@synopackageland/cli 0.34.0 → 0.35.0

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.35.0 (2026-10-29)
+
+- Audit the target Linux import graphs of configured Go binaries rather than
+  recursively scanning unshipped development commands.
+- Accept fixed, permission-declared `api.HandleHTTP` routes and package-private
+  `ipc.ServeUnix` handler graphs with SDK 0.33.0. Reject direct listeners and
+  unregistered handlers even when an IPC handler is reused.
+- Bind the raw HTTP prefix inventory and package IPC identity into each Go
+  binary. Repeat source validation after UI hooks. Retain executor 0.32.0 bytes
+  and templates 0.32.0.
+
 ## 0.34.0 (2026-10-29)
 
 - Enforce explicit App entry and reject undeclared App methods, dynamic route

package/README.md

@@ -74,15 +74,18 @@ alongside npm lockfiles. Do not disable checksum verification for public SDK
 packages. Private mirrors can use explicitly configured Go authentication and
 checksum settings; a failed fetch reports `SDK_DOWNLOAD_FAILED`.
 
-CLI 0.34.0 uses templates 0.32.0 and SDK 0.32.0. Compose import and SDK defaults
+CLI 0.35.0 uses templates ~0.32.0, whose default SDK pin remains 0.32.0. Compose import and SDK defaults
 read the SDK pin from the installed templates; explicit App SDK declarations take precedence.
 Every App method must be declared in the permissions table. Dynamic names and
-custom HTTP dispatchers are rejected; use fixed SDK route constructors and
+custom HTTP dispatchers are rejected. With SDK 0.33.0, use fixed
+`api.HandleHTTP` prefixes for authorized raw HTTP and `ipc.ServeUnix` for private
+package Unix sockets. The audit follows each shipped Linux binary's import graph;
+unimported development commands are excluded. Use
 `identity_gateway.upstream_auth_paths` for client API paths that use upstream
 authentication. See [App entry and registration](docs/app-entry.md).
 
 `init` and `add` read their templates from the locally installed
-`@synopackageland/templates`. CLI 0.34.0 depends on `~0.32.0`: npm installation or
+`@synopackageland/templates`. CLI 0.35.0 depends on `~0.32.0`: npm installation or
 update can select the latest templates patch in the 0.32 minor line. Templates
 patches need only a templates release; update the npm installation to receive them.
 The CLI never fetches templates at runtime, so offline use works after installation;

package/assets/go/route-audit/main.go

@@ -2,26 +2,302 @@
 package main
 
 import (
+	"bytes"
 	"encoding/json"
 	"fmt"
 	"go/ast"
 	"go/parser"
 	"go/token"
+	"io"
 	"os"
+	"os/exec"
 	"path/filepath"
+	"regexp"
+	"sort"
 	"strconv"
 	"strings"
 )
 
 type input struct {
 	Dir         string
+	Roots       []string
+	Arches      []string
 	Permissions map[string]string
 	SDK         map[string]map[string]string
 }
 
 type result struct {
-	Problems  []string `json:"problems"`
-	EntryGate bool     `json:"entryGate"`
+	Problems   []string    `json:"problems"`
+	EntryGate  bool        `json:"entryGate"`
+	HTTPRoutes []httpRoute `json:"httpRoutes"`
+}
+
+type httpRoute struct {
+	Prefix string `json:"prefix"`
+	Method string `json:"method"`
+}
+
+const sdkModule = "github.com/synopackageland/syno-pkg-land-sdk"
+
+// Resolve target build constraints without running any application code.
+func shippedFiles(in input) (map[string]string, error) {
+	files := map[string]string{}
+	if _, err := os.Stat(filepath.Join(in.Dir, "go.mod")); os.IsNotExist(err) {
+		matches, err := filepath.Glob(filepath.Join(in.Dir, "*.go"))
+		for _, path := range matches {
+			if !strings.HasSuffix(path, "_test.go") {
+				files[path] = "fixture"
+			}
+		}
+		return files, err
+	}
+	roots, arches := in.Roots, in.Arches
+	if len(roots) == 0 {
+		roots = []string{"."}
+	}
+	if len(arches) == 0 {
+		arches = []string{"amd64", "arm64", "arm"}
+	}
+	for _, arch := range arches {
+		cmd := exec.Command("go", append([]string{"list", "-e", "-mod=readonly", "-deps", "-json"}, roots...)...)
+		cmd.Dir = in.Dir
+		cmd.Env = append(os.Environ(), "GOOS=linux", "GOARCH="+arch, "GOARM=7", "CGO_ENABLED=0", "GOWORK=off", "GOFLAGS=")
+		raw, err := cmd.Output()
+		if err != nil {
+			return nil, fmt.Errorf("cannot resolve shipped Go import graph")
+		}
+		d := json.NewDecoder(bytes.NewReader(raw))
+		for {
+			var p struct {
+				Dir, ImportPath string
+				GoFiles         []string
+				Standard        bool
+				DepOnly         bool
+				Error           *struct{ Err string }
+				Module          *struct {
+					Main    bool
+					Replace *struct{ Dir string }
+				}
+			}
+			err := d.Decode(&p)
+			if err == io.EOF {
+				break
+			}
+			if err != nil {
+				return nil, err
+			}
+			if !p.DepOnly && p.Error != nil {
+				return nil, fmt.Errorf("cannot resolve a configured shipped Go root")
+			}
+			if p.Standard || p.ImportPath == sdkModule || strings.HasPrefix(p.ImportPath, sdkModule+"/") {
+				continue
+			}
+			if p.Module == nil || !p.Module.Main && p.Module.Replace == nil {
+				continue
+			}
+			for _, name := range p.GoFiles {
+				files[filepath.Join(p.Dir, name)] = p.ImportPath
+			}
+		}
+	}
+	if len(files) == 0 {
+		return nil, fmt.Errorf("shipped Go roots contain no auditable source")
+	}
+	return files, nil
+}
+
+func stringLiteral(expr ast.Expr) string {
+	if v, ok := expr.(*ast.BasicLit); ok && v.Kind == token.STRING {
+		s, _ := strconv.Unquote(v.Value)
+		return s
+	}
+	return ""
+}
+
+type source struct {
+	file      *ast.File
+	path, pkg string
+	imports   map[string]string
+}
+
+// Follow the handler argument through local declarations and factories. A
+// boundary never exempts an entire directory, file, or any listener primitive.
+func boundaryHandlers(sources []source) map[ast.Node]bool {
+	decls := map[string][]ast.Node{}
+	owners := map[ast.Node]source{}
+	for _, s := range sources {
+		ast.Inspect(s.file, func(n ast.Node) bool {
+			if n != nil {
+				owners[n] = s
+			}
+			return true
+		})
+		for _, decl := range s.file.Decls {
+			switch d := decl.(type) {
+			case *ast.FuncDecl:
+				key := s.pkg + "." + d.Name.Name
+				if d.Recv != nil {
+					t := d.Recv.List[0].Type
+					if v, ok := t.(*ast.StarExpr); ok {
+						t = v.X
+					}
+					if v, ok := t.(*ast.Ident); ok {
+						key = s.pkg + "." + v.Name
+					}
+				}
+				decls[key] = append(decls[key], d)
+			case *ast.GenDecl:
+				for _, spec := range d.Specs {
+					switch v := spec.(type) {
+					case *ast.TypeSpec:
+						decls[s.pkg+"."+v.Name.Name] = append(decls[s.pkg+"."+v.Name.Name], v)
+					case *ast.ValueSpec:
+						for _, name := range v.Names {
+							decls[s.pkg+"."+name.Name] = append(decls[s.pkg+"."+name.Name], v)
+						}
+					}
+				}
+			}
+		}
+	}
+	safe, visited := map[ast.Node]bool{}, map[ast.Node]bool{}
+	var mark func(ast.Node)
+	mark = func(root ast.Node) {
+		if root == nil || visited[root] {
+			return
+		}
+		visited[root] = true
+		s := owners[root]
+		ast.Inspect(root, func(n ast.Node) bool {
+			if n == nil {
+				return false
+			}
+			safe[n] = true
+			key := ""
+			switch v := n.(type) {
+			case *ast.Ident:
+				key = s.pkg + "." + v.Name
+				if v.Obj != nil {
+					if d, ok := v.Obj.Decl.(ast.Node); ok {
+						mark(d)
+					}
+				}
+			case *ast.SelectorExpr:
+				if id, ok := v.X.(*ast.Ident); ok {
+					key = s.imports[id.Name] + "." + v.Sel.Name
+				}
+			}
+			for _, decl := range decls[key] {
+				mark(decl)
+			}
+			return true
+		})
+	}
+	for _, s := range sources {
+		ast.Inspect(s.file, func(n ast.Node) bool {
+			call, ok := n.(*ast.CallExpr)
+			if !ok || len(call.Args) != 3 {
+				return true
+			}
+			sel, ok := call.Fun.(*ast.SelectorExpr)
+			if !ok {
+				return true
+			}
+			id, ok := sel.X.(*ast.Ident)
+			if ok && (s.imports[id.Name] == sdkModule+"/api" && sel.Sel.Name == "HandleHTTP" ||
+				s.imports[id.Name] == sdkModule+"/ipc" && sel.Sel.Name == "ServeUnix") {
+				mark(call.Args[2])
+			}
+			return true
+		})
+	}
+	return safe
+}
+
+// A handler admitted to a private/raw boundary cannot also be installed as
+// the CGI root. SDK server construction ends this search because it gates
+// its registered routes before invoking their handlers.
+func reusesBoundary(expr ast.Node, owner source, sources []source, safe map[ast.Node]bool, seen map[ast.Node]bool) bool {
+	if expr == nil || seen[expr] {
+		return false
+	}
+	seen[expr] = true
+	imports := owner.imports
+	if call, ok := expr.(*ast.CallExpr); ok {
+		if sel, ok := call.Fun.(*ast.SelectorExpr); ok {
+			if id, ok := sel.X.(*ast.Ident); ok && imports[id.Name] == sdkModule+"/api" {
+				switch sel.Sel.Name {
+				case "NewServerWithPermissions":
+					return false
+				case "WithRequestDeadline", "WithDescription":
+					return len(call.Args) > 0 && reusesBoundary(call.Args[0], owner, sources, safe, seen)
+				}
+			}
+		}
+	}
+	found := false
+	ast.Inspect(expr, func(n ast.Node) bool {
+		if n == nil || found {
+			return false
+		}
+		if n != expr {
+			if _, ok := n.(*ast.CallExpr); ok {
+				found = reusesBoundary(n, owner, sources, safe, seen)
+				return false
+			}
+		}
+		targetPackage, targetName := "", ""
+		if id, ok := n.(*ast.Ident); ok {
+			if id.Obj != nil {
+				if decl, ok := id.Obj.Decl.(ast.Node); ok {
+					found = safe[decl] || reusesBoundary(decl, owner, sources, safe, seen)
+				}
+			} else {
+				targetPackage, targetName = owner.pkg, id.Name
+			}
+		}
+		if selector, ok := n.(*ast.SelectorExpr); ok {
+			if pkg, ok := selector.X.(*ast.Ident); ok {
+				targetPackage, targetName = imports[pkg.Name], selector.Sel.Name
+			}
+		}
+		if targetPackage != "" {
+			for _, candidate := range sources {
+				if candidate.pkg != targetPackage {
+					continue
+				}
+				for _, decl := range candidate.file.Decls {
+					var target ast.Node
+					switch d := decl.(type) {
+					case *ast.FuncDecl:
+						if d.Recv == nil && d.Name.Name == targetName {
+							target = d
+						}
+					case *ast.GenDecl:
+						for _, spec := range d.Specs {
+							switch v := spec.(type) {
+							case *ast.TypeSpec:
+								if v.Name.Name == targetName {
+									target = v
+								}
+							case *ast.ValueSpec:
+								for _, name := range v.Names {
+									if name.Name == targetName {
+										target = v
+									}
+								}
+							}
+						}
+					}
+					if target != nil && (safe[target] || reusesBoundary(target, candidate, sources, safe, seen)) {
+						found = true
+					}
+				}
+			}
+		}
+		return !found
+	})
+	return found
 }
 
 func main() {
@@ -30,7 +306,7 @@ func main() {
 		fmt.Fprintln(os.Stderr, err)
 		os.Exit(1)
 	}
-	out := result{Problems: []string{}}
+	out := result{Problems: []string{}, HTTPRoutes: []httpRoute{}}
 	sdk := map[string]bool{}
 	for _, group := range in.SDK {
 		for method := range group {
@@ -38,50 +314,55 @@ func main() {
 		}
 	}
 	set := token.NewFileSet()
-	err := filepath.WalkDir(in.Dir, func(path string, d os.DirEntry, err error) error {
+	files, err := shippedFiles(in)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+	var sources []source
+	for path, pkg := range files {
+		file, err := parser.ParseFile(set, path, nil, 0)
 		if err != nil {
-			return err
-		}
-		if d.IsDir() {
-			if path != in.Dir && (strings.HasPrefix(d.Name(), ".") || d.Name() == "vendor" || d.Name() == "node_modules") {
-				return filepath.SkipDir
-			}
-			return nil
+			fmt.Fprintln(os.Stderr, "invalid shipped Go source")
+			os.Exit(1)
 		}
-		if d.Type()&os.ModeSymlink != 0 {
-			target, err := os.Stat(path)
-			if err == nil && target.IsDir() {
-				shown, _ := filepath.Rel(in.Dir, path)
-				out.Problems = append(out.Problems, filepath.ToSlash(shown)+":0: Go source directories cannot be symlinks")
-				return nil
+		imports := map[string]string{}
+		for _, spec := range file.Imports {
+			module, _ := strconv.Unquote(spec.Path.Value)
+			alias := filepath.Base(module)
+			if spec.Name != nil {
+				alias = spec.Name.Name
 			}
+			imports[alias] = module
 		}
-		if !strings.HasSuffix(path, ".go") || strings.HasSuffix(path, "_test.go") {
-			return nil
-		}
+		sources = append(sources, source{file, path, pkg, imports})
+	}
+	safe := boundaryHandlers(sources)
+	for _, src := range sources {
+		path, file, imports := src.path, src.file, src.imports
 		shown, _ := filepath.Rel(in.Dir, path)
 		problem := func(pos token.Pos, message string) {
 			out.Problems = append(out.Problems, fmt.Sprintf("%s:%d: %s", filepath.ToSlash(shown), set.Position(pos).Line, message))
 		}
-		if d.Type()&os.ModeSymlink != 0 {
+		d, err := os.Lstat(path)
+		if err != nil || d.Mode()&os.ModeSymlink != 0 {
 			problem(token.NoPos, "Go source symlinks cannot be audited")
-			return nil
+			continue
 		}
-		file, err := parser.ParseFile(set, path, nil, 0)
-		if err != nil {
-			return fmt.Errorf("%s: invalid Go source", shown)
+		for dir := filepath.Dir(path); dir != filepath.Dir(dir); dir = filepath.Dir(dir) {
+			info, err := os.Lstat(dir)
+			if err == nil && info.Mode()&os.ModeSymlink != 0 {
+				problem(token.NoPos, "Go source directories cannot be symlinks")
+				break
+			}
+			if dir == in.Dir {
+				break
+			}
 		}
-		imports := map[string]string{}
 		for _, spec := range file.Imports {
-			module, _ := strconv.Unquote(spec.Path.Value)
-			alias := filepath.Base(module)
-			if spec.Name != nil {
-				alias = spec.Name.Name
-			}
-			if alias == "." {
+			if spec.Name != nil && spec.Name.Name == "." {
 				problem(spec.Pos(), "dot imports cannot be audited")
 			}
-			imports[alias] = module
 		}
 		constants := map[string]string{}
 		direct := map[*ast.SelectorExpr]bool{}
@@ -108,25 +389,36 @@ func main() {
 			}
 		}
 		ast.Inspect(file, func(n ast.Node) bool {
-			if fn, ok := n.(*ast.FuncDecl); ok && fn.Recv != nil && fn.Name.Name == "ServeHTTP" {
-				problem(fn.Pos(), "custom ServeHTTP bypasses the SDK registry; use api.HandleRequest, HandleResponse or HandleStream")
+			if fn, ok := n.(*ast.FuncDecl); ok && fn.Recv != nil && fn.Name.Name == "ServeHTTP" && !safe[n] {
+				problem(fn.Pos(), "unregistered ServeHTTP; use api.HandleHTTP or ipc.ServeUnix")
 			}
 			selector, ok := n.(*ast.SelectorExpr)
 			if !ok {
 				return true
 			}
+			if selector.Sel.Name == "ServeHTTP" && !safe[n] {
+				problem(selector.Pos(), "unregistered ServeHTTP dispatch")
+			}
 			pkg, ok := selector.X.(*ast.Ident)
 			if !ok {
 				return true
 			}
 			module := imports[pkg.Name]
 			name := selector.Sel.Name
+			if module == "net" && (strings.HasPrefix(name, "Listen") || name == "FileListener" || name == "FilePacketConn") ||
+				module == "crypto/tls" && name == "Listen" ||
+				(module == "syscall" || module == "golang.org/x/sys/unix") && (name == "Bind" || name == "Listen" || name == "Socket") {
+				problem(selector.Pos(), "custom listener outside SDK boundaries: "+name)
+			}
+			if module == sdkModule+"/ipc" && name == "ServeUnix" && !direct[selector] {
+				problem(selector.Pos(), "IPC constructor aliases cannot be audited")
+			}
 			if module == "github.com/synopackageland/syno-pkg-land-sdk/idgateway" && (name == "NewFront" || name == "Build" || name == "Run") {
 				problem(selector.Pos(), "gateway listeners must use identity_gateway in the manifest; upstream_auth_paths never exempts SDK RPC or custom HTTP handlers")
 			}
 			if module == "github.com/synopackageland/syno-pkg-land-sdk/api" {
 				switch name {
-				case "Handle", "HandleRequest", "HandleResponse", "HandleStream", "HandleRequestBatch":
+				case "Handle", "HandleRequest", "HandleResponse", "HandleStream", "HandleRequestBatch", "HandleHTTP":
 					if !direct[selector] {
 						problem(selector.Pos(), "route constructor aliases cannot be audited; register methods directly")
 					}
@@ -134,8 +426,20 @@ func main() {
 			}
 			if module == "net/http" {
 				switch name {
-				case "Handle", "HandleFunc", "HandlerFunc", "NewServeMux", "Server", "Serve", "ServeTLS", "ListenAndServe", "ListenAndServeTLS":
+				case "Handle", "HandleFunc", "Server", "Serve", "ServeTLS", "ListenAndServe", "ListenAndServeTLS":
 					problem(selector.Pos(), "HTTP handler outside the SDK registry: "+name)
+				case "HandlerFunc", "NewServeMux", "ServeMux", "FileServer", "FileServerFS", "StripPrefix", "TimeoutHandler", "NotFoundHandler", "RedirectHandler":
+					if !safe[n] {
+						problem(selector.Pos(), "HTTP handler outside the SDK registry: "+name)
+					}
+				}
+			}
+			if module == "net/http/httputil" && (name == "ReverseProxy" || name == "NewSingleHostReverseProxy") && !safe[n] {
+				problem(selector.Pos(), "HTTP proxy outside the SDK registry")
+			}
+			if module == "net/http/cgi" && name == "Serve" {
+				if !direct[selector] {
+					problem(selector.Pos(), "CGI constructor aliases cannot be audited")
 				}
 			}
 			return true
@@ -154,6 +458,9 @@ func main() {
 				return true
 			}
 			module := imports[pkg.Name]
+			if module == "net/http/cgi" && selector.Sel.Name == "Serve" && len(call.Args) > 0 && reusesBoundary(call.Args[0], src, sources, safe, map[ast.Node]bool{}) {
+				problem(call.Pos(), "private or raw HTTP handler reused outside its SDK boundary")
+			}
 			if module == "github.com/synopackageland/syno-pkg-land-sdk/dsm" && selector.Sel.Name == "NewEntryGate" {
 				out.EntryGate = true
 			}
@@ -161,13 +468,17 @@ func main() {
 				return true
 			}
 			switch selector.Sel.Name {
-			case "Handle", "HandleRequest", "HandleResponse", "HandleStream", "HandleRequestBatch":
+			case "Handle", "HandleRequest", "HandleResponse", "HandleStream", "HandleRequestBatch", "HandleHTTP":
 			default:
 				return true
 			}
 			method := ""
-			if len(call.Args) > 0 {
-				switch arg := call.Args[0].(type) {
+			index := 0
+			if selector.Sel.Name == "HandleHTTP" {
+				index = 1
+			}
+			if len(call.Args) > index {
+				switch arg := call.Args[index].(type) {
 				case *ast.BasicLit:
 					if arg.Kind == token.STRING {
 						method, _ = strconv.Unquote(arg.Value)
@@ -181,14 +492,34 @@ func main() {
 			} else if _, declared := in.Permissions[method]; !declared && !sdk[method] {
 				problem(call.Pos(), "registered method missing from permissions.json: "+method)
 			}
+			if selector.Sel.Name == "HandleHTTP" {
+				prefix := ""
+				if len(call.Args) > 0 {
+					prefix = stringLiteral(call.Args[0])
+				}
+				if !regexp.MustCompile(`^/([A-Za-z0-9_-]+/)+$`).MatchString(prefix) {
+					problem(call.Pos(), "HTTP prefix must be a fixed literal full-segment path ending in /")
+				}
+				for _, reserved := range []string{"/_sso/", "/_spl/", "/api/", "/api.cgi/", "/rpc/", "/webman/", "/cgi/"} {
+					if strings.HasPrefix(prefix, reserved) || strings.HasPrefix(reserved, prefix) {
+						problem(call.Pos(), "HTTP prefix overlaps a reserved path")
+					}
+				}
+				if sdk[method] || in.Permissions[method] != "authenticated" && in.Permissions[method] != "administrators" {
+					problem(call.Pos(), "HTTP routes require an explicit App authenticated or administrators permission")
+				}
+				for _, other := range out.HTTPRoutes {
+					if strings.HasPrefix(prefix, other.Prefix) || strings.HasPrefix(other.Prefix, prefix) {
+						problem(call.Pos(), "HTTP prefixes must not overlap")
+					}
+				}
+				out.HTTPRoutes = append(out.HTTPRoutes, httpRoute{prefix, method})
+			}
 			return true
 		})
-		return nil
-	})
-	if err != nil {
-		fmt.Fprintln(os.Stderr, err)
-		os.Exit(1)
 	}
+	sort.Strings(out.Problems)
+	sort.Slice(out.HTTPRoutes, func(i, j int) bool { return out.HTTPRoutes[i].Prefix < out.HTTPRoutes[j].Prefix })
 	if err := json.NewEncoder(os.Stdout).Encode(out); err != nil {
 		os.Exit(1)
 	}

package/dist/standalone/api-description.js

@@ -33,6 +33,7 @@ export async function buildApiDescription(m, bridgeMethods, run) {
     if (!Array.isArray(methods) || methods.some(item => typeof item.method !== 'string' || typeof item.permission !== 'string'))
         throw new StandaloneBuildError('CTL_DESCRIBE_FAILED', 'Invalid registry snapshot.');
     const registry = new Map(methods.map(item => [item.method, item.permission]));
+    const rawHTTP = new Set(methods.filter(item => item.kind === 'http').map(item => item.method));
     // Identity transport routes are outside the business registry but have immutable SDK ownership.
     if (m.capabilities.identity) {
         registry.set('identity.session', 'public');
@@ -46,6 +47,8 @@ export async function buildApiDescription(m, bridgeMethods, run) {
         const names = flowMethods(command.flow);
         let permission = 'public';
         for (const name of names) {
+            if (rawHTTP.has(name))
+                throw new StandaloneBuildError('CTL_COMMAND_UNREGISTERED', `Command ${id} references raw HTTP route ${name}; ctl commands require RPC methods.`);
             if (!registry.has(name))
                 throw new StandaloneBuildError('CTL_COMMAND_UNREGISTERED', `Command ${id} references unregistered method ${name}.`);
             const effective = m.entry === 'admin-only' ? 'administrators' : registry.get(name);

package/dist/standalone/build.js

@@ -1,5 +1,5 @@
 import { buildInstallSettings } from './install-settings.js';
-import { auditGoRoutes } from './route-audit.js';
+import { auditGoRoutes, httpRoutesDigest } from './route-audit.js';
 import { PORTAL_REQUIRES_EXECUTOR } from "../portal/alias.js";
 import { buildApiDescription } from "./api-description.js";
 import { goChildEnv } from "../runtime/go-env.js";
@@ -234,7 +234,7 @@ async function buildGoCgi(manifest, backend, arch, work, run) {
         throw new StandaloneBuildError("STANDALONE_API_PERMISSIONS_CHANGED", "API permissions changed during build; check and rebuild.");
     }
     const policy = readApiPermissions(backend, manifest.capabilities);
-    const audit = auditGoRoutes(backend.dir, policy.policy, policy.sdk);
+    const audit = auditGoRoutes(backend.dir, policy.policy, policy.sdk, [backend.main], [goBuildEnv(arch).GOARCH]);
     if (audit.problems.length || manifest.entry && !audit.entryGate) {
         throw new StandaloneBuildError("STANDALONE_API_REGISTRY_INVALID", audit.problems.join("\n") || "App entry gate was removed during build.");
     }
@@ -252,6 +252,8 @@ async function buildGoCgi(manifest, backend, arch, work, run) {
         `-X ${module}/internal/api.expectedPermissionsDigest=${manifest.apiPermissionsDigest}`,
         `-X ${SDK_MODULE}/api.expectedSDKPermissionsDigest=${manifest.apiSDKPermissionsDigest}`,
         `-X ${SDK_MODULE}/api.expectedPermissionsDigest=${manifest.apiPermissionsDigest}`,
+        `-X ${SDK_MODULE}/api.expectedHTTPRoutesDigest=${httpRoutesDigest(audit)}`,
+        `-X ${SDK_MODULE}/ipc.packageID=${manifest.package}`,
         ...(manifest.entry ? [`-X ${SDK_MODULE}/api.expectedEntryMode=${manifest.entry}`] : []),
         ...delegateBuildFlags(manifest),
         ...(manifest.executor
@@ -302,11 +304,20 @@ async function buildBackgroundWorker(manifest, arch, work, run) {
     if (!manifest.capabilities.jobs || manifest.backend.kind !== "go")
         return undefined;
     const out = join(work, `background-worker-${arch}`);
+    const policy = readApiPermissions(manifest.backend, manifest.capabilities);
+    const audit = auditGoRoutes(manifest.backend.dir, policy.policy, policy.sdk, [BACKGROUND_WORKER_MAIN], [goBuildEnv(arch).GOARCH]);
+    if (audit.problems.length)
+        throw new StandaloneBuildError("STANDALONE_API_REGISTRY_INVALID", audit.problems.join("\n"));
     const ldflags = [
         "-s",
         "-w",
         "-buildid=",
         `-X main.packageID=${manifest.package}`,
+        `-X ${SDK_MODULE}/ipc.packageID=${manifest.package}`,
+        `-X ${SDK_MODULE}/api.expectedHTTPRoutesDigest=${httpRoutesDigest(audit)}`,
+        `-X ${SDK_MODULE}/api.expectedPermissionsDigest=${manifest.apiPermissionsDigest}`,
+        `-X ${SDK_MODULE}/api.expectedSDKPermissionsDigest=${manifest.apiSDKPermissionsDigest}`,
+        ...(manifest.entry ? [`-X ${SDK_MODULE}/api.expectedEntryMode=${manifest.entry}`] : []),
         ...delegateBuildFlags(manifest),
         ...(manifest.executor
             ? [

package/dist/standalone/manifest.js

@@ -1,5 +1,6 @@
 import { readInstallSettings } from './install-settings.js';
 import { auditGoRoutes } from './route-audit.js';
+import { BACKGROUND_WORKER_MAIN } from './background.js';
 import { isWebLaunchMode } from "../contract/web-launch.js";
 import { validWebAPIProfiles, } from "../runtime/webapi-profile.js";
 import { validateMetadata } from "../package-metadata.js";
@@ -354,11 +355,18 @@ function readManifest(raw, c) {
     }
     if (backend?.kind === "go" && permissions && sdkVersionOrUndefined(backend) && (raw.entry === undefined || entry)) {
         try {
-            const audit = auditGoRoutes(backend.dir, permissions.policy, permissions.sdk);
-            for (const problem of audit.problems)
+            const problems = new Set();
+            for (const main of [backend.main, ...(capabilities.jobs ? [BACKGROUND_WORKER_MAIN] : [])]) {
+                for (const arch of arches ?? []) {
+                    const audit = auditGoRoutes(backend.dir, permissions.policy, permissions.sdk, [main], [({ x86_64: 'amd64', aarch64: 'arm64', armv7: 'arm' })[arch]]);
+                    for (const problem of audit.problems)
+                        problems.add(problem);
+                    if (main === backend.main && entry && !audit.entryGate)
+                        c.fail("STANDALONE_ENTRY_UNSUPPORTED", "App entry requires an actual dsm.NewEntryGate call; comments do not enforce admission.");
+                }
+            }
+            for (const problem of problems)
                 c.fail("STANDALONE_API_REGISTRY_INVALID", problem);
-            if (entry && !audit.entryGate)
-                c.fail("STANDALONE_ENTRY_UNSUPPORTED", "App entry requires an actual dsm.NewEntryGate call; comments do not enforce admission.");
         }
         catch (error) {
             c.fail("STANDALONE_API_REGISTRY_INVALID", error.message);

package/dist/standalone/route-audit.d.ts

@@ -1,6 +1,12 @@
 import type { ApiPermissions } from './api-permissions.js';
-/** Parse Go syntax without executing an App's main, init functions or --describe. */
-export declare function auditGoRoutes(dir: string, policy: ApiPermissions, sdk: Record<string, Record<string, string>>): {
+export interface RouteAudit {
     problems: string[];
     entryGate: boolean;
-};
+    httpRoutes: {
+        prefix: string;
+        method: string;
+    }[];
+}
+export declare function httpRoutesDigest(audit: RouteAudit): string;
+/** Parse Go syntax without executing an App's main, init functions or --describe. */
+export declare function auditGoRoutes(dir: string, policy: ApiPermissions, sdk: Record<string, Record<string, string>>, roots?: string[], arches?: string[]): RouteAudit;

package/dist/standalone/route-audit.js

@@ -1,12 +1,16 @@
 import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
 import { mkdtempSync, rmSync, realpathSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { goChildEnv } from '../runtime/go-env.js';
 let binary;
+export function httpRoutesDigest(audit) {
+    return createHash('sha256').update(JSON.stringify(audit.httpRoutes)).digest('hex');
+}
 /** Parse Go syntax without executing an App's main, init functions or --describe. */
-export function auditGoRoutes(dir, policy, sdk) {
+export function auditGoRoutes(dir, policy, sdk, roots = ['.'], arches = ['amd64', 'arm64', 'arm']) {
     const env = goChildEnv({ ...process.env, GOOS: undefined, GOARCH: undefined, GOARM: undefined, GOWORK: 'off', CGO_ENABLED: '0' });
     if (!binary) {
         const work = mkdtempSync(join(tmpdir(), 'synopkgland-route-audit-'));
@@ -18,7 +22,7 @@ export function auditGoRoutes(dir, policy, sdk) {
             throw new Error('Cannot build the Go route auditor; install Go and retry.');
         binary = out;
     }
-    const result = spawnSync(binary, [], { env, input: JSON.stringify({ Dir: realpathSync(dir), Permissions: policy.methods, SDK: sdk }), encoding: 'utf8', timeout: 30_000, maxBuffer: 4 << 20 });
+    const result = spawnSync(binary, [], { env, input: JSON.stringify({ Dir: realpathSync(dir), Roots: roots, Arches: arches, Permissions: policy.methods, SDK: sdk }), encoding: 'utf8', timeout: 120_000, maxBuffer: 4 << 20 });
     if (result.error || result.status !== 0)
         throw new Error(`Cannot audit Go routes: ${result.stderr?.trim() || 'auditor unavailable'}`);
     return JSON.parse(result.stdout);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.34.0",
+  "version": "0.35.0",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {

package/skills/SKILL.md

@@ -5,7 +5,7 @@ description: Initialize, extend, check, build, inspect, and deploy Synology appl
 
 # Independent Synology SPKs
 
-CLI 0.33.1 installs templates through `~0.31.0`. A templates patch needs only a
+CLI 0.35.0 installs templates through `~0.32.0`. A templates patch needs only a
 templates release; npm install/update selects a patch in that minor line. The CLI
 uses the locally installed templates and reads their SDK pin for defaults; it
 never downloads templates at runtime. Preserve the lockfile and use `npm ci` for
@@ -24,12 +24,22 @@ Use this guide to initialize, build and inspect own applications or upstream OSS
 
 For an existing open-source App, first read [reference/upstream-fork.md](reference/upstream-fork.md): upstream fork/history + untouched upstream files + all packaging in `synology/`, official container images pinned by tag/index digest, native official release binaries pinned by SHA-256 or a source build hook, and a single tag-merge upgrade command. Use `init --upstream-fork`; never rewrite the App as a component. Integrated upstream Apps require direct DSM administrator entry without a separate App password or an OIDC/SSO server: supported trusted headers first, disabling native login second; the shipped OpenList pattern uses the existing SDK 0.17.3 token adapter (`mode: token`, `access: dsm-admins`, `entry: admin-only`) with server-side Authorization injection. All DSM admins share one upstream admin; token reset requires package restart; WebDAV retains its native credentials.
 
-Use SDK 0.32.0 and CLI 0.34.0 for App entry enforcement. Declare every App method
-in the permissions table; dynamic names and custom HTTP dispatchers are rejected.
+Use SDK 0.33.0 and CLI 0.35.0 for App entry enforcement. Declare every App method
+in the permissions table; dynamic names and unregistered HTTP dispatchers are rejected.
 Use fixed SDK routes and `identity_gateway.upstream_auth_paths` for client API
 paths that rely on upstream authentication. Read
 [reference/identity.md](reference/identity.md) and
 [reference/identity-gateway.md](reference/identity-gateway.md) before migration.
+For private worker HTTP, use `ipc.ServeUnix(ctx, path, handler)` and
+`ipc.DialUnix`, never a custom listener. The helper requires an owned mode-0600
+socket under the package's private `var/run`. For browser proxies, streams or
+initial upgrades, register `api.HandleHTTP("/proxy/", "app.proxy", handler)`
+in the same API registry and declare the method as authenticated or
+administrators. Prefixes are literal, disjoint full segments outside reserved
+SDK paths. Origin, entry, identity and permission checks still apply. CGI
+cannot upgrade a connection; use an existing upgrade-capable deployment
+transport. The audit follows each configured Go binary's Linux import graph,
+including declared workers; unshipped dev commands are excluded.
 
 **If you package someone else's open-source project, set `maintainer` to the
 original project/owner (prefer the project's own team/org name, else the owner's