@synopackageland/cli 0.34.0 → 0.36.0

package/skills/SKILL.md

@@ -5,7 +5,7 @@ description: Initialize, extend, check, build, inspect, and deploy Synology appl
 
 # Independent Synology SPKs
 
-CLI 0.33.1 installs templates through `~0.31.0`. A templates patch needs only a
+CLI 0.36.0 installs templates through `~0.32.0`. A templates patch needs only a
 templates release; npm install/update selects a patch in that minor line. The CLI
 uses the locally installed templates and reads their SDK pin for defaults; it
 never downloads templates at runtime. Preserve the lockfile and use `npm ci` for
@@ -24,12 +24,52 @@ Use this guide to initialize, build and inspect own applications or upstream OSS
 
 For an existing open-source App, first read [reference/upstream-fork.md](reference/upstream-fork.md): upstream fork/history + untouched upstream files + all packaging in `synology/`, official container images pinned by tag/index digest, native official release binaries pinned by SHA-256 or a source build hook, and a single tag-merge upgrade command. Use `init --upstream-fork`; never rewrite the App as a component. Integrated upstream Apps require direct DSM administrator entry without a separate App password or an OIDC/SSO server: supported trusted headers first, disabling native login second; the shipped OpenList pattern uses the existing SDK 0.17.3 token adapter (`mode: token`, `access: dsm-admins`, `entry: admin-only`) with server-side Authorization injection. All DSM admins share one upstream admin; token reset requires package restart; WebDAV retains its native credentials.
 
-Use SDK 0.32.0 and CLI 0.34.0 for App entry enforcement. Declare every App method
-in the permissions table; dynamic names and custom HTTP dispatchers are rejected.
+Use SDK/App 0.34.0 and CLI 0.36.0 for App entry enforcement. Declare every App method
+in the permissions table; dynamic names and unregistered HTTP dispatchers are rejected.
 Use fixed SDK routes and `identity_gateway.upstream_auth_paths` for client API
 paths that rely on upstream authentication. Read
 [reference/identity.md](reference/identity.md) and
 [reference/identity-gateway.md](reference/identity-gateway.md) before migration.
+For private worker HTTP, use `ipc.ServeUnix(ctx, path, handler)` and
+`ipc.DialUnix`, never a custom listener. The helper requires an owned mode-0600
+socket under the package's private `var/run`. For browser proxies, streams or
+initial upgrades, register `api.HandleHTTP("/proxy/", "app.proxy", handler)`
+in the same API registry and declare the method as authenticated or
+administrators. Prefixes are literal, disjoint full segments outside reserved
+SDK paths. Origin, entry, identity and permission checks still apply. CGI
+cannot upgrade a connection; use an existing upgrade-capable deployment
+transport. The audit follows each configured Go binary's Linux import graph,
+including declared workers; unshipped dev commands are excluded.
+
+Use `ipc.StartUnix(ctx, path, handler)` for multiple private data-plane sockets.
+Each direct `.sock` child of the package `var/run` gets an independent handle
+with Close, Shutdown and Wait. Stop/revoke closes active streams and hijacked
+connections, including WebSocket; keep target approval and pin checks in the
+handler. A private socket may serve the upstream root path without CGI.
+For official supervised children use `ipc.ReserveLoopback(ctx, 0)` to hold a
+127.0.0.1 TCP port, read Port/Address and Release immediately before starting
+the child. `ipc.ProbeLoopback(ctx, port)` checks a specific port without
+retaining it. Check child readiness and retry bind conflicts: release-to-bind
+is inherently racy. Never replace these with custom listeners or fixed ports.
+
+An optional root helper is a separately approved executor payload.
+`ipc.ServePeerUnix(ctx, path, ipc.PeerPolicy{UID: uid, GID: gid}, handler)`
+supports a bounded raw JSON control protocol on a root-owned 0660 socket under
+`/var/run/synopkgland/<package>/`. The SDK authenticates exactly the selected
+UID with SO_PEERCRED; the handler validates bounded frames and current
+authorization. `ipc.DialPeerUnix` verifies root ownership, protected ancestors,
+mode and server UID zero. The server requires root AND the helper's explicit
+`ipc.executorTier=executor` linker binding. Bind packageID in custom builds.
+Generated CGI/workers bind tier `none`; never launch or install them as root.
+The transport does not provide installation, approval or privilege elevation.
+
+Audit every custom-hook Go payload with
+`synopkgland audit-entry ./cmd/helper --dir backend --arch amd64,arm64,arm --json`
+before packaging. Use `--permissions` when it registers App methods.
+Each entry is checked against its actual target import graph, including every
+file of shared packages. Unused server functions have no exemption. Use real
+client/server packages or supported SDK boundaries; no App allowlists, hidden
+directories, aliases or ABI workarounds.
 
 **If you package someone else's open-source project, set `maintainer` to the
 original project/owner (prefer the project's own team/org name, else the owner's