@synopackageland/cli 0.37.0 → 0.38.0

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.38.0 (2026-10-29)
+
+- Audit direct `ipc.StartPeerUnix` calls and reject constructor aliases.
+  Document connection ownership, admission stop and final ACK sequencing in
+  the App skill. Use SDK/App 0.36.0.
+- Pin templates 0.34.0 and its SDK/App 0.36.0 defaults.
+- Fix CGI handler reachability when initialization shares Config or error
+  values. Follow each identifier's initializer so SDK CGI handlers are
+  accepted while private IPC handlers remain refused through assignments
+  and wrappers.
+
 ## 0.37.0 (2026-10-29)
 
 - Native Apps appear in Hyper Backup as applications by default. Build writes

package/README.md

@@ -74,7 +74,7 @@ alongside npm lockfiles. Do not disable checksum verification for public SDK
 packages. Private mirrors can use explicitly configured Go authentication and
 checksum settings; a failed fetch reports `SDK_DOWNLOAD_FAILED`.
 
-CLI 0.37.0 uses templates ~0.33.0, whose default SDK pin is 0.35.0. Compose import and SDK defaults
+CLI 0.38.0 uses templates ~0.34.0, whose default SDK pin is 0.36.0. Compose import and SDK defaults
 read the SDK pin from the installed templates; explicit App SDK declarations take precedence.
 Every App method must be declared in the permissions table. Dynamic names and
 custom HTTP dispatchers are rejected. With SDK 0.33.0, use fixed
@@ -85,8 +85,8 @@ unimported development commands are excluded. Use
 authentication. See [App entry and registration](docs/app-entry.md).
 
 `init` and `add` read their templates from the locally installed
-`@synopackageland/templates`. CLI 0.37.0 depends on `~0.33.0`: npm installation or
-update can select the latest templates patch in the 0.33 minor line. Templates
+`@synopackageland/templates`. CLI 0.38.0 depends on `~0.34.0`: npm installation or
+update can select the latest templates patch in the 0.34 minor line. Templates
 patches need only a templates release; update the npm installation to receive them.
 The CLI never fetches templates at runtime, so offline use works after installation;
 commit a lockfile and use `npm ci` to reproduce a chosen dependency tree.

package/assets/go/route-audit/main.go

@@ -248,6 +248,9 @@ func reusesBoundary(expr ast.Node, owner source, sources []source, safe map[ast.
 			}
 		}
 	}
+	if safe[expr] {
+		return true
+	}
 	found := false
 	ast.Inspect(expr, func(n ast.Node) bool {
 		if n == nil || found {
@@ -263,8 +266,38 @@ func reusesBoundary(expr ast.Node, owner source, sources []source, safe map[ast.
 		if id, ok := n.(*ast.Ident); ok {
 			if id.Obj != nil {
 				if decl, ok := id.Obj.Decl.(ast.Node); ok {
-					found = safe[decl] || reusesBoundary(decl, owner, sources, safe, seen)
+					// An identifier carries its own initializer, not the other
+					// values/errors declared beside it in a shared assignment.
+					var names []*ast.Ident
+					var values []ast.Expr
+					switch d := decl.(type) {
+					case *ast.AssignStmt:
+						for _, lhs := range d.Lhs {
+							name, _ := lhs.(*ast.Ident)
+							names = append(names, name)
+						}
+						values = d.Rhs
+					case *ast.ValueSpec:
+						names, values = d.Names, d.Values
+					}
+					if len(values) > 0 {
+						for i, name := range names {
+							if name != nil && name.Obj == id.Obj {
+								index := i
+								if len(values) == 1 {
+									index = 0
+								}
+								if index < len(values) {
+									found = reusesBoundary(values[index], owner, sources, safe, seen)
+								}
+								break
+							}
+						}
+					} else {
+						found = safe[decl] || reusesBoundary(decl, owner, sources, safe, seen)
+					}
 				}
+				return false
 			} else {
 				targetPackage, targetName = owner.pkg, id.Name
 			}
@@ -554,7 +587,7 @@ func main() {
 			}
 			if module == sdkModule+"/ipc" && !direct[selector] {
 				switch name {
-				case "ServeUnix", "StartUnix", "ServePeerUnix", "DialUnix", "DialPeerUnix", "ReserveLoopback", "ProbeLoopback":
+				case "ServeUnix", "StartUnix", "ServePeerUnix", "StartPeerUnix", "DialUnix", "DialPeerUnix", "ReserveLoopback", "ProbeLoopback":
 					problem(selector.Pos(), "IPC constructor aliases cannot be audited")
 				}
 			}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.37.0",
+  "version": "0.38.0",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "@napi-rs/keyring": "^2.1.1",
-    "@synopackageland/templates": "~0.33.0",
+    "@synopackageland/templates": "~0.34.0",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "json-canonicalize": "^3.0.1",

package/skills/SKILL.md

@@ -5,7 +5,7 @@ description: Initialize, extend, check, build, inspect, and deploy Synology appl
 
 # Independent Synology SPKs
 
-CLI 0.36.0 installs templates through `~0.32.0`. A templates patch needs only a
+The CLI installs templates through `~0.34.0`. A templates patch needs only a
 templates release; npm install/update selects a patch in that minor line. The CLI
 uses the locally installed templates and reads their SDK pin for defaults; it
 never downloads templates at runtime. Preserve the lockfile and use `npm ci` for
@@ -24,7 +24,7 @@ Use this guide to initialize, build and inspect own applications or upstream OSS
 
 For an existing open-source App, first read [reference/upstream-fork.md](reference/upstream-fork.md): upstream fork/history + untouched upstream files + all packaging in `synology/`, official container images pinned by tag/index digest, native official release binaries pinned by SHA-256 or a source build hook, and a single tag-merge upgrade command. Use `init --upstream-fork`; never rewrite the App as a component. Integrated upstream Apps require direct DSM administrator entry without a separate App password or an OIDC/SSO server: supported trusted headers first, disabling native login second; the shipped OpenList pattern uses the existing SDK 0.17.3 token adapter (`mode: token`, `access: dsm-admins`, `entry: admin-only`) with server-side Authorization injection. All DSM admins share one upstream admin; token reset requires package restart; WebDAV retains its native credentials.
 
-Use SDK/App 0.35.0 and CLI 0.37.0 for App entry enforcement. Declare every App method
+Use SDK/App 0.36.0 and CLI 0.38.0 for App entry enforcement. Declare every App method
 in the permissions table; dynamic names and unregistered HTTP dispatchers are rejected.
 Use fixed SDK routes and `identity_gateway.upstream_auth_paths` for client API
 paths that rely on upstream authentication. Read
@@ -53,14 +53,26 @@ retaining it. Check child readiness and retry bind conflicts: release-to-bind
 is inherently racy. Never replace these with custom listeners or fixed ports.
 
 An optional root helper is a separately approved executor payload.
-`ipc.ServePeerUnix(ctx, path, ipc.PeerPolicy{UID: uid, GID: gid}, handler)`
-supports a bounded raw JSON control protocol on a root-owned 0660 socket under
+`ipc.StartPeerUnix(ctx, path, ipc.PeerPolicy{UID: uid, GID: gid}, handler)`
+synchronously returns a peer-server handle for a bounded raw JSON control
+protocol on a root-owned 0660 socket under
 `/var/run/synopkgland/<package>/`. The SDK authenticates exactly the selected
 UID with SO_PEERCRED; the handler validates bounded frames and current
 authorization. `ipc.DialPeerUnix` verifies root ownership, protected ancestors,
 mode and server UID zero. The server requires root AND the helper's explicit
 `ipc.executorTier=executor` linker binding. Bind packageID in custom builds.
 Generated CGI/workers bind tier `none`; never launch or install them as root.
+The handler owns its verified conn even after returning; close it when done.
+Stop and reap a supervised child on its owning OS thread, call the handle's
+`StopAccepting`, write the complete final ACK, then retain the conn until
+process exit. StopAccepting waits for listener/socket cleanup while keeping
+accepted peers and handler contexts alive. `Wait` waits for admission stop,
+not handlers or retained peers. `Close` or context cancellation cancels handler
+contexts and closes all peers, including after StopAccepting; keep the context
+alive through the ACK. Eight slots cover both retained conns and still-running
+callbacks; set explicit deadlines for exchanges beyond the initial five seconds.
+`ServePeerUnix` is the blocking form that closes a peer on callback return.
+Use direct constructor calls; aliases are rejected by the audit.
 The transport does not provide installation, approval or privilege elevation.
 
 Audit every custom-hook Go payload with