@synopackageland/cli 0.41.12 → 0.41.13

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## Unreleased
+
+## 0.41.13
+
+- Pin CLI-owned runtime defaults to SDK 0.41.0 independently of templates
+- Check daemon restart support through the policy decoder and normalizer
+- Bind daemon ingress to the exact, case-sensitive `/synopkgland/<package>/`
+  namespace across manifest validation, generated proxies, daemon environment,
+  SPK inspection and App smoke entry selection.
+- Use bounded RE2 patterns for ctl schema validation and sensitive-value
+  redaction; reject unsupported validation patterns and redact conservatively
+  when an unvalidated privacy pattern cannot be compiled.
+- Restrict native layout systemd units to package-process directives; reject
+  manager actions, activation dependencies and unknown directives or sections.
+- Inspect bridge access against the declared package entry and validate its
+  permissions policy even when its embedded digest matches.
+- Require executable native lifecycle scripts and the exact package privilege
+  declaration.
+- Inventory both archives before SDK package extraction; flag duplicate names,
+  case or Unicode collisions, noncanonical paths and unexpected entry types,
+  including type flags otherwise ignored by the tar reader.
+
 ## 0.41.12 (2026-10-31)
 
 - Remove the delegated WebAPI profile API-name and method-name word lists so

package/README.md

@@ -47,7 +47,8 @@ See the [upstream scaffold and release checklist](skills/reference/upstream-fork
 | `compose` | Unchanged upstream Compose, generated override and SDK planner | `dsm-package.yaml` |
 
 Existing native products with their own payload layout use `backend: {kind: native}` in
-`dsm-package.yaml`.
+`dsm-package.yaml`. Their systemd units accept only the package-process settings
+listed in [native systemd settings](docs/native-layout-systemd.md).
 
 Declare language-independent DSM installation requirements with
 [`dependencies.packages`](docs/manifest.md). They merge with inferred Node
@@ -88,8 +89,9 @@ alongside npm lockfiles. Do not disable checksum verification for public SDK
 packages. Private mirrors can use explicitly configured Go authentication and
 checksum settings; a failed fetch reports `SDK_DOWNLOAD_FAILED`.
 
-CLI 0.41.12 uses templates ~0.35.5, whose default SDK pin is 0.38.2. Compose import and SDK defaults
-read the SDK pin from the installed templates; explicit App SDK declarations take precedence.
+The CLI pins SDK 0.41.0 for its daemon controllers, Compose planning and installer
+context. Explicit App SDK declarations take precedence. Templates remain ~0.35.5
+and retain their own scaffold SDK pins; none declare daemon ingress.
 Every App method must be declared in the permissions table. Dynamic names and
 custom HTTP dispatchers are rejected. With SDK 0.33.0, use fixed
 `api.HandleHTTP` prefixes for authorized raw HTTP and `ipc.ServeUnix` for private
@@ -99,7 +101,7 @@ unimported development commands are excluded. Use
 authentication. See [App entry and registration](docs/app-entry.md).
 
 `init` and `add` read their templates from the locally installed
-`@synopackageland/templates`. CLI 0.41.12 depends on `~0.35.5`: npm installation or
+`@synopackageland/templates`. CLI 0.41.13 depends on `~0.35.5`: npm installation or
 update can select the latest templates patch in the 0.35 minor line. Templates
 patches need only a templates release; update the npm installation to receive them.
 The CLI never fetches templates at runtime, so offline use works after installation;
@@ -109,8 +111,8 @@ exact SDK Go module sum anchors the build manifest; npm integrity anchors the
 identical manifest in `@synopackageland/sdk/executor-manifest.json`. No manifest
 is fetched at NAS runtime. Missing, malformed or unsupported new manifests fail
 closed. SDK 0.26.0 and 0.27.0 retain the CLI's frozen legacy inventory.
-SDK defaults continue to come from the actual installed templates. An SDK minor
-release no longer requires a CLI release; new CLI capabilities or a new manifest
+CLI runtime defaults use its pinned SDK independently of the templates. An SDK minor
+release does not require a templates release; new CLI capabilities or a new manifest
 format can still require one.
 
 For development against local checkouts, set `SYNOPKGLAND_TEMPLATES_DIR` to a

package/dist/ctl/descriptor.js

@@ -3,9 +3,10 @@ import { createHash } from 'node:crypto';
 import { canonicalize } from 'json-canonicalize';
 import Ajv2020 from 'ajv/dist/2020.js';
 import { CtlError } from './errors.js';
+import { schemaRegExp } from './pattern.js';
 export const DESCRIPTION_METHOD = 'synopkgland.describe';
 export const DESCRIPTION_FILE = 'synopkgland-api.json';
-export const ajv = new Ajv2020.default({ allErrors: true, strict: false, validateFormats: false, addUsedSchema: false });
+export const ajv = new Ajv2020.default({ allErrors: true, strict: false, validateFormats: false, addUsedSchema: false, code: { regExp: schemaRegExp } });
 const descriptorSchema = ajv.compile(JSON.parse(readFileSync(new URL('../../schema/synopkgland-api-v1.schema.json', import.meta.url), 'utf8')));
 export function makeDescriptor(payload) { const value = { format: 'synopkgland.api', version: 1, payload }; return { ...value, sha256: createHash('sha256').update(canonicalize(value)).digest('hex') }; }
 export function validateDescriptor(value, id, version) {

package/dist/ctl/pattern.d.ts

@@ -0,0 +1,12 @@
+/** Package-supplied schema patterns never run in the backtracking JS engine. */
+export declare function schemaPattern(pattern: string): {
+    test(value: string): boolean;
+    toString(): string;
+};
+/** Ajv's pattern and patternProperties keywords must use the same engine. */
+export declare const schemaRegExp: ((pattern: string, _flags: string) => {
+    test(value: string): boolean;
+    toString(): string;
+}) & {
+    code: string;
+};

package/dist/ctl/pattern.js

@@ -0,0 +1,10 @@
+import { RE2JS } from 're2js';
+/** Package-supplied schema patterns never run in the backtracking JS engine. */
+export function schemaPattern(pattern) {
+    if (pattern.length > 4096)
+        throw new Error('schema pattern exceeds 4096 characters');
+    const compiled = RE2JS.compile(RE2JS.translateRegExp(pattern));
+    return { test: value => compiled.test(value), toString: () => pattern };
+}
+/** Ajv's pattern and patternProperties keywords must use the same engine. */
+export const schemaRegExp = Object.assign((pattern, _flags) => schemaPattern(pattern), { code: 'schemaRegExp' });

package/dist/ctl/redaction.js

@@ -1,4 +1,5 @@
 import { CtlError, ctlError } from './errors.js';
+import { schemaPattern } from './pattern.js';
 export const REDACTED = '<redacted>';
 function reference(root, ref) {
     if (!ref.startsWith('#'))
@@ -55,6 +56,22 @@ function branches(schemas, root) {
     return result;
 }
 export function redactValue(value, schema, root = schema, onSecret) {
+    const patterns = new Map();
+    const matches = (pattern, key) => {
+        let compiled = patterns.get(pattern);
+        if (!compiled) {
+            // Cached descriptors and direct callers can bypass descriptor validation.
+            // Unsupported syntax must conservatively apply its privacy annotations.
+            try {
+                compiled = schemaPattern(pattern);
+            }
+            catch {
+                compiled = { test: () => undefined };
+            }
+            patterns.set(pattern, compiled);
+        }
+        return compiled.test(key);
+    };
     const walk = (input, schemas) => {
         const nodes = branches(schemas, root);
         if (nodes.some(node => node.writeOnly === true)) {
@@ -76,10 +93,12 @@ export function redactValue(value, schema, root = schema, onSecret) {
                         matched = true;
                     }
                     for (const [pattern, child] of Object.entries(node.patternProperties ?? {})) {
-                        if (new RegExp(pattern).test(key)) {
+                        const match = matches(pattern, key);
+                        if (match !== false)
                             children.push(child);
+                        // An unknown match must not suppress additionalProperties privacy.
+                        if (match === true)
                             matched = true;
-                        }
                     }
                     if (!matched)
                         children.push(node.additionalProperties);

package/dist/e2e/app-open.js

@@ -2,6 +2,7 @@ import { readFileSync } from 'node:fs';
 import { parse } from 'yaml';
 import { resolveAppLaunch } from '../contract/app-launch.js';
 import { trustedAppEntryPath } from '../contract/web-launch.js';
+import { readDaemonIngress } from '../standalone/daemon-ingress.js';
 function safeEntry(entry) {
     const url = new URL(entry, 'https://dsm.example');
     if ((!entry.startsWith('/') && !/^https?:\/\//.test(entry)) || entry.startsWith('//') ||
@@ -25,7 +26,10 @@ export function deriveSmokeEntry(raw, entry) {
     if (!launch)
         throw new Error('Invalid app launch mode in manifest.');
     const window = launch === 'dsm-window' && !raw.console && raw.ui !== false && !raw.compose && !raw.daemon?.ingress;
-    const derived = raw.daemon?.ingress?.path ?? (gateway
+    const ingress = readDaemonIngress(raw.daemon?.ingress, raw.package, () => { });
+    if (raw.daemon?.ingress !== undefined && !ingress)
+        throw new Error('Invalid daemon ingress: use /synopkgland/<package>/ with the exact package ID');
+    const derived = ingress?.path ?? (gateway
         ? `/webman/3rdparty/${raw.package}/sso/open.cgi`
         : native ? `/?launchApp=${encodeURIComponent(appId)}`
             : trustedAppEntryPath(raw));

package/dist/error-registry.js

@@ -336,7 +336,7 @@ export const ERROR_REGISTRY = {
         STANDALONE_DAEMON_RESTART_SDK_REQUIRED: {
             code: "STANDALONE_DAEMON_RESTART_SDK_REQUIRED",
             description: "The selected controller SDK version or source does not support daemon.restart.",
-            suggestion: "Upgrade the selected controller SDK to 0.26.0 or later and use matching sources, including a local SDK override; update the App SDK requirement, identity_gateway.sdk or the templates that supply the default.",
+            suggestion: "Upgrade the selected controller SDK to 0.26.0 or later and use matching sources, including a local SDK override; update the App SDK requirement, identity_gateway.sdk or the CLI that supplies the default.",
         },
         UNINSTALL_INVALID: {
             code: "UNINSTALL_INVALID",
@@ -386,7 +386,7 @@ export const ERROR_REGISTRY = {
         STANDALONE_DAEMON_INGRESS_INVALID: {
             code: "STANDALONE_DAEMON_INGRESS_INVALID",
             description: "daemon.ingress does not declare one same-origin path and a bounded proxy timeout.",
-            suggestion: "Set daemon.ingress.path to /<name>/ with lowercase letters, digits and -, not a DSM path, and timeout (optional) to 1–3600 seconds.",
+            suggestion: "Set daemon.ingress.path to exactly /synopkgland/<package>/ using the case-sensitive manifest package ID, and timeout (optional) to 1–3600 seconds",
         },
         STANDALONE_DAEMON_INGRESS_MIN_DSM: {
             code: "STANDALONE_DAEMON_INGRESS_MIN_DSM",

package/dist/runtime/sdk-source.d.ts

@@ -1,5 +1,7 @@
 export { goPrivateCovers } from './go-env.js';
 import { type ExecutorManifest } from './sdk-executor-manifest.js';
+/** Pinned SDK for CLI-owned controllers and Compose planning; App pins take precedence. */
+export declare const DEFAULT_SDK_VERSION = "0.41.0";
 export declare const SDK_PACKAGE = "@synopackageland/sdk";
 export declare const SDK_MODULE = "github.com/synopackageland/syno-pkg-land-sdk";
 export declare const EXECUTOR_MODULE = "github.com/synopackageland/syno-pkg-land-sdk/executor";

package/dist/runtime/sdk-source.js

@@ -4,6 +4,8 @@ import { readFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { readExecutorManifest, predatesExecutorManifest } from './sdk-executor-manifest.js';
+/** Pinned SDK for CLI-owned controllers and Compose planning; App pins take precedence. */
+export const DEFAULT_SDK_VERSION = '0.41.0';
 export const SDK_PACKAGE = '@synopackageland/sdk';
 export const SDK_MODULE = 'github.com/synopackageland/syno-pkg-land-sdk';
 export const EXECUTOR_MODULE = `${SDK_MODULE}/executor`;

package/dist/spk/archive-inventory.d.ts

@@ -0,0 +1,9 @@
+export interface ArchiveIssue {
+    kind: 'path' | 'type' | 'duplicate' | 'collision' | 'unexpected';
+    path: string;
+    type: string;
+    message: string;
+}
+export declare const formatArchiveIssue: (issue: ArchiveIssue) => string;
+/** Scan names and types before extraction can merge or replace archive members. */
+export declare function archiveInventory(file: string, outer?: boolean, allowPayloadLinks?: boolean): Promise<ArchiveIssue[]>;

package/dist/spk/archive-inventory.js

@@ -0,0 +1,65 @@
+import * as tar from 'tar';
+import { createReadStream } from 'node:fs';
+import { KNOWN_TOP_LEVEL } from './dsm-spec.js';
+export const formatArchiveIssue = (issue) => `SPK_ARCHIVE_${issue.kind.toUpperCase()} ${issue.message}`;
+/** Scan names and types before extraction can merge or replace archive members. */
+export async function archiveInventory(file, outer = false, allowPayloadLinks = false) {
+    const findings = [];
+    const names = new Map();
+    const spellings = new Map();
+    const scan = (entry) => {
+        const raw = entry.path;
+        const add = (kind, message) => findings.push({ kind, path: raw, type: entry.type, message });
+        const path = raw.replace(/^\.\//, '').replace(/\/$/, '');
+        if (!path || path === '.') {
+            if (entry.type !== 'Directory')
+                add('path', `invalid root entry: ${raw}`);
+            return;
+        }
+        const parts = path.split('/');
+        if (raw.startsWith('/') || path.includes('\\') || parts.some(p => !p || p === '.' || p === '..') || /[\x00-\x1f\x7f]/.test(path))
+            add('path', `noncanonical archive path: ${raw}`);
+        if (!['File', 'Directory', ...(allowPayloadLinks ? ['SymbolicLink', 'Link'] : [])].includes(entry.type))
+            add('type', `unexpected ${entry.type} entry: ${raw}`);
+        const previous = names.get(path);
+        if (previous)
+            add('duplicate', `repeated archive path: ${raw}`);
+        names.set(path, { path, type: entry.type });
+        // Include implicit parent directories: Bin/a and bin/b collide too.
+        for (let i = 1; i <= parts.length; i++) {
+            const prefix = parts.slice(0, i).join('/');
+            const folded = prefix.normalize('NFC').toLowerCase();
+            const spelling = spellings.get(folded);
+            if (spelling !== undefined && spelling !== prefix)
+                add('collision', `case or Unicode alias: ${spelling} and ${prefix}`);
+            spellings.set(folded, prefix);
+        }
+        if (outer && !KNOWN_TOP_LEVEL.includes(parts[0]))
+            add('unexpected', `unknown SPK metadata entry: ${raw}`);
+        else if (outer) {
+            const directory = ['scripts', 'conf', 'WIZARD_UIFILES'].includes(parts[0]);
+            if (!directory && (parts.length > 1 || entry.type === 'Directory') ||
+                directory && parts.length === 1 && entry.type === 'File')
+                add('type', `SPK metadata has the wrong file or directory role: ${raw}`);
+        }
+    };
+    const parser = new tar.Parser({ strict: true, onReadEntry(entry) { scan(entry); entry.resume(); } });
+    // tar.t silently drops unknown type flags; they are still archive members.
+    parser.on('ignoredEntry', scan);
+    const input = createReadStream(file);
+    await new Promise((resolve, reject) => {
+        input.on('error', reject);
+        parser.on('error', error => { input.destroy(); reject(error); });
+        parser.on('end', resolve);
+        input.pipe(parser);
+    });
+    for (const [path] of names) {
+        const parts = path.split('/');
+        for (let i = 1; i < parts.length; i++) {
+            const parent = names.get(parts.slice(0, i).join('/'));
+            if (parent && parent.type !== 'Directory')
+                findings.push({ kind: 'collision', path, type: parent.type, message: `file used as a directory: ${parent.path}` });
+        }
+    }
+    return findings;
+}

package/dist/spk/check-payload.js

@@ -2,6 +2,7 @@ import { openSync, readSync, closeSync } from "node:fs";
 import { posix } from "node:path";
 import * as tar from "tar";
 import { ARCH_ELF_MACHINE } from "./dsm-spec.js";
+import { archiveInventory, formatArchiveIssue } from './archive-inventory.js';
 const XZ_MAGIC = Buffer.from([0xfd, 0x37, 0x7a, 0x58, 0x5a, 0x00]);
 const ELF_MAGIC = Buffer.from("\x7fELF", "latin1");
 const MAX_TEXT = 1024 * 1024;
@@ -145,6 +146,14 @@ export async function checkPayload(payloadPath, info, findings) {
         return;
     }
     const dirs = uiDirs(info.dsmuidir);
+    try {
+        for (const issue of await archiveInventory(payloadPath, false, true)) {
+            if (issue.kind === 'path' && (issue.path.startsWith('/') || posix.normalize(issue.path).split('/')[0] === '..'))
+                continue;
+            findings.add('SPK_ARCHIVE_INVALID', formatArchiveIssue(issue), at(issue.path));
+        }
+    }
+    catch { /* scanPayload reports unreadable archives */ }
     const configs = new Set(dirs.map((dir) => posix.join(dir, "config")));
     const files = await scanPayload(payloadPath, (path) => configs.has(path) || (/\/texts\/[^/]+\/strings$/.test(path) && dirs.some((dir) => path.startsWith(`${dir}/`))), findings);
     if (!files)

package/dist/spk/rules.d.ts

@@ -11,6 +11,11 @@ export interface SpkRule {
     source: string;
 }
 export declare const SPK_RULES: {
+    readonly SPK_ARCHIVE_INVALID: {
+        readonly severity: "error";
+        readonly description: "An archive has noncanonical or colliding names, repeated entries, or unsupported entry types.";
+        readonly source: "Archive inventory";
+    };
     readonly SPK_NOT_TAR: {
         readonly severity: "error";
         readonly description: "The file is not a readable tar archive; an SPK is an uncompressed tar.";

package/dist/spk/rules.js

@@ -1,5 +1,6 @@
 const GUIDE = "DSM 7 Developer Guide";
 export const SPK_RULES = {
+    SPK_ARCHIVE_INVALID: { severity: "error", description: "An archive has noncanonical or colliding names, repeated entries, or unsupported entry types.", source: "Archive inventory" },
     SPK_NOT_TAR: { severity: "error", description: "The file is not a readable tar archive; an SPK is an uncompressed tar.", source: `${GUIDE}: Package Structure` },
     SPK_ENTRY_UNSAFE: { severity: "error", description: "A path inside the SPK escapes the archive root (an absolute path or ..), or is a link.", source: `${GUIDE}: Package Structure` },
     SPK_ENTRY_UNKNOWN: { severity: "warning", description: "The SPK top level has a file or directory the guide does not list (file names are case-sensitive).", source: `${GUIDE}: Package Structure` },

package/dist/spk/validate-spk.js

@@ -8,6 +8,7 @@ import { checkMetadata } from "./check-metadata.js";
 import { checkPayload } from "./check-payload.js";
 import { KNOWN_TOP_LEVEL } from "./dsm-spec.js";
 import { Findings } from "./findings.js";
+import { archiveInventory, formatArchiveIssue } from './archive-inventory.js';
 /** Outer files other than package.tgz are metadata; anything larger is not read. */
 const MAX_OUTER_FILE = 16 * 1024 * 1024;
 const TOP_LEVEL = new Set(KNOWN_TOP_LEVEL);
@@ -17,6 +18,17 @@ export async function validateSpk(spkPath) {
     const dir = mkdtempSync(join(tmpdir(), "syno-validate-spk-"));
     let info = {};
     try {
+        try {
+            for (const issue of await archiveInventory(spkPath, true)) {
+                // The existing outer rules already report escaping names and links.
+                if (issue.kind === 'unexpected' || issue.kind === 'type' && ['SymbolicLink', 'Link'].includes(issue.type))
+                    continue;
+                if (issue.kind === 'path' && (issue.path.startsWith('/') || issue.path.split('/').includes('..')))
+                    continue;
+                findings.add('SPK_ARCHIVE_INVALID', formatArchiveIssue(issue), issue.path);
+            }
+        }
+        catch { /* readOuter reports unreadable archives */ }
         const outer = await readOuter(spkPath, dir, findings);
         if (outer) {
             checkOuterEntries(outer.entries, findings);

package/dist/standalone/compose.js

@@ -9,7 +9,7 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { parse } from "yaml";
-import { templateSdkVersion } from "../template-paths.js";
+import { DEFAULT_SDK_VERSION } from "../runtime/sdk-source.js";
 import { goChildEnv } from "../runtime/go-env.js";
 import { sdkSource } from "../runtime/sdk-source.js";
 import { readDaemon } from "./daemon.js";
@@ -106,10 +106,10 @@ export function readComposeApp(value, root, arches, fail, context = {}) {
             return invalid("compose.host_udp allows at most 32 distinct ports 1024-65535 with lowercase purpose labels of 1-64 characters.", "COMPOSE_HOST_UDP_INVALID");
         hostUdp = [...value.host_udp].map(l => ({ port: l.port, purpose: l.purpose })).sort((a, b) => a.port - b.port);
     }
-    const sdk = typeof value.sdk === "string" ? value.sdk : (context.sdk ?? templateSdkVersion());
+    const sdk = typeof value.sdk === "string" ? value.sdk : (context.sdk ?? DEFAULT_SDK_VERSION);
     let targets = {};
     if (value.helpers !== undefined) {
-        const d = readDaemon({ exec: "_sso/gateway", targets: value.helpers }, root, arches, fail);
+        const d = readDaemon({ exec: "_sso/gateway", targets: value.helpers }, root, arches, fail, context.package);
         if (!d)
             return;
         targets = d.targets;
@@ -309,7 +309,7 @@ export function lockComposeImages(m, arch, resolveImages, imageProofs) {
     return { ...m, compose };
 }
 export function composeInputs(root, file, envFile) {
-    const result = spawnSync(planner(templateSdkVersion()), [
+    const result = spawnSync(planner(DEFAULT_SDK_VERSION), [
         "sources",
         "--root",
         root,

package/dist/standalone/daemon-ingress.d.ts

@@ -1,13 +1,14 @@
 import type { StandaloneError } from "./manifest.js";
 /** `daemon.ingress`: one path in DSM's own server blocks, proxied to the daemon. */
 export interface DaemonIngress {
-    /** `/<name>/`, served on DSM's ports and custom domains, so same-origin with DSM. */
+    /** `/synopkgland/<package>/`, with the exact manifest package ID. */
     path: string;
     /** nginx proxy_read_timeout and proxy_send_timeout in seconds. */
     timeout: number;
 }
 export declare const DAEMON_INGRESS_CONFIG = "daemon/ingress-nginx.conf";
-export declare function readDaemonIngress(value: unknown, fail: (error: StandaloneError) => void): DaemonIngress | undefined;
+export declare const daemonIngressPath: (packageId: string) => string;
+export declare function readDaemonIngress(value: unknown, packageId: string | undefined, fail: (error: StandaloneError) => void): DaemonIngress | undefined;
 /** DSM before 7.2 rejects an unsigned web-config, the worker this path uses. */
 export declare function daemonIngressMinDsmProblem(osMinVer: string | undefined): string | undefined;
 export declare const daemonIngressSocket: (pkg: string) => string;

package/dist/standalone/daemon-ingress.js

@@ -1,9 +1,7 @@
 import { isDsmAtLeast, PORTAL_MIN_DSM } from "../build-spk/dsm-version.js";
-import { RESERVED_PORTAL_ALIASES } from "../portal/alias.js";
 export const DAEMON_INGRESS_CONFIG = "daemon/ingress-nginx.conf";
-const PATH = /^\/[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?\/$/;
-const reserved = (path) => RESERVED_PORTAL_ALIASES.includes(path.slice(1, -1));
-export function readDaemonIngress(value, fail) {
+export const daemonIngressPath = (packageId) => `/synopkgland/${packageId}/`;
+export function readDaemonIngress(value, packageId, fail) {
     if (value === undefined)
         return undefined;
     const v = value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
@@ -11,14 +9,14 @@ export function readDaemonIngress(value, fail) {
     if (!v ||
         Object.keys(v).some((k) => k !== "path" && k !== "timeout") ||
         typeof v.path !== "string" ||
-        !PATH.test(v.path) ||
-        reserved(v.path) ||
+        !packageId || !/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(packageId) ||
+        v.path !== daemonIngressPath(packageId) ||
         !Number.isInteger(timeout) ||
         timeout < 1 ||
         timeout > 3600) {
         fail({
             code: "STANDALONE_DAEMON_INGRESS_INVALID",
-            message: `daemon.ingress needs path "/<name>/" (lowercase letters, digits and -, not a DSM path such as /webapi/) and an optional timeout of 1–3600 seconds.`,
+            message: `daemon.ingress.path must be exactly /synopkgland/<package>/ with the manifest package ID (case-sensitive), and timeout must be 1–3600 seconds`,
         });
         return undefined;
     }
@@ -31,9 +29,14 @@ export function daemonIngressMinDsmProblem(osMinVer) {
     return `daemon.ingress needs os_min_ver ${PORTAL_MIN_DSM} or later; os_min_ver is "${osMinVer ?? ""}". DSM 7.1 rejects the unsigned web-config worker that adds the path to DSM's nginx. Raise os_min_ver or remove daemon.ingress.`;
 }
 export const daemonIngressSocket = (pkg) => `/tmp/synopkgland-ingress-${pkg}.sock`;
+function checkedIngressPath(pkg, ingress) {
+    if (!readDaemonIngress(ingress, pkg, () => { }))
+        throw new Error('Invalid daemon ingress: use /synopkgland/<package>/ with the exact package ID');
+    return daemonIngressPath(pkg);
+}
 /** What the daemon learns: where to listen and which path prefix it serves. */
 export function ingressEnv(pkg, ingress) {
-    return { SYNOPKGLAND_INGRESS_PATH: ingress.path, SYNOPKGLAND_INGRESS_SOCKET: daemonIngressSocket(pkg) };
+    return { SYNOPKGLAND_INGRESS_PATH: checkedIngressPath(pkg, ingress), SYNOPKGLAND_INGRESS_SOCKET: daemonIngressSocket(pkg) };
 }
 export function daemonIngressResource() {
     return { "nginx-static-config": { enable: [{ type: "dsm", relpath: DAEMON_INGRESS_CONFIG }] } };
@@ -43,7 +46,7 @@ export function daemonIngressResource() {
  * unbuffered; nginx replaces any client X-Real-IP with the peer address.
  */
 export function renderDaemonIngressConfig(pkg, ingress) {
-    return `location ^~ ${ingress.path} {
+    return `location ^~ ${checkedIngressPath(pkg, ingress)} {
     proxy_pass http://unix:${daemonIngressSocket(pkg)}:;
     proxy_http_version 1.1;
     proxy_set_header Host $http_host;

package/dist/standalone/daemon-restart.d.ts

@@ -7,7 +7,7 @@ export interface DaemonRestart {
     max_attempts: number;
     window_seconds: number;
 }
-/** Normalize exactly the SDK's zero/omitted defaults; omission itself stays off. */
+/** Normalize explicit manifest policies; omission uses the SDK controller default. */
 export declare function readDaemonRestart(value: unknown, fail: (error: StandaloneError) => void): DaemonRestart | undefined;
 export declare function daemonRestartSdkSupported(sdk: string): boolean;
 export declare function daemonRestartSdkProblem(sdk: string): string | undefined;

package/dist/standalone/daemon-restart.js

@@ -7,7 +7,7 @@ let validator;
 function restartValidator() {
     return validator ??= new Ajv().compile(JSON.parse(readFileSync(new URL("../../schema/daemon-restart.v1.schema.json", import.meta.url), "utf8")));
 }
-/** Normalize exactly the SDK's zero/omitted defaults; omission itself stays off. */
+/** Normalize explicit manifest policies; omission uses the SDK controller default. */
 export function readDaemonRestart(value, fail) {
     if (value === undefined)
         return undefined;
@@ -35,7 +35,7 @@ export function daemonRestartSdkSupported(sdk) {
 }
 export function daemonRestartSdkProblem(sdk) {
     if (!daemonRestartSdkSupported(sdk))
-        return `daemon.restart requires SDK ${DAEMON_RESTART_MIN_SDK} or later; selected SDK ${sdk}. Upgrade the App's SDK pin, identity_gateway.sdk or the templates supplying the default controller SDK before rebuilding.`;
+        return `daemon.restart requires SDK ${DAEMON_RESTART_MIN_SDK} or later; selected SDK ${sdk}. Upgrade the App's SDK pin, identity_gateway.sdk or the CLI supplying the default controller SDK before rebuilding.`;
     return undefined;
 }
 /** Development overrides must contain the decoder as well as the restart code. */
@@ -50,6 +50,6 @@ export function requireDaemonRestartSource(dir, sdk, policy) {
     catch { /* Fail below before compiling or packaging a mismatched runtime. */ }
     const problem = daemonRestartSdkProblem(sdk);
     if (problem || !/\bRestart\s+\*restartPolicy\s+`json:"restart,omitempty"`/.test(main) ||
-        !/^func normalizeRestart\(/m.test(restart) || !/^type restartBudget struct\s*\{/m.test(restart))
+        !/^func normalizeRestart\(/m.test(restart) || !/^type restartPolicy struct\s*\{/m.test(restart))
         throw new StandaloneBuildError("STANDALONE_DAEMON_RESTART_SDK_REQUIRED", problem ?? `Selected SDK ${sdk} source does not support daemon.restart; use matching SDK ${DAEMON_RESTART_MIN_SDK} or later sources, including for a local development override.`);
 }

package/dist/standalone/daemon.d.ts

@@ -5,7 +5,7 @@ import { type DaemonRestart } from "./daemon-restart.js";
 import type { CommandRunner } from "./build.js";
 import type { StandaloneError, StandaloneManifest } from "./manifest.js";
 export interface Daemon {
-    /** Optional bounded recovery; omitted means off. SDK 0.26.0 or later. */
+    /** Optional bounded recovery; omission uses the SDK controller default. SDK 0.26.0 or later. */
     restart?: DaemonRestart;
     /** Fixed foreground executable relative to daemon/payload; empty for a backend daemon. */
     exec: string;
@@ -53,7 +53,7 @@ export declare const token: (v: unknown) => v is string;
 export declare const envKey: (k: string) => boolean;
 /** A relative path to a fixed executable, without `.` or `..` parts. */
 export declare const relativeExec: (v: unknown) => v is string;
-export declare function readDaemon(value: unknown, root: string, arches: NativeArchFamily[], fail: (error: StandaloneError) => void): Daemon | undefined;
+export declare function readDaemon(value: unknown, root: string, arches: NativeArchFamily[], fail: (error: StandaloneError) => void, packageId: string | undefined): Daemon | undefined;
 export declare function daemonSdkVersion(manifest: Pick<StandaloneManifest, "backend" | "identityGateway">): string;
 export declare function daemonConfig(manifest: StandaloneManifest): string;
 /**

package/dist/standalone/daemon.js

@@ -5,7 +5,7 @@ import { chmodSync, existsSync, copyFileSync, lstatSync, mkdirSync, readdirSync,
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { PINNED_GO_HINT, pinnedGoBuildEnv, pinnedGoProblem, } from "../build-spk/go-toolchain.js";
 import { sdkSource, appSdkVersion } from "../runtime/sdk-source.js";
-import { templateSdkVersion } from "../template-paths.js";
+import { DEFAULT_SDK_VERSION } from "../runtime/sdk-source.js";
 import { checkCgiBinary } from "./binary.js";
 import { NODE_PACKAGES } from "./bridge-backend.js";
 import { readDaemonIngress, ingressEnv } from "./daemon-ingress.js";
@@ -65,7 +65,7 @@ export const relativeExec = (v) => typeof v === "string" &&
     !v.split("/").some((p) => p === "." || p === "..");
 /** A Node entry such as `server.mjs` or `dist/main.js`, inside the payload. */
 const relativeEntry = (v) => typeof v === "string" && relativeExec(`_/${v}`);
-export function readDaemon(value, root, arches, fail) {
+export function readDaemon(value, root, arches, fail, packageId) {
     if (value === undefined)
         return undefined;
     const invalid = () => {
@@ -126,10 +126,10 @@ export function readDaemon(value, root, arches, fail) {
     const node = readDaemonNode(value.node, fail);
     if (value.node !== undefined && !node)
         return undefined;
-    const ingress = readDaemonIngress(value.ingress, fail);
+    const ingress = readDaemonIngress(value.ingress, packageId, fail);
     if (value.ingress !== undefined && !ingress)
         return undefined;
-    if (ingress && Object.keys(env).some((key) => key in ingressEnv("", ingress)))
+    if (ingress && Object.keys(env).some((key) => key in ingressEnv(packageId, ingress)))
         return invalid();
     if (backend && node && Object.keys(env).some((key) => key in backendNodeEnv()))
         return invalid();
@@ -172,7 +172,7 @@ function readDaemonNode(value, fail) {
 export function daemonSdkVersion(manifest) {
     return manifest.identityGateway?.sdk ??
         (manifest.backend.kind === "go" ? appSdkVersion(manifest.backend) : undefined) ??
-        templateSdkVersion();
+        DEFAULT_SDK_VERSION;
 }
 export function daemonConfig(manifest) {
     const { exec, args, uninstall_args, env, timeouts, restart } = manifest.compose

package/dist/standalone/inspect-bridge.d.ts

@@ -1,8 +1,10 @@
+import type { EntryMode } from './manifest.js';
 type Payload = Array<{
     path: string;
     mode: string;
 }>;
 export interface BridgeJson {
+    access?: EntryMode;
     runtime?: string;
     entry?: string;
     methods?: string[];
@@ -22,7 +24,7 @@ export interface BridgeJson {
  * permissions.json by digest, the App lives in target/app (never under ui/),
  * and its entry, SDK and dependencies are in the package.
  */
-export declare function checkBridgeApp(dir: string, backend: string, info: Record<string, string>, payload: Payload, findings: string[]): Promise<BridgeJson | undefined>;
+export declare function checkBridgeApp(dir: string, backend: string, info: Record<string, string>, payload: Payload, findings: string[], entry?: EntryMode): Promise<BridgeJson | undefined>;
 /** root and delegate reach the package's executor; delegate pins the one this SPK ships. */
 export declare function checkBridgeExecutor(bridge: BridgeJson, executor: {
     executorDigest: string;

package/dist/standalone/inspect-bridge.js

@@ -7,6 +7,7 @@ import { ELF_MACHINE } from "./binary.js";
 import { NODE_SDK_PACKAGE } from "./bridge-app.js";
 import { BRIDGE_JSON, bridgeManifestProblems, PYTHON_VENDOR_DIR } from "./bridge-json.js";
 import { CGI_PAYLOAD_PATH } from "./dsm-window.js";
+import { parseApiPermissions } from './api-permissions.js';
 /** Files that belong in target/app only: DSM serves everything under ui/ to the browser. */
 const APP_ONLY = [`/${BRIDGE_JSON}`, "/permissions.json", `/${PYTHON_VENDOR_DIR}/synopkgland_app/`, `/node_modules/${NODE_SDK_PACKAGE}/`];
 /**
@@ -14,7 +15,7 @@ const APP_ONLY = [`/${BRIDGE_JSON}`, "/permissions.json", `/${PYTHON_VENDOR_DIR}
  * permissions.json by digest, the App lives in target/app (never under ui/),
  * and its entry, SDK and dependencies are in the package.
  */
-export async function checkBridgeApp(dir, backend, info, payload, findings) {
+export async function checkBridgeApp(dir, backend, info, payload, findings, entry) {
     const paths = new Set(payload.map(entry => entry.path));
     for (const path of payload.map(entry => `/${entry.path}`).filter(path => path.startsWith("/ui/") && APP_ONLY.some(name => path.includes(name)))) {
         findings.push(`BRIDGE_APP_IN_UI ${path.slice(1)} is an App file and must not be placed in ui/ (DSM serves it directly to the browser)`);
@@ -31,6 +32,8 @@ export async function checkBridgeApp(dir, backend, info, payload, findings) {
         return undefined;
     }
     const bridge = JSON.parse(text);
+    if (bridge.access !== entry)
+        findings.push('BRIDGE_ACCESS_MISMATCH app/bridge.json access differs from sdk-package.json entry');
     if (bridge.runtime !== backend)
         findings.push(`BRIDGE_MANIFEST_INVALID the runtime "${bridge.runtime}" in app/${BRIDGE_JSON} differs from the backend "${backend}" in sdk-package.json`);
     checkEntry(app, bridge, info, payload, findings);
@@ -82,10 +85,10 @@ function checkEntry(app, bridge, info, payload, findings) {
 function checkPermissions(bytes, bridge, findings) {
     let methods;
     try {
-        methods = Object.keys(JSON.parse(bytes.toString("utf8")).methods ?? {});
+        methods = Object.keys(parseApiPermissions(bytes).methods);
     }
     catch {
-        findings.push("BRIDGE_PERMISSIONS app/permissions.json is not JSON");
+        findings.push("BRIDGE_PERMISSIONS app/permissions.json must be a valid bounded method policy with default administrators");
         return;
     }
     const unlisted = methods.filter(method => !bridge.methods?.includes(method));

package/dist/standalone/inspect-spk.js

@@ -14,6 +14,7 @@ import { readComposeApp, composeSource, dsmComposeProblem, COMPOSE_READINESS_LIM
 import { createHash } from "node:crypto";
 import { inspectNativeLayout } from "./native-layout.js";
 import { checkBridgeApp, checkBridgeExecutor } from "./inspect-bridge.js";
+import { archiveInventory, formatArchiveIssue } from '../spk/archive-inventory.js';
 import { inspectExecutor, inspectExecutorAnchor, } from "../runtime/executor-inspect.js";
 import { existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
 import { sdkScriptOf, unwrapAppScripts } from "./app-scripts.js";
@@ -65,8 +66,15 @@ export async function inspectStandaloneSpk(spkPath) {
 export async function inspectSpk(spkPath, expectedKind) {
     const dir = mkdtempSync(join(tmpdir(), "syno-inspect-spk-"));
     try {
+        const findings = (await archiveInventory(spkPath, true)).map(formatArchiveIssue);
+        if (findings.length)
+            return { signed: false, payload: [], findings, capabilities: [] };
         await tar.x({ file: spkPath, cwd: dir });
-        const findings = [];
+        if (existsSync(join(dir, 'package.tgz'))) {
+            findings.push(...(await archiveInventory(join(dir, 'package.tgz'))).map(formatArchiveIssue));
+            if (findings.length)
+                return { signed: existsSync(join(dir, 'syno_signature.asc')), payload: [], findings, capabilities: [] };
+        }
         if (!expectedKind && existsSync(join(dir, "native-layout.json"))) {
             let dependencies;
             try {
@@ -240,7 +248,7 @@ export async function inspectSpk(spkPath, expectedKind) {
             }
         }
         const bridge = compiledKind && kind !== "native-go"
-            ? await checkBridgeApp(dir, metadata.backend, info, payload, findings)
+            ? await checkBridgeApp(dir, metadata.backend, info, payload, findings, metadata.entry)
             : undefined;
         if (dependencies && bridge?.node?.package && !dependencies.packages.some(d => d.name === bridge.node.package))
             findings.push("DEPENDENCIES_INVALID build metadata dependencies omit the Node backend package.");
@@ -996,7 +1004,7 @@ async function checkDaemon(dir, info, paths, payload, findings, executor, backgr
             timeouts: config.timeouts,
             restart: config.restart,
             targets: { x86_64: "payload" },
-        }, dir, ["x86_64"], () => { });
+        }, dir, ["x86_64"], () => { }, info.package);
         if (!daemon)
             throw new Error("invalid config");
         // The packaged config already carries the launcher argv; only the launcher itself is checked here.
@@ -1280,7 +1288,7 @@ async function recoverNativeGateway(dir, value, info, findings) {
 function recoverDaemonNode(value, findings) {
     if (value === undefined)
         return undefined;
-    const daemon = readDaemon({ exec: "x", targets: {}, node: value }, tmpdir(), [], () => { });
+    const daemon = readDaemon({ exec: "x", targets: {}, node: value }, tmpdir(), [], () => { }, undefined);
     if (!daemon?.node || !isDeepStrictEqual(daemon.node, value)) {
         findings.push("DAEMON_NODE_INVALID sdk-package.json daemon_node is not a Node.js package declaration build writes");
         return undefined;
@@ -1291,7 +1299,7 @@ async function recoverDaemonIngress(dir, value, info, paths, findings) {
     if (value === undefined)
         return undefined;
     try {
-        const ingress = readDaemonIngress(value, () => { });
+        const ingress = readDaemonIngress(value, info.package, () => { });
         if (!ingress || !isDeepStrictEqual(ingress, value))
             throw new Error("invalid ingress record");
         const minDsm = daemonIngressMinDsmProblem(info.os_min_ver);
@@ -1369,10 +1377,18 @@ function checkConf(dir, findings, kind, background, sharedFolder, pkg, portal, c
         findings.push("conf/privilege is not JSON");
         return;
     }
+    if (!privilege || typeof privilege !== 'object' || Array.isArray(privilege)) {
+        findings.push('conf/privilege must be a JSON object');
+        return;
+    }
     const defaults = privilege.defaults;
     if (defaults?.["run-as"] !== "package") {
         findings.push('conf/privilege defaults.run-as must be "package"');
     }
+    if (Object.keys(privilege).some(key => key !== 'defaults') || !defaults ||
+        Object.keys(defaults).some(key => key !== 'run-as')) {
+        findings.push('conf/privilege must contain only defaults.run-as: package');
+    }
     for (const key of ["tool", "ctrl-script", "executable", "join-groupname"]) {
         if (key in privilege) {
             findings.push(`conf/privilege requires ${key} (root or extra group privileges)`);
@@ -1624,8 +1640,12 @@ function checkScripts(dir, findings) {
             for (const name of readdirSync(path))
                 scan(`${relative}/${name}`);
         }
-        else if (ROOT_SCRIPT_HINTS.some((pattern) => pattern.test(readFileSync(path, "utf8")))) {
-            findings.push(`${relative} tries to gain root (sudo, chown root or setuid)`);
+        else {
+            if (!(lstatSync(path).mode & 0o111))
+                findings.push(`${relative} is not executable`);
+            if (ROOT_SCRIPT_HINTS.some(pattern => pattern.test(readFileSync(path, "utf8")))) {
+                findings.push(`${relative} tries to gain root (sudo, chown root or setuid)`);
+            }
         }
     };
     if (existsSync(scriptsDir))

package/dist/standalone/install-settings.js

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { sdkSource } from '../runtime/sdk-source.js';
-import { templateSdkVersion } from '../template-paths.js';
+import { DEFAULT_SDK_VERSION } from '../runtime/sdk-source.js';
 import { goChildEnv } from '../runtime/go-env.js';
 import { pinnedGoBuildEnv, pinnedGoProblem } from '../build-spk/go-toolchain.js';
 import { checkCgiBinary } from './binary.js';
@@ -49,7 +49,7 @@ export function renderSettingsHook(name, m) {
 export async function buildInstallSettings(m, arch, work, run) {
     if (!m.installSettings && !m.installPorts)
         return;
-    const sdk = m.compose?.sdk ?? m.identityGateway?.sdk ?? templateSdkVersion(), source = sdkSource(sdk);
+    const sdk = m.compose?.sdk ?? m.identityGateway?.sdk ?? DEFAULT_SDK_VERSION, source = sdkSource(sdk);
     if (!existsSync(join(source.goDir, 'installsettings/cmd/control/main.go')))
         throw new StandaloneBuildError('SDK_INSTALL_SETTINGS_UNSUPPORTED', 'Use an SDK release with native install.settings support.');
     if (m.installPorts && !existsSync(join(source.goDir, 'installsettings/ports.go')))

package/dist/standalone/manifest.js

@@ -250,7 +250,7 @@ function readManifest(raw, c) {
     const timeoutOnly = isRecord(raw.daemon) && Object.keys(raw.daemon).length === 1 && 'timeouts' in raw.daemon;
     const lifecycleTimeouts = timeoutOnly ? readLifecycleTimeouts(raw.daemon.timeouts, (e) => c.fail(e.code, e.message)) : undefined;
     const daemon = arches &&
-        readDaemon(timeoutOnly ? undefined : raw.daemon, c.root, arches, (e) => c.fail(e.code, e.message));
+        readDaemon(timeoutOnly ? undefined : raw.daemon, c.root, arches, (e) => c.fail(e.code, e.message), packageId);
     let dependencies;
     try {
         const explicit = readPackageDependencies(raw.dependencies);

package/dist/standalone/native-layout.js

@@ -257,10 +257,27 @@ export function checkLayoutMetadata(root, inspection = false, packageId) {
             if (/\\\s*$/m.test(unit))
                 fail('systemd unit continuations are unsupported');
             let section = '';
+            // These settings either describe ordering or operate on the package
+            // process. Manager actions/dependencies and filesystem setup are absent.
+            const directives = {
+                Unit: ['Description', 'Documentation', 'After', 'Before'],
+                Service: ['Type', 'User', 'Group', 'ExecStart', 'ExecStartPre', 'ExecStartPost', 'ExecStop', 'ExecStopPost', 'ExecReload',
+                    'Restart', 'RestartSec', 'TimeoutStartSec', 'TimeoutStopSec', 'KillMode', 'KillSignal', 'WorkingDirectory', 'Environment'],
+                Install: ['WantedBy'],
+            };
             for (const line of unit.split('\n')) {
+                if (!line.trim() || /^\s*[#;]/.test(line))
+                    continue;
                 const heading = line.match(/^\s*\[([^\]]+)\]\s*$/);
-                if (heading)
+                if (heading) {
                     section = heading[1];
+                    if (!Object.hasOwn(directives, section))
+                        fail(`unsupported systemd section: ${section}`);
+                    continue;
+                }
+                const assignment = line.match(/^\s*([A-Za-z][A-Za-z0-9]*)\s*=/);
+                if (!assignment || !Object.hasOwn(directives, section) || !directives[section].includes(assignment[1]))
+                    fail(`unsupported systemd unit directive in ${section || 'missing section'}`);
                 if (/^\s*(?:User|Group|Exec\w*)\s*=/.test(line) && section !== 'Service')
                     fail('systemd execution directives require the package Service section');
             }

package/dist/template-paths.d.ts

@@ -3,7 +3,3 @@
  * package; SYNOPKGLAND_TEMPLATES_DIR points at a templates checkout instead.
  */
 export declare function templatesRoot(env?: NodeJS.ProcessEnv, from?: string): string;
-/** The installed templates' SDK pin also supplies CLI-owned runtime defaults.
- * CLI-only patch releases must never turn their own version into an SDK tag.
- */
-export declare function templateSdkVersion(env?: NodeJS.ProcessEnv): string;

package/dist/template-paths.js

@@ -1,6 +1,5 @@
 import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
-import { sdkRequirement } from "./runtime/sdk-source.js";
 /**
  * The scaffold templates come from the locally installed @synopackageland/templates
  * package; SYNOPKGLAND_TEMPLATES_DIR points at a templates checkout instead.
@@ -15,13 +14,3 @@ export function templatesRoot(env = process.env, from = import.meta.url) {
         throw new Error("[TEMPLATES_MISSING] @synopackageland/templates is not installed; reinstall @synopackageland/cli, or set SYNOPKGLAND_TEMPLATES_DIR to a templates checkout.");
     }
 }
-/** The installed templates' SDK pin also supplies CLI-owned runtime defaults.
- * CLI-only patch releases must never turn their own version into an SDK tag.
- */
-export function templateSdkVersion(env = process.env) {
-    const version = sdkRequirement(join(templatesRoot(env), "native-go/backend"));
-    if (!version || !/^\d+\.\d+\.\d+$/.test(version)) {
-        throw new Error("[TEMPLATES_MISSING] The installed templates have no valid SDK pin; reinstall @synopackageland/templates.");
-    }
-    return version;
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.41.12",
+  "version": "0.41.13",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -32,6 +32,7 @@
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "json-canonicalize": "^3.0.1",
+    "re2js": "2.9.1",
     "tar": "^7.4.3",
     "yaml": "^2.7.0"
   },

package/skills/reference/ctl.md

@@ -163,6 +163,8 @@ For AI consumers: execute commands that describe a complete task. Do not manuall
 
 App authors must mark passkeys, tokens, private URLs, torrent/base64 and upload content with standard JSON Schema `writeOnly: true`, including nested objects, array items and local references. Mark sensitive response fields in resultSchema too. Do not embed real secrets in schema defaults/enums/examples or command examples.
 
+Parameter and result schema `pattern` and `patternProperties` use the linear RE2 engine, with at most 4096 characters per pattern. Backreferences, lookarounds and other unsupported syntax are rejected during description validation. If an unvalidated or cached privacy pattern cannot be compiled, redaction conservatively applies that pattern's annotations to every property.
+
 CLI plans, dry-run, missing-yes errors, JSON/multi-host output and known input values repeated by the App use the fixed string `<redacted>`. Schema validation errors never echo instance values or paths. This changes presentation only: authorized requests still send the original values. The CLI does not log or cache business parameters. Sensitive description examples/defaults are masked in list/help and disk caches; a cache altered by redaction requires a fresh authenticated description/hash check before execution. Fill placeholders locally; never paste secrets into AI messages or logs.
 
 ## Command naming recommendations

package/skills/reference/daemon-mode.md

@@ -6,6 +6,11 @@ for every request, and the process exits when the request ends. With
 the same binary runs once as the package daemon and serves the pages through
 DSM's nginx. The CGI stays for integrations, transfers and fallback.
 
+Set `daemon.ingress.path` to exactly `/synopkgland/<package>/`, preserving the
+manifest package ID's case. The backend mounts routes at
+`SYNOPKGLAND_INGRESS_PATH`; build, inspect and smoke entry checks bind this path
+to the package.
+
 Daemon mode is not the default recommendation. It removes work that repeats
 on every request. It does not make a single expensive request cheaper, and it
 costs memory for as long as the package runs. Measure first, then decide.