@synopackageland/cli 0.41.12 → 0.42.0

package/CHANGELOG.md

@@ -1,5 +1,48 @@
 # Changelog
 
+## Unreleased
+
+## 0.42.0 (2026-11-01)
+
+- Require templates ~0.37.0 so `init` and `add` scaffold with UI 0.19.1 and
+  SDK/App 0.41.1 (executor/v0.39.0). CLI 0.41.x stays on the templates 0.35
+  minor line.
+- Pin CLI-owned runtime defaults (daemon controllers, Compose planning and
+  installer context) to SDK 0.41.1, matching the templates. Explicit App SDK
+  declarations still take precedence.
+- Skip installation when the requested package version is already installed,
+  including DSM build suffixes; report `action: "none"` in plans and avoid
+  downloads, uploads and reinstalling on confirmed runs.
+- Accept repeated ctl flags for arrays of scalar values, validate their item
+  schemas and expose repeatable flags in command help and examples. Preserve
+  sensitive-value redaction and JSON input for complex parameters.
+- Return `CTL_APP_NEEDS_APPROVAL` (exit 4) with an App-scoped
+  `ctl list --app <package> --approve-installed` hint when an installed App,
+  called by package ID or a cached alias, awaits first, new-version or
+  changed-description approval. Cached aliases identify upgraded packages but
+  never authorize execution; `CTL_APP_UNKNOWN` suggestions apply only to names
+  matching no installed package or known alias.
+
+## 0.41.13
+
+- Pin CLI-owned runtime defaults to SDK 0.41.0 independently of templates
+- Check daemon restart support through the policy decoder and normalizer
+- Bind daemon ingress to the exact, case-sensitive `/synopkgland/<package>/`
+  namespace across manifest validation, generated proxies, daemon environment,
+  SPK inspection and App smoke entry selection.
+- Use bounded RE2 patterns for ctl schema validation and sensitive-value
+  redaction; reject unsupported validation patterns and redact conservatively
+  when an unvalidated privacy pattern cannot be compiled.
+- Restrict native layout systemd units to package-process directives; reject
+  manager actions, activation dependencies and unknown directives or sections.
+- Inspect bridge access against the declared package entry and validate its
+  permissions policy even when its embedded digest matches.
+- Require executable native lifecycle scripts and the exact package privilege
+  declaration.
+- Inventory both archives before SDK package extraction; flag duplicate names,
+  case or Unicode collisions, noncanonical paths and unexpected entry types,
+  including type flags otherwise ignored by the tar reader.
+
 ## 0.41.12 (2026-10-31)
 
 - Remove the delegated WebAPI profile API-name and method-name word lists so

package/README.md

@@ -47,7 +47,8 @@ See the [upstream scaffold and release checklist](skills/reference/upstream-fork
 | `compose` | Unchanged upstream Compose, generated override and SDK planner | `dsm-package.yaml` |
 
 Existing native products with their own payload layout use `backend: {kind: native}` in
-`dsm-package.yaml`.
+`dsm-package.yaml`. Their systemd units accept only the package-process settings
+listed in [native systemd settings](docs/native-layout-systemd.md).
 
 Declare language-independent DSM installation requirements with
 [`dependencies.packages`](docs/manifest.md). They merge with inferred Node
@@ -88,8 +89,9 @@ alongside npm lockfiles. Do not disable checksum verification for public SDK
 packages. Private mirrors can use explicitly configured Go authentication and
 checksum settings; a failed fetch reports `SDK_DOWNLOAD_FAILED`.
 
-CLI 0.41.12 uses templates ~0.35.5, whose default SDK pin is 0.38.2. Compose import and SDK defaults
-read the SDK pin from the installed templates; explicit App SDK declarations take precedence.
+The CLI pins SDK 0.41.1 for its daemon controllers, Compose planning and installer
+context. Explicit App SDK declarations take precedence. Templates use ~0.37.0
+and retain their own scaffold SDK pins; none declare daemon ingress.
 Every App method must be declared in the permissions table. Dynamic names and
 custom HTTP dispatchers are rejected. With SDK 0.33.0, use fixed
 `api.HandleHTTP` prefixes for authorized raw HTTP and `ipc.ServeUnix` for private
@@ -99,8 +101,8 @@ unimported development commands are excluded. Use
 authentication. See [App entry and registration](docs/app-entry.md).
 
 `init` and `add` read their templates from the locally installed
-`@synopackageland/templates`. CLI 0.41.12 depends on `~0.35.5`: npm installation or
-update can select the latest templates patch in the 0.35 minor line. Templates
+`@synopackageland/templates`. CLI 0.42.0 depends on `~0.37.0`: npm installation or
+update can select the latest templates patch in the 0.37 minor line. Templates
 patches need only a templates release; update the npm installation to receive them.
 The CLI never fetches templates at runtime, so offline use works after installation;
 commit a lockfile and use `npm ci` to reproduce a chosen dependency tree.
@@ -109,8 +111,8 @@ exact SDK Go module sum anchors the build manifest; npm integrity anchors the
 identical manifest in `@synopackageland/sdk/executor-manifest.json`. No manifest
 is fetched at NAS runtime. Missing, malformed or unsupported new manifests fail
 closed. SDK 0.26.0 and 0.27.0 retain the CLI's frozen legacy inventory.
-SDK defaults continue to come from the actual installed templates. An SDK minor
-release no longer requires a CLI release; new CLI capabilities or a new manifest
+CLI runtime defaults use its pinned SDK independently of the templates. An SDK minor
+release does not require a templates release; new CLI capabilities or a new manifest
 format can still require one.
 
 For development against local checkouts, set `SYNOPKGLAND_TEMPLATES_DIR` to a
@@ -535,7 +537,7 @@ for `ctl` calls; App command/job/transfer deadlines retain their existing defaul
 | 1 | Unexpected internal error (`CTL_INTERNAL`), or an uncaught CLI exception. |
 | 2 | Authentication/session failure: `CTL_NOT_AUTHENTICATED`, `CTL_AUTH_FAILED`, `CTL_CREDENTIAL_MISMATCH`, or unavailable OS credential storage. |
 | 3 | Invalid parameters, schema validation or unknown names: `CTL_PARAMS_INVALID`, `CTL_ARGUMENT_INVALID`, `CTL_APP_UNKNOWN`, `CTL_COMMAND_UNKNOWN`. |
-| 4 | Permission refusal that fails the command: `CTL_PERMISSION_DENIED`, `CTL_INVENTORY_DENIED`. |
+| 4 | Approval/trust or permission refusal: `CTL_APP_NEEDS_APPROVAL`, `CTL_PERMISSION_DENIED`, `CTL_INVENTORY_DENIED`. |
 | 5 | App/contract failure that fails the command: `CTL_APP_ERROR`, `CTL_RESPONSE_INVALID`, `CTL_JOB_FAILED`. |
 | 6 | Network/HTTP failure or uncertain completion: `CTL_NETWORK`, `CTL_HTTP_ERROR`, `CTL_JOB_TIMEOUT`, `CTL_LOGOUT_FAILED`. |
 | 7 | Confirmation required (`CTL_CONFIRM_REQUIRED`): a write/destructive command or host removal without confirmation; no business operation runs. |
@@ -545,13 +547,26 @@ For example, `synopkgland ctl studio drafts create --host nas --json` without
 `--yes` returns `ok:false` with `CTL_CONFIRM_REQUIRED` and exits 7 once discovery
 and parameter validation succeed. Missing sessions fail earlier with exit 2.
 Discovery catches per-App description errors and excludes those Apps from its
-results. For example, a changed pinned description (`CTL_DESCRIPTION_CHANGED`)
+results. For example, a changed pinned description (`CTL_APP_NEEDS_APPROVAL`)
 or an invalid descriptor (`CTL_DESCRIPTOR_INVALID`) appears in
 `ctl list --host nas --refresh --json` under `data.diagnostics`; the listing still
 returns `ok:true` and exits 0, even if no Apps remain. These diagnostic codes do
-not become process exit codes 4 or 5. Attempting to execute an excluded App with
-`--refresh` instead returns `ok:false`, `CTL_APP_UNKNOWN` and exit 3 because the
-App is absent from discovery results; no business operation runs.
+not become process exit codes 4 or 5 for a listing. Executing or requesting help
+for an installed App by package ID or a known cached alias instead returns its
+specific error; no business operation runs. A first approval, new version, or
+changed description returns `CTL_APP_NEEDS_APPROVAL` and exit 4, for example
+`SynoReclaim 1.2.0 needs approval`, with the exact App-scoped hint:
+
+```sh
+synopkgland ctl list --app SynoReclaim --approve-installed --host <profile>
+```
+
+Obtain the user's authorization before approving. Previously approved aliases
+identify upgraded installed packages without granting permission to execute.
+Use the package ID for first approval when no alias has been discovered yet.
+Only a name matching no installed package ID or known alias returns
+`CTL_APP_UNKNOWN` with “Did you mean …” suggestions. Other description failures,
+such as `CTL_DESCRIPTOR_INVALID`, remain specific errors (exit 5).
 
 `host list/show` can also succeed while reporting `authenticated:false` and
 exit 0. Check discovery `apps`/`diagnostics` and session fields as well as the exit

package/dist/ctl/cli.d.ts

@@ -12,6 +12,11 @@ export interface CtlIO {
 export declare function listView(host: string, apps: Descriptor[]): {
     commands: {
         parameters: string | Record<string, any>;
+        flags: {
+            flag: string;
+            valueType: string;
+            repeatable: boolean;
+        }[];
         examples: string[];
         summary: string;
         cli: string[];

package/dist/ctl/cli.js

@@ -6,7 +6,7 @@ import { Writable } from 'node:stream';
 import { CtlError, errorData, ctlError } from './errors.js';
 import { CtlStore } from './store.js';
 import { CtlClient, boundedMap } from './service.js';
-import { selectHosts, selectApp, selectOperation, flagName, RESERVED_FLAGS } from './input.js';
+import { selectHosts, selectOperation, flagName, flagValueType, RESERVED_FLAGS } from './input.js';
 import { canonicalOrigin, CTL_TIMEOUT_MS, createRequest } from './transport.js';
 import { loginDsm, logoutDsm } from './dsm-auth.js';
 import { publicOperation } from './redaction.js';
@@ -51,16 +51,23 @@ function take(args, flag, value = false) {
     return answer;
 }
 function q(value) { return "'" + value.replaceAll("'", "'\\''") + "'"; }
+function typedFlags(op) {
+    const fields = Object.entries(op.paramsSchema?.properties ?? {}), names = fields.map(([key]) => flagName(key));
+    if (names.some(name => RESERVED_FLAGS.has(name)) || new Set(names).size !== names.length)
+        return [];
+    return fields.flatMap(([key, schema]) => /^[A-Za-z][A-Za-z0-9_]*$/.test(key) && flagValueType(schema) ? [{ flag: '--' + flagName(key), valueType: flagValueType(schema), repeatable: schema.type === 'array' }] : []);
+}
 function example(host, app, op) {
     const base = `synopkgland ctl ${app.payload.aliases[0] ?? app.payload.package.id} ${op.cli.join(' ')} --host ${host}`;
+    const flags = typedFlags(op);
     return (op.examples?.length ? op.examples : [{}]).map(params => {
-        const simple = op.paramsSchema && Object.entries(params).every(([key, value]) => ['string', 'number', 'boolean'].includes(typeof value) && /^[A-Za-z][A-Za-z0-9_]*$/.test(key) && !RESERVED_FLAGS.has(flagName(key)) && op.paramsSchema?.properties?.[key]);
+        const simple = op.paramsSchema && Object.entries(params).every(([key, value]) => { const flag = flags.find(f => f.flag === '--' + flagName(key)); return flag && (flag.repeatable ? Array.isArray(value) && value.length > 0 && value.every(v => ['string', 'number', 'boolean'].includes(typeof v)) : ['string', 'number', 'boolean'].includes(typeof value)); });
         if (simple)
-            return base + Object.entries(params).map(([key, value]) => ' --' + flagName(key) + ' ' + q(String(value))).join('') + (op.effect === 'read' ? '' : ' --yes');
+            return base + Object.entries(params).flatMap(([key, value]) => (Array.isArray(value) ? value : [value]).map(item => ' --' + flagName(key) + ' ' + q(String(item)))).join('') + (op.effect === 'read' ? '' : ' --yes');
         return `printf '%s' ${q(JSON.stringify(params))} | ${base} --input -` + (op.effect === 'read' ? '' : ' --yes');
     });
 }
-export function listView(host, apps) { return apps.map(app => ({ host, package: app.payload.package, aliases: app.payload.aliases, protocolVersion: app.version, developedBy: app.payload.provenance.developedBy, provenance: 'self-declared', hash: app.sha256, ...(app.payload.external ? { external: app.payload.external } : {}), commands: Object.entries(app.payload.commands).map(([id, original]) => { const op = publicOperation(original); return { id, ...op, parameters: op.paramsSchema ?? 'Undescribed parameters; use --input', examples: example(host, app, op) }; }) })); }
+export function listView(host, apps) { return apps.map(app => ({ host, package: app.payload.package, aliases: app.payload.aliases, protocolVersion: app.version, developedBy: app.payload.provenance.developedBy, provenance: 'self-declared', hash: app.sha256, ...(app.payload.external ? { external: app.payload.external } : {}), commands: Object.entries(app.payload.commands).map(([id, original]) => { const op = publicOperation(original); return { id, ...op, parameters: op.paramsSchema ?? 'Undescribed parameters; use --input', flags: typedFlags(op), examples: example(host, app, op) }; }) })); }
 export async function runCtl(argv, io = {}) {
     if (argv[0] === 'external')
         return runExternal(argv.slice(1), io);
@@ -237,7 +244,7 @@ async function runCtlWithin(argv, io = {}) {
                 if (args[0] === 'help' || help) {
                     const nameArg = args[0] === 'help' ? args[1] : args[0];
                     const data = await ctl.discover(discoverOptions);
-                    const app = selectApp(data.apps, nameArg ?? '');
+                    const app = ctl.selectApp(data, nameArg ?? '');
                     const path = args[0] === 'help' ? args.slice(2) : args.slice(1);
                     const view = listView(name, [app])[0];
                     return { host: name, ok: true, data: path.length ? { ...view, commands: [view.commands.find(c => c.id === selectOperation(app, path).id)] } : view };

package/dist/ctl/descriptor.js

@@ -3,9 +3,10 @@ import { createHash } from 'node:crypto';
 import { canonicalize } from 'json-canonicalize';
 import Ajv2020 from 'ajv/dist/2020.js';
 import { CtlError } from './errors.js';
+import { schemaRegExp } from './pattern.js';
 export const DESCRIPTION_METHOD = 'synopkgland.describe';
 export const DESCRIPTION_FILE = 'synopkgland-api.json';
-export const ajv = new Ajv2020.default({ allErrors: true, strict: false, validateFormats: false, addUsedSchema: false });
+export const ajv = new Ajv2020.default({ allErrors: true, strict: false, validateFormats: false, addUsedSchema: false, code: { regExp: schemaRegExp } });
 const descriptorSchema = ajv.compile(JSON.parse(readFileSync(new URL('../../schema/synopkgland-api-v1.schema.json', import.meta.url), 'utf8')));
 export function makeDescriptor(payload) { const value = { format: 'synopkgland.api', version: 1, payload }; return { ...value, sha256: createHash('sha256').update(canonicalize(value)).digest('hex') }; }
 export function validateDescriptor(value, id, version) {

package/dist/ctl/input.d.ts

@@ -1,12 +1,16 @@
 import { type Descriptor, type Operation } from './descriptor.js';
 export declare function selectHosts(names: string[], selected?: string, all?: boolean): string[];
-export declare function selectApp(apps: Descriptor[], name: string): Descriptor;
+export declare function selectApp<T extends {
+    id: string;
+    aliases: string[];
+}>(apps: T[], name: string): T;
 export declare function selectOperation(app: Descriptor, path: string[]): {
     id: string;
     operation: Operation;
 };
 export declare const RESERVED_FLAGS: Set<string>;
 export declare function flagName(key: string): string;
+export declare function flagValueType(schema: any): string | undefined;
 export declare function operationInput(op: Operation, args: string[], stdin?: string, helpHint?: string): Record<string, unknown>;
 export declare function requestPlan(app: Descriptor, id: string, params: Record<string, unknown>): {
     package: string;

package/dist/ctl/input.js

@@ -21,12 +21,15 @@ export function selectHosts(names, selected, all = false) {
     return [...new Set(hosts)];
 }
 export function selectApp(apps, name) {
-    const found = apps.filter(a => [a.payload.package.id, ...a.payload.aliases].some(s => s.toLowerCase() === name.toLowerCase()));
+    const exact = apps.find(app => app.id.toLowerCase() === name.toLowerCase());
+    if (exact)
+        return exact;
+    const found = apps.filter(app => app.aliases.some(alias => alias.toLowerCase() === name.toLowerCase()));
     if (found.length > 1)
-        throw new CtlError('CTL_APP_AMBIGUOUS', 'Alias matches multiple packages.', 'Use an exact DSM package ID.', 3, found.map(a => a.payload.package.id));
+        throw new CtlError('CTL_APP_AMBIGUOUS', 'Alias matches multiple packages.', 'Use an exact DSM package ID.', 3, found.map(app => app.id));
     if (found.length === 1)
         return found[0];
-    return choose(name, apps.flatMap(a => [a.payload.package.id, ...a.payload.aliases]), 'app');
+    return choose(name, apps.flatMap(app => [app.id, ...app.aliases]), 'app');
 }
 export function selectOperation(app, path) {
     const found = Object.entries(app.payload.commands).find(([, op]) => op.cli.join(' ') === path.join(' '));
@@ -36,6 +39,10 @@ export function selectOperation(app, path) {
 }
 export const RESERVED_FLAGS = new Set(['ca', 'strict-tls', 'host', 'all-hosts', 'json', 'app', 'refresh', 'yes', 'dry-run', 'approve-installed', 'help', 'input', 'wait', 'no-wait', 'timeout']);
 export function flagName(key) { return key.replace(/[A-Z]/g, c => '-' + c.toLowerCase()).replaceAll('_', '-'); }
+export function flagValueType(schema) {
+    const type = schema?.type === 'array' ? schema.items?.type : schema?.type;
+    return ['string', 'integer', 'number', 'boolean'].includes(type) ? type : undefined;
+}
 export function operationInput(op, args, stdin, helpHint) {
     const fail = (message, allowed) => { throw new CtlError('CTL_PARAMS_INVALID', message, helpHint ?? ('run: synopkgland ctl <package> ' + op.cli.join(' ') + ' --help'), 3, allowed); };
     const inputIndex = args.indexOf('--input');
@@ -78,35 +85,42 @@ export function operationInput(op, args, stdin, helpHint) {
             const field = fields.get(flag);
             if (!field)
                 return fail('Unknown parameter flag.', [...fields.keys()]);
-            const [key, schema] = field;
-            if (Object.hasOwn(params, key))
+            const [key, schema] = field, repeatable = schema.type === 'array', type = flagValueType(schema);
+            if (Object.hasOwn(params, key) && !repeatable)
                 return fail(`Duplicate parameter flag ${flag}.`);
-            if (!['string', 'integer', 'number', 'boolean'].includes(schema.type))
+            if (!type)
                 return fail(`Complex parameter ${flag}: use --input.`);
             let value = split > 0 ? args[i].slice(split + 1) : undefined;
-            if (value === undefined && schema.type === 'boolean' && (!args[i + 1] || args[i + 1].startsWith('--')))
+            if (value === undefined && type === 'boolean' && (!args[i + 1] || args[i + 1].startsWith('--')))
                 value = 'true';
+            else if (value === undefined && (!args[i + 1] || args[i + 1].startsWith('--')))
+                return fail(`Missing parameter value for ${flag}.`);
             else if (value === undefined)
                 value = args[++i];
             if (value === undefined)
                 return fail(`Missing parameter value for ${flag}.`);
-            if (schema.type === 'integer') {
+            let parsed = value;
+            if (type === 'integer') {
                 if (!/^-?\d+$/.test(value) || !Number.isSafeInteger(Number(value)))
                     return fail(`Parameter ${flag} must be a safe integer.`);
-                params[key] = Number(value);
+                parsed = Number(value);
             }
-            else if (schema.type === 'number') {
+            else if (type === 'number') {
                 if (!value.trim() || !Number.isFinite(Number(value)))
                     return fail(`Parameter ${flag} must be a number.`);
-                params[key] = Number(value);
+                parsed = Number(value);
             }
-            else if (schema.type === 'boolean') {
+            else if (type === 'boolean') {
                 if (!['true', 'false'].includes(value))
                     return fail(`Parameter ${flag} must be true or false.`);
-                params[key] = value === 'true';
+                parsed = value === 'true';
+            }
+            if (repeatable) {
+                const values = (params[key] ??= []);
+                values.push(parsed);
             }
             else
-                params[key] = value;
+                params[key] = parsed;
         }
     }
     if (!params || Array.isArray(params) || typeof params !== 'object')

package/dist/ctl/pattern.d.ts

@@ -0,0 +1,12 @@
+/** Package-supplied schema patterns never run in the backtracking JS engine. */
+export declare function schemaPattern(pattern: string): {
+    test(value: string): boolean;
+    toString(): string;
+};
+/** Ajv's pattern and patternProperties keywords must use the same engine. */
+export declare const schemaRegExp: ((pattern: string, _flags: string) => {
+    test(value: string): boolean;
+    toString(): string;
+}) & {
+    code: string;
+};

package/dist/ctl/pattern.js

@@ -0,0 +1,10 @@
+import { RE2JS } from 're2js';
+/** Package-supplied schema patterns never run in the backtracking JS engine. */
+export function schemaPattern(pattern) {
+    if (pattern.length > 4096)
+        throw new Error('schema pattern exceeds 4096 characters');
+    const compiled = RE2JS.compile(RE2JS.translateRegExp(pattern));
+    return { test: value => compiled.test(value), toString: () => pattern };
+}
+/** Ajv's pattern and patternProperties keywords must use the same engine. */
+export const schemaRegExp = Object.assign((pattern, _flags) => schemaPattern(pattern), { code: 'schemaRegExp' });

package/dist/ctl/redaction.js

@@ -1,4 +1,5 @@
 import { CtlError, ctlError } from './errors.js';
+import { schemaPattern } from './pattern.js';
 export const REDACTED = '<redacted>';
 function reference(root, ref) {
     if (!ref.startsWith('#'))
@@ -55,6 +56,22 @@ function branches(schemas, root) {
     return result;
 }
 export function redactValue(value, schema, root = schema, onSecret) {
+    const patterns = new Map();
+    const matches = (pattern, key) => {
+        let compiled = patterns.get(pattern);
+        if (!compiled) {
+            // Cached descriptors and direct callers can bypass descriptor validation.
+            // Unsupported syntax must conservatively apply its privacy annotations.
+            try {
+                compiled = schemaPattern(pattern);
+            }
+            catch {
+                compiled = { test: () => undefined };
+            }
+            patterns.set(pattern, compiled);
+        }
+        return compiled.test(key);
+    };
     const walk = (input, schemas) => {
         const nodes = branches(schemas, root);
         if (nodes.some(node => node.writeOnly === true)) {
@@ -76,10 +93,12 @@ export function redactValue(value, schema, root = schema, onSecret) {
                         matched = true;
                     }
                     for (const [pattern, child] of Object.entries(node.patternProperties ?? {})) {
-                        if (new RegExp(pattern).test(key)) {
+                        const match = matches(pattern, key);
+                        if (match !== false)
                             children.push(child);
+                        // An unknown match must not suppress additionalProperties privacy.
+                        if (match === true)
                             matched = true;
-                        }
                     }
                     if (!matched)
                         children.push(node.additionalProperties);

package/dist/ctl/service.d.ts

@@ -1,3 +1,4 @@
+import { CtlError } from './errors.js';
 import { type DsmSession, type JsonRequest } from './transport.js';
 import { CtlStore, type Host } from './store.js';
 import { type Descriptor } from './descriptor.js';
@@ -11,6 +12,18 @@ export interface DiscoverOptions {
         version: string;
     }[]) => Promise<boolean>;
 }
+interface InstalledApp {
+    id: string;
+    version: string;
+    aliases: string[];
+    error?: CtlError;
+}
+interface Discovery {
+    apps: Descriptor[];
+    installed: InstalledApp[];
+    diagnostics: any[];
+    cacheHits: number;
+}
 export declare class CtlClient {
     store: CtlStore;
     host: Host;
@@ -24,11 +37,9 @@ export declare class CtlClient {
         version: string;
         state?: unknown;
     }[]>;
-    discover(options?: DiscoverOptions): Promise<{
-        apps: Descriptor[];
-        diagnostics: any[];
-        cacheHits: number;
-    }>;
+    private needsApproval;
+    selectApp(listing: Discovery, name: string): Descriptor;
+    discover(options?: DiscoverOptions): Promise<Discovery>;
     execute(name: string, path: string[], args: string[], options?: DiscoverOptions & {
         yes?: boolean;
         dryRun?: boolean;
@@ -39,3 +50,4 @@ export declare class CtlClient {
     private executeWithin;
     private appCookieSession;
 }
+export {};

package/dist/ctl/service.js

@@ -1,4 +1,4 @@
-import { CtlError, errorData, choose } from './errors.js';
+import { CtlError, ctlError, errorData } from './errors.js';
 import { APP_COOKIE, CTL_TIMEOUT_MS, createRequest } from './transport.js';
 import { DESCRIPTION_METHOD, validateDescriptor, ajv } from './descriptor.js';
 import { runFlow } from './flows.js';
@@ -41,24 +41,26 @@ export class CtlClient {
         return entries.map((p) => { if (typeof p.id !== 'string' || !/^[A-Za-z][A-Za-z0-9_.+-]{0,127}$/.test(p.id) || typeof p.version !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._+~-]{0,63}$/.test(p.version))
             throw new CtlError('CTL_INVENTORY_INVALID', 'Invalid package identity.', 'Check the DSM response.', 5); return { id: p.id, version: p.version, state: p.additional?.status }; });
     }
+    needsApproval(pkg) {
+        return new CtlError('CTL_APP_NEEDS_APPROVAL', `${pkg.id} ${pkg.version} needs approval`, `run: synopkgland ctl list --app ${pkg.id} --approve-installed --host ${this.host.name}`, 4);
+    }
+    selectApp(listing, name) {
+        const pkg = selectApp(listing.installed, name);
+        if (pkg.error)
+            throw pkg.error;
+        return listing.apps.find(app => app.payload.package.id === pkg.id);
+    }
     async discover(options = {}) {
         const session = await this.store.session(this.host);
-        let packages = await this.inventory(session);
+        let packages = (await this.inventory(session)).map(pkg => {
+            const approved = this.host.approved[pkg.id];
+            // Previous-version metadata identifies aliases only; it never authorizes a call.
+            const description = this.store.cache(this.host, pkg.id, pkg.version)?.description ?? (approved ? this.store.cache(this.host, pkg.id, approved.version)?.description : undefined);
+            return { ...pkg, aliases: description?.payload.aliases ?? [] };
+        });
         // An exact package filter narrows credential delivery. Alias selection needs the cached descriptors first.
-        if (options.app) {
-            const exact = packages.find(p => p.id.toLowerCase() === options.app.toLowerCase());
-            if (exact)
-                packages = [exact];
-            else {
-                const match = packages.find(p => this.store.cache(this.host, p.id, p.version)?.description?.payload.aliases?.some((a) => a.toLowerCase() === options.app.toLowerCase()));
-                if (match)
-                    packages = [match];
-                else {
-                    const known = packages.flatMap(p => { const d = this.store.cache(this.host, p.id, p.version)?.description; return d ? [p.id, ...d.payload.aliases] : []; });
-                    choose(options.app, known, 'app');
-                }
-            }
-        }
+        if (options.app)
+            packages = [selectApp(packages, options.app)];
         const pending = packages.filter(p => this.host.approved[p.id]?.version !== p.version);
         if (pending.length && (options.approve || await options.confirm?.(pending))) {
             for (const p of pending)
@@ -68,11 +70,14 @@ export class CtlClient {
         let cacheHits = 0;
         const results = await boundedMap(packages, 4, async (pkg) => {
             const approval = this.host.approved[pkg.id];
-            if (approval?.version !== pkg.version)
-                return { error: { package: pkg.id, code: 'CTL_TRUST_REQUIRED', message: 'Description endpoint not approved.', hint: `run: synopkgland ctl list --host ${this.host.name} --approve-installed` } };
+            if (approval?.version !== pkg.version) {
+                pkg.error = this.needsApproval(pkg);
+                return { error: { package: pkg.id, ...errorData(pkg.error) } };
+            }
             const cached = options.refresh ? null : this.store.cache(this.host, pkg.id, pkg.version);
             if (cached?.failure) {
                 cacheHits++;
+                pkg.error = new CtlError(cached.failure.code, cached.failure.message, cached.failure.hint, 5);
                 return { error: { package: pkg.id, ...cached.failure, cached: true } };
             }
             try {
@@ -87,13 +92,19 @@ export class CtlClient {
                         throw new CtlError('CTL_DESCRIPTION_UNAVAILABLE', `Description refused (${String(response?.error?.code ?? 'invalid response')}).`, 'Use --refresh after updating the App.', 5);
                     description = validateDescriptor(response.data, pkg.id, pkg.version);
                 }
-                if (approval.hash && approval.hash !== description.sha256 && !options.approve)
-                    throw new CtlError('CTL_DESCRIPTION_CHANGED', 'Description hash changed; approval required.', `run: synopkgland ctl list --host ${this.host.name} --refresh --approve-installed`, 4);
+                if (approval.hash && approval.hash !== description.sha256 && !options.approve) {
+                    // Remember the observed change so a later cache hit cannot revive the old approval.
+                    this.store.putCache(this.host, pkg.id, pkg.version, description);
+                    pkg.aliases = [...new Set([...pkg.aliases, ...description.payload.aliases])];
+                    throw this.needsApproval(pkg);
+                }
+                pkg.aliases = description.payload.aliases;
                 approval.hash = description.sha256;
                 this.store.putCache(this.host, pkg.id, pkg.version, description);
                 return { description };
             }
             catch (error) {
+                pkg.error = ctlError(error);
                 const failure = errorData(error);
                 if (failure.code === 'CTL_DESCRIPTION_UNAVAILABLE')
                     this.store.putFailure(this.host, pkg.id, pkg.version, failure);
@@ -102,7 +113,7 @@ export class CtlClient {
         });
         this.host.lastUsed = new Date().toISOString();
         this.store.save(this.host);
-        return { apps: results.flatMap(r => r.description ? [r.description] : []), diagnostics: results.flatMap(r => r.error ? [r.error] : []), cacheHits };
+        return { apps: results.flatMap(r => r.description ? [r.description] : []), installed: packages, diagnostics: results.flatMap(r => r.error ? [r.error] : []), cacheHits };
     }
     async execute(name, path, args, options = {}) {
         try {
@@ -116,7 +127,7 @@ export class CtlClient {
         const started = performance.now();
         this.until = started + (options.timeoutMs ?? CTL_TIMEOUT_MS);
         const listing = await this.discover(options);
-        const app = selectApp(listing.apps, name);
+        const app = this.selectApp(listing, name);
         const { id, operation } = selectOperation(app, path);
         const params = operationInput(operation, args, options.stdin, `run: synopkgland ctl ${name} ${operation.cli.join(' ')} --host ${this.host.name} --help`);
         const output = new SensitiveOutput(params, operation.paramsSchema);

package/dist/e2e/app-open.js

@@ -2,6 +2,7 @@ import { readFileSync } from 'node:fs';
 import { parse } from 'yaml';
 import { resolveAppLaunch } from '../contract/app-launch.js';
 import { trustedAppEntryPath } from '../contract/web-launch.js';
+import { readDaemonIngress } from '../standalone/daemon-ingress.js';
 function safeEntry(entry) {
     const url = new URL(entry, 'https://dsm.example');
     if ((!entry.startsWith('/') && !/^https?:\/\//.test(entry)) || entry.startsWith('//') ||
@@ -25,7 +26,10 @@ export function deriveSmokeEntry(raw, entry) {
     if (!launch)
         throw new Error('Invalid app launch mode in manifest.');
     const window = launch === 'dsm-window' && !raw.console && raw.ui !== false && !raw.compose && !raw.daemon?.ingress;
-    const derived = raw.daemon?.ingress?.path ?? (gateway
+    const ingress = readDaemonIngress(raw.daemon?.ingress, raw.package, () => { });
+    if (raw.daemon?.ingress !== undefined && !ingress)
+        throw new Error('Invalid daemon ingress: use /synopkgland/<package>/ with the exact package ID');
+    const derived = ingress?.path ?? (gateway
         ? `/webman/3rdparty/${raw.package}/sso/open.cgi`
         : native ? `/?launchApp=${encodeURIComponent(appId)}`
             : trustedAppEntryPath(raw));

package/dist/error-registry.js

@@ -336,7 +336,7 @@ export const ERROR_REGISTRY = {
         STANDALONE_DAEMON_RESTART_SDK_REQUIRED: {
             code: "STANDALONE_DAEMON_RESTART_SDK_REQUIRED",
             description: "The selected controller SDK version or source does not support daemon.restart.",
-            suggestion: "Upgrade the selected controller SDK to 0.26.0 or later and use matching sources, including a local SDK override; update the App SDK requirement, identity_gateway.sdk or the templates that supply the default.",
+            suggestion: "Upgrade the selected controller SDK to 0.26.0 or later and use matching sources, including a local SDK override; update the App SDK requirement, identity_gateway.sdk or the CLI that supplies the default.",
         },
         UNINSTALL_INVALID: {
             code: "UNINSTALL_INVALID",
@@ -386,7 +386,7 @@ export const ERROR_REGISTRY = {
         STANDALONE_DAEMON_INGRESS_INVALID: {
             code: "STANDALONE_DAEMON_INGRESS_INVALID",
             description: "daemon.ingress does not declare one same-origin path and a bounded proxy timeout.",
-            suggestion: "Set daemon.ingress.path to /<name>/ with lowercase letters, digits and -, not a DSM path, and timeout (optional) to 1–3600 seconds.",
+            suggestion: "Set daemon.ingress.path to exactly /synopkgland/<package>/ using the case-sensitive manifest package ID, and timeout (optional) to 1–3600 seconds",
         },
         STANDALONE_DAEMON_INGRESS_MIN_DSM: {
             code: "STANDALONE_DAEMON_INGRESS_MIN_DSM",

package/dist/host/package-commands.d.ts

@@ -12,6 +12,20 @@ export interface InstallOptions {
     dryRun?: boolean;
 }
 export declare function installPackage(spec: string, options?: InstallOptions, connection?: NasConnection): Promise<{
+    message?: string | undefined;
+    host: string;
+    target: NasTarget;
+    source: string;
+    packages: {
+        signed?: boolean | undefined;
+        package: string;
+        version: string;
+        size: number;
+        action: string;
+    }[];
+    parameters: string[];
+} | {
+    message?: string | undefined;
     host: string;
     target: NasTarget;
     source: string;
@@ -26,6 +40,7 @@ export declare function installPackage(spec: string, options?: InstallOptions, c
     dryRun: boolean;
 } | {
     status: import("./catalog-install.js").InstalledPackageState | undefined;
+    message?: string | undefined;
     host: string;
     target: NasTarget;
     source: string;