@synopackageland/cli 0.41.12 → 0.42.0

package/dist/standalone/native-layout.js

@@ -257,10 +257,27 @@ export function checkLayoutMetadata(root, inspection = false, packageId) {
             if (/\\\s*$/m.test(unit))
                 fail('systemd unit continuations are unsupported');
             let section = '';
+            // These settings either describe ordering or operate on the package
+            // process. Manager actions/dependencies and filesystem setup are absent.
+            const directives = {
+                Unit: ['Description', 'Documentation', 'After', 'Before'],
+                Service: ['Type', 'User', 'Group', 'ExecStart', 'ExecStartPre', 'ExecStartPost', 'ExecStop', 'ExecStopPost', 'ExecReload',
+                    'Restart', 'RestartSec', 'TimeoutStartSec', 'TimeoutStopSec', 'KillMode', 'KillSignal', 'WorkingDirectory', 'Environment'],
+                Install: ['WantedBy'],
+            };
             for (const line of unit.split('\n')) {
+                if (!line.trim() || /^\s*[#;]/.test(line))
+                    continue;
                 const heading = line.match(/^\s*\[([^\]]+)\]\s*$/);
-                if (heading)
+                if (heading) {
                     section = heading[1];
+                    if (!Object.hasOwn(directives, section))
+                        fail(`unsupported systemd section: ${section}`);
+                    continue;
+                }
+                const assignment = line.match(/^\s*([A-Za-z][A-Za-z0-9]*)\s*=/);
+                if (!assignment || !Object.hasOwn(directives, section) || !directives[section].includes(assignment[1]))
+                    fail(`unsupported systemd unit directive in ${section || 'missing section'}`);
                 if (/^\s*(?:User|Group|Exec\w*)\s*=/.test(line) && section !== 'Service')
                     fail('systemd execution directives require the package Service section');
             }

package/dist/template-paths.d.ts

@@ -3,7 +3,3 @@
  * package; SYNOPKGLAND_TEMPLATES_DIR points at a templates checkout instead.
  */
 export declare function templatesRoot(env?: NodeJS.ProcessEnv, from?: string): string;
-/** The installed templates' SDK pin also supplies CLI-owned runtime defaults.
- * CLI-only patch releases must never turn their own version into an SDK tag.
- */
-export declare function templateSdkVersion(env?: NodeJS.ProcessEnv): string;

package/dist/template-paths.js

@@ -1,6 +1,5 @@
 import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
-import { sdkRequirement } from "./runtime/sdk-source.js";
 /**
  * The scaffold templates come from the locally installed @synopackageland/templates
  * package; SYNOPKGLAND_TEMPLATES_DIR points at a templates checkout instead.
@@ -15,13 +14,3 @@ export function templatesRoot(env = process.env, from = import.meta.url) {
         throw new Error("[TEMPLATES_MISSING] @synopackageland/templates is not installed; reinstall @synopackageland/cli, or set SYNOPKGLAND_TEMPLATES_DIR to a templates checkout.");
     }
 }
-/** The installed templates' SDK pin also supplies CLI-owned runtime defaults.
- * CLI-only patch releases must never turn their own version into an SDK tag.
- */
-export function templateSdkVersion(env = process.env) {
-    const version = sdkRequirement(join(templatesRoot(env), "native-go/backend"));
-    if (!version || !/^\d+\.\d+\.\d+$/.test(version)) {
-        throw new Error("[TEMPLATES_MISSING] The installed templates have no valid SDK pin; reinstall @synopackageland/templates.");
-    }
-    return version;
-}

package/docs/ctl-external.md

@@ -68,6 +68,22 @@ selected live descriptor against its approved hash. Zero or multiple matching
 Apps refuse; revoke the unwanted approval or use distinct protocol IDs. A cache
 is only a recipient selector and never grants tool authority.
 
+For ordinary `ctl <alias|package> …` and help requests, an installed App awaiting
+first approval, a new version's approval, or approval of a changed description
+returns `CTL_APP_NEEDS_APPROVAL` (exit 4). For example, the message is
+`SynoReclaim 1.2.0 needs approval` with an App-scoped command:
+
+```sh
+synopkgland ctl list --app SynoReclaim --approve-installed --host controller
+```
+
+Obtain the user's authorization before running the hint. Cached aliases from the
+previously approved version still identify an upgraded installed App, but cannot
+authorize execution. Before an alias has been discovered, use the package ID for
+first approval. Unknown-name suggestions appear only if no installed package ID
+or known alias matches. `ctl list` includes pending approvals in its diagnostics;
+external calls retain the separate protocol/pin checks described below.
+
 Only a named, registered host and its OS-stored session are used. Ambient
 `DSM_*` credentials/URL cannot create or replace this login. HTTPS requires the
 stored SHA-256 certificate pin and refuses rotation before sending HTTP headers,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.41.12",
+  "version": "0.42.0",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -28,10 +28,11 @@
   },
   "dependencies": {
     "@napi-rs/keyring": "^2.1.1",
-    "@synopackageland/templates": "~0.35.5",
+    "@synopackageland/templates": "~0.37.0",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "json-canonicalize": "^3.0.1",
+    "re2js": "2.9.1",
     "tar": "^7.4.3",
     "yaml": "^2.7.0"
   },

package/skills/SKILL.md

@@ -5,7 +5,7 @@ description: Initialize, extend, check, build, inspect, and deploy Synology appl
 
 # Independent Synology SPKs
 
-The CLI installs templates through `~0.35.5`. A templates patch needs only a
+The CLI installs templates through `~0.37.0`. A templates patch needs only a
 templates release; npm install/update selects a patch in that minor line. The CLI
 uses the locally installed templates and reads their SDK pin for defaults; it
 never downloads templates at runtime. Preserve the lockfile and use `npm ci` for

package/skills/reference/ctl.md

@@ -10,8 +10,30 @@ Use this for operating installed Apps, rather than building/deploying projects.
 4. Use the discovered alias, CLI path and typed flags with an explicit `--host nas`; inspect `--help` and `--dry-run` before execution. For example, `synopkgland ctl notes list --status pending --host nas --dry-run`. Use the real command/schema from discovery, not this illustrative name.
 5. Reads need no write confirmation. For authorized write/destructive commands, add `--yes`; without it the CLI returns a plan and confirmation error. A --yes flag does not replace the user's authorization or the App's backend checks.
 
+Typed flags accept strings, integers, numbers and booleans, including arrays of
+these scalar types. Repeat an array flag for each item, for example
+`--targets /volume1 --targets /volume2`; one occurrence still produces an array.
+Use `--flag=value` when a string item starts with `--`. Commas are literal string
+content, not array separators. Items and the complete array are checked against
+the command schema. Command `--help` lists each supported flag's `valueType` and
+`repeatable` status and renders scalar-array examples as repeated flags.
+Objects, arrays of objects, nested arrays and arrays without a scalar item type
+require `--input <file|->`; use JSON input for an explicit empty array too.
+Plans keep schema-marked private paths and other sensitive values redacted.
+
 With multiple hosts, select a default with `synopkgland host default <name>` or specify --host. `--host a,b` and --all-hosts return per-host results, with exit 8 on partial failure. Do not retry a write merely because one host failed; query its state first. --refresh rereads descriptions; unchanged package versions use the host/account/package/version/hash cache. Never assume cached metadata grants resource permission.
 
+An installed App awaiting first approval, approval of a new version, or approval
+of a changed description returns `CTL_APP_NEEDS_APPROVAL` (exit 4) when selected
+by package ID or a known cached alias, including help requests. The message names
+the installed package and version, for example `SynoReclaim 1.2.0 needs approval`.
+Obtain the user's authorization, then follow the exact App-scoped hint:
+`synopkgland ctl list --app SynoReclaim --approve-installed --host <profile>`.
+Previous-version aliases identify the installed App only; they never authorize
+execution. An alias not yet discovered requires the package ID for first approval.
+`CTL_APP_UNKNOWN` and “Did you mean …” apply only when no installed package ID or
+known alias matches. `ctl list` reports pending approvals in `data.diagnostics`.
+
 Use `host show nas` to inspect approvals/pins, `host revoke nas PackageID` to remove an App approval, `host logout nas` to retain registration, and `host remove nas --yes` to delete sessions, device token, approvals and cache. A failed NAS logout is reported independently from successful local removal.
 
 Stdout defaults to JSON without a TTY. Success is {ok:true,data}; failure is {ok:false,error:{code,message,hint,allowed?}}. Multi-host output uses {ok,results:[{host,ok,data|error}]}. Follow the concrete hint and complete allowed list; do not guess another method or bypass ctl with raw HTTP. Exit codes: 2 authentication, 3 parameters/names, 4 permissions/trust, 5 App/contract, 6 network, 7 confirmation, 8 partial failure.
@@ -163,6 +185,8 @@ For AI consumers: execute commands that describe a complete task. Do not manuall
 
 App authors must mark passkeys, tokens, private URLs, torrent/base64 and upload content with standard JSON Schema `writeOnly: true`, including nested objects, array items and local references. Mark sensitive response fields in resultSchema too. Do not embed real secrets in schema defaults/enums/examples or command examples.
 
+Parameter and result schema `pattern` and `patternProperties` use the linear RE2 engine, with at most 4096 characters per pattern. Backreferences, lookarounds and other unsupported syntax are rejected during description validation. If an unvalidated or cached privacy pattern cannot be compiled, redaction conservatively applies that pattern's annotations to every property.
+
 CLI plans, dry-run, missing-yes errors, JSON/multi-host output and known input values repeated by the App use the fixed string `<redacted>`. Schema validation errors never echo instance values or paths. This changes presentation only: authorized requests still send the original values. The CLI does not log or cache business parameters. Sensitive description examples/defaults are masked in list/help and disk caches; a cache altered by redaction requires a fresh authenticated description/hash check before execution. Fill placeholders locally; never paste secrets into AI messages or logs.
 
 ## Command naming recommendations

package/skills/reference/daemon-mode.md

@@ -6,6 +6,11 @@ for every request, and the process exits when the request ends. With
 the same binary runs once as the package daemon and serves the pages through
 DSM's nginx. The CGI stays for integrations, transfers and fallback.
 
+Set `daemon.ingress.path` to exactly `/synopkgland/<package>/`, preserving the
+manifest package ID's case. The backend mounts routes at
+`SYNOPKGLAND_INGRESS_PATH`; build, inspect and smoke entry checks bind this path
+to the package.
+
 Daemon mode is not the default recommendation. It removes work that repeats
 on every request. It does not make a single expensive request cheaper, and it
 costs memory for as long as the package runs. Measure first, then decide.

package/skills/reference/install.md

@@ -1,6 +1,6 @@
 # Native installation settings
 
-Use SDK/App 0.38.6, CLI 0.41.12 and templates 0.35.5. Configure installation through the manifest and generated wizard; do not add App ACL writers, root hooks or independent port state.
+Use SDK/App 0.41.1, CLI 0.42.0 and templates 0.37.0. Configure installation through the manifest and generated wizard; do not add App ACL writers, root hooks or independent port state.
 
 ```yaml
 install: