@synopackageland/cli 0.41.7 → 0.41.9

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 0.41.9 (2026-10-30)
+
+- Accept self-signed DSM and redirected gateway certificates by default in the
+  Chromium e2e target, before its first network navigation.
+- Preserve installer-managed ports when the SPK inspector reconstructs daemon
+  and background lifecycle hooks, so native gateway Apps with `install.ports`
+  build and inspect consistently.
+
+## 0.41.8 (2026-10-30)
+
+- Preserve the manifest's installer ports, settings and shared-folder context
+  when locking Compose images during build. Apps referencing `install.ports`
+  in runtime environment declarations now build as well as pass check.
+- Cover offline locking and Compose scaffold build/inspection with installer
+  runtime ports in the CLI release gates.
+- Derive app-open smoke expectations from the manifest: an `admin-only` App
+  requires gateway denial for a normal user, with App content and ready markers
+  absent. Administrators and permitted normal users still require ready.
+
 ## 0.41.7 (2026-10-30)
 
 - Allow `webapi` raw profiles to set `raw_max_bytes` up to 10 GiB

package/README.md

@@ -225,6 +225,10 @@ not change how the App runs or its privilege tier. See `synopkgland skill show b
 suite on [`e2e`](https://www.npmjs.com/package/e2e) and `@e2e-dev/web`
 (optional peers, with `ai` and `@ai-sdk/openai`).
 
+`dsmTarget()` uses Chromium and accepts self-signed DSM and gateway HTTPS
+certificates by default, including redirects from an HTTP DSM URL. It configures
+CDP before the first network navigation; this certificate handling is Chromium-only.
+
 ```ts
 // e2e.config.ts
 import {dsmTarget, magpieAgent} from '@synopackageland/cli/e2e';
@@ -275,8 +279,14 @@ appOpenSmoke({ ready: '[data-app-ready]' });
 `ready` is an app-content CSS selector or `{text: 'Exact text'}`. The helper
 reads `dsm-package.yaml` (`app` overrides its filename) and derives the launcher
 and entry using the packaging defaults. `entry` overrides a configured Portal
-alias or ingress URL. Three tests cover administrator (A), normal user with
-Application Privileges (N), and a fresh anonymous browser context (X).
+alias or ingress URL. Three tests cover administrator (A), normal user (N),
+and a fresh anonymous browser context (X). A must reach `ready`. For
+`entry: admin-only`, N must see the SDK gateway's access-denied page, with
+the `ready` and App content markers absent from the DOM. Set `content` to
+an App shell selector or text marker when it differs from `ready`, for example
+`appOpenSmoke({ready: '[data-app-ready]', content: '#app'})`.
+For other entry kinds, N must reach `ready`; grant that account Application
+Privileges as needed. Keep the App's intended entry policy to run the smoke.
 N explicitly skips when neither `DSM_E2E_ACCOUNT_NORMAL` nor its saved profile
 exists; `normal` selects another named account/profile. A defaults to `admin`.
 An expired saved profile needs its account file to sign in again and fails if

package/dist/e2e/app-open.d.ts

@@ -9,6 +9,8 @@ export interface AppOpenSmokeOptions {
     /** Override the manifest-derived entry, e.g. a configured Portal alias. */
     entry?: string;
     ready: SmokeMarker;
+    /** App shell/content marker to exclude on denied pages; defaults to ready. */
+    content?: SmokeMarker;
     /** Required only for an entry the manifest declares upstream-authenticated. */
     publicLogin?: SmokeMarker;
     admin?: string;
@@ -21,6 +23,7 @@ export interface SmokeEntry {
     entry: string;
     window: boolean;
     upstreamAuthenticated: boolean;
+    normalExpectation: 'ready' | 'denied';
 }
 /** Uses the same launch defaults and legacy web entry resolver as packaging. */
 export declare function deriveSmokeEntry(raw: any, entry?: string): SmokeEntry;

package/dist/e2e/app-open.js

@@ -36,7 +36,8 @@ export function deriveSmokeEntry(raw, entry) {
     const upstreamAuthenticated = (gateway?.upstream_access === 'public' && pathname !== menuEntry) ||
         (!native && raw.integration?.web?.access === 'public') ||
         (gateway?.upstream_auth_paths ?? []).some((prefix) => pathname === prefix || pathname.startsWith(prefix.endsWith('/') ? prefix : `${prefix}/`));
-    return { package: raw.package, appId, entry: selected, window: entry ? false : window, upstreamAuthenticated };
+    return { package: raw.package, appId, entry: selected, window: entry ? false : window, upstreamAuthenticated,
+        normalExpectation: raw.entry === 'admin-only' ? 'denied' : 'ready' };
 }
 export function readSmokeEntry(options) {
     return deriveSmokeEntry(parse(readFileSync(options.app ?? 'dsm-package.yaml', 'utf8')), options.entry);

package/dist/e2e/certificates.d.ts

@@ -0,0 +1,6 @@
+import { type EngineHandle } from "e2e/engine";
+import type { surfaceOf } from "@e2e-dev/web";
+type Surface = NonNullable<ReturnType<typeof surfaceOf>>;
+/** Chromium DSM test targets accept self-signed DSM and redirected gateway certificates. */
+export declare function withDsmCertificates(base: EngineHandle, surface: () => Surface): EngineHandle;
+export {};

package/dist/e2e/certificates.js

@@ -0,0 +1,60 @@
+import { defineEngine } from "e2e/engine";
+/** Chromium DSM test targets accept self-signed DSM and redirected gateway certificates. */
+export function withDsmCertificates(base, surface) {
+    const browsers = new WeakMap();
+    const pages = new WeakMap();
+    async function prepareBrowser() {
+        const browser = surface().context().browser();
+        if (!browser)
+            return false;
+        let pending = browsers.get(browser);
+        if (!pending) {
+            pending = (async () => {
+                const session = await browser.newBrowserCDPSession();
+                await session.send("Security.setIgnoreCertificateErrors", { ignore: true });
+                return true;
+            })().catch(() => false); // Some Chromium connections expose only page CDP.
+            browsers.set(browser, pending);
+        }
+        return pending;
+    }
+    const { capabilities: _capabilities, ...spec } = base;
+    return defineEngine({
+        ...spec,
+        async startAttempt(context) {
+            await base.startAttempt?.(context);
+            await prepareBrowser();
+        },
+        session: {
+            ...base.session,
+            async open(url, operation) {
+                if (!base.session?.open)
+                    throw new Error("The DSM engine cannot open a page.");
+                if (!await prepareBrowser()) {
+                    // The runner creates its page lazily. Open only a blank page before
+                    // configuring page CDP, so the first network navigation is covered.
+                    let page;
+                    try {
+                        page = surface().page();
+                    }
+                    catch {
+                        await base.session.open("about:blank", operation);
+                        page = surface().page();
+                    }
+                    let pending = pages.get(page);
+                    if (!pending) {
+                        const target = page;
+                        pending = (async () => {
+                            const session = await surface().context().newCDPSession(target);
+                            await session.send("Security.setIgnoreCertificateErrors", { ignore: true });
+                        })();
+                        pages.set(page, pending);
+                        pending.catch(() => pages.delete(target));
+                    }
+                    await pending;
+                }
+                await base.session.open(url, operation);
+            },
+        },
+    });
+}

package/dist/e2e/dsm.d.ts

@@ -82,7 +82,7 @@ export declare function loadProfile(file: string, url: string): StorageState | n
  * process, each write their own temporary file and rename it into place.
  */
 export declare function saveProfile(file: string, url: string, state: StorageState): void;
-/** The `targets` entry of e2e.config.ts. */
+/** The Chromium `targets` entry of e2e.config.ts; accepts self-signed test certificates. */
 export declare function dsmTarget(name?: string): {
     name: string;
     engine: import("e2e/engine").EngineHandle;
@@ -193,5 +193,7 @@ export declare function openPortal(app: App, path: string, browser?: DialogBrows
 export declare function normalSmokeSkip(user?: string, env?: Env): string | undefined;
 /** Checks rendered errors as well as HTTP errors; ready alone never proves success. */
 export declare function assertSmokePage(page: Page, ready: SmokeMarker, anonymous?: boolean, publicLogin?: SmokeMarker): Promise<void>;
-/** Registers A (admin), N (permitted normal user), X (fresh anonymous context). */
+/** A denied entry must show the SDK denial page and contain no App markers. */
+export declare function assertSmokeAccess(page: Page, root: Page | Locator, options: Pick<AppOpenSmokeOptions, 'ready' | 'content'>, expectation: 'ready' | 'denied', timeout: number): Promise<void>;
+/** Registers A (admin), N (manifest entry policy), X (fresh anonymous context). */
 export declare function appOpenSmoke(options: AppOpenSmokeOptions): void;

package/dist/e2e/dsm.js

@@ -23,6 +23,7 @@ import { createOpenAI } from "@ai-sdk/openai";
 import { readSmokeEntry } from "./app-open.js";
 export { deriveSmokeEntry } from "./app-open.js";
 import { surfaceOf, test, web } from "@e2e-dev/web";
+import { withDsmCertificates } from "./certificates.js";
 const safeName = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/;
 const desktopSelector = "#sds-desktop";
 const signedInSelector = "#sds-taskbar-tray-item-user";
@@ -288,15 +289,16 @@ export function saveProfile(file, url, state) {
     renameSync(temporary, file);
 }
 // ---- Browser --------------------------------------------------------------
-const engine = web({
+const webEngine = web({
     viewport: { width: Number(process.env.DSM_E2E_VIEWPORT_WIDTH || 1280), height: Number(process.env.DSM_E2E_VIEWPORT_HEIGHT || 800) },
 });
-/** The `targets` entry of e2e.config.ts. */
+const engine = withDsmCertificates(webEngine, surface);
+/** The Chromium `targets` entry of e2e.config.ts; accepts self-signed test certificates. */
 export function dsmTarget(name = "dsm") {
     return { name, engine, app: { url: dsmUrl() } };
 }
 function surface() {
-    const live = surfaceOf(engine);
+    const live = surfaceOf(webEngine);
     if (!live)
         throw new Error("The DSM web engine is unavailable.");
     return live;
@@ -587,7 +589,7 @@ export function normalSmokeSkip(user = "normal", env = process.env) {
     const file = profilePath(env.DSM_E2E_TARGET || "dsm", user, env);
     if (existsSync(file) && loadProfile(file, dsmUrl(env)))
         return undefined;
-    return `Normal-user smoke requires ${key} (mode 600) or a saved ${user} profile with app permission.`;
+    return `Normal-user smoke requires ${key} (mode 600) or a saved ${user} profile.`;
 }
 function marker(root, value) {
     return typeof value === "string" ? root.locator(value).first()
@@ -610,6 +612,7 @@ async function dsmLoginVisible(page) {
 }
 const signInText = /sign in to DSM|log in to DSM|\u767b\u5165 DSM|\u767b\u5f55 DSM/i;
 const errorText = /(?:^|\n)\s*(?:[45]0[0-9]\b|internal server error|bad gateway|service unavailable|gateway timeout|not found|access denied|you are not authorized)/i;
+const gatewayDenied = '[data-error-code="dsm_admin_required"][data-i18n="gateway.admin_required"], [data-error-code="dsm_app_privilege_denied"][data-i18n="gateway.app_privilege_denied"]';
 /** Checks rendered errors as well as HTTP errors; ready alone never proves success. */
 export async function assertSmokePage(page, ready, anonymous = false, publicLogin) {
     if (await page.locator('body').innerText().then(text => errorText.test(text)))
@@ -629,7 +632,24 @@ export async function assertSmokePage(page, ready, anonymous = false, publicLogi
         throw new Error('Signed-in app smoke reached a login gate.');
     }
 }
-/** Registers A (admin), N (permitted normal user), X (fresh anonymous context). */
+/** A denied entry must show the SDK denial page and contain no App markers. */
+export async function assertSmokeAccess(page, root, options, expectation, timeout) {
+    if (expectation === 'ready') {
+        await marker(root, options.ready).waitFor({ state: 'visible', timeout });
+        await assertSmokePage(page, options.ready);
+        return;
+    }
+    await root.locator(gatewayDenied).first().waitFor({ state: 'visible', timeout });
+    if (await dsmLoginVisible(page))
+        throw new Error('Denied app smoke reached a login gate.');
+    if (await marker(root, options.ready).count() || await marker(root, options.content ?? options.ready).count()) {
+        throw new Error('Denied app smoke exposed app content or its ready marker.');
+    }
+    if (await page.locator('body').innerText().then(text => /(?:^|\n)\s*(?:50[0-9]\b|internal server error|bad gateway|service unavailable|gateway timeout)/i.test(text))) {
+        throw new Error('Denied app smoke reached a server error page.');
+    }
+}
+/** Registers A (admin), N (manifest entry policy), X (fresh anonymous context). */
 export function appOpenSmoke(options) {
     const entry = readSmokeEntry(options);
     if (entry.upstreamAuthenticated && !options.publicLogin) {
@@ -644,7 +664,8 @@ export function appOpenSmoke(options) {
     if (normal === admin)
         throw new Error('Normal smoke must use a separate named profile.');
     for (const [role, user] of [['A administrator', admin], ['N normal user', normal]]) {
-        test(`${entry.package}: app opens — ${role}`, {
+        const expectation = user === normal ? entry.normalExpectation : 'ready';
+        test(`${entry.package}: app opens — ${role}${expectation === 'denied' ? ' (access denied)' : ''}`, {
             timeout, skip: user === normal ? normalSmokeSkip(normal) : undefined,
         }, async ({ app, browser }) => {
             await signIn(app, user);
@@ -659,8 +680,7 @@ export function appOpenSmoke(options) {
             try {
                 const root = entry.window ? await openApp(app, entry.appId, timeout, browser)
                     : (await handleDialogs(browser), await openPath(app, new URL(entry.entry, dsmUrl()).href), dsmPage());
-                await marker(root, options.ready).waitFor({ state: 'visible', timeout });
-                await assertSmokePage(page, options.ready);
+                await assertSmokeAccess(page, root, options, expectation, timeout);
                 if (failures.length)
                     throw new Error(`App smoke received HTTP ${failures.join(', ')}.`);
             }

package/dist/standalone/compose.d.ts

@@ -87,6 +87,21 @@ export interface ComposeApp {
     plan: ComposePlan;
 }
 export declare const COMPOSE_FIELDS: readonly ["host_udp", "devices", "startup_timeout_seconds", "resource_prefix", "files", "env_files", "profiles", "web", "data", "shares", "network", "services", "helpers", "sdk"];
+/** Keep manifest parsing and image-lock replanning on the same installation context. */
+export declare function composeManifestContext(m: Pick<StandaloneManifest, 'identityGateway' | 'capabilities' | 'sharedFolder' | 'installSettings' | 'installPorts'> & {
+    package?: string;
+}): {
+    package: string | undefined;
+    sdk: string | undefined;
+    mode: import("./identity-gateway.js").GatewayMode;
+    composeMounts: true | undefined;
+    sharedFolder: SharedFolder | undefined;
+    installSettings: InstallSettings | undefined;
+    installPorts: Record<string, {
+        default: number;
+        protocol: "tcp";
+    }> | undefined;
+};
 export declare function readComposeApp(value: unknown, root: string, arches: NativeArchFamily[], fail: (e: StandaloneError) => void, context?: {
     package?: string;
     sdk?: string;

package/dist/standalone/compose.js

@@ -1,3 +1,4 @@
+import { portDefaults } from './install-ports.js';
 import { validComposeAppData } from "../runtime/compose-data.js";
 import { composeDiagnosisMessages, renderComposeDiagnosis } from "../build-spk/compose-diagnosis.js";
 import { COMPOSE_ERRORS } from "./compose-errors.js";
@@ -58,6 +59,18 @@ function planner(sdk) {
     process.once("exit", () => rmSync(work, { recursive: true, force: true }));
     return out;
 }
+/** Keep manifest parsing and image-lock replanning on the same installation context. */
+export function composeManifestContext(m) {
+    return {
+        package: m.package,
+        sdk: m.identityGateway?.sdk,
+        mode: m.identityGateway?.mode ?? 'none',
+        composeMounts: m.capabilities.composeMounts,
+        sharedFolder: m.sharedFolder,
+        installSettings: m.installSettings,
+        installPorts: m.installPorts ? portDefaults(m) : undefined,
+    };
+}
 export function readComposeApp(value, root, arches, fail, context = {}) {
     if (value === undefined)
         return;
@@ -287,12 +300,8 @@ export function lockComposeImages(m, arch, resolveImages, imageProofs) {
     const compose = readComposeApp(m.compose.declaration, m.root, m.arches, (e) => {
         error = e;
     }, {
-        package: m.package,
+        ...composeManifestContext(m),
         sdk: m.compose.sdk,
-        mode: m.identityGateway?.mode ?? "none",
-        composeMounts: m.capabilities.composeMounts,
-        sharedFolder: m.sharedFolder,
-        installSettings: m.installSettings,
         resolveImages,
         architecture: arch,
         imageProofs,

package/dist/standalone/inspect-spk.js

@@ -248,10 +248,10 @@ export async function inspectSpk(spkPath, expectedKind) {
         if (standalone && portal)
             findings.push(...inspectPortalInfo(info, hasExecutor));
         const daemon = standalone
-            ? await checkDaemon(dir, info, paths, payload, findings, hasExecutor, background, combined, nativeGateway, uninstallHook?.uninstall, { ingress: daemonIngress, node: daemonNode, restart: daemonRestart })
+            ? await checkDaemon(dir, info, paths, payload, findings, hasExecutor, background, combined, nativeGateway, uninstallHook?.uninstall, { ingress: daemonIngress, node: daemonNode, restart: daemonRestart, installPorts: Boolean(metadata.installPorts) })
             : undefined;
         if (background)
-            checkBackground(dir, info, payload, findings, hasExecutor, daemon, kind !== "native-go", metadata.lifecycleTimeouts, nativeGateway);
+            checkBackground(dir, info, payload, findings, hasExecutor, daemon, kind !== "native-go", metadata.lifecycleTimeouts, nativeGateway, Boolean(metadata.installPorts));
         let executor;
         if ((metadata.capabilities ?? []).some((name) => name === "rootOps" || name === "delegate" || name === "webapi") ||
             paths.has("executor/executor")) {
@@ -1026,6 +1026,7 @@ async function checkDaemon(dir, info, paths, payload, findings, executor, backgr
             throw new Error("missing executable");
         const manifest = {
             package: info.package,
+            ...(extras.installPorts ? { installPorts: true } : {}),
             backend: { kind: 'go', dir: dir, main: './cmd/app', timeoutSeconds: config.operation_seconds ?? 60 },
             root: dir,
             ...(combined ? { lifecycleTimeouts: daemon.timeouts } : {}),
@@ -1057,7 +1058,7 @@ async function checkDaemon(dir, info, paths, payload, findings, executor, backgr
         if (readFileSync(join(unpacked, "daemon/config.json"), "utf8") !== JSON.stringify(expectedConfig) + '\n')
             throw new Error("non-canonical daemon config");
         for (const hook of ["start-stop-status", "preupgrade", "preuninst"]) {
-            if (!matchesStandaloneScript(hook, nativeGateway ? { ...manifest, os_min_ver: info.os_min_ver, identityGateway: nativeGateway } : manifest, readFileSync(join(dir, "scripts", hook), "utf8")))
+            if (!matchesStandaloneScript(hook, nativeGateway ? { ...manifest, os_min_ver: info.os_min_ver, identityGateway: nativeGateway } : manifest, readFileSync(join(dir, "scripts", hook), "utf8"), Boolean(extras.installPorts)))
                 findings.push(`daemon scripts/${hook} does not match the fixed lifecycle`);
         }
         return daemon;
@@ -1379,7 +1380,7 @@ function checkConf(dir, findings, kind, background, sharedFolder, pkg, portal, c
     }
 }
 /** The opt-in package user unit must be exactly what the generator writes. */
-function checkBackground(dir, info, payload, findings, executor, daemon, bridge = false, lifecycleTimeouts, nativeGateway) {
+function checkBackground(dir, info, payload, findings, executor, daemon, bridge = false, lifecycleTimeouts, nativeGateway, installPorts = false) {
     const pkg = info.package;
     if (!pkg)
         return;
@@ -1402,6 +1403,7 @@ function checkBackground(dir, info, payload, findings, executor, daemon, bridge
     }
     if (!matchesStandaloneScript("start-stop-status", {
         package: pkg,
+        ...(installPorts ? { installPorts: true } : {}),
         os_min_ver: info.os_min_ver,
         ...(nativeGateway ? { identityGateway: nativeGateway } : {}),
         lifecycleTimeouts,
@@ -1410,7 +1412,7 @@ function checkBackground(dir, info, payload, findings, executor, daemon, bridge
             jobs: { worker: "sha256-v1" },
             ...(executor ? { rootOps: true } : {}),
         },
-    }, read("scripts/start-stop-status")))
+    }, read("scripts/start-stop-status"), installPorts))
         findings.push("background scripts/start-stop-status does not match the fixed synosystemctl lifecycle");
 }
 /**

package/dist/standalone/manifest.js

@@ -13,7 +13,7 @@ import { parse } from "yaml";
 import { isNativeArchFamily, } from "../build-spk/dsm-arch.js";
 import { checkGlossary, loadCatalogs, readInfoTranslations, } from "./i18n.js";
 import { loadRootOps, readRootSettings, rootBinaryProblem, ROOT_OPS_DIR, } from "./root-ops.js";
-import { readComposeApp } from "./compose.js";
+import { composeManifestContext, readComposeApp } from "./compose.js";
 import { daemonSdkVersion, readDaemon, readLifecycleTimeouts } from "./daemon.js";
 import { daemonRestartSdkProblem } from "./daemon-restart.js";
 import { daemonIngressMinDsmProblem } from "./daemon-ingress.js";
@@ -278,15 +278,18 @@ function readManifest(raw, c) {
     const installSettings = readInstallSettings(isRecord(raw.install) ? raw.install.settings : undefined, e => c.fail(e.code, e.message));
     const hyperBackup = readHyperBackup(raw.backup, { compose: raw.compose !== undefined }, e => c.fail(e.code, e.message));
     const compose = arches &&
-        readComposeApp(raw.compose, c.root, arches, (e) => c.fail(e.code, e.message), {
+        readComposeApp(raw.compose, c.root, arches, (e) => c.fail(e.code, e.message), composeManifestContext({
             package: packageId,
-            sdk: typeof gatewayRaw.sdk === "string" ? gatewayRaw.sdk : undefined,
-            mode: typeof gatewayRaw.mode === "string" ? gatewayRaw.mode : "none",
-            composeMounts: capabilities.composeMounts,
+            identityGateway: {
+                ...gatewayRaw,
+                sdk: typeof gatewayRaw.sdk === "string" ? gatewayRaw.sdk : undefined,
+                mode: typeof gatewayRaw.mode === "string" ? gatewayRaw.mode : "none",
+            },
+            capabilities,
             sharedFolder,
             installSettings,
-            installPorts: installPorts ? portDefaults({ installPorts, identityGateway: gatewayRaw }) : undefined,
-        });
+            installPorts,
+        }));
     if (raw.compose !== undefined &&
         ((raw.daemon !== undefined && !timeoutOnly) ||
             Object.keys(capabilities).some((k) => k !== "composeMounts") ||

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.41.7",
+  "version": "0.41.9",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {

package/skills/SKILL.md

@@ -316,7 +316,11 @@ Use `appOpenSmoke` from `@synopackageland/cli/e2e`; keep one content-specific
 reuses the existing DSM credentials/profiles/tunnel, and registers administrator,
 normal-user and fresh anonymous tests. Configure `DSM_E2E_ACCOUNT_ADMIN` and
 `DSM_E2E_ACCOUNT_NORMAL` as private account files; a missing normal profile and
-credentials is a reported skip. Grant Application Privileges before running.
+credentials is a reported skip. For `entry: admin-only`, N must see the SDK
+gateway denial page with no App content or ready marker in the DOM; use
+`content` for a separate App shell marker. Other entry kinds require N to
+reach `ready`; grant Application Privileges as needed. Preserve the manifest's
+entry policy when running the smoke.
 Override `app` for a manifest filename or `entry` for a configured URL.
 Only a manifest-declared upstream-authenticated entry may use `publicLogin`.
 Keep `.env` and `.e2e/` untracked; never add NAS details to source.