@synopackageland/cli 0.41.9 → 0.41.11

package/dist/host/package-diagnostics.js

@@ -0,0 +1,62 @@
+import { createHash } from 'node:crypto';
+import { mkdirSync, readFileSync, renameSync, writeFileSync, rmSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+/** Diagnostic text is untrusted and can contain daemon URLs or echoed credentials. */
+export function maskDiagnostic(text) {
+    return text.replace(/https?:\/\/[^\s"'<>]+/gi, value => {
+        try {
+            const url = new URL(value);
+            if (!url.username && !url.password && !url.search && !url.hash)
+                return value;
+            url.username = '';
+            url.password = '';
+            url.search = '';
+            url.hash = '';
+            return url.href;
+        }
+        catch {
+            return '<redacted URL>';
+        }
+    }).replace(/\b(password|passwd|token|synotoken|_sid|authorization|cookie|set-cookie)\s*[:=]\s*[^\r\n]+/gi, '$1=<redacted>');
+}
+function pathFor(origin, packageId) {
+    const key = createHash('sha256').update(new URL(origin).origin + '\0' + packageId).digest('hex');
+    return join(process.env.SYNOPKGLAND_DIAGNOSTICS_DIR ?? join(homedir(), '.cache/synopkgland/diagnostics'), key + '.json');
+}
+export function savePullFailure(origin, packageId, message) {
+    try {
+        const file = pathFor(origin, packageId);
+        if (!message) {
+            rmSync(file, { force: true });
+            return;
+        }
+        const dir = file.slice(0, file.lastIndexOf('/'));
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        const temporary = `${file}.${process.pid}.tmp`;
+        writeFileSync(temporary, JSON.stringify({ source: 'CLI NAS pre-pull', observedAt: new Date().toISOString(), message: maskDiagnostic(message) }), { mode: 0o600 });
+        renameSync(temporary, file);
+    }
+    catch { /* Optional diagnostic retention must not mask the install result. */ }
+}
+function readPullFailure(origin, packageId) {
+    try {
+        const value = JSON.parse(readFileSync(pathFor(origin, packageId), 'utf8'));
+        return { source: value.source, observedAt: value.observedAt, message: maskDiagnostic(String(value.message)) };
+    }
+    catch {
+        return undefined;
+    }
+}
+export function packageDiagnostics(packageId, state, origin) {
+    const clean = (value) => typeof value === 'string' ? maskDiagnostic(value) : Array.isArray(value) ? value.map(clean)
+        : value && typeof value === 'object' ? Object.fromEntries(Object.entries(value).map(([key, v]) => [key, /password|passwd|token|sid|authorization|cookie/i.test(key) ? '<redacted>' : clean(v)])) : value;
+    const worker = clean(state?.error?.workerMsg ?? []);
+    const messages = (value) => typeof value === 'string' ? [value] : Array.isArray(value) ? value.flatMap(messages)
+        : value && typeof value === 'object' ? Object.values(value).flatMap(messages) : [];
+    const lastComposeError = messages(worker).filter(line => /compose|pull|docker|x509|tls|certificate|registry/i.test(line)).at(-1);
+    return { packageIdentity: packageId, readiness: state?.status, error: clean(state?.error), worker_msg: worker,
+        statusCode: state?.statusCode, statusDescription: clean(state?.statusDescription),
+        ...(lastComposeError ? { lastComposeError } : {}),
+        ...(state?.status === 'broken' || state?.error?.code ? { lastPullError: readPullFailure(origin, packageId) } : {}), redacted: true };
+}

package/dist/images/pin.js

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { registryBaseUrl } from "../compose/registry-mirrors.js";
 import { readFileSync, writeFileSync } from "node:fs";
 import { isScalar, parseDocument } from "yaml";
 /**
@@ -73,18 +74,6 @@ export function parseImageReference(image) {
     }
     return { registry, repository, tag, digest, explicitTag };
 }
-function registryBaseUrl(registry) {
-    if (registry === "docker.io" || registry === "index.docker.io") {
-        return "https://registry-1.docker.io";
-    }
-    const host = registry.startsWith("[")
-        ? registry.slice(0, registry.indexOf("]") + 1)
-        : registry.split(":")[0];
-    if (host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]") {
-        return `http://${registry}`;
-    }
-    return `https://${registry}`;
-}
 function parseBearerChallenge(header) {
     if (!header) {
         return null;
@@ -152,12 +141,13 @@ export async function resolveImageDigest(image, deps = {}) {
     if (!response.ok) {
         throw new ImageDigestError(`registry answered HTTP ${response.status} for ${image}`);
     }
+    const body = Buffer.from(await response.arrayBuffer());
+    const digest = `sha256:${createHash("sha256").update(body).digest("hex")}`;
     const header = response.headers.get("docker-content-digest");
-    if (header && DIGEST_VALUE.test(header)) {
-        return header.toLowerCase();
+    if (header && (!DIGEST_VALUE.test(header) || header.toLowerCase() !== digest)) {
+        throw new ImageDigestError(`registry content digest mismatch for ${image}`);
     }
-    const body = Buffer.from(await response.arrayBuffer());
-    return `sha256:${createHash("sha256").update(body).digest("hex")}`;
+    return digest;
 }
 /** Keep the source's quote style so only the reference text changes. */
 function quoteLike(node, value) {

package/dist/log.js

@@ -1,5 +1,6 @@
 import { loadStandaloneManifest } from "./standalone/manifest.js";
 import { resolveDeployIdentity } from "./deploy/identity.js";
+import { maskDiagnostic, packageDiagnostics } from './host/package-diagnostics.js';
 export async function followProjectLogs(options) {
     const identity = resolveDeployIdentity(options.project, { dev: options.dev });
     const installed = await options.host.isPackageInstalled(identity.packageId);
@@ -10,12 +11,8 @@ export async function followProjectLogs(options) {
     const info = await options.host.getInstalledPackageState?.(identity.packageId);
     return {
         ok: true,
-        lines,
-        diagnostics: {
-            packageIdentity: identity.packageId,
-            readiness: info?.status,
-            redacted: true,
-        },
+        lines: lines.map(maskDiagnostic),
+        diagnostics: packageDiagnostics(identity.packageId, info, options.host.dsmOrigin),
     };
 }
 export async function followStandaloneLogs(options) {
@@ -31,7 +28,7 @@ export async function followStandaloneLogs(options) {
     const info = await options.host.getInstalledPackageState?.(packageIdentity);
     return {
         ok: true,
-        lines,
-        diagnostics: { packageIdentity, readiness: info?.status, redacted: true },
+        lines: lines.map(maskDiagnostic),
+        diagnostics: packageDiagnostics(packageIdentity, info, options.host.dsmOrigin),
     };
 }

package/dist/nas/auth.js

@@ -1,7 +1,7 @@
 import { CtlError } from '../ctl/errors.js';
 import { createRequest } from './transport.js';
 export async function loginDsm(origin, username, password, options) {
-    const request = options.request ?? createRequest(origin, 30000, options.ca);
+    const request = options.request ?? createRequest(origin, undefined, options.ca);
     const form = new URLSearchParams({ api: 'SYNO.API.Auth', version: '7', method: 'login', account: username, passwd: password, session: 'DSM', format: 'cookie', enable_syno_token: 'yes', enable_device_token: options.remember === false ? 'no' : 'yes', device_name: 'synopkgland', device_id: options.deviceId ?? '' });
     let result = await request('/webapi/entry.cgi', form);
     if (result?.error?.code === 402) {

package/dist/nas/connection.js

@@ -6,7 +6,7 @@ export async function connectNas(name) {
     const credentials = resolveHostCredentials(name);
     const session = await credentials.loadSession();
     registerDsmSession(session, credentials.hostName, credentials.ca, credentials.fingerprint, credentials.tls);
-    const request = createRequest(session.origin, 62000, credentials.ca, credentials.tls);
+    const request = createRequest(session.origin, undefined, credentials.ca, credentials.tls);
     return {
         name: credentials.hostName,
         session,

package/dist/nas/http.d.ts

@@ -2,4 +2,4 @@ import { type DsmSession } from './transport.js';
 import type { HostTls } from './tls.js';
 export declare function registerDsmSession(session: DsmSession, name: string, ca?: string, fingerprint?: string, policy?: HostTls): void;
 /** All DSM fetch callers, including session-only automation, use the NAS socket policy. */
-export declare function dsmFetch(url: string, init?: RequestInit): Promise<Response>;
+export declare function dsmFetch(url: string, init?: RequestInit, timeoutMs?: number): Promise<Response>;

package/dist/nas/http.js

@@ -9,12 +9,12 @@ export function registerDsmSession(session, name, ca, fingerprint, policy) {
     policies.set(session.origin, trust);
 }
 /** All DSM fetch callers, including session-only automation, use the NAS socket policy. */
-export async function dsmFetch(url, init = {}) {
+export async function dsmFetch(url, init = {}, timeoutMs) {
     const headers = new Headers(init.headers), origin = new URL(url).origin;
     const cookie = headers.get('cookie') ?? '';
     // App cookies can accompany a DSM cookie; keep its token and TLS policy.
     const binding = [...bindings.values()].find(b => b.session.origin === origin && cookie.split(/;\s*/).includes(b.session.cookie));
-    const response = await sessionFetch(url, { ...init, headers }, binding ? { ...binding.session, cookie } : undefined, undefined, binding?.trust ?? policies.get(origin));
+    const response = await sessionFetch(url, { ...init, headers }, binding ? { ...binding.session, cookie } : undefined, undefined, binding?.trust ?? policies.get(origin), timeoutMs);
     if (response.status >= 300 && response.status < 400)
         throw new CtlError('CTL_HTTP_ERROR', `HTTP ${response.status}; redirects are never followed`, 'Check the NAS URL', 6);
     if (binding && new URL(url).pathname === '/webapi/entry.cgi') {

package/dist/nas/store.js

@@ -99,7 +99,7 @@ export class CtlStore {
         if (!options.storedOnly && process.env.DSM_USERNAME && process.env.DSM_PASSWORD) {
             if (process.env.DSM_USERNAME !== host.username)
                 throw new CtlError('CTL_CREDENTIAL_MISMATCH', 'Automation account differs from the registered host.', 'Use the registered account or a separately named host.', 2);
-            session = await loginDsm(host.origin, host.username, process.env.DSM_PASSWORD, { remember: false, otp: async () => process.env.DSM_OTP ?? '', request: createRequest(host.origin, 30000, undefined, this.trust(host)) });
+            session = await loginDsm(host.origin, host.username, process.env.DSM_PASSWORD, { remember: false, otp: async () => process.env.DSM_OTP ?? '', request: createRequest(host.origin, undefined, undefined, this.trust(host)) });
         }
         else
             session = await this.credentials.get(this.key(host));

package/dist/nas/timeouts.d.ts

@@ -0,0 +1,8 @@
+export declare const dsmRequestTimeoutMs: () => number;
+export declare const dsmOperationTimeoutMs: () => number;
+export declare const dsmUninstallTimeoutMs: () => number;
+export declare const dsmInstallTimeoutMs: () => number;
+export declare const dsmPollIntervalMs: () => number;
+export declare const dsmPullStallTimeoutMs: () => number;
+export declare function isHostTimeout(error: unknown): boolean;
+export declare function dsmApiTimeoutMs(api: string | null, method: string | null): number;

package/dist/nas/timeouts.js

@@ -0,0 +1,25 @@
+import { CtlError } from '../ctl/errors.js';
+/** Seconds in the existing DSM_* automation environment (also loaded from .env). */
+function seconds(name, fallback) {
+    const value = process.env[name];
+    if (value === undefined)
+        return fallback * 1000;
+    if (!/^\d+$/.test(value) || !Number.isSafeInteger(Number(value)) || Number(value) < 1 || Number(value) > 86400)
+        throw new CtlError('DSM_TIMEOUT_INVALID', `${name} must be a whole number of seconds from 1 to 86400`, 'Set a positive DSM timeout budget');
+    return Number(value) * 1000;
+}
+export const dsmRequestTimeoutMs = () => seconds('DSM_REQUEST_TIMEOUT_SECONDS', 180);
+export const dsmOperationTimeoutMs = () => seconds('DSM_OPERATION_TIMEOUT_SECONDS', 600);
+export const dsmUninstallTimeoutMs = () => seconds('DSM_UNINSTALL_TIMEOUT_SECONDS', 1800);
+export const dsmInstallTimeoutMs = () => seconds('DSM_INSTALL_TIMEOUT_SECONDS', 1800);
+export const dsmPollIntervalMs = () => seconds('DSM_POLL_INTERVAL_SECONDS', 5);
+export const dsmPullStallTimeoutMs = () => seconds('DSM_IMAGE_PULL_STALL_TIMEOUT_SECONDS', 1200);
+export function isHostTimeout(error) {
+    return error instanceof CtlError && error.code === 'HOST_TIMEOUT';
+}
+export function dsmApiTimeoutMs(api, method) {
+    const longOperation = api === 'SYNO.Entry.Request' || api === 'SYNO.Core.Package.Uninstallation' ||
+        (api === 'SYNO.Core.Package.Installation' && ['upload', 'install'].includes(method ?? '')) ||
+        (api === 'SYNO.Core.Package.Control' && ['start', 'stop'].includes(method ?? ''));
+    return longOperation ? dsmOperationTimeoutMs() : dsmRequestTimeoutMs();
+}

package/dist/nas/tls.js

@@ -1,3 +1,4 @@
+import { dsmRequestTimeoutMs } from './timeouts.js';
 import tls from "node:tls";
 import https from "node:https";
 import { isIP } from "node:net";
@@ -47,7 +48,7 @@ export function probeCertificate(origin, options = {}) {
             ...socketOptions(origin, options.ca),
             rejectUnauthorized: false,
         });
-        const timer = setTimeout(() => socket.destroy(timeoutError()), options.timeoutMs ?? 30000);
+        const timer = setTimeout(() => socket.destroy(timeoutError()), options.timeoutMs ?? dsmRequestTimeoutMs());
         socket.once("error", (e) => reject(networkError(e)));
         socket.once("close", () => clearTimeout(timer));
         socket.once("secureConnect", () => {

package/dist/nas/transport.d.ts

@@ -11,7 +11,7 @@ export interface DsmSession {
 }
 export type JsonRequest = (path: string, body: URLSearchParams | Record<string, unknown>, session?: DsmSession) => Promise<any>;
 export declare function canonicalOrigin(input: string, tunnel?: boolean): string;
-export declare function createRequest(origin: string, timeoutMs?: number | (() => number), ca?: string, trust?: HostTls): JsonRequest;
-export declare function sessionFetch(url: string, init: RequestInit, session: DsmSession | undefined, ca?: string, trust?: HostTls): Promise<Response>;
+export declare function createRequest(origin: string, timeoutMs?: number | (() => number) | undefined, ca?: string, trust?: HostTls): JsonRequest;
+export declare function sessionFetch(url: string, init: RequestInit, session: DsmSession | undefined, ca?: string, trust?: HostTls, timeoutMs?: number): Promise<Response>;
 /** The only Node HTTP dispatch for NAS endpoints, including streaming transfers. */
 export declare function nasHttpRequest(url: URL, options: http.RequestOptions, timeoutMs: number, trust: HostTls | undefined, listener: (res: http.IncomingMessage) => void): http.ClientRequest;

package/dist/nas/transport.js

@@ -6,6 +6,7 @@ import { assertSessionActive } from './session.js';
 import { nasOptions } from './options.js';
 import { readFileSync } from 'node:fs';
 import { CtlError } from '../ctl/errors.js';
+import { dsmRequestTimeoutMs, dsmApiTimeoutMs } from './timeouts.js';
 export const CTL_TIMEOUT_MS = 62000;
 export const APP_COOKIE = Symbol("ctlAppCookie");
 export function canonicalOrigin(input, tunnel = false) {
@@ -20,11 +21,12 @@ export function canonicalOrigin(input, tunnel = false) {
         throw new CtlError('CTL_URL_INVALID', 'Use HTTPS, or explicit --ssh-tunnel for a loopback HTTP tunnel.', 'run: synopkgland host add <name> --url https://<nas>:5001');
     return url.origin;
 }
-export function createRequest(origin, timeoutMs = CTL_TIMEOUT_MS, ca, trust) {
+export function createRequest(origin, timeoutMs = undefined, ca, trust) {
     return async (path, body, session) => {
         if (!path.startsWith('/') || path.startsWith('//') || path.includes('?') || path.includes('#') || path.includes('\\') || path.includes('%') || path.split('/').some(p => p === '.' || p === '..'))
             throw new CtlError('CTL_PATH_INVALID', 'Unsafe request path.', 'run: synopkgland ctl list --refresh');
-        const remaining = typeof timeoutMs === 'function' ? timeoutMs() : timeoutMs;
+        const params = body instanceof URLSearchParams ? body : undefined;
+        const remaining = typeof timeoutMs === 'function' ? timeoutMs() : timeoutMs ?? (path === '/webapi/entry.cgi' ? dsmApiTimeoutMs(params?.get('api') ?? null, params?.get('method') ?? null) : CTL_TIMEOUT_MS);
         if (remaining <= 0)
             throw new CtlError('CTL_NETWORK', 'Request budget exhausted before dispatch.', 'Check App state before retrying writes.', 6);
         const url = new URL(path, origin);
@@ -91,7 +93,10 @@ export function createRequest(origin, timeoutMs = CTL_TIMEOUT_MS, ca, trust) {
         });
     };
 }
-export async function sessionFetch(url, init, session, ca, trust) {
+export async function sessionFetch(url, init, session, ca, trust, timeoutMs) {
+    const targetUrl = new URL(url);
+    const params = init.body instanceof URLSearchParams ? init.body : targetUrl.searchParams;
+    timeoutMs ??= targetUrl.pathname === '/webapi/entry.cgi' ? dsmApiTimeoutMs(params.get('api'), params.get('method')) : dsmRequestTimeoutMs();
     if (session && new URL(url).origin !== session.origin)
         throw new CtlError('CTL_ORIGIN_MISMATCH', 'Credentials cannot cross NAS origins', 'Check the registered NAS origin', 4);
     const headers = new Headers(init.headers);
@@ -102,14 +107,14 @@ export async function sessionFetch(url, init, session, ca, trust) {
     const request = new Request(url, { ...init, headers }), bytes = init.body ? Buffer.from(await request.arrayBuffer()) : undefined;
     return new Promise((resolve, reject) => {
         const target = new URL(url);
-        const req = nasHttpRequest(target, { method: request.method, headers: Object.fromEntries(request.headers) }, 62000, trustWithCa(trust, ca), res => {
+        const req = nasHttpRequest(target, { method: request.method, headers: Object.fromEntries(request.headers) }, timeoutMs, trustWithCa(trust, ca), res => {
             const chunks = [];
             let length = 0;
             res.on('data', c => { length += c.length; if (length > 16 * 1024 * 1024)
                 res.destroy(new CtlError('CTL_RESPONSE_TOO_LARGE', 'DSM response exceeds 16 MiB', 'Use a narrower operation', 5));
             else
                 chunks.push(c); });
-            res.on('error', () => reject(new CtlError('DSM_NETWORK', 'DSM response interrupted', 'Check the NAS connection', 6)));
+            res.on('error', e => reject(e instanceof CtlError ? e : new CtlError('DSM_NETWORK', 'DSM response interrupted', 'Check the NAS connection', 6)));
             res.on('end', () => { const headers = new Headers(); for (const [k, v] of Object.entries(res.headers))
                 for (const x of Array.isArray(v) ? v : [v])
                     if (x !== undefined)
@@ -121,7 +126,7 @@ export async function sessionFetch(url, init, session, ca, trust) {
         else
             request.signal.addEventListener('abort', abort, { once: true });
         req.once('close', () => request.signal.removeEventListener('abort', abort));
-        const timer = setTimeout(() => req.destroy(timeoutError()), 62000);
+        const timer = setTimeout(() => req.destroy(timeoutError()), timeoutMs);
         req.once('close', () => clearTimeout(timer));
         req.on('timeout', () => req.destroy(timeoutError()));
         req.on('error', e => reject(networkError(e)));

package/dist/standalone/compose.js

@@ -1,3 +1,4 @@
+import { composeRegistryMirrors } from "../compose/registry-mirrors.js";
 import { portDefaults } from './install-ports.js';
 import { validComposeAppData } from "../runtime/compose-data.js";
 import { composeDiagnosisMessages, renderComposeDiagnosis } from "../build-spk/compose-diagnosis.js";
@@ -126,10 +127,7 @@ export function readComposeApp(value, root, arches, fail, context = {}) {
                 install_settings: context.installSettings,
                 install_ports: context.installPorts,
                 resolve_images: context.resolveImages === true,
-                registry_mirrors: context.resolveImages &&
-                    process.env.SYNOPKGLAND_COMPOSE_REGISTRY_MIRRORS
-                    ? JSON.parse(process.env.SYNOPKGLAND_COMPOSE_REGISTRY_MIRRORS)
-                    : undefined,
+                registry_mirrors: context.resolveImages ? composeRegistryMirrors() : undefined,
                 architecture: context.architecture,
                 image_proofs: context.imageProofs,
             }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.41.9",
+  "version": "0.41.11",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {

package/skills/SKILL.md

@@ -316,8 +316,12 @@ Use `appOpenSmoke` from `@synopackageland/cli/e2e`; keep one content-specific
 reuses the existing DSM credentials/profiles/tunnel, and registers administrator,
 normal-user and fresh anonymous tests. Configure `DSM_E2E_ACCOUNT_ADMIN` and
 `DSM_E2E_ACCOUNT_NORMAL` as private account files; a missing normal profile and
-credentials is a reported skip. For `entry: admin-only`, N must see the SDK
-gateway denial page with no App content or ready marker in the DOM; use
+credentials is a reported skip. Smoke needs `e2e`, `@e2e-dev/web` and Chromium;
+`ai` and `@ai-sdk/openai` are required only for `magpieAgent()`. Declare an optional
+interstitial as `preReady: {clickIfVisible: {text: "Continue on this device"}}`.
+For `entry: admin-only`, N must see the SDK gateway denial page or an explicit
+DSM denial/launcher privilege signal without an App window. Timeout alone is not
+denial. No App content or ready marker may be present in the DOM; use
 `content` for a separate App shell marker. Other entry kinds require N to
 reach `ready`; grant Application Privileges as needed. Preserve the manifest's
 entry policy when running the smoke.