@synopackageland/cli 0.9.1 → 0.9.3

package/CHANGELOG.md

@@ -1,5 +1,59 @@
 # Changelog
 
+## 0.9.3 (2026-10-12)
+
+Builds with SDK 0.9.4 and templates 0.9.3: `init` writes SDK v0.9.4 and
+`@synopackageland/sdk` 0.9.4. The executor digest table records SDK 0.9.4,
+whose executor asks DSM's native `SLIBAppPrivUserHas` for App Privileges
+instead of the `SYNO.Core.AppPriv.App` preview. An App rebuilt with SDK 0.9.4
+gets the new executor; the policy digest stays the same, so an installed App
+needs no new approval.
+
+繁中摘要：使用 SDK 0.9.4 與 templates 0.9.3。executor 改以 DSM 原生
+`SLIBAppPrivUserHas` 判斷應用程式權限，digest 表加入 0.9.4；policy digest 不變，
+重新建置後已安裝的 App 不需重新核准。限定 IP 的應用程式權限規則改為依瀏覽器位址
+判斷；自行組 `auth` 的呼叫端必須帶 `remote_addr`，否則 executor 回 `APP_DENIED`。
+
+- Behavior change: an Application Privileges rule limited to IP addresses
+  applies to the browser's address; with SDK 0.9.3 or earlier the executor
+  refused every request under such a rule. Work no browser asked for is
+  checked as coming from 127.0.0.1. The generated CGI sends the address
+  through `api.DSMSession`; code that builds the executor `auth` itself must
+  add `remote_addr` or the executor refuses with `APP_DENIED`.
+- The fake-DSM executor flow tests host the 0.9.4 executor's embedded bridge
+  and check the online grant against the browser's address and the offline
+  write against 127.0.0.1.
+
+## 0.9.2 (2026-10-12)
+
+Builds with SDK 0.9.3 and templates 0.9.2: `init` writes SDK v0.9.3 and
+`@synopackageland/sdk` 0.9.3. The executor digest table records SDK 0.9.2 and
+0.9.3 (the same digests; 0.9.3 changes only translations). An App rebuilt
+with SDK 0.9.2 or 0.9.3 gets the new executor; the policy digest stays the
+same, so an installed App needs no new approval.
+
+繁中摘要：`check` 與 `build` 的錯誤訊息每個錯誤碼只出現一次；`build --json` 的 SDK
+下載失敗附上 GOPRIVATE 提示；有 executor 並宣告 `install.sharedFolder` 的 App 通過
+`inspect` 的 postinst 檢查。重新安裝後的核准只需輸入一次密碼：共用資料夾讀回等 40 s，
+沒到達 executor 的選擇任務在同一次核准內再跑一次，啟動後的健康檢查等 30 s。
+
+- `check` and `build` name each error code once. 0.9.1 printed the first code
+  twice, for example
+  `[STANDALONE_PORTAL_REQUIRES_EXECUTOR] [STANDALONE_PORTAL_REQUIRES_EXECUTOR] …`.
+- A `--json` error without its own hint takes the registry suggestion of its
+  code. `build --json` now answers `SDK_DOWNLOAD_FAILED` with the GOPRIVATE and
+  git-credential step instead of the generic hint.
+- `inspect` accepts an App with `capabilities.rootOps` or `delegate` that
+  declares `install.sharedFolder`. Its `postinst` and `postupgrade` start the
+  executor before the shared-folder script, and 0.9.1 reported them as not
+  matching.
+- Re-approval after a reinstall takes one password submission for both the
+  executor and an install-selected share. The DSM window now reads the share
+  selection back for 40 s instead of 20 s, runs a selection task that missed
+  the restarting executor once more without a new confirmation, and waits
+  30 s instead of 10 s for a started executor before withdrawing the tasks an
+  approval created.
+
 ## 0.9.1 (2026-10-12)
 
 Fixes from the 0.9.0 acceptance on DSM (t-0294, t-0290, t-0292).

package/dist/cli.js

@@ -5,7 +5,8 @@ import { basename, resolve, dirname, join } from "node:path";
 import { findProjectRoot } from "./discovery.js";
 import { loadContract } from "./contract/load.js";
 import { contractIconPath } from "./contract/icon.js";
-import { formatErrors } from "./errors.js";
+import { codedMessage, formatErrors } from "./errors.js";
+import { getErrorCode } from "./error-registry.js";
 import { formatInspectReport, inspectProject } from "./inspect.js";
 import { formatPinReport, pinProjectImages } from "./images/pin.js";
 import { initFromTemplate, isTemplateName, listTemplates } from "./init.js";
@@ -33,7 +34,7 @@ import { checkJobs, commitOutputs, forEachArch } from "./standalone/arch-jobs.js
 import { checkReproducible } from "./reproducible.js";
 import { inspectAnySpk } from "./spk/inspect.js";
 function failure(code, message, hint = "修正設定後重試；使用 --help 查看指令用法。") {
-    return Object.assign(new Error(`[${code}] ${message}`), { code, hint });
+    return Object.assign(new Error(codedMessage(code, message)), { code, hint });
 }
 function requireProject(cwd, project) {
     const found = findProjectRoot(project ? resolve(cwd, project) : cwd);
@@ -531,7 +532,7 @@ export async function runCli(argv) {
                 ok: false,
                 code,
                 message,
-                hint: detail.hint ?? "修正設定後重試；使用 --help 查看指令用法。",
+                hint: detail.hint ?? getErrorCode(code)?.suggestion ?? "修正設定後重試；使用 --help 查看指令用法。",
                 ...(detail.report ? { data: detail.report } : {}),
             }));
         }

package/dist/errors.d.ts

@@ -3,4 +3,6 @@ export declare function makeError(code: string, span: SourceSpan, message: strin
 export declare function contractSpan(file: string, line: number, column: number, path?: string): SourceSpan;
 export declare function composeSpan(file: string, line: number, column: number, path?: string): SourceSpan;
 export declare function formatError(error: ValidationError): string;
+/** The message of an error thrown with a code: the code in brackets, then the message; the code only once. */
+export declare function codedMessage(code: string, message: string): string;
 export declare function formatErrors(errors: ValidationError[]): string;

package/dist/errors.js

@@ -13,6 +13,11 @@ export function formatError(error) {
         : `${error.span.file}:${error.span.line}:${error.span.column}`;
     return `[${error.code}] ${location}\n${error.message}\n建議：${error.suggestion}`;
 }
+/** The message of an error thrown with a code: the code in brackets, then the message; the code only once. */
+export function codedMessage(code, message) {
+    const prefix = `[${code}] `;
+    return message.startsWith(prefix) ? message : prefix + message;
+}
 export function formatErrors(errors) {
     return errors.map(formatError).join("\n\n");
 }

package/dist/images/pin.js

@@ -9,7 +9,6 @@ import { isScalar, parseDocument } from "yaml";
  * (Docker Hub and ghcr both issue an anonymous Bearer token for public repos).
  */
 const DIGEST_VALUE = /^sha256:[0-9a-f]{64}$/i;
-const DIGEST_AT_END = /@sha256:([0-9a-f]{64})$/i;
 /** A registry returns the index (manifest list) digest when we ask for it. */
 const MANIFEST_ACCEPT = [
     "application/vnd.oci.image.index.v1+json",

package/dist/init.js

@@ -257,7 +257,6 @@ function substitute(path, substitutions) {
         writeFileSync(path, text);
 }
 function substitutionsFor(template, targetDir, options) {
-    const ui = resolvedUi(template, options);
     const caps = capabilityNames(options.with ?? []);
     if (options.ui !== undefined && template !== "native-go")
         throw new Error("[INIT_OPTIONS_UNSUPPORTED] --ui 只適用於 native-go。");

package/dist/runtime/executor-digests.json

@@ -20,5 +20,38 @@
             "armv7": "b65a14f0fc77a1d3221c7dc6781eb66059aa200956b094d58a62bd1cad10f116"
         },
         "goToolchain": "go1.26.9"
+    },
+    "0.9.2": {
+        "x86_64": "89c26f18ef05b601963341da6cce43f588bdf2a74039feaf3dfcffdd1295207f",
+        "aarch64": "6616953ac1721da64a134898ed1bec93d8e5a81fc044f8bc822751df1a871bdd",
+        "armv7": "d9c62b601454b8806a6eeef18a503385b508a8a3b947afa9b433a092979cc6da",
+        "lifecycle": {
+            "x86_64": "819459580135e016184ad80c258350d57194d6134e8aa4cf1caf5237085b1004",
+            "aarch64": "5abcfc21403e84a0af15d972bcb819ac6fedfd9aaf5898ddc8c4bb06130f9f59",
+            "armv7": "b65a14f0fc77a1d3221c7dc6781eb66059aa200956b094d58a62bd1cad10f116"
+        },
+        "goToolchain": "go1.26.9"
+    },
+    "0.9.3": {
+        "x86_64": "89c26f18ef05b601963341da6cce43f588bdf2a74039feaf3dfcffdd1295207f",
+        "aarch64": "6616953ac1721da64a134898ed1bec93d8e5a81fc044f8bc822751df1a871bdd",
+        "armv7": "d9c62b601454b8806a6eeef18a503385b508a8a3b947afa9b433a092979cc6da",
+        "lifecycle": {
+            "x86_64": "819459580135e016184ad80c258350d57194d6134e8aa4cf1caf5237085b1004",
+            "aarch64": "5abcfc21403e84a0af15d972bcb819ac6fedfd9aaf5898ddc8c4bb06130f9f59",
+            "armv7": "b65a14f0fc77a1d3221c7dc6781eb66059aa200956b094d58a62bd1cad10f116"
+        },
+        "goToolchain": "go1.26.9"
+    },
+    "0.9.4": {
+        "x86_64": "fc3c206b6a8e30b7470cedabf6676c027960311469685eab2fe544fe6cc671ac",
+        "aarch64": "aa1a8a1b88758ad47ca69d30e9649a24a93b94b5b5fc181ce782035c2c77c497",
+        "armv7": "0c39cb98b67735fede6bbbe91471695e26707f377cbc50dd860a1d9a7fe06fcf",
+        "lifecycle": {
+            "x86_64": "819459580135e016184ad80c258350d57194d6134e8aa4cf1caf5237085b1004",
+            "aarch64": "5abcfc21403e84a0af15d972bcb819ac6fedfd9aaf5898ddc8c4bb06130f9f59",
+            "armv7": "b65a14f0fc77a1d3221c7dc6781eb66059aa200956b094d58a62bd1cad10f116"
+        },
+        "goToolchain": "go1.26.9"
     }
 }

package/dist/standalone/inspect-spk.js

@@ -118,7 +118,7 @@ export async function inspectSpk(spkPath, expectedKind) {
         if (metadata.entry)
             await checkEntryLauncher(dir, info.package, metadata.entry, findings);
         if (standalone)
-            checkSharedFolder(dir, findings, info.package, sharedFolder, executor?.policy.scope === 'install-selected', portal);
+            checkSharedFolder(dir, findings, info.package, sharedFolder, executor?.policy.scope === 'install-selected', portal, hasExecutor);
         const icon = inspectPackageIcons(dir, findings);
         const cgiEntry = payload.find((entry) => entry.path === CGI_PAYLOAD_PATH);
         if (standalone && !cgiEntry) {
@@ -381,7 +381,7 @@ function checkBackground(dir, info, payload, findings, executor, daemon) {
  * declaration (without one, any present file must be the default native
  * install wizard), and no other install/upgrade wizard file may exist.
  */
-function checkSharedFolder(dir, findings, pkg, folder, selected = false, portal) {
+function checkSharedFolder(dir, findings, pkg, folder, selected = false, portal, executor = false) {
     const wizardDir = join(dir, "WIZARD_UIFILES");
     const present = (existsSync(wizardDir) ? readdirSync(wizardDir) : []).filter(name => /^(install|upgrade)_uifile(_|\.|$)/.test(name)).sort();
     const postinst = readOptional(join(dir, "scripts/postinst"));
@@ -407,7 +407,7 @@ function checkSharedFolder(dir, findings, pkg, folder, selected = false, portal)
     if (!folder)
         return;
     for (const hook of ["postinst", "postupgrade"]) {
-        if (readOptional(join(dir, "scripts", hook)) !== renderStandaloneScript(hook, { package: pkg, sharedFolder: folder, ...(selected ? { capabilities: { delegate: { scope: "install-selected" } } } : {}), ...portalManifest(portal) })) {
+        if (readOptional(join(dir, "scripts", hook)) !== renderStandaloneScript(hook, { package: pkg, sharedFolder: folder, ...(selected ? { capabilities: { delegate: { scope: "install-selected" } } } : executor ? { capabilities: { rootOps: true } } : {}), ...portalManifest(portal) })) {
             findings.push(`scripts/${hook} 與 install.sharedFolder 宣告的固定腳本不符`);
         }
     }

package/dist/standalone/root-window.js

@@ -155,22 +155,34 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
         if (current.ref) throw fail("executor_selection_cleanup_conflict");
       });
     }
+    // The task waits up to 35 s for the executor, whose account, AppPriv and
+    // share lookups took 16-20 s on a measured NAS: read back for 40 s,
+    // backing off from 500 ms to 2 s like health.
+    function readSelection(budget, delay) {
+      delay = Math.min(delay || 500, 2000);
+      verified.state = "ready";
+      return health(verified, 0).then(function (current) {
+        if (current.state === "ready" && current.executor.selection && current.executor.selection.scope === selectedScope && Number.isSafeInteger(current.executor.selection.generation) && current.executor.selection.generation > 0) return current;
+        if (budget >= delay && options.wait) return options.wait(delay).then(function () { return readSelection(budget - delay, delay * 2); });
+        throw fail("executor_selection_unconfirmed");
+      });
+    }
+    // Right after a reinstall the boot task restarts the executor, so a run can
+    // miss it. Past the readback window that run has ended: run the pinned task
+    // once more. Its expected generation makes it stale if the first one landed.
+    function runAndRead(ref, runs) {
+      return send(taskAPI, "run", 2, {tasks: [ref]}).then(function () { return readSelection(40000); }).catch(function (e) {
+        if (runs > 1 && e && e.code === "executor_selection_unconfirmed") return runAndRead(ref, runs - 1);
+        throw e;
+      });
+    }
     return find(task).then(function (current) {
       if (current.state === "blocked" || current.state === "unsupported") throw fail("executor_selection_conflict");
       var removed = current.ref ? remove(task, current.ref) : Promise.resolve();
       return removed.then(function () { return create(false, definition(task), confirmation); });
     }).then(function () { return find(task); }).then(function (current) {
       if (current.state !== "ready") throw fail("executor_selection_readback_mismatch");
-      return send(taskAPI, "run", 2, {tasks: [current.ref]});
-    }).then(function () {
-      function readSelection(attempts) {
-        return health(verified, 0).then(function (current) {
-          if (current.state === "ready" && current.executor.selection && current.executor.selection.scope === selectedScope && Number.isSafeInteger(current.executor.selection.generation) && current.executor.selection.generation > 0) return current;
-          if (attempts > 1 && options.wait) return options.wait(500).then(function () { verified.state = "ready"; return readSelection(attempts - 1); });
-          throw fail("executor_selection_unconfirmed");
-        });
-      }
-      return readSelection(40);
+      return runAndRead(current.ref, 2);
     }).then(function (result) { return removeExact().then(function () { return result; }); }, function (error) {
       return removeExact().then(function () { throw error; });
     });
@@ -188,6 +200,9 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
       verified.executor = status; return verified;
     }, function () { return null; });
   }
+  // A started executor answered only after its own DSM lookups, which took
+  // 16-20 s on a measured NAS; giving up withdraws a fresh approval.
+  var startBudget = 30000;
   // budget: how long to keep asking after a start (ms). The wait doubles from
   // 500 ms to 2 s so an open window does not poll the executor twice a second.
   function health(verified, budget, delay) {
@@ -211,7 +226,7 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
       return send(eventAPI, "run", 1, verified.tasks.boot.ref);
     }).then(function () {
       // run can succeed for a nonexistent task. Read both definitions again.
-      return read().then(function (after) { return health(after, 10000); });
+      return read().then(function (after) { return health(after, startBudget); });
     }).catch(function (e) { verified.state = "blocked"; verified.reason = reason(e); return verified; });
   }
   // The window panel and the app's own settings share this access; each
@@ -230,7 +245,7 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
         if (verified.state !== "ready") throw fail("executor_not_ready");
         return options.call("executor.control", {action: action}).then(function () {
           return send(taskAPI, "run", 2, {tasks: [verified.tasks.control.ref]});
-        }).then(read).then(function (after) { return action === "start" ? health(after, 10000) : after; });
+        }).then(read).then(function (after) { return action === "start" ? health(after, startBudget) : after; });
       }).then(publish);
     },
     subscribe: function (listener) { listeners.push(listener); }

package/dist/standalone/spk.js

@@ -12,6 +12,7 @@ import { writeWizardUiFiles } from "../build-spk/wizard-i18n.js";
 import { renderDelegateScopeSteps } from '../build-spk/delegate-scope.js';
 import { createReproducibleTar } from "../build-spk/reproducible-archive.js";
 import { renderStandaloneScript } from "./lifecycle.js";
+import { codedMessage } from "../errors.js";
 import { DSM_LANGS, LOCALES } from "./i18n.js";
 import { appTitle, CGI_PAYLOAD_PATH, renderUiConfig, renderWindowScript, windowScriptName } from "./dsm-window.js";
 import { writeUiTexts } from "../build-spk/ui-texts.js";
@@ -40,7 +41,7 @@ export const LIFECYCLE_SCRIPTS = [
 export class StandaloneBuildError extends Error {
     code;
     constructor(code, message) {
-        super(`[${code}] ${message}`);
+        super(codedMessage(code, message));
         this.code = code;
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.9.1",
+  "version": "0.9.3",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -24,7 +24,7 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@synopackageland/templates": "0.9.1",
+    "@synopackageland/templates": "0.9.3",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "tar": "^7.4.3",