@coze-arch/cli 0.0.36-alpha.102c95 → 0.0.36-alpha.15544e

package/lib/__templates__/nextjs/scripts/dev.sh

@@ -14,22 +14,42 @@ DEPLOY_RUN_PORT="${DEPLOY_RUN_PORT:-${PORT}}"
 
 cd "${COZE_WORKSPACE_PATH}"
 
+list_port_pids() {
+    local port=$1
+    local pids=""
+    local has_tool=0
+
+    if command -v ss >/dev/null 2>&1; then
+      has_tool=1
+      pids=$(ss -H -lntp 2>/dev/null | awk -v port="${port}" '$4 ~ ":"port"$"' | grep -o 'pid=[0-9]*' | cut -d= -f2 | sort -u | paste -sd' ' - || true)
+    fi
+    if [[ -z "${pids}" ]] && command -v lsof >/dev/null 2>&1; then
+      has_tool=1
+      pids=$(lsof -t -iTCP:"${port}" -sTCP:LISTEN 2>/dev/null | sort -u | paste -sd' ' - || true)
+    fi
+    if [[ "${has_tool}" -eq 0 ]]; then
+      echo "Warning: neither ss nor lsof available, cannot inspect port ${port}." >&2
+    fi
+
+    echo "${pids}"
+}
+
 kill_port_if_listening() {
     local pids
-    pids=$(ss -H -lntp 2>/dev/null | awk -v port="${DEPLOY_RUN_PORT}" '$4 ~ ":"port"$"' | grep -o 'pid=[0-9]*' | cut -d= -f2 | paste -sd' ' - || true)
+    pids=$(list_port_pids "${DEPLOY_RUN_PORT}")
     if [[ -z "${pids}" ]]; then
       echo "Port ${DEPLOY_RUN_PORT} is free."
       return
     fi
     echo "Port ${DEPLOY_RUN_PORT} in use by PIDs: ${pids} (SIGKILL)"
-    echo "${pids}" | xargs -I {} kill -9 {}
+    echo "${pids}" | xargs -I {} kill -9 {} || true
     sleep 1
-    pids=$(ss -H -lntp 2>/dev/null | awk -v port="${DEPLOY_RUN_PORT}" '$4 ~ ":"port"$"' | grep -o 'pid=[0-9]*' | cut -d= -f2 | paste -sd' ' - || true)
+    pids=$(list_port_pids "${DEPLOY_RUN_PORT}")
     if [[ -n "${pids}" ]]; then
-      echo "Warning: port ${DEPLOY_RUN_PORT} still busy after SIGKILL, PIDs: ${pids}"
-    else
-      echo "Port ${DEPLOY_RUN_PORT} cleared."
+      echo "端口 ${DEPLOY_RUN_PORT} 被 PID ${pids} 占用且无法清理（SIGKILL 后仍在监听），dev server 无法启动。" >&2
+      exit 1
     fi
+    echo "Port ${DEPLOY_RUN_PORT} cleared."
 }
 
 <% if (process.env.NODE_ENV === 'test') { %>
@@ -41,17 +61,42 @@ echo "Starting HTTP service on port ${DEPLOY_RUN_PORT} for dev..."
 exec env PORT="${DEPLOY_RUN_PORT}" pnpm tsx watch src/server.ts
 <% } else { %>
 LOG_DIR="${COZE_LOG_DIR:-${COZE_WORKSPACE_PATH}/logs}"
-LOG_FILE="${LOG_DIR}/server.log"
+LOG_FILE="${LOG_DIR}/app.log"
 PID_FILE="${LOG_DIR}/server.pid"
 
-# coze-daemon 会在 runtime shell 退出时清理原进程组。
-# 通过 Node detached spawn 创建独立 session/进程组，并将 stdio 直接写入日志。
+# detached 出去的进程没人负责回收，超过这个时长就自己退出，避免端口与内存长期泄露。
+MAX_RUNTIME_SECONDS=1200
+
+# 真正被 detach 的是这层 bash wrapper：它是进程组 leader，组内 watchdog 到点回收整组
+# （wrapper -> pnpm -> tsx -> node）；被包的进程自己先退出时也顺手清空进程组，不留残余。
+RUN_WITH_TIMEOUT='
+timeout_seconds=$1
+shift
+
+"$@" &
+child_pid=$!
+
+# 先忽略 TERM，才能在向整组发 TERM（自己也在组里）之后存活下来补一发 KILL。
+( trap "" TERM
+  sleep "${timeout_seconds}"
+  echo "[dev] 后台进程运行超过 ${timeout_seconds}s，回收进程组 $$。"
+  kill -TERM -- "-$$" 2>/dev/null || true
+  sleep 5
+  kill -KILL -- "-$$" 2>/dev/null || true
+) &
+
+wait "${child_pid}"
+kill -KILL -- "-$$" 2>/dev/null || true
+'
+
+# 返回的 PID 是 wrapper 的，同时也是整个进程组的 PGID，后续按组回收。
 spawn_detached() {
   local cwd="$1"
   local log_file="$2"
   shift 2
 
-  node - "$cwd" "$log_file" "$@" <<'NODE'
+  node - "$cwd" "$log_file" \
+    /bin/bash -c "${RUN_WITH_TIMEOUT}" detached-runner "${MAX_RUNTIME_SECONDS}" "$@" <<'NODE'
 const fs = require('node:fs');
 const { spawn } = require('node:child_process');
 
@@ -87,6 +132,89 @@ stop_detached() {
   kill -KILL -- "-${pid}" 2>/dev/null || true
 }
 
+READY_RETRIES=10
+READY_PROBE_HOSTS=("127.0.0.1" "::1")
+LOG_TAIL_LINES=40
+
+dump_log() {
+  echo "---- tail -n ${LOG_TAIL_LINES} ${LOG_FILE} ----" >&2
+  tail -n "${LOG_TAIL_LINES}" "${LOG_FILE}" >&2 || true
+  echo "---- end of ${LOG_FILE} ----" >&2
+}
+
+# 仅用于无 ss/lsof 时的兜底探测。服务可能只 bind IPv4 loopback、只 bind IPv6 loopback
+# （server.listen(port, 'localhost') 会变成 ::1 独占），或 bind 双栈通配地址，
+port_connectable() {
+  local port=$1
+  local host
+  for host in "${READY_PROBE_HOSTS[@]}"; do
+    if command -v nc >/dev/null 2>&1; then
+      if nc -z -w 1 "${host}" "${port}" >/dev/null 2>&1; then
+        return 0
+      fi
+    elif (exec 3<>"/dev/tcp/${host}/${port}") >/dev/null 2>&1; then
+      return 0
+    fi
+  done
+  return 1
+}
+
+port_probe_available() {
+  command -v ss >/dev/null 2>&1 || command -v lsof >/dev/null 2>&1
+}
+
+# 端口监听者是否属于本进程组：spawn detached 后 PID == PGID，子孙进程继承该 PGID。
+#   0 = 是；1 = 不是（无人监听，或监听者不属于本进程组）；2 = 无探测工具，无法判断
+port_listened_by_pgid() {
+  local port=$1 pgid=$2
+  local listener owner
+
+  if ! port_probe_available; then
+    return 2
+  fi
+
+  for listener in $(list_port_pids "${port}" 2>/dev/null); do
+    owner=$(ps -o pgid= -p "${listener}" 2>/dev/null | tr -d ' ')
+    if [[ "${owner}" == "${pgid}" ]]; then
+      return 0
+    fi
+  done
+  return 1
+}
+
+wait_for_ready() {
+  local pid=$1 port=$2
+  local attempt=0 owned
+
+  if ! port_probe_available; then
+    echo "Warning: 缺少 ss 与 lsof，无法确认端口监听者归属，仅按 loopback 可连接性判断就绪。" >&2
+  fi
+
+  while [[ "${attempt}" -lt "${READY_RETRIES}" ]]; do
+    if ! kill -0 "${pid}" 2>/dev/null; then
+      echo "Dev server 进程在启动过程中退出。" >&2
+      return 1
+    fi
+
+    if port_listened_by_pgid "${port}" "${pid}"; then
+      owned=0
+    else
+      owned=$?
+    fi
+    if [[ "${owned}" -eq 0 ]]; then
+      return 0
+    fi
+    if [[ "${owned}" -eq 2 ]] && port_connectable "${port}"; then
+      return 0
+    fi
+
+    sleep 1
+    attempt=$((attempt + 1))
+  done
+
+  return 2
+}
+
 # 监听端口的是孙进程（pnpm -> tsx -> node），只清端口会漏掉上层 pnpm/tsx，
 # 所以先按上次记录的 PID 把整个进程组回收掉。
 if [[ -f "${PID_FILE}" ]]; then
@@ -104,17 +232,34 @@ mkdir -p "${LOG_DIR}"
 export PORT="${DEPLOY_RUN_PORT}"
 server_pid="$(spawn_detached "${COZE_WORKSPACE_PATH}" "${LOG_FILE}" \
   "$(command -v pnpm)" tsx watch src/server.ts)"
+if [[ -z "${server_pid}" ]]; then
+  echo "Dev server failed to start: 未获取到后台进程 PID。" >&2
+  dump_log
+  exit 1
+fi
 echo "${server_pid}" > "${PID_FILE}"
 
-sleep 1
-if [[ -z "${server_pid}" ]] || ! kill -0 "${server_pid}" 2>/dev/null; then
+if wait_for_ready "${server_pid}" "${DEPLOY_RUN_PORT}"; then
+  ready_status=0
+else
+  ready_status=$?
+fi
+
+if [[ "${ready_status}" -eq 2 ]]; then
+  # 进程还活着但迟迟没监听端口：多半是编译/运行时报错后 tsx watch 驻留，日志里有真正原因。
+  echo "Dev server 在 ${READY_RETRIES} 次探测（每次 1s）内未就绪于端口 ${DEPLOY_RUN_PORT}（进程 ${server_pid} 仍在运行）。" >&2
+  dump_log
+  exit 1
+elif [[ "${ready_status}" -ne 0 ]]; then
   echo "Dev server failed to start. See ${LOG_FILE}." >&2
-  tail -n 20 "${LOG_FILE}" >&2 || true
+  dump_log
+  stop_detached "${server_pid}"
   rm -f "${PID_FILE}"
   exit 1
 fi
 
-echo "Dev server started (PID: ${server_pid})."
+echo "Dev server started (PID: ${server_pid}), listening on port ${DEPLOY_RUN_PORT}."
+echo "Auto stop after ${MAX_RUNTIME_SECONDS}s."
 echo "Log file: ${LOG_FILE}"
 echo "PID file: ${PID_FILE}"
 <% } %>

package/lib/__templates__/nextjs/template.config.js

@@ -66,7 +66,7 @@ const config = {
     }
 
     const cmd = 'pnpm';
-    const args = ['update', 'coze-coding-dev-sdk@^0.7.0'];
+    const args = ['update', 'coze-coding-dev-sdk@^0.7.25-beta.8'];
     console.log(
       `\nTriggering: ${cmd} ${args.join(' ')} (running in background)`,
     );

package/lib/__templates__/nuxt-vue/package.json

@@ -27,7 +27,7 @@
     "@nuxtjs/tailwindcss": "^6.14.0",
     "@types/node": "^20",
     "autoprefixer": "^10.4.20",
-    "coze-coding-dev-sdk": "^0.7.16",
+    "coze-coding-dev-sdk": "^0.7.25-beta.8",
     "eslint": "^9",
     "eslint-plugin-import": "^2.32.0",
     "eslint-plugin-vue": "^10",

package/lib/__templates__/nuxt-vue/pnpm-lock.yaml

@@ -34,8 +34,8 @@ importers:
         specifier: ^10.4.20
         version: 10.4.27(postcss@8.5.8)
       coze-coding-dev-sdk:
-        specifier: ^0.7.16
-        version: 0.7.17(openai@6.27.0(ws@8.21.3)(zod@4.3.6))(ws@8.21.3)
+        specifier: ^0.7.25-beta.8
+        version: 0.7.25-beta.8(openai@6.27.0(ws@8.21.3)(zod@4.3.6))(ws@8.21.3)
       eslint:
         specifier: ^9
         version: 9.39.4(jiti@2.7.0)
@@ -2498,8 +2498,8 @@ packages:
       typescript:
         optional: true
 
-  coze-coding-dev-sdk@0.7.17:
-    resolution: {integrity: sha512-ABq84CkmEtvIAat9QGnfY+b1na5Z7XGyAJP/N2XzqFkVfEF268EwFZLpDOQsBBoYWT+6fmpKLZzBoJDVkQU47w==}
+  coze-coding-dev-sdk@0.7.25-beta.8:
+    resolution: {integrity: sha512-RSKlXCO0W/OPDjx9D9JICn2cGeOJw3iG+y0Pr1AhAf7YdAjjNbBZoG7qfg0Zg2SqgaVN2qSLQFmKPbhNq9ZWSg==}
     engines: {node: '>=18.0.0'}
     hasBin: true
 
@@ -8526,7 +8526,7 @@ snapshots:
     optionalDependencies:
       typescript: 5.9.3
 
-  coze-coding-dev-sdk@0.7.17(openai@6.27.0(ws@8.21.3)(zod@4.3.6))(ws@8.21.3):
+  coze-coding-dev-sdk@0.7.25-beta.8(openai@6.27.0(ws@8.21.3)(zod@4.3.6))(ws@8.21.3):
     dependencies:
       '@langchain/core': 1.1.31(openai@6.27.0(ws@8.21.3)(zod@4.3.6))
       '@langchain/openai': 1.2.12(@langchain/core@1.1.31(openai@6.27.0(ws@8.21.3)(zod@4.3.6)))(ws@8.21.3)

package/lib/__templates__/nuxt-vue/scripts/dev.sh

@@ -44,14 +44,41 @@ LOG_DIR="${COZE_LOG_DIR:-${COZE_WORKSPACE_PATH}/logs}"
 LOG_FILE="${LOG_DIR}/server.log"
 PID_FILE="${LOG_DIR}/server.pid"
 
+# detached 出去的进程没人负责回收，超过这个时长就自己退出，避免端口与内存长期泄露。
+MAX_RUNTIME_SECONDS=1200
+
+# 真正被 detach 的是这层 bash wrapper：它是进程组 leader，组内 watchdog 到点回收整组
+# （wrapper -> pnpm -> nuxt -> node）；被包的进程自己先退出时也顺手清空进程组，不留残余。
+RUN_WITH_TIMEOUT='
+timeout_seconds=$1
+shift
+
+"$@" &
+child_pid=$!
+
+# 先忽略 TERM，才能在向整组发 TERM（自己也在组里）之后存活下来补一发 KILL。
+( trap "" TERM
+  sleep "${timeout_seconds}"
+  echo "[dev] 后台进程运行超过 ${timeout_seconds}s，回收进程组 $$。"
+  kill -TERM -- "-$$" 2>/dev/null || true
+  sleep 5
+  kill -KILL -- "-$$" 2>/dev/null || true
+) &
+
+wait "${child_pid}"
+kill -KILL -- "-$$" 2>/dev/null || true
+'
+
 # coze-daemon 会在 runtime shell 退出时清理原进程组。
 # 通过 Node detached spawn 创建独立 session/进程组，并将 stdio 直接写入日志。
+# 返回的 PID 是 wrapper 的，同时也是整个进程组的 PGID，后续按组回收。
 spawn_detached() {
   local cwd="$1"
   local log_file="$2"
   shift 2
 
-  node - "$cwd" "$log_file" "$@" <<'NODE'
+  node - "$cwd" "$log_file" \
+    /bin/bash -c "${RUN_WITH_TIMEOUT}" detached-runner "${MAX_RUNTIME_SECONDS}" "$@" <<'NODE'
 const fs = require('node:fs');
 const { spawn } = require('node:child_process');
 
@@ -115,6 +142,7 @@ if [[ -z "${server_pid}" ]] || ! kill -0 "${server_pid}" 2>/dev/null; then
 fi
 
 echo "Dev server started (PID: ${server_pid})."
+echo "Auto stop after ${MAX_RUNTIME_SECONDS}s."
 echo "Log file: ${LOG_FILE}"
 echo "PID file: ${PID_FILE}"
 <% } %>

package/lib/__templates__/pi-agent/package.json

@@ -22,7 +22,7 @@
     "@mariozechner/pi-ai": "^0.63.2",
     "@mariozechner/pi-coding-agent": "^0.63.2",
     "@sinclair/typebox": "^0.34.48",
-    "coze-coding-dev-sdk": "^0.7.17",
+    "coze-coding-dev-sdk": "^0.7.25-beta.8",
     "@radix-ui/react-select": "^2.2.6",
     "@radix-ui/react-slot": "^1.2.4",
     "@streamdown/code": "^1.1.1",

package/lib/__templates__/pi-agent/pnpm-lock.yaml

@@ -36,8 +36,8 @@ importers:
         specifier: ^2.1.1
         version: 2.1.1
       coze-coding-dev-sdk:
-        specifier: ^0.7.17
-        version: 0.7.20(openai@6.34.0(ws@8.20.0)(zod@4.3.6))(ws@8.20.0)
+        specifier: ^0.7.25-beta.8
+        version: 0.7.25-beta.8(openai@6.34.0(ws@8.20.0)(zod@4.3.6))(ws@8.20.0)
       express:
         specifier: ^4.21.2
         version: 4.22.1
@@ -2085,8 +2085,8 @@ packages:
   cose-base@2.2.0:
     resolution: {integrity: sha512-AzlgcsCbUMymkADOJtQm3wO9S3ltPfYOFD5033keQn9NJzIbtnZj+UdBJe7DYml/8TdbtHJW3j58SOnKhWY/5g==}
 
-  coze-coding-dev-sdk@0.7.20:
-    resolution: {integrity: sha512-f3UeZcYB/udyWrlFrsOViM47PCW+Nk0I4FcXEGzcjEfaQsa1CPBpf/y5UbBM6GIZ1v+lnuh/MiBlAaALFeMTqw==}
+  coze-coding-dev-sdk@0.7.25-beta.8:
+    resolution: {integrity: sha512-RSKlXCO0W/OPDjx9D9JICn2cGeOJw3iG+y0Pr1AhAf7YdAjjNbBZoG7qfg0Zg2SqgaVN2qSLQFmKPbhNq9ZWSg==}
     engines: {node: '>=18.0.0'}
     hasBin: true
 
@@ -6120,7 +6120,7 @@ snapshots:
     dependencies:
       layout-base: 2.0.1
 
-  coze-coding-dev-sdk@0.7.20(openai@6.34.0(ws@8.20.0)(zod@4.3.6))(ws@8.20.0):
+  coze-coding-dev-sdk@0.7.25-beta.8(openai@6.34.0(ws@8.20.0)(zod@4.3.6))(ws@8.20.0):
     dependencies:
       '@langchain/core': 1.1.40(openai@6.34.0(ws@8.20.0)(zod@4.3.6))(ws@8.20.0)
       '@langchain/openai': 1.4.3(@langchain/core@1.1.40(openai@6.34.0(ws@8.20.0)(zod@4.3.6))(ws@8.20.0))(ws@8.20.0)

package/lib/__templates__/taro/.cozeproj/scripts/dev_run.sh

@@ -30,14 +30,41 @@ kill_process_tree() {
     fi
 }
 
+# detached 出去的进程没人负责回收，超过这个时长就自己退出，避免端口与内存长期泄露。
+MAX_RUNTIME_SECONDS=1200
+
+# 真正被 detach 的是这层 bash wrapper：它是进程组 leader，组内 watchdog 到点回收整组
+# （wrapper -> pnpm -> taro/nest）；被包的进程自己先退出时也顺手清空进程组，不留残余。
+RUN_WITH_TIMEOUT='
+timeout_seconds=$1
+shift
+
+"$@" &
+child_pid=$!
+
+# 先忽略 TERM，才能在向整组发 TERM（自己也在组里）之后存活下来补一发 KILL。
+( trap "" TERM
+  sleep "${timeout_seconds}"
+  echo "[dev] 后台进程运行超过 ${timeout_seconds}s，回收进程组 $$。"
+  kill -TERM -- "-$$" 2>/dev/null || true
+  sleep 5
+  kill -KILL -- "-$$" 2>/dev/null || true
+) &
+
+wait "${child_pid}"
+kill -KILL -- "-$$" 2>/dev/null || true
+'
+
 # coze-daemon 会在 runtime shell 退出时清理原进程组。
 # 通过 Node detached spawn 创建独立 session/进程组，并将 stdio 直接写入日志。
+# 返回的 PID 是 wrapper 的，同时也是整个进程组的 PGID，后续按组回收。
 spawn_detached() {
     local cwd="$1"
     local log_file="$2"
     shift 2
 
-    node - "$cwd" "$log_file" "$@" <<'NODE'
+    node - "$cwd" "$log_file" \
+        /bin/bash -c "${RUN_WITH_TIMEOUT}" detached-runner "${MAX_RUNTIME_SECONDS}" "$@" <<'NODE'
 const fs = require('node:fs');
 const { spawn } = require('node:child_process');
 
@@ -225,6 +252,7 @@ start_service() {
     fi
 
     echo "📝 Dev process started with PID: ${DEV_PID}"
+    echo "Auto stop after ${MAX_RUNTIME_SECONDS}s."
     echo "Log file: ${LOG_FILE}"
     echo "PID file: ${PID_FILE}"
 }

package/lib/__templates__/taro/pnpm-lock.yaml

@@ -204,8 +204,8 @@ importers:
         specifier: 2.95.3
         version: 2.95.3
       coze-coding-dev-sdk:
-        specifier: ^0.7.25-beta.4
-        version: 0.7.25-beta.4(openai@6.16.0(ws@8.19.0)(zod@4.3.5))(ws@8.19.0)
+        specifier: ^0.7.25-beta.8
+        version: 0.7.25-beta.8(openai@6.16.0(ws@8.19.0)(zod@4.3.5))(ws@8.19.0)
       dotenv:
         specifier: ^17.2.3
         version: 17.2.3
@@ -5416,8 +5416,8 @@ packages:
       typescript:
         optional: true
 
-  coze-coding-dev-sdk@0.7.25-beta.4:
-    resolution: {integrity: sha512-+PCoJ8yhsAIlx3YT898bCkB2gx5EMBunJMP7/kI/Jq/8dj7SDU9EUBZ2Z8ZJocSaPBT9T6dVvFHBsDLZh4FN/Q==}
+  coze-coding-dev-sdk@0.7.25-beta.8:
+    resolution: {integrity: sha512-RSKlXCO0W/OPDjx9D9JICn2cGeOJw3iG+y0Pr1AhAf7YdAjjNbBZoG7qfg0Zg2SqgaVN2qSLQFmKPbhNq9ZWSg==}
     engines: {node: '>=18.0.0'}
     hasBin: true
 
@@ -17159,7 +17159,7 @@ snapshots:
     optionalDependencies:
       typescript: 5.9.3
 
-  coze-coding-dev-sdk@0.7.25-beta.4(openai@6.16.0(ws@8.19.0)(zod@4.3.5))(ws@8.19.0):
+  coze-coding-dev-sdk@0.7.25-beta.8(openai@6.16.0(ws@8.19.0)(zod@4.3.5))(ws@8.19.0):
     dependencies:
       '@langchain/core': 1.1.16(openai@6.16.0(ws@8.19.0)(zod@4.3.5))
       '@langchain/openai': 1.2.3(@langchain/core@1.1.16(openai@6.16.0(ws@8.19.0)(zod@4.3.5)))(ws@8.19.0)

package/lib/__templates__/taro/server/package.json

@@ -17,7 +17,7 @@
     "@nestjs/core": "^10.4.15",
     "@nestjs/platform-express": "^10.4.15",
     "@supabase/supabase-js": "2.95.3",
-    "coze-coding-dev-sdk": "^0.7.25-beta.4",
+    "coze-coding-dev-sdk": "^0.7.25-beta.8",
     "dotenv": "^17.2.3",
     "drizzle-kit": "^0.31.8",
     "drizzle-orm": "^0.45.1",

package/lib/__templates__/vite/package.json

@@ -22,7 +22,7 @@
     "@types/express": "^5.0.0",
     "@types/node": "^22.10.5",
     "autoprefixer": "^10.4.20",
-    "coze-coding-dev-sdk": "^0.7.16",
+    "coze-coding-dev-sdk": "^0.7.25-beta.8",
     "esbuild": "^0.24.2",
     "eslint": "^9",
     "eslint-plugin-import": "^2.32.0",

package/lib/__templates__/vite/pnpm-lock.yaml

@@ -32,8 +32,8 @@ importers:
         specifier: ^10.4.20
         version: 10.4.23(postcss@8.5.6)
       coze-coding-dev-sdk:
-        specifier: ^0.7.16
-        version: 0.7.16(openai@6.16.0(ws@8.19.0)(zod@4.3.5))(ws@8.19.0)
+        specifier: ^0.7.25-beta.8
+        version: 0.7.25-beta.8(openai@6.16.0(ws@8.19.0)(zod@4.3.5))(ws@8.19.0)
       esbuild:
         specifier: ^0.27.2
         version: 0.27.2
@@ -910,8 +910,8 @@ packages:
       typescript:
         optional: true
 
-  coze-coding-dev-sdk@0.7.16:
-    resolution: {integrity: sha512-B7gRPBa+sfrZL8ur0+F/92SOgZgFaWD/fOnCN2DjthnHSdmCYhAJWCfqzG2oO2vwTiYCXkKUuTBZ3MJLMj886g==}
+  coze-coding-dev-sdk@0.7.25-beta.8:
+    resolution: {integrity: sha512-RSKlXCO0W/OPDjx9D9JICn2cGeOJw3iG+y0Pr1AhAf7YdAjjNbBZoG7qfg0Zg2SqgaVN2qSLQFmKPbhNq9ZWSg==}
     engines: {node: '>=18.0.0'}
     hasBin: true
 
@@ -3281,7 +3281,7 @@ snapshots:
     optionalDependencies:
       typescript: 5.9.3
 
-  coze-coding-dev-sdk@0.7.16(openai@6.16.0(ws@8.19.0)(zod@4.3.5))(ws@8.19.0):
+  coze-coding-dev-sdk@0.7.25-beta.8(openai@6.16.0(ws@8.19.0)(zod@4.3.5))(ws@8.19.0):
     dependencies:
       '@langchain/core': 1.1.16(openai@6.16.0(ws@8.19.0)(zod@4.3.5))
       '@langchain/openai': 1.2.3(@langchain/core@1.1.16(openai@6.16.0(ws@8.19.0)(zod@4.3.5)))(ws@8.19.0)

package/lib/__templates__/vite/scripts/dev.sh

@@ -44,14 +44,41 @@ LOG_DIR="${COZE_LOG_DIR:-${COZE_WORKSPACE_PATH}/logs}"
 LOG_FILE="${LOG_DIR}/server.log"
 PID_FILE="${LOG_DIR}/server.pid"
 
+# detached 出去的进程没人负责回收，超过这个时长就自己退出，避免端口与内存长期泄露。
+MAX_RUNTIME_SECONDS=1200
+
+# 真正被 detach 的是这层 bash wrapper：它是进程组 leader，组内 watchdog 到点回收整组
+# （wrapper -> pnpm -> tsx -> node）；被包的进程自己先退出时也顺手清空进程组，不留残余。
+RUN_WITH_TIMEOUT='
+timeout_seconds=$1
+shift
+
+"$@" &
+child_pid=$!
+
+# 先忽略 TERM，才能在向整组发 TERM（自己也在组里）之后存活下来补一发 KILL。
+( trap "" TERM
+  sleep "${timeout_seconds}"
+  echo "[dev] 后台进程运行超过 ${timeout_seconds}s，回收进程组 $$。"
+  kill -TERM -- "-$$" 2>/dev/null || true
+  sleep 5
+  kill -KILL -- "-$$" 2>/dev/null || true
+) &
+
+wait "${child_pid}"
+kill -KILL -- "-$$" 2>/dev/null || true
+'
+
 # coze-daemon 会在 runtime shell 退出时清理原进程组。
 # 通过 Node detached spawn 创建独立 session/进程组，并将 stdio 直接写入日志。
+# 返回的 PID 是 wrapper 的，同时也是整个进程组的 PGID，后续按组回收。
 spawn_detached() {
   local cwd="$1"
   local log_file="$2"
   shift 2
 
-  node - "$cwd" "$log_file" "$@" <<'NODE'
+  node - "$cwd" "$log_file" \
+    /bin/bash -c "${RUN_WITH_TIMEOUT}" detached-runner "${MAX_RUNTIME_SECONDS}" "$@" <<'NODE'
 const fs = require('node:fs');
 const { spawn } = require('node:child_process');
 
@@ -115,6 +142,7 @@ if [[ -z "${server_pid}" ]] || ! kill -0 "${server_pid}" 2>/dev/null; then
 fi
 
 echo "Dev server started (PID: ${server_pid})."
+echo "Auto stop after ${MAX_RUNTIME_SECONDS}s."
 echo "Log file: ${LOG_FILE}"
 echo "PID file: ${PID_FILE}"
 <% } %>

package/lib/__templates__/vite/template.config.js

@@ -73,7 +73,7 @@ const config = {
     }
 
     const cmd = 'pnpm';
-    const args = ['update', 'coze-coding-dev-sdk@^0.7.0'];
+    const args = ['update', 'coze-coding-dev-sdk@^0.7.25-beta.8'];
     console.log(
       `\nTriggering: ${cmd} ${args.join(' ')} (running in background)`,
     );