@coze-arch/cli 0.0.36-alpha.75f808 → 0.0.36-alpha.80ccd6

package/README.md

@@ -69,7 +69,9 @@ build_win = ["powershell.exe", "-NoProfile", "-ExecutionPolicy", "Bypass", "-Fil
 
 ## 部署
 
-`coze-dev deploy` 内置于同一 CLI，登录态默认保存在 `~/.coze/cli/config.json`：
+`coze-dev deploy` 内置于同一 CLI。认证优先读取
+`~/.coze/desktop/runtime.beta.json`，其次读取 `~/.coze/desktop/runtime.json`；
+桌面 Token 不可用时再回退到 `COZE_API_TOKEN` 和 `~/.coze/cli/config.json` 登录态：
 
 ```bash
 coze-dev deploy auth login

package/docs/deploy.md

@@ -1,7 +1,14 @@
 # coze-dev deploy
 
-`coze-dev` 内置的部署命令，复用主 Coze CLI 保存在
-`~/.coze/cli/config.json` 中的登录状态。
+`coze-dev` 内置的部署命令。认证凭据按以下优先级读取：
+
+1. `~/.coze/desktop/runtime.beta.json` 的 `patToken.accessToken`
+2. `~/.coze/desktop/runtime.json` 的 `patToken.accessToken`
+3. 非空环境变量 `COZE_API_TOKEN`
+4. 主 Coze CLI 保存在 `~/.coze/cli/config.json` 中的登录状态
+
+桌面运行时文件不存在、不可读、JSON 无效或 Token 字段缺失、为空时，CLI
+静默尝试下一来源，不输出或持久化 Token。
 
 ## 安装与运行
 

package/lib/__templates__/expo/.cozeproj/scripts/dev_run.sh

@@ -16,7 +16,12 @@ EXPO_HOST="0.0.0.0"
 EXPO_DIR="expo"
 # DEPLOY_RUN_PORT 是平台注入的对外端口，EXPO_PORT 保留为本地覆盖项。
 EXPO_PORT="${DEPLOY_RUN_PORT:-${EXPO_PORT:-<%= port %>}}"
-WEB_URL="${COZE_PROJECT_DOMAIN_DEFAULT:-http://127.0.0.1:${SERVER_PORT}}"
+COZE_HARDWARE_DID="${COZE_HARDWARE_DID:-}"
+if [ -n "${EXPO_PORT:-}" ] && [ -n "${COZE_HARDWARE_DID}" ]; then
+  WEB_URL="${COZE_PROJECT_DOMAIN_DEFAULT:-https://cozedaemon-${COZE_HARDWARE_DID}-${EXPO_PORT}.dev.coze.site}"
+else
+  WEB_URL="${COZE_PROJECT_DOMAIN_DEFAULT:-http://127.0.0.1:${SERVER_PORT}}"
+fi
 ASSUME_YES="1"
 EXPO_PUBLIC_BACKEND_BASE_URL="${EXPO_PUBLIC_BACKEND_BASE_URL:-$WEB_URL}"
 EXPO_PUBLIC_COZE_PROJECT_ID="${COZE_PROJECT_ID:-}"

package/lib/__templates__/nextjs/package.json

@@ -56,7 +56,7 @@
     "embla-carousel-react": "^8.6.0",
     "input-otp": "^1.4.2",
     "lucide-react": "^0.468.0",
-    "next": "16.1.1",
+    "next": "16.3.3",
     "next-themes": "^0.4.6",
     "pg": "^8.16.3",
     "react": "19.2.3",
@@ -80,7 +80,7 @@
     "@types/react": "^19",
     "@types/react-dom": "^19",
     "eslint": "^9",
-    "eslint-config-next": "16.1.1",
+    "eslint-config-next": "16.3.3",
     "only-allow": "^1.2.2",
     "react-dev-inspector": "^2.0.1",
     "shadcn": "latest",

package/lib/__templates__/nextjs/pnpm-lock.yaml

@@ -135,8 +135,8 @@ importers:
         specifier: ^0.468.0
         version: 0.468.0(react@19.2.3)
       next:
-        specifier: 16.1.1
-        version: 16.1.1(@babel/core@7.28.6)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)
+        specifier: 16.3.3
+        version: 16.3.3(@babel/core@7.28.6)(@types/node@20.19.30)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)
       next-themes:
         specifier: ^0.4.6
         version: 0.4.6(react-dom@19.2.3(react@19.2.3))(react@19.2.3)
@@ -202,8 +202,8 @@ importers:
         specifier: ^9
         version: 9.39.2(jiti@2.6.1)
       eslint-config-next:
-        specifier: 16.1.1
-        version: 16.1.1(@typescript-eslint/parser@8.54.0(eslint@9.39.2(jiti@2.6.1))(typescript@5.9.3))(eslint@9.39.2(jiti@2.6.1))(typescript@5.9.3)
+        specifier: 16.3.3
+        version: 16.3.3(@typescript-eslint/parser@8.54.0(eslint@9.39.2(jiti@2.6.1))(typescript@5.9.3))(eslint@9.39.2(jiti@2.6.1))(typescript@5.9.3)
       only-allow:
         specifier: ^1.2.2
         version: 1.2.2
@@ -6224,6 +6224,270 @@ packages:
   zod@4.3.6:
     resolution: {integrity: sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg==}
 
+  '@emnapi/runtime@1.11.3':
+    resolution: {integrity: sha512-Xz4Tpyki7XyrpbUK1jR1AhdAdaXyhhY4lZ3neLodmhpuWfy2PAQN5B46sAiU4liOXGLkHypn/qU+jvfWSCYYLA==}
+
+  '@img/colour@1.1.0':
+    resolution: {integrity: sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ==}
+    engines: {node: '>=18'}
+
+  '@img/sharp-darwin-arm64@0.35.3':
+    resolution: {integrity: sha512-RMnFX7YQsMoh7lWfcM4NEHHymBX/rLuKNPVM84XE9ONPcaSCDgE7CHIHpSgPcO2xcRthgBy1HfNO319mwhIAkg==}
+    engines: {node: '>=20.9.0'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@img/sharp-darwin-x64@0.35.3':
+    resolution: {integrity: sha512-Xo+5uFBtLN0BKqieTxiFzFPQAUlBbbH5iBKyRX/z1JrbnYsHTfKJnUfL8+p2TPXr1pXqao4eeL4Rl144uDpK9w==}
+    engines: {node: '>=20.9.0'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@img/sharp-freebsd-wasm32@0.35.3':
+    resolution: {integrity: sha512-lUxcqWIj2wMQ9BrwNjngcr1gWUr5xgaGThBRqPPalIC2n67Cqj1uPh8NnA/ZhAg8hUbKl+kVHKwgUIwe6ZYPrg==}
+    engines: {node: '>=20.9.0'}
+    os: [freebsd]
+
+  '@img/sharp-libvips-darwin-arm64@1.3.2':
+    resolution: {integrity: sha512-9J6ypZFpQBj4YnePGoq/S38w6nz+vqg5WZLrLGY4YuSemdMq47GMLBPO42MzwdGwpg/agZ7xzZcFHa48xlywfg==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@img/sharp-libvips-darwin-x64@1.3.2':
+    resolution: {integrity: sha512-m2pW1n6cns9VaubNwsZ+c3CRYjxNQWgJ5gPlnL1nbBcpkBvFm6SCFN5o0psFHI8w9n11NKhFkeEDns98tiqbEw==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@img/sharp-libvips-linux-arm64@1.3.2':
+    resolution: {integrity: sha512-dqVSFynCox4C/J8kT16V7SIFAns0IjgLwkvYT7p8LQVmJ5OS5b6tI9IGflxTeuBS//zXeFIUbwt5dwxyZ17cnA==}
+    cpu: [arm64]
+    os: [linux]
+
+  '@img/sharp-libvips-linux-arm@1.3.2':
+    resolution: {integrity: sha512-1eMLzy92I4J6rmi4mAT8yC3HxOtniyGELlzGbNMLLeqe052ahFQ0h6LFq+lh5DsDIdYViIDst08abvSbcEdLXQ==}
+    cpu: [arm]
+    os: [linux]
+
+  '@img/sharp-libvips-linux-ppc64@1.3.2':
+    resolution: {integrity: sha512-3z0NHDxD6n5I9gc05U1eW1AyRm+Gznzq3naMrthPNqE6oYykcogW0l/jfpJdjYnuNl8R7yI9pNbE1XiUeyq0Aw==}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@img/sharp-libvips-linux-riscv64@1.3.2':
+    resolution: {integrity: sha512-bsb4rI+NldGOsXuej2r8OdSS8+zXDVaCWxyWrcv6kneTOlgAHtZABRzBBCwdsPiD90J4myNJuHpg6kA20ImW/w==}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@img/sharp-libvips-linux-s390x@1.3.2':
+    resolution: {integrity: sha512-/ABshyj8gCpyIrNXnHn4LorDJ0HHm1VhXPBlxZ8zAtfVPAaSafXPGn+sUSIRiwaSBy0mmFjSjiXI5mkcwdChKQ==}
+    cpu: [s390x]
+    os: [linux]
+
+  '@img/sharp-libvips-linux-x64@1.3.2':
+    resolution: {integrity: sha512-ITPEtgffGJ0S6G9dRyw/366tJQqFRcHWPHhC+Stpg3Z8AEMrDrTr2lhdz4f/Y/HMbRh//7Z5mBzEpVdi62Oc3w==}
+    cpu: [x64]
+    os: [linux]
+
+  '@img/sharp-libvips-linuxmusl-arm64@1.3.2':
+    resolution: {integrity: sha512-zE9EdiUzUmg5mDT5a1rk5fYJ6GWPloTwWBYDS14naqHsL+EaMpDj1AWnpLgh3u0YCORv2Tt50wrcrpYqkP97Kw==}
+    cpu: [arm64]
+    os: [linux]
+
+  '@img/sharp-libvips-linuxmusl-x64@1.3.2':
+    resolution: {integrity: sha512-m0lrLiUt+lBYnCFr8qV/65yMR4E/c7/wf78I5eKTdkEakFAlZ9QlzEM3QIhhAwVeUhLAHLcCq7a7Vszq/oFNZQ==}
+    cpu: [x64]
+    os: [linux]
+
+  '@img/sharp-linux-arm64@0.35.3':
+    resolution: {integrity: sha512-QgKDspHPnrU+GQ55XPhGwyhC8acLVOOSyAvo1oVfFmrIXLkDNmGWzAfDZ4xK8oSA1qBQrALcHX0G5UZni/SuFQ==}
+    engines: {node: '>=20.9.0'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@img/sharp-linux-arm@0.35.3':
+    resolution: {integrity: sha512-affVWCTLooy8TSxbDx2qkzuDeaWLNVBA+P//FNBirHsXpP2fuBhk5AuboYUnrDnzoXes8GFjpTx0SBFOCRg+FA==}
+    engines: {node: '>=20.9.0'}
+    cpu: [arm]
+    os: [linux]
+
+  '@img/sharp-linux-ppc64@0.35.3':
+    resolution: {integrity: sha512-sMd8rDxmpLOwv/7N44klFjOD5DUO7FLdjiXDI0hoxYaf7Ar262dQIEkosE98bps+5HPLtp/EvNqeqQtOycP/IA==}
+    engines: {node: '>=20.9.0'}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@img/sharp-linux-riscv64@0.35.3':
+    resolution: {integrity: sha512-0Eob78yjlYPfL5vMNWAW55l3R9Y6BQS/gOfe0ZcP9mEz9ohhKSt4im1hayiknXgf8AWrFqMvJcKIdmLmEe7yeQ==}
+    engines: {node: '>=20.9.0'}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@img/sharp-linux-s390x@0.35.3':
+    resolution: {integrity: sha512-KgAxQ0DxpNOq1rG2t5cgTgShJFGSuU7XO45cqC+1NVOuZnP6tlgZRuSYOfNupGkHID0o3cJOsw4DVeJpMovcGw==}
+    engines: {node: '>=20.9.0'}
+    cpu: [s390x]
+    os: [linux]
+
+  '@img/sharp-linux-x64@0.35.3':
+    resolution: {integrity: sha512-8pqvxubL2PGdhlPy6GLqzDYMUjyRmKAwKHYKixpdJYBUK7PJ0C029XdsnpFIdgRZG68fZiGdHVWcKPvtiPB4cA==}
+    engines: {node: '>=20.9.0'}
+    cpu: [x64]
+    os: [linux]
+
+  '@img/sharp-linuxmusl-arm64@0.35.3':
+    resolution: {integrity: sha512-Vz0iQjzzcSX3HCbfwFfCSG/9SCIqyO0mH2sXyiHaAYfBk0cRsCWXRyQYX0ovCK/PAQBbTzQ0dsPQHh5MAFL59w==}
+    engines: {node: '>=20.9.0'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@img/sharp-linuxmusl-x64@0.35.3':
+    resolution: {integrity: sha512-6O1NPKcDVj9QEdg7Hx549EX8U0rp6yXQERqru6yRN7fGBn32UvIRJUlWnk+8xDCiG76hXVBbX82NZ/ZKr0euIg==}
+    engines: {node: '>=20.9.0'}
+    cpu: [x64]
+    os: [linux]
+
+  '@img/sharp-wasm32@0.35.3':
+    resolution: {integrity: sha512-cZ0XkcYGpHZkqW6iCkqTcmUC0CD9DhD5d/qeZlZkfRBn6GnHniZXLUo5+9xw8Iv76YE6LQFN9YNBlKREcCG76w==}
+    engines: {node: '>=20.9.0'}
+
+  '@img/sharp-webcontainers-wasm32@0.35.3':
+    resolution: {integrity: sha512-2rnq7bX3NzeR2T4YWgz8qiG4h3TSdMe+vN1iQXpJleSJ3SM5zQ8Fy2SyyXAWlbxpEZ2Y+Z4u1BePgJEYbSy80Q==}
+    engines: {node: '>=20.9.0'}
+    cpu: [wasm32]
+
+  '@img/sharp-win32-arm64@0.35.3':
+    resolution: {integrity: sha512-4bPwFdMbeC4JQ8L8LOyWp6nsHcboP5fxkp6iPOXz2Vg49R42TuMs2whkJ5OAP4/Ul035qOzy0AecOF9VOscn4w==}
+    engines: {node: '>=20.9.0'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@img/sharp-win32-ia32@0.35.3':
+    resolution: {integrity: sha512-r53mXsBN6lFUDiST764SvgwUdHAqM4rPAiDzAmf4fLoB6X/rkfyTrLCg6+g17wJJiCmB3JYgHuUldCWUIRFSXw==}
+    engines: {node: ^20.9.0}
+    cpu: [ia32]
+    os: [win32]
+
+  '@img/sharp-win32-x64@0.35.3':
+    resolution: {integrity: sha512-D4y1vNeZrIIJCN+uHaWVtH86B+aCrdMYYjicy9pXHvbGZeGYLLSd3wdVuC37FxVXlU1ARsk84eKWfWMXGYEqvA==}
+    engines: {node: '>=20.9.0'}
+    cpu: [x64]
+    os: [win32]
+
+  '@next/env@16.3.3':
+    resolution: {integrity: sha512-U2eYQRwXj+dsqxV79zFqExDdatnNY/ZWc2nsJU1p/OgT7fd3dXwlF6OjYaFQCfMoeTA19PWq+wVmYgimVA+V+g==}
+
+  '@next/eslint-plugin-next@16.3.3':
+    resolution: {integrity: sha512-pbEh30vvjKpDoTAmo1v3q2uM4JUi8QaEBpbmjWvGfoec2jLghy/WNtvzAT0bk+Ik9oz6etjt4YjXEk4BQnicCw==}
+
+  '@next/swc-darwin-arm64@16.3.3':
+    resolution: {integrity: sha512-8Hiv32QJPwdV6KYJ8meR9SBA061tQqnIKTJDocvOXlEQqib0xMFpzArosuffFUUc0sslbh7QQ8a3Yey1QV8EIw==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@next/swc-darwin-x64@16.3.3':
+    resolution: {integrity: sha512-A1lgKgwVchRYmSe467zdwhxT9040dd8lH+o65sL5Jet8fjB4kegw/rDyPIpYVRb6jAqwXFOJpjIXJLxQKLiE3A==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@next/swc-linux-arm64-gnu@16.3.3':
+    resolution: {integrity: sha512-bf0FIssMFueU2dm7vQEWWxk0c8UjKTdW0yzuh0sQsD8pf1+KCLDdaqhYZNMYGmXwEOiHAUzgBKudovIlcvvBjg==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@next/swc-linux-arm64-musl@16.3.3':
+    resolution: {integrity: sha512-W7viwCk9JY/cAkdz/A273rd5bb3RgT/IHwR7Upv90tunjBWNtAAhGhoecHh+teRNRSinuAFmE+l7fwZ4YKkrXg==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@next/swc-linux-x64-gnu@16.3.3':
+    resolution: {integrity: sha512-0W46zw1N3ODpI6n0GeivHvvob1pooozgZVqy65k0mh4/7vr+FbY9+WpHzNVXjHipJf/A3FDheBG19H1s5A25rA==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [linux]
+
+  '@next/swc-linux-x64-musl@16.3.3':
+    resolution: {integrity: sha512-H4mBso8ZTMBPtdT0PN0pBx2ayTvQuTuvS6qT13d77yVFJXAPCxkyIhLTmdMaGTJs0krQYI/qpzdHijCeihXhbg==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [linux]
+
+  '@next/swc-win32-arm64-msvc@16.3.3':
+    resolution: {integrity: sha512-cTMUJpcEGmeywofCUfhR+rSsoE33+rVPnPEYNTNdLNlsOeEg/vktOsKUSTb28vUGqD2jkm4Zaskcwn7OCI6FQg==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@next/swc-win32-x64-msvc@16.3.3':
+    resolution: {integrity: sha512-2VR4cTBzHXaBjnGsuH6GyJjENzQOmHeAh11uY1iUhjm3j5dEUrVJuUj+VL78jaGi/Dik8xS76zEj18BsFhlVZQ==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [win32]
+
+  '@swc/helpers@0.5.23':
+    resolution: {integrity: sha512-5lSsMOTXURePglDfvuAQUqkGek9Hg2kksOYay2m0+XR++b2NWYL/4sWyuvVBIs8oKnJaxkdi9whaL/sqN13afw==}
+
+  baseline-browser-mapping@2.11.19:
+    resolution: {integrity: sha512-Grytf1xOxOEMTGRwx6rLGKkTabd4vMg3VrKdj/7joCmV0qgh4QwMMO6xh34YEXQqirAuUdgQGa5orJQQ+69RBw==}
+    engines: {node: '>=6.0.0'}
+    hasBin: true
+
+  eslint-config-next@16.3.3:
+    resolution: {integrity: sha512-teqtsR26tnlfXFHfVLTM/4tzEzU8DMu6GS1sddZzhfGzgd2f2ofbgDUcsk6cssSCzX6Tk6fmWifJcdANSdPJrw==}
+    peerDependencies:
+      eslint: '>=9.0.0'
+      typescript: '>=3.3.1'
+    peerDependenciesMeta:
+      typescript:
+        optional: true
+
+  nanoid@3.3.18:
+    resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==}
+    engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
+    hasBin: true
+
+  next@16.3.3:
+    resolution: {integrity: sha512-tuRTx1nQ/yVw83cwJBo9F+njGUgMn3UHQycreWHB8XsStvvAh1AthbI8/4IpKnFaF58F+iSiHejYOlMQ/eq83g==}
+    engines: {node: '>=20.9.0'}
+    hasBin: true
+    peerDependencies:
+      '@opentelemetry/api': ^1.1.0
+      '@playwright/test': ^1.51.1
+      babel-plugin-react-compiler: '*'
+      react: ^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0
+      react-dom: ^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0
+      sass: ^1.3.0
+    peerDependenciesMeta:
+      '@opentelemetry/api':
+        optional: true
+      '@playwright/test':
+        optional: true
+      babel-plugin-react-compiler:
+        optional: true
+      sass:
+        optional: true
+
+  postcss@8.5.23:
+    resolution: {integrity: sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==}
+    engines: {node: ^10 || ^12 || >=14}
+
+  semver@7.8.5:
+    resolution: {integrity: sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==}
+    engines: {node: '>=10'}
+    hasBin: true
+
+  sharp@0.35.3:
+    resolution: {integrity: sha512-ej0zVHuZGHCiABXcNxeYhpRnPNPAcvbG8RMdBAhDAxLKkCRVSpK3Iyu7qbqw3JMzoj0REeM6f3tJLtVwl0023Q==}
+    engines: {node: '>=20.9.0'}
+    peerDependencies:
+      '@types/node': '*'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
 snapshots:
 
   '@alloc/quick-lru@5.2.0': {}
@@ -12786,3 +13050,243 @@ snapshots:
   zod@3.25.76: {}
 
   zod@4.3.6: {}
+  '@emnapi/runtime@1.11.3':
+    dependencies:
+      tslib: 2.8.1
+    optional: true
+
+  '@img/colour@1.1.0':
+    optional: true
+
+  '@img/sharp-darwin-arm64@0.35.3':
+    optionalDependencies:
+      '@img/sharp-libvips-darwin-arm64': 1.3.2
+    optional: true
+
+  '@img/sharp-darwin-x64@0.35.3':
+    optionalDependencies:
+      '@img/sharp-libvips-darwin-x64': 1.3.2
+    optional: true
+
+  '@img/sharp-freebsd-wasm32@0.35.3':
+    dependencies:
+      '@img/sharp-wasm32': 0.35.3
+    optional: true
+
+  '@img/sharp-libvips-darwin-arm64@1.3.2':
+    optional: true
+
+  '@img/sharp-libvips-darwin-x64@1.3.2':
+    optional: true
+
+  '@img/sharp-libvips-linux-arm64@1.3.2':
+    optional: true
+
+  '@img/sharp-libvips-linux-arm@1.3.2':
+    optional: true
+
+  '@img/sharp-libvips-linux-ppc64@1.3.2':
+    optional: true
+
+  '@img/sharp-libvips-linux-riscv64@1.3.2':
+    optional: true
+
+  '@img/sharp-libvips-linux-s390x@1.3.2':
+    optional: true
+
+  '@img/sharp-libvips-linux-x64@1.3.2':
+    optional: true
+
+  '@img/sharp-libvips-linuxmusl-arm64@1.3.2':
+    optional: true
+
+  '@img/sharp-libvips-linuxmusl-x64@1.3.2':
+    optional: true
+
+  '@img/sharp-linux-arm64@0.35.3':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-arm64': 1.3.2
+    optional: true
+
+  '@img/sharp-linux-arm@0.35.3':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-arm': 1.3.2
+    optional: true
+
+  '@img/sharp-linux-ppc64@0.35.3':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-ppc64': 1.3.2
+    optional: true
+
+  '@img/sharp-linux-riscv64@0.35.3':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-riscv64': 1.3.2
+    optional: true
+
+  '@img/sharp-linux-s390x@0.35.3':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-s390x': 1.3.2
+    optional: true
+
+  '@img/sharp-linux-x64@0.35.3':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-x64': 1.3.2
+    optional: true
+
+  '@img/sharp-linuxmusl-arm64@0.35.3':
+    optionalDependencies:
+      '@img/sharp-libvips-linuxmusl-arm64': 1.3.2
+    optional: true
+
+  '@img/sharp-linuxmusl-x64@0.35.3':
+    optionalDependencies:
+      '@img/sharp-libvips-linuxmusl-x64': 1.3.2
+    optional: true
+
+  '@img/sharp-wasm32@0.35.3':
+    dependencies:
+      '@emnapi/runtime': 1.11.3
+    optional: true
+
+  '@img/sharp-webcontainers-wasm32@0.35.3':
+    dependencies:
+      '@img/sharp-wasm32': 0.35.3
+    optional: true
+
+  '@img/sharp-win32-arm64@0.35.3':
+    optional: true
+
+  '@img/sharp-win32-ia32@0.35.3':
+    optional: true
+
+  '@img/sharp-win32-x64@0.35.3':
+    optional: true
+
+  '@next/env@16.3.3': {}
+
+  '@next/eslint-plugin-next@16.3.3(eslint@9.39.2(jiti@2.6.1))':
+    dependencies:
+      '@eslint-community/eslint-utils': 4.9.1(eslint@9.39.2(jiti@2.6.1))
+      fast-glob: 3.3.1
+    transitivePeerDependencies:
+      - eslint
+
+  '@next/swc-darwin-arm64@16.3.3':
+    optional: true
+
+  '@next/swc-darwin-x64@16.3.3':
+    optional: true
+
+  '@next/swc-linux-arm64-gnu@16.3.3':
+    optional: true
+
+  '@next/swc-linux-arm64-musl@16.3.3':
+    optional: true
+
+  '@next/swc-linux-x64-gnu@16.3.3':
+    optional: true
+
+  '@next/swc-linux-x64-musl@16.3.3':
+    optional: true
+
+  '@next/swc-win32-arm64-msvc@16.3.3':
+    optional: true
+
+  '@next/swc-win32-x64-msvc@16.3.3':
+    optional: true
+
+  '@swc/helpers@0.5.23':
+    dependencies:
+      tslib: 2.8.1
+
+  baseline-browser-mapping@2.11.19: {}
+
+  eslint-config-next@16.3.3(@typescript-eslint/parser@8.54.0(eslint@9.39.2(jiti@2.6.1))(typescript@5.9.3))(eslint@9.39.2(jiti@2.6.1))(typescript@5.9.3):
+    dependencies:
+      '@next/eslint-plugin-next': 16.3.3(eslint@9.39.2(jiti@2.6.1))
+      eslint: 9.39.2(jiti@2.6.1)
+      eslint-import-resolver-node: 0.3.9
+      eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0)(eslint@9.39.2(jiti@2.6.1))
+      eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.54.0(eslint@9.39.2(jiti@2.6.1))(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.2(jiti@2.6.1))
+      eslint-plugin-jsx-a11y: 6.10.2(eslint@9.39.2(jiti@2.6.1))
+      eslint-plugin-react: 7.37.5(eslint@9.39.2(jiti@2.6.1))
+      eslint-plugin-react-hooks: 7.0.1(eslint@9.39.2(jiti@2.6.1))
+      globals: 16.4.0
+      typescript-eslint: 8.54.0(eslint@9.39.2(jiti@2.6.1))(typescript@5.9.3)
+    optionalDependencies:
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - '@typescript-eslint/parser'
+      - eslint-import-resolver-webpack
+      - eslint-plugin-import-x
+      - supports-color
+
+  nanoid@3.3.18: {}
+
+  next@16.3.3(@babel/core@7.28.6)(@types/node@20.19.30)(react-dom@19.2.3(react@19.2.3))(react@19.2.3):
+    dependencies:
+      '@next/env': 16.3.3
+      '@swc/helpers': 0.5.23
+      baseline-browser-mapping: 2.11.19
+      caniuse-lite: 1.0.30001766
+      postcss: 8.5.23
+      react: 19.2.3
+      react-dom: 19.2.3(react@19.2.3)
+      styled-jsx: 5.1.6(@babel/core@7.28.6)(react@19.2.3)
+    optionalDependencies:
+      '@next/swc-darwin-arm64': 16.3.3
+      '@next/swc-darwin-x64': 16.3.3
+      '@next/swc-linux-arm64-gnu': 16.3.3
+      '@next/swc-linux-arm64-musl': 16.3.3
+      '@next/swc-linux-x64-gnu': 16.3.3
+      '@next/swc-linux-x64-musl': 16.3.3
+      '@next/swc-win32-arm64-msvc': 16.3.3
+      '@next/swc-win32-x64-msvc': 16.3.3
+      sharp: 0.35.3(@types/node@20.19.30)
+    transitivePeerDependencies:
+      - '@babel/core'
+      - '@types/node'
+      - babel-plugin-macros
+
+  postcss@8.5.23:
+    dependencies:
+      nanoid: 3.3.18
+      picocolors: 1.1.1
+      source-map-js: 1.2.1
+
+  semver@7.8.5:
+    optional: true
+
+  sharp@0.35.3(@types/node@20.19.30):
+    dependencies:
+      '@img/colour': 1.1.0
+      detect-libc: 2.1.2
+      semver: 7.8.5
+    optionalDependencies:
+      '@img/sharp-darwin-arm64': 0.35.3
+      '@img/sharp-darwin-x64': 0.35.3
+      '@img/sharp-freebsd-wasm32': 0.35.3
+      '@img/sharp-libvips-darwin-arm64': 1.3.2
+      '@img/sharp-libvips-darwin-x64': 1.3.2
+      '@img/sharp-libvips-linux-arm': 1.3.2
+      '@img/sharp-libvips-linux-arm64': 1.3.2
+      '@img/sharp-libvips-linux-ppc64': 1.3.2
+      '@img/sharp-libvips-linux-riscv64': 1.3.2
+      '@img/sharp-libvips-linux-s390x': 1.3.2
+      '@img/sharp-libvips-linux-x64': 1.3.2
+      '@img/sharp-libvips-linuxmusl-arm64': 1.3.2
+      '@img/sharp-libvips-linuxmusl-x64': 1.3.2
+      '@img/sharp-linux-arm': 0.35.3
+      '@img/sharp-linux-arm64': 0.35.3
+      '@img/sharp-linux-ppc64': 0.35.3
+      '@img/sharp-linux-riscv64': 0.35.3
+      '@img/sharp-linux-s390x': 0.35.3
+      '@img/sharp-linux-x64': 0.35.3
+      '@img/sharp-linuxmusl-arm64': 0.35.3
+      '@img/sharp-linuxmusl-x64': 0.35.3
+      '@img/sharp-webcontainers-wasm32': 0.35.3
+      '@img/sharp-win32-arm64': 0.35.3
+      '@img/sharp-win32-ia32': 0.35.3
+      '@img/sharp-win32-x64': 0.35.3
+      '@types/node': 20.19.30
+    optional: true

package/lib/__templates__/nextjs/scripts/dev.sh

@@ -14,22 +14,42 @@ DEPLOY_RUN_PORT="${DEPLOY_RUN_PORT:-${PORT}}"
 
 cd "${COZE_WORKSPACE_PATH}"
 
+list_port_pids() {
+    local port=$1
+    local pids=""
+    local has_tool=0
+
+    if command -v ss >/dev/null 2>&1; then
+      has_tool=1
+      pids=$(ss -H -lntp 2>/dev/null | awk -v port="${port}" '$4 ~ ":"port"$"' | grep -o 'pid=[0-9]*' | cut -d= -f2 | sort -u | paste -sd' ' - || true)
+    fi
+    if [[ -z "${pids}" ]] && command -v lsof >/dev/null 2>&1; then
+      has_tool=1
+      pids=$(lsof -t -iTCP:"${port}" -sTCP:LISTEN 2>/dev/null | sort -u | paste -sd' ' - || true)
+    fi
+    if [[ "${has_tool}" -eq 0 ]]; then
+      echo "Warning: neither ss nor lsof available, cannot inspect port ${port}." >&2
+    fi
+
+    echo "${pids}"
+}
+
 kill_port_if_listening() {
     local pids
-    pids=$(ss -H -lntp 2>/dev/null | awk -v port="${DEPLOY_RUN_PORT}" '$4 ~ ":"port"$"' | grep -o 'pid=[0-9]*' | cut -d= -f2 | paste -sd' ' - || true)
+    pids=$(list_port_pids "${DEPLOY_RUN_PORT}")
     if [[ -z "${pids}" ]]; then
       echo "Port ${DEPLOY_RUN_PORT} is free."
       return
     fi
     echo "Port ${DEPLOY_RUN_PORT} in use by PIDs: ${pids} (SIGKILL)"
-    echo "${pids}" | xargs -I {} kill -9 {}
+    echo "${pids}" | xargs -I {} kill -9 {} || true
     sleep 1
-    pids=$(ss -H -lntp 2>/dev/null | awk -v port="${DEPLOY_RUN_PORT}" '$4 ~ ":"port"$"' | grep -o 'pid=[0-9]*' | cut -d= -f2 | paste -sd' ' - || true)
+    pids=$(list_port_pids "${DEPLOY_RUN_PORT}")
     if [[ -n "${pids}" ]]; then
-      echo "Warning: port ${DEPLOY_RUN_PORT} still busy after SIGKILL, PIDs: ${pids}"
-    else
-      echo "Port ${DEPLOY_RUN_PORT} cleared."
+      echo "端口 ${DEPLOY_RUN_PORT} 被 PID ${pids} 占用且无法清理（SIGKILL 后仍在监听），dev server 无法启动。" >&2
+      exit 1
     fi
+    echo "Port ${DEPLOY_RUN_PORT} cleared."
 }
 
 <% if (process.env.NODE_ENV === 'test') { %>
@@ -41,11 +61,9 @@ echo "Starting HTTP service on port ${DEPLOY_RUN_PORT} for dev..."
 exec env PORT="${DEPLOY_RUN_PORT}" pnpm tsx watch src/server.ts
 <% } else { %>
 LOG_DIR="${COZE_LOG_DIR:-${COZE_WORKSPACE_PATH}/logs}"
-LOG_FILE="${LOG_DIR}/server.log"
+LOG_FILE="${LOG_DIR}/app.log"
 PID_FILE="${LOG_DIR}/server.pid"
 
-# coze-daemon 会在 runtime shell 退出时清理原进程组。
-# 通过 Node detached spawn 创建独立 session/进程组，并将 stdio 直接写入日志。
 spawn_detached() {
   local cwd="$1"
   local log_file="$2"
@@ -87,6 +105,89 @@ stop_detached() {
   kill -KILL -- "-${pid}" 2>/dev/null || true
 }
 
+READY_RETRIES=10
+READY_PROBE_HOSTS=("127.0.0.1" "::1")
+LOG_TAIL_LINES=40
+
+dump_log() {
+  echo "---- tail -n ${LOG_TAIL_LINES} ${LOG_FILE} ----" >&2
+  tail -n "${LOG_TAIL_LINES}" "${LOG_FILE}" >&2 || true
+  echo "---- end of ${LOG_FILE} ----" >&2
+}
+
+# 仅用于无 ss/lsof 时的兜底探测。服务可能只 bind IPv4 loopback、只 bind IPv6 loopback
+# （server.listen(port, 'localhost') 会变成 ::1 独占），或 bind 双栈通配地址，
+port_connectable() {
+  local port=$1
+  local host
+  for host in "${READY_PROBE_HOSTS[@]}"; do
+    if command -v nc >/dev/null 2>&1; then
+      if nc -z -w 1 "${host}" "${port}" >/dev/null 2>&1; then
+        return 0
+      fi
+    elif (exec 3<>"/dev/tcp/${host}/${port}") >/dev/null 2>&1; then
+      return 0
+    fi
+  done
+  return 1
+}
+
+port_probe_available() {
+  command -v ss >/dev/null 2>&1 || command -v lsof >/dev/null 2>&1
+}
+
+# 端口监听者是否属于本进程组：spawn detached 后 PID == PGID，子孙进程继承该 PGID。
+#   0 = 是；1 = 不是（无人监听，或监听者不属于本进程组）；2 = 无探测工具，无法判断
+port_listened_by_pgid() {
+  local port=$1 pgid=$2
+  local listener owner
+
+  if ! port_probe_available; then
+    return 2
+  fi
+
+  for listener in $(list_port_pids "${port}" 2>/dev/null); do
+    owner=$(ps -o pgid= -p "${listener}" 2>/dev/null | tr -d ' ')
+    if [[ "${owner}" == "${pgid}" ]]; then
+      return 0
+    fi
+  done
+  return 1
+}
+
+wait_for_ready() {
+  local pid=$1 port=$2
+  local attempt=0 owned
+
+  if ! port_probe_available; then
+    echo "Warning: 缺少 ss 与 lsof，无法确认端口监听者归属，仅按 loopback 可连接性判断就绪。" >&2
+  fi
+
+  while [[ "${attempt}" -lt "${READY_RETRIES}" ]]; do
+    if ! kill -0 "${pid}" 2>/dev/null; then
+      echo "Dev server 进程在启动过程中退出。" >&2
+      return 1
+    fi
+
+    if port_listened_by_pgid "${port}" "${pid}"; then
+      owned=0
+    else
+      owned=$?
+    fi
+    if [[ "${owned}" -eq 0 ]]; then
+      return 0
+    fi
+    if [[ "${owned}" -eq 2 ]] && port_connectable "${port}"; then
+      return 0
+    fi
+
+    sleep 1
+    attempt=$((attempt + 1))
+  done
+
+  return 2
+}
+
 # 监听端口的是孙进程（pnpm -> tsx -> node），只清端口会漏掉上层 pnpm/tsx，
 # 所以先按上次记录的 PID 把整个进程组回收掉。
 if [[ -f "${PID_FILE}" ]]; then
@@ -104,17 +205,33 @@ mkdir -p "${LOG_DIR}"
 export PORT="${DEPLOY_RUN_PORT}"
 server_pid="$(spawn_detached "${COZE_WORKSPACE_PATH}" "${LOG_FILE}" \
   "$(command -v pnpm)" tsx watch src/server.ts)"
+if [[ -z "${server_pid}" ]]; then
+  echo "Dev server failed to start: 未获取到后台进程 PID。" >&2
+  dump_log
+  exit 1
+fi
 echo "${server_pid}" > "${PID_FILE}"
 
-sleep 1
-if [[ -z "${server_pid}" ]] || ! kill -0 "${server_pid}" 2>/dev/null; then
+if wait_for_ready "${server_pid}" "${DEPLOY_RUN_PORT}"; then
+  ready_status=0
+else
+  ready_status=$?
+fi
+
+if [[ "${ready_status}" -eq 2 ]]; then
+  # 进程还活着但迟迟没监听端口：多半是编译/运行时报错后 tsx watch 驻留，日志里有真正原因。
+  echo "Dev server 在 ${READY_RETRIES} 次探测（每次 1s）内未就绪于端口 ${DEPLOY_RUN_PORT}（进程 ${server_pid} 仍在运行）。" >&2
+  dump_log
+  exit 1
+elif [[ "${ready_status}" -ne 0 ]]; then
   echo "Dev server failed to start. See ${LOG_FILE}." >&2
-  tail -n 20 "${LOG_FILE}" >&2 || true
+  dump_log
+  stop_detached "${server_pid}"
   rm -f "${PID_FILE}"
   exit 1
 fi
 
-echo "Dev server started (PID: ${server_pid})."
+echo "Dev server started (PID: ${server_pid}), listening on port ${DEPLOY_RUN_PORT}."
 echo "Log file: ${LOG_FILE}"
 echo "PID file: ${PID_FILE}"
 <% } %>

package/lib/cli.js

@@ -23,9 +23,9 @@ var Ajv = require('ajv');
 var minimist = require('minimist');
 var changeCase = require('change-case');
 var ejs = require('ejs');
-var node_crypto = require('node:crypto');
 var node_os = require('node:os');
 var promises = require('node:fs/promises');
+var node_crypto = require('node:crypto');
 var node_child_process = require('node:child_process');
 var node_util = require('node:util');
 var tar = require('tar');
@@ -2114,7 +2114,7 @@ const EventBuilder = {
 };
 
 var name = "@coze-arch/cli";
-var version = "0.0.36-alpha.75f808";
+var version = "0.0.36-alpha.80ccd6";
 var description = "coze coding devtools cli";
 var license = "MIT";
 var author = "fanwenjie.fe@bytedance.com";
@@ -10467,7 +10467,6 @@ const withRequestedApplicationType = (
 };
 
 function _optionalChain$b(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
-
 const DEFAULT_CONFIG = {
   apiBaseUrl: 'https://code.coze.cn/',
   openApiBaseUrl: 'https://api.coze.cn',
@@ -10479,6 +10478,11 @@ const getSharedConfigPath = () =>
 
 const getLegacyConfigPath = () => node_path.join(node_os.homedir(), '.coze', 'config.json');
 
+const getDesktopRuntimePaths = () => [
+  node_path.join(node_os.homedir(), '.coze', 'desktop', 'runtime.beta.json'),
+  node_path.join(node_os.homedir(), '.coze', 'desktop', 'runtime.json'),
+];
+
 const isRecord$3 = (value) =>
   typeof value === 'object' && value !== null && !Array.isArray(value);
 
@@ -10494,6 +10498,23 @@ const readJson = async (path) => {
   }
 };
 
+const readDesktopAccessToken = async () => {
+  for (const path of getDesktopRuntimePaths()) {
+    try {
+      const runtime = safeJsonParse(await promises.readFile(path, 'utf8'), undefined);
+      if (!isRecord$3(runtime) || !isRecord$3(runtime.patToken)) {
+        continue;
+      }
+      const {accessToken} = runtime.patToken;
+      if (typeof accessToken === 'string' && accessToken.trim()) {
+        return accessToken.trim();
+      }
+    } catch (error) {
+    }
+  }
+  return undefined;
+};
+
 const configuredPath = (options) =>
   _optionalChain$b([options, 'optionalAccess', _ => _.config]) || process.env.COZE_CONFIG_FILE;
 
@@ -10502,15 +10523,17 @@ const loadConfig = async (options = {}) => {
   const globalConfig = customPath
     ? await readJson(node_path.resolve(customPath))
     : (await readJson(getSharedConfigPath())) || (await readJson(getLegacyConfigPath()));
+  const desktopAccessToken = await readDesktopAccessToken();
   const environmentAccessToken = process.env.COZE_API_TOKEN;
+  const fixedAccessToken = desktopAccessToken || environmentAccessToken;
   const config = {
     ...DEFAULT_CONFIG,
     ...globalConfig,
-    ...(environmentAccessToken
+    ...(fixedAccessToken
       ? {
-          accessToken: environmentAccessToken,
-          // COZE_API_TOKEN is a fixed runtime credential. Never combine it with
-          // refresh metadata left by an earlier OAuth login in config.json.
+          accessToken: fixedAccessToken,
+          // Desktop PAT and COZE_API_TOKEN are fixed runtime credentials. Never
+          // combine them with refresh metadata from an earlier OAuth login.
           refreshToken: undefined,
           tokenExpiresAt: undefined,
         }
@@ -10524,7 +10547,7 @@ const loadConfig = async (options = {}) => {
     ...(options.apiBaseUrl ? { apiBaseUrl: options.apiBaseUrl } : {}),
     // Runtime-only trust decision: a value persisted in config.json must never enable
     // project-secret injection for an OAuth access token.
-    injectApiToken: Boolean(environmentAccessToken),
+    injectApiToken: Boolean(fixedAccessToken),
   };
   return config;
 };
@@ -11250,6 +11273,7 @@ class DeployApiClient {
 
 
 
+
 ) {
     return this.post
 
@@ -12269,6 +12293,7 @@ const MINI_PROGRAM_BUILD_OUTPUT_DIRS = {
 
 
 
+
 const resolveConnectorId = (platform) => {
   const connectorId = CONNECTOR_IDS[platform ];
   if (!connectorId) {
@@ -12393,6 +12418,7 @@ const registerPreviewCommand = (miniProgram) => {
     .requiredOption('--mini-app-id <miniAppId>', 'Mini-program AppID')
     .option('--project-id <projectId>', 'Deployment Project ID')
     .option('--source-root <sourceRoot>', 'Directory containing dist or dist-tt', '.')
+    .option('--server-url <serverUrl>', 'Public HTTPS server URL to whitelist for this preview')
     .action(async (options, command) => {
       const runtime = await getRuntime(command);
       const projectId = await resolveProjectId(command, options);
@@ -12422,6 +12448,7 @@ const registerPreviewCommand = (miniProgram) => {
           app_id: options.miniAppId || '',
           connector_id: resolveConnectorId(options.platform),
           source_package_base64: content.toString('base64'),
+          ...(options.serverUrl ? { server_url: options.serverUrl } : {}),
         });
         if (data.failed) {
           throw new CliError(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coze-arch/cli",
-  "version": "0.0.36-alpha.75f808",
+  "version": "0.0.36-alpha.80ccd6",
   "private": false,
   "description": "coze coding devtools cli",
   "license": "MIT",