@coze-arch/cli 0.1.5 → 0.1.8-alpha.4500b5

package/lib/__templates__/nuxt-vue/scripts/prepare-node-modules.sh

@@ -0,0 +1,212 @@
+#!/usr/bin/env bash
+# Install dependencies on local disk and expose them to the source tree by symlink.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+if [ "$(basename "$(dirname "$SCRIPT_DIR")")" = ".cozeproj" ]; then
+  PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd -P)"
+else
+  PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+fi
+
+command -v pnpm >/dev/null 2>&1 || {
+  echo "[node_modules] pnpm is required" >&2
+  exit 1
+}
+
+DRIVE_ROOT="${COZE_DRIVE_ROOT:-/Coze/Drive}"
+if [ -d "$DRIVE_ROOT" ]; then
+  DRIVE_ROOT="$(cd "$DRIVE_ROOT" && pwd -P)"
+else
+  DRIVE_ROOT="${DRIVE_ROOT%/}"
+fi
+case "$PROJECT_ROOT" in
+  "$DRIVE_ROOT"|"$DRIVE_ROOT"/*) ;;
+  *)
+    (cd "$PROJECT_ROOT" && pnpm install "$@")
+    exit 0
+    ;;
+esac
+
+NM_ROOT="/tmp/nm"
+PROJECT_ID="$(basename "$PROJECT_ROOT")-$(printf '%s' "$PROJECT_ROOT" | cksum | awk '{print $1}')"
+mkdir -p "$NM_ROOT"
+WORK_DIR="$NM_ROOT/$PROJECT_ID"
+case "$WORK_DIR" in
+  "$DRIVE_ROOT"|"$DRIVE_ROOT"/*)
+    echo "[node_modules] local dependency directory must not be on Coze Drive: $WORK_DIR" >&2
+    exit 1
+    ;;
+esac
+
+LOCK_DIR="$NM_ROOT/$PROJECT_ID.lock"
+LOCK_TIMEOUT_SECONDS="${COZE_NODE_MODULES_LOCK_TIMEOUT_SECONDS:-120}"
+case "$LOCK_TIMEOUT_SECONDS" in
+  ''|*[!0-9]*|0)
+    echo "[node_modules] COZE_NODE_MODULES_LOCK_TIMEOUT_SECONDS must be a positive integer" >&2
+    exit 1
+    ;;
+esac
+
+lock_owner_is_alive() {
+  local owner_pid=""
+  [ -f "$LOCK_DIR/pid" ] || return 1
+  IFS= read -r owner_pid < "$LOCK_DIR/pid" || return 1
+  case "$owner_pid" in
+    ''|*[!0-9]*) return 1 ;;
+  esac
+  kill -0 "$owner_pid" 2>/dev/null
+}
+
+release_lock() {
+  local owner_pid=""
+  [ -f "$LOCK_DIR/pid" ] || return 0
+  IFS= read -r owner_pid < "$LOCK_DIR/pid" || true
+  if [ "$owner_pid" = "$$" ]; then
+    rm -f "$LOCK_DIR/pid"
+    rmdir "$LOCK_DIR" 2>/dev/null || true
+  fi
+}
+
+lock_started_at="$(date +%s)"
+missing_owner_checks=0
+while ! mkdir "$LOCK_DIR" 2>/dev/null; do
+  if lock_owner_is_alive; then
+    missing_owner_checks=0
+  else
+    missing_owner_checks=$((missing_owner_checks + 1))
+    if [ "$missing_owner_checks" -ge 2 ]; then
+      stale_lock_dir="$LOCK_DIR.stale.$$"
+      if mv "$LOCK_DIR" "$stale_lock_dir" 2>/dev/null; then
+        echo "[node_modules] Recovering stale dependency preparation lock."
+        rm -rf "$stale_lock_dir"
+      fi
+      missing_owner_checks=0
+      continue
+    fi
+  fi
+
+  lock_now="$(date +%s)"
+  if [ $((lock_now - lock_started_at)) -ge "$LOCK_TIMEOUT_SECONDS" ]; then
+    echo "[node_modules] Timed out waiting ${LOCK_TIMEOUT_SECONDS}s for dependency preparation lock: $LOCK_DIR" >&2
+    exit 1
+  fi
+  echo "[node_modules] Waiting for another dependency preparation for this project..."
+  sleep 1
+done
+printf '%s\n' "$$" > "$LOCK_DIR/pid"
+trap release_lock EXIT
+
+mkdir -p "$WORK_DIR"
+
+# Previous versions mirrored the whole project into WORK_DIR. That gives pnpm
+# and framework dev servers two paths for the same source tree, which breaks
+# file watching and on-demand compilation. Keep only managed local outputs.
+cleanup_legacy_workspace() {
+  local workspace_dir="$1" entry name
+  if [ -L "$workspace_dir" ] || { [ -e "$workspace_dir" ] && [ ! -d "$workspace_dir" ]; }; then
+    rm -rf "$workspace_dir"
+    return
+  fi
+  if [ ! -d "$workspace_dir" ]; then
+    return 0
+  fi
+
+  while IFS= read -r -d '' entry; do
+    name="$(basename "$entry")"
+    [ "$name" = "node_modules" ] || rm -rf "$entry"
+  done < <(find "$workspace_dir" -mindepth 1 -maxdepth 1 -print0)
+}
+
+cleanup_legacy_shadow_project() {
+  local entry name
+  while IFS= read -r -d '' entry; do
+    name="$(basename "$entry")"
+    case "$name" in
+      node_modules|client|server) continue ;;
+    esac
+    rm -rf "$entry"
+  done < <(find "$WORK_DIR" -mindepth 1 -maxdepth 1 -print0)
+
+  for workspace in client server; do
+    cleanup_legacy_workspace "$WORK_DIR/$workspace"
+  done
+}
+
+link_install_entry() {
+  local source_path="$1" target_path="$2"
+  rm -rf "$target_path"
+  if [ -e "$source_path" ]; then
+    ln -s "$source_path" "$target_path"
+  fi
+}
+
+copy_install_metadata() {
+  local filename source_file target_file workspace
+  for filename in pnpm-lock.yaml pnpm-workspace.yaml .npmrc; do
+    source_file="$PROJECT_ROOT/$filename"
+    target_file="$WORK_DIR/$filename"
+    rm -f "$target_file"
+    if [ -f "$source_file" ]; then
+      cp "$source_file" "$target_file"
+    fi
+  done
+
+  link_install_entry "$PROJECT_ROOT/package.json" "$WORK_DIR/package.json"
+  link_install_entry "$PROJECT_ROOT/patches" "$WORK_DIR/patches"
+  link_install_entry "$PROJECT_ROOT/scripts" "$WORK_DIR/scripts"
+
+  for workspace in client server; do
+    if [ -f "$PROJECT_ROOT/$workspace/package.json" ]; then
+      mkdir -p "$WORK_DIR/$workspace"
+      link_install_entry "$PROJECT_ROOT/$workspace/package.json" "$WORK_DIR/$workspace/package.json"
+      link_install_entry "$PROJECT_ROOT/$workspace/scripts" "$WORK_DIR/$workspace/scripts"
+    else
+      rm -rf "$WORK_DIR/$workspace"
+    fi
+  done
+}
+
+link_node_modules() {
+  local source_dir="$1" target_dir="$2"
+  local current=""
+  mkdir -p "$target_dir"
+  if [ -L "$source_dir/node_modules" ]; then
+    current="$(readlink "$source_dir/node_modules")"
+    case "$current" in
+      "$NM_ROOT"/*/node_modules|"$NM_ROOT"/*/*/node_modules) ;;
+      *)
+        echo "[node_modules] refusing to replace unmanaged symlink: $source_dir/node_modules" >&2
+        exit 1
+        ;;
+    esac
+    rm "$source_dir/node_modules"
+  elif [ -e "$source_dir/node_modules" ]; then
+    rm -rf "$source_dir/node_modules"
+  fi
+  ln -s "$target_dir" "$source_dir/node_modules"
+}
+
+cleanup_legacy_shadow_project
+copy_install_metadata
+
+echo "[node_modules] Installing dependencies in $WORK_DIR"
+if ! (cd "$WORK_DIR" && pnpm install "$@"); then
+  exit 1
+fi
+
+if [ -f "$WORK_DIR/pnpm-lock.yaml" ]; then
+  temporary_lockfile="$(mktemp "$PROJECT_ROOT/.pnpm-lock.yaml.XXXXXX")"
+  cp "$WORK_DIR/pnpm-lock.yaml" "$temporary_lockfile"
+  chmod 0644 "$temporary_lockfile"
+  mv -f "$temporary_lockfile" "$PROJECT_ROOT/pnpm-lock.yaml"
+fi
+
+link_node_modules "$PROJECT_ROOT" "$WORK_DIR/node_modules"
+for workspace in client server; do
+  if [ -f "$PROJECT_ROOT/$workspace/package.json" ]; then
+    link_node_modules "$PROJECT_ROOT/$workspace" "$WORK_DIR/$workspace/node_modules"
+  fi
+done
+
+echo "[node_modules] Dependencies ready"

package/lib/__templates__/nuxt-vue/scripts/prepare.sh

@@ -6,10 +6,7 @@ COZE_WORKSPACE_PATH="${COZE_WORKSPACE_PATH:-$(pwd)}"
 cd "${COZE_WORKSPACE_PATH}"
 
 echo "Installing dependencies..."
-pnpm install --prefer-frozen-lockfile --prefer-offline
-if command -v coze-dev > /dev/null 2>&1 && coze-dev check-bins --help > /dev/null 2>&1; then
-  coze-dev check-bins --fix
-fi
+bash "$COZE_WORKSPACE_PATH/scripts/prepare-node-modules.sh" --prefer-frozen-lockfile --prefer-offline
 
 echo "Preparing Nuxt project..."
 pnpm exec nuxt prepare

package/lib/__templates__/pi-agent/package.json

@@ -22,7 +22,7 @@
     "@mariozechner/pi-ai": "^0.63.2",
     "@mariozechner/pi-coding-agent": "^0.63.2",
     "@sinclair/typebox": "^0.34.48",
-    "coze-coding-dev-sdk": "^0.7.28",
+    "coze-coding-dev-sdk": "^0.7.30",
     "@radix-ui/react-select": "^2.2.6",
     "@radix-ui/react-slot": "^1.2.4",
     "@streamdown/code": "^1.1.1",

package/lib/__templates__/pi-agent/pnpm-lock.yaml

@@ -36,8 +36,8 @@ importers:
         specifier: ^2.1.1
         version: 2.1.1
       coze-coding-dev-sdk:
-        specifier: ^0.7.28
-        version: 0.7.28(openai@6.34.0(ws@8.20.0)(zod@4.3.6))(ws@8.20.0)
+        specifier: ^0.7.30
+        version: 0.7.30(openai@6.34.0(ws@8.20.0)(zod@4.3.6))(ws@8.20.0)
       express:
         specifier: ^4.21.2
         version: 4.22.1
@@ -2085,8 +2085,8 @@ packages:
   cose-base@2.2.0:
     resolution: {integrity: sha512-AzlgcsCbUMymkADOJtQm3wO9S3ltPfYOFD5033keQn9NJzIbtnZj+UdBJe7DYml/8TdbtHJW3j58SOnKhWY/5g==}
 
-  coze-coding-dev-sdk@0.7.28:
-    resolution: {integrity: sha512-ku7AiVWUmgCrUuMT1m2iTmHIwG39EfmcAhPASd8M7XyKxIC6A1cjIIe/3YpStRsj8pMF9LU+pxHWxisf+F44oQ==}
+  coze-coding-dev-sdk@0.7.30:
+    resolution: {integrity: sha512-BhyMFh7zZPFeN9VRxvqPJ5NS8WO+MJD/bVdzXkuJivCgvc4e2BnpT895rGodLV0TvgJUYYk2O0XJOZSU1OFRyA==}
     engines: {node: '>=18.0.0'}
     hasBin: true
 
@@ -6120,7 +6120,7 @@ snapshots:
     dependencies:
       layout-base: 2.0.1
 
-  coze-coding-dev-sdk@0.7.28(openai@6.34.0(ws@8.20.0)(zod@4.3.6))(ws@8.20.0):
+  coze-coding-dev-sdk@0.7.30(openai@6.34.0(ws@8.20.0)(zod@4.3.6))(ws@8.20.0):
     dependencies:
       '@langchain/core': 1.1.40(openai@6.34.0(ws@8.20.0)(zod@4.3.6))(ws@8.20.0)
       '@langchain/openai': 1.4.3(@langchain/core@1.1.40(openai@6.34.0(ws@8.20.0)(zod@4.3.6))(ws@8.20.0))(ws@8.20.0)

package/lib/__templates__/taro/.cozeproj/scripts/deploy_build.sh

@@ -1,6 +1,10 @@
 #!/bin/bash
 set -Eeuo pipefail
 
+ROOT_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
+COZE_WORKSPACE_PATH="${COZE_WORKSPACE_PATH:-${ROOT_DIR}}"
+export COZE_WORKSPACE_PATH
+
 cd "${COZE_WORKSPACE_PATH}"
 if [ -f "./.cozeproj/scripts/init_env.sh" ]; then
     echo "⚙️ Initializing environment..."
@@ -11,7 +15,7 @@ else
 fi
 echo "Installing dependencies..."
 # 安装所有依赖（包含 Taro 核心和 React）
-pnpm install
+bash "$ROOT_DIR/.cozeproj/scripts/prepare-node-modules.sh" --prefer-frozen-lockfile --prefer-offline
 
 echo "Building the Taro project..."
 pnpm build

package/lib/__templates__/taro/.cozeproj/scripts/deploy_run.sh

@@ -1,6 +1,10 @@
 #!/bin/bash
 set -Eeuo pipefail
 
+ROOT_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
+COZE_WORKSPACE_PATH="${COZE_WORKSPACE_PATH:-${ROOT_DIR}}"
+export COZE_WORKSPACE_PATH
+
 start_service() {
     cd "${COZE_WORKSPACE_PATH}/server/dist"
 

package/lib/__templates__/taro/.cozeproj/scripts/dev_build.sh

@@ -1,2 +1,5 @@
 #!/bin/bash
 set -Eeuo pipefail
+
+ROOT_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
+bash "$ROOT_DIR/.cozeproj/scripts/prepare-node-modules.sh" --prefer-frozen-lockfile --prefer-offline

package/lib/__templates__/taro/.cozeproj/scripts/dev_run.ps1

@@ -28,7 +28,9 @@ function Start-DevProcess([string] $workingDirectory, [string] $logFile, [hashta
   }
 }
 
-$workspace = if ($env:COZE_WORKSPACE_PATH) { $env:COZE_WORKSPACE_PATH } else { (Get-Location).Path }
+$projectRoot = (Resolve-Path (Join-Path $PSScriptRoot "../..")).Path
+$workspace = if ($env:COZE_WORKSPACE_PATH) { $env:COZE_WORKSPACE_PATH } else { $projectRoot }
+$env:COZE_WORKSPACE_PATH = $workspace
 $port = if ($env:DEPLOY_RUN_PORT) { [int] $env:DEPLOY_RUN_PORT } elseif ($env:PORT) { [int] $env:PORT } else { <%= port %> }
 $serverPort = if ($env:SERVER_PORT) { [int] $env:SERVER_PORT } else { <%= serverPort %> }
 $logDirectory = if ($env:COZE_LOG_DIR) { $env:COZE_LOG_DIR } else { Join-Path $workspace "logs" }
@@ -43,7 +45,7 @@ if (Test-Path $pidFile) {
 Stop-ListeningProcess $port
 Stop-ListeningProcess $serverPort
 
-$environment = @{ PORT = "$port"; SERVER_PORT = "$serverPort" }
+$environment = @{ COZE_WORKSPACE_PATH = $workspace; PORT = "$port"; SERVER_PORT = "$serverPort" }
 if ($env:COZE_PROJECT_DOMAIN_DEFAULT) {
   $environment.PROJECT_DOMAIN = $env:COZE_PROJECT_DOMAIN_DEFAULT
 }

package/lib/__templates__/taro/.cozeproj/scripts/dev_run.sh

@@ -4,6 +4,7 @@ set -Eeuo pipefail
 
 ROOT_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
 COZE_WORKSPACE_PATH="${COZE_WORKSPACE_PATH:-${ROOT_DIR}}"
+export COZE_WORKSPACE_PATH
 cd "${COZE_WORKSPACE_PATH}"
 
 # ---------------------------------------------------------
@@ -31,11 +32,15 @@ kill_process_tree() {
 }
 
 # detached 出去的进程没人负责回收，超过这个时长就自己退出，避免端口与内存长期泄露。
-MAX_RUNTIME_SECONDS=1200
+MAX_RUNTIME_SECONDS=3600
+
+timeout_watchdog_enabled() {
+    [[ -z "${COZE_EVAL:-}" && -z "${COZE_PROJECT_TYPE:-}" ]]
+}
 
 # 真正被 detach 的是这层 bash wrapper：它是进程组 leader，组内 watchdog 到点回收整组
 # （wrapper -> pnpm -> taro/nest）；被包的进程自己先退出时也顺手清空进程组，不留残余。
-RUN_WITH_TIMEOUT='
+RUN_WITH_TIMEOUT="$(declare -f timeout_watchdog_enabled)"'
 timeout_seconds=$1
 shift
 
@@ -43,6 +48,7 @@ shift
 child_pid=$!
 
 # 先忽略 TERM，才能在向整组发 TERM（自己也在组里）之后存活下来补一发 KILL。
+if timeout_watchdog_enabled; then
 ( trap "" TERM
   sleep "${timeout_seconds}"
   echo "[dev] 后台进程运行超过 ${timeout_seconds}s，回收进程组 $$。"
@@ -50,6 +56,7 @@ child_pid=$!
   sleep 5
   kill -KILL -- "-$$" 2>/dev/null || true
 ) &
+fi
 
 wait "${child_pid}"
 kill -KILL -- "-$$" 2>/dev/null || true
@@ -155,12 +162,24 @@ list_port_pids() {
 
 kill_port_if_listening() {
     local port=$1
+    # 用于错误提示的端口环境变量名称，例如 DEPLOY_RUN_PORT 或 SERVER_PORT。
+    local port_env_name=$2
     local pids
+    local pid
     pids=$(list_port_pids "${port}")
     if [[ -z "${pids}" ]]; then
         echo "Port ${port} is free."
         return
     fi
+
+    # 端口可能由另一个项目占用。必须在杀进程前校验全部 PID，避免清理到一半才发现外部进程。
+    for pid in ${pids}; do
+        if ! process_belongs_to_workspace "${pid}"; then
+            echo "Error: port ${port} is occupied by PID ${pid}, which does not belong to workspace ${COZE_WORKSPACE_PATH}. Refusing to kill it. Set ${port_env_name} to another port and retry." >&2
+            return 1
+        fi
+    done
+
     echo "Port ${port} in use by PIDs: ${pids} (SIGKILL)"
     for pid in ${pids}; do
         kill_process_tree "${pid}"
@@ -168,7 +187,8 @@ kill_port_if_listening() {
     sleep 1
     pids=$(list_port_pids "${port}")
     if [[ -n "${pids}" ]]; then
-        echo "Warning: port ${port} still busy after SIGKILL, PIDs: ${pids}"
+        echo "Error: port ${port} is still occupied after cleaning up this project's processes, PIDs: ${pids}. Check the remaining processes manually or set ${port_env_name} to another port and retry." >&2
+        return 1
     else
         echo "Port ${port} cleared."
     fi
@@ -194,7 +214,7 @@ cleanup_previous_run() {
 # ---------------------------------------------------------
 echo "📦 Installing dependencies..."
 PNPM_BIN="$(command -v pnpm)"
-"${PNPM_BIN}" install
+bash "$ROOT_DIR/.cozeproj/scripts/prepare-node-modules.sh" --prefer-frozen-lockfile --prefer-offline
 echo "✅ Dependencies installed successfully!"
 
 # ---------------------------------------------------------
@@ -210,9 +230,9 @@ mkdir -p "${LOG_DIR}"
 cleanup_previous_run
 
 echo "Clearing port ${PORT} (web) before start."
-kill_port_if_listening "${PORT}"
+kill_port_if_listening "${PORT}" "DEPLOY_RUN_PORT"
 echo "Clearing port ${SERVER_PORT} (server) before start."
-kill_port_if_listening "${SERVER_PORT}"
+kill_port_if_listening "${SERVER_PORT}" "SERVER_PORT"
 
 # ---------------------------------------------------------
 # 4. 启动服务
@@ -252,7 +272,9 @@ start_service() {
     fi
 
     echo "📝 Dev process started with PID: ${DEV_PID}"
-    echo "Auto stop after ${MAX_RUNTIME_SECONDS}s."
+    if timeout_watchdog_enabled; then
+        echo "Auto stop after ${MAX_RUNTIME_SECONDS}s."
+    fi
     echo "Log file: ${LOG_FILE}"
     echo "PID file: ${PID_FILE}"
 }

package/lib/__templates__/taro/.cozeproj/scripts/init_env.sh

@@ -1,5 +1,9 @@
 #!/bin/bash
 
+ROOT_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
+COZE_WORKSPACE_PATH="${COZE_WORKSPACE_PATH:-${ROOT_DIR}}"
+export COZE_WORKSPACE_PATH
+
 cd "${COZE_WORKSPACE_PATH}"
 
 echo "✅ 初始化完成"

package/lib/__templates__/taro/.cozeproj/scripts/pack.ps1

@@ -1,6 +1,8 @@
 $ErrorActionPreference = "Stop"
 
-$workspace = if ($env:COZE_WORKSPACE_PATH) { $env:COZE_WORKSPACE_PATH } else { (Get-Location).Path }
+$projectRoot = (Resolve-Path (Join-Path $PSScriptRoot "../..")).Path
+$workspace = if ($env:COZE_WORKSPACE_PATH) { $env:COZE_WORKSPACE_PATH } else { $projectRoot }
+$env:COZE_WORKSPACE_PATH = $workspace
 Set-Location $workspace
 
 & pnpm build:pack

package/lib/__templates__/taro/.cozeproj/scripts/pack.sh

@@ -1,3 +1,11 @@
+#!/bin/bash
+
+ROOT_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
+COZE_WORKSPACE_PATH="${COZE_WORKSPACE_PATH:-${ROOT_DIR}}"
+export COZE_WORKSPACE_PATH
+
+cd "${COZE_WORKSPACE_PATH}"
+
 # build_weapp.sh - 通过 PID 文件精确杀掉自己上次的构建进程
 PID_FILE="/tmp/coze-build_weapp.pid"
 

package/lib/__templates__/taro/.cozeproj/scripts/prepare-node-modules.sh

@@ -0,0 +1,212 @@
+#!/usr/bin/env bash
+# Install dependencies on local disk and expose them to the source tree by symlink.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+if [ "$(basename "$(dirname "$SCRIPT_DIR")")" = ".cozeproj" ]; then
+  PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd -P)"
+else
+  PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+fi
+
+command -v pnpm >/dev/null 2>&1 || {
+  echo "[node_modules] pnpm is required" >&2
+  exit 1
+}
+
+DRIVE_ROOT="${COZE_DRIVE_ROOT:-/Coze/Drive}"
+if [ -d "$DRIVE_ROOT" ]; then
+  DRIVE_ROOT="$(cd "$DRIVE_ROOT" && pwd -P)"
+else
+  DRIVE_ROOT="${DRIVE_ROOT%/}"
+fi
+case "$PROJECT_ROOT" in
+  "$DRIVE_ROOT"|"$DRIVE_ROOT"/*) ;;
+  *)
+    (cd "$PROJECT_ROOT" && pnpm install "$@")
+    exit 0
+    ;;
+esac
+
+NM_ROOT="/tmp/nm"
+PROJECT_ID="$(basename "$PROJECT_ROOT")-$(printf '%s' "$PROJECT_ROOT" | cksum | awk '{print $1}')"
+mkdir -p "$NM_ROOT"
+WORK_DIR="$NM_ROOT/$PROJECT_ID"
+case "$WORK_DIR" in
+  "$DRIVE_ROOT"|"$DRIVE_ROOT"/*)
+    echo "[node_modules] local dependency directory must not be on Coze Drive: $WORK_DIR" >&2
+    exit 1
+    ;;
+esac
+
+LOCK_DIR="$NM_ROOT/$PROJECT_ID.lock"
+LOCK_TIMEOUT_SECONDS="${COZE_NODE_MODULES_LOCK_TIMEOUT_SECONDS:-120}"
+case "$LOCK_TIMEOUT_SECONDS" in
+  ''|*[!0-9]*|0)
+    echo "[node_modules] COZE_NODE_MODULES_LOCK_TIMEOUT_SECONDS must be a positive integer" >&2
+    exit 1
+    ;;
+esac
+
+lock_owner_is_alive() {
+  local owner_pid=""
+  [ -f "$LOCK_DIR/pid" ] || return 1
+  IFS= read -r owner_pid < "$LOCK_DIR/pid" || return 1
+  case "$owner_pid" in
+    ''|*[!0-9]*) return 1 ;;
+  esac
+  kill -0 "$owner_pid" 2>/dev/null
+}
+
+release_lock() {
+  local owner_pid=""
+  [ -f "$LOCK_DIR/pid" ] || return 0
+  IFS= read -r owner_pid < "$LOCK_DIR/pid" || true
+  if [ "$owner_pid" = "$$" ]; then
+    rm -f "$LOCK_DIR/pid"
+    rmdir "$LOCK_DIR" 2>/dev/null || true
+  fi
+}
+
+lock_started_at="$(date +%s)"
+missing_owner_checks=0
+while ! mkdir "$LOCK_DIR" 2>/dev/null; do
+  if lock_owner_is_alive; then
+    missing_owner_checks=0
+  else
+    missing_owner_checks=$((missing_owner_checks + 1))
+    if [ "$missing_owner_checks" -ge 2 ]; then
+      stale_lock_dir="$LOCK_DIR.stale.$$"
+      if mv "$LOCK_DIR" "$stale_lock_dir" 2>/dev/null; then
+        echo "[node_modules] Recovering stale dependency preparation lock."
+        rm -rf "$stale_lock_dir"
+      fi
+      missing_owner_checks=0
+      continue
+    fi
+  fi
+
+  lock_now="$(date +%s)"
+  if [ $((lock_now - lock_started_at)) -ge "$LOCK_TIMEOUT_SECONDS" ]; then
+    echo "[node_modules] Timed out waiting ${LOCK_TIMEOUT_SECONDS}s for dependency preparation lock: $LOCK_DIR" >&2
+    exit 1
+  fi
+  echo "[node_modules] Waiting for another dependency preparation for this project..."
+  sleep 1
+done
+printf '%s\n' "$$" > "$LOCK_DIR/pid"
+trap release_lock EXIT
+
+mkdir -p "$WORK_DIR"
+
+# Previous versions mirrored the whole project into WORK_DIR. That gives pnpm
+# and framework dev servers two paths for the same source tree, which breaks
+# file watching and on-demand compilation. Keep only managed local outputs.
+cleanup_legacy_workspace() {
+  local workspace_dir="$1" entry name
+  if [ -L "$workspace_dir" ] || { [ -e "$workspace_dir" ] && [ ! -d "$workspace_dir" ]; }; then
+    rm -rf "$workspace_dir"
+    return
+  fi
+  if [ ! -d "$workspace_dir" ]; then
+    return 0
+  fi
+
+  while IFS= read -r -d '' entry; do
+    name="$(basename "$entry")"
+    [ "$name" = "node_modules" ] || rm -rf "$entry"
+  done < <(find "$workspace_dir" -mindepth 1 -maxdepth 1 -print0)
+}
+
+cleanup_legacy_shadow_project() {
+  local entry name
+  while IFS= read -r -d '' entry; do
+    name="$(basename "$entry")"
+    case "$name" in
+      node_modules|client|server) continue ;;
+    esac
+    rm -rf "$entry"
+  done < <(find "$WORK_DIR" -mindepth 1 -maxdepth 1 -print0)
+
+  for workspace in client server; do
+    cleanup_legacy_workspace "$WORK_DIR/$workspace"
+  done
+}
+
+link_install_entry() {
+  local source_path="$1" target_path="$2"
+  rm -rf "$target_path"
+  if [ -e "$source_path" ]; then
+    ln -s "$source_path" "$target_path"
+  fi
+}
+
+copy_install_metadata() {
+  local filename source_file target_file workspace
+  for filename in pnpm-lock.yaml pnpm-workspace.yaml .npmrc; do
+    source_file="$PROJECT_ROOT/$filename"
+    target_file="$WORK_DIR/$filename"
+    rm -f "$target_file"
+    if [ -f "$source_file" ]; then
+      cp "$source_file" "$target_file"
+    fi
+  done
+
+  link_install_entry "$PROJECT_ROOT/package.json" "$WORK_DIR/package.json"
+  link_install_entry "$PROJECT_ROOT/patches" "$WORK_DIR/patches"
+  link_install_entry "$PROJECT_ROOT/scripts" "$WORK_DIR/scripts"
+
+  for workspace in client server; do
+    if [ -f "$PROJECT_ROOT/$workspace/package.json" ]; then
+      mkdir -p "$WORK_DIR/$workspace"
+      link_install_entry "$PROJECT_ROOT/$workspace/package.json" "$WORK_DIR/$workspace/package.json"
+      link_install_entry "$PROJECT_ROOT/$workspace/scripts" "$WORK_DIR/$workspace/scripts"
+    else
+      rm -rf "$WORK_DIR/$workspace"
+    fi
+  done
+}
+
+link_node_modules() {
+  local source_dir="$1" target_dir="$2"
+  local current=""
+  mkdir -p "$target_dir"
+  if [ -L "$source_dir/node_modules" ]; then
+    current="$(readlink "$source_dir/node_modules")"
+    case "$current" in
+      "$NM_ROOT"/*/node_modules|"$NM_ROOT"/*/*/node_modules) ;;
+      *)
+        echo "[node_modules] refusing to replace unmanaged symlink: $source_dir/node_modules" >&2
+        exit 1
+        ;;
+    esac
+    rm "$source_dir/node_modules"
+  elif [ -e "$source_dir/node_modules" ]; then
+    rm -rf "$source_dir/node_modules"
+  fi
+  ln -s "$target_dir" "$source_dir/node_modules"
+}
+
+cleanup_legacy_shadow_project
+copy_install_metadata
+
+echo "[node_modules] Installing dependencies in $WORK_DIR"
+if ! (cd "$WORK_DIR" && pnpm install "$@"); then
+  exit 1
+fi
+
+if [ -f "$WORK_DIR/pnpm-lock.yaml" ]; then
+  temporary_lockfile="$(mktemp "$PROJECT_ROOT/.pnpm-lock.yaml.XXXXXX")"
+  cp "$WORK_DIR/pnpm-lock.yaml" "$temporary_lockfile"
+  chmod 0644 "$temporary_lockfile"
+  mv -f "$temporary_lockfile" "$PROJECT_ROOT/pnpm-lock.yaml"
+fi
+
+link_node_modules "$PROJECT_ROOT" "$WORK_DIR/node_modules"
+for workspace in client server; do
+  if [ -f "$PROJECT_ROOT/$workspace/package.json" ]; then
+    link_node_modules "$PROJECT_ROOT/$workspace" "$WORK_DIR/$workspace/node_modules"
+  fi
+done
+
+echo "[node_modules] Dependencies ready"