@coze-arch/cli 0.1.7 → 0.1.8-alpha.6e99f9

package/lib/__templates__/expo/.cozeproj/scripts/prepare-node-modules.sh

@@ -98,6 +98,7 @@ printf '%s\n' "$$" > "$LOCK_DIR/pid"
 trap release_lock EXIT
 
 mkdir -p "$WORK_DIR"
+INSTALL_STATE_FILE="$WORK_DIR/.install-state"
 
 # Previous versions mirrored the whole project into WORK_DIR. That gives pnpm
 # and framework dev servers two paths for the same source tree, which breaks
@@ -118,12 +119,15 @@ cleanup_legacy_workspace() {
   done < <(find "$workspace_dir" -mindepth 1 -maxdepth 1 -print0)
 }
 
+# caches is reserved for the sibling prepare scripts of this project. They keep
+# regenerable framework output there (the Next helper points .next/dev into it), and that
+# output has to outlive an install, so this cleanup must not read it as leftover.
 cleanup_legacy_shadow_project() {
   local entry name
   while IFS= read -r -d '' entry; do
     name="$(basename "$entry")"
     case "$name" in
-      node_modules|client|server) continue ;;
+      node_modules|client|server|caches|.install-state) continue ;;
     esac
     rm -rf "$entry"
   done < <(find "$WORK_DIR" -mindepth 1 -maxdepth 1 -print0)
@@ -141,6 +145,162 @@ link_install_entry() {
   fi
 }
 
+hash_install_input() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum | awk '{print $1}'
+  elif command -v shasum >/dev/null 2>&1; then
+    shasum -a 256 | awk '{print $1}'
+  else
+    cksum | awk '{print $1 "-" $2}'
+  fi
+}
+
+append_file_to_install_fingerprint() {
+  local relative_path="$1"
+  local source_path="$PROJECT_ROOT/$relative_path"
+  printf 'path=%s\n' "$relative_path"
+  if [ -f "$source_path" ]; then
+    cat "$source_path"
+  else
+    printf '<missing>\n'
+  fi
+}
+
+append_directory_to_install_fingerprint() {
+  local relative_path="$1"
+  local source_path="$PROJECT_ROOT/$relative_path"
+  local file
+  printf 'path=%s\n' "$relative_path"
+  if [ ! -d "$source_path" ]; then
+    printf '<missing>\n'
+    return
+  fi
+
+  while IFS= read -r file; do
+    printf 'file=%s\n' "${file#"${PROJECT_ROOT}/"}"
+    cat "$file"
+  done < <(find -P "$source_path" -type f -print | LC_ALL=C sort)
+}
+
+# Everything that can change the resolved dependency tree. The leading version marker
+# invalidates every stored state when this scheme itself changes.
+calculate_install_fingerprint() {
+  local filename workspace argument
+  {
+    printf 'prepare-node-modules-install-state=1\n'
+    printf 'node-version=%s\n' "$(node --version)"
+    printf 'pnpm-version=%s\n' "$(pnpm --version)"
+    printf 'node-env=%s\n' "${NODE_ENV:-}"
+    printf 'npm-config-production=%s\n' "${npm_config_production:-}"
+    printf 'npm-config-production-upper=%s\n' "${NPM_CONFIG_PRODUCTION:-}"
+    printf 'pnpm-config-production=%s\n' "${PNPM_CONFIG_PRODUCTION:-}"
+    for argument in "$@"; do
+      printf 'install-argument=%s\n' "$argument"
+    done
+    for filename in package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc; do
+      append_file_to_install_fingerprint "$filename"
+    done
+    for workspace in client server; do
+      append_file_to_install_fingerprint "$workspace/package.json"
+    done
+    append_directory_to_install_fingerprint patches
+  } | hash_install_input
+}
+
+install_requires_refresh() {
+  local argument
+  for argument in "$@"; do
+    case "$argument" in
+      --force|-f|--lockfile-only|--fix-lockfile) return 0 ;;
+    esac
+  done
+  return 1
+}
+
+# Reuse skips pnpm install entirely, so it must not skip side effects that live outside
+# node_modules. preinstall is exempt: it only guards which package manager may run, and
+# there is no install to guard when the tree is already in place.
+package_has_install_lifecycle() {
+  local package_path="$1"
+  node - "$package_path" <<'NODE'
+const fs = require('node:fs');
+const [packagePath] = process.argv.slice(2);
+
+try {
+  const packageJson = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
+  const scripts = packageJson && typeof packageJson.scripts === 'object' && packageJson.scripts
+    ? packageJson.scripts
+    : {};
+  const hasLifecycle = ['install', 'postinstall', 'prepare'].some(
+    name => typeof scripts[name] === 'string' && scripts[name].trim() !== '',
+  );
+
+  process.exit(hasLifecycle ? 0 : 1);
+} catch {
+  process.exit(0);
+}
+NODE
+}
+
+install_reuse_is_safe() {
+  local workspace package_path
+  for package_path in "$PROJECT_ROOT/.pnpmfile.cjs" "$PROJECT_ROOT/.pnpmfile.js"; do
+    if [ -e "$package_path" ]; then
+      echo "[node_modules] Reinstalling because pnpm hooks are present: $package_path"
+      return 1
+    fi
+  done
+
+  if [ -f "$PROJECT_ROOT/.npmrc" ] && grep -Eq '^[[:space:]]*pnpmfile[[:space:]]*=' "$PROJECT_ROOT/.npmrc"; then
+    echo "[node_modules] Reinstalling because .npmrc configures a pnpm hook."
+    return 1
+  fi
+
+  for workspace in . client server; do
+    package_path="$PROJECT_ROOT/$workspace/package.json"
+    [ -f "$package_path" ] || continue
+    if package_has_install_lifecycle "$package_path"; then
+      echo "[node_modules] Reinstalling because $package_path has an install lifecycle script."
+      return 1
+    fi
+  done
+  return 0
+}
+
+dependencies_are_ready() {
+  local workspace
+  [ -f "$WORK_DIR/node_modules/.modules.yaml" ] || return 1
+  for workspace in client server; do
+    if [ -f "$PROJECT_ROOT/$workspace/package.json" ] &&
+      [ ! -f "$WORK_DIR/$workspace/node_modules/.modules.yaml" ]; then
+      return 1
+    fi
+  done
+  return 0
+}
+
+# 判断顺序按代价从小到大排。指纹要读云盘上的 lockfile 和整个 patches/，所以放最后：只有其余
+# 条件都满足、确实可能复用时才付这份开销。build.sh 和 prepare.sh 不设开关，第一行就返回了。
+install_can_be_reused() {
+  local installed_fingerprint=""
+
+  [ "${COZE_REUSE_NODE_MODULES:-}" = "1" ] || return 1
+  install_requires_refresh "$@" && return 1
+  [ -f "$INSTALL_STATE_FILE" ] || return 1
+  IFS= read -r installed_fingerprint < "$INSTALL_STATE_FILE" || return 1
+  dependencies_are_ready || return 1
+  install_reuse_is_safe || return 1
+  [ "$installed_fingerprint" = "$(calculate_install_fingerprint "$@")" ] || return 1
+  return 0
+}
+
+write_install_state() {
+  local fingerprint="$1" temporary_state
+  temporary_state="$(mktemp "$WORK_DIR/.install-state.XXXXXX")"
+  printf '%s\n' "$fingerprint" > "$temporary_state"
+  mv -f "$temporary_state" "$INSTALL_STATE_FILE"
+}
+
 copy_install_metadata() {
   local filename source_file target_file workspace
   for filename in pnpm-lock.yaml pnpm-workspace.yaml .npmrc; do
@@ -190,16 +350,26 @@ link_node_modules() {
 cleanup_legacy_shadow_project
 copy_install_metadata
 
-echo "[node_modules] Installing dependencies in $WORK_DIR"
-if ! (cd "$WORK_DIR" && pnpm install "$@"); then
-  exit 1
-fi
+if install_can_be_reused "$@"; then
+  echo "[node_modules] Reusing unchanged dependencies in $WORK_DIR"
+else
+  # A stale state file must not survive a failed install.
+  rm -f "$INSTALL_STATE_FILE"
+  echo "[node_modules] Installing dependencies in $WORK_DIR"
+  if ! (cd "$WORK_DIR" && pnpm install "$@"); then
+    exit 1
+  fi
+
+  if [ -f "$WORK_DIR/pnpm-lock.yaml" ]; then
+    temporary_lockfile="$(mktemp "$PROJECT_ROOT/.pnpm-lock.yaml.XXXXXX")"
+    cp "$WORK_DIR/pnpm-lock.yaml" "$temporary_lockfile"
+    chmod 0644 "$temporary_lockfile"
+    mv -f "$temporary_lockfile" "$PROJECT_ROOT/pnpm-lock.yaml"
+  fi
 
-if [ -f "$WORK_DIR/pnpm-lock.yaml" ]; then
-  temporary_lockfile="$(mktemp "$PROJECT_ROOT/.pnpm-lock.yaml.XXXXXX")"
-  cp "$WORK_DIR/pnpm-lock.yaml" "$temporary_lockfile"
-  chmod 0644 "$temporary_lockfile"
-  mv -f "$temporary_lockfile" "$PROJECT_ROOT/pnpm-lock.yaml"
+  # pnpm may have rewritten the lockfile, so record the fingerprint of the tree as it
+  # now stands. Otherwise the next run would see a changed input and reinstall.
+  write_install_state "$(calculate_install_fingerprint "$@")"
 fi
 
 link_node_modules "$PROJECT_ROOT" "$WORK_DIR/node_modules"

package/lib/__templates__/nextjs/scripts/dev.sh

@@ -71,9 +71,14 @@ warn_source_symlinks() {
     done <<< "${links}"
 }
 
-# 云盘挂载偶尔会把新建文件的 mtime 设为 Unix epoch。Watchpack 会因此把路由文件当作
-# 启动前的旧状态，导致 Next 的首轮扫描漏掉 route/page。只在云盘项目启动前刷新 app/pages
-# 的目录和普通文件时间戳；不跟随软链、不改文件内容。
+# 云盘挂载偶尔会把新建文件的 mtime 设为 Unix epoch，这种时间戳会让所有按 mtime 判断新旧的
+# 环节（Next 的首轮路由扫描、webpack 的 timestamp 快照、tsbuildinfo）拿到错误的结论。
+# 只修 mtime 确实异常的那些条目：无条件刷新整棵 app/pages 会让 webpack 每次启动都重算全部
+# 路由文件的 hash，并让云盘把它们全部重传一遍。不跟随软链、不改文件内容。
+# 判定 mtime 是否异常的下界。真实的项目文件不可能早于这个时间，落在它之前的只有被云盘写坏的
+# 时间戳，所以用它把"需要修"和"本来就好"区分开。
+DRIVE_MTIME_FLOOR="1971-01-01"
+
 refresh_drive_route_mtimes() {
     local drive_root="${COZE_DRIVE_ROOT:-/Coze/Drive}"
     local project_root route_dir
@@ -91,7 +96,7 @@ refresh_drive_route_mtimes() {
 
     for route_dir in "${COZE_WORKSPACE_PATH}/src/app" "${COZE_WORKSPACE_PATH}/src/pages"; do
       [[ -d "${route_dir}" ]] || continue
-      if ! find -P "${route_dir}" \( -type f -o -type d \) -exec touch {} + 2>/dev/null; then
+      if ! find -P "${route_dir}" \( -type f -o -type d \) ! -newermt "${DRIVE_MTIME_FLOOR}" -exec touch {} + 2>/dev/null; then
         echo "Warning: failed to refresh Next route timestamps in ${route_dir}." >&2
       fi
     done
@@ -100,7 +105,8 @@ refresh_drive_route_mtimes() {
 <% if (process.env.NODE_ENV === 'test') { %>
 echo "Clearing port ${DEPLOY_RUN_PORT} before start."
 kill_port_if_listening
-bash "${COZE_WORKSPACE_PATH}/scripts/prepare-node-modules.sh" --prefer-frozen-lockfile --prefer-offline --loglevel debug --reporter=append-only
+COZE_REUSE_NODE_MODULES=1 bash "${COZE_WORKSPACE_PATH}/scripts/prepare-node-modules.sh" --prefer-frozen-lockfile --prefer-offline --loglevel debug --reporter=append-only
+bash "${COZE_WORKSPACE_PATH}/scripts/prepare-next-dev-output.sh"
 warn_source_symlinks
 refresh_drive_route_mtimes
 echo "Starting HTTP service on port ${DEPLOY_RUN_PORT} for dev..."
@@ -294,7 +300,8 @@ fi
 
 echo "Clearing port ${DEPLOY_RUN_PORT} before start."
 kill_port_if_listening
-bash "${COZE_WORKSPACE_PATH}/scripts/prepare-node-modules.sh" --prefer-frozen-lockfile --prefer-offline --loglevel debug --reporter=append-only
+COZE_REUSE_NODE_MODULES=1 bash "${COZE_WORKSPACE_PATH}/scripts/prepare-node-modules.sh" --prefer-frozen-lockfile --prefer-offline --loglevel debug --reporter=append-only
+bash "${COZE_WORKSPACE_PATH}/scripts/prepare-next-dev-output.sh"
 warn_source_symlinks
 refresh_drive_route_mtimes
 echo "Starting HTTP service on port ${DEPLOY_RUN_PORT} for dev..."

package/lib/__templates__/nextjs/scripts/prepare-next-dev-output.sh

@@ -0,0 +1,122 @@
+#!/usr/bin/env bash
+# Keep Next development output off Coze Drive without moving production output.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+if [ "$(basename "$(dirname "$SCRIPT_DIR")")" = ".cozeproj" ]; then
+  PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd -P)"
+else
+  PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+fi
+
+DRIVE_ROOT="${COZE_DRIVE_ROOT:-/Coze/Drive}"
+if [ -d "$DRIVE_ROOT" ]; then
+  DRIVE_ROOT="$(cd "$DRIVE_ROOT" && pwd -P)"
+else
+  DRIVE_ROOT="${DRIVE_ROOT%/}"
+fi
+case "$PROJECT_ROOT" in
+  "$DRIVE_ROOT"|"$DRIVE_ROOT"/*) ;;
+  *) exit 0 ;;
+esac
+
+# Next writes every on-demand development build into .next/dev. On Coze Drive each of
+# those writes goes through the sync daemon, so only that subtree moves to local disk.
+# Production output stays in the project directory, which keeps `next build` and
+# deployment unchanged.
+#
+# One local directory per project, shared with prepare-node-modules.sh: node_modules and
+# this cache sit side by side under WORK_DIR. The caches subdirectory is the slot that
+# script reserves for output that must survive an install, so nothing here is cleaned up
+# behind our back. PROJECT_ID has to stay identical to the one it computes.
+NM_ROOT="/tmp/nm"
+PROJECT_ID="$(basename "$PROJECT_ROOT")-$(printf '%s' "$PROJECT_ROOT" | cksum | awk '{print $1}')"
+WORK_DIR="$NM_ROOT/$PROJECT_ID"
+NEXT_ROOT="$PROJECT_ROOT/.next"
+NEXT_DEV="$NEXT_ROOT/dev"
+LEGACY_NEXT_ROOT="$WORK_DIR/.next"
+LOCAL_NEXT_DEV="$WORK_DIR/caches/next-dev"
+
+case "$LOCAL_NEXT_DEV" in
+  "$DRIVE_ROOT"|"$DRIVE_ROOT"/*)
+    echo "[next] local development output must not be on Coze Drive: $LOCAL_NEXT_DEV" >&2
+    exit 1
+    ;;
+esac
+
+# Coze Drive sync does not preserve symlinks: a synced copy of a link arrives as a
+# regular file holding the link target. Recognize the links this scheme creates so a
+# project that came back from sync repairs itself instead of failing to start.
+is_flattened_managed_link() {
+  local candidate="$1" content=""
+  [ -f "$candidate" ] || return 1
+  [ ! -L "$candidate" ] || return 1
+  [ "$(wc -c < "$candidate")" -le 4096 ] || return 1
+  content="$(tr -d '\r\n' < "$candidate")"
+  case "$content" in
+    "$NM_ROOT"/*) return 0 ;;
+  esac
+  return 1
+}
+
+# Earlier versions linked the whole .next directory. Bring any production build made
+# back then into the project; from here on only .next/dev is redirected.
+restore_legacy_next_root() {
+  local entry
+  rm -f "$NEXT_ROOT"
+  mkdir -p "$NEXT_ROOT"
+  if [ -d "$LEGACY_NEXT_ROOT" ]; then
+    while IFS= read -r -d '' entry; do
+      mv "$entry" "$NEXT_ROOT/"
+    done < <(find -P "$LEGACY_NEXT_ROOT" -mindepth 1 -maxdepth 1 -print0)
+    rmdir "$LEGACY_NEXT_ROOT" 2>/dev/null || true
+  fi
+}
+
+if [ -L "$NEXT_ROOT" ]; then
+  case "$(readlink "$NEXT_ROOT")" in
+    "$NM_ROOT"/*)
+      echo "[next] Restoring legacy .next output to the project directory."
+      restore_legacy_next_root
+      ;;
+    *)
+      echo "[next] refusing to replace unmanaged .next symlink: $NEXT_ROOT" >&2
+      exit 1
+      ;;
+  esac
+elif is_flattened_managed_link "$NEXT_ROOT"; then
+  echo "[next] Recovering .next flattened by Coze Drive sync."
+  restore_legacy_next_root
+elif [ -e "$NEXT_ROOT" ] && [ ! -d "$NEXT_ROOT" ]; then
+  echo "[next] refusing to replace non-directory Next output: $NEXT_ROOT" >&2
+  exit 1
+fi
+
+mkdir -p "$NEXT_ROOT" "$LOCAL_NEXT_DEV"
+
+if [ -L "$NEXT_DEV" ]; then
+  if [ "$(readlink "$NEXT_DEV")" = "$LOCAL_NEXT_DEV" ]; then
+    exit 0
+  fi
+  case "$(readlink "$NEXT_DEV")" in
+    "$NM_ROOT"/*) rm "$NEXT_DEV" ;;
+    *)
+      echo "[next] refusing to replace unmanaged .next/dev symlink: $NEXT_DEV" >&2
+      exit 1
+      ;;
+  esac
+elif [ -e "$NEXT_DEV" ]; then
+  # .next/dev holds development output only, and Next regenerates it on demand.
+  rm -rf "$NEXT_DEV"
+fi
+
+# A second dev start can win the race between the removal above and this link.
+if ! ln -s "$LOCAL_NEXT_DEV" "$NEXT_DEV" 2>/dev/null; then
+  if [ -L "$NEXT_DEV" ] && [ "$(readlink "$NEXT_DEV")" = "$LOCAL_NEXT_DEV" ]; then
+    exit 0
+  fi
+  echo "[next] failed to link development output: $NEXT_DEV" >&2
+  exit 1
+fi
+
+echo "[next] Development output linked to $LOCAL_NEXT_DEV"

package/lib/__templates__/nextjs/scripts/prepare-node-modules.sh

@@ -98,6 +98,7 @@ printf '%s\n' "$$" > "$LOCK_DIR/pid"
 trap release_lock EXIT
 
 mkdir -p "$WORK_DIR"
+INSTALL_STATE_FILE="$WORK_DIR/.install-state"
 
 # Previous versions mirrored the whole project into WORK_DIR. That gives pnpm
 # and framework dev servers two paths for the same source tree, which breaks
@@ -118,12 +119,15 @@ cleanup_legacy_workspace() {
   done < <(find "$workspace_dir" -mindepth 1 -maxdepth 1 -print0)
 }
 
+# caches is reserved for the sibling prepare scripts of this project. They keep
+# regenerable framework output there (the Next helper points .next/dev into it), and that
+# output has to outlive an install, so this cleanup must not read it as leftover.
 cleanup_legacy_shadow_project() {
   local entry name
   while IFS= read -r -d '' entry; do
     name="$(basename "$entry")"
     case "$name" in
-      node_modules|client|server) continue ;;
+      node_modules|client|server|caches|.install-state) continue ;;
     esac
     rm -rf "$entry"
   done < <(find "$WORK_DIR" -mindepth 1 -maxdepth 1 -print0)
@@ -141,6 +145,162 @@ link_install_entry() {
   fi
 }
 
+hash_install_input() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum | awk '{print $1}'
+  elif command -v shasum >/dev/null 2>&1; then
+    shasum -a 256 | awk '{print $1}'
+  else
+    cksum | awk '{print $1 "-" $2}'
+  fi
+}
+
+append_file_to_install_fingerprint() {
+  local relative_path="$1"
+  local source_path="$PROJECT_ROOT/$relative_path"
+  printf 'path=%s\n' "$relative_path"
+  if [ -f "$source_path" ]; then
+    cat "$source_path"
+  else
+    printf '<missing>\n'
+  fi
+}
+
+append_directory_to_install_fingerprint() {
+  local relative_path="$1"
+  local source_path="$PROJECT_ROOT/$relative_path"
+  local file
+  printf 'path=%s\n' "$relative_path"
+  if [ ! -d "$source_path" ]; then
+    printf '<missing>\n'
+    return
+  fi
+
+  while IFS= read -r file; do
+    printf 'file=%s\n' "${file#"${PROJECT_ROOT}/"}"
+    cat "$file"
+  done < <(find -P "$source_path" -type f -print | LC_ALL=C sort)
+}
+
+# Everything that can change the resolved dependency tree. The leading version marker
+# invalidates every stored state when this scheme itself changes.
+calculate_install_fingerprint() {
+  local filename workspace argument
+  {
+    printf 'prepare-node-modules-install-state=1\n'
+    printf 'node-version=%s\n' "$(node --version)"
+    printf 'pnpm-version=%s\n' "$(pnpm --version)"
+    printf 'node-env=%s\n' "${NODE_ENV:-}"
+    printf 'npm-config-production=%s\n' "${npm_config_production:-}"
+    printf 'npm-config-production-upper=%s\n' "${NPM_CONFIG_PRODUCTION:-}"
+    printf 'pnpm-config-production=%s\n' "${PNPM_CONFIG_PRODUCTION:-}"
+    for argument in "$@"; do
+      printf 'install-argument=%s\n' "$argument"
+    done
+    for filename in package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc; do
+      append_file_to_install_fingerprint "$filename"
+    done
+    for workspace in client server; do
+      append_file_to_install_fingerprint "$workspace/package.json"
+    done
+    append_directory_to_install_fingerprint patches
+  } | hash_install_input
+}
+
+install_requires_refresh() {
+  local argument
+  for argument in "$@"; do
+    case "$argument" in
+      --force|-f|--lockfile-only|--fix-lockfile) return 0 ;;
+    esac
+  done
+  return 1
+}
+
+# Reuse skips pnpm install entirely, so it must not skip side effects that live outside
+# node_modules. preinstall is exempt: it only guards which package manager may run, and
+# there is no install to guard when the tree is already in place.
+package_has_install_lifecycle() {
+  local package_path="$1"
+  node - "$package_path" <<'NODE'
+const fs = require('node:fs');
+const [packagePath] = process.argv.slice(2);
+
+try {
+  const packageJson = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
+  const scripts = packageJson && typeof packageJson.scripts === 'object' && packageJson.scripts
+    ? packageJson.scripts
+    : {};
+  const hasLifecycle = ['install', 'postinstall', 'prepare'].some(
+    name => typeof scripts[name] === 'string' && scripts[name].trim() !== '',
+  );
+
+  process.exit(hasLifecycle ? 0 : 1);
+} catch {
+  process.exit(0);
+}
+NODE
+}
+
+install_reuse_is_safe() {
+  local workspace package_path
+  for package_path in "$PROJECT_ROOT/.pnpmfile.cjs" "$PROJECT_ROOT/.pnpmfile.js"; do
+    if [ -e "$package_path" ]; then
+      echo "[node_modules] Reinstalling because pnpm hooks are present: $package_path"
+      return 1
+    fi
+  done
+
+  if [ -f "$PROJECT_ROOT/.npmrc" ] && grep -Eq '^[[:space:]]*pnpmfile[[:space:]]*=' "$PROJECT_ROOT/.npmrc"; then
+    echo "[node_modules] Reinstalling because .npmrc configures a pnpm hook."
+    return 1
+  fi
+
+  for workspace in . client server; do
+    package_path="$PROJECT_ROOT/$workspace/package.json"
+    [ -f "$package_path" ] || continue
+    if package_has_install_lifecycle "$package_path"; then
+      echo "[node_modules] Reinstalling because $package_path has an install lifecycle script."
+      return 1
+    fi
+  done
+  return 0
+}
+
+dependencies_are_ready() {
+  local workspace
+  [ -f "$WORK_DIR/node_modules/.modules.yaml" ] || return 1
+  for workspace in client server; do
+    if [ -f "$PROJECT_ROOT/$workspace/package.json" ] &&
+      [ ! -f "$WORK_DIR/$workspace/node_modules/.modules.yaml" ]; then
+      return 1
+    fi
+  done
+  return 0
+}
+
+# 判断顺序按代价从小到大排。指纹要读云盘上的 lockfile 和整个 patches/，所以放最后：只有其余
+# 条件都满足、确实可能复用时才付这份开销。build.sh 和 prepare.sh 不设开关，第一行就返回了。
+install_can_be_reused() {
+  local installed_fingerprint=""
+
+  [ "${COZE_REUSE_NODE_MODULES:-}" = "1" ] || return 1
+  install_requires_refresh "$@" && return 1
+  [ -f "$INSTALL_STATE_FILE" ] || return 1
+  IFS= read -r installed_fingerprint < "$INSTALL_STATE_FILE" || return 1
+  dependencies_are_ready || return 1
+  install_reuse_is_safe || return 1
+  [ "$installed_fingerprint" = "$(calculate_install_fingerprint "$@")" ] || return 1
+  return 0
+}
+
+write_install_state() {
+  local fingerprint="$1" temporary_state
+  temporary_state="$(mktemp "$WORK_DIR/.install-state.XXXXXX")"
+  printf '%s\n' "$fingerprint" > "$temporary_state"
+  mv -f "$temporary_state" "$INSTALL_STATE_FILE"
+}
+
 copy_install_metadata() {
   local filename source_file target_file workspace
   for filename in pnpm-lock.yaml pnpm-workspace.yaml .npmrc; do
@@ -190,16 +350,26 @@ link_node_modules() {
 cleanup_legacy_shadow_project
 copy_install_metadata
 
-echo "[node_modules] Installing dependencies in $WORK_DIR"
-if ! (cd "$WORK_DIR" && pnpm install "$@"); then
-  exit 1
-fi
+if install_can_be_reused "$@"; then
+  echo "[node_modules] Reusing unchanged dependencies in $WORK_DIR"
+else
+  # A stale state file must not survive a failed install.
+  rm -f "$INSTALL_STATE_FILE"
+  echo "[node_modules] Installing dependencies in $WORK_DIR"
+  if ! (cd "$WORK_DIR" && pnpm install "$@"); then
+    exit 1
+  fi
+
+  if [ -f "$WORK_DIR/pnpm-lock.yaml" ]; then
+    temporary_lockfile="$(mktemp "$PROJECT_ROOT/.pnpm-lock.yaml.XXXXXX")"
+    cp "$WORK_DIR/pnpm-lock.yaml" "$temporary_lockfile"
+    chmod 0644 "$temporary_lockfile"
+    mv -f "$temporary_lockfile" "$PROJECT_ROOT/pnpm-lock.yaml"
+  fi
 
-if [ -f "$WORK_DIR/pnpm-lock.yaml" ]; then
-  temporary_lockfile="$(mktemp "$PROJECT_ROOT/.pnpm-lock.yaml.XXXXXX")"
-  cp "$WORK_DIR/pnpm-lock.yaml" "$temporary_lockfile"
-  chmod 0644 "$temporary_lockfile"
-  mv -f "$temporary_lockfile" "$PROJECT_ROOT/pnpm-lock.yaml"
+  # pnpm may have rewritten the lockfile, so record the fingerprint of the tree as it
+  # now stands. Otherwise the next run would see a changed input and reinstall.
+  write_install_state "$(calculate_install_fingerprint "$@")"
 fi
 
 link_node_modules "$PROJECT_ROOT" "$WORK_DIR/node_modules"

package/lib/__templates__/nuxt-vue/scripts/prepare-node-modules.sh

@@ -98,6 +98,7 @@ printf '%s\n' "$$" > "$LOCK_DIR/pid"
 trap release_lock EXIT
 
 mkdir -p "$WORK_DIR"
+INSTALL_STATE_FILE="$WORK_DIR/.install-state"
 
 # Previous versions mirrored the whole project into WORK_DIR. That gives pnpm
 # and framework dev servers two paths for the same source tree, which breaks
@@ -118,12 +119,15 @@ cleanup_legacy_workspace() {
   done < <(find "$workspace_dir" -mindepth 1 -maxdepth 1 -print0)
 }
 
+# caches is reserved for the sibling prepare scripts of this project. They keep
+# regenerable framework output there (the Next helper points .next/dev into it), and that
+# output has to outlive an install, so this cleanup must not read it as leftover.
 cleanup_legacy_shadow_project() {
   local entry name
   while IFS= read -r -d '' entry; do
     name="$(basename "$entry")"
     case "$name" in
-      node_modules|client|server) continue ;;
+      node_modules|client|server|caches|.install-state) continue ;;
     esac
     rm -rf "$entry"
   done < <(find "$WORK_DIR" -mindepth 1 -maxdepth 1 -print0)
@@ -141,6 +145,162 @@ link_install_entry() {
   fi
 }
 
+hash_install_input() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum | awk '{print $1}'
+  elif command -v shasum >/dev/null 2>&1; then
+    shasum -a 256 | awk '{print $1}'
+  else
+    cksum | awk '{print $1 "-" $2}'
+  fi
+}
+
+append_file_to_install_fingerprint() {
+  local relative_path="$1"
+  local source_path="$PROJECT_ROOT/$relative_path"
+  printf 'path=%s\n' "$relative_path"
+  if [ -f "$source_path" ]; then
+    cat "$source_path"
+  else
+    printf '<missing>\n'
+  fi
+}
+
+append_directory_to_install_fingerprint() {
+  local relative_path="$1"
+  local source_path="$PROJECT_ROOT/$relative_path"
+  local file
+  printf 'path=%s\n' "$relative_path"
+  if [ ! -d "$source_path" ]; then
+    printf '<missing>\n'
+    return
+  fi
+
+  while IFS= read -r file; do
+    printf 'file=%s\n' "${file#"${PROJECT_ROOT}/"}"
+    cat "$file"
+  done < <(find -P "$source_path" -type f -print | LC_ALL=C sort)
+}
+
+# Everything that can change the resolved dependency tree. The leading version marker
+# invalidates every stored state when this scheme itself changes.
+calculate_install_fingerprint() {
+  local filename workspace argument
+  {
+    printf 'prepare-node-modules-install-state=1\n'
+    printf 'node-version=%s\n' "$(node --version)"
+    printf 'pnpm-version=%s\n' "$(pnpm --version)"
+    printf 'node-env=%s\n' "${NODE_ENV:-}"
+    printf 'npm-config-production=%s\n' "${npm_config_production:-}"
+    printf 'npm-config-production-upper=%s\n' "${NPM_CONFIG_PRODUCTION:-}"
+    printf 'pnpm-config-production=%s\n' "${PNPM_CONFIG_PRODUCTION:-}"
+    for argument in "$@"; do
+      printf 'install-argument=%s\n' "$argument"
+    done
+    for filename in package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc; do
+      append_file_to_install_fingerprint "$filename"
+    done
+    for workspace in client server; do
+      append_file_to_install_fingerprint "$workspace/package.json"
+    done
+    append_directory_to_install_fingerprint patches
+  } | hash_install_input
+}
+
+install_requires_refresh() {
+  local argument
+  for argument in "$@"; do
+    case "$argument" in
+      --force|-f|--lockfile-only|--fix-lockfile) return 0 ;;
+    esac
+  done
+  return 1
+}
+
+# Reuse skips pnpm install entirely, so it must not skip side effects that live outside
+# node_modules. preinstall is exempt: it only guards which package manager may run, and
+# there is no install to guard when the tree is already in place.
+package_has_install_lifecycle() {
+  local package_path="$1"
+  node - "$package_path" <<'NODE'
+const fs = require('node:fs');
+const [packagePath] = process.argv.slice(2);
+
+try {
+  const packageJson = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
+  const scripts = packageJson && typeof packageJson.scripts === 'object' && packageJson.scripts
+    ? packageJson.scripts
+    : {};
+  const hasLifecycle = ['install', 'postinstall', 'prepare'].some(
+    name => typeof scripts[name] === 'string' && scripts[name].trim() !== '',
+  );
+
+  process.exit(hasLifecycle ? 0 : 1);
+} catch {
+  process.exit(0);
+}
+NODE
+}
+
+install_reuse_is_safe() {
+  local workspace package_path
+  for package_path in "$PROJECT_ROOT/.pnpmfile.cjs" "$PROJECT_ROOT/.pnpmfile.js"; do
+    if [ -e "$package_path" ]; then
+      echo "[node_modules] Reinstalling because pnpm hooks are present: $package_path"
+      return 1
+    fi
+  done
+
+  if [ -f "$PROJECT_ROOT/.npmrc" ] && grep -Eq '^[[:space:]]*pnpmfile[[:space:]]*=' "$PROJECT_ROOT/.npmrc"; then
+    echo "[node_modules] Reinstalling because .npmrc configures a pnpm hook."
+    return 1
+  fi
+
+  for workspace in . client server; do
+    package_path="$PROJECT_ROOT/$workspace/package.json"
+    [ -f "$package_path" ] || continue
+    if package_has_install_lifecycle "$package_path"; then
+      echo "[node_modules] Reinstalling because $package_path has an install lifecycle script."
+      return 1
+    fi
+  done
+  return 0
+}
+
+dependencies_are_ready() {
+  local workspace
+  [ -f "$WORK_DIR/node_modules/.modules.yaml" ] || return 1
+  for workspace in client server; do
+    if [ -f "$PROJECT_ROOT/$workspace/package.json" ] &&
+      [ ! -f "$WORK_DIR/$workspace/node_modules/.modules.yaml" ]; then
+      return 1
+    fi
+  done
+  return 0
+}
+
+# 判断顺序按代价从小到大排。指纹要读云盘上的 lockfile 和整个 patches/，所以放最后：只有其余
+# 条件都满足、确实可能复用时才付这份开销。build.sh 和 prepare.sh 不设开关，第一行就返回了。
+install_can_be_reused() {
+  local installed_fingerprint=""
+
+  [ "${COZE_REUSE_NODE_MODULES:-}" = "1" ] || return 1
+  install_requires_refresh "$@" && return 1
+  [ -f "$INSTALL_STATE_FILE" ] || return 1
+  IFS= read -r installed_fingerprint < "$INSTALL_STATE_FILE" || return 1
+  dependencies_are_ready || return 1
+  install_reuse_is_safe || return 1
+  [ "$installed_fingerprint" = "$(calculate_install_fingerprint "$@")" ] || return 1
+  return 0
+}
+
+write_install_state() {
+  local fingerprint="$1" temporary_state
+  temporary_state="$(mktemp "$WORK_DIR/.install-state.XXXXXX")"
+  printf '%s\n' "$fingerprint" > "$temporary_state"
+  mv -f "$temporary_state" "$INSTALL_STATE_FILE"
+}
+
 copy_install_metadata() {
   local filename source_file target_file workspace
   for filename in pnpm-lock.yaml pnpm-workspace.yaml .npmrc; do
@@ -190,16 +350,26 @@ link_node_modules() {
 cleanup_legacy_shadow_project
 copy_install_metadata
 
-echo "[node_modules] Installing dependencies in $WORK_DIR"
-if ! (cd "$WORK_DIR" && pnpm install "$@"); then
-  exit 1
-fi
+if install_can_be_reused "$@"; then
+  echo "[node_modules] Reusing unchanged dependencies in $WORK_DIR"
+else
+  # A stale state file must not survive a failed install.
+  rm -f "$INSTALL_STATE_FILE"
+  echo "[node_modules] Installing dependencies in $WORK_DIR"
+  if ! (cd "$WORK_DIR" && pnpm install "$@"); then
+    exit 1
+  fi
+
+  if [ -f "$WORK_DIR/pnpm-lock.yaml" ]; then
+    temporary_lockfile="$(mktemp "$PROJECT_ROOT/.pnpm-lock.yaml.XXXXXX")"
+    cp "$WORK_DIR/pnpm-lock.yaml" "$temporary_lockfile"
+    chmod 0644 "$temporary_lockfile"
+    mv -f "$temporary_lockfile" "$PROJECT_ROOT/pnpm-lock.yaml"
+  fi
 
-if [ -f "$WORK_DIR/pnpm-lock.yaml" ]; then
-  temporary_lockfile="$(mktemp "$PROJECT_ROOT/.pnpm-lock.yaml.XXXXXX")"
-  cp "$WORK_DIR/pnpm-lock.yaml" "$temporary_lockfile"
-  chmod 0644 "$temporary_lockfile"
-  mv -f "$temporary_lockfile" "$PROJECT_ROOT/pnpm-lock.yaml"
+  # pnpm may have rewritten the lockfile, so record the fingerprint of the tree as it
+  # now stands. Otherwise the next run would see a changed input and reinstall.
+  write_install_state "$(calculate_install_fingerprint "$@")"
 fi
 
 link_node_modules "$PROJECT_ROOT" "$WORK_DIR/node_modules"

package/lib/__templates__/taro/.cozeproj/scripts/prepare-node-modules.sh

@@ -98,6 +98,7 @@ printf '%s\n' "$$" > "$LOCK_DIR/pid"
 trap release_lock EXIT
 
 mkdir -p "$WORK_DIR"
+INSTALL_STATE_FILE="$WORK_DIR/.install-state"
 
 # Previous versions mirrored the whole project into WORK_DIR. That gives pnpm
 # and framework dev servers two paths for the same source tree, which breaks
@@ -118,12 +119,15 @@ cleanup_legacy_workspace() {
   done < <(find "$workspace_dir" -mindepth 1 -maxdepth 1 -print0)
 }
 
+# caches is reserved for the sibling prepare scripts of this project. They keep
+# regenerable framework output there (the Next helper points .next/dev into it), and that
+# output has to outlive an install, so this cleanup must not read it as leftover.
 cleanup_legacy_shadow_project() {
   local entry name
   while IFS= read -r -d '' entry; do
     name="$(basename "$entry")"
     case "$name" in
-      node_modules|client|server) continue ;;
+      node_modules|client|server|caches|.install-state) continue ;;
     esac
     rm -rf "$entry"
   done < <(find "$WORK_DIR" -mindepth 1 -maxdepth 1 -print0)
@@ -141,6 +145,162 @@ link_install_entry() {
   fi
 }
 
+hash_install_input() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum | awk '{print $1}'
+  elif command -v shasum >/dev/null 2>&1; then
+    shasum -a 256 | awk '{print $1}'
+  else
+    cksum | awk '{print $1 "-" $2}'
+  fi
+}
+
+append_file_to_install_fingerprint() {
+  local relative_path="$1"
+  local source_path="$PROJECT_ROOT/$relative_path"
+  printf 'path=%s\n' "$relative_path"
+  if [ -f "$source_path" ]; then
+    cat "$source_path"
+  else
+    printf '<missing>\n'
+  fi
+}
+
+append_directory_to_install_fingerprint() {
+  local relative_path="$1"
+  local source_path="$PROJECT_ROOT/$relative_path"
+  local file
+  printf 'path=%s\n' "$relative_path"
+  if [ ! -d "$source_path" ]; then
+    printf '<missing>\n'
+    return
+  fi
+
+  while IFS= read -r file; do
+    printf 'file=%s\n' "${file#"${PROJECT_ROOT}/"}"
+    cat "$file"
+  done < <(find -P "$source_path" -type f -print | LC_ALL=C sort)
+}
+
+# Everything that can change the resolved dependency tree. The leading version marker
+# invalidates every stored state when this scheme itself changes.
+calculate_install_fingerprint() {
+  local filename workspace argument
+  {
+    printf 'prepare-node-modules-install-state=1\n'
+    printf 'node-version=%s\n' "$(node --version)"
+    printf 'pnpm-version=%s\n' "$(pnpm --version)"
+    printf 'node-env=%s\n' "${NODE_ENV:-}"
+    printf 'npm-config-production=%s\n' "${npm_config_production:-}"
+    printf 'npm-config-production-upper=%s\n' "${NPM_CONFIG_PRODUCTION:-}"
+    printf 'pnpm-config-production=%s\n' "${PNPM_CONFIG_PRODUCTION:-}"
+    for argument in "$@"; do
+      printf 'install-argument=%s\n' "$argument"
+    done
+    for filename in package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc; do
+      append_file_to_install_fingerprint "$filename"
+    done
+    for workspace in client server; do
+      append_file_to_install_fingerprint "$workspace/package.json"
+    done
+    append_directory_to_install_fingerprint patches
+  } | hash_install_input
+}
+
+install_requires_refresh() {
+  local argument
+  for argument in "$@"; do
+    case "$argument" in
+      --force|-f|--lockfile-only|--fix-lockfile) return 0 ;;
+    esac
+  done
+  return 1
+}
+
+# Reuse skips pnpm install entirely, so it must not skip side effects that live outside
+# node_modules. preinstall is exempt: it only guards which package manager may run, and
+# there is no install to guard when the tree is already in place.
+package_has_install_lifecycle() {
+  local package_path="$1"
+  node - "$package_path" <<'NODE'
+const fs = require('node:fs');
+const [packagePath] = process.argv.slice(2);
+
+try {
+  const packageJson = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
+  const scripts = packageJson && typeof packageJson.scripts === 'object' && packageJson.scripts
+    ? packageJson.scripts
+    : {};
+  const hasLifecycle = ['install', 'postinstall', 'prepare'].some(
+    name => typeof scripts[name] === 'string' && scripts[name].trim() !== '',
+  );
+
+  process.exit(hasLifecycle ? 0 : 1);
+} catch {
+  process.exit(0);
+}
+NODE
+}
+
+install_reuse_is_safe() {
+  local workspace package_path
+  for package_path in "$PROJECT_ROOT/.pnpmfile.cjs" "$PROJECT_ROOT/.pnpmfile.js"; do
+    if [ -e "$package_path" ]; then
+      echo "[node_modules] Reinstalling because pnpm hooks are present: $package_path"
+      return 1
+    fi
+  done
+
+  if [ -f "$PROJECT_ROOT/.npmrc" ] && grep -Eq '^[[:space:]]*pnpmfile[[:space:]]*=' "$PROJECT_ROOT/.npmrc"; then
+    echo "[node_modules] Reinstalling because .npmrc configures a pnpm hook."
+    return 1
+  fi
+
+  for workspace in . client server; do
+    package_path="$PROJECT_ROOT/$workspace/package.json"
+    [ -f "$package_path" ] || continue
+    if package_has_install_lifecycle "$package_path"; then
+      echo "[node_modules] Reinstalling because $package_path has an install lifecycle script."
+      return 1
+    fi
+  done
+  return 0
+}
+
+dependencies_are_ready() {
+  local workspace
+  [ -f "$WORK_DIR/node_modules/.modules.yaml" ] || return 1
+  for workspace in client server; do
+    if [ -f "$PROJECT_ROOT/$workspace/package.json" ] &&
+      [ ! -f "$WORK_DIR/$workspace/node_modules/.modules.yaml" ]; then
+      return 1
+    fi
+  done
+  return 0
+}
+
+# 判断顺序按代价从小到大排。指纹要读云盘上的 lockfile 和整个 patches/，所以放最后：只有其余
+# 条件都满足、确实可能复用时才付这份开销。build.sh 和 prepare.sh 不设开关，第一行就返回了。
+install_can_be_reused() {
+  local installed_fingerprint=""
+
+  [ "${COZE_REUSE_NODE_MODULES:-}" = "1" ] || return 1
+  install_requires_refresh "$@" && return 1
+  [ -f "$INSTALL_STATE_FILE" ] || return 1
+  IFS= read -r installed_fingerprint < "$INSTALL_STATE_FILE" || return 1
+  dependencies_are_ready || return 1
+  install_reuse_is_safe || return 1
+  [ "$installed_fingerprint" = "$(calculate_install_fingerprint "$@")" ] || return 1
+  return 0
+}
+
+write_install_state() {
+  local fingerprint="$1" temporary_state
+  temporary_state="$(mktemp "$WORK_DIR/.install-state.XXXXXX")"
+  printf '%s\n' "$fingerprint" > "$temporary_state"
+  mv -f "$temporary_state" "$INSTALL_STATE_FILE"
+}
+
 copy_install_metadata() {
   local filename source_file target_file workspace
   for filename in pnpm-lock.yaml pnpm-workspace.yaml .npmrc; do
@@ -190,16 +350,26 @@ link_node_modules() {
 cleanup_legacy_shadow_project
 copy_install_metadata
 
-echo "[node_modules] Installing dependencies in $WORK_DIR"
-if ! (cd "$WORK_DIR" && pnpm install "$@"); then
-  exit 1
-fi
+if install_can_be_reused "$@"; then
+  echo "[node_modules] Reusing unchanged dependencies in $WORK_DIR"
+else
+  # A stale state file must not survive a failed install.
+  rm -f "$INSTALL_STATE_FILE"
+  echo "[node_modules] Installing dependencies in $WORK_DIR"
+  if ! (cd "$WORK_DIR" && pnpm install "$@"); then
+    exit 1
+  fi
+
+  if [ -f "$WORK_DIR/pnpm-lock.yaml" ]; then
+    temporary_lockfile="$(mktemp "$PROJECT_ROOT/.pnpm-lock.yaml.XXXXXX")"
+    cp "$WORK_DIR/pnpm-lock.yaml" "$temporary_lockfile"
+    chmod 0644 "$temporary_lockfile"
+    mv -f "$temporary_lockfile" "$PROJECT_ROOT/pnpm-lock.yaml"
+  fi
 
-if [ -f "$WORK_DIR/pnpm-lock.yaml" ]; then
-  temporary_lockfile="$(mktemp "$PROJECT_ROOT/.pnpm-lock.yaml.XXXXXX")"
-  cp "$WORK_DIR/pnpm-lock.yaml" "$temporary_lockfile"
-  chmod 0644 "$temporary_lockfile"
-  mv -f "$temporary_lockfile" "$PROJECT_ROOT/pnpm-lock.yaml"
+  # pnpm may have rewritten the lockfile, so record the fingerprint of the tree as it
+  # now stands. Otherwise the next run would see a changed input and reinstall.
+  write_install_state "$(calculate_install_fingerprint "$@")"
 fi
 
 link_node_modules "$PROJECT_ROOT" "$WORK_DIR/node_modules"

package/lib/__templates__/vite/scripts/prepare-node-modules.sh

@@ -98,6 +98,7 @@ printf '%s\n' "$$" > "$LOCK_DIR/pid"
 trap release_lock EXIT
 
 mkdir -p "$WORK_DIR"
+INSTALL_STATE_FILE="$WORK_DIR/.install-state"
 
 # Previous versions mirrored the whole project into WORK_DIR. That gives pnpm
 # and framework dev servers two paths for the same source tree, which breaks
@@ -118,12 +119,15 @@ cleanup_legacy_workspace() {
   done < <(find "$workspace_dir" -mindepth 1 -maxdepth 1 -print0)
 }
 
+# caches is reserved for the sibling prepare scripts of this project. They keep
+# regenerable framework output there (the Next helper points .next/dev into it), and that
+# output has to outlive an install, so this cleanup must not read it as leftover.
 cleanup_legacy_shadow_project() {
   local entry name
   while IFS= read -r -d '' entry; do
     name="$(basename "$entry")"
     case "$name" in
-      node_modules|client|server) continue ;;
+      node_modules|client|server|caches|.install-state) continue ;;
     esac
     rm -rf "$entry"
   done < <(find "$WORK_DIR" -mindepth 1 -maxdepth 1 -print0)
@@ -141,6 +145,162 @@ link_install_entry() {
   fi
 }
 
+hash_install_input() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum | awk '{print $1}'
+  elif command -v shasum >/dev/null 2>&1; then
+    shasum -a 256 | awk '{print $1}'
+  else
+    cksum | awk '{print $1 "-" $2}'
+  fi
+}
+
+append_file_to_install_fingerprint() {
+  local relative_path="$1"
+  local source_path="$PROJECT_ROOT/$relative_path"
+  printf 'path=%s\n' "$relative_path"
+  if [ -f "$source_path" ]; then
+    cat "$source_path"
+  else
+    printf '<missing>\n'
+  fi
+}
+
+append_directory_to_install_fingerprint() {
+  local relative_path="$1"
+  local source_path="$PROJECT_ROOT/$relative_path"
+  local file
+  printf 'path=%s\n' "$relative_path"
+  if [ ! -d "$source_path" ]; then
+    printf '<missing>\n'
+    return
+  fi
+
+  while IFS= read -r file; do
+    printf 'file=%s\n' "${file#"${PROJECT_ROOT}/"}"
+    cat "$file"
+  done < <(find -P "$source_path" -type f -print | LC_ALL=C sort)
+}
+
+# Everything that can change the resolved dependency tree. The leading version marker
+# invalidates every stored state when this scheme itself changes.
+calculate_install_fingerprint() {
+  local filename workspace argument
+  {
+    printf 'prepare-node-modules-install-state=1\n'
+    printf 'node-version=%s\n' "$(node --version)"
+    printf 'pnpm-version=%s\n' "$(pnpm --version)"
+    printf 'node-env=%s\n' "${NODE_ENV:-}"
+    printf 'npm-config-production=%s\n' "${npm_config_production:-}"
+    printf 'npm-config-production-upper=%s\n' "${NPM_CONFIG_PRODUCTION:-}"
+    printf 'pnpm-config-production=%s\n' "${PNPM_CONFIG_PRODUCTION:-}"
+    for argument in "$@"; do
+      printf 'install-argument=%s\n' "$argument"
+    done
+    for filename in package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc; do
+      append_file_to_install_fingerprint "$filename"
+    done
+    for workspace in client server; do
+      append_file_to_install_fingerprint "$workspace/package.json"
+    done
+    append_directory_to_install_fingerprint patches
+  } | hash_install_input
+}
+
+install_requires_refresh() {
+  local argument
+  for argument in "$@"; do
+    case "$argument" in
+      --force|-f|--lockfile-only|--fix-lockfile) return 0 ;;
+    esac
+  done
+  return 1
+}
+
+# Reuse skips pnpm install entirely, so it must not skip side effects that live outside
+# node_modules. preinstall is exempt: it only guards which package manager may run, and
+# there is no install to guard when the tree is already in place.
+package_has_install_lifecycle() {
+  local package_path="$1"
+  node - "$package_path" <<'NODE'
+const fs = require('node:fs');
+const [packagePath] = process.argv.slice(2);
+
+try {
+  const packageJson = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
+  const scripts = packageJson && typeof packageJson.scripts === 'object' && packageJson.scripts
+    ? packageJson.scripts
+    : {};
+  const hasLifecycle = ['install', 'postinstall', 'prepare'].some(
+    name => typeof scripts[name] === 'string' && scripts[name].trim() !== '',
+  );
+
+  process.exit(hasLifecycle ? 0 : 1);
+} catch {
+  process.exit(0);
+}
+NODE
+}
+
+install_reuse_is_safe() {
+  local workspace package_path
+  for package_path in "$PROJECT_ROOT/.pnpmfile.cjs" "$PROJECT_ROOT/.pnpmfile.js"; do
+    if [ -e "$package_path" ]; then
+      echo "[node_modules] Reinstalling because pnpm hooks are present: $package_path"
+      return 1
+    fi
+  done
+
+  if [ -f "$PROJECT_ROOT/.npmrc" ] && grep -Eq '^[[:space:]]*pnpmfile[[:space:]]*=' "$PROJECT_ROOT/.npmrc"; then
+    echo "[node_modules] Reinstalling because .npmrc configures a pnpm hook."
+    return 1
+  fi
+
+  for workspace in . client server; do
+    package_path="$PROJECT_ROOT/$workspace/package.json"
+    [ -f "$package_path" ] || continue
+    if package_has_install_lifecycle "$package_path"; then
+      echo "[node_modules] Reinstalling because $package_path has an install lifecycle script."
+      return 1
+    fi
+  done
+  return 0
+}
+
+dependencies_are_ready() {
+  local workspace
+  [ -f "$WORK_DIR/node_modules/.modules.yaml" ] || return 1
+  for workspace in client server; do
+    if [ -f "$PROJECT_ROOT/$workspace/package.json" ] &&
+      [ ! -f "$WORK_DIR/$workspace/node_modules/.modules.yaml" ]; then
+      return 1
+    fi
+  done
+  return 0
+}
+
+# 判断顺序按代价从小到大排。指纹要读云盘上的 lockfile 和整个 patches/，所以放最后：只有其余
+# 条件都满足、确实可能复用时才付这份开销。build.sh 和 prepare.sh 不设开关，第一行就返回了。
+install_can_be_reused() {
+  local installed_fingerprint=""
+
+  [ "${COZE_REUSE_NODE_MODULES:-}" = "1" ] || return 1
+  install_requires_refresh "$@" && return 1
+  [ -f "$INSTALL_STATE_FILE" ] || return 1
+  IFS= read -r installed_fingerprint < "$INSTALL_STATE_FILE" || return 1
+  dependencies_are_ready || return 1
+  install_reuse_is_safe || return 1
+  [ "$installed_fingerprint" = "$(calculate_install_fingerprint "$@")" ] || return 1
+  return 0
+}
+
+write_install_state() {
+  local fingerprint="$1" temporary_state
+  temporary_state="$(mktemp "$WORK_DIR/.install-state.XXXXXX")"
+  printf '%s\n' "$fingerprint" > "$temporary_state"
+  mv -f "$temporary_state" "$INSTALL_STATE_FILE"
+}
+
 copy_install_metadata() {
   local filename source_file target_file workspace
   for filename in pnpm-lock.yaml pnpm-workspace.yaml .npmrc; do
@@ -190,16 +350,26 @@ link_node_modules() {
 cleanup_legacy_shadow_project
 copy_install_metadata
 
-echo "[node_modules] Installing dependencies in $WORK_DIR"
-if ! (cd "$WORK_DIR" && pnpm install "$@"); then
-  exit 1
-fi
+if install_can_be_reused "$@"; then
+  echo "[node_modules] Reusing unchanged dependencies in $WORK_DIR"
+else
+  # A stale state file must not survive a failed install.
+  rm -f "$INSTALL_STATE_FILE"
+  echo "[node_modules] Installing dependencies in $WORK_DIR"
+  if ! (cd "$WORK_DIR" && pnpm install "$@"); then
+    exit 1
+  fi
+
+  if [ -f "$WORK_DIR/pnpm-lock.yaml" ]; then
+    temporary_lockfile="$(mktemp "$PROJECT_ROOT/.pnpm-lock.yaml.XXXXXX")"
+    cp "$WORK_DIR/pnpm-lock.yaml" "$temporary_lockfile"
+    chmod 0644 "$temporary_lockfile"
+    mv -f "$temporary_lockfile" "$PROJECT_ROOT/pnpm-lock.yaml"
+  fi
 
-if [ -f "$WORK_DIR/pnpm-lock.yaml" ]; then
-  temporary_lockfile="$(mktemp "$PROJECT_ROOT/.pnpm-lock.yaml.XXXXXX")"
-  cp "$WORK_DIR/pnpm-lock.yaml" "$temporary_lockfile"
-  chmod 0644 "$temporary_lockfile"
-  mv -f "$temporary_lockfile" "$PROJECT_ROOT/pnpm-lock.yaml"
+  # pnpm may have rewritten the lockfile, so record the fingerprint of the tree as it
+  # now stands. Otherwise the next run would see a changed input and reinstall.
+  write_install_state "$(calculate_install_fingerprint "$@")"
 fi
 
 link_node_modules "$PROJECT_ROOT" "$WORK_DIR/node_modules"

package/lib/cli.js

@@ -2114,7 +2114,7 @@ const EventBuilder = {
 };
 
 var name = "@coze-arch/cli";
-var version = "0.1.7";
+var version = "0.1.8-alpha.6e99f9";
 var description = "coze coding devtools cli";
 var license = "MIT";
 var author = "fanwenjie.fe@bytedance.com";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coze-arch/cli",
-  "version": "0.1.7",
+  "version": "0.1.8-alpha.6e99f9",
   "private": false,
   "description": "coze coding devtools cli",
   "license": "MIT",