@coze-arch/cli 0.1.8 → 0.1.9-alpha.ce005e

package/lib/__templates__/taro/.cozeproj/scripts/local-workspace.cjs

@@ -0,0 +1,351 @@
+#!/usr/bin/env node
+// Taro source is owned by Drive. Only these wrappers may write to the local workspace.
+/* eslint-disable @typescript-eslint/no-require-imports -- Standalone CommonJS runtime shipped without CLI dependencies. */
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+const { createHash } = require('node:crypto');
+const { spawn, execFileSync } = require('node:child_process');
+const { setTimeout: delay } = require('node:timers/promises');
+
+const scriptRoot = fs.realpathSync(path.resolve(__dirname, '..', '..'));
+const source = fs.realpathSync(
+  process.env.COZE_TARO_LOCAL_ACTIVE === scriptRoot && process.env.COZE_TARO_SOURCE_PATH
+    ? process.env.COZE_TARO_SOURCE_PATH : scriptRoot,
+);
+const drivePath = path.resolve(process.env.COZE_DRIVE_ROOT || '/Coze/Drive');
+const drive = fs.existsSync(drivePath) ? fs.realpathSync(drivePath) : drivePath;
+const inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path.sep}`);
+const onDrive = inside(drive, source);
+const digest = value => createHash('sha256').update(value).digest('hex');
+// Separate from /tmp/nm: older dependency helpers clean unknown entries there.
+const cacheRoot = path.join(os.tmpdir(), `coze-taro-${process.getuid()}`);
+const projectCache = path.join(cacheRoot, digest(source));
+const exclusions = [
+  'node_modules', '.git', '/logs', '.pnpm-store', '.next', '.nuxt', '.output',
+  '/dist', '/dist-web', '/dist-tt', '/server/dist', '/dist-server', '.cache', '.turbo', '*.tsbuildinfo',
+  '.eslintcache', '.stylelintcache', '/next-env.d.ts',
+];
+const outputDirs = ['dist', 'dist-web', 'dist-tt', 'server/dist'];
+const taroOutputDirs = {
+  web: 'dist-web',
+  h5: 'dist-web',
+  weapp: 'dist',
+  tt: 'dist-tt',
+};
+const installArgs = ['install', '--prefer-frozen-lockfile', '--prefer-offline'];
+let interrupted = false;
+const children = new Set();
+
+function stopTree(child) {
+  if (!child.pid || child.exitCode !== null) return;
+  // Keep descendants in the detached launcher's group so readiness ownership works.
+  // Also stop grandchildren when the test/foreground path is signalled directly.
+  let rows = [];
+  try {
+    rows = execFileSync('ps', ['-axo', 'pid=,ppid='], { encoding: 'utf8' })
+      .trim().split('\n').map(line => line.trim().split(/\s+/).map(Number));
+  } catch { /* The launcher still owns and reaps its process group. */ }
+  const pids = [child.pid];
+  for (let i = 0; i < pids.length; i++) {
+    for (const [pid, parent] of rows) if (parent === pids[i]) pids.push(pid);
+  }
+  for (const pid of pids.reverse()) {
+    try { process.kill(pid, 'SIGTERM'); } catch { /* Already exited. */ }
+  }
+  const timer = setTimeout(() => {
+    for (const pid of pids) {
+      try { process.kill(pid, 'SIGKILL'); } catch { /* Already exited. */ }
+    }
+  }, 2000);
+  timer.unref();
+}
+
+for (const signal of ['SIGINT', 'SIGTERM']) {
+  process.on(signal, () => {
+    interrupted = true;
+    process.exitCode = signal === 'SIGINT' ? 130 : 143;
+    for (const child of children) stopTree(child);
+  });
+}
+
+function run(command, args, cwd, env = process.env) {
+  if (interrupted) return Promise.reject(new Error('Interrupted'));
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, { cwd, env, stdio: 'inherit' });
+    children.add(child);
+    child.once('error', error => { children.delete(child); reject(error); });
+    child.once('exit', (code, signal) => {
+      children.delete(child);
+      if (code === 0) resolve();
+      else reject(new Error(`${command} exited with ${signal || code}`));
+    });
+  });
+}
+
+function ensureCache() {
+  for (const dir of [cacheRoot, projectCache]) {
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    if (fs.lstatSync(dir).isSymbolicLink() || fs.statSync(dir).uid !== process.getuid()) {
+      throw new Error(`Refusing unmanaged workspace directory: ${dir}`);
+    }
+    if (inside(drive, fs.realpathSync(dir))) {
+      throw new Error(`Local workspace must be outside Coze Drive: ${dir}`);
+    }
+  }
+}
+
+async function locked(action, name = 'sync') {
+  const lock = path.join(projectCache, `${name}.lock`);
+  const started = Date.now();
+  let missingOwner = 0;
+  while (true) {
+    if (interrupted) throw new Error('Interrupted');
+    try { fs.mkdirSync(lock); break; } catch (error) {
+      if (error.code !== 'EEXIST') throw error;
+    }
+    let alive = false;
+    try {
+      const pid = Number(fs.readFileSync(path.join(lock, 'pid'), 'utf8'));
+      if (Number.isInteger(pid) && pid > 0) { process.kill(pid, 0); alive = true; }
+    } catch (error) { if (error.code === 'EPERM') alive = true; }
+    missingOwner = alive ? 0 : missingOwner + 1;
+    if (missingOwner >= 2) {
+      const stale = `${lock}.stale-${process.pid}`;
+      try {
+        fs.renameSync(lock, stale);
+        fs.rmSync(stale, { recursive: true });
+      } catch (error) { if (error.code !== 'ENOENT') throw error; }
+      missingOwner = 0;
+      continue;
+    }
+    if (Date.now() - started > 120000) throw new Error(`Timed out waiting for ${lock}`);
+    await delay(500);
+  }
+  fs.writeFileSync(path.join(lock, 'pid'), String(process.pid));
+  try { return await action(); }
+  finally { fs.rmSync(lock, { recursive: true, force: true }); }
+}
+
+async function sync(local) {
+  if (!fs.existsSync(path.join(source, 'package.json'))) {
+    throw new Error(`Source project is unavailable: ${source}`);
+  }
+  fs.mkdirSync(local, { recursive: true });
+  if (fs.realpathSync(local) !== local) throw new Error(`Refusing workspace symlink: ${local}`);
+  // Checksums catch same-size edits with unchanged/epoch Drive mtimes. Do not use -t:
+  // changed local files get fresh mtimes and unchanged files retain watcher snapshots.
+  // Materialize source links so the framework never follows them back onto Drive.
+  await run('rsync', [
+    '-rLp', '--checksum', '--delete', '--delay-updates',
+    ...exclusions.map(entry => `--exclude=${entry}`), `${source}/`, `${local}/`,
+  ], source);
+}
+
+function readOptional(file) {
+  try { return fs.readFileSync(file); }
+  catch (error) { if (error.code === 'ENOENT') return Buffer.alloc(0); throw error; }
+}
+
+function installInput(root) {
+  const hash = createHash('sha256');
+  const visit = (dir, all = false) => {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      if (['node_modules', '.git', 'logs', '.pnpm-store', '.next', '.nuxt', '.output', 'dist', 'dist-web', 'dist-tt', 'dist-server', '.cache', '.turbo'].includes(entry.name)) continue;
+      const file = path.join(dir, entry.name);
+      // Follow source links just as rsync -L does, while detecting loops explicitly.
+      const real = fs.realpathSync(file);
+      if (entry.isDirectory() || (entry.isSymbolicLink() && fs.statSync(file).isDirectory())) {
+        if (ancestors.has(real)) throw new Error(`Source symlink cycle: ${file}`);
+        ancestors.add(real);
+        visit(file, all || entry.name === 'patches');
+        ancestors.delete(real);
+      }
+      else if (all || ['package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml', '.npmrc', '.pnpmfile.cjs', '.pnpmfile.js'].includes(entry.name)) {
+        hash.update(path.relative(root, file)).update('\0').update(readOptional(file)).update('\0');
+      }
+    }
+  };
+  const ancestors = new Set([fs.realpathSync(root)]);
+  visit(root);
+  return hash.digest('hex');
+}
+
+function localEnv(local) {
+  return {
+    ...process.env,
+    COZE_TARO_LOCAL_ACTIVE: local,
+    COZE_TARO_SOURCE_PATH: source,
+    COZE_TARO_LOCAL_MIRROR: onDrive ? '1' : '',
+    COZE_WORKSPACE_PATH: local,
+    // Keep the existing discoverable log/PID location in the source project.
+    COZE_LOG_DIR: process.env.COZE_LOG_DIR || path.join(source, 'logs'),
+    PWD: local,
+    INIT_CWD: local,
+    ...(onDrive ? { npm_config_store_dir: path.join(cacheRoot, 'store') } : {}),
+  };
+}
+
+async function install(local, mode) {
+  const state = path.join(projectCache, `${mode}.install`);
+  const version = execFileSync('pnpm', ['--version'], { encoding: 'utf8' }).trim();
+  const fingerprint = () => digest([
+    installInput(local), version, process.version, process.env.NODE_ENV,
+    process.env.npm_config_production, process.env.NPM_CONFIG_PRODUCTION,
+    process.env.PNPM_CONFIG_PRODUCTION,
+  ].join('\n'));
+  // Lifecycle scripts may generate files from arbitrary source, so do not reuse
+  // their install based on dependency metadata alone. Read manifests as text here
+  // (no executable hooks or private CLI dependencies in the standalone helper).
+  const manifest = readOptional(path.join(local, 'package.json')).toString();
+  const hasLifecycle = /"(?:install|postinstall|prepare)"\s*:/.test(manifest);
+  const hasHooks = ['.pnpmfile.cjs', '.pnpmfile.js'].some(file => fs.existsSync(path.join(local, file))) ||
+    /^\s*pnpmfile\s*=/m.test(readOptional(path.join(local, '.npmrc')).toString());
+  if (!hasLifecycle && !hasHooks && readOptional(state).toString() === fingerprint() &&
+      fs.existsSync(path.join(local, 'node_modules', '.modules.yaml'))) return;
+  fs.rmSync(state, { force: true });
+  const before = installInput(source);
+  if (before !== installInput(local)) {
+    throw new Error('Dependency inputs changed during sync; rerun dev_build.sh.');
+  }
+  await run('pnpm', [...installArgs, '--store-dir', path.join(cacheRoot, 'store')], local, localEnv(local));
+  if (before !== installInput(source)) {
+    throw new Error('Dependency inputs changed on Drive during installation; rerun dev_build.sh. Lockfile was not overwritten.');
+  }
+  const lockfile = path.join(local, 'pnpm-lock.yaml');
+  if (fs.existsSync(lockfile) && !readOptional(lockfile).equals(readOptional(path.join(source, 'pnpm-lock.yaml')))) {
+    const temporary = path.join(source, `.pnpm-lock.yaml.${process.pid}.tmp`);
+    try {
+      fs.copyFileSync(lockfile, temporary);
+      fs.renameSync(temporary, path.join(source, 'pnpm-lock.yaml'));
+    } finally { fs.rmSync(temporary, { force: true }); }
+  }
+  fs.writeFileSync(state, fingerprint());
+}
+
+async function watch(args) {
+  const local = fs.realpathSync(process.env.COZE_TARO_LOCAL_ACTIVE || path.resolve(__dirname, '..', '..'));
+  if (!onDrive) return run(args[0], args.slice(1), local);
+  ensureCache();
+  if (local !== path.join(fs.realpathSync(projectCache), 'dev')) {
+    throw new Error(`Refusing to watch an unmanaged workspace: ${local}`);
+  }
+  const preparedInput = installInput(local);
+  let running = true;
+  let syncError;
+  const command = run(args[0], args.slice(1), local).finally(() => { running = false; });
+  const poll = (async () => {
+    while (running && !interrupted) {
+      await delay(1000);
+      if (!running || interrupted) break;
+      try {
+        await locked(async () => {
+          await sync(local);
+          if (installInput(local) !== preparedInput) {
+            throw new Error('Dependency inputs changed; rerun dev_build.sh and dev_run.sh before previewing.');
+          }
+        });
+      }
+      catch (error) {
+        syncError = error;
+        for (const child of children) stopTree(child);
+        break;
+      }
+    }
+  })();
+  const results = await Promise.allSettled([command, poll]);
+  if (syncError) throw syncError;
+  if (results[0].status === 'rejected') throw results[0].reason;
+}
+
+async function syncOutputBack(local, outputs = outputDirs) {
+  for (const output of outputs) {
+    const localOutput = path.join(local, output);
+    const sourceOutput = path.join(source, output);
+    if (!fs.existsSync(localOutput)) continue;
+    fs.rmSync(sourceOutput, { recursive: true, force: true });
+    fs.mkdirSync(path.dirname(sourceOutput), { recursive: true });
+    await run('rsync', ['-a', '--delete', `${localOutput}/`, `${sourceOutput}/`], local);
+  }
+}
+
+function cleanOutputs(local, outputs = outputDirs) {
+  for (const output of outputs) {
+    fs.rmSync(path.join(local, output), { recursive: true, force: true });
+  }
+}
+
+function taroBuildOutput(args) {
+  const target = args[1] === 'h5' ? 'web' : args[1];
+  const output = taroOutputDirs[target];
+  if (!output) throw new Error(`Unknown Taro build target: ${args[1] || ''}`);
+  return output;
+}
+
+function runScript(script, local, args) {
+  const scriptPath = path.join(local, '.cozeproj', 'scripts', script);
+  if (script.endsWith('.cjs')) {
+    return run(process.execPath, [scriptPath, ...args], local, localEnv(local));
+  }
+  return run('bash', [scriptPath, ...args], local, localEnv(local));
+}
+
+async function main() {
+  const [action, ...args] = process.argv.slice(2);
+  if (action === 'watch') return watch(args);
+  if (!['prepare', 'dev', 'build', 'pack', 'validate', 'taro-build'].includes(action)) throw new Error(`Unknown Taro action: ${action}`);
+  const scriptByAction = {
+    prepare: 'dev_build.sh',
+    dev: 'dev_run.sh',
+    build: 'deploy_build.sh',
+    pack: 'pack.sh',
+    validate: 'validate.sh',
+    'taro-build': 'taro-build.cjs',
+  };
+  if (!onDrive) {
+    return runScript(scriptByAction[action], source, args);
+  }
+  ensureCache();
+  const mode = action === 'validate' ? 'check' : action === 'build' || action === 'pack' || action === 'taro-build' ? 'build' : 'dev';
+  const local = path.join(fs.realpathSync(projectCache), mode);
+  console.log(`[taro] Source: ${source}\n[taro] Local ${mode} workspace: ${local}`);
+  if (action === 'taro-build') {
+    const output = taroBuildOutput(args);
+    return locked(async () => {
+      await sync(local);
+      await install(local, mode);
+      cleanOutputs(local, [output]);
+      await runScript(scriptByAction[action], local, args);
+      await locked(async () => {
+        await syncOutputBack(local, [output]);
+      }, 'output');
+    }, mode);
+  }
+  if (action === 'validate') {
+    return locked(async () => {
+      await locked(async () => {
+        await sync(local);
+        await install(local, mode);
+      });
+      await runScript('validate.sh', local, args);
+    }, 'check');
+  }
+  await locked(async () => {
+    await sync(local);
+    await install(local, mode);
+  }, mode);
+  if (action === 'build' || action === 'pack') {
+    cleanOutputs(local);
+  }
+  await runScript(scriptByAction[action], local, args);
+  if (action === 'build' || action === 'pack') {
+    await locked(async () => {
+      await syncOutputBack(local);
+    }, 'output');
+  }
+}
+
+main().catch(error => {
+  console.error(`[taro] ${error.message}`);
+  process.exitCode = process.exitCode || 1;
+});

package/lib/__templates__/taro/.cozeproj/scripts/pack.sh

@@ -1,13 +1,18 @@
 #!/bin/bash
+set -Eeuo pipefail
 
 ROOT_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
+if [[ "${COZE_TARO_LOCAL_ACTIVE:-}" != "${ROOT_DIR}" ]]; then
+    exec node "$ROOT_DIR/.cozeproj/scripts/local-workspace.cjs" pack "$@"
+fi
 COZE_WORKSPACE_PATH="${COZE_WORKSPACE_PATH:-${ROOT_DIR}}"
 export COZE_WORKSPACE_PATH
 
 cd "${COZE_WORKSPACE_PATH}"
 
-# build_weapp.sh - 通过 PID 文件精确杀掉自己上次的构建进程
-PID_FILE="/tmp/coze-build_weapp.pid"
+LOG_DIR="${COZE_LOG_DIR:-/tmp}"
+mkdir -p "$LOG_DIR"
+PID_FILE="$LOG_DIR/coze-build_weapp.pid"
 
 # 杀掉上次的构建进程组
 if [ -f "$PID_FILE" ]; then
@@ -21,11 +26,16 @@ if [ -f "$PID_FILE" ]; then
     rm -f "$PID_FILE"
 fi
 
-# 用 setsid 创建新的进程组，方便下次整组杀掉
-setsid pnpm build:pack &
-echo $! > "$PID_FILE"
+# 用 setsid 创建新的进程组，方便下次整组杀掉；无 setsid 的环境退化为普通后台进程。
+if command -v setsid >/dev/null 2>&1; then
+    setsid pnpm build:pack &
+else
+    pnpm build:pack &
+fi
+BUILD_PID=$!
+echo "$BUILD_PID" > "$PID_FILE"
 
 echo "构建已启动 (PID: $(cat $PID_FILE))"
 
-wait $!
+wait "$BUILD_PID"
 rm -f "$PID_FILE"

package/lib/__templates__/taro/.cozeproj/scripts/prepare-node-modules.sh

@@ -98,6 +98,7 @@ printf '%s\n' "$$" > "$LOCK_DIR/pid"
 trap release_lock EXIT
 
 mkdir -p "$WORK_DIR"
+INSTALL_STATE_FILE="$WORK_DIR/.install-state"
 
 # Previous versions mirrored the whole project into WORK_DIR. That gives pnpm
 # and framework dev servers two paths for the same source tree, which breaks
@@ -118,12 +119,13 @@ cleanup_legacy_workspace() {
   done < <(find "$workspace_dir" -mindepth 1 -maxdepth 1 -print0)
 }
 
+# Preserve existing project caches during dependency preparation.
 cleanup_legacy_shadow_project() {
   local entry name
   while IFS= read -r -d '' entry; do
     name="$(basename "$entry")"
     case "$name" in
-      node_modules|client|server) continue ;;
+      node_modules|client|server|caches|.install-state) continue ;;
     esac
     rm -rf "$entry"
   done < <(find "$WORK_DIR" -mindepth 1 -maxdepth 1 -print0)
@@ -141,6 +143,162 @@ link_install_entry() {
   fi
 }
 
+hash_install_input() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum | awk '{print $1}'
+  elif command -v shasum >/dev/null 2>&1; then
+    shasum -a 256 | awk '{print $1}'
+  else
+    cksum | awk '{print $1 "-" $2}'
+  fi
+}
+
+append_file_to_install_fingerprint() {
+  local relative_path="$1"
+  local source_path="$PROJECT_ROOT/$relative_path"
+  printf 'path=%s\n' "$relative_path"
+  if [ -f "$source_path" ]; then
+    cat "$source_path"
+  else
+    printf '<missing>\n'
+  fi
+}
+
+append_directory_to_install_fingerprint() {
+  local relative_path="$1"
+  local source_path="$PROJECT_ROOT/$relative_path"
+  local file
+  printf 'path=%s\n' "$relative_path"
+  if [ ! -d "$source_path" ]; then
+    printf '<missing>\n'
+    return
+  fi
+
+  while IFS= read -r file; do
+    printf 'file=%s\n' "${file#"${PROJECT_ROOT}/"}"
+    cat "$file"
+  done < <(find -P "$source_path" -type f -print | LC_ALL=C sort)
+}
+
+# Everything that can change the resolved dependency tree. The leading version marker
+# invalidates every stored state when this scheme itself changes.
+calculate_install_fingerprint() {
+  local filename workspace argument
+  {
+    printf 'prepare-node-modules-install-state=1\n'
+    printf 'node-version=%s\n' "$(node --version)"
+    printf 'pnpm-version=%s\n' "$(pnpm --version)"
+    printf 'node-env=%s\n' "${NODE_ENV:-}"
+    printf 'npm-config-production=%s\n' "${npm_config_production:-}"
+    printf 'npm-config-production-upper=%s\n' "${NPM_CONFIG_PRODUCTION:-}"
+    printf 'pnpm-config-production=%s\n' "${PNPM_CONFIG_PRODUCTION:-}"
+    for argument in "$@"; do
+      printf 'install-argument=%s\n' "$argument"
+    done
+    for filename in package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc; do
+      append_file_to_install_fingerprint "$filename"
+    done
+    for workspace in client server; do
+      append_file_to_install_fingerprint "$workspace/package.json"
+    done
+    append_directory_to_install_fingerprint patches
+  } | hash_install_input
+}
+
+install_requires_refresh() {
+  local argument
+  for argument in "$@"; do
+    case "$argument" in
+      --force|-f|--lockfile-only|--fix-lockfile) return 0 ;;
+    esac
+  done
+  return 1
+}
+
+# Reuse skips pnpm install entirely, so it must not skip side effects that live outside
+# node_modules. preinstall is exempt: it only guards which package manager may run, and
+# there is no install to guard when the tree is already in place.
+package_has_install_lifecycle() {
+  local package_path="$1"
+  node - "$package_path" <<'NODE'
+const fs = require('node:fs');
+const [packagePath] = process.argv.slice(2);
+
+try {
+  const packageJson = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
+  const scripts = packageJson && typeof packageJson.scripts === 'object' && packageJson.scripts
+    ? packageJson.scripts
+    : {};
+  const hasLifecycle = ['install', 'postinstall', 'prepare'].some(
+    name => typeof scripts[name] === 'string' && scripts[name].trim() !== '',
+  );
+
+  process.exit(hasLifecycle ? 0 : 1);
+} catch {
+  process.exit(0);
+}
+NODE
+}
+
+install_reuse_is_safe() {
+  local workspace package_path
+  for package_path in "$PROJECT_ROOT/.pnpmfile.cjs" "$PROJECT_ROOT/.pnpmfile.js"; do
+    if [ -e "$package_path" ]; then
+      echo "[node_modules] Reinstalling because pnpm hooks are present: $package_path"
+      return 1
+    fi
+  done
+
+  if [ -f "$PROJECT_ROOT/.npmrc" ] && grep -Eq '^[[:space:]]*pnpmfile[[:space:]]*=' "$PROJECT_ROOT/.npmrc"; then
+    echo "[node_modules] Reinstalling because .npmrc configures a pnpm hook."
+    return 1
+  fi
+
+  for workspace in . client server; do
+    package_path="$PROJECT_ROOT/$workspace/package.json"
+    [ -f "$package_path" ] || continue
+    if package_has_install_lifecycle "$package_path"; then
+      echo "[node_modules] Reinstalling because $package_path has an install lifecycle script."
+      return 1
+    fi
+  done
+  return 0
+}
+
+dependencies_are_ready() {
+  local workspace
+  [ -f "$WORK_DIR/node_modules/.modules.yaml" ] || return 1
+  for workspace in client server; do
+    if [ -f "$PROJECT_ROOT/$workspace/package.json" ] &&
+      [ ! -f "$WORK_DIR/$workspace/node_modules/.modules.yaml" ]; then
+      return 1
+    fi
+  done
+  return 0
+}
+
+# 判断顺序按代价从小到大排。指纹要读云盘上的 lockfile 和整个 patches/，所以放最后：只有其余
+# 条件都满足、确实可能复用时才付这份开销。build.sh 和 prepare.sh 不设开关，第一行就返回了。
+install_can_be_reused() {
+  local installed_fingerprint=""
+
+  [ "${COZE_REUSE_NODE_MODULES:-}" = "1" ] || return 1
+  install_requires_refresh "$@" && return 1
+  [ -f "$INSTALL_STATE_FILE" ] || return 1
+  IFS= read -r installed_fingerprint < "$INSTALL_STATE_FILE" || return 1
+  dependencies_are_ready || return 1
+  install_reuse_is_safe || return 1
+  [ "$installed_fingerprint" = "$(calculate_install_fingerprint "$@")" ] || return 1
+  return 0
+}
+
+write_install_state() {
+  local fingerprint="$1" temporary_state
+  temporary_state="$(mktemp "$WORK_DIR/.install-state.XXXXXX")"
+  printf '%s\n' "$fingerprint" > "$temporary_state"
+  mv -f "$temporary_state" "$INSTALL_STATE_FILE"
+}
+
 copy_install_metadata() {
   local filename source_file target_file workspace
   for filename in pnpm-lock.yaml pnpm-workspace.yaml .npmrc; do
@@ -190,16 +348,26 @@ link_node_modules() {
 cleanup_legacy_shadow_project
 copy_install_metadata
 
-echo "[node_modules] Installing dependencies in $WORK_DIR"
-if ! (cd "$WORK_DIR" && pnpm install "$@"); then
-  exit 1
-fi
+if install_can_be_reused "$@"; then
+  echo "[node_modules] Reusing unchanged dependencies in $WORK_DIR"
+else
+  # A stale state file must not survive a failed install.
+  rm -f "$INSTALL_STATE_FILE"
+  echo "[node_modules] Installing dependencies in $WORK_DIR"
+  if ! (cd "$WORK_DIR" && pnpm install "$@"); then
+    exit 1
+  fi
+
+  if [ -f "$WORK_DIR/pnpm-lock.yaml" ]; then
+    temporary_lockfile="$(mktemp "$PROJECT_ROOT/.pnpm-lock.yaml.XXXXXX")"
+    cp "$WORK_DIR/pnpm-lock.yaml" "$temporary_lockfile"
+    chmod 0644 "$temporary_lockfile"
+    mv -f "$temporary_lockfile" "$PROJECT_ROOT/pnpm-lock.yaml"
+  fi
 
-if [ -f "$WORK_DIR/pnpm-lock.yaml" ]; then
-  temporary_lockfile="$(mktemp "$PROJECT_ROOT/.pnpm-lock.yaml.XXXXXX")"
-  cp "$WORK_DIR/pnpm-lock.yaml" "$temporary_lockfile"
-  chmod 0644 "$temporary_lockfile"
-  mv -f "$temporary_lockfile" "$PROJECT_ROOT/pnpm-lock.yaml"
+  # pnpm may have rewritten the lockfile, so record the fingerprint of the tree as it
+  # now stands. Otherwise the next run would see a changed input and reinstall.
+  write_install_state "$(calculate_install_fingerprint "$@")"
 fi
 
 link_node_modules "$PROJECT_ROOT" "$WORK_DIR/node_modules"

package/lib/__templates__/taro/.cozeproj/scripts/taro-build.cjs

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+/* eslint-disable @typescript-eslint/no-require-imports -- Standalone CommonJS runtime shipped without CLI dependencies. */
+const fs = require('node:fs');
+const path = require('node:path');
+const { spawn } = require('node:child_process');
+
+const scriptRoot = fs.realpathSync(path.resolve(__dirname, '..', '..'));
+const [action, target, ...extraArgs] = process.argv.slice(2);
+const normalizedTarget = target === 'h5' ? 'web' : target;
+const taroTypeByTarget = {
+  web: 'h5',
+  weapp: 'weapp',
+  tt: 'tt',
+};
+const validTargets = new Set(['web', 'weapp', 'tt']);
+const validActions = new Set(['build', 'preview']);
+
+function run(command, args, options = {}) {
+  const child = spawn(command, args, {
+    cwd: options.cwd || process.cwd(),
+    env: options.env || process.env,
+    stdio: 'inherit',
+  });
+  child.once('exit', (code, signal) => {
+    if (signal) {
+      process.kill(process.pid, signal);
+      return;
+    }
+    process.exit(code || 0);
+  });
+  child.once('error', error => {
+    console.error(error.message);
+    process.exit(1);
+  });
+}
+
+if (!validActions.has(action) || !validTargets.has(normalizedTarget)) {
+  console.error('Usage: taro-build.cjs <build|preview> <web|weapp|tt|h5> [...args]');
+  process.exit(1);
+}
+
+if (action === 'preview' && normalizedTarget === 'web') {
+  console.error('Taro preview is only supported for weapp or tt.');
+  process.exit(1);
+}
+
+if (process.env.COZE_TARO_LOCAL_ACTIVE !== scriptRoot) {
+  run(process.execPath, [
+    path.join(scriptRoot, '.cozeproj', 'scripts', 'local-workspace.cjs'),
+    'taro-build',
+    action,
+    normalizedTarget,
+    ...extraArgs,
+  ], { cwd: scriptRoot });
+  return;
+}
+
+const taroArgs = ['exec', 'taro', 'build', '--type', taroTypeByTarget[normalizedTarget]];
+if (action === 'preview') {
+  taroArgs.push('--preview');
+}
+taroArgs.push(...extraArgs);
+
+run('pnpm', taroArgs, {
+  cwd: process.env.COZE_WORKSPACE_PATH || scriptRoot,
+});

package/lib/__templates__/taro/.cozeproj/scripts/validate.sh

@@ -2,6 +2,9 @@
 set -Eeuo pipefail
 
 ROOT_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
+if [[ "${COZE_TARO_LOCAL_ACTIVE:-}" != "${ROOT_DIR}" ]]; then
+    exec node "$ROOT_DIR/.cozeproj/scripts/local-workspace.cjs" validate "$@"
+fi
 COZE_WORKSPACE_PATH="${COZE_WORKSPACE_PATH:-${ROOT_DIR}}"
 export COZE_WORKSPACE_PATH