@nocobase/cli 2.1.11-test.9 → 2.1.12-test.1

package/dist/commands/install.js

@@ -1468,8 +1468,6 @@ export default class Install extends Command {
                 '-d',
                 '--name',
                 containerName,
-                '--restart',
-                'always',
                 '--network',
                 networkName,
                 '-e',
@@ -1512,8 +1510,6 @@ export default class Install extends Command {
                 '-d',
                 '--name',
                 containerName,
-                '--restart',
-                'always',
                 '--network',
                 networkName,
                 '-e',
@@ -1558,8 +1554,6 @@ export default class Install extends Command {
                 '-d',
                 '--name',
                 containerName,
-                '--restart',
-                'always',
                 '--network',
                 networkName,
                 '-e',
@@ -1604,8 +1598,6 @@ export default class Install extends Command {
                 '-d',
                 '--name',
                 containerName,
-                '--restart',
-                'always',
                 '--network',
                 networkName,
                 '--platform',
@@ -1805,8 +1797,6 @@ export default class Install extends Command {
             '-d',
             '--name',
             containerName,
-            '--restart',
-            'always',
             '--network',
             params.networkName,
             '-p',

package/dist/lib/app-managed-resources.js

@@ -225,8 +225,6 @@ export async function buildSavedDockerRunArgs(runtime, options) {
         '-d',
         '--name',
         runtime.containerName,
-        '--restart',
-        'always',
         '--network',
         runtime.workspaceName,
     ];

package/dist/lib/auth-store.js

@@ -99,6 +99,17 @@ function normalizeAuthConfig(config) {
         ? settings.log.retentionDays
         : undefined;
     const logEnabled = typeof settings.log?.enabled === 'boolean' ? settings.log.enabled : undefined;
+    const hasBinSettings = settings.bin?.docker ||
+        settings.bin?.caddy ||
+        settings.bin?.git ||
+        settings.bin?.nginx ||
+        settings.bin?.pnpm ||
+        settings.bin?.yarn;
+    const hasProxySettings = settings.proxy?.nbCliRoot ||
+        settings.proxy?.caddyDriver ||
+        settings.proxy?.nginxDriver ||
+        settings.proxy?.upstreamHost ||
+        settings.proxy?.host;
     return {
         name: config.name || config.dockerResourcePrefix,
         settings: {
@@ -123,12 +134,7 @@ function normalizeAuthConfig(config) {
                     },
                 }
                 : {}),
-            ...(settings.bin?.docker ||
-                settings.bin?.caddy ||
-                settings.bin?.git ||
-                settings.bin?.nginx ||
-                settings.bin?.pnpm ||
-                settings.bin?.yarn
+            ...(hasBinSettings
                 ? {
                     bin: {
                         ...(settings.bin?.docker ? { docker: normalizeOptionalString(settings.bin.docker) } : {}),
@@ -140,11 +146,7 @@ function normalizeAuthConfig(config) {
                     },
                 }
                 : {}),
-            ...(settings.proxy?.nbCliRoot ||
-                settings.proxy?.caddyDriver ||
-                settings.proxy?.nginxDriver ||
-                settings.proxy?.upstreamHost ||
-                settings.proxy?.host
+            ...(hasProxySettings
                 ? {
                     proxy: {
                         ...(settings.proxy?.nbCliRoot ? { nbCliRoot: normalizeOptionalString(settings.proxy.nbCliRoot) } : {}),

package/dist/lib/env-auth.js

@@ -22,9 +22,45 @@ const OAUTH_FETCH_TIMEOUT_MS = 15_000;
 const OAUTH_FETCH_RETRY_DELAYS_MS = [500, 1_000, 2_000];
 const DEFAULT_OAUTH_SCOPE = 'openid api offline_access';
 const DEFAULT_CLIENT_NAME = 'NocoBase CLI';
+const DEVICE_CODE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';
+const DEFAULT_DEVICE_POLL_INTERVAL_SECONDS = 5;
 function normalizeBaseUrl(baseUrl) {
     return baseUrl.replace(/\/+$/, '');
 }
+function buildDeviceVerificationPathFromApiBaseUrl(apiBaseUrl) {
+    const url = new URL(apiBaseUrl);
+    const subappMatch = url.pathname.match(/^(.*)\/api\/__app\/([^/]+)\/?$/);
+    if (subappMatch) {
+        const publicPath = (subappMatch[1] || '').replace(/\/+$/, '');
+        return `${publicPath}/apps/${subappMatch[2]}/idpOAuth/device`;
+    }
+    const appMatch = url.pathname.match(/^(.*)\/api\/?$/);
+    if (appMatch) {
+        const publicPath = (appMatch[1] || '').replace(/\/+$/, '');
+        return `${publicPath}/idpOAuth/device`;
+    }
+    return undefined;
+}
+export function resolveDeviceVerificationUrlForApiBaseUrl(verificationUrl, apiBaseUrl) {
+    try {
+        const devicePath = buildDeviceVerificationPathFromApiBaseUrl(apiBaseUrl);
+        if (!devicePath) {
+            return verificationUrl;
+        }
+        const originalUrl = new URL(verificationUrl);
+        if (!originalUrl.pathname.endsWith('/idpOAuth/device')) {
+            return verificationUrl;
+        }
+        const publicUrl = new URL(apiBaseUrl);
+        publicUrl.pathname = devicePath;
+        publicUrl.search = originalUrl.search;
+        publicUrl.hash = originalUrl.hash;
+        return publicUrl.toString();
+    }
+    catch {
+        return verificationUrl;
+    }
+}
 export function getOauthMetadataUrl(baseUrl) {
     return `${normalizeBaseUrl(baseUrl)}/.well-known/oauth-authorization-server`;
 }
@@ -129,6 +165,16 @@ function getOauthFetchRetryDelays() {
     }
     return OAUTH_FETCH_RETRY_DELAYS_MS;
 }
+function getDevicePollIntervalMs(intervalSeconds) {
+    const override = process.env.NB_CLI_OAUTH_DEVICE_POLL_INTERVAL_MS;
+    if (override !== undefined) {
+        const delay = Number(override);
+        if (Number.isFinite(delay) && delay >= 0) {
+            return Math.max(1, delay);
+        }
+    }
+    return Math.max(1, intervalSeconds ?? DEFAULT_DEVICE_POLL_INTERVAL_SECONDS) * 1000;
+}
 function formatOauthRetryMessage(options) {
     return `${options.operation} failed (${options.reason}). Retrying ${options.attempt}/${options.maxAttempts}...`;
 }
@@ -223,6 +269,31 @@ async function registerOauthClient(metadata, redirectUri, options = {}) {
     if (!metadata.registration_endpoint) {
         throw new Error('OAuth server does not expose a dynamic client registration endpoint.');
     }
+    let body;
+    if (options.deviceFlow) {
+        body = {
+            client_name: DEFAULT_CLIENT_NAME,
+            application_type: 'native',
+            token_endpoint_auth_method: 'none',
+            grant_types: [DEVICE_CODE_GRANT_TYPE, 'refresh_token'],
+            response_types: [],
+            scope: DEFAULT_OAUTH_SCOPE,
+        };
+    }
+    else {
+        if (!redirectUri) {
+            throw new Error('OAuth redirect URI is required for browser sign-in.');
+        }
+        body = {
+            client_name: DEFAULT_CLIENT_NAME,
+            application_type: 'native',
+            token_endpoint_auth_method: 'none',
+            grant_types: ['authorization_code', 'refresh_token'],
+            response_types: ['code'],
+            scope: DEFAULT_OAUTH_SCOPE,
+            redirect_uris: [redirectUri],
+        };
+    }
     let response;
     try {
         response = await fetchWithOauthRetry(metadata.registration_endpoint, {
@@ -231,15 +302,7 @@ async function registerOauthClient(metadata, redirectUri, options = {}) {
                 accept: 'application/json',
                 'content-type': 'application/json',
             },
-            body: JSON.stringify({
-                client_name: DEFAULT_CLIENT_NAME,
-                application_type: 'native',
-                token_endpoint_auth_method: 'none',
-                grant_types: ['authorization_code', 'refresh_token'],
-                response_types: ['code'],
-                scope: DEFAULT_OAUTH_SCOPE,
-                redirect_uris: [redirectUri],
-            }),
+            body: JSON.stringify(body),
         }, {
             operation: 'Registering OAuth client',
             onRetry: (message) => updateTask(message),
@@ -594,6 +657,10 @@ async function maybeOpenBrowser(url) {
         cleanup,
     };
 }
+let browserOpener = maybeOpenBrowser;
+export function setOauthBrowserOpenerForTests(opener) {
+    browserOpener = opener || maybeOpenBrowser;
+}
 async function createLoopbackServer(state) {
     const result = await new Promise((resolve, reject) => {
         const server = createServer((req, res) => {
@@ -706,6 +773,109 @@ async function exchangeAuthorizationCode(options) {
     }
     return data;
 }
+async function requestDeviceAuthorization(options) {
+    if (!options.metadata.device_authorization_endpoint) {
+        throw new Error('OAuth server does not expose a device authorization endpoint.');
+    }
+    const body = new URLSearchParams({
+        client_id: options.clientId,
+        scope: options.scope,
+        resource: options.resource,
+    });
+    let response;
+    try {
+        response = await fetchWithOauthRetry(options.metadata.device_authorization_endpoint, {
+            method: 'POST',
+            headers: {
+                accept: 'application/json',
+                'content-type': 'application/x-www-form-urlencoded',
+            },
+            body,
+        }, {
+            operation: 'Starting OAuth device authorization',
+            onRetry: (message) => updateTask(message),
+        });
+    }
+    catch (error) {
+        throw new Error(formatOauthFetchFailure('Failed to start OAuth device authorization.', {
+            envName: options.envName,
+            baseUrl: options.baseUrl,
+            url: options.metadata.device_authorization_endpoint,
+            rawMessage: error instanceof Error ? error.message : String(error),
+        }));
+    }
+    const data = await parseJsonResponse(response);
+    if (!response.ok) {
+        throw new Error(formatOauthError('Failed to start OAuth device authorization', data, response.status));
+    }
+    if (!data ||
+        typeof data !== 'object' ||
+        typeof data.device_code !== 'string' ||
+        typeof data.user_code !== 'string' ||
+        typeof data.verification_uri !== 'string') {
+        throw new Error('OAuth device authorization response is missing device_code, user_code, or verification_uri.');
+    }
+    return data;
+}
+async function pollDeviceToken(options) {
+    let intervalMs = getDevicePollIntervalMs(options.interval);
+    const deadline = Date.now() + Math.max(1, options.expiresIn ?? OAUTH_LOGIN_TIMEOUT_MS / 1000) * 1000;
+    while (Date.now() < deadline) {
+        await sleep(intervalMs);
+        const body = new URLSearchParams({
+            grant_type: DEVICE_CODE_GRANT_TYPE,
+            client_id: options.clientId,
+            device_code: options.deviceCode,
+        });
+        let response;
+        try {
+            response = await fetchWithOauthRetry(options.metadata.token_endpoint, {
+                method: 'POST',
+                headers: {
+                    accept: 'application/json',
+                    'content-type': 'application/x-www-form-urlencoded',
+                },
+                body,
+            }, {
+                operation: 'Polling OAuth device authorization',
+                onRetry: (message) => updateTask(message),
+            });
+        }
+        catch (error) {
+            throw new Error(formatOauthFetchFailure('Failed to poll OAuth device authorization.', {
+                envName: options.envName,
+                baseUrl: options.baseUrl,
+                url: options.metadata.token_endpoint,
+                rawMessage: error instanceof Error ? error.message : String(error),
+            }));
+        }
+        const data = await parseJsonResponse(response);
+        if (response.ok) {
+            if (!data || typeof data !== 'object' || typeof data.access_token !== 'string') {
+                throw new Error('OAuth token response is missing access_token.');
+            }
+            return data;
+        }
+        const oauthError = typeof data === 'object' && data ? String(data.error || '') : '';
+        if (oauthError === 'authorization_pending') {
+            updateTask(`Waiting for you to approve device sign-in for "${options.envName}"...`);
+            continue;
+        }
+        if (oauthError === 'slow_down') {
+            intervalMs += 5_000;
+            updateTask(`OAuth server asked us to slow down. Polling again in ${Math.ceil(intervalMs / 1000)}s...`);
+            continue;
+        }
+        if (oauthError === 'expired_token') {
+            throw new Error(`OAuth device sign-in expired. Run \`nb env auth ${options.envName}\` to try again.`);
+        }
+        if (oauthError === 'access_denied') {
+            throw new Error('OAuth device sign-in was denied.');
+        }
+        throw new Error(formatOauthError('Failed to poll OAuth device authorization', data, response.status));
+    }
+    throw new Error(`OAuth device sign-in timed out. Run \`nb env auth ${options.envName}\` to try again.`);
+}
 async function refreshOauthAccessToken(options) {
     if (!options.auth.refreshToken || !options.auth.clientId) {
         throw new Error(`OAuth session for env "${options.envName}" cannot be refreshed. Run \`nb env auth ${options.envName}\`.`);
@@ -862,41 +1032,79 @@ export async function authenticateEnvWithBasic(options) {
     }
     return token;
 }
-export async function authenticateEnvWithOauth(options) {
-    const envName = options.envName ?? (await getCurrentEnvName({ scope: options.scope }));
-    const env = await getEnv(envName, { scope: options.scope });
-    const baseUrl = env?.baseUrl;
-    if (!baseUrl) {
-        throw new Error([
-            env
-                ? `Environment "${envName}" does not have an API base URL yet.`
-                : `Environment "${envName}" has not been set up yet.`,
-            env
-                ? `Run \`nb env update ${envName} --api-base-url <url>\` to finish setting it up.`
-                : `Run \`nb init --ui --env ${envName}\` first.`,
-        ]
-            .filter(Boolean)
-            .join('\n'));
+async function authenticateEnvWithOauthDevice(options) {
+    const resource = getOauthResource(options.metadata.issuer);
+    let cleanupBrowserOpenTarget;
+    try {
+        updateTask(`Preparing device sign-in for "${options.envName}"...`);
+        const registration = await registerOauthClient(options.metadata, undefined, {
+            envName: options.envName,
+            baseUrl: options.baseUrl,
+            deviceFlow: true,
+        });
+        const deviceAuthorization = await requestDeviceAuthorization({
+            metadata: options.metadata,
+            clientId: registration.clientId,
+            scope: DEFAULT_OAUTH_SCOPE,
+            resource,
+            envName: options.envName,
+            baseUrl: options.baseUrl,
+        });
+        stopTask();
+        const verificationUrl = resolveDeviceVerificationUrlForApiBaseUrl(deviceAuthorization.verification_uri_complete || deviceAuthorization.verification_uri, options.baseUrl);
+        const browser = await browserOpener(verificationUrl);
+        cleanupBrowserOpenTarget = browser.cleanup;
+        if (!browser.opened) {
+            printWarningBlock('We could not open your browser automatically. Open the URL below to approve device sign-in:');
+        }
+        else {
+            printInfo(`Opening device sign-in for "${options.envName}" in your browser.`);
+            printInfo('If the browser does not open automatically, open this URL manually:');
+        }
+        printInfo(verificationUrl);
+        printInfo(`Enter code: ${deviceAuthorization.user_code}`);
+        updateTask(`Waiting for you to approve device sign-in for "${options.envName}"...`);
+        const tokenResponse = await pollDeviceToken({
+            metadata: options.metadata,
+            clientId: registration.clientId,
+            deviceCode: deviceAuthorization.device_code,
+            expiresIn: deviceAuthorization.expires_in,
+            interval: deviceAuthorization.interval,
+            envName: options.envName,
+            baseUrl: options.baseUrl,
+        });
+        if (!tokenResponse.refresh_token) {
+            printWarning('Sign-in succeeded, but no refresh token was returned. You may need to sign in again when this session expires.');
+        }
+        await setEnvOauthSession(options.envName, {
+            type: 'oauth',
+            accessToken: tokenResponse.access_token,
+            refreshToken: tokenResponse.refresh_token,
+            expiresAt: calculateExpiresAt(tokenResponse.expires_in),
+            scope: tokenResponse.scope || DEFAULT_OAUTH_SCOPE,
+            issuer: options.metadata.issuer,
+            clientId: registration.clientId,
+            resource,
+        }, { scope: options.scope });
     }
-    printVerbose(`Starting OAuth sign-in for env "${envName}" using ${baseUrl}`);
-    updateTask(`Checking sign-in settings for "${envName}"...`);
-    const metadata = await fetchOauthServerMetadata(baseUrl, {
-        envName,
-        onRetry: (message) => updateTask(message),
-    });
+    finally {
+        await cleanupBrowserOpenTarget?.().catch(() => undefined);
+    }
+}
+async function authenticateEnvWithOauthBrowser(options) {
     const state = encodeBase64Url(crypto.randomBytes(16));
     const { codeVerifier, codeChallenge } = buildPkcePair();
     const callback = await createLoopbackServer(state);
-    const resource = getOauthResource(metadata.issuer);
+    const resource = getOauthResource(options.metadata.issuer);
     let cleanupBrowserOpenTarget;
     try {
         printVerbose(`OAuth callback listener ready at ${callback.redirectUri}`);
-        updateTask(`Preparing secure browser sign-in for "${envName}"...`);
-        const registration = await registerOauthClient(metadata, callback.redirectUri, {
-            envName,
-            baseUrl,
+        updateTask(`Preparing secure browser sign-in for "${options.envName}"...`);
+        const registration = await registerOauthClient(options.metadata, callback.redirectUri, {
+            envName: options.envName,
+            baseUrl: options.baseUrl,
         });
-        const authorizationUrl = new URL(metadata.authorization_endpoint);
+        const authorizationUrl = new URL(options.metadata.authorization_endpoint);
         authorizationUrl.searchParams.set('response_type', 'code');
         authorizationUrl.searchParams.set('client_id', registration.clientId);
         authorizationUrl.searchParams.set('redirect_uri', callback.redirectUri);
@@ -906,8 +1114,8 @@ export async function authenticateEnvWithOauth(options) {
         authorizationUrl.searchParams.set('code_challenge', codeChallenge);
         authorizationUrl.searchParams.set('code_challenge_method', 'S256');
         authorizationUrl.searchParams.set('resource', resource);
-        updateTask(`Waiting for you to finish signing in for "${envName}"...`);
-        const browser = await maybeOpenBrowser(authorizationUrl.toString());
+        updateTask(`Waiting for you to finish signing in for "${options.envName}"...`);
+        const browser = await browserOpener(authorizationUrl.toString());
         cleanupBrowserOpenTarget = browser.cleanup;
         if (!browser.opened) {
             printWarningBlock('We could not open your browser automatically. Open the URL below to continue signing in:');
@@ -918,7 +1126,7 @@ export async function authenticateEnvWithOauth(options) {
         }
         printInfo(authorizationUrl.toString());
         const code = await new Promise((resolve, reject) => {
-            const timeout = setTimeout(() => reject(new Error(`OAuth sign-in timed out after 5 minutes. Run \`nb env auth ${envName}\` to try again.`)), OAUTH_LOGIN_TIMEOUT_MS);
+            const timeout = setTimeout(() => reject(new Error(`OAuth sign-in timed out after 5 minutes. Run \`nb env auth ${options.envName}\` to try again.`)), OAUTH_LOGIN_TIMEOUT_MS);
             timeout.unref?.();
             callback
                 .waitForCode()
@@ -931,27 +1139,27 @@ export async function authenticateEnvWithOauth(options) {
                 reject(error);
             });
         });
-        updateTask(`Finishing sign-in for "${envName}"...`);
+        updateTask(`Finishing sign-in for "${options.envName}"...`);
         const tokenResponse = await exchangeAuthorizationCode({
-            metadata,
+            metadata: options.metadata,
             clientId: registration.clientId,
             redirectUri: callback.redirectUri,
             code,
             codeVerifier,
             resource,
-            envName,
-            baseUrl,
+            envName: options.envName,
+            baseUrl: options.baseUrl,
         });
         if (!tokenResponse.refresh_token) {
             printWarning('Sign-in succeeded, but no refresh token was returned. You may need to sign in again when this session expires.');
         }
-        await setEnvOauthSession(envName, {
+        await setEnvOauthSession(options.envName, {
             type: 'oauth',
             accessToken: tokenResponse.access_token,
             refreshToken: tokenResponse.refresh_token,
             expiresAt: calculateExpiresAt(tokenResponse.expires_in),
             scope: tokenResponse.scope || DEFAULT_OAUTH_SCOPE,
-            issuer: metadata.issuer,
+            issuer: options.metadata.issuer,
             clientId: registration.clientId,
             resource,
         }, { scope: options.scope });
@@ -961,3 +1169,41 @@ export async function authenticateEnvWithOauth(options) {
         await callback.close().catch(() => undefined);
     }
 }
+export async function authenticateEnvWithOauth(options) {
+    const envName = options.envName ?? (await getCurrentEnvName({ scope: options.scope }));
+    const env = await getEnv(envName, { scope: options.scope });
+    const baseUrl = env?.baseUrl;
+    if (!baseUrl) {
+        throw new Error([
+            env
+                ? `Environment "${envName}" does not have an API base URL yet.`
+                : `Environment "${envName}" has not been set up yet.`,
+            env
+                ? `Run \`nb env update ${envName} --api-base-url <url>\` to finish setting it up.`
+                : `Run \`nb init --ui --env ${envName}\` first.`,
+        ]
+            .filter(Boolean)
+            .join('\n'));
+    }
+    printVerbose(`Starting OAuth sign-in for env "${envName}" using ${baseUrl}`);
+    updateTask(`Checking sign-in settings for "${envName}"...`);
+    const metadata = await fetchOauthServerMetadata(baseUrl, {
+        envName,
+        onRetry: (message) => updateTask(message),
+    });
+    if (metadata.device_authorization_endpoint) {
+        await authenticateEnvWithOauthDevice({
+            envName,
+            baseUrl,
+            metadata,
+            scope: options.scope,
+        });
+        return;
+    }
+    await authenticateEnvWithOauthBrowser({
+        envName,
+        baseUrl,
+        metadata,
+        scope: options.scope,
+    });
+}

package/dist/lib/prompt-validators.js

@@ -10,7 +10,7 @@ import { spawn } from 'node:child_process';
 import net from 'node:net';
 import { translateCli } from "./cli-locale.js";
 const API_BASE_URL_EXAMPLE = 'http://localhost:13000/api';
-const ENV_KEY_PATTERN = /^[A-Za-z0-9]+$/;
+const ENV_KEY_PATTERN = /^[A-Za-z0-9_-]+$/;
 const APP_PUBLIC_PATH_PATTERN = /^\/(?:[A-Za-z0-9_-]+(?:\/[A-Za-z0-9_-]+)*)?\/?$/;
 const TCP_PORT_EXAMPLE = '13000';
 const API_BASE_URL_REQUEST_TIMEOUT_MS = 5_000;

package/dist/lib/self-manager.js

@@ -7,6 +7,7 @@
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { commandOutput, run } from './run-npm.js';
@@ -124,6 +125,7 @@ function detectInstallMethod(packageRoot, options = {}) {
     })) {
         return 'pnpm-global';
     }
+    // Best-effort fallback for environments where pnpm probes are unavailable.
     if (isPnpmGlobalPath(packageRoot)) {
         return 'pnpm-global';
     }
@@ -141,6 +143,39 @@ function isPnpmGlobalPath(packageRoot) {
     }
     return segments.slice(globalIndex + 2).includes('node_modules');
 }
+function normalizePnpmGlobalNodeModulesRoot(pnpmGlobalRoot) {
+    const normalizedGlobalRoot = normalizePath(pnpmGlobalRoot);
+    return path.basename(normalizedGlobalRoot) === 'node_modules'
+        ? normalizedGlobalRoot
+        : path.join(normalizedGlobalRoot, 'node_modules');
+}
+function readSiblingPnpmGlobalNodeModulesRoots(pnpmGlobalRoot) {
+    const globalNodeModulesDir = normalizePnpmGlobalNodeModulesRoot(pnpmGlobalRoot);
+    const globalProjectDir = path.dirname(globalNodeModulesDir);
+    let entries;
+    try {
+        entries = fs.readdirSync(globalProjectDir);
+    }
+    catch {
+        return [];
+    }
+    return entries
+        .filter((entry) => {
+        if (entry === path.basename(globalNodeModulesDir)) {
+            return false;
+        }
+        try {
+            return fs.statSync(path.join(globalProjectDir, entry)).isDirectory();
+        }
+        catch {
+            return false;
+        }
+    })
+        .map((entry) => path.join(globalProjectDir, entry, 'node_modules'));
+}
+function readPnpmGlobalNodeModulesRoots(pnpmGlobalRoot) {
+    return [normalizePnpmGlobalNodeModulesRoot(pnpmGlobalRoot), ...readSiblingPnpmGlobalNodeModulesRoots(pnpmGlobalRoot)];
+}
 function packageNameToPath(packageName) {
     return packageName.split('/').filter(Boolean);
 }
@@ -156,10 +191,7 @@ function isPnpmGlobalRootPath(pnpmGlobalRoot, packageRoot) {
     if (isSubPath(pnpmGlobalRoot, packageRoot)) {
         return true;
     }
-    const normalizedGlobalRoot = normalizePath(pnpmGlobalRoot);
-    const globalNodeModulesDir = path.basename(normalizedGlobalRoot) === 'node_modules'
-        ? normalizedGlobalRoot
-        : path.join(normalizedGlobalRoot, 'node_modules');
+    const globalNodeModulesDir = normalizePnpmGlobalNodeModulesRoot(pnpmGlobalRoot);
     const globalProjectDir = path.dirname(globalNodeModulesDir);
     if (!isSubPath(globalProjectDir, packageRoot)) {
         return false;
@@ -172,7 +204,7 @@ function isPnpmGlobalRootPath(pnpmGlobalRoot, packageRoot) {
     return segments.slice(pnpmStoreIndex + 1).includes('node_modules');
 }
 function isPnpmGlobalPackagePath(pnpmGlobalRoot, packageRoot, packageName) {
-    return isSameRealPath(path.join(pnpmGlobalRoot, ...packageNameToPath(packageName)), packageRoot);
+    return readPnpmGlobalNodeModulesRoots(pnpmGlobalRoot).some((pnpmGlobalNodeModulesRoot) => isSameRealPath(path.join(pnpmGlobalNodeModulesRoot, ...packageNameToPath(packageName)), packageRoot));
 }
 function isPnpmGlobalBinProjectPath(pnpmGlobalBin, packageRoot, packageName) {
     const pnpmHome = path.dirname(normalizePath(pnpmGlobalBin));
@@ -188,9 +220,9 @@ function isPnpmGlobalBinProjectPath(pnpmGlobalBin, packageRoot, packageName) {
         return false;
     }
     return entries.some((entry) => {
-        const pnpmGlobalRoot = path.join(globalDir, entry, 'node_modules');
-        return isPnpmGlobalRootPath(pnpmGlobalRoot, packageRoot)
-            || isPnpmGlobalPackagePath(pnpmGlobalRoot, packageRoot, packageName);
+        const pnpmGlobalRoot = path.join(globalDir, entry);
+        return (isPnpmGlobalRootPath(pnpmGlobalRoot, packageRoot)
+            || isPnpmGlobalPackagePath(pnpmGlobalRoot, packageRoot, packageName));
     });
 }
 function isPnpmGlobalInstallPath(options) {
@@ -217,9 +249,27 @@ function cleanCommandPath(value) {
     const trimmed = value.trim();
     return trimmed ? trimmed : undefined;
 }
+function resolvePackageManagerProbeCwd() {
+    const candidates = [os.homedir(), os.tmpdir(), path.parse(process.cwd()).root];
+    for (const candidate of candidates) {
+        if (!candidate) {
+            continue;
+        }
+        try {
+            if (fs.statSync(candidate).isDirectory()) {
+                return candidate;
+            }
+        }
+        catch {
+            // Ignore invalid probe cwd candidates and continue to the next one.
+        }
+    }
+    return undefined;
+}
 async function readGlobalPrefix(commandOutputFn) {
     try {
         return cleanCommandPath(await commandOutputFn('npm', ['prefix', '-g'], {
+            cwd: resolvePackageManagerProbeCwd(),
             errorName: 'npm prefix',
         }));
     }
@@ -230,6 +280,7 @@ async function readGlobalPrefix(commandOutputFn) {
 async function readPnpmGlobalBin(commandOutputFn) {
     try {
         return cleanCommandPath(await commandOutputFn('pnpm', ['bin', '-g'], {
+            cwd: resolvePackageManagerProbeCwd(),
             errorName: 'pnpm bin',
         }));
     }
@@ -240,6 +291,7 @@ async function readPnpmGlobalBin(commandOutputFn) {
 async function readPnpmGlobalRoot(commandOutputFn) {
     try {
         return cleanCommandPath(await commandOutputFn('pnpm', ['root', '-g'], {
+            cwd: resolvePackageManagerProbeCwd(),
             errorName: 'pnpm root',
         }));
     }
@@ -250,6 +302,7 @@ async function readPnpmGlobalRoot(commandOutputFn) {
 async function readYarnGlobalDir(commandOutputFn) {
     try {
         return cleanCommandPath(await commandOutputFn('yarn', ['global', 'dir'], {
+            cwd: resolvePackageManagerProbeCwd(),
             errorName: 'yarn global dir',
         }));
     }
@@ -260,6 +313,7 @@ async function readYarnGlobalDir(commandOutputFn) {
 async function readYarnGlobalBin(commandOutputFn) {
     try {
         return cleanCommandPath(await commandOutputFn('yarn', ['global', 'bin'], {
+            cwd: resolvePackageManagerProbeCwd(),
             errorName: 'yarn global bin',
         }));
     }
@@ -367,6 +421,7 @@ export async function inspectSelfStatus(options = {}) {
     const channel = options.channel && options.channel !== 'auto' ? options.channel : detectChannel(currentVersion);
     const commandOutputFn = options.commandOutputFn ?? commandOutput;
     const { installMethod, globalPrefix } = await inspectSelfInstall({
+        currentBinPath: options.currentBinPath,
         packageName,
         packageRoot,
         commandOutputFn,

package/dist/locale/en-US.json

@@ -68,7 +68,7 @@
       "unreachable": "Unable to connect to the API base URL. Check the address and make sure the server is reachable. Details: {{details}}"
     },
     "envKey": {
-      "invalid": "Use letters and numbers only."
+      "invalid": "Use letters, numbers, hyphens, and underscores only."
     },
     "appPublicPath": {
       "invalid": "Use / or a slash-separated path like /nocobase/ or /foo-bar/baz_2/. Each path segment may contain letters, numbers, hyphens, and underscores only."

package/dist/locale/zh-CN.json

@@ -68,7 +68,7 @@
       "unreachable": "无法连接到该 API 地址，请检查地址是否正确，并确认服务可访问。详情：{{details}}"
     },
     "envKey": {
-      "invalid": "仅支持字母和数字。"
+      "invalid": "仅支持字母、数字、中划线和下划线。"
     },
     "appPublicPath": {
       "invalid": "请输入 /，或类似 /nocobase/、/foo-bar/baz_2/ 这样的路径。每个路径段仅支持字母、数字、中划线和下划线。"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/cli",
-  "version": "2.1.11-test.9",
+  "version": "2.1.12-test.1",
   "description": "NocoBase Command Line Tool",
   "type": "module",
   "main": "dist/generated/command-registry.js",