@nocobase/cli 2.2.0-beta.2 → 2.2.0-beta.3

package/bin/early-locale.js

@@ -0,0 +1,89 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export function normalizeEarlyCliLocale(value) {
+  const normalized = String(value ?? '')
+    .trim()
+    .replace(/\..*$/, '')
+    .replace(/_/g, '-')
+    .toLowerCase();
+
+  if (normalized === 'zh' || normalized.startsWith('zh-')) {
+    return 'zh-CN';
+  }
+
+  if (normalized === 'en' || normalized.startsWith('en-')) {
+    return 'en-US';
+  }
+
+  return undefined;
+}
+
+function readConfiguredEarlyCliLocale() {
+  try {
+    const cliHomeRoot = String(process.env.NB_CLI_ROOT ?? '').trim() || os.homedir();
+    const configPath = path.join(cliHomeRoot, '.nocobase', 'config.json');
+    const content = fs.readFileSync(configPath, 'utf8');
+    const parsed = JSON.parse(content);
+    return normalizeEarlyCliLocale(parsed?.settings?.locale);
+  } catch {
+    return undefined;
+  }
+}
+
+export function detectEarlyCliLocale() {
+  const candidates = [
+    process.env.NB_LOCALE,
+    readConfiguredEarlyCliLocale(),
+    process.env.LC_ALL,
+    process.env.LC_MESSAGES,
+    process.env.LANG,
+    Intl.DateTimeFormat().resolvedOptions().locale,
+  ];
+
+  for (const candidate of candidates) {
+    const locale = normalizeEarlyCliLocale(candidate);
+    if (locale) {
+      return locale;
+    }
+  }
+
+  return 'en-US';
+}
+
+function getEarlyLocalePathValue(input, key) {
+  let current = input;
+  for (const part of key.split('.')) {
+    if (!current || typeof current !== 'object' || !Object.prototype.hasOwnProperty.call(current, part)) {
+      return undefined;
+    }
+    current = current[part];
+  }
+  return typeof current === 'string' ? current : undefined;
+}
+
+function readEarlyLocaleMessages(locale) {
+  const moduleDir = path.dirname(fileURLToPath(import.meta.url));
+  const packageRoot = path.resolve(moduleDir, '..');
+  const localePaths = [
+    path.join(packageRoot, 'src', 'locale', `${locale}.json`),
+    path.join(packageRoot, 'dist', 'locale', `${locale}.json`),
+  ];
+
+  for (const localePath of localePaths) {
+    try {
+      return JSON.parse(fs.readFileSync(localePath, 'utf8'));
+    } catch {
+      // Try the next runtime layout.
+    }
+  }
+
+  return undefined;
+}
+
+export function translateEarlyCli(key, fallback, locale = detectEarlyCliLocale()) {
+  const messages = readEarlyLocaleMessages(locale);
+  return getEarlyLocalePathValue(messages, key) ?? fallback;
+}

package/bin/run.js

@@ -8,6 +8,7 @@ import pc from 'picocolors';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { formatUnsupportedNodeVersionMessage, isSupportedNodeVersion } from './node-version.js';
 import { normalizeNodeOptions, normalizeSessionEnv } from './session-env.js';
+import { ensureWindowsAdministrator } from './windows-admin.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const requireFromCli = createRequire(import.meta.url);
@@ -27,6 +28,8 @@ if (!isSupportedNodeVersion()) {
 normalizeSessionEnv();
 normalizeNodeOptions();
 
+ensureWindowsAdministrator();
+
 /**
  * In the monorepo, plain `node` cannot load `.ts`. Re-exec once with `--import <tsx>`
  * (same effect as a dedicated dev entry with `#!/usr/bin/env -S node --import tsx`).

package/bin/windows-admin.js

@@ -0,0 +1,60 @@
+import { spawnSync } from 'node:child_process';
+import pc from 'picocolors';
+import { detectEarlyCliLocale, translateEarlyCli } from './early-locale.js';
+
+const windowsAdministratorCheckScript = [
+  '$identity = [Security.Principal.WindowsIdentity]::GetCurrent();',
+  '$principal = New-Object Security.Principal.WindowsPrincipal($identity);',
+  'if ($principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { exit 0 }',
+  'exit 1',
+].join(' ');
+
+export function formatWindowsAdministratorRequiredMessage() {
+  const locale = detectEarlyCliLocale();
+  const message = translateEarlyCli(
+    'entry.windowsAdministratorRequired.message',
+    'NocoBase CLI must be run as Administrator on Windows.',
+    locale,
+  );
+  const hint = translateEarlyCli(
+    'entry.windowsAdministratorRequired.hint',
+    'Open your terminal as Administrator, then run the command again.',
+    locale,
+  );
+
+  return [message, hint].join('\n');
+}
+
+function isWindowsAdministrator() {
+  for (const command of ['pwsh.exe', 'powershell.exe']) {
+    const result = spawnSync(
+      command,
+      ['-NoLogo', '-NoProfile', '-NonInteractive', '-Command', windowsAdministratorCheckScript],
+      {
+        stdio: 'ignore',
+        windowsHide: true,
+      },
+    );
+
+    if (result.error?.code === 'ENOENT') {
+      continue;
+    }
+
+    return result.status === 0;
+  }
+
+  return false;
+}
+
+export function ensureWindowsAdministrator() {
+  if (process.platform !== 'win32' || process.env.NB_CLI_WINDOWS_ADMIN_CHECKED === '1') {
+    return;
+  }
+
+  if (!isWindowsAdministrator()) {
+    console.error(pc.red(formatWindowsAdministratorRequiredMessage()));
+    process.exit(1);
+  }
+
+  process.env.NB_CLI_WINDOWS_ADMIN_CHECKED = '1';
+}

package/dist/commands/app/destroy.js

@@ -143,6 +143,7 @@ export default class AppDestroy extends Command {
         }
         announceTargetEnv(runtime.envName);
         try {
+            const retryCommand = `nb env remove ${runtime.envName} --purge --force`;
             if (runtime.kind === 'docker') {
                 startTask(`Removing Docker app container for "${runtime.envName}"...`);
                 const state = await removeDockerContainerIfExists(runtime.containerName, {
@@ -192,7 +193,7 @@ export default class AppDestroy extends Command {
                     const localAppPath = resolveManagedLocalAppPath(runtime);
                     if (localAppPath && removesManagedLocalAppFiles) {
                         startTask(`Removing managed local app files for "${runtime.envName}"...`);
-                        await removePathIfExists(localAppPath, `managed app files for "${runtime.envName}"`);
+                        await removePathIfExists(localAppPath, `managed app files for "${runtime.envName}"`, { retryCommand });
                         succeedTask(`Managed local app files removed for "${runtime.envName}".`);
                     }
                     else {
@@ -206,13 +207,13 @@ export default class AppDestroy extends Command {
                 ];
                 startTask(`Removing proxy entry files for "${runtime.envName}"...`);
                 for (const proxyEntryDir of proxyEntryDirs) {
-                    await removePathIfExists(proxyEntryDir, `proxy entry files for "${runtime.envName}"`);
+                    await removePathIfExists(proxyEntryDir, `proxy entry files for "${runtime.envName}"`, { retryCommand });
                 }
                 succeedTask(`Proxy entry files removed for "${runtime.envName}".`);
                 const configuredStoragePath = resolveConfiguredStoragePath(runtime.env.config);
                 if (configuredStoragePath) {
                     startTask(`Removing storage data for "${runtime.envName}"...`);
-                    await removePathIfExists(configuredStoragePath, `storage data for "${runtime.envName}"`);
+                    await removePathIfExists(configuredStoragePath, `storage data for "${runtime.envName}"`, { retryCommand });
                     succeedTask(`Storage data removed for "${runtime.envName}".`);
                 }
                 else {

package/dist/commands/app/shared.js

@@ -25,10 +25,54 @@ function assertSafeRemovalPath(target, label) {
         throw new Error(`Refusing to remove ${label} at "${resolved}" because it is too broad.`);
     }
 }
-export async function removePathIfExists(target, label) {
+function getErrorCode(error) {
+    if (!(error instanceof Error)) {
+        return undefined;
+    }
+    const { code } = error;
+    return typeof code === 'string' ? code : undefined;
+}
+function isPermissionDeniedError(error) {
+    const code = getErrorCode(error);
+    return code === 'EACCES' || code === 'EPERM';
+}
+function formatOriginalError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const code = getErrorCode(error);
+    return code && !message.includes(code) ? `${code}: ${message}` : message;
+}
+function quoteShellValue(value) {
+    return `"${value.replace(/(["\\$`])/g, '\\$1')}"`;
+}
+function formatPermissionDeniedRemovalError(target, label, error, options) {
+    const retryLines = os.platform() === 'win32' ? [] : [`  sudo chown -R "$(id -u):$(id -g)" ${quoteShellValue(target)}`];
+    if (options.retryCommand) {
+        retryLines.push(`  ${options.retryCommand}`);
+    }
+    return [
+        `Failed to remove ${label} at "${target}".`,
+        'The current user cannot delete one or more files under this path. Files may have been created by a Docker container running as root.',
+        '',
+        retryLines.length > 0
+            ? 'Fix ownership or permissions, then retry:'
+            : 'Fix ownership or permissions, then retry the command.',
+        ...retryLines,
+        '',
+        `Original error: ${formatOriginalError(error)}`,
+    ].join('\n');
+}
+export async function removePathIfExists(target, label, options = {}) {
     const resolved = path.resolve(target);
     assertSafeRemovalPath(resolved, label);
-    await fsp.rm(resolved, { recursive: true, force: true });
+    try {
+        await fsp.rm(resolved, { recursive: true, force: true });
+    }
+    catch (error) {
+        if (isPermissionDeniedError(error)) {
+            throw new Error(formatPermissionDeniedRemovalError(resolved, label, error, options));
+        }
+        throw error;
+    }
 }
 function isMissingDockerContainerError(error) {
     const message = error instanceof Error ? error.message : String(error);
@@ -116,7 +160,9 @@ export function managedDockerNetworkName(runtime) {
     return runtime.dockerNetworkName?.trim() || runtime.workspaceName?.trim() || undefined;
 }
 export function resolveManagedLocalAppPath(runtime) {
-    return resolveConfiguredAppPath(runtime.env.config) || runtime.projectRoot || resolveConfiguredPath(runtime.env.config.appRootPath);
+    return (resolveConfiguredAppPath(runtime.env.config) ||
+        runtime.projectRoot ||
+        resolveConfiguredPath(runtime.env.config.appRootPath));
 }
 export function shouldRemoveManagedLocalAppFiles(runtime) {
     return runtime.source === 'npm' || runtime.source === 'git' || runtime.source === 'local';

package/dist/commands/examples/prompts-stages.js

@@ -109,8 +109,8 @@ export default class PromptsStages extends Command {
                 values: presetValues,
                 pageTitle: 'nb prompts-stages — Web UI',
                 documentHeading: 'nb prompts-stages — `stages` demo',
-                onServerStart: ({ host, port, url }) => {
-                    this.log(`Local Web UI (multi-stage) ready — ${url} (listening on ${host}:${port}). Submit the form in the browser to continue.`);
+                onServerStart: ({ listenHost, port, url }) => {
+                    this.log(`Local Web UI (multi-stage) ready — ${url} (listening on ${listenHost}:${port}). Submit the form in the browser to continue.`);
                 },
                 onOpenBrowserError: (url, err) => {
                     this.log(`Open this URL in a browser: ${url} (${err instanceof Error ? err.message : String(err)})`);

package/dist/commands/examples/prompts-test.js

@@ -139,8 +139,8 @@ export default class PromptsTest extends Command {
                 values: presetValues,
                 pageTitle: 'nb prompts-test — UI',
                 documentHeading: 'nb prompts-test',
-                onServerStart: ({ host, port, url }) => {
-                    this.log(`Local Web UI ready — ${url} (listening on ${host}:${port}). Submit the form in the browser to continue.`);
+                onServerStart: ({ listenHost, port, url }) => {
+                    this.log(`Local Web UI ready — ${url} (listening on ${listenHost}:${port}). Submit the form in the browser to continue.`);
                 },
                 onOpenBrowserError: (url, err) => {
                     this.log(`Open this URL in a browser: ${url} (${err instanceof Error ? err.message : String(err)})`);

package/dist/commands/init.js

@@ -471,7 +471,7 @@ Prompt modes:
             default: false,
         }),
         'ui-host': Flags.string({
-            description: 'Host for the local --ui setup server (default: 127.0.0.1)',
+            description: 'Browser-accessible host for the --ui setup page URL (default: 127.0.0.1)',
         }),
         'ui-port': Flags.integer({
             description: 'Port for the local --ui setup server; 0 lets the OS choose an available port',

package/dist/commands/license/activate.js

@@ -143,11 +143,14 @@ export default class LicenseActivate extends Command {
         const validation = await validateLicenseKey(runtime, resolvedKey);
         const ok = !validation.keyStatus && validation.envMatch && validation.domainMatch && validation.licenseStatus === 'active';
         const licenseKeyPath = ok ? await saveLicenseKey(runtime, resolvedKey) : resolveLicenseKeyFile(runtime);
+        const shouldResolveInstanceId = Boolean(interactiveKeyFlowInstanceId || ok || (flags.json && !validation.keyStatus));
         const payload = {
             ok,
             env: runtime.envName,
             kind: runtime.kind,
-            instanceId: interactiveKeyFlowInstanceId ?? (await ensureInstanceId(runtime)),
+            instanceId: shouldResolveInstanceId
+                ? interactiveKeyFlowInstanceId ?? (await ensureInstanceId(runtime))
+                : undefined,
             mode: 'key',
             key: redactLicenseKey(resolvedKey),
             keyFile: keyFile || undefined,

package/dist/commands/license/shared.js

@@ -10,8 +10,8 @@ import { Flags } from '@oclif/core';
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 import { getEnvAsync, getInstanceIdAsync, keyDecrypt } from '@nocobase/license-kit';
-import { checkExternalDbConnection, readExternalDbConnectionConfig, } from "../../lib/db-connection-check.js";
-import { DEFAULT_DOCKER_REGISTRY, DEFAULT_DOCKER_VERSION, resolveDockerImageRef, } from "../../lib/docker-image.js";
+import { checkExternalDbConnection, readExternalDbConnectionConfig } from "../../lib/db-connection-check.js";
+import { DEFAULT_DOCKER_REGISTRY, DEFAULT_DOCKER_VERSION, resolveDockerImageRef } from "../../lib/docker-image.js";
 import { formatMissingManagedAppEnvMessage, resolveManagedAppRuntime } from '../../lib/app-runtime.js';
 import { buildRuntimeEnvVars } from '../../lib/runtime-env-vars.js';
 import { resolveLicensePkgUrlFromConfig } from '../../lib/cli-config.js';
@@ -102,12 +102,7 @@ function buildDockerLicenseDbFlagArgs(envVars) {
     ];
 }
 async function runDockerLicenseJsonCommand(runtime, commandArgs) {
-    const args = [
-        'run',
-        '--rm',
-        '--network',
-        runtime.dockerNetworkName || runtime.workspaceName,
-    ];
+    const args = ['run', '--rm', '--network', runtime.dockerNetworkName || runtime.workspaceName];
     const dockerPlatform = normalizeDockerPlatform(runtime.env.config?.dockerPlatform);
     if (dockerPlatform) {
         args.push('--platform', dockerPlatform);
@@ -193,11 +188,11 @@ export async function generateValidatedInstanceIdFromEnvVars(envVars) {
 }
 async function generateInstanceIdForDockerRuntime(runtime) {
     const envVars = await buildRuntimeEnvVars(runtime);
-    const payload = await runDockerLicenseJsonCommand(runtime, [
+    const payload = (await runDockerLicenseJsonCommand(runtime, [
         'license',
         'generate-id',
         ...buildDockerLicenseDbFlagArgs(envVars),
-    ]);
+    ]));
     const instanceId = trimValue(payload.instanceId);
     if (!instanceId) {
         throw new Error('Docker instance ID generation did not return an instance ID.');
@@ -337,7 +332,7 @@ export async function getLicenseStatus(keyData) {
             }),
             signal: controller.signal,
         });
-        const payload = await response.json();
+        const payload = (await response.json());
         return payload?.data?.status === 'active' ? 'active' : 'invalid';
     }
     catch {
@@ -356,6 +351,22 @@ export async function validateLicenseKey(runtime, key) {
     catch {
         keyStatus = 'invalid';
     }
+    if (keyStatus) {
+        const currentDomain = appUrl(runtime);
+        return {
+            current: {
+                env: undefined,
+                domain: currentDomain ? new URL(currentDomain).host : '',
+            },
+            keyData,
+            keyStatus,
+            dbMatch: false,
+            sysMatch: false,
+            envMatch: false,
+            domainMatch: false,
+            licenseStatus: 'invalid',
+        };
+    }
     const currentEnv = await getCurrentLicenseEnv(runtime);
     const currentDomain = appUrl(runtime);
     const dbMatch = isDbMatch(currentEnv, keyData);
@@ -391,7 +402,7 @@ export async function resolveLicenseServiceUrl(value) {
     return (await resolveLicensePkgUrl(value)).replace(/\/+$/, '');
 }
 export async function resolveLicensePkgUrl(value) {
-    const normalized = String(value ?? '').trim() || await resolveLicensePkgUrlFromConfig();
+    const normalized = String(value ?? '').trim() || (await resolveLicensePkgUrlFromConfig());
     return normalized.replace(/\/+$/, '') + '/';
 }
 function shouldRedactOutputKey(key) {
@@ -414,9 +425,7 @@ export function sanitizeLicenseOutput(value) {
     if (value && typeof value === 'object') {
         return Object.fromEntries(Object.entries(value).map(([key, nestedValue]) => [
             key,
-            shouldRedactOutputKey(key)
-                ? redactOutputValue(String(nestedValue ?? ''))
-                : sanitizeLicenseOutput(nestedValue),
+            shouldRedactOutputKey(key) ? redactOutputValue(String(nestedValue ?? '')) : sanitizeLicenseOutput(nestedValue),
         ]));
     }
     return value;

package/dist/commands/self/check.js

@@ -20,7 +20,7 @@ export default class SelfCheck extends Command {
     static flags = {
         channel: Flags.string({
             description: 'Release channel to compare against. Defaults to the current CLI channel.',
-            options: ['auto', 'latest', 'beta', 'alpha'],
+            options: ['auto', 'latest', 'test', 'beta', 'alpha'],
             default: 'auto',
         }),
         json: Flags.boolean({

package/dist/commands/self/update.js

@@ -31,12 +31,12 @@ export default class SelfUpdate extends Command {
         '<%= config.bin %> <%= command.id %>',
         '<%= config.bin %> <%= command.id %> --yes',
         '<%= config.bin %> <%= command.id %> --skills',
-        '<%= config.bin %> <%= command.id %> --channel alpha --json',
+        '<%= config.bin %> <%= command.id %> --channel test --json',
     ];
     static flags = {
         channel: Flags.string({
             description: 'Release channel to update to. Defaults to the current CLI channel.',
-            options: ['auto', 'latest', 'beta', 'alpha'],
+            options: ['auto', 'latest', 'test', 'beta', 'alpha'],
             default: 'auto',
         }),
         yes: Flags.boolean({

package/dist/commands/skills/install.js

@@ -8,7 +8,7 @@
  */
 import { Command, Flags } from '@oclif/core';
 import { confirm } from "../../lib/inquirer.js";
-import { setVerboseMode } from '../../lib/ui.js';
+import { setVerboseMode, startTask, stopTask, updateTask } from '../../lib/ui.js';
 import { installNocoBaseSkills } from '../../lib/skills-manager.js';
 export default class SkillsInstall extends Command {
     static summary = 'Install the NocoBase AI coding skills globally';
@@ -17,6 +17,7 @@ export default class SkillsInstall extends Command {
         '<%= config.bin %> <%= command.id %>',
         '<%= config.bin %> <%= command.id %> --yes',
         '<%= config.bin %> <%= command.id %> --version 1.0.4',
+        '<%= config.bin %> <%= command.id %> --verbose',
         '<%= config.bin %> <%= command.id %> --json',
     ];
     static flags = {
@@ -55,9 +56,20 @@ export default class SkillsInstall extends Command {
                 return;
             }
         }
+        const shouldShowLoading = !flags.json && !flags.verbose;
+        if (shouldShowLoading) {
+            startTask(flags.version
+                ? `Installing NocoBase AI coding skills ${flags.version}...`
+                : 'Installing NocoBase AI coding skills...');
+        }
         const result = await installNocoBaseSkills({
             targetVersion: flags.version,
             verbose: flags.verbose,
+            onProgress: shouldShowLoading ? updateTask : undefined,
+        }).finally(() => {
+            if (shouldShowLoading) {
+                stopTask();
+            }
         });
         if (flags.json) {
             this.log(JSON.stringify({

package/dist/commands/skills/update.js

@@ -8,7 +8,7 @@
  */
 import { Command, Flags } from '@oclif/core';
 import { confirm } from "../../lib/inquirer.js";
-import { setVerboseMode, startTask, stopTask } from '../../lib/ui.js';
+import { setVerboseMode, startTask, stopTask, updateTask } from '../../lib/ui.js';
 import { updateNocoBaseSkills } from '../../lib/skills-manager.js';
 export default class SkillsUpdate extends Command {
     static summary = 'Update the globally installed NocoBase AI coding skills';
@@ -17,6 +17,7 @@ export default class SkillsUpdate extends Command {
         '<%= config.bin %> <%= command.id %>',
         '<%= config.bin %> <%= command.id %> --yes',
         '<%= config.bin %> <%= command.id %> --version 1.0.4',
+        '<%= config.bin %> <%= command.id %> --verbose',
         '<%= config.bin %> <%= command.id %> --json',
     ];
     static flags = {
@@ -64,6 +65,7 @@ export default class SkillsUpdate extends Command {
         const result = await updateNocoBaseSkills({
             targetVersion: flags.version,
             verbose: flags.verbose,
+            onProgress: shouldShowLoading ? updateTask : undefined,
         }).finally(() => {
             if (shouldShowLoading) {
                 stopTask();

package/dist/lib/prompt-web-ui.js

@@ -19,7 +19,8 @@ export const PWC_FORM_META_STEP = '_pwcStep';
 /** Form POST JSON meta field: current field key when validating a single field. */
 export const PWC_FORM_META_FIELD = '_pwcField';
 const DEFAULT_TIMEOUT_MS = 30 * 60 * 1000;
-const DEFAULT_HOST = '127.0.0.1';
+const DEFAULT_PUBLIC_HOST = '127.0.0.1';
+const LISTEN_HOST = '0.0.0.0';
 function resolveUiText(text, locale, fallback = '') {
     return resolveLocalizedText(text, { locale, fallback });
 }
@@ -705,7 +706,7 @@ function runPromptCatalogWebUIImpl(options) {
     const initialShow = reflowWebFormState(merged, Object.fromEntries(Object.entries(formDefaults).map(([k, v]) => [k, v])), userSeed).show;
     const submitPath = options.submitPath ?? DEFAULT_SUBMIT;
     const reflowPath = options.reflowPath ?? DEFAULT_REFLOW;
-    const host = options.host ?? DEFAULT_HOST;
+    const publicHost = options.host ?? DEFAULT_PUBLIC_HOST;
     const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     const pageTitle = resolveUiText(options.pageTitle, locale, t('promptCatalog.web.pageTitle'));
     const h1 = resolveUiText(options.documentHeading, locale, t('promptCatalog.web.documentHeading'));
@@ -753,7 +754,7 @@ function runPromptCatalogWebUIImpl(options) {
             }
         };
         const servePage = (port) => {
-            const base = `http://${host}:${port}`;
+            const base = `http://${publicHost}:${port}`;
             const formInner = buildPwcFormHtml(catalog, formDefaults, initialShow, pwcStepDefs, 0, pwcNSteps, locale, uiText);
             const wizardClientJson = JSON.stringify({ n: pwcNSteps, stepDefs: pwcStepDefs });
             const pwcValStepUrl = pwcNSteps > 1 ? JSON.stringify(base + resolveValidateStepPath) : 'null';
@@ -2071,11 +2072,6 @@ function runPromptCatalogWebUIImpl(options) {
             return page;
         };
         server = createServer((req, res) => {
-            if (!req.socket.remoteAddress ||
-                !['127.0.0.1', '::1', '::ffff:127.0.0.1'].includes(req.socket.remoteAddress)) {
-                res.writeHead(403).end();
-                return;
-            }
             if (req.method === 'GET' && (req.url === '/' || req.url === '')) {
                 const addr = server?.address();
                 const port = typeof addr === 'object' && addr ? Number(addr.port) : 0;
@@ -2212,15 +2208,15 @@ function runPromptCatalogWebUIImpl(options) {
             }
             res.writeHead(404).end();
         });
-        server.listen(options.port ?? 0, host, () => {
+        server.listen(options.port ?? 0, LISTEN_HOST, () => {
             const addr = server?.address();
             if (typeof addr !== 'object' || !addr) {
                 rejectAndClose(new Error('Failed to bind HTTP server'));
                 return;
             }
             const port = addr.port;
-            const startUrl = `http://${host}:${port}/`;
-            options.onServerStart?.({ host, port, url: startUrl });
+            const startUrl = `http://${publicHost}:${port}/`;
+            options.onServerStart?.({ host: publicHost, listenHost: LISTEN_HOST, port, url: startUrl });
             const onOpenBrowserError = options.onOpenBrowserError ?? ((u, err) => console.warn(String(err), u));
             try {
                 openUrlInDefaultBrowser(startUrl, onOpenBrowserError);

package/dist/lib/self-manager.js

@@ -97,6 +97,9 @@ function detectChannel(currentVersion) {
     if (/-beta(?:[.-]|$)/i.test(currentVersion)) {
         return 'beta';
     }
+    if (/-test(?:[.-]|$)/i.test(currentVersion)) {
+        return 'test';
+    }
     return 'latest';
 }
 function readCurrentVersion(packageRoot) {

package/dist/lib/skills-manager.js

@@ -21,8 +21,8 @@ const NOCOBASE_SKILLS_NAME_PREFIX = 'nocobase-';
 // resolves and boots the package, even when the local skills installation is healthy.
 const SKILLS_LIST_TIMEOUT_MS = 15000;
 const SKILLS_NPM_VIEW_TIMEOUT_MS = 3000;
-const SKILLS_PACK_TIMEOUT_MS = 30000;
-const SKILLS_ADD_TIMEOUT_MS = 20000;
+const SKILLS_PACK_TIMEOUT_MS = 120000;
+const SKILLS_ADD_TIMEOUT_MS = 120000;
 const NPM_REGISTRY_UNAVAILABLE_PATTERNS = [
     'enotfound',
     'eai_again',
@@ -279,6 +279,7 @@ async function prepareLocalSkillsPackage(globalRoot, options = {}, targetVersion
     const cachedVersion = await readCachedSkillsVersion(cacheRoot);
     await fsp.mkdir(cacheRoot, { recursive: true });
     if (targetVersion && cachedVersion && compareVersions(cachedVersion, targetVersion) === 0) {
+        options.onProgress?.(`Using cached ${NOCOBASE_SKILLS_PACKAGE_NAME}@${targetVersion}...`);
         return {
             packageDir,
             cleanup: async () => undefined,
@@ -287,12 +288,14 @@ async function prepareLocalSkillsPackage(globalRoot, options = {}, targetVersion
     await fsp.rm(packRoot, { recursive: true, force: true });
     await fsp.mkdir(packRoot, { recursive: true });
     try {
-        await (options.runFn ?? run)('npm', ['pack', '--silent', packageSpec], {
+        options.onProgress?.(`Downloading ${packageSpec}...`);
+        await (options.runFn ?? run)('npm', ['pack', ...(options.verbose ? [] : ['--silent']), packageSpec], {
             cwd: packRoot,
             stdio: options.verbose ? 'inherit' : 'ignore',
             errorName: 'npm pack',
             timeoutMs: SKILLS_PACK_TIMEOUT_MS,
         });
+        options.onProgress?.(`Extracting ${NOCOBASE_SKILLS_PACKAGE_NAME}...`);
         const tarballPath = await resolvePackedSkillsTarball(packRoot);
         await extractPackedSkillsTarball(tarballPath, cacheRoot, targetVersion);
     }
@@ -385,6 +388,7 @@ async function persistManagedSkillsState(globalRoot, options = {}, installedVers
 async function reinstallManagedSkills(globalRoot, options = {}, targetVersion) {
     const prepared = await prepareLocalSkillsPackage(globalRoot, options, targetVersion);
     try {
+        options.onProgress?.('Installing NocoBase AI coding skills globally...');
         await (options.runFn ?? run)('npx', ['-y', 'skills', 'add', prepared.packageDir, '-g', '-y', '--skill', '*'], {
             cwd: globalRoot,
             stdio: options.verbose ? 'inherit' : 'ignore',
@@ -407,6 +411,7 @@ async function removeObsoleteManagedSkills(globalRoot, installedSkillNames, opti
     const packageSkillNames = await readCachedPackageSkillNames(globalRoot);
     const obsoleteSkillNames = pickObsoleteManagedSkillNames(installedSkillNames, packageSkillNames);
     for (const skillName of obsoleteSkillNames) {
+        options.onProgress?.(`Removing obsolete skill ${skillName}...`);
         await (options.runFn ?? run)('npx', ['-y', 'skills', 'remove', skillName, '-g', '-y'], {
             cwd: globalRoot,
             stdio: options.verbose ? 'inherit' : 'ignore',
@@ -416,6 +421,7 @@ async function removeObsoleteManagedSkills(globalRoot, installedSkillNames, opti
 }
 export async function installNocoBaseSkills(options = {}) {
     const globalRoot = resolveSkillsRoot(options);
+    options.onProgress?.('Checking installed NocoBase AI coding skills...');
     const status = await inspectSkillsStatus({
         globalRoot,
         commandOutputFn: options.commandOutputFn,
@@ -437,6 +443,7 @@ export async function installNocoBaseSkills(options = {}) {
         await reinstallManagedSkills(globalRoot, options, installVersion);
     }
     await removeObsoleteManagedSkills(globalRoot, status.installedSkillNames, options);
+    options.onProgress?.('Verifying installed NocoBase AI coding skills...');
     return {
         action: 'installed',
         status: await persistManagedSkillsState(globalRoot, options, targetVersion),
@@ -444,6 +451,7 @@ export async function installNocoBaseSkills(options = {}) {
 }
 export async function updateNocoBaseSkills(options = {}) {
     const globalRoot = resolveSkillsRoot(options);
+    options.onProgress?.('Checking installed NocoBase AI coding skills...');
     const status = await inspectSkillsStatus({
         globalRoot,
         commandOutputFn: options.commandOutputFn,
@@ -487,6 +495,7 @@ export async function updateNocoBaseSkills(options = {}) {
         await reinstallManagedSkills(globalRoot, options, installVersion);
     }
     await removeObsoleteManagedSkills(globalRoot, status.installedSkillNames, options);
+    options.onProgress?.('Verifying installed NocoBase AI coding skills...');
     return {
         action: 'updated',
         status: await persistManagedSkillsState(globalRoot, options, targetVersion),

package/dist/locale/en-US.json

@@ -1,4 +1,10 @@
 {
+  "entry": {
+    "windowsAdministratorRequired": {
+      "message": "NocoBase CLI must be run as Administrator on Windows.",
+      "hint": "Open your terminal as Administrator, then run the command again."
+    }
+  },
   "promptCatalog": {
     "common": {
       "cancelled": "Cancelled.",

package/dist/locale/zh-CN.json

@@ -1,4 +1,10 @@
 {
+  "entry": {
+    "windowsAdministratorRequired": {
+      "message": "Windows 上运行 NocoBase CLI 必须使用管理员模式。",
+      "hint": "请以管理员身份打开终端，然后重新执行命令。"
+    }
+  },
   "promptCatalog": {
     "common": {
       "cancelled": "已取消。",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/cli",
-  "version": "2.2.0-beta.2",
+  "version": "2.2.0-beta.3",
   "description": "NocoBase Command Line Tool",
   "type": "module",
   "main": "dist/generated/command-registry.js",
@@ -143,5 +143,5 @@
     "type": "git",
     "url": "git+https://github.com/nocobase/nocobase.git"
   },
-  "gitHead": "2fe3e6a86fc1d0cd039349a68b2e4d1d6945ce45"
+  "gitHead": "7b16bb2cfd427c110c6671252138cd85155723c5"
 }