@nocobase/cli 2.2.0-beta.7 → 2.2.0-beta.8

package/dist/commands/install.js

@@ -1468,8 +1468,6 @@ export default class Install extends Command {
                 '-d',
                 '--name',
                 containerName,
-                '--restart',
-                'always',
                 '--network',
                 networkName,
                 '-e',
@@ -1512,8 +1510,6 @@ export default class Install extends Command {
                 '-d',
                 '--name',
                 containerName,
-                '--restart',
-                'always',
                 '--network',
                 networkName,
                 '-e',
@@ -1558,8 +1554,6 @@ export default class Install extends Command {
                 '-d',
                 '--name',
                 containerName,
-                '--restart',
-                'always',
                 '--network',
                 networkName,
                 '-e',
@@ -1604,8 +1598,6 @@ export default class Install extends Command {
                 '-d',
                 '--name',
                 containerName,
-                '--restart',
-                'always',
                 '--network',
                 networkName,
                 '--platform',
@@ -1805,8 +1797,6 @@ export default class Install extends Command {
             '-d',
             '--name',
             containerName,
-            '--restart',
-            'always',
             '--network',
             params.networkName,
             '-p',

package/dist/commands/self/update.js

@@ -26,7 +26,7 @@ function formatSkillsUpdateMessage(result, verbose) {
 }
 export default class SelfUpdate extends Command {
     static summary = 'Update the globally installed NocoBase CLI';
-    static description = 'Update the current NocoBase CLI install when it is managed by a standard global npm install.';
+    static description = 'Update the current NocoBase CLI install when it is managed by a standard global npm, pnpm, or yarn install.';
     static examples = [
         '<%= config.bin %> <%= command.id %>',
         '<%= config.bin %> <%= command.id %> --yes',
@@ -77,7 +77,7 @@ export default class SelfUpdate extends Command {
                     message: flags.skills
                         ? `Update ${status.packageName} from ${status.currentVersion} to ${status.latestVersion} and refresh the globally installed NocoBase AI coding skills?`
                         : `Update ${status.packageName} from ${status.currentVersion} to ${status.latestVersion}?`,
-                    default: false,
+                    default: true,
                 });
             }
             catch {

package/dist/lib/app-managed-resources.js

@@ -225,8 +225,6 @@ export async function buildSavedDockerRunArgs(runtime, options) {
         '-d',
         '--name',
         runtime.containerName,
-        '--restart',
-        'always',
         '--network',
         runtime.workspaceName,
     ];

package/dist/lib/auth-store.js

@@ -99,6 +99,17 @@ function normalizeAuthConfig(config) {
         ? settings.log.retentionDays
         : undefined;
     const logEnabled = typeof settings.log?.enabled === 'boolean' ? settings.log.enabled : undefined;
+    const hasBinSettings = settings.bin?.docker ||
+        settings.bin?.caddy ||
+        settings.bin?.git ||
+        settings.bin?.nginx ||
+        settings.bin?.pnpm ||
+        settings.bin?.yarn;
+    const hasProxySettings = settings.proxy?.nbCliRoot ||
+        settings.proxy?.caddyDriver ||
+        settings.proxy?.nginxDriver ||
+        settings.proxy?.upstreamHost ||
+        settings.proxy?.host;
     return {
         name: config.name || config.dockerResourcePrefix,
         settings: {
@@ -123,22 +134,19 @@ function normalizeAuthConfig(config) {
                     },
                 }
                 : {}),
-            ...(settings.bin?.docker || settings.bin?.caddy || settings.bin?.git || settings.bin?.nginx || settings.bin?.yarn
+            ...(hasBinSettings
                 ? {
                     bin: {
                         ...(settings.bin?.docker ? { docker: normalizeOptionalString(settings.bin.docker) } : {}),
                         ...(settings.bin?.caddy ? { caddy: normalizeOptionalString(settings.bin.caddy) } : {}),
                         ...(settings.bin?.git ? { git: normalizeOptionalString(settings.bin.git) } : {}),
                         ...(settings.bin?.nginx ? { nginx: normalizeOptionalString(settings.bin.nginx) } : {}),
+                        ...(settings.bin?.pnpm ? { pnpm: normalizeOptionalString(settings.bin.pnpm) } : {}),
                         ...(settings.bin?.yarn ? { yarn: normalizeOptionalString(settings.bin.yarn) } : {}),
                     },
                 }
                 : {}),
-            ...(settings.proxy?.nbCliRoot ||
-                settings.proxy?.caddyDriver ||
-                settings.proxy?.nginxDriver ||
-                settings.proxy?.upstreamHost ||
-                settings.proxy?.host
+            ...(hasProxySettings
                 ? {
                     proxy: {
                         ...(settings.proxy?.nbCliRoot ? { nbCliRoot: normalizeOptionalString(settings.proxy.nbCliRoot) } : {}),

package/dist/lib/cli-config.js

@@ -16,6 +16,7 @@ export const DEFAULT_DOCKER_BIN = 'docker';
 export const DEFAULT_CADDY_BIN = 'caddy';
 export const DEFAULT_GIT_BIN = 'git';
 export const DEFAULT_NGINX_BIN = 'nginx';
+export const DEFAULT_PNPM_BIN = 'pnpm';
 export const PROXY_PROVIDER_OPTIONS = ['nginx', 'caddy'];
 export const DEFAULT_PROXY_PROVIDER = 'nginx';
 export const NGINX_PROXY_DRIVER_OPTIONS = ['local', 'docker'];
@@ -40,6 +41,7 @@ export const SUPPORTED_CLI_CONFIG_KEYS = [
     'bin.caddy',
     'bin.git',
     'bin.nginx',
+    'bin.pnpm',
     'proxy.nb-cli-root',
     'proxy.caddy-driver',
     'proxy.nginx-driver',
@@ -136,6 +138,7 @@ function pruneSettings(config) {
         !trimValue(bin.caddy) &&
         !trimValue(bin.git) &&
         !trimValue(bin.nginx) &&
+        !trimValue(bin.pnpm) &&
         !trimValue(bin.yarn)) {
         delete config.settings?.bin;
     }
@@ -187,6 +190,8 @@ export function getExplicitCliConfigValue(config, key) {
             return trimValue(config.settings?.bin?.git);
         case 'bin.nginx':
             return trimValue(config.settings?.bin?.nginx);
+        case 'bin.pnpm':
+            return trimValue(config.settings?.bin?.pnpm);
         case 'proxy.nb-cli-root':
             return trimValue(config.settings?.proxy?.nbCliRoot);
         case 'proxy.caddy-driver':
@@ -233,6 +238,8 @@ export function getEffectiveCliConfigValue(config, key) {
             return DEFAULT_GIT_BIN;
         case 'bin.nginx':
             return DEFAULT_NGINX_BIN;
+        case 'bin.pnpm':
+            return DEFAULT_PNPM_BIN;
         case 'proxy.nb-cli-root':
             return explicit ?? resolveCliHomeRoot();
         case 'proxy.caddy-driver':
@@ -387,6 +394,12 @@ export async function setCliConfigValue(key, value, options = {}) {
                 nginx: normalized,
             };
             break;
+        case 'bin.pnpm':
+            config.settings.bin = {
+                ...(config.settings.bin ?? {}),
+                pnpm: normalized,
+            };
+            break;
         case 'proxy.nb-cli-root':
             config.settings.proxy = {
                 ...(config.settings.proxy ?? {}),
@@ -496,6 +509,11 @@ export async function deleteCliConfigValue(key, options = {}) {
                 delete config.settings.bin.nginx;
             }
             break;
+        case 'bin.pnpm':
+            if (config.settings.bin) {
+                delete config.settings.bin.pnpm;
+            }
+            break;
         case 'proxy.nb-cli-root':
             if (config.settings.proxy) {
                 delete config.settings.proxy.nbCliRoot;
@@ -556,6 +574,7 @@ const CONFIGURABLE_COMMAND_KEYS = {
     caddy: 'bin.caddy',
     git: 'bin.git',
     nginx: 'bin.nginx',
+    pnpm: 'bin.pnpm',
     yarn: 'bin.yarn',
 };
 export function isConfigurableCommandName(value) {

package/dist/lib/env-auth.js

@@ -22,9 +22,45 @@ const OAUTH_FETCH_TIMEOUT_MS = 15_000;
 const OAUTH_FETCH_RETRY_DELAYS_MS = [500, 1_000, 2_000];
 const DEFAULT_OAUTH_SCOPE = 'openid api offline_access';
 const DEFAULT_CLIENT_NAME = 'NocoBase CLI';
+const DEVICE_CODE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';
+const DEFAULT_DEVICE_POLL_INTERVAL_SECONDS = 5;
 function normalizeBaseUrl(baseUrl) {
     return baseUrl.replace(/\/+$/, '');
 }
+function buildDeviceVerificationPathFromApiBaseUrl(apiBaseUrl) {
+    const url = new URL(apiBaseUrl);
+    const subappMatch = url.pathname.match(/^(.*)\/api\/__app\/([^/]+)\/?$/);
+    if (subappMatch) {
+        const publicPath = (subappMatch[1] || '').replace(/\/+$/, '');
+        return `${publicPath}/apps/${subappMatch[2]}/idpOAuth/device`;
+    }
+    const appMatch = url.pathname.match(/^(.*)\/api\/?$/);
+    if (appMatch) {
+        const publicPath = (appMatch[1] || '').replace(/\/+$/, '');
+        return `${publicPath}/idpOAuth/device`;
+    }
+    return undefined;
+}
+export function resolveDeviceVerificationUrlForApiBaseUrl(verificationUrl, apiBaseUrl) {
+    try {
+        const devicePath = buildDeviceVerificationPathFromApiBaseUrl(apiBaseUrl);
+        if (!devicePath) {
+            return verificationUrl;
+        }
+        const originalUrl = new URL(verificationUrl);
+        if (!originalUrl.pathname.endsWith('/idpOAuth/device')) {
+            return verificationUrl;
+        }
+        const publicUrl = new URL(apiBaseUrl);
+        publicUrl.pathname = devicePath;
+        publicUrl.search = originalUrl.search;
+        publicUrl.hash = originalUrl.hash;
+        return publicUrl.toString();
+    }
+    catch {
+        return verificationUrl;
+    }
+}
 export function getOauthMetadataUrl(baseUrl) {
     return `${normalizeBaseUrl(baseUrl)}/.well-known/oauth-authorization-server`;
 }
@@ -129,6 +165,16 @@ function getOauthFetchRetryDelays() {
     }
     return OAUTH_FETCH_RETRY_DELAYS_MS;
 }
+function getDevicePollIntervalMs(intervalSeconds) {
+    const override = process.env.NB_CLI_OAUTH_DEVICE_POLL_INTERVAL_MS;
+    if (override !== undefined) {
+        const delay = Number(override);
+        if (Number.isFinite(delay) && delay >= 0) {
+            return Math.max(1, delay);
+        }
+    }
+    return Math.max(1, intervalSeconds ?? DEFAULT_DEVICE_POLL_INTERVAL_SECONDS) * 1000;
+}
 function formatOauthRetryMessage(options) {
     return `${options.operation} failed (${options.reason}). Retrying ${options.attempt}/${options.maxAttempts}...`;
 }
@@ -223,6 +269,31 @@ async function registerOauthClient(metadata, redirectUri, options = {}) {
     if (!metadata.registration_endpoint) {
         throw new Error('OAuth server does not expose a dynamic client registration endpoint.');
     }
+    let body;
+    if (options.deviceFlow) {
+        body = {
+            client_name: DEFAULT_CLIENT_NAME,
+            application_type: 'native',
+            token_endpoint_auth_method: 'none',
+            grant_types: [DEVICE_CODE_GRANT_TYPE, 'refresh_token'],
+            response_types: [],
+            scope: DEFAULT_OAUTH_SCOPE,
+        };
+    }
+    else {
+        if (!redirectUri) {
+            throw new Error('OAuth redirect URI is required for browser sign-in.');
+        }
+        body = {
+            client_name: DEFAULT_CLIENT_NAME,
+            application_type: 'native',
+            token_endpoint_auth_method: 'none',
+            grant_types: ['authorization_code', 'refresh_token'],
+            response_types: ['code'],
+            scope: DEFAULT_OAUTH_SCOPE,
+            redirect_uris: [redirectUri],
+        };
+    }
     let response;
     try {
         response = await fetchWithOauthRetry(metadata.registration_endpoint, {
@@ -231,15 +302,7 @@ async function registerOauthClient(metadata, redirectUri, options = {}) {
                 accept: 'application/json',
                 'content-type': 'application/json',
             },
-            body: JSON.stringify({
-                client_name: DEFAULT_CLIENT_NAME,
-                application_type: 'native',
-                token_endpoint_auth_method: 'none',
-                grant_types: ['authorization_code', 'refresh_token'],
-                response_types: ['code'],
-                scope: DEFAULT_OAUTH_SCOPE,
-                redirect_uris: [redirectUri],
-            }),
+            body: JSON.stringify(body),
         }, {
             operation: 'Registering OAuth client',
             onRetry: (message) => updateTask(message),
@@ -594,6 +657,10 @@ async function maybeOpenBrowser(url) {
         cleanup,
     };
 }
+let browserOpener = maybeOpenBrowser;
+export function setOauthBrowserOpenerForTests(opener) {
+    browserOpener = opener || maybeOpenBrowser;
+}
 async function createLoopbackServer(state) {
     const result = await new Promise((resolve, reject) => {
         const server = createServer((req, res) => {
@@ -706,6 +773,109 @@ async function exchangeAuthorizationCode(options) {
     }
     return data;
 }
+async function requestDeviceAuthorization(options) {
+    if (!options.metadata.device_authorization_endpoint) {
+        throw new Error('OAuth server does not expose a device authorization endpoint.');
+    }
+    const body = new URLSearchParams({
+        client_id: options.clientId,
+        scope: options.scope,
+        resource: options.resource,
+    });
+    let response;
+    try {
+        response = await fetchWithOauthRetry(options.metadata.device_authorization_endpoint, {
+            method: 'POST',
+            headers: {
+                accept: 'application/json',
+                'content-type': 'application/x-www-form-urlencoded',
+            },
+            body,
+        }, {
+            operation: 'Starting OAuth device authorization',
+            onRetry: (message) => updateTask(message),
+        });
+    }
+    catch (error) {
+        throw new Error(formatOauthFetchFailure('Failed to start OAuth device authorization.', {
+            envName: options.envName,
+            baseUrl: options.baseUrl,
+            url: options.metadata.device_authorization_endpoint,
+            rawMessage: error instanceof Error ? error.message : String(error),
+        }));
+    }
+    const data = await parseJsonResponse(response);
+    if (!response.ok) {
+        throw new Error(formatOauthError('Failed to start OAuth device authorization', data, response.status));
+    }
+    if (!data ||
+        typeof data !== 'object' ||
+        typeof data.device_code !== 'string' ||
+        typeof data.user_code !== 'string' ||
+        typeof data.verification_uri !== 'string') {
+        throw new Error('OAuth device authorization response is missing device_code, user_code, or verification_uri.');
+    }
+    return data;
+}
+async function pollDeviceToken(options) {
+    let intervalMs = getDevicePollIntervalMs(options.interval);
+    const deadline = Date.now() + Math.max(1, options.expiresIn ?? OAUTH_LOGIN_TIMEOUT_MS / 1000) * 1000;
+    while (Date.now() < deadline) {
+        await sleep(intervalMs);
+        const body = new URLSearchParams({
+            grant_type: DEVICE_CODE_GRANT_TYPE,
+            client_id: options.clientId,
+            device_code: options.deviceCode,
+        });
+        let response;
+        try {
+            response = await fetchWithOauthRetry(options.metadata.token_endpoint, {
+                method: 'POST',
+                headers: {
+                    accept: 'application/json',
+                    'content-type': 'application/x-www-form-urlencoded',
+                },
+                body,
+            }, {
+                operation: 'Polling OAuth device authorization',
+                onRetry: (message) => updateTask(message),
+            });
+        }
+        catch (error) {
+            throw new Error(formatOauthFetchFailure('Failed to poll OAuth device authorization.', {
+                envName: options.envName,
+                baseUrl: options.baseUrl,
+                url: options.metadata.token_endpoint,
+                rawMessage: error instanceof Error ? error.message : String(error),
+            }));
+        }
+        const data = await parseJsonResponse(response);
+        if (response.ok) {
+            if (!data || typeof data !== 'object' || typeof data.access_token !== 'string') {
+                throw new Error('OAuth token response is missing access_token.');
+            }
+            return data;
+        }
+        const oauthError = typeof data === 'object' && data ? String(data.error || '') : '';
+        if (oauthError === 'authorization_pending') {
+            updateTask(`Waiting for you to approve device sign-in for "${options.envName}"...`);
+            continue;
+        }
+        if (oauthError === 'slow_down') {
+            intervalMs += 5_000;
+            updateTask(`OAuth server asked us to slow down. Polling again in ${Math.ceil(intervalMs / 1000)}s...`);
+            continue;
+        }
+        if (oauthError === 'expired_token') {
+            throw new Error(`OAuth device sign-in expired. Run \`nb env auth ${options.envName}\` to try again.`);
+        }
+        if (oauthError === 'access_denied') {
+            throw new Error('OAuth device sign-in was denied.');
+        }
+        throw new Error(formatOauthError('Failed to poll OAuth device authorization', data, response.status));
+    }
+    throw new Error(`OAuth device sign-in timed out. Run \`nb env auth ${options.envName}\` to try again.`);
+}
 async function refreshOauthAccessToken(options) {
     if (!options.auth.refreshToken || !options.auth.clientId) {
         throw new Error(`OAuth session for env "${options.envName}" cannot be refreshed. Run \`nb env auth ${options.envName}\`.`);
@@ -862,41 +1032,79 @@ export async function authenticateEnvWithBasic(options) {
     }
     return token;
 }
-export async function authenticateEnvWithOauth(options) {
-    const envName = options.envName ?? (await getCurrentEnvName({ scope: options.scope }));
-    const env = await getEnv(envName, { scope: options.scope });
-    const baseUrl = env?.baseUrl;
-    if (!baseUrl) {
-        throw new Error([
-            env
-                ? `Environment "${envName}" does not have an API base URL yet.`
-                : `Environment "${envName}" has not been set up yet.`,
-            env
-                ? `Run \`nb env update ${envName} --api-base-url <url>\` to finish setting it up.`
-                : `Run \`nb init --ui --env ${envName}\` first.`,
-        ]
-            .filter(Boolean)
-            .join('\n'));
+async function authenticateEnvWithOauthDevice(options) {
+    const resource = getOauthResource(options.metadata.issuer);
+    let cleanupBrowserOpenTarget;
+    try {
+        updateTask(`Preparing device sign-in for "${options.envName}"...`);
+        const registration = await registerOauthClient(options.metadata, undefined, {
+            envName: options.envName,
+            baseUrl: options.baseUrl,
+            deviceFlow: true,
+        });
+        const deviceAuthorization = await requestDeviceAuthorization({
+            metadata: options.metadata,
+            clientId: registration.clientId,
+            scope: DEFAULT_OAUTH_SCOPE,
+            resource,
+            envName: options.envName,
+            baseUrl: options.baseUrl,
+        });
+        stopTask();
+        const verificationUrl = resolveDeviceVerificationUrlForApiBaseUrl(deviceAuthorization.verification_uri_complete || deviceAuthorization.verification_uri, options.baseUrl);
+        const browser = await browserOpener(verificationUrl);
+        cleanupBrowserOpenTarget = browser.cleanup;
+        if (!browser.opened) {
+            printWarningBlock('We could not open your browser automatically. Open the URL below to approve device sign-in:');
+        }
+        else {
+            printInfo(`Opening device sign-in for "${options.envName}" in your browser.`);
+            printInfo('If the browser does not open automatically, open this URL manually:');
+        }
+        printInfo(verificationUrl);
+        printInfo(`Enter code: ${deviceAuthorization.user_code}`);
+        updateTask(`Waiting for you to approve device sign-in for "${options.envName}"...`);
+        const tokenResponse = await pollDeviceToken({
+            metadata: options.metadata,
+            clientId: registration.clientId,
+            deviceCode: deviceAuthorization.device_code,
+            expiresIn: deviceAuthorization.expires_in,
+            interval: deviceAuthorization.interval,
+            envName: options.envName,
+            baseUrl: options.baseUrl,
+        });
+        if (!tokenResponse.refresh_token) {
+            printWarning('Sign-in succeeded, but no refresh token was returned. You may need to sign in again when this session expires.');
+        }
+        await setEnvOauthSession(options.envName, {
+            type: 'oauth',
+            accessToken: tokenResponse.access_token,
+            refreshToken: tokenResponse.refresh_token,
+            expiresAt: calculateExpiresAt(tokenResponse.expires_in),
+            scope: tokenResponse.scope || DEFAULT_OAUTH_SCOPE,
+            issuer: options.metadata.issuer,
+            clientId: registration.clientId,
+            resource,
+        }, { scope: options.scope });
     }
-    printVerbose(`Starting OAuth sign-in for env "${envName}" using ${baseUrl}`);
-    updateTask(`Checking sign-in settings for "${envName}"...`);
-    const metadata = await fetchOauthServerMetadata(baseUrl, {
-        envName,
-        onRetry: (message) => updateTask(message),
-    });
+    finally {
+        await cleanupBrowserOpenTarget?.().catch(() => undefined);
+    }
+}
+async function authenticateEnvWithOauthBrowser(options) {
     const state = encodeBase64Url(crypto.randomBytes(16));
     const { codeVerifier, codeChallenge } = buildPkcePair();
     const callback = await createLoopbackServer(state);
-    const resource = getOauthResource(metadata.issuer);
+    const resource = getOauthResource(options.metadata.issuer);
     let cleanupBrowserOpenTarget;
     try {
         printVerbose(`OAuth callback listener ready at ${callback.redirectUri}`);
-        updateTask(`Preparing secure browser sign-in for "${envName}"...`);
-        const registration = await registerOauthClient(metadata, callback.redirectUri, {
-            envName,
-            baseUrl,
+        updateTask(`Preparing secure browser sign-in for "${options.envName}"...`);
+        const registration = await registerOauthClient(options.metadata, callback.redirectUri, {
+            envName: options.envName,
+            baseUrl: options.baseUrl,
         });
-        const authorizationUrl = new URL(metadata.authorization_endpoint);
+        const authorizationUrl = new URL(options.metadata.authorization_endpoint);
         authorizationUrl.searchParams.set('response_type', 'code');
         authorizationUrl.searchParams.set('client_id', registration.clientId);
         authorizationUrl.searchParams.set('redirect_uri', callback.redirectUri);
@@ -906,8 +1114,8 @@ export async function authenticateEnvWithOauth(options) {
         authorizationUrl.searchParams.set('code_challenge', codeChallenge);
         authorizationUrl.searchParams.set('code_challenge_method', 'S256');
         authorizationUrl.searchParams.set('resource', resource);
-        updateTask(`Waiting for you to finish signing in for "${envName}"...`);
-        const browser = await maybeOpenBrowser(authorizationUrl.toString());
+        updateTask(`Waiting for you to finish signing in for "${options.envName}"...`);
+        const browser = await browserOpener(authorizationUrl.toString());
         cleanupBrowserOpenTarget = browser.cleanup;
         if (!browser.opened) {
             printWarningBlock('We could not open your browser automatically. Open the URL below to continue signing in:');
@@ -918,7 +1126,7 @@ export async function authenticateEnvWithOauth(options) {
         }
         printInfo(authorizationUrl.toString());
         const code = await new Promise((resolve, reject) => {
-            const timeout = setTimeout(() => reject(new Error(`OAuth sign-in timed out after 5 minutes. Run \`nb env auth ${envName}\` to try again.`)), OAUTH_LOGIN_TIMEOUT_MS);
+            const timeout = setTimeout(() => reject(new Error(`OAuth sign-in timed out after 5 minutes. Run \`nb env auth ${options.envName}\` to try again.`)), OAUTH_LOGIN_TIMEOUT_MS);
             timeout.unref?.();
             callback
                 .waitForCode()
@@ -931,27 +1139,27 @@ export async function authenticateEnvWithOauth(options) {
                 reject(error);
             });
         });
-        updateTask(`Finishing sign-in for "${envName}"...`);
+        updateTask(`Finishing sign-in for "${options.envName}"...`);
         const tokenResponse = await exchangeAuthorizationCode({
-            metadata,
+            metadata: options.metadata,
             clientId: registration.clientId,
             redirectUri: callback.redirectUri,
             code,
             codeVerifier,
             resource,
-            envName,
-            baseUrl,
+            envName: options.envName,
+            baseUrl: options.baseUrl,
         });
         if (!tokenResponse.refresh_token) {
             printWarning('Sign-in succeeded, but no refresh token was returned. You may need to sign in again when this session expires.');
         }
-        await setEnvOauthSession(envName, {
+        await setEnvOauthSession(options.envName, {
             type: 'oauth',
             accessToken: tokenResponse.access_token,
             refreshToken: tokenResponse.refresh_token,
             expiresAt: calculateExpiresAt(tokenResponse.expires_in),
             scope: tokenResponse.scope || DEFAULT_OAUTH_SCOPE,
-            issuer: metadata.issuer,
+            issuer: options.metadata.issuer,
             clientId: registration.clientId,
             resource,
         }, { scope: options.scope });
@@ -961,3 +1169,41 @@ export async function authenticateEnvWithOauth(options) {
         await callback.close().catch(() => undefined);
     }
 }
+export async function authenticateEnvWithOauth(options) {
+    const envName = options.envName ?? (await getCurrentEnvName({ scope: options.scope }));
+    const env = await getEnv(envName, { scope: options.scope });
+    const baseUrl = env?.baseUrl;
+    if (!baseUrl) {
+        throw new Error([
+            env
+                ? `Environment "${envName}" does not have an API base URL yet.`
+                : `Environment "${envName}" has not been set up yet.`,
+            env
+                ? `Run \`nb env update ${envName} --api-base-url <url>\` to finish setting it up.`
+                : `Run \`nb init --ui --env ${envName}\` first.`,
+        ]
+            .filter(Boolean)
+            .join('\n'));
+    }
+    printVerbose(`Starting OAuth sign-in for env "${envName}" using ${baseUrl}`);
+    updateTask(`Checking sign-in settings for "${envName}"...`);
+    const metadata = await fetchOauthServerMetadata(baseUrl, {
+        envName,
+        onRetry: (message) => updateTask(message),
+    });
+    if (metadata.device_authorization_endpoint) {
+        await authenticateEnvWithOauthDevice({
+            envName,
+            baseUrl,
+            metadata,
+            scope: options.scope,
+        });
+        return;
+    }
+    await authenticateEnvWithOauthBrowser({
+        envName,
+        baseUrl,
+        metadata,
+        scope: options.scope,
+    });
+}

package/dist/lib/prompt-validators.js

@@ -10,7 +10,7 @@ import { spawn } from 'node:child_process';
 import net from 'node:net';
 import { translateCli } from "./cli-locale.js";
 const API_BASE_URL_EXAMPLE = 'http://localhost:13000/api';
-const ENV_KEY_PATTERN = /^[A-Za-z0-9]+$/;
+const ENV_KEY_PATTERN = /^[A-Za-z0-9_-]+$/;
 const APP_PUBLIC_PATH_PATTERN = /^\/(?:[A-Za-z0-9_-]+(?:\/[A-Za-z0-9_-]+)*)?\/?$/;
 const TCP_PORT_EXAMPLE = '13000';
 const API_BASE_URL_REQUEST_TIMEOUT_MS = 5_000;

package/dist/lib/run-npm.js

@@ -44,6 +44,10 @@ const MISSING_COMMAND_SPECS = {
         displayName: 'Yarn',
         configKey: 'bin.yarn',
     },
+    pnpm: {
+        displayName: 'pnpm',
+        configKey: 'bin.pnpm',
+    },
 };
 const DOCKER_DAEMON_UNAVAILABLE_PATTERNS = [
     /cannot connect to the docker daemon/i,

package/dist/lib/self-manager.js

@@ -7,14 +7,12 @@
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
 import fs from 'node:fs';
-import fsp from 'node:fs/promises';
+import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { resolveCliHomeDir } from './cli-home.js';
 import { commandOutput, run } from './run-npm.js';
 const DEFAULT_PACKAGE_NAME = '@nocobase/cli';
 const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
-const INSTALL_METHOD_CACHE_FILE = 'self-install-methods.json';
 function normalizePath(value) {
     return path.resolve(value);
 }
@@ -108,56 +106,216 @@ function readCurrentVersion(packageRoot) {
     const pkg = JSON.parse(content);
     return String(pkg.version ?? '').trim();
 }
-function detectInstallMethod(packageRoot, globalPrefix) {
+function detectInstallMethod(packageRoot, options = {}) {
     if (fs.existsSync(path.join(packageRoot, 'src'))
         && fs.existsSync(path.join(packageRoot, 'tsconfig.json'))) {
         return 'source';
     }
-    if (globalPrefix && isSubPath(globalPrefix, packageRoot)) {
+    if (options.globalPrefix && isSubPath(options.globalPrefix, packageRoot)) {
         return 'npm-global';
     }
+    if (options.yarnGlobalDir && isSubPath(options.yarnGlobalDir, packageRoot)) {
+        return 'yarn-global';
+    }
+    if (isPnpmGlobalInstallPath({
+        packageName: options.packageName ?? DEFAULT_PACKAGE_NAME,
+        packageRoot,
+        pnpmGlobalBin: options.pnpmGlobalBin,
+        pnpmGlobalRoot: options.pnpmGlobalRoot,
+    })) {
+        return 'pnpm-global';
+    }
+    // Best-effort fallback for environments where pnpm probes are unavailable.
+    if (isPnpmGlobalPath(packageRoot)) {
+        return 'pnpm-global';
+    }
     if (packageRoot.includes(`${path.sep}node_modules${path.sep}`)) {
         return 'package-local';
     }
     return 'unknown';
 }
-function getInstallMethodCacheFile() {
-    return path.join(resolveCliHomeDir('global'), INSTALL_METHOD_CACHE_FILE);
+function isPnpmGlobalPath(packageRoot) {
+    const normalized = normalizePath(packageRoot);
+    const segments = normalized.split(path.sep).filter(Boolean);
+    const globalIndex = segments.findIndex((segment, index) => segment === 'global' && segments[index - 1] === 'pnpm');
+    if (globalIndex === -1) {
+        return false;
+    }
+    return segments.slice(globalIndex + 2).includes('node_modules');
 }
-function getInstallMethodCacheKey(packageRoot) {
-    return normalizePath(path.join(packageRoot, 'bin', 'run.js'));
+function normalizePnpmGlobalNodeModulesRoot(pnpmGlobalRoot) {
+    const normalizedGlobalRoot = normalizePath(pnpmGlobalRoot);
+    return path.basename(normalizedGlobalRoot) === 'node_modules'
+        ? normalizedGlobalRoot
+        : path.join(normalizedGlobalRoot, 'node_modules');
 }
-async function readInstallMethodCache() {
+function readSiblingPnpmGlobalNodeModulesRoots(pnpmGlobalRoot) {
+    const globalNodeModulesDir = normalizePnpmGlobalNodeModulesRoot(pnpmGlobalRoot);
+    const globalProjectDir = path.dirname(globalNodeModulesDir);
+    let entries;
     try {
-        const raw = await fsp.readFile(getInstallMethodCacheFile(), 'utf8');
-        return JSON.parse(raw);
+        entries = fs.readdirSync(globalProjectDir);
     }
     catch {
-        return {};
+        return [];
     }
+    return entries
+        .filter((entry) => {
+        if (entry === path.basename(globalNodeModulesDir)) {
+            return false;
+        }
+        try {
+            return fs.statSync(path.join(globalProjectDir, entry)).isDirectory();
+        }
+        catch {
+            return false;
+        }
+    })
+        .map((entry) => path.join(globalProjectDir, entry, 'node_modules'));
 }
-async function writeInstallMethodCache(state) {
-    const filePath = getInstallMethodCacheFile();
-    await fsp.mkdir(path.dirname(filePath), { recursive: true });
-    await fsp.writeFile(filePath, JSON.stringify(state, null, 2));
+function readPnpmGlobalNodeModulesRoots(pnpmGlobalRoot) {
+    return [normalizePnpmGlobalNodeModulesRoot(pnpmGlobalRoot), ...readSiblingPnpmGlobalNodeModulesRoots(pnpmGlobalRoot)];
 }
-async function readCachedInstallMethod(packageRoot) {
-    const state = await readInstallMethodCache();
-    return state.entries?.[getInstallMethodCacheKey(packageRoot)];
+function packageNameToPath(packageName) {
+    return packageName.split('/').filter(Boolean);
 }
-async function writeCachedInstallMethod(packageRoot, entry) {
-    const state = await readInstallMethodCache();
-    const entries = {
-        ...(state.entries ?? {}),
-        [getInstallMethodCacheKey(packageRoot)]: entry,
-    };
-    await writeInstallMethodCache({ entries });
+function isSameRealPath(left, right) {
+    try {
+        return normalizePath(fs.realpathSync(left)) === normalizePath(fs.realpathSync(right));
+    }
+    catch {
+        return false;
+    }
+}
+function isPnpmGlobalRootPath(pnpmGlobalRoot, packageRoot) {
+    if (isSubPath(pnpmGlobalRoot, packageRoot)) {
+        return true;
+    }
+    const globalNodeModulesDir = normalizePnpmGlobalNodeModulesRoot(pnpmGlobalRoot);
+    const globalProjectDir = path.dirname(globalNodeModulesDir);
+    if (!isSubPath(globalProjectDir, packageRoot)) {
+        return false;
+    }
+    const segments = normalizePath(packageRoot).split(path.sep).filter(Boolean);
+    const pnpmStoreIndex = segments.indexOf('.pnpm');
+    if (pnpmStoreIndex === -1) {
+        return false;
+    }
+    return segments.slice(pnpmStoreIndex + 1).includes('node_modules');
+}
+function isPnpmGlobalPackagePath(pnpmGlobalRoot, packageRoot, packageName) {
+    return readPnpmGlobalNodeModulesRoots(pnpmGlobalRoot).some((pnpmGlobalNodeModulesRoot) => isSameRealPath(path.join(pnpmGlobalNodeModulesRoot, ...packageNameToPath(packageName)), packageRoot));
+}
+function isPnpmGlobalBinProjectPath(pnpmGlobalBin, packageRoot, packageName) {
+    const pnpmHome = path.dirname(normalizePath(pnpmGlobalBin));
+    const globalDir = path.join(pnpmHome, 'global');
+    if (isSubPath(globalDir, packageRoot)) {
+        return true;
+    }
+    let entries;
+    try {
+        entries = fs.readdirSync(globalDir);
+    }
+    catch {
+        return false;
+    }
+    return entries.some((entry) => {
+        const pnpmGlobalRoot = path.join(globalDir, entry);
+        return (isPnpmGlobalRootPath(pnpmGlobalRoot, packageRoot)
+            || isPnpmGlobalPackagePath(pnpmGlobalRoot, packageRoot, packageName));
+    });
+}
+function isPnpmGlobalInstallPath(options) {
+    if (options.pnpmGlobalRoot) {
+        const matchedRoot = isPnpmGlobalRootPath(options.pnpmGlobalRoot, options.packageRoot)
+            || isPnpmGlobalPackagePath(options.pnpmGlobalRoot, options.packageRoot, options.packageName);
+        if (matchedRoot) {
+            return true;
+        }
+    }
+    if (options.pnpmGlobalBin) {
+        return isPnpmGlobalBinProjectPath(options.pnpmGlobalBin, options.packageRoot, options.packageName);
+    }
+    return false;
+}
+function readCurrentBinPath(currentBinPath) {
+    const candidate = String(currentBinPath ?? process.argv[1] ?? '').trim();
+    if (!candidate) {
+        return undefined;
+    }
+    return normalizePath(candidate);
+}
+function cleanCommandPath(value) {
+    const trimmed = value.trim();
+    return trimmed ? trimmed : undefined;
+}
+function resolvePackageManagerProbeCwd() {
+    const candidates = [os.homedir(), os.tmpdir(), path.parse(process.cwd()).root];
+    for (const candidate of candidates) {
+        if (!candidate) {
+            continue;
+        }
+        try {
+            if (fs.statSync(candidate).isDirectory()) {
+                return candidate;
+            }
+        }
+        catch {
+            // Ignore invalid probe cwd candidates and continue to the next one.
+        }
+    }
+    return undefined;
 }
 async function readGlobalPrefix(commandOutputFn) {
     try {
-        return (await commandOutputFn('npm', ['prefix', '-g'], {
+        return cleanCommandPath(await commandOutputFn('npm', ['prefix', '-g'], {
+            cwd: resolvePackageManagerProbeCwd(),
             errorName: 'npm prefix',
-        })).trim();
+        }));
+    }
+    catch {
+        return undefined;
+    }
+}
+async function readPnpmGlobalBin(commandOutputFn) {
+    try {
+        return cleanCommandPath(await commandOutputFn('pnpm', ['bin', '-g'], {
+            cwd: resolvePackageManagerProbeCwd(),
+            errorName: 'pnpm bin',
+        }));
+    }
+    catch {
+        return undefined;
+    }
+}
+async function readPnpmGlobalRoot(commandOutputFn) {
+    try {
+        return cleanCommandPath(await commandOutputFn('pnpm', ['root', '-g'], {
+            cwd: resolvePackageManagerProbeCwd(),
+            errorName: 'pnpm root',
+        }));
+    }
+    catch {
+        return undefined;
+    }
+}
+async function readYarnGlobalDir(commandOutputFn) {
+    try {
+        return cleanCommandPath(await commandOutputFn('yarn', ['global', 'dir'], {
+            cwd: resolvePackageManagerProbeCwd(),
+            errorName: 'yarn global dir',
+        }));
+    }
+    catch {
+        return undefined;
+    }
+}
+async function readYarnGlobalBin(commandOutputFn) {
+    try {
+        return cleanCommandPath(await commandOutputFn('yarn', ['global', 'bin'], {
+            cwd: resolvePackageManagerProbeCwd(),
+            errorName: 'yarn global bin',
+        }));
     }
     catch {
         return undefined;
@@ -174,21 +332,21 @@ function getUnsupportedSelfUpdateReason(installMethod) {
     if (installMethod === 'source') {
         return [
             'This CLI is running from source in a repository checkout.',
-            'Automatic self-update is only supported for standard global npm installs.',
+            'Automatic self-update is only supported for standard global npm, pnpm, or yarn installs.',
             'Upgrade this checkout through your repo workflow instead.',
         ].join(' ');
     }
     if (installMethod === 'package-local') {
         return [
             'This CLI is installed from a local project dependency tree.',
-            'Automatic self-update is only supported for standard global npm installs.',
+            'Automatic self-update is only supported for standard global npm, pnpm, or yarn installs.',
             'Upgrade the parent project dependency that provides this CLI instead.',
         ].join(' ');
     }
     if (installMethod === 'unknown') {
         return [
-            'This CLI install could not be recognized as a standard global npm install.',
-            'Automatic self-update is only supported for standard global npm installs.',
+            'This CLI install could not be recognized as a standard global npm, pnpm, or yarn install.',
+            'Automatic self-update is only supported for standard global npm, pnpm, or yarn installs.',
         ].join(' ');
     }
     return undefined;
@@ -217,22 +375,45 @@ export function getSelfUpdatePackageSpec(status) {
 }
 export async function inspectSelfInstall(options = {}) {
     const packageRoot = options.packageRoot ? normalizePath(options.packageRoot) : PACKAGE_ROOT;
+    const packageName = options.packageName ?? DEFAULT_PACKAGE_NAME;
     const commandOutputFn = options.commandOutputFn ?? commandOutput;
-    const cachedInstallMethod = await readCachedInstallMethod(packageRoot);
-    const globalPrefix = cachedInstallMethod?.globalPrefix ?? await readGlobalPrefix(commandOutputFn);
-    const installMethod = cachedInstallMethod?.installMethod ?? detectInstallMethod(packageRoot, globalPrefix);
-    if (!cachedInstallMethod) {
-        await writeCachedInstallMethod(packageRoot, {
-            installMethod,
-            globalPrefix,
-        });
-    }
+    const currentBinPath = readCurrentBinPath(options.currentBinPath);
+    const globalPrefix = await readGlobalPrefix(commandOutputFn);
+    const pnpmGlobalBin = await readPnpmGlobalBin(commandOutputFn);
+    const pnpmGlobalRoot = await readPnpmGlobalRoot(commandOutputFn);
+    const yarnGlobalDir = await readYarnGlobalDir(commandOutputFn);
+    const yarnGlobalBin = await readYarnGlobalBin(commandOutputFn);
+    const installMethod = detectInstallMethodFromSignals({
+        packageRoot,
+        currentBinPath,
+        globalPrefix,
+        packageName,
+        pnpmGlobalBin,
+        pnpmGlobalRoot,
+        yarnGlobalBin,
+        yarnGlobalDir,
+    });
     return {
         packageRoot,
         installMethod,
         globalPrefix,
     };
 }
+function detectInstallMethodFromSignals(options) {
+    if (options.currentBinPath && options.yarnGlobalBin && isSubPath(options.yarnGlobalBin, options.currentBinPath)) {
+        return 'yarn-global';
+    }
+    if (options.currentBinPath && options.pnpmGlobalBin && isSubPath(options.pnpmGlobalBin, options.currentBinPath)) {
+        return 'pnpm-global';
+    }
+    return detectInstallMethod(options.packageRoot, {
+        globalPrefix: options.globalPrefix,
+        packageName: options.packageName,
+        pnpmGlobalBin: options.pnpmGlobalBin,
+        pnpmGlobalRoot: options.pnpmGlobalRoot,
+        yarnGlobalDir: options.yarnGlobalDir,
+    });
+}
 export async function inspectSelfStatus(options = {}) {
     const packageRoot = options.packageRoot ? normalizePath(options.packageRoot) : PACKAGE_ROOT;
     const packageName = options.packageName ?? DEFAULT_PACKAGE_NAME;
@@ -240,6 +421,8 @@ export async function inspectSelfStatus(options = {}) {
     const channel = options.channel && options.channel !== 'auto' ? options.channel : detectChannel(currentVersion);
     const commandOutputFn = options.commandOutputFn ?? commandOutput;
     const { installMethod, globalPrefix } = await inspectSelfInstall({
+        currentBinPath: options.currentBinPath,
+        packageName,
         packageRoot,
         commandOutputFn,
     });
@@ -261,7 +444,7 @@ export async function inspectSelfStatus(options = {}) {
         latestVersion,
         updateAvailable,
         installMethod,
-        updatable: installMethod === 'npm-global',
+        updatable: installMethod === 'npm-global' || installMethod === 'pnpm-global' || installMethod === 'yarn-global',
         updateBlockedReason: getUnsupportedSelfUpdateReason(installMethod),
         globalPrefix,
         registryError,
@@ -270,9 +453,30 @@ export async function inspectSelfStatus(options = {}) {
 export function formatUnsupportedSelfUpdateMessage(status) {
     return status.updateBlockedReason
         ?? [
-            'Automatic self-update is only supported for standard global npm installs.',
+            'Automatic self-update is only supported for standard global npm, pnpm, or yarn installs.',
         ].join('\n');
 }
+function resolveSelfUpdateInstallCommand(installMethod, packageSpec) {
+    if (installMethod === 'pnpm-global') {
+        return {
+            command: 'pnpm',
+            args: ['add', '-g', packageSpec],
+            errorName: 'pnpm add',
+        };
+    }
+    if (installMethod === 'yarn-global') {
+        return {
+            command: 'yarn',
+            args: ['global', 'add', packageSpec],
+            errorName: 'yarn global add',
+        };
+    }
+    return {
+        command: 'npm',
+        args: ['install', '-g', packageSpec],
+        errorName: 'npm install',
+    };
+}
 export async function updateSelf(options = {}) {
     const status = await inspectSelfStatus(options);
     if (!status.updatable) {
@@ -291,9 +495,10 @@ export async function updateSelf(options = {}) {
         };
     }
     const packageSpec = getSelfUpdatePackageSpec(status);
-    await (options.runFn ?? run)('npm', ['install', '-g', packageSpec], {
+    const installCommand = resolveSelfUpdateInstallCommand(status.installMethod, packageSpec);
+    await (options.runFn ?? run)(installCommand.command, installCommand.args, {
         stdio: options.verbose ? 'inherit' : 'ignore',
-        errorName: 'npm install',
+        errorName: installCommand.errorName,
     });
     return {
         action: 'updated',

package/dist/lib/startup-update.js

@@ -151,7 +151,7 @@ export async function shouldRunStartupUpdateCheck(argv, now = new Date()) {
     return readCurrentInstallLastCheckedDate(state) !== todayStamp(now);
 }
 export function shouldEnableStartupUpdateForInstallMethod(installMethod) {
-    return installMethod === 'npm-global';
+    return installMethod === 'npm-global' || installMethod === 'pnpm-global' || installMethod === 'yarn-global';
 }
 function hasPendingUpdates(selfStatus, skillsStatus) {
     return Boolean(selfStatus.updateAvailable || skillsStatus.updateAvailable === true);

package/dist/locale/en-US.json

@@ -68,7 +68,7 @@
       "unreachable": "Unable to connect to the API base URL. Check the address and make sure the server is reachable. Details: {{details}}"
     },
     "envKey": {
-      "invalid": "Use letters and numbers only."
+      "invalid": "Use letters, numbers, hyphens, and underscores only."
     },
     "appPublicPath": {
       "invalid": "Use / or a slash-separated path like /nocobase/ or /foo-bar/baz_2/. Each path segment may contain letters, numbers, hyphens, and underscores only."

package/dist/locale/zh-CN.json

@@ -68,7 +68,7 @@
       "unreachable": "无法连接到该 API 地址，请检查地址是否正确，并确认服务可访问。详情：{{details}}"
     },
     "envKey": {
-      "invalid": "仅支持字母和数字。"
+      "invalid": "仅支持字母、数字、中划线和下划线。"
     },
     "appPublicPath": {
       "invalid": "请输入 /，或类似 /nocobase/、/foo-bar/baz_2/ 这样的路径。每个路径段仅支持字母、数字、中划线和下划线。"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/cli",
-  "version": "2.2.0-beta.7",
+  "version": "2.2.0-beta.8",
   "description": "NocoBase Command Line Tool",
   "type": "module",
   "main": "dist/generated/command-registry.js",
@@ -143,5 +143,5 @@
     "type": "git",
     "url": "git+https://github.com/nocobase/nocobase.git"
   },
-  "gitHead": "e6a3fa8963a73cd9ddfc1273d71b0012483e1ad8"
+  "gitHead": "fa2502c1e9faf6d74b3f51b42dbc6546638d46af"
 }