@nocobase/cli 3.0.0-alpha.4 → 3.0.0-alpha.6

package/dist/lib/portal-info.js

@@ -10,9 +10,6 @@ import { translateCli } from './cli-locale.js';
 import { toPortalOutputItem } from './portal-list.js';
 const portalInfoText = (key, values, fallback) => translateCli(`commands.portalInfo.${key}`, values, { fallback });
 function formatBoolean(value) {
-    if (value === null) {
-        return '';
-    }
     return value ? 'yes' : 'no';
 }
 export function findPortalListItem(items, portal) {
@@ -24,8 +21,8 @@ export function formatPortalInfo(item) {
         `${portalInfoText('fields.name', undefined, 'Name')}: ${outputItem.name}`,
         `${portalInfoText('fields.url', undefined, 'URL')}: ${outputItem.url}`,
         `${portalInfoText('fields.portalType', undefined, 'Portal type')}: ${outputItem.portalType}`,
-        `${portalInfoText('fields.path', undefined, 'Local path')}: ${outputItem.localPath}`,
+        `${portalInfoText('fields.developmentPath', undefined, 'Development path')}: ${outputItem.developmentPath}`,
+        `${portalInfoText('fields.deploymentPath', undefined, 'Deployment path')}: ${outputItem.deploymentPath}`,
         `${portalInfoText('fields.enabled', undefined, 'Enabled')}: ${formatBoolean(outputItem.enabled)}`,
-        `${portalInfoText('fields.localSynced', undefined, 'Local synced')}: ${formatBoolean(outputItem.localSynced)}`,
     ].join('\n');
 }

package/dist/lib/portal-list.js

@@ -6,12 +6,10 @@
  * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
-import { stat } from 'node:fs/promises';
-import path from 'node:path';
 import { appendAppPublicPath } from './app-public-path.js';
 import { executeApiRequest } from './api-client.js';
 import { translateCli } from './cli-locale.js';
-import { buildPortalBasePath, resolvePortalAppFromApiBaseUrl, resolvePortalStoragePath, } from './portal-create.js';
+import { buildPortalBasePath, resolvePortalDeployPath, resolvePortalAppContext, resolveSavedPortalSourcePath, resolvePortalStoragePath, } from './portal-create.js';
 const portalListText = (key, values, fallback) => translateCli(`commands.portalList.${key}`, values, { fallback });
 const LIST_PORTALS_OPERATION = {
     method: 'GET',
@@ -57,15 +55,6 @@ function readListData(data) {
     }
     return readListData(directData);
 }
-async function pathExists(target) {
-    try {
-        await stat(target);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
 function buildPortalAccessUrl(apiBaseUrl, portalBase) {
     try {
         const baseUrl = new URL(apiBaseUrl);
@@ -134,10 +123,11 @@ export function toPortalOutputItem(item) {
         name: item.portalName,
         url: item.portalUrl,
         portalType: item.portalType,
-        localPath: item.localSynced === true ? item.portalDir : '',
+        developmentPath: item.portalDir,
+        deploymentPath: item.deployDir,
         enabled: item.enabled,
+        isDefault: item.isDefault,
         sourceStorage: item.sourceStorage,
-        localSynced: item.localSynced,
     };
 }
 async function listMultiPortalRecords(params) {
@@ -159,8 +149,9 @@ async function listMultiPortalRecords(params) {
 export async function listPortalWorkspaces(options) {
     const apiBaseUrl = trimValue(options.env.apiBaseUrl);
     const storagePath = resolvePortalStoragePath(options.env);
-    const { app, appPublicPath } = resolvePortalAppFromApiBaseUrl(apiBaseUrl, options.env.config.appPublicPath);
+    const { app, appPublicPath, portalBaseApp } = options.appContext ?? (await resolvePortalAppContext(options));
     const mode = options.env.kind;
+    const baseApp = portalBaseApp ?? app;
     if (mode !== 'local' && mode !== 'docker' && mode !== 'http') {
         throw new Error(portalListText('errors.unsupportedEnvKind', { kind: mode }, `Cannot list portals for ${mode} envs in the first version.`));
     }
@@ -170,38 +161,41 @@ export async function listPortalWorkspaces(options) {
         cliVersion: options.cliVersion,
         apiRequest: options.apiRequest,
     });
-    const items = await Promise.all(records.map(async (record) => {
+    const items = records.map((record) => {
         const uid = readRecordString(record, 'uid');
         const portalName = readRecordString(record, 'portalName') || uid;
         const routePath = readRecordString(record, 'routePath') || `/${portalName}`;
         const portalType = readRecordString(record, 'portalType');
         const enabled = readRecordBoolean(record, 'enabled');
-        const options = readRecordObject(record, 'options');
-        const git = readRecordObject(options, 'git');
-        const sourceStorage = trimValue(options.sourceStorage) || readRecordString(record, 'sourceStorage') || 'nocobase';
+        const isDefault = readRecordBoolean(record, 'isDefault');
+        const recordOptions = readRecordObject(record, 'options');
+        const git = readRecordObject(recordOptions, 'git');
+        const sourceStorage = trimValue(recordOptions.sourceStorage) || readRecordString(record, 'sourceStorage') || 'nocobase';
         const isAi = portalType === 'ai';
-        const portalDir = isAi ? path.join(storagePath, 'portals', app, portalName) : '';
+        const portalDir = isAi ? resolveSavedPortalSourcePath(options.env, portalName) ?? '' : '';
+        const deployDir = isAi ? resolvePortalDeployPath({ storagePath, app, portal: portalName }) : '';
         return {
             uid,
             portalName,
             routePath,
             portalType,
             enabled,
+            isDefault,
             sourceStorage,
             gitRepo: trimValue(git.repo) || readRecordString(record, 'gitRepo'),
             gitBranch: trimValue(git.branch) || readRecordString(record, 'gitBranch'),
             gitPath: trimValue(git.path) || readRecordString(record, 'gitPath'),
-            sourceRevision: trimValue(options.sourceRevision) || readRecordString(record, 'sourceRevision'),
-            options,
+            sourceRevision: trimValue(recordOptions.sourceRevision) || readRecordString(record, 'sourceRevision'),
+            options: recordOptions,
             portalUrl: enabled
                 ? buildPortalAccessUrl(apiBaseUrl, isAi
-                    ? buildPortalBasePath({ app, appPublicPath, portal: portalName })
-                    : buildNoCodePortalBasePath({ app, appPublicPath, routePath }))
+                    ? buildPortalBasePath({ app: baseApp, appPublicPath, portal: portalName })
+                    : buildNoCodePortalBasePath({ app: baseApp, appPublicPath, routePath }))
                 : '',
             portalDir,
-            localSynced: isAi ? await pathExists(portalDir) : null,
+            deployDir,
         };
-    }));
+    });
     return {
         app,
         mode: listMode,

package/dist/lib/portal-path-safety.js

@@ -0,0 +1,76 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+import { readdir, readFile, realpath, stat } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+async function resolveExistingPath(target) {
+    const resolved = path.resolve(target);
+    try {
+        return await realpath(resolved);
+    }
+    catch {
+        return resolved;
+    }
+}
+function isSameOrAncestor(candidate, child) {
+    const relative = path.relative(candidate, child);
+    return !relative || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
+export async function isUnsafePortalDeletePath(target) {
+    const resolvedTarget = await resolveExistingPath(target);
+    const root = path.parse(resolvedTarget).root;
+    if (resolvedTarget === root) {
+        return true;
+    }
+    const homeDir = await resolveExistingPath(os.homedir());
+    if (resolvedTarget === homeDir) {
+        return true;
+    }
+    const cwd = await resolveExistingPath(process.cwd());
+    return isSameOrAncestor(resolvedTarget, cwd);
+}
+async function isDirectory(target) {
+    try {
+        return (await stat(target)).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+async function isEmptyDirectory(target) {
+    try {
+        return (await readdir(target)).length === 0;
+    }
+    catch {
+        return false;
+    }
+}
+async function hasNocoBasePackageField(target) {
+    try {
+        const data = JSON.parse(await readFile(path.join(target, 'package.json'), 'utf-8'));
+        return (!!data &&
+            typeof data === 'object' &&
+            !Array.isArray(data) &&
+            Object.prototype.hasOwnProperty.call(data, 'nocobase'));
+    }
+    catch {
+        return false;
+    }
+}
+export async function canReplacePortalDirectory(target) {
+    const resolvedTarget = await resolveExistingPath(target);
+    const root = path.parse(resolvedTarget).root;
+    if (resolvedTarget === root || resolvedTarget === (await resolveExistingPath(os.homedir()))) {
+        return false;
+    }
+    if (!(await isDirectory(resolvedTarget))) {
+        return false;
+    }
+    return (await isEmptyDirectory(resolvedTarget)) || (await hasNocoBasePackageField(resolvedTarget));
+}

package/dist/lib/portal-source.js

@@ -14,12 +14,15 @@ import path from 'node:path';
 import * as tar from 'tar';
 import { executeApiRequest } from './api-client.js';
 import { translateCli } from './cli-locale.js';
-import { buildPortalConfig, buildPortalConfigFromOptions, DEFAULT_PORTAL_GIT_PATH, readPortalConfig, syncPortalConfigToRemote, writePortalConfig, } from './portal-config.js';
+import { ensurePortalBuildHtmlReadsEnvOnly } from './portal-build-html.js';
+import { buildPortalConfig, buildPortalConfigFromOptions, DEFAULT_PORTAL_GIT_PATH, } from './portal-config.js';
 import { buildPortalCommandEnv } from './portal-command-env.js';
-import { buildPortalBasePath, resolvePortalAppFromApiBaseUrl, resolvePortalStoragePath, validatePortalSlug, } from './portal-create.js';
+import { canReplacePortalDirectory } from './portal-path-safety.js';
+import { updatePortalEnvFiles } from './portal-env-files.js';
+import { buildPortalBasePath, resolvePortalAppContext, resolvePortalDeployPath, resolvePortalSourcePath, resolveSavedPortalSourcePath, resolvePortalStoragePath, validatePortalSlug, } from './portal-create.js';
 import { listPortalWorkspaces } from './portal-list.js';
 import { findPortalListItem } from './portal-info.js';
-import { run, runPnpmCommand } from './run-npm.js';
+import { resolvePnpmInstallCommand, run, runPnpmInstallCommand } from './run-npm.js';
 const execFileAsync = promisify(execFile);
 const portalSourceText = (key, values, fallback) => translateCli(`commands.portalSource.${key}`, values, { fallback });
 const PULL_SOURCE_OPERATION = {
@@ -128,11 +131,25 @@ async function packPortalSource(portalDir) {
         },
     };
 }
-async function replacePortalSourceFromArchive(params) {
-    const targetExists = await pathExists(params.portalDir);
-    if (targetExists && !params.force) {
-        throw new Error(portalSourceText('errors.workspaceExists', { portalDir: params.portalDir }, `Portal already exists: ${params.portalDir}\nPass --force to delete it and pull again.`));
+async function replaceExistingPortalDirectory(params) {
+    if (!(await pathExists(path.join(params.portalDir, '.git')))) {
+        await rm(params.portalDir, { recursive: true, force: true });
+        await rename(params.sourceDir, params.portalDir);
+        return;
     }
+    const existingEntries = await readdir(params.portalDir);
+    await Promise.all(existingEntries
+        .filter((entry) => entry !== '.git')
+        .map((entry) => rm(path.join(params.portalDir, entry), { recursive: true, force: true })));
+    const sourceEntries = await readdir(params.sourceDir);
+    await Promise.all(sourceEntries.map((entry) => rename(path.join(params.sourceDir, entry), path.join(params.portalDir, entry))));
+    await rm(params.sourceDir, { recursive: true, force: true });
+}
+async function replacePortalSourceFromArchive(params) {
+    const targetExists = await assertPortalDirectoryCanBeReplaced({
+        portalDir: params.portalDir,
+        force: params.force,
+    });
     const parentDir = path.dirname(params.portalDir);
     const tempDir = await mkdtemp(path.join(parentDir, `.${path.basename(params.portalDir)}-pull-`));
     try {
@@ -143,7 +160,11 @@ async function replacePortalSourceFromArchive(params) {
             filter: validatePortalSourceTarEntry,
         });
         if (targetExists) {
-            await rm(params.portalDir, { recursive: true, force: true });
+            await replaceExistingPortalDirectory({
+                sourceDir: tempDir,
+                portalDir: params.portalDir,
+            });
+            return;
         }
         await rename(tempDir, params.portalDir);
     }
@@ -153,10 +174,10 @@ async function replacePortalSourceFromArchive(params) {
     }
 }
 async function replacePortalSourceFromDirectory(params) {
-    const targetExists = await pathExists(params.portalDir);
-    if (targetExists && !params.force) {
-        throw new Error(portalSourceText('errors.workspaceExists', { portalDir: params.portalDir }, `Portal already exists: ${params.portalDir}\nPass --force to delete it and pull again.`));
-    }
+    const targetExists = await assertPortalDirectoryCanBeReplaced({
+        portalDir: params.portalDir,
+        force: params.force,
+    });
     const parentDir = path.dirname(params.portalDir);
     const tempDir = await mkdtemp(path.join(parentDir, `.${path.basename(params.portalDir)}-pull-`));
     try {
@@ -165,7 +186,11 @@ async function replacePortalSourceFromDirectory(params) {
             filter: (source) => shouldPackPortalSourceEntry(path.relative(params.sourceDir, source)),
         });
         if (targetExists) {
-            await rm(params.portalDir, { recursive: true, force: true });
+            await replaceExistingPortalDirectory({
+                sourceDir: tempDir,
+                portalDir: params.portalDir,
+            });
+            return;
         }
         await rename(tempDir, params.portalDir);
     }
@@ -174,6 +199,16 @@ async function replacePortalSourceFromDirectory(params) {
         throw error;
     }
 }
+async function assertPortalDirectoryCanBeReplaced(params) {
+    const targetExists = await pathExists(params.portalDir);
+    if (targetExists && !params.force) {
+        throw new Error(portalSourceText('errors.workspaceExists', { portalDir: params.portalDir }, `Portal already exists: ${params.portalDir}\nPass --force to delete it and pull again.`));
+    }
+    if (targetExists && params.force && !(await canReplacePortalDirectory(params.portalDir))) {
+        throw new Error(portalSourceText('errors.workspaceNotReplaceable', { portalDir: params.portalDir }, `Refusing to replace a non-portal directory: ${params.portalDir}`));
+    }
+    return targetExists;
+}
 async function runGit(args, cwd) {
     return await execFileAsync('git', args, {
         cwd,
@@ -185,24 +220,37 @@ async function installPortalDependencies(params) {
         return {
             dependenciesInstalled: false,
             installSkipped: true,
+            installFailed: false,
         };
     }
     if (!(await isFile(path.join(params.portalDir, 'package.json')))) {
         return {
             dependenciesInstalled: false,
             installSkipped: true,
+            installFailed: false,
         };
     }
     const runCommand = params.runCommand ?? run;
-    await runPnpmCommand(runCommand, ['install'], {
-        cwd: params.portalDir,
-        env: buildPortalCommandEnv(),
-        envMode: 'replace',
-        errorName: 'pnpm install',
-    });
+    const installCommand = await resolvePnpmInstallCommand(params.portalDir);
+    try {
+        await runPnpmInstallCommand(runCommand, installCommand.args, {
+            cwd: params.portalDir,
+            env: buildPortalCommandEnv(),
+            envMode: 'replace',
+            errorName: installCommand.errorName,
+        });
+    }
+    catch {
+        return {
+            dependenciesInstalled: false,
+            installSkipped: false,
+            installFailed: true,
+        };
+    }
     return {
         dependenciesInstalled: true,
         installSkipped: false,
+        installFailed: false,
     };
 }
 function readSourceRevision(data) {
@@ -219,10 +267,15 @@ async function resolvePortalSourceContext(options) {
     const portal = validatePortalSlug(options.portal);
     const apiBaseUrl = trimValue(options.env.apiBaseUrl);
     const storagePath = resolvePortalStoragePath(options.env);
-    const { app, appPublicPath } = resolvePortalAppFromApiBaseUrl(apiBaseUrl, options.env.config.appPublicPath);
-    const portalDir = path.join(storagePath, 'portals', app, portal);
-    const portalBase = buildPortalBasePath({ app, appPublicPath, portal });
     const mode = options.env.kind;
+    const appContext = await resolvePortalAppContext(options);
+    const { app, appPublicPath, portalBaseApp } = appContext;
+    const portalDeployDir = resolvePortalDeployPath({ storagePath, app, portal });
+    const portalDir = options.sourcePath
+        ? resolvePortalSourcePath(portal, options.sourcePath)
+        : resolveSavedPortalSourcePath(options.env, portal) ??
+            (options.defaultSourcePath ? resolvePortalSourcePath(portal) : portalDeployDir);
+    const portalBase = buildPortalBasePath({ app: portalBaseApp ?? app, appPublicPath, portal });
     if (mode !== 'local' && mode !== 'docker' && mode !== 'http') {
         throw new Error(portalSourceText('errors.unsupportedEnvKind', { kind: mode }, `Cannot sync portal source for ${mode} envs in the first version.`));
     }
@@ -231,6 +284,7 @@ async function resolvePortalSourceContext(options) {
         envName: options.envName,
         cliVersion: options.cliVersion,
         apiRequest: options.apiRequest,
+        appContext,
     });
     const item = findPortalListItem(list.items, portal);
     if (!item) {
@@ -241,6 +295,7 @@ async function resolvePortalSourceContext(options) {
         portal,
         portalDir,
         portalBase,
+        apiBaseUrl,
         mode,
         sourceStorage: item.sourceStorage || 'nocobase',
         gitRepo: item.gitRepo,
@@ -271,6 +326,25 @@ function applyPortalConfigToContext(context, config) {
         gitPath: config.git?.path ?? DEFAULT_PORTAL_GIT_PATH,
     };
 }
+function getTemporaryGitPortalConfig(options) {
+    const gitRepo = trimValue(options.gitRepo);
+    if (!gitRepo) {
+        if (trimValue(options.gitBranch) || trimValue(options.gitPath)) {
+            throw new Error(portalSourceText('errors.gitRepoRequiredForTemporaryPull', undefined, [
+                '--git-branch and --git-path require --git-repo for a temporary Git pull.',
+                'To update the portal configuration, use `nb portal config`.',
+            ].join(' ')));
+        }
+        return undefined;
+    }
+    return buildPortalConfig({
+        portal: options.portal,
+        sourceStorage: 'git',
+        gitRepo,
+        gitBranch: options.gitBranch,
+        gitPath: options.gitPath,
+    });
+}
 function assertGitSourceConfig(context) {
     if (!context.gitRepo) {
         throw new Error(portalSourceText('errors.gitRepoMissing', { portal: context.portal }, `Portal "${context.portal}" uses Git source storage, but gitRepo is missing.`));
@@ -319,8 +393,76 @@ async function cloneGitSource(params) {
     }
     return repoDir;
 }
+async function setGitOriginRepository(params) {
+    try {
+        await runGit(['remote', 'get-url', 'origin'], params.repoDir);
+        await runGit(['remote', 'set-url', 'origin', params.repo], params.repoDir);
+    }
+    catch {
+        await runGit(['remote', 'add', 'origin', params.repo], params.repoDir);
+    }
+}
+async function checkoutExistingGitRepository(params) {
+    await setGitOriginRepository({
+        repoDir: params.repoDir,
+        repo: params.repo,
+    });
+    try {
+        await runGit(['fetch', 'origin', params.branch], params.repoDir);
+        await runGit(['checkout', '-f', '-B', params.branch, 'FETCH_HEAD'], params.repoDir);
+    }
+    catch (error) {
+        await runGit(['fetch', 'origin'], params.repoDir);
+        await runGit(['checkout', '-f', '-B', params.branch], params.repoDir);
+    }
+    await runGit(['clean', '-fdx'], params.repoDir);
+}
+async function pullGitRepositoryRootPortalSource(params) {
+    const targetExists = await assertPortalDirectoryCanBeReplaced({
+        portalDir: params.context.portalDir,
+        force: params.force,
+    });
+    await mkdir(path.dirname(params.context.portalDir), { recursive: true });
+    if (targetExists && (await pathExists(path.join(params.context.portalDir, '.git')))) {
+        await checkoutExistingGitRepository({
+            repoDir: params.context.portalDir,
+            repo: params.repo,
+            branch: params.branch,
+        });
+        return;
+    }
+    if (targetExists) {
+        await rm(params.context.portalDir, { recursive: true, force: true });
+    }
+    const tempDir = await mkdtemp(path.join(path.dirname(params.context.portalDir), `.${path.basename(params.context.portalDir)}-git-pull-`));
+    try {
+        const repoDir = await cloneGitSource({
+            repo: params.repo,
+            branch: params.branch,
+            cwd: tempDir,
+            createBranch: true,
+        });
+        await rename(repoDir, params.context.portalDir);
+    }
+    catch (error) {
+        await rm(params.context.portalDir, { recursive: true, force: true });
+        throw error;
+    }
+    finally {
+        await rm(tempDir, { recursive: true, force: true });
+    }
+}
 async function pullGitPortalSource(params) {
     const git = assertGitSourceConfig(params.context);
+    if (isGitRepositoryRootPath(git.gitPath)) {
+        await pullGitRepositoryRootPortalSource({
+            context: params.context,
+            repo: git.repo,
+            branch: git.branch,
+            force: params.force,
+        });
+        return;
+    }
     const tempDir = await mkdtemp(path.join(os.tmpdir(), 'nocobase-cli-portal-git-pull-'));
     try {
         const repoDir = await cloneGitSource({
@@ -382,15 +524,23 @@ async function pushGitPortalSource(params) {
     }
 }
 export async function pullPortalSource(options) {
-    const context = await resolvePortalSourceContext(options);
-    const portalConfig = buildPortalConfigFromContext(context);
+    const context = await resolvePortalSourceContext({
+        ...options,
+        defaultSourcePath: true,
+    });
+    const portalConfig = getTemporaryGitPortalConfig(options) ?? buildPortalConfigFromContext(context);
     const sourceContext = applyPortalConfigToContext(context, portalConfig);
     if (sourceContext.sourceStorage === 'git') {
         await pullGitPortalSource({
             context: sourceContext,
             force: options.force,
         });
-        await writePortalConfig(sourceContext.portalDir, portalConfig);
+        await ensurePortalBuildHtmlReadsEnvOnly(sourceContext.portalDir);
+        await updatePortalEnvFiles({
+            portalDir: sourceContext.portalDir,
+            apiBaseUrl: sourceContext.apiBaseUrl,
+            portalBase: sourceContext.portalBase,
+        });
         const installResult = await installPortalDependencies({
             portalDir: sourceContext.portalDir,
             installDependencies: options.installDependencies,
@@ -405,15 +555,6 @@ export async function pullPortalSource(options) {
     if (sourceContext.sourceStorage !== 'nocobase') {
         throw new Error(portalSourceText('errors.unsupportedSourceStorage', { sourceStorage: sourceContext.sourceStorage }, `Unsupported portal source storage: ${sourceContext.sourceStorage}`));
     }
-    if (sourceContext.mode === 'local' || sourceContext.mode === 'docker') {
-        return {
-            ...sourceContext,
-            changed: false,
-            noopReason: sourceContext.mode === 'local'
-                ? portalSourceText('messages.localPullNoop', undefined, 'Portal source is already local.')
-                : portalSourceText('messages.dockerPullNoop', undefined, 'Portal source is already available through the Docker volume.'),
-        };
-    }
     const tempDir = await mkdtemp(path.join(os.tmpdir(), 'nocobase-cli-portal-pull-'));
     const archivePath = path.join(tempDir, 'source.tar.gz');
     const apiRequest = options.apiRequest ?? executeApiRequest;
@@ -437,7 +578,12 @@ export async function pullPortalSource(options) {
             portalDir: sourceContext.portalDir,
             force: options.force,
         });
-        await writePortalConfig(sourceContext.portalDir, portalConfig);
+        await ensurePortalBuildHtmlReadsEnvOnly(sourceContext.portalDir);
+        await updatePortalEnvFiles({
+            portalDir: sourceContext.portalDir,
+            apiBaseUrl: sourceContext.apiBaseUrl,
+            portalBase: sourceContext.portalBase,
+        });
         const installResult = await installPortalDependencies({
             portalDir: sourceContext.portalDir,
             installDependencies: options.installDependencies,
@@ -454,19 +600,14 @@ export async function pullPortalSource(options) {
     }
 }
 export async function pushPortalSource(options) {
-    const context = await resolvePortalSourceContext(options);
+    const context = await resolvePortalSourceContext({
+        ...options,
+        defaultSourcePath: true,
+    });
     if (!(await pathExists(context.portalDir))) {
         throw new Error(portalSourceText('errors.workspaceMissing', { portalDir: context.portalDir, portal: context.portal }, `Portal does not exist: ${context.portalDir}\nRun \`nb portal create ${context.portal}\` first.`));
     }
-    const portalConfig = await readPortalConfig(context.portalDir);
-    await syncPortalConfigToRemote({
-        portal: context.portal,
-        config: portalConfig,
-        currentOptions: context.options,
-        envName: options.envName,
-        cliVersion: options.cliVersion,
-        apiRequest: options.apiRequest,
-    });
+    const portalConfig = buildPortalConfigFromContext(context);
     const sourceContext = applyPortalConfigToContext(context, portalConfig);
     if (sourceContext.sourceStorage === 'git') {
         const revision = await pushGitPortalSource({
@@ -485,15 +626,6 @@ export async function pushPortalSource(options) {
     if (sourceContext.sourceStorage !== 'nocobase') {
         throw new Error(portalSourceText('errors.unsupportedSourceStorage', { sourceStorage: sourceContext.sourceStorage }, `Unsupported portal source storage: ${sourceContext.sourceStorage}`));
     }
-    if (sourceContext.mode === 'local' || sourceContext.mode === 'docker') {
-        return {
-            ...sourceContext,
-            changed: false,
-            noopReason: sourceContext.mode === 'local'
-                ? portalSourceText('messages.localPushNoop', undefined, 'Portal source is already local.')
-                : portalSourceText('messages.dockerPushNoop', undefined, 'Portal source is already available through the Docker volume.'),
-        };
-    }
     const archive = await packPortalSource(sourceContext.portalDir);
     const apiRequest = options.apiRequest ?? executeApiRequest;
     try {

package/dist/lib/run-npm.js

@@ -105,6 +105,52 @@ export async function runPnpmCommand(runCommand, args, options) {
         throw createMissingCommandError('pnpm', options.errorName ?? `pnpm ${args.join(' ')}`.trim(), error) ?? error;
     }
 }
+function createInstallArgsWithoutTrustLockfile(args) {
+    if (!args.includes('install') || !args.includes('--trust-lockfile')) {
+        return undefined;
+    }
+    return args.filter((arg) => arg !== '--trust-lockfile');
+}
+function isFriendlyMissingPnpmError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return message.includes('because the pnpm executable could not be found');
+}
+function formatPnpmLabel(args) {
+    return `pnpm ${args.join(' ')}`.trim();
+}
+export async function resolvePnpmInstallCommand(cwd) {
+    const hasLockfile = await fsp
+        .stat(path.join(cwd, 'pnpm-lock.yaml'))
+        .then((stats) => stats.isFile())
+        .catch(() => false);
+    if (hasLockfile) {
+        const args = ['install', '--frozen-lockfile', '--trust-lockfile'];
+        return {
+            args,
+            errorName: formatPnpmLabel(args),
+        };
+    }
+    const args = ['install'];
+    return {
+        args,
+        errorName: formatPnpmLabel(args),
+    };
+}
+export async function runPnpmInstallCommand(runCommand, args, options) {
+    try {
+        await runPnpmCommand(runCommand, args, options);
+    }
+    catch (error) {
+        const fallbackArgs = createInstallArgsWithoutTrustLockfile(args);
+        if (!fallbackArgs || isFriendlyMissingPnpmError(error)) {
+            throw error;
+        }
+        await runPnpmCommand(runCommand, fallbackArgs, {
+            ...options,
+            errorName: formatPnpmLabel(fallbackArgs),
+        });
+    }
+}
 function isDockerDaemonUnavailableError(error) {
     const message = error instanceof Error ? error.message : String(error);
     return DOCKER_DAEMON_UNAVAILABLE_PATTERNS.some((pattern) => pattern.test(message));