@wdyy/skills 0.1.13 → 0.1.15

package/.well-known/skills/wdyy-deployment-standard/scripts/validate-deployment-package.test.mjs

@@ -7,8 +7,10 @@ import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { promisify } from 'node:util';
+import { gunzip } from 'node:zlib';
 
 const run = promisify(execFile);
+const unzip = promisify(gunzip);
 const scriptsRoot = dirname(fileURLToPath(import.meta.url));
 const generator = join(scriptsRoot, 'generate-deployment-files.mjs');
 const validator = join(scriptsRoot, 'validate-deployment-package.mjs');
@@ -29,11 +31,15 @@ DB_NAME=app
 DB_SCHEMA=public
 # API
 API_URL=
+API_PREFIX=api
+VITE_API_BASE_URL=/api
 # 部署
 PROJECT_NAME=example_project
 DOCKER_BIND_IP=0.0.0.0
+DOCKER_PLATFORM=linux/amd64
 FRONTEND_BASE_IMAGE=nginx:stable
-BACKEND_BASE_IMAGE=node:24-alpine3.24
+BACKEND_BASE_IMAGE=node:24-bookworm-slim
+TZ=Asia/Shanghai
 `;
 const exampleText = `# 前端
 FRONTEND_URL=0.0.0.0
@@ -50,11 +56,15 @@ DB_NAME=
 DB_SCHEMA=
 # API
 API_URL=
+API_PREFIX=api
+VITE_API_BASE_URL=/api
 # 部署
 PROJECT_NAME=
 DOCKER_BIND_IP=
+DOCKER_PLATFORM=linux/amd64
 FRONTEND_BASE_IMAGE=nginx:stable
-BACKEND_BASE_IMAGE=node:24-alpine3.24
+BACKEND_BASE_IMAGE=node:24-bookworm-slim
+TZ=Asia/Shanghai
 `;
 
 const fakeDocker = `#!/usr/bin/env node
@@ -64,9 +74,15 @@ const path = require('path');
 const cp = require('child_process');
 const args = process.argv.slice(2);
 if (process.env.DOCKER_LOG) fs.appendFileSync(process.env.DOCKER_LOG, args.join(' ') + '\\n');
+if (args[0] === 'version') {
+  if (process.env.FAIL_SERVER_PLATFORM_READ === '1') process.exit(1);
+  process.stdout.write((process.env.SERVER_PLATFORM || 'linux/amd64') + '\\n');
+  process.exit(0);
+}
 if (args[0] === 'image' && args[1] === 'inspect') {
   const image = args[args.length - 1];
   if (process.env.MISSING_IMAGE === image) process.exit(1);
+  if (args.includes('--format')) process.stdout.write((process.env.IMAGE_PLATFORM || 'linux/amd64') + '\\n');
   process.exit(0);
 }
 if (args[0] === 'build') {
@@ -75,12 +91,37 @@ if (args[0] === 'build') {
   if (process.env.FAIL_BUILD && tag.includes(process.env.FAIL_BUILD)) process.exit(1);
   process.exit(0);
 }
+if (args[0] === 'run') {
+  const image = args[args.indexOf('-c') - 1];
+  if (process.env.FAIL_IMAGE_TIME && image.includes(process.env.FAIL_IMAGE_TIME)) process.exit(1);
+  process.stdout.write((process.env.IMAGE_TIME || '19 CST +0800') + '\\n');
+  process.exit(0);
+}
+if (args[0] === 'exec') {
+  const name = args[1];
+  if (process.env.FAIL_CONTAINER_TIME && name.includes(process.env.FAIL_CONTAINER_TIME)) process.exit(1);
+  process.stdout.write((process.env.CONTAINER_TIME || '19 CST +0800') + '\\n');
+  process.exit(0);
+}
+if (args[0] === 'container' && args[1] === 'ls') {
+  const filter = args[args.indexOf('--filter') + 1] || '';
+  const name = filter.replace('name=^/', '').replace('$$', '').replace('$', '');
+  if (process.env.EXISTING_CONTAINER_NAME === name) process.stdout.write(name + '\\n');
+  process.exit(0);
+}
+if (args[0] === 'container' && args[1] === 'inspect') {
+  const name = args[args.length - 1];
+  if (process.env.EXISTING_CONTAINER_NAME !== name) process.exit(1);
+  process.stdout.write((process.env.CONTAINER_PROJECT || '') + '|' + (process.env.CONTAINER_SERVICE || '') + '\\n');
+  process.exit(0);
+}
 if (args[0] === 'save') {
   const output = args[args.indexOf('-o') + 1];
   const tag = args[args.length - 1];
+  const [imageOs, imageArchitecture] = (process.env.IMAGE_PLATFORM || 'linux/amd64').split('/');
   const temporary = fs.mkdtempSync(path.join(os.tmpdir(), 'fake-image-'));
   fs.writeFileSync(path.join(temporary, 'manifest.json'), JSON.stringify([{Config:'config.json',RepoTags:[tag],Layers:[]}]) + '\\n');
-  fs.writeFileSync(path.join(temporary, 'config.json'), '{}\\n');
+  fs.writeFileSync(path.join(temporary, 'config.json'), JSON.stringify({architecture:imageArchitecture,os:imageOs}) + '\\n');
   const result = cp.spawnSync('tar', ['-cf', output, '-C', temporary, 'manifest.json', 'config.json']);
   fs.rmSync(temporary, {recursive:true, force:true});
   process.exit(result.status || 0);
@@ -88,6 +129,9 @@ if (args[0] === 'save') {
 if (args[0] === 'compose' && args.includes('up') && process.env.FAIL_COMPOSE_UP === '1') process.exit(1);
 process.exit(0);
 `;
+const fakeUname = `#!/usr/bin/env node
+process.stdout.write((process.env.HOST_KERNEL || 'Linux') + '\\n');
+`;
 
 async function fixture() {
   const root = await mkdtemp(join(tmpdir(), 'wdyy-unified-delivery-'));
@@ -104,7 +148,9 @@ async function fixture() {
   const bin = join(root, 'fake-bin');
   await mkdir(bin);
   await writeFile(join(bin, 'docker'), fakeDocker, { mode: 0o755 });
+  await writeFile(join(bin, 'uname'), fakeUname, { mode: 0o755 });
   await chmod(join(bin, 'docker'), 0o755);
+  await chmod(join(bin, 'uname'), 0o755);
   const log = join(root, 'docker.log');
   const environment = { ...process.env, PATH: `${bin}:${process.env.PATH}`, DOCKER_LOG: log };
   return { root, log, environment, archive: join(root, 'deploy/example_project-docker.tar.gz') };
@@ -131,6 +177,34 @@ async function rewriteManifest(root) {
   await writeFile(join(root, 'manifest.sha256'), `${lines.join('\n')}\n`);
 }
 
+async function setTargetPlatform(root, platform) {
+  const environmentPath = join(root, '.env');
+  const environment = await readFile(environmentPath, 'utf8');
+  await writeFile(environmentPath, environment.replace(/^DOCKER_PLATFORM=.*$/m, `DOCKER_PLATFORM=${platform}`), { mode: 0o600 });
+}
+
+async function readImageArchivePlatform(archive) {
+  const { stdout: manifestText } = await run('tar', ['-xOf', archive, 'manifest.json']);
+  const [{ Config: configName }] = JSON.parse(manifestText);
+  const { stdout: configText } = await run('tar', ['-xOf', archive, configName]);
+  const config = JSON.parse(configText);
+  return `${config.os}/${config.architecture}`;
+}
+
+async function rewriteImageArchivePlatform(archive, platform) {
+  const temporary = await mkdtemp(join(tmpdir(), 'wdyy-image-platform-'));
+  created.push(temporary);
+  await run('tar', ['-xf', archive, '-C', temporary]);
+  const manifest = JSON.parse(await readFile(join(temporary, 'manifest.json'), 'utf8'));
+  const configName = manifest[0].Config;
+  const config = JSON.parse(await readFile(join(temporary, configName), 'utf8'));
+  const [os, architecture] = platform.split('/');
+  config.os = os;
+  config.architecture = architecture;
+  await writeFile(join(temporary, configName), `${JSON.stringify(config)}\n`);
+  await run('tar', ['-cf', archive, '-C', temporary, 'manifest.json', configName]);
+}
+
 test.after(async () => {
   await Promise.all(created.map((path) => rm(path, { recursive: true, force: true })));
 });
@@ -140,19 +214,64 @@ test('build 使用本地基础镜像并生成一个含双镜像归档的压缩
   const result = await buildProject(item);
   assert.match(result.stdout, /delivery archive created/);
   assert.deepEqual(await readdir(join(item.root, 'deploy')), ['example_project-docker.tar.gz']);
+  const uncompressed = await unzip(await readFile(item.archive));
+  assert.equal(uncompressed.includes(Buffer.from('./._.env')), false);
+  const listing = await run('tar', ['-tzf', item.archive]);
+  assert.doesNotMatch(listing.stdout, /(^|\/)\._[^/]*(?:\n|$)/m);
+  assert.doesNotMatch(listing.stderr, /LIBARCHIVE\.xattr|unknown extended header/i);
   const extracted = await extractArchive(item);
   assert.deepEqual((await readdir(extracted)).sort(), ['.env', 'backend-image.tar', 'deploy.sh', 'docker-compose.yml', 'frontend-image.tar', 'manifest.sha256'].sort());
   const validation = await run(process.execPath, [validator, extracted]);
   assert.match(validation.stdout, /valid unified Docker delivery package/);
+  const compose = await readFile(join(extracted, 'docker-compose.yml'), 'utf8');
+  assert.equal((compose.match(/TZ: "\$\{TZ:\?TZ is required\}"/g) ?? []).length, 2);
+  assert.match(compose, /container_name: "\$\{PROJECT_NAME:\?PROJECT_NAME is required\}_frontend"/);
+  assert.match(compose, /container_name: "\$\{PROJECT_NAME:\?PROJECT_NAME is required\}_backend"/);
+  assert.equal((compose.match(/restart: unless-stopped/g) ?? []).length, 2);
   const log = await readFile(item.log, 'utf8');
   assert.match(log, /image inspect nginx:stable/);
-  assert.match(log, /image inspect node:24-alpine3\.24/);
-  assert.equal((log.match(/build --pull=false/g) ?? []).length, 2);
+  assert.match(log, /image inspect node:24-bookworm-slim/);
+  assert.equal((log.match(/build --pull=false --platform linux\/amd64/g) ?? []).length, 2);
+  assert.match(log, /build --pull=false --platform linux\/amd64 .*--build-arg VITE_API_BASE_URL=\/api .*example_project_frontend:latest/);
+  assert.equal((log.match(/^run --rm --pull=never --platform linux\/amd64 /gm) ?? []).length, 2);
   assert.doesNotMatch(log, /(^|\s)pull(\s|$)/m);
   assert.match(log, /save -o .*frontend-image\.tar example_project_frontend:latest/);
   assert.match(log, /save -o .*backend-image\.tar example_project_backend:latest/);
 });
 
+test('基础镜像平台不匹配时在 build 前失败', async () => {
+  const item = await fixture();
+  await assert.rejects(buildProject(item, { IMAGE_PLATFORM: 'linux/arm64' }), /image platform mismatch for nginx:stable: expected linux\/amd64, got linux\/arm64/);
+  const log = await readFile(item.log, 'utf8');
+  assert.doesNotMatch(log, /^build /m);
+  assert.equal((await readdir(join(item.root, 'deploy'))).length, 0);
+});
+
+test('macOS arm64 与 Windows WSL2 使用 Linux engine 生成并部署单架构交付包', async () => {
+  const item = await fixture();
+  await setTargetPlatform(item.root, 'linux/arm64');
+  await buildProject(item, { HOST_KERNEL: 'Darwin', IMAGE_PLATFORM: 'linux/arm64' });
+  const buildLog = await readFile(item.log, 'utf8');
+  assert.equal((buildLog.match(/build --pull=false --platform linux\/arm64/g) ?? []).length, 2);
+  const extracted = await extractArchive(item);
+  assert.equal(await readImageArchivePlatform(join(extracted, 'frontend-image.tar')), 'linux/arm64');
+  assert.equal(await readImageArchivePlatform(join(extracted, 'backend-image.tar')), 'linux/arm64');
+  const validation = await run(process.execPath, [validator, extracted]);
+  assert.match(validation.stdout, /valid unified Docker delivery package/);
+  await writeFile(item.log, '');
+  await run(join(extracted, 'deploy.sh'), [], { env: { ...item.environment, HOST_KERNEL: 'Linux', WSL_DISTRO_NAME: 'Ubuntu', IMAGE_PLATFORM: 'linux/arm64', SERVER_PLATFORM: 'linux/arm64' } });
+  const deployLog = await readFile(item.log, 'utf8');
+  assert.match(deployLog, /^version --format \{\{\.Server\.Os\}\}\/\{\{\.Server\.Arch\}\}$/m);
+  assert.equal((deployLog.match(/^load -i /gm) ?? []).length, 2);
+  assert.equal((deployLog.match(/^exec example_project_(?:frontend|backend) /gm) ?? []).length, 2);
+});
+
+test('原生 Windows shell 在任何 Docker 操作前被拒绝', async () => {
+  const item = await fixture();
+  await assert.rejects(buildProject(item, { HOST_KERNEL: 'Windows_NT' }), /unsupported execution host: Windows_NT/);
+  await assert.rejects(stat(item.log), { code: 'ENOENT' });
+});
+
 test('缺少本地基础镜像时在 build 前失败', async () => {
   const item = await fixture();
   await assert.rejects(buildProject(item, { MISSING_IMAGE: 'nginx:stable' }), /required local frontend base image is missing/);
@@ -172,6 +291,20 @@ test('构建失败保留上一份成功交付包且不暴露半成品', async ()
   assert.deepEqual(await readdir(join(item.root, 'deploy')), ['example_project-docker.tar.gz']);
 });
 
+test('镜像时间探测失败时保留上一份成功交付包', async () => {
+  const item = await fixture();
+  await buildProject(item);
+  const before = createHash('sha256').update(await readFile(item.archive)).digest('hex');
+  await assert.rejects(buildProject(item, { FAIL_IMAGE_TIME: 'frontend' }), /unable to verify image CST time: example_project_frontend:latest/);
+  const after = createHash('sha256').update(await readFile(item.archive)).digest('hex');
+  assert.equal(after, before);
+  const log = await readFile(item.log, 'utf8');
+  const lastSave = log.lastIndexOf('save -o ');
+  const lastRun = log.lastIndexOf('run --rm --pull=never');
+  assert(lastRun > lastSave);
+  assert.doesNotMatch(log.slice(lastRun), /^save -o /m);
+});
+
 test('服务器无参数执行时从脚本目录整体加载并部署前后端', async () => {
   const item = await fixture();
   await buildProject(item);
@@ -179,9 +312,68 @@ test('服务器无参数执行时从脚本目录整体加载并部署前后端',
   await writeFile(item.log, '');
   await run(join(extracted, 'deploy.sh'), [], { cwd: tmpdir(), env: item.environment });
   const log = await readFile(item.log, 'utf8');
+  const versionIndex = log.indexOf('version --format {{.Server.Os}}/{{.Server.Arch}}');
+  const firstLoadIndex = log.indexOf('load -i ');
+  const ownershipIndex = log.indexOf('container ls --all --filter name=^/example_project_frontend$');
+  assert(versionIndex >= 0 && ownershipIndex > versionIndex && firstLoadIndex > ownershipIndex);
   assert.equal((log.match(/^load -i /gm) ?? []).length, 2);
   assert.match(log, /compose --env-file .* --project-name example_project -f .* up -d --force-recreate --no-build --pull never --wait frontend backend/);
-  assert.match(await readFile(join(extracted, 'logs/deploy.log'), 'utf8'), /operation=deploy result=success/);
+  assert.equal((log.match(/^exec example_project_(?:frontend|backend) /gm) ?? []).length, 2);
+  assert.match(await readFile(join(extracted, 'logs/deploy.log'), 'utf8'), /CST \+0800 operation=deploy result=success/);
+});
+
+test('服务器平台无法读取、不受支持或不匹配时在加载镜像前失败', async () => {
+  const item = await fixture();
+  await buildProject(item);
+  const cases = [
+    [{ FAIL_SERVER_PLATFORM_READ: '1' }, /Docker Server platform is unavailable/],
+    [{ SERVER_PLATFORM: 'windows/amd64' }, /Windows container mode is unsupported; switch Docker Desktop to Linux containers/],
+    [{ SERVER_PLATFORM: 'linux/arm64' }, /Docker Server platform mismatch: expected linux\/amd64, got linux\/arm64/],
+  ];
+  for (const [extraEnvironment, expectedError] of cases) {
+    const extracted = await extractArchive(item);
+    await writeFile(item.log, '');
+    await assert.rejects(run(join(extracted, 'deploy.sh'), [], { env: { ...item.environment, ...extraEnvironment } }), expectedError);
+    const log = await readFile(item.log, 'utf8');
+    assert.match(log, /^version --format \{\{\.Server\.Os\}\}\/\{\{\.Server\.Arch\}\}$/m);
+    assert.doesNotMatch(log, /^load -i /m);
+    assert.doesNotMatch(log, /^compose .* (?:up|stop) /m);
+    assert.match(await readFile(join(extracted, 'logs/deploy.log'), 'utf8'), /operation=deploy result=failure/);
+  }
+});
+
+test('固定容器名冲突在镜像加载前失败，当前项目所有权允许继续', async () => {
+  const item = await fixture();
+  await buildProject(item);
+  const conflictPackage = await extractArchive(item);
+  await writeFile(item.log, '');
+  await assert.rejects(run(join(conflictPackage, 'deploy.sh'), [], {
+    env: { ...item.environment, EXISTING_CONTAINER_NAME: 'example_project_frontend', CONTAINER_PROJECT: 'other_project', CONTAINER_SERVICE: 'frontend' }
+  }), /container name conflict: example_project_frontend belongs to other_project\|frontend/);
+  const conflictLog = await readFile(item.log, 'utf8');
+  assert.match(conflictLog, /^container inspect .*example_project_frontend$/m);
+  assert.doesNotMatch(conflictLog, /^load -i /m);
+
+  const ownedPackage = await extractArchive(item);
+  await writeFile(item.log, '');
+  await run(join(ownedPackage, 'deploy.sh'), [], {
+    env: { ...item.environment, EXISTING_CONTAINER_NAME: 'example_project_frontend', CONTAINER_PROJECT: 'example_project', CONTAINER_SERVICE: 'frontend' }
+  });
+  assert.equal(((await readFile(item.log, 'utf8')).match(/^load -i /gm) ?? []).length, 2);
+});
+
+test('服务器在 Docker 操作前拒绝 AppleDouble 和上传压缩包残留', async () => {
+  const item = await fixture();
+  await buildProject(item);
+  const extracted = await extractArchive(item);
+  await writeFile(item.log, '');
+  await writeFile(join(extracted, '._deploy.sh'), 'AppleDouble\n');
+  await assert.rejects(run(join(extracted, 'deploy.sh'), [], { env: item.environment }), /unexpected package entry: \._deploy\.sh/);
+  assert.equal(await readFile(item.log, 'utf8'), '');
+  await rm(join(extracted, '._deploy.sh'));
+  await writeFile(join(extracted, 'example_project-docker.tar.gz'), 'uploaded archive\n');
+  await assert.rejects(run(join(extracted, 'deploy.sh'), [], { env: item.environment }), /unexpected package entry: example_project-docker\.tar\.gz/);
+  assert.equal(await readFile(item.log, 'utf8'), '');
 });
 
 test('stop 与 status 始终作用于完整项目栈，非法参数不触发 Docker', async () => {
@@ -194,6 +386,7 @@ test('stop 与 status 始终作用于完整项目栈，非法参数不触发 Doc
   const beforeInvalid = await readFile(item.log, 'utf8');
   assert.match(beforeInvalid, /stop frontend backend/);
   assert.match(beforeInvalid, /ps frontend backend/);
+  assert.doesNotMatch(beforeInvalid, /^\s*(?:start|restart)\b|^compose .* up /m);
   await assert.rejects(run(join(extracted, 'deploy.sh'), ['frontend'], { env: item.environment }), /usage:/);
   assert.equal(await readFile(item.log, 'utf8'), beforeInvalid);
   assert.match(await readFile(join(extracted, 'logs/deploy.log'), 'utf8'), /operation=stop result=success/);
@@ -207,6 +400,19 @@ test('整栈健康等待失败返回非零并记录失败', async () => {
   assert.match(await readFile(join(extracted, 'logs/deploy.log'), 'utf8'), /operation=deploy result=failure/);
 });
 
+test('运行容器时间探测失败在健康等待后明确失败并记录容器', async () => {
+  const item = await fixture();
+  await buildProject(item);
+  const extracted = await extractArchive(item);
+  await writeFile(item.log, '');
+  await assert.rejects(run(join(extracted, 'deploy.sh'), [], { env: { ...item.environment, FAIL_CONTAINER_TIME: 'backend' } }), /unable to verify running container CST time: example_project_backend/);
+  const log = await readFile(item.log, 'utf8');
+  const composeIndex = log.indexOf(' up -d --force-recreate');
+  const execIndex = log.indexOf('exec example_project_backend');
+  assert(composeIndex >= 0 && execIndex > composeIndex);
+  assert.match(await readFile(join(extracted, 'logs/deploy.log'), 'utf8'), /operation=deploy result=failure/);
+});
+
 test('validator 拒绝数据库容器和不完整远程数据库配置', async () => {
   const item = await fixture();
   await buildProject(item);
@@ -221,6 +427,72 @@ test('validator 拒绝数据库容器和不完整远程数据库配置', async (
   await assert.rejects(run(process.execPath, [validator, envPackage]), /Root \.env is missing DB_URL/);
 });
 
+test('缺失或非 Asia/Shanghai TZ 在 Docker 状态变化前被拒绝', async () => {
+  const item = await fixture();
+  const environmentPath = join(item.root, '.env');
+  await writeFile(environmentPath, envText.replace('TZ=Asia/Shanghai', 'TZ=../Shanghai'), { mode: 0o600 });
+  await assert.rejects(buildProject(item), /TZ must equal Asia\/Shanghai for CST \(UTC\+8\)/);
+  await assert.rejects(stat(item.log), { code: 'ENOENT' });
+
+  await writeFile(environmentPath, envText, { mode: 0o600 });
+  await buildProject(item);
+
+  const missingPackage = await extractArchive(item);
+  await writeFile(join(missingPackage, '.env'), envText.replace('TZ=Asia/Shanghai\n', ''), { mode: 0o600 });
+  await rewriteManifest(missingPackage);
+  await assert.rejects(run(process.execPath, [validator, missingPackage]), /Root \.env is missing TZ/);
+
+  const invalidPackage = await extractArchive(item);
+  await writeFile(join(invalidPackage, '.env'), envText.replace('TZ=Asia/Shanghai', 'TZ=UTC'), { mode: 0o600 });
+  await rewriteManifest(invalidPackage);
+  await assert.rejects(run(process.execPath, [validator, invalidPackage]), /Invalid TZ; expected Asia\/Shanghai/);
+
+  const composePackage = await extractArchive(item);
+  const compose = await readFile(join(composePackage, 'docker-compose.yml'), 'utf8');
+  await writeFile(join(composePackage, 'docker-compose.yml'), compose.replace('      TZ: "${TZ:?TZ is required}"\n', ''));
+  await rewriteManifest(composePackage);
+  await assert.rejects(run(process.execPath, [validator, composePackage]), /Both services must explicitly use the same required TZ/);
+});
+
+test('validator 拒绝容器名、重启策略或端口单一来源被破坏', async () => {
+  const item = await fixture();
+  await buildProject(item);
+
+  const namePackage = await extractArchive(item);
+  let compose = await readFile(join(namePackage, 'docker-compose.yml'), 'utf8');
+  await writeFile(join(namePackage, 'docker-compose.yml'), compose.replace('container_name: "${PROJECT_NAME:?PROJECT_NAME is required}_frontend"', 'container_name: unrelated_frontend'));
+  await rewriteManifest(namePackage);
+  await assert.rejects(run(process.execPath, [validator, namePackage]), /frontend container name must equal its image repository/);
+
+  const restartPackage = await extractArchive(item);
+  compose = await readFile(join(restartPackage, 'docker-compose.yml'), 'utf8');
+  await writeFile(join(restartPackage, 'docker-compose.yml'), compose.replace('restart: unless-stopped', 'restart: always'));
+  await rewriteManifest(restartPackage);
+  await assert.rejects(run(process.execPath, [validator, restartPackage]), /Both services must use restart: unless-stopped/);
+
+  const portPackage = await extractArchive(item);
+  compose = await readFile(join(portPackage, 'docker-compose.yml'), 'utf8');
+  await writeFile(join(portPackage, 'docker-compose.yml'), compose.replace('${DOCKER_BIND_IP}:${FRONTEND_PORT}:${FRONTEND_PORT}', '${DOCKER_BIND_IP}:${FRONTEND_PORT}:80'));
+  await rewriteManifest(portPackage);
+  await assert.rejects(run(process.execPath, [validator, portPackage]), /Frontend port mapping is invalid/);
+});
+
+test('validator 拒绝冲突的 API 路径和缺失的代理注入', async () => {
+  const item = await fixture();
+  await buildProject(item);
+
+  const envPackage = await extractArchive(item);
+  await writeFile(join(envPackage, '.env'), envText.replace('VITE_API_BASE_URL=/api', 'VITE_API_BASE_URL=/service'), { mode: 0o600 });
+  await rewriteManifest(envPackage);
+  await assert.rejects(run(process.execPath, [validator, envPackage]), /VITE_API_BASE_URL must equal \/API_PREFIX/);
+
+  const composePackage = await extractArchive(item);
+  const compose = await readFile(join(composePackage, 'docker-compose.yml'), 'utf8');
+  await writeFile(join(composePackage, 'docker-compose.yml'), compose.replace('      VITE_API_BASE_URL: "${VITE_API_BASE_URL:?VITE_API_BASE_URL is required}"\n', ''));
+  await rewriteManifest(composePackage);
+  await assert.rejects(run(process.execPath, [validator, composePackage]), /Frontend API path is not passed to Nginx/);
+});
+
 test('validator 拒绝清单篡改和额外包内容', async () => {
   const item = await fixture();
   await buildProject(item);
@@ -232,6 +504,15 @@ test('validator 拒绝清单篡改和额外包内容', async () => {
   await assert.rejects(run(process.execPath, [validator, extracted]), /Compose must define only frontend and backend|Checksum mismatch/);
 });
 
+test('validator 拒绝镜像归档平台与 DOCKER_PLATFORM 不一致', async () => {
+  const item = await fixture();
+  await buildProject(item);
+  const extracted = await extractArchive(item);
+  await rewriteImageArchivePlatform(join(extracted, 'backend-image.tar'), 'linux/arm64');
+  await rewriteManifest(extracted);
+  await assert.rejects(run(process.execPath, [validator, extracted]), /backend-image\.tar platform must equal DOCKER_PLATFORM/);
+});
+
 test('build 在任何 Docker 操作前拒绝环境文件命令语法', async () => {
   const item = await fixture();
   await writeFile(join(item.root, '.env'), envText.replace('DB_PASSWORD=secret', 'DB_PASSWORD=$(id)'), { mode: 0o600 });

package/.well-known/skills/wdyy-deployment-standard/templates/backend.Dockerfile.template

@@ -3,7 +3,8 @@ FROM ${BACKEND_BASE_IMAGE} AS build
 WORKDIR /app
 COPY . .
 RUN corepack enable && pnpm install --frozen-lockfile
-RUN pnpm --dir src/backend build
+RUN pnpm --filter ./src/backend build
+RUN pnpm --filter ./src/backend deploy --prod --legacy /runtime
 
 FROM ${BACKEND_BASE_IMAGE} AS runtime
 WORKDIR /app
@@ -11,8 +12,6 @@ ARG BACKEND_PORT
 ENV NODE_ENV=production
 ENV PORT=${BACKEND_PORT}
 LABEL org.opencontainers.image.title="wdyy-backend"
-COPY --from=build /app/package.json ./package.json
-COPY --from=build /app/node_modules ./node_modules
-COPY --from=build /app/src/backend/dist ./dist
+COPY --from=build /runtime ./src/backend/
 EXPOSE ${BACKEND_PORT}
-CMD ["node", "dist/main.js"]
+CMD ["node", "src/backend/dist/main.js"]

package/.well-known/skills/wdyy-deployment-standard/templates/deploy.sh.template

@@ -53,15 +53,28 @@ validate_env_permissions() {
   [[ "$mode" == 400 || "$mode" == 600 ]] || fail "root .env permissions must be 400 or 600; got $mode"
 }
 
+assert_execution_host() {
+  local kernel
+  kernel="$(uname -s 2>/dev/null)" || fail "execution host OS is unavailable"
+  case "$kernel" in
+    Darwin|Linux) ;;
+    *) fail "unsupported execution host: $kernel; use Linux, macOS, or Windows Docker Desktop through WSL2" ;;
+  esac
+  if [[ "$kernel" == Linux ]] && { [[ -n "${WSL_DISTRO_NAME:-}" ]] || grep -qi microsoft /proc/sys/kernel/osrelease 2>/dev/null; }; then
+    [[ ! "$SCRIPT_DIR" =~ ^/mnt/[A-Za-z](/|$) ]] || fail "Windows Docker Desktop execution must use the WSL2 Linux filesystem, not $SCRIPT_DIR"
+  fi
+}
+
 reset_configuration() {
   unset FRONTEND_URL FRONTEND_PORT BACKEND_URL BACKEND_PORT
+  unset API_PREFIX VITE_API_BASE_URL
   unset DB_URL DB_PORT DB_USER DB_PASSWORD DB_NAME DB_SCHEMA
-  unset PROJECT_NAME DOCKER_BIND_IP FRONTEND_BASE_IMAGE BACKEND_BASE_IMAGE
+  unset PROJECT_NAME DOCKER_BIND_IP DOCKER_PLATFORM FRONTEND_BASE_IMAGE BACKEND_BASE_IMAGE TZ
 }
 
 is_configuration_key() {
   case "$1" in
-    FRONTEND_URL|FRONTEND_PORT|BACKEND_URL|BACKEND_PORT|DB_URL|DB_PORT|DB_USER|DB_PASSWORD|DB_NAME|DB_SCHEMA|PROJECT_NAME|DOCKER_BIND_IP|FRONTEND_BASE_IMAGE|BACKEND_BASE_IMAGE)
+    FRONTEND_URL|FRONTEND_PORT|BACKEND_URL|BACKEND_PORT|API_PREFIX|VITE_API_BASE_URL|DB_URL|DB_PORT|DB_USER|DB_PASSWORD|DB_NAME|DB_SCHEMA|PROJECT_NAME|DOCKER_BIND_IP|DOCKER_PLATFORM|FRONTEND_BASE_IMAGE|BACKEND_BASE_IMAGE|TZ)
       return 0 ;;
     *) return 1 ;;
   esac
@@ -105,23 +118,74 @@ load_dotenv() {
 
 validate_configuration() {
   local key value
-  for key in FRONTEND_URL FRONTEND_PORT BACKEND_URL BACKEND_PORT DB_URL DB_PORT DB_USER DB_PASSWORD DB_NAME DB_SCHEMA PROJECT_NAME DOCKER_BIND_IP FRONTEND_BASE_IMAGE BACKEND_BASE_IMAGE; do
+  for key in FRONTEND_URL FRONTEND_PORT BACKEND_URL BACKEND_PORT API_PREFIX VITE_API_BASE_URL DB_URL DB_PORT DB_USER DB_PASSWORD DB_NAME DB_SCHEMA PROJECT_NAME DOCKER_BIND_IP DOCKER_PLATFORM FRONTEND_BASE_IMAGE BACKEND_BASE_IMAGE TZ; do
     value="${!key:-}"
     [[ -n "$value" ]] || fail "required configuration is missing: $key"
   done
   [[ "$PROJECT_NAME" =~ ^[a-z][a-z0-9_]*$ ]] || fail "PROJECT_NAME must match ^[a-z][a-z0-9_]*$"
   [[ "$FRONTEND_URL" =~ ^[A-Za-z0-9:.%-]+$ ]] || fail "FRONTEND_URL contains unsafe characters"
   [[ "$BACKEND_URL" =~ ^[A-Za-z0-9:.%-]+$ ]] || fail "BACKEND_URL contains unsafe characters"
+  [[ "$API_PREFIX" =~ ^[A-Za-z][A-Za-z0-9_-]*$ ]] || fail "API_PREFIX must be one safe path segment"
+  [[ "$VITE_API_BASE_URL" == "/$API_PREFIX" ]] || fail "VITE_API_BASE_URL must equal /$API_PREFIX"
   [[ "$DOCKER_BIND_IP" =~ ^[A-Za-z0-9:.%-]+$ ]] || fail "DOCKER_BIND_IP contains unsafe characters"
+  [[ "$DOCKER_PLATFORM" =~ ^linux/(amd64|arm64)$ ]] || fail "DOCKER_PLATFORM must be linux/amd64 or linux/arm64"
   [[ "$DB_URL" =~ ^[A-Za-z0-9._:/?@\&=%-]+$ ]] || fail "DB_URL contains unsafe characters"
   [[ "$FRONTEND_BASE_IMAGE" =~ ^[A-Za-z0-9._/:@-]+$ ]] || fail "FRONTEND_BASE_IMAGE is not a valid image reference"
   [[ "$BACKEND_BASE_IMAGE" =~ ^[A-Za-z0-9._/:@-]+$ ]] || fail "BACKEND_BASE_IMAGE is not a valid image reference"
+  [[ "$TZ" == Asia/Shanghai ]] || fail "TZ must equal Asia/Shanghai for CST (UTC+8)"
   assert_port FRONTEND_PORT "$FRONTEND_PORT"
   assert_port BACKEND_PORT "$BACKEND_PORT"
   assert_port DB_PORT "$DB_PORT"
   [[ "$FRONTEND_PORT" != "$BACKEND_PORT" ]] || fail "FRONTEND_PORT and BACKEND_PORT must differ"
 }
 
+assert_image_platform() {
+  local image="$1" actual
+  actual="$(docker image inspect --platform "$DOCKER_PLATFORM" --format '{{.Os}}/{{.Architecture}}' "$image" 2>/dev/null)" || fail "image platform is unavailable for $image: $DOCKER_PLATFORM"
+  [[ "$actual" == "$DOCKER_PLATFORM" ]] || fail "image platform mismatch for $image: expected $DOCKER_PLATFORM, got $actual"
+}
+
+assert_server_platform() {
+  local actual
+  actual="$(docker version --format '{{.Server.Os}}/{{.Server.Arch}}' 2>/dev/null)" || fail "Docker Server platform is unavailable"
+  [[ -n "$actual" ]] || fail "Docker Server platform is empty"
+  [[ "$actual" != windows/* ]] || fail "Windows container mode is unsupported; switch Docker Desktop to Linux containers"
+  [[ "$actual" =~ ^linux/(amd64|arm64)$ ]] || fail "unsupported Docker Server platform: $actual"
+  [[ "$actual" == "$DOCKER_PLATFORM" ]] || fail "Docker Server platform mismatch: expected $DOCKER_PLATFORM, got $actual"
+}
+
+assert_container_ownership() {
+  local name="$1" expected_service="$2" matches ownership
+  matches="$(docker container ls --all --filter "name=^/${name}$" --format '{{.Names}}' 2>/dev/null)" || fail "unable to inspect existing container name: $name"
+  [[ -n "$matches" ]] || return 0
+  [[ "$matches" == "$name" ]] || fail "container name lookup returned unexpected results for $name: $matches"
+  ownership="$(docker container inspect --format '{{ index .Config.Labels "com.docker.compose.project" }}|{{ index .Config.Labels "com.docker.compose.service" }}' "$name" 2>/dev/null)" || fail "unable to inspect container ownership: $name"
+  [[ "$ownership" == "$PROJECT_NAME|$expected_service" ]] || fail "container name conflict: $name belongs to ${ownership:-unknown}; expected $PROJECT_NAME|$expected_service"
+}
+
+assert_stack_container_ownership() {
+  assert_container_ownership "${PROJECT_NAME}_frontend" frontend
+  assert_container_ownership "${PROJECT_NAME}_backend" backend
+}
+
+assert_cst_time_value() {
+  local label="$1" actual="$2"
+  actual="${actual%$'\r'}"
+  [[ "$actual" =~ ^([01][0-9]|2[0-3])[[:space:]]CST[[:space:]]\+0800$ ]] || fail "$label time must use 24-hour CST +0800; got ${actual:-empty}"
+}
+
+assert_image_cst_time() {
+  local image="$1" actual
+  actual="$(docker run --rm --pull=never --platform "$DOCKER_PLATFORM" --entrypoint sh --env TZ=Asia/Shanghai "$image" -c 'LC_ALL=C date "+%H %Z %z"' 2>/dev/null)" || fail "unable to verify image CST time: $image"
+  assert_cst_time_value "image $image" "$actual"
+}
+
+assert_container_cst_time() {
+  local name="$1" actual
+  actual="$(docker exec "$name" sh -c 'LC_ALL=C date "+%H %Z %z"' 2>/dev/null)" || fail "unable to verify running container CST time: $name"
+  assert_cst_time_value "container $name" "$actual"
+}
+
 validate_dockerignore() {
   local file="$1" pattern line
   [[ -f "$file" && ! -L "$file" ]] || fail "required Docker ignore file is missing: $file"
@@ -206,8 +270,9 @@ ensure_deploy_output_scope() {
 build_release() {
   local project_root="$SCRIPT_DIR" frontend_dockerfile backend_dockerfile compose_source dockerignore_file
   local frontend_image backend_image package_root deploy_dir archive_name candidate
-  for command in docker tar install find sort grep sed awk mktemp; do require_command "$command"; done
+  for command in docker tar install find sort grep sed awk mktemp uname; do require_command "$command"; done
   select_checksum_tool
+  assert_execution_host
   load_dotenv "$project_root/.env"
   validate_configuration
   frontend_dockerfile="$project_root/src/frontend/Dockerfile"
@@ -220,14 +285,20 @@ build_release() {
   validate_dockerignore "$dockerignore_file"
   docker image inspect "$FRONTEND_BASE_IMAGE" >/dev/null 2>&1 || fail "required local frontend base image is missing: $FRONTEND_BASE_IMAGE"
   docker image inspect "$BACKEND_BASE_IMAGE" >/dev/null 2>&1 || fail "required local backend base image is missing: $BACKEND_BASE_IMAGE"
+  assert_image_platform "$FRONTEND_BASE_IMAGE"
+  assert_image_platform "$BACKEND_BASE_IMAGE"
   frontend_image="${PROJECT_NAME}_frontend:latest"
   backend_image="${PROJECT_NAME}_backend:latest"
   acquire_build_lock
   trap cleanup_build EXIT
-  docker build --pull=false --build-arg "FRONTEND_BASE_IMAGE=$FRONTEND_BASE_IMAGE" --build-arg "BACKEND_BASE_IMAGE=$BACKEND_BASE_IMAGE" --tag "$frontend_image" --file "$frontend_dockerfile" "$project_root"
-  docker build --pull=false --build-arg "BACKEND_BASE_IMAGE=$BACKEND_BASE_IMAGE" --build-arg "BACKEND_PORT=$BACKEND_PORT" --tag "$backend_image" --file "$backend_dockerfile" "$project_root"
+  docker build --pull=false --platform "$DOCKER_PLATFORM" --build-arg "FRONTEND_BASE_IMAGE=$FRONTEND_BASE_IMAGE" --build-arg "BACKEND_BASE_IMAGE=$BACKEND_BASE_IMAGE" --build-arg "VITE_API_BASE_URL=$VITE_API_BASE_URL" --tag "$frontend_image" --file "$frontend_dockerfile" "$project_root"
+  docker build --pull=false --platform "$DOCKER_PLATFORM" --build-arg "BACKEND_BASE_IMAGE=$BACKEND_BASE_IMAGE" --build-arg "BACKEND_PORT=$BACKEND_PORT" --tag "$backend_image" --file "$backend_dockerfile" "$project_root"
   docker image inspect "$frontend_image" >/dev/null 2>&1 || fail "frontend image build did not create $frontend_image"
   docker image inspect "$backend_image" >/dev/null 2>&1 || fail "backend image build did not create $backend_image"
+  assert_image_platform "$frontend_image"
+  assert_image_platform "$backend_image"
+  assert_image_cst_time "$frontend_image"
+  assert_image_cst_time "$backend_image"
   STAGING_ROOT="$(mktemp -d "$project_root/.deploy-build.XXXXXX")"
   package_root="$STAGING_ROOT/package"
   mkdir -p "$package_root"
@@ -245,7 +316,7 @@ build_release() {
   archive_name="${PROJECT_NAME}-docker.tar.gz"
   ensure_deploy_output_scope "$deploy_dir" "$archive_name"
   candidate="$STAGING_ROOT/$archive_name"
-  tar -czf "$candidate" -C "$package_root" .
+  env COPYFILE_DISABLE=1 tar --no-xattrs -czf "$candidate" -C "$package_root" .
   tar -tzf "$candidate" >/dev/null || fail "generated delivery archive is invalid"
   mv -f "$candidate" "$deploy_dir/$archive_name"
   rm -rf -- "$STAGING_ROOT"
@@ -258,8 +329,9 @@ build_release() {
 
 initialize_server_context() {
   DEPLOY_ROOT="$SCRIPT_DIR"
-  for command in docker tar find sort grep sed awk; do require_command "$command"; done
+  for command in docker tar find sort grep sed awk uname; do require_command "$command"; done
   select_checksum_tool
+  assert_execution_host
   load_dotenv "$DEPLOY_ROOT/.env"
   validate_configuration
   [[ -f "$DEPLOY_ROOT/docker-compose.yml" && ! -L "$DEPLOY_ROOT/docker-compose.yml" ]] || fail "docker-compose.yml is missing"
@@ -273,7 +345,7 @@ compose() {
 record_operation() {
   local result="$1" timestamp
   [[ -n "$DEPLOY_ROOT" && -d "$DEPLOY_ROOT/logs" && -n "$OPERATION" ]] || return 0
-  timestamp="$(date '+%Y-%m-%d %H:%M:%S %z')"
+  timestamp="$(TZ=Asia/Shanghai LC_ALL=C date '+%Y-%m-%d %H:%M:%S %Z %z')"
   printf '%s operation=%s result=%s\n' "$timestamp" "$OPERATION" "$result" >> "$DEPLOY_ROOT/logs/deploy.log"
 }
 
@@ -283,11 +355,17 @@ deploy_stack() {
   verify_manifest "$DEPLOY_ROOT"
   archive_has_tag "$DEPLOY_ROOT/frontend-image.tar" "$frontend_image"
   archive_has_tag "$DEPLOY_ROOT/backend-image.tar" "$backend_image"
+  assert_server_platform
+  assert_stack_container_ownership
   docker load -i "$DEPLOY_ROOT/frontend-image.tar" >/dev/null
   docker load -i "$DEPLOY_ROOT/backend-image.tar" >/dev/null
+  assert_image_platform "${PROJECT_NAME}_frontend:latest"
+  assert_image_platform "${PROJECT_NAME}_backend:latest"
   docker image inspect "$frontend_image" >/dev/null 2>&1 || fail "loaded frontend image is missing: $frontend_image"
   docker image inspect "$backend_image" >/dev/null 2>&1 || fail "loaded backend image is missing: $backend_image"
   compose up -d --force-recreate --no-build --pull never --wait frontend backend
+  assert_container_cst_time "${PROJECT_NAME}_frontend"
+  assert_container_cst_time "${PROJECT_NAME}_backend"
 }
 
 run_logged_operation() {
@@ -307,6 +385,8 @@ server_deploy() {
 
 server_stop() {
   initialize_server_context
+  assert_server_platform
+  assert_stack_container_ownership
   run_logged_operation stop compose stop frontend backend
 }