@wdyy/skills 0.1.14 → 0.1.15

package/.well-known/skills/index.json

@@ -7,13 +7,13 @@
     },
     {
       "name": "wdyy-deployment-standard",
-      "description": "为无 CI/CD 的前后端项目生成并验证目标平台确定的统一 Docker 交付：在任意构建机上使用本地已有的目标架构基础镜像，构建 linux/amd64 或 linux/arm64 前后端镜像，分别导出后封装为一个压缩包，并在平台匹配的 Linux Docker Server 上无参数部署整个项目栈。Use when 规划、实现、审查或执行跨构建机平台的人工 Docker 生产交付时。",
+      "description": "为无 CI/CD 的前后端项目生成并验证跨宿主机统一 Docker 交付：在 Linux、macOS Docker Desktop 或 Windows Docker Desktop + WSL2/Linux 容器模式中，使用本地已有基础镜像构建单一 linux/amd64 或 linux/arm64 双镜像包，并在平台匹配的 Linux engine 上以固定端口、容器名、重启策略和 CST（UTC+8）时间整栈运行。Use when 规划、实现、审查或执行跨构建机平台的人工 Docker 生产交付时。",
       "files": ["SKILL.md", "agents/openai.yaml", "reference/docker-delivery-rules.md", "scripts/generate-deployment-files.mjs", "scripts/generate-deployment-files.test.mjs", "scripts/validate-deployment-package.mjs", "scripts/validate-deployment-package.test.mjs", "templates/backend.Dockerfile.template", "templates/frontend.Dockerfile.template", "templates/frontend-container.conf.template", "templates/env.example.template", "templates/deploy.sh.template", "templates/docker-compose.yml", "templates/dockerignore.template"]
     },
     {
       "name": "wdyy-api-standard",
       "description": "根据“获取XX数据”“使用XX接口”等具体需求，定位已登记的接口 reference，并按已确认的接口契约将调用方式写入程序。Use when 需要查询或实现一个已登记接口的数据调用时。",
-      "files": ["SKILL.md", "agents/openai.yaml", "reference/api-demo.md", "reference/api-sms.md"]
+      "files": ["SKILL.md", "agents/openai.yaml", "reference/api-demo.md", "reference/api-his-sql.md", "reference/api-sms.md"]
     },
     {
       "name": "wdyy-bug-record",

package/.well-known/skills/wdyy-api-standard/reference/api-his-sql.md

@@ -0,0 +1,38 @@
+# 接口名称：api-his-sql
+
+# 接口用途：执行 SQL 查询并返回查询结果
+
+# 接口URL：http://172.26.1.64:8999/api/database/query
+
+`POST` 请求，`Content-Type` 为 `application/json`。
+
+# 入参格式：JSON
+
+```json
+{
+  "sql": "SELECT * FROM SS_User WHERE ssusr_name = '示例用户'",
+  "params": []
+}
+```
+
+- `sql`：要执行的 SQL 查询语句。
+- `params`：SQL 查询参数数组；示例 SQL 未使用参数，因此传入空数组。
+
+# 返回值：JSON
+
+```json
+{
+  "data": [
+    {
+      "SSUSR_RowId": 20292,
+      "SSUSR_Initials": "20684",
+      "SSUSR_Name": "马俊"
+    }
+  ],
+  "success": true,
+  "count": 1,
+  "message": "查询执行成功"
+}
+```
+
+# 备注：使用 `POST` 请求调用；将 SQL 查询语句放入 `sql` 字段，将对应的查询参数放入 `params` 数组。

package/.well-known/skills/wdyy-deployment-standard/SKILL.md

@@ -1,13 +1,15 @@
 ---
 name: wdyy-deployment-standard
-description: 为无 CI/CD 的前后端项目生成并验证目标平台确定的统一 Docker 交付：在任意构建机上使用本地已有的目标架构基础镜像，构建 linux/amd64 或 linux/arm64 前后端镜像，分别导出后封装为一个压缩包，并在平台匹配的 Linux Docker Server 上无参数部署整个项目栈。Use when 规划、实现、审查或执行跨构建机平台的人工 Docker 生产交付时。
+description: 为无 CI/CD 的前后端项目生成并验证跨宿主机统一 Docker 交付：在 Linux、macOS Docker Desktop 或 Windows Docker Desktop + WSL2/Linux 容器模式中，使用本地已有基础镜像构建单一 linux/amd64 或 linux/arm64 双镜像包，并在平台匹配的 Linux engine 上以固定端口、容器名、重启策略和 CST（UTC+8）时间整栈运行。Use when 规划、实现、审查或执行跨构建机平台的人工 Docker 生产交付时。
 ---
 
 # 统一 Docker 交付规范
 
 ## Overview
 
-把一个项目作为一个整体交付：在任意支持目标架构的 Docker 构建机上执行 `./deploy.sh build`，按 `DOCKER_PLATFORM` 生成前端、后端两个单架构镜像并分别导出，最终只产出一个压缩包；工程师人工上传并解压；平台匹配的 Linux Docker Server 无参数执行 `./deploy.sh`，一次性加载并部署整个前后端项目栈。
+把一个项目作为一个整体交付：在 Linux、macOS Docker Desktop，或 Windows Docker Desktop + WSL2/Linux 容器模式中执行 `./deploy.sh build`，按 `DOCKER_PLATFORM` 生成前端、后端两个 Linux 单架构镜像并分别导出，最终只产出一个压缩包；工程师人工复制并解压；Docker Server 平台匹配时无参数执行 `./deploy.sh`，一次性加载并部署整个前后端项目栈。
+
+macOS/arm64 宿主机的 Docker Server 平台是 `linux/arm64`。Windows 必须在启用 Docker Desktop 集成的 WSL2 发行版和 Linux 文件系统中执行同一 Bash 脚本，并使用 Linux 容器 engine；不支持原生 PowerShell、Windows 容器模式或 `windows/*` 镜像。
 
 ## Workflow
 
@@ -16,7 +18,7 @@ description: 为无 CI/CD 的前后端项目生成并验证目标平台确定的
 3. 运行 `node scripts/generate-deployment-files.mjs --target <目标项目根目录> --write` 生成受版本控制文件并扩充 `.env`、`.env.example` 的部署段。既有生成文件不一致时先展示差异并等待工程师确认，确认后才使用 `--force`。
 4. 在目标项目根执行生成器 `--check`，再运行 `scripts/validate-deployment-package.mjs` 和行为测试。
 5. 本地执行 `./deploy.sh build`；只在全部校验成功后原子替换 `deploy/<PROJECT_NAME>-docker.tar.gz`。
-6. 人工上传并解压压缩包，在服务器解压目录无参数执行 `./deploy.sh`。
+6. 人工复制并解压压缩包，在 Linux 文件系统的解压目录无参数执行 `./deploy.sh`；Windows 场景必须从 WSL2 执行。
 
 ## Fixed Contract
 
@@ -24,11 +26,15 @@ description: 为无 CI/CD 的前后端项目生成并验证目标平台确定的
 - 每个交付包只对应 `DOCKER_PLATFORM` 指定的 `linux/amd64` 或 `linux/arm64`；构建机自身平台可以不同，不得回退到构建机原生架构。
 - 分别导出 `frontend-image.tar`、`backend-image.tar`，但只交付一个 `<PROJECT_NAME>-docker.tar.gz`。
 - 构建前检查 `FRONTEND_BASE_IMAGE`、`BACKEND_BASE_IMAGE` 已存在于本地；缺失即失败，不执行 `docker pull`。
-- 服务器加载镜像前读取 Docker Server OS/架构；无法读取、不是 Linux 或不等于 `DOCKER_PLATFORM` 时立即失败。
+- 宿主机可以是 Linux、macOS 或 Windows，但镜像和 Docker Server 必须是 `linux/amd64` 或 `linux/arm64`；加载前读取 Server OS/架构，无法读取、Windows 容器模式或不等于 `DOCKER_PLATFORM` 时立即失败。
 - Compose 只定义 frontend、backend；数据库通过 `.env` 直连远程实例，不生成数据库容器、数据卷或迁移路径。
 - 服务器无参数命令整体部署；只额外允许 `stop` 和 `status`，不得独立操作单一服务。
 - 前后端直接暴露 `.env` 指定的宿主机端口；两个容器共同挂载项目根 `./logs` 到 `/app/logs`。
+- `FRONTEND_PORT` 同时控制 frontend 宿主机映射和容器 Nginx 监听；`BACKEND_PORT` 同时控制 backend 宿主机映射、Node 监听、健康检查和 frontend 内部代理，不增加重复容器端口变量。
+- frontend 容器和镜像 repository 都命名为 `<PROJECT_NAME>_frontend`，backend 都命名为 `<PROJECT_NAME>_backend`；镜像额外使用 `:latest` 标签。同名容器不属于当前 Compose 项目和服务时必须在加载镜像前失败，不得删除或接管。
+- frontend 与 backend 都使用 `restart: unless-stopped`：意外退出由 Docker 自动重启，`./deploy.sh stop` 人工停止后保持停止，直到再次明确整栈部署。
 - frontend Nginx 使用 `.env` 的 `VITE_API_BASE_URL` 与 `BACKEND_PORT`，把同源 API 请求代理到 Compose `backend` 服务；`VITE_API_BASE_URL` 必须等于 `/${API_PREFIX}`。
+- 根 `.env` 与 `.env.example` 必须严格使用 `TZ=Asia/Shanghai`。构建后、Docker save 前实际探测两个镜像；整栈健康后实际探测两个运行容器，均必须以 24 小时格式输出 `CST +0800`。
 - `.env` 可以进入人工上传的压缩包，但必须被 `.dockerignore` 排除，不得进入镜像。
 
 ## Prohibited
@@ -36,6 +42,7 @@ description: 为无 CI/CD 的前后端项目生成并验证目标平台确定的
 - 不得使用镜像仓库 pull、镜像 fallback、数据库容器、数据库迁移、宿主机 Nginx、蓝绿、滚动切流或自动回滚。
 - 不得保留发布账本、版本目录、`release.env`、交互菜单或前后端独立替换命令。
 - 不得上传文件、拉取代码、安装 Docker、固定服务器目录或使用 `source`、`eval` 执行 `.env`。
+- 不得生成 PowerShell 备用脚本、Windows 镜像或自动切换 Docker Desktop engine；Windows 原生容器模式必须明确失败。
 - 不得跳过清单、镜像标签、Compose 服务范围、远程数据库配置或健康状态验证。
 
 ## Verification
@@ -45,8 +52,11 @@ description: 为无 CI/CD 的前后端项目生成并验证目标平台确定的
 - [ ] 两个镜像归档各自只含预期的 `latest` 标签。
 - [ ] 单一压缩包不含 macOS AppleDouble、资源叉或扩展属性元数据。
 - [ ] 构建与服务器 Compose 均禁止 pull，服务器禁止 build；基础镜像、构建参数、产出镜像和 Compose 平台均与 `DOCKER_PLATFORM` 一致。
-- [ ] 服务器 Docker Engine 平台在加载镜像前通过校验，并严格等于 `DOCKER_PLATFORM`。
+- [ ] Linux Engine、macOS/arm64 Docker Desktop 与 Windows Docker Desktop + WSL2 场景使用同一包契约；Windows 原生容器模式被拒绝。
+- [ ] Docker Server 平台在加载镜像前通过校验，并严格等于 `DOCKER_PLATFORM`。
 - [ ] Compose 只含 frontend、backend，并使用远程数据库环境变量和根 logs。
+- [ ] Compose 的双向端口都来自 FRONTEND_PORT/BACKEND_PORT；两个固定容器名等于各自镜像 repository，并各使用 `unless-stopped`。
+- [ ] 根 `.env` 严格使用 `TZ=Asia/Shanghai`；两个镜像和两个运行容器的真实时间探测均为 24 小时制 `CST +0800`。
 - [ ] frontend 镜像不包含 `.env`，同源 API 代理能够把真实页面查询转发到 backend。
 - [ ] 无参数部署、stop、status 的实际行为及失败传播通过测试。
 

package/.well-known/skills/wdyy-deployment-standard/agents/openai.yaml

@@ -1,4 +1,4 @@
 interface:
   display_name: "wdyy-deployment-standard"
-  short_description: "跨构建机生成指定 Linux 架构的双镜像并一键整栈部署"
-  default_prompt: "Use $wdyy-deployment-standard to build a single-target linux/amd64 or linux/arm64 dual-image package and verify the Docker Server platform before deploying the full stack."
+  short_description: "跨 Linux、Mac 与 Windows WSL2 生成并验证统一双镜像交付"
+  default_prompt: "Use $wdyy-deployment-standard to build and run a single-target linux/amd64 or linux/arm64 dual-image package on Linux engines, macOS Docker Desktop, or Windows Docker Desktop through WSL2, with deterministic ports, names, restart policy, and CST UTC+8 time."

package/.well-known/skills/wdyy-deployment-standard/reference/docker-delivery-rules.md

@@ -37,7 +37,8 @@ PROJECT_NAME=example_project
 DOCKER_BIND_IP=0.0.0.0
 DOCKER_PLATFORM=linux/amd64
 FRONTEND_BASE_IMAGE=nginx:stable
-BACKEND_BASE_IMAGE=node:24-alpine3.24
+BACKEND_BASE_IMAGE=node:24-bookworm-slim
+TZ=Asia/Shanghai
 ```
 
 - `PROJECT_NAME` 只允许小写字母开头，后续使用小写字母、数字或下划线。
@@ -45,23 +46,25 @@ BACKEND_BASE_IMAGE=node:24-alpine3.24
 - `.env` 权限必须为 `0600` 或只读 `0400`。
 - 按数据解析 `.env`；不得 `source`、`eval` 或执行其中内容。
 - `DB_URL` 指向远程数据库主机或地址；部署资产不得把它解释为 Docker 服务名并创建数据库容器。
-- `DOCKER_PLATFORM` 必须为 `linux/amd64` 或 `linux/arm64`，表示当前单一交付包的目标平台，并与目标 Docker Server 平台一致；不得根据构建机平台自动改写。
+- `DOCKER_PLATFORM` 必须为 `linux/amd64` 或 `linux/arm64`，表示当前单一交付包的镜像目标平台，并与运行时 Docker Server 平台一致；不得根据 Linux、macOS、Windows 宿主机或 CPU 自动改写，不得使用 `darwin/*` 或 `windows/*`。
+- `TZ` 必须严格等于 `Asia/Shanghai`，使两个容器统一使用 24 小时制的 CST（UTC+8）；其他合法 IANA 时区也不属于本交付合同。
 - `API_PREFIX` 只允许一个安全路径段，`VITE_API_BASE_URL` 必须严格等于 `/${API_PREFIX}`；生成器在两个键都缺失时加入标准值，存在缺失或冲突时明确失败。
 - `.env.example` 可保留空数据库凭据，但真实 `.env` 构建时必须完整。
 
 ## 3. 本地镜像与构建
 
-基础镜像引用允许使用标签，但目标架构版本必须在构建机本地预先存在。构建机可以是 macOS、Windows 或 Linux，也可以与目标架构不同；相同标签被人工替换后可能对应不同内容，构建过程不得访问镜像仓库或回退到构建机原生架构。
+基础镜像引用允许使用标签，但目标架构版本必须在构建机本地预先存在。构建命令可以在 Linux、macOS Docker Desktop，或 Windows Docker Desktop + WSL2/Linux 容器模式中执行，也可以与目标架构不同；Windows 必须从启用 Docker Desktop 集成的 WSL2 发行版和 Linux 文件系统执行，不支持原生 PowerShell 或 Windows 容器模式。相同标签被人工替换后可能对应不同内容，构建过程不得访问镜像仓库或回退到构建机原生架构。
 
 `./deploy.sh build` 必须按顺序：
 
 1. 验证根 `.env`、Dockerfile、Compose 和 `.dockerignore`。
 2. 使用平台感知的 `docker image inspect --platform "$DOCKER_PLATFORM"` 确认两个基础镜像的目标架构版本存在。
 3. 校验本地基础镜像平台与 `DOCKER_PLATFORM` 一致，使用 `docker build --pull=false --platform "$DOCKER_PLATFORM"` 构建 `<PROJECT_NAME>_frontend:latest` 与 `<PROJECT_NAME>_backend:latest`，并校验产出镜像平台。
-4. 分别执行 Docker save，生成 `frontend-image.tar`、`backend-image.tar`。
-5. 复制根 `.env`、deploy.sh、docker-compose.yml，生成覆盖全部包内文件的 `manifest.sha256`。
-6. 验证镜像归档各自只含预期标签，验证完整包结构。
-7. 使用 `COPYFILE_DISABLE=1` 和 `tar --no-xattrs` 排除 macOS AppleDouble、资源叉和扩展属性，生成 `deploy/<PROJECT_NAME>-docker.tar.gz`，成功后原子替换同名旧包。
+4. 对两个产出镜像分别使用 `docker run --rm --pull=never --platform "$DOCKER_PLATFORM"` 探测 `date '+%H %Z %z'`，要求小时为 `00`–`23`、时区为 `CST +0800`。
+5. 分别执行 Docker save，生成 `frontend-image.tar`、`backend-image.tar`。
+6. 复制根 `.env`、deploy.sh、docker-compose.yml，生成覆盖全部包内文件的 `manifest.sha256`。
+7. 验证镜像归档各自只含预期标签，验证完整包结构。
+8. 使用 `COPYFILE_DISABLE=1` 和 `tar --no-xattrs` 排除 macOS AppleDouble、资源叉和扩展属性，生成 `deploy/<PROJECT_NAME>-docker.tar.gz`，成功后原子替换同名旧包。
 
 构建失败必须保留上一份成功压缩包，并清理本次临时目录。不得维护发布账本、版本号、版本目录、`release.env` 或半成品目录。
 
@@ -82,9 +85,9 @@ manifest.sha256
 
 ## 5. 服务器一键操作
 
-工程师人工上传并解压单一压缩包。服务器部署根由解压后的 deploy.sh 物理路径确定。上传用的 `.tar.gz` 必须放在部署根外，或在解压后移出部署根；执行 `./deploy.sh` 时，部署根只允许保留压缩包契约中的 6 个文件和运行后生成的 `logs/` 目录。
+工程师人工复制并解压单一压缩包。部署根由解压后的 deploy.sh 物理路径确定。Windows Docker Desktop 场景必须把包放在 WSL2 Linux 文件系统中；不能满足 `.env` owner-only 权限的 Windows 挂载目录必须失败。复制用的 `.tar.gz` 必须放在部署根外，或在解压后移出部署根；执行 `./deploy.sh` 时，部署根只允许保留压缩包契约中的 6 个文件和运行后生成的 `logs/` 目录。
 
-- `./deploy.sh`：校验 `.env` 权限和内容、清单、两个镜像 tar 及预期标签；通过 `docker version` 读取 Docker Server OS/架构并要求严格等于 `DOCKER_PLATFORM`；校验通过后才加载两个镜像，再使用一次 `docker compose up -d --force-recreate --no-build --pull never --wait frontend backend` 整体部署并等待健康。
+- `./deploy.sh`：校验 `.env` 权限和内容、清单、两个镜像 tar 及预期标签；通过 `docker version` 读取 Docker Server OS/架构并要求是与 `DOCKER_PLATFORM` 相等的 Linux engine；检查固定容器名不存在或属于当前 Compose 项目和对应服务；校验通过后才加载两个镜像，再使用一次 `docker compose up -d --force-recreate --no-build --pull never --wait frontend backend` 整体部署并等待健康，最后在两个运行容器中验证 24 小时制 `CST +0800`。
 - 加载后必须再次校验两个镜像与 `DOCKER_PLATFORM` 一致；Compose 的两个服务也必须显式声明同一平台。
 - `./deploy.sh stop`：同时停止 frontend、backend，保留容器、镜像、交付文件和日志。
 - `./deploy.sh status`：输出当前 Compose 项目的服务状态，不改变 Docker 状态。
@@ -93,18 +96,19 @@ manifest.sha256
 
 ## 6. Compose、数据库和日志
 
-- Compose 只允许 frontend、backend 两个服务，不设置 `container_name`。
+- Compose 只允许 frontend、backend 两个服务；`container_name` 分别固定为 `${PROJECT_NAME}_frontend`、`${PROJECT_NAME}_backend`，与镜像 repository 相同但不含 `:latest`。
 - 镜像固定为 `${PROJECT_NAME}_frontend:latest`、`${PROJECT_NAME}_backend:latest`，不得提供 fallback。
 - frontend 映射 `${DOCKER_BIND_IP}:${FRONTEND_PORT}:${FRONTEND_PORT}`；backend 同理。
+- 两个服务都固定使用 `restart: unless-stopped`；意外退出由 Docker 重启，`./deploy.sh stop` 后不得由脚本再次启动。
 - frontend Nginx 把 `${VITE_API_BASE_URL}/...` 原样代理到 `http://backend:${BACKEND_PORT}`；不得硬编码服务器地址或后端端口。
-- 两个服务均使用根 `.env`，并挂载 `./logs:/app/logs`。
+- 两个服务均使用根 `.env`，显式接收同一 `TZ`，并挂载 `./logs:/app/logs`。
 - backend 直接读取 DB_URL、DB_PORT、DB_USER、DB_PASSWORD、DB_NAME、DB_SCHEMA。
 - Compose 不得定义数据库服务、数据库镜像、数据库 volume、数据库端口映射或迁移任务。
 - 前端 Nginx 日志写入 `/app/logs/frontend-access.log`、`/app/logs/frontend-error.log`；后端遵循 wdyy-logging-standard；部署操作写入 `./logs/deploy.log`。
 
 ## 7. 失败边界
 
-- 目标架构基础镜像缺失、Docker Server 平台无法读取或不匹配、清单错误、镜像标签错误、远程数据库配置不完整或任一服务不健康时明确失败。
+- 目标架构基础镜像缺失、Docker Server 平台无法读取或不匹配、Windows 容器模式、同名容器所有权冲突、TZ 不等于 `Asia/Shanghai`、镜像或运行容器时间不是 24 小时制 `CST +0800`、清单错误、镜像标签错误、远程数据库配置不完整或任一服务不健康时明确失败。
 - 禁止 `docker pull`、服务器 `docker build`、镜像 fallback、自动回滚、自动安装和静默跳过。
 - 脚本只操作当前 `PROJECT_NAME` 的 Compose 项目和 frontend、backend 服务，不清理其他项目资源。
 - 旧部署资产由工程师根据实际状态单独迁移；新脚本不得猜测并删除。

package/.well-known/skills/wdyy-deployment-standard/scripts/generate-deployment-files.mjs

@@ -25,7 +25,8 @@ const exampleDefaults = new Map([
   ['DB_URL', ''], ['DB_PORT', '5432'], ['DB_USER', ''], ['DB_PASSWORD', ''], ['DB_NAME', ''], ['DB_SCHEMA', ''],
 ]);
 const apiKeys = ['API_PREFIX', 'VITE_API_BASE_URL'];
-const deploymentKeys = ['PROJECT_NAME', 'DOCKER_BIND_IP', 'DOCKER_PLATFORM', 'FRONTEND_BASE_IMAGE', 'BACKEND_BASE_IMAGE'];
+const legacyDeploymentKeys = ['PROJECT_NAME', 'DOCKER_BIND_IP', 'DOCKER_PLATFORM', 'FRONTEND_BASE_IMAGE', 'BACKEND_BASE_IMAGE'];
+const deploymentKeys = [...legacyDeploymentKeys, 'TZ'];
 const removedKeys = new Set([
   'PROJECT_HTTP_PORT', 'FRONTEND_BLUE_PORT', 'FRONTEND_GREEN_PORT', 'BACKEND_BLUE_PORT', 'BACKEND_GREEN_PORT',
   'SERVER_PROJECTS_ROOT', 'NGINX_SOURCE', 'LOG_DIR', 'HOST_LOG_DIR', 'FRONTEND_CONTAINER_PORT',
@@ -109,17 +110,26 @@ function parseEnvironment(text, relativePath, requireExampleDefaults, deployment
   }
   const deploymentEntries = sections.get('部署');
   const actualDeploymentKeys = deploymentEntries.map(({ key }) => key);
-  if (actualDeploymentKeys.length !== 0 && actualDeploymentKeys.join('|') !== deploymentKeys.join('|')) {
-    throw new Error(`${relativePath} # 部署 keys must be empty or exactly: ${deploymentKeys.join(', ')}`);
+  const deploymentKeySequence = actualDeploymentKeys.join('|');
+  const isEmptyDeployment = actualDeploymentKeys.length === 0;
+  const isLegacyDeployment = deploymentKeySequence === legacyDeploymentKeys.join('|');
+  const isCurrentDeployment = deploymentKeySequence === deploymentKeys.join('|');
+  if (!isEmptyDeployment && !isLegacyDeployment && !isCurrentDeployment) {
+    throw new Error(`${relativePath} # 部署 keys must be empty, the legacy sequence ${legacyDeploymentKeys.join(', ')}, or exactly: ${deploymentKeys.join(', ')}`);
   }
   if (requireExampleDefaults) {
     for (const { key, value } of deploymentEntries) {
       if (value !== deploymentDefaults.get(key)) throw new Error(`${relativePath} must keep the standard deployment default for ${key}`);
     }
   }
+  if (isCurrentDeployment) {
+    const timezone = deploymentEntries.find(({ key }) => key === 'TZ')?.value;
+    if (timezone !== 'Asia/Shanghai') throw new Error(`${relativePath} TZ must equal Asia/Shanghai for CST (UTC+8)`);
+  }
   return {
     apiExtended: presentApiKeys.length === apiKeys.length,
-    deploymentExtended: deploymentEntries.length === deploymentKeys.length,
+    deploymentExtended: isCurrentDeployment,
+    presentDeploymentKeys: actualDeploymentKeys,
     nonDeploymentKeys: [...seen].filter((key) => !deploymentKeys.includes(key)),
   };
 }
@@ -129,8 +139,11 @@ function extendApiSection(text, apiDefaults) {
   return `${text.replaceAll('\r\n', '\n').trimEnd().replace(/^# 部署$/m, `${additions}\n\n# 部署`)}\n`;
 }
 
-function extendDeploymentSection(text, deploymentDefaults) {
-  const additions = deploymentKeys.map((key) => `${key}=${deploymentDefaults.get(key)}`).join('\n');
+function extendDeploymentSection(text, deploymentDefaults, presentDeploymentKeys) {
+  const additions = deploymentKeys
+    .filter((key) => !presentDeploymentKeys.includes(key))
+    .map((key) => `${key}=${deploymentDefaults.get(key)}`)
+    .join('\n');
   return `${text.trimEnd()}\n${additions}\n`;
 }
 
@@ -175,7 +188,7 @@ for (const [relativePath, expectedMode, requireDefaults] of [['.env', 0o600, fal
   const parsed = parseEnvironment(existing, relativePath, requireDefaults, deploymentDefaults);
   let expected = existing;
   if (!parsed.apiExtended) expected = extendApiSection(expected, apiDefaults);
-  if (!parsed.deploymentExtended) expected = extendDeploymentSection(expected, deploymentDefaults);
+  if (!parsed.deploymentExtended) expected = extendDeploymentSection(expected, deploymentDefaults, parsed.presentDeploymentKeys);
   environmentPlans.push({
     path, relativePath, expectedMode,
     existing: existingBuffer,

package/.well-known/skills/wdyy-deployment-standard/scripts/generate-deployment-files.test.mjs

@@ -75,7 +75,15 @@ test('生成统一 Docker 交付文件并通过确定性检查', async () => {
   assert.match(environment, /API_URL=\nAPI_PREFIX=api\nVITE_API_BASE_URL=\/api\n\n# 部署/);
   assert.match(environment, /FRONTEND_BASE_IMAGE=nginx:stable/);
   assert.match(environment, /DOCKER_PLATFORM=linux\/amd64/);
-  assert.match(await readFile(join(root, '.env.example'), 'utf8'), /BACKEND_BASE_IMAGE=node:24-alpine3\.24/);
+  assert.match(environment, /TZ=Asia\/Shanghai/);
+  assert.match(await readFile(join(root, '.env.example'), 'utf8'), /BACKEND_BASE_IMAGE=node:24-bookworm-slim/);
+  const compose = await readFile(join(root, 'scripts/deployment/docker-compose.yml'), 'utf8');
+  assert.equal((compose.match(/TZ: "\$\{TZ:\?TZ is required\}"/g) ?? []).length, 2);
+  assert.match(compose, /container_name: "\$\{PROJECT_NAME:\?PROJECT_NAME is required\}_frontend"/);
+  assert.match(compose, /container_name: "\$\{PROJECT_NAME:\?PROJECT_NAME is required\}_backend"/);
+  assert.equal((compose.match(/restart: unless-stopped/g) ?? []).length, 2);
+  assert.match(compose, /"\$\{DOCKER_BIND_IP\}:\$\{FRONTEND_PORT\}:\$\{FRONTEND_PORT\}"/);
+  assert.match(compose, /"\$\{DOCKER_BIND_IP\}:\$\{BACKEND_PORT\}:\$\{BACKEND_PORT\}"/);
   const nginx = await readFile(join(root, 'scripts/deployment/frontend-container.conf.template'), 'utf8');
   assert.match(nginx, /location \$\{VITE_API_BASE_URL\}\/ \{/);
   assert.match(nginx, /proxy_pass http:\/\/backend:\$\{BACKEND_PORT\};/);
@@ -101,6 +109,89 @@ test('扩充部署段时完整保留真实环境值', async () => {
   assert.match(actual, /PROJECT_NAME=\nDOCKER_BIND_IP=\n/);
 });
 
+test('旧五键部署段只追加标准时区并保留既有值', async () => {
+  const legacyReal = realEnv.replace('# 部署\n', `# 部署
+PROJECT_NAME=custom_project
+DOCKER_BIND_IP=127.0.0.1
+DOCKER_PLATFORM=linux/arm64
+FRONTEND_BASE_IMAGE=custom-nginx:1
+BACKEND_BASE_IMAGE=custom-node:1
+`);
+  const legacyExample = exampleEnv.replace('# 部署\n', `# 部署
+PROJECT_NAME=
+DOCKER_BIND_IP=
+DOCKER_PLATFORM=linux/amd64
+FRONTEND_BASE_IMAGE=nginx:stable
+BACKEND_BASE_IMAGE=node:24-bookworm-slim
+`);
+  const root = await fixture(legacyReal, legacyExample);
+  await invoke(root, '--write');
+  const actual = await readFile(join(root, '.env'), 'utf8');
+  assert.match(actual, /PROJECT_NAME=custom_project/);
+  assert.match(actual, /DOCKER_PLATFORM=linux\/arm64/);
+  assert.match(actual, /BACKEND_BASE_IMAGE=custom-node:1\nTZ=Asia\/Shanghai\n$/);
+  assert.match(await readFile(join(root, '.env.example'), 'utf8'), /BACKEND_BASE_IMAGE=node:24-bookworm-slim\nTZ=Asia\/Shanghai\n$/);
+  await invoke(root, '--check');
+});
+
+test('非标准时区默认值和无效部署键顺序被拒绝且不修改', async () => {
+  const root = await fixture();
+  await invoke(root, '--write');
+  const examplePath = join(root, '.env.example');
+  const invalidTimezoneExample = (await readFile(examplePath, 'utf8')).replace('TZ=Asia/Shanghai', 'TZ=UTC');
+  await writeFile(examplePath, invalidTimezoneExample, { mode: 0o644 });
+  const before = await readFile(examplePath);
+  await assert.rejects(invoke(root, '--write'), /standard deployment default for TZ/);
+  assert.deepEqual(await readFile(examplePath), before);
+
+  const invalidOrder = realEnv.replace('# 部署\n', `# 部署
+TZ=Asia/Shanghai
+PROJECT_NAME=example_project
+DOCKER_BIND_IP=0.0.0.0
+DOCKER_PLATFORM=linux/amd64
+FRONTEND_BASE_IMAGE=nginx:stable
+BACKEND_BASE_IMAGE=node:24-bookworm-slim
+`);
+  await assert.rejects(invoke(await fixture(invalidOrder), '--write'), /# 部署 keys must be/);
+});
+
+test('真实环境必须固定 Asia/Shanghai 且失败时不修改受控文件', async () => {
+  const root = await fixture();
+  await invoke(root, '--write');
+  const envPath = join(root, '.env');
+  const invalid = (await readFile(envPath, 'utf8')).replace('TZ=Asia/Shanghai', 'TZ=UTC');
+  await writeFile(envPath, invalid, { mode: 0o600 });
+  const beforeEnv = await readFile(envPath);
+  const beforeDeploy = await readFile(join(root, 'deploy.sh'));
+  await assert.rejects(invoke(root, '--write'), /TZ must equal Asia\/Shanghai for CST \(UTC\+8\)/);
+  assert.deepEqual(await readFile(envPath), beforeEnv);
+  assert.deepEqual(await readFile(join(root, 'deploy.sh')), beforeDeploy);
+});
+
+test('非默认应用端口保持单一来源且宿主机变量不改写镜像平台', async () => {
+  const configured = realEnv
+    .replace('FRONTEND_PORT=5173', 'FRONTEND_PORT=18080')
+    .replace('BACKEND_PORT=3000', 'BACKEND_PORT=19090')
+    .replace('# 部署\n', `# 部署
+PROJECT_NAME=desktop_project
+DOCKER_BIND_IP=127.0.0.1
+DOCKER_PLATFORM=linux/arm64
+FRONTEND_BASE_IMAGE=nginx:stable
+BACKEND_BASE_IMAGE=node:24-bookworm-slim
+TZ=Asia/Shanghai
+`);
+  const root = await fixture(configured);
+  await invoke(root, '--write');
+  const actual = await readFile(join(root, '.env'), 'utf8');
+  assert.match(actual, /FRONTEND_PORT=18080/);
+  assert.match(actual, /BACKEND_PORT=19090/);
+  assert.match(actual, /DOCKER_PLATFORM=linux\/arm64/);
+  const compose = await readFile(join(root, 'scripts/deployment/docker-compose.yml'), 'utf8');
+  assert.match(compose, /"\$\{DOCKER_BIND_IP\}:\$\{FRONTEND_PORT\}:\$\{FRONTEND_PORT\}"/);
+  assert.match(compose, /"\$\{DOCKER_BIND_IP\}:\$\{BACKEND_PORT\}:\$\{BACKEND_PORT\}"/);
+  assert.doesNotMatch(compose, /18080|19090|FRONTEND_CONTAINER_PORT|BACKEND_CONTAINER_PORT/);
+});
+
 test('保留有效的自定义 API 路径', async () => {
   const configuredReal = realEnv.replace('API_URL=\n', 'API_URL=\nAPI_PREFIX=service\nVITE_API_BASE_URL=/service\n');
   const configuredExample = exampleEnv.replace('API_URL=\n', 'API_URL=\nAPI_PREFIX=service\nVITE_API_BASE_URL=/service\n');
@@ -133,6 +224,23 @@ test('非标准环境文件被拒绝且不修改', async () => {
   await assert.rejects(stat(join(root, 'deploy.sh')), { code: 'ENOENT' });
 });
 
+test('旧后端基础镜像默认值被拒绝且两个环境文件均不修改', async () => {
+  const root = await fixture();
+  await invoke(root, '--write');
+  const envPath = join(root, '.env');
+  const examplePath = join(root, '.env.example');
+  const configuredEnv = (await readFile(envPath, 'utf8')).replace('node:24-bookworm-slim', 'node:24-alpine3.24');
+  const outdatedExample = (await readFile(examplePath, 'utf8')).replace('node:24-bookworm-slim', 'node:24-alpine3.24');
+  await writeFile(envPath, configuredEnv, { mode: 0o600 });
+  await writeFile(examplePath, outdatedExample, { mode: 0o644 });
+  const beforeEnv = await readFile(envPath);
+  const beforeExample = await readFile(examplePath);
+
+  await assert.rejects(invoke(root, '--write'), /must keep the standard deployment default for BACKEND_BASE_IMAGE/);
+  assert.deepEqual(await readFile(envPath), beforeEnv);
+  assert.deepEqual(await readFile(examplePath), beforeExample);
+});
+
 test('环境变量集合不一致时拒绝修改', async () => {
   const root = await fixture(realEnv, exampleEnv.replace('API_URL=', 'API_URL=\nAPI_TOKEN='));
   await assert.rejects(invoke(root, '--write'), /variable names must remain consistent/);

package/.well-known/skills/wdyy-deployment-standard/scripts/validate-deployment-package.mjs

@@ -55,7 +55,7 @@ const envText = await readFile(join(packageRoot, '.env'), 'utf8');
 const env = parseDotenv(envText);
 const sections = [...envText.matchAll(/^# (前端|后端|数据库|API|部署)$/gm)].map((match) => match[1]);
 assert(sections.join('|') === '前端|后端|数据库|API|部署', 'Root .env must use the five standard sections in order');
-for (const key of ['FRONTEND_URL', 'FRONTEND_PORT', 'BACKEND_URL', 'BACKEND_PORT', 'API_PREFIX', 'VITE_API_BASE_URL', 'DB_URL', 'DB_PORT', 'DB_USER', 'DB_PASSWORD', 'DB_NAME', 'DB_SCHEMA', 'PROJECT_NAME', 'DOCKER_BIND_IP', 'DOCKER_PLATFORM', 'FRONTEND_BASE_IMAGE', 'BACKEND_BASE_IMAGE']) {
+for (const key of ['FRONTEND_URL', 'FRONTEND_PORT', 'BACKEND_URL', 'BACKEND_PORT', 'API_PREFIX', 'VITE_API_BASE_URL', 'DB_URL', 'DB_PORT', 'DB_USER', 'DB_PASSWORD', 'DB_NAME', 'DB_SCHEMA', 'PROJECT_NAME', 'DOCKER_BIND_IP', 'DOCKER_PLATFORM', 'FRONTEND_BASE_IMAGE', 'BACKEND_BASE_IMAGE', 'TZ']) {
   assert(env.get(key), `Root .env is missing ${key}`);
 }
 assert(/^[a-z][a-z0-9_]*$/.test(env.get('PROJECT_NAME')), 'Invalid PROJECT_NAME');
@@ -67,6 +67,7 @@ assert(env.get('FRONTEND_PORT') !== env.get('BACKEND_PORT'), 'Frontend and backe
 assert(/^[A-Za-z][A-Za-z0-9_-]*$/.test(env.get('API_PREFIX')), 'API_PREFIX must be one safe path segment');
 assert(env.get('VITE_API_BASE_URL') === `/${env.get('API_PREFIX')}`, 'VITE_API_BASE_URL must equal /API_PREFIX');
 assert(/^(?:linux\/amd64|linux\/arm64)$/.test(env.get('DOCKER_PLATFORM')), 'Invalid DOCKER_PLATFORM');
+assert(env.get('TZ') === 'Asia/Shanghai', 'Invalid TZ; expected Asia/Shanghai for CST (UTC+8)');
 for (const key of env.keys()) {
   assert(!['PROJECT_HTTP_PORT', 'FRONTEND_BLUE_PORT', 'FRONTEND_GREEN_PORT', 'BACKEND_BLUE_PORT', 'BACKEND_GREEN_PORT', 'SERVER_PROJECTS_ROOT', 'NGINX_SOURCE', 'LOG_DIR', 'HOST_LOG_DIR', 'FRONTEND_CONTAINER_PORT', 'BACKEND_CONTAINER_PORT', 'BACKEND_LISTEN_HOST', 'DATABASE_MIGRATION_MODE', 'MIGRATIONS_SOURCE', 'MIGRATION_RUNNER_SOURCE', 'RELEASE_VERSION'].includes(key) && !/_(?:HEALTH|VERSION)_URL$/.test(key), `Root .env contains removed configuration: ${key}`);
 }
@@ -85,6 +86,12 @@ for (const [pattern, message] of [
   [/docker save -o "\$package_root\/backend-image\.tar"/, 'Backend image must be exported separately'],
   [/env COPYFILE_DISABLE=1 tar --no-xattrs -czf "\$candidate"/, 'Delivery archive must exclude macOS metadata and extended attributes'],
   [/docker version --format '\{\{\.Server\.Os\}\}\/\{\{\.Server\.Arch\}\}'/, 'Deploy must read the Docker Server platform'],
+  [/Windows container mode is unsupported; switch Docker Desktop to Linux containers/, 'Deploy must reject Windows container mode explicitly'],
+  [/assert_stack_container_ownership/, 'Deploy must validate fixed container name ownership'],
+  [/assert_image_cst_time "\$frontend_image"/, 'Frontend built image CST time must be checked'],
+  [/assert_image_cst_time "\$backend_image"/, 'Backend built image CST time must be checked'],
+  [/assert_container_cst_time "\$\{PROJECT_NAME\}_frontend"/, 'Running frontend CST time must be checked'],
+  [/assert_container_cst_time "\$\{PROJECT_NAME\}_backend"/, 'Running backend CST time must be checked'],
   [/compose up -d --force-recreate --no-build --pull never --wait frontend backend/, 'Deploy must recreate and wait for both services without build or pull'],
   [/compose stop frontend backend/, 'Stop must target both services'],
   [/compose ps frontend backend/, 'Status must inspect both services'],
@@ -92,9 +99,17 @@ for (const [pattern, message] of [
 assert((deploy.match(/docker build --pull=false --platform "\$DOCKER_PLATFORM"/g) ?? []).length === 2, 'Exactly two Docker builds must use the configured target platform and disable pull');
 const deployStackIndex = deploy.indexOf('deploy_stack() {');
 const serverPlatformCheckIndex = deploy.indexOf('  assert_server_platform\n', deployStackIndex);
+const ownershipCheckIndex = deploy.indexOf('  assert_stack_container_ownership\n', deployStackIndex);
 const firstImageLoadIndex = deploy.indexOf('  docker load -i ', deployStackIndex);
-assert(deployStackIndex >= 0 && serverPlatformCheckIndex > deployStackIndex && firstImageLoadIndex > serverPlatformCheckIndex, 'Docker Server platform must be checked before loading images');
+const composeUpIndex = deploy.indexOf('  compose up -d --force-recreate --no-build --pull never --wait frontend backend', deployStackIndex);
+const runningTimeCheckIndex = deploy.indexOf('  assert_container_cst_time "${PROJECT_NAME}_frontend"', deployStackIndex);
+assert(deployStackIndex >= 0 && serverPlatformCheckIndex > deployStackIndex && ownershipCheckIndex > serverPlatformCheckIndex && firstImageLoadIndex > ownershipCheckIndex, 'Docker Server platform and container ownership must be checked before loading images');
+assert(composeUpIndex > firstImageLoadIndex && runningTimeCheckIndex > composeUpIndex, 'Running container CST time must be checked after Compose health wait');
+const frontendImageTimeIndex = deploy.indexOf('  assert_image_cst_time "$frontend_image"');
+const firstImageSaveIndex = deploy.indexOf('  docker save -o "$package_root/frontend-image.tar"');
+assert(frontendImageTimeIndex >= 0 && firstImageSaveIndex > frontendImageTimeIndex, 'Built image CST time must be checked before Docker save');
 assert(!/\bdocker\s+pull\b/.test(deploy), 'docker pull is forbidden');
+assert(!/\bdocker\s+(?:start|restart)\b/.test(deploy), 'Deployment script must not restart manually stopped containers outside explicit Compose deploy');
 assert(!/\bsource\s+[^\n]*\.env|\beval\b/.test(deploy), 'Environment files must be parsed as data');
 assert(!/server_menu|运行或替换|read_release_pointer|release_ledger|AGENTS\.md/.test(deploy), 'Legacy menu or release ledger logic is forbidden');
 assert(!/\bpsql\b|\b(?:scp|rsync)\b|\bgit\s+(?:pull|clone)\b/.test(deploy), 'Database, upload or source-pull commands are forbidden');
@@ -104,15 +119,19 @@ const serviceNames = [...compose.matchAll(/^  ([a-z][a-z0-9_-]*):$/gm)].map((mat
 assert(JSON.stringify(serviceNames) === JSON.stringify(['frontend', 'backend']), `Compose must define only frontend and backend; got ${serviceNames.join(', ')}`);
 assert(compose.includes('image: "${PROJECT_NAME:?PROJECT_NAME is required}_frontend:latest"'), 'Compose frontend image is not fixed');
 assert(compose.includes('image: "${PROJECT_NAME:?PROJECT_NAME is required}_backend:latest"'), 'Compose backend image is not fixed');
+assert(compose.includes('container_name: "${PROJECT_NAME:?PROJECT_NAME is required}_frontend"'), 'Compose frontend container name must equal its image repository');
+assert(compose.includes('container_name: "${PROJECT_NAME:?PROJECT_NAME is required}_backend"'), 'Compose backend container name must equal its image repository');
 assert((compose.match(/platform: "\$\{DOCKER_PLATFORM:\?DOCKER_PLATFORM is required\}"/g) ?? []).length === 2, 'Both services must use DOCKER_PLATFORM');
 assert((compose.match(/env_file: \.\/\.env/g) ?? []).length === 2, 'Both services must use root .env');
+assert((compose.match(/TZ: "\$\{TZ:\?TZ is required\}"/g) ?? []).length === 2, 'Both services must explicitly use the same required TZ');
+assert((compose.match(/restart: unless-stopped/g) ?? []).length === 2, 'Both services must use restart: unless-stopped');
 assert((compose.match(/^\s*- \.\/logs:\/app\/logs\s*$/gm) ?? []).length === 2, 'Both services must mount root logs');
 assert(compose.includes('"${DOCKER_BIND_IP}:${FRONTEND_PORT}:${FRONTEND_PORT}"'), 'Frontend port mapping is invalid');
 assert(compose.includes('"${DOCKER_BIND_IP}:${BACKEND_PORT}:${BACKEND_PORT}"'), 'Backend port mapping is invalid');
 assert(compose.includes('VITE_API_BASE_URL: "${VITE_API_BASE_URL:?VITE_API_BASE_URL is required}"'), 'Frontend API path is not passed to Nginx');
 assert(compose.includes('BACKEND_PORT: "${BACKEND_PORT:?BACKEND_PORT is required}"'), 'Backend port is not passed to Nginx');
 assert(compose.includes('NGINX_ENVSUBST_FILTER: "^(FRONTEND_URL|FRONTEND_PORT|VITE_API_BASE_URL|BACKEND_PORT)$"'), 'Nginx envsubst filter does not cover the runtime API proxy');
-assert(!/container_name:|\b(?:postgres|database|db):\s*$|postgres:\d|DATABASE_MIGRATION|MIGRATIONS_SOURCE|RELEASE_VERSION|blue|green/i.test(compose), 'Compose contains a database, migration, release or blue-green configuration');
+assert(!/\b(?:postgres|database|db):\s*$|postgres:\d|DATABASE_MIGRATION|MIGRATIONS_SOURCE|RELEASE_VERSION|blue|green/i.test(compose), 'Compose contains a database, migration, release or blue-green configuration');
 
 const manifestText = await readFile(join(packageRoot, 'manifest.sha256'), 'utf8');
 const manifestEntries = new Map();

package/.well-known/skills/wdyy-deployment-standard/scripts/validate-deployment-package.test.mjs

@@ -38,7 +38,8 @@ PROJECT_NAME=example_project
 DOCKER_BIND_IP=0.0.0.0
 DOCKER_PLATFORM=linux/amd64
 FRONTEND_BASE_IMAGE=nginx:stable
-BACKEND_BASE_IMAGE=node:24-alpine3.24
+BACKEND_BASE_IMAGE=node:24-bookworm-slim
+TZ=Asia/Shanghai
 `;
 const exampleText = `# 前端
 FRONTEND_URL=0.0.0.0
@@ -62,7 +63,8 @@ PROJECT_NAME=
 DOCKER_BIND_IP=
 DOCKER_PLATFORM=linux/amd64
 FRONTEND_BASE_IMAGE=nginx:stable
-BACKEND_BASE_IMAGE=node:24-alpine3.24
+BACKEND_BASE_IMAGE=node:24-bookworm-slim
+TZ=Asia/Shanghai
 `;
 
 const fakeDocker = `#!/usr/bin/env node
@@ -89,6 +91,30 @@ if (args[0] === 'build') {
   if (process.env.FAIL_BUILD && tag.includes(process.env.FAIL_BUILD)) process.exit(1);
   process.exit(0);
 }
+if (args[0] === 'run') {
+  const image = args[args.indexOf('-c') - 1];
+  if (process.env.FAIL_IMAGE_TIME && image.includes(process.env.FAIL_IMAGE_TIME)) process.exit(1);
+  process.stdout.write((process.env.IMAGE_TIME || '19 CST +0800') + '\\n');
+  process.exit(0);
+}
+if (args[0] === 'exec') {
+  const name = args[1];
+  if (process.env.FAIL_CONTAINER_TIME && name.includes(process.env.FAIL_CONTAINER_TIME)) process.exit(1);
+  process.stdout.write((process.env.CONTAINER_TIME || '19 CST +0800') + '\\n');
+  process.exit(0);
+}
+if (args[0] === 'container' && args[1] === 'ls') {
+  const filter = args[args.indexOf('--filter') + 1] || '';
+  const name = filter.replace('name=^/', '').replace('$$', '').replace('$', '');
+  if (process.env.EXISTING_CONTAINER_NAME === name) process.stdout.write(name + '\\n');
+  process.exit(0);
+}
+if (args[0] === 'container' && args[1] === 'inspect') {
+  const name = args[args.length - 1];
+  if (process.env.EXISTING_CONTAINER_NAME !== name) process.exit(1);
+  process.stdout.write((process.env.CONTAINER_PROJECT || '') + '|' + (process.env.CONTAINER_SERVICE || '') + '\\n');
+  process.exit(0);
+}
 if (args[0] === 'save') {
   const output = args[args.indexOf('-o') + 1];
   const tag = args[args.length - 1];
@@ -103,6 +129,9 @@ if (args[0] === 'save') {
 if (args[0] === 'compose' && args.includes('up') && process.env.FAIL_COMPOSE_UP === '1') process.exit(1);
 process.exit(0);
 `;
+const fakeUname = `#!/usr/bin/env node
+process.stdout.write((process.env.HOST_KERNEL || 'Linux') + '\\n');
+`;
 
 async function fixture() {
   const root = await mkdtemp(join(tmpdir(), 'wdyy-unified-delivery-'));
@@ -119,7 +148,9 @@ async function fixture() {
   const bin = join(root, 'fake-bin');
   await mkdir(bin);
   await writeFile(join(bin, 'docker'), fakeDocker, { mode: 0o755 });
+  await writeFile(join(bin, 'uname'), fakeUname, { mode: 0o755 });
   await chmod(join(bin, 'docker'), 0o755);
+  await chmod(join(bin, 'uname'), 0o755);
   const log = join(root, 'docker.log');
   const environment = { ...process.env, PATH: `${bin}:${process.env.PATH}`, DOCKER_LOG: log };
   return { root, log, environment, archive: join(root, 'deploy/example_project-docker.tar.gz') };
@@ -192,11 +223,17 @@ test('build 使用本地基础镜像并生成一个含双镜像归档的压缩
   assert.deepEqual((await readdir(extracted)).sort(), ['.env', 'backend-image.tar', 'deploy.sh', 'docker-compose.yml', 'frontend-image.tar', 'manifest.sha256'].sort());
   const validation = await run(process.execPath, [validator, extracted]);
   assert.match(validation.stdout, /valid unified Docker delivery package/);
+  const compose = await readFile(join(extracted, 'docker-compose.yml'), 'utf8');
+  assert.equal((compose.match(/TZ: "\$\{TZ:\?TZ is required\}"/g) ?? []).length, 2);
+  assert.match(compose, /container_name: "\$\{PROJECT_NAME:\?PROJECT_NAME is required\}_frontend"/);
+  assert.match(compose, /container_name: "\$\{PROJECT_NAME:\?PROJECT_NAME is required\}_backend"/);
+  assert.equal((compose.match(/restart: unless-stopped/g) ?? []).length, 2);
   const log = await readFile(item.log, 'utf8');
   assert.match(log, /image inspect nginx:stable/);
-  assert.match(log, /image inspect node:24-alpine3\.24/);
+  assert.match(log, /image inspect node:24-bookworm-slim/);
   assert.equal((log.match(/build --pull=false --platform linux\/amd64/g) ?? []).length, 2);
   assert.match(log, /build --pull=false --platform linux\/amd64 .*--build-arg VITE_API_BASE_URL=\/api .*example_project_frontend:latest/);
+  assert.equal((log.match(/^run --rm --pull=never --platform linux\/amd64 /gm) ?? []).length, 2);
   assert.doesNotMatch(log, /(^|\s)pull(\s|$)/m);
   assert.match(log, /save -o .*frontend-image\.tar example_project_frontend:latest/);
   assert.match(log, /save -o .*backend-image\.tar example_project_backend:latest/);
@@ -210,10 +247,10 @@ test('基础镜像平台不匹配时在 build 前失败', async () => {
   assert.equal((await readdir(join(item.root, 'deploy'))).length, 0);
 });
 
-test('linux/arm64 目标在不同构建机平台上生成并部署单架构交付包', async () => {
+test('macOS arm64 与 Windows WSL2 使用 Linux engine 生成并部署单架构交付包', async () => {
   const item = await fixture();
   await setTargetPlatform(item.root, 'linux/arm64');
-  await buildProject(item, { IMAGE_PLATFORM: 'linux/arm64' });
+  await buildProject(item, { HOST_KERNEL: 'Darwin', IMAGE_PLATFORM: 'linux/arm64' });
   const buildLog = await readFile(item.log, 'utf8');
   assert.equal((buildLog.match(/build --pull=false --platform linux\/arm64/g) ?? []).length, 2);
   const extracted = await extractArchive(item);
@@ -222,10 +259,17 @@ test('linux/arm64 目标在不同构建机平台上生成并部署单架构交
   const validation = await run(process.execPath, [validator, extracted]);
   assert.match(validation.stdout, /valid unified Docker delivery package/);
   await writeFile(item.log, '');
-  await run(join(extracted, 'deploy.sh'), [], { env: { ...item.environment, IMAGE_PLATFORM: 'linux/arm64', SERVER_PLATFORM: 'linux/arm64' } });
+  await run(join(extracted, 'deploy.sh'), [], { env: { ...item.environment, HOST_KERNEL: 'Linux', WSL_DISTRO_NAME: 'Ubuntu', IMAGE_PLATFORM: 'linux/arm64', SERVER_PLATFORM: 'linux/arm64' } });
   const deployLog = await readFile(item.log, 'utf8');
   assert.match(deployLog, /^version --format \{\{\.Server\.Os\}\}\/\{\{\.Server\.Arch\}\}$/m);
   assert.equal((deployLog.match(/^load -i /gm) ?? []).length, 2);
+  assert.equal((deployLog.match(/^exec example_project_(?:frontend|backend) /gm) ?? []).length, 2);
+});
+
+test('原生 Windows shell 在任何 Docker 操作前被拒绝', async () => {
+  const item = await fixture();
+  await assert.rejects(buildProject(item, { HOST_KERNEL: 'Windows_NT' }), /unsupported execution host: Windows_NT/);
+  await assert.rejects(stat(item.log), { code: 'ENOENT' });
 });
 
 test('缺少本地基础镜像时在 build 前失败', async () => {
@@ -247,6 +291,20 @@ test('构建失败保留上一份成功交付包且不暴露半成品', async ()
   assert.deepEqual(await readdir(join(item.root, 'deploy')), ['example_project-docker.tar.gz']);
 });
 
+test('镜像时间探测失败时保留上一份成功交付包', async () => {
+  const item = await fixture();
+  await buildProject(item);
+  const before = createHash('sha256').update(await readFile(item.archive)).digest('hex');
+  await assert.rejects(buildProject(item, { FAIL_IMAGE_TIME: 'frontend' }), /unable to verify image CST time: example_project_frontend:latest/);
+  const after = createHash('sha256').update(await readFile(item.archive)).digest('hex');
+  assert.equal(after, before);
+  const log = await readFile(item.log, 'utf8');
+  const lastSave = log.lastIndexOf('save -o ');
+  const lastRun = log.lastIndexOf('run --rm --pull=never');
+  assert(lastRun > lastSave);
+  assert.doesNotMatch(log.slice(lastRun), /^save -o /m);
+});
+
 test('服务器无参数执行时从脚本目录整体加载并部署前后端', async () => {
   const item = await fixture();
   await buildProject(item);
@@ -256,10 +314,12 @@ test('服务器无参数执行时从脚本目录整体加载并部署前后端',
   const log = await readFile(item.log, 'utf8');
   const versionIndex = log.indexOf('version --format {{.Server.Os}}/{{.Server.Arch}}');
   const firstLoadIndex = log.indexOf('load -i ');
-  assert(versionIndex >= 0 && firstLoadIndex > versionIndex);
+  const ownershipIndex = log.indexOf('container ls --all --filter name=^/example_project_frontend$');
+  assert(versionIndex >= 0 && ownershipIndex > versionIndex && firstLoadIndex > ownershipIndex);
   assert.equal((log.match(/^load -i /gm) ?? []).length, 2);
   assert.match(log, /compose --env-file .* --project-name example_project -f .* up -d --force-recreate --no-build --pull never --wait frontend backend/);
-  assert.match(await readFile(join(extracted, 'logs/deploy.log'), 'utf8'), /operation=deploy result=success/);
+  assert.equal((log.match(/^exec example_project_(?:frontend|backend) /gm) ?? []).length, 2);
+  assert.match(await readFile(join(extracted, 'logs/deploy.log'), 'utf8'), /CST \+0800 operation=deploy result=success/);
 });
 
 test('服务器平台无法读取、不受支持或不匹配时在加载镜像前失败', async () => {
@@ -267,7 +327,7 @@ test('服务器平台无法读取、不受支持或不匹配时在加载镜像
   await buildProject(item);
   const cases = [
     [{ FAIL_SERVER_PLATFORM_READ: '1' }, /Docker Server platform is unavailable/],
-    [{ SERVER_PLATFORM: 'windows/amd64' }, /unsupported Docker Server platform: windows\/amd64/],
+    [{ SERVER_PLATFORM: 'windows/amd64' }, /Windows container mode is unsupported; switch Docker Desktop to Linux containers/],
     [{ SERVER_PLATFORM: 'linux/arm64' }, /Docker Server platform mismatch: expected linux\/amd64, got linux\/arm64/],
   ];
   for (const [extraEnvironment, expectedError] of cases) {
@@ -282,6 +342,26 @@ test('服务器平台无法读取、不受支持或不匹配时在加载镜像
   }
 });
 
+test('固定容器名冲突在镜像加载前失败，当前项目所有权允许继续', async () => {
+  const item = await fixture();
+  await buildProject(item);
+  const conflictPackage = await extractArchive(item);
+  await writeFile(item.log, '');
+  await assert.rejects(run(join(conflictPackage, 'deploy.sh'), [], {
+    env: { ...item.environment, EXISTING_CONTAINER_NAME: 'example_project_frontend', CONTAINER_PROJECT: 'other_project', CONTAINER_SERVICE: 'frontend' }
+  }), /container name conflict: example_project_frontend belongs to other_project\|frontend/);
+  const conflictLog = await readFile(item.log, 'utf8');
+  assert.match(conflictLog, /^container inspect .*example_project_frontend$/m);
+  assert.doesNotMatch(conflictLog, /^load -i /m);
+
+  const ownedPackage = await extractArchive(item);
+  await writeFile(item.log, '');
+  await run(join(ownedPackage, 'deploy.sh'), [], {
+    env: { ...item.environment, EXISTING_CONTAINER_NAME: 'example_project_frontend', CONTAINER_PROJECT: 'example_project', CONTAINER_SERVICE: 'frontend' }
+  });
+  assert.equal(((await readFile(item.log, 'utf8')).match(/^load -i /gm) ?? []).length, 2);
+});
+
 test('服务器在 Docker 操作前拒绝 AppleDouble 和上传压缩包残留', async () => {
   const item = await fixture();
   await buildProject(item);
@@ -306,6 +386,7 @@ test('stop 与 status 始终作用于完整项目栈，非法参数不触发 Doc
   const beforeInvalid = await readFile(item.log, 'utf8');
   assert.match(beforeInvalid, /stop frontend backend/);
   assert.match(beforeInvalid, /ps frontend backend/);
+  assert.doesNotMatch(beforeInvalid, /^\s*(?:start|restart)\b|^compose .* up /m);
   await assert.rejects(run(join(extracted, 'deploy.sh'), ['frontend'], { env: item.environment }), /usage:/);
   assert.equal(await readFile(item.log, 'utf8'), beforeInvalid);
   assert.match(await readFile(join(extracted, 'logs/deploy.log'), 'utf8'), /operation=stop result=success/);
@@ -319,6 +400,19 @@ test('整栈健康等待失败返回非零并记录失败', async () => {
   assert.match(await readFile(join(extracted, 'logs/deploy.log'), 'utf8'), /operation=deploy result=failure/);
 });
 
+test('运行容器时间探测失败在健康等待后明确失败并记录容器', async () => {
+  const item = await fixture();
+  await buildProject(item);
+  const extracted = await extractArchive(item);
+  await writeFile(item.log, '');
+  await assert.rejects(run(join(extracted, 'deploy.sh'), [], { env: { ...item.environment, FAIL_CONTAINER_TIME: 'backend' } }), /unable to verify running container CST time: example_project_backend/);
+  const log = await readFile(item.log, 'utf8');
+  const composeIndex = log.indexOf(' up -d --force-recreate');
+  const execIndex = log.indexOf('exec example_project_backend');
+  assert(composeIndex >= 0 && execIndex > composeIndex);
+  assert.match(await readFile(join(extracted, 'logs/deploy.log'), 'utf8'), /operation=deploy result=failure/);
+});
+
 test('validator 拒绝数据库容器和不完整远程数据库配置', async () => {
   const item = await fixture();
   await buildProject(item);
@@ -333,6 +427,56 @@ test('validator 拒绝数据库容器和不完整远程数据库配置', async (
   await assert.rejects(run(process.execPath, [validator, envPackage]), /Root \.env is missing DB_URL/);
 });
 
+test('缺失或非 Asia/Shanghai TZ 在 Docker 状态变化前被拒绝', async () => {
+  const item = await fixture();
+  const environmentPath = join(item.root, '.env');
+  await writeFile(environmentPath, envText.replace('TZ=Asia/Shanghai', 'TZ=../Shanghai'), { mode: 0o600 });
+  await assert.rejects(buildProject(item), /TZ must equal Asia\/Shanghai for CST \(UTC\+8\)/);
+  await assert.rejects(stat(item.log), { code: 'ENOENT' });
+
+  await writeFile(environmentPath, envText, { mode: 0o600 });
+  await buildProject(item);
+
+  const missingPackage = await extractArchive(item);
+  await writeFile(join(missingPackage, '.env'), envText.replace('TZ=Asia/Shanghai\n', ''), { mode: 0o600 });
+  await rewriteManifest(missingPackage);
+  await assert.rejects(run(process.execPath, [validator, missingPackage]), /Root \.env is missing TZ/);
+
+  const invalidPackage = await extractArchive(item);
+  await writeFile(join(invalidPackage, '.env'), envText.replace('TZ=Asia/Shanghai', 'TZ=UTC'), { mode: 0o600 });
+  await rewriteManifest(invalidPackage);
+  await assert.rejects(run(process.execPath, [validator, invalidPackage]), /Invalid TZ; expected Asia\/Shanghai/);
+
+  const composePackage = await extractArchive(item);
+  const compose = await readFile(join(composePackage, 'docker-compose.yml'), 'utf8');
+  await writeFile(join(composePackage, 'docker-compose.yml'), compose.replace('      TZ: "${TZ:?TZ is required}"\n', ''));
+  await rewriteManifest(composePackage);
+  await assert.rejects(run(process.execPath, [validator, composePackage]), /Both services must explicitly use the same required TZ/);
+});
+
+test('validator 拒绝容器名、重启策略或端口单一来源被破坏', async () => {
+  const item = await fixture();
+  await buildProject(item);
+
+  const namePackage = await extractArchive(item);
+  let compose = await readFile(join(namePackage, 'docker-compose.yml'), 'utf8');
+  await writeFile(join(namePackage, 'docker-compose.yml'), compose.replace('container_name: "${PROJECT_NAME:?PROJECT_NAME is required}_frontend"', 'container_name: unrelated_frontend'));
+  await rewriteManifest(namePackage);
+  await assert.rejects(run(process.execPath, [validator, namePackage]), /frontend container name must equal its image repository/);
+
+  const restartPackage = await extractArchive(item);
+  compose = await readFile(join(restartPackage, 'docker-compose.yml'), 'utf8');
+  await writeFile(join(restartPackage, 'docker-compose.yml'), compose.replace('restart: unless-stopped', 'restart: always'));
+  await rewriteManifest(restartPackage);
+  await assert.rejects(run(process.execPath, [validator, restartPackage]), /Both services must use restart: unless-stopped/);
+
+  const portPackage = await extractArchive(item);
+  compose = await readFile(join(portPackage, 'docker-compose.yml'), 'utf8');
+  await writeFile(join(portPackage, 'docker-compose.yml'), compose.replace('${DOCKER_BIND_IP}:${FRONTEND_PORT}:${FRONTEND_PORT}', '${DOCKER_BIND_IP}:${FRONTEND_PORT}:80'));
+  await rewriteManifest(portPackage);
+  await assert.rejects(run(process.execPath, [validator, portPackage]), /Frontend port mapping is invalid/);
+});
+
 test('validator 拒绝冲突的 API 路径和缺失的代理注入', async () => {
   const item = await fixture();
   await buildProject(item);

package/.well-known/skills/wdyy-deployment-standard/templates/deploy.sh.template

@@ -53,16 +53,28 @@ validate_env_permissions() {
   [[ "$mode" == 400 || "$mode" == 600 ]] || fail "root .env permissions must be 400 or 600; got $mode"
 }
 
+assert_execution_host() {
+  local kernel
+  kernel="$(uname -s 2>/dev/null)" || fail "execution host OS is unavailable"
+  case "$kernel" in
+    Darwin|Linux) ;;
+    *) fail "unsupported execution host: $kernel; use Linux, macOS, or Windows Docker Desktop through WSL2" ;;
+  esac
+  if [[ "$kernel" == Linux ]] && { [[ -n "${WSL_DISTRO_NAME:-}" ]] || grep -qi microsoft /proc/sys/kernel/osrelease 2>/dev/null; }; then
+    [[ ! "$SCRIPT_DIR" =~ ^/mnt/[A-Za-z](/|$) ]] || fail "Windows Docker Desktop execution must use the WSL2 Linux filesystem, not $SCRIPT_DIR"
+  fi
+}
+
 reset_configuration() {
   unset FRONTEND_URL FRONTEND_PORT BACKEND_URL BACKEND_PORT
   unset API_PREFIX VITE_API_BASE_URL
   unset DB_URL DB_PORT DB_USER DB_PASSWORD DB_NAME DB_SCHEMA
-  unset PROJECT_NAME DOCKER_BIND_IP DOCKER_PLATFORM FRONTEND_BASE_IMAGE BACKEND_BASE_IMAGE
+  unset PROJECT_NAME DOCKER_BIND_IP DOCKER_PLATFORM FRONTEND_BASE_IMAGE BACKEND_BASE_IMAGE TZ
 }
 
 is_configuration_key() {
   case "$1" in
-    FRONTEND_URL|FRONTEND_PORT|BACKEND_URL|BACKEND_PORT|API_PREFIX|VITE_API_BASE_URL|DB_URL|DB_PORT|DB_USER|DB_PASSWORD|DB_NAME|DB_SCHEMA|PROJECT_NAME|DOCKER_BIND_IP|DOCKER_PLATFORM|FRONTEND_BASE_IMAGE|BACKEND_BASE_IMAGE)
+    FRONTEND_URL|FRONTEND_PORT|BACKEND_URL|BACKEND_PORT|API_PREFIX|VITE_API_BASE_URL|DB_URL|DB_PORT|DB_USER|DB_PASSWORD|DB_NAME|DB_SCHEMA|PROJECT_NAME|DOCKER_BIND_IP|DOCKER_PLATFORM|FRONTEND_BASE_IMAGE|BACKEND_BASE_IMAGE|TZ)
       return 0 ;;
     *) return 1 ;;
   esac
@@ -106,7 +118,7 @@ load_dotenv() {
 
 validate_configuration() {
   local key value
-  for key in FRONTEND_URL FRONTEND_PORT BACKEND_URL BACKEND_PORT API_PREFIX VITE_API_BASE_URL DB_URL DB_PORT DB_USER DB_PASSWORD DB_NAME DB_SCHEMA PROJECT_NAME DOCKER_BIND_IP DOCKER_PLATFORM FRONTEND_BASE_IMAGE BACKEND_BASE_IMAGE; do
+  for key in FRONTEND_URL FRONTEND_PORT BACKEND_URL BACKEND_PORT API_PREFIX VITE_API_BASE_URL DB_URL DB_PORT DB_USER DB_PASSWORD DB_NAME DB_SCHEMA PROJECT_NAME DOCKER_BIND_IP DOCKER_PLATFORM FRONTEND_BASE_IMAGE BACKEND_BASE_IMAGE TZ; do
     value="${!key:-}"
     [[ -n "$value" ]] || fail "required configuration is missing: $key"
   done
@@ -120,6 +132,7 @@ validate_configuration() {
   [[ "$DB_URL" =~ ^[A-Za-z0-9._:/?@\&=%-]+$ ]] || fail "DB_URL contains unsafe characters"
   [[ "$FRONTEND_BASE_IMAGE" =~ ^[A-Za-z0-9._/:@-]+$ ]] || fail "FRONTEND_BASE_IMAGE is not a valid image reference"
   [[ "$BACKEND_BASE_IMAGE" =~ ^[A-Za-z0-9._/:@-]+$ ]] || fail "BACKEND_BASE_IMAGE is not a valid image reference"
+  [[ "$TZ" == Asia/Shanghai ]] || fail "TZ must equal Asia/Shanghai for CST (UTC+8)"
   assert_port FRONTEND_PORT "$FRONTEND_PORT"
   assert_port BACKEND_PORT "$BACKEND_PORT"
   assert_port DB_PORT "$DB_PORT"
@@ -136,10 +149,43 @@ assert_server_platform() {
   local actual
   actual="$(docker version --format '{{.Server.Os}}/{{.Server.Arch}}' 2>/dev/null)" || fail "Docker Server platform is unavailable"
   [[ -n "$actual" ]] || fail "Docker Server platform is empty"
+  [[ "$actual" != windows/* ]] || fail "Windows container mode is unsupported; switch Docker Desktop to Linux containers"
   [[ "$actual" =~ ^linux/(amd64|arm64)$ ]] || fail "unsupported Docker Server platform: $actual"
   [[ "$actual" == "$DOCKER_PLATFORM" ]] || fail "Docker Server platform mismatch: expected $DOCKER_PLATFORM, got $actual"
 }
 
+assert_container_ownership() {
+  local name="$1" expected_service="$2" matches ownership
+  matches="$(docker container ls --all --filter "name=^/${name}$" --format '{{.Names}}' 2>/dev/null)" || fail "unable to inspect existing container name: $name"
+  [[ -n "$matches" ]] || return 0
+  [[ "$matches" == "$name" ]] || fail "container name lookup returned unexpected results for $name: $matches"
+  ownership="$(docker container inspect --format '{{ index .Config.Labels "com.docker.compose.project" }}|{{ index .Config.Labels "com.docker.compose.service" }}' "$name" 2>/dev/null)" || fail "unable to inspect container ownership: $name"
+  [[ "$ownership" == "$PROJECT_NAME|$expected_service" ]] || fail "container name conflict: $name belongs to ${ownership:-unknown}; expected $PROJECT_NAME|$expected_service"
+}
+
+assert_stack_container_ownership() {
+  assert_container_ownership "${PROJECT_NAME}_frontend" frontend
+  assert_container_ownership "${PROJECT_NAME}_backend" backend
+}
+
+assert_cst_time_value() {
+  local label="$1" actual="$2"
+  actual="${actual%$'\r'}"
+  [[ "$actual" =~ ^([01][0-9]|2[0-3])[[:space:]]CST[[:space:]]\+0800$ ]] || fail "$label time must use 24-hour CST +0800; got ${actual:-empty}"
+}
+
+assert_image_cst_time() {
+  local image="$1" actual
+  actual="$(docker run --rm --pull=never --platform "$DOCKER_PLATFORM" --entrypoint sh --env TZ=Asia/Shanghai "$image" -c 'LC_ALL=C date "+%H %Z %z"' 2>/dev/null)" || fail "unable to verify image CST time: $image"
+  assert_cst_time_value "image $image" "$actual"
+}
+
+assert_container_cst_time() {
+  local name="$1" actual
+  actual="$(docker exec "$name" sh -c 'LC_ALL=C date "+%H %Z %z"' 2>/dev/null)" || fail "unable to verify running container CST time: $name"
+  assert_cst_time_value "container $name" "$actual"
+}
+
 validate_dockerignore() {
   local file="$1" pattern line
   [[ -f "$file" && ! -L "$file" ]] || fail "required Docker ignore file is missing: $file"
@@ -224,8 +270,9 @@ ensure_deploy_output_scope() {
 build_release() {
   local project_root="$SCRIPT_DIR" frontend_dockerfile backend_dockerfile compose_source dockerignore_file
   local frontend_image backend_image package_root deploy_dir archive_name candidate
-  for command in docker tar install find sort grep sed awk mktemp; do require_command "$command"; done
+  for command in docker tar install find sort grep sed awk mktemp uname; do require_command "$command"; done
   select_checksum_tool
+  assert_execution_host
   load_dotenv "$project_root/.env"
   validate_configuration
   frontend_dockerfile="$project_root/src/frontend/Dockerfile"
@@ -250,6 +297,8 @@ build_release() {
   docker image inspect "$backend_image" >/dev/null 2>&1 || fail "backend image build did not create $backend_image"
   assert_image_platform "$frontend_image"
   assert_image_platform "$backend_image"
+  assert_image_cst_time "$frontend_image"
+  assert_image_cst_time "$backend_image"
   STAGING_ROOT="$(mktemp -d "$project_root/.deploy-build.XXXXXX")"
   package_root="$STAGING_ROOT/package"
   mkdir -p "$package_root"
@@ -280,8 +329,9 @@ build_release() {
 
 initialize_server_context() {
   DEPLOY_ROOT="$SCRIPT_DIR"
-  for command in docker tar find sort grep sed awk; do require_command "$command"; done
+  for command in docker tar find sort grep sed awk uname; do require_command "$command"; done
   select_checksum_tool
+  assert_execution_host
   load_dotenv "$DEPLOY_ROOT/.env"
   validate_configuration
   [[ -f "$DEPLOY_ROOT/docker-compose.yml" && ! -L "$DEPLOY_ROOT/docker-compose.yml" ]] || fail "docker-compose.yml is missing"
@@ -295,7 +345,7 @@ compose() {
 record_operation() {
   local result="$1" timestamp
   [[ -n "$DEPLOY_ROOT" && -d "$DEPLOY_ROOT/logs" && -n "$OPERATION" ]] || return 0
-  timestamp="$(date '+%Y-%m-%d %H:%M:%S %z')"
+  timestamp="$(TZ=Asia/Shanghai LC_ALL=C date '+%Y-%m-%d %H:%M:%S %Z %z')"
   printf '%s operation=%s result=%s\n' "$timestamp" "$OPERATION" "$result" >> "$DEPLOY_ROOT/logs/deploy.log"
 }
 
@@ -306,6 +356,7 @@ deploy_stack() {
   archive_has_tag "$DEPLOY_ROOT/frontend-image.tar" "$frontend_image"
   archive_has_tag "$DEPLOY_ROOT/backend-image.tar" "$backend_image"
   assert_server_platform
+  assert_stack_container_ownership
   docker load -i "$DEPLOY_ROOT/frontend-image.tar" >/dev/null
   docker load -i "$DEPLOY_ROOT/backend-image.tar" >/dev/null
   assert_image_platform "${PROJECT_NAME}_frontend:latest"
@@ -313,6 +364,8 @@ deploy_stack() {
   docker image inspect "$frontend_image" >/dev/null 2>&1 || fail "loaded frontend image is missing: $frontend_image"
   docker image inspect "$backend_image" >/dev/null 2>&1 || fail "loaded backend image is missing: $backend_image"
   compose up -d --force-recreate --no-build --pull never --wait frontend backend
+  assert_container_cst_time "${PROJECT_NAME}_frontend"
+  assert_container_cst_time "${PROJECT_NAME}_backend"
 }
 
 run_logged_operation() {
@@ -332,6 +385,8 @@ server_deploy() {
 
 server_stop() {
   initialize_server_context
+  assert_server_platform
+  assert_stack_container_ownership
   run_logged_operation stop compose stop frontend backend
 }
 

package/.well-known/skills/wdyy-deployment-standard/templates/docker-compose.yml

@@ -1,12 +1,14 @@
 services:
   frontend:
     image: "${PROJECT_NAME:?PROJECT_NAME is required}_frontend:latest"
+    container_name: "${PROJECT_NAME:?PROJECT_NAME is required}_frontend"
     platform: "${DOCKER_PLATFORM:?DOCKER_PLATFORM is required}"
     env_file: ./.env
     environment:
       NGINX_ENVSUBST_FILTER: "^(FRONTEND_URL|FRONTEND_PORT|VITE_API_BASE_URL|BACKEND_PORT)$"
       VITE_API_BASE_URL: "${VITE_API_BASE_URL:?VITE_API_BASE_URL is required}"
       BACKEND_PORT: "${BACKEND_PORT:?BACKEND_PORT is required}"
+      TZ: "${TZ:?TZ is required}"
     ports:
       - "${DOCKER_BIND_IP}:${FRONTEND_PORT}:${FRONTEND_PORT}"
     volumes:
@@ -23,11 +25,13 @@ services:
 
   backend:
     image: "${PROJECT_NAME:?PROJECT_NAME is required}_backend:latest"
+    container_name: "${PROJECT_NAME:?PROJECT_NAME is required}_backend"
     platform: "${DOCKER_PLATFORM:?DOCKER_PLATFORM is required}"
     env_file: ./.env
     environment:
       HOST: "${BACKEND_URL}"
       PORT: "${BACKEND_PORT}"
+      TZ: "${TZ:?TZ is required}"
     ports:
       - "${DOCKER_BIND_IP}:${BACKEND_PORT}:${BACKEND_PORT}"
     volumes:

package/.well-known/skills/wdyy-deployment-standard/templates/env.example.template

@@ -4,4 +4,5 @@ PROJECT_NAME=
 DOCKER_BIND_IP=
 DOCKER_PLATFORM=linux/amd64
 FRONTEND_BASE_IMAGE=nginx:stable
-BACKEND_BASE_IMAGE=node:24-alpine3.24
+BACKEND_BASE_IMAGE=node:24-bookworm-slim
+TZ=Asia/Shanghai

package/README.md

@@ -18,7 +18,7 @@ OpenSpec                           单项变更的需求、设计、任务、实
 | `wdyy-api-standard` | 根据“获取XX数据”“使用XX接口”等需求定位接口 reference，并按已确认契约写入调用方式。 |
 | `wdyy-bug-record` | 手动汇总当前任务已解决的问题，并按模板追加至 `docs/bug_record.md`。 |
 | `wdyy-logging-standard` | 结构化日志、敏感字段移除、traceId、前端异常上报与日志轮转。 |
-| `wdyy-deployment-standard` | 使用本地基础镜像构建前后端独立镜像，分别导出并统一压缩交付，远程数据库直连，服务器一键部署整个项目栈。 |
+| `wdyy-deployment-standard` | 在 Linux、macOS Docker Desktop 或 Windows Docker Desktop + WSL2/Linux 容器模式中，使用本地基础镜像构建前后端独立镜像，分别导出并统一压缩交付，远程数据库直连并一键部署整个项目栈。 |
 
 ## 使用方式
 
@@ -43,7 +43,7 @@ wdyy update-skill --all
 
 `wdyy update-skill <skill-name>` 只接受 5 个受管理的 `wdyy-*` Skill，且仅替换系统用户目录 `.agents/skills/` 中的指定目录；`--all` 替换全部 5 个受管理 Skill。两种方式都不会写入调用项目的 `AGENTS.md`、`AGENTS_new.md`、`docs/bug_record.md` 或 `.agents/skills/`，也不会执行 `openspec init`。首次初始化或需要重新生成项目规则时，使用 `wdyy init`。
 
-部署 Skill 生成的标准流程为：在本地项目根目录执行 `./deploy.sh build`，只使用本地已有的 Node、Nginx 基础镜像构建 `<项目名>_frontend:latest` 与 `<项目名>_backend:latest`，分别导出两个镜像 tar，并统一封装为 `deploy/<项目名>-docker.tar.gz`。工程师人工上传并解压该压缩包，服务器无参数执行 `./deploy.sh` 即校验、加载并整体部署前后端；另可执行 `./deploy.sh stop` 和 `./deploy.sh status`。数据库通过 `.env` 直连远程 PostgreSQL，不生成数据库容器；前后端直接暴露 `.env` 中的宿主机端口，日志直接保存在服务器部署根 `logs/`。
+部署 Skill 生成的标准流程为：在 Linux、macOS Docker Desktop，或 Windows Docker Desktop + WSL2/Linux 文件系统的项目根目录执行 `./deploy.sh build`，只使用本地已有的 Node、Nginx 基础镜像构建 `<项目名>_frontend:latest` 与 `<项目名>_backend:latest`，分别导出两个镜像 tar，并统一封装为 `deploy/<项目名>-docker.tar.gz`。工程师人工复制并解压该压缩包，在平台匹配的 Linux engine 上无参数执行 `./deploy.sh` 即校验、加载并整体部署前后端；另可执行 `./deploy.sh stop` 和 `./deploy.sh status`。数据库通过 `.env` 直连远程 PostgreSQL，不生成数据库容器；前后端的宿主机与容器端口都来自 `.env`，容器名与镜像 repository 相同，使用 `unless-stopped`，并验证 24 小时制 CST（UTC+8）；日志直接保存在部署根 `logs/`。不支持原生 PowerShell 或 Windows 容器模式。
 
 中大型变更先使用 `/opsx:explore` 或 `/opsx:propose <change-name>`，在方案确认后使用 `/opsx:apply`；完成验证后使用 `/opsx:archive`。涉及数据库、内部 API、日志、部署时，按 `AGENTS.md` 的路由加载相应企业 Skill。所有 URL、端口和 IP 地址从 `.env` 读取，不得硬编码；所有项目管理的日志直接写入项目根目录 `logs/`；生产部署不使用蓝绿发布。不得提交秘密或生产环境 `.env`。项目完成后创建 `README.md`，说明技术栈、目录结构和安装部署。
 

package/lib/wdyy-cli.js

@@ -82,7 +82,7 @@ const generatedAgentsContent = `# 企业开发规则
 | 获取已登记接口数据、使用已登记接口 | \`wdyy-api-standard\` |
 | 汇总当前任务已解决的 BUG、漏洞或运行异常 | 手动调用 \`wdyy-bug-record\`，追加写入 \`docs/bug_record.md\` |
 | 结构化日志、traceId、完整原始入参、前端异常上报 | \`wdyy-logging-standard\` |
-| 统一 Docker 交付、本地双镜像、远程数据库与整栈一键部署 | \`wdyy-deployment-standard\` |
+| 统一 Docker 交付、Linux/Mac/Windows WSL2 双镜像、远程数据库与整栈一键部署 | \`wdyy-deployment-standard\` |
 
 ## 通用边界
 
@@ -90,7 +90,7 @@ const generatedAgentsContent = `# 企业开发规则
 - 代码、配置、迁移、测试与部署文件必须以实际实现为准；不得用模板虚构已实现能力。
 - 所有需求（如数据库变更、流程变更、功能变更、从零开发项目等），必须先使用\`openspec-explore\`技能确认需求，再根据实际情况，使用\`openspec\`的其它技能。
 - 所有项目管理的日志必须直接写入项目根目录 \`logs/\`，不得通过环境变量改写目录或创建服务、实例、日期等日志子目录。
-- 生产部署必须使用 \`wdyy-deployment-standard\`：本地只使用已有基础镜像构建前后端两个独立镜像，分别导出后封装为一个压缩包；数据库直连远程实例且不得使用数据库容器；服务器解压后无参数执行 \`./deploy.sh\`，一次性部署整个前后端项目栈。禁止自动拉取镜像、交互菜单和单独操作一个服务。
+- 生产部署必须使用 \`wdyy-deployment-standard\`：在 Linux、macOS Docker Desktop 或 Windows Docker Desktop + WSL2/Linux 容器模式中，只使用已有基础镜像构建前后端两个独立 Linux 镜像，分别导出后封装为一个压缩包；数据库直连远程实例且不得使用数据库容器；解压后无参数执行 \`./deploy.sh\`，一次性部署整个前后端项目栈。禁止原生 PowerShell、Windows 容器模式、自动拉取镜像、交互菜单和单独操作一个服务。
 - 不得静默吞错、跳过验证、以兜底逻辑掩盖未决问题。
 `;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wdyy/skills",
-  "version": "0.1.14",
+  "version": "0.1.15",
   "description": "企业内部开发 Skill 与项目初始化命令",
   "type": "module",
   "bin": {