@wdyy/skills 0.1.5 → 0.1.7

package/.well-known/skills/wdyy-deployment-standard/scripts/validate-deployment-package.test.mjs

@@ -1,72 +1,569 @@
 import assert from 'node:assert/strict';
-import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import {
+  access, chmod, cp, copyFile, mkdir, mkdtemp, readFile, readdir, rm, stat, symlink, unlink, writeFile,
+} from 'node:fs/promises';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { afterEach, test } from 'node:test';
 import { spawnSync } from 'node:child_process';
 
-const validator = new URL('./validate-deployment-package.mjs', import.meta.url);
+const scriptsRoot = dirname(fileURLToPath(import.meta.url));
+const skillRoot = resolve(scriptsRoot, '..');
+const templatesRoot = join(skillRoot, 'templates');
+const validator = join(scriptsRoot, 'validate-deployment-package.mjs');
+const deployTemplate = join(templatesRoot, 'deploy.sh.template');
+const composeTemplate = join(templatesRoot, 'docker-compose.blue-green.yml');
+const nginxTemplate = join(templatesRoot, 'nginx-upstream.template.conf');
+const dockerignoreTemplate = join(templatesRoot, 'dockerignore.template');
+const frontendDockerfileTemplate = join(templatesRoot, 'frontend.Dockerfile.template');
+const backendDockerfileTemplate = join(templatesRoot, 'Dockerfile.template');
+const frontendNginxTemplate = join(templatesRoot, 'frontend-container.conf.template');
 const temporaryDirectories = [];
 
 afterEach(async () => {
-  await Promise.all(
-    temporaryDirectories.splice(0).map((directory) =>
-      rm(directory, { force: true, recursive: true }),
-    ),
-  );
+  await Promise.all(temporaryDirectories.splice(0).map((path) => rm(path, { recursive: true, force: true })));
 });
 
-async function createFiles({ includeRollback = true } = {}) {
-  const directory = await mkdtemp(join(tmpdir(), 'deployment-package-'));
-  temporaryDirectories.push(directory);
-  const deploy = join(directory, 'deploy.sh');
-  const nginx = join(directory, 'nginx.conf');
-  const compose = join(directory, 'compose.yml');
-  await writeFile(
-    deploy,
-    `case "$1" in
-start) version="$2";;
-stop) ;;
-restart) ;;
-status) ;;
-${includeRollback ? 'rollback) version="$2";;' : ''}
+async function temporary(prefix) {
+  const path = await mkdtemp(join(tmpdir(), prefix));
+  temporaryDirectories.push(path);
+  return path;
+}
+
+function envText(serverProjectsRoot, mode = 'none', extra = '') {
+  return `# 前端
+FRONTEND_URL=0.0.0.0
+FRONTEND_PORT=5173
+
+# 后端
+BACKEND_URL=0.0.0.0
+BACKEND_PORT=3000
+
+# 数据库
+DB_URL=
+DB_PORT=5432
+DB_USER=
+DB_PASSWORD=
+DB_NAME=
+DB_SCHEMA=
+
+# API
+
+# 部署
+PROJECT_NAME=fixture
+SERVER_PROJECTS_ROOT=${serverProjectsRoot}
+PROJECT_HTTP_PORT=9099
+DOCKER_BIND_IP=127.0.0.1
+FRONTEND_BLUE_PORT=19091
+FRONTEND_GREEN_PORT=19092
+BACKEND_BLUE_PORT=19093
+BACKEND_GREEN_PORT=19094
+FRONTEND_BASE_IMAGE=nginx@sha256:${'0'.repeat(64)}
+BACKEND_BASE_IMAGE=node@sha256:${'1'.repeat(64)}
+DATABASE_MIGRATION_MODE=${mode}
+${extra}`;
+}
+
+async function createFixture({ mode = 'none', agents = '# Target project\n', extraEnv = '' } = {}) {
+  const root = await temporary('wdyy-deploy-');
+  const fakeBin = join(root, 'fake-bin');
+  const serverProjectsRoot = join(root, 'servers');
+  const commandLog = join(root, 'commands.log');
+  await Promise.all([
+    mkdir(fakeBin, { recursive: true }),
+    mkdir(join(root, 'src/frontend'), { recursive: true }),
+    mkdir(join(root, 'src/backend'), { recursive: true }),
+    mkdir(join(root, 'scripts/deployment'), { recursive: true }),
+    mkdir(serverProjectsRoot, { recursive: true }),
+  ]);
+  await Promise.all([
+    copyFile(deployTemplate, join(root, 'deploy.sh')),
+    copyFile(frontendDockerfileTemplate, join(root, 'src/frontend/Dockerfile')),
+    copyFile(backendDockerfileTemplate, join(root, 'src/backend/Dockerfile')),
+    copyFile(composeTemplate, join(root, 'scripts/deployment/docker-compose.blue-green.yml')),
+    copyFile(nginxTemplate, join(root, 'scripts/deployment/nginx-site.conf')),
+    copyFile(frontendNginxTemplate, join(root, 'scripts/deployment/frontend-container.conf.template')),
+    copyFile(dockerignoreTemplate, join(root, '.dockerignore')),
+    writeFile(join(root, 'AGENTS.md'), agents),
+    writeFile(join(root, '.env'), envText(serverProjectsRoot, mode, extraEnv)),
+    writeFile(commandLog, ''),
+  ]);
+  await chmod(join(root, 'deploy.sh'), 0o755);
+  await chmod(join(root, '.env'), 0o600);
+
+  if (mode === 'manual') {
+    await mkdir(join(root, 'database/migrations'), { recursive: true });
+    await writeFile(join(root, 'database/migrations/V001__baseline.sql'), 'SELECT 1;\n');
+    await writeFile(join(root, 'scripts/apply-migrations.sh'), '#!/usr/bin/env bash\nset -euo pipefail\n');
+    await chmod(join(root, 'scripts/apply-migrations.sh'), 0o755);
+  }
+
+  await writeExecutable(join(fakeBin, 'pnpm'), `#!/usr/bin/env bash
+set -euo pipefail
+printf 'pnpm %s\n' "$*" >> "$COMMAND_LOG"
+[[ "\${FAIL_GATE:-}" != "\${1:-}" ]] || exit 9
+if [[ "\${1:-}" == build ]]; then
+  mkdir -p src/frontend/dist
+  printf '<!doctype html><div id="app"></div>\n' > src/frontend/dist/index.html
+fi
+`);
+  await writeExecutable(join(fakeBin, 'docker'), `#!/usr/bin/env bash
+set -euo pipefail
+printf 'docker %s\n' "$*" >> "$COMMAND_LOG"
+case "\${1:-}" in
+  build) exit 0 ;;
+  image)
+    if [[ "\${2:-}" == inspect ]]; then tag="\${!#}"; printf '%s\n' "\${tag##*:}";
+    elif [[ "\${2:-}" == ls ]]; then printf '%s\n' "\${DOCKER_IMAGE_LIST:-fixture_frontend:20260808-001
+fixture_backend:20260808-001
+other_project_frontend:shared}"; fi
+    ;;
+  save)
+    shift; output=; tag=
+    while [[ "$#" -gt 0 ]]; do
+      if [[ "$1" == -o ]]; then output="$2"; shift 2; else tag="$1"; shift; fi
+    done
+    work="$(mktemp -d)"
+    printf '[{"Config":"config.json","RepoTags":["%s"],"Layers":[]}]\n' "$tag" > "$work/manifest.json"
+    printf '{}\n' > "$work/config.json"
+    /usr/bin/tar -cf "$output" -C "$work" manifest.json config.json
+    /bin/rm -rf "$work"
+    ;;
+  load) exit 0 ;;
+  compose) exit 0 ;;
+  ps)
+    if [[ "\${2:-}" == -aq ]]; then
+      printf '%s\n' "\${DOCKER_CONTAINER_IDS:-c111
+c222}"
+    elif [[ "\${2:-}" == --format && -n "\${DOCKER_RUNNING_PORTS:-}" ]]; then
+      printf '%s\n' "$DOCKER_RUNNING_PORTS"
+    fi
+    ;;
+  network)
+    if [[ "\${2:-}" == ls ]]; then printf '%s\n' "\${DOCKER_NETWORK_IDS:-n111}"; fi
+    ;;
+  rm) exit 0 ;;
+  *) echo "unexpected docker command: $*" >&2; exit 10 ;;
 esac
-HEALTH_URL=/health
-VERSION_URL=/version
-database/migrations
-`,
-  );
-  await writeFile(
-    nginx,
-    'location /releases/ { root /srv/app; }\nroot /srv/app/current;\n',
-  );
-  await writeFile(
-    compose,
-    'backend-blue:\nbackend-green:\nINSTANCE_ID: blue\nINSTANCE_ID: green\nLOG_DIR: /logs\n',
-  );
-  return { deploy, nginx, compose };
+`);
+  await writeExecutable(join(fakeBin, 'curl'), `#!/usr/bin/env bash
+set -euo pipefail
+url="\${!#}"
+if [[ "\${FAIL_PUBLIC_ENDPOINT:-0}" == 1 && "$url" == *:9099/* ]]; then exit 26; fi
+if [[ "$url" == */version ]]; then printf '%s' "\${EXPECTED_VERSION:?}"; else printf 'ok'; fi
+`);
+  await writeExecutable(join(fakeBin, 'nginx'), `#!/usr/bin/env bash
+set -euo pipefail
+printf 'nginx %s\n' "$*" >> "$COMMAND_LOG"
+if [[ "\${1:-}" == -t ]]; then [[ "\${FAIL_NGINX_TEST:-0}" != 1 ]] || exit 23; exit 0; fi
+if [[ "\${1:-}" == -T ]]; then
+  [[ ! -f "$SERVER_ROOT/nginx/site.conf" ]] || cat "$SERVER_ROOT/nginx/site.conf"
+  [[ -z "\${EXTRA_NGINX_CONFIG:-}" ]] || printf '%s\n' "$EXTRA_NGINX_CONFIG"
+  exit 0
+fi
+if [[ "\${1:-}" == -s && "\${2:-}" == reload && "\${FAIL_NGINX_RELOAD_ONCE:-0}" == 1 && ! -f "$NGINX_FAIL_MARKER" ]]; then
+  : > "$NGINX_FAIL_MARKER"; exit 24
+fi
+`);
+  await writeExecutable(join(fakeBin, 'flock'), '#!/usr/bin/env bash\nexit 0\n');
+  await writeExecutable(join(fakeBin, 'install'), `#!/usr/bin/env bash
+set -euo pipefail
+target="\${!#}"
+if [[ "\${FAIL_STATE_INSTALL:-0}" == 1 && "$target" == */state/active.env ]]; then exit 25; fi
+exec /usr/bin/install "$@"
+`);
+
+  return { root, fakeBin, serverProjectsRoot, commandLog, mode };
 }
 
-test('接受版本化前端、蓝绿后端和完整命令', async () => {
-  const files = await createFiles();
-  const result = spawnSync(
-    process.execPath,
-    [validator.pathname, files.deploy, files.nginx, files.compose],
-    { encoding: 'utf8' },
-  );
+async function writeExecutable(path, content) {
+  await writeFile(path, content);
+  await chmod(path, 0o755);
+}
 
+function run(root, args, fixture, extraEnv = {}) {
+  return spawnSync('bash', args, {
+    cwd: root,
+    encoding: 'utf8',
+    env: {
+      ...process.env,
+      PATH: `${fixture.fakeBin}:${process.env.PATH}`,
+      COMMAND_LOG: fixture.commandLog,
+      ...extraEnv,
+    },
+  });
+}
+
+function runBuild(fixture, extraEnv = {}, ...extraArgs) {
+  return run(fixture.root, ['deploy.sh', 'build', ...extraArgs], fixture, extraEnv);
+}
+
+async function releaseVersion(root) {
+  return (await readFile(join(root, 'deploy/release.env'), 'utf8')).trim().slice('RELEASE_VERSION='.length);
+}
+
+function runValidator(root, version) {
+  return spawnSync(process.execPath, [
+    validator,
+    join(root, 'deploy/deploy.sh'),
+    join(root, `deploy/${version}/nginx/site.conf`),
+    join(root, `deploy/${version}/docker/docker-compose.blue-green.yml`),
+    join(root, 'deploy'),
+  ], { encoding: 'utf8' });
+}
+
+async function installOnServer(fixture) {
+  const serverRoot = join(fixture.serverProjectsRoot, 'fixture');
+  await cp(join(fixture.root, 'deploy'), serverRoot, { recursive: true, force: true });
+  await chmod(join(serverRoot, 'deploy.sh'), 0o755);
+  return serverRoot;
+}
+
+function runServer(fixture, serverRoot, command, extraEnv = {}, argument) {
+  const args = [join(serverRoot, 'deploy.sh'), command];
+  if (argument) args.push(argument);
+  return run(fixture.root, args, fixture, {
+    SERVER_ROOT: serverRoot,
+    NGINX_FAIL_MARKER: join(fixture.root, 'nginx-failed-once'),
+    ...extraEnv,
+  });
+}
+
+test('build 生成根 .env、双镜像和四服务完整包', async () => {
+  const fixture = await createFixture();
+  const result = runBuild(fixture);
+  assert.equal(result.status, 0, `stdout:\n${result.stdout}\nstderr:\n${result.stderr}`);
+  const version = await releaseVersion(fixture.root);
+  assert.deepEqual((await readdir(join(fixture.root, 'deploy'))).sort(), ['.env', version, 'deploy.sh', 'release.env'].sort());
+  await Promise.all([
+    access(join(fixture.root, `deploy/${version}/frontend-image.tar`)),
+    access(join(fixture.root, `deploy/${version}/backend-image.tar`)),
+  ]);
+  const validation = runValidator(fixture.root, version);
+  assert.equal(validation.status, 0, validation.stderr);
+  assert.match(validation.stdout, /valid dual-image deployment package/);
+  const log = await readFile(fixture.commandLog, 'utf8');
+  assert.match(log, new RegExp(`--tag fixture_frontend:${version}`));
+  assert.match(log, new RegExp(`--tag fixture_backend:${version}`));
+  assert.match(log, /--build-arg BACKEND_PORT=3000/);
+  assert.doesNotMatch(await readFile(join(fixture.root, `deploy/${version}/docker/docker-compose.blue-green.yml`), 'utf8'), /FRONTEND_CONTAINER_PORT|BACKEND_CONTAINER_PORT|_HEALTH_URL|_VERSION_URL/);
+});
+
+test('none 模式不伪造数据库文件，manual 模式只打包人工脚本', async () => {
+  const none = await createFixture();
+  assert.equal(runBuild(none).status, 0);
+  const noneVersion = await releaseVersion(none.root);
+  await assert.rejects(stat(join(none.root, `deploy/${noneVersion}/database`)));
+
+  const manual = await createFixture({ mode: 'manual' });
+  const built = runBuild(manual);
+  assert.equal(built.status, 0, built.stderr);
+  assert.match(built.stdout, /migration was not executed/);
+  const manualVersion = await releaseVersion(manual.root);
+  assert.ok((await stat(join(manual.root, `deploy/${manualVersion}/database/apply-migrations.sh`))).mode & 0o111);
+  assert.doesNotMatch(await readFile(join(manual.root, 'deploy/deploy.sh'), 'utf8'), /\bpsql\b/);
+});
+
+test('连续构建的 deploy.sh、Compose 和 Nginx 配置字节一致', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const firstVersion = await releaseVersion(fixture.root);
+  const first = await configurationHashes(fixture.root, firstVersion);
+  assert.equal(runBuild(fixture).status, 0);
+  const secondVersion = await releaseVersion(fixture.root);
+  const second = await configurationHashes(fixture.root, secondVersion);
+  assert.notEqual(firstVersion, secondVersion);
+  assert.deepEqual(second, first);
+});
+
+async function configurationHashes(root, version) {
+  const paths = ['deploy/deploy.sh', `deploy/${version}/docker/docker-compose.blue-green.yml`, `deploy/${version}/nginx/site.conf`];
+  return Promise.all(paths.map(async (path) => createHash('sha256').update(await readFile(join(root, path))).digest('hex')));
+}
+
+async function rewriteManifest(versionRoot, directory = versionRoot) {
+  const files = [];
+  async function walk(current) {
+    for (const entry of await readdir(current, { withFileTypes: true })) {
+      const path = join(current, entry.name);
+      if (entry.isDirectory()) await walk(path);
+      else if (entry.isFile() && entry.name !== 'manifest.sha256') files.push(path);
+    }
+  }
+  await walk(directory);
+  const lines = await Promise.all(files.sort().map(async (path) => {
+    const relative = path.slice(versionRoot.length + 1).split('\\').join('/');
+    const hash = createHash('sha256').update(await readFile(path)).digest('hex');
+    return `${hash}  ${relative}`;
+  }));
+  await writeFile(join(versionRoot, 'manifest.sha256'), `${lines.join('\n')}\n`);
+}
+
+test('失败构建保留上一发布包和发布账本', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const version = await releaseVersion(fixture.root);
+  const agents = await readFile(join(fixture.root, 'AGENTS.md'), 'utf8');
+  const failed = runBuild(fixture, { FAIL_GATE: 'lint' });
+  assert.equal(failed.status, 9);
+  assert.equal(await releaseVersion(fixture.root), version);
+  assert.equal(await readFile(join(fixture.root, 'AGENTS.md'), 'utf8'), agents);
+});
+
+test('dotenv 被作为数据解析，不执行命令替换或覆盖脚本 PATH', async () => {
+  const fixture = await createFixture({ extraEnv: 'UNUSED_VALUE=$(touch should-not-exist)\nPATH=/malicious\n' });
+  const result = runBuild(fixture);
   assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /valid deployment package/);
+  await assert.rejects(access(join(fixture.root, 'should-not-exist')));
+});
+
+test('build 拒绝重复键、漂移基础镜像和额外版本参数', async () => {
+  const duplicate = await createFixture({ extraEnv: 'PROJECT_NAME=duplicate\n' });
+  assert.notEqual(runBuild(duplicate).status, 0);
+  const mutable = await createFixture();
+  await writeFile(join(mutable.root, '.env'), (await readFile(join(mutable.root, '.env'), 'utf8')).replace(/nginx@sha256:[0-9a-f]+/, 'nginx:latest'));
+  assert.notEqual(runBuild(mutable).status, 0);
+  const extra = await createFixture();
+  assert.equal(runBuild(extra, {}, '20260808-001').status, 2);
+  const logDirectory = await createFixture({ extraEnv: 'LOG_DIR=/tmp/logs\n' });
+  const rejected = runBuild(logDirectory);
+  assert.notEqual(rejected.status, 0);
+  assert.match(rejected.stderr, /must not configure log directories/);
+  const legacy = await createFixture({ extraEnv: 'FRONTEND_CONTAINER_PORT=8080\n' });
+  const legacyRejected = runBuild(legacy);
+  assert.notEqual(legacyRejected.status, 0);
+  assert.match(legacyRejected.stderr, /legacy duplicate environment key/);
+  const reverseInclude = await createFixture();
+  await writeFile(join(reverseInclude.root, '.dockerignore'), `${await readFile(join(reverseInclude.root, '.dockerignore'), 'utf8')}!.env\n`);
+  const reverseRejected = runBuild(reverseInclude);
+  assert.notEqual(reverseRejected.status, 0);
+  assert.match(reverseRejected.stderr, /forbidden reverse include/);
+});
+
+test('validator 拒绝缺失前端镜像、镜像 fallback 和嵌套日志', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const version = await releaseVersion(fixture.root);
+  await unlink(join(fixture.root, `deploy/${version}/frontend-image.tar`));
+  assert.notEqual(runValidator(fixture.root, version).status, 0);
+
+  assert.equal(runBuild(fixture).status, 0);
+  const next = await releaseVersion(fixture.root);
+  const composePath = join(fixture.root, `deploy/${next}/docker/docker-compose.blue-green.yml`);
+  await writeFile(composePath, (await readFile(composePath, 'utf8')).replace('${FRONTEND_IMAGE:?FRONTEND_IMAGE is required}', '${FRONTEND_IMAGE:-fallback}').replace('../../logs:/app/logs', '../../logs/frontend:/app/logs'));
+  const validation = runValidator(fixture.root, next);
+  assert.notEqual(validation.status, 0);
+  assert.match(validation.stderr, /fallback|logs/);
+});
+
+test('validator 拒绝版本目录符号链接', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const version = await releaseVersion(fixture.root);
+  await symlink('../outside', join(fixture.root, `deploy/${version}/linked-file`));
+  const validation = runValidator(fixture.root, version);
+  assert.notEqual(validation.status, 0);
+  assert.match(validation.stderr, /symbolic links/);
+});
+
+test('服务器拒绝标签不匹配的镜像归档且不执行 docker load', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const version = await releaseVersion(fixture.root);
+  const versionRoot = join(fixture.root, `deploy/${version}`);
+  const badArchiveRoot = await temporary('bad-image-');
+  await writeFile(join(badArchiveRoot, 'manifest.json'), `[{"Config":"config.json","RepoTags":["fixture_frontend:${version}","other_frontend:bad"],"Layers":[]}]\n`);
+  await writeFile(join(badArchiveRoot, 'config.json'), '{}\n');
+  const tarResult = spawnSync('/usr/bin/tar', ['-cf', join(versionRoot, 'frontend-image.tar'), '-C', badArchiveRoot, 'manifest.json', 'config.json'], { encoding: 'utf8' });
+  assert.equal(tarResult.status, 0, tarResult.stderr);
+  await rewriteManifest(versionRoot);
+  const serverRoot = await installOnServer(fixture);
+  await writeFile(fixture.commandLog, '');
+  const started = runServer(fixture, serverRoot, 'start', { EXPECTED_VERSION: version });
+  assert.notEqual(started.status, 0);
+  assert.match(started.stderr, /exactly one expected tag/);
+  assert.doesNotMatch(await readFile(fixture.commandLog, 'utf8'), /docker load/);
+});
+
+test('start、replace 和 rollback 成对切换前后端', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const first = await releaseVersion(fixture.root);
+  const serverRoot = await installOnServer(fixture);
+  const started = runServer(fixture, serverRoot, 'start', { EXPECTED_VERSION: first });
+  assert.equal(started.status, 0, started.stderr);
+  assert.match(await readFile(join(serverRoot, 'state/active.env'), 'utf8'), new RegExp(`ACTIVE_COLOR=blue[\\s\\S]*${first}`));
+
+  assert.equal(runBuild(fixture).status, 0);
+  const second = await releaseVersion(fixture.root);
+  await cp(join(fixture.root, 'deploy'), serverRoot, { recursive: true, force: true });
+  const replaced = runServer(fixture, serverRoot, 'replace', { EXPECTED_VERSION: second });
+  assert.equal(replaced.status, 0, replaced.stderr);
+  assert.match(await readFile(join(serverRoot, 'state/active.env'), 'utf8'), /ACTIVE_COLOR=green/);
+  assert.match(await readFile(join(serverRoot, 'state/previous.env'), 'utf8'), new RegExp(first));
+  const upstream = await readFile(join(serverRoot, 'nginx/active-upstreams.conf'), 'utf8');
+  assert.match(upstream, /fixture_frontend_active/);
+  assert.match(upstream, /fixture_backend_active/);
+
+  const rolledBack = runServer(fixture, serverRoot, 'rollback', { EXPECTED_VERSION: first }, first);
+  assert.equal(rolledBack.status, 0, rolledBack.stderr);
+  assert.match(await readFile(join(serverRoot, 'state/active.env'), 'utf8'), new RegExp(first));
+});
+
+test('restart、stop、status 只操作当前颜色的一对容器', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const version = await releaseVersion(fixture.root);
+  const serverRoot = await installOnServer(fixture);
+  assert.equal(runServer(fixture, serverRoot, 'start', { EXPECTED_VERSION: version }).status, 0);
+  await writeFile(fixture.commandLog, '');
+  assert.equal(runServer(fixture, serverRoot, 'restart', { EXPECTED_VERSION: version }).status, 0);
+  assert.equal(runServer(fixture, serverRoot, 'stop', { EXPECTED_VERSION: version }).status, 0);
+  const statusResult = runServer(fixture, serverRoot, 'status', { EXPECTED_VERSION: version });
+  assert.equal(statusResult.status, 0, statusResult.stderr);
+  assert.match(statusResult.stdout, new RegExp(version));
+  const log = await readFile(fixture.commandLog, 'utf8');
+  assert.match(log, /up -d --force-recreate frontend-blue backend-blue/);
+  assert.match(log, /stop frontend-blue backend-blue/);
 });
 
-test('缺少 rollback 命令时明确失败', async () => {
-  const files = await createFiles({ includeRollback: false });
-  const result = spawnSync(
-    process.execPath,
-    [validator.pathname, files.deploy, files.nginx, files.compose],
-    { encoding: 'utf8' },
+test('remove 只删除本项目容器、网络和两个镜像仓库并保留日志', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const serverRoot = await installOnServer(fixture);
+  await mkdir(join(serverRoot, 'logs'), { recursive: true });
+  await writeFile(join(serverRoot, 'logs/backend.log'), 'keep\n');
+  await writeFile(fixture.commandLog, '');
+  const removed = runServer(fixture, serverRoot, 'remove');
+  assert.equal(removed.status, 0, removed.stderr);
+  const log = await readFile(fixture.commandLog, 'utf8');
+  assert.match(log, /docker rm -f c111 c222/);
+  assert.match(log, /docker network rm n111/);
+  assert.match(log, /docker image rm -f fixture_backend:20260808-001 fixture_frontend:20260808-001|docker image rm -f fixture_frontend:20260808-001 fixture_backend:20260808-001/);
+  assert.doesNotMatch(log, /other_project_frontend:shared/);
+  assert.equal(await readFile(join(serverRoot, 'logs/backend.log'), 'utf8'), 'keep\n');
+  await access(join(serverRoot, 'release.env'));
+});
+
+test('端口冲突在加载镜像或启动容器前失败', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const version = await releaseVersion(fixture.root);
+  const serverRoot = await installOnServer(fixture);
+  await mkdir(join(fixture.serverProjectsRoot, 'other/nginx'), { recursive: true });
+  await writeFile(join(fixture.serverProjectsRoot, 'other/nginx/site.conf'), '# wdyy-project: other\n# wdyy-port: 9099\nserver { listen 9099; }\n');
+  await writeFile(fixture.commandLog, '');
+  const result = runServer(fixture, serverRoot, 'start', { EXPECTED_VERSION: version });
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /already used by another project/);
+  const log = await readFile(fixture.commandLog, 'utf8');
+  assert.doesNotMatch(log, /docker load|docker compose/);
+});
+
+test('展开的全局 Nginx 中存在非标准项目端口时也拒绝部署', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const version = await releaseVersion(fixture.root);
+  const serverRoot = await installOnServer(fixture);
+  await writeFile(fixture.commandLog, '');
+  const result = runServer(fixture, serverRoot, 'start', {
+    EXPECTED_VERSION: version,
+    EXTRA_NGINX_CONFIG: 'server {\n  listen 9099;\n}',
+  });
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /expanded Nginx configuration/);
+  assert.doesNotMatch(await readFile(fixture.commandLog, 'utf8'), /docker load|docker compose/);
+});
+
+test('其他项目预留任一 Docker blue-green 宿主机端口时在启动前失败', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const version = await releaseVersion(fixture.root);
+  const serverRoot = await installOnServer(fixture);
+  await mkdir(join(fixture.serverProjectsRoot, 'other/nginx'), { recursive: true });
+  await writeFile(
+    join(fixture.serverProjectsRoot, 'other/nginx/site.conf'),
+    '# wdyy-project: other\n# wdyy-port: 9100\n# wdyy-docker-ports: 19091,29092,29093,29094\nserver { listen 9100; }\n',
   );
+  await writeFile(fixture.commandLog, '');
+  const result = runServer(fixture, serverRoot, 'start', { EXPECTED_VERSION: version });
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /Docker host port 19091/);
+  assert.doesNotMatch(await readFile(fixture.commandLog, 'utf8'), /docker load|docker compose/);
+});
 
+test('其他运行中容器发布项目 Docker 端口时在镜像加载前失败', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const version = await releaseVersion(fixture.root);
+  const serverRoot = await installOnServer(fixture);
+  await writeFile(fixture.commandLog, '');
+  const result = runServer(fixture, serverRoot, 'start', {
+    EXPECTED_VERSION: version,
+    DOCKER_RUNNING_PORTS: 'other_project|0.0.0.0:19093->3000/tcp, [::]:19093->3000/tcp',
+  });
   assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /rollback/);
+  assert.match(result.stderr, /Docker host port 19093 is already published by another container/);
+  assert.doesNotMatch(await readFile(fixture.commandLog, 'utf8'), /docker load|docker compose/);
+});
+
+test('replace 的 Nginx reload 失败时恢复旧 upstream 和状态', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const first = await releaseVersion(fixture.root);
+  const serverRoot = await installOnServer(fixture);
+  assert.equal(runServer(fixture, serverRoot, 'start', { EXPECTED_VERSION: first }).status, 0);
+  const oldUpstream = await readFile(join(serverRoot, 'nginx/active-upstreams.conf'), 'utf8');
+  const oldState = await readFile(join(serverRoot, 'state/active.env'), 'utf8');
+  assert.equal(runBuild(fixture).status, 0);
+  const second = await releaseVersion(fixture.root);
+  await cp(join(fixture.root, 'deploy'), serverRoot, { recursive: true, force: true });
+  const failed = runServer(fixture, serverRoot, 'replace', { EXPECTED_VERSION: second, FAIL_NGINX_RELOAD_ONCE: '1' });
+  assert.notEqual(failed.status, 0);
+  assert.equal(await readFile(join(serverRoot, 'nginx/active-upstreams.conf'), 'utf8'), oldUpstream);
+  assert.equal(await readFile(join(serverRoot, 'state/active.env'), 'utf8'), oldState);
+});
+
+test('首次切流后的外部端口验证失败时不提交状态并移除候选 Nginx 文件', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const version = await releaseVersion(fixture.root);
+  const serverRoot = await installOnServer(fixture);
+  const failed = runServer(fixture, serverRoot, 'start', { EXPECTED_VERSION: version, FAIL_PUBLIC_ENDPOINT: '1' });
+  assert.notEqual(failed.status, 0);
+  assert.match(failed.stderr, /public endpoint verification failed/);
+  await assert.rejects(access(join(serverRoot, 'state/active.env')));
+  await assert.rejects(access(join(serverRoot, 'nginx/site.conf')));
+  await assert.rejects(access(join(serverRoot, 'nginx/active-upstreams.conf')));
+});
+
+test('状态提交失败时恢复旧流量和旧状态', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const first = await releaseVersion(fixture.root);
+  const serverRoot = await installOnServer(fixture);
+  assert.equal(runServer(fixture, serverRoot, 'start', { EXPECTED_VERSION: first }).status, 0);
+  const oldUpstream = await readFile(join(serverRoot, 'nginx/active-upstreams.conf'), 'utf8');
+  const oldState = await readFile(join(serverRoot, 'state/active.env'), 'utf8');
+  assert.equal(runBuild(fixture).status, 0);
+  const second = await releaseVersion(fixture.root);
+  await cp(join(fixture.root, 'deploy'), serverRoot, { recursive: true, force: true });
+  const failed = runServer(fixture, serverRoot, 'replace', { EXPECTED_VERSION: second, FAIL_STATE_INSTALL: '1' });
+  assert.notEqual(failed.status, 0);
+  assert.equal(await readFile(join(serverRoot, 'nginx/active-upstreams.conf'), 'utf8'), oldUpstream);
+  assert.equal(await readFile(join(serverRoot, 'state/active.env'), 'utf8'), oldState);
+});
+
+test('服务器命令拒绝额外参数和错误部署根', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const serverRoot = await installOnServer(fixture);
+  assert.equal(runServer(fixture, serverRoot, 'start', {}, 'unexpected').status, 2);
+  const wrongRoot = join(fixture.root, 'wrong');
+  await cp(join(fixture.root, 'deploy'), wrongRoot, { recursive: true });
+  const wrong = runServer(fixture, wrongRoot, 'status');
+  assert.notEqual(wrong.status, 0);
+  assert.match(wrong.stderr, /server deploy root must be exactly/);
 });

package/.well-known/skills/wdyy-deployment-standard/templates/Dockerfile.template

@@ -1,15 +1,22 @@
-FROM node:24-bookworm-slim AS build
+ARG BACKEND_BASE_IMAGE
+FROM ${BACKEND_BASE_IMAGE} AS build
 WORKDIR /app
-COPY package.json pnpm-lock.yaml ./
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 RUN corepack enable && pnpm install --frozen-lockfile
 COPY . .
 RUN pnpm build
 
-FROM node:24-bookworm-slim AS runtime
+ARG BACKEND_BASE_IMAGE
+FROM ${BACKEND_BASE_IMAGE} AS runtime
 WORKDIR /app
+ARG RELEASE_VERSION
+ARG BACKEND_PORT
 ENV NODE_ENV=production
+ENV RELEASE_VERSION=${RELEASE_VERSION}
+ENV PORT=${BACKEND_PORT}
+LABEL org.opencontainers.image.version=${RELEASE_VERSION}
 COPY --from=build /app/package.json ./
 COPY --from=build /app/node_modules ./node_modules
 COPY --from=build /app/dist ./dist
-EXPOSE 3000
+EXPOSE ${BACKEND_PORT}
 CMD ["node", "dist/main.js"]