@wdyy/skills 0.1.6 → 0.1.8

package/.well-known/skills/wdyy-deployment-standard/scripts/validate-deployment-package.test.mjs

@@ -1,22 +1,10 @@
 import assert from 'node:assert/strict';
 import { createHash } from 'node:crypto';
 import {
-  chmod,
-  cp,
-  copyFile,
-  mkdir,
-  mkdtemp,
-  readFile,
-  readlink,
-  readdir,
-  rm,
-  stat,
-  symlink,
-  unlink,
-  writeFile,
+  access, chmod, cp, copyFile, mkdir, mkdtemp, readFile, readdir, rm, stat, symlink, unlink, writeFile,
 } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
-import { dirname, join, relative, resolve, sep } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { afterEach, test } from 'node:test';
 import { spawnSync } from 'node:child_process';
@@ -29,582 +17,553 @@ const deployTemplate = join(templatesRoot, 'deploy.sh.template');
 const composeTemplate = join(templatesRoot, 'docker-compose.blue-green.yml');
 const nginxTemplate = join(templatesRoot, 'nginx-upstream.template.conf');
 const dockerignoreTemplate = join(templatesRoot, 'dockerignore.template');
+const frontendDockerfileTemplate = join(templatesRoot, 'frontend.Dockerfile.template');
+const backendDockerfileTemplate = join(templatesRoot, 'Dockerfile.template');
+const frontendNginxTemplate = join(templatesRoot, 'frontend-container.conf.template');
 const temporaryDirectories = [];
 
 afterEach(async () => {
-  await Promise.all(
-    temporaryDirectories.splice(0).map((directory) =>
-      rm(directory, { force: true, recursive: true }),
-    ),
-  );
+  await Promise.all(temporaryDirectories.splice(0).map((path) => rm(path, { recursive: true, force: true })));
 });
 
-async function createTemporaryDirectory(prefix) {
-  const directory = await mkdtemp(join(tmpdir(), prefix));
-  temporaryDirectories.push(directory);
-  return directory;
-}
-
-async function listFiles(root, directory = root) {
-  const result = [];
-  for (const entry of await readdir(directory, { withFileTypes: true })) {
-    const path = join(directory, entry.name);
-    if (entry.isDirectory()) result.push(...await listFiles(root, path));
-    else if (entry.isFile()) result.push(relative(root, path).split(sep).join('/'));
-  }
-  return result;
+async function temporary(prefix) {
+  const path = await mkdtemp(join(tmpdir(), prefix));
+  temporaryDirectories.push(path);
+  return path;
 }
 
-async function writeManifest(versionRoot) {
-  const paths = (await listFiles(versionRoot))
-    .filter((path) => path !== 'manifest.sha256')
-    .sort();
-  const lines = [];
-  for (const path of paths) {
-    const checksum = createHash('sha256')
-      .update(await readFile(join(versionRoot, path)))
-      .digest('hex');
-    lines.push(`${checksum}  ${path}`);
-  }
-  await writeFile(join(versionRoot, 'manifest.sha256'), `${lines.join('\n')}\n`);
+function envText(serverProjectsRoot, mode = 'none', extra = '') {
+  return `# 前端
+FRONTEND_URL=0.0.0.0
+FRONTEND_PORT=5173
+
+# 后端
+BACKEND_URL=0.0.0.0
+BACKEND_PORT=3000
+
+# 数据库
+DB_URL=
+DB_PORT=5432
+DB_USER=
+DB_PASSWORD=
+DB_NAME=
+DB_SCHEMA=
+
+# API
+
+# 部署
+PROJECT_NAME=fixture
+SERVER_PROJECTS_ROOT=${serverProjectsRoot}
+PROJECT_HTTP_PORT=9099
+DOCKER_BIND_IP=127.0.0.1
+FRONTEND_BLUE_PORT=19091
+FRONTEND_GREEN_PORT=19092
+BACKEND_BLUE_PORT=19093
+BACKEND_GREEN_PORT=19094
+FRONTEND_BASE_IMAGE=nginx@sha256:${'0'.repeat(64)}
+BACKEND_BASE_IMAGE=node@sha256:${'1'.repeat(64)}
+DATABASE_MIGRATION_MODE=${mode}
+${extra}`;
 }
 
-async function createPackage() {
-  const directory = await createTemporaryDirectory('deployment-package-');
-  const packageRoot = join(directory, 'deploy');
-  const version = '20260730-001';
-  const versionRoot = join(packageRoot, version);
+async function createFixture({ mode = 'none', agents = '# Target project\n', extraEnv = '' } = {}) {
+  const root = await temporary('wdyy-deploy-');
+  const fakeBin = join(root, 'fake-bin');
+  const serverProjectsRoot = join(root, 'servers');
+  const commandLog = join(root, 'commands.log');
   await Promise.all([
-    mkdir(join(versionRoot, 'database', 'migrations'), { recursive: true }),
-    mkdir(join(versionRoot, 'scripts'), { recursive: true }),
-    mkdir(join(versionRoot, 'docker'), { recursive: true }),
-    mkdir(join(versionRoot, 'nginx'), { recursive: true }),
+    mkdir(fakeBin, { recursive: true }),
+    mkdir(join(root, 'src/frontend'), { recursive: true }),
+    mkdir(join(root, 'src/backend'), { recursive: true }),
+    mkdir(join(root, 'scripts/deployment'), { recursive: true }),
+    mkdir(serverProjectsRoot, { recursive: true }),
   ]);
-  await copyFile(deployTemplate, join(packageRoot, 'deploy.sh'));
-  await chmod(join(packageRoot, 'deploy.sh'), 0o755);
-  await writeFile(join(packageRoot, 'release.env'), `RELEASE_VERSION=${version}\n`);
-  await writeFile(join(versionRoot, 'frontend.tar.gz'), 'frontend archive');
-  await writeFile(join(versionRoot, 'backend-image.tar'), 'backend image');
-  await writeFile(
-    join(versionRoot, 'database', 'migrations', 'V001__baseline.sql'),
-    'SELECT 1;\n',
-  );
-  await writeFile(
-    join(versionRoot, 'scripts', 'apply-migrations.sh'),
-    '#!/usr/bin/env bash\nset -euo pipefail\n',
-  );
-  await chmod(join(versionRoot, 'scripts', 'apply-migrations.sh'), 0o755);
-  await copyFile(composeTemplate, join(versionRoot, 'docker', 'docker-compose.blue-green.yml'));
-  await copyFile(nginxTemplate, join(versionRoot, 'nginx', 'site.conf'));
-  await writeManifest(versionRoot);
-  return {
-    directory,
-    packageRoot,
-    version,
-    versionRoot,
-    deploy: join(packageRoot, 'deploy.sh'),
-    compose: join(versionRoot, 'docker', 'docker-compose.blue-green.yml'),
-    nginx: join(versionRoot, 'nginx', 'site.conf'),
-  };
-}
-
-function runValidator(files) {
-  return spawnSync(
-    process.execPath,
-    [validator, files.deploy, files.nginx, files.compose, files.packageRoot],
-    { encoding: 'utf8' },
-  );
-}
-
-async function replace(path, from, to) {
-  const content = await readFile(path, 'utf8');
-  assert.ok(content.includes(from), `fixture replacement source not found: ${from}`);
-  await writeFile(path, content.replace(from, to));
-}
-
-test('接受自动 build、完整单版本目录和无参数 start', async () => {
-  const files = await createPackage();
-  const result = runValidator(files);
-
-  assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /valid deployment package 20260730-001/);
-});
-
-test('缺少 rollback 命令时明确失败', async () => {
-  const files = await createPackage();
-  await replace(files.deploy, '\n  rollback)\n', '\n  legacy_command)\n');
-  const result = runValidator(files);
-
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /rollback/);
-});
-
-test('拒绝旧 start version 语法', async () => {
-  const files = await createPackage();
-  await replace(
-    files.deploy,
-    'start)\n    [[ "$#" -eq 1 ]] || usage',
-    'start)\n    version="$2"',
-  );
-  const result = runValidator(files);
-
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /start/);
-});
-
-test('拒绝固定 srv 部署根目录', async () => {
-  const files = await createPackage();
-  await replace(files.nginx, '__DEPLOY_ROOT__', '/srv/fixed-project');
-  const result = runValidator(files);
-
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /fixed \/srv path/);
-});
-
-test('拒绝 Nginx 模板写死代理 URL', async () => {
-  const files = await createPackage();
-  await replace(files.nginx, '__BACKEND_PROXY_URL__', 'http://backend_active');
-  const result = runValidator(files);
-
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /BACKEND_PROXY_URL/);
-});
-
-test('拒绝缺失迁移执行器', async () => {
-  const files = await createPackage();
-  await unlink(join(files.versionRoot, 'scripts', 'apply-migrations.sh'));
-  const result = runValidator(files);
-
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /apply-migrations/);
-});
-
-test('拒绝缺失校验清单', async () => {
-  const files = await createPackage();
-  await unlink(join(files.versionRoot, 'manifest.sha256'));
-  const result = runValidator(files);
-
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /manifest/);
-});
-
-test('拒绝生产环境文件进入版本目录', async () => {
-  const files = await createPackage();
-  await writeFile(join(files.versionRoot, '.env.production'), 'DATABASE_URL=secret\n');
-  await writeManifest(files.versionRoot);
-  const result = runValidator(files);
-
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /secret file/);
-});
-
-test('拒绝版本目录中的符号链接', async () => {
-  const files = await createPackage();
-  await symlink('../outside-secret', join(files.versionRoot, 'linked-secret'));
-  const result = runValidator(files);
-
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /symbolic links/);
-});
-
-test('拒绝文件与校验清单不一致', async () => {
-  const files = await createPackage();
-  await writeFile(join(files.versionRoot, 'backend-image.tar'), 'changed image');
-  const result = runValidator(files);
-
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /Checksum mismatch/);
-});
-
-test('拒绝 deploy.sh 自动上传', async () => {
-  const files = await createPackage();
-  await writeFile(files.deploy, `${await readFile(files.deploy, 'utf8')}\nscp deploy server:/tmp\n`);
-  const result = runValidator(files);
-
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /must not upload/);
-});
-
-test('拒绝 LOG_DIR 和 HOST_LOG_DIR 可配置日志目录', async () => {
-  const files = await createPackage();
-  await writeFile(
-    files.compose,
-    `services:
-  backend-blue:
-    environment:
-      INSTANCE_ID: blue
-      LOG_DIR: /var/log/application
-    volumes:
-      - \${HOST_LOG_DIR}/backend/blue:/app/logs
-  backend-green:
-    environment:
-      INSTANCE_ID: green
-      LOG_DIR: /var/log/application
-    volumes:
-      - \${HOST_LOG_DIR}/backend/green:/app/logs
-`,
-  );
-  const result = runValidator(files);
-
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /project-root/);
-});
-
-test('拒绝 blue 和 green 使用不同日志目录', async () => {
-  const files = await createPackage();
-  await writeFile(
-    files.compose,
-    `services:
-  backend-blue:
-    environment:
-      INSTANCE_ID: blue
-    volumes:
-      - ../../logs/backend/blue:/app/logs
-  backend-green:
-    environment:
-      INSTANCE_ID: green
-    volumes:
-      - ../../logs/backend/green:/app/logs
-`,
-  );
-  const result = runValidator(files);
-
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /project-root/);
-});
-
-async function createBuildFixture({ agentsContent = '# Target Project\n', secretMigration = false } = {}) {
-  const directory = await createTemporaryDirectory('deployment-build-');
-  const fakeBin = join(directory, 'fake-bin');
   await Promise.all([
-    mkdir(fakeBin, { recursive: true }),
-    mkdir(join(directory, 'src', 'backend'), { recursive: true }),
-    mkdir(join(directory, 'database', 'migrations'), { recursive: true }),
-    mkdir(join(directory, 'scripts', 'deployment'), { recursive: true }),
+    copyFile(deployTemplate, join(root, 'deploy.sh')),
+    copyFile(frontendDockerfileTemplate, join(root, 'src/frontend/Dockerfile')),
+    copyFile(backendDockerfileTemplate, join(root, 'src/backend/Dockerfile')),
+    copyFile(composeTemplate, join(root, 'scripts/deployment/docker-compose.blue-green.yml')),
+    copyFile(nginxTemplate, join(root, 'scripts/deployment/nginx-site.conf')),
+    copyFile(frontendNginxTemplate, join(root, 'scripts/deployment/frontend-container.conf.template')),
+    copyFile(dockerignoreTemplate, join(root, '.dockerignore')),
+    writeFile(join(root, 'AGENTS.md'), agents),
+    writeFile(join(root, '.env'), envText(serverProjectsRoot, mode, extraEnv)),
+    writeFile(commandLog, ''),
   ]);
-  await copyFile(deployTemplate, join(directory, 'deploy.sh'));
-  await chmod(join(directory, 'deploy.sh'), 0o755);
-  await writeFile(join(directory, 'AGENTS.md'), agentsContent);
-  await writeFile(
-    join(directory, '.env'),
-    'PROJECT_NAME=fixture\nBACKEND_CONTAINER_PORT=3000\n',
-  );
-  await copyFile(dockerignoreTemplate, join(directory, '.dockerignore'));
-  await writeFile(join(directory, 'src', 'backend', 'Dockerfile'), 'FROM scratch\n');
-  await writeFile(
-    join(directory, 'database', 'migrations', 'V001__baseline.sql'),
-    'SELECT 1;\n',
-  );
-  if (secretMigration) {
-    await writeFile(
-      join(directory, 'database', 'migrations', '.env.production'),
-      'DATABASE_URL=secret\n',
-    );
+  await chmod(join(root, 'deploy.sh'), 0o755);
+  await chmod(join(root, '.env'), 0o600);
+
+  if (mode === 'manual') {
+    await mkdir(join(root, 'database/migrations'), { recursive: true });
+    await writeFile(join(root, 'database/migrations/V001__baseline.sql'), 'SELECT 1;\n');
+    await writeFile(join(root, 'scripts/apply-migrations.sh'), '#!/usr/bin/env bash\nset -euo pipefail\n');
+    await chmod(join(root, 'scripts/apply-migrations.sh'), 0o755);
   }
-  await writeFile(
-    join(directory, 'scripts', 'apply-migrations.sh'),
-    `#!/usr/bin/env bash
-set -euo pipefail
-if [[ -n "\${COMMAND_LOG:-}" ]]; then
-  printf 'migration %s\\n' "\${MIGRATIONS_DIR:-}" >> "$COMMAND_LOG"
-fi
-`,
-  );
-  await chmod(join(directory, 'scripts', 'apply-migrations.sh'), 0o755);
-  await copyFile(
-    composeTemplate,
-    join(directory, 'scripts', 'deployment', 'docker-compose.blue-green.yml'),
-  );
-  await copyFile(
-    nginxTemplate,
-    join(directory, 'scripts', 'deployment', 'nginx-site.conf'),
-  );
 
-  const fakePnpm = join(fakeBin, 'pnpm');
-  await writeFile(
-    fakePnpm,
-    `#!/usr/bin/env bash
+  await writeExecutable(join(fakeBin, 'pnpm'), `#!/usr/bin/env bash
 set -euo pipefail
-if [[ "\${FAIL_GATE:-}" == "\${1:-}" ]]; then
-  echo "forced pnpm failure: $1" >&2
-  exit 9
-fi
+printf 'pnpm %s\n' "$*" >> "$COMMAND_LOG"
+[[ "\${FAIL_GATE:-}" != "\${1:-}" ]] || exit 9
 if [[ "\${1:-}" == build ]]; then
   mkdir -p src/frontend/dist
-  printf '<!doctype html><script src="%sapp.js"></script>\\n' "$VITE_RELEASE_BASE" > src/frontend/dist/index.html
-  printf 'console.log("ok")\\n' > src/frontend/dist/app.js
+  printf '<!doctype html><div id="app"></div>\n' > src/frontend/dist/index.html
 fi
-`,
-  );
-  await chmod(fakePnpm, 0o755);
-
-  const fakeDocker = join(fakeBin, 'docker');
-  await writeFile(
-    fakeDocker,
-    `#!/usr/bin/env bash
+`);
+  await writeExecutable(join(fakeBin, 'docker'), `#!/usr/bin/env bash
 set -euo pipefail
-if [[ -n "\${COMMAND_LOG:-}" ]]; then
-  printf 'docker %s\\n' "$*" >> "$COMMAND_LOG"
-fi
+printf 'docker %s\n' "$*" >> "$COMMAND_LOG"
 case "\${1:-}" in
-  build)
-    exit 0
-    ;;
+  build) exit 0 ;;
   image)
-    [[ "\${2:-}" == inspect ]]
+    if [[ "\${2:-}" == inspect ]]; then tag="\${!#}"; printf '%s\n' "\${tag##*:}";
+    elif [[ "\${2:-}" == ls ]]; then printf '%s\n' "\${DOCKER_IMAGE_LIST:-fixture_frontend:20260808-001
+fixture_backend:20260808-001
+other_project_frontend:shared}"; fi
     ;;
   save)
-    shift
-    output=
+    shift; output=; tag=
     while [[ "$#" -gt 0 ]]; do
-      if [[ "$1" == -o ]]; then
-        output="$2"
-        shift 2
-      else
-        shift
-      fi
+      if [[ "$1" == -o ]]; then output="$2"; shift 2; else tag="$1"; shift; fi
     done
-    [[ -n "$output" ]]
-    printf 'fixture image\\n' > "$output"
+    work="$(mktemp -d)"
+    printf '[{"Config":"config.json","RepoTags":["%s"],"Layers":[]}]\n' "$tag" > "$work/manifest.json"
+    printf '{}\n' > "$work/config.json"
+    /usr/bin/tar -cf "$output" -C "$work" manifest.json config.json
+    /bin/rm -rf "$work"
     ;;
-  load|compose)
-    exit 0
+  load) exit 0 ;;
+  compose) exit 0 ;;
+  ps)
+    if [[ "\${2:-}" == -aq ]]; then
+      printf '%s\n' "\${DOCKER_CONTAINER_IDS:-c111
+c222}"
+    elif [[ "\${2:-}" == --format && -n "\${DOCKER_RUNNING_PORTS:-}" ]]; then
+      printf '%s\n' "$DOCKER_RUNNING_PORTS"
+    fi
     ;;
-  *)
-    echo "unexpected docker command: $*" >&2
-    exit 10
+  network)
+    if [[ "\${2:-}" == ls ]]; then printf '%s\n' "\${DOCKER_NETWORK_IDS:-n111}"; fi
     ;;
+  rm) exit 0 ;;
+  *) echo "unexpected docker command: $*" >&2; exit 10 ;;
 esac
-`,
-  );
-  await chmod(fakeDocker, 0o755);
-
-  const fakeCurl = join(fakeBin, 'curl');
-  await writeFile(
-    fakeCurl,
-    `#!/usr/bin/env bash
+`);
+  await writeExecutable(join(fakeBin, 'curl'), `#!/usr/bin/env bash
 set -euo pipefail
 url="\${!#}"
-if [[ "$url" == */version ]]; then
-  printf '%s' "\${EXPECTED_VERSION:?}"
-else
-  printf 'ok'
-fi
-`,
-  );
-  await chmod(fakeCurl, 0o755);
-
-  const fakeNginx = join(fakeBin, 'nginx');
-  await writeFile(
-    fakeNginx,
-    `#!/usr/bin/env bash
+if [[ "\${FAIL_PUBLIC_ENDPOINT:-0}" == 1 && "$url" == *:9099/* ]]; then exit 26; fi
+if [[ "$url" == */version ]]; then printf '%s' "\${EXPECTED_VERSION:?}"; else printf 'ok'; fi
+`);
+  await writeExecutable(join(fakeBin, 'nginx'), `#!/usr/bin/env bash
 set -euo pipefail
-if [[ -n "\${COMMAND_LOG:-}" ]]; then
-  printf 'nginx %s\\n' "$*" >> "$COMMAND_LOG"
+printf 'nginx %s\n' "$*" >> "$COMMAND_LOG"
+if [[ "\${1:-}" == -t ]]; then [[ "\${FAIL_NGINX_TEST:-0}" != 1 ]] || exit 23; exit 0; fi
+if [[ "\${1:-}" == -T ]]; then
+  [[ ! -f "$SERVER_ROOT/nginx/site.conf" ]] || cat "$SERVER_ROOT/nginx/site.conf"
+  [[ -z "\${EXTRA_NGINX_CONFIG:-}" ]] || printf '%s\n' "$EXTRA_NGINX_CONFIG"
+  exit 0
 fi
-`,
-  );
-  await chmod(fakeNginx, 0o755);
+if [[ "\${1:-}" == -s && "\${2:-}" == reload && "\${FAIL_NGINX_RELOAD_ONCE:-0}" == 1 && ! -f "$NGINX_FAIL_MARKER" ]]; then
+  : > "$NGINX_FAIL_MARKER"; exit 24
+fi
+`);
+  await writeExecutable(join(fakeBin, 'flock'), '#!/usr/bin/env bash\nexit 0\n');
+  await writeExecutable(join(fakeBin, 'install'), `#!/usr/bin/env bash
+set -euo pipefail
+target="\${!#}"
+if [[ "\${FAIL_STATE_INSTALL:-0}" == 1 && "$target" == */state/active.env ]]; then exit 25; fi
+exec /usr/bin/install "$@"
+`);
 
-  const fakePsql = join(fakeBin, 'psql');
-  await writeFile(fakePsql, '#!/usr/bin/env bash\nset -euo pipefail\n');
-  await chmod(fakePsql, 0o755);
+  return { root, fakeBin, serverProjectsRoot, commandLog, mode };
+}
 
-  const fakeMv = join(fakeBin, 'mv');
-  await writeFile(
-    fakeMv,
-    `#!/usr/bin/env bash
-set -euo pipefail
-if [[ "\${1:-}" == -Tf ]]; then
-  shift
-  exec /bin/mv -f "$@"
-fi
-exec /bin/mv "$@"
-`,
-  );
-  await chmod(fakeMv, 0o755);
-  return { directory, fakeBin, commandLog: join(directory, 'commands.log') };
+async function writeExecutable(path, content) {
+  await writeFile(path, content);
+  await chmod(path, 0o755);
 }
 
-function runBuild(fixture, extraEnv = {}, ...extraArguments) {
-  return spawnSync(
-    'bash',
-    ['deploy.sh', 'build', ...extraArguments],
-    {
-      cwd: fixture.directory,
-      encoding: 'utf8',
-      env: {
-        ...process.env,
-        PATH: `${fixture.fakeBin}:${process.env.PATH}`,
-        ...extraEnv,
-      },
+function run(root, args, fixture, extraEnv = {}) {
+  return spawnSync('bash', args, {
+    cwd: root,
+    encoding: 'utf8',
+    env: {
+      ...process.env,
+      PATH: `${fixture.fakeBin}:${process.env.PATH}`,
+      COMMAND_LOG: fixture.commandLog,
+      ...extraEnv,
     },
-  );
+  });
 }
 
-function currentDateText() {
-  const value = new Date();
-  return [
-    String(value.getFullYear()).padStart(4, '0'),
-    String(value.getMonth() + 1).padStart(2, '0'),
-    String(value.getDate()).padStart(2, '0'),
-  ].join('');
+function runBuild(fixture, extraEnv = {}, ...extraArgs) {
+  return run(fixture.root, ['deploy.sh', 'build', ...extraArgs], fixture, extraEnv);
 }
 
-test('build 首次生成 001、同日递增并只保留当前完整版本目录', async () => {
-  const fixture = await createBuildFixture();
-  const date = currentDateText();
+async function releaseVersion(root) {
+  return (await readFile(join(root, 'deploy/release.env'), 'utf8')).trim().slice('RELEASE_VERSION='.length);
+}
 
-  const first = runBuild(fixture);
-  assert.equal(first.status, 0, first.stderr);
-  assert.equal(
-    await readFile(join(fixture.directory, 'deploy', 'release.env'), 'utf8'),
-    `RELEASE_VERSION=${date}-001\n`,
-  );
-  assert.deepEqual(
-    (await readdir(join(fixture.directory, 'deploy'))).sort(),
-    [`${date}-001`, 'deploy.sh', 'release.env'].sort(),
-  );
-  assert.match(await readFile(join(fixture.directory, 'AGENTS.md'), 'utf8'), new RegExp(`${date}-001`));
-  assert.ok((await stat(join(
-    fixture.directory,
-    'deploy',
-    `${date}-001`,
-    'scripts',
-    'apply-migrations.sh',
-  ))).mode & 0o111);
-
-  const second = runBuild(fixture);
-  assert.equal(second.status, 0, second.stderr);
-  assert.equal(
-    await readFile(join(fixture.directory, 'deploy', 'release.env'), 'utf8'),
-    `RELEASE_VERSION=${date}-002\n`,
-  );
-  assert.deepEqual(
-    (await readdir(join(fixture.directory, 'deploy'))).sort(),
-    [`${date}-002`, 'deploy.sh', 'release.env'].sort(),
-  );
-  const agents = await readFile(join(fixture.directory, 'AGENTS.md'), 'utf8');
-  assert.match(agents, new RegExp(`${date}-001`));
-  assert.match(agents, new RegExp(`${date}-002`));
+function runValidator(root, version) {
+  return spawnSync(process.execPath, [
+    validator,
+    join(root, 'deploy/deploy.sh'),
+    join(root, `deploy/${version}/nginx/site.conf`),
+    join(root, `deploy/${version}/docker/docker-compose.blue-green.yml`),
+    join(root, 'deploy'),
+  ], { encoding: 'utf8' });
+}
+
+async function installOnServer(fixture) {
+  const serverRoot = join(fixture.serverProjectsRoot, 'fixture');
+  await cp(join(fixture.root, 'deploy'), serverRoot, { recursive: true, force: true });
+  await chmod(join(serverRoot, 'deploy.sh'), 0o755);
+  return serverRoot;
+}
+
+function runServer(fixture, serverRoot, command, extraEnv = {}, argument) {
+  const args = [join(serverRoot, 'deploy.sh'), command];
+  if (argument) args.push(argument);
+  return run(fixture.root, args, fixture, {
+    SERVER_ROOT: serverRoot,
+    NGINX_FAIL_MARKER: join(fixture.root, 'nginx-failed-once'),
+    ...extraEnv,
+  });
+}
+
+test('build 生成根 .env、双镜像和四服务完整包', async () => {
+  const fixture = await createFixture();
+  const result = runBuild(fixture);
+  assert.equal(result.status, 0, `stdout:\n${result.stdout}\nstderr:\n${result.stderr}`);
+  const version = await releaseVersion(fixture.root);
+  assert.deepEqual((await readdir(join(fixture.root, 'deploy'))).sort(), ['.env', version, 'deploy.sh', 'release.env'].sort());
+  await Promise.all([
+    access(join(fixture.root, `deploy/${version}/frontend-image.tar`)),
+    access(join(fixture.root, `deploy/${version}/backend-image.tar`)),
+  ]);
+  const validation = runValidator(fixture.root, version);
+  assert.equal(validation.status, 0, validation.stderr);
+  assert.match(validation.stdout, /valid dual-image deployment package/);
+  const log = await readFile(fixture.commandLog, 'utf8');
+  assert.match(log, new RegExp(`--tag fixture_frontend:${version}`));
+  assert.match(log, new RegExp(`--tag fixture_backend:${version}`));
+  assert.match(log, /--build-arg BACKEND_PORT=3000/);
+  assert.doesNotMatch(await readFile(join(fixture.root, `deploy/${version}/docker/docker-compose.blue-green.yml`), 'utf8'), /FRONTEND_CONTAINER_PORT|BACKEND_CONTAINER_PORT|_HEALTH_URL|_VERSION_URL/);
 });
 
-test('build 门禁失败时不写发布记录且不暴露 deploy 目录', async () => {
-  const fixture = await createBuildFixture();
-  const originalAgents = await readFile(join(fixture.directory, 'AGENTS.md'), 'utf8');
-  const result = runBuild(fixture, { FAIL_GATE: 'lint' });
+test('none 模式不伪造数据库文件，manual 模式只打包人工脚本', async () => {
+  const none = await createFixture();
+  assert.equal(runBuild(none).status, 0);
+  const noneVersion = await releaseVersion(none.root);
+  await assert.rejects(stat(join(none.root, `deploy/${noneVersion}/database`)));
+
+  const manual = await createFixture({ mode: 'manual' });
+  const built = runBuild(manual);
+  assert.equal(built.status, 0, built.stderr);
+  assert.match(built.stdout, /migration was not executed/);
+  const manualVersion = await releaseVersion(manual.root);
+  assert.ok((await stat(join(manual.root, `deploy/${manualVersion}/database/apply-migrations.sh`))).mode & 0o111);
+  assert.doesNotMatch(await readFile(join(manual.root, 'deploy/deploy.sh'), 'utf8'), /\bpsql\b/);
+});
 
-  assert.equal(result.status, 9);
-  assert.equal(await readFile(join(fixture.directory, 'AGENTS.md'), 'utf8'), originalAgents);
-  await assert.rejects(stat(join(fixture.directory, 'deploy')));
+test('连续构建的 deploy.sh、Compose 和 Nginx 配置字节一致', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const firstVersion = await releaseVersion(fixture.root);
+  const first = await configurationHashes(fixture.root, firstVersion);
+  assert.equal(runBuild(fixture).status, 0);
+  const secondVersion = await releaseVersion(fixture.root);
+  const second = await configurationHashes(fixture.root, secondVersion);
+  assert.notEqual(firstVersion, secondVersion);
+  assert.deepEqual(second, first);
 });
 
-test('build 拒绝损坏的 AGENTS 发布记录', async () => {
-  const fixture = await createBuildFixture({
-    agentsContent: '# Target\n\n## 发布记录\n\n| 版本 | 时间 |\n|---|---|\n',
-  });
-  const result = runBuild(fixture);
+async function configurationHashes(root, version) {
+  const paths = ['deploy/deploy.sh', `deploy/${version}/docker/docker-compose.blue-green.yml`, `deploy/${version}/nginx/site.conf`];
+  return Promise.all(paths.map(async (path) => createHash('sha256').update(await readFile(join(root, path))).digest('hex')));
+}
 
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /release record table/);
-  await assert.rejects(stat(join(fixture.directory, 'deploy')));
+async function rewriteManifest(versionRoot, directory = versionRoot) {
+  const files = [];
+  async function walk(current) {
+    for (const entry of await readdir(current, { withFileTypes: true })) {
+      const path = join(current, entry.name);
+      if (entry.isDirectory()) await walk(path);
+      else if (entry.isFile() && entry.name !== 'manifest.sha256') files.push(path);
+    }
+  }
+  await walk(directory);
+  const lines = await Promise.all(files.sort().map(async (path) => {
+    const relative = path.slice(versionRoot.length + 1).split('\\').join('/');
+    const hash = createHash('sha256').update(await readFile(path)).digest('hex');
+    return `${hash}  ${relative}`;
+  }));
+  await writeFile(join(versionRoot, 'manifest.sha256'), `${lines.join('\n')}\n`);
+}
+
+test('失败构建保留上一发布包和发布账本', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const version = await releaseVersion(fixture.root);
+  const agents = await readFile(join(fixture.root, 'AGENTS.md'), 'utf8');
+  const failed = runBuild(fixture, { FAIL_GATE: 'lint' });
+  assert.equal(failed.status, 9);
+  assert.equal(await releaseVersion(fixture.root), version);
+  assert.equal(await readFile(join(fixture.root, 'AGENTS.md'), 'utf8'), agents);
 });
 
-test('build 拒绝把生产秘密从迁移目录带入发布包', async () => {
-  const fixture = await createBuildFixture({ secretMigration: true });
-  const originalAgents = await readFile(join(fixture.directory, 'AGENTS.md'), 'utf8');
+test('dotenv 被作为数据解析，不执行命令替换或覆盖脚本 PATH', async () => {
+  const fixture = await createFixture({ extraEnv: 'UNUSED_VALUE=$(touch should-not-exist)\nPATH=/malicious\n' });
   const result = runBuild(fixture);
+  assert.equal(result.status, 0, result.stderr);
+  await assert.rejects(access(join(fixture.root, 'should-not-exist')));
+});
 
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /secret file/);
-  assert.equal(await readFile(join(fixture.directory, 'AGENTS.md'), 'utf8'), originalAgents);
-  await assert.rejects(stat(join(fixture.directory, 'deploy')));
+test('build 拒绝重复键、漂移基础镜像和额外版本参数', async () => {
+  const duplicate = await createFixture({ extraEnv: 'PROJECT_NAME=duplicate\n' });
+  assert.notEqual(runBuild(duplicate).status, 0);
+  const mutable = await createFixture();
+  await writeFile(join(mutable.root, '.env'), (await readFile(join(mutable.root, '.env'), 'utf8')).replace(/nginx@sha256:[0-9a-f]+/, 'nginx:latest'));
+  assert.notEqual(runBuild(mutable).status, 0);
+  const extra = await createFixture();
+  assert.equal(runBuild(extra, {}, '20260808-001').status, 2);
+  const logDirectory = await createFixture({ extraEnv: 'LOG_DIR=/tmp/logs\n' });
+  const rejected = runBuild(logDirectory);
+  assert.notEqual(rejected.status, 0);
+  assert.match(rejected.stderr, /must not configure log directories/);
+  const legacy = await createFixture({ extraEnv: 'FRONTEND_CONTAINER_PORT=8080\n' });
+  const legacyRejected = runBuild(legacy);
+  assert.notEqual(legacyRejected.status, 0);
+  assert.match(legacyRejected.stderr, /legacy duplicate environment key/);
+  const reverseInclude = await createFixture();
+  await writeFile(join(reverseInclude.root, '.dockerignore'), `${await readFile(join(reverseInclude.root, '.dockerignore'), 'utf8')}!.env\n`);
+  const reverseRejected = runBuild(reverseInclude);
+  assert.notEqual(reverseRejected.status, 0);
+  assert.match(reverseRejected.stderr, /forbidden reverse include/);
 });
 
-test('build 在 Docker ignore 不能排除秘密时明确失败', async () => {
-  const fixture = await createBuildFixture();
-  await writeFile(join(fixture.directory, '.dockerignore'), '.env\ndeploy/\n');
-  const originalAgents = await readFile(join(fixture.directory, 'AGENTS.md'), 'utf8');
-  const result = runBuild(fixture);
+test('validator 拒绝缺失前端镜像、镜像 fallback 和嵌套日志', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const version = await releaseVersion(fixture.root);
+  await unlink(join(fixture.root, `deploy/${version}/frontend-image.tar`));
+  assert.notEqual(runValidator(fixture.root, version).status, 0);
+
+  assert.equal(runBuild(fixture).status, 0);
+  const next = await releaseVersion(fixture.root);
+  const composePath = join(fixture.root, `deploy/${next}/docker/docker-compose.blue-green.yml`);
+  await writeFile(composePath, (await readFile(composePath, 'utf8')).replace('${FRONTEND_IMAGE:?FRONTEND_IMAGE is required}', '${FRONTEND_IMAGE:-fallback}').replace('../../logs:/app/logs', '../../logs/frontend:/app/logs'));
+  const validation = runValidator(fixture.root, next);
+  assert.notEqual(validation.status, 0);
+  assert.match(validation.stderr, /fallback|logs/);
+});
 
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /Docker ignore file is missing required pattern/);
-  assert.equal(await readFile(join(fixture.directory, 'AGENTS.md'), 'utf8'), originalAgents);
-  await assert.rejects(stat(join(fixture.directory, 'deploy')));
+test('validator 拒绝版本目录符号链接', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const version = await releaseVersion(fixture.root);
+  await symlink('../outside', join(fixture.root, `deploy/${version}/linked-file`));
+  const validation = runValidator(fixture.root, version);
+  assert.notEqual(validation.status, 0);
+  assert.match(validation.stderr, /symbolic links/);
 });
 
-test('build 和 start 都拒绝人工版本参数', async () => {
-  const fixture = await createBuildFixture();
-  const build = runBuild(fixture, {}, '20260730-001');
-  const start = spawnSync(
-    'bash',
-    ['deploy.sh', 'start', '20260730-001'],
-    { cwd: fixture.directory, encoding: 'utf8' },
-  );
+test('服务器拒绝标签不匹配的镜像归档且不执行 docker load', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const version = await releaseVersion(fixture.root);
+  const versionRoot = join(fixture.root, `deploy/${version}`);
+  const badArchiveRoot = await temporary('bad-image-');
+  await writeFile(join(badArchiveRoot, 'manifest.json'), `[{"Config":"config.json","RepoTags":["fixture_frontend:${version}","other_frontend:bad"],"Layers":[]}]\n`);
+  await writeFile(join(badArchiveRoot, 'config.json'), '{}\n');
+  const tarResult = spawnSync('/usr/bin/tar', ['-cf', join(versionRoot, 'frontend-image.tar'), '-C', badArchiveRoot, 'manifest.json', 'config.json'], { encoding: 'utf8' });
+  assert.equal(tarResult.status, 0, tarResult.stderr);
+  await rewriteManifest(versionRoot);
+  const serverRoot = await installOnServer(fixture);
+  await writeFile(fixture.commandLog, '');
+  const started = runServer(fixture, serverRoot, 'start', { EXPECTED_VERSION: version });
+  assert.notEqual(started.status, 0);
+  assert.match(started.stderr, /exactly one expected tag/);
+  assert.doesNotMatch(await readFile(fixture.commandLog, 'utf8'), /docker load/);
+});
 
-  assert.equal(build.status, 2);
-  assert.match(build.stderr, /usage/);
-  assert.equal(start.status, 2);
-  assert.match(start.stderr, /usage/);
+test('start、replace 和 rollback 成对切换前后端', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const first = await releaseVersion(fixture.root);
+  const serverRoot = await installOnServer(fixture);
+  const started = runServer(fixture, serverRoot, 'start', { EXPECTED_VERSION: first });
+  assert.equal(started.status, 0, started.stderr);
+  assert.match(await readFile(join(serverRoot, 'state/active.env'), 'utf8'), new RegExp(`ACTIVE_COLOR=blue[\\s\\S]*${first}`));
+
+  assert.equal(runBuild(fixture).status, 0);
+  const second = await releaseVersion(fixture.root);
+  await cp(join(fixture.root, 'deploy'), serverRoot, { recursive: true, force: true });
+  const replaced = runServer(fixture, serverRoot, 'replace', { EXPECTED_VERSION: second });
+  assert.equal(replaced.status, 0, replaced.stderr);
+  assert.match(await readFile(join(serverRoot, 'state/active.env'), 'utf8'), /ACTIVE_COLOR=green/);
+  assert.match(await readFile(join(serverRoot, 'state/previous.env'), 'utf8'), new RegExp(first));
+  const upstream = await readFile(join(serverRoot, 'nginx/active-upstreams.conf'), 'utf8');
+  assert.match(upstream, /fixture_frontend_active/);
+  assert.match(upstream, /fixture_backend_active/);
+
+  const rolledBack = runServer(fixture, serverRoot, 'rollback', { EXPECTED_VERSION: first }, first);
+  assert.equal(rolledBack.status, 0, rolledBack.stderr);
+  assert.match(await readFile(join(serverRoot, 'state/active.env'), 'utf8'), new RegExp(first));
 });
 
-test('上传到任意目录后 start 从 release.env 完成首个蓝色实例切换', async () => {
-  const fixture = await createBuildFixture();
-  const build = runBuild(fixture);
-  assert.equal(build.status, 0, build.stderr);
-  const releaseEnv = await readFile(join(fixture.directory, 'deploy', 'release.env'), 'utf8');
-  const version = releaseEnv.trim().slice('RELEASE_VERSION='.length);
+test('restart、stop、status 只操作当前颜色的一对容器', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const version = await releaseVersion(fixture.root);
+  const serverRoot = await installOnServer(fixture);
+  assert.equal(runServer(fixture, serverRoot, 'start', { EXPECTED_VERSION: version }).status, 0);
+  await writeFile(fixture.commandLog, '');
+  assert.equal(runServer(fixture, serverRoot, 'restart', { EXPECTED_VERSION: version }).status, 0);
+  assert.equal(runServer(fixture, serverRoot, 'stop', { EXPECTED_VERSION: version }).status, 0);
+  const statusResult = runServer(fixture, serverRoot, 'status', { EXPECTED_VERSION: version });
+  assert.equal(statusResult.status, 0, statusResult.stderr);
+  assert.match(statusResult.stdout, new RegExp(version));
+  const log = await readFile(fixture.commandLog, 'utf8');
+  assert.match(log, /up -d --force-recreate frontend-blue backend-blue/);
+  assert.match(log, /stop frontend-blue backend-blue/);
+});
 
-  const serverRoot = join(fixture.directory, 'chosen server root');
-  await cp(join(fixture.directory, 'deploy'), serverRoot, { recursive: true });
+test('remove 只删除本项目容器、网络和两个镜像仓库并保留日志', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const serverRoot = await installOnServer(fixture);
+  await mkdir(join(serverRoot, 'logs'), { recursive: true });
+  await writeFile(join(serverRoot, 'logs/backend.log'), 'keep\n');
+  await writeFile(fixture.commandLog, '');
+  const removed = runServer(fixture, serverRoot, 'remove');
+  assert.equal(removed.status, 0, removed.stderr);
+  const log = await readFile(fixture.commandLog, 'utf8');
+  assert.match(log, /docker rm -f c111 c222/);
+  assert.match(log, /docker network rm n111/);
+  assert.match(log, /docker image rm -f fixture_backend:20260808-001 fixture_frontend:20260808-001|docker image rm -f fixture_frontend:20260808-001 fixture_backend:20260808-001/);
+  assert.doesNotMatch(log, /other_project_frontend:shared/);
+  assert.equal(await readFile(join(serverRoot, 'logs/backend.log'), 'utf8'), 'keep\n');
+  await access(join(serverRoot, 'release.env'));
+});
+
+test('端口冲突在加载镜像或启动容器前失败', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const version = await releaseVersion(fixture.root);
+  const serverRoot = await installOnServer(fixture);
+  await mkdir(join(fixture.serverProjectsRoot, 'other/nginx'), { recursive: true });
+  await writeFile(join(fixture.serverProjectsRoot, 'other/nginx/site.conf'), '# wdyy-project: other\n# wdyy-port: 9099\nserver { listen 9099; }\n');
+  await writeFile(fixture.commandLog, '');
+  const result = runServer(fixture, serverRoot, 'start', { EXPECTED_VERSION: version });
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /already used by another project/);
+  const log = await readFile(fixture.commandLog, 'utf8');
+  assert.doesNotMatch(log, /docker load|docker compose/);
+});
+
+test('展开的全局 Nginx 中存在非标准项目端口时也拒绝部署', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const version = await releaseVersion(fixture.root);
+  const serverRoot = await installOnServer(fixture);
+  await writeFile(fixture.commandLog, '');
+  const result = runServer(fixture, serverRoot, 'start', {
+    EXPECTED_VERSION: version,
+    EXTRA_NGINX_CONFIG: 'server {\n  listen 9099;\n}',
+  });
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /expanded Nginx configuration/);
+  assert.doesNotMatch(await readFile(fixture.commandLog, 'utf8'), /docker load|docker compose/);
+});
+
+test('其他项目预留任一 Docker blue-green 宿主机端口时在启动前失败', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const version = await releaseVersion(fixture.root);
+  const serverRoot = await installOnServer(fixture);
+  await mkdir(join(fixture.serverProjectsRoot, 'other/nginx'), { recursive: true });
   await writeFile(
-    join(serverRoot, '.env.production'),
-    `PROJECT_NAME=fixture
-DATABASE_URL=postgresql://fixture
-BACKEND_BIND_IP=127.0.0.1
-BACKEND_LISTEN_HOST=0.0.0.0
-BACKEND_CONTAINER_PORT=3000
-BACKEND_CONTAINER_HEALTH_URL=http://127.0.0.1:3000/health
-BLUE_PORT=3001
-GREEN_PORT=3002
-BLUE_HEALTH_URL=http://127.0.0.1:3001/health
-GREEN_HEALTH_URL=http://127.0.0.1:3002/health
-BLUE_VERSION_URL=http://127.0.0.1:3001/version
-GREEN_VERSION_URL=http://127.0.0.1:3002/version
-BLUE_UPSTREAM=127.0.0.1:3001
-GREEN_UPSTREAM=127.0.0.1:3002
-BACKEND_PROXY_URL=http://backend_active
-`,
-  );
-  const start = spawnSync(
-    'bash',
-    [join(serverRoot, 'deploy.sh'), 'start'],
-    {
-      cwd: fixture.directory,
-      encoding: 'utf8',
-      env: {
-        ...process.env,
-        PATH: `${fixture.fakeBin}:${process.env.PATH}`,
-        COMMAND_LOG: fixture.commandLog,
-        EXPECTED_VERSION: version,
-      },
-    },
+    join(fixture.serverProjectsRoot, 'other/nginx/site.conf'),
+    '# wdyy-project: other\n# wdyy-port: 9100\n# wdyy-docker-ports: 19091,29092,29093,29094\nserver { listen 9100; }\n',
   );
+  await writeFile(fixture.commandLog, '');
+  const result = runServer(fixture, serverRoot, 'start', { EXPECTED_VERSION: version });
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /Docker host port 19091/);
+  assert.doesNotMatch(await readFile(fixture.commandLog, 'utf8'), /docker load|docker compose/);
+});
+
+test('其他运行中容器发布项目 Docker 端口时在镜像加载前失败', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const version = await releaseVersion(fixture.root);
+  const serverRoot = await installOnServer(fixture);
+  await writeFile(fixture.commandLog, '');
+  const result = runServer(fixture, serverRoot, 'start', {
+    EXPECTED_VERSION: version,
+    DOCKER_RUNNING_PORTS: 'other_project|0.0.0.0:19093->3000/tcp, [::]:19093->3000/tcp',
+  });
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /Docker host port 19093 is already published by another container/);
+  assert.doesNotMatch(await readFile(fixture.commandLog, 'utf8'), /docker load|docker compose/);
+});
+
+test('replace 的 Nginx reload 失败时恢复旧 upstream 和状态', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const first = await releaseVersion(fixture.root);
+  const serverRoot = await installOnServer(fixture);
+  assert.equal(runServer(fixture, serverRoot, 'start', { EXPECTED_VERSION: first }).status, 0);
+  const oldUpstream = await readFile(join(serverRoot, 'nginx/active-upstreams.conf'), 'utf8');
+  const oldState = await readFile(join(serverRoot, 'state/active.env'), 'utf8');
+  assert.equal(runBuild(fixture).status, 0);
+  const second = await releaseVersion(fixture.root);
+  await cp(join(fixture.root, 'deploy'), serverRoot, { recursive: true, force: true });
+  const failed = runServer(fixture, serverRoot, 'replace', { EXPECTED_VERSION: second, FAIL_NGINX_RELOAD_ONCE: '1' });
+  assert.notEqual(failed.status, 0);
+  assert.equal(await readFile(join(serverRoot, 'nginx/active-upstreams.conf'), 'utf8'), oldUpstream);
+  assert.equal(await readFile(join(serverRoot, 'state/active.env'), 'utf8'), oldState);
+});
+
+test('首次切流后的外部端口验证失败时不提交状态并移除候选 Nginx 文件', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const version = await releaseVersion(fixture.root);
+  const serverRoot = await installOnServer(fixture);
+  const failed = runServer(fixture, serverRoot, 'start', { EXPECTED_VERSION: version, FAIL_PUBLIC_ENDPOINT: '1' });
+  assert.notEqual(failed.status, 0);
+  assert.match(failed.stderr, /public endpoint verification failed/);
+  await assert.rejects(access(join(serverRoot, 'state/active.env')));
+  await assert.rejects(access(join(serverRoot, 'nginx/site.conf')));
+  await assert.rejects(access(join(serverRoot, 'nginx/active-upstreams.conf')));
+});
+
+test('状态提交失败时恢复旧流量和旧状态', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const first = await releaseVersion(fixture.root);
+  const serverRoot = await installOnServer(fixture);
+  assert.equal(runServer(fixture, serverRoot, 'start', { EXPECTED_VERSION: first }).status, 0);
+  const oldUpstream = await readFile(join(serverRoot, 'nginx/active-upstreams.conf'), 'utf8');
+  const oldState = await readFile(join(serverRoot, 'state/active.env'), 'utf8');
+  assert.equal(runBuild(fixture).status, 0);
+  const second = await releaseVersion(fixture.root);
+  await cp(join(fixture.root, 'deploy'), serverRoot, { recursive: true, force: true });
+  const failed = runServer(fixture, serverRoot, 'replace', { EXPECTED_VERSION: second, FAIL_STATE_INSTALL: '1' });
+  assert.notEqual(failed.status, 0);
+  assert.equal(await readFile(join(serverRoot, 'nginx/active-upstreams.conf'), 'utf8'), oldUpstream);
+  assert.equal(await readFile(join(serverRoot, 'state/active.env'), 'utf8'), oldState);
+});
 
-  assert.equal(start.status, 0, start.stderr);
-  assert.equal(await readlink(join(serverRoot, 'current')), `releases/${version}`);
-  assert.match(await readFile(join(serverRoot, 'state', 'active.env'), 'utf8'), /ACTIVE_COLOR=blue/);
-  assert.match(await readFile(join(serverRoot, 'state', 'active.env'), 'utf8'), new RegExp(version));
-  assert.ok(await readFile(join(serverRoot, 'releases', version, 'index.html'), 'utf8'));
-  const nginxSite = await readFile(join(serverRoot, 'nginx', 'site.conf'), 'utf8');
-  assert.ok(!nginxSite.includes('__DEPLOY_ROOT__'));
-  assert.ok(!nginxSite.includes('__BACKEND_PROXY_URL__'));
-  assert.ok(nginxSite.includes(serverRoot));
-  assert.match(nginxSite, /proxy_pass http:\/\/backend_active;/);
-  const commandLog = await readFile(fixture.commandLog, 'utf8');
-  assert.match(commandLog, /migration/);
-  assert.match(commandLog, /docker load/);
-  assert.match(commandLog, /backend-blue/);
-  assert.match(commandLog, /nginx -t/);
-  assert.match(commandLog, /nginx -s reload/);
+test('服务器命令拒绝额外参数和错误部署根', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const serverRoot = await installOnServer(fixture);
+  assert.equal(runServer(fixture, serverRoot, 'start', {}, 'unexpected').status, 2);
+  const wrongRoot = join(fixture.root, 'wrong');
+  await cp(join(fixture.root, 'deploy'), wrongRoot, { recursive: true });
+  const wrong = runServer(fixture, wrongRoot, 'status');
+  assert.notEqual(wrong.status, 0);
+  assert.match(wrong.stderr, /server deploy root must be exactly/);
 });