@wdyy/skills 0.1.9 → 0.1.11

package/.well-known/skills/index.json

@@ -7,7 +7,7 @@
     },
     {
       "name": "wdyy-deployment-standard",
-      "description": "基于标准五段根 .env，为无 CI/CD 的多项目 Linux 服务器生成确定性的前后端双 Docker 发布配置、本地 deploy.sh build 完整打包、人工上传及按独立端口执行蓝绿启动、替换、重启、停止、删除和回滚。Use when 规划、实现、审查或执行 `/xxzx/home/项目目录` 下的手工生产部署时。",
+      "description": "基于标准五段根 .env，为无 CI/CD 项目生成确定性的前后端双 Docker 发布配置、本地 deploy.sh build 完整打包、人工上传及按独立端口执行蓝绿启动、替换、重启、停止、删除和回滚；部署根由脚本位置确定且不处理数据库迁移。Use when 规划、实现、审查或执行手工生产部署时。",
       "files": ["SKILL.md", "agents/openai.yaml", "reference/linux-deployment-rules.md", "scripts/generate-deployment-files.mjs", "scripts/generate-deployment-files.test.mjs", "scripts/validate-deployment-package.mjs", "scripts/validate-deployment-package.test.mjs", "templates/Dockerfile.template", "templates/frontend.Dockerfile.template", "templates/frontend-container.conf.template", "templates/env.example.template", "templates/deploy.sh.template", "templates/docker-compose.blue-green.yml", "templates/dockerignore.template", "templates/nginx-upstream.template.conf"]
     },
     {

package/.well-known/skills/wdyy-deployment-standard/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: wdyy-deployment-standard
-description: 基于标准五段根 .env，为无 CI/CD 的多项目 Linux 服务器生成确定性的前后端双 Docker 发布配置、本地 deploy.sh build 完整打包、人工上传及按独立端口执行蓝绿启动、替换、重启、停止、删除和回滚。Use when 规划、实现、审查或执行 `/xxzx/home/项目目录` 下的手工生产部署时。
+description: 基于标准五段根 .env，为无 CI/CD 项目生成确定性的前后端双 Docker 发布配置、本地 deploy.sh build 完整打包、人工上传及按独立端口执行蓝绿启动、替换、重启、停止、删除和回滚；部署根由脚本位置确定且不处理数据库迁移。Use when 规划、实现、审查或执行手工生产部署时。
 ---
 
 # 企业部署规范
@@ -19,15 +19,15 @@ description: 基于标准五段根 .env，为无 CI/CD 的多项目 Linux 服务
 
 ## 固定契约
 
-- 项目名只允许小写字母、数字和下划线，并与服务器目录 `/xxzx/home/<项目名称>` 对应。
+- 项目名只允许小写字母、数字和下划线；服务器部署根由上传后的 `deploy.sh` 物理路径确定。
 - 两个镜像必须精确命名为 `<项目名称>_frontend:<YYYYMMDD-NNN>` 和 `<项目名称>_backend:<YYYYMMDD-NNN>`。
 - Compose 必须包含 frontend-blue、backend-blue、frontend-green、backend-green；同一颜色的前后端作为一个切流单元。
 - 宿主机 Nginx 只监听根 `.env` 的 `PROJECT_HTTP_PORT`，`/api/` 代理活动后端，其他请求代理活动前端。
 - 所有容器只把项目根 `./logs` 挂载到 `/app/logs`；日志文件直接位于 `logs/`，不得创建服务、颜色或日期子目录。
 - 根 `.env` 原样复制到 `deploy/.env` 并人工上传，但必须被 `.dockerignore` 排除，且不得进入版本目录或任一镜像。
-- `FRONTEND_BASE_IMAGE` 与 `BACKEND_BASE_IMAGE` 使用非空 Docker 镜像引用；可直接使用本地带标签镜像。相同标签在不同时间重新构建时可能对应不同基础镜像内容，但已导出的项目成品镜像仍按版本确定部署。
+- `.env.example` 是环境主模板，内置 `FRONTEND_BASE_IMAGE=nginx:stable` 与 `BACKEND_BASE_IMAGE=node:24-alpine3.24`；`.env` 可在生成后显式覆盖。相同标签在不同时间重新构建时可能对应不同基础镜像内容，但已导出的项目成品镜像仍按版本确定部署。
 - 环境文件固定按“前端、后端、数据库、API、部署”排列；部署生成器保留前四段和已有值，只扩充部署段。
-- `DATABASE_MIGRATION_MODE=manual` 时只打包迁移与执行脚本；`none` 时不要求数据库文件。任何部署命令都不得自动访问数据库。
+- 发布链路不接受数据库迁移参数，也不打包、校验或执行迁移文件。
 - 相同输入生成的 deploy.sh、Compose、Nginx 配置必须字节一致；版本指针、镜像归档和 manifest 可随发布变化。
 
 ## 工作流
@@ -35,18 +35,16 @@ description: 基于标准五段根 .env，为无 CI/CD 的多项目 Linux 服务
 1. 使用 `pnpm dev` 完成开发测试。
 2. 执行不带额外参数的 `./deploy.sh build`；从 `AGENTS.md` 唯一“发布记录”表生成 `YYYYMMDD-NNN`。
 3. 依次通过测试、lint、类型检查、构建、双镜像语义检查、包校验和配置确定性检查；成功后才替换 `deploy/` 并写发布记录。
-4. 人工把 `deploy/` 全部内容上传到 `.env` 声明的 `<SERVER_PROJECTS_ROOT>/<PROJECT_NAME>`；生产值不得通过命令行传入。
-5. 数据库模式为 manual 时，由工程师单独执行版本包中的迁移脚本并确认结果。
-6. 首次部署执行 `./deploy.sh start`；后续新版本执行 `./deploy.sh replace`。
-7. 通过 `restart`、`stop`、`status`、`rollback <version>` 管理当前项目；`remove` 只删除本项目容器、网络及两个精确镜像仓库。
+4. 人工把 `deploy/` 全部内容上传到目标部署目录；生产值不得通过命令行传入。
+5. 首次部署执行 `./deploy.sh start`；后续新版本执行 `./deploy.sh replace`。
+6. 通过 `restart`、`stop`、`status`、`rollback <version>` 管理当前项目；`remove` 只删除本项目容器、网络及两个精确镜像仓库。
 
-## Nginx 多项目隔离
+## Nginx 当前项目边界
 
-- 运维只在服务器初次接入时让共享 Nginx include `/xxzx/home/*/nginx/site.conf`；部署脚本不得编辑该全局配置。
 - 每个项目只写自身 `nginx/site.conf` 和 `nginx/active-upstreams.conf`。
 - upstream 名称由严格项目名确定，不接受自由文本配置。
-- 在共享文件锁内检查其他项目配置和运行中容器的实际发布端口、安装候选配置、运行进程级 `nginx -t` 和 reload；失败时恢复本项目旧文件。
-- 其他项目配置错误可以阻止本次 reload，但不得强制跳过检查或改写其他项目文件。
+- 安装候选配置后运行 `nginx -t` 和 reload；失败时恢复本项目旧文件。
+- 不扫描、校验或修改其他项目配置、端口或 Nginx include。
 
 ## 禁止事项
 
@@ -66,7 +64,7 @@ description: 基于标准五段根 .env，为无 CI/CD 的多项目 Linux 服务
 - [ ] `.env` 与 `.env.example` 的五段、变量顺序一致，部署段键相同且无重复 URL/端口配置。
 - [ ] 外部项目端口唯一；Nginx 一次同时切换前后端，失败恢复旧流量和状态。
 - [ ] start、replace、restart、stop、remove、status、rollback 行为与资源范围均通过测试。
-- [ ] manual/none 两种数据库模式均通过测试，部署脚本不存在数据库执行路径。
+- [ ] 不存在数据库迁移参数、迁移包内容或数据库执行路径。
 - [ ] 连续两次构建的配置文件一致，失败不写发布记录、不暴露半成品。
 - [ ] `deploy/` 含根 `.env`，但版本目录、Docker 上下文和镜像不含秘密文件。
 - [ ] 替换或删除容器后，项目根 `logs/` 内容仍保留。

package/.well-known/skills/wdyy-deployment-standard/reference/linux-deployment-rules.md

@@ -33,7 +33,6 @@ DB_PASSWORD=
 DB_NAME=
 DB_SCHEMA=
 PROJECT_NAME=example_project
-SERVER_PROJECTS_ROOT=/xxzx/home
 PROJECT_HTTP_PORT=9099
 DOCKER_BIND_IP=127.0.0.1
 FRONTEND_BLUE_PORT=19091
@@ -42,7 +41,6 @@ BACKEND_BLUE_PORT=19093
 BACKEND_GREEN_PORT=19094
 FRONTEND_BASE_IMAGE=nginx:stable
 BACKEND_BASE_IMAGE=node:24-alpine3.24
-DATABASE_MIGRATION_MODE=none
 ```
 
 `FRONTEND_URL`、`FRONTEND_PORT`、`BACKEND_URL`、`BACKEND_PORT` 是应用监听的唯一来源；容器、蓝绿和项目入口的健康/版本 URL 必须由对应主机、端口与固定路径确定性构造。不得增加 `FRONTEND_CONTAINER_PORT`、`BACKEND_CONTAINER_PORT`、`BACKEND_LISTEN_HOST`、`*_HEALTH_URL` 或 `*_VERSION_URL`。通配监听地址 `0.0.0.0` 仅在主动本机探测时转换为 `127.0.0.1`。
@@ -51,7 +49,7 @@ DATABASE_MIGRATION_MODE=none
 
 `.env` 权限必须为 `0600` 或只读的 `0400`。部署脚本只把明确的部署键载入自身环境；数据库密码、JWT 等其他应用键保留在文件中供 Compose 注入容器，不得改变脚本的 `PATH`、Shell 选项或命令行为。
 
-可选路径键为 `FRONTEND_DOCKERFILE`、`BACKEND_DOCKERFILE`、`MIGRATIONS_SOURCE`、`MIGRATION_RUNNER_SOURCE`、`DEPLOY_CONFIG_DIR`；未设置时只能使用与目标项目真实结构一致且已验证的标准路径。
+可选路径键为 `FRONTEND_DOCKERFILE`、`BACKEND_DOCKERFILE`、`DEPLOY_CONFIG_DIR`；未设置时只能使用与目标项目真实结构一致且已验证的标准路径。
 
 ## Docker 与日志
 
@@ -88,16 +86,13 @@ deploy/
     ├── manifest.sha256
     ├── docker/docker-compose.blue-green.yml
     ├── nginx/site.conf
-    └── database/                 # 仅 manual 模式
-        ├── migrations/
-        └── apply-migrations.sh
 ```
 
 `release.env` 只包含当前版本。manifest 覆盖版本目录内除自身外的全部普通文件，禁止符号链接、硬链接秘密、绝对路径和 `..`。根 `.env` 可上传，但版本目录与镜像不得包含它。
 
 ## 服务器部署和 Nginx
 
-上传目标必须是 `${SERVER_PROJECTS_ROOT}/${PROJECT_NAME}`，生产值为 `/xxzx/home/<项目名称>`。脚本通过自身物理路径验证该关系，不依赖调用者当前目录。
+上传目标由工程师确定；脚本通过自身物理路径确定部署根，不依赖调用者当前目录。
 
 共享 Nginx 主配置由运维预先 include `/xxzx/home/*/nginx/site.conf`。项目脚本不得写 `/etc/nginx` 或其他项目，只维护：
 
@@ -122,10 +117,7 @@ site 监听 `PROJECT_HTTP_PORT`，并带项目名、外部端口及四个 Docker
 
 ## 数据库
 
-- `DATABASE_MIGRATION_MODE=none`：版本包不要求数据库目录。
-- `DATABASE_MIGRATION_MODE=manual`：必须打包完整迁移目录和可执行脚本。
-- deploy.sh 的任何服务器命令都不得调用迁移脚本、psql 或数据库客户端。
-- build 完成和服务器 start/replace 必须明确提示 manual 操作尚需工程师单独执行，不得声称已迁移。
+部署 Skill 不接受数据库迁移参数，也不打包、校验、提示或执行迁移文件。
 
 ## 失败边界
 

package/.well-known/skills/wdyy-deployment-standard/scripts/generate-deployment-files.mjs

@@ -22,9 +22,9 @@ const baseKeys = new Map([
   ['数据库', ['DB_URL', 'DB_PORT', 'DB_USER', 'DB_PASSWORD', 'DB_NAME', 'DB_SCHEMA']],
 ]);
 const deploymentKeys = [
-  'PROJECT_NAME', 'SERVER_PROJECTS_ROOT', 'PROJECT_HTTP_PORT', 'DOCKER_BIND_IP',
+  'PROJECT_NAME', 'PROJECT_HTTP_PORT', 'DOCKER_BIND_IP',
   'FRONTEND_BLUE_PORT', 'FRONTEND_GREEN_PORT', 'BACKEND_BLUE_PORT', 'BACKEND_GREEN_PORT',
-  'FRONTEND_BASE_IMAGE', 'BACKEND_BASE_IMAGE', 'DATABASE_MIGRATION_MODE',
+  'FRONTEND_BASE_IMAGE', 'BACKEND_BASE_IMAGE',
 ];
 
 function parseEnvironmentStructure(text, relativeTarget, requireExampleDefaults, exampleValues) {
@@ -73,8 +73,14 @@ function parseEnvironmentStructure(text, relativeTarget, requireExampleDefaults,
   if (actualDeploymentKeys.length !== 0 && actualDeploymentKeys.join('|') !== deploymentKeys.join('|')) {
     throw new Error(`${relativeTarget} # 部署 keys must be empty or exactly: ${deploymentKeys.join(', ')}`);
   }
-  if (requireExampleDefaults && sections.get('部署').some(({ value }) => value !== '')) {
-    throw new Error(`${relativeTarget} deployment example values must be empty`);
+  if (requireExampleDefaults && sections.get('部署').some(({ key, value }) => !['FRONTEND_BASE_IMAGE', 'BACKEND_BASE_IMAGE'].includes(key) && value !== '')) {
+    throw new Error(`${relativeTarget} deployment example values must be empty except base-image defaults`);
+  }
+  if (requireExampleDefaults) {
+    for (const key of ['FRONTEND_BASE_IMAGE', 'BACKEND_BASE_IMAGE']) {
+      const entry = sections.get('部署').find((item) => item.key === key);
+      if (entry && entry.value !== exampleValues.get(key)) throw new Error(`${relativeTarget} must keep the standard default for ${key}`);
+    }
   }
   return {
     extended: actualDeploymentKeys.length === deploymentKeys.length,
@@ -83,7 +89,7 @@ function parseEnvironmentStructure(text, relativeTarget, requireExampleDefaults,
 }
 
 function extendDeploymentSection(text) {
-  return `${text.trimEnd()}\n${deploymentKeys.map((key) => `${key}=`).join('\n')}\n`;
+  return `${text.trimEnd()}\n${deploymentKeys.map((key) => `${key}=${['FRONTEND_BASE_IMAGE', 'BACKEND_BASE_IMAGE'].includes(key) ? exampleValues.get(key) : ''}`).join('\n')}\n`;
 }
 
 const args = process.argv.slice(2);

package/.well-known/skills/wdyy-deployment-standard/scripts/generate-deployment-files.test.mjs

@@ -38,7 +38,9 @@ test('确定性生成全部标准文件并通过 check', async () => {
   const environment = await readFile(join(root, '.env'), 'utf8');
   const example = await readFile(join(root, '.env.example'), 'utf8');
   assert.match(environment, /^# 前端\nFRONTEND_URL=0\.0\.0\.0\nFRONTEND_PORT=5173$/m);
-  assert.match(environment, /^# 部署\nPROJECT_NAME=\nSERVER_PROJECTS_ROOT=/m);
+  assert.match(environment, /^# 部署\nPROJECT_NAME=\nPROJECT_HTTP_PORT=/m);
+  assert.match(environment, /^FRONTEND_BASE_IMAGE=nginx:stable$/m);
+  assert.match(environment, /^BACKEND_BASE_IMAGE=node:24-alpine3\.24$/m);
   assert.equal(example, environment);
   if (process.platform !== 'win32') assert.equal((await stat(join(root, '.env'))).mode & 0o777, 0o600);
 });

package/.well-known/skills/wdyy-deployment-standard/scripts/validate-deployment-package.mjs

@@ -61,11 +61,8 @@ const requiredDeploySemantics = [
   /docker save -o "\$version_root\/backend-image\.tar"/,
   /load_dotenv "\$DEPLOY_ROOT\/\.env"/,
   /endpoint_url "\$DOCKER_BIND_IP"/,
-  /server deploy root must be exactly/,
-  /assert_project_ports_isolated/,
   /flock -x 9/,
   /Nginx reload failed; old project configuration restored/,
-  /database migration was not executed/,
   /docker ps -aq --filter "label=com\.docker\.compose\.project=\$PROJECT_NAME"/,
   /\$1 == frontend \|\| \$1 == backend/,
 ];
@@ -95,11 +92,11 @@ for (const key of ['FRONTEND_PORT', 'BACKEND_PORT', 'FRONTEND_URL', 'BACKEND_URL
   if (!compose.includes(`\${${key}}`)) throw new Error(`Compose must use ${key}`);
 }
 
-for (const placeholder of ['__PROJECT_NAME__', '__PROJECT_HTTP_PORT__', '__DOCKER_HOST_PORTS__', '__DEPLOY_ROOT__', '__FRONTEND_UPSTREAM_NAME__', '__BACKEND_UPSTREAM_NAME__']) {
+for (const placeholder of ['__PROJECT_NAME__', '__PROJECT_HTTP_PORT__', '__DEPLOY_ROOT__', '__FRONTEND_UPSTREAM_NAME__', '__BACKEND_UPSTREAM_NAME__']) {
   if (!nginx.includes(placeholder)) throw new Error(`Nginx template is missing ${placeholder}`);
 }
-if (!/^# wdyy-project: __PROJECT_NAME__$/m.test(nginx) || !/^# wdyy-port: __PROJECT_HTTP_PORT__$/m.test(nginx) || !/^# wdyy-docker-ports: __DOCKER_HOST_PORTS__$/m.test(nginx)) {
-  throw new Error('Nginx template must expose deterministic project and all port markers');
+if (!/^# wdyy-project: __PROJECT_NAME__$/m.test(nginx) || !/^# wdyy-port: __PROJECT_HTTP_PORT__$/m.test(nginx)) {
+  throw new Error('Nginx template must expose deterministic project and port markers');
 }
 if (/listen\s+\d+/.test(nginx) || /proxy_pass\s+https?:\/\/(?!__)/.test(nginx)) throw new Error('Nginx URL or port is hardcoded');
 
@@ -114,23 +111,20 @@ const sectionNames = [...rootEnvText.matchAll(/^# (前端|后端|数据库|API|
 if (sectionNames.join('|') !== '前端|后端|数据库|API|部署') throw new Error('Root .env must use the five standard sections in order');
 const requiredEnv = [
   'FRONTEND_URL', 'FRONTEND_PORT', 'BACKEND_URL', 'BACKEND_PORT', 'DB_PORT',
-  'PROJECT_NAME', 'SERVER_PROJECTS_ROOT', 'PROJECT_HTTP_PORT', 'DOCKER_BIND_IP',
+  'PROJECT_NAME', 'PROJECT_HTTP_PORT', 'DOCKER_BIND_IP',
   'FRONTEND_BLUE_PORT', 'FRONTEND_GREEN_PORT', 'BACKEND_BLUE_PORT', 'BACKEND_GREEN_PORT',
-  'FRONTEND_BASE_IMAGE', 'BACKEND_BASE_IMAGE', 'DATABASE_MIGRATION_MODE',
+  'FRONTEND_BASE_IMAGE', 'BACKEND_BASE_IMAGE',
 ];
 for (const key of requiredEnv) if (!env.get(key)) throw new Error(`Root .env is missing ${key}`);
 for (const key of env.keys()) {
-  if (['FRONTEND_CONTAINER_PORT', 'BACKEND_CONTAINER_PORT', 'BACKEND_LISTEN_HOST'].includes(key) || /_(?:HEALTH|VERSION)_URL$/.test(key)) {
+  if (['FRONTEND_CONTAINER_PORT', 'BACKEND_CONTAINER_PORT', 'BACKEND_LISTEN_HOST', 'DATABASE_MIGRATION_MODE', 'MIGRATIONS_SOURCE', 'MIGRATION_RUNNER_SOURCE'].includes(key) || /_(?:HEALTH|VERSION)_URL$/.test(key)) {
     throw new Error(`Root .env contains legacy duplicate configuration: ${key}`);
   }
 }
 if (!/^[a-z][a-z0-9_]*$/.test(env.get('PROJECT_NAME'))) throw new Error('Invalid PROJECT_NAME');
-if (!/^\/.+[^/]$/.test(env.get('SERVER_PROJECTS_ROOT'))) throw new Error('Invalid SERVER_PROJECTS_ROOT');
 for (const key of ['FRONTEND_URL', 'BACKEND_URL', 'DOCKER_BIND_IP']) {
   if (!/^[A-Za-z0-9:.%-]+$/.test(env.get(key))) throw new Error(`${key} contains unsafe characters`);
 }
-const migrationMode = env.get('DATABASE_MIGRATION_MODE');
-if (!['manual', 'none'].includes(migrationMode)) throw new Error('DATABASE_MIGRATION_MODE must be manual or none');
 if (env.has('LOG_DIR') || env.has('HOST_LOG_DIR')) throw new Error('Root .env must not configure log directories');
 const allPortKeys = ['FRONTEND_PORT', 'BACKEND_PORT', 'DB_PORT', 'PROJECT_HTTP_PORT', 'FRONTEND_BLUE_PORT', 'FRONTEND_GREEN_PORT', 'BACKEND_BLUE_PORT', 'BACKEND_GREEN_PORT'];
 for (const key of allPortKeys) {
@@ -159,14 +153,7 @@ for (const path of requiredPaths) {
   const info = await stat(join(versionRoot, path));
   if (!info.isFile()) throw new Error(`Required release path is not a file: ${path}`);
 }
-if (migrationMode === 'manual') {
-  const runner = await stat(join(versionRoot, 'database/apply-migrations.sh'));
-  if (!runner.isFile() || (runner.mode & 0o111) === 0) throw new Error('Manual migration runner must be executable');
-  const migrations = await readdir(join(versionRoot, 'database/migrations'));
-  if (!migrations.some((item) => /^V\d{3}__[a-z0-9]+(?:_[a-z0-9]+)*\.sql$/.test(item))) throw new Error('Manual migration files are missing');
-} else {
-  await assertMissing(join(versionRoot, 'database'), 'none mode must not package database files');
-}
+await assertMissing(join(versionRoot, 'database'), 'Release package must not contain database migration files');
 
 const versionFiles = (await listFiles(versionRoot)).sort();
 for (const path of versionFiles) {

package/.well-known/skills/wdyy-deployment-standard/scripts/validate-deployment-package.test.mjs

@@ -32,7 +32,7 @@ async function temporary(prefix) {
   return path;
 }
 
-function envText(serverProjectsRoot, mode = 'none', extra = '') {
+function envText(extra = '') {
   return `# 前端
 FRONTEND_URL=0.0.0.0
 FRONTEND_PORT=5173
@@ -53,7 +53,6 @@ DB_SCHEMA=
 
 # 部署
 PROJECT_NAME=fixture
-SERVER_PROJECTS_ROOT=${serverProjectsRoot}
 PROJECT_HTTP_PORT=9099
 DOCKER_BIND_IP=127.0.0.1
 FRONTEND_BLUE_PORT=19091
@@ -62,11 +61,10 @@ BACKEND_BLUE_PORT=19093
 BACKEND_GREEN_PORT=19094
 FRONTEND_BASE_IMAGE=nginx:stable
 BACKEND_BASE_IMAGE=node:24-alpine3.24
-DATABASE_MIGRATION_MODE=${mode}
 ${extra}`;
 }
 
-async function createFixture({ mode = 'none', agents = '# Target project\n', extraEnv = '' } = {}) {
+async function createFixture({ agents = '# Target project\n', extraEnv = '' } = {}) {
   const root = await temporary('wdyy-deploy-');
   const fakeBin = join(root, 'fake-bin');
   const serverProjectsRoot = join(root, 'servers');
@@ -87,19 +85,12 @@ async function createFixture({ mode = 'none', agents = '# Target project\n', ext
     copyFile(frontendNginxTemplate, join(root, 'scripts/deployment/frontend-container.conf.template')),
     copyFile(dockerignoreTemplate, join(root, '.dockerignore')),
     writeFile(join(root, 'AGENTS.md'), agents),
-    writeFile(join(root, '.env'), envText(serverProjectsRoot, mode, extraEnv)),
+    writeFile(join(root, '.env'), envText(extraEnv)),
     writeFile(commandLog, ''),
   ]);
   await chmod(join(root, 'deploy.sh'), 0o755);
   await chmod(join(root, '.env'), 0o600);
 
-  if (mode === 'manual') {
-    await mkdir(join(root, 'database/migrations'), { recursive: true });
-    await writeFile(join(root, 'database/migrations/V001__baseline.sql'), 'SELECT 1;\n');
-    await writeFile(join(root, 'scripts/apply-migrations.sh'), '#!/usr/bin/env bash\nset -euo pipefail\n');
-    await chmod(join(root, 'scripts/apply-migrations.sh'), 0o755);
-  }
-
   await writeExecutable(join(fakeBin, 'pnpm'), `#!/usr/bin/env bash
 set -euo pipefail
 printf 'pnpm %s\n' "$*" >> "$COMMAND_LOG"
@@ -175,7 +166,7 @@ if [[ "\${FAIL_STATE_INSTALL:-0}" == 1 && "$target" == */state/active.env ]]; th
 exec /usr/bin/install "$@"
 `);
 
-  return { root, fakeBin, serverProjectsRoot, commandLog, mode };
+  return { root, fakeBin, serverProjectsRoot, commandLog };
 }
 
 async function writeExecutable(path, content) {
@@ -251,19 +242,12 @@ test('build 生成根 .env、双镜像和四服务完整包', async () => {
   assert.doesNotMatch(await readFile(join(fixture.root, `deploy/${version}/docker/docker-compose.blue-green.yml`), 'utf8'), /FRONTEND_CONTAINER_PORT|BACKEND_CONTAINER_PORT|_HEALTH_URL|_VERSION_URL/);
 });
 
-test('none 模式不伪造数据库文件，manual 模式只打包人工脚本', async () => {
-  const none = await createFixture();
-  assert.equal(runBuild(none).status, 0);
-  const noneVersion = await releaseVersion(none.root);
-  await assert.rejects(stat(join(none.root, `deploy/${noneVersion}/database`)));
-
-  const manual = await createFixture({ mode: 'manual' });
-  const built = runBuild(manual);
-  assert.equal(built.status, 0, built.stderr);
-  assert.match(built.stdout, /migration was not executed/);
-  const manualVersion = await releaseVersion(manual.root);
-  assert.ok((await stat(join(manual.root, `deploy/${manualVersion}/database/apply-migrations.sh`))).mode & 0o111);
-  assert.doesNotMatch(await readFile(join(manual.root, 'deploy/deploy.sh'), 'utf8'), /\bpsql\b/);
+test('发布包不包含数据库迁移文件或迁移参数', async () => {
+  const fixture = await createFixture();
+  assert.equal(runBuild(fixture).status, 0);
+  const version = await releaseVersion(fixture.root);
+  await assert.rejects(stat(join(fixture.root, `deploy/${version}/database`)));
+  assert.doesNotMatch(await readFile(join(fixture.root, 'deploy/deploy.sh'), 'utf8'), /apply-migrations\.sh|database\/migrations|\bpsql\b/);
 });
 
 test('连续构建的 deploy.sh、Compose 和 Nginx 配置字节一致', async () => {
@@ -334,6 +318,10 @@ test('build 接受带标签基础镜像并拒绝重复键和额外版本参数',
   const legacyRejected = runBuild(legacy);
   assert.notEqual(legacyRejected.status, 0);
   assert.match(legacyRejected.stderr, /legacy duplicate environment key/);
+  const migration = await createFixture({ extraEnv: 'DATABASE_MIGRATION_MODE=none\n' });
+  const migrationRejected = runBuild(migration);
+  assert.notEqual(migrationRejected.status, 0);
+  assert.match(migrationRejected.stderr, /legacy duplicate environment key/);
   const reverseInclude = await createFixture();
   await writeFile(join(reverseInclude.root, '.dockerignore'), `${await readFile(join(reverseInclude.root, '.dockerignore'), 'utf8')}!.env\n`);
   const reverseRejected = runBuild(reverseInclude);
@@ -446,68 +434,6 @@ test('remove 只删除本项目容器、网络和两个镜像仓库并保留日
   await access(join(serverRoot, 'release.env'));
 });
 
-test('端口冲突在加载镜像或启动容器前失败', async () => {
-  const fixture = await createFixture();
-  assert.equal(runBuild(fixture).status, 0);
-  const version = await releaseVersion(fixture.root);
-  const serverRoot = await installOnServer(fixture);
-  await mkdir(join(fixture.serverProjectsRoot, 'other/nginx'), { recursive: true });
-  await writeFile(join(fixture.serverProjectsRoot, 'other/nginx/site.conf'), '# wdyy-project: other\n# wdyy-port: 9099\nserver { listen 9099; }\n');
-  await writeFile(fixture.commandLog, '');
-  const result = runServer(fixture, serverRoot, 'start', { EXPECTED_VERSION: version });
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /already used by another project/);
-  const log = await readFile(fixture.commandLog, 'utf8');
-  assert.doesNotMatch(log, /docker load|docker compose/);
-});
-
-test('展开的全局 Nginx 中存在非标准项目端口时也拒绝部署', async () => {
-  const fixture = await createFixture();
-  assert.equal(runBuild(fixture).status, 0);
-  const version = await releaseVersion(fixture.root);
-  const serverRoot = await installOnServer(fixture);
-  await writeFile(fixture.commandLog, '');
-  const result = runServer(fixture, serverRoot, 'start', {
-    EXPECTED_VERSION: version,
-    EXTRA_NGINX_CONFIG: 'server {\n  listen 9099;\n}',
-  });
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /expanded Nginx configuration/);
-  assert.doesNotMatch(await readFile(fixture.commandLog, 'utf8'), /docker load|docker compose/);
-});
-
-test('其他项目预留任一 Docker blue-green 宿主机端口时在启动前失败', async () => {
-  const fixture = await createFixture();
-  assert.equal(runBuild(fixture).status, 0);
-  const version = await releaseVersion(fixture.root);
-  const serverRoot = await installOnServer(fixture);
-  await mkdir(join(fixture.serverProjectsRoot, 'other/nginx'), { recursive: true });
-  await writeFile(
-    join(fixture.serverProjectsRoot, 'other/nginx/site.conf'),
-    '# wdyy-project: other\n# wdyy-port: 9100\n# wdyy-docker-ports: 19091,29092,29093,29094\nserver { listen 9100; }\n',
-  );
-  await writeFile(fixture.commandLog, '');
-  const result = runServer(fixture, serverRoot, 'start', { EXPECTED_VERSION: version });
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /Docker host port 19091/);
-  assert.doesNotMatch(await readFile(fixture.commandLog, 'utf8'), /docker load|docker compose/);
-});
-
-test('其他运行中容器发布项目 Docker 端口时在镜像加载前失败', async () => {
-  const fixture = await createFixture();
-  assert.equal(runBuild(fixture).status, 0);
-  const version = await releaseVersion(fixture.root);
-  const serverRoot = await installOnServer(fixture);
-  await writeFile(fixture.commandLog, '');
-  const result = runServer(fixture, serverRoot, 'start', {
-    EXPECTED_VERSION: version,
-    DOCKER_RUNNING_PORTS: 'other_project|0.0.0.0:19093->3000/tcp, [::]:19093->3000/tcp',
-  });
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /Docker host port 19093 is already published by another container/);
-  assert.doesNotMatch(await readFile(fixture.commandLog, 'utf8'), /docker load|docker compose/);
-});
-
 test('replace 的 Nginx reload 失败时恢复旧 upstream 和状态', async () => {
   const fixture = await createFixture();
   assert.equal(runBuild(fixture).status, 0);
@@ -555,14 +481,12 @@ test('状态提交失败时恢复旧流量和旧状态', async () => {
   assert.equal(await readFile(join(serverRoot, 'state/active.env'), 'utf8'), oldState);
 });
 
-test('服务器命令拒绝额外参数和错误部署根', async () => {
+test('服务器命令拒绝额外参数且部署根由脚本位置确定', async () => {
   const fixture = await createFixture();
   assert.equal(runBuild(fixture).status, 0);
   const serverRoot = await installOnServer(fixture);
   assert.equal(runServer(fixture, serverRoot, 'start', {}, 'unexpected').status, 2);
-  const wrongRoot = join(fixture.root, 'wrong');
-  await cp(join(fixture.root, 'deploy'), wrongRoot, { recursive: true });
-  const wrong = runServer(fixture, wrongRoot, 'status');
-  assert.notEqual(wrong.status, 0);
-  assert.match(wrong.stderr, /server deploy root must be exactly/);
+  const alternateRoot = join(fixture.root, 'alternate');
+  await cp(join(fixture.root, 'deploy'), alternateRoot, { recursive: true });
+  assert.equal(runServer(fixture, alternateRoot, 'status').status, 0);
 });

package/.well-known/skills/wdyy-deployment-standard/templates/deploy.sh.template

@@ -31,22 +31,22 @@ assert_port() {
 }
 
 reset_configuration() {
-  unset PROJECT_NAME SERVER_PROJECTS_ROOT PROJECT_HTTP_PORT DOCKER_BIND_IP
+  unset PROJECT_NAME PROJECT_HTTP_PORT DOCKER_BIND_IP
   unset FRONTEND_URL FRONTEND_PORT BACKEND_URL BACKEND_PORT
   unset FRONTEND_BLUE_PORT FRONTEND_GREEN_PORT BACKEND_BLUE_PORT BACKEND_GREEN_PORT
-  unset FRONTEND_BASE_IMAGE BACKEND_BASE_IMAGE DATABASE_MIGRATION_MODE
+  unset FRONTEND_BASE_IMAGE BACKEND_BASE_IMAGE
   unset FRONTEND_DOCKERFILE BACKEND_DOCKERFILE DOCKERIGNORE_FILE
-  unset MIGRATIONS_SOURCE MIGRATION_RUNNER_SOURCE DEPLOY_CONFIG_DIR
+  unset DEPLOY_CONFIG_DIR
   unset COMPOSE_SOURCE NGINX_SOURCE
 }
 
 is_deployment_key() {
   case "$1" in
     FRONTEND_URL|FRONTEND_PORT|BACKEND_URL|BACKEND_PORT|\
-    PROJECT_NAME|SERVER_PROJECTS_ROOT|PROJECT_HTTP_PORT|DOCKER_BIND_IP|\
+    PROJECT_NAME|PROJECT_HTTP_PORT|DOCKER_BIND_IP|\
     FRONTEND_BLUE_PORT|FRONTEND_GREEN_PORT|BACKEND_BLUE_PORT|BACKEND_GREEN_PORT|\
-    FRONTEND_BASE_IMAGE|BACKEND_BASE_IMAGE|DATABASE_MIGRATION_MODE|\
-    FRONTEND_DOCKERFILE|BACKEND_DOCKERFILE|DOCKERIGNORE_FILE|MIGRATIONS_SOURCE|MIGRATION_RUNNER_SOURCE|\
+    FRONTEND_BASE_IMAGE|BACKEND_BASE_IMAGE|\
+    FRONTEND_DOCKERFILE|BACKEND_DOCKERFILE|DOCKERIGNORE_FILE|\
     DEPLOY_CONFIG_DIR|COMPOSE_SOURCE|NGINX_SOURCE)
       return 0 ;;
     *) return 1 ;;
@@ -55,7 +55,7 @@ is_deployment_key() {
 
 is_legacy_configuration_key() {
   case "$1" in
-    FRONTEND_CONTAINER_PORT|BACKEND_CONTAINER_PORT|BACKEND_LISTEN_HOST|*_HEALTH_URL|*_VERSION_URL)
+    FRONTEND_CONTAINER_PORT|BACKEND_CONTAINER_PORT|BACKEND_LISTEN_HOST|DATABASE_MIGRATION_MODE|MIGRATIONS_SOURCE|MIGRATION_RUNNER_SOURCE|*_HEALTH_URL|*_VERSION_URL)
       return 0 ;;
     *) return 1 ;;
   esac
@@ -109,17 +109,15 @@ validate_configuration() {
   local name port seen=" "
   local -a required=(
     FRONTEND_URL FRONTEND_PORT BACKEND_URL BACKEND_PORT
-    PROJECT_NAME SERVER_PROJECTS_ROOT PROJECT_HTTP_PORT DOCKER_BIND_IP
+    PROJECT_NAME PROJECT_HTTP_PORT DOCKER_BIND_IP
     FRONTEND_BLUE_PORT FRONTEND_GREEN_PORT BACKEND_BLUE_PORT BACKEND_GREEN_PORT
-    FRONTEND_BASE_IMAGE BACKEND_BASE_IMAGE DATABASE_MIGRATION_MODE
+    FRONTEND_BASE_IMAGE BACKEND_BASE_IMAGE
   )
   for name in "${required[@]}"; do
     [[ -n "${!name:-}" ]] || fail "$name is required in root .env"
   done
   [[ "$PROJECT_NAME" =~ ^[a-z][a-z0-9_]*$ ]] ||
     fail "PROJECT_NAME must match ^[a-z][a-z0-9_]*$"
-  [[ "$SERVER_PROJECTS_ROOT" = /* && "$SERVER_PROJECTS_ROOT" != */ ]] ||
-    fail "SERVER_PROJECTS_ROOT must be an absolute path without a trailing slash"
   [[ "$DOCKER_BIND_IP" =~ ^[A-Za-z0-9:.%-]+$ ]] || fail "DOCKER_BIND_IP contains unsafe characters"
   [[ "$FRONTEND_URL" =~ ^[A-Za-z0-9:.%-]+$ ]] || fail "FRONTEND_URL contains unsafe characters"
   [[ "$BACKEND_URL" =~ ^[A-Za-z0-9:.%-]+$ ]] || fail "BACKEND_URL contains unsafe characters"
@@ -132,8 +130,6 @@ validate_configuration() {
     [[ "$seen" != *" $port "* ]] || fail "host ports must be unique; duplicate value: $port"
     seen+="$port "
   done
-  [[ "$DATABASE_MIGRATION_MODE" == manual || "$DATABASE_MIGRATION_MODE" == none ]] ||
-    fail "DATABASE_MIGRATION_MODE must be manual or none"
 }
 
 probe_host() {
@@ -329,7 +325,6 @@ validate_dockerignore() {
 
 validate_local_package() {
   local output_root="$1" version="$2" version_root="$1/$2"
-  local expected_count
   [[ -x "$output_root/deploy.sh" ]] || fail "generated deploy.sh is missing or not executable"
   cmp -s "$SCRIPT_PATH" "$output_root/deploy.sh" || fail "generated deploy.sh differs from its source"
   cmp -s "$SCRIPT_DIR/.env" "$output_root/.env" || fail "generated root .env differs from project .env"
@@ -343,14 +338,8 @@ validate_local_package() {
   grep -Fq 'frontend-green:' "$version_root/docker/docker-compose.blue-green.yml" || fail "missing frontend-green"
   grep -Fq 'backend-green:' "$version_root/docker/docker-compose.blue-green.yml" || fail "missing backend-green"
   grep -Fq '__PROJECT_HTTP_PORT__' "$version_root/nginx/site.conf" || fail "missing project port placeholder"
-  if [[ "$DATABASE_MIGRATION_MODE" == manual ]]; then
-    [[ -d "$version_root/database/migrations" && -x "$version_root/database/apply-migrations.sh" ]] || fail "manual database package is incomplete"
-  else
-    [[ ! -e "$version_root/database" ]] || fail "none database mode must not package database files"
-  fi
-  expected_count=4
-  [[ "$DATABASE_MIGRATION_MODE" == manual ]] && expected_count=6
-  [[ "$(find "$version_root" -type f ! -name manifest.sha256 | wc -l | tr -d ' ')" -ge "$expected_count" ]] || fail "release package is incomplete"
+  [[ ! -e "$version_root/database" ]] || fail "release package must not contain database migration files"
+  [[ "$(find "$version_root" -type f ! -name manifest.sha256 | wc -l | tr -d ' ')" -ge 4 ]] || fail "release package is incomplete"
   reject_version_secrets "$version_root"
   verify_manifest "$version_root"
 }
@@ -368,7 +357,7 @@ build_release() {
   local project_root="$SCRIPT_DIR" agents_file="$SCRIPT_DIR/AGENTS.md"
   local today version raw_time build_time frontend_image backend_image
   local frontend_dockerfile backend_dockerfile dockerignore_file deploy_config_dir compose_source nginx_source
-  local migrations_source migration_runner_source staging_parent output_root version_root agents_prepared old_deploy
+  local staging_parent output_root version_root agents_prepared old_deploy
 
   acquire_build_lock
   staging_parent=
@@ -385,18 +374,12 @@ build_release() {
   deploy_config_dir="$(resolve_project_path "$project_root" "${DEPLOY_CONFIG_DIR:-scripts/deployment}")"
   compose_source="$(resolve_project_path "$project_root" "${COMPOSE_SOURCE:-${deploy_config_dir#"$project_root"/}/docker-compose.blue-green.yml}")"
   nginx_source="$(resolve_project_path "$project_root" "${NGINX_SOURCE:-${deploy_config_dir#"$project_root"/}/nginx-site.conf}")"
-  migrations_source="$(resolve_project_path "$project_root" "${MIGRATIONS_SOURCE:-database/migrations}")"
-  migration_runner_source="$(resolve_project_path "$project_root" "${MIGRATION_RUNNER_SOURCE:-scripts/apply-migrations.sh}")"
 
   for command in node pnpm docker tar install find sort cmp awk sed grep uniq; do require_command "$command"; done
   select_checksum_tool
   [[ -f "$frontend_dockerfile" && -f "$backend_dockerfile" ]] || fail "frontend and backend Dockerfiles are required"
   [[ -f "$compose_source" && -f "$nginx_source" ]] || fail "deployment Compose and Nginx sources are required"
   validate_dockerignore "$dockerignore_file"
-  if [[ "$DATABASE_MIGRATION_MODE" == manual ]]; then
-    [[ -d "$migrations_source" ]] || fail "manual migration directory is missing: $migrations_source"
-    [[ -x "$migration_runner_source" ]] || fail "manual migration runner is missing or not executable"
-  fi
 
   today="$(date +%Y%m%d)"
   version="$(release_ledger next "$agents_file" "$today")"
@@ -432,11 +415,6 @@ build_release() {
   install -m 0644 "$nginx_source" "$version_root/nginx/site.conf"
   cmp -s "$compose_source" "$version_root/docker/docker-compose.blue-green.yml" || fail "generated Compose is not deterministic"
   cmp -s "$nginx_source" "$version_root/nginx/site.conf" || fail "generated Nginx config is not deterministic"
-  if [[ "$DATABASE_MIGRATION_MODE" == manual ]]; then
-    mkdir -p "$version_root/database"
-    cp -R "$migrations_source" "$version_root/database/migrations"
-    install -m 0755 "$migration_runner_source" "$version_root/database/apply-migrations.sh"
-  fi
   create_manifest "$version_root"
   validate_local_package "$output_root" "$version"
 
@@ -463,7 +441,6 @@ build_release() {
   release_build_lock; BUILD_LOCK=
   trap - EXIT
   echo "release package created: deploy/$version"
-  [[ "$DATABASE_MIGRATION_MODE" == manual ]] && echo "database migration was not executed; run the packaged script manually after approval"
   return 0
 }
 
@@ -477,13 +454,9 @@ read_release_pointer() {
 }
 
 initialize_server_context() {
-  local expected_root
   DEPLOY_ROOT="$SCRIPT_DIR"
   load_dotenv "$DEPLOY_ROOT/.env"
   validate_configuration
-  [[ -d "$SERVER_PROJECTS_ROOT" ]] || fail "SERVER_PROJECTS_ROOT does not exist: $SERVER_PROJECTS_ROOT"
-  expected_root="$(cd "$SERVER_PROJECTS_ROOT" >/dev/null 2>&1 && pwd -P)/$PROJECT_NAME"
-  [[ "$DEPLOY_ROOT" == "$expected_root" ]] || fail "server deploy root must be exactly $expected_root; got $DEPLOY_ROOT"
   STATE_DIR="$DEPLOY_ROOT/state"
   ACTIVE_STATE="$STATE_DIR/active.env"
   PREVIOUS_STATE="$STATE_DIR/previous.env"
@@ -543,11 +516,7 @@ validate_uploaded_package() {
   local package_root="$1"
   [[ -f "$package_root/frontend-image.tar" && -f "$package_root/backend-image.tar" ]] || fail "dual image archives are missing"
   [[ -f "$package_root/docker/docker-compose.blue-green.yml" && -f "$package_root/nginx/site.conf" ]] || fail "release configuration is incomplete"
-  if [[ "$DATABASE_MIGRATION_MODE" == manual ]]; then
-    [[ -d "$package_root/database/migrations" && -x "$package_root/database/apply-migrations.sh" ]] || fail "manual database package is incomplete"
-  else
-    [[ ! -e "$package_root/database" ]] || fail "none database mode must not contain database files"
-  fi
+  [[ ! -e "$package_root/database" ]] || fail "release package must not contain database migration files"
   reject_version_secrets "$package_root"
   verify_manifest "$package_root"
   tar -tf "$package_root/frontend-image.tar" >/dev/null || fail "invalid frontend image archive"
@@ -608,12 +577,11 @@ verify_pair() {
 
 render_site_candidate() {
   local source="$1" output="$2" escaped_root
-  for placeholder in __PROJECT_NAME__ __PROJECT_HTTP_PORT__ __DOCKER_HOST_PORTS__ __DEPLOY_ROOT__ __FRONTEND_UPSTREAM_NAME__ __BACKEND_UPSTREAM_NAME__; do
+  for placeholder in __PROJECT_NAME__ __PROJECT_HTTP_PORT__ __DEPLOY_ROOT__ __FRONTEND_UPSTREAM_NAME__ __BACKEND_UPSTREAM_NAME__; do
     grep -Fq "$placeholder" "$source" || fail "Nginx template is missing $placeholder"
   done
   escaped_root="${DEPLOY_ROOT//\\/\\\\}"; escaped_root="${escaped_root//&/\\&}"; escaped_root="${escaped_root//|/\\|}"
   sed -e "s|__PROJECT_NAME__|$PROJECT_NAME|g" -e "s|__PROJECT_HTTP_PORT__|$PROJECT_HTTP_PORT|g" \
-    -e "s|__DOCKER_HOST_PORTS__|$FRONTEND_BLUE_PORT,$FRONTEND_GREEN_PORT,$BACKEND_BLUE_PORT,$BACKEND_GREEN_PORT|g" \
     -e "s|__DEPLOY_ROOT__|$escaped_root|g" -e "s|__FRONTEND_UPSTREAM_NAME__|$FRONTEND_UPSTREAM_NAME|g" \
     -e "s|__BACKEND_UPSTREAM_NAME__|$BACKEND_UPSTREAM_NAME|g" "$source" > "$output"
 }
@@ -626,56 +594,6 @@ write_upstream_candidate() {
     "$BACKEND_UPSTREAM_NAME" "$DOCKER_BIND_IP" "$backend_port" > "$output"
 }
 
-assert_project_ports_isolated() {
-  local site site_physical expanded total_listeners own_listener marker port own_upstream_listener
-  local docker_ports compose_project published_ports
-  shopt -s nullglob
-  for site in "$SERVER_PROJECTS_ROOT"/*/nginx/site.conf; do
-    site_physical="$(cd "$(dirname "$site")" >/dev/null 2>&1 && pwd -P)/$(basename "$site")"
-    [[ "$site_physical" == "$NGINX_SITE_FILE" ]] && continue
-    if grep -Eq "^# wdyy-port: ${PROJECT_HTTP_PORT}$|^[[:space:]]*listen[[:space:]]+${PROJECT_HTTP_PORT}[[:space:]]*;" "$site"; then
-      shopt -u nullglob
-      fail "PROJECT_HTTP_PORT is already used by another project: $site"
-    fi
-    marker="$(sed -n 's/^# wdyy-docker-ports: //p' "$site")"
-    [[ "$marker" =~ ^[0-9]+,[0-9]+,[0-9]+,[0-9]+$ ]] || {
-      shopt -u nullglob
-      fail "cannot prove Docker host port isolation for project site: $site"
-    }
-    marker=" ${marker//,/ } "
-    for port in $FRONTEND_BLUE_PORT $FRONTEND_GREEN_PORT $BACKEND_BLUE_PORT $BACKEND_GREEN_PORT; do
-      [[ "$marker" != *" $port "* ]] || {
-        shopt -u nullglob
-        fail "Docker host port $port is already reserved by another project: $site"
-      }
-    done
-  done
-  shopt -u nullglob
-  docker_ports="$(docker ps --format '{{.Label "com.docker.compose.project"}}|{{.Ports}}')" ||
-    fail "unable to inspect running Docker port bindings"
-  while IFS='|' read -r compose_project published_ports; do
-    [[ -n "$published_ports" && "$compose_project" != "$PROJECT_NAME" ]] || continue
-    for port in $FRONTEND_BLUE_PORT $FRONTEND_GREEN_PORT $BACKEND_BLUE_PORT $BACKEND_GREEN_PORT; do
-      if grep -Eq "(^|[[:space:],])([^,[:space:]]*:)?${port}->" <<< "$published_ports"; then
-        fail "Docker host port $port is already published by another container"
-      fi
-    done
-  done <<< "$docker_ports"
-  expanded="$(nginx -T 2>&1)" || fail "current global Nginx configuration is invalid"
-  total_listeners="$(grep -Ec "^[[:space:]]*listen[[:space:]]+${PROJECT_HTTP_PORT}[[:space:]]*;" <<< "$expanded" || true)"
-  if grep -Fq "# wdyy-project: $PROJECT_NAME" <<< "$expanded"; then own_listener=1; fi
-  (( total_listeners <= own_listener )) || fail "PROJECT_HTTP_PORT is already used outside this project in expanded Nginx configuration"
-  for port in $FRONTEND_BLUE_PORT $FRONTEND_GREEN_PORT $BACKEND_BLUE_PORT $BACKEND_GREEN_PORT; do
-    total_listeners="$(grep -Ec "^[[:space:]]*server[[:space:]]+[^;[:space:]]+:${port}[[:space:]]*;|proxy_pass[[:space:]]+https?://[^;[:space:]]+:${port}([/;]|$)" <<< "$expanded" || true)"
-    own_upstream_listener=0
-    if grep -Eq "upstream[[:space:]]+(${FRONTEND_UPSTREAM_NAME}|${BACKEND_UPSTREAM_NAME})" <<< "$expanded" &&
-      [[ -f "$UPSTREAM_FILE" ]] && grep -Eq ":${port}[[:space:]]*;" "$UPSTREAM_FILE"; then
-      own_upstream_listener=1
-    fi
-    (( total_listeners <= own_upstream_listener )) || fail "Docker host port $port is already used outside this project in expanded Nginx configuration"
-  done
-}
-
 restore_file() {
   local backup="$1" target="$2"
   if [[ -f "$backup" ]]; then cp -p "$backup" "$target"; else rm -f -- "$target"; fi
@@ -683,7 +601,7 @@ restore_file() {
 
 commit_traffic_and_state() {
   local site_candidate="$1" upstream_candidate="$2" active_candidate="$3" previous_candidate="${4:-}" expected_version="$5"
-  local transaction expanded public_health public_version_url public_version rollback_failed=0
+  local transaction public_health public_version_url public_version rollback_failed=0
   mkdir -p "$NGINX_DIR" "$STATE_DIR"
   transaction="$(mktemp -d "$DEPLOY_ROOT/.nginx-switch.XXXXXX")"
   [[ -f "$NGINX_SITE_FILE" ]] && cp -p "$NGINX_SITE_FILE" "$transaction/site.old"
@@ -693,7 +611,6 @@ commit_traffic_and_state() {
 
   exec 9>/tmp/wdyy-nginx-deploy.lock
   flock -x 9
-  assert_project_ports_isolated
   install -m 0644 "$site_candidate" "$NGINX_SITE_FILE"
   install -m 0644 "$upstream_candidate" "$UPSTREAM_FILE"
   if ! nginx -t; then
@@ -702,18 +619,6 @@ commit_traffic_and_state() {
     rm -rf -- "$transaction"
     fail "Nginx candidate validation failed; project configuration restored"
   fi
-  expanded="$(nginx -T 2>&1)" || {
-    restore_file "$transaction/site.old" "$NGINX_SITE_FILE"
-    restore_file "$transaction/upstreams.old" "$UPSTREAM_FILE"
-    rm -rf -- "$transaction"
-    fail "unable to inspect expanded Nginx configuration"
-  }
-  grep -Fq "# wdyy-project: $PROJECT_NAME" <<< "$expanded" || {
-    restore_file "$transaction/site.old" "$NGINX_SITE_FILE"
-    restore_file "$transaction/upstreams.old" "$UPSTREAM_FILE"
-    rm -rf -- "$transaction"
-    fail "shared Nginx does not include this project's site.conf"
-  }
   if ! nginx -s reload; then
     restore_file "$transaction/site.old" "$NGINX_SITE_FILE"
     restore_file "$transaction/upstreams.old" "$UPSTREAM_FILE"
@@ -767,7 +672,6 @@ deploy_release() {
     target_color=$([[ "$ACTIVE_COLOR" == blue ]] && printf green || printf blue)
   fi
   mkdir -p "$STATE_DIR" "$NGINX_DIR" "$DEPLOY_ROOT/logs"
-  assert_project_ports_isolated
   load_release_images "$RELEASE_VERSION"
   up_pair "$target_color" "$RELEASE_VERSION"
   verify_pair "$target_color" "$RELEASE_VERSION"
@@ -786,7 +690,6 @@ deploy_release() {
   rm -rf -- "$work"
   trap - EXIT
   echo "active release: $RELEASE_VERSION ($target_color)"
-  [[ "$DATABASE_MIGRATION_MODE" == manual ]] && echo "database migration was not executed; execute $package_root/database/apply-migrations.sh manually after approval"
   return 0
 }
 

package/.well-known/skills/wdyy-deployment-standard/templates/env.example.template

@@ -18,7 +18,6 @@ DB_SCHEMA=
 
 # 部署
 PROJECT_NAME=
-SERVER_PROJECTS_ROOT=
 PROJECT_HTTP_PORT=
 DOCKER_BIND_IP=
 FRONTEND_BLUE_PORT=
@@ -27,4 +26,3 @@ BACKEND_BLUE_PORT=
 BACKEND_GREEN_PORT=
 FRONTEND_BASE_IMAGE=nginx:stable
 BACKEND_BASE_IMAGE=node:24-alpine3.24
-DATABASE_MIGRATION_MODE=

package/.well-known/skills/wdyy-deployment-standard/templates/nginx-upstream.template.conf

@@ -1,6 +1,5 @@
 # wdyy-project: __PROJECT_NAME__
 # wdyy-port: __PROJECT_HTTP_PORT__
-# wdyy-docker-ports: __DOCKER_HOST_PORTS__
 include "__DEPLOY_ROOT__/nginx/active-upstreams.conf";
 
 server {

package/README.md

@@ -64,7 +64,7 @@ wdyy update-skill --all
 
 ### 使用发布脚本
 
-推荐从项目根目录手动运行 `release_npm.sh`。脚本会检查工作区、组织权限、项目测试、lint 与打包内容，自动执行 `npm version <patch|minor|major>`、`npm publish --access public`，并核验 registry 版本。它不会执行登录、浏览器认证或处理认证凭据。
+推荐从项目根目录手动运行 `release_npm.sh`。脚本会检查工作区、组织权限、lint 与打包内容，自动执行 `npm version <patch|minor|major>`、`npm publish --access public`；发布成功后等待 5 秒，再一次查询刚发布的确切版本进行 registry 核验。它不会执行登录、浏览器认证或处理认证凭据。
 
 首次运行或登录失效时，先手工登录；脚本检测到未登录也会提示并退出：
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wdyy/skills",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "description": "企业内部开发 Skill 与项目初始化命令",
   "type": "module",
   "bin": {