codex-snapshots 0.1.0 → 0.1.1

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "codex-snapshots",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Local-first read-only snapshots for Codex, Claude Code, and Trae sessions.",
   "type": "module",
   "packageManager": "pnpm@10.20.0",
   "bin": {
-    "codex-snapshot": "bin/codex-snapshot.mjs",
-    "codex-snapshots": "bin/codex-snapshot.mjs",
-    "codex-snapshot-share": "server/share-api.mjs",
+    "codex-snapshot": "dist/cli/codex-snapshot.mjs",
+    "codex-snapshots": "dist/cli/codex-snapshot.mjs",
+    "codex-snapshot-share": "dist/server/share-api.mjs",
     "codex-snapshots-site": "scripts/serve-site.mjs"
   },
   "keywords": [
@@ -30,6 +30,8 @@
   "author": "ffffhx",
   "files": [
     "bin",
+    "deploy",
+    "dist",
     "server",
     "scripts",
     "site",
@@ -41,16 +43,27 @@
     "registry": "https://registry.npmjs.org/"
   },
   "scripts": {
-    "dev": "node bin/codex-snapshot.mjs serve --port 4321",
-    "snapshot": "node bin/codex-snapshot.mjs",
-    "snapshot:daemon": "node bin/codex-snapshot.mjs serve --port 4321",
-    "snapshot:install-daemon": "node scripts/launch-agent.mjs install",
-    "snapshot:uninstall-daemon": "node scripts/launch-agent.mjs uninstall",
-    "snapshot:daemon:status": "node scripts/launch-agent.mjs status",
-    "snapshot:daemon:logs": "node scripts/launch-agent.mjs logs",
+    "build": "pnpm build:dist && pnpm build:site",
+    "build:dist": "tsc -p tsconfig.build.json && chmod +x dist/cli/codex-snapshot.mjs dist/server/share-api.mjs",
+    "build:site": "node scripts/build-site.mjs",
+    "dev": "pnpm build:dist && node dist/cli/codex-snapshot.mjs serve --port 4321",
+    "snapshot": "pnpm build:dist && node dist/cli/codex-snapshot.mjs",
+    "snapshot:daemon": "pnpm build:dist && node dist/cli/codex-snapshot.mjs serve --port 4321",
+    "snapshot:install-daemon": "pnpm build:dist && node scripts/launch-agent.mjs install",
+    "snapshot:uninstall-daemon": "pnpm build:dist && node scripts/launch-agent.mjs uninstall",
+    "snapshot:daemon:status": "pnpm build:dist && node scripts/launch-agent.mjs status",
+    "snapshot:daemon:logs": "pnpm build:dist && node scripts/launch-agent.mjs logs",
     "site:dev": "node scripts/serve-site.mjs",
-    "share:server": "node server/share-api.mjs",
-    "test:smoke": "node bin/codex-snapshot.mjs --help && node server/share-api.mjs --help && node scripts/serve-site.mjs --help && node --check bin/codex-snapshot.mjs && node --check server/share-api.mjs && node --check scripts/launch-agent.mjs && node --check scripts/serve-site.mjs"
+    "share:server": "pnpm build:dist && node dist/server/share-api.mjs",
+    "prepack": "pnpm build",
+    "test:generated": "pnpm build && git diff --exit-code -- site dist",
+    "test:smoke": "pnpm build:dist && node dist/cli/codex-snapshot.mjs --help && node dist/cli/codex-snapshot.mjs daemon --help && node dist/server/share-api.mjs --help && node scripts/serve-site.mjs --help && node --check bin/codex-snapshot.mjs && node --check server/share-api.mjs && node --check dist/cli/codex-snapshot.mjs && node --check dist/server/share-api.mjs && node --check scripts/build-site.mjs && node --check scripts/launch-agent.mjs && node --check scripts/serve-site.mjs && node --check scripts/test-share-api.mjs && node --check scripts/test-static-site.mjs && node --check scripts/write-site-config.mjs && node --check scripts/test-site-config.mjs && node --check deploy/aliyun/doctor.mjs && node --check deploy/aliyun/preflight.mjs && node --check deploy/aliyun/verify-public-share.mjs && bash -n deploy/aliyun/*.sh scripts/test-aliyun-deploy-config.sh",
+    "test:share-api": "pnpm build:dist && node scripts/test-share-api.mjs",
+    "test:static-site": "pnpm build:site && node scripts/test-static-site.mjs",
+    "test:site-config": "node scripts/test-site-config.mjs",
+    "test:deploy-config": "bash scripts/test-aliyun-deploy-config.sh",
+    "typecheck": "tsc --noEmit",
+    "test": "pnpm typecheck && pnpm test:smoke && pnpm test:share-api && pnpm test:static-site && pnpm test:site-config && pnpm test:deploy-config"
   },
   "engines": {
     "node": ">=18"
@@ -58,6 +71,21 @@
   "license": "MIT",
   "dependencies": {
     "highlight.js": "^11.11.1",
-    "markdown-it": "^14.1.1"
+    "markdown-it": "^14.1.1",
+    "react": "^19.2.6",
+    "react-dom": "^19.2.6",
+    "sanitize-html": "^2.17.4"
+  },
+  "devDependencies": {
+    "@tailwindcss/vite": "^4.3.0",
+    "@types/node": "^25.9.1",
+    "@types/react": "^19.2.15",
+    "@types/react-dom": "^19.2.3",
+    "@types/sanitize-html": "^2.16.1",
+    "@vitejs/plugin-react": "^6.0.2",
+    "jsdom": "^29.1.1",
+    "tailwindcss": "^4.3.0",
+    "typescript": "^6.0.3",
+    "vite": "^8.0.14"
   }
 }

package/scripts/build-site.mjs

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+
+import { rm } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import tailwindcss from "@tailwindcss/vite";
+import react from "@vitejs/plugin-react";
+import { build } from "vite";
+
+const ROOT_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const OUT_DIR = path.join(ROOT_DIR, "site");
+const ASSETS_DIR = path.join(OUT_DIR, "assets");
+
+const entries = [
+  {
+    entry: path.join(ROOT_DIR, "src/site/main.tsx"),
+    fileName: "site",
+    globalName: "CodexSnapshotsSite",
+  },
+  {
+    entry: path.join(ROOT_DIR, "src/site/share.tsx"),
+    fileName: "share",
+    globalName: "CodexSnapshotsShare",
+  },
+];
+
+await Promise.all([
+  rm(path.join(ASSETS_DIR, "site.js"), { force: true }),
+  rm(path.join(ASSETS_DIR, "share.js"), { force: true }),
+  rm(path.join(ASSETS_DIR, "site.css"), { force: true }),
+]);
+
+for (const item of entries) {
+  await build({
+    root: ROOT_DIR,
+    configFile: false,
+    define: {
+      "process.env.NODE_ENV": JSON.stringify("production"),
+    },
+    publicDir: false,
+    logLevel: "warn",
+    plugins: [react(), tailwindcss()],
+    build: {
+      emptyOutDir: false,
+      minify: true,
+      outDir: OUT_DIR,
+      sourcemap: false,
+      target: "es2022",
+      lib: {
+        entry: item.entry,
+        formats: ["iife"],
+        name: item.globalName,
+        fileName: () => `assets/${item.fileName}.js`,
+        cssFileName: "assets/site",
+      },
+      rollupOptions: {
+        output: {
+          assetFileNames: (assetInfo) => {
+            if (assetInfo.name?.endsWith(".css")) {
+              return "assets/site.css";
+            }
+            return "assets/[name][extname]";
+          },
+          extend: true,
+        },
+      },
+    },
+  });
+}
+
+console.log("Built React/Tailwind static site assets in site/assets");

package/scripts/launch-agent.mjs

@@ -1,241 +1,33 @@
 #!/usr/bin/env node
 
-import { execFile } from "node:child_process";
-import { existsSync } from "node:fs";
-import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
-import os from "node:os";
+import { spawn } from "node:child_process";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { promisify } from "node:util";
 
-const execFileAsync = promisify(execFile);
-const label = process.env.SNAPSHOT_LAUNCH_AGENT_LABEL || "com.codex-snapshots.viewer";
-const uid = process.getuid?.() ?? Number.parseInt(process.env.UID || "", 10);
-const homeDir = os.homedir();
 const scriptDir = path.dirname(fileURLToPath(import.meta.url));
 const repoRoot = path.resolve(scriptDir, "..");
-const launchAgentsDir = path.join(homeDir, "Library", "LaunchAgents");
-const logsDir = path.join(homeDir, "Library", "Logs", "codex-snapshots");
-const plistPath = path.join(launchAgentsDir, `${label}.plist`);
-const stdoutPath = path.join(logsDir, "codex-snapshot.out.log");
-const stderrPath = path.join(logsDir, "codex-snapshot.err.log");
-const defaultApiUrl = "http://127.0.0.1:8787";
-const defaultSiteUrl = "http://127.0.0.1:8787";
+const cliPath = path.join(repoRoot, "dist", "cli", "codex-snapshot.mjs");
+const legacyCommand = process.argv[2] || "status";
+const args = ["daemon", legacyCommand, ...process.argv.slice(3)];
 
-const command = process.argv[2] || "status";
-
-main().catch((error) => {
-  console.error(error instanceof Error ? error.message : String(error));
-  process.exitCode = 1;
-});
-
-async function main() {
-  if (command === "install") {
-    await install();
-    return;
-  }
-  if (command === "uninstall") {
-    await uninstall();
-    return;
-  }
-  if (command === "status") {
-    await status();
-    return;
-  }
-  if (command === "logs") {
-    await logs();
-    return;
-  }
-  printHelp();
-  process.exitCode = 1;
+if (legacyCommand === "help" || legacyCommand === "--help" || legacyCommand === "-h") {
+  args.splice(1, 1, "help");
 }
 
-async function install() {
-  const pnpmPath = await resolvePnpmPath();
-  await mkdir(launchAgentsDir, { recursive: true });
-  await mkdir(logsDir, { recursive: true });
-
-  const plist = renderPlist({
-    pnpmPath,
-    apiUrl: process.env.SNAPSHOT_SHARE_API_URL || defaultApiUrl,
-    siteUrl: process.env.SNAPSHOT_SHARE_SITE_URL || defaultSiteUrl,
-  });
-
-  await writeFile(plistPath, plist, "utf8");
-  await bootoutIfLoaded();
-  await execLaunchctl(["bootstrap", guiDomain(), plistPath]);
-  await execLaunchctl(["kickstart", "-k", `${guiDomain()}/${label}`]);
-
-  console.log(`Installed ${label}`);
-  console.log(`Plist: ${plistPath}`);
-  console.log(`Logs: ${stdoutPath}`);
-  console.log(`Preview: http://127.0.0.1:4321/`);
-}
-
-async function uninstall() {
-  await bootoutIfLoaded();
-  await rm(plistPath, { force: true });
-  console.log(`Uninstalled ${label}`);
-}
+const child = spawn(process.execPath, [cliPath, ...args], {
+  cwd: repoRoot,
+  stdio: "inherit",
+});
 
-async function status() {
-  if (!existsSync(plistPath)) {
-    console.log(`Not installed: ${plistPath}`);
+child.on("exit", (code, signal) => {
+  if (signal) {
+    process.kill(process.pid, signal);
     return;
   }
-  try {
-    const { stdout } = await execLaunchctl(["print", `${guiDomain()}/${label}`]);
-    const state = stdout.match(/state = ([^\n]+)/)?.[1]?.trim() || "unknown";
-    const pid = stdout.match(/pid = (\d+)/)?.[1] || "";
-    console.log(`${label}: ${state}${pid ? `, pid=${pid}` : ""}`);
-    console.log(`Plist: ${plistPath}`);
-    console.log(`Preview: http://127.0.0.1:4321/`);
-  } catch (error) {
-    console.log(`${label}: installed but not loaded`);
-    console.log(`Plist: ${plistPath}`);
-    if (error instanceof Error && error.message) {
-      console.log(error.message);
-    }
-  }
-}
-
-async function logs() {
-  console.log(`==> ${stdoutPath}`);
-  console.log(await tailFile(stdoutPath));
-  console.log(`==> ${stderrPath}`);
-  console.log(await tailFile(stderrPath));
-}
-
-async function bootoutIfLoaded() {
-  try {
-    await execLaunchctl(["bootout", guiDomain(), plistPath]);
-  } catch {}
-  try {
-    await execLaunchctl(["bootout", `${guiDomain()}/${label}`]);
-  } catch {}
-}
-
-async function resolvePnpmPath() {
-  if (process.env.PNPM_EXECUTABLE) {
-    return process.env.PNPM_EXECUTABLE;
-  }
-  try {
-    const { stdout } = await execFileAsync("/bin/zsh", ["-lc", "command -v pnpm"], {
-      cwd: repoRoot,
-      maxBuffer: 1024 * 1024,
-    });
-    const pnpmPath = stdout.trim().split("\n")[0];
-    if (pnpmPath) {
-      return pnpmPath;
-    }
-  } catch {}
-  throw new Error("Cannot find pnpm. Install pnpm first, or run with PNPM_EXECUTABLE=/absolute/path/to/pnpm.");
-}
-
-function renderPlist({ pnpmPath, apiUrl, siteUrl }) {
-  const shellCommand = `cd ${shellQuote(repoRoot)} && exec ${shellQuote(pnpmPath)} snapshot:daemon`;
-  const stablePath = [
-    path.dirname(pnpmPath),
-    "/opt/homebrew/bin",
-    "/usr/local/bin",
-    "/usr/bin",
-    "/bin",
-    "/usr/sbin",
-    "/sbin",
-  ].join(":");
-  const env = {
-    PATH: process.env.SNAPSHOT_DAEMON_PATH || stablePath,
-    SNAPSHOT_SHARE_API_URL: apiUrl,
-    SNAPSHOT_SHARE_SITE_URL: siteUrl,
-    SNAPSHOT_VIEWER_ALLOWED_ORIGINS:
-      process.env.SNAPSHOT_VIEWER_ALLOWED_ORIGINS ||
-      "http://127.0.0.1:3000,http://localhost:3000",
-  };
-
-  return `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>Label</key>
-  <string>${xmlEscape(label)}</string>
-  <key>ProgramArguments</key>
-  <array>
-    <string>/bin/zsh</string>
-    <string>-lc</string>
-    <string>${xmlEscape(shellCommand)}</string>
-  </array>
-  <key>WorkingDirectory</key>
-  <string>${xmlEscape(repoRoot)}</string>
-  <key>EnvironmentVariables</key>
-  <dict>
-${Object.entries(env)
-  .map(([key, value]) => `    <key>${xmlEscape(key)}</key>\n    <string>${xmlEscape(value)}</string>`)
-  .join("\n")}
-  </dict>
-  <key>RunAtLoad</key>
-  <true/>
-  <key>KeepAlive</key>
-  <true/>
-  <key>ThrottleInterval</key>
-  <integer>10</integer>
-  <key>ProcessType</key>
-  <string>Background</string>
-  <key>StandardOutPath</key>
-  <string>${xmlEscape(stdoutPath)}</string>
-  <key>StandardErrorPath</key>
-  <string>${xmlEscape(stderrPath)}</string>
-</dict>
-</plist>
-`;
-}
-
-function guiDomain() {
-  if (!Number.isFinite(uid)) {
-    throw new Error("Cannot determine current macOS user id.");
-  }
-  return `gui/${uid}`;
-}
-
-async function execLaunchctl(args) {
-  return execFileAsync("/bin/launchctl", args, {
-    cwd: repoRoot,
-    maxBuffer: 1024 * 1024,
-  });
-}
-
-async function tailFile(filePath, lines = 80) {
-  try {
-    const text = await readFile(filePath, "utf8");
-    return text.split(/\r?\n/).slice(-lines).join("\n").trimEnd() || "(empty)";
-  } catch {
-    return "(missing)";
-  }
-}
-
-function shellQuote(value) {
-  return `'${String(value).replace(/'/g, "'\\''")}'`;
-}
-
-function xmlEscape(value) {
-  return String(value)
-    .replace(/&/g, "&amp;")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;")
-    .replace(/'/g, "&apos;");
-}
-
-function printHelp() {
-  console.log(`Usage:
-  pnpm snapshot:install-daemon
-  pnpm snapshot:daemon:status
-  pnpm snapshot:daemon:logs
-  pnpm snapshot:uninstall-daemon
+  process.exitCode = code || 0;
+});
 
-Environment:
-  PNPM_EXECUTABLE=/absolute/path/to/pnpm
-  SNAPSHOT_SHARE_API_URL=${defaultApiUrl}
-  SNAPSHOT_SHARE_SITE_URL=${defaultSiteUrl}
-  SNAPSHOT_VIEWER_ALLOWED_ORIGINS=http://127.0.0.1:3000,http://localhost:3000
-`);
-}
+child.on("error", (error) => {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+});

package/scripts/serve-site.mjs

@@ -9,7 +9,7 @@ import { fileURLToPath } from "node:url";
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "site");
 const parsed = parseArgs(process.argv.slice(2));
 const host = parsed.host || "127.0.0.1";
-const port = Number(parsed.port || 4323);
+const port = Number(parsed.port || 4322);
 
 if (parsed.help) {
   printHelp();
@@ -98,6 +98,6 @@ function printHelp() {
   console.log(`codex-snapshots site server
 
 Usage:
-  node scripts/serve-site.mjs [--host 127.0.0.1] [--port 4323]
+  node scripts/serve-site.mjs [--host 127.0.0.1] [--port 4322]
 `);
 }

package/scripts/test-aliyun-deploy-config.sh

@@ -0,0 +1,230 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+OUTPUT_FILE="$(mktemp)"
+VALID_CONFIG="$(mktemp)"
+AUTO_TOKEN_CONFIG="$(mktemp)"
+OAUTH_CONFIG="$(mktemp)"
+LOCAL_TOKEN_CONFIG="$(mktemp)"
+TOKEN_FILE="$(mktemp)"
+
+cleanup() {
+  rm -f "${OUTPUT_FILE}" "${VALID_CONFIG}" "${AUTO_TOKEN_CONFIG}" "${OAUTH_CONFIG}" "${LOCAL_TOKEN_CONFIG}" "${TOKEN_FILE}"
+}
+trap cleanup EXIT
+
+if bash "${ROOT_DIR}/deploy/aliyun/deploy-to-ecs.sh" \
+  --config "${ROOT_DIR}/deploy/aliyun/deploy.env.example" \
+  --dry-run >"${OUTPUT_FILE}" 2>&1; then
+  echo "Expected deploy.env.example to fail validation." >&2
+  exit 1
+fi
+
+grep -q "SSH target still uses the placeholder root@1.2.3.4" "${OUTPUT_FILE}"
+grep -q "DOMAIN still uses the placeholder snapshots.example.com" "${OUTPUT_FILE}"
+grep -q "TOKEN still uses the placeholder change-me" "${OUTPUT_FILE}"
+
+if node "${ROOT_DIR}/deploy/aliyun/doctor.mjs" \
+  --config "${ROOT_DIR}/deploy/aliyun/deploy.env.example" \
+  --offline >"${OUTPUT_FILE}" 2>&1; then
+  echo "Expected deploy doctor to fail on example placeholders." >&2
+  exit 1
+fi
+
+grep -q "SSH target: set SSH_TARGET to your ECS user and public IP" "${OUTPUT_FILE}"
+grep -q "Deploy dry-run: Deployment config needs real values before continuing" "${OUTPUT_FILE}"
+
+cat >"${VALID_CONFIG}" <<'EOF'
+SSH_TARGET=root@203.0.113.42
+SSH_IDENTITY_FILE=
+SSH_PORT=
+DOMAIN=snapshots.mycompany.dev
+API_URL=https://snapshots.mycompany.dev
+SITE_URL=https://ffffhx.github.io/codex-snapshots/
+TOKEN=test-token-0123456789
+CERTBOT_EMAIL=ops@example.org
+INSTALL_DEPS=0
+ISSUE_CERT=1
+RUN_PREFLIGHT=0
+RUN_VERIFY=0
+CONFIGURE_PAGES=0
+WAIT_PAGES=0
+CONFIGURE_LOCAL=0
+REINSTALL_DAEMON=0
+REMOTE_DIR=/tmp/codex-snapshots-deploy
+EOF
+
+bash "${ROOT_DIR}/deploy/aliyun/deploy-to-ecs.sh" --config "${VALID_CONFIG}" --dry-run >"${OUTPUT_FILE}" 2>&1
+
+grep -q "Resolved deployment plan" "${OUTPUT_FILE}"
+grep -q "Token: set (21 chars)" "${OUTPUT_FILE}"
+grep -q "Issue cert: 1" "${OUTPUT_FILE}"
+
+node "${ROOT_DIR}/deploy/aliyun/doctor.mjs" --config "${VALID_CONFIG}" --offline >"${OUTPUT_FILE}" 2>&1
+
+grep -q "Ready for local deployment orchestration" "${OUTPUT_FILE}"
+grep -q "Deploy dry-run: deploy-to-ecs.sh accepted the config" "${OUTPUT_FILE}"
+
+cat >"${AUTO_TOKEN_CONFIG}" <<'EOF'
+SSH_TARGET=root@203.0.113.42
+DOMAIN=snapshots.mycompany.dev
+API_URL=https://snapshots.mycompany.dev
+SITE_URL=https://ffffhx.github.io/codex-snapshots/
+TOKEN=auto
+INSTALL_DEPS=0
+ISSUE_CERT=0
+RUN_PREFLIGHT=0
+RUN_VERIFY=0
+CONFIGURE_PAGES=0
+WAIT_PAGES=0
+CONFIGURE_LOCAL=1
+REINSTALL_DAEMON=0
+REMOTE_DIR=/tmp/codex-snapshots-deploy
+EOF
+
+bash "${ROOT_DIR}/deploy/aliyun/deploy-to-ecs.sh" --config "${AUTO_TOKEN_CONFIG}" --dry-run >"${OUTPUT_FILE}" 2>&1
+
+grep -q "Publish token: generated for this deployment" "${OUTPUT_FILE}"
+grep -Eq "Token: generated \\([0-9]+ chars\\)" "${OUTPUT_FILE}"
+grep -q "Configure local publisher: 1" "${OUTPUT_FILE}"
+
+node "${ROOT_DIR}/deploy/aliyun/doctor.mjs" --config "${AUTO_TOKEN_CONFIG}" --offline >"${OUTPUT_FILE}" 2>&1
+
+grep -q "Publish token: will be generated by deploy-to-ecs.sh" "${OUTPUT_FILE}"
+grep -q "Local publisher config: will be written with generated token" "${OUTPUT_FILE}"
+
+cat >"${OAUTH_CONFIG}" <<'EOF'
+SSH_TARGET=root@203.0.113.42
+DOMAIN=snapshots.mycompany.dev
+API_URL=https://snapshots.mycompany.dev
+SITE_URL=https://ffffhx.github.io/codex-snapshots/
+TOKEN=change-me
+SNAPSHOT_GITHUB_CLIENT_ID=client-id-0123456789
+SNAPSHOT_GITHUB_CLIENT_SECRET=client-secret-0123456789
+SNAPSHOT_GITHUB_OWNER_LOGIN=site-owner
+SNAPSHOT_SESSION_SECRET=session-secret-0123456789-0123456789
+INSTALL_DEPS=0
+ISSUE_CERT=0
+RUN_PREFLIGHT=0
+RUN_VERIFY=0
+CONFIGURE_PAGES=0
+WAIT_PAGES=0
+CONFIGURE_LOCAL=1
+REINSTALL_DAEMON=0
+REMOTE_DIR=/tmp/codex-snapshots-deploy
+EOF
+
+bash "${ROOT_DIR}/deploy/aliyun/deploy-to-ecs.sh" --config "${OAUTH_CONFIG}" --dry-run >"${OUTPUT_FILE}" 2>&1
+
+grep -q "Resolved deployment plan" "${OUTPUT_FILE}"
+grep -q "Token: not configured (GitHub OAuth mode)" "${OUTPUT_FILE}"
+grep -q "GitHub OAuth: configured" "${OUTPUT_FILE}"
+
+node "${ROOT_DIR}/deploy/aliyun/doctor.mjs" --config "${OAUTH_CONFIG}" --offline >"${OUTPUT_FILE}" 2>&1
+
+grep -q "GitHub OAuth: configured for site-owner" "${OUTPUT_FILE}"
+grep -q "Publish token: not required when GitHub OAuth is configured" "${OUTPUT_FILE}"
+grep -q "Local publisher config: will be written with public API/site URLs for GitHub OAuth" "${OUTPUT_FILE}"
+
+cat >"${LOCAL_TOKEN_CONFIG}" <<'EOF'
+SSH_TARGET=root@203.0.113.42
+DOMAIN=snapshots.mycompany.dev
+API_URL=https://snapshots.mycompany.dev
+SITE_URL=https://ffffhx.github.io/codex-snapshots/
+INSTALL_DEPS=0
+ISSUE_CERT=0
+RUN_PREFLIGHT=0
+RUN_VERIFY=0
+CONFIGURE_PAGES=0
+WAIT_PAGES=0
+CONFIGURE_LOCAL=0
+REINSTALL_DAEMON=0
+REMOTE_DIR=/tmp/codex-snapshots-deploy
+EOF
+
+cat >"${TOKEN_FILE}" <<'EOF'
+{
+  "snapshotShareToken": "local-file-token-0123456789",
+  "snapshotShareApiUrl": "https://snapshots.mycompany.dev",
+  "snapshotShareSiteUrl": "https://ffffhx.github.io/codex-snapshots"
+}
+EOF
+
+SNAPSHOT_SHARE_TOKEN_FILE="${TOKEN_FILE}" \
+bash "${ROOT_DIR}/deploy/aliyun/deploy-to-ecs.sh" --config "${LOCAL_TOKEN_CONFIG}" --dry-run >"${OUTPUT_FILE}" 2>&1
+
+grep -q "Resolved deployment plan" "${OUTPUT_FILE}"
+grep -q "Token: set (27 chars)" "${OUTPUT_FILE}"
+
+if bash "${ROOT_DIR}/deploy/aliyun/configure-local-publisher.sh" \
+  --api-url https://snapshots.example.com \
+  --token change-me \
+  --token-file "${TOKEN_FILE}" \
+  --no-check >"${OUTPUT_FILE}" 2>&1; then
+  echo "Expected placeholder local publisher config to fail validation." >&2
+  exit 1
+fi
+
+grep -q "API URL still uses the placeholder https://snapshots.example.com" "${OUTPUT_FILE}"
+grep -q "Token still uses the placeholder change-me" "${OUTPUT_FILE}"
+
+bash "${ROOT_DIR}/deploy/aliyun/configure-local-publisher.sh" \
+  --api-url https://snapshots.mycompany.dev \
+  --site-url https://ffffhx.github.io/codex-snapshots/ \
+  --token test-token-0123456789 \
+  --token-file "${TOKEN_FILE}" \
+  --no-check >"${OUTPUT_FILE}" 2>&1
+
+grep -q "Wrote local publisher config" "${OUTPUT_FILE}"
+grep -q "Public share API: https://snapshots.mycompany.dev" "${OUTPUT_FILE}"
+grep -q '"snapshotShareToken": "test-token-0123456789"' "${TOKEN_FILE}"
+grep -q '"snapshotShareApiUrl": "https://snapshots.mycompany.dev"' "${TOKEN_FILE}"
+grep -q '"snapshotShareSiteUrl": "https://ffffhx.github.io/codex-snapshots"' "${TOKEN_FILE}"
+
+bash "${ROOT_DIR}/deploy/aliyun/configure-local-publisher.sh" \
+  --api-url https://snapshots.mycompany.dev \
+  --site-url https://ffffhx.github.io/codex-snapshots/ \
+  --token-file "${TOKEN_FILE}" \
+  --no-check >"${OUTPUT_FILE}" 2>&1
+
+grep -q "Legacy publish token: not configured" "${OUTPUT_FILE}"
+grep -q '"snapshotShareApiUrl": "https://snapshots.mycompany.dev"' "${TOKEN_FILE}"
+grep -q '"snapshotShareSiteUrl": "https://ffffhx.github.io/codex-snapshots"' "${TOKEN_FILE}"
+if grep -q '"snapshotShareToken"' "${TOKEN_FILE}"; then
+  echo "OAuth local publisher config should not require a snapshotShareToken." >&2
+  exit 1
+fi
+
+if bash "${ROOT_DIR}/deploy/aliyun/configure-github-pages-api.sh" \
+  --api-url https://snapshots.example.com \
+  --no-dispatch >"${OUTPUT_FILE}" 2>&1; then
+  echo "Expected placeholder GitHub Pages API config to fail validation." >&2
+  exit 1
+fi
+
+grep -q "API URL still uses the placeholder https://snapshots.example.com" "${OUTPUT_FILE}"
+
+grep -q -- '--exclude "deploy/aliyun/deploy.env"' "${ROOT_DIR}/deploy/aliyun/deploy-to-ecs.sh"
+grep -q -- '--exclude ".env"' "${ROOT_DIR}/deploy/aliyun/deploy-to-ecs.sh"
+grep -q -- '--exclude "backups"' "${ROOT_DIR}/deploy/aliyun/deploy-to-ecs.sh"
+grep -q 'rm -f .env deploy/aliyun/deploy.env' "${ROOT_DIR}/deploy/aliyun/deploy-to-ecs.sh"
+grep -q -- '--check-local-config' "${ROOT_DIR}/deploy/aliyun/deploy-to-ecs.sh"
+
+grep -q -- '--exclude "deploy/aliyun/deploy.env"' "${ROOT_DIR}/deploy/aliyun/install-share-api.sh"
+grep -q -- '--exclude ".env"' "${ROOT_DIR}/deploy/aliyun/install-share-api.sh"
+grep -q -- '--exclude "backups"' "${ROOT_DIR}/deploy/aliyun/install-share-api.sh"
+grep -q 'rm -f "${APP_DIR}/.env" "${APP_DIR}/deploy/aliyun/deploy.env"' "${ROOT_DIR}/deploy/aliyun/install-share-api.sh"
+grep -q 'systemd_env_value' "${ROOT_DIR}/deploy/aliyun/install-share-api.sh"
+grep -q 'SNAPSHOT_SHARE_TOKEN=%s' "${ROOT_DIR}/deploy/aliyun/install-share-api.sh"
+grep -q 'SNAPSHOT_SHARE_PUBLIC_API_URL=%s' "${ROOT_DIR}/deploy/aliyun/install-share-api.sh"
+grep -q 'SNAPSHOT_SHARE_TOKEN must be a single-line value' "${ROOT_DIR}/deploy/aliyun/install-share-api.sh"
+
+grep -q 'proxy_pass http://127.0.0.1:8787' "${ROOT_DIR}/deploy/aliyun/nginx-codex-snapshots.bootstrap.conf"
+grep -q 'proxy_set_header X-Forwarded-Host $host;' "${ROOT_DIR}/deploy/aliyun/nginx-codex-snapshots.bootstrap.conf"
+grep -q 'proxy_set_header X-Forwarded-Port $server_port;' "${ROOT_DIR}/deploy/aliyun/nginx-codex-snapshots.bootstrap.conf"
+grep -q 'Strict-Transport-Security "max-age=31536000"' "${ROOT_DIR}/deploy/aliyun/nginx-codex-snapshots.conf"
+grep -q 'X-Frame-Options DENY' "${ROOT_DIR}/deploy/aliyun/nginx-codex-snapshots.conf"
+grep -q 'proxy_set_header X-Forwarded-Proto https;' "${ROOT_DIR}/deploy/aliyun/nginx-codex-snapshots.conf"
+
+echo "✓ Aliyun deploy config validation checks passed"