deployment-cleanup

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

deployment-cleanup

The site works, but it still thinks it is running on someone's laptop: canonical to

localhost:5173

, sitemap on

staging.

NEXT_PUBLIC_API_URL=http://localhost:3001

, a test-mode payment key, a

/debug

route. This skill hunts those leftovers.

网站功能正常，但它仍然像运行在某人的笔记本电脑上：canonical 指向

localhost:5173

，sitemap 指向

staging.

，

NEXT_PUBLIC_API_URL=http://localhost:3001

，使用 test 模式的支付密钥，以及存在

/debug

路由。此 skill 用于排查这些遗留项。

Activate when

何时启用

Before any launch, domain cutover, or move from preview to production.
```
discoverability-all
```
/
```
production-all
```
route here (checks 17, 38).
Not to deploy, change DNS, or edit production secrets.

在任何 launch、domain cutover，或从 preview 迁移到 production 之前。
```
discoverability-all
```
/
```
production-all
```
由此路由至这里（checks 17、38）。
不用于 deploy、修改 DNS 或编辑 production secrets。

Inspect

检查

Shipped-output sweep (run against a production build, not dev):

bash

node scripts/scan-secrets.mjs --root .            # DEV_URL_IN_SHIPPED_OUTPUT, SOURCEMAP_EXPOSED, DEBUG_ROUTE_PRESENT, secrets
node scripts/inspect-metadata.mjs --url <site> --render     # localhost/staging in canonical, OG, sitemap, robots, JSON-LD
node scripts/check-links.mjs --url <site> --render          # LINK_DEV_HOST, placeholder targets, form actions

Paths are relative to this skill's folder.

Search config and source for:
```
localhost
```
,
```
127.0.0.1
```
,
```
0.0.0.0
```
,
```
.local
```
,
```
staging
```
,
```
preview
```
,
```
.vercel.app
```
/
```
.netlify.app
```
(ok only if intended),
```
ngrok
```
,
```
example.com
```
,
```
TODO
```
/
```
FIXME
```
/
```
XXX
```
in user-visible strings,
```
console.log
```
/
```
debugger
```
with sensitive data,
```
if (process.env.NODE_ENV !== "production")
```
guards that fail open, feature flags defaulting to "on" for admin/debug,
```
NEXT_PUBLIC_*
```
/
```
VITE_*
```
URLs pointing at dev services.
Environment parity: which env vars the code needs (
```
.env.example
```
, config reads) vs. which are set in the deployment (owner confirms; you cannot read production values). Missing values silently falling back to dev defaults (
```
process.env.API_URL ?? "http://localhost:3001"
```
) are launch bugs.
Test vs live modes: payment provider keys (
```
pk_test
```
/
```
sk_test
```
vs live), OAuth redirect URIs, webhook endpoints, email provider sandbox mode, analytics property IDs (dev vs prod), captcha test keys (
```
1x00000000000000000000AA
```
style always-pass keys), map/API key restrictions (HTTP-referrer or origin restricted?).
Test data and accounts: seed users, default admin passwords, demo content, "test" products/orders, fake reviews, sample emails; sitemap/robots/noindex states appropriate for launch (a
```
noindex
```
left on production, or removed on a site meant to stay private).
Build hygiene: production build succeeds without warnings that indicate misconfiguration; source maps excluded or access-restricted; no
```
dist
```
/
```
.next
```
cache directories committed; drafts and preview routes not shipped;
```
robots.txt
```
correct for production.
Ops basics (ask, do not assume): error monitoring installed and pointing at the right project; analytics environment separation; uptime check; backup for the database; domain/HTTPS/redirect policy set (
```
security-headers
```
); rollback path known.
Domain-move checklist when switching hosts: canonical/sitemap/OG/host absolutes updated; redirects from old hosts; OAuth/webhook URLs updated.

发布产物扫描（针对 production build 运行，而不是 dev）：

bash

node scripts/scan-secrets.mjs --root .            # DEV_URL_IN_SHIPPED_OUTPUT, SOURCEMAP_EXPOSED, DEBUG_ROUTE_PRESENT, secrets
node scripts/inspect-metadata.mjs --url <site> --render     # localhost/staging in canonical, OG, sitemap, robots, JSON-LD
node scripts/check-links.mjs --url <site> --render          # LINK_DEV_HOST, placeholder targets, form actions

路径相对于此 skill 所在目录。

在 config 和 source 中搜索：
```
localhost
```
、
```
127.0.0.1
```
、
```
0.0.0.0
```
、
```
.local
```
、
```
staging
```
、
```
preview
```
、
```
.vercel.app
```
/
```
.netlify.app
```
（仅在意图明确时允许）、
```
ngrok
```
、
```
example.com
```
、用户可见字符串中的
```
TODO
```
/
```
FIXME
```
/
```
XXX
```
、包含敏感数据的
```
console.log
```
/
```
debugger
```
、采用 fail open 的
```
if (process.env.NODE_ENV !== "production")
```
guard、为 admin/debug 默认设为
```
"on"
```
的 feature flag，以及指向 dev service 的
```
NEXT_PUBLIC_*
```
/
```
VITE_*
```
URL。
**环境一致性：**代码需要哪些 env var（
```
.env.example
```
、config 读取项），以及 deployment 中设置了哪些 env var（由 owner 确认；你无法读取 production 值）。缺失值静默 fallback 到 dev 默认值（
```
process.env.API_URL ?? "http://localhost:3001"
```
）属于 launch bug。
**test 与 live 模式：**支付 provider 的 key（
```
pk_test
```
/
```
sk_test
```
与 live key）、OAuth redirect URI、webhook endpoint、email provider 的 sandbox 模式、analytics property ID（dev 与 prod）、captcha test key（
```
1x00000000000000000000AA
```
样式的永久通过 key），以及 map/API key 限制（是否限制 HTTP referrer 或 origin）。
**测试数据和账户：**seed 中的用户、默认 admin 密码、demo 内容、“test”商品或订单、虚假评价、示例邮箱；sitemap/robots/noindex 状态应符合上线目标（面向公网的 production 上不应残留
```
noindex
```
；本应保持私有的站点则不应移除
```
noindex
```
）。
**构建卫生：**production build 应成功完成，且不应出现表明 misconfiguration 的 warning；source map 应被排除或限制访问；不应将
```
dist
```
/
```
.next
```
cache 目录提交到版本库；draft 和 preview route 不应进入发布产物；
```
robots.txt
```
应符合 production 要求。
运维基础项（需要询问，不要臆测）：已安装错误监控并指向正确项目；analytics 环境已隔离；已配置 uptime check；数据库有 backup；已设置 domain/HTTPS/redirect 策略（
```
security-headers
```
）；已知 rollback 路径。
**切换 host 时的 domain 迁移检查清单：**更新 canonical/sitemap/OG/host 中的绝对 URL；配置旧 host 的 redirect；更新 OAuth/webhook URL。

Evidence that counts

有效证据

Label each claim OBSERVED, SOURCE-INDICATED, DECLARED, INFERRED, UNKNOWN, or REVIEW REQUIRED. UNKNOWN is never a pass and never a failure.

A string in the shipped bundle or served HTML: OBSERVED. A string in source or config: SOURCE-INDICATED (it may not reach production).
Production environment values are the owner's; ask them to confirm which are set. Do not read secrets from
```
.env
```
files.
A
```
.vercel.app
```
or platform hostname may be the production host; do not call it a leftover without confirming intent.

将每项结论标记为 OBSERVED、SOURCE-INDICATED、DECLARED、INFERRED、UNKNOWN 或 REVIEW REQUIRED。UNKNOWN 既不表示通过，也不表示失败。

发布 bundle 或已提供 HTML 中的字符串：OBSERVED。source 或 config 中的字符串：SOURCE-INDICATED（它可能不会进入 production）。
production env 值由 owner 掌握；请 owner 确认已设置哪些值。不要从
```
.env
```
文件读取 secrets。
```
.vercel.app
```
或平台主机名可能就是 production host；未确认意图前，不要将其判定为遗留项。

May change

可以修改的内容

Replace dev/staging URLs with the confirmed production origin (via env-driven config, not hardcoding); remove dev fallbacks that fail open (fail loudly instead); remove or gate debug routes and console noise; exclude source maps from production; delete test data from seeds shipped to production; fix

noindex

/robots for the intended state; add

.env.example

entries; update docs listing required production env vars. Do not change deployment settings, DNS, or environment values on the platform.

使用经确认的 production origin 替换 dev/staging URL（通过 env-driven config，不要硬编码）；移除会 fail open 的 dev fallback（应改为明确报错）；移除 debug route 和 console noise，或为其增加访问限制；从 production 中排除 source map；从会发布到 production 的 seed 中删除 test data；根据预期状态修正 noindex/robots；补充

.env.example

条目；更新文档，列出 required production env var。不要修改平台上的 deployment 设置、DNS 或环境值。

Must not claim

不得声称

"Production-ready", "clean", or "no dev artifacts" beyond what the sweep covered. Say which builds and paths were scanned.

不得超出本次扫描的覆盖范围声称“Production-ready”、“clean”或“no dev artifacts”。应说明扫描了哪些 build 和 path。

Verify

验证

Rebuild and re-run the three commands; grep the rebuilt output for

localhost

staging

; confirm debug routes 404 in production mode; confirm behavior with only production env values present (missing var now errors clearly).

重新构建并再次运行这三个命令；对重建后的 output grep

localhost

staging

；确认 debug route 在 production 模式下返回 404；确认仅提供 production env 值时的行为（缺失 var 现在应明确报错）。

Escalate

升级处理

Test-mode keys in production or live keys exposed (owner action needed); real user data in test fixtures; anything requiring platform access; missing backups or monitoring for a launch with real users.

production 中存在 test-mode key，或 live key 已暴露（需要 owner 采取行动）；test fixture 中包含真实用户数据；任何需要 platform access 的事项；面向真实用户上线时缺少 backup 或 monitoring。

No change is valid when

何时不修改也是有效结果

The sweeps are clean and the owner confirms production env parity. Do not remove intentional staging banners on a staging site.

各项扫描均未发现问题，且 owner 确认 production 环境一致时，不做修改是有效的。不要移除 staging site 上有意设置的 staging banner。