Merge remote-tracking branch 'origin/master' into codex/agc-runtime-generation-reliability

scripts/check-preview-deployer.mjs

@@ -125,6 +125,16 @@ assertIncludes(
   'restart: on-failure',
   '预览外部生成 worker 必须在运行时身份初始化竞态后自动重启。',
 );
+assertIncludes(
+  deployer,
+  'GENARRATIVE_DEV_PASSWORD_ENTRY_AUTO_REGISTER_ENABLED=true',
+  '预览独立空库必须允许首次密码登录自动创建预览账号。',
+);
+assertIncludes(
+  deployer,
+  "'SMS_AUTH_ENABLED=true',\n  'SMS_AUTH_PROVIDER=mock',\n  'SMS_AUTH_MOCK_VERIFY_CODE=123456'",
+  '预览短信登录必须使用固定 mock 验证码，不得继承生产短信密钥。',
+);
 assertIncludes(
   deployer,
   '^preview-[0-9a-f]{16}$',

scripts/jenkins-preview-deployer.sh

@@ -336,6 +336,15 @@ const [file, internalSecret, jwtSecret] = process.argv.slice(2);
 let content = fs.readFileSync(file, 'utf8');
 content = content.replace(/^GENARRATIVE_INTERNAL_API_SECRET=.*$/mu, `GENARRATIVE_INTERNAL_API_SECRET=${internalSecret}`);
 content = content.replace(/^GENARRATIVE_JWT_SECRET=.*$/mu, `GENARRATIVE_JWT_SECRET=${jwtSecret}`);
+content += [
+  '',
+  '# Jenkins 分支预览使用隔离数据库和预览专用认证，不继承生产账号或短信凭据。',
+  'GENARRATIVE_DEV_PASSWORD_ENTRY_AUTO_REGISTER_ENABLED=true',
+  'SMS_AUTH_ENABLED=true',
+  'SMS_AUTH_PROVIDER=mock',
+  'SMS_AUTH_MOCK_VERIFY_CODE=123456',
+  '',
+].join('\n');
 fs.writeFileSync(file, content, {encoding: 'utf8', mode: 0o600});
 NODE
   unset internal_secret jwt_secret