@baize-ai/core 0.2.0 → 0.3.0

package/skills/web-console/scripts/a2a-admin.js

@@ -0,0 +1,506 @@
+/**
+ * A2A admin backend for the web console.
+ *
+ * Proxies to the @baize-ai/baize-a2a scripts/cli.js (D19 contract §6) for
+ * status/enable/disable/peers/search/send/task, and reads two local SQLite
+ * databases directly for the read-only boards:
+ *   - task_runs board:  ~/baize/scheduler/scheduler.db (source = 'a2a', §3)
+ *   - message log:      ~/baize/components/a2a/a2a.db (inbox/outbox, §0 db.js)
+ *
+ * The CLI resolution mirrors channel-admin.js cliPath()/runCli (web-console
+ * is deployed as a standalone skill, so it cannot import cli/lib).
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import net from 'node:net';
+import { spawn, execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import Database from 'better-sqlite3';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+function baizeDir() {
+  return process.env.BAIZE_DIR || path.join(os.homedir(), 'baize');
+}
+
+/**
+ * Locate the baize-a2a scripts/cli.js. Precedence:
+ * BAIZE_A2A_PATH env → channel install (~/baize/.claude/skills/a2a) →
+ * global npm (@baize-ai/baize-a2a) → dev sibling ../baize-a2a.
+ */
+export function a2aCliPath() {
+  const envPath = process.env.BAIZE_A2A_PATH;
+  if (envPath && fs.existsSync(envPath)) {
+    if (fs.statSync(envPath).isDirectory()) {
+      const inner = path.join(envPath, 'scripts', 'cli.js');
+      if (fs.existsSync(inner)) return inner;
+    } else {
+      return envPath;
+    }
+  }
+  // baize-a2a is a channel package — `baize add` installs it under
+  // ~/baize/.claude/skills/a2a/ (SKILL.md layout), not npm global.
+  const baizeDir = process.env.BAIZE_DIR || path.join(os.homedir(), 'baize');
+  const candidates = [
+    path.join(baizeDir, '.claude', 'skills', 'a2a', 'scripts', 'cli.js'),
+    path.join(__dirname, '..', '..', '..', 'node_modules', '@baize-ai', 'baize-a2a', 'scripts', 'cli.js'),
+  ];
+  try {
+    const npmRoot = execFileSync('npm', ['root', '-g'], { encoding: 'utf8', timeout: 10000 }).trim();
+    candidates.push(path.join(npmRoot, '@baize-ai', 'baize-a2a', 'scripts', 'cli.js'));
+  } catch {
+    // npm unavailable
+  }
+  // Dev-time sibling repo (../baize-a2a next to baize-core)
+  candidates.push(path.join(__dirname, '..', '..', '..', '..', 'baize-a2a', 'scripts', 'cli.js'));
+  return candidates.find((c) => fs.existsSync(c)) || null;
+}
+
+/**
+ * Run a baize-a2a CLI command with --json appended (contract §6: JSON on
+ * stdout, exit 0 success / stderr + exit 1 failure).
+ *
+ * The child gets a piped stdin that is ended immediately: the baize-a2a CLI
+ * merges a JSON object from stdin and blocks until stdin EOF.
+ */
+export async function runA2aCli(args, { cliPath = a2aCliPath(), timeout = 120000, spawnFn = spawn } = {}) {
+  const cli = typeof cliPath === 'function' ? cliPath() : cliPath;
+  if (!cli) {
+    return { success: false, error: '未找到 baize-a2a CLI（设置 BAIZE_A2A_PATH 或安装 @baize-ai/baize-a2a）' };
+  }
+  const argv = args.includes('--json') ? [...args] : [...args, '--json'];
+  return new Promise((resolve) => {
+    const child = spawnFn(process.execPath, [cli, ...argv], {
+      env: { ...process.env },
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    let stdout = '';
+    let stderr = '';
+    let settled = false;
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      child.kill('SIGTERM');
+      resolve({ success: false, error: `a2a 命令超时（${Math.round(timeout / 1000)}s）`, output: (stdout || stderr).trim() });
+    }, timeout);
+    child.stdout.on('data', (d) => { stdout += String(d); });
+    child.stderr.on('data', (d) => { stderr += String(d); });
+    child.on('error', (err) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve({ success: false, error: err.message });
+    });
+    child.on('close', (code) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      const raw = stdout.trim();
+      let json = null;
+      try {
+        json = raw ? JSON.parse(raw) : null;
+      } catch {
+        // non-JSON stdout
+      }
+      if (code === 0) {
+        resolve({ success: true, json: json || {}, output: raw });
+        return;
+      }
+      const detail = (json?.error || stderr.trim() || raw || `exit ${code}`).slice(-1500);
+      resolve({ success: false, error: detail, json, output: raw || stderr.trim() });
+    });
+    child.stdin.end();
+  });
+}
+
+// ── Delegated commands (argv passthrough + field validation) ───────────────
+
+export async function getA2aStatus() {
+  return runA2aCli(['status']);
+}
+
+export async function getA2aPeers() {
+  return runA2aCli(['peer', 'list']);
+}
+
+export async function searchA2aAgents(query) {
+  const q = String(query || '').trim();
+  if (!q) return { success: false, error: '缺少搜索关键字' };
+  return runA2aCli(['search', q]);
+}
+
+
+export async function enableA2a({ adminUrl, advertiseUrl } = {}) {
+  const admin = String(adminUrl || '').trim();
+  const advertise = String(advertiseUrl || '').trim();
+  if (!admin || !advertise) return { success: false, error: '启用 A2A 需要 Admin 服务地址与对外宣告地址' };
+  // D25 switch contract: >60s is a failure.
+  return runA2aCli(['enable', '--admin', admin, '--advertise', advertise], { timeout: 60000 });
+}
+
+export async function disableA2a() {
+  return runA2aCli(['disable'], { timeout: 60000 });
+}
+
+export async function sendA2aMessage({ peer, text } = {}) {
+  const p = String(peer || '').trim();
+  const t = String(text || '').trim();
+  if (!p || !t) return { success: false, error: '发送消息需要 peer 与内容' };
+  return runA2aCli(['send', p, t]);
+}
+
+export async function submitA2aTask({ peer, skill, instruction, async: isAsync } = {}) {
+  const p = String(peer || '').trim();
+  const inst = String(instruction || '').trim();
+  if (!p || !inst) return { success: false, error: '派发任务需要 peer 与指令' };
+  const args = ['task', p];
+  if (String(skill || '').trim()) args.push(String(skill).trim());
+  args.push(inst);
+  if (isAsync) args.push('--async');
+  // Sync task waits for a terminal state (contract: up to 10 min).
+  return runA2aCli(args, { timeout: 660000 });
+}
+
+export async function getA2aTask(taskId) {
+  const id = String(taskId || '').trim();
+  if (!id) return { success: false, error: '缺少 taskId' };
+  return runA2aCli(['task', 'status', id]);
+}
+
+export async function cancelA2aTask(taskId) {
+  const id = String(taskId || '').trim();
+  if (!id) return { success: false, error: '缺少 taskId' };
+  return runA2aCli(['task', 'cancel', id]);
+}
+
+// ── Read-only boards ────────────────────────────────────────────────────────
+// ── D25 单元 B: 私有交付安装 + 运行模式 / 守护进程健康 ───────────────────────
+
+export const A2A_PACKAGE_NAME = '@baize-ai/baize-a2a';
+export const A2A_MODES = Object.freeze(new Set(['standalone', 'cluster']));
+const A2A_INSTALL_MAX_MB = 100;
+const A2A_INSTALL_MAX_BYTES = A2A_INSTALL_MAX_MB * 1024 * 1024;
+const TAR_TIMEOUT_MS = 30000;
+const NPM_INSTALL_TIMEOUT_MS = 300000;
+
+/** Same override chain as the web-console server (a2aConfigPath). */
+export function a2aConfigPath() {
+  return process.env.BAIZE_A2A_CONFIG || path.join(baizeDir(), 'components', 'a2a', 'config.json');
+}
+
+function defaultSkillsDir() {
+  return process.env.WEB_CONSOLE_SKILLS_DIR || path.join(baizeDir(), '.claude', 'skills');
+}
+
+function componentsFile() {
+  return path.join(baizeDir(), '.baize', 'components.json');
+}
+
+function readComponents(file) {
+  try { return JSON.parse(fs.readFileSync(file, 'utf8')) || {}; } catch { return {}; }
+}
+
+function writeComponents(file, components) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, JSON.stringify(components, null, 2));
+}
+
+/**
+ * Resolve the A2A run mode for display (D25 contract):
+ *   CLI-reported mode → config.json mode → derived from enabled
+ * (legacy configs lack an explicit mode: enabled → 'cluster', else 'standalone').
+ */
+export function resolveA2aMode(cliMode) {
+  if (A2A_MODES.has(cliMode)) return cliMode;
+  let cfg = {};
+  try {
+    cfg = JSON.parse(fs.readFileSync(a2aConfigPath(), 'utf8'));
+  } catch {
+    return 'standalone';
+  }
+  if (A2A_MODES.has(cfg.mode)) return cfg.mode;
+  return cfg.enabled ? 'cluster' : 'standalone';
+}
+
+/**
+ * Daemon readiness = TCP connect to the configured listenPort (default 8443,
+ * config listenPort wins). The daemon is HTTPS; a plain TCP connect — not a
+ * TLS handshake — is the contract's readiness signal.
+ */
+export function probeA2aDaemonHealthy({ timeoutMs = 2000 } = {}) {
+  let port = 8443;
+  let host = '127.0.0.1';
+  try {
+    const cfg = JSON.parse(fs.readFileSync(a2aConfigPath(), 'utf8'));
+    const p = Number.parseInt(cfg.listenPort, 10);
+    if (Number.isInteger(p) && p > 0) port = p;
+    const rawHost = String(cfg.listenHost || '').trim();
+    if (rawHost && rawHost !== '0.0.0.0' && rawHost !== '::') host = rawHost;
+  } catch {
+    // defaults (8443 / 127.0.0.1)
+  }
+  return new Promise((resolve) => {
+    const socket = net.connect({ port, host });
+    let settled = false;
+    const finish = (ok) => {
+      if (settled) return;
+      settled = true;
+      socket.destroy();
+      resolve(ok);
+    };
+    socket.setTimeout(timeoutMs);
+    socket.once('connect', () => finish(true));
+    socket.once('timeout', () => finish(false));
+    socket.once('error', () => finish(false));
+  });
+}
+
+function listTarballEntries(tarballPath) {
+  const listing = execFileSync('tar', ['tzf', tarballPath], {
+    timeout: TAR_TIMEOUT_MS, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  return listing.split('\n').map((e) => e.replace(/^\.\//, '').replace(/\/$/, '')).filter(Boolean);
+}
+
+function isUnsafeArchiveEntry(entry) {
+  if (path.posix.isAbsolute(entry) || path.win32.isAbsolute(entry)) return true;
+  const normalized = entry.replace(/\\/g, '/');
+  return normalized === '..' || normalized.startsWith('../') || normalized.split('/').includes('..');
+}
+
+function assertNoArchiveLinks(tarballPath) {
+  const verbose = execFileSync('tar', ['tvzf', tarballPath], {
+    timeout: TAR_TIMEOUT_MS, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  const link = verbose.split('\n').find((line) => line.startsWith('l') || line.startsWith('h'));
+  if (link) throw new Error('归档包含符号链接或硬链接，已拒绝（防止越权写入）');
+}
+
+function readTarballPackageJson(tarballPath, entries) {
+  const pkgEntry = entries.find((e) => e === 'package.json' || e.endsWith('/package.json'));
+  if (!pkgEntry) return null;
+  const raw = execFileSync('tar', ['xzf', tarballPath, '-O', pkgEntry], {
+    timeout: TAR_TIMEOUT_MS, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  return JSON.parse(raw);
+}
+
+function extractTarballTo(tarballPath, destDir, entries) {
+  const firstParts = new Set(entries.map((e) => e.split('/')[0]));
+  const hasSingleWrapper = firstParts.size === 1 && entries.some((e) => e.includes('/'));
+  fs.mkdirSync(destDir, { recursive: true });
+  const args = ['xzf', tarballPath, '-C', destDir];
+  if (hasSingleWrapper) args.push('--strip-components=1');
+  execFileSync('tar', args, { timeout: TAR_TIMEOUT_MS, stdio: 'pipe' });
+}
+
+function npmInstallDeps(cwd) {
+  return new Promise((resolve) => {
+    // --ignore-scripts: uploaded tarballs are vendor-provided; never run
+    // their lifecycle hooks (postinstall etc.) with the web-console's privileges.
+    const child = spawn('npm', ['install', '--omit=dev', '--ignore-scripts', '--no-audit', '--no-fund'], {
+      cwd, env: { ...process.env }, stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let stderr = '';
+    let settled = false;
+    child.stderr.on('data', (d) => { stderr += String(d); });
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      child.kill('SIGTERM');
+      resolve({ ok: false, error: `npm install 超时（${Math.round(NPM_INSTALL_TIMEOUT_MS / 1000)}s）` });
+    }, NPM_INSTALL_TIMEOUT_MS);
+    child.on('error', (err) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve({ ok: false, error: err.message });
+    });
+    child.on('close', (code) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(code === 0 ? { ok: true } : { ok: false, error: (stderr.trim() || `exit ${code}`).slice(-500) });
+    });
+  });
+}
+
+/**
+ * Install @baize-ai/baize-a2a from an uploaded .tar.gz (D25 私有交付).
+ * Pipeline: entry listing + path-safety vetting (no `..`/absolute/links) →
+ * manifest check (name = @baize-ai/baize-a2a, version present) → extract to
+ * SKILLS_DIR/a2a → npm install --omit=dev → components.json registration.
+ * Already installed → { ok:false, error } naming the installed version
+ * (mirrors `baize add`; version bumps go through `baize upgrade a2a`).
+ *
+ * @returns {Promise<{ok:boolean, version?:string, error?:string}>}
+ */
+export async function installA2aTarball(tarballPath, {
+  skillsDir = defaultSkillsDir(),
+  componentsFile: componentsPath = componentsFile(),
+  installDeps = npmInstallDeps,
+  originalName = null,
+} = {}) {
+  const file = String(tarballPath || '');
+  const nameForType = String(originalName || file || '');
+  if (!/\.(?:tar\.gz|tgz)$/i.test(nameForType)) {
+    return { ok: false, error: '安装包必须是 .tar.gz 归档' };
+  }
+  let stat;
+  try {
+    stat = fs.statSync(file);
+  } catch {
+    return { ok: false, error: '上传文件不存在或不可读' };
+  }
+  if (stat.size > A2A_INSTALL_MAX_BYTES) {
+    return { ok: false, error: `文件超过 ${A2A_INSTALL_MAX_MB}MB 限制` };
+  }
+  let entries;
+  try {
+    entries = listTarballEntries(file);
+  } catch (err) {
+    return { ok: false, error: `无法读取归档: ${err.message}` };
+  }
+  if (entries.length === 0) return { ok: false, error: '归档为空' };
+  const unsafe = entries.find(isUnsafeArchiveEntry);
+  if (unsafe) return { ok: false, error: `归档包含不安全的路径条目: ${unsafe}` };
+  try {
+    assertNoArchiveLinks(file);
+  } catch (err) {
+    return { ok: false, error: err.message };
+  }
+  let pkg;
+  try {
+    pkg = readTarballPackageJson(file, entries);
+  } catch (err) {
+    return { ok: false, error: `manifest 解析失败: ${err.message}` };
+  }
+  if (!pkg) return { ok: false, error: '归档缺少 package.json' };
+  if (pkg.name !== A2A_PACKAGE_NAME) {
+    return { ok: false, error: `manifest name 不符: 期望 ${A2A_PACKAGE_NAME}，实际 ${pkg.name}` };
+  }
+  if (typeof pkg.version !== 'string' || !pkg.version.trim()) {
+    return { ok: false, error: 'manifest 缺少 version' };
+  }
+  const targetDir = path.join(skillsDir, 'a2a');
+  const installed = readComponents(componentsPath).a2a;
+  if (fs.existsSync(targetDir) || installed) {
+    const v = installed && installed.version ? installed.version : '未知';
+    return { ok: false, error: `a2a 已安装（v${v}），如需更新请先卸载或使用 baize upgrade a2a` };
+  }
+  try {
+    extractTarballTo(file, targetDir, entries);
+  } catch (err) {
+    return { ok: false, error: `解压失败: ${err.message}` };
+  }
+  const depResult = await installDeps(targetDir);
+  if (!depResult.ok) {
+    fs.rmSync(targetDir, { recursive: true, force: true });
+    return { ok: false, error: `npm install 失败: ${depResult.error}` };
+  }
+  const components = readComponents(componentsPath);
+  components.a2a = {
+    version: pkg.version,
+    repo: 'baize-ai/baize-a2a',
+    isThirdParty: false,
+    installedAt: new Date().toISOString(),
+    skillDir: targetDir,
+    dataDir: path.join(baizeDir(), 'components', 'a2a'),
+    deliveredVia: { type: 'local-tarball', verified: true },
+  };
+  writeComponents(componentsPath, components);
+  return { ok: true, version: pkg.version };
+}
+
+function schedulerDbPath() {
+  return path.join(baizeDir(), 'scheduler', 'scheduler.db');
+}
+
+function a2aDbPath() {
+  return process.env.BAIZE_A2A_DB || path.join(baizeDir(), 'components', 'a2a', 'a2a.db');
+}
+
+/**
+ * Task board: task_runs rows created by the A2A worker (source = 'a2a', §3).
+ * Tolerant when the table/DB does not exist yet (baize-a2a not started).
+ */
+export function getA2aTaskRuns(limit = 100) {
+  const file = schedulerDbPath();
+  if (!fs.existsSync(file)) {
+    return { success: true, tasks: [], available: false, dbPath: file, hint: 'scheduler 数据库不存在（scheduler 服务未启动）' };
+  }
+  try {
+    const db = new Database(file, { readonly: true });
+    const hasTable = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='task_runs'").get();
+    if (!hasTable) {
+      db.close();
+      return { success: true, tasks: [], available: false, dbPath: file, hint: 'task_runs 表尚未创建（A2A 组件首次运行后出现）' };
+    }
+    const rows = db.prepare(
+      `SELECT id, scheduler_task_id, source_id, caller_agent_id, context_id, skill_id, instruction,
+              status, priority, message, result, error, created_at, started_at, updated_at, completed_at
+       FROM task_runs WHERE source = 'a2a' ORDER BY created_at DESC LIMIT ?`,
+    ).all(limit);
+    db.close();
+    return { success: true, tasks: rows, available: true, dbPath: file };
+  } catch (err) {
+    return { success: false, error: err.message, tasks: [] };
+  }
+}
+
+/**
+ * Message log: inbox (direction=in) + outbox (direction=out) from the
+ * baize-a2a SQLite store, merged by created_at (newest first).
+ */
+export function getA2aMessages(limit = 100) {
+  const file = a2aDbPath();
+  if (!fs.existsSync(file)) {
+    return { success: true, messages: [], available: false, dbPath: file, hint: 'A2A 消息库未就绪（baize-a2a 组件启动后生成）' };
+  }
+  try {
+    const db = new Database(file, { readonly: true });
+    const tables = new Set(db.prepare("SELECT name FROM sqlite_master WHERE type='table'").all().map((r) => r.name));
+    const messages = [];
+    if (tables.has('inbox')) {
+      for (const r of db.prepare(
+        'SELECT caller_agent_id, request_id, op, response, created_at FROM inbox ORDER BY created_at DESC LIMIT ?',
+      ).all(limit)) {
+        messages.push({
+          direction: 'in',
+          peer: r.caller_agent_id,
+          requestId: r.request_id,
+          kind: r.op,
+          content: r.response,
+          createdAt: r.created_at,
+        });
+      }
+    }
+    if (tables.has('outbox')) {
+      for (const r of db.prepare(
+        `SELECT kind, peer_agent_id, peer_endpoint, request_id, context_id, task_id, payload, status,
+                last_error, created_at, updated_at, sent_at
+         FROM outbox ORDER BY created_at DESC LIMIT ?`,
+      ).all(limit)) {
+        messages.push({
+          direction: 'out',
+          peer: r.peer_agent_id,
+          requestId: r.request_id,
+          kind: r.kind,
+          content: r.payload,
+          status: r.status,
+          taskId: r.task_id,
+          lastError: r.last_error,
+          createdAt: r.created_at,
+        });
+      }
+    }
+    db.close();
+    messages.sort((a, b) => String(b.createdAt).localeCompare(String(a.createdAt)));
+    return { success: true, messages: messages.slice(0, limit), available: true, dbPath: file };
+  } catch (err) {
+    return { success: false, error: err.message, messages: [] };
+  }
+}

package/skills/web-console/scripts/channel-admin.js

@@ -141,6 +141,40 @@ export const BUILTIN_CHANNELS = {
       links: [{ label: '企业微信管理后台', url: 'https://work.weixin.qq.com/' }],
     },
   },
+  a2a: {
+    name: 'a2a',
+    title: 'A2A 智能体互联',
+    type: 'communication',
+    description: 'Agent-to-Agent 互联：HTTPS 消息/任务收发、注册到 admin-workspace 目录、peer 发现与任务看板。',
+    repo: 'baize-ai/baize-a2a',
+    npmPkg: '@baize-ai/baize-a2a',
+    configSchema: [
+      {
+        key: 'enabled', label: '启用 A2A', type: 'radio',
+        options: [
+          { value: 'true', label: '启用（注册 + 接收消息/任务）' },
+          { value: 'false', label: '停用' },
+        ],
+        target: 'config', configKey: 'enabled', default: 'false',
+      },
+      { key: 'adminUrl', label: 'Admin 服务地址', type: 'text', placeholder: 'https://admin.example.com', target: 'config', configKey: 'adminUrl' },
+      { key: 'agentId', label: 'Agent ID（留空自动生成）', type: 'text', placeholder: 'agent_xxx', target: 'config', configKey: 'agentId' },
+      { key: 'advertiseUrl', label: '对外宣告地址', type: 'text', placeholder: 'https://a2a.example.com', target: 'config', configKey: 'advertiseUrl' },
+      { key: 'listenPort', label: '监听端口（默认 8443）', type: 'text', placeholder: '8443', target: 'config', configKey: 'listenPort', default: '8443' },
+      { key: 'certKeyPath', label: 'TLS 私钥路径（可选）', type: 'text', placeholder: '/path/to/key.pem', target: 'config', configKey: 'cert.keyPath' },
+      { key: 'certCertPath', label: 'TLS 证书路径（可选）', type: 'text', placeholder: '/path/to/cert.pem', target: 'config', configKey: 'cert.certPath' },
+    ],
+    guide: {
+      intro: 'A2A 让本机 agent 与其它 agent 通过 HTTPS 互联：注册到 admin-workspace 目录后被 peer 发现，可收发消息与派发任务。启用时必须填写 Admin 服务地址与对外宣告地址。',
+      steps: [
+        '部署并启动 admin-workspace（提供 /api/login 与 /.well-known/jwks.json 的 HTTPS 服务），记录其地址',
+        '填写 Admin 服务地址（adminUrl）与对外宣告地址（advertiseUrl，HTTPS 域名，指向本机 A2A 端点）',
+        '保存配置（启用）并启动渠道：自动生成 agentId、密钥对并向 admin 提交注册',
+        '在 admin-workspace 审批注册后，本机 agent 即可被发现并接收消息/任务',
+        'TLS：advertiseUrl 为 HTTPS 时提供证书路径；也可由 Caddy 等反向代理终结 TLS',
+      ],
+    },
+  },
 };
 
 // ── Per-channel lifecycle hooks ─────────────────────────────────────────────
@@ -171,6 +205,41 @@ const CHANNEL_IMPLS = {
       return { ok: true };
     },
   },
+  a2a: {
+    // Config lives in ~/baize/components/a2a/config.json (D19 §5).
+    getStatus: () => {
+      const config = readChannelConfig('a2a');
+      const enabled = config.enabled === true || String(config.enabled) === 'true';
+      const adminUrl = String(config.adminUrl || '').trim();
+      const advertiseUrl = String(config.advertiseUrl || '').trim();
+      return {
+        configured: Boolean(enabled && adminUrl && advertiseUrl),
+        configSummary: enabled
+          ? `admin: ${adminUrl}${advertiseUrl ? ` · advertise: ${advertiseUrl}` : ''}`
+          : '未启用',
+        service: pm2State('baize-a2a'),
+      };
+    },
+    verify: async (values) => {
+      const enabled = values.enabled === true || String(values.enabled) === 'true';
+      if (enabled) {
+        if (!String(values.adminUrl || '').trim()) return { ok: false, error: '启用 A2A 需要填写 Admin 服务地址（adminUrl）' };
+        if (!String(values.advertiseUrl || '').trim()) return { ok: false, error: '启用 A2A 需要填写对外宣告地址（advertiseUrl）' };
+      }
+      return { ok: true };
+    },
+    // Generic persist, but enabled must land as a real boolean (D19 §5 schema).
+    configure: async (values, deps) => {
+      const v = await CHANNEL_IMPLS.a2a.verify(values, deps);
+      if (!v.ok) return { success: false, error: v.error };
+      const normalized = { ...values };
+      if (normalized.enabled !== undefined && normalized.enabled !== null) {
+        normalized.enabled = normalized.enabled === true || String(normalized.enabled) === 'true';
+      }
+      persistGeneric('a2a', BUILTIN_CHANNELS.a2a.configSchema, normalized);
+      return { success: true, status: channelStatus({ ...BUILTIN_CHANNELS.a2a, installed: true }, deps) };
+    },
+  },
 };
 
 function builtinChannel(name) {
@@ -333,6 +402,35 @@ function upsertEnv(content, key, value) {
   return `${content.trimEnd()}\n${line}\n`;
 }
 
+/**
+ * Generic persist: env keys → .env, config keys → dataDir/config.json.
+ * Shared by the default configure path and per-channel configure hooks
+ * (e.g. a2a normalizes enabled to a real boolean before persisting).
+ */
+function persistGeneric(name, schema, values) {
+  const env = readEnv();
+  let newEnv = env;
+  const config = readChannelConfig(name);
+  for (const f of schema) {
+    const value = values[f.key];
+    if (value == null || value === '') continue;
+    if (f.target === 'env' && f.envKey) {
+      newEnv = upsertEnv(newEnv, f.envKey, String(value).trim());
+    } else if (f.target === 'config' && f.configKey) {
+      // Preserve real booleans/numbers (D19 §5 config schema); env-style
+      // string coercion would turn enabled into "true".
+      const stored = typeof value === 'boolean' || typeof value === 'number' ? value : String(value).trim();
+      setDeep(config, f.configKey, stored);
+    }
+  }
+  if (newEnv !== env) {
+    fs.mkdirSync(baizeDir(), { recursive: true });
+    fs.writeFileSync(path.join(baizeDir(), '.env'), newEnv, 'utf8');
+  }
+  fs.mkdirSync(path.dirname(channelConfigFile(name)), { recursive: true });
+  fs.writeFileSync(channelConfigFile(name), JSON.stringify(config, null, 2) + '\n', 'utf8');
+}
+
 // ── Configuration (schema-driven) ───────────────────────────────────────────
 
 /**
@@ -360,22 +458,7 @@ export async function configureChannel(name, values = {}, deps = {}) {
     if (!v.ok) return { success: false, error: v.error };
   }
 
-  // Generic persist: env keys → .env, config keys → dataDir/config.json
-  const env = readEnv();
-  let newEnv = env;
-  const config = readChannelConfig(name);
-  for (const f of schema) {
-    const value = values[f.key];
-    if (value == null || value === '') continue;
-    if (f.target === 'env' && f.envKey) newEnv = upsertEnv(newEnv, f.envKey, String(value).trim());
-    else if (f.target === 'config' && f.configKey) setDeep(config, f.configKey, String(value).trim());
-  }
-  if (newEnv !== env) {
-    fs.mkdirSync(baizeDir(), { recursive: true });
-    fs.writeFileSync(path.join(baizeDir(), '.env'), newEnv, 'utf8');
-  }
-  fs.mkdirSync(path.dirname(channelConfigFile(name)), { recursive: true });
-  fs.writeFileSync(channelConfigFile(name), JSON.stringify(config, null, 2) + '\n', 'utf8');
+  persistGeneric(name, schema, values);
 
   return { success: true, status: channelStatus({ ...channel, installed: true }, deps) };
 }