@baize-ai/core 0.2.0 → 0.3.1

package/skills/web-console/scripts/server.js

@@ -59,6 +59,24 @@ import {
   uninstallChannel,
   channelAction,
 } from './channel-admin.js';
+import {
+  getA2aStatus,
+  getA2aPeers,
+  searchA2aAgents,
+  enableA2a,
+  disableA2a,
+  sendA2aMessage,
+  submitA2aTask,
+  getA2aTask,
+  cancelA2aTask,
+  getA2aTaskRuns,
+  getA2aMessages,
+  installA2aTarball,
+  probeA2aDaemonHealthy,
+  resolveA2aMode,
+  getSchedulerTasks,
+} from './a2a-admin.js';
+import { listInstalledSkills } from './skill-catalog.js';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -71,13 +89,15 @@ const PORT = process.env.WEB_CONSOLE_PORT || 3456;
 
 // Paths
 const BAIZE_DIR = process.env.BAIZE_DIR || path.join(os.homedir(), 'baize');
-const SKILLS_DIR = process.env.WEB_CONSOLE_SKILLS_DIR || path.join(os.homedir(), 'baize', '.claude', 'skills');
+const SKILLS_DIR = process.env.WEB_CONSOLE_SKILLS_DIR || path.join(BAIZE_DIR, '.claude', 'skills');
 const DB_DIR = path.join(BAIZE_DIR, 'comm-bridge');
 const DB_PATH = path.join(DB_DIR, 'c4.db');
 const STATUS_FILE = path.join(BAIZE_DIR, 'activity-monitor', 'agent-status.json');
 const MEDIA_DIR = path.join(BAIZE_DIR, 'web-console', 'media');
 const MAX_UPLOAD_MB = Number.parseInt(process.env.WEB_CONSOLE_MAX_UPLOAD_MB || '20', 10);
 const MAX_UPLOAD_BYTES = Math.max(1, MAX_UPLOAD_MB) * 1024 * 1024;
+const A2A_INSTALL_MAX_MB = Number.parseInt(process.env.WEB_CONSOLE_A2A_MAX_UPLOAD_MB || '100', 10);
+const A2A_INSTALL_MAX_BYTES = Math.max(1, A2A_INSTALL_MAX_MB) * 1024 * 1024;
 const C4_SCRIPT_DIR = path.join(SKILLS_DIR, 'comm-bridge', 'scripts');
 
 // Paths - __dirname is scripts/, public/ is one level up
@@ -159,6 +179,19 @@ const upload = multer({
   }
 });
 
+// A2A install uploads: a .tar.gz up to 100MB, staged in the OS temp dir and
+// removed after processing (the package is moved into SKILLS_DIR/a2a).
+const a2aInstallUpload = multer({
+  storage: multer.diskStorage({
+    destination: (_req, _file, cb) => cb(null, os.tmpdir()),
+    filename: (_req, _file, cb) => cb(null, `a2a-install-${Date.now()}-${crypto.randomBytes(6).toString('hex')}.tgz`),
+  }),
+  limits: {
+    fileSize: A2A_INSTALL_MAX_BYTES,
+    files: 1
+  }
+});
+
 // Initialize database connection
 let db;
 try {
@@ -916,6 +949,367 @@ app.post('/api/admin/channels/:name/:action', async (req, res) => {
   }
 });
 
+// ── Admin: A2A (Agent-to-Agent) ─────────────────────────────────────────────
+// Delegated to baize-a2a scripts/cli.js (--json); boards read local SQLite.
+
+function sendA2aResult(res, result) {
+  if (result.success) {
+    res.json({ success: true, ...(result.json || {}) });
+  } else {
+    res.status(400).json({ success: false, error: result.error || 'a2a 命令失败' });
+  }
+}
+
+// Identity / registration status — D25 augments with run mode + daemon health:
+//   mode: CLI-reported → config.json mode → derived from enabled
+//   daemonHealthy: TCP connect to the configured listenPort (default 8443)
+app.get('/api/admin/a2a/status', async (req, res) => {
+  try {
+    const result = await getA2aStatus();
+    const payload = { ...(result.json || {}) };
+    payload.mode = resolveA2aMode(payload.mode);
+    payload.daemonHealthy = await probeA2aDaemonHealthy();
+    if (result.success) {
+      res.json({ success: true, ...payload });
+    } else {
+      res.status(400).json({ success: false, error: result.error, ...payload });
+    }
+  } catch (err) {
+    jsonError(res, err);
+  }
+});
+
+// Peer directory (cached in baize-a2a)
+app.get('/api/admin/a2a/peers', async (req, res) => {
+  try {
+    sendA2aResult(res, await getA2aPeers());
+  } catch (err) {
+    jsonError(res, err);
+  }
+});
+
+// Directory search (admin-workspace) — ?q=<query>
+app.get('/api/admin/a2a/search', async (req, res) => {
+  try {
+    sendA2aResult(res, await searchA2aAgents(req.query.q));
+  } catch (err) {
+    jsonError(res, err);
+  }
+});
+
+// D25 switch contract: delegate to the a2a CLI and return its {ok, mode, error?}.
+// mode: CLI-reported → config.json mode → derived from enabled.
+function sendA2aSwitchResult(res, result) {
+  const json = result.json || {};
+  const mode = resolveA2aMode(json.mode);
+  if (result.success) {
+    res.json({ ok: json.ok !== false, mode });
+  } else {
+    res.status(400).json({ ok: false, mode, error: result.error || 'a2a 命令失败' });
+  }
+}
+
+// Enable + register (generates agentId, submits registration)
+app.post('/api/admin/a2a/enable', async (req, res) => {
+  try {
+    sendA2aSwitchResult(res, await enableA2a(req.body || {}));
+  } catch (err) {
+    jsonError(res, err);
+  }
+});
+
+app.post('/api/admin/a2a/disable', async (req, res) => {
+  try {
+    sendA2aSwitchResult(res, await disableA2a());
+  } catch (err) {
+    jsonError(res, err);
+  }
+});
+
+// Send a message to a peer
+app.post('/api/admin/a2a/send', async (req, res) => {
+  try {
+    sendA2aResult(res, await sendA2aMessage(req.body || {}));
+  } catch (err) {
+    jsonError(res, err);
+  }
+});
+
+// Task dispatch — { peer, skill?, instruction, async? }
+app.post('/api/admin/a2a/task', async (req, res) => {
+  try {
+    sendA2aResult(res, await submitA2aTask(req.body || {}));
+  } catch (err) {
+    jsonError(res, err);
+  }
+});
+
+// Task board: task_runs (source = 'a2a') — registered BEFORE /task/:taskId
+app.get('/api/admin/scheduler/tasks', (req, res) => {
+  try {
+    res.json(getSchedulerTasks(Number.parseInt(req.query.limit, 10) || 100));
+  } catch (err) {
+    jsonError(res, err);
+  }
+});
+
+app.get('/api/admin/a2a/tasks', (req, res) => {
+  try {
+    res.json(getA2aTaskRuns(Number.parseInt(req.query.limit, 10) || 100));
+  } catch (err) {
+    jsonError(res, err);
+  }
+});
+
+// Task status
+app.get('/api/admin/a2a/task/:taskId', async (req, res) => {
+  try {
+    sendA2aResult(res, await getA2aTask(req.params.taskId));
+  } catch (err) {
+    jsonError(res, err);
+  }
+});
+
+// Task cancel
+app.post('/api/admin/a2a/task/:taskId/cancel', async (req, res) => {
+  try {
+    sendA2aResult(res, await cancelA2aTask(req.params.taskId));
+  } catch (err) {
+    jsonError(res, err);
+  }
+});
+
+// Message log: inbox/outbox from baize-a2a SQLite
+app.get('/api/admin/a2a/messages', (req, res) => {
+  try {
+    res.json(getA2aMessages(Number.parseInt(req.query.limit, 10) || 100));
+  } catch (err) {
+    jsonError(res, err);
+  }
+});
+
+// Install @baize-ai/baize-a2a from an uploaded .tar.gz (D25 私有交付).
+// multipart field `file`; ≤100MB (413 over); entries vetted against `..` /
+// absolute paths / links before extraction; manifest must be the a2a package
+// with a version; then extract to SKILLS_DIR/a2a → npm install --omit=dev →
+// components.json. Response: {ok:true, version} | {ok:false, error}.
+app.post('/api/admin/a2a/install', (req, res) => {
+  a2aInstallUpload.single('file')(req, res, async (err) => {
+    if (err) {
+      if (err.code === 'LIMIT_FILE_SIZE') {
+        return res.status(413).json({ ok: false, error: `安装包超过 ${A2A_INSTALL_MAX_MB}MB 限制` });
+      }
+      return res.status(400).json({ ok: false, error: `上传失败: ${err.message}` });
+    }
+    const file = req.file;
+    if (!file) {
+      return res.status(400).json({ ok: false, error: '缺少 file 字段（multipart 字段名必须为 file）' });
+    }
+    try {
+      const result = await installA2aTarball(file.path, { skillsDir: SKILLS_DIR, originalName: file.originalname });
+      res.status(result.ok ? 200 : 400).json(result);
+    } catch (e) {
+      res.status(500).json({ ok: false, error: `安装失败: ${e.message}` });
+    } finally {
+      fs.promises.rm(file.path, { force: true }).catch(() => {});
+    }
+  });
+});
+
+// ── Admin: A2A agent card (D21 self-service) ─────────────────────────────────
+// name/description/skills are written to the same config.json the baize-a2a
+// daemon reads (configPollMs=3000 → card hot-reload). skills ids are validated
+// against the installed skill catalogue so the card cannot advertise skills
+// that do not exist on this machine.
+
+function a2aConfigPath() {
+  return process.env.BAIZE_A2A_CONFIG || path.join(BAIZE_DIR, 'components', 'a2a', 'config.json');
+}
+
+function readAgentCard() {
+  try {
+    const raw = JSON.parse(fs.readFileSync(a2aConfigPath(), 'utf8'));
+    return {
+      name: typeof raw.name === 'string' && raw.name.trim() !== '' ? raw.name : 'Baize Agent',
+      // 与 baize-a2a card.js 的默认 description 保持一致（未配置时 Card 展示默认文本）
+      description: typeof raw.description === 'string' && raw.description.trim() !== '' ? raw.description : 'A Baize agent reachable over the baize-a2a protocol.',
+      skills: Array.isArray(raw.skills) ? raw.skills : [],
+    };
+  } catch {
+    return { name: 'Baize Agent', description: 'A Baize agent reachable over the baize-a2a protocol.', skills: [] };
+  }
+}
+
+function installedSkillMap() {
+  const map = new Map();
+  for (const skill of listInstalledSkills({ skillsDir: SKILLS_DIR })) {
+    map.set(skill.id, skill);
+  }
+  return map;
+}
+
+// Installed skills catalogue (source for the card skills multi-selector)
+app.get('/api/admin/a2a/card/skills', (req, res) => {
+  try {
+    const skills = listInstalledSkills({ skillsDir: SKILLS_DIR })
+      .sort((a, b) => a.name.localeCompare(b.name));
+    res.json({ success: true, skills });
+  } catch (err) {
+    jsonError(res, err);
+  }
+});
+
+// Current agent card (name/description/skills); defaults when unconfigured
+app.get('/api/admin/a2a/card', (req, res) => {
+  try {
+    res.json({ success: true, ...readAgentCard() });
+  } catch (err) {
+    jsonError(res, err);
+  }
+});
+
+// Save the agent card — validates, then writes config.json (preserving other
+// fields) and returns the persisted card
+app.put('/api/admin/a2a/card', (req, res) => {
+  try {
+    const body = req.body || {};
+    const name = typeof body.name === 'string' ? body.name.trim() : '';
+    if (!name) {
+      return res.status(400).json({ success: false, error: 'name 必填' });
+    }
+    if (name.length > 60) {
+      return res.status(400).json({ success: false, error: 'name 不能超过 60 个字符' });
+    }
+    const description = typeof body.description === 'string' ? body.description : '';
+    if (description.length > 300) {
+      return res.status(400).json({ success: false, error: 'description 不能超过 300 个字符' });
+    }
+    const requested = Array.isArray(body.skills) ? body.skills : [];
+    const installed = installedSkillMap();
+    const ids = [];
+    const seen = new Set();
+    for (const item of requested) {
+      const id = typeof item === 'string' ? item : (item && typeof item.id === 'string' ? item.id : '');
+      if (!id || !installed.has(id)) {
+        return res.status(400).json({
+          success: false,
+          error: `skills 包含未安装的 skill：${id || '(空)'}`,
+        });
+      }
+      if (seen.has(id)) {
+        return res.status(400).json({ success: false, error: `skills 包含重复的 skill：${id}` });
+      }
+      seen.add(id);
+      ids.push(id);
+    }
+    // Persist full SkillInfo entries ({id,name,description}) so baize-a2a's
+    // card.js serves a complete card without any daemon-side change.
+    const skills = ids.map((id) => {
+      const info = installed.get(id);
+      return { id, name: info.name, description: info.description };
+    });
+    const file = a2aConfigPath();
+    let cfg = {};
+    try {
+      cfg = JSON.parse(fs.readFileSync(file, 'utf8'));
+    } catch {
+      // missing/corrupt — start from the contract defaults
+      cfg = { enabled: false, adminUrl: '', agentId: '', advertiseUrl: '', cert: { keyPath: '', certPath: '' } };
+    }
+    cfg.name = name;
+    cfg.description = description;
+    cfg.skills = skills;
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, `${JSON.stringify(cfg, null, 2)}\n`);
+    res.json({ success: true, name, description, skills });
+  } catch (err) {
+    jsonError(res, err);
+  }
+});
+
+// ── Admin: A2A call authorization (D22 单元 C) ───────────────────────────────
+// Authz policy persisted in the same config.json the baize-a2a daemon reads:
+//   { mode: 'open' | 'allowlist', allow: [...], block: [...] }
+// - open (default): accept every approved agent except the block list
+// - allowlist: only the allow list may call
+const AUTHZ_MODES = new Set(['open', 'allowlist']);
+
+function defaultAuthz() {
+  return { mode: 'open', allow: [], block: [] };
+}
+
+function readAuthz() {
+  try {
+    const raw = JSON.parse(fs.readFileSync(a2aConfigPath(), 'utf8'));
+    const authz = raw && typeof raw.authz === 'object' && !Array.isArray(raw.authz) ? raw.authz : {};
+    const clean = (list) => (Array.isArray(list) ? list.filter((x) => typeof x === 'string' && x.trim() !== '') : []);
+    return {
+      mode: AUTHZ_MODES.has(authz.mode) ? authz.mode : 'open',
+      allow: clean(authz.allow),
+      block: clean(authz.block),
+    };
+  } catch {
+    return defaultAuthz();
+  }
+}
+
+// Validates an allow/block list; returns { list } or { error }.
+function validateAuthzList(value, name) {
+  if (!Array.isArray(value)) return { error: `${name} 必须是数组` };
+  const seen = new Set();
+  const list = [];
+  for (const item of value) {
+    if (typeof item !== 'string' || item.trim() === '') {
+      return { error: `${name} 包含空项（必须是非空字符串）` };
+    }
+    const v = item.trim();
+    if (seen.has(v)) return { error: `${name} 包含重复的 agent_id：${v}` };
+    seen.add(v);
+    list.push(v);
+  }
+  return { list };
+}
+
+// Current authz policy (config.json authz; contract defaults when unconfigured)
+app.get('/api/admin/a2a/authz', (req, res) => {
+  try {
+    res.json({ success: true, ...readAuthz() });
+  } catch (err) {
+    jsonError(res, err);
+  }
+});
+
+// Save the authz policy — validates, then writes config.json (preserving other
+// fields) and returns the persisted policy
+app.put('/api/admin/a2a/authz', (req, res) => {
+  try {
+    const body = req.body || {};
+    const mode = body.mode;
+    if (mode !== 'open' && mode !== 'allowlist') {
+      return res.status(400).json({ success: false, error: 'mode 必须是 open 或 allowlist' });
+    }
+    const allow = body.allow === undefined ? { list: [] } : validateAuthzList(body.allow, 'allow');
+    if (allow.error) return res.status(400).json({ success: false, error: allow.error });
+    const block = body.block === undefined ? { list: [] } : validateAuthzList(body.block, 'block');
+    if (block.error) return res.status(400).json({ success: false, error: block.error });
+    const authz = { mode, allow: allow.list, block: block.list };
+    const file = a2aConfigPath();
+    let cfg = {};
+    try {
+      cfg = JSON.parse(fs.readFileSync(file, 'utf8'));
+    } catch {
+      // missing/corrupt — start from the contract defaults
+      cfg = { enabled: false, adminUrl: '', agentId: '', advertiseUrl: '', cert: { keyPath: '', certPath: '' } };
+    }
+    cfg.authz = authz;
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, `${JSON.stringify(cfg, null, 2)}\n`);
+    res.json({ success: true, ...authz });
+  } catch (err) {
+    jsonError(res, err);
+  }
+});
+
 // Serve index.html for root
 app.get('/', (req, res) => {
   res.sendFile(path.join(SKILL_ROOT, 'public', 'index.html'));

package/skills/web-console/scripts/skill-catalog.js

@@ -0,0 +1,179 @@
+/**
+ * Skill catalogue for the web console (D21: agent card self-service).
+ *
+ * Reads the installed skill list from the Claude skills directory
+ * (~/baize/.claude/skills by default; BAIZE_DIR env aware). Each subdirectory
+ * with a SKILL.md contributes one entry:
+ *
+ *   { id: <directory name>, name, description }
+ *
+ * name/description are extracted from the SKILL.md frontmatter (the YAML block
+ * between the leading `---` and its closing `---`). Supported description
+ * shapes: plain scalar, `>-` folded, `|-` literal, and plain multi-line
+ * continuations. Skills whose frontmatter fails to parse or that lack a
+ * SKILL.md are skipped.
+ *
+ * web-console is deployed as a standalone skill, so it cannot import cli/lib —
+ * this is a deliberately small, dependency-free YAML-frontmatter reader.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+
+/**
+ * Resolve the installed-skills directory. Honors BAIZE_DIR like the rest of
+ * the web-console; falls back to ~/baize/.claude/skills.
+ */
+export function defaultSkillsDir() {
+  const base = process.env.BAIZE_DIR || path.join(os.homedir(), 'baize');
+  return path.join(base, '.claude', 'skills');
+}
+
+/**
+ * Parse SKILL.md frontmatter into { name, description }.
+ * Returns null when the file has no frontmatter block or no usable name.
+ *
+ * @param {string} content - raw SKILL.md file content
+ */
+export function parseSkillFrontmatter(content) {
+  if (typeof content !== 'string') return null;
+  const match = /^---[ \t]*\r?\n([\s\S]*?)\r?\n---[ \t]*(?:\r?\n|$)/.exec(content);
+  if (!match) return null;
+
+  const lines = match[1].split(/\r?\n/);
+  const scalars = {};
+  let current = null; // { key, style, rest, lines[] }
+
+  const flush = () => {
+    if (!current) return;
+    const text = renderScalar(current);
+    if (text !== null && (current.key === 'name' || current.key === 'description')) {
+      scalars[current.key] = text;
+    }
+    current = null;
+  };
+
+  for (const line of lines) {
+    if (current) {
+      // Continuation lines: blank or indented relative to the key.
+      if (line.trim() === '' || /^\s+/.test(line)) {
+        current.lines.push(line);
+        continue;
+      }
+      // A non-indented, non-blank line ends the current scalar (next key or
+      // stray content). Only top-level `key:` lines restart a scalar.
+      flush();
+    }
+    const keyMatch = /^([A-Za-z0-9_-]+)\s*:\s*(.*)$/.exec(line);
+    if (keyMatch) {
+      const [, key, rest] = keyMatch;
+      const blockMatch = /^([>|])(-)?$/.exec(rest.trim());
+      current = {
+        key,
+        style: blockMatch ? (blockMatch[1] === '>' ? 'folded' : 'literal') : 'plain',
+        chomp: blockMatch ? Boolean(blockMatch[2]) : false,
+        rest,
+        lines: [],
+      };
+    }
+  }
+  flush();
+
+  if (typeof scalars.name !== 'string' || scalars.name.trim() === '') return null;
+  return {
+    name: scalars.name.trim(),
+    description: typeof scalars.description === 'string' ? scalars.description : '',
+  };
+}
+
+/** Assemble a scalar value from its collected continuation lines. */
+function renderScalar({ key, style, chomp, rest, lines }) {
+  if (style === 'plain') {
+    const parts = [];
+    if (rest.trim() !== '') parts.push(rest.trim());
+    for (const line of lines) {
+      if (line.trim() !== '') parts.push(line.trim());
+    }
+    if (parts.length === 0) return '';
+    return dequote(parts.join(' '));
+  }
+  // Folded / literal block scalars: value lives entirely on indented lines.
+  if (style === 'folded') {
+    const paragraphs = [];
+    let para = [];
+    for (const line of lines) {
+      if (line.trim() === '') {
+        if (para.length) {
+          paragraphs.push(para.join(' '));
+          para = [];
+        }
+      } else {
+        para.push(line.trim());
+      }
+    }
+    if (para.length) paragraphs.push(para.join(' '));
+    return paragraphs.join('\n');
+  }
+  // literal: strip the common indentation shared by content lines
+  let text = stripCommonIndent(lines).join('\n');
+  return chomp ? text.replace(/\n+$/, '') : text;
+}
+
+/** Remove the smallest leading indentation shared by non-blank lines. */
+function stripCommonIndent(lines) {
+  const nonBlank = lines.filter((line) => line.trim() !== '');
+  if (nonBlank.length === 0) return lines;
+  let min = Infinity;
+  for (const line of nonBlank) {
+    const m = /^[ \t]*/.exec(line);
+    min = Math.min(min, m[0].length);
+  }
+  if (!Number.isFinite(min) || min === 0) return lines;
+  return lines.map((line) => (line.trim() === '' ? '' : line.slice(min)));
+}
+
+/** Strip a single pair of wrapping quotes (YAML double/single). */
+function dequote(value) {
+  if (value.length >= 2) {
+    const first = value[0];
+    const last = value[value.length - 1];
+    if ((first === '"' && last === '"') || (first === "'" && last === "'")) {
+      return value.slice(1, -1);
+    }
+  }
+  return value;
+}
+
+/**
+ * List installed skills as [{ id, name, description }].
+ * Entries are returned in directory order; sorting is the caller's job.
+ *
+ * @param {{ skillsDir?: string }} [options]
+ */
+export function listInstalledSkills({ skillsDir = defaultSkillsDir() } = {}) {
+  let entries;
+  try {
+    entries = fs.readdirSync(skillsDir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const skills = [];
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    let content;
+    try {
+      content = fs.readFileSync(path.join(skillsDir, entry.name, 'SKILL.md'), 'utf8');
+    } catch {
+      continue; // no SKILL.md (or unreadable) — skip
+    }
+    const parsed = parseSkillFrontmatter(content);
+    if (!parsed) continue;
+    skills.push({
+      id: entry.name,
+      name: parsed.name,
+      description: parsed.description || '',
+    });
+  }
+  return skills;
+}

package/templates/claude-system.md

@@ -125,6 +125,28 @@ to you when idle. When a scheduled task arrives, or when you want to schedule
 one, read `~/baize/.claude/skills/scheduler/SKILL.md` first if you have not
 already this session.
 
+## A2A & Agent Discovery
+
+A2A lets you collaborate with other Baize agents: list, search, inspect, and
+delegate to them over HTTPS (each agent is an independent instance with its
+own skills and capabilities).
+
+**When to use**: the user needs another agent's capability, asks about
+internal agents ("what agents are available", "who can do X"), or asks you to
+collaborate with / delegate to another agent.
+
+**How** (data is always queried live — never answer from memory):
+1. `baize a2a session-summary` — list the currently available agents (latest data)
+2. `baize a2a search <query>` — find agents whose card matches the need (e.g.
+   `a2a search "crypto price trend"`)
+3. `baize a2a card <agent-id>` — inspect one agent's capabilities in detail
+4. `baize a2a task <agent-id> <skill> <instruction>` — delegate a task (waits for
+   the result by default; `--async` returns immediately)
+5. `baize a2a task status <task-id>` / `baize a2a task cancel <task-id>` — track/cancel
+
+Read `~/baize/.claude/skills/a2a/SKILL.md` once if you have not already this
+session for the full protocol.
+
 ## Skills & Components
 
 - **Sedimenting a reusable workflow for the user** (a repeatable capability,

package/templates/pm2/ecosystem.config.cjs

@@ -208,7 +208,10 @@ module.exports = {
       cwd: HOME,
       env: {
         PATH: ENHANCED_PATH,
-        NODE_ENV: 'production'
+        NODE_ENV: 'production',
+        // Docker/container 场景：端口映射需监听 0.0.0.0（默认 127.0.0.1 只通容器内 loopback）。
+        // .env 的 WEB_CONSOLE_BIND 不被 PM2 自动加载，必须在 ecosystem 注入。
+        WEB_CONSOLE_BIND: process.env.WEB_CONSOLE_BIND || '0.0.0.0'
       },
       autorestart: true,
       max_restarts: 10,