@baize-ai/core 0.3.12 → 0.3.13

package/.dockerignore

@@ -6,3 +6,5 @@
 !templates/pm2/ecosystem.config.cjs
 !.claude-local/claude
 !.claude-local/claude.version
+!skills/
+!.docker-local-skills/

package/CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to baize-core will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.13] - 2026-08-28
+
+### Fixed
+- A2A 上传安装后自动 rebuild 原生模块（D44）：上传安装用 --ignore-scripts（vendor 包安全），better-sqlite3 等 native 模块不编译 → 上传后 A2A 状态加载失败；安装流程现追加 `npm rebuild --build-from-source`（只编译、不跑 vendor 脚本），失败回滚
+- Docker 镜像 npm 源修复（D43）：容器 npm 运行时是 baize 用户（prefix /home/baize/.npm-global）——镜像只写了 /usr/etc/npmrc（root 视角）npm 不读 → ACR 镜像 npm 仍走 npmjs；现同时写 /home/baize/.npmrc（优先级最高必读）
+
 ## [0.3.12] - 2026-08-28
 
 ### Added

package/Dockerfile

@@ -55,6 +55,10 @@ RUN if [ "${BAIZE_NPM_MIRROR:-off}" = "aliyun" ]; then \
       # Also drop a system-wide npmrc so the runtime user (baize) and any
       # docker exec npm use the mainland mirror too.
       mkdir -p /usr/etc && printf 'registry=https://registry.npmmirror.com\n' > /usr/etc/npmrc; \
+      # Container npm runs as USER baize with prefix /home/baize/.npm-global —
+      # its globalconfig is NOT /usr/etc/npmrc, so also write the user-level
+      # ~/.npmrc (highest precedence, always read) or npm stays on npmjs.
+      mkdir -p /home/baize && printf 'registry=https://registry.npmmirror.com\n' > /home/baize/.npmrc; \
     fi
 RUN npm install -g pm2@latest
 
@@ -78,6 +82,11 @@ ENV WEB_CONSOLE_BIND=0.0.0.0
 # build context) — source stays private, the image matches the npm version
 # exactly. Build with: docker build --build-arg BAZE_CORE_VERSION=0.2.0 .
 ARG BAZE_CORE_VERSION=latest
+# Local-development override: when building from source with
+# --build-arg BAIZE_LOCAL_SKILLS=1, copy the LOCAL skills over the npm-package
+# skills so un-released fixes (e.g. D44) land in the image without publishing.
+# Official builds leave this off — the published npm package is authoritative.
+ARG BAIZE_LOCAL_SKILLS=0
 WORKDIR /home/baize
 RUN npm install -g @baize-ai/core@${BAZE_CORE_VERSION} \
     && baize --version \
@@ -120,6 +129,14 @@ RUN npm install -g @baize-ai/core@${BAZE_CORE_VERSION} \
     && node -e "const D=require('/home/baize/baize/.claude/skills/web-console/node_modules/better-sqlite3'); new D(':memory:')" \
     && echo "native modules OK (locally compiled, baked into runtime skills)"
 
+# ── Local-source skills override (BAIZE_LOCAL_SKILLS=1) ─────────────────────
+# docker-publish.sh stages the repo's skills/ into .docker-local-skills/ when
+# BAIZE_LOCAL_SKILLS=1 (empty directory otherwise). They land in
+# /home/baize/.local-skills and are applied by entrypoint AFTER init, because
+# init's postinstall syncSkills uses the npm-package skills as source and
+# would otherwise overwrite them. Official images carry an empty dir — no-op.
+COPY --chown=baize:baize .docker-local-skills/ /home/baize/.local-skills/
+
 # ── Workspace directories ─────────────────────────────────────────────────────
 # ~/baize is mounted as a single volume in docker-compose.yml.
 # Creating subdirectories here ensures correct ownership in the image.

package/docker/entrypoint.sh

@@ -94,10 +94,18 @@ if ! baize init ${INIT_ARGS}; then
 fi
 ok "Workspace ready"
 mkdir -p "${BAIZE_DIR}/.baize"
-printf '{"status":"ok","at":"%s"}\n' "$(date -Iseconds)" > "${BAIZE_DIR}/.baize/init-state.json"
-
+# ── Local-source skills override (BAIZE_LOCAL_SKILLS=1 images) ──────────────
+# Images built with BAIZE_LOCAL_SKILLS=1 bake the repo's skills into
+# /home/baize/.local-skills. syncSkills (npm postinstall) runs during init
+# with the npm-package skills as source, so apply the local override AFTER
+# init to keep un-released fixes (e.g. D44) authoritative.
+# Official images ship an empty .local-skills — this is a no-op there.
+if [ -d /home/baize/.local-skills ]; then
+  cp -rf /home/baize/.local-skills/. "${BAIZE_DIR}/.claude/skills/" 2>/dev/null \
+    && ok "Local-source skills applied (BAIZE_LOCAL_SKILLS=1)"
+fi
 
-ok "Workspace ready"
+# ── Pass through channel env vars to .env ─────────────────────────────────────
 
 # ── Pass through channel env vars to .env ─────────────────────────────────────
 # baize init doesn't write channel tokens — those come from component installs.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@baize-ai/core",
-  "version": "0.3.12",
+  "version": "0.3.13",
   "type": "module",
   "description": "Baize (\u767d\u6cfd) \u2014 autonomous AI agent infrastructure",
   "main": "cli/baize.js",

package/scripts/docker-publish.sh

@@ -30,11 +30,22 @@ ACR_NAMESPACE="${ACR_NAMESPACE:-baize01}"
 
 # ── Build ────────────────────────────────────────────────────────────────────
 echo "==> Building baize-core:${VERSION} (from npm @baize-ai/core@${VERSION})"
+BUILD_ARGS=(--build-arg "BAZE_CORE_VERSION=${VERSION}")
+rm -rf .docker-local-skills && mkdir -p .docker-local-skills
+if [ "${BAIZE_LOCAL_SKILLS:-0}" = "1" ]; then
+  BUILD_ARGS+=(--build-arg BAIZE_LOCAL_SKILLS=1)
+  echo "==> Overriding skills with LOCAL repo source (BAIZE_LOCAL_SKILLS=1) — un-released fixes baked in"
+  cp -r skills/. .docker-local-skills/
+  # Never ship host-compiled node_modules (mac binaries break linux runtime) —
+  # dependency binaries come from the image's own npm install.
+  find .docker-local-skills -type d -name node_modules -prune -exec rm -rf {} +
+fi
 docker build \
-  --build-arg BAZE_CORE_VERSION="${VERSION}" \
+  "${BUILD_ARGS[@]}" \
   -t "${GHCR_IMAGE}:${VERSION}" \
   -t "${GHCR_IMAGE}:latest" \
   .
+rm -rf .docker-local-skills
 
 if [ -n "${ACR_REGISTRY}" ] && [ -n "${ACR_NAMESPACE}" ]; then
   ACR_IMAGE="${ACR_REGISTRY}/${ACR_NAMESPACE}/baize-core"

package/skills/web-console/scripts/a2a-admin.js

@@ -328,6 +328,39 @@ function npmInstallDeps(cwd) {
   });
 }
 
+/** Rebuild native modules after --ignore-scripts install (D44).
+ * --ignore-scripts skips postinstall, so better-sqlite3 etc. never compile
+ * their native binary. Rebuilding runs node-gyp only (no vendor lifecycle
+ * scripts) — the security stance is kept while the module becomes loadable. */
+function rebuildNativeDeps(cwd) {
+  return new Promise((resolve) => {
+    const child = spawn('npm', ['rebuild', '--build-from-source', '--no-audit', '--no-fund'], {
+      cwd, env: { ...process.env }, stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let stderr = '';
+    let settled = false;
+    child.stderr.on('data', (d) => { stderr += String(d); });
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      child.kill('SIGTERM');
+      resolve({ ok: false, error: `npm rebuild 超时（${Math.round(NPM_INSTALL_TIMEOUT_MS / 1000)}s）` });
+    }, NPM_INSTALL_TIMEOUT_MS);
+    child.on('error', (err) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve({ ok: false, error: err.message });
+    });
+    child.on('close', (code) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(code === 0 ? { ok: true } : { ok: false, error: (stderr.trim() || `exit ${code}`).slice(-500) });
+    });
+  });
+}
+
 /**
  * Install @baize-ai/baize-a2a from an uploaded .tar.gz (D25 私有交付).
  * Pipeline: entry listing + path-safety vetting (no `..`/absolute/links) →
@@ -342,6 +375,7 @@ export async function installA2aTarball(tarballPath, {
   skillsDir = defaultSkillsDir(),
   componentsFile: componentsPath = componentsFile(),
   installDeps = npmInstallDeps,
+  rebuildDeps = rebuildNativeDeps,
   originalName = null,
 } = {}) {
   const file = String(tarballPath || '');
@@ -401,6 +435,13 @@ export async function installA2aTarball(tarballPath, {
     fs.rmSync(targetDir, { recursive: true, force: true });
     return { ok: false, error: `npm install 失败: ${depResult.error}` };
   }
+  // D44: --ignore-scripts skipped native compilation — rebuild modules so
+  // better-sqlite3 etc. are loadable (node-gyp only, no vendor scripts).
+  const rebuildResult = await rebuildDeps(targetDir);
+  if (!rebuildResult.ok) {
+    fs.rmSync(targetDir, { recursive: true, force: true });
+    return { ok: false, error: `native 模块重建失败: ${rebuildResult.error}` };
+  }
   const components = readComponents(componentsPath);
   components.a2a = {
     version: pkg.version,