@baize-ai/core 0.3.12 → 0.3.14

package/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to baize-core will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.14] - 2026-08-30
+
+### Fixed
+- A2A 容器重启自愈（D48）：entrypoint 检查 A2A config.enabled → 自动启动 baize-a2a daemon——容器重启后 A2A 零手动恢复
+- Web A2A 状态卡证书徽章（D48）：显示证书链状态（certValid）——daemon 在线时"自动处理中"、离线时提示"待续签"
+
+## [0.3.13] - 2026-08-28
+
+### Fixed
+- A2A 上传安装后自动 rebuild 原生模块（D44）：上传安装用 --ignore-scripts（vendor 包安全），better-sqlite3 等 native 模块不编译 → 上传后 A2A 状态加载失败；安装流程现追加 `npm rebuild --build-from-source`（只编译、不跑 vendor 脚本），失败回滚
+- Docker 镜像 npm 源修复（D43）：容器 npm 运行时是 baize 用户（prefix /home/baize/.npm-global）——镜像只写了 /usr/etc/npmrc（root 视角）npm 不读 → ACR 镜像 npm 仍走 npmjs；现同时写 /home/baize/.npmrc（优先级最高必读）
+
 ## [0.3.12] - 2026-08-28
 
 ### Added

package/Dockerfile

@@ -55,6 +55,10 @@ RUN if [ "${BAIZE_NPM_MIRROR:-off}" = "aliyun" ]; then \
       # Also drop a system-wide npmrc so the runtime user (baize) and any
       # docker exec npm use the mainland mirror too.
       mkdir -p /usr/etc && printf 'registry=https://registry.npmmirror.com\n' > /usr/etc/npmrc; \
+      # Container npm runs as USER baize with prefix /home/baize/.npm-global —
+      # its globalconfig is NOT /usr/etc/npmrc, so also write the user-level
+      # ~/.npmrc (highest precedence, always read) or npm stays on npmjs.
+      mkdir -p /home/baize && printf 'registry=https://registry.npmmirror.com\n' > /home/baize/.npmrc; \
     fi
 RUN npm install -g pm2@latest
 

package/docker/entrypoint.sh

@@ -153,6 +153,27 @@ PM2_PID=$!
 sleep 3
 ok "Services started"
 
+# ── Step 3b: A2A self-heal (D48) ─────────────────────────────────────────────
+# After a container restart, a previously-enabled A2A component must come back
+# up by itself (zero manual ops). If the A2A config says enabled, start the
+# baize-a2a daemon — it registers/renews its certificate with the admin and
+# serves the advertise port. Idempotent: pm2 start restarts an existing entry.
+if [ -f "${BAIZE_DIR}/components/a2a/config.json" ]; then
+  A2A_ENABLED=$(node -e "
+    try {
+      const c = JSON.parse(require('fs').readFileSync('${BAIZE_DIR}/components/a2a/config.json','utf8'));
+      process.stdout.write(c.enabled ? '1' : '0');
+    } catch { process.stdout.write('0'); }
+  " 2>/dev/null || echo "0")
+  if [ "$A2A_ENABLED" = "1" ]; then
+    ok "A2A enabled — starting baize-a2a daemon"
+    ( cd "${BAIZE_DIR}/.claude/skills/a2a" && pm2 start ecosystem.config.cjs >/dev/null 2>&1 ) || \
+      warn "A2A daemon start failed — check 'docker exec <c> pm2 logs baize-a2a'"
+  fi
+fi
+
+# ── Step 4: Start the configured agent runtime in tmux ───────────────────────
+
 # ── Step 4: Start the configured agent runtime in tmux ───────────────────────
 # Determine runtime: BAIZE_RUNTIME env var always wins; fall back to config.json.
 if [ -z "${BAIZE_RUNTIME:-}" ]; then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@baize-ai/core",
-  "version": "0.3.12",
+  "version": "0.3.14",
   "type": "module",
   "description": "Baize (\u767d\u6cfd) \u2014 autonomous AI agent infrastructure",
   "main": "cli/baize.js",

package/scripts/build-push-acr.sh

@@ -1,11 +1,13 @@
 #!/usr/bin/env bash
 # Multi-platform build + push to Aliyun ACR for the mainland distribution.
-# Usage:  bash build-push-acr.sh [VERSION]   (default 0.3.11)
+# Usage:  bash build-push-acr.sh [VERSION]   (default = latest published)
+# IMPORTANT: bump this default when a new version is published — it must
+# track @baize-ai/core latest (never point at an un-released version).
 # Requires: docker login already done, qemu-arm64 registered
 #           (apt install qemu-user-binfmt), registry mirror configured.
 set -euo pipefail
 
-VERSION="${1:-0.3.11}"
+VERSION="${1:-0.3.13}"
 ACR="crpi-8bg62qbrjs3cr3as.cn-hangzhou.personal.cr.aliyuncs.com/baize01/baize-core"
 
 echo "== Configure buildkit registry mirror (mainland Docker Hub access) =="

package/scripts/docker-publish.sh

@@ -35,6 +35,10 @@ docker build \
   -t "${GHCR_IMAGE}:${VERSION}" \
   -t "${GHCR_IMAGE}:latest" \
   .
+  "${BUILD_ARGS[@]}" \
+  -t "${GHCR_IMAGE}:${VERSION}" \
+  -t "${GHCR_IMAGE}:latest" \
+  .
 
 if [ -n "${ACR_REGISTRY}" ] && [ -n "${ACR_NAMESPACE}" ]; then
   ACR_IMAGE="${ACR_REGISTRY}/${ACR_NAMESPACE}/baize-core"

package/skills/web-console/public/app.js

@@ -1655,6 +1655,19 @@ async function loadA2aStatus(basePath) {
     state.textContent = enabled ? '已启用' : '未启用';
     state.className = `channel-state ${enabled ? 'ok' : 'warn'}`;
   }
+  // D48: certificate health — the daemon self-heals (re-registers) when the
+  // admin rotated its CA. Only claim "auto-healing" when the daemon is
+  // actually alive to run the 5-min renewal check; otherwise the user must
+  // act (daemon down / renewals exhausted).
+  const certValid = body.certValid === true;
+  const daemonUp = body.daemonHealthy === true;
+  let certLabel = '正常';
+  if (!certValid) {
+    certLabel = daemonUp ? '需续签（自动处理中）' : '证书待续签（daemon 未运行）';
+  }
+  const certRow = body.enabled === true
+    ? `<div class="conn-summary-row"><span class="conn-summary-name">证书状态</span><span class="conn-summary-detail"><span class="channel-state ${certValid ? 'ok' : 'warn'}">${certLabel}</span></span></div>`
+    : '';
   const rows = [
     ['启用', enabled ? '是' : '否'],
     ['Agent ID', body.agentId],
@@ -1664,7 +1677,7 @@ async function loadA2aStatus(basePath) {
     ['Endpoint', body.endpoint],
     ['版本', body.version],
   ].filter(([, v]) => v !== undefined && v !== null && v !== '');
-  el.innerHTML = rows.map(([k, v]) => `<div class="conn-summary-row"><span class="conn-summary-name">${escapeHtml(k)}</span><span class="conn-summary-detail">${escapeHtml(String(v))}</span></div>`).join('');
+  el.innerHTML = rows.map(([k, v]) => `<div class="conn-summary-row"><span class="conn-summary-name">${escapeHtml(k)}</span><span class="conn-summary-detail">${escapeHtml(String(v))}</span></div>`).join('') + certRow;
   updateA2aInstallArea(body);
   updateA2aModeCard(body);
   updateA2aConfigArea(body);

package/skills/web-console/scripts/a2a-admin.js

@@ -328,6 +328,39 @@ function npmInstallDeps(cwd) {
   });
 }
 
+/** Rebuild native modules after --ignore-scripts install (D44).
+ * --ignore-scripts skips postinstall, so better-sqlite3 etc. never compile
+ * their native binary. Rebuilding runs node-gyp only (no vendor lifecycle
+ * scripts) — the security stance is kept while the module becomes loadable. */
+function rebuildNativeDeps(cwd) {
+  return new Promise((resolve) => {
+    const child = spawn('npm', ['rebuild', '--build-from-source', '--no-audit', '--no-fund'], {
+      cwd, env: { ...process.env }, stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let stderr = '';
+    let settled = false;
+    child.stderr.on('data', (d) => { stderr += String(d); });
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      child.kill('SIGTERM');
+      resolve({ ok: false, error: `npm rebuild 超时（${Math.round(NPM_INSTALL_TIMEOUT_MS / 1000)}s）` });
+    }, NPM_INSTALL_TIMEOUT_MS);
+    child.on('error', (err) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve({ ok: false, error: err.message });
+    });
+    child.on('close', (code) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(code === 0 ? { ok: true } : { ok: false, error: (stderr.trim() || `exit ${code}`).slice(-500) });
+    });
+  });
+}
+
 /**
  * Install @baize-ai/baize-a2a from an uploaded .tar.gz (D25 私有交付).
  * Pipeline: entry listing + path-safety vetting (no `..`/absolute/links) →
@@ -342,6 +375,7 @@ export async function installA2aTarball(tarballPath, {
   skillsDir = defaultSkillsDir(),
   componentsFile: componentsPath = componentsFile(),
   installDeps = npmInstallDeps,
+  rebuildDeps = rebuildNativeDeps,
   originalName = null,
 } = {}) {
   const file = String(tarballPath || '');
@@ -401,6 +435,13 @@ export async function installA2aTarball(tarballPath, {
     fs.rmSync(targetDir, { recursive: true, force: true });
     return { ok: false, error: `npm install 失败: ${depResult.error}` };
   }
+  // D44: --ignore-scripts skipped native compilation — rebuild modules so
+  // better-sqlite3 etc. are loadable (node-gyp only, no vendor scripts).
+  const rebuildResult = await rebuildDeps(targetDir);
+  if (!rebuildResult.ok) {
+    fs.rmSync(targetDir, { recursive: true, force: true });
+    return { ok: false, error: `native 模块重建失败: ${rebuildResult.error}` };
+  }
   const components = readComponents(componentsPath);
   components.a2a = {
     version: pkg.version,