@baize-ai/core 0.3.14 → 0.3.16

package/CHANGELOG.md

@@ -5,6 +5,32 @@ All notable changes to baize-core will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.16] - 2026-09-13
+
+### Added
+- Codex 供应商配置改造（D51）：独立 provider 块写入器 + kind/slug store + init/runtime 遗留路径转换 + web-console 只读激活卡；`/models` 探测读取 provider 块 base_url
+- Dockerfile 本地源码构建支持（D51）：`BAZE_CORE_TARBALL=/core.tgz` 安装工作区包而非 registry 版本——验证未发布修复（如 D51）进镜像
+
+### Fixed
+- D51 部署缺陷（init）：web-console `import ../../../cli/lib/runtime-setup.js` 运行时 `~/.claude/cli/lib/` 不存在 → ERR_MODULE_NOT_FOUND 崩溃——`syncCoreSkills` 补拷 `package/cli` 至 `SKILLS_DIR 上级/cli`，并从包根复制零依赖 `node_modules/smol-toml`
+- D51 配置污染事故根因（4a37368）：`globalCodexConfigPath` 优先读 `HOME` env 而非 `os.homedir()`——jest ESM sandbox 曾写穿真实 `~/.codex/config.toml`
+- D51 review 修复：restore 只删 baize-written 块（`name=key && wire_api=responses`）；写盘直设 `0600` + 去重用例；激活卡展示 kind
+
+### Changed
+- A2A 授权治理收敛（D52 2b11171）：agent 本地 authz 仅保留 mode 切换（open/allowlist）——allow/block 名单由 admin 控制台统一管控（PUT 忽略名单强制清空 + UI 隐藏名单编辑并提示管控来源；移除死代码 `validateAuthzList`/peerIds 请求）
+
+## [0.3.15] - 2026-08-31
+
+### Fixed
+- A2A daemon 监控自愈统一收编 `baize init`（D49）：init 幂等 bootstrap（enabled → detached `cli.js start --background` → daemon-ctl pm2+waitReady → pm2 save），结果落 `components/a2a/bootstrap-state.json` 并在 web 状态卡展示；Docker 与裸机同一路径，entrypoint 的 Docker 专属 Step 3b（D48）删除
+- core pm2 ecosystem 不再纳管 baize-a2a（D49）：其生命周期唯一归属 daemon-ctl——消除三条启动路径并存导致的 8443 双实例竞态
+
+### Added
+- `baize upgrade <name> --file <tgz>`（D49）：商业组件离线升级——manifest/版本闸（新 > 旧）、备份回滚、既有 9 步管线；step8 重启钩子对 baize-a2a 优先走其 `cli.js restart`（覆盖 nohup daemon，pm2-only 路径的盲区修复）
+- getLocalVersion 优先读组件 package.json（SKILL.md frontmatter 曾恒 0.1.0 → 升级判定失真）
+- Web 控制台 A2A 上传：已安装 = 升级（版本闸 409 version_not_higher + 备份回滚 + 自动重启 daemon），安装/升级双语义
+- docker-compose healthcheck：A2A enabled 时追加 TCP 8443 就绪探测（pm2 list 无法发现静默空转的 daemon）
+
 ## [0.3.14] - 2026-08-30
 
 ### Fixed

package/Dockerfile

@@ -82,8 +82,12 @@ ENV WEB_CONSOLE_BIND=0.0.0.0
 # build context) — source stays private, the image matches the npm version
 # exactly. Build with: docker build --build-arg BAZE_CORE_VERSION=0.2.0 .
 ARG BAZE_CORE_VERSION=latest
+# Local-source build: pass BAZE_CORE_TARBALL=/core.tgz (COPY'd into the
+# build context) to install the workspace package instead of the registry
+# version — lets us verify un-released fixes (e.g. D51) in the image.
+ARG BAZE_CORE_TARBALL=
 WORKDIR /home/baize
-RUN npm install -g @baize-ai/core@${BAZE_CORE_VERSION} \
+RUN if [ -n "${BAZE_CORE_TARBALL}" ]; then npm install -g /tmp/${BAZE_CORE_TARBALL}; else npm install -g @baize-ai/core@${BAZE_CORE_VERSION}; fi \
     && baize --version \
     # ── Build-time skill dependency preinstall (reproducibility) ─────────
     # `baize init` reinstalls skill deps at runtime; doing it here bakes the
@@ -134,6 +138,11 @@ RUN mkdir -p \
 # ── Copy PM2 ecosystem config ─────────────────────────────────────────────────
 COPY --chown=baize:baize templates/pm2/ecosystem.config.cjs /home/baize/baize/pm2/ecosystem.config.cjs
 
+# ── Local-source build context (optional) ────────────────────────────────────
+# When BAZE_CORE_TARBALL is set, the tarball must live at ./core.tgz in the
+# build context; it is staged at /tmp so the install RUN above can consume it.
+COPY core.tgz /tmp/core.tgz
+
 # ── Copy entrypoint ───────────────────────────────────────────────────────────
 COPY --chown=baize:baize docker/entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh

package/cli/commands/add.js

@@ -714,6 +714,9 @@ async function installDeclarative(resolved, skillDir, skipConfirm, jsonOutput, b
       console.log(`  ${success(`${bold(service.name || ('baize-' + resolved.name))} started`)}`);
     } else {
       console.log(`  ${error(`Failed to start service: ${svcResult.error}`)}`);
+      if (name === 'a2a') {
+        console.log(`  ${dim('Run `baize a2a start` (or \`baize init\`) to bring the A2A daemon up.')}`);
+      }
       console.log(`  ${dim('You can start it manually later.')}`);
     }
   }

package/cli/commands/component.js

@@ -3,14 +3,15 @@
  */
 
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { execFileSync } from 'node:child_process';
 import { BAIZE_DIR, SKILLS_DIR, COMPONENTS_DIR, getBaizeConfig } from '../lib/config.js';
 import { bold, dim, green, red, yellow, cyan, success, error, warn, heading } from '../lib/colors.js';
 import { loadRegistry } from '../lib/registry.js';
-import { searchNpmPackages, npmRegistryUrl } from '../lib/download.js';
+import { searchNpmPackages, npmRegistryUrl, acquireSource } from '../lib/download.js';
 import { loadComponents, saveComponents } from '../lib/components.js';
-import { checkForUpdates, getLocalSourceUpgradeError, getRepo, runUpgrade, downloadToTemp, readChangelog, filterChangelog, cleanupTemp } from '../lib/upgrade.js';
+import { checkForUpdates, getLocalVersion, getLocalSourceUpgradeError, getRepo, runUpgrade, downloadToTemp, readChangelog, filterChangelog, cleanupTemp } from '../lib/upgrade.js';
 import {
   checkForCoreUpdates, runSelfUpgrade,
   downloadCoreToTemp, readChangelog as readCoreChangelog,
@@ -21,7 +22,7 @@ import { parseSkillMd } from '../lib/skill.js';
 import { linkBins, unlinkBins } from '../lib/bin.js';
 import { removeCaddyRoutes } from '../lib/caddy.js';
 import { acquireLock, releaseLock } from '../lib/lock.js';
-import { fetchRawFile } from '../lib/github.js';
+import { fetchRawFile, compareSemverDesc } from '../lib/github.js';
 import { promptYesNo } from '../lib/prompts.js';
 import { evaluateUpgrade } from '../lib/claude-eval.js';
 
@@ -251,6 +252,8 @@ export async function upgradeComponent(args) {
   const skipEval = args.includes('--skip-eval');
   const beta = args.includes('--beta');
   const hasTempDirFlag = args.includes('--temp-dir');
+  const fileIndex = args.indexOf('--file');
+  const upgradeFile = fileIndex !== -1 ? args[fileIndex + 1] : null;
 
   if (hasTempDirFlag) {
     const msg = '--temp-dir is not supported.';
@@ -272,6 +275,17 @@ export async function upgradeComponent(args) {
     process.exit(1);
   }
 
+  if (fileIndex !== -1 && (!upgradeFile || upgradeFile.startsWith('-'))) {
+    console.error('Error: --file requires a path to a .tgz archive.');
+    process.exit(1);
+  }
+
+  // --file is a fully offline source: remote/branch resolution flags make no sense.
+  if (upgradeFile && (branch || beta)) {
+    console.error('Error: --file cannot be combined with --branch or --beta.');
+    process.exit(1);
+  }
+
   // --beta and --branch are mutually exclusive
   if (beta && branch) {
     console.error('Error: --beta and --branch are mutually exclusive.');
@@ -291,7 +305,7 @@ export async function upgradeComponent(args) {
   }
 
   // Get target component (filter out flags and flag values)
-  const flagsWithValues = new Set(['--branch', '--mode']);
+  const flagsWithValues = new Set(['--branch', '--mode', '--file']);
   const target = args.find((a, i) => {
     if (a.startsWith('-')) return false;
     if (a === 'confirm') return false;
@@ -300,6 +314,12 @@ export async function upgradeComponent(args) {
     return true;
   });
 
+  // --file upgrades one installed component from a local tarball.
+  if (upgradeFile && (upgradeAll || upgradeSelf)) {
+    console.error('Error: --file upgrades a single installed component; it cannot be combined with --all or --self.');
+    process.exit(1);
+  }
+
   // Handle --self: upgrade baize-core itself
   if (upgradeSelf) {
     if (checkOnly) {
@@ -326,6 +346,7 @@ export async function upgradeComponent(args) {
     console.log('  --yes, -y      Skip confirmation');
     console.log('  --skip-eval    Skip upgrade analysis of local changes');
     console.log('  --beta         Include prerelease (beta) versions');
+    console.log('  --file <tgz>   Upgrade from a local .tar.gz archive (offline delivery)');
     console.log('  --branch <b>   Upgrade from a specific branch (e.g. feat/xxx)');
     console.log('  --mode <m>     Merge mode: "merge" (default, smart three-way) or "overwrite"');
     console.log('\nExamples:');
@@ -356,20 +377,25 @@ export async function upgradeComponent(args) {
     process.exit(1);
   }
 
-  const localSourceError = getLocalSourceUpgradeError(target, components[target]);
-  if (localSourceError) {
-    const result = {
-      action: checkOnly ? 'check' : 'upgrade',
-      component: target,
-      ...localSourceError,
-      reply: localSourceError.message,
-    };
-    if (jsonOutput) {
-      console.log(JSON.stringify(result, null, 2));
-    } else {
-      console.error(`Error: ${localSourceError.message}`);
+  if (upgradeFile) {
+    // The tarball IS the local source for this upgrade — a local-source
+    // registration does not block it.
+  } else {
+    const localSourceError = getLocalSourceUpgradeError(target, components[target]);
+    if (localSourceError) {
+      const result = {
+        action: checkOnly ? 'check' : 'upgrade',
+        component: target,
+        ...localSourceError,
+        reply: localSourceError.message,
+      };
+      if (jsonOutput) {
+        console.log(JSON.stringify(result, null, 2));
+      } else {
+        console.error(`Error: ${localSourceError.message}`);
+      }
+      process.exit(1);
     }
-    process.exit(1);
   }
 
   if (!fs.existsSync(skillDir)) {
@@ -388,6 +414,17 @@ export async function upgradeComponent(args) {
     process.exit(1);
   }
 
+  // Mode 0: offline upgrade from a local tgz (K4 commercial delivery —
+  // baize-a2a never ships to npm; --file and web upload are the only channels).
+  if (upgradeFile) {
+    if (checkOnly) {
+      return handleFileCheckOnly(target, upgradeFile, { jsonOutput });
+    }
+    const ok = await handleFileUpgradeFlow(target, upgradeFile, { jsonOutput, skipConfirm: skipConfirm || explicitConfirm, mode });
+    if (!ok) process.exit(1);
+    return;
+  }
+
   // Mode 1: Check only (--check) — no lock, downloads to temp for file comparison
   if (checkOnly) {
     return handleCheckOnly(target, { jsonOutput, branch, beta });
@@ -717,29 +754,7 @@ async function handleUpgradeFlow(component, { jsonOutput, skipConfirm, skipEval,
     });
 
     if (result.success) {
-      // Phase C: Cleanup
-      // Update components.json
-      const components = loadComponents();
-      if (components[component]) {
-        components[component].version = result.to || components[component].version;
-        components[component].upgradedAt = new Date().toISOString();
-
-        // Update bin symlinks (remove old, create new)
-        const oldBin = components[component].bin;
-        if (oldBin) unlinkBins(oldBin);
-        const updatedSkill = parseSkillMd(skillDir);
-        const newBin = linkBins(skillDir, updatedSkill?.frontmatter?.bin);
-        if (newBin) {
-          components[component].bin = newBin;
-        } else {
-          delete components[component].bin;
-        }
-
-        saveComponents(components);
-      }
-
-      // Clean old backups (keep only the latest)
-      cleanOldBackups(skillDir);
+      applyUpgradeBookkeeping(component, skillDir, result);
     }
 
     // Output result
@@ -777,6 +792,240 @@ async function handleUpgradeFlow(component, { jsonOutput, skipConfirm, skipEval,
   }
 }
 
+/**
+ * Post-success bookkeeping shared by every upgrade path: bump components.json,
+ * refresh bin symlinks, prune old backups.
+ */
+function applyUpgradeBookkeeping(component, skillDir, result) {
+  const components = loadComponents();
+  if (components[component]) {
+    components[component].version = result.to || components[component].version;
+    components[component].upgradedAt = new Date().toISOString();
+
+    // Update bin symlinks (remove old, create new)
+    const oldBin = components[component].bin;
+    if (oldBin) unlinkBins(oldBin);
+    const updatedSkill = parseSkillMd(skillDir);
+    const newBin = linkBins(skillDir, updatedSkill?.frontmatter?.bin);
+    if (newBin) {
+      components[component].bin = newBin;
+    } else {
+      delete components[component].bin;
+    }
+
+    saveComponents(components);
+  }
+
+  // Clean old backups (keep only the latest)
+  cleanOldBackups(skillDir);
+}
+
+/**
+ * Resolve a --file path (~ expansion + absolutize).
+ */
+function resolveTgzPath(filePath) {
+  const expanded = filePath === '~'
+    ? os.homedir()
+    : filePath.startsWith('~/')
+      ? path.join(os.homedir(), filePath.slice(2))
+      : filePath;
+  return path.resolve(expanded);
+}
+
+/**
+ * Extract a local .tgz into a fresh temp dir and read its package manifest.
+ * Safety vetting (path traversal / links) is delegated to the local-tarball
+ * source resolver in cli/lib/download.js — the same gate `baize add` uses.
+ *
+ * @returns {{ ok: true, tempDir: string, version: string, name: string|null }
+ *          | { ok: false, error: string }}
+ */
+function extractTarballArtifact(tgzPath) {
+  if (!/\.(?:tar\.gz|tgz)$/i.test(tgzPath)) {
+    return { ok: false, error: `--file must be a .tgz archive: ${tgzPath}` };
+  }
+  if (!fs.existsSync(tgzPath)) {
+    return { ok: false, error: `File not found: ${tgzPath}` };
+  }
+  const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'baize-upgrade-file-'));
+  const extract = acquireSource({ type: 'local-tarball', path: tgzPath }, tempDir);
+  if (!extract.success) {
+    cleanupTemp(tempDir);
+    return { ok: false, error: extract.error || 'Failed to extract tarball' };
+  }
+  let version = null;
+  let name = null;
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(tempDir, 'package.json'), 'utf8'));
+    if (typeof pkg.version === 'string' && pkg.version.trim()) version = pkg.version.trim();
+    if (typeof pkg.name === 'string' && pkg.name.trim()) name = pkg.name.trim();
+  } catch {
+    // missing/invalid package.json → version stays null, rejected by caller
+  }
+  if (!version) {
+    cleanupTemp(tempDir);
+    return { ok: false, error: 'Tarball has no package.json version' };
+  }
+  return { ok: true, tempDir, version, name };
+}
+
+/**
+ * K4: offline upgrade from a local .tgz (commercial delivery channel —
+ * baize-a2a never ships to npm, so --file and web upload are the only
+ * upgrade paths). Skips checkForUpdates/downloadToTemp: the tarball IS the
+ * source. Version gate: incoming semver must be strictly higher than the
+ * locally installed one (getLocalVersion reads package.json first — K6).
+ * Everything downstream reuses the existing 9-step runUpgrade pipeline
+ * (backup → smart merge → npm install → baseline → restart), including
+ * failure rollback.
+ *
+ * Returns true on success, false on failure. No process.exit() here.
+ */
+async function handleFileUpgradeFlow(component, filePath, { jsonOutput, skipConfirm, mode = 'merge' }) {
+  const skillDir = path.join(SKILLS_DIR, component);
+  let tempDir = null;
+
+  const failWith = (payload) => {
+    if (jsonOutput) {
+      const errOutput = { action: 'upgrade', component, success: false, ...payload };
+      errOutput.reply = formatC4Reply('error', { message: payload.message || payload.error });
+      console.log(JSON.stringify(errOutput, null, 2));
+    } else {
+      console.error(`Error: ${payload.message || payload.error}`);
+    }
+    return false;
+  };
+
+  const artifact = extractTarballArtifact(resolveTgzPath(filePath));
+  if (!artifact.ok) {
+    return failWith({ error: artifact.error });
+  }
+  tempDir = artifact.tempDir;
+
+  const lockResult = acquireLock(component);
+  if (!lockResult.success) {
+    return failWith({ error: lockResult.error });
+  }
+
+  try {
+    // Manifest sanity: the artifact must be the same package as installed.
+    let installedName = null;
+    try {
+      const localPkg = JSON.parse(fs.readFileSync(path.join(skillDir, 'package.json'), 'utf8'));
+      if (typeof localPkg.name === 'string') installedName = localPkg.name;
+    } catch {
+      // skill package.json is optional for the name check
+    }
+    if (installedName && artifact.name && artifact.name !== installedName) {
+      return failWith({ error: `manifest name mismatch: installed ${installedName}, tarball ${artifact.name}` });
+    }
+
+    const local = getLocalVersion(skillDir);
+    if (!local.success) {
+      return failWith({ error: `Cannot read current version: ${local.error}` });
+    }
+
+    if (compareSemverDesc(local.version, artifact.version) <= 0) {
+      return failWith({
+        error: 'version_not_higher',
+        message: `Incoming version ${artifact.version} is not higher than installed ${local.version} — nothing to upgrade.`,
+        local: local.version,
+        incoming: artifact.version,
+      });
+    }
+
+    if (!jsonOutput) {
+      console.log(`\n${bold(component)}: ${dim(local.version)} → ${bold(artifact.version)}`);
+      console.log(dim(`Source: local tarball (${filePath})`));
+    }
+
+    // Confirmation (no download/eval steps — the artifact is already local)
+    if (!skipConfirm) {
+      const confirmed = await promptYesNo('Proceed with upgrade? [y/N]: ');
+      if (!confirmed) {
+        console.log('Upgrade cancelled.');
+        return true; // Not an error — user chose to cancel
+      }
+    } else if (!jsonOutput) {
+      console.log(`Upgrading ${bold(component)}...`);
+    }
+
+    const result = runUpgrade(component, {
+      tempDir,
+      newVersion: artifact.version,
+      mode,
+      jsonOutput,
+      onStep: !jsonOutput ? printStep : undefined,
+    });
+
+    if (result.success) {
+      applyUpgradeBookkeeping(component, skillDir, result);
+    }
+
+    if (jsonOutput) {
+      const output = { ...result, source: { type: 'local-tarball', path: resolveTgzPath(filePath) } };
+      output.reply = formatC4Reply('upgrade', { component, ...result });
+      console.log(JSON.stringify(output, null, 2));
+    } else if (result.success) {
+      console.log(`\n${success(`${bold(component)} upgraded: ${dim(result.from)} → ${bold(result.to)}`)}`);
+    } else {
+      console.log(`\n${error(`Upgrade failed (step ${result.failedStep}): ${result.error}`)}`);
+      if (result.rollback?.performed) {
+        console.log(`\n${bold('Auto-rollback performed:')}`);
+        for (const r of result.rollback.steps) {
+          if (r.success) console.log(`  ${success(r.action)}`);
+          else console.log(`  ${error(r.action)}`);
+        }
+      }
+    }
+
+    return result.success;
+  } finally {
+    cleanupTemp(tempDir);
+    releaseLock(component);
+  }
+}
+
+/**
+ * K4 --check variant: compare a local tgz against the installed version
+ * without touching the installation (no lock needed).
+ */
+function handleFileCheckOnly(component, filePath, { jsonOutput }) {
+  const skillDir = path.join(SKILLS_DIR, component);
+  const artifact = extractTarballArtifact(resolveTgzPath(filePath));
+  if (!artifact.ok) {
+    if (jsonOutput) {
+      console.log(JSON.stringify({ action: 'check', component, success: false, error: artifact.error }, null, 2));
+    } else {
+      console.error(`Error: ${artifact.error}`);
+    }
+    process.exit(1);
+  }
+
+  const local = getLocalVersion(skillDir);
+  const hasUpdate = local.success && compareSemverDesc(local.version, artifact.version) > 0;
+  const result = {
+    action: 'check',
+    component,
+    success: local.success,
+    hasUpdate,
+    current: local.success ? local.version : null,
+    latest: artifact.version,
+    source: { type: 'local-tarball', path: resolveTgzPath(filePath) },
+    ...(local.success ? {} : { error: local.error }),
+  };
+  if (jsonOutput) {
+    console.log(JSON.stringify(result, null, 2));
+  } else if (hasUpdate) {
+    console.log(`${bold(component)}: ${dim(result.current)} → ${bold(result.latest)} (local tarball)`);
+  } else if (local.success) {
+    console.log(success(`${bold(component)} is up to date (v${result.current}); tarball v${artifact.version} is not higher.`));
+  } else {
+    console.error(`Error: ${local.error}`);
+    process.exit(1);
+  }
+}
+
 /**
  * Clean old .backup/ directories, keeping only the latest.
  */

package/cli/commands/init.js

@@ -41,6 +41,7 @@ import {
   saveCodexApiKeyToEnv,
   saveCodexBaseUrlToEnv,
   writeCodexConfig,
+  applyCodexProviderBlock,
 } from '../lib/runtime-setup.js';
 
 // Source directories (shipped with baize package)
@@ -839,6 +840,30 @@ function syncCoreSkills() {
   const installed = [];
   const updated = [];
 
+  // D51: web-console imports `../../../cli/lib/runtime-setup.js`, which from
+  // `~/.claude/skills/web-console/scripts/` resolves to `~/.claude/cli/lib/`.
+  // The npm package ships `package/cli`, but init never deployed it to the
+  // runtime tree — web-console crashed with ERR_MODULE_NOT_FOUND in the image.
+  // Deploy the shared CLI lib beside SKILLS_DIR so the import path mirrors the
+  // package layout (package/cli ↔ <SKILLS_DIR>/../cli).
+  const cliSrc = path.join(PACKAGE_ROOT, 'cli');
+  const cliDest = path.join(path.dirname(SKILLS_DIR), 'cli');
+  if (fs.existsSync(cliSrc)) {
+    try {
+      copyTree(cliSrc, cliDest);
+      // runtime-setup.js imports smol-toml (D51). The cli/ tree is deployed
+      // outside any skill's node_modules, so the dependency must ride along —
+      // mirror the package layout by copying the package's smol-toml into
+      // <cliDest>/node_modules/.
+      const tomlSrc = path.join(PACKAGE_ROOT, 'node_modules', 'smol-toml');
+      if (fs.existsSync(tomlSrc)) {
+        copyTree(tomlSrc, path.join(cliDest, 'node_modules', 'smol-toml'));
+      }
+    } catch {
+      console.log(`  ${warn(`Failed to sync cli/ to ${cliDest}`)}`);
+    }
+  }
+
   const entries = fs.readdirSync(CORE_SKILLS_SRC, { withFileTypes: true });
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
@@ -1145,6 +1170,47 @@ function startCoreServices(webPassword = null) {
   }
 }
 
+// ── A2A daemon bootstrap (D49) ───────────────────────────────────
+
+/**
+ * Fire-and-forget A2A daemon bootstrap. When the commercial baize-a2a
+ * component is installed AND enabled, bring its daemon up through the
+ * component's own CLI (`start --background`), which:
+ *   - prefers pm2 (autorestart + `pm2 save`/resurrect survive reboots),
+ *   - waits for TCP + card-identity readiness (30s),
+ *   - falls back to a nohup daemon when pm2 is unavailable,
+ *   - records the outcome in components/a2a/bootstrap-state.json.
+ *
+ * CRITICAL: this must NEVER block init. The child runs detached; init does
+ * not wait and cannot fail because of it. Docker and bare metal take the
+ * exact same path — the Docker-only entrypoint self-heal (D48 Step 3b) was
+ * removed in favor of this unified bootstrap (user decision, 2026-08-31).
+ */
+function bootstrapA2aDaemon({ quiet = false } = {}) {
+  try {
+    const cli = path.join(SKILLS_DIR, 'a2a', 'scripts', 'cli.js');
+    const a2aConfigPath = path.join(COMPONENTS_DIR, 'a2a', 'config.json');
+    if (!fs.existsSync(cli) || !fs.existsSync(a2aConfigPath)) return;
+    let enabled = false;
+    try {
+      enabled = JSON.parse(fs.readFileSync(a2aConfigPath, 'utf8')).enabled === true;
+    } catch {
+      return;
+    }
+    if (!enabled) return;
+    fs.mkdirSync(path.join(COMPONENTS_DIR, 'a2a', 'logs'), { recursive: true });
+    const child = spawn(process.execPath, [cli, 'start', '--background'], {
+      detached: true,
+      stdio: 'ignore',
+      env: process.env,
+    });
+    child.unref();
+    if (!quiet) console.log(`  ${dim('A2A daemon bootstrap launched (background) — see components/a2a/bootstrap-state.json.')}`);
+  } catch (err) {
+    if (!quiet) console.log(`  ${warn(`A2A bootstrap failed to launch: ${err.message}`)}`);
+  }
+}
+
 // ── PM2 boot auto-start ──────────────────────────────────────────
 
 /**
@@ -2141,9 +2207,17 @@ export async function initCommand(args) {
           }
         }
       }
-
-      // Write ~/.codex/config.toml to suppress interactive prompts on first launch
-      if (writeCodexConfig(BAIZE_DIR, { openaiBaseUrl: pendingCodexBaseUrl || undefined })) {
+      // Write ~/.codex/config.toml to suppress interactive prompts on first
+      // launch. A custom --codex-base-url becomes a dedicated provider block
+      // (D51) — never the built-in-OpenAI openai_base_url override.
+      if (pendingCodexBaseUrl) {
+        applyCodexProviderBlock({
+          providerKey: 'baize-init',
+          baseUrl: pendingCodexBaseUrl,
+          token: opts.codexApiKey || undefined,
+        });
+        if (!quiet) console.log(`  ${success('Codex startup config written (provider block)')}`);
+      } else if (writeCodexConfig(BAIZE_DIR)) {
         if (!quiet) console.log(`  ${success('Codex startup config written')}`);
       }
     }
@@ -2368,7 +2442,12 @@ export async function initCommand(args) {
     }
     if (pendingCodexBaseUrl) {
       saveCodexBaseUrlToEnv(pendingCodexBaseUrl);
-      writeCodexConfig(BAIZE_DIR, { openaiBaseUrl: pendingCodexBaseUrl });
+      // D51: custom endpoint → dedicated provider block, not the built-in-OpenAI override.
+      applyCodexProviderBlock({
+        providerKey: 'baize-init',
+        baseUrl: pendingCodexBaseUrl,
+        token: opts.codexApiKey || undefined,
+      });
     }
 
     // Timezone: use resolved value or show current
@@ -2394,6 +2473,7 @@ export async function initCommand(args) {
     }
     if (!quiet) console.log(heading('Starting services...'));
     const servicesStarted = startCoreServices(opts.webPassword);
+    bootstrapA2aDaemon({ quiet });
     if (servicesStarted > 0) {
       setupPm2Startup();
       if (!quiet) console.log(`\n${green(`${servicesStarted} service(s) started.`)} ${dim('Run "baize status" to check.')}`);
@@ -2476,7 +2556,12 @@ export async function initCommand(args) {
   }
   if (pendingCodexBaseUrl) {
     saveCodexBaseUrlToEnv(pendingCodexBaseUrl);
-    writeCodexConfig(BAIZE_DIR, { openaiBaseUrl: pendingCodexBaseUrl });
+    // D51: custom endpoint → dedicated provider block, not the built-in-OpenAI override.
+    applyCodexProviderBlock({
+      providerKey: 'baize-init',
+      baseUrl: pendingCodexBaseUrl,
+      token: opts.codexApiKey || undefined,
+    });
   }
   // Step 8: Configure timezone
   if (!quiet) console.log(`\n${heading('Timezone configuration...')}`);
@@ -2516,6 +2601,7 @@ export async function initCommand(args) {
   // Step 11: Start services
   if (!quiet) console.log(`\n${heading('Starting services...')}`);
   const servicesStarted = startCoreServices(opts.webPassword);
+  bootstrapA2aDaemon({ quiet });
 
   if (servicesStarted > 0) {
     setupPm2Startup();

package/cli/commands/runtime.js

@@ -29,6 +29,7 @@ import {
   saveSetupTokenToEnv,
   saveCodexApiKey,
   saveCodexBaseUrlToEnv,
+  applyCodexProviderBlock,
   saveCodexApiKeyToEnv,
   writeCodexConfig,
 } from '../lib/runtime-setup.js';
@@ -123,7 +124,14 @@ export function applyBaseUrl(target, baseUrl) {
   }
   if (target === 'codex') {
     if (!saveCodexBaseUrlToEnv(baseUrl)) return false;
-    return writeCodexConfig(BAIZE_DIR, { openaiBaseUrl: baseUrl });
+    // D51: external endpoints get a dedicated provider block (DeepSeek-safe,
+    // local compaction) — never the built-in-openai openai_base_url override.
+    try {
+      applyCodexProviderBlock({ providerKey: 'baize-runtime', baseUrl, projectDir: BAIZE_DIR });
+      return true;
+    } catch {
+      return false;
+    }
   }
   return false;
 }