@baize-ai/core 0.3.14 → 0.3.16

package/cli/lib/__tests__/init-base-url.test.js

@@ -72,7 +72,7 @@ describe('base URL support', () => {
     }
   });
 
-  test('writeCodexConfig writes openai_base_url when OPENAI_BASE_URL is set', async () => {
+  test('writeCodexConfig never writes openai_base_url — env override is dropped (D51)', async () => {
     const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'baize-base-url-'));
     const originalHome = process.env.HOME;
     const originalOpenAiBaseUrl = process.env.OPENAI_BASE_URL;
@@ -87,7 +87,7 @@ describe('base URL support', () => {
 
       const configPath = path.join(tmpRoot, '.codex', 'config.toml');
       const config = fs.readFileSync(configPath, 'utf8');
-      assert.match(config, /openai_base_url = "https:\/\/openai-proxy\.example\.com\/v1"/);
+      assert.doesNotMatch(config, /openai_base_url/);
     } finally {
       if (originalHome === undefined) delete process.env.HOME;
       else process.env.HOME = originalHome;
@@ -99,31 +99,73 @@ describe('base URL support', () => {
     }
   });
 
-  test('writeCodexConfig writes openai_base_url when explicit opts.openaiBaseUrl is provided', async () => {
+  test('writeCodexConfig strips a stale legacy openai_base_url from existing config (D51)', async () => {
     const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'baize-base-url-opt-'));
     const originalHome = process.env.HOME;
-    const originalOpenAiBaseUrl = process.env.OPENAI_BASE_URL;
 
     process.env.HOME = tmpRoot;
-    delete process.env.OPENAI_BASE_URL;
 
     try {
       const { writeCodexConfig } = await import('../runtime-setup.js');
 
-      assert.equal(
-        writeCodexConfig(path.join(tmpRoot, 'baize-project'), { openaiBaseUrl: 'https://explicit-proxy.example.com/v1' }),
-        true
-      );
-
       const configPath = path.join(tmpRoot, '.codex', 'config.toml');
+      fs.mkdirSync(path.dirname(configPath), { recursive: true });
+      fs.writeFileSync(configPath, 'openai_base_url = "https://explicit-proxy.example.com/v1"\nmodel = "old"\n');
+
+      assert.equal(writeCodexConfig(path.join(tmpRoot, 'baize-project'), { openaiBaseUrl: 'https://explicit-proxy.example.com/v1' }), true);
+
       const config = fs.readFileSync(configPath, 'utf8');
-      assert.match(config, /openai_base_url = "https:\/\/explicit-proxy\.example\.com\/v1"/);
+      assert.doesNotMatch(config, /openai_base_url/);
+      assert.match(config, /^model = "old"$/m, 'unrelated keys preserved');
     } finally {
       if (originalHome === undefined) delete process.env.HOME;
       else process.env.HOME = originalHome;
 
-      if (originalOpenAiBaseUrl === undefined) delete process.env.OPENAI_BASE_URL;
-      else process.env.OPENAI_BASE_URL = originalOpenAiBaseUrl;
+      fs.rmSync(tmpRoot, { recursive: true, force: true });
+    }
+  });
+
+  test('--codex-base-url path writes a baize-init provider block (D51)', async () => {
+    const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'baize-init-provider-'));
+    const originalHome = process.env.HOME;
+    const originalBaizeDir = process.env.BAIZE_DIR;
+
+    process.env.HOME = tmpRoot;
+    process.env.BAIZE_DIR = path.join(tmpRoot, 'baize');
+
+    try {
+      const { applyCodexProviderBlock } = await import('../runtime-setup.js');
+
+      // This mirrors exactly what init.js does when --codex-base-url is given:
+      // pendingCodexBaseUrl → applyCodexProviderBlock (providerKey 'baize-init').
+      // projectDir passed explicitly: the module-level BAIZE_DIR fallback is
+      // captured at first import and may not match this test's env override.
+      applyCodexProviderBlock({
+        providerKey: 'baize-init',
+        baseUrl: 'https://proxy.example.com/v1',
+        token: 'sk-init-key',
+        projectDir: process.env.BAIZE_DIR,
+      });
+
+      const config = fs.readFileSync(path.join(tmpRoot, '.codex', 'config.toml'), 'utf8');
+      assert.match(config, /\[model_providers\.baize-init\]/);
+      assert.match(config, /^model_provider = "baize-init"$/m);
+      assert.match(config, /^name = "baize-init"$/m);
+      assert.match(config, /^base_url = "https:\/\/proxy\.example\.com\/v1"$/m);
+      assert.match(config, /^wire_api = "responses"$/m);
+      assert.match(config, /^experimental_bearer_token = "sk-init-key"$/m);
+      assert.doesNotMatch(config, /openai_base_url/);
+
+      // Project-level: no provider block, no override.
+      const projectConfig = fs.readFileSync(path.join(tmpRoot, 'baize', '.codex', 'config.toml'), 'utf8');
+      assert.doesNotMatch(projectConfig, /model_provider/);
+      assert.doesNotMatch(projectConfig, /\[model_providers\./);
+      assert.doesNotMatch(projectConfig, /openai_base_url/);
+    } finally {
+      if (originalHome === undefined) delete process.env.HOME;
+      else process.env.HOME = originalHome;
+      if (originalBaizeDir === undefined) delete process.env.BAIZE_DIR;
+      else process.env.BAIZE_DIR = originalBaizeDir;
 
       fs.rmSync(tmpRoot, { recursive: true, force: true });
     }

package/cli/lib/__tests__/runtime-base-url.test.js

@@ -126,6 +126,8 @@ describe('runtime base URL support', () => {
     assert.equal(claudeSettings.env.ANTHROPIC_BASE_URL, 'https://claude-proxy.example.com');
 
     const codexConfig = fs.readFileSync(path.join(tmpRoot, '.codex', 'config.toml'), 'utf8');
-    assert.match(codexConfig, /openai_base_url = "https:\/\/codex-proxy\.example\.com\/v1"/);
+    assert.match(codexConfig, /model_provider = "baize-runtime"/);
+    assert.match(codexConfig, /\[model_providers\.baize-runtime\][\s\S]*?base_url = "https:\/\/codex-proxy\.example\.com\/v1"/);
+    assert.doesNotMatch(codexConfig, /openai_base_url/);
   });
 });

package/cli/lib/__tests__/runtime-setup.test.js

@@ -162,9 +162,55 @@ describe('renderCodexGlobalConfig', () => {
     assert.doesNotMatch(content, /check_for_update_on_startup/);
   });
 
-  it('includes openai_base_url when provided', () => {
+  it('never writes openai_base_url — legacy opt only cleans the override (D51)', () => {
     const content = renderCodexGlobalConfig('/home/user/baize', '', { openaiBaseUrl: 'https://proxy.example.com/v1' });
-    assert.match(content, /openai_base_url = "https:\/\/proxy\.example\.com\/v1"/);
+    assert.doesNotMatch(content, /openai_base_url/);
+  });
+
+  it('renders a dedicated provider block from opts.codex (D51)', () => {
+    const content = renderCodexGlobalConfig('/home/user/baize', '', {
+      codex: {
+        providerKey: 'deepseek',
+        baseUrl: 'https://api.deepseek.com/',
+        token: 'sk-test',
+        model: 'deepseek-v4-flash',
+      },
+    });
+    assert.match(content, /^model = "deepseek-v4-flash"$/m);
+    assert.match(content, /^model_provider = "deepseek"$/m);
+    assert.match(content, /\[model_providers\.deepseek\]/);
+    assert.match(content, /name = "deepseek"/);
+    assert.match(content, /base_url = "https:\/\/api\.deepseek\.com\/"/);
+    assert.match(content, /wire_api = "responses"/);
+    assert.match(content, /experimental_bearer_token = "sk-test"/);
+    assert.doesNotMatch(content, /openai_base_url/);
+  });
+
+  it('provider block omits the token key when no token is given (D51)', () => {
+    const content = renderCodexGlobalConfig('/home/user/baize', '', {
+      codex: { providerKey: 'deepseek', baseUrl: 'https://api.deepseek.com/', model: 'deepseek-v4-flash' },
+    });
+    assert.match(content, /\[model_providers\.deepseek\]/);
+    assert.doesNotMatch(content, /experimental_bearer_token/);
+  });
+
+  it('provider block replaces the legacy override and keeps other provider tables (D51)', () => {
+    const existing = [
+      'openai_base_url = "https://old.example.com/v1"',
+      'model = "old"',
+      '',
+      '[model_providers.userown]',
+      'name = "userown"',
+      'base_url = "https://u.example"',
+      '',
+    ].join('\n');
+    const content = renderCodexGlobalConfig('/home/user/baize', existing, {
+      codex: { providerKey: 'deepseek', baseUrl: 'https://api.deepseek.com/' },
+    });
+    assert.doesNotMatch(content, /openai_base_url/);
+    assert.match(content, /^model = "old"$/m, 'model kept when opts.codex.model absent');
+    assert.match(content, /\[model_providers\.userown\]/, 'user tables survive');
+    assert.match(content, /\[model_providers\.deepseek\]/);
   });
 
   it('preserves unknown global top-level keys, sections, and unrelated projects', () => {
@@ -189,22 +235,23 @@ describe('renderCodexGlobalConfig', () => {
     assert.match(content, /\[projects\."\/home\/user\/baize"\]\ntrust_level = "trusted"/);
   });
 
-  it('preserves existing openai_base_url when baize has no value', () => {
+  it('strips a stale legacy openai_base_url even without opts (D51 migration)', () => {
     const existing = 'openai_base_url = "https://user-proxy.example.com/v1"\n';
     const content = renderCodexGlobalConfig('/home/user/baize', existing);
-    assert.match(content, /openai_base_url = "https:\/\/user-proxy\.example\.com\/v1"/);
+    assert.doesNotMatch(content, /openai_base_url/);
   });
 
-  it('overwrites existing openai_base_url when baize has a value', () => {
+  it('cleans the legacy openai_base_url when the legacy opt is passed (D51)', () => {
     const existing = 'openai_base_url = "https://old-proxy.example.com/v1"\n';
     const content = renderCodexGlobalConfig('/home/user/baize', existing, {
       openaiBaseUrl: 'https://new-proxy.example.com/v1',
     });
-    assert.match(content, /openai_base_url = "https:\/\/new-proxy\.example\.com\/v1"/);
+    assert.doesNotMatch(content, /openai_base_url/);
     assert.doesNotMatch(content, /old-proxy/);
   });
 });
 
+
 describe('writeCodexConfig', () => {
   it('writes project-level config and global config to separate locations', () => {
     const globalConfigPath = path.join(fakeHome, '.codex', 'config.toml');

package/cli/lib/runtime/codex.js

@@ -55,10 +55,27 @@ function getCodexApiBaseUrl() {
   try {
     const configPath = path.join(os.homedir(), '.codex', 'config.toml');
     const config = fs.readFileSync(configPath, 'utf8');
+    // legacy override first (pre-D51 configs)
     const match = config.match(/^\s*openai_base_url\s*=\s*"([^"]+)"\s*$/m);
     if (match?.[1]) {
       return match[1].replace(/\/+$/, '');
     }
+    // D51: the active provider block carries the endpoint — resolve the
+    // top-level model_provider slug and read its base_url, so the /models
+    // probe stays in sync with what codex actually calls (otherwise an
+    // external endpoint activation reports 401 against api.openai.com).
+    const providerKey = config.match(/^\s*model_provider\s*=\s*"([^"]+)"\s*$/m)?.[1];
+    if (providerKey) {
+      const escaped = providerKey.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+      const blockRe = new RegExp(
+        `\\[model_providers\\.${escaped}\\][^[]*?\\bbase_url\\s*=\\s*"([^"]+)"`,
+        'm'
+      );
+      const blockMatch = config.match(blockRe);
+      if (blockMatch?.[1]) {
+        return blockMatch[1].replace(/\/+$/, '');
+      }
+    }
   } catch { /* ignore missing config */ }
 
   if (process.env.OPENAI_BASE_URL) {

package/cli/lib/runtime-setup.js

@@ -11,6 +11,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { execSync, execFileSync, spawnSync } from 'node:child_process';
 import { parse, stringify } from 'smol-toml';
+import crypto from 'node:crypto';
 import { BAIZE_DIR } from './config.js';
 import { commandExists } from './shell-utils.js';
 import { parseClaudeAuthStatus, parseCodexLoginStatus } from './auth-parsers.js';
@@ -410,21 +411,30 @@ export function renderCodexProjectConfig(existingContent = '', opts = {}) {
 /**
  * Render global ~/.codex/config.toml with user/environment-level settings.
  *
- * Contains only trust declarations and optional base URL override.
- * Existing [projects.*] trust entries are preserved; the baize project trust
- * entry is always regenerated.
- *
- * @param {string} projectDir - The baize working directory to pre-trust
- * @param {string} existingContent - Existing global config.toml contents (optional)
- * @param {{ openaiBaseUrl?: string }} opts - Optional Codex config overrides
+ * Contains only trust declarations and the optional D51 provider block.
  * @returns {string}
  */
 export function renderCodexGlobalConfig(projectDir, existingContent = '', opts = {}) {
   const absProject = path.resolve(projectDir);
-  const openaiBaseUrl = opts.openaiBaseUrl || process.env.OPENAI_BASE_URL || '';
   const obj = parseCodexToml(existingContent);
-  if (openaiBaseUrl) {
-    obj.openai_base_url = openaiBaseUrl;
+  // D51: external Codex endpoints are configured as a dedicated provider
+  // block (model_providers.<key> + top-level model_provider) instead of
+  // overriding the built-in OpenAI provider via openai_base_url — the override
+  // keeps provider.name === "OpenAI", which makes Codex enable remote
+  // compaction v2 against endpoints that cannot answer it (DeepSeek → fatal
+  // "expected exactly one compaction output item").
+  const codex = opts.codex || null;
+  if (codex && codex.providerKey && codex.baseUrl) {
+    obj.model = codex.model || obj.model;
+    obj.model_provider = codex.providerKey;
+    obj.model_providers = isTomlSectionValue(obj.model_providers) ? obj.model_providers : {};
+    const block = { name: codex.providerKey, base_url: codex.baseUrl, wire_api: 'responses' };
+    if (codex.token) block.experimental_bearer_token = codex.token;
+    obj.model_providers[codex.providerKey] = block;
+    delete obj.openai_base_url; // migration cleanup — never mix the two mechanisms
+  } else {
+    // D51: no provider block requested → never leave a stale override behind
+    delete obj.openai_base_url;
   }
   obj.features = isTomlSectionValue(obj.features) ? obj.features : {};
   obj.features.hooks = true;
@@ -438,8 +448,9 @@ export function renderCodexGlobalConfig(projectDir, existingContent = '', opts =
  *
  * - Project config (<projectDir>/.codex/config.toml): headless settings,
  *   features, notice suppression — required for baize unattended operation.
- * - Global config (~/.codex/config.toml): trust declarations, optional
- *   base URL override.
+ * - Global config (~/.codex/config.toml): trust declarations + optional D51
+ *   provider block (opts.codex). Legacy opts.openaiBaseUrl is still accepted
+ *   for compatibility but only cleans the override key (D51 migration).
  *
  * Called by both `baize init` (Codex runtime) and `baize runtime codex` so the
  * config is always present when switching to Codex.
@@ -485,6 +496,136 @@ export function writeCodexConfig(projectDir, opts = {}) {
   }
 }
 
+// ── D51: dedicated provider block writers (DeepSeek remote-compaction fix) ──
+
+// Keys Codex treats as built-in model_providers entries — a custom provider
+// must never shadow these (merge_configured_model_providers silently drops
+// colliding keys). Also covers the web-console restore targets.
+export const CODEX_RESERVED_PROVIDER_KEYS = new Set([
+  'openai', 'azure', 'amazon-bedrock', 'amazon-bedrock-runtime',
+  'ollama', 'lmstudio', 'gpt-oss', 'official', 'official-openai',
+]);
+
+/**
+ * Deterministic provider slug for a provider id: ASCII slug, or
+ * `codex-<id-hash8>` when empty or reserved. Pure — no store access.
+ */
+export function codexProviderKeyForId(id) {
+  const base = String(id || '').toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
+  if (base && !CODEX_RESERVED_PROVIDER_KEYS.has(base)) return base;
+  const hash = crypto.createHash('sha256').update(String(id || '')).digest('hex').slice(0, 8);
+  return `codex-${hash}`;
+}
+
+function globalCodexConfigPath(homeDir) {
+  // D51 incident hardening: jest's ESM sandbox resolves os.homedir() to the
+  // REAL home regardless of process.env.HOME — relying on the default once
+  // wrote test fixtures into the user's live ~/.codex. Callers must pass
+  // homeDir explicitly; when they don't, honor HOME env first and only then
+  // fall back to os.homedir().
+  const base = homeDir || process.env.HOME || os.homedir();
+  return path.join(base, '.codex', 'config.toml');
+}
+
+function projectCodexConfigPathFor(projectDir) {
+  // D51: resolve the fallback lazily — BAIZE_DIR is a module-load constant in
+  // config.js, so under test runners that mutate HOME/BAIZE_DIR per case the
+  // cached value would point at the first case's temp dir. env wins here.
+  const base = projectDir
+    ? path.resolve(projectDir)
+    : (process.env.BAIZE_DIR || BAIZE_DIR);
+  return path.join(base, '.codex', 'config.toml');
+}
+
+/** Parse + stringify round-trip preserving everything smol-toml supports. */
+function rewriteCodexToml(targetPath, mutate, { mode } = {}) {
+  const dir = path.dirname(targetPath);
+  fs.mkdirSync(dir, { recursive: true });
+  let content = '';
+  try { content = fs.readFileSync(targetPath, 'utf8'); } catch { /* new file */ }
+  const obj = parseCodexToml(content);
+  mutate(obj);
+  const out = stringify(obj);
+  fs.writeFileSync(targetPath, out.endsWith('\n') ? out : `${out}\n`, mode ? { mode } : 'utf8');
+  return targetPath;
+}
+
+/**
+ * D51: activate an external Codex provider as a dedicated [model_providers.<key>]
+ * block in the GLOBAL config + top-level model_provider, and ensure both files
+ * are free of the legacy openai_base_url override. The block's `name` always
+ * equals the slug (never "OpenAI") so Codex treats the endpoint as a generic
+ * responses-compatible provider → local compaction (DeepSeek-safe).
+ *
+ * @param {{ providerKey: string, baseUrl: string, token?: string, model?: string,
+ *           homeDir?: string, projectDir?: string }} opts
+ * @returns {{ globalPath: string, projectPath: string }} written file paths
+ */
+export function applyCodexProviderBlock(opts) {
+  const { providerKey, baseUrl, token, model } = opts || {};
+  if (!providerKey || !baseUrl) {
+    throw new Error('applyCodexProviderBlock requires providerKey and baseUrl');
+  }
+  const key = CODEX_RESERVED_PROVIDER_KEYS.has(providerKey)
+    ? codexProviderKeyForId(providerKey)
+    : providerKey;
+  const globalPath = rewriteCodexToml(globalCodexConfigPath(opts.homeDir), (obj) => {
+    if (model) obj.model = model;
+    obj.model_provider = key;
+    obj.model_providers = isTomlSectionValue(obj.model_providers) ? obj.model_providers : {};
+    const block = { name: key, base_url: baseUrl, wire_api: 'responses' };
+    if (token) block.experimental_bearer_token = token;
+    obj.model_providers[key] = block;
+    delete obj.openai_base_url;
+  }, { mode: 0o600 }); // token may ride the global file — write user-only from the start
+
+
+  // D31 semantics: codex prefers project-level values, so the provider model
+  // must be mirrored here — otherwise a stale project model (e.g. gpt-5.5
+  // backfilled by init) would shadow the just-activated provider model.
+  const projectPath = rewriteCodexToml(projectCodexConfigPathFor(opts.projectDir), (obj) => {
+    if (model) obj.model = model;
+    delete obj.openai_base_url; // project-level never carries endpoint/auth
+  });
+  return { globalPath, projectPath };
+}
+
+/**
+ * D51: restore the official OpenAI configuration — remove the top-level
+ * model_provider and every baize-written custom provider block, drop the
+ * legacy openai_base_url override, reset model to gpt-5.5. Project-level
+ * model resets too (mirrors the pre-D51 applyCodexOfficial behavior).
+ *
+ * @param {{ homeDir?: string, projectDir?: string }} [opts]
+ * @returns {{ globalPath: string, projectPath: string }}
+ */
+export function restoreCodexOfficialBlock(opts = {}) {
+  const globalPath = rewriteCodexToml(globalCodexConfigPath(opts.homeDir), (obj) => {
+    delete obj.model_provider;
+    if (isTomlSectionValue(obj.model_providers)) {
+      for (const key of Object.keys(obj.model_providers)) {
+        const block = obj.model_providers[key];
+        // D51 review P2: only remove blocks baize itself wrote — the writer
+        // always stamps name === key && wire_api === 'responses'. Hand-edited
+        // user providers (any other shape) must survive an official restore.
+        const isBaizeWritten = isTomlSectionValue(block)
+          && block.name === key
+          && block.wire_api === 'responses';
+        if (isBaizeWritten) delete obj.model_providers[key];
+      }
+      if (Object.keys(obj.model_providers).length === 0) delete obj.model_providers;
+    }
+    delete obj.openai_base_url;
+    obj.model = 'gpt-5.5';
+  });
+  const projectPath = rewriteCodexToml(projectCodexConfigPathFor(opts.projectDir), (obj) => {
+    delete obj.openai_base_url;
+    obj.model = 'gpt-5.5';
+  });
+  return { globalPath, projectPath };
+}
+
+
 /**
  * Persist an OpenAI API key to ~/.codex/auth.json (Codex's native credential store).
  * Also sets OPENAI_API_KEY in process.env for the current init process so that

package/cli/lib/upgrade.js

@@ -21,31 +21,35 @@ import { copyTree, syncTree } from './fs-utils.js';
 import { applyCaddyRoutes } from './caddy.js';
 import { smartSync, formatMergeResult } from './smart-merge.js';
 import { restartFromEcosystem, restartManagedProcess } from './pm2.js';
+import { a2aCliPath } from './a2a.js';
 
 // ---------------------------------------------------------------------------
 // Version helpers
 // ---------------------------------------------------------------------------
 
+const SEMVER_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+
 /**
- * Read the local version from SKILL.md frontmatter, falling back to package.json.
+ * Read the local version of an installed component (K6).
+ * Primary: skillDir/package.json `version` (valid semver only — SKILL.md
+ * frontmatter historically stayed at 0.1.0 while package.json advanced, which
+ * broke upgrade version gating). Fallback: SKILL.md frontmatter.
  */
-function getLocalVersion(skillDir) {
-  // Primary: SKILL.md frontmatter
-  const parsed = parseSkillMd(skillDir);
-  if (parsed?.frontmatter?.version) {
-    return { success: true, version: String(parsed.frontmatter.version) };
-  }
-  // Fallback: package.json
+export function getLocalVersion(skillDir) {
   const pkgPath = path.join(skillDir, 'package.json');
   try {
     const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
-    if (pkg.version) {
-      return { success: true, version: String(pkg.version) };
+    if (typeof pkg.version === 'string' && SEMVER_RE.test(pkg.version.trim())) {
+      return { success: true, version: pkg.version.trim() };
     }
   } catch {
-    // package.json doesn't exist or is invalid
+    // package.json missing or invalid — fall through to SKILL.md
+  }
+  const parsed = parseSkillMd(skillDir);
+  if (parsed?.frontmatter?.version) {
+    return { success: true, version: String(parsed.frontmatter.version) };
   }
-  return { success: false, error: 'Version not found in SKILL.md or package.json' };
+  return { success: false, error: 'Version not found in package.json or SKILL.md' };
 }
 
 /**
@@ -645,8 +649,27 @@ function truncateHookOutput(value, maxLength = 1000) {
   return value.length > maxLength ? `${value.slice(0, maxLength)}...` : value;
 }
 
+const A2A_CLI_RESTART_TIMEOUT_MS = 120000;
+
+/**
+ * Resolve the baize-a2a scripts/cli.js for the K5 restart hook. The component's
+ * own skill dir wins (that is where `baize add` / web install put it); the
+ * fallback reuses cli/lib/a2a.js resolution (env override included).
+ */
+function defaultResolveA2aCli(skillDir) {
+  const local = path.join(skillDir, 'scripts', 'cli.js');
+  if (fs.existsSync(local)) return local;
+  return a2aCliPath();
+}
+
 /**
- * Step 8: restart PM2 service (if it was running before upgrade)
+ * Step 8: restart the component service (if it was running before upgrade).
+ *
+ * K5 restart hook: a nohup-started a2a daemon (Docker entrypoint) is invisible
+ * to pm2, so the pm2-only restart below never refreshed its code (C6). For
+ * service name 'baize-a2a' the a2a CLI `restart` (daemon-ctl: nohup pid +
+ * pm2 + waitReady) is preferred — it covers both lifecycles — falling back to
+ * the existing pm2 path when the CLI is unavailable or fails.
  */
 export function step8_startService(ctx, deps = {}) {
   const startTime = Date.now();
@@ -654,13 +677,30 @@ export function step8_startService(ctx, deps = {}) {
   const exists = deps.existsSync ?? fs.existsSync;
   const restartManaged = deps.restartManagedProcess ?? restartManagedProcess;
   const restartViaEcosystem = deps.restartFromEcosystem ?? restartFromEcosystem;
+  const spawnSyncFn = deps.spawnSyncFn ?? spawnSync;
+  const resolveA2aCli = deps.resolveA2aCli ?? defaultResolveA2aCli;
+
+  const parsed = parseSkillMd(ctx.skillDir);
+  const serviceName = parsed?.frontmatter?.lifecycle?.service?.name || `baize-${ctx.component}`;
+
+  if (serviceName === 'baize-a2a') {
+    const cli = resolveA2aCli(ctx.skillDir);
+    if (cli) {
+      const res = spawnSyncFn(process.execPath, [cli, 'restart', '--json'], {
+        input: '',
+        encoding: 'utf8',
+        timeout: A2A_CLI_RESTART_TIMEOUT_MS,
+      });
+      if (!res.error && res.status === 0) {
+        return { step: 8, name: 'start_service', status: 'done', message: `${serviceName} (a2a cli restart)`, duration: Date.now() - startTime };
+      }
+    }
+  }
 
   if (!ctx.serviceWasRunning) {
     return { step: 8, name: 'start_service', status: 'skipped', message: 'was not running', duration: Date.now() - startTime };
   }
 
-  const parsed = parseSkillMd(ctx.skillDir);
-  const serviceName = parsed?.frontmatter?.lifecycle?.service?.name || `baize-${ctx.component}`;
   const ecosystemPath = path.join(ctx.skillDir, 'ecosystem.config.cjs');
 
   try {

package/docker/entrypoint.sh

@@ -97,7 +97,6 @@ mkdir -p "${BAIZE_DIR}/.baize"
 printf '{"status":"ok","at":"%s"}\n' "$(date -Iseconds)" > "${BAIZE_DIR}/.baize/init-state.json"
 
 
-ok "Workspace ready"
 
 # ── Pass through channel env vars to .env ─────────────────────────────────────
 # baize init doesn't write channel tokens — those come from component installs.
@@ -153,25 +152,6 @@ PM2_PID=$!
 sleep 3
 ok "Services started"
 
-# ── Step 3b: A2A self-heal (D48) ─────────────────────────────────────────────
-# After a container restart, a previously-enabled A2A component must come back
-# up by itself (zero manual ops). If the A2A config says enabled, start the
-# baize-a2a daemon — it registers/renews its certificate with the admin and
-# serves the advertise port. Idempotent: pm2 start restarts an existing entry.
-if [ -f "${BAIZE_DIR}/components/a2a/config.json" ]; then
-  A2A_ENABLED=$(node -e "
-    try {
-      const c = JSON.parse(require('fs').readFileSync('${BAIZE_DIR}/components/a2a/config.json','utf8'));
-      process.stdout.write(c.enabled ? '1' : '0');
-    } catch { process.stdout.write('0'); }
-  " 2>/dev/null || echo "0")
-  if [ "$A2A_ENABLED" = "1" ]; then
-    ok "A2A enabled — starting baize-a2a daemon"
-    ( cd "${BAIZE_DIR}/.claude/skills/a2a" && pm2 start ecosystem.config.cjs >/dev/null 2>&1 ) || \
-      warn "A2A daemon start failed — check 'docker exec <c> pm2 logs baize-a2a'"
-  fi
-fi
-
 # ── Step 4: Start the configured agent runtime in tmux ───────────────────────
 
 # ── Step 4: Start the configured agent runtime in tmux ───────────────────────

package/docker-compose.yml

@@ -57,9 +57,27 @@ services:
 
     # ── Health ────────────────────────────────────────────────────────────────
     healthcheck:
-      test: ["CMD", "pm2", "list"]
+      test:
+        - CMD
+        - node
+        - -e
+        - |
+          const fs = require('fs'), net = require('net');
+          // Core health = pm2 reports online. A2A (commercial component, D49):
+          // when installed and enabled, the container is only healthy if its
+          // daemon actually LISTENS (pm2 status alone masked the KI-015
+          // silent-idle shape); otherwise the check is skipped.
+          try { require('child_process').execSync('pm2 list', { stdio: 'ignore' }); } catch { process.exit(1); }
+          try {
+            const cfg = JSON.parse(fs.readFileSync('/home/baize/baize/components/a2a/config.json', 'utf8'));
+            if (cfg.enabled !== true) process.exit(0);
+            const s = net.connect({ host: '127.0.0.1', port: cfg.listenPort || 8443, timeout: 3000 });
+            s.on('connect', () => { s.destroy(); process.exit(0); });
+            s.on('error', () => process.exit(1));
+            s.on('timeout', () => { s.destroy(); process.exit(1); });
+          } catch { process.exit(0); }
       interval: 30s
-      timeout: 10s
+      timeout: 15s
       retries: 3
       start_period: 600s
 

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@baize-ai/core",
-  "version": "0.3.14",
+  "version": "0.3.16",
   "type": "module",
-  "description": "Baize (\u767d\u6cfd) \u2014 autonomous AI agent infrastructure",
+  "description": "Baize (白泽) — autonomous AI agent infrastructure",
   "main": "cli/baize.js",
   "bin": {
     "baize": "./cli/baize.js"

package/scripts/docker-publish.sh

@@ -35,10 +35,6 @@ docker build \
   -t "${GHCR_IMAGE}:${VERSION}" \
   -t "${GHCR_IMAGE}:latest" \
   .
-  "${BUILD_ARGS[@]}" \
-  -t "${GHCR_IMAGE}:${VERSION}" \
-  -t "${GHCR_IMAGE}:latest" \
-  .
 
 if [ -n "${ACR_REGISTRY}" ] && [ -n "${ACR_NAMESPACE}" ]; then
   ACR_IMAGE="${ACR_REGISTRY}/${ACR_NAMESPACE}/baize-core"