@baize-ai/core 0.3.15 → 0.3.17

package/skills/web-console/public/app.js

@@ -1170,7 +1170,18 @@ async function loadProviders(basePath) {
     const names = { official: 'Anthropic 官方', 'official-openai': 'OpenAI 官方' };
     const prov = (body.providers || []).find((x) => x.id === body.active);
     const label = prov?.name || names[body.active] || body.active || 'official';
-    activeEl.textContent = `当前激活：${label}`;
+    const codexSlug = body.codexProviderKey || prov?.codex?.providerKey || null;
+    const codexKind = prov?.codex?.kind || null;
+    // D51 review P3: surface the kind so openai-official (no block) vs
+    // responses-compatible (provider block) are distinguishable at a glance.
+    const codexTag = codexKind === 'responses-compatible' && codexSlug
+      ? `（codex: ${codexSlug} · responses）`
+      : codexKind === 'openai-official'
+        ? '（codex: OpenAI 官方）'
+        : codexSlug
+          ? `（codex: ${codexSlug}）`
+          : '';
+    activeEl.textContent = `当前激活：${label}${codexTag}`;
   }
   const list = document.getElementById('provider-list');
   if (!list) return;
@@ -1249,7 +1260,8 @@ async function activateProviderFromAdmin(basePath, id) {
     const restartNote = body.restart?.restarted ? '，会话已重启' : (body.restart?.reason === 'no_session' ? '（无运行中会话）' : '');
     const warnNote = body.warnings?.length ? `
 警告：${body.warnings.join('\n')}` : '';
-    setAdminMsg(`已激活 ${body.active}${restartNote}${warnNote}`);
+    const slugNote = body.codexProviderKey ? `（codex: ${body.codexProviderKey}）` : '';
+    setAdminMsg(`已激活 ${body.active}${slugNote}${restartNote}${warnNote}`);
   } else {
     setAdminMsg(`激活失败：${body.error || '未知错误'}`, true);
   }
@@ -1863,13 +1875,11 @@ async function openAgentCardEditor(basePath) {
   let catalogue;
   let card;
   let authz;
-  let peerIds;
   try {
-    const [catRes, cardRes, authzRes, peersRes] = await Promise.all([
+    const [catRes, cardRes, authzRes] = await Promise.all([
       adminFetch(basePath, '/api/admin/a2a/card/skills'),
       adminFetch(basePath, '/api/admin/a2a/card'),
       adminFetch(basePath, '/api/admin/a2a/authz'),
-      adminFetch(basePath, '/api/admin/a2a/peers'),
     ]);
     if (catRes.status !== 200) throw new Error(catRes.body.error || 'skills 列表加载失败');
     if (cardRes.status !== 200) throw new Error(cardRes.body.error || '名片加载失败');
@@ -1877,9 +1887,6 @@ async function openAgentCardEditor(basePath) {
     catalogue = catRes.body.skills || [];
     card = cardRes.body;
     authz = authzRes.body;
-    peerIds = peersRes.status === 200 && Array.isArray(peersRes.body.peers)
-      ? peersRes.body.peers.map((p) => p.agentId).filter(Boolean)
-      : [];
   } catch (err) {
     setAdminMsg(`❌ 无法打开名片编辑器：${err.message}`, true);
     return;
@@ -1917,14 +1924,7 @@ async function openAgentCardEditor(basePath) {
             <label class="authz-mode-option"><input type="radio" name="authz-mode" value="allowlist"> 白名单</label>
           </div>
           <p class="conn-block-desc" id="authz-mode-desc"></p>
-          <div class="agent-card-field-label"><span id="authz-list-title">阻止列表</span> <span class="agent-card-selected-count" id="authz-count"></span></div>
-          <div class="authz-tags" id="authz-tags" aria-live="polite"></div>
-          <div class="authz-add-row">
-            <input type="text" id="authz-peer-input" class="agent-card-input" placeholder="输入 peer agent_id 后添加" autocomplete="off" spellcheck="false">
-            <button type="button" class="btn btn-outline" id="authz-peer-add">添加</button>
-          </div>
-          <div class="agent-card-field-label">从 peer 列表选择</div>
-          <select id="authz-peer-select" class="agent-card-input" aria-label="从 peer 列表选择"></select>
+          <p class="conn-block-desc" style="color:#8c8c8c">允许 / 阻止名单由 admin 控制台统一管控（组织架构 · 调用白名单），此处仅切换本 agent 的授权模式。</p>
         </div>
       </div>
       <div class="agent-card-modal-foot">
@@ -1943,18 +1943,10 @@ async function openAgentCardEditor(basePath) {
   nameInput.value = card.name || '';
   descInput.value = card.description || '';
 
-  // ── 调用授权 tab state (D22 单元 C) ──
-  const allowSet = new Set(Array.isArray(authz.allow) ? authz.allow : []);
-  const blockSet = new Set(Array.isArray(authz.block) ? authz.block : []);
+  // ── 调用授权 tab state (D52: local mode only; lists are admin-managed) ──
   let authzMode = authz.mode === 'allowlist' ? 'allowlist' : 'open';
-  const activeAuthzList = () => (authzMode === 'allowlist' ? allowSet : blockSet);
 
   const authzModeDesc = overlay.querySelector('#authz-mode-desc');
-  const authzListTitle = overlay.querySelector('#authz-list-title');
-  const authzCount = overlay.querySelector('#authz-count');
-  const authzTagsEl = overlay.querySelector('#authz-tags');
-  const authzPeerInput = overlay.querySelector('#authz-peer-input');
-  const authzPeerSelect = overlay.querySelector('#authz-peer-select');
 
   const renderAuthz = () => {
     overlay.querySelectorAll('input[name="authz-mode"]').forEach((r) => {
@@ -1962,19 +1954,8 @@ async function openAgentCardEditor(basePath) {
     });
     const isAllowlist = authzMode === 'allowlist';
     authzModeDesc.textContent = isAllowlist
-      ? '仅允许列表中的 agent 可以调用本 agent（空列表 = 无人可调用）。'
-      : '接受所有已批准 agent，除阻止列表中的 agent。';
-    authzListTitle.textContent = isAllowlist ? '允许列表' : '阻止列表';
-    const list = [...activeAuthzList()];
-    authzCount.textContent = `${list.length} 个`;
-    authzTagsEl.innerHTML = list.length
-      ? list.map((id) => `<span class="authz-tag">${escapeHtml(id)}<button type="button" class="authz-tag-x" aria-label="移除 ${escapeHtml(id)}" data-id="${escapeHtml(id)}">×</button></span>`).join('')
-      : '<span class="cred-state">（空）</span>';
-    const current = new Set(activeAuthzList());
-    const available = peerIds.filter((id) => !current.has(id));
-    authzPeerSelect.innerHTML = `<option value="">${available.length ? '选择 peer 添加到列表…' : '列表已包含所有已知 peer'}</option>`
-      + available.map((id) => `<option value="${escapeHtml(id)}">${escapeHtml(id)}</option>`).join('');
-    authzPeerSelect.disabled = available.length === 0;
+      ? '仅允许白名单中的 agent 调用本 agent（白名单由 admin 控制台配置；空名单 = 无人可调用）。'
+      : '接受所有已批准 agent（除 admin 控制台配置的阻止名单）。';
   };
 
   overlay.querySelectorAll('input[name="authz-mode"]').forEach((r) => {
@@ -1986,42 +1967,6 @@ async function openAgentCardEditor(basePath) {
     });
   });
 
-  const addAuthzPeer = () => {
-    const value = authzPeerInput.value.trim();
-    if (!value) {
-      setAdminMsg('请输入 peer agent_id', true);
-      return;
-    }
-    const list = activeAuthzList();
-    if (list.has(value)) {
-      setAdminMsg(`⚠️ ${value} 已在${authzMode === 'allowlist' ? '允许' : '阻止'}列表中`, true);
-      return;
-    }
-    list.add(value);
-    authzPeerInput.value = '';
-    renderAuthz();
-  };
-  authzPeerInput.addEventListener('keydown', (e) => {
-    if (e.key === 'Enter') {
-      e.preventDefault();
-      addAuthzPeer();
-    }
-  });
-  overlay.querySelector('#authz-peer-add').addEventListener('click', addAuthzPeer);
-  authzPeerSelect.addEventListener('change', () => {
-    const value = authzPeerSelect.value;
-    if (!value) return;
-    activeAuthzList().add(value);
-    renderAuthz();
-  });
-  authzTagsEl.addEventListener('click', (e) => {
-    const btn = e.target.closest('.authz-tag-x');
-    if (btn) {
-      activeAuthzList().delete(btn.dataset.id);
-      renderAuthz();
-    }
-  });
-
   // ── Tab switching ──
   const tabButtons = overlay.querySelectorAll('.agent-card-tab');
   const cardTabEl = overlay.querySelector('#agent-card-tab-card');
@@ -2123,7 +2068,7 @@ async function openAgentCardEditor(basePath) {
         adminFetch(basePath, '/api/admin/a2a/authz', {
           method: 'PUT',
           headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ mode: authzMode, allow: [...allowSet], block: [...blockSet] }),
+          body: JSON.stringify({ mode: authzMode }),
         }),
       ]);
       if (cardRes.status === 401 || authzRes.status === 401) {

package/skills/web-console/scripts/model-provider.js

@@ -4,7 +4,7 @@
  *
  * A provider entry carries per-runtime endpoints/models:
  *   cc:    { baseUrl, authToken, model, smallModel }   → ANTHROPIC_* env
- *   codex: { baseUrl, apiKey, model }                  → OPENAI_BASE_URL + auth.json + config.toml
+ *   codex: { kind, providerKey, baseUrl, apiKey, model } → dedicated provider block in config.toml
  *
  * Activation writes the same storage surfaces init uses (~/baize/.env +
  * ~/.claude/settings.json env + ~/.codex/auth.json + ~/.codex/config.toml)
@@ -31,6 +31,13 @@ import {
   restartAgentSession,
 } from './admin-auth.js';
 
+// D51: Codex provider-block writers shared with the CLI (same package tree).
+import {
+  applyCodexProviderBlock,
+  codexProviderKeyForId,
+  restoreCodexOfficialBlock,
+} from '../../../cli/lib/runtime-setup.js';
+
 // ── Config store (~/.baize/providers.json) ───────────────────────────────────
 
 function providersPath() {
@@ -53,13 +60,49 @@ function projectCodexConfigPath() {
   return path.join(process.env.BAIZE_DIR || path.join(process.env.HOME || '', 'baize'), '.codex', 'config.toml');
 }
 
+// Codex-side kind enum (D51 — DeepSeek remote-compaction fix):
+//   openai-official       use the built-in OpenAI provider (no model_provider block)
+//   responses-compatible  generic /responses endpoint → dedicated [model_providers.<slug>] block
+//   chat-only             legacy /chat wire only — Codex removed the Chat wire
+const CODEX_KINDS = new Set(['openai-official', 'responses-compatible', 'chat-only']);
+
+// Home/project roots, resolved from the same env vars every other path in
+// this module uses. Passed explicitly to the runtime-setup writers because
+// their os.homedir()/BAIZE_DIR fallbacks don't follow test env overrides
+// (jest sandboxes os.homedir()).
+function homeRoot() {
+  return process.env.HOME || '';
+}
+function baizeRoot() {
+  return process.env.BAIZE_DIR || path.join(process.env.HOME || '', 'baize');
+}
+
 function loadStore() {
   const data = readJson(providersPath()) || {};
-  return {
+  const store = {
     active: typeof data.active === 'string' ? data.active : 'official',
     providers: Array.isArray(data.providers) ? data.providers : [],
     stash: data.stash && typeof data.stash === 'object' ? data.stash : null,
   };
+  // Lazy D51 migration: entries saved before kind/providerKey existed get
+  // backfilled from the entry shape (baseUrl → responses-compatible) and the
+  // store is re-persisted so slugs stay stable from the first read onward.
+  let migrated = false;
+  for (const p of store.providers) {
+    const codex = p.codex && typeof p.codex === 'object' ? p.codex : {};
+    if (!codex.kind) {
+      codex.kind = codex.baseUrl ? 'responses-compatible' : 'openai-official';
+      p.codex = codex;
+      migrated = true;
+    }
+    if (!codex.providerKey && p.id) {
+      codex.providerKey = codexProviderKeyForId(p.id);
+      p.codex = codex;
+      migrated = true;
+    }
+  }
+  if (migrated) saveStore(store);
+  return store;
 }
 
 function saveStore(store) {
@@ -91,6 +134,7 @@ function validProviderInput(data) {
   const urlRe = /^https?:\/\/.+/;
   if (cc.baseUrl && !urlRe.test(String(cc.baseUrl))) return 'cc.baseUrl must start with http(s)://';
   if (codex.baseUrl && !urlRe.test(String(codex.baseUrl))) return 'codex.baseUrl must start with http(s)://';
+  if (codex.kind && !CODEX_KINDS.has(String(codex.kind))) return `codex.kind must be one of: ${[...CODEX_KINDS].join(', ')}`;
   return null;
 }
 
@@ -106,6 +150,8 @@ function sanitizeProvider(p) {
       authConfigured: Boolean(p.cc?.authToken),
     },
     codex: {
+      kind: p.codex?.kind || null,
+      providerKey: p.codex?.providerKey || null,
       baseUrl: p.codex?.baseUrl || null,
       model: p.codex?.model || null,
       apiConfigured: Boolean(p.codex?.apiKey),
@@ -131,8 +177,15 @@ export async function saveProvider(input) {
   const cc = input.cc || {};
   const codex = input.codex || {};
   const exists = input.id && store.providers.some((p) => p.id === input.id);
+  // D51: keep the pre-existing kind/providerKey on updates (slug is generated
+  // once and never regenerated — a rename must not orphan the TOML block).
+  const prevCodex = exists ? store.providers.find((p) => p.id === input.id).codex || {} : {};
+  const kind = codex.kind
+    ? String(codex.kind)
+    : (prevCodex.kind || (codex.baseUrl ? 'responses-compatible' : 'openai-official'));
+  const id = exists ? input.id : genId(name, store);
   const entry = {
-    id: exists ? input.id : genId(name, store),
+    id,
     name,
     cc: {
       baseUrl: cc.baseUrl ? String(cc.baseUrl).trim() : undefined,
@@ -141,6 +194,8 @@ export async function saveProvider(input) {
       smallModel: cc.smallModel ? String(cc.smallModel).trim() : undefined,
     },
     codex: {
+      kind,
+      providerKey: prevCodex.providerKey || codexProviderKeyForId(id),
       baseUrl: codex.baseUrl ? String(codex.baseUrl).trim() : undefined,
       apiKey: codex.apiKey ? String(codex.apiKey).trim() : undefined,
       model: codex.model ? String(codex.model).trim() : undefined,
@@ -165,9 +220,12 @@ function readRuntime() {
 
 function genId(name, store) {
   const base = name.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '') || 'provider';
-  // 'official' / 'official-openai' are built-in restore targets — reserve them
-  // so a user-named provider can never shadow or be shadowed by them.
-  let id = (base === 'official' || base === 'official-openai') ? `${base}-custom` : base;
+  // Reserved ids never land in the store: the built-in restore targets
+  // ('official' / 'official-openai') plus Codex built-in provider keys that a
+  // user-named provider must not shadow (D51 — 'openai' would make the
+  // generated provider block collide with the built-in OpenAI entry).
+  const reserved = new Set(['official', 'official-openai', 'openai', 'azure', 'amazon-bedrock', 'amazon-bedrock-runtime', 'ollama', 'lmstudio', 'gpt-oss']);
+  let id = reserved.has(base) ? `${base}-custom` : base;
   let n = 2;
   while (store.providers.some((p) => p.id === id)) id = `${base}-${n++}`;
   return id;
@@ -189,7 +247,8 @@ const CC_EXTERNAL_KEYS = ['ANTHROPIC_AUTH_TOKEN', 'ANTHROPIC_BASE_URL', 'ANTHROP
 
 /**
  * Activate a provider or built-in official restore target.
- * @returns {Promise<{success: boolean, active: string, warnings: string[], restart?: object, error?: string}>}
+ * @returns {Promise<{success: boolean, active: string, warnings: string[],
+ *   restart?: object, codexProviderKey?: string|null, error?: string}>}
  */
 export async function activateProvider(id, deps = {}) {
   const store = loadStore();
@@ -206,6 +265,14 @@ export async function activateProvider(id, deps = {}) {
   // current runtime's side is meaningless (e.g. a cc-only provider while the
   // Codex runtime is active). Official restores and dual-side providers pass.
   if (provider) {
+    // D51: chat-only endpoints have no Codex wiring at all (the Chat wire was
+    // removed from Codex) — block activation before anything is written.
+    if (provider.codex?.kind === 'chat-only') {
+      return {
+        success: false,
+        error: '该供应商仅支持 Chat 接口，Codex 已移除 Chat wire，请改用 Claude 运行时',
+      };
+    }
     const runtime = readRuntime();
     const hasCc = Boolean(provider.cc?.authToken || provider.cc?.baseUrl || provider.cc?.model || provider.cc?.smallModel);
     const hasCodex = Boolean(provider.codex?.baseUrl || provider.codex?.apiKey || provider.codex?.model);
@@ -233,10 +300,11 @@ export async function activateProvider(id, deps = {}) {
     applyClaudeExternal(cc, store);
   }
 
+  let codexProviderKey = null;
   if (isOfficialOpenai) {
     applyCodexOfficial();
   } else if (provider?.codex) {
-    applyCodexExternal(provider.codex);
+    codexProviderKey = applyCodexExternal(provider.codex) || null;
   }
 
   // Non-blocking reachability probe for configured base URLs (informational).
@@ -251,7 +319,7 @@ export async function activateProvider(id, deps = {}) {
   store.active = id;
   saveStore(store);
   const restart = await (deps.restart ?? restartAgentSession)();
-  return { success: true, active: id, warnings, restart };
+  return { success: true, active: id, warnings, codexProviderKey, restart };
 }
 
 // Claude Code: external provider application
@@ -308,67 +376,37 @@ function applyOfficialClaude(store) {
   updateSettingsEnv(updates, CC_EXTERNAL_KEYS);
 }
 
-// Codex: external provider application
+// Codex: external provider application (D51 — dedicated provider block).
+// Returns the active codex provider slug, or null when nothing was written.
 function applyCodexExternal(codex) {
   let env = readEnv(envFile());
+  // Legacy override kept for health-probe/status consumers that still read it.
   if (codex.baseUrl) env = upsertEnv(env, 'OPENAI_BASE_URL', codex.baseUrl, 'OpenAI-compatible endpoint (web console)');
   writeEnvFile(env);
   if (codex.apiKey) writeCodexAuth(codex.apiKey);
-  editCodexConfigToml({ model: codex.model, openaiBaseUrl: codex.baseUrl });
+  if (codex.kind === 'openai-official') {
+    // Official endpoint: keep the built-in OpenAI provider (remote compaction
+    // works there) — just drop any leftover custom block/override.
+    restoreCodexOfficialBlock({ homeDir: homeRoot(), projectDir: baizeRoot() });
+    return null;
+  }
+  applyCodexProviderBlock({
+    providerKey: codex.providerKey || codexProviderKeyForId('provider'),
+    baseUrl: codex.baseUrl,
+    token: codex.apiKey,
+    model: codex.model,
+    homeDir: homeRoot(),
+    projectDir: baizeRoot(),
+  });
+  return codex.providerKey || null;
 }
 
-// Codex: restore official (clear external base_url, default model; auth untouched)
+// Codex: restore official (drop provider block + overrides, reset model; auth untouched)
 function applyCodexOfficial() {
   let env = readEnv(envFile());
   env = removeEnvKey(env, 'OPENAI_BASE_URL');
   writeEnvFile(env);
-  editCodexConfigToml({ model: 'gpt-5.5', openaiBaseUrl: null });
-}
-
-/**
- * Conservative top-level edit of a Codex config.toml: set/replace the
- * `model` and `openai_base_url` keys, preserving every other line (comments,
- * sections, providers). Only the TOP-LEVEL prefix (before the first section
- * header) is touched — keys inside [table] sections are also unindented, so
- * regex edits must never run past the first `[` header.
- */
-function writeCodexTomlTopLevel(targetPath, { model, openaiBaseUrl }) {
-  const dir = path.dirname(targetPath);
-  fs.mkdirSync(dir, { recursive: true });
-  let content = '';
-  try { content = fs.readFileSync(targetPath, 'utf8'); } catch { /* new file */ }
-
-  const sectionAt = content.search(/^\[/m);
-  const head = sectionAt === -1 ? content : content.slice(0, sectionAt);
-  const tail = sectionAt === -1 ? '' : content.slice(sectionAt);
-
-  const setTopLevel = (text, key, value) => {
-    const lineRe = new RegExp(`^${key}\\s*=.*$`, 'm');
-    const line = `${key} = ${JSON.stringify(value)}`;
-    if (lineRe.test(text)) return text.replace(lineRe, line);
-    return `${text.trimEnd()}\n${line}\n`;
-  };
-  const removeTopLevel = (text, key) => text.replace(new RegExp(`^${key}\\s*=.*\\n?`, 'm'), '');
-
-  let out = head;
-  if (model) out = setTopLevel(out, 'model', model);
-  if (openaiBaseUrl) out = setTopLevel(out, 'openai_base_url', openaiBaseUrl);
-  if (openaiBaseUrl === null) out = removeTopLevel(out, 'openai_base_url');
-  const joined = tail && !out.endsWith('\n') ? `${out}\n${tail}` : `${out}${tail}`;
-  fs.writeFileSync(targetPath, joined, 'utf8');
-  return targetPath;
-}
-
-/**
- * Apply a provider's Codex model/base_url to BOTH the global config.toml and
- * the baize project-level config.toml. codex prefers project-level keys, so
- * writing only the global file let baize init's backfilled defaults (model =
- * "gpt-5.5") shadow the provider config (D31).
- */
-export function editCodexConfigToml({ model, openaiBaseUrl }) {
-  writeCodexTomlTopLevel(codexConfigPath(), { model, openaiBaseUrl });
-  writeCodexTomlTopLevel(projectCodexConfigPath(), { model, openaiBaseUrl });
-  return codexConfigPath();
+  restoreCodexOfficialBlock({ homeDir: homeRoot(), projectDir: baizeRoot() });
 }
 
 // Reachability probe: any <500 status means the endpoint answers.

package/skills/web-console/scripts/server.js

@@ -1558,23 +1558,6 @@ function readAuthz() {
   }
 }
 
-// Validates an allow/block list; returns { list } or { error }.
-function validateAuthzList(value, name) {
-  if (!Array.isArray(value)) return { error: `${name} 必须是数组` };
-  const seen = new Set();
-  const list = [];
-  for (const item of value) {
-    if (typeof item !== 'string' || item.trim() === '') {
-      return { error: `${name} 包含空项（必须是非空字符串）` };
-    }
-    const v = item.trim();
-    if (seen.has(v)) return { error: `${name} 包含重复的 agent_id：${v}` };
-    seen.add(v);
-    list.push(v);
-  }
-  return { list };
-}
-
 // Current authz policy (config.json authz; contract defaults when unconfigured)
 app.get('/api/admin/a2a/authz', (req, res) => {
   try {
@@ -1584,8 +1567,11 @@ app.get('/api/admin/a2a/authz', (req, res) => {
   }
 });
 
-// Save the authz policy — validates, then writes config.json (preserving other
-// fields) and returns the persisted policy
+// Save the authz policy — D52 governance: the LOCAL agent may only flip the
+// mode (open/allowlist); allow/block lists are admin-managed (admin-workspace
+// pushes the cluster policy; local lists here would be dead weight / bypass
+// confusion). Any allow/block sent is ignored and forced to [] — the UI hides
+// list editing, and a direct API call cannot reintroduce local lists.
 app.put('/api/admin/a2a/authz', (req, res) => {
   try {
     const body = req.body || {};
@@ -1593,11 +1579,7 @@ app.put('/api/admin/a2a/authz', (req, res) => {
     if (mode !== 'open' && mode !== 'allowlist') {
       return res.status(400).json({ success: false, error: 'mode 必须是 open 或 allowlist' });
     }
-    const allow = body.allow === undefined ? { list: [] } : validateAuthzList(body.allow, 'allow');
-    if (allow.error) return res.status(400).json({ success: false, error: allow.error });
-    const block = body.block === undefined ? { list: [] } : validateAuthzList(body.block, 'block');
-    if (block.error) return res.status(400).json({ success: false, error: block.error });
-    const authz = { mode, allow: allow.list, block: block.list };
+    const authz = { mode, allow: [], block: [] };
     const file = a2aConfigPath();
     let cfg = {};
     try {

package/templates/pm2/ecosystem.config.cjs

@@ -28,11 +28,12 @@ function readEnvValue(key, defaultValue = '') {
   return defaultValue;
 }
 
-// Build PATH: Claude locations + user's full shell PATH + PM2's own PATH
-// Deduplicate to prevent PATH bloat across PM2 restarts — each restart
-// re-evaluates this file with process.env.PATH already containing the
-// previous ENHANCED_PATH, which would otherwise compound indefinitely.
+// Build PATH: npm global bin + Claude locations + user's full shell PATH +
+// PM2's own PATH. D54: ~/.npm-global/bin is added EXPLICITLY (independent of
+// SYSTEM_PATH / process.env.PATH) — codex/baize live there; a polluted login
+// shell PATH must never hide them from PM2 services.
 const ENHANCED_PATH = [...new Set([
+  path.join(HOME, '.npm-global', 'bin'),
   path.join(HOME, '.local', 'bin'),
   path.join(HOME, '.claude', 'bin'),
   ...(readEnvValue('SYSTEM_PATH') || '').split(':').filter(Boolean),