@baize-ai/core 0.3.5 → 0.3.7

package/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to baize-core will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.7] - 2026-08-26
+
+### Fixed
+- Codex 配置链路（D31）：web 控制台激活供应商现在同时写全局与项目级 `config.toml`（model + openai_base_url）——此前只写全局，baize init 回填的项目级默认 `gpt-5.5` 会压制用户配置（codex 键级合并，项目级优先）→ 大陆 DeepSeek 场景会话秒退
+- `baize init` 的项目级 codex config 回填改为继承全局 model（无全局时才用 gpt-5.5 兜底）——升级不再覆盖用户配置
+- `baize upgrade --self` 改为 npm registry 路径（`npm view` / `npm pack`，跟随用户 registry——大陆 npmmirror 可达）；`--beta` 保留预发布通道（dist-tags/versions 选最高 prerelease）；npm 返回值严格 semver 校验
+
+## [0.3.6] - 2026-08-26
+
+### Added
+- web-console 诊断卡（模型设置页）：服务状态 / agent 会话（含卡登录提示）/ 运行时与认证 / 最近错误——浏览器内排查，无需 SSH
+
 ## [0.3.5] - 2026-08-26
 
 ### Fixed

package/cli/lib/__tests__/runtime-setup.test.js

@@ -93,6 +93,27 @@ describe('renderCodexProjectConfig', () => {
     assert.doesNotMatch(content, /^model = "gpt-5\.5"$/m);
     assert.doesNotMatch(content, /^model_reasoning_effort = "medium"$/m);
   });
+  it('backfills the global codex model when the project config has none (D31)', () => {
+    fs.mkdirSync(path.join(fakeHome, '.codex'), { recursive: true });
+    fs.writeFileSync(
+      path.join(fakeHome, '.codex', 'config.toml'),
+      'model = "deepseek-v4-flash"\nopenai_base_url = "https://api.deepseek.com"\n',
+      'utf8',
+    );
+
+    const content = renderCodexProjectConfig('');
+
+    assert.match(content, /^model = "deepseek-v4-flash"$/m);
+    assert.doesNotMatch(content, /^model = "gpt-5\.5"$/m);
+  });
+
+  it('falls back to the gpt-5.5 default when no global model exists (D31)', () => {
+    fs.rmSync(path.join(fakeHome, '.codex', 'config.toml'), { force: true });
+
+    const content = renderCodexProjectConfig('');
+
+    assert.match(content, /^model = "gpt-5\.5"$/m);
+  });
 
   it('replaces baize-owned notice sections exactly without touching dotted siblings', () => {
     const existing = [

package/cli/lib/runtime-setup.js

@@ -347,6 +347,21 @@ function isTomlSectionValue(value) {
   return value && typeof value === 'object' && !Array.isArray(value);
 }
 
+/**
+ * Read the user's global Codex model (~/.codex/config.toml `model`), if any.
+ * Used so project-level config backfill inherits the user's provider model
+ * instead of shadowing it with a hard-coded default (D31).
+ */
+function readGlobalCodexModel(homeDir = os.homedir()) {
+  try {
+    const globalPath = path.join(homeDir, '.codex', 'config.toml');
+    const parsed = parseCodexToml(fs.readFileSync(globalPath, 'utf8'));
+    return typeof parsed.model === 'string' && parsed.model ? parsed.model : null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Render project-level .codex/config.toml with headless configuration.
  *
@@ -359,15 +374,19 @@ function isTomlSectionValue(value) {
  * @param {string} existingContent - Existing project config.toml contents (optional)
  * @returns {string}
  */
-export function renderCodexProjectConfig(existingContent = '') {
+export function renderCodexProjectConfig(existingContent = '', opts = {}) {
   const obj = parseCodexToml(existingContent);
 
   // Always overwrite: these values are required for unattended Baize runtime behavior.
   obj.check_for_update_on_startup = false;
   obj.model_availability_nux = 'gpt-5.4';
 
-  // Backfill: default only when the user has not configured a value.
-  if (obj.model === undefined) obj.model = 'gpt-5.5';
+  // Backfill: default only when the user has not configured a value. Inherit
+  // the global codex model when present (web-console provider activation writes
+  // it there) — a hard-coded default would shadow the user's provider model.
+  if (obj.model === undefined) {
+    obj.model = readGlobalCodexModel(opts.homeDir) || 'gpt-5.5';
+  }
   if (obj.model_reasoning_effort === undefined) obj.model_reasoning_effort = 'medium';
 
   obj.features = isTomlSectionValue(obj.features) ? obj.features : {};

package/cli/lib/self-upgrade.js

@@ -9,9 +9,9 @@ import path from 'node:path';
 import os from 'node:os';
 import { execSync, spawnSync } from 'node:child_process';
 import { SKILLS_DIR, BAIZE_DIR, getBaizeConfig } from './config.js';
-import { downloadArchive, downloadBranch } from './download.js';
+import { downloadBranch } from './download.js';
 import { generateManifest, saveMergeBaseline } from './manifest.js';
-import { fetchRawFile, fetchLatestTag, compareSemverDesc, sanitizeError } from './github.js';
+import { fetchRawFile, compareSemverDesc, sanitizeError } from './github.js';
 import { copyTree, syncTree } from './fs-utils.js';
 import { getCommandHooks, hookScriptKey } from './hook-utils.js';
 import { isCoreManaged } from './sync-settings-hooks.js';
@@ -67,15 +67,43 @@ function getLatestVersion({ branch, beta = false } = {}) {
     }
   }
 
-  // Default: tag-based detection (unified with component upgrades)
+  // Default: npm registry — follows the user's npm config (npmmirror in CN),
+  // which GitHub-based tag detection cannot reach reliably (D31).
   try {
-    const tagVersion = fetchLatestTag(REPO, { includePrerelease: beta });
-    if (tagVersion) {
-      return { success: true, version: tagVersion };
+    // Strict semver anchor (never interpolate unvalidated registry output into
+    // a shell command or semver comparison).
+    const SEMVER_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+    if (beta) {
+      // Prerelease channel: prefer the highest non-latest dist-tag, falling
+      // back to the highest prerelease in the full versions list.
+      const tagsOut = execSync('npm view @baize-ai/core dist-tags --json', {
+        encoding: 'utf8', timeout: 20000, stdio: 'pipe',
+      });
+      const tags = JSON.parse(tagsOut);
+      const prereleaseTags = Object.entries(tags)
+        .filter(([tag, v]) => tag !== 'latest' && typeof v === 'string' && SEMVER_RE.test(v) && v.includes('-'))
+        .map(([, v]) => v);
+      if (prereleaseTags.length > 0) {
+        return { success: true, version: prereleaseTags.sort(compareSemverDesc)[0] };
+      }
+      const versionsOut = execSync('npm view @baize-ai/core versions --json', {
+        encoding: 'utf8', timeout: 20000, stdio: 'pipe',
+      });
+      const prereleases = JSON.parse(versionsOut)
+        .filter((v) => typeof v === 'string' && SEMVER_RE.test(v) && v.includes('-'));
+      if (prereleases.length === 0) {
+        return { success: false, error: 'No prerelease versions found in npm registry' };
+      }
+      return { success: true, version: prereleases.sort(compareSemverDesc)[0] };
+    }
+    const out = execSync('npm view @baize-ai/core version', { encoding: 'utf8', timeout: 20000, stdio: 'pipe' });
+    const version = out.trim();
+    if (!SEMVER_RE.test(version)) {
+      return { success: false, error: `Unexpected npm version output: ${version}` };
     }
-    return { success: false, error: 'No release tags found' };
+    return { success: true, version };
   } catch (err) {
-    return { success: false, error: `Cannot fetch latest version: ${sanitizeError(err.message)}` };
+    return { success: false, error: `Cannot fetch latest version from npm registry: ${sanitizeError(err.message)}` };
   }
 }
 
@@ -150,17 +178,25 @@ export function downloadCoreToTemp(version, branch) {
     return { success: true, tempDir };
   }
 
-  const result = downloadArchive(REPO, version, tempDir);
-  if (!result.success) {
-    // Fallback: try downloading main branch (for pre-release versions without tags)
-    const branchResult = downloadBranch(REPO, 'main', tempDir);
-    if (!branchResult.success) {
-      fs.rmSync(tempDir, { recursive: true, force: true });
-      return { success: false, error: result.error };
+  // Default: npm registry tarball (npm pack), extracted to the temp root so
+  // downstream steps see the source-tree layout (package.json at root).
+  try {
+    execSync(`npm pack @baize-ai/core@${version} --pack-destination "${tempDir}"`, {
+      encoding: 'utf8', timeout: 120000, stdio: 'pipe',
+    });
+    const tgz = fs.readdirSync(tempDir).find((f) => f.endsWith('.tgz'));
+    if (!tgz) throw new Error('npm pack produced no tarball');
+    execSync(`tar -xzf "${path.join(tempDir, tgz)}" -C "${tempDir}"`, { stdio: 'pipe' });
+    const pkgDir = path.join(tempDir, 'package');
+    for (const entry of fs.readdirSync(pkgDir)) {
+      fs.renameSync(path.join(pkgDir, entry), path.join(tempDir, entry));
     }
+    fs.rmSync(pkgDir, { recursive: true, force: true });
+    return { success: true, tempDir };
+  } catch (err) {
+    fs.rmSync(tempDir, { recursive: true, force: true });
+    return { success: false, error: `npm registry download failed: ${sanitizeError(err.message)}` };
   }
-
-  return { success: true, tempDir };
 }
 
 // ---------------------------------------------------------------------------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@baize-ai/core",
-  "version": "0.3.5",
+  "version": "0.3.7",
   "type": "module",
   "description": "Baize (\u767d\u6cfd) \u2014 autonomous AI agent infrastructure",
   "main": "cli/baize.js",

package/skills/web-console/public/app.js

@@ -2297,6 +2297,62 @@ async function submitA2aTaskForm(basePath) {
   }
 }
 
+/** Diagnostics: service/session/auth/errors rendered from /api/admin/diagnostics. */
+async function renderDiagnostics(basePath) {
+  const runtimeEl = document.getElementById('diag-runtime');
+  const servicesEl = document.getElementById('diag-services');
+  const sessionsEl = document.getElementById('diag-sessions');
+  const errorsEl = document.getElementById('diag-errors');
+  const stateEl = document.getElementById('diag-runtime-state');
+  if (!servicesEl) return;
+  runtimeEl.textContent = '加载中...';
+  let body;
+  try {
+    const r = await adminFetch(basePath, '/api/admin/diagnostics');
+    if (r.status !== 200) throw new Error(r.body?.error || '加载失败');
+    body = r.body;
+  } catch (err) {
+    runtimeEl.textContent = `加载失败：${escapeHtml(err.message)}`;
+    return;
+  }
+  const rt = body.runtime || {};
+  if (stateEl) stateEl.textContent = `runtime: ${escapeHtml(rt.runtime || '?')}`;
+  // runtime + auth
+  const auth = body.auth || {};
+  const authLine = [];
+  if (auth.claude?.configured) authLine.push(`Claude: ${escapeHtml(auth.claude.method)} (${escapeHtml(auth.claude.masked || '')})`);
+  else authLine.push('Claude: 未配置');
+  if (auth.codex?.configured) authLine.push(`Codex: ${escapeHtml(auth.codex.method)} (${escapeHtml(auth.codex.masked || '')})`);
+  else authLine.push('Codex: 未配置');
+  runtimeEl.innerHTML = `<strong>${escapeHtml(rt.runtime || 'claude')}</strong> · ${authLine.join(' · ')}`;
+  // services
+  const svcs = body.services || [];
+  if (!svcs.length) {
+    servicesEl.textContent = 'PM2 未运行或无服务（容器/服务未启动）';
+  } else {
+    servicesEl.innerHTML = '<table class="tasks-table"><thead><tr><th>服务</th><th>状态</th><th>重启</th><th>运行</th></tr></thead><tbody>'
+      + svcs.map((s) => `<tr><td>${escapeHtml(s.name)}</td><td><span class="channel-state ${s.status === 'online' ? 'ok' : 'warn'}">${escapeHtml(s.status)}</span></td><td>${s.restarts}</td><td>${s.uptime != null ? Math.round(s.uptime / 60) + 'm' : '—'}</td></tr>`).join('')
+      + '</tbody></table>';
+  }
+  // sessions
+  const sessions = body.sessions || [];
+  if (!sessions.length) {
+    sessionsEl.innerHTML = '<span class="cred-state">无 agent 会话（tmux 未运行或未拉起）</span>';
+  } else {
+    sessionsEl.innerHTML = sessions.map((s) => {
+      const stuck = /(sign in|login|authenticate)/i.test(s.tail || '') ? '<span class="channel-state warn">⚠ 可能卡在登录</span>' : '<span class="channel-state ok">运行中</span>';
+      return `<div style="margin-bottom:8px"><strong>${escapeHtml(s.name)}</strong> ${stuck}<pre style="font-size:12px;background:var(--bg-2,#1a1a1a);padding:8px;border-radius:6px;white-space:pre-wrap">${escapeHtml(s.tail || '（空）')}</pre></div>`;
+    }).join('');
+  }
+  // errors
+  const errors = body.errors || [];
+  if (!errors.length) {
+    errorsEl.textContent = '无错误日志';
+  } else {
+    errorsEl.innerHTML = errors.map((e) => `<div style="margin-bottom:8px"><strong>${escapeHtml(e.service)}</strong><pre style="font-size:12px;background:var(--bg-2,#1a1a1a);padding:8px;border-radius:6px;white-space:pre-wrap;color:var(--danger,#e5534b)">${escapeHtml(e.tail)}</pre></div>`).join('');
+  }
+}
+
 function showAppView(basePath, view) {
   const chatView = document.getElementById('chat-view');
   const modelView = document.getElementById('model-view');
@@ -2323,6 +2379,7 @@ function showAppView(basePath, view) {
     a2aView.hidden = true;
     schedulerView.hidden = true;
     modelView.hidden = false;
+    renderDiagnostics(basePath);
     setNav(navModel, [navChat, navChannels, navA2a, navScheduler]);
     renderModelSettings(basePath);
   } else if (view === 'channels') {
@@ -2518,6 +2575,7 @@ function initViews(basePath) {
   document.getElementById('nav-channels').addEventListener('click', () => showAppView(basePath, 'channels'));
   document.getElementById('nav-a2a').addEventListener('click', () => showAppView(basePath, 'a2a'));
   document.getElementById('nav-scheduler').addEventListener('click', () => showAppView(basePath, 'scheduler'));
+  document.getElementById('btn-diag-refresh').addEventListener('click', () => renderDiagnostics(basePath));
 
   // D8 two-column layout: Claude official = setup-token form; custom API =
   // per-column quick forms. The standalone api-key forms were removed.

package/skills/web-console/public/index.html

@@ -231,6 +231,28 @@
           </div>
         </section>
       </div>
+        <section class="settings-section">
+          <div class="settings-section-head">
+            <h2>诊断</h2>
+            <p>服务 / 会话 / 认证 / 最近错误——浏览器内排查，无需 SSH。</p>
+          </div>
+          <div class="settings-card">
+            <div class="card-title">运行时与认证 <span class="channel-state" id="diag-runtime-state"></span></div>
+            <div class="cred-state" id="diag-runtime" aria-live="polite">加载中...</div>
+          </div>
+          <div class="settings-card">
+            <div class="card-title">服务状态 <button type="button" class="small-btn" id="btn-diag-refresh">刷新</button></div>
+            <div class="cred-state" id="diag-services" aria-live="polite">加载中...</div>
+          </div>
+          <div class="settings-card">
+            <div class="card-title">Agent 会话</div>
+            <div class="cred-state" id="diag-sessions" aria-live="polite">加载中...</div>
+          </div>
+          <div class="settings-card">
+            <div class="card-title">最近错误</div>
+            <div class="cred-state" id="diag-errors" aria-live="polite">加载中...</div>
+          </div>
+        </section>
     </main>
 
     <main class="settings-view" id="channels-view" hidden>

package/skills/web-console/scripts/diagnostics.js

@@ -0,0 +1,141 @@
+/**
+ * Diagnostics for the web console (D26): aggregate service/session/runtime
+ * state so operators can troubleshoot from the browser without SSH.
+ *
+ * readDiagnostics() returns:
+ *   services[]   — PM2 processes (name, status, restarts, uptime)
+ *   sessions[]   — tmux agent sessions (name, exists, last pane lines)
+ *   runtime      — active runtime (claude/codex) + CLI presence
+ *   auth         — claude/codex credential state (masked, never echoed)
+ *   errors       — tail of each service error log (last lines)
+ */
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+
+const execFileAsync = promisify(execFile);
+
+function baizeDir() {
+  return process.env.BAIZE_DIR || path.join(os.homedir(), 'baize');
+}
+
+function readJsonSafe(file) {
+  try {
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function maskSecret(secret) {
+  if (!secret || typeof secret !== 'string') return null;
+  if (secret.length <= 8) return '****';
+  return `${secret.slice(0, 4)}••••${secret.slice(-4)}`;
+}
+
+/** PM2 process table via `pm2 jlist` (tolerant when pm2 is absent). */
+async function readServices() {
+  try {
+    const { stdout } = await execFileAsync('pm2', ['jlist'], { timeout: 8000, maxBuffer: 4 * 1024 * 1024 });
+    const list = JSON.parse(stdout);
+    return list.map((p) => ({
+      name: p.name,
+      status: p.pm2_env?.status || 'unknown',
+      restarts: p.pm2_env?.restart_time ?? 0,
+      uptime: p.pm2_env?.pm_uptime ? Math.round((Date.now() - p.pm2_env.pm_uptime) / 1000) : null,
+      cpu: p.monit?.cpu ?? null,
+      memory: p.monit?.memory ?? null,
+    }));
+  } catch {
+    return [];
+  }
+}
+
+/** tmux agent sessions: existence + last pane lines (for stuck-login detection). */
+async function readSessions() {
+  const sessions = [];
+  try {
+    const { stdout } = await execFileAsync('tmux', ['ls'], { timeout: 5000 });
+    const names = stdout.split('\n').map((l) => l.split(':')[0]).filter(Boolean);
+    for (const name of names) {
+      if (!/(main|agent)/.test(name)) continue;
+      let tail = '';
+      try {
+        const pane = await execFileAsync('tmux', ['capture-pane', '-t', name, '-p', '-S', '-12'], { timeout: 5000 });
+        tail = pane.stdout.split('\n').filter((l) => l.trim()).slice(-8).join('\n').slice(0, 600);
+      } catch { /* pane read failed */ }
+      sessions.push({ name, tail });
+    }
+  } catch {
+    /* no tmux or no sessions */
+  }
+  return sessions;
+}
+
+/** Active runtime from ~/baize/.baize/config.json. */
+function readRuntime() {
+  const cfg = readJsonSafe(path.join(baizeDir(), '.baize', 'config.json')) || {};
+  return { runtime: cfg.runtime || 'claude', configPresent: !!cfg };
+}
+
+/** Credential state (masked). Never echoes secrets. */
+function readAuth() {
+  const out = { claude: { configured: false, method: null, masked: null }, codex: { configured: false, method: null, masked: null } };
+  // Claude: ~/.claude/settings.json (ANTHROPIC_API_KEY) or env
+  try {
+    const settings = readJsonSafe(path.join(os.homedir(), '.claude', 'settings.json')) || {};
+    const key = settings.env?.ANTHROPIC_API_KEY || process.env.ANTHROPIC_API_KEY;
+    if (key) { out.claude.configured = true; out.claude.method = 'api-key'; out.claude.masked = maskSecret(key); }
+  } catch { /* ignore */ }
+  // Codex: ~/.codex/auth.json (auth_mode apikey/chatgpt)
+  const codexAuth = readJsonSafe(path.join(os.homedir(), '.codex', 'auth.json'));
+  if (codexAuth) {
+    if (codexAuth.auth_mode === 'apikey' && codexAuth.OPENAI_API_KEY) {
+      out.codex.configured = true; out.codex.method = 'api-key'; out.codex.masked = maskSecret(codexAuth.OPENAI_API_KEY);
+    } else if (codexAuth.tokens?.access_token) {
+      out.codex.configured = true; out.codex.method = 'chatgpt-oauth';
+    }
+  }
+  const envKey = process.env.OPENAI_API_KEY;
+  if (envKey && !out.codex.configured) { out.codex.configured = true; out.codex.method = 'env'; out.codex.masked = maskSecret(envKey); }
+  return out;
+}
+
+/** Tail of each service error log under ~/.pm2/logs/. */
+function readErrors() {
+  const logsDir = path.join(os.homedir(), '.pm2', 'logs');
+  const errors = [];
+  try {
+    for (const file of fs.readdirSync(logsDir)) {
+      if (!/error.*\.log$/.test(file)) continue;
+      const full = path.join(logsDir, file);
+      try {
+        const size = fs.statSync(full).size;
+        const fd = fs.openSync(full, 'r');
+        const buf = Buffer.alloc(Math.min(size, 3000));
+        fs.readSync(fd, buf, 0, buf.length, Math.max(0, size - buf.length));
+        fs.closeSync(fd);
+        const tail = buf.toString('utf8').split('\n').filter((l) => l.trim()).slice(-6).join('\n');
+        if (tail) errors.push({ service: file.replace(/-(error|out)\.log$/, ''), tail: tail.slice(0, 500) });
+      } catch { /* unreadable log */ }
+    }
+  } catch { /* no logs dir */ }
+  return errors;
+}
+
+/** Full diagnostics payload. */
+export async function readDiagnostics() {
+  const [services, sessions] = await Promise.all([readServices(), readSessions()]);
+  return {
+    success: true,
+    at: new Date().toISOString(),
+    runtime: readRuntime(),
+    services,
+    sessions,
+    auth: readAuth(),
+    errors: readErrors(),
+  };
+}

package/skills/web-console/scripts/model-provider.js

@@ -45,6 +45,13 @@ function claudeSettingsPath() {
 function codexConfigPath() {
   return path.join(process.env.HOME || '', '.codex', 'config.toml');
 }
+// Project-level Codex config — the file codex actually prefers (project-level
+// keys win over global ones). Web activation must write here too, or the
+// project-level defaults baize init backfills (e.g. model = "gpt-5.5") would
+// shadow the user's provider model/base_url (D31).
+function projectCodexConfigPath() {
+  return path.join(process.env.BAIZE_DIR || path.join(process.env.HOME || '', 'baize'), '.codex', 'config.toml');
+}
 
 function loadStore() {
   const data = readJson(providersPath()) || {};
@@ -319,17 +326,17 @@ function applyCodexOfficial() {
 }
 
 /**
- * Conservative top-level edit of ~/.codex/config.toml: set/replace the
+ * Conservative top-level edit of a Codex config.toml: set/replace the
  * `model` and `openai_base_url` keys, preserving every other line (comments,
  * sections, providers). Only the TOP-LEVEL prefix (before the first section
  * header) is touched — keys inside [table] sections are also unindented, so
  * regex edits must never run past the first `[` header.
  */
-export function editCodexConfigToml({ model, openaiBaseUrl }) {
-  const codexDir = path.dirname(codexConfigPath());
-  fs.mkdirSync(codexDir, { recursive: true });
+function writeCodexTomlTopLevel(targetPath, { model, openaiBaseUrl }) {
+  const dir = path.dirname(targetPath);
+  fs.mkdirSync(dir, { recursive: true });
   let content = '';
-  try { content = fs.readFileSync(codexConfigPath(), 'utf8'); } catch { /* new file */ }
+  try { content = fs.readFileSync(targetPath, 'utf8'); } catch { /* new file */ }
 
   const sectionAt = content.search(/^\[/m);
   const head = sectionAt === -1 ? content : content.slice(0, sectionAt);
@@ -348,7 +355,19 @@ export function editCodexConfigToml({ model, openaiBaseUrl }) {
   if (openaiBaseUrl) out = setTopLevel(out, 'openai_base_url', openaiBaseUrl);
   if (openaiBaseUrl === null) out = removeTopLevel(out, 'openai_base_url');
   const joined = tail && !out.endsWith('\n') ? `${out}\n${tail}` : `${out}${tail}`;
-  fs.writeFileSync(codexConfigPath(), joined, 'utf8');
+  fs.writeFileSync(targetPath, joined, 'utf8');
+  return targetPath;
+}
+
+/**
+ * Apply a provider's Codex model/base_url to BOTH the global config.toml and
+ * the baize project-level config.toml. codex prefers project-level keys, so
+ * writing only the global file let baize init's backfilled defaults (model =
+ * "gpt-5.5") shadow the provider config (D31).
+ */
+export function editCodexConfigToml({ model, openaiBaseUrl }) {
+  writeCodexTomlTopLevel(codexConfigPath(), { model, openaiBaseUrl });
+  writeCodexTomlTopLevel(projectCodexConfigPath(), { model, openaiBaseUrl });
   return codexConfigPath();
 }
 

package/skills/web-console/scripts/server.js

@@ -77,6 +77,7 @@ import {
   getSchedulerTasks,
 } from './a2a-admin.js';
 import { listInstalledSkills } from './skill-catalog.js';
+import { readDiagnostics } from './diagnostics.js';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -825,6 +826,14 @@ app.post('/api/admin/codex-key', async (req, res) => {
   }
 });
 
+app.get('/api/admin/diagnostics', async (req, res) => {
+  try {
+    res.json(await readDiagnostics());
+  } catch (err) {
+    jsonError(res, err);
+  }
+});
+
 app.post('/api/admin/runtime', async (req, res) => {
   try {
     const result = await switchRuntime(req.body?.runtime);