@baize-ai/core 0.3.6 → 0.3.7

package/CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to baize-core will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.7] - 2026-08-26
+
+### Fixed
+- Codex 配置链路（D31）：web 控制台激活供应商现在同时写全局与项目级 `config.toml`（model + openai_base_url）——此前只写全局，baize init 回填的项目级默认 `gpt-5.5` 会压制用户配置（codex 键级合并，项目级优先）→ 大陆 DeepSeek 场景会话秒退
+- `baize init` 的项目级 codex config 回填改为继承全局 model（无全局时才用 gpt-5.5 兜底）——升级不再覆盖用户配置
+- `baize upgrade --self` 改为 npm registry 路径（`npm view` / `npm pack`，跟随用户 registry——大陆 npmmirror 可达）；`--beta` 保留预发布通道（dist-tags/versions 选最高 prerelease）；npm 返回值严格 semver 校验
+
 ## [0.3.6] - 2026-08-26
 
 ### Added

package/cli/lib/__tests__/runtime-setup.test.js

@@ -93,6 +93,27 @@ describe('renderCodexProjectConfig', () => {
     assert.doesNotMatch(content, /^model = "gpt-5\.5"$/m);
     assert.doesNotMatch(content, /^model_reasoning_effort = "medium"$/m);
   });
+  it('backfills the global codex model when the project config has none (D31)', () => {
+    fs.mkdirSync(path.join(fakeHome, '.codex'), { recursive: true });
+    fs.writeFileSync(
+      path.join(fakeHome, '.codex', 'config.toml'),
+      'model = "deepseek-v4-flash"\nopenai_base_url = "https://api.deepseek.com"\n',
+      'utf8',
+    );
+
+    const content = renderCodexProjectConfig('');
+
+    assert.match(content, /^model = "deepseek-v4-flash"$/m);
+    assert.doesNotMatch(content, /^model = "gpt-5\.5"$/m);
+  });
+
+  it('falls back to the gpt-5.5 default when no global model exists (D31)', () => {
+    fs.rmSync(path.join(fakeHome, '.codex', 'config.toml'), { force: true });
+
+    const content = renderCodexProjectConfig('');
+
+    assert.match(content, /^model = "gpt-5\.5"$/m);
+  });
 
   it('replaces baize-owned notice sections exactly without touching dotted siblings', () => {
     const existing = [

package/cli/lib/runtime-setup.js

@@ -347,6 +347,21 @@ function isTomlSectionValue(value) {
   return value && typeof value === 'object' && !Array.isArray(value);
 }
 
+/**
+ * Read the user's global Codex model (~/.codex/config.toml `model`), if any.
+ * Used so project-level config backfill inherits the user's provider model
+ * instead of shadowing it with a hard-coded default (D31).
+ */
+function readGlobalCodexModel(homeDir = os.homedir()) {
+  try {
+    const globalPath = path.join(homeDir, '.codex', 'config.toml');
+    const parsed = parseCodexToml(fs.readFileSync(globalPath, 'utf8'));
+    return typeof parsed.model === 'string' && parsed.model ? parsed.model : null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Render project-level .codex/config.toml with headless configuration.
  *
@@ -359,15 +374,19 @@ function isTomlSectionValue(value) {
  * @param {string} existingContent - Existing project config.toml contents (optional)
  * @returns {string}
  */
-export function renderCodexProjectConfig(existingContent = '') {
+export function renderCodexProjectConfig(existingContent = '', opts = {}) {
   const obj = parseCodexToml(existingContent);
 
   // Always overwrite: these values are required for unattended Baize runtime behavior.
   obj.check_for_update_on_startup = false;
   obj.model_availability_nux = 'gpt-5.4';
 
-  // Backfill: default only when the user has not configured a value.
-  if (obj.model === undefined) obj.model = 'gpt-5.5';
+  // Backfill: default only when the user has not configured a value. Inherit
+  // the global codex model when present (web-console provider activation writes
+  // it there) — a hard-coded default would shadow the user's provider model.
+  if (obj.model === undefined) {
+    obj.model = readGlobalCodexModel(opts.homeDir) || 'gpt-5.5';
+  }
   if (obj.model_reasoning_effort === undefined) obj.model_reasoning_effort = 'medium';
 
   obj.features = isTomlSectionValue(obj.features) ? obj.features : {};

package/cli/lib/self-upgrade.js

@@ -9,9 +9,9 @@ import path from 'node:path';
 import os from 'node:os';
 import { execSync, spawnSync } from 'node:child_process';
 import { SKILLS_DIR, BAIZE_DIR, getBaizeConfig } from './config.js';
-import { downloadArchive, downloadBranch } from './download.js';
+import { downloadBranch } from './download.js';
 import { generateManifest, saveMergeBaseline } from './manifest.js';
-import { fetchRawFile, fetchLatestTag, compareSemverDesc, sanitizeError } from './github.js';
+import { fetchRawFile, compareSemverDesc, sanitizeError } from './github.js';
 import { copyTree, syncTree } from './fs-utils.js';
 import { getCommandHooks, hookScriptKey } from './hook-utils.js';
 import { isCoreManaged } from './sync-settings-hooks.js';
@@ -67,15 +67,43 @@ function getLatestVersion({ branch, beta = false } = {}) {
     }
   }
 
-  // Default: tag-based detection (unified with component upgrades)
+  // Default: npm registry — follows the user's npm config (npmmirror in CN),
+  // which GitHub-based tag detection cannot reach reliably (D31).
   try {
-    const tagVersion = fetchLatestTag(REPO, { includePrerelease: beta });
-    if (tagVersion) {
-      return { success: true, version: tagVersion };
+    // Strict semver anchor (never interpolate unvalidated registry output into
+    // a shell command or semver comparison).
+    const SEMVER_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+    if (beta) {
+      // Prerelease channel: prefer the highest non-latest dist-tag, falling
+      // back to the highest prerelease in the full versions list.
+      const tagsOut = execSync('npm view @baize-ai/core dist-tags --json', {
+        encoding: 'utf8', timeout: 20000, stdio: 'pipe',
+      });
+      const tags = JSON.parse(tagsOut);
+      const prereleaseTags = Object.entries(tags)
+        .filter(([tag, v]) => tag !== 'latest' && typeof v === 'string' && SEMVER_RE.test(v) && v.includes('-'))
+        .map(([, v]) => v);
+      if (prereleaseTags.length > 0) {
+        return { success: true, version: prereleaseTags.sort(compareSemverDesc)[0] };
+      }
+      const versionsOut = execSync('npm view @baize-ai/core versions --json', {
+        encoding: 'utf8', timeout: 20000, stdio: 'pipe',
+      });
+      const prereleases = JSON.parse(versionsOut)
+        .filter((v) => typeof v === 'string' && SEMVER_RE.test(v) && v.includes('-'));
+      if (prereleases.length === 0) {
+        return { success: false, error: 'No prerelease versions found in npm registry' };
+      }
+      return { success: true, version: prereleases.sort(compareSemverDesc)[0] };
+    }
+    const out = execSync('npm view @baize-ai/core version', { encoding: 'utf8', timeout: 20000, stdio: 'pipe' });
+    const version = out.trim();
+    if (!SEMVER_RE.test(version)) {
+      return { success: false, error: `Unexpected npm version output: ${version}` };
     }
-    return { success: false, error: 'No release tags found' };
+    return { success: true, version };
   } catch (err) {
-    return { success: false, error: `Cannot fetch latest version: ${sanitizeError(err.message)}` };
+    return { success: false, error: `Cannot fetch latest version from npm registry: ${sanitizeError(err.message)}` };
   }
 }
 
@@ -150,17 +178,25 @@ export function downloadCoreToTemp(version, branch) {
     return { success: true, tempDir };
   }
 
-  const result = downloadArchive(REPO, version, tempDir);
-  if (!result.success) {
-    // Fallback: try downloading main branch (for pre-release versions without tags)
-    const branchResult = downloadBranch(REPO, 'main', tempDir);
-    if (!branchResult.success) {
-      fs.rmSync(tempDir, { recursive: true, force: true });
-      return { success: false, error: result.error };
+  // Default: npm registry tarball (npm pack), extracted to the temp root so
+  // downstream steps see the source-tree layout (package.json at root).
+  try {
+    execSync(`npm pack @baize-ai/core@${version} --pack-destination "${tempDir}"`, {
+      encoding: 'utf8', timeout: 120000, stdio: 'pipe',
+    });
+    const tgz = fs.readdirSync(tempDir).find((f) => f.endsWith('.tgz'));
+    if (!tgz) throw new Error('npm pack produced no tarball');
+    execSync(`tar -xzf "${path.join(tempDir, tgz)}" -C "${tempDir}"`, { stdio: 'pipe' });
+    const pkgDir = path.join(tempDir, 'package');
+    for (const entry of fs.readdirSync(pkgDir)) {
+      fs.renameSync(path.join(pkgDir, entry), path.join(tempDir, entry));
     }
+    fs.rmSync(pkgDir, { recursive: true, force: true });
+    return { success: true, tempDir };
+  } catch (err) {
+    fs.rmSync(tempDir, { recursive: true, force: true });
+    return { success: false, error: `npm registry download failed: ${sanitizeError(err.message)}` };
   }
-
-  return { success: true, tempDir };
 }
 
 // ---------------------------------------------------------------------------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@baize-ai/core",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "type": "module",
   "description": "Baize (\u767d\u6cfd) \u2014 autonomous AI agent infrastructure",
   "main": "cli/baize.js",

package/skills/web-console/scripts/model-provider.js

@@ -45,6 +45,13 @@ function claudeSettingsPath() {
 function codexConfigPath() {
   return path.join(process.env.HOME || '', '.codex', 'config.toml');
 }
+// Project-level Codex config — the file codex actually prefers (project-level
+// keys win over global ones). Web activation must write here too, or the
+// project-level defaults baize init backfills (e.g. model = "gpt-5.5") would
+// shadow the user's provider model/base_url (D31).
+function projectCodexConfigPath() {
+  return path.join(process.env.BAIZE_DIR || path.join(process.env.HOME || '', 'baize'), '.codex', 'config.toml');
+}
 
 function loadStore() {
   const data = readJson(providersPath()) || {};
@@ -319,17 +326,17 @@ function applyCodexOfficial() {
 }
 
 /**
- * Conservative top-level edit of ~/.codex/config.toml: set/replace the
+ * Conservative top-level edit of a Codex config.toml: set/replace the
  * `model` and `openai_base_url` keys, preserving every other line (comments,
  * sections, providers). Only the TOP-LEVEL prefix (before the first section
  * header) is touched — keys inside [table] sections are also unindented, so
  * regex edits must never run past the first `[` header.
  */
-export function editCodexConfigToml({ model, openaiBaseUrl }) {
-  const codexDir = path.dirname(codexConfigPath());
-  fs.mkdirSync(codexDir, { recursive: true });
+function writeCodexTomlTopLevel(targetPath, { model, openaiBaseUrl }) {
+  const dir = path.dirname(targetPath);
+  fs.mkdirSync(dir, { recursive: true });
   let content = '';
-  try { content = fs.readFileSync(codexConfigPath(), 'utf8'); } catch { /* new file */ }
+  try { content = fs.readFileSync(targetPath, 'utf8'); } catch { /* new file */ }
 
   const sectionAt = content.search(/^\[/m);
   const head = sectionAt === -1 ? content : content.slice(0, sectionAt);
@@ -348,7 +355,19 @@ export function editCodexConfigToml({ model, openaiBaseUrl }) {
   if (openaiBaseUrl) out = setTopLevel(out, 'openai_base_url', openaiBaseUrl);
   if (openaiBaseUrl === null) out = removeTopLevel(out, 'openai_base_url');
   const joined = tail && !out.endsWith('\n') ? `${out}\n${tail}` : `${out}${tail}`;
-  fs.writeFileSync(codexConfigPath(), joined, 'utf8');
+  fs.writeFileSync(targetPath, joined, 'utf8');
+  return targetPath;
+}
+
+/**
+ * Apply a provider's Codex model/base_url to BOTH the global config.toml and
+ * the baize project-level config.toml. codex prefers project-level keys, so
+ * writing only the global file let baize init's backfilled defaults (model =
+ * "gpt-5.5") shadow the provider config (D31).
+ */
+export function editCodexConfigToml({ model, openaiBaseUrl }) {
+  writeCodexTomlTopLevel(codexConfigPath(), { model, openaiBaseUrl });
+  writeCodexTomlTopLevel(projectCodexConfigPath(), { model, openaiBaseUrl });
   return codexConfigPath();
 }