@zhin.js/adapter-sandbox 5.0.6 → 6.0.1

package/CHANGELOG.md

@@ -1,5 +1,57 @@
 # @zhin.js/adapter-process
 
+## 6.0.1
+
+### Patch Changes
+
+- 5691aba: 第二轮全量审计修复批（8 面 ~60 bug）：
+
+  - **安全**：email 附件路径穿越修复（basename + downloadPath 约束）；lark/telegram/satori webhook 鉴权（缺密钥告警、timingSafeEqual、±5min 时效窗、chat_type 修正）；onebot wss/webhook 缺 token 告警；qq webhook 改原始字节验签；renderJsx/JSX 转义注入修复；console runtime token 401 死循环。
+  - **P0 功能**：sandbox 多 endpoint 解析 + WS 路径隔离；short-url expand（undici opaqueredirect）改 follow；AI 压缩摘要失败不再静默丢历史（熔断恢复生效）；console-ui 实时推送事件名归一化 + IndexedDB schema 对齐；process-monitor 热重载不再误判崩溃。
+  - **生命周期**：email IMAP 断线重连 + 在飞锁；onebot11/12 start 失败清理；line replyToken TTL + push 兜底；wechat-mp token 过期重试 + MsgId 去重；weixin-ilink buf 推进/防抖写盘/媒体 TTL/QR abort；satori PONG 看门狗；退避自毁修复。
+  - **游戏**：text-adventure 终局 restart 复活 + requires 服务端校验；tic-tac-toe PvP 占用/restart/队列清理/TTL；idiom-chain/word-riddle 闲聊不扣失误；别名中间件不劫持普通聊天。
+  - **共享库**：schema falsy 默认值/date/tuple/union 修复；database parseCondition Date/未知操作符、sqlite TEXT 往返、query 分派、belongsToMany 方言、migration dry-run；schedule DST 回拨死循环、重复 id 去重、flush 串行化；game-kit fallback 编号/onboarding 提示/尾缀边界/活引用拷贝。
+  - **渲染语音**：fetch 全部超时 + 渲染并发闸；sanitizeHtml form 保文本；STT 扩展名映射 + 删临时文件；TTS 未知 provider 报错；emojiCache LRU 负缓存/fontCache style/clearFonts 恢复；register 错误分类收窄。
+
+- Updated dependencies [cdf64e7]
+- Updated dependencies [2d0a159]
+- Updated dependencies [5691aba]
+- Updated dependencies [078e3f7]
+- Updated dependencies [9c997b2]
+- Updated dependencies [09d4f25]
+- Updated dependencies [f0ec5ab]
+- Updated dependencies [fa66c4c]
+- Updated dependencies [fa66c4c]
+- Updated dependencies [6cb6152]
+  - @zhin.js/plugin-runtime@1.1.1
+  - @zhin.js/host-http@1.0.3
+  - @zhin.js/client@2.1.1
+  - @zhin.js/adapter@1.1.1
+  - @zhin.js/core@1.4.1
+  - @zhin.js/page@1.0.3
+
+## 6.0.0
+
+### Patch Changes
+
+- 7db69c1: 命令前缀改为适配器配置项：`MessageDispatcher` 不再硬编码 `/`，默认按消息所属适配器实例 config 的 `commandPrefix` 解析（默认 `''` 无前缀，任意文本按命令匹配），`endpoints[i].commandPrefix` 逐项覆盖；`ImRuntime({ commandPrefix })` 仍可设全局静态前缀。全部 20 个平台适配器 schema 新增 `commandPrefix` 属性。
+
+  BREAKING（行为变化）：未配置时命令不再需要 `/` 前缀——原 `/zt` 写法不再命中，直接发 `zt` 即可；需要斜杠风格的适配器请在配置里显式设 `commandPrefix: '/'`。
+
+- 713445c: 适配器配置格式定稿（不兼容旧格式）：`plugins.<adapter>` 顶层仅共享字段 + `commandPrefix`，`endpoints[i]` 携带 endpoint 级字段（`name` + 凭据，各 schema 已类型化），`endpoints` 为必填（icqq 另需顶层 `master`）；icqq 新增 `trusted` 列表（顶层/逐项均可）。scaffold-wizard 全部字段式与自定义 configure() 产出改为新格式，examples（full-bot / qq-games-bot）与 20 个适配器 README 同步迁移。
+- Updated dependencies [7db69c1]
+- Updated dependencies [e5c84ed]
+- Updated dependencies [3ea84a0]
+- Updated dependencies [5849336]
+- Updated dependencies [1ddcd70]
+- Updated dependencies [ac9da66]
+  - @zhin.js/core@1.4.0
+  - @zhin.js/adapter@1.1.0
+  - @zhin.js/plugin-runtime@1.1.0
+  - @zhin.js/client@2.1.0
+  - @zhin.js/host-http@1.0.2
+  - @zhin.js/page@1.0.2
+
 ## 5.0.6
 
 ### Patch Changes

package/README.md

@@ -23,43 +23,43 @@ pnpm add @zhin.js/adapter-sandbox
 - `@zhin.js/adapter` — 约定式 `adapters/sandbox.ts`
 - `@zhin.js/host-http` — Root 提供的 `httpHostToken`（WebSocket `/sandbox` + Console HTTP）
 - `@zhin.js/core` — `messageGatewayToken` / ImRuntime 入站出站
-- `@zhin.js/page` + `pages/sandbox.tsx` — ADR 0046 约定页（`definePage`）
+- `@zhin.js/page` + `pages/index.tsx` — ADR 0046 约定页（`definePage`；路由 `/sandbox`）
 
 Root 在 `zhin runtime start` 时装载 `@zhin.js/host-http`、`ConsoleRuntime` 与
 `ClientBuildModuleRuntime`。打开 `http://<host>:<port>/console` 可浏览页面；Sandbox 页
-（路由形如 `/…/p-sandbox`）内置 WebSocket `/sandbox` 聊天壳。
+（路由 `/sandbox`，与 WebSocket `/sandbox` 同 path：GET 开页、Upgrade 走 WS）内置聊天壳。
 
 旧 `client/`（`register(api)` / `pageManager.addEntry`）仅保留给 legacy Host 栈参考，
 **不是** Plugin Runtime 生产入口。
 
-### 旧 Host 栈（`zhin dev` / full-bot）
+### 旧 Host 栈（已删除）
+
+原 legacy 插件包 `@zhin.js/host-router`（HTTP 服务）与 `@zhin.js/host-api`（Host 侧 Console API，`addEntry` 注册 Sandbox 扩展）已删除；`zhin dev` 现由 `@zhin.js/cli` 自动装配 Console/HTTP Host（`@zhin.js/host-http` + `@zhin.js/pagemanager`），无需安装任何 Host 插件。
 
-- `@zhin.js/host-router` — HTTP 服务（提供 Router 和 WebSocket）
-- `@zhin.js/host-api` — Host 侧 Console API（`addEntry` 注册 Sandbox 扩展）
 - `@zhin.js/client` — Remote Console 客户端 SDK（UI 在 zhin-console 仓库）
 
 出站 wire 只做 JSON 封装；旧 `segment-mapper`（canonical segments）归一化上移到 gateway/core 渲染链。
 
 ## 配置
 
-**推荐（与 [minimal-bot](../../../examples/minimal-bot/) 一致）**：`endpoints: []`，在 Remote Console 打开「沙盒」页时经 `/sandbox` WebSocket **自动创建** bot（如 `sandbox-xxxx`），无需在 yaml 里写 `context: sandbox`。
+**推荐（与 [minimal-bot](../../../examples/minimal-bot/) 一致）**：`plugins.sandbox.endpoints: []`，在 Remote Console 打开「沙盒」页时经 `/sandbox` WebSocket **自动创建** bot（如 `sandbox-xxxx`），无需在 yaml 里写 `context: sandbox`。
 
 ```yaml
-# zhin.config.yml
-endpoints: []
-
+# zhin.config.yml（Plugin Runtime）
 plugins:
-  - "@zhin.js/adapter-sandbox"
-  - "@zhin.js/host-router"
-  - "@zhin.js/host-api"
+  sandbox:
+    endpoints: []
 ```
 
 可选：若需在启动时即在 bot 列表显示**固定名称**的离线占位 bot，可显式配置：
 
 ```yaml
-endpoints:
-  - context: sandbox
-    name: sandbox-bot
+plugins:
+  sandbox:
+    endpoints:
+      - name: sandbox-bot
+        context: sandbox
+        owner: sandbox-user
 ```
 
 ## 使用方式

package/adapters/sandbox.ts

@@ -15,6 +15,11 @@ export type { SandboxEndpointOptions } from '../src/endpoint.js';
 
 export default defineAdapter<SandboxAdapterConfig>({
   capabilities: ['inbound', 'outbound'],
+  // Console UI 直接渲染 base64 内联媒体；交互段由 Console 原生承载。
+  segments: {
+    outboundMedia: ['base64'],
+    interactive: 'native',
+  },
   create(context) {
     return new SandboxWsEndpoint({
       id: context.id,

package/lib/endpoint.d.ts

@@ -9,6 +9,10 @@ export interface SandboxEndpointOptions {
     readonly http: HttpHost;
     readonly defaults: ResolvedSandboxBot;
 }
+/**
+ * Sandbox 是本地开发/测试面，无平台社交图谱（好友/群/频道），
+ * 不适用 EndpointManagement 语义端口；本 endpoint 不暴露该端口。
+ */
 export declare class SandboxWsEndpoint implements EndpointInstance {
     #private;
     constructor(options: SandboxEndpointOptions);

package/lib/endpoint.js

@@ -5,10 +5,50 @@ import { randomUUID } from 'node:crypto';
 import { formatCompact, getLogger } from '@zhin.js/logger';
 import { bindSandboxWsSocket, formatSandboxOutbound, parseSandboxWsPayload, whenWsOpen, } from './protocol.js';
 const logger = getLogger('sandbox');
+/**
+ * 多 sandbox endpoint 共用同一个 HttpHost 时，同 path 的所有 WS listener
+ * 都会被回调（入站重复、出站互窜）。按 endpoint 名隔离挂载路径：
+ * 首个占用 `/sandbox`（保持 Console 默认兼容），其余退到 `/sandbox/<name>`。
+ * 认领记录按 HttpHost 隔离，endpoint stop() 时必须 release。
+ */
+const claimedWsPaths = new WeakMap();
+function claimSandboxWsPath(http, name) {
+    let claims = claimedWsPaths.get(http);
+    if (!claims) {
+        claims = new Map();
+        claimedWsPaths.set(http, claims);
+    }
+    const candidates = ['/sandbox', `/sandbox/${encodeURIComponent(name)}`];
+    let path = candidates.find((candidate) => !claims.has(candidate) || claims.get(candidate) === name);
+    if (!path) {
+        let index = 2;
+        path = `/sandbox/${encodeURIComponent(name)}-${index}`;
+        while (claims.has(path)) {
+            index += 1;
+            path = `/sandbox/${encodeURIComponent(name)}-${index}`;
+        }
+    }
+    claims.set(path, name);
+    const claimed = path;
+    const registry = claims;
+    return {
+        path: claimed,
+        release: () => {
+            if (registry.get(claimed) === name)
+                registry.delete(claimed);
+        },
+    };
+}
+/**
+ * Sandbox 是本地开发/测试面，无平台社交图谱（好友/群/频道），
+ * 不适用 EndpointManagement 语义端口；本 endpoint 不暴露该端口。
+ */
 export class SandboxWsEndpoint {
     #options;
     #connections = new Map();
     #wsHandleRelease;
+    #wsPathRelease;
+    #wsPath = '/sandbox';
     #open = false;
     #started = false;
     constructor(options) {
@@ -22,7 +62,11 @@ export class SandboxWsEndpoint {
         if (this.#started)
             return;
         this.#started = true;
-        const handle = this.#options.http.ws('/sandbox');
+        // 多 endpoint 同 path 会被全部回调（入站重复、出站互窜），按名隔离。
+        const claim = claimSandboxWsPath(this.#options.http, this.#options.defaults.name);
+        this.#wsPathRelease = claim.release;
+        this.#wsPath = claim.path;
+        const handle = this.#options.http.ws(claim.path);
         this.#wsHandleRelease = handle.onConnection((connection) => {
             this.#acceptConnection(connection);
         });
@@ -31,7 +75,7 @@ export class SandboxWsEndpoint {
         }
         logger.info(formatCompact({
             op: 'sandbox_ws_mounted',
-            path: '/sandbox',
+            path: claim.path,
             endpoint: this.#options.defaults.name,
         }));
     }
@@ -45,8 +89,19 @@ export class SandboxWsEndpoint {
         this.#open = false;
         this.#wsHandleRelease?.();
         this.#wsHandleRelease = undefined;
-        for (const connection of this.#connections.values())
+        this.#wsPathRelease?.();
+        this.#wsPathRelease = undefined;
+        for (const connection of this.#connections.values()) {
             connection.release();
+            if (!connection.placeholder) {
+                try {
+                    connection.socket.close(1001, 'sandbox endpoint stopped');
+                }
+                catch {
+                    /* already closed */
+                }
+            }
+        }
         this.#connections.clear();
         this.#started = false;
         logger.debug(formatCompact({ op: 'sandbox_stopped' }));
@@ -54,7 +109,9 @@ export class SandboxWsEndpoint {
     send({ target, payload }) {
         if (!this.#open)
             return undefined;
-        const connection = this.#connections.get(target);
+        // Reply target is the connection key (bot name / sandbox-uuid), not private:channelId.
+        const connection = this.#connections.get(target)
+            ?? this.#findLiveConnection();
         if (!connection) {
             logger.debug(formatCompact({ op: 'sandbox_send_miss', target }));
             return undefined;
@@ -63,31 +120,75 @@ export class SandboxWsEndpoint {
             logger.debug(formatCompact({ op: 'sandbox_send_placeholder', target }));
             return undefined;
         }
-        connection.socket.send(formatSandboxOutbound(payload));
-        logger.debug(formatCompact({ op: 'sandbox_send', target }));
+        // Console UI filters by type+id; stamp last inbound channel onto outbound wire.
+        const channel = connection.lastChannel ?? {
+            type: 'private',
+            id: connection.owner,
+        };
+        connection.socket.send(formatSandboxOutbound(payload, {
+            type: channel.type,
+            id: channel.id,
+            bot: this.#options.defaults.name,
+            endpoint: connection.target,
+        }));
+        logger.debug(formatCompact({
+            op: 'sandbox_send',
+            target: connection.target,
+            channelType: channel.type,
+            channelId: channel.id,
+        }));
         return payload;
     }
+    /** Prefer a real (non-placeholder) socket when reply target key is wrong/stale. */
+    #findLiveConnection() {
+        for (const connection of this.#connections.values()) {
+            if (!connection.placeholder)
+                return connection;
+        }
+        return undefined;
+    }
     #acceptConnection(connection) {
         const target = this.#options.defaults.randomNamePerConnection
             ? `sandbox-${randomUUID().slice(0, 8)}`
             : this.#options.defaults.name;
         const owner = this.#options.defaults.owner;
         const socket = connection.socket;
-        if (this.#connections.has(target)) {
-            this.#connections.get(target)?.release();
+        // Fixed-name mode reuses `target`; dropping the prior entry without
+        // closing its socket leaves a zombie browser tab that still looks
+        // connected but never receives outbound traffic.
+        const previous = this.#connections.get(target);
+        if (previous) {
+            previous.release();
+            if (!previous.placeholder) {
+                try {
+                    previous.socket.close(4000, 'replaced by new sandbox client');
+                }
+                catch {
+                    /* already closed */
+                }
+            }
             this.#connections.delete(target);
         }
         const release = bindSandboxWsSocket(socket, {
             onMessage: (raw) => {
-                if (!this.#open)
-                    return;
                 const parsed = parseSandboxWsPayload(raw);
+                const conn = this.#connections.get(target);
+                if (conn && !conn.placeholder) {
+                    conn.lastChannel = {
+                        type: parsed.type,
+                        id: parsed.id || owner,
+                    };
+                }
                 logger.debug(formatCompact({
                     op: 'sandbox_recv',
                     target,
                     sender: parsed.id || owner,
+                    channelType: parsed.type,
+                    channelId: parsed.id || owner,
                     text: parsed.text.slice(0, 80),
                 }));
+                // Don't gate on #open — inbound must always reach the gateway so
+                // Command/AI dispatch and outbound replies work.
                 void this.#options.gateway.receive({
                     adapter: this.#options.id,
                     target,
@@ -95,6 +196,9 @@ export class SandboxWsEndpoint {
                     sender: parsed.id || owner,
                     metadata: Object.freeze({
                         type: parsed.type,
+                        channelType: parsed.type,
+                        channelId: parsed.id || owner,
+                        endpoint: target,
                         elements: parsed.content,
                         timestamp: parsed.timestamp,
                         ...(parsed.action ? { action: parsed.action } : {}),
@@ -108,8 +212,13 @@ export class SandboxWsEndpoint {
                 });
             },
             onClose: () => {
-                this.#connections.delete(target);
-                logger.debug(formatCompact({ op: 'sandbox_ws_closed', target }));
+                // Only drop the map entry if we still own this socket — a replace
+                // may have already swapped in a newer connection for the same target.
+                const current = this.#connections.get(target);
+                if (current && current.socket === socket) {
+                    this.#connections.delete(target);
+                    logger.debug(formatCompact({ op: 'sandbox_ws_closed', target }));
+                }
             },
             onError: (err) => {
                 logger.warn(formatCompact({
@@ -119,7 +228,7 @@ export class SandboxWsEndpoint {
                 }));
             },
         });
-        this.#connections.set(target, Object.freeze({ target, owner, socket, release }));
+        this.#connections.set(target, { target, owner, socket, release });
         logger.debug(formatCompact({ op: 'sandbox_ws_connected', target, owner }));
         if (!this.#options.defaults.randomNamePerConnection) {
             const readyPayload = JSON.stringify({
@@ -131,7 +240,7 @@ export class SandboxWsEndpoint {
                         data: {
                             text: [
                                 `已连接 Sandbox「${target}」`,
-                                '与 Node Host 控制台沙盒协议一致（/sandbox）',
+                                `与 Node Host 控制台沙盒协议一致（${this.#wsPath}）`,
                                 '命令: help · ping · zt · status',
                             ].join('\n'),
                         },
@@ -144,12 +253,12 @@ export class SandboxWsEndpoint {
     #ensurePlaceholder(name, owner) {
         if (this.#connections.has(name))
             return;
-        this.#connections.set(name, Object.freeze({
+        this.#connections.set(name, {
             target: name,
             owner,
             socket: { send: () => undefined, close: () => undefined },
             release: () => undefined,
             placeholder: true,
-        }));
+        });
     }
 }

package/lib/protocol.d.ts

@@ -19,6 +19,11 @@ export type ResolvedSandboxBot = {
     readonly randomNamePerConnection: boolean;
 };
 export interface SandboxAdapterConfig {
+    /** Runtime expands `endpoints[i]` onto the top level — prefer these. */
+    readonly context?: string;
+    readonly name?: string;
+    readonly owner?: string;
+    /** Legacy shape: endpoint entries nested under `endpoints[]`. */
     readonly endpoints?: ReadonlyArray<{
         readonly context?: string;
         readonly name?: string;
@@ -42,11 +47,17 @@ export declare function parseSandboxWsPayload(raw: string): {
         payload: string;
     };
 };
+export type SandboxOutboundChannel = {
+    readonly type?: string;
+    readonly id?: string;
+    readonly bot?: string;
+    readonly endpoint?: string;
+    readonly messageId?: string;
+};
 /**
  * Wire-encode an already-rendered outbound payload.
- * Canonical segment mapping (old `segment-mapper` re-export of `to/fromCanonicalSegments`
- * from legacy `zhin.js`) is intentionally not done here — the gateway/core render path
- * owns that before `endpoint.send`.
+ * Stamps `channel` so Console SandboxChat can filter by type+id (otherwise
+ * replies look like they disappeared).
  */
-export declare function formatSandboxOutbound(payload: unknown): string;
+export declare function formatSandboxOutbound(payload: unknown, channel?: SandboxOutboundChannel): string;
 export declare function whenWsOpen(ws: SandboxWsSocket, fn: () => void): void;

package/lib/protocol.js

@@ -1,9 +1,14 @@
 /** Sandbox WebSocket wire protocol helpers (no legacy Adapter/Endpoint). */
 export function resolveSandboxEndpoint(appConfig) {
     const entry = appConfig.endpoints?.find((item) => item.context === 'sandbox');
-    const fixedName = typeof entry?.name === 'string' ? entry.name : undefined;
+    const fixedName = typeof appConfig.name === 'string' && appConfig.name
+        ? appConfig.name
+        : typeof entry?.name === 'string' && entry.name
+            ? entry.name
+            : undefined;
     const name = fixedName || process.env.SANDBOX_BOT_NAME || 'sandbox-bot';
-    const owner = (typeof entry?.owner === 'string' && entry.owner)
+    const owner = (typeof appConfig.owner === 'string' && appConfig.owner)
+        || (typeof entry?.owner === 'string' && entry.owner)
         || process.env.SANDBOX_BOT_OWNER
         || 'sandbox-user';
     return {
@@ -100,24 +105,53 @@ export function parseSandboxWsPayload(raw) {
 }
 /**
  * Wire-encode an already-rendered outbound payload.
- * Canonical segment mapping (old `segment-mapper` re-export of `to/fromCanonicalSegments`
- * from legacy `zhin.js`) is intentionally not done here — the gateway/core render path
- * owns that before `endpoint.send`.
+ * Stamps `channel` so Console SandboxChat can filter by type+id (otherwise
+ * replies look like they disappeared).
  */
-export function formatSandboxOutbound(payload) {
+export function formatSandboxOutbound(payload, channel = {}) {
+    const stamp = {};
+    if (channel.type)
+        stamp.type = channel.type;
+    if (channel.id)
+        stamp.id = channel.id;
+    if (channel.bot)
+        stamp.bot = channel.bot;
+    if (channel.endpoint)
+        stamp.endpoint = channel.endpoint;
+    if (channel.messageId)
+        stamp.messageId = channel.messageId;
     if (typeof payload === 'string') {
         return JSON.stringify({
+            ...stamp,
             content: [{ type: 'text', data: { text: payload } }],
             timestamp: Date.now(),
         });
     }
     if (Array.isArray(payload)) {
         return JSON.stringify({
+            ...stamp,
             content: payload,
             timestamp: Date.now(),
         });
     }
-    return JSON.stringify({ content: payload, timestamp: Date.now() });
+    // Already a wire envelope ({ content, type, … }) — pass through so the
+    // Console UI can read `content` / `type` without an extra nesting layer.
+    // Bare segment objects ({ type: 'text', data: … }) still need wrapping.
+    if (payload
+        && typeof payload === 'object'
+        && !Array.isArray(payload)
+        && ('content' in payload
+            || 'type' in payload && 'timestamp' in payload)) {
+        const envelope = payload;
+        return JSON.stringify({
+            ...stamp,
+            ...envelope,
+            type: envelope.type ?? stamp.type,
+            id: envelope.id ?? stamp.id,
+            timestamp: typeof envelope.timestamp === 'number' ? envelope.timestamp : Date.now(),
+        });
+    }
+    return JSON.stringify({ ...stamp, content: payload, timestamp: Date.now() });
 }
 /** WebSocket.OPEN 常量值；Node <22 无全局 WebSocket，不能用 WebSocket.OPEN。 */
 const WS_OPEN = 1;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhin.js/adapter-sandbox",
-  "version": "5.0.6",
+  "version": "6.0.1",
   "description": "Zhin.js Sandbox adapter for Plugin Runtime (WebSocket /sandbox)",
   "type": "module",
   "main": "./lib/index.js",
@@ -46,35 +46,42 @@
     "directory": "plugins/adapters/sandbox"
   },
   "dependencies": {
+    "lucide-react": "^0.525.0",
     "react": "^19.1.0",
+    "@zhin.js/adapter": "1.1.1",
+    "@zhin.js/client": "2.1.1",
     "@zhin.js/console-contract": "1.0.0",
-    "@zhin.js/adapter": "1.0.1",
-    "@zhin.js/core": "1.3.5",
-    "@zhin.js/host-http": "1.0.1",
+    "@zhin.js/core": "1.4.1",
+    "@zhin.js/host-http": "1.0.3",
     "@zhin.js/logger": "1.0.75",
-    "@zhin.js/page": "1.0.1",
-    "@zhin.js/plugin-runtime": "1.0.1"
+    "@zhin.js/page": "1.0.3",
+    "@zhin.js/plugin-runtime": "1.1.1"
   },
   "devDependencies": {
+    "@types/react": "^19.1.8",
     "@types/ws": "^8.18.1",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10",
     "ws": "^8.21.0",
-    "@zhin.js/pagemanager": "2.0.4",
-    "@zhin.js/runtime": "1.0.1"
+    "@zhin.js/pagemanager": "2.0.6",
+    "@zhin.js/runtime": "1.0.3"
   },
   "peerDependencies": {
     "react": "^19.0.0",
-    "@zhin.js/adapter": "1.0.1",
+    "@zhin.js/adapter": "1.1.1",
+    "@zhin.js/client": "2.1.1",
     "@zhin.js/console-contract": "1.0.0",
-    "@zhin.js/core": "1.3.5",
-    "@zhin.js/host-http": "1.0.1",
-    "@zhin.js/page": "1.0.1",
-    "@zhin.js/plugin-runtime": "1.0.1"
+    "@zhin.js/core": "1.4.1",
+    "@zhin.js/host-http": "1.0.3",
+    "@zhin.js/page": "1.0.3",
+    "@zhin.js/plugin-runtime": "1.1.1"
   },
   "peerDependenciesMeta": {
     "react": {
       "optional": true
+    },
+    "@zhin.js/client": {
+      "optional": true
     }
   },
   "publishConfig": {