@zhin.js/scaffold-wizard 0.1.8 → 0.2.0

package/src/apply.ts

@@ -1,11 +1,23 @@
 import fs from 'fs-extra';
 import path from 'path';
+import yaml from 'yaml';
+import { stringify as stringifyToml } from 'smol-toml';
 import type { AdapterSetupResult, AISetupConfig, DatabaseConfig, InitOptions } from './types.js';
-import { generateAdapterEnvVars, getAdapterDependencies } from './adapter.js';
+import {
+  collectAdapterPluginConfigs,
+  collectAdapterPluginManifest,
+  generateAdapterEnvVars,
+  getAdapterDependencies,
+} from './adapter.js';
 import { generateAIEnvVars, materializeAIConfig } from './ai.js';
 import { ensureDatabaseForAdapters, ensureDatabaseForAI, getAIDependencies } from './project-deps.js';
+import { DEFAULT_CREATE_BOT_HTTP_PORT } from './zhin-stack-deps.js';
+import { packageToInstanceKey } from './project-config-plan.js';
 
-/** Host 插件（Webhook / Console 必需） */
+/**
+ * @deprecated Plugin Runtime 由 CLI composition root 装配 Console/HTTP Host，
+ * 不再需要在 plugins 清单中声明 host 插件；保留导出仅为兼容。
+ */
 export const CONSOLE_HOST_PLUGINS = [
   '@zhin.js/host-router',
   '@zhin.js/host-api',
@@ -13,32 +25,67 @@ export const CONSOLE_HOST_PLUGINS = [
 
 export function applyDatabaseToConfig(config: Record<string, unknown>, database: DatabaseConfig): void {
   config.database = database;
-  if (database.dialect === 'sqlite') {
-    config.inbox = { enabled: true };
+}
+
+/** 将 legacy 数组形式 plugins 归一化为新 runtime 的 instanceKey 映射 */
+export function normalizePluginsMap(value: unknown): Record<string, unknown> {
+  if (Array.isArray(value)) {
+    const map: Record<string, unknown> = {};
+    for (const entry of value) {
+      if (typeof entry !== 'string') continue;
+      map[packageToInstanceKey(entry)] ??= {};
+    }
+    return map;
   }
+  if (value && typeof value === 'object') {
+    return { ...(value as Record<string, unknown>) };
+  }
+  return {};
 }
 
 export function applyAdaptersToConfig(config: Record<string, unknown>, result: AdapterSetupResult): void {
-  const plugins = Array.isArray(config.plugins) ? [...config.plugins as string[]] : [];
-  for (const plugin of result.plugins) {
-    if (!plugins.includes(plugin)) plugins.push(plugin);
-  }
-  if (result.plugins.some((p: string) => p !== '@zhin.js/adapter-sandbox')) {
-    for (const hostPlugin of CONSOLE_HOST_PLUGINS) {
-      if (!plugins.includes(hostPlugin)) plugins.push(hostPlugin);
-    }
+  const plugins = normalizePluginsMap(config.plugins);
+  for (const instance of result.instances) {
+    plugins[instance.instanceKey] = instance.config;
   }
   config.plugins = plugins;
-
-  const endpoints = Array.isArray(config.endpoints) ? [...config.endpoints as Record<string, unknown>[]] : [];
-  endpoints.push(...result.endpoints);
-  config.endpoints = endpoints;
+  // legacy endpoints 列表不被 runtime 配置 schema 接受（additionalProperties: false）
+  delete config.endpoints;
 }
 
 export function applyAIToConfig(config: Record<string, unknown>, ai: AISetupConfig): void {
   config.ai = materializeAIConfig(ai);
 }
 
+/** 把 zhin.plugins 清单条目合并进项目 package.json（zhin setup 路径） */
+export async function mergePluginManifestIntoPackageJson(
+  projectDir: string,
+  entries: Array<{ package: string; instanceKey: string }>,
+): Promise<boolean> {
+  if (entries.length === 0) return false;
+  const pkgPath = path.join(projectDir, 'package.json');
+  if (!(await fs.pathExists(pkgPath))) return false;
+
+  const pkg = await fs.readJson(pkgPath);
+  const zhin = pkg.zhin && typeof pkg.zhin === 'object' && !Array.isArray(pkg.zhin)
+    ? pkg.zhin
+    : { protocol: 1, type: 'plugin', entry: './plugin.ts' };
+  const manifest: Array<{ package: string; instanceKey: string }> = Array.isArray(zhin.plugins)
+    ? [...zhin.plugins]
+    : [];
+  let changed = false;
+  for (const entry of entries) {
+    if (manifest.some((item) => item?.instanceKey === entry.instanceKey)) continue;
+    manifest.push({ package: entry.package, instanceKey: entry.instanceKey });
+    changed = true;
+  }
+  if (!changed && pkg.zhin) return false;
+  zhin.plugins = manifest;
+  pkg.zhin = zhin;
+  await fs.writeJson(pkgPath, pkg, { spaces: 2 });
+  return true;
+}
+
 export async function appendWizardEnvVars(
   projectDir: string,
   adapters?: AdapterSetupResult,
@@ -47,11 +94,16 @@ export async function appendWizardEnvVars(
   const extra =
     (adapters ? generateAdapterEnvVars(adapters) : '') +
     (ai ? generateAIEnvVars(ai) : '');
-  if (!extra) return;
+  if (extra) {
+    const envPath = path.join(projectDir, '.env');
+    const existing = (await fs.pathExists(envPath)) ? await fs.readFile(envPath, 'utf-8') : '';
+    await fs.writeFile(envPath, existing.replace(/\s*$/, '') + extra + '\n');
+  }
 
-  const envPath = path.join(projectDir, '.env');
-  const existing = (await fs.pathExists(envPath)) ? await fs.readFile(envPath, 'utf-8') : '';
-  await fs.writeFile(envPath, existing.replace(/\s*$/, '') + extra + '\n');
+  // 新 Plugin Runtime 通过 package.json zhin.plugins 清单挂载子插件，与依赖一起落盘
+  if (adapters) {
+    await mergePluginManifestIntoPackageJson(projectDir, collectAdapterPluginManifest(adapters));
+  }
 }
 
 export function collectWizardDependencies(
@@ -95,5 +147,102 @@ export function finalizeWizardOptions(options: InitOptions): void {
 export function applyWizardOptionsToConfig(config: Record<string, unknown>, options: InitOptions): void {
   if (options.database) applyDatabaseToConfig(config, options.database);
   if (options.adapters) applyAdaptersToConfig(config, options.adapters);
-  if (options.ai) applyAIToConfig(config, options.ai);
+  if (options.ai?.enabled) applyAIToConfig(config, options.ai);
+}
+
+/**
+ * 数据库配置物化为可落盘对象；非 SQLite 连接参数引用 .env（${VAR} 由 runtime 展开）
+ */
+export function materializeDatabaseConfig(config: DatabaseConfig): Record<string, unknown> {
+  switch (config.dialect) {
+    case 'mysql':
+      return {
+        dialect: 'mysql',
+        host: '${DB_HOST}',
+        port: '${DB_PORT}',
+        user: '${DB_USER}',
+        password: '${DB_PASSWORD}',
+        database: '${DB_DATABASE}',
+      };
+    case 'pg':
+      return {
+        dialect: 'pg',
+        host: '${DB_HOST}',
+        port: '${DB_PORT}',
+        user: '${DB_USER}',
+        password: '${DB_PASSWORD}',
+        database: '${DB_DATABASE}',
+      };
+    case 'mongodb':
+      return { dialect: 'mongodb', url: '${DB_URL}', dbName: '${DB_NAME}' };
+    case 'redis':
+      return {
+        dialect: 'redis',
+        socket: { host: '${REDIS_HOST}', port: '${REDIS_PORT}' },
+        password: '${REDIS_PASSWORD}',
+        database: '${REDIS_DB}',
+      };
+    case 'sqlite':
+    default: {
+      const sqlite: Record<string, unknown> = { dialect: 'sqlite' };
+      if (config.filename) sqlite.filename = config.filename;
+      if (config.mode) sqlite.mode = config.mode;
+      return sqlite;
+    }
+  }
+}
+
+/** 生活助手模板的额外 AI 配置（知识库 + compaction + 执行审批） */
+function applyLifeAssistantAiExtras(ai: Record<string, unknown>): Record<string, unknown> {
+  const agent = ai.agent && typeof ai.agent === 'object' && !Array.isArray(ai.agent)
+    ? { ...(ai.agent as Record<string, unknown>) }
+    : {};
+  return {
+    ...ai,
+    knowledge: { baseDir: 'knowledge' },
+    agent: {
+      ...agent,
+      execSecurity: 'allowlist',
+      execApprovalMode: 'ask',
+      compaction: { enabled: true, auto: true, keepRecentTokens: 20000 },
+    },
+  };
+}
+
+/**
+ * 构建新 Plugin Runtime 配置文档（顶层 http/database/ai + plugins.<instanceKey>）。
+ * 顶层键与 packages/im/runtime/src/config-composer.ts 的 effectiveSchema 对齐。
+ */
+export function buildRuntimeConfigDocument(options: InitOptions): Record<string, unknown> {
+  const doc: Record<string, unknown> = {};
+
+  if (options.database) {
+    doc.database = materializeDatabaseConfig(options.database);
+  }
+
+  doc.http = {
+    token: '${HTTP_TOKEN}',
+    port: DEFAULT_CREATE_BOT_HTTP_PORT,
+    base: '/api',
+    corsOrigins: ['https://console.zhin.dev'],
+  };
+
+  if (options.ai?.enabled) {
+    const ai = materializeAIConfig(options.ai);
+    doc.ai = options.template === 'life-assistant' ? applyLifeAssistantAiExtras(ai) : ai;
+  }
+
+  doc.plugins = options.adapters ? collectAdapterPluginConfigs(options.adapters) : {};
+
+  return doc;
+}
+
+/** 序列化配置文档为 zhin.config.yml / json / toml 文本 */
+export function serializeRuntimeConfig(
+  doc: Record<string, unknown>,
+  format: 'yaml' | 'json' | 'toml',
+): string {
+  if (format === 'json') return `${JSON.stringify(doc, null, 2)}\n`;
+  if (format === 'toml') return stringifyToml(doc);
+  return yaml.stringify(doc);
 }

package/src/index.ts

@@ -1,13 +1,13 @@
 export type { InitOptions, DatabaseConfig } from './types.js';
 export { DATABASE_PACKAGES } from './types.js';
 
-export type { AdapterSetupResult } from './adapter.js';
+export type { AdapterSetupResult, AdapterPluginInstance } from './adapter.js';
 export {
   configureAdapters,
+  buildFieldBasedInstanceConfig,
   generateAdapterEnvVars,
-  generateEndpointsConfigYaml,
-  generateEndpointsConfigJSON,
-  generateEndpointsConfigToml,
+  collectAdapterPluginConfigs,
+  collectAdapterPluginManifest,
   getAdapterDependencies,
   getAdapterSetupNotes,
 } from './adapter.js';
@@ -89,6 +89,7 @@ export {
   migrateAiLegacyConfig,
   diagnoseConsoleConfig,
   applyConsoleConfigFixes,
+  packageToInstanceKey,
 } from './project-config-plan.js';
 export type {
   LoadedProjectConfig,
@@ -106,6 +107,11 @@ export {
   appendWizardEnvVars,
   collectWizardDependencies,
   mergeDependenciesIntoPackageJson,
+  mergePluginManifestIntoPackageJson,
   finalizeWizardOptions,
   applyWizardOptionsToConfig,
+  normalizePluginsMap,
+  materializeDatabaseConfig,
+  buildRuntimeConfigDocument,
+  serializeRuntimeConfig,
 } from './apply.js';

package/src/project-config-plan.ts

@@ -12,10 +12,19 @@ const CONFIG_CANDIDATES = [
   'zhin.config.toml',
   'zhin.config.ts',
 ] as const;
+/** @deprecated Plugin Runtime 由 CLI 装配 Console Host，无需在配置中声明；仅用于 legacy 数组配置诊断 */
 const CONSOLE_HOST_PLUGINS = ['@zhin.js/host-router', '@zhin.js/host-api'] as const;
 const SANDBOX_PLUGIN = '@zhin.js/adapter-sandbox';
 const LEGACY_AI_PROVIDER_FIELDS = ['driver', 'api', 'preset', 'spec'] as const;
 
+/** 由插件包名推导默认 instanceKey（@zhin.js/adapter-telegram → telegram） */
+export function packageToInstanceKey(packageName: string): string {
+  const name = packageName.includes('/')
+    ? packageName.split('/').pop() ?? packageName
+    : packageName;
+  return name.replace(/^(adapter|plugin|service)-/, '');
+}
+
 export type ProjectConfigFormat = 'yaml' | 'json' | 'toml' | 'ts';
 
 export interface LoadedProjectConfig {
@@ -164,17 +173,34 @@ export function loadProjectConfig(cwd = process.cwd(), configPath?: string): Loa
 }
 
 function ensurePlugins(config: Record<string, unknown>, pluginsToAdd: readonly string[], mutations: string[]): void {
-  const plugins = Array.isArray(config.plugins)
-    ? config.plugins.filter((p): p is string => typeof p === 'string')
-    : [];
+  if (Array.isArray(config.plugins)) {
+    // legacy 数组形式：保持原形态追加，避免改写旧项目结构
+    const plugins = config.plugins.filter((p): p is string => typeof p === 'string');
+    let changed = false;
+    for (const plugin of pluginsToAdd) {
+      if (plugins.includes(plugin)) continue;
+      plugins.push(plugin);
+      mutations.push(`added ${plugin} to plugins`);
+      changed = true;
+    }
+    if (changed) {
+      config.plugins = plugins;
+    }
+    return;
+  }
+  // 新 Plugin Runtime：plugins 为 <instanceKey>: <配置> 映射
+  const plugins = config.plugins && typeof config.plugins === 'object'
+    ? { ...(config.plugins as Record<string, unknown>) }
+    : {};
   let changed = false;
-  for (const plugin of pluginsToAdd) {
-    if (plugins.includes(plugin)) continue;
-    plugins.push(plugin);
-    mutations.push(`added ${plugin} to plugins`);
+  for (const pkg of pluginsToAdd) {
+    const instanceKey = packageToInstanceKey(pkg);
+    if (instanceKey in plugins) continue;
+    plugins[instanceKey] = {};
+    mutations.push(`added ${instanceKey} (${pkg}) to plugins`);
     changed = true;
   }
-  if (changed || !Array.isArray(config.plugins)) {
+  if (changed || !config.plugins || typeof config.plugins !== 'object') {
     config.plugins = plugins;
   }
 }
@@ -318,7 +344,8 @@ export function createProjectConfigPlan(options: ProjectConfigPlanOptions): Proj
   const mutations: string[] = [];
 
   if (loaded.status === 'loaded' || options.config) {
-    if (options.ensureConsole) {
+    if (options.ensureConsole && Array.isArray(after.plugins)) {
+      // legacy 数组形态：host 插件仍需写入列表（旧项目行为不变）
       ensurePlugins(after, CONSOLE_HOST_PLUGINS, mutations);
     }
     if (options.ensureSandbox) {
@@ -327,7 +354,8 @@ export function createProjectConfigPlan(options: ProjectConfigPlanOptions): Proj
     if (options.enablePlugins?.length) {
       ensurePlugins(after, options.enablePlugins, mutations);
     }
-    if (options.ensureHttp) {
+    if (options.ensureConsole || options.ensureHttp) {
+      // 新形态下 Console Host 由 CLI composition root 装配；Console 可达只需 http.token + corsOrigins
       ensureHttp(after, mutations);
     }
     if (options.migrateAiLegacy) {
@@ -369,17 +397,29 @@ export async function applyProjectConfigPlan(plan: ProjectConfigPlan): Promise<b
 }
 
 export function diagnoseConsoleConfig(config: Record<string, unknown>): ConsoleConfigDiagnosis {
-  const plugins = Array.isArray(config.plugins)
-    ? config.plugins.filter((p): p is string => typeof p === 'string')
-    : [];
   const http = config.http && typeof config.http === 'object' && !Array.isArray(config.http)
     ? config.http as Record<string, unknown>
     : {};
   const corsOrigins = Array.isArray(http.corsOrigins) ? http.corsOrigins : [];
 
+  if (Array.isArray(config.plugins)) {
+    // legacy 数组形式配置
+    const plugins = config.plugins.filter((p): p is string => typeof p === 'string');
+    return {
+      missingHostPlugins: CONSOLE_HOST_PLUGINS.filter((plugin) => !plugins.includes(plugin)),
+      missingSandboxPlugin: !plugins.includes(SANDBOX_PLUGIN),
+      missingConsoleOrigin: !hasConsoleOrigin(corsOrigins.filter((origin): origin is string => typeof origin === 'string')),
+      missingHttpToken: typeof http.token !== 'string' || http.token.trim().length === 0,
+    };
+  }
+
+  // 新 Plugin Runtime：Console Host 由 CLI 装配，无需 host 插件；Sandbox 为 plugins.sandbox 实例
+  const plugins = config.plugins && typeof config.plugins === 'object'
+    ? config.plugins as Record<string, unknown>
+    : {};
   return {
-    missingHostPlugins: CONSOLE_HOST_PLUGINS.filter((plugin) => !plugins.includes(plugin)),
-    missingSandboxPlugin: !plugins.includes(SANDBOX_PLUGIN),
+    missingHostPlugins: [],
+    missingSandboxPlugin: !('sandbox' in plugins),
     missingConsoleOrigin: !hasConsoleOrigin(corsOrigins.filter((origin): origin is string => typeof origin === 'string')),
     missingHttpToken: typeof http.token !== 'string' || http.token.trim().length === 0,
   };

package/src/weixin-ilink-login.ts

@@ -0,0 +1,151 @@
+/**
+ * 微信 iLink（ClawBot）扫码登录流程 — 向导内联实现。
+ * 协议与 plugins/adapters/weixin-ilink/src/login.ts 一致（SSOT），
+ * 此处复制最小 HTTP 面，避免向导在适配器包安装前产生依赖。
+ */
+
+export interface IlinkQrLoginResult {
+  readonly botToken: string;
+  readonly ilinkUserId?: string;
+  readonly ilinkBotId?: string;
+  readonly baseUrl: string;
+}
+
+interface QrCodeResponse {
+  qrcode: string;
+  qrcode_img_content: string;
+}
+
+type QrStatus =
+  | 'wait'
+  | 'scaned'
+  | 'confirmed'
+  | 'expired'
+  | 'scaned_but_redirect'
+  | 'need_verifycode'
+  | 'verify_code_blocked'
+  | 'binded_redirect';
+
+interface StatusResponse {
+  status: QrStatus;
+  bot_token?: string;
+  ilink_endpoint_id?: string;
+  baseurl?: string;
+  ilink_user_id?: string;
+  redirect_host?: string;
+}
+
+const DEFAULT_BASE_URL = 'https://ilinkai.weixin.qq.com';
+const DEFAULT_BOT_TYPE = '3';
+const POLL_INTERVAL_MS = 500;
+const QR_LONG_POLL_TIMEOUT_MS = 35_000;
+
+export interface IlinkQrLoginOptions {
+  readonly baseUrl?: string;
+  readonly timeoutMs?: number;
+  /** 拿到二维码内容（URL）后回调，由调用方负责展示（终端 QR / 链接）。 */
+  readonly onQrCode: (url: string) => void | Promise<void>;
+  /** 扫码状态变化提示（scaned → 已扫码待确认）。 */
+  readonly onStatus?: (status: QrStatus) => void;
+  readonly fetchImpl?: typeof fetch;
+  readonly sleep?: (ms: number) => Promise<void>;
+}
+
+export class IlinkQrLoginError extends Error {
+  constructor(
+    message: string,
+    readonly reason: 'expired' | 'timeout' | 'network' | 'protocol',
+  ) {
+    super(message);
+    this.name = 'IlinkQrLoginError';
+  }
+}
+
+/** 与 adapter login.ts 的 buildBaseInfo 对齐的最小结构。 */
+function buildBaseInfo(): Record<string, string> {
+  return { channel_version: '0.0.0', bot_agent: 'Zhin.js' };
+}
+
+/**
+ * 微信 iLink 扫码登录：获取二维码 → 展示 → 长轮询直至 confirmed。
+ * 成功返回 bot_token 等凭证；过期/超时/网络失败抛 IlinkQrLoginError。
+ */
+export async function loginWithIlinkQr(options: IlinkQrLoginOptions): Promise<IlinkQrLoginResult> {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const sleep = options.sleep ?? ((ms: number) => new Promise<void>((r) => setTimeout(r, ms)));
+  const apiBaseUrl = options.baseUrl ?? DEFAULT_BASE_URL;
+  const timeoutMs = options.timeoutMs ?? 480_000;
+
+  let qr: QrCodeResponse;
+  try {
+    const res = await fetchImpl(
+      `${apiBaseUrl}/ilink/bot/get_bot_qrcode?bot_type=${encodeURIComponent(DEFAULT_BOT_TYPE)}`,
+      {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ local_token_list: [], base_info: buildBaseInfo() }),
+      },
+    );
+    if (!res.ok) throw new Error(`HTTP ${res.status}`);
+    qr = await res.json() as QrCodeResponse;
+  } catch (error) {
+    throw new IlinkQrLoginError(
+      `获取登录二维码失败：${error instanceof Error ? error.message : String(error)}`,
+      'network',
+    );
+  }
+
+  const qrcodeUrl = qr.qrcode_img_content || qr.qrcode;
+  await options.onQrCode(qrcodeUrl);
+
+  const deadline = Date.now() + timeoutMs;
+  let currentBaseUrl = apiBaseUrl;
+  let lastStatus: QrStatus | undefined;
+
+  while (Date.now() < deadline) {
+    let status: StatusResponse;
+    try {
+      const res = await fetchImpl(
+        `${currentBaseUrl}/ilink/bot/get_qrcode_status?qrcode=${encodeURIComponent(qr.qrcode)}`,
+        { signal: AbortSignal.timeout(QR_LONG_POLL_TIMEOUT_MS) },
+      );
+      if (!res.ok) throw new Error(`HTTP ${res.status}`);
+      status = await res.json() as StatusResponse;
+    } catch {
+      // 长轮询超时/瞬断视为继续等待
+      await sleep(POLL_INTERVAL_MS);
+      continue;
+    }
+
+    if (status.status !== lastStatus) {
+      lastStatus = status.status;
+      options.onStatus?.(status.status);
+    }
+
+    if (status.status === 'scaned_but_redirect' && status.redirect_host) {
+      currentBaseUrl = status.redirect_host.startsWith('http')
+        ? status.redirect_host
+        : `https://${status.redirect_host}`;
+    }
+
+    if (status.status === 'confirmed' || status.status === 'binded_redirect') {
+      if (!status.bot_token) {
+        throw new IlinkQrLoginError('扫码成功但未返回 bot_token，请重试或改用手动输入', 'protocol');
+      }
+      return {
+        botToken: status.bot_token,
+        ...(status.ilink_user_id ? { ilinkUserId: status.ilink_user_id } : {}),
+        ...(status.ilink_endpoint_id ? { ilinkBotId: status.ilink_endpoint_id } : {}),
+        baseUrl: status.baseurl ?? currentBaseUrl,
+      };
+    }
+
+    if (status.status === 'expired') {
+      throw new IlinkQrLoginError('二维码已过期', 'expired');
+    }
+
+    await sleep(POLL_INTERVAL_MS);
+  }
+
+  throw new IlinkQrLoginError('微信扫码登录超时', 'timeout');
+}

package/src/zhin-stack-deps.ts

@@ -6,12 +6,20 @@ import { findMissingPackageDependencies, findUnresolvedPackageInstalls, isAiEnab
 
 /**
  * User project dependency policy: scaffolded dependencies intentionally float to latest.
+ * WARNING: this is not reproducible; pin versions for production. See scaffold-wizard README.
  */
 export const ZHIN_STACK_VERSIONS = {
   'zhin.js': 'latest',
   '@zhin.js/cli': 'latest',
   '@zhin.js/agent': 'latest',
   '@zhin.js/database': 'latest',
+  '@zhin.js/plugin-runtime': 'latest',
+  '@zhin.js/runtime': 'latest',
+  '@zhin.js/adapter': 'latest',
+  '@zhin.js/command': 'latest',
+  '@zhin.js/component': 'latest',
+  '@zhin.js/core': 'latest',
+  '@zhin.js/tool': 'latest',
   '@zhin.js/host-router': 'latest',
   '@zhin.js/host-api': 'latest',
   '@zhin.js/client': 'latest',
@@ -81,10 +89,17 @@ function resolveStackVersion(packageName: string): string {
 }
 
 function collectZhinPluginsFromConfig(config: Record<string, unknown>): string[] {
-  const plugins = Array.isArray(config.plugins)
-    ? config.plugins.filter((p): p is string => typeof p === 'string')
-    : [];
-  return [...new Set(plugins.filter((p) => p.startsWith('@zhin.js/')))];
+  // legacy 数组形式：条目即包名
+  if (Array.isArray(config.plugins)) {
+    const plugins = config.plugins.filter((p): p is string => typeof p === 'string');
+    return [...new Set(plugins.filter((p) => p.startsWith('@zhin.js/')))];
+  }
+  // 新 runtime：plugins 为 instanceKey 映射，包名在 package.json zhin.plugins 清单中，
+  // 无法从配置推导；仅收集直接以包名出现的键（防御性）
+  if (config.plugins && typeof config.plugins === 'object') {
+    return Object.keys(config.plugins as Record<string, unknown>).filter((key) => key.startsWith('@zhin.js/'));
+  }
+  return [];
 }
 
 /** create-zhin / minimal-bot 默认 Host 端口（避免与常见 8086 占用冲突） */
@@ -100,15 +115,16 @@ export function getCreateBotPnpmConfig(_aiEnabled?: boolean): Record<string, unk
   };
 }
 
-/** create-zhin-app 默认 bot 骨架依赖（不含适配器 / AI / 数据库驱动） */
+/** create-zhin-app Plugin Runtime 骨架 production 依赖（不含适配器 / AI / 数据库驱动） */
 export function getCreateBotBaseDependencies(): Record<string, string> {
   return {
     'zhin.js': ZHIN_STACK_VERSIONS['zhin.js'],
-    '@zhin.js/cli': ZHIN_STACK_VERSIONS['@zhin.js/cli'],
-    '@zhin.js/host-router': ZHIN_STACK_VERSIONS['@zhin.js/host-router'],
-    '@zhin.js/client': ZHIN_STACK_VERSIONS['@zhin.js/client'],
-    '@zhin.js/host-api': ZHIN_STACK_VERSIONS['@zhin.js/host-api'],
-    '@zhin.js/contract': ZHIN_STACK_VERSIONS['@zhin.js/contract'],
+    '@zhin.js/plugin-runtime': ZHIN_STACK_VERSIONS['@zhin.js/plugin-runtime'],
+    '@zhin.js/runtime': ZHIN_STACK_VERSIONS['@zhin.js/runtime'],
+    '@zhin.js/adapter': ZHIN_STACK_VERSIONS['@zhin.js/adapter'],
+    '@zhin.js/command': ZHIN_STACK_VERSIONS['@zhin.js/command'],
+    '@zhin.js/component': ZHIN_STACK_VERSIONS['@zhin.js/component'],
+    '@zhin.js/core': ZHIN_STACK_VERSIONS['@zhin.js/core'],
     '@zhin.js/satori': ZHIN_STACK_VERSIONS['@zhin.js/satori'],
   };
 }