refactor: sync main runtime and CI changes to 1.0.0-explore

.github/workflows/ci.yml

@@ -141,7 +141,6 @@ jobs:
           sudo apt-get install -y --no-install-recommends \
             pkg-config \
             build-essential \
-            libssl-dev \
             libxcb1-dev \
             libxcb-render0-dev \
             libxcb-shape0-dev \
@@ -526,12 +525,22 @@ jobs:
       - name: Validate interactive capability contract
         run: pnpm run capabilities:check && pnpm run capabilities:test && pnpm run website:test && pnpm run website:build
 
+      - name: Test core boundary contracts
+        run: pnpm run check:core-boundaries:test
+
       - name: Check core boundaries
-        run: node --test scripts/check-core-boundaries.test.mjs
+        run: pnpm run check:core-boundaries
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Setup Bun for package resource preflight
+        if: needs.build-impact.outputs.frontend_required != 'false'
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.3.14"
+          no-cache: true
+
       - name: Setup Rust for release projection preflight
         if: needs.build-impact.outputs.frontend_required != 'false'
         uses: dtolnay/rust-toolchain@stable
@@ -540,6 +549,12 @@ jobs:
         if: needs.build-impact.outputs.frontend_required != 'false'
         run: cargo metadata --locked --no-deps
 
+      - name: Build plugin Host resources
+        if: needs.build-impact.outputs.frontend_required != 'false'
+        run: |
+          bun install --cwd src/apps/extension-host --frozen-lockfile
+          bun run --cwd src/apps/extension-host build
+
       - name: Generate web API bindings
         if: needs.build-impact.outputs.frontend_required != 'false'
         run: pnpm --dir src/web-ui run gen:types

.github/workflows/cli-package-manual.yml

@@ -127,6 +127,16 @@ jobs:
         with:
           ref: ${{ needs.prepare.outputs.checkout_ref }}
 
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.3.14"
+
+      - name: Build plugin Host resources
+        run: |
+          bun install --cwd src/apps/extension-host --frozen-lockfile
+          bun run --cwd src/apps/extension-host build
+
       - name: Install Linux system dependencies
         if: runner.os == 'Linux'
         shell: bash
@@ -135,7 +145,6 @@ jobs:
           sudo apt-get install -y --no-install-recommends \
             pkg-config \
             build-essential \
-            libssl-dev \
             libxcb1-dev \
             libxcb-render0-dev \
             libxcb-shape0-dev \

.github/workflows/cli-package.yml

@@ -105,6 +105,16 @@ jobs:
         with:
           ref: ${{ needs.prepare.outputs.checkout_ref }}
 
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.3.14"
+
+      - name: Build plugin Host resources
+        run: |
+          bun install --cwd src/apps/extension-host --frozen-lockfile
+          bun run --cwd src/apps/extension-host build
+
       - name: Setup Rust toolchain
         uses: dtolnay/rust-toolchain@stable
         with:

.github/workflows/linux-binaries.yml

@@ -79,12 +79,23 @@ jobs:
         with:
           ref: ${{ inputs.checkout_ref }}
 
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.3.14"
+          no-cache: true
+
       - name: Setup Node.js
         uses: actions/setup-node@v5
         with:
           node-version-file: package.json
           package-manager-cache: false
 
+      - name: Build plugin Host resources
+        run: |
+          bun install --cwd src/apps/extension-host --frozen-lockfile
+          bun run --cwd src/apps/extension-host build
+
       - name: Install Linux system dependencies
         shell: bash
         run: |
@@ -94,7 +105,6 @@ jobs:
             clang \
             cmake \
             curl \
-            libssl-dev \
             libxcb1-dev \
             libxcb-render0-dev \
             libxcb-shape0-dev \

.github/workflows/nightly-artifacts.yml

@@ -89,6 +89,12 @@ jobs:
         with:
           ref: ${{ inputs.checkout_ref }}
 
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.3.14"
+          no-cache: true
+
       - name: Install Linux system dependencies (Tauri bundler)
         if: runner.os == 'Linux'
         shell: bash
@@ -172,6 +178,11 @@ jobs:
             exit 1
           fi
 
+      - name: Build plugin Host resources
+        run: |
+          bun install --cwd src/apps/extension-host --frozen-lockfile
+          bun run --cwd src/apps/extension-host build
+
       - name: Generate web API bindings
         run: pnpm --dir src/web-ui run gen:types
 

.gitignore

@@ -29,6 +29,9 @@ sdk/typescript/src/internal/wire-validators.ts
 # The deployable Rust services use the workspace lockfile for reproducible
 # container builds.
 !Cargo.lock
+# The standalone Installer resolves against the shared source tree and owns a
+# generated lockfile that must not be committed.
+/BitFun-Installer/src-tauri/Cargo.lock
 
 # Monaco Editor - copied from node_modules
 public/monaco-editor/
@@ -95,6 +98,7 @@ external/
 /.flashgrep-index-engine/
 
 .design/
+.pnpm-store/
 
 # KMP shared mobile core and the platform apps that include it (Gradle).
 # Written per-directory rather than as a bare `local.properties` so the pattern

AGENTS-CN.md

@@ -28,7 +28,7 @@ Stable Contracts and Security Control Plane 的边界以
 | 2 | 产品组装层 | `src/crates/assembly` | 兼容导出、产品能力选择、product-full 接线、不可变内置 Agent 内容、adapter/service 注册和生态无关的来源协调 | `agent-content`, `core`, `external-sources`, `product-capabilities` | [AGENTS.md](src/crates/assembly/AGENTS.md) |
 | 3 | 适配层 | `src/crates/adapters` | AI/transport/WebDriver 协议 adapter、外部 AI work source adapter（OpenCode/Claude Code/Codex）和外部 provider 转换 | `agent-runtime-ipc`、`ai-adapters`, `opencode-adapter`, `claude-code-adapter`, `codex-adapter`, `static-hook-support`, `transport`, `webdriver` | [AGENTS.md](src/crates/adapters/AGENTS.md) |
 | 4 | 服务实现层 | `src/crates/services` | 可复用 OS、filesystem、terminal、MCP、remote、git、watch、process、session persistence primitives、network 和 MiniApp runtime IO 实现 | `services-core`, `services-integrations`, `relay-service`, `page-function-runtime`, `terminal` | [AGENTS.md](src/crates/services/AGENTS.md) |
-| 5 | 执行原语层 | `src/crates/execution` | 可移植 agent、harness、stream、DeepReview policy/report、插件运行时客户端、typed-service、tool-contract、tool-group 和 tool-execution 构件 | `agent-runtime`, `agent-stream`, `tool-contracts`, `harness`, `plugin-runtime-client`, `runtime-services`, `tool-provider-groups`, `tool-execution`, `tool-call-jsonrepair` | [AGENTS.md](src/crates/execution/AGENTS.md) |
+| 5 | 执行原语层 | `src/crates/execution` | 可移植 agent、命名工作流策略、harness、stream、DeepReview policy/report、插件运行时客户端、typed-service、tool-contract、tool-group 和 tool-execution 构件 | `agent-runtime`, `agent-workflows`, `agent-stream`, `tool-contracts`, `harness`, `plugin-runtime-client`, `runtime-services`, `tool-provider-groups`, `tool-execution`, `tool-call-jsonrepair` | [AGENTS.md](src/crates/execution/AGENTS.md) |
 | 6 | 稳定契约与产品领域层 | `src/crates/contracts` | 跨层共享 DTO、事件形状、runtime port、产品领域契约和策略 | `core-types`, `events`, `runtime-ports`, `product-domains` | [AGENTS.md](src/crates/contracts/AGENTS.md) |
 
 边界规则：

AGENTS.md

@@ -43,7 +43,7 @@ Keep crate dependencies inside each layer to the smallest set needed.
 | 2 | Product assembly | `src/crates/assembly` | Compatibility exports, product capability selection, product-full wiring, immutable built-in Agent content, adapter/service registration, and ecosystem-neutral source coordination | `agent-content`, `core`, `external-sources`, `product-capabilities` | [AGENTS.md](src/crates/assembly/AGENTS.md) |
 | 3 | Adapters | `src/crates/adapters` | AI/transport/WebDriver protocol adapters, external AI work source adapters (OpenCode/Claude Code/Codex), and external-provider translation | `agent-runtime-ipc`, `ai-adapters`, `opencode-adapter`, `claude-code-adapter`, `codex-adapter`, `static-hook-support`, `transport`, `webdriver` | [AGENTS.md](src/crates/adapters/AGENTS.md) |
 | 4 | Services | `src/crates/services` | Reusable OS, filesystem, terminal, MCP, remote, git, watch, process, session persistence primitives, MiniApp runtime IO, and network implementations | `services-core`, `services-integrations`, `miniapp-market-service`, `relay-service`, `page-function-runtime`, `terminal` | [AGENTS.md](src/crates/services/AGENTS.md) |
-| 5 | Execution primitives | `src/crates/execution` | Portable agent, harness, stream, DeepReview policy/report, plugin runtime client, typed-service, tool-contract, tool-group, and tool-execution building blocks | `agent-runtime`, `agent-stream`, `tool-contracts`, `harness`, `plugin-runtime-client`, `runtime-services`, `tool-provider-groups`, `tool-execution`, `tool-call-jsonrepair` | [AGENTS.md](src/crates/execution/AGENTS.md) |
+| 5 | Execution primitives | `src/crates/execution` | Portable agent, named-workflow policy, harness, stream, DeepReview policy/report, plugin runtime client, typed-service, tool-contract, tool-group, and tool-execution building blocks | `agent-runtime`, `agent-workflows`, `agent-stream`, `tool-contracts`, `harness`, `plugin-runtime-client`, `runtime-services`, `tool-provider-groups`, `tool-execution`, `tool-call-jsonrepair` | [AGENTS.md](src/crates/execution/AGENTS.md) |
 | 6 | Stable contracts and product domains | `src/crates/contracts` | Shared DTOs, event shapes, runtime ports, and product domain contracts/policies | `core-types`, `events`, `runtime-ports`, `product-domains` | [AGENTS.md](src/crates/contracts/AGENTS.md) |
 
 Boundary rules:

BitFun-Installer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bitfun-installer",
-  "version": "0.2.18",
+  "version": "0.2.19",
   "private": true,
   "type": "module",
   "description": "BitFun Custom Installer - Modern branded installation experience",

BitFun-Installer/scripts/sync-model-i18n.cjs

@@ -209,7 +209,7 @@ function syncOne(languageTag) {
     'locales',
     localeDir,
     'settings',
-    'ai-model.json'
+    'models.json'
   );
   const sourceComponentsPath = path.join(
     PROJECT_ROOT,

BitFun-Installer/scripts/sync-theme-i18n.cjs

@@ -25,7 +25,7 @@ function writeJson(filePath, data) {
 }
 
 function extractThemeNames(source, sourceLabel) {
-  // Theme preset names live under settings/basics.json → appearance.presets (formerly theme.json → theme.presets).
+  // Theme preset names live under settings/application.json → appearance.presets (formerly theme.json → theme.presets).
   const presets = source?.appearance?.presets;
   if (!presets || typeof presets !== "object") {
     throw new Error(`Invalid appearance.presets in ${sourceLabel}`);
@@ -63,7 +63,7 @@ function main() {
     "locales",
     "en-US",
     "settings",
-    "basics.json"
+    "application.json"
   );
   const sourceZhPath = path.join(
     PROJECT_ROOT,
@@ -73,7 +73,7 @@ function main() {
     "locales",
     "zh-CN",
     "settings",
-    "basics.json"
+    "application.json"
   );
 
   const targetEnPath = path.join(