refactor(runtime): extract bots and shared network packages

[sunheyi6]

Summary

Bot delivery currently pulls IM SDKs into every runtime consumer. Extracting bots while keeping a runtime re-export would retain that dependency and, if bots imported runtime, introduce a cycle.

• Extract bridges and their tests into @maka/bots; move shared proxy transports into @maka/network. Neither package depends on runtime. Desktop connects bot events to Session execution through the existing callbacks.
• Migrate consumers, workspace builds, CI selection, and license inventories. Runtime and CLI no longer include the Slack, Feishu, or WeCom SDKs; ws remains for OpenAI Responses WebSocket transport.

Fixes #3910.

Compatibility

This intentionally revises the issue's old-entry compatibility requirement: remove @maka/runtime/bots and the migrated runtime network exports instead of keeping a re-export. These are private workspace packages, and all known consumers are migrated together. Import bots from @maka/bots and transports from @maka/network/*. No session or persisted-data migration is required.

Verification

• Clean npm ci --ignore-scripts, npm run build:test, full npm run build, and npm run typecheck passed on the PR worktree based on ac59b47b7.
• Full lint/format checks, ASF headers, Desktop/CLI license checks, and git diff --check passed.
• 139 bot/network/model-transport tests and 72 CI/package tests passed. Production dependency closure checks confirmed the SDK removal.
• Earlier extended Host validation: 152 passed, 5 failed, 3 skipped. All five failures (implementation-child completion, SQLite cleanup, and three OAuth publication cases) also reproduced in an isolated pre-change checkout at 5d24c3c59; they are not fixed here.
• Knip for Desktop/UI is not green: it reports unused files/exports and dependency/binary declarations. Those findings were not cleaned up in this extraction. Full workspace tests and Electron E2E were not run.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex implemented the extraction, migrated consumers/tests, ran validation, and drafted this PR. The commit includes a Generated-by trailer.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally — the extended Host failures are disclosed above.

Does this PR entail a change in behavior?

• Yes — private package import paths and installation dependencies change as described above; Session behavior is unchanged.
• No

中文说明

概述

目前机器人投递模块使所有 runtime 使用方都带上 IM SDK。直接拆包但保留 runtime 转导出，仍会保留这条依赖；如果 bots 同时依赖 runtime，还会形成循环。

• 将机器人桥接实现及测试迁入 @maka/bots，将共享代理传输能力迁入 @maka/network。两个包均不依赖 runtime；Desktop 继续通过现有回调将机器人消息连接到 Session 执行。
• 同步调用方、工作区构建、CI 选择和许可证清单。Runtime 与 CLI 不再携带 Slack、飞书、企业微信 SDK；ws 仍用于 OpenAI Responses WebSocket 传输，因此保留。

解决 #3910。

兼容性

这里明确调整 issue 的旧入口兼容要求：删除 @maka/runtime/bots 及已迁移的 runtime 网络导出，不保留转导出。这些是私有工作区包，已知调用方均在本次统一迁移。机器人从 @maka/bots 导入，网络传输从 @maka/network/* 导入。不涉及 Session 或持久化数据迁移。

验证

• 在基于 ac59b47b7 的 PR 工作区完成干净的 npm ci --ignore-scripts，npm run build:test、完整 npm run build 和 npm run typecheck 均通过。
• 全仓 lint/格式检查、ASF 许可证头、Desktop/CLI 许可证检查及 git diff --check 均通过。
• 139 项机器人／网络／模型传输测试和 72 项 CI／打包测试通过。生产依赖树检查确认专用 SDK 已移除。
• 此前扩展 Host 验证为 152 项通过、5 项失败、3 项跳过。这 5 项失败涉及实现子任务结束、SQLite 清理及三个 OAuth 发布场景，在修改前的独立工作区 5d24c3c59 中也全部复现；本次不修改这些问题。
• Desktop/UI 的 Knip 检查未通过，报告了未使用文件／导出及依赖／命令声明问题。本次拆包没有顺带清理这些报告。未运行全部工作区测试或 Electron E2E。

AI 使用

生成式工具有实质贡献。OpenAI Codex 完成拆包、调用方和测试迁移、验证及 PR 草稿；提交包含 Generated-by 标记。

检查清单

• 测试覆盖本次改动，未实施改动时相关边界测试会失败。
• 不宣称全部相关测试通过：lint、格式和类型检查通过，扩展 Host 的失败已在上方披露。
• 行为变化：私有包的导入路径和安装依赖发生变化，Session 行为不变。

[me2seeks]

Automated review notice: This comment was posted by an automated review agent operated by me2seeks make. It is not an independent human review and does not replace one.

Summary

Extracts bots and shared network code into their own packages: packages/bots gains 15 bridge/adapter modules (base-adapter, bot-registry, dingtalk/discord/feishu/gateway/qq/slack/telegram/wechat/wecom bridges, ws-bridge-base, bot-test, types, index) and packages/network gains the 5 proxy modules (active-proxy-state, bypass-matcher, proxied-fetch, proxy-dispatcher, proxy-env) — moved out of the runtime package behind the same call sites, with bot-incoming lifecycle/typing/project-cwd tests, runtime-host-client-uds, the streaming-remount e2e, and the renderer-architecture checker updated for the new package boundaries. Addon builds (all four platforms) and the immutable-tarball lane pass.

Findings

1. [P3] Only the addon-build and tarball lanes ran on this head — for a package-boundary refactor of the bot bridges and proxy layer, the test lane must run green to prove no bridge import or proxy singleton broke in the move.

Verdict

merge-ready — correct package extraction with the bot/network surfaces moving intact; request the runtime test lane.

[github-actions]

This pull request has had no new commits for 30 days and has been marked stale. It will be closed in 7 days unless a new commit is pushed.

Comments do not reset this timer: only a new commit does. If the pull request is intentionally long-lived, a maintainer can apply the pinned label.

[github-actions]

This pull request has been closed because it received no new commits during the 7-day grace period. This is not a judgement on the merit of the change; it only keeps the review queue aligned with work that is actively in flight.

The branch and review history are preserved. Push a new commit and reopen the pull request whenever the work is ready to continue.