feat: 组合包配置以包内 config/ 为唯一来源，并新增受保护写入人工审批

配置统一：权限策略、硬防御、Tool Search、提示词封面以及新迁入的
RTK、pi-compaction、pi-worktree、pi-hermes-memory 配置全部由扩展
直接读取已安装组合包内的 config/，pi install / pi update 即完成部署；
删除 rebuild-bundle-config.mjs 与 bundle-manifest.json，my-pi/ 只保留
日志与缓存。update.sh 成功升级后将默认 git 来源的已安装副本
reset 回发布版本。AGENTS.md 新增「组合包配置原则」。

脚本整合：search_config.sh / ssh_config.sh 合并为 configure.sh
search|ssh；install.sh / update.sh 共享函数抽到 scripts/lib.sh，远程
安装器改为先下载到临时文件再执行，下载失败可被检测。

权限：hard-guards 新增 protectedWrites，写入 Pi 凭据/设置、已安装
组合包与扩展目录、pi-ssh 凭据库时一律人工确认（跳过 AutoReview、
yolo 与 Session grant，无 UI 时拒绝）；放行 ls、LSP 查询、ctx 只读、
web_search、Chrome 只读与 git 只读命令，skill_manage 改为 ask。

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

config/bundle-manifest.json

@@ -1,10 +0,0 @@
-{
-  "version": 1,
-  "directory": "my-pi",
-  "files": [
-    { "source": "config/pi-permission-policy.jsonc", "target": "permission-system/policy.jsonc" },
-    { "source": "config/pi-permission-hard-guards.jsonc", "target": "permission-system/hard-guards.jsonc" },
-    { "source": "config/tool-search.json", "target": "tool-search/config.json" },
-    { "source": "config/system-prompt-cover.md", "target": "system-prompt-cover.md" }
-  ]
-}

config/pi-compaction.json

@@ -0,0 +1,22 @@
+{
+  "enabled": true,
+  "softRatio": 0.72,
+  "hardRatio": 0.9,
+  "targetRatio": 0.55,
+  "deterministic": {
+    "enabled": true,
+    "maxStubTokens": 1024
+  },
+  "semantic": {
+    "enabled": true,
+    "model": "default",
+    "thinking": "low",
+    "concurrency": 1,
+    "minInputChars": 4000,
+    "maxInputChars": 24000,
+    "maxRetries": 2
+  },
+  "native": {
+    "enabled": true
+  }
+}

config/pi-hermes-memory.json

@@ -0,0 +1,35 @@
+{
+  "lazyInitialization": false,
+  "memoryMode": "policy-only",
+  "memoryPolicyStyle": "full",
+  "memoryCharLimit": 5000,
+  "userCharLimit": 5000,
+  "projectCharLimit": 5000,
+  "nudgeInterval": 10,
+  "reviewRecentMessages": 0,
+  "reviewEnabled": true,
+  "reviewTransport": "direct",
+  "flushOnCompact": true,
+  "flushOnShutdown": true,
+  "flushMinTurns": 6,
+  "flushRecentMessages": 0,
+  "flushCompactTimeoutMs": 60000,
+  "memoryOverflowStrategy": "auto-consolidate",
+  "overflowGraceMs": 180000,
+  "autoConsolidate": true,
+  "correctionDetection": true,
+  "failureInjectionEnabled": true,
+  "failureInjectionMaxAgeDays": 7,
+  "failureInjectionMaxEntries": 5,
+  "consolidationChunking": false,
+  "consolidationChunkChars": 4000,
+  "consolidationTimeoutMs": 180000,
+  "usageHitTrackingEnabled": true,
+  "consolidationUsageSignals": true,
+  "autoConsolidationWarnOnFailure": true,
+  "nudgeToolCalls": 15,
+  "standingInstructionsEnabled": true,
+  "sessionSearch": { "variant": "legacy" },
+  "quickCheckOnOpen": true,
+  "sessionRetentionDays": 0
+}

config/pi-permission-hard-guards.jsonc

@@ -1,6 +1,7 @@
 {
-  // Bundle default. The installed user-level copy is seeded once and may then
-  // be edited by the user; project configuration cannot override it.
+  // Bundle-owned hard guards, read directly from the installed bundle's
+  // config/ directory. pi update overwrites this file; project configuration
+  // cannot override it.
   "version": 1,
   "permission": {
     "bash": {
@@ -13,5 +14,22 @@
       "mkfs*": "deny",
       "dd * of=/dev/*": "deny"
     }
-  }
+  },
+  // Writes to the files below always reach a human prompt — never AutoReview,
+  // never yolo, never an existing session grant — and are denied outright when
+  // no confirmation UI is available. Reads are unaffected. `*` crosses `/`, so
+  // `/**` covers a whole subtree. `{agentDir}` is the Pi agent directory,
+  // `{configHome}` is $XDG_CONFIG_HOME or ~/.config; a leading `~/` also works.
+  "protectedWrites": [
+    { "pattern": "{agentDir}/auth.json", "label": "Pi 凭据（模型与搜索 API key）" },
+    { "pattern": "{agentDir}/settings.json", "label": "Pi 全局设置" },
+    { "pattern": "{agentDir}/models.json", "label": "Pi 模型配置" },
+    { "pattern": "{agentDir}/trust.json", "label": "项目信任记录" },
+    { "pattern": "{agentDir}/hashline.json", "label": "Hashline 配置" },
+    { "pattern": "{agentDir}/lsp.json", "label": "LSP 配置" },
+    { "pattern": "{agentDir}/git/**", "label": "已安装的组合包（含 config/ 与权限系统源码）" },
+    { "pattern": "{agentDir}/npm/**", "label": "已安装的 npm 扩展" },
+    { "pattern": "{agentDir}/extensions/**", "label": "Pi 自动加载的扩展目录" },
+    { "pattern": "{configHome}/my-pi/**", "label": "pi-ssh 凭据库与 p10k 配置" }
+  ]
 }

config/pi-permission-policy.jsonc

@@ -38,13 +38,31 @@
     "grep": "allow",
     "find": "allow",
     "multi_grep": "allow",
+    "ls": "allow",
     "codegraph_explore": "allow",
     "lsp_diagnostics": "allow",
+    "lsp_definition": "allow",
+    "lsp_references": "allow",
+    "lsp_hover": "allow",
+    "lsp_symbols": "allow",
     "ctx_execute": "allow",
     "ctx_execute_file": "allow",
     "ctx_batch_execute": "allow",
+    "ctx_search": "allow",
+    "ctx_index": "allow",
+    "ctx_stats": "allow",
+    "ctx_doctor": "allow",
     "tool_search": "allow",
     "ask_user_question": "allow",
+    "web_search": "allow",
+    "chrome_snapshot": "allow",
+    "chrome_find": "allow",
+    "chrome_inspect": "allow",
+    "chrome_wait_for": "allow",
+    "chrome_screenshot": "allow",
+    "chrome_list_console_messages": "allow",
+    "chrome_list_network_requests": "allow",
+    "chrome_get_network_request": "allow",
 
     // Hermes memory tools write only to the extension's own agent-directory
     // stores and never touch the workspace, so they stay allowed. memory_search
@@ -55,12 +73,18 @@
     "memory_add": "allow",
     "memory_replace": "allow",
     "memory_remove": "allow",
-    "skill_manage": "allow",
+    // Skills skill_manage writes are loaded into every future session, so
+    // their creation stays human-reviewed.
+    "skill_manage": "ask",
     // pi-compaction's evidence recovery reads only the extension's own segment
     // index and never touches the workspace. It is pinned in Tool Search's
     // alwaysEnabled set, so it must not pay an AutoReview round trip per turn.
     "context_tree_query": "allow",
 
+    // Model-chosen URLs can exfiltrate data — same reason curl/wget ask.
+    "web_fetch": "ask",
+    "ctx_fetch_and_index": "ask",
+
     "ssh_connect": "ask",
     "ssh_cd": "ask",
     "ssh_read": "ask",
@@ -91,6 +115,20 @@
       "git branch --show-current*": "allow",
       "git remote -v": "allow",
       "git remote get-url*": "allow",
+      "git blame*": "allow",
+      "git describe*": "allow",
+      "git rev-list*": "allow",
+      "git merge-base*": "allow",
+      "git ls-tree*": "allow",
+      "git cat-file*": "allow",
+      "git name-rev*": "allow",
+      "git shortlog*": "allow",
+      "git stash list*": "allow",
+      "git worktree list*": "allow",
+      "git tag -l*": "allow",
+      "git tag --list*": "allow",
+      "git config --get*": "allow",
+      "git config --list*": "allow",
       "npm install *": "ask",
       "npm add *": "ask",
       "npm uninstall *": "ask",

config/pi-worktree.json

@@ -0,0 +1,4 @@
+{
+  "root": "~/.pi/worktrees",
+  "branchPrefix": "wt/"
+}

config/rtk-optimizer.json

@@ -0,0 +1,30 @@
+{
+  "enabled": true,
+  "commandRewritingEnabled": false,
+  "mode": "rewrite",
+  "guardWhenRtkMissing": true,
+  "showRewriteNotifications": true,
+  "outputCompaction": {
+    "enabled": true,
+    "stripAnsi": true,
+    "readCompaction": {
+      "enabled": false
+    },
+    "truncate": {
+      "enabled": true,
+      "maxChars": 12000
+    },
+    "sourceCodeFilteringEnabled": false,
+    "preserveExactSkillReads": false,
+    "sourceCodeFiltering": "none",
+    "smartTruncate": {
+      "enabled": false,
+      "maxLines": 220
+    },
+    "aggregateTestOutput": true,
+    "filterBuildOutput": true,
+    "compactGitOutput": true,
+    "aggregateLinterOutput": true,
+    "trackSavings": true
+  }
+}