feat: 组合包配置以包内 config/ 为唯一来源，并新增受保护写入人工审批

配置统一：权限策略、硬防御、Tool Search、提示词封面以及新迁入的
RTK、pi-compaction、pi-worktree、pi-hermes-memory 配置全部由扩展
直接读取已安装组合包内的 config/，pi install / pi update 即完成部署；
删除 rebuild-bundle-config.mjs 与 bundle-manifest.json，my-pi/ 只保留
日志与缓存。update.sh 成功升级后将默认 git 来源的已安装副本
reset 回发布版本。AGENTS.md 新增「组合包配置原则」。

脚本整合：search_config.sh / ssh_config.sh 合并为 configure.sh
search|ssh；install.sh / update.sh 共享函数抽到 scripts/lib.sh，远程
安装器改为先下载到临时文件再执行，下载失败可被检测。

权限：hard-guards 新增 protectedWrites，写入 Pi 凭据/设置、已安装
组合包与扩展目录、pi-ssh 凭据库时一律人工确认（跳过 AutoReview、
yolo 与 Session grant，无 UI 时拒绝）；放行 ls、LSP 查询、ctx 只读、
web_search、Chrome 只读与 git 只读命令，skill_manage 改为 ask。

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

pi-permission-system/src/authority/authorizer-selection.ts

@@ -6,9 +6,11 @@ import {
   type NamedAuthorizer,
   type SelectedAuthority,
   selectAuthorizer,
+  type TerminalAuthorizer,
 } from "./authorizer";
 import { composeAuthorizerChain } from "./authorizer-chain";
 import type { AuthorizerLookup } from "./authorizer-registry";
+import { LocalUserAuthorizer } from "./local-user-authorizer";
 import type {
   PermissionPrompterApi,
   PromptPermissionDetails,
@@ -172,6 +174,27 @@ export class AuthorizerSelection
         new Error("escalate called before the session was activated"),
       );
     }
+    // A protected-write ask is human-only: it composes with zero links (no
+    // AutoReview), and a terminal that is not the local UI — a denying node,
+    // a `ParentAuthorizer` relay, or a session with no UI — cannot confirm
+    // it, so it denies without prompting.
+    if (details.humanOnly) {
+      if (!(authority.terminal instanceof LocalUserAuthorizer)) {
+        return this.deps.prompter.prompt(
+          new ProtectedWriteUnavailableAuthorizer(),
+          details,
+        );
+      }
+      return this.deps.prompter.prompt(
+        composeAuthorizerChain(
+          [],
+          authority.terminal,
+          this.deps.getPermissionQuery(),
+          this.deps.logger,
+        ),
+        details,
+      );
+    }
     const chain = composeAuthorizerChain(
       this.linksFor(authority, details.requestId),
       authority.terminal,
@@ -181,3 +204,26 @@ export class AuthorizerSelection
     return this.deps.prompter.prompt(chain, details);
   }
 }
+
+/**
+ * The human-only terminal for a protected-write ask on a node with no local
+ * UI: answers with a fixed denial, marked `confirmationUnavailable` so the
+ * review log and decision event record that no human ever ruled rather than
+ * a user denial (#719). Routed through `PermissionPrompter` so the
+ * waiting/denied review entries are written like any other escalated ask.
+ */
+class ProtectedWriteUnavailableAuthorizer implements TerminalAuthorizer {
+  authorize(): Promise<PermissionPromptDecision> {
+    return Promise.resolve({
+      approved: false,
+      state: "denied_with_reason",
+      denialReason:
+        "写入受保护文件需要人工确认，但当前没有可用的确认界面",
+      confirmationUnavailable: true,
+      decidedBy: {
+        kind: "unavailable",
+        reason: "protected_write_no_local_ui",
+      },
+    });
+  }
+}

pi-permission-system/src/authority/local-user-authorizer.ts

@@ -76,6 +76,11 @@ function buildRequestOptions(
   const notes = details.deferNotes;
   const withNotes =
     notes && notes.length > 0 ? { deferNotes: notes } : undefined;
+  // A protected-write ask offers no session grant at all — a human must
+  // confirm every write, so the option is hidden rather than unrecorded.
+  if (details.humanOnly) {
+    return { hideSessionOption: true, ...withNotes };
+  }
   if (details.forwarding && details.sessionApproval && pattern) {
     return {
       sessionScope: buildForwardedScopeLabels(

pi-permission-system/src/authority/permission-dialog.ts

@@ -119,6 +119,12 @@ export interface RequestPermissionOptions {
    * deterministic, code-authored sentence.
    */
   deferNotes?: readonly PromptDecisionNote[];
+  /**
+   * Protected-write asks only: suppress the "for this session" option
+   * entirely — a human-only write must be confirmed every time, so the
+   * session grant is not offered rather than merely unrecorded.
+   */
+  hideSessionOption?: boolean;
 }
 
 export async function requestPermissionDecisionFromUi(
@@ -130,7 +136,7 @@ export async function requestPermissionDecisionFromUi(
   const sessionOption = options?.sessionLabel ?? APPROVE_FOR_SESSION_OPTION;
   const decisionOptions = [
     APPROVE_OPTION,
-    sessionOption,
+    ...(options?.hideSessionOption ? [] : [sessionOption]),
     DENY_OPTION,
     DENY_WITH_REASON_OPTION,
   ] as const;

pi-permission-system/src/authority/permission-prompt-component.ts

@@ -16,6 +16,7 @@ import {
   type UnattributedDecision,
 } from "#src/authority/permission-dialog";
 import {
+  enabledPromptKeys,
   initialPromptState,
   type PromptEvent,
   type PromptKey,
@@ -139,8 +140,6 @@ const OPTION_LABELS: Record<PromptKey, string> = {
   r: "No, provide reason",
 };
 
-const OPTION_ORDER: readonly PromptKey[] = ["y", "s", "n", "r"];
-
 export function presentInlinePermissionPrompt(
   view: PermissionPromptView,
   title: string,
@@ -151,6 +150,7 @@ export function presentInlinePermissionPrompt(
     doublePressToConfirm: view.doublePressToConfirm,
     sessionLabel: options?.sessionLabel ?? DEFAULT_SESSION_LABEL,
     sessionScope: options?.sessionScope,
+    hideSessionOption: options?.hideSessionOption,
   };
   return view.ui.custom<UnattributedDecision>(
     (tui, theme, keybindings, done) =>
@@ -341,7 +341,9 @@ class PermissionPromptComponent implements Component {
       return { type: "cancel" };
     }
     if (this.state.step === "decision") {
-      const key = OPTION_ORDER.find((option) => matchesKey(data, option));
+      const key = enabledPromptKeys(this.config).find((option) =>
+        matchesKey(data, option),
+      );
       if (key) {
         return { type: "hotkey", key };
       }
@@ -365,7 +367,7 @@ class PermissionPromptComponent implements Component {
   private renderDecision(width: number): string[] {
     const ask = this.renderAsk(width);
     const lines = [this.theme.fg("accent", this.title), ...ask.lines, ""];
-    for (const key of OPTION_ORDER) {
+    for (const key of enabledPromptKeys(this.config)) {
       const label = key === "s" ? this.config.sessionLabel : OPTION_LABELS[key];
       const selected = this.state.highlightedKey === key;
       const marker = selected ? "▶" : " ";

pi-permission-system/src/authority/permission-prompt-decision.ts

@@ -30,6 +30,21 @@ const OPTION_VERBS: Record<PromptKey, string> = {
   r: "deny with a reason",
 };
 
+/**
+ * The keys this prompt offers: `OPTION_ORDER` minus `s` when
+ * {@link PromptModelConfig.hideSessionOption} suppresses the session grant
+ * (a protected-write ask must be confirmed every time). Shared by the
+ * reducer and the component renderer so the two never disagree about which
+ * options exist.
+ */
+export function enabledPromptKeys(
+  config: PromptModelConfig,
+): readonly PromptKey[] {
+  return config.hideSessionOption
+    ? OPTION_ORDER.filter((key) => key !== "s")
+    : OPTION_ORDER;
+}
+
 /** Static configuration for a single prompt presentation. */
 export interface PromptModelConfig {
   /** When true, a letter hotkey arms first and commits only on a second press. */
@@ -42,6 +57,11 @@ export interface PromptModelConfig {
    * default) or the whole serving session.
    */
   sessionScope?: NonNullable<RequestPermissionOptions["sessionScope"]>;
+  /**
+   * Protected-write asks only: suppress the `s` option entirely — a
+   * human-only write must be confirmed every time.
+   */
+  hideSessionOption?: boolean;
 }
 
 /** The re-render view state the component draws from. */
@@ -116,11 +136,18 @@ function reduceDecisionStep(
     case "nav":
       return render({
         ...state,
-        highlightedKey: shiftKey(state.highlightedKey, event.direction),
+        highlightedKey: shiftKey(
+          state.highlightedKey,
+          event.direction,
+          enabledPromptKeys(config),
+        ),
         armedKey: undefined,
         hint: "",
       });
     case "hotkey":
+      if (!enabledPromptKeys(config).includes(event.key)) {
+        return render(state);
+      }
       return pressHotkey(config, state, event.key);
     case "confirm":
       return commit(config, state, state.highlightedKey);
@@ -245,11 +272,16 @@ function reduceScopeStep(
   }
 }
 
-function shiftKey(current: PromptKey, direction: "up" | "down"): PromptKey {
-  const index = OPTION_ORDER.indexOf(current);
+function shiftKey(
+  current: PromptKey,
+  direction: "up" | "down",
+  keys: readonly PromptKey[],
+): PromptKey {
+  const index = keys.indexOf(current);
+  if (index === -1) return keys[0] ?? current;
   const delta = direction === "down" ? 1 : -1;
-  const next = (index + delta + OPTION_ORDER.length) % OPTION_ORDER.length;
-  return OPTION_ORDER[next] ?? current;
+  const next = (index + delta + keys.length) % keys.length;
+  return keys[next] ?? current;
 }
 
 function render(state: PromptViewState): PromptOutcome {

pi-permission-system/src/authority/permission-prompter.ts

@@ -79,6 +79,13 @@ export interface PromptPermissionDetails {
    * model-generated), `system` is a code-authored sentence.
    */
   deferNotes?: readonly DeferNote[];
+  /**
+   * Marks the protected-write escalation path: the ask must reach the local
+   * human terminal directly — no `authorizerChain` links (AutoReview), no
+   * session-grant option, and a terminal without a local UI denies without
+   * prompting. Set by `GateRunner` from the descriptor's `humanOnly` marker.
+   */
+  humanOnly?: boolean;
 }
 
 /**