feat: 组合包配置以包内 config/ 为唯一来源，并新增受保护写入人工审批

配置统一：权限策略、硬防御、Tool Search、提示词封面以及新迁入的 RTK、pi-compaction、pi-worktree、pi-hermes-memory 配置全部由扩展直接读取已安装组合包内的 config/，pi install / pi update 即完成部署；删除 rebuild-bundle-config.mjs 与 bundle-manifest.json，my-pi/ 只保留日志与缓存。update.sh 成功升级后将默认 git 来源的已安装副本 reset 回发布版本。AGENTS.md 新增「组合包配置原则」。脚本整合：search_config.sh / ssh_config.sh 合并为 configure.sh search|ssh；install.sh / update.sh 共享函数抽到 scripts/lib.sh，远程安装器改为先下载到临时文件再执行，下载失败可被检测。权限：hard-guards 新增 protectedWrites，写入 Pi 凭据/设置、已安装组合包与扩展目录、pi-ssh 凭据库时一律人工确认（跳过 AutoReview、 yolo 与 Session grant，无 UI 时拒绝）；放行 ls、LSP 查询、ctx 只读、 web_search、Chrome 只读与 git 只读命令，skill_manage 改为 ask。 Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-26 18:55:22 +00:00 · 2026-10-20 01:05:31 -07:00
parent a0ee9389c7
commit 2aa1be0b54
105 changed files with 2337 additions and 1413 deletions
@@ -467,4 +467,75 @@ describe("AuthorizerSelection", () => {
      );
    });
  });
+
+  describe("human-only asks (protected writes)", () => {
+    const humanOnlyDetails = (): PromptPermissionDetails =>
+      makeDetails({ humanOnly: true });
+
+    it("goes straight to the local user and never runs configured links", async () => {
+      const link = vi
+        .fn<Authorizer["authorize"]>()
+        .mockResolvedValue({ kind: "allow" });
+      const registry = new AuthorizerRegistry();
+      registry.register("judge", link);
+      const prompter = makePrompterApi();
+      const selection = new AuthorizerSelection(
+        makeDeps({
+          prompter,
+          authorizerRegistry: registry,
+          getAuthorizerChain: () => ["judge"],
+        }),
+      );
+      selection.activate(makeCtx({ hasUI: true }));
+
+      await selection.escalate(humanOnlyDetails());
+
+      expect(link).not.toHaveBeenCalled();
+      expect(prompter.prompt).toHaveBeenCalledWith(
+        expect.any(LocalUserAuthorizer),
+        expect.anything(),
+      );
+    });
+
+    it("denies without prompting when the terminal is DenyingAuthorizer", async () => {
+      const prompter = makeInvokingPrompter();
+      const selection = new AuthorizerSelection(makeDeps({ prompter }));
+      // No UI, not a subagent → DenyingAuthorizer terminal.
+      selection.activate(makeCtx({ hasUI: false }));
+
+      const decision = await selection.escalate(humanOnlyDetails());
+
+      expect(decision).toEqual({
+        approved: false,
+        state: "denied_with_reason",
+        denialReason:
+          "写入受保护文件需要人工确认，但当前没有可用的确认界面",
+        confirmationUnavailable: true,
+        decidedBy: {
+          kind: "unavailable",
+          reason: "protected_write_no_local_ui",
+        },
+      });
+      expect(prompter.prompt).toHaveBeenCalledOnce();
+    });
+
+    it("denies instead of relaying to a parent on a subagent node", async () => {
+      const prompter = makeInvokingPrompter();
+      const selection = new AuthorizerSelection(
+        makeDeps({ detection: makeDetection(true), prompter }),
+      );
+      selection.activate(makeCtx({ hasUI: false }));
+
+      const decision = await selection.escalate(humanOnlyDetails());
+
+      // ParentAuthorizer.forward would have been invoked if relaying were
+      // still allowed; instead the human-only denial is returned.
+      expect(decision.approved).toBe(false);
+      expect(decision.state).toBe("denied_with_reason");
+      expect(decision.denialReason).toBe(
+        "写入受保护文件需要人工确认，但当前没有可用的确认界面",
+      );
+      expect(prompter.prompt).toHaveBeenCalledOnce();
+    });
+  });
 });