feat: 组合包配置以包内 config/ 为唯一来源，并新增受保护写入人工审批

配置统一：权限策略、硬防御、Tool Search、提示词封面以及新迁入的
RTK、pi-compaction、pi-worktree、pi-hermes-memory 配置全部由扩展
直接读取已安装组合包内的 config/，pi install / pi update 即完成部署；
删除 rebuild-bundle-config.mjs 与 bundle-manifest.json，my-pi/ 只保留
日志与缓存。update.sh 成功升级后将默认 git 来源的已安装副本
reset 回发布版本。AGENTS.md 新增「组合包配置原则」。

脚本整合：search_config.sh / ssh_config.sh 合并为 configure.sh
search|ssh；install.sh / update.sh 共享函数抽到 scripts/lib.sh，远程
安装器改为先下载到临时文件再执行，下载失败可被检测。

权限：hard-guards 新增 protectedWrites，写入 Pi 凭据/设置、已安装
组合包与扩展目录、pi-ssh 凭据库时一律人工确认（跳过 AutoReview、
yolo 与 Session grant，无 UI 时拒绝）；放行 ls、LSP 查询、ctx 只读、
web_search、Chrome 只读与 git 只读命令，skill_manage 改为 ask。

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

pi-permission-system/test/config-loader.test.ts

@@ -1,6 +1,6 @@
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
 
 import {
@@ -673,13 +673,14 @@ describe("loadAndMergeConfigs", () => {
   let tempDir: string;
   let agentDir: string;
   let cwd: string;
-  let extensionRoot: string;
+  let globalConfigPath: string;
 
   beforeEach(() => {
     tempDir = mkdtempSync(join(tmpdir(), "config-merge-test-"));
     agentDir = join(tempDir, "agent");
     cwd = join(tempDir, "project");
-    extensionRoot = join(tempDir, "ext");
+    // Tests inject a temp policy path; the bundle config/ file is never touched.
+    globalConfigPath = join(tempDir, "config", "pi-permission-policy.jsonc");
   });
 
   afterEach(() => {
@@ -687,9 +688,8 @@ describe("loadAndMergeConfigs", () => {
   });
 
   function writeGlobal(content: Record<string, unknown>): void {
-    const dir = join(agentDir, "my-pi", "permission-system");
-    mkdirSync(dir, { recursive: true });
-    writeFileSync(join(dir, "policy.jsonc"), JSON.stringify(content));
+    mkdirSync(dirname(globalConfigPath), { recursive: true });
+    writeFileSync(globalConfigPath, JSON.stringify(content));
   }
 
   function writeProject(content: Record<string, unknown>): void {
@@ -712,72 +712,26 @@ describe("loadAndMergeConfigs", () => {
     writeFileSync(join(dir, "pi-permissions.jsonc"), JSON.stringify(content));
   }
 
-  function writeLegacyExtensionConfig(content: Record<string, unknown>): void {
-    mkdirSync(extensionRoot, { recursive: true });
-    writeFileSync(join(extensionRoot, "config.json"), JSON.stringify(content));
-  }
 
-
-  it("detects legacy global policy and emits migration issue", () => {
+  it("ignores leftover files at legacy locations", () => {
     writeLegacyGlobalPolicy({
       defaultPolicy: { tools: "allow" },
       tools: { read: "allow" },
     });
-
-    const result = loadAndMergeConfigs(agentDir, cwd, extensionRoot);
-    expect(result.issues).toHaveLength(1);
-    expect(result.issues[0]).toContain("pi-permissions.jsonc");
-    expect(result.issues[0]).toContain("my-pi/permission-system");
-    // Legacy file has no flat-format permission key — no rules extracted
-    expect(result.merged.permission).toBeUndefined();
-  });
-
-
-  it("detects legacy extension runtime config and emits migration issue", () => {
-    writeLegacyExtensionConfig({
-      debugLog: true,
-      yoloMode: true,
-    });
-
-    const result = loadAndMergeConfigs(agentDir, cwd, extensionRoot);
-    expect(result.issues).toHaveLength(1);
-    expect(result.issues[0]).toContain(extensionRoot);
-    expect(result.merged.debugLog).toBe(true);
-    expect(result.merged.yoloMode).toBe(true);
-  });
-
-  it("does not emit legacy extension config issue when its path equals the runtime legacy path", () => {
-    const newGlobalDir = join(agentDir, "extensions", "pi-permission-system");
-    mkdirSync(newGlobalDir, { recursive: true });
-    writeFileSync(
-      join(newGlobalDir, "config.json"),
-      JSON.stringify({ debugLog: true }),
-    );
-
-    const result = loadAndMergeConfigs(agentDir, cwd, newGlobalDir);
-    expect(result.issues.filter((i) => i.includes("legacy"))).toHaveLength(0);
-  });
-
-  it("emits no issues when no legacy files exist and no new files exist", () => {
-    const result = loadAndMergeConfigs(agentDir, cwd, extensionRoot);
-    expect(result.issues).toEqual([]);
-  });
-
-  it("new-layout config takes precedence over legacy config at same scope", () => {
     writeGlobal({
       permission: { "*": "deny" },
     });
-    writeLegacyGlobalPolicy({
-      permission: { "*": "allow" },
-    });
 
-    const result = loadAndMergeConfigs(agentDir, cwd, extensionRoot);
-    // New layout wins (legacy loaded first, new layout loaded second → new wins)
+    const result = loadAndMergeConfigs(globalConfigPath);
+    // The legacy file is simply ignored — never merged, never flagged.
+    expect(result.issues).toEqual([]);
     expect(result.merged.permission).toEqual({ "*": "deny" });
-    // But legacy still emits a migration warning
-    expect(result.issues.some((i) => i.includes("pi-permissions.jsonc"))).toBe(
-      true,
-    );
+  });
+
+  it("emits no issues when no config file exists", () => {
+    const result = loadAndMergeConfigs(globalConfigPath);
+    expect(result.issues).toEqual([]);
+    expect(result.merged).toEqual({});
   });
 
   it("warns when the merged config leaves bash inheriting a permissive top-level '*'", () => {
@@ -785,7 +739,7 @@ describe("loadAndMergeConfigs", () => {
       permission: { "*": "allow", read: "allow" },
     });
 
-    const result = loadAndMergeConfigs(agentDir, cwd, extensionRoot);
+    const result = loadAndMergeConfigs(globalConfigPath);
     expect(result.issues.some((i) => i.includes("bash"))).toBe(true);
   });
 
@@ -794,7 +748,7 @@ describe("loadAndMergeConfigs", () => {
       permission: { "*": "allow", bash: { "*": "ask" } },
     });
 
-    const result = loadAndMergeConfigs(agentDir, cwd, extensionRoot);
+    const result = loadAndMergeConfigs(globalConfigPath);
     expect(result.issues).toEqual([]);
   });
 
@@ -803,7 +757,7 @@ describe("loadAndMergeConfigs", () => {
     writeProject({ permission: { bash: "allow" } });
     writeLegacyProjectPolicy({ permission: { "*": "allow" } });
 
-    const result = loadAndMergeConfigs(agentDir, cwd, extensionRoot);
+    const result = loadAndMergeConfigs(globalConfigPath);
 
     expect(result.merged.permission).toEqual({ "*": "ask", bash: "deny" });
     expect(result.issues).toEqual([]);
@@ -816,7 +770,7 @@ describe("loadAndMergeConfigs", () => {
         toolInputPreviewMaxLength: 400,
       });
 
-      const result = loadAndMergeConfigs(agentDir, cwd, extensionRoot);
+      const result = loadAndMergeConfigs(globalConfigPath);
 
       expect(result.issues).toHaveLength(1);
       expect(result.issues[0]).toContain("toolInputPreviewMaxLength");
@@ -828,7 +782,7 @@ describe("loadAndMergeConfigs", () => {
         toolTextSummaryMaxLength: 120,
       });
 
-      const result = loadAndMergeConfigs(agentDir, cwd, extensionRoot);
+      const result = loadAndMergeConfigs(globalConfigPath);
 
       expect(result.merged.permission).toEqual({ "*": "ask", bash: "deny" });
     });
@@ -836,7 +790,7 @@ describe("loadAndMergeConfigs", () => {
     it("stays silent when neither cap is set", () => {
       writeGlobal({ permission: { "*": "ask", bash: "deny" } });
 
-      const result = loadAndMergeConfigs(agentDir, cwd, extensionRoot);
+      const result = loadAndMergeConfigs(globalConfigPath);
 
       expect(result.issues).toEqual([]);
     });