feat: 组合包配置以包内 config/ 为唯一来源，并新增受保护写入人工审批

配置统一：权限策略、硬防御、Tool Search、提示词封面以及新迁入的
RTK、pi-compaction、pi-worktree、pi-hermes-memory 配置全部由扩展
直接读取已安装组合包内的 config/，pi install / pi update 即完成部署；
删除 rebuild-bundle-config.mjs 与 bundle-manifest.json，my-pi/ 只保留
日志与缓存。update.sh 成功升级后将默认 git 来源的已安装副本
reset 回发布版本。AGENTS.md 新增「组合包配置原则」。

脚本整合：search_config.sh / ssh_config.sh 合并为 configure.sh
search|ssh；install.sh / update.sh 共享函数抽到 scripts/lib.sh，远程
安装器改为先下载到临时文件再执行，下载失败可被检测。

权限：hard-guards 新增 protectedWrites，写入 Pi 凭据/设置、已安装
组合包与扩展目录、pi-ssh 凭据库时一律人工确认（跳过 AutoReview、
yolo 与 Session grant，无 UI 时拒绝）；放行 ls、LSP 查询、ctx 只读、
web_search、Chrome 只读与 git 只读命令，skill_manage 改为 ask。

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

pi-permission-system/test/handlers/gates/protected-write-runner.test.ts

@@ -0,0 +1,117 @@
+import { describe, expect, it, vi } from "vitest";
+
+import { protectedWriteDeferNote } from "#src/handlers/gates/protected-write";
+import type { ProtectedWriteTarget } from "#src/handlers/gates/descriptor";
+import type { PermissionCheckResult } from "#src/types";
+
+import { DECIDED_BY_HUMAN } from "#test/helpers/decision-fixtures";
+import { makeDescriptor, makeGateRunner } from "#test/helpers/gate-fixtures";
+import { makeCheckResult } from "#test/helpers/handler-fixtures";
+
+const MARKER: ProtectedWriteTarget = {
+  path: "/vault/auth.json",
+  pattern: "/vault/auth.json",
+  label: "Pi 凭据",
+  extraCount: 0,
+};
+
+function protectedDescriptor(check: PermissionCheckResult) {
+  return makeDescriptor({
+    humanOnly: MARKER,
+    sessionApproval: undefined,
+    preCheck: check,
+  });
+}
+
+describe("GateRunner — humanOnly protected writes", () => {
+  it("still escalates when the resolved check is a session grant", async () => {
+    const { runner, deps } = makeGateRunner();
+    const outcome = await runner.run(
+      protectedDescriptor(
+        makeCheckResult({
+          state: "ask",
+          source: "session",
+          matchedPattern: "/vault/**",
+        }),
+      ),
+      null,
+    );
+
+    expect(deps.escalate).toHaveBeenCalledOnce();
+    expect(outcome).toEqual({ action: "allow" });
+    expect(deps.reporter.writeReviewLog).not.toHaveBeenCalledWith(
+      "permission_request.session_approved",
+      expect.anything(),
+    );
+  });
+
+  it("still escalates when yolo mode is enabled", async () => {
+    const { runner, deps } = makeGateRunner({ yolo: true });
+    await runner.run(
+      protectedDescriptor(
+        makeCheckResult({ state: "ask", source: "tool", origin: "builtin" }),
+      ),
+      null,
+    );
+
+    expect(deps.escalate).toHaveBeenCalledOnce();
+    expect(deps.reporter.writeReviewLog).not.toHaveBeenCalledWith(
+      "permission_request.auto_approved",
+      expect.anything(),
+    );
+  });
+
+  it("escalates with humanOnly, the system note, and no session approval", async () => {
+    const { runner, deps } = makeGateRunner();
+    await runner.run(
+      protectedDescriptor(
+        makeCheckResult({ state: "ask", source: "tool", origin: "builtin" }),
+      ),
+      null,
+    );
+
+    expect(deps.escalate).toHaveBeenCalledWith(
+      expect.objectContaining({
+        humanOnly: true,
+        deferNotes: [protectedWriteDeferNote(MARKER)],
+      }),
+    );
+    const details = vi.mocked(deps.escalate).mock.calls[0][0];
+    expect(details.sessionApproval).toBeUndefined();
+  });
+
+  it("records no session grant when the user approves", async () => {
+    const { runner, deps } = makeGateRunner({
+      escalate: vi.fn().mockResolvedValue({
+        approved: true,
+        state: "approved_for_session",
+        decidedBy: DECIDED_BY_HUMAN,
+      }),
+    });
+    const outcome = await runner.run(
+      protectedDescriptor(
+        makeCheckResult({ state: "ask", source: "tool", origin: "builtin" }),
+      ),
+      null,
+    );
+
+    // A session-shaped approval cannot be recorded: the descriptor carries no
+    // sessionApproval to grant.
+    expect(deps.recordSessionApproval).not.toHaveBeenCalled();
+    expect(outcome).toEqual({ action: "allow" });
+  });
+});
+
+describe("protectedWriteDeferNote", () => {
+  it("renders the exact system note", () => {
+    expect(protectedWriteDeferNote(MARKER)).toEqual({
+      origin: "system",
+      text: "⚠ 该操作将写入受保护文件：/vault/auth.json（Pi 凭据，匹配 /vault/auth.json）。此类写入不经 AutoReview，必须由你人工确认。",
+    });
+  });
+
+  it("adds the extra-target count", () => {
+    const note = protectedWriteDeferNote({ ...MARKER, extraCount: 2 });
+    expect(note.text).toContain("，另有 2 个受保护目标");
+  });
+});

pi-permission-system/test/handlers/gates/protected-write.test.ts

@@ -0,0 +1,300 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+// Mock node:fs so realpathSync (used by canonicalizePath) is controllable for
+// the symlink-into-protected-directory case; identity by default.
+const realpathSync = vi.hoisted(() =>
+  vi.fn<(path: string) => string>((p) => p),
+);
+vi.mock("node:fs", async () => {
+  const actual = await vi.importActual<typeof import("node:fs")>("node:fs");
+  return {
+    ...actual,
+    realpathSync,
+    default: { ...actual, realpathSync },
+  };
+});
+
+import { BashProgram } from "#src/access-intent/bash/program";
+import type { ShellInvocation } from "#src/access-intent/tool-kind";
+import {
+  type GateDescriptor,
+  type GateResult,
+  isGateDescriptor,
+} from "#src/handlers/gates/descriptor";
+import { describeProtectedWriteGate } from "#src/handlers/gates/protected-write";
+import type { ProtectedWriteRule } from "#src/hard-guard-loader";
+import { pathFlavorForPlatform } from "#src/path/path-flavor";
+import { PathNormalizer } from "#src/path-normalizer";
+
+import { makeTcc } from "#test/helpers/gate-fixtures";
+
+const CWD = "/test/project";
+
+beforeEach(() => {
+  realpathSync.mockReset();
+  realpathSync.mockImplementation((p: string) => p);
+});
+
+const PROTECTED_WRITES: ProtectedWriteRule[] = [
+  { pattern: "/vault/auth.json", label: "Pi 凭据" },
+  { pattern: "/protected/**", label: "受保护目录" },
+];
+
+function normalizer(): PathNormalizer {
+  return new PathNormalizer(pathFlavorForPlatform(process.platform), CWD);
+}
+
+async function describeBashCall(
+  command: string,
+  rules: readonly ProtectedWriteRule[] = PROTECTED_WRITES,
+) {
+  const tcc = makeTcc({ toolName: "bash", input: { command } });
+  const bashProgram = command
+    ? await BashProgram.parse(command, normalizer())
+    : null;
+  const shell: ShellInvocation = { command, workdir: undefined };
+  return describeProtectedWriteGate(
+    tcc,
+    bashProgram,
+    shell,
+    normalizer(),
+    rules,
+  );
+}
+
+function describeToolCall(
+  toolName: string,
+  input: unknown,
+  rules: readonly ProtectedWriteRule[] = PROTECTED_WRITES,
+) {
+  const tcc = makeTcc({ toolName, input });
+  return describeProtectedWriteGate(tcc, null, null, normalizer(), rules);
+}
+
+function asDescriptor(result: GateResult): GateDescriptor {
+  expect(isGateDescriptor(result)).toBe(true);
+  return result as GateDescriptor;
+}
+
+describe("describeProtectedWriteGate", () => {
+  describe("write/edit tools", () => {
+    it("prompts on a write tool targeting a protected file", () => {
+      const desc = asDescriptor(
+        describeToolCall("write", { path: "/vault/auth.json" }),
+      );
+      expect(desc.humanOnly).toEqual({
+        path: "/vault/auth.json",
+        pattern: "/vault/auth.json",
+        label: "Pi 凭据",
+        extraCount: 0,
+      });
+      expect(desc.preCheck?.state).toBe("ask");
+      expect(desc.sessionApproval).toBeUndefined();
+      expect(desc.logContext.protectedWrite).toEqual({
+        path: "/vault/auth.json",
+        pattern: "/vault/auth.json",
+        label: "Pi 凭据",
+      });
+    });
+
+    it("prompts on an edit tool targeting a protected file", () => {
+      expect(
+        isGateDescriptor(
+          describeToolCall("edit", { path: "/vault/auth.json" }),
+        ),
+      ).toBe(true);
+    });
+
+    it("does not gate a read of a protected path", () => {
+      expect(
+        describeToolCall("read", { path: "/vault/auth.json" }),
+      ).toBeNull();
+    });
+
+    it("covers a whole subtree, not just the directory root", () => {
+      expect(
+        isGateDescriptor(
+          describeToolCall("write", { path: "/protected/deep/nested/x.json" }),
+        ),
+      ).toBe(true);
+    });
+
+    it("prompts on a symlink whose target is protected", () => {
+      realpathSync.mockImplementation((p: string) =>
+        p === "/work/link" ? "/vault/auth.json" : p,
+      );
+      const desc = asDescriptor(
+        describeToolCall("write", { path: "/work/link" }),
+      );
+      expect(desc.humanOnly?.pattern).toBe("/vault/auth.json");
+    });
+  });
+
+  describe("bash writes", () => {
+    it("prompts on a redirect into a protected file", async () => {
+      expect(
+        isGateDescriptor(await describeBashCall("echo x > /vault/auth.json")),
+      ).toBe(true);
+    });
+
+    it("prompts on a redirect into a not-yet-existing protected path", async () => {
+      expect(
+        isGateDescriptor(
+          await describeBashCall("echo 1 > /protected/new-file.json"),
+        ),
+      ).toBe(true);
+    });
+
+    it("does not prompt on cat of a protected file", async () => {
+      expect(await describeBashCall("cat /vault/auth.json")).toBeNull();
+    });
+
+    it("does not prompt when a protected read feeds an unprotected write", async () => {
+      expect(
+        await describeBashCall("cat /vault/auth.json > /tmp/x"),
+      ).toBeNull();
+    });
+
+    it("does not prompt on a redirect-in read of a protected file", async () => {
+      expect(await describeBashCall("cat < /vault/auth.json")).toBeNull();
+    });
+
+    it("prompts on tee of a protected file", async () => {
+      expect(
+        isGateDescriptor(await describeBashCall("tee /vault/auth.json")),
+      ).toBe(true);
+    });
+
+    it("prompts on cp into a protected file", async () => {
+      expect(
+        isGateDescriptor(
+          await describeBashCall("cp /tmp/x /vault/auth.json"),
+        ),
+      ).toBe(true);
+    });
+
+    it("prompts on sed -i of a protected file", async () => {
+      expect(
+        isGateDescriptor(
+          await describeBashCall("sed -i s/a/b/ /vault/auth.json"),
+        ),
+      ).toBe(true);
+    });
+
+    it("prompts on an opaque bash -c payload writing a protected file", async () => {
+      expect(
+        isGateDescriptor(
+          await describeBashCall('bash -c "echo > /vault/auth.json"'),
+        ),
+      ).toBe(true);
+    });
+
+    it("prompts on a relative redirect after cd into a protected directory", async () => {
+      expect(
+        isGateDescriptor(
+          await describeBashCall("cd /protected && echo 1 > rel.json"),
+        ),
+      ).toBe(true);
+    });
+
+    it("prompts on an unparseable command containing a protected path", async () => {
+      const tcc = makeTcc({
+        toolName: "bash",
+        input: { command: "echo broken > /vault/auth.json" },
+      });
+      // Parser failure is injected: the gate must scan the text directly.
+      const shell: ShellInvocation = {
+        command: "echo broken > /vault/auth.json",
+        workdir: undefined,
+      };
+      const result = describeProtectedWriteGate(
+        tcc,
+        null,
+        shell,
+        normalizer(),
+        PROTECTED_WRITES,
+      );
+      expect(isGateDescriptor(result)).toBe(true);
+    });
+
+    it("reports the extra protected targets in the same call", async () => {
+      const desc = asDescriptor(
+        await describeBashCall(
+          "echo x > /vault/auth.json && echo y > /protected/a.json",
+        ),
+      );
+      expect(desc.humanOnly?.extraCount).toBe(1);
+    });
+  });
+
+  describe("non-local tools and empty rules", () => {
+    it("does not gate an ssh_bash-style aliased shell tool", async () => {
+      const tcc = makeTcc({
+        toolName: "ssh_bash",
+        input: { command: "echo x > /vault/auth.json" },
+      });
+      const bashProgram = await BashProgram.parse(
+        "echo x > /vault/auth.json",
+        normalizer(),
+      );
+      const shell: ShellInvocation = {
+        command: "echo x > /vault/auth.json",
+        workdir: undefined,
+      };
+      expect(
+        describeProtectedWriteGate(
+          tcc,
+          bashProgram,
+          shell,
+          normalizer(),
+          PROTECTED_WRITES,
+        ),
+      ).toBeNull();
+    });
+
+    it("returns null when no protectedWrites are configured", async () => {
+      expect(
+        await describeBashCall("echo x > /vault/auth.json", []),
+      ).toBeNull();
+      expect(
+        describeToolCall("write", { path: "/vault/auth.json" }, []),
+      ).toBeNull();
+    });
+  });
+
+  describe("bare token existence probe", () => {
+    // `auth.json` is a bare token (no path shape), so it only becomes a
+    // candidate when the resolver's existence probe finds it on disk; the
+    // probe must carry the same role/program metadata as shaped tokens.
+    it("does not prompt on a read of an existing bare-token file in a protected directory", async () => {
+      const dir = mkdtempSync(join(tmpdir(), "pw-probe-"));
+      try {
+        writeFileSync(join(dir, "auth.json"), "x");
+        const rules = [{ pattern: `${dir}/**`, label: "受保护目录" }];
+        expect(
+          await describeBashCall(`cd ${dir} && cat auth.json`, rules),
+        ).toBeNull();
+      } finally {
+        rmSync(dir, { recursive: true, force: true });
+      }
+    });
+
+    it("prompts on rm of an existing bare-token file in a protected directory", async () => {
+      const dir = mkdtempSync(join(tmpdir(), "pw-probe-"));
+      try {
+        writeFileSync(join(dir, "auth.json"), "x");
+        const rules = [{ pattern: `${dir}/**`, label: "受保护目录" }];
+        expect(
+          isGateDescriptor(
+            await describeBashCall(`cd ${dir} && rm auth.json`, rules),
+          ),
+        ).toBe(true);
+      } finally {
+        rmSync(dir, { recursive: true, force: true });
+      }
+    });
+  });
+});

pi-permission-system/test/handlers/gates/tool-call-gate-pipeline.test.ts

@@ -1,6 +1,5 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
-import type { AccessPath } from "#src/access-intent/access-path";
 import { ToolCallGatePipeline } from "#src/handlers/gates/tool-call-gate-pipeline";
 import { PathNormalizer } from "#src/path-normalizer";
 
@@ -37,7 +36,7 @@ function makeMockBashProgram(command = "echo hello") {
     commandText: vi.fn(() => command),
     commands: vi.fn<() => []>(() => []),
     pathRuleCandidates: vi.fn<() => []>(() => []),
-    externalPaths: vi.fn<() => AccessPath[]>(() => []),
+    writeCandidates: vi.fn<() => []>(() => []),
   };
 }
 
@@ -200,7 +199,7 @@ describe("ToolCallGatePipeline", () => {
         commandText: vi.fn(() => text),
         commands: vi.fn(() => [{ text }]),
         pathRuleCandidates: vi.fn<() => []>(() => []),
-        externalPaths: vi.fn<() => AccessPath[]>(() => []),
+        writeCandidates: vi.fn<() => []>(() => []),
       };
     }