admin/my-pi
1
0
Fork 0
mirror of https://bitbucket.org/siakitem/my-pi.git synced 2026-10-26 10:45:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: 组合包配置以包内 config/ 为唯一来源，并新增受保护写入人工审批

Browse Source 
配置统一：权限策略、硬防御、Tool Search、提示词封面以及新迁入的
RTK、pi-compaction、pi-worktree、pi-hermes-memory 配置全部由扩展
直接读取已安装组合包内的 config/，pi install / pi update 即完成部署；
删除 rebuild-bundle-config.mjs 与 bundle-manifest.json，my-pi/ 只保留
日志与缓存。update.sh 成功升级后将默认 git 来源的已安装副本
reset 回发布版本。AGENTS.md 新增「组合包配置原则」。

脚本整合：search_config.sh / ssh_config.sh 合并为 configure.sh
search|ssh；install.sh / update.sh 共享函数抽到 scripts/lib.sh，远程
安装器改为先下载到临时文件再执行，下载失败可被检测。

权限：hard-guards 新增 protectedWrites，写入 Pi 凭据/设置、已安装
组合包与扩展目录、pi-ssh 凭据库时一律人工确认（跳过 AutoReview、
yolo 与 Session grant，无 UI 时拒绝）；放行 ls、LSP 查询、ctx 只读、
web_search、Chrome 只读与 git 只读命令，skill_manage 改为 ask。

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
This commit is contained in:
云服务部-叶林立
2026-10-20 01:05:31 -07:00
co-authored by Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
parent a0ee9389c7
commit 2aa1be0b54
105 changed files with 2337 additions and 1413 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pi-permission-system/test/permission-manager-unified.test.ts
+12 -18
View File
@@ -1112,12 +1112,16 @@ describe("cross-cutting path surface — home-expanded values", () => {
// ---------------------------------------------------------------------------
test("project policy files are ignored", () => {
const { agentDir, cwd, cleanup } = createAgentDirHarness({
const { agentDir, cwd, globalConfigPath, cleanup } = createAgentDirHarness({
globalPermission: { "*": "ask", bash: "deny" },
projectPermission: { bash: "allow" },
});
try {
const manager = new PermissionManager({ agentDir });
const manager = new PermissionManager({
globalConfigPath,
agentsDir: join(agentDir, "agents"),
projectAgentsDir: join(cwd, ".pi", "agents"),
});
manager.configureForCwd(cwd);
expect(checkTool(manager, "bash", { command: "echo hi" }).state).toBe(
"deny",
@@ -1898,27 +1902,17 @@ permission:
// PI_CODING_AGENT_DIR support — moved from catch-all (#342)
// ---------------------------------------------------------------------------
test("PermissionManager reads config from PI_CODING_AGENT_DIR when set", () => {
test("PermissionManager reads the bundle-level policy regardless of PI_CODING_AGENT_DIR", () => {
// The bundle config/ directory is the single source of truth; the agent dir
// env var no longer influences the ordinary-policy location.
const baseDir = mkdtempSync(join(tmpdir(), "pi-permission-system-envdir-"));
const agentsDir = join(baseDir, "agents");
const newConfigPath = getGlobalConfigPath(baseDir);
mkdirSync(agentsDir, { recursive: true });
mkdirSync(dirname(newConfigPath), { recursive: true });
const config: ScopeConfig = {
permission: { "*": "deny", read: "allow" },
};
writeFileSync(newConfigPath, JSON.stringify(config), "utf8");
const original = process.env.PI_CODING_AGENT_DIR;
process.env.PI_CODING_AGENT_DIR = baseDir;
try {
const manager = new PermissionManager();
const result = checkTool(manager, "read", {});
expect(result.state).toBe("allow");
const result2 = checkTool(manager, "write", {});
expect(result2.state).toBe("deny");
const resolved = manager.getResolvedPolicyPaths();
expect(resolved.globalConfigPath).toBe(getGlobalConfigPath());
expect(resolved.globalConfigPath).not.toContain(baseDir);
} finally {
if (original !== undefined) {
process.env.PI_CODING_AGENT_DIR = original;