feat: 组合包配置以包内 config/ 为唯一来源，并新增受保护写入人工审批

配置统一：权限策略、硬防御、Tool Search、提示词封面以及新迁入的
RTK、pi-compaction、pi-worktree、pi-hermes-memory 配置全部由扩展
直接读取已安装组合包内的 config/，pi install / pi update 即完成部署；
删除 rebuild-bundle-config.mjs 与 bundle-manifest.json，my-pi/ 只保留
日志与缓存。update.sh 成功升级后将默认 git 来源的已安装副本
reset 回发布版本。AGENTS.md 新增「组合包配置原则」。

脚本整合：search_config.sh / ssh_config.sh 合并为 configure.sh
search|ssh；install.sh / update.sh 共享函数抽到 scripts/lib.sh，远程
安装器改为先下载到临时文件再执行，下载失败可被检测。

权限：hard-guards 新增 protectedWrites，写入 Pi 凭据/设置、已安装
组合包与扩展目录、pi-ssh 凭据库时一律人工确认（跳过 AutoReview、
yolo 与 Session grant，无 UI 时拒绝）；放行 ls、LSP 查询、ctx 只读、
web_search、Chrome 只读与 git 只读命令，skill_manage 改为 ask。

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

pi-tool-search/README.md

@@ -71,7 +71,7 @@ The first loads are purely additive and retain Pi's native deferred-loading prop
 
 ## Configuration
 
-Pi reads this configuration from `<agent-dir>/my-pi/tool-search/config.json` (normally `~/.pi/agent/my-pi/tool-search/config.json`), deployed by the bundle's `install.sh` / `update.sh` from `config/tool-search.json`. A missing, unreadable, or invalid file falls back to the built-in `BUNDLE_TOOL_SEARCH_DEFAULTS`; the extension never writes the file:
+Pi reads this configuration directly from the installed bundle's `config/tool-search.json` — the single source of truth, refreshed by `pi update`. A missing, unreadable, or invalid file falls back to the built-in `BUNDLE_TOOL_SEARCH_DEFAULTS`; the extension never writes the file:
 
 ```json
 {
@@ -117,7 +117,7 @@ Example override:
 }
 ```
 
-An explicit override larger than `maxDynamicTools` remains visible but cannot be activated until the limit or override is corrected. Every `install.sh` / `update.sh` run rebuilds the file together with the rest of the `my-pi/` tree, so hand edits are overwritten — change `config/tool-search.json` in the bundle repository for durable customization.
+An explicit override larger than `maxDynamicTools` remains visible but cannot be activated until the limit or override is corrected. To customize, edit `config/tool-search.json` in the bundle repository and update the bundle — `pi update` refreshes the installed copy.
 
 ## Current host integration
 

pi-tool-search/extensions/config.ts

@@ -1,18 +1,22 @@
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
+import { fileURLToPath } from "node:url";
 
 const TOOL_SEARCH_DIR = join("my-pi", "tool-search");
 
 /**
- * Path of the bundle-managed Tool Search config inside the agent directory.
- * `scripts/rebuild-bundle-config.mjs` deploys `config/tool-search.json` here;
- * this extension never writes or migrates it.
+ * Bundle-level `config/` is the single source of truth: the extension reads
+ * `config/tool-search.json` from inside the installed bundle (resolved
+ * relative to this source file), never deployed to or migrated from the
+ * agent directory.
  */
-export function getToolSearchConfigPath(agentDir: string): string {
-  return join(agentDir, TOOL_SEARCH_DIR, "config.json");
+export function getToolSearchConfigPath(): string {
+  const override = process.env.PI_TOOL_SEARCH_CONFIG_PATH;
+  if (override) return override;
+  return fileURLToPath(new URL("../../config/tool-search.json", import.meta.url));
 }
 
-/** Catalog cache path under the same bundle-owned `my-pi/tool-search/` tree. */
+/** Disposable catalog cache under the agent dir's `my-pi/tool-search/` tree. */
 export function getToolSearchCatalogPath(agentDir: string): string {
   return join(agentDir, TOOL_SEARCH_DIR, "catalog-v1.json");
 }
@@ -83,13 +87,16 @@ export function bundleFallbackConfig(): ToolSearchConfig {
 }
 
 /**
- * Read the Tool Search config from `<agentDir>/my-pi/tool-search/config.json`.
- * A missing, unreadable, or non-object file falls back to the bundle defaults.
+ * Read the Tool Search config. Defaults to the bundle-level
+ * `config/tool-search.json`; tests inject an explicit temp path. A missing,
+ * unreadable, or non-object file falls back to the bundle defaults.
  */
-export function readToolSearchConfig(agentDir: string): ToolSearchConfig {
+export function readToolSearchConfig(
+  configPath: string = getToolSearchConfigPath(),
+): ToolSearchConfig {
   const fallback = bundleFallbackConfig();
   try {
-    const parsed: unknown = JSON.parse(readFileSync(getToolSearchConfigPath(agentDir), "utf8"));
+    const parsed: unknown = JSON.parse(readFileSync(configPath, "utf8"));
     if (!isObject(parsed)) return fallback;
     const config = parsed;
     return {

pi-tool-search/extensions/index.ts

@@ -114,7 +114,7 @@ export default function toolSearchExtension(pi: ExtensionAPI): void {
   const agentDir = getAgentDir();
   const cachePath = getToolSearchCatalogPath(agentDir);
 
-  let config = readToolSearchConfig(agentDir);
+  let config = readToolSearchConfig();
   let tools: ToolInfo[] = [];
   let catalog: ToolCatalog = createFallbackCatalog([], "", {
     maxToolsPerGroup: Math.min(config.maxToolsPerGroup, config.maxDynamicTools),
@@ -440,7 +440,7 @@ export default function toolSearchExtension(pi: ExtensionAPI): void {
   }
 
   function refreshState(ctx: Pick<ExtensionContext, "ui">, forceReset: boolean): void {
-    const nextConfig = readToolSearchConfig(agentDir);
+    const nextConfig = readToolSearchConfig();
     const registeredTools = pi.getAllTools().filter((tool) => tool.name !== TOOL_SEARCH_NAME);
     const platformPolicy = platformToolPolicy(registeredTools, process.platform);
     const allTools = platformPolicy.tools;

pi-tool-search/test/config.test.ts

@@ -21,10 +21,12 @@ async function withAgentDir(run: (agentDir: string) => Promise<void>): Promise<v
   }
 }
 
-async function writeConfig(agentDir: string, content: string): Promise<void> {
-  const path = getToolSearchConfigPath(agentDir);
+/** Write a config file inside the temp dir; never touches the repo config/. */
+async function writeConfig(agentDir: string, content: string): Promise<string> {
+  const path = join(agentDir, "config.json");
   await mkdir(dirname(path), { recursive: true });
   await writeFile(path, content, "utf8");
+  return path;
 }
 
 test("bundle defaults keep the committed tool list", () => {
@@ -52,12 +54,9 @@ test("bundle defaults keep the committed tool list", () => {
   });
 });
 
-test("config and catalog live under the bundle-owned my-pi tree", async () => {
+test("config resolves to the bundle config dir; catalog stays under my-pi", async () => {
   await withAgentDir(async (agentDir) => {
-    assert.equal(
-      getToolSearchConfigPath(agentDir),
-      join(agentDir, "my-pi", "tool-search", "config.json"),
-    );
+    assert.match(getToolSearchConfigPath(), /config[/\\]tool-search\.json$/);
     assert.equal(
       getToolSearchCatalogPath(agentDir),
       join(agentDir, "my-pi", "tool-search", "catalog-v1.json"),
@@ -67,13 +66,16 @@ test("config and catalog live under the bundle-owned my-pi tree", async () => {
 
 test("falls back to bundle defaults when the config file is absent or invalid", async () => {
   await withAgentDir(async (agentDir) => {
-    assert.deepEqual(readToolSearchConfig(agentDir), bundleFallbackConfig());
+    assert.deepEqual(
+      readToolSearchConfig(join(agentDir, "missing.json")),
+      bundleFallbackConfig(),
+    );
 
-    await writeConfig(agentDir, "{not-json");
-    assert.deepEqual(readToolSearchConfig(agentDir), bundleFallbackConfig());
+    const badJson = await writeConfig(agentDir, "{not-json");
+    assert.deepEqual(readToolSearchConfig(badJson), bundleFallbackConfig());
 
-    await writeConfig(agentDir, '"a string, not an object"');
-    assert.deepEqual(readToolSearchConfig(agentDir), bundleFallbackConfig());
+    const nonObject = await writeConfig(agentDir, '"a string, not an object"');
+    assert.deepEqual(readToolSearchConfig(nonObject), bundleFallbackConfig());
   });
 });
 
@@ -87,8 +89,8 @@ test("normalizes invalid runtime values without overwriting the file", async ()
       maxDynamicTools: -1,
       groupOverrides: { web: ["search", 2], empty: [] },
     });
-    await writeConfig(agentDir, original);
-    assert.deepEqual(readToolSearchConfig(agentDir), {
+    const path = await writeConfig(agentDir, original);
+    assert.deepEqual(readToolSearchConfig(path), {
       alwaysEnabled: ["one"],
       showToolSearchFooterStatus: false,
       maxActiveGroups: 5,
@@ -96,7 +98,7 @@ test("normalizes invalid runtime values without overwriting the file", async ()
       maxDynamicTools: 28,
       groupOverrides: { web: ["search"] },
     });
-    assert.equal(await readFile(getToolSearchConfigPath(agentDir), "utf8"), original);
+    assert.equal(await readFile(path, "utf8"), original);
   });
 });
 
@@ -110,8 +112,8 @@ test("reads an explicit configuration verbatim", async () => {
       maxDynamicTools: 20,
       groupOverrides: { custom: ["some_tool"] },
     }, null, 2)}\n`;
-    await writeConfig(agentDir, original);
-    assert.deepEqual(readToolSearchConfig(agentDir), {
+    const path = await writeConfig(agentDir, original);
+    assert.deepEqual(readToolSearchConfig(path), {
       alwaysEnabled: ["codegraph_explore", "lsp_diagnostics"],
       showToolSearchFooterStatus: true,
       maxActiveGroups: 3,
@@ -119,6 +121,6 @@ test("reads an explicit configuration verbatim", async () => {
       maxDynamicTools: 20,
       groupOverrides: { custom: ["some_tool"] },
     });
-    assert.equal(await readFile(getToolSearchConfigPath(agentDir), "utf8"), original);
+    assert.equal(await readFile(path, "utf8"), original);
   });
 });

pi-tool-search/test/extension.test.ts

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import test from "node:test";
@@ -49,13 +49,13 @@ function testContext(overrides: Partial<ExtensionContext> = {}): ExtensionContex
 test("loads whole groups and evicts the least-recently-used group", async () => {
   const agentDir = await mkdtemp(join(tmpdir(), "my-pi-tool-search-extension-"));
   const previousAgentDir = process.env.PI_CODING_AGENT_DIR;
+  const previousConfigPath = process.env.PI_TOOL_SEARCH_CONFIG_PATH;
   process.env.PI_CODING_AGENT_DIR = agentDir;
+  process.env.PI_TOOL_SEARCH_CONFIG_PATH = join(agentDir, "tool-search-config.json");
 
   try {
-    const configDir = join(agentDir, "my-pi", "tool-search");
-    await mkdir(configDir, { recursive: true });
     await writeFile(
-      join(configDir, "config.json"),
+      process.env.PI_TOOL_SEARCH_CONFIG_PATH,
       JSON.stringify({
         alwaysEnabled: ["codegraph_explore", "lsp_diagnostics"],
         showToolSearchFooterStatus: false,
@@ -159,6 +159,8 @@ test("loads whole groups and evicts the least-recently-used group", async () =>
   } finally {
     if (previousAgentDir === undefined) delete process.env.PI_CODING_AGENT_DIR;
     else process.env.PI_CODING_AGENT_DIR = previousAgentDir;
+    if (previousConfigPath === undefined) delete process.env.PI_TOOL_SEARCH_CONFIG_PATH;
+    else process.env.PI_TOOL_SEARCH_CONFIG_PATH = previousConfigPath;
     await rm(agentDir, { recursive: true, force: true });
   }
 });