feat: 组合包配置以包内 config/ 为唯一来源，并新增受保护写入人工审批

配置统一：权限策略、硬防御、Tool Search、提示词封面以及新迁入的
RTK、pi-compaction、pi-worktree、pi-hermes-memory 配置全部由扩展
直接读取已安装组合包内的 config/，pi install / pi update 即完成部署；
删除 rebuild-bundle-config.mjs 与 bundle-manifest.json，my-pi/ 只保留
日志与缓存。update.sh 成功升级后将默认 git 来源的已安装副本
reset 回发布版本。AGENTS.md 新增「组合包配置原则」。

脚本整合：search_config.sh / ssh_config.sh 合并为 configure.sh
search|ssh；install.sh / update.sh 共享函数抽到 scripts/lib.sh，远程
安装器改为先下载到临时文件再执行，下载失败可被检测。

权限：hard-guards 新增 protectedWrites，写入 Pi 凭据/设置、已安装
组合包与扩展目录、pi-ssh 凭据库时一律人工确认（跳过 AutoReview、
yolo 与 Session grant，无 UI 时拒绝）；放行 ls、LSP 查询、ctx 只读、
web_search、Chrome 只读与 git 只读命令，skill_manage 改为 ask。

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

tests/bundle-config-rebuild.test.ts

@@ -1,220 +0,0 @@
-import assert from "node:assert/strict";
-import { lstat, mkdir, mkdtemp, readdir, readFile, rm, stat, symlink, writeFile } from "node:fs/promises";
-import { spawnSync } from "node:child_process";
-import { tmpdir } from "node:os";
-import { dirname, join, resolve } from "node:path";
-import test from "node:test";
-import { fileURLToPath } from "node:url";
-
-import {
-  getGlobalConfigPath,
-  getGlobalLogsDir,
-  getHardGuardConfigPath,
-} from "../pi-permission-system/src/config-paths.ts";
-import {
-  BUNDLE_TOOL_SEARCH_DEFAULTS,
-  getToolSearchCatalogPath,
-  getToolSearchConfigPath,
-} from "../pi-tool-search/extensions/config.ts";
-import { resolveCoverPath } from "../extensions/system-prompt-cover-config.ts";
-import { rebuildBundleConfig } from "../scripts/rebuild-bundle-config.mjs";
-
-const repositoryRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-const rebuildScript = join(repositoryRoot, "scripts", "rebuild-bundle-config.mjs");
-const manifestPath = join(repositoryRoot, "config", "bundle-manifest.json");
-
-interface ManifestFile {
-  source: string;
-  target: string;
-}
-
-const manifest = JSON.parse(await readFile(manifestPath, "utf8")) as {
-  version: number;
-  directory: string;
-  files: ManifestFile[];
-};
-
-async function makeTempDir() {
-  return mkdtemp(join(tmpdir(), "my-pi-rebuild-"));
-}
-
-function modeOf(path: string): Promise<number> {
-  return stat(path).then((info) => info.mode & 0o777);
-}
-
-async function readSnapshot(path: string): Promise<string> {
-  return readFile(path, "utf8");
-}
-
-test("rebuild replaces the my-pi tree with byte-identical manifest targets and leaves outside files alone", async () => {
-  const dir = await makeTempDir();
-  try {
-    // Pre-existing junk inside the managed directory must disappear entirely.
-    await mkdir(join(dir, "my-pi", "permission-system"), { recursive: true });
-    await writeFile(join(dir, "my-pi", "permission-system", "policy.jsonc"), "STALE POLICY", "utf8");
-    await writeFile(join(dir, "my-pi", "leftover.txt"), "JUNK", "utf8");
-    await mkdir(join(dir, "my-pi", "stray", "deep"), { recursive: true });
-
-    // Files outside my-pi/ must survive byte-identical — the script owns only my-pi/.
-    const outside = [
-      join(dir, "settings.json"),
-      join(dir, "sessions", "abc", "session.jsonl"),
-      join(dir, "extensions", "pi-permission-system", "policy.jsonc"),
-    ];
-    for (const path of outside) {
-      await mkdir(dirname(path), { recursive: true });
-      await writeFile(path, `outside ${path}\n`, "utf8");
-    }
-    const before = new Map(await Promise.all(outside.map(async (p) => [p, await readSnapshot(p)])));
-
-    await rebuildBundleConfig(dir);
-
-    const myPi = join(dir, "my-pi");
-    const expectedFiles = new Set(manifest.files.map((file) => file.target));
-    const actualFiles: string[] = [];
-    const walk = async (root: string, rel: string) => {
-      for (const entry of await readdir(root, { withFileTypes: true })) {
-        const next = rel ? `${rel}/${entry.name}` : entry.name;
-        if (entry.isDirectory()) await walk(join(root, entry.name), next);
-        else actualFiles.push(next);
-      }
-    };
-    await walk(myPi, "");
-    assert.deepEqual(actualFiles.sort(), [...expectedFiles].sort(), "my-pi must contain exactly the manifest targets");
-
-    for (const file of manifest.files) {
-      const target = join(myPi, file.target);
-      assert.equal(await readFile(target, "utf8"), await readFile(join(repositoryRoot, file.source), "utf8"));
-      assert.equal(await modeOf(target), 0o600, `${file.target} must be owner-only`);
-      assert.equal(await modeOf(dirname(target)), 0o700, `${dirname(file.target)} must be owner-only`);
-    }
-
-    for (const [path, content] of before) {
-      assert.equal(await readSnapshot(path), content, `outside file ${path} must be untouched`);
-    }
-  } finally {
-    await rm(dir, { recursive: true, force: true });
-  }
-});
-
-test("rejects an empty or relative agentDir without deleting anything", async () => {
-  const dir = await makeTempDir();
-  try {
-    const sentinel = join(dir, "keep.txt");
-    await writeFile(sentinel, "keep", "utf8");
-
-    await assert.rejects(rebuildBundleConfig(""), /absolute/);
-    await assert.rejects(rebuildBundleConfig("relative/dir"), /absolute/);
-    assert.equal(await readFile(sentinel, "utf8"), "keep");
-  } finally {
-    await rm(dir, { recursive: true, force: true });
-  }
-});
-
-test("CLI rejects a relative agentDir and reports the failure", async () => {
-  const dir = await makeTempDir();
-  try {
-    await mkdir(join(dir, "my-pi"), { recursive: true });
-    await writeFile(join(dir, "my-pi", "sentinel.txt"), "still here", "utf8");
-
-    const failure = spawnSync(process.execPath, [rebuildScript, "relative/dir"], {
-      encoding: "utf8",
-    });
-    assert.equal(failure.status, 2);
-    assert.match(failure.stderr ?? "", /absolute/);
-    assert.equal(await readFile(join(dir, "my-pi", "sentinel.txt"), "utf8"), "still here");
-  } finally {
-    await rm(dir, { recursive: true, force: true });
-  }
-});
-
-test("CLI prints rebuilt:<path> on success", async () => {
-  const dir = await makeTempDir();
-  try {
-    const result = spawnSync(process.execPath, [rebuildScript, dir], { encoding: "utf8" });
-    assert.equal(result.status, 0, `${result.stdout}\n${result.stderr}`);
-    assert.equal(result.stdout.trim(), `rebuilt:${join(dir, "my-pi")}`);
-  } finally {
-    await rm(dir, { recursive: true, force: true });
-  }
-});
-
-test("a manifest target escaping the directory is rejected without deleting my-pi", async () => {
-  const dir = await makeTempDir();
-  try {
-    await mkdir(join(dir, "my-pi"), { recursive: true });
-    await writeFile(join(dir, "my-pi", "sentinel.txt"), "still here", "utf8");
-
-    const badManifestPath = join(dir, "bad-manifest.json");
-    await writeFile(
-      badManifestPath,
-      JSON.stringify({
-        version: 1,
-        directory: "my-pi",
-        files: [{ source: "config/tool-search.json", target: "../escape.txt" }],
-      }),
-      "utf8",
-    );
-    await assert.rejects(
-      rebuildBundleConfig(dir, { manifestPath: badManifestPath }),
-      /escapes/,
-    );
-    assert.equal(await readFile(join(dir, "my-pi", "sentinel.txt"), "utf8"), "still here");
-    await assert.rejects(readFile(join(dir, "escape.txt"), "utf8"), /ENOENT/);
-  } finally {
-    await rm(dir, { recursive: true, force: true });
-  }
-});
-
-test("a symlinked my-pi is replaced, never followed", async () => {
-  const dir = await makeTempDir();
-  const elsewhere = await makeTempDir();
-  try {
-    const targetContent = join(elsewhere, "precious.txt");
-    await writeFile(targetContent, "do not touch", "utf8");
-    await symlink(elsewhere, join(dir, "my-pi"), "dir");
-
-    await rebuildBundleConfig(dir);
-
-    // The link itself must be replaced by a real directory…
-    const rebuilt = await stat(join(dir, "my-pi"));
-    assert.ok(rebuilt.isDirectory());
-    assert.ok(!(await lstat(join(dir, "my-pi"))).isSymbolicLink(), "my-pi must be a real directory now");
-
-    // …and the link target's contents must survive untouched.
-    assert.equal(await readFile(targetContent, "utf8"), "do not touch");
-  } finally {
-    await rm(dir, { recursive: true, force: true });
-    await rm(elsewhere, { recursive: true, force: true });
-  }
-});
-
-test("manifest targets match the paths the extensions actually read", () => {
-  const targets = new Map(manifest.files.map((file) => [file.target, file.source]));
-  const agentDir = "/agent";
-  const base = `${agentDir}/${manifest.directory}`;
-
-  const expectTarget = (source: string, resolved: string, suffix: string) => {
-    assert.ok(resolved.startsWith(`${base}/`), `${resolved} must live under ${base}`);
-    assert.equal(
-      targets.get(resolved.slice(base.length + 1)),
-      source,
-      `${resolved} must be a manifest target backed by ${source}`,
-    );
-    assert.ok(resolved.endsWith(suffix), `${resolved} must end with ${suffix}`);
-  };
-
-  expectTarget("config/pi-permission-policy.jsonc", getGlobalConfigPath(agentDir), "my-pi/permission-system/policy.jsonc");
-  expectTarget("config/pi-permission-hard-guards.jsonc", getHardGuardConfigPath(agentDir), "my-pi/permission-system/hard-guards.jsonc");
-  expectTarget("config/tool-search.json", getToolSearchConfigPath(agentDir), "my-pi/tool-search/config.json");
-  expectTarget("config/system-prompt-cover.md", resolveCoverPath(agentDir), "my-pi/system-prompt-cover.md");
-
-  // Runtime state that is created rather than deployed must still live under my-pi/.
-  assert.ok(getGlobalLogsDir(agentDir).endsWith("my-pi/permission-system/logs"));
-  assert.ok(getToolSearchCatalogPath(agentDir).endsWith("my-pi/tool-search/catalog-v1.json"));
-});
-
-test("deployed tool-search config is exactly BUNDLE_TOOL_SEARCH_DEFAULTS", async () => {
-  const deployed = JSON.parse(await readFile(join(repositoryRoot, "config", "tool-search.json"), "utf8"));
-  assert.deepEqual(deployed, BUNDLE_TOOL_SEARCH_DEFAULTS);
-});

tests/bundle-config.test.ts

@@ -0,0 +1,114 @@
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+
+import {
+  getGlobalConfigPath,
+  getGlobalLogsDir,
+  getHardGuardConfigPath,
+} from "../pi-permission-system/src/config-paths.ts";
+import {
+  getToolSearchCatalogPath,
+  getToolSearchConfigPath,
+} from "../pi-tool-search/extensions/config.ts";
+import {
+  CONFIG_PATH as RTK_CONFIG_PATH,
+  resolveConfigPath as resolveRtkConfigPath,
+} from "../pi-rtk-optimizer/src/constants.ts";
+import { CONFIG_PATH as COMPACTION_CONFIG_PATH } from "../pi-compaction/src/config.ts";
+import { WORKTREE_CONFIG_PATH } from "../pi-worktree/src/settings.ts";
+import { resolveCoverPath } from "../extensions/system-prompt-cover-config.ts";
+
+const repositoryRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const bundleConfigDir = join(repositoryRoot, "config");
+
+// pi-hermes-memory's config module uses runtime "./x.js" specifiers that
+// Node's type stripping cannot resolve to sibling ".ts" files, so it is
+// loaded through jiti instead of a plain import.
+const { createJiti } = await import("jiti");
+const jiti = createJiti(import.meta.url);
+const { DEFAULT_CONFIG_PATH: HERMES_CONFIG_PATH } = (await jiti.import(
+  join(repositoryRoot, "pi-hermes-memory", "src", "config.ts"),
+)) as { DEFAULT_CONFIG_PATH: string };
+
+/** Bundle config files every extension reads directly at runtime. */
+const BUNDLE_CONFIG_FILES = [
+  "pi-permission-policy.jsonc",
+  "pi-permission-hard-guards.jsonc",
+  "tool-search.json",
+  "rtk-optimizer.json",
+  "pi-compaction.json",
+  "pi-worktree.json",
+  "pi-hermes-memory.json",
+  "system-prompt-cover.md",
+  "pi-hashline-edit.json",
+  "lsp.json",
+  "p10k.zsh",
+];
+
+/** Strip JSONC comments (line and block) — same approach as the seed test. */
+function stripJsonc(raw: string): string {
+  return raw.replace(/^\s*\/\/.*$/gm, "").replace(/\/\*[\s\S]*?\*\//g, "");
+}
+
+test("every bundle config file exists and is non-empty", async () => {
+  for (const name of BUNDLE_CONFIG_FILES) {
+    const content = await readFile(join(bundleConfigDir, name), "utf8");
+    assert.ok(content.trim().length > 0, `config/${name} must not be empty`);
+  }
+});
+
+test("every bundle JSON/JSONC config file parses", async () => {
+  for (const name of BUNDLE_CONFIG_FILES) {
+    if (!name.endsWith(".json") && !name.endsWith(".jsonc")) continue;
+    const raw = await readFile(join(bundleConfigDir, name), "utf8");
+    assert.doesNotThrow(
+      () => JSON.parse(stripJsonc(raw)),
+      `config/${name} must parse as JSONC`,
+    );
+  }
+});
+
+test("each extension resolves its config path inside the bundle config/ dir", () => {
+  const savedToolSearch = process.env.PI_TOOL_SEARCH_CONFIG_PATH;
+  const savedRtk = process.env.PI_RTK_CONFIG_PATH;
+  delete process.env.PI_TOOL_SEARCH_CONFIG_PATH;
+  delete process.env.PI_RTK_CONFIG_PATH;
+  try {
+    const inBundleConfig = (resolved: string, file: string) =>
+    assert.equal(
+      resolved,
+      join(bundleConfigDir, file),
+      `expected the bundle config path for ${file}`,
+    );
+
+    inBundleConfig(getGlobalConfigPath(), "pi-permission-policy.jsonc");
+    inBundleConfig(getHardGuardConfigPath(), "pi-permission-hard-guards.jsonc");
+    inBundleConfig(getToolSearchConfigPath(), "tool-search.json");
+    inBundleConfig(RTK_CONFIG_PATH, "rtk-optimizer.json");
+    inBundleConfig(resolveRtkConfigPath(), "rtk-optimizer.json");
+    inBundleConfig(COMPACTION_CONFIG_PATH, "pi-compaction.json");
+    inBundleConfig(WORKTREE_CONFIG_PATH, "pi-worktree.json");
+    inBundleConfig(HERMES_CONFIG_PATH, "pi-hermes-memory.json");
+    inBundleConfig(resolveCoverPath(), "system-prompt-cover.md");
+  } finally {
+    if (savedToolSearch === undefined) delete process.env.PI_TOOL_SEARCH_CONFIG_PATH;
+    else process.env.PI_TOOL_SEARCH_CONFIG_PATH = savedToolSearch;
+    if (savedRtk === undefined) delete process.env.PI_RTK_CONFIG_PATH;
+    else process.env.PI_RTK_CONFIG_PATH = savedRtk;
+  }
+});
+
+test("disposable runtime state stays under the agent-dir my-pi tree", () => {
+  const agentDir = "/agent";
+  assert.ok(
+    getGlobalLogsDir(agentDir).endsWith("my-pi/permission-system/logs"),
+  );
+  assert.ok(
+    getToolSearchCatalogPath(agentDir).endsWith(
+      "my-pi/tool-search/catalog-v1.json",
+    ),
+  );
+});

tests/extension-load.test.ts

@@ -78,7 +78,7 @@ test("all package extensions load together without global registration conflicts
 	assert.equal(packageJson.dependencies.ssh2, "1.17.0", "the packed bundle must install pi-ssh's runtime transport");
 	assert.equal(packageJson.dependencies.jiti, "2.7.0", "the packed helper must load local TypeScript outside Pi");
 	assert.ok(packageJson.files.includes("pi-ssh"), "the packed bundle must include the locally maintained SSH source");
-	assert.ok(packageJson.files.includes("ssh_config.sh"), "the packed bundle must include the SSH host import helper");
+	assert.ok(packageJson.files.includes("configure.sh"), "the packed bundle must include the search/SSH config helper");
 	assert.ok(packageJson.pi.extensions.includes("./pi-ask-user/index.ts"), "the bundle must load pi-ask-user");
 	assert.equal(packageJson.dependencies["pi-ask-user"], "file:./pi-ask-user");
 	assert.ok(packageJson.files.includes("pi-ask-user"), "the packed bundle must include pi-ask-user source");

tests/search-auth.test.ts

@@ -140,7 +140,7 @@ test("template parser handles env names, braces and escapes", () => {
 });
 
 const AUTH_MJS = new URL("../scripts/search-auth.mjs", import.meta.url).pathname;
-const SEARCH_SH = new URL("../search_config.sh", import.meta.url).pathname;
+const CONFIGURE_SH = new URL("../configure.sh", import.meta.url).pathname;
 
 function runMjs(args: string[], env: Record<string, string> = {}) {
 	return spawnSync("node", [AUTH_MJS, ...args], { encoding: "utf8", env: { ...process.env, ...env } });
@@ -238,10 +238,10 @@ test("search-auth.mjs --has and --list never print key material", async () => {
 	assert.doesNotMatch(list.stdout, /supersecret/);
 });
 
-test("search_config.sh writes keys through search-auth.mjs noninteractively", async () => {
+test("configure.sh search writes keys through search-auth.mjs noninteractively", async () => {
 	const dir = await mkdtemp(join(tmpdir(), "my-pi-auth-write-"));
 	const authPath = join(dir, "auth.json");
-	const result = spawnSync("sh", [SEARCH_SH, "--auth", authPath, "--tavily", "tvly-sh", "--exa", "exa-sh"], {
+	const result = spawnSync("sh", [CONFIGURE_SH, "search", "--auth", authPath, "--tavily", "tvly-sh", "--exa", "exa-sh"], {
 		encoding: "utf8",
 	});
 	assert.equal(result.status, 0, result.stderr);

tests/system-prompt-cover.test.ts

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import test from "node:test";
@@ -139,14 +139,16 @@ test("spliceCover keeps an attribute-bearing nested tag inside its parent sectio
   );
 });
 
+test("resolveCoverPath points at the bundle config file", () => {
+  assert.equal(resolveCoverPath(), bundledCoverPath);
+});
+
 test("readCoverFile returns undefined when the file is absent or blank", async () => {
   const dir = await makeTempDir();
   try {
-    const coverPath = resolveCoverPath(dir);
-    assert.equal(coverPath, join(dir, "my-pi", "system-prompt-cover.md"));
+    const coverPath = join(dir, "system-prompt-cover.md");
     assert.equal(readCoverFile(coverPath), undefined);
 
-    await mkdir(dirname(coverPath), { recursive: true });
     await writeFile(coverPath, "   \n\n", "utf8");
     assert.equal(readCoverFile(coverPath), undefined);