admin/my-pi
1
0
Fork 0
mirror of https://bitbucket.org/siakitem/my-pi.git synced 2026-08-28 08:35:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(pi-ssh): harden remote execution and search

Browse Source
This commit is contained in:
云服务部-叶林立
2026-08-24 23:04:29 +08:00
parent a7891f18bf
commit aff91b0972
30 changed files with 1063 additions and 222 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/extension-load.test.ts
+5
View File
@@ -37,6 +37,7 @@ test("all package extensions load together without global registration conflicts
await readFile(join(repositoryRoot, "config", "pi-permission-system.json"), "utf8"),
) as { authorizerChain: string[]; permission: Record<string, unknown> };
assert.equal(permissionConfig.permission.ssh_connect, "ask", "SSH connection must enter the permission gate");
assert.equal(permissionConfig.permission.ssh_cd, "ask", "remote workspace changes must enter the permission gate");
assert.deepEqual(permissionConfig.authorizerChain, ["auto-review"], "SSH connection asks must reach AutoReview");
assert.ok(
packageJson.pi.extensions.indexOf("./extensions/permission-system.ts") <
@@ -93,4 +94,8 @@ test("all package extensions load together without global registration conflicts
assert.equal(result.status, 0, `${result.stdout}\n${result.stderr}`);
assert.doesNotMatch(`${result.stdout}\n${result.stderr}`, /Failed to load extension|conflicts with/u);
const deployedPermissionConfig = JSON.parse(
await readFile(join(home, ".pi-agent", "extensions", "pi-permission-system", "config.json"), "utf8"),
);
assert.deepEqual(deployedPermissionConfig, permissionConfig, "the deployed permission config must match the bundle source");
});
tests/tool-routing.test.ts
+8 -1
View File
@@ -24,10 +24,17 @@ test("search routing narrows files before requesting matching line numbers", ()
test("SSH connection routing requires an explicit named host and concrete task", () => {
const section = buildToolRoutingSection(["ssh_connect"]);
assert.match(section, /only when the user explicitly names an imported host/);
assert.match(section, /Connect before calling other ssh_\* tools/);
assert.match(section, /separate step and wait for success before calling other ssh_\* tools/);
assert.match(section, /never infer or substitute a different host/);
});
test("remote cwd routing separates persistent workspace changes from shell commands", () => {
const section = buildToolRoutingSection(["ssh_cd", "ssh_bash"]);
assert.match(section, /call it as a separate step and wait for success/);
assert.match(section, /relative ssh_read\/ssh_write\/ssh_edit\/ssh_find\/ssh_grep/);
assert.match(section, /intentionally temporary, command-local directory change/);
});
test("remote search routing uses structured bounded SSH tools", () => {
const section = buildToolRoutingSection(["ssh_find", "ssh_grep"]);
assert.match(section, /use ssh_find to narrow remote file paths before ssh_grep/);