feat: 接入 Pi 内置 codemode，并修复全面审查发现的问题

- codemode：Tool Search 常驻（alwaysEnabled）、权限 allow（嵌套调用仍逐个过权限门）、
  tools.jsonc 登记使用规则；RTK 跳过 parentToolCallId 嵌套调用，避免丢失 bash
  structuredContent；Tool Search 目录过滤 hidden / codemode（script-only）exposure；
  扩展加载测试加载 builtin:codemode 并断言其常驻激活
- 搜索 key 不再经命令行参数传递：search-auth.mjs 改为 --set-stdin（先读校验再加锁），
  configure.sh 交互输入经管道、非交互用 --<provider> -
- CodeGraph 客户端监听子进程 stdin error，避免 EPIPE 未处理导致崩溃
- 移除 PI_TOOL_SEARCH/HERMES_MEMORY/RTK_CONFIG_PATH 环境变量入口，测试改用工厂 configPath 注入
- pi-subagents 固定 vitest / coverage-istanbul 4.1.10，修复 npm ls 版本冲突
- 补 pi-web-search / pi-worktree UPSTREAM.md 与 pi-minimal-footer AGENTS.md，
  files 白名单补齐并加测试；.codegraph/.gitignore 移出跟踪
- detect_kitty 优先识别官方安装目录

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

pi-hermes-memory/src/config.ts

@@ -89,16 +89,7 @@ export const DEFAULT_CONFIG_PATH = fileURLToPath(
   new URL("../../config/pi-hermes-memory.json", import.meta.url),
 );
 
-/**
- * Resolve the effective config path. `PI_HERMES_MEMORY_CONFIG_PATH` relocates
- * the file (tests point it at a temp file; it is never a persisted config
- * value).
- */
-export function resolveConfigPath(): string {
-  return process.env.PI_HERMES_MEMORY_CONFIG_PATH ?? DEFAULT_CONFIG_PATH;
-}
-
-export function loadConfig(configPath = resolveConfigPath()): MemoryConfig {
+export function loadConfig(configPath = DEFAULT_CONFIG_PATH): MemoryConfig {
   try {
     if (fs.existsSync(configPath)) {
       const raw = fs.readFileSync(configPath, "utf-8");

pi-hermes-memory/src/index.ts

@@ -52,7 +52,7 @@ import { registerPreviewContextCommand } from "./handlers/preview-context.js";
 import { registerStandingPinCommand } from "./handlers/standing-pin.js";
 import { StandingInstructions } from "./store/standing-instructions.js";
 import { STANDING_FILE } from "./constants.js";
-import { loadConfig } from "./config.js";
+import { DEFAULT_CONFIG_PATH, loadConfig } from "./config.js";
 import { shouldWarnAutoConsolidationFailure } from "./auto-consolidation-warning.js";
 import { detectProject, detectProjectSkills } from "./project.js";
 import { buildPromptContext } from "./prompt-context.js";
@@ -90,8 +90,12 @@ export function registerProjectSkillDiscoveryHandler(
   });
 }
 
-export default function (pi: ExtensionAPI) {
-  const config = loadConfig();
+export interface HermesMemoryExtensionOptions {
+  configPath?: string;
+}
+
+function hermesMemoryExtension(pi: ExtensionAPI, configPath: string) {
+  const config = loadConfig(configPath);
   const lazy = config.lazyInitialization === true && config.memoryMode === "policy-only";
   let sessionContext: ExtensionContext | undefined;
 
@@ -480,3 +484,12 @@ export default function (pi: ExtensionAPI) {
     }
   });
 }
+
+export function createHermesMemoryExtension(
+  options?: HermesMemoryExtensionOptions,
+): (pi: ExtensionAPI) => void {
+  const configPath = options?.configPath ?? DEFAULT_CONFIG_PATH;
+  return (pi) => hermesMemoryExtension(pi, configPath);
+}
+
+export default createHermesMemoryExtension();