mirror of
https://bitbucket.org/siakitem/my-pi.git
synced 2026-10-26 18:55:22 +00:00
云服务部-叶林立andDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2aa1be0b54
配置统一：权限策略、硬防御、Tool Search、提示词封面以及新迁入的 RTK、pi-compaction、pi-worktree、pi-hermes-memory 配置全部由扩展 直接读取已安装组合包内的 config/，pi install / pi update 即完成部署； 删除 rebuild-bundle-config.mjs 与 bundle-manifest.json，my-pi/ 只保留 日志与缓存。update.sh 成功升级后将默认 git 来源的已安装副本 reset 回发布版本。AGENTS.md 新增「组合包配置原则」。 脚本整合：search_config.sh / ssh_config.sh 合并为 configure.sh search|ssh；install.sh / update.sh 共享函数抽到 scripts/lib.sh，远程 安装器改为先下载到临时文件再执行，下载失败可被检测。 权限：hard-guards 新增 protectedWrites，写入 Pi 凭据/设置、已安装 组合包与扩展目录、pi-ssh 凭据库时一律人工确认（跳过 AutoReview、 yolo 与 Session grant，无 UI 时拒绝）；放行 ls、LSP 查询、ctx 只读、 web_search、Chrome 只读与 git 只读命令，skill_manage 改为 ask。 Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
55 lines
1.9 KiB
JSON
55 lines
1.9 KiB
JSON
{
|
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
"$id": "https://raw.githubusercontent.com/siakitem/my-pi/main/pi-permission-system/schemas/hard-guards.schema.json",
|
|
"title": "Pi Permission System Hard Guards",
|
|
"description": "Global-only allow exceptions and non-overridable deny rules evaluated before ordinary policy, session grants, and AutoReview, plus protectedWrites whose writes always escalate to a human prompt.",
|
|
"type": "object",
|
|
"properties": {
|
|
"$schema": { "type": "string" },
|
|
"version": { "const": 1 },
|
|
"permission": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"oneOf": [
|
|
{ "$ref": "#/$defs/hardValue" },
|
|
{
|
|
"type": "object",
|
|
"additionalProperties": { "$ref": "#/$defs/hardValue" }
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"protectedWrites": {
|
|
"type": "array",
|
|
"description": "Files and subtrees whose writes are human-only: every write goes to a local human prompt, skipping AutoReview, yolo, and session grants, and is denied when no UI is available. Patterns use the path surface wildcard syntax; {agentDir}, {configHome} and a leading ~/ are expanded at load.",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"pattern": { "type": "string", "minLength": 1 },
|
|
"label": { "type": "string", "minLength": 1 }
|
|
},
|
|
"required": ["pattern", "label"],
|
|
"additionalProperties": false
|
|
}
|
|
}
|
|
},
|
|
"required": ["version", "permission"],
|
|
"additionalProperties": false,
|
|
"$defs": {
|
|
"hardValue": {
|
|
"oneOf": [
|
|
{ "enum": ["allow", "deny"] },
|
|
{
|
|
"type": "object",
|
|
"properties": {
|
|
"action": { "const": "deny" },
|
|
"reason": { "type": "string", "minLength": 1, "maxLength": 500 }
|
|
},
|
|
"required": ["action"],
|
|
"additionalProperties": false
|
|
}
|
|
]
|
|
}
|
|
}
|
|
}
|