mirror of
https://bitbucket.org/siakitem/my-pi.git
synced 2026-10-26 18:55:22 +00:00
云服务部-叶林立andDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2aa1be0b54
配置统一：权限策略、硬防御、Tool Search、提示词封面以及新迁入的 RTK、pi-compaction、pi-worktree、pi-hermes-memory 配置全部由扩展 直接读取已安装组合包内的 config/，pi install / pi update 即完成部署； 删除 rebuild-bundle-config.mjs 与 bundle-manifest.json，my-pi/ 只保留 日志与缓存。update.sh 成功升级后将默认 git 来源的已安装副本 reset 回发布版本。AGENTS.md 新增「组合包配置原则」。 脚本整合：search_config.sh / ssh_config.sh 合并为 configure.sh search|ssh；install.sh / update.sh 共享函数抽到 scripts/lib.sh，远程 安装器改为先下载到临时文件再执行，下载失败可被检测。 权限：hard-guards 新增 protectedWrites，写入 Pi 凭据/设置、已安装 组合包与扩展目录、pi-ssh 凭据库时一律人工确认（跳过 AutoReview、 yolo 与 Session grant，无 UI 时拒绝）；放行 ls、LSP 查询、ctx 只读、 web_search、Chrome 只读与 git 只读命令，skill_manage 改为 ask。 Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
36 lines
1.7 KiB
JSON
36 lines
1.7 KiB
JSON
{
|
||
// Bundle-owned hard guards, read directly from the installed bundle's
|
||
// config/ directory. pi update overwrites this file; project configuration
|
||
// cannot override it.
|
||
"version": 1,
|
||
"permission": {
|
||
"bash": {
|
||
"rm -rf /": "deny",
|
||
"rm -rf /*": "deny",
|
||
"rm -rf ~": "deny",
|
||
"rm -rf ~/*": "deny",
|
||
"sudo rm -rf /": "deny",
|
||
"sudo rm -rf /*": "deny",
|
||
"mkfs*": "deny",
|
||
"dd * of=/dev/*": "deny"
|
||
}
|
||
},
|
||
// Writes to the files below always reach a human prompt — never AutoReview,
|
||
// never yolo, never an existing session grant — and are denied outright when
|
||
// no confirmation UI is available. Reads are unaffected. `*` crosses `/`, so
|
||
// `/**` covers a whole subtree. `{agentDir}` is the Pi agent directory,
|
||
// `{configHome}` is $XDG_CONFIG_HOME or ~/.config; a leading `~/` also works.
|
||
"protectedWrites": [
|
||
{ "pattern": "{agentDir}/auth.json", "label": "Pi 凭据（模型与搜索 API key）" },
|
||
{ "pattern": "{agentDir}/settings.json", "label": "Pi 全局设置" },
|
||
{ "pattern": "{agentDir}/models.json", "label": "Pi 模型配置" },
|
||
{ "pattern": "{agentDir}/trust.json", "label": "项目信任记录" },
|
||
{ "pattern": "{agentDir}/hashline.json", "label": "Hashline 配置" },
|
||
{ "pattern": "{agentDir}/lsp.json", "label": "LSP 配置" },
|
||
{ "pattern": "{agentDir}/git/**", "label": "已安装的组合包（含 config/ 与权限系统源码）" },
|
||
{ "pattern": "{agentDir}/npm/**", "label": "已安装的 npm 扩展" },
|
||
{ "pattern": "{agentDir}/extensions/**", "label": "Pi 自动加载的扩展目录" },
|
||
{ "pattern": "{configHome}/my-pi/**", "label": "pi-ssh 凭据库与 p10k 配置" }
|
||
]
|
||
}
|