@maxiaochao/pi-toolkit 0.13.1 → 0.13.3

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## 2026-10-21 - v0.13.3
+
+- codex-edit v0.2.0: persist personal routing rules in the Pi agent directory across package updates
+- Codex Edit: read persistent personal routing overrides from `~/.pi/agent/codex-edit.json` (respecting `PI_CODING_AGENT_DIR`), shared by parent sessions and explicitly configured subagents; validate user settings and preserve the bundled defaults.
+
+## 2026-10-21 - v0.13.2
+
+- make agent-team user-invoked only and add post-release workflow/npm/tarball verification
+
+## Unreleased
+
+- Make Agent Team user-invoked only through `/skill:agent-team`, hidden from automatic model selection.
+- Add `npm run release:check -- vX.Y.Z` to wait for GitHub publication and verify exact npm versions, remote tags, integrity, and all tarball contents against the release commit, including coordinated child releases.
+
 ## 2026-10-21 - v0.13.1
 
 - herdr-subagents v0.7.2: clarify final answer submission through subagent_report

package/README.md

@@ -40,6 +40,8 @@ Restart Pi after updating. `pi update --extensions` has the same effect when upd
 
 Each child README owns its feature description, motivation or upstream alignment, examples, screenshots/demos, configuration, and test documentation.
 
+Codex Edit personal routing rules belong in `~/.pi/agent/codex-edit.json`, not inside `node_modules`. User fields override bundled defaults; `models` replaces the complete default list. The file survives package updates and is shared by parent sessions and explicitly configured subagents using the same agent directory. Use `/reload` after editing it, and start new subagents. See [Codex Edit configuration](packages/codex-edit/README.md#configuration).
+
 Herdr Subagents tasks require an explicit `agent` Persona; no default `worker` is selected. Choose `reviewer` for independent reviews of proposals, designs, documents, implementations, or analysis; `explorer` for codebase investigation; `worker` for file-changing work; and `analyst` for charter-defined agent-team roles. See [built-in Personas](packages/herdr-subagents/README.md#built-in-personas) for selection guidance and the distinction between parent-facing descriptions and child instructions. Personas can opt into local extension files or npm/git Pi packages through `extensions`. Set top-level `defaultExtensions` in `~/.pi/agent/herdr-subagents.json` (or project `.pi/herdr-subagents.json`) to share a fallback list; Persona-specific lists take precedence, and `[]` clears inherited sources. This uses native Pi package semantics: package-provided skills, prompt templates, and themes may also load, and `--no-skills` does not exclude explicitly selected package skills. See the [extension-source contract](packages/herdr-subagents/README.md#explicit-extension-sources-and-pi-packages) for precedence, isolation, and examples. The [real Herdr smoke test](packages/herdr-subagents/TESTING.md) preserves the configured analyst model and explicit authentication extensions while isolating unrelated settings.
 
 Multiple standalone children may be installed together. `pi-openai-account-pool` may also be installed alongside the complete toolkit because the toolkit does not embed it. Every other child in the table above, including `pi-background-tasks`, is embedded, so a second install exposes the same resource twice.
@@ -77,7 +79,7 @@ bash scripts/install.sh
 | `html-artifact` | Build self-contained HTML explainers and diagrams |
 | `pdlog` | Decompress and inspect Pudu `.pdlog` files |
 | `herdr` | Control Herdr workspaces, tabs, panes, and agents |
-| `agent-team` | Let the main agent dispatch concurrent analysis using configured models and roles, collect results, and maintain investigation records; run extra review rounds as needed |
+| `agent-team` | Manually invoke `/skill:agent-team` for concurrent analysis with configured models and roles, result collection, and investigation records; hidden from automatic model selection |
 | `tapd` | Investigate and operate on TAPD items with workspace, evidence, and safe-download guardrails |
 
 Package-specific skills, such as `pi-worktree`, are documented by their child package.
@@ -85,3 +87,17 @@ Package-specific skills, such as `pi-worktree`, are documented by their child pa
 ## Repository
 
 This repository is an npm workspace. Child implementations live under `packages/*`; `extensions/` contains only the toolkit-only BTW module. Development, testing, media generation, and release rules are documented in [AGENTS.md](AGENTS.md).
+
+### Post-release verification
+
+After pushing a release, run from this checkout:
+
+```bash
+npm run release:check -- v0.13.1
+# Wait up to 15 minutes, polling every 15 seconds:
+npm run release:check -- v0.13.1 --timeout 900 --interval 15
+```
+
+Omit the tag to use the current root `package.json` version. Requires Node.js, Git, npm, tar, authenticated GitHub CLI (`gh auth login`), and local release tags (`git fetch origin --tags` if needed).
+
+The read-only check verifies remote tag commits, waits for the matching `publish.yml` run to succeed, and checks exact public npm versions and tarball integrity. It compares every packaged file and mode against an isolated snapshot of the release tag, including an optional coordinated child release. It uses the tag rather than uncommitted checkout changes, never installs or publishes, and removes temporary downloads. Failures exit nonzero; only a pending workflow or npm `E404` is retried within the shared timeout (600 seconds by default). Local packing uses `--ignore-scripts`, matching this repository's source-only packages; packages that add generated prepack output will need this check updated.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maxiaochao/pi-toolkit",
-  "version": "0.13.1",
+  "version": "0.13.3",
   "description": "Personal pi coding agent toolkit: background tasks, scheduler, /btw, /cache_export, apply_patch, browser automation, and bundled theme/skills.",
   "type": "module",
   "workspaces": [
@@ -61,10 +61,11 @@
     "ws": "^8.19.0"
   },
   "scripts": {
-    "test": "node tests/package-layout.mjs && node tests/release-check.mjs && npm --prefix packages/todo test && npm --prefix packages/cache-export test && npm --prefix packages/codex-edit test && npm --prefix packages/herdr-subagents test && npm --prefix packages/openai-account-pool test && npm --prefix packages/scheduler test && npm --prefix packages/background-tasks test && npm --prefix packages/worktree test && node --experimental-strip-types extensions/btw/tests/history.mjs",
-    "test:root": "node tests/package-layout.mjs && node tests/release-check.mjs && node --experimental-strip-types extensions/btw/tests/history.mjs",
+    "test": "node tests/package-layout.mjs && node tests/release-check.mjs && node tests/post-release-check.mjs && npm --prefix packages/todo test && npm --prefix packages/cache-export test && npm --prefix packages/codex-edit test && npm --prefix packages/herdr-subagents test && npm --prefix packages/openai-account-pool test && npm --prefix packages/scheduler test && npm --prefix packages/background-tasks test && npm --prefix packages/worktree test && node --experimental-strip-types extensions/btw/tests/history.mjs",
+    "test:root": "node tests/package-layout.mjs && node tests/release-check.mjs && node tests/post-release-check.mjs && node --experimental-strip-types extensions/btw/tests/history.mjs",
     "load-test": "pi -ne -e ./packages/cache-export/extensions/cache-export.ts && pi -ne -e ./extensions/btw/index.ts && pi -ne -e ./packages/codex-edit/extensions/codex-edit.ts && pi -ne -e ./packages/herdr-subagents/extensions/herdr-subagents.ts && pi -ne -e ./packages/scheduler/extensions/scheduler.ts && pi -ne -e ./packages/background-tasks/extensions/background-tasks.ts && pi -ne -e ./packages/worktree/extensions/worktree.ts && npm --prefix packages/background-tasks run load-test -- --toolkit",
     "load-test:root": "pi -ne -e ./extensions/btw/index.ts",
+    "release:check": "node scripts/post-release-check.mjs",
     "eval:agents": "node evaluations/agents-md/run.mjs",
     "eval:agents:test": "node evaluations/agents-md/tests/run-tests.mjs",
     "postinstall": "node scripts/install-agents.mjs"

package/packages/codex-edit/CHANGELOG.md

@@ -1,3 +1,10 @@
+## 2026-10-21 - v0.2.0
+
+- persist personal routing rules in the Pi agent directory across package updates
+- Read persistent user overrides from `~/.pi/agent/codex-edit.json`, or the custom `PI_CODING_AGENT_DIR`, so package updates no longer replace personal routing rules.
+- Merge settings by field over package defaults; replace model lists, preserve explicit false/empty values, and report malformed or unreadable configuration with its path.
+- Cover shared parent/child editor routing, reloads, API restrictions, read-only tool selection, and real patch execution through the production extension factory.
+
 ## 2026-10-10 - v0.1.10
 
 - remove redundant apply_patch prompt metadata

package/packages/codex-edit/README.md

@@ -50,7 +50,7 @@ The extension registers `apply_patch` and selects the editing tool from the reso
 - Model ID outside the allowlist: Pi's native `edit`
 - Model on another API, even if its ID matches: Pi's native `edit`
 
-The default allowlist enables all `gpt-5.6-*` models regardless of provider. Other model families can be added after separate validation by editing `config.json`.
+The default allowlist enables all `gpt-5.6-*` models regardless of provider. Other model families can be added after separate validation in `~/.pi/agent/codex-edit.json`.
 
 The extension does not add a permanent AGENTS rule telling models not to use `apply_patch`. Only the selected editor tool is active, so the model receives one editing protocol.
 
@@ -74,7 +74,11 @@ This repeated-header tolerance is a deliberate Pi-side extension: current Codex
 
 ## Configuration
 
-The extension defaults to a model-ID allowlist in `config.json`: `"gpt-5.6-*"`. Provider does not affect routing. Each entry is a `*` glob, so this matches every `gpt-5.6-` variant. The route additionally requires:
+The extension reads package defaults from its bundled `config.json`, then applies user overrides from `~/.pi/agent/codex-edit.json`. The user file is outside the installed package, so package updates do not replace your rules. When `PI_CODING_AGENT_DIR` is set, the user file is `<PI_CODING_AGENT_DIR>/codex-edit.json` instead.
+
+Each user field overrides the corresponding package default. `models` replaces the entire default list, rather than appending; `[]` clears it. Omitted fields inherit defaults. A missing user file is allowed. Invalid JSON, invalid known field types, or unreadable files fail extension loading with the file path instead of silently ignoring your rules. Unknown fields are ignored. There is no project-level Codex Edit configuration.
+
+The package default model-ID allowlist is `"gpt-5.6-*"`. Provider does not affect routing. Each entry is a `*` glob, so this matches every `gpt-5.6-` variant. The route additionally requires:
 
 ```text
 model.api = openai-responses or openai-codex-responses
@@ -92,7 +96,7 @@ Patterns are case-sensitive, match the complete model ID, and support `*` as the
 
 ### Add model rules
 
-Edit `config.json` and add validated model-ID patterns:
+Create `~/.pi/agent/codex-edit.json` and add validated model-ID patterns:
 
 ```json
 {
@@ -117,7 +121,11 @@ Adding a pattern only changes routing; it does not prove that a model handles th
 
 Grammar support is not part of the route. When a provider does not emit Lark grammar tools, Pi falls back to a normal function tool, so `apply_patch` still runs there — only the grammar-enforced output shape is lost.
 
-Edit `config.json` in the standalone installed package, or `packages/codex-edit/config.json` inside an installed full toolkit, only if you need to change the default allowlist. Package updates can replace local edits. Set `"enabled": false` to disable all `apply_patch` routing. The implementation keeps both tools registered for session replay and changes only the active tool set on `session_start` and `model_select`.
+Use a boolean for `enabled` and an array of non-empty strings for `models`. Set `"enabled": false` in the user file to disable all `apply_patch` routing. Do not edit the installed package's `config.json` for personal rules; move any existing personal rules into the user file.
+
+Configuration is read when the extension loads. After changing it, use `/reload` or restart Pi. Already running subagents retain their loaded configuration; start a new child to read changes. Parent sessions and subagents that load Codex Edit use the same user file when they share the same agent directory, regardless of working directory or toolkit/standalone distribution. The implementation keeps both tools registered for session replay and changes only the active tool set on `session_start` and `model_select`.
+
+Herdr Subagents does not automatically inherit the parent's extensions. To enable Codex Edit for a writing Persona, include the installed Codex Edit extension file in that Persona's `extensions` array in `~/.pi/agent/herdr-subagents.json`. You may instead use top-level `defaultExtensions` when the Persona has no explicit extension list; Persona-specific lists replace defaults, not merge with them. Preserve any authentication-provider extensions already configured. Read-only Personas should not gain editing tools.
 
 ## Documentation
 

package/packages/codex-edit/TESTING.md

@@ -2,7 +2,7 @@
 
 ## 流程
 
-1. `npm --prefix packages/codex-edit test`：运行 parser、matcher、路由、工具契约、包结构、下面两组强制对比、入口加载和 tarball 检查；随后生成 `docs/test-report.md` 并从该 Markdown 转换为自包含 `docs/test-report.html`。这是秒级反馈环，修改 parser 前必须先让对应回归用例变红。
+1. `npm --prefix packages/codex-edit test`：运行用户配置、parser、matcher、路由、工具契约、包结构、下面两组强制对比、入口加载、配置集成和 tarball 检查；随后生成 `docs/test-report.md` 并从该 Markdown 转换为自包含 `docs/test-report.html`。这是秒级反馈环，修改 parser 前必须先让对应回归用例变红。
 2. `pi -ne -e ./packages/codex-edit/extensions/codex-edit.ts`：加载权威入口；独立子包与根包 manifest 都指向该实现。
 3. `npm pack ./packages/codex-edit --dry-run`：检查独立 tarball。
 4. 在根目录运行 `npm test`、`npm run load-test` 和 `npm pack --dry-run`，确认主包内嵌的同一份实现没有退化。
@@ -10,6 +10,12 @@
 
 `docs/test-report.md` 是报告内容的权威中间产物，HTML 是每次测试生成的交付视图。提交或发布 Codex Edit 改动时必须包含两者，且 HTML 顶部 Overall 必须为 PASS。
 
+## 用户配置验证
+
+- `node --experimental-strip-types --test packages/codex-edit/tests/config.test.mjs`：隔离临时 agent 目录，覆盖缺少用户文件、按字段覆盖、模型列表替换、显式 false/空列表、非法 JSON/字段类型、读取失败、重新读取和不修改配置文件。包内默认模型规则保持不变。
+- `npm --prefix packages/codex-edit run load-test`：加载权威入口，再用 Pi 加载 `tests/config-integration.ts`。配置集成使用真实扩展 factory 和隔离的 `PI_CODING_AGENT_DIR`，通过模拟的事件/工具选择接口验证不同 cwd 的父子会话共享规则、模型/API 切换、只读工具列表、重载后的禁用和非法配置报错，并执行真实 `apply_patch` 写入临时文件。不修改个人配置、不调用模型、不启动真实 Herdr pane。
+- 用户文件固定为 agent 目录内的 `codex-edit.json`；不读取项目配置。修改后需要 `/reload`，已有子代理需要重新启动。此配置能力不等于验证新增模型的编辑质量；默认模型路由和历史 benchmark 不变，新增模型仍需独立验证。
+
 ## 两组强制对比
 
 1. `npm --prefix packages/codex-edit run test:compare-native`：使用当前 Pi 公开导出的真实 `createEditToolDefinition` 和本地 extension 实际注册的 `apply_patch`，将两个真实工具跑在同一组临时 workspace 与期望文件快照上；失败 case 还要求 Codex Edit 不产生部分写入。它比较编辑协议能力和确定性结果，不替代真实模型质量 benchmark。
@@ -35,12 +41,14 @@
 | 项目级多文件重构、重复 SKILL 分隔符、重复 tiny/release 文件块 | 解析为唯一文件操作并得到确定性结果 | `parser.test.mjs` |
 | workspace escape | 拒绝 | `parser.test.mjs` |
 | `gpt-5.6-*`、Responses API、disabled、自定义 glob | 仅允许规则内模型使用 `apply_patch`，其余回退 `edit` | `package.test.mjs` |
+| 用户配置缺失、覆盖、空列表、错误输入、重新读取 | 用户字段覆盖默认值，失败带配置路径，不重写文件 | `config.test.mjs` |
+| 父子会话、API 切换、只读工具、重载 | 共享 agent 目录配置，保留编辑权限与 API 限制 | `config-integration.ts` |
 
 空参数是模型/提供方生成的无效工具调用，Pi 会在扩展 `execute` 之前拦截；parser 无法也不应为缺失 patch 猜内容。`Failed to find expected lines` 表示 patch 基于旧文件内容，安全行为是失败后重新读取并生成新 patch，而不是放宽到可能改错位置。
 
 ## 最近验证结果
 
-当前基线为 22 个 Node 确定性测试及 12 个共享对比 case 全部通过。原生 edit 为 5 pass / 2 fail / 5 unsupported，本地 Codex Edit 为 7 pass / 5 正确安全拒绝；发布版 v0.1.7 为 6 pass / 6 fail，其中 5 个是正确安全拒绝，另 1 个是本地版已修复的同路径顺序 update。另有 5 个生产事故条目冻结真实问题来源，其中 4 个可进入 Agent Benchmark，1 个仅验证指定协议形态。真实触发过的 runner 类型重命名 ambiguous、重复同路径、空 chunk、stale context、解析路径别名冲突、工作区外绝对路径和项目级多文件形态均已进入回归集。发布前必须验证子包 tarball 和根包 tarball 都包含并成功加载该入口。
+当前基线为 29 个 Node 确定性测试及 12 个共享对比 case 全部通过。原生 edit 为 5 pass / 2 fail / 5 unsupported，本地 Codex Edit 为 7 pass / 5 正确安全拒绝；发布版 v0.1.7 为 6 pass / 6 fail，其中 5 个是正确安全拒绝，另 1 个是本地版已修复的同路径顺序 update。另有 5 个生产事故条目冻结真实问题来源，其中 4 个可进入 Agent Benchmark，1 个仅验证指定协议形态。真实触发过的 runner 类型重命名 ambiguous、重复同路径、空 chunk、stale context、解析路径别名冲突、工作区外绝对路径和项目级多文件形态均已进入回归集。发布前必须验证子包 tarball 和根包 tarball 都包含并成功加载该入口。
 
 正式 Agent Benchmark 的预算门禁使用仓库内 `benchmark/run-with-budget.mjs` 包装上游 runner。不要修改 `/tmp` 中的 benchmark clone，也不要允许 `apply_patch` 写出当前工作区；工作区外路径必须作为 Safety Regression 正确拒绝。包装器在 `--stop-cost` 停止调度，并以 `--max-cost` 检查最终硬上限。
 

package/packages/codex-edit/docs/test-report.html

@@ -18,7 +18,7 @@
 <p>被测包：<code>@maxiaochao/pi-codex-edit</code>（当前工作区）</p>
 <p>本报告严格区分真实模型基准、确定性协议回归和安全回归，三类成功率不会混算。</p>
 <h2 id="summary">执行摘要</h2>
-<ul><li>Agent Benchmark：<strong>通过（有共同例外）</strong> — 已完成 300/300 条 chain；本地版 First Exact 92/100、Final Exact 92/100，全部正式门槛通过。</li><li>协议/包回归：<strong>通过</strong> — 4/4 项检查通过。</li><li>安全回归：<strong>5/5 正确拒绝且零写入</strong>，包括工作区外路径。</li><li>下文提供 Agent、协议、安全、效率、版本、integrity 和任务来源的完整证据。</li></ul>
+<ul><li>Agent Benchmark：<strong>通过（有共同例外）</strong> — 已完成 300/300 条 chain；本地版 First Exact 92/100、Final Exact 92/100，全部正式门槛通过。</li><li>协议/包回归：<strong>通过</strong> — 5/5 项检查通过。</li><li>安全回归：<strong>5/5 正确拒绝且零写入</strong>，包括工作区外路径。</li><li>下文提供 Agent、协议、安全、效率、版本、integrity 和任务来源的完整证据。</li></ul>
 <h2 id="benchmark">Agent Benchmark：真实模型基准</h2>
 <p><strong>状态：通过（有共同例外）</strong></p>
 <p>三个测试臂均完成全部 100 个配对任务（共 300 条 chain），实际成本为 $12.388。本地版满足全部正式验收门槛；8 个最终失败均为三臂共同失败，不是本地版独有回归。</p>
@@ -88,13 +88,14 @@
 <ul><li>数据源：<a href="https://github.com/alexshpunt/explicit-edit-benchmark">https://github.com/alexshpunt/explicit-edit-benchmark</a>，commit <code>5827e3fb65845f4b76adb06e5919d94ec4ffd5cf</code>。</li><li>冻结任务：80 Neutral + 20 Challenge；seed 为 <code>pi-toolkit-codex-edit-100-v1</code>。</li><li>模型：<code>openai-codex/gpt-5.6-sol</code>；reasoning：<code>low</code>；Pi：<code>0.85.1</code>；最多 5 次 Oracle recovery。</li><li>发布版：<code>@maxiaochao/pi-codex-edit@0.1.7 (sha512-hfNfx20h51FLCueXaMqBUAVYnxoCakuI306rzuFPI/lS0HT1jE/wQ8xkKl9PwEXboVVD6ZzS/YB0VVrd67V7cw==)</code>。</li><li>本地版：<code>@maxiaochao/pi-codex-edit@0.1.7+local (sha512-Mf21ZfSwOOgaH2lSiF/DpoA8Jk5jH84MaZUX1abkMop3HST3xt2YtCw2NKwrRJpvmJB02bl9wwYyFlAVI68Qwg==)</code>。</li><li>Run ID：<code>explicit-edit-100-sol-low-v3-complete</code>；运行完整性：300/300。</li><li>Identity：task manifest <code>cab0278f530271c7bb3de3e4dba6ab252fa2b748d00164e749ecdbd8f9f7f431</code>；config <code>739bb323275fdcead7709f19a894b0dee57062f40064c04d182d96474535328c</code>；verifier <code>8bd4be15c886bba84e8a6fa46576c43f2ca0f02d2536d98403f97361914a166d</code>。</li><li>Provider 失败：0；失败工具调用：0。</li></ul>
 <h2 id="protocol">协议与包验证摘要</h2>
 <div class="table-wrap"><table><thead><tr><th>检查项</th><th>结果</th><th>命令</th></tr></thead><tbody>
-<tr><td>Node 回归测试</td><td>通过</td><td><code>node --experimental-strip-types --test tests/package.test.mjs tests/parser.test.mjs tests/released-vs-local.test.mjs tests/benchmark.test.mjs</code></td></tr>
+<tr><td>Node 回归测试</td><td>通过</td><td><code>node --experimental-strip-types --test tests/package.test.mjs tests/config.test.mjs tests/parser.test.mjs tests/released-vs-local.test.mjs tests/benchmark.test.mjs</code></td></tr>
 <tr><td>原生 edit 与本地 Codex Edit 对比</td><td>通过</td><td><code>pi -ne -e ./tests/native-vs-codex.ts</code></td></tr>
 <tr><td>扩展加载</td><td>通过</td><td><code>pi -ne -e ./extensions/codex-edit.ts</code></td></tr>
+<tr><td>用户配置与父子会话编辑器集成</td><td>通过</td><td><code>pi -ne -e ./tests/config-integration.ts</code></td></tr>
 <tr><td>独立包 tarball</td><td>通过</td><td><code>npm pack --dry-run --json</code></td></tr>
 </tbody></table></div>
 <h2 id="section-4">确定性回归基线</h2>
-<ul><li>Node 测试：预期 22 个，覆盖 parser、matcher、路由、包契约、resolved-path 防护、发布版对比、分层调度和生产事故语料。</li><li>共享对比 corpus：12 个 case。</li><li>原生 edit：5 通过 / 2 失败或正确拒绝 / 5 不适用。</li><li>Codex Edit 发布版 v0.1.7：6 通过 / 6 失败或正确拒绝。</li><li>Codex Edit 本地版：7 通过 / 5 正确安全拒绝。</li></ul>
+<ul><li>Node 测试：预期 29 个，覆盖用户配置覆盖与校验、parser、matcher、路由、包契约、resolved-path 防护、发布版对比、分层调度和生产事故语料。</li><li>共享对比 corpus：12 个 case。</li><li>原生 edit：5 通过 / 2 失败或正确拒绝 / 5 不适用。</li><li>Codex Edit 发布版 v0.1.7：6 通过 / 6 失败或正确拒绝。</li><li>Codex Edit 本地版：7 通过 / 5 正确安全拒绝。</li></ul>
 <p>“正确拒绝”表示无效或陈旧操作被拒绝，且工作区没有变化。“不适用”表示 Pi 原生 <code>edit</code> 无法用一次编辑协议调用表达该操作，不计为工具缺陷。</p>
 <h2 id="safety">安全回归</h2>
 <p>本地版 5/5 个安全 case 均正确拒绝，且工作区零写入。特别是 <code>outside-workspace-absolute-path</code> 的结果为 <strong>工作区外路径 — 正确拒绝</strong>；放行该操作会允许任意写入 benchmark sandbox 之外。安全拒绝不计入编辑失败率。</p>

package/packages/codex-edit/docs/test-report.md

@@ -9,7 +9,7 @@
 ## 执行摘要
 
 - Agent Benchmark：**通过（有共同例外）** — 已完成 300/300 条 chain；本地版 First Exact 92/100、Final Exact 92/100，全部正式门槛通过。
-- 协议/包回归：**通过** — 4/4 项检查通过。
+- 协议/包回归：**通过** — 5/5 项检查通过。
 - 安全回归：**5/5 正确拒绝且零写入**，包括工作区外路径。
 - 下文提供 Agent、协议、安全、效率、版本、integrity 和任务来源的完整证据。
 
@@ -114,14 +114,15 @@ Score v2 = `覆盖率 ×（0.75 × 首次精确率 + 0.25 × 最终精确率）`
 
 | 检查项 | 结果 | 命令 |
 |---|---|---|
-| Node 回归测试 | 通过 | `node --experimental-strip-types --test tests/package.test.mjs tests/parser.test.mjs tests/released-vs-local.test.mjs tests/benchmark.test.mjs` |
+| Node 回归测试 | 通过 | `node --experimental-strip-types --test tests/package.test.mjs tests/config.test.mjs tests/parser.test.mjs tests/released-vs-local.test.mjs tests/benchmark.test.mjs` |
 | 原生 edit 与本地 Codex Edit 对比 | 通过 | `pi -ne -e ./tests/native-vs-codex.ts` |
 | 扩展加载 | 通过 | `pi -ne -e ./extensions/codex-edit.ts` |
+| 用户配置与父子会话编辑器集成 | 通过 | `pi -ne -e ./tests/config-integration.ts` |
 | 独立包 tarball | 通过 | `npm pack --dry-run --json` |
 
 ## 确定性回归基线
 
-- Node 测试：预期 22 个，覆盖 parser、matcher、路由、包契约、resolved-path 防护、发布版对比、分层调度和生产事故语料。
+- Node 测试：预期 29 个，覆盖用户配置覆盖与校验、parser、matcher、路由、包契约、resolved-path 防护、发布版对比、分层调度和生产事故语料。
 - 共享对比 corpus：12 个 case。
 - 原生 edit：5 通过 / 2 失败或正确拒绝 / 5 不适用。
 - Codex Edit 发布版 v0.1.7：6 通过 / 6 失败或正确拒绝。

package/packages/codex-edit/docs/test-summary.md

@@ -1,7 +1,7 @@
 # Codex Edit 测试摘要
 
 - Agent Benchmark：**通过（有共同例外）** — 完成 300/300 条 chain；全部正式验收门槛通过。
-- 协议/包回归：**通过** — 4/4 项检查通过。
+- 协议/包回归：**通过** — 5/5 项检查通过。
 - 安全回归：**5/5 正确拒绝**，覆盖陈旧上下文、空 chunk、目标冲突、resolved alias 和工作区外路径。
 - First Exact：原生 edit 91/100，发布版 91/100，本地版 92/100；Final Exact：三臂均为 92/100。
 - 总成本：$12.388；Provider 失败：0。

package/packages/codex-edit/extensions/codex-edit.ts

@@ -5,6 +5,7 @@ import { Text } from "@earendil-works/pi-tui";
 import {
   generateDiffString,
   generateUnifiedPatch,
+  getAgentDir,
   withFileMutationQueue,
 } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
@@ -15,17 +16,9 @@ import {
   resolveWorkspacePath,
 } from "../src/parser.ts";
 import { modelIsAllowed } from "../src/model-routing.ts";
+import { loadSettings } from "../src/config.ts";
 
 const editorToolNames = new Set(["edit", "apply_patch"]);
-const settingsUrl = new URL("../config.json", import.meta.url);
-
-async function loadSettings() {
-  try {
-    return JSON.parse(await readFile(settingsUrl, "utf8"));
-  } catch {
-    return { enabled: true, models: [] };
-  }
-}
 
 function syncEditorTools(pi, ctx, model, settings) {
   const active = pi.getActiveTools();
@@ -96,7 +89,7 @@ function buildFileDetail(path, action, before, after, moveTo) {
 }
 
 export default async function (pi) {
-  const settings = await loadSettings();
+  const settings = await loadSettings(getAgentDir());
 
   pi.registerTool({
     name: "apply_patch",

package/packages/codex-edit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maxiaochao/pi-codex-edit",
-  "version": "0.1.10",
+  "version": "0.2.0",
   "description": "Pi extension that exposes Codex-style apply_patch for GPT/Codex models with model-aware edit fallback.",
   "type": "module",
   "keywords": [
@@ -42,11 +42,11 @@
   },
   "scripts": {
     "test": "node tests/generate-test-report.mjs",
-    "test:regression": "node --experimental-strip-types --test tests/package.test.mjs tests/parser.test.mjs tests/released-vs-local.test.mjs tests/benchmark.test.mjs",
+    "test:regression": "node --experimental-strip-types --test tests/package.test.mjs tests/config.test.mjs tests/parser.test.mjs tests/released-vs-local.test.mjs tests/benchmark.test.mjs",
     "test:compare-native": "pi -ne -e ./tests/native-vs-codex.ts",
     "test:compare-released": "node --experimental-strip-types --test tests/released-vs-local.test.mjs",
     "test:report": "node tests/generate-test-report.mjs",
-    "load-test": "pi -ne -e ./extensions/codex-edit.ts"
+    "load-test": "pi -ne -e ./extensions/codex-edit.ts && pi -ne -e ./tests/config-integration.ts"
   },
   "publishConfig": {
     "access": "public"

package/packages/codex-edit/src/config.ts

@@ -0,0 +1,40 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const defaultsPath = fileURLToPath(new URL("../config.json", import.meta.url));
+
+async function readSettings(path, required = false) {
+  let text;
+  try {
+    text = await readFile(path, "utf8");
+  } catch (error) {
+    if (!required && error.code === "ENOENT") return {};
+    throw new Error(`Codex Edit config ${path}: ${error.message}`, { cause: error });
+  }
+  try {
+    const value = JSON.parse(text);
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      throw new Error("expected a JSON object");
+    }
+    if ((required || "enabled" in value) && typeof value.enabled !== "boolean") {
+      throw new Error("enabled must be a boolean");
+    }
+    if ((required || "models" in value) && (!Array.isArray(value.models)
+      || !value.models.every((pattern) => typeof pattern === "string" && pattern.trim().length > 0))) {
+      throw new Error("models must be an array of non-empty strings");
+    }
+    return {
+      ...("enabled" in value ? { enabled: value.enabled } : {}),
+      ...("models" in value ? { models: value.models } : {}),
+    };
+  } catch (error) {
+    throw new Error(`Codex Edit config ${path}: ${error.message}`, { cause: error });
+  }
+}
+
+export async function loadSettings(agentDir) {
+  const defaults = await readSettings(defaultsPath, true);
+  const user = await readSettings(join(agentDir, "codex-edit.json"));
+  return { ...defaults, ...user };
+}

package/packages/codex-edit/tests/config-integration.ts

@@ -0,0 +1,78 @@
+import assert from "node:assert/strict";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import registerCodexEdit from "../extensions/codex-edit.ts";
+
+async function editor(tools = ["read", "bash", "edit", "write"]) {
+  let active = [...tools];
+  let tool;
+  let status;
+  const handlers = new Map();
+  await registerCodexEdit({
+    registerTool(definition) { tool = definition; },
+    on(event, handler) { handlers.set(event, handler); },
+    getActiveTools() { return active; },
+    setActiveTools(next) { active = next; },
+  });
+  return {
+    tool,
+    active: () => active,
+    status: () => status,
+    async start(model, cwd) {
+      await handlers.get("session_start")({}, {
+        model, cwd, hasUI: true,
+        ui: { setStatus(key, value) { assert.equal(key, "codex-edit"); status = value; } },
+      });
+    },
+    async select(model) {
+      await handlers.get("model_select")({ model }, { hasUI: false });
+    },
+  };
+}
+
+export default async function () {
+  const agentDir = await mkdtemp(join(tmpdir(), "codex-edit-integration-"));
+  const previous = process.env.PI_CODING_AGENT_DIR;
+  process.env.PI_CODING_AGENT_DIR = agentDir;
+  const configPath = join(agentDir, "codex-edit.json");
+  const model = { id: "gpt-6.1-sol", api: "openai-codex-responses" };
+  try {
+    await writeFile(configPath, JSON.stringify({ models: [model.id] }));
+    const parent = await editor();
+    const child = await editor();
+    for (const [session, cwd] of [[parent, "/parent-project"], [child, "/child-worktree"]]) {
+      await session.start(model, cwd);
+      assert.equal(session.status(), "editor: apply_patch");
+      assert.deepEqual(session.active(), ["read", "bash", "write", "apply_patch"]);
+      await session.select({ ...model, id: "gpt-5.6-sol" });
+      assert.ok(session.active().includes("edit"), "user list must replace defaults");
+      await session.select({ ...model, api: "openai-completions" });
+      assert.ok(session.active().includes("edit"), "unsupported API must retain edit");
+      await session.select(model);
+      assert.ok(!session.active().includes("edit"));
+    }
+    await child.tool.execute("config-patch", {
+      patch: "*** Begin Patch\n*** Add File: proof.txt\n+shared user config\n*** End Patch",
+    }, undefined, undefined, { cwd: agentDir });
+    assert.equal(await readFile(join(agentDir, "proof.txt"), "utf8"), "shared user config\n");
+
+    const readonly = await editor(["read", "bash"]);
+    await readonly.start(model, agentDir);
+    assert.deepEqual(readonly.active(), ["read", "bash"]);
+
+    await writeFile(configPath, JSON.stringify({ enabled: false }));
+    const reloaded = await editor();
+    await reloaded.start(model, agentDir);
+    assert.equal(reloaded.status(), "editor: edit");
+    assert.ok(!reloaded.active().includes("apply_patch"));
+
+    await writeFile(configPath, "{");
+    await assert.rejects(editor(), (error) => error.message.includes(configPath));
+    console.log("Codex Edit user config: shared parent/child routing, patch execution, read-only tools, reload and invalid-config checks passed");
+  } finally {
+    if (previous === undefined) delete process.env.PI_CODING_AGENT_DIR;
+    else process.env.PI_CODING_AGENT_DIR = previous;
+    await rm(agentDir, { recursive: true, force: true });
+  }
+}

package/packages/codex-edit/tests/config.test.mjs

@@ -0,0 +1,80 @@
+import assert from "node:assert/strict";
+import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import { loadSettings } from "../src/config.ts";
+import { modelIsAllowed } from "../src/model-routing.ts";
+
+async function fixture(t) {
+  const agentDir = await mkdtemp(join(tmpdir(), "codex-edit-config-"));
+  t.after(() => rm(agentDir, { recursive: true, force: true }));
+  return { agentDir, path: join(agentDir, "codex-edit.json") };
+}
+
+test("missing user config preserves package defaults without creating a file", async (t) => {
+  const { agentDir, path } = await fixture(t);
+  assert.deepEqual(await loadSettings(agentDir), { enabled: true, models: ["gpt-5.6-*"] });
+  await assert.rejects(readFile(path), { code: "ENOENT" });
+});
+
+test("partial user config overrides enabled while inheriting package models", async (t) => {
+  const { agentDir, path } = await fixture(t);
+  await writeFile(path, JSON.stringify({ enabled: false }));
+  assert.deepEqual(await loadSettings(agentDir), { enabled: false, models: ["gpt-5.6-*"] });
+});
+
+test("user model list replaces defaults and keeps API routing restrictions", async (t) => {
+  const { agentDir, path } = await fixture(t);
+  await writeFile(path, JSON.stringify({ models: ["gpt-6.1-sol"] }));
+  const settings = await loadSettings(agentDir);
+  assert.deepEqual(settings, { enabled: true, models: ["gpt-6.1-sol"] });
+  const model = { id: "gpt-6.1-sol", api: "openai-codex-responses" };
+  assert.equal(modelIsAllowed(model, settings), true);
+  assert.equal(modelIsAllowed({ ...model, api: "openai-responses" }, settings), true);
+  assert.equal(modelIsAllowed({ ...model, api: "anthropic-messages" }, settings), false);
+  assert.equal(modelIsAllowed({ ...model, id: "gpt-5.6-sol" }, settings), false);
+});
+
+test("empty models and explicit false are not replaced by defaults", async (t) => {
+  const { agentDir, path } = await fixture(t);
+  await writeFile(path, JSON.stringify({ enabled: false, models: [] }));
+  assert.deepEqual(await loadSettings(agentDir), { enabled: false, models: [] });
+  await writeFile(path, JSON.stringify({ models: [] }));
+  assert.deepEqual(await loadSettings(agentDir), { enabled: true, models: [] });
+});
+
+test("malformed JSON and invalid known fields fail visibly with the config path", async (t) => {
+  const { agentDir, path } = await fixture(t);
+  for (const input of ["{", "null", "[]", "true", '"text"', '{"enabled":"false"}',
+    '{"enabled":null}', '{"models":"gpt-*"}', '{"models":null}', '{"models":[1]}',
+    '{"models":[""]}', '{"models":["   "]}']) {
+    await writeFile(path, input);
+    await assert.rejects(loadSettings(agentDir), (error) => {
+      assert.ok(error.message.includes(path), `${input}: missing config path`);
+      return true;
+    });
+  }
+});
+
+test("config read errors other than missing files are not ignored", async (t) => {
+  const { agentDir, path } = await fixture(t);
+  await mkdir(path);
+  await assert.rejects(loadSettings(agentDir), (error) => {
+    assert.ok(error.message.includes(path));
+    return true;
+  });
+});
+
+test("reload reads updated user rules without rewriting either config", async (t) => {
+  const { agentDir, path } = await fixture(t);
+  const defaultsUrl = new URL("../config.json", import.meta.url);
+  const defaultsBefore = await readFile(defaultsUrl, "utf8");
+  await writeFile(path, JSON.stringify({ models: ["gpt-6.1-sol"], note: "preserve unknown fields" }));
+  assert.deepEqual((await loadSettings(agentDir)).models, ["gpt-6.1-sol"]);
+  const next = JSON.stringify({ models: ["custom-*"], note: "preserve unknown fields" });
+  await writeFile(path, next);
+  assert.deepEqual((await loadSettings(agentDir)).models, ["custom-*"]);
+  assert.equal(await readFile(path, "utf8"), next);
+  assert.equal(await readFile(defaultsUrl, "utf8"), defaultsBefore);
+});

package/packages/codex-edit/tests/generate-test-report.mjs

@@ -13,7 +13,7 @@ const defaultEvidencePath = join(packageDir, "benchmark/results/explicit-edit-10
 const checks = [
   {
     name: "Node 回归测试",
-    command: ["node", "--experimental-strip-types", "--test", "tests/package.test.mjs", "tests/parser.test.mjs", "tests/released-vs-local.test.mjs", "tests/benchmark.test.mjs"],
+    command: ["node", "--experimental-strip-types", "--test", "tests/package.test.mjs", "tests/config.test.mjs", "tests/parser.test.mjs", "tests/released-vs-local.test.mjs", "tests/benchmark.test.mjs"],
   },
   {
     name: "原生 edit 与本地 Codex Edit 对比",
@@ -23,6 +23,10 @@ const checks = [
     name: "扩展加载",
     command: ["pi", "-ne", "-e", "./extensions/codex-edit.ts"],
   },
+  {
+    name: "用户配置与父子会话编辑器集成",
+    command: ["pi", "-ne", "-e", "./tests/config-integration.ts"],
+  },
   {
     name: "独立包 tarball",
     command: ["npm", "pack", "--dry-run", "--json"],
@@ -345,7 +349,7 @@ function buildMarkdown(results, benchmark) {
     "",
     "## 确定性回归基线",
     "",
-    `- Node 测试：预期 22 个，覆盖 parser、matcher、路由、包契约、resolved-path 防护、发布版对比、分层调度和生产事故语料。`,
+    `- Node 测试：预期 29 个，覆盖用户配置覆盖与校验、parser、matcher、路由、包契约、resolved-path 防护、发布版对比、分层调度和生产事故语料。`,
     `- 共享对比 corpus：${comparisonCases.length} 个 case。`,
     `- 原生 edit：${count("pass", "native")} 通过 / ${count("fail", "native")} 失败或正确拒绝 / ${count("unsupported", "native")} 不适用。`,
     `- Codex Edit 发布版 v0.1.7：${count("pass", "released")} 通过 / ${count("fail", "released")} 失败或正确拒绝。`,

package/packages/codex-edit/tests/package.test.mjs

@@ -10,7 +10,10 @@ test("package points Pi at the extension and config is reachable from it", async
   const manifest = JSON.parse(await readFile(join(packageDir, "package.json"), "utf8"));
   assert.deepEqual(manifest.pi.extensions, ["./extensions/codex-edit.ts"]);
   const source = await readFile(join(packageDir, "extensions/codex-edit.ts"), "utf8");
-  assert.match(source, /new URL\("\.\.\/config\.json", import\.meta\.url\)/);
+  assert.match(source, /loadSettings\(getAgentDir\(\)\)/);
+  const settingsSource = await readFile(join(packageDir, "src/config.ts"), "utf8");
+  assert.match(settingsSource, /new URL\("\.\.\/config\.json", import\.meta\.url\)/);
+  assert.match(settingsSource, /join\(agentDir, "codex-edit\.json"\)/);
   assert.match(source, /model-routing\.ts/);
   assert.match(source, /parameters: Type\.Object\(\{\s*patch: Type\.String/);
   assert.match(source, /applyUpdateGroups\(before, operation\.chunkGroups, operation\.path\)/);

package/skills/agent-team/SKILL.md

@@ -1,13 +1,14 @@
 ---
 name: agent-team
-description: 多模型协作分析：主 Agent 按配置的模型和角色调度独立子代理，汇总结果并维护调查档案。用于用户要求多模型分析或对抗评审，或高代价决策需要独立复核时。
+description: 多模型协作分析：按配置的模型和角色调度独立子代理，汇总结果并维护调查档案。
+disable-model-invocation: true
 ---
 
 当前会话是**主 Agent**，负责核心调度：按配置中的模型和角色启动独立子代理，分派用户问题，收集结果并维护调查档案。主 Agent 根据结果决定直接回答、补充核验或继续下一轮。子代理不需要常驻；跨轮连续性来自持久调查档案和逻辑成员身份，而不是聊天记忆。
 
-## 何时值得开
+## 调用方式
 
-用户明确要求多模型分析或对抗评审时开启；主 Agent 也可在结论会驱动高代价动作（改内核、下线设备、向客户定责）时主动开启。查一个事实、读一份文件用不上。
+用户通过 `/skill:agent-team` 显式加载后开启。此 skill 不参与模型自动选择；高代价决策也不构成自动加载或启动的授权。
 
 ## 1. 建立调查档案