pi-coding-master 0.2.7

package/deploy/dist-overrides/vendor.REMOVED/jiti/lib/jiti.mjs

@@ -0,0 +1,3 @@
+// jiti DISABLED by NORM-020 — any import() goes through native Node, not jiti
+export function createJiti() { throw new Error("jiti disabled by NORM-020. Use native Node import() instead."); }
+export default createJiti;

package/deploy/install.sh

@@ -0,0 +1,186 @@
+#!/bin/bash
+# pi-coding-master installer v0.2.7
+# 兼容 macOS + Linux。从 npm 全局安装或手动 bash deploy/install.sh 均可。
+#
+# 两条铁律：
+#  1) pi-tui 的 tui.js + blockrender.js + text.js 三件套绝不能注释掉——防崩的。
+#  2) live(node_modules)是一次性的,npm 重装就冲掉。修复只在源,live 崩了跑本脚本重建。
+set -e
+
+PIN="0.79.10"
+
+# ── 定位自身：支持 DEV 开发模式 + npm 全局安装模式 ──
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+PKG_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+# 判断是 DEV 模式还是发行包模式
+if [ -d "$PKG_ROOT/Codebase/core" ]; then
+  # DEV 模式：pi-coding-master.DEV/Codebase/deploy/install.sh
+  IMPL="$PKG_ROOT/Codebase/core"
+  DEPLOY="$PKG_ROOT/Codebase/deploy"
+elif [ -d "$PKG_ROOT/core" ]; then
+  # 发行包模式：v0.2.7-stable/deploy/install.sh 或 npm 全局 pi-coding-master/deploy/install.sh
+  IMPL="$PKG_ROOT/core"
+  DEPLOY="$PKG_ROOT/deploy"
+else
+  echo "Error: 找不到 core/ 目录。请从 pi-coding-master 包根目录运行 bash deploy/install.sh"
+  exit 1
+fi
+
+echo "── pi-coding-master installer (pinned pi $PIN) ──"
+echo "  source: $PKG_ROOT"
+
+# ── 1. 定位 pi(只认 @earendil-works) ──
+PI_DIST=""
+SEARCH_PATHS=""
+# npm root -g 在 mac/linux 都能用
+NPM_GLOBAL="$(npm root -g 2>/dev/null)"
+[ -n "$NPM_GLOBAL" ] && SEARCH_PATHS="$NPM_GLOBAL/@earendil-works/pi-coding-agent/dist"
+# mac homebrew
+SEARCH_PATHS="$SEARCH_PATHS /opt/homebrew/lib/node_modules/@earendil-works/pi-coding-agent/dist"
+# linux 常见路径
+SEARCH_PATHS="$SEARCH_PATHS /usr/lib/node_modules/@earendil-works/pi-coding-agent/dist"
+SEARCH_PATHS="$SEARCH_PATHS /usr/local/lib/node_modules/@earendil-works/pi-coding-agent/dist"
+# nvm/fnm
+[ -n "$NVM_DIR" ] && SEARCH_PATHS="$SEARCH_PATHS $(dirname "$(which node)" 2>/dev/null)/../lib/node_modules/@earendil-works/pi-coding-agent/dist"
+
+for c in $SEARCH_PATHS; do
+  [ -f "$c/core/tools/bash.js" ] && { PI_DIST="$c"; break; }
+done
+[ -z "$PI_DIST" ] && { echo "Error: 未找到 @earendil-works/pi-coding-agent。先: npm i -g @earendil-works/pi-coding-agent@$PIN"; exit 1; }
+VER="$(node -e "console.log(require('$(dirname "$PI_DIST")/package.json').version)")"
+echo "  pi $VER @ $PI_DIST"
+[ "$VER" != "$PIN" ] && echo "  WARN: patch 钉死 $PIN;当前是 $VER,可能打不上。"
+
+# ── 2. 打 dist patch ──
+apply_patch() {
+  local pf="$1" n; n="$(basename "$pf")"
+  if ( cd "$PI_DIST" && git apply --reverse --check -p1 "$pf" ) 2>/dev/null; then
+    echo "   $n 已应用"
+  elif ( cd "$PI_DIST" && git apply --check -p1 "$pf" ) 2>/dev/null; then
+    ( cd "$PI_DIST" && git apply -p1 "$pf" ); echo "  OK $n"
+  else
+    echo "  WARN: $n patch不匹配当前dist，跳过。"
+  fi
+}
+echo "patch dist:"
+apply_patch "$IMPL/individual.bio.organs/heart.interrupt/runner_esc.patch"
+apply_patch "$IMPL/individual.bio.organs/heart.interrupt/interactive-mode-loader.patch"
+
+# ── 2b. dist-overrides ──
+PI_AI_DIST="$(dirname "$PI_DIST")/node_modules/@earendil-works/pi-ai/dist"
+PI_TUI_DIST="$(dirname "$PI_DIST")/node_modules/@earendil-works/pi-tui/dist"
+echo "dist-overrides:"
+if [ "$VER" = "$PIN" ]; then
+  # 语法闸
+  echo "  语法闸:校验 golden..."
+  GATE_BAD=0
+  for js in $(find "$DEPLOY/dist-overrides" -name "*.js" ! -name "*.bak" 2>/dev/null) "$IMPL/god.pi.mod/tui.mods.blockrender/blockrender.js"; do
+    node --check "$js" 2>/dev/null || { echo "  Error: golden 语法错: ${js#$PKG_ROOT/}"; GATE_BAD=1; }
+  done
+  [ "$GATE_BAD" = "1" ] && { echo "  Error: 有 golden 解析不过,中止部署。"; exit 1; }
+  echo "  OK 所有 golden 语法通过"
+
+  cp "$IMPL/god.pi.mod/tui.mods.blockrender/blockrender.js" "$PI_DIST/modes/interactive/components/blockrender.js" && echo "  OK blockrender.js"
+  cp "$DEPLOY/dist-overrides/modes/interactive/components/footer.js" "$PI_DIST/modes/interactive/components/footer.js" && echo "  OK footer.js"
+  cp "$DEPLOY/dist-overrides/modes/interactive/components/tool-execution.js" "$PI_DIST/modes/interactive/components/tool-execution.js" && echo "  OK tool-execution.js"
+  cp "$DEPLOY/dist-overrides/modes/interactive/components/model-selector.js" "$PI_DIST/modes/interactive/components/model-selector.js" && echo "  OK model-selector.js"
+  cp "$DEPLOY/dist-overrides/core/system-prompt.js" "$PI_DIST/core/system-prompt.js" && echo "  OK system-prompt.js"
+  cp "$DEPLOY/dist-overrides/modes/interactive/interactive-mode.js" "$PI_DIST/modes/interactive/interactive-mode.js" && echo "  OK interactive-mode.js"
+  cp "$DEPLOY/dist-overrides/main.js" "$PI_DIST/main.js" && echo "  OK main.js"
+  cp "$DEPLOY/dist-overrides/modes/interactive/components/assistant-message.js" "$PI_DIST/modes/interactive/components/assistant-message.js" && echo "  OK assistant-message.js"
+  cp "$DEPLOY/dist-overrides/core/extensions/loader.js" "$PI_DIST/core/extensions/loader.js" && echo "  OK core/extensions/loader.js"
+  cp "$DEPLOY/dist-overrides/core/package-manager.js" "$PI_DIST/core/package-manager.js" && echo "  OK core/package-manager.js"
+
+  for f in bash edit read write ls grep find; do
+    cp "$DEPLOY/dist-overrides/core/tools/$f.js" "$PI_DIST/core/tools/$f.js" && echo "  OK core/tools/$f.js"
+  done
+  for f in edit-diff.js file-mutation-queue.js ls-guard.js output-accumulator.js path-utils.js prompts-reader.js render-utils.js tool-definition-wrapper.js truncate.js; do
+    [ -f "$DEPLOY/dist-overrides/core/tools/$f" ] && cp "$DEPLOY/dist-overrides/core/tools/$f" "$PI_DIST/core/tools/$f" && echo "  OK core/tools/$f"
+  done
+
+  if [ -d "$PI_TUI_DIST" ]; then
+    cp "$IMPL/god.pi.mod/tui.mods.blockrender/blockrender.js" "$PI_TUI_DIST/blockrender.js" && echo "  OK pi-tui/blockrender.js"
+    cp "$DEPLOY/dist-overrides/pi-tui/tui.js" "$PI_TUI_DIST/tui.js" && echo "  OK pi-tui/tui.js"
+    cp "$DEPLOY/dist-overrides/pi-tui/utils.js" "$PI_TUI_DIST/utils.js" && echo "  OK pi-tui/utils.js"
+    cp "$DEPLOY/dist-overrides/pi-tui/components/markdown.js" "$PI_TUI_DIST/components/markdown.js" && echo "  OK pi-tui/components/markdown.js"
+    cp "$DEPLOY/dist-overrides/pi-tui/components/text.js" "$PI_TUI_DIST/components/text.js" && echo "  OK pi-tui/components/text.js"
+    cp "$DEPLOY/dist-overrides/pi-tui/components/loader.js" "$PI_TUI_DIST/components/loader.js" && echo "  OK pi-tui/components/loader.js"
+  else
+    echo "  WARN: 未找到 pi-tui/dist，跳过渲染 override。"
+  fi
+
+  if [ -f "$PI_AI_DIST/providers/openai-completions.js" ]; then
+    cp "$DEPLOY/dist-overrides/pi-ai/providers/openai-completions.js" "$PI_AI_DIST/providers/openai-completions.js" && echo "  OK openai-completions.js"
+    mkdir -p "$(dirname "$PI_DIST")/prompts"
+    [ -f "$IMPL/prompts/prompts.json" ] && cp "$IMPL/prompts/prompts.json" "$(dirname "$PI_DIST")/prompts/prompts.json" && echo "  OK prompts/prompts.json"
+  else
+    echo "  WARN: 未找到 pi-ai/providers/openai-completions.js，跳过断流补丁。"
+  fi
+else
+  echo "  pi $VER != $PIN：跳过 dist-overrides，避免不兼容。"
+fi
+
+# ── 3. 部署扩展 ──
+EXT_DIR="$HOME/.pi/agent/extensions"
+mkdir -p "$EXT_DIR"
+
+for old in unstop conscious memory hippocampus; do
+  [ -d "$EXT_DIR/$old" ] && [ ! -L "$EXT_DIR/$old" ] && mv "$EXT_DIR/$old" "$EXT_DIR/$old.old"
+done
+
+safe_deploy() {
+  local src="$1" dest="$2" label="$3"; local d="${dest%/}"
+  if [ -L "$d" ]; then
+    echo "  跳过 $label -- $d 是软链(已 live 指向源)"
+    return 0
+  fi
+  rsync -a --exclude='.DS_Store' --exclude='__pycache__' --exclude='*.pyc' "$src" "$dest"
+  echo "  OK $label"
+}
+
+echo "扩展:"
+safe_deploy "$IMPL/"                                  "$EXT_DIR/pi-coding-master/"   "pi-coding-master/ (主扩展)"
+safe_deploy "$IMPL/technology.phone/"                 "$EXT_DIR/device/"     "device/"
+safe_deploy "$IMPL/god.pi.mod/tui.mods.viewmode/"    "$EXT_DIR/view_mode/"  "view_mode/"
+
+# ── 4. 部署 launcher ──
+mkdir -p "$HOME/.local/bin"
+LAUNCHER_SRC="$IMPL/god.pi.mod/cli/pi-people.sh"
+if [ -L "$HOME/.local/bin/pi" ]; then
+  echo "  跳过 launcher -- ~/.local/bin/pi 是软链(防写穿源)"
+elif [ -f "$LAUNCHER_SRC" ]; then
+  cp "$LAUNCHER_SRC" "$HOME/.local/bin/pi"
+  chmod +x "$HOME/.local/bin/pi"
+  echo "  OK pi launcher -> ~/.local/bin/pi"
+else
+  echo "  WARN: 未找到 launcher，跳过。"
+fi
+
+# ── 5. 部署 shell 补全 ──
+mkdir -p "$HOME/.pi/agent"
+COMPL_SRC="$IMPL/god.pi.mod/cli/pi-completion.zsh"
+if [ -f "$COMPL_SRC" ]; then
+  cp "$COMPL_SRC" "$HOME/.pi/agent/pi-completion.zsh"
+  echo "  OK pi 补全 -> ~/.pi/agent/pi-completion.zsh"
+fi
+
+# zsh 补全自动接入
+SRC_LINE='source "$HOME/.pi/agent/pi-completion.zsh" 2>/dev/null'
+for rc in "$HOME/.zshrc" "$HOME/.bashrc"; do
+  [ -f "$rc" ] || continue
+  if ! grep -qF '.pi/agent/pi-completion.zsh' "$rc"; then
+    printf '\n# pi-coding-master shell 补全\n%s\n' "$SRC_LINE" >> "$rc"
+    echo "  OK 补全已接入 $(basename "$rc")"
+  fi
+done
+
+# ── 6. 部署完整性检查 ──
+if [ -f "$DEPLOY/scripts/check-deploy.sh" ]; then
+  echo ""
+  echo "部署检查:"
+  bash "$DEPLOY/scripts/check-deploy.sh" "$PKG_ROOT" 2>&1 | sed 's/^/  /' || true
+fi
+
+echo ""
+echo "── pi-coding-master v0.2.7 安装完成。重启 pi 生效。 ──"

package/deploy/install.sh.CHANGELOG

@@ -0,0 +1,6 @@
+[2026-06-12 16:13:45] edited (auto-logged, no messageDescription)
+[2026-06-12 16:13:45] added hebbian.ts, people.ts, logistics.ts, graph-viewer.mjs to install copies
+[2026-06-12 16:15] added touchfish.ts to install copies
+[2026-06-12 16:15:07] edited (auto-logged, no messageDescription)
+[2026-06-12 16:27:18] edited (auto-logged, no messageDescription)
+[2026-06-12 16:27:20] fix: fallback to extensions-disabled/ for notification, message dirs

package/deploy/lint/lint-naming.ts

@@ -0,0 +1,202 @@
+/**
+ * pi-coding-master naming convention linter
+ * Checks files/dirs against 003-naming-convention.NORM
+ *
+ * Usage: bun Codebase/test/lint-naming.ts
+ *   Run from pi-coding-master.DEV/ directory
+ */
+
+import { readdirSync, statSync, readFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { join, relative, dirname } from "node:path";
+
+// --- Configuration ---
+
+const SKIP_NAMES = new Set([".git", "node_modules", "__pycache__", ".DS_Store", ".vscode"]);
+
+const KNOWN_TYPED_SUFFIXES = new Set([
+  "SPEC", "README", "CHANGELOG", "LESSON", "ISSUE", "NORM",
+  "VERSION", "BLUEPRINT", "PAPER", "INDEX", "COMMENT", "TRUST",
+]);
+
+const LIFECYCLE_SUFFIXES = new Set(["DEV", "RELEASE", "FUTURE", "HISTORICAL"]);
+
+// All known ALLCAPS suffixes (typed + lifecycle)
+const ALL_KNOWN_UPPER = new Set([...KNOWN_TYPED_SUFFIXES, ...LIFECYCLE_SUFFIXES]);
+
+const OLD_PREFIX_RE = /(?:^|[/\\])(HumaN|AgenT)\b/;
+
+// --- Helpers ---
+
+const ROOT = process.cwd();
+const issues: string[] = [];
+let fileCount = 0;
+
+function relPath(abs: string): string {
+  return relative(ROOT, abs);
+}
+
+/** Extract the final .ALLCAPS suffix from a name, if any. */
+function extractUpperSuffix(name: string): string | null {
+  const m = name.match(/\.([A-Z]{2,})$/);
+  return m ? m[1] : null;
+}
+
+/** Check if a name has a typed suffix followed by .md */
+function hasMdAfterTypedSuffix(name: string): { suffix: string; clean: string } | null {
+  for (const suf of KNOWN_TYPED_SUFFIXES) {
+    const pattern = `.${suf}.md`;
+    if (name.endsWith(pattern)) {
+      return { suffix: suf, clean: name.slice(0, -3) }; // remove trailing .md
+    }
+  }
+  return null;
+}
+
+/** Check if a Codebase/core/ directory name has uppercase letters (excluding lifecycle suffix) */
+function hasUpperInCodeDir(dirName: string): boolean {
+  // Strip lifecycle suffix if present (e.g. ".DEV")
+  let base = dirName;
+  for (const ls of LIFECYCLE_SUFFIXES) {
+    if (base.endsWith(`.${ls}`)) {
+      base = base.slice(0, -(ls.length + 1));
+      break;
+    }
+  }
+  // Strip #human. / #agent. / @human. / @agent. prefixes
+  base = base.replace(/^[#@](?:human|agent)\./, "");
+  return /[A-Z]/.test(base);
+}
+
+// --- Walk ---
+
+function walk(dir: string): void {
+  let entries: string[];
+  try {
+    entries = readdirSync(dir);
+  } catch {
+    return;
+  }
+
+  // Collect names for stale-js check (per directory)
+  const tsFiles = new Set<string>();
+  const jsFiles = new Set<string>();
+
+  for (const name of entries) {
+    if (SKIP_NAMES.has(name)) continue;
+
+    const full = join(dir, name);
+    const rel = relPath(full);
+    let isDir: boolean;
+    try {
+      isDir = statSync(full).isDirectory();
+    } catch {
+      continue;
+    }
+
+    fileCount++;
+
+    // --- Rule 1: .md after typed suffix ---
+    const mdHit = hasMdAfterTypedSuffix(name);
+    if (mdHit) {
+      issues.push(`[SUFFIX] ${rel} — has .md after typed suffix, should be ${mdHit.clean}`);
+    }
+
+    // --- Rule 5: unknown ALLCAPS suffix ---
+    const upperSuf = extractUpperSuffix(name);
+    if (upperSuf && !ALL_KNOWN_UPPER.has(upperSuf)) {
+      // Ignore known lowercase extensions that happen to be uppercase (shouldn't exist but be safe)
+      issues.push(`[UNKNOWN] ${rel} — .${upperSuf} is not a known suffix (typo?)`);
+    }
+
+    // --- Rule 4: old HumaN / AgenT prefix ---
+    if (OLD_PREFIX_RE.test(name)) {
+      const match = name.match(OLD_PREFIX_RE)!;
+      const oldPfx = match[1];
+      const replacement = oldPfx === "HumaN" ? "#human." : "#agent.";
+      issues.push(`[PREFIX] ${rel} — old ${oldPfx} convention, use ${replacement} prefix`);
+    }
+
+    if (isDir) {
+      // --- Rule 2: code directory case (Codebase/core/ children) ---
+      const parentRel = relPath(dir);
+      const isCoreChild = parentRel === "Codebase/core"
+        || parentRel.startsWith("Codebase/core/");
+      if (isCoreChild && hasUpperInCodeDir(name)) {
+        issues.push(`[CASE] ${rel} — code directory should be lowercase`);
+      }
+
+      // --- Rule 3: top-level org dirs should start uppercase ---
+      const isTopLevel = relPath(dir) === ".";
+      if (isTopLevel && /^[a-z]/.test(name) && !name.startsWith(".") && !name.startsWith("#") && !name.startsWith("@")) {
+        issues.push(`[CASE] ${rel} — top-level directory should start with uppercase`);
+      }
+
+      walk(full);
+    } else {
+      // Track .ts / .js for stale check
+      if (name.endsWith(".ts") && !name.includes(".ts.")) tsFiles.add(name.replace(/\.ts$/, ""));
+      if (name.endsWith(".js") && !name.includes(".js.")) jsFiles.add(name.replace(/\.js$/, ""));
+    }
+  }
+
+  // --- Rule 6: stale .js alongside .ts ---
+  for (const stem of jsFiles) {
+    if (tsFiles.has(stem)) {
+      issues.push(`[STALE] ${relPath(join(dir, stem + ".js"))} — stale .js exists alongside ${stem}.ts`);
+    }
+  }
+}
+
+// --- Rule 7: SPEC source hash staleness ---
+function checkSpecHashes(root: string) {
+  const specs: string[] = [];
+  function findSpecs(dir: string) {
+    for (const name of readdirSync(dir)) {
+      if (SKIP_NAMES.has(name)) continue;
+      const full = join(dir, name);
+      try {
+        const st = statSync(full);
+        if (st.isDirectory()) findSpecs(full);
+        else if (name.endsWith(".SPEC")) specs.push(full);
+      } catch {}
+    }
+  }
+  findSpecs(root);
+
+  for (const specPath of specs) {
+    try {
+      const content = readFileSync(specPath, "utf8");
+      const firstLine = content.split("\n")[0];
+      const m = firstLine.match(/^source:\s*(\S+)\s*@\s*([a-f0-9]+)/);
+      if (!m) continue;
+      const [, srcName, expectedHash] = m;
+      const srcPath = join(dirname(specPath), srcName);
+      try {
+        const srcContent = readFileSync(srcPath);
+        const actualHash = createHash("sha256").update(srcContent).digest("hex").slice(0, 8);
+        if (actualHash !== expectedHash) {
+          issues.push(`[STALE] ${relPath(specPath)} — source hash mismatch (expected ${expectedHash}, got ${actualHash}), SPEC may be outdated`);
+        }
+      } catch {
+        issues.push(`[STALE] ${relPath(specPath)} — source file "${srcName}" not found`);
+      }
+    } catch {}
+  }
+}
+
+// --- Main ---
+
+walk(ROOT);
+checkSpecHashes(ROOT);
+
+if (issues.length > 0) {
+  for (const msg of issues) {
+    console.log(msg);
+  }
+  console.log();
+}
+
+const mark = issues.length === 0 ? "✓" : "✗";
+console.log(`${mark} ${fileCount} files checked, ${issues.length} issues found`);
+process.exit(issues.length > 0 ? 1 : 0);

package/deploy/scripts/apply.js

@@ -0,0 +1,18 @@
+// deploy/apply.js — 自动打所有 pi dist 补丁
+const { execSync } = require("child_process");
+const path = require("path");
+const DEPLOY = __dirname;
+
+const patches = [
+  { name: "read-docs-ugly", script: "patch-pi-dist.js" },
+];
+
+console.log("pi-coding-master deploy");
+for (const p of patches) {
+  try {
+    execSync(`node ${path.join(DEPLOY, p.script)}`, { stdio: "inherit" });
+  } catch (e) {
+    console.error(`ERROR ${p.name}: ${e.message}`);
+  }
+}
+console.log("deploy done");

package/deploy/scripts/build-github.sh

@@ -0,0 +1,219 @@
+#!/bin/bash
+# build-github.sh — 从 DEV 自动打包到 github-dev 和 github-release
+# 用法:
+#   bash Codebase/deploy/scripts/build-github.sh dev      # 只打 dev
+#   bash Codebase/deploy/scripts/build-github.sh release   # 只打 release
+#   bash Codebase/deploy/scripts/build-github.sh all       # 两个都打（默认）
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+DEV="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PARENT="$(dirname "$DEV")"
+GH_DEV="$PARENT/pi-coding-master.GITHUB"
+GH_REL="$PARENT/pi-coding-master.RELEASE-GITHUB"
+RELEASE_DIR="$PARENT/pi-coding-master.RELEASE"
+
+TARGET="${1:-all}"
+
+# ── 共用：排除规则 ──
+COMMON_EXCLUDES=(
+  --exclude='.DS_Store'
+  --exclude='__pycache__'
+  --exclude='*.pyc'
+  --exclude='*.pyo'
+  --exclude='node_modules'
+  --exclude='*.log'
+  --exclude='.env'
+  --exclude='.env.*'
+  --exclude='*.pem'
+  --exclude='*.key'
+  --exclude='*.crt'
+  --exclude='data/cookies/'
+  --exclude='authorize.TRUST'
+  --exclude='ears.listen/config.json'
+  --exclude='*ABANDONED*'
+  --exclude='*REMOVED*'
+  --exclude='*FUTURE*'
+)
+
+DOC_EXCLUDES=(
+  --exclude='.DS_Store'
+  --exclude='Paper/'
+  --exclude='#human.Paper/'
+  --exclude='*.aux'
+  --exclude='*.out'
+  --exclude='*.log'
+  --exclude='*.synctex.gz'
+  --exclude='.!*'
+)
+
+# ── 共用：安全检查 ──
+security_check() {
+  local dir="$1" label="$2"
+  echo "  安全检查 ($label)..."
+  local leaked=0
+  # 拆开字符串防自匹配
+  local p1='7mTFF''zKEkzC4DcV3'
+  local p2='53487''81537'
+  local p3='/Users/zhang''kezhen'
+  for pattern in "$p1" "$p2" "$p3"; do
+    if grep -rq --exclude='build-github.sh' "$pattern" "$dir" 2>/dev/null; then
+      echo "    LEAKED: $pattern"
+      leaked=1
+    fi
+  done
+  if [ "$leaked" -eq 1 ]; then
+    echo "  Error: $label 有敏感信息泄露，中止。"
+    return 1
+  fi
+  # 旧名检查
+  local old="pi-ali""ve"
+  local count
+  count=$(grep -r --exclude='build-github.sh' -c "$old" "$dir" 2>/dev/null | awk -F: '{s+=$2}END{print s+0}')
+  if [ "$count" -gt 0 ]; then
+    echo "  WARN: $label 仍有 $count 处 '$old' 引用"
+  fi
+  echo "  OK $label 安全检查通过"
+  return 0
+}
+
+# ══════════════════════════════════════════════════════════════════════
+# DEV → github-dev (pi-coding-master-dev)
+# ══════════════════════════════════════════════════════════════════════
+build_dev() {
+  echo ""
+  echo "══ build github-dev ══"
+  echo "  DEV:    $DEV"
+  echo "  TARGET: $GH_DEV"
+
+  if [ ! -d "$GH_DEV/.git" ]; then
+    echo "  Error: $GH_DEV/.git 不存在。先 git clone pi-coding-master-dev 到该目录。"
+    return 1
+  fi
+
+  # 同步 Codebase
+  rsync -a --delete "${COMMON_EXCLUDES[@]}" --exclude='debug/logs/' "$DEV/Codebase/" "$GH_DEV/Codebase/"
+  echo "  OK Codebase"
+
+  # 同步 Docs
+  rsync -a --delete "${DOC_EXCLUDES[@]}" "$DEV/Docs/" "$GH_DEV/Docs/"
+  echo "  OK Docs"
+
+  # .gitignore
+  [ -f "$DEV/.gitignore" ] && cp "$DEV/.gitignore" "$GH_DEV/.gitignore"
+
+  # README 不覆盖（GITHUB 目录有自己维护的 README.md）
+
+  # 安全检查
+  security_check "$GH_DEV/Codebase/" "dev-codebase" || return 1
+
+  # 自动 commit + push
+  cd "$GH_DEV"
+  git add -A
+  if git diff --cached --quiet 2>/dev/null; then
+    echo "  无变更，跳过 commit。"
+  else
+    local msg="sync from DEV $(date '+%Y-%m-%d %H:%M')"
+    git commit -m "$msg"
+    git push origin main
+    echo "  OK pushed to pi-coding-master-dev"
+  fi
+}
+
+# ══════════════════════════════════════════════════════════════════════
+# DEV → github-release (pi-coding-master-release)
+# 只包含 npm 需要的文件：core/ deploy/ package.json README.md
+# ══════════════════════════════════════════════════════════════════════
+build_release() {
+  echo ""
+  echo "══ build github-release ══"
+
+  # 找最新的 release 版本目录
+  local latest
+  latest=$(ls -d "$RELEASE_DIR"/v*-stable 2>/dev/null | sort -V | tail -1)
+  if [ -z "$latest" ]; then
+    echo "  Error: 没找到 release 版本目录 ($RELEASE_DIR/v*-stable)"
+    return 1
+  fi
+  local ver
+  ver=$(basename "$latest" | sed 's/-stable//')
+  echo "  RELEASE: $latest ($ver)"
+  echo "  TARGET:  $GH_REL"
+
+  # 初始化 release github 目录
+  if [ ! -d "$GH_REL" ]; then
+    mkdir -p "$GH_REL"
+    cd "$GH_REL"
+    git init
+    git remote add origin https://github.com/ApolloZhangOnGithub/pi-coding-master-release.git
+    git checkout -b main 2>/dev/null || true
+  fi
+
+  if [ ! -d "$GH_REL/.git" ]; then
+    echo "  Error: $GH_REL/.git 不存在。"
+    return 1
+  fi
+
+  # 从 DEV 重新打包 release（确保用最新源码）
+  rsync -a --delete "${COMMON_EXCLUDES[@]}" "$DEV/Codebase/core/" "$latest/core/"
+  rsync -a --delete --exclude='.DS_Store' "$DEV/Codebase/deploy/" "$latest/deploy/"
+  echo "  OK release 源码已从 DEV 同步"
+
+  # 同步到 github-release 目录
+  rsync -a --delete \
+    --exclude='.DS_Store' --exclude='__pycache__' --exclude='*.pyc' \
+    --exclude='node_modules' --exclude='*.log' --exclude='data/cookies/' \
+    --exclude='authorize.TRUST' --exclude='ears.listen/config.json' \
+    --exclude='*ABANDONED*' --exclude='*REMOVED*' --exclude='*FUTURE*' \
+    --exclude='debug/' \
+    "$latest/core/" "$GH_REL/core/"
+  rsync -a --delete --exclude='.DS_Store' "$latest/deploy/" "$GH_REL/deploy/"
+  [ -f "$latest/package.json" ] && cp "$latest/package.json" "$GH_REL/package.json"
+  [ -f "$latest/README.md" ] && cp "$latest/README.md" "$GH_REL/README.md"
+  [ -f "$latest/RELEASE.README" ] && cp "$latest/RELEASE.README" "$GH_REL/RELEASE.README"
+
+  # .gitignore
+  cat > "$GH_REL/.gitignore" << 'GITEOF'
+.DS_Store
+__pycache__/
+*.pyc
+node_modules/
+*.log
+data/cookies/
+*.pem
+*.key
+GITEOF
+
+  # 安全检查
+  security_check "$GH_REL/core/" "release-core" || return 1
+
+  # 自动 commit + push
+  cd "$GH_REL"
+  git add -A
+  if git diff --cached --quiet 2>/dev/null; then
+    echo "  无变更，跳过 commit。"
+  else
+    local msg="release $ver $(date '+%Y-%m-%d %H:%M')"
+    git commit -m "$msg"
+    git push -u origin main 2>/dev/null || git push --set-upstream origin main
+    echo "  OK pushed to pi-coding-master-release"
+  fi
+
+  # 创建 tag
+  if ! git tag -l "$ver" | grep -q "$ver"; then
+    git tag "$ver"
+    git push origin "$ver"
+    echo "  OK tag $ver"
+  fi
+}
+
+# ── 执行 ──
+case "$TARGET" in
+  dev)     build_dev ;;
+  release) build_release ;;
+  all)     build_dev; build_release ;;
+  *)       echo "用法: $0 [dev|release|all]"; exit 1 ;;
+esac
+
+echo ""
+echo "── 完成 ──"

package/deploy/scripts/build-phone.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+# Build phone/device tools .ts → .js
+# Auto-discovers source directory (survives renames)
+set -e
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+IMPL="$SCRIPT_DIR/../../core"
+
+# 自动发现 device-manifest.ts
+DM=$(find "$IMPL" -name 'technology-manifest.ts' -not -path '*/node_modules/*' 2>/dev/null | head -1)
+if [ -z "$DM" ]; then echo "Error: technology-manifest.ts not found"; exit 1; fi
+PHONE_DIR="$(dirname "$DM")"
+SAFARI="$PHONE_DIR/safari.ts"
+
+# ── 禁止 execSync（只检查扩展工具目录）──
+if grep -rn 'execSync' "$PHONE_DIR/" --include='*.ts' 2>/dev/null | grep -v '.bak\|.CHANGELOG\|.SPEC\|sh.ts'; then
+  echo "Error: BLOCKING: execSync found!"
+  exit 1
+fi
+
+echo "── Building phone tools ($PHONE_DIR) ──"
+bun build --outdir="$PHONE_DIR" --target=node --format=esm --external '*' \
+  "$DM" \
+  "$SAFARI"
+echo "OK Done"