pi-information-protecter 0.2.0 → 0.2.1

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog / 更新日志
 
+## 0.2.1 — Compiled distribution / 编译产物发布
+
+- Publish compiled, bundled and minified ESM in `dist/`, including both workers; exclude source and source maps from npm packages.
+  发布 `dist/` 中编译合并压缩后的 ESM 及两个 worker，npm 包不再包含源码或 source map。
+- Build automatically before tests and packing; validate the actual tarball through Pi's loader and worker execution.
+  测试及打包前自动构建，使用 Pi 加载器和 worker 执行验证真实压缩包。
+- Separate README into full English and Simplified Chinese sections with top language links.
+  README 改为完整英文在前、简体中文在后，顶部提供语言跳转链接。
+
 ## 0.2.0 — Machine configuration and memory cache / 机器配置与内存缓存
 
 - Derive deterministic filenames from OS machine identifiers using a product-specific hash; never fall back to random IDs.
@@ -13,7 +22,6 @@
 - Add migration, failure-injection, concurrency and cache regression tests, plus bilingual migration documentation.
   增加迁移、故障注入、并发及缓存回归测试和双语迁移文档。
 
-
 - Add tag-triggered GitHub Actions npm OIDC publishing, scoped environment permissions and manual dry-run validation.
   增加标签触发的 GitHub Actions npm OIDC 发布、限定环境权限及手动试运行验证。
 - Document trusted publisher setup and the automated release procedure in both languages.

package/README.md

@@ -1,63 +1,51 @@
 # pi-information-protecter
 
-**Sensitive Personal Information (SPI) Protecter — 个人敏感信息保护插件。**
+[English](#english) · [简体中文](#简体中文)
 
-A Pi extension that inspects outgoing LLM request bodies locally, replaces configured sensitive values with random placeholders, and restores echoed placeholders locally. Suitable for URLs, phone numbers, identity numbers, names, credentials and passwords. **This is rule-based accidental-disclosure protection, not a sandbox, automatic PII detector or encryption proxy.**
+## English
 
-这是一个 Pi 扩展：在本地审查 LLM 出站请求体，用随机占位符替换配置中的敏感值，并在本地还原模型返回的占位符。适用于 URL、电话号码、身份证／ID、姓名、凭证和密码。**这是基于规则的意外泄漏防护，不是沙箱、自动 PII 检测器或加密代理。**
+**Sensitive Personal Information (SPI) Protecter.**
+
+A Pi extension that inspects outgoing LLM request bodies locally, replaces configured sensitive values with random placeholders, and restores echoed placeholders locally. Suitable for URLs, phone numbers, identity numbers, names, credentials and passwords. **This is rule-based accidental-disclosure protection, not a sandbox, automatic PII detector or encryption proxy.**
 
-## Installation / 安装
+## Installation
 
 Requires Node.js 22+ and `@earendil-works/pi-coding-agent` **0.85.1–0.85.x**, tested against 0.85.1. Legacy `@mariozechner/*` releases are not supported.
 
-要求 Node.js 22+ 和 `@earendil-works/pi-coding-agent` **0.85.1–0.85.x**，验证基线为 0.85.1。不支持旧 `@mariozechner/*` 版本。
-
 ```bash
-# Install the published, pinned npm release. / 安装已发布的固定 npm 版本。
-pi install npm:pi-information-protecter@0.2.0
+# Install the pinned npm release.
+pi install npm:pi-information-protecter@0.2.1
 
-# Alternatively, install from this repository without copying it. / 或从本仓库本地安装，不复制仓库。
+# Alternatively, build and install from this repository without copying it.
+npm ci
+npm run build
 pi install "$PWD"
 
-# Load for one invocation. / 单次加载。
+# Load for one invocation.
 pi -e ./src/index.ts
 ```
 
-Run `/reload` in an existing Pi session. Keep the complete `src/` directory when distributing this extension: the worker file is required, so copying only `index.ts` is insufficient.
-
-已运行的 Pi 请执行 `/reload`。分发时保留完整 `src/` 目录；插件需要 worker 文件，不能仅复制 `index.ts`。
+Run `/reload` in an existing Pi session. Starting with `0.2.1`, npm releases ship compiled, minified ESM in `dist/`, not TypeScript source. Keep all three files together: `index.mjs`, `scan-worker.mjs` and `validate-worker.mjs`. Version `0.2.0` uses the previous source layout.
 
 See [CHANGELOG.md](CHANGELOG.md) for version changes. Contribution and release instructions are in the repository's `CONTRIBUTING.md` and `docs/RELEASING.md`.
 
-版本变更见 [CHANGELOG.md](CHANGELOG.md)。贡献与发布流程见仓库内的 `CONTRIBUTING.md` 和 `docs/RELEASING.md`。
-
 Maintainers publish new versions by pushing matching `v*` tags. GitHub Actions validates and publishes through npm OIDC trusted publishing without a long-lived token. Manual dry runs do not publish.
 
-维护者通过推送匹配版本的 `v*` 标签发布新版本。GitHub Actions 验证后使用 npm OIDC 可信发布，不需要长期令牌；手动试运行不会发布。
-
 Initialization uses `~/.pi/agent/protecter.<machineHash>.json`, respecting `PI_CODING_AGENT_DIR`. The hash is the first 32 hex characters of SHA-256 over a product prefix and normalized OS ID: macOS `IOPlatformUUID`, Linux `/etc/machine-id`, Windows `MachineGuid`. Missing/invalid IDs fail initialization, without random fallback. The hash is a stable identifier, not a secret. Project-local configuration is not loaded.
 
-初始化使用 `~/.pi/agent/protecter.<machineHash>.json`，遵循 `PI_CODING_AGENT_DIR`。哈希由产品前缀与规范化系统标识计算 SHA-256，取前 32 位十六进制；macOS 使用 `IOPlatformUUID`、Linux 使用 `/etc/machine-id`、Windows 使用 `MachineGuid`。标识缺失或无效时拒绝初始化，不随机回退。哈希是稳定标识而非秘密，不加载项目级配置。
-
 At startup and `/reload`, recognized old configs (including legacy `protecter.json`) are validated, union-merged and deduplicated into the current target. The target is durably written and verified before unchanged old files are deleted. Invalid sources abort migration without deleting originals. Unix permissions are `0600`; unsafe links, foreign ownership and oversized files are rejected. Windows users must configure ACLs separately. See [migration details](docs/MIGRATION.md).
 
-启动和重载时，识别到的旧配置（包括原固定文件名）会先验证，再合并去重到当前目标；目标持久化写入并验证后才删除未变化的旧文件。无效来源会中止迁移而不删除原文件。Unix 权限为 `0600`，拒绝不安全链接、他人所有文件和超限文件；Windows 需自行设置 ACL。详见迁移文档。
-
 Validated configuration is cached per extension instance. Outgoing scans and status commands never reread or stat configuration files. Editing, corrupting or deleting files after loading does not alter the active snapshot. Changes take effect on `/reload` (or `/protecter reload`, which invokes Pi reload). A new instance after session replacement also initializes once. If all configs are deleted, the next initialization creates an empty config and warns; the old memory does not survive teardown.
 
-验证后的配置按扩展实例缓存。出站扫描及状态命令不重新读取或检查配置文件；加载后修改、损坏或删除文件不改变当前快照。修改在重载后生效；`/protecter reload` 会调用 Pi 重载，会话切换产生的新实例也初始化一次。若全部配置已删除，下次初始化会创建空配置并警告，旧内存不跨实例销毁保留。
-
-## Configuration / 配置
+## Configuration
 
 **Edit the configuration in a local editor. Do not ask the model to enter real passwords or commit real configuration to Git.** The initial rule array is empty and provides no personal-information detection; the UI warns about this. The extension does not automatically identify all SPI.
 
-**请用本地编辑器修改配置，不要让模型填写真实密码，也不要把真实配置提交到 Git。** 初始规则数组为空，不具备个人信息检测能力，界面会给出警告。插件不会自动识别所有 SPI。
-
 ```json
 {
   "version": 1,
   "sensitiveWords": [
-    "张三",
+    "Alex Morgan",
     { "type": "literal", "value": "your-private-password" },
     { "type": "regex", "pattern": "https?://[^\\s\\\"<>]+", "flags": "i" },
     { "type": "regex", "pattern": "(?<!\\d)1[3-9]\\d{9}(?!\\d)" }
@@ -67,84 +55,55 @@ Validated configuration is cached per extension instance. Outgoing scans and sta
 
 More examples are in [`protecter.example.json`](protecter.example.json); they are not automatically enabled. Number patterns do not validate authenticity or check digits. Prefer exact values for names and passwords.
 
-更多示例见 [`protecter.example.json`](protecter.example.json)，不会自动启用。号码规则不验证真实性或校验位，姓名和密码建议使用精确值。
-
 - **Literals:** strings and `literal` rules match all case-sensitive occurrences, without regex interpretation.
-  **字面规则：**字符串和 `literal` 按大小写敏感方式匹配全部出现位置，不作正则解释。
 - **Regex:** JavaScript regex replaces the entire match. Use lookbehind to match only a credential value. Flags `g i m s u` are supported; `g` is added automatically. `/pattern/flags` shorthand is not supported.
-  **正则：**JavaScript 正则替换整个匹配，可用后行断言仅匹配凭证值。支持 `g i m s u`，自动补 `g`，不支持 `/pattern/flags` 简写。
 - Escape backslashes as `\\` in JSON. Empty-string matches are invalid; runtime zero-width matches reject the request.
-  JSON 中的反斜杠写作 `\\`。不允许匹配空字符串；运行时零宽匹配会拒绝请求。
 - Overlapping matches are merged to avoid exposing a longer secret's suffix. Equal values reuse a token within the extension instance.
-  合并重叠匹配，避免暴露长敏感值的后缀；同一实例内相同原文复用占位符。
 - Learned originals remain exact-match protected within the instance even if regex context disappears or a rule is removed. Exit/reload clears these records.
-  已识别原文在当前实例内持续受到精确匹配保护，即使正则上下文消失或规则被删除；退出或重载清除记录。
 - `/protecter` and `/protecter status` report cached counts only, without disk access or sensitive values. `/protecter reload` waits for idle and invokes Pi's full reload; it is no longer a status-only command. Adding secrets through command arguments is not supported.
-  状态命令只报告缓存数量，不访问磁盘或显示敏感值。重载命令等待空闲并调用 Pi 完整重载，不再只是查询状态；不支持通过命令参数添加秘密。
 - Limits: 1000 rules, 8192 characters per literal/pattern, 2-second scan timeout and 8 MiB request JSON. Exceeding limits rejects the request rather than sending plaintext.
-  限制为 1000 条规则、每个词或模式 8192 字符、扫描 2 秒、请求 JSON 8 MiB；超限拒绝，不降级发送明文。
 
-## How it works / 工作方式
+## How it works
 
 ```text
 Input / history / tools / system prompt / tool definitions
-输入／历史／工具结果／系统提示／工具定义
                          ↓
-before_provider_request: final JSON text scan / 最终 JSON 文本扫描
+before_provider_request: final JSON text scan
                          ↓
-__PIP_<192-bit random hex>__ → LLM gateway / LLM 网关
+__PIP_<192-bit random hex>__ → LLM gateway
                          ↓
-Local response and tool-argument restoration / 本地回复和工具参数还原
+Local response and tool-argument restoration
 ```
 
 1. Scan JSON strings, keys and numbers, including decoded JSON-string tool arguments. Local user input and original history are unchanged.
-   扫描 JSON 字符串、键和数字，包括解码后的 JSON 字符串工具参数；不修改本地用户输入和历史原文。
 2. Generate tokens with `crypto.randomBytes(24)`. Mappings stay **in memory only**, never in configuration, session custom entries, logs or model prompts. Local users can still see original values.
-   使用 `crypto.randomBytes(24)` 生成占位符。映射**仅存于内存**，不写入配置、会话自定义条目、日志或模型提示；本地用户仍可看到原文。
 3. Restore finalized assistant text, thinking and tool arguments. The TUI Markdown transformer restores complete streamed tokens; partial tokens may briefly appear. RPC/JSON deltas remain masked until final `message_end`. Altered or truncated tokens cannot be restored.
-   还原最终 assistant 文本、思考内容和工具参数。TUI 在完整占位符到达后还原，片段可能短暂显示；RPC/JSON 增量仍脱敏，直到最终消息还原。被改写或截断的占位符无法还原。
 4. Restore tool arguments before execution so legitimate local operations use original values; redact them again on subsequent requests. **Restoring credentials is not tool authorization or exfiltration prevention.**
-   工具执行前还原参数，让合法本地操作使用原值；后续请求再次脱敏。**凭证还原不等于工具授权或防外传。**
 5. Execute regex scans in a terminable worker. On failure, return `{}` and request cancellation rather than relying on hook exceptions swallowed by Pi. An empty request or provider validation error may still occur, but the handler does not return the original payload.
-   正则扫描运行于可终止 worker。失败时返回 `{}` 并请求取消，不依赖被 Pi 吞掉的钩子异常；仍可能产生空请求或提供商校验错误，但处理器不返回原始请求体。
 
-### Configuration access guard / 配置访问防护
+### Configuration access guard
 
 **Outgoing redaction is the main defense; direct-access blocking is supplementary.** Shell is not disabled wholesale.
 
-**以出站脱敏为主，直接访问拦截为辅。** 不全面禁用 shell。
-
 - File tools check actual path arguments, not document bodies; writing documentation that mentions config filenames is allowed. In the active config directory, legacy/current hash filenames and migration artifacts are protected. Shell command fields retain best-effort filename checks, so shell mentions can still produce false positives.
-  文件工具检查实际路径参数而非正文，允许文档提及配置名称。当前配置目录内的旧名称、哈希名称及迁移文件受保护；shell 命令字段保留尽力文件名检查，因此 shell 提及名称仍可能误拦截。
 - Resolve `@`, `~`, relative paths and `file://`; check symlink/inode aliases. Block `grep/find/ls` over ancestor directories containing the configuration.
-  解析上述路径形式，检查符号链接和 inode 别名；阻止这些搜索工具扫描包含配置的祖先目录。
 - Attempt whole-text masking if the complete original configuration accidentally appears in a request.
-  完整原始配置意外出现在请求文本时，尝试整体替换。
 - **Best effort only:** dynamic shell, base64, split output, nested symlinks, arbitrary third-party tools and network sends can bypass these checks. This cannot guarantee that a malicious model never obtains configuration.
-  **仅为尽力防护：**动态 shell、编码、拆分输出、目录内链接、任意第三方工具和网络发送可绕过检查，无法保证恶意模型永远无法取得配置。
 
-## Limitations — read first / 当前限制——请先阅读
+## Limitations — read first
 
 - Only rule-matching text is protected, not paraphrases, split characters or arbitrary encodings. Common image/audio/video/file blocks reject the entire request because SPI cannot be reliably inspected; no OCR is provided.
-  仅保护命中规则的文本，不覆盖改写、拆字和任意编码。常见多模态附件因无法可靠审查而拒绝整个请求，不提供 OCR。
 - `/compact`, automatic compaction and summarized `/tree` navigation are cancelled pending separate lifecycle/restoration verification. Tree navigation without summaries works; use `/new` for long sessions.
-  暂时取消压缩和带摘要的树导航，等待单独验证生命周期及还原；不带摘要的导航可用，长会话请使用 `/new`。
 - Exit, reload and session switching discard mappings. Final restored local messages remain readable; crash leftovers, old summaries and raw deltas cannot recover tokens across restarts.
-  退出、重载和切换会话会丢弃映射。最终已还原消息仍可读，但崩溃残留、旧摘要和原始增量无法跨重启恢复占位符。
 - Broad rules such as `.` or all digits may alter protocol fields, model names, tool schemas or IDs and break requests. Matching numbers become token strings. Prefer precise rules.
-  过宽规则可能改写协议字段、模型名、工具结构和 ID，导致请求失败；命中数字变为占位符字符串，应优先使用精确规则。
 - Reused tokens reveal equality relationships; context may imply identity. This is not formal anonymization.
-  复用占位符会暴露值相等的关系，上下文也可能揭示身份，这不是形式化匿名化。
 - Hooks do not cover HTTP headers, authentication keys, gateway endpoints, Pi telemetry, `/share`, independent extension SDK/fetch calls or tool networking. The gateway still receives its authentication credentials.
-  钩子不覆盖认证头、API key、网关地址、遥测、分享、扩展独立网络调用和工具联网；网关仍收到其认证凭证。
 - **Load after other payload rewriters and trust every installed extension.** Later handlers can reintroduce originals. Extensions have local permissions, and Pi may continue if this extension fails to load. Check status before entering secrets.
-  **在其他请求改写扩展之后加载，并只使用可信扩展。** 后续处理器可重新加入原文；扩展有本机权限，插件加载失败时 Pi 可能继续运行，请先检查状态再输入秘密。
 - Local sessions, terminals, exports and files written by tools may contain plaintext. They are not encrypted or cleaned by this project.
-  本地会话、终端、导出和工具写出的文件可能包含明文，本项目不加密或清理它们。
 
-See [SECURITY.md](SECURITY.md) for the threat model. / 详细威胁模型见该安全文档。
+See [SECURITY.md](SECURITY.md) for the threat model.
 
-## Development and verification / 开发与验证
+## Development and verification
 
 ```bash
 npm ci
@@ -153,8 +112,122 @@ npm run check
 
 Tests use temporary directories and fictional secrets, never real user configuration, API keys or LLM gateways. Coverage includes masking/restoration, regex timeout, permissions, path guards and real Pi loader/runner integration. All Markdown, comments and new commit messages must be English + Simplified Chinese.
 
-测试仅使用临时目录和虚构敏感值，不读取真实配置、不使用真实密钥或访问 LLM 网关，覆盖脱敏还原、正则超时、权限、路径防护和真实 Pi 加载器／执行器集成。所有 Markdown、注释和新提交信息必须使用英文＋简体中文。
+`npm run build` bundles local modules with esbuild, removes TypeScript types and minifies output. Node built-ins and Pi peer packages remain external. No source maps or source files are published; source remains available on GitHub. Minification reduces size, not visibility or security. `npm pack` rebuilds via `prepack`; `npm publish` first runs checks. Tests also extract the actual npm tarball and run Pi's loader and both workers from it. See the repository's `docs/BUILDING.md` for details.
 
 API references: [Pi Extensions](https://pi.dev/docs/latest/extensions), local 0.85.1 documentation and runner implementation. Licensed under MIT.
 
-接口依据为 Pi 官方扩展文档、本机 0.85.1 文档及执行器实现；采用 MIT 许可证。
+---
+
+## 简体中文
+
+**个人敏感信息保护插件。**
+
+这是一个 Pi 扩展：在本地审查 LLM 出站请求体，用随机占位符替换配置中的敏感值，并在本地还原模型返回的占位符。适用于 URL、电话号码、身份证／ID、姓名、凭证和密码。**这是基于规则的意外泄漏防护，不是沙箱、自动 PII 检测器或加密代理。**
+
+## 安装
+
+要求 Node.js 22+ 和 `@earendil-works/pi-coding-agent` **0.85.1–0.85.x**，验证基线为 0.85.1。不支持旧 `@mariozechner/*` 版本。
+
+```bash
+# 安装固定 npm 版本。
+pi install npm:pi-information-protecter@0.2.1
+
+# 或在本仓库构建后本地安装，不复制仓库。
+npm ci
+npm run build
+pi install "$PWD"
+
+# 单次加载。
+pi -e ./src/index.ts
+```
+
+已运行的 Pi 请执行 `/reload`。从 `0.2.1` 起，npm 发布 `dist/` 中编译压缩后的 ESM，而非 TypeScript 源码。必须同时保留 `index.mjs`、`scan-worker.mjs` 和 `validate-worker.mjs` 三个文件。`0.2.0` 采用旧源码布局。
+
+版本变更见 [CHANGELOG.md](CHANGELOG.md)。贡献与发布流程见仓库内的 `CONTRIBUTING.md` 和 `docs/RELEASING.md`。
+
+维护者通过推送匹配版本的 `v*` 标签发布新版本。GitHub Actions 验证后使用 npm OIDC 可信发布，不需要长期令牌；手动试运行不会发布。
+
+初始化使用 `~/.pi/agent/protecter.<machineHash>.json`，遵循 `PI_CODING_AGENT_DIR`。哈希由产品前缀与规范化系统标识计算 SHA-256，取前 32 位十六进制；macOS 使用 `IOPlatformUUID`、Linux 使用 `/etc/machine-id`、Windows 使用 `MachineGuid`。标识缺失或无效时拒绝初始化，不随机回退。哈希是稳定标识而非秘密，不加载项目级配置。
+
+启动和重载时，识别到的旧配置（包括原固定文件名）会先验证，再合并去重到当前目标；目标持久化写入并验证后才删除未变化的旧文件。无效来源会中止迁移而不删除原文件。Unix 权限为 `0600`，拒绝不安全链接、他人所有文件和超限文件；Windows 需自行设置 ACL。详见[迁移文档](docs/MIGRATION.md)。
+
+验证后的配置按扩展实例缓存。出站扫描及状态命令不重新读取或检查配置文件；加载后修改、损坏或删除文件不改变当前快照。修改在重载后生效；`/protecter reload` 会调用 Pi 重载，会话切换产生的新实例也初始化一次。若全部配置已删除，下次初始化会创建空配置并警告，旧内存不跨实例销毁保留。
+
+## 配置
+
+**请用本地编辑器修改配置，不要让模型填写真实密码，也不要把真实配置提交到 Git。** 初始规则数组为空，不具备个人信息检测能力，界面会给出警告。插件不会自动识别所有 SPI。
+
+```json
+{
+  "version": 1,
+  "sensitiveWords": [
+    "张三",
+    { "type": "literal", "value": "your-private-password" },
+    { "type": "regex", "pattern": "https?://[^\\s\\\"<>]+", "flags": "i" },
+    { "type": "regex", "pattern": "(?<!\\d)1[3-9]\\d{9}(?!\\d)" }
+  ]
+}
+```
+
+更多示例见 [`protecter.example.json`](protecter.example.json)，不会自动启用。号码规则不验证真实性或校验位，姓名和密码建议使用精确值。
+
+- **字面规则：**字符串和 `literal` 按大小写敏感方式匹配全部出现位置，不作正则解释。
+- **正则：**JavaScript 正则替换整个匹配，可用后行断言仅匹配凭证值。支持 `g i m s u`，自动补 `g`，不支持 `/pattern/flags` 简写。
+- JSON 中的反斜杠写作 `\\`。不允许匹配空字符串；运行时零宽匹配会拒绝请求。
+- 合并重叠匹配，避免暴露长敏感值的后缀；同一实例内相同原文复用占位符。
+- 已识别原文在当前实例内持续受到精确匹配保护，即使正则上下文消失或规则被删除；退出或重载清除记录。
+- 状态命令只报告缓存数量，不访问磁盘或显示敏感值。重载命令等待空闲并调用 Pi 完整重载，不再只是查询状态；不支持通过命令参数添加秘密。
+- 限制为 1000 条规则、每个词或模式 8192 字符、扫描 2 秒、请求 JSON 8 MiB；超限拒绝，不降级发送明文。
+
+## 工作方式
+
+```text
+输入／历史／工具结果／系统提示／工具定义
+                         ↓
+before_provider_request：最终 JSON 文本扫描
+                         ↓
+__PIP_<192-bit 随机十六进制>__ → LLM 网关
+                         ↓
+本地回复和工具参数还原
+```
+
+1. 扫描 JSON 字符串、键和数字，包括解码后的 JSON 字符串工具参数；不修改本地用户输入和历史原文。
+2. 使用 `crypto.randomBytes(24)` 生成占位符。映射**仅存于内存**，不写入配置、会话自定义条目、日志或模型提示；本地用户仍可看到原文。
+3. 还原最终 assistant 文本、思考内容和工具参数。TUI 在完整占位符到达后还原，片段可能短暂显示；RPC/JSON 增量仍脱敏，直到最终消息还原。被改写或截断的占位符无法还原。
+4. 工具执行前还原参数，让合法本地操作使用原值；后续请求再次脱敏。**凭证还原不等于工具授权或防外传。**
+5. 正则扫描运行于可终止 worker。失败时返回 `{}` 并请求取消，不依赖被 Pi 吞掉的钩子异常；仍可能产生空请求或提供商校验错误，但处理器不返回原始请求体。
+
+### 配置访问防护
+
+**以出站脱敏为主，直接访问拦截为辅。** 不全面禁用 shell。
+
+- 文件工具检查实际路径参数而非正文，允许文档提及配置名称。当前配置目录内的旧名称、哈希名称及迁移文件受保护；shell 命令字段保留尽力文件名检查，因此 shell 提及名称仍可能误拦截。
+- 解析 `@`、`~`、相对路径和 `file://`，检查符号链接和 inode 别名；阻止 `grep/find/ls` 扫描包含配置的祖先目录。
+- 完整原始配置意外出现在请求文本时，尝试整体替换。
+- **仅为尽力防护：**动态 shell、编码、拆分输出、目录内链接、任意第三方工具和网络发送可绕过检查，无法保证恶意模型永远无法取得配置。
+
+## 当前限制——请先阅读
+
+- 仅保护命中规则的文本，不覆盖改写、拆字和任意编码。常见多模态附件因无法可靠审查而拒绝整个请求，不提供 OCR。
+- 暂时取消压缩和带摘要的树导航，等待单独验证生命周期及还原；不带摘要的导航可用，长会话请使用 `/new`。
+- 退出、重载和切换会话会丢弃映射。最终已还原消息仍可读，但崩溃残留、旧摘要和原始增量无法跨重启恢复占位符。
+- 过宽规则可能改写协议字段、模型名、工具结构和 ID，导致请求失败；命中数字变为占位符字符串，应优先使用精确规则。
+- 复用占位符会暴露值相等的关系，上下文也可能揭示身份，这不是形式化匿名化。
+- 钩子不覆盖认证头、API key、网关地址、遥测、分享、扩展独立网络调用和工具联网；网关仍收到其认证凭证。
+- **在其他请求改写扩展之后加载，并只使用可信扩展。** 后续处理器可重新加入原文；扩展有本机权限，插件加载失败时 Pi 可能继续运行，请先检查状态再输入秘密。
+- 本地会话、终端、导出和工具写出的文件可能包含明文，本项目不加密或清理它们。
+
+详细威胁模型见 [SECURITY.md](SECURITY.md)。
+
+## 开发与验证
+
+```bash
+npm ci
+npm run check
+```
+
+测试仅使用临时目录和虚构敏感值，不读取真实配置、不使用真实密钥或访问 LLM 网关，覆盖脱敏还原、正则超时、权限、路径防护和真实 Pi 加载器／执行器集成。所有 Markdown、注释和新提交信息必须使用英文＋简体中文。
+
+`npm run build` 使用 esbuild 合并本地模块、移除类型并压缩产物，Node 内置模块和 Pi peer 依赖保持外部引用。不发布源码或 source map，源码仍可在 GitHub 查阅。压缩是体积优化，不是加密或安全隔离。`npm pack` 通过 `prepack` 自动构建，`npm publish` 先执行检查。测试还会解压实际 npm 压缩包，用 Pi 加载器和两个 worker 验证产物。详见仓库内的 `docs/BUILDING.md`。
+
+接口依据为 [Pi 官方扩展文档](https://pi.dev/docs/latest/extensions)、本机 0.85.1 文档及执行器实现；采用 MIT 许可证。

package/dist/index.mjs

@@ -0,0 +1,4 @@
+/*! SPI Protecter | MIT | see LICENSE / SPI 隐私保护插件 | MIT 许可 */
+import{getAgentDir as Se,VERSION as q}from"@earendil-works/pi-coding-agent";import{Worker as ue}from"node:worker_threads";import{fileURLToPath as le}from"node:url";import*as a from"node:fs";import{join as S,resolve as re}from"node:path";import{createHash as te,randomUUID as ne}from"node:crypto";import{Worker as oe}from"node:worker_threads";import{fileURLToPath as ie}from"node:url";import{constants as y,closeSync as M,fchmodSync as Y,fstatSync as K,mkdirSync as Q,openSync as A,readFileSync as V,writeFileSync as Z}from"node:fs";import{dirname as ee}from"node:path";var C={version:1,sensitiveWords:[]},u="SPI Protecter: unsafe or invalid configuration / 配置不安全或格式无效，请在本地修复。";function R(i){try{let e=JSON.parse(i);if(!e||e.version!==1||!Array.isArray(e.sensitiveWords)||e.sensitiveWords.length>1e3||Object.keys(e).some(r=>!["version","sensitiveWords"].includes(r)))throw new Error;for(let r of e.sensitiveWords){if(typeof r=="string"){if(!r||r.length>8192)throw new Error;continue}if(!r||typeof r!="object")throw new Error;if(r.type==="literal"){if(Object.keys(r).some(t=>!["type","value"].includes(t))||typeof r.value!="string"||!r.value||r.value.length>8192)throw new Error}else if(r.type==="regex"){if(Object.keys(r).some(o=>!["type","pattern","flags"].includes(o))||typeof r.pattern!="string"||!r.pattern||r.pattern.length>8192||r.flags!==void 0&&(typeof r.flags!="string"||!/^[gimsu]*$/.test(r.flags)))throw new Error;let t=new RegExp(r.pattern,r.flags??"")}else throw new Error}return e}catch{throw new Error(u)}}function W(i,e=!1){let r;try{if(e){Q(ee(i),{recursive:!0,mode:448});try{let n=A(i,y.O_WRONLY|y.O_CREAT|y.O_EXCL,384);try{Z(n,JSON.stringify(C,null,2)+`
+`)}finally{M(n)}}catch(n){if(n.code!=="EEXIST")throw n}}r=A(i,y.O_RDONLY|y.O_NOFOLLOW|y.O_NONBLOCK);let t=K(r);if(!t.isFile()||t.nlink!==1||t.size>1024*1024||process.getuid&&t.uid!==process.getuid())throw new Error;process.platform!=="win32"&&Y(r,384);let o=V(r,"utf8");if(Buffer.byteLength(o)>1024*1024)throw new Error;return{config:R(o),raw:o}}catch{throw new Error(u)}finally{r!==void 0&&M(r)}}var b=/^protecter(?:\.[a-f0-9]{32})?\.json$/;function se(i){return new Promise((e,r)=>{let t=new oe(ie(new URL("./validate-worker.mjs",import.meta.url)),{workerData:i,execArgv:[],resourceLimits:{maxOldGenerationSizeMb:64}}),o=!1,n=l=>{o||(o=!0,clearTimeout(s),t.terminate(),l?e():r(new Error(u)))},s=setTimeout(()=>n(!1),2e3);t.once("message",l=>n(l===!0)),t.once("error",()=>n(!1)),t.once("exit",()=>n(!1))})}function ae(i){let e=new Set,r=[];for(let o of i)for(let n of o.sensitiveWords){let s=typeof n=="string"?JSON.stringify(["literal",n]):n.type==="literal"?JSON.stringify(["literal",n.value]):JSON.stringify(["regex",n.pattern,[...new Set((n.flags??"")+"g")].sort().join("")]);e.has(s)||(e.add(s),r.push(n))}let t=JSON.stringify({version:1,sensitiveWords:r});if(Buffer.byteLength(t)>1024*1024)throw new Error(u);return R(t)}function F(i){let e=a.lstatSync(i,{bigint:!0});if(!e.isFile()||e.nlink!==1n||process.getuid&&e.uid!==BigInt(process.getuid()))throw new Error(u);return`${e.dev}:${e.ino}:${e.size}:${e.mtimeNs}`}function P(i,e){let r=S(i,e),t=F(r),o=W(r);if(F(r)!==t)throw new Error(u);return{name:e,...o,identity:t,digest:te("sha256").update(o.raw).digest("hex")}}function O(i,e){let r=P(i,e.name);if(r.identity!==e.identity||r.digest!==e.digest)throw new Error(u)}function k(i){return a.readdirSync(i).filter(e=>b.test(e)).sort()}function D(i){if(process.platform==="win32")return;let e=a.openSync(i,a.constants.O_RDONLY);try{a.fsyncSync(e)}finally{a.closeSync(e)}}async function j(i,e,r={}){if(!/^[a-f0-9]{32}$/.test(e))throw new Error(u);let t=re(i),o=`protecter.${e}.json`,n=S(t,o);a.mkdirSync(t,{recursive:!0,mode:448});let s=S(t,".protecter-migration.lock"),l=Date.now()+(r.lockTimeoutMs??5e3);for(;;)try{a.mkdirSync(s,{mode:448});break}catch(m){if(m.code!=="EEXIST"||Date.now()>=l)throw new Error("SPI Protecter: migration locked; check active processes / 迁移锁被占用，请检查活动进程。");await new Promise(h=>setTimeout(h,50))}let g;try{let m=k(t);if(m.length>64)throw new Error(u);let f=[...m].sort((c,L)=>c===o?-1:L===o?1:c.localeCompare(L)).map(c=>P(t,c)),d=ae(f.length?f.map(c=>c.config):[C]);if(await se(f.length?f.map(c=>c.config):[d]),f.length===1&&f[0].name===o){if(O(t,f[0]),JSON.stringify(k(t))!==JSON.stringify(m))throw new Error(u);return{path:n,config:f[0].config,raw:f[0].raw,sourceRaws:[f[0].raw],migrated:0}}let w=JSON.stringify(d,null,2)+`
+`;if(Buffer.byteLength(w)>1024*1024)throw new Error(u);g=S(t,`.protecter-migration.${ne()}.tmp`);let E=a.openSync(g,a.constants.O_WRONLY|a.constants.O_CREAT|a.constants.O_EXCL,384);try{a.writeFileSync(E,w),a.fsyncSync(E)}finally{a.closeSync(E)}if(r.checkpoint?.("beforeCommit",n),JSON.stringify(k(t))!==JSON.stringify(m))throw new Error(u);for(let c of f)O(t,c);a.renameSync(g,n),g=void 0,D(t);let x=P(t,o);if(x.raw!==w)throw new Error(u);r.checkpoint?.("afterCommit",n);for(let c of f)c.name!==o&&(r.checkpoint?.("beforeDelete",S(t,c.name)),O(t,x),O(t,c),a.unlinkSync(S(t,c.name)));D(t);let X=[o];if(JSON.stringify(k(t))!==JSON.stringify(X))throw new Error(u);return O(t,x),{path:n,config:d,raw:w,sourceRaws:[...new Set([...f.map(c=>c.raw),w])],migrated:f.filter(c=>c.name!==o).length}}catch{throw new Error(u)}finally{if(g)try{a.unlinkSync(g)}catch{}a.rmdirSync(s)}}import{createHash as ce}from"node:crypto";import{readFileSync as fe}from"node:fs";import{execFileSync as J}from"node:child_process";var $="SPI Protecter: machine ID unavailable / 无法获取机器标识。";function N(i){let e=i.trim().toLowerCase().replace(/-/g,"");if(!/^[a-f0-9]{32}$/.test(e)||/^0+$/.test(e))throw new Error($);return ce("sha256").update(`pi-information-protecter:v1:${e}`).digest("hex").slice(0,32)}function U(){try{if(process.platform==="linux")return N(fe("/etc/machine-id","utf8"));if(process.platform==="darwin"){let i=J("/usr/sbin/ioreg",["-rd1","-c","IOPlatformExpertDevice"],{encoding:"utf8",timeout:5e3,maxBuffer:1048576,stdio:["ignore","pipe","pipe"]});return N(i.match(/"IOPlatformUUID"\s*=\s*"([a-fA-F0-9-]+)"/)?.[1]??"")}if(process.platform==="win32"){let i=J("reg.exe",["query","HKLM\\SOFTWARE\\Microsoft\\Cryptography","/v","MachineGuid","/reg:64"],{encoding:"utf8",timeout:5e3,maxBuffer:65536,stdio:["ignore","pipe","pipe"]});return N(i.match(/MachineGuid\s+REG_SZ\s+([a-fA-F0-9-]+)/i)?.[1]??"")}}catch{}throw new Error($)}var p="protecter: 请求已清空。配置无效、扫描超时或包含不支持的附件；修复后重试。",v=class{constructor(e,r=2e3,t=U){this.configDir=e;this.timeoutMs=r;this.machineId=t}configDir;timeoutMs;machineId;tokens=new Map;queue=Promise.resolve();workers=new Set;closed=!1;snapshot;async initialize(){if(this.closed)throw new Error(p);this.snapshot=void 0;let e=await j(this.configDir,this.machineId());if(this.closed)throw new Error(p);this.snapshot=e}get configPath(){return this.snapshot?.path??""}get ruleCount(){return this.snapshot?.config.sensitiveWords.length??0}get ready(){return!!this.snapshot&&!this.closed}get mappingCount(){return this.tokens.size}redact(e){let r=this.queue.then(()=>this.scan(e));return this.queue=r.catch(()=>{}),r}async scan(e){if(!this.ready)throw new Error(p);let{config:r,sourceRaws:t}=this.snapshot,o=JSON.stringify(e);if(!o||Buffer.byteLength(o)>8*1024*1024)throw new Error(p);let n;try{n=JSON.parse(o)}catch{throw new Error(p)}return new Promise((s,l)=>{let g=!1,m=new ue(le(new URL("./scan-worker.mjs",import.meta.url)),{workerData:{payload:n,rules:r.sensitiveWords,entries:[...this.tokens],configRaws:t},execArgv:[],resourceLimits:{maxOldGenerationSizeMb:128}});this.workers.add(m);let h=d=>{if(!g){if(g=!0,clearTimeout(f),this.workers.delete(m),m.terminate(),!d||this.closed){l(new Error(p));return}for(let[w,E]of d.additions)this.tokens.set(w,E);s(d.payload)}},f=setTimeout(()=>h(),this.timeoutMs);m.once("message",d=>h(d.failed?void 0:d)),m.once("error",()=>h()),m.once("exit",()=>h())})}restoreText(e){return e.replace(/__PIP_[a-f0-9]{48}__/g,r=>this.tokens.get(r)??r)}restore(e,r=0){if(r>80)throw new Error("protecter: 响应层级过深。");if(typeof e=="string")return this.restoreText(e);if(Array.isArray(e))return e.map(t=>this.restore(t,r+1));if(e&&typeof e=="object"){let t=Object.create(null);for(let[o,n]of Object.entries(e)){let s=this.restoreText(o);if(Object.hasOwn(t,s))throw new Error("protecter: 响应键冲突。");t[s]=this.restore(n,r+1)}return t}return e}close(){this.closed=!0,this.snapshot=void 0,this.tokens.clear();for(let e of this.workers)e.terminate();this.workers.clear()}};import{realpathSync as ge,statSync as G}from"node:fs";import{homedir as me}from"node:os";import{basename as z,dirname as _,isAbsolute as de,relative as B,resolve as I}from"node:path";import{fileURLToPath as pe}from"node:url";function he(i,e){let r=i.replace(/^@/,"");return r.startsWith("file://")&&(r=pe(r)),(r==="~"||r.startsWith("~/"))&&(r=me()+r.slice(1)),I(e,r)}function T(i){try{return ge(i)}catch{let e=_(i);return e===i?i:I(T(e),B(e,i))}}function we(i,e){let r=B(i,e);return r===""||!r.startsWith("..")&&!de(r)}function ye(i,e){try{let r=G(i),t=G(e);return r.dev===t.dev&&r.ino===t.ino}catch{return!1}}function H(i,e,r,t){if(!t)return!0;let o=T(I(t));if(["bash","powershell"].includes(i)){let l=typeof e.command=="string"?e.command:"";if(/protecter(?:\.[a-f0-9]{32})?\.json|\.protecter-migration/i.test(l)||l.includes(t))return!0}let n=e.path??e.file_path??e.filePath,s=["grep","find","ls"].includes(i);if(typeof n!="string"&&!s)return!1;try{let l=he(typeof n=="string"?n:".",r),g=T(l);return _(g)===_(o)&&(b.test(z(g))||z(g).startsWith(".protecter-migration"))||g===o||ye(l,t)||s&&we(g,o)}catch{return!0}}function Ee(i){let e=new v(Se()),r=/^0\.85\./.test(q)&&Number(q.split(".")[2])>=1,t=!1;i.on("session_start",async(o,n)=>{try{if(!r)throw new Error;await e.initialize(),t=!0;let s=e.ruleCount;n.ui.setStatus("protecter",`SPI Protecter · ${s} rules`),s===0&&n.ui.notify("SPI Protecter: empty rules; edit local machine config and /reload / 规则为空，请编辑本地机器配置后重载。","warning")}catch{t=!1,n.ui.notify(p,"error")}}),i.on("before_provider_request",async(o,n)=>{try{if(!r)throw new Error;let s=await e.redact(o.payload);return t=!0,s}catch{t=!1;try{await n.abort()}catch{}try{n.ui.notify(p,"error")}catch{}return{}}}),i.on("message_end",o=>{if(o.message.role!=="assistant")return;let n=o.message;return{message:{...n,content:n.content.map(s=>s.type==="text"?{...s,text:e.restoreText(s.text)}:s.type==="thinking"?{...s,thinking:e.restoreText(s.thinking)}:s.type==="toolCall"?{...s,arguments:e.restore(s.arguments)}:s),...n.errorMessage?{errorMessage:e.restoreText(n.errorMessage)}:{}}}}),i.registerMarkdownTransformer((o,n)=>n.messageType==="user"?o:e.restoreText(o)),i.on("tool_call",(o,n)=>{if(!t)return{block:!0,reason:"SPI Protecter 尚未就绪。"};let s=e.restore(o.input);for(let l of Object.keys(o.input))delete o.input[l];if(Object.assign(o.input,s),H(o.toolName,o.input,n.cwd,e.configPath))return{block:!0,reason:"SPI Protecter：禁止工具访问保护配置，请由用户在本地编辑。"}}),i.on("session_before_compact",(o,n)=>(n.ui.notify("SPI Protecter：暂不支持远程上下文压缩，请使用 /new 开始新会话。","warning"),{cancel:!0})),i.on("session_before_tree",o=>o.preparation.userWantsSummary?{cancel:!0}:void 0),i.registerCommand("protecter",{description:"SPI Protecter memory status / 内存状态（不显示敏感值）",handler:async(o,n)=>{if(o.trim()&&!["status","reload"].includes(o.trim())){n.ui.notify("用法：/protecter [status|reload]。不要在命令参数中填写敏感值。","info");return}if(o.trim()==="reload"){await n.waitForIdle(),await n.reload();return}n.ui.notify(`SPI Protecter: ${e.ready?"ready / 就绪":"not ready / 未就绪"}; ${e.ruleCount} rules / 规则; ${e.mappingCount} mappings / 映射. Memory snapshot; /reload to refresh / 内存快照，重载后更新。`,e.ready?"info":"error")}}),i.on("session_shutdown",()=>e.close())}export{Ee as default};

package/dist/scan-worker.mjs

@@ -0,0 +1,2 @@
+/*! SPI Protecter | MIT | see LICENSE / SPI 隐私保护插件 | MIT 许可 */
+import{parentPort as _,workerData as b}from"node:worker_threads";import{randomBytes as j}from"node:crypto";try{let u=function(t){let r=l.get(t);if(r)return r;if(a.size>=5e4)throw new Error;do r=`__PIP_${j(24).toString("hex")}__`;while(a.has(r)||E.includes(r));return l.set(t,r),a.set(r,t),d.push([r,t]),r},h=function(t){let r=[];for(let o of p)if(o.literal===void 0){o.regex.lastIndex=0;for(let n of t.matchAll(o.regex)){if(!n[0].length)throw new Error;if(r.push([n.index,n.index+n[0].length]),++y>1e5)throw new Error}}else{if(!o.literal)continue;let n=0;for(;(n=t.indexOf(o.literal,n))!==-1;){if(r.push([n,n+o.literal.length]),++y>1e5)throw new Error;n++}}r.sort((o,n)=>o[0]-n[0]||n[1]-o[1]);let e=[];for(let o of r){let n=e.at(-1);n&&o[0]<n[1]?n[1]=Math.max(n[1],o[1]):e.push([...o])}let s="",i=0;for(let[o,n]of e)s+=t.slice(i,o)+u(t.slice(o,n)),i=n;return s+t.slice(i)},f=function(t){let r="",e=0;for(let s of t.matchAll(/__PIP_[a-f0-9]{48}__/g))a.has(s[0])&&(r+=h(t.slice(e,s.index))+s[0],e=s.index+s[0].length);return r+h(t.slice(e))},c=function(t,r=0){if(++x>2e5||r>80)throw new Error;if(typeof t=="string"){if(m.some(e=>t.includes(e)))return f(t);if(/^\s*[[{]/.test(t)){let e;try{e=JSON.parse(t)}catch{}if(e&&typeof e=="object"){let s=JSON.stringify(c(e,r+1)),i=f(s);return i===s?s:(JSON.parse(i),i)}}return f(t)}if(typeof t=="number"){let e=f(String(t));return e===String(t)?t:e}if(Array.isArray(t))return t.map(e=>c(e,r+1));if(t&&typeof t=="object"){if(typeof t.type=="string"&&/image|audio|video|document|(^|_)file($|_)/i.test(t.type))throw new Error;if(Object.keys(t).some(s=>/^(inlineData|inline_data|fileData|file_data|image_url|input_audio)$/.test(s)))throw new Error;let e=Object.create(null);for(let[s,i]of Object.entries(t)){let o=f(s);if(Object.hasOwn(e,o))throw new Error;e[o]=c(i,r+1)}return e}if(t===null||typeof t=="boolean")return t;throw new Error};J=u,M=h,N=f,k=c;let{payload:g,rules:O,entries:w,configRaws:S}=b,l=new Map(w.map(([t,r])=>[r,t])),a=new Map(w),d=[],p=O.map(t=>typeof t=="string"?{literal:t}:t.type==="literal"?{literal:t.value}:{regex:new RegExp(t.pattern,[...new Set((t.flags??"")+"g")].join(""))});for(let t of l.keys())p.push({literal:t});let m=[...new Set(S.flatMap(t=>[t,JSON.stringify(JSON.parse(t))]))];for(let t of m)p.push({literal:t});let E=JSON.stringify(g),y=0,x=0;_.postMessage({payload:c(g),additions:d})}catch{_.postMessage({failed:!0})}var J,M,N,k;

package/dist/validate-worker.mjs

@@ -0,0 +1,2 @@
+/*! SPI Protecter | MIT | see LICENSE / SPI 隐私保护插件 | MIT 许可 */
+import{parentPort as t,workerData as r}from"node:worker_threads";try{for(let o of r)for(let e of o.sensitiveWords)if(typeof e=="object"&&e.type==="regex"&&new RegExp(e.pattern,e.flags??"").test(""))throw new Error;t.postMessage(!0)}catch{t.postMessage(!1)}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-information-protecter",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Sensitive Personal Information (SPI) Protecter — local reversible privacy redaction for Pi",
   "type": "module",
   "license": "MIT",
@@ -23,7 +23,7 @@
     "redaction"
   ],
   "files": [
-    "src",
+    "dist",
     "README.md",
     "SECURITY.md",
     "CHANGELOG.md",
@@ -33,7 +33,7 @@
   ],
   "pi": {
     "extensions": [
-      "./src/index.ts"
+      "./dist/index.mjs"
     ]
   },
   "engines": {
@@ -45,13 +45,17 @@
   "devDependencies": {
     "@earendil-works/pi-coding-agent": "0.85.1",
     "@types/node": "^22.0.0",
+    "esbuild": "0.28.2",
     "tsx": "^4.20.0",
     "typescript": "^5.9.0"
   },
   "scripts": {
+    "build": "node scripts/build.mjs",
+    "pretest": "npm run build",
     "test": "tsx --test test/*.test.ts",
     "typecheck": "tsc --noEmit",
     "check": "npm run typecheck && npm test",
-    "prepublishOnly": "npm run check"
+    "prepublishOnly": "npm run check",
+    "prepack": "npm run build"
   }
 }

package/src/config.ts

@@ -1,124 +0,0 @@
-import {
-  constants,
-  closeSync,
-  fchmodSync,
-  fstatSync,
-  mkdirSync,
-  openSync,
-  readFileSync,
-  writeFileSync,
-} from "node:fs";
-import { dirname } from "node:path";
-
-export type Rule =
-  | string
-  | { type: "literal"; value: string }
-  | { type: "regex"; pattern: string; flags?: string };
-export interface Config {
-  version: 1;
-  sensitiveWords: Rule[];
-}
-export const DEFAULT_CONFIG: Config = { version: 1, sensitiveWords: [] };
-export const CONFIG_ERROR =
-  "SPI Protecter: unsafe or invalid configuration / 配置不安全或格式无效，请在本地修复。";
-
-export function parseConfig(raw: string): Config {
-  try {
-    const value = JSON.parse(raw);
-    if (
-      !value ||
-      value.version !== 1 ||
-      !Array.isArray(value.sensitiveWords) ||
-      value.sensitiveWords.length > 1000 ||
-      Object.keys(value).some((k) => !["version", "sensitiveWords"].includes(k))
-    )
-      throw new Error();
-    for (const rule of value.sensitiveWords) {
-      if (typeof rule === "string") {
-        if (!rule || rule.length > 8192) throw new Error();
-        continue;
-      }
-      if (!rule || typeof rule !== "object") throw new Error();
-      if (rule.type === "literal") {
-        if (
-          Object.keys(rule).some((k) => !["type", "value"].includes(k)) ||
-          typeof rule.value !== "string" ||
-          !rule.value ||
-          rule.value.length > 8192
-        )
-          throw new Error();
-      } else if (rule.type === "regex") {
-        if (
-          Object.keys(rule).some(
-            (k) => !["type", "pattern", "flags"].includes(k),
-          ) ||
-          typeof rule.pattern !== "string" ||
-          !rule.pattern ||
-          rule.pattern.length > 8192 ||
-          (rule.flags !== undefined &&
-            (typeof rule.flags !== "string" || !/^[gimsu]*$/.test(rule.flags)))
-        )
-          throw new Error();
-        const re = new RegExp(rule.pattern, rule.flags ?? "");
-        // Compilation only here; matching is bounded in the worker. / 此处仅编译，匹配在限时 worker 内执行。
-        void re;
-      } else throw new Error();
-    }
-    return value;
-  } catch {
-    throw new Error(CONFIG_ERROR);
-  }
-}
-
-/**
- * Reject symlinks and hard links; never print parser/OS errors containing secrets.
- * 拒绝符号链接和硬链接；不输出可能包含敏感值的解析器或系统错误。
- */
-export function loadConfig(
-  path: string,
-  create = false,
-): { config: Config; raw: string } {
-  let fd: number | undefined;
-  try {
-    if (create) {
-      mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-      try {
-        const initial = openSync(
-          path,
-          constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL,
-          0o600,
-        );
-        try {
-          writeFileSync(
-            initial,
-            JSON.stringify(DEFAULT_CONFIG, null, 2) + "\n",
-          );
-        } finally {
-          closeSync(initial);
-        }
-      } catch (error) {
-        if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
-      }
-    }
-    fd = openSync(
-      path,
-      constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK,
-    );
-    const stat = fstatSync(fd);
-    if (
-      !stat.isFile() ||
-      stat.nlink !== 1 ||
-      stat.size > 1024 * 1024 ||
-      (process.getuid && stat.uid !== process.getuid())
-    )
-      throw new Error();
-    if (process.platform !== "win32") fchmodSync(fd, 0o600);
-    const raw = readFileSync(fd, "utf8");
-    if (Buffer.byteLength(raw) > 1024 * 1024) throw new Error();
-    return { config: parseConfig(raw), raw };
-  } catch {
-    throw new Error(CONFIG_ERROR);
-  } finally {
-    if (fd !== undefined) closeSync(fd);
-  }
-}

package/src/engine.ts

@@ -1,130 +0,0 @@
-import { Worker } from "node:worker_threads";
-import { fileURLToPath } from "node:url";
-import { migrateConfig, type Snapshot } from "./migration.ts";
-import { getMachineHash } from "./machine.ts";
-
-export const REQUEST_ERROR =
-  "protecter: 请求已清空。配置无效、扫描超时或包含不支持的附件；修复后重试。";
-export class Protecter {
-  private readonly tokens = new Map<string, string>();
-  private queue: Promise<unknown> = Promise.resolve();
-  private readonly workers = new Set<Worker>();
-  private closed = false;
-  private snapshot?: Snapshot;
-  constructor(
-    private readonly configDir: string,
-    private readonly timeoutMs = 2000,
-    private readonly machineId: () => string = getMachineHash,
-  ) {}
-
-  async initialize(): Promise<void> {
-    if (this.closed) throw new Error(REQUEST_ERROR);
-    this.snapshot = undefined;
-    const snapshot = await migrateConfig(this.configDir, this.machineId());
-    if (this.closed) throw new Error(REQUEST_ERROR);
-    this.snapshot = snapshot;
-  }
-  get configPath(): string { return this.snapshot?.path ?? ""; }
-  get ruleCount(): number { return this.snapshot?.config.sensitiveWords.length ?? 0; }
-  get ready(): boolean { return !!this.snapshot && !this.closed; }
-  get mappingCount(): number {
-    return this.tokens.size;
-  }
-
-  /**
-   * Serialise scans so two requests cannot assign different tokens to the same value.
-   * 串行扫描，避免两个请求为同一原文分配不同占位符。
-   */
-  redact(payload: unknown): Promise<unknown> {
-    const run = this.queue.then(() => this.scan(payload));
-    this.queue = run.catch(() => undefined);
-    return run;
-  }
-
-  private async scan(payload: unknown): Promise<unknown> {
-    if (!this.ready) throw new Error(REQUEST_ERROR);
-    const { config, sourceRaws } = this.snapshot!;
-    const serialized = JSON.stringify(payload);
-    if (!serialized || Buffer.byteLength(serialized) > 8 * 1024 * 1024)
-      throw new Error(REQUEST_ERROR);
-    let snapshot: unknown;
-    try {
-      snapshot = JSON.parse(serialized);
-    } catch {
-      throw new Error(REQUEST_ERROR);
-    }
-    return new Promise((resolve, reject) => {
-      let settled = false;
-      const worker = new Worker(
-        fileURLToPath(new URL("./scan-worker.mjs", import.meta.url)),
-        {
-          workerData: {
-            payload: snapshot,
-            rules: config.sensitiveWords,
-            entries: [...this.tokens],
-            configRaws: sourceRaws,
-          },
-          execArgv: [],
-          resourceLimits: { maxOldGenerationSizeMb: 128 },
-        },
-      );
-      this.workers.add(worker);
-      const finish = (data?: {
-        payload: unknown;
-        additions: [string, string][];
-      }) => {
-        if (settled) return;
-        settled = true;
-        clearTimeout(timer);
-        this.workers.delete(worker);
-        void worker.terminate();
-        if (!data || this.closed) {
-          reject(new Error(REQUEST_ERROR));
-          return;
-        }
-        for (const [token, original] of data.additions)
-          this.tokens.set(token, original);
-        resolve(data.payload);
-      };
-      const timer = setTimeout(() => finish(), this.timeoutMs);
-      worker.once("message", (data) => finish(data.failed ? undefined : data));
-      worker.once("error", () => finish());
-      worker.once("exit", () => finish());
-    });
-  }
-
-  restoreText(text: string): string {
-    // One pass, never recursively expand text introduced by a replacement.
-    // 仅替换一遍，不递归展开替换后引入的文本。
-    return text.replace(
-      /__PIP_[a-f0-9]{48}__/g,
-      (token) => this.tokens.get(token) ?? token,
-    );
-  }
-
-  restore<T>(value: T, depth = 0): T {
-    if (depth > 80) throw new Error("protecter: 响应层级过深。");
-    if (typeof value === "string") return this.restoreText(value) as T;
-    if (Array.isArray(value))
-      return value.map((item) => this.restore(item, depth + 1)) as T;
-    if (value && typeof value === "object") {
-      const result: Record<string, unknown> = Object.create(null);
-      for (const [key, item] of Object.entries(value)) {
-        const nextKey = this.restoreText(key);
-        if (Object.hasOwn(result, nextKey))
-          throw new Error("protecter: 响应键冲突。");
-        result[nextKey] = this.restore(item, depth + 1);
-      }
-      return result as T;
-    }
-    return value;
-  }
-
-  close(): void {
-    this.closed = true;
-    this.snapshot = undefined;
-    this.tokens.clear();
-    for (const worker of this.workers) void worker.terminate();
-    this.workers.clear();
-  }
-}

package/src/guard.ts

@@ -1,73 +0,0 @@
-import { realpathSync, statSync } from "node:fs";
-import { homedir } from "node:os";
-import { basename, dirname, isAbsolute, relative, resolve } from "node:path";
-import { CONFIG_NAME } from "./migration.ts";
-import { fileURLToPath } from "node:url";
-
-function normalized(path: string, cwd: string): string {
-  let value = path.replace(/^@/, "");
-  if (value.startsWith("file://")) value = fileURLToPath(value);
-  if (value === "~" || value.startsWith("~/"))
-    value = homedir() + value.slice(1);
-  return resolve(cwd, value);
-}
-function canonical(path: string): string {
-  try {
-    return realpathSync(path);
-  } catch {
-    const parent = dirname(path);
-    return parent === path
-      ? path
-      : resolve(canonical(parent), relative(parent, path));
-  }
-}
-function contains(parent: string, child: string): boolean {
-  const rel = relative(parent, child);
-  return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
-}
-function sameFile(a: string, b: string): boolean {
-  try {
-    const x = statSync(a),
-      y = statSync(b);
-    return x.dev === y.dev && x.ino === y.ino;
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Best-effort access guard. Arbitrary shell/third-party tools are NOT sandboxed.
- * 尽力而为的访问防护，不对任意 shell 或第三方工具提供沙箱隔离。
- */
-export function blocksConfigAccess(
-  tool: string,
-  input: Record<string, unknown>,
-  cwd: string,
-  configPath: string,
-): boolean {
-  if (!configPath) return true;
-  const target = canonical(resolve(configPath));
-  // Inspect executable fields, not document bodies. / 检查可执行字段，不检查文档正文。
-  if (["bash", "powershell"].includes(tool)) {
-    const command = typeof input.command === "string" ? input.command : "";
-    if (/protecter(?:\.[a-f0-9]{32})?\.json|\.protecter-migration/i.test(command) || command.includes(configPath)) return true;
-  }
-  const candidate = input.path ?? input.file_path ?? input.filePath;
-  const recursive = ["grep", "find", "ls"].includes(tool);
-  if (typeof candidate !== "string" && !recursive) return false;
-  try {
-    const path = normalized(
-      typeof candidate === "string" ? candidate : ".",
-      cwd,
-    );
-    const real = canonical(path);
-    return (
-      (dirname(real) === dirname(target) && (CONFIG_NAME.test(basename(real)) || basename(real).startsWith(".protecter-migration"))) ||
-      real === target ||
-      sameFile(path, configPath) ||
-      (recursive && contains(real, target))
-    );
-  } catch {
-    return true;
-  }
-}

package/src/index.ts

@@ -1,151 +0,0 @@
-import {
-  getAgentDir,
-  VERSION,
-  type ExtensionAPI,
-} from "@earendil-works/pi-coding-agent";
-import { Protecter, REQUEST_ERROR } from "./engine.ts";
-import { blocksConfigAccess } from "./guard.ts";
-
-/**
- * Explicitly install this after other extensions that rewrite outgoing payloads.
- * 请将本扩展放在其他改写出站请求体的扩展之后加载。
- */
-export default function informationProtecter(pi: ExtensionAPI): void {
-  const engine = new Protecter(getAgentDir());
-  const compatible =
-    /^0\.85\./.test(VERSION) && Number(VERSION.split(".")[2]) >= 1;
-  let healthy = false;
-
-  pi.on("session_start", async (_event, ctx) => {
-    try {
-      if (!compatible) throw new Error();
-      await engine.initialize();
-      healthy = true;
-      const count = engine.ruleCount;
-      ctx.ui.setStatus("protecter", `SPI Protecter · ${count} rules`);
-      if (count === 0)
-        ctx.ui.notify(
-          "SPI Protecter: empty rules; edit local machine config and /reload / 规则为空，请编辑本地机器配置后重载。",
-          "warning",
-        );
-    } catch {
-      healthy = false;
-      ctx.ui.notify(REQUEST_ERROR, "error");
-    }
-  });
-
-  pi.on("before_provider_request", async (event, ctx) => {
-    try {
-      if (!compatible) throw new Error();
-      const payload = await engine.redact(event.payload);
-      healthy = true;
-      return payload;
-    } catch {
-      healthy = false;
-      // Pi catches hook errors and continues with the ORIGINAL payload.
-      // Pi 会捕获钩子异常并继续使用原始请求体。
-      // Always return an empty replacement; abort/notifications are best-effort.
-      // 必须返回空替代请求体；终止请求和通知仅作尽力处理。
-      try {
-        await ctx.abort();
-      } catch {
-        /* Replacement below remains mandatory. / 仍须返回下方的替代请求体。 */
-      }
-      try {
-        ctx.ui.notify(REQUEST_ERROR, "error");
-      } catch {
-        /* Never fail open. / 不因异常放行原文。 */
-      }
-      // May produce a provider validation error, but contains NO original data.
-      // 可能触发提供商校验错误，但不包含任何原始数据。
-      return {};
-    }
-  });
-
-  pi.on("message_end", (event) => {
-    if (event.message.role !== "assistant") return;
-    // Preserve IDs, signatures, usage and provider metadata; only restore user-facing content.
-    // 保留 ID、签名、用量与提供商元数据，仅还原面向用户的内容。
-    const message = event.message;
-    return {
-      message: {
-        ...message,
-        content: message.content.map((block) => {
-          if (block.type === "text")
-            return { ...block, text: engine.restoreText(block.text) };
-          if (block.type === "thinking")
-            return { ...block, thinking: engine.restoreText(block.thinking) };
-          if (block.type === "toolCall")
-            return { ...block, arguments: engine.restore(block.arguments) };
-          return block;
-        }),
-        ...(message.errorMessage
-          ? { errorMessage: engine.restoreText(message.errorMessage) }
-          : {}),
-      },
-    };
-  });
-
-  pi.registerMarkdownTransformer((text, context) =>
-    context.messageType === "user" ? text : engine.restoreText(text),
-  );
-
-  pi.on("tool_call", (event, ctx) => {
-    if (!healthy) return { block: true, reason: "SPI Protecter 尚未就绪。" };
-    const restored = engine.restore(event.input);
-    for (const key of Object.keys(event.input))
-      delete (event.input as Record<string, unknown>)[key];
-    Object.assign(event.input, restored);
-    if (
-      blocksConfigAccess(
-        event.toolName,
-        event.input,
-        ctx.cwd,
-        engine.configPath,
-      )
-    ) {
-      return {
-        block: true,
-        reason: "SPI Protecter：禁止工具访问保护配置，请由用户在本地编辑。",
-      };
-    }
-  });
-
-  // These auxiliary requests have different lifecycle/response restoration semantics.
-  // 这些辅助请求具有不同的生命周期与响应还原语义。
-  // Until separately verified, cancel instead of silently sending plaintext summaries.
-  // 在单独验证前取消这些请求，避免静默发送明文摘要。
-  pi.on("session_before_compact", (_event, ctx) => {
-    ctx.ui.notify(
-      "SPI Protecter：暂不支持远程上下文压缩，请使用 /new 开始新会话。",
-      "warning",
-    );
-    return { cancel: true };
-  });
-  pi.on("session_before_tree", (event) =>
-    event.preparation.userWantsSummary ? { cancel: true } : undefined,
-  );
-
-  pi.registerCommand("protecter", {
-    description: "SPI Protecter memory status / 内存状态（不显示敏感值）",
-    handler: async (args, ctx) => {
-      if (args.trim() && !["status", "reload"].includes(args.trim())) {
-        ctx.ui.notify(
-          "用法：/protecter [status|reload]。不要在命令参数中填写敏感值。",
-          "info",
-        );
-        return;
-      }
-      if (args.trim() === "reload") {
-        await ctx.waitForIdle();
-        await ctx.reload();
-        return;
-      }
-      ctx.ui.notify(
-        `SPI Protecter: ${engine.ready ? "ready / 就绪" : "not ready / 未就绪"}; ${engine.ruleCount} rules / 规则; ${engine.mappingCount} mappings / 映射. Memory snapshot; /reload to refresh / 内存快照，重载后更新。`,
-        engine.ready ? "info" : "error",
-      );
-    },
-  });
-  pi.on("session_shutdown", () => engine.close());
-}

package/src/machine.ts

@@ -1,28 +0,0 @@
-import { createHash } from "node:crypto";
-import { readFileSync } from "node:fs";
-import { execFileSync } from "node:child_process";
-
-export const MACHINE_ERROR = "SPI Protecter: machine ID unavailable / 无法获取机器标识。";
-
-/** Normalize OS identifiers without exposing them. / 规范化系统标识，不向外暴露。 */
-export function machineHash(id: string): string {
-  const normalized = id.trim().toLowerCase().replace(/-/g, "");
-  if (!/^[a-f0-9]{32}$/.test(normalized) || /^0+$/.test(normalized)) throw new Error(MACHINE_ERROR);
-  return createHash("sha256").update(`pi-information-protecter:v1:${normalized}`).digest("hex").slice(0, 32);
-}
-
-/** No random fallback: unavailable IDs must fail closed. / 不随机回退，标识不可用时拒绝初始化。 */
-export function getMachineHash(): string {
-  try {
-    if (process.platform === "linux") return machineHash(readFileSync("/etc/machine-id", "utf8"));
-    if (process.platform === "darwin") {
-      const text = execFileSync("/usr/sbin/ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"], { encoding: "utf8", timeout: 5000, maxBuffer: 1024 * 1024, stdio: ["ignore", "pipe", "pipe"] });
-      return machineHash(text.match(/"IOPlatformUUID"\s*=\s*"([a-fA-F0-9-]+)"/)?.[1] ?? "");
-    }
-    if (process.platform === "win32") {
-      const text = execFileSync("reg.exe", ["query", "HKLM\\SOFTWARE\\Microsoft\\Cryptography", "/v", "MachineGuid", "/reg:64"], { encoding: "utf8", timeout: 5000, maxBuffer: 65536, stdio: ["ignore", "pipe", "pipe"] });
-      return machineHash(text.match(/MachineGuid\s+REG_SZ\s+([a-fA-F0-9-]+)/i)?.[1] ?? "");
-    }
-  } catch { /* Do not expose command output. / 不暴露命令输出。 */ }
-  throw new Error(MACHINE_ERROR);
-}

package/src/migration.ts

@@ -1,127 +0,0 @@
-import * as fs from "node:fs";
-import { join, resolve } from "node:path";
-import { createHash, randomUUID } from "node:crypto";
-import { Worker } from "node:worker_threads";
-import { fileURLToPath } from "node:url";
-import { CONFIG_ERROR, DEFAULT_CONFIG, loadConfig, parseConfig, type Config, type Rule } from "./config.ts";
-
-export const CONFIG_NAME = /^protecter(?:\.[a-f0-9]{32})?\.json$/;
-export interface Snapshot { path: string; config: Config; raw: string; sourceRaws: string[]; migrated: number }
-interface Source { name: string; raw: string; config: Config; identity: string; digest: string }
-export interface MigrationOptions {
-  lockTimeoutMs?: number;
-  // Local fault injection for regression tests only. / 仅供本地回归测试注入故障。
-  checkpoint?: (stage: "beforeCommit" | "afterCommit" | "beforeDelete", path: string) => void;
-}
-
-export function validatePatterns(configs: Config[]): Promise<void> {
-  return new Promise((resolvePromise, reject) => {
-    const worker = new Worker(fileURLToPath(new URL("./validate-worker.mjs", import.meta.url)), { workerData: configs, execArgv: [], resourceLimits: { maxOldGenerationSizeMb: 64 } });
-    let done = false;
-    const finish = (ok: boolean) => {
-      if (done) return;
-      done = true;
-      clearTimeout(timer);
-      void worker.terminate();
-      if (ok) resolvePromise(); else reject(new Error(CONFIG_ERROR));
-    };
-    const timer = setTimeout(() => finish(false), 2000);
-    worker.once("message", value => finish(value === true));
-    worker.once("error", () => finish(false));
-    worker.once("exit", () => finish(false));
-  });
-}
-
-export function mergeConfigs(configs: Config[]): Config {
-  const seen = new Set<string>();
-  const rules: Rule[] = [];
-  for (const config of configs) for (const rule of config.sensitiveWords) {
-    const key = typeof rule === "string" ? JSON.stringify(["literal", rule]) : rule.type === "literal" ? JSON.stringify(["literal", rule.value]) : JSON.stringify(["regex", rule.pattern, [...new Set((rule.flags ?? "") + "g")].sort().join("")]);
-    if (!seen.has(key)) { seen.add(key); rules.push(rule); }
-  }
-  const raw = JSON.stringify({ version: 1, sensitiveWords: rules });
-  if (Buffer.byteLength(raw) > 1024 * 1024) throw new Error(CONFIG_ERROR);
-  return parseConfig(raw);
-}
-
-function identity(path: string): string {
-  const s = fs.lstatSync(path, { bigint: true });
-  if (!s.isFile() || s.nlink !== 1n || (process.getuid && s.uid !== BigInt(process.getuid()))) throw new Error(CONFIG_ERROR);
-  return `${s.dev}:${s.ino}:${s.size}:${s.mtimeNs}`;
-}
-function source(dir: string, name: string): Source {
-  const path = join(dir, name), before = identity(path);
-  const loaded = loadConfig(path);
-  if (identity(path) !== before) throw new Error(CONFIG_ERROR);
-  return { name, ...loaded, identity: before, digest: createHash("sha256").update(loaded.raw).digest("hex") };
-}
-function unchanged(dir: string, previous: Source): void {
-  const now = source(dir, previous.name);
-  if (now.identity !== previous.identity || now.digest !== previous.digest) throw new Error(CONFIG_ERROR);
-}
-function names(dir: string): string[] { return fs.readdirSync(dir).filter(name => CONFIG_NAME.test(name)).sort(); }
-function syncDir(dir: string): void {
-  // Windows does not support POSIX directory fsync. / Windows 不支持 POSIX 目录同步。
-  if (process.platform === "win32") return;
-  const fd = fs.openSync(dir, fs.constants.O_RDONLY);
-  try { fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
-}
-
-/** Commit before deleting; repeat safely after partial cleanup. / 先提交再删除，部分清理后可安全重试。 */
-export async function migrateConfig(directory: string, hash: string, options: MigrationOptions = {}): Promise<Snapshot> {
-  if (!/^[a-f0-9]{32}$/.test(hash)) throw new Error(CONFIG_ERROR);
-  const dir = resolve(directory), targetName = `protecter.${hash}.json`, path = join(dir, targetName);
-  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-  const lock = join(dir, ".protecter-migration.lock"), deadline = Date.now() + (options.lockTimeoutMs ?? 5000);
-  for (;;) {
-    try { fs.mkdirSync(lock, { mode: 0o700 }); break; }
-    catch (error) {
-      if ((error as NodeJS.ErrnoException).code !== "EEXIST" || Date.now() >= deadline) throw new Error("SPI Protecter: migration locked; check active processes / 迁移锁被占用，请检查活动进程。");
-      await new Promise(resolvePromise => setTimeout(resolvePromise, 50));
-    }
-  }
-  let temp: string | undefined;
-  try {
-    const discovered = names(dir);
-    if (discovered.length > 64) throw new Error(CONFIG_ERROR);
-    const ordered = [...discovered].sort((a, b) => a === targetName ? -1 : b === targetName ? 1 : a.localeCompare(b));
-    const sources = ordered.map(name => source(dir, name));
-    const config = mergeConfigs(sources.length ? sources.map(s => s.config) : [DEFAULT_CONFIG]);
-    await validatePatterns(sources.length ? sources.map(s => s.config) : [config]);
-    if (sources.length === 1 && sources[0].name === targetName) {
-      unchanged(dir, sources[0]);
-      if (JSON.stringify(names(dir)) !== JSON.stringify(discovered)) throw new Error(CONFIG_ERROR);
-      return { path, config: sources[0].config, raw: sources[0].raw, sourceRaws: [sources[0].raw], migrated: 0 };
-    }
-    const raw = JSON.stringify(config, null, 2) + "\n";
-    if (Buffer.byteLength(raw) > 1024 * 1024) throw new Error(CONFIG_ERROR);
-    temp = join(dir, `.protecter-migration.${randomUUID()}.tmp`);
-    const fd = fs.openSync(temp, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL, 0o600);
-    try { fs.writeFileSync(fd, raw); fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
-    options.checkpoint?.("beforeCommit", path);
-    if (JSON.stringify(names(dir)) !== JSON.stringify(discovered)) throw new Error(CONFIG_ERROR);
-    for (const s of sources) unchanged(dir, s);
-    fs.renameSync(temp, path);
-    temp = undefined;
-    syncDir(dir);
-    const committed = source(dir, targetName);
-    if (committed.raw !== raw) throw new Error(CONFIG_ERROR);
-    options.checkpoint?.("afterCommit", path);
-    for (const s of sources) {
-      if (s.name === targetName) continue;
-      options.checkpoint?.("beforeDelete", join(dir, s.name));
-      unchanged(dir, committed);
-      unchanged(dir, s);
-      fs.unlinkSync(join(dir, s.name));
-    }
-    syncDir(dir);
-    const expected = [targetName];
-    if (JSON.stringify(names(dir)) !== JSON.stringify(expected)) throw new Error(CONFIG_ERROR);
-    unchanged(dir, committed);
-    return { path, config, raw, sourceRaws: [...new Set([...sources.map(s => s.raw), raw])], migrated: sources.filter(s => s.name !== targetName).length };
-  } catch { throw new Error(CONFIG_ERROR); }
-  finally {
-    if (temp) { try { fs.unlinkSync(temp); } catch { /* Preserve on failure. / 失败时保留待人工检查。 */ } }
-    fs.rmdirSync(lock);
-  }
-}

package/src/scan-worker.mjs

@@ -1,160 +0,0 @@
-// A separate worker bounds user-supplied JavaScript regex execution (including ReDoS).
-// 独立 worker 限制用户正则的执行时间，包括正则拒绝服务风险。
-import { parentPort, workerData } from "node:worker_threads";
-import { randomBytes } from "node:crypto";
-
-try {
-  const { payload, rules, entries, configRaws } = workerData;
-  const originalToToken = new Map(
-    entries.map(([token, original]) => [original, token]),
-  );
-  const tokenToOriginal = new Map(entries);
-  const additions = [];
-  const matchers = rules.map((rule) => {
-    if (typeof rule === "string") return { literal: rule };
-    if (rule.type === "literal") return { literal: rule.value };
-    return {
-      regex: new RegExp(
-        rule.pattern,
-        [...new Set((rule.flags ?? "") + "g")].join(""),
-      ),
-    };
-  });
-  // A restored value may lose its original regex context (e.g. a Bearer prefix).
-  // 还原后的值可能失去原始正则上下文，例如 Bearer 前缀。
-  // Keep learned originals protected for the lifetime of this extension instance.
-  // 在当前扩展实例的整个生命周期内继续保护已识别的原文。
-  for (const original of originalToToken.keys())
-    matchers.push({ literal: original });
-  // Defense in depth for an accidentally pasted full configuration (not a sandbox).
-  // 对意外粘贴的完整配置提供纵深防护，但这不是沙箱。
-  const protectedTexts = [...new Set(configRaws.flatMap(raw => [raw, JSON.stringify(JSON.parse(raw))]))];
-  for (const literal of protectedTexts) matchers.push({ literal });
-  const payloadText = JSON.stringify(payload);
-  let matches = 0;
-  let nodes = 0;
-  function tokenFor(original) {
-    let token = originalToToken.get(original);
-    if (token) return token;
-    if (tokenToOriginal.size >= 50000) throw new Error();
-    do {
-      token = `__PIP_${randomBytes(24).toString("hex")}__`;
-    } while (tokenToOriginal.has(token) || payloadText.includes(token));
-    originalToToken.set(original, token);
-    tokenToOriginal.set(token, original);
-    additions.push([token, original]);
-    return token;
-  }
-  function redactPlain(text) {
-    const spans = [];
-    for (const matcher of matchers) {
-      if (matcher.literal === undefined) {
-        matcher.regex.lastIndex = 0;
-        for (const match of text.matchAll(matcher.regex)) {
-          if (!match[0].length) throw new Error();
-          spans.push([match.index, match.index + match[0].length]);
-          if (++matches > 100000) throw new Error();
-        }
-      } else {
-        if (!matcher.literal) continue;
-        let start = 0;
-        while ((start = text.indexOf(matcher.literal, start)) !== -1) {
-          spans.push([start, start + matcher.literal.length]);
-          if (++matches > 100000) throw new Error();
-          start++; // Include overlapping occurrences. / 包含重叠匹配。
-        }
-      }
-    }
-    spans.sort((a, b) => a[0] - b[0] || b[1] - a[1]);
-    const merged = [];
-    for (const span of spans) {
-      const prev = merged.at(-1);
-      if (prev && span[0] < prev[1]) prev[1] = Math.max(prev[1], span[1]);
-      else merged.push([...span]);
-    }
-    let result = "",
-      cursor = 0;
-    for (const [start, end] of merged) {
-      result += text.slice(cursor, start) + tokenFor(text.slice(start, end));
-      cursor = end;
-    }
-    return result + text.slice(cursor);
-  }
-  function redact(text) {
-    // Only OUR tokens are exempt, not arbitrary strings with a similar prefix.
-    // 仅豁免本实例生成的占位符，不豁免具有相似前缀的任意字符串。
-    let result = "",
-      cursor = 0;
-    for (const match of text.matchAll(/__PIP_[a-f0-9]{48}__/g)) {
-      if (!tokenToOriginal.has(match[0])) continue;
-      result += redactPlain(text.slice(cursor, match.index)) + match[0];
-      cursor = match.index + match[0].length;
-    }
-    return result + redactPlain(text.slice(cursor));
-  }
-  function walk(value, depth = 0) {
-    if (++nodes > 200000 || depth > 80) throw new Error();
-    if (typeof value === "string") {
-      if (protectedTexts.some(text => value.includes(text)))
-        return redact(value);
-      // OpenAI serializes tool arguments as JSON strings: decode escapes BEFORE matching.
-      // OpenAI 将工具参数序列化为 JSON 字符串，匹配前必须先解码转义。
-      if (/^\s*[[{]/.test(value)) {
-        let parsed;
-        try {
-          parsed = JSON.parse(value);
-        } catch {
-          /* Ordinary prose. / 普通文本。 */
-        }
-        if (parsed && typeof parsed === "object") {
-          const inner = JSON.stringify(walk(parsed, depth + 1));
-          const outer = redact(inner);
-          if (outer === inner) return inner;
-          // A rule may span JSON syntax or match a whole JSON-shaped secret.
-          // 规则可能跨越 JSON 语法，或匹配整个 JSON 形式的敏感值。
-          // Return altered JSON only if it still parses; otherwise reject the request.
-          // 仅返回仍可解析的修改后 JSON，否则拒绝请求。
-          JSON.parse(outer);
-          return outer;
-        }
-      }
-      return redact(value);
-    }
-    if (typeof value === "number") {
-      const transformed = redact(String(value));
-      return transformed === String(value) ? value : transformed;
-    }
-    if (Array.isArray(value)) return value.map((item) => walk(item, depth + 1));
-    if (value && typeof value === "object") {
-      // No claim to perform OCR or redact opaque attachments. Reject rather than leak.
-      // 不提供 OCR 或不透明附件脱敏，宁可拒绝请求也不放行泄漏。
-      if (
-        typeof value.type === "string" &&
-        /image|audio|video|document|(^|_)file($|_)/i.test(value.type)
-      )
-        throw new Error();
-      if (
-        Object.keys(value).some((key) =>
-          /^(inlineData|inline_data|fileData|file_data|image_url|input_audio)$/.test(
-            key,
-          ),
-        )
-      )
-        throw new Error();
-      const result = Object.create(null);
-      for (const [key, item] of Object.entries(value)) {
-        const nextKey = redact(key);
-        if (Object.hasOwn(result, nextKey)) throw new Error();
-        result[nextKey] = walk(item, depth + 1);
-      }
-      return result;
-    }
-    if (value === null || typeof value === "boolean") return value;
-    throw new Error();
-  }
-  parentPort.postMessage({ payload: walk(payload), additions });
-} catch {
-  // Never serialize an exception, original payload or configuration back into diagnostics.
-  // 不将异常、原始请求体或配置序列化到诊断信息中。
-  parentPort.postMessage({ failed: true });
-}

package/src/validate-worker.mjs

@@ -1,13 +0,0 @@
-import { parentPort, workerData } from "node:worker_threads";
-
-try {
-  for (const config of workerData) {
-    for (const rule of config.sensitiveWords) {
-      if (typeof rule === "object" && rule.type === "regex" && new RegExp(rule.pattern, rule.flags ?? "").test("")) throw new Error();
-    }
-  }
-  parentPort.postMessage(true);
-} catch {
-  // Return no rules or parser errors. / 不返回规则或解析错误。
-  parentPort.postMessage(false);
-}