pisper 0.0.1 → 0.0.2

package/README.en.md

@@ -93,15 +93,11 @@ See the [Pisper project site](https://ling-kong-ran.github.io/pisper/) for the p
 
 ## Data Safety & Privacy
 
-Pisper is local-first and does not provide a Pisper cloud service that hosts or relays your conversations. Sessions, memory, workflows, schedules, usage, and connection settings are stored under `~/.pisper/agent` by default. Set `PISPER_AGENT_DIR` to move this data root.
+Pisper is local-first and does not provide a cloud service that hosts or relays conversations. Sessions and settings are stored under `~/.pisper/agent` by default; set `PISPER_AGENT_DIR` to move them.
 
-- **Protected local service:** the desktop Runtime listens on `127.0.0.1` by default and uses a random bootstrap token, an `HttpOnly` / `SameSite=Strict` cookie, and Origin checks for write requests. Pi telemetry is disabled by default.
-- **Known-secret redaction:** known formats such as API keys, Bearer/JWT values, common access tokens, private keys, and database connection strings are replaced before memory persistence, secondary model-based memory extraction, and display boundaries including errors, MCP configuration, and approval summaries. Redacted values appear as `[REDACTED SECRET]` or `***`.
-- **Credential isolation:** Provider credentials, MCP headers/environment variables, and channel credentials stay in local configuration and are not echoed to the Agent through normal configuration APIs. The host Shell tool also removes common credential and Shell-injection environment variables.
-- **Controllable memory:** automatically inferred conversation memories remain pending and cannot affect recall until confirmed. You can reject candidates, delete individual memories, or delete sessions; deletion removes the associated content and retrieval data.
-- **Explicit outbound boundaries:** regular prompts, attachments, and tool results are not globally rewritten or anonymized. Model calls send the required context directly to your configured Provider. Remote MCP, Web search, image/video generation, and messaging channels send their corresponding requests to those third parties only when enabled and used. Model-based memory extraction and semantic summaries apply the known-format redaction above before calling the active Provider.
-
-> **Important boundary:** redaction is defense in depth against accidental disclosure of common credential formats. It is not complete DLP, a sandbox, or end-to-end encryption, and it cannot recognize every sensitive value in free-form text. Provider and channel credentials currently live in the local Agent data directory rather than an operating-system keychain. Protect that directory and its backups, review prompts, files, and tool arguments before sending, and follow the privacy policy of each configured third party.
+- The Runtime listens on `127.0.0.1` by default, and Pi telemetry is disabled by default.
+- Model calls and enabled remote services such as MCP, Web search, and messaging receive the data required for each request.
+- Common credential formats are redacted at storage and display boundaries, but this is not a replacement for DLP or end-to-end encryption. Protect the local Agent data directory and its backups.
 
 <a id="desktop-pet"></a>
 
@@ -148,22 +144,27 @@ sudo apt install ./Pisper-*-linux-amd64.deb
 
 ### Terminal Client (TUI)
 
-With Node.js 20+, you can install the Pisper CLI through npm:
+With Node.js 20+, you can install the Pisper CLI through npm. Installation obtains and verifies the TUI and Runtime for the current platform; it does not install the desktop shell or Web frontend:
 
 ```bash
 npm install -g pisper
 pisper
 ```
 
+After entering the TUI for the first time, use `/apikey` to choose a Provider and save its API key in a masked input. For visual configuration, run `pisper web`; Pisper installs the signed Web frontend on demand and opens an authenticated, localhost-only settings page in your default browser. **Save Provider settings** does not change the default model; only **Set as default Provider** changes the default for later sessions.
+
 After installing the desktop app, you can also install the `pisper` command from **Settings → Terminal**. The first installation remains explicit; after later desktop updates restart Pisper, it automatically refreshes this managed terminal client:
 
 ```bash
-pisper          # start a new conversation
-pisper resume   # resume from an interactive list across all workspaces
-pisper doctor   # diagnose the runtime
+pisper                 # start a new conversation
+pisper resume          # resume from a list across all workspaces
+pisper doctor          # diagnose the runtime
+pisper web             # install and open the optional Web settings
+pisper update --check  # check TUI, Runtime, and optional Web updates
+pisper --help          # show complete onboarding and command help
 ```
 
-See the **[Pisper TUI user guide](./src-tui/README.en.md)** for installation, commands, keyboard controls, attachments, execution modes, and approvals.
+`pisper update all` updates only the TUI and Runtime. Web remains opt-in and can be updated separately with `pisper update web`. See the **[Pisper TUI user guide](./src-tui/README.en.md)** for installation, commands, keyboard controls, attachments, execution modes, and approvals.
 
 ### Run from Source
 

package/README.md

@@ -93,15 +93,11 @@ Pisper 是基于 [Pi Coding Agent](https://github.com/earendil-works/pi/tree/mai
 
 ## 数据安全与隐私
 
-Pisper 是本地优先应用，不提供用于托管或中转会话的 Pisper 云服务。会话、记忆、工作流、日程、用量和连接配置默认保存在本机 `~/.pisper/agent`；可通过 `PISPER_AGENT_DIR` 更改位置。
+Pisper 是本地优先应用，不提供托管或中转会话的云服务。会话和配置默认保存在本机 `~/.pisper/agent`，也可通过 `PISPER_AGENT_DIR` 更改位置。
 
-- **本地服务保护**：桌面 Runtime 默认只监听 `127.0.0.1`，使用随机启动 Token、`HttpOnly` / `SameSite=Strict` Cookie 和写请求 Origin 校验；Pi 遥测默认关闭。
-- **已知敏感信息脱敏**：API Key、Bearer/JWT、常见访问令牌、私钥和数据库连接串等已知格式，会在记忆落盘、记忆二次模型提取，以及错误、MCP 配置和审批摘要等展示边界进入前被替换。脱敏后的内容使用 `[REDACTED SECRET]` 或 `***` 标记。
-- **凭据隔离**：Provider 凭据、MCP Header/环境变量和渠道凭据保存在本机配置中，不通过普通配置接口回显给 Agent；宿主 Shell 工具也会移除常见凭据环境变量和 Shell 注入变量。
-- **记忆可控**：自动推断的会话记忆先进入待确认区，未确认前不参与召回；用户可以拒绝候选、删除单条记忆或删除会话，删除操作会清除对应正文与检索数据。
-- **外发边界明确**：普通 Prompt、附件、工具结果不会被全局改写或匿名化。调用模型时，必要上下文会直接发送到你配置的 Provider；启用远程 MCP、Web 搜索、图像/视频生成或消息渠道时，相应请求也会发送给该第三方。记忆提取和语义摘要如使用模型，会先执行上述已知格式脱敏，再调用当前 Provider。
-
-> **重要边界：** 脱敏是降低常见凭据意外泄露风险的纵深防护，不是完整的 DLP、沙箱或端到端加密，也无法识别所有自由文本中的敏感数据。Provider 和渠道凭据目前保存在本机 Agent 数据目录，而不是操作系统钥匙串；请保护该目录与备份，并在发送前检查 Prompt、文件和工具参数，同时遵守所选第三方的隐私政策。
+- Runtime 默认只监听 `127.0.0.1`，Pi 遥测默认关闭。
+- 调用模型或启用远程 MCP、Web 搜索和消息渠道时，必要数据会发送给你配置的第三方。
+- 常见凭据格式会在存储和展示边界脱敏，但这不能替代 DLP 或端到端加密。凭据保存在本机 Agent 数据目录，请妥善保护该目录和备份。
 
 <a id="desktop-pet"></a>
 
@@ -148,22 +144,27 @@ sudo apt install ./Pisper-*-linux-amd64.deb
 
 ### 终端客户端（TUI）
 
-使用 Node.js 20+ 时，也可通过 npm 安装 Pisper CLI：
+使用 Node.js 20+ 时，也可通过 npm 安装 Pisper CLI。安装过程会为当前平台获取并验证 TUI 与 Runtime；不会安装桌面壳或 Web 前端：
 
 ```bash
 npm install -g pisper
 pisper
 ```
 
+首次进入 TUI 后使用 `/apikey` 选择 Provider 并在掩码输入框中保存 API Key。需要可视化配置时，运行 `pisper web`，Pisper 会按需安装签名 Web 前端并在默认浏览器打开仅监听本机的认证配置页。配置页中的 **保存 Provider 配置** 不会修改默认模型；只有点击 **设为默认 Provider** 才会切换后续会话的默认模型。
+
 安装桌面版后，也可以在 **设置 → 终端** 中安装 `pisper` 命令。首次安装由你主动确认；之后桌面应用更新并重启时，Pisper 会自动刷新这份已托管的终端客户端：
 
 ```bash
-pisper          # 新建会话
-pisper resume   # 从所有工作目录的交互列表中恢复会话
-pisper doctor   # 诊断运行环境
+pisper                 # 新建会话
+pisper resume          # 从所有工作目录的交互列表中恢复会话
+pisper doctor          # 诊断运行环境
+pisper web             # 安装并打开可选 Web 配置页
+pisper update --check  # 检查 TUI、Runtime 和可选 Web 更新
+pisper --help          # 查看完整上手和命令说明
 ```
 
-安装、命令、快捷键、附件、执行模式和审批说明见 **[Pisper TUI 使用指南](./src-tui/README.md)**。
+`pisper update all` 只更新 TUI 与 Runtime；Web 始终保持按需安装，可使用 `pisper update web` 单独更新。安装、命令、快捷键、附件、执行模式和审批说明见 **[Pisper TUI 使用指南](./src-tui/README.md)**。
 
 ### 从源码运行
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pisper",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "description": "Pisper CLI.",
   "license": "MIT",
   "author": {
@@ -40,8 +40,8 @@
   },
   "pisper": {
     "repository": "ling-kong-ran/pisper",
-    "tuiVersion": "0.4.28",
-    "runtimeVersion": "0.4.29"
+    "tuiVersion": "0.4.30",
+    "runtimeVersion": "0.4.30"
   },
   "publishConfig": {
     "access": "public",