u1s1-cli 1.4.0 → 1.4.2

package/dist/agent-setup.d.ts

@@ -41,6 +41,14 @@ export declare function writeWebToolsExtension(cfg: CliConfig, features: {
  * 宁可回到原始错误文本,也不能让扩展报错刷英文堆栈。
  */
 export declare function writeErrorHumanizeExtension(): void;
+/**
+ * 生成「会话内公告触达」扩展到 <agentDir>/extensions/u1s1-announcements.js:
+ * 启动横幅只渲染一次公告,维护窗口里挂着会话的用户只会撞裸错误(审计 F14)。
+ * 轮询逻辑在 announcements-poll.ts(5 分钟一次、首拉只建基线不打扰);
+ * 公告变化时 appendEntry 进会话 + 尽力弹 notify。TUI 和 Desktop App 共用。
+ * print/json 一次性模式不起轮询;import 失败静默跳过(同 error-humanize)。
+ */
+export declare function writeAnnouncementsExtension(): void;
 /**
  * 生成「OpenRouter 应用归因」扩展到 <agentDir>/extensions/u1s1-attribution.js。
  * 用户自己配 OPENROUTER_API_KEY 直连时，pi 内置的归因头归到 pi.dev 名下（且受遥测
@@ -71,7 +79,7 @@ export declare function toProviderModels(models: ModelDef[]): {
     reasoning: boolean;
     thinkingLevelMap?: Partial<Record<ThinkingLevel, string | null>>;
     input: ("text" | "image")[];
-    cost: ModelDef["cost"];
+    cost: NonNullable<ModelDef["cost"]>;
     contextWindow: number;
     maxTokens: number;
     compat?: {
@@ -89,7 +97,9 @@ export declare function toProviderModels(models: ModelDef[]): {
  * 字面量 "local" —— pi 没有凭据会直接拒启("No API key found"),
  * 这是 pi 自带 llama provider 的同款兜底,本地服务会忽略 Authorization 头。
  */
-export declare function endpointProviderEntry(ep: CustomEndpoint): Record<string, unknown>;
+export declare function endpointProviderEntry(ep: CustomEndpoint, options?: {
+    literalKey?: boolean;
+}): Record<string, unknown>;
 /**
  * 生成 /workflow 提示词模板到 <agentDir>/prompts/workflow.md:引导主 agent
  * 拆解任务 → 生成沙箱脚本 → 调 run_workflow 执行。每次启动重写,便于随版迭代文案。

package/dist/agent-setup.js

@@ -1,7 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
-import { agentDir, CUSTOM_ENDPOINTS, ENDPOINT_ID_RE, endpointKeyEnvName, MODELS, PROVIDER_ID, VERSION, } from "./config.js";
+import { agentDir, CUSTOM_ENDPOINTS, ENDPOINT_ID_RE, endpointKeyEnvName, MODELS, PROVIDER_ID, UNKNOWN_MODEL_COST, VERSION, } from "./config.js";
 const BRAND_APPEND = `## u1s1
 
 You are u1s1 — a plain-spoken AI coding buddy for programming beginners. Most users are unfamiliar with jargon:
@@ -224,8 +224,12 @@ export function writeWebToolsExtension(cfg, features) {
         `    const workflow = await import(${JSON.stringify(new URL("./workflow/tool.js", import.meta.url).href)});\n` +
         `    pi.registerTool(workflow.createRunWorkflowTool(getParentModel));\n` +
         `  }\n`;
+    // 密钥剥离守卫也从这里装:Desktop App 的 pi 跑在 pi-web-ui 子进程里,没有
+    // 启动器代码,只有扩展能替它把 U1S1_API_KEY / U1S1_EP_KEY_* 挡在子进程之外
+    const secretEnvUrl = new URL("./secret-env.js", import.meta.url).href;
     writeFileSync(join(dir, "u1s1-tools.js"), `// 由 u1s1 每次启动自动生成,请勿手改\n` +
         `export default async function (pi) {\n` +
+        `  (await import(${JSON.stringify(secretEnvUrl)})).installChildEnvGuard();\n` +
         `  if (process.env.U1S1_TOOLS_VIA_EXTENSION !== "1") return;\n` +
         `  const baseUrl = process.env.U1S1_SIGNING_PROXY_URL || ${JSON.stringify(cfg.baseUrl)};\n` +
         `  const tools = await import(${JSON.stringify(toolsUrl)});\n` +
@@ -264,6 +268,49 @@ export function writeErrorHumanizeExtension() {
         `  });\n` +
         `}\n`);
 }
+/**
+ * 生成「会话内公告触达」扩展到 <agentDir>/extensions/u1s1-announcements.js:
+ * 启动横幅只渲染一次公告,维护窗口里挂着会话的用户只会撞裸错误(审计 F14)。
+ * 轮询逻辑在 announcements-poll.ts(5 分钟一次、首拉只建基线不打扰);
+ * 公告变化时 appendEntry 进会话 + 尽力弹 notify。TUI 和 Desktop App 共用。
+ * print/json 一次性模式不起轮询;import 失败静默跳过(同 error-humanize)。
+ */
+export function writeAnnouncementsExtension() {
+    const dir = join(agentDir, "extensions");
+    mkdirSync(dir, { recursive: true });
+    const url = new URL("./announcements-poll.js", import.meta.url).href;
+    writeFileSync(join(dir, "u1s1-announcements.js"), `// 由 u1s1 每次启动自动生成,请勿手改\n` +
+        `export default async function (pi) {\n` +
+        `  let startAnnouncementPoll;\n` +
+        `  try {\n` +
+        `    startAnnouncementPoll = (await import(${JSON.stringify(url)})).startAnnouncementPoll;\n` +
+        `  } catch {\n` +
+        `    return;\n` +
+        `  }\n` +
+        `  const { Text } = await import("@earendil-works/pi-tui");\n` +
+        `  pi.registerEntryRenderer("u1s1-announcement", (entry, _opts, theme) => {\n` +
+        `    const d = entry.data ?? {};\n` +
+        `    let text = theme.fg("text", theme.bold("📢 " + String(d.text ?? "")));\n` +
+        `    if (d.url) text += "\\n" + theme.fg("dim", String(d.url));\n` +
+        `    return new Text(text, 1, 0);\n` +
+        `  });\n` +
+        `  let ui;\n` +
+        `  let started = false;\n` +
+        `  pi.on("session_start", (_event, ctx) => {\n` +
+        `    if (ctx.hasUI) ui = ctx.ui;\n` +
+        `    if (started || ctx.mode === "print" || ctx.mode === "json") return;\n` +
+        `    started = true;\n` +
+        `    startAnnouncementPoll({\n` +
+        `      onNew: (a) => {\n` +
+        `        pi.appendEntry("u1s1-announcement", { text: a.text, url: a.url });\n` +
+        `        try {\n` +
+        `          ui?.notify("📢 " + a.text, "info");\n` +
+        `        } catch {}\n` +
+        `      },\n` +
+        `    });\n` +
+        `  });\n` +
+        `}\n`);
+}
 /**
  * 生成「OpenRouter 应用归因」扩展到 <agentDir>/extensions/u1s1-attribution.js。
  * 用户自己配 OPENROUTER_API_KEY 直连时，pi 内置的归因头归到 pi.dev 名下（且受遥测
@@ -370,8 +417,10 @@ export default async function (pi) {
   }
 
   const cwd = process.cwd();
+  // 模型跑的 shell 命令拿不到 U1S1_API_KEY / U1S1_EP_KEY_* 等密钥(进程级守卫之外的显式一层)
+  const { stripSecretEnv } = await import(${JSON.stringify(new URL("./secret-env.js", import.meta.url).href)});
   hideTool("read", createReadTool(cwd));
-  hideTool("bash", createBashTool(cwd));
+  hideTool("bash", createBashTool(cwd, { spawnHook: (spawnContext) => ({ ...spawnContext, env: stripSecretEnv(spawnContext.env) }) }));
   hideTool("edit", createEditTool(cwd));
   hideTool("write", createWriteTool(cwd));
   hideTool("grep", createGrepTool(cwd));
@@ -438,7 +487,7 @@ export function toProviderModels(models) {
             reasoning: m.reasoning,
             thinkingLevelMap,
             input: m.vision ? ["text", "image"] : ["text"],
-            cost: m.cost,
+            cost: m.cost ?? UNKNOWN_MODEL_COST,
             contextWindow: m.contextWindow,
             maxTokens: m.maxTokens,
             compat,
@@ -451,12 +500,14 @@ export function toProviderModels(models) {
  * 字面量 "local" —— pi 没有凭据会直接拒启("No API key found"),
  * 这是 pi 自带 llama provider 的同款兜底,本地服务会忽略 Authorization 头。
  */
-export function endpointProviderEntry(ep) {
+export function endpointProviderEntry(ep, options = {}) {
+    // 进程内 registerProvider 可以直接给字面量(不落文件);写 models.json 时仍走 $VAR 引用
+    const envRef = `$${endpointKeyEnvName(ep.id)}`;
     return {
         name: ep.name,
         baseUrl: ep.baseUrl,
         api: ep.api,
-        apiKey: ep.apiKey ? `$${endpointKeyEnvName(ep.id)}` : "local",
+        apiKey: ep.apiKey ? (options.literalKey ? ep.apiKey : envRef) : "local",
         models: toProviderModels(ep.models),
     };
 }

package/dist/announcements-poll.d.ts

@@ -0,0 +1,22 @@
+import { type ApiAnnouncement } from "./api.js";
+/**
+ * 会话内公告轮询(审计 F14):启动横幅只渲染一次公告,维护窗口里挂着
+ * 会话的用户只会撞裸错误。这里每 5 分钟带凭证拉一次模型列表(与启动同一
+ * 接口,公告随响应捎回,服务端零新增开销),公告发生变化时推进会话。
+ *
+ * 首次成功拉取只做基线、不打扰——启动横幅已经展示过当前公告;之后
+ * 「出现新公告」或「公告内容变化」才触发 onNew。公告被清空不提示。
+ */
+export declare const ANNOUNCEMENT_POLL_INTERVAL_MS: number;
+export declare function announcementKey(a?: ApiAnnouncement | null): string;
+/** 基线跟踪器:observe 返回「需要通知的新公告」,否则 undefined。 */
+export declare function createAnnouncementTracker(): {
+    observe(a: ApiAnnouncement | null | undefined): ApiAnnouncement | undefined;
+};
+export declare function startAnnouncementPoll(deps: {
+    onNew: (a: ApiAnnouncement) => void;
+    fetch?: () => Promise<{
+        announcement?: ApiAnnouncement | null;
+    }>;
+    intervalMs?: number;
+}): () => void;

package/dist/announcements-poll.js

@@ -0,0 +1,59 @@
+import { fetchLatestAnnouncement } from "./api.js";
+import { loadConfig } from "./config.js";
+import { hasDeviceCredential } from "./device-auth.js";
+/**
+ * 会话内公告轮询(审计 F14):启动横幅只渲染一次公告,维护窗口里挂着
+ * 会话的用户只会撞裸错误。这里每 5 分钟带凭证拉一次模型列表(与启动同一
+ * 接口,公告随响应捎回,服务端零新增开销),公告发生变化时推进会话。
+ *
+ * 首次成功拉取只做基线、不打扰——启动横幅已经展示过当前公告;之后
+ * 「出现新公告」或「公告内容变化」才触发 onNew。公告被清空不提示。
+ */
+export const ANNOUNCEMENT_POLL_INTERVAL_MS = 5 * 60_000;
+export function announcementKey(a) {
+    return a?.text ? `${a.text}\u0000${a.url ?? ""}` : "";
+}
+/** 基线跟踪器:observe 返回「需要通知的新公告」,否则 undefined。 */
+export function createAnnouncementTracker() {
+    let baseline;
+    return {
+        observe(a) {
+            const key = announcementKey(a);
+            if (baseline === undefined) {
+                baseline = key;
+                return undefined;
+            }
+            const changed = key !== "" && key !== baseline;
+            baseline = key;
+            return changed ? a : undefined;
+        },
+    };
+}
+export function startAnnouncementPoll(deps) {
+    const doFetch = deps.fetch ?? (async () => {
+        const cfg = loadConfig();
+        if (!hasDeviceCredential(cfg))
+            throw new Error("not logged in");
+        // 轻量公告接口,不再每 5 分钟拉整份模型目录(鉴权 + 主库写 + 目录构建)
+        return fetchLatestAnnouncement(cfg);
+    });
+    const tracker = createAnnouncementTracker();
+    const tick = async () => {
+        let announcement;
+        try {
+            announcement = (await doFetch()).announcement;
+        }
+        catch {
+            return; // 网络抖动/未登录:静默,下一轮再试
+        }
+        const fresh = tracker.observe(announcement ?? null);
+        if (fresh)
+            deps.onNew(fresh);
+    };
+    void tick(); // 立刻建基线,避免把启动前就存在的公告当成"新公告"
+    const timer = setInterval(() => {
+        void tick();
+    }, deps.intervalMs ?? ANNOUNCEMENT_POLL_INTERVAL_MS);
+    timer.unref?.();
+    return () => clearInterval(timer);
+}

package/dist/api.d.ts

@@ -1,4 +1,4 @@
-import { type ApiThinkingCapabilities, type CliConfig } from "./config.js";
+import { type ApiModel, type CliConfig } from "./config.js";
 /** Preserve caller cancellation while always enforcing the operation deadline. */
 export declare function signalWithTimeout(signal: AbortSignal | undefined, timeoutMs: number): AbortSignal;
 /** Read a complete response without allowing a custom or faulty server to exhaust CLI memory. */
@@ -37,22 +37,7 @@ export interface MePackage {
     expires_at: string | null;
     note: string | null;
 }
-export interface ApiModel {
-    id: string;
-    name: string;
-    reasoning: boolean;
-    /** Older gateways omit model-specific thinking metadata. */
-    thinking?: ApiThinkingCapabilities | null;
-    /** Older gateways omit this field; missing means text-only. */
-    vision?: boolean;
-    context_length: number;
-    max_tokens: number;
-    price: {
-        input: number;
-        output: number;
-        cache_read: number | null;
-    };
-}
+export type { ApiModel };
 /** 启动横幅公告(后台「全局设置」下发);url 可选。老网关没有该字段,undefined = 不显示。 */
 export interface ApiAnnouncement {
     text: string;
@@ -79,6 +64,13 @@ export interface ModelsResponse {
 export declare class AuthError extends Error {
 }
 export declare function fetchModels(cfg: CliConfig): Promise<ModelsResponse>;
+/**
+ * 会话内公告轮询用的轻量接口:免鉴权、服务端有缓存,回的就是 /v1/models 里的 announcement
+ * 字段。老网关没有这个路由(404)时回退整份 /v1/models。
+ */
+export declare function fetchLatestAnnouncement(cfg: CliConfig): Promise<{
+    announcement?: ApiAnnouncement | null;
+}>;
 export interface ApiEndpoint {
     id: string;
     name: string;

package/dist/api.js

@@ -91,6 +91,31 @@ export async function fetchModels(cfg) {
         clientAttestationExpiresInSeconds: typeof expiresIn === "number" && Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn : undefined,
     };
 }
+/**
+ * 会话内公告轮询用的轻量接口:免鉴权、服务端有缓存,回的就是 /v1/models 里的 announcement
+ * 字段。老网关没有这个路由(404)时回退整份 /v1/models。
+ */
+export async function fetchLatestAnnouncement(cfg) {
+    let resp;
+    try {
+        resp = await fetch(new URL("/public/announcements/latest", cfg.baseUrl), {
+            headers: { "x-u1s1-version": VERSION, Accept: "application/json" },
+            signal: AbortSignal.timeout(15_000),
+        });
+    }
+    catch {
+        throw new Error(`连不上 ${cfg.baseUrl}`);
+    }
+    if (resp.status === 404)
+        return fetchModels(cfg);
+    if (!resp.ok)
+        throw new Error(`服务端返回 ${resp.status}`);
+    const body = jsonRecord(await readJsonResponseCapped(resp));
+    const announcement = body?.announcement;
+    return {
+        announcement: announcement && typeof announcement === "object" ? announcement : null,
+    };
+}
 /**
  * 拉取用户在云端配置的自定义模型端点(dashboard「自定义模型端点」卡片)。
  * 老网关没有这个路由(GET 落到静态资产 404),调用方失败时回退本地缓存。

package/dist/config.d.ts

@@ -1,4 +1,4 @@
-import type { webcrypto } from "node:crypto";
+import { type webcrypto } from "node:crypto";
 export declare const VERSION: string;
 /**
  * 便携包安装(install.sh / install.ps1):包根旁边带自己的 node 运行时,
@@ -48,6 +48,14 @@ export interface ApiModel {
  * Aliases are derived from the short id; note is left empty (filled by /model command).
  */
 export declare function apiModelToDef(m: ApiModel): ModelDef;
+export interface ModelCost {
+    input: number;
+    output: number;
+    cacheRead: number;
+    cacheWrite: number;
+}
+/** pi 的 Model 类型要求 cost 非空;价格未知时按 0 交给 pi(与自有端点同一约定)。 */
+export declare const UNKNOWN_MODEL_COST: ModelCost;
 export interface ModelDef {
     id: string;
     name: string;
@@ -59,13 +67,11 @@ export interface ModelDef {
     vision: boolean;
     contextWindow: number;
     maxTokens: number;
-    /** USD per million tokens — display/estimation only; billing is server-side */
-    cost: {
-        input: number;
-        output: number;
-        cacheRead: number;
-        cacheWrite: number;
-    };
+    /**
+     * USD per million tokens — display/estimation only; billing is server-side.
+     * null = 价格未知(内置兜底目录不再硬编码价格,权威在网关 D1;09-01 评审 D5 拍板删)。
+     */
+    cost: ModelCost | null;
     /** 网关下发的免费用量包覆盖标记;老网关缺失时为 undefined(不派生 note)。 */
     freeEligible?: boolean;
     note: string;
@@ -159,6 +165,11 @@ export declare function writeAgentDefaultModel(provider: string, modelId: string
  */
 export declare function resolvePreferredModel(cfg: Pick<CliConfig, "model" | "modelProvider">): ModelRef;
 export declare function loadConfig(): CliConfig;
+/**
+ * 凭据文件落盘:先以 0600 写临时文件再 rename 覆盖,文件从不以默认权限
+ * (umask 下常是 0644)存在过哪怕一瞬;rename 在 POSIX 上原子替换。
+ */
+export declare function writePrivateFile(path: string, content: string): void;
 export declare function saveConfig(cfg: CliConfig): void;
 /** Persist the user's preferred model to both stores. */
 export declare function persistPreferredModel(cfg: CliConfig, provider: string, modelId: string): CliConfig;

package/dist/config.js

@@ -1,4 +1,5 @@
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { randomBytes } from "node:crypto";
 import { createRequire } from "node:module";
 import { homedir } from "node:os";
 import { basename, dirname, join } from "node:path";
@@ -80,6 +81,8 @@ export function apiModelToDef(m) {
         note: "",
     };
 }
+/** pi 的 Model 类型要求 cost 非空;价格未知时按 0 交给 pi(与自有端点同一约定)。 */
+export const UNKNOWN_MODEL_COST = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
 export const MODELS = [
     {
         id: "deepseek-v4-flash",
@@ -96,7 +99,7 @@ export const MODELS = [
         vision: false,
         contextWindow: 1_048_576,
         maxTokens: 384_000,
-        cost: { input: 0.14, output: 0.28, cacheRead: 0, cacheWrite: 0 },
+        cost: null,
         note: "默认 · 免费用量包额度内免费,日常写代码首选",
     },
     {
@@ -107,7 +110,7 @@ export const MODELS = [
         vision: false,
         contextWindow: 500_000,
         maxTokens: 65_536,
-        cost: { input: 2, output: 6, cacheRead: 0, cacheWrite: 0 },
+        cost: null,
         note: "更强 · 但烧额度快约 20 倍,难题再用",
     },
 ];
@@ -120,8 +123,8 @@ function deriveModelNote(m, base) {
     if (m.freeEligible === true)
         return "免费用量包可抵扣";
     if (m.freeEligible === false) {
-        const blended = (m.cost.input + m.cost.output) / 2;
-        const baseBlended = base ? (base.cost.input + base.cost.output) / 2 : 0;
+        const blended = m.cost ? (m.cost.input + m.cost.output) / 2 : 0;
+        const baseBlended = base?.cost ? (base.cost.input + base.cost.output) / 2 : 0;
         const mult = baseBlended > 0 ? Math.round(blended / baseBlended) : 0;
         return mult >= 2
             ? `不走免费包 · 费用约为默认模型 ${mult} 倍`
@@ -295,10 +298,24 @@ export function loadConfig() {
         modelProvider: typeof file.modelProvider === "string" ? file.modelProvider : undefined,
     };
 }
+/**
+ * 凭据文件落盘:先以 0600 写临时文件再 rename 覆盖,文件从不以默认权限
+ * (umask 下常是 0644)存在过哪怕一瞬;rename 在 POSIX 上原子替换。
+ */
+export function writePrivateFile(path, content) {
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const tmp = `${path}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+    writeFileSync(tmp, content, { mode: 0o600 });
+    try {
+        renameSync(tmp, path);
+    }
+    catch (e) {
+        rmSync(tmp, { force: true });
+        throw e;
+    }
+}
 export function saveConfig(cfg) {
-    mkdirSync(u1s1Dir, { recursive: true, mode: 0o700 });
-    writeFileSync(configFile, JSON.stringify(cfg, null, 2) + "\n");
-    chmodSync(configFile, 0o600);
+    writePrivateFile(configFile, JSON.stringify(cfg, null, 2) + "\n");
 }
 /** Persist the user's preferred model to both stores. */
 export function persistPreferredModel(cfg, provider, modelId) {
@@ -310,9 +327,7 @@ export function persistPreferredModel(cfg, provider, modelId) {
 // ---- 端点本地缓存:离线/网关不可达时沿用上次拉到的配置(含密钥,0600)----
 const endpointsCacheFile = join(u1s1Dir, "endpoints.json");
 export function saveEndpointsCache(endpoints) {
-    mkdirSync(u1s1Dir, { recursive: true, mode: 0o700 });
-    writeFileSync(endpointsCacheFile, JSON.stringify(endpoints, null, 2) + "\n");
-    chmodSync(endpointsCacheFile, 0o600);
+    writePrivateFile(endpointsCacheFile, JSON.stringify(endpoints, null, 2) + "\n");
 }
 export function loadEndpointsCache() {
     const raw = readJsonFile(endpointsCacheFile);

package/dist/device-auth.d.ts

@@ -9,6 +9,14 @@ export declare function generateDeviceKeyPair(): Promise<{
 export declare function dpopHeaders(cfg: CliConfig, method: string, url: string): Promise<Record<string, string>>;
 /** Fetch a gateway route with a fresh proof; generic keys remain a read-only compatibility fallback. */
 export declare function authorizedFetch(cfg: CliConfig, input: string | URL, init?: RequestInit): Promise<Response>;
+/**
+ * Headers to replay on the loopback response. fetch() has already decoded the
+ * upstream body (gzip/br), so the upstream framing and content-encoding must
+ * not be forwarded: replaying `content-encoding` made the local SDK inflate
+ * plain JSON and surface every non-streaming error as `<status> terminated`
+ * (zlib "incorrect header check"), hiding the real message.
+ */
+export declare function forwardedResponseHeaders(upstream: Headers): Record<string, string>;
 /** Buffer a loopback request only up to the same JSON limit enforced by Gateway. */
 export declare function readSigningProxyRequestBody(request: IncomingMessage, maxBytes?: number): Promise<Buffer | undefined>;
 /**

package/dist/device-auth.js

@@ -80,6 +80,22 @@ export async function authorizedFetch(cfg, input, init = {}) {
     }
     return fetch(url, { ...init, headers });
 }
+/**
+ * Headers to replay on the loopback response. fetch() has already decoded the
+ * upstream body (gzip/br), so the upstream framing and content-encoding must
+ * not be forwarded: replaying `content-encoding` made the local SDK inflate
+ * plain JSON and surface every non-streaming error as `<status> terminated`
+ * (zlib "incorrect header check"), hiding the real message.
+ */
+export function forwardedResponseHeaders(upstream) {
+    const headers = {};
+    upstream.forEach((value, name) => {
+        if (!["content-length", "transfer-encoding", "connection", "content-encoding"].includes(name)) {
+            headers[name] = value;
+        }
+    });
+    return headers;
+}
 function requestHeaders(input) {
     const headers = new Headers();
     for (const [name, value] of Object.entries(input)) {
@@ -247,12 +263,7 @@ export async function ensureSigningProxy(cfg, fallbackClient = "terminal", attes
                     body,
                     signal: upstreamAbort.signal,
                 });
-                const headers = {};
-                upstream.headers.forEach((value, name) => {
-                    if (!["content-length", "transfer-encoding", "connection"].includes(name))
-                        headers[name] = value;
-                });
-                res.writeHead(upstream.status, headers);
+                res.writeHead(upstream.status, forwardedResponseHeaders(upstream.headers));
                 if (upstream.body) {
                     for await (const chunk of upstream.body)
                         res.write(chunk);

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { execSync, spawnSync } from "node:child_process";
 import { writeFileSync } from "node:fs";
-import { cleanupBrandThemes, endpointKeyEnv, endpointProviderEntry, ensureBrandPrompt, ensureDefaultSettings, ensureProviderModels, ensureWorkflowPromptTemplate, scrubForeignProviderEnv, toProviderModels, writeAttributionExtension, writeCompactUiExtension, writeErrorHumanizeExtension, writeWebToolsExtension, } from "./agent-setup.js";
+import { cleanupBrandThemes, endpointKeyEnv, endpointProviderEntry, ensureBrandPrompt, ensureDefaultSettings, ensureProviderModels, ensureWorkflowPromptTemplate, scrubForeignProviderEnv, toProviderModels, writeAnnouncementsExtension, writeAttributionExtension, writeCompactUiExtension, writeErrorHumanizeExtension, writeWebToolsExtension, } from "./agent-setup.js";
 import { Text } from "@earendil-works/pi-tui";
 import { printConsoleBanner } from "./brand.js";
 import { agentDir, apiModelToDef, CUSTOM_ENDPOINTS, isPortableInstall, loadConfig, MODELS, persistPreferredModel, PROVIDER_ID, readSettings, refValid, resolvePreferredModel, setModelsFromApi, VERSION, } from "./config.js";
@@ -11,6 +11,7 @@ import { ensureUsableShell } from "./shell-doctor.js";
 import { applyBrandUi, setAnnouncement, setUpdateNotice } from "./style.js";
 import { AuthError, fetchModels, loadCustomEndpoints, readJsonResponseCapped } from "./api.js";
 import { ensureSigningProxy } from "./device-auth.js";
+import { installChildEnvGuard } from "./secret-env.js";
 const PACKAGE_NAME = "u1s1-cli";
 /** 启动时检测到的可自动安装的新版;TUI 退出后才装(见 installPendingUpdate)。 */
 let pendingUpdate;
@@ -145,9 +146,18 @@ function ensureTmuxKeyboardProtocol() {
     runTmux(["bind-key", "-n", "S-Enter", "send-keys", "-l", "\x1b[13;2u"]);
     runTmux(["bind-key", "-n", "C-Enter", "send-keys", "-l", "\x1b[13;5u"]);
 }
+/** 取模型列表的请求发出后、发起 pi import 前的让路时间(见 runAgent 内注释)。 */
+const AGENT_IMPORT_DEFER_MS = 200;
 async function runAgent(cfg, args) {
     cleanupBrandThemes();
     ensureDefaultSettings();
+    // pi 在 import/初始化阶段可能读到的常量环境变量先设好(import 在下面网络请求
+    // 发出之后才发起);依赖网络结果的变量(签名代理地址/密钥、端点密钥)仍在进 pi
+    // 之前才设置——pi 只在调用时读它们。
+    process.env["PI_CODING_AGENT_DIR"] = agentDir;
+    process.env["U1S1_TOOLS_VIA_EXTENSION"] = "1";
+    // hide pi's own "Run pi update" banner; users should run `u1s1 update` instead
+    process.env["PI_SKIP_VERSION_CHECK"] = "1";
     // Windows shell 体检异步先行,与取模型列表/搜索工具下载并行;首启验活
     // (Defender 首扫 bash.exe 可达秒级)藏进网络等待,进 pi 前再 await
     const shellReady = ensureUsableShell();
@@ -163,9 +173,18 @@ async function runAgent(cfg, args) {
     // 老网关没有 /v1/image,image_gen 缺失时按关闭处理,不注册生图工具
     let imageGenEnabled = false;
     const endpointsReady = loadCustomEndpoints(cfg);
+    const modelsReady = fetchModels(cfg);
+    modelsReady.catch(() => { });
+    // pi 的模块图 import 要 300~800 ms,且 ESM 求值是同步的、会把事件循环卡住;
+    // 若在请求发出前就 import,请求要等它求值完才真正上线,重叠白做(实测总耗时不变)。
+    // 先让 DNS/TLS/写出在事件循环里推进一段,再发起 import,让它落在等服务端应答的空档里。
+    await new Promise((resolve) => setTimeout(resolve, AGENT_IMPORT_DEFER_MS));
+    const agentReady = import("@earendil-works/pi-coding-agent");
+    // 失败留到下面 await 时再抛;这里只是避免在等网络期间被当成未处理的 rejection。
+    agentReady.catch(() => { });
     let modelsResp;
     try {
-        modelsResp = await fetchModels(cfg);
+        modelsResp = await modelsReady;
     }
     catch (e) {
         if (e instanceof AuthError) {
@@ -223,22 +242,23 @@ async function runAgent(cfg, args) {
     writeCompactUiExtension();
     // 模型调用错误人话化（同样投影,Desktop App 共享）
     writeErrorHumanizeExtension();
+    // 会话内公告触达:5 分钟轮询,公告变化时推进会话(同样投影,Desktop 共享)
+    writeAnnouncementsExtension();
     // OpenRouter 应用归因：直连流量计入 u1s1 的公开排行
     writeAttributionExtension();
     ensureTmuxKeyboardProtocol();
-    // must be set before pi reads them (getAgentDir() reads at call time, env at import is fine too)
-    process.env["PI_CODING_AGENT_DIR"] = agentDir;
+    // must be set before pi reads them (getAgentDir() reads at call time);
+    // 常量部分已在 runAgent 开头、发起 import 之前设好
     process.env["U1S1_API_KEY"] = officialCfg.apiKey;
     process.env["U1S1_SIGNING_PROXY_URL"] = officialCfg.baseUrl;
-    process.env["U1S1_TOOLS_VIA_EXTENSION"] = "1";
     // 自定义端点的密钥走环境变量引用(models.json 里只有 $VAR,不落明文)
     Object.assign(process.env, endpointKeyEnv());
     // 剔掉环境里的其他厂商密钥,/model 只展示 u1s1 官方模型 + 自定义端点
     scrubForeignProviderEnv();
-    // hide pi's own "Run pi update" banner; users should run `u1s1 update` instead
-    process.env["PI_SKIP_VERSION_CHECK"] = "1";
+    // 密钥只留在本进程:模型跑的 shell 命令、子 agent、扩展派生的任何子进程都拿不到
+    installChildEnvGuard();
     await searchToolsReady;
-    const { CustomEditor, main } = await import("@earendil-works/pi-coding-agent");
+    const { CustomEditor, main } = await agentReady;
     // 网页终端(如 Taikula)把 Shift+Enter 发成 ESC+CR(\x1b\r)。pi 在没开 Kitty
     // 协议时把它当成 Alt+Enter:空闲就直接发送,忙碌才排队。先改成 CSI-u 的
     // Shift+Enter,输入框就会换行,真·Alt+Enter(\x1b[13;3u)不受影响。
@@ -345,16 +365,17 @@ async function runAgent(cfg, args) {
                         });
                     },
                 });
+                // 进程内注册直接给字面量密钥:不经 $VAR 环境变量引用,也不落文件
                 pi.registerProvider(PROVIDER_ID, {
                     name: "u1s1",
                     baseUrl: officialCfg.baseUrl,
                     api: "openai-completions",
-                    apiKey: "$U1S1_API_KEY",
+                    apiKey: officialCfg.apiKey,
                     models: toProviderModels(MODELS),
                 });
                 // 用户在云端配置的自定义端点,一个端点一个 provider,/model 里即可切换
                 for (const ep of CUSTOM_ENDPOINTS) {
-                    pi.registerProvider(ep.id, endpointProviderEntry(ep));
+                    pi.registerProvider(ep.id, endpointProviderEntry(ep, { literalKey: true }));
                 }
                 // /model and Ctrl+P already write pi settings; also keep ~/.u1s1/config.json in sync
                 pi.on("model_select", (event) => {

package/dist/model.js

@@ -32,12 +32,11 @@ export async function modelCommand(nameOrAlias) {
         for (const m of MODELS) {
             const mark = current.provider === PROVIDER_ID && m.id === current.id ? "●" : " ";
             console.log(`  ${mark} ${m.aliases[0].padEnd(10)} ${m.name}`);
-            if (m.note) {
-                console.log(`               ${m.note} · $${m.cost.input}/$${m.cost.output} 每百万 token`);
-            }
-            else {
-                console.log(`               $${m.cost.input}/$${m.cost.output} 每百万 token`);
-            }
+            // 价格来自网关目录;离线兜底目录不带价格,只列名字与提示
+            const price = m.cost ? `$${m.cost.input}/$${m.cost.output} 每百万 token` : "";
+            const detail = [m.note, price].filter(Boolean).join(" · ");
+            if (detail)
+                console.log(`               ${detail}`);
         }
         for (const ep of CUSTOM_ENDPOINTS) {
             console.log("");

package/dist/secret-env.d.ts

@@ -0,0 +1,14 @@
+export declare function isSecretEnvName(name: string): boolean;
+/** 返回去掉密钥变量的环境副本;传入对象本身不动。 */
+export declare function stripSecretEnv(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/**
+ * 把 child_process 各函数的实参改写成「env 已剥离密钥」的版本:已有 options
+ * 就替换其 env(缺省 env 视为 process.env);没有 options 就在 args 数组之后、
+ * 回调之前插一个。签名族:fn(cmd[, args][, options][, callback])。
+ */
+export declare function withStrippedEnvArgs(args: unknown[]): unknown[];
+/**
+ * 给 node:child_process 装上密钥剥离守卫(幂等)。ESM 的具名导入是活绑定,
+ * syncBuiltinESMExports 之后 `import { spawn } from "child_process"` 也拿到守卫版。
+ */
+export declare function installChildEnvGuard(): void;

package/dist/secret-env.js

@@ -0,0 +1,90 @@
+import childProcess from "node:child_process";
+import { syncBuiltinESMExports } from "node:module";
+import { promisify } from "node:util";
+/**
+ * 只该留在 u1s1 进程内的凭据类环境变量:官方 key(TUI 里是本地签名代理的
+ * 一次性 bearer)、云端自定义端点的第三方长期 key、设备令牌与设备私钥。
+ * pi 通过 models.json / auth.json 里的 `$VAR` 引用在每次请求时从 process.env
+ * 解析它们,所以进程内必须保留;但模型执行的任何 shell 命令都不该看见 ——
+ * prompt injection 跑一句 `env` 或项目 `postinstall` 就能把它们外传。
+ *
+ * 非密钥的 U1S1_* 配置(签名代理地址、工具开关、子 agent 标记、BASE_URL、
+ * CLIENT、MODELS_PATH、设备公钥)照常继承:脚本可能正当依赖它们,且单独
+ * 拿到也换不来任何权限(代理地址没有 bearer 打不通)。
+ */
+const SECRET_ENV_NAMES = new Set(["U1S1_API_KEY", "U1S1_DEVICE_TOKEN", "U1S1_DEVICE_PRIVATE_JWK"]);
+const SECRET_ENV_PREFIXES = ["U1S1_EP_KEY_"];
+export function isSecretEnvName(name) {
+    return SECRET_ENV_NAMES.has(name) || SECRET_ENV_PREFIXES.some((prefix) => name.startsWith(prefix));
+}
+/** 返回去掉密钥变量的环境副本;传入对象本身不动。 */
+export function stripSecretEnv(env = process.env) {
+    const out = {};
+    for (const [key, value] of Object.entries(env)) {
+        if (!isSecretEnvName(key))
+            out[key] = value;
+    }
+    return out;
+}
+const GUARDED_METHODS = ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync", "fork"];
+const GUARD_MARK = Symbol.for("u1s1.childEnvGuard");
+function isOptionsObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value) && !Buffer.isBuffer(value);
+}
+/**
+ * 把 child_process 各函数的实参改写成「env 已剥离密钥」的版本:已有 options
+ * 就替换其 env(缺省 env 视为 process.env);没有 options 就在 args 数组之后、
+ * 回调之前插一个。签名族:fn(cmd[, args][, options][, callback])。
+ */
+export function withStrippedEnvArgs(args) {
+    const next = [...args];
+    for (let i = 1; i < next.length; i++) {
+        const candidate = next[i];
+        if (!isOptionsObject(candidate))
+            continue;
+        const env = candidate["env"];
+        next[i] = { ...candidate, env: stripSecretEnv(isOptionsObject(env) ? env : process.env) };
+        return next;
+    }
+    const at = Array.isArray(next[1]) ? 2 : 1;
+    next.splice(at, 0, { env: stripSecretEnv() });
+    return next;
+}
+function isGuarded(fn) {
+    return fn[GUARD_MARK] === true;
+}
+/** exec/execFile 的 util.promisify 定制:必须经过守卫版本,否则 promisify 会绕回原函数。 */
+function promisifiedThrough(fn) {
+    return (...args) => new Promise((resolve, reject) => {
+        fn(...args, (error, stdout, stderr) => {
+            if (error) {
+                error.stdout = stdout;
+                error.stderr = stderr;
+                reject(error);
+                return;
+            }
+            resolve({ stdout, stderr });
+        });
+    });
+}
+/**
+ * 给 node:child_process 装上密钥剥离守卫(幂等)。ESM 的具名导入是活绑定,
+ * syncBuiltinESMExports 之后 `import { spawn } from "child_process"` 也拿到守卫版。
+ */
+export function installChildEnvGuard() {
+    const cp = childProcess;
+    for (const name of GUARDED_METHODS) {
+        const original = cp[name];
+        if (!original || isGuarded(original))
+            continue;
+        const guarded = function (...args) {
+            return original.apply(this, withStrippedEnvArgs(args));
+        };
+        Object.defineProperty(guarded, GUARD_MARK, { value: true });
+        if (name === "exec" || name === "execFile") {
+            Object.defineProperty(guarded, promisify.custom, { value: promisifiedThrough(guarded) });
+        }
+        cp[name] = guarded;
+    }
+    syncBuiltinESMExports();
+}

package/dist/subagent.d.ts

@@ -19,7 +19,23 @@ export interface SubagentOptions {
     noTools?: boolean;
     /** 子 agent 的工作目录(git worktree 隔离等场景);缺省继承主进程 cwd。 */
     cwd?: string;
+    /**
+     * 主会话对项目的信任裁决(ctx.isProjectTrusted());缺省按 trust.json 非交互
+     * 裁决。子 agent 绝不能默认可信:主会话拒绝过的 .pi/extensions 不能被绕过。
+     */
+    projectTrusted?: boolean;
+    /** 信任裁决依据的目录(worktree 隔离时是源仓库,不是临时工作树);缺省 cwd。 */
+    trustCwd?: string;
 }
+/** 工具 execute 的 ctx 里的信任裁决;老版 pi 没这个方法时返回 undefined 走存档兜底。 */
+export declare function contextProjectTrust(ctx: {
+    isProjectTrusted?: () => boolean;
+} | undefined): boolean | undefined;
+/**
+ * 与 pi 主会话同一口径的非交互裁决:没有需要信任门的项目资源(.pi/extensions、
+ * .agents/skills 等)即视为可信;有则只认 trust.json 里的明确「信任」,从不弹窗。
+ */
+export declare function resolveStoredProjectTrust(cwd: string, agentDir?: string): boolean;
 /** 单个子 agent 的 token/费用用量(汇总自会话内全部 assistant 消息)。 */
 export interface SubagentUsage {
     totalTokens: number;

package/dist/subagent.js

@@ -1,4 +1,4 @@
-import { createAgentSession, DefaultResourceLoader, getAgentDir, ModelRuntime, SessionManager, } from "@earendil-works/pi-coding-agent";
+import { createAgentSession, DefaultResourceLoader, getAgentDir, hasTrustRequiringProjectResources, ModelRuntime, ProjectTrustStore, SessionManager, SettingsManager, } from "@earendil-works/pi-coding-agent";
 // ---- 子 agent spawn 基础设施:spawn_subagent 工具与 workflow runner 共用 ----
 /** 同时在跑的子 agent 上限;超额排队,防止打爆网关。 */
 export const SUBAGENT_CONCURRENCY = 4;
@@ -6,6 +6,19 @@ export const SUBAGENT_CONCURRENCY = 4;
 export const SUBAGENT_TIMEOUT_MS = 15 * 60_000;
 /** ModelRuntime 进程内只建一次(auth/models 解析有启动开销)。 */
 let sharedModelRuntime;
+/** 工具 execute 的 ctx 里的信任裁决;老版 pi 没这个方法时返回 undefined 走存档兜底。 */
+export function contextProjectTrust(ctx) {
+    return typeof ctx?.isProjectTrusted === "function" ? ctx.isProjectTrusted() : undefined;
+}
+/**
+ * 与 pi 主会话同一口径的非交互裁决:没有需要信任门的项目资源(.pi/extensions、
+ * .agents/skills 等)即视为可信;有则只认 trust.json 里的明确「信任」,从不弹窗。
+ */
+export function resolveStoredProjectTrust(cwd, agentDir = getAgentDir()) {
+    if (!hasTrustRequiringProjectResources(cwd))
+        return true;
+    return new ProjectTrustStore(agentDir).get(cwd) === true;
+}
 function cancelledError(signal) {
     return new Error("已取消", { cause: signal.reason });
 }
@@ -121,9 +134,15 @@ export async function runSubagent(opts) {
     }
     // 子会话不加载精简 UI 扩展:它用 process.cwd() 重建内置工具,会破坏自定义
     // cwd(worktree 隔离)下的路径解析;且 UI 美化对无界面的子 agent 毫无意义
+    const cwd = opts.cwd ?? process.cwd();
+    const agentDir = getAgentDir();
+    // 项目信任跟随主会话:SettingsManager 缺省 projectTrusted=true,会把主会话
+    // 拒绝过的 .pi/extensions 在子 agent 里悄悄加载执行
+    const projectTrusted = opts.projectTrusted ?? resolveStoredProjectTrust(opts.trustCwd ?? cwd, agentDir);
     const loader = new DefaultResourceLoader({
-        agentDir: getAgentDir(),
-        cwd: opts.cwd ?? process.cwd(),
+        agentDir,
+        cwd,
+        settingsManager: SettingsManager.create(cwd, agentDir, { projectTrusted }),
         extensionsOverride: (base) => ({
             ...base,
             extensions: base.extensions.filter((e) => !JSON.stringify(e).includes("u1s1-compact-ui")),

package/dist/tools.js

@@ -1,7 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { dirname, extname, resolve } from "node:path";
 import { defineTool } from "@earendil-works/pi-coding-agent";
-import { runPool, runSubagent, SUBAGENT_CONCURRENCY, SUBAGENT_TIMEOUT_MS } from "./subagent.js";
+import { contextProjectTrust, runPool, runSubagent, SUBAGENT_CONCURRENCY, SUBAGENT_TIMEOUT_MS, } from "./subagent.js";
 import { Text } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
 import { generateImage, renderPage, searchWeb } from "./api.js";
@@ -204,7 +204,9 @@ export function createSubagentTool(getParentModel) {
                 : "🤖 子任务";
             return compactResultRender({ result, options, theme, context, summaryLine: summary });
         },
-        async execute(_toolCallId, params, signal) {
+        async execute(_toolCallId, params, signal, _onUpdate, ctx) {
+            // 子 agent 沿用主会话的项目信任裁决,不能默认可信
+            const projectTrusted = contextProjectTrust(ctx);
             const list = (params.tasks?.length ? params.tasks : params.task ? [params.task] : [])
                 .map((t) => t.trim())
                 .filter(Boolean)
@@ -224,7 +226,7 @@ export function createSubagentTool(getParentModel) {
                     items: list,
                     limit: SUBAGENT_CONCURRENCY,
                     run: async (task, i) => {
-                        outcomes[i] = await runSubagent({ task, parentModel, model: params.model, timeoutMs, signal }).catch((e) => ({ ok: false, text: e.message, usage: { totalTokens: 0, costUsd: 0 } }));
+                        outcomes[i] = await runSubagent({ task, parentModel, model: params.model, timeoutMs, signal, projectTrusted }).catch((e) => ({ ok: false, text: e.message, usage: { totalTokens: 0, costUsd: 0 } }));
                     },
                     signal,
                 });

package/dist/update.d.ts

@@ -5,4 +5,20 @@ export declare function detectPackageManager(): string;
 /** Fetch the latest published version from npm registry. */
 export declare function getLatestVersion(): Promise<string | undefined>;
 export declare function compareVersions(a: string, b: string): number;
+/** 从固定发布源拉一个文本文件:强制 https、拒绝重定向、限长。 */
+export declare function fetchReleaseText(name: string, maxBytes: number, timeoutMs?: number): Promise<string>;
+/** 在 sha256sum 格式的清单里找某个文件的哈希("<hex>  <name>" 或 "<hex> *<name>")。 */
+export declare function findPublishedSha256(sums: string, name: string): string | undefined;
+export type InstallScriptCheck = "verified" | "unlisted" | "mismatch";
+/** 拿发布清单核对脚本正文;清单没列脚本(旧版发布)返回 unlisted,由调用方决定是否放行。 */
+export declare function verifyInstallScript(script: string, sums: string, name?: string): InstallScriptCheck;
+/**
+ * 下载安装脚本并对照随发布上传的 SHA256SUMS。清单拉不到或哈希不符都拒绝执行;
+ * 清单里没有脚本条目只可能是旧版发布,放行但告知调用方(verified=false)。
+ * 这只是同源完整性校验(防边缘缓存残缺/单文件被换),不是代码签名。
+ */
+export declare function downloadInstallScript(): Promise<{
+    script: string;
+    verified: boolean;
+}>;
 export declare function update(): Promise<void>;

package/dist/update.js

@@ -1,4 +1,5 @@
 import { execFileSync, spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { tmpdir } from "node:os";
@@ -64,6 +65,52 @@ export function compareVersions(a, b) {
     }
     return 0;
 }
+/** 发布件只认这一个 https 源;任何跳转(哪怕同域)都视为异常,不跟。 */
+const RELEASE_ORIGIN = "https://u1s1.io";
+const INSTALL_SCRIPT_NAME = "install.sh";
+const MAX_SUMS_BYTES = 64 * 1024;
+/** 从固定发布源拉一个文本文件:强制 https、拒绝重定向、限长。 */
+export async function fetchReleaseText(name, maxBytes, timeoutMs = 30_000) {
+    const url = new URL(`/releases/${name}`, RELEASE_ORIGIN);
+    if (url.protocol !== "https:")
+        throw new Error(`拒绝非 https 发布源: ${url.href}`);
+    const res = await fetch(url, { redirect: "error", signal: AbortSignal.timeout(timeoutMs) });
+    if (!res.ok)
+        throw new Error(`${name}: HTTP ${res.status}`);
+    return readResponseTextCapped(res, maxBytes);
+}
+/** 在 sha256sum 格式的清单里找某个文件的哈希("<hex>  <name>" 或 "<hex> *<name>")。 */
+export function findPublishedSha256(sums, name) {
+    for (const line of sums.split("\n")) {
+        const m = /^([0-9a-fA-F]{64})\s+\*?(.+?)\s*$/.exec(line.trim());
+        if (m && m[2] === name)
+            return m[1].toLowerCase();
+    }
+    return undefined;
+}
+/** 拿发布清单核对脚本正文;清单没列脚本(旧版发布)返回 unlisted,由调用方决定是否放行。 */
+export function verifyInstallScript(script, sums, name = INSTALL_SCRIPT_NAME) {
+    const expected = findPublishedSha256(sums, name);
+    if (!expected)
+        return "unlisted";
+    const actual = createHash("sha256").update(script, "utf8").digest("hex");
+    return actual === expected ? "verified" : "mismatch";
+}
+/**
+ * 下载安装脚本并对照随发布上传的 SHA256SUMS。清单拉不到或哈希不符都拒绝执行;
+ * 清单里没有脚本条目只可能是旧版发布,放行但告知调用方(verified=false)。
+ * 这只是同源完整性校验(防边缘缓存残缺/单文件被换),不是代码签名。
+ */
+export async function downloadInstallScript() {
+    const [script, sums] = await Promise.all([
+        fetchReleaseText(INSTALL_SCRIPT_NAME, MAX_INSTALL_SCRIPT_BYTES),
+        fetchReleaseText("SHA256SUMS", MAX_SUMS_BYTES, 15_000),
+    ]);
+    const check = verifyInstallScript(script, sums);
+    if (check === "mismatch")
+        throw new Error("安装脚本与发布清单的 SHA256 不符,已拒绝执行");
+    return { script, verified: check === "verified" };
+}
 /**
  * 便携版原地升级:下载官网安装脚本并替用户执行,整包替换安装目录。
  *
@@ -102,15 +149,14 @@ async function portableSelfUpdate(latest) {
     console.log(`正在下载安装脚本并升级到 v${latest}…`);
     let script;
     try {
-        const res = await fetch("https://u1s1.io/releases/install.sh", {
-            signal: AbortSignal.timeout(30_000),
-        });
-        if (!res.ok)
-            throw new Error(`HTTP ${res.status}`);
-        script = await readResponseTextCapped(res, MAX_INSTALL_SCRIPT_BYTES);
+        const download = await downloadInstallScript();
+        script = download.script;
+        if (!download.verified) {
+            console.log("⚠ 发布清单里没有安装脚本的校验和(旧版发布),跳过脚本校验;安装包本身仍会校验。");
+        }
     }
-    catch {
-        console.error("安装脚本下载失败。请手动运行:");
+    catch (e) {
+        console.error(`安装脚本下载失败:${e.message}。请手动运行:`);
         console.error("  curl -fsSL https://u1s1.io/releases/install.sh | bash");
         process.exit(1);
     }

package/dist/workflow/runner.d.ts

@@ -49,6 +49,8 @@ export interface WorkflowRunOptions {
     progressPath: string;
     resume?: boolean;
     parentModel: ParentModelRef;
+    /** 主会话的项目信任裁决;子 agent 与临时 worktree 都沿用它,缺省按 trust.json 非交互裁决。 */
+    projectTrusted?: boolean;
     signal?: AbortSignal;
     timeoutMs?: number;
     /** 整个 run 的 token 上限;缺省 WORKFLOW_DEFAULT_BUDGET_TOKENS,<=0 不限。 */

package/dist/workflow/runner.js

@@ -180,6 +180,9 @@ export async function runWorkflow(opts) {
                 timeoutMs: PER_TASK_TIMEOUT_MS,
                 signal: internal.signal,
                 cwd: worktreeDir,
+                // 临时 worktree 永远不在 trust.json 里:信任裁决按源仓库(主进程 cwd)算
+                projectTrusted: opts.projectTrusted,
+                trustCwd: process.cwd(),
                 noTools: o.noTools === true,
             });
             stats.ok++;

package/dist/workflow/tool.d.ts

@@ -1,5 +1,5 @@
 import { Type } from "typebox";
-import type { ParentModelRef } from "../subagent.js";
+import { type ParentModelRef } from "../subagent.js";
 /**
  * run_workflow 工具:主 agent 把模型生成的编排脚本交给 WorkflowRunner 执行。
  * 脚本在 vm 沙箱里跑,只能用注入的 subagent/parallel/pipeline 原语。

package/dist/workflow/tool.js

@@ -3,6 +3,7 @@ import { dirname, resolve } from "node:path";
 import { defineTool } from "@earendil-works/pi-coding-agent";
 import { Text } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
+import { contextProjectTrust } from "../subagent.js";
 import { compactResultRender, truncate } from "../tools.js";
 import { runWorkflow, saveWorkflowScript, validateScript, workflowsDir, WORKFLOW_DEFAULT_BUDGET_TOKENS, WORKFLOW_TIMEOUT_MS, } from "./runner.js";
 import { buildFromTemplate, TEMPLATES } from "./templates.js";
@@ -131,7 +132,7 @@ export function createRunWorkflowTool(getParentModel) {
             return compactResultRender({ result, options, theme, context, summaryLine: summary });
         },
         async execute(...args) {
-            const [, params, signal, onUpdate] = args;
+            const [, params, signal, onUpdate, ctx] = args;
             const source = resolveWorkflowSource(params);
             const scriptPath = persistWorkflowSource(source);
             const progressPath = scriptPath.replace(/\.mjs$/, ".progress.jsonl");
@@ -159,6 +160,8 @@ export function createRunWorkflowTool(getParentModel) {
                 progressPath,
                 resume: params.resume === true,
                 parentModel: getParentModel(),
+                // 子 agent(含临时 worktree)沿用主会话的项目信任裁决
+                projectTrusted: contextProjectTrust(ctx),
                 signal,
                 timeoutMs: Math.min(180, params.timeout_minutes ?? WORKFLOW_TIMEOUT_MS / 60_000) * 60_000,
                 budgetTokens: params.budget_tokens,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "u1s1-cli",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "u1s1 — 有一说一,最省心的 AI 编程搭子。终端里用中文说需求,AI 帮你读文件、改代码、跑命令。",
   "type": "module",
   "bin": {