u1s1-cli 1.4.1 → 1.4.2

package/dist/agent-setup.d.ts

@@ -97,7 +97,9 @@ export declare function toProviderModels(models: ModelDef[]): {
  * 字面量 "local" —— pi 没有凭据会直接拒启("No API key found"),
  * 这是 pi 自带 llama provider 的同款兜底,本地服务会忽略 Authorization 头。
  */
-export declare function endpointProviderEntry(ep: CustomEndpoint): Record<string, unknown>;
+export declare function endpointProviderEntry(ep: CustomEndpoint, options?: {
+    literalKey?: boolean;
+}): Record<string, unknown>;
 /**
  * 生成 /workflow 提示词模板到 <agentDir>/prompts/workflow.md:引导主 agent
  * 拆解任务 → 生成沙箱脚本 → 调 run_workflow 执行。每次启动重写,便于随版迭代文案。

package/dist/agent-setup.js

@@ -224,8 +224,12 @@ export function writeWebToolsExtension(cfg, features) {
         `    const workflow = await import(${JSON.stringify(new URL("./workflow/tool.js", import.meta.url).href)});\n` +
         `    pi.registerTool(workflow.createRunWorkflowTool(getParentModel));\n` +
         `  }\n`;
+    // 密钥剥离守卫也从这里装:Desktop App 的 pi 跑在 pi-web-ui 子进程里,没有
+    // 启动器代码,只有扩展能替它把 U1S1_API_KEY / U1S1_EP_KEY_* 挡在子进程之外
+    const secretEnvUrl = new URL("./secret-env.js", import.meta.url).href;
     writeFileSync(join(dir, "u1s1-tools.js"), `// 由 u1s1 每次启动自动生成,请勿手改\n` +
         `export default async function (pi) {\n` +
+        `  (await import(${JSON.stringify(secretEnvUrl)})).installChildEnvGuard();\n` +
         `  if (process.env.U1S1_TOOLS_VIA_EXTENSION !== "1") return;\n` +
         `  const baseUrl = process.env.U1S1_SIGNING_PROXY_URL || ${JSON.stringify(cfg.baseUrl)};\n` +
         `  const tools = await import(${JSON.stringify(toolsUrl)});\n` +
@@ -413,8 +417,10 @@ export default async function (pi) {
   }
 
   const cwd = process.cwd();
+  // 模型跑的 shell 命令拿不到 U1S1_API_KEY / U1S1_EP_KEY_* 等密钥(进程级守卫之外的显式一层)
+  const { stripSecretEnv } = await import(${JSON.stringify(new URL("./secret-env.js", import.meta.url).href)});
   hideTool("read", createReadTool(cwd));
-  hideTool("bash", createBashTool(cwd));
+  hideTool("bash", createBashTool(cwd, { spawnHook: (spawnContext) => ({ ...spawnContext, env: stripSecretEnv(spawnContext.env) }) }));
   hideTool("edit", createEditTool(cwd));
   hideTool("write", createWriteTool(cwd));
   hideTool("grep", createGrepTool(cwd));
@@ -494,12 +500,14 @@ export function toProviderModels(models) {
  * 字面量 "local" —— pi 没有凭据会直接拒启("No API key found"),
  * 这是 pi 自带 llama provider 的同款兜底,本地服务会忽略 Authorization 头。
  */
-export function endpointProviderEntry(ep) {
+export function endpointProviderEntry(ep, options = {}) {
+    // 进程内 registerProvider 可以直接给字面量(不落文件);写 models.json 时仍走 $VAR 引用
+    const envRef = `$${endpointKeyEnvName(ep.id)}`;
     return {
         name: ep.name,
         baseUrl: ep.baseUrl,
         api: ep.api,
-        apiKey: ep.apiKey ? `$${endpointKeyEnvName(ep.id)}` : "local",
+        apiKey: ep.apiKey ? (options.literalKey ? ep.apiKey : envRef) : "local",
         models: toProviderModels(ep.models),
     };
 }

package/dist/announcements-poll.js

@@ -1,4 +1,4 @@
-import { fetchModels } from "./api.js";
+import { fetchLatestAnnouncement } from "./api.js";
 import { loadConfig } from "./config.js";
 import { hasDeviceCredential } from "./device-auth.js";
 /**
@@ -34,7 +34,8 @@ export function startAnnouncementPoll(deps) {
         const cfg = loadConfig();
         if (!hasDeviceCredential(cfg))
             throw new Error("not logged in");
-        return fetchModels(cfg);
+        // 轻量公告接口,不再每 5 分钟拉整份模型目录(鉴权 + 主库写 + 目录构建)
+        return fetchLatestAnnouncement(cfg);
     });
     const tracker = createAnnouncementTracker();
     const tick = async () => {

package/dist/api.d.ts

@@ -64,6 +64,13 @@ export interface ModelsResponse {
 export declare class AuthError extends Error {
 }
 export declare function fetchModels(cfg: CliConfig): Promise<ModelsResponse>;
+/**
+ * 会话内公告轮询用的轻量接口:免鉴权、服务端有缓存,回的就是 /v1/models 里的 announcement
+ * 字段。老网关没有这个路由(404)时回退整份 /v1/models。
+ */
+export declare function fetchLatestAnnouncement(cfg: CliConfig): Promise<{
+    announcement?: ApiAnnouncement | null;
+}>;
 export interface ApiEndpoint {
     id: string;
     name: string;

package/dist/api.js

@@ -91,6 +91,31 @@ export async function fetchModels(cfg) {
         clientAttestationExpiresInSeconds: typeof expiresIn === "number" && Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn : undefined,
     };
 }
+/**
+ * 会话内公告轮询用的轻量接口:免鉴权、服务端有缓存,回的就是 /v1/models 里的 announcement
+ * 字段。老网关没有这个路由(404)时回退整份 /v1/models。
+ */
+export async function fetchLatestAnnouncement(cfg) {
+    let resp;
+    try {
+        resp = await fetch(new URL("/public/announcements/latest", cfg.baseUrl), {
+            headers: { "x-u1s1-version": VERSION, Accept: "application/json" },
+            signal: AbortSignal.timeout(15_000),
+        });
+    }
+    catch {
+        throw new Error(`连不上 ${cfg.baseUrl}`);
+    }
+    if (resp.status === 404)
+        return fetchModels(cfg);
+    if (!resp.ok)
+        throw new Error(`服务端返回 ${resp.status}`);
+    const body = jsonRecord(await readJsonResponseCapped(resp));
+    const announcement = body?.announcement;
+    return {
+        announcement: announcement && typeof announcement === "object" ? announcement : null,
+    };
+}
 /**
  * 拉取用户在云端配置的自定义模型端点(dashboard「自定义模型端点」卡片)。
  * 老网关没有这个路由(GET 落到静态资产 404),调用方失败时回退本地缓存。

package/dist/config.d.ts

@@ -1,4 +1,4 @@
-import type { webcrypto } from "node:crypto";
+import { type webcrypto } from "node:crypto";
 export declare const VERSION: string;
 /**
  * 便携包安装(install.sh / install.ps1):包根旁边带自己的 node 运行时,
@@ -165,6 +165,11 @@ export declare function writeAgentDefaultModel(provider: string, modelId: string
  */
 export declare function resolvePreferredModel(cfg: Pick<CliConfig, "model" | "modelProvider">): ModelRef;
 export declare function loadConfig(): CliConfig;
+/**
+ * 凭据文件落盘:先以 0600 写临时文件再 rename 覆盖,文件从不以默认权限
+ * (umask 下常是 0644)存在过哪怕一瞬;rename 在 POSIX 上原子替换。
+ */
+export declare function writePrivateFile(path: string, content: string): void;
 export declare function saveConfig(cfg: CliConfig): void;
 /** Persist the user's preferred model to both stores. */
 export declare function persistPreferredModel(cfg: CliConfig, provider: string, modelId: string): CliConfig;

package/dist/config.js

@@ -1,4 +1,5 @@
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { randomBytes } from "node:crypto";
 import { createRequire } from "node:module";
 import { homedir } from "node:os";
 import { basename, dirname, join } from "node:path";
@@ -297,10 +298,24 @@ export function loadConfig() {
         modelProvider: typeof file.modelProvider === "string" ? file.modelProvider : undefined,
     };
 }
+/**
+ * 凭据文件落盘:先以 0600 写临时文件再 rename 覆盖,文件从不以默认权限
+ * (umask 下常是 0644)存在过哪怕一瞬;rename 在 POSIX 上原子替换。
+ */
+export function writePrivateFile(path, content) {
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const tmp = `${path}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+    writeFileSync(tmp, content, { mode: 0o600 });
+    try {
+        renameSync(tmp, path);
+    }
+    catch (e) {
+        rmSync(tmp, { force: true });
+        throw e;
+    }
+}
 export function saveConfig(cfg) {
-    mkdirSync(u1s1Dir, { recursive: true, mode: 0o700 });
-    writeFileSync(configFile, JSON.stringify(cfg, null, 2) + "\n");
-    chmodSync(configFile, 0o600);
+    writePrivateFile(configFile, JSON.stringify(cfg, null, 2) + "\n");
 }
 /** Persist the user's preferred model to both stores. */
 export function persistPreferredModel(cfg, provider, modelId) {
@@ -312,9 +327,7 @@ export function persistPreferredModel(cfg, provider, modelId) {
 // ---- 端点本地缓存:离线/网关不可达时沿用上次拉到的配置(含密钥,0600)----
 const endpointsCacheFile = join(u1s1Dir, "endpoints.json");
 export function saveEndpointsCache(endpoints) {
-    mkdirSync(u1s1Dir, { recursive: true, mode: 0o700 });
-    writeFileSync(endpointsCacheFile, JSON.stringify(endpoints, null, 2) + "\n");
-    chmodSync(endpointsCacheFile, 0o600);
+    writePrivateFile(endpointsCacheFile, JSON.stringify(endpoints, null, 2) + "\n");
 }
 export function loadEndpointsCache() {
     const raw = readJsonFile(endpointsCacheFile);

package/dist/device-auth.d.ts

@@ -9,6 +9,14 @@ export declare function generateDeviceKeyPair(): Promise<{
 export declare function dpopHeaders(cfg: CliConfig, method: string, url: string): Promise<Record<string, string>>;
 /** Fetch a gateway route with a fresh proof; generic keys remain a read-only compatibility fallback. */
 export declare function authorizedFetch(cfg: CliConfig, input: string | URL, init?: RequestInit): Promise<Response>;
+/**
+ * Headers to replay on the loopback response. fetch() has already decoded the
+ * upstream body (gzip/br), so the upstream framing and content-encoding must
+ * not be forwarded: replaying `content-encoding` made the local SDK inflate
+ * plain JSON and surface every non-streaming error as `<status> terminated`
+ * (zlib "incorrect header check"), hiding the real message.
+ */
+export declare function forwardedResponseHeaders(upstream: Headers): Record<string, string>;
 /** Buffer a loopback request only up to the same JSON limit enforced by Gateway. */
 export declare function readSigningProxyRequestBody(request: IncomingMessage, maxBytes?: number): Promise<Buffer | undefined>;
 /**

package/dist/device-auth.js

@@ -80,6 +80,22 @@ export async function authorizedFetch(cfg, input, init = {}) {
     }
     return fetch(url, { ...init, headers });
 }
+/**
+ * Headers to replay on the loopback response. fetch() has already decoded the
+ * upstream body (gzip/br), so the upstream framing and content-encoding must
+ * not be forwarded: replaying `content-encoding` made the local SDK inflate
+ * plain JSON and surface every non-streaming error as `<status> terminated`
+ * (zlib "incorrect header check"), hiding the real message.
+ */
+export function forwardedResponseHeaders(upstream) {
+    const headers = {};
+    upstream.forEach((value, name) => {
+        if (!["content-length", "transfer-encoding", "connection", "content-encoding"].includes(name)) {
+            headers[name] = value;
+        }
+    });
+    return headers;
+}
 function requestHeaders(input) {
     const headers = new Headers();
     for (const [name, value] of Object.entries(input)) {
@@ -247,12 +263,7 @@ export async function ensureSigningProxy(cfg, fallbackClient = "terminal", attes
                     body,
                     signal: upstreamAbort.signal,
                 });
-                const headers = {};
-                upstream.headers.forEach((value, name) => {
-                    if (!["content-length", "transfer-encoding", "connection"].includes(name))
-                        headers[name] = value;
-                });
-                res.writeHead(upstream.status, headers);
+                res.writeHead(upstream.status, forwardedResponseHeaders(upstream.headers));
                 if (upstream.body) {
                     for await (const chunk of upstream.body)
                         res.write(chunk);

package/dist/index.js

@@ -11,6 +11,7 @@ import { ensureUsableShell } from "./shell-doctor.js";
 import { applyBrandUi, setAnnouncement, setUpdateNotice } from "./style.js";
 import { AuthError, fetchModels, loadCustomEndpoints, readJsonResponseCapped } from "./api.js";
 import { ensureSigningProxy } from "./device-auth.js";
+import { installChildEnvGuard } from "./secret-env.js";
 const PACKAGE_NAME = "u1s1-cli";
 /** 启动时检测到的可自动安装的新版;TUI 退出后才装(见 installPendingUpdate)。 */
 let pendingUpdate;
@@ -145,9 +146,18 @@ function ensureTmuxKeyboardProtocol() {
     runTmux(["bind-key", "-n", "S-Enter", "send-keys", "-l", "\x1b[13;2u"]);
     runTmux(["bind-key", "-n", "C-Enter", "send-keys", "-l", "\x1b[13;5u"]);
 }
+/** 取模型列表的请求发出后、发起 pi import 前的让路时间(见 runAgent 内注释)。 */
+const AGENT_IMPORT_DEFER_MS = 200;
 async function runAgent(cfg, args) {
     cleanupBrandThemes();
     ensureDefaultSettings();
+    // pi 在 import/初始化阶段可能读到的常量环境变量先设好(import 在下面网络请求
+    // 发出之后才发起);依赖网络结果的变量(签名代理地址/密钥、端点密钥)仍在进 pi
+    // 之前才设置——pi 只在调用时读它们。
+    process.env["PI_CODING_AGENT_DIR"] = agentDir;
+    process.env["U1S1_TOOLS_VIA_EXTENSION"] = "1";
+    // hide pi's own "Run pi update" banner; users should run `u1s1 update` instead
+    process.env["PI_SKIP_VERSION_CHECK"] = "1";
     // Windows shell 体检异步先行,与取模型列表/搜索工具下载并行;首启验活
     // (Defender 首扫 bash.exe 可达秒级)藏进网络等待,进 pi 前再 await
     const shellReady = ensureUsableShell();
@@ -163,9 +173,18 @@ async function runAgent(cfg, args) {
     // 老网关没有 /v1/image,image_gen 缺失时按关闭处理,不注册生图工具
     let imageGenEnabled = false;
     const endpointsReady = loadCustomEndpoints(cfg);
+    const modelsReady = fetchModels(cfg);
+    modelsReady.catch(() => { });
+    // pi 的模块图 import 要 300~800 ms,且 ESM 求值是同步的、会把事件循环卡住;
+    // 若在请求发出前就 import,请求要等它求值完才真正上线,重叠白做(实测总耗时不变)。
+    // 先让 DNS/TLS/写出在事件循环里推进一段,再发起 import,让它落在等服务端应答的空档里。
+    await new Promise((resolve) => setTimeout(resolve, AGENT_IMPORT_DEFER_MS));
+    const agentReady = import("@earendil-works/pi-coding-agent");
+    // 失败留到下面 await 时再抛;这里只是避免在等网络期间被当成未处理的 rejection。
+    agentReady.catch(() => { });
     let modelsResp;
     try {
-        modelsResp = await fetchModels(cfg);
+        modelsResp = await modelsReady;
     }
     catch (e) {
         if (e instanceof AuthError) {
@@ -228,19 +247,18 @@ async function runAgent(cfg, args) {
     // OpenRouter 应用归因：直连流量计入 u1s1 的公开排行
     writeAttributionExtension();
     ensureTmuxKeyboardProtocol();
-    // must be set before pi reads them (getAgentDir() reads at call time, env at import is fine too)
-    process.env["PI_CODING_AGENT_DIR"] = agentDir;
+    // must be set before pi reads them (getAgentDir() reads at call time);
+    // 常量部分已在 runAgent 开头、发起 import 之前设好
     process.env["U1S1_API_KEY"] = officialCfg.apiKey;
     process.env["U1S1_SIGNING_PROXY_URL"] = officialCfg.baseUrl;
-    process.env["U1S1_TOOLS_VIA_EXTENSION"] = "1";
     // 自定义端点的密钥走环境变量引用(models.json 里只有 $VAR,不落明文)
     Object.assign(process.env, endpointKeyEnv());
     // 剔掉环境里的其他厂商密钥,/model 只展示 u1s1 官方模型 + 自定义端点
     scrubForeignProviderEnv();
-    // hide pi's own "Run pi update" banner; users should run `u1s1 update` instead
-    process.env["PI_SKIP_VERSION_CHECK"] = "1";
+    // 密钥只留在本进程:模型跑的 shell 命令、子 agent、扩展派生的任何子进程都拿不到
+    installChildEnvGuard();
     await searchToolsReady;
-    const { CustomEditor, main } = await import("@earendil-works/pi-coding-agent");
+    const { CustomEditor, main } = await agentReady;
     // 网页终端(如 Taikula)把 Shift+Enter 发成 ESC+CR(\x1b\r)。pi 在没开 Kitty
     // 协议时把它当成 Alt+Enter:空闲就直接发送,忙碌才排队。先改成 CSI-u 的
     // Shift+Enter,输入框就会换行,真·Alt+Enter(\x1b[13;3u)不受影响。
@@ -347,16 +365,17 @@ async function runAgent(cfg, args) {
                         });
                     },
                 });
+                // 进程内注册直接给字面量密钥:不经 $VAR 环境变量引用,也不落文件
                 pi.registerProvider(PROVIDER_ID, {
                     name: "u1s1",
                     baseUrl: officialCfg.baseUrl,
                     api: "openai-completions",
-                    apiKey: "$U1S1_API_KEY",
+                    apiKey: officialCfg.apiKey,
                     models: toProviderModels(MODELS),
                 });
                 // 用户在云端配置的自定义端点,一个端点一个 provider,/model 里即可切换
                 for (const ep of CUSTOM_ENDPOINTS) {
-                    pi.registerProvider(ep.id, endpointProviderEntry(ep));
+                    pi.registerProvider(ep.id, endpointProviderEntry(ep, { literalKey: true }));
                 }
                 // /model and Ctrl+P already write pi settings; also keep ~/.u1s1/config.json in sync
                 pi.on("model_select", (event) => {

package/dist/secret-env.d.ts

@@ -0,0 +1,14 @@
+export declare function isSecretEnvName(name: string): boolean;
+/** 返回去掉密钥变量的环境副本;传入对象本身不动。 */
+export declare function stripSecretEnv(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/**
+ * 把 child_process 各函数的实参改写成「env 已剥离密钥」的版本:已有 options
+ * 就替换其 env(缺省 env 视为 process.env);没有 options 就在 args 数组之后、
+ * 回调之前插一个。签名族:fn(cmd[, args][, options][, callback])。
+ */
+export declare function withStrippedEnvArgs(args: unknown[]): unknown[];
+/**
+ * 给 node:child_process 装上密钥剥离守卫(幂等)。ESM 的具名导入是活绑定,
+ * syncBuiltinESMExports 之后 `import { spawn } from "child_process"` 也拿到守卫版。
+ */
+export declare function installChildEnvGuard(): void;

package/dist/secret-env.js

@@ -0,0 +1,90 @@
+import childProcess from "node:child_process";
+import { syncBuiltinESMExports } from "node:module";
+import { promisify } from "node:util";
+/**
+ * 只该留在 u1s1 进程内的凭据类环境变量:官方 key(TUI 里是本地签名代理的
+ * 一次性 bearer)、云端自定义端点的第三方长期 key、设备令牌与设备私钥。
+ * pi 通过 models.json / auth.json 里的 `$VAR` 引用在每次请求时从 process.env
+ * 解析它们,所以进程内必须保留;但模型执行的任何 shell 命令都不该看见 ——
+ * prompt injection 跑一句 `env` 或项目 `postinstall` 就能把它们外传。
+ *
+ * 非密钥的 U1S1_* 配置(签名代理地址、工具开关、子 agent 标记、BASE_URL、
+ * CLIENT、MODELS_PATH、设备公钥)照常继承:脚本可能正当依赖它们,且单独
+ * 拿到也换不来任何权限(代理地址没有 bearer 打不通)。
+ */
+const SECRET_ENV_NAMES = new Set(["U1S1_API_KEY", "U1S1_DEVICE_TOKEN", "U1S1_DEVICE_PRIVATE_JWK"]);
+const SECRET_ENV_PREFIXES = ["U1S1_EP_KEY_"];
+export function isSecretEnvName(name) {
+    return SECRET_ENV_NAMES.has(name) || SECRET_ENV_PREFIXES.some((prefix) => name.startsWith(prefix));
+}
+/** 返回去掉密钥变量的环境副本;传入对象本身不动。 */
+export function stripSecretEnv(env = process.env) {
+    const out = {};
+    for (const [key, value] of Object.entries(env)) {
+        if (!isSecretEnvName(key))
+            out[key] = value;
+    }
+    return out;
+}
+const GUARDED_METHODS = ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync", "fork"];
+const GUARD_MARK = Symbol.for("u1s1.childEnvGuard");
+function isOptionsObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value) && !Buffer.isBuffer(value);
+}
+/**
+ * 把 child_process 各函数的实参改写成「env 已剥离密钥」的版本:已有 options
+ * 就替换其 env(缺省 env 视为 process.env);没有 options 就在 args 数组之后、
+ * 回调之前插一个。签名族:fn(cmd[, args][, options][, callback])。
+ */
+export function withStrippedEnvArgs(args) {
+    const next = [...args];
+    for (let i = 1; i < next.length; i++) {
+        const candidate = next[i];
+        if (!isOptionsObject(candidate))
+            continue;
+        const env = candidate["env"];
+        next[i] = { ...candidate, env: stripSecretEnv(isOptionsObject(env) ? env : process.env) };
+        return next;
+    }
+    const at = Array.isArray(next[1]) ? 2 : 1;
+    next.splice(at, 0, { env: stripSecretEnv() });
+    return next;
+}
+function isGuarded(fn) {
+    return fn[GUARD_MARK] === true;
+}
+/** exec/execFile 的 util.promisify 定制:必须经过守卫版本,否则 promisify 会绕回原函数。 */
+function promisifiedThrough(fn) {
+    return (...args) => new Promise((resolve, reject) => {
+        fn(...args, (error, stdout, stderr) => {
+            if (error) {
+                error.stdout = stdout;
+                error.stderr = stderr;
+                reject(error);
+                return;
+            }
+            resolve({ stdout, stderr });
+        });
+    });
+}
+/**
+ * 给 node:child_process 装上密钥剥离守卫(幂等)。ESM 的具名导入是活绑定,
+ * syncBuiltinESMExports 之后 `import { spawn } from "child_process"` 也拿到守卫版。
+ */
+export function installChildEnvGuard() {
+    const cp = childProcess;
+    for (const name of GUARDED_METHODS) {
+        const original = cp[name];
+        if (!original || isGuarded(original))
+            continue;
+        const guarded = function (...args) {
+            return original.apply(this, withStrippedEnvArgs(args));
+        };
+        Object.defineProperty(guarded, GUARD_MARK, { value: true });
+        if (name === "exec" || name === "execFile") {
+            Object.defineProperty(guarded, promisify.custom, { value: promisifiedThrough(guarded) });
+        }
+        cp[name] = guarded;
+    }
+    syncBuiltinESMExports();
+}

package/dist/subagent.d.ts

@@ -19,7 +19,23 @@ export interface SubagentOptions {
     noTools?: boolean;
     /** 子 agent 的工作目录(git worktree 隔离等场景);缺省继承主进程 cwd。 */
     cwd?: string;
+    /**
+     * 主会话对项目的信任裁决(ctx.isProjectTrusted());缺省按 trust.json 非交互
+     * 裁决。子 agent 绝不能默认可信:主会话拒绝过的 .pi/extensions 不能被绕过。
+     */
+    projectTrusted?: boolean;
+    /** 信任裁决依据的目录(worktree 隔离时是源仓库,不是临时工作树);缺省 cwd。 */
+    trustCwd?: string;
 }
+/** 工具 execute 的 ctx 里的信任裁决;老版 pi 没这个方法时返回 undefined 走存档兜底。 */
+export declare function contextProjectTrust(ctx: {
+    isProjectTrusted?: () => boolean;
+} | undefined): boolean | undefined;
+/**
+ * 与 pi 主会话同一口径的非交互裁决:没有需要信任门的项目资源(.pi/extensions、
+ * .agents/skills 等)即视为可信;有则只认 trust.json 里的明确「信任」,从不弹窗。
+ */
+export declare function resolveStoredProjectTrust(cwd: string, agentDir?: string): boolean;
 /** 单个子 agent 的 token/费用用量(汇总自会话内全部 assistant 消息)。 */
 export interface SubagentUsage {
     totalTokens: number;

package/dist/subagent.js

@@ -1,4 +1,4 @@
-import { createAgentSession, DefaultResourceLoader, getAgentDir, ModelRuntime, SessionManager, } from "@earendil-works/pi-coding-agent";
+import { createAgentSession, DefaultResourceLoader, getAgentDir, hasTrustRequiringProjectResources, ModelRuntime, ProjectTrustStore, SessionManager, SettingsManager, } from "@earendil-works/pi-coding-agent";
 // ---- 子 agent spawn 基础设施:spawn_subagent 工具与 workflow runner 共用 ----
 /** 同时在跑的子 agent 上限;超额排队,防止打爆网关。 */
 export const SUBAGENT_CONCURRENCY = 4;
@@ -6,6 +6,19 @@ export const SUBAGENT_CONCURRENCY = 4;
 export const SUBAGENT_TIMEOUT_MS = 15 * 60_000;
 /** ModelRuntime 进程内只建一次(auth/models 解析有启动开销)。 */
 let sharedModelRuntime;
+/** 工具 execute 的 ctx 里的信任裁决;老版 pi 没这个方法时返回 undefined 走存档兜底。 */
+export function contextProjectTrust(ctx) {
+    return typeof ctx?.isProjectTrusted === "function" ? ctx.isProjectTrusted() : undefined;
+}
+/**
+ * 与 pi 主会话同一口径的非交互裁决:没有需要信任门的项目资源(.pi/extensions、
+ * .agents/skills 等)即视为可信;有则只认 trust.json 里的明确「信任」,从不弹窗。
+ */
+export function resolveStoredProjectTrust(cwd, agentDir = getAgentDir()) {
+    if (!hasTrustRequiringProjectResources(cwd))
+        return true;
+    return new ProjectTrustStore(agentDir).get(cwd) === true;
+}
 function cancelledError(signal) {
     return new Error("已取消", { cause: signal.reason });
 }
@@ -121,9 +134,15 @@ export async function runSubagent(opts) {
     }
     // 子会话不加载精简 UI 扩展:它用 process.cwd() 重建内置工具,会破坏自定义
     // cwd(worktree 隔离)下的路径解析;且 UI 美化对无界面的子 agent 毫无意义
+    const cwd = opts.cwd ?? process.cwd();
+    const agentDir = getAgentDir();
+    // 项目信任跟随主会话:SettingsManager 缺省 projectTrusted=true,会把主会话
+    // 拒绝过的 .pi/extensions 在子 agent 里悄悄加载执行
+    const projectTrusted = opts.projectTrusted ?? resolveStoredProjectTrust(opts.trustCwd ?? cwd, agentDir);
     const loader = new DefaultResourceLoader({
-        agentDir: getAgentDir(),
-        cwd: opts.cwd ?? process.cwd(),
+        agentDir,
+        cwd,
+        settingsManager: SettingsManager.create(cwd, agentDir, { projectTrusted }),
         extensionsOverride: (base) => ({
             ...base,
             extensions: base.extensions.filter((e) => !JSON.stringify(e).includes("u1s1-compact-ui")),

package/dist/tools.js

@@ -1,7 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { dirname, extname, resolve } from "node:path";
 import { defineTool } from "@earendil-works/pi-coding-agent";
-import { runPool, runSubagent, SUBAGENT_CONCURRENCY, SUBAGENT_TIMEOUT_MS } from "./subagent.js";
+import { contextProjectTrust, runPool, runSubagent, SUBAGENT_CONCURRENCY, SUBAGENT_TIMEOUT_MS, } from "./subagent.js";
 import { Text } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
 import { generateImage, renderPage, searchWeb } from "./api.js";
@@ -204,7 +204,9 @@ export function createSubagentTool(getParentModel) {
                 : "🤖 子任务";
             return compactResultRender({ result, options, theme, context, summaryLine: summary });
         },
-        async execute(_toolCallId, params, signal) {
+        async execute(_toolCallId, params, signal, _onUpdate, ctx) {
+            // 子 agent 沿用主会话的项目信任裁决,不能默认可信
+            const projectTrusted = contextProjectTrust(ctx);
             const list = (params.tasks?.length ? params.tasks : params.task ? [params.task] : [])
                 .map((t) => t.trim())
                 .filter(Boolean)
@@ -224,7 +226,7 @@ export function createSubagentTool(getParentModel) {
                     items: list,
                     limit: SUBAGENT_CONCURRENCY,
                     run: async (task, i) => {
-                        outcomes[i] = await runSubagent({ task, parentModel, model: params.model, timeoutMs, signal }).catch((e) => ({ ok: false, text: e.message, usage: { totalTokens: 0, costUsd: 0 } }));
+                        outcomes[i] = await runSubagent({ task, parentModel, model: params.model, timeoutMs, signal, projectTrusted }).catch((e) => ({ ok: false, text: e.message, usage: { totalTokens: 0, costUsd: 0 } }));
                     },
                     signal,
                 });

package/dist/update.d.ts

@@ -5,4 +5,20 @@ export declare function detectPackageManager(): string;
 /** Fetch the latest published version from npm registry. */
 export declare function getLatestVersion(): Promise<string | undefined>;
 export declare function compareVersions(a: string, b: string): number;
+/** 从固定发布源拉一个文本文件:强制 https、拒绝重定向、限长。 */
+export declare function fetchReleaseText(name: string, maxBytes: number, timeoutMs?: number): Promise<string>;
+/** 在 sha256sum 格式的清单里找某个文件的哈希("<hex>  <name>" 或 "<hex> *<name>")。 */
+export declare function findPublishedSha256(sums: string, name: string): string | undefined;
+export type InstallScriptCheck = "verified" | "unlisted" | "mismatch";
+/** 拿发布清单核对脚本正文;清单没列脚本(旧版发布)返回 unlisted,由调用方决定是否放行。 */
+export declare function verifyInstallScript(script: string, sums: string, name?: string): InstallScriptCheck;
+/**
+ * 下载安装脚本并对照随发布上传的 SHA256SUMS。清单拉不到或哈希不符都拒绝执行;
+ * 清单里没有脚本条目只可能是旧版发布,放行但告知调用方(verified=false)。
+ * 这只是同源完整性校验(防边缘缓存残缺/单文件被换),不是代码签名。
+ */
+export declare function downloadInstallScript(): Promise<{
+    script: string;
+    verified: boolean;
+}>;
 export declare function update(): Promise<void>;

package/dist/update.js

@@ -1,4 +1,5 @@
 import { execFileSync, spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { tmpdir } from "node:os";
@@ -64,6 +65,52 @@ export function compareVersions(a, b) {
     }
     return 0;
 }
+/** 发布件只认这一个 https 源;任何跳转(哪怕同域)都视为异常,不跟。 */
+const RELEASE_ORIGIN = "https://u1s1.io";
+const INSTALL_SCRIPT_NAME = "install.sh";
+const MAX_SUMS_BYTES = 64 * 1024;
+/** 从固定发布源拉一个文本文件:强制 https、拒绝重定向、限长。 */
+export async function fetchReleaseText(name, maxBytes, timeoutMs = 30_000) {
+    const url = new URL(`/releases/${name}`, RELEASE_ORIGIN);
+    if (url.protocol !== "https:")
+        throw new Error(`拒绝非 https 发布源: ${url.href}`);
+    const res = await fetch(url, { redirect: "error", signal: AbortSignal.timeout(timeoutMs) });
+    if (!res.ok)
+        throw new Error(`${name}: HTTP ${res.status}`);
+    return readResponseTextCapped(res, maxBytes);
+}
+/** 在 sha256sum 格式的清单里找某个文件的哈希("<hex>  <name>" 或 "<hex> *<name>")。 */
+export function findPublishedSha256(sums, name) {
+    for (const line of sums.split("\n")) {
+        const m = /^([0-9a-fA-F]{64})\s+\*?(.+?)\s*$/.exec(line.trim());
+        if (m && m[2] === name)
+            return m[1].toLowerCase();
+    }
+    return undefined;
+}
+/** 拿发布清单核对脚本正文;清单没列脚本(旧版发布)返回 unlisted,由调用方决定是否放行。 */
+export function verifyInstallScript(script, sums, name = INSTALL_SCRIPT_NAME) {
+    const expected = findPublishedSha256(sums, name);
+    if (!expected)
+        return "unlisted";
+    const actual = createHash("sha256").update(script, "utf8").digest("hex");
+    return actual === expected ? "verified" : "mismatch";
+}
+/**
+ * 下载安装脚本并对照随发布上传的 SHA256SUMS。清单拉不到或哈希不符都拒绝执行;
+ * 清单里没有脚本条目只可能是旧版发布,放行但告知调用方(verified=false)。
+ * 这只是同源完整性校验(防边缘缓存残缺/单文件被换),不是代码签名。
+ */
+export async function downloadInstallScript() {
+    const [script, sums] = await Promise.all([
+        fetchReleaseText(INSTALL_SCRIPT_NAME, MAX_INSTALL_SCRIPT_BYTES),
+        fetchReleaseText("SHA256SUMS", MAX_SUMS_BYTES, 15_000),
+    ]);
+    const check = verifyInstallScript(script, sums);
+    if (check === "mismatch")
+        throw new Error("安装脚本与发布清单的 SHA256 不符,已拒绝执行");
+    return { script, verified: check === "verified" };
+}
 /**
  * 便携版原地升级:下载官网安装脚本并替用户执行,整包替换安装目录。
  *
@@ -102,15 +149,14 @@ async function portableSelfUpdate(latest) {
     console.log(`正在下载安装脚本并升级到 v${latest}…`);
     let script;
     try {
-        const res = await fetch("https://u1s1.io/releases/install.sh", {
-            signal: AbortSignal.timeout(30_000),
-        });
-        if (!res.ok)
-            throw new Error(`HTTP ${res.status}`);
-        script = await readResponseTextCapped(res, MAX_INSTALL_SCRIPT_BYTES);
+        const download = await downloadInstallScript();
+        script = download.script;
+        if (!download.verified) {
+            console.log("⚠ 发布清单里没有安装脚本的校验和(旧版发布),跳过脚本校验;安装包本身仍会校验。");
+        }
     }
-    catch {
-        console.error("安装脚本下载失败。请手动运行:");
+    catch (e) {
+        console.error(`安装脚本下载失败:${e.message}。请手动运行:`);
         console.error("  curl -fsSL https://u1s1.io/releases/install.sh | bash");
         process.exit(1);
     }

package/dist/workflow/runner.d.ts

@@ -49,6 +49,8 @@ export interface WorkflowRunOptions {
     progressPath: string;
     resume?: boolean;
     parentModel: ParentModelRef;
+    /** 主会话的项目信任裁决;子 agent 与临时 worktree 都沿用它,缺省按 trust.json 非交互裁决。 */
+    projectTrusted?: boolean;
     signal?: AbortSignal;
     timeoutMs?: number;
     /** 整个 run 的 token 上限;缺省 WORKFLOW_DEFAULT_BUDGET_TOKENS,<=0 不限。 */

package/dist/workflow/runner.js

@@ -180,6 +180,9 @@ export async function runWorkflow(opts) {
                 timeoutMs: PER_TASK_TIMEOUT_MS,
                 signal: internal.signal,
                 cwd: worktreeDir,
+                // 临时 worktree 永远不在 trust.json 里:信任裁决按源仓库(主进程 cwd)算
+                projectTrusted: opts.projectTrusted,
+                trustCwd: process.cwd(),
                 noTools: o.noTools === true,
             });
             stats.ok++;

package/dist/workflow/tool.d.ts

@@ -1,5 +1,5 @@
 import { Type } from "typebox";
-import type { ParentModelRef } from "../subagent.js";
+import { type ParentModelRef } from "../subagent.js";
 /**
  * run_workflow 工具:主 agent 把模型生成的编排脚本交给 WorkflowRunner 执行。
  * 脚本在 vm 沙箱里跑,只能用注入的 subagent/parallel/pipeline 原语。

package/dist/workflow/tool.js

@@ -3,6 +3,7 @@ import { dirname, resolve } from "node:path";
 import { defineTool } from "@earendil-works/pi-coding-agent";
 import { Text } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
+import { contextProjectTrust } from "../subagent.js";
 import { compactResultRender, truncate } from "../tools.js";
 import { runWorkflow, saveWorkflowScript, validateScript, workflowsDir, WORKFLOW_DEFAULT_BUDGET_TOKENS, WORKFLOW_TIMEOUT_MS, } from "./runner.js";
 import { buildFromTemplate, TEMPLATES } from "./templates.js";
@@ -131,7 +132,7 @@ export function createRunWorkflowTool(getParentModel) {
             return compactResultRender({ result, options, theme, context, summaryLine: summary });
         },
         async execute(...args) {
-            const [, params, signal, onUpdate] = args;
+            const [, params, signal, onUpdate, ctx] = args;
             const source = resolveWorkflowSource(params);
             const scriptPath = persistWorkflowSource(source);
             const progressPath = scriptPath.replace(/\.mjs$/, ".progress.jsonl");
@@ -159,6 +160,8 @@ export function createRunWorkflowTool(getParentModel) {
                 progressPath,
                 resume: params.resume === true,
                 parentModel: getParentModel(),
+                // 子 agent(含临时 worktree)沿用主会话的项目信任裁决
+                projectTrusted: contextProjectTrust(ctx),
                 signal,
                 timeoutMs: Math.min(180, params.timeout_minutes ?? WORKFLOW_TIMEOUT_MS / 60_000) * 60_000,
                 budgetTokens: params.budget_tokens,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "u1s1-cli",
-  "version": "1.4.1",
+  "version": "1.4.2",
   "description": "u1s1 — 有一说一,最省心的 AI 编程搭子。终端里用中文说需求,AI 帮你读文件、改代码、跑命令。",
   "type": "module",
   "bin": {