@ia-ccun/code-agent-cli 0.0.51-beta.2 → 0.0.51-beta.3

package/bin/cli.js

@@ -144,7 +144,7 @@ if (config.banner === '__default__' || config.banner !== '') {
 // 检查新版本
 async function checkForUpdates() {
   try {
-    const { execSync } = await import('child_process');
+    const { execFileSync } = await import('child_process');
     // 读取本地版本 - 向上查找 package.json
     let rootDir = __dirname;
     let localVersion = null;
@@ -158,9 +158,9 @@ async function checkForUpdates() {
     }
     if (!localVersion) return;
 
-    // 获取当前 registry
-    const registry = execSync('npm config get registry', { encoding: 'utf8', stdio: 'pipe' }).trim();
-    const latestVersion = execSync(`npm view @ia-ccun/code-agent-cli version --registry=${registry}`, { encoding: 'utf8', stdio: 'pipe' }).trim();
+    // 🔒 Security: Use execFileSync instead of execSync to prevent command injection
+    const registry = execFileSync('npm', ['config', 'get', 'registry'], { encoding: 'utf8', stdio: 'pipe' }).trim();
+    const latestVersion = execFileSync('npm', ['view', '@ia-ccun/code-agent-cli', 'version', '--registry=' + registry], { encoding: 'utf8', stdio: 'pipe' }).trim();
 
     // 比较版本号
     const localParts = localVersion.split('.').map(Number);
@@ -175,7 +175,8 @@ async function checkForUpdates() {
     try {
       const cacheDir = join(process.env.HOME || process.env.USERPROFILE, '.aicode-cli');
       if (!existsSync(cacheDir)) {
-        execSync(`mkdir -p "${cacheDir}"`, { stdio: 'pipe' });
+        // 🔒 Security: Use execFileSync for mkdir instead of execSync
+        execFileSync('mkdir', ['-p', cacheDir], { stdio: 'pipe' });
       }
       const cacheData = {
         localVersion,

package/config/agent/help.md

@@ -457,3 +457,5 @@ aicode-cli --verbose
 ---
 
 *世界那么哒 · AI 实践落地 @2026*
+
+**作者**: xujianjiang

package/dist/config-loader.d.ts

@@ -1,9 +1,11 @@
 /**
  * 配置加载器
+ * 🔒 Security: Validate path to prevent path traversal attacks
  */
 import type { AppConfig } from './config.js';
 /**
  * 获取配置目录
+ * 🔒 Security: Validate path to prevent path traversal attacks
  */
 export declare function getConfigDir(): string;
 /**

package/dist/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../src/config-loader.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAK7C;;GAEG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAgBrC;AAED;;GAEG;AACH,wBAAgB,UAAU,IAAI,SAAS,CAyBtC;AAED;;GAEG;AACH,wBAAgB,SAAS,IAAI,SAAS,CAErC"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../src/config-loader.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAM7C;;;GAGG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAuErC;AAED;;GAEG;AACH,wBAAgB,UAAU,IAAI,SAAS,CA8CtC;AAED;;GAEG;AACH,wBAAgB,SAAS,IAAI,SAAS,CAErC"}

package/dist/config-loader.js

@@ -1,26 +1,80 @@
 /**
  * 配置加载器
+ * 🔒 Security: Validate path to prevent path traversal attacks
  */
 import { homedir } from 'os';
-import { join } from 'path';
+import { join, normalize, resolve, isAbsolute } from 'path';
 import { existsSync, readFileSync } from 'fs';
 import { defaultConfig } from './config.js';
+import { logSecurity, logError, SecurityEventType, LogLevel } from './security-logger.js';
 let cachedConfig = null;
 /**
  * 获取配置目录
+ * 🔒 Security: Validate path to prevent path traversal attacks
  */
 export function getConfigDir() {
-    // 优先级: 环境变量 > 命令行参数(后续实现) > 默认值
+    // 优先级：环境变量 > 命令行参数 (后续实现) > 默认值
     const configDir = process.env.AICODE_CLI_CONFIG_DIR;
     if (configDir) {
+        let resolvedPath;
         // 展开环境变量中的路径
         if (configDir === "~") {
-            return homedir();
+            resolvedPath = homedir();
         }
-        if (configDir.startsWith("~/")) {
-            return join(homedir(), configDir.slice(2));
+        else if (configDir.startsWith("~/")) {
+            resolvedPath = join(homedir(), configDir.slice(2));
         }
-        return configDir;
+        else if (isAbsolute(configDir)) {
+            resolvedPath = configDir;
+        }
+        else {
+            // 相对路径：相对于当前工作目录
+            resolvedPath = resolve(configDir);
+        }
+        // 🔒 规范化路径（消除 .. 和 .）
+        const normalized = normalize(resolvedPath);
+        // 🔒 安全检查 1: 防止路径遍历
+        if (normalized.includes('..')) {
+            logSecurity(SecurityEventType.PATH_TRAVERSAL_BLOCKED, {
+                attemptedPath: configDir,
+                normalizedPath: normalized,
+                reason: 'Path contains ..',
+                action: 'Rejected and using default',
+            }, LogLevel.WARN);
+            console.warn('[安全警告] 配置路径包含 ..，使用默认值');
+            return join(homedir(), defaultConfig.configDir);
+        }
+        // 🔒 安全检查 2: 限制在家目录内（防止写入系统目录）
+        const homeDir = homedir();
+        if (!normalized.startsWith(homeDir)) {
+            logSecurity(SecurityEventType.PATH_VALIDATION, {
+                attemptedPath: configDir,
+                normalizedPath: normalized,
+                homeDir: homeDir,
+                reason: 'Path outside home directory',
+                action: 'Rejected and using default',
+            }, LogLevel.WARN);
+            console.warn(`[安全警告] 配置目录 (${normalized}) 在家目录外，使用默认值`);
+            return join(homedir(), defaultConfig.configDir);
+        }
+        // 🔒 安全检查 3: 确保是绝对路径
+        if (!isAbsolute(normalized)) {
+            logSecurity(SecurityEventType.PATH_VALIDATION, {
+                attemptedPath: configDir,
+                normalizedPath: normalized,
+                reason: 'Path is not absolute',
+                action: 'Rejected and using default',
+            }, LogLevel.WARN);
+            console.warn('[安全警告] 配置路径不是绝对路径，使用默认值');
+            return join(homedir(), defaultConfig.configDir);
+        }
+        // ✅ 路径验证通过
+        logSecurity(SecurityEventType.PATH_VALIDATION, {
+            attemptedPath: configDir,
+            normalizedPath: normalized,
+            action: 'Accepted',
+        });
+        return normalized;
     }
     return join(homedir(), defaultConfig.configDir);
 }
@@ -37,12 +91,32 @@ export function loadConfig() {
             const content = readFileSync(configPath, 'utf-8');
             const userConfig = JSON.parse(content);
             cachedConfig = { ...defaultConfig, ...userConfig };
+            // ✅ 记录配置加载成功
+            logSecurity(SecurityEventType.CONFIG_LOAD, {
+                path: configPath,
+                success: true,
+                hasUserConfig: true,
+            });
         }
-        catch {
+        catch (error) {
+            // ❌ 记录配置解析错误
+            logError('Failed to parse config.json', error, { path: configPath });
+            logSecurity(SecurityEventType.CONFIG_ERROR, {
+                path: configPath,
+                error: error.message,
+                action: 'Using default config',
+            }, LogLevel.WARN);
             cachedConfig = { ...defaultConfig };
         }
     }
     else {
+        // ⚠️ 记录配置文件不存在
+        logSecurity(SecurityEventType.CONFIG_LOAD, {
+            path: configPath,
+            success: true,
+            exists: false,
+            action: 'Using default config',
+        });
         cachedConfig = { ...defaultConfig };
     }
     // 设置环境变量，让 pi-coding-agent 使用我们的配置目录

package/dist/config-loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.js","sourceRoot":"","sources":["../src/config-loader.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAE9C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,IAAI,YAAY,GAAqB,IAAI,CAAC;AAE1C;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,gCAAgC;IAChC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAEpD,IAAI,SAAS,EAAE,CAAC;QACd,aAAa;QACb,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACtB,OAAO,OAAO,EAAE,CAAC;QACnB,CAAC;QACD,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU;IACxB,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,EAAE,aAAa,CAAC,CAAC;IAEvD,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAClD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvC,YAAY,GAAG,EAAE,GAAG,aAAa,EAAE,GAAG,UAAU,EAAE,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QACtC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,YAAY,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;IACtC,CAAC;IAED,qCAAqC;IACrC,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,2BAA2B,GAAG,QAAQ,CAAC;IAEnD,OAAO,YAAa,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS;IACvB,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC"}
+{"version":3,"file":"config-loader.js","sourceRoot":"","sources":["../src/config-loader.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAE9C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAE1F,IAAI,YAAY,GAAqB,IAAI,CAAC;AAE1C;;;GAGG;AACH,MAAM,UAAU,YAAY;IAC1B,gCAAgC;IAChC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAEpD,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,YAAoB,CAAC;QAEzB,aAAa;QACb,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACtB,YAAY,GAAG,OAAO,EAAE,CAAC;QAC3B,CAAC;aAAM,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC;aAAM,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,YAAY,GAAG,SAAS,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,iBAAiB;YACjB,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QAED,sBAAsB;QACtB,MAAM,UAAU,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;QAE3C,oBAAoB;QACpB,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,WAAW,CAAC,iBAAiB,CAAC,sBAAsB,EAAE;gBACpD,aAAa,EAAE,SAAS;gBACxB,cAAc,EAAE,UAAU;gBAC1B,MAAM,EAAE,kBAAkB;gBAC1B,MAAM,EAAE,4BAA4B;aACrC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;YACvC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;QAClD,CAAC;QAED,+BAA+B;QAC/B,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACpC,WAAW,CAAC,iBAAiB,CAAC,eAAe,EAAE;gBAC7C,aAAa,EAAE,SAAS;gBACxB,cAAc,EAAE,UAAU;gBAC1B,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,6BAA6B;gBACrC,MAAM,EAAE,4BAA4B;aACrC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,gBAAgB,UAAU,eAAe,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;QAClD,CAAC;QAED,qBAAqB;QACrB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,WAAW,CAAC,iBAAiB,CAAC,eAAe,EAAE;gBAC7C,aAAa,EAAE,SAAS;gBACxB,cAAc,EAAE,UAAU;gBAC1B,MAAM,EAAE,sBAAsB;gBAC9B,MAAM,EAAE,4BAA4B;aACrC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;YACxC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;QAClD,CAAC;QAED,WAAW;QACX,WAAW,CAAC,iBAAiB,CAAC,eAAe,EAAE;YAC7C,aAAa,EAAE,SAAS;YACxB,cAAc,EAAE,UAAU;YAC1B,MAAM,EAAE,UAAU;SACnB,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU;IACxB,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,EAAE,aAAa,CAAC,CAAC;IAEvD,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAClD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvC,YAAY,GAAG,EAAE,GAAG,aAAa,EAAE,GAAG,UAAU,EAAE,CAAC;YAEnD,aAAa;YACb,WAAW,CAAC,iBAAiB,CAAC,WAAW,EAAE;gBACzC,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,IAAI;gBACb,aAAa,EAAE,IAAI;aACpB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,aAAa;YACb,QAAQ,CAAC,6BAA6B,EAAE,KAAc,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC9E,WAAW,CAAC,iBAAiB,CAAC,YAAY,EAAE;gBAC1C,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAG,KAAe,CAAC,OAAO;gBAC/B,MAAM,EAAE,sBAAsB;aAC/B,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;YAClB,YAAY,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QACtC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,eAAe;QACf,WAAW,CAAC,iBAAiB,CAAC,WAAW,EAAE;YACzC,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,sBAAsB;SAC/B,CAAC,CAAC;QACH,YAAY,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;IACtC,CAAC;IAED,qCAAqC;IACrC,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,2BAA2B,GAAG,QAAQ,CAAC;IAEnD,OAAO,YAAa,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS;IACvB,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC"}

package/dist/security-logger.d.ts

@@ -0,0 +1,69 @@
+/**
+ * 安全日志模块
+ * 🔒 Security: Structured logging for security events
+ */
+/**
+ * 日志级别
+ */
+export declare enum LogLevel {
+    INFO = "info",
+    WARN = "warn",
+    ERROR = "error"
+}
+/**
+ * 安全事件类型
+ */
+export declare enum SecurityEventType {
+    CONFIG_LOAD = "config_load",
+    CONFIG_ERROR = "config_error",
+    PATH_VALIDATION = "path_validation",
+    PATH_TRAVERSAL_BLOCKED = "path_traversal_blocked",
+    FILE_MODIFIED = "file_modified",
+    FILE_ACCESS = "file_access",
+    DEPENDENCY_CHECK = "dependency_check",
+    VERSION_CHECK = "version_check",
+    INSTALL_START = "install_start",
+    INSTALL_COMPLETE = "install_complete",
+    SYMLINK_CREATE = "symlink_create",
+    SUSPICIOUS_ACTIVITY = "suspicious_activity"
+}
+/**
+ * 日志条目接口
+ */
+export interface LogEntry {
+    timestamp: string;
+    level: LogLevel;
+    event?: SecurityEventType;
+    message: string;
+    details?: Record<string, unknown>;
+    pid: number;
+    version?: string;
+}
+/**
+ * 记录安全事件
+ * @param event 事件类型
+ * @param details 事件详情
+ * @param level 日志级别（默认 info）
+ */
+export declare function logSecurity(event: SecurityEventType, details: Record<string, unknown>, level?: LogLevel): void;
+/**
+ * 记录错误
+ * @param message 错误消息
+ * @param error 错误对象
+ * @param context 上下文信息
+ */
+export declare function logError(message: string, error: Error, context?: Record<string, unknown>): void;
+/**
+ * 获取日志文件路径
+ */
+export declare function getLogPaths(): {
+    security: string;
+    error: string;
+    dir: string;
+};
+/**
+ * 清除旧日志（可选的维护功能）
+ * @param maxAge 最大保留天数（默认 30 天）
+ */
+export declare function rotateLogs(maxAge?: number): void;
+//# sourceMappingURL=security-logger.d.ts.map

package/dist/security-logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-logger.d.ts","sourceRoot":"","sources":["../src/security-logger.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH;;GAEG;AACH,oBAAY,QAAQ;IAClB,IAAI,SAAS;IACb,IAAI,SAAS;IACb,KAAK,UAAU;CAChB;AAED;;GAEG;AACH,oBAAY,iBAAiB;IAE3B,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAG7B,eAAe,oBAAoB;IACnC,sBAAsB,2BAA2B;IAGjD,aAAa,kBAAkB;IAC/B,WAAW,gBAAgB;IAG3B,gBAAgB,qBAAqB;IACrC,aAAa,kBAAkB;IAG/B,aAAa,kBAAkB;IAC/B,gBAAgB,qBAAqB;IACrC,cAAc,mBAAmB;IAGjC,mBAAmB,wBAAwB;CAC5C;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,QAAQ,CAAC;IAChB,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAyCD;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,iBAAiB,EACxB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,KAAK,GAAE,QAAwB,GAC9B,IAAI,CAmBN;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CACtB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,KAAK,EACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,IAAI,CAuBN;AAoBD;;GAEG;AACH,wBAAgB,WAAW,IAAI;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAM9E;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,MAAM,GAAE,MAAW,GAAG,IAAI,CAoBpD"}

package/dist/security-logger.js

@@ -0,0 +1,178 @@
+/**
+ * 安全日志模块
+ * 🔒 Security: Structured logging for security events
+ */
+import { createWriteStream, existsSync, mkdirSync, readdirSync, statSync, unlinkSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+// 日志目录和文件
+const LOG_DIR = join(homedir(), '.aicode-cli', 'logs');
+const SECURITY_LOG = join(LOG_DIR, 'security.log');
+const ERROR_LOG = join(LOG_DIR, 'error.log');
+/**
+ * 日志级别
+ */
+export var LogLevel;
+(function (LogLevel) {
+    LogLevel["INFO"] = "info";
+    LogLevel["WARN"] = "warn";
+    LogLevel["ERROR"] = "error";
+})(LogLevel || (LogLevel = {}));
+/**
+ * 安全事件类型
+ */
+export var SecurityEventType;
+(function (SecurityEventType) {
+    // 配置相关
+    SecurityEventType["CONFIG_LOAD"] = "config_load";
+    SecurityEventType["CONFIG_ERROR"] = "config_error";
+    // 路径验证
+    SecurityEventType["PATH_VALIDATION"] = "path_validation";
+    SecurityEventType["PATH_TRAVERSAL_BLOCKED"] = "path_traversal_blocked";
+    // 文件操作
+    SecurityEventType["FILE_MODIFIED"] = "file_modified";
+    SecurityEventType["FILE_ACCESS"] = "file_access";
+    // 依赖和更新
+    SecurityEventType["DEPENDENCY_CHECK"] = "dependency_check";
+    SecurityEventType["VERSION_CHECK"] = "version_check";
+    // 安装和设置
+    SecurityEventType["INSTALL_START"] = "install_start";
+    SecurityEventType["INSTALL_COMPLETE"] = "install_complete";
+    SecurityEventType["SYMLINK_CREATE"] = "symlink_create";
+    // 通用
+    SecurityEventType["SUSPICIOUS_ACTIVITY"] = "suspicious_activity";
+})(SecurityEventType || (SecurityEventType = {}));
+/**
+ * 日志流（懒加载）
+ */
+let securityLogStream = null;
+let errorLogStream = null;
+/**
+ * 初始化日志目录和流
+ */
+function initLogs() {
+    // 确保日志目录存在
+    if (!existsSync(LOG_DIR)) {
+        mkdirSync(LOG_DIR, { recursive: true, mode: 0o700 });
+    }
+    // 创建安全日志流（追加模式，仅所有者可读写）
+    if (!securityLogStream) {
+        securityLogStream = createWriteStream(SECURITY_LOG, {
+            flags: 'a',
+            mode: 0o600,
+        });
+    }
+    // 创建错误日志流
+    if (!errorLogStream) {
+        errorLogStream = createWriteStream(ERROR_LOG, {
+            flags: 'a',
+            mode: 0o600,
+        });
+    }
+}
+/**
+ * 格式化日志条目为 JSON
+ */
+function formatLog(entry) {
+    return JSON.stringify(entry) + '\n';
+}
+/**
+ * 记录安全事件
+ * @param event 事件类型
+ * @param details 事件详情
+ * @param level 日志级别（默认 info）
+ */
+export function logSecurity(event, details, level = LogLevel.INFO) {
+    initLogs();
+    const entry = {
+        timestamp: new Date().toISOString(),
+        level,
+        event,
+        message: `Security event: ${event}`,
+        details: sanitizeDetails(details),
+        pid: process.pid,
+        version: process.version,
+    };
+    securityLogStream?.write(formatLog(entry));
+    // 开发环境下输出到控制台
+    if (process.env.DEBUG || process.env.NODE_ENV === 'development') {
+        console.error(`[🔒 安全] ${event}:`, details);
+    }
+}
+/**
+ * 记录错误
+ * @param message 错误消息
+ * @param error 错误对象
+ * @param context 上下文信息
+ */
+export function logError(message, error, context) {
+    initLogs();
+    const entry = {
+        timestamp: new Date().toISOString(),
+        level: LogLevel.ERROR,
+        message,
+        details: {
+            name: error.name,
+            message: error.message,
+            stack: error.stack,
+            ...sanitizeDetails(context || {}),
+        },
+        pid: process.pid,
+        version: process.version,
+    };
+    errorLogStream?.write(formatLog(entry));
+    // 开发环境下输出到控制台
+    if (process.env.DEBUG || process.env.NODE_ENV === 'development') {
+        console.error(`[❌ 错误] ${message}:`, error);
+    }
+}
+/**
+ * 脱敏处理（移除敏感信息）
+ */
+function sanitizeDetails(details) {
+    const sensitiveKeys = ['apiKey', 'api_key', 'token', 'password', 'secret', 'auth'];
+    const sanitized = { ...details };
+    for (const key of sensitiveKeys) {
+        if (sanitized[key]) {
+            // 仅保留前 4 个字符用于识别
+            const value = String(sanitized[key]);
+            sanitized[key] = value.length > 8 ? value.substring(0, 4) + '***' : '***';
+        }
+    }
+    return sanitized;
+}
+/**
+ * 获取日志文件路径
+ */
+export function getLogPaths() {
+    return {
+        security: SECURITY_LOG,
+        error: ERROR_LOG,
+        dir: LOG_DIR,
+    };
+}
+/**
+ * 清除旧日志（可选的维护功能）
+ * @param maxAge 最大保留天数（默认 30 天）
+ */
+export function rotateLogs(maxAge = 30) {
+    const now = Date.now();
+    const maxAgeMs = maxAge * 24 * 60 * 60 * 1000;
+    try {
+        if (!existsSync(LOG_DIR))
+            return;
+        const files = readdirSync(LOG_DIR);
+        for (const file of files) {
+            const filePath = join(LOG_DIR, file);
+            const stats = statSync(filePath);
+            if (stats.isFile() && now - stats.mtimeMs > maxAgeMs) {
+                unlinkSync(filePath);
+                console.log(`[日志轮转] 已删除旧日志：${file}`);
+            }
+        }
+    }
+    catch (error) {
+        logError('日志轮转失败', error, { maxAge });
+    }
+}
+//# sourceMappingURL=security-logger.js.map

package/dist/security-logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-logger.js","sourceRoot":"","sources":["../src/security-logger.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AACjG,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAE7B,UAAU;AACV,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;AACvD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;AACnD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;AAE7C;;GAEG;AACH,MAAM,CAAN,IAAY,QAIX;AAJD,WAAY,QAAQ;IAClB,yBAAa,CAAA;IACb,yBAAa,CAAA;IACb,2BAAe,CAAA;AACjB,CAAC,EAJW,QAAQ,KAAR,QAAQ,QAInB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,iBAwBX;AAxBD,WAAY,iBAAiB;IAC3B,OAAO;IACP,gDAA2B,CAAA;IAC3B,kDAA6B,CAAA;IAE7B,OAAO;IACP,wDAAmC,CAAA;IACnC,sEAAiD,CAAA;IAEjD,OAAO;IACP,oDAA+B,CAAA;IAC/B,gDAA2B,CAAA;IAE3B,QAAQ;IACR,0DAAqC,CAAA;IACrC,oDAA+B,CAAA;IAE/B,QAAQ;IACR,oDAA+B,CAAA;IAC/B,0DAAqC,CAAA;IACrC,sDAAiC,CAAA;IAEjC,KAAK;IACL,gEAA2C,CAAA;AAC7C,CAAC,EAxBW,iBAAiB,KAAjB,iBAAiB,QAwB5B;AAeD;;GAEG;AACH,IAAI,iBAAiB,GAAgD,IAAI,CAAC;AAC1E,IAAI,cAAc,GAAgD,IAAI,CAAC;AAEvE;;GAEG;AACH,SAAS,QAAQ;IACf,WAAW;IACX,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,wBAAwB;IACxB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,iBAAiB,GAAG,iBAAiB,CAAC,YAAY,EAAE;YAClD,KAAK,EAAE,GAAG;YACV,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IAED,UAAU;IACV,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,cAAc,GAAG,iBAAiB,CAAC,SAAS,EAAE;YAC5C,KAAK,EAAE,GAAG;YACV,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,KAAe;IAChC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,KAAwB,EACxB,OAAgC,EAChC,QAAkB,QAAQ,CAAC,IAAI;IAE/B,QAAQ,EAAE,CAAC;IAEX,MAAM,KAAK,GAAa;QACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,KAAK;QACL,KAAK;QACL,OAAO,EAAE,mBAAmB,KAAK,EAAE;QACnC,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC;QACjC,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;IAEF,iBAAiB,EAAE,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAE3C,cAAc;IACd,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QAChE,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CACtB,OAAe,EACf,KAAY,EACZ,OAAiC;IAEjC,QAAQ,EAAE,CAAC;IAEX,MAAM,KAAK,GAAa;QACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,OAAO;QACP,OAAO,EAAE;YACP,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,eAAe,CAAC,OAAO,IAAI,EAAE,CAAC;SAClC;QACD,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;IAEF,cAAc,EAAE,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAExC,cAAc;IACd,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QAChE,OAAO,CAAC,KAAK,CAAC,UAAU,OAAO,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,OAAgC;IACvD,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACnF,MAAM,SAAS,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IAEjC,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,iBAAiB;YACjB,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YACrC,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO;QACL,QAAQ,EAAE,YAAY;QACtB,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE,OAAO;KACb,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,SAAiB,EAAE;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAE9C,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO;QAEjC,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAEjC,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,GAAG,QAAQ,EAAE,CAAC;gBACrD,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACrB,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,QAAQ,EAAE,KAAc,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACjD,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ia-ccun/code-agent-cli",
-  "version": "0.0.51-beta.2",
+  "version": "0.0.51-beta.3",
   "description": "AI Coding Agent CLI - 基于OpenClaw🦞底层Agent（pi）原理封装的编码智能体（供学习使用）。",
   "type": "module",
   "main": "./dist/index.js",
@@ -42,7 +42,16 @@
   },
   "overrides": {
     "glob": "^11.0.0",
-    "node-domexception": "^2.0.0"
+    "node-domexception": "^2.0.0",
+    "protobufjs": "^7.5.5",
+    "basic-ftp": "^6.0.1",
+    "flatted": "^3.4.2",
+    "undici": "^7.24.8",
+    "picomatch": "^4.0.4",
+    "brace-expansion": "^5.0.5",
+    "file-type": "^21.3.2",
+    "ip-address": "^10.1.1",
+    "yaml": "^2.8.3"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",

package/scripts/postinstall.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 // Post-install script for aicode-cli
-import { existsSync, mkdirSync, readFileSync, writeFileSync, copyFileSync, readdirSync, statSync } from 'fs';
-import { execSync } from 'child_process';
+import { existsSync, mkdirSync, readFileSync, writeFileSync, copyFileSync, readdirSync, statSync, createWriteStream } from 'fs';
+import { symlink as fsSymlink } from 'fs/promises';
 import { join, dirname, relative } from 'path';
 import { homedir } from 'os';
 import { fileURLToPath } from 'url';
@@ -11,8 +11,55 @@ import { fileURLToPath } from 'url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 
+// ============================================================================
+// Security Logger (inline for postinstall script)
+// ============================================================================
+const LOG_DIR = join(homedir(), '.aicode-cli', 'logs');
+const SECURITY_LOG = join(LOG_DIR, 'security.log');
+
+function ensureLogDir() {
+  if (!existsSync(LOG_DIR)) {
+    mkdirSync(LOG_DIR, { recursive: true, mode: 0o700 });
+  }
+}
+
+function logSecurity(event, details, level = 'info') {
+  ensureLogDir();
+  const entry = {
+    timestamp: new Date().toISOString(),
+    level,
+    event,
+    message: `PostInstall: ${event}`,
+    details,
+    pid: process.pid,
+  };
+  
+  try {
+    const stream = createWriteStream(SECURITY_LOG, { flags: 'a', mode: 0o600 });
+    stream.write(JSON.stringify(entry) + '\n');
+    stream.end();
+  } catch (e) {
+    // Ignore logging errors
+  }
+  
+  if (process.env.DEBUG) {
+    console.error(`[🔒 安全] ${event}:`, details);
+  }
+}
+
+// ============================================================================
+// Main Installation Logic
+// ============================================================================
+
 console.log('\n🚀 Setting up aicode-cli...');
 
+// Record installation start
+logSecurity('install_start', {
+  version: '0.0.51-beta.1',
+  homeDir: homedir(),
+  timestamp: new Date().toISOString(),
+});
+
 // Get the current user's home directory
 const homeDir = homedir();
 const aicodeCliDir = join(homeDir, '.aicode-cli');
@@ -33,8 +80,19 @@ if (existsSync(piAgentPackageJson)) {
     piPkg.piConfig.configDir = '.aicode-cli';
     writeFileSync(piAgentPackageJson, JSON.stringify(piPkg, null, 2) + '\n');
     console.log(`✓ Updated pi-coding-agent app name: ${oldName} -> aicode-cli`);
+    
+    logSecurity('file_modified', {
+      file: piAgentPackageJson,
+      action: 'Updated piConfig',
+      changes: ['name', 'configDir'],
+    });
   } catch (e) {
     console.log(`⚠ Could not update pi-coding-agent config: ${e.message}`);
+    logSecurity('file_modified', {
+      file: piAgentPackageJson,
+      action: 'Update failed',
+      error: e.message,
+    }, 'warn');
   }
 }
 
@@ -47,6 +105,11 @@ if (existsSync(piAgentCliJs)) {
       cliContent = cliContent.replace(/process\.title = "pi"/g, 'process.title = "aicode-cli"');
       writeFileSync(piAgentCliJs, cliContent);
       console.log(`✓ Updated pi-coding-agent process.title`);
+      
+      logSecurity('file_modified', {
+        file: piAgentCliJs,
+        action: 'Updated process.title',
+      });
     }
   } catch (e) {
     console.log(`⚠ Could not update pi-coding-agent cli.js: ${e.message}`);
@@ -62,6 +125,11 @@ if (existsSync(piAgentConfigJs)) {
       configContent = configContent.replace(/pkg\.piConfig\?\.name \|\| "pi"/g, 'pkg.piConfig?.name || "aicode-cli"');
       writeFileSync(piAgentConfigJs, configContent);
       console.log(`✓ Updated pi-coding-agent config.js APP_NAME`);
+      
+      logSecurity('file_modified', {
+        file: piAgentConfigJs,
+        action: 'Updated APP_NAME',
+      });
     }
   } catch (e) {
     console.log(`⚠ Could not update pi-coding-agent config.js: ${e.message}`);
@@ -77,6 +145,11 @@ if (existsSync(slashCommandsJs)) {
       content = content.replace(/Quit pi/g, 'Quit aicode-cli');
       writeFileSync(slashCommandsJs, content);
       console.log(`✓ Updated slash command description`);
+      
+      logSecurity('file_modified', {
+        file: slashCommandsJs,
+        action: 'Updated slash commands',
+      });
     }
   } catch (e) {
     console.log(`⚠ Could not update slash commands: ${e.message}`);
@@ -103,7 +176,6 @@ function copyDirRecursive(src, dest) {
   const isDirectory = exists && stats.isDirectory();
 
   if (isDirectory) {
-    // Create directory if it doesn't exist
     if (!existsSync(dest)) {
       mkdirSync(dest, { recursive: true });
     }
@@ -115,9 +187,7 @@ function copyDirRecursive(src, dest) {
       copyDirRecursive(srcPath, destPath);
     });
   } else {
-    // Only copy if source exists AND destination doesn't exist (preserve user files)
     if (exists && !existsSync(dest)) {
-      // Ensure parent directory exists
       const parentDir = dirname(dest);
       if (!existsSync(parentDir)) {
         mkdirSync(parentDir, { recursive: true });
@@ -172,19 +242,25 @@ const FORCE_OVERWRITE_LIST = [
   'dangerous-patterns.json',
   'settings.json',
   'help.md',
-  'extensions/working-msg.ts',
+  // Extensions - all files
+  'extensions/aicode-tips.ts',
+  'extensions/bash-check.ts',
+  'extensions/context-monitor.ts',
+  'extensions/context.ts',
   'extensions/custom-footer.ts',
   'extensions/custom.ts',
-  'extensions/bash-check.ts',
-  'extensions/aicode-tips.ts',
-  // Force overwrite all prompts .md files
+  'extensions/error-monitor.ts',
+  'extensions/msg-debug.ts',
+  'extensions/review.ts',
+  'extensions/working-msg.ts',
+  // Prompts
   'prompts/*.md',
-  // Force overwrite all skills SKILL.md files
+  // Skills
   'skills/*/SKILL.md',
-   'skills/*/*/SKILL.md',
+  'skills/*/*/SKILL.md',
 ];
 
-// Function to expand glob patterns like "skills/*/SKILL.md" or "prompts/*.md"
+// Function to expand glob patterns
 function expandGlob(pattern) {
   const results = [];
   
@@ -202,21 +278,17 @@ function expandGlob(pattern) {
         if (!existsSync(cp)) continue;
         
         if (hasWildcard) {
-          // Handle wildcard patterns like * or *.md
           const entries = readdirSync(cp);
-          // Convert glob pattern to regex: *.md -> ^.*\.md$
           const regex = new RegExp('^' + part.replace(/\*/g, '.*') + '$');
           
           for (const entry of entries) {
             if (regex.test(entry)) {
               const fullPath = join(cp, entry);
               if (isLastPart) {
-                // Last part - match files (not directories)
                 if (statSync(fullPath).isFile()) {
                   nextPaths.push(fullPath);
                 }
               } else {
-                // Not the last part - only directories
                 if (statSync(fullPath).isDirectory()) {
                   nextPaths.push(fullPath);
                 }
@@ -244,7 +316,6 @@ function expandGlob(pattern) {
 
 // Function to force overwrite specific files/folders
 function forceOverwriteList(relativePaths) {
-  // Expand glob patterns first
   const expandedPaths = [];
   for (const relativePath of relativePaths) {
     expandedPaths.push(...expandGlob(relativePath));
@@ -258,14 +329,12 @@ function forceOverwriteList(relativePaths) {
       try {
         const stats = statSync(srcPath);
         if (stats.isDirectory()) {
-          // Force copy directory
           if (!existsSync(destPath)) {
             mkdirSync(destPath, { recursive: true });
           }
           forceCopyDirRecursive(srcPath, destPath);
           console.log(`✓ Force overwritten (dir): ${relativePath}`);
         } else {
-          // Force copy file
           const parentDir = dirname(destPath);
           if (!existsSync(parentDir)) {
             mkdirSync(parentDir, { recursive: true });
@@ -282,20 +351,17 @@ function forceOverwriteList(relativePaths) {
   });
 }
 
-// Copy config/agent contents to ~/.aicode-cli/agent only if they don't exist (preserve user customizations)
+// Copy config/agent contents to ~/.aicode-cli/agent
 if (existsSync(packageConfigDir)) {
   console.log(`📁 Syncing default config files to ${agentDir} (preserving user customizations)`);
 
-  // Copy directory recursively (only if destination doesn't exist)
   copyDirRecursive(packageConfigDir, agentDir);
   console.log('✓ Default config files synced successfully');
 
-  // Force overwrite specified files/folders
   if (FORCE_OVERWRITE_LIST.length > 0) {
     forceOverwriteList(FORCE_OVERWRITE_LIST);
   }
 
-  // Check for extensions
   const extensionsDir = join(agentDir, 'extensions');
   if (existsSync(extensionsDir)) {
     try {
@@ -312,19 +378,17 @@ if (existsSync(packageConfigDir)) {
 }
 
 // ============================================================================
-// Reset User-Agent placeholder in models.json (so CLI can replace it on each run)
+// Reset User-Agent placeholder in models.json
 // ============================================================================
 const modelsPath = join(agentDir, 'models.json');
 if (existsSync(modelsPath)) {
   try {
     let content = readFileSync(modelsPath, 'utf-8');
-    // 只重置 headers.User-Agent 下的版本号为占位符
     try {
       const config = JSON.parse(content);
       for (const provider of Object.values(config.providers || {})) {
         if (provider.headers && provider.headers['User-Agent']) {
           const ua = provider.headers['User-Agent'];
-          // 如果是以 aicode-cli/ 开头，替换为占位符
           if (ua && ua.startsWith('aicode-cli/')) {
             provider.headers['User-Agent'] = '${VERSION}';
           }
@@ -335,6 +399,11 @@ if (existsSync(modelsPath)) {
       if (newContent !== content) {
         writeFileSync(modelsPath, newContent, 'utf-8');
         console.log('✓ Reset User-Agent placeholder in models.json');
+        
+        logSecurity('file_modified', {
+          file: modelsPath,
+          action: 'Reset User-Agent placeholder',
+        });
       }
     } catch (e) {
       console.log(`⚠ Could not reset User-Agent placeholder: ${e.message}`);
@@ -350,24 +419,38 @@ if (existsSync(modelsPath)) {
 }
 
 // Create symlink ~/.pi linking to ~/.aicode-cli (if not exists)
-try {
-  if (!existsSync(piDir)) {
-    // Create symbolic link using shell command (works on all platforms)
-    execSync(`ln -s "${aicodeCliDir}" "${piDir}"`, { stdio: 'pipe' });
-    console.log(`✓ Created symbolic link: ${piDir} -> ${aicodeCliDir}`);
-  } else {
-    console.log(`✓ ${piDir} already exists`);
-  }
-} catch (e) {
-  if (e.message.includes('File exists')) {
-    console.log(`✓ Symbolic link already exists: ${piDir}`);
-  } else {
-    console.log(`⚠ Could not create symbolic link: ${e.message}`);
-    console.log('\n📌 To fix this, please run manually:');
-    console.log('   ln -s ~/.aicode-cli ~/.pi');
-    console.log('\n   (If ~/.pi exists, run: rm -rf ~/.pi && ln -s ~/.aicode-cli ~/.pi)');
+(async () => {
+  try {
+    if (!existsSync(piDir)) {
+      await fsSymlink(aicodeCliDir, piDir, 'dir');
+      console.log(`✓ Created symbolic link: ${piDir} -> ${aicodeCliDir}`);
+      
+      logSecurity('symlink_create', {
+        target: piDir,
+        source: aicodeCliDir,
+        success: true,
+      });
+    } else {
+      console.log(`✓ ${piDir} already exists`);
+    }
+  } catch (e) {
+    if (e.code === 'EEXIST') {
+      console.log(`✓ Symbolic link already exists: ${piDir}`);
+    } else {
+      console.log(`⚠ Could not create symbolic link: ${e.message}`);
+      console.log('\n📌 To fix this, please run manually:');
+      console.log('   ln -s ~/.aicode-cli ~/.pi');
+      console.log('\n   (If ~/.pi exists, run: rm -rf ~/.pi && ln -s ~/.aicode-cli ~/.pi)');
+      
+      logSecurity('symlink_create', {
+        target: piDir,
+        source: aicodeCliDir,
+        success: false,
+        error: e.message,
+      }, 'warn');
+    }
   }
-}
+})();
 
 // Check and display models config
 if (existsSync(modelsPath)) {
@@ -384,8 +467,16 @@ if (existsSync(modelsPath)) {
   console.log(`⚠ No models.json found at ${modelsPath}`);
 }
 
+// Record installation complete
+logSecurity('install_complete', {
+  success: true,
+  aicodeCliDir,
+  agentDir,
+  piDir,
+});
+
 console.log('\n✨ Setup complete!');
 console.log('📝 Configuration files are in ~/.aicode-cli/');
 console.log('🔗 ~/.pi is linked to ~/.aicode-cli (ensuring model configs work)');
 console.log('🚀 Run with: aicode-cli');
-console.log('\n📖 For more information, see: https://www.npmjs.com/package/@ia-ccun/code-agent-cli');
+console.log('\n📖 For more information, see: https://www.npmjs.com/package/@ia-ccun/code-agent-cli');