@ia-ccun/code-agent-cli 0.0.51 → 0.0.52-beta.2

package/dist/security-logger.js

@@ -0,0 +1,178 @@
+/**
+ * 安全日志模块
+ * 🔒 Security: Structured logging for security events
+ */
+import { createWriteStream, existsSync, mkdirSync, readdirSync, statSync, unlinkSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+// 日志目录和文件
+const LOG_DIR = join(homedir(), '.aicode-cli', 'logs');
+const SECURITY_LOG = join(LOG_DIR, 'security.log');
+const ERROR_LOG = join(LOG_DIR, 'error.log');
+/**
+ * 日志级别
+ */
+export var LogLevel;
+(function (LogLevel) {
+    LogLevel["INFO"] = "info";
+    LogLevel["WARN"] = "warn";
+    LogLevel["ERROR"] = "error";
+})(LogLevel || (LogLevel = {}));
+/**
+ * 安全事件类型
+ */
+export var SecurityEventType;
+(function (SecurityEventType) {
+    // 配置相关
+    SecurityEventType["CONFIG_LOAD"] = "config_load";
+    SecurityEventType["CONFIG_ERROR"] = "config_error";
+    // 路径验证
+    SecurityEventType["PATH_VALIDATION"] = "path_validation";
+    SecurityEventType["PATH_TRAVERSAL_BLOCKED"] = "path_traversal_blocked";
+    // 文件操作
+    SecurityEventType["FILE_MODIFIED"] = "file_modified";
+    SecurityEventType["FILE_ACCESS"] = "file_access";
+    // 依赖和更新
+    SecurityEventType["DEPENDENCY_CHECK"] = "dependency_check";
+    SecurityEventType["VERSION_CHECK"] = "version_check";
+    // 安装和设置
+    SecurityEventType["INSTALL_START"] = "install_start";
+    SecurityEventType["INSTALL_COMPLETE"] = "install_complete";
+    SecurityEventType["SYMLINK_CREATE"] = "symlink_create";
+    // 通用
+    SecurityEventType["SUSPICIOUS_ACTIVITY"] = "suspicious_activity";
+})(SecurityEventType || (SecurityEventType = {}));
+/**
+ * 日志流（懒加载）
+ */
+let securityLogStream = null;
+let errorLogStream = null;
+/**
+ * 初始化日志目录和流
+ */
+function initLogs() {
+    // 确保日志目录存在
+    if (!existsSync(LOG_DIR)) {
+        mkdirSync(LOG_DIR, { recursive: true, mode: 0o700 });
+    }
+    // 创建安全日志流（追加模式，仅所有者可读写）
+    if (!securityLogStream) {
+        securityLogStream = createWriteStream(SECURITY_LOG, {
+            flags: 'a',
+            mode: 0o600,
+        });
+    }
+    // 创建错误日志流
+    if (!errorLogStream) {
+        errorLogStream = createWriteStream(ERROR_LOG, {
+            flags: 'a',
+            mode: 0o600,
+        });
+    }
+}
+/**
+ * 格式化日志条目为 JSON
+ */
+function formatLog(entry) {
+    return JSON.stringify(entry) + '\n';
+}
+/**
+ * 记录安全事件
+ * @param event 事件类型
+ * @param details 事件详情
+ * @param level 日志级别（默认 info）
+ */
+export function logSecurity(event, details, level = LogLevel.INFO) {
+    initLogs();
+    const entry = {
+        timestamp: new Date().toISOString(),
+        level,
+        event,
+        message: `Security event: ${event}`,
+        details: sanitizeDetails(details),
+        pid: process.pid,
+        version: process.version,
+    };
+    securityLogStream?.write(formatLog(entry));
+    // 开发环境下输出到控制台
+    if (process.env.DEBUG || process.env.NODE_ENV === 'development') {
+        console.error(`[🔒 安全] ${event}:`, details);
+    }
+}
+/**
+ * 记录错误
+ * @param message 错误消息
+ * @param error 错误对象
+ * @param context 上下文信息
+ */
+export function logError(message, error, context) {
+    initLogs();
+    const entry = {
+        timestamp: new Date().toISOString(),
+        level: LogLevel.ERROR,
+        message,
+        details: {
+            name: error.name,
+            message: error.message,
+            stack: error.stack,
+            ...sanitizeDetails(context || {}),
+        },
+        pid: process.pid,
+        version: process.version,
+    };
+    errorLogStream?.write(formatLog(entry));
+    // 开发环境下输出到控制台
+    if (process.env.DEBUG || process.env.NODE_ENV === 'development') {
+        console.error(`[❌ 错误] ${message}:`, error);
+    }
+}
+/**
+ * 脱敏处理（移除敏感信息）
+ */
+function sanitizeDetails(details) {
+    const sensitiveKeys = ['apiKey', 'api_key', 'token', 'password', 'secret', 'auth'];
+    const sanitized = { ...details };
+    for (const key of sensitiveKeys) {
+        if (sanitized[key]) {
+            // 仅保留前 4 个字符用于识别
+            const value = String(sanitized[key]);
+            sanitized[key] = value.length > 8 ? value.substring(0, 4) + '***' : '***';
+        }
+    }
+    return sanitized;
+}
+/**
+ * 获取日志文件路径
+ */
+export function getLogPaths() {
+    return {
+        security: SECURITY_LOG,
+        error: ERROR_LOG,
+        dir: LOG_DIR,
+    };
+}
+/**
+ * 清除旧日志（可选的维护功能）
+ * @param maxAge 最大保留天数（默认 30 天）
+ */
+export function rotateLogs(maxAge = 30) {
+    const now = Date.now();
+    const maxAgeMs = maxAge * 24 * 60 * 60 * 1000;
+    try {
+        if (!existsSync(LOG_DIR))
+            return;
+        const files = readdirSync(LOG_DIR);
+        for (const file of files) {
+            const filePath = join(LOG_DIR, file);
+            const stats = statSync(filePath);
+            if (stats.isFile() && now - stats.mtimeMs > maxAgeMs) {
+                unlinkSync(filePath);
+                console.log(`[日志轮转] 已删除旧日志：${file}`);
+            }
+        }
+    }
+    catch (error) {
+        logError('日志轮转失败', error, { maxAge });
+    }
+}
+//# sourceMappingURL=security-logger.js.map

package/dist/security-logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-logger.js","sourceRoot":"","sources":["../src/security-logger.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AACjG,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAE7B,UAAU;AACV,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;AACvD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;AACnD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;AAE7C;;GAEG;AACH,MAAM,CAAN,IAAY,QAIX;AAJD,WAAY,QAAQ;IAClB,yBAAa,CAAA;IACb,yBAAa,CAAA;IACb,2BAAe,CAAA;AACjB,CAAC,EAJW,QAAQ,KAAR,QAAQ,QAInB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,iBAwBX;AAxBD,WAAY,iBAAiB;IAC3B,OAAO;IACP,gDAA2B,CAAA;IAC3B,kDAA6B,CAAA;IAE7B,OAAO;IACP,wDAAmC,CAAA;IACnC,sEAAiD,CAAA;IAEjD,OAAO;IACP,oDAA+B,CAAA;IAC/B,gDAA2B,CAAA;IAE3B,QAAQ;IACR,0DAAqC,CAAA;IACrC,oDAA+B,CAAA;IAE/B,QAAQ;IACR,oDAA+B,CAAA;IAC/B,0DAAqC,CAAA;IACrC,sDAAiC,CAAA;IAEjC,KAAK;IACL,gEAA2C,CAAA;AAC7C,CAAC,EAxBW,iBAAiB,KAAjB,iBAAiB,QAwB5B;AAeD;;GAEG;AACH,IAAI,iBAAiB,GAAgD,IAAI,CAAC;AAC1E,IAAI,cAAc,GAAgD,IAAI,CAAC;AAEvE;;GAEG;AACH,SAAS,QAAQ;IACf,WAAW;IACX,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,wBAAwB;IACxB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,iBAAiB,GAAG,iBAAiB,CAAC,YAAY,EAAE;YAClD,KAAK,EAAE,GAAG;YACV,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IAED,UAAU;IACV,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,cAAc,GAAG,iBAAiB,CAAC,SAAS,EAAE;YAC5C,KAAK,EAAE,GAAG;YACV,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,KAAe;IAChC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,KAAwB,EACxB,OAAgC,EAChC,QAAkB,QAAQ,CAAC,IAAI;IAE/B,QAAQ,EAAE,CAAC;IAEX,MAAM,KAAK,GAAa;QACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,KAAK;QACL,KAAK;QACL,OAAO,EAAE,mBAAmB,KAAK,EAAE;QACnC,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC;QACjC,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;IAEF,iBAAiB,EAAE,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAE3C,cAAc;IACd,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QAChE,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CACtB,OAAe,EACf,KAAY,EACZ,OAAiC;IAEjC,QAAQ,EAAE,CAAC;IAEX,MAAM,KAAK,GAAa;QACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,OAAO;QACP,OAAO,EAAE;YACP,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,eAAe,CAAC,OAAO,IAAI,EAAE,CAAC;SAClC;QACD,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;IAEF,cAAc,EAAE,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAExC,cAAc;IACd,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QAChE,OAAO,CAAC,KAAK,CAAC,UAAU,OAAO,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,OAAgC;IACvD,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACnF,MAAM,SAAS,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IAEjC,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,iBAAiB;YACjB,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YACrC,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO;QACL,QAAQ,EAAE,YAAY;QACtB,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE,OAAO;KACb,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,SAAiB,EAAE;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAE9C,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO;QAEjC,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAEjC,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,GAAG,QAAQ,EAAE,CAAC;gBACrD,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACrB,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,QAAQ,EAAE,KAAc,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACjD,CAAC;AACH,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ia-ccun/code-agent-cli",
-  "version": "0.0.51",
-  "description": "AI Coding Agent CLI - 基于OpenClaw🦞底层Agent（pi）原理封装的编码智能体（供学习使用）。",
+  "version": "0.0.52-beta.2",
+  "description": "AI Coding Agent CLI - 基于OpenClaw🦞底层Agent原理封装的编码智能体（供学习使用）。",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -35,21 +35,32 @@
     "prepare": "husky"
   },
   "dependencies": {
-    "@mariozechner/pi-agent-core": "0.62.0",
-    "@mariozechner/pi-ai": "0.62.0",
-    "@mariozechner/pi-coding-agent": "0.62.0",
-    "@mariozechner/pi-tui": "0.62.0"
+    "@earendil-works/pi-agent-core": "^0.77.0",
+    "@earendil-works/pi-ai": "^0.77.0",
+    "@earendil-works/pi-coding-agent": "^0.77.0",
+    "@earendil-works/pi-tui": "^0.77.0"
   },
   "overrides": {
     "glob": "^11.0.0",
-    "node-domexception": "^2.0.0"
+    "node-domexception": "^2.0.0",
+    "protobufjs": "^7.5.5",
+    "basic-ftp": "^6.0.1",
+    "flatted": "^3.4.2",
+    "undici": "^7.24.8",
+    "picomatch": "^4.0.4",
+    "brace-expansion": "^5.0.5",
+    "file-type": "^21.3.2",
+    "ip-address": "^10.1.1",
+    "yaml": "^2.8.3"
   },
   "devDependencies": {
+    "@devkade/pi-plan": "^0.2.2",
     "@types/node": "^22.10.0",
     "@typescript-eslint/eslint-plugin": "^8.57.0",
     "@typescript-eslint/parser": "^8.57.0",
     "eslint": "^10.0.3",
     "husky": "^9.1.7",
+    "playwright": "^1.60.0",
     "shx": "^0.4.0",
     "typescript": "^5.7.2",
     "typescript-eslint": "^8.57.0"

package/scripts/postinstall.js

@@ -1,18 +1,66 @@
 #!/usr/bin/env node
 
 // Post-install script for aicode-cli
-import { existsSync, mkdirSync, readFileSync, writeFileSync, copyFileSync, readdirSync, statSync } from 'fs';
-import { execSync } from 'child_process';
+import { existsSync, mkdirSync, readFileSync, writeFileSync, copyFileSync, readdirSync, statSync, createWriteStream } from 'fs';
+import { symlink as fsSymlink } from 'fs/promises';
 import { join, dirname, relative } from 'path';
 import { homedir } from 'os';
 import { fileURLToPath } from 'url';
+import { spawn } from 'child_process';
 
 // Get __dirname equivalent for ES modules
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 
+// ============================================================================
+// Security Logger (inline for postinstall script)
+// ============================================================================
+const LOG_DIR = join(homedir(), '.aicode-cli', 'logs');
+const SECURITY_LOG = join(LOG_DIR, 'security.log');
+
+function ensureLogDir() {
+  if (!existsSync(LOG_DIR)) {
+    mkdirSync(LOG_DIR, { recursive: true, mode: 0o700 });
+  }
+}
+
+function logSecurity(event, details, level = 'info') {
+  ensureLogDir();
+  const entry = {
+    timestamp: new Date().toISOString(),
+    level,
+    event,
+    message: `PostInstall: ${event}`,
+    details,
+    pid: process.pid,
+  };
+  
+  try {
+    const stream = createWriteStream(SECURITY_LOG, { flags: 'a', mode: 0o600 });
+    stream.write(JSON.stringify(entry) + '\n');
+    stream.end();
+  } catch (e) {
+    // Ignore logging errors
+  }
+  
+  if (process.env.DEBUG) {
+    console.error(`[🔒 安全] ${event}:`, details);
+  }
+}
+
+// ============================================================================
+// Main Installation Logic
+// ============================================================================
+
 console.log('\n🚀 Setting up aicode-cli...');
 
+// Record installation start
+logSecurity('install_start', {
+  version: '0.0.51-beta.1',
+  homeDir: homedir(),
+  timestamp: new Date().toISOString(),
+});
+
 // Get the current user's home directory
 const homeDir = homedir();
 const aicodeCliDir = join(homeDir, '.aicode-cli');
@@ -21,7 +69,7 @@ const piDir = join(homeDir, '.pi');
 // ============================================================================
 // Fix pi-coding-agent APP_NAME
 // ============================================================================
-const piAgentPackageJson = join(__dirname, '..', 'node_modules', '@mariozechner', 'pi-coding-agent', 'package.json');
+const piAgentPackageJson = join(__dirname, '..', 'node_modules', '@earendil-works', 'pi-coding-agent', 'package.json');
 if (existsSync(piAgentPackageJson)) {
   try {
     const piPkg = JSON.parse(readFileSync(piAgentPackageJson, 'utf-8'));
@@ -33,13 +81,24 @@ if (existsSync(piAgentPackageJson)) {
     piPkg.piConfig.configDir = '.aicode-cli';
     writeFileSync(piAgentPackageJson, JSON.stringify(piPkg, null, 2) + '\n');
     console.log(`✓ Updated pi-coding-agent app name: ${oldName} -> aicode-cli`);
+    
+    logSecurity('file_modified', {
+      file: piAgentPackageJson,
+      action: 'Updated piConfig',
+      changes: ['name', 'configDir'],
+    });
   } catch (e) {
     console.log(`⚠ Could not update pi-coding-agent config: ${e.message}`);
+    logSecurity('file_modified', {
+      file: piAgentPackageJson,
+      action: 'Update failed',
+      error: e.message,
+    }, 'warn');
   }
 }
 
 // Fix pi-coding-agent cli.js process.title
-const piAgentCliJs = join(__dirname, '..', 'node_modules', '@mariozechner', 'pi-coding-agent', 'dist', 'cli.js');
+const piAgentCliJs = join(__dirname, '..', 'node_modules', '@earendil-works', 'pi-coding-agent', 'dist', 'cli.js');
 if (existsSync(piAgentCliJs)) {
   try {
     let cliContent = readFileSync(piAgentCliJs, 'utf-8');
@@ -47,6 +106,11 @@ if (existsSync(piAgentCliJs)) {
       cliContent = cliContent.replace(/process\.title = "pi"/g, 'process.title = "aicode-cli"');
       writeFileSync(piAgentCliJs, cliContent);
       console.log(`✓ Updated pi-coding-agent process.title`);
+      
+      logSecurity('file_modified', {
+        file: piAgentCliJs,
+        action: 'Updated process.title',
+      });
     }
   } catch (e) {
     console.log(`⚠ Could not update pi-coding-agent cli.js: ${e.message}`);
@@ -54,7 +118,7 @@ if (existsSync(piAgentCliJs)) {
 }
 
 // Fix pi-coding-agent config.js APP_NAME default
-const piAgentConfigJs = join(__dirname, '..', 'node_modules', '@mariozechner', 'pi-coding-agent', 'dist', 'config.js');
+const piAgentConfigJs = join(__dirname, '..', 'node_modules', '@earendil-works', 'pi-coding-agent', 'dist', 'config.js');
 if (existsSync(piAgentConfigJs)) {
   try {
     let configContent = readFileSync(piAgentConfigJs, 'utf-8');
@@ -62,6 +126,11 @@ if (existsSync(piAgentConfigJs)) {
       configContent = configContent.replace(/pkg\.piConfig\?\.name \|\| "pi"/g, 'pkg.piConfig?.name || "aicode-cli"');
       writeFileSync(piAgentConfigJs, configContent);
       console.log(`✓ Updated pi-coding-agent config.js APP_NAME`);
+      
+      logSecurity('file_modified', {
+        file: piAgentConfigJs,
+        action: 'Updated APP_NAME',
+      });
     }
   } catch (e) {
     console.log(`⚠ Could not update pi-coding-agent config.js: ${e.message}`);
@@ -69,7 +138,7 @@ if (existsSync(piAgentConfigJs)) {
 }
 
 // Fix pi-coding-agent slash commands - change "Quit pi" to "Quit aicode-cli"
-const slashCommandsJs = join(__dirname, '..', 'node_modules', '@mariozechner', 'pi-coding-agent', 'dist', 'core', 'slash-commands.js');
+const slashCommandsJs = join(__dirname, '..', 'node_modules', '@earendil-works', 'pi-coding-agent', 'dist', 'core', 'slash-commands.js');
 if (existsSync(slashCommandsJs)) {
   try {
     let content = readFileSync(slashCommandsJs, 'utf-8');
@@ -77,6 +146,11 @@ if (existsSync(slashCommandsJs)) {
       content = content.replace(/Quit pi/g, 'Quit aicode-cli');
       writeFileSync(slashCommandsJs, content);
       console.log(`✓ Updated slash command description`);
+      
+      logSecurity('file_modified', {
+        file: slashCommandsJs,
+        action: 'Updated slash commands',
+      });
     }
   } catch (e) {
     console.log(`⚠ Could not update slash commands: ${e.message}`);
@@ -103,7 +177,6 @@ function copyDirRecursive(src, dest) {
   const isDirectory = exists && stats.isDirectory();
 
   if (isDirectory) {
-    // Create directory if it doesn't exist
     if (!existsSync(dest)) {
       mkdirSync(dest, { recursive: true });
     }
@@ -115,9 +188,7 @@ function copyDirRecursive(src, dest) {
       copyDirRecursive(srcPath, destPath);
     });
   } else {
-    // Only copy if source exists AND destination doesn't exist (preserve user files)
     if (exists && !existsSync(dest)) {
-      // Ensure parent directory exists
       const parentDir = dirname(dest);
       if (!existsSync(parentDir)) {
         mkdirSync(parentDir, { recursive: true });
@@ -171,19 +242,14 @@ const FORCE_OVERWRITE_LIST = [
   'SYSTEM.md',
   'dangerous-patterns.json',
   'settings.json',
-  'extensions/working-msg.ts',
-  'extensions/custom-footer.ts',
-  'extensions/custom.ts',
-  'extensions/bash-check.ts',
-  'extensions/aicode-tips.ts',
-  // Force overwrite all prompts .md files
+  'help.md',
+  'extensions/*.ts',
   'prompts/*.md',
-  // Force overwrite all skills SKILL.md files
   'skills/*/SKILL.md',
-   'skills/*/*/SKILL.md',
+  'skills/*/*/SKILL.md',
 ];
 
-// Function to expand glob patterns like "skills/*/SKILL.md" or "prompts/*.md"
+// Function to expand glob patterns
 function expandGlob(pattern) {
   const results = [];
   
@@ -201,21 +267,17 @@ function expandGlob(pattern) {
         if (!existsSync(cp)) continue;
         
         if (hasWildcard) {
-          // Handle wildcard patterns like * or *.md
           const entries = readdirSync(cp);
-          // Convert glob pattern to regex: *.md -> ^.*\.md$
           const regex = new RegExp('^' + part.replace(/\*/g, '.*') + '$');
           
           for (const entry of entries) {
             if (regex.test(entry)) {
               const fullPath = join(cp, entry);
               if (isLastPart) {
-                // Last part - match files (not directories)
                 if (statSync(fullPath).isFile()) {
                   nextPaths.push(fullPath);
                 }
               } else {
-                // Not the last part - only directories
                 if (statSync(fullPath).isDirectory()) {
                   nextPaths.push(fullPath);
                 }
@@ -243,7 +305,6 @@ function expandGlob(pattern) {
 
 // Function to force overwrite specific files/folders
 function forceOverwriteList(relativePaths) {
-  // Expand glob patterns first
   const expandedPaths = [];
   for (const relativePath of relativePaths) {
     expandedPaths.push(...expandGlob(relativePath));
@@ -257,14 +318,12 @@ function forceOverwriteList(relativePaths) {
       try {
         const stats = statSync(srcPath);
         if (stats.isDirectory()) {
-          // Force copy directory
           if (!existsSync(destPath)) {
             mkdirSync(destPath, { recursive: true });
           }
           forceCopyDirRecursive(srcPath, destPath);
           console.log(`✓ Force overwritten (dir): ${relativePath}`);
         } else {
-          // Force copy file
           const parentDir = dirname(destPath);
           if (!existsSync(parentDir)) {
             mkdirSync(parentDir, { recursive: true });
@@ -281,20 +340,17 @@ function forceOverwriteList(relativePaths) {
   });
 }
 
-// Copy config/agent contents to ~/.aicode-cli/agent only if they don't exist (preserve user customizations)
+// Copy config/agent contents to ~/.aicode-cli/agent
 if (existsSync(packageConfigDir)) {
   console.log(`📁 Syncing default config files to ${agentDir} (preserving user customizations)`);
 
-  // Copy directory recursively (only if destination doesn't exist)
   copyDirRecursive(packageConfigDir, agentDir);
   console.log('✓ Default config files synced successfully');
 
-  // Force overwrite specified files/folders
   if (FORCE_OVERWRITE_LIST.length > 0) {
     forceOverwriteList(FORCE_OVERWRITE_LIST);
   }
 
-  // Check for extensions
   const extensionsDir = join(agentDir, 'extensions');
   if (existsSync(extensionsDir)) {
     try {
@@ -311,19 +367,17 @@ if (existsSync(packageConfigDir)) {
 }
 
 // ============================================================================
-// Reset User-Agent placeholder in models.json (so CLI can replace it on each run)
+// Reset User-Agent placeholder in models.json
 // ============================================================================
 const modelsPath = join(agentDir, 'models.json');
 if (existsSync(modelsPath)) {
   try {
     let content = readFileSync(modelsPath, 'utf-8');
-    // 只重置 headers.User-Agent 下的版本号为占位符
     try {
       const config = JSON.parse(content);
       for (const provider of Object.values(config.providers || {})) {
         if (provider.headers && provider.headers['User-Agent']) {
           const ua = provider.headers['User-Agent'];
-          // 如果是以 aicode-cli/ 开头，替换为占位符
           if (ua && ua.startsWith('aicode-cli/')) {
             provider.headers['User-Agent'] = '${VERSION}';
           }
@@ -334,6 +388,11 @@ if (existsSync(modelsPath)) {
       if (newContent !== content) {
         writeFileSync(modelsPath, newContent, 'utf-8');
         console.log('✓ Reset User-Agent placeholder in models.json');
+        
+        logSecurity('file_modified', {
+          file: modelsPath,
+          action: 'Reset User-Agent placeholder',
+        });
       }
     } catch (e) {
       console.log(`⚠ Could not reset User-Agent placeholder: ${e.message}`);
@@ -349,24 +408,38 @@ if (existsSync(modelsPath)) {
 }
 
 // Create symlink ~/.pi linking to ~/.aicode-cli (if not exists)
-try {
-  if (!existsSync(piDir)) {
-    // Create symbolic link using shell command (works on all platforms)
-    execSync(`ln -s "${aicodeCliDir}" "${piDir}"`, { stdio: 'pipe' });
-    console.log(`✓ Created symbolic link: ${piDir} -> ${aicodeCliDir}`);
-  } else {
-    console.log(`✓ ${piDir} already exists`);
-  }
-} catch (e) {
-  if (e.message.includes('File exists')) {
-    console.log(`✓ Symbolic link already exists: ${piDir}`);
-  } else {
-    console.log(`⚠ Could not create symbolic link: ${e.message}`);
-    console.log('\n📌 To fix this, please run manually:');
-    console.log('   ln -s ~/.aicode-cli ~/.pi');
-    console.log('\n   (If ~/.pi exists, run: rm -rf ~/.pi && ln -s ~/.aicode-cli ~/.pi)');
+(async () => {
+  try {
+    if (!existsSync(piDir)) {
+      await fsSymlink(aicodeCliDir, piDir, 'dir');
+      console.log(`✓ Created symbolic link: ${piDir} -> ${aicodeCliDir}`);
+      
+      logSecurity('symlink_create', {
+        target: piDir,
+        source: aicodeCliDir,
+        success: true,
+      });
+    } else {
+      console.log(`✓ ${piDir} already exists`);
+    }
+  } catch (e) {
+    if (e.code === 'EEXIST') {
+      console.log(`✓ Symbolic link already exists: ${piDir}`);
+    } else {
+      console.log(`⚠ Could not create symbolic link: ${e.message}`);
+      console.log('\n📌 To fix this, please run manually:');
+      console.log('   ln -s ~/.aicode-cli ~/.pi');
+      console.log('\n   (If ~/.pi exists, run: rm -rf ~/.pi && ln -s ~/.aicode-cli ~/.pi)');
+      
+      logSecurity('symlink_create', {
+        target: piDir,
+        source: aicodeCliDir,
+        success: false,
+        error: e.message,
+      }, 'warn');
+    }
   }
-}
+})();
 
 // Check and display models config
 if (existsSync(modelsPath)) {
@@ -383,8 +456,73 @@ if (existsSync(modelsPath)) {
   console.log(`⚠ No models.json found at ${modelsPath}`);
 }
 
+// Record installation complete
+logSecurity('install_complete', {
+  success: true,
+  aicodeCliDir,
+  agentDir,
+  piDir,
+});
+
+// ============================================================================
+// Auto-install codegraph (optional dependency)
+// ============================================================================
+
+const CODEGRAPH_PKG = '@colbymchenry/codegraph@0.9.7';
+
+async function installCodegraph() {
+  return new Promise((resolve) => {
+    const child = spawn('npm', ['i', '-g', CODEGRAPH_PKG], {
+      stdio: 'pipe',
+      shell: process.platform === 'win32',
+    });
+    
+    let stderr = '';
+    
+    child.stderr.on('data', (data) => {
+      stderr += data.toString();
+    });
+    
+    child.on('close', (code) => {
+      if (code === 0) {
+        console.log('✓ Installed codegraph globally,See UniDoc《2026.5 aicode+codegraph 安装与使用》');
+        logSecurity('codegraph_install', { 
+          package: CODEGRAPH_PKG, 
+          success: true 
+        });
+      } else {
+        // 静默失败，不中断主流程
+        if (process.env.DEBUG) {
+          console.log(`⚠ Could not install codegraph: ${stderr.slice(0, 100)}`);
+        }
+        logSecurity('codegraph_install', { 
+          package: CODEGRAPH_PKG, 
+          success: false, 
+          error: stderr.slice(0, 200) 
+        }, 'warn');
+      }
+      resolve();
+    });
+    
+    child.on('error', (err) => {
+      if (process.env.DEBUG) {
+        console.log(`⚠ Could not install codegraph: ${err.message}`);
+      }
+      logSecurity('codegraph_install', { 
+        package: CODEGRAPH_PKG, 
+        success: false, 
+        error: err.message 
+      }, 'warn');
+      resolve();
+    });
+  });
+}
+
+// Execute codegraph installation
+await installCodegraph();
+
 console.log('\n✨ Setup complete!');
 console.log('📝 Configuration files are in ~/.aicode-cli/');
 console.log('🔗 ~/.pi is linked to ~/.aicode-cli (ensuring model configs work)');
 console.log('🚀 Run with: aicode-cli');
-console.log('\n📖 For more information, see: https://www.npmjs.com/package/@ia-ccun/code-agent-cli');
+console.log('\n📖 For more information, see: https://www.npmjs.com/package/@ia-ccun/code-agent-cli');