@ia-ccun/code-agent-cli 0.0.51 → 0.0.52

package/bin/cli.js

@@ -136,6 +136,10 @@ function replaceCLIVersionPlaceholder() {
 // 执行占位符替换
 replaceCLIVersionPlaceholder();
 
+// 提前获取版本号（用于 banner 显示）
+const localVersion = getLocalVersion();
+process.env.AICODE_CLI_VERSION = localVersion || '';
+
 // 显示 Banner
 if (config.banner === '__default__' || config.banner !== '') {
   console.log(generateBanner(config.themeColor));
@@ -144,7 +148,7 @@ if (config.banner === '__default__' || config.banner !== '') {
 // 检查新版本
 async function checkForUpdates() {
   try {
-    const { execSync } = await import('child_process');
+    const { execFileSync } = await import('child_process');
     // 读取本地版本 - 向上查找 package.json
     let rootDir = __dirname;
     let localVersion = null;
@@ -158,9 +162,9 @@ async function checkForUpdates() {
     }
     if (!localVersion) return;
 
-    // 获取当前 registry
-    const registry = execSync('npm config get registry', { encoding: 'utf8', stdio: 'pipe' }).trim();
-    const latestVersion = execSync(`npm view @ia-ccun/code-agent-cli version --registry=${registry}`, { encoding: 'utf8', stdio: 'pipe' }).trim();
+    // 🔒 Security: Use execFileSync instead of execSync to prevent command injection
+    const registry = execFileSync('npm', ['config', 'get', 'registry'], { encoding: 'utf8', stdio: 'pipe' }).trim();
+    const latestVersion = execFileSync('npm', ['view', '@ia-ccun/code-agent-cli', 'version', '--registry=' + registry], { encoding: 'utf8', stdio: 'pipe' }).trim();
 
     // 比较版本号
     const localParts = localVersion.split('.').map(Number);
@@ -175,7 +179,8 @@ async function checkForUpdates() {
     try {
       const cacheDir = join(process.env.HOME || process.env.USERPROFILE, '.aicode-cli');
       if (!existsSync(cacheDir)) {
-        execSync(`mkdir -p "${cacheDir}"`, { stdio: 'pipe' });
+        // 🔒 Security: Use execFileSync for mkdir instead of execSync
+        execFileSync('mkdir', ['-p', cacheDir], { stdio: 'pipe' });
       }
       const cacheData = {
         localVersion,
@@ -193,13 +198,9 @@ async function checkForUpdates() {
 }
 checkForUpdates();
 
-// 获取 node_modules 中 pi-coding-agent 的 CLI 路径
-const piAgentPathUrl = new URL('../node_modules/@mariozechner/pi-coding-agent/dist/cli.js', import.meta.url);
+const piAgentPathUrl = new URL('../node_modules/@earendil-works/pi-coding-agent/dist/cli.js', import.meta.url);
 const piAgentPath = fileURLToPath(piAgentPathUrl); // 解码中文路径
 
-// 获取本地版本号
-const localVersion = getLocalVersion();
-
 // 获取版本缓存文件路径
 const versionCachePath = getVersionCachePath();