fix(scripts): enhance execution robustness

- Add a 3-minute timeout and logging to bootstrap.sh to prevent hanging
  while waiting for Xcode Command Line Tools.
- Add a 5-second timeout in install.sh using perl to prevent hanging
  when reading the legacy zsh PATH.
- Replace unsafe eval with array-based command execution in aic.fish
  to prevent command injection from malicious git diffs.
- Enforce strict prompt constraints in aic.fish and ait.fish to forbid
  markdown blocks and conversational filler text.
- Add awk-based fallback parser in aic.fish to forcefully extract the
  commit message if the AI model disobeys output constraints.
- Include bootstrap.sh in the Makefile shellcheck linting target.
- Clear the local fisher plugin cache during Makefile plugin updates.

Author: windvalley

Makefile

@@ -154,6 +154,8 @@ plugins: ## 安装/更新 Fisher 插件
 		fish -c "source '$$tmp' && fisher install jorgebucaran/fisher"; \
 		rm -f "$$tmp"; \
 	fi
+	@echo "  清理残留插件缓存..."
+	@rm -rf $(HOME)/.local/share/fisher
 	@if [ -f fish/dot-config/fish/fish_plugins ]; then \
 		fish -c "fisher install (cat fish/dot-config/fish/fish_plugins)"; \
 	fi
@@ -171,7 +173,7 @@ lint: ## 静态分析 Shell 脚本 (shellcheck)
 		exit 1; \
 	fi
 	@errors=0; \
-	for script in install.sh macos.sh bin/*; do \
+	for script in bootstrap.sh install.sh macos.sh bin/*; do \
 		if [ -f "$$script" ]; then \
 			if file "$$script" | grep -q "shell script" || head -1 "$$script" | grep -Eq '^#!.*(bash|sh)'; then \
 				if shellcheck -S warning "$$script" 2>/dev/null; then \

bootstrap.sh

@@ -27,8 +27,17 @@ if ! command -v git &> /dev/null; then
     xcode-select --install
 
     info "Waiting for Git installation to complete..."
+    wait_count=0
     until command -v git &> /dev/null; do
         sleep 5
+        wait_count=$((wait_count + 1))
+        if [ $((wait_count % 6)) -eq 0 ]; then
+            info "Still waiting for Xcode Command Line Tools. Please click 'Install' on the macOS popup..."
+        fi
+        if [ $wait_count -ge 180 ]; then
+            error "Git installation took too long or was cancelled. Please install manually: xcode-select --install"
+            exit 1
+        fi
     done
     success "Git installed successfully."
 fi

fish/dot-config/fish/functions/aic.fish

@@ -60,7 +60,12 @@ function aic -d "根据代码变更自动生成 Git Commit 信息"
 $lang_prompt
 
 类型可选: feat, fix, docs, style, refactor, test, chore
-只返回完整的提交信息本身（包含首行和 Body/Footer），不加任何啰嗦的解释和外层的 Markdown 代码块 (```)。"
+
+⚠️ 绝对约束：
+- 绝对禁止输出任何解释、思考过程、分析意图（如 'I detect implementation intent'）或引导语！
+- 只返回严格的提交信息文本本身。
+- 禁止使用外层的 Markdown 代码块 (\`\`\`)。
+- 第一行必须直接是 type(scope): description 格式！"
 
         if test -n "$supplementary_info"
             set prompt_text "$prompt_text
@@ -75,17 +80,39 @@ $supplementary_info"
 $diff
 </diff>"
 
+        # 安全执行 AI_CMD（禁止 eval），避免 git diff 中的特殊字符触发命令注入
+        # 兼容两种配置：
+        # 1) set -gx AI_CMD opencode run
+        # 2) set -gx AI_CMD "opencode run"
+        set -l ai_cmd_argv $AI_CMD
+        if test (count $ai_cmd_argv) -eq 1
+            set ai_cmd_argv (string split -n " " -- $ai_cmd_argv[1])
+        end
+
+        if test (count $ai_cmd_argv) -eq 0
+            echo "❌ AI_CMD 配置无效，请检查 ~/.config/fish/config.local.fish"
+            return 1
+        end
+
         # 调用检测到的 AI 工具生成内容
         set -l msg_tmpfile (mktemp)
-        eval $ai_cmd \"\$prompt_text\" > $msg_tmpfile
+        $ai_cmd_argv "$prompt_text" > $msg_tmpfile
         set -l ai_exit_status $status
 
         # 捕捉在 AI 生成过程中被 Ctrl+C 中断的情况或者命令执行失败
         # 先检查退出码：Ctrl+C (130) 或其他错误
         if test $ai_exit_status -ne 0
             rm -f $msg_tmpfile
             echo ""
-            echo "❌ 操作已中断"
+            echo "❌ 操作已中断或报错退出"
+            return 1
+        end
+
+        # 如果文件为空（AI未输出或因发生类似模型未找到的错误而仅输出到了 stderr）
+        if not test -s $msg_tmpfile
+            rm -f $msg_tmpfile
+            echo ""
+            echo "❌ AI 生成失败 (未获取到输出内容，请检查上方报错信息)"
             return 1
         end
 
@@ -98,9 +125,18 @@ $diff
             return 1
         end
 
-        # 清理响应
+        # 清理响应: 移除 Markdown 块标记
         sed -i '' -e '/^```\(commit\|text\)/d' -e '/^```$/d' $msg_tmpfile
 
+        # 兜底防御：大模型有时仍会输出思考过程或废话。
+        # 这里使用 awk 截取从标准的 Conventional Commit 起始的所有内容，抛弃前面的废话
+        awk '/^(feat|fix|docs|style|refactor|test|chore|perf|build|ci|revert)(\([^)]+\))?: / {found=1} found {print}' $msg_tmpfile > $msg_tmpfile.tmp
+        if test -s $msg_tmpfile.tmp
+            mv $msg_tmpfile.tmp $msg_tmpfile
+        else
+            rm -f $msg_tmpfile.tmp
+        end
+        
         echo ""
         echo "📝 建议提交信息:"
         awk '{print "   " $0}' $msg_tmpfile

fish/dot-config/fish/functions/ait.fish

@@ -88,7 +88,7 @@ $commit_logs
    第一部分：仅包含推断出的纯版本号（例如 1.2.0，不要带 v）
    第二部分：对应的 CHANGELOG 内容，格式遵循 Keep a Changelog 规范。二级标题必须为 ## [VERSION] - DATE。具体条目按 Added, Changed, Fixed 等归类，内容使用无序列表即可。
 
-4. 强制约束：只返回以上两部分内容，不带 Markdown 代码块或其他多余解释。"
+4. 强制约束：绝对禁止输出任何解释、思考过程、分析意图或引导语！只返回以上两部分内容本身，严禁带 Markdown 代码块或其余口语化废话。"
 
         if test -n "$supplementary_info"
             set prompt "$prompt

install.sh

@@ -225,33 +225,42 @@ fish -c "fish_add_path (brew --prefix)/bin" 2>/dev/null || true
 
 # Migrate PATH from zsh to fish (for users switching from zsh)
 if command -v zsh &>/dev/null; then
-    info "Migrating PATH from zsh to fish..."
-
-    ZSH_PATHS=$(/bin/zsh -l -c 'echo "$PATH"' 2>/dev/null | tr ':' '\n')
-    FISH_PATHS=$(fish -l -c 'string join \n $PATH' 2>/dev/null)
-
-    MIGRATED=0
-    while IFS= read -r p; do
-        [ -z "$p" ] && continue
-        [ ! -d "$p" ] && continue
-
-        # Skip system/default paths (already handled)
-        case "$p" in
-            /usr/bin|/bin|/usr/sbin|/sbin|/usr/local/bin|/opt/homebrew/bin|/opt/homebrew/sbin) continue ;;
-        esac
-
-        # Check if path is already in fish
-        if ! echo "$FISH_PATHS" | grep -qxF "$p"; then
-            fish -c "fish_add_path --append '$p'" 2>/dev/null || true
-            info "  Added: $p"
-            MIGRATED=$((MIGRATED + 1))
-        fi
-    done <<< "$ZSH_PATHS"
+    info "Migrating PATH from zsh to fish (with 5-second timeout protection)..."
+
+    if command -v perl &>/dev/null; then
+        ZSH_PATHS=$(perl -e 'alarm 5; exec @ARGV' /bin/zsh -l -c 'echo "$PATH"' 2>/dev/null | tr ':' '\n' || true)
+    else
+        ZSH_PATHS=$(/bin/zsh -l -c 'echo "$PATH"' 2>/dev/null | tr ':' '\n' || true)
+    fi
 
-    if [ "$MIGRATED" -gt 0 ]; then
-        success "Migrated $MIGRATED PATH entries from zsh to fish."
+    if [ -z "$ZSH_PATHS" ]; then
+        warn "Could not read legacy zsh PATH or timed out. Skipping migration."
     else
-        success "No additional PATH entries to migrate from zsh."
+        FISH_PATHS=$(fish -l -c 'string join \n $PATH' 2>/dev/null)
+
+        MIGRATED=0
+        while IFS= read -r p; do
+            [ -z "$p" ] && continue
+            [ ! -d "$p" ] && continue
+
+            # Skip system/default paths (already handled)
+            case "$p" in
+                /usr/bin|/bin|/usr/sbin|/sbin|/usr/local/bin|/opt/homebrew/bin|/opt/homebrew/sbin) continue ;;
+            esac
+
+            # Check if path is already in fish
+            if ! echo "$FISH_PATHS" | grep -qxF "$p"; then
+                fish -c "fish_add_path --append '$p'" 2>/dev/null || true
+                info "  Added: $p"
+                MIGRATED=$((MIGRATED + 1))
+            fi
+        done <<< "$ZSH_PATHS"
+
+        if [ "$MIGRATED" -gt 0 ]; then
+            success "Migrated $MIGRATED PATH entries from zsh to fish."
+        else
+            success "No additional PATH entries to migrate from zsh."
+        fi
     fi
 else
     info "zsh not found, skipping PATH migration."