// 在Cmd::exec中，建议添加环境变量清理
// 防止命令注入攻击
std::vector<std::string> envStrings;
std::vector<char *> envp;

// 添加以下代码清理潜在危险的环境变量
const char* dangerous_envs[] = {"LD_PRELOAD", "LD_LIBRARY_PATH", "IFS"};
for (char **env = environ; *env != nullptr; ++env) {
    bool is_dangerous = false;
    for (const char* dangerous : dangerous_envs) {
        if (strncmp(*env, dangerous, strlen(dangerous)) == 0 && 
            (*env)[strlen(dangerous)] == '=') {
            is_dangerous = true;
            break;
        }
    }
    if (!is_dangerous) {
        envStrings.emplace_back(*env);
    }
}

// 在Cmd::exec中，建议添加更详细的错误信息
if (WIFSIGNALED(status)) {
    int signal = WTERMSIG(status);
    return LINGLONG_ERR(fmt::format(
        "command killed by signal {} ({}): {}", 
        signal, 
        strsignal(signal),
        output
    ));
}

// 在fork前添加资源检查
if (m_stdinContent.size() > 1024 * 1024 * 10) {  // 限制10MB
    return LINGLONG_ERR("stdin content too large, potential DoS risk");
}

// 建议添加错误信息翻译支持
std::string errorString(int err) {
    // 可以添加翻译逻辑
    return std::system_category().message(err);
}

// 在concatFile中添加符号链接检查
if (std::filesystem::is_symlink(source) || std::filesystem::is_symlink(target)) {
    return LINGLONG_ERR("symbolic links are not allowed");
}

// 在concatFile中添加进度回调
linglong::utils::error::Result<void> concatFile(
    const std::filesystem::path &source,
    const std::filesystem::path &target,
    std::function<void(size_t, size_t)> progressCallback = nullptr
) {
    // 实现中添加进度报告
    size_t totalSize = std::filesystem::file_size(source);
    size_t copied = 0;
    // ... 复制过程中更新进度
    if (progressCallback) {
        progressCallback(copied, totalSize);
    }
}

// 添加更多边界条件测试
TEST(command, LargeStdin) {
    // 测试大输入数据
    std::string large_data(1024 * 1024, 'A');  // 1MB
    auto ret = linglong::utils::Cmd("cat").toStdin(large_data).exec();
    EXPECT_TRUE(ret);
    EXPECT_EQ(*ret, large_data);
}

TEST(command, SpecialCharacters) {
    // 测试特殊字符处理
    std::string special_chars = "$`\\\"'()[]{}*?|&;<>";
    auto ret = linglong::utils::Cmd("echo").exec({special_chars});
    EXPECT_TRUE(ret);
    EXPECT_EQ(*ret, special_chars + "\n");
}

TEST(command, ConcurrentExecution) {
    // 测试并发执行
    std::vector<std::future<linglong::utils::error::Result<std::string>>> results;
    for (int i = 0; i < 10; ++i) {
        results.push_back(std::async(std::launch::async, []() {
            return linglong::utils::Cmd("echo").exec({std::to_string(i)});
        }));
    }
    for (auto& result : results) {
        auto ret = result.get();
        EXPECT_TRUE(ret);
    }
}

// 添加命令路径缓存
class Cmd {
private:
    static std::unordered_map<std::string, std::filesystem::path> commandCache;
    std::filesystem::path getCommandPath() {
        auto it = commandCache.find(m_command);
        if (it != commandCache.end()) {
            return it->second;
        }
        // ... 原有查找逻辑
        auto path = /* 查找结果 */;
        commandCache[m_command] = path;
        return path;
    }
};

// 添加批量执行接口
static utils::error::Result<std::vector<std::string>> execBatch(
    const std::vector<std::pair<std::string, std::vector<std::string>>> &commands
) {
    std::vector<std::string> results;
    for (const auto &cmd : commands) {
        auto ret = Cmd(cmd.first).exec(cmd.second);
        if (!ret) {
            return LINGLONG_ERR(ret.error());
        }
        results.push_back(*ret);
    }
    return results;
}

// 添加命令白名单机制
class Cmd {
private:
    static std::unordered_set<std::string> allowedCommands;
public:
    static void setAllowedCommands(const std::unordered_set<std::string> &commands) {
        allowedCommands = commands;
    }
    
    utils::error::Result<std::string> exec(const std::vector<std::string> &args) noexcept {
        if (!allowedCommands.empty() && allowedCommands.find(m_command) == allowedCommands.end()) {
            return LINGLONG_ERR(fmt::format("command {} is not allowed", m_command));
        }
        // ... 原有逻辑
    }
};

// 在Cmd::exec中添加资源限制
struct rlimit limit;
limit.rlim_cur = 30;  // 30秒CPU时间
limit.rlim_max = 30;
if (setrlimit(RLIMIT_CPU, &limit) == -1) {
    return LINGLONG_ERR(fmt::format("setrlimit failed: {}", errorString(errno)));
}