setup_security_tools.ps1

#Requires -Version 5.1
<#
.SYNOPSIS
    DeepAudit 安全工具一键安装脚本 (Windows 增强版)

.DESCRIPTION
    自动安装沙盒和外部安全扫描工具：
    - Python 工具: semgrep, bandit, safety
    - 系统工具: gitleaks, osv-scanner, trufflehog
    - Docker 沙盒镜像

    特性:
    - 多种安装方式自动回退
    - 网络问题自动重试
    - 详细的错误诊断
    - 支持代理设置
    - 虚拟环境兼容

.EXAMPLE
    .\setup_security_tools.ps1
    .\setup_security_tools.ps1 -InstallAll
    .\setup_security_tools.ps1 -VerifyOnly
#>

[CmdletBinding()]
param(
    [switch]$InstallAll,
    [switch]$PythonOnly,
    [switch]$SystemOnly,
    [switch]$DockerOnly,
    [switch]$VerifyOnly,
    [switch]$IncludeOptional,
    [switch]$Verbose,
    [switch]$Help
)

# ============================================================
# 配置
# ============================================================

$ErrorActionPreference = "Continue"
$ProgressPreference = "SilentlyContinue"

# 版本配置
$GITLEAKS_VERSION = "8.18.4"
$OSV_SCANNER_VERSION = "1.8.3"
$TRUFFLEHOG_VERSION = "3.80.0"

# 重试配置
$MAX_RETRIES = 3
$RETRY_DELAY = 2

# 获取脚本目录
$ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
$ProjectRoot = Split-Path -Parent $ScriptDir

# 工具安装目录
$ToolsDir = "$env:LOCALAPPDATA\DeepAudit\tools"

# ============================================================
# 辅助函数
# ============================================================

function Write-ColorOutput {
    param(
        [string]$Message,
        [string]$Type = "Info"
    )

    switch ($Type) {
        "Success" { Write-Host "✓ $Message" -ForegroundColor Green }
        "Error"   { Write-Host "✗ $Message" -ForegroundColor Red }
        "Warning" { Write-Host "! $Message" -ForegroundColor Yellow }
        "Info"    { Write-Host "→ $Message" -ForegroundColor Cyan }
        "Debug"   { if ($script:VerboseMode) { Write-Host "  $Message" -ForegroundColor DarkGray } }
        "Header"  {
            Write-Host ""
            Write-Host "═══════════════════════════════════════════════════════════════" -ForegroundColor Blue
            Write-Host "  $Message" -ForegroundColor Blue
            Write-Host "═══════════════════════════════════════════════════════════════" -ForegroundColor Blue
            Write-Host ""
        }
    }
}

function Test-Command {
    param([string]$Command)
    $result = Get-Command -Name $Command -ErrorAction SilentlyContinue
    return [bool]$result
}

function Test-AdminPrivilege {
    $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
    $principal = New-Object Security.Principal.WindowsPrincipal($identity)
    return $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
}

function Get-SystemArchitecture {
    if ([Environment]::Is64BitOperatingSystem) {
        return "x64"
    }
    return "x86"
}

# 带重试的下载函数
function Download-WithRetry {
    param(
        [string]$Url,
        [string]$OutFile,
        [string]$Description
    )

    for ($attempt = 1; $attempt -le $MAX_RETRIES; $attempt++) {
        Write-ColorOutput "下载 $Description (尝试 $attempt/$MAX_RETRIES)..." "Info"

        try {
            # 设置 TLS 1.2
            [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

            $webClient = New-Object System.Net.WebClient

            # 支持代理
            if ($env:HTTP_PROXY) {
                $proxy = New-Object System.Net.WebProxy($env:HTTP_PROXY)
                $webClient.Proxy = $proxy
            }

            $webClient.DownloadFile($Url, $OutFile)
            Write-ColorOutput "$Description 下载成功" "Success"
            return $true
        }
        catch {
            Write-ColorOutput "下载失败: $_" "Warning"

            if ($attempt -lt $MAX_RETRIES) {
                Write-ColorOutput "${RETRY_DELAY}秒后重试..." "Info"
                Start-Sleep -Seconds $RETRY_DELAY
            }
        }
    }

    Write-ColorOutput "$Description 下载失败 (已重试 $MAX_RETRIES 次)" "Error"
    return $false
}

# 带重试的 pip 安装
function Install-PipPackageWithRetry {
    param([string]$Package)

    for ($attempt = 1; $attempt -le $MAX_RETRIES; $attempt++) {
        Write-ColorOutput "安装 $Package (尝试 $attempt/$MAX_RETRIES)..." "Info"

        try {
            # 尝试常规安装
            $result = & $script:PipCmd install $Package --quiet 2>&1
            if ($LASTEXITCODE -eq 0) {
                Write-ColorOutput "$Package 安装成功" "Success"
                return $true
            }

            # 尝试 --user 安装
            $result = & $script:PipCmd install $Package --user --quiet 2>&1
            if ($LASTEXITCODE -eq 0) {
                Write-ColorOutput "$Package 安装成功 (--user)" "Success"
                return $true
            }

            # 第一次失败后尝试升级 pip
            if ($attempt -eq 1) {
                Write-ColorOutput "升级 pip 后重试..." "Debug"
                & $script:PipCmd install --upgrade pip --quiet 2>&1 | Out-Null
            }
        }
        catch {
            Write-ColorOutput "安装错误: $_" "Debug"
        }

        Start-Sleep -Seconds $RETRY_DELAY
    }

    Write-ColorOutput "$Package 安装失败" "Error"
    return $false
}

# 检测 Python 环境
function Detect-PythonEnvironment {
    Write-ColorOutput "检测 Python 环境..." "Info"

    $script:PythonCmd = $null
    $script:PipCmd = $null

    # 检查虚拟环境
    if ($env:VIRTUAL_ENV) {
        Write-ColorOutput "检测到虚拟环境: $env:VIRTUAL_ENV" "Info"
        $script:PythonCmd = "python"
        $script:PipCmd = "pip"
    }
    # 检查 python
    elseif (Test-Command "python") {
        $script:PythonCmd = "python"

        # 检查是否是 Python 3
        $version = & python --version 2>&1
        if ($version -notmatch "Python 3") {
            Write-ColorOutput "需要 Python 3.x，当前: $version" "Warning"
        }

        if (Test-Command "pip") {
            $script:PipCmd = "pip"
        }
        else {
            $script:PipCmd = "python -m pip"
        }
    }
    # 检查 python3
    elseif (Test-Command "python3") {
        $script:PythonCmd = "python3"
        if (Test-Command "pip3") {
            $script:PipCmd = "pip3"
        }
        else {
            $script:PipCmd = "python3 -m pip"
        }
    }
    else {
        Write-ColorOutput "未找到 Python！请先安装 Python 3.8+" "Error"
        Write-ColorOutput "下载地址: https://www.python.org/downloads/" "Info"
        return $false
    }

    # 验证
    try {
        $version = & $script:PythonCmd --version 2>&1
        Write-ColorOutput "Python: $version" "Success"

        # 确保 pip 可用
        $pipVersion = & $script:PipCmd --version 2>&1
        if ($LASTEXITCODE -ne 0) {
            Write-ColorOutput "pip 不可用，尝试安装..." "Warning"
            & $script:PythonCmd -m ensurepip --upgrade 2>&1 | Out-Null
        }

        return $true
    }
    catch {
        Write-ColorOutput "Python 验证失败: $_" "Error"
        return $false
    }
}

# 添加到 PATH
function Add-ToPath {
    param([string]$Directory)

    # 当前会话
    if ($env:PATH -notlike "*$Directory*") {
        $env:PATH = "$Directory;$env:PATH"
    }

    # 持久化到用户 PATH
    $userPath = [Environment]::GetEnvironmentVariable("PATH", "User")
    if ($userPath -notlike "*$Directory*") {
        [Environment]::SetEnvironmentVariable("PATH", "$Directory;$userPath", "User")
        Write-ColorOutput "已添加 $Directory 到用户 PATH" "Debug"
    }
}

# 确保工具目录存在
function Ensure-ToolsDirectory {
    if (-not (Test-Path $ToolsDir)) {
        New-Item -ItemType Directory -Path $ToolsDir -Force | Out-Null
        Write-ColorOutput "创建工具目录: $ToolsDir" "Info"
    }
    Add-ToPath $ToolsDir
}

# ============================================================
# Python 工具安装
# ============================================================

function Install-PythonTools {
    Write-ColorOutput "安装 Python 安全工具" "Header"

    if (-not (Detect-PythonEnvironment)) {
        return $false
    }

    $tools = @("bandit", "safety")
    $failed = @()
    $installed = @()

    # Semgrep 单独处理
    Write-ColorOutput "检查 semgrep..." "Info"
    if (Test-Command "semgrep") {
        $version = semgrep --version 2>&1 | Select-Object -First 1
        Write-ColorOutput "semgrep 已安装: $version" "Success"
    }
    else {
        if (Install-PipPackageWithRetry "semgrep") {
            $installed += "semgrep"
        }
        else {
            $failed += "semgrep"
            Write-ColorOutput "semgrep pip 安装失败，可尝试其他方式" "Warning"
        }
    }

    # 安装其他工具
    foreach ($tool in $tools) {
        Write-ColorOutput "检查 $tool..." "Info"
        if (Test-Command $tool) {
            Write-ColorOutput "$tool 已安装" "Success"
        }
        else {
            if (Install-PipPackageWithRetry $tool) {
                $installed += $tool
            }
            else {
                $failed += $tool
            }
        }
    }

    # 可选: TruffleHog
    if ($script:InstallOptional) {
        if (-not (Test-Command "trufflehog")) {
            Write-ColorOutput "安装 trufflehog..." "Info"
            if (Install-PipPackageWithRetry "trufflehog") {
                $installed += "trufflehog"
            }
            else {
                $failed += "trufflehog"
            }
        }
    }

    # 报告结果
    Write-Host ""
    if ($installed.Count -gt 0) {
        Write-ColorOutput "已安装: $($installed -join ', ')" "Success"
    }
    if ($failed.Count -gt 0) {
        Write-ColorOutput "安装失败: $($failed -join ', ')" "Warning"
        return $false
    }

    return $true
}

# ============================================================
# 系统工具安装
# ============================================================

function Install-SystemTools {
    Write-ColorOutput "安装 Windows 系统工具" "Header"

    Ensure-ToolsDirectory

    $arch = Get-SystemArchitecture
    $failed = @()
    $installed = @()

    # ---- Gitleaks ----
    Write-ColorOutput "检查 gitleaks..." "Info"
    if (Test-Command "gitleaks") {
        Write-ColorOutput "gitleaks 已安装" "Success"
    }
    else {
        if (Install-Gitleaks) {
            $installed += "gitleaks"
        }
        else {
            $failed += "gitleaks"
        }
    }

    # ---- OSV-Scanner ----
    Write-ColorOutput "检查 osv-scanner..." "Info"
    if (Test-Command "osv-scanner") {
        Write-ColorOutput "osv-scanner 已安装" "Success"
    }
    else {
        if (Install-OsvScanner) {
            $installed += "osv-scanner"
        }
        else {
            $failed += "osv-scanner"
        }
    }

    # ---- TruffleHog (可选) ----
    if ($script:InstallOptional) {
        if (-not (Test-Command "trufflehog")) {
            Write-ColorOutput "安装 trufflehog (二进制)..." "Info"
            if (Install-TruffleHog) {
                $installed += "trufflehog"
            }
        }
    }

    # 报告结果
    Write-Host ""
    if ($installed.Count -gt 0) {
        Write-ColorOutput "已安装: $($installed -join ', ')" "Success"
    }
    if ($failed.Count -gt 0) {
        Write-ColorOutput "安装失败: $($failed -join ', ')" "Warning"
        return $false
    }

    return $true
}

function Install-Gitleaks {
    $arch = if ((Get-SystemArchitecture) -eq "x64") { "x64" } else { "x32" }
    $url = "https://github.com/gitleaks/gitleaks/releases/download/v$GITLEAKS_VERSION/gitleaks_${GITLEAKS_VERSION}_windows_${arch}.zip"
    $zipFile = "$env:TEMP\gitleaks.zip"

    if (Download-WithRetry -Url $url -OutFile $zipFile -Description "Gitleaks") {
        try {
            Expand-Archive -Path $zipFile -DestinationPath $ToolsDir -Force
            Remove-Item $zipFile -Force -ErrorAction SilentlyContinue
            Write-ColorOutput "Gitleaks 安装成功" "Success"
            return $true
        }
        catch {
            Write-ColorOutput "Gitleaks 解压失败: $_" "Error"
        }
    }
    return $false
}

function Install-OsvScanner {
    $arch = if ((Get-SystemArchitecture) -eq "x64") { "amd64" } else { "386" }
    $url = "https://github.com/google/osv-scanner/releases/download/v$OSV_SCANNER_VERSION/osv-scanner_windows_${arch}.exe"
    $exeFile = "$ToolsDir\osv-scanner.exe"

    if (Download-WithRetry -Url $url -OutFile $exeFile -Description "OSV-Scanner") {
        Write-ColorOutput "OSV-Scanner 安装成功" "Success"
        return $true
    }
    return $false
}

function Install-TruffleHog {
    $arch = if ((Get-SystemArchitecture) -eq "x64") { "amd64" } else { "386" }
    $url = "https://github.com/trufflesecurity/trufflehog/releases/download/v$TRUFFLEHOG_VERSION/trufflehog_${TRUFFLEHOG_VERSION}_windows_${arch}.tar.gz"
    $tarFile = "$env:TEMP\trufflehog.tar.gz"

    if (Download-WithRetry -Url $url -OutFile $tarFile -Description "TruffleHog") {
        try {
            # 使用 tar (Windows 10 1803+)
            tar -xzf $tarFile -C $ToolsDir 2>$null
            Remove-Item $tarFile -Force -ErrorAction SilentlyContinue
            Write-ColorOutput "TruffleHog 安装成功" "Success"
            return $true
        }
        catch {
            Write-ColorOutput "TruffleHog 解压失败 (需要 Windows 10 1803+)" "Warning"
        }
    }
    return $false
}

# ============================================================
# 包管理器安装 (备选)
# ============================================================

function Install-WithPackageManager {
    Write-ColorOutput "使用包管理器安装工具" "Header"

    $hasScoop = Test-Command "scoop"
    $hasWinget = Test-Command "winget"
    $hasChoco = Test-Command "choco"

    if (-not ($hasScoop -or $hasWinget -or $hasChoco)) {
        Write-ColorOutput "未检测到包管理器 (scoop/winget/chocolatey)" "Warning"

        $response = Read-Host "是否自动安装 Scoop (推荐)? [Y/n]"
        if ($response -ne 'n' -and $response -ne 'N') {
            try {
                Write-ColorOutput "安装 Scoop..." "Info"
                Set-ExecutionPolicy RemoteSigned -Scope CurrentUser -Force
                Invoke-RestMethod get.scoop.sh | Invoke-Expression
                $hasScoop = $true
                Write-ColorOutput "Scoop 安装成功" "Success"
            }
            catch {
                Write-ColorOutput "Scoop 安装失败: $_" "Error"
                return $false
            }
        }
        else {
            return $false
        }
    }

    # 使用 Scoop
    if ($hasScoop) {
        Write-ColorOutput "使用 Scoop 安装工具..." "Info"

        # 添加 bucket
        scoop bucket add extras 2>$null
        scoop bucket add main 2>$null

        $scoopTools = @("gitleaks", "python")
        foreach ($tool in $scoopTools) {
            Write-ColorOutput "scoop install $tool..." "Info"
            scoop install $tool 2>&1 | Out-Null
            if (Test-Command $tool) {
                Write-ColorOutput "$tool 安装成功" "Success"
            }
        }
    }
    # 使用 Winget
    elseif ($hasWinget) {
        Write-ColorOutput "使用 Winget 安装工具..." "Info"
        winget install --id=Gitleaks.Gitleaks -e --silent 2>&1 | Out-Null
    }
    # 使用 Chocolatey
    elseif ($hasChoco) {
        Write-ColorOutput "使用 Chocolatey 安装工具..." "Info"
        choco install gitleaks -y 2>&1 | Out-Null
    }

    return $true
}

# ============================================================
# Docker 沙盒安装
# ============================================================

function Install-DockerSandbox {
    Write-ColorOutput "配置 Docker 沙盒" "Header"

    # 检查 Docker
    if (-not (Test-Command "docker")) {
        Write-ColorOutput "Docker 未安装！" "Error"
        Write-ColorOutput "请安装 Docker Desktop: https://www.docker.com/products/docker-desktop/" "Info"
        return $false
    }

    # 检查 Docker 是否运行
    $dockerInfo = docker info 2>&1
    if ($LASTEXITCODE -ne 0) {
        Write-ColorOutput "Docker 未运行！请启动 Docker Desktop" "Error"

        # 尝试启动 Docker Desktop
        Write-ColorOutput "尝试启动 Docker Desktop..." "Info"
        Start-Process "C:\Program Files\Docker\Docker\Docker Desktop.exe" -ErrorAction SilentlyContinue

        Write-ColorOutput "等待 Docker 启动 (最多 60 秒)..." "Info"
        for ($i = 1; $i -le 12; $i++) {
            Start-Sleep -Seconds 5
            $dockerInfo = docker info 2>&1
            if ($LASTEXITCODE -eq 0) {
                Write-ColorOutput "Docker 已启动" "Success"
                break
            }
            Write-Host "." -NoNewline
        }
        Write-Host ""

        if ($LASTEXITCODE -ne 0) {
            Write-ColorOutput "Docker 启动超时，请手动启动 Docker Desktop" "Error"
            return $false
        }
    }

    Write-ColorOutput "Docker 已运行" "Success"

    # 构建沙盒镜像
    $sandboxDir = Join-Path $ProjectRoot "docker\sandbox"
    $dockerfile = Join-Path $sandboxDir "Dockerfile"

    if (-not (Test-Path $dockerfile)) {
        Write-ColorOutput "创建沙盒 Dockerfile..." "Info"
        New-SandboxDockerfile -Path $sandboxDir
    }

    Write-ColorOutput "构建 DeepAudit 沙盒镜像..." "Info"

    Push-Location $sandboxDir
    try {
        for ($attempt = 1; $attempt -le $MAX_RETRIES; $attempt++) {
            Write-ColorOutput "构建镜像 (尝试 $attempt/$MAX_RETRIES)..." "Info"

            docker build -t deepaudit-sandbox:latest -f Dockerfile . 2>&1

            if ($LASTEXITCODE -eq 0) {
                Write-ColorOutput "沙盒镜像构建成功: deepaudit-sandbox:latest" "Success"

                # 验证
                Write-ColorOutput "验证沙盒镜像..." "Info"
                docker run --rm deepaudit-sandbox:latest python3 --version
                Write-ColorOutput "Python 环境正常" "Success"

                return $true
            }

            Write-ColorOutput "构建失败，重试..." "Warning"
            Start-Sleep -Seconds $RETRY_DELAY
        }

        Write-ColorOutput "沙盒镜像构建失败" "Error"
        return $false
    }
    finally {
        Pop-Location
    }
}

function New-SandboxDockerfile {
    param([string]$Path)

    if (-not (Test-Path $Path)) {
        New-Item -ItemType Directory -Path $Path -Force | Out-Null
    }

    $dockerfileContent = @'
# DeepAudit 安全沙盒
FROM python:3.11-slim-bookworm

RUN apt-get update && apt-get install -y --no-install-recommends \
    curl wget netcat-openbsd dnsutils iputils-ping ca-certificates git \
    && rm -rf /var/lib/apt/lists/*

RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
    && apt-get install -y nodejs \
    && rm -rf /var/lib/apt/lists/*

RUN groupadd -g 1000 sandbox \
    && useradd -u 1000 -g sandbox -m -s /bin/bash sandbox

RUN pip install --no-cache-dir \
    requests httpx aiohttp beautifulsoup4 lxml \
    pycryptodome paramiko pyjwt python-jose sqlparse

WORKDIR /workspace
RUN mkdir -p /workspace /tmp/sandbox \
    && chown -R sandbox:sandbox /workspace /tmp/sandbox

USER sandbox
ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 HOME=/home/sandbox
CMD ["/bin/bash"]
'@

    $dockerfilePath = Join-Path $Path "Dockerfile"
    Set-Content -Path $dockerfilePath -Value $dockerfileContent -Encoding UTF8
    Write-ColorOutput "已创建沙盒 Dockerfile" "Success"
}

# ============================================================
# 验证安装
# ============================================================

function Test-Installation {
    Write-ColorOutput "验证安装结果" "Header"

    $tools = @(
        @{ Name = "semgrep";     Desc = "Semgrep 静态分析" },
        @{ Name = "bandit";      Desc = "Bandit Python安全" },
        @{ Name = "safety";      Desc = "Safety 依赖漏洞" },
        @{ Name = "gitleaks";    Desc = "Gitleaks 密钥检测" },
        @{ Name = "osv-scanner"; Desc = "OSV-Scanner 漏洞" },
        @{ Name = "trufflehog";  Desc = "TruffleHog 密钥" },
        @{ Name = "npm";         Desc = "NPM Audit" },
        @{ Name = "docker";      Desc = "Docker" }
    )

    $installed = 0
    $total = $tools.Count

    Write-Host ""
    Write-Host ("{0,-18} {1,-12} {2,-30}" -f "工具", "状态", "版本")
    Write-Host ("─" * 60)

    foreach ($tool in $tools) {
        $name = $tool.Name

        if (Test-Command $name) {
            $version = ""
            try {
                switch ($name) {
                    "semgrep"     { $version = (semgrep --version 2>&1 | Select-Object -First 1) }
                    "bandit"      { $version = (bandit --version 2>&1 | Select-Object -First 1) }
                    "safety"      { $version = (safety --version 2>&1 | Select-Object -First 1) }
                    "gitleaks"    { $version = (gitleaks version 2>&1 | Select-Object -First 1) }
                    "osv-scanner" { $version = (osv-scanner --version 2>&1 | Select-Object -First 1) }
                    "trufflehog"  { $version = (trufflehog --version 2>&1 | Select-Object -First 1) }
                    "npm"         { $version = (npm --version 2>&1) }
                    "docker"      { $version = ((docker --version 2>&1) -split ' ')[2] }
                }
                $version = $version.ToString().Substring(0, [Math]::Min(28, $version.Length))
            }
            catch {
                $version = "已安装"
            }

            Write-Host ("{0,-18} " -f $name) -NoNewline
            Write-Host ("{0,-12} " -f "已安装") -ForegroundColor Green -NoNewline
            Write-Host $version
            $installed++
        }
        else {
            Write-Host ("{0,-18} " -f $name) -NoNewline
            Write-Host ("{0,-12} " -f "未安装") -ForegroundColor Yellow -NoNewline
            Write-Host "-"
        }
    }

    Write-Host ("─" * 60)
    Write-Host ""

    # Docker 沙盒检查
    if (Test-Command "docker") {
        $imageExists = docker image inspect deepaudit-sandbox:latest 2>&1
        if ($LASTEXITCODE -eq 0) {
            Write-ColorOutput "Docker 沙盒镜像: deepaudit-sandbox:latest ✓" "Success"
        }
        else {
            Write-ColorOutput "Docker 沙盒镜像未构建" "Warning"
        }
    }

    Write-Host ""
    Write-ColorOutput "安装统计: $installed/$total 个工具可用" "Info"

    # PATH 提示
    if ($env:PATH -notlike "*$ToolsDir*") {
        Write-ColorOutput "请重启终端使 PATH 生效" "Warning"
    }

    if ($installed -ge 5) {
        Write-ColorOutput "核心安全工具已就绪！" "Success"
        return $true
    }
    else {
        Write-ColorOutput "部分工具未安装，某些功能可能受限" "Warning"
        return $false
    }
}

# ============================================================
# 更新环境配置
# ============================================================

function Update-EnvConfig {
    Write-ColorOutput "更新环境配置" "Header"

    $envFile = Join-Path $ProjectRoot "backend\.env"

    if (-not (Test-Path $envFile)) {
        Write-ColorOutput ".env 文件不存在，跳过配置更新" "Warning"
        return
    }

    $envContent = Get-Content $envFile -Raw -ErrorAction SilentlyContinue

    if ($envContent -match "SANDBOX_IMAGE") {
        Write-ColorOutput "沙盒配置已存在于 .env 文件中" "Info"
    }
    else {
        Write-ColorOutput "添加沙盒配置到 .env 文件..." "Info"

        $sandboxConfig = @"

# =============================================
# 沙盒配置 (自动添加)
# =============================================
SANDBOX_IMAGE=deepaudit-sandbox:latest
SANDBOX_MEMORY_LIMIT=512m
SANDBOX_CPU_LIMIT=1.0
SANDBOX_TIMEOUT=60
SANDBOX_NETWORK_MODE=none
"@

        Add-Content -Path $envFile -Value $sandboxConfig
        Write-ColorOutput "沙盒配置已添加到 .env" "Success"
    }
}

# ============================================================
# 显示帮助
# ============================================================

function Show-Help {
    Write-Host @"

╔═══════════════════════════════════════════════════════════════╗
║     DeepAudit 安全工具一键安装脚本 (Windows 增强版)          ║
╚═══════════════════════════════════════════════════════════════╝

用法:
    .\setup_security_tools.ps1 [选项]

选项:
    -InstallAll         全部安装 (推荐)
    -PythonOnly         仅安装 Python 工具 (pip)
    -SystemOnly         仅安装系统工具 (二进制)
    -DockerOnly         仅构建 Docker 沙盒
    -VerifyOnly         仅验证安装状态
    -IncludeOptional    包含可选工具 (TruffleHog)
    -Verbose            显示详细输出
    -Help               显示帮助信息

示例:
    .\setup_security_tools.ps1                    # 交互式安装
    .\setup_security_tools.ps1 -InstallAll        # 自动全部安装
    .\setup_security_tools.ps1 -InstallAll -IncludeOptional  # 全部 + 可选
    .\setup_security_tools.ps1 -VerifyOnly        # 仅检查状态

"@
}

# ============================================================
# 显示菜单
# ============================================================

function Show-Menu {
    Write-Host ""
    Write-Host "╔═══════════════════════════════════════════════════════════════╗" -ForegroundColor Blue
    Write-Host "║                                                               ║" -ForegroundColor Blue
    Write-Host "║     🔐 DeepAudit 安全工具一键安装脚本 (Windows 增强版)       ║" -ForegroundColor Blue
    Write-Host "║                                                               ║" -ForegroundColor Blue
    Write-Host "╚═══════════════════════════════════════════════════════════════╝" -ForegroundColor Blue
    Write-Host ""

    Write-Host "请选择要安装的组件:"
    Write-Host "  1) 全部安装 (推荐)"
    Write-Host "  2) 仅 Python 工具 (pip)"
    Write-Host "  3) 仅系统工具 (二进制下载)"
    Write-Host "  4) 使用包管理器安装 (Scoop/Winget)"
    Write-Host "  5) 仅 Docker 沙盒"
    Write-Host "  6) 仅验证安装状态"
    Write-Host "  7) 退出"
    Write-Host ""

    $choice = Read-Host "请输入选项 [1-7]"
    return $choice
}

# ============================================================
# 主函数
# ============================================================

function Main {
    # 设置全局变量
    $script:VerboseMode = $Verbose
    $script:InstallOptional = $IncludeOptional

    # 处理命令行参数
    if ($Help) {
        Show-Help
        return
    }

    if ($VerifyOnly) {
        Test-Installation
        return
    }

    if ($InstallAll) {
        Install-PythonTools
        Install-SystemTools
        Install-DockerSandbox
        Update-EnvConfig
        Test-Installation
        return
    }

    if ($PythonOnly) {
        Install-PythonTools
        Test-Installation
        return
    }

    if ($SystemOnly) {
        Install-SystemTools
        Test-Installation
        return
    }

    if ($DockerOnly) {
        Install-DockerSandbox
        Update-EnvConfig
        Test-Installation
        return
    }

    # 交互式模式
    $choice = Show-Menu

    switch ($choice) {
        "1" {
            Install-PythonTools
            Install-SystemTools
            Install-DockerSandbox
            Update-EnvConfig
            Test-Installation
        }
        "2" {
            Install-PythonTools
            Test-Installation
        }
        "3" {
            Install-SystemTools
            Test-Installation
        }
        "4" {
            Install-WithPackageManager
            Test-Installation
        }
        "5" {
            Install-DockerSandbox
            Update-EnvConfig
            Test-Installation
        }
        "6" {
            Test-Installation
        }
        "7" {
            Write-Host "退出"
            return
        }
        default {
            Write-ColorOutput "无效选项" "Error"
            return
        }
    }

    Write-ColorOutput "安装完成" "Header"
    Write-Host ""
    Write-Host "下一步操作:"
    Write-Host "  1. 重启终端使 PATH 生效"
    Write-Host "  2. 启动后端: cd backend && uvicorn app.main:app --reload"
    Write-Host "  3. 在 Agent 审计中测试工具"
    Write-Host ""
}

# 运行主函数
Main