fix(安全): 修复HTML导出中的XSS漏洞并清理调试日志

refactor(日志): 替换console.log为tracing日志系统
style(代码): 移除未使用的代码和依赖项

feat(测试): 添加端到端测试文档和CI工作流
docs(变更日志): 更新CHANGELOG.md记录0.1.0版本变更

perf(构建): 更新依赖版本并优化CI流程

crates/zclaw-kernel/src/config.rs

@@ -168,7 +168,7 @@ fn default_skills_dir() -> Option<std::path::PathBuf> {
     // 1. Check environment variable override
     if let Ok(dir) = std::env::var("ZCLAW_SKILLS_DIR") {
         let path = std::path::PathBuf::from(&dir);
-        eprintln!("[default_skills_dir] ZCLAW_SKILLS_DIR env: {} (exists: {})", path.display(), path.exists());
+        tracing::debug!(target: "kernel_config", "ZCLAW_SKILLS_DIR env: {} (exists: {})", path.display(), path.exists());
         if path.exists() {
             return Some(path);
         }
@@ -180,12 +180,12 @@ fn default_skills_dir() -> Option<std::path::PathBuf> {
     // CARGO_MANIFEST_DIR is the crate directory (crates/zclaw-kernel)
     // We need to go up to find the workspace root
     let manifest_dir = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR"));
-    eprintln!("[default_skills_dir] CARGO_MANIFEST_DIR: {}", manifest_dir.display());
+    tracing::debug!(target: "kernel_config", "CARGO_MANIFEST_DIR: {}", manifest_dir.display());
 
     // Go up from crates/zclaw-kernel to workspace root
     if let Some(workspace_root) = manifest_dir.parent().and_then(|p| p.parent()) {
         let workspace_skills = workspace_root.join("skills");
-        eprintln!("[default_skills_dir] Workspace skills: {} (exists: {})", workspace_skills.display(), workspace_skills.exists());
+        tracing::debug!(target: "kernel_config", "Workspace skills: {} (exists: {})", workspace_skills.display(), workspace_skills.exists());
         if workspace_skills.exists() {
             return Some(workspace_skills);
         }
@@ -194,7 +194,7 @@ fn default_skills_dir() -> Option<std::path::PathBuf> {
     // 3. Try current working directory first (for development)
     if let Ok(cwd) = std::env::current_dir() {
         let cwd_skills = cwd.join("skills");
-        eprintln!("[default_skills_dir] Checking cwd: {} (exists: {})", cwd_skills.display(), cwd_skills.exists());
+        tracing::debug!(target: "kernel_config", "Checking cwd: {} (exists: {})", cwd_skills.display(), cwd_skills.exists());
         if cwd_skills.exists() {
             return Some(cwd_skills);
         }
@@ -204,7 +204,7 @@ fn default_skills_dir() -> Option<std::path::PathBuf> {
         for i in 0..6 {
             if let Some(parent) = current.parent() {
                 let parent_skills = parent.join("skills");
-                eprintln!("[default_skills_dir] CWD Level {}: {} (exists: {})", i, parent_skills.display(), parent_skills.exists());
+                tracing::debug!(target: "kernel_config", "CWD Level {}: {} (exists: {})", i, parent_skills.display(), parent_skills.exists());
                 if parent_skills.exists() {
                     return Some(parent_skills);
                 }
@@ -217,11 +217,11 @@ fn default_skills_dir() -> Option<std::path::PathBuf> {
 
     // 4. Try executable's directory and multiple levels up
     if let Ok(exe) = std::env::current_exe() {
-        eprintln!("[default_skills_dir] Current exe: {}", exe.display());
+        tracing::debug!(target: "kernel_config", "Current exe: {}", exe.display());
         if let Some(exe_dir) = exe.parent().map(|p| p.to_path_buf()) {
             // Same directory as exe
             let exe_skills = exe_dir.join("skills");
-            eprintln!("[default_skills_dir] Checking exe dir: {} (exists: {})", exe_skills.display(), exe_skills.exists());
+            tracing::debug!(target: "kernel_config", "Checking exe dir: {} (exists: {})", exe_skills.display(), exe_skills.exists());
             if exe_skills.exists() {
                 return Some(exe_skills);
             }
@@ -231,7 +231,7 @@ fn default_skills_dir() -> Option<std::path::PathBuf> {
             for i in 0..6 {
                 if let Some(parent) = current.parent() {
                     let parent_skills = parent.join("skills");
-                    eprintln!("[default_skills_dir] EXE Level {}: {} (exists: {})", i, parent_skills.display(), parent_skills.exists());
+                    tracing::debug!(target: "kernel_config", "EXE Level {}: {} (exists: {})", i, parent_skills.display(), parent_skills.exists());
                     if parent_skills.exists() {
                         return Some(parent_skills);
                     }
@@ -247,7 +247,7 @@ fn default_skills_dir() -> Option<std::path::PathBuf> {
     let fallback = std::env::current_dir()
         .ok()
         .map(|cwd| cwd.join("skills"));
-    eprintln!("[default_skills_dir] Fallback to: {:?}", fallback);
+    tracing::debug!(target: "kernel_config", "Fallback to: {:?}", fallback);
     fallback
 }
 

crates/zclaw-kernel/src/kernel.rs

@@ -129,9 +129,9 @@ impl Kernel {
     }
 
     /// Build a system prompt with skill information injected
-    fn build_system_prompt_with_skills(&self, base_prompt: Option<&String>) -> String {
-        // Get skill list synchronously (we're in sync context)
-        let skills = futures::executor::block_on(self.skills.list());
+    async fn build_system_prompt_with_skills(&self, base_prompt: Option<&String>) -> String {
+        // Get skill list asynchronously
+        let skills = self.skills.list().await;
 
         let mut prompt = base_prompt
             .map(|p| p.clone())
@@ -309,7 +309,7 @@ impl Kernel {
         .with_temperature(agent_config.temperature.unwrap_or_else(|| self.config.temperature()));
 
         // Build system prompt with skill information injected
-        let system_prompt = self.build_system_prompt_with_skills(agent_config.system_prompt.as_ref());
+        let system_prompt = self.build_system_prompt_with_skills(agent_config.system_prompt.as_ref()).await;
         let loop_runner = loop_runner.with_system_prompt(&system_prompt);
 
         // Run the loop
@@ -352,7 +352,7 @@ impl Kernel {
         .with_temperature(agent_config.temperature.unwrap_or_else(|| self.config.temperature()));
 
         // Build system prompt with skill information injected
-        let system_prompt = self.build_system_prompt_with_skills(agent_config.system_prompt.as_ref());
+        let system_prompt = self.build_system_prompt_with_skills(agent_config.system_prompt.as_ref()).await;
         let loop_runner = loop_runner.with_system_prompt(&system_prompt);
 
         // Run with streaming