fix: 代码审查问题修复

- C1 (Critical): 添加 PyYAML 解析 frontmatter，支持多行值和列表
- M1 (Major): 添加 FTS5 查询验证，防止注入攻击
- M2/M3 (Major): 工具类使用显式 wiki_vault_path 参数
- M4 (Major): 集成 aiofiles 实现真正的异步文件 I/O
- M5 (Major): 改用 logger.exception() 记录完整堆栈

Co-Authored-By: Claude Dev <noreply@anthropic.com>

mcp_server/tools/daily_update.py

@@ -7,9 +7,11 @@ Tool Layer - daily_update 工具
 """
 
 import logging
+import os
 from typing import Dict, Any
 from datetime import datetime
 from pathlib import Path
+import aiofiles
 from ..services import QueryService, IndexerService
 
 logger = logging.getLogger(__name__)
@@ -18,9 +20,11 @@ logger = logging.getLogger(__name__)
 class DailyUpdateTool:
     """daily_update 工具实现"""
 
-    def __init__(self, query_service: QueryService, indexer_service: IndexerService):
+    def __init__(self, query_service: QueryService, indexer_service: IndexerService, wiki_vault_path: str = None):
         self.query_service = query_service
         self.indexer_service = indexer_service
+        # 优先使用传入的路径，否则使用环境变量
+        self.wiki_vault_path = Path(wiki_vault_path or os.environ.get("WIKI_VAULT_PATH", "/Volumes/KnowledgeBase/wiki-vault"))
 
     async def handle(self) -> Dict[str, Any]:
         """
@@ -61,9 +65,8 @@ class DailyUpdateTool:
     async def _generate_hot_md(self, recent_pages, new_tags, orphans) -> bool:
         """生成热点文件"""
         try:
-            # 确定 hot.md 保存路径
-            vault_path = Path(self.query_service.db.path).parent.parent / "wiki-vault"
-            hot_path = vault_path / "hot.md"
+            # 使用配置的 wiki vault 路径
+            hot_path = self.wiki_vault_path / "hot.md"
 
             # 格式化内容
             content = f"""# Wiki Hot - {datetime.now().strftime('%Y-%m-%d')}
@@ -82,9 +85,9 @@ class DailyUpdateTool:
             for orphan in sorted(list(orphans))[:10]:
                 content += f"- [[{orphan}]]\n"
 
-            # 写入文件
-            with open(hot_path, 'w', encoding='utf-8') as f:
-                f.write(content)
+            # 写入文件（使用 aiofiles 实现异步 I/O）
+            async with aiofiles.open(hot_path, 'w', encoding='utf-8') as f:
+                await f.write(content)
 
             logger.info(f"Generated hot.md: {hot_path}")
             return True

mcp_server/tools/wiki_lint.py

@@ -7,7 +7,9 @@ Tool Layer - wiki_lint 工具
 """
 
 import logging
+import os
 from typing import Dict, Any, List
+from pathlib import Path
 from ..services import ParserService, QueryService, GraphService
 
 logger = logging.getLogger(__name__)
@@ -16,10 +18,12 @@ logger = logging.getLogger(__name__)
 class WikiLintTool:
     """wiki_lint 工具实现"""
 
-    def __init__(self, parser: ParserService, query_service: QueryService, graph_service: GraphService):
+    def __init__(self, parser: ParserService, query_service: QueryService, graph_service: GraphService, wiki_vault_path: str = None):
         self.parser = parser
         self.query_service = query_service
         self.graph_service = graph_service
+        # 优先使用传入的路径，否则使用环境变量
+        self.wiki_vault_path = Path(wiki_vault_path or os.environ.get("WIKI_VAULT_PATH", "/Volumes/KnowledgeBase/wiki-vault"))
 
     async def handle(self, path: str = "", level: str = "basic") -> Dict[str, Any]:
         """
@@ -68,9 +72,7 @@ class WikiLintTool:
         for page in pages:
             # 读取内容
             try:
-                from pathlib import Path
-                vault_path = Path(self.query_service.db.path).parent.parent / "wiki-vault"
-                full_path = vault_path / page.path
+                full_path = self.wiki_vault_path / page.path
                 with open(full_path, 'r', encoding='utf-8') as f:
                     content = f.read()
             except Exception as e: