dsh-deepseek-import 0.2.3 → 0.2.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dsh-import.mjs +32 -0
- package/package.json +1 -1
package/dsh-import.mjs
CHANGED
|
@@ -86,6 +86,7 @@ function parseArgs(argv) {
|
|
|
86
86
|
else if (arg === '--tail') opts.tail = Number(argv[++i]);
|
|
87
87
|
else if (arg === '--no-auto-trim') opts.autoTrim = false;
|
|
88
88
|
else if (arg === '--no-system-head') opts.noSystemHead = true;
|
|
89
|
+
else if (arg === '--no-acl-fix') opts.noAclFix = true;
|
|
89
90
|
else if (arg === '--audit') opts.audit = true;
|
|
90
91
|
else if (arg === '--repair') { opts.audit = true; opts.applyRepair = true; }
|
|
91
92
|
else if (arg === '--no-sidecar' || arg === '--sidecar') opts.noSidecar = true;
|
|
@@ -904,6 +905,35 @@ function writeTranscript(conversation, workspacePath, sessionId) {
|
|
|
904
905
|
|
|
905
906
|
// ---------------------------------------------------------------- 主流程
|
|
906
907
|
|
|
908
|
+
/**
|
|
909
|
+
* 确保当前用户在目标工作区上拥有「完全控制」。
|
|
910
|
+
*
|
|
911
|
+
* 为什么需要：DSH 沙箱每次运行都要往工作区写一条针对本次受限 SID 的授权，
|
|
912
|
+
* 这要求目录本身带 WRITE_DAC / WRITE_OWNER。而新建的目录通常只从父目录继承
|
|
913
|
+
* 「Authenticated Users: 修改」——不含这两项——于是授权写入直接失败
|
|
914
|
+
* （SetNamedSecurityInfoW Win32 5），表现为打开会话后所有命令都报 grantWrite。
|
|
915
|
+
*
|
|
916
|
+
* 导入时顺手补一条可继承的完全控制，用户就不必先撞一次错误再回来修。
|
|
917
|
+
* 这是用户自己的进程在跑，不是受限令牌，所以能改（目录 owner 有隐式 WRITE_DAC）。
|
|
918
|
+
*/
|
|
919
|
+
function ensureWorkspaceAcl(dir) {
|
|
920
|
+
if (process.platform !== 'win32' || opts.noAclFix) return;
|
|
921
|
+
try {
|
|
922
|
+
const user = execFileSync('whoami', { encoding: 'utf8' }).trim();
|
|
923
|
+
const listing = execFileSync('icacls', [dir], { encoding: 'utf8' });
|
|
924
|
+
const already = listing
|
|
925
|
+
.split('\n')
|
|
926
|
+
.some((line) => line.toUpperCase().includes(user.toUpperCase()) && /\(F\)/.test(line));
|
|
927
|
+
if (already) return;
|
|
928
|
+
execFileSync('icacls', [dir, '/grant', `${user}:(OI)(CI)F`], { stdio: 'ignore' });
|
|
929
|
+
console.log(` 已为工作区补写完全控制权限（DSH 沙箱需要）：${dir}`);
|
|
930
|
+
} catch (error) {
|
|
931
|
+
console.warn(` 无法自动补写工作区权限：${error.message}`);
|
|
932
|
+
console.warn(` 若打开会话时报 grantWrite，请手动执行：`);
|
|
933
|
+
console.warn(` icacls "${dir}" /grant "${process.env.USERNAME}:(OI)(CI)F"`);
|
|
934
|
+
}
|
|
935
|
+
}
|
|
936
|
+
|
|
907
937
|
async function main() {
|
|
908
938
|
if (opts.audit) {
|
|
909
939
|
const { auditSessions } = await import('./repair-session.mjs');
|
|
@@ -959,6 +989,8 @@ async function main() {
|
|
|
959
989
|
process.exit(1);
|
|
960
990
|
}
|
|
961
991
|
|
|
992
|
+
ensureWorkspaceAcl(target.path);
|
|
993
|
+
|
|
962
994
|
const files = expandFiles(opts.files);
|
|
963
995
|
if (!files.length) {
|
|
964
996
|
console.error('没有找到可导入的 .json 文件');
|