mirror of https://github.com/garrytan/gstack.git
6fd1ef383a
restrictFilePermissions / restrictDirectoryPermissions passed os.userInfo().username straight to `icacls /grant`. On a domain-joined Windows host that also has a *local* account of the same login name, icacls resolves the bare name to the LOCAL account (e.g. HOST\user), not the domain account the process runs as (e.g. DOMAIN\user). Combined with `/inheritance:r`, the new single-entry ACL is granted to an account the process is NOT, locking it out of the .gstack state dir it just created. The browse daemon then can't create its lock/state file and startup fails with a misleading "Another instance is starting... Timed out." Fix: resolve the current process token SID via System32\whoami.exe (absolute path, so a shadowing Unix `whoami` on PATH can't hijack it) and grant `*<SID>`, which is immune to local-vs-domain name collisions. Fall back to USERDOMAIN\username, then bare username, if the SID lookup is unavailable. Cached per process. Adds a regression test asserting the resolved principal is a SID literal (*S-1-5-...) on Windows and a non-empty name-based fallback off-Windows. Co-Authored-By: Paperclip <noreply@paperclip.ing> |
||
|---|---|---|
| .. | ||
| bin | ||
| scripts | ||
| src | ||
| test | ||
| PLAN-snapshot-dropdown-interactive.md | ||
| SKILL.md | ||
| SKILL.md.tmpl | ||