From ec6973605bc71ee0d6905f6211bddbb81dc24c7b Mon Sep 17 00:00:00 2001
From: Suzumiya <suzmii@qq.com>
Date: Thu, 10 Sep 2026 19:55:52 +0800
Subject: [PATCH] =?UTF-8?q?=E7=BB=99=E9=9A=94=E7=A6=BB=E6=B5=8B=E8=AF=95?=
 =?UTF-8?q?=E9=85=8D=E7=BD=AE=E5=8A=A0=E4=B8=8A=E5=8F=AF=E9=80=89=E7=9A=84?=
 =?UTF-8?q?=20Windows=20ACL=20=E5=8A=A0=E5=9B=BA=E6=B3=A8=E5=85=A5?=
 =?UTF-8?q?=E7=82=B9=EF=BC=9A=E9=BB=98=E8=AE=A4=E7=9C=9F=E5=AE=9E=E5=AE=9E?=
 =?UTF-8?q?=E7=8E=B0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- agent-swarm-test-chat.mjs：secureWindowsPrivateRuntimePath 增加可选第三参 secureWindowsPath，传入时直接调用它，不传时完整保留原有的 await import + secureWindowsGameCreatorPathForCurrentUser 调用。
- agent-swarm-test-chat.mjs：copyPrivateRuntimeConfigEntry 增加可选第五参 secureWindowsPath，并透传给上面的加固函数。
- agent-swarm-test-chat.mjs：prepareSwarmTestRuntimeConfig 增加可选第三参 { secureWindowsPath = null } = {}，透传给运行配置目录加固与两次配置文件复制。
- 生产路径行为逐字不变：默认值为 null 时 if 分支不进入，执行的原语句与改动前完全一致；唯一生产调用点仍按单参调用（prepareSwarmTestRuntimeConfig(sourceConfigDir)）。
- 加这个接缝的原因：Windows 上每次私有路径加固都要拉起一个真实 powershell.exe（本机实测约 0.6 秒 / 次），一次 prepareSwarmTestRuntimeConfig 在双配置文件场景最多加固 3 次，只校验隔离与清理语义的用例不该为此耗掉 vitest 的 5000ms 默认预算。
---
 .../scripts/agent-swarm-test-chat.mjs         | 35 ++++++++++++++-----
 1 file changed, 27 insertions(+), 8 deletions(-)

diff --git a/apps/ai-game-creator-shell/scripts/agent-swarm-test-chat.mjs b/apps/ai-game-creator-shell/scripts/agent-swarm-test-chat.mjs
index 14a529600..32a9b8644 100644
--- a/apps/ai-game-creator-shell/scripts/agent-swarm-test-chat.mjs
+++ b/apps/ai-game-creator-shell/scripts/agent-swarm-test-chat.mjs
@@ -371,7 +371,15 @@ async function runMissingConfigWizard(setActiveChild, explicitConfigDir) {
   }
 }
 
-async function secureWindowsPrivateRuntimePath(targetPath, options) {
+async function secureWindowsPrivateRuntimePath(
+  targetPath,
+  options,
+  secureWindowsPath = null,
+) {
+  if (secureWindowsPath) {
+    await secureWindowsPath(targetPath, options);
+    return;
+  }
   const { secureWindowsGameCreatorPathForCurrentUser } = await import(
     './game-creator-config-wizard.mjs'
   );
@@ -383,6 +391,7 @@ async function copyPrivateRuntimeConfigEntry(
   runtimeConfigDir,
   fileName,
   required,
+  secureWindowsPath = null,
 ) {
   const sourcePath = path.join(sourceConfigDir, fileName);
   const sourceMetadata = await lstat(sourcePath).catch((error) => {
@@ -402,9 +411,11 @@ async function copyPrivateRuntimeConfigEntry(
     const sourceBytes = await readFile(sourcePath);
     const destinationFile = await open(destinationPath, 'wx', 0o600);
     try {
-      await secureWindowsPrivateRuntimePath(destinationPath, {
-        isDirectory: false,
-      });
+      await secureWindowsPrivateRuntimePath(
+        destinationPath,
+        { isDirectory: false },
+        secureWindowsPath,
+      );
       await destinationFile.writeFile(sourceBytes);
       await destinationFile.sync();
     } finally {
@@ -437,7 +448,11 @@ async function copyPrivateRuntimeConfigEntry(
   return true;
 }
 
-export async function prepareSwarmTestRuntimeConfig(sourceConfigDir, tempRoot) {
+export async function prepareSwarmTestRuntimeConfig(
+  sourceConfigDir,
+  tempRoot,
+  { secureWindowsPath = null } = {},
+) {
   if (!path.isAbsolute(sourceConfigDir)) {
     throw new Error('配置来源目录必须是绝对路径');
   }
@@ -457,9 +472,11 @@ export async function prepareSwarmTestRuntimeConfig(sourceConfigDir, tempRoot) {
   );
   try {
     if (process.platform === 'win32') {
-      await secureWindowsPrivateRuntimePath(runtimeConfigDir, {
-        isDirectory: true,
-      });
+      await secureWindowsPrivateRuntimePath(
+        runtimeConfigDir,
+        { isDirectory: true },
+        secureWindowsPath,
+      );
     } else {
       await chmod(runtimeConfigDir, 0o700);
     }
@@ -477,12 +494,14 @@ export async function prepareSwarmTestRuntimeConfig(sourceConfigDir, tempRoot) {
       runtimeConfigDir,
       configFileName,
       true,
+      secureWindowsPath,
     );
     await copyPrivateRuntimeConfigEntry(
       canonicalSourceConfigDir,
       runtimeConfigDir,
       localConfigFileName,
       false,
+      secureWindowsPath,
     );
     return {
       path: await realpath(runtimeConfigDir),