fix(system): 编译产物读 /proc、/sys 走 cat 兜底,运行状态资源监控与沙箱内存看门狗恢复

Deno 2 不带 --allow-all 时读 /proc、/sys 一律 NotCapable,部署环境资源监控一直无数据。

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Cxwgnn2pbzQ7rXv3rq7fei

apps/server/test/system/proc-read.test.ts

@@ -0,0 +1,42 @@
+// 生产权限下读 /proc、/sys:Deno 2 不带 --allow-all 时 readTextFile 一律 NotCapable,
+// 编译产物的资源监控与沙箱内存看门狗曾因此静默取不到数(v0.3.34 运行状态页一直无数据)。
+// 这里用与 apps/server/deno.json compile 相同的权限起子进程,确认走 cat 兜底能读到。
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+
+const here = fileURLToPath(new URL(".", import.meta.url));
+const probe = `
+import { readProcText } from "${here}../../src/proc-read.ts";
+import { readResources } from "${here}../../src/modules/system/resources.ts";
+const stat = await readProcText("/proc/stat");
+const r = await readResources();
+console.log(JSON.stringify({ stat: !!stat && stat.startsWith("cpu"), host: r.host != null, mem: r.meminfo != null }));
+`;
+
+describe.skipIf(Deno.build.os !== "linux")("readProcText 在生产权限下", () => {
+  it("走 cat 兜底读到 /proc 与资源读数", async () => {
+    const out = await new Deno.Command(Deno.execPath(), {
+      args: [
+        "run",
+        "--no-prompt",
+        "--allow-net",
+        "--allow-env",
+        "--allow-sys",
+        "--allow-read",
+        "--allow-write",
+        "--allow-run=ffprobe,sha256sum,cat",
+        "-",
+      ],
+      stdin: "piped",
+      stdout: "piped",
+      stderr: "piped",
+    }).spawn();
+    const w = out.stdin.getWriter();
+    await w.write(new TextEncoder().encode(probe));
+    await w.close();
+    const o = await out.output();
+    const text = new TextDecoder().decode(o.stdout).trim();
+    expect(o.success, new TextDecoder().decode(o.stderr)).toBe(true);
+    expect(JSON.parse(text.split("\n").at(-1)!)).toEqual({ stat: true, host: true, mem: true });
+  }, 60_000);
+});