rootandClaude Opus 5.5
9268a4d920
Deno 2 不带 --allow-all 时读 /proc、/sys 一律 NotCapable,部署环境资源监控一直无数据。 Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01Cxwgnn2pbzQ7rXv3rq7fei
43 lines
1.7 KiB
TypeScript
43 lines
1.7 KiB
TypeScript
// 生产权限下读 /proc、/sys:Deno 2 不带 --allow-all 时 readTextFile 一律 NotCapable,
|
|
// 编译产物的资源监控与沙箱内存看门狗曾因此静默取不到数(v0.3.34 运行状态页一直无数据)。
|
|
// 这里用与 apps/server/deno.json compile 相同的权限起子进程,确认走 cat 兜底能读到。
|
|
import { fileURLToPath } from "node:url";
|
|
import { describe, expect, it } from "vitest";
|
|
|
|
const here = fileURLToPath(new URL(".", import.meta.url));
|
|
const probe = `
|
|
import { readProcText } from "${here}../../src/proc-read.ts";
|
|
import { readResources } from "${here}../../src/modules/system/resources.ts";
|
|
const stat = await readProcText("/proc/stat");
|
|
const r = await readResources();
|
|
console.log(JSON.stringify({ stat: !!stat && stat.startsWith("cpu"), host: r.host != null, mem: r.meminfo != null }));
|
|
`;
|
|
|
|
describe.skipIf(Deno.build.os !== "linux")("readProcText 在生产权限下", () => {
|
|
it("走 cat 兜底读到 /proc 与资源读数", async () => {
|
|
const out = await new Deno.Command(Deno.execPath(), {
|
|
args: [
|
|
"run",
|
|
"--no-prompt",
|
|
"--allow-net",
|
|
"--allow-env",
|
|
"--allow-sys",
|
|
"--allow-read",
|
|
"--allow-write",
|
|
"--allow-run=ffprobe,sha256sum,cat",
|
|
"-",
|
|
],
|
|
stdin: "piped",
|
|
stdout: "piped",
|
|
stderr: "piped",
|
|
}).spawn();
|
|
const w = out.stdin.getWriter();
|
|
await w.write(new TextEncoder().encode(probe));
|
|
await w.close();
|
|
const o = await out.output();
|
|
const text = new TextDecoder().decode(o.stdout).trim();
|
|
expect(o.success, new TextDecoder().decode(o.stderr)).toBe(true);
|
|
expect(JSON.parse(text.split("\n").at(-1)!)).toEqual({ stat: true, host: true, mem: true });
|
|
}, 60_000);
|
|
});
|