ci: adicionar diagnostico de permissoes e usar EFFECTIVE_APP_DIR no build\n\n- Passo 'Permissions diagnostic' lista donos/permissoes e test de escrita.\n- Build roda em para evitar /srv bloqueado.

.github/workflows/ci-cd-web-desktop.yml

@@ -77,6 +77,41 @@ jobs:
           node-version: 20
           cache: 'pnpm'
 
+      - name: Permissions diagnostic (server paths)
+        run: |
+          set +e
+          echo "== Basic context =="
+          whoami || true
+          id || true
+          groups || true
+          umask || true
+          echo "HOME=$HOME"
+          echo "APP_DIR(default)=${APP_DIR:-/srv/apps/sistema}"
+          echo "EFFECTIVE_APP_DIR=$EFFECTIVE_APP_DIR"
+
+          echo "\n== Permissions check =="
+          check_path() {
+            P="$1"
+            echo "-- $P"
+            if [ -e "$P" ]; then
+              stat -c '%A %U:%G %n' "$P" 2>/dev/null || ls -ld "$P" || true
+              echo -n "WRITABLE? "; [ -w "$P" ] && echo yes || echo no
+              if command -v namei >/dev/null 2>&1; then
+                namei -l "$P" || true
+              fi
+              TMP="$P/.permtest.$$"
+              (echo test > "$TMP" 2>/dev/null && echo "CREATE_FILE: ok" && rm -f "$TMP") || echo "CREATE_FILE: failed"
+            else
+              echo "(missing)"
+            fi
+          }
+          check_path "/srv/apps/sistema"
+          check_path "/srv/apps/sistema/src/app/machines/handshake"
+          check_path "/srv/apps/sistema/apps/desktop/node_modules"
+          check_path "/srv/apps/sistema/node_modules"
+          check_path "$EFFECTIVE_APP_DIR"
+          check_path "$EFFECTIVE_APP_DIR/node_modules"
+
       - name: Sync workspace to APP_DIR (preserving local env)
         run: |
           mkdir -p "$EFFECTIVE_APP_DIR"
@@ -114,7 +149,7 @@ jobs:
 
       - name: Install and build (Next.js)
         run: |
-          cd "$APP_DIR"
+          cd "$EFFECTIVE_APP_DIR"
           corepack enable || true
           pnpm install --no-frozen-lockfile
           pnpm prisma:generate