test: remove the temporary directories tests create

src/bridges/user/web/test/orpc-router.integration.test.ts

@@ -7,8 +7,6 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import * as fs from "node:fs";
 import net from "node:net";
-import { tmpdir } from "node:os";
-import * as path from "node:path";
 import WsWebSocket from "ws";
 import { createORPCClient, getEventMeta } from "@orpc/client";
 import { RPCLink, type WebSocketLike } from "@orpc/client/websocket";
@@ -19,6 +17,7 @@ import {
   freeLocalPort,
   unreachableHubUrl,
 } from "../../../../test/hub-helpers.js";
+import { scratchDirectory } from "../../../../test/scratch-directory.helper.js";
 
 type MeshClient = ContractRouterClient<typeof meshContract>;
 
@@ -70,7 +69,7 @@ async function setup(): Promise<{ client: MeshClient; port: number }> {
 let isolatedHome: string | undefined;
 
 beforeEach(() => {
-  isolatedHome = fs.mkdtempSync(path.join(tmpdir(), "agent-comms-orpc-home-"));
+  isolatedHome = scratchDirectory("agent-comms-orpc-home-");
   vi.stubEnv("HOME", isolatedHome);
 });
 

src/bridges/user/web/test/web-assets.unit.test.ts

@@ -4,13 +4,13 @@
 
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
 import * as fs from "node:fs";
-import * as os from "node:os";
 import * as path from "node:path";
 import {
   createFrontendAssetLoader,
   FrontendNotBuiltError,
   loadFrontendAssets,
 } from "../web-assets.js";
+import { scratchDirectory } from "../../../../test/scratch-directory.helper.js";
 
 const ICON_FILENAMES = [
   "icon-96x96.svg",
@@ -21,7 +21,7 @@ const ICON_FILENAMES = [
 let assetDir: string;
 
 beforeEach(() => {
-  assetDir = fs.mkdtempSync(path.join(os.tmpdir(), "web-assets-"));
+  assetDir = scratchDirectory("web-assets-");
 });
 
 afterEach(() => {

src/bridges/user/web/test/web-console-route.integration.test.ts

@@ -4,7 +4,6 @@
 
 import { describe, it, expect, afterEach } from "vitest";
 import * as fs from "node:fs";
-import * as os from "node:os";
 import * as path from "node:path";
 import http from "node:http";
 import net from "node:net";
@@ -14,6 +13,7 @@ import {
   freeLocalPort,
   unreachableHubUrl,
 } from "../../../../test/hub-helpers.js";
+import { scratchDirectory } from "../../../../test/scratch-directory.helper.js";
 
 const ENV_VAR = "AGENT_COMMS_WEB_CONSOLE_DIST";
 const HTTP_OK = 200;
@@ -105,7 +105,7 @@ describe("web-console route (opt-in)", () => {
 
   it("serves web-console's index.html and assets when the dist dir is configured", async () => {
     originalEnv = process.env[ENV_VAR];
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "web-console-dist-"));
+    tmpDir = scratchDirectory("web-console-dist-");
     fs.writeFileSync(
       path.join(tmpDir, "index.html"),
       "<!doctype html><title>web-console</title>",

src/bridges/user/web/test/web-console-static.unit.test.ts

@@ -4,14 +4,14 @@
 
 import { describe, it, expect, beforeEach, afterEach } from "vitest";
 import * as fs from "node:fs";
-import * as os from "node:os";
 import * as path from "node:path";
 import type http from "node:http";
 import {
   resolveWebConsoleDist,
   serveWebConsole,
   WEB_CONSOLE_MOUNT,
 } from "../web-console-static.js";
+import { scratchDirectory } from "../../../../test/scratch-directory.helper.js";
 
 const ENV_VAR = "AGENT_COMMS_WEB_CONSOLE_DIST";
 const HTTP_OK = 200;
@@ -37,7 +37,7 @@ afterEach(() => {
 });
 
 function makeDistDir(): string {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "web-console-dist-"));
+  const dir = scratchDirectory("web-console-dist-");
   fs.writeFileSync(
     path.join(dir, "index.html"),
     "<!doctype html><title>web-console</title>",
@@ -62,7 +62,7 @@ describe("resolveWebConsoleDist", () => {
   });
 
   it("returns undefined when the configured directory has no index.html", () => {
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "web-console-empty-"));
+    tmpDir = scratchDirectory("web-console-empty-");
     process.env[ENV_VAR] = tmpDir;
     expect(resolveWebConsoleDist()).toBeUndefined();
   });

src/test/account-join.integration.test.ts

@@ -3,8 +3,6 @@
  */
 
 import * as fs from "node:fs";
-import * as path from "node:path";
-import { tmpdir } from "node:os";
 import { afterEach, describe, expect, it } from "vitest";
 import type { Clock } from "wire-mesh-core/ports/clock";
 import { DEFAULT_CONNECTION_CODE_TTL_MS } from "../core/connection-code.js";
@@ -14,6 +12,7 @@ import type { Visibility } from "../core/types.js";
 import { runAccountCommand, type AccountCliIo } from "../account-cli.js";
 import { freeLocalPort, realHubOverWs, TeardownStack } from "./hub-helpers.js";
 import { waitFor, wireTestTransport } from "./test-transport.js";
+import { scratchDirectory } from "./scratch-directory.helper.js";
 
 /** A device-id is a 64-character lowercase hex SHA-256 digest. */
 const DEVICE_ID_HEX_LENGTH = 64;
@@ -33,7 +32,7 @@ afterEach(async () => {
 });
 
 function userDir(): string {
-  const dir = fs.mkdtempSync(path.join(tmpdir(), "account-join-user-"));
+  const dir = scratchDirectory("account-join-user-");
   dirs.push(dir);
   return dir;
 }

src/test/account-ledger-helpers.ts

@@ -4,7 +4,6 @@
 
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { tmpdir } from "node:os";
 import { createMemoryStorage } from "wire-mesh-core/adapters/memory-storage";
 import { createSystemClock } from "wire-mesh-core/adapters/system-clock";
 import type { KeyValueStorage } from "wire-mesh-core/ports/storage";
@@ -19,6 +18,7 @@ import type { AccountLedger } from "../core/account-ledger.js";
 import { loadOrCreateUserIdentity } from "../core/user-identity.js";
 import type { TeardownStack } from "./hub-helpers.js";
 import { wireTestTransportWithHub } from "./test-transport.js";
+import { scratchDirectory } from "./scratch-directory.helper.js";
 
 /** Short enough that the ledger's announcement round, which rides the re-advertise cadence, fires many times within a test's wait budget. */
 export const FAST_GOSSIP_INTERVAL_MS = 50;
@@ -27,7 +27,7 @@ const dirs: string[] = [];
 
 /** A fresh throwaway directory for one machine's user-identity.json, removed by removeUserDirs. */
 export function userDir(): string {
-  const dir = fs.mkdtempSync(path.join(tmpdir(), "ledger-replication-user-"));
+  const dir = scratchDirectory("ledger-replication-user-");
   dirs.push(dir);
   return dir;
 }

src/test/account-ledger-lock.integration.test.ts

@@ -3,14 +3,14 @@
  */
 
 import * as fs from "node:fs";
-import { tmpdir } from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawn } from "node:child_process";
 import { afterEach, expect, test } from "vitest";
 import { createSystemClock } from "wire-mesh-core/adapters/system-clock";
 import { openAccountLedger } from "../core/account-ledger-store.js";
 import { loadOrCreateUserIdentity } from "../core/user-identity.js";
+import { scratchDirectory } from "./scratch-directory.helper.js";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const WORKER_SCRIPT = path.join(__dirname, "account-ledger-lock-worker.ts");
@@ -64,7 +64,7 @@ test(
   "concurrent processes appending to one machine's ledger lose no grant",
   { timeout: START_DELAY_MS + TIMEOUT_HEADROOM_MS },
   async () => {
-    const dir = fs.mkdtempSync(path.join(tmpdir(), "account-ledger-lock-"));
+    const dir = scratchDirectory("account-ledger-lock-");
     dirs.push(dir);
     const userIdentityOptions = { dir };
     const userIdentity = loadOrCreateUserIdentity(userIdentityOptions);

src/test/account-ledger.unit.test.ts

@@ -3,7 +3,6 @@
  */
 
 import * as fs from "node:fs";
-import { tmpdir } from "node:os";
 import path from "node:path";
 import { describe, expect, it } from "vitest";
 import { createMemoryStorage } from "wire-mesh-core/adapters/memory-storage";
@@ -38,6 +37,7 @@ import {
   readLegacyIssuedGrants,
 } from "../core/user-identity.js";
 import { toIdentityPort } from "../core/wire-mesh-identity.js";
+import { scratchDirectory } from "./scratch-directory.helper.js";
 
 type LedgerFrame = DataHaveFrame | DataRequestFrame | DataEntriesFrame;
 
@@ -249,7 +249,7 @@ describe("account ledger replication", () => {
   it("never misses a replicated grant while another bridge on the machine is storing that log", async () => {
     const account = generateIdentity();
     const origin = machineLedger(account);
-    const dir = fs.mkdtempSync(path.join(tmpdir(), "agent-comms-ledger-fs-"));
+    const dir = scratchDirectory("agent-comms-ledger-fs-");
     const tornWrite = pausingHeadWrites(createNodeFsStorage({ dir }));
     const machineLock = `${dir}.lock`;
     const replicator = new AccountLedger({
@@ -319,7 +319,7 @@ describe("account ledger replication", () => {
 
 describe("openAccountLedger", () => {
   function userDir(): string {
-    return fs.mkdtempSync(path.join(tmpdir(), "agent-comms-account-ledger-"));
+    return scratchDirectory("agent-comms-account-ledger-");
   }
 
   function writeLegacyGrants(dir: string): void {

src/test/account-transfer.unit.test.ts

@@ -3,7 +3,6 @@
  */
 
 import * as fs from "node:fs";
-import { tmpdir } from "node:os";
 import path from "node:path";
 import { describe, expect, it } from "vitest";
 import { createSystemClock } from "wire-mesh-core/adapters/system-clock";
@@ -32,11 +31,12 @@ import {
   runAccountCommand,
   type AccountCliIo,
 } from "../account-cli.js";
+import { scratchDirectory } from "./scratch-directory.helper.js";
 
 const PASSPHRASE = "correct horse battery staple";
 
 function tempDir(): string {
-  return fs.mkdtempSync(path.join(tmpdir(), "agent-comms-account-transfer-"));
+  return scratchDirectory("agent-comms-account-transfer-");
 }
 
 function principalIn(dir: string): string {

src/test/bridge-mesh-data-directory.integration.test.ts

@@ -1,5 +1,4 @@
 import * as fs from "node:fs";
-import * as os from "node:os";
 import * as path from "node:path";
 import { afterEach, beforeEach, expect, it, vi } from "vitest";
 import { createSystemClock } from "wire-mesh-core/adapters/system-clock";
@@ -36,13 +35,14 @@ import {
   unreachableHubUrl,
 } from "./hub-helpers.js";
 import { waitFor } from "./test-transport.js";
+import { scratchDirectory } from "./scratch-directory.helper.js";
 
 let root: string;
 let defaultDir: string;
 const cleanups = new TeardownStack();
 
 beforeEach(() => {
-  root = fs.mkdtempSync(path.join(os.tmpdir(), "agent-comms-data-dir-"));
+  root = scratchDirectory("agent-comms-data-dir-");
   defaultDir = path.join(root, "environment-default");
   vi.stubEnv(DATA_DIR_ENV_VAR, defaultDir);
 });

src/test/bridge-mesh-version-drift.integration.test.ts

@@ -4,21 +4,17 @@
  * fetchLatestVersion is injected in every test here specifically so this file never makes a real network call to the npm registry -- see bridge-mesh.ts's own header on why that parameter exists.
  */
 
-import * as fs from "node:fs";
-import { tmpdir } from "node:os";
-import path from "node:path";
 import { test, expect } from "vitest";
 import { createBridgeMesh } from "../core/bridge-mesh.js";
 import { freeLocalPort } from "./hub-helpers.js";
 import { getOwnPackageVersion } from "../core/package-version.js";
 import { buildAction } from "../core/bridge.js";
 import type { IdentitySlot } from "../core/identity-store.js";
 import type { CommsTool } from "../core/tool.js";
+import { scratchDirectory } from "./scratch-directory.helper.js";
 
 function tempSlot(harness: string): IdentitySlot {
-  const dir = fs.mkdtempSync(
-    path.join(tmpdir(), "agent-comms-bridge-mesh-version-drift-test-"),
-  );
+  const dir = scratchDirectory("agent-comms-bridge-mesh-version-drift-test-");
   return { harness, cwd: "/tmp/project", dir };
 }
 

src/test/bridge-mesh.integration.test.ts

@@ -2,9 +2,6 @@
  * Unit tests for createBridgeMesh -- the shared factory every bridge builds its own MeshStore/WireMeshTransport/CommsTool from, replacing the identical four-line block each of the six bridges used to repeat against TlsTransport directly.
  */
 
-import * as fs from "node:fs";
-import { tmpdir } from "node:os";
-import path from "node:path";
 import { test, expect } from "vitest";
 import { deviceIdToHex } from "wire-mesh-core/domain/device-id";
 import {
@@ -20,14 +17,13 @@ import {
 import { waitFor } from "./test-transport.js";
 import { freeLocalPort } from "./hub-helpers.js";
 import { realHubOverWs, waitForCondition } from "./hub-helpers.js";
+import { scratchDirectory } from "./scratch-directory.helper.js";
 
 /** A device-id is a 64-character lowercase hex SHA-256 digest. */
 const DEVICE_ID_HEX_LENGTH = 64;
 
 function tempSlot(harness: string): IdentitySlot {
-  const dir = fs.mkdtempSync(
-    path.join(tmpdir(), "agent-comms-bridge-mesh-test-"),
-  );
+  const dir = scratchDirectory("agent-comms-bridge-mesh-test-");
   return { harness, cwd: "/tmp/project", dir };
 }
 

src/test/connection-code-ledger-persistence.unit.test.ts

@@ -3,19 +3,17 @@
  */
 
 import * as fs from "node:fs";
-import { tmpdir } from "node:os";
 import path from "node:path";
 import { test, expect } from "vitest";
 import {
   loadConnectionCodeLedger,
   saveConnectionCodeLedger,
   type IdentitySlot,
 } from "../core/identity-store.js";
+import { scratchDirectory } from "./scratch-directory.helper.js";
 
 function tempSlot(harness: string): IdentitySlot {
-  const dir = fs.mkdtempSync(
-    path.join(tmpdir(), "agent-comms-connection-code-ledger-test-"),
-  );
+  const dir = scratchDirectory("agent-comms-connection-code-ledger-test-");
   return { harness, cwd: "/tmp/project", dir };
 }
 

src/test/connection-code.unit.test.ts

@@ -2,9 +2,6 @@
  * Unit tests for ConnectionCodeLedger (agent-comms#188): the generate/redeem pair backing gateway_generate_connection_code/gateway_redeem_connection_code. Covers the always-checked nonce/expiry path standalone from the optional PGP-signature path, mirroring gateway-trust.test.ts's own split between plain-trust and slot-persistence describe blocks for the sibling allowlist class.
  */
 
-import * as fs from "node:fs";
-import { tmpdir } from "node:os";
-import path from "node:path";
 import * as openpgp from "openpgp";
 import { describe, expect, it, beforeAll } from "vitest";
 import {
@@ -13,11 +10,10 @@ import {
 } from "../core/connection-code.js";
 import type { IdentitySlot } from "../core/identity-store.js";
 import type { ConnectionCode } from "../core/types.js";
+import { scratchDirectory } from "./scratch-directory.helper.js";
 
 function tempSlot(harness: string): IdentitySlot {
-  const dir = fs.mkdtempSync(
-    path.join(tmpdir(), "agent-comms-connection-code-test-"),
-  );
+  const dir = scratchDirectory("agent-comms-connection-code-test-");
   return { harness, cwd: "/tmp/project", dir };
 }
 

src/test/device-membership.unit.test.ts

@@ -1,9 +1,6 @@
 /**
  * Unit tests for core/device-membership: admitDevice (mint, recorded in the account's grant ledger) and removeDevice (revoke every outstanding grant, recorded in the same ledger), the mint/revoke half of agent-comms#161. verifyDeviceMembership itself is covered separately in device-membership-verification.test.ts.
  */
-import * as fs from "node:fs";
-import { tmpdir } from "node:os";
-import path from "node:path";
 import { describe, it, expect } from "vitest";
 import { deviceIdToHex } from "wire-mesh-core/domain/device-id";
 import { createSystemClock } from "wire-mesh-core/adapters/system-clock";
@@ -20,13 +17,12 @@ import {
   groupPath,
   verifyDeviceMembership,
 } from "../core/device-membership-verification.js";
+import { scratchDirectory } from "./scratch-directory.helper.js";
 
 const TOKEN_TTL_MS = 60_000;
 
 function tempDir(): string {
-  return fs.mkdtempSync(
-    path.join(tmpdir(), "agent-comms-device-membership-test-"),
-  );
+  return scratchDirectory("agent-comms-device-membership-test-");
 }
 
 /** A real, persisted user-principal identity and its account ledger, opened the way a real bridge process opens them. */