feat: add isolated portable profile smoke

Author: bruceblink

docs/windows-distribution.md

@@ -21,7 +21,9 @@ Before distributing a portable ZIP, run its release executable from a fresh temp
 .\scripts\smoke-portable-startup.ps1 -ArchivePath "dist\FlashShot-0.1.0-windows-x86_64.zip"
 ```
 
-This is an artifact-startup preflight, not a substitute for manually testing on a clean Windows user profile.
+The smoke script sets `FLASH_SHOT_PROFILE_DIR` to a disposable directory and verifies that config,
+data, cache, and history are initialized there. This is an isolated profile preflight, not a
+substitute for manually testing on a clean Windows user account.
 
 The package intentionally does not include FFmpeg. Recording users must install a compatible FFmpeg build or set `FLASH_SHOT_FFMPEG` to its executable path. This keeps the application license boundary and FFmpeg distribution choice explicit.
 

scripts/smoke-portable-startup.ps1

@@ -21,6 +21,8 @@ if (Get-Process -Name "flash-shot" -ErrorAction SilentlyContinue) {
 
 $packageRoot = [IO.Path]::GetFileNameWithoutExtension($archive)
 $staging = Join-Path ([IO.Path]::GetTempPath()) ("flash-shot-portable-smoke-" + [guid]::NewGuid())
+$profileDirectory = Join-Path $staging "profile"
+$previousProfileDirectory = [Environment]::GetEnvironmentVariable("FLASH_SHOT_PROFILE_DIR", "Process")
 $process = $null
 try {
     Expand-Archive -LiteralPath $archive -DestinationPath $staging
@@ -29,14 +31,21 @@ try {
         throw "Portable archive has no flash-shot executable at the expected path."
     }
 
+    New-Item -ItemType Directory -Force -Path $profileDirectory | Out-Null
+    [Environment]::SetEnvironmentVariable("FLASH_SHOT_PROFILE_DIR", $profileDirectory, "Process")
     $process = Start-Process -FilePath $executable -WorkingDirectory (Split-Path -Parent $executable) -PassThru
     Start-Sleep -Seconds $StartupSeconds
     $process.Refresh()
     if ($process.HasExited) {
         throw "Portable Flash Shot exited during startup with exit code $($process.ExitCode)."
     }
+    foreach ($requiredDirectory in @("config", "data", "cache", "history")) {
+        if (-not (Test-Path -LiteralPath (Join-Path $profileDirectory $requiredDirectory) -PathType Container)) {
+            throw "Portable Flash Shot did not initialize isolated profile directory '$requiredDirectory'."
+        }
+    }
 
-    Write-Host "Portable Flash Shot stayed running for $StartupSeconds seconds."
+    Write-Host "Portable Flash Shot stayed running for $StartupSeconds seconds with an isolated profile."
 }
 finally {
     if ($null -ne $process) {
@@ -46,6 +55,7 @@ finally {
             $process.WaitForExit()
         }
     }
+    [Environment]::SetEnvironmentVariable("FLASH_SHOT_PROFILE_DIR", $previousProfileDirectory, "Process")
     if (Test-Path -LiteralPath $staging) {
         Remove-Item -LiteralPath $staging -Recurse -Force
     }

src/diagnostics.rs

@@ -13,6 +13,7 @@ use directories::ProjectDirs;
 use log::{LevelFilter, Log, Metadata, Record};
 
 const LOG_FILE_NAME: &str = "flash-shot.jsonl";
+const PROFILE_DIR_ENV: &str = "FLASH_SHOT_PROFILE_DIR";
 type PanicHook = Box<dyn Fn(&panic::PanicHookInfo<'_>) + Sync + Send + 'static>;
 
 #[derive(Clone, Debug, Eq, PartialEq)]
@@ -25,23 +26,41 @@ pub struct AppPaths {
 
 impl AppPaths {
     pub fn discover() -> io::Result<Self> {
-        let project = ProjectDirs::from("com", "BruceBlink", "Flash Shot").ok_or_else(|| {
-            io::Error::new(
-                io::ErrorKind::NotFound,
-                "application directories unavailable",
-            )
-        })?;
-
-        let paths = Self {
-            config_dir: project.config_dir().to_path_buf(),
-            data_dir: project.data_dir().to_path_buf(),
-            cache_dir: project.cache_dir().to_path_buf(),
-            log_dir: project.data_dir().join("logs"),
-        };
+        let paths =
+            if let Some(root) = std::env::var_os(PROFILE_DIR_ENV).filter(|root| !root.is_empty()) {
+                Self::from_profile_root(PathBuf::from(root))
+            } else {
+                let project =
+                    ProjectDirs::from("com", "BruceBlink", "Flash Shot").ok_or_else(|| {
+                        io::Error::new(
+                            io::ErrorKind::NotFound,
+                            "application directories unavailable",
+                        )
+                    })?;
+                Self {
+                    config_dir: project.config_dir().to_path_buf(),
+                    data_dir: project.data_dir().to_path_buf(),
+                    cache_dir: project.cache_dir().to_path_buf(),
+                    log_dir: project.data_dir().join("logs"),
+                }
+            };
         paths.create()?;
         Ok(paths)
     }
 
+    /// Maps an explicit test profile root to every writable application directory.
+    ///
+    /// Keeping the root mapping in one place prevents a clean-profile run from accidentally
+    /// writing settings, metrics, logs, or cache entries into the user's normal profile.
+    fn from_profile_root(root: PathBuf) -> Self {
+        Self {
+            config_dir: root.join("config"),
+            data_dir: root.join("data"),
+            cache_dir: root.join("cache"),
+            log_dir: root.join("data").join("logs"),
+        }
+    }
+
     fn create(&self) -> io::Result<()> {
         for path in [
             &self.config_dir,
@@ -157,7 +176,7 @@ fn unix_timestamp_ms() -> u128 {
 
 #[cfg(test)]
 mod tests {
-    use super::{JsonLogger, LOG_FILE_NAME, Log, Metadata, Record};
+    use super::{AppPaths, JsonLogger, LOG_FILE_NAME, Log, Metadata, Record};
     use log::{Level, LevelFilter};
     use std::{fs::OpenOptions, sync::Mutex};
 
@@ -213,4 +232,15 @@ mod tests {
 
         assert!(!logger.enabled(&metadata));
     }
+
+    #[test]
+    fn profile_root_paths_are_kept_inside_the_explicit_root() {
+        let root = std::path::PathBuf::from("target/profile-fixture");
+        let paths = AppPaths::from_profile_root(root.clone());
+
+        assert_eq!(paths.config_dir, root.join("config"));
+        assert_eq!(paths.data_dir, root.join("data"));
+        assert_eq!(paths.cache_dir, root.join("cache"));
+        assert_eq!(paths.log_dir, root.join("data/logs"));
+    }
 }

src/history.rs

@@ -9,9 +9,13 @@ use std::{
 
 const INDEX_FILE: &str = "history.json";
 const DEFAULT_LIMIT: usize = 30;
+const PROFILE_DIR_ENV: &str = "FLASH_SHOT_PROFILE_DIR";
 
 /// Returns the only directory whose screenshot files this feature manages.
 pub fn managed_history_directory() -> io::Result<PathBuf> {
+    if let Some(root) = std::env::var_os(PROFILE_DIR_ENV).filter(|root| !root.is_empty()) {
+        return create_managed_history_directory(PathBuf::from(root).join("history"));
+    }
     let user_dirs = directories::UserDirs::new().ok_or_else(|| {
         io::Error::new(
             io::ErrorKind::NotFound,
@@ -24,7 +28,11 @@ pub fn managed_history_directory() -> io::Result<PathBuf> {
             "user picture directory is unavailable",
         )
     })?;
-    let directory = pictures.join("Flash Shot");
+    create_managed_history_directory(pictures.join("Flash Shot"))
+}
+
+/// Creates the history root selected by the current profile without exposing files outside it.
+fn create_managed_history_directory(directory: PathBuf) -> io::Result<PathBuf> {
     fs::create_dir_all(&directory)?;
     Ok(directory)
 }
@@ -358,6 +366,16 @@ mod tests {
         ))
     }
 
+    #[test]
+    fn isolated_profile_history_uses_its_private_root() {
+        let root = directory("profile");
+        let history = super::create_managed_history_directory(root.join("history")).unwrap();
+
+        assert_eq!(history, root.join("history"));
+        assert!(history.is_dir());
+        fs::remove_dir_all(root).unwrap();
+    }
+
     #[test]
     fn records_existing_managed_files_and_restores_them_on_restart() {
         let root = directory("reload");