test: give each launcher-spawning file its own TMPDIR

The launcher writes cache-fix-proxy-<port>.sha256 under os.tmpdir() on every
spawn, and the tests spawn it with `{ ...process.env }`. So each run left those
records in the shared /tmp, and 2,145 had accumulated on this host.

Set once per file rather than at each spawn site, because the env is inherited —
this also covers sites added later, which is what went wrong the first time.
proxy-held-port already had a private TMPDIR at one of its eleven spawn sites,
with a comment explaining exactly why ("Asserting a global path can only ever
measure the machine's history"); the other ten never got it.

Measured with a private TMPDIR per run, before -> after:
  proxy-held-port        24 -> 0   (34/34)
  proxy-holder-handover  10 -> 0   (11/11)
  proxy-wrapper           7 -> 0   (45/45)
  stdio-epipe-survival    2 -> 0   (4/4)
  proxy-shutdown-once     1 -> 0   (3/3)
  proxy-server            0 -> 0   (32/32)  consistency, not a fix
The counts include the ccf-runsvc-, ccf-wild- and ccf-v6- directories these
files also left behind, not only the .sha256 records.

proxy-wrapper is a different family from the same cause: runWrapper forks the
wrapper with the inherited env and the launcher writes its scratch CA under
os.tmpdir(), so seven cache-fix-ca-scratch-* dirs survived each run for the seven
days its reaper waits. It goes through that file's own tempDir() registrar rather
than a raw mkdtempSync — the file has a meta-assertion requiring exactly that,
and it caught the first attempt.

In five of the six the cleanup hook is appended at EOF, so it cannot delete the
dir out from under a sweep that reaps ports after the cases: node runs root hooks
in registration order. proxy-wrapper is the exception — its removal rides the
file's existing tempDirs hook near the top, which is harmless there because that
is the file's only root hook, but the property does not hold uniformly.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: codeslake

test/proxy-held-port.test.mjs

@@ -5,14 +5,22 @@ import net from "node:net";
 import { execFileSync, spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { writeFile, rm } from "node:fs/promises";
-import { readdirSync, readFileSync, existsSync, mkdirSync, mkdtempSync, writeFileSync, rmSync, utimesSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, utimesSync, writeFileSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { tmpdir, availableParallelism } from "node:os";
 import { join, dirname } from "node:path";
 
 import { sourceFingerprintSync } from "../proxy/source-fingerprint.mjs";
 import { HOP_ENV, OURS, cmdOf, freePort as takePort, listeners, onPort } from "./proc-helpers.mjs";
 
+// A PRIVATE TMPDIR FOR THE WHOLE FILE. Every launcher spawned here inherits
+// process.env, and the launcher writes cache-fix-proxy-<port>.sha256 under
+// os.tmpdir() on each spawn — so without this the run leaves those records in
+// the shared /tmp, one per spawn. Set once rather than at each spawn site: the
+// env is inherited, so this also covers sites added later.
+const FILE_TMP = mkdtempSync(join(tmpdir(), "ccf-hp-"));
+process.env.TMPDIR = FILE_TMP;
+
 const launcherPath = join(dirname(fileURLToPath(import.meta.url)), "..", "bin", "claude-via-proxy.mjs");
 
 // WHAT A PROBE RESULT MEANS. One definition, because four hand-rolled ones is
@@ -2366,3 +2374,7 @@ after(async () => {
     await new Promise((r) => setTimeout(r, 700));
   }
 });
+
+// LAST, so it cannot delete the dir out from under a sweep that reaps ports
+// after the cases: node runs root hooks in registration order.
+after(() => { try { rmSync(FILE_TMP, { recursive: true, force: true }); } catch { /* gone */ } });

test/proxy-holder-handover.test.mjs

@@ -8,9 +8,18 @@ import { dirname, join } from "node:path";
 import { tmpdir } from "node:os";
 import { createHash } from "node:crypto";
 import { EventEmitter } from "node:events";
-import { mkdirSync, mkdtempSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { OURS, cmdOf, freePort as takePort, listeners, onPort } from "./proc-helpers.mjs";
 
+// A PRIVATE TMPDIR FOR THE WHOLE FILE. Every launcher spawned here inherits
+// process.env, and the launcher writes cache-fix-proxy-<port>.sha256 under
+// os.tmpdir() on each spawn — so without this the run leaves those records in
+// the shared /tmp, one per spawn, for every box the suite has ever run on.
+// Set once here rather than at each spawn site: the env is inherited, so this
+// also covers spawn sites added later.
+const FILE_TMP = mkdtempSync(join(tmpdir(), "ccf-hh-"));
+process.env.TMPDIR = FILE_TMP;
+
 const launcherPath = join(dirname(fileURLToPath(import.meta.url)), "..", "bin", "claude-via-proxy.mjs");
 
 // Its own file, and that is the point rather than tidiness. This case samples a
@@ -1011,3 +1020,7 @@ describe("openGap identity", () => {
   assert.ok(holder._gap === second, "a late 'error' from the retired gap cleared the live one");
 });
 });
+
+// LAST, so it cannot delete the dir out from under a sweep that reaps ports
+// after the cases: node runs root hooks in registration order.
+after(() => { try { rmSync(FILE_TMP, { recursive: true, force: true }); } catch { /* gone */ } });

test/proxy-server.test.mjs

@@ -5,14 +5,22 @@ import net from "node:net";
 import { execFileSync, spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { mkdir, writeFile, rm } from "node:fs/promises";
-import { readdirSync, readFileSync } from "node:fs";
+import { mkdtempSync, readFileSync, readdirSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, dirname } from "node:path";
 import { startProxy, upstreamPointsAtSelf } from "../proxy/server.mjs";
 import { startWatcher } from "../proxy/watcher.mjs";
 import { loadExtensions, getRegistry } from "../proxy/pipeline.mjs";
 import { OURS, cmdOf, freePort as takePort, listeners, onPort } from "./proc-helpers.mjs";
 
+// A PRIVATE TMPDIR FOR THE WHOLE FILE. Every launcher spawned here inherits
+// process.env, and the launcher writes cache-fix-proxy-<port>.sha256 under
+// os.tmpdir() on each spawn — so without this the run leaves those records in
+// the shared /tmp, one per spawn. Set once rather than at each spawn site: the
+// env is inherited, so this also covers sites added later.
+const FILE_TMP = mkdtempSync(join(tmpdir(), "ccf-ps-"));
+process.env.TMPDIR = FILE_TMP;
+
 const serverPath = join(dirname(fileURLToPath(import.meta.url)), "..", "proxy", "server.mjs");
 const launcherPath = join(dirname(fileURLToPath(import.meta.url)), "..", "bin", "claude-via-proxy.mjs");
 
@@ -1047,3 +1055,7 @@ describe("client-abandon abort", () => {
     } finally { restore(saved); if (h) await h.close(); }
   });
 });
+
+// LAST, so it cannot delete the dir out from under a sweep that reaps ports
+// after the cases: node runs root hooks in registration order.
+after(() => { try { rmSync(FILE_TMP, { recursive: true, force: true }); } catch { /* gone */ } });

test/proxy-shutdown-once.test.mjs

@@ -10,15 +10,24 @@
 // mutation-checked; it needed isolating, not deleting.
 //
 // node gives each FILE its own process, which is the whole mechanism.
-import { describe, it } from "node:test";
+import { after, describe, it } from "node:test";
 import assert from "node:assert/strict";
 import http from "node:http";
 import net from "node:net";
 import { spawn } from "node:child_process";
-import { readFileSync } from "node:fs";
+import { mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
 import { OURS, cmdOf, freePort, listeners } from "./proc-helpers.mjs";
+import { tmpdir } from "node:os";
+
+// A PRIVATE TMPDIR FOR THE WHOLE FILE. Every launcher spawned here inherits
+// process.env, and the launcher writes cache-fix-proxy-<port>.sha256 under
+// os.tmpdir() on each spawn — so without this the run leaves those records in
+// the shared /tmp, one per spawn. Set once rather than at each spawn site: the
+// env is inherited, so this also covers sites added later.
+const FILE_TMP = mkdtempSync(join(tmpdir(), "ccf-so-"));
+process.env.TMPDIR = FILE_TMP;
 
 const here = dirname(fileURLToPath(import.meta.url));
 const launcherPath = join(here, "..", "bin", "claude-via-proxy.mjs");
@@ -234,3 +243,7 @@ describe("shutdown runs once per stop", () => {
     }
   });
 });
+
+// LAST, so it cannot delete the dir out from under a sweep that reaps ports
+// after the cases: node runs root hooks in registration order.
+after(() => { try { rmSync(FILE_TMP, { recursive: true, force: true }); } catch { /* gone */ } });

test/proxy-wrapper.test.mjs

@@ -37,6 +37,13 @@ function tempDir(prefix) {
   tempDirs.push(d);
   return d;
 }
+// A PRIVATE TMPDIR FOR THE WHOLE FILE, for the same reason the launcher-spawning
+// files carry one: runWrapper forks the wrapper with the inherited env, and the
+// launcher writes its scratch CA under os.tmpdir() — measured, 7
+// cache-fix-ca-scratch-* dirs left in the shared /tmp per run, collected by the
+// launcher's own reaper only after seven days.
+process.env.TMPDIR = tempDir("ccf-pw-");
+
 after(() => {
   for (const d of tempDirs) {
     try { rmSync(d, { recursive: true, force: true }); } catch { /* already gone */ }

test/stdio-epipe-survival.test.mjs

@@ -22,14 +22,23 @@
 // mode, and the holder through BOTH of its dispatch doors — `server` with
 // CACHE_FIX_HOLD_PORT=on was the one an earlier fix missed while the other
 // passed, so a single holder row would have called that fixed.
-import { describe, it } from "node:test";
+import { after, describe, it } from "node:test";
 import assert from "node:assert/strict";
 import net from "node:net";
 import { spawn } from "node:child_process";
-import { readFileSync } from "node:fs";
+import { mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { withDeadline } from "./child-deadline.mjs";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
+import { tmpdir } from "node:os";
+
+// A PRIVATE TMPDIR FOR THE WHOLE FILE. Every launcher spawned here inherits
+// process.env, and the launcher writes cache-fix-proxy-<port>.sha256 under
+// os.tmpdir() on each spawn — so without this the run leaves those records in
+// the shared /tmp, one per spawn. Set once rather than at each spawn site: the
+// env is inherited, so this also covers sites added later.
+const FILE_TMP = mkdtempSync(join(tmpdir(), "ccf-se-"));
+process.env.TMPDIR = FILE_TMP;
 
 const root = join(dirname(fileURLToPath(import.meta.url)), "..");
 const reap = (p) => { try { process.kill(-p.pid, "SIGKILL"); } catch {} try { p.kill("SIGKILL"); } catch {} };
@@ -192,3 +201,7 @@ describe("a dead stdio reader does not kill the port's process", () => {
 // does this holder have", which is a number on the machine, not a shape in the
 // source. `openStandby` states the same identity rule twenty lines below and had
 // always followed it; this is the sibling that was missed in the same sweep.
+
+// LAST, so it cannot delete the dir out from under a sweep that reaps ports
+// after the cases: node runs root hooks in registration order.
+after(() => { try { rmSync(FILE_TMP, { recursive: true, force: true }); } catch { /* gone */ } });