test: give each launcher-spawning file its own TMPDIR

The launcher writes cache-fix-proxy-<port>.sha256 under os.tmpdir() on every
spawn, and the tests spawn it with `{ ...process.env }`. So each run left those
records in the shared /tmp: measured 17 per run of proxy-held-port alone, 23
across the five files, and 2,145 accumulated on this host — the largest single
family left in /tmp after a box-wide sweep, at roughly 1,400 an hour while the
suite was being run repeatedly.

That is the rate a 7-day reaper cannot win against, and it is not a production
rate at all: a production host spawns a proxy when a session starts.

Set once per file rather than at each of the 26 spawn sites, because the env is
inherited — this also covers sites added later, which is what went wrong the
first time. proxy-held-port already had a private TMPDIR at one of its eleven
spawn sites, with a comment explaining exactly why ("Asserting a global path can
only ever measure the machine's history"); the other ten never got it.

Measured per file, before -> after: proxy-held-port 17 -> 0, proxy-holder-handover
4 -> 0, proxy-shutdown-once 1 -> 0, stdio-epipe-survival 1 -> 0, proxy-server
0 -> 0. All five green, and the scratch dirs are removed in after().

Co-Authored-By: Claude <noreply@anthropic.com>

Author: codeslake

test/proxy-held-port.test.mjs

@@ -5,14 +5,23 @@ import net from "node:net";
 import { execFileSync, spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { writeFile, rm } from "node:fs/promises";
-import { readdirSync, readFileSync, existsSync, mkdirSync, mkdtempSync, writeFileSync, rmSync, utimesSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, utimesSync, writeFileSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { tmpdir, availableParallelism } from "node:os";
 import { join, dirname } from "node:path";
 
 import { sourceFingerprintSync } from "../proxy/source-fingerprint.mjs";
 import { HOP_ENV, OURS, cmdOf, freePort as takePort, listeners, onPort } from "./proc-helpers.mjs";
 
+// A PRIVATE TMPDIR FOR THE WHOLE FILE. Every launcher spawned here inherits
+// process.env, and the launcher writes cache-fix-proxy-<port>.sha256 under
+// os.tmpdir() on each spawn — so without this the run leaves those records in
+// the shared /tmp, one per spawn. Set once rather than at each spawn site: the
+// env is inherited, so this also covers sites added later.
+const FILE_TMP = mkdtempSync(join(tmpdir(), "ccf-hp-"));
+process.env.TMPDIR = FILE_TMP;
+after(() => { try { rmSync(FILE_TMP, { recursive: true, force: true }); } catch { /* gone */ } });
+
 const launcherPath = join(dirname(fileURLToPath(import.meta.url)), "..", "bin", "claude-via-proxy.mjs");
 
 // WHAT A PROBE RESULT MEANS. One definition, because four hand-rolled ones is

test/proxy-holder-handover.test.mjs

@@ -8,9 +8,19 @@ import { dirname, join } from "node:path";
 import { tmpdir } from "node:os";
 import { createHash } from "node:crypto";
 import { EventEmitter } from "node:events";
-import { mkdirSync, mkdtempSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { OURS, cmdOf, freePort as takePort, listeners, onPort } from "./proc-helpers.mjs";
 
+// A PRIVATE TMPDIR FOR THE WHOLE FILE. Every launcher spawned here inherits
+// process.env, and the launcher writes cache-fix-proxy-<port>.sha256 under
+// os.tmpdir() on each spawn — so without this the run leaves those records in
+// the shared /tmp, one per spawn, for every box the suite has ever run on.
+// Set once here rather than at each spawn site: the env is inherited, so this
+// also covers spawn sites added later.
+const FILE_TMP = mkdtempSync(join(tmpdir(), "ccf-hh-"));
+process.env.TMPDIR = FILE_TMP;
+after(() => { try { rmSync(FILE_TMP, { recursive: true, force: true }); } catch { /* gone */ } });
+
 const launcherPath = join(dirname(fileURLToPath(import.meta.url)), "..", "bin", "claude-via-proxy.mjs");
 
 // Its own file, and that is the point rather than tidiness. This case samples a

test/proxy-server.test.mjs

@@ -5,14 +5,23 @@ import net from "node:net";
 import { execFileSync, spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { mkdir, writeFile, rm } from "node:fs/promises";
-import { readdirSync, readFileSync } from "node:fs";
+import { mkdtempSync, readFileSync, readdirSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, dirname } from "node:path";
 import { startProxy, upstreamPointsAtSelf } from "../proxy/server.mjs";
 import { startWatcher } from "../proxy/watcher.mjs";
 import { loadExtensions, getRegistry } from "../proxy/pipeline.mjs";
 import { OURS, cmdOf, freePort as takePort, listeners, onPort } from "./proc-helpers.mjs";
 
+// A PRIVATE TMPDIR FOR THE WHOLE FILE. Every launcher spawned here inherits
+// process.env, and the launcher writes cache-fix-proxy-<port>.sha256 under
+// os.tmpdir() on each spawn — so without this the run leaves those records in
+// the shared /tmp, one per spawn. Set once rather than at each spawn site: the
+// env is inherited, so this also covers sites added later.
+const FILE_TMP = mkdtempSync(join(tmpdir(), "ccf-ps-"));
+process.env.TMPDIR = FILE_TMP;
+after(() => { try { rmSync(FILE_TMP, { recursive: true, force: true }); } catch { /* gone */ } });
+
 const serverPath = join(dirname(fileURLToPath(import.meta.url)), "..", "proxy", "server.mjs");
 const launcherPath = join(dirname(fileURLToPath(import.meta.url)), "..", "bin", "claude-via-proxy.mjs");
 

test/proxy-shutdown-once.test.mjs

@@ -1,3 +1,4 @@
+import { tmpdir } from "node:os";
 // ONE CASE, ITS OWN FILE — the same remedy proxy-holder-handover.test.mjs
 // applies to itself, and for the same measured reason.
 //
@@ -10,16 +11,25 @@
 // mutation-checked; it needed isolating, not deleting.
 //
 // node gives each FILE its own process, which is the whole mechanism.
-import { describe, it } from "node:test";
+import { after, describe, it } from "node:test";
 import assert from "node:assert/strict";
 import http from "node:http";
 import net from "node:net";
 import { spawn } from "node:child_process";
-import { readFileSync } from "node:fs";
+import { mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
 import { OURS, cmdOf, freePort, listeners } from "./proc-helpers.mjs";
 
+// A PRIVATE TMPDIR FOR THE WHOLE FILE. Every launcher spawned here inherits
+// process.env, and the launcher writes cache-fix-proxy-<port>.sha256 under
+// os.tmpdir() on each spawn — so without this the run leaves those records in
+// the shared /tmp, one per spawn. Set once rather than at each spawn site: the
+// env is inherited, so this also covers sites added later.
+const FILE_TMP = mkdtempSync(join(tmpdir(), "ccf-so-"));
+process.env.TMPDIR = FILE_TMP;
+after(() => { try { rmSync(FILE_TMP, { recursive: true, force: true }); } catch { /* gone */ } });
+
 const here = dirname(fileURLToPath(import.meta.url));
 const launcherPath = join(here, "..", "bin", "claude-via-proxy.mjs");
 const serverPath = join(here, "..", "proxy", "server.mjs");

test/stdio-epipe-survival.test.mjs

@@ -1,3 +1,4 @@
+import { tmpdir } from "node:os";
 // A DEAD LOG READER MUST NOT TAKE THE PROCESS THAT SERVES THE PORT.
 //
 // Measured outage, 27 minutes: a leftover `… | tee <file>` was killed, that tee
@@ -22,15 +23,24 @@
 // mode, and the holder through BOTH of its dispatch doors — `server` with
 // CACHE_FIX_HOLD_PORT=on was the one an earlier fix missed while the other
 // passed, so a single holder row would have called that fixed.
-import { describe, it } from "node:test";
+import { after, describe, it } from "node:test";
 import assert from "node:assert/strict";
 import net from "node:net";
 import { spawn } from "node:child_process";
-import { readFileSync } from "node:fs";
+import { mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { withDeadline } from "./child-deadline.mjs";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
 
+// A PRIVATE TMPDIR FOR THE WHOLE FILE. Every launcher spawned here inherits
+// process.env, and the launcher writes cache-fix-proxy-<port>.sha256 under
+// os.tmpdir() on each spawn — so without this the run leaves those records in
+// the shared /tmp, one per spawn. Set once rather than at each spawn site: the
+// env is inherited, so this also covers sites added later.
+const FILE_TMP = mkdtempSync(join(tmpdir(), "ccf-se-"));
+process.env.TMPDIR = FILE_TMP;
+after(() => { try { rmSync(FILE_TMP, { recursive: true, force: true }); } catch { /* gone */ } });
+
 const root = join(dirname(fileURLToPath(import.meta.url)), "..");
 const reap = (p) => { try { process.kill(-p.pid, "SIGKILL"); } catch {} try { p.kill("SIGKILL"); } catch {} };
 const cleanEnv = () => {