test: give each launcher-spawning file its own TMPDIR

test/file-tmpdir.mjs

@@ -0,0 +1,20 @@
+// A private TMPDIR for the importing test file — `import "./file-tmpdir.mjs";`,
+// for side effect, first among its imports.
+//
+// The ENV VAR rather than a path threaded through each spawn: the launcher
+// writes `cache-fix-proxy-<port>.sha256` and its scratch CA under its OWN
+// os.tmpdir(), so the isolation only reaches it by being inherited. node:test
+// gives each FILE its own process, so one dir per file falls out of that.
+//
+// `exit`, not after(): it runs after every hook, so it cannot delete the dir
+// out from under a sweep that reaps ports once the cases are done, and it is
+// armed before the importing file's body runs rather than at the end of it.
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const FILE_TMP = mkdtempSync(join(tmpdir(), "ccf-test-"));
+process.env.TMPDIR = FILE_TMP;
+process.on("exit", () => {
+  try { rmSync(FILE_TMP, { recursive: true, force: true }); } catch { /* already gone */ }
+});

test/proxy-held-port.test.mjs

@@ -1,3 +1,6 @@
+// A private TMPDIR for this file, because the launchers spawned below write
+// under os.tmpdir(). First, so nothing reads one before it is set.
+import "./file-tmpdir.mjs";
 import { after, describe, it } from "node:test";
 import assert from "node:assert/strict";
 import http from "node:http";

test/proxy-holder-handover.test.mjs

@@ -1,3 +1,6 @@
+// A private TMPDIR for this file, because the launchers spawned below write
+// under os.tmpdir(). First, so nothing reads one before it is set.
+import "./file-tmpdir.mjs";
 import { after, describe, it } from "node:test";
 import assert from "node:assert/strict";
 import http from "node:http";

test/proxy-server.test.mjs

@@ -1,3 +1,6 @@
+// A private TMPDIR for this file, because the launchers spawned below write
+// under os.tmpdir(). First, so nothing reads one before it is set.
+import "./file-tmpdir.mjs";
 import { describe, it, before, after } from "node:test";
 import assert from "node:assert/strict";
 import http from "node:http";

test/proxy-shutdown-once.test.mjs

@@ -10,6 +10,10 @@
 // mutation-checked; it needed isolating, not deleting.
 //
 // node gives each FILE its own process, which is the whole mechanism.
+
+// A private TMPDIR for this file, because the launchers spawned below write
+// under os.tmpdir(). First, so nothing reads one before it is set.
+import "./file-tmpdir.mjs";
 import { describe, it } from "node:test";
 import assert from "node:assert/strict";
 import http from "node:http";

test/proxy-wrapper.test.mjs

@@ -1,3 +1,6 @@
+// A private TMPDIR for this file, because the launchers spawned below write
+// under os.tmpdir(). First, so nothing reads one before it is set.
+import "./file-tmpdir.mjs";
 import { after, describe, it } from "node:test";
 import assert from "node:assert/strict";
 import { withDeadline, exitWithin } from "./child-deadline.mjs";

test/stdio-epipe-survival.test.mjs

@@ -22,6 +22,10 @@
 // mode, and the holder through BOTH of its dispatch doors — `server` with
 // CACHE_FIX_HOLD_PORT=on was the one an earlier fix missed while the other
 // passed, so a single holder row would have called that fixed.
+
+// A private TMPDIR for this file, because the launchers spawned below write
+// under os.tmpdir(). First, so nothing reads one before it is set.
+import "./file-tmpdir.mjs";
 import { describe, it } from "node:test";
 import assert from "node:assert/strict";
 import net from "node:net";

test/tmp-isolation.test.mjs

@@ -0,0 +1,51 @@
+// What file-tmpdir.mjs sells, measured through a real process boundary rather
+// than read off its source.
+//
+// The property is not "the file cleans up after itself". It is that the scratch
+// of the process AND of everything it spawns lands somewhere private that is
+// gone when the process exits — the launcher writes its port record under its
+// own os.tmpdir(), and on a box that is also RUNNING the product that record is
+// named after a port a live holder may be serving.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, readdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const MODULE = join(dirname(fileURLToPath(import.meta.url)), "file-tmpdir.mjs");
+// The grandchild is the point: the launcher is a CHILD and reads its own
+// os.tmpdir(), so a redirection that does not cross the boundary isolates
+// nothing. Both markers are checked by the probe before it exits, because an
+// empty directory proves nothing if neither was ever written.
+const KID = 'require("node:fs").writeFileSync(require("node:path").join(require("node:os").tmpdir(), "kids"), "")';
+const PROBE = `
+import ${JSON.stringify(MODULE)};
+import { existsSync, writeFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+writeFileSync(join(tmpdir(), "mine"), "");
+spawnSync(process.execPath, ["-e", ${JSON.stringify(KID)}]);
+for (const m of ["mine", "kids"]) {
+  if (!existsSync(join(tmpdir(), m))) { console.error("marker never written: " + m); process.exit(3); }
+}`;
+
+test("a process that imports it leaves the tmpdir it inherited empty", () => {
+  const outer = mkdtempSync(join(tmpdir(), "ccf-tmpiso-"));
+  try {
+    const r = spawnSync(process.execPath, ["--input-type=module", "-e", PROBE],
+                        { env: { ...process.env, TMPDIR: outer }, encoding: "utf8", timeout: 30_000 });
+    assert.equal(r.status, 0,
+      `the probe never got far enough to measure anything: ${r.error ?? ""} ${r.stderr}`);
+    // Red both ways: with no redirection the markers land here, and with no
+    // cleanup the private dir stays here holding them.
+    assert.deepEqual(readdirSync(outer), [],
+      "the process left scratch in the tmpdir it inherited — on a developer's box " +
+      "that is the shared /tmp, where the launcher's records are named after ports " +
+      "a live proxy may be serving");
+  } finally {
+    rmSync(outer, { recursive: true, force: true });
+  }
+});