chore(lint): forbid node:os in product tests

Add a no-restricted-imports override so a product *.test.ts that imports
node:os is a lint error pointing at mkdtempForTest, mirroring the existing
node:child_process ban. A follow-up override clears it for the handful of tests
that mock production's os.tmpdir()/os.homedir() or assert a real /tmp socket.

Author: thymikee

oxlint.config.ts

@@ -146,5 +146,42 @@ export default defineConfig({
         output: 'writable',
       },
     },
+    {
+      // Product tests get scratch from the package tmp-dir helpers, which honor the run's
+      // redirected TMPDIR; reading node:os reuses a fixed path across the suite. A file with a
+      // justified read (mocking production, a real socket path, or the TMPDIR mechanism itself)
+      // oxlint-disables its one import line with a reason instead of widening this list.
+      files: [
+        'src/**/*.test.ts',
+        'src/**/*.fixtures.ts',
+        'src/**/__tests__/**/*.ts',
+        'src/**/test-utils/**/*.ts',
+        'packages/*/src/**/*.test.ts',
+        'packages/*/src/**/*.fixtures.ts',
+        'packages/*/src/**/__tests__/**/*.ts',
+        'packages/*/src/**/test-utils/**/*.ts',
+      ],
+      rules: {
+        'no-restricted-imports': [
+          'error',
+          {
+            paths: [
+              {
+                name: 'node:os',
+                message:
+                  'Create test scratch with mkdtempForTest()/mkdtempForTestSync() from the package tmp-dir helper instead of reading node:os.',
+              },
+            ],
+          },
+        ],
+      },
+    },
+    {
+      // The tmp-dir helper modules are the sanctioned os.tmpdir() readers.
+      files: ['**/tmp-dir.ts', '**/tmp-dir.fixtures.ts'],
+      rules: {
+        'no-restricted-imports': ['error', { paths: [] }],
+      },
+    },
   ],
 });

packages/host-kit/src/code-signature-cache.test.ts

@@ -1,5 +1,6 @@
 import assert from 'node:assert/strict';
 import fs from 'node:fs';
+// oxlint-disable-next-line no-restricted-imports -- vi.spyOn(os,'tmpdir') aims production's cache home
 import os from 'node:os';
 import path from 'node:path';
 import { afterEach, test, vi } from 'vitest';

packages/platform-android/src/__tests__/install-artifact-cancellation.test.ts

@@ -1,6 +1,7 @@
 import assert from 'node:assert/strict';
 import dns from 'node:dns/promises';
 import { promises as fs } from 'node:fs';
+// oxlint-disable-next-line no-restricted-imports -- vi.spyOn(os,'tmpdir') aims production's install scratch
 import os from 'node:os';
 import path from 'node:path';
 import { Readable } from 'node:stream';

packages/platform-apple/src/runner/__tests__/runner-xctestrun.test.ts

@@ -1,6 +1,7 @@
 import { test, vi, beforeEach } from 'vitest';
 import assert from 'node:assert/strict';
 import fs from 'node:fs';
+// oxlint-disable-next-line no-restricted-imports -- mirrors production's os.tmpdir xctestrun path
 import os from 'node:os';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';

packages/platform-web/src/__tests__/test-utils.ts

@@ -1,5 +1,6 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
+// oxlint-disable-next-line no-restricted-imports -- real Unix socket path under TMPDIR (104-char limit)
 import os from 'node:os';
 import path from 'node:path';
 import type { CommandExecutorOverride, ExecOptions } from '@agent-device/host-kit/command';

src/__tests__/cli-diff.test.ts

@@ -1,6 +1,7 @@
 import { describe, test } from 'vitest';
 import assert from 'node:assert/strict';
 import fs from 'node:fs';
+// oxlint-disable-next-line no-restricted-imports -- asserts the default diff path under os.tmpdir
 import os from 'node:os';
 import path from 'node:path';
 import { PNG } from '@agent-device/capture-kit/png';

src/__tests__/daemon-process-takeover.test.ts

@@ -1,6 +1,7 @@
 import assert from 'node:assert/strict';
 import { spawn } from 'node:child_process';
 import fs from 'node:fs';
+// oxlint-disable-next-line no-restricted-imports -- real /tmp socket path within the 104-char limit
 import os from 'node:os';
 import path from 'node:path';
 import { afterEach, test } from 'vitest';

src/__tests__/hermetic-env-setup.test.ts

@@ -1,3 +1,4 @@
+// oxlint-disable-next-line no-restricted-imports -- exercises the TMPDIR mechanism and os.availableParallelism
 import os from 'node:os';
 import path from 'node:path';
 import { afterEach, test, vi } from 'vitest';

src/__tests__/hermetic-env-setup.ts

@@ -1,4 +1,5 @@
 import fs from 'node:fs';
+// oxlint-disable-next-line no-restricted-imports -- sets the run's TMPDIR; must read the real tmpdir
 import os from 'node:os';
 import path from 'node:path';
 import { afterEach } from 'vitest';

src/__tests__/install-source.test.ts

@@ -3,6 +3,7 @@ import assert from 'node:assert/strict';
 import dns from 'node:dns/promises';
 import fsSync from 'node:fs';
 import fs from 'node:fs/promises';
+// oxlint-disable-next-line no-restricted-imports -- vi.spyOn(os,'tmpdir') aims production's install source
 import os from 'node:os';
 import path from 'node:path';
 import { Readable } from 'node:stream';