test: create test scratch via mkdtempForTest instead of os.tmpdir()

Route every product-test scratch directory through the per-package
mkdtempForTest/mkdtempForTestSync helpers so it lands under the run's
redirected TMPDIR and is removed once per run, instead of ad-hoc
path.join(os.tmpdir(), name) that reuses a fixed path across the suite.

Collapses the repeated daemon.log idiom to one scratch dir per call site,
drops now-redundant randomUUID/Date.now() uniqueness suffixes, and folds
two ad-hoc Android screenshot paths into the existing withTempScreenshot
helper. Adds the missing tmp-dir helpers to platform-harmonyos,
provider-webdriver, and replay-test and rounds out platform-apple's.

Adds an AST-based check-test-tmpdir gate + unit test that fails any product
test file reading os.tmpdir() directly, with a documented allowlist for the
tmpdir-mechanism, mirror-production, and unix-socket-length cases.

Also drops a stale installArgs field from a snapshot-helper manifest fixture
(a #2618 leftover) that broke typecheck.

Author: thymikee

packages/capture-kit/src/audio-probe-runtime.test.ts

@@ -1,6 +1,6 @@
 import assert from 'node:assert/strict';
 import { promises as fs } from 'node:fs';
-import os from 'node:os';
+
 import path from 'node:path';
 import { test } from 'vitest';
 import type {
@@ -19,6 +19,7 @@ import {
   createDurableResourceEnvelope,
   encodeDurableDescriptor,
 } from './durable-resource-envelope.ts';
+import { mkdtempForTest } from './tmp-dir.fixtures.ts';
 
 const device: DeviceInfo = {
   id: 'macos-host',
@@ -56,7 +57,7 @@ function envelopeWith(body: object) {
 }
 
 async function withStatusDir<T>(run: (dir: string) => Promise<T>): Promise<T> {
-  const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'audio-probe-kit-'));
+  const dir = await mkdtempForTest('audio-probe-kit-');
   try {
     return await run(dir);
   } finally {

packages/host-kit/src/internal/archive-extraction.fixtures.ts

@@ -1,16 +1,17 @@
 import { promises as fs } from 'node:fs';
-import os from 'node:os';
+
 import path from 'node:path';
 import { gzipSync } from 'node:zlib';
 import * as tar from 'tar-stream';
 import { runCmdSync } from './exec.ts';
+import { mkdtempForTest } from './tmp-dir.fixtures.ts';
 
 export async function createArchiveWorkspace(): Promise<{
   archivePath: string;
   outputRoot: string;
   root: string;
 }> {
-  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'agent-device-archive-'));
+  const root = await mkdtempForTest('agent-device-archive-');
   const outputRoot = path.join(root, 'output');
   await fs.mkdir(outputRoot);
   return { archivePath: path.join(root, 'fixture.archive'), outputRoot, root };

packages/host-kit/src/internal/durable-file.test.ts

@@ -1,9 +1,10 @@
 import assert from 'node:assert/strict';
 import fs from 'node:fs';
-import os from 'node:os';
+
 import path from 'node:path';
 import { afterEach, expect, test, vi } from 'vitest';
 import { isAtomicPublishTemporaryPath, publishDurableFileSync } from './atomic-file.ts';
+import { mkdtempForTestSync } from './tmp-dir.fixtures.ts';
 
 const roots: string[] = [];
 
@@ -109,7 +110,7 @@ test('preserves a file fsync error when descriptor cleanup also fails', () => {
 });
 
 function fixtureRoot(label: string): string {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), `agent-device-durable-file-${label}-`));
+  const root = mkdtempForTestSync(`agent-device-durable-file-${label}-`);
   roots.push(root);
   return root;
 }

packages/host-kit/src/internal/owner-identity.test.ts

@@ -1,6 +1,6 @@
 import assert from 'node:assert/strict';
 import fs from 'node:fs';
-import os from 'node:os';
+
 import path from 'node:path';
 import { afterEach, test, vi } from 'vitest';
 import {
@@ -10,6 +10,7 @@ import {
   type OwnerIdentity,
 } from './owner-identity.ts';
 import { readProcessStartTime } from './host-process.ts';
+import { mkdtempForTestSync } from './tmp-dir.fixtures.ts';
 
 afterEach(() => {
   vi.restoreAllMocks();
@@ -28,7 +29,10 @@ test('distinguishes dead and PID-reused owners', () => {
 
 test('distinguishes a gone state directory from permission and transient I/O failures', () => {
   const startTime = readProcessStartTime(process.pid);
-  const missing = path.join(os.tmpdir(), `agent-device-missing-owner-${Date.now()}`);
+  const missing = path.join(
+    mkdtempForTestSync('agent-device-missing-owner'),
+    `agent-device-missing-owner-${Date.now()}`,
+  );
   assert.equal(
     classifyOwnerLiveness({ owner: { pid: process.pid, startTime }, stateDir: missing }),
     'owner-state-dir-gone',

packages/host-kit/src/internal/verified-file.test.ts

@@ -1,6 +1,6 @@
 import assert from 'node:assert/strict';
 import fs from 'node:fs';
-import os from 'node:os';
+
 import path from 'node:path';
 import { afterEach, expect, test, vi } from 'vitest';
 import { AppError, normalizeError } from '@agent-device/kernel/errors';
@@ -17,6 +17,7 @@ import {
   openVerifiedFileForRead,
   openVerifiedFileForTruncate,
 } from './verified-file.ts';
+import { mkdtempForTestSync } from './tmp-dir.fixtures.ts';
 
 const roots: string[] = [];
 
@@ -111,7 +112,7 @@ test('returns absent for a missing read without creating the file', () => {
 });
 
 function fixturePath(label: string): string {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), `agent-device-verified-${label}-`));
+  const root = mkdtempForTestSync(`agent-device-verified-${label}-`);
   roots.push(root);
   return path.join(root, 'artifact');
 }

packages/platform-android/src/__tests__/app-deployment.test.ts

@@ -1,7 +1,7 @@
 import { test } from 'vitest';
 import assert from 'node:assert/strict';
 import { promises as fs } from 'node:fs';
-import os from 'node:os';
+
 import path from 'node:path';
 import { AppError } from '@agent-device/kernel/errors';
 import { installAndroidInstallablePath } from '../app-deployment.ts';
@@ -14,7 +14,8 @@ import { withAndroidAdbProvider } from '../adb-executor.ts';
 import type { DeviceInfo } from '@agent-device/kernel/device';
 import { assertRejectsAppError } from './test-utils/app-error.ts';
 import { withFakeAdb } from './test-utils/fake-adb.ts';
-import { mkdtempForTest } from './test-utils/tmp-dir.ts';
+
+import { mkdtempForTest, mkdtempForTestSync } from './test-utils/tmp-dir.ts';
 
 // The fake adb provider installs through the production withAndroidAdbProvider
 // scope, so `calls` records device-scoped args without a leading `-s <serial>`.
@@ -32,7 +33,10 @@ test('inferAndroidAppName derives readable names from package ids', () => {
 });
 
 test('installAndroidInstallablePath installs .apk via adb install -r', async () => {
-  const apkPath = path.join(os.tmpdir(), `agent-device-test-${Date.now()}.apk`);
+  const apkPath = path.join(
+    mkdtempForTestSync('agent-device-test'),
+    `agent-device-test-${Date.now()}.apk`,
+  );
   await fs.writeFile(apkPath, 'placeholder', 'utf8');
   await withFakeAdb(
     () => undefined,
@@ -49,7 +53,10 @@ test('installAndroidInstallablePath installs .apk via adb install -r', async ()
 });
 
 test('installAndroidInstallablePath uses provider install capability when available', async () => {
-  const apkPath = path.join(os.tmpdir(), `agent-device-provider-install-${Date.now()}.apk`);
+  const apkPath = path.join(
+    mkdtempForTestSync('agent-device-provider-install'),
+    `agent-device-provider-install-${Date.now()}.apk`,
+  );
   await fs.writeFile(apkPath, 'placeholder', 'utf8');
   const installCalls: Array<{ source: string; replace: boolean | undefined }> = [];
   const device: DeviceInfo = {
@@ -84,7 +91,10 @@ test('installAndroidInstallablePath uses provider install capability when availa
 test('an app install timeout keeps the generic adb-server advice', async () => {
   // The OEM install dialog can hold an app install too, but the helper-specific advice names an
   // agent-device helper package, so it must not leak onto the app-under-test install path.
-  const apkPath = path.join(os.tmpdir(), `agent-device-app-install-timeout-${Date.now()}.apk`);
+  const apkPath = path.join(
+    mkdtempForTestSync('agent-device-app-install-timeout'),
+    `agent-device-app-install-timeout-${Date.now()}.apk`,
+  );
   await fs.writeFile(apkPath, 'placeholder', 'utf8');
   const device: DeviceInfo = {
     platform: 'android',

packages/platform-android/src/__tests__/snapshot-helper-install.test.ts

@@ -26,7 +26,6 @@ const manifest: AndroidSnapshotHelperManifest = {
   targetSdk: 36,
   outputFormat: 'uiautomator-xml',
   statusProtocol: 'android-snapshot-helper-v1',
-  installArgs: ['install', '-r'],
 };
 
 beforeEach(() => {

packages/platform-android/src/__tests__/snapshot.test.ts

@@ -1,7 +1,7 @@
 import { afterEach, beforeEach, test, vi } from 'vitest';
 import assert from 'node:assert/strict';
 import { promises as fs } from 'node:fs';
-import os from 'node:os';
+
 import path from 'node:path';
 
 vi.mock('@agent-device/host-kit/command', async (importOriginal) => {
@@ -114,31 +114,29 @@ afterEach(async () => {
 
 test('screenshotAndroid waits for transient UI to settle before capture', async () => {
   const events: string[] = [];
-  const outPath = path.join(os.tmpdir(), `agent-device-android-screenshot-${Date.now()}.png`);
-
-  mockScreenshotEvents(events);
-
-  await screenshotAndroid(device, outPath);
+  await withTempScreenshot('screenshot-settle-', async (outPath) => {
+    mockScreenshotEvents(events);
+    await screenshotAndroid(device, outPath);
 
-  const relevantEvents = events.filter((event, index) => {
-    if (event !== 'enable') {
-      return true;
-    }
-    return index === 0;
+    const relevantEvents = events.filter((event, index) => {
+      if (event !== 'enable') {
+        return true;
+      }
+      return index === 0;
+    });
+    assert.deepEqual(relevantEvents, ['enable', 'settle:1000', 'capture', 'disable']);
   });
-  assert.deepEqual(relevantEvents, ['enable', 'settle:1000', 'capture', 'disable']);
 });
 
 test('screenshotAndroid skips stabilization when requested', async () => {
   const events: string[] = [];
-  const outPath = path.join(os.tmpdir(), `agent-device-android-screenshot-${Date.now()}.png`);
-
-  mockScreenshotEvents(events);
+  await withTempScreenshot('screenshot-stabilize-', async (outPath) => {
+    mockScreenshotEvents(events);
+    await screenshotAndroid(device, outPath, { stabilize: false });
 
-  await screenshotAndroid(device, outPath, { stabilize: false });
-
-  assert.deepEqual(events, ['capture']);
-  assert.equal(mockSleep.mock.calls.length, 0);
+    assert.deepEqual(events, ['capture']);
+    assert.equal(mockSleep.mock.calls.length, 0);
+  });
 });
 
 test('screenshotAndroid writes a valid PNG when output is clean', async () => {

packages/platform-android/src/__tests__/test-utils/android-file-host.ts

@@ -2,7 +2,6 @@ import { constants } from 'node:fs';
 import {
   access,
   mkdir,
-  mkdtemp,
   open,
   readFile,
   readdir,
@@ -12,9 +11,10 @@ import {
   writeFile,
 } from 'node:fs/promises';
 import { createHash, randomUUID } from 'node:crypto';
-import os from 'node:os';
+
 import path from 'node:path';
 import type { AndroidAdbFileHost } from '../../adb-host.ts';
+import { mkdtempForTest } from './tmp-dir.ts';
 
 export function createAndroidFileHost(): AndroidAdbFileHost {
   return {
@@ -30,7 +30,7 @@ export function createAndroidFileHost(): AndroidAdbFileHost {
         return false;
       }
     },
-    makeTempDirectory: async (prefix) => await mkdtemp(path.join(os.tmpdir(), prefix)),
+    makeTempDirectory: async (prefix) => await mkdtempForTest(prefix),
     readBytes: async (filePath) => await readFile(filePath),
     readDirectory: async (directory) => await readdir(directory),
     readText: async (filePath) => await readFile(filePath, 'utf8'),

packages/platform-apple/src/__tests__/tmp-dir.ts

@@ -1,7 +1,14 @@
+import fs from 'node:fs';
 import fsPromises from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 
+// fallow-ignore-next-line code-duplication
 export async function mkdtempForTest(prefix: string): Promise<string> {
   return fsPromises.mkdtemp(path.join(os.tmpdir(), prefix));
 }
+
+// fallow-ignore-next-line code-duplication
+export function mkdtempForTestSync(prefix: string): string {
+  return fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+}