@danypops/pi-packed 0.21.11 → 0.21.13

package/service/test/domain.test.ts

@@ -1,5 +1,5 @@
-import { describe, expect, it } from "bun:test";
-import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { afterEach, describe, expect, it } from "bun:test";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { AuthenticatedRpcClient } from "@danypops/vehicle-client/rpc-client";
@@ -17,8 +17,18 @@ import {
 } from "../src/packages/installed.ts";
 import type { Installer, PkgInfo, Registry, SearchPage, UpdateOutcome, UpdatesSnapshot } from "../src/packages/package.ts";
 
+const roots: string[] = [];
+afterEach(() => {
+	for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+function track(dir: string): string {
+	roots.push(dir);
+	return dir;
+}
+
 function writePiHome(settings: unknown, nodeModules: Record<string, string> = {}): string {
-	const dir = mkdtempSync(join(tmpdir(), "packed-pihome-"));
+	const dir = track(mkdtempSync(join(tmpdir(), "packed-pihome-")));
 	writeFileSync(join(dir, "settings.json"), JSON.stringify(settings));
 	for (const [name, version] of Object.entries(nodeModules)) {
 		const pkgDir = join(dir, "npm", "node_modules", name);
@@ -99,7 +109,7 @@ describe("readInstalledPackages", () => {
 	});
 
 	it("missing settings → empty", () => {
-		expect(readInstalledPackages(mkdtempSync(join(tmpdir(), "packed-")))).toEqual([]);
+		expect(readInstalledPackages(track(mkdtempSync(join(tmpdir(), "packed-"))))).toEqual([]);
 	});
 });
 
@@ -113,7 +123,7 @@ describe("readInstalledPackagesAcrossScopes", () => {
 
 	it("reproduces the real jittor gap: a stale project-scoped pin is invisible to a global-only read, visible once project scope is included", () => {
 		const home = writePiHome({ packages: ["npm:pi-global@1.0.0"] });
-		const projectRoot = mkdtempSync(join(tmpdir(), "packed-project-"));
+		const projectRoot = track(mkdtempSync(join(tmpdir(), "packed-project-")));
 		const projectHome = join(projectRoot, ".pi");
 		mkdirSync(projectHome, { recursive: true });
 		writeFileSync(join(projectHome, "settings.json"), JSON.stringify({ packages: ["npm:papyrus@0.21.2"] }));
@@ -128,7 +138,7 @@ describe("readInstalledPackagesAcrossScopes", () => {
 
 	it("is unaffected by a missing project settings file", () => {
 		const home = writePiHome({ packages: ["npm:pi-global@1.0.0"] });
-		const projectRoot = mkdtempSync(join(tmpdir(), "packed-project-"));
+		const projectRoot = track(mkdtempSync(join(tmpdir(), "packed-project-")));
 		expect(readInstalledPackagesAcrossScopes(home, projectRoot)).toEqual([
 			{ name: "pi-global", pinned: "1.0.0", installed: undefined, scope: "global" },
 		]);
@@ -214,13 +224,13 @@ class NoopInstaller implements Installer {
 
 describe("package.updates.project (daemon RPC wiring)", () => {
 	it("computes a live, cross-scope drift check on demand, distinct from package.updates' own persisted global-only snapshot", async () => {
-		const home = mkdtempSync(join(tmpdir(), "packed-updates-project-"));
+		const home = track(mkdtempSync(join(tmpdir(), "packed-updates-project-")));
 		writeFileSync(join(home, "settings.json"), JSON.stringify({ packages: ["npm:pi-global@1.0.0"] }));
-		const projectRoot = mkdtempSync(join(tmpdir(), "packed-updates-project-root-"));
+		const projectRoot = track(mkdtempSync(join(tmpdir(), "packed-updates-project-root-")));
 		const projectHome = join(projectRoot, ".pi");
 		mkdirSync(projectHome, { recursive: true });
 		writeFileSync(join(projectHome, "settings.json"), JSON.stringify({ packages: ["npm:papyrus@0.21.2"] }));
-		const stateDir = mkdtempSync(join(tmpdir(), "packed-updates-project-state-"));
+		const stateDir = track(mkdtempSync(join(tmpdir(), "packed-updates-project-state-")));
 		const db = openDb(dbPath(stateDir));
 		replaceAll(
 			db,
@@ -249,7 +259,7 @@ describe("package.updates.project (daemon RPC wiring)", () => {
 
 describe("updates store", () => {
 	it("roundtrips", async () => {
-		const dir = mkdtempSync(join(tmpdir(), "packed-"));
+		const dir = track(mkdtempSync(join(tmpdir(), "packed-")));
 		const snap = { checkedAt: new Date().toISOString(), updates: [{ name: "a", installed: "1", latest: "2", detectedAt: "" }] };
 		await saveUpdates(dir, snap);
 		expect(await loadUpdates(dir)).toEqual(snap);
@@ -259,7 +269,7 @@ describe("updates store", () => {
 
 describe("watcher producer", () => {
 	it("writes a snapshot on tick", async () => {
-		const dir = mkdtempSync(join(tmpdir(), "packed-"));
+		const dir = track(mkdtempSync(join(tmpdir(), "packed-")));
 		let signalTick: ((snapshot: UpdatesSnapshot) => void) | undefined;
 		const tick = new Promise<UpdatesSnapshot>((resolve) => {
 			signalTick = resolve;
@@ -282,7 +292,7 @@ describe("watcher producer", () => {
 
 describe("catalog status", () => {
 	it("stale when unsynced, fresh after sync", () => {
-		const dir = mkdtempSync(join(tmpdir(), "packed-"));
+		const dir = track(mkdtempSync(join(tmpdir(), "packed-")));
 		expect(catalogStatus(dir, 6 * 3_600_000).stale).toBe(true);
 		const db = openDb(`${dir}/packed.db`);
 		replaceAll(db, [{ name: "a", version: "1" }], "test");

package/service/test/index.test.ts

@@ -1,5 +1,5 @@
-import { afterAll, beforeAll, describe, expect, it } from "bun:test";
-import { mkdtempSync, readFileSync } from "node:fs";
+import { afterAll, afterEach, beforeAll, describe, expect, it } from "bun:test";
+import { mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import type { Server } from "bun";
@@ -7,6 +7,16 @@ import { buildIndex, generateIndex, indexPath, indexStatus, readIndex, writeInde
 import { dbPath, openDb, replaceAll } from "../src/packages/db.ts";
 import { HttpRegistry } from "../src/registry/registry.ts";
 
+const roots: string[] = [];
+afterEach(() => {
+	for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+function track(dir: string): string {
+	roots.push(dir);
+	return dir;
+}
+
 // Guards the "never bulk GitHub calls" constraint against regression: a
 // future edit could easily start threading a GitHub-commit fetcher through
 // buildIndex the same way scoreTarget does. A source-level check catches
@@ -89,7 +99,10 @@ describe("buildIndex", () => {
 		registry = new HttpRegistry(`http://127.0.0.1:${server.port}`, 250, 0, 1, `http://127.0.0.1:${server.port}`);
 	});
 
-	afterAll(() => server.stop(true));
+	afterAll(() => {
+		server.stop(true);
+		rmSync(catalogDir, { recursive: true, force: true });
+	});
 
 	it("builds one entry per cataloged package, skipping a lookup failure rather than failing the whole run", async () => {
 		const index = await buildIndex(registry, catalogDir, { delayMs: 0, currentPiVersion: async () => "0.83.0" });
@@ -123,7 +136,7 @@ describe("buildIndex", () => {
 
 describe("buildIndex bounds", () => {
 	it("never calls downloads() -- confirmed live to trigger npm's 429s at real catalog scale -- and truncates past maxPackages, marking the result", async () => {
-		const dir = mkdtempSync(join(tmpdir(), "packed-index-bounds-"));
+		const dir = track(mkdtempSync(join(tmpdir(), "packed-index-bounds-")));
 		const db = openDb(dbPath(dir));
 		replaceAll(
 			db,
@@ -160,7 +173,7 @@ describe("buildIndex bounds", () => {
 	});
 
 	it("collapses two concurrent callers into one run -- confirmed live to matter: the daemon's own maintenance tick and an on-demand CLI build overlapping compounded into a shutdown the daemon's SIGTERM grace period couldn't outlast", async () => {
-		const dir = mkdtempSync(join(tmpdir(), "packed-index-concurrent-"));
+		const dir = track(mkdtempSync(join(tmpdir(), "packed-index-concurrent-")));
 		const db = openDb(dbPath(dir));
 		replaceAll(db, [{ name: "pi-one", version: "1.0.0" }], "test");
 		db.close();
@@ -203,7 +216,7 @@ describe("buildIndex bounds", () => {
 
 describe("buildIndex incremental delta scanning", () => {
 	it("partitions the catalog into New/Changed/Unchanged against the prior index -- Unchanged makes zero live registry calls, New and Changed do", async () => {
-		const dir = mkdtempSync(join(tmpdir(), "packed-index-delta-"));
+		const dir = track(mkdtempSync(join(tmpdir(), "packed-index-delta-")));
 		const db = openDb(dbPath(dir));
 		replaceAll(
 			db,
@@ -275,7 +288,7 @@ describe("buildIndex incremental delta scanning", () => {
 	});
 
 	it("maxPackages bounds only the New+Changed live-call queue -- Unchanged entries beyond that count still complete", async () => {
-		const dir = mkdtempSync(join(tmpdir(), "packed-index-delta-bound-"));
+		const dir = track(mkdtempSync(join(tmpdir(), "packed-index-delta-bound-")));
 		const db = openDb(dbPath(dir));
 		// 5 unchanged entries alone already exceed maxPackages: 1 below.
 		replaceAll(
@@ -323,7 +336,7 @@ describe("buildIndex incremental delta scanning", () => {
 
 describe("index persistence", () => {
 	it("writes, reads, and reports staleness", async () => {
-		const dir = mkdtempSync(join(tmpdir(), "packed-index-store-"));
+		const dir = track(mkdtempSync(join(tmpdir(), "packed-index-store-")));
 		const path = indexPath(dir);
 		expect(readIndex(path)).toBeUndefined();
 		expect(indexStatus(path, 1_000).stale).toBe(true);
@@ -343,7 +356,7 @@ describe("index persistence", () => {
 	});
 
 	it("generateIndex builds and writes in one call", async () => {
-		const dir = mkdtempSync(join(tmpdir(), "packed-index-generate-"));
+		const dir = track(mkdtempSync(join(tmpdir(), "packed-index-generate-")));
 		const db = openDb(dbPath(dir));
 		replaceAll(db, [{ name: "pi-alpha", version: "1.0.0" }], "npm:keywords:pi-package");
 		db.close();

package/service/test/install-validation.test.ts

@@ -7,8 +7,8 @@
  * a broken fixture must genuinely be refused, a healthy one must genuinely
  * pass.
  */
-import { describe, expect, it } from "bun:test";
-import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { afterEach, describe, expect, it } from "bun:test";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -23,6 +23,16 @@ const BROKEN = join(FIXTURES, "broken-package");
 const NO_MANIFEST = join(FIXTURES, "no-manifest-package");
 const DEP_PACKAGE = join(FIXTURES, "dep-package");
 
+const roots: string[] = [];
+afterEach(() => {
+	for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+function track(dir: string): string {
+	roots.push(dir);
+	return dir;
+}
+
 /** Writes a fresh package into `dir` whose extension entry point has a real
  * runtime import (`packed-fixture-dep`, a `file:` dependency resolvable
  * fully offline) -- otherwise healthy, structurally identical to HEALTHY,
@@ -106,13 +116,46 @@ describe("HeadlessInstallValidator (real npm pack + tar extraction, no mocking)"
 		const validator = new HeadlessInstallValidator();
 		const result = await validator.validate(`npm:${HEALTHY}`);
 		expect(result.ok).toBe(true);
-		expect(result.extensions).toEqual([{ path: "extension/index.ts", ok: true }]);
+		expect(result.extensions).toHaveLength(1);
+		expect(result.extensions[0]).toMatchObject({ path: "extension/index.ts", ok: true });
+	}, 20_000);
+});
+
+describe("HeadlessInstallValidator (vehicle-client-pi pi-load-harness, non-gating diagnostic)", () => {
+	it("attaches all-three-path evidence for a real healthy package without changing its ok:true verdict", async () => {
+		const validator = new HeadlessInstallValidator();
+		const result = await validator.validate(`npm:${HEALTHY}`);
+		expect(result.ok).toBe(true);
+		expect(result.extensions).toHaveLength(1);
+		const paths = result.extensions[0]?.additionalLoadPaths;
+		expect(paths).toBeDefined();
+		expect(paths?.map((p) => p.path).sort()).toEqual(["jiti-try-native-false", "jiti-try-native-true", "native-esm"]);
+		expect(paths?.every((p) => p.ok)).toBe(true);
+	}, 20_000);
+
+	it("reports the broken fixture's additional paths as ok:true -- documents a real, deliberate difference in what's checked, not a bug", async () => {
+		// verifyLoadableUnderPi only checks that *importing* the module succeeds;
+		// it never calls the extension's exported factory the way mock-pi-cli's
+		// gating check does. BROKEN's factory only throws once invoked, so
+		// merely importing it succeeds on every path -- confirmed directly
+		// against the real child process, not assumed. The two checks answer
+		// genuinely different questions (import-time vs. factory-execution-time
+		// failure) and are complementary for exactly that reason; this test
+		// exists so a future change that makes them silently agree (e.g. an
+		// accidental factory invocation creeping into the load-path check)
+		// gets caught as a real behavior change.
+		const validator = new HeadlessInstallValidator();
+		const result = await validator.validate(`npm:${BROKEN}`);
+		expect(result.ok).toBe(false); // the gating check still refuses it
+		const paths = result.extensions[0]?.additionalLoadPaths;
+		expect(paths).toBeDefined();
+		expect(paths?.every((p) => p.ok === true)).toBe(true);
 	}, 20_000);
 });
 
 describe("HeadlessInstallValidator (bug repro, packed-headlessinstallvalidator-never-installs-the): staged tarball's own declared dependencies are never installed before the load check", () => {
 	it("approves an otherwise-healthy package whose entry point needs its one declared file: dependency", async () => {
-		const dir = mkdtempSync(join(tmpdir(), "packed-install-validation-dep-fixture-"));
+		const dir = track(mkdtempSync(join(tmpdir(), "packed-install-validation-dep-fixture-")));
 		writePackageWithRealDependency(dir);
 
 		// Ground truth this isn't a broken fixture: a plain `bun install` in an
@@ -131,7 +174,8 @@ describe("HeadlessInstallValidator (bug repro, packed-headlessinstallvalidator-n
 		const validator = new HeadlessInstallValidator();
 		const result = await validator.validate(`npm:${dir}`);
 		expect(result.ok).toBe(true);
-		expect(result.extensions).toEqual([{ path: "extension/index.ts", ok: true }]);
+		expect(result.extensions).toHaveLength(1);
+		expect(result.extensions[0]).toMatchObject({ path: "extension/index.ts", ok: true });
 	}, 30_000);
 });
 
@@ -159,7 +203,7 @@ describe("ExecInstaller.install() -- refuses before ever spawning the real pi bi
 		// step to cwd into -- /bin/true always exits 0 regardless, proving both
 		// the real install spawn *and* the re-resolution spawn were reached (a
 		// refused install never gets this far to find out).
-		const piHome = mkdtempSync(join(tmpdir(), "packed-install-validation-pihome-"));
+		const piHome = track(mkdtempSync(join(tmpdir(), "packed-install-validation-pihome-")));
 		mkdirSync(join(piHome, "npm"), { recursive: true });
 		const installer = new ExecInstaller(
 			"/bin/true",

package/service/test/install.test.ts

@@ -10,8 +10,8 @@
  * always-"Updated"-regardless-of-outcome text, and assert the real on-disk
  * version diff is what actually drives reloadRequired/alreadyUpToDate.
  */
-import { describe, expect, it } from "bun:test";
-import { chmodSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { afterEach, describe, expect, it } from "bun:test";
+import { chmodSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { ExecInstaller } from "../src/packages/install.ts";
@@ -24,6 +24,16 @@ import { ExecInstaller } from "../src/packages/install.ts";
  * baked into the script file itself (not an env var) so it is immune to
  * Bun.spawn's default env snapshot not picking up late process.env writes.
  */
+const roots: string[] = [];
+afterEach(() => {
+	for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+function track(dir: string): string {
+	roots.push(dir);
+	return dir;
+}
+
 function writeFakePi(dir: string, rewrite?: { piHome: string; name: string; newVersion: string }): string {
 	const script = join(dir, "fake-pi");
 	const rewriteLine = rewrite
@@ -39,7 +49,7 @@ function writeFakePi(dir: string, rewrite?: { piHome: string; name: string; newV
 }
 
 function writePiHome(nodeModules: Record<string, string> = {}): string {
-	const dir = mkdtempSync(join(tmpdir(), "packed-exec-pihome-"));
+	const dir = track(mkdtempSync(join(tmpdir(), "packed-exec-pihome-")));
 	mkdirSync(join(dir, "npm"), { recursive: true });
 	for (const [name, version] of Object.entries(nodeModules)) {
 		const pkgDir = join(dir, "npm", "node_modules", name);
@@ -73,7 +83,7 @@ function writeFakeNpm(dir: string, logFile: string, rewrite?: { piHome: string;
 
 describe("ExecInstaller.update() — honest reloadRequired despite pi's ambiguous exit-0 text", () => {
 	it("pinned source, version genuinely unchanged: alreadyUpToDate, reloadRequired false", async () => {
-		const scriptDir = mkdtempSync(join(tmpdir(), "packed-exec-bin-"));
+		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-exec-bin-")));
 		const bin = writeFakePi(scriptDir);
 		const npmBin = writeFakeNpm(scriptDir, join(scriptDir, "npm.log"));
 		const piHome = writePiHome({ "@scope/pkg": "1.2.3" });
@@ -90,7 +100,7 @@ describe("ExecInstaller.update() — honest reloadRequired despite pi's ambiguou
 	});
 
 	it('unpinned source, already latest (pi still exits 0 and says "Updated"): alreadyUpToDate', async () => {
-		const scriptDir = mkdtempSync(join(tmpdir(), "packed-exec-bin-"));
+		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-exec-bin-")));
 		const bin = writeFakePi(scriptDir);
 		const npmBin = writeFakeNpm(scriptDir, join(scriptDir, "npm.log"));
 		const piHome = writePiHome({ plain: "0.5.0" });
@@ -106,7 +116,7 @@ describe("ExecInstaller.update() — honest reloadRequired despite pi's ambiguou
 	});
 
 	it("unpinned source, a real version change happens: reloadRequired true", async () => {
-		const scriptDir = mkdtempSync(join(tmpdir(), "packed-exec-bin-"));
+		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-exec-bin-")));
 		const piHome = writePiHome({ plain: "0.5.0" });
 		const bin = writeFakePi(scriptDir, { piHome, name: "plain", newVersion: "0.6.0" });
 		const npmBin = writeFakeNpm(scriptDir, join(scriptDir, "npm.log"));
@@ -122,7 +132,7 @@ describe("ExecInstaller.update() — honest reloadRequired despite pi's ambiguou
 	});
 
 	it("git: source (no npm resolution possible either side): conservatively assumes it may have changed", async () => {
-		const scriptDir = mkdtempSync(join(tmpdir(), "packed-exec-bin-"));
+		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-exec-bin-")));
 		const bin = writeFakePi(scriptDir);
 		const npmBin = writeFakeNpm(scriptDir, join(scriptDir, "npm.log"));
 		const piHome = writePiHome();
@@ -141,7 +151,7 @@ describe("ExecInstaller.update() — honest reloadRequired despite pi's ambiguou
 
 describe("ExecInstaller — forces full dependency re-resolution, not just the target's own subtree", () => {
 	it("update() fixes a stale root-level sibling that the targeted pi update never touched", async () => {
-		const scriptDir = mkdtempSync(join(tmpdir(), "packed-exec-bin-"));
+		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-exec-bin-")));
 		// Simulates the confirmed live defect: after `pi update npm:@scope/leaf`,
 		// the leaf's own version bumps, but a root-level sibling
 		// (@scope/shared) that the freshly-updated leaf now needs a newer
@@ -170,7 +180,7 @@ describe("ExecInstaller — forces full dependency re-resolution, not just the t
 	});
 
 	it("install() also forces a full re-resolution after a successful pi install", async () => {
-		const scriptDir = mkdtempSync(join(tmpdir(), "packed-exec-bin-"));
+		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-exec-bin-")));
 		const piHome = writePiHome({ "@scope/shared": "1.0.0" });
 		const bin = writeFakePi(scriptDir);
 		const npmLog = join(scriptDir, "npm.log");
@@ -185,7 +195,7 @@ describe("ExecInstaller — forces full dependency re-resolution, not just the t
 	});
 
 	it("surfaces a failed re-resolution instead of silently reporting success", async () => {
-		const scriptDir = mkdtempSync(join(tmpdir(), "packed-exec-bin-"));
+		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-exec-bin-")));
 		const piHome = writePiHome({ plain: "0.5.0" });
 		const bin = writeFakePi(scriptDir, { piHome, name: "plain", newVersion: "0.6.0" });
 		const failingNpm = join(scriptDir, "fake-npm-fail");

package/service/test/pack-score.test.ts

@@ -1,5 +1,5 @@
-import { describe, expect, it } from "bun:test";
-import { existsSync, mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { afterEach, describe, expect, it } from "bun:test";
+import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { createGithubLastCommitAt, type FetchGithubLastCommitAt } from "../src/adoption/commit-freshness.ts";
@@ -30,8 +30,14 @@ class FakeRegistry implements Registry {
 	}
 }
 
+const roots: string[] = [];
+afterEach(() => {
+	for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
 function fixture(manifest: Record<string, unknown>, readme = ""): string {
 	const root = mkdtempSync(join(tmpdir(), "packed-pack-"));
+	roots.push(root);
 	writeFileSync(join(root, "package.json"), JSON.stringify(manifest));
 	if (readme) writeFileSync(join(root, "README.md"), readme);
 	return root;

package/service/test/pi-version.test.ts

@@ -1,5 +1,5 @@
 import { afterEach, describe, expect, it } from "bun:test";
-import { mkdtempSync } from "node:fs";
+import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { AuthenticatedRpcClient } from "@danypops/vehicle-client/rpc-client";
@@ -17,6 +17,16 @@ import {
 } from "../src/pi/pi-version.ts";
 import type { VersionCommand } from "../src/publish/publish.ts";
 
+const roots: string[] = [];
+afterEach(() => {
+	for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+function track(dir: string): string {
+	roots.push(dir);
+	return dir;
+}
+
 class NoopRegistry implements Registry {
 	async search(): Promise<SearchPage> {
 		return { results: [], total: 0 };
@@ -288,8 +298,8 @@ describe("pi.status operation", () => {
 			reg: new NoopRegistry(),
 			inst: new NoopInstaller(),
 			token: "test-token",
-			stateDir: mkdtempSync(join(tmpdir(), "packed-pi-version-state-")),
-			dataDir: mkdtempSync(join(tmpdir(), "packed-pi-version-data-")),
+			stateDir: track(mkdtempSync(join(tmpdir(), "packed-pi-version-state-"))),
+			dataDir: track(mkdtempSync(join(tmpdir(), "packed-pi-version-data-"))),
 			piVersion: { check: async () => ({ current: "0.82.1", latest: "0.83.0", upToDate: false }) },
 		});
 		const client = new AuthenticatedRpcClient<OperationName, OperationInputs, OperationOutputs>("http://packed.test", "test-token", {
@@ -305,8 +315,8 @@ describe("pi.status operation", () => {
 			reg: new NoopRegistry(),
 			inst: new NoopInstaller(),
 			token: "test-token",
-			stateDir: mkdtempSync(join(tmpdir(), "packed-pi-version-state-")),
-			dataDir: mkdtempSync(join(tmpdir(), "packed-pi-version-data-")),
+			stateDir: track(mkdtempSync(join(tmpdir(), "packed-pi-version-state-"))),
+			dataDir: track(mkdtempSync(join(tmpdir(), "packed-pi-version-data-"))),
 			piVersion: { check: async () => ({}) },
 		});
 		const client = new AuthenticatedRpcClient<OperationName, OperationInputs, OperationOutputs>("http://packed.test", "test-token", {

package/service/test/public-client.test.ts

@@ -1,9 +1,19 @@
-import { chmodSync, mkdtempSync, writeFileSync } from "node:fs";
+import { chmodSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { describe, expect, it } from "bun:test";
+import { afterEach, describe, expect, it } from "bun:test";
 import { ensureClient, resolvePiBinForSpawn } from "../src/public/client.ts";
 
+const roots: string[] = [];
+afterEach(() => {
+	for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+function track(dir: string): string {
+	roots.push(dir);
+	return dir;
+}
+
 describe("ensureClient (packed daemon auto-spawn-or-wait decision)", () => {
 	it("connects immediately without ever checking for a service or spawning, when already reachable", async () => {
 		let spawnCalls = 0;
@@ -150,12 +160,12 @@ describe("resolvePiBinForSpawn", () => {
 	});
 
 	it("returns undefined when no PATH directory has an executable `pi`", () => {
-		const dir = mkdtempSync(join(tmpdir(), "packed-resolve-pi-bin-"));
+		const dir = track(mkdtempSync(join(tmpdir(), "packed-resolve-pi-bin-")));
 		expect(resolvePiBinForSpawn({ PATH: dir })).toBeUndefined();
 	});
 
 	it("resolves the absolute path to an executable `pi` on PATH", () => {
-		const dir = mkdtempSync(join(tmpdir(), "packed-resolve-pi-bin-"));
+		const dir = track(mkdtempSync(join(tmpdir(), "packed-resolve-pi-bin-")));
 		const piPath = join(dir, "pi");
 		writeFileSync(piPath, "#!/bin/sh\necho pi\n");
 		chmodSync(piPath, 0o755);
@@ -163,8 +173,8 @@ describe("resolvePiBinForSpawn", () => {
 	});
 
 	it("skips a non-executable `pi` earlier on PATH and resolves a later one", () => {
-		const deadDir = mkdtempSync(join(tmpdir(), "packed-resolve-pi-bin-dead-"));
-		const liveDir = mkdtempSync(join(tmpdir(), "packed-resolve-pi-bin-live-"));
+		const deadDir = track(mkdtempSync(join(tmpdir(), "packed-resolve-pi-bin-dead-")));
+		const liveDir = track(mkdtempSync(join(tmpdir(), "packed-resolve-pi-bin-live-")));
 		writeFileSync(join(deadDir, "pi"), "not executable");
 		chmodSync(join(deadDir, "pi"), 0o644);
 		const livePi = join(liveDir, "pi");

package/service/test/publish.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, it } from "bun:test";
+import { afterEach, describe, expect, it } from "bun:test";
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -32,8 +32,18 @@ class RegistryFixture implements Registry {
 	}
 }
 
+const roots: string[] = [];
+afterEach(() => {
+	for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+function track(dir: string): string {
+	roots.push(dir);
+	return dir;
+}
+
 function project(overrides: Record<string, unknown> = {}): string {
-	const root = mkdtempSync(join(tmpdir(), "packed-publish-"));
+	const root = track(mkdtempSync(join(tmpdir(), "packed-publish-")));
 	writeFileSync(
 		join(root, "package.json"),
 		JSON.stringify({
@@ -84,7 +94,7 @@ class MultiRegistryFixture implements Registry {
 /** A two-package Bun workspace: packages/core (published, depended on) and
  * packages/ext (the one under test, declaring a dependency on core). */
 function workspace(extDependencyRange = "^1.0.0"): { root: string; corePath: string; extPath: string } {
-	const root = mkdtempSync(join(tmpdir(), "packed-workspace-"));
+	const root = track(mkdtempSync(join(tmpdir(), "packed-workspace-")));
 	writeFileSync(join(root, "package.json"), JSON.stringify({ name: "demo-workspace", private: true, workspaces: ["packages/*"] }));
 	writeFileSync(join(root, "bun.lock"), "{}");
 	const corePath = join(root, "packages", "core");

package/service/test/registry-contract.test.ts

@@ -1,5 +1,5 @@
 import { afterAll, beforeAll, describe, expect, it } from "bun:test";
-import { mkdtempSync } from "node:fs";
+import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import type { Server } from "bun";
@@ -86,6 +86,14 @@ describe("HttpRegistry vs DaemonRegistry", () => {
 	let httpServer: Server<undefined>;
 	let daemonServer: Server<undefined>;
 	const daemonToken = "c".repeat(64);
+	// createApp() is invoked fresh on every request below, so this can grow
+	// past one entry -- every one of them still needs cleanup.
+	const stateDirs: string[] = [];
+	function trackedStateDir(): string {
+		const dir = mkdtempSync(join(tmpdir(), "packed-registry-contract-"));
+		stateDirs.push(dir);
+		return dir;
+	}
 
 	beforeAll(() => {
 		httpServer = Bun.serve({
@@ -110,13 +118,14 @@ describe("HttpRegistry vs DaemonRegistry", () => {
 					reg: new InMemoryRegistry(),
 					inst: new NoopInstaller(),
 					token: daemonToken,
-					stateDir: mkdtempSync(join(tmpdir(), "packed-registry-contract-")),
+					stateDir: trackedStateDir(),
 				}).fetch(req),
 		});
 	});
 	afterAll(() => {
 		httpServer.stop(true);
 		daemonServer.stop(true);
+		for (const dir of stateDirs.splice(0)) rmSync(dir, { recursive: true, force: true });
 	});
 
 	registryContract("HttpRegistry (real Bun.serve npm-mock)", () => new HttpRegistry(`http://127.0.0.1:${httpServer.port}`, 2, 0, 1_000));

package/service/test/resources.test.ts

@@ -12,6 +12,11 @@ afterEach(() => {
 	for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
 });
 
+function track(dir: string): string {
+	roots.push(dir);
+	return dir;
+}
+
 function piHome(settingsPackages: unknown[]): string {
 	const root = mkdtempSync(join(tmpdir(), "packed-resources-"));
 	roots.push(root);
@@ -149,8 +154,8 @@ function rpcClient(piHome: string) {
 		reg: new NoopRegistry(),
 		inst: new NoopInstaller(),
 		token: "test-token",
-		stateDir: mkdtempSync(join(tmpdir(), "packed-resources-state-")),
-		dataDir: mkdtempSync(join(tmpdir(), "packed-resources-data-")),
+		stateDir: track(mkdtempSync(join(tmpdir(), "packed-resources-state-"))),
+		dataDir: track(mkdtempSync(join(tmpdir(), "packed-resources-data-"))),
 		piHome,
 	});
 	return new AuthenticatedRpcClient<OperationName, OperationInputs, OperationOutputs>("http://packed.test", "test-token", {

package/service/test/security.test.ts

@@ -1,12 +1,22 @@
-import { describe, expect, it } from "bun:test";
-import { mkdtempSync, writeFileSync } from "node:fs";
+import { afterEach, describe, expect, it } from "bun:test";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { PACKAGE_OPERATIONS, packagePermissionDecision, readSecuritySettings, writeSecuritySettings } from "../src/security/security.ts";
 
+const roots: string[] = [];
+afterEach(() => {
+	for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+function track(dir: string): string {
+	roots.push(dir);
+	return dir;
+}
+
 describe("package permission policy", () => {
 	it("defaults every arbitrary-code and settings/install-root mutation to approval", () => {
-		const dir = mkdtempSync(join(tmpdir(), "packed-security-"));
+		const dir = track(mkdtempSync(join(tmpdir(), "packed-security-")));
 		const settings = readSecuritySettings(dir);
 		expect(settings).toEqual({ mutationApproval: "always" });
 		expect(PACKAGE_OPERATIONS).toEqual([
@@ -72,11 +82,11 @@ describe("package permission policy", () => {
 	});
 
 	it("persists an explicit unsafe opt-out and migrates the prior storage key", async () => {
-		const dir = mkdtempSync(join(tmpdir(), "packed-security-"));
+		const dir = track(mkdtempSync(join(tmpdir(), "packed-security-")));
 		expect(await writeSecuritySettings(dir, { mutationApproval: "never" })).toEqual({ mutationApproval: "never" });
 		expect(readSecuritySettings(dir)).toEqual({ mutationApproval: "never" });
 
-		const legacyDir = mkdtempSync(join(tmpdir(), "packed-security-legacy-"));
+		const legacyDir = track(mkdtempSync(join(tmpdir(), "packed-security-legacy-")));
 		writeFileSync(join(legacyDir, "security.json"), '{"installApproval":"never"}\n');
 		expect(readSecuritySettings(legacyDir)).toEqual({ mutationApproval: "never" });
 	});