@danypops/pi-packed 0.21.12 → 0.21.13

package/extension/src/tui.ts

@@ -29,12 +29,13 @@
  * inline next to the row currently updating, settling into a real ✓/✗
  * plus a bounded tail of that row's own actual captured stdout/stderr
  * once it finishes, never a determinate bar (a single subprocess call has
- * no knowable percentage). Rows render through Malevich's Table (real
- * column-aligned Package/Version/status cells, per-row selection styling
- * baked into each cell since Table's own cellStyle is column-wide, not
- * row-wide) inside this tab's own scroll-window slice -- Table
- * deliberately owns no pagination of its own, so the visible-window-
- * around-selectedIndex math stays here. u/x/d and the Enter action menu
+ * no knowable percentage). Rows render as a column-major grid of
+ * Malevich Cards (computeCardColumns/renderCardGrid, below) -- one card
+ * per package, as many side by side as `width` allows above a fixed
+ * minimum card width, rather than one full-width card per line -- inside
+ * this tab's own scroll-window slice. No pagination baked into the grid
+ * helpers themselves, so the visible-window-around-selectedIndex math
+ * stays here. u/x/d and the Enter action menu
  * all run their whole approve+mutate+confirmReload flow inline, via the
  * shared TabHost's inlineCtx -- every confirm() along the way renders as
  * a real Malevich Dialog on this SAME overlay, dispatched by literal y/n
@@ -407,6 +408,87 @@ async function showActionMenu(ctx: ExtensionCommandContext, row: Row): Promise<"
 	);
 }
 
+/** A card narrower than this wastes more space on border/padding than it
+ * shows of a real scoped package name ("@scope/pi-longer-name") plus its
+ * version/status -- the floor `computeCardColumns` uses when deciding how
+ * many side-by-side columns actually fit `width`, rather than guessing a
+ * fixed row/page count independent of the panel's real width. */
+const MIN_CARD_WIDTH = 28;
+const CARD_GRID_GAP = 1;
+
+/** How many side-by-side card columns fit `width` without any of them
+ * dropping below MIN_CARD_WIDTH, capped at `itemCount` -- never more
+ * columns than there are real items to fill them (a wide terminal with
+ * only 2 packages installed gets 2 columns, not 4 mostly-empty ones). */
+function computeCardColumns(width: number, itemCount: number): number {
+	if (itemCount <= 0) return 1;
+	const fits = Math.floor((width + CARD_GRID_GAP) / (MIN_CARD_WIDTH + CARD_GRID_GAP));
+	return Math.max(1, Math.min(fits, itemCount));
+}
+
+/** Exact per-column widths for `columns` side-by-side cards inside `width`,
+ * every gap included -- sums (with CARD_GRID_GAP between each) to exactly
+ * `width`, distributing any remainder across the leading columns instead
+ * of leaving it as slack nobody renders into (the same exact-width
+ * contract every other line in this panel already holds, verified by this
+ * file's own "every rendered line at the exact same real width" test). */
+function distributeColumnWidths(width: number, columns: number): number[] {
+	const available = width - CARD_GRID_GAP * (columns - 1);
+	const base = Math.floor(available / columns);
+	const remainder = available - base * columns;
+	return Array.from({ length: columns }, (_, i) => base + (i < remainder ? 1 : 0));
+}
+
+/** Lays `items` into a column-major grid of exactly `columns` columns
+ * (column 0 filled top-to-bottom first, then column 1, ...) -- the same
+ * fill order `ls -C` uses, so a flat Up/Down cycle through `items` moves
+ * down one column at a time instead of snaking left-to-right through a
+ * row-major grid, with no new keybinding needed (Left/Right stay reserved
+ * for the panel's own tab-cycling -- see this file's own header comment).
+ * `columns` is always the caller's own already-computed computeCardColumns
+ * result, never re-derived here from `items.length` -- a caller windowing
+ * `items` into a page shorter than its full list must still render that
+ * page at the same column count the rest of the list uses, or the grid
+ * would reflow mid-scroll. `selectedIndex` is an index into `items`
+ * itself, or -1 when nothing in this grid is selected. */
+function renderCardGrid<T>(
+	items: T[],
+	columns: number,
+	width: number,
+	selectedIndex: number,
+	renderCard: (item: T, columnWidth: number, selected: boolean) => string[],
+): string[] {
+	if (items.length === 0) return [];
+	const columnWidths = distributeColumnWidths(width, columns);
+	const rowsPerColumn = Math.ceil(items.length / columns);
+	const rendered: string[][] = [];
+	for (let c = 0; c < columns; c++) {
+		const columnWidth = columnWidths[c] ?? MIN_CARD_WIDTH;
+		const lines: string[] = [];
+		for (let r = 0; r < rowsPerColumn; r++) {
+			const index = c * rowsPerColumn + r;
+			const item = items[index];
+			if (item === undefined) break;
+			lines.push(...renderCard(item, columnWidth, index === selectedIndex));
+		}
+		rendered.push(lines);
+	}
+	const height = Math.max(0, ...rendered.map((lines) => lines.length));
+	const out: string[] = [];
+	for (let row = 0; row < height; row++) {
+		out.push(
+			rendered
+				.map((lines, c) => {
+					const line = lines[row] ?? "";
+					const pad = Math.max(0, (columnWidths[c] ?? MIN_CARD_WIDTH) - visibleWidth(line));
+					return line + " ".repeat(pad);
+				})
+				.join(" ".repeat(CARD_GRID_GAP)),
+		);
+	}
+	return out;
+}
+
 /** Packages -- the panel's default/"home" tab. A real Component (not the
  * panel's own top-level ctx.ui.custom owner anymore); the shared TabHost
  * gives it inline approval/reload dialogs and a way to signal the overlay
@@ -509,33 +591,42 @@ export class PackagesTab implements Component {
 			lines.push(theme.fg("muted", "  No packages"));
 			return lines;
 		}
-		// No scrolling of its own (Malevich's Table is deliberately
-		// unopinionated about pagination) -- the visible window around
-		// selectedIndex stays this tab's own job.
-		const start = Math.max(0, Math.min(this.selectedIndex - Math.floor(this.maxVisible / 2), this.filtered.length - this.maxVisible));
-		const end = Math.min(start + this.maxVisible, this.filtered.length);
-		for (const [offset, row] of this.filtered.slice(start, end).entries()) {
-			const selected = start + offset === this.selectedIndex;
-			// A settled row shows its real outcome even for the instant before
-			// the next row's "start" event moves updatingRowName off it.
-			const rowSettled = this.settled.get(row.name);
-			const isUpdating = !rowSettled && this.updatingRowName === row.name;
-			const status = isUpdating
-				? theme.fg("accent", `${this.spinner.glyph()} updating…`)
-				: rowSettled
-					? theme.fg(rowSettled.ok ? "success" : "error", `${rowSettled.ok ? "✓" : "✗"}${rowSettled.tail ? ` ${rowSettled.tail}` : ""}`)
-					: row.hasUpdate
-						? theme.fg("warning", `↑${row.latest}`)
-						: theme.fg("muted", "installed");
-			const card = new Card({
-				title: theme.bold(row.name),
-				content: [`${theme.fg("dim", row.version)} · ${status}`],
-				selected,
-				theme: cardTheme(theme),
-				measure: this.measure,
-			});
-			lines.push(...card.render(width));
-		}
+		// Column count is derived from `width` (and the total item count, so a
+		// short list never gets more columns than it has items) once per
+		// render, then held fixed across the whole page -- otherwise scrolling
+		// through a filtered list would reflow the grid mid-scroll. No
+		// scrolling of its own beyond that: the visible-window-around-
+		// selectedIndex math stays this tab's own job, same as before, just
+		// now counting grid rows (maxVisible) times columns instead of a flat
+		// one-card-per-line count.
+		const columns = computeCardColumns(width, this.filtered.length);
+		const pageSize = columns * this.maxVisible;
+		const start = Math.max(0, Math.min(this.selectedIndex - Math.floor(pageSize / 2), this.filtered.length - pageSize));
+		const end = Math.min(start + pageSize, this.filtered.length);
+		const page = this.filtered.slice(start, end);
+		lines.push(
+			...renderCardGrid(page, columns, width, this.selectedIndex - start, (row, columnWidth, selected) => {
+				// A settled row shows its real outcome even for the instant before
+				// the next row's "start" event moves updatingRowName off it.
+				const rowSettled = this.settled.get(row.name);
+				const isUpdating = !rowSettled && this.updatingRowName === row.name;
+				const status = isUpdating
+					? theme.fg("accent", `${this.spinner.glyph()} updating…`)
+					: rowSettled
+						? theme.fg(rowSettled.ok ? "success" : "error", `${rowSettled.ok ? "✓" : "✗"}${rowSettled.tail ? ` ${rowSettled.tail}` : ""}`)
+						: row.hasUpdate
+							? theme.fg("warning", `↑${row.latest}`)
+							: theme.fg("muted", "installed");
+				const card = new Card({
+					title: theme.bold(row.name),
+					content: [`${theme.fg("dim", row.version)} · ${status}`],
+					selected,
+					theme: cardTheme(theme),
+					measure: this.measure,
+				});
+				return card.render(columnWidth);
+			}),
+		);
 		const hasScroll = start > 0 || end < this.filtered.length;
 		lines.push(theme.fg("dim", `  ${hasScroll ? `${this.selectedIndex + 1}/${this.filtered.length} ` : ""}${this.mode}`));
 		return lines;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danypops/pi-packed",
-  "version": "0.21.12",
+  "version": "0.21.13",
   "description": "Pi package lifecycle, validation, daemon, tools, profiles, and TUI",
   "type": "module",
   "bin": {

package/service/test/advisories.test.ts

@@ -1,5 +1,5 @@
 import { afterEach, describe, expect, it } from "bun:test";
-import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { AuthenticatedRpcClient } from "@danypops/vehicle-client/rpc-client";
@@ -36,11 +36,18 @@ class NoopInstaller implements Installer {
 }
 
 let server: Server<undefined> | undefined;
+const roots: string[] = [];
 afterEach(() => {
 	server?.stop(true);
 	server = undefined;
+	for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
 });
 
+function track(dir: string): string {
+	roots.push(dir);
+	return dir;
+}
+
 const daysAgo = (n: number) => new Date(Date.now() - n * 24 * 60 * 60 * 1000).toISOString();
 
 describe("fetchBulkAdvisories", () => {
@@ -221,6 +228,7 @@ describe("scanInstalledPackages", () => {
 describe("advisories.scan operation (real daemon route)", () => {
 	it("resolves real installed npm packages' on-disk versions and routes through the authenticated operation registry", async () => {
 		const piHome = mkdtempSync(join(tmpdir(), "packed-advisories-daemon-"));
+		roots.push(piHome);
 		writeFileSync(join(piHome, "settings.json"), JSON.stringify({ packages: ["npm:pi-vuln"] }));
 		const pkgDir = join(piHome, "npm", "node_modules", "pi-vuln");
 		mkdirSync(pkgDir, { recursive: true });
@@ -231,8 +239,8 @@ describe("advisories.scan operation (real daemon route)", () => {
 			reg: new NoopRegistry(),
 			inst: new NoopInstaller(),
 			token: "test-token",
-			stateDir: mkdtempSync(join(tmpdir(), "packed-advisories-state-")),
-			dataDir: mkdtempSync(join(tmpdir(), "packed-advisories-data-")),
+			stateDir: track(mkdtempSync(join(tmpdir(), "packed-advisories-state-"))),
+			dataDir: track(mkdtempSync(join(tmpdir(), "packed-advisories-data-"))),
 			piHome,
 			// injected exactly like pi.status's piVersion seam -- never a real
 			// network call to the live npm registry from an automated test.
@@ -258,9 +266,9 @@ describe("advisories.scan operation (real daemon route)", () => {
 			reg: new NoopRegistry(),
 			inst: new NoopInstaller(),
 			token: "test-token",
-			stateDir: mkdtempSync(join(tmpdir(), "packed-advisories-state-")),
-			dataDir: mkdtempSync(join(tmpdir(), "packed-advisories-data-")),
-			piHome: mkdtempSync(join(tmpdir(), "packed-advisories-pihome-")),
+			stateDir: track(mkdtempSync(join(tmpdir(), "packed-advisories-state-"))),
+			dataDir: track(mkdtempSync(join(tmpdir(), "packed-advisories-data-"))),
+			piHome: track(mkdtempSync(join(tmpdir(), "packed-advisories-pihome-"))),
 		});
 		const client = new AuthenticatedRpcClient<OperationName, OperationInputs, OperationOutputs>("http://packed.test", "test-token", {
 			label: "Packed",
@@ -274,9 +282,9 @@ describe("advisories.scan operation (real daemon route)", () => {
 			reg: new NoopRegistry(),
 			inst: new NoopInstaller(),
 			token: "test-token",
-			stateDir: mkdtempSync(join(tmpdir(), "packed-advisories-state-")),
-			dataDir: mkdtempSync(join(tmpdir(), "packed-advisories-data-")),
-			piHome: mkdtempSync(join(tmpdir(), "packed-advisories-pihome-")),
+			stateDir: track(mkdtempSync(join(tmpdir(), "packed-advisories-state-"))),
+			dataDir: track(mkdtempSync(join(tmpdir(), "packed-advisories-data-"))),
+			piHome: track(mkdtempSync(join(tmpdir(), "packed-advisories-pihome-"))),
 		});
 		const client = new AuthenticatedRpcClient<OperationName, OperationInputs, OperationOutputs>("http://packed.test", "test-token", {
 			label: "Packed",

package/service/test/cleanup.test.ts

@@ -12,6 +12,11 @@ afterEach(() => {
 	for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
 });
 
+function track(dir: string): string {
+	roots.push(dir);
+	return dir;
+}
+
 function pkg(manifest: Record<string, unknown>): string {
 	const root = mkdtempSync(join(tmpdir(), "packed-cleanup-"));
 	roots.push(root);
@@ -169,8 +174,8 @@ describe("packed remove applies pi.cleanup before delegating to pi remove (real
 			reg: new NoopRegistry(),
 			inst,
 			token: "test-token",
-			stateDir: mkdtempSync(join(tmpdir(), "packed-cleanup-state-")),
-			dataDir: mkdtempSync(join(tmpdir(), "packed-cleanup-data-")),
+			stateDir: track(mkdtempSync(join(tmpdir(), "packed-cleanup-state-"))),
+			dataDir: track(mkdtempSync(join(tmpdir(), "packed-cleanup-data-"))),
 			piHome,
 		});
 		return new AuthenticatedRpcClient<OperationName, OperationInputs, OperationOutputs>("http://packed.test", "test-token", {

package/service/test/cli.test.ts

@@ -1,6 +1,6 @@
-import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { afterAll, afterEach, beforeAll, describe, expect, it } from "bun:test";
 import { spawnSync } from "node:child_process";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { writeDaemonHandle } from "@danypops/vehicle-server/paths";
@@ -125,6 +125,16 @@ class FakeDaemonServiceInstaller {
 	}
 }
 
+const roots: string[] = [];
+afterEach(() => {
+	for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+function track(dir: string): string {
+	roots.push(dir);
+	return dir;
+}
+
 function deps(over: Partial<CliDeps> = {}): CliDeps {
 	return {
 		reg: new FakeRegistry(),
@@ -138,8 +148,8 @@ function deps(over: Partial<CliDeps> = {}): CliDeps {
 				return { mutationApproval };
 			},
 		},
-		stateDir: mkdtempSync(join(tmpdir(), "packed-")),
-		piHome: mkdtempSync(join(tmpdir(), "packed-pihome-")),
+		stateDir: track(mkdtempSync(join(tmpdir(), "packed-"))),
+		piHome: track(mkdtempSync(join(tmpdir(), "packed-pihome-"))),
 		...over,
 	};
 }
@@ -389,7 +399,7 @@ describe("CLI", () => {
 	it("updates --project also checks a project's own .pi/settings.json pins -- global-only misses them entirely", async () => {
 		const d = deps();
 		writeFileSync(join(d.piHome, "settings.json"), JSON.stringify({ packages: ["npm:pi-global@1.0.0"] }));
-		const projectRoot = mkdtempSync(join(tmpdir(), "packed-project-"));
+		const projectRoot = track(mkdtempSync(join(tmpdir(), "packed-project-")));
 		const projectHome = join(projectRoot, ".pi");
 		mkdirSync(projectHome, { recursive: true });
 		writeFileSync(join(projectHome, "settings.json"), JSON.stringify({ packages: ["npm:papyrus@0.21.2"] }));
@@ -938,7 +948,7 @@ describe("CLI", () => {
 	});
 
 	it("advisories runs standalone without a daemon and degrades to zero findings, never a real network call, when nothing is installed", async () => {
-		const d = deps({ piHome: mkdtempSync(join(tmpdir(), "packed-advisories-cli-")) });
+		const d = deps({ piHome: track(mkdtempSync(join(tmpdir(), "packed-advisories-cli-"))) });
 		const result = await cliRun(["advisories", "--json"], d);
 		expect(result.code).toBe(0);
 		expect(JSON.parse(result.out)).toEqual({ scanned: 0, findings: [], diagnostics: [], truncated: false });
@@ -956,7 +966,7 @@ describe("CLI", () => {
 	});
 
 	it("resources list and toggle run standalone without a daemon (CLI parity for the daemon-only resources.list/toggle operations)", async () => {
-		const piHome = mkdtempSync(join(tmpdir(), "packed-resources-cli-"));
+		const piHome = track(mkdtempSync(join(tmpdir(), "packed-resources-cli-")));
 		writeFileSync(join(piHome, "settings.json"), JSON.stringify({ packages: ["npm:pi-demo"] }));
 		const pkgDir = join(piHome, "npm", "node_modules", "pi-demo");
 		mkdirSync(pkgDir, { recursive: true });
@@ -998,7 +1008,7 @@ describe("CLI", () => {
 	(bwrapUsable ? it : it.skip)(
 		"doctor runs standalone without a daemon and reproduces the jittor incident through the real CLI (CLI parity for the daemon-only doctor.run operation)",
 		async () => {
-			const piHome = mkdtempSync(join(tmpdir(), "packed-doctor-cli-"));
+			const piHome = track(mkdtempSync(join(tmpdir(), "packed-doctor-cli-")));
 			writeFileSync(join(piHome, "settings.json"), JSON.stringify({ packages: ["npm:pi-papyrus"] }));
 			const globalPkg = join(piHome, "npm", "node_modules", "pi-papyrus");
 			mkdirSync(join(globalPkg, "extension"), { recursive: true });
@@ -1007,7 +1017,7 @@ describe("CLI", () => {
 				JSON.stringify({ name: "pi-papyrus", version: "1.0.0", pi: { extensions: ["extension/index.ts"] } }),
 			);
 			writeFileSync(join(globalPkg, "extension", "index.ts"), 'export default function (pi: any) { pi.registerTool({ name: "tasks" }); }');
-			const projectRoot = mkdtempSync(join(tmpdir(), "packed-doctor-cli-project-"));
+			const projectRoot = track(mkdtempSync(join(tmpdir(), "packed-doctor-cli-project-")));
 			const projectHome = join(projectRoot, ".pi");
 			mkdirSync(projectHome, { recursive: true });
 			writeFileSync(join(projectHome, "settings.json"), JSON.stringify({ packages: ["npm:papyrus"] }));
@@ -1063,12 +1073,14 @@ describe("CLI", () => {
 describe("daemon client", () => {
 	let server: Server<undefined>;
 	let daemonDir: string;
+	let daemonPiHome: string;
 	let daemonPaths: PackedPaths;
 	let daemonInstaller: FakeInstaller;
 	const daemonToken = "d".repeat(64);
 
 	beforeAll(async () => {
 		daemonDir = mkdtempSync(join(tmpdir(), "packed-daemon-"));
+		daemonPiHome = mkdtempSync(join(tmpdir(), "packed-daemon-pi-"));
 		daemonPaths = resolvePackedPaths({ env: { PI_PACKED_HOME: daemonDir } });
 		writeFileSync(daemonPaths.token, `${daemonToken}\n`);
 		daemonInstaller = new FakeInstaller();
@@ -1100,7 +1112,7 @@ describe("daemon client", () => {
 			},
 			token: daemonToken,
 			stateDir: daemonDir,
-			piHome: mkdtempSync(join(tmpdir(), "packed-daemon-pi-")),
+			piHome: daemonPiHome,
 			packer: {
 				async verify(path) {
 					return {
@@ -1169,7 +1181,11 @@ describe("daemon client", () => {
 		server = Bun.serve({ port: 0, hostname: "127.0.0.1", fetch: (req) => app.fetch(req) });
 		writeDaemonHandle(daemonPaths.handle, { host: "127.0.0.1", port: server.port!, pid: process.pid });
 	});
-	afterAll(() => server.stop(true));
+	afterAll(() => {
+		server.stop(true);
+		rmSync(daemonDir, { recursive: true, force: true });
+		rmSync(daemonPiHome, { recursive: true, force: true });
+	});
 
 	it("probe finds a live daemon", async () => {
 		const found = await probe(daemonPaths);
@@ -1188,7 +1204,7 @@ describe("daemon client", () => {
 	});
 
 	it("probe rejects dead state", async () => {
-		const directory = mkdtempSync(join(tmpdir(), "packed-"));
+		const directory = track(mkdtempSync(join(tmpdir(), "packed-")));
 		expect(await probe(resolvePackedPaths({ env: { PI_PACKED_HOME: directory } }))).toBeUndefined();
 	});
 
@@ -1260,7 +1276,7 @@ describe("daemon client", () => {
 	it("resolveRegistry prefers daemon, falls back direct", async () => {
 		const viaDaemon = await resolveRegistry(daemonPaths, "https://registry.npmjs.org");
 		expect(viaDaemon).toBeInstanceOf(DaemonRegistry);
-		const directory = mkdtempSync(join(tmpdir(), "packed-"));
+		const directory = track(mkdtempSync(join(tmpdir(), "packed-")));
 		const direct = await resolveRegistry(resolvePackedPaths({ env: { PI_PACKED_HOME: directory } }), "https://registry.npmjs.org");
 		expect(direct).toBeInstanceOf(HttpRegistry);
 	});

package/service/test/db.test.ts

@@ -1,5 +1,5 @@
-import { describe, expect, it } from "bun:test";
-import { existsSync, mkdtempSync } from "node:fs";
+import { afterEach, describe, expect, it } from "bun:test";
+import { existsSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { syncCatalog } from "../src/packages/catalog.ts";
@@ -127,9 +127,15 @@ class PagedRegistry implements Registry {
 	}
 }
 
+const roots: string[] = [];
+afterEach(() => {
+	for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
 describe("syncCatalog → SQLite", () => {
 	it("accumulates pages into the DB and records sync meta", async () => {
 		const dir = mkdtempSync(join(tmpdir(), "packed-"));
+		roots.push(dir);
 		const reg = new PagedRegistry({ 0: PKGS.slice(0, 2), 2: PKGS.slice(2) }, 3);
 		expect(await syncCatalog(reg, dir)).toBe(3);
 		expect(existsSync(dbPath(dir))).toBe(true);

package/service/test/doctor.test.ts

@@ -13,6 +13,11 @@ afterEach(() => {
 	for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
 });
 
+function track(dir: string): string {
+	roots.push(dir);
+	return dir;
+}
+
 // Same sandbox-availability probe as smoke.test.ts: binary presence alone
 // doesn't prove bwrap actually works under this host's user namespaces.
 function bwrapUsable(): boolean {
@@ -216,8 +221,8 @@ describeIfSandboxed("doctor.run (daemon RPC wiring)", () => {
 			reg: new NoopRegistry(),
 			inst: new NoopInstaller(),
 			token: "test-token",
-			stateDir: mkdtempSync(join(tmpdir(), "packed-doctor-state-")),
-			dataDir: mkdtempSync(join(tmpdir(), "packed-doctor-data-")),
+			stateDir: track(mkdtempSync(join(tmpdir(), "packed-doctor-state-"))),
+			dataDir: track(mkdtempSync(join(tmpdir(), "packed-doctor-data-"))),
 			piHome: home,
 		});
 		const client = new AuthenticatedRpcClient<OperationName, OperationInputs, OperationOutputs>("http://packed.test", "test-token", {

package/service/test/domain.test.ts

@@ -1,5 +1,5 @@
-import { describe, expect, it } from "bun:test";
-import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { afterEach, describe, expect, it } from "bun:test";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { AuthenticatedRpcClient } from "@danypops/vehicle-client/rpc-client";
@@ -17,8 +17,18 @@ import {
 } from "../src/packages/installed.ts";
 import type { Installer, PkgInfo, Registry, SearchPage, UpdateOutcome, UpdatesSnapshot } from "../src/packages/package.ts";
 
+const roots: string[] = [];
+afterEach(() => {
+	for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+function track(dir: string): string {
+	roots.push(dir);
+	return dir;
+}
+
 function writePiHome(settings: unknown, nodeModules: Record<string, string> = {}): string {
-	const dir = mkdtempSync(join(tmpdir(), "packed-pihome-"));
+	const dir = track(mkdtempSync(join(tmpdir(), "packed-pihome-")));
 	writeFileSync(join(dir, "settings.json"), JSON.stringify(settings));
 	for (const [name, version] of Object.entries(nodeModules)) {
 		const pkgDir = join(dir, "npm", "node_modules", name);
@@ -99,7 +109,7 @@ describe("readInstalledPackages", () => {
 	});
 
 	it("missing settings → empty", () => {
-		expect(readInstalledPackages(mkdtempSync(join(tmpdir(), "packed-")))).toEqual([]);
+		expect(readInstalledPackages(track(mkdtempSync(join(tmpdir(), "packed-"))))).toEqual([]);
 	});
 });
 
@@ -113,7 +123,7 @@ describe("readInstalledPackagesAcrossScopes", () => {
 
 	it("reproduces the real jittor gap: a stale project-scoped pin is invisible to a global-only read, visible once project scope is included", () => {
 		const home = writePiHome({ packages: ["npm:pi-global@1.0.0"] });
-		const projectRoot = mkdtempSync(join(tmpdir(), "packed-project-"));
+		const projectRoot = track(mkdtempSync(join(tmpdir(), "packed-project-")));
 		const projectHome = join(projectRoot, ".pi");
 		mkdirSync(projectHome, { recursive: true });
 		writeFileSync(join(projectHome, "settings.json"), JSON.stringify({ packages: ["npm:papyrus@0.21.2"] }));
@@ -128,7 +138,7 @@ describe("readInstalledPackagesAcrossScopes", () => {
 
 	it("is unaffected by a missing project settings file", () => {
 		const home = writePiHome({ packages: ["npm:pi-global@1.0.0"] });
-		const projectRoot = mkdtempSync(join(tmpdir(), "packed-project-"));
+		const projectRoot = track(mkdtempSync(join(tmpdir(), "packed-project-")));
 		expect(readInstalledPackagesAcrossScopes(home, projectRoot)).toEqual([
 			{ name: "pi-global", pinned: "1.0.0", installed: undefined, scope: "global" },
 		]);
@@ -214,13 +224,13 @@ class NoopInstaller implements Installer {
 
 describe("package.updates.project (daemon RPC wiring)", () => {
 	it("computes a live, cross-scope drift check on demand, distinct from package.updates' own persisted global-only snapshot", async () => {
-		const home = mkdtempSync(join(tmpdir(), "packed-updates-project-"));
+		const home = track(mkdtempSync(join(tmpdir(), "packed-updates-project-")));
 		writeFileSync(join(home, "settings.json"), JSON.stringify({ packages: ["npm:pi-global@1.0.0"] }));
-		const projectRoot = mkdtempSync(join(tmpdir(), "packed-updates-project-root-"));
+		const projectRoot = track(mkdtempSync(join(tmpdir(), "packed-updates-project-root-")));
 		const projectHome = join(projectRoot, ".pi");
 		mkdirSync(projectHome, { recursive: true });
 		writeFileSync(join(projectHome, "settings.json"), JSON.stringify({ packages: ["npm:papyrus@0.21.2"] }));
-		const stateDir = mkdtempSync(join(tmpdir(), "packed-updates-project-state-"));
+		const stateDir = track(mkdtempSync(join(tmpdir(), "packed-updates-project-state-")));
 		const db = openDb(dbPath(stateDir));
 		replaceAll(
 			db,
@@ -249,7 +259,7 @@ describe("package.updates.project (daemon RPC wiring)", () => {
 
 describe("updates store", () => {
 	it("roundtrips", async () => {
-		const dir = mkdtempSync(join(tmpdir(), "packed-"));
+		const dir = track(mkdtempSync(join(tmpdir(), "packed-")));
 		const snap = { checkedAt: new Date().toISOString(), updates: [{ name: "a", installed: "1", latest: "2", detectedAt: "" }] };
 		await saveUpdates(dir, snap);
 		expect(await loadUpdates(dir)).toEqual(snap);
@@ -259,7 +269,7 @@ describe("updates store", () => {
 
 describe("watcher producer", () => {
 	it("writes a snapshot on tick", async () => {
-		const dir = mkdtempSync(join(tmpdir(), "packed-"));
+		const dir = track(mkdtempSync(join(tmpdir(), "packed-")));
 		let signalTick: ((snapshot: UpdatesSnapshot) => void) | undefined;
 		const tick = new Promise<UpdatesSnapshot>((resolve) => {
 			signalTick = resolve;
@@ -282,7 +292,7 @@ describe("watcher producer", () => {
 
 describe("catalog status", () => {
 	it("stale when unsynced, fresh after sync", () => {
-		const dir = mkdtempSync(join(tmpdir(), "packed-"));
+		const dir = track(mkdtempSync(join(tmpdir(), "packed-")));
 		expect(catalogStatus(dir, 6 * 3_600_000).stale).toBe(true);
 		const db = openDb(`${dir}/packed.db`);
 		replaceAll(db, [{ name: "a", version: "1" }], "test");

package/service/test/index.test.ts

@@ -1,5 +1,5 @@
-import { afterAll, beforeAll, describe, expect, it } from "bun:test";
-import { mkdtempSync, readFileSync } from "node:fs";
+import { afterAll, afterEach, beforeAll, describe, expect, it } from "bun:test";
+import { mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import type { Server } from "bun";
@@ -7,6 +7,16 @@ import { buildIndex, generateIndex, indexPath, indexStatus, readIndex, writeInde
 import { dbPath, openDb, replaceAll } from "../src/packages/db.ts";
 import { HttpRegistry } from "../src/registry/registry.ts";
 
+const roots: string[] = [];
+afterEach(() => {
+	for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+function track(dir: string): string {
+	roots.push(dir);
+	return dir;
+}
+
 // Guards the "never bulk GitHub calls" constraint against regression: a
 // future edit could easily start threading a GitHub-commit fetcher through
 // buildIndex the same way scoreTarget does. A source-level check catches
@@ -89,7 +99,10 @@ describe("buildIndex", () => {
 		registry = new HttpRegistry(`http://127.0.0.1:${server.port}`, 250, 0, 1, `http://127.0.0.1:${server.port}`);
 	});
 
-	afterAll(() => server.stop(true));
+	afterAll(() => {
+		server.stop(true);
+		rmSync(catalogDir, { recursive: true, force: true });
+	});
 
 	it("builds one entry per cataloged package, skipping a lookup failure rather than failing the whole run", async () => {
 		const index = await buildIndex(registry, catalogDir, { delayMs: 0, currentPiVersion: async () => "0.83.0" });
@@ -123,7 +136,7 @@ describe("buildIndex", () => {
 
 describe("buildIndex bounds", () => {
 	it("never calls downloads() -- confirmed live to trigger npm's 429s at real catalog scale -- and truncates past maxPackages, marking the result", async () => {
-		const dir = mkdtempSync(join(tmpdir(), "packed-index-bounds-"));
+		const dir = track(mkdtempSync(join(tmpdir(), "packed-index-bounds-")));
 		const db = openDb(dbPath(dir));
 		replaceAll(
 			db,
@@ -160,7 +173,7 @@ describe("buildIndex bounds", () => {
 	});
 
 	it("collapses two concurrent callers into one run -- confirmed live to matter: the daemon's own maintenance tick and an on-demand CLI build overlapping compounded into a shutdown the daemon's SIGTERM grace period couldn't outlast", async () => {
-		const dir = mkdtempSync(join(tmpdir(), "packed-index-concurrent-"));
+		const dir = track(mkdtempSync(join(tmpdir(), "packed-index-concurrent-")));
 		const db = openDb(dbPath(dir));
 		replaceAll(db, [{ name: "pi-one", version: "1.0.0" }], "test");
 		db.close();
@@ -203,7 +216,7 @@ describe("buildIndex bounds", () => {
 
 describe("buildIndex incremental delta scanning", () => {
 	it("partitions the catalog into New/Changed/Unchanged against the prior index -- Unchanged makes zero live registry calls, New and Changed do", async () => {
-		const dir = mkdtempSync(join(tmpdir(), "packed-index-delta-"));
+		const dir = track(mkdtempSync(join(tmpdir(), "packed-index-delta-")));
 		const db = openDb(dbPath(dir));
 		replaceAll(
 			db,
@@ -275,7 +288,7 @@ describe("buildIndex incremental delta scanning", () => {
 	});
 
 	it("maxPackages bounds only the New+Changed live-call queue -- Unchanged entries beyond that count still complete", async () => {
-		const dir = mkdtempSync(join(tmpdir(), "packed-index-delta-bound-"));
+		const dir = track(mkdtempSync(join(tmpdir(), "packed-index-delta-bound-")));
 		const db = openDb(dbPath(dir));
 		// 5 unchanged entries alone already exceed maxPackages: 1 below.
 		replaceAll(
@@ -323,7 +336,7 @@ describe("buildIndex incremental delta scanning", () => {
 
 describe("index persistence", () => {
 	it("writes, reads, and reports staleness", async () => {
-		const dir = mkdtempSync(join(tmpdir(), "packed-index-store-"));
+		const dir = track(mkdtempSync(join(tmpdir(), "packed-index-store-")));
 		const path = indexPath(dir);
 		expect(readIndex(path)).toBeUndefined();
 		expect(indexStatus(path, 1_000).stale).toBe(true);
@@ -343,7 +356,7 @@ describe("index persistence", () => {
 	});
 
 	it("generateIndex builds and writes in one call", async () => {
-		const dir = mkdtempSync(join(tmpdir(), "packed-index-generate-"));
+		const dir = track(mkdtempSync(join(tmpdir(), "packed-index-generate-")));
 		const db = openDb(dbPath(dir));
 		replaceAll(db, [{ name: "pi-alpha", version: "1.0.0" }], "npm:keywords:pi-package");
 		db.close();

package/service/test/install-validation.test.ts

@@ -7,8 +7,8 @@
  * a broken fixture must genuinely be refused, a healthy one must genuinely
  * pass.
  */
-import { describe, expect, it } from "bun:test";
-import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { afterEach, describe, expect, it } from "bun:test";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -23,6 +23,16 @@ const BROKEN = join(FIXTURES, "broken-package");
 const NO_MANIFEST = join(FIXTURES, "no-manifest-package");
 const DEP_PACKAGE = join(FIXTURES, "dep-package");
 
+const roots: string[] = [];
+afterEach(() => {
+	for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+function track(dir: string): string {
+	roots.push(dir);
+	return dir;
+}
+
 /** Writes a fresh package into `dir` whose extension entry point has a real
  * runtime import (`packed-fixture-dep`, a `file:` dependency resolvable
  * fully offline) -- otherwise healthy, structurally identical to HEALTHY,
@@ -145,7 +155,7 @@ describe("HeadlessInstallValidator (vehicle-client-pi pi-load-harness, non-gatin
 
 describe("HeadlessInstallValidator (bug repro, packed-headlessinstallvalidator-never-installs-the): staged tarball's own declared dependencies are never installed before the load check", () => {
 	it("approves an otherwise-healthy package whose entry point needs its one declared file: dependency", async () => {
-		const dir = mkdtempSync(join(tmpdir(), "packed-install-validation-dep-fixture-"));
+		const dir = track(mkdtempSync(join(tmpdir(), "packed-install-validation-dep-fixture-")));
 		writePackageWithRealDependency(dir);
 
 		// Ground truth this isn't a broken fixture: a plain `bun install` in an
@@ -193,7 +203,7 @@ describe("ExecInstaller.install() -- refuses before ever spawning the real pi bi
 		// step to cwd into -- /bin/true always exits 0 regardless, proving both
 		// the real install spawn *and* the re-resolution spawn were reached (a
 		// refused install never gets this far to find out).
-		const piHome = mkdtempSync(join(tmpdir(), "packed-install-validation-pihome-"));
+		const piHome = track(mkdtempSync(join(tmpdir(), "packed-install-validation-pihome-")));
 		mkdirSync(join(piHome, "npm"), { recursive: true });
 		const installer = new ExecInstaller(
 			"/bin/true",

package/service/test/install.test.ts

@@ -10,8 +10,8 @@
  * always-"Updated"-regardless-of-outcome text, and assert the real on-disk
  * version diff is what actually drives reloadRequired/alreadyUpToDate.
  */
-import { describe, expect, it } from "bun:test";
-import { chmodSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { afterEach, describe, expect, it } from "bun:test";
+import { chmodSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { ExecInstaller } from "../src/packages/install.ts";
@@ -24,6 +24,16 @@ import { ExecInstaller } from "../src/packages/install.ts";
  * baked into the script file itself (not an env var) so it is immune to
  * Bun.spawn's default env snapshot not picking up late process.env writes.
  */
+const roots: string[] = [];
+afterEach(() => {
+	for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+function track(dir: string): string {
+	roots.push(dir);
+	return dir;
+}
+
 function writeFakePi(dir: string, rewrite?: { piHome: string; name: string; newVersion: string }): string {
 	const script = join(dir, "fake-pi");
 	const rewriteLine = rewrite
@@ -39,7 +49,7 @@ function writeFakePi(dir: string, rewrite?: { piHome: string; name: string; newV
 }
 
 function writePiHome(nodeModules: Record<string, string> = {}): string {
-	const dir = mkdtempSync(join(tmpdir(), "packed-exec-pihome-"));
+	const dir = track(mkdtempSync(join(tmpdir(), "packed-exec-pihome-")));
 	mkdirSync(join(dir, "npm"), { recursive: true });
 	for (const [name, version] of Object.entries(nodeModules)) {
 		const pkgDir = join(dir, "npm", "node_modules", name);
@@ -73,7 +83,7 @@ function writeFakeNpm(dir: string, logFile: string, rewrite?: { piHome: string;
 
 describe("ExecInstaller.update() — honest reloadRequired despite pi's ambiguous exit-0 text", () => {
 	it("pinned source, version genuinely unchanged: alreadyUpToDate, reloadRequired false", async () => {
-		const scriptDir = mkdtempSync(join(tmpdir(), "packed-exec-bin-"));
+		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-exec-bin-")));
 		const bin = writeFakePi(scriptDir);
 		const npmBin = writeFakeNpm(scriptDir, join(scriptDir, "npm.log"));
 		const piHome = writePiHome({ "@scope/pkg": "1.2.3" });
@@ -90,7 +100,7 @@ describe("ExecInstaller.update() — honest reloadRequired despite pi's ambiguou
 	});
 
 	it('unpinned source, already latest (pi still exits 0 and says "Updated"): alreadyUpToDate', async () => {
-		const scriptDir = mkdtempSync(join(tmpdir(), "packed-exec-bin-"));
+		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-exec-bin-")));
 		const bin = writeFakePi(scriptDir);
 		const npmBin = writeFakeNpm(scriptDir, join(scriptDir, "npm.log"));
 		const piHome = writePiHome({ plain: "0.5.0" });
@@ -106,7 +116,7 @@ describe("ExecInstaller.update() — honest reloadRequired despite pi's ambiguou
 	});
 
 	it("unpinned source, a real version change happens: reloadRequired true", async () => {
-		const scriptDir = mkdtempSync(join(tmpdir(), "packed-exec-bin-"));
+		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-exec-bin-")));
 		const piHome = writePiHome({ plain: "0.5.0" });
 		const bin = writeFakePi(scriptDir, { piHome, name: "plain", newVersion: "0.6.0" });
 		const npmBin = writeFakeNpm(scriptDir, join(scriptDir, "npm.log"));
@@ -122,7 +132,7 @@ describe("ExecInstaller.update() — honest reloadRequired despite pi's ambiguou
 	});
 
 	it("git: source (no npm resolution possible either side): conservatively assumes it may have changed", async () => {
-		const scriptDir = mkdtempSync(join(tmpdir(), "packed-exec-bin-"));
+		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-exec-bin-")));
 		const bin = writeFakePi(scriptDir);
 		const npmBin = writeFakeNpm(scriptDir, join(scriptDir, "npm.log"));
 		const piHome = writePiHome();
@@ -141,7 +151,7 @@ describe("ExecInstaller.update() — honest reloadRequired despite pi's ambiguou
 
 describe("ExecInstaller — forces full dependency re-resolution, not just the target's own subtree", () => {
 	it("update() fixes a stale root-level sibling that the targeted pi update never touched", async () => {
-		const scriptDir = mkdtempSync(join(tmpdir(), "packed-exec-bin-"));
+		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-exec-bin-")));
 		// Simulates the confirmed live defect: after `pi update npm:@scope/leaf`,
 		// the leaf's own version bumps, but a root-level sibling
 		// (@scope/shared) that the freshly-updated leaf now needs a newer
@@ -170,7 +180,7 @@ describe("ExecInstaller — forces full dependency re-resolution, not just the t
 	});
 
 	it("install() also forces a full re-resolution after a successful pi install", async () => {
-		const scriptDir = mkdtempSync(join(tmpdir(), "packed-exec-bin-"));
+		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-exec-bin-")));
 		const piHome = writePiHome({ "@scope/shared": "1.0.0" });
 		const bin = writeFakePi(scriptDir);
 		const npmLog = join(scriptDir, "npm.log");
@@ -185,7 +195,7 @@ describe("ExecInstaller — forces full dependency re-resolution, not just the t
 	});
 
 	it("surfaces a failed re-resolution instead of silently reporting success", async () => {
-		const scriptDir = mkdtempSync(join(tmpdir(), "packed-exec-bin-"));
+		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-exec-bin-")));
 		const piHome = writePiHome({ plain: "0.5.0" });
 		const bin = writeFakePi(scriptDir, { piHome, name: "plain", newVersion: "0.6.0" });
 		const failingNpm = join(scriptDir, "fake-npm-fail");

package/service/test/pack-score.test.ts

@@ -1,5 +1,5 @@
-import { describe, expect, it } from "bun:test";
-import { existsSync, mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { afterEach, describe, expect, it } from "bun:test";
+import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { createGithubLastCommitAt, type FetchGithubLastCommitAt } from "../src/adoption/commit-freshness.ts";
@@ -30,8 +30,14 @@ class FakeRegistry implements Registry {
 	}
 }
 
+const roots: string[] = [];
+afterEach(() => {
+	for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
 function fixture(manifest: Record<string, unknown>, readme = ""): string {
 	const root = mkdtempSync(join(tmpdir(), "packed-pack-"));
+	roots.push(root);
 	writeFileSync(join(root, "package.json"), JSON.stringify(manifest));
 	if (readme) writeFileSync(join(root, "README.md"), readme);
 	return root;

package/service/test/pi-version.test.ts

@@ -1,5 +1,5 @@
 import { afterEach, describe, expect, it } from "bun:test";
-import { mkdtempSync } from "node:fs";
+import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { AuthenticatedRpcClient } from "@danypops/vehicle-client/rpc-client";
@@ -17,6 +17,16 @@ import {
 } from "../src/pi/pi-version.ts";
 import type { VersionCommand } from "../src/publish/publish.ts";
 
+const roots: string[] = [];
+afterEach(() => {
+	for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+function track(dir: string): string {
+	roots.push(dir);
+	return dir;
+}
+
 class NoopRegistry implements Registry {
 	async search(): Promise<SearchPage> {
 		return { results: [], total: 0 };
@@ -288,8 +298,8 @@ describe("pi.status operation", () => {
 			reg: new NoopRegistry(),
 			inst: new NoopInstaller(),
 			token: "test-token",
-			stateDir: mkdtempSync(join(tmpdir(), "packed-pi-version-state-")),
-			dataDir: mkdtempSync(join(tmpdir(), "packed-pi-version-data-")),
+			stateDir: track(mkdtempSync(join(tmpdir(), "packed-pi-version-state-"))),
+			dataDir: track(mkdtempSync(join(tmpdir(), "packed-pi-version-data-"))),
 			piVersion: { check: async () => ({ current: "0.82.1", latest: "0.83.0", upToDate: false }) },
 		});
 		const client = new AuthenticatedRpcClient<OperationName, OperationInputs, OperationOutputs>("http://packed.test", "test-token", {
@@ -305,8 +315,8 @@ describe("pi.status operation", () => {
 			reg: new NoopRegistry(),
 			inst: new NoopInstaller(),
 			token: "test-token",
-			stateDir: mkdtempSync(join(tmpdir(), "packed-pi-version-state-")),
-			dataDir: mkdtempSync(join(tmpdir(), "packed-pi-version-data-")),
+			stateDir: track(mkdtempSync(join(tmpdir(), "packed-pi-version-state-"))),
+			dataDir: track(mkdtempSync(join(tmpdir(), "packed-pi-version-data-"))),
 			piVersion: { check: async () => ({}) },
 		});
 		const client = new AuthenticatedRpcClient<OperationName, OperationInputs, OperationOutputs>("http://packed.test", "test-token", {

package/service/test/public-client.test.ts

@@ -1,9 +1,19 @@
-import { chmodSync, mkdtempSync, writeFileSync } from "node:fs";
+import { chmodSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { describe, expect, it } from "bun:test";
+import { afterEach, describe, expect, it } from "bun:test";
 import { ensureClient, resolvePiBinForSpawn } from "../src/public/client.ts";
 
+const roots: string[] = [];
+afterEach(() => {
+	for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+function track(dir: string): string {
+	roots.push(dir);
+	return dir;
+}
+
 describe("ensureClient (packed daemon auto-spawn-or-wait decision)", () => {
 	it("connects immediately without ever checking for a service or spawning, when already reachable", async () => {
 		let spawnCalls = 0;
@@ -150,12 +160,12 @@ describe("resolvePiBinForSpawn", () => {
 	});
 
 	it("returns undefined when no PATH directory has an executable `pi`", () => {
-		const dir = mkdtempSync(join(tmpdir(), "packed-resolve-pi-bin-"));
+		const dir = track(mkdtempSync(join(tmpdir(), "packed-resolve-pi-bin-")));
 		expect(resolvePiBinForSpawn({ PATH: dir })).toBeUndefined();
 	});
 
 	it("resolves the absolute path to an executable `pi` on PATH", () => {
-		const dir = mkdtempSync(join(tmpdir(), "packed-resolve-pi-bin-"));
+		const dir = track(mkdtempSync(join(tmpdir(), "packed-resolve-pi-bin-")));
 		const piPath = join(dir, "pi");
 		writeFileSync(piPath, "#!/bin/sh\necho pi\n");
 		chmodSync(piPath, 0o755);
@@ -163,8 +173,8 @@ describe("resolvePiBinForSpawn", () => {
 	});
 
 	it("skips a non-executable `pi` earlier on PATH and resolves a later one", () => {
-		const deadDir = mkdtempSync(join(tmpdir(), "packed-resolve-pi-bin-dead-"));
-		const liveDir = mkdtempSync(join(tmpdir(), "packed-resolve-pi-bin-live-"));
+		const deadDir = track(mkdtempSync(join(tmpdir(), "packed-resolve-pi-bin-dead-")));
+		const liveDir = track(mkdtempSync(join(tmpdir(), "packed-resolve-pi-bin-live-")));
 		writeFileSync(join(deadDir, "pi"), "not executable");
 		chmodSync(join(deadDir, "pi"), 0o644);
 		const livePi = join(liveDir, "pi");

package/service/test/publish.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, it } from "bun:test";
+import { afterEach, describe, expect, it } from "bun:test";
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -32,8 +32,18 @@ class RegistryFixture implements Registry {
 	}
 }
 
+const roots: string[] = [];
+afterEach(() => {
+	for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+function track(dir: string): string {
+	roots.push(dir);
+	return dir;
+}
+
 function project(overrides: Record<string, unknown> = {}): string {
-	const root = mkdtempSync(join(tmpdir(), "packed-publish-"));
+	const root = track(mkdtempSync(join(tmpdir(), "packed-publish-")));
 	writeFileSync(
 		join(root, "package.json"),
 		JSON.stringify({
@@ -84,7 +94,7 @@ class MultiRegistryFixture implements Registry {
 /** A two-package Bun workspace: packages/core (published, depended on) and
  * packages/ext (the one under test, declaring a dependency on core). */
 function workspace(extDependencyRange = "^1.0.0"): { root: string; corePath: string; extPath: string } {
-	const root = mkdtempSync(join(tmpdir(), "packed-workspace-"));
+	const root = track(mkdtempSync(join(tmpdir(), "packed-workspace-")));
 	writeFileSync(join(root, "package.json"), JSON.stringify({ name: "demo-workspace", private: true, workspaces: ["packages/*"] }));
 	writeFileSync(join(root, "bun.lock"), "{}");
 	const corePath = join(root, "packages", "core");

package/service/test/registry-contract.test.ts

@@ -1,5 +1,5 @@
 import { afterAll, beforeAll, describe, expect, it } from "bun:test";
-import { mkdtempSync } from "node:fs";
+import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import type { Server } from "bun";
@@ -86,6 +86,14 @@ describe("HttpRegistry vs DaemonRegistry", () => {
 	let httpServer: Server<undefined>;
 	let daemonServer: Server<undefined>;
 	const daemonToken = "c".repeat(64);
+	// createApp() is invoked fresh on every request below, so this can grow
+	// past one entry -- every one of them still needs cleanup.
+	const stateDirs: string[] = [];
+	function trackedStateDir(): string {
+		const dir = mkdtempSync(join(tmpdir(), "packed-registry-contract-"));
+		stateDirs.push(dir);
+		return dir;
+	}
 
 	beforeAll(() => {
 		httpServer = Bun.serve({
@@ -110,13 +118,14 @@ describe("HttpRegistry vs DaemonRegistry", () => {
 					reg: new InMemoryRegistry(),
 					inst: new NoopInstaller(),
 					token: daemonToken,
-					stateDir: mkdtempSync(join(tmpdir(), "packed-registry-contract-")),
+					stateDir: trackedStateDir(),
 				}).fetch(req),
 		});
 	});
 	afterAll(() => {
 		httpServer.stop(true);
 		daemonServer.stop(true);
+		for (const dir of stateDirs.splice(0)) rmSync(dir, { recursive: true, force: true });
 	});
 
 	registryContract("HttpRegistry (real Bun.serve npm-mock)", () => new HttpRegistry(`http://127.0.0.1:${httpServer.port}`, 2, 0, 1_000));

package/service/test/resources.test.ts

@@ -12,6 +12,11 @@ afterEach(() => {
 	for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
 });
 
+function track(dir: string): string {
+	roots.push(dir);
+	return dir;
+}
+
 function piHome(settingsPackages: unknown[]): string {
 	const root = mkdtempSync(join(tmpdir(), "packed-resources-"));
 	roots.push(root);
@@ -149,8 +154,8 @@ function rpcClient(piHome: string) {
 		reg: new NoopRegistry(),
 		inst: new NoopInstaller(),
 		token: "test-token",
-		stateDir: mkdtempSync(join(tmpdir(), "packed-resources-state-")),
-		dataDir: mkdtempSync(join(tmpdir(), "packed-resources-data-")),
+		stateDir: track(mkdtempSync(join(tmpdir(), "packed-resources-state-"))),
+		dataDir: track(mkdtempSync(join(tmpdir(), "packed-resources-data-"))),
 		piHome,
 	});
 	return new AuthenticatedRpcClient<OperationName, OperationInputs, OperationOutputs>("http://packed.test", "test-token", {

package/service/test/security.test.ts

@@ -1,12 +1,22 @@
-import { describe, expect, it } from "bun:test";
-import { mkdtempSync, writeFileSync } from "node:fs";
+import { afterEach, describe, expect, it } from "bun:test";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { PACKAGE_OPERATIONS, packagePermissionDecision, readSecuritySettings, writeSecuritySettings } from "../src/security/security.ts";
 
+const roots: string[] = [];
+afterEach(() => {
+	for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+function track(dir: string): string {
+	roots.push(dir);
+	return dir;
+}
+
 describe("package permission policy", () => {
 	it("defaults every arbitrary-code and settings/install-root mutation to approval", () => {
-		const dir = mkdtempSync(join(tmpdir(), "packed-security-"));
+		const dir = track(mkdtempSync(join(tmpdir(), "packed-security-")));
 		const settings = readSecuritySettings(dir);
 		expect(settings).toEqual({ mutationApproval: "always" });
 		expect(PACKAGE_OPERATIONS).toEqual([
@@ -72,11 +82,11 @@ describe("package permission policy", () => {
 	});
 
 	it("persists an explicit unsafe opt-out and migrates the prior storage key", async () => {
-		const dir = mkdtempSync(join(tmpdir(), "packed-security-"));
+		const dir = track(mkdtempSync(join(tmpdir(), "packed-security-")));
 		expect(await writeSecuritySettings(dir, { mutationApproval: "never" })).toEqual({ mutationApproval: "never" });
 		expect(readSecuritySettings(dir)).toEqual({ mutationApproval: "never" });
 
-		const legacyDir = mkdtempSync(join(tmpdir(), "packed-security-legacy-"));
+		const legacyDir = track(mkdtempSync(join(tmpdir(), "packed-security-legacy-")));
 		writeFileSync(join(legacyDir, "security.json"), '{"installApproval":"never"}\n');
 		expect(readSecuritySettings(legacyDir)).toEqual({ mutationApproval: "never" });
 	});

package/service/test/service.test.ts

@@ -1,5 +1,5 @@
-import { describe, expect, it } from "bun:test";
-import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { afterEach, describe, expect, it } from "bun:test";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import type { ServiceSpec } from "@danypops/vehicle-server/service";
@@ -105,12 +105,22 @@ class FakeDaemonServiceInstaller implements DaemonServiceInstaller {
 	}
 }
 
+const roots: string[] = [];
+afterEach(() => {
+	for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+function track(dir: string): string {
+	roots.push(dir);
+	return dir;
+}
+
 function deps(over: Partial<Deps> = {}): Deps {
 	return {
 		reg: new FakeRegistry(),
 		inst: new FakeInstaller(),
 		token: "test-token",
-		stateDir: mkdtempSync(join(tmpdir(), "packed-")),
+		stateDir: track(mkdtempSync(join(tmpdir(), "packed-"))),
 		...over,
 	};
 }
@@ -272,7 +282,7 @@ describe("service app", () => {
 
 	it("POST /install configures an npm package's persistent Vehicle under the same approval", async () => {
 		const svc = new FakeDaemonServiceInstaller();
-		const piHome = mkdtempSync(join(tmpdir(), "packed-install-vehicle-"));
+		const piHome = track(mkdtempSync(join(tmpdir(), "packed-install-vehicle-")));
 		const app = createApp(deps({ daemonServiceInstaller: svc, piHome }));
 		const response = await app.fetch(
 			new Request("http://x/install", {
@@ -328,7 +338,7 @@ describe("service app", () => {
 
 	it("POST /install-service installs a real service once approved, reporting the resolved spec", async () => {
 		const svc = new FakeDaemonServiceInstaller();
-		const piHome = mkdtempSync(join(tmpdir(), "packed-pi-"));
+		const piHome = track(mkdtempSync(join(tmpdir(), "packed-pi-")));
 		const app = createApp(deps({ daemonServiceInstaller: svc, piHome }));
 
 		const res = await app.fetch(
@@ -406,7 +416,7 @@ describe("service app", () => {
 
 	it("POST /restart-service restarts a real service once approved, reporting the resolved spec", async () => {
 		const svc = new FakeDaemonServiceInstaller();
-		const piHome = mkdtempSync(join(tmpdir(), "packed-pi-"));
+		const piHome = track(mkdtempSync(join(tmpdir(), "packed-pi-")));
 		const app = createApp(deps({ daemonServiceInstaller: svc, piHome }));
 
 		const res = await app.fetch(
@@ -492,7 +502,7 @@ describe("service app", () => {
 
 	it("POST /update reconciles an installed Vehicle after a real package change", async () => {
 		const svc = new FakeDaemonServiceInstaller();
-		const piHome = mkdtempSync(join(tmpdir(), "packed-update-vehicle-"));
+		const piHome = track(mkdtempSync(join(tmpdir(), "packed-update-vehicle-")));
 		const app = createApp(deps({ daemonServiceInstaller: svc, piHome }));
 		const response = await app.fetch(
 			new Request("http://x/update", {
@@ -542,7 +552,7 @@ describe("service app", () => {
 	});
 
 	it("GET /installed lists packages from pi settings", async () => {
-		const piHome = mkdtempSync(join(tmpdir(), "packed-pi-"));
+		const piHome = track(mkdtempSync(join(tmpdir(), "packed-pi-")));
 		writeFileSync(
 			join(piHome, "settings.json"),
 			JSON.stringify({ packages: ["npm:pi-extension-manager@0.8.2", { source: "npm:obj@2.0.0" }] }),
@@ -582,7 +592,7 @@ describe("service app", () => {
 	});
 
 	it("POST /remove removes declared Vehicle state before deleting the package", async () => {
-		const piHome = mkdtempSync(join(tmpdir(), "packed-remove-vehicle-"));
+		const piHome = track(mkdtempSync(join(tmpdir(), "packed-remove-vehicle-")));
 		const packageDir = join(piHome, "npm", "node_modules", "probe");
 		mkdirSync(packageDir, { recursive: true });
 		writeFileSync(

package/service/test/setup.test.ts

@@ -1,5 +1,5 @@
-import { describe, expect, it } from "bun:test";
-import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { afterEach, describe, expect, it } from "bun:test";
+import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import type { Installer, PkgInfo, Registry, SearchPage, UpdateOutcome } from "../src/packages/package.ts";
@@ -54,8 +54,18 @@ class GitFixture implements GitResolutionPort {
 	}
 }
 
+const roots: string[] = [];
+afterEach(() => {
+	for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+function track(dir: string): string {
+	roots.push(dir);
+	return dir;
+}
+
 function piHome(withPackage = true): string {
-	const root = mkdtempSync(join(tmpdir(), "packed-setup-home-"));
+	const root = track(mkdtempSync(join(tmpdir(), "packed-setup-home-")));
 	const packages = withPackage ? ["npm:pi-demo"] : [];
 	writeFileSync(join(root, "settings.json"), JSON.stringify({ packages }));
 	if (withPackage) {
@@ -73,7 +83,7 @@ function piHome(withPackage = true): string {
 }
 
 function project(): string {
-	const root = mkdtempSync(join(tmpdir(), "packed-setup-project-"));
+	const root = track(mkdtempSync(join(tmpdir(), "packed-setup-project-")));
 	mkdirSync(join(root, ".pi"), { recursive: true });
 	return root;
 }