@saadnvd1/agent-os 0.3.664 → 0.3.671

package/lib/project-config/index.ts

@@ -1,17 +1,28 @@
 /**
- * The one reader of a project's config: `agentos.json`, else `.dispatch.json`,
- * else the legacy `.agent-os/worktrees.json` / `.agent-os.json`. The first
- * file that exists is the config; a broken one is an error, never a reason
- * to read the next. Design: docs/decisions/2026-10-10-agentos-json.md.
+ * The one reader of a project's config: `agentos.json` and `.dispatch.json`
+ * together, else the legacy `.agent-os/worktrees.json` / `.agent-os.json`
+ * (the first of those that exists). A broken file is an error, never a
+ * reason to read the next or to ignore it.
+ *
+ * When both agentos.json and .dispatch.json exist they merge by top-level
+ * key: agentos.json wins any key it sets, and its value replaces
+ * .dispatch.json's whole (no deep merge, so a partial `browse` never mixes
+ * with the old one); keys only .dispatch.json has still apply, after its
+ * normalization (`workspace` becomes `cards.workspace`, dispatch-only keys
+ * are dropped). `inherited` names those keys and `warning` says to move them.
+ * Design: docs/decisions/2026-10-10-agentos-json.md.
  */
 
 import * as fs from "fs";
 import * as path from "path";
 import type { z } from "zod";
 import {
+  agentosFields,
   agentosJson,
+  dispatchFields,
   dispatchJson,
   legacyJson,
+  mergedJson,
   RESERVED_ENV,
   type ProjectConfig,
 } from "./schema";
@@ -34,9 +45,20 @@ export interface LoadedConfig {
   source: string | null;
   // Why the file was refused, naming it and every bad field.
   error: string | null;
+  // Top-level keys that came from .dispatch.json because agentos.json lacks
+  // them; empty unless both files exist.
+  inherited: string[];
+  // One line for the brief when both files exist; null otherwise.
+  warning: string | null;
 }
 
-const NONE: LoadedConfig = { config: {}, source: null, error: null };
+export const NONE: LoadedConfig = Object.freeze({
+  config: {},
+  source: null,
+  error: null,
+  inherited: Object.freeze([]) as unknown as string[],
+  warning: null,
+});
 
 function describe(file: string, error: z.ZodError): string {
   const fields = error.issues.map((i) => {
@@ -61,7 +83,9 @@ function fromLegacy(raw: z.infer<typeof legacyJson>): ProjectConfig {
   return config;
 }
 
-function parse(file: string, text: string): LoadedConfig {
+// `checked: false` leaves the port-name check to the merge, which can see
+// the ports the other file declares.
+function parse(file: string, text: string, checked = true): LoadedConfig {
   let raw: unknown;
   try {
     raw = JSON.parse(text);
@@ -73,31 +97,102 @@ function parse(file: string, text: string): LoadedConfig {
     };
   }
   if (file === "agentos.json") {
-    const got = agentosJson.safeParse(raw);
+    const got = (checked ? agentosJson : agentosFields).safeParse(raw);
     return got.success
-      ? { config: got.data, source: file, error: null }
+      ? { ...NONE, config: got.data, source: file }
       : { ...NONE, source: file, error: describe(file, got.error) };
   }
   if (file === ".dispatch.json") {
-    const got = dispatchJson.safeParse(raw);
+    const got = (checked ? dispatchJson : dispatchFields).safeParse(raw);
     if (!got.success)
       return { ...NONE, source: file, error: describe(file, got.error) };
     const { workspace, ...config } = got.data;
     if (workspace && !config.cards?.workspace)
       config.cards = { ...config.cards, workspace };
-    return { config, source: file, error: null };
+    return { ...NONE, config, source: file };
   }
   const got = legacyJson.safeParse(raw);
   return got.success
-    ? { config: fromLegacy(got.data), source: file, error: null }
+    ? { ...NONE, config: fromLegacy(got.data), source: file }
     : { ...NONE, source: file, error: describe(file, got.error) };
 }
 
+export const bothFilesWarning = (inherited: string[]): string =>
+  `This repo has both agentos.json and .dispatch.json; keys ${inherited.join(", ")} come from .dispatch.json. Move them into agentos.json and delete .dispatch.json.`;
+
+function merge(agentos: ProjectConfig, dispatch: ProjectConfig): LoadedConfig {
+  const inherited = Object.keys(dispatch).filter((k) => !(k in agentos));
+  const config = {
+    ...Object.fromEntries(
+      inherited.map((k) => [k, dispatch[k as keyof ProjectConfig]])
+    ),
+    ...agentos,
+  } as ProjectConfig;
+  const got = mergedJson.safeParse(config);
+  if (!got.success)
+    return {
+      ...NONE,
+      source: "agentos.json",
+      error: describe("agentos.json with .dispatch.json", got.error),
+    };
+  return {
+    ...NONE,
+    config,
+    source: "agentos.json",
+    inherited,
+    warning: inherited.length ? bothFilesWarning(inherited) : null,
+  };
+}
+
+function statOf(projectPath: string, file: string): fs.Stats | null {
+  try {
+    const stat = fs.statSync(path.join(projectPath, file));
+    return stat.isFile() ? stat : null;
+  } catch {
+    return null;
+  }
+}
+
+function readFile(projectPath: string, file: string): string | LoadedConfig {
+  try {
+    return fs.readFileSync(path.join(projectPath, file), "utf-8");
+  } catch (e) {
+    return {
+      ...NONE,
+      source: file,
+      error: `${file} could not be read: ${(e as Error).message}`,
+    };
+  }
+}
+
+// Both files, merged. A broken one is the error, whichever it is.
+function loadBoth(projectPath: string): LoadedConfig {
+  const parsed: LoadedConfig[] = [];
+  for (const file of ["agentos.json", ".dispatch.json"]) {
+    const text = readFile(projectPath, file);
+    if (typeof text !== "string") return text;
+    const got = parse(file, text, false);
+    if (got.error) return got;
+    parsed.push(got);
+  }
+  return merge(parsed[0].config, parsed[1].config);
+}
+
 // Keyed on the project; reused while the file's mtime and size hold, since
 // agentEnv reads it for every terminal and chat start.
 const cache = new Map<string, { stamp: string; loaded: LoadedConfig }>();
 
 export function loadProjectConfig(projectPath: string): LoadedConfig {
+  const a = statOf(projectPath, "agentos.json");
+  const d = statOf(projectPath, ".dispatch.json");
+  if (a && d) {
+    const stamp = `both:${a.mtimeMs}:${a.size}:${d.mtimeMs}:${d.size}`;
+    const hit = cache.get(projectPath);
+    if (hit?.stamp === stamp) return hit.loaded;
+    const loaded = loadBoth(projectPath);
+    cache.set(projectPath, { stamp, loaded });
+    return loaded;
+  }
   for (const file of CONFIG_FILES) {
     const full = path.join(projectPath, file);
     let stat: fs.Stats;
@@ -110,16 +205,8 @@ export function loadProjectConfig(projectPath: string): LoadedConfig {
     const stamp = `${file}:${stat.mtimeMs}:${stat.size}`;
     const hit = cache.get(projectPath);
     if (hit?.stamp === stamp) return hit.loaded;
-    let text: string;
-    try {
-      text = fs.readFileSync(full, "utf-8");
-    } catch (e) {
-      return {
-        ...NONE,
-        source: file,
-        error: `${file} could not be read: ${(e as Error).message}`,
-      };
-    }
+    const text = readFile(projectPath, file);
+    if (typeof text !== "string") return text;
     const loaded = parse(file, text);
     cache.set(projectPath, { stamp, loaded });
     return loaded;

package/lib/project-config/schema.ts

@@ -228,13 +228,19 @@ function portRefs(
 
 // agentos.json: an unknown key is an error, because it is nearly always a
 // typo that would otherwise be silently ignored.
-export const agentosJson = z.strictObject(shape).superRefine(portRefs);
+export const agentosFields = z.strictObject(shape);
+export const agentosJson = agentosFields.superRefine(portRefs);
 
 // .dispatch.json: the same fields, but dispatch has keys of its own. Its
 // top-level `workspace` is `cards.workspace` here.
-export const dispatchJson = z
-  .object({ ...shape, workspace: z.string().optional() })
-  .superRefine(portRefs);
+export const dispatchFields = z.object({
+  ...shape,
+  workspace: z.string().optional(),
+});
+export const dispatchJson = dispatchFields.superRefine(portRefs);
+
+// The cross-key port check on its own, for a config merged from two files.
+export const mergedJson = z.looseObject(shape).superRefine(portRefs);
 
 export const legacyJson = z.object({
   setup: z.array(z.string()).optional(),

package/lib/project-config/session.ts

@@ -10,7 +10,12 @@ import { sessionTmpDir } from "../sessions/leftovers";
 import { db } from "../db";
 import { getProject } from "../projects";
 import { sessionPorts } from "../ports";
-import { loadProjectConfig, projectEnv, type LoadedConfig } from "./index";
+import {
+  loadProjectConfig,
+  NONE,
+  projectEnv,
+  type LoadedConfig,
+} from "./index";
 import { runningBrief } from "./brief";
 import { databaseEnv, sessionDatabase } from "./database";
 
@@ -31,9 +36,7 @@ export function sessionConfig(
   sessionId: string
 ): LoadedConfig & { ports: Record<string, number> | null } {
   const projectPath = projectPathOf(sessionId);
-  const loaded = projectPath
-    ? loadProjectConfig(projectPath)
-    : { config: {}, source: null, error: null };
+  const loaded = projectPath ? loadProjectConfig(projectPath) : NONE;
   return { ...loaded, ports: sessionPorts(sessionId) };
 }
 
@@ -70,9 +73,9 @@ export function sessionProjectEnv(sessionId: string): Record<string, string> {
 
 export function sessionRunningBrief(sessionId: string): string {
   try {
-    const { config, source, ports } = sessionConfig(sessionId);
+    const { config, source, warning, ports } = sessionConfig(sessionId);
     return source
-      ? runningBrief(config, ports ?? {}, sessionDatabase(sessionId))
+      ? runningBrief(config, ports ?? {}, sessionDatabase(sessionId), warning)
       : "";
   } catch (error) {
     console.error(`[project-config] brief for ${sessionId}:`, error);

package/lib/security/net.ts

@@ -146,10 +146,13 @@ export function originAllowed(
 
 const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
 
-// LumifyHub's approve page sends the browser back here, so this one URL is
-// reached by a cross-site top-level navigation. It acts only on a `state`
-// this instance issued, which a foreign page can't know.
-const CROSS_SITE_NAVIGATIONS = ["/api/lumifyhub/callback"];
+// LumifyHub's approve page and an MCP server's sign-in send the browser back
+// here, so these URLs are reached by a cross-site top-level navigation. Each
+// acts only on a `state` this instance issued, which a foreign page can't know.
+const CROSS_SITE_NAVIGATIONS = [
+  "/api/lumifyhub/callback",
+  "/api/mcp-auth/callback",
+];
 
 function crossSiteNavigationAllowed(req: {
   method?: string;

package/lib/tasks/move-testing.ts

@@ -3,13 +3,13 @@
 // Tests mock ../worktrees (WORKTREES_DIR), ../env-setup and ../agents/launch.
 
 import fs from "fs";
-import os from "os";
 import path from "path";
 import { randomUUID } from "crypto";
 import { db, insertSessionRow, type Session } from "../db";
 import { createProject } from "../projects";
 import { writeTranscript } from "./transcript";
 import { gitSync } from "../git-exec";
+import { tempDir } from "@/lib/test-temp";
 
 export const CLAUDE_ID = "11111111-2222-3333-4444-555555555555";
 
@@ -30,7 +30,7 @@ export interface MoveFixture {
 /** HOME, Claude's folder and git identity all point into a temp dir. */
 export function setupMoveRepo(): MoveFixture {
   const saved = { HOME: process.env.HOME };
-  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "aos-move-"));
+  const tmp = tempDir("aos-move-");
   process.env.HOME = tmp;
   process.env.CLAUDE_CONFIG_DIR = path.join(tmp, ".claude");
   for (const who of ["AUTHOR", "COMMITTER"]) {

package/lib/test-temp.ts

@@ -0,0 +1,30 @@
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+// Folders made by tempDir, removed when the test file ends (vitest.setup.ts
+// calls removeTempDirs). Kept on globalThis: vi.resetModules() would
+// otherwise lose the list.
+const KEY = Symbol.for("agentos.testTempDirs");
+const made = (): Set<string> => {
+  const g = globalThis as unknown as Record<symbol, Set<string> | undefined>;
+  return (g[KEY] ??= new Set<string>());
+};
+
+/** A fresh temp folder that is removed when the test file ends. */
+export function tempDir(prefix: string): string {
+  const dir = mkdtempSync(join(tmpdir(), prefix));
+  made().add(dir);
+  return dir;
+}
+
+export function removeTempDirs(): void {
+  for (const dir of made()) {
+    try {
+      rmSync(dir, { recursive: true, force: true, maxRetries: 5 });
+    } catch {
+      // the run root's removal is the backstop
+    }
+  }
+  made().clear();
+}

package/lib/workspaces.ts

@@ -8,10 +8,11 @@ import { db, type Workspace } from "./db";
 
 type WorkspaceRow = Omit<
   Workspace,
-  "collapsed" | "wake_tasks_on_pr" | "orch_mcp_servers"
+  "collapsed" | "wake_tasks_on_pr" | "orch_mcp_servers" | "orch_full_access"
 > & {
   collapsed: number;
   wake_tasks_on_pr: number;
+  orch_full_access: number;
   orch_mcp_servers: string;
 };
 
@@ -38,6 +39,7 @@ const toWorkspace = (row: WorkspaceRow): Workspace => ({
   ...row,
   collapsed: !!row.collapsed,
   wake_tasks_on_pr: !!row.wake_tasks_on_pr,
+  orch_full_access: !!row.orch_full_access,
   orch_mcp_servers: parseServers(row.orch_mcp_servers),
 });
 
@@ -86,6 +88,7 @@ export function updateWorkspace(
     sortOrder?: number;
     maxRunningTasks?: number | null;
     wakeTasksOnPR?: boolean;
+    orchFullAccess?: boolean;
     mcpServers?: string[];
   }
 ): Workspace | null {
@@ -93,13 +96,14 @@ export function updateWorkspace(
   if (!existing) return null;
   const name = updates.name?.trim() || existing.name;
   db.prepare(
-    `UPDATE workspaces SET name = ?, collapsed = ?, sort_order = ?, max_running_tasks = ?, wake_tasks_on_pr = ?, orch_mcp_servers = ? WHERE id = ?`
+    `UPDATE workspaces SET name = ?, collapsed = ?, sort_order = ?, max_running_tasks = ?, wake_tasks_on_pr = ?, orch_full_access = ?, orch_mcp_servers = ? WHERE id = ?`
   ).run(
     name,
     (updates.collapsed ?? existing.collapsed) ? 1 : 0,
     updates.sortOrder ?? existing.sort_order,
     taskLimit(updates.maxRunningTasks, existing.max_running_tasks),
     (updates.wakeTasksOnPR ?? existing.wake_tasks_on_pr) ? 1 : 0,
+    (updates.orchFullAccess ?? existing.orch_full_access) ? 1 : 0,
     JSON.stringify(serverNames(updates.mcpServers, existing.orch_mcp_servers)),
     id
   );

package/lib/worktree-sweep/caches.ts

@@ -10,6 +10,7 @@ import fs from "fs";
 import path from "path";
 import { execFile } from "child_process";
 import { SESSION_TMP_PREFIX, tmpName } from "../sessions/leftovers";
+import { isTestTempName } from "./testTemp";
 import type { Candidate, SweepSkipped } from "./types";
 
 const DAY_MS = 24 * 3600_000;
@@ -92,6 +93,11 @@ export async function findCacheLeftovers(deps: CacheDeps): Promise<{
   const livePrefixes = [...deps.liveIds].map(tmpName);
   for (const dir of subdirs(deps.tmpRoot)) {
     const name = path.basename(dir);
+    if (isTestTempName(name)) {
+      if (deps.now - mtime(dir) >= DAY_MS)
+        await add(dir, "test-temp", "left behind by a test run");
+      continue;
+    }
     const isSession = name.startsWith(SESSION_TMP_PREFIX);
     if (!isSession && !name.startsWith("agentos-preview-")) continue;
     if (deps.now - mtime(dir) < DAY_MS) continue;

package/lib/worktree-sweep/extras.ts

@@ -69,6 +69,18 @@ export async function cachedRootSize(
 
 export const forgetRootSizes = () => rootSizes.clear();
 
+// Removes a folder directly inside one of the roots, and nothing else.
+export async function dropFolderIn(
+  roots: string[],
+  folder: string
+): Promise<boolean> {
+  const target = path.resolve(folder);
+  if (!roots.some((r) => r && path.dirname(target) === path.resolve(r)))
+    return false;
+  await fs.promises.rm(target, { recursive: true, force: true });
+  return !fs.existsSync(target);
+}
+
 export async function defaultExtras(
   opts: { fresh?: boolean } = {}
 ): Promise<Extras> {
@@ -108,14 +120,10 @@ export async function defaultExtras(
       count: dirCount(SPARE_ROOT),
       bytes: await cachedRootSize(SPARE_ROOT, size, !!opts.fresh),
     },
-    drop: async (c) => {
-      if (c.kind === "database") return dropTaskDatabase(c, froms);
-      const target = path.resolve(c.path);
-      if (!roots.some((r) => r && path.dirname(target) === path.resolve(r)))
-        return false;
-      await fs.promises.rm(target, { recursive: true, force: true });
-      return !fs.existsSync(target);
-    },
+    drop: async (c) =>
+      c.kind === "database"
+        ? dropTaskDatabase(c, froms)
+        : dropFolderIn(roots, c.path),
   };
 }
 

package/lib/worktree-sweep/report.ts

@@ -21,6 +21,7 @@ const TITLES: Record<SweepKind, string> = {
   database: "Task databases",
   spare: "Dependency spares",
   temp: "Temp folders",
+  "test-temp": "Test temp folders",
   "derived-data": "Xcode build folders of removed worktrees",
 };
 

package/lib/worktree-sweep/settings.ts

@@ -83,8 +83,8 @@ export function projectSweepOverrides(): Array<{
 }
 
 // The full clean-up (test leftovers, task databases, spares, temp folders,
-// build caches) removes nothing until a person turns it on for this machine,
-// after reading what a dry run found.
+// build caches) removes nothing until Saad turns it on for this machine, or
+// the orchestrator does on his word after a dry run from the last hour.
 const ARMED_KEY = "worktree_sweep.reaper";
 
 export function reaperArmed(): boolean {

package/lib/worktree-sweep/testTemp.ts

@@ -0,0 +1,113 @@
+// Folders the test suite makes in the OS temp folder, by name. The sweep
+// takes only these, never another aos-… or agent-os-… folder, so AgentOS's
+// own temp folders (aos-review-, aos-rebase-…) and a person's are safe.
+// lib/test-temp.test.ts fails when a test uses a prefix missing here.
+export const TEST_TEMP_PREFIXES: readonly string[] = [
+  "agent-os-git-",
+  "agent-os-home-",
+  "agent-os-kept-",
+  "agent-os-limits-",
+  "agent-os-session-logs-",
+  "agent-os-test-",
+  "aos-acc-",
+  "aos-add-",
+  "aos-armed-repo-",
+  "aos-art-",
+  "aos-autodeploy-",
+  "aos-caches-",
+  "aos-channel-",
+  "aos-clone-",
+  "aos-config-",
+  "aos-crypt-",
+  "aos-db-",
+  "aos-db-drops-",
+  "aos-db-wt-",
+  "aos-decl-",
+  "aos-device-keys-",
+  "aos-done-home-",
+  "aos-done-repo-",
+  "aos-env-",
+  "aos-fast-",
+  "aos-files-",
+  "aos-git-",
+  "aos-gr-",
+  "aos-heavy-",
+  "aos-init-route-",
+  "aos-install-",
+  "aos-kind-",
+  "aos-launch-plain-",
+  "aos-launch-repo-",
+  "aos-limits-",
+  "aos-mcp-",
+  "aos-merge-policy-",
+  "aos-mig-",
+  "aos-move-",
+  "aos-no-approvals-",
+  "aos-nogit-",
+  "aos-notify-",
+  "aos-orch-act-",
+  "aos-orch-add-",
+  "aos-orch-approve-",
+  "aos-orch-armed-",
+  "aos-orch-asks-",
+  "aos-orch-brakes-",
+  "aos-orch-ext-repo-",
+  "aos-orch-external-",
+  "aos-orch-home-",
+  "aos-orch-move-",
+  "aos-orch-plain-",
+  "aos-orch-questions-",
+  "aos-orch-recipes-",
+  "aos-orch-remind-",
+  "aos-orch-repo-",
+  "aos-orch-rules-",
+  "aos-orch-settle-",
+  "aos-orch-signoff-",
+  "aos-orch-sweep-",
+  "aos-origin-",
+  "aos-path-",
+  "aos-plain-",
+  "aos-plan-",
+  "aos-ports-",
+  "aos-pr-",
+  "aos-pr-async-",
+  "aos-pr-create-",
+  "aos-pr-gen-",
+  "aos-pr-route-",
+  "aos-prompts-",
+  "aos-quick-",
+  "aos-quick-repo-",
+  "aos-relay-",
+  "aos-relay-none-",
+  "aos-report-",
+  "aos-resurrect-claude-",
+  "aos-resurrect-home-",
+  "aos-run-",
+  "aos-runner-",
+  "aos-sec-",
+  "aos-shot-",
+  "aos-sim-",
+  "aos-spare-",
+  "aos-stack-",
+  "aos-start-opts-",
+  "aos-start-plain-",
+  "aos-sweep-own-",
+  "aos-t-",
+  "aos-task-diff-",
+  "aos-temp-helper-",
+  "aos-tmux-",
+  "aos-transcripts-",
+  "aos-ui-",
+  "aos-upd-",
+  "aos-usage-",
+  "aos-wg-",
+  "aos-wg-path-",
+  "aos-wl-",
+  "aos-worker-env-",
+  "aos-worker-tmux-",
+  "aos-wsl-",
+  "aos-wt-",
+];
+
+export const isTestTempName = (name: string) =>
+  TEST_TEMP_PREFIXES.some((p) => name.startsWith(p));

package/lib/worktree-sweep/types.ts

@@ -6,6 +6,7 @@ export type SweepKind =
   | "database"
   | "spare"
   | "temp"
+  | "test-temp"
   | "derived-data";
 
 // Kinds that go only once the full clean-up is turned on.
@@ -14,6 +15,7 @@ export const ARMED_KINDS: ReadonlySet<SweepKind> = new Set([
   "database",
   "spare",
   "temp",
+  "test-temp",
   "derived-data",
 ]);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saadnvd1/agent-os",
-  "version": "0.3.664",
+  "version": "0.3.671",
   "description": "Self-hosted web UI for managing Claude Code sessions",
   "bin": {
     "agent-os": "scripts/agent-os"

package/scripts/autodeploy.test.ts

@@ -1,8 +1,8 @@
 import { execFileSync } from "child_process";
 import * as fs from "fs";
-import * as os from "os";
 import * as path from "path";
 import { describe, expect, it } from "vitest";
+import { tempDir } from "@/lib/test-temp";
 
 // Runs the real scripts/autodeploy in a scratch clone with a stub redeploy
 // (a pull) and wait-quiet, against a scratch origin and HOME.
@@ -11,7 +11,7 @@ const sh = (cwd: string, ...args: string[]) =>
   execFileSync("git", args, { cwd, encoding: "utf-8" }).trim();
 
 function setup() {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), "aos-autodeploy-"));
+  const root = tempDir("aos-autodeploy-");
   const origin = path.join(root, "origin.git");
   const work = path.join(root, "work");
   const clone = path.join(root, "live");

package/scripts/check-bundle.test.ts

@@ -1,13 +1,13 @@
 import { describe, expect, it } from "vitest";
 import { spawnSync } from "child_process";
 import fs from "fs";
-import os from "os";
 import path from "path";
+import { tempDir } from "@/lib/test-temp";
 
 const script = path.join(__dirname, "check-bundle.mjs");
 
 function run(stats: unknown) {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "bundle-"));
+  const dir = tempDir("bundle-");
   const file = path.join(dir, "stats.json");
   fs.writeFileSync(file, JSON.stringify(stats));
   const r = spawnSync(process.execPath, [script, file], { encoding: "utf-8" });

package/scripts/hooks/banned-terms.test.ts

@@ -4,11 +4,12 @@ import fs from "fs";
 import os from "os";
 import path from "path";
 import { GENERIC_TERMS, loadTerms, matcher, scanTree } from "./banned-terms";
+import { tempDir } from "@/lib/test-temp";
 
 const generic = GENERIC_TERMS[0];
 
 function tempRepo() {
-  const repo = fs.mkdtempSync(path.join(os.tmpdir(), "banned-terms-"));
+  const repo = tempDir("banned-terms-");
   const git = (...args: string[]) =>
     execFileSync("git", args, { cwd: repo, stdio: "pipe" });
   git("init", "-q");
@@ -22,7 +23,7 @@ describe("loadTerms", () => {
   });
 
   it("adds the private regexes, skipping blanks and comments", () => {
-    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "banned-names-"));
+    const dir = tempDir("banned-names-");
     const file = path.join(dir, "banned-names");
     fs.writeFileSync(file, "# names\nacme[ -]?widgets\n\n  zorp  \n");
     try {

package/scripts/hooks/staged-secrets.test.ts

@@ -1,9 +1,9 @@
 import { describe, expect, it } from "vitest";
 import { execFileSync, spawnSync } from "child_process";
 import fs from "fs";
-import os from "os";
 import path from "path";
 import { scanDiff } from "./staged-secrets";
+import { tempDir } from "@/lib/test-temp";
 
 // Fakes are built here, never written whole: a literal would be the very
 // thing this scan (and the merge gate) refuses.
@@ -62,7 +62,7 @@ describe("scanDiff", () => {
   });
 
   it("fails the commit on a staged secret, and passes once it's gone", () => {
-    const repo = fs.mkdtempSync(path.join(os.tmpdir(), "staged-secrets-"));
+    const repo = tempDir("staged-secrets-");
     const git = (...args: string[]) =>
       execFileSync("git", args, { cwd: repo, stdio: "pipe" });
     const scan = () =>