@vellumai/assistant 0.5.13 → 0.5.14

package/src/__tests__/docker-signing-key-bootstrap.test.ts

@@ -3,15 +3,38 @@
  * and file-based load/create (local mode).
  */
 
-import { mkdirSync, mkdtempSync, realpathSync, rmSync } from "node:fs";
+import {
+  mkdirSync,
+  mkdtempSync,
+  realpathSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { afterAll, afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import {
+  afterAll,
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  mock,
+  test,
+} from "bun:test";
 
 const testDir = realpathSync(mkdtempSync(join(tmpdir(), "signing-key-test-")));
 
+// Mock homedir() so the hardcoded LEGACY_SIGNING_KEY_PATH resolves inside
+// the temp test directory instead of the real ~/.vellum/protected/.
+mock.module("node:os", () => ({
+  homedir: () => testDir,
+  tmpdir,
+}));
+
 mock.module("../util/platform.js", () => ({
-  getRootDir: () => testDir,
+  getProtectedDir: () => join(testDir, ".vellum", "protected"),
+  getWorkspaceDir: () => join(testDir, ".vellum", "workspace"),
+  getDeprecatedDir: () => join(testDir, ".vellum", "workspace", "deprecated"),
   getDataDir: () => testDir,
   getDbPath: () => join(testDir, "test.db"),
   normalizeAssistantId: (id: string) => (id === "self" ? "self" : id),
@@ -38,7 +61,9 @@ const savedEnv: Record<string, string | undefined> = {};
 
 beforeEach(() => {
   savedEnv.ACTOR_TOKEN_SIGNING_KEY = process.env.ACTOR_TOKEN_SIGNING_KEY;
-  mkdirSync(join(testDir, "protected"), { recursive: true });
+  // Clean up key files from previous tests so they don't leak between cases.
+  rmSync(join(testDir, ".vellum"), { recursive: true, force: true });
+  mkdirSync(join(testDir, ".vellum", "protected"), { recursive: true });
 });
 
 afterEach(() => {
@@ -69,30 +94,51 @@ describe("resolveSigningKey", () => {
   test("rejects invalid ACTOR_TOKEN_SIGNING_KEY", () => {
     process.env.ACTOR_TOKEN_SIGNING_KEY = "tooshort";
 
-    expect(() => resolveSigningKey()).toThrow("Invalid ACTOR_TOKEN_SIGNING_KEY");
+    expect(() => resolveSigningKey()).toThrow(
+      "Invalid ACTOR_TOKEN_SIGNING_KEY",
+    );
   });
 
-  test("falls back to file-based load/create when env var is not set", () => {
+  test("falls back to disk when env var is not set", () => {
     delete process.env.ACTOR_TOKEN_SIGNING_KEY;
 
+    // resolveSigningKey now falls back to loadOrCreateSigningKey()
+    // which will generate a new key on disk.
     const key = resolveSigningKey();
+    expect(key).toBeInstanceOf(Buffer);
+    expect(key.length).toBe(32);
+  });
 
+  test("reads existing key from legacy protected/ path when env var is not set", () => {
+    delete process.env.ACTOR_TOKEN_SIGNING_KEY;
+
+    // Write a known key to the legacy protected/ location
+    const legacyKey = Buffer.alloc(32, 0xaa);
+    // LEGACY_SIGNING_KEY_PATH = join(homedir(), ".vellum", "protected", "actor-token-signing-key")
+    // homedir() is mocked to testDir
+    const legacyPath = join(
+      testDir,
+      ".vellum",
+      "protected",
+      "actor-token-signing-key",
+    );
+    mkdirSync(join(testDir, ".vellum", "protected"), { recursive: true });
+    writeFileSync(legacyPath, legacyKey, { mode: 0o600 });
+
+    const key = resolveSigningKey();
     expect(key).toBeInstanceOf(Buffer);
     expect(key.length).toBe(32);
+    expect(key.toString("hex")).toBe(legacyKey.toString("hex"));
   });
 
-  test("env var takes priority over file on disk", () => {
+  test("different env var values produce different keys", () => {
     process.env.ACTOR_TOKEN_SIGNING_KEY = VALID_HEX_KEY;
+    const key1 = resolveSigningKey();
 
-    // First call creates a file-based key
-    delete process.env.ACTOR_TOKEN_SIGNING_KEY;
-    const fileKey = resolveSigningKey();
-
-    // Second call with env var should use the env var, not the file
     process.env.ACTOR_TOKEN_SIGNING_KEY = "cd".repeat(32);
-    const envKey = resolveSigningKey();
+    const key2 = resolveSigningKey();
 
-    expect(envKey.toString("hex")).toBe("cd".repeat(32));
-    expect(envKey.toString("hex")).not.toBe(fileKey.toString("hex"));
+    expect(key2.toString("hex")).toBe("cd".repeat(32));
+    expect(key2.toString("hex")).not.toBe(key1.toString("hex"));
   });
 });

package/src/__tests__/dynamic-skill-workflow-prompt.test.ts

@@ -1,41 +1,11 @@
-import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
+import { mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 
-const TEST_DIR = join(tmpdir(), `vellum-dyn-skill-test-${crypto.randomUUID()}`);
+const TEST_DIR = process.env.VELLUM_WORKSPACE_DIR!;
 
 import { mock } from "bun:test";
 
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-const realPlatform = require("../util/platform.js");
-mock.module("../util/platform.js", () => ({
-  ...realPlatform,
-  getRootDir: () => TEST_DIR,
-  getDataDir: () => TEST_DIR,
-  getWorkspaceDir: () => TEST_DIR,
-  getWorkspaceConfigPath: () => join(TEST_DIR, "config.json"),
-  getWorkspaceSkillsDir: () => join(TEST_DIR, "skills"),
-  getWorkspaceHooksDir: () => join(TEST_DIR, "hooks"),
-  getWorkspacePromptPath: (file: string) => join(TEST_DIR, file),
-  ensureDataDir: () => {},
-  getPidPath: () => join(TEST_DIR, "vellum.pid"),
-  getDbPath: () => join(TEST_DIR, "data", "assistant.db"),
-  getLogPath: () => join(TEST_DIR, "logs", "vellum.log"),
-  getHistoryPath: () => join(TEST_DIR, "history"),
-  getHooksDir: () => join(TEST_DIR, "hooks"),
-
-  getSandboxRootDir: () => join(TEST_DIR, "sandbox"),
-  getSandboxWorkingDir: () => TEST_DIR,
-  getInterfacesDir: () => join(TEST_DIR, "interfaces"),
-  isMacOS: () => process.platform === "darwin",
-  isLinux: () => process.platform === "linux",
-  isWindows: () => process.platform === "win32",
-  getPlatformName: () => process.platform,
-  getClipboardCommand: () => null,
-  readSessionToken: () => null,
-}));
-
 const noopLogger = new Proxy({} as Record<string, unknown>, {
   get: (_target, prop) => (prop === "child" ? () => noopLogger : () => {}),
 });
@@ -82,7 +52,6 @@ const { _setOverridesForTesting } =
 
 describe("Dynamic Skill Authoring Workflow moved to tool descriptions", () => {
   beforeEach(() => {
-    mkdirSync(TEST_DIR, { recursive: true });
     _setOverridesForTesting({
       browser: true,
     });
@@ -90,9 +59,6 @@ describe("Dynamic Skill Authoring Workflow moved to tool descriptions", () => {
 
   afterEach(() => {
     _setOverridesForTesting({});
-    if (existsSync(TEST_DIR)) {
-      rmSync(TEST_DIR, { recursive: true, force: true });
-    }
   });
 
   test("system prompt no longer contains Dynamic Skill Authoring section", () => {

package/src/__tests__/email-cli.test.ts

@@ -4,21 +4,21 @@ import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 
 // ---------------------------------------------------------------------------
-// Test isolation: override BASE_DATA_DIR so guardrails state uses a temp dir
+// Test isolation: override VELLUM_WORKSPACE_DIR so guardrails state uses a temp dir
 // ---------------------------------------------------------------------------
 const testDir = join(tmpdir(), `email-cli-test-${Date.now()}`);
-const originalBaseDataDir = process.env.BASE_DATA_DIR;
+const originalWorkspaceDir = process.env.VELLUM_WORKSPACE_DIR;
 
 beforeEach(() => {
   mkdirSync(testDir, { recursive: true });
-  process.env.BASE_DATA_DIR = testDir;
+  process.env.VELLUM_WORKSPACE_DIR = testDir;
 });
 
 afterEach(() => {
-  if (originalBaseDataDir === undefined) {
-    delete process.env.BASE_DATA_DIR;
+  if (originalWorkspaceDir === undefined) {
+    delete process.env.VELLUM_WORKSPACE_DIR;
   } else {
-    process.env.BASE_DATA_DIR = originalBaseDataDir;
+    process.env.VELLUM_WORKSPACE_DIR = originalWorkspaceDir;
   }
   try {
     rmSync(testDir, { recursive: true, force: true });

package/src/__tests__/ephemeral-permissions.test.ts

@@ -1,5 +1,4 @@
-import { mkdirSync, mkdtempSync } from "node:fs";
-import { tmpdir } from "node:os";
+import { mkdirSync } from "node:fs";
 import { join } from "node:path";
 import {
   afterEach,
@@ -11,21 +10,10 @@ import {
   test,
 } from "bun:test";
 
-// Use a temp directory so trust-store doesn't touch ~/.vellum
-const testDir = mkdtempSync(join(tmpdir(), "ephemeral-perm-test-"));
-
-mock.module("../util/platform.js", () => ({
-  getRootDir: () => testDir,
-  getDataDir: () => join(testDir, "data"),
-  getWorkspaceSkillsDir: () => join(testDir, "skills"),
-  isMacOS: () => process.platform === "darwin",
-  isLinux: () => process.platform === "linux",
-  isWindows: () => process.platform === "win32",
-  getPidPath: () => join(testDir, "test.pid"),
-  getDbPath: () => join(testDir, "test.db"),
-  getLogPath: () => join(testDir, "test.log"),
-  ensureDataDir: () => {},
-}));
+const testDir = process.env.VELLUM_WORKSPACE_DIR!;
+
+// Point the file-based trust backend at the test temp dir.
+process.env.GATEWAY_SECURITY_DIR = join(testDir, "protected");
 
 mock.module("../util/logger.js", () => ({
   getLogger: () =>

package/src/__tests__/first-greeting.test.ts

@@ -1,42 +1,13 @@
-import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
+import { existsSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { afterEach, beforeEach, describe, expect, it, mock } from "bun:test";
+import { describe, expect, it } from "bun:test";
 
-let tempDir: string;
-
-mock.module("../util/platform.js", () => ({
-  getWorkspacePromptPath: mock((file: string) => join(tempDir, file)),
-  getWorkspaceDir: () => tempDir,
-  getRootDir: () => tempDir,
-  getDataDir: () => join(tempDir, "data"),
-  getPlatformName: () => "darwin",
-  isMacOS: () => false,
-  isLinux: () => false,
-  isWindows: () => false,
-  ensureDataDir: () => {},
-  getDbPath: () => "",
-  getLogPath: () => "",
-  getHistoryPath: () => "",
-  getHooksDir: () => "",
-  getSessionTokenPath: () => "",
-  getPlatformTokenPath: () => "",
-  getPidPath: () => "",
-}));
+const tempDir = process.env.VELLUM_WORKSPACE_DIR!;
 
 const { isWakeUpGreeting, getCannedFirstGreeting, CANNED_FIRST_GREETING } =
   await import("../daemon/first-greeting.js");
 
 describe("first-greeting", () => {
-  beforeEach(() => {
-    tempDir = join(tmpdir(), `first-greeting-test-${Date.now()}`);
-    mkdirSync(tempDir, { recursive: true });
-  });
-
-  afterEach(() => {
-    rmSync(tempDir, { recursive: true, force: true });
-  });
-
   describe("isWakeUpGreeting", () => {
     it("returns true for wake-up greeting with 0 messages and BOOTSTRAP.md present", () => {
       writeFileSync(join(tempDir, "BOOTSTRAP.md"), "bootstrap content");
@@ -71,6 +42,7 @@ describe("first-greeting", () => {
     });
 
     it("returns false when BOOTSTRAP.md doesn't exist", () => {
+      rmSync(join(tempDir, "BOOTSTRAP.md"), { force: true });
       expect(existsSync(join(tempDir, "BOOTSTRAP.md"))).toBe(false);
       expect(isWakeUpGreeting("Wake up, my friend.", 0)).toBe(false);
     });

package/src/__tests__/followup-tools.test.ts

@@ -1,21 +1,5 @@
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
 import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
-const testDir = mkdtempSync(join(tmpdir(), "followup-tools-test-"));
-
-mock.module("../util/platform.js", () => ({
-  getDataDir: () => testDir,
-  isMacOS: () => process.platform === "darwin",
-  isLinux: () => process.platform === "linux",
-  isWindows: () => process.platform === "win32",
-  getPidPath: () => join(testDir, "test.pid"),
-  getDbPath: () => join(testDir, "test.db"),
-  getLogPath: () => join(testDir, "test.log"),
-  ensureDataDir: () => {},
-}));
-
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
     new Proxy({} as Record<string, unknown>, {
@@ -42,11 +26,6 @@ initializeDb();
 
 afterAll(() => {
   resetDb();
-  try {
-    rmSync(testDir, { recursive: true });
-  } catch {
-    /* best effort */
-  }
 });
 
 function getRawDb(): Database {

package/src/__tests__/gateway-only-enforcement.test.ts

@@ -9,28 +9,8 @@
  * - Relay WebSocket upgrade allowed from private network peers/origins
  * - Startup warning when RUNTIME_HTTP_HOST is not loopback
  */
-import { mkdtempSync, realpathSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
 import { afterAll, beforeAll, describe, expect, mock, test } from "bun:test";
 
-const testDir = realpathSync(
-  mkdtempSync(join(tmpdir(), "gw-only-enforcement-test-")),
-);
-
-mock.module("../util/platform.js", () => ({
-  getRootDir: () => testDir,
-  getDataDir: () => testDir,
-  getWorkspaceConfigPath: () => join(testDir, "config.json"),
-  isMacOS: () => process.platform === "darwin",
-  isLinux: () => process.platform === "linux",
-  isWindows: () => process.platform === "win32",
-  getPidPath: () => join(testDir, "test.pid"),
-  getDbPath: () => join(testDir, "test.db"),
-  getLogPath: () => join(testDir, "test.log"),
-  ensureDataDir: () => {},
-}));
-
 const logMessages: { level: string; msg: string; args?: unknown }[] = [];
 
 mock.module("../util/logger.js", () => ({

package/src/__tests__/guardian-action-conversation-turn.test.ts

@@ -1,23 +1,5 @@
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
 import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
-const testDir = mkdtempSync(
-  join(tmpdir(), "guardian-action-conversation-turn-test-"),
-);
-
-mock.module("../util/platform.js", () => ({
-  getDataDir: () => testDir,
-  isMacOS: () => process.platform === "darwin",
-  isLinux: () => process.platform === "linux",
-  isWindows: () => process.platform === "win32",
-  getPidPath: () => join(testDir, "test.pid"),
-  getDbPath: () => join(testDir, "test.db"),
-  getLogPath: () => join(testDir, "test.log"),
-  ensureDataDir: () => {},
-}));
-
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
     new Proxy({} as Record<string, unknown>, {
@@ -153,11 +135,6 @@ describe("guardian-action-conversation-turn", () => {
 
   afterAll(() => {
     resetDb();
-    try {
-      rmSync(testDir, { recursive: true });
-    } catch {
-      /* best effort */
-    }
   });
 
   // ── processGuardianFollowUpTurn: classification ─────────────────────

package/src/__tests__/guardian-action-followup-executor.test.ts

@@ -1,23 +1,5 @@
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
 import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
-const testDir = mkdtempSync(
-  join(tmpdir(), "guardian-action-followup-executor-test-"),
-);
-
-mock.module("../util/platform.js", () => ({
-  getDataDir: () => testDir,
-  isMacOS: () => process.platform === "darwin",
-  isLinux: () => process.platform === "linux",
-  isWindows: () => process.platform === "win32",
-  getPidPath: () => join(testDir, "test.pid"),
-  getDbPath: () => join(testDir, "test.db"),
-  getLogPath: () => join(testDir, "test.log"),
-  ensureDataDir: () => {},
-}));
-
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
     new Proxy({} as Record<string, unknown>, {
@@ -180,11 +162,6 @@ describe("guardian-action-followup-executor", () => {
 
   afterAll(() => {
     resetDb();
-    try {
-      rmSync(testDir, { recursive: true });
-    } catch {
-      /* best effort */
-    }
   });
 
   // ── Counterparty resolution ─────────────────────────────────────────

package/src/__tests__/guardian-action-followup-store.test.ts

@@ -1,21 +1,5 @@
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
 import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
-const testDir = mkdtempSync(join(tmpdir(), "guardian-action-followup-test-"));
-
-mock.module("../util/platform.js", () => ({
-  getDataDir: () => testDir,
-  isMacOS: () => process.platform === "darwin",
-  isLinux: () => process.platform === "linux",
-  isWindows: () => process.platform === "win32",
-  getPidPath: () => join(testDir, "test.pid"),
-  getDbPath: () => join(testDir, "test.db"),
-  getLogPath: () => join(testDir, "test.log"),
-  ensureDataDir: () => {},
-}));
-
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
     new Proxy({} as Record<string, unknown>, {
@@ -93,11 +77,6 @@ describe("guardian-action-followup-store", () => {
 
   afterAll(() => {
     resetDb();
-    try {
-      rmSync(testDir, { recursive: true });
-    } catch {
-      /* best effort */
-    }
   });
 
   // ── markTimedOutWithReason ──────────────────────────────────────────

package/src/__tests__/guardian-action-grant-mint-consume.test.ts

@@ -10,26 +10,10 @@
  *   5. Second consume attempt is denied (one-time use)
  */
 
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
 import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
-const testDir = mkdtempSync(join(tmpdir(), "guardian-action-grant-e2e-"));
-
 // ── Platform + logger mocks ─────────────────────────────────────────
 
-mock.module("../util/platform.js", () => ({
-  getDataDir: () => testDir,
-  isMacOS: () => process.platform === "darwin",
-  isLinux: () => process.platform === "linux",
-  isWindows: () => process.platform === "win32",
-  getPidPath: () => join(testDir, "test.pid"),
-  getDbPath: () => join(testDir, "test.db"),
-  getLogPath: () => join(testDir, "test.log"),
-  ensureDataDir: () => {},
-}));
-
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
     new Proxy({} as Record<string, unknown>, {
@@ -61,11 +45,6 @@ initializeDb();
 
 afterAll(() => {
   resetDb();
-  try {
-    rmSync(testDir, { recursive: true });
-  } catch {
-    /* best effort */
-  }
 });
 
 // ── Constants ───────────────────────────────────────────────────────

package/src/__tests__/guardian-action-late-reply.test.ts

@@ -1,21 +1,5 @@
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
 import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
-const testDir = mkdtempSync(join(tmpdir(), "guardian-action-late-reply-test-"));
-
-mock.module("../util/platform.js", () => ({
-  getDataDir: () => testDir,
-  isMacOS: () => process.platform === "darwin",
-  isLinux: () => process.platform === "linux",
-  isWindows: () => process.platform === "win32",
-  getPidPath: () => join(testDir, "test.pid"),
-  getDbPath: () => join(testDir, "test.db"),
-  getLogPath: () => join(testDir, "test.log"),
-  ensureDataDir: () => {},
-}));
-
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
     new Proxy({} as Record<string, unknown>, {
@@ -133,11 +117,6 @@ describe("guardian-action-late-reply", () => {
 
   afterAll(() => {
     resetDb();
-    try {
-      rmSync(testDir, { recursive: true });
-    } catch {
-      /* best effort */
-    }
   });
 
   // ── getExpiredDeliveriesByDestination ──────────────────────────────

package/src/__tests__/guardian-action-store.test.ts

@@ -1,21 +1,5 @@
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
 import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
-const testDir = mkdtempSync(join(tmpdir(), "guardian-action-store-test-"));
-
-mock.module("../util/platform.js", () => ({
-  getDataDir: () => testDir,
-  isMacOS: () => process.platform === "darwin",
-  isLinux: () => process.platform === "linux",
-  isWindows: () => process.platform === "win32",
-  getPidPath: () => join(testDir, "test.pid"),
-  getDbPath: () => join(testDir, "test.db"),
-  getLogPath: () => join(testDir, "test.log"),
-  ensureDataDir: () => {},
-}));
-
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
     new Proxy({} as Record<string, unknown>, {
@@ -75,11 +59,6 @@ describe("guardian-action-store", () => {
 
   afterAll(() => {
     resetDb();
-    try {
-      rmSync(testDir, { recursive: true });
-    } catch {
-      // best-effort cleanup
-    }
   });
 
   // ── Helper to create a pending request+delivery targeting a conversation ──

package/src/__tests__/guardian-action-sweep.test.ts

@@ -1,21 +1,5 @@
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
 import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
-const testDir = mkdtempSync(join(tmpdir(), "guardian-action-sweep-test-"));
-
-mock.module("../util/platform.js", () => ({
-  getDataDir: () => testDir,
-  isMacOS: () => process.platform === "darwin",
-  isLinux: () => process.platform === "linux",
-  isWindows: () => process.platform === "win32",
-  getPidPath: () => join(testDir, "test.pid"),
-  getDbPath: () => join(testDir, "test.db"),
-  getLogPath: () => join(testDir, "test.log"),
-  ensureDataDir: () => {},
-}));
-
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
     new Proxy({} as Record<string, unknown>, {
@@ -89,11 +73,6 @@ describe("guardian-action-sweep", () => {
   afterAll(() => {
     stopGuardianActionSweep();
     resetDb();
-    try {
-      rmSync(testDir, { recursive: true });
-    } catch {
-      /* best effort */
-    }
   });
 
   test("sweepExpiredGuardianActions expires requests past their expiresAt", async () => {

package/src/__tests__/guardian-binding-drift-heal.test.ts

@@ -1,23 +1,5 @@
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
 import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
-const testDir = mkdtempSync(
-  join(tmpdir(), "guardian-binding-drift-heal-test-"),
-);
-
-mock.module("../util/platform.js", () => ({
-  getDataDir: () => testDir,
-  isMacOS: () => process.platform === "darwin",
-  isLinux: () => process.platform === "linux",
-  isWindows: () => process.platform === "win32",
-  getPidPath: () => join(testDir, "test.pid"),
-  getDbPath: () => join(testDir, "test.db"),
-  getLogPath: () => join(testDir, "test.log"),
-  ensureDataDir: () => {},
-}));
-
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
     new Proxy({} as Record<string, unknown>, {
@@ -45,11 +27,6 @@ describe("healGuardianBindingDrift", () => {
 
   afterAll(() => {
     resetDb();
-    try {
-      rmSync(testDir, { recursive: true });
-    } catch {
-      // best-effort cleanup
-    }
   });
 
   test("heals drift when both principals have vellum-principal- prefix", () => {