[mrthankyou]

Fixes #1017. Fixes #1018.

Both issues come from the same line, repeated 136 times:

fs.mkdtempSync(path.join(os.tmpdir(), "some-prefix-"))

It is not canonical. On macOS os.tmpdir() is /var/folders/... and /var
is a symlink to /private/var, so the runtime rejects the fixture's own root --
correctly, since that check exists to stop a component being swapped underneath
a resolved path. The suite failed against itself rather than against anything
under test. Linux is unaffected (/tmp is already canonical), which is why CI
never saw this.

It is not removable. Sealed execution snapshots are left dr-x------, and
unlinking an entry needs the write bit on its parent rather than on the entry
itself, so rmSync cannot remove a tree that contains one. Of 39 files creating
temporary roots, 25 attempted removal and 11 restored permissions first.

Measured on macOS, main vs this branch, default tmpdir throughout

	main	this branch
distinct failures	362	219
new failures	—	0
must be canonical failures	44	0
leaked directories	1,232	0
leaked files	567,065	0

The remaining 219 all fail on main too. 159 are the darwin /proc limitation
tracked in #1011 and fixed by #1016; the rest are unrelated to temporary roots.

The one directory that still survives a run is a deliberately retained
native-continuation controller root, which production removes through its own
exit hook -- not a leak, and left alone.

What changed

temporaryRoot(prefix) builds on a canonicalized tmpdir and registers the root
for removal, restoring owner write permission on directories on the way down --
the same treatment restoreRemovableDirectoryPermissions already applies in
clean.ts (#985).

registerTemporaryPath(dir) covers paths a fixture places beside its root
rather than inside it, which root removal cannot reach. These were the last
survivors: ${project}-fake-bin, -fake-ps-bin, -redaction-bin,
-sealed-runner-interpreter and friends.

Two production sites are canonicalized for the same reason the tests are -- the
runtime requires canonical roots, so it should create them:

• smithers.ts ultrafuzz-controller-
• workspace-handoff.ts ultrafuzz-workspace-index-

Incidental cleanups the rewrite forced:

• trusted-cli.test.ts had a local temporaryRoot() wrapper that the rename
  made self-recursive; removed, with its prefix inlined at its 16 call sites.
• workflow-execution-snapshot-capability.test.ts had a local const shadowing
  the import; renamed to fixtureRoot.
• 36 files no longer need os, and 3 no longer need mkdtempSync.

Why this is worth more than the failure count suggests

A macOS contributor currently cannot tell a real regression from the noise: the
suite is red before they touch anything, and the failures name canonicality
rather than the temporary directory, so the cause is not evident from the
output. The accumulation problem compounds it -- the slowdown is silent and
reads as a hang or as a regression in whatever you happen to be editing.

It also means darwin-specific defects could not be caught by the suite at all,
because it never got far enough to exercise one. #1016 is a concrete instance:
the tests that would have caught it were skipping.

Verification

• tsc --noEmit (both tsconfig.json and tsconfig.test.json), eslint, prettier --check: clean
• pnpm build: clean
• Full runtime suite on macOS with the default tmpdir, before and after, with the temporary directory cleared between runs so the leak delta is real

Greptile Summary

The PR centralizes runtime-test temporary-root creation and cleanup while canonicalizing the two production temporary roots that feed trusted runtime paths.

• Adds a shared canonical temporary-root helper with exit-time permission restoration and recursive cleanup.
• Registers fixture-created sibling paths that root cleanup cannot otherwise reach.
• Migrates runtime fixtures to the helper and removes obsolete filesystem imports and local wrappers.
• Canonicalizes Smithers controller and workspace-index temporary roots before creation.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
packages/runtime/test/temporary-root.ts	Adds the shared canonical-root registry and best-effort exit cleanup used across runtime tests.
packages/runtime/src/smithers.ts	Creates the operator-controller project beneath the canonical system temporary directory.
packages/runtime/src/workspace-handoff.ts	Creates temporary Git index directories beneath the canonical system temporary directory.
packages/runtime/test/runtime.test.ts	Migrates the largest runtime fixture surface to canonical registered roots and explicitly tracks sibling fixture paths.
packages/runtime/test/trusted-cli.test.ts	Removes a conflicting local temporary-root wrapper and uses the shared helper with explicit prefixes.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Test or runtime requests temporary root] --> B[Resolve canonical system tmpdir]
  B --> C[Create uniquely prefixed directory]
  C --> D{Test fixture?}
  D -->|Yes| E[Register root and sibling paths]
  D -->|No| F[Use runtime-specific cleanup ownership]
  E --> G[Process exit]
  G --> H[Restore owner permissions recursively]
  H --> I[Remove registered paths]

Loading

_{Reviews (4): Last reviewed commit: "Merge remote-tracking branch 'origin/mai..." | Re-trigger Greptile}

Context used:

• Knowledge Base — Execution runtime
• Knowledge Base — Runtime orchestration

[mrthankyou]

Rebased onto fix/gitleaks-test-fixture-allowlist (#1021) and retargeted this PR's base to it.

This PR was failing External static analysis (and release-gates with it) on pre-existing secret-scanner findings, not on anything it adds. The gate runs with VALIDATE_ALL_CODEBASE: false, so gitleaks scans changed files rather than changed lines -- editing any part of a file that already contains a fake credential fixture fails the gate on content this change never touched. #1021 marks those fixtures.

Stacking rather than duplicating the markers keeps this diff to its own delta (unchanged at +292/-211) and makes the dependency explicit instead of implicit. It should be retargeted back to main once #1021 lands; the rebase was clean, so that will be a no-op.

To be explicit, since the failure name invites the wrong conclusion: no credential is added by this branch. Scanning only the lines it adds reports no findings, and the flagged fixtures trace to #865.