test: isolate and clean temporary test roots

[hxy91819]

Summary

Repeated test runs can leave fixture directories behind in the shared system temporary directory. Some fixtures intentionally contain non-regular files such as FIFOs, which can also cause content-inspecting host cleanup tools to block indefinitely.

This change keeps the FIFO safety coverage while tightening the test lifecycle:

• track and remove validation fixtures after each test
• run standard test commands inside a unique per-run temporary root
• clean the run root after success, assertion failure, and termination signals
• reap abandoned run roots after a TTL while protecting active concurrent runs with a heartbeat
• remove roots recursively without opening fixture contents

The tracker follows the established OpenClaw auto-cleanup temp-directory pattern, adapted locally so ClawSweeper does not depend on another repository's test helpers.

Review follow-up

Validated at head a602f2ba67.

• P2 fixed at the supported test-entry boundary: target-validation is now a canonical run-node-tests.mjs target. Validation fixtures created through the supported narrow-test command inherit the run root, so a SIGKILL, crash, or reboot leaves a clawsweeper-test-run-* root that the existing heartbeat/TTL reaper recognizes. The raw node --test ... target-validation.test.ts command is no longer used as the recommended evidence path.
• P3 fixed: the Windows CI job no longer passes test/codex-process.test.ts twice; the named target remains the single source of file selection.
• A new heartbeat-specific unit test was not added because this follow-up does not change heartbeat semantics; the existing lifecycle suite continues to cover stale-root reaping, assertion failure, SIGTERM, and successful cleanup.

Local black-box validation

Linux, Node v24.15.0. Corepack resolved the repository pin to pnpm 11.10.0.

Runner and lifecycle behavior

node --test test/run-node-tests.test.ts test/test-temp-root-runner.test.ts

Result: 10 passed, 0 failed. This covers named-target selection plus successful FIFO cleanup, assertion-failure cleanup, stale-root TTL cleanup, and SIGTERM cleanup through the real CLI runner.

Incident-equivalent FIFO fixture through the canonical target

node scripts/run-node-tests.mjs target-validation --test-concurrency=1 -- \
  --test-name-pattern "workspace preflight rejects non-regular package metadata without blocking"

Result: 1 passed, 0 failed; FIFO behavior completed in 19.75 ms. Matching counts were unchanged:

clawsweeper-test-run-*   0 -> 0
clawsweeper-validation-* 0 -> 0

Repeated full target validation through the canonical target

Executed twice:

node scripts/run-node-tests.mjs target-validation --test-concurrency=1 -- \
  --test-reporter=tap

Results:

• run 1: 198 passed, 3 skipped, 0 failed; 133.8 s test duration / 134 s wall clock
• run 2: 198 passed, 3 skipped, 0 failed; 131.6 s test duration / 131 s wall clock
• clawsweeper-test-run-*: 0 -> 0 -> 0
• clawsweeper-validation-*: 0 -> 0 -> 0
• no run root or validation fixture remained after either run

Repository checks

• corepack pnpm run check: static checks, formatting, builds, lint, and changed coverage passed; the final full-coverage run failed only in three test/review-blob-hydration.test.ts partial-clone hydration cases, which returned hydrated: false / blobs: 0 in this environment. The same failures reproduce when that file is run directly outside the new runner; this PR does not modify that test or hydration code. The current-head hosted pnpm check passed: https://github.com/openclaw/clawsweeper/actions/runs/31464912192/job/93695706262.
• focused autoreview before commit: clean; TruffleHog clean
• branch autoreview against origin/main after commit: clean; TruffleHog clean

Scope boundary

This change affects only test fixture and test-runner lifecycle. It does not change OpenClaw Bay state, queues, sweep workflows, publication behavior, or dashboard contracts. It does not downgrade pnpm and does not delete host-level pnpm, npm, or Docker caches.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 23, 2026, 11:00 AM ET / 15:00 UTC.

ClawSweeper review

What this changes

The PR runs named Node test targets under a unique temporary root, cleans test fixtures and stale roots, and routes selected package and Windows CI test commands through that runner.

Merge readiness

⚠️ Ready for maintainer review - 4 items remain

Keep open for maintainer review: the PR’s cleanup approach is not on current main, but the branch is currently dirty against main and needs a rebase plus refreshed proof before it can land. No discrete correctness defect was found in the reviewed branch diff.

Priority: P3
Reviewed head: a602f2ba67f9db0b25c604324cacd307a1075ed8
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch has focused lifecycle coverage and useful historical proof, but its dirty current-main merge state prevents a higher readiness rating.
Proof confidence	🌊 off-meta tidepool	Not applicable: This MEMBER-authored PR is exempt from the contributor proof gate; its PR body nevertheless includes useful after-fix local lifecycle and hosted-check evidence that must be refreshed after rebase.
Patch quality	🦐 gold shrimp (3/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This MEMBER-authored PR is exempt from the contributor proof gate; its PR body nevertheless includes useful after-fix local lifecycle and hosted-check evidence that must be refreshed after rebase.
Evidence reviewed	4 items	Branch implementation: The PR creates a unique run root, assigns TMPDIR/TEMP/TMP to the child test process, maintains a heartbeat, and removes the root in finally cleanup. Current-main comparison: Current main’s runner still spawns Node tests without a per-run temporary-root environment, so the central cleanup behavior is not already implemented. Current-main provenance: Current-main history shows later changes to the overlapping CI, package-script, runner, and target-validation surfaces, making the old-base proof stale for the merge result.
Findings	None	None.
Security	None	None.

Live Verification

Command: node scripts/run-node-tests.mjs unit --test-concurrency=1 -- --test-name-pattern "test runner expands named targets with sorted de-duplicated files"

Result: PASS (completed)

✖ test/review-preparation.test.ts (48.461811ms)
node:internal/modules/esm/resolve:271
    throw new ERR_MODULE_NOT_FOUND(
          ^

Error [ERR_MODULE_NOT_FOUND]: Cannot find module '/tmp/clawsweeper-live-proof-1099-2jGgjg/target/dist/clawsweeper.js' imported from /tmp/clawsweeper-live-proof-
1099-2jGgjg/target/test/review-prompt-context.test.ts
    at finalizeResolution (node:internal/modules/esm/resolve:271:11)
    at moduleResolve (node:internal/modules/esm/resolve:865:10)
    at defaultResolve (node:internal/modules/esm/resolve:992:11)
    at #cachedDefaultResolve (node:internal/modules/esm/loader:701:20)
    at #resolveAndMaybeBlockOnLoaderThread (node:internal/modules/esm/loader:721:38)
    at ModuleLoader.resolveSync (node:internal/modules/esm/loader:759:56)
    at #resolve (node:internal/modules/esm/loader:683:17)
    at ModuleLoader.getOrCreateModuleJob (node:internal/modules/esm/loader:603:35)
    at ModuleJob.syncLink (node:internal/modules/esm/module_job:163:33)
    at ModuleJob.link (node:internal/modules/esm/module_job:253:17) {
  code: 'ERR_MODULE_NOT_FOUND',
  url: 'file:///tmp/clawsweeper-live-proof-1099-2jGgjg/target/dist/clawsweeper.js'
}

Node.js v24.19.0
✖ test/review-prompt-context.test.ts (48.192263ms)
node:internal/modules/esm/resolve:271
    throw new ERR_MODULE_NOT_FOUND(
          ^

Error [ERR_MODULE_NOT_FOUND]: Cannot find module '/tmp/clawsweeper-live-proof-1099-2jGgjg/target/dist/clawsweeper.js' imported from /tmp/clawsweeper-live-proof-
1099-2jGgjg/target/test/review-prompt-policy.test.ts
    at finalizeResolution (node:internal/modules/esm/resolve:271:11)
    at moduleResolve (node:internal/modules/esm/resolve:865:10)
    at defaultResolve (node:internal/modules/esm/resolve:992:11)
    at #cachedDefaultResolve (node:internal/modules/esm/loader:701:20)
    at #resolveAndMaybeBlockOnLoaderThread (node:internal/modules/esm/loader:721:38)
    at ModuleLoader.resolveSync (node:internal/modules/esm/loader:759:56)
    at #resolve (node:internal/modules/esm/loader:683:17)
    at ModuleLoader.getOrCreateModuleJob (node:internal/modules/esm/loader:603:35)
    at ModuleJob.syncLink (node:internal/modules/esm/module_job:163:33)
    at ModuleJob.link (node:internal/modules/esm/module_job:253:17) {
  code: 'ERR_MODULE_NOT_FOUND',
  url: 'file:///tmp/clawsweeper-live-proof-1099-2jGgjg/target/dist/clawsweeper.js'
}

Node.js v24.19.0
✖ test/review-prompt-policy.test.ts (62.345462ms)
node:internal/modules/esm/resolve:271
    throw new ERR_MODULE_NOT_FOUND(
          ^

Error [ERR_MODULE_NOT_FOUND]: Cannot find module '/tmp/clawsweeper-live-proof-1099-2jGgjg/target/dist/review-recovery-label-backfill.js' imported from /tmp/claw
sweeper-live-proof-1099-2jGgjg/target/test/review-recovery-label-backfill.test.ts
    at finalizeResolution (node:internal/modules/esm/resolve:271:11)
    at moduleResolve (node:internal/modules/esm/resolve:865:10)
    at defaultResolve (node:internal/modules/esm/resolve:992:11)
    at #cachedDefaultResolve (node:internal/modules/esm/loader:701:20)
    at #resolveAndMaybeBlockOnLoaderThread (node:internal/modules/esm/loader:721:38)
    at ModuleLoader.resolveSync (node:internal/modules/esm/loader:759:56)
    at #resolve (node:internal/modules/esm/loader:683:17)
    at ModuleLoader.getOrCreateModuleJob (node:internal/modules/esm/loader:603:35)
    at ModuleJob.syncLink (node:internal/modules/esm/module_job:163:33)
    at ModuleJob.link (node:internal/modules/esm/module_job:253:17) {
  code: 'ERR_MODULE_NOT_FOUND',
  url: 'file:///tmp/clawsweeper-live-proof-1099-2jGgjg/target/dist/review-recovery-label-backfill.js'
}

Node.js v24.19.0
✖ test/review-recovery-label-backfill.test.ts (55.924114ms)
✔ test/review-reliability-workflow.test.ts (78.206956ms)
✔ test/review-run-telemetry.test.ts (67.686161ms)
node:internal/modules/esm/resolve:271
    throw new ERR_MODULE_NOT_FOUND(
          ^

Error [ERR_MODULE_NOT_FOUND]: Cannot find module '/tmp/clawsweeper-live-proof-1099-
… output truncated …

Assertions:

• PASS expect_output: test runner expands named targets with sorted de-duplicated files

How this fits together

ClawSweeper’s Node test runner expands named test targets for local commands and CI. This change supplies its child tests with an isolated temporary directory and removes that directory after test completion or interruption.

flowchart LR
A[Package script or CI job] --> B[Named test runner]
B --> C[Per-run temporary root]
C --> D[Node test fixtures]
D --> E[Cleanup and stale-root reaper]
E --> F[Host temporary directory]

Loading

Decision needed

Question	Recommendation
Should this maintainer-authored test-runner cleanup be rebased and revalidated against current main, or should it be deferred rather than resolving its now-dirty merge state?	Rebase and revalidate: Resolve against current main, then rerun the FIFO, interruption, stale-root, and Windows launcher proof on the rebased head.

Why: The branch changes shared test execution and cannot currently merge cleanly; repository policy keeps maintainer-authored items open for explicit maintainer judgment.

Before merge

• Resolve merge risk (P1) - GitHub reports a dirty merge state; a rebase is required before the PR’s old-base validation can establish the behavior of the actual merge result.
• Resolve merge risk (P1) - The runner changes the temporary-directory environment for shared named targets and CI, so rebased proof must confirm that current fixtures and Windows launcher coverage still behave as intended.
• Complete next step (P2) - A maintainer must decide whether to preserve this shared test-runner policy and reconcile the dirty current-main merge before any landing action.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production versus test delta	production +95/-27; tests +247/-84	Most of the 453 changed lines are lifecycle coverage, while the shared runner and command integrations remain comparatively small.

Merge-risk options

Maintainer options:

1. Rebase and refresh lifecycle proof (recommended)
   Resolve the dirty merge against current main and rerun the named-target, FIFO cleanup, stale-root, signal, and Windows launcher checks before merge.
2. Pause the branch
   Defer the change if maintainers no longer want shared test commands to own temporary-root lifecycle policy.

Technical review

Best possible solution:

Rebase the isolated temporary-root runner onto current main, resolve the overlapping test and script changes deliberately, and retain it only if fresh lifecycle and Windows CI proof confirms the current merge result.

Do we have a high-confidence way to reproduce the issue?

Yes, source-reproducible: current main’s named runner launches tests without an isolated TMPDIR/TEMP/TMP root, while the affected validation tests create temporary fixtures. The PR body also supplies after-fix lifecycle runs, but they must be refreshed after rebase.

Is this the best way to solve the issue?

Yes in principle: a runner-owned temporary root and direct recursive removal are a narrow way to prevent fixture accumulation, provided the current-main merge result preserves the stated lifecycle behavior.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 2da70c23b043.

Labels

Label changes:

• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• remove rating: 🐚 platinum hermit: Current PR rating is rating: 🦐 gold shrimp, so this older rating label is no longer current.

Label justifications:

• P3: This is preventative test-infrastructure cleanup without indicated production-user impact.
• merge-risk: 🚨 automation: The PR changes the shared test runner, package test entrypoint, and a Windows CI command.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This MEMBER-authored PR is exempt from the contributor proof gate; its PR body nevertheless includes useful after-fix local lifecycle and hosted-check evidence that must be refreshed after rebase.

Evidence

What I checked:

• Branch implementation: The PR creates a unique run root, assigns TMPDIR/TEMP/TMP to the child test process, maintains a heartbeat, and removes the root in finally cleanup. (scripts/run-node-tests.mjs:154, a602f2ba67f9)
• Current-main comparison: Current main’s runner still spawns Node tests without a per-run temporary-root environment, so the central cleanup behavior is not already implemented. (scripts/run-node-tests.mjs:145, 2da70c23b043)
• Current-main provenance: Current-main history shows later changes to the overlapping CI, package-script, runner, and target-validation surfaces, making the old-base proof stale for the merge result. (scripts/run-node-tests.mjs:24, 43799a11fc26)
• Merge state: GitHub reports the PR as dirty; its base predates current-main changes in package scripts and target-validation coverage, so it cannot be evaluated as a clean current-main merge. (a602f2ba67f9)

Likely related people:

• Martin Cleary: The common current-main history attributes the runner, CI command, package-script, and target-validation baseline to this commit. (role: current-main runner and CI contributor; confidence: medium; commits: 43799a11fc26; files: scripts/run-node-tests.mjs, .github/workflows/ci.yml, package.json)
• Peter Steinberger: Recent current-main commits changed package-script entrypoints that overlap the PR’s test-command integration. (role: recent automation entrypoint contributor; confidence: medium; commits: 03c1f452ec49, fad3d5959820, c06a897aadd7; files: package.json)
• Vincent Koc: The latest current-main change on the affected target-validation test surface is this security-test update. (role: recent target-validation test contributor; confidence: medium; commits: edfc57b12bfe; files: test/repair/target-validation.test.ts)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Rebase onto current main and resolve the runner, package-script, CI, and target-validation overlap.
• Repeat the documented FIFO, stale-root, interruption, and Windows launcher checks on the rebased head.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (8 earlier review cycles)

• reviewed 2026-08-10T15:35:28.822Z sha 4b99634 :: found issues before merge. :: [P1] Extend the established runner instead of adding a second one | [P2] Re-raise termination after cleaning the run root
• reviewed 2026-08-10T15:50:37.034Z sha 1aa53a6 :: needs maintainer review before merge. :: none
• reviewed 2026-08-11T00:28:19.431Z sha 1aa53a6 :: needs maintainer review before merge. :: none
• reviewed 2026-08-11T06:29:52.041Z sha a602f2b :: found issues before merge. :: [P2] Refresh proof for the latest runner invocation
• reviewed 2026-08-11T06:36:47.348Z sha a602f2b :: needs maintainer review before merge. :: none
• reviewed 2026-08-11T12:11:07.285Z sha a602f2b :: needs maintainer review before merge. :: none
• reviewed 2026-08-12T06:24:31.715Z sha a602f2b :: needs maintainer review before merge. :: none
• reviewed 2026-08-12T23:32:24.400Z sha a602f2b :: needs maintainer review before merge. :: none

[hxy91819]

Local black-box validation completed against commit 1aa53a6a09.

Environment:

• Linux, Node v24.15.0
• Corepack resolved the repository pin to pnpm 11.10.0

Evidence:

1. Lifecycle and runner behavior

   Command:

   node --test test/run-node-tests.test.ts test/test-temp-root-runner.test.ts
   

   Result: 10 passed, 0 failed. This exercises successful FIFO cleanup, assertion-failure cleanup, stale-root TTL cleanup, and SIGTERM cleanup through the real CLI runner. Matching run-root and validation-directory counts were unchanged before and after.

2. Incident-equivalent FIFO fixture

   Command:

   node --test --test-name-pattern "workspace preflight rejects non-regular package metadata without blocking" test/repair/target-validation.test.ts
   

   Result: 1 passed, 0 failed. The FIFO preflight itself completed in 28.8 ms, below its 1-second behavior bound, and left no matching validation directory behind.

3. Repeated full target-validation runs

   Command, executed twice:

   node --test --test-reporter=tap test/repair/target-validation.test.ts
   

   Results:

   • run 1: 198 passed, 3 skipped, 0 failed; 132.9 s
   • run 2: 198 passed, 3 skipped, 0 failed; 130.6 s
   • the total count of matching top-level ClawSweeper temporary directories was identical before and after each run
   • no clawsweeper-validation-* directory remained after either run

No pre-existing historical temporary directories were deleted during this validation.

The PR CI pnpm check also passed: https://github.com/openclaw/clawsweeper/actions/runs/31405434604/job/93510465585