fix(test): isolate route tests from the production ~/.codeman data dir

[timkjr]

Problem

test/routes/session-routes-workspace-hooks.test.ts writes its h1/box/10.0.0.5 remote-host fixture into getDataDir()/remote-hosts.json:

awaitmkdir(getDataDir(),{recursive: true});awaitwriteFile(join(getDataDir(),'remote-hosts.json'),JSON.stringify([{id: 'h1',label: 'box',host: '10.0.0.5',username: 'dev'}]));

getDataDir() resolves via homedir() → ~/.codeman (INSTANCE_SUFFIX='' by default). Overriding HOME in test/setup.ts does not change os.homedir() on Linux — it reads /etc/passwd, not $HOME. So every full-suite run silently overwrites the production ~/.codeman/remote-hosts.json: user-defined remote hosts are wiped, the launch-case dropdown empties, and remote session creation breaks with "host not found".

Found live 2026-08-29: a bare suite run destroyed a production host registry. The test suite is tmux-safe by design, but this write path bypassed every safety.

Why the obvious fix doesn't work

Vitest 4.1.8 ignores the test.env config key (probe-confirmed: a worker still saw CODEMAN_DATA_DIR=undefined). Setting the env in test/setup.ts also doesn't propagate reliably. So the fix must happen inside the test itself, at call time — getDataDir() reads process.env.CODEMAN_DATA_DIR on every call, so vi.stubEnv works:

constfixtureDataDir=join(tmpdir(),`codeman-hook-fixture-${process.pid}`);vi.stubEnv('CODEMAN_DATA_DIR',fixtureDataDir);try{awaitmkdir(getDataDir(),{recursive: true});awaitwriteFile(/* fixture */);}finally{vi.unstubAllEnvs();}

Changes

• test/routes/session-routes-workspace-hooks.test.ts: redirect the fixture write to a throwaway /tmp dir + finally unstub.
• test/setup.ts: set CODEMAN_DATA_DIR to a temp dir as defense-in-depth, and clean it up.
• config/vitest.config.ts + config/vitest.ci.config.ts: declare CODEMAN_DATA_DIR (inert in v4, correct in v5+ — harmless, and keeps intent documented).

Verification

• md5sum ~/.codeman/remote-hosts.json before and after vitest run test/routes/session-routes-workspace-hooks.test.ts — identical (was being clobbered before).
• Fixture lands in /tmp/codeman-hook-fixture-*, not prod.
• 17/17 tests in the file pass.

Suggested rule

Any test that writes into getDataDir() MUST stub CODEMAN_DATA_DIR to a throwaway dir first. The suite's HOME override is not sufficient on Linux.

[timkjr]

Test-isolation sweep identified — available on request

While hardening this PR I found the same containment gap in a broader set of tests: per-case cleanup that does rmSync(join(homedir(), 'codeman-cases', ...)) (or writes into dataPath()) without the CODEMAN_DATA_DIR/HOME-override protection. On platforms where os.homedir() ignores $HOME, each of these can touch the real ~/codeman-cases or ~/.codeman during a bare suite run.

The affected files (identified, changes ready, deliberately not included here to keep this PR skinny):

• test/cli-skill-target.test.ts (writes+deletes linked-cases.json)
• test/edge-cases.test.ts, test/integration-flows.test.ts, test/session-cleanup.test.ts, test/ralph-integration.test.ts (per-case deletes)
• test/operation-lightspeed.test.ts, test/sse-events.test.ts, test/sse-subscription-filter.test.ts (per-case deletes)
• test/routes/case-clone-routes.test.ts (clone dirs under CASES_DIR)
• test/routes/voice-routes.test.ts (writes+deletes ~/.claude/.credentials.json)

Each applies the same safeRmHomeTree containment gate (only delete a path under the redirected test HOME) that this PR adds. Happy to open a follow-up PR with that sweep if it's wanted.

[timkjr]

Pushed a follow-up fix: the "never writes hooks for a remote attach" test was stubbing CODEMAN_DATA_DIR to a separate throwaway dir for its fixture write, but session-routes.ts's CODEMAN_CONFIG_DIR is a module-load-time constant frozen before the test runs — so the fixture landed somewhere the route handler could never read, the host lookup silently failed, and the test passed for the wrong reason (Fastify defaults an unset status to 200). Now writes straight to getDataDir(), matching the docker-hosts fixture convention already used elsewhere in this file. Verified it now exercises the actual success path. Still 6 files, still scoped to the original fix.

[Ark0N]

Merged, thank you. Both changes are right and they ship in today's release. One correction to the write-up so the next reader does not chase it: Node's os.homedir() does follow $HOME on Linux (libuv checks the env var before the passwd entry; HOME=/tmp/x node -e 'console.log(os.homedir())' prints /tmp/x here), so the temp HOME in test/setup.ts was already redirecting ~/.codeman and ~/codeman-cases for the suite. What bypasses it is an inherited CODEMAN_DATA_DIR, which getDataDir() reads as an absolute override before it ever looks at homedir(), and that is exactly what your setup.ts change now neutralises. I pushed a small follow-up (2e0129f) that says so in the comments and in CLAUDE.md, and keeps safeRmHomeTree described as the defense in depth it is. @opticon454's #371 names the same variable from the other direction and will need a small rebase over this.