fix: track the wav temp dir for cleanup and finish the mkdtemp sweep

The wav helper pushed the file path into `dirs`, so `afterEach` removed
`tone.wav` and left the directory it had just made — four per suite run.
Push the directory and derive the file path from it. Measured: the old code
leaks 4 directories per run, the new code leaks 0.

Three sites still built a predictable name and then created it. CodeQL never
flagged them — its dataflow reaches the template preview writes through a
`readdir` walk and does not connect them back to the `tmpdir()` root — so the
alert list was narrower than the pattern, and closing only the alerts would
turn the rule green while the shape survived where nothing would re-flag it.
`generate-template-previews.ts` is the near-twin of the file this change
started from, and the other two are producer dev entry points. All three use
the path only through the variable, so the random suffix changes nothing.

Catalog previews now call the existing `createCatalogPreviewTempDir` instead
of repeating its body. That test was in no runner, so it pinned uniqueness and
mode 0700 on a function nothing called; adding it to `test:scripts` alongside
a real caller makes it load-bearing. The rationale for the primitive moves to
the helper, which is now the only place it lives.

Author: vanceingalls

package.json

@@ -48,7 +48,7 @@
     "player:perf": "bun run --filter @hyperframes/player perf",
     "format:check": "oxfmt --check .",
     "knip": "knip",
-    "test:scripts": "node --import tsx --test scripts/check-tracked-artifacts.test.mjs scripts/check-no-main-deletions.test.mjs scripts/check-docs-snippet-motion.test.mjs scripts/registry-target-paths.test.mjs scripts/check-workspace-contracts.test.mjs scripts/check-package-cycles.test.mjs scripts/check-cli-process-ownership.test.mjs scripts/package-subpaths.test.mjs scripts/validate-release-channel.test.mjs scripts/publish-workflow.test.mjs scripts/install-workspace-dependencies.test.mjs scripts/draft-changelog.test.ts scripts/set-version.test.ts scripts/release-prepare.test.ts scripts/cli-options.test.ts scripts/changelog-weekly.test.ts scripts/claude-plugin-compression.test.ts scripts/catalog-payload-assets.test.ts scripts/studio-runtime-smoke.test.mjs scripts/verify-packed-manifests.test.mjs scripts/lint-skills.test.mjs packages/gcp-cloud-run/check-dockerfile-workspaces.test.mjs && vitest run scripts/catalog/",
+    "test:scripts": "node --import tsx --test scripts/check-tracked-artifacts.test.mjs scripts/check-no-main-deletions.test.mjs scripts/check-docs-snippet-motion.test.mjs scripts/registry-target-paths.test.mjs scripts/check-workspace-contracts.test.mjs scripts/check-package-cycles.test.mjs scripts/check-cli-process-ownership.test.mjs scripts/package-subpaths.test.mjs scripts/validate-release-channel.test.mjs scripts/publish-workflow.test.mjs scripts/install-workspace-dependencies.test.mjs scripts/draft-changelog.test.ts scripts/set-version.test.ts scripts/release-prepare.test.ts scripts/cli-options.test.ts scripts/changelog-weekly.test.ts scripts/claude-plugin-compression.test.ts scripts/catalog-payload-assets.test.ts scripts/catalog-preview-temp.test.ts scripts/studio-runtime-smoke.test.mjs scripts/verify-packed-manifests.test.mjs scripts/lint-skills.test.mjs packages/gcp-cloud-run/check-dockerfile-workspaces.test.mjs && vitest run scripts/catalog/",
     "typecheck:scripts": "tsc --noEmit -p scripts/tsconfig.json",
     "test:skills": "node --test 'skills/**/*.test.mjs'",
     "generate:previews": "tsx scripts/generate-template-previews.ts",

packages/cli/src/whisper/normalize.test.ts

@@ -567,9 +567,10 @@ describe("detectSpeechOnset", () => {
       const amplitude = energyFn(t);
       buf.writeInt16LE(Math.round(amplitude * 32767), 44 + i * 2);
     }
-    const path = join(mkdtempSync(join(tmpdir(), "hf-wav-test-")), "tone.wav");
+    const dir = mkdtempSync(join(tmpdir(), "hf-wav-test-"));
+    dirs.push(dir);
+    const path = join(dir, "tone.wav");
     writeFileSync(path, buf);
-    dirs.push(path);
     return path;
   }
 

packages/producer/src/benchmark.ts

@@ -25,6 +25,7 @@ import {
   writeFileSync,
   existsSync,
   mkdirSync,
+  mkdtempSync,
   cpSync,
   rmSync,
 } from "node:fs";
@@ -204,8 +205,7 @@ async function runBenchmark(): Promise<void> {
       console.log(`  Run ${r + 1}/${runs}...`);
 
       // Copy src to temp dir for isolation
-      const tmpRoot = join(tmpdir(), `benchmark-${fixture.id}-${Date.now()}`);
-      mkdirSync(tmpRoot, { recursive: true });
+      const tmpRoot = mkdtempSync(join(tmpdir(), `benchmark-${fixture.id}-`));
       cpSync(join(fixture.dir, "src"), join(tmpRoot, "src"), { recursive: true });
 
       const projectDir = join(tmpRoot, "src");

packages/producer/src/transparency-test.ts

@@ -20,7 +20,7 @@
  */
 
 import { strict as assert } from "node:assert";
-import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -309,8 +309,7 @@ async function main(): Promise<void> {
   if (!existsSync(SHADER_FIXTURE_SRC) || !existsSync(SHADER_GOLDEN)) {
     throw new Error(`Shader fixture or golden missing: ${SHADER_FIXTURE_DIR}`);
   }
-  const workRoot = join(tmpdir(), `hf-transparency-${process.pid}-${Date.now()}`);
-  mkdirSync(workRoot, { recursive: true });
+  const workRoot = mkdtempSync(join(tmpdir(), "hf-transparency-"));
   const keepWork = process.env.KEEP_TEMP === "1";
   console.log(`work dir: ${workRoot}${keepWork ? " (KEEP_TEMP=1)" : ""}`);
 

scripts/catalog-preview-temp.ts

@@ -2,7 +2,13 @@ import { mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
-/** Atomically allocate an owner-only preview directory under the OS temp root. */
+/**
+ * Atomically allocate an owner-only preview directory under the OS temp root.
+ *
+ * `mkdtemp` rather than a name built from `Date.now()`: it picks the random
+ * suffix and creates the directory 0700 in one syscall, so nothing can
+ * pre-create or symlink the path between choosing the name and making it.
+ */
 export function createCatalogPreviewTempDir(itemName: string): string {
   return mkdtempSync(join(tmpdir(), `hf-catalog-${itemName}-`));
 }

scripts/generate-catalog-previews.ts

@@ -24,16 +24,15 @@ import {
   readFileSync,
   existsSync,
   mkdirSync,
-  mkdtempSync,
   cpSync,
   rmSync,
   writeFileSync,
   statSync,
 } from "node:fs";
 import { execFileSync } from "node:child_process";
 import { join, resolve, dirname } from "node:path";
-import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
+import { createCatalogPreviewTempDir } from "./catalog-preview-temp.js";
 // Import from source — bun workspace linking doesn't resolve for scripts outside packages/.
 import {
   captureFrame,
@@ -171,10 +170,7 @@ export async function prepareProjectDir(
   item: CatalogItem,
   options: PrepareOptions = {},
 ): Promise<string> {
-  // mkdtemp rather than a name built from `Date.now()`: it picks the random
-  // suffix and creates the directory 0700 in one syscall, so nothing can
-  // pre-create or symlink the path between choosing it and making it.
-  const tmpDir = mkdtempSync(join(tmpdir(), `hf-catalog-${item.name}-`));
+  const tmpDir = createCatalogPreviewTempDir(item.name);
   cpSync(item.sourceDir, tmpDir, { recursive: true });
   mirrorRegistryTargets(tmpDir);
 

scripts/generate-template-previews.ts

@@ -21,6 +21,7 @@ import {
   writeFileSync,
   existsSync,
   mkdirSync,
+  mkdtempSync,
   cpSync,
   rmSync,
 } from "node:fs";
@@ -126,8 +127,7 @@ function discoverTemplates(only: string | null): string[] {
 }
 
 function prepareTemplateDir(templateId: string): string {
-  const tmpDir = join(tmpdir(), `hf-preview-${templateId}-${Date.now()}`);
-  mkdirSync(tmpDir, { recursive: true });
+  const tmpDir = mkdtempSync(join(tmpdir(), `hf-preview-${templateId}-`));
   const src = resolveTemplateDir(templateId);
   if (!src) throw new Error(`Template directory not found for "${templateId}"`);
   cpSync(src, tmpDir, { recursive: true });