test: enforce test-directory isolation across all packages

Introduce a shared test-utils module and global vitest setup that
guarantee tests never write to the real .fusion directory or leak temp
directories under /tmp.

Infrastructure:
- packages/core/src/__test-utils__/workspace.ts — tempWorkspace(),
  useIsolatedCwd(), trackForCleanup(), assertOutsideRealFusion() with
  auto-cleanup in afterEach.
- packages/core/src/__test-utils__/vitest-setup.ts — per-worker guard:
  chdirs each worker into an isolated tmp dir, wraps process.chdir to
  refuse the real .fusion, scopes tmp dirs under fusion-test-workers/
  (skips cwd change in thread-pool workers where chdir isn't supported).
- packages/core/src/__test-utils__/vitest-teardown.ts — globalSetup
  hook that wipes the shared parent even when workers are SIGKILLed.
- scripts/check-test-isolation.mjs + `test:isolated` / `test:check-
  isolation` scripts for CI.
- @fusion/test-utils alias + setupFiles + globalSetup wired into core,
  cli, engine, dashboard, tui vitest configs; matching tsconfig paths.

Test refactors (no behavior change):
- cli provider-settings, auth-paths, provider-auth — switch leaking
  mkdtempSync calls to tempWorkspace().
- core migration, first-run, store-backward-compat — replace manual
  process.chdir save/restore with useIsolatedCwd().
- tui fusion-context — replace 9 hardcoded tmp paths (collision-prone
  under parallelism) with tempWorkspace().
- dashboard useTheme, FileBrowser, TaskCard — resolve source-file reads
  against a PACKAGE_ROOT computed from import.meta.url instead of cwd,
  so tests don't depend on the process working directory.

Verified: full suite (~15,500 tests across 8 packages + plugins) passes
and the orphan-detector reports zero leaked temp directories after a
complete run.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/cli/src/commands/auth-paths.test.ts

@@ -1,7 +1,7 @@
-import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
+import { mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { describe, expect, it } from "vitest";
+import { tempWorkspace } from "@fusion/test-utils";
 import { getFusionAgentDir, getLegacyAgentDir, getPackageManagerAgentDir } from "./auth-paths.js";
 
 function writeJson(path: string, value: Record<string, unknown>): void {
@@ -10,7 +10,7 @@ function writeJson(path: string, value: Record<string, unknown>): void {
 
 describe("getPackageManagerAgentDir", () => {
   it("falls back to legacy Pi settings when Fusion settings only contain Fusion metadata", () => {
-    const home = mkdtempSync(join(tmpdir(), "fusion-agent-dir-"));
+    const home = tempWorkspace("fusion-agent-dir-");
     const fusionAgentDir = getFusionAgentDir(home);
     const legacyAgentDir = getLegacyAgentDir(home);
 
@@ -27,7 +27,7 @@ describe("getPackageManagerAgentDir", () => {
   });
 
   it("prefers Fusion settings when they contain package-manager settings", () => {
-    const home = mkdtempSync(join(tmpdir(), "fusion-agent-dir-"));
+    const home = tempWorkspace("fusion-agent-dir-");
     const fusionAgentDir = getFusionAgentDir(home);
     const legacyAgentDir = getLegacyAgentDir(home);
 

packages/cli/src/commands/provider-auth.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, it, vi } from "vitest";
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { tempWorkspace } from "@fusion/test-utils";
 import { createReadOnlyAuthFileStorage, mergeAuthStorageReads, wrapAuthStorageWithApiKeyProviders } from "./provider-auth.js";
 
 function makeAuthStorage(credentials: Record<string, { type: string; key?: string; access?: string; refresh?: string; expires?: number }> = {}) {
@@ -87,7 +87,7 @@ describe("wrapAuthStorageWithApiKeyProviders", () => {
 
 
   it("reads legacy auth JSON without creating missing files", async () => {
-    const tempDir = join(tmpdir(), `fusion-provider-auth-${process.pid}-${Date.now()}`);
+    const tempDir = tempWorkspace("fusion-provider-auth-");
     const legacyAgentDir = join(tempDir, ".pi", "agent");
     const legacyAgentAuth = join(legacyAgentDir, "auth.json");
     const missingLegacyAuth = join(tempDir, ".pi", "auth.json");
@@ -101,7 +101,7 @@ describe("wrapAuthStorageWithApiKeyProviders", () => {
   });
 
   it("reads non-expired OAuth credentials from legacy auth JSON", async () => {
-    const tempDir = join(tmpdir(), `fusion-provider-auth-oauth-${process.pid}-${Date.now()}`);
+    const tempDir = tempWorkspace("fusion-provider-auth-oauth-");
     const legacyAgentDir = join(tempDir, ".pi", "agent");
     const legacyAgentAuth = join(legacyAgentDir, "auth.json");
     mkdirSync(legacyAgentDir, { recursive: true });

packages/cli/src/commands/provider-settings.test.ts

@@ -1,7 +1,7 @@
-import { mkdirSync, mkdtempSync, writeFileSync, readFileSync } from "node:fs";
-import { tmpdir } from "node:os";
+import { mkdirSync, writeFileSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { describe, expect, it } from "vitest";
+import { tempWorkspace } from "@fusion/test-utils";
 import { createReadOnlyProviderSettingsView, createProjectSettingsPersistence } from "./provider-settings.js";
 
 function writeJson(path: string, value: Record<string, unknown>): void {
@@ -10,7 +10,7 @@ function writeJson(path: string, value: Record<string, unknown>): void {
 
 describe("createReadOnlyProviderSettingsView", () => {
   it("reads provider package settings from .fusion/settings.json", () => {
-    const root = mkdtempSync(join(tmpdir(), "fusion-provider-settings-"));
+    const root = tempWorkspace("fusion-provider-settings-");
     const cwd = join(root, "project");
     const agentDir = join(root, "agent");
 
@@ -40,7 +40,7 @@ describe("createReadOnlyProviderSettingsView", () => {
   });
 
   it("returns empty project settings when .fusion/settings.json does not exist", () => {
-    const root = mkdtempSync(join(tmpdir(), "fusion-provider-settings-"));
+    const root = tempWorkspace("fusion-provider-settings-");
     const cwd = join(root, "project");
     const agentDir = join(root, "agent");
 
@@ -57,7 +57,7 @@ describe("createReadOnlyProviderSettingsView", () => {
   });
 
   it("merges legacy Pi and Fusion agent settings with Fusion taking precedence", () => {
-    const home = mkdtempSync(join(tmpdir(), "fusion-provider-settings-"));
+    const home = tempWorkspace("fusion-provider-settings-");
     const cwd = join(home, "project");
     const fusionAgentDir = join(home, ".fusion", "agent");
     const legacyAgentDir = join(home, ".pi", "agent");
@@ -91,7 +91,7 @@ describe("createReadOnlyProviderSettingsView", () => {
 
 describe("createProjectSettingsPersistence", () => {
   it("reads from .fusion/settings.json when it exists", () => {
-    const root = mkdtempSync(join(tmpdir(), "fusion-provider-settings-"));
+    const root = tempWorkspace("fusion-provider-settings-");
     const cwd = join(root, "project");
 
     mkdirSync(join(cwd, ".fusion"), { recursive: true });
@@ -110,7 +110,7 @@ describe("createProjectSettingsPersistence", () => {
   });
 
   it("returns empty object when .fusion/settings.json does not exist", () => {
-    const root = mkdtempSync(join(tmpdir(), "fusion-provider-settings-"));
+    const root = tempWorkspace("fusion-provider-settings-");
     const cwd = join(root, "project");
 
     mkdirSync(cwd, { recursive: true });
@@ -122,7 +122,7 @@ describe("createProjectSettingsPersistence", () => {
   });
 
   it("writes to .fusion/settings.json", () => {
-    const root = mkdtempSync(join(tmpdir(), "fusion-provider-settings-"));
+    const root = tempWorkspace("fusion-provider-settings-");
     const cwd = join(root, "project");
 
     mkdirSync(cwd, { recursive: true });
@@ -135,7 +135,7 @@ describe("createProjectSettingsPersistence", () => {
   });
 
   it("replaces existing settings when writing (read before write for merge)", () => {
-    const root = mkdtempSync(join(tmpdir(), "fusion-provider-settings-"));
+    const root = tempWorkspace("fusion-provider-settings-");
     const cwd = join(root, "project");
 
     mkdirSync(join(cwd, ".fusion"), { recursive: true });
@@ -154,7 +154,7 @@ describe("createProjectSettingsPersistence", () => {
   });
 
   it("creates .fusion directory if it does not exist", () => {
-    const root = mkdtempSync(join(tmpdir(), "fusion-provider-settings-"));
+    const root = tempWorkspace("fusion-provider-settings-");
     const cwd = join(root, "project");
 
     mkdirSync(cwd, { recursive: true });
@@ -167,7 +167,7 @@ describe("createProjectSettingsPersistence", () => {
   });
 
   it("returns correct settings path via getSettingsPath", () => {
-    const root = mkdtempSync(join(tmpdir(), "fusion-provider-settings-"));
+    const root = tempWorkspace("fusion-provider-settings-");
     const cwd = join(root, "project");
 
     mkdirSync(cwd, { recursive: true });

packages/cli/tsconfig.json

@@ -3,7 +3,10 @@
   "compilerOptions": {
     "outDir": "dist",
     "rootDir": "src",
-    "types": ["node", "vitest/globals"]
+    "types": ["node", "vitest/globals"],
+    "paths": {
+      "@fusion/test-utils": ["../core/src/__test-utils__/workspace.ts"]
+    }
   },
   "include": ["src/**/*"],
   "exclude": ["src/**/*.test.ts", "src/**/__tests__/**/*"]

packages/cli/vitest.config.ts

@@ -1,4 +1,5 @@
 import { defineConfig } from "vitest/config";
+import { resolve } from "node:path";
 
 const defaultMaxWorkers = 2;
 const requestedMaxWorkers = Number.parseInt(process.env.VITEST_MAX_WORKERS ?? String(defaultMaxWorkers), 10);
@@ -6,8 +7,15 @@ const maxWorkers = Math.max(1, Math.min(2, Number.isFinite(requestedMaxWorkers)
 process.env.VITEST_MAX_WORKERS = String(maxWorkers);
 
 export default defineConfig({
+  resolve: {
+    alias: {
+      "@fusion/test-utils": resolve(__dirname, "../core/src/__test-utils__/workspace.ts"),
+    },
+  },
   test: {
     include: ["src/**/*.test.ts"],
+    setupFiles: [resolve(__dirname, "../core/src/__test-utils__/vitest-setup.ts")],
+    globalSetup: [resolve(__dirname, "../core/src/__test-utils__/vitest-teardown.ts")],
     maxWorkers,
     poolOptions: { threads: { minThreads: 1, maxThreads: maxWorkers }, forks: { minForks: 1, maxForks: maxWorkers } },
     // build-exe and build-exe-cross suites both operate on packages/cli/dist/