feat(FN-2606): merge fusion/fn-2606 (auto-resolved)

- fix(FN-2606): complete Step 4 — clean up mkdtemp test directories
- test(FN-2606): complete Step 3 — add isolation guard coverage
- feat(FN-2606): complete Step 2 — add engine/dashboard HOME test isolation setup

packages/engine/src/__tests__/auth-storage.test.ts

@@ -1,6 +1,6 @@
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
 import { mkdirSync, writeFileSync, existsSync } from "node:fs";
-import { mkdtemp } from "node:fs/promises";
+import { mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { createFusionAuthStorage, getFusionAuthPath } from "../auth-storage.js";
@@ -15,7 +15,11 @@ describe("createFusionAuthStorage", () => {
     process.env.HOME = homeDir;
   });
 
-  afterEach(() => {
+  afterEach(async () => {
+    if (homeDir) {
+      await rm(homeDir, { recursive: true, force: true });
+    }
+
     if (originalHome === undefined) {
       delete process.env.HOME;
     } else {

packages/engine/src/__tests__/executor.test.ts

@@ -191,7 +191,7 @@ import { TaskExecutor, buildExecutionPrompt } from "../executor.js";
 import { createFnAgent } from "../pi.js";
 import { reviewStep as mockedReviewStepFn } from "../reviewer.js";
 import { execSync } from "node:child_process";
-import { mkdtemp, mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { findWorktreeUser, aiMergeTask } from "../merger.js";
@@ -8242,6 +8242,7 @@ describe("Workflow Steps Execution", () => {
     expect(promptContent).toContain("Quality gate hard failure");
 
     vi.useRealTimers();
+    await rm(tempRoot, { recursive: true, force: true });
   });
 
   it("skips script-mode step when scriptName is missing", async () => {

packages/engine/src/__tests__/setup-test-isolation.ts

@@ -0,0 +1,12 @@
+/**
+ * Global test isolation: prevents engine tests from writing to the real ~/.fusion/ directory.
+ *
+ * This runs in every Vitest worker before shared setup. By forcing process.env.HOME
+ * to a fresh temp directory, homedir()-derived paths resolve to isolated locations.
+ */
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const tempHome = mkdtempSync(join(tmpdir(), "fn-test-home-"));
+process.env.HOME = tempHome;

packages/engine/src/__tests__/test-isolation-guard.test.ts

@@ -0,0 +1,23 @@
+import { describe, expect, it } from "vitest";
+import { tmpdir } from "node:os";
+import { getFusionAuthPath } from "../auth-storage.js";
+
+describe("test isolation guard", () => {
+  it("overrides HOME to a temp fn-test-home directory", () => {
+    const home = process.env.HOME;
+
+    expect(home).toBeDefined();
+    expect(home).toContain(tmpdir());
+    expect(home).toContain("fn-test-home-");
+  });
+
+  it("resolves Fusion auth path under temp HOME", () => {
+    const home = process.env.HOME;
+    const authPath = getFusionAuthPath();
+
+    expect(home).toBeDefined();
+    expect(authPath).toContain("fn-test-home-");
+    expect(authPath.startsWith(home!)).toBe(true);
+    expect(authPath).toContain(".fusion");
+  });
+});

packages/engine/vitest.config.ts

@@ -16,7 +16,10 @@ export default defineConfig({
   },
   test: {
     include: ["src/**/*.test.ts"],
-    setupFiles: [resolve(__dirname, "../core/src/__test-utils__/vitest-setup.ts")],
+    setupFiles: [
+      "./src/__tests__/setup-test-isolation.ts",
+      resolve(__dirname, "../core/src/__test-utils__/vitest-setup.ts"),
+    ],
     globalSetup: [resolve(__dirname, "../core/src/__test-utils__/vitest-teardown.ts")],
     maxWorkers,
     poolOptions: { threads: { minThreads: 1, maxThreads: maxWorkers }, forks: { minForks: 1, maxForks: maxWorkers } },