perf(test): reduce temp fixture churn in guardrail-heavy suites

src/security/temp-path-guard.test.ts

@@ -224,14 +224,21 @@ describe("temp path guard", () => {
 
     for (const file of files) {
       const relativePath = file.relativePath;
-      if (hasDynamicTmpdirJoin(file.source)) {
+      const source = file.source;
+      const mightContainTmpdirJoin =
+        source.includes("tmpdir") &&
+        source.includes("path") &&
+        source.includes("join") &&
+        source.includes("`");
+      const mightContainWeakRandom = source.includes("Date.now") && source.includes("Math.random");
+
+      if (!mightContainTmpdirJoin && !mightContainWeakRandom) {
+        continue;
+      }
+      if (mightContainTmpdirJoin && hasDynamicTmpdirJoin(source)) {
         offenders.push(relativePath);
       }
-      if (
-        file.source.includes("Date.now") &&
-        file.source.includes("Math.random") &&
-        WEAK_RANDOM_SAME_LINE_PATTERN.test(file.source)
-      ) {
+      if (mightContainWeakRandom && WEAK_RANDOM_SAME_LINE_PATTERN.test(source)) {
         weakRandomMatches.push(relativePath);
       }
     }

src/test-utils/tracked-temp-dirs.ts

@@ -3,16 +3,50 @@ import os from "node:os";
 import path from "node:path";
 
 export function createTrackedTempDirs() {
-  const dirs: string[] = [];
+  const prefixRoots = new Map<string, { root: string; nextIndex: number }>();
+  const pendingPrefixRoots = new Map<string, Promise<{ root: string; nextIndex: number }>>();
+  const cleanupRoots = new Set<string>();
+  let globalDirIndex = 0;
+
+  const ensurePrefixRoot = async (prefix: string) => {
+    const cached = prefixRoots.get(prefix);
+    if (cached) {
+      return cached;
+    }
+    const pending = pendingPrefixRoots.get(prefix);
+    if (pending) {
+      return await pending;
+    }
+    const create = (async () => {
+      const root = await fs.mkdtemp(path.join(os.tmpdir(), prefix));
+      const state = { root, nextIndex: 0 };
+      prefixRoots.set(prefix, state);
+      cleanupRoots.add(root);
+      return state;
+    })();
+    pendingPrefixRoots.set(prefix, create);
+    try {
+      return await create;
+    } finally {
+      pendingPrefixRoots.delete(prefix);
+    }
+  };
 
   return {
     async make(prefix: string): Promise<string> {
-      const dir = await fs.mkdtemp(path.join(os.tmpdir(), prefix));
-      dirs.push(dir);
+      const state = await ensurePrefixRoot(prefix);
+      const dir = path.join(state.root, `dir-${String(globalDirIndex)}`);
+      state.nextIndex += 1;
+      globalDirIndex += 1;
+      await fs.mkdir(dir, { recursive: true });
       return dir;
     },
     async cleanup(): Promise<void> {
-      await Promise.all(dirs.splice(0).map((dir) => fs.rm(dir, { recursive: true, force: true })));
+      const roots = [...cleanupRoots];
+      cleanupRoots.clear();
+      prefixRoots.clear();
+      pendingPrefixRoots.clear();
+      await Promise.all(roots.map((dir) => fs.rm(dir, { recursive: true, force: true })));
     },
   };
 }