Follow-up to #2173, which stopped auth-go's process lock landing in the developer's real user cache under go test.
That fix is in-process only. tokenManagerLockDir (cmd/entire/cli/auth/refresh.go:156) returns testdirs.Dir("authlock"), and testdirs.Dir returns ok=false in a subprocess (internal/testdirs/testdirs.go:26-29). The integration and e2e TestMains set ENTIRE_CONFIG_DIR and XDG_CACHE_HOME but not HOME, and on macOS os.UserCacheDir() ignores XDG_CACHE_HOME - so a spawned entire that reaches a token refresh still writes into the real ~/Library/Caches/auth-go.
userdirs and tokenstore each pair testdirs with an env override (ENTIRE_CONFIG_DIR, ENTIRE_TOKEN_STORE_PATH). This one implements only half that pattern.
Suggested: check an ENTIRE_AUTH_LOCK_DIR env var ahead of testdirs.Dir, and set it in the integration and e2e TestMains alongside the existing isolation vars.
Note the practical exposure is unproven - no spawned binary was observed reaching the lock before failing at the network - but the mechanism is confirmed.
Follow-up to #2173, which stopped auth-go's process lock landing in the developer's real user cache under
go test.That fix is in-process only.
tokenManagerLockDir(cmd/entire/cli/auth/refresh.go:156) returnstestdirs.Dir("authlock"), andtestdirs.Dirreturnsok=falsein a subprocess (internal/testdirs/testdirs.go:26-29). The integration and e2e TestMains setENTIRE_CONFIG_DIRandXDG_CACHE_HOMEbut notHOME, and on macOSos.UserCacheDir()ignoresXDG_CACHE_HOME- so a spawnedentirethat reaches a token refresh still writes into the real~/Library/Caches/auth-go.userdirsandtokenstoreeach pairtestdirswith an env override (ENTIRE_CONFIG_DIR,ENTIRE_TOKEN_STORE_PATH). This one implements only half that pattern.Suggested: check an
ENTIRE_AUTH_LOCK_DIRenv var ahead oftestdirs.Dir, and set it in the integration and e2e TestMains alongside the existing isolation vars.Note the practical exposure is unproven - no spawned binary was observed reaching the lock before failing at the network - but the mechanism is confirmed.