From ae1215dc98a645dff8c53615d65442ee73d803d6 Mon Sep 17 00:00:00 2001
From: mptyl <mp@tylconsulting.it>
Date: Fri, 14 Aug 2026 17:32:22 +0200
Subject: [PATCH] test: isolate workspace secret vaults under vitest

---
 backend/src/app.ts | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/backend/src/app.ts b/backend/src/app.ts
index a983d492..628632c3 100644
--- a/backend/src/app.ts
+++ b/backend/src/app.ts
@@ -1,6 +1,7 @@
 import Fastify, { type FastifyInstance } from "fastify";
 import cors from "@fastify/cors";
 import { join } from "node:path";
+import { tmpdir } from "node:os";
 import type { AppConfig } from "./config.js";
 import { ThtRunner } from "./tht/tht-runner.js";
 import { PiProcessManager } from "./pi/pi-process-manager.js";
@@ -44,9 +45,14 @@ export interface BuildAppDeps {
 
 export function buildApp(config: AppConfig, deps?: BuildAppDeps): FastifyInstance {
   const app = Fastify({ logger: { level: "warn" }, disableRequestLogging: true });
+  const isolatedTestRoot = process.env.VITEST === "true"
+    ? join(tmpdir(), `thothii-workspace-secrets-vitest-${process.pid}`)
+    : undefined;
   const workspaceSecretStore = deps?.workspaceSecretStore ?? new WorkspaceSecretStore({
-    root: config.workspaceSecretStoreRoot,
-    runtimeRoot: config.workspaceSecretRuntimeRoot,
+    root: isolatedTestRoot ?? config.workspaceSecretStoreRoot,
+    runtimeRoot: isolatedTestRoot === undefined
+      ? config.workspaceSecretRuntimeRoot
+      : join(isolatedTestRoot, "runtime"),
     installationId: config.workspaceRegistry.installationId,
   });