a mutant can send a test to the real ~/.config/aidd: only AIDD_USER_CONFIG_DIR is relocated

[blafourcade]

What happens

A test that relocates only AIDD_USER_CONFIG_DIR is one mutant away from the real profile. userConfigDir() reads AIDD_USER_CONFIG_DIR, then XDG_CONFIG_HOME, then homedir(). A mutant that drops the first branch sends the test to ~/.config/aidd of whoever runs the mutation. The mutant is killed, because the test fails, but the file is already written.

Evidence

• A developer machine carries {"name":"aidd-framework","scope":"user","source":{"kind":"local","path":"/src/framework"}} in its real ~/.config/aidd/marketplaces.json, added 2026-09-09T05:21:21Z. /src/framework exists only in test code.
• A mutation run was in progress at that time.
• Reproduced: rewrite if (process.env.AIDD_USER_CONFIG_DIR) return to if (false) return in src/runtime/user-config-dir.ts, then run marketplace-register-framework-use-case.integration.test.ts under a throwaway HOME. The test fails, and the throwaway ~/.config/aidd/marketplaces.json holds exactly that entry.
• marketplace-registry-adapter.integration.test.ts relocates HOME as well, so the same mutant cannot take it out of its sandbox.
• The whole suite (unit, integration and e2e) under a throwaway HOME writes nothing to ~/.config today. The leak needs a mutant, not a bug in the code.

Tests that relocate AIDD_USER_CONFIG_DIR without HOME (on next)

• cli/tests/contexts/distribution/application/marketplace-register-framework-use-case.integration.test.ts
• cli/tests/runtime/auth/auth-storage.integration.test.ts
• cli/tests/runtime/self-update/check-update-use-case.unit.test.ts
• cli/tests/runtime/user-config-dir.unit.test.ts

Expected

No test and no mutant can write the real profile. One setup file for the unit and integration projects can move HOME, XDG_CONFIG_HOME, APPDATA and AIDD_USER_CONFIG_DIR into a per-worker temp directory. Stryker runs the same projects, so that covers mutation runs too.

It also reached credentials

On the same machine, the real ~/.config/aidd/auth.json now holds the test token ghp_save_project (auth-storage.integration.test.ts), with method: stored, level: project and createdAt: 2026-09-10T08:28:42Z. A runtime mutation run had started at 08:28:03Z. auth-storage.integration.test.ts is in the list above. The person's stored GitHub credential was overwritten. There is no backup, so its previous content is unknown.

Suspected, not reproduced: the identity file

The real identity.json was re-minted at 2026-09-10T07:59:43Z (origin: minted), while the telemetry and kernel mutation runs were both in progress. The records stored before carry a different person_id, so the person axis now splits one person into two. The path out of the sandbox is not identified. resolveHomeDir falls back to os.homedir(), which follows $HOME.