The tarball IO honors the sandboxDir it is handed

Per-package sandboxes exposed a latent bug: realTarballIo ignored the
sandboxDir argument, always installing into one fixed directory and
reading the started package's name back from it. With two sandboxes,
startBin looked for node_modules in directories nothing had installed
into, and both bins reported exit null. installSandbox now creates the
directory it was asked for (fresh each time) and startBin reads the
manifest from the same directory it starts in. Also hoists the sandbox
name regexes and de-nests a test ternary, per lint.

Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>

Author: wmadden-electric

packages/cli-conformance/src/checks/tarball.ts

@@ -97,6 +97,10 @@ export interface TarballInput {
 
 const EXACT_VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
 
+/** Package-name characters that cannot appear in a directory name. */
+const SANDBOX_NAME_UNSAFE = /[@/]/g;
+const LEADING_DASH = /^-/;
+
 /**
  * Check 3: the tarballs a registry would receive. 3a — packed output
  * imports only what the packed manifest declares. 3b — the root tarball
@@ -289,7 +293,7 @@ async function sandboxFindings(
 ): Promise<readonly Finding[]> {
   const sandboxDir = join(
     input.sandboxDir,
-    packageName.replace(/[@/]/g, "-").replace(/^-/, ""),
+    packageName.replace(SANDBOX_NAME_UNSAFE, "-").replace(LEADING_DASH, ""),
   );
   // Transitive: a sibling reached only through another sibling still
   // needs its override, or the install falls back to the registry.

packages/cli-conformance/src/tarball-io.ts

@@ -38,7 +38,6 @@ export function realTarballIo(
   // exact files CI uploads and attaches to the GitHub Release.
   const tarballDir = resolve(options.tarballDir ?? join(absWork, "tarballs"));
   rmSync(tarballDir, { recursive: true, force: true });
-  const sandbox = () => join(absWork, "sandbox");
 
   return {
     async pack(pkgDir) {
@@ -88,8 +87,9 @@ export function realTarballIo(
       return files;
     },
 
-    async installSandbox({ rootTarball, overrides }) {
-      const dir = sandbox();
+    async installSandbox({ sandboxDir, rootTarball, overrides }) {
+      const dir = resolve(sandboxDir);
+      rmSync(dir, { recursive: true, force: true });
       mkdirSync(dir, { recursive: true });
       const rootManifest = await this.readPackedManifest(rootTarball);
       const name = manifestName(rootManifest);
@@ -176,7 +176,7 @@ export function realTarballIo(
       argv,
       timeoutMs,
     }) {
-      const rootManifestPath = join(sandbox(), "package.json");
+      const rootManifestPath = join(sandboxDir, "package.json");
       const rootManifest = JSON.parse(
         readFileSync(rootManifestPath, "utf8"),
       ) as {

packages/cli-conformance/tests/tarball.test.ts

@@ -570,14 +570,15 @@ describe("sibling manifests and per-package sandboxes (the rc.8 class)", () => {
     overrides: Partial<TarballIo> = {},
   ): TarballIo {
     return fakeIo({
-      readPackedManifest: (tarball) =>
-        Promise.resolve(
-          tarball.includes("cli-engine")
-            ? ENGINE_MANIFEST
-            : tarball.includes("prisma-wrapper")
-              ? wrapperManifest
-              : SHELL_MANIFEST,
-        ),
+      readPackedManifest: (tarball) => {
+        if (tarball.includes("cli-engine")) {
+          return Promise.resolve(ENGINE_MANIFEST);
+        }
+        if (tarball.includes("prisma-wrapper")) {
+          return Promise.resolve(wrapperManifest);
+        }
+        return Promise.resolve(SHELL_MANIFEST);
+      },
       readPackedFiles: (tarball) =>
         Promise.resolve(
           tarball.includes("prisma-wrapper")