TASK-3909cbf6-10c6-44ce-b82e-5bfb62cf34c8 harden artifact target guard

test/fleet/dashboard-artifacts.test.mjs

@@ -4,7 +4,7 @@ import { existsSync, mkdtempSync, mkdirSync, readFileSync, symlinkSync, writeFil
 import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 import test from 'node:test';
-import { createDashboardArtifactDirectory, describeDashboardArtifacts } from '../../scripts/dashboard-artifacts.mjs';
+import { createDashboardArtifactDirectory, describeDashboardArtifacts, prepareDashboardArtifactTargets } from '../../scripts/dashboard-artifacts.mjs';
 
 function repositoryFixture() {
   const root = mkdtempSync(join(tmpdir(), 'torch-dashboard-artifact-fixture-'));
@@ -24,7 +24,8 @@ test('SCN-dashboard-artifacts: standalone execution retains fresh external scree
   assert.equal(artifacts.provenance, 'standalone-temporary');
   assert.equal(artifacts.requestedDirectory, null);
   assert.equal(artifacts.directory.startsWith(resolve(repositoryRoot)), false);
-  writeFileSync(join(artifacts.directory, 'captured.png'), 'standalone screenshot');
+  const targets = prepareDashboardArtifactTargets(artifacts, ['captured.png']);
+  writeFileSync(targets['captured.png'], 'standalone screenshot');
   assert.deepEqual(describeDashboardArtifacts(artifacts).files, [{
     path: 'captured.png', bytes: 21,
     sha256: '6921ad2c105108a005db4282443624252c392392d85bcb4ca2625c6af488f57c',
@@ -39,20 +40,25 @@ test('SCN-dashboard-artifacts: an explicit external runner directory receives ha
   });
   assert.equal(artifacts.provenance, 'TORCH_CHECK_ARTIFACT_DIR');
   assert.equal(artifacts.directory, resolve(output));
-  writeFileSync(join(artifacts.directory, 'captured.png'), 'runner screenshot');
+  const targets = prepareDashboardArtifactTargets(artifacts, ['captured.png']);
+  writeFileSync(targets['captured.png'], 'runner screenshot');
   assert.deepEqual(describeDashboardArtifacts(artifacts).files, [{
     path: 'captured.png', bytes: 17,
     sha256: '382d6e41938a7a8cc7767e9b519ddbef25e5048fc6fa9fe02faf31bab4148e2b',
   }]);
 });
 
-test('SCN-dashboard-artifacts: repository and symlinked-worktree targets fail before changing preserved baseline bytes', () => {
+test('SCN-dashboard-artifacts: repository, temporary-root, pre-existing and symlink targets fail before changing preserved bytes', () => {
   const repositoryRoot = repositoryFixture();
   const baseline = join(repositoryRoot, 'reports', 'design-system', 'baseline.png');
   const before = readFileSync(baseline);
-  const direct = join(repositoryRoot, 'reports', 'design-system');
+  for (const direct of [join(repositoryRoot, 'reports', 'design-system'), join(repositoryRoot, '..captures')]) {
+    assert.throws(() => createDashboardArtifactDirectory({
+      environment: { TORCH_CHECK_ARTIFACT_DIR: direct }, repositoryRoot,
+    }), (error) => error.code === 'DASHBOARD_ARTIFACT_DIRECTORY_FORBIDDEN');
+  }
   assert.throws(() => createDashboardArtifactDirectory({
-    environment: { TORCH_CHECK_ARTIFACT_DIR: direct }, repositoryRoot,
+    environment: {}, repositoryRoot, temporaryRoot: join(repositoryRoot, 'unsafe-tmp'),
   }), (error) => error.code === 'DASHBOARD_ARTIFACT_DIRECTORY_FORBIDDEN');
   assert.deepEqual(readFileSync(baseline), before);
 
@@ -65,4 +71,22 @@ test('SCN-dashboard-artifacts: repository and symlinked-worktree targets fail be
   }), (error) => error.code === 'DASHBOARD_ARTIFACT_DIRECTORY_FORBIDDEN');
   assert.deepEqual(readFileSync(baseline), before);
   assert.equal(existsSync(join(linkedWorktree, 'reports', 'design-system', 'torch-dashboard-demo-desktop.png')), false);
+
+  const output = mkdtempSync(join(tmpdir(), 'torch-dashboard-existing-output-'));
+  const expected = join(output, 'torch-dashboard-demo-desktop.png');
+  writeFileSync(expected, 'existing user evidence');
+  const external = createDashboardArtifactDirectory({ environment: { TORCH_CHECK_ARTIFACT_DIR: output }, repositoryRoot });
+  assert.throws(() => prepareDashboardArtifactTargets(external, ['torch-dashboard-demo-desktop.png']),
+    (error) => error.code === 'DASHBOARD_ARTIFACT_TARGET_EXISTS');
+  assert.equal(readFileSync(expected, 'utf8'), 'existing user evidence');
+
+  const linkedOutput = mkdtempSync(join(tmpdir(), 'torch-dashboard-linked-output-'));
+  const linkedExpected = join(linkedOutput, 'torch-dashboard-demo-desktop.png');
+  symlinkSync(baseline, linkedExpected);
+  const linkedExternal = createDashboardArtifactDirectory({
+    environment: { TORCH_CHECK_ARTIFACT_DIR: linkedOutput }, repositoryRoot,
+  });
+  assert.throws(() => prepareDashboardArtifactTargets(linkedExternal, ['torch-dashboard-demo-desktop.png']),
+    (error) => error.code === 'DASHBOARD_ARTIFACT_TARGET_EXISTS');
+  assert.deepEqual(readFileSync(baseline), before);
 });