[WRONG BRANCH] tests: use private temp dir for route scanner probe to prevent symlink clobbering

[luvs01]

Motivation

• The scanner test previously wrote a fixed repository-root file (.tmp-scanner-probe.ts) with a plain writeFileSync, which can follow a pre-planted workspace symlink and truncate an attacker-chosen target; this change removes that attack surface.

Description

• Create the probe inside an atomically-created private temp directory using mkdtempSync(join(tmpdir(), "ocx-route-scanner-")), write it with writeFileSync, and remove the whole temp directory with rmSync(..., { recursive: true, force: true }), and add the required node:fs/node:os imports to tests/management-route-registry.test.ts.

Testing

• Ran the focused checks bun test tests/management-route-registry.test.ts (passed), bun run typecheck (passed), and bun run privacy:scan (passed), and validated the scanner assertion still fails loud when appropriate; a full bun run test run was not relied on here because unrelated existing suite failures/timeouts were observed when run end-to-end.

---

Codex Task

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-30T15:10:02.346859Z	f1bbd1e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 7ea6c559-4287-413b-b717-ba049f650b48

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.