fix(scripts): put the mktemp X's last in gen-sdui-manifest.sh templates (#17120)

`mktemp "…/sdui-dump-dev.XXXXXX.log"` is a GNU coreutils spelling: coreutils
splits the trailing `.log` off as an implied `--suffix` (`--suffix=SUFF … is
implied if TEMPLATE does not end in X`) and substitutes the X's anyway, which
is why CI has never seen this. BSD mktemp(1) is a thin wrapper over mkstemp(3),
which only ever replaces a TRAILING run of X's, so on stock macOS nothing is
substituted: the first run creates the file called literally
`sdui-dump-dev.XXXXXX.log` and every later run dies at that line with
`File exists`. That host is the only one this on-demand ratchet is run on.

Two of the three call sites carried the broken shape. The pidfile beside them
was already correct and is untouched; it is now the shape all three use. The
`.log` extension is given up rather than bought back with `--suffix` (itself
the GNU extension) or with a rename that would add a second path and a window
in which the two disagree — nothing reads these files by extension.

Pins the spelling beside the existing fixed-path pin, asserting the count of
GOOD templates next to the count of bad ones so that a file with no templates
left in it cannot read as green.


Claude-Session: https://claude.ai/code/session_012GKcPZbMoGq7WPzKLfRBTU

Co-authored-by: Claude <noreply@anthropic.com>

Author: baozhoutao

packages/spec/scripts/gen-sdui-manifest-collision.test.ts

@@ -288,6 +288,32 @@ function runHarness(): Record<string, string> {
       // quietly, since nothing else in the run would notice until two agents
       // overlapped again.
       `printf "FIXED_LOG_LITERALS=%s\\n" "$(grep -c '/tmp/sdui-dump-dev\\.log' ${JSON.stringify(SCRIPT)} || true)"`,
+      // ── 5b. every mktemp template is portable: X's terminal, no suffix ───
+      //
+      // A spelling pin like 5 above, and for a defect from the same family: a
+      // per-run temp path that is not actually per-run. `mktemp
+      // "…dump-dev.XXXXXX.log"` reads as per-run and is per-run on GNU
+      // coreutils, which splits the trailing `.log` off as an implied
+      // `--suffix` and substitutes the X's anyway. That is a coreutils
+      // extension. BSD mktemp(1) wraps mkstemp(3), which only ever replaces a
+      // TRAILING run of X's, so on stock macOS nothing is substituted: the
+      // first run creates the file called literally `sdui-dump-dev.XXXXXX.log`
+      // and every later run dies there with `File exists`. Reported from a
+      // real mac; measured here only at the libc layer, where glibc's
+      // mkstemp("./x.XXXXXX.log") refuses with EINVAL outright.
+      //
+      // CI is Linux, so CI can never see this — which is precisely why it wants
+      // a pin rather than a run. The counted shape is the ASSIGNMENT form, not
+      // the word `mktemp`: the script's own comments quote the broken spelling
+      // in order to explain it, and a pattern that read those would be red on
+      // the fixed tree.
+      //
+      // TERMINAL_X is the vacuity guard, in the same spirit as
+      // STEAL_CLAIM_ON_PICK above: SUFFIXED=0 is also what a file with no
+      // mktemp templates left in it looks like, so the count of GOOD templates
+      // is asserted beside the count of bad ones.
+      `printf "SUFFIXED_MKTEMP_TEMPLATES=%s\\n" "$(grep -cE '^[[:space:]]*[A-Za-z_]+="\\$\\(mktemp "[^"]*X{3,}[^"X][^"]*"' ${JSON.stringify(SCRIPT)} || true)"`,
+      `printf "TERMINAL_X_MKTEMP_TEMPLATES=%s\\n" "$(grep -cE '^[[:space:]]*[A-Za-z_]+="\\$\\(mktemp "[^"]*X{3,}"' ${JSON.stringify(SCRIPT)} || true)"`,
       '',
       '# ── 6. concurrent callers from ONE base get DISTINCT ports ──────────',
       // The card, as an executed assertion. Eight subshells, one base, at
@@ -424,4 +450,10 @@ describe.skipIf(!RUNNABLE)('gen-sdui-manifest.sh concurrent-run contract', () =>
   it('keeps no fixed dev-server log path (spelling pin)', () => {
     expect(seen.FIXED_LOG_LITERALS).toBe('0');
   });
+
+  it("keeps every mktemp template portable — X's terminal, no suffix (spelling pin)", () => {
+    // Vacuity first: zero bad templates is also what zero templates looks like.
+    expect(seen.TERMINAL_X_MKTEMP_TEMPLATES, JSON.stringify(seen)).toBe('3');
+    expect(seen.SUFFIXED_MKTEMP_TEMPLATES, JSON.stringify(seen)).toBe('0');
+  });
 });

scripts/gen-sdui-manifest.sh

@@ -568,7 +568,26 @@ esac
 # started last, so a diagnosing reader could be reading another run's output —
 # and the failure branches below point readers straight at it. mktemp, matching
 # the pidfile beside it.
-DUMP_DEV_LOG="$(mktemp "${TMPDIR:-/tmp}/sdui-dump-dev.XXXXXX.log")"
+#
+# THE X'S ARE TERMINAL, AND NO SUFFIX FOLLOWS THEM — THE BSD/macOS FLOOR.
+# `mktemp "…dev.XXXXXX.log"` is a GNU coreutils spelling: coreutils splits the
+# trailing `.log` off as an implied `--suffix` (`--suffix=SUFF … is implied if
+# TEMPLATE does not end in X`, mktemp --help, coreutils 9.4) and substitutes the
+# X's anyway. BSD mktemp(1) is a thin wrapper over mkstemp(3), which takes the
+# template as-is and only ever replaces a TRAILING run of X's; measured here on
+# glibc, `mkstemp("./x.XXXXXX.log")` fails outright with EINVAL while
+# `mkstemp("./x.XXXXXX")` succeeds. On stock macOS the reported symptom is the
+# other branch of the same refusal: nothing is substituted, the literal file
+# `sdui-dump-dev.XXXXXX.log` is created on the first run, and every later run
+# dies at this line with `mkstemp failed on …: File exists` — the script
+# manufacturing its own blocking condition, one manual `rm` per pin bump.
+#
+# So: terminal X's, and the `.log` extension is simply given up. `--suffix` is
+# itself the GNU extension and is not the portable answer; a rename after the
+# fact would buy the extension back at the price of a second path and a window
+# in which the two disagree, and nothing reads these files by extension — they
+# are echoed to the operator and classified by content, never globbed.
+DUMP_DEV_LOG="$(mktemp "${TMPDIR:-/tmp}/sdui-dump-dev.XXXXXX")"
 DUMP_PID_FILE="$(mktemp "${TMPDIR:-/tmp}/sdui-dump-pid.XXXXXX")"
 
 echo "  dev server: port ${DUMP_PORT}, log ${DUMP_DEV_LOG}"
@@ -625,7 +644,9 @@ fi
 # The dump's combined output goes to a per-run file as well as to the terminal:
 # the failure branch classifies that text, and a remedy chosen from what
 # actually happened is the point (see sdui_dump_failure_advice above).
-DUMP_OUT_LOG="$(mktemp "${TMPDIR:-/tmp}/sdui-dump-out.XXXXXX.log")"
+# Terminal X's, no suffix after them — see the DUMP_DEV_LOG block above for the
+# BSD/macOS floor this shape is keeping.
+DUMP_OUT_LOG="$(mktemp "${TMPDIR:-/tmp}/sdui-dump-out.XXXXXX")"
 
 # `${PIPESTATUS[0]}`, never `$?`: after a pipeline `$?` is TEE's status, and tee
 # does not fail, so `$?` here would read every failure of the dump as a success.