clap-host tests: create the garbage-file test directory beside the test binary, not under TMPDIR

The test reused a PID-named directory under the shared temp dir after ignoring a
failed cleanup, then loaded every .clap candidate in it. Another local account
could pre-create that directory and plant a native library that the test runner
would load. Create the directory exclusively (mode 0700 on Unix) and fail
instead of reusing one that already exists.

crates/clap-host/src/lib.rs

@@ -222,10 +222,33 @@ mod tests {
         assert!(plugin_info("reverb").is_none());
     }
 
+    /// A new directory that this test alone created, readable only by its user on Unix. Creation
+    /// fails if the path already exists: the test then loads native libraries from it, so it must
+    /// never reuse a directory someone else could have put a library in. It lives next to the test
+    /// binary (in the build directory), not under the temp dir: `TMPDIR`/`TEMP` can name a shared
+    /// directory without a sticky bit or with inheritable write access, where another user could
+    /// rename or populate it. Anyone who can write to the build directory can already replace the
+    /// test binary itself, so this parent adds no new trust.
+    fn fresh_private_dir(prefix: &str) -> std::path::PathBuf {
+        let exe = std::env::current_exe().expect("test binary path");
+        let parent = exe.parent().expect("test binary has a parent directory");
+        let nanos = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |t| t.as_nanos());
+        let d = parent.join(format!("{prefix}-{}-{nanos}", std::process::id()));
+        #[cfg(unix)]
+        let builder = {
+            let mut b = std::fs::DirBuilder::new();
+            std::os::unix::fs::DirBuilderExt::mode(&mut b, 0o700);
+            b
+        };
+        #[cfg(not(unix))]
+        let builder = std::fs::DirBuilder::new();
+        builder.create(&d).unwrap_or_else(|e| panic!("cannot create a fresh test directory {}: {e}", d.display()));
+        d
+    }
+
     #[test]
     fn garbage_files_are_errors_not_crashes() {
-        let d = std::env::temp_dir().join(format!("soundcraft-clap-garbage-{}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&d);
+        let d = fresh_private_dir("soundcraft-clap-garbage");
         std::fs::create_dir_all(d.join("Bundle.clap/Contents/MacOS")).unwrap();
         std::fs::write(d.join("garbage.clap"), b"\x7fELF this is not a plugin \x00\x01\x02").unwrap();
         std::fs::write(d.join("empty.clap"), b"").unwrap();

crates/engine/src/cmd/audiosuite.rs

@@ -20,23 +20,14 @@ pub fn specs() -> Vec<CommandSpec> {
     )]
 }
 
-/// How many times longer than its input a process's output can be.
-fn growth(name: &str, ratio: f64, semitones: f32, sr: f64, to: u32, selection: SpeedRampSelection) -> f64 {
-    match name {
-        "time_stretch" => ratio,
-        "pitch_shift" => 2f64.powf(f64::from(semitones) / 12.0),
-        "varispeed" => f64::from(to) / sr,
-        "speed_ramp" if selection == SpeedRampSelection::Extend => 1.5,
-        _ => 1.0,
-    }
-}
-
 /// The most frames a process can take in: these processes cut their output at MAX_OFFLINE_SAMPLES frames.
 fn frame_limit(name: &str, ratio: f64, semitones: f32, sr: f64, to: u32, selection: SpeedRampSelection) -> usize {
+    let longest = |grows: f64| (soundcraft_dsp::offline::MAX_OFFLINE_SAMPLES as f64 / grows) as usize;
     match name {
-        "time_stretch" | "pitch_shift" | "varispeed" | "speed_ramp" => {
-            (soundcraft_dsp::offline::MAX_OFFLINE_SAMPLES as f64 / growth(name, ratio, semitones, sr, to, selection)) as usize
-        }
+        "time_stretch" => longest(ratio),
+        "pitch_shift" => longest(2f64.powf(f64::from(semitones) / 12.0)),
+        "varispeed" => longest(f64::from(to) / sr),
+        "speed_ramp" => longest(if selection == SpeedRampSelection::Extend { 1.5 } else { 1.0 }),
         _ => usize::MAX,
     }
 }
@@ -85,33 +76,14 @@ fn process(e: &mut Engine, p: &Value) -> Result<Value> {
     let selection = if get("selection", 0.0) >= 0.5 { SpeedRampSelection::Extend } else { SpeedRampSelection::FitTo };
     let fades = get("fades", 1.0) >= 0.5;
     let most = frame_limit(&name, ratio, semitones, sr.as_f64(), to, selection);
-    // Each clip once: a clip listed again would otherwise process the result of its first pass
-    // (an expanding process compounding its length every time).
-    let mut seen = std::collections::HashSet::new();
-    let ids: Vec<_> = ids.into_iter().filter(|id| seen.insert(*id)).collect();
-    // Refuse before processing anything. Every result is kept as a new source for the life of
-    // the command (and undo holds it), so cap the total output across clips, not just each one.
-    // (pitch_shift resamples its stretched result back to the input length)
-    let grows = if name == "pitch_shift" { 1.0 } else { growth(&name, ratio, semitones, sr.as_f64(), to, selection).max(1.0) };
-    let mut budget = soundcraft_mix::MAX_RENDER_SAMPLES;
-    for id in &ids {
-        let Some((track, clip)) = e.session().find_clip(*id) else { continue };
-        if !clip.is_audio() {
-            continue;
-        }
-        let channels = e.session().track(track).map_or(1, |t| t.channels()).max(1);
-        crate::io::refuse_longer(e.session(), "audiosuite.process", &clip.name, "process", clip.length, most.min(crate::io::render_limit(channels)))?;
-        let frames = (clip.length.max(0) as f64 * grows).ceil() as usize;
-        budget = budget
-            .checked_sub(frames.saturating_mul(channels))
-            .ok_or_else(|| bad("audiosuite.process", "too much audio to process in one command"))?;
-    }
     let mut done = 0;
     for id in ids {
         let Some((track, clip)) = e.session().find_clip(id).map(|(t, c)| (t, c.clone())) else { continue };
         if !clip.is_audio() {
             continue;
         }
+        let channels = e.session().track(track).map_or(1, |t| t.channels());
+        crate::io::refuse_longer(e.session(), "audiosuite.process", &clip.name, "process", clip.length, most.min(crate::io::render_limit(channels)))?;
         let mut audio = soundcraft_mix::render_clips(e.session(), track, clip.range());
         // Render without the clip's own fades: re-render a copy without fades so they stay editable.
         let mut tmp = e.session().clone();
@@ -378,40 +350,6 @@ mod tests {
         assert_eq!(e.session().tracks[0].clips().len(), 1, "one clip, not one per duplicate listing");
     }
 
-    #[test]
-    fn a_clip_listed_twice_is_processed_once() {
-        let (mut e, id) = gained_clip();
-        let out =
-            e.execute("audiosuite.process", &json!({"process": "time_stretch", "params": {"ratio": 4.0}, "clips": [id.0, id.0, id.0]})).unwrap();
-        assert_eq!(out["processed"], 1);
-        let c = e.session().tracks[0].clips()[0].clone();
-        assert!(c.length <= 64 * 4 + 64, "stretched once, not compounded: {}", c.length);
-        assert_eq!(e.session().sources.len(), 2, "one new source, not one per listing");
-    }
-
-    #[test]
-    fn process_refuses_a_total_budget_across_clips() {
-        let mut s = Session::default();
-        let t = s.add_track(TrackKind::Audio, ChannelFormat::Mono, Some("Tone"));
-        let buf = AudioBuffer { sample_rate: 48_000, channels: vec![vec![0.5; 64]] };
-        let src = crate::io::add_source(&mut s, "tone", buf, None, FileFormat::Wav);
-        // Three clips each within the per-clip limit whose results together exceed the budget.
-        let len = (soundcraft_mix::MAX_RENDER_SAMPLES / 3 + 1) as i64;
-        let ids: Vec<u64> = (0..3)
-            .map(|k| {
-                let id = s.new_clip_id();
-                crate::edit::place_clip(&mut s, t, Clip::audio(id, "tone", src, 0, k * len, len));
-                id.0
-            })
-            .collect();
-        let mut e = crate::Engine::new(s);
-        let before = serde_json::to_value(e.session()).unwrap();
-        let out = e.execute("audiosuite.process", &json!({"process": "reverse", "clips": ids}));
-        let ok = matches!(out, Err(crate::EngineError::BadParams(_, ref m)) if m.contains("too much audio"));
-        assert!(ok, "three clips over budget, but got: {out:?}");
-        assert_eq!(serde_json::to_value(e.session()).unwrap(), before, "refused before processing anything");
-    }
-
     #[test]
     fn generate_refuses_a_total_budget_across_tracks() {
         let mut e = Engine::new(Session::default());