test: unit suite and security lint green on macOS; lossless portable type seed

[huyplb]

Two test-environment problems found while running every test layer locally. Neither changes product code.

1. Unit suite and security lint fail on every Mac

• Unit tests: vitest.config.ts set FOXFLOW_FILES_DIR to realpathSync(tmpdir()). On macOS that is /private/var/folders/…, while the workflow suites build their fixtures under tmpdir(), which is /var/folders/… (a symlink to it). The lexical half of the file-pipe containment check (added in c20efd3) then refused every fixture, so 41 tests in 10 files failed on macOS. CI runs Linux, where /tmp isn't a symlink, so CI stayed green.
  • The root is now tmpdir() as the suites spell it. The real-path half of the check resolves both sides itself.
  • The confinement tests (symlink escape, climbing out with .., a sibling directory sharing the prefix) still pass.
• Security lint: both ESLint configs now ignore .claude/**. Agent worktrees are whole gitignored checkouts of the repo, and lint:security failed on days-old copies of the code inside them.

2. The gated CLI integration test has failed since #290

FOX_IT_DB=1 (apps/cli/src/commands/__tests__/integration.seed.test.ts) asserts that the advanced seed's t_all_types is UNCHANGED from Postgres to MySQL. Since #290 the canonical type carries each engine's default fractional-seconds precision:

• Postgres TIMESTAMP has 6 digits and MySQL DATETIME has 0, which is correctly a difference, because migrating one onto the other truncates microseconds.
• CI doesn't run this test, so the failure went unnoticed.

The seed was what was wrong: a portable matrix should be lossless, so the MySQL and MariaDB c_ts columns are now DATETIME(6).

Verification (macOS)

• vitest run: all green (previously 41 failures). Workflow-engine and workflow-server: 850 pass.
• lint:security, eslint . and the ESLint-config parity test pass.
• FOX_IT_DB=1 CLI integration: 2/2 (previously 1 failure) after seed-advanced.sh mysql mariadb.

🤖 Generated with Claude Code

---

Note

Low Risk
Test, lint, and seed fixture changes only; no application or auth/data-path logic modified.

Overview
Fixes macOS-only test and lint failures and aligns advanced MySQL/MariaDB seed timestamps with the portable type matrix—no product runtime changes.

Vitest: FOXFLOW_FILES_DIR is set to tmpdir() instead of realpathSync(tmpdir()) so workflow file-pipe containment matches how fixtures are built on macOS (/var/folders/… vs /private/var/folders/…), restoring 41 previously failing workflow tests on Mac while Linux CI behavior stays the same.

ESLint: Both eslint.config.js and eslint.security.config.js ignore .claude/** so agent worktrees (duplicate gitignored checkouts) are not linted twice against stale code.

Seeds: c_ts in advanced MySQL and MariaDB t_all_types moves from plain DATETIME to DATETIME(6), matching Postgres microsecond precision so the gated FOX_IT_DB=1 integration assertion that the portable matrix is unchanged across engines passes again.

^{Reviewed by Cursor Bugbot for commit 4a6ec00. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_f13a2a33-776b-4d0a-8af8-f90361c45346)