ci: shorten VS Code test profile path

Author: TheStreamCode

.github/workflows/ci.yml

@@ -26,6 +26,7 @@ jobs:
 
     env:
       VSCODE_TEST_VERSION: stable
+      VSCODE_TEST_USER_DATA_DIR: ${{ runner.temp }}/kimi-vscode-test
 
     steps:
       - name: Checkout repository
@@ -63,6 +64,7 @@ jobs:
 
     env:
       VSCODE_TEST_VERSION: ${{ matrix.vscode }}
+      VSCODE_TEST_USER_DATA_DIR: ${{ runner.temp }}/kimi-vscode-test
 
     steps:
       - name: Checkout repository

.github/workflows/release.yml

@@ -13,6 +13,8 @@ jobs:
     name: Package GitHub release
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    env:
+      VSCODE_TEST_USER_DATA_DIR: ${{ runner.temp }}/kimi-vscode-test
     permissions:
       contents: write
 

AGENTS.md

@@ -58,7 +58,7 @@ Use `npm ci --ignore-scripts` for a clean, reproducible install. Do not replace
 
 - Add unit tests for helper edge cases and metadata tests for public contract changes.
 - Keep `@types/vscode` pinned to the minimum version declared by `engines.vscode`.
-- The integration runner accepts `VSCODE_TEST_VERSION`; CI covers stable VS Code on Windows, Linux, and macOS plus the minimum supported VS Code on Linux.
+- The integration runner accepts `VSCODE_TEST_VERSION` and `VSCODE_TEST_USER_DATA_DIR`. CI uses a short temporary profile path to stay within macOS Unix-socket limits and covers stable VS Code on Windows, Linux, and macOS plus the minimum supported VS Code on Linux.
 - Never weaken tests merely to make a change pass. Update brittle exact assertions only when the public contract intentionally changes.
 
 ## Documentation and Releases

CHANGELOG.md

@@ -16,6 +16,7 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 - Added Biome linting and formatting checks plus stricter TypeScript compiler options
 - Aligned VS Code type definitions and integration coverage with the minimum supported editor version
 - Expanded CI coverage to Windows, Linux, macOS, and the minimum supported VS Code release
+- Isolated Extension Host test profiles under the runner temporary directory to avoid macOS socket-path limits
 - Updated repository documentation, contributor guidance, and AI-agent instructions
 
 ## 0.1.2 - 2026-07-25

docs/SECURITY_REVIEW.md

@@ -26,7 +26,7 @@ Resolution:
 - `brace-expansion` is locked to 5.0.9 (`package-lock.json:1510`).
 - `fast-uri` is locked to 3.1.5 (`package-lock.json:2167`).
 - `npm run check:security` now audits the lockfile at high severity (`package.json:127`).
-- CI and release jobs run the audit before accepting or publishing artifacts (`.github/workflows/ci.yml:104`, `.github/workflows/release.yml:42`).
+- CI and release jobs run the audit before accepting or publishing artifacts (`.github/workflows/ci.yml:106`, `.github/workflows/release.yml:44`).
 
 ## Medium-Severity Findings
 
@@ -36,8 +36,8 @@ The CI workflow referenced `actions/checkout@v7` and `actions/setup-node@v6`. Ma
 
 Resolution:
 
-- All checkout and Node setup steps are pinned to verified full commit SHAs, with their major release retained in same-line comments for maintainability (`.github/workflows/ci.yml:32`, `.github/workflows/ci.yml:35`, `.github/workflows/release.yml:21`, `.github/workflows/release.yml:24`).
-- Default workflow permissions remain read-only; only the release job receives scoped `contents: write` permission (`.github/workflows/release.yml:8`, `.github/workflows/release.yml:16`).
+- All checkout and Node setup steps are pinned to verified full commit SHAs, with their major release retained in same-line comments for maintainability (`.github/workflows/ci.yml:33`, `.github/workflows/ci.yml:36`, `.github/workflows/release.yml:23`, `.github/workflows/release.yml:26`).
+- Default workflow permissions remain read-only; only the release job receives scoped `contents: write` permission (`.github/workflows/release.yml:8`, `.github/workflows/release.yml:18`).
 
 ## Low-Severity Findings
 

test/integration/runTest.js

@@ -4,12 +4,18 @@ const { runTests } = require('@vscode/test-electron');
 async function main() {
   const extensionDevelopmentPath = path.resolve(__dirname, '..', '..');
   const extensionTestsPath = path.resolve(__dirname, 'suite');
+  const launchArgs = ['--disable-extensions'];
+  const userDataDir = process.env.VSCODE_TEST_USER_DATA_DIR;
+
+  if (userDataDir) {
+    launchArgs.push(`--user-data-dir=${userDataDir}`);
+  }
 
   try {
     await runTests({
       extensionDevelopmentPath,
       extensionTestsPath,
-      launchArgs: ['--disable-extensions'],
+      launchArgs,
       version: process.env.VSCODE_TEST_VERSION || 'stable',
     });
   } catch (error) {

test/metadata.test.js

@@ -156,6 +156,7 @@ test('CI validates securely across supported platforms and editor versions', ()
   assert.match(workflow, /ubuntu-latest/);
   assert.match(workflow, /macos-latest/);
   assert.match(workflow, /vscode: '1\.103\.0'/);
+  assert.match(workflow, /VSCODE_TEST_USER_DATA_DIR: \$\{\{ runner\.temp \}\}\/kimi-vscode-test/);
   assert.match(workflow, /cache: npm/);
   assert.match(workflow, /npm ci --ignore-scripts/);
   assert.match(workflow, /npm run check/);
@@ -166,6 +167,13 @@ test('CI validates securely across supported platforms and editor versions', ()
   assert.doesNotMatch(workflow, /uses: actions\/(?:checkout|setup-node)@v\d+/);
 });
 
+test('integration runner supports a short isolated VS Code profile path', () => {
+  const runner = readText('test/integration/runTest.js');
+
+  assert.match(runner, /process\.env\.VSCODE_TEST_USER_DATA_DIR/);
+  assert.match(runner, /--user-data-dir=\$\{userDataDir\}/);
+});
+
 test('release workflow validates, audits, packages, and publishes matching tags', () => {
   const workflow = readText('.github/workflows/release.yml');