test: isolate theme tests to prevent module state pollution

Split tests requiring module-level isolation into separate test suite:
- Created .config/vitest.config.isolated.mts with isolate: true
- Moved themes.test.ts and logger.test.ts to test/isolated/
- Updated main vitest config to exclude isolated tests
- Modified test script to run both main and isolated suites
- Added separate test-isolated job in CI workflow

This prevents theme state pollution between test files while keeping
the main test suite fast with parallel execution.

Fixes third-strike test failure for "should default to socket theme".

Author: jdalton

.config/vitest.config.isolated.mts

@@ -0,0 +1,68 @@
+/**
+ * @fileoverview Vitest configuration for isolated tests
+ * Tests that require full isolation due to shared module state
+ */
+
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { defineConfig } from 'vitest/config'
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const projectRoot = path.resolve(__dirname, '..')
+
+// Normalize paths for cross-platform glob patterns (forward slashes on Windows)
+const toGlobPath = (pathLike: string): string => pathLike.replaceAll('\\', '/')
+
+export default defineConfig({
+  cacheDir: path.resolve(projectRoot, '.cache/vitest-isolated'),
+  resolve: {
+    preserveSymlinks: false,
+    extensions: ['.mts', '.ts', '.mjs', '.js', '.json'],
+    alias: {
+      '#env/ci': path.resolve(projectRoot, 'src/env/ci.ts'),
+      '#env': path.resolve(projectRoot, 'src/env'),
+      '#constants': path.resolve(projectRoot, 'src/constants'),
+      '#lib': path.resolve(projectRoot, 'src/lib'),
+      '#packages': path.resolve(projectRoot, 'src/lib/packages'),
+      '#types': path.resolve(projectRoot, 'src/types.ts'),
+      '#utils': path.resolve(projectRoot, 'src/utils'),
+      cacache: path.resolve(projectRoot, 'src/external/cacache'),
+      'make-fetch-happen': path.resolve(
+        projectRoot,
+        'src/external/make-fetch-happen',
+      ),
+      'fast-sort': path.resolve(projectRoot, 'src/external/fast-sort'),
+      pacote: path.resolve(projectRoot, 'src/external/pacote'),
+      '@socketregistry/scripts': path.resolve(projectRoot, 'scripts'),
+      '@socketsecurity/lib': path.resolve(projectRoot, 'src'),
+    },
+  },
+  test: {
+    globalSetup: [path.resolve(__dirname, 'vitest-global-setup.mts')],
+    globals: false,
+    environment: 'node',
+    include: [
+      toGlobPath(
+        path.resolve(projectRoot, 'test/isolated/**/*.test.{js,ts,mjs,mts}'),
+      ),
+    ],
+    exclude: ['**/node_modules/**', '**/dist/**'],
+    reporters: ['default'],
+    // Full isolation for tests that modify shared module state
+    pool: 'threads',
+    poolOptions: {
+      threads: {
+        singleThread: true,
+        maxThreads: 1,
+        minThreads: 1,
+        isolate: true,
+        useAtomics: true,
+      },
+    },
+    testTimeout: 10_000,
+    hookTimeout: 10_000,
+    sequence: {
+      concurrent: false,
+    },
+  },
+})

.config/vitest.config.mts

@@ -56,6 +56,7 @@ export default defineConfig({
     exclude: [
       '**/node_modules/**',
       '**/dist/**',
+      toGlobPath(path.resolve(projectRoot, 'test/isolated/**')),
       ...(process.env.INCLUDE_NPM_TESTS
         ? []
         : [toGlobPath(path.resolve(projectRoot, 'test/npm/**'))]),

.github/workflows/ci.yml

@@ -78,7 +78,7 @@ jobs:
             node_modules
           key: build-${{ github.sha }}-${{ runner.os }}
 
-  # Test matrix - reuses build artifacts
+  # Test matrix - reuses build artifacts (main test suite)
   test:
     name: Test
     needs: [lint, build]
@@ -117,8 +117,41 @@ jobs:
         if: runner.os == 'Windows'
         run: pnpm install --frozen-lockfile
 
-      - name: Run tests
-        run: pnpm run test --fast --all
+      - name: Run main tests
+        run: pnpm exec vitest --config .config/vitest.config.mts run
+
+  # Isolated test suite - runs separately with full isolation
+  test-isolated:
+    name: Test (Isolated)
+    needs: [lint, build]
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
+        with:
+          version: 10
+
+      - name: Setup Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22
+          cache: 'pnpm'
+
+      - name: Restore build artifacts
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            dist
+            node_modules
+          key: build-${{ github.sha }}-Linux
+          fail-on-cache-miss: true
+
+      - name: Run isolated tests
+        run: pnpm exec vitest --config .config/vitest.config.isolated.mts run
 
   # Type check - reuses build artifacts
   type-check:
@@ -156,7 +189,7 @@ jobs:
   # Status check job - used as required check in branch protection
   ci-success:
     name: CI Success
-    needs: [lint, build, test, type-check]
+    needs: [lint, build, test, test-isolated, type-check]
     if: always()
     runs-on: ubuntu-latest
     steps:
@@ -165,6 +198,7 @@ jobs:
           if [ "${{ needs.lint.result }}" != "success" ] || \
              [ "${{ needs.build.result }}" != "success" ] || \
              [ "${{ needs.test.result }}" != "success" ] || \
+             [ "${{ needs.test-isolated.result }}" != "success" ] || \
              [ "${{ needs.type-check.result }}" != "success" ]; then
             echo "One or more jobs failed"
             exit 1

scripts/test.mjs

@@ -199,7 +199,11 @@ async function runBuild() {
   return 0
 }
 
-async function runTests(options, positionals = []) {
+async function runTests(
+  options,
+  positionals = [],
+  configPath = '.config/vitest.config.mts',
+) {
   const { all, coverage, force, staged, update } = options
   const runAll = all || force
 
@@ -217,7 +221,7 @@ async function runTests(options, positionals = []) {
   const vitestCmd = WIN32 ? 'vitest.cmd' : 'vitest'
   const vitestPath = path.join(nodeModulesBinPath, vitestCmd)
 
-  const vitestArgs = ['--config', '.config/vitest.config.mts', 'run']
+  const vitestArgs = ['--config', configPath, 'run']
 
   // Add coverage if requested
   if (coverage) {
@@ -311,6 +315,57 @@ async function runTests(options, positionals = []) {
   return result.code
 }
 
+async function runIsolatedTests(options) {
+  const { coverage } = options
+
+  logger.step('Running isolated tests')
+
+  // Prepare vitest command
+  const vitestCmd = WIN32 ? 'vitest.cmd' : 'vitest'
+  const vitestPath = path.join(nodeModulesBinPath, vitestCmd)
+
+  const vitestArgs = ['--config', '.config/vitest.config.isolated.mts', 'run']
+
+  // Add coverage if requested
+  if (coverage) {
+    vitestArgs.push('--coverage')
+  }
+
+  const spawnOptions = {
+    cwd: rootPath,
+    env: {
+      ...process.env,
+      NODE_OPTIONS:
+        `${process.env.NODE_OPTIONS || ''} --max-old-space-size=${process.env.CI ? 8192 : 4096} --unhandled-rejections=warn`.trim(),
+    },
+    stdio: 'inherit',
+  }
+
+  // Use dotenvx to load test environment
+  const dotenvxCmd = WIN32 ? 'dotenvx.cmd' : 'dotenvx'
+  const dotenvxPath = path.join(nodeModulesBinPath, dotenvxCmd)
+
+  // Always use direct execution for isolated tests (simpler, more predictable)
+  const result = await runCommandWithOutput(
+    dotenvxPath,
+    ['-q', 'run', '-f', '.env.test', '--', vitestPath, ...vitestArgs],
+    {
+      ...spawnOptions,
+      stdio: ['inherit', 'pipe', 'pipe'],
+    },
+  )
+
+  // Print output
+  if (result.stdout) {
+    process.stdout.write(result.stdout)
+  }
+  if (result.stderr) {
+    process.stderr.write(result.stderr)
+  }
+
+  return result.code
+}
+
 async function main() {
   try {
     // Parse arguments
@@ -420,14 +475,23 @@ async function main() {
       }
     }
 
-    // Run tests
+    // Run main tests
     exitCode = await runTests(
       { ...values, coverage: withCoverage },
       positionals,
     )
 
     if (exitCode !== 0) {
-      logger.error('Tests failed')
+      logger.error('Main tests failed')
+      process.exitCode = exitCode
+      return
+    }
+
+    // Run isolated tests
+    exitCode = await runIsolatedTests({ coverage: withCoverage })
+
+    if (exitCode !== 0) {
+      logger.error('Isolated tests failed')
       process.exitCode = exitCode
     } else {
       logger.success('All tests passed!')