Make synthetic browser checks independent of private files and timing (#45)

tests/native-browser.spec.ts

@@ -1,7 +1,14 @@
 import { test, expect } from "@playwright/test";
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
 import { createHash } from "node:crypto";
-import { resolve } from "node:path";
+import { basename, join, resolve } from "node:path";
 import { CrystalAssets } from "../src/game/rom/assets";
 import { generatePartyMon } from "../src/game/party/pokemon";
 import { GameWorld } from "../src/game/world/world";
@@ -420,12 +427,23 @@ test("walks from New Bark Town onto Route 29 after receiving a starter", async (
 test("development server does not serve ROMs or the private reference checkout", async ({
   request,
 }) => {
-  for (const path of [
-    "/Pokemon%20-%20Crystal%20Version%20(UE)%20(V1.1)%20%5BC%5D%5B!%5D.gbc",
-    "/.reference/pokecrystal/README.md",
-  ]) {
-    const response = await request.get(path);
-    expect([403, 404]).toContain(response.status());
+  // Missing paths can return Vite's HTML fallback. Exercise real files using
+  // disposable synthetic content, without depending on a private checkout.
+  const directory = mkdtempSync(resolve(".ci-private-"));
+  try {
+    mkdirSync(join(directory, ".reference"));
+    for (const file of ["fixture.gbc", ".reference/README.md"]) {
+      writeFileSync(join(directory, file), "Synthetic private-file test fixture");
+      for (const path of [
+        `/${basename(directory)}/${file}`,
+        `/@fs/${join(directory, file)}`,
+      ]) {
+        const response = await request.get(path);
+        expect(response.status(), path).toBe(403);
+      }
+    }
+  } finally {
+    rmSync(directory, { recursive: true, force: true });
   }
 });