node scripts/e2e/lib/bun-global-install/assertions.mjs run-with-timeout "$timeout_ms" "$@"

}

resolve_pack_tarball_path() {

local pack_json_file="$1"

local pack_dir="$2"

node -e '

const fs = require("node:fs");

const path = require("node:path");

const raw = fs.readFileSync(process.argv[1], "utf8") || "[]";

const parsed = JSON.parse(raw);

const last = Array.isArray(parsed) ? parsed.at(-1) : null;

const filename = typeof last?.filename === "string" ? last.filename.trim() : "";

if (

!filename.endsWith(".tgz") ||

filename.includes("\0") ||

filename !== path.basename(filename) ||

filename !== path.win32.basename(filename)

) {

console.error(`ERROR: npm pack reported unsafe tarball filename ${JSON.stringify(filename)}`);

process.exit(1);

}

process.stdout.write(path.resolve(process.argv[2], filename));

' "$pack_json_file" "$pack_dir"

}

restore_dist_from_image() {

local image="$1"

local backup_dir=""

echo "==> Pack OpenClaw tarball"

npm pack --ignore-scripts --json --pack-destination "$PACK_DIR" >"$pack_json_file"

PACKAGE_TGZ="$(

node -e '

const raw = require("node:fs").readFileSync(process.argv[1], "utf8") || "[]";

const parsed = JSON.parse(raw);

const last = Array.isArray(parsed) ? parsed.at(-1) : null;

if (!last || typeof last.filename !== "string" || last.filename.length === 0) {

process.exit(1);

}

process.stdout.write(require("node:path").resolve(process.argv[2], last.filename));

' "$pack_json_file" "$PACK_DIR"

)"

PACKAGE_TGZ="$(resolve_pack_tarball_path "$pack_json_file" "$PACK_DIR")"

if [ -z "$PACKAGE_TGZ" ] || [ ! -f "$PACKAGE_TGZ" ]; then

echo "missing packed OpenClaw tarball" >&2

exit 1

);

}

function extractResolvePackTarballPath(): string {

const script = readFileSync(BUN_GLOBAL_SMOKE_PATH, "utf8");

const match = script.match(/(resolve_pack_tarball_path\(\) \{[\s\S]*?\n\})\n\nrestore_dist/u);

if (!match) {

throw new Error("resolve_pack_tarball_path helper was not found");

}

return match[1];

}

function runResolvePackTarballPath(filename: string) {

return spawnSync(

"bash",

[

"--noprofile",

"--norc",

"-c",

`${extractResolvePackTarballPath()}

pack_dir="$(mktemp -d)"

pack_json_file="$pack_dir/pack.json"

trap 'rm -rf "$pack_dir"' EXIT

printf '%s' "$PACK_JSON" >"$pack_json_file"

resolve_pack_tarball_path "$pack_json_file" "$pack_dir"`,

],

{

encoding: "utf8",

env: {

HOME: "/tmp",

PACK_JSON: JSON.stringify([{ filename }]),

PATH: process.env.PATH ?? "",

},

},

);

}

describe("test-install-sh-docker", () => {

it("defaults ARM hosts to native arm64 while keeping x64 CI on amd64", () => {

expect(runDefaultSmokePlatform({ CI: "true" }, "aarch64")).toBe("linux/arm64");

expect(script).not.toContain('\n rm -rf "$ROOT_DIR/dist"\n');

});

it("keeps npm pack tarball paths inside the Bun smoke pack directory", () => {

const script = readFileSync(BUN_GLOBAL_SMOKE_PATH, "utf8");

expect(script).toContain("resolve_pack_tarball_path()");

expect(script).toContain(

'PACKAGE_TGZ="$(resolve_pack_tarball_path "$pack_json_file" "$PACK_DIR")"',

);

expect(script).toContain("filename !== path.basename(filename)");

expect(script).toContain("filename !== path.win32.basename(filename)");

expect(script).toContain("npm pack reported unsafe tarball filename");

});

it("rejects path-like npm pack tarball filenames in Bun smoke metadata", () => {

const safeResult = runResolvePackTarballPath("openclaw-2026.6.17.tgz");

expect(safeResult.status).toBe(0);

expect(safeResult.stdout).toMatch(/\/openclaw-2026\.6\.17\.tgz$/u);

const unsafeFilenames = [

"../openclaw.tgz",

"nested/openclaw.tgz",

"nested\\openclaw.tgz",

"/tmp/openclaw.tgz",

"C:\\temp\\openclaw.tgz",

"openclaw.tar.gz",

];

for (const filename of unsafeFilenames) {

const result = runResolvePackTarballPath(filename);

expect(result.status, filename).not.toBe(0);

expect(result.stderr, filename).toContain("npm pack reported unsafe tarball filename");

}

});

it("gates workflow Bun install smoke to scheduled and release-check runs", () => {

const workflow = readFileSync(INSTALL_SMOKE_WORKFLOW_PATH, "utf8");

const releaseChecks = readFileSync(RELEASE_CHECKS_WORKFLOW_PATH, "utf8");