import path from "node:path";

import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";

import { writeStateDirDotEnv } from "../config/test-helpers.js";

import { collectPreservedExistingServiceEnvVars } from "./daemon-install-helpers.js";

const mocks = vi.hoisted(() => ({

hasAnyAuthProfileStoreSource: vi.fn(() => true),

);

});

});

describe("collectPreservedExistingServiceEnvVars — operator opt-in allowlist", () => {

const managedKeys = new Set<string>();

it("continues to drop stale OPENCLAW_ALLOW_ROOT", () => {

const result = collectPreservedExistingServiceEnvVars(

{ OPENCLAW_ALLOW_ROOT: "1" },

managedKeys,

);

expect(result.OPENCLAW_ALLOW_ROOT).toBeUndefined();

});

it("preserves OPENCLAW_CLI_CONTAINER_BYPASS and OPENCLAW_CONTAINER_HINT", () => {

const result = collectPreservedExistingServiceEnvVars(

{

OPENCLAW_CLI_CONTAINER_BYPASS: "1",

OPENCLAW_CONTAINER_HINT: "ci",

},

managedKeys,

);

expect(result.OPENCLAW_CLI_CONTAINER_BYPASS).toBe("1");

expect(result.OPENCLAW_CONTAINER_HINT).toBe("ci");

});

it("still drops arbitrary OPENCLAW_FOO", () => {

const result = collectPreservedExistingServiceEnvVars({ OPENCLAW_FOO: "bar" }, managedKeys);

expect(result.OPENCLAW_FOO).toBeUndefined();

});

it("preserves container opt-ins while dropping unrelated OPENCLAW_* keys", () => {

const result = collectPreservedExistingServiceEnvVars(

{

OPENCLAW_CLI_CONTAINER_BYPASS: "1",

OPENCLAW_CONTAINER_HINT: "ci",

OPENCLAW_BAZ: "qux",

},

managedKeys,

);

expect(result.OPENCLAW_CLI_CONTAINER_BYPASS).toBe("1");

expect(result.OPENCLAW_CONTAINER_HINT).toBe("ci");

expect(result.OPENCLAW_BAZ).toBeUndefined();

});

});

return segments.length > 0 ? segments.join(path.delimiter) : undefined;

}

function collectPreservedExistingServiceEnvVars(

// Operator opt-in env vars that should survive service regeneration even though

// they share the OPENCLAW_ prefix that is otherwise stripped from preserved

// environments. These represent intentional, user-placed configuration on the

// service definition that the install/repair flow should not silently revert.

const PRESERVED_OPENCLAW_OPERATOR_OPT_IN_ENV_KEYS = new Set([

"OPENCLAW_CLI_CONTAINER_BYPASS",

"OPENCLAW_CONTAINER_HINT",

]);

export function collectPreservedExistingServiceEnvVars(

existingEnvironment: Record<string, string | undefined> | undefined,

managedServiceEnvKeys: Set<string>,

): Record<string, string | undefined> {

upper === "HOME" ||

upper === "PATH" ||

upper === "TMPDIR" ||

upper.startsWith("OPENCLAW_")

(upper.startsWith("OPENCLAW_") && !PRESERVED_OPENCLAW_OPERATOR_OPT_IN_ENV_KEYS.has(upper))

) {

continue;

}