From b44aa5b1f7ecdd57e82ed79836cb25d974e05ac8 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Sat, 21 Feb 2026 18:38:25 +0000 Subject: [PATCH] refactor(test): snapshot skills install state dir env --- src/agents/skills-install.download.e2e.test.ts | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/src/agents/skills-install.download.e2e.test.ts b/src/agents/skills-install.download.e2e.test.ts index 7e2346107..0cbf7648e 100644 --- a/src/agents/skills-install.download.e2e.test.ts +++ b/src/agents/skills-install.download.e2e.test.ts @@ -4,6 +4,7 @@ import path from "node:path"; import JSZip from "jszip"; import * as tar from "tar"; import { afterEach, beforeEach, describe, expect, it, vi } from "vitest"; +import { captureEnv } from "../test-utils/env.js"; import { setTempStateDir, writeDownloadSkill } from "./skills-install.download-test-utils.js"; import { installSkill } from "./skills-install.js"; @@ -11,15 +12,7 @@ const runCommandWithTimeoutMock = vi.fn(); const scanDirectoryWithSummaryMock = vi.fn(); const fetchWithSsrFGuardMock = vi.fn(); -const originalOpenClawStateDir = process.env.OPENCLAW_STATE_DIR; - -afterEach(() => { - if (originalOpenClawStateDir === undefined) { - delete process.env.OPENCLAW_STATE_DIR; - } else { - process.env.OPENCLAW_STATE_DIR = originalOpenClawStateDir; - } -}); +let envSnapshot: ReturnType; vi.mock("../process/exec.js", () => ({ runCommandWithTimeout: (...args: unknown[]) => runCommandWithTimeoutMock(...args), @@ -81,6 +74,7 @@ async function installZipDownloadSkill(params: { describe("installSkill download extraction safety", () => { beforeEach(() => { + envSnapshot = captureEnv(["OPENCLAW_STATE_DIR"]); runCommandWithTimeoutMock.mockReset(); scanDirectoryWithSummaryMock.mockReset(); fetchWithSsrFGuardMock.mockReset(); @@ -93,6 +87,10 @@ describe("installSkill download extraction safety", () => { }); }); + afterEach(() => { + envSnapshot.restore(); + }); + it("rejects zip slip traversal", async () => { const workspaceDir = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-skills-install-")); try {