[freeqaz]

Problem

Tests that change process.env for one test or one call each carry their own save/restore: read the old value, assign, then delete it or put it back in a t.after hook or a finally block. The same five-line if (previous === undefined) delete ... else ... block appears about 20 times in 10 files. Two ci-openshell tests, first-agent-smoke and kubernetes-real-kubectl also put a fixture directory first on PATH by hand instead of using prependPath. Those copies restore with process.env.PATH = path, which writes the string "undefined" when PATH was unset.

Change

• New tests/helpers/environment.mjs:
  • setEnvironment(t, values) sets the entries until the test that owns t ends.
  • withEnvironment(values, body) sets them while body runs and restores them when it settles.
  • An entry that was unset is unset again, and undefined unsets an entry. Several setEnvironment calls in one test are undone in reverse order, so an entry set twice (as runtime-image-failure-output's dockerFailure does) ends as it was before the first call.
• prependPath in fake-commands.mjs now uses setEnvironment.
• These 11 files switch over with the same values and the same scope: per-test copies use setEnvironment, and finally-scoped copies use withEnvironment.
  • container-release
  • container-resume
  • github-app-observer
  • postgres-connection-auth
  • repository-client-environment
  • socket-directory
  • runtime-image-failure-output
  • ci-openshell (2 of 3 PATH sites, plus EARLY_WAKE_GRACE_MS)
  • first-agent-smoke
  • kubernetes-real-kubectl
  • fake-commands
• Left alone:
  • docker-compute, ssh-compute and docker-compute-token-retry, because feat(occdev): wire the OpenShell Git route into occ dev up with an installed acceptance #3045 rewrites them.
  • The first ci-openshell PATH site, because feat(runtime): apply Gateway tool policy to dedicated OCE deployments #2633 edits the next line.
  • Module-level environment setup in fixture files and ci-impact's whole-environment swap.

Verification

• Every touched file passes locally on Node 24, pinned to 10 CPUs.

  • Test counts: repository-client-environment 1, socket-directory 2, kubernetes-real-kubectl 47, ci-openshell 14, container-release 22, container-resume 1, first-agent-smoke 35, github-app-observer 13, postgres-connection-auth 6, runtime-image-failure-output 12.
  • postgres-connection-auth skips 2, the cases that need a real database, which don't use the helper. Every converted site ran.
  • The other prependPath callers also pass: kubernetes-api-read 4 and k3d-failure-diagnostics 32.

• Mutants:

  Mutant	Fails
  setEnvironment sets nothing	repository-client-environment 1/1, container-release 5/22, container-resume 1/1, runtime-image-failure-output 9/12, ci-openshell 3/14, postgres-connection-auth 1/6, kubernetes-api-read 2/4, k3d-failure-diagnostics 1/32; kubernetes-real-kubectl hangs
  withEnvironment sets nothing	socket-directory 1/2, kubernetes-real-kubectl 3/47, ci-openshell 1/14, first-agent-smoke 1/35, postgres-connection-auth 1/6

• tsc --build tsconfig.json tests/tsconfig.json, ESLint and Prettier are clean on the touched files.

• A git merge-tree check against open PRs that touch these files (test(openshell): exercise native provider authority #1982, Draft implementation: managed outbound HTTPS for dedicated Gateways #2518, feat(runtime): apply Gateway tool policy to dedicated OCE deployments #2633, Type-check maintained Node scripts and tests in the root build #2925) finds no new conflicts.

Risks

Test-only. Restores now run at the same point or, for the container-release and container-resume cases, one after-hook later than the temporary-directory removal they shared a hook with.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.