fix(e2e): fail on invalid test state payloads

scripts/lib/openclaw-e2e-instance.sh

@@ -1,6 +1,18 @@
 #!/usr/bin/env bash
 # Shared in-container lifecycle helpers for Docker/Bash E2E lanes.
-openclaw_e2e_eval_test_state_from_b64() { eval "$(printf '%s' "${1:?missing OpenClaw test-state script}" | base64 -d)"; }
+openclaw_e2e_eval_test_state_from_b64() {
+  local encoded="${1:?missing OpenClaw test-state script}"
+  local decoded
+  if ! decoded="$(printf '%s' "$encoded" | base64 -d)"; then
+    echo "Invalid OpenClaw test-state base64 payload" >&2
+    return 1
+  fi
+  if [ -z "${decoded//[[:space:]]/}" ]; then
+    echo "OpenClaw test-state base64 payload decoded to an empty script" >&2
+    return 1
+  fi
+  eval "$decoded"
+}
 openclaw_e2e_resolve_entrypoint() {
   local entry
   for entry in dist/index.mjs dist/index.js; do

test/scripts/openclaw-e2e-instance.test.ts

@@ -0,0 +1,54 @@
+import { execFileSync, spawnSync } from "node:child_process";
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+
+const helperPath = path.resolve("scripts/lib/openclaw-e2e-instance.sh");
+
+function shellQuote(value: string): string {
+  return `'${value.replace(/'/gu, `'\\''`)}'`;
+}
+
+function runHelper(payload: string) {
+  return spawnSync(
+    "bash",
+    [
+      "-lc",
+      [
+        "set -euo pipefail",
+        `source ${shellQuote(helperPath)}`,
+        `openclaw_e2e_eval_test_state_from_b64 ${shellQuote(payload)}`,
+        'printf "value=%s" "${OPENCLAW_E2E_INSTANCE_TEST:-unset}"',
+      ].join("; "),
+    ],
+    { encoding: "utf8" },
+  );
+}
+
+function base64(script: string): string {
+  return execFileSync("base64", { input: script, encoding: "utf8" }).replace(/\s+/gu, "");
+}
+
+describe("scripts/lib/openclaw-e2e-instance.sh", () => {
+  it("sources decoded test-state scripts", () => {
+    const result = runHelper(base64('export OPENCLAW_E2E_INSTANCE_TEST="ok"\n'));
+
+    expect(result.status).toBe(0);
+    expect(result.stdout).toBe("value=ok");
+  });
+
+  it("fails when the test-state payload is not valid base64", () => {
+    const result = runHelper("@@@");
+
+    expect(result.status).not.toBe(0);
+    expect(result.stdout).not.toContain("value=");
+    expect(result.stderr).toContain("Invalid OpenClaw test-state base64 payload");
+  });
+
+  it("fails when the test-state payload decodes to an empty script", () => {
+    const result = runHelper(base64("\n"));
+
+    expect(result.status).not.toBe(0);
+    expect(result.stdout).not.toContain("value=");
+    expect(result.stderr).toContain("decoded to an empty script");
+  });
+});