From 130464e797315c8f4788bceb2812e0195dbd80dd Mon Sep 17 00:00:00 2001
From: Vincent Koc <vincentkoc@ieee.org>
Date: Wed, 27 May 2026 00:53:50 +0200
Subject: [PATCH] fix(docker): bound telegram npm installs

---
 scripts/e2e/npm-telegram-live-docker.sh | 34 +++++++++++++++++--------
 scripts/e2e/npm-telegram-rtt-docker.sh  | 34 +++++++++++++++++--------
 test/scripts/npm-telegram-live.test.ts  | 12 ++++++---
 test/scripts/rtt-harness.test.ts        | 12 ++++++---
 4 files changed, 64 insertions(+), 28 deletions(-)

diff --git a/scripts/e2e/npm-telegram-live-docker.sh b/scripts/e2e/npm-telegram-live-docker.sh
index 0836860d8a8..cf4cc996607 100755
--- a/scripts/e2e/npm-telegram-live-docker.sh
+++ b/scripts/e2e/npm-telegram-live-docker.sh
@@ -240,18 +240,30 @@ package_label="${OPENCLAW_NPM_TELEGRAM_PACKAGE_LABEL:-$install_source}"
 echo "Installing ${package_label} from ${install_source}..."
 
 npm_install_timeout="${OPENCLAW_E2E_NPM_INSTALL_TIMEOUT:-600s}"
-if [ -z "$npm_install_timeout" ] || [ "$npm_install_timeout" = "0" ]; then
-  npm install -g "$install_source" --no-fund --no-audit
-elif command -v timeout >/dev/null 2>&1; then
-  if timeout --kill-after=1s 1s true >/dev/null 2>&1; then
-    timeout --kill-after=30s "$npm_install_timeout" npm install -g "$install_source" --no-fund --no-audit
-  else
-    timeout "$npm_install_timeout" npm install -g "$install_source" --no-fund --no-audit
+run_npm_install() {
+  if [ -z "$npm_install_timeout" ] || [ "$npm_install_timeout" = "0" ]; then
+    npm install -g "$install_source" --no-fund --no-audit
+    return
   fi
-else
-  echo "timeout command not found; running package install without OPENCLAW_E2E_NPM_INSTALL_TIMEOUT" >&2
-  npm install -g "$install_source" --no-fund --no-audit
-fi
+
+  local timeout_bin=""
+  if command -v timeout >/dev/null 2>&1; then
+    timeout_bin="timeout"
+  elif command -v gtimeout >/dev/null 2>&1; then
+    timeout_bin="gtimeout"
+  fi
+  if [ -z "$timeout_bin" ]; then
+    echo "timeout or gtimeout is required for OPENCLAW_E2E_NPM_INSTALL_TIMEOUT=$npm_install_timeout" >&2
+    return 127
+  fi
+
+  if "$timeout_bin" --kill-after=1s 1s true >/dev/null 2>&1; then
+    "$timeout_bin" --kill-after=30s "$npm_install_timeout" npm install -g "$install_source" --no-fund --no-audit
+  else
+    "$timeout_bin" "$npm_install_timeout" npm install -g "$install_source" --no-fund --no-audit
+  fi
+}
+run_npm_install
 
 command -v openclaw
 openclaw --version
diff --git a/scripts/e2e/npm-telegram-rtt-docker.sh b/scripts/e2e/npm-telegram-rtt-docker.sh
index 5ed47da2492..9eff9d041ea 100755
--- a/scripts/e2e/npm-telegram-rtt-docker.sh
+++ b/scripts/e2e/npm-telegram-rtt-docker.sh
@@ -264,18 +264,30 @@ install_source="${OPENCLAW_NPM_TELEGRAM_INSTALL_SOURCE:?missing OPENCLAW_NPM_TEL
 package_label="${OPENCLAW_NPM_TELEGRAM_PACKAGE_LABEL:-$install_source}"
 
 npm_install_timeout="${OPENCLAW_E2E_NPM_INSTALL_TIMEOUT:-600s}"
-if [ -z "$npm_install_timeout" ] || [ "$npm_install_timeout" = "0" ]; then
-  npm install -g "$install_source" --no-fund --no-audit
-elif command -v timeout >/dev/null 2>&1; then
-  if timeout --kill-after=1s 1s true >/dev/null 2>&1; then
-    timeout --kill-after=30s "$npm_install_timeout" npm install -g "$install_source" --no-fund --no-audit
-  else
-    timeout "$npm_install_timeout" npm install -g "$install_source" --no-fund --no-audit
+run_npm_install() {
+  if [ -z "$npm_install_timeout" ] || [ "$npm_install_timeout" = "0" ]; then
+    npm install -g "$install_source" --no-fund --no-audit
+    return
   fi
-else
-  echo "timeout command not found; running package install without OPENCLAW_E2E_NPM_INSTALL_TIMEOUT" >&2
-  npm install -g "$install_source" --no-fund --no-audit
-fi
+
+  local timeout_bin=""
+  if command -v timeout >/dev/null 2>&1; then
+    timeout_bin="timeout"
+  elif command -v gtimeout >/dev/null 2>&1; then
+    timeout_bin="gtimeout"
+  fi
+  if [ -z "$timeout_bin" ]; then
+    echo "timeout or gtimeout is required for OPENCLAW_E2E_NPM_INSTALL_TIMEOUT=$npm_install_timeout" >&2
+    return 127
+  fi
+
+  if "$timeout_bin" --kill-after=1s 1s true >/dev/null 2>&1; then
+    "$timeout_bin" --kill-after=30s "$npm_install_timeout" npm install -g "$install_source" --no-fund --no-audit
+  else
+    "$timeout_bin" "$npm_install_timeout" npm install -g "$install_source" --no-fund --no-audit
+  fi
+}
+run_npm_install
 command -v openclaw
 openclaw --version
 node -p "require('/npm-global/lib/node_modules/openclaw/package.json').version"
diff --git a/test/scripts/npm-telegram-live.test.ts b/test/scripts/npm-telegram-live.test.ts
index e03c99d996a..7d4ee731dbf 100644
--- a/test/scripts/npm-telegram-live.test.ts
+++ b/test/scripts/npm-telegram-live.test.ts
@@ -44,13 +44,19 @@ describe("package Telegram live Docker E2E", () => {
       '-e OPENCLAW_E2E_NPM_INSTALL_TIMEOUT="${OPENCLAW_E2E_NPM_INSTALL_TIMEOUT:-600s}"',
     );
     expect(installRun).toContain(
-      'timeout --kill-after=30s "$npm_install_timeout" npm install -g "$install_source" --no-fund --no-audit',
+      '"$timeout_bin" --kill-after=30s "$npm_install_timeout" npm install -g "$install_source" --no-fund --no-audit',
     );
-    expect(installRun).toContain("timeout --kill-after=1s 1s true >/dev/null 2>&1");
+    expect(installRun).toContain('elif command -v gtimeout >/dev/null 2>&1; then');
+    expect(installRun).toContain("timeout_bin=\"gtimeout\"");
     expect(installRun).toContain(
-      'timeout "$npm_install_timeout" npm install -g "$install_source" --no-fund --no-audit',
+      'echo "timeout or gtimeout is required for OPENCLAW_E2E_NPM_INSTALL_TIMEOUT=$npm_install_timeout" >&2',
+    );
+    expect(installRun).toContain('"$timeout_bin" --kill-after=1s 1s true >/dev/null 2>&1');
+    expect(installRun).toContain(
+      '"$timeout_bin" "$npm_install_timeout" npm install -g "$install_source" --no-fund --no-audit',
     );
     expect(installRun).toContain('npm install -g "$install_source" --no-fund --no-audit');
+    expect(installRun).not.toContain("running package install without OPENCLAW_E2E_NPM_INSTALL_TIMEOUT");
     expect(installRun).toContain('"${package_mount_args[@]}"');
     expect(installRun).not.toContain('"${docker_env[@]}"');
     expect(installRun).toContain("run_logged docker_e2e_docker_run_cmd run --rm");
diff --git a/test/scripts/rtt-harness.test.ts b/test/scripts/rtt-harness.test.ts
index 5d0eaeae231..06ce5b90a5e 100644
--- a/test/scripts/rtt-harness.test.ts
+++ b/test/scripts/rtt-harness.test.ts
@@ -147,12 +147,18 @@ describe("RTT harness", () => {
       '-e OPENCLAW_E2E_NPM_INSTALL_TIMEOUT="${OPENCLAW_E2E_NPM_INSTALL_TIMEOUT:-600s}"',
     );
     expect(script).toContain(
-      'timeout --kill-after=30s "$npm_install_timeout" npm install -g "$install_source" --no-fund --no-audit',
+      '"$timeout_bin" --kill-after=30s "$npm_install_timeout" npm install -g "$install_source" --no-fund --no-audit',
     );
-    expect(script).toContain("timeout --kill-after=1s 1s true >/dev/null 2>&1");
+    expect(script).toContain('elif command -v gtimeout >/dev/null 2>&1; then');
+    expect(script).toContain("timeout_bin=\"gtimeout\"");
     expect(script).toContain(
-      'timeout "$npm_install_timeout" npm install -g "$install_source" --no-fund --no-audit',
+      'echo "timeout or gtimeout is required for OPENCLAW_E2E_NPM_INSTALL_TIMEOUT=$npm_install_timeout" >&2',
     );
+    expect(script).toContain('"$timeout_bin" --kill-after=1s 1s true >/dev/null 2>&1');
+    expect(script).toContain(
+      '"$timeout_bin" "$npm_install_timeout" npm install -g "$install_source" --no-fund --no-audit',
+    );
+    expect(script).not.toContain("running package install without OPENCLAW_E2E_NPM_INSTALL_TIMEOUT");
     expect(script).toContain("run_logged docker_e2e_docker_run_cmd run --rm");
     expect(script).not.toContain("run_logged docker run --rm");
     expect(heartbeatStartIndex).toBeGreaterThan(sourceIndex);