fix(cli): scope packaged compile cache

scripts/lib/workspace-bootstrap-smoke.mjs

@@ -1,7 +1,7 @@
 import { execFileSync } from "node:child_process";
 import { existsSync, mkdtempSync, mkdirSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 
 export const WORKSPACE_TEMPLATE_PACK_PATHS = [
   "docs/reference/templates/AGENTS.md",
@@ -23,6 +23,47 @@ const REQUIRED_BOOTSTRAP_WORKSPACE_FILES = [
   "BOOTSTRAP.md",
 ];
 
+export const WORKSPACE_BOOTSTRAP_SMOKE_TIMEOUT_MS = 15_000;
+const SAFE_UNIX_SMOKE_PATH = "/usr/bin:/bin";
+
+export function createWorkspaceBootstrapSmokeEnv(env, homeDir, overrides = {}) {
+  const allowlistedEnvEntries = [
+    "TMPDIR",
+    "TMP",
+    "TEMP",
+    "SystemRoot",
+    "ComSpec",
+    "PATHEXT",
+    "WINDIR",
+  ];
+  const windowsRoot = env.SystemRoot ?? env.WINDIR ?? "C:\\Windows";
+  const nodeBinDir = dirname(process.execPath);
+  const safePath =
+    process.platform === "win32"
+      ? `${nodeBinDir};${windowsRoot}\\System32;${windowsRoot}`
+      : `${nodeBinDir}:${SAFE_UNIX_SMOKE_PATH}`;
+
+  return {
+    ...Object.fromEntries(
+      allowlistedEnvEntries.flatMap((key) => {
+        const value = env[key];
+        return typeof value === "string" && value.length > 0 ? [[key, value]] : [];
+      }),
+    ),
+    PATH: safePath,
+    HOME: homeDir,
+    USERPROFILE: homeDir,
+    OPENCLAW_HOME: homeDir,
+    OPENCLAW_NO_ONBOARD: "1",
+    OPENCLAW_SUPPRESS_NOTES: "1",
+    OPENCLAW_DISABLE_BUNDLED_ENTRY_SOURCE_FALLBACK: "1",
+    AWS_EC2_METADATA_DISABLED: "true",
+    AWS_SHARED_CREDENTIALS_FILE: join(homeDir, ".aws", "credentials"),
+    AWS_CONFIG_FILE: join(homeDir, ".aws", "config"),
+    ...overrides,
+  };
+}
+
 function collectMissingBootstrapWorkspaceFiles(workspaceDir) {
   return REQUIRED_BOOTSTRAP_WORKSPACE_FILES.filter(
     (filename) => !existsSync(join(workspaceDir, filename)),
@@ -77,12 +118,8 @@ export function runInstalledWorkspaceBootstrapSmoke(params) {
           encoding: "utf8",
           maxBuffer: 1024 * 1024 * 16,
           stdio: ["ignore", "pipe", "pipe"],
-          env: {
-            ...process.env,
-            HOME: homeDir,
-            OPENCLAW_HOME: homeDir,
-            OPENCLAW_SUPPRESS_NOTES: "1",
-          },
+          timeout: WORKSPACE_BOOTSTRAP_SMOKE_TIMEOUT_MS,
+          env: createWorkspaceBootstrapSmokeEnv(process.env, homeDir),
         },
       );
     } catch (error) {