test(report-sanitizer): cover sanitizeReportArtifact path-redaction branches

[KrasimirKralev]

What Problem This Solves

src/report-sanitizer.js exports sanitizeReportArtifact(report, options) — the redaction gate that strips absolute OpenClaw target paths out of every emitted report artifact (JSON via --sanitize, Markdown, issues, compatibility reports; re-exported through src/index.js:238, src/report.js:308, src/advanced.js, and src/cli.js). It shipped with no direct test. The only existing coverage exercises it indirectly through the report-writing happy path (report.test.js:267, cli.test.js:90), which always uses a single absolute path and the default placeholder — so the module's more subtle, security-relevant branches were unpinned:

• Longest-path-first ordering. sensitiveOpenClawPaths sorts matches by descending length before substring replacement. This is what stops a shorter path (e.g. /home/user/openclaw) from partially matching inside a longer one (/home/user/openclaw/extensions/telegram) and leaving the trailing /extensions/telegram exposed in the output. With only single-path coverage, reversing this sort would leak path suffixes and no test would catch it.
• No-op passthrough. When no absolute path is present the original report is returned by reference, unchanged — untested.
• Custom openclawPathPlaceholder option — untested (existing coverage only hits the default <OPENCLAW_PATH>).
• Windows drive-letter + UNC absolute-path detection (isAbsolutePath's C:\… regex and \\server\share prefix) — untested; on POSIX path.isAbsolute returns false for these, so this branch is the only thing that redacts a Windows target path.
• Non-string / relative searchedPaths filtering — relative or non-string entries must pass through unredacted; untested.

A regression in any of these would silently weaken path redaction (a leak) or change the passthrough contract, and would ship green.

Why This Change Was Made

Coverage-only. Adds one new file, test/report-sanitizer.test.js (+91), pinning the module's current main behavior against these branches. Tests import the real exported sanitizeReportArtifact from ../src/report-sanitizer.js (matching the repo's per-module unit-test layout, e.g. json-file.test.js) and drive it directly — no stubs. No production code is touched; no new config, defaults, dependencies, or report field names (per AGENTS.md's "preserve stable report field names").

User Impact

No user-visible or runtime change. For maintainers, the path-redaction gate now regresses loudly: a future edit that reverses the longest-first ordering (a path-suffix leak), drops the Windows/UNC detection, breaks the placeholder option, or changes the no-op passthrough will fail this suite instead of shipping silently.

Evidence

Linux, Node 22.22, branched off current main (2f93500), no install needed (the suite runs the source directly via node --test).

6/6 pass on clean main:

$ node --test test/report-sanitizer.test.js
# tests 6
# pass 6
# fail 0

Full suite green with the new file — no regressions:

$ node --test test/*.test.js
# tests 212
# pass 212
# fail 0

Non-vacuous — each scenario bites when its target branch is mutated (mutation applied to src/report-sanitizer.js, suite re-run, then reverted):

Mutation to report-sanitizer.js	Result
sort ascending (left.length - right.length) — reverses longest-first	1 fail (nested-path leak)
remove the sensitivePaths.length === 0 early return	1 fail (passthrough identity)
force default placeholder (ignore options.openclawPathPlaceholder)	1 fail (custom placeholder)
drop Windows/UNC detection (return path.isAbsolute(value) only)	1 fail (drive/UNC)
(reverted — control)	6 pass

Diff: +91, one new test file, no production code.

AI-assisted contribution.

---

Generated by Claude Code

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 19, 2026, 4:26 AM ET / 08:26 UTC.

Summary
The branch adds test/report-sanitizer.test.js with six direct tests for existing sanitizeReportArtifact path-redaction behavior, including nested paths, passthrough identity, custom placeholders, Windows/UNC paths, and searched-path filtering.

Reproducibility: not applicable. This PR adds regression coverage for an existing sanitizer contract rather than reporting a user-facing failure to reproduce.

Review metrics: 2 noteworthy metrics.

• Changed surface: 1 test file added; 91 lines added; 0 production files changed. The narrow scope limits merge blast radius while adding regression coverage for existing redaction behavior.
• Reported validation: 6 direct tests; 212 full-suite tests passing. The contributor reports both focused and repository-wide Node test runs on the proposed head.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• none.

Next step before merge

• [P2] No discrete repair is needed; this is a focused draft PR awaiting ordinary maintainer review.

Security
Cleared: The PR adds only unit tests and does not change dependencies, package metadata, workflows, secrets handling, or production execution paths.

Review details

Best possible solution:

Land the focused direct tests after a maintainer confirms the asserted sanitizer semantics remain the intended public behavior; retain the existing offline, dependency-free test setup.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR adds regression coverage for an existing sanitizer contract rather than reporting a user-facing failure to reproduce.

Is this the best way to solve the issue?

Likely yes: direct tests of the exported sanitizer preserve the existing implementation boundary without adding config, dependencies, or alternate behavior.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against f165eafa2a74.

Label changes

Label changes:

• add P3: This is a low-risk test-coverage improvement with no user-visible runtime behavior change.
• add proof: sufficient: Contributor real behavior proof is sufficient. The PR body provides after-change terminal output for the focused Node test file and the full Node test suite; this is appropriate real behavior proof for a unit-test-only change.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body provides after-change terminal output for the focused Node test file and the full Node test suite; this is appropriate real behavior proof for a unit-test-only change.

Label justifications:

• P3: This is a low-risk test-coverage improvement with no user-visible runtime behavior change.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body provides after-change terminal output for the focused Node test file and the full Node test suite; this is appropriate real behavior proof for a unit-test-only change.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR body provides after-change terminal output for the focused Node test file and the full Node test suite; this is appropriate real behavior proof for a unit-test-only change.

Evidence reviewed

What I checked:

• Focused test-only diff: The PR changes one file, adding 91 lines under test/ and no production, dependency, workflow, package, or stable-report-field changes. (test/report-sanitizer.test.js:1, 0a103e35b2e9)
• Direct behavior coverage: The added tests import the public sanitizeReportArtifact export directly and exercise the documented path-redaction contract rather than stubbing the module. (test/report-sanitizer.test.js:3, 0a103e35b2e9)
• Contributor runtime validation: The PR body reports an actual Node 22 run of the new file with 6 passing tests and the full test/*.test.js suite with 212 passing tests. (test/report-sanitizer.test.js:1, 0a103e35b2e9)
• Repository policy fit: The repository AGENTS.md requires dependency-light, offline, credential-free checks and stable report fields; this PR adds no runtime dependency or report-contract change. (AGENTS.md:1, f165eafa2a74)

Likely related people:

• unknown: The available PR context identifies the proposed test author but provides no current-main sanitizer provenance; the review does not treat the external PR author alone as the feature owner. (role: current-main area owner unresolved; confidence: low; files: src/report-sanitizer.js, test/report-sanitizer.test.js)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.