test: cover path-utils resolve/join/slug branches

[KrasimirKralev]

What Problem This Solves

src/path-utils.js exports six shared path helpers. Existing workspace-plan and profile-diff consumer tests already execute the module, but there is no dedicated test/path-utils.test.js on main. These tests add direct branch coverage for labeled required-path errors, relative/absolute paths, separator normalization, falsy path segments, repeated slashes, and artifact slug trimming.

Why This Change Was Made

Coverage-only: one new file, test/path-utils.test.js (+64/-0), with nine tests against the real exported helpers and no stubs or production changes. The assertions protect existing path and artifact contracts without adding configuration, dependencies, report fields, or runtime behavior.

Original contribution by @KrasimirKralev. The contributor's branch and exact head 8e79692ee54c6023c99633c72a380020f22db926 remain unchanged.

User Impact

No user-visible or runtime change. Maintainers gain focused regression checks for existing path-helper behavior. No changelog, release, downstream pin update, or external runtime integration is needed for this tests-only diff.

Evidence

Fresh Maintainer Verification

• September 9, 2026: secretless Node22 CI run 34366915512 passed on the unchanged contributor head merged with current main 84ede904fd6e766a9fc4de002f39af87d90c1916.
• All 259 tests passed, including the nine direct path-helper tests; package contents validation passed.
• The job reported Secret source: None and read-only Contents/Metadata token permissions. No fork code was executed locally.
• src/path-utils.js is byte-identical at the PR base, contributor head, and current main. The merge preview adds only the original 64 test lines.
• Fresh independent P2 review found no actionable defects; git diff --check passed.
• Maintainer decision: focused contract tests plus fresh Node22 CI are proportional proof for this strictly test-only change under current policy. ClawSweeper reported no code findings; its requested maintainer decision on test-only proof is resolved. No live API/runtime claim or waiver of enforced GitHub checks/reviews is involved.

The original August 3 CI run could no longer be rerun because it was over a month old. Closing and reopening this same PR triggered the fresh run without editing the contributor branch.

Original Contributor Evidence

The contributor reported Linux/Node22.22 validation at PR base 392cc7c8d6419965bb351584aaa47a50abd2ebce: nine focused tests passed, and the then-current full suite increased from 234 to 243 passing tests. These are historical counts, not the fresh current-main totals above.

The contributor also reported mutation controls, restored byte-identically afterward:

Mutation to path-utils.js	Reported Result
Remove the required-path throw	1 failure
Remove posixJoin falsy filtering	1 failure
Remove posixJoin slash collapsing	1 failure
Remove artifact-slug dash trimming	2 failures
Remove backslash normalization	2 failures
Restored control	9 passing tests

The mutation controls are contributor-reported historical evidence, not local maintainer execution.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed September 8, 2026, 7:00 AM ET / 11:00 UTC.

ClawSweeper review

What this changes

Adds nine tests for path resolution, required-path errors, separator normalization, path joining, and artifact-name formatting.

Merge readiness

⛔ Blocked before merge - 3 items remain

The focused coverage remains useful and is not present on current main. No actionable patch defect was found; the previously identified test-only proof exception remains unresolved.

Priority: P3
Reviewed head: 8e79692ee54c6023c99633c72a380020f22db926
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The patch is focused and sound, but its test-only evidence leaves the explicit proof gate unresolved.
Proof confidence	🦪 silver shellfish (2/6)	Needs real behavior proof before merge: Only test/path-utils.test.js changes; the captured Linux/Node 22.22 transcript exercises unchanged src/path-utils.js through isolated tests and mutation controls. This is useful supplemental evidence but does not satisfy the external-PR runtime-proof gate; an authorized test-only override is recommended. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs real behavior proof before merge: Only test/path-utils.test.js changes; the captured Linux/Node 22.22 transcript exercises unchanged src/path-utils.js through isolated tests and mutation controls. This is useful supplemental evidence but does not satisfy the external-PR runtime-proof gate; an authorized test-only override is recommended. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	6 items	Repository policy: Read the complete root AGENTS.md at the checkout and current main; no applicable nested instructions or maintainer notes were found. This test-only addition preserves offline checks and does not trigger the behavior, entrypoint, or release changes requiring Crabpot follow-through. Verified introduced change: The pinned merge-base-to-head diff adds only 64 test lines. All nine cases were read and checked against the real helper implementation; no production code, dependencies, workflows, package exports, or stored formats change. Current implementation and necessity: Current main retains the same six helper implementations and has no test/path-utils.test.js. Existing workspace-plan and profile-diff tests exercise consumers, so the body overstates the absence of any execution, but focused branch assertions still add distinct coverage.
Findings	None	None.
Security	None	None.

How this fits together

Plugin Inspector checks OpenClaw plugin compatibility and produces reports and execution plans. Its shared path helpers turn configured paths and entrypoint names into consistent report locations and artifact identifiers.

flowchart LR
  A[Configured paths] --> C[Shared path helpers]
  B[Entrypoint names] --> C
  C --> D[Report locations]
  C --> E[Execution plan artifacts]
  F[Nine regression tests] --> C

Loading

Decision needed

Question	Recommendation
Should the reported direct-helper tests and mutation controls receive a proof override for this strictly test-only PR?	Approve a test-only proof override: Accept the focused tests and mutation controls as adequate validation for this change, which alters no runtime behavior.

Why: The external-PR proof rule exempts docs-only changes but not test-only changes; the reviewer cannot grant that exception.

Before merge

• Add real behavior proof - Needs real behavior proof before merge: Only test/path-utils.test.js changes; the captured Linux/Node 22.22 transcript exercises unchanged src/path-utils.js through isolated tests and mutation controls. This is useful supplemental evidence but does not satisfy the external-PR runtime-proof gate; an authorized test-only override is recommended. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Complete next step (P2) - Have an authorized maintainer decide the test-only proof override, or supply qualifying consumer evidence before merge.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Coverage scope	Production +0; tests +64; nine tests	The addition protects six existing helpers without growing runtime code.

Technical review

Best possible solution:

Retain the focused contract tests and resolve their proof gate through an explicit authorized test-only exception.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR adds coverage for existing behavior rather than reporting a runtime defect; the contributor supplies passing tests and mutation controls.

Is this the best way to solve the issue?

Yes: direct assertions against the existing helpers are a narrow, maintainable way to protect their contracts, without another implementation or dependency.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 92db8c57e1d5.

Labels

Label justifications:

• P3: This is low-risk regression coverage with no reported current runtime failure.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: Only test/path-utils.test.js changes; the captured Linux/Node 22.22 transcript exercises unchanged src/path-utils.js through isolated tests and mutation controls. This is useful supplemental evidence but does not satisfy the external-PR runtime-proof gate; an authorized test-only override is recommended. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• Repository policy: Read the complete root AGENTS.md at the checkout and current main; no applicable nested instructions or maintainer notes were found. This test-only addition preserves offline checks and does not trigger the behavior, entrypoint, or release changes requiring Crabpot follow-through. (AGENTS.md:1, 8e79692ee54c)
• Verified introduced change: The pinned merge-base-to-head diff adds only 64 test lines. All nine cases were read and checked against the real helper implementation; no production code, dependencies, workflows, package exports, or stored formats change. (test/path-utils.test.js:1, 8e79692ee54c)
• Current implementation and necessity: Current main retains the same six helper implementations and has no test/path-utils.test.js. Existing workspace-plan and profile-diff tests exercise consumers, so the body overstates the absence of any execution, but focused branch assertions still add distinct coverage. (src/path-utils.js:3, 92db8c57e1d5)
• Release and related-work check: GitHub reports v0.3.24 as the latest release; supplied repository state identifies its commit as current main. A repository issue/PR search for path-utils returned only this PR, providing no merged replacement for the requested coverage. (92db8c57e1d5)
• Helper history and routing: GitHub's path history identifies vincentkoc on both helper-sharing refactors. The inspected commit patch adds the normalization, joining, and slug helpers. Local history traversal encountered unavailable objects; GitHub commit metadata and the exact patch supplied the missing history evidence. (src/path-utils.js:23, e316baef6b42)
• Captured validation and review continuity: The complete supplied body at sourceRevision b7b161c1383b549d4066b55f94831f5775c3cfe84cbae764680e789de73f30d1 reports Linux/Node 22.22 results: nine focused tests pass, the full suite grows from 234 to 243 passing tests, and five mutations produce failures before a restored passing control. These are isolated test results, not consumer runtime proof. The previous completed review assessed the same head, found no defects, and recommended an authorized test-only proof exception; no subsequent qualifying proof or override is supplied. (test/path-utils.test.js:13, 8e79692ee54c)

Likely related people:

• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Obtain an authorized test-only proof override; an unrelated application smoke would not resolve this gate.
• If supplying qualifying consumer evidence instead, terminal output, recordings, or logs are acceptable; redact private details. Update the PR body to trigger re-review, or ask a maintainer to comment @clawsweeper re-review.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (91 earlier review cycles; latest 8 shown)

• reviewed 2026-08-25T10:01:44.118Z sha 8e79692 :: needs maintainer review before merge. :: none
• reviewed 2026-08-26T06:01:02.427Z sha 8e79692 :: needs maintainer review before merge. :: none
• reviewed 2026-08-26T22:43:53.185Z sha 8e79692 :: needs maintainer review before merge. :: none
• reviewed 2026-08-28T08:51:13.630Z sha 8e79692 :: needs real behavior proof before merge. :: none
• reviewed 2026-08-29T02:01:41.422Z sha 8e79692 :: needs maintainer review before merge. :: none
• reviewed 2026-08-29T07:55:29.264Z sha 8e79692 :: needs maintainer review before merge. :: none
• reviewed 2026-08-29T12:45:14.728Z sha 8e79692 :: needs maintainer review before merge. :: none
• reviewed 2026-09-05T00:01:03.031Z sha 8e79692 :: needs real behavior proof before merge. :: none

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.