fix(review): recognize approved Browser redaction fixtures

[scotthuang]

What Problem This Solves

Exact reviews of Browser changes can stop with AgentInputScanError: findings before Codex starts because complete changed files include existing synthetic authentication and credential-redaction fixtures. This affects the source reported in OpenClaw PR 134400. Source hydration was fixed separately in PR 1333; the Browser literals still need classification.

Why This Change Was Made

Approve two exact synthetic URI digests at three existing Browser test paths. The classifier now checks every blob reference against the fixture it already selected by digest. Removing reviewedFixtureForSource eliminates the second lookup and its one-fixture-per-source assumption, so both approved literals in chrome.test.ts work without adding another policy mechanism.

The fixtures were independently read from their immutable public source blobs, their Git hashes recomputed, and their introduction checked against raw commit parents and patches. The local value is dummy authentication for a loopback test server; the remote value is dummy credential-redaction input under browserless.example.com:

• Local Chrome authentication fixture.
• Remote Chrome redaction fixture.
• Remote server-context redaction fixture.

Every reference must still match the same digest, exact path, and Git mode 100644. Complete-scan, detector, literal-line, source-drift, staging, and cleanup checks remain active. These hashes identify the scanner's URI literals, not whole files or arbitrary surrounding URL content. The existing policy is not repository/commit scoped; the links above document provenance.

User Impact

Reviews can inspect the approved Browser fixture changes. Unclassified findings continue to stop admission. OpenClaw Bay, publication, queueing, and mutation authority are unchanged.

Documentation Impact

The README documents the approved sources and exact digest/path/mode membership. Release-note context is in this PR; the changelog is unchanged. The original contributor commit and credit for @scotthuang are preserved.

Evidence

Candidate: 52d62998d9a4a67e7b3c28b35635b1dfebd63435. Production classifier source SHA-256: b7bb49034223716b67bd229fa0d9596a00813ad18ac00eb4a0c11366ffd8d30f; compiled module SHA-256: 9ada61cd1421f8f37a566f07c48960e6de887462966d0187b568408b6b2d9563. The committed source is checked against the bytes exercised below. Against main abfcb0dc084c962d123d49e560a82446bb0988c0, the integration delta is three files, +55/-44; production code is +14/-9.

Build and repair build, targeted source/test lint, formatting, documentation checks, and the 55-case fixture admission matrix passed. The new cases exercise all three approved pairs and reject the local fixture on the remote server-context path. Managed Codex reviews of both the final uncommitted change and committed branch completed scoped-clean at P0 with no findings.

Full current-head CI passed 4,263 tests with 14 skips and zero failures, plus 13 changed-file coverage tests: https://github.com/openclaw/clawsweeper/actions/runs/33494736334. CI checked out 52368029af08f4bf14bf45182ca4739f18f23fc6, merging this candidate with then-main b056c0ab1510b23330f15bd44af7087129f9f270, using Node 24.19.0 and pnpm 11.10.0. CodeQL passed in https://github.com/openclaw/clawsweeper/actions/runs/33494736366. The fresh hosted review accepted the native owner proof and found no correctness or security defects.

The first local scanner-file run passed 88/89 tests. Its existing cache-symlink test supplied the macOS /var alias as the canonical checkout argument, unlike both production callers. A same-function baseline/candidate probe reproduced that mismatch and confirmed both production-shaped calls reject with unsafe_path. The test now supplies realpathSync(f.cwd) while retaining the lexical argument and rejection assertion; its exact case was rerun after correction. No cache runtime code changed.

Real Behavior Proof

The built production scanAgentInput owner used native TruffleHog 3.97.1 on Node 24.20.0/macOS arm64, with a 60-second scan budget. A task-owned two-file Git repository contains the exact public Chrome and server-context test bytes from upstream 72dab3e751988337961c3d80fb41164fded7128a and fafc74649c9afc279e581883805d9b4d5fccc761. All four Git blob IDs were verified; its complete 4,362-byte binary diff contains neither approved URI literal. Commands were node owner-proof.mjs before and node owner-proof.mjs after; the script invokes the real compiled owner on committed source and consumes its normal sanitized notices.

Production path	Observed result	Notices	Elapsed
Current-main-equivalent scanner	Refused findings	None	1,910 ms
Simplified candidate	Admitted	3 fixture/path groups, 6 findings across old/new blobs	3,660 ms
Candidate with tracked Chrome mode 100755	Refused findings	None	7,623 ms

Sanitized result:

before: refused=findings, staging_removed=true, checkout_clean=true
after: admitted=true, fixture_groups=3, findings=6, staging_removed=true, checkout_clean=true
executable-mode: refused=findings, staging_removed=true, checkout_clean=true

The three admitted groups were d69d650dc6c3… at the Chrome path and 60267342b1ab… at the Chrome and server-context paths. Production notices identify only digest, source, detector, blob, line, decoder, and occurrence count. No raw fixture values or verification diagnostics were published.

This proves real native admission over a synthetic two-file range containing exact public source bytes. It is not the complete 13-file upstream PR, a hosted deployment, or a model review. Browser code was never executed or imported. No real credentials, GitHub mutations, or remote lease were needed. The individual durations are observations, not a performance benchmark.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 1, 2026, 5:59 AM ET / 09:59 UTC.

ClawSweeper review

What this changes

Adds two approved synthetic Browser credential-fixture digests at three exact OpenClaw test paths and keeps review admission fail-closed for every other finding.

Merge readiness

⚠️ Ready for maintainer review - 1 item remains

Keep open for maintainer landing review: current main does not contain the Browser fixture entries, while the PR’s exact digest/path/mode checks and native before/after scanner trace support the intended narrow repair. No introduced correctness defect was found.

Priority: P2
Reviewed head: 52d62998d9a4a67e7b3c28b35635b1dfebd63435

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, well-evidenced admission repair with an intentionally security-sensitive but tightly constrained policy change.
Proof confidence	🦞 diamond lobster (5/6)	Sufficient (terminal): The changed production owner is the fixture classifier used by scanAgentInput; the PR body records its real compiled native-TruffleHog entrypoint on Node 24, showing baseline refusal, after-fix admission for the three approved groups, and retained refusal for a mode change. The proof is a task-owned two-file Git scenario rather than a full upstream Browser PR replay, which is sufficient for the exact admission boundary changed here.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (terminal): The changed production owner is the fixture classifier used by scanAgentInput; the PR body records its real compiled native-TruffleHog entrypoint on Node 24, showing baseline refusal, after-fix admission for the three approved groups, and retained refusal for a mode change. The proof is a task-owned two-file Git scenario rather than a full upstream Browser PR replay, which is sufficient for the exact admission boundary changed here.
Evidence reviewed	5 items	Current-main baseline: The fetched main revision has only the existing two fixture entries and the one-fixture-per-source helper, so it does not yet implement this Browser-fixture admission behavior. Exact policy boundary: The PR adds two fixed SHA-256 entries and checks every staged source reference against the digest-selected entry while retaining the regular-file mode requirement. Focused regression coverage: The admission matrix covers the local fixture, both valid remote-path pairs, and rejects the local digest at the server-context path.
Findings	None	None.
Security	None	None.

How this fits together

ClawSweeper scans complete pull-request source with TruffleHog before a model can inspect it. The fixture classifier may recognize reviewed synthetic test values, then emits sanitized notices and permits the review; all other secret-shaped findings still stop admission.

flowchart LR
  A[Pull request source] --> B[Native secret scan]
  B --> C[Fixture classifier]
  C --> D{Exact digest, path, and mode match?}
  D -->|Yes| E[Sanitized admission notice]
  E --> F[Codex review starts]
  D -->|No| G[Review admission refused]

Loading

Before merge

• Resolve merge risk (P1) - This changes a pre-model secret-scan exception; merge only with the documented exact digest, path, and mode boundary intact and after current-head checks complete.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Pinned review range	18 files, +523, -241	The pinned range includes merged base updates as well as the fixture repair, so maintainers should assess the current-head candidate behavior rather than infer ownership from endpoint drift alone.
Fixture scope	2 digests across 3 approved paths	This is the complete new admission surface and is intentionally narrower than a source- or domain-based allowlist.

Merge-risk options

Maintainer options:

1. Keep the exact reviewed exception (recommended)
   Accept the narrowly scoped synthetic-fixture exception after current-head checks confirm the documented digest/path/mode behavior.
2. Pause the exception
   Hold the PR if maintainers no longer want these external Browser fixture values exempted from review admission.

Technical review

Best possible solution:

Land the narrowly scoped fixture classification while preserving fail-closed admission for any unapproved digest, path, mode, detector result, or scan state.

Do we have a high-confidence way to reproduce the issue?

Yes: the current PR body records a production-owner before/after run in which the baseline refused the Browser fixtures and the candidate admitted only the approved pairs while rejecting executable mode.

Is this the best way to solve the issue?

Yes: fixed digest, exact source path, regular-file mode, literal-line, and scanner-contract checks are the narrowest maintainable way to classify known synthetic fixtures without weakening general secret detection.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against b056c0ab1510.

Labels

Label justifications:

• P2: This is a bounded review-admission bug fix with limited operational blast radius.
• merge-risk: 🚨 security-boundary: The PR changes which credential-shaped scan findings may pass the pre-model admission gate.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The changed production owner is the fixture classifier used by scanAgentInput; the PR body records its real compiled native-TruffleHog entrypoint on Node 24, showing baseline refusal, after-fix admission for the three approved groups, and retained refusal for a mode change. The proof is a task-owned two-file Git scenario rather than a full upstream Browser PR replay, which is sufficient for the exact admission boundary changed here.
• proof: sufficient: Contributor real behavior proof is sufficient. The changed production owner is the fixture classifier used by scanAgentInput; the PR body records its real compiled native-TruffleHog entrypoint on Node 24, showing baseline refusal, after-fix admission for the three approved groups, and retained refusal for a mode change. The proof is a task-owned two-file Git scenario rather than a full upstream Browser PR replay, which is sufficient for the exact admission boundary changed here.

Evidence

What I checked:

• Current-main baseline: The fetched main revision has only the existing two fixture entries and the one-fixture-per-source helper, so it does not yet implement this Browser-fixture admission behavior. (src/agent-input-scan-fixtures.ts:5, b056c0ab1510)
• Exact policy boundary: The PR adds two fixed SHA-256 entries and checks every staged source reference against the digest-selected entry while retaining the regular-file mode requirement. (src/agent-input-scan-fixtures.ts:20, 52d62998d9a4)
• Focused regression coverage: The admission matrix covers the local fixture, both valid remote-path pairs, and rejects the local digest at the server-context path. (test/agent-input-scan.test.ts:545, 52d62998d9a4)
• Current-head behavior proof: The captured PR body records a real compiled scanAgentInput run with native TruffleHog: the baseline refused findings, the candidate admitted the three approved fixture/path groups, and an executable-mode variant still refused. (52d62998d9a4)
• Feature history: The current head is a merge commit authored by Peter Steinberger that brings in the contributor’s fixture classification commit and describes the exact one-lookup, exact-pair behavior. (src/agent-input-scan-fixtures.ts:20, 52d62998d9a4)

Likely related people:

• Peter Steinberger: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-09-01T07:38:31.176Z sha d8b238f :: needs maintainer review before merge. :: none