Greptile Summary

This PR fixes an O(N²) performance bottleneck in mapSensitivePaths by replacing per-call { ...hints } shallow copies with a single in-place mutation pass. The public API signature and return semantics are preserved; a new private mapSensitivePathsMut helper carries the recursive logic.\n\n- Correctness: The refactored logic is functionally identical to the original — both accumulate sensitive-path entries into the same hints object. All 5 existing tests pass without modification.\n- Call-site audit: The only production call site (schema-base.ts:76) passes a freshly constructed buildBaseHints() result, so the new mutation semantic has no observable side-effect on callers.\n- Behavioral change worth noting: mapSensitivePaths now mutates its hints argument in-place (in addition to returning it). Since the function is exported, a JSDoc note would help future callers avoid surprises — flagged as a non-blocking P2 suggestion.\n- Performance impact: O(N) single-pass traversal vs. the previous O(N²) allocation loop; the PR description reports ~30 s → negligible for the full OpenClawSchema tree.

Confidence Score: 5/5

Safe to merge — minimal, well-scoped refactor with no behavioral regressions and full test coverage.

The change is a clean algorithmic optimisation with a single modified file. Logic equivalence is verified by the existing test suite; the only production call site passes a fresh object so mutation semantics are harmless. The sole open item is a non-blocking documentation suggestion.

No files require special attention.

This is a comment left during a code review.
Path: src/config/schema.hints.ts
Line: 191-201

Comment:
**Document mutation side-effect on the public function**

The public `mapSensitivePaths` now mutates its `hints` argument in-place, which is a semantic change from the original (which returned a fresh object). All current call sites pass a freshly created `{}` or `buildBaseHints()`, so there's no regression here, but since the function is exported, adding a brief JSDoc note would prevent future callers from being surprised:

```suggestion
/**
 * Traverses the Zod schema tree and marks every sensitive path in `hints`.
 *
 * Note: `hints` is mutated in-place for performance (avoids O(N²) copies).
 * The same object is also returned for call-site convenience.
 */
export function mapSensitivePaths(
  schema: z.ZodType,
  path: string,
  hints: ConfigUiHints,
): ConfigUiHints {
  // Mutate `hints` in-place to avoid O(N²) shallow-copy overhead.
  // Previous impl did `{ ...hints }` on every recursive call which caused
  // ~30 s blocking for the full OpenClawSchema tree.
  mapSensitivePathsMut(schema, path, hints);
  return hints;
}
```

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "fix: avoid O(N²) shallow-copy in mapSens..." | Re-trigger Greptile}

Gentle ping 🙏

CI is all green, and the Greptile P2 feedback (JSDoc note on in-place mutation) has been addressed in the latest commit.
This PR is a single-file performance optimization: refactors mapSensitivePaths from O(N²) shallow copies to O(N) in-place mutation, improving performance (~30s → negligible) with identical logic (all 5 existing tests pass).
Happy to rebase, squash, or adjust if needed — thanks for reviewing!

Just following up on this PR in case it fell through the cracks 🙏

The branch is in good shape: CI is green, the prior review feedback has been addressed, and there shouldn’t be any remaining action items on my side.

It’s still a small, single-file performance optimization with unchanged behavior. Happy to rebase, squash, or make any further adjustments if needed. Thanks again for reviewing when you have time.

ClawSweeper review: did not complete due to Codex infrastructure failure. Reviewed June 23, 2026, 11:49 PM ET / 03:49 UTC.

Summary
Review failed before ClawSweeper could summarize the requested change.

PR surface: Source +11. Total +11 across 1 file.

Reproducibility: unclear. The review failed before ClawSweeper could establish a reproduction path.

Review metrics: none identified.

Stored data model
Persistent data-model change detected: unknown-data-model-change: src/config/schema.hints.ts. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Not assessed.
Failure reason: timeout.

This is a ClawSweeper/Codex infrastructure failure, not a PR readiness or patch-quality verdict.
Keep any merge decision on the normal maintainer review path until ClawSweeper can complete a fresh review.

Risk before merge

• [P1] No close action taken because the review did not complete.

Maintainer options:

1. Decide the mitigation before merge
   Retry the Codex review after fixing the execution failure.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

• Review did not complete, so no work-lane recommendation was made.

ClawSweeper PR egg

🎁 Pass real behavior proof to wake the egg and unlock a hatchable treat.

This pull request has been automatically marked as stale due to inactivity.
Please add updates or it will be closed.

Dependency graph guard cleared

This PR no longer has blocked dependency graph changes. A future dependency graph change requires a fresh /allow-dependencies-change comment after the guard blocks that new head SHA.

• Current SHA: abf91adf242990eaa544d5d6efa61206dbc4a8d9

Maintainer closeout proof for abf91adf242990eaa544d5d6efa61206dbc4a8d9:

• Fixed the accumulator shape so mapSensitivePaths avoids repeated recursive shallow copies while still returning a new hints map instead of mutating caller-owned input.
• Added regression coverage for the no-mutation public contract in src/config/schema.hints.test.ts.
• Local focused proof: ./node_modules/.bin/oxfmt --check src/config/schema.hints.ts src/config/schema.hints.test.ts, git diff --check, and a direct tsx contract smoke for non-mutating output.
• Crabbox proof: Azure direct Crabbox cbx_fd11288428d7, run run_627efbec345c, passed corepack pnpm test:serial src/config/schema.hints.test.ts and corepack pnpm check:changed; lease stopped.
• Autoreview: .agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main returned no accepted/actionable findings.
• Hosted exact-head gates are green; OPENCLAW_TESTBOX=1 scripts/pr prepare-run 55018 passed.

Ready to merge.

Merged via squash.

• Prepared head SHA: abf91adf242990eaa544d5d6efa61206dbc4a8d9
• Landed commit: 89b2db77d4d5dbb4645ef7e6f8d3b6f906ff3d81