Skip to content

test(qa): cover Crabline Zalo transport#99303

Merged
RomneyDa merged 1 commit into
mainfrom
test/crabline-zalo-coverage
Jul 3, 2026
Merged

test(qa): cover Crabline Zalo transport#99303
RomneyDa merged 1 commit into
mainfrom
test/crabline-zalo-coverage

Conversation

@RomneyDa

@RomneyDa RomneyDa commented Jul 3, 2026

Copy link
Copy Markdown
Member

Summary

  • upgrade QA Lab to @openclaw/[email protected]
  • move the exact minimum-release-age exception from 0.1.7 to 0.1.8
  • verify Zalo gateway config, trusted runtime environment, native target mapping, and admin inbound delivery
  • send through Crabline's Zalo-compatible sendMessage endpoint and assert recorder-backed QA outbound normalization

No additional QA runtime or Zalo channel wiring is required: the existing generic Crabline transport consumes the released Zalo bridge.

Stack

Tests

  • pnpm install --frozen-lockfile
  • node scripts/run-vitest.mjs extensions/qa-lab/src/crabline-transport.test.ts (14 tests passed)
  • pnpm format:check extensions/qa-lab/src/crabline-transport.test.ts extensions/qa-lab/package.json pnpm-workspace.yaml
  • git diff --check
  • .agents/skills/autoreview/scripts/autoreview --mode local --stream-engine-output (clean, no actionable findings)

@RomneyDa
RomneyDa requested a review from a team as a code owner July 3, 2026 01:43
@github-actions github-actions Bot added the dependencies-changed PR changes dependency-related files label Jul 3, 2026
@github-actions

github-actions Bot commented Jul 3, 2026

Copy link
Copy Markdown
Contributor

Dependency Guard

This PR changes dependency-related files. Maintainers should confirm these changes are intentional.

Changed files:

  • extensions/qa-lab/package.json
  • pnpm-lock.yaml
  • pnpm-workspace.yaml

Maintainer follow-up:

  • Review whether the dependency changes are intentional.
  • Inspect resolved package deltas when lockfile, shrinkwrap, or workspace dependency policy changes are present.
  • Treat package-lock.json and npm-shrinkwrap.json diffs as security-review surfaces.
  • Run pnpm deps:changes:report -- --base-ref origin/main --markdown /tmp/dependency-changes.md --json /tmp/dependency-changes.json locally for detailed release-style evidence.

@github-actions

github-actions Bot commented Jul 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Dependency graph changes are blocked

OpenClaw does not accept dependency graph changes through PRs unless a repository admin or security explicitly authorizes the current head SHA. Dependency updates are generated internally by maintainers so external PRs cannot change the resolved graph.

Detected dependency graph changes:

  • pnpm-lock.yaml changed.
  • extensions/qa-lab/package.json changed devDependencies.

Auto-scrub was not attempted because this PR changes package manifest dependency graph fields:

  • extensions/qa-lab/package.json changed devDependencies.

Dependency graph changes must be reviewed by security or handled by maintainers internally. Please remove lockfile changes manually if they are not needed.

To remove lockfile changes, restore them from the target branch:

git fetch origin
git checkout 'origin/main' -- 'pnpm-lock.yaml'
git commit -m 'chore: remove dependency lockfile change'
git push

If this PR intentionally needs a dependency graph change, ask a repository admin or member of @openclaw/openclaw-secops to comment:

/allow-dependencies-change

The action will approve the current head SHA (81b14d3546eca49a4de761165d06233a6747c80f) when it reruns. A later push requires a fresh approval.

Base automatically changed from feat/zalo-api-root to main July 3, 2026 01:44
@openclaw-barnacle openclaw-barnacle Bot added channel: zalo Channel integration: zalo size: M and removed size: S labels Jul 3, 2026
@RomneyDa
RomneyDa force-pushed the test/crabline-zalo-coverage branch from 775895c to eabac26 Compare July 3, 2026 01:46
@openclaw-barnacle openclaw-barnacle Bot added size: S and removed channel: zalo Channel integration: zalo size: M labels Jul 3, 2026
@clawsweeper

clawsweeper Bot commented Jul 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed July 2, 2026, 10:07 PM ET / 02:07 UTC.

Summary
The PR bumps QA Lab from @openclaw/[email protected] to 0.1.8, moves the release-age exception, updates the lockfile, and adds Zalo coverage to the existing Crabline transport test.

PR surface: Tests +79, Config 0, Other 0. Total +79 across 4 files.

Reproducibility: not applicable. this is a test coverage and dependency update PR, not a bug report. Source and package inspection show current main uses Crabline 0.1.7, while 0.1.8 is the inspected package version with the Zalo server and bridge path the new test covers.

Review metrics: 1 noteworthy metric.

  • Dependency graph surfaces: 1 devDependency bump, 1 lockfile package update, 1 release-age exception moved. These are the maintainer-visible security approval surfaces that ordinary test success does not settle.

Stored data model
Persistent data-model change detected: serialized state: extensions/qa-lab/src/crabline-transport.test.ts. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • Get admin/secops authorization for the current dependency graph change.

Risk before merge

  • [P1] The resolved dependency graph and minimum-release-age exception change remain security-sensitive and blocked until an authorized admin/secops reviewer approves the current head SHA.
  • [P1] A few live checks were still pending when inspected, so final merge should wait for the normal required-check gate after dependency approval.

Maintainer options:

  1. Approve the dependency bump after secops review (recommended)
    Have an authorized admin or secops reviewer approve the current head after checking the Crabline 0.1.8 package provenance, lockfile integrity, and release-age exception.
  2. Move the bump to a maintainer-owned update
    If secops does not want this PR to carry a dependency graph update, land the Crabline bump through the internal dependency path and rebase the test coverage on top.
  3. Pause if Zalo QA coverage is not needed now
    If maintainers do not want to authorize this fresh Crabline release yet, keep the PR paused rather than merging a blocked dependency graph change.

Next step before merge

  • [P2] The remaining action is human dependency/security approval for a maintainer-labeled PR, not an automated code repair.

Security
Needs attention: No malicious or inconsistent package delta was found, but the dependency graph change remains security-sensitive and blocked until authorized.

Review details

Best possible solution:

Keep the focused QA Lab Zalo coverage and Crabline 0.1.8 bump, then merge only after secops/admin dependency approval and required checks are settled.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a test coverage and dependency update PR, not a bug report. Source and package inspection show current main uses Crabline 0.1.7, while 0.1.8 is the inspected package version with the Zalo server and bridge path the new test covers.

Is this the best way to solve the issue?

Yes, conditionally: adding the focused case to the existing Crabline transport test is the narrowest code shape because the QA Lab adapter already delegates channel-specific behavior to Crabline. The better merge path question is process-related: secops/admin must approve the dependency graph update first.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 3ad465d32b3b.

Label changes

Label changes:

  • add P2: This is normal-priority QA coverage and dependency maintenance for one channel transport path, with limited product blast radius but real maintainer approval requirements.
  • add merge-risk: 🚨 security-boundary: Merging changes a resolved dependency and release-age exception for code that runs local provider servers during QA.
  • add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
  • remove rating: 🦐 gold shrimp: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.

Label justifications:

  • P2: This is normal-priority QA coverage and dependency maintenance for one channel transport path, with limited product blast radius but real maintainer approval requirements.
  • merge-risk: 🚨 security-boundary: Merging changes a resolved dependency and release-age exception for code that runs local provider servers during QA.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The PR is maintainer-labeled/member-authored, so the external contributor real-behavior proof gate does not apply; the PR body includes local test and format evidence.
Evidence reviewed

PR surface:

Tests +79, Config 0, Other 0. Total +79 across 4 files.

View PR surface stats
Area Files Added Removed Net
Source 0 0 0 0
Tests 1 79 0 +79
Docs 0 0 0 0
Config 2 2 2 0
Generated 0 0 0 0
Other 1 5 5 0
Total 4 86 7 +79

Security concerns:

  • [medium] Authorize the dependency graph update — extensions/qa-lab/package.json:19
    The PR changes extensions/qa-lab/package.json, pnpm-lock.yaml, and the minimum-release-age exception for @openclaw/[email protected]; the repository guard requires current-head admin/secops authorization before merge.
    Confidence: 0.93

Acceptance criteria:

  • [P1] node scripts/run-vitest.mjs extensions/qa-lab/src/crabline-transport.test.ts.
  • [P1] pnpm format:check extensions/qa-lab/src/crabline-transport.test.ts extensions/qa-lab/package.json pnpm-workspace.yaml.
  • [P1] git diff --check.
  • [P1] dependency-guard approval and required CI on the current head.

What I checked:

  • Repository policy read: Root review policy was fully read and applies because this PR touches a dependency, lockfile, QA Lab plugin tests, and a channel transport path. (AGENTS.md:17, 3ad465d32b3b)
  • Scoped extension policy read: extensions/AGENTS.md was fully read; the change stays inside the bundled plugin boundary and uses the existing dependency surface rather than importing core internals. (extensions/AGENTS.md:1, 3ad465d32b3b)
  • Live PR state: The current PR head is 81b14d3546eca49a4de761165d06233a6747c80f, is mergeable but unstable, and carries maintainer and dependency-change labels. (81b14d3546ec)
  • PR diff adds focused coverage: The diff adds a Zalo case to crabline-transport.test.ts that asserts gateway config, runtime env, delivery mapping, admin inbound, and recorder-backed outbound normalization. (extensions/qa-lab/src/crabline-transport.test.ts:617, 81b14d3546ec)
  • Current main adapter seam: createQaCrablineTransportAdapter already starts the Crabline adapter, writes its manifest, and delegates config, env, delivery, inbound, and recorder normalization to @openclaw/crabline. (extensions/qa-lab/src/crabline-transport.ts:297, 3ad465d32b3b)
  • Current main uses Crabline 0.1.7: QA Lab currently depends on @openclaw/[email protected], so the Zalo bridge/server support from 0.1.8 is not already available on main. (extensions/qa-lab/package.json:19, 3ad465d32b3b)

Likely related people:

  • RomneyDa: Blame and log history show RomneyDa introduced the QA Lab Crabline adapter/test surface and the linked Zalo API-root seam this PR exercises, beyond authoring this PR. (role: recent area contributor; confidence: high; commits: 6432808ad297, 84c9f05513de, 381b44a9fc26; files: extensions/qa-lab/src/crabline-transport.ts, extensions/qa-lab/src/crabline-transport.test.ts, extensions/zalo/src/api.ts)
  • openclaw/openclaw-secops: CODEOWNERS and the live dependency guard route lockfile and dependency graph review for this PR to the secops ownership path. (role: required dependency reviewer; confidence: high; files: pnpm-lock.yaml, .github/CODEOWNERS, .github/workflows/dependency-guard.yml)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@RomneyDa
RomneyDa force-pushed the test/crabline-zalo-coverage branch from eabac26 to 81b14d3 Compare July 3, 2026 01:58
@clawsweeper clawsweeper Bot added rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. and removed rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. labels Jul 3, 2026
@RomneyDa
RomneyDa merged commit 8d535fb into main Jul 3, 2026
137 of 146 checks passed
@RomneyDa
RomneyDa deleted the test/crabline-zalo-coverage branch July 3, 2026 02:09
@Haderach-Ram Haderach-Ram mentioned this pull request Jul 3, 2026
Open
@clawsweeper clawsweeper Bot mentioned this pull request Jul 3, 2026
Merged
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jul 3, 2026
@RomneyDa
test(qa): cover Crabline Zalo transport (openclaw#99303)
6a15ef9
sheyanmin pushed a commit to sheyanmin/openclaw that referenced this pull request Jul 8, 2026
@RomneyDa @sheyanmin
test(qa): cover Crabline Zalo transport (openclaw#99303)
45daafb
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies-changed PR changes dependency-related files extensions: qa-lab maintainer Maintainer-authored PR merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. P2 Normal backlog priority with limited blast radius. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. size: S status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@RomneyDa