fix(provider): normalize nullable schemas for Codex

[clawsweeper]

Summary

• Normalize nullable anyOf output schemas in provider JSON Schema conversion to Codex/OpenAI strict-compatible type arrays.
• Keep existing unsupported keyword stripping and strict object required/additionalProperties behavior intact.
• Add a focused regression for reviewJsonSchema evidence endLine so it no longer contains nullable anyOf.

Fixes #146

Validation

• pnpm test src/provider.test.ts -- -t providerJsonSchema
• pnpm typecheck
• pnpm lint
• pnpm test
• pnpm build

Notes

Source report by @grantjayy in #146.

[clawsweeper]

Codex review: passed. Reviewed June 30, 2026, 1:31 PM ET / 17:31 UTC.

Summary
The PR normalizes nullable anyOf provider schemas into strict-compatible type arrays and adds a regression test.

Reproducibility: yes. The linked source issue gives a command-level Codex reproduction, and current main still sends the generated provider schema to Codex without nullable anyOf normalization.

Review metrics: 2 noteworthy metrics.

• PR surface: 2 files changed, 35 additions, 0 deletions. The change is small and concentrated in provider schema conversion plus a focused regression test.
• Checks: 6 successful check runs reported. CI, CodeQL, and secret scanning success reduce routine merge uncertainty for this generated provider fix.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #146
Summary: This PR is the candidate fix for the linked Codex provider schema failure.

Members:

• canonical: Codex provider fails on nullable anyOf output schemas #146 - The PR body uses closing syntax and the diff directly targets the provider schema failure described there.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• none.

Risk before merge

• [P1] The full external Codex CLI/codex-pooler smoke from the linked issue was not rerun during this read-only review, though the source path, regression, and reported PR checks are consistent with the fix.

Maintainer options:

1. Decide the mitigation before merge
   Merge this narrow provider schema normalization after ordinary maintainer review, then let the linked issue close from the merged fix.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

• [P2] No repair lane is needed; this PR is the active fix candidate and has no discrete review finding for automation to address.

Security
Cleared: The diff only changes local JSON Schema conversion and a regression test; it adds no dependency, workflow, secret, or external execution risk.

Review details

Best possible solution:

Merge this narrow provider schema normalization after ordinary maintainer review, then let the linked issue close from the merged fix.

Do we have a high-confidence way to reproduce the issue?

Yes. The linked source issue gives a command-level Codex reproduction, and current main still sends the generated provider schema to Codex without nullable anyOf normalization.

Is this the best way to solve the issue?

Yes. The PR keeps the existing schema conversion boundary and adds focused normalization plus regression coverage instead of changing provider transport or user configuration.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 24763d26cdff.

Label changes

Label changes:

• add P1: The linked source report shows the Codex provider failing before model reasoning on the latest released CLI path.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a ClawSweeper bot autofix PR, so the external contributor real-behavior proof gate does not apply.

Label justifications:

• P1: The linked source report shows the Codex provider failing before model reasoning on the latest released CLI path.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a ClawSweeper bot autofix PR, so the external contributor real-behavior proof gate does not apply.

Evidence reviewed

What I checked:

• Current main source: providerJsonSchema() on current main only strips unsupported JSON Schema keywords and tightens object schemas, so it has no nullable anyOf normalization before Codex receives the schema. (src/provider-schema.ts:23, 24763d26cdff)
• Codex adapter path: runCodexJson() writes the provider schema to a temp schema file and passes it to Codex via --output-schema, matching the linked failure path before model reasoning. (src/providers/codex.ts:65, 24763d26cdff)
• PR diff: The branch adds a nullable anyOf recognizer in stripProviderUnsupportedSchemaKeywords() and a regression asserting reviewJsonSchema evidence endLine has type: ["integer", "null"] with no anyOf. (src/provider-schema.ts:42, aafe2cbc8e0b)
• Linked issue evidence: The linked source issue reports a real clawpatch ci --provider codex failure on v0.7.0 and includes a locally validated normalization that changes the same nullable shape into a strict-compatible type array.
• History provenance: Blame and git log -S show the current provider schema converter and nullable evidence line schema date to the v0.7.0 release commit, with the Codex adapter later extracted from the provider area. (src/provider-schema.ts:23, 0cd24d07a262)
• PR checks: GitHub reports the PR mergeable, with CI, CodeQL, and secret scanning check runs successful at review time. (aafe2cbc8e0b)

Likely related people:

• steipete: Current history shows the provider schema converter, nullable evidence line schema, and provider tests introduced in the v0.7.0 release commit, with later provider extraction work in the same area. (role: introduced behavior and recent provider area contributor; confidence: high; commits: 0cd24d07a262, 0a0d7f5f1ec0, 0aff68a31070; files: src/provider-schema.ts, src/types.ts, src/provider.test.ts)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[clawsweeper]

🦞✅
ClawSweeper autofix is complete for this exact head.

Source: clawsweeper[bot]
Feedback: structured ClawSweeper verdict: pass (sha=aafe2cbc8e0b161f7dbc1371827d9b3e336b904a)
Head: aafe2cbc8e0b

No actionable findings remain. I removed the repair-loop label and left the PR open for maintainer review and merge.

Automerge progress:

• 2026-06-30 17:32:26 UTC review passed aafe2cbc8e0b (structured ClawSweeper verdict: pass (sha=aafe2cbc8e0b161f7dbc1371827d9b3e336b9...)