test(http-utils): cover URL-candidate and selector error/boundary branches

[KrasimirKralev]

What Problem This Solves

src/cli/http-utils.ts holds the URL helpers behind HTTP-server target resolution: normalizeHttpUrlCandidate (promote/validate a user-typed target), looksLikeHttpUrl, normalizeHttpUrl, and splitHttpToolSelector (split a base.tool selector). The existing tests/http-utils.test.ts covered the happy paths of normalizeHttpUrl and splitHttpToolSelector, but several error/boundary branches shipped with no coverage at any level:

• normalizeHttpUrlCandidate returning undefined for missing / empty / whitespace-only input, and for a scheme-prefixed value that is not a valid URL (e.g. https://).
• looksLikeHttpUrl — the boolean contract on a non-URL vs a normalizable candidate.
• normalizeHttpUrl returning undefined for unparseable input.
• splitHttpToolSelector rejecting a tool suffix containing non-identifier characters (the /^[A-Za-z0-9_-]+$/ guard).

A future edit to any of those branches could silently change how a mistyped or malformed HTTP target/selector is handled, with no failing test to catch it.

Why This Change Was Made

Coverage-only. Extends tests/http-utils.test.ts (+39 / −1, no production code touched) with focused characterization tests that pin the current main behavior of the previously-uncovered branches. No new config, defaults, dependencies, or behavior.

User Impact

No user-visible or runtime change. For maintainers, the URL-candidate and tool-selector rejection contracts now regress loudly instead of silently: a future edit that drops the empty/whitespace guard, the scheme-but-invalid guard, the unparseable-input guard, or the tool-suffix character check will fail this suite.

Evidence

Linux, Node 22, pnpm install --frozen-lockfile from source, branched off current main (9579ed6).

12/12 pass on clean main:

$ ./node_modules/.bin/vitest run tests/http-utils.test.ts
 Test Files  1 passed (1)
      Tests  12 passed (12)

These branches were genuinely uncovered — the whole suite (unit + integration) does not assert them. Applying a combined behavior-changing mutation to exactly these branches in src/cli/http-utils.ts (empty/whitespace/invalid → return a non-undefined value; drop the tool-suffix regex) and running the entire test suite leaves the pass/fail count unchanged (same pre-existing environment-dependent failures, zero new ones) — no existing unit or integration test's assertion depends on these branches, including tests/cli-http-selector.integration.test.ts:

Suite run under the combined mutation	New failures
full test suite (203 files)	0

The new tests bite — under the same mutation, this suite fails exactly on the targeted arms:

$ # combined mutation applied to src/cli/http-utils.ts
$ ./node_modules/.bin/vitest run tests/http-utils.test.ts
      Tests  5 failed | 7 passed (12)
$ # mutation reverted (src/cli/http-utils.ts byte-identical to main)

Coverage of the target branches (lines 5, 9, 20, 56, 81) is now filled — the only branches that remain uncovered afterward are the defensive/unreachable ones (a URL always has a pathname; the selector's new URL cannot throw after normalizeHttpUrlCandidate already validated it; baseSegment is non-empty whenever dotIndex > 0), which this suite deliberately does not target.

Format / lint / types clean on the changed file:

$ ./node_modules/.bin/oxfmt --check tests/http-utils.test.ts        # All matched files use the correct format.
$ ./node_modules/.bin/oxlint --type-aware --tsconfig tsconfig.json --deny-warnings tests/http-utils.test.ts   # exit 0
$ ./node_modules/.bin/tsc --project tsconfig.json --noEmit          # exit 0

Scope: one existing test file extended, +39 / −1, no production code changed. Same accept-shape as the merged OAuth-coverage PRs #246 / #281 / #331.

AI-assisted contribution.

_{Opened from an org-owned fork via the API; if GitHub's Allow edits by maintainers toggle isn't honored on this PR, a maintainer can still push to the branch or supersede-and-land.}

---

Generated by Claude Code

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 5, 2026, 3:42 PM ET / 19:42 UTC.

ClawSweeper review

What this changes

Adds six tests for HTTP URL normalization, empty or malformed candidates, and invalid tool-selector suffixes without changing runtime behavior.

Merge readiness

✅ Ready for maintainer review

This remains a useful, focused coverage addition absent from current main. The maintainer’s exact-head CLI validation resolves the previous proof blocker; no actionable correctness or security findings remain.

Priority: P3
Reviewed head: ca80f0ad7c22ee9b1edd6a92ffae98e4ce26072b

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, correct coverage addition with relevant mutation evidence and sufficient exact-head CLI validation.
Proof confidence	🐚 platinum hermit (4/6) ✨ media proof bonus	Sufficient (linked_artifact): The maintainer’s exact-head report exercises the helpers through the built CLI and a real loopback HTTP connection, recording successful list/call behavior, malformed-target failure before requests, and preservation of the invalid-suffix endpoint path. This resolves the prior runtime-proof gap; mutation and unit results supplement it.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (linked_artifact): The maintainer’s exact-head report exercises the helpers through the built CLI and a real loopback HTTP connection, recording successful list/call behavior, malformed-target failure before requests, and preservation of the invalid-suffix endpoint path. This resolves the prior runtime-proof gap; mutation and unit results supplement it.
Evidence reviewed	8 items	Applicable repository policy: Read the complete root AGENTS.md and VISION.md; no nested AGENTS.md or maintainer-note files were found. Focused tests and verifiable behavior match the repository guidance. No project commands were executed because this review must remain read-only. Verified introduced scope: The pinned base-to-head patch changes only the existing HTTP helper test file: 39 added lines, one removed line, and six added test cases. It introduces no production, dependency, workflow, permission, or persisted-state changes. Assertions match the production contract: The helpers return undefined for missing, blank, or unparseable candidates, promote domain/path candidates to HTTPS, and return null when a suffix contains non-identifier characters. Returning null declines selector splitting; it does not prohibit the complete URL from being an endpoint.
Findings	None	None.
Security	None	None.

How this fits together

MCPorter’s CLI interprets typed server targets as configured names or HTTP endpoints, optionally separating a tool name from the URL. These helpers feed server lookup and the list/call commands.

flowchart LR
  A[Typed server target] --> B[Normalize URL candidate]
  B --> C[Check tool suffix]
  C --> D[Resolve server endpoint]
  B --> E[Configured name or diagnostic]
  D --> F[List or call MCP tools]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Coverage scope	6 tests added; production +0/-0; tests +39/-1	The additional boundary coverage introduces no production growth or runtime behavior change.

Technical review

Best possible solution:

Retain the focused characterization tests alongside existing CLI integration coverage, preserving the distinction between invalid tool suffixes and valid endpoint paths.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR characterizes existing behavior rather than repairing a reported bug; source inspection and the supplied exact-head validation support the assertions.

Is this the best way to solve the issue?

Yes. Extending the existing helper suite is a narrow, maintainable way to protect these branches, supplemented by mutation evidence and real CLI validation.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 9957bd1e233c.

Labels

Label changes:

• add proof: sufficient: Contributor real behavior proof is sufficient. The maintainer’s exact-head report exercises the helpers through the built CLI and a real loopback HTTP connection, recording successful list/call behavior, malformed-target failure before requests, and preservation of the invalid-suffix endpoint path. This resolves the prior runtime-proof gap; mutation and unit results supplement it.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (linked_artifact): The maintainer’s exact-head report exercises the helpers through the built CLI and a real loopback HTTP connection, recording successful list/call behavior, malformed-target failure before requests, and preservation of the invalid-suffix endpoint path. This resolves the prior runtime-proof gap; mutation and unit results supplement it.
• remove status: 📣 needs proof: Current PR status label is status: 👀 ready for maintainer look.
• remove rating: 🦪 silver shellfish: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.

Label justifications:

• P3: This is a low-risk test coverage improvement with no reported current runtime defect.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (linked_artifact): The maintainer’s exact-head report exercises the helpers through the built CLI and a real loopback HTTP connection, recording successful list/call behavior, malformed-target failure before requests, and preservation of the invalid-suffix endpoint path. This resolves the prior runtime-proof gap; mutation and unit results supplement it.
• proof: sufficient: Contributor real behavior proof is sufficient. The maintainer’s exact-head report exercises the helpers through the built CLI and a real loopback HTTP connection, recording successful list/call behavior, malformed-target failure before requests, and preservation of the invalid-suffix endpoint path. This resolves the prior runtime-proof gap; mutation and unit results supplement it.

Evidence

What I checked:

• Applicable repository policy: Read the complete root AGENTS.md and VISION.md; no nested AGENTS.md or maintainer-note files were found. Focused tests and verifiable behavior match the repository guidance. No project commands were executed because this review must remain read-only. (AGENTS.md:1, ca80f0ad7c22)
• Verified introduced scope: The pinned base-to-head patch changes only the existing HTTP helper test file: 39 added lines, one removed line, and six added test cases. It introduces no production, dependency, workflow, permission, or persisted-state changes. (tests/http-utils.test.ts:9, ca80f0ad7c22)
• Assertions match the production contract: The helpers return undefined for missing, blank, or unparseable candidates, promote domain/path candidates to HTTPS, and return null when a suffix contains non-identifier characters. Returning null declines selector splitting; it does not prohibit the complete URL from being an endpoint. (src/cli/http-utils.ts:3, ca80f0ad7c22)
• Coverage remains absent from current main: Current main retains the six original tests without this PR’s additional candidate and rejection cases. The production helper file has no difference between the reviewed head and fetched main. (tests/http-utils.test.ts:1, 9957bd1e233c)
• Latest release comparison: The supplied latest release, v0.13.9, also contains only the original HTTP helper tests; it does not already include this coverage addition. (tests/http-utils.test.ts:1, 64d613c1e96f)
• New real CLI validation resolves prior proof request: The captured maintainer comment test(http-utils): cover URL-candidate and selector error/boundary branches #344 (comment) reports testing this exact head on macOS with Node 24.20.0 and pnpm 10.34.5. The built CLI successfully listed and called a loopback MCP HTTP server; malformed and whitespace selectors exited 1 before HTTP requests; the /mcp.to$ol endpoint retained its full path and invoked identity. It also records pnpm check, all 12 focused tests, three-platform CI success, and isolation of an unrelated Unix socket-path failure. These observations address the previous review’s specific CLI-proof request. (ca80f0ad7c22)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Yiğit ERDOĞAN: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Vincent Koc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (4 earlier review cycles)

• reviewed 2026-09-04T11:52:19.979Z sha ca80f0a :: needs maintainer review before merge. :: none
• reviewed 2026-09-04T12:56:45.151Z sha ca80f0a :: needs changes before merge. :: none
• reviewed 2026-09-04T17:59:50.006Z sha ca80f0a :: needs changes before merge. :: none
• reviewed 2026-09-05T11:59:21.727Z sha ca80f0a :: needs real behavior proof before merge. :: none

[steipete]

Maintainer validation on ca80f0ad7c22ee9b1edd6a92ffae98e4ce26072b (macOS, Node 24.20.0, pnpm 10.34.5):

• pnpm check passed; pnpm exec vitest run tests/http-utils.test.ts passed all 12 cases. Independent branch autoreview through P2 is clean.
• Built the actual CLI with pnpm build, then drove node dist/cli.js against an isolated config and a synthetic loopback MCP HTTP server. Listing and .identity calls succeeded. https:// and whitespace-only selectors exited 1 with the existing unknown-server diagnostic before any HTTP request.
• Calling the synthetic /mcp.to$ol endpoint retained that complete path on every request and used the server's single identity tool. This proves the invalid suffix is not split off as a tool name; it does not claim malformed suffixes are rejected as endpoint URLs.
• Exact-head Linux, macOS, and Windows CI passed: https://github.com/openclaw/mcporter/actions/runs/33869748954

The full local suite reached 1803 passing tests with one environment failure: this Mac's long private temporary path exceeded the Unix socket path limit in daemon-host.test.ts. Re-running the entire daemon-host suite with a shorter private temp path passed all 29 tests; the failure was unrelated to the HTTP test delta.

No production behavior changes, so no user-facing changelog entry is required. Keep the contributor's human credit in the squash commit; omit generated/session attribution trailers.