[freeqaz]

Problem

Tests check API refusals with the same two lines over and over: assert.equal(x.status, 4xx, ...) and then assert.equal(x.body.error.code, "CODE", ...). A survey of tests/ on main found 181 such pairs in 19 files (96 in occ-api.test.mjs). The failure messages differ by site: some print the body, some print only a label, and some print nothing, so a refusal that answered differently can fail without showing what came back.

Change

• New tests/helpers/api-error.mjs with assertApiError(response, status, code, label). It asserts response.status and response.body.error.code with the same strict assert.equal the call sites used. Each failure message is the response body as JSON, after label when given.
• 159 pairs in 15 files now call it. Each site keeps its status, its code and its label (the label the site passed to either assertion; a ${label}: ${JSON.stringify(body)} message becomes label). Sites that printed x.text now print the parsed body.
• Left alone:
  • configuration-controller.test.mjs and static-egress.test.mjs (both edited by feat(occdev): wire the OpenShell Git route into occ dev up with an installed acceptance #3045).
  • Two pairs in native-admin-access.test.mjs that feat: assign configured OpenClaw roles to Agent users #906 rewrites.
  • The two credential-source-api.test.mjs pairs whose status and code messages differ.
  • Status checks without a code check, and deepEqual(x.body.error, {...}) checks: they assert more than the helper does.

Test-only. No product code, assertion values or test names change.

Verification

• Touched baseline files pass locally (Node 24, CPUs 20-27): occ-api 71/71, occ-api-security 41/41, runtime-logs-sandbox 48/48, configuration-body-limits 3/3, console-api 10/10, credential-free-metadata-grant 2/2, native-admin-access 15/15, openshell-device-authorization-api 1/1, plugin-discovery-api 23/23, presets-controller 25/25, runtime-credentials-api 19/19, secret-api 26/26, workspace-setup-api 11/11.
• postgres-agent-provisioning and credential-proxy-withdrawal ran in the full postgres-platform lane on a remote test VM: the lane passed (postgres-agent-provisioning 84.5 s, credential-proxy-withdrawal 6.3 s).
• Mutants on the helper, each run against all 13 baseline caller files:
  • The status compared with status + 1 fails every file (occ-api 37 cases, plugin-discovery-api 9, secret-api 8, presets-controller 7, runtime-credentials-api 6, and 1-3 in each of the others).
  • The code compared with code + "_" fails the same cases.
• tsc --build tsconfig.json tests/tsconfig.json, ESLint and Prettier are clean.
• git merge-tree: none of the 17 open PRs that touch these files (feat: add Agent workload tags #115, feat: assign configured OpenClaw roles to Agent users #906, fix(ssh): accept operator-provisioned channel credentials #914, feat(iam): grant the deployer exact read of the revision a deploy admits #1605, fix(credentials): release refresh bootstrap references and preserve resend protection #1952, fix: preserve native plugin permissions across Harness selection and admission #2258, fix: prepare native admin access on the first Agent deployment #2259, fix(worker): settle initial provisioning on a superseding deploy or stop #2268, feat(plugins): let administrators approve pinned plugin releases #2398, Draft implementation: managed outbound HTTPS for dedicated Gateways #2518, fix(credentials): retain every Secret the gateway may hold during updates #2520, Propose execution-scoped Strands history policy above Credential Proxy #2533, feat(console): show the authorized native Gateway people roster #2596, feat: add Gateway managed mode to Agent deployments #2982, feat(occdev): wire the OpenShell Git route into occ dev up with an installed acceptance #3045, fix(kubernetes): preserve explicit human Gateway identities #3049, Bind OpenClaw plugin selections to Agent connections #3343) gets a new conflicted file or conflict hunk.

Risks

Low. The helper asserts the same two values with the same strict equality; the messages now include the body where some sites had none. A response without body.error still fails with a TypeError, as before.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR replaces 159 repeated API error assertion pairs with a shared helper that includes the response body in failure messages.

Example: An API refusal test expects 403 FORBIDDEN but receives 500 INTERNAL_ERROR.

• Before: Some assertion failures show only the status mismatch or a label.
• After: The assertion failure includes the JSON response body and any existing label.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused test refactor with preserved expectations, proportionate reported validation, successful exact-head checks, and no actionable findings.
Proof confidence	🐚 platinum hermit (4/6)	This maintainer-authored PR changes only test assertions; reported caller-suite and mutation runs support the extraction, and no shipped product behavior requires separate live proof.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Test only · Worth it: Yes · Fix scope: Complete
User problem: Contributors diagnosing failing API refusal tests can receive inconsistent messages that omit the response body.
Reason: The maintainer-authored direction improves diagnostics while reducing repetition and preserving test coverage.

Merge readiness

✅ Ready for maintainer review

Keep open: this maintainer-authored PR provides useful test cleanup, preserves the existing expectations, and has no actionable findings.

Priority: P3
Reviewed head: 1e16c04188fc1df09359fcf47d20d82a878cce1b

Before merge

None.

Findings

None.

Agent review details

How this fits together

Integration and conformance tests pass parsed controller responses into the helper, which checks HTTP status and error code and produces assertion diagnostics.

flowchart LR
  A[Test scenario] --> B[Controller API]
  B --> C[Parsed response]
  C --> D[Shared error assertion]
  D --> E[Test result and diagnostics]

Loading

Technical review

Best possible solution:

Retain the small shared assertion helper and its behavior-preserving caller replacements.

Do we have a high-confidence way to reproduce the issue?

No product bug is claimed; the pinned base assertions directly establish the repeated checks and inconsistent diagnostic messages.

Is this the best way to solve the issue?

The helper is a proportionate solution: it preserves strict comparisons, keeps expectations at each call site, and leaves richer assertions in place.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against eef2a181350f.

Provenance checked

• API status and error-code expectations keeps the original intent (1814d57: Earlier integration-test consolidation retained explicit API refusal checks; this PR preserves their independent expected values.)
• Console authorization refusals keeps the original intent (feat: add read-only platform console #12: Console API tests enforce exact IAM boundaries and canonical API errors; only their repeated assertion syntax changes.)
• Runtime-log request bounds keeps the original intent (f2a4902: Recent coverage pins request-schema bounds and error details; the helper retains status/code checks and leaves detail assertions untouched.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Introduced changes preserve assertions: The pinned introduction diff contains only the helper, its imports, and replacements of status/code assertion pairs; expected values and surrounding message, detail, audit, and side-effect assertions remain intact. (tests/helpers/api-error.mjs:8, 1e16c04188fc)
• Response boundary matches helper: The console fixture obtains real HTTP responses, parses JSON, and returns the status/body shape consumed by the helper; serialization therefore operates on parsed JSON rather than arbitrary application objects. (tests/helpers/console-app.mjs:591, 1e16c04188fc)
• Current main and related work: Fetched main has no api-error helper, and repository searches found no competing assertion-helper PR; test: open and close test postgresql pools through a shared helper #3560 concerns PostgreSQL pool teardown and does not supersede this change. (tests/helpers/api-error.mjs, eef2a181350f)
• Validation on reviewed head: GitHub reports 32 successful and seven skipped checks on the reviewed head, including successful CI Required, conformance, and PostgreSQL Platform checks; the body also records caller-suite and mutation runs. Leaf-log retrieval redirected to a blocked Azure storage host, so detailed logs were not inspected. (1e16c04188fc)
• Applicable policy and discussion: The complete root policy was applied; no nested tests policy, maintainer-notes directory, or pr-simplify skill was present. REST reads confirmed collaborator authorship and only automated status comments, with no substantive review objections. (AGENTS.md, 1e16c04188fc)

Likely related people:

• Free Wortley: Raw commit f2a4902 adds tests/conformance/occ-api-security.test.mjs:1796 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: f2a4902f68af; files: tests/conformance/occ-api-security.test.mjs)
• kevinlin-openai: Raw commit 3474bb7 adds tests/integration/console-api.test.mjs:92 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: 3474bb717fff; files: tests/integration/console-api.test.mjs)
• Russell Bryant: Raw commit 3935a45 adds tests/integration/console-api.test.mjs:65 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: low; commits: 3935a4545342; files: tests/integration/console-api.test.mjs)

Review metrics

Metric	Value	Why it matters
Change scope	Production +0/-0; tests and helpers +188/-320	The 13-line helper removes repeated assertions without adding test cases or production machinery.

Labels

Label changes:

• add P3: This is low-risk test maintenance that improves failure diagnostics without changing product behavior.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P3: This is low-risk test maintenance that improves failure diagnostics without changing product behavior.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 24, 2026, 8:58 PM ET / October 25, 2026, 00:58 UTC.