feat: add opt-in HTTP context for Node and Rust

[steipete]

Add opt-in HTTP candidate context for Node/TypeScript callers and Rust handlers. map --link-http frontend:backend reports literal method/path links between explicitly paired roots; review with the same flag adds counterpart files only to that review's prompt. Default output, stored feature schemas, and persisted context remain unchanged.

The pass validates canonical roots, rejects ambiguous handlers and recognized unresolved mounts, and bounds source reads, output, and per-feature review context. JavaScript calls are matched from js-tokens tokens, keeping regex/template contents, private methods, and longer identifier names out of the candidate set. The small dependency has no transitive dependencies; package smoke now resolves dependency metadata through public entry points so packages with restricted exports are supported.

JSX/TSX, dynamic or escaped paths, additional fetch options, other handler syntaxes, and inferred deployment topology are outside this first version. The feature-mapping documentation defines the exact syntax and limits. Thanks @Tanmay-008 for the proposal and narrowed scope. Closes #169.

Merge #201 after this PR and #199. It contains all release notes and contributor credit for the group.

Validation on 8835259

• Typecheck, lint, formatting, build, and full suite passed: 941 tests passed, 2 platform skips; the focused HTTP suite has 17 passing tests.
• Exact-head CI succeeded: https://github.com/openclaw/clawpatch/actions/runs/34120601463 (Linux full suite/package smoke and Windows execution tests).
• Final Codex branch autoreview against origin/main is scoped-clean at P2. All accepted findings were addressed, including parsing boundaries, physical root overlap, independent context limits, dense-input indexing, and nested templates.
• The built CLI mapped six features and one HTTP relation in a synthetic Node/Rust repository. The documented fixture provider returned 0 findings by default, 1 frontend marker finding with HTTP context, and 0 on a subsequent default review. Persisted context stayed unchanged.
• A built-CLI scan of 4,000 duplicate handler declarations (159,001 source bytes) completed in 152 ms, rejected the ambiguous route, and retained /health, /users/@me, and /Über. Generic mounts were rejected. Built-code checks also rejected private/Unicode-prefixed identifiers and recognized a real call after a regex control-flow body and formatting comments.
• Dense 20,000-call and 10,000-nested-template regressions pass. Packaged CLI smoke mapped 13 features, including 3 CUDA. Local HTTP-branch smoke reused the completed build with lifecycle hooks disabled because main's prepack shorthand fails under globally installed pnpm 12; CI ran normal smoke. chore: prepare 0.8.0 notes and refresh pnpm setup #201 fixes the hook and passes normal local smoke.
• One earlier suite attempt hit host ENOSPC. The retry in a fresh private temp directory passed.

The fixture provider measures real CLI/scanner/prompt behavior, not live service topology. The result remains candidate context that reviewers must verify against runtime routing.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 7, 2026, 8:23 AM ET / 12:23 UTC.

ClawSweeper review

What this changes

Adds an optional flag that links literal Node HTTP calls to Rust handlers and includes counterpart files in review prompts, with documentation, tests, and packaging support.

Merge readiness

✅ Ready for maintainer review

Keep open: this is a distinct, bounded improvement absent from current main and v0.7.3. The earlier duplicate-handler blocker is resolved, and no remaining actionable defect was found.

Priority: P2
Reviewed head: 8835259ef6b224514f1c9c4fd1d7c0b4136e86a3

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused implementation with relevant CLI observations, substantial regression coverage, and no remaining blocking finding.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (terminal): The reported built-CLI run exercises the actual scanner and review-prompt path in a synthetic Node/Rust repository: one relation, 0→1→0 findings across flag toggles, unchanged stored context, and bounded duplicate-handler processing.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (terminal): The reported built-CLI run exercises the actual scanner and review-prompt path in a synthetic Node/Rust repository: one relation, 0→1→0 findings across flag toggles, unchanged stored context, and bounded duplicate-handler processing.
Evidence reviewed	8 items	Repository policy and patch scope: Read the full root AGENTS.md; no nested AGENTS.md or maintainer-notes directory was found. Reviewed all 11 introduced files using the pinned base-to-head diff. The checkout remained clean. Distinct capability on the reviewed branch: Current-main documentation describes language-specific mapping and agent-assisted mapping, but no equivalent deterministic HTTP pairing flag. Tree checks found no HTTP relations module on main or v0.7.3; the provided related PRs remain open. Prior finding resolved: The current route index stores one endpoint or an ambiguity marker instead of repeatedly copying duplicate-handler buckets. A 4,000-handler regression retains the unique route. This addresses the concrete blocker retained from earlier review cycles.
Findings	None	None.
Security	None	None.

How this fits together

Clawpatch maps repository files into reviewable features and sends bounded source context to a coding provider. The optional HTTP scanner connects explicitly paired frontend and backend roots before constructing a review prompt.

flowchart LR
  A[Explicit frontend and backend roots] --> B[Filtered source scan]
  B --> C[Literal HTTP candidates]
  C --> D[Reject ambiguous routes and mounts]
  D --> E[Map relation output]
  D --> F[Bounded temporary review context]
  F --> G[Coding provider review]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test growth	production +425 net lines; tests +400 net lines	Production growth, including packaging support, is justified by the new bounded scanner and opt-in integration.

Root-cause cluster

Relationship: fixed_by_candidate
Canonical: #169
Summary: This PR is the explicit, narrowed implementation candidate for the linked cross-language context request.

Members:

• canonical: feat: introduce global dependency graph for cross-language context resolution #169 - The PR explicitly addresses its Node caller/Rust handler example; the issue remains open pending implementation.
• adjacent_distinct: chore: prepare 0.8.0 notes and refresh pnpm setup #201 - Coordinates release notes and packaging tooling without replacing the HTTP implementation.
• adjacent_distinct: test: allow scheduling headroom in timeout regressions #199 - Adjusts timeout-test scheduling headroom as separate work in the release group.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Technical review

Best possible solution:

Retain explicit root pairing and temporary, bounded candidate context without introducing persistent graph state or inferred deployment topology.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a bug reproduction: this adds a capability; the supplied built-CLI observations exercise its enabled and disabled behavior.

Is this the best way to solve the issue?

Yes: explicit pairing and ephemeral context provide a narrower solution than a persistent global dependency graph, while documenting unsupported syntax and routing assumptions.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 9f71d92f0069.

Labels

Label justifications:

• P2: Optional cross-language review context is a bounded improvement without an urgent existing-workflow regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The reported built-CLI run exercises the actual scanner and review-prompt path in a synthetic Node/Rust repository: one relation, 0→1→0 findings across flag toggles, unchanged stored context, and bounded duplicate-handler processing.
• proof: sufficient: Contributor real behavior proof is sufficient. The reported built-CLI run exercises the actual scanner and review-prompt path in a synthetic Node/Rust repository: one relation, 0→1→0 findings across flag toggles, unchanged stored context, and bounded duplicate-handler processing.

Evidence

What I checked:

• Repository policy and patch scope: Read the full root AGENTS.md; no nested AGENTS.md or maintainer-notes directory was found. Reviewed all 11 introduced files using the pinned base-to-head diff. The checkout remained clean. (AGENTS.md:1, 8835259ef6b2)
• Distinct capability on the reviewed branch: Current-main documentation describes language-specific mapping and agent-assisted mapping, but no equivalent deterministic HTTP pairing flag. Tree checks found no HTTP relations module on main or v0.7.3; the provided related PRs remain open. (docs/feature-mapping.md:81, 9f71d92f0069)
• Prior finding resolved: The current route index stores one endpoint or an ambiguity marker instead of repeatedly copying duplicate-handler buckets. A 4,000-handler regression retains the unique route. This addresses the concrete blocker retained from earlier review cycles. (src/http-relations.ts:132, 8835259ef6b2)
• Temporary context preserves stored records: Review enriches a copy passed to the existing prompt builder; persisted updates still derive from lockedFeature. Existing prompt deduplication, file limits, and repository containment checks remain in use. (src/review.ts:350, 8835259ef6b2)
• After-fix production CLI observations: The captured full PR body and feat: add opt-in HTTP context for Node and Rust #200 (comment) report the built CLI at the reviewed SHA mapping six features and one relation, with backend findings changing 0→1→0 as the flag was enabled and removed, while stored context remained unchanged. The recorded dense-handler scan completed in 152 ms and rejected ambiguity. The fixture provider supplies deterministic output while the actual CLI, scanner, and prompt path perform the changed behavior; live HTTP connectivity is expressly outside the claim. Tests and CI are supplemental. Captured sourceRevision: dacd258e11d6e400d240821796698792dcc3f413420b2fc4060ddd52c4b68104. (8835259ef6b2)
• Dependency and execution boundary: The scanner directly imports js-tokens, establishing its lexical contract as relevant. The lockfile pins 10.0.0 with integrity and no transitive dependency entries; packaging resolves public entrypoints while preserving disabled dependency-pack lifecycle scripts. No provider authentication, permissions, or execution policy changes were introduced. Dependency source was unavailable locally and its upstream page could not be retrieved; no independent dependency-source audit is claimed. (src/http-relations.ts:2, 8835259ef6b2)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Tanmay-008: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (5 earlier review cycles)

• reviewed 2026-09-07T11:19:15.685Z sha 3bcb3d1 :: needs changes before merge. :: [P2] Collect duplicate handlers without copying the entire bucket
• reviewed 2026-09-07T11:28:14.516Z sha 50475ed :: blocked before merge. :: [P2] Collect duplicate handlers without copying the entire bucket
• reviewed 2026-09-07T11:44:30.848Z sha c4bf93e :: needs maintainer review before merge. :: none
• reviewed 2026-09-07T12:01:49.753Z sha b6e0701 :: needs maintainer review before merge. :: none
• reviewed 2026-09-07T12:16:21.095Z sha 8835259 :: needs maintainer review before merge. :: none

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	js-tokens@​10.0.0

View full report

[steipete]

Prepared head: 8835259ef6b224514f1c9c4fd1d7c0b4136e86a3.

All 941 tests passed (2 platform skips), along with typecheck, lint, formatting, build, and packaged CLI smoke. Exact-head Linux/Windows CI succeeded: https://github.com/openclaw/clawpatch/actions/runs/34120601463. Final Codex branch autoreview against origin/main is scoped-clean at P2.

The real built CLI produced one relation across six synthetic Node/Rust features. Backend review results were 0→1→0 when the explicit HTTP flag was enabled and then omitted, using the documented fixture provider; stored context stayed unchanged. A 159,001-byte input with 4,000 duplicate handlers returned only the three unique routes in 152 ms. The duplicate bucket now uses an ambiguity marker, so it does not repeatedly copy lists. The built-code and regression checks cover generic mounts, regex/control-flow syntax, comments, private and Unicode-prefixed identifiers, and deep templates.

This addresses the earlier duplicate-handler finding. The complete final proof and bounded syntax contract are in the PR body and docs. #201 must merge last to supply the consolidated 0.8.0 notes.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/34121765249
• Updated: 2026-09-07T12:25:44.921Z