fix: guard setDeep against empty keys array in Chrome profile decoration by zhangLei99586 · Pull Request #98138 · openclaw/openclaw

zhangLei99586 · 2026-06-30T12:05:51Z

Related: #98465

What Problem This Solves

setDeep() with empty keys creates obj[""] = value via keys[-1] ?? "".

Why This Change Was Made

Add early if (keys.length === 0) return; guard.

User Impact

No user-visible change. Defensive guard.

Evidence

Runtime terminal proof (Node v24.13.1):

36/36 tests passed (profiles.test.ts) — setDeep(obj,[],"v") → keys: [ ]

clawsweeper · 2026-06-30T12:07:02Z

Codex review: needs maintainer review before merge. Reviewed July 1, 2026, 8:25 PM ET / 00:25 UTC.

Summary
The branch adds an early return for empty key arrays in the browser Chrome profile-decoration setDeep helper and removes the empty-string fallback assignment.

PR surface: Source +3. Total +3 across 1 file.

Reproducibility: yes. at source level: current main's final assignment writes obj[""] = value for an empty key array. No high-confidence production user-flow reproduction is shown because all current callers pass non-empty literal paths.

Review metrics: none identified.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #98465
Summary: The open linked issue is the canonical report for the same private setDeep empty-key behavior, and this PR is the candidate fix.

Members:

canonical: browser: setDeep creates empty-string property on empty keys #98465 - The issue body describes the same empty-key write and requests the same early return guard.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit ✨ media proof bonus
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

none.

Risk before merge

[P1] The report is source-level only: current production callers pass non-empty literal paths, so maintainers should decide whether landing defensive no-op semantics is worthwhile without a demonstrated user-flow failure.

Maintainer options:

Decide the mitigation before merge
Land this narrow guard as the candidate fix for browser: setDeep creates empty-string property on empty keys #98465 if maintainers want empty key paths to be a no-op for the private helper.
Pause or close
Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

[P2] The PR already contains the narrow candidate fix and has no actionable repair findings; the remaining action is maintainer review and merge or close judgment.

Security
Cleared: The diff only changes a private TypeScript object-path helper and adds no dependency, workflow, package, permission, secret, or code-execution surface.

Review details

Best possible solution:

Land this narrow guard as the candidate fix for #98465 if maintainers want empty key paths to be a no-op for the private helper.

Do we have a high-confidence way to reproduce the issue?

Yes at source level: current main's final assignment writes obj[""] = value for an empty key array. No high-confidence production user-flow reproduction is shown because all current callers pass non-empty literal paths.

Is this the best way to solve the issue?

Yes for the helper-level behavior: an early return before final indexing is the narrow local fix. A wider caller refactor is not justified because the helper is private and the only current call sites are local non-empty literal paths.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 3558391a75fd.

Label changes

Label changes:

add proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence. The contributor's terminal screenshot is sufficient for this non-visual helper change because it shows the after-fix empty-key no-op, normal nested behavior, profile decoration path exercise, and focused test output.

Label justifications:

P3: This is a low-risk defensive browser helper fix with no demonstrated user-facing failure in current callers.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (screenshot): The contributor's terminal screenshot is sufficient for this non-visual helper change because it shows the after-fix empty-key no-op, normal nested behavior, profile decoration path exercise, and focused test output.
proof: sufficient: Contributor real behavior proof is sufficient. The contributor's terminal screenshot is sufficient for this non-visual helper change because it shows the after-fix empty-key no-op, normal nested behavior, profile decoration path exercise, and focused test output.
proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence. The contributor's terminal screenshot is sufficient for this non-visual helper change because it shows the after-fix empty-key no-op, normal nested behavior, profile decoration path exercise, and focused test output.

Evidence reviewed

PR surface:

Source +3. Total +3 across 1 file.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	4	1	+3
Tests	0	0	0	0
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	1	4	1	+3

What I checked:

Current main helper behavior: Current main still assigns through node[keys[keys.length - 1] ?? ""], so an empty key list writes under the empty-string property. (extensions/browser/src/browser/chrome.profile-decoration.ts:49, 3558391a75fd)
PR diff: The PR head adds if (keys.length === 0) return; before traversal and then indexes the final key directly after that guard. (extensions/browser/src/browser/chrome.profile-decoration.ts:40, c6a5303d666c)
Current callers: All current setDeep() call sites in the module pass non-empty literal key arrays through profile decoration or clean-exit updates, so the fix is defensive rather than tied to a demonstrated production caller failure. (extensions/browser/src/browser/chrome.profile-decoration.ts:128, 3558391a75fd)
Runtime entry point: Managed Chrome startup reaches the affected helper through decorateOpenClawProfile() and ensureProfileCleanExit() after resolving the managed user data directory. (extensions/browser/src/browser/chrome.ts:1011, 3558391a75fd)
Adjacent tests: Adjacent browser tests cover normal profile decoration, download prefs, invalid preference recovery, clean-exit prefs, and idempotency; they do not directly test the private empty-key helper edge case. (extensions/browser/src/browser/chrome.test.ts:141, 3558391a75fd)
Latest release behavior: The latest release tag still contains the empty-string fallback assignment, so this fix is not already shipped. (extensions/browser/src/browser/chrome.profile-decoration.ts:49, e085fa1a3ffd)

Likely related people:

Eva: git blame attributes the current setDeep() helper and fallback assignment to the commit that added the browser profile-decoration file in current main history. (role: introduced current helper path; confidence: high; commits: 48974b5765d3; files: extensions/browser/src/browser/chrome.profile-decoration.ts, extensions/browser/src/browser/chrome.ts, extensions/browser/src/browser/chrome.test.ts)
obviyus: GitHub commit metadata lists obviyus as the committer for the current-main commit that contains the helper path. (role: committer of introducing commit; confidence: medium; commits: 48974b5765d3; files: extensions/browser/src/browser/chrome.profile-decoration.ts)
vincentkoc: The PR timeline shows vincentkoc assigned the item and force-pushed the current contributor branch head for maintainer follow-up. (role: current PR follow-up owner; confidence: medium; commits: c6a5303d666c; files: extensions/browser/src/browser/chrome.profile-decoration.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

zhangLei99586

@clawsweeper re-review

zhangLei99586 · 2026-07-01T02:24:37Z

@clawsweeper re-review

clawsweeper · 2026-07-01T02:24:40Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

zhangLei99586 · 2026-07-01T06:21:44Z

@clawsweeper review

zhangLei99586 · 2026-07-01T06:31:07Z

@clawsweeper re-review

clawsweeper · 2026-07-01T06:31:10Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

zhangLei99586 · 2026-07-01T06:46:05Z

@clawsweeper re-review

zhangLei99586 · 2026-07-01T08:18:36Z

@clawsweeper re-review

zhangLei99586 · 2026-07-01T08:29:38Z

@clawsweeper re-review

zhangLei99586 · 2026-07-01T08:33:31Z

Runtime behavior proof — terminal output from after-fix execution:

zhangLei99586 · 2026-07-01T08:35:17Z

Runtime behavior proof (terminal output):

zhangLei99586 · 2026-07-01T08:35:49Z

@clawsweeper re-review

zhangLei99586 · 2026-07-01T08:40:41Z

@clawsweeper re-review

zhangLei99586 · 2026-07-01T08:45:13Z

@clawsweeper re-review

When keys is empty, keys[keys.length - 1] returns undefined, and the previous ?? fallback would silently create a property with an empty string key on the target object. Add an early return so empty keys are a no-op instead of silently polluting the object.

vincentkoc · 2026-07-02T00:30:00Z

Merged via squash.

Prepared head SHA: c6a5303d666c8ec5468f6b9dede023f10eba6fb2
Landed commit: 273729bd95ef4523fa87e1f8722214f90602ac27

* origin/main: test(gateway): isolate live release agent state test(plugins): repair prerelease validation fixtures fix(discord): guard JSON.parse against malformed API response bodies (#97889) fix(codex): preserve app approvals in side forks (#98812) fix(agents): don't inject A2A turns into isolated-cron sessions_send (#92257) (#92283) fix(browser): guard setDeep against empty keys array (#98138) docs(telegram): move maintainer decisions into scoped AGENTS.md fix(ios): generate light app store screenshots only fix(gateway): distinguish reachable gateway from failed status probe (#98183)

When keys is empty, keys[keys.length - 1] returns undefined, and the previous ?? fallback would silently create a property with an empty string key on the target object. Add an early return so empty keys are a no-op instead of silently polluting the object.

openclaw-barnacle Bot added the size: XS label Jun 30, 2026

zhangLei99586 commented Jul 1, 2026

View reviewed changes

zhangLei99586 force-pushed the fix/empty-keys-setdeep branch from 2c51b19 to 0a2139c Compare July 1, 2026 06:30

clawsweeper Bot mentioned this pull request Jul 1, 2026

browser: setDeep creates empty-string property on empty keys #98465

Closed

vincentkoc self-assigned this Jul 1, 2026

vincentkoc force-pushed the fix/empty-keys-setdeep branch from 0a2139c to 342b845 Compare July 2, 2026 00:08

vincentkoc force-pushed the fix/empty-keys-setdeep branch from 342b845 to c6a5303 Compare July 2, 2026 00:20

clawsweeper Bot added the proof: 📸 screenshot Contributor real behavior proof includes screenshot evidence. label Jul 2, 2026

vincentkoc merged commit 273729b into openclaw:main Jul 2, 2026
97 checks passed

github-actions Bot mentioned this pull request Jul 2, 2026

📡 Upstream Digest — 2026-07-02 02:32 UTC curtismercier/openclaw-mods#1186

Open

vincentkoc mentioned this pull request Jul 6, 2026

chore(jobs): prune resolved OpenClaw inbox jobs openclaw/clownfish#221

Merged

Uh oh!

Uh oh!

Conversation

zhangLei99586 commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

clawsweeper Bot commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zhangLei99586 left a comment

Choose a reason for hiding this comment

Uh oh!

zhangLei99586 commented Jul 1, 2026

Uh oh!

clawsweeper Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zhangLei99586 commented Jul 1, 2026

Uh oh!

zhangLei99586 commented Jul 1, 2026

Uh oh!

clawsweeper Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zhangLei99586 commented Jul 1, 2026

Uh oh!

zhangLei99586 commented Jul 1, 2026

Uh oh!

zhangLei99586 commented Jul 1, 2026

Uh oh!

zhangLei99586 commented Jul 1, 2026

Uh oh!

zhangLei99586 commented Jul 1, 2026

Uh oh!

zhangLei99586 commented Jul 1, 2026

Uh oh!

zhangLei99586 commented Jul 1, 2026

Uh oh!

zhangLei99586 commented Jul 1, 2026

Uh oh!

Uh oh!

vincentkoc commented Jul 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

zhangLei99586 commented Jun 30, 2026 •

edited

Loading

clawsweeper Bot commented Jun 30, 2026 •

edited

Loading

clawsweeper Bot commented Jul 1, 2026 •

edited

Loading

clawsweeper Bot commented Jul 1, 2026 •

edited

Loading