From 33d80b6fe3b90efac0a31d5b4eadbb2d169fe38a Mon Sep 17 00:00:00 2001
From: openclaw-bot <bot@openclaw.local>
Date: Fri, 15 May 2026 14:19:15 +0000
Subject: [PATCH] test(#1199): demonstrate regex blindspot in
 resolveWithContext gate (RED)

Item 1/6 from PR #1198 round-2 deferred review. The ad-hoc regex in
resolve_context_callsites_test.go splits on the FIRST comma so any nested
call in arg1 (e.g. getHop(a, b)) makes the gate skip arg2 entirely.

This RED test asserts a synthetic offender is detected by the regex; it is
not. Next commit replaces the regex with a go/parser AST walk.
---
 .../resolve_context_callsites_ast_test.go     | 40 +++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 cmd/server/resolve_context_callsites_ast_test.go

diff --git a/cmd/server/resolve_context_callsites_ast_test.go b/cmd/server/resolve_context_callsites_ast_test.go
new file mode 100644
index 00000000..d4e3b668
--- /dev/null
+++ b/cmd/server/resolve_context_callsites_ast_test.go
@@ -0,0 +1,40 @@
+package main
+
+import (
+	"regexp"
+	"testing"
+)
+
+// TestResolveWithContextRegexBlindspot demonstrates the failure mode of the
+// ad-hoc regex used by TestAllResolveWithContextCallSitesPassNonNilContext.
+//
+// Issue #1199 (item 1): the regex `resolveWithContext\s*\(\s*([^,]+?)\s*,\s*
+// ([^,]+?)\s*,` greedily splits on the FIRST comma. Any nested call in arg1
+// (e.g. `getHop(a, b)`) makes the regex capture `b)` as arg2 and the real
+// `nil` arg2 sails past the gate.
+//
+// RED: this test asserts the regex correctly flags the synthetic offender
+// below. It does not — the regex returns 0 offenders for input that clearly
+// passes nil as the resolver's context arg. Test fails ⇒ proves the gate has
+// a hole. GREEN follow-up replaces the regex with a go/parser AST walk.
+func TestResolveWithContextRegexBlindspot(t *testing.T) {
+	src := `package x
+
+func f() {
+	pm.resolveWithContext(getHop(a, b), nil, graph)
+}
+`
+	re := regexp.MustCompile(`resolveWithContext\s*\(\s*([^,]+?)\s*,\s*([^,]+?)\s*,`)
+	matches := re.FindAllStringSubmatch(src, -1)
+	offenders := 0
+	for _, m := range matches {
+		if m[2] == "nil" {
+			offenders++
+		}
+	}
+	if offenders == 0 {
+		t.Fatalf("regex blindspot confirmed: synthetic source contains a nil context "+
+			"call that the regex misses (parsed %d call(s), 0 flagged). The static-grep "+
+			"gate must be replaced with a go/parser AST walk.", len(matches))
+	}
+}