fix(utils): normalizeE164 returns "" when there are no digits

he-yufeng · he-yufeng · commit 2d40ae3be89d · 2026-06-23T13:04:22.000+08:00
A From with no digits — a blocked caller the carrier reports as "Anonymous",
or a bare "sms://" scheme — normalized to a stray "+", which is not a valid
E.164. Since "+" is truthy, deriveSessionKey's `from || "unknown"` fallback
never fired and those messages landed in a junk "+" session bucket instead of
"unknown". Return "" when there is nothing to normalize so callers fall back as
intended; valid numbers are unaffected.
diff --git a/src/utils.test.ts b/src/utils.test.ts
@@ -8,6 +8,7 @@ import { withEnv } from "./test-utils/env.js";
 import {
   CONFIG_DIR,
   ensureDir,
+  normalizeE164,
   pinConfigDir,
   resolveConfigDir,
   resolveHomeDir,
@@ -17,6 +18,25 @@ import {
   sleep,
 } from "./utils.js";
 
+describe("normalizeE164", () => {
+  it("normalizes phone-like input into loose E.164", () => {
+    expect(normalizeE164("+1 (555) 234-5678")).toBe("+15552345678");
+    expect(normalizeE164("15552345678")).toBe("+15552345678");
+    expect(normalizeE164("tel:+1-555-234-5678")).toBe("+15552345678");
+  });
+
+  it("returns an empty string when there are no digits to normalize", () => {
+    // Carriers report blocked caller id as a literal like "Anonymous", and a
+    // bare scheme such as "sms://" carries no number. These must not collapse to
+    // a stray "+" (not a valid E.164); returning "" lets callers fall back to
+    // their own sentinel (e.g. `from || "unknown"`).
+    expect(normalizeE164("Anonymous")).toBe("");
+    expect(normalizeE164("sms://")).toBe("");
+    expect(normalizeE164("")).toBe("");
+    expect(normalizeE164("+")).toBe("");
+  });
+});
+
 describe("ensureDir", () => {
   it("creates nested directory", async () => {
     await withTempDir({ prefix: "openclaw-test-" }, async (tmp) => {
diff --git a/src/utils.ts b/src/utils.ts
@@ -56,10 +56,14 @@ export function isRecord(value: unknown): value is Record<string, unknown> {
 export function normalizeE164(number: string): string {
   const withoutPrefix = number.replace(/^[a-z][a-z0-9-]*:/i, "").trim();
   const digits = withoutPrefix.replace(/[^\d+]/g, "");
-  if (digits.startsWith("+")) {
-    return `+${digits.slice(1)}`;
+  const bare = digits.startsWith("+") ? digits.slice(1) : digits;
+  if (!bare) {
+    // No digits to normalize (e.g. an "Anonymous" caller id or a bare "sms://"
+    // scheme). Return "" rather than a stray "+", which is not a valid E.164 and
+    // silently defeats caller fallbacks like `from || "unknown"`.
+    return "";
   }
-  return `+${digits}`;
+  return `+${bare}`;
 }
 
 /** Promise-based sleep that clamps timer inputs through the shared timeout resolver. */
