fix(qa-lab): keep capture preview truncation UTF-16 safe

cxbAsDev · cxbAsDev · commit 4ae40f20e871 · 2026-07-09T20:09:49.000+08:00
diff --git a/extensions/qa-lab/web/src/ui-render.test.ts b/extensions/qa-lab/web/src/ui-render.test.ts
@@ -1,6 +1,6 @@
 // Qa Lab UI render tests cover evidence gallery affordances.
 import { describe, expect, it } from "vitest";
-import { renderQaLabUi, type UiState } from "./ui-render.js";
+import { redactCaptureScalar, renderQaLabUi, type UiState } from "./ui-render.js";
 
 function evidenceState(overrides: Partial<UiState> = {}): UiState {
   return {
@@ -411,3 +411,34 @@ describe("QA Lab UI evidence render", () => {
     expect(html).not.toContain("secret-token");
   });
 });
+
+describe("redactCaptureScalar", () => {
+  it("keeps long capture previews UTF-16 safe when an emoji crosses the head boundary", () => {
+    const prefix = "a".repeat(279);
+    const value = `${prefix}😀${"b".repeat(200)}`;
+
+    const result = redactCaptureScalar(value);
+
+    expect(result).toContain(prefix);
+    expect(result).toContain("…");
+    expect(result).not.toContain("😀");
+    // A naive .slice(0, 280) would leave a dangling high surrogate at index 279.
+    expect(
+      Array.from(result).every((c) => c.charCodeAt(0) < 0xd800 || c.charCodeAt(0) > 0xdbff),
+    ).toBe(true);
+  });
+
+  it("keeps long capture previews UTF-16 safe when an emoji crosses the tail boundary", () => {
+    const suffix = "z".repeat(79);
+    const value = `${"a".repeat(350)}😀${suffix}`;
+
+    const result = redactCaptureScalar(value);
+
+    expect(result).toContain(suffix);
+    expect(result).toContain("…");
+    expect(result).not.toContain("😀");
+    expect(
+      Array.from(result).every((c) => c.charCodeAt(0) < 0xd800 || c.charCodeAt(0) > 0xdbff),
+    ).toBe(true);
+  });
+});
diff --git a/extensions/qa-lab/web/src/ui-render.ts b/extensions/qa-lab/web/src/ui-render.ts
@@ -7,6 +7,31 @@ import type {
   QaEvidenceProducerContextFile,
 } from "../../shared/evidence-gallery-types.js";
 
+/** Slices a UTF-16 string without returning dangling surrogate halves at either edge. */
+function sliceUtf16Safe(input: string, start: number, end?: number): string {
+  const len = input.length;
+  let from = start < 0 ? Math.max(len + start, 0) : Math.min(start, len);
+  let to = end === undefined ? len : end < 0 ? Math.max(len + end, 0) : Math.min(end, len);
+  if (to <= from) {
+    return "";
+  }
+  const isHighSurrogate = (codeUnit: number) => codeUnit >= 0xd800 && codeUnit <= 0xdbff;
+  const isLowSurrogate = (codeUnit: number) => codeUnit >= 0xdc00 && codeUnit <= 0xdfff;
+  if (from > 0 && from < len) {
+    const codeUnit = input.charCodeAt(from);
+    if (isLowSurrogate(codeUnit) && isHighSurrogate(input.charCodeAt(from - 1))) {
+      from += 1;
+    }
+  }
+  if (to > 0 && to < len) {
+    const codeUnit = input.charCodeAt(to - 1);
+    if (isHighSurrogate(codeUnit) && isLowSurrogate(input.charCodeAt(to))) {
+      to -= 1;
+    }
+  }
+  return input.slice(from, to);
+}
+
 /* ===== Shared types (unchanged from the bus protocol) ===== */
 
 type Conversation = {
@@ -560,7 +585,7 @@ function isSensitiveCaptureField(label: string): boolean {
   );
 }
 
-function redactCaptureScalar(value: string, label?: string): string {
+export function redactCaptureScalar(value: string, label?: string): string {
   const trimmed = value.trim();
   if (!trimmed) {
     return "";
@@ -572,7 +597,7 @@ function redactCaptureScalar(value: string, label?: string): string {
     return "[redacted]";
   }
   if (trimmed.length > 400) {
-    return `${trimmed.slice(0, 280)}\n…\n${trimmed.slice(-80)}`;
+    return `${sliceUtf16Safe(trimmed, 0, 280)}\n…\n${sliceUtf16Safe(trimmed, -80)}`;
   }
   return trimmed;
 }
