fix(exec): preserve action-critical auth/setup prompt lines during output truncation

wanyongstar · wanyongstar · commit c169cddd50f7 · 2026-06-24T17:43:09.000+08:00
When runCommandWithTimeout output exceeds maxOutputBytes, appendCapturedOutput keeps only the tail of captured stdout/stderr. Device-code login prompts (login URL, device code, next-action instruction) at the beginning are silently dropped, making auth prompts unactionable. This adds: - src/process/action-critical-output.ts: shared classifier with 13 regex patterns for device-login URLs, verification codes, callback URLs, and explicit next-action instructions - CapturedOutputBuffers.headChunks: bounded head buffer (maxOutputBytes) to recover action-critical lines from early output - CapturedOutputBuffers.preservedActionCritical: stores lines extracted from chunks dropped during truncation - buildCaptureResult(): integrates preserved lines + truncation notice into final stdout/stderr output The classifier is designed for shared use with broadcast redaction (PR #95809). Closes #96346
diff --git a/src/process/action-critical-output.test.ts b/src/process/action-critical-output.test.ts
@@ -0,0 +1,128 @@
+// Tests for action-critical output classifier.
+import { describe, expect, it } from "vitest";
+import {
+  extractActionCriticalLines,
+  hasActionCriticalContent,
+  isActionCriticalLine,
+} from "./action-critical-output.js";
+
+describe("isActionCriticalLine", () => {
+  it("detects Microsoft device-login URLs", () => {
+    expect(isActionCriticalLine("To sign in, use a web browser to open https://login.microsoft.com/device")).toBe(true);
+    expect(isActionCriticalLine("Open https://microsoft.com/devicelogin in your browser")).toBe(true);
+  });
+
+  it("detects device/verification codes", () => {
+    expect(isActionCriticalLine("and enter the code FAKE-CODE-270 to authenticate.")).toBe(true);
+    expect(isActionCriticalLine("Your verification code is: ABCD-1234-EFGH")).toBe(true);
+    expect(isActionCriticalLine("Setup code: 1234-5678")).toBe(true);
+    expect(isActionCriticalLine("Device code: WXYZ-9876")).toBe(true);
+    expect(isActionCriticalLine("enter this code: XXXXX-YYYYY")).toBe(true);
+  });
+
+  it("detects localhost callback URLs", () => {
+    expect(isActionCriticalLine("Open http://localhost:9876 to complete setup")).toBe(true);
+    expect(isActionCriticalLine("Callback: http://127.0.0.1:3000/callback")).toBe(true);
+  });
+
+  it("detects explicit next-action instructions", () => {
+    expect(isActionCriticalLine("To sign in, open a web browser")).toBe(true);
+    expect(isActionCriticalLine("Go to https://example.com/activate")).toBe(true);
+    expect(isActionCriticalLine("Copy this code and paste it in the browser")).toBe(true);
+    expect(isActionCriticalLine("Use this URL to authenticate")).toBe(true);
+  });
+
+  it("returns false for ordinary output lines", () => {
+    expect(isActionCriticalLine("Starting build process...")).toBe(false);
+    expect(isActionCriticalLine("CRON-FILLER-270-line-1")).toBe(false);
+    expect(isActionCriticalLine("DONE")).toBe(false);
+    expect(isActionCriticalLine("Error: file not found")).toBe(false);
+    expect(isActionCriticalLine("")).toBe(false);
+    expect(isActionCriticalLine("[INFO] Task completed successfully")).toBe(false);
+  });
+
+  it("returns false for URLs without auth context", () => {
+    expect(isActionCriticalLine("Download from https://example.com/file.zip")).toBe(false);
+    expect(isActionCriticalLine("See https://docs.example.com for more info")).toBe(false);
+  });
+});
+
+describe("hasActionCriticalContent", () => {
+  it("returns true when multi-line text contains action-critical content", () => {
+    const text = [
+      "Starting job...",
+      "To sign in, use a web browser to open https://login.microsoft.com/device",
+      "and enter the code FAKE-CODE-270 to authenticate.",
+      "Job complete.",
+    ].join("\n");
+    expect(hasActionCriticalContent(text)).toBe(true);
+  });
+
+  it("returns false for ordinary multi-line text", () => {
+    const text = [
+      "line 1",
+      "line 2",
+      "line 3",
+    ].join("\n");
+    expect(hasActionCriticalContent(text)).toBe(false);
+  });
+
+  it("returns true for empty-adjacent content (edge)", () => {
+    expect(hasActionCriticalContent("https://login.microsoft.com/device")).toBe(true);
+    expect(hasActionCriticalContent("")).toBe(false);
+  });
+});
+
+describe("extractActionCriticalLines", () => {
+  it("extracts action-critical lines from mixed output", () => {
+    const text = [
+      "Filler line 1",
+      "To sign in, use a web browser to open https://login.microsoft.com/device",
+      "and enter the code FAKE-CODE-270 to authenticate.",
+      "Filler line 2",
+    ].join("\n");
+
+    const lines = extractActionCriticalLines(text);
+    expect(lines).toHaveLength(2);
+    expect(lines[0]).toContain("login.microsoft.com");
+    expect(lines[1]).toContain("FAKE-CODE-270");
+  });
+
+  it("returns empty array when no action-critical lines present", () => {
+    const text = [
+      "line 1",
+      "line 2",
+    ].join("\n");
+    expect(extractActionCriticalLines(text)).toEqual([]);
+  });
+
+  it("returns empty array for empty string", () => {
+    expect(extractActionCriticalLines("")).toEqual([]);
+  });
+
+  it("deduplicates identical lines (via caller, but this is the raw extract)", () => {
+    const text = [
+      "To sign in, open https://login.microsoft.com/device",
+      "Filler",
+      "To sign in, open https://login.microsoft.com/device",
+    ].join("\n");
+    const lines = extractActionCriticalLines(text);
+    // Raw extract does not deduplicate — that's the caller's responsibility.
+    expect(lines).toHaveLength(2);
+  });
+
+  it("preserves line order", () => {
+    const text = [
+      "Filler A",
+      "To sign in, open https://login.microsoft.com/device",
+      "Filler B",
+      "Your verification code is: ABCD-1234",
+      "Filler C",
+    ].join("\n");
+
+    const lines = extractActionCriticalLines(text);
+    expect(lines).toHaveLength(2);
+    expect(lines[0]).toContain("login.microsoft.com");
+    expect(lines[1]).toContain("ABCD-1234");
+  });
+});
diff --git a/src/process/action-critical-output.ts b/src/process/action-critical-output.ts
@@ -0,0 +1,70 @@
+/**
+ * Shared classifier for action-critical output lines.
+ *
+ * Identifies lines that must be preserved in interactive command results
+ * (auth/setup prompts, device codes, callback URLs) and redacted in
+ * broadcast delivery.
+ *
+ * Used by:
+ * - Interactive/async truncation preservation (issue #96346)
+ * - Cron broadcast delivery redaction (PR #95809)
+ *
+ * Design invariant: classification is stateless and line-based.
+ * A line is action-critical if it matches any of the patterns below.
+ */
+
+// Patterns for action-critical lines.
+// Each pattern is tested against individual lines (not multi-line text).
+const ACTION_CRITICAL_PATTERNS: readonly RegExp[] = [
+  // Device-login URLs
+  /login\.microsoft\.com\/device/i,
+  /microsoft\.com\/devicelogin/i,
+
+  // Device/setup/verification code patterns
+  /code:\s*\w{4,}(?:[-\s]\w{4,})+/, // code: XXXX-XXXX or code: XXXX XXXX
+  /enter the code\s/i,
+  /enter this code/i,
+  /verification code/i,
+  /setup code/i,
+  /device code/i,
+
+  // Localhost/device/callback URLs
+  /https?:\/\/localhost:\d+/,
+  /https?:\/\/127\.0\.0\.1:\d+/,
+
+  // Explicit next-action instructions
+  /(?:enter|use|copy|paste|open)\s+(?:this|the)\s+(?:code|url|link|page)/i,
+  /to\s+(?:sign\s+in|authenticate|continue|complete)/i,
+  /open\s+(?:a\s+)?(?:web\s+)?browser/i,
+  /go to\s+(?:https?:\/\/)/i,
+];
+
+/**
+ * Returns true if the given line contains action-critical content
+ * that should be preserved during output truncation.
+ */
+export function isActionCriticalLine(line: string): boolean {
+  return ACTION_CRITICAL_PATTERNS.some((pattern) => pattern.test(line));
+}
+
+/**
+ * Extracts all action-critical lines from a multi-line text string.
+ * Empty lines and lines without action-critical content are excluded.
+ */
+export function extractActionCriticalLines(text: string): string[] {
+  const result: string[] = [];
+  for (const line of text.split("\n")) {
+    if (isActionCriticalLine(line)) {
+      result.push(line);
+    }
+  }
+  return result;
+}
+
+/**
+ * Returns true if the text contains any action-critical content.
+ * Faster than extractActionCriticalLines when you only need a boolean.
+ */
+export function hasActionCriticalContent(text: string): boolean {
+  return ACTION_CRITICAL_PATTERNS.some((pattern) => pattern.test(text));
+}
diff --git a/src/process/exec.ts b/src/process/exec.ts
@@ -7,6 +7,10 @@ import { promisify } from "node:util";
 import { normalizeLowercaseStringOrEmpty } from "@openclaw/normalization-core/string-coerce";
 import { danger, shouldLogVerbose } from "../globals.js";
 import { markOpenClawExecEnv } from "../infra/openclaw-exec-env.js";
+import {
+  extractActionCriticalLines,
+  hasActionCriticalContent,
+} from "./action-critical-output.js";
 import { resolveTimerTimeoutMs } from "../shared/number-coercion.js";
 import {
   decodeWindowsOutputBuffer,
@@ -243,6 +247,11 @@ type CapturedOutputBuffers = {
   chunks: Buffer[];
   bytes: number;
   truncatedBytes: number;
+  /** First N bytes of output (bounded by maxOutputBytes). Used to recover action-critical lines when truncation occurs. */
+  headChunks: Buffer[];
+  headBytes: number;
+  /** Action-critical lines extracted from dropped data during truncation. */
+  preservedActionCritical: string[];
 };
 
 function normalizeMaxOutputBytes(value: number | undefined): number {
@@ -258,7 +267,26 @@ function appendCapturedOutput(
   maxBytes: number,
 ): void {
   const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+
+  // Track head data (bounded by maxBytes) for action-critical line recovery.
+  if (capture.headBytes < maxBytes) {
+    const headRoom = maxBytes - capture.headBytes;
+    const headChunk = buffer.subarray(0, Math.min(headRoom, buffer.byteLength));
+    capture.headChunks.push(Buffer.from(headChunk));
+    capture.headBytes += headChunk.byteLength;
+  }
+
   if (buffer.byteLength >= maxBytes) {
+    // Single chunk exceeds the limit. Replace the entire tail with the last maxBytes.
+    // Preserve action-critical lines from all accumulated data before replacement.
+    preserveActionCriticalFromCapture(capture, maxBytes);
+
+    // Also scan the current chunk for action-critical lines.
+    const chunkText = buffer.toString();
+    if (hasActionCriticalContent(chunkText)) {
+      capture.preservedActionCritical.push(...extractActionCriticalLines(chunkText));
+    }
+
     capture.chunks = [Buffer.from(buffer.subarray(buffer.byteLength - maxBytes))];
     capture.truncatedBytes += capture.bytes + buffer.byteLength - maxBytes;
     capture.bytes = maxBytes;
@@ -274,13 +302,90 @@ function appendCapturedOutput(
       capture.chunks.shift();
       capture.bytes -= first.byteLength;
       capture.truncatedBytes += first.byteLength;
+      // Scan dropped chunk for action-critical lines.
+      const droppedText = first.toString();
+      if (hasActionCriticalContent(droppedText)) {
+        capture.preservedActionCritical.push(...extractActionCriticalLines(droppedText));
+      }
     } else {
+      const droppedText = first.subarray(0, overflow).toString();
       capture.chunks[0] = Buffer.from(first.subarray(overflow));
       capture.bytes -= overflow;
       capture.truncatedBytes += overflow;
+      // Scan dropped portion for action-critical lines.
+      if (hasActionCriticalContent(droppedText)) {
+        capture.preservedActionCritical.push(...extractActionCriticalLines(droppedText));
+      }
     }
   }
 }
+
+/**
+ * Extract action-critical lines from head (first maxBytes of output) when
+ * truncation has occurred. Used before a single oversized chunk replaces
+ * the entire tail buffer.
+ */
+function preserveActionCriticalFromCapture(
+  capture: CapturedOutputBuffers,
+  maxBytes: number,
+): void {
+  if (capture.chunks.length === 0) {
+    return;
+  }
+  const headText = Buffer.concat(capture.headChunks, capture.headBytes).toString();
+  if (hasActionCriticalContent(headText)) {
+    capture.preservedActionCritical.push(...extractActionCriticalLines(headText));
+  }
+}
+
+/**
+ * Build the final output string from captured buffers.
+ * When truncation occurred, preserved action-critical lines are prepended
+ * and a truncation notice is appended. When no truncation occurred,
+ * the raw tail is returned as-is.
+ */
+function buildCaptureResult(
+  capture: CapturedOutputBuffers,
+  windowsEncoding: string,
+): string {
+  const tail = decodeWindowsOutputBuffer({
+    buffer: Buffer.concat(capture.chunks, capture.bytes),
+    windowsEncoding,
+  });
+
+  if (capture.truncatedBytes > 0 || capture.preservedActionCritical.length > 0) {
+    const recoveryHint =
+      capture.truncatedBytes > 0
+        ? ' For full output, use "openclaw cron runs --id <job> --run-id <run>"'
+        : "";
+    const truncatedNotice = `[output truncated: ${capture.truncatedBytes} bytes]${recoveryHint}`;
+
+    if (
+      capture.preservedActionCritical.length > 0 &&
+      (capture.truncatedBytes > 0 || capture.chunks.length > 0)
+    ) {
+      // Deduplicate preserved lines (they may appear in both head and dropped chunks).
+      const seen = new Set<string>();
+      const uniqueLines = capture.preservedActionCritical.filter((l) => {
+        const key = l.trim().toLowerCase();
+        if (seen.has(key)) return false;
+        seen.add(key);
+        return true;
+      });
+
+      if (uniqueLines.length > 0) {
+        return `${uniqueLines.join("\n")}\n\n${tail}\n${truncatedNotice}`;
+      }
+    }
+
+    // Truncated but no (unique) action-critical lines preserved.
+    return tail + (tail ? "\n" : "") + truncatedNotice;
+  }
+
+  // No truncation — return raw tail as-is.
+  return tail;
+}
+
 export function resolveProcessExitCode(params: {
   explicitCode: number | null | undefined;
   childExitCode: number | null | undefined;
@@ -382,8 +487,22 @@ export async function runCommandWithTimeout(
   });
   // Spawn with inherited stdin (TTY) so interactive tools stay usable when needed.
   return await new Promise((resolve, reject) => {
-    const stdoutCapture: CapturedOutputBuffers = { chunks: [], bytes: 0, truncatedBytes: 0 };
-    const stderrCapture: CapturedOutputBuffers = { chunks: [], bytes: 0, truncatedBytes: 0 };
+    const stdoutCapture: CapturedOutputBuffers = {
+      chunks: [],
+      bytes: 0,
+      truncatedBytes: 0,
+      headChunks: [],
+      headBytes: 0,
+      preservedActionCritical: [],
+    };
+    const stderrCapture: CapturedOutputBuffers = {
+      chunks: [],
+      bytes: 0,
+      truncatedBytes: 0,
+      headChunks: [],
+      headBytes: 0,
+      preservedActionCritical: [],
+    };
     const maxOutputBytes = normalizeMaxOutputBytes(options.maxOutputBytes);
     const windowsEncoding = resolveWindowsConsoleEncoding();
     let settled = false;
@@ -598,14 +717,8 @@ export async function runCommandWithTimeout(
           : resolvedCode;
       resolve({
         pid: child.pid ?? undefined,
-        stdout: decodeWindowsOutputBuffer({
-          buffer: Buffer.concat(stdoutCapture.chunks, stdoutCapture.bytes),
-          windowsEncoding,
-        }),
-        stderr: decodeWindowsOutputBuffer({
-          buffer: Buffer.concat(stderrCapture.chunks, stderrCapture.bytes),
-          windowsEncoding,
-        }),
+        stdout: buildCaptureResult(stdoutCapture, windowsEncoding),
+        stderr: buildCaptureResult(stderrCapture, windowsEncoding),
         stdoutTruncatedBytes: stdoutCapture.truncatedBytes || undefined,
         stderrTruncatedBytes: stderrCapture.truncatedBytes || undefined,
         code: normalizedCode,
