fix(clawrouter): keep sanitized ids collision-resistant

steipete · steipete · commit c67249675d9a · 2026-07-18T02:02:50.000+01:00
diff --git a/extensions/clawrouter/index.test.ts b/extensions/clawrouter/index.test.ts
@@ -220,6 +220,43 @@ describe("ClawRouter plugin", () => {
     );
   });
 
+  it("keeps encoded and lone-surrogate attribution ids distinct", () => {
+    const captured: string[] = [];
+    const captureAgentId = (agentId: string) => {
+      const wrapped = wrapClawRouterProviderStream({
+        provider: "clawrouter",
+        modelId: "openai/gpt-5.5",
+        agentId,
+        streamFn: ((model) => {
+          captured.push(model.headers?.["X-ClawRouter-Agent-Id"] ?? "");
+          return {} as ReturnType<StreamFn>;
+        }) satisfies StreamFn,
+      } as never);
+      void wrapped?.(
+        {
+          provider: "clawrouter",
+          api: "openai-responses",
+          id: "openai/gpt-5.5",
+        } as never,
+        {} as never,
+        {} as never,
+      );
+    };
+
+    captureAgentId("agent-😀");
+    captureAgentId(captured[0]!);
+    captureAgentId("agent-\uD800");
+    captureAgentId("agent-\uD801");
+
+    expect(captured).toHaveLength(4);
+    expect(captured[1]).not.toBe(captured[0]);
+    expect(captured[2]).not.toBe(captured[3]);
+    for (const value of captured) {
+      expect(value).toMatch(/^[\x20-\x7E]+$/u);
+      expect(() => new Headers({ "X-ClawRouter-Agent-Id": value })).not.toThrow();
+    }
+  });
+
   it("keeps an explicit per-request header ahead of the automatic model-call id", () => {
     const calls: Array<{
       model: Parameters<StreamFn>[0];
diff --git a/extensions/clawrouter/stream.ts b/extensions/clawrouter/stream.ts
@@ -1,3 +1,4 @@
+import { Buffer } from "node:buffer";
 import { createHash } from "node:crypto";
 import type { StreamFn } from "openclaw/plugin-sdk/agent-core";
 import type { ProviderWrapStreamFnContext } from "openclaw/plugin-sdk/plugin-entry";
@@ -15,21 +16,26 @@ const REQUEST_ID_PATTERN = /^[A-Za-z0-9._~:/+@=-]+$/u;
 const REQUEST_ID_UNSAFE_CHARACTER_PATTERN = /[^A-Za-z0-9._~:/+@=-]/gu;
 const ATTRIBUTION_PRINTABLE_ASCII_PATTERN = /^[\x20-\x7E]+$/u;
 const ATTRIBUTION_NON_PRINTABLE_ASCII_PATTERN = /[^\x20-\x7E]/gu;
+const ATTRIBUTION_ENCODED_SUFFIX_PATTERN = /~[a-f0-9]{16}$/u;
 const REQUEST_ID_SUFFIX_PATTERN = /:model:\d+$/u;
+const REQUEST_ID_ENCODED_SUFFIX_PATTERN = /~[a-f0-9]{16}(?::model:\d+)?$/u;
 
 type BoundedIdPolicy = {
+  encodedSuffixPattern: RegExp;
   maxLength: number;
   safePattern: RegExp;
   unsafeCharacterPattern: RegExp;
   preservedSuffixPattern?: RegExp;
 };
 
 const ATTRIBUTION_ID_POLICY: BoundedIdPolicy = {
+  encodedSuffixPattern: ATTRIBUTION_ENCODED_SUFFIX_PATTERN,
   maxLength: ATTRIBUTION_VALUE_MAX_LENGTH,
   safePattern: ATTRIBUTION_PRINTABLE_ASCII_PATTERN,
   unsafeCharacterPattern: ATTRIBUTION_NON_PRINTABLE_ASCII_PATTERN,
 };
 const REQUEST_ID_POLICY: BoundedIdPolicy = {
+  encodedSuffixPattern: REQUEST_ID_ENCODED_SUFFIX_PATTERN,
   maxLength: REQUEST_ID_MAX_LENGTH,
   safePattern: REQUEST_ID_PATTERN,
   unsafeCharacterPattern: REQUEST_ID_UNSAFE_CHARACTER_PATTERN,
@@ -59,12 +65,20 @@ function sanitizeBoundedId(value: string | undefined, policy: BoundedIdPolicy):
   if (!normalized) {
     return undefined;
   }
-  if (normalized.length <= policy.maxLength && policy.safePattern.test(normalized)) {
+  if (
+    normalized.length <= policy.maxLength &&
+    policy.safePattern.test(normalized) &&
+    !policy.encodedSuffixPattern.test(normalized)
+  ) {
     return normalized;
   }
-  // Fetch converts header values to ByteString. Keep automatic IDs ASCII,
-  // bounded, readable, and collision-resistant before transport construction.
-  const hash = createHash("sha256").update(normalized).digest("hex").slice(0, ID_HASH_LENGTH);
+  // Hash UTF-16 code units losslessly: UTF-8 string hashing replaces lone
+  // surrogates with U+FFFD. The reserved encoded suffix keeps a rewritten ID
+  // from aliasing an otherwise safe input that already looks encoded.
+  const hash = createHash("sha256")
+    .update(Buffer.from(normalized, "utf16le"))
+    .digest("hex")
+    .slice(0, ID_HASH_LENGTH);
   const preservedSuffix = policy.preservedSuffixPattern?.exec(normalized)?.[0] ?? "";
   const rawPrefix = preservedSuffix ? normalized.slice(0, -preservedSuffix.length) : normalized;
   const safePrefix = rawPrefix.replace(policy.unsafeCharacterPattern, "_");
