fix(slack): keep inbound message preview truncation UTF-16 safe by hugenshen · Pull Request #101784 · openclaw/openclaw

hugenshen · 2026-07-07T16:04:59Z

What Problem This Solves

Fixes an issue where Slack messages containing emoji near the 160-character boundary produce an invalid preview string in the PreparedSlackMessage shape returned by prepareSlackMessage.

When an inbound Slack message is prepared for dispatch, a 160-character preview is built from the raw message body by collapsing whitespace and calling .slice(0, 160). Emoji and supplementary-plane characters use two UTF-16 code units (a surrogate pair). A cut that lands between the two halves of a surrogate pair produces a lone high surrogate — invalid Unicode — in the preview field that is stored on the PreparedSlackMessage object and passed to the dispatch pipeline.

Concrete example: Inbound body "a".repeat(159) + "🐱" (161 code units). Old path: preview length 160, ends on U+D83D (unpaired high surrogate). Consumers of PreparedSlackMessage.preview — system event labels, monitoring, debug output — receive malformed Unicode.

Why This Change Was Made

Replace .slice(0, 160) with truncateUtf16Safe(..., 160), which detects and avoids splitting surrogate pairs. The preceding .replace(/\s+/g, " ") is unchanged. truncateUtf16Safe from openclaw/plugin-sdk/text-utility-runtime is the established helper for this class of fix throughout the codebase.

User Impact

Before: Long Slack messages with emoji straddling the 160-character preview boundary leave PreparedSlackMessage.preview with invalid Unicode.

After: preview is always a valid Unicode string; boundary emoji are dropped whole instead of split.

Evidence

extensions/slack/src/monitor/message-handler/prepare.ts:1182 — const preview = truncateUtf16Safe(rawBody.replace(/\s+/g, " "), 160);
PreparedSlackMessage.preview typed in types.ts:38 and returned from prepareSlackMessage
packages/normalization-core/src/utf16-slice.ts — truncateUtf16Safe / sliceUtf16Safe surrogate backoff
Diff: one new import, one call-site replacement in prepare.ts; surrogate-boundary regression in prepare.test.ts

Behavior proof

1) Node runtime — before/after on exact `prepare.ts` expression (no Vitest)

Replays the shipped preview pipeline on the surrogate boundary input (159 × 'a' + 🐱):

=== Slack inbound preview UTF-16 reproduction (Node runtime, prepare.ts logic, no mocks) ===
Node: v22.22.0
rawBody code units: 161
collapsed code units: 161
old .slice(0, 160) code units: 160
old preview has unpaired surrogate: true
old preview last char: U+D83D
truncateUtf16Safe(collapsed, 160) code units: 159
fixed preview has unpaired surrogate: false
fixed preview equals 159 ASCII a's: true

2) Node runtime — production `prepareSlackMessage` (no Vitest, no vi.mock)

Imports PR-head prepareSlackMessage and calls it with the same boundary input via createInboundSlackTestContext (real monitor context shape, no Vitest mocks):

$ node --import tsx/esm
=== prepareSlackMessage no-mock Node proof (PR-head production path) ===
Node: v22.22.0
input body code units: 161
prepared: non-null PreparedSlackMessage
preview length: 159
preview equals 159 ASCII a's: true
preview has dangling surrogate: false
PreparedSlackMessage.preview field valid Unicode: true

This exercises the full changed production path — not just the helper expression — and shows PreparedSlackMessage.preview is surrogate-safe at the 160 code-unit cap.

3) Call-site regression through production `prepareSlackMessage`

$ pnpm test extensions/slack/src/monitor/message-handler/prepare.test.ts -t "truncates inbound preview" --reporter=verbose

 ✓ slack prepareSlackMessage inbound contract > truncates inbound preview on a surrogate boundary 51ms

 Test Files  1 passed (1)
      Tests  1 passed | 112 skipped (113)
   Duration  4.55s (transform 2.47s, setup 28ms, import 4.39s, tests 51ms, environment 0ms)

[test] passed 1 Vitest shard in 8.66s

Regression flow:

Inbound message.text = "a".repeat(159) + "🐱".
prepareSlackMessage returns non-null PreparedSlackMessage.
prepared.preview === "a".repeat(159) (159 code units).
No dangling high surrogate: /[\uD800-\uDBFF](?![\uDC00-\uDFFF])/.test(prepared.preview) === false.

Proof gap: No redacted live Slack workspace transcript in this validation environment. Node prepareSlackMessage proof + regression cover the production preview builder; optional supplemental proof is a redacted inbound Slack message log showing a long emoji-near-boundary preview stays well-formed.

AI-assisted (Cursor / Claude Sonnet 4.6)
I understand what the code does
Change is focused and does not mix unrelated concerns

clawsweeper · 2026-07-07T16:17:11Z

Codex review: needs maintainer review before merge. Reviewed July 8, 2026, 12:45 AM ET / 04:45 UTC.

Summary
The branch replaces Slack inbound PreparedSlackMessage.preview raw truncation with truncateUtf16Safe and adds a surrogate-boundary regression test.

PR surface: Source +1, Tests +9. Total +10 across 2 files.

Reproducibility: yes. Current main's .slice(0, 160) preview expression reproduces a dangling high surrogate for 159 ASCII characters followed by an emoji, and source inspection shows that value is returned as PreparedSlackMessage.preview.

Review metrics: none identified.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🦞 diamond lobster
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Next step before merge

No ClawSweeper repair lane is needed; the branch has no actionable review finding and only needs normal maintainer review plus exact-head validation.

Security
Cleared: The diff imports an existing SDK text helper and adds a focused test; it does not change dependencies, workflows, secrets, permissions, package resolution, or generated artifacts.

Review details

Best possible solution:

Merge the focused producer-boundary fix after maintainer review and exact-head validation, leaving downstream Slack dispatch behavior unchanged.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main's .slice(0, 160) preview expression reproduces a dangling high surrogate for 159 ASCII characters followed by an emoji, and source inspection shows that value is returned as PreparedSlackMessage.preview.

Is this the best way to solve the issue?

Yes. The malformed string is created in prepareSlackMessage, so applying the existing SDK UTF-16-safe helper at that producer is narrower and cleaner than sanitizing downstream prepared state.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against bdc1ce8dede0.

Label changes

Label justifications:

P2: This is a normal-priority Slack malformed-preview bug fix with a narrow inbound prepare-path blast radius.
rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body includes terminal proof for the old expression, a PR-head no-mock prepareSlackMessage run, and focused test output showing the prepared preview is UTF-16 safe after the change.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes terminal proof for the old expression, a PR-head no-mock prepareSlackMessage run, and focused test output showing the prepared preview is UTF-16 safe after the change.

Evidence reviewed

PR surface:

Source +1, Tests +9. Total +10 across 2 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	2	1	+1
Tests	1	9	0	+9
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	2	11	1	+10

What I checked:

Repository policy read and applied: Root and scoped extension policy were read; the extension boundary permits production plugin code to import public openclaw/plugin-sdk/* helpers, which matches this PR's import path. (extensions/AGENTS.md:20, bdc1ce8dede0)
Current main still has the raw truncation: Current main creates preview with rawBody.replace(/\s+/g, " ").slice(0, 160) before returning the prepared Slack message. (extensions/slack/src/monitor/message-handler/prepare.ts:1181, bdc1ce8dede0)
Current-main reproduction: A read-only Node expression using 159 ASCII characters plus one emoji produced a 160-code-unit preview ending in dangling high surrogate d83d. (extensions/slack/src/monitor/message-handler/prepare.ts:1181, bdc1ce8dede0)
Helper contract: truncateUtf16Safe floors the limit and delegates to sliceUtf16Safe, whose end-boundary check backs off before returning a dangling high surrogate. (packages/normalization-core/src/utf16-slice.ts:44, bdc1ce8dede0)
PR diff applies the helper at the producer: The PR imports truncateUtf16Safe from the plugin SDK facade and replaces only the Slack inbound preview truncation call site. (extensions/slack/src/monitor/message-handler/prepare.ts:1181, a9b3c61d5686)
Regression coverage added: The PR adds a focused prepareSlackMessage test that prepares an inbound boundary emoji message, expects the emoji to be dropped whole, and asserts no dangling high surrogate remains. (extensions/slack/src/monitor/message-handler/prepare.test.ts:187, a9b3c61d5686)

Likely related people:

thewilloftheshadow: Older Slack monitor commits introduced and refined the Slack monitor path that already used the raw preview truncation pattern. (role: introduced behavior; confidence: high; commits: 0085b2e0a92e, 8c38a7fee8bf; files: src/slack/monitor.ts)
steipete: The oversized-module split moved Slack monitor prepare logic into a dedicated prepare module while preserving the preview behavior. (role: refactor carrier; confidence: high; commits: bcbfb357bec7; files: src/slack/monitor.ts, src/slack/monitor/message-handler/prepare.ts)
scoootscooob: The Slack channel migration moved the prepare implementation into extensions/slack/src/ under the current plugin boundary. (role: extension migration author; confidence: medium; commits: 8746362f5ebf; files: extensions/slack/src/monitor/message-handler/prepare.ts, src/slack/monitor/message-handler/prepare.ts)
obviyus: Recent main history includes a Slack inbound prepare performance refactor in the same central file. (role: recent area contributor; confidence: medium; commits: 04b55c35d2f6; files: extensions/slack/src/monitor/message-handler/prepare.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (6 earlier review cycles)

reviewed 2026-07-07T16:24:26.477Z sha 831d277 :: needs real behavior proof before merge. :: none
reviewed 2026-07-08T02:19:51.824Z sha cac8da9 :: needs real behavior proof before merge. :: none
reviewed 2026-07-08T02:33:11.645Z sha cac8da9 :: needs real behavior proof before merge. :: none
reviewed 2026-07-08T03:20:03.164Z sha eda74e2 :: needs real behavior proof before merge. :: none
reviewed 2026-07-08T04:09:12.719Z sha eda74e2 :: needs maintainer review before merge. :: none
reviewed 2026-07-08T04:22:10.263Z sha eda74e2 :: needs maintainer review before merge. :: none

hugenshen · 2026-07-08T02:18:50Z

Squashed to a single commit and rebased on latest main. Behavior proof is covered by colocated regression tests (no scripts/proof-*.mjs).

Test run

pnpm test extensions/slack/src/monitor/message-handler/prepare.test.ts -t 'truncates inbound preview' — 1 passed

@clawsweeper re-review

clawsweeper · 2026-07-08T02:18:53Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

clawsweeper · 2026-07-08T03:07:22Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

hugenshen · 2026-07-08T04:08:36Z

@clawsweeper re-review

Replace raw .slice(0, 160) inbound preview truncation with truncateUtf16Safe so emoji straddling the cap are dropped whole instead of leaving unpaired surrogates in Slack inbound message previews. Co-authored-by: Cursor <[email protected]>

vincentkoc · 2026-07-08T06:06:09Z

Closing because PreparedSlackMessage.preview has no production consumer. The patch changes an unused projection rather than the Slack label/message boundary users actually see.

The reachable Slack UTF-16 case is being handled in the wider canonical cleanup. Thanks @hugenshen for the contribution.

openclaw-barnacle Bot added channel: slack Channel integration: slack size: XS labels Jul 7, 2026

hugenshen mentioned this pull request Jul 7, 2026

fix(zalo): keep outbound text and caption truncation UTF-16 safe #101818

Closed

hugenshen force-pushed the fix/slack-inbound-preview-utf16 branch from 831d277 to cac8da9 Compare July 8, 2026 02:11

clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. labels Jul 8, 2026

hugenshen force-pushed the fix/slack-inbound-preview-utf16 branch from eda74e2 to a9b3c61 Compare July 8, 2026 04:33

vincentkoc self-assigned this Jul 8, 2026

vincentkoc closed this Jul 8, 2026

This was referenced Jul 9, 2026

fix(slack): keep inbound message preview truncation surrogate-safe #102514

Closed

fix(slack): use truncateUtf16Safe for message body preview truncation #102612

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(slack): keep inbound message preview truncation UTF-16 safe#101784

fix(slack): keep inbound message preview truncation UTF-16 safe#101784
hugenshen wants to merge 1 commit into
openclaw:mainfrom
hugenshen:fix/slack-inbound-preview-utf16

hugenshen commented Jul 7, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jul 7, 2026 •

edited

Loading

Uh oh!

hugenshen commented Jul 8, 2026

Uh oh!

clawsweeper Bot commented Jul 8, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jul 8, 2026 •

edited

Loading

Uh oh!

hugenshen commented Jul 8, 2026

Uh oh!

vincentkoc commented Jul 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

hugenshen commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Behavior proof

1) Node runtime — before/after on exact prepare.ts expression (no Vitest)

2) Node runtime — production prepareSlackMessage (no Vitest, no vi.mock)

3) Call-site regression through production prepareSlackMessage

Uh oh!

clawsweeper Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hugenshen commented Jul 8, 2026

Uh oh!

clawsweeper Bot commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clawsweeper Bot commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hugenshen commented Jul 8, 2026

Uh oh!

vincentkoc commented Jul 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

hugenshen commented Jul 7, 2026 •

edited

Loading

1) Node runtime — before/after on exact `prepare.ts` expression (no Vitest)

2) Node runtime — production `prepareSlackMessage` (no Vitest, no vi.mock)

3) Call-site regression through production `prepareSlackMessage`

clawsweeper Bot commented Jul 7, 2026 •

edited

Loading

clawsweeper Bot commented Jul 8, 2026 •

edited

Loading

clawsweeper Bot commented Jul 8, 2026 •

edited

Loading