fix: keep task title truncation UTF-16 safe in restart/diagnostic output by wm0018 · Pull Request #101934 · openclaw/openclaw

wm0018 · 2026-07-08T00:56:13Z

What Problem This Solves

Gateway restart diagnostics had three copies of the same task-blocker formatter. Each used task.title.slice(0, 80), so an emoji or supplementary CJK character crossing that UTF-16 boundary could leave a lone surrogate in terminal and log output.

Why This Change Was Made

The final implementation moves the formatter and its truncateUtf16Safe boundary into one side-effect-free task module. The gateway reload handler, restart coordinator, and lazy gateway run loop all call that same formatter; the three duplicate implementations and the helper-only test are gone.

Keeping the helper independent from task-registry maintenance avoids eagerly materializing maintenance/runtime state from the gateway run loop. The restart-blocker type is imported directly from its owner rather than retained through an internal re-export shim.

User Impact

Task titles in restart, reload, and drain diagnostics remain bounded to 80 UTF-16 units without rendering broken replacement characters. Existing ASCII output is unchanged.

Evidence

Exact production-path assertion through createSafeGatewayRestartPreflight: 79 ASCII characters plus a crossing emoji produces 79 ASCII characters, with no lone surrogate.
Existing gateway reload and run-loop suites continue to assert the shared diagnostic output.
Blacksmith Testbox run 28997018899: all three touched suites passed, 103 test executions total.
Fresh structured autoreview on exact head 60d1b4a7f8ad3604daa654387d0dcea4b1ab239d: clean, confidence 0.98.
git diff --check and targeted oxfmt checks passed.
Production diff is net -18 lines across the shared formatter migration.

Risk checklist

Did user-visible behavior change? (Yes/No)
Yes. Broken UTF-16 output at the task-title boundary is repaired.

Did config, environment, or migration behavior change? (Yes/No)
No.

Did security, auth, secrets, network, or tool execution behavior change? (Yes/No)
No.

What is the highest-risk area?
Gateway restart diagnostic formatting.

How is that risk mitigated?
One canonical formatter now owns all three call sites, with exact production-path and existing caller-suite coverage.

Three private copies of formatTaskBlocker share the same pattern — task.title.slice(0, 80) — which can split surrogate pairs in task titles, producing broken U+FFFD in restart blocker diagnostics, gateway reload logs, and CLI run-loop output. Replace raw slice with truncateUtf16Safe in all three locations. Relevant files: - gateway/server-reload-handlers.ts:270 - infra/restart-coordinator.ts:73 - cli/gateway-cli/run-loop.ts:569

clawsweeper · 2026-07-08T00:59:38Z

Codex review: needs real behavior proof before merge. Reviewed July 9, 2026, 2:02 AM ET / 06:02 UTC.

Summary
The PR adds a shared task restart-blocker formatter using truncateUtf16Safe, rewires three gateway restart diagnostic call sites to use it, and adds restart preflight regression coverage.

PR surface: Source -20, Tests +22. Total +2 across 6 files.

Reproducibility: yes. Current main has three raw slice(0, 80) restart diagnostic formatters, and a 79-code-unit prefix plus emoji crosses the boundary in a way that can leave a dangling high surrogate.

Review metrics: 1 noteworthy metric.

Formatter copies consolidated: 3 call sites to 1 shared formatter. Restart preflight, gateway reload, and run-loop diagnostics share the same truncation invariant, so one formatter reduces future drift.

Merge readiness
Overall: 🦪 silver shellfish
Proof: 🦪 silver shellfish
Patch quality: 🦞 diamond lobster
Result: blocked until real behavior proof from a real setup is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P1] Add redacted terminal output, logs, or a short recording showing actual diagnostic output with a boundary-crossing task title and no replacement character.
Wait for the remaining exact-head check to finish green, or get maintainer adjudication if it is unrelated.

Proof guidance:

[P1] Needs real behavior proof before merge: The PR currently provides tests, CI, and Testbox-style validation only; it still needs redacted terminal output, logs, or a recording from a real restart, reload, or run-loop diagnostic showing the boundary-crossing title after the fix. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

[P1] Only test/CI-style evidence is available; no redacted terminal output, log, or recording shows the changed diagnostic string after the fix.
[P1] One exact-head CI check was still in progress when inspected, so merge readiness still depends on that check finishing green or maintainer adjudication.

Maintainer options:

Decide the mitigation before merge
Land the shared formatter after redacted real diagnostic output proof is added and exact-head checks finish green or are explicitly adjudicated.
Pause or close
Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

[P1] No automated repair lane is appropriate; the remaining blockers are contributor real-behavior proof, exact-head check completion, and normal maintainer review.

Security
Cleared: The diff only changes internal diagnostic string formatting and tests using an existing workspace package export; it does not touch dependencies, workflows, secrets, auth, network, or supply-chain execution paths.

Review details

Best possible solution:

Land the shared formatter after redacted real diagnostic output proof is added and exact-head checks finish green or are explicitly adjudicated.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main has three raw slice(0, 80) restart diagnostic formatters, and a 79-code-unit prefix plus emoji crosses the boundary in a way that can leave a dangling high surrogate.

Is this the best way to solve the issue?

Yes for the code shape. A side-effect-free shared task formatter is narrower and cleaner than keeping three helpers or exporting formatting through task-registry maintenance, but merge readiness still needs real behavior proof.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against a3f00d32c914.

Label changes

Label justifications:

P3: This is a small diagnostic-output correctness fix with limited runtime blast radius and no config, migration, auth, provider, or availability impact.
rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦞 diamond lobster.
status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR currently provides tests, CI, and Testbox-style validation only; it still needs redacted terminal output, logs, or a recording from a real restart, reload, or run-loop diagnostic showing the boundary-crossing title after the fix. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence reviewed

PR surface:

Source -20, Tests +22. Total +2 across 6 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	5	35	55	-20
Tests	1	22	0	+22
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	6	57	55	+2

What I checked:

Current main bug surface: Current main still formats restart preflight task titles with raw task.title.slice(0, 80), so a supplementary character crossing the limit can leave a dangling surrogate. (src/infra/restart-coordinator.ts:73, a3f00d32c914)
Sibling diagnostic surfaces: The same raw title slice exists in gateway reload diagnostics and CLI run-loop drain diagnostics on current main, so the PR is not a one-sided fix. (src/gateway/server-reload-handlers.ts:270, a3f00d32c914)
PR implementation: At PR head, formatActiveTaskRestartBlocker preserves the existing field order and bounds titles with truncateUtf16Safe(task.title, 80). (src/tasks/task-restart-blocker.ts:14, 60d1b4a7f8ad)
Regression coverage: The PR adds a restart preflight assertion for 79 ASCII code units plus a crossing emoji and expects the formatted title to stop before the incomplete surrogate pair. (src/infra/restart-coordinator.test.ts:72, 60d1b4a7f8ad)
Dependency contract: truncateUtf16Safe delegates to sliceUtf16Safe, which backs off when the requested end would split a high/low surrogate pair. (packages/normalization-core/src/utf16-slice.ts:44, a3f00d32c914)
Proof state: The PR body and comments provide CI/Testbox/test evidence, but no terminal output, logs, recording, or other real diagnostic output proof at the current head; the live labels still include status: 📣 needs proof. (60d1b4a7f8ad)

Likely related people:

RomneyDa: Current-main blame for the duplicated restart-blocker formatters and the UTF-16 helper source points to the merged gateway-client consolidation commit authored and merged by this handle. (role: recent area contributor; confidence: high; commits: 8fa83d27420b; files: src/infra/restart-coordinator.ts, src/gateway/server-reload-handlers.ts, src/cli/gateway-cli/run-loop.ts)
steipete: The latest commits on this PR define the shared side-effect-free formatter shape, and recent merged UTF-16 bounded-text work used the same helper pattern in adjacent surfaces. (role: PR follow-up owner and adjacent contributor; confidence: high; commits: c650b2b199ff, 705a7b05327f, 60d1b4a7f8ad; files: src/tasks/task-restart-blocker.ts, src/infra/restart-coordinator.ts, src/gateway/server-reload-handlers.ts)
vincentkoc: The live PR timeline assigns this review target to this handle, making them the visible routing candidate even though the direct formatter history is shared with other contributors. (role: assigned reviewer; confidence: medium; files: src/infra/restart-coordinator.ts, src/gateway/server-reload-handlers.ts, src/cli/gateway-cli/run-loop.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (6 earlier review cycles)

reviewed 2026-07-08T01:03:45.069Z sha 80656a5 :: needs real behavior proof before merge. :: [P3] Exercise the changed diagnostic output path
reviewed 2026-07-08T01:57:23.491Z sha 80656a5 :: found issues before merge. :: [P3] Exercise a changed diagnostic formatter
reviewed 2026-07-08T02:04:51.599Z sha 80656a5 :: needs changes before merge. :: [P3] Exercise a changed diagnostic formatter
reviewed 2026-07-09T04:04:08.376Z sha 705a7b0 :: needs maintainer review before merge. :: none
reviewed 2026-07-09T04:11:36.728Z sha 705a7b0 :: needs real behavior proof before merge. :: none
reviewed 2026-07-09T05:55:30.415Z sha 60d1b4a :: needs real behavior proof before merge. :: none

wm0018 · 2026-07-08T01:53:52Z

@clawsweeper re-review

clawsweeper · 2026-07-08T01:53:55Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

steipete · 2026-07-09T06:10:09Z

Land-ready verification at exact head 60d1b4a7f8ad3604daa654387d0dcea4b1ab239d:

Refactored all three task-restart blocker paths onto one owner helper and removed the duplicated formatters (production net -18 lines).
Blacksmith Testbox run 28997018899: restart coordinator, gateway reload, and CLI drain suites passed (103 test executions).
Exact-head CI run 28997147829, attempt 2: passed. Attempt 1's sole failure was an 11-minute Blacksmith timeout during Setup Node environment; no repository check ran in that job, and the same job passed on retry.
Fresh full-head autoreview: clean, confidence 0.98.
Native OPENCLAW_TESTBOX=1 scripts/pr prepare-run 101934: passed with exact head and review artifacts validated.

No changelog entry is required: this corrects internal restart-blocker formatting without changing the user-visible contract.

steipete · 2026-07-09T06:10:30Z

Merged via squash.

Prepared head SHA: 60d1b4a7f8ad3604daa654387d0dcea4b1ab239d
Landed commit: 7de325d06023ca1a679660b73785795fa00e2218

…put (openclaw#101934) * fix: keep task title truncation UTF-16 safe in restart/diagnostic output Three private copies of formatTaskBlocker share the same pattern — task.title.slice(0, 80) — which can split surrogate pairs in task titles, producing broken U+FFFD in restart blocker diagnostics, gateway reload logs, and CLI run-loop output. Replace raw slice with truncateUtf16Safe in all three locations. Relevant files: - gateway/server-reload-handlers.ts:270 - infra/restart-coordinator.ts:73 - cli/gateway-cli/run-loop.ts:569 * refactor(tasks): centralize restart blocker formatting * fix(tasks): keep restart formatter side-effect free * refactor(tasks): tighten restart blocker ownership --------- Co-authored-by: Peter Steinberger <[email protected]>

openclaw-barnacle Bot added gateway Gateway runtime cli CLI command changes size: XS labels Jul 8, 2026

vincentkoc self-assigned this Jul 8, 2026

steipete added 2 commits July 9, 2026 04:54

refactor(tasks): centralize restart blocker formatting

c650b2b

fix(tasks): keep restart formatter side-effect free

705a7b0

openclaw-barnacle Bot added size: S and removed size: XS labels Jul 9, 2026

refactor(tasks): tighten restart blocker ownership

60d1b4a

steipete merged commit 7de325d into openclaw:main Jul 9, 2026
159 of 160 checks passed

This was referenced Jul 9, 2026

fix(text): keep five src-side text truncations UTF-16 safe #102630

Closed

fix(chat,cli): keep session snippet and CLI output digest truncation UTF-16 safe #102747

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix: keep task title truncation UTF-16 safe in restart/diagnostic output#101934

fix: keep task title truncation UTF-16 safe in restart/diagnostic output#101934
steipete merged 4 commits into
openclaw:mainfrom
wm0018:fix/task-title-utf16-safe-truncation

wm0018 commented Jul 8, 2026 •

edited by steipete

Loading

Uh oh!

clawsweeper Bot commented Jul 8, 2026 •

edited

Loading

Uh oh!

wm0018 commented Jul 8, 2026

Uh oh!

clawsweeper Bot commented Jul 8, 2026 •

edited

Loading

Uh oh!

steipete commented Jul 9, 2026

Uh oh!

Uh oh!

steipete commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Uh oh!

Conversation

wm0018 commented Jul 8, 2026 • edited by steipete Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Risk checklist

Uh oh!

clawsweeper Bot commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wm0018 commented Jul 8, 2026

Uh oh!

clawsweeper Bot commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

steipete commented Jul 9, 2026

Uh oh!

Uh oh!

steipete commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

wm0018 commented Jul 8, 2026 •

edited by steipete

Loading

clawsweeper Bot commented Jul 8, 2026 •

edited

Loading

clawsweeper Bot commented Jul 8, 2026 •

edited

Loading