fix(android): preserve UTF-16 boundaries in notification text by ly85206559 · Pull Request #102442 · openclaw/openclaw

ly85206559 · 2026-07-09T05:47:08Z

What Problem This Solves

Fixes an issue where forwarded Android notification text could contain an unpaired UTF-16 surrogate when a supplementary character crossed the 512-code-unit limit.

Why This Change Was Made

Notification text now truncates at a valid UTF-16 boundary while preserving the existing 512-code-unit cap and blank-value behavior. The regression coverage lives beside the existing sanitizer tests and proves both sides of the boundary: a split pair is removed, while a complete pair ending exactly at the limit is preserved.

This PR is AI-assisted. The author reviewed the implementation and validation results.

User Impact

Forwarded Android notification titles and message previews no longer risk malformed text when an emoji or another supplementary Unicode character falls at the truncation boundary.

Evidence

Exact head: 79ae5028d78513e73839a1224617964b4d3538c4
Blacksmith Testbox run: https://github.com/openclaw/openclaw/actions/runs/28998742871
- ./gradlew :app:ktlintCheck :app:testThirdPartyDebugUnitTest --tests ai.openclaw.app.node.NotificationsHandlerTest --console=plain
- BUILD SUCCESSFUL; Android production sanitizer tests and ktlint passed.
git diff --check
Fresh uncommitted autoreview: clean, no accepted/actionable findings (0.99).

The branch was updated from current main after the original merge-ref-only native i18n inventory failure; regenerating the inventory on the current base reported changed=false.

clawsweeper · 2026-07-09T05:48:36Z

Codex review: needs real behavior proof before merge. Reviewed July 9, 2026, 2:51 AM ET / 06:51 UTC.

Summary
The PR changes Android notification text sanitization to truncate at a UTF-16-safe boundary and adds boundary regression coverage.

PR surface: Other +23. Total +23 across 2 files.

Reproducibility: yes. source-reproducible: current main trims then uses raw take(512), so 511 BMP code units followed by an emoji can leave a lone high surrogate. I did not run live Android proof in this read-only review.

Review metrics: none identified.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🦞 diamond lobster
Result: blocked until real behavior proof from a real setup is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P1] Add redacted Android device or emulator proof showing a forwarded notification with an emoji at the truncation boundary remains well-formed in the actual listener/gateway path.

Proof guidance:

[P1] Needs real behavior proof before merge: The PR currently shows unit/CI validation only; it needs redacted Android device or emulator proof such as logs, terminal output, or a recording of the boundary-case notification forwarding path before merge, with private details redacted and the PR body updated for re-review. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

[P1] Real Android device or emulator proof is still missing for the notification listener and gateway event path; CI and unit tests do not show the forwarded boundary-case notification in a real setup.

Maintainer options:

Decide the mitigation before merge
Land the focused Android sanitizer and regression test after the PR body includes redacted real Android device or emulator proof for the notification-forwarding boundary case.
Pause or close
Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

[P1] Needs contributor real-behavior proof and normal maintainer review; there is no narrow code defect for ClawSweeper repair to apply.

Security
Cleared: No concrete security or supply-chain concern found; the diff only changes Android Kotlin text truncation and a focused unit test.

Review details

Best possible solution:

Land the focused Android sanitizer and regression test after the PR body includes redacted real Android device or emulator proof for the notification-forwarding boundary case.

Do we have a high-confidence way to reproduce the issue?

Yes, source-reproducible: current main trims then uses raw take(512), so 511 BMP code units followed by an emoji can leave a lone high surrogate. I did not run live Android proof in this read-only review.

Is this the best way to solve the issue?

Yes, the patch is the narrow Android-layer fix because it preserves the existing trim/null/512-code-unit contract and only changes the unsafe surrogate boundary case. Merge readiness still depends on real behavior proof, not another code change.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 5f91f6c95840.

Label changes

Label justifications:

P2: This is a focused Android notification text correctness fix with limited blast radius, not a live outage, security boundary issue, or blocked setup path.
rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦞 diamond lobster.
status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR currently shows unit/CI validation only; it needs redacted Android device or emulator proof such as logs, terminal output, or a recording of the boundary-case notification forwarding path before merge, with private details redacted and the PR body updated for re-review. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence reviewed

PR surface:

Other +23. Total +23 across 2 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	0	0	0	0
Tests	0	0	0	0
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	2	24	1	+23
Total	2	24	1	+23

What I checked:

Repository policy read: Root AGENTS.md and apps/android/AGENTS.md were read fully; the root review policy affected this review by requiring read-beyond-diff code inspection and real behavior proof for user-visible PRs. (AGENTS.md:1, 5f91f6c95840)
Current main source behavior: Current main still trims notification text and then uses raw Kotlin take(MAX_NOTIFICATION_TEXT_CHARS), which can leave a lone high surrogate when a supplementary character crosses the 512-code-unit boundary. (apps/android/app/src/main/java/ai/openclaw/app/node/DeviceNotificationListenerService.kt:30, 5f91f6c95840)
Runtime entry point: StatusBarNotification.toEntry() sends title, big text, text, and subText through sanitizeNotificationText before storing and emitting gateway-visible notification data. (apps/android/app/src/main/java/ai/openclaw/app/node/DeviceNotificationListenerService.kt:288, 5f91f6c95840)
PR implementation: The PR head replaces raw take(512) with takeUtf16Safe and backs off one code unit when the truncation tail would retain a high surrogate. (apps/android/app/src/main/java/ai/openclaw/app/node/DeviceNotificationListenerService.kt:30, c647e7a2a363)
PR regression coverage: The added test covers both split-pair truncation removal and preserving a complete emoji pair ending exactly at the cap. (apps/android/app/src/test/java/ai/openclaw/app/node/NotificationsHandlerTest.kt:269, c647e7a2a363)
Sibling invariant: The repository already uses UTF-16-safe truncation helpers elsewhere, with the same rule of shrinking an end boundary that would leave a high surrogate before its low surrogate. (packages/normalization-core/src/utf16-slice.ts:33, 5f91f6c95840)

Likely related people:

nimbleenigma: Authored the merged Android notification-forwarding controls work that established the listener, policy enforcement, and tests around this path. (role: feature introducer; confidence: high; commits: aee61dcee0f3, 27141c711bbf; files: apps/android/app/src/main/java/ai/openclaw/app/node/DeviceNotificationListenerService.kt, apps/android/app/src/test/java/ai/openclaw/app/node/DeviceNotificationListenerServiceTest.kt)
obviyus: Merged the notification-forwarding controls PR and authored final Android notification-forwarding follow-up commits in that feature history. (role: merger and adjacent contributor; confidence: medium; commits: 1a8fab063b12, 825f03eed722; files: apps/android/app/src/main/java/ai/openclaw/app/node/DeviceNotificationListenerService.kt, apps/android/app/src/test/java/ai/openclaw/app/node/DeviceNotificationListenerServiceTest.kt)
vincentkoc: Current-main blame for the sanitizer, cap, and notification text extraction lines points at aad9974 in this checkout. (role: recent area contributor; confidence: medium; commits: aad99747cd45; files: apps/android/app/src/main/java/ai/openclaw/app/node/DeviceNotificationListenerService.kt, apps/android/app/src/test/java/ai/openclaw/app/node/NotificationsHandlerTest.kt)
ly85206559: Besides opening this PR, this account authored a recently merged Android notification-forwarding policy fix in the same product area. (role: recent adjacent contributor; confidence: medium; commits: 607c481ca9d5; files: apps/android/app/src/main/java/ai/openclaw/app/NotificationForwardingPolicy.kt, apps/android/app/src/main/java/ai/openclaw/app/SecurePrefs.kt)
steipete: Merged the recent Android notification-forwarding policy fix and added the second commit moving this PR's regression coverage into the existing sanitizer test file. (role: recent adjacent merger and reviewer; confidence: medium; commits: 607c481ca9d5, c647e7a2a363; files: apps/android/app/src/main/java/ai/openclaw/app/NotificationForwardingPolicy.kt, apps/android/app/src/test/java/ai/openclaw/app/node/NotificationsHandlerTest.kt)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (2 earlier review cycles)

reviewed 2026-07-09T05:54:04.305Z sha 50ec031 :: needs real behavior proof before merge. :: none
reviewed 2026-07-09T06:00:59.175Z sha 50ec031 :: needs real behavior proof before merge. :: none

steipete · 2026-07-09T07:11:22Z

Land-ready at exact head 79ae5028d78513e73839a1224617964b4d3538c4.

Proof:

Blacksmith Testbox run 28998742871: :app:ktlintCheck plus focused NotificationsHandlerTest third-party debug unit tests passed.
The first CI merge ref encountered transient native-i18n inventory drift from its base. Current main was independently checked in Testbox run 28999386168; pnpm native:i18n:sync reported entries=2815 changed=false.
After updating the PR branch onto current main, exact-head CI run 29000129108 passed, including native-i18n, Android build, Android ktlint, and both Android test variants.
git diff --check passed.
Fresh exact-head autoreview found no actionable findings.

No known proof gaps. The fix preserves the existing 512-code-unit notification cap while avoiding an unpaired high surrogate at the boundary.

steipete · 2026-07-09T07:11:37Z

Merged via squash.

Prepared head SHA: 79ae5028d78513e73839a1224617964b4d3538c4
Landed commit: 3e787f31878553fa09f96d5d7a380e822bb5b782

…aw#102442) * fix(android): keep notification text UTF-16 safe * test(android): cover UTF-16 notification boundaries --------- Co-authored-by: Peter Steinberger <[email protected]> Co-authored-by: Peter Steinberger <[email protected]>

fix(android): keep notification text UTF-16 safe

50ec031

openclaw-barnacle Bot added app: android App: android size: XS labels Jul 9, 2026

test(android): cover UTF-16 notification boundaries

c647e7a

steipete marked this pull request as ready for review July 9, 2026 06:37

Merge branch 'main' into codex/android-notification-utf16-safe

79ae502

steipete merged commit 3e787f3 into openclaw:main Jul 9, 2026
52 checks passed

This was referenced Jul 9, 2026

fix(text): keep five src-side text truncations UTF-16 safe #102630

Closed

fix(chat,cli): keep session snippet and CLI output digest truncation UTF-16 safe #102747

Closed

ly85206559 deleted the codex/android-notification-utf16-safe branch July 9, 2026 15:56

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(android): preserve UTF-16 boundaries in notification text#102442

fix(android): preserve UTF-16 boundaries in notification text#102442
steipete merged 3 commits into
openclaw:mainfrom
ly85206559:codex/android-notification-utf16-safe

ly85206559 commented Jul 9, 2026 •

edited by steipete

Loading

Uh oh!

clawsweeper Bot commented Jul 9, 2026 •

edited

Loading

Uh oh!

steipete commented Jul 9, 2026

Uh oh!

Uh oh!

steipete commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

ly85206559 commented Jul 9, 2026 • edited by steipete Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

clawsweeper Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

steipete commented Jul 9, 2026

Uh oh!

Uh oh!

steipete commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ly85206559 commented Jul 9, 2026 •

edited by steipete

Loading

clawsweeper Bot commented Jul 9, 2026 •

edited

Loading