Skip to content

fix(gateway): use truncateUtf16Safe for config path display truncation#102513

Merged
steipete merged 2 commits into
openclaw:mainfrom
lsr911:fix/utf16-config-path
Jul 9, 2026
Merged

fix(gateway): use truncateUtf16Safe for config path display truncation#102513
steipete merged 2 commits into
openclaw:mainfrom
lsr911:fix/utf16-config-path

Conversation

@lsr911

@lsr911 lsr911 commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

What Problem This Solves

The config path sanitizer uses naive .slice(0, 117) which can split surrogate pairs when sanitized paths contain emoji or other multi-codepoint characters.

Why This Change Was Made

Replace with truncateUtf16Safe(). Same pattern as #102464, #102467, #102500 (all merged).

Files Changed

File Change
src/gateway/server-methods/config.ts +1 import; .slice(0,117) → truncateUtf16Safe()

🤖 Generated with Claude Code

@lsr911 @claude
fix(gateway): use truncateUtf16Safe for config path display truncation
c788502 
Replace naive .slice(0, 117) with truncateUtf16Safe() to prevent
surrogate pair splitting in config path sanitization output.

Co-Authored-By: Claude <[email protected]>
@openclaw-barnacle openclaw-barnacle Bot added gateway Gateway runtime size: XS triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. labels Jul 9, 2026
@clawsweeper

clawsweeper Bot commented Jul 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs real behavior proof before merge. Reviewed July 9, 2026, 4:16 AM ET / 08:16 UTC.

Summary
The branch imports truncateUtf16Safe, uses it for Gateway config path log truncation, and adds a mocked config.openFile regression test for an emoji boundary.

PR surface: Source +1, Tests +13. Total +14 across 2 files.

Reproducibility: yes. source-reproducible: current main raw-slices sanitized config paths at 117 UTF-16 code units before adding an ellipsis, so an emoji crossing that boundary can leave a dangling surrogate. I did not run a live Gateway/OpenClaw scenario in this read-only review.

Review metrics: 1 noteworthy metric.

  • Proof artifacts: 0 live artifacts, 1 mocked regression test. Real behavior proof remains the external-PR merge gate even though the branch now has focused unit coverage.

Merge readiness
Overall: 🦪 silver shellfish
Proof: 🦪 silver shellfish
Patch quality: 🐚 platinum hermit
Result: blocked until real behavior proof from a real setup is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • [P1] Add redacted terminal output or logs from a real config.openFile failure with a long emoji-containing config path showing surrogate-safe truncation.
  • Update the PR body after adding proof so ClawSweeper can re-review automatically; if it does not, ask a maintainer to comment @clawsweeper re-review.

Proof guidance:

  • [P1] Needs real behavior proof before merge: Only mocked regression and CI evidence are visible; the contributor should add redacted terminal output, copied live output, or logs from a real Gateway/OpenClaw config path failure, with private paths, keys, phone numbers, endpoints, and other private details redacted. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

  • [P1] The external PR still has no after-fix real behavior proof showing a real Gateway/OpenClaw config path log with a long emoji-containing path.
  • [P1] The branch is behind current main, so exact-head checks should refresh before merge even though GitHub currently reports it mergeable.

Maintainer options:

  1. Decide the mitigation before merge
    Keep the centralized sanitizer and land the helper substitution only after redacted real Gateway log/output proof or an explicit maintainer proof override.
  2. Pause or close
    Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

  • [P1] Human/contributor follow-up is needed for real behavior proof or a maintainer proof override; there is no narrow ClawSweeper code repair to perform.

Maintainer decision needed

  • Question: Should maintainers require real Gateway/OpenClaw output proof for this external log-display fix, or accept a proof override based on the mocked regression and CI?
  • Rationale: The code path is source-reproducible and the patch is narrow, but repository policy treats external PR real behavior proof as a merge gate unless maintainers explicitly override it.
  • Likely owner: steipete — They are the best available routing owner from recent Gateway config and UTF-16 helper history, and they merged the adjacent UTF-16 truncation fixes.
  • Options:
    • Require real behavior proof (recommended): Ask for redacted terminal output or logs from a real config.openFile failure with a long emoji-containing config path before merge.
    • Apply proof override: A maintainer can intentionally accept the mocked regression plus green checks as sufficient for this tiny log-only display fix.

Security
Cleared: No concrete security or supply-chain concern found; the diff only swaps an existing internal string helper into log-display truncation and adds a mocked regression test.

Review details

Best possible solution:

Keep the centralized sanitizer and land the helper substitution only after redacted real Gateway log/output proof or an explicit maintainer proof override.

Do we have a high-confidence way to reproduce the issue?

Yes, source-reproducible: current main raw-slices sanitized config paths at 117 UTF-16 code units before adding an ellipsis, so an emoji crossing that boundary can leave a dangling surrogate. I did not run a live Gateway/OpenClaw scenario in this read-only review.

Is this the best way to solve the issue?

Yes for the implementation shape: reusing truncateUtf16Safe inside the existing sanitizer is the narrowest maintainable fix and also covers sibling sanitizer log callers. Merge readiness still depends on real behavior proof or a maintainer proof override.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 769878303744.

Label changes

Label changes:

  • add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
  • remove rating: 🧂 unranked krab: Current PR rating is rating: 🦪 silver shellfish, so this older rating label is no longer current.

Label justifications:

  • P3: This is a small Gateway log/display correctness fix with limited blast radius and no config, protocol, data-model, dependency, or security surface change.
  • rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
  • status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: Only mocked regression and CI evidence are visible; the contributor should add redacted terminal output, copied live output, or logs from a real Gateway/OpenClaw config path failure, with private paths, keys, phone numbers, endpoints, and other private details redacted. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed

PR surface:

Source +1, Tests +13. Total +14 across 2 files.

View PR surface stats
Area Files Added Removed Net
Source 1 2 1 +1
Tests 1 13 0 +13
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 2 15 1 +14

What I checked:

Likely related people:

  • mmaps: The config opener work in Gateway: open config files without shell interpolation #57921 introduced sanitizeLookupPathForLog with the raw slice(0, 117) truncation in the affected Gateway config method. (role: introduced behavior; confidence: high; commits: 5cc0bc936c4d; files: src/gateway/server-methods/config.ts, src/gateway/server-methods/config.test.ts)
  • Linux2010: Recent config.openFile failure-feedback work updated the same log/error path and adjacent tests that this PR now extends. (role: recent area contributor; confidence: medium; commits: 8246e91e9212; files: src/gateway/server-methods/config.ts, src/gateway/server-methods/config.test.ts)
  • steipete: Recent history shows repeated Gateway config maintenance plus extraction/export of the normalization-core UTF-16 helper, and this person merged the adjacent UTF-16 truncation fixes referenced by the PR. (role: recent area contributor and merger; confidence: high; commits: 00d8d7ead059, 062f88e3e3af, 472e5167d38a; files: packages/normalization-core/src/utf16-slice.ts, packages/normalization-core/package.json, src/gateway/server-methods/config.ts)
  • lsr911: This contributor has adjacent merged UTF-16-safe truncation fixes on current main beyond only opening this PR, including tool-policy audit and native hook relay display paths. (role: recent adjacent UTF-16 truncation contributor; confidence: medium; commits: 472e5167d38a, 4fa3118049c1; files: src/agents/tool-policy-audit.ts, src/agents/harness/native-hook-relay.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.
Review history (1 earlier review cycle)
  • reviewed 2026-07-09T07:46:39.795Z sha c788502 :: needs real behavior proof before merge. :: none

@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P3 Low-priority cleanup, docs, polish, ergonomics, or speculative work. labels Jul 9, 2026
@clawsweeper clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. labels Jul 9, 2026
@steipete

steipete commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

Land-ready maintainer verification at exact head 418c2342ddb64d0ad1fcf9f2a178ab2a0af20749:

  • The existing gateway config-path sanitizer retains control-character replacement, its 120-code-unit display budget, and the current ellipsis.
  • Only the bounded prefix selection now uses the canonical UTF-16-safe helper.
  • Production-path config.openFile failure regression: focused 2-file proof, 20 tests passed.
  • Fresh autoreview: clean (0.99).
  • Exact-head hosted CI/Testbox gates: passed.

No config shape, default, gateway protocol, or docs surface changed.

@steipete
steipete merged commit 8c608ae into openclaw:main Jul 9, 2026
107 of 111 checks passed
@steipete

steipete commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

Merged via squash.

@wangmiao0668000666 wangmiao0668000666 mentioned this pull request Jul 9, 2026
Closed
9 tasks
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jul 10, 2026
@lsr911 @claude @steipete
fix(gateway): use truncateUtf16Safe for config path display truncation (
7dd6026 
openclaw#102513)

* fix(gateway): use truncateUtf16Safe for config path display truncation

Replace naive .slice(0, 117) with truncateUtf16Safe() to prevent
surrogate pair splitting in config path sanitization output.

Co-Authored-By: Claude <[email protected]>

* test(gateway): prove config path UTF-16 boundary

---------

Co-authored-by: Claude <[email protected]>
Co-authored-by: Peter Steinberger <[email protected]>
@OpenClawKobian99 OpenClawKobian99 mentioned this pull request Jul 14, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

gateway Gateway runtime P3 Low-priority cleanup, docs, polish, ergonomics, or speculative work. rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. size: XS status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@lsr911 @steipete