fix(ui): keep workboard capture text truncation UTF-16 safe by maweibin · Pull Request #102544 · openclaw/openclaw

maweibin · 2026-07-09T08:14:07Z

What Problem This Solves

Workboard session-capture titles and notes used raw UTF-16 code-unit slices. If a length boundary landed between an emoji's surrogate halves, the captured card contained malformed text.

Why This Change Was Made

Both capture clamps now use the shared truncateUtf16Safe helper already owned by the Workboard module. The reviewed patch keeps the private helpers private and covers them through captureSessionToWorkboard instead of a helper-only probe.

User Impact

Long captured session labels, user prompts, and assistant notes remain valid Unicode at the Workboard limits. Short text and ASCII truncation behavior are unchanged.

Evidence

Added a public-path regression that creates a Workboard card with an emoji straddling both the 177-code-unit title prefix and 697-code-unit note prefix.
Focused ui/src/pages/workboard/data.test.ts run — 1 passed, 179 skipped.
Exact create-request assertions verify the title and notes contain the complete-code-point prefixes plus the existing ellipses.
Fresh autoreview — clean, 0.99 confidence.

AI-assisted: Claude Code

Replace raw .slice(0, N - 3) with truncateUtf16Safe in clampSessionCaptureText and clampSessionCaptureTitle to prevent lone surrogates when emoji cross the truncation boundary. Completes the UTF-16 hardening started in openclaw#101685, which added the import but only covered buildCardSessionLabel.

maweibin · 2026-07-09T08:30:00Z

@clawsweeper re-review

clawsweeper · 2026-07-09T08:30:03Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

clawsweeper · 2026-07-09T08:40:53Z

Codex review: needs real behavior proof before merge. Reviewed July 9, 2026, 5:26 AM ET / 09:26 UTC.

Summary
The PR replaces two Workboard session-capture .slice truncations with truncateUtf16Safe and updates the capture regression test for title and notes emoji boundaries.

PR surface: Source 0, Tests +6. Total +6 across 2 files.

Reproducibility: yes. source-reproducible: current main slices at 177 and 697 code units in the Workboard capture path, so a prefix plus emoji crossing those boundaries can produce malformed UTF-16. I did not run a live UI reproduction in this read-only review.

Review metrics: none identified.

Merge readiness
Overall: 🦪 silver shellfish
Proof: 🦪 silver shellfish
Patch quality: 🐚 platinum hermit
Result: blocked until real behavior proof from a real setup is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P1] Add redacted real behavior proof from a Workboard session capture showing emoji-boundary title and notes remain valid.
[P1] Refresh or resolve the current-head checks-node-compact-large-2 failure, or document maintainer-verified unrelatedness before merge.

Proof guidance:

[P1] Needs real behavior proof before merge: The visible proof is focused regression-test output only; before merge, the contributor should add redacted real Workboard capture proof such as a screenshot, recording, live output, or logs showing the after-fix title/notes behavior, then update the PR body to trigger a fresh review.

Risk before merge

[P1] The PR body shows focused regression-test output, but no live Workboard/session-capture proof artifact showing the after-fix card title and notes in a real setup.
[P1] The current check rollup includes a failed checks-node-compact-large-2 shard on this head; I did not inspect logs deeply enough to attribute it to or clear it from this diff.

Maintainer options:

Decide the mitigation before merge
Land the two owner-local clamp replacements with the regression test after exact-head CI is clean and a redacted real Workboard capture proof is attached.
Pause or close
Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

[P1] Manual review is appropriate because the remaining blockers are contributor real-behavior proof and CI status, not a narrow code repair for ClawSweeper to apply.

Security
Cleared: The diff only changes UI Workboard string truncation and a focused test, with no dependency, workflow, secret, auth, packaging, or code-execution surface changes.

Review details

Best possible solution:

Land the two owner-local clamp replacements with the regression test after exact-head CI is clean and a redacted real Workboard capture proof is attached.

Do we have a high-confidence way to reproduce the issue?

Yes, source-reproducible: current main slices at 177 and 697 code units in the Workboard capture path, so a prefix plus emoji crossing those boundaries can produce malformed UTF-16. I did not run a live UI reproduction in this read-only review.

Is this the best way to solve the issue?

Yes, this is the best narrow fix: the existing shared UTF-16 helper already serves sibling Workboard and UI truncation paths, and replacing only the two capture clamps avoids new API surface or helper exports.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 4ad94febcb31.

Label changes

Label changes:

add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The visible proof is focused regression-test output only; before merge, the contributor should add redacted real Workboard capture proof such as a screenshot, recording, live output, or logs showing the after-fix title/notes behavior, then update the PR body to trigger a fresh review.

Label justifications:

P3: This is a low-risk Control UI text-truncation bug fix with limited blast radius and no config, data-model, provider, or security surface changes.
rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The visible proof is focused regression-test output only; before merge, the contributor should add redacted real Workboard capture proof such as a screenshot, recording, live output, or logs showing the after-fix title/notes behavior, then update the PR body to trigger a fresh review.

Evidence reviewed

PR surface:

Source 0, Tests +6. Total +6 across 2 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	2	2	0
Tests	1	12	6	+6
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	2	14	8	+6

What I checked:

Current-main bug path: Current main still truncates captured Workboard note text with raw UTF-16 .slice, which can return a dangling surrogate when the boundary splits an emoji. (ui/src/lib/workboard/index.ts:2912, 4ad94febcb31)
Current-main title path: Current main also truncates captured Workboard titles with raw .slice, so the PR targets both session-capture clamp sites that share the invariant. (ui/src/lib/workboard/index.ts:2920, 4ad94febcb31)
Existing helper contract: truncateUtf16Safe floors the limit and delegates to sliceUtf16Safe, whose end adjustment avoids returning a high surrogate without its low-surrogate pair. (packages/normalization-core/src/utf16-slice.ts:44, 4ad94febcb31)
Sibling Workboard behavior: The Workboard session label builder already uses truncateUtf16Safe for a similar bounded title-plus-suffix path, so the PR aligns capture text with the local sibling pattern. (ui/src/lib/workboard/index.ts:3716, 4ad94febcb31)
Caller path: The Sessions page calls captureSessionToWorkboard from the Workboard menu action, so malformed capture title/notes can reach the user-visible Workboard card creation path. (ui/src/pages/sessions/sessions-page.ts:1005, 4ad94febcb31)
PR diff: The PR head changes only the two clamp return expressions and the public-path Workboard data test; the final changelog add/remove nets out to no release-file change. (ui/src/lib/workboard/index.ts:2909, 73c9def5b106)

Likely related people:

steipete: Authored the merged Workboard feature PR including session capture, authored/merged the broad UTF-16 hardening PR that touched Workboard, and added maintainer commits on this PR. (role: feature owner and recent area contributor; confidence: high; commits: 41a895852007, 176fee5d071d, 80cb5f1e737c; files: ui/src/lib/workboard/index.ts, ui/src/pages/workboard/data.test.ts, ui/src/pages/sessions/sessions-page.ts)
maweibin: Co-authored the merged broad UTF-16 hardening work and authored this branch's targeted clamp replacement, making them relevant to the specific Unicode-boundary behavior. (role: recent UTF-16 hardening contributor; confidence: medium; commits: 176fee5d071d, c240a87a8423; files: ui/src/lib/workboard/index.ts, ui/src/pages/workboard/data.test.ts)
vincentkoc: Recently refactored the Workboard module file around internal declarations and exports without changing this capture behavior, so they are useful adjacent context but not the primary owner. (role: recent adjacent contributor; confidence: low; commits: 9dbb1ed3d246, 3d206140f3f0; files: ui/src/lib/workboard/index.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (1 earlier review cycle)

reviewed 2026-07-09T08:44:36.838Z sha c240a87 :: needs maintainer review before merge. :: none

steipete · 2026-07-09T09:42:24Z

Land-ready at exact head 73c9def5b1067205abf1d5cee9dd66d5942ad1cd.

Maintainer review strengthened this with public captureSessionToWorkboard coverage for both title and note boundaries; the focused regression passed (1 selected, 179 skipped), targeted formatting and git diff --check passed, and fresh autoreview completed clean with no accepted/actionable findings (0.99). A transient unrelated provider-local-service CI failure passed on its focused rerun; the repository landing wrapper now confirms exact-head hosted CI/Testbox gates passed.

Best-fix verdict: both capture-owned limits keep their existing policy and share the module's existing UTF-16-safe helper, with no new abstraction or compatibility path.

steipete · 2026-07-09T09:42:38Z

Merged via squash.

Prepared head SHA: 73c9def5b1067205abf1d5cee9dd66d5942ad1cd
Landed commit: 9bf212765f665cd3d741e6f66ede5abc420385d2

…#102544) * fix(ui): keep workboard capture text truncation UTF-16 safe Replace raw .slice(0, N - 3) with truncateUtf16Safe in clampSessionCaptureText and clampSessionCaptureTitle to prevent lone surrogates when emoji cross the truncation boundary. Completes the UTF-16 hardening started in openclaw#101685, which added the import but only covered buildCardSessionLabel. * test(ui): cover workboard UTF-16 boundaries * docs(changelog): note Workboard UTF-16 fix * docs(changelog): leave release notes to release flow --------- Co-authored-by: Peter Steinberger <[email protected]>

openclaw-barnacle Bot added app: web-ui App: web-ui size: XS triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. labels Jul 9, 2026

openclaw-barnacle Bot removed the triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. label Jul 9, 2026

steipete added 3 commits July 9, 2026 09:57

test(ui): cover workboard UTF-16 boundaries

80cb5f1

docs(changelog): note Workboard UTF-16 fix

6cf3e1c

docs(changelog): leave release notes to release flow

73c9def

steipete merged commit 9bf2127 into openclaw:main Jul 9, 2026
148 of 153 checks passed

clawsweeper Bot mentioned this pull request Jul 9, 2026

fix(ui): keep event payload previews UTF-16 safe #102625

Merged

github-actions Bot mentioned this pull request Jul 9, 2026

📡 Upstream Digest — 2026-07-09 10:56 UTC curtismercier/openclaw-mods#1242

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(ui): keep workboard capture text truncation UTF-16 safe#102544

fix(ui): keep workboard capture text truncation UTF-16 safe#102544
steipete merged 4 commits into
openclaw:mainfrom
maweibin:fix/workboard-utf16-truncation

maweibin commented Jul 9, 2026 •

edited by steipete

Loading

Uh oh!

maweibin commented Jul 9, 2026

Uh oh!

clawsweeper Bot commented Jul 9, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jul 9, 2026 •

edited

Loading

Uh oh!

steipete commented Jul 9, 2026

Uh oh!

Uh oh!

steipete commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

maweibin commented Jul 9, 2026 • edited by steipete Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

maweibin commented Jul 9, 2026

Uh oh!

clawsweeper Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clawsweeper Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

steipete commented Jul 9, 2026

Uh oh!

Uh oh!

steipete commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

maweibin commented Jul 9, 2026 •

edited by steipete

Loading

clawsweeper Bot commented Jul 9, 2026 •

edited

Loading

clawsweeper Bot commented Jul 9, 2026 •

edited

Loading