fix(telegram): use truncateUtf16Safe for raw update log truncation by lsr911 · Pull Request #102567 · openclaw/openclaw

lsr911 · 2026-07-09T08:41:49Z

What Problem This Solves

Telegram verbose logging first redacts and serializes an inbound update, then caps the complete log payload at 8,000 UTF-16 code units. That final cap lived separately in bot-core and used slice, so a surrogate pair crossing the boundary could produce malformed log text even though individual string fields were already safe.

Why This Change Was Made

Move the complete-payload cap into the existing raw-update log formatter and apply the shared truncateUtf16Safe utility there. The formatter now owns redaction, field bounds, serialization, and final log framing as one policy surface; bot-core only emits the formatted result.

The regression extends the existing privacy/log formatter suite with an update whose serialized key crosses the 8,000-code-unit boundary. It asserts the complete output and proves there is no dangling surrogate.

User Impact

Verbose Telegram raw-update logs remain redacted and bounded, but no longer contain malformed UTF-16 at the outer limit. Telegram transport, update handling, authorization, replies, and config are unchanged.

Evidence

node ../../node_modules/vitest/vitest.mjs run --config test/vitest/vitest.extension-telegram.config.ts extensions/telegram/src/bot-core.raw-update-log.test.ts — 4 tests passed.
oxfmt completed on all changed files.
git diff --check passed.
Existing redaction tests still pass alongside both the per-field and complete-payload surrogate-boundary regressions.
Per the Telegram plugin review guide, live Telegram proof is not required for this isolated verbose-log formatter change; no transport, streaming, topic, callback, authorization, or reply-context behavior changed.

Risk

Low. The same limits and ellipsis remain; policy moved to its existing formatter owner and valid non-boundary output is unchanged.

AI-assisted

This PR was generated with Claude Code and refactored/reviewed by a maintainer agent.

clawsweeper · 2026-07-09T09:04:04Z

Codex review: needs real behavior proof before merge. Reviewed July 9, 2026, 6:10 AM ET / 10:10 UTC.

Summary
The PR moves Telegram raw-update verbose-log final truncation into the raw-update formatter, applies truncateUtf16Safe, updates the caller, and adds a final-cap regression test.

PR surface: Source 0, Tests +8. Total +8 across 3 files.

Reproducibility: yes. source-level. Current main still uses raw slice for the final serialized Telegram raw-update preview cap, which can split a UTF-16 surrogate pair when the boundary lands inside an emoji.

Review metrics: none identified.

Stored data model
Persistent data-model change detected: serialized state: extensions/telegram/src/raw-update-log.ts. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🐚 platinum hermit
Result: blocked until real behavior proof from a real setup is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P1] Add redacted formatter output, raw-update log output, or terminal output from the PR head showing the 8000-code-unit final cap no longer emits surrogate halves.
Refresh exact-head checks/review after the proof is added.

Proof guidance:

[P1] Needs real behavior proof before merge: Proof is still only tests/formatting checks; add a redacted terminal/log transcript showing the final raw-update cap no longer emits a dangling surrogate, then update the PR body or ask a maintainer to comment @clawsweeper re-review.

Risk before merge

[P1] Real behavior proof is still mock-only: maintainers have tests and source evidence, but no redacted formatter/log transcript showing the final-cap behavior after the fix.
[P1] The PR base is behind current main, so exact-head checks/review should refresh after proof is added.

Maintainer options:

Decide the mitigation before merge
Land the narrow formatter-owned truncation after the contributor adds redacted after-fix terminal or log proof and exact-head validation is current.
Pause or close
Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

[P1] No repair job: the remaining blocker is contributor-supplied real behavior proof and normal exact-head review, not an automated code repair.

Security
Cleared: No concrete security or supply-chain concern found; the diff changes internal debug-log truncation using an existing helper and does not alter secrets, auth, dependencies, or network behavior.

Review details

Best possible solution:

Land the narrow formatter-owned truncation after the contributor adds redacted after-fix terminal or log proof and exact-head validation is current.

Do we have a high-confidence way to reproduce the issue?

Yes, source-level. Current main still uses raw slice for the final serialized Telegram raw-update preview cap, which can split a UTF-16 surrogate pair when the boundary lands inside an emoji.

Is this the best way to solve the issue?

Yes for the code shape. Moving the final cap into the raw-update formatter keeps redaction, serialization, and truncation in one owner surface; the remaining gap is contributor real behavior proof, not a different implementation layer.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against fae5421f8116.

Label changes

Label justifications:

P2: This is a normal-priority Telegram verbose-log correctness bug with a narrow patch and limited runtime blast radius.
rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: Proof is still only tests/formatting checks; add a redacted terminal/log transcript showing the final raw-update cap no longer emits a dangling surrogate, then update the PR body or ask a maintainer to comment @clawsweeper re-review.

Evidence reviewed

PR surface:

Source 0, Tests +8. Total +8 across 3 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	2	8	8	0
Tests	1	13	5	+8
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	3	21	13	+8

What I checked:

Current main still has the bug: origin/main still caps the serialized Telegram raw-update preview with raw.slice(0, MAX_RAW_UPDATE_CHARS), so an emoji crossing the 8000-code-unit cap can leave a dangling surrogate. (extensions/telegram/src/bot-core.ts:251, fae5421f8116)
Latest release also has the old final cap: The latest release tag content still uses the same raw slice final preview cap, so the central fix is not already shipped. (extensions/telegram/src/bot-core.ts:246, e085fa1a3ffd)
Patch moves the cap into the formatter: The PR head adds MAX_RAW_UPDATE_CHARS to the formatter and uses truncateUtf16Safe(raw, MAX_RAW_UPDATE_CHARS) for the complete serialized log payload. (extensions/telegram/src/raw-update-log.ts:114, b78730fb8acc)
Focused regression now covers the final cap: The PR head adds a test whose serialized key crosses the 8000-code-unit boundary and asserts the output contains no surrogate halves. (extensions/telegram/src/bot-core.raw-update-log.test.ts:192, b78730fb8acc)
Helper contract matches the fix: truncateUtf16Safe floors and clamps the limit, then delegates to sliceUtf16Safe, whose edge checks avoid dangling surrogate halves. (packages/normalization-core/src/utf16-slice.ts:44, fae5421f8116)
Plugin SDK import is an existing public plugin seam: openclaw/plugin-sdk/text-utility-runtime already re-exports truncateUtf16Safe, so the Telegram plugin stays inside the extension boundary. (src/plugin-sdk/text-utility-runtime.ts:21, fae5421f8116)

Likely related people:

galiniliev: Authored the merged Telegram raw-update redaction formatter PR that created the formatter and raw-update logging surface now being adjusted. (role: introduced behavior; confidence: high; commits: 74949eda2f72; files: extensions/telegram/src/raw-update-log.ts, extensions/telegram/src/bot-core.ts, extensions/telegram/src/bot-core.raw-update-log.test.ts)
joshavant: Merged the raw-update redaction PR that introduced this formatter/logging surface and is tied to the current behavior through PR metadata. (role: merger and adjacent owner; confidence: high; commits: 74949eda2f72; files: extensions/telegram/src/raw-update-log.ts, extensions/telegram/src/bot-core.ts)
vincentkoc: Authored the merged bounded-output UTF-16 consolidation that fixed the adjacent per-field Telegram raw-update truncation path. (role: adjacent merged-fix author; confidence: high; commits: 84e5327720b4; files: extensions/telegram/src/raw-update-log.ts, extensions/telegram/src/bot-core.raw-update-log.test.ts)
lsr911: Current main blame for the raw-update formatter and final preview cap points to a recent commit by this author, and the current PR also targets that same surface. (role: recent area contributor; confidence: medium; commits: 6a3834d41d0c; files: extensions/telegram/src/raw-update-log.ts, extensions/telegram/src/bot-core.ts, extensions/telegram/src/bot-core.raw-update-log.test.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (1 earlier review cycle)

reviewed 2026-07-09T09:08:30.020Z sha 96a77fd :: needs real behavior proof before merge. :: none

steipete · 2026-07-09T10:11:25Z

Land-ready verification at exact head b78730fb8acc0f21ffc469d24d1a7d305bd25bd1:

Refactored the one-line patch so Telegram's raw-update formatter now owns redaction, per-field bounds, serialization, and the complete 8,000-code-unit log cap; bot-core only emits the formatted value.
Added an outer-boundary regression alongside the existing redaction and per-field UTF-16 cases.
Focused Telegram raw-update suite — 4 tests passed.
oxfmt and git diff --check passed.
Fresh autoreview: clean, 0.98 confidence; no accepted/actionable findings.
Native OPENCLAW_TESTBOX=1 scripts/pr prepare-run 102567 passed exact-head hosted CI/Testbox gates.
Scoped Telegram guide reviewed. Live Telegram proof is not required for this isolated verbose-log formatter change; transport, streaming, topics, callbacks, authorization, and reply context are untouched.

No docs, config, protocol, or dependency changes. Ready to merge.

steipete · 2026-07-09T10:11:39Z

Merged via squash.

Prepared head SHA: b78730fb8acc0f21ffc469d24d1a7d305bd25bd1
Landed commit: 6ad8a77b512f5796e0932743b1d50735809b6413

…penclaw#102567) * fix(telegram): use truncateUtf16Safe for raw update log truncation * refactor(telegram): own raw log bounds in formatter --------- Co-authored-by: Peter Steinberger <[email protected]>

fix(telegram): use truncateUtf16Safe for raw update log truncation

96a77fd

openclaw-barnacle Bot added channel: telegram Channel integration: telegram size: XS triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. labels Jul 9, 2026

clawsweeper Bot mentioned this pull request Jul 9, 2026

fix(codex,tui,cli): keep retained text UTF-16 safe #102599

Merged

wangmiao0668000666 mentioned this pull request Jul 9, 2026

fix(text): keep five src-side text truncations UTF-16 safe #102630

Closed

9 tasks

refactor(telegram): own raw log bounds in formatter

b78730f

openclaw-barnacle Bot removed the triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. label Jul 9, 2026

steipete merged commit 6ad8a77 into openclaw:main Jul 9, 2026
98 of 99 checks passed

github-actions Bot mentioned this pull request Jul 9, 2026

📡 Upstream Digest — 2026-07-09 10:56 UTC curtismercier/openclaw-mods#1242

Open

wangmiao0668000666 mentioned this pull request Jul 9, 2026

fix(chat,cli): keep session snippet and CLI output digest truncation UTF-16 safe #102747

Closed

9 tasks

OpenClawKobian99 mentioned this pull request Jul 14, 2026

[Bug]: memory-core dreaming narrative fails with "no low surrogate in string" API 400 — clampDiaryContextEntry truncates mid-surrogate-pair (fix on main, missing from v2026.7.1) #107815

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(telegram): use truncateUtf16Safe for raw update log truncation#102567

fix(telegram): use truncateUtf16Safe for raw update log truncation#102567
steipete merged 2 commits into
openclaw:mainfrom
lsr911:fix/utf16-telegram-update

lsr911 commented Jul 9, 2026 •

edited by steipete

Loading

Uh oh!

clawsweeper Bot commented Jul 9, 2026 •

edited

Loading

Uh oh!

steipete commented Jul 9, 2026

Uh oh!

Uh oh!

steipete commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

lsr911 commented Jul 9, 2026 • edited by steipete Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Risk

AI-assisted

Uh oh!

clawsweeper Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

steipete commented Jul 9, 2026

Uh oh!

Uh oh!

steipete commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

lsr911 commented Jul 9, 2026 •

edited by steipete

Loading

clawsweeper Bot commented Jul 9, 2026 •

edited

Loading