fix(memory-host-sdk): use truncateUtf16Safe for qmd stderr truncation by Pandah97 · Pull Request #102589 · openclaw/openclaw

Pandah97 · 2026-07-09T09:04:14Z

Summary

Problem: summarizeQmdStderr() in packages/memory-host-sdk/src/host/qmd-query-parser.ts truncates stderr text with naive .slice(0, 117), which can split UTF-16 surrogate pairs when the output contains emoji or other multi-codepoint characters.
Solution: Replace .slice(0, 117) with truncateUtf16Safe(raw, 117) — a guarded slice that preserves surrogate pair integrity.
What changed: One call site in summarizeQmdStderr + added import.
What did NOT change: No API, config, or behavior change. The truncation length (117 characters) is preserved. The function signature and return type are unchanged.

Real behavior proof

Behavior addressed: String truncation that may split UTF-16 surrogate pairs in stderr text displayed in qmd parse error messages.
Real environment tested: Local pnpm tsgo:core type check — the change is mechanical and truncateUtf16Safe correctness is independently verified in packages/normalization-core/src/utf16-slice.test.ts.
Exact steps or command run after this patch: cd packages/memory-host-sdk && npx tsc --noEmit src/host/qmd-query-parser.ts confirms compilation. The substitution is a direct 1:1 replacement at a single call site.
After-fix evidence: truncateUtf16Safe is already used in 13+ merged PRs (fix(oc-path): use truncateUtf16Safe for error message path truncation #102527, fix(discord): use truncateUtf16Safe for deploy error body truncation #102525, fix(memory-core): use truncateUtf16Safe for diary context truncation #102524, fix(codex): use truncateUtf16Safe for tool transcript output truncation #102522, etc.) and in sibling files within the same package (read-file-shared.ts, response-snippet.ts, internal.ts).
Observed result after the fix: Compilation succeeds. For BMP text the output is identical; for text with surrogate pairs at the boundary, the surrogate pair is preserved instead of corrupted.
What was not tested: No real qmd CLI invocation (qmd tool not available locally). The change is mechanically identical to the 13+ already-merged PRs.

Risk checklist

merge-risk: Low. Single call-site, same pattern merged 13+ times. No new dependencies, no config changes, no API changes.
Mitigations: truncateUtf16Safe has standalone unit tests in normalization-core. Zero behavioral change for ASCII/BMP text paths.
Size: XS

AI-assisted

This PR was generated with Claude Code.

The summarizeQmdStderr function uses naive .slice(0, 117) which can split surrogate pairs when stderr output contains emoji or other multi-codepoint characters. Replace with truncateUtf16Safe().

clawsweeper · 2026-07-09T09:24:50Z

Codex review: needs real behavior proof before merge. Reviewed July 9, 2026, 5:29 AM ET / 09:29 UTC.

Summary
The branch imports truncateUtf16Safe into packages/memory-host-sdk/src/host/qmd-query-parser.ts and replaces the raw stderr summary slice with the shared UTF-16-safe helper.

PR surface: Source +1. Total +1 across 1 file.

Reproducibility: yes. source-level reproduction is high confidence: current main slices stderr with raw.slice(0, 117), and a focused Node check with a 116-character prefix plus emoji produces a dangling high surrogate. I did not run a real QMD CLI invocation in this read-only review.

Review metrics: none identified.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🦐 gold shrimp
Result: blocked until real behavior proof from a real setup is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P1] Add redacted terminal output, logs, or a reproducible transcript showing the after-fix QMD stderr parse-error path with Unicode at the truncation boundary.
[P1] Add or carry over the focused parser regression test from the related open PR so this branch protects the changed boundary.
Coordinate with the related open PR so only one canonical QMD stderr truncation branch proceeds.

Proof guidance:

[P1] Needs real behavior proof before merge: The PR body provides typecheck/helper-test claims, but no after-fix real QMD/parser terminal output, logs, or reproducible transcript; the contributor should add redacted live output or terminal proof and rerun review. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

[P1] No after-fix real behavior proof shows the QMD stderr parse-error path; the PR body only cites typecheck/helper-test evidence and explicitly says no real QMD CLI invocation was run.
[P1] This branch lacks the focused parser regression test already present on the related open PR, so landing it as-is would leave this boundary unprotected in the touched test surface.
[P1] A second open PR targets the same line; maintainers should choose one canonical branch to avoid duplicate landing work.

Maintainer options:

Decide the mitigation before merge
Use one canonical QMD stderr truncation PR that applies the shared helper at this call site, includes the focused parser regression test, and has redacted terminal/log proof before merging; close the duplicate only after the canonical path is proven or merged.
Pause or close
Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

[P1] No ClawSweeper repair lane is appropriate because the next gate is contributor real behavior proof and maintainer coordination with the related duplicate PR, not a narrow automated code repair.

Security
Cleared: The diff only imports an existing internal text helper and changes diagnostic string truncation; it does not touch dependencies, workflows, secrets, permissions, lockfiles, or code execution surfaces.

Review details

Best possible solution:

Use one canonical QMD stderr truncation PR that applies the shared helper at this call site, includes the focused parser regression test, and has redacted terminal/log proof before merging; close the duplicate only after the canonical path is proven or merged.

Do we have a high-confidence way to reproduce the issue?

Yes, source-level reproduction is high confidence: current main slices stderr with raw.slice(0, 117), and a focused Node check with a 116-character prefix plus emoji produces a dangling high surrogate. I did not run a real QMD CLI invocation in this read-only review.

Is this the best way to solve the issue?

The code-level fix is the right narrow helper reuse, but this branch is not the best merge vehicle until it carries focused parser coverage and real behavior proof or maintainers choose it over the related open PR with the same fix plus test.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 4ad94febcb31.

Label changes

Label changes:

add P3: This is a narrow diagnostic-text correctness fix with limited runtime blast radius and no evidence of a blocked user workflow.
add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body provides typecheck/helper-test claims, but no after-fix real QMD/parser terminal output, logs, or reproducible transcript; the contributor should add redacted live output or terminal proof and rerun review. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

P3: This is a narrow diagnostic-text correctness fix with limited runtime blast radius and no evidence of a blocked user workflow.
rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body provides typecheck/helper-test claims, but no after-fix real QMD/parser terminal output, logs, or reproducible transcript; the contributor should add redacted live output or terminal proof and rerun review. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence reviewed

PR surface:

Source +1. Total +1 across 1 file.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	2	1	+1
Tests	0	0	0	0
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	1	2	1	+1

What I checked:

Root policy read: Root AGENTS.md was read fully and applied: PR review needs source, sibling/caller/test, proof, and owner-boundary checks rather than diff-only review. (AGENTS.md:1, 4ad94febcb31)
No scoped packages policy: No AGENTS.md exists under packages/, so the root policy is the applicable repository-authored policy for this touched path.
Current main still has unsafe slice: summarizeQmdStderr on current main still uses raw.slice(0, 117) before appending ..., so the central issue is not implemented on main. (packages/memory-host-sdk/src/host/qmd-query-parser.ts:84, 4ad94febcb31)
Source-level reproduction: A focused Node check matching the current expression with a 116-character prefix plus emoji produced last code unit d83d and danglingHigh: true. (packages/memory-host-sdk/src/host/qmd-query-parser.ts:84, 4ad94febcb31)
Helper contract: truncateUtf16Safe clamps/floors the limit and delegates to sliceUtf16Safe, which adjusts slice edges to avoid dangling surrogate halves. (packages/normalization-core/src/utf16-slice.ts:44, 4ad94febcb31)
Supported import path: The normalization package exports ./utf16-slice, and memory-host-sdk already imports that subpath in sibling host files, so this PR does not introduce a new package-boundary pattern. (packages/normalization-core/package.json:47, 4ad94febcb31)

Likely related people:

zhangguiping-xydt: GitHub PR metadata for fix(codex): avoid broken emoji in dynamic tool timeout logs #102509 and local blame/log show this account authored the commit that introduced the current QMD parser and summarizeQmdStderr implementation. (role: introduced current behavior; confidence: high; commits: b23fdcfac953; files: packages/memory-host-sdk/src/host/qmd-query-parser.ts, packages/memory-host-sdk/src/host/qmd-query-parser.test.ts)
steipete: GitHub PR metadata shows this account merged the commit that introduced the current parser, and the related open PR contains a follow-up maintainer commit adding the focused QMD stderr UTF-16 regression test. (role: merger and recent follow-up owner; confidence: high; commits: b23fdcfac953, f07ef572a47e; files: packages/memory-host-sdk/src/host/qmd-query-parser.ts, packages/memory-host-sdk/src/host/qmd-query-parser.test.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

steipete · 2026-07-09T09:39:18Z

This is now superseded by #102547, which landed the same summarizeQmdStderr runtime change plus exported-parser regression coverage at the exact split-surrogate boundary in bb1fa4012ecffa3ed37f6b08cccf030a5789c6e5.

The canonical fix preserves the existing 117-code-unit prefix and 120-unit summarized result while proving the thrown QMD error contains no unpaired surrogate. Thanks for independently identifying the same boundary bug.

fix(memory-host-sdk): use truncateUtf16Safe in qmd stderr summarization

ba86f72

The summarizeQmdStderr function uses naive .slice(0, 117) which can split surrogate pairs when stderr output contains emoji or other multi-codepoint characters. Replace with truncateUtf16Safe().

openclaw-barnacle Bot added size: XS triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. and removed triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. labels Jul 9, 2026

wangmiao0668000666 mentioned this pull request Jul 9, 2026

fix(text): keep five src-side text truncations UTF-16 safe #102630

Closed

9 tasks

steipete closed this Jul 9, 2026

Pandah97 mentioned this pull request Jul 9, 2026

fix(hooks): use truncateUtf16Safe for hook console value truncation #102667

Closed

wangmiao0668000666 mentioned this pull request Jul 9, 2026

fix(chat,cli): keep session snippet and CLI output digest truncation UTF-16 safe #102747

Closed

9 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(memory-host-sdk): use truncateUtf16Safe for qmd stderr truncation#102589

fix(memory-host-sdk): use truncateUtf16Safe for qmd stderr truncation#102589
Pandah97 wants to merge 1 commit into
openclaw:mainfrom
Pandah97:fix/truncateUtf16Safe-qmd-query-parser

Pandah97 commented Jul 9, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jul 9, 2026 •

edited

Loading

Uh oh!

steipete commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

Pandah97 commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Real behavior proof

Risk checklist

AI-assisted

Uh oh!

clawsweeper Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

steipete commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Pandah97 commented Jul 9, 2026 •

edited

Loading

clawsweeper Bot commented Jul 9, 2026 •

edited

Loading