fix(codex-supervisor): use truncateUtf16Safe for stderr tail truncation by Pandah97 · Pull Request #102590 · openclaw/openclaw

Pandah97 · 2026-07-09T09:04:33Z

What Problem This Solves

The Codex supervisor bounded child-process stderr with a raw UTF-16 slice when the app-server transport closed. An emoji crossing the 1,200-code-unit cutoff could leave an unpaired surrogate in the surfaced connection error.

Why This Change Was Made

Use the existing truncateUtf16Safe plugin-SDK helper at the stderr-tail owner boundary, preserving the current limit and error shape.

User Impact

Codex supervisor connection failures remain valid Unicode when app-server diagnostics contain supplementary characters at the cutoff.

Evidence

Added a real child-process regression that writes an emoji across the stderr-tail boundary and asserts the exact connection error.
node scripts/run-vitest.mjs extensions/codex-supervisor/src/supervisor.test.ts — 1 file, 32 tests passed.
Targeted oxfmt and git diff --check passed.
Direct Codex contract check at db887d03e1f907467e33271572dffb73bceecd6b: app-server tracing is emitted to stderr in codex-rs/app-server/src/lib.rs.

Files Changed

File	Change
`extensions/codex-supervisor/src/json-rpc-client.ts`	Keep the bounded stderr tail UTF-16 safe.
`extensions/codex-supervisor/src/supervisor.test.ts`	Add real stdio child-process boundary proof.

🤖 Generated with Claude Code

StdioCodexJsonRpcConnection includes stderr output in the transport-closed error message with a naive .slice(0, 1200) which can split surrogate pairs. Replace with truncateUtf16Safe().

clawsweeper · 2026-07-09T09:25:18Z

Codex review: needs real behavior proof before merge. Reviewed July 9, 2026, 5:30 AM ET / 09:30 UTC.

Summary
The PR replaces the codex-supervisor stdio transport-close stderr-tail .slice(0, 1200) with the shared truncateUtf16Safe helper.

PR surface: Source +1. Total +1 across 1 file.

Reproducibility: Do we have a high-confidence way to reproduce the issue? Source inspection gives a clear focused path: the stdio close handler on current main slices a joined stderr string at 1200 UTF-16 code units, which can split a surrogate pair, but I did not run a live Codex app-server reproduction.

Review metrics: none identified.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🐚 platinum hermit
Result: blocked until real behavior proof from a real setup is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P1] Add redacted terminal output or logs from a Codex supervisor run or minimal real stdio child run showing the stderr tail no longer contains a dangling surrogate; redact IPs, API keys, phone numbers, and non-public endpoints.
After adding proof, update the PR body so ClawSweeper re-reviews automatically, or ask a maintainer to comment @clawsweeper re-review if it does not.

Proof guidance:

[P1] Needs real behavior proof before merge: The PR cites type-check/helper-test evidence but no real after-fix Codex supervisor run or stderr output; the contributor should add redacted terminal output or logs and update the PR body for a fresh review.

Risk before merge

[P1] The PR body does not include real after-fix Codex supervisor output; it relies on type-check/helper-test style evidence and explicitly says no real Codex app-server process with surrogate-pair stderr was tested.
[P1] A sibling Codex app-server client still has raw slice-based stderr preview/tail helpers, so this branch should be treated as a narrow supervisor fix rather than a complete Codex stderr diagnostic sweep.

Maintainer options:

Decide the mitigation before merge
Keep the code change narrow for codex-supervisor, require redacted runtime proof or a maintainer proof override before merge, and handle broader Codex app-server stderr cleanup separately if desired.
Pause or close
Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

[P1] The remaining gate is contributor-provided real behavior proof or maintainer proof override; there is no concrete code repair marker from this review.

Security
Cleared: The diff only adds an existing OpenClaw plugin SDK helper import and changes diagnostic string truncation; no dependency, workflow, lockfile, secret, permission, or code-execution surface changes were found.

Review details

Best possible solution:

Keep the code change narrow for codex-supervisor, require redacted runtime proof or a maintainer proof override before merge, and handle broader Codex app-server stderr cleanup separately if desired.

Do we have a high-confidence way to reproduce the issue?

Do we have a high-confidence way to reproduce the issue? Source inspection gives a clear focused path: the stdio close handler on current main slices a joined stderr string at 1200 UTF-16 code units, which can split a surrogate pair, but I did not run a live Codex app-server reproduction.

Is this the best way to solve the issue?

Is this the best way to solve the issue? Yes for the stated codex-supervisor bug: reuse the existing public plugin SDK UTF-16 helper at the diagnostic boundary while preserving the current limit and message shape; it is not a full sibling stderr-diagnostic sweep.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 4ad94febcb31.

Label changes

Label changes:

add P3: This is a small diagnostic-string correctness fix with low blast radius and no API, config, storage, delivery, or routing surface change.
add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR cites type-check/helper-test evidence but no real after-fix Codex supervisor run or stderr output; the contributor should add redacted terminal output or logs and update the PR body for a fresh review.

Label justifications:

P3: This is a small diagnostic-string correctness fix with low blast radius and no API, config, storage, delivery, or routing surface change.
rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR cites type-check/helper-test evidence but no real after-fix Codex supervisor run or stderr output; the contributor should add redacted terminal output or logs and update the PR body for a fresh review.

Evidence reviewed

PR surface:

Source +1. Total +1 across 1 file.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	2	1	+1
Tests	0	0	0	0
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	1	2	1	+1

What I checked:

Current main still has unsafe stderr-tail truncation: StdioCodexJsonRpcConnection collects stderr lines and currently formats the transport-closed error with this.stderrTail.join("\n").slice(0, 1200), so the central requested change is not already implemented on main. (extensions/codex-supervisor/src/json-rpc-client.ts:202, 4ad94febcb31)
PR diff is a one-call-site helper replacement: The branch imports truncateUtf16Safe from the focused plugin SDK text utility runtime and replaces only the stderr-tail .slice(0, 1200) call. (extensions/codex-supervisor/src/json-rpc-client.ts:200, afedb38fdba6)
Helper contract is suitable for this boundary: truncateUtf16Safe floors the limit, returns shorter input unchanged, and delegates to sliceUtf16Safe, whose implementation avoids returning dangling surrogate halves. (packages/normalization-core/src/utf16-slice.ts:43, 4ad94febcb31)
Plugin SDK import boundary is valid: The focused openclaw/plugin-sdk/text-utility-runtime subpath exports truncateUtf16Safe, and the root package exports that plugin SDK subpath. (src/plugin-sdk/text-utility-runtime.ts:21, 4ad94febcb31)
Codex app-server stdio and stderr contract checked: Sibling Codex source documents and implements stdio:// as the default app-server transport and writes app-server tracing/log output to stderr, so the OpenClaw stderr tail is a real diagnostic path. (../codex/codex-rs/app-server/README.md:26, 0d18d4f7535d)
Caller path inspected: CodexSupervisor creates and caches connections through connectCodexAppServerEndpoint, so stdio connection failures surface through endpoint probes and tool operations. (extensions/codex-supervisor/src/supervisor.ts:509, 4ad94febcb31)

Likely related people:

zhangguiping-xydt: GitHub history for merged fix(codex): avoid broken emoji in dynamic tool timeout logs #102509 maps the current codex-supervisor file and unsafe stderr-tail line to this author’s merged commit. (role: introduced behavior and recent area contributor; confidence: high; commits: b23fdcfac953; files: extensions/codex-supervisor/src/json-rpc-client.ts, extensions/codex/src/app-server/dynamic-tool-execution.ts)
steipete: The merged adjacent PR includes a land-ready verification and merge comment from this account plus co-author metadata, including direct Codex contract inspection for the same UTF-16 diagnostic bug class. (role: recent verifier and merger for adjacent Codex UTF-16 diagnostic work; confidence: medium; commits: b23fdcfac953; files: extensions/codex/src/app-server/dynamic-tool-execution.ts, extensions/codex-supervisor/src/json-rpc-client.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

steipete · 2026-07-09T09:59:06Z

Land-ready verification at exact head a3ee3a9f4e4c566dc2a32c01f5c8ff424d87c402:

Improved the patch with a real child-process regression: the fixture writes an emoji across the 1,200-code-unit stderr boundary, exits, and the test asserts the complete CodexJsonRpcClient close error.
node scripts/run-vitest.mjs extensions/codex-supervisor/src/supervisor.test.ts — 32 tests passed.
oxfmt and git diff --check passed.
Fresh autoreview: clean, 0.99 confidence; no accepted/actionable findings.
Native OPENCLAW_TESTBOX=1 scripts/pr prepare-run 102590 passed exact-head hosted CI/Testbox gates.
Direct dependency contract check: upstream Codex app-server configures tracing on stderr in lib.rs, so the client-owned bounded stderr diagnostic is the correct repair surface.

No docs, config, protocol, or dependency changes. Ready to merge.

steipete · 2026-07-09T09:59:22Z

Merged via squash.

Prepared head SHA: a3ee3a9f4e4c566dc2a32c01f5c8ff424d87c402
Landed commit: 4be6fa7413af0fdc6a3624f99045406dc6419bd0

…on (openclaw#102590) * fix(codex-supervisor): use truncateUtf16Safe for stderr tail truncation StdioCodexJsonRpcConnection includes stderr output in the transport-closed error message with a naive .slice(0, 1200) which can split surrogate pairs. Replace with truncateUtf16Safe(). * test(codex-supervisor): cover UTF-16-safe stderr tails --------- Co-authored-by: Peter Steinberger <[email protected]>

fix(codex-supervisor): use truncateUtf16Safe for stderr tail truncation

afedb38

StdioCodexJsonRpcConnection includes stderr output in the transport-closed error message with a naive .slice(0, 1200) which can split surrogate pairs. Replace with truncateUtf16Safe().

wangmiao0668000666 mentioned this pull request Jul 9, 2026

fix(text): keep five src-side text truncations UTF-16 safe #102630

Closed

9 tasks

test(codex-supervisor): cover UTF-16-safe stderr tails

a3ee3a9

steipete merged commit 4be6fa7 into openclaw:main Jul 9, 2026
103 checks passed

github-actions Bot mentioned this pull request Jul 9, 2026

📡 Upstream Digest — 2026-07-09 10:56 UTC curtismercier/openclaw-mods#1242

Open

wangmiao0668000666 mentioned this pull request Jul 9, 2026

fix(chat,cli): keep session snippet and CLI output digest truncation UTF-16 safe #102747

Closed

9 tasks

OpenClawKobian99 mentioned this pull request Jul 14, 2026

[Bug]: memory-core dreaming narrative fails with "no low surrogate in string" API 400 — clampDiaryContextEntry truncates mid-surrogate-pair (fix on main, missing from v2026.7.1) #107815

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(codex-supervisor): use truncateUtf16Safe for stderr tail truncation#102590

fix(codex-supervisor): use truncateUtf16Safe for stderr tail truncation#102590
steipete merged 2 commits into
openclaw:mainfrom
Pandah97:fix/truncateUtf16Safe-codex-supervisor

Pandah97 commented Jul 9, 2026 •

edited by steipete

Loading

Uh oh!

clawsweeper Bot commented Jul 9, 2026 •

edited

Loading

Uh oh!

steipete commented Jul 9, 2026

Uh oh!

Uh oh!

steipete commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

Pandah97 commented Jul 9, 2026 • edited by steipete Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Files Changed

Uh oh!

clawsweeper Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

steipete commented Jul 9, 2026

Uh oh!

Uh oh!

steipete commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Pandah97 commented Jul 9, 2026 •

edited by steipete

Loading

clawsweeper Bot commented Jul 9, 2026 •

edited

Loading