fix(openai): use truncateUtf16Safe for image gen log value truncation by lzyyzznl · Pull Request #102611 · openclaw/openclaw

lzyyzznl · 2026-07-09T09:19:14Z

What Problem This Solves

The OpenAI image provider bounds model and auth-mode values before logging its Codex Responses auth-selection diagnostic. A raw UTF-16 code-unit slice could leave a dangling surrogate when an emoji crossed the existing 256-unit boundary.

Why This Change Was Made

Use the shared plugin-SDK truncateUtf16Safe primitive at the existing limit. The sanitization and logging owner remain unchanged, and the fix does not add a second code path or change Codex request/response behavior.

User Impact

Long OpenAI image-generation log values remain valid Unicode. ASCII behavior, the 256-unit bound, auth routing, and image-generation requests are unchanged.

Evidence

Added an exact public-provider-path regression with a surrogate pair crossing the 256-unit boundary.
Focused OpenAI provider suite: 67 passed.
Focused oxfmt, oxlint, and git diff --check passed.
Fresh autoreview clean (0.99).
Direct Codex source inspection confirmed image generation is a stable Responses API item and this patch only affects OpenClaw's local auth-selection log.

Generated with Claude Code; reviewed and improved by an OpenClaw maintainer agent.

One .slice(0, N) truncation site in the OpenAI image generation provider may cut UTF-16 surrogate pairs in half when the log value contains multi-byte characters such as emoji. Replace it with truncateUtf16Safe to keep the truncated output valid Unicode.

clawsweeper · 2026-07-09T09:36:33Z

Codex review: needs real behavior proof before merge. Reviewed July 9, 2026, 6:36 AM ET / 10:36 UTC.

Summary
The PR replaces the OpenAI image-generation log sanitizer's raw slice truncation with the shared UTF-16-safe truncation helper.

PR surface: Source +1. Total +1 across 1 file.

Reproducibility: yes. by source inspection: current main truncates OpenAI image auth/model log values with a raw UTF-16 code-unit slice, which can split a surrogate pair at the limit. I did not run a live reproduction because this review is read-only.

Review metrics: none identified.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🦞 diamond lobster
Result: blocked until real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P1] Add redacted real behavior proof showing emoji-containing OpenAI image auth/model log values after the fix.
Update the PR body after adding proof so ClawSweeper can re-review the current head.

Proof guidance:

[P1] Needs real behavior proof before merge: No PR body or comment proof shows the after-fix OpenAI image-generation log path; add redacted terminal output, copied live output, logs, or a validation transcript, then update the PR body to trigger re-review or ask a maintainer for @clawsweeper re-review.

Risk before merge

[P1] No after-fix real behavior proof has been posted, so maintainers cannot yet verify the actual OpenAI image log truncation path in a real setup.

Maintainer options:

Decide the mitigation before merge
Merge after redacted terminal output, copied live output, logs, or a maintainer proof override confirms emoji-containing OpenAI image auth/model log values truncate without dangling surrogate halves.
Pause or close
Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

[P1] No repair lane is appropriate because I found no concrete code defect in the patch; the remaining blocker is contributor-provided real behavior proof or a maintainer proof override.

Security
Cleared: The diff only imports and calls an existing internal text truncation helper; no security or supply-chain concern was found.

Review details

Best possible solution:

Merge after redacted terminal output, copied live output, logs, or a maintainer proof override confirms emoji-containing OpenAI image auth/model log values truncate without dangling surrogate halves.

Do we have a high-confidence way to reproduce the issue?

Yes, by source inspection: current main truncates OpenAI image auth/model log values with a raw UTF-16 code-unit slice, which can split a surrogate pair at the limit. I did not run a live reproduction because this review is read-only.

Is this the best way to solve the issue?

Yes for the code shape: reusing the exported truncateUtf16Safe helper at the owner-local sanitizer is the narrow maintainable fix. Merge readiness still depends on real behavior proof or a maintainer proof override.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 2f66c3c0c845.

Label changes

Label justifications:

P3: This is a small provider log-string correctness fix with limited blast radius and no config, protocol, persistence, availability, or security surface change.
rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦞 diamond lobster.
status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: No PR body or comment proof shows the after-fix OpenAI image-generation log path; add redacted terminal output, copied live output, logs, or a validation transcript, then update the PR body to trigger re-review or ask a maintainer for @clawsweeper re-review.

Evidence reviewed

PR surface:

Source +1. Total +1 across 1 file.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	2	1	+1
Tests	0	0	0	0
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	1	2	1	+1

What I checked:

PR diff: The branch adds the exported plugin SDK text utility import and swaps the OpenAI image-generation log sanitizer from raw slice truncation to truncateUtf16Safe. (extensions/openai/image-generation-provider.ts:105, 5a85116a48c9)
Current main behavior: Current main still truncates cleaned log values with cleaned.slice(0, LOG_VALUE_MAX_CHARS), which can leave a dangling UTF-16 surrogate half when the 256-code-unit boundary lands inside a pair. (extensions/openai/image-generation-provider.ts:106, 2f66c3c0c845)
Runtime caller path: The sanitizer is used in the OpenAI Codex image auth selection log for auth mode and requested model values, so model/auth strings flow through this truncation site. (extensions/openai/image-generation-provider.ts:707, 2f66c3c0c845)
Helper contract: truncateUtf16Safe floors the limit and delegates to sliceUtf16Safe, whose end-boundary logic backs off before returning a dangling high surrogate. (packages/normalization-core/src/utf16-slice.ts:44, 2f66c3c0c845)
Helper coverage: The normalization tests include truncating at a surrogate-pair boundary and expect the helper not to return a dangling surrogate half. (packages/normalization-core/src/utf16-slice.test.ts:84, 2f66c3c0c845)
Plugin SDK import contract: The text-utility-runtime subpath is exported from the package, so this import follows the bundled plugin boundary instead of reaching into core internals. (package.json:1427, 2f66c3c0c845)

Likely related people:

obviyus: Current blame on main attributes the OpenAI image-generation sanitizer and the shared UTF-16 helper surface to commit 4cbe49b, which GitHub associates with fix(agents): run-lifecycle reliability — bounded release, evidence-based liveness, watchdog semantics #102160 by this user. (role: recent area contributor; confidence: medium; commits: 4cbe49ba881a; files: extensions/openai/image-generation-provider.ts, packages/normalization-core/src/utf16-slice.ts, src/plugin-sdk/text-utility-runtime.ts)
vincentkoc: History shows commit 0f54ca2 moved the OpenAI image-generation provider into the bundled plugin boundary, and commit e085fa1 also carried the same OpenAI image provider and text utility surfaces. (role: feature-history contributor; confidence: medium; commits: 0f54ca20aa50, e085fa1a3ffd; files: extensions/openai/image-generation-provider.ts, src/plugin-sdk/text-utility-runtime.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (1 earlier review cycle)

reviewed 2026-07-09T09:39:15.895Z sha 5a85116 :: needs real behavior proof before merge. :: none

steipete · 2026-07-09T11:21:15Z

Land-ready review complete on exact head a8afb73557031d44c21c42efcf6512b7645f3369.

Replaced the raw 256-unit OpenAI image auth-log cut with the shared plugin-SDK UTF-16-safe truncator while preserving the existing sanitization and ellipsis.
Added an exact public-provider-path regression with an emoji crossing the boundary.
Focused OpenAI provider suite: 67 passed.
Static proof: focused oxfmt, oxlint, git diff --check; fresh autoreview clean (0.99).
Direct Codex contract proof: codex-rs/protocol/src/models.rs defines the Responses API ImageGenerationCall; codex-rs/app-server-protocol/src/protocol/v2/item.rs maps it to the stable app-server image-generation item. This patch changes only OpenClaw's local auth-selection diagnostic.
Native prepare gate: exact-head hosted CI/Testbox passed with 62 relevant checks; remote PR head tree matches the prepared tree.

No docs or changelog entry is required because request routing and image-generation behavior are unchanged.

steipete · 2026-07-09T11:21:28Z

Merged via squash.

Prepared head SHA: a8afb73557031d44c21c42efcf6512b7645f3369
Landed commit: 6c3a46fb4183c5ac36f7343403bcf8953e57b6db

…openclaw#102611) * fix(openai): use truncateUtf16Safe for image gen log value truncation One .slice(0, N) truncation site in the OpenAI image generation provider may cut UTF-16 surrogate pairs in half when the log value contains multi-byte characters such as emoji. Replace it with truncateUtf16Safe to keep the truncated output valid Unicode. * fix(openai): keep image auth logs UTF-16 safe --------- Co-authored-by: Peter Steinberger <[email protected]>

openclaw-barnacle Bot added extensions: openai size: XS triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. labels Jul 9, 2026

openclaw-barnacle Bot removed the triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. label Jul 9, 2026

fix(openai): keep image auth logs UTF-16 safe

a8afb73

steipete merged commit 6c3a46f into openclaw:main Jul 9, 2026
95 checks passed

vincentkoc mentioned this pull request Jul 9, 2026

fix(openai): use truncateUtf16Safe for image generation log truncation #102725

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(openai): use truncateUtf16Safe for image gen log value truncation#102611

fix(openai): use truncateUtf16Safe for image gen log value truncation#102611
steipete merged 2 commits into
openclaw:mainfrom
lzyyzznl:fix/truncateUtf16Safe-openai-img

lzyyzznl commented Jul 9, 2026 •

edited by steipete

Loading

Uh oh!

clawsweeper Bot commented Jul 9, 2026 •

edited

Loading

Uh oh!

steipete commented Jul 9, 2026

Uh oh!

Uh oh!

steipete commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

lzyyzznl commented Jul 9, 2026 • edited by steipete Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

clawsweeper Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

steipete commented Jul 9, 2026

Uh oh!

Uh oh!

steipete commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

lzyyzznl commented Jul 9, 2026 •

edited by steipete

Loading

clawsweeper Bot commented Jul 9, 2026 •

edited

Loading