Skip to content

fix(active-memory): keep bounded search queries UTF-16 safe#102621

Merged
steipete merged 1 commit into
openclaw:mainfrom
lzyyzznl:fix/truncateUtf16Safe-active-memory-log
Jul 9, 2026
Merged

fix(active-memory): keep bounded search queries UTF-16 safe#102621
steipete merged 1 commit into
openclaw:mainfrom
lzyyzznl:fix/truncateUtf16Safe-active-memory-log

Conversation

@lzyyzznl

@lzyyzznl lzyyzznl commented Jul 9, 2026 •
edited by steipete
Loading

Copy link
Copy Markdown
Contributor

What Problem This Solves

Active Memory bounds the normalized latest-message search query to 480 UTF-16 units before placing it in the memory-search prompt. A raw slice could leave a dangling surrogate when an emoji crossed that boundary.

Why This Change Was Made

Rebuilt the PR on current main, removed the log-value hunk already landed in #102551, and applied the existing shared UTF-16-safe truncator only to the remaining search-query owner.

User Impact

Long Active Memory search queries remain valid Unicode at the same 480-unit limit. Query mode, filtering, prompt structure, and ASCII behavior are unchanged.

Evidence

  • Added an exact before_prompt_build regression that inspects the bounded search query at the surrogate boundary.
  • Focused Active Memory suite: 158 passed.
  • Focused oxfmt, oxlint, and git diff --check passed.
  • Fresh autoreview clean (0.99).

Co-authored-by: lizeyu-xydt [email protected]

@openclaw-barnacle openclaw-barnacle Bot added size: XS triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. labels Jul 9, 2026
@clawsweeper

clawsweeper Bot commented Jul 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs real behavior proof before merge. Reviewed July 9, 2026, 6:24 AM ET / 10:24 UTC.

Summary
This PR changes Active Memory log-value and search-query truncation to use truncateUtf16Safe instead of raw slice.

PR surface: Source 0. Total 0 across 1 file.

Reproducibility: yes. from source inspection: current main still raw-slices the bounded search query at a UTF-16 code-unit boundary. The shared helper implementation and tests show the surrogate-boundary behavior this call site should use.

Review metrics: 1 noteworthy metric.

  • Current-main overlap: 1 of 2 truncation sites already fixed on main. The log-value hunk is redundant after the merged sibling PR, while the search-query hunk remains the useful delta to review.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🐚 platinum hermit
Result: blocked until real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • [P1] Add redacted terminal output, logs, copied live output, or a validation transcript showing the search-query surrogate-boundary truncation stays well formed.
  • Refresh the PR description or branch context against current main so reviewers can see that only the search-query hunk remains unique.
  • Consider adding a focused Active Memory regression test for the latest-message search-query clamp.

Proof guidance:

  • [P1] Needs real behavior proof before merge: The PR body has rationale and mechanical evidence, but no after-fix real behavior proof; add redacted terminal output, logs, copied live output, or a validation transcript, then update the PR body so ClawSweeper re-reviews automatically, or ask a maintainer to comment @clawsweeper re-review.

Risk before merge

  • [P1] Contributor after-fix real behavior proof is still missing; merge should wait for redacted terminal output, logs, copied live output, or a validation transcript showing the Active Memory surrogate-boundary case stays well formed.
  • [P1] The log-value hunk is now redundant with current main, so reviewers should focus on the remaining search-query clamp rather than treating both call sites as still unfixed.
  • [P1] There is adjacent helper and Active Memory coverage, but no exact regression test for the final latest-message search-query clamp in this PR.

Maintainer options:

  1. Decide the mitigation before merge
    Land or replace the remaining search-query truncateUtf16Safe clamp on current main while preserving the already-merged log-value fix and adding real behavior proof.
  2. Pause or close
    Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

  • [P1] This PR already contains the narrow remaining implementation path; the next action is contributor proof and ordinary maintainer review rather than automated repair.

Security
Cleared: The diff only swaps bounded string truncation calls inside one plugin and does not touch secrets, dependencies, workflows, package resolution, or code execution surfaces.

Review details

Best possible solution:

Land or replace the remaining search-query truncateUtf16Safe clamp on current main while preserving the already-merged log-value fix and adding real behavior proof.

Do we have a high-confidence way to reproduce the issue?

Yes, from source inspection: current main still raw-slices the bounded search query at a UTF-16 code-unit boundary. The shared helper implementation and tests show the surrogate-boundary behavior this call site should use.

Is this the best way to solve the issue?

Yes for the intended code shape: using the existing plugin SDK text helper at the caller is the narrowest maintainable fix. The mergeable end state should pair that code change with contributor real behavior proof, and a focused search-query regression test would further reduce review risk.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 2f66c3c0c845.

Label changes

Label justifications:

  • P3: The remaining change is a narrow internal Active Memory Unicode-validity fix with limited blast radius.
  • rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
  • status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body has rationale and mechanical evidence, but no after-fix real behavior proof; add redacted terminal output, logs, copied live output, or a validation transcript, then update the PR body so ClawSweeper re-reviews automatically, or ask a maintainer to comment @clawsweeper re-review.
Evidence reviewed

PR surface:

Source 0. Total 0 across 1 file.

View PR surface stats
Area Files Added Removed Net
Source 1 2 2 0
Tests 0 0 0 0
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 1 2 2 0

What I checked:

Likely related people:

  • lsr911: Authored the merged Active Memory log-value UTF-16 truncation fix that overlaps one of this PR's two call sites. (role: recent adjacent contributor; confidence: high; commits: e39e628a8416; files: extensions/active-memory/index.ts, extensions/active-memory/index.test.ts)
  • steipete: Authored the merged broad UTF-16 bounded-text sweep and co-authored the merged Active Memory log-boundary follow-up. (role: adjacent sweep author/reviewer; confidence: high; commits: a9582a1bb62a, e39e628a8416; files: extensions/active-memory/index.ts, extensions/active-memory/index.test.ts, packages/normalization-core/src/utf16-slice.ts)
  • Takhoffman: Git history shows several early Active Memory recall/runtime changes in this plugin area, including query-mode and hidden prompt-prefix behavior. (role: feature-history contributor; confidence: high; commits: f94d6778b1d5, 9d126dc64584, 885209ed0330; files: extensions/active-memory/index.ts, extensions/active-memory/index.test.ts)
  • obviyus: Git blame shows the current Active Memory file, including clampSearchQuery, entered main through the current implementation import commit by Ayaan Zaidi. (role: current implementation carrier; confidence: medium; commits: 4cbe49ba881a; files: extensions/active-memory/index.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.
Review history (1 earlier review cycle)
  • reviewed 2026-07-09T09:45:19.184Z sha eec70a1 :: needs real behavior proof before merge. :: none

@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P3 Low-priority cleanup, docs, polish, ergonomics, or speculative work. labels Jul 9, 2026
@openclaw-barnacle openclaw-barnacle Bot removed the triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. label Jul 9, 2026
@steipete
steipete force-pushed the fix/truncateUtf16Safe-active-memory-log branch from eec70a1 to 7d24864 Compare July 9, 2026 11:29
@steipete steipete changed the title fix(active-memory): use truncateUtf16Safe for log value and search query truncation fix(active-memory): keep bounded search queries UTF-16 safe Jul 9, 2026
@steipete
steipete merged commit 5497662 into openclaw:main Jul 9, 2026
95 checks passed
@steipete

steipete commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

Merged via squash.

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jul 10, 2026
@lzyyzznl @steipete
fix(active-memory): keep search queries UTF-16 safe (openclaw#102621)
04a563c 
Co-authored-by: Peter Steinberger <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

P3 Low-priority cleanup, docs, polish, ergonomics, or speculative work. rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. size: XS status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@lzyyzznl @steipete