fix(imessage): keep CLI stderr tails UTF-16 safe by wings1029 · Pull Request #102626 · openclaw/openclaw

wings1029 · 2026-07-09T09:33:06Z

What Problem This Solves

The iMessage CLI stderr accumulator retained its bounded tail with a raw negative UTF-16 slice. If the retained suffix began between the halves of an emoji or another supplementary character, error output could start with a lone low surrogate.

Why This Change Was Made

The shared appendIMessageCliStderrTail owner now uses sliceUtf16Safe for its suffix. That one change covers both iMessage CLI execution paths while preserving the existing cap and recent-error semantics.

User Impact

Bounded iMessage CLI error details remain valid Unicode. Stderr within the limit and ASCII-only tails are unchanged.

Evidence

Focused iMessage CLI output suite passed.
The improved regression demonstrates the old raw suffix starts with a lone low surrogate and asserts the exact safe suffix.
Focused oxfmt and oxlint passed; git diff --check passed.
Fresh branch autoreview found no accepted or actionable findings (0.96 confidence).

clawsweeper · 2026-07-09T09:46:28Z

Codex review: needs maintainer review before merge. Reviewed July 9, 2026, 9:47 AM ET / 13:47 UTC.

Summary
The PR changes the shared iMessage CLI stderr-tail helper to use sliceUtf16Safe through the plugin SDK and adds a surrogate-boundary regression test.

PR surface: Source +1, Tests +7. Total +8 across 2 files.

Reproducibility: yes. Current main's helper still uses raw next.slice(-maxChars), and a focused Node probe of the same surrogate-boundary input starts with low surrogate 0xde80; both iMessage CLI paths feed stderr through that helper.

Review metrics: none identified.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

Refresh against the current base and clear the exact-head check failure before landing.

Next step before merge

[P2] No repair lane is needed because the prior code finding and real-proof gap are resolved; remaining work is ordinary maintainer landing validation.

Security
Cleared: No workflow, lockfile, dependency, secret-handling, or new code-execution surface changed; the patch only changes string tail slicing and its regression test.

Review details

Best possible solution:

Keep the shared-helper fix and regression test, then land after the normal exact-head CI/native prepare gates pass.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main's helper still uses raw next.slice(-maxChars), and a focused Node probe of the same surrogate-boundary input starts with low surrogate 0xde80; both iMessage CLI paths feed stderr through that helper.

Is this the best way to solve the issue?

Yes. The shared stderr-tail helper is the right owner-boundary fix, and using the plugin SDK text helper avoids duplicating the invariant in each caller.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 0e626690cd5d.

Label changes

Label changes:

add proof: sufficient: Contributor real behavior proof is sufficient. A maintainer provided exact-head live-path proof for the iMessage actions runtime stderr boundary, including surrogate-boundary and ASCII controls.
add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): A maintainer provided exact-head live-path proof for the iMessage actions runtime stderr boundary, including surrogate-boundary and ASCII controls.
remove rating: 🧂 unranked krab: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
remove merge-risk: 🚨 compatibility: Current PR review selected no merge-risk labels.
remove status: 📣 needs proof: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

P2: This is a narrow iMessage runtime bug fix with limited blast radius and a clear validation path.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): A maintainer provided exact-head live-path proof for the iMessage actions runtime stderr boundary, including surrogate-boundary and ASCII controls.
proof: sufficient: Contributor real behavior proof is sufficient. A maintainer provided exact-head live-path proof for the iMessage actions runtime stderr boundary, including surrogate-boundary and ASCII controls.

Evidence reviewed

PR surface:

Source +1, Tests +7. Total +8 across 2 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	2	1	+1
Tests	1	7	0	+7
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	2	9	1	+8

What I checked:

Current main still has the bug: appendIMessageCliStderrTail on current main still returns next.slice(-maxChars), so the central behavior is not already implemented on main. (extensions/imessage/src/cli-output.ts:53, 0e626690cd5d)
Latest release still has the bug: The latest release tag also retains stderr with raw next.slice(-maxChars), so this fix has not already shipped. (extensions/imessage/src/cli-output.ts:29, e085fa1a3ffd)
PR fixes the shared helper: The latest PR head imports sliceUtf16Safe from openclaw/plugin-sdk/text-utility-runtime and uses it in the shared stderr-tail helper. (extensions/imessage/src/cli-output.ts:54, 3567bd156da0)
Both runtime paths share the helper: The iMessage actions runtime and send path both append stderr through appendIMessageCliStderrTail, so fixing the helper covers both CLI execution paths. (extensions/imessage/src/actions.runtime.ts:251, 0e626690cd5d)
Regression hits the surrogate boundary: The new test first proves raw slice(-11) starts with low surrogate \ude80, then asserts the helper returns the safe suffix. (extensions/imessage/src/cli-output.test.ts:24, 3567bd156da0)
Prior SDK import finding is resolved: The current head switches the production import from @openclaw/normalization-core/utf16-slice to the supported plugin SDK subpath. (extensions/imessage/src/cli-output.ts:3, 3567bd156da0)

Likely related people:

obviyus: GitHub commit metadata maps the current-main blame commit for the helper and both stderr caller lines to this account, though the local checkout marks that commit as grafted and broad. (role: current-main line owner; confidence: medium; commits: f32c36cdc878; files: extensions/imessage/src/cli-output.ts, extensions/imessage/src/actions.runtime.ts, extensions/imessage/src/send.ts)
vincentkoc: History shows the focused fix(imessage): bound cli output capture commit added the bounded CLI output helper surface this PR repairs. (role: feature-history contributor; confidence: high; commits: 65d47dc5d7fc; files: extensions/imessage/src/cli-output.ts, extensions/imessage/src/actions.runtime.ts, extensions/imessage/src/send.ts)
cxbAsDev: Recent merged iMessage CLI stream-error work touched the same helper and both child-process stderr paths. (role: recent iMessage CLI contributor; confidence: medium; commits: 08abf83a6659; files: extensions/imessage/src/cli-output.ts, extensions/imessage/src/actions.runtime.ts, extensions/imessage/src/send.ts)
steipete: The live PR is assigned to this person, their exact-head proof closes the prior evidence gap, and history shows multiple earlier iMessage touches. (role: assigned reviewer and recent area contributor; confidence: medium; commits: 3567bd156da0, d85b2a0e81, 3bb02d3338; files: extensions/imessage/src/cli-output.ts, extensions/imessage/src/cli-output.test.ts, extensions/imessage/src/actions.runtime.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (2 earlier review cycles)

reviewed 2026-07-09T09:51:32.855Z sha ee5a15b :: needs real behavior proof before merge. :: [P1] Import text helpers through the plugin SDK | [P2] Put the surrogate on the tail boundary
reviewed 2026-07-09T12:06:42.674Z sha 4ef569e :: needs real behavior proof before merge. :: [P1] Import text helpers through the plugin SDK

steipete · 2026-07-09T13:28:55Z

Maintainer land-ready proof on exact head eeabba805c856af999edea6443e4e251713de84f.

The real-git rebase is based on 2d5dd6c03584988216c3f15e26644db9c152fef7; the hosted PR diff is exactly the two intended iMessage files (+9/-1), and all three rebased commits have valid signatures.
appendIMessageCliStderrTail now uses the public plugin-SDK UTF-16-safe slice helper shared by both iMessage CLI execution callers. The regression test proves the previous negative-slice boundary began with a lone low surrogate and the repaired tail does not.
Exact-head credential-free live proof exercised imessageActionsRuntime.sendReaction through a temporary executable that emitted oversized stderr and exited nonzero. The surrogate case retained 65,535 UTF-16 units, began with y, and had no lone surrogate. The ASCII control retained all 65,536 units and began with b.
Fresh whole-branch autoreview: clean, confidence 0.99. Source-blind behavior validation: satisfies_contract, confidence 1.0.
Exact-head CI run 29023021793: 43 jobs succeeded, 12 intentionally skipped, zero failed, cancelled, timed out, or incomplete.
Native hosted prepare passed and confirmed the remote branch was already at the reviewed head.

Commands/evidence:

node --import tsx .local/pr102626-imessage-stderr-live.mts
git diff --check origin/main...HEAD
.agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main --no-web-search
OPENCLAW_TESTBOX=1 OPENCLAW_PR_PUSH_MODE=git OPENCLAW_ALLOW_UNSIGNED_GIT_PUSH=1 scripts/pr prepare-run 102626

No Messages account, database, phone number, credential, or real send was involved. That is intentional: the user-visible contract under test is the spawned CLI failure/error-tail boundary, and the exact runtime path was exercised without risking a message send. No remaining proof gaps.

clawsweeper · 2026-07-09T13:28:59Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

steipete · 2026-07-09T14:04:13Z

Merged via squash.

Prepared head SHA: eeabba805c856af999edea6443e4e251713de84f
Landed commit: 4c55d462541f8b76918a1fca2ad82278c38ee8ae

* fix(imessage): keep CLI stderr tail truncation UTF-16 safe * test(imessage): hit stderr surrogate boundary * fix(imessage): use plugin sdk text helper --------- Co-authored-by: Peter Steinberger <[email protected]>

openclaw-barnacle Bot added channel: imessage Channel integration: imessage size: XS labels Jul 9, 2026

steipete changed the title ~~fix(imessage): keep CLI stderr tail truncation UTF-16 safe~~ fix(imessage): keep CLI stderr tails UTF-16 safe Jul 9, 2026

steipete self-assigned this Jul 9, 2026

steipete force-pushed the fix/utf16-safe-imessage-cli-output branch from 4ef569e to 3567bd1 Compare July 9, 2026 13:17

wings1029 and others added 3 commits July 9, 2026 14:50

fix(imessage): keep CLI stderr tail truncation UTF-16 safe

a5f2858

test(imessage): hit stderr surrogate boundary

f73bc95

fix(imessage): use plugin sdk text helper

eeabba8

openclaw-barnacle Bot added channel: googlechat Channel integration: googlechat channel: msteams Channel integration: msteams app: web-ui App: web-ui commands Command implementations channel: qqbot extensions: codex size: L and removed size: XS labels Jul 9, 2026

steipete force-pushed the fix/utf16-safe-imessage-cli-output branch from 7e81331 to eeabba8 Compare July 9, 2026 13:51

openclaw-barnacle Bot added size: XS and removed channel: googlechat Channel integration: googlechat channel: msteams Channel integration: msteams app: web-ui App: web-ui commands Command implementations channel: qqbot extensions: codex size: L labels Jul 9, 2026

steipete merged commit 4c55d46 into openclaw:main Jul 9, 2026
111 of 118 checks passed

github-actions Bot mentioned this pull request Jul 9, 2026

📡 Upstream Digest — 2026-07-09 14:36 UTC curtismercier/openclaw-mods#1243

Open

steipete mentioned this pull request Jul 9, 2026

docs(changelog): credit recent UTF-16 and display fixes #103102

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(imessage): keep CLI stderr tails UTF-16 safe#102626

fix(imessage): keep CLI stderr tails UTF-16 safe#102626
steipete merged 3 commits into
openclaw:mainfrom
wings1029:fix/utf16-safe-imessage-cli-output

wings1029 commented Jul 9, 2026 •

edited by steipete

Loading

Uh oh!

clawsweeper Bot commented Jul 9, 2026 •

edited

Loading

Uh oh!

steipete commented Jul 9, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jul 9, 2026 •

edited

Loading

Uh oh!

Uh oh!

steipete commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

wings1029 commented Jul 9, 2026 • edited by steipete Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

clawsweeper Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

steipete commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clawsweeper Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

steipete commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

wings1029 commented Jul 9, 2026 •

edited by steipete

Loading

clawsweeper Bot commented Jul 9, 2026 •

edited

Loading

steipete commented Jul 9, 2026 •

edited

Loading

clawsweeper Bot commented Jul 9, 2026 •

edited

Loading