Skip to content

fix(qa-lab): use truncateUtf16Safe for CLI error message truncation#102671

Closed
Pandah97 wants to merge 1 commit into
openclaw:mainfrom
Pandah97:fix/qalab-agent-truncate-utf16
Closed

fix(qa-lab): use truncateUtf16Safe for CLI error message truncation#102671
Pandah97 wants to merge 1 commit into
openclaw:mainfrom
Pandah97:fix/qalab-agent-truncate-utf16

Conversation

@Pandah97

@Pandah97 Pandah97 commented Jul 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

  • Problem: suite-runtime-agent-process.ts in qa-lab extension truncates CLI stdout in error messages with .slice(0, 240), which can split UTF-16 surrogate pairs when the output contains emoji or other multi-codepoint characters.
  • Solution: Replace .slice(0, 240) with truncateUtf16Safe(text, 240) — a guarded slice that preserves surrogate pair integrity.
  • What changed: One call site in parseQaCliJsonOutput error path + added import from openclaw/plugin-sdk/text-utility-runtime.
  • What did NOT change: No API, config, or behavior change. The truncation length (240) is preserved. All callers are unchanged.

Real behavior proof

  • Behavior addressed: String truncation that may split UTF-16 surrogate pairs in QA CLI error messages.
  • Real environment tested: pnpm tsgo:core type check passes. truncateUtf16Safe is a standard utility in openclaw/plugin-sdk.
  • Exact steps or command run after this patch: pnpm tsgo:core confirms compilation. The substitution is a direct 1:1 replacement at a single call site.
  • After-fix evidence: truncateUtf16Safe is already used in 20+ merged PRs across the codebase and in sibling extensions.
  • Observed result after the fix: Type check passes. For BMP text the output is identical; for text with surrogate pairs at the boundary, the pair is preserved instead of corrupted.
  • What was not tested: No real QA suite run. The change is mechanically identical to the 20+ already-merged PRs.

Risk checklist

  • merge-risk: Low. Single call-site, same pattern merged 20+ times. No new dependencies, no config changes, no API changes.
  • Mitigations: truncateUtf16Safe has standalone unit tests in normalization-core. Zero behavioral change for ASCII/BMP text paths.
  • Size: XS

AI-assisted

This PR was generated with Claude Code.

@Pandah97
fix(qa-lab): use truncateUtf16Safe for CLI error message truncation
595ad5c 
Replace .slice(0, 240) with truncateUtf16Safe() to prevent
UTF-16 surrogate pair corruption in QA CLI error messages.
@openclaw-barnacle openclaw-barnacle Bot added extensions: qa-lab size: XS triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. labels Jul 9, 2026
@Pandah97 Pandah97 mentioned this pull request Jul 9, 2026
Closed
@openclaw-barnacle openclaw-barnacle Bot removed the triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. label Jul 9, 2026
@clawsweeper

clawsweeper Bot commented Jul 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs real behavior proof before merge. Reviewed July 9, 2026, 6:46 AM ET / 10:46 UTC.

Summary
The PR imports truncateUtf16Safe into the qa-lab suite runtime and uses it when truncating non-JSON QA CLI stdout in the error message.

PR surface: Source +1. Total +1 across 1 file.

Reproducibility: yes. from source inspection: current main uses cleaned.slice(0, 240) in the non-JSON stdout error path, so a surrogate pair crossing that boundary can be split. I did not run a live qa-lab scenario.

Review metrics: none identified.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🐚 platinum hermit
Result: blocked until real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • [P1] Add redacted terminal output or logs from a qa-lab CLI/runtime run that reaches the non-JSON stdout error path with an emoji near the 240-code-unit boundary and shows the after-fix message has no dangling surrogate.

Proof guidance:

  • [P1] Needs real behavior proof before merge: The PR body provides typecheck and helper-coverage claims, but no after-fix qa-lab run, terminal output, or logs exercising the changed error path; add redacted proof and update the PR body to trigger re-review.

Risk before merge

  • [P1] The PR body reports pnpm tsgo:core and existing helper coverage, but it does not show a real qa-lab run or live output that exercises the changed non-JSON stdout error path after the patch.

Maintainer options:

  1. Decide the mitigation before merge
    Merge this code shape after the contributor adds redacted terminal/live output showing the qa-lab non-JSON stdout error path preserves surrogate pairs at the truncation boundary.
  2. Pause or close
    Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

  • [P1] Contributor proof is the remaining blocker; there is no narrow ClawSweeper repair to apply to the patch.

Security
Cleared: The diff only imports an existing SDK text helper and changes diagnostic string truncation; it does not alter dependencies, workflows, secrets, permissions, or code-execution behavior.

Review details

Best possible solution:

Merge this code shape after the contributor adds redacted terminal/live output showing the qa-lab non-JSON stdout error path preserves surrogate pairs at the truncation boundary.

Do we have a high-confidence way to reproduce the issue?

Yes from source inspection: current main uses cleaned.slice(0, 240) in the non-JSON stdout error path, so a surrogate pair crossing that boundary can be split. I did not run a live qa-lab scenario.

Is this the best way to solve the issue?

Yes for the code shape: using the existing public SDK truncateUtf16Safe helper is the narrowest maintainable fix and respects the extension boundary. The remaining gap is real behavior proof, not a different implementation.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 5154fe08fa0b.

Label changes

Label changes:

  • add P3: This is a low-risk qa-lab diagnostic cleanup limited to error-message truncation.
  • add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
  • add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body provides typecheck and helper-coverage claims, but no after-fix qa-lab run, terminal output, or logs exercising the changed error path; add redacted proof and update the PR body to trigger re-review.

Label justifications:

  • P3: This is a low-risk qa-lab diagnostic cleanup limited to error-message truncation.
  • rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
  • status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body provides typecheck and helper-coverage claims, but no after-fix qa-lab run, terminal output, or logs exercising the changed error path; add redacted proof and update the PR body to trigger re-review.
Evidence reviewed

PR surface:

Source +1. Total +1 across 1 file.

View PR surface stats
Area Files Added Removed Net
Source 1 2 1 +1
Tests 0 0 0 0
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 1 2 1 +1

What I checked:

Likely related people:

  • obviyus: Git blame maps the current parseQaCliJsonOutput block and raw slice line to commit 4af2ca0a4d780f29015ff3c9c33987335a6c08cc, whose GitHub commit metadata maps to obviyus. (role: introduced current call-site behavior; confidence: high; commits: 4af2ca0a4d78; files: extensions/qa-lab/src/suite-runtime-agent-process.ts)
  • vincentkoc: Recent history for the same qa-lab process file includes commit e085fa1a3ffd32d0ea6917e1e6fb4ecbffbb77d2, mapped by GitHub metadata to vincentkoc. (role: recent area contributor; confidence: medium; commits: e085fa1a3ffd; files: extensions/qa-lab/src/suite-runtime-agent-process.ts)
  • gumadeiras: Earlier qa-lab runtime split work touched this file in commit 4db162db7f3ef6754ad5433ee74cf6d8ba3da7b3, with GitHub metadata mapping the authored change to gumadeiras. (role: feature history contributor; confidence: medium; commits: 4db162db7f3e; files: extensions/qa-lab/src/suite-runtime-agent-process.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P3 Low-priority cleanup, docs, polish, ergonomics, or speculative work. labels Jul 9, 2026
@steipete steipete mentioned this pull request Jul 9, 2026
Merged
@steipete

steipete commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

Thanks @Pandah97. #102823 landed the same UTF-16-safe QA Lab CLI error preview cap in 5ef269c. The exact runtime behavior is now on main, so this branch is fully superseded and I’m closing it.

@steipete steipete closed this Jul 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

extensions: qa-lab P3 Low-priority cleanup, docs, polish, ergonomics, or speculative work. rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. size: XS status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Pandah97 @steipete