* fix(sandbox): keep redacted session keys UTF-16 safe

* test(sandbox): cover UTF-16 redaction boundaries

---------

Co-authored-by: Peter Steinberger <[email protected]>

…ster regression

Adds the mushuiyu886 openclaw#102969/openclaw#102949 proof shape to the existing regression:

- LABEL_TRUNCATION_MODE=baseline swaps the SDK truncateUtf16Safe with raw
  String.prototype.slice via vi.mock, so the same test cases run as
  control-red on the buggy code. Three of the four boundary cases fail
  with 'lone high surrogate detected' (one passes: the no-cut baseline).
- LABEL_PROOF_DUMP=1 writes a [proof] line per case with the actual
  length=, hex_tail= of the parsed display_name= value plus the
  isLoneHighSurrogate verdict. Crabbox can capture the line and the PR
  body can paste it next to the run URL.
- vi.hoisted() lifts the env-var reads so the vi.mock factory (which is
  hoisted to the top of the file) can reference them safely.

No production code change.  No new SDK surface.  No touched files
outside extensions/discord/src/voice/.

…gressContext

P1 follow-up: the regression test now drives the production
resolveDiscordVoiceIngressContext end-to-end instead of mocking it.

Before: vi.mock("./ingress.js") returned a stub
{ senderIsOwner: false, speakerLabel: "tester" } with no
extraSystemPrompt. The test still exercised the real
appendDiscordVoiceParticipantContext, but the upstream auth + speaker
identity layer was stubbed.

After: the upstream resolveDiscordVoiceIngressContext is the real
production function. The test passes:
- a real DiscordVoiceSpeakerContextResolver instance with a stub
  client whose fetchMember / fetchUser return emoji-laden display data
- cfg = {} and discordConfig = { groupPolicy: "open" } so
  authorizeDiscordVoiceIngress returns { ok: true, channelConfig: null }
  via the owner-allow-all short-circuit and the default-open group
  policy path
- ownerAllowAll: true so the resolveCommandAuthorizedFromAuthorizers
  authorizer is { configured: true, allowed: true }

What now runs for real (not mocked):
- DiscordVoiceSpeakerContextResolver (class, not a stub): exercises
  resolveIdentity + cache + resolveIsOwner
- authorizeDiscordVoiceIngress: real production auth check
- buildDiscordGroupSystemPrompt: real production prompt builder
- appendDiscordVoiceParticipantContext: real production roster builder

What stays mocked:
- the SDK truncateUtf16Safe (only via LABEL_TRUNCATION_MODE=baseline
  vi.mock, which is the test-only control-red affordance)
- the gateway plugin client (the only way to inject listVoiceChannelStates
  state without a real Discord connection)

P2 follow-up: also add the ephemeral worktree control-red shape (the
mushuiyu886 openclaw#102949 / openclaw#102969 gold standard). The test file itself is
unchanged for P2; the proof is captured by running the test in an
ephemeral worktree with the production code reverted to the buggy raw
slice. See 4.5 of the PR body for the full transcript.

Local verification:
- oxlint --threads=1 on the test file: clean (exit 0)
- vitest in fix mode (default): 4 / 4 pass, hex_tail all clean
- vitest in baseline mode (LABEL_TRUNCATION_MODE=baseline): 3 / 4 fail
  with lone high surrogate detected at the boundary
- vitest in ephemeral worktree with participant-context.ts reverted to
  the original slice(0, 100): 3 / 4 fail with the same lone high
  surrogate; the no-cut baseline still passes
- vitest with LABEL_PROOF_DUMP=1 in either mode: emits the [proof]
  line with length= / hex_tail= / lone_surrogate= / sample= per case

Co-Authored-By: Claude <[email protected]>

…ster regression

Adds the mushuiyu886 openclaw#102969/openclaw#102949 proof shape to the existing regression:

- LABEL_TRUNCATION_MODE=baseline swaps the SDK truncateUtf16Safe with raw
  String.prototype.slice via vi.mock, so the same test cases run as
  control-red on the buggy code. Three of the four boundary cases fail
  with 'lone high surrogate detected' (one passes: the no-cut baseline).
- LABEL_PROOF_DUMP=1 writes a [proof] line per case with the actual
  length=, hex_tail= of the parsed display_name= value plus the
  isLoneHighSurrogate verdict. Crabbox can capture the line and the PR
  body can paste it next to the run URL.
- vi.hoisted() lifts the env-var reads so the vi.mock factory (which is
  hoisted to the top of the file) can reference them safely.

No production code change.  No new SDK surface.  No touched files
outside extensions/discord/src/voice/.

…gressContext

P1 follow-up: the regression test now drives the production
resolveDiscordVoiceIngressContext end-to-end instead of mocking it.

Before: vi.mock("./ingress.js") returned a stub
{ senderIsOwner: false, speakerLabel: "tester" } with no
extraSystemPrompt. The test still exercised the real
appendDiscordVoiceParticipantContext, but the upstream auth + speaker
identity layer was stubbed.

After: the upstream resolveDiscordVoiceIngressContext is the real
production function. The test passes:
- a real DiscordVoiceSpeakerContextResolver instance with a stub
  client whose fetchMember / fetchUser return emoji-laden display data
- cfg = {} and discordConfig = { groupPolicy: "open" } so
  authorizeDiscordVoiceIngress returns { ok: true, channelConfig: null }
  via the owner-allow-all short-circuit and the default-open group
  policy path
- ownerAllowAll: true so the resolveCommandAuthorizedFromAuthorizers
  authorizer is { configured: true, allowed: true }

What now runs for real (not mocked):
- DiscordVoiceSpeakerContextResolver (class, not a stub): exercises
  resolveIdentity + cache + resolveIsOwner
- authorizeDiscordVoiceIngress: real production auth check
- buildDiscordGroupSystemPrompt: real production prompt builder
- appendDiscordVoiceParticipantContext: real production roster builder

What stays mocked:
- the SDK truncateUtf16Safe (only via LABEL_TRUNCATION_MODE=baseline
  vi.mock, which is the test-only control-red affordance)
- the gateway plugin client (the only way to inject listVoiceChannelStates
  state without a real Discord connection)

P2 follow-up: also add the ephemeral worktree control-red shape (the
mushuiyu886 openclaw#102949 / openclaw#102969 gold standard). The test file itself is
unchanged for P2; the proof is captured by running the test in an
ephemeral worktree with the production code reverted to the buggy raw
slice. See 4.5 of the PR body for the full transcript.

Local verification:
- oxlint --threads=1 on the test file: clean (exit 0)
- vitest in fix mode (default): 4 / 4 pass, hex_tail all clean
- vitest in baseline mode (LABEL_TRUNCATION_MODE=baseline): 3 / 4 fail
  with lone high surrogate detected at the boundary
- vitest in ephemeral worktree with participant-context.ts reverted to
  the original slice(0, 100): 3 / 4 fail with the same lone high
  surrogate; the no-cut baseline still passes
- vitest with LABEL_PROOF_DUMP=1 in either mode: emits the [proof]
  line with length= / hex_tail= / lone_surrogate= / sample= per case

Co-Authored-By: Claude <[email protected]>

Round 2 follow-up: slim the regression test and PR body to match the
sibling UTF-16-safe cohort (openclaw#106328, openclaw#102949, openclaw#102969) template.

- Test: 304 -> 127 lines (-58%)
  - Removed LABEL_PROOF_DUMP / LABEL_RUN_LOG env vars + dumpDisplayName helper
  - Extracted renderRosterPrompt(nick) + parseDisplayName(prompt) helpers
  - Trimmed 47-line test-file header to 9 lines
  - Kept LABEL_TRUNCATION_MODE=baseline vi.mock for in-process control-red
  - All 4 emoji-boundary cases preserved
- Body: ~30KB -> 10.5KB (-64%)
  - Dropped Round 1/2/3 rebase history
  - Dropped hex code-unit dump
  - Dropped TODO Crabbox run placeholders
  - Restructured to 4-section template
- Production code unchanged: same 1-line + import + named constant patch.
  Same fix/baseline behavior (4/4 pass in fix mode, 3 fail in baseline).

Co-Authored-By: Claude <[email protected]>