fix(logging): keep redacted token hints UTF-16 safe#103341
Conversation
clawsweeper
Bot
added
proof: sufficient
|
Codex review: needs maintainer review before merge. Reviewed July 10, 2026, 6:17 AM ET / 10:17 UTC. Summary PR surface: Source +1, Tests +23. Total +24 across 2 files. Reproducibility: yes. Current Review metrics: none identified. Merge readiness Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch. Rank-up moves:
Next step before merge
Security Review detailsBest possible solution: Refresh the branch against current Do we have a high-confidence way to reproduce the issue? Yes. Current Is this the best way to solve the issue? Yes. Fixing the single shared AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against f1b75bf5fa34. Label changesLabel changes:
Label justifications:
Evidence reviewedPR surface: Source +1, Tests +23. Total +24 across 2 files. View PR surface stats
What I checked:
Likely related people:
What the crustacean ranks mean
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics. How this review workflow works
|
|
Land-ready proof for exact head
The best-fix review traced all hint-producing callers to the private Known proof gaps: none. |
|
Merged via squash.
|
Completes the sibling memory-host masker missed by #103341. Co-authored-by: 张贵萍0668001030 <[email protected]>
) Completes the sibling memory-host masker missed by openclaw#103341. Co-authored-by: 张贵萍0668001030 <[email protected]>
2 participants
What Problem This Solves
Fixes an issue where operators logging non-ASCII secrets could receive malformed redacted token hints when a surrogate pair crossed the retained first 6 or last 4 UTF-16 code units. The redaction step could introduce an unpaired surrogate into JSON-formatted log output even though the original secret was well-formed.
Why This Change Was Made
This is a root-cause fix in the shared token hint constructor. It uses the repository's canonical surrogate-safe UTF-16 slicing helper for both retained edges, so every existing caller gets the same boundary guarantee.
ASCII hints keep the existing 6/4 code-unit budget, short tokens remain fully masked, and complete surrogate pairs that fit inside the budget remain visible. This does not change redaction patterns, logging configuration, public APIs, schemas, protocols, or persistence formats. A consumer sweep confirmed registered secrets, regex matches, URL/form values, authorization codes, and structured sensitive fields all converge on the same helper.
User Impact
Unicode secrets now produce well-formed redacted hints, so JSON log consumers no longer receive surrogate halves introduced by redaction. Existing ASCII token hints are unchanged; when an emoji would straddle a hint edge, the output retains one fewer code unit instead of emitting half of the character.
Evidence
Before the fix, the focused regression failed with:
Local E2E live proof on the patched checkout:
/healthz.{"level":"info","subsystem":"gateway/auth","message":"TOKEN=abcde…wxyz"} {"level":"info","subsystem":"gateway/auth","message":"TOKEN=abcdef…abc"} {"level":"info","subsystem":"gateway/auth","message":"TOKEN=abcd😀…😀ab"}Focused regression:
Additional checks:
pnpm exec oxfmt --check --threads=1 src/logging/redact.ts src/logging/redact.test.tsnode scripts/run-oxlint.mjs src/logging/redact.ts src/logging/redact.test.tspnpm tsgo:corepnpm tsgo:test:srcgit diff --checkThe pre-submit scan found no related open PR, and the refreshed main branch still used ordinary
String.prototype.slicefor both hint edges. The change is limited to the shared hint construction and its regression coverage.