Skip to content

fix(line): truncate action label/data on code-point boundaries#96493

Closed
ly-wang19 wants to merge 2 commits into
openclaw:mainfrom
ly-wang19:fix/line-action-label-surrogate-safe
Closed

fix(line): truncate action label/data on code-point boundaries#96493
ly-wang19 wants to merge 2 commits into
openclaw:mainfrom
ly-wang19:fix/line-action-label-surrogate-safe

Conversation

@ly-wang19

Copy link
Copy Markdown
Contributor

What Problem This Solves

The LINE action builders in extensions/line/src/actions.ts enforce LINE's
field limits by calling String.prototype.slice directly:

  • messageAction / uriAction / postbackAction / datetimePickerAction
    label.slice(0, 20)
  • postbackAction / datetimePickerActiondata.slice(0, 300) and
    displayText?.slice(0, 300)

A raw UTF-16 slice cuts an emoji in half whenever the limit lands inside a
surrogate pair. The returned label then ends in an unpaired high
surrogate
, which LINE renders as a replacement character (or rejects the
payload).

Repro: messageAction("1234567890123456789😀") — 19 ASCII chars + 😀
(U+1F600, 2 UTF-16 code units) = 21 code units.

label returned
Before (buggy) "1234567890123456789\uD83D" — trailing lone high surrogate
After (fixed) "1234567890123456789" — half-emoji dropped, no lone surrogate

The fix swaps the raw slices for truncateUtf16Safe(value, limit) from
openclaw/plugin-sdk/text-utility-runtime, which drops a dangling surrogate
instead of emitting it. This matches how this plugin already truncates LINE
template titles (truncateTemplateText in template-messages.ts). Normal
inputs (short labels, exactly-at-limit ASCII, fully-fitting emoji) are
unchanged, and displayText stays undefined when omitted.

Evidence

Standalone red→green proof (replicates truncateUtf16Safe + the old vs. new
action logic):

RED  ok: old messageAction label = "1234567890123456789\ud83d" (lone surrogate present)
GREEN ok: messageAction label = "1234567890123456789"
GREEN ok: postbackAction label/data/displayText all surrogate-safe
GREEN ok: postbackAction displayText undefined is preserved
GREEN ok: normal/unaffected inputs unchanged

ALL ASSERTIONS PASSED — fix produces expectedOutput and preserves normal behavior.

The script asserts:

  • RED: the old label.slice(0, 20) keeps a lone high surrogate (\uD83D).
  • GREEN: the fixed builders return "1234567890123456789" (no lone
    surrogate) for label, and surrogate-safe data / displayText.
  • Preservation: "Yes""Yes", 20-char ASCII unchanged, 25-char ASCII
    truncated to 20, fully-fitting "hi😀" preserved, and displayText stays
    undefined when not passed.

New unit tests in extensions/line/src/message-cards.test.ts cover
messageAction, uriAction, postbackAction (label, data, displayText), and
datetimePickerAction, asserting no /[\uD800-\uDBFF](?![\uDC00-\uDFFF])/
lone surrogate survives truncation.

🤖 Generated with Claude Code

The LINE action builders truncated label (20) and data/displayText (300)
with a raw `String.prototype.slice`, which cuts an emoji apart when the
limit falls inside a surrogate pair. A 19-char label followed by 😀
(U+1F600) yielded a label ending in a lone high surrogate (\uD83D), which
LINE renders as a replacement glyph or rejects.

Truncate with `truncateUtf16Safe` instead so a dangling half-emoji is
dropped, matching how this plugin already truncates LINE template titles.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
@openclaw-barnacle openclaw-barnacle Bot added channel: line Channel integration: line size: S labels Jun 24, 2026
@clawsweeper

clawsweeper Bot commented Jun 24, 2026

Copy link
Copy Markdown
Contributor

Codex review: needs real behavior proof before merge. Reviewed June 24, 2026, 1:08 PM ET / 17:08 UTC.

Summary
The PR changes LINE action builders to use truncateUtf16Safe for action labels, postback data, and display text, with focused surrogate-safety tests.

PR surface: Source +1, Tests +67. Total +68 across 2 files.

Reproducibility: yes. for source-level reproduction: current main uses raw UTF-16 slicing in the LINE action builders, and a Node probe shows the reported input leaves a dangling high surrogate. I did not run the PR's tests in this read-only review.

Review metrics: none identified.

Root-cause cluster
Relationship: canonical
Canonical: #96493
Summary: This PR is the active canonical copy of the LINE action surrogate-safety fix; the earlier same-title PR was closed unmerged for author active-PR limits.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🐚 platinum hermit
Result: blocked until stronger real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • [P1] Add redacted terminal output, copied live output, logs, or a short recording that imports the changed LINE action builders from this branch and shows no lone surrogate after truncation.

Proof guidance:

  • [P1] Needs stronger real behavior proof before merge: The PR body has terminal-style output for a standalone logic replica, but it still needs redacted terminal output, logs, copied live output, or a short recording that imports the changed LINE builders and shows the after-fix result; after updating the PR body, ClawSweeper should re-review automatically or a maintainer can comment @clawsweeper re-review.

Risk before merge

  • [P1] Contributor-supplied real after-fix proof is still insufficient: the PR body only shows a standalone logic replica, not the changed LINE builders running from this branch.
  • [P1] The patch is intentionally limited to avoiding invalid UTF-16 boundaries; any broader grapheme-cluster length semantics for LINE-visible fields should be tracked separately if maintainers want that behavior.

Maintainer options:

  1. Decide the mitigation before merge
    Land this owner-local helper-based fix after the contributor adds real after-fix proof for the changed LINE builders; handle broader LINE grapheme-counting semantics as a separate follow-up if desired.
  2. Pause or close
    Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

  • [P1] The only current blocker is contributor real behavior proof, which automation cannot supply for this external PR; no narrow code repair is identified.

Security
Cleared: The diff reuses an existing exported SDK text helper and adds tests; it does not change dependencies, workflows, secrets, package metadata, install scripts, or other supply-chain surfaces.

Review details

Best possible solution:

Land this owner-local helper-based fix after the contributor adds real after-fix proof for the changed LINE builders; handle broader LINE grapheme-counting semantics as a separate follow-up if desired.

Do we have a high-confidence way to reproduce the issue?

Yes for source-level reproduction: current main uses raw UTF-16 slicing in the LINE action builders, and a Node probe shows the reported input leaves a dangling high surrogate. I did not run the PR's tests in this read-only review.

Is this the best way to solve the issue?

Yes for the narrow surrogate-safety bug: reusing the existing exported SDK helper inside the LINE plugin boundary is the maintainable fix. It is not a full grapheme-cluster length-counting solution for all LINE-visible fields.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 4ae0a5d958a0.

Label changes

Label justifications:

  • P2: This is a normal-priority LINE channel payload correctness fix with limited blast radius.
  • rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
  • status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The PR body has terminal-style output for a standalone logic replica, but it still needs redacted terminal output, logs, copied live output, or a short recording that imports the changed LINE builders and shows the after-fix result; after updating the PR body, ClawSweeper should re-review automatically or a maintainer can comment @clawsweeper re-review.
Evidence reviewed

PR surface:

Source +1, Tests +67. Total +68 across 2 files.

View PR surface stats
Area Files Added Removed Net
Source 1 8 7 +1
Tests 1 67 0 +67
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 2 75 7 +68

What I checked:

  • Current main raw truncation: Current main still truncates LINE action labels/data/displayText with raw .slice, so the PR targets the implicated owner path. (extensions/line/src/actions.ts:12, 4ae0a5d958a0)
  • Source-level reproduction: A Node probe confirms "1234567890123456789😀".slice(0, 20) leaves a dangling high surrogate, matching the PR's reported failure mode.
  • Existing helper behavior: truncateUtf16Safe delegates to sliceUtf16Safe, which backs off when the truncation endpoint would split a surrogate pair. (src/utils.ts:110, 4ae0a5d958a0)
  • Extension boundary fit: The scoped extension policy allows bundled plugin production code to import from openclaw/plugin-sdk/*, and text-utility-runtime is exported as a package subpath. (extensions/AGENTS.md:19, 4ae0a5d958a0)
  • PR diff reviewed: The diff only swaps the LINE action builders to the exported helper and adds focused tests for messageAction, uriAction, postbackAction, and datetimePickerAction. (extensions/line/src/actions.ts:10, 5453fdfccceb)
  • Proof gap: The PR body includes standalone terminal-style output that replicates the logic, but it does not show after-fix output from importing or running the changed LINE action builders. (5453fdfccceb)

Likely related people:

  • vincentkoc: Commit 2131981 moved the LINE channel/provider ownership into the current extensions/line plugin path, including the current action/template surfaces. (role: introduced current action builder surface; confidence: high; commits: 213198123042; files: extensions/line/src/actions.ts, extensions/line/src/template-messages.ts)
  • steipete: Commit 63f5fa4 introduced the shared UTF-16-safe truncation helper, and recent history shows substantial adjacent LINE test/refactor work. (role: adjacent helper and LINE test contributor; confidence: high; commits: 63f5fa47deb6, cb76ba24068c; files: src/utils.ts, src/plugin-sdk/text-utility-runtime.ts, extensions/line/src/message-cards.test.ts)
  • plum-dawg: Commit c96ffa7 added the LINE plugin and original LINE template/rich-menu surfaces that the current action builders descend from. (role: original LINE plugin contributor; confidence: medium; commits: c96ffa7186a4; files: extensions/line, src/line)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P2 Normal backlog priority with limited blast radius. labels Jun 24, 2026
- drop the unnecessary template literal (no-unnecessary-template-expression)
- cast messageAction/uriAction results to { label: string } so loneHighSurrogate.test()
  receives a string (matches the postback/datetime test casts)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
@ly-wang19

Copy link
Copy Markdown
Contributor Author

Closing to stay under the repo's active-PR limit and keep my queue focused on changes I can fully prove headlessly. This channel fix needs live-channel proof I can't generate in my current environment; the code change itself stands and I'll resubmit with live proof when I can run the channel.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

channel: line Channel integration: line P2 Normal backlog priority with limited blast radius. rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. size: S status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant