fix(mattermost): truncate draft previews on code-point boundaries by ly-wang19 · Pull Request #97472 · openclaw/openclaw

ly-wang19 · 2026-06-28T10:18:43Z

What Problem This Solves

Mattermost draft preview truncation used raw UTF-16 slicing. If an emoji or other astral character straddled the draft preview limit, the draft update could contain a dangling surrogate half before the ellipsis.

Why This Change Was Made

The Mattermost draft text normalizer now uses the existing plugin SDK sliceUtf16Safe helper while preserving the existing max-character cap and trailing ellipsis behavior.

User Impact

Long Mattermost draft updates containing emoji no longer produce malformed replacement characters at truncation boundaries.

Evidence

git diff --check origin/main...HEAD
node scripts/run-vitest.mjs extensions/mattermost/src/mattermost/draft-stream.test.ts
.agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main

Autoreview result: clean; no accepted/actionable findings.

After-fix Proof

Boundary probe on this PR branch:

{
  "usesSafeSlice": true,
  "output": "aaaaaaaa...",
  "outputLength": 11,
  "hasLoneSurrogate": false
}

The probe places an emoji across the maxChars - 3 slice boundary. The after-fix output drops the emoji whole and leaves no lone UTF-16 surrogate.

clawsweeper · 2026-06-28T10:22:40Z

Codex review: passed. Reviewed June 28, 2026, 2:18 PM ET / 18:18 UTC.

Summary
The PR replaces Mattermost draft preview raw UTF-16 slicing with the existing SDK sliceUtf16Safe helper and adds a regression test for an emoji that straddles the preview limit.

PR surface: Source +1, Tests +26. Total +27 across 2 files.

Reproducibility: yes. Source inspection shows current main raw-slices at maxChars - 3; driving createMattermostDraftStream with maxChars: 12 and an emoji at UTF-16 indices 8-9 reaches the lone-surrogate path, though I did not run tests in this read-only sweep.

Review metrics: none identified.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

none.

Next step before merge

No repair job is needed because the PR already contains the focused code and test fix; automerge should rely on exact-head review, mergeability, and required checks.

Security
Cleared: The diff only changes Mattermost plugin string truncation and its test, with no dependency, workflow, package, secret, or executable supply-chain surface.

Review details

Best possible solution:

Land this focused Mattermost plugin fix after exact-head checks and mergeability gates, keeping surrogate-safe truncation local to the draft normalizer and regression test.

Do we have a high-confidence way to reproduce the issue?

Yes. Source inspection shows current main raw-slices at maxChars - 3; driving createMattermostDraftStream with maxChars: 12 and an emoji at UTF-16 indices 8-9 reaches the lone-surrogate path, though I did not run tests in this read-only sweep.

Is this the best way to solve the issue?

Yes. Reusing the existing SDK sliceUtf16Safe helper at the existing Mattermost truncation point is the narrowest maintainable fix; a new helper or broader channel rewrite would duplicate existing sibling-channel behavior.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against f9dddea72a7b.

Label changes

Label changes:

add status: 🚀 automerge armed: This PR is in ClawSweeper's automerge lane. Sufficient (live_output): The PR body includes after-fix boundary probe output showing no lone surrogate for the emoji-straddling case, supplemented by a targeted draft-stream regression test.
remove status: 👀 ready for maintainer look: Current PR status label is status: 🚀 automerge armed.

Label justifications:

P2: This is a focused Mattermost channel bug fix for malformed user-visible draft preview text with limited blast radius.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
status: 🚀 automerge armed: This PR is in ClawSweeper's automerge lane. Sufficient (live_output): The PR body includes after-fix boundary probe output showing no lone surrogate for the emoji-straddling case, supplemented by a targeted draft-stream regression test.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix boundary probe output showing no lone surrogate for the emoji-straddling case, supplemented by a targeted draft-stream regression test.

Evidence reviewed

PR surface:

Source +1, Tests +26. Total +27 across 2 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	2	1	+1
Tests	1	26	0	+26
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	2	28	1	+27

What I checked:

Root policy read: The full root AGENTS.md was read; its plugin-boundary and PR-review guidance affected the review scope. (AGENTS.md:1, f9dddea72a7b)
Scoped plugin policy read: The scoped extensions guide permits bundled plugin production code to import through openclaw/plugin-sdk/*, which is the import path this PR uses. (extensions/AGENTS.md:14, f9dddea72a7b)
Current main still raw-slices: Current main truncates Mattermost draft previews with trimmed.slice(0, Math.max(0, maxChars - 3)), which can split a surrogate pair at the cut point. (extensions/mattermost/src/mattermost/draft-stream.ts:32, f9dddea72a7b)
Runtime caller reaches the normalizer: The Mattermost monitor creates the draft stream for active draft preview mode and feeds partial text through draftStream.update, which reaches normalizeMattermostDraftText before sending or editing the post. (extensions/mattermost/src/mattermost/monitor.ts:1710, f9dddea72a7b)
PR implementation: The current PR head imports sliceUtf16Safe from the plugin SDK text utility entrypoint and uses it only at the existing Mattermost truncation slice. (extensions/mattermost/src/mattermost/draft-stream.ts:33, 86d0dd2a069e)
Regression test: The added test drives createMattermostDraftStream with maxChars: 12, an emoji straddling the cut, and asserts no surrogate-range code unit remains and the result stays within the cap. (extensions/mattermost/src/mattermost/draft-stream.test.ts:208, 86d0dd2a069e)

Likely related people:

ninjaa: Authored the merged Mattermost draft-preview feature that added draft-stream.ts and the monitor integration this PR now fixes. (role: feature introducer; confidence: high; commits: b38988ca9616; files: extensions/mattermost/src/mattermost/draft-stream.ts, extensions/mattermost/src/mattermost/monitor.ts)
yetval: Owns an active Mattermost draft-preview boundary PR touching the same draft stream and monitor surfaces, but for a distinct text-block delivery issue. (role: recent adjacent contributor; confidence: medium; commits: bd013ce6c5e6; files: extensions/mattermost/src/mattermost/draft-stream.ts, extensions/mattermost/src/mattermost/monitor.ts)
ly-wang19: Beyond authoring this PR, they authored the merged Slack UTF-16 boundary fix and a prior administratively closed Mattermost attempt with the same repair shape. (role: sibling invariant contributor; confidence: medium; commits: 1069c60e1e25, 71f839b9aae0, 9b13891a7320; files: extensions/slack/src/truncate.ts, extensions/mattermost/src/mattermost/draft-stream.ts, extensions/mattermost/src/mattermost/draft-stream.test.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Takhoffman · 2026-06-28T17:56:05Z

@clawsweeper automerge

clawsweeper · 2026-06-28T17:56:08Z

🦞✅
ClawSweeper merged this PR after the passing review.

Source: clawsweeper[bot]
Feedback: structured ClawSweeper verdict: pass (sha=86d0dd2a069ef07857de19f34608fbfb4359b852)
Merge status: merged by ClawSweeper automerge
Merged at: 2026-06-28T18:20:34Z
Merge commit: 881ec2f93f37

What merged:

The PR replaces Mattermost draft preview raw UTF-16 slicing with the existing SDK sliceUtf16Safe helper and adds a regression test for an emoji that straddles the preview limit.
PR surface: Source +1, Tests +26. Total +27 across 2 files.
Reproducibility: yes. Source inspection shows current main raw-slices at maxChars - 3; driving `createMatt ... at UTF-16 indices 8-9 reaches the lone-surrogate path, though I did not run tests in this read-only sweep.

Automerge notes:

PR branch already contained follow-up commit before automerge: fix(mattermost): truncate draft previews on code-point boundaries

The automerge loop is complete.

Automerge progress:

2026-06-28 17:56:05 UTC review queued 71f839b9aae0 (queued)

2026-06-28 17:57:32 UTC repair queued 71f839b9aae0 (autonomous) Run: https://github.com/openclaw/clawsweeper/actions/runs/28331006729

2026-06-28 17:59:04 UTC repair started (running) in 1s Run: https://github.com/openclaw/clawsweeper/actions/runs/28331006729 automerge-openclaw-openclaw-97472

2026-06-28 17:59:19 UTC validation plan (passed) in 16s Run: https://github.com/openclaw/clawsweeper/actions/runs/28331006729 pnpm check:changed; pnpm lint; pnpm check:test-types

2026-06-28 17:59:34 UTC Codex write preflight (passed) in 30s Run: https://github.com/openclaw/clawsweeper/actions/runs/28331006729 danger-full-access

2026-06-28 18:06:09 UTC Codex edit 1 85fdf6cc2e19 (complete) in 7m 6s Run: https://github.com/openclaw/clawsweeper/actions/runs/28331006729 exit 0

2026-06-28 18:08:39 UTC validation and review 1 86d0dd2a069e (base moved) in 9m 36s Run: https://github.com/openclaw/clawsweeper/actions/runs/28331006729 rebased

2026-06-28 18:10:17 UTC repair completed 86d0dd2a069e (branch updated) in 11m 13s Run: https://github.com/openclaw/clawsweeper/actions/runs/28331006729 initial automerge rebase is delegated to Codex repair

2026-06-28 18:10:16 UTC review queued 86d0dd2a069e (after repair)

2026-06-28 18:20:20 UTC automerge wait 86d0dd2a069e (ready) in 21m 16s Run: https://github.com/openclaw/clawsweeper/actions/runs/28331006729 checks and exact-head review are ready

2026-06-28 18:20:21 UTC repair finished 86d0dd2a069e (pushed) in 21m 18s Run: https://github.com/openclaw/clawsweeper/actions/runs/28331006729 repair_contributor_branch

2026-06-28 18:19:50 UTC review passed 86d0dd2a069e (structured ClawSweeper verdict: pass (sha=86d0dd2a069ef07857de19f34608fbfb4359b...)

2026-06-28 18:20:35 UTC merged 86d0dd2a069e (merged by ClawSweeper automerge)

… raw UTF-16 normalizeMattermostDraftText truncated the streaming preview with a raw `trimmed.slice(0, maxChars - 3)`. When an emoji (or any astral code point) straddled the cut, the slice kept the high surrogate but dropped its low surrogate; trimEnd() does not strip a lone surrogate, so the Mattermost post message carried a dangling surrogate half rendered as the replacement char. Example: normalizeMattermostDraftText("a".repeat(8) + "\u{1F600}" + "b".repeat(5), 12) cuts at index 9 (maxChars-3), the emoji 😀 occupies UTF-16 indices 8-9, and the old code produced "aaaaaaaa\ud83d..." (lone high surrogate). The same defect hits the default 4000-char stream limit at cut point 3997. Route the slice through sliceUtf16Safe (from openclaw/plugin-sdk/text-utility-runtime), matching the surrogate-safe truncation already used by the slack adapter, so a straddling emoji is dropped whole: the output becomes "aaaaaaaa...". All-BMP input and inputs at/under the limit are byte-identical to the previous behavior. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…enclaw#97472) Summary: - The PR replaces Mattermost draft preview raw UTF-16 slicing with the existing SDK `sliceUtf16Safe` helper and adds a regression test for an emoji that straddles the preview limit. - PR surface: Source +1, Tests +26. Total +27 across 2 files. - Reproducibility: yes. Source inspection shows current main raw-slices at `maxChars - 3`; driving `createMatt ... at UTF-16 indices 8-9 reaches the lone-surrogate path, though I did not run tests in this read-only sweep. Automerge notes: - PR branch already contained follow-up commit before automerge: fix(mattermost): truncate draft previews on code-point boundaries Validation: - ClawSweeper review passed for head 86d0dd2. - Required merge gates passed before the squash merge. Prepared head SHA: 86d0dd2 Review: openclaw#97472 (comment) Co-authored-by: ly-wang19 <[email protected]> Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]> Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com> Approved-by: takhoffman

…enclaw#97472) Summary: - The PR replaces Mattermost draft preview raw UTF-16 slicing with the existing SDK `sliceUtf16Safe` helper and adds a regression test for an emoji that straddles the preview limit. - PR surface: Source +1, Tests +26. Total +27 across 2 files. - Reproducibility: yes. Source inspection shows current main raw-slices at `maxChars - 3`; driving `createMatt ... at UTF-16 indices 8-9 reaches the lone-surrogate path, though I did not run tests in this read-only sweep. Automerge notes: - PR branch already contained follow-up commit before automerge: fix(mattermost): truncate draft previews on code-point boundaries Validation: - ClawSweeper review passed for head 86d0dd2. - Required merge gates passed before the squash merge. Prepared head SHA: 86d0dd2 Review: openclaw#97472 (comment) Co-authored-by: ly-wang19 <[email protected]> Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]> Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com> Approved-by: takhoffman (cherry picked from commit 881ec2f)

…enclaw#97472) Summary: - The PR replaces Mattermost draft preview raw UTF-16 slicing with the existing SDK `sliceUtf16Safe` helper and adds a regression test for an emoji that straddles the preview limit. - PR surface: Source +1, Tests +26. Total +27 across 2 files. - Reproducibility: yes. Source inspection shows current main raw-slices at `maxChars - 3`; driving `createMatt ... at UTF-16 indices 8-9 reaches the lone-surrogate path, though I did not run tests in this read-only sweep. Automerge notes: - PR branch already contained follow-up commit before automerge: fix(mattermost): truncate draft previews on code-point boundaries Validation: - ClawSweeper review passed for head 86d0dd2. - Required merge gates passed before the squash merge. Prepared head SHA: 86d0dd2 Review: openclaw#97472 (comment) Co-authored-by: ly-wang19 <[email protected]> Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]> Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com> Approved-by: takhoffman

…void lone surrogates The Mattermost inbound handler in extensions/mattermost/src/mattermost/monitor.ts truncates the message body preview with bodyText.slice(0, 200), which can split a UTF-16 surrogate pair when an emoji (e.g. 🎉, 🦞) or other astral character lands at the 200-char boundary. The resulting lone surrogate half leaks into the verbose log preview and could propagate to downstream consumers that reject ill-formed strings. Replace the raw .slice(0, 200) with the shared truncateUtf16Safe helper (from openclaw/plugin-sdk/text-utility-runtime), which backs up one code unit when the cut would land inside a surrogate pair. This matches the same pattern already applied to the Slack, Discord, Telegram, IRC, Line, MS Teams, and Feishu channel previews (openclaw#96456, openclaw#96569, openclaw#96572, openclaw#96577, openclaw#96578, openclaw#97462, openclaw#97472, openclaw#98994). The preview is only used for the verbose inbound log line so the behavioral change is cosmetic: when the 200th code unit would split an emoji, the preview now includes one fewer code unit rather than emitting a broken surrogate.

openclaw-barnacle Bot added channel: mattermost Channel integration: mattermost size: XS labels Jun 28, 2026

clawsweeper Bot added the clawsweeper:automerge Maintainer opted this PR into bounded ClawSweeper-reviewed automerge label Jun 28, 2026

ly-wang19 and others added 2 commits June 28, 2026 18:08

fix(mattermost): truncate draft previews on code-point boundaries

86d0dd2

clawsweeper Bot force-pushed the fix/mattermost-draft-surrogate-safe branch from 71f839b to 86d0dd2 Compare June 28, 2026 18:10

clawsweeper Bot added status: 🚀 automerge armed This PR is in ClawSweeper's automerge lane. and removed status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Jun 28, 2026

clawsweeper Bot merged commit 881ec2f into openclaw:main Jun 28, 2026
96 of 99 checks passed

github-actions Bot mentioned this pull request Jun 28, 2026

📡 Upstream Digest — 2026-06-28 19:05 UTC curtismercier/openclaw-mods#1168

Open

clawsweeper Bot mentioned this pull request Jun 29, 2026

fix(mattermost): truncate streaming draft text on UTF-16 boundary #97597

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(mattermost): truncate draft previews on code-point boundaries#97472

fix(mattermost): truncate draft previews on code-point boundaries#97472
clawsweeper[bot] merged 2 commits into
openclaw:mainfrom
ly-wang19:fix/mattermost-draft-surrogate-safe

ly-wang19 commented Jun 28, 2026

Uh oh!

clawsweeper Bot commented Jun 28, 2026 •

edited

Loading

Uh oh!

Takhoffman commented Jun 28, 2026

Uh oh!

clawsweeper Bot commented Jun 28, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

ly-wang19 commented Jun 28, 2026

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

After-fix Proof

Uh oh!

clawsweeper Bot commented Jun 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Takhoffman commented Jun 28, 2026

Uh oh!

clawsweeper Bot commented Jun 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

clawsweeper Bot commented Jun 28, 2026 •

edited

Loading

clawsweeper Bot commented Jun 28, 2026 •

edited

Loading