Summary

• Tighten the boundary-safety guard so changed production files catch returned/deferred Response body reads, cloned/aliased responses, and full-buffer blob() / formData() reads.
• Reduce UTF-16 truncation noise by excluding collection, range, suffix-removal, byte-prefix, and identifier-prefix slices, while accepting only actual boundary-safety-ignore comments with reasons.
• Fix the shared bounded Response read and readResponseTextSnippet(...) contracts for exact byte budgets, headerless/minimal Response objects, byte-truncated UTF-8, and maxChars ellipsis budgeting, with the full boundary inventory stable at 210 known entries.

What Problem This Solves

OpenClaw already had canonical helpers for UTF-16-safe text truncation and bounded response reads, but the repository invariant was incomplete: new production code could still add raw head truncation or direct unbounded Response body reads in source shapes the original guard missed.

This update keeps the guardrail value while lowering reviewer noise. It catches the high-risk response read patterns, removes common false-positive text-slice shapes, and leaves legacy debt tracked in the 210-entry baseline instead of expanding the remediation scope.

User Impact

Future runtime/channel/model-adjacent changes are less likely to reintroduce corrupted surrogate-pair snippets or unbounded Response body buffering. Diagnostic snippets are also more accurate: exact Content-Length bodies at the byte cap no longer get a false ellipsis, headerless/minimal Response objects still enforce overflow handling, byte-truncated UTF-8 no longer emits �, and the ellipsis stays inside the configured character budget.

Origin / follow-up

Follow-up to #97620. That merged change fixed one bounded-read path; this PR keeps the broader source invariant that catches the same boundary regression classes when future production files change.

Competition / linked PR analysis

This is an update to the existing #97774 branch, not a replacement PR. The related merged work considered in this repair flow includes #97620 and #99340. Those merged fixes reduce focused runtime boundary gaps, but they do not add a changed-file guard for new raw UTF-16 truncation or unbounded Response body reads, and they do not supersede this repository-wide guard/baseline proposal. No public API, user configuration, schema, protocol, data format, default-value, or migration contract is being introduced here; the contract surface is the repository validator plus the shared Response snippet helper.

Maintainer-ready notes

• Behavior or issue addressed: The repaired branch catches newly introduced high-confidence unbounded Response body reads and raw UTF-16 text truncation while reducing known false-positive classes. The bounded Response helpers now preserve exact byte-budget snippets without a false ellipsis, keep headerless/minimal Response objects on the overflow-enforced path, drop incomplete UTF-8 tails instead of emitting �, and count the ellipsis within maxChars.
• Why it matters / User impact: The guard turns repeated boundary review findings into a source-of-truth validation invariant for changed production files, while the runtime fix prevents malformed or misleading diagnostic snippets from the shared Response helper.
• Fix classification: Root cause fix
• Maintainer-ready confidence: High for the local guard behavior and shared Response snippet semantics covered by focused tests, prior check:changed, and latest diff hygiene. A later full local check:changed rerun after the expectation-only CI fix reached typecheck, then failed in lint core because tsgolint was SIGTERM'd without a code diagnostic; the remaining review question is maintainer policy acceptance for a baseline-backed changed-file gate.
• Root cause: The root cause was a missing source invariant: OpenClaw had canonical UTF-16 and bounded-response helpers, but no changed-file validator contract preventing new production files from bypassing those helpers. The initial guard also over- and under-matched important parser shapes, which caused review noise and missed returned/cloned Response reads.
• Why this is root-cause fix: scripts/check-boundary-safety.mjs is now the validation source of truth for this invariant, so new raw text truncation and unbounded Response reads fail changed-file validation before they reach runtime code. src/infra/http-body.ts fixes the canonical snippet contract itself rather than patching individual call sites.
• What did NOT change: The patch only changes the boundary-safety guard, its baseline/tests, and the shared Response snippet semantics. It does not change credentials, user configuration, browser UI, public APIs, schema/protocol formats, migrations, or attempt full legacy remediation for all 210 baseline-known entries.
• Architecture / source-of-truth check: scripts/check-boundary-safety.mjs is the validator and test/fixtures/boundary-safety-inventory.json is the baseline contract. src/infra/http-body.ts owns bounded response/snippet reads, and @openclaw/normalization-core/utf16-slice remains the canonical UTF-16-safe text owner.
• Patch quality notes: The large fixture diff is the explicit 210-entry baseline contract, not unrelated cleanup. The parser guard uses explicit false returns for non-candidate AST shapes, and the body-less Response path keeps a narrow comment-only ignore because maxBytes enforcement happens immediately after the only available read path.
• Target test file: test/scripts/check-boundary-safety.test.ts; src/infra/http-body.response.test.ts; src/agents/runtime/proxy.test.ts; src/agents/anthropic-transport-stream.test.ts.
• Scenario locked in: Returned, deferred, cloned, and full-buffer Response reads are flagged; collection/range/suffix/byte slices are not treated as user-visible text truncation; spoofed ignore strings do not suppress violations; bounded response reads handle headerless/minimal Response objects; snippet output handles exact byte caps plus UTF-8/max-char boundaries correctly.
• Why this is the smallest reliable guardrail: A baseline-backed changed-file guard prevents new regressions without forcing broad legacy remediation in the same PR. The runtime hunk is limited to the shared helper semantics that the guard points callers toward.

Real behavior proof

• Behavior or issue addressed: The repaired branch catches newly introduced high-confidence unbounded Response body reads and raw UTF-16 text truncation while reducing known false-positive classes. The bounded Response helpers now preserve exact byte-budget snippets without a false ellipsis, keep headerless/minimal Response objects on the overflow-enforced path, drop incomplete UTF-8 tails instead of emitting �, and count the ellipsis within maxChars.
• Canonical reachability path: Developer changes production TypeScript source → pnpm check:changed / node scripts/check-boundary-safety.mjs derives the changed-file set from git → scripts/check-boundary-safety.mjs parses those source files with TypeScript AST rules → new raw head UTF-16 slices or full Response body reads are compared against test/fixtures/boundary-safety-inventory.json → changed-file validation fails with guidance before the code can merge. Runtime snippet reachability is HTTP/provider/channel response handling → shared src/infra/http-body.ts bounded reader → diagnostic/error snippet text returned to callers.
• Boundary crossed: Repository validation crosses the source-to-CI boundary for changed production files, and the runtime proof crosses real local WHATWG Response stream boundaries, including unknown/headerless responses, exact Content-Length, clone/alias response reads, byte-truncated UTF-8, and stalled/overflowing body streams.
• Shared helper / provider constraint check: The validator points new code to existing shared helpers (truncateUtf16Safe, sliceUtf16Safe, readResponseWithLimit, readResponseTextSnippet, and readProviderJsonResponse) instead of adding provider-specific policy. No provider credentials, routing, schema, model selection, or channel protocol constraint changed.
• Real environment tested: Local Linux OpenClaw repair worktree at /media/vdb/code/ai/aispace/openclaw-worktrees/pr-97774, branch repair/pr-97774, after daily_fix.sh sync-main onto current origin/main. The exercised behavior is repository guard execution plus real local WHATWG Response stream handling in Vitest.
• Exact steps or command run after this patch:

cd /media/vdb/code/ai/aispace/openclaw-worktrees/pr-97774 && node scripts/run-vitest.mjs run --config test/vitest/vitest.unit-fast.config.ts test/scripts/check-boundary-safety.test.ts

cd /media/vdb/code/ai/aispace/openclaw-worktrees/pr-97774 && node scripts/run-vitest.mjs run src/infra/http-body.response.test.ts

cd /media/vdb/code/ai/aispace/openclaw-worktrees/pr-97774 && node scripts/run-vitest.mjs run src/agents/runtime/proxy.test.ts -t "bounds non-2xx proxy JSON error reads"

cd /media/vdb/code/ai/aispace/openclaw-worktrees/pr-97774 && node scripts/run-vitest.mjs run src/agents/anthropic-transport-stream.test.ts -t "bounds streamed Anthropic error responses without content-length"

cd /media/vdb/code/ai/aispace/openclaw-worktrees/pr-97774 && node scripts/run-vitest.mjs run src/agents/tool-search.test.ts -t "aborts already-started bridged calls when code mode times out"

cd /media/vdb/code/ai/aispace/openclaw-worktrees/pr-97774 && pnpm test src/acp/control-plane/manager.cancel-session.test.ts src/acp/control-plane/manager.turn-results.test.ts

cd /media/vdb/code/ai/aispace/openclaw-worktrees/pr-97774 && node scripts/check-boundary-safety.mjs --all && node scripts/check-boundary-safety.mjs

gh pr checks 97774 --repo openclaw/openclaw --watch

cd /media/vdb/code/ai/aispace/openclaw-worktrees/pr-97774 && CI=1 PNPM_CONFIG_VERIFY_DEPS_BEFORE_RUN=false pnpm check:changed

• Evidence after fix:

node scripts/run-vitest.mjs run --config test/vitest/vitest.unit-fast.config.ts test/scripts/check-boundary-safety.test.ts
Test Files  1 passed (1)
Tests  18 passed (18)

node scripts/run-vitest.mjs run src/infra/http-body.response.test.ts
Test Files  1 passed (1)
Tests  24 passed (24)

node scripts/run-vitest.mjs run src/agents/runtime/proxy.test.ts -t "bounds non-2xx proxy JSON error reads"
Test Files  2 passed (2)
Tests  2 passed | 22 skipped (24)

node scripts/run-vitest.mjs run src/agents/anthropic-transport-stream.test.ts -t "bounds streamed Anthropic error responses without content-length"
Test Files  2 passed (2)
Tests  2 passed | 198 skipped (200)

node scripts/run-vitest.mjs run src/agents/tool-search.test.ts -t "aborts already-started bridged calls when code mode times out"
Test Files  2 passed (2)
Tests  2 passed | 96 skipped (98)

pnpm test src/acp/control-plane/manager.cancel-session.test.ts src/acp/control-plane/manager.turn-results.test.ts
Test Files  1 passed (1)
Tests  18 passed (18)
Test Files  1 passed (1)
Tests  1 passed (1)
[test] passed 2 Vitest shards in 43.14s

gh pr checks 97774 --repo openclaw/openclaw --watch
checks-node-compact-large-2 pass
check-lint pass
check-guards pass
check-prod-types pass
check-test-types pass
Real behavior proof pass
Security High (process-exec-boundary) pass
Critical Quality (agent-runtime-boundary) pass
exit code 0

node scripts/check-boundary-safety.mjs --all
Boundary safety baseline matches (210 entries).

node scripts/check-boundary-safety.mjs
Boundary safety changed-file check passed (0 changed-file entries, all baseline-known).

CI=1 PNPM_CONFIG_VERIFY_DEPS_BEFORE_RUN=false pnpm check:changed
[check:changed] lanes=core, coreTests, tooling
Boundary safety changed-file check passed (0 changed-file entries, all baseline-known).
Import cycle check: 0 runtime value cycle(s).
exit code 0

• Observed result after fix: Focused guard tests pass with coverage for returned/deferred Response reads, response clones/aliases, blob() / formData(), generic display truncation, comment-only ignores, and false-positive boundaries. Focused response-body tests pass with exact Content-Length byte-budget, headerless/minimal Response overflow handling, byte-truncated UTF-8, and max-char ellipsis semantics. The proxy non-2xx oversized-body regression now reports Proxy error body exceeded 16777216 bytes. The Anthropic streamed error response test now expects the ellipsis inside the 400-character budget and passes. The ACP cancellation tests requested by ClawSweeper pass. After syncing main, the full boundary inventory is refreshed to 210 entries, changed-file enforcement reports 0 new entries, and the exact-head hosted checks completed without failures.
• What was not tested: No browser UI or hosted CI success is claimed from local proof. The remote tool-search abort-signal failure was checked with its targeted local test and passed locally; this PR does not claim that local result as a hosted CI pass. Network integrations were not exercised because this patch changes the repository guard and shared Response stream helper, not an integration-specific transport path.
• Fix classification: Root cause fix

Review findings addressed

• RF-001 — waiting-on-author label: Addressed by pushing the repair commits and re-running exact-head checks. Label clearing is left to ClawSweeper/maintainer automation; no direct label mutation was made.
• RF-002 — refresh exact-head CI: Addressed. After the latest head was pushed, gh pr checks 97774 --repo openclaw/openclaw --watch exited 0; key checks including checks-node-compact-large-2, check-lint, check-guards, check-prod-types, check-test-types, Real behavior proof, Security High (process-exec-boundary), and Critical Quality (agent-runtime-boundary) passed.
• RF-003 — ACP cancelled compatibility: Addressed by preserving the ACP cancelled terminal status compatibility in the repaired branch and verifying the relevant ACP manager tests.
• RF-004 — baseline-backed guard policy: Disclosed as maintainer policy territory. The full inventory is now 210 entries after main sync, changed-file enforcement reports 0 new entries, and the PR body calls out maintainer acceptance of the baseline-backed gate as the remaining non-code decision.
• RF-005 — branch behind / exact merge result: Addressed with daily_fix.sh sync-main, which rebased the repair branch onto current origin/main; the baseline was refreshed after sync and exact-head checks were re-run.
• RF-006 — narrow ACP repair versus guard policy: Addressed by keeping the ACP compatibility repair separate from the guard-policy decision in this explanation: ACP cancellation compatibility is verified, while guard adoption remains an explicit maintainer review item.
• RF-007 — restore cancelled ACP task status: Addressed in src/acp/control-plane/manager.background-task.ts by retaining the cancelled terminal status path expected by current main.
• RF-008 — requested ACP tests: Addressed. pnpm test src/acp/control-plane/manager.cancel-session.test.ts src/acp/control-plane/manager.turn-results.test.ts passed after sync.
• RF-009 — pnpm check:changed: Addressed through prior local check:changed success, post-sync targeted validation, and exact-head hosted checks. A local post-expectation rerun hit a tsgolint SIGTERM without a code diagnostic, but hosted check-lint, check-guards, type/test checks, compact test shards, and security checks passed on the pushed head.
• ClawSweeper — latest CI attribution: Addressed. The contributor-fixable failure in src/agents/anthropic-transport-stream.test.ts was a stale expectation after ellipsis budgeting changed; the test now matches the shared helper contract and checks-node-compact-large-2 passes remotely.
• ClawSweeper — superseded-by-runtime-fix concern: Addressed in scope notes. fix(infra): enforce maxBytes in body-less HTTP error snippet path #99340 covers the body-less HTTP error snippet path; it does not replace this PR's changed-file validator, 210-entry baseline, response-read detector, or UTF-16 guardrail.
• ClawSweeper — stored data model signal: Treated as a false-positive policy signal from test fixtures/baseline metadata. This PR does not add or migrate production persisted state, serialized user data, vector metadata, schema, or upgrade format.

Regression Test Plan

• Target test file: test/scripts/check-boundary-safety.test.ts; src/infra/http-body.response.test.ts; src/agents/runtime/proxy.test.ts; src/agents/anthropic-transport-stream.test.ts.
• Scenario locked in: Guard tests lock returned/deferred/cloned/full-buffer Response reads, generic display truncation, actual-comment ignores, spoofed ignore strings, and collection/range/suffix/byte false-positive boundaries. Response tests lock exact byte-budget snippets, headerless/minimal Response overflow handling, byte-truncated UTF-8 behavior, max-char ellipsis budgeting, stalling-stream cancellation, and body-less handling.
• Why this is the smallest reliable guardrail: These regression tests cover the source invariant and shared helper contract directly, so the PR does not need broad legacy migrations or integration-specific fixtures to prove the repaired behavior.
• test/fixtures/boundary-safety-inventory.json is the current full inventory contract: 210 baseline-known entries after the refactor.
• pnpm check:changed covers conflict markers, package guardrails, typecheck, lint, boundary-safety guard, import cycles, and related repository guards for this changed-file set.

Merge risk

• Risk labels considered: CI/tooling, security-boundary, compatibility, message-delivery text boundaries, auth-adjacent response reads, session-state text previews, and availability of the changed-file check path.
• Risk explanation: The PR adds a baseline-backed guard that can fail future changed-file checks when production code introduces high-confidence raw UTF-16 truncation or unbounded Response body reads. The runtime snippet helper also changes how diagnostics mark exact byte budgets and truncated UTF-8. The remaining non-code risk is maintainer acceptance of the guard/baseline policy, not an unresolved contributor proof gap.
• Why acceptable: The guard fails with actionable guidance to use truncateUtf16Safe, sliceUtf16Safe, readResponseWithLimit, readResponseTextSnippet, readProviderJsonResponse, or a narrow comment-only ignore with a reason. Existing debt remains baseline-known at 210 entries, changed-file enforcement reports 0 new entries, the runtime behavior is covered by focused Response stream tests, and ClawSweeper's stored-data signal maps to test fixtures rather than a production migration.

Risk / Compatibility

• Guard adoption risk: The PR adds a validation gate that can block future source changes introducing high-confidence raw UTF-16 truncation or unbounded Response reads. This is intentionally maintainer-policy territory because it changes future review/CI behavior.
• False-positive/noise boundary: The guard is high-confidence rather than exhaustive. Existing debt stays visible in the 210-entry baseline, while changed-file enforcement stays focused on new violations.
• Runtime compatibility: readResponseTextSnippet(...) still cancels stalling exact-budget streams when size is not proven. It only avoids the truncation ellipsis when Content-Length proves the exact byte budget was also EOF, and all ellipsis output now stays inside maxChars.
• Stored data model boundary: The changed serialized-looking content is test/baseline material only. No production persisted state, migration, vector metadata contract, schema, or user-data upgrade path changes in this PR.
• Public contract boundary: No user-facing API, config, schema, protocol, default, or migration contract is changed. The contract being clarified is internal validation ownership for boundary safety and the shared helper's diagnostic snippet semantics.

What was not changed

• No public APIs, credential/configuration behavior, browser UI, schema/protocol formats, migrations, or integration-specific runtime behavior were changed.
• The PR does not attempt full legacy remediation for all 210 baseline-known entries.
• The PR does not replace maintainer policy judgment about whether OpenClaw should adopt this guard now.
• No CHANGELOG.md changes were made.

Root Cause

• Root cause: The root cause was a missing repository-level source invariant for boundary code: new production files could still introduce raw UTF-16 code-unit truncation or direct unbounded Response body reads even though canonical helpers existed. The first guard version also had parser-rule gaps that missed returned/cloned reads and produced noisy matches for collection/range/suffix/byte slices.
• Why this is root-cause fix: This refactor puts the invariant in scripts/check-boundary-safety.mjs, keeps its full baseline in test/fixtures/boundary-safety-inventory.json, and fixes src/infra/http-body.ts where the shared snippet contract is owned. That prevents new violations at validation time and repairs the canonical runtime helper instead of masking individual call sites.