Robustness: invocation one-line display collapse() splits surrogate pairs — provider/tool/MCP Result/Stdout/Stderr can carry an unpaired surrogate #856

sourceType

source:self-discovery — undirected maintainer review pass. Same surrogate-safety defect class as the merged truncation series (#812, #842, #848, #854), in three sibling sites that series did not cover.

sourceLinkOrEvidence

Concrete evidence on main @ 7d9cf90. Three identical local collapse helpers truncate the captured output for the one-line invocation text view by raw UTF-16 code units:

• src/provider-invocation.ts:512-516 — used at line 505 for the Result: line.
• src/tool-invocation.ts:420-424 — used at lines 410/413 for the Stdout:/Stderr: lines.
• src/mcp-invocation.ts:620-624 — used at line 613 for the Result: line.

Each is:

const MAX_DISPLAY_OUTPUT = 240;
function collapse(text: string): string {
  const oneLine = text.replace(/\s+/g, " ").trim();
  if (oneLine.length <= MAX_DISPLAY_OUTPUT) return oneLine;
  return `${oneLine.slice(0, MAX_DISPLAY_OUTPUT)} …[+${oneLine.length - MAX_DISPLAY_OUTPUT} chars]`;
}

The captured-output byte caps were already made surrogate-safe (#832/#834/#836/#848), so the text entering collapse is clean — but collapse then re-truncates at 240 code units with String.prototype.slice, which can orphan half of a surrogate pair and emit an unpaired surrogate into the user-visible invocation report.

Minimal reproduction (mirrors collapse exactly):

collapse("a".repeat(239) + "🚀 tail")

Observed: the 🚀 (code units 239–240) straddles the 240 cut; the output contains an unpaired high surrogate (0xd83d) immediately before the …[+N chars] marker.

problemStatement

The provider/tool/MCP invocation text views render captured output through a local collapse that bounds the one-line display with String.prototype.slice(0, 240). Because slice indexes UTF-16 code units, an astral character (emoji, etc.) straddling the 240 boundary is split, leaving an unpaired surrogate in the rendered Result:/Stdout:/Stderr: line. The upstream byte caps are surrogate-safe, but this separate display truncation reintroduces the defect. Same class as #854 (session-export clamp), in three more sites.

userValue

The one-line invocation summaries (provider Result:, tool Stdout:/Stderr:, MCP Result:) never show a broken/orphaned surrogate at the truncation boundary. An emoji or astral character straddling the 240-char display cap is dropped whole, so invocation reports render cleanly.

scope

• Make all three collapse helpers surrogate-safe by cutting via safeCutEnd from src/text-cut.ts (import it in each of provider-invocation.ts, tool-invocation.ts, mcp-invocation.ts).
• Compute the truncation count from the actual safe cut point (e.g. oneLine.length - cut) so the …[+N chars] marker stays accurate when the safe cut backs off one code unit.
• Preserve existing behavior for all non-surrogate-boundary inputs (same collapsed prefix, same marker format, same whitespace collapsing).

nonGoals

• Not changing MAX_DISPLAY_OUTPUT (240), the whitespace-collapse/trim behavior, or the surrounding invocation report format.
• Not touching the already-safe captured-output byte caps (Robustness: make the tool-invocation output-size cap surrogate-safe (spawnCommandRunner) #832/Robustness: account subprocess output caps in UTF-8 bytes, not UTF-16 code units (hook/tool/MCP) #834/Robustness: reassemble multi-byte UTF-8 split across chunks in the hook/tool/MCP output caps #836/Robustness: make the provider-invocation output cap UTF-8-byte-accurate and surrogate-safe (capOutput) #848).
• Not altering other truncation sites (this Issue is scoped to the three invocation-display collapse helpers).
• Desktop, Dynamic Workflow, or governance surfaces.

acceptanceCriteria

• None of the three collapse outputs can contain an unpaired surrogate (no lone \uD800–\uDBFF or \uDC00–\uDFFF).
• An astral character straddling the 240 cap is dropped whole (e.g. "a".repeat(239)+"🚀 tail" collapses with no surrogate before the marker).
• The truncation-count marker reflects the actual safe cut point.
• Non-boundary inputs are byte-for-byte unchanged from current behavior (including whitespace collapsing and in-range pass-through).
• Regression tests cover the surrogate-straddle case plus an in-range and a mid-ASCII-truncation case for the invocation display; existing tests pass.

testPlan

Unit tests (extend the existing provider/tool/mcp invocation suites): drive the invocation text-formatting path with captured output that places an astral character exactly across the 240 display cap, asserting the rendered line has no unpaired surrogate (regex /[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/) and the marker is present/accurate; plus an in-range case (no truncation) and an ASCII-overflow case (unchanged prefix/marker). Deterministic string assertions.

dogfoodPlan

Build from the merged branch and run the provider/tool/mcp invocation unit suites; additionally render an invocation report whose captured output carries emoji/astral content across the 240-char cap and confirm no broken glyph at the truncation boundary and the marker still present.

riskAndSecurityNotes

Low risk: display formatting only. Behavior is preserved except the surrogate fix; whitespace collapsing, the byte caps, and the report structure are untouched. No secrets/credentials/network action involved; the display path remains downstream of the redaction/cap pipeline.

duplicateSearchEvidence

• gh search issues for invocation collapse surrogate, invocation display truncat surrogate, collapse display surrogate, Result Stdout surrogate, invocation one-line surrogate → no matching Issue/PR.
• The merged byte-cap series is scoped to the captured-output caps, not this display collapse: Robustness: make the tool-invocation output-size cap surrogate-safe (spawnCommandRunner) #832 ("tool-invocation output-size cap … (spawnCommandRunner)"), Robustness: make the provider-invocation output cap UTF-8-byte-accurate and surrogate-safe (capOutput) #848 ("provider-invocation output cap … (capOutput)"), Robustness: account subprocess output caps in UTF-8 bytes, not UTF-16 code units (hook/tool/MCP) #834/Robustness: reassemble multi-byte UTF-8 split across chunks in the hook/tool/MCP output caps #836 (byte units / chunk reassembly).
• The three collapse helpers currently use raw .slice(0, 240) and none imports a text-cut helper.
  Conclusion: distinct, unfixed, untested surrogate-split sites — not a duplicate.

parentChildRelationship

Standalone source:self-discovery Issue (not a child of any roadmap parent). Complements the merged surrogate-safe truncation series by covering the three invocation-display collapse sites it missed.

dependencyOrder

No blocking dependencies; executable immediately (safeCutEnd already exists in src/text-cut.ts). Single vertical slice: make three identical helpers surrogate-safe plus focused regression tests.