expect(result).toContain("[truncated]");

});

it("truncates long inputs without splitting a surrogate pair", () => {

const loneSurrogatePattern =

/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?:^|[^\uD800-\uDBFF])[\uDC00-\uDFFF]/u;

const input = "a".repeat(3999) + "\u{1F600}" + "b".repeat(2000);

const result = sanitizeInput(input);

expect(result).toContain("[truncated]");

expect(result).not.toMatch(loneSurrogatePattern);

expect(result).toBe(`${"a".repeat(3999)}... [truncated]`);

});

it("keeps complete supplementary-plane characters that fit before truncation", () => {

const loneSurrogatePattern =

/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?:^|[^\uD800-\uDBFF])[\uDC00-\uDFFF]/u;

const emoji = "\u{1F600}";

const input = "a".repeat(3998) + emoji + "b".repeat(2000);

const result = sanitizeInput(input);

expect(result).toContain("[truncated]");

expect(result.startsWith(`${"a".repeat(3998)}${emoji}`)).toBe(true);

expect(result).not.toMatch(loneSurrogatePattern);

});

it("rate limits per user and caps tracked state", () => {

const limiter = new RateLimiter(3, 60);

expect(limiter.check("user1")).toBe(true);

import { resolveStableChannelMessageIngress } from "openclaw/plugin-sdk/channel-ingress-runtime";

import { finiteSecondsToTimerSafeMilliseconds } from "openclaw/plugin-sdk/number-runtime";

import { safeEqualSecret } from "openclaw/plugin-sdk/security-runtime";

import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";

import {

createFixedWindowRateLimiter,

type FixedWindowRateLimiter,

const maxLength = 4000;

if (sanitized.length > maxLength) {

sanitized = sanitized.slice(0, maxLength) + "... [truncated]";

sanitized = truncateUtf16Safe(sanitized, maxLength) + "... [truncated]";

}

return sanitized;

import type { IncomingMessage, ServerResponse } from "node:http";

import * as querystring from "node:querystring";

import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/string-coerce-runtime";

import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";

import {

beginWebhookRequestPipelineOrReject,

createWebhookInFlightLimiter,

respondNoContent(params.res);

return { ok: false };

}

const preview = cleanText.length > 100 ? `${cleanText.slice(0, 100)}...` : cleanText;

const preview = cleanText.length > 100 ? `${truncateUtf16Safe(cleanText, 100)}...` : cleanText;

return {

ok: true,

message: {

deliveryUserId,

params.account.allowInsecureSsl,

);

const replyPreview = reply.length > 100 ? `${reply.slice(0, 100)}...` : reply;

const replyPreview = reply.length > 100 ? `${truncateUtf16Safe(reply, 100)}...` : reply;

params.log?.info?.(

`Reply sent to ${params.message.payload.username} (${deliveryUserId}): ${replyPreview}`,

);