[Birfy]

Written-by: Dev
Fixes #2693

Owner: Dev
Reviewer: Reviewer

What changed

A friend's Bot or owner display name is capped at 60 characters, and the cap now counts code points, not UTF-16 units. On main, 'a'.repeat(59) + U+1F600 + 'b' through cleanText kept 'a'.repeat(59) plus a lone high surrogate — isWellFormed() === false, efbfbd in UTF-8, \ud83d after a JSON round-trip — and that value is not transient: it is stored in settings.shareRequests, becomes a remote session name and goes into a cross-home payload, so it outlives the message that carried it. Now the same input ends as 'a'.repeat(59) + U+1F600.

cutCodePoints (#2581) was already the right helper. It moved to plugins/social/src/code-points.js so mcp-client.js can share the one implementation, and social.js re-exports it unchanged.

Cut by code points now:

• social.js cleanText (60), safeName (120), draftText (800)
• social.js peer-text details: the onboarding body.message detail (200), mapFaceAutoError's raw message (200), notePaused's reason (120), the send-failure short line (100)
• social.js untrusted file preview (8000) and the invite message (280)
• mcp-client.js grantPersonView's person label (60)

Checked and deliberately unchanged, because the cut is ASCII-only and cannot split a code point: the handle sanitizers (social.js:88, mcp-client.js:225), slug (:270), the sha256 hex cuts (:271, :679, :822, :4783), homeHandleOf (:277), nextOnboardDisplayName's [^a-z0-9]+ base (:305), and the SSE prefix probe (mcp-client.js:156). face-rooms.js keeps its own documented copy of the helper (#2438) and is not touched here.

Names already stored with a lone surrogate are not migrated; only new values stop being damaged, and the changelog fragment says so.

Verification at the tip

Tip SHA: d626b7b

Red first: with plugins/social/src/social.js and plugins/social/src/mcp-client.js restored to the live main blobs and the new test kept, the new file gives 4 failures out of 5 (cleanText, safeName, grantPersonView, draftText; the "still caps, strips and falls back" case stays green because it does not cross a code-point bound).

Ran at this tip:

$ cd plugins/social && TZ=UTC DSH_HARNESS=/data/dsh/bot/workspace/d2607/repo/core/dev/harness node --import ./test/resolve.mjs --test test/name-code-points.test.js
$ cd plugins/social && TZ=UTC DSH_HARNESS=/data/dsh/bot/workspace/d2607/repo/core/dev/harness node --import ./test/resolve.mjs --test "test/*.test.js"
$ node scripts/lint-plugins.mjs social
$ node .github/scripts/changelog.mjs check

Results: red 1/5 pass on the base blobs; at this tip 5/5 pass, the whole social suite is 614 tests with 0 failures, lint-plugins reports 0 errors (36 pre-existing warnings) and the packed @flybot/social imports, and changelog.mjs check finds 32 well-formed fragments. No test line was relaxed, skipped or deleted.

Not run (and why): full npm run verify (the brief scoped the run to the social plugin); node scripts/ds-bot-patches.mjs check and build-client.mjs --check (nothing under core/ changed); node core/scripts/check-arch-docs.mjs (it reads git log base..HEAD and this box has no git checkout — docs/subsystems/social.md, the page that owns plugins/social/, is in this diff instead).

Checkpoint

{
  "pr": 2695,
  "claim": "Dev",
  "issue": 2693,
  "summary": "Peer display names, file names, drafts and error lines are now cut on code points instead of UTF-16 units, so a value whose bound falls inside an emoji no longer ends on a lone high surrogate that every later write reads as U+FFFD. The cutCodePoints helper (#2581) moved to src/code-points.js so mcp-client.js shares one implementation, and social.js re-exports it unchanged. Values already stored with a lone surrogate are left as they are, not migrated. A new test covers cleanText, safeName, draftText and grantPersonView, and it fails 4/5 when the fixed sources are reverted.",
  "files": [
    "plugins/social/src/code-points.js",
    "plugins/social/src/social.js",
    "plugins/social/src/mcp-client.js",
    "plugins/social/test/name-code-points.test.js",
    "docs/subsystems/social.md",
    "changelog.d/2693-social-name-cut.fixed.md"
  ],
  "checks": {
    "ran": "plugins/social suite 614 pass; name-code-points 5/5; node scripts/lint-plugins.mjs social; node .github/scripts/changelog.mjs check",
    "result": "green",
    "at": "d626b7b557354d5a0154e114ea439ac787a993f1"
  },
  "next": "none — ready for review"
}

[Birfy]

Verdict: PASS at d626b7b
Written-by: Reviewer
Attestation: d626b7b role=Reviewer

Ran at this tip:

$ cd plugins/social && TZ=UTC DSH_HARNESS=/data/dsh/bot/workspace/d2607/repo/core/dev/harness FLYBOT_CORE=/data/dsh/bot/workspace/p2695/ThinkFlowLab-FlyBot-d626b7b/core node --import ./test/resolve.mjs --test test/name-code-points.test.js
# tests 5  # pass 5  # fail 0
$ cd plugins/social && TZ=UTC DSH_HARNESS=/data/dsh/bot/workspace/d2607/repo/core/dev/harness FLYBOT_CORE=/data/dsh/bot/workspace/p2695/ThinkFlowLab-FlyBot-d626b7b/core node --import ./test/resolve.mjs --test "test/*.test.js"
# tests 614  # pass 614  # fail 0
$ cp base-social.js plugins/social/src/social.js && cp base-mcp-client.js plugins/social/src/mcp-client.js   # red first: base blobs, new test kept
# tests 5  # pass 1  # fail 4

What I checked:

• The cut is on code points, at the right call sites. 'a'×59 + U+1F600 + 'b' through cleanText now ends 'a'×59 + U+1F600, isWellFormed() === true, no lone 0xd83d; safeName (120) and grantPersonView (60, mcp-client.js:256) and draftText (800) the same. The four failing cases on the base blobs are exactly those four, so the red is the change and not the test.
• code-points.js is the same implementation, not a second one. The function body moved verbatim from social.js (was cutCodePoints, Fix the remaining UTF-16-unit string cuts: lone surrogates in stored failure text, task cues, room shares, avatars, role labels and timeline labels #2581); plugins/social/src now holds one definition (code-points.js:6), social.js:36 imports it and social.js:107 keeps the old export { cutCodePoints }, so existing importers are unchanged. mcp-client.js:10 is the only new importer, no cycle. BMP and combining-sequence behaviour is byte-identical because the body is unchanged; the Fix the remaining UTF-16-unit string cuts: lone surrogates in stored failure text, task cues, room shares, avatars, role labels and timeline labels #2581 test still runs and is green in the 614.
• The untouched slice(0, n) calls cannot split a code point. Handle sanitizers (social.js:89, mcp-client.js:226), slug (:267), nextOnboardDisplayName's [^a-z0-9]+ base (:302), the sha256 hex cuts (:268, :676, :819, :2735, :4780), the SSE prefix probe (mcp-client.js:157) and the array slices all operate on ASCII-only values — same list the PR body gives, and it matches the code.
• No migration, and it is said. settings.shareRequests values already stored with a lone surrogate stay as they are; the changelog fragment says so and demonstrates the user-visible effect.
• Regression and docs. Social suite 614/614 including Fix the remaining UTF-16-unit string cuts: lone surrogates in stored failure text, task cues, room shares, avatars, role labels and timeline labels #2581; the 16 deleted social.js lines are the moved helper and the four replaced cuts, no test line relaxed. docs/subsystems/social.md's new paragraph matches the implementation (60/120/800/60, one helper, re-exported).
• Scope. Only the six listed files; nothing in core/, plugins/tree, or the Three identity keys that bypass the shared name rule: tree siblings, role labels, memory topics #2692 surface. Check-runs at this tip: only enqueue-guard failure (no PASS at that moment — this comment supplies it); tests-ok, package, policy-sign, merge-gate, plugins (social/tree/timeline/workflow) all green.
• Nit, not blocking: face-rooms.js:27's comment still says social.js's cutCodePoints "already repeats it" — social.js no longer holds a copy; file untouched here, and social: peer-supplied face-room names, roles, platform lines and join errors are capped on UTF-16 units, so a label can carry half a surrogate pair #2438 keeps that copy deliberately.