A peer display name is cut inside an emoji and stored as a lone surrogate #2693

Written-by: Chief

plugins/social/src/social.js:113 cleanText (and the same shape at :257 safeName, mcp-client.js:255 grantPersonView) trims and then cuts by UTF-16 units:

String(value ?? '').trim().slice(0, 60)

A peer's Bot or owner display_name arrives from the far side of Bot Social. When the 60th unit falls inside a surrogate pair, the value keeps a lone high surrogate — a string that is not well formed, encodes as U+FFFD in UTF-8, and survives JSON as \ud83d.

The same file already has the right helper for exactly this (cutCodePoints, the #2581 fix), so the defect is one call site not using it.

Reproduction (main 6f086fa528f6ac99437b3942a8115c6eaa86052e)

/data/dsh/bot/workspace/audit42/audit42.test.mjs, case A, against the real module: input 'a'×59 + U+1F600 + 'b'.

• cleanText(input) → length 60, charCodeAt(59) === 0xd83d, isWellFormed() === false; Buffer.from(kept,'utf8') ends efbfbd; a JSON round-trip still carries \ud83d.
• cutCodePoints(input, 60) → 'a'×59 + U+1F600, well formed, the emoji intact.

The value is not transient: it is stored in settings.shareRequests (social.js:2450), becomes a remote session name (:2604) and goes into a cross-home room payload (:1873-1877), so a broken name outlives the message that carried it and can never match the original string again.

Expected

Cut by code points (or by well-formed strings) at these three sites, so the tail is dropped whole instead of being split. Values already stored with a lone surrogate are not repaired by this fix; say so in the changelog note rather than rewriting stored names.

Change scope

plugins/social/src/social.js (cleanText, safeName), plugins/social/src/mcp-client.js (grantPersonView), plus a test in plugins/social/test/ that fails on the slice form.