CLI: surrogate-safe truncation for repo-context file/dir names (redactName) #876

Self-discovery (undirected maintainer review pass). Left unclaimed for the next natural tick.

sourceType

Self-discovery (repository maintainer review of qwen-code-dev-bot/oh-my-cli).

sourceLinkOrEvidence

• src/repo-context.ts:119 — redactName: return redactSecrets(text).text.slice(0, MAX_NAME_LEN); (MAX_NAME_LEN = 200, src/repo-context.ts:32) — raw slice of file/directory names.
• Consumed at src/repo-context.ts:442 (name: redactName(ent.name)) during the structure walk, so it is reachable via collectRepoContext.
• Its sibling redactCommand (src/repo-context.ts:123) was fixed to safeCutEnd in CLI: surrogate-safe truncation for task-plan objective + verify commands (remaining raw slices) #874; redactName was not.

Minimal reproduction: a directory or file whose name is "a".repeat(199) + "🚀…" (i.e. > 200 chars with an astral character straddling the 200 boundary). collectRepoContext walks it and redactName keeps indices 0-199 via slice(0, 200), retaining the rocket's high surrogate while cutting its low partner — an orphaned surrogate in the repo-context snapshot name.

problemStatement

repo-context.ts redactName still truncates with a raw String.prototype.slice(0, MAX_NAME_LEN). File and directory names can legitimately contain astral characters (emoji); when one straddles the 200-char bound, the kept name ends in an orphaned surrogate. This is the last raw-slice truncation in repo-context.ts — its sibling redactCommand was already fixed in #874 — and it lags the safeCutEnd convention established by #812/#821 and extended through #860/#868/#870/#874.

userValue

Repo-context snapshot names containing emoji/astral characters truncate cleanly instead of ending in an unpaired surrogate — consistent with every other truncation path in the CLI.

scope

• src/repo-context.ts redactName: cut via safeCutEnd (already imported in this file after CLI: surrogate-safe truncation for task-plan objective + verify commands (remaining raw slices) #874).
• Keep the MAX_NAME_LEN bound and redaction unchanged.
• Red→green regression test.

nonGoals

• Not changing the bound, redaction, or the repo-context snapshot structure.
• run-bottleneck.ts safeName and run-failure-taxonomy.ts sanitizeReason also raw-slice, but their inputs are ASCII by construction (registered tool names / a fixed terminal-reason set), so they are out of scope.

acceptanceCriteria

• Given a file/directory name whose astral character straddles the MAX_NAME_LEN bound, the redacted name in the repo-context snapshot contains no orphaned surrogate (regex [\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff] does not match) and still respects the length bound.
• Names at or below the bound (including ASCII) are unchanged.

testPlan

• Regression test in tests/unit/repo-context.test.ts: create a temp dir containing a file/dir whose name straddles the 200-char bound with an astral character, run collectRepoContext, and assert the snapshot name has no lone surrogate; plus an in-range name passthrough case.
• Red→green: reverting the cut to raw slice makes the test fail; restoring safeCutEnd turns it green.
• Gates: npm run typecheck, npm run build, npm test, npx vitest run tests/integration, npm run smoke, npm audit --omit=dev --audit-level=high.

dogfoodPlan

After merge, run npx vitest run tests/unit/repo-context.test.ts tests/unit/text-cut.test.ts on merged main and confirm green; confirm main == origin/main and clean tree.

riskAndSecurityNotes

Behavior surface unchanged except surrogate safety at the cut; redaction and the snapshot structure are untouched. Tests use inert local temp names (no secrets). No new attack surface.

duplicateSearchEvidence

• gh search issues "redactName" -> Robustness: make byte-bounded truncations surrogate-safe (headless output + change-review path/name) #828 (closed, change-review path/name + headless output), CLI: surrogate-safe truncation for task-plan objective + verify commands (remaining raw slices) #874/CLI: surrogate-safe truncation for hook tool-arg bounds + task-runtime detail (remaining raw slices) #870/CLI: surrogate-safe truncation for goal objective + workspace-memory text (remaining raw slices deferred by #860) #868 (closed, other modules); none covers repo-context.ts redactName.
• gh search issues "repo-context name truncat" / "repo-context surrogate" -> no results.
• CLI: surrogate-safe truncation for task-plan objective + verify commands (remaining raw slices) #874 fixed the sibling redactCommand in the same file but not redactName.

parentChildRelationship

Standalone leaf subtask; no parent roadmap item required and no children anticipated.

dependencyOrder

No dependencies; dependency-ready. Self-contained change to src/repo-context.ts (+ tests) using the existing text-cut.ts helper.