gansx · Oct 23, 2026 · Oct 21, 2026 · Oct 22, 2026 · Oct 22, 2026 · Oct 23, 2026
@@ -1,4 +1,5 @@
 import { parseLocalFileReference } from "./message-body.js";
+import { trimBoundaryCharacters } from "./string-boundaries.js";
 
 export type ComposerInputPart =
   | { readonly type: "text"; readonly text: string }
@@ -254,7 +255,7 @@ function mergeAdjacentTextParts(parts: readonly ComposerInputPart[]): readonly C
 }
 
 function normalizeLabel(value: string): string {
-  return value.toLowerCase().replace(/[^a-z0-9_.-]+/g, "-").replace(/^-+|-+$/g, "");
+  return trimBoundaryCharacters(value.toLowerCase().replace(/[^a-z0-9_.-]+/g, "-"), "-");
 }
 
 function readKnownMentionAtStart(
@@ -319,7 +320,7 @@ function readUrlAtStart(
 }
 
 function trimUrlToken(value: string): string {
-  let next = trimNaturalLanguageSuffix(value).replace(/[.,;:!?，。！？；：、]+$/u, "");
+  let next = trimBoundaryCharacters(trimNaturalLanguageSuffix(value), ".,;:!?，。！？；：、", "end");
   while (next.endsWith(")") || next.endsWith("]")) {
     const opener = next.endsWith(")") ? "(" : "[";
     const closer = next.endsWith(")") ? ")" : "]";

@@ -2,6 +2,7 @@ import { unified } from "unified";
 import remarkParse from "remark-parse";
 import remarkGfm from "remark-gfm";
 import remarkMath from "remark-math";
+import { trimBoundaryCharacters } from "./string-boundaries.js";
 
 export interface LocalFileReference {
   readonly raw: string;
@@ -521,11 +522,11 @@ function stripWrappingQuotes(value: string): string {
 }
 
 function trimTrailingUrlPunctuation(value: string): string {
-  return value.replace(/[),.;!?]+$/g, "");
+  return trimBoundaryCharacters(value, "),.;!?", "end");
 }
 
 function trimTrailingPathPunctuation(value: string): string {
-  return value.replace(/[),.;!?]+$/g, "");
+  return trimBoundaryCharacters(value, "),.;!?", "end");
 }
 
 function normalizePath(value: string): string {

@@ -0,0 +1,74 @@
+export function trimBoundaryCharacters(
+  value: string,
+  characters: string,
+  side: "start" | "end" | "both" = "both",
+): string {
+  let start = 0;
+  let end = value.length;
+  if (side !== "end") {
+    while (start < end && characters.includes(value[start] ?? "")) start += 1;
+  }
+  if (side !== "start") {
+    while (end > start && characters.includes(value[end - 1] ?? "")) end -= 1;
+  }
+  return start === 0 && end === value.length ? value : value.slice(start, end);
+}
+
+export function extractWrappedSection(
+  value: string,
+  labels: readonly string[],
+  boundaryLabels: readonly string[],
+): string | undefined {
+  const searchValue = asciiLowercase(value);
+  let selected: { readonly labelIndex: number; readonly start: number } | undefined;
+  for (const label of labels) {
+    const searchLabel = asciiLowercase(label);
+    let labelIndex = searchValue.indexOf(searchLabel);
+    while (labelIndex !== -1) {
+      let start = labelIndex + label.length;
+      while (start < value.length && isWhitespace(value[start])) start += 1;
+      if (":：".includes(value[start] ?? "")) {
+        start += 1;
+        while (start < value.length && isWhitespace(value[start])) start += 1;
+        if (!selected || labelIndex < selected.labelIndex) selected = { labelIndex, start };
+        break;
+      }
+      labelIndex = searchValue.indexOf(searchLabel, labelIndex + 1);
+    }
+  }
+  if (!selected) return undefined;
+  let end = value.length;
+  for (const boundary of boundaryLabels) {
+    const searchBoundary = asciiLowercase(boundary);
+    let boundaryIndex = searchValue.indexOf(searchBoundary, selected.start);
+    while (boundaryIndex !== -1) {
+      const before = value[boundaryIndex - 1];
+      const after = value[boundaryIndex + boundary.length];
+      if (isWhitespace(before) && !isWordCharacter(after)) {
+        end = Math.min(end, boundaryIndex);
+        break;
+      }
+      boundaryIndex = searchValue.indexOf(searchBoundary, boundaryIndex + 1);
+    }
+  }
+  const section = value.slice(selected.start, end).trim();
+  return section || undefined;
+}
+
+function asciiLowercase(value: string): string {
+  const result: string[] = [];
+  for (let index = 0; index < value.length; index += 1) {
+    const character = value[index] ?? "";
+    const code = character.charCodeAt(0);
+    result.push(code >= 65 && code <= 90 ? String.fromCharCode(code + 32) : character);
+  }
+  return result.join("");
+}
+
+function isWhitespace(value: string | undefined): boolean {
+  return value !== undefined && value.trim() === "";
+}
+
+function isWordCharacter(value: string | undefined): boolean {
+  return value !== undefined && /[A-Za-z0-9_]/u.test(value);
+}
@@ -14,6 +14,7 @@ import {
   userVisibleTerminalReportChanges,
 } from "./terminal-report-visibility.js";
 import { projectVisibleTerminalReportContent } from "./terminal-report-presentation.js";
+import { extractWrappedSection, trimBoundaryCharacters } from "./string-boundaries.js";
 
 interface TerminalReportSourceRefInput {
   readonly kind: string;
@@ -300,10 +301,17 @@ function uniqueSourceRefs(refs: readonly TerminalReportSourceRefInput[]): Termin
  */
 function compactTerminalReportTitle(value: string): string {
   const normalized = value.replace(/\s+/gu, " ").trim();
-  const wrapped = normalized.match(
-    /(?:原始请求|Original request)\s*[:：]\s*(.+?)(?=\s+(?:执行任务|已物化的执行操作|建议协作步骤|Requested objective|No literal file content|Materialized operations|Participant operation ownership|Permission boundary)\b|$)/iu,
-  )?.[1]?.trim();
-  const candidate = (wrapped || normalized).replace(/^\*+|\*+$/gu, "").trim();
+  const wrapped = extractWrappedSection(normalized, ["原始请求", "Original request"], [
+    "执行任务",
+    "已物化的执行操作",
+    "建议协作步骤",
+    "Requested objective",
+    "No literal file content",
+    "Materialized operations",
+    "Participant operation ownership",
+    "Permission boundary",
+  ]);
+  const candidate = trimBoundaryCharacters(wrapped || normalized, "*").trim();
   return candidate.length > 180 ? `${candidate.slice(0, 177).trimEnd()}...` : candidate;
 }
 

@@ -114,6 +114,18 @@ test("raw token removal trims duplicate whitespace at removal boundary", () => {
   assert.equal(removeComposerInputRawToken("Run /review  now", "/review"), "Run now");
 });
 
+test("composer parsing handles long boundary runs without changing tokens", () => {
+  const punctuation = "!".repeat(100_000);
+  const parts = parseComposerInputParts(`https://example.com/docs${punctuation}`);
+  assert.equal(parts[0]?.type, "url_ref");
+  assert.equal(parts[0]?.raw, "https://example.com/docs");
+
+  const paddedId = `${"-".repeat(100_000)}review${"-".repeat(100_000)}`;
+  const command = parseComposerInputParts("/review", { slashCommands: [{ id: paddedId, label: "Review" }] });
+  assert.equal(command[0]?.type, "slash_command");
+  assert.equal(command[0]?.commandId, paddedId);
+});
+
 test("permission confirmation is derived from explicit option metadata", () => {
   assert.equal(conversationPermissionPresetRequiresConfirmation("full_access"), true);
   assert.equal(conversationPermissionPresetRequiresConfirmation("read_only"), false);

@@ -144,3 +144,12 @@ test("message body collects unique file references from nested structured blocks
     "docs/design/conversation-shared-capabilities.md",
   ]);
 });
+
+test("message tokenization trims long punctuation runs in linear boundary helpers", () => {
+  const punctuation = "!".repeat(100_000);
+  const tokens = splitInlineTokens(`https://example.com/docs${punctuation} src/index.ts${punctuation}`, "/workspace/ling-stack");
+  const link = tokens.find((token) => token.kind === "web_link");
+  const file = tokens.find((token) => token.kind === "local_file");
+  assert.equal(link?.kind === "web_link" ? link.href : undefined, "https://example.com/docs");
+  assert.equal(file?.kind === "local_file" ? file.reference.displayPath : undefined, "src/index.ts");
+});
@@ -140,6 +140,20 @@ test("terminal report projection keeps Markdown summaries and bounds model title
   assert.match(participant?.description ?? "", /```ts\nconst ok = true;/u);
 });
 
+test("terminal report title extraction handles long protocol whitespace", () => {
+  const title = `Original request${" ".repeat(100_000)}: concise result Requested objective ignored wrapper`;
+  const report = terminalReportToViewModel({
+    id: "terminal_report_long_wrapper",
+    status: "committed",
+    language: "en-US",
+    outcome: { status: "succeeded", title, summary: "done", corrections: [], sourceRefs: [] },
+    changes: [], verification: [], participants: [], artifacts: [], risks: [], references: [],
+    evidenceFingerprint: "fingerprint_long_wrapper",
+    committedAt: "2026-10-21T00:00:00.000Z",
+  });
+  assert.equal(report.rows.find((row) => row.reportSection === "outcome")?.title, "concise result");
+});
+
 test("terminal report artifact workspace paths require one trusted changed-file source ref", () => {
   const report = terminalReportToViewModel({
     id: "terminal_report_workspace_files",

@@ -111,7 +111,7 @@ function inferRiskReview(input: string): Parameters<typeof buildChannelTeamRiskR
       },
     };
   }
-  if (/(delete|drop|remove).*(production|database|db)|rm\s+-rf|reset\s+--hard/.test(lower)) {
+  if (hasDestructiveTargetSequence(lower) || /rm\s+-rf|reset\s+--hard/.test(lower)) {
     return {
       actionType: "bash",
       risk: "critical",
@@ -129,6 +129,18 @@ function inferRiskReview(input: string): Parameters<typeof buildChannelTeamRiskR
   };
 }
 
+function hasDestructiveTargetSequence(value: string): boolean {
+  for (const action of ["delete", "drop", "remove"] as const) {
+    const actionIndex = value.indexOf(action);
+    if (actionIndex === -1) continue;
+    const targetStart = actionIndex + action.length;
+    if (["production", "database", "db"].some((target) => value.indexOf(target, targetStart) !== -1)) {
+      return true;
+    }
+  }
+  return false;
+}
+
 function diffValue(path: string, before: unknown, after: unknown): readonly ChannelTeamSnapshotDiffEntry[] {
   if (JSON.stringify(before) === JSON.stringify(after)) {
     return [];

@@ -1,3 +1,5 @@
+import { trimBoundaryCharacters } from "./string-boundaries.js";
+
 export type ComposerSlashIntent =
   | { readonly kind: "none" }
   | {
@@ -314,7 +316,7 @@ function isSessionCommandOption(command: ComposerSlashCommandOption): boolean {
 }
 
 function normalizeLabel(value: string): string {
-  return value.toLowerCase().replace(/[^a-z0-9_.-]+/g, "-").replace(/^-+|-+$/g, "");
+  return trimBoundaryCharacters(value.toLowerCase().replace(/[^a-z0-9_.-]+/g, "-"), "-");
 }
 
 function teammateMentionAliases(teammate: ComposerSlashMentionOption): readonly string[] {

@@ -3,6 +3,7 @@ import { mkdirSync, writeFileSync } from "node:fs";
 import { relative, resolve as resolvePath } from "node:path";
 import type { ApprovalRequest } from "./approval-types.js";
 import { redactSecrets } from "./redaction.js";
+import { trimBoundaryCharacters } from "./string-boundaries.js";
 import { DEFAULT_WORKSPACE_ID } from "./workspace-types.js";
 import { normalizeGitHubExternalWorkItem } from "./external-work.js";
 import type {
@@ -145,7 +146,7 @@ export function createGitHubExternalActionAdapter(options: GitHubExternalActionA
   if (!fetchImpl) {
     throw new Error("A fetch implementation is required for GitHub external action execution.");
   }
-  const apiBaseUrl = (options.apiBaseUrl ?? "https://api.github.com").replace(/\/+$/, "");
+  const apiBaseUrl = trimBoundaryCharacters(options.apiBaseUrl ?? "https://api.github.com", "/", "end");
 
   return {
     async getPullRequest(input: GitHubSubjectInput): Promise<ExternalWorkItem | undefined> {

@@ -3,6 +3,7 @@ import { mkdirSync, writeFileSync } from "node:fs";
 import { relative, resolve as resolvePath } from "node:path";
 import { normalizeGitHubExternalWorkItem } from "./external-work.js";
 import { redactSecrets } from "./redaction.js";
+import { trimBoundaryCharacters } from "./string-boundaries.js";
 import type {
   ExternalWorkCiTriageRecord,
   ExternalWorkCiTriageResponse,
@@ -85,7 +86,7 @@ export function createGitHubCiTriageAdapter(options: GitHubCiTriageAdapterOption
   if (!fetchImpl) {
     throw new Error("A fetch implementation is required for GitHub CI triage.");
   }
-  const apiBaseUrl = (options.apiBaseUrl ?? "https://api.github.com").replace(/\/+$/, "");
+  const apiBaseUrl = trimBoundaryCharacters(options.apiBaseUrl ?? "https://api.github.com", "/", "end");
 
   return {
     async getPullRequest(input): Promise<ExternalWorkItem> {

@@ -4,6 +4,7 @@ import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { isAbsolute, relative, resolve as resolvePath } from "node:path";
 import { DEFAULT_WORKSPACE_ID, type Channel } from "./workspace-types.js";
 import { redactSecrets } from "./redaction.js";
+import { trimBoundaryCharacters } from "./string-boundaries.js";
 import { createCoreOriginalProcessEntry, isCoreOriginalLaunchRefusal, type CoreOriginalProcessEntry } from "./original-host-process-entry.js";
 import type {
   ChannelStoreFacet,
@@ -117,7 +118,7 @@ export function createGitHubExternalWorkAdapter(options: GitHubExternalWorkAdapt
   if (!fetchImpl) {
     throw new Error("A fetch implementation is required for GitHub external work polling.");
   }
-  const apiBaseUrl = (options.apiBaseUrl ?? "https://api.github.com").replace(/\/+$/, "");
+  const apiBaseUrl = trimBoundaryCharacters(options.apiBaseUrl ?? "https://api.github.com", "/", "end");
 
   return {
     id: "github-readonly",

@@ -59,17 +59,45 @@ export function updateExternalWorkflowSecretRef(markdown: string, secretRef: str
 }
 
 export function renderExternalWorkflowPrompt(template: string, input: { readonly item: ExternalWorkItem }): string {
-  return template.replace(/\{\{\s*([^}]+?)\s*\}\}/g, (_match, expression: string) => {
-    const path = expression.trim();
-    if (!path.startsWith("item.")) {
-      throw new ExternalWorkflowValidationError(`Unknown workflow prompt variable: ${path}`);
+  const parts: string[] = [];
+  let cursor = 0;
+  let opening: number | undefined;
+  let index = 0;
+  while (index < template.length) {
+    const character = template[index];
+    const nextCharacter = template[index + 1];
+    if (character === "{" && nextCharacter === "{") {
+      if (opening === undefined) opening = index;
+      index += 1;
+      continue;
     }
-    const value = readDotPath(input, path);
-    if (value === undefined || value === null) {
-      throw new ExternalWorkflowValidationError(`Unknown workflow prompt variable: ${path}`);
+    if (character !== "}") {
+      index += 1;
+      continue;
     }
-    return formatPromptValue(value);
-  });
+    if (nextCharacter !== "}") {
+      opening = undefined;
+      index += 1;
+      continue;
+    }
+    if (opening !== undefined && index > opening + 2) {
+      parts.push(template.slice(cursor, opening));
+      const path = template.slice(opening + 2, index).trim();
+      if (!path.startsWith("item.")) {
+        throw new ExternalWorkflowValidationError(`Unknown workflow prompt variable: ${path}`);
+      }
+      const value = readDotPath(input, path);
+      if (value === undefined || value === null) {
+        throw new ExternalWorkflowValidationError(`Unknown workflow prompt variable: ${path}`);
+      }
+      parts.push(formatPromptValue(value));
+      cursor = index + 2;
+    }
+    opening = undefined;
+    index += 2;
+  }
+  parts.push(template.slice(cursor));
+  return parts.join("");
 }
 
 export function normalizeGitHubExternalWorkItem(input: {

@@ -4,6 +4,7 @@ import { join, resolve } from "node:path";
 import { promisify } from "node:util";
 import type { SkillSourceScanRoot } from "./skill-types.js";
 import { createCoreOriginalProcessEntry, isCoreOriginalLaunchRefusal } from "./original-host-process-entry.js";
+import { trimBoundaryCharacters } from "./string-boundaries.js";
 
 const execFile = promisify(execFileCallback);
 
@@ -179,7 +180,7 @@ async function readGstackVersion(repoRoot: string): Promise<string | undefined>
 
 function normalizeGithubPath(host: string, pathname: string): string | undefined {
   const normalizedHost = host.trim().toLowerCase();
-  const normalizedPath = pathname.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "").toLowerCase();
+  const normalizedPath = trimBoundaryCharacters(pathname, "/").replace(/\.git$/i, "").toLowerCase();
   return normalizedHost && normalizedPath ? `${normalizedHost}/${normalizedPath}` : undefined;
 }
 

@@ -5,6 +5,7 @@ import type {
   MemorySourceRef,
 } from "./memory-types.js";
 import { DEFAULT_WORKSPACE_ID } from "./workspace-types.js";
+import { trimBoundaryCharacters } from "./string-boundaries.js";
 
 export interface MemoryMarkdownImportOptions {
   readonly workspaceId?: string;
@@ -374,7 +375,7 @@ function importSourceRefId(sourceId: string, itemId: string): string {
 }
 
 function sanitizeSourceId(value: string): string {
-  const sanitized = value.trim().replace(/[^A-Za-z0-9._:-]+/g, "_").replace(/^_+|_+$/g, "");
+  const sanitized = trimBoundaryCharacters(value.trim().replace(/[^A-Za-z0-9._:-]+/g, "_"), "_");
   return sanitized || "memory-markdown-import";
 }