refactor: route the remaining code-unit clips through truncateUtf16Safe

The MCP header-warning ellipsis in sep-2243 and the Telegram draft/chunk prefix were two more hand-written copies of the same boundary rule on a UTF-16 code-unit budget. Both now call the shared helper, which retires the Telegram-local prefix walk and its direct test; the same cases live in text-sanitize.test.ts. thread-search's capCodePoints stays as is: its budget is code points, not code units, so it is a different contract rather than another copy.

Generated-by: Claude Code (Fable 5.1)
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FTqr6ZjXfNthXT719ag7Qc

Author: shaynhornik

packages/mcp/src/sep-2243.ts

@@ -17,6 +17,7 @@
  * under the License.
  */
 
+import { truncateUtf16Safe } from '@maka/core/text-sanitize';
 import { formatMcpDiagnosticText } from './diagnostic-text.js';
 
 const X_MCP_HEADER = 'x-mcp-header';
@@ -281,9 +282,8 @@ function valueAtPath(root: unknown, path: readonly string[]): unknown {
 
 function truncateRenderedWarning(value: string): string {
   if (value.length <= MCP_HEADER_WARNING_LENGTH_LIMIT) return value;
-  const end = MCP_HEADER_WARNING_LENGTH_LIMIT - 1;
-  const safeEnd = end > 0 && /[\uD800-\uDBFF]/u.test(value[end - 1] ?? '') ? end - 1 : end;
-  return `${value.slice(0, safeEnd)}\u2026`;
+  // The ellipsis is one BMP code unit, so it fits in the unit it reclaims.
+  return `${truncateUtf16Safe(value, MCP_HEADER_WARNING_LENGTH_LIMIT - 1)}\u2026`;
 }
 
 function isRecord(value: unknown): value is Record<string, unknown> {

packages/runtime/src/bots/__tests__/telegram-utf16.test.ts

@@ -22,19 +22,9 @@ import { describe, it } from 'node:test';
 
 import { __TEST__ } from '../telegram-bridge.js';
 
-const { utf16Len, prefixWithinUtf16, splitForTelegram } = __TEST__;
+const { utf16Len, splitForTelegram } = __TEST__;
 
 describe('Telegram UTF-16 limits', () => {
-  it('truncates prefixes without splitting surrogate pairs', () => {
-    for (const [text, limit, expected] of [
-      ['hello', 100, 'hello'],
-      ['abcdef', 3, 'abc'],
-      ['a😀', 2, 'a'],
-    ] as const) {
-      assert.equal(prefixWithinUtf16(text, limit), expected, text);
-    }
-  });
-
   it('splits oversized text within limits, on code points, and preferably at newlines', () => {
     assert.deepEqual(splitForTelegram('hello world'), ['hello world']);
 

packages/runtime/src/bots/telegram-bridge.ts

@@ -28,6 +28,7 @@
 import type { BotAttachmentKind } from '@maka/core/bot-events';
 import type { BotChannelSettings } from '@maka/core/bot-chat-settings';
 import { generalizedErrorMessage } from '@maka/core/redaction';
+import { truncateUtf16Safe } from '@maka/core/text-sanitize';
 import { BaseBotAdapter, botReadinessFromSettings } from './base-adapter.js';
 import type {
   BotPlatform,
@@ -63,28 +64,6 @@ function utf16Len(s: string): number {
   return s.length === 0 ? 0 : Buffer.byteLength(s, 'utf16le') / 2;
 }
 
-/**
- * Return the longest prefix of `s` whose UTF-16 length is ≤ `cap`,
- * respecting surrogate-pair boundaries (we never slice a
- * multi-code-unit character in half). We iterate codepoint-by-
- * codepoint instead of binary-searching slices: the cost of
- * mistakenly splitting an emoji is far worse than the O(n) cost.
- */
-function prefixWithinUtf16(s: string, cap: number): string {
-  if (utf16Len(s) <= cap) return s;
-  let used = 0;
-  let end = 0;
-  for (let i = 0; i < s.length; ) {
-    const code = s.codePointAt(i)!;
-    const units = code > 0xffff ? 2 : 1;
-    if (used + units > cap) break;
-    used += units;
-    i += units;
-    end = i;
-  }
-  return s.slice(0, end);
-}
-
 /**
  * Split `text` into UTF-16-bounded chunks for Telegram delivery.
  * Prefers breaking on a newline within the last ~10% of the chunk;
@@ -100,7 +79,7 @@ function splitForTelegram(text: string): string[] {
   const pieces: string[] = [];
   let remaining = text;
   while (utf16Len(remaining) > cap) {
-    let chunk = prefixWithinUtf16(remaining, cap);
+    let chunk = truncateUtf16Safe(remaining, cap);
     const minBoundary = Math.floor(chunk.length * 0.9);
     const nl = chunk.lastIndexOf('\n');
     if (nl >= minBoundary) chunk = chunk.slice(0, nl);
@@ -264,7 +243,6 @@ function classifyTelegramSendResponse(response: any): TelegramSendClassification
 
 export const __TEST__ = {
   utf16Len,
-  prefixWithinUtf16,
   splitForTelegram,
   buildTelegramSendBody,
   normalizeTelegramReplyToMessageId,
@@ -374,7 +352,7 @@ export class TelegramBotBridge extends BaseBotAdapter implements SendCapable {
     return createTelegramReplyStream({
       chatId,
       streamId: options.streamId,
-      prepareDraftText: (text) => prefixWithinUtf16(text, TELEGRAM_MAX_UTF16_PER_MESSAGE),
+      prepareDraftText: (text) => truncateUtf16Safe(text, TELEGRAM_MAX_UTF16_PER_MESSAGE),
       sendDraft: async (draftId, text) => {
         const response = await telegramApi(token, 'sendMessageDraft', {
           chat_id: privateChatId,