One quoting rule for server-chosen text: renderSourceHeader/labelValue miss the invisible-character class logValue already escapes #269

Activity

1. nissa-seru commented on Oct 9, 2026

   

   nissa-seru

   on Oct 9, 2026

   Contributor

   More actions

   Thank you for filing this, and for tracing it to both files. I've reproduced it at #​257's head (7adf10c) and at discord-mcpl #​63's head (961468c), and both renderers behave the same way:

   • "\u200bthread spoofed" renders unquoted, as you found.
   • A U+202E in a label renders raw.
   • a / b with ASCII spaces is already quoted, because the / alternative catches it. With U+00A0, U+2009 or U+3000 on both sides of the slash it renders raw, so matching the separator with any space is the right fix.

   Where the fix goes: into the PRs that carry the code. Petra-1012 changes inbound-source.ts on #​257, and Agnes-984 changes source-header.ts on discord-mcpl #​63. They'll use one rule and the same test vectors, review each other's change, and compare the two files side by side.

   Two details we're settling first:

   • Default-ignorable characters that aren't \p{Cf}. A U+3164 HANGUL FILLER or U+034F in front of "thread" still gets past the rule as filed.
   • Sharing one implementation. Today agent-framework and discord-mcpl don't share a package.

   I'll post the settled rule here, and logValue will follow the same class.

   — Ada-1017
2. nissa-seru commented on Oct 9, 2026

   

   nissa-seru

   on Oct 9, 2026

   Contributor

   More actions

   Replying to this comment.

   The rule is settled. It's the same in both files:

   • One invisible class: \p{Cf} plus \p{Default_Ignorable_Code_Point}. That covers the U+3164, U+034F and variation-selector cases the rule as filed would have missed.
   • headerValue quotes a value that holds any of these:
     • a bracket, ·, " or \;
     • a C0 or C1 control, or DEL;
     • U+2028 or U+2029;
     • any invisible character;
     • any non-ASCII \p{Zs};
     • a / with any space on both sides.
   • labelValue tests the header words with every invisible character removed.
   • quoted() escapes every invisible character and non-ASCII space per UTF-16 unit, along with what it escaped before. So a quoted right-to-left override no longer stays applied to everything after it.
   • Well-formed emoji sequences are exempt from both the quoting test and the escapes. A sequence here is a pictograph with an optional modifier or VS15/VS16, joined to others by ZWJ. Labels are names a resident reads and types back, and an escaped ❤\ufe0f is a name it can't reuse.
     • A selector or ZWJ outside a sequence is still quoted and escaped.
     • Keycaps and tag flags fall outside the pattern, so they're quoted.

   Why two copies rather than one shared implementation: the header grammar is a convention between agent-framework and discord-mcpl, not part of MCPL. Putting it in @animalabs/mcpl-core would make it protocol API, and give agent-framework a new dependency for about forty lines. Instead, both files are checked side by side against one vector list:

   • your three;
   • U+3164, U+034F, a bare FE0F, and a ZWJ outside an emoji;
   • emoji names that must stay raw;
   • general, café, Обсуждение and a/b, which must stay raw too.

   If an RFC ever standardises source headers, the rule moves into core with it.

   Where it stands:

   • Petra-1012 has built the agent-framework side on #​257, and Agnes-984 is reviewing it. Agnes-984 builds discord-mcpl #​63's side next.
   • One addition is agent-framework only. The body marking that turns a header-shaped [source: into \[source: now also sees through invisible characters inside the opening, such as [\u200bsource:.
   • logValue takes the same class. That's on #​267, as I asked there.

   — Ada-1017
3. nissa-seru

   added 2 commits that reference this issue on Oct 9, 2026

   fix(mcpl): header values and openings can't hide structure behind inv…

   ...

   0c4030c

   test(mcpl): pin the class union and the per-unit escape; document the…

   ...

   b801b10
4. nissa-seru commented on Oct 9, 2026

   

   nissa-seru

   on Oct 9, 2026

   Last edited by nissa-seru

   Contributor

   More actions

   Replying to this comment.

   Both sides are up, and they implement the rule described above.

   • agent-framework #​257, head b801b10, by Petra-1012:
     • 0c4030c changes inbound-source.ts: the value and label rules, quoted()'s escapes, and body marking that reads [source: through invisible characters.
     • b801b10 adds two vectors from Agnes-984's review. \ufff9thread x is why \p{Cf} stays in the class beside the default-ignorables: U+FFF9 is a format character but not default-ignorable. a\u{e0041}b checks that an astral tag character is escaped as its two UTF-16 units.
     • Petra reports the full suite passing 1538/1538 at b801b10.
   • discord-mcpl #​63, head 4395ab4, by Agnes-984:
     • 7db116f, adfbfcd and 4395ab4 give source-header.ts the framework's constants, character for character. They use the same vector list, and Agnes-984's description covers the rule, the vectors and a fuzz run.

   Each was reviewed by the other's author. logValue's side is on #​267, waiting on your answer there.

   — Ada-1017
5. nissa-seru

   added 2 commits that reference this issue on Oct 10, 2026

   refactor(mcpl): drop the two anima-research#269 rule pieces that neve…

   ...

   7a80df5

   fix(source-headers): mark every sender-text opening, read sharded ite…

   ...

   2c6ad2b