fix(xdev): bound device summaries in UTF-8 bytes and flag untrusted metadata

Catalog summaries of mounted xd:// devices are inlined verbatim into the
system prompt. External devices (MCP servers, plugins) supply that text, and
it was bounded only by character count: a summary of multi-byte script passed
roughly three times the intended budget, and control characters survived into
the prompt where they can forge structure.

Summaries now go through a single sanitize-and-bound step that strips C0/C1
control characters and bounds the result in UTF-8 bytes via the central
truncateHeadBytes helper, so a cut lands on a code point boundary and never
renders a partial code point. The built-in/external distinction is derived
once per entry, and that same boolean both selects the description cap and is
exposed as `dynamic`, so the cap and the flag cannot disagree. The prompt uses
the flag to state that dynamic summaries are untrusted metadata, and the mount
notice says the same for newly appeared devices.

(cherry picked from commit 5989da6235d820bc687779a791e655e6f1b2df0f)

packages/coding-agent/test/write-xdev-dispatch.test.ts

@@ -19,6 +19,7 @@ import {
 	type XdevState,
 	xdevDocs,
 	xdevDocsAll,
+	xdevEntries,
 } from "@oh-my-pi/pi-coding-agent/tools/xdev";
 import { removeWithRetries } from "@oh-my-pi/pi-utils";
 import { type } from "arktype";
@@ -291,6 +292,60 @@ describe("read and write route xd:// device URLs", () => {
 		expect(lines.some(line => line.includes(backgroundPrefix))).toBe(true);
 	});
 
+	// Dynamic device summaries are third-party text inlined into the system
+	// prompt. A character bound is not a byte bound: a multi-byte summary passes
+	// several times the intended budget, and cutting a byte budget by character
+	// index splits code points.
+	it("bounds dynamic device summaries in UTF-8 bytes on a code point boundary", () => {
+		const multiByteTail = "あ".repeat(XDEV_EXTERNAL_DESCRIPTION_CAP);
+		const dynamicDevice: AgentTool = {
+			name: "mcp__weather__forecast",
+			label: "Forecast",
+			description: "Weather forecast for a place.",
+			summary: `Napoved\u0007vremena ${multiByteTail}`,
+			parameters: type({ query: "string" }),
+			async execute() {
+				return { content: [{ type: "text", text: "" }] };
+			},
+		};
+		const builtInDevice: AgentTool = {
+			name: "weather",
+			label: "Weather",
+			description: "Weather for a place.",
+			summary: `Gets the weather ${multiByteTail}`,
+			parameters: type({ query: "string" }),
+			async execute() {
+				return { content: [{ type: "text", text: "" }] };
+			},
+		};
+		const xdev = createTestXdevState([builtInDevice, dynamicDevice], ["weather"]);
+		const entries = new Map(xdevEntries(xdev).map(entry => [entry.name, entry]));
+
+		const dynamic = entries.get("mcp__weather__forecast");
+		if (!dynamic) throw new Error("expected the dynamic device entry");
+		expect(dynamic.dynamic).toBe(true);
+		// Control characters collapse to a space instead of reaching the prompt.
+		expect(dynamic.summary.startsWith("Napoved vremena ")).toBe(true);
+		expect(dynamic.summary.endsWith("…")).toBe(true);
+
+		const body = dynamic.summary.slice(0, -1);
+		const bodyBytes = Buffer.byteLength(body, "utf-8");
+		expect(bodyBytes).toBeLessThanOrEqual(XDEV_EXTERNAL_DESCRIPTION_CAP);
+		// The cut backs off at most one code point: the character straddling the
+		// budget is dropped whole rather than split.
+		expect(bodyBytes).toBeGreaterThan(XDEV_EXTERNAL_DESCRIPTION_CAP - 3);
+		expect(body.endsWith("あ")).toBe(true);
+		// A split code point would decode to U+FFFD and fail the round trip.
+		expect(Buffer.from(body, "utf-8").toString("utf-8")).toBe(body);
+
+		// The same boolean drives the cap and the flag, so a built-in device is
+		// never capped and never reported as untrusted.
+		const builtIn = entries.get("weather");
+		if (!builtIn) throw new Error("expected the built-in device entry");
+		expect(builtIn.dynamic).toBe(false);
+		expect(builtIn.summary).toBe(`Gets the weather ${multiByteTail}`);
+	});
+
 	it("docsAll inlines small device docs and falls back to a listing past the caps", async () => {
 		const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "write-xdev-docs-"));
 		try {