fix(qa-lab): cap credential broker request timeouts · openclaw/openclaw@c8f5a2e

推荐订阅源

Cyberwarzone

Hacker News - Newest: "LLM"

The Exploit Database - CXSecurity.com

有赞技术团队

cs.CL updates on arXiv.org

GbyAI

Arctic Wolf

Simon Willison's Weblog

Cybersecurity and Infrastructure Security Agency CISA

Hacker News: Front Page

MyScale Blog

News and Events Feed by Topic

MIT News - Artificial intelligence

爱范儿

月光博客

IT之家

CERT Recently Published Vulnerability Notes

Threatpost

Last Week in AI

Cisco Blogs

Heimdal Security Blog

大猫的无限游戏

Webroot Blog

www.infosecurity-magazine.com

KPMG report finds enterprise disconnect between AI and its ROI | CIO

Attack and Defense Labs

量子位

Vulnerabilities – Threatpost

InfoQ

Proofpoint News Feed

Y Combinator Blog

Recent Commits to openclaw:main

fix(qa-lab): cap credential broker request timeouts · openclaw/openclaw@c8f5a2e

steipete · 2026-05-30 · via Recent Commits to openclaw:main

Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,4 @@`
	`1`	`+import { MAX_TIMER_TIMEOUT_MS } from "openclaw/plugin-sdk/number-runtime";`
`1`	`2`	`import { afterEach, describe, expect, it, vi } from "vitest";`
`2`	`3`	`import {`
`3`	`4`	`acquireQaCredentialLease,`
`@@ -320,6 +321,37 @@ describe("credential lease runtime", () => {`
`320`	`321`	`expect(fetchUrl(fetchImpl)).toBe("http://127.0.0.1:3210/qa-credentials/v1/acquire");`
`321`	`322`	`});`
`322`	`323`
	`324`	`+it("caps oversized convex HTTP timeouts before creating abort signals", async () => {`
	`325`	`+const timeoutController = new AbortController();`
	`326`	`+const timeoutSpy = vi.spyOn(AbortSignal, "timeout").mockReturnValue(timeoutController.signal);`
	`327`	`+const fetchImpl = vi.fn<typeof fetch>().mockResolvedValueOnce(`
	`328`	`+jsonResponse({`
	`329`	`+status: "ok",`
	`330`	`+credentialId: "cred-timeout",`
	`331`	`+leaseToken: "lease-timeout",`
	`332`	`+payload: { groupId: "-100123", driverToken: "driver", sutToken: "sut" },`
	`333`	`+}),`
	`334`	`+);`
	`335`	`+`
	`336`	`+await acquireQaCredentialLease({`
	`337`	`+kind: "telegram",`
	`338`	`+source: "convex",`
	`339`	`+role: "maintainer",`
	`340`	`+env: {`
	`341`	`+OPENCLAW_QA_CONVEX_SITE_URL: "https://qa-cred.example.convex.site",`
	`342`	`+OPENCLAW_QA_CONVEX_SECRET_MAINTAINER: "maintainer-secret",`
	`343`	`+OPENCLAW_QA_CREDENTIAL_HTTP_TIMEOUT_MS: String(Number.MAX_SAFE_INTEGER),`
	`344`	`+},`
	`345`	`+ fetchImpl,`
	`346`	`+resolveEnvPayload: () => ({ groupId: "-1", driverToken: "unused", sutToken: "unused" }),`
	`347`	`+parsePayload: (payload) =>`
	`348`	`+payload as { groupId: string; driverToken: string; sutToken: string },`
	`349`	`+});`
	`350`	`+`
	`351`	`+expect(timeoutSpy).toHaveBeenCalledWith(MAX_TIMER_TIMEOUT_MS);`
	`352`	`+expect(fetchInit(fetchImpl).signal).toBe(timeoutController.signal);`
	`353`	`+});`
	`354`	`+`
`323`	`355`	`it("rejects unsafe endpoint prefix overrides", async () => {`
`324`	`356`	`await expect(`
`325`	`357`	`acquireQaCredentialLease({`

Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,6 @@`
`1`	`1`	`import { randomUUID } from "node:crypto";`
`2`	`2`	`import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";`
	`3`	`+import { resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";`
`3`	`4`	`import { z } from "zod";`
`4`	`5`	`import {`
`5`	`6`	`isQaCredentialTruthyOptIn,`
`@@ -258,14 +259,15 @@ async function postConvexBroker(params: {`
`258`	`259`	`timeoutMs: number;`
`259`	`260`	`url: string;`
`260`	`261`	`}): Promise<unknown> {`
	`262`	`+const timeoutMs = resolveTimerTimeoutMs(params.timeoutMs, DEFAULT_HTTP_TIMEOUT_MS);`
`261`	`263`	`const response = await params.fetchImpl(params.url, {`
`262`	`264`	`method: "POST",`
`263`	`265`	`headers: {`
`264`	`266`	authorization: `Bearer ${params.authToken}`,
`265`	`267`	`"content-type": "application/json",`
`266`	`268`	`},`
`267`	`269`	`body: JSON.stringify(params.body),`
`268`		`-signal: AbortSignal.timeout(params.timeoutMs),`
	`270`	`+signal: AbortSignal.timeout(timeoutMs),`
`269`	`271`	`});`
`270`	`272`
`271`	`273`	`const text = await response.text();`

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,5 @@`
`1`	`1`	`import type { OpenClawConfig } from "openclaw/plugin-sdk/config-contracts";`
	`2`	`+import { MAX_TIMER_TIMEOUT_MS } from "openclaw/plugin-sdk/number-runtime";`
`2`	`3`	`import { afterEach, describe, expect, it, vi } from "vitest";`
`3`	`4`	`import {`
`4`	`5`	`LIVE_TRANSPORT_BASELINE_STANDARD_SCENARIO_IDS,`
`@@ -7,13 +8,20 @@ import {`
`7`	`8`	`import { testing } from "./telegram-live.runtime.js";`
`8`	`9`
`9`	`10`	`const fetchWithSsrFGuardMock = vi.hoisted(() =>`
`10`		`-vi.fn(async (params: { url: string; init?: RequestInit; signal?: AbortSignal }) => ({`
`11`		`-response: await fetch(params.url, {`
`12`		`- ...params.init,`
`13`		`-signal: params.signal,`
	`11`	`+vi.fn(`
	`12`	`+async (params: {`
	`13`	`+url: string;`
	`14`	`+init?: RequestInit;`
	`15`	`+signal?: AbortSignal;`
	`16`	`+timeoutMs?: number;`
	`17`	`+}) => ({`
	`18`	`+response: await fetch(params.url, {`
	`19`	`+ ...params.init,`
	`20`	`+signal: params.signal ?? AbortSignal.timeout(params.timeoutMs ?? 0),`
	`21`	`+}),`
	`22`	`+release: async () => {},`
`14`	`23`	`}),`
`15`		`-release: async () => {},`
`16`		`-})),`
	`24`	`+),`
`17`	`25`	`);`
`18`	`26`
`19`	`27`	`vi.mock("openclaw/plugin-sdk/ssrf-runtime", async () => {`
`@@ -904,6 +912,34 @@ describe("telegram live qa runtime", () => {`
`904`	`912`	`expect(signal?.aborted).toBe(true);`
`905`	`913`	`});`
`906`	`914`
	`915`	`+it("caps oversized Telegram API request deadlines", async () => {`
	`916`	`+const controller = new AbortController();`
	`917`	`+const timeoutSpy = vi.spyOn(AbortSignal, "timeout").mockReturnValue(controller.signal);`
	`918`	`+vi.stubGlobal(`
	`919`	`+"fetch",`
	`920`	`+vi.fn(`
	`921`	`+async () =>`
	`922`	`+new Response(JSON.stringify({ ok: true, result: { id: 42 } }), {`
	`923`	`+status: 200,`
	`924`	`+headers: {`
	`925`	`+"content-type": "application/json",`
	`926`	`+},`
	`927`	`+}),`
	`928`	`+),`
	`929`	`+);`
	`930`	`+`
	`931`	`+await expect(`
	`932`	`+testing.callTelegramApi("token", "getMe", undefined, Number.MAX_SAFE_INTEGER),`
	`933`	`+).resolves.toEqual({`
	`934`	`+id: 42,`
	`935`	`+});`
	`936`	`+`
	`937`	`+expect(timeoutSpy).toHaveBeenCalledWith(MAX_TIMER_TIMEOUT_MS);`
	`938`	`+expect(fetchWithSsrFGuardMock.mock.calls.at(-1)?.[0]).toMatchObject({`
	`939`	`+timeoutMs: MAX_TIMER_TIMEOUT_MS,`
	`940`	`+});`
	`941`	`+});`
	`942`	`+`
`907`	`943`	`it("treats transient Telegram getUpdates network errors as recoverable", () => {`
`908`	`944`	`expect(testing.isRecoverableTelegramQaPollError(new TypeError("fetch failed"))).toBe(true);`
`909`	`945`	`expect(testing.isRecoverableTelegramQaPollError(new Error("socket hang up"))).toBe(true);`
`@@ -912,6 +948,7 @@ describe("telegram live qa runtime", () => {`
`912`	`948`	`new Error("The operation was aborted due to timeout"),`
`913`	`949`	`),`
`914`	`950`	`).toBe(true);`
	`951`	`+expect(testing.isRecoverableTelegramQaPollError(new Error("request timed out"))).toBe(true);`
`915`	`952`	`expect(testing.isRecoverableTelegramQaPollError(new Error("AbortError"))).toBe(true);`
`916`	`953`	`expect(testing.isRecoverableTelegramQaPollError(new Error("Bad Request: chat not found"))).toBe(`
`917`	`954`	`false,`

Original file line number	Diff line number	Diff line change
`@@ -5,7 +5,10 @@ import path from "node:path";`
`5`	`5`	`import { promisify } from "node:util";`
`6`	`6`	`import type { OpenClawConfig } from "openclaw/plugin-sdk/config-contracts";`
`7`	`7`	`import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";`
`8`		`-import { parseStrictPositiveInteger } from "openclaw/plugin-sdk/number-runtime";`
	`8`	`+import {`
	`9`	`+parseStrictPositiveInteger,`
	`10`	`+resolveTimerTimeoutMs,`
	`11`	`+} from "openclaw/plugin-sdk/number-runtime";`
`9`	`12`	`import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";`
`10`	`13`	`import { isRecord, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";`
`11`	`14`	`import { resolvePreferredOpenClawTmpDir } from "openclaw/plugin-sdk/temp-path";`
`@@ -773,6 +776,7 @@ async function callTelegramApi<T>(`
`773`	`776`	`body?: Record<string, unknown>,`
`774`	`777`	`timeoutMs = 15_000,`
`775`	`778`	`): Promise<T> {`
	`779`	`+const requestTimeoutMs = resolveTimerTimeoutMs(timeoutMs, 15_000);`
`776`	`780`	`const { response, release } = await fetchWithSsrFGuard({`
`777`	`781`	url: `https://api.telegram.org/bot${token}/${method}`,
`778`	`782`	`init: {`
`@@ -782,7 +786,7 @@ async function callTelegramApi<T>(`
`782`	`786`	`},`
`783`	`787`	`body: JSON.stringify(body ?? {}),`
`784`	`788`	`},`
`785`		`-signal: AbortSignal.timeout(timeoutMs),`
	`789`	`+timeoutMs: requestTimeoutMs,`
`786`	`790`	`policy: { hostnameAllowlist: ["api.telegram.org"] },`
`787`	`791`	`auditContext: "qa-lab-telegram-live",`
`788`	`792`	`});`
`@@ -805,6 +809,7 @@ function isRecoverableTelegramQaPollError(error: unknown): boolean {`
`805`	`809`	`message.includes("fetch failed") \|\|`
`806`	`810`	`message.includes("aborted due to timeout") \|\|`
`807`	`811`	`message.includes("operation was aborted") \|\|`
	`812`	`+message.includes("request timed out") \|\|`
`808`	`813`	`message.includes("aborterror") \|\|`
`809`	`814`	`message.includes("econnreset") \|\|`
`810`	`815`	`message.includes("etimedout") \|\|`

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,5 @@`
`1`		`-import { describe, expect, it, vi } from "vitest";`
	`1`	`+import { MAX_TIMER_TIMEOUT_MS } from "openclaw/plugin-sdk/number-runtime";`
	`2`	`+import { afterEach, describe, expect, it, vi } from "vitest";`
`2`	`3`	`import {`
`3`	`4`	`addQaCredentialSet,`
`4`	`5`	`diagnoseQaCredentialBroker,`
`@@ -52,6 +53,10 @@ async function expectQaCredentialAdminError(promise: Promise<unknown>, code: str`
`52`	`53`	`}`
`53`	`54`
`54`	`55`	`describe("qa credential admin runtime", () => {`
	`56`	`+afterEach(() => {`
	`57`	`+vi.restoreAllMocks();`
	`58`	`+});`
	`59`	`+`
`55`	`60`	`it("adds a credential set through the admin endpoint", async () => {`
`56`	`61`	`const fetchImpl = vi.fn(async (_input: RequestInfo \| URL, _init?: RequestInit) =>`
`57`	`62`	`jsonResponse({`
`@@ -151,6 +156,30 @@ describe("qa credential admin runtime", () => {`
`151`	`156`	`);`
`152`	`157`	`});`
`153`	`158`
	`159`	`+it("caps oversized admin HTTP timeouts before creating abort signals", async () => {`
	`160`	`+const timeoutController = new AbortController();`
	`161`	`+const timeoutSpy = vi.spyOn(AbortSignal, "timeout").mockReturnValue(timeoutController.signal);`
	`162`	`+const fetchImpl = vi.fn(async (_input: RequestInfo \| URL, _init?: RequestInit) =>`
	`163`	`+jsonResponse({`
	`164`	`+status: "ok",`
	`165`	`+count: 0,`
	`166`	`+credentials: [],`
	`167`	`+}),`
	`168`	`+);`
	`169`	`+`
	`170`	`+await listQaCredentialSets({`
	`171`	`+siteUrl: "https://first-schnauzer-821.convex.site",`
	`172`	`+env: {`
	`173`	`+OPENCLAW_QA_CONVEX_SECRET_MAINTAINER: "maint-secret",`
	`174`	`+OPENCLAW_QA_CREDENTIAL_HTTP_TIMEOUT_MS: String(Number.MAX_SAFE_INTEGER),`
	`175`	`+},`
	`176`	`+ fetchImpl,`
	`177`	`+});`
	`178`	`+`
	`179`	`+expect(timeoutSpy).toHaveBeenCalledWith(MAX_TIMER_TIMEOUT_MS);`
	`180`	`+expect(requireFirstFetchInit(fetchImpl).signal).toBe(timeoutController.signal);`
	`181`	`+});`
	`182`	`+`
`154`	`183`	`it("rejects unsafe endpoint-prefix overrides", async () => {`
`155`	`184`	`await expectQaCredentialAdminError(`
`156`	`185`	`listQaCredentialSets({`

Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,6 @@`
`1`	`1`	`import { randomUUID } from "node:crypto";`
`2`	`2`	`import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";`
	`3`	`+import { resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";`
`3`	`4`	`import { z } from "zod";`
`4`	`5`	`import {`
`5`	`6`	`joinQaCredentialEndpoint,`
`@@ -371,6 +372,7 @@ async function postJson<T>(params: {`
`371`	`372`	`responseSchema: z.ZodType<T>;`
`372`	`373`	`url: string;`
`373`	`374`	`}) {`
	`375`	`+const httpTimeoutMs = resolveTimerTimeoutMs(params.httpTimeoutMs, DEFAULT_HTTP_TIMEOUT_MS);`
`374`	`376`	`let response: Response;`
`375`	`377`	`try {`
`376`	`378`	`response = await params.fetchImpl(params.url, {`
`@@ -380,7 +382,7 @@ async function postJson<T>(params: {`
`380`	`382`	`"content-type": "application/json",`
`381`	`383`	`},`
`382`	`384`	`body: JSON.stringify(params.body),`
`383`		`-signal: AbortSignal.timeout(params.httpTimeoutMs),`
	`385`	`+signal: AbortSignal.timeout(httpTimeoutMs),`
`384`	`386`	`});`
`385`	`387`	`} catch (error) {`
`386`	`388`	`throw new QaCredentialAdminError({`

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。原文来自 — 版权归原作者所有。