fix(thread-ownership): cap mention cache and bound forwarder JSON reads

NIO · cursoragent · NIO · commit 0cb28b437b54 · 2026-07-08T10:14:59.000+08:00
Co-authored-by: Cursor &lt;cursoragent@cursor.com&gt;
diff --git a/extensions/thread-ownership/index.test.ts b/extensions/thread-ownership/index.test.ts
@@ -1,7 +1,7 @@
 // Thread Ownership tests cover index plugin behavior.
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import type { OpenClawPluginApi } from "./api.js";
-import register from "./index.js";
+import register, { resetMentionedThreadsForTests } from "./index.js";
 
 describe("thread-ownership plugin", () => {
   const hooks: Record<string, Function> = {};
@@ -50,6 +50,7 @@ describe("thread-ownership plugin", () => {
 
   beforeEach(() => {
     vi.clearAllMocks();
+    resetMentionedThreadsForTests();
     for (const key of Object.keys(hooks)) {
       delete hooks[key];
     }
@@ -502,5 +503,43 @@ describe("thread-ownership plugin", () => {
 
       expect(globalThis.fetch).toHaveBeenCalled();
     });
+
+    it("evicts oldest mention cache entries once the cache exceeds its cap", async () => {
+      await hooks.message_received(
+        {
+          content: "hey @TestBot help",
+          threadId: "1111.0001",
+          metadata: { channelId: "C000" },
+        },
+        { channelId: "slack", conversationId: "C000" },
+      );
+
+      for (let i = 1; i <= 1000; i += 1) {
+        await hooks.message_received(
+          {
+            content: "hey @TestBot help",
+            threadId: `2222.${i.toString().padStart(4, "0")}`,
+            metadata: { channelId: `C${i.toString().padStart(3, "0")}` },
+          },
+          { channelId: "slack", conversationId: `C${i.toString().padStart(3, "0")}` },
+        );
+      }
+
+      vi.mocked(globalThis.fetch).mockResolvedValue(
+        new Response(JSON.stringify({ owner: "test-agent" }), { status: 200 }),
+      );
+
+      await hooks.message_sending(
+        {
+          content: "On it!",
+          replyToId: "1111.0001",
+          metadata: { channelId: "C000" },
+          to: "C000",
+        },
+        { channelId: "slack", conversationId: "C000" },
+      );
+
+      expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+    });
   });
 });
diff --git a/extensions/thread-ownership/index.ts b/extensions/thread-ownership/index.ts
@@ -1,5 +1,7 @@
 // Thread Ownership plugin entrypoint registers its OpenClaw integration.
+import { pruneMapToMaxSize } from "openclaw/plugin-sdk/collection-runtime";
 import { resolveLivePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
+import { readProviderJsonResponse } from "openclaw/plugin-sdk/provider-http";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { escapeRegExp } from "openclaw/plugin-sdk/text-utility-runtime";
 import {
@@ -22,6 +24,7 @@ type ThreadOwnershipMessageSendingResult = { cancel: true } | undefined;
 // Entries expire after 5 minutes.
 const mentionedThreads = new Map<string, number>();
 const MENTION_TTL_MS = 5 * 60 * 1000;
+const MENTIONED_THREADS_MAX_ENTRIES = 1000;
 
 function isThreadOwnershipConfig(value: unknown): value is ThreadOwnershipConfig {
   return value !== null && typeof value === "object";
@@ -51,6 +54,15 @@ function cleanExpiredMentions(): void {
   }
 }
 
+function trackMentionedThread(key: string): void {
+  cleanExpiredMentions();
+  if (mentionedThreads.has(key)) {
+    mentionedThreads.delete(key);
+  }
+  mentionedThreads.set(key, Date.now());
+  pruneMapToMaxSize(mentionedThreads, MENTIONED_THREADS_MAX_ENTRIES);
+}
+
 function containsAgentNameMention(text: string, agentName: string): boolean {
   const trimmedName = agentName.trim();
   if (!trimmedName) {
@@ -136,8 +148,7 @@ export default definePluginEntry({
         containsAgentNameMention(text, agent.name) ||
         (botUserId && text.includes(`<@${botUserId}>`));
       if (mentioned) {
-        cleanExpiredMentions();
-        mentionedThreads.set(`${channelId}:${threadTs}`, Date.now());
+        trackMentionedThread(`${channelId}:${threadTs}`);
       }
     });
 
@@ -189,7 +200,10 @@ export default definePluginEntry({
             return undefined;
           }
           if (resp.status === 409) {
-            const body = (await resp.json()) as { owner?: string };
+            const body = await readProviderJsonResponse<{ owner?: string }>(
+              resp,
+              "thread-ownership.ownership-conflict",
+            );
             api.logger.info?.(
               `thread-ownership: cancelled send to ${channelId}:${threadTs} — owned by ${body.owner}`,
             );
@@ -208,3 +222,7 @@ export default definePluginEntry({
     });
   },
 });
+
+export function resetMentionedThreadsForTests(): void {
+  mentionedThreads.clear();
+}
