fix(scripts): clamp secret proof timers

vincentkoc · vincentkoc · commit 0f64e3c05202 · 2026-06-22T04:38:45.000+02:00
diff --git a/scripts/e2e/secret-provider-integrations.mjs b/scripts/e2e/secret-provider-integrations.mjs
@@ -21,23 +21,24 @@ const MANUAL_EXEC_TOKEN = "proof-manual-exec-token";
 const PLUGIN_EXEC_TOKEN = "proof-plugin-exec-token";
 const OPENAI_PROFILE = "openai:secretref-proof";
 const OPENAI_LIVE_PROOF_MODEL = "openai/gpt-5.5";
-const COMMAND_TIMEOUT_MS = readPositiveInt(
+const MAX_SECRET_PROOF_TIMER_TIMEOUT_MS = 2_147_000_000;
+const COMMAND_TIMEOUT_MS = readPositiveTimerMs(
   process.env.OPENCLAW_SECRET_PROOF_COMMAND_MS,
   120000,
   "OPENCLAW_SECRET_PROOF_COMMAND_MS",
 );
 const COMMAND_TIMEOUT_KILL_GRACE_MS = 1000;
-const READY_TIMEOUT_MS = readPositiveInt(
+const READY_TIMEOUT_MS = readPositiveTimerMs(
   process.env.OPENCLAW_SECRET_PROOF_READY_MS,
   120000,
   "OPENCLAW_SECRET_PROOF_READY_MS",
 );
-const RPC_TIMEOUT_MS = readPositiveInt(
+const RPC_TIMEOUT_MS = readPositiveTimerMs(
   process.env.OPENCLAW_SECRET_PROOF_RPC_MS,
   15000,
   "OPENCLAW_SECRET_PROOF_RPC_MS",
 );
-const TEARDOWN_GRACE_MS = readPositiveInt(
+const TEARDOWN_GRACE_MS = readPositiveTimerMs(
   process.env.OPENCLAW_SECRET_PROOF_TEARDOWN_GRACE_MS,
   5000,
   "OPENCLAW_SECRET_PROOF_TEARDOWN_GRACE_MS",
@@ -101,6 +102,18 @@ function readPositiveInt(raw, fallback, label) {
   return parsed;
 }
 
+function clampSecretProofTimerTimeoutMs(valueMs) {
+  const value = Number.isFinite(valueMs) ? valueMs : 1;
+  return Math.min(
+    Math.max(1, Math.floor(value)),
+    MAX_SECRET_PROOF_TIMER_TIMEOUT_MS,
+  );
+}
+
+function readPositiveTimerMs(raw, fallback, label) {
+  return clampSecretProofTimerTimeoutMs(readPositiveInt(raw, fallback, label));
+}
+
 function remainingDeadlineMs(started, timeoutMs) {
   return Math.max(1, timeoutMs - (Date.now() - started));
 }
@@ -347,7 +360,7 @@ async function cleanupEnv(root, options = {}) {
 }
 
 function runCommand(command, args, options = {}) {
-  const timeoutMs = options.timeoutMs ?? COMMAND_TIMEOUT_MS;
+  const timeoutMs = clampSecretProofTimerTimeoutMs(options.timeoutMs ?? COMMAND_TIMEOUT_MS);
   return new Promise((resolve, reject) => {
     const usesProcessGroup = options.detached ?? process.platform !== "win32";
     const child = childProcess.spawn(command, args, {
@@ -1825,8 +1838,10 @@ async function runPtySecretsConfigurePreset(envCtx, options = {}) {
     let timedOut = false;
     let forceKillAt;
     let forceKillTimer;
-    const timeoutMs = options.timeoutMs ?? 60000;
-    const timeoutKillGraceMs = options.timeoutKillGraceMs ?? COMMAND_TIMEOUT_KILL_GRACE_MS;
+    const timeoutMs = clampSecretProofTimerTimeoutMs(options.timeoutMs ?? 60000);
+    const timeoutKillGraceMs = clampSecretProofTimerTimeoutMs(
+      options.timeoutKillGraceMs ?? COMMAND_TIMEOUT_KILL_GRACE_MS,
+    );
     const timer = setTimeout(() => {
       timedOut = true;
       signalPtyProcessTree(child, "SIGHUP");
@@ -2152,11 +2167,13 @@ async function main() {
 
 export {
   assertAllowedFailureCommandSucceeded,
+  clampSecretProofTimerTimeoutMs,
   collectBlockingProofResults,
   cleanupEnv,
   expectGatewayStartupFails,
   gatewayCall,
   parseJsonOutput,
+  readPositiveTimerMs,
   runPtySecretsConfigurePreset,
   runWithProof,
   runCommand,
diff --git a/test/scripts/secret-provider-integrations.test.ts b/test/scripts/secret-provider-integrations.test.ts
@@ -297,6 +297,30 @@ describe("secret provider integration proof harness", () => {
     }
   });
 
+  it("clamps oversized command timeout env values before scheduling timers", async () => {
+    const previousTimeout = process.env.OPENCLAW_SECRET_PROOF_COMMAND_MS;
+    process.env.OPENCLAW_SECRET_PROOF_COMMAND_MS = String(Number.MAX_SAFE_INTEGER);
+    try {
+      const proof = await import(
+        `${pathToFileURL(proofScriptPath).href}?case=command-timeout-clamp-${Date.now()}`
+      );
+
+      await expect(
+        proof.runCommand(process.execPath, [
+          "--input-type=module",
+          "--eval",
+          "setTimeout(() => process.exit(0), 25);",
+        ]),
+      ).resolves.toMatchObject({ code: 0 });
+    } finally {
+      if (previousTimeout === undefined) {
+        delete process.env.OPENCLAW_SECRET_PROOF_COMMAND_MS;
+      } else {
+        process.env.OPENCLAW_SECRET_PROOF_COMMAND_MS = previousTimeout;
+      }
+    }
+  });
+
   it("parses JSON command output without swallowing brace-heavy diagnostics", async () => {
     const proof = await import(`${pathToFileURL(proofScriptPath).href}?case=json-${Date.now()}`);
 
