fix(update): cancel npm registry error bodies

vincentkoc · vincentkoc · commit 86a28636fa80 · 2026-06-19T09:11:43.000+02:00
diff --git a/src/infra/update-check.test.ts b/src/infra/update-check.test.ts
@@ -219,6 +219,24 @@ describe("resolveNpmChannelTag", () => {
     );
   });
 
+  it("cancels public registry HTTP failure bodies", async () => {
+    const cancel = vi.fn(async () => undefined);
+    const fetch = vi.fn(
+      async () => ({ ok: false, status: 503, body: { cancel } }) as unknown as Response,
+    );
+    vi.stubGlobal("fetch", fetch);
+
+    await expect(
+      fetchNpmPackageTargetStatus({ target: "latest", timeoutMs: 1000 }),
+    ).resolves.toEqual({
+      target: "latest",
+      version: null,
+      nodeEngine: null,
+      error: "HTTP 503",
+    });
+    expect(cancel).toHaveBeenCalledTimes(1);
+  });
+
   it("falls back to latest when beta is older", async () => {
     versionByTag.beta = "1.0.0-beta.1";
     versionByTag.latest = "1.0.1-1";
diff --git a/src/infra/update-check.ts b/src/infra/update-check.ts
@@ -110,8 +110,9 @@ async function fetchPublicNpmPackageTargetStatus(params: {
   target: string;
   timeoutMs: number;
 }): Promise<NpmPackageTargetStatus> {
+  let res: Response | undefined;
   try {
-    const res = await fetchWithTimeout(
+    res = await fetchWithTimeout(
       `https://registry.npmjs.org/openclaw/${encodeURIComponent(params.target)}`,
       {},
       Math.max(250, params.timeoutMs),
@@ -135,6 +136,10 @@ async function fetchPublicNpmPackageTargetStatus(params: {
     };
   } catch (err) {
     return { target: params.target, version: null, nodeEngine: null, error: String(err) };
+  } finally {
+    if (res?.bodyUsed !== true) {
+      await res?.body?.cancel().catch(() => undefined);
+    }
   }
 }
 
