fix(thread-ownership): bound forwarder conflict handling

miorbnli · miorbnli · commit afa0f8fe32f6 · 2026-07-14T11:58:19.000+08:00
diff --git a/extensions/thread-ownership/api.ts b/extensions/thread-ownership/api.ts
@@ -1,6 +1,7 @@
 // Thread Ownership API module exposes the plugin public contract.
 export type { OpenClawConfig } from "openclaw/plugin-sdk/config-contracts";
 export { definePluginEntry, type OpenClawPluginApi } from "openclaw/plugin-sdk/plugin-entry";
+export { readProviderJsonResponse } from "openclaw/plugin-sdk/provider-http";
 export {
   fetchWithSsrFGuard,
   ssrfPolicyFromDangerouslyAllowPrivateNetwork,
diff --git a/extensions/thread-ownership/index.test.ts b/extensions/thread-ownership/index.test.ts
@@ -272,20 +272,39 @@ describe("thread-ownership plugin", () => {
       expect(infoMessage).toContain("cancelled send");
     });
 
-    it("cancels when the 409 conflict body is truncated or malformed", async () => {
-      // Simulates an over-cap or malformed 409 body: readResponseTextLimited
-      // stops at the cap, JSON.parse fails on the truncated text, but the 409
-      // status itself means another agent owns this thread — still cancel.
+    it("cancels when the forwarder conflict JSON is malformed", async () => {
+      vi.mocked(globalThis.fetch).mockResolvedValue(new Response("{", { status: 409 }));
+
+      const result = await sendSlackThreadMessage();
+
+      expect(result).toEqual({ cancel: true });
+      const warningMessage = requireFirstLogMessage(
+        api.logger.warn,
+        "ownership conflict warning log",
+      );
+      expect(warningMessage).toContain("conflict body unreadable");
+      expect(warningMessage).toContain("malformed JSON response");
+      const infoMessage = requireFirstLogMessage(api.logger.info, "ownership cancel info log");
+      expect(infoMessage).toContain("cancelled send");
+      expect(infoMessage).toContain("owned by unknown");
+    });
+
+    it("cancels when the forwarder conflict JSON exceeds the bounded read limit", async () => {
       vi.mocked(globalThis.fetch).mockResolvedValue(
-        new Response('{ "owner": "other-agent" ,', { status: 409 }),
+        new Response(JSON.stringify({ owner: "x".repeat(70 * 1024) }), { status: 409 }),
       );
 
       const result = await sendSlackThreadMessage();
 
       expect(result).toEqual({ cancel: true });
+      const warningMessage = requireFirstLogMessage(
+        api.logger.warn,
+        "ownership conflict warning log",
+      );
+      expect(warningMessage).toContain("conflict body unreadable");
+      expect(warningMessage).toContain("JSON response exceeds 65536 bytes");
       const infoMessage = requireFirstLogMessage(api.logger.info, "ownership cancel info log");
       expect(infoMessage).toContain("cancelled send");
-      // The owner field was unparseable, so the log falls back to "unknown".
       expect(infoMessage).toContain("owned by unknown");
     });
 
diff --git a/extensions/thread-ownership/index.ts b/extensions/thread-ownership/index.ts
@@ -1,18 +1,17 @@
 // Thread Ownership plugin entrypoint registers its OpenClaw integration.
 import { resolveLivePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
-import { readResponseTextLimited } from "openclaw/plugin-sdk/provider-http";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { escapeRegExp } from "openclaw/plugin-sdk/text-utility-runtime";
 import {
   definePluginEntry,
   fetchWithSsrFGuard,
+  readProviderJsonResponse,
   ssrfPolicyFromDangerouslyAllowPrivateNetwork,
   type OpenClawConfig,
   type OpenClawPluginApi,
 } from "./api.js";
 
-/** Bound a forwarder 409 body; a compromised forwarder must not OOM the agent. */
-const THREAD_OWNERSHIP_CONFLICT_BODY_LIMIT_BYTES = 8 * 1024;
+const THREAD_OWNERSHIP_CONFLICT_BODY_LIMIT_BYTES = 64 * 1024;
 
 type ThreadOwnershipConfig = {
   forwarderUrl?: string;
@@ -193,18 +192,24 @@ export default definePluginEntry({
             return undefined;
           }
           if (resp.status === 409) {
-            let owner: string | undefined;
+            let owner = "unknown";
             try {
-              const body = JSON.parse(
-                await readResponseTextLimited(resp, THREAD_OWNERSHIP_CONFLICT_BODY_LIMIT_BYTES),
-              ) as { owner?: string };
-              owner = body.owner;
-            } catch {
-              // Truncated or malformed 409 body; the 409 status itself means
-              // another agent owns this thread — still cancel.
+              const body = await readProviderJsonResponse<{ owner?: unknown }>(
+                resp,
+                "thread-ownership forwarder conflict",
+                { maxBytes: THREAD_OWNERSHIP_CONFLICT_BODY_LIMIT_BYTES },
+              );
+              if (typeof body.owner === "string" && body.owner) {
+                owner = body.owner;
+              }
+            } catch (error) {
+              // A 409 is authoritative even when its body is malformed or oversized.
+              api.logger.warn?.(
+                `thread-ownership: conflict body unreadable (${String(error)}), cancelling send`,
+              );
             }
             api.logger.info?.(
-              `thread-ownership: cancelled send to ${channelId}:${threadTs} — owned by ${owner ?? "unknown"}`,
+              `thread-ownership: cancelled send to ${channelId}:${threadTs} — owned by ${owner}`,
             );
             return { cancel: true };
           }
