fix(feishu): pass timeoutMs through app-registration guarded fetch (#105549)

hugenshen · steipete · web-flow · commit ed16970fc617 · 2026-07-15T17:18:54.000-07:00
* fix(feishu): pass timeoutMs through app-registration guarded fetch

* refactor(feishu): keep registration timeout internal

* docs(changelog): credit Feishu timeout fix

---------

Co-authored-by: Peter Steinberger &lt;steipete@gmail.com&gt;
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -41,6 +41,7 @@ Docs: https://docs.openclaw.ai
 
 ### Fixes
 
+- **Feishu app registration deadlines:** bound OAuth device-registration requests to 10 seconds through the guarded fetch boundary so setup cannot hang indefinitely on stalled response headers. (#105549) Thanks @hugenshen.
 - **LINE control-command mentions:** detect authorized slash commands before mention stripping so inline group and direct-message controls preserve the original ingress metadata. (#107230) Thanks @edenfunf.
 - **Feishu document image reads:** bound remote document-image headers and stalled bodies with the selected account timeout, parse document Markdown through the plugin's MDAST pipeline, preserve image/block alignment, and reject failed upload input before creating empty image blocks. Thanks @Alix-007.
 - **ClawHub registry reads:** retry bounded HTTP 500 responses alongside other transient gateway failures so multi-package release scans survive isolated registry errors.
diff --git a/extensions/feishu/src/app-registration.test.ts b/extensions/feishu/src/app-registration.test.ts
@@ -254,6 +254,39 @@ describe("Feishu app registration", () => {
     expect(writeSpy).toHaveBeenCalledWith("terminal-qr\n");
   });
 
+  it("times out registration POSTs when accounts never return headers", async () => {
+    await withRegistrationServer(
+      // Accept TCP but never write headers — idle body timers never start.
+      (_req, _res) => {},
+      async (options) => {
+        const started = Date.now();
+        const outcome = await beginAppRegistration("feishu", {
+          ...options,
+          // Keep the real guarded-fetch path while shortening its production deadline.
+          timeoutMs: 80,
+        }).then(
+          (value) => ({ ok: true as const, value }),
+          (error: unknown) => ({ ok: false as const, error }),
+        );
+        const elapsedMs = Date.now() - started;
+        expect(outcome.ok).toBe(false);
+        if (!outcome.ok) {
+          expect(outcome.error).toMatchObject({
+            name: "TimeoutError",
+            message: "request timed out",
+          });
+        }
+        expect(elapsedMs).toBeGreaterThanOrEqual(60);
+        expect(elapsedMs).toBeLessThan(2_000);
+        console.log(
+          `[feishu fetchFeishuJson hang proof] timed_out=${!outcome.ok} name=${
+            outcome.ok ? "n/a" : (outcome.error as Error).name
+          } elapsed_ms=${elapsedMs}`,
+        );
+      },
+    );
+  });
+
   // over-cap: body > 16 MiB, no Content-Length. The bounded reader cancels
   // through the real SSRF guard and rejects before full buffering.
   it("rejects Feishu API responses that exceed the 16 MiB JSON body cap", async () => {
diff --git a/extensions/feishu/src/app-registration.ts b/extensions/feishu/src/app-registration.ts
@@ -22,7 +22,9 @@ const LARK_ACCOUNTS_URL = "https://accounts.larksuite.com";
 
 const REGISTRATION_PATH = "/oauth/v1/app/registration";
 
-const REQUEST_TIMEOUT_MS = 10_000;
+// QR onboarding should fall back promptly when an accounts endpoint stalls;
+// regular Feishu API requests use the longer FEISHU_HTTP_TIMEOUT_MS budget.
+const APP_REGISTRATION_REQUEST_TIMEOUT_MS = 10_000;
 const DEFAULT_REGISTRATION_POLL_INTERVAL_SECONDS = 5;
 const DEFAULT_REGISTRATION_EXPIRE_SECONDS = 600;
 
@@ -57,6 +59,8 @@ type FeishuAppRegistrationFetchOptions = {
   fetchImpl?: FeishuAppRegistrationFetch;
   /** Override hostname lookup for hermetic SSRF-guard tests. */
   lookupFn?: LookupFn;
+  /** Override the registration HTTP deadline for tests. */
+  timeoutMs?: number;
 };
 
 interface RawBeginResponse {
@@ -105,11 +109,11 @@ async function postRegistration<T>(
       method: "POST",
       headers: { "Content-Type": "application/x-www-form-urlencoded" },
       body: new URLSearchParams(body).toString(),
-      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
     },
     auditContext: "feishu.app-registration.post",
     fetchImpl: options?.fetchImpl,
     lookupFn: options?.lookupFn,
+    timeoutMs: options?.timeoutMs,
   });
 }
 
@@ -119,12 +123,15 @@ async function fetchFeishuJson<T>(params: {
   auditContext: string;
   fetchImpl?: FeishuAppRegistrationFetch;
   lookupFn?: LookupFn;
+  timeoutMs?: number;
 }): Promise<T> {
+  const timeoutMs = params.timeoutMs ?? APP_REGISTRATION_REQUEST_TIMEOUT_MS;
   const { response, release } = await fetchWithSsrFGuard({
     url: params.url,
     init: params.init,
     fetchImpl: params.fetchImpl,
     lookupFn: params.lookupFn,
+    timeoutMs,
     policy: { allowedHostnames: [new URL(params.url).hostname] },
     auditContext: params.auditContext,
   });
@@ -227,9 +234,7 @@ export async function pollAppRegistration(params: {
   let domainSwitched = false;
 
   const expireInMs =
-    finiteSecondsToTimerSafeMilliseconds(expireIn) ??
-    finiteSecondsToTimerSafeMilliseconds(DEFAULT_REGISTRATION_EXPIRE_SECONDS) ??
-    REQUEST_TIMEOUT_MS;
+    finiteSecondsToTimerSafeMilliseconds(expireIn) ?? DEFAULT_REGISTRATION_EXPIRE_SECONDS * 1_000;
   const deadline = Date.now() + expireInMs;
 
   while (Date.now() < deadline) {
@@ -342,7 +347,6 @@ export async function getAppOwnerOpenId(params: {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ app_id: params.appId, app_secret: params.appSecret }),
-        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
       },
       auditContext: "feishu.app-registration.owner-token",
       fetchImpl: params.fetchImpl,
@@ -369,7 +373,6 @@ export async function getAppOwnerOpenId(params: {
           Authorization: `Bearer ${tokenData.tenant_access_token}`,
           "Content-Type": "application/json",
         },
-        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
       },
       auditContext: "feishu.app-registration.owner-app",
       fetchImpl: params.fetchImpl,
@@ -394,7 +397,6 @@ export async function getAppOwnerOpenId(params: {
 function sleepRegistrationPollInterval(intervalSeconds: number): Promise<void> {
   const intervalMs =
     finiteSecondsToTimerSafeMilliseconds(intervalSeconds) ??
-    finiteSecondsToTimerSafeMilliseconds(DEFAULT_REGISTRATION_POLL_INTERVAL_SECONDS) ??
-    REQUEST_TIMEOUT_MS;
+    DEFAULT_REGISTRATION_POLL_INTERVAL_SECONDS * 1_000;
   return sleep(intervalMs);
 }
