fix(chutes-oauth): bound core helper JSON response reads at 16 MiB

wangmiao0668000666 · wangmiao0668000666 · commit f6c85df3a5ec · 2026-06-26T01:05:33.000+08:00
Replace 3 unbounded (await response.json()) calls in the deprecated core
chutes-oauth helper with readProviderJsonResponse (16 MiB cap). Sites:
fetchChutesUserInfo (userinfo), exchangeChutesCodeForTokens (token
exchange), refreshChutesTokens (token refresh).

Reuses the existing SDK helper already used by 15+ other providers.
diff --git a/src/agents/chutes-oauth.ts b/src/agents/chutes-oauth.ts
@@ -6,6 +6,7 @@ import { createHash, randomBytes } from "node:crypto";
 import { normalizeOptionalString } from "@openclaw/normalization-core/string-coerce";
 import { resolveExpiresAtMsFromDurationSeconds } from "../infra/parse-finite-number.js";
 import type { OAuthCredentials } from "../llm/oauth.js";
+import { readProviderJsonResponse } from "./provider-http-errors.js";
 
 const CHUTES_OAUTH_ISSUER = "https://api.chutes.ai";
 export const CHUTES_AUTHORIZE_ENDPOINT = `${CHUTES_OAUTH_ISSUER}/idp/authorize`;
@@ -115,7 +116,7 @@ async function fetchChutesUserInfo(params: {
     await cancelUnreadResponseBody(response);
     return null;
   }
-  const data = (await response.json()) as unknown;
+  const data = await readProviderJsonResponse<unknown>(response, "Chutes userinfo");
   if (!data || typeof data !== "object") {
     return null;
   }
@@ -155,11 +156,11 @@ export async function exchangeChutesCodeForTokens(params: {
     throw new Error(`Chutes token exchange failed: ${text}`);
   }
 
-  const data = (await response.json()) as {
+  const data = await readProviderJsonResponse<{
     access_token?: string;
     refresh_token?: string;
     expires_in?: number;
-  };
+  }>(response, "Chutes token exchange");
 
   const access = data.access_token?.trim();
   const refresh = data.refresh_token?.trim();
@@ -226,11 +227,11 @@ export async function refreshChutesTokens(params: {
     throw new Error(`Chutes token refresh failed: ${text}`);
   }
 
-  const data = (await response.json()) as {
+  const data = await readProviderJsonResponse<{
     access_token?: string;
     refresh_token?: string;
     expires_in?: number;
-  };
+  }>(response, "Chutes token refresh");
   const access = data.access_token?.trim();
   const newRefresh = data.refresh_token?.trim();
   const expires = resolveChutesExpiresAt(data.expires_in, now);
