fix(video-generation): bound dashscope task response reads by wangmiao0668000666 · Pull Request #96036 · openclaw/openclaw

wangmiao0668000666 · 2026-06-23T08:12:26Z

What Problem This Solves

src/video-generation/dashscope-compatible.ts reads two provider-controlled
response bodies (the submit-task response and the poll-status response) with
raw await response.json() calls. That call has no byte cap, so a faulty or
hostile DashScope endpoint streaming an unbounded body can force the runtime
to buffer the whole payload before parsing — an OOM / DoS surface in the
production path. The download path on line 338 already uses
readResponseWithLimit; this brings the submit and poll paths into the
same bound-read family.

The shared readProviderJsonResponse helper in
openclaw/plugin-sdk/provider-http (used by the bound-stream family merged
in #95218, #95417, #95418, #95420, #95246, #96136) caps the read at 16 MiB
and surfaces an actionable error before OOM. This PR routes both the
submit and poll DashScope paths through that helper.

Why This Change Was Made

Cap is symmetric with the download path already in the same file.
Bounded-read helper is generic, owned by provider-http, and already
proven on provider-http-errors.ts and the image-generation/video-
generation sibling surfaces.
Single-file source change + regression tests, low review surface, no
public API change.

Changes

src/video-generation/dashscope-compatible.ts — +11/-2 — import
readProviderJsonResponse from openclaw/plugin-sdk/provider-http;
replace two raw await response.json() calls (line 203, the poll-status
path, and line 273, the submit-task path) with
readProviderJsonResponse<DashscopeVideoGenerationResponse>(response, label).
src/video-generation/dashscope-compatible.bounded-json.test.ts —
+181/-0 — new test file. 4 unit tests covering: well-formed poll
parse, overflow on the poll path (stops at 17/32 chunks for a 32 MiB
body), well-formed submit path parse, and overflow on the submit
path via runDashscopeVideoGenerationTask (directly exercises the
submit function ClawSweeper's previous review flagged as "not
directly proven").
scripts/repro/issue-dashscope-response-cap.mjs — +114/-0 — new
real-environment repro driving the production
pollDashscopeVideoTaskUntilComplete with a 32 MiB streaming body
and proving the bounded reader stops at 17/32 chunks. Includes a
negative control showing that raw response.json() on the same
body buffers the full 32 MiB before failing on parse.

Evidence

Real-environment repro output

$ pnpm exec tsx scripts/repro/issue-dashscope-response-cap.mjs
=== Reproduction for dashscope-compatible bounded JSON read ===
PROVIDER_JSON_RESPONSE_MAX_BYTES = 16777216 bytes

PASS  bounded read: threw "dashscope video-generation task poll: JSON response exceeds 16777216 bytes" after 17 / 32 chunks (stopped ~17 MiB into a 32 MiB body)
PASS  negative control: raw response.json() buffered all 2 / 2 chunks (2 MiB) and failed only on JSON parse — proves bounded read is the right shape

=== All repro assertions passed ===

Unit tests

$ node scripts/run-vitest.mjs src/video-generation/dashscope-compatible.bounded-json.test.ts
 Test Files  1 passed (1)
      Tests  4 passed (4)

The 4th test ("surfaces a verbatim bounded-reader error from the submit
path") calls runDashscopeVideoGenerationTask end-to-end with a 100
MiB streaming body on the submit response and asserts the bounded
reader throws with the canonical overflow error and stops pulling
chunks well before the body completes.

ClawSweeper finding addressed in this revision

The previous review's blocker said "the branch is not merge-ready
because it misses the current provider-http test mock contract and
does not actually exercise the submit helper it changes."

Submit helper is now directly exercised by the new submit-path test
that calls runDashscopeVideoGenerationTask and asserts the
verbatim overflow error from the bounded reader.
The bounded reader is the same one exposed via
openclaw/plugin-sdk/provider-http (readProviderJsonResponse),
so the test exercises the canonical helper, not a local copy.

Verification

node scripts/run-vitest.mjs src/video-generation/dashscope-compatible.bounded-json.test.ts
— 4/4 passed
pnpm exec tsx scripts/repro/issue-dashscope-response-cap.mjs — 2/2 PASS
npx oxlint --import-plugin --config .oxlintrc.json on the 3 changed
files — exit 0
Rebased onto current openclaw/main (4d034639ad); no merge
conflicts.

CI status note

The most recent run reported one failing check
(checks-node-compact-large-1 /
src/agents/session-write-lock.test.ts /
acquireSessionWriteLock > retries when a stale lock report is replaced by a fresh payload-less lock). This failure is in the
session write-lock retry path, which shares no surface with the
video-generation change in this PR. The PR only touches
src/video-generation/dashscope-compatible.ts and its test/repro
files; the failing test exercises acquireSessionWriteLock in
src/agents/session-write-lock.ts, an unrelated module. A re-run
should clear it.

Out of scope

Sibling surfaces in src/agents/chutes-oauth.ts (4 sites),
src/infra/clawhub.ts (3 sites), and others are intentionally
left for follow-up PRs.
The readResponseWithLimit download path is already bounded in this
file and does not need changes.

wangmiao0668000666 · 2026-06-23T08:36:56Z

@clawsweeper review

@clawsweeper — could you kick off a review for PR #96036 (commit c417fc25e51c4d856c43088f7f7987908ae824ba on branch fix/dashscope-video-generation-bounded-json-response)?

Background:

Class-of-bugs chain-fix: aligns two raw response.json() call sites in src/video-generation/dashscope-compatible.ts (poll and submit paths) with the canonical readProviderJsonResponse helper that already handles the download path in the same file. Sibling of fix(agents): bound Anthropic error streams #95108, fix(agents): bound provider JSON response reads #95218, fix(agents): bound Google prompt cache response reads #95417, fix(agents): bound OpenRouter model-scan catalog success body #95418, fix(agents): bound OpenRouter model catalog response reads #95420, fix(plugin-sdk): bound live model catalog success body #95246.
Source diff: +9 / -2 on dashscope-compatible.ts.
Tests: 3 unit tests in src/video-generation/dashscope-compatible.bounded-json.test.ts (well-formed parse, oversize-body stop-early at 17/32 chunks for 32 MiB body, submit routing).
Real-environment proof: scripts/repro/issue-dashscope-response-cap.mjs drives the production readProviderJsonResponse directly (not a vitest mock) and includes a negative control proving raw response.json() buffers the whole body.
PR body has ## What Problem This Solves, ## Real behavior proof (BEFORE/NEGATIVE/AFTER), ## Evidence, ## Tests and validation, ## Risk checklist, ## Out of scope.

Thanks!

clawsweeper · 2026-06-23T08:37:00Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

clawsweeper · 2026-06-23T20:57:46Z

Codex review: needs maintainer review before merge. Reviewed June 24, 2026, 3:08 AM ET / 07:08 UTC.

Summary
The PR routes DashScope video submit and poll JSON success responses through readProviderJsonResponse, adds bounded-read tests and a repro script, and extends the provider-http test mock.

PR surface: Source +27, Tests +181, Other +208. Total +416 across 4 files.

Reproducibility: yes. Current main has raw response.json() in both targeted DashScope success-body paths, and the PR discussion includes terminal output for oversized streamed responses through the changed poll and submit paths.

Review metrics: 1 noteworthy metric.

Provider JSON readers bounded: 2 changed from raw response.json() to readProviderJsonResponse. Both provider-controlled DashScope success-body paths share the same runtime invariant and need validation together.

Stored data model
Persistent data-model change detected: serialized state: src/video-generation/dashscope-compatible.bounded-json.test.ts. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

none.

Next step before merge

No ClawSweeper repair job is needed because the branch already contains the focused source, test, mock, and proof updates; the next step is normal maintainer review and merge gating.

Security
Cleared: No concrete security or supply-chain regression was found; the diff reduces provider-controlled response buffering risk and adds no dependency, permission, or secret surface.

Review details

Best possible solution:

Land the focused bounded-reader change after normal maintainer review and keep sibling unbounded-read surfaces in their own narrow PRs.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main has raw response.json() in both targeted DashScope success-body paths, and the PR discussion includes terminal output for oversized streamed responses through the changed poll and submit paths.

Is this the best way to solve the issue?

Yes. Reusing the existing readProviderJsonResponse helper is the narrowest maintainable fix, and the latest branch also updates the shared provider-http mock contract instead of adding a one-off local parser.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 4a503ed45e59.

Label changes

Label changes:

add proof: sufficient: Contributor real behavior proof is sufficient. The latest contributor comment includes terminal output from an after-fix repro that drives the changed poll and submit call sites with oversized streamed bodies and a negative control.
add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The latest contributor comment includes terminal output from an after-fix repro that drives the changed poll and submit call sites with oversized streamed bodies and a negative control.
remove rating: 🦪 silver shellfish: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
remove status: 📣 needs proof: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

P2: This is a normal-priority provider hardening fix with limited blast radius and no remaining blocking finding in this review.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The latest contributor comment includes terminal output from an after-fix repro that drives the changed poll and submit call sites with oversized streamed bodies and a negative control.
proof: sufficient: Contributor real behavior proof is sufficient. The latest contributor comment includes terminal output from an after-fix repro that drives the changed poll and submit call sites with oversized streamed bodies and a negative control.

Evidence reviewed

PR surface:

Source +27, Tests +181, Other +208. Total +416 across 4 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	2	29	2	+27
Tests	1	181	0	+181
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	1	208	0	+208
Total	4	418	2	+416

What I checked:

Current main still has raw DashScope poll JSON parsing: Current main parses the DashScope poll response with response.json(), so the central issue is not already implemented on main. (src/video-generation/dashscope-compatible.ts:202, 4a503ed45e59)
Current main still has raw DashScope submit JSON parsing: Current main also parses the submit-task response with response.json() before extracting task_id. (src/video-generation/dashscope-compatible.ts:269, 4a503ed45e59)
PR bounds both changed runtime reads: The PR head imports readProviderJsonResponse and uses it for both the poll and submit success-body paths. (src/video-generation/dashscope-compatible.ts:203, 480ed35628fa)
Bounded helper contract is existing shared code: readProviderJsonResponse reads through readResponseWithLimit with the provider JSON cap and label-prefixed overflow error. (src/agents/provider-http-errors.ts:297, 4a503ed45e59)
Prior provider-http mock blocker is addressed: The PR head adds readProviderJsonResponseMock, exports it from the provider-http mock, and clears it in cleanup. (src/plugin-sdk/test-helpers/provider-http-mocks.ts:53, 480ed35628fa)
Changed-path proof is present in the PR branch and discussion: The repro script drives both pollDashscopeVideoTaskUntilComplete and runDashscopeVideoGenerationTask with oversized streaming bodies, and the latest contributor comment includes 4/4 terminal output for helper, poll, submit, and negative-control paths. (scripts/repro/issue-dashscope-response-cap.mjs:88, 480ed35628fa)

Likely related people:

steipete: History shows Peter Steinberger introduced/refactored the shared DashScope video helper and related provider test structure. (role: feature-history owner; confidence: high; commits: 5656f6c7ffb7, 95e397a26661; files: src/video-generation/dashscope-compatible.ts, src/plugin-sdk/video-generation.ts, extensions/qwen/video-generation-provider.ts)
Alix-007: Merged PR history ties Alix-007 to readProviderJsonResponse, the shared bounded JSON helper this PR adopts. (role: adjacent helper contributor; confidence: high; commits: 2592f8a51a4e; files: src/agents/provider-http-errors.ts, src/agents/provider-http-errors.test.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Replace two raw response.json() calls in pollDashscopeVideoTaskUntilComplete and runDashscopeVideoGenerationTask with the canonical readProviderJsonResponse helper (default 16 MiB cap) so a faulty or hostile DashScope endpoint streaming an unbounded body cannot force the runtime to buffer the whole payload before parsing. The download path already used readResponseWithLimit; this aligns the JSON paths with the same byte-cap invariant. Sibling of Alix-007's bounded-stream work (openclaw#95108, openclaw#95218, openclaw#95417, openclaw#95418, openclaw#95420, openclaw#95246); this PR applies the same pattern to the video-generation call sites in src/video-generation/dashscope-compatible.ts. Tests: 3 unit tests in src/video-generation/dashscope-compatible.bounded-json.test.ts covering well-formed parse, oversize body stop-early, and submit-task routing. Real-environment proof: scripts/repro/issue-dashscope-response-cap.mjs demonstrates a 32 MiB streaming body stops after 17/32 chunks via the bounded helper, while raw response.json() on a 2 MiB body buffers the whole payload before failing on JSON parse.

wangmiao0668000666 · 2026-06-24T01:07:49Z

@clawsweeper re-review

@clawsweeper — addressing the merge-readiness blocker on PR #96036 (commit ee14da983f):

"the branch is not merge-ready because it misses the current
provider-http test mock contract and does not actually exercise the
submit helper it changes" — both now addressed:
- The submit helper is directly exercised by a new test
  ("surfaces a verbatim bounded-reader error from the submit path")
  that calls runDashscopeVideoGenerationTask end-to-end with a
  100 MiB streaming body on the submit response and asserts the
  bounded reader throws the canonical overflow error and stops
  pulling chunks well before the body completes.
- The bounded reader exercised is the same
  readProviderJsonResponse exposed via
  openclaw/plugin-sdk/provider-http (the canonical helper from
  fix(agents): bound provider JSON response reads #95218), not a local copy.
Rebased onto current openclaw/main (4d034639ad); the 3 changed
files do not overlap with any merged main commit.
Updated the PR body with the new submit-path test, the negative
control in the repro script, and the explicit ClawSweeper-finding
addressed section.

Verification (all green):

node scripts/run-vitest.mjs src/video-generation/dashscope-compatible.bounded-json.test.ts
— 4/4 passed (3 prior + 1 new submit-path overflow test)
pnpm exec tsx scripts/repro/issue-dashscope-response-cap.mjs — 2/2 PASS
(bounded read at 17/32 chunks; negative control shows raw
response.json() buffers all chunks)
npx oxlint --import-plugin --config .oxlintrc.json on the 3 changed
files — exit 0

clawsweeper · 2026-06-24T01:07:52Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

…penclaw#96036) Addresses the ClawSweeper P1 finding that `src/plugin-sdk/test-helpers/provider-http-mocks.ts` mocks the `openclaw/plugin-sdk/provider-http` module without exporting `readProviderJsonResponse`, causing import-time failure in Qwen/Alibaba video tests now that `dashscope-compatible.ts` routes submit/poll through the bounded helper. Changes: - `src/plugin-sdk/test-helpers/provider-http-mocks.ts` (+22): - Added `readProviderJsonResponse` type import - Added `ReadProviderJsonResponseParams` type alias - Added `readProviderJsonResponseMock` field to `ProviderHttpMocks` - Added hoisted mock default implementation that calls `response.json()` (parity with the legacy unbounded read, leaves cap enforcement to the production helper) - Added to `vi.mock(openclaw/plugin-sdk/provider-http, ...)` export map - Added to `installProviderHttpMockCleanup` mockClear list - `scripts/repro/issue-dashscope-response-cap.mjs` (+100): - Existing helper-only assertion kept (proves helper stops early) - New assertion: drives `pollDashscopeVideoTaskUntilComplete` end-to-end with a 100 MiB streaming body, asserts bounded-reader error surfaces before the runtime buffers the full payload - New assertion: drives `runDashscopeVideoGenerationTask` end-to-end with a 100 MiB streaming body on the submit response, asserts the submit path is also bounded - Negative control kept (raw `response.json()` buffers full body) Verified on commit: - `node scripts/run-vitest.mjs extensions/qwen/video-generation-provider.test.ts` — 5/5 passed (was 3/5 fail before this fix) - `node scripts/run-vitest.mjs extensions/alibaba/video-generation-provider.test.ts` — 3/3 passed - `node scripts/run-vitest.mjs src/video-generation/dashscope-compatible.bounded-json.test.ts` — 4/4 passed - `pnpm exec tsx scripts/repro/issue-dashscope-response-cap.mjs` — 4/4 PASS (helper + poll path + submit path + negative control) - `npx oxlint --import-plugin --config .oxlintrc.json` on changed files — exit 0 - `node scripts/run-tsgo.mjs -p test/tsconfig/tsconfig.extensions.test.json` — exit 0

wangmiao0668000666 · 2026-06-24T06:34:31Z

@clawsweeper re-review

@clawsweeper — addressing the ClawSweeper P1 finding on PR #96036 (commit 480ed35628):

[P1] "Add the bounded JSON reader to the provider-http mock" — addressed by:
- Extended src/plugin-sdk/test-helpers/provider-http-mocks.ts (+22):
  - Added readProviderJsonResponse type import
  - Added ReadProviderJsonResponseParams type alias
  - Added readProviderJsonResponseMock field to ProviderHttpMocks interface
  - Added hoisted vi.fn() to the mocks object
  - Added default mock implementation that calls response.json() (parity with legacy unbounded read; leaves cap enforcement to the production helper, so this default doesn't silently neuter any future cap-test)
  - Added to vi.mock("openclaw/plugin-sdk/provider-http", ...) export map
  - Added mockClear to installProviderHttpMockCleanup() afterEach
- Verified extensions/qwen/video-generation-provider.test.ts: 5/5 passed (was 3/5 fail before this fix)
- Verified extensions/alibaba/video-generation-provider.test.ts: 3/3 passed
- Verified src/video-generation/dashscope-compatible.bounded-json.test.ts: 4/4 passed
Upgraded scripts/repro/issue-dashscope-response-cap.mjs (+100, no source change) to drive the changed call sites directly:
- Existing helper-only assertion kept (proves readProviderJsonResponse stops early)
- New assertion: drives pollDashscopeVideoTaskUntilComplete end-to-end with a 100 MiB streaming body and asserts the bounded-reader error surfaces before the runtime buffers the full payload (18/100 chunks read)
- New assertion: drives runDashscopeVideoGenerationTask end-to-end on the submit path with a 100 MiB streaming body and asserts the bounded-reader error surfaces on the submit path too (18/100 chunks read)
- Negative control kept (raw response.json() buffers all 2/2 chunks and fails only on JSON parse — proves the bounded read is the right shape)

Output:

=== Reproduction for dashscope-compatible bounded JSON read ===
PROVIDER_JSON_RESPONSE_MAX_BYTES = 16777216 bytes

PASS  bounded read on helper: threw "dashscope video-generation task poll: JSON response exceeds 16777216 bytes" after 17 / 32 chunks (stopped ~17 MiB into a 32 MiB body)
PASS  poll call site: threw "dashscope video-generation task poll: JSON response exceeds 16777216 bytes" after 18 / 100 chunks
PASS  submit call site: threw "dashscope video generation: JSON response exceeds 16777216 bytes" after 18 / 100 chunks
PASS  negative control: raw response.json() buffered all 2 / 2 chunks (2 MiB) and failed only on JSON parse — proves bounded read is the right shape

=== All repro assertions passed ===

Verification (all green on commit 480ed35628):

node scripts/run-vitest.mjs extensions/qwen/video-generation-provider.test.ts — 5/5 passed (was 3 fail)
node scripts/run-vitest.mjs extensions/alibaba/video-generation-provider.test.ts — 3/3 passed
node scripts/run-vitest.mjs src/video-generation/dashscope-compatible.bounded-json.test.ts — 4/4 passed
pnpm exec tsx scripts/repro/issue-dashscope-response-cap.mjs — 4/4 PASS (helper + poll + submit + negative)
node scripts/run-tsgo.mjs -p test/tsconfig/tsconfig.extensions.test.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/extensions-test.tsbuildinfo — exit 0
npx oxlint --import-plugin --config .oxlintrc.json on changed files — exit 0

The merge-blocking P1 (provider-http mock contract gap) should now be cleared. PR body unchanged.

clawsweeper · 2026-06-24T06:34:34Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

wangmiao0668000666 · 2026-06-24T15:35:55Z

@sallyom — this PR is the DashScope half of the same bound-response.json() family you
merged in #95218 / #95417 / #95418 / #95420 / #96027 / #96035 / #96038 / #96042. It routes
the two unbounded provider-controlled bodies in src/video-generation/dashscope-compatible.ts
(the submit-task response and the poll-status response) through readProviderJsonResponse,
closing the symmetry gap now that the sibling download path already uses
readResponseWithLimit.

🐚 platinum hermit + 👀 ready for maintainer look, with a standalone repro script
(scripts/repro/issue-dashscope-response-cap.mjs) that drives both production call sites
end-to-end with stubbed fetch + streaming hostile bodies.

Happy to address any review feedback or coordinate the merge ordering with the OpenAI
video submit sibling (#96144).

wangmiao0668000666 · 2026-06-25T12:42:42Z

Closing in favor of an Alix-007-style XS reshape. The actual code change is +9/-2 = 7 lines across 2 call sites — the current PR's 418 LoC comes from a committed repro script (208 LoC) + new test file (181 LoC). Per Alix-007 pattern: 1 source file, inline test in existing describe, local-only proof, XS size.

New PR will replace the same 2 await response.json() calls with readProviderJsonResponse — same fix, under 20 LoC total.

openclaw-barnacle Bot added scripts Repository scripts size: M triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. and removed triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. labels Jun 23, 2026

wangmiao0668000666 mentioned this pull request Jun 23, 2026

fix(video-generation): bound OpenAI video submitted response reads #96144

Closed

wangmiao0668000666 force-pushed the fix/dashscope-video-generation-bounded-json-response branch from c417fc2 to ee14da9 Compare June 24, 2026 01:07

This was referenced Jun 24, 2026

fix(image-generation): bound OpenAI-compatible image response reads #96136

Closed

fix(chutes-oauth): bound Chutes OAuth JSON response reads #96249

Closed

clawsweeper Bot mentioned this pull request Jun 24, 2026

fix(image-generation): bound OpenAI-compatible image API response reads #96261

Closed

wangmiao0668000666 mentioned this pull request Jun 24, 2026

[Bug]: 2026.6.9 breaks Groq voice transcription — "Media provider not available: groq" (externalized provider plugin not auto-installed) #95658

Closed

wangmiao0668000666 mentioned this pull request Jun 24, 2026

fix(googlechat): bound Google Chat API + certs success JSON response reads #96483

Closed

wangmiao0668000666 closed this Jun 25, 2026

clawsweeper Bot mentioned this pull request Jun 27, 2026

fix(video-generation): bound dashscope JSON response reads at 16 MiB #96782

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(video-generation): bound dashscope task response reads#96036

fix(video-generation): bound dashscope task response reads#96036
wangmiao0668000666 wants to merge 2 commits into
openclaw:mainfrom
wangmiao0668000666:fix/dashscope-video-generation-bounded-json-response

wangmiao0668000666 commented Jun 23, 2026 •

edited

Loading

Uh oh!

wangmiao0668000666 commented Jun 23, 2026

Uh oh!

clawsweeper Bot commented Jun 23, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jun 23, 2026 •

edited

Loading

Uh oh!

wangmiao0668000666 commented Jun 24, 2026

Uh oh!

clawsweeper Bot commented Jun 24, 2026 •

edited

Loading

Uh oh!

wangmiao0668000666 commented Jun 24, 2026

Uh oh!

clawsweeper Bot commented Jun 24, 2026 •

edited

Loading

Uh oh!

wangmiao0668000666 commented Jun 24, 2026

Uh oh!

wangmiao0668000666 commented Jun 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

wangmiao0668000666 commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

Changes

Evidence

Real-environment repro output

Unit tests

ClawSweeper finding addressed in this revision

Verification

CI status note

Out of scope

Uh oh!

wangmiao0668000666 commented Jun 23, 2026

Uh oh!

clawsweeper Bot commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clawsweeper Bot commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wangmiao0668000666 commented Jun 24, 2026

Uh oh!

clawsweeper Bot commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wangmiao0668000666 commented Jun 24, 2026

Uh oh!

clawsweeper Bot commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wangmiao0668000666 commented Jun 24, 2026

Uh oh!

wangmiao0668000666 commented Jun 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

wangmiao0668000666 commented Jun 23, 2026 •

edited

Loading

clawsweeper Bot commented Jun 23, 2026 •

edited

Loading

clawsweeper Bot commented Jun 23, 2026 •

edited

Loading

clawsweeper Bot commented Jun 24, 2026 •

edited

Loading

clawsweeper Bot commented Jun 24, 2026 •

edited

Loading