fix(bedrock): bound Mantle model discovery fetches by zhangguiping-xydt · Pull Request #99961 · openclaw/openclaw

zhangguiping-xydt · 2026-07-04T12:49:18Z

What Problem This Solves

Fixes an issue where users relying on Amazon Bedrock Mantle model discovery could have provider setup hang indefinitely when the /v1/models request stalls, or consume unbounded memory when the endpoint streams an oversized JSON body.

Why This Change Was Made

Mantle model discovery now treats the provider catalog response as an untrusted network boundary: the fetch receives a 30 second abort signal, and successful JSON bodies are read through the existing bounded response reader with a 4 MiB cap. The 4 MiB cap matches OpenClaw's existing live model catalog body cap for provider-owned model catalogs; the larger 16 MiB setup-discovery cap is for self-hosted setup JSON, so this keeps the Mantle fix aligned with the live catalog path. The timeout/cap boundary preserves the existing failure behavior: discovery errors fall back to cached models or an empty result instead of hanging or reading an unbounded response.

No schema, config, migration, stored-state, or public provider contract is changed.

User Impact

Mantle provider discovery is now bounded for normal, oversized, and stalled provider responses. Users should see provider resolution fail safely instead of hanging the process or reading an unbounded response body. If a Mantle catalog exceeds the bounded provider-catalog limit or does not produce a response within 30 seconds, discovery uses the same cache-or-empty fallback path it already used for provider failures.

Evidence

Local HTTP behavior proof for Mantle discovery normal, oversized, and stalled response paths. The proof uses the actual Mantle discovery module, verifies the fetch receives an AbortSignal, and serves responses from a local HTTP server:

normal: PASS returned openai.gpt-oss-120b from local HTTP server in 101ms
oversized: PASS returned 0 models after cancelling at 4325376 bytes (limit 4194304 bytes, target 25165824 bytes) in 71ms
stalled: PASS returned 0 models after 30004ms and closed the half-open request
Mantle local HTTP discovery proof: PASS

node scripts/run-vitest.mjs run extensions/amazon-bedrock-mantle/discovery.test.ts

Test Files  1 passed (1)
     Tests  31 passed (31)
[test] passed 1 Vitest shard in 16.73s

env OPENCLAW_CHECK_CHANGED_REMOTE_CHILD=1 OPENCLAW_CHANGED_LANES_RAW_SYNC=1 CI=1 PNPM_CONFIG_VERIFY_DEPS_BEFORE_RUN=false pnpm check:changed

[check:changed] lanes=extensions, extensionTests
[check:changed] extensions/amazon-bedrock-mantle/discovery.test.ts: extension test
[check:changed] extensions/amazon-bedrock-mantle/discovery.ts: extension production
[check:changed] conflict markers
[check:changed] changelog attributions
[check:changed] guarded extension wildcard re-exports
No guarded extension wildcard re-exports found.
[check:changed] plugin-sdk wildcard re-exports
No plugin-sdk wildcard re-exports found in extension API barrels.
[check:changed] duplicate scan target coverage
[dup:check] target coverage ok
[check:changed] dependency pin guard
PASS direct dependency pin guard: checked 472 directly declared dependency specs across 159 tracked package manifests; 0 violations.
[check:changed] package patch guard
PASS package patch guard: no new pnpm patches; 4 legacy patches allowlisted.
[check:changed] typecheck extensions
[check:changed] typecheck extension tests
[check:changed] lint extension changed files
[check:changed] database-first legacy-store guard
Database-first legacy-store guard passed.
[check:changed] runtime sidecar loader guard
runtime-sidecar-loaders: local runtime sidecar loaders look OK.
[check:changed] runtime import cycles
Import cycle check: 0 runtime value cycle(s).

clawsweeper · 2026-07-04T12:50:27Z

Codex review: needs changes before merge. Reviewed July 5, 2026, 8:53 PM ET / 00:53 UTC.

Summary
The PR bounds Bedrock Mantle model discovery with a 30s abort signal, a 4 MiB bounded response reader, rejected-body cancellation, updated discovery tests, and a CHANGELOG.md entry.

PR surface: Source +24, Tests +43, Docs +1. Total +68 across 3 files.

Reproducibility: yes. Source inspection shows current main reads successful Mantle discovery responses with unbounded native response.json() and no fetch timeout, and the PR body includes local HTTP proof for normal, oversized, and stalled responses.

Review metrics: 1 noteworthy metric.

Mantle discovery bounds: 30s timeout, 4 MiB response cap. These new provider behavior limits are the compatibility boundary maintainers should notice before merge.

Stored data model
Persistent data-model change detected: serialized state: extensions/amazon-bedrock-mantle/discovery.test.ts, serialized state: extensions/amazon-bedrock-mantle/discovery.ts. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

Remove the CHANGELOG.md entry while keeping release-note context in the PR body or squash message.

Risk before merge

[P1] The new 4 MiB/30s limits intentionally fail soft to cached or empty discovery results; a rare existing Mantle setup with a larger or slower catalog could stop auto-discovering models after upgrade unless maintainers accept that boundary.

Maintainer options:

Accept the Mantle discovery bounds (recommended)
Proceed after changelog cleanup if maintainers accept that Mantle discovery responses over 4 MiB or slower than 30s now use the existing cache-or-empty fallback.
Adjust bounds before merge
If provider owners expect valid Mantle catalogs to exceed these limits, change the constants and extend the proof before landing.

Next step before merge

The concrete patch defect is a narrow changelog cleanup that automation can remove without touching runtime behavior or choosing product direction.

Security
Cleared: No security or supply-chain issue found; the diff narrows an untrusted provider-response availability boundary and does not add dependencies, workflows, permissions, or secret handling.

Review findings

[P3] Remove the release-owned changelog entry — CHANGELOG.md:73

Review details

Best possible solution:

Merge the bounded Mantle discovery runtime/test change after removing CHANGELOG.md; keep release-note context in the PR body or squash message and treat the 30s/4 MiB bound as the intended provider-discovery policy.

Do we have a high-confidence way to reproduce the issue?

Yes. Source inspection shows current main reads successful Mantle discovery responses with unbounded native response.json() and no fetch timeout, and the PR body includes local HTTP proof for normal, oversized, and stalled responses.

Is this the best way to solve the issue?

Mostly yes. The runtime fix stays inside the owning Bedrock Mantle plugin and uses the existing bounded-response SDK helper; the remaining branch issue is the release-owned changelog edit, not the runtime approach.

Full review comments:

[P3] Remove the release-owned changelog entry — CHANGELOG.md:73
Root AGENTS.md marks CHANGELOG.md as release-only, but this PR still adds a release entry here. This was the prior ClawSweeper finding and remains present on the current head; remove the line and keep the release-note context in the PR body or squash message.
Confidence: 0.95

Overall correctness: patch is correct
Overall confidence: 0.88

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 95f12178a794.

Label changes

Label changes:

add merge-risk: 🚨 compatibility: Existing Mantle setups with unusually slow or larger-than-4 MiB model catalogs would now fall back to cached or empty discovery results instead of continuing to read.
add proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes terminal output from a local HTTP server exercising the changed Mantle discovery module for normal, oversized, and stalled response paths after the fix.
add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body includes terminal output from a local HTTP server exercising the changed Mantle discovery module for normal, oversized, and stalled response paths after the fix.

Label justifications:

P2: This fixes a real Bedrock Mantle provider discovery hang/OOM class with limited blast radius to one provider path.
merge-risk: 🚨 compatibility: Existing Mantle setups with unusually slow or larger-than-4 MiB model catalogs would now fall back to cached or empty discovery results instead of continuing to read.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body includes terminal output from a local HTTP server exercising the changed Mantle discovery module for normal, oversized, and stalled response paths after the fix.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes terminal output from a local HTTP server exercising the changed Mantle discovery module for normal, oversized, and stalled response paths after the fix.

Evidence reviewed

PR surface:

Source +24, Tests +43, Docs +1. Total +68 across 3 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	25	1	+24
Tests	1	80	37	+43
Docs	1	1	0	+1
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	3	106	38	+68

Acceptance criteria:

[P1] git diff --check.

What I checked:

Repository policy applied: Root policy marks CHANGELOG.md as release-only and says normal PRs should not edit it; scoped extensions/AGENTS.md confirms bundled provider production code should stay on plugin SDK subpaths, which this runtime change does. (AGENTS.md:238, 95f12178a794)
Current main behavior: Current main performs Mantle /v1/models discovery with fetchFn and then calls native response.json() on successful responses, with no fetch timeout or response-size cap at that call site. (extensions/amazon-bedrock-mantle/discovery.ts:305, ce294dd96b81)
PR runtime behavior: The PR head reads successful Mantle discovery JSON through readResponseWithLimit with a 4 MiB cap and 30s idle timeout, passes AbortSignal.timeout(30_000) to fetch, and cancels non-OK response bodies. (extensions/amazon-bedrock-mantle/discovery.ts:238, 209f903b8752)
Bounded-reader contract: readResponseWithLimit delegates to readResponsePrefix; the prefix reader cancels the stream once the next chunk would exceed maxBytes, then the public helper throws the configured overflow error. (src/infra/http-body.ts:229, 95f12178a794)
Regression coverage: The PR tests assert that Mantle fetches receive a timeout signal, successful oversized bodies return the existing empty fallback without calling native response.json(), and non-OK response bodies are consumed/cancelled. (extensions/amazon-bedrock-mantle/discovery.test.ts:384, 209f903b8752)
Real behavior proof and CI context: The PR body includes terminal proof from a local HTTP server for normal, oversized, and stalled Mantle discovery responses; maintainer landing prep also reports sanitized AWS Crabbox test proof and exact-head hosted CI for the earlier rebased head. (209f903b8752)

Likely related people:

wirjo: Authored the merged Bedrock Mantle provider PR that introduced discovery.ts and the /v1/models discovery path now being bounded. (role: introduced behavior; confidence: high; commits: dbac5fa258d9, 0793136c6361; files: extensions/amazon-bedrock-mantle/discovery.ts, extensions/amazon-bedrock-mantle/discovery.test.ts)
vincentkoc: Merged the original Bedrock Mantle provider PR and authored or maintained shared provider HTTP bounded-reader helpers relevant to this fix shape. (role: merger and shared helper contributor; confidence: medium; commits: dbac5fa258d9, d16f79f49d24, aa665817490b; files: extensions/amazon-bedrock-mantle/discovery.ts, src/agents/provider-http-errors.ts, src/plugin-sdk/provider-http.ts)
steipete: Recent git history shows provider helper/error-format refactors touching this file, and the live PR discussion shows maintainer landing prep for this branch. (role: recent area contributor and reviewer; confidence: medium; commits: 775b78e186c4, 54cd8ed25be6, 7bb5ec44f30b; files: extensions/amazon-bedrock-mantle/discovery.ts, extensions/amazon-bedrock-mantle/discovery.test.ts)
Alix-007: Authored recently merged sibling provider JSON response bounding work that established the shared bounded-reader pattern used across provider surfaces. (role: adjacent hardening contributor; confidence: medium; commits: 2592f8a51a4e; files: src/agents/provider-http-errors.ts, src/agents/provider-http-errors.test.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (8 earlier review cycles)

reviewed 2026-07-04T12:54:45.192Z sha decba77 :: needs real behavior proof before merge. :: none
reviewed 2026-07-04T13:50:44.432Z sha decba77 :: needs maintainer review before merge. :: none
reviewed 2026-07-04T13:57:11.655Z sha decba77 :: needs maintainer review before merge. :: none
reviewed 2026-07-04T13:57:33.349Z sha decba77 :: needs maintainer review before merge. :: none
reviewed 2026-07-04T14:49:32.233Z sha decba77 :: needs maintainer review before merge. :: none
reviewed 2026-07-04T15:42:52.230Z sha decba77 :: needs maintainer review before merge. :: none
reviewed 2026-07-04T16:41:03.906Z sha decba77 :: needs maintainer review before merge. :: none
reviewed 2026-07-06T00:01:20.048Z sha 9770fbd :: found issues before merge. :: [P3] Remove the release-owned changelog entry

steipete · 2026-07-05T23:57:58Z

Maintainer landing prep is complete for exact head bc5677f24bf1b0aa1ce53103c940ae1d3631ff4b.

Rebased onto main; kept Mantle catalog discovery in the Bedrock provider owner.
Added a 30-second abort signal, the shared 4 MiB bounded response reader, idle-stream timeout handling, and explicit cancellation for non-OK response bodies.
Regression coverage uses real Response streams for timeout wiring, overflow cancellation, non-OK cleanup, and the existing cache-or-empty fallback.
Fresh post-rebase whole-branch AutoReview: clean, no accepted/actionable findings (0.83).
Exact-head hosted CI: run 28761448707 passed.
Sanitized AWS Crabbox focused proof: run_f39c4b625230, 31/31 tests passed.
Added changelog credit.

No remaining proof gap for this bounded provider boundary; no live Mantle credential was required to exercise the HTTP stream, timeout, overflow, cleanup, and fallback contracts.

steipete · 2026-07-06T01:21:04Z

Merged via squash.

Prepared head SHA: bc5677f24bf1b0aa1ce53103c940ae1d3631ff4b
Landed commit: a77ea59ce73cca21b3897bbf313abee2df50dd23

* fix(bedrock): bound Mantle model discovery fetches * fix(bedrock): release rejected Mantle responses * docs(changelog): position Bedrock Mantle fix --------- Co-authored-by: Peter Steinberger <[email protected]>

…ider reader Drop the Mantle half of the original combined change; that surface is already covered by openclaw#99961 on main. Keep only the HuggingFace catalog success-path bound read using readProviderJsonResponse. Co-authored-by: Cursor <[email protected]>

* fix(bedrock): bound Mantle model discovery fetches * fix(bedrock): release rejected Mantle responses * docs(changelog): position Bedrock Mantle fix --------- Co-authored-by: Peter Steinberger <[email protected]>

openclaw-barnacle Bot added the size: S label Jul 4, 2026

zhangguiping-xydt changed the title ~~Fix Mantle model discovery fetch timeout and bounded JSON parsing~~ fix(bedrock): bound Mantle model discovery fetches Jul 4, 2026

steipete self-assigned this Jul 5, 2026

steipete force-pushed the fix/problem-mantle-discovery-timeout-bounded-json branch from decba77 to 9770fbd Compare July 5, 2026 23:46

openclaw-barnacle Bot added docs Improvements or additions to documentation app: android App: android app: ios App: ios app: web-ui App: web-ui gateway Gateway runtime scripts Repository scripts agents Agent runtime and tooling size: XL and removed size: S labels Jul 6, 2026

steipete force-pushed the fix/problem-mantle-discovery-timeout-bounded-json branch from c62737d to ac9059e Compare July 6, 2026 00:28

openclaw-barnacle Bot removed docs Improvements or additions to documentation app: android App: android app: ios App: ios app: web-ui App: web-ui gateway Gateway runtime labels Jul 6, 2026

openclaw-barnacle Bot added size: S and removed scripts Repository scripts agents Agent runtime and tooling size: XL labels Jul 6, 2026

steipete force-pushed the fix/problem-mantle-discovery-timeout-bounded-json branch from ac9059e to 209f903 Compare July 6, 2026 00:39

zhangguiping-xydt and others added 3 commits July 5, 2026 21:06

fix(bedrock): bound Mantle model discovery fetches

735cbb2

fix(bedrock): release rejected Mantle responses

d10301a

docs(changelog): position Bedrock Mantle fix

bc5677f

steipete force-pushed the fix/problem-mantle-discovery-timeout-bounded-json branch from 209f903 to bc5677f Compare July 6, 2026 01:07

steipete merged commit a77ea59 into openclaw:main Jul 6, 2026
88 checks passed

This was referenced Jul 6, 2026

fix(bedrock-mantle): bound model discovery JSON response read #98858

Closed

fix(agents): bound model catalog JSON response reads for bedrock-mantle and huggingface #96480

Closed

github-actions Bot mentioned this pull request Jul 6, 2026

📡 Upstream Digest — 2026-07-06 02:26 UTC curtismercier/openclaw-mods#1220

Open

clawsweeper Bot mentioned this pull request Jul 6, 2026

fix(build): add explicit ESM format to nodeBuildConfig for type module package #95059

Closed

clawsweeper Bot mentioned this pull request Jul 6, 2026

fix(extensions/huggingface): bound model discovery JSON response read to prevent OOM #101079

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(bedrock): bound Mantle model discovery fetches#99961

fix(bedrock): bound Mantle model discovery fetches#99961
steipete merged 3 commits into
openclaw:mainfrom
zhangguiping-xydt:fix/problem-mantle-discovery-timeout-bounded-json

zhangguiping-xydt commented Jul 4, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jul 4, 2026 •

edited

Loading

Uh oh!

steipete commented Jul 5, 2026 •

edited

Loading

Uh oh!

Uh oh!

steipete commented Jul 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

zhangguiping-xydt commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

clawsweeper Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

steipete commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

steipete commented Jul 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

zhangguiping-xydt commented Jul 4, 2026 •

edited

Loading

clawsweeper Bot commented Jul 4, 2026 •

edited

Loading

steipete commented Jul 5, 2026 •

edited

Loading