Vendor OpenClaw source as Adolf fork baseline

Adolf is a fork/vendored clone of github.com/openclaw/openclaw (v2026.6.11),
free to diverge. Tree copied sans upstream .git; upstream remote added for
future syncs. Node pinned to 24 (.nvmrc); engines already require >=22.19.
Preserves docs/ARCHITECTURE.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LeqyaxJF2nbRXJtae2kNB2

extensions/google/oauth.http.test.ts

@@ -0,0 +1,172 @@
+// Google tests cover oauth.http body-byte-cap for the Gemini CLI OAuth
+// token-exchange/identity calls.
+import http from "node:http";
+import type { AddressInfo } from "node:net";
+import { readResponseWithLimit } from "openclaw/plugin-sdk/response-limit-runtime";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { TOKEN_URL } from "./oauth.shared.js";
+
+const fetchWithSsrFGuardMock = vi.fn();
+const releaseMock = vi.fn(async () => undefined);
+
+vi.mock("openclaw/plugin-sdk/ssrf-runtime", async () => {
+  const actual = await vi.importActual<typeof import("openclaw/plugin-sdk/ssrf-runtime")>(
+    "openclaw/plugin-sdk/ssrf-runtime",
+  );
+  return {
+    ...actual,
+    fetchWithSsrFGuard: (params: unknown) => fetchWithSsrFGuardMock(params),
+  };
+});
+
+const { fetchWithTimeout } = await import("./oauth.http.js");
+
+describe("oauth.http fetchWithTimeout body byte cap", () => {
+  beforeEach(() => {
+    fetchWithSsrFGuardMock.mockReset();
+    releaseMock.mockClear();
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it("caps oversized response body at 16 MiB with labeled overflow error", async () => {
+    // Build a Response with a body that exceeds the 16 MiB cap.
+    // 1 MiB chunks × 18 chunks = 18 MiB queued; the bounded reader reads
+    // up to the 16 MiB cap (16 chunks = 16777216 bytes) and one extra
+    // chunk before throwing on overflow, so the labeled `size` is the
+    // cap plus the trailing chunk: 16777216 + 1048576 = 17825792 bytes.
+    const CHUNK = 1024 * 1024;
+    let sent = 0;
+    const body = new ReadableStream({
+      pull(controller) {
+        if (sent < 18) {
+          controller.enqueue(new Uint8Array(CHUNK));
+          sent++;
+        } else {
+          controller.close();
+        }
+      },
+    });
+    fetchWithSsrFGuardMock.mockResolvedValue({
+      response: new Response(body, {
+        status: 200,
+        headers: { "content-type": "application/json" },
+      }),
+      finalUrl: TOKEN_URL,
+      release: releaseMock,
+    });
+
+    await expect(fetchWithTimeout(TOKEN_URL, { method: "POST" })).rejects.toThrow(
+      /google HTTP fetch: body exceeds 16777216 bytes \(got 17825792\)/,
+    );
+    expect(releaseMock).toHaveBeenCalledOnce();
+  });
+
+  it("returns a Response for normal-size bodies", async () => {
+    fetchWithSsrFGuardMock.mockResolvedValue({
+      response: new Response('{"access_token":"abc","expires_in":3600}', {
+        status: 200,
+        headers: { "content-type": "application/json" },
+      }),
+      finalUrl: TOKEN_URL,
+      release: releaseMock,
+    });
+
+    const res = await fetchWithTimeout(TOKEN_URL, { method: "POST" });
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ access_token: "abc", expires_in: 3600 });
+    expect(releaseMock).toHaveBeenCalledOnce();
+  });
+});
+
+// Real-wire loopback proof. These tests bypass `fetchWithSsrFGuard` (which
+// blocks 127.0.0.1 by design) and exercise `readResponseWithLimit` directly
+// against a real `http.createServer` listener — the same helper that
+// `fetchWithTimeout` calls inside its try/finally block. Captured vitest
+// output for these two tests is the ClawSweeper "real behavior proof" required
+// before merge.
+describe("oauth.http bounded-read real wire proof (loopback http.createServer)", () => {
+  it("caps an oversized body streamed chunked over real wire", async () => {
+    const CHUNK = 1024 * 1024;
+    const MAX = 16 * 1024 * 1024;
+    const TOTAL = 18 * 1024 * 1024;
+    const server = http.createServer((req, res) => {
+      res.writeHead(200, { "content-type": "application/octet-stream" });
+      let sent = 0;
+      const tick = setInterval(() => {
+        if (sent < 18) {
+          res.write(Buffer.alloc(CHUNK));
+          sent++;
+        } else {
+          clearInterval(tick);
+          res.end();
+        }
+      }, 1);
+    });
+    await new Promise<void>((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(0, "127.0.0.1", () => resolve());
+    });
+    const port = (server.address() as AddressInfo).port;
+
+    let captured: Error | undefined;
+    try {
+      const response = await fetch(`http://127.0.0.1:${port}/`);
+      // Wire framing merges TCP packets, so the exact reported size varies by
+      // runtime. The stable invariant is that the cap fires after MAX.
+      try {
+        await readResponseWithLimit(response, MAX, {
+          onOverflow: ({ size, maxBytes }) =>
+            new Error(`real wire: body exceeds ${maxBytes} bytes (got ${size})`),
+        });
+      } catch (err) {
+        captured = err as Error;
+      }
+      expect(captured).toBeInstanceOf(Error);
+      const match = captured!.message.match(/real wire: body exceeds \d+ bytes \(got (\d+)\)/);
+      expect(match).not.toBeNull();
+      const got = Number(match![1]);
+      expect(got).toBeGreaterThan(MAX);
+      // Print to vitest stdout for PR-body real behavior proof capture.
+      console.log(
+        `[oauth.http loopback proof] oversized path: cap=${MAX} reported=${got} server_total=${TOTAL}`,
+      );
+    } finally {
+      await new Promise<void>((resolve) => {
+        server.close(() => resolve());
+      });
+    }
+  });
+
+  it("returns a Buffer for normal-size responses on real wire", async () => {
+    const bodyText = '{"access_token":"loopback","expires_in":3600}';
+    const server = http.createServer((req, res) => {
+      res.writeHead(200, { "content-type": "application/json" });
+      res.end(bodyText);
+    });
+    await new Promise<void>((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(0, "127.0.0.1", () => resolve());
+    });
+    const port = (server.address() as AddressInfo).port;
+
+    try {
+      const response = await fetch(`http://127.0.0.1:${port}/`);
+      const body = await readResponseWithLimit(response, 16 * 1024 * 1024, {
+        onOverflow: ({ size, maxBytes }) =>
+          new Error(`real wire: body exceeds ${maxBytes} bytes (got ${size})`),
+      });
+      expect(body.byteLength).toBe(Buffer.byteLength(bodyText, "utf8"));
+      expect(new TextDecoder("utf-8").decode(body)).toBe(bodyText);
+      console.log(
+        `[oauth.http loopback proof] normal path: cap=16777216 returned=${body.byteLength} body=${JSON.stringify(new TextDecoder("utf-8").decode(body))}`,
+      );
+    } finally {
+      await new Promise<void>((resolve) => {
+        server.close(() => resolve());
+      });
+    }
+  });
+});