fix(tlon): bound Urbit auth response body drain to prevent OOM (#109697)

* fix(tlon): bound Urbit auth response body drain to prevent OOM

Replace the unbounded response.text() body drain (discarded after reading
to finalize set-cookie headers) with a streaming reader capped at 64 KiB.
When no body stream is available, fall back to text() for compatibility.
A hostile or misconfigured Urbit endpoint could previously stream an
arbitrarily large body into memory during login.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(tlon): add curly braces to drain loop for lint compliance

* fix(tlon): remove unbounded text() fallback, cancel reader in finally

Remove the unbounded response.text() body-less fallback path. When no body
stream is available, there is nothing to drain — cookie headers are already
finalised. Move reader.cancel() into a finally block so the reader is
released even when read() throws.

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>

extensions/tlon/src/urbit/auth.ssrf.test.ts

@@ -24,14 +24,11 @@ describe("tlon urbit auth ssrf", () => {
   });
 
   it("allows private IPs when allowPrivateNetwork is enabled", async () => {
-    const mockFetch = vi.fn().mockResolvedValue({
-      ok: true,
+    const response = new Response("ok", {
       status: 200,
-      text: async () => "ok",
-      headers: new Headers({
-        "set-cookie": "urbauth-~zod=123; Path=/; HttpOnly",
-      }),
+      headers: { "set-cookie": "urbauth-~zod=123; Path=/; HttpOnly" },
     });
+    const mockFetch = vi.fn().mockResolvedValue(response);
     vi.stubGlobal("fetch", mockFetch);
     const lookupFn = (async () => [{ address: "127.0.0.1", family: 4 }]) as unknown as LookupFn;
 
@@ -41,6 +38,37 @@ describe("tlon urbit auth ssrf", () => {
       fetchImpl: mockFetch as typeof fetch,
     });
     expect(cookie).toContain("urbauth-~zod=123");
+    expect(response.bodyUsed).toBe(true);
     expect(mockFetch).toHaveBeenCalled();
   });
+
+  it("cancels an open body stream as soon as the drain cap is reached", async () => {
+    const cookieValue = "urbauth-~zod=789; Path=/; HttpOnly";
+    const cappedBody = new Uint8Array(64 * 1024).fill(0x78);
+    let canceled = false;
+    const stream = new ReadableStream({
+      start(controller) {
+        controller.enqueue(cappedBody);
+      },
+      cancel() {
+        canceled = true;
+      },
+    });
+    const response = new Response(stream, {
+      status: 200,
+      headers: { "set-cookie": cookieValue },
+    });
+
+    const mockFetch = vi.fn().mockResolvedValue(response);
+    vi.stubGlobal("fetch", mockFetch);
+    const lookupFn = (async () => [{ address: "127.0.0.1", family: 4 }]) as unknown as LookupFn;
+
+    const cookie = await authenticate("http://127.0.0.1:8080", "code", {
+      ssrfPolicy: { allowPrivateNetwork: true },
+      lookupFn,
+      fetchImpl: mockFetch as typeof fetch,
+    });
+    expect(cookie).toContain("urbauth-~zod=789");
+    expect(canceled).toBe(true);
+  });
 });

extensions/tlon/src/urbit/auth.ts

@@ -1,8 +1,11 @@
 // Tlon plugin module implements auth behavior.
+import { readResponseTextLimited } from "openclaw/plugin-sdk/provider-http";
 import type { LookupFn, SsrFPolicy } from "openclaw/plugin-sdk/ssrf-runtime";
 import { UrbitAuthError } from "./errors.js";
 import { urbitFetch } from "./fetch.js";
 
+const MAX_AUTH_BODY_DRAIN_BYTES = 64 * 1024;
+
 type UrbitAuthenticateOptions = {
   ssrfPolicy?: SsrFPolicy;
   lookupFn?: LookupFn;
@@ -36,8 +39,8 @@ export async function authenticate(
       throw new UrbitAuthError("auth_failed", `Login failed with status ${response.status}`);
     }
 
-    // Some Urbit setups require the response body to be read before cookie headers finalize.
-    await response.text().catch(() => {});
+    // Finish normal login responses for connection reuse, but cancel as soon as the cap is reached.
+    await readResponseTextLimited(response, MAX_AUTH_BODY_DRAIN_BYTES).catch(() => undefined);
     const cookie = response.headers.get("set-cookie");
     if (!cookie) {
       throw new UrbitAuthError("missing_cookie", "No authentication cookie received");