test: clarify qqbot stt guarded fetch

extensions/qqbot/src/engine/utils/stt.test.ts

@@ -4,8 +4,15 @@ import * as path from "node:path";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { resolveSTTConfig, transcribeAudio } from "./stt.js";
 
+const fetchWithSsrFGuardMock = vi.hoisted(() => vi.fn());
+
+vi.mock("openclaw/plugin-sdk/ssrf-runtime", () => ({
+  fetchWithSsrFGuard: fetchWithSsrFGuardMock,
+}));
+
 describe("engine/utils/stt", () => {
   afterEach(() => {
+    fetchWithSsrFGuardMock.mockReset();
     vi.unstubAllGlobals();
   });
 
@@ -72,12 +79,13 @@ describe("engine/utils/stt", () => {
     const audioPath = path.join(tmpDir, "voice.wav");
     fs.writeFileSync(audioPath, Buffer.from([1, 2, 3, 4]));
 
-    const fetchMock = vi.fn(async () =>
-      Response.json({
+    const release = vi.fn(async () => {});
+    fetchWithSsrFGuardMock.mockResolvedValueOnce({
+      response: Response.json({
         text: "hello from audio",
       }),
-    );
-    vi.stubGlobal("fetch", fetchMock);
+      release,
+    });
 
     const transcript = await transcribeAudio(audioPath, {
       channels: {
@@ -92,8 +100,28 @@ describe("engine/utils/stt", () => {
     });
 
     expect(transcript).toBe("hello from audio");
-    expect(fetchMock).toHaveBeenCalledWith(
-      "https://api.example.test/v1/audio/transcriptions",
+    expect(fetchWithSsrFGuardMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        auditContext: "qqbot-stt",
+        url: "https://api.example.test/v1/audio/transcriptions",
+        init: expect.objectContaining({
+          method: "POST",
+          headers: { Authorization: "Bearer secret" },
+          body: expect.any(FormData),
+        }),
+      }),
+    );
+    expect(release).toHaveBeenCalledTimes(1);
+    const [{ init }] = fetchWithSsrFGuardMock.mock.calls[0] as [
+      {
+        init: {
+          body: FormData;
+          headers: Record<string, string>;
+          method: string;
+        };
+      },
+    ];
+    expect(init).toEqual(
       expect.objectContaining({
         method: "POST",
         headers: { Authorization: "Bearer secret" },