fix: abort hung dashboard and OAuth token fetches

[SebTardif]

What Problem This Solves

The admin console request / playgroundRequest helpers and the /v1/oauth/callback token exchange call fetch with no AbortSignal. If the Worker or the provider tokenUrl stalls, the dashboard stays pending and the OAuth callback never returns a connected/failed page. The proxy path already combines the inbound request signal with a timeout; these two call sites did not.

Evidence

Live Node against a TCP server that accepts the connection and never writes an HTTP response. The shared helper aborts in ~80ms when given an 80ms budget. The production dashboard request() helper uses the default 30s budget and returns TimeoutError instead of hanging.

$ node --version && uname -srm
v26.7.0
Darwin 25.6.0 arm64

$ node /tmp/oc-clawrouter-fetch-proof.mjs
hung_server=http://127.0.0.1:50817
default_timeout_ms=30000
helper_abort name=TimeoutError elapsed_ms=83
dashboard_request name=TimeoutError elapsed_ms=30004 timeout_ms=[30000]
proof_ok hung fetch aborted

Playground fetches use the Worker manifest ceiling (PLAYGROUND_FETCH_TIMEOUT_MS = 600_000). Dashboard JSON stays at 30s. A caller can still pass a shorter budget (coverage uses 180_000).

$ rg -n "PLAYGROUND_FETCH_TIMEOUT_MS|DEFAULT_FETCH_TIMEOUT_MS" shared/fetch-timeout.ts admin/src/dashboard-fetch.ts
shared/fetch-timeout.ts:1:export const DEFAULT_FETCH_TIMEOUT_MS = 30_000;
shared/fetch-timeout.ts:2:export const PLAYGROUND_FETCH_TIMEOUT_MS = 600_000;
admin/src/dashboard-fetch.ts: request() -> fetchTimeoutSignal(init.signal)
admin/src/dashboard-fetch.ts: playgroundRequest(..., timeoutMs = PLAYGROUND_FETCH_TIMEOUT_MS)

A token-exchange throw (timeout or network) now returns the existing "Provider token exchange failed." callback page instead of an unhandled Worker exception.

Real behavior proof

Behavior or issue addressed: Dashboard JSON fetches and the OAuth token POST carry a 30s AbortSignal.timeout. Playground model and service calls use a 600s budget so they can finish inside the Worker endpoint timeout. A hung peer finishes with TimeoutError (dashboard) or the OAuth failed page (callback).

Real environment tested: macOS Darwin 25.6.0 arm64, Node v26.7.0, clawrouter checkout /tmp/oc-impl-clawrouter-fetch on fix/fetch-abort-timeout. Live node against a local hanging HTTP server (accept, no response body).

Exact steps or command run after this patch: Started a node:http server that never writes a response. Called fetchTimeoutSignal(undefined, 80) on POST /oauth/token, then called production request(hung, "/v1/session") so the default 30s budget is the one compiled into admin/src/dashboard-fetch.ts. Ran pnpm --dir admin test for the 600s playground default and the explicit 180s override.

Evidence after fix: terminal output copied below.

hung_server=http://127.0.0.1:50817
default_timeout_ms=30000
helper_abort name=TimeoutError elapsed_ms=83
dashboard_request name=TimeoutError elapsed_ms=30004 timeout_ms=[30000]
proof_ok hung fetch aborted

Observed result after fix: The 80ms helper path aborted with TimeoutError at 83ms. Production dashboard request() recorded AbortSignal.timeout(30000) and aborted at 30004ms instead of remaining pending. playgroundRequest records AbortSignal.timeout(600000) unless the caller passes a shorter timeoutMs. OAuth callback maps the same abort to the existing failed HTML page.

What was not tested: Live Cloudflare Access admin session through a real provider tokenUrl. Grant refresh in worker/providers.ts (refreshGrant) still has no token-fetch timeout. Browser screenshot of a 10-minute playground completion.

Summary

• Shared fetchTimeoutSignal in shared/fetch-timeout.ts (30s dashboard default, 600s playground default, preserves a caller signal)
• Admin console JSON stays on the 30s helper; playground uses the 600s Worker ceiling
• /v1/oauth/callback token POST uses the same helper and catches abort/network failures
• Same hang class as openclaw/clickclack#168
• Unbounded fetch landed in openclaw/clawrouter#55 (2026-06-22)
• Proxy already uses AbortSignal.any plus a timer in worker/proxy.ts

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed August 16, 2026, 7:39 AM ET / 11:39 UTC.

ClawSweeper review

What this changes

The PR moves dashboard request helpers into a focused module, adds timeout signals for dashboard and OAuth token fetches, keeps playground requests at a 600-second budget, and adds focused tests.

Regression provenance

Possible regression — probable (reproduction; reviewed change). No predecessor PR is attributed.

Merge readiness

⛔ Blocked until stronger real behavior proof is added - 3 items remain

Keep open: current main still leaves these dashboard and OAuth fetches unbounded, and the current patch is targeted with no code-level blocker found. The final head changed the dashboard timeout to 60 seconds, but the supplied live proof still demonstrates the earlier 30-second behavior, so exact-head proof is needed before merge.

Priority: P1
Reviewed head: 75cf96857215c133ea3223d485b0e9f63fc4532b

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch is focused and source-consistent, but the available real-behavior transcript does not prove the final timeout configuration.
Proof confidence	🦐 gold shrimp (3/6)	Needs stronger real behavior proof before merge: The supplied terminal proof is real but demonstrates the prior 30-second dashboard behavior, while the final head uses 60 seconds; add redacted after-fix output for the current head. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs stronger real behavior proof before merge: The supplied terminal proof is real but demonstrates the prior 30-second dashboard behavior, while the final head uses 60 seconds; add redacted after-fix output for the current head. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	6 items	Current main remains affected: Dashboard request and playground helpers call fetch without a signal on current main. Current-head dashboard behavior: The submitted head applies a 60-second dashboard timeout while retaining the 600-second playground budget. Current-head OAuth behavior: The token exchange combines the inbound request signal with the shared timeout and maps fetch failures to the existing failed callback page.
Findings	None	None.
Security	None	None.

How this fits together

The admin dashboard fetches Worker JSON endpoints, while the OAuth callback exchanges an authorization code with a provider. Both paths affect interactive console state and provider connection setup, so stalled upstreams need bounded user-visible failures.

flowchart LR
  A[Admin dashboard] --> B[Dashboard request helper]
  C[OAuth callback] --> D[Provider token exchange]
  B --> E[Timeout and caller abort signal]
  D --> E
  E --> F[Worker or provider endpoint]
  F --> G[Bounded response or failure page]

Loading

Before merge

• Add real behavior proof - Needs stronger real behavior proof before merge: The supplied terminal proof is real but demonstrates the prior 30-second dashboard behavior, while the final head uses 60 seconds; add redacted after-fix output for the current head. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Resolve merge risk (P1) - Existing dashboard requests that previously waited indefinitely now fail after 60 seconds, and OAuth exchanges fail after 30 seconds; this is intentional but changes the observable failure mode.
• Resolve merge risk (P2) - The PR body and live transcript still claim a 30-second dashboard timeout, so they do not prove the final submitted head.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Implementation and coverage	production +63/-35, tests +206	The patch moves existing helpers while adding bounded-fetch behavior and focused dashboard/OAuth coverage.

Root-cause cluster

Relationship: canonical
Canonical: #111
Summary: This PR owns the dashboard and OAuth-callback fetch paths; the related refresh-token change has a separate owner path.

Members:

• adjacent_distinct: fix(oauth): abort hung grant refresh token fetches #112 - It addresses the separate refresh-token request in worker/providers.ts.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge-risk options

Maintainer options:

1. Refresh exact-head runtime proof (recommended)
   Run the hanging-server scenario against the current head and post redacted terminal output showing the 60-second dashboard abort and OAuth failed-page result.

Technical review

Best possible solution:

Retain the 60-second dashboard headroom and 600-second playground budget, while keeping OAuth token exchange failure bounded at 30 seconds and evidenced on the final head.

Do we have a high-confidence way to reproduce the issue?

Yes, source-reproducible: current main has both owner fetch calls without signals, and the PR supplies a concrete hanging TCP-server scenario; this review did not execute that scenario.

Is this the best way to solve the issue?

Yes, the timeout helper is a narrow shared solution that preserves caller cancellation and the playground budget, but current-head runtime proof must replace the earlier 30-second dashboard transcript.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against ca27bc44227f.

Labels

Label changes:

• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The supplied terminal proof is real but demonstrates the prior 30-second dashboard behavior, while the final head uses 60 seconds; add redacted after-fix output for the current head. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• remove rating: 🐚 platinum hermit: Current PR rating is rating: 🦐 gold shrimp, so this older rating label is no longer current.
• remove status: 👀 ready for maintainer look: Current PR status label is status: 📣 needs proof.
• remove proof: sufficient: Current real behavior proof status is insufficient, not sufficient.

Label justifications:

• P1: A stalled Worker or provider token endpoint leaves active dashboard and OAuth workflows pending on current main.
• merge-risk: 🚨 compatibility: Existing requests that waited indefinitely will instead receive a bounded timeout failure after upgrade.
• merge-risk: 🚨 availability: The patch changes how dashboard and OAuth flows recover from stalled upstream connections.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The supplied terminal proof is real but demonstrates the prior 30-second dashboard behavior, while the final head uses 60 seconds; add redacted after-fix output for the current head. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• Current main remains affected: Dashboard request and playground helpers call fetch without a signal on current main. (admin/src/ui-helpers.ts:30, ca27bc44227f)
• Current-head dashboard behavior: The submitted head applies a 60-second dashboard timeout while retaining the 600-second playground budget. (shared/fetch-timeout.ts:2, 75cf96857215)
• Current-head OAuth behavior: The token exchange combines the inbound request signal with the shared timeout and maps fetch failures to the existing failed callback page. (worker/oauth.ts:50, 75cf96857215)
• Feature provenance: Blame attributes the original unbounded dashboard and OAuth calls to the v0.1.0 release commit; the current PR head also contains a follow-up authored by steipete to preserve Worker timeout errors. (worker/oauth.ts:47, 13845ee2bdc0)
• Proof is stale relative to head: The final-head test asserts a 60-second dashboard signal, whereas the supplied live terminal transcript records a 30-second dashboard abort. (admin/test/dashboard-fetch.test.mjs:35, 75cf96857215)
• Autoreview limitation: The required structured autoreview was invoked for the submitted commit but could not build its full patch because a required promisor object was absent and github.com DNS resolution failed; the available source blobs and focused diff were reviewed manually. (75cf96857215)

Likely related people:

• steipete: Git blame attributes the pre-existing dashboard and OAuth fetches to the v0.1.0 release commit, and steipete authored the latest current-head timeout follow-up. (role: original feature author and recent area contributor; confidence: high; commits: 13845ee2bdc0, 75cf96857215; files: admin/src/ui-helpers.ts, worker/oauth.ts, admin/src/dashboard-fetch.ts)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Update the PR body with redacted hanging-server output from the current head; after updating proof, request a fresh ClawSweeper review if one is not triggered automatically.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (2 earlier review cycles)

• reviewed 2026-08-15T23:30:37.766Z sha a0779e7 :: needs changes before merge. :: [P1] Preserve the playground endpoint timeout budget
• reviewed 2026-08-16T00:22:25.158Z sha d647877 :: needs maintainer review before merge. :: none

[SebTardif]

@clawsweeper

[P1] Preserve the playground endpoint timeout budget
playgroundRequest now unconditionally uses the 30-second shared timeout, but usePlayground sends normal model and service calls through it while the Worker honors manifest endpoint budgets up to 600 seconds.

Pushed d647877. playgroundRequest defaults to PLAYGROUND_FETCH_TIMEOUT_MS (600000). Dashboard request() stays at 30s. Coverage records [600_000] and an explicit 180_000 override.

@clawsweeper re-review