fix(nvidia): satisfy guarded catalog fetch

CaptainTimon · CaptainTimon · commit 9e127b38ea2f · 2026-05-08T23:18:13.000+02:00
diff --git a/extensions/nvidia/provider-catalog.ts b/extensions/nvidia/provider-catalog.ts
@@ -3,6 +3,10 @@ import type {
   ModelDefinitionConfig,
   ModelProviderConfig,
 } from "openclaw/plugin-sdk/provider-model-shared";
+import {
+  fetchWithSsrFGuard,
+  ssrfPolicyFromHttpBaseUrlAllowedHostname,
+} from "openclaw/plugin-sdk/ssrf-runtime";
 import manifest from "./openclaw.plugin.json" with { type: "json" };
 
 export const NVIDIA_DEFAULT_MODEL_ID = "nvidia/nemotron-3-super-120b-a12b";
@@ -82,13 +86,22 @@ async function loadNvidiaFeaturedModels(): Promise<ModelDefinitionConfig[] | nul
 
 async function fetchNvidiaFeaturedModels(): Promise<ModelDefinitionConfig[] | null> {
   try {
-    const response = await fetch(NVIDIA_FEATURED_MODELS_URL, {
-      signal: AbortSignal.timeout(FEATURED_MODEL_FETCH_TIMEOUT_MS),
+    const { response, release } = await fetchWithSsrFGuard({
+      url: NVIDIA_FEATURED_MODELS_URL,
+      init: {
+        signal: AbortSignal.timeout(FEATURED_MODEL_FETCH_TIMEOUT_MS),
+      },
+      policy: ssrfPolicyFromHttpBaseUrlAllowedHostname(NVIDIA_FEATURED_MODELS_URL),
+      auditContext: "nvidia-featured-model-catalog",
     });
-    if (!response.ok) {
-      return null;
+    try {
+      if (!response.ok) {
+        return null;
+      }
+      return parseNvidiaFeaturedModels(await response.json());
+    } finally {
+      release();
     }
-    return parseNvidiaFeaturedModels(await response.json());
   } catch {
     return null;
   }
diff --git a/src/gateway/server-cron.test.ts b/src/gateway/server-cron.test.ts
@@ -4,7 +4,6 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 import type { CliDeps } from "../cli/deps.js";
 import type { OpenClawConfig } from "../config/config.js";
 import { SsrFBlockedError } from "../infra/net/ssrf.js";
-import { mergeMockedModule } from "../test-utils/vitest-module-mocks.js";
 
 const {
   enqueueSystemEventMock,
@@ -50,14 +49,13 @@ vi.mock("../infra/system-events.js", () => ({
 }));
 
 vi.mock("../infra/heartbeat-wake.js", async () => {
-  return await mergeMockedModule(
-    await vi.importActual<typeof import("../infra/heartbeat-wake.js")>(
-      "../infra/heartbeat-wake.js",
-    ),
-    () => ({
-      requestHeartbeat,
-    }),
+  const actual = await vi.importActual<typeof import("../infra/heartbeat-wake.js")>(
+    "../infra/heartbeat-wake.js",
   );
+  return {
+    ...actual,
+    requestHeartbeat,
+  };
 });
 
 vi.mock("../infra/heartbeat-runner.js", () => ({
