PR #71687: fix(active-memory): enforce timeoutMs as hard deadline via Promise.race [AI-assisted]

• Repository: openclaw/openclaw
• Author: luyao618
• State: closed | merged: True
• Link: https://github.com/openclaw/openclaw/pull/71687

Description (problem / solution / changelog)

🤖 AI-assisted (built with Claude Code via Hermes orchestration, reviewed by Codex). Test level: fully tested. Prompt summary available on request.

Summary

• Problem: maybeResolveActiveRecall in the active-memory extension awaits runRecallSubagent() cooperatively — the AbortController fires at timeoutMs but the function blocks until the embedded agent run checks the signal at internal checkpoints. With timeoutMs=5000, real-world wall-clock time reaches 11–13s.
• Why it matters: Interactive conversations become noticeably slower; the configured timeout does not guarantee quick fail-open behavior.
• What changed: Wrapped runRecallSubagent() with Promise.race against a timeout promise tied to the existing AbortController. When the timeout fires first, the function returns { status: "timeout" } immediately. Late subagent rejections are caught silently to prevent unhandled promise errors.
• What did NOT change (scope boundary): The cooperative AbortController still fires to request graceful cleanup of the embedded run. No changes to runRecallSubagent, runEmbeddedPiAgent, or any core agent runtime code.

Change Type (select all)

• Bug fix

Scope (select all touched areas)

• Integrations

Linked Issue/PR

• Closes #71629
• This PR fixes a bug or regression

Root Cause

• Root cause: maybeResolveActiveRecall used a cooperative abort pattern — AbortController.abort() sets signal.aborted = true, but the await runRecallSubagent(...) call blocks until the embedded run's internal retry/failover loop reaches a checkpoint that checks the signal. Between checkpoints (during LLM API calls, tool execution), the abort is ignored.
• Missing detection / guardrail: No Promise.race wrapper to enforce the configured timeout as a hard wall-clock deadline independent of internal abort-signal propagation.
• Contributing context: The embedded agent runner (runEmbeddedPiAgent) has a complex retry loop with multiple cooperative abort checkpoints, but the active-memory caller had no mechanism to return early when those checkpoints are slow to reach.

Regression Test Plan

• Coverage level that should have caught this:
  • Unit test
• Target test or file: extensions/active-memory/index.test.ts
• Scenario the test should lock in: A subagent that blocks for 30s without checking the abort signal must still cause maybeResolveActiveRecall to return within timeoutMs + 500ms margin with status=timeout.
• Why this is the smallest reliable guardrail: Tests the exact boundary between cooperative and preemptive timeout enforcement at the caller level.
• Existing test that already covers this (if any): The existing "ignores late subagent payloads once the active-memory timeout signal has fired" test covers the cooperative path but does not assert wall-clock return time.
• If no new test is added, why not: N/A — new test added.

User-visible / Behavior Changes

• active-memory now returns status=timeout within the configured timeoutMs (plus small scheduling jitter), instead of potentially blocking for 2–3× longer.

Diagram (if applicable)

Before:
[setTimeout fires at timeoutMs] -> [signal.aborted = true] -> [await blocks until embedded run checks signal] -> [return timeout after 11-13s]

After:
[setTimeout fires at timeoutMs] -> [Promise.race resolves TIMEOUT_SENTINEL] -> [return timeout immediately] -> [embedded run continues cleanup in background]

Security Impact (required)

• New permissions/capabilities? No
• Secrets/tokens handling changed? No
• New/changed network calls? No
• Command/tool execution surface changed? No
• Data access scope changed? No

Repro + Verification

Environment

• OS: macOS (Darwin, Apple Silicon)
• Runtime: Node 22+, pnpm
• Model/provider: N/A (unit test uses mocked embedded agent)

Steps

1. Configure active-memory with timeoutMs: 200
2. Mock runEmbeddedPiAgent to block for 30s without checking abort signal
3. Call before_prompt_build and measure wall-clock return time

Expected

• Function returns within ~700ms (200ms timeout + 500ms margin)

Actual

• Before fix: blocks for 30s (or until embedded run cooperatively checks signal)
• After fix: returns within ~205ms with status=timeout

Evidence

• Failing test/log before + passing after
• 64/64 extension tests pass
• oxfmt --check clean

Changed files

• extensions/active-memory/index.test.ts (modified, +38/-0)
• extensions/active-memory/index.ts (modified, +40/-1)