openclaw - 💡(How to fix) Fix [Bug]: web_search times out with fetchWithSsrFGuard after v2026.5.26 upgrade

Description

After upgrading from v2026.5.20 to v2026.5.26, web_search times out consistently (30s) for all providers (Kimi/Moonshot, DuckDuckGo). web_fetch works fine.

The issue is in fetchWithSsrFGuard — the new SSRF-guarded fetch path introduced in this release.

Steps to Reproduce

1. Upgrade to v2026.5.26
2. Configure tools.web.search.provider: "kimi" with valid Moonshot API key
3. Call web_search({ query: "test" })
4. Observe 30s timeout

Environment

• OS: Ubuntu 25.04 (Linux 7.0.0-15-generic, x64)
• Node.js: v22.22.1
• OpenClaw: v2026.5.26 (10ad3aa) — upgraded from v2026.5.20 (e510042) where search worked
• Gateway: running as systemd service
• Search providers tested: Kimi (api.moonshot.cn), DuckDuckGo (html.duckduckgo.com)
• DN: China mainland

Gateway Log

[fetch-timeout] fetch timeout after 30000ms (elapsed 30000ms) operation=fetchWithSsrFGuard url=https://api.moonshot.cn/v1/chat/completions
[tools] web_search failed: request timed out raw_params={"query":"openclaw test search","count":1}

What Works

• ✅ Direct curl to https://api.moonshot.cn/v1/chat/completions with API key — returns 200 in ~2.3s
• ✅ Node.js native https.request to same endpoint — works fine
• ✅ Node.js fetch() with undici Agent + pinned IP (DNS lookup → connect to resolved IP) — works in ~300ms
• ✅ web_fetch tool — fetches external URLs normally
• ✅ DNS resolution: api.moonshot.cn → CNAME rp68jmko8a6qpuee.aliyunddos1022.com → 8.147.223.37

Debugging Attempts

1. Proxy check: System proxy (mihomo 127.0.0.1:7890) is NOT configured in the Gateway process environment. Added NO_PROXY=api.moonshot.cn,moonshot.cn to the Gateway .env and systemd EnvironmentFile — no effect.

2. SSRF guard path: Traced fetchWithSsrFGuard in the dist. The fetch goes through STRICT mode which calls createPinnedDispatcher with DNS-pinned IP. The createPinnedDispatcher → createHttp1Agent({ connect: { lookup } }) code path looks correct.

3. Reproduction test: Created a standalone Node.js script that recreates the exact same flow (dns.lookup → undici Agent with connect.host set to pinned IP → fetch). Works perfectly in ~300ms.

4. Reverted to DuckDuckGo: Same timeout, so it's not provider-specific.

Suspected Cause

The fetchWithSsrFGuard function (in fetch-guard-BLLDm71I.js) is timing out at the actual fetch call after the pinned dispatcher is created. The DNS pinning and dispatcher creation succeed, but the subsequent fetch using the pinned dispatcher hangs. This could be:

• fetchWithRuntimeDispatcher (used when supportsDispatcherInit is false) behaving differently from globalThis.fetch with dispatcher
• An interaction between createPinnedDispatcher and the specific undici/Node.js environment
• A race condition in buildTimeoutAbortSignal that prevents proper cleanup

Workaround

web_fetch continues to work for fetching specific URLs, but AI-synthesized search results from Kimi/Brave/etc are unavailable.

Regression

This is a regression from v2026.5.20 where web_search worked correctly.