openclaw - 💡(How to fix) Fix UA interceptor replacement relies on undocumented axios `handlers` internal [1 comments, 2 participants]

Severity: low / Confidence: high / Category: maintainability Triage: risk Detected against: openclaw v2026.5.18 (latest stable at time of scan, 2026-05-18) Tooling: clawpatch 0.3.0 + acpx/claude-sonnet-4-5 via Brad Mills protocol

Evidence

• extensions/feishu/src/client.ts:72-81 (None)

inst.interceptors.request.handlers = [];
    inst.interceptors.request.use((req: unknown) => {
      const r = req as { headers?: Record<string, string> };
      if (r.headers) {
        r.headers["User-Agent"] = getFeishuUserAgent();
      }
      return req;
    });

Reasoning

The code directly assigns to interceptors.request.handlers, which is an undocumented internal of axios's InterceptorManager. Axios v1.x changed the internal representation (array of handler objects vs a sparse array). If a future @larksuiteoapi/node-sdk upgrade bumps its axios version and the property is renamed or restructured, the optional-chain guard inst.interceptors?.request would still pass (the object exists) but handlers = [] would set a property on a different or incompatible structure, causing the clear to silently no-op. The SDK's original UA interceptor would then remain active and silently overwrite the custom UA on every request. The code comment acknowledges upgrade risk but doesn't address the silent-failure path.

Reproduction

Upgrade @larksuiteoapi/node-sdk to a version that bundles axios v1.x (if not already); the handlers clear may silently fail, causing requests to carry the SDK's default UA instead of the custom one.

Recommendation

Instead of clearing the handlers array, register the custom UA interceptor first (FIFO) and have it always overwrite the header regardless of ordering, making the approach resilient to SDK interceptor re-ordering. Alternatively, track whether the clear succeeded (e.g. check handlers.length before/after) and log a warning if it did not.

Why existing tests miss this

All tests mock ./client.js; the module-level IIFE is never executed. No test verifies the actual outgoing User-Agent header on HTTP requests.

Suggested regression test

In client.test.ts: after importing the module, verify that Lark.defaultHttpInstance interceptors include exactly one handler and that it sets the expected User-Agent string.

Minimum fix scope

Replace the handlers = [] clear with an approach that does not depend on axios internals, such as always-overwriting the header in the interceptor or using a different interception point.

Standardized clawpatch finding. Persistent in v2026.5.18 (not resolved by upgrading from v2026.5.12). Finding ID: fnd_sig-feat-cli-command-1e533463a4-_69f4cf58c0.