fix(github): bound guard response bodies

test/scripts/dependency-guard-script.test.ts

@@ -2,6 +2,7 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
 import {
   GITHUB_ERROR_BODY_MAX_BYTES,
+  GITHUB_RESPONSE_BODY_MAX_BYTES,
   canAutoscrubPullRequest,
   createAutoscrubCommit,
   dependencyGuardCommentAuthors,
@@ -669,6 +670,21 @@ describe("dependency guard script", () => {
     }
   });
 
+  it("bounds successful GitHub API response bodies", async () => {
+    const request = githubApi("token", {
+      responseMaxBodyBytes: 64,
+      fetchImpl: (() =>
+        Promise.resolve(
+          new Response("x".repeat(65), {
+            headers: { "content-length": "65" },
+          }),
+        )) as typeof fetch,
+    }).request("/repos/openclaw/openclaw");
+
+    await expect(request).rejects.toThrow("GitHub response body exceeded 64 bytes");
+    expect(GITHUB_RESPONSE_BODY_MAX_BYTES).toBeGreaterThan(64);
+  });
+
   it("aborts stalled GitHub API fetches at the request timeout", async () => {
     let signal: AbortSignal | undefined;
     let markFetchStarted!: () => void;

test/scripts/security-sensitive-guard-script.test.ts

@@ -1,11 +1,13 @@
 // Security Sensitive Guard Script tests cover sensitive file guard behavior.
 import { describe, expect, it } from "vitest";
 import {
+  GITHUB_RESPONSE_BODY_MAX_BYTES,
   allowSecuritySensitiveCommand,
   collectSecuritySensitiveChanges,
   findSecuritySensitiveOverrideCommand,
   findSecuritySensitiveOverrideCommandAsync,
   findTrustedSecuritySensitiveGuardActor,
+  githubApi,
   isSecuritySensitiveFile,
   isSecuritySensitiveGuardAuthorizedForHead,
   isSecuritySensitiveGuardMarkerComment,
@@ -245,4 +247,19 @@ describe("security-sensitive guard script", () => {
       new Set(["vincentkoc", "steipete", "joshavant"]),
     );
   });
+
+  it("bounds successful GitHub API response bodies", async () => {
+    const request = githubApi("token", {
+      responseMaxBodyBytes: 64,
+      fetchImpl: (() =>
+        Promise.resolve(
+          new Response("x".repeat(65), {
+            headers: { "content-length": "65" },
+          }),
+        )) as typeof fetch,
+    }).request("/repos/openclaw/openclaw");
+
+    await expect(request).rejects.toThrow("GitHub response body exceeded 64 bytes");
+    expect(GITHUB_RESPONSE_BODY_MAX_BYTES).toBeGreaterThan(64);
+  });
 });