[#639] Harden resolveAgentURI with timeout and validation

[realproject7]

Summary

• 5s timeout: AbortController on remote fetches (https/ipfs) prevents hangs from slow servers
• Response validation: Checks res.ok before parsing body
• 50KB size limit: Enforced on all payload types (remote, data: URI, raw JSON)
• Graceful error handling: Entire function wrapped in try/catch, returns {} on any failure instead of throwing

Fixes #639
Tracks realproject7/agent-os#312

Test plan

• Remote fetch with slow server times out after 5s (returns {})
• Non-200 responses return {} (not crash)
• Invalid JSON returns {} gracefully
• Oversized data: URI payloads return {}
• Normal agent URIs still resolve correctly
• Build passes

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
plotlink	Ignored		Mar 30, 2026 6:59pm

[project7-interns]

Verdict: REQUEST CHANGES

Summary

The timeout and graceful-failure work is headed in the right direction, but the oversized remote-response protection is still incomplete.

Findings

• [high] The remote size check happens only after res.text() has already buffered the entire response body, so an oversized agent URI response can still be fully downloaded into memory before being rejected.
  • File: lib/contracts/erc8004.ts:248
  • Suggestion: Reject oversized remote payloads before or during body consumption. At minimum, gate on Content-Length when present; ideally stream the body and abort once the accumulated byte count exceeds MAX_URI_BYTES.

Decision

Requesting changes because the current implementation does not yet safely handle oversized remote responses, which is part of the issue's acceptance criteria.

[project7-interns]

Verdict: REQUEST CHANGES

Summary

The streamed size-cap fix addresses the earlier buffering issue, but the current implementation introduces a client-side runtime/bundle regression.

Findings

• [high] resolveAgentURI() now uses Buffer.concat(...), but this helper is imported by the client component src/components/AgentManage.tsx, so the change adds a Node-only dependency into client code.
  • File: lib/contracts/erc8004.ts:267
  • Suggestion: Keep the streamed decoding browser-safe. For example, accumulate into a growing Uint8Array, or append decoded chunks via TextDecoder.decode(value, { stream: true }) and finalize once the reader completes.

Decision

Requesting changes because resolveAgentURI() is used from client-side code and the new Buffer dependency can break the runtime or bundle despite the size-limit fix itself being directionally correct.

[project7-interns]

Verdict: APPROVE

Summary

The hardening work now meets the requested scope: resolveAgentURI() adds the timeout, response validation, size limits, graceful parse failure handling, and the streamed body handling is now browser-safe for client-importable code.

Findings

• None.

Decision

Approving on code review. The earlier oversized-response and client-runtime issues are addressed; remaining CI checks are still running but do not block the review verdict.