@lousy-agents/cli 5.17.7 → 5.17.9

package/api/copilot-with-fastify/.devcontainer/devcontainer.json

@@ -10,7 +10,7 @@
         },
         "ghcr.io/devcontainers/features/copilot-cli:1.0.0": {},
         "ghcr.io/anthropics/devcontainer-features/claude-code:1": {
-            "version": "v2.1.217"
+            "version": "v2.1.218"
         },
         "ghcr.io/rocker-org/devcontainer-features/apt-packages:1.0.2": {
             "packages": "yamllint, shellcheck",

package/api/copilot-with-fastify/package-lock.json

@@ -18,7 +18,7 @@
             },
             "devDependencies": {
                 "@biomejs/biome": "2.5.3",
-                "@lousy-agents/mcp": "5.17.6",
+                "@lousy-agents/mcp": "5.17.8",
                 "@modelcontextprotocol/server-sequential-thinking": "2026.7.4",
                 "@testcontainers/postgresql": "12.0.4",
                 "@types/node": "24.13.3",
@@ -972,9 +972,9 @@
             }
         },
         "node_modules/@lousy-agents/mcp": {
-            "version": "5.17.6",
-            "resolved": "https://registry.npmjs.org/@lousy-agents/mcp/-/mcp-5.17.6.tgz",
-            "integrity": "sha512-I4QIEAHFDdbbgW78/lg82Imw3rg26lSaDuiFA4STWAfxRAKUuusxcodMC4eZqkcNKGU32XzKDOnPyVVfZN7gNg==",
+            "version": "5.17.8",
+            "resolved": "https://registry.npmjs.org/@lousy-agents/mcp/-/mcp-5.17.8.tgz",
+            "integrity": "sha512-4c6NkQAje237D4DzbY1cH+qvYc2uIX1uZc0KBYZtqSMSUfKrGb4crCR8TcS/HRnM8NGqRXqtnnh/mkiyZyvq+A==",
             "dev": true,
             "license": "BSD-2-Clause-Patent",
             "dependencies": {
@@ -3476,9 +3476,9 @@
             }
         },
         "node_modules/fast-json-stringify/node_modules/fast-uri": {
-            "version": "4.1.0",
-            "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-4.1.0.tgz",
-            "integrity": "sha512-ZodJ2cRiLVWGi9IgPb3mbgSqM4CD3LexCHkuv0FfBXHJI1ADfucTD06m6clO2Cy5RZYsw/SiCVl/dyrFI/SYWA==",
+            "version": "4.1.1",
+            "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-4.1.1.tgz",
+            "integrity": "sha512-YPOs1zD5TG2+EZt+r88LwF6mclA7TPkpwMP7ZN3TO2HiHS8TXvq7QA/17iJsV9dubcLo/f8eEYqMBruyQV21hQ==",
             "funding": [
                 {
                     "type": "github",
@@ -3501,9 +3501,9 @@
             }
         },
         "node_modules/fast-uri": {
-            "version": "3.1.3",
-            "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.3.tgz",
-            "integrity": "sha512-i70LwGWUduXqzicKXWshooq+sWL1K3WUU5rKZNG/0i3a1OSoX3HqhH5WbWwTmqWfor4urUakGPiRQcleRZTwOg==",
+            "version": "3.1.4",
+            "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz",
+            "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==",
             "funding": [
                 {
                     "type": "github",

package/api/copilot-with-fastify/package.json

@@ -29,7 +29,7 @@
     },
     "devDependencies": {
         "@biomejs/biome": "2.5.3",
-        "@lousy-agents/mcp": "5.17.6",
+        "@lousy-agents/mcp": "5.17.8",
         "@modelcontextprotocol/server-sequential-thinking": "2026.7.4",
         "@testcontainers/postgresql": "12.0.4",
         "@types/node": "24.13.3",

package/cli/copilot-with-citty/.devcontainer/devcontainer.json

@@ -10,7 +10,7 @@
         },
         "ghcr.io/devcontainers/features/copilot-cli:1.0.0": {},
         "ghcr.io/anthropics/devcontainer-features/claude-code:1": {
-            "version": "v2.1.217"
+            "version": "v2.1.218"
         },
         "ghcr.io/rocker-org/devcontainer-features/apt-packages:1.0.2": {
             "packages": "yamllint, shellcheck",

package/cli/copilot-with-citty/package.json

@@ -20,7 +20,7 @@
     },
     "devDependencies": {
         "@biomejs/biome": "2.5.3",
-        "@lousy-agents/mcp": "5.17.6",
+        "@lousy-agents/mcp": "5.17.8",
         "@modelcontextprotocol/server-sequential-thinking": "2026.7.4",
         "@types/node": "24.13.3",
         "@upstash/context7-mcp": "3.2.4",

package/dist/index.js

@@ -3032,7 +3032,7 @@ exports.basename = (path, { windows } = {}) => {
 
 
 },
-889(__unused_rspack_module, __unused_rspack___webpack_exports__, __webpack_require__) {
+580(__unused_rspack_module, __unused_rspack___webpack_exports__, __webpack_require__) {
 // NAMESPACE OBJECT: ../../node_modules/micromark/lib/constructs.js
 var constructs_namespaceObject = {};
 __webpack_require__.r(constructs_namespaceObject);
@@ -3790,15 +3790,11 @@ var external_node_child_process_ = __webpack_require__(1421);
 const PINNED_PYTHON_WORKER_SOURCE = String.raw `
 import base64, errno, json, os, secrets, stat, sys
 DIR_FLAGS = os.O_RDONLY
-if hasattr(os, "O_DIRECTORY"):
-    DIR_FLAGS |= os.O_DIRECTORY
-if hasattr(os, "O_NOFOLLOW"):
-    DIR_FLAGS |= os.O_NOFOLLOW
+if hasattr(os, "O_DIRECTORY"): DIR_FLAGS |= os.O_DIRECTORY
+if hasattr(os, "O_NOFOLLOW"): DIR_FLAGS |= os.O_NOFOLLOW
 READ_FLAGS = os.O_RDONLY
-if hasattr(os, "O_NONBLOCK"):
-    READ_FLAGS |= os.O_NONBLOCK
-if hasattr(os, "O_NOFOLLOW"):
-    READ_FLAGS |= os.O_NOFOLLOW
+if hasattr(os, "O_NONBLOCK"): READ_FLAGS |= os.O_NONBLOCK
+if hasattr(os, "O_NOFOLLOW"): READ_FLAGS |= os.O_NOFOLLOW
 WRITE_FLAGS = os.O_WRONLY | os.O_CREAT | os.O_EXCL
 if hasattr(os, "O_NOFOLLOW"):
     WRITE_FLAGS |= os.O_NOFOLLOW
@@ -3878,6 +3874,10 @@ def write_all(fd, data):
         if written <= 0:
             raise OSError(errno.EIO, "short write")
         view = view[written:]
+def fsync_best_effort(fd):
+    try: os.fsync(fd)
+    except OSError as error:
+        if error.errno != errno.EPERM: raise
 def link_unsupported(exc):
     unsupported = (errno.EPERM, errno.EOPNOTSUPP, getattr(errno, "ENOTSUP", errno.EOPNOTSUPP))
     return getattr(exc, "errno", None) in unsupported
@@ -4083,13 +4083,13 @@ def write_path(root_fd, payload):
         temp_name, temp_fd = create_temp_file(parent_fd, basename, mode)
         os.fchmod(temp_fd, mode)
         write_all(temp_fd, data)
-        os.fsync(temp_fd)
+        fsync_best_effort(temp_fd)
         temp_stat = os.fstat(temp_fd)
         os.close(temp_fd)
         temp_fd = None
         result_stat = commit_temp_file(parent_fd, temp_name, basename, overwrite, mode, temp_stat)
         temp_name = None
-        os.fsync(parent_fd)
+        fsync_best_effort(parent_fd)
         return {"dev": result_stat.st_dev, "ino": result_stat.st_ino}
     finally:
         if temp_fd is not None:
@@ -4516,29 +4516,34 @@ async function runPinnedPathHelper(params) {
     }
 }
 
-;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/sidecar-lock.js
-
+;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/sidecar-lock-reclaim.js
 
 
 
-const GLOBAL_STATE_KEY = Symbol.for("fsSafe.sidecarLockManagers");
-function getGlobalManagers() {
-    const globalWithState = globalThis;
-    if (!globalWithState[GLOBAL_STATE_KEY]) {
-        globalWithState[GLOBAL_STATE_KEY] = new Map();
+const SIDECAR_LOCK_OWNERSHIP_TOKEN_BYTES = 16;
+const SIDECAR_LOCK_OWNERSHIP_TOKEN_BITS = SIDECAR_LOCK_OWNERSHIP_TOKEN_BYTES * 8;
+const SIDECAR_LOCK_OWNERSHIP_TOKEN_PREFIX = "\t".repeat(8);
+const SIDECAR_LOCK_OWNERSHIP_TOKEN_PATTERN = new RegExp(`\\n(${SIDECAR_LOCK_OWNERSHIP_TOKEN_PREFIX}[ \\t]{${SIDECAR_LOCK_OWNERSHIP_TOKEN_BITS}})\\n$`);
+function createSidecarLockOwnershipToken() {
+    let token = SIDECAR_LOCK_OWNERSHIP_TOKEN_PREFIX;
+    for (const byte of (0,external_node_crypto_.randomBytes)(SIDECAR_LOCK_OWNERSHIP_TOKEN_BYTES)) {
+        for (let bit = 7; bit >= 0; bit -= 1) {
+            token += byte & (1 << bit) ? "\t" : " ";
+        }
     }
-    return globalWithState[GLOBAL_STATE_KEY];
+    return token;
 }
-function resolveManagerState(key) {
-    const managers = getGlobalManagers();
-    let state = managers.get(key);
-    if (!state) {
-        state = { cleanupRegistered: false, held: new Map() };
-        managers.set(key, state);
-    }
-    return state;
+function readSidecarLockOwnershipToken(raw) {
+    return SIDECAR_LOCK_OWNERSHIP_TOKEN_PATTERN.exec(raw)?.[1];
+}
+function serializeSidecarLockPayload(payload) {
+    const ownershipToken = createSidecarLockOwnershipToken();
+    return {
+        raw: `${JSON.stringify(payload, null, 2)}\n${ownershipToken}\n`,
+        ownershipToken,
+    };
 }
-async function readLockSnapshot(lockPath) {
+async function readSidecarLockSnapshot(lockPath) {
     try {
         const stat = await promises_.lstat(lockPath);
         const raw = await promises_.readFile(lockPath, "utf8");
@@ -4560,7 +4565,15 @@ async function readLockSnapshot(lockPath) {
         throw err;
     }
 }
-function snapshotMatches(current, observed) {
+function sidecarLockSnapshotMatches(current, observed) {
+    if (observed.ownershipToken !== undefined) {
+        return (current.stat?.isFile() === true &&
+            current.raw !== undefined &&
+            observed.raw !== undefined &&
+            readSidecarLockOwnershipToken(current.raw) === observed.ownershipToken &&
+            readSidecarLockOwnershipToken(observed.raw) === observed.ownershipToken &&
+            current.raw === observed.raw);
+    }
     if (observed.stat && current.stat && !file_identity_sameFileIdentity(observed.stat, current.stat)) {
         return false;
     }
@@ -4569,30 +4582,54 @@ function snapshotMatches(current, observed) {
     }
     return observed.stat !== undefined && current.stat !== undefined;
 }
-async function removeLockIfUnchanged(lockPath, observed) {
-    const current = await readLockSnapshot(lockPath);
-    if (!current || !observed) {
-        return false;
-    }
-    if (!snapshotMatches(current, observed)) {
-        // The lock changed after we decided it was stale. Leave the fresh holder's
-        // file alone; deleting by path here would break mutual exclusion.
+async function removeSidecarLockIfUnchanged(lockPath, observed) {
+    const current = await readSidecarLockSnapshot(lockPath);
+    if (!current || !observed || !sidecarLockSnapshotMatches(current, observed)) {
         return false;
     }
     await promises_.rm(lockPath, { force: true }).catch(() => undefined);
     return true;
 }
-async function lockSnapshotStillPresent(lockPath, observed) {
-    const current = await readLockSnapshot(lockPath);
-    return !!current && !!observed && snapshotMatches(current, observed);
+async function sidecarLockSnapshotStillPresent(lockPath, observed) {
+    const current = await readSidecarLockSnapshot(lockPath);
+    return !!current && !!observed && sidecarLockSnapshotMatches(current, observed);
 }
-async function removeStaleLockIfAllowed(params) {
-    if (!params.shouldRemoveStaleLock) {
-        return "not-approved";
+async function sidecarReclaimGuardExists(pathname) {
+    try {
+        await promises_.lstat(pathname);
+        return true;
+    }
+    catch (err) {
+        if (err.code === "ENOENT") {
+            return false;
+        }
+        throw err;
     }
-    if (params.snapshot.raw === undefined) {
+}
+async function tryAcquireSidecarReclaimGuard(reclaimGuards, reclaimGuardPath) {
+    try {
+        await promises_.mkdir(reclaimGuardPath);
+        reclaimGuards.add(reclaimGuardPath);
+        return true;
+    }
+    catch (err) {
+        if (err.code === "EEXIST") {
+            return false;
+        }
+        throw err;
+    }
+}
+async function releaseSidecarReclaimGuard(reclaimGuards, reclaimGuardPath) {
+    await promises_.rmdir(reclaimGuardPath);
+    reclaimGuards.delete(reclaimGuardPath);
+}
+async function removeStaleSidecarLockIfAllowed(params) {
+    if (!params.shouldRemoveStaleLock || params.snapshot.raw === undefined) {
         return "not-approved";
     }
+    if (!(await sidecarLockSnapshotStillPresent(params.lockPath, params.snapshot))) {
+        return "changed";
+    }
     if (!(await params.shouldRemoveStaleLock({
         lockPath: params.lockPath,
         normalizedTargetPath: params.normalizedTargetPath,
@@ -4601,32 +4638,95 @@ async function removeStaleLockIfAllowed(params) {
     }))) {
         return "not-approved";
     }
-    const current = await readLockSnapshot(params.lockPath);
-    if (!current || !snapshotMatches(current, params.snapshot)) {
+    if (!(await sidecarLockSnapshotStillPresent(params.lockPath, params.snapshot))) {
         return "changed";
     }
     try {
-        await promises_.rm(params.lockPath, { force: true });
+        await promises_.rm(params.lockPath);
+        return "removed";
     }
     catch (err) {
         if (err.code === "ENOENT") {
             return "changed";
         }
-        return "not-approved";
+        throw err;
+    }
+}
+
+;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/sidecar-lock.js
+
+
+
+
+
+const GLOBAL_STATE_KEY = Symbol.for("fsSafe.sidecarLockManagers");
+function getGlobalManagers() {
+    const globalWithState = globalThis;
+    if (!globalWithState[GLOBAL_STATE_KEY]) {
+        globalWithState[GLOBAL_STATE_KEY] = new Map();
     }
-    return "removed";
+    return globalWithState[GLOBAL_STATE_KEY];
+}
+function resolveManagerState(key) {
+    const managers = getGlobalManagers();
+    let state = managers.get(key);
+    if (!state) {
+        state = {
+            cleanupRegistered: false,
+            held: new Map(),
+            reclaimCleanupRegistered: false,
+            reclaimGuards: new Set(),
+        };
+        managers.set(key, state);
+    }
+    else {
+        // The global manager symbol is shared across package copies and hot reloads.
+        // Backfill state created by fs-safe versions that predate reclaim guards.
+        state.reclaimCleanupRegistered ??= false;
+        state.reclaimGuards ??= new Set();
+    }
+    return state;
 }
 function snapshotMatchesSync(lockPath, observed) {
+    let fd;
     try {
-        const stat = external_node_fs_.lstatSync(lockPath);
-        if (observed.stat && !file_identity_sameFileIdentity(observed.stat, stat)) {
+        const beforeStat = external_node_fs_.lstatSync(lockPath);
+        if (!beforeStat.isFile()) {
+            return false;
+        }
+        const openFlags = external_node_fs_.constants.O_RDONLY |
+            (process.platform !== "win32" && typeof external_node_fs_.constants.O_NOFOLLOW === "number"
+                ? external_node_fs_.constants.O_NOFOLLOW
+                : 0) |
+            (typeof external_node_fs_.constants.O_NONBLOCK === "number" ? external_node_fs_.constants.O_NONBLOCK : 0);
+        fd = external_node_fs_.openSync(lockPath, openFlags);
+        const openedStat = external_node_fs_.fstatSync(fd);
+        if (!openedStat.isFile()) {
+            return false;
+        }
+        if (observed.raw !== undefined && openedStat.size !== Buffer.byteLength(observed.raw)) {
             return false;
         }
-        return observed.raw === undefined || external_node_fs_.readFileSync(lockPath, "utf8") === observed.raw;
+        const raw = external_node_fs_.readFileSync(fd, "utf8");
+        const afterStat = external_node_fs_.lstatSync(lockPath);
+        if (!afterStat.isFile() || !file_identity_sameFileIdentity(beforeStat, afterStat)) {
+            return false;
+        }
+        return sidecarLockSnapshotMatches({ raw, payload: null, stat: afterStat }, observed);
     }
     catch {
         return false;
     }
+    finally {
+        if (fd !== undefined) {
+            try {
+                external_node_fs_.closeSync(fd);
+            }
+            catch {
+                // Best-effort process-exit cleanup.
+            }
+        }
+    }
 }
 async function resolveNormalizedTargetPath(targetPath) {
     const resolved = external_node_path_.resolve(targetPath);
@@ -4661,6 +4761,17 @@ async function defaultShouldReclaim(params) {
         return true;
     }
 }
+function releaseAllReclaimGuardsSync(state) {
+    for (const reclaimGuardPath of state.reclaimGuards) {
+        try {
+            external_node_fs_.rmdirSync(reclaimGuardPath);
+            state.reclaimGuards.delete(reclaimGuardPath);
+        }
+        catch {
+            // Best-effort process-exit cleanup. A surviving guard fails closed.
+        }
+    }
+}
 function releaseAllLocksSync(state) {
     for (const [normalizedTargetPath, held] of state.held) {
         void held.handle.close().catch(() => undefined);
@@ -4674,6 +4785,7 @@ function releaseAllLocksSync(state) {
         }
         state.held.delete(normalizedTargetPath);
     }
+    releaseAllReclaimGuardsSync(state);
 }
 async function releaseHeldLock(state, normalizedTargetPath, held, opts = {}) {
     const current = state.held.get(normalizedTargetPath);
@@ -4696,7 +4808,7 @@ async function releaseHeldLock(state, normalizedTargetPath, held, opts = {}) {
     state.held.delete(normalizedTargetPath);
     held.releasePromise = (async () => {
         await held.handle.close().catch(() => undefined);
-        await removeLockIfUnchanged(held.lockPath, held.snapshot);
+        await removeSidecarLockIfUnchanged(held.lockPath, held.snapshot);
     })();
     try {
         await held.releasePromise;
@@ -4709,11 +4821,16 @@ async function releaseHeldLock(state, normalizedTargetPath, held, opts = {}) {
 function createSidecarLockManager(key) {
     const state = resolveManagerState(key);
     function ensureExitCleanupRegistered() {
-        if (state.cleanupRegistered) {
+        if (!state.cleanupRegistered) {
+            state.cleanupRegistered = true;
+            state.reclaimCleanupRegistered = true;
+            process.on("exit", () => releaseAllLocksSync(state));
             return;
         }
-        state.cleanupRegistered = true;
-        process.on("exit", () => releaseAllLocksSync(state));
+        if (!state.reclaimCleanupRegistered) {
+            state.reclaimCleanupRegistered = true;
+            process.on("exit", () => releaseAllReclaimGuardsSync(state));
+        }
     }
     async function acquire(options) {
         ensureExitCleanupRegistered();
@@ -4733,108 +4850,146 @@ function createSidecarLockManager(key) {
         const startedAt = Date.now();
         const retry = options.retry ?? {};
         const maxRetries = options.timeoutMs === Number.POSITIVE_INFINITY ? undefined : retry.retries;
+        const reclaimGuardPath = `${lockPath}.reclaim`;
+        let ownsReclaimGuard = false;
         let attempt = 0;
-        while (true) {
-            let handle = null;
-            try {
-                handle = await promises_.open(lockPath, "wx");
-                const payload = await options.payload();
-                const raw = `${JSON.stringify(payload, null, 2)}\n`;
-                await handle.writeFile(raw, "utf8");
-                const snapshot = { raw, payload, stat: await handle.stat() };
-                const createdHeld = {
-                    count: 1,
-                    handle,
-                    lockPath,
-                    snapshot,
-                    acquiredAt: Date.now(),
-                    metadata: options.metadata ?? {},
-                };
-                state.held.set(normalizedTargetPath, createdHeld);
-                const release = () => releaseHeldLock(state, normalizedTargetPath, createdHeld).then(() => undefined);
-                return {
+        const waitForRetry = async () => {
+            const elapsed = Date.now() - startedAt;
+            if ((options.timeoutMs !== undefined &&
+                options.timeoutMs !== Number.POSITIVE_INFINITY &&
+                elapsed >= options.timeoutMs) ||
+                (maxRetries !== undefined && attempt >= maxRetries)) {
+                throw Object.assign(new Error(`file lock timeout for ${normalizedTargetPath}`), {
+                    code: "file_lock_timeout",
                     lockPath,
                     normalizedTargetPath,
-                    release,
-                    [Symbol.asyncDispose]: release,
-                };
+                });
             }
-            catch (err) {
-                if (handle) {
-                    const failedSnapshot = { payload: null };
-                    try {
-                        failedSnapshot.stat = await handle.stat();
-                    }
-                    catch {
-                        // Best-effort cleanup of a failed exclusive create.
-                    }
-                    const current = state.held.get(normalizedTargetPath);
-                    if (current?.handle === handle) {
-                        state.held.delete(normalizedTargetPath);
-                    }
-                    // If payload serialization/write fails, the file may be empty or
-                    // partial JSON, so remove while our exclusive handle is still open.
-                    await promises_.rm(lockPath, { force: true }).catch(() => undefined);
-                    await handle.close().catch(() => undefined);
-                    // Windows can refuse removing an open file; retry after close but
-                    // only if the path still points at the file identity we created.
-                    await removeLockIfUnchanged(lockPath, failedSnapshot);
-                }
-                if (err.code !== "EEXIST") {
-                    throw err;
-                }
-                const nowMs = Date.now();
-                const snapshot = await readLockSnapshot(lockPath);
-                if (!snapshot) {
+            const remaining = options.timeoutMs === undefined || options.timeoutMs === Number.POSITIVE_INFINITY
+                ? Number.POSITIVE_INFINITY
+                : Math.max(0, options.timeoutMs - elapsed);
+            const delay = Math.min(computeDelayMs(retry, attempt), remaining);
+            attempt += 1;
+            await new Promise((resolve) => setTimeout(resolve, delay));
+        };
+        try {
+            while (true) {
+                if (!ownsReclaimGuard && (await sidecarReclaimGuardExists(reclaimGuardPath))) {
+                    await waitForRetry();
                     continue;
                 }
-                const shouldReclaim = options.shouldReclaim ?? defaultShouldReclaim;
-                if (await shouldReclaim({
-                    lockPath,
-                    normalizedTargetPath,
-                    payload: snapshot?.payload ?? null,
-                    staleMs: options.staleMs,
-                    nowMs,
-                    heldByThisProcess: state.held.has(normalizedTargetPath),
-                })) {
-                    if (!(await lockSnapshotStillPresent(lockPath, snapshot))) {
-                        continue;
-                    }
-                    const staleRecovery = options.staleRecovery ?? "fail-closed";
-                    if (staleRecovery === "remove-if-unchanged") {
-                        const removal = await removeStaleLockIfAllowed({
-                            lockPath,
-                            normalizedTargetPath,
-                            snapshot,
-                            shouldRemoveStaleLock: options.shouldRemoveStaleLock,
-                        });
-                        if (removal === "removed" || removal === "changed") {
-                            continue;
+                let handle = null;
+                try {
+                    handle = await promises_.open(lockPath, "wx");
+                    const payload = await options.payload();
+                    const { raw, ownershipToken } = serializeSidecarLockPayload(payload);
+                    await handle.writeFile(raw, "utf8");
+                    const snapshot = { raw, payload, stat: await handle.stat(), ownershipToken };
+                    const createdHeld = {
+                        count: 1,
+                        handle,
+                        lockPath,
+                        snapshot,
+                        acquiredAt: Date.now(),
+                        metadata: options.metadata ?? {},
+                    };
+                    state.held.set(normalizedTargetPath, createdHeld);
+                    if (ownsReclaimGuard) {
+                        try {
+                            await releaseSidecarReclaimGuard(state.reclaimGuards, reclaimGuardPath);
+                            ownsReclaimGuard = false;
+                        }
+                        catch (err) {
+                            await releaseHeldLock(state, normalizedTargetPath, createdHeld, { force: true });
+                            throw err;
                         }
                     }
-                    throw Object.assign(new Error(`file lock stale for ${normalizedTargetPath}`), {
-                        code: "file_lock_stale",
+                    const release = () => releaseHeldLock(state, normalizedTargetPath, createdHeld).then(() => undefined);
+                    return {
                         lockPath,
                         normalizedTargetPath,
-                    });
+                        release,
+                        [Symbol.asyncDispose]: release,
+                    };
                 }
-                const elapsed = Date.now() - startedAt;
-                if ((options.timeoutMs !== undefined &&
-                    options.timeoutMs !== Number.POSITIVE_INFINITY &&
-                    elapsed >= options.timeoutMs) ||
-                    (maxRetries !== undefined && attempt >= maxRetries)) {
-                    throw Object.assign(new Error(`file lock timeout for ${normalizedTargetPath}`), {
-                        code: "file_lock_timeout",
+                catch (err) {
+                    if (handle) {
+                        const failedSnapshot = { payload: null };
+                        try {
+                            failedSnapshot.stat = await handle.stat();
+                        }
+                        catch {
+                            // Best-effort cleanup of a failed exclusive create.
+                        }
+                        const current = state.held.get(normalizedTargetPath);
+                        if (current?.handle === handle) {
+                            state.held.delete(normalizedTargetPath);
+                        }
+                        // If payload serialization/write fails, the file may be empty or
+                        // partial JSON, so remove while our exclusive handle is still open.
+                        await promises_.rm(lockPath, { force: true }).catch(() => undefined);
+                        await handle.close().catch(() => undefined);
+                        // Windows can refuse removing an open file; retry after close but
+                        // only if the path still points at the file identity we created.
+                        await removeSidecarLockIfUnchanged(lockPath, failedSnapshot);
+                    }
+                    if (err.code !== "EEXIST") {
+                        throw err;
+                    }
+                    if (ownsReclaimGuard) {
+                        await releaseSidecarReclaimGuard(state.reclaimGuards, reclaimGuardPath);
+                        ownsReclaimGuard = false;
+                        continue;
+                    }
+                    const nowMs = Date.now();
+                    const snapshot = await readSidecarLockSnapshot(lockPath);
+                    if (!snapshot) {
+                        continue;
+                    }
+                    const shouldReclaim = options.shouldReclaim ?? defaultShouldReclaim;
+                    if (await shouldReclaim({
                         lockPath,
                         normalizedTargetPath,
-                    });
+                        payload: snapshot?.payload ?? null,
+                        staleMs: options.staleMs,
+                        nowMs,
+                        heldByThisProcess: state.held.has(normalizedTargetPath),
+                    })) {
+                        if (!(await sidecarLockSnapshotStillPresent(lockPath, snapshot))) {
+                            continue;
+                        }
+                        const staleRecovery = options.staleRecovery ?? "fail-closed";
+                        if (staleRecovery === "remove-if-unchanged") {
+                            if (!(await tryAcquireSidecarReclaimGuard(state.reclaimGuards, reclaimGuardPath))) {
+                                await waitForRetry();
+                                continue;
+                            }
+                            ownsReclaimGuard = true;
+                            const removal = await removeStaleSidecarLockIfAllowed({
+                                lockPath,
+                                normalizedTargetPath,
+                                snapshot,
+                                shouldRemoveStaleLock: options.shouldRemoveStaleLock,
+                            });
+                            if (removal === "removed" || removal === "changed") {
+                                continue;
+                            }
+                            await releaseSidecarReclaimGuard(state.reclaimGuards, reclaimGuardPath);
+                            ownsReclaimGuard = false;
+                        }
+                        throw Object.assign(new Error(`file lock stale for ${normalizedTargetPath}`), {
+                            code: "file_lock_stale",
+                            lockPath,
+                            normalizedTargetPath,
+                        });
+                    }
+                    await waitForRetry();
                 }
-                const remaining = options.timeoutMs === undefined || options.timeoutMs === Number.POSITIVE_INFINITY
-                    ? Number.POSITIVE_INFINITY
-                    : Math.max(0, options.timeoutMs - elapsed);
-                const delay = Math.min(computeDelayMs(retry, attempt), remaining);
-                attempt += 1;
-                await new Promise((resolve) => setTimeout(resolve, delay));
+            }
+        }
+        finally {
+            if (ownsReclaimGuard) {
+                await releaseSidecarReclaimGuard(state.reclaimGuards, reclaimGuardPath).catch(() => undefined);
             }
         }
     }
@@ -4921,6 +5076,16 @@ function assertWithinMaxBytes(bytes, maxBytes) {
         throw new errors_FsSafeError("too-large", `file exceeds limit of ${maxBytes} bytes (got at least ${bytes})`);
     }
 }
+async function syncFileBestEffort(handle) {
+    try {
+        await handle.sync();
+    }
+    catch (error) {
+        if (error?.code !== "EPERM") {
+            throw error;
+        }
+    }
+}
 async function writeStreamToHandle(stream, handle, maxBytes) {
     let bytes = 0;
     for await (const chunk of stream) {
@@ -5082,7 +5247,7 @@ async function runPinnedWriteFallback(params) {
             else {
                 await writeStreamToHandle(params.input.stream, handle, params.maxBytes);
             }
-            await handle.sync();
+            await syncFileBestEffort(handle);
             const stat = await handle.stat();
             await handle.close().catch(() => undefined);
             await syncDirectoryBestEffort(parentPath);
@@ -5127,7 +5292,7 @@ async function runPinnedWriteFallback(params) {
             throw new errors_FsSafeError("path-mismatch", "fallback temp path changed during write");
         }
         const expectedTempStat = tempStat;
-        await handle.sync();
+        await syncFileBestEffort(handle);
         await handle.close().catch(() => undefined);
         handle = undefined;
         await withAsyncDirectoryGuards([parentGuard], async () => {
@@ -6036,16 +6201,104 @@ function assertNoUnsafeDeviceReadPath(filePath, options) {
     }
 }
 
+;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/bounded-read.js
+
+
+const READ_CHUNK_BYTES = 64 * 1024;
+function assertMaxBytes(maxBytes) {
+    if (maxBytes === Number.POSITIVE_INFINITY) {
+        return;
+    }
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < 0) {
+        throw new RangeError("maxBytes must be a non-negative safe integer or Infinity");
+    }
+}
+function createScratchBuffer(maxBytes) {
+    const initialReadBytes = Number.isFinite(maxBytes)
+        ? Math.min(READ_CHUNK_BYTES, maxBytes + 1)
+        : READ_CHUNK_BYTES;
+    return Buffer.allocUnsafe(Math.max(1, initialReadBytes));
+}
+function nextReadLength(total, maxBytes, capacity) {
+    return Number.isFinite(maxBytes)
+        ? Math.min(capacity, maxBytes - total + 1)
+        : capacity;
+}
+function appendChunk(params) {
+    const total = params.total + params.bytesRead;
+    if (total > params.maxBytes) {
+        throw new errors_FsSafeError("too-large", `file exceeds limit of ${params.maxBytes} bytes (got at least ${total})`);
+    }
+    params.chunks.push(Buffer.from(params.scratch.subarray(0, params.bytesRead)));
+    return total;
+}
+async function readBoundedAsync(maxBytes, readChunk) {
+    assertMaxBytes(maxBytes);
+    const chunks = [];
+    const scratch = createScratchBuffer(maxBytes);
+    let total = 0;
+    while (true) {
+        const length = nextReadLength(total, maxBytes, scratch.length);
+        const bytesRead = await readChunk(scratch, length);
+        if (bytesRead === 0) {
+            return Buffer.concat(chunks, total);
+        }
+        total = appendChunk({ chunks, scratch, bytesRead, total, maxBytes });
+    }
+}
+/**
+ * Reads from the handle's current offset without closing it. A bounded read
+ * consumes at most maxBytes + 1 bytes so growth after an earlier stat cannot
+ * force an unbounded allocation.
+ */
+async function readFileHandleBounded(handle, maxBytes) {
+    return await readBoundedAsync(maxBytes, async (scratch, length) => {
+        return (await handle.read(scratch, 0, length, null)).bytesRead;
+    });
+}
+function readDescriptorChunk(fd, scratch, length) {
+    return new Promise((resolve, reject) => {
+        fs.read(fd, scratch, 0, length, null, (error, bytesRead) => {
+            if (error) {
+                reject(error);
+                return;
+            }
+            resolve(bytesRead);
+        });
+    });
+}
+/** Async bounded read from a numeric descriptor. The caller owns the descriptor. */
+async function readFileDescriptorBounded(fd, maxBytes) {
+    return await readBoundedAsync(maxBytes, async (scratch, length) => {
+        return await readDescriptorChunk(fd, scratch, length);
+    });
+}
+/** Sync bounded read from a numeric descriptor. The caller owns the descriptor. */
+function readFileDescriptorBoundedSync(fd, maxBytes) {
+    assertMaxBytes(maxBytes);
+    const chunks = [];
+    const scratch = createScratchBuffer(maxBytes);
+    let total = 0;
+    while (true) {
+        const length = nextReadLength(total, maxBytes, scratch.length);
+        const bytesRead = fs.readSync(fd, scratch, 0, length, null);
+        if (bytesRead === 0) {
+            return Buffer.concat(chunks, total);
+        }
+        total = appendChunk({ chunks, scratch, bytesRead, total, maxBytes });
+    }
+}
+
 ;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/read-opened-file.js
 
+
 async function read_opened_file_readOpenedFileSafely(params) {
     if (params.maxBytes !== undefined && params.opened.stat.size > params.maxBytes) {
         throw new errors_FsSafeError("too-large", `file exceeds limit of ${params.maxBytes} bytes (got ${params.opened.stat.size})`);
     }
-    const buffer = await params.opened.handle.readFile();
-    if (params.maxBytes !== undefined && buffer.byteLength > params.maxBytes) {
-        throw new errors_FsSafeError("too-large", `file exceeds limit of ${params.maxBytes} bytes (got ${buffer.byteLength})`);
-    }
+    const buffer = params.maxBytes === undefined
+        ? await params.opened.handle.readFile()
+        : await readFileHandleBounded(params.opened.handle, params.maxBytes);
     return {
         buffer,
         realPath: params.opened.realPath,
@@ -62073,4 +62326,4 @@ if (installedChunkData !== 0) { // 0 means "already installed".'
 // module factories are used so entry inlining is disabled
 // startup
 // Load entry module and return exports
-var __webpack_exports__ = __webpack_require__(889);
+var __webpack_exports__ = __webpack_require__(580);

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@lousy-agents/cli",
-    "version": "5.17.7",
+    "version": "5.17.9",
     "description": "CLI scaffolding tool that sets up projects with structure, instructions, and feedback loops for AI coding assistants",
     "type": "module",
     "repository": {

package/ui/copilot-with-react/.devcontainer/devcontainer.json

@@ -10,7 +10,7 @@
         },
         "ghcr.io/devcontainers/features/copilot-cli:1.0.0": {},
         "ghcr.io/anthropics/devcontainer-features/claude-code:1": {
-            "version": "v2.1.217"
+            "version": "v2.1.218"
         },
         "ghcr.io/rocker-org/devcontainer-features/apt-packages:1.0.2": {
             "packages": "libnss3, libnspr4, libatk1.0-0t64, libatk-bridge2.0-0t64, libcups2t64, libdrm2, libdbus-1-3, libatspi2.0-0t64, libxcomposite1, libxdamage1, libxfixes3, libxrandr2, libgbm1, libxkbcommon0, libasound2t64, yamllint, shellcheck",

package/ui/copilot-with-react/package.json

@@ -16,14 +16,14 @@
         "@emotion/server": "11.11.0",
         "@mui/material": "9.2.0",
         "@mui/material-nextjs": "9.1.1",
-        "next": "16.2.10",
+        "next": "16.2.11",
         "react": "19.2.8",
         "react-dom": "19.2.8"
     },
     "devDependencies": {
         "@biomejs/biome": "2.5.3",
         "@eslint/eslintrc": "3.3.6",
-        "@lousy-agents/mcp": "5.17.6",
+        "@lousy-agents/mcp": "5.17.8",
         "@modelcontextprotocol/server-sequential-thinking": "2026.7.4",
         "@testing-library/jest-dom": "7.0.0",
         "@testing-library/react": "16.3.2",
@@ -34,8 +34,8 @@
         "@vitejs/plugin-react": "6.0.4",
         "@vitest/ui": "4.1.10",
         "eslint": "10.7.0",
-        "eslint-config-next": "16.2.10",
-        "happy-dom": "20.11.0",
+        "eslint-config-next": "16.2.11",
+        "happy-dom": "20.11.1",
         "jsdom": "29.1.1",
         "typescript": "7.0.2",
         "vitest": "4.1.10",