npm - @openclaw/lobster - Versions diffs - 2026.7.2-beta.5 → 2026.8.1-beta.2 - Mend

Files changed (771) hide show

package/node_modules/{fast-uri → @clawdbot/lobster/node_modules/fast-uri}/test/security.test.js RENAMED Viewed

@@ -221,3 +221,139 @@ test('parse does not reject a literal backslash in the query or fragment', (t) =
   t.notOk(parsed.error, 'backslash in query/fragment does not mark the URI malformed')
   t.equal(parsed.host, 'host.example.com', 'host parsed normally')
 })
+test('parse rejects a malformed authority introducer (\\\\, /\\, \\/) in place of //', (t) => {
+  // Regression: "\\", "/\\", "\\/" after the scheme colon are not valid authority
+  // introducers. Node's URL treats "\\" as interchangeable with "/" on special
+  // schemes, so "http:\\\\evil.com/path" would be parsed as host "evil.com" by
+  // Node, but fast-uri must reject it as malformed to prevent SSRF/redirect bypass.
+  const cases = [
+    'http:\\\\evil.com/path',
+    'http:/\\evil.com/path',
+    'http:\\/evil.com/path',
+    'ws:\\\\evil.com/chat',
+    'wss:\\\\evil.com/chat',
+    'ftp:\\\\evil.com/',
+    '\\\\evil.com/path'
+  ]
+  t.plan(cases.length)
+  cases.forEach((input) => {
+    t.equal(
+      fastURI.parse(input).error,
+      'URI authority must not contain a literal backslash.',
+      input
+    )
+  })
+})
+test('normalize does not canonicalize a malformed-authority-introducer URI', (t) => {
+  const cases = [
+    'http:\\\\evil.com/path',
+    'http:/\\evil.com/path'
+  ]
+  t.plan(cases.length)
+  cases.forEach((input) => {
+    t.equal(fastURI.normalize(input), input, input)
+  })
+})
+test('equal returns false for malformed-authority-introducer URIs', (t) => {
+  const pairs = [
+    ['http:\\\\evil.com/path', 'http://evil.com/path'],
+    ['http:/\\evil.com/path', 'http://evil.com/path']
+  ]
+  t.plan(pairs.length)
+  pairs.forEach(([left, right]) => {
+    t.equal(fastURI.equal(left, right), false, `${left} != ${right}`)
+  })
+})
+test('resolve throws on malformed authority introducer', (t) => {
+  // resolve() returns a plain string with no error field, so the only safe
+  // behavior is to throw when either component has a malformed authority.
+  const pairs = [
+    ['https://allowed.com/', '\\\\evil.com/path'],
+    ['\\\\evil.com/path', 'https://allowed.com/'],
+    ['https://allowed.com/', 'http:/\\evil.com/path'],
+    ['https://allowed.com/', 'http:\\/evil.com/path']
+  ]
+  t.plan(pairs.length)
+  pairs.forEach(([base, rel]) => {
+    t.throws(
+      () => fastURI.resolve(base, rel),
+      /URI authority must not contain a literal backslash/,
+      `${base} + ${rel}`
+    )
+  })
+})
+test('parse rejects a whitespace-split authority introducer (TAB, LF, CR)', (t) => {
+  // The WHATWG URL parser removes TAB (U+0009), LF (U+000A) and CR (U+000D) from
+  // the input before parsing, so a stripped character wedged into the introducer
+  // ("/<TAB>\\", "/<TAB>/", or a leading "<TAB>//") reaches an authority in Node
+  // while fast-uri would otherwise fold it into the path. These must be rejected
+  // like the adjacent "\\", "/\\", "\\/" forms.
+  const cases = [
+    { input: '/\t\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: '/\t/evil.com/path', expectedError: 'URI authority introducer must not contain whitespace.' },
+    { input: '/\n\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: '/\r\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: '\t//evil.com/path', expectedError: 'URI authority introducer must not contain whitespace.' },
+    { input: '\t/\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: 'https:/\t/evil.com/path', expectedError: 'URI authority introducer must not contain whitespace.' }
+  ]
+  t.plan(cases.length)
+  cases.forEach(({ input, expectedError }) => {
+    t.equal(fastURI.parse(input).error, expectedError, JSON.stringify(input))
+  })
+})
+test('resolve throws on a whitespace-split authority introducer', (t) => {
+  const pairs = [
+    ['https://allowed.com/', '/\t\\evil.com/path'],
+    ['https://allowed.com/', '/\t/evil.com/path'],
+    ['https://allowed.com/', '/\n\\evil.com/path'],
+    ['/\t/evil.com/path', 'https://allowed.com/']
+  ]
+  t.plan(pairs.length)
+  pairs.forEach(([base, rel]) => {
+    t.throws(
+      () => fastURI.resolve(base, rel),
+      /URI authority (must not contain a literal backslash|introducer must not contain whitespace)/,
+      `${JSON.stringify(base)} + ${JSON.stringify(rel)}`
+    )
+  })
+})
+test('parse does not reject valid authority introducer patterns', (t) => {
+  // No false positives: "//" introducer and scheme-less "//" must be valid.
+  const cases = [
+    'http://good.com/',
+    'https://good.com/',
+    'ws://good.com/chat',
+    'wss://good.com/chat',
+    'ftp://good.com/',
+    '//good.com/path',
+    '/absolute/path',
+    'relative/path'
+  ]
+  t.plan(cases.length)
+  cases.forEach((input) => {
+    const parsed = fastURI.parse(input)
+    t.notOk(parsed.error, input)
+  })
+})

@@ -0,0 +1,16 @@
+'use strict'
+const test = require('tape')
+const fastURI = require('..')
+test('scheme is normalized to lowercase (RFC 3986 §6.2.2.1)', (t) => {
+  // parse lowercases the scheme, consistent with how it already lowercases the host
+  t.equal(fastURI.parse('HTTP://EXAMPLE.com/Path').scheme, 'http', 'parse lowercases an uppercase scheme')
+  t.equal(fastURI.parse('HtTpS://example.com').scheme, 'https', 'parse lowercases a mixed-case scheme')
+  // normalize emits a lowercase scheme (matches the already-lowercased host)
+  t.equal(fastURI.normalize('HTTP://EXAMPLE.com/p'), 'http://example.com/p', 'normalize lowercases the scheme')
+  t.equal(fastURI.normalize('HtTp://Example.COM/'), 'http://example.com/', 'normalize lowercases a mixed-case scheme')
+  t.end()
+})

@@ -8,7 +8,7 @@ const fastURI = require('..')
  *
  * @fileoverview An RFC 3986 compliant, scheme extendable URI parsing/normalizing/resolving/serializing library for JavaScript.
  * @author <a href="mailto:gary.court@gmail.com">Gary Court</a>
- * @see http://github.com/garycourt/uri-js
+ * @see https://github.com/garycourt/uri-js
  */
 /**

@@ -29,6 +29,15 @@ test('removeDotSegments', (t) => {
   // https://github.com/fastify/fast-uri/issues/139
   testCases.push(['WS:/WS://1305G130505:1&%0D:1&C(XXXXX*)))))))XXX130505:UUVUaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa$aaaaaaaaaaaa13a',
     'WS:/WS://1305G130505:1&%0D:1&C(XXXXX*)))))))XXX130505:UUVUaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa$aaaaaaaaaaaa13a'])
+  // trailing empty segments must be preserved: RFC 3986 5.2.4 only removes
+  // complete "." / ".." segments, never an empty segment
+  testCases.push(['//', '//'])
+  testCases.push(['/foo//', '/foo//'])
+  testCases.push(['/a/b//', '/a/b//'])
+  testCases.push(['/x//y//z', '/x//y//z'])
+  // "." / ".." segments still collapse
+  testCases.push(['/a/b/c/./../../g', '/a/g'])
+  testCases.push(['/.', '/'])
   t.plan(testCases.length)

@@ -0,0 +1,10 @@
+{
+  "compilerOptions": {
+    "allowJs": true,
+    "checkJs": true,
+    "strict": true,
+    "noImplicitAny": true,
+    "target": "es2022",
+    "noEmit": true
+  }
+}

@@ -28,15 +28,6 @@ declare namespace fastUri {
     nid?: string;
   }
-  /**
-   * @deprecated Use Options instead
-   */
-  export type options = Options
-  /**
-   * @deprecated Use URIComponent instead
-   */
-  export type URIComponents = URIComponent
   export function normalize (uri: string, opts?: Options): string
   export function normalize (uri: URIComponent, opts?: Options): URIComponent
   export function normalize (uri: any, opts?: Options): any

@@ -0,0 +1,15 @@
+import uri, {
+  type URIComponent,
+} from '..'
+import { expect } from 'tstyche'
+const parsed = uri.parse('foo')
+expect(parsed).type.toBe<URIComponent>()
+const parsed2 = uri.parse('foo', {
+  domainHost: true,
+  scheme: 'https',
+  unicodeSupport: false
+})
+expect(parsed2).type.toBe<URIComponent>()

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/lobster",
-  "version": "2026.7.2-beta.5",
+  "version": "2026.8.1-beta.2",
   "description": "Lobster workflow tool plugin for typed pipelines and resumable approvals.",
   "repository": {
     "type": "git",
@@ -21,10 +21,10 @@
       "minHostVersion": ">=2026.4.25"
     },
     "compat": {
-      "pluginApi": ">=2026.7.2-beta.5"
+      "pluginApi": ">=2026.8.1-beta.2"
     },
     "build": {
-      "openclawVersion": "2026.7.2-beta.5"
+      "openclawVersion": "2026.8.1-beta.2"
     },
     "release": {
       "publishToClawHub": true,
@@ -41,7 +41,7 @@
     "SKILL.md"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.7.2-beta.5"
+    "openclaw": ">=2026.8.1-beta.2"
   },
   "peerDependenciesMeta": {
     "openclaw": {

@@ -1,13 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "monthly"
-    open-pull-requests-limit: 10
-  - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "monthly"
-    open-pull-requests-limit: 10

@@ -1,24 +0,0 @@
-name: package-manager-ci
-on:
-  push:
-    branches:
-     - main
-     - next
-     - 'v*'
-    paths-ignore:
-      - 'docs/**'
-      - '*.md'
-  pull_request:
-    paths-ignore:
-      - 'docs/**'
-      - '*.md'
-permissions:
-  contents: read
-jobs:
-  test:
-    permissions:
-      contents: read
-    uses: fastify/workflows/.github/workflows/plugins-ci-package-manager.yml@v6

@@ -1,17 +0,0 @@
-import uri, { URIComponents, URIComponent, Options, options } from '..'
-import { expectDeprecated, expectType } from 'tsd'
-const parsed = uri.parse('foo')
-expectType<URIComponents>(parsed)
-const parsed2 = uri.parse('foo', {
-  domainHost: true,
-  scheme: 'https',
-  unicodeSupport: false
-})
-expectType<URIComponents>(parsed2)
-expectType<URIComponent>({} as URIComponents)
-expectDeprecated({} as URIComponents)
-expectType<Options>({} as options)
-expectDeprecated({} as options)

@openclaw/lobster 2026.7.2-beta.5 → 2026.8.1-beta.2