@openclaw/lobster 2026.7.2-beta.7 → 2026.8.1-beta.3

package/dist/index.js

@@ -6,6 +6,8 @@ import { Type } from "typebox";
 import { stat } from "node:fs/promises";
 import path from "node:path";
 import { Readable, Writable } from "node:stream";
+import { toErrorObject } from "openclaw/plugin-sdk/error-runtime";
+import { isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
 //#region extensions/lobster/src/lobster-runner.ts
 const workflowExts = /* @__PURE__ */ new Set([
 	".lobster",
@@ -13,19 +15,13 @@ const workflowExts = /* @__PURE__ */ new Set([
 	".yml",
 	".json"
 ]);
-function normalizeForCwdSandbox(p) {
-	const normalized = path.normalize(p);
-	return process.platform === "win32" ? normalized.toLowerCase() : normalized;
-}
 function resolveLobsterCwd(cwdRaw) {
 	if (typeof cwdRaw !== "string" || !cwdRaw.trim()) return process.cwd();
 	const cwd = cwdRaw.trim();
 	if (path.isAbsolute(cwd)) throw new Error("cwd must be a relative path");
 	const base = process.cwd();
 	const resolved = path.resolve(base, cwd);
-	const rel = path.relative(normalizeForCwdSandbox(base), normalizeForCwdSandbox(resolved));
-	if (rel === "" || rel === ".") return resolved;
-	if (rel.startsWith("..") || path.isAbsolute(rel)) throw new Error("cwd must stay within the gateway working directory");
+	if (!isPathInside(base, resolved)) throw new Error("cwd must stay within the gateway working directory");
 	return resolved;
 }
 function createLimitedSink(maxBytes, label) {
@@ -40,66 +36,36 @@ function createLimitedSink(maxBytes, label) {
 	} });
 }
 function normalizeEnvelope(envelope) {
-	if (envelope.ok) {
-		if (envelope.status === "needs_input") return {
-			ok: false,
-			error: {
-				type: "unsupported_status",
-				message: "Lobster input requests are not supported by the OpenClaw Lobster tool yet"
-			}
-		};
-		return {
-			ok: true,
-			status: envelope.status ?? "ok",
-			output: Array.isArray(envelope.output) ? envelope.output : [],
-			requiresApproval: envelope.requiresApproval ? {
-				type: "approval_request",
-				prompt: envelope.requiresApproval.prompt,
-				items: envelope.requiresApproval.items,
-				...envelope.requiresApproval.resumeToken ? { resumeToken: envelope.requiresApproval.resumeToken } : {},
-				...envelope.requiresApproval.approvalId ? { approvalId: envelope.requiresApproval.approvalId } : {}
-			} : null
-		};
-	}
+	if (!envelope.ok) throw new Error(envelope.error?.message ?? "lobster runtime failed");
+	if (envelope.status === "needs_input") throw new Error("Lobster input requests are not supported by the OpenClaw Lobster tool yet");
 	return {
-		ok: false,
-		error: {
-			type: envelope.error?.type,
-			message: envelope.error?.message ?? "lobster runtime failed"
-		}
+		ok: true,
+		status: envelope.status ?? "ok",
+		output: Array.isArray(envelope.output) ? envelope.output : [],
+		requiresApproval: envelope.requiresApproval ? {
+			type: "approval_request",
+			prompt: envelope.requiresApproval.prompt,
+			items: envelope.requiresApproval.items,
+			...envelope.requiresApproval.resumeToken ? { resumeToken: envelope.requiresApproval.resumeToken } : {},
+			...envelope.requiresApproval.approvalId ? { approvalId: envelope.requiresApproval.approvalId } : {}
+		} : null
 	};
 }
-function throwOnErrorEnvelope(envelope) {
-	if (envelope.ok) return envelope;
-	throw new Error(envelope.error.message);
-}
-async function resolveWorkflowFile(candidate, cwd) {
-	const resolved = path.isAbsolute(candidate) ? candidate : path.resolve(cwd, candidate);
-	if (!(await stat(resolved)).isFile()) throw new Error("Workflow path is not a file");
-	const ext = path.extname(resolved).toLowerCase();
-	if (!workflowExts.has(ext)) throw new Error("Workflow file must end in .lobster, .yaml, .yml, or .json");
-	return resolved;
-}
 function isMissingPathError(error) {
 	return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 }
-function hasWorkflowFileExtension(candidate) {
-	return workflowExts.has(path.extname(candidate).toLowerCase());
-}
 async function detectWorkflowFile(candidate, cwd) {
 	const trimmed = candidate.trim();
-	if (!trimmed || trimmed.includes("|") || !hasWorkflowFileExtension(trimmed)) return null;
-	if (!/\s/.test(trimmed)) return await resolveWorkflowFile(trimmed, cwd);
+	if (!trimmed || trimmed.includes("|") || !workflowExts.has(path.extname(trimmed).toLowerCase())) return null;
+	const resolved = path.isAbsolute(trimmed) ? trimmed : path.resolve(cwd, trimmed);
 	try {
-		return await resolveWorkflowFile(trimmed, cwd);
+		if (!(await stat(resolved)).isFile()) throw new Error("Workflow path is not a file");
+		return resolved;
 	} catch (error) {
-		if (isMissingPathError(error)) return null;
+		if (/\s/.test(trimmed) && isMissingPathError(error)) return null;
 		throw error;
 	}
 }
-function parseWorkflowArgs(argsJson) {
-	return JSON.parse(argsJson);
-}
 function createEmbeddedToolContext(params, signal) {
 	const env = { ...process.env };
 	return {
@@ -127,7 +93,7 @@ async function withTimeout(timeoutMs, fn) {
 			resolve(value);
 		}, (error) => {
 			clearTimeout(timer);
-			reject(toLintErrorObject(error, "Non-Error rejection"));
+			reject(toErrorObject(error, "Non-Error rejection"));
 		});
 	});
 }
@@ -154,41 +120,34 @@ function createEmbeddedLobsterRunner(options) {
 					const parsedArgsJson = params.argsJson?.trim() ?? "";
 					let args;
 					if (parsedArgsJson) try {
-						args = parseWorkflowArgs(parsedArgsJson);
+						args = JSON.parse(parsedArgsJson);
 					} catch {
 						throw new Error("run --args-json must be valid JSON");
 					}
-					return throwOnErrorEnvelope(normalizeEnvelope(await runtime.runToolRequest({
+					return normalizeEnvelope(await runtime.runToolRequest({
 						filePath,
 						args,
 						ctx
-					})));
+					}));
 				}
-				return throwOnErrorEnvelope(normalizeEnvelope(await runtime.runToolRequest({
+				return normalizeEnvelope(await runtime.runToolRequest({
 					pipeline,
 					ctx
-				})));
+				}));
 			}
 			const token = params.token?.trim() ?? "";
 			const approvalId = params.approvalId?.trim() ?? "";
 			if (!token && !approvalId) throw new Error("token or approvalId required");
 			if (typeof params.approve !== "boolean") throw new Error("approve required");
-			return throwOnErrorEnvelope(normalizeEnvelope(await runtime.resumeToolRequest({
+			return normalizeEnvelope(await runtime.resumeToolRequest({
 				...token ? { token } : {},
 				...approvalId ? { approvalId } : {},
 				approved: params.approve,
 				ctx
-			})));
+			}));
 		});
 	} };
 }
-function toLintErrorObject(value, fallbackMessage) {
-	if (value instanceof Error) return value;
-	if (typeof value === "string") return new Error(value);
-	const error = new Error(fallbackMessage, { cause: value });
-	if (typeof value === "object" && value !== null || typeof value === "function") Object.assign(error, value);
-	return error;
-}
 //#endregion
 //#region extensions/lobster/src/lobster-taskflow.ts
 function toJsonLike(value, seen = /* @__PURE__ */ new WeakSet()) {
@@ -218,51 +177,30 @@ function toJsonLike(value, seen = /* @__PURE__ */ new WeakSet()) {
 	return null;
 }
 function buildApprovalWaitState(envelope) {
-	if (!envelope.requiresApproval) return {
-		kind: "lobster_approval",
-		prompt: "",
-		items: []
-	};
+	const approval = envelope.requiresApproval;
 	return {
 		kind: "lobster_approval",
-		prompt: envelope.requiresApproval.prompt,
-		items: envelope.requiresApproval.items.map((item) => toJsonLike(item)),
-		...envelope.requiresApproval.resumeToken ? { resumeToken: envelope.requiresApproval.resumeToken } : {},
-		...envelope.requiresApproval.approvalId ? { approvalId: envelope.requiresApproval.approvalId } : {}
+		prompt: approval ? approval.prompt : "",
+		items: approval ? approval.items.map((item) => toJsonLike(item)) : [],
+		...approval?.resumeToken ? { resumeToken: approval.resumeToken } : {},
+		...approval?.approvalId ? { approvalId: approval.approvalId } : {}
 	};
 }
 function applyEnvelopeToFlow(params) {
 	const { taskFlow, flow, envelope, waitingStep } = params;
-	if (!envelope.ok) return taskFlow.fail({
+	const flowMutation = {
 		flowId: flow.flowId,
 		expectedRevision: flow.revision
-	});
+	};
+	if (!envelope.ok) return taskFlow.fail(flowMutation);
 	if (envelope.status === "needs_approval") return taskFlow.setWaiting({
-		flowId: flow.flowId,
-		expectedRevision: flow.revision,
+		...flowMutation,
 		currentStep: waitingStep,
 		waitJson: buildApprovalWaitState(envelope)
 	});
-	return taskFlow.finish({
-		flowId: flow.flowId,
-		expectedRevision: flow.revision
-	});
+	return taskFlow.finish(flowMutation);
 }
-function buildEnvelopeError(envelope) {
-	return new Error(envelope.error.message);
-}
-async function runManagedLobsterFlow(params) {
-	const createFlowParams = {
-		controllerId: params.controllerId,
-		goal: params.goal,
-		currentStep: params.currentStep ?? "run_lobster",
-		...params.stateJson !== void 0 ? { stateJson: params.stateJson } : {}
-	};
-	const flow = params.taskFlow.tryCreateManaged ? params.taskFlow.tryCreateManaged(createFlowParams) : params.taskFlow.createManaged(createFlowParams);
-	if (!flow) return {
-		ok: false,
-		error: /* @__PURE__ */ new Error("TaskFlow persistence failed.")
-	};
+async function executeManagedLobsterFlow(params, flow, failureFlowId = flow.flowId) {
 	try {
 		const envelope = await params.runner.run(params.runnerParams);
 		const mutation = applyEnvelopeToFlow({
@@ -275,7 +213,7 @@ async function runManagedLobsterFlow(params) {
 			ok: false,
 			flow,
 			mutation,
-			error: buildEnvelopeError(envelope)
+			error: new Error(envelope.error.message)
 		};
 		return {
 			ok: true,
@@ -290,7 +228,7 @@ async function runManagedLobsterFlow(params) {
 				ok: false,
 				flow,
 				mutation: params.taskFlow.fail({
-					flowId: flow.flowId,
+					flowId: failureFlowId,
 					expectedRevision: flow.revision
 				}),
 				error: err
@@ -304,6 +242,20 @@ async function runManagedLobsterFlow(params) {
 		}
 	}
 }
+async function runManagedLobsterFlow(params) {
+	const createFlowParams = {
+		controllerId: params.controllerId,
+		goal: params.goal,
+		currentStep: params.currentStep ?? "run_lobster",
+		...params.stateJson !== void 0 ? { stateJson: params.stateJson } : {}
+	};
+	const flow = params.taskFlow.tryCreateManaged ? params.taskFlow.tryCreateManaged(createFlowParams) : params.taskFlow.createManaged(createFlowParams);
+	if (!flow) return {
+		ok: false,
+		error: /* @__PURE__ */ new Error("TaskFlow persistence failed.")
+	};
+	return await executeManagedLobsterFlow(params, flow);
+}
 async function resumeManagedLobsterFlow(params) {
 	const resumed = params.taskFlow.resume({
 		flowId: params.flowId,
@@ -316,47 +268,7 @@ async function resumeManagedLobsterFlow(params) {
 		mutation: resumed,
 		error: /* @__PURE__ */ new Error(`TaskFlow resume failed: ${resumed.code}`)
 	};
-	try {
-		const envelope = await params.runner.run(params.runnerParams);
-		const mutation = applyEnvelopeToFlow({
-			taskFlow: params.taskFlow,
-			flow: resumed.flow,
-			envelope,
-			waitingStep: params.waitingStep ?? "await_lobster_approval"
-		});
-		if (!envelope.ok) return {
-			ok: false,
-			flow: resumed.flow,
-			mutation,
-			error: buildEnvelopeError(envelope)
-		};
-		return {
-			ok: true,
-			envelope,
-			flow: resumed.flow,
-			mutation
-		};
-	} catch (error) {
-		const err = error instanceof Error ? error : new Error(String(error));
-		try {
-			const mutation = params.taskFlow.fail({
-				flowId: params.flowId,
-				expectedRevision: resumed.flow.revision
-			});
-			return {
-				ok: false,
-				flow: resumed.flow,
-				mutation,
-				error: err
-			};
-		} catch {
-			return {
-				ok: false,
-				flow: resumed.flow,
-				error: err
-			};
-		}
-	}
+	return await executeManagedLobsterFlow(params, resumed.flow, params.flowId);
 }
 //#endregion
 //#region extensions/lobster/src/lobster-tool.ts
@@ -434,9 +346,10 @@ function parseResumeFlowParams(params) {
 		...waitingStep ? { waitingStep } : {}
 	};
 }
-function formatManagedFlowResult(result) {
+function resolveManagedFlowToolResult(result) {
+	if (!result.ok) throw result.error;
 	return jsonResult({
-		...result.envelope && typeof result.envelope === "object" && !Array.isArray(result.envelope) ? result.envelope : { envelope: result.envelope },
+		...result.envelope,
 		flow: result.flow,
 		mutation: result.mutation
 	});
@@ -445,10 +358,6 @@ function requireTaskFlowRuntime(taskFlow, action) {
 	if (!taskFlow) throw new Error(`Managed TaskFlow ${action} mode requires a bound taskFlow runtime`);
 	return taskFlow;
 }
-function resolveManagedFlowToolResult(result) {
-	if (!result.ok) throw result.error;
-	return formatManagedFlowResult(result);
-}
 function createLobsterTool(api, options) {
 	const runner = options?.runner ?? createEmbeddedLobsterRunner();
 	return {

package/node_modules/@clawdbot/lobster/node_modules/fast-uri/.github/workflows/ci.yml

@@ -30,11 +30,11 @@ jobs:
       matrix:
         node-version: ['20', '22', '24', '26']
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
@@ -54,11 +54,11 @@ jobs:
       matrix:
         node-version: ['16', '18', '20', '22', '24', '26']
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
@@ -77,11 +77,11 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '10'
           cache: 'npm'
@@ -119,11 +119,11 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '24'
           cache: 'npm'
@@ -147,7 +147,7 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-    uses: fastify/workflows/.github/workflows/plugins-ci.yml@v6
+    uses: fastify/workflows/.github/workflows/plugins-ci.yml@2073dc8e1f9e172bf42daa3843c9dbd31af1e8cb # v6.0.0
     with:
       license-check: true
       lint: true

package/node_modules/@clawdbot/lobster/node_modules/fast-uri/.github/workflows/lock-threads.yml

@@ -16,4 +16,4 @@ jobs:
     permissions:
       issues: write
       pull-requests: write
-    uses: fastify/workflows/.github/workflows/lock-threads.yml@v6
+    uses: fastify/workflows/.github/workflows/lock-threads.yml@2073dc8e1f9e172bf42daa3843c9dbd31af1e8cb # v6.0.0

package/node_modules/@clawdbot/lobster/node_modules/fast-uri/.github/workflows/ossf-scorecard.yml

@@ -0,0 +1,45 @@
+name: OSSF Scorecard Analysis
+
+# **What it does**: Runs OSSF Scorecard analysis on the repository and uploads the results.
+# **Why we have it**: Security scanning.
+
+on:
+    branch_protection_rule:
+    push:
+        branches:
+            - main
+        paths-ignore:
+            - "docs/**"
+            - "*.md"
+    schedule:
+        #        ┌───────────── minute (0 - 59)
+        #        │  ┌───────────── hour (0 - 23)
+        #        │  │ ┌───────────── day of the month (1 - 31)
+        #        │  │ │ ┌───────────── month (1 - 12 or JAN-DEC)
+        #        │  │ │ │ ┌───────────── day of the week (0 - 6 or SUN-SAT)
+        #        │  │ │ │ │
+        #        │  │ │ │ │
+        #        │  │ │ │ │
+        #        *  * * * *
+        - cron: "21 17 * * 0"
+    # Allows this workflow to be run manually from the Actions tab
+    workflow_dispatch:
+
+# This allows a subsequently queued workflow run to interrupt previous runs
+concurrency:
+    group: "${{ github.workflow }}-${{ github.event.pull_request.head.label || github.head_ref || github.ref }}"
+    cancel-in-progress: true
+
+permissions:
+    contents: read
+
+jobs:
+    analysis:
+        name: OSSF Scorecard Analysis
+        permissions:
+            contents: read
+            id-token: write
+            security-events: write
+        uses: fastify/workflows/.github/workflows/reusable-ossf-scorecard.yml@ef591e2186785d5ab36b9fe6a79c7ce2f1d94e57 #v7.0.0
+        with:
+            publish_results: true

package/node_modules/@clawdbot/lobster/node_modules/fast-uri/README.md

@@ -3,6 +3,7 @@
 [![NPM version](https://img.shields.io/npm/v/fast-uri.svg?style=flat)](https://www.npmjs.com/package/fast-uri)
 [![CI](https://github.com/fastify/fast-uri/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/fastify/fast-uri/actions/workflows/ci.yml)
 [![neostandard javascript style](https://img.shields.io/badge/code_style-neostandard-brightgreen?style=flat)](https://github.com/neostandard/neostandard)
+[![OSSF Scorecard](https://api.scorecard.dev/projects/github.com/fastify/fast-uri/badge)](https://scorecard.dev/viewer/?uri=github.com/fastify/fast-uri)
 
 Dependency-free RFC 3986 URI toolbox.
 

package/node_modules/@clawdbot/lobster/node_modules/fast-uri/SECURITY.md

@@ -0,0 +1,168 @@
+# Security Policy
+
+This document describes the management of vulnerabilities for `fast-uri`, an
+official Fastify project package. It supplements the Fastify project's
+[organization-wide security policy](https://github.com/fastify/.github/blob/main/SECURITY.md).
+
+## Standards and scope
+
+`fast-uri` implements URI parsing and normalization according to
+[RFC 3986](https://www.rfc-editor.org/rfc/rfc3986). It does not implement the
+[WHATWG URL Standard](https://url.spec.whatwg.org/).
+
+Differences between `fast-uri` and WHATWG URL implementations are expected.
+Reports based on comparing or mixing parsers that follow these different
+standards are out of scope. Applications must use the same parsing and
+normalization rules for both security decisions and subsequent URI use.
+
+## Threat model
+
+`fast-uri`'s threat model extends the
+[Node.js threat model](https://github.com/nodejs/node/blob/main/SECURITY.md#the-nodejs-threat-model).
+
+**Trusted:** Application code, parser options, configuration, and the runtime
+environment.
+
+**Untrusted:** URI and IRI strings passed to the package's public APIs.
+
+### Examples of vulnerabilities
+
+- RFC 3986 parsing or normalization flaws that bypass security controls
+- Denial of service through malformed input
+- Inconsistent parsing or normalization between `fast-uri` APIs
+
+### Examples of non-vulnerabilities
+
+The following are **not** considered vulnerabilities in `fast-uri`:
+
+- **Different URL standards:** Differences between RFC 3986 behavior and
+  WHATWG URL behavior, including differences exposed by mixing parsers that
+  implement those standards
+- **Unsupported scheme semantics:** Scheme-specific behavior for schemes that
+  `fast-uri` does not document as supported
+- **Application code vulnerabilities:** Security flaws in code that consumes
+  `fast-uri` output
+- **Configuration mistakes:** Security issues caused by incorrect parser
+  options or application configuration
+- **Missing security features:** Application-level protections that are not
+  part of URI parsing or normalization
+- **Third-party dependencies:** Vulnerabilities in packages used by an
+  application alongside `fast-uri`
+
+## Reporting vulnerabilities
+
+Individuals who find potential vulnerabilities in `fast-uri` are invited to
+complete a vulnerability report via the
+[GitHub Security page][advisory].
+
+Do not assign or request a CVE directly.
+CVE assignment is handled by the Fastify Security Team.
+Fastify falls under the [OpenJS CNA](https://cna.openjsf.org/).
+A CVE will be assigned as part of our responsible disclosure process.
+
+> [!NOTE]
+> Fastify's [HackerOne](https://hackerone.com/fastify) program is now closed.
+
+[advisory]: ../../security/advisories/new
+
+### Strict measures when reporting vulnerabilities
+
+It is of the utmost importance that you read carefully and follow these
+guidelines to ensure the ecosystem as a whole is not disrupted due to
+improperly reported vulnerabilities:
+
+- Avoid creating new "informative" reports. Only create a new report if you are
+  confident the issue is an actual vulnerability. Third-party vendors and
+  individuals track new GitHub security reports and may flag them for their
+  customers.
+- Security reports should never be created and triaged by the same person. A
+  second Security Team member must triage a report submitted by a team member
+  or on their behalf. If in doubt, invite more Fastify collaborators to help
+  review the report.
+- **Do not** attempt to demonstrate CI/CD vulnerabilities by creating pull
+  requests in Fastify organization repositories. Doing so will result in a
+  [content report][content-report] to GitHub as an unsolicited exploit. Create
+  a separate repository configured like the affected repository and provide
+  the proof of concept there instead.
+
+[content-report]: https://docs.github.com/en/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam#reporting-an-issue-or-pull-request
+
+### Vulnerabilities found outside this process
+
+The Fastify project does not support vulnerability reporting outside the
+process described in this document.
+
+## Handling vulnerability reports
+
+When a potential vulnerability is reported, the following actions are taken.
+
+### Triage
+
+**Delay:** 4 business days
+
+Within 4 business days, a member of the Security Team provides a first response
+to the reporter. The possible responses are:
+
+- **Acceptance:** The report is considered a new vulnerability.
+- **Rejection:** The report is not considered a new vulnerability.
+- **Need more information:** The Security Team needs more information to
+  evaluate the report.
+
+Triaging should include updating these issue fields:
+
+- Asset: set or create the module affected by the report
+- Severity: TBD, initially left empty
+
+### Correction follow-up
+
+**Delay:** 90 days
+
+When a vulnerability is confirmed, a member of the Security Team volunteers to
+follow up on the report.
+
+With the reporter's help, they contact the maintainers of the vulnerable
+package and may invite them as participants in the report. Together, they
+define a publication date. Ideally, publication should not happen before the
+package has been patched.
+
+The report's vulnerable-version upper limit should be set to:
+
+- `*` if no fixed version is available when the report is published
+- the last vulnerable version, such as `<=1.2.3`, if the fix is released in
+  `1.2.4`
+
+### Publication
+
+**Delay:** 90 days
+
+Within 90 days after triage, the vulnerability must be made public.
+
+Vulnerability severity is assessed using
+[CVSS v3](https://www.first.org/cvss/user-guide).
+
+If package maintainers are actively developing a patch, the Security Team and
+the reporter may approve an additional delay.
+
+### Secondary contact
+
+If you do not receive an acknowledgment within 6 business days, or cannot find
+a private security contact, contact the OpenJS Foundation CNA at
+<https://cna.openjsf.org/> or `security@lists.openjsf.org` for assistance.
+
+The CNA can help ensure that reports are acknowledged, coordinate disclosure
+timelines, and assign CVEs when necessary.
+
+## The Fastify Security Team
+
+The core team manages the security program, policy, and process.
+
+Team members must keep all privileged information private. This includes the
+existence of undisclosed issues, expected release dates, and upcoming patches.
+
+### Members
+
+- [Matteo Collina](https://github.com/mcollina)
+- [Tomas Della Vedova](https://github.com/delvedor)
+- [Vincent Le Goff](https://github.com/zekth)
+- [KaKa Ng](https://github.com/climba03003)
+- [James Sumners](https://github.com/jsumners)

package/node_modules/@clawdbot/lobster/node_modules/fast-uri/index.js

@@ -26,7 +26,12 @@ function normalize (uri, options) {
  */
 function resolve (baseURI, relativeURI, options) {
   const schemelessOptions = options ? Object.assign({ scheme: 'null' }, options) : { scheme: 'null' }
-  const resolved = resolveComponent(parse(baseURI, schemelessOptions), parse(relativeURI, schemelessOptions), schemelessOptions, true)
+  const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions)
+  const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions)
+  if (baseMalformed || relativeMalformed) {
+    throw new Error(baseParsed.error || relativeParsed.error || 'URI is malformed.')
+  }
+  const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true)
   schemelessOptions.skipEscape = true
   return serialize(resolved, schemelessOptions)
 }
@@ -206,6 +211,15 @@ const URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:
 // with or without a scheme prefix, for the literal-backslash rejection below.
 const AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/
 
+// Captures the leading authority-introducer region after an optional scheme: a
+// run of forward slashes, backslashes, and the characters the WHATWG URL parser
+// removes before parsing (TAB U+0009, LF U+000A, CR U+000D). A valid introducer
+// is exactly "//". Node treats "\" as "/" on special schemes and strips those
+// characters first, so forms like "\\", "/\", "\/", "/<TAB>/", or a leading
+// "<TAB>//" reach an authority in Node while fast-uri's URI_PARSE folds them into
+// the path group (host confusion / SSRF / redirect bypass).
+const AUTHORITY_INTRODUCER_REGION = /^(?:[^#/:?]+:)?([/\\\t\n\r]*)/
+
 /**
  * @param {import('./types/index').URIComponent} parsed
  * @param {RegExpMatchArray} matches
@@ -265,6 +279,28 @@ function parseWithStatus (uri, opts) {
     malformedAuthorityOrPort = true
   }
 
+  // Reject a malformed or whitespace-smuggled authority introducer. fast-uri
+  // only recognizes a literal "//"; anything else in the leading separator run
+  // (a backslash, or a "//" that appears only after removing the TAB/LF/CR that
+  // Node strips) means the authority fast-uri parses differs from the one Node's
+  // URL resolves. Reject rather than rewrite, mirroring the literal-backslash
+  // guard above. Percent-encoded forms (%5C, %09) are untouched, valid data.
+  const introducerMatch = uri.match(AUTHORITY_INTRODUCER_REGION)
+  if (introducerMatch !== null) {
+    const region = introducerMatch[1]
+    const normalizedRegion = region.replace(/[\t\n\r]/g, '')
+    // Two or more leading separators introduce an authority.
+    if (normalizedRegion.length >= 2) {
+      if (normalizedRegion.slice(0, 2) !== '//') {
+        parsed.error = parsed.error || 'URI authority must not contain a literal backslash.'
+        malformedAuthorityOrPort = true
+      } else if (region.length !== normalizedRegion.length) {
+        parsed.error = parsed.error || 'URI authority introducer must not contain whitespace.'
+        malformedAuthorityOrPort = true
+      }
+    }
+  }
+
   const matches = uri.match(URI_PARSE)
 
   if (matches) {

package/node_modules/@clawdbot/lobster/node_modules/fast-uri/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fast-uri",
   "description": "Dependency-free RFC 3986 URI toolbox",
-  "version": "4.1.1",
+  "version": "4.1.2",
   "main": "index.js",
   "type": "commonjs",
   "types": "types/index.d.ts",

package/node_modules/@clawdbot/lobster/node_modules/fast-uri/test/security.test.js

@@ -221,3 +221,139 @@ test('parse does not reject a literal backslash in the query or fragment', (t) =
   t.notOk(parsed.error, 'backslash in query/fragment does not mark the URI malformed')
   t.equal(parsed.host, 'host.example.com', 'host parsed normally')
 })
+
+test('parse rejects a malformed authority introducer (\\\\, /\\, \\/) in place of //', (t) => {
+  // Regression: "\\", "/\\", "\\/" after the scheme colon are not valid authority
+  // introducers. Node's URL treats "\\" as interchangeable with "/" on special
+  // schemes, so "http:\\\\evil.com/path" would be parsed as host "evil.com" by
+  // Node, but fast-uri must reject it as malformed to prevent SSRF/redirect bypass.
+  const cases = [
+    'http:\\\\evil.com/path',
+    'http:/\\evil.com/path',
+    'http:\\/evil.com/path',
+    'ws:\\\\evil.com/chat',
+    'wss:\\\\evil.com/chat',
+    'ftp:\\\\evil.com/',
+    '\\\\evil.com/path'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    t.equal(
+      fastURI.parse(input).error,
+      'URI authority must not contain a literal backslash.',
+      input
+    )
+  })
+})
+
+test('normalize does not canonicalize a malformed-authority-introducer URI', (t) => {
+  const cases = [
+    'http:\\\\evil.com/path',
+    'http:/\\evil.com/path'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    t.equal(fastURI.normalize(input), input, input)
+  })
+})
+
+test('equal returns false for malformed-authority-introducer URIs', (t) => {
+  const pairs = [
+    ['http:\\\\evil.com/path', 'http://evil.com/path'],
+    ['http:/\\evil.com/path', 'http://evil.com/path']
+  ]
+
+  t.plan(pairs.length)
+
+  pairs.forEach(([left, right]) => {
+    t.equal(fastURI.equal(left, right), false, `${left} != ${right}`)
+  })
+})
+
+test('resolve throws on malformed authority introducer', (t) => {
+  // resolve() returns a plain string with no error field, so the only safe
+  // behavior is to throw when either component has a malformed authority.
+  const pairs = [
+    ['https://allowed.com/', '\\\\evil.com/path'],
+    ['\\\\evil.com/path', 'https://allowed.com/'],
+    ['https://allowed.com/', 'http:/\\evil.com/path'],
+    ['https://allowed.com/', 'http:\\/evil.com/path']
+  ]
+
+  t.plan(pairs.length)
+
+  pairs.forEach(([base, rel]) => {
+    t.throws(
+      () => fastURI.resolve(base, rel),
+      /URI authority must not contain a literal backslash/,
+      `${base} + ${rel}`
+    )
+  })
+})
+
+test('parse rejects a whitespace-split authority introducer (TAB, LF, CR)', (t) => {
+  // The WHATWG URL parser removes TAB (U+0009), LF (U+000A) and CR (U+000D) from
+  // the input before parsing, so a stripped character wedged into the introducer
+  // ("/<TAB>\\", "/<TAB>/", or a leading "<TAB>//") reaches an authority in Node
+  // while fast-uri would otherwise fold it into the path. These must be rejected
+  // like the adjacent "\\", "/\\", "\\/" forms.
+  const cases = [
+    { input: '/\t\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: '/\t/evil.com/path', expectedError: 'URI authority introducer must not contain whitespace.' },
+    { input: '/\n\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: '/\r\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: '\t//evil.com/path', expectedError: 'URI authority introducer must not contain whitespace.' },
+    { input: '\t/\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: 'https:/\t/evil.com/path', expectedError: 'URI authority introducer must not contain whitespace.' }
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach(({ input, expectedError }) => {
+    t.equal(fastURI.parse(input).error, expectedError, JSON.stringify(input))
+  })
+})
+
+test('resolve throws on a whitespace-split authority introducer', (t) => {
+  const pairs = [
+    ['https://allowed.com/', '/\t\\evil.com/path'],
+    ['https://allowed.com/', '/\t/evil.com/path'],
+    ['https://allowed.com/', '/\n\\evil.com/path'],
+    ['/\t/evil.com/path', 'https://allowed.com/']
+  ]
+
+  t.plan(pairs.length)
+
+  pairs.forEach(([base, rel]) => {
+    t.throws(
+      () => fastURI.resolve(base, rel),
+      /URI authority (must not contain a literal backslash|introducer must not contain whitespace)/,
+      `${JSON.stringify(base)} + ${JSON.stringify(rel)}`
+    )
+  })
+})
+
+test('parse does not reject valid authority introducer patterns', (t) => {
+  // No false positives: "//" introducer and scheme-less "//" must be valid.
+  const cases = [
+    'http://good.com/',
+    'https://good.com/',
+    'ws://good.com/chat',
+    'wss://good.com/chat',
+    'ftp://good.com/',
+    '//good.com/path',
+    '/absolute/path',
+    'relative/path'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    const parsed = fastURI.parse(input)
+    t.notOk(parsed.error, input)
+  })
+})

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/lobster",
-  "version": "2026.7.2-beta.7",
+  "version": "2026.8.1-beta.3",
   "description": "Lobster workflow tool plugin for typed pipelines and resumable approvals.",
   "repository": {
     "type": "git",
@@ -21,10 +21,10 @@
       "minHostVersion": ">=2026.4.25"
     },
     "compat": {
-      "pluginApi": ">=2026.7.2-beta.7"
+      "pluginApi": ">=2026.8.1-beta.3"
     },
     "build": {
-      "openclawVersion": "2026.7.2-beta.7"
+      "openclawVersion": "2026.8.1-beta.3"
     },
     "release": {
       "publishToClawHub": true,
@@ -41,7 +41,7 @@
     "SKILL.md"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.7.2-beta.7"
+    "openclaw": ">=2026.8.1-beta.3"
   },
   "peerDependenciesMeta": {
     "openclaw": {