@openclaw/lobster 2026.9.1-beta.1 → 2026.9.1

package/dist/index.js

@@ -35,10 +35,10 @@ function createLimitedSink(maxBytes, label) {
 		callback();
 	} });
 }
-function normalizeEnvelope(envelope) {
+function normalizeEnvelope(envelope, maxStdoutBytes) {
 	if (!envelope.ok) throw new Error(envelope.error?.message ?? "lobster runtime failed");
 	if (envelope.status === "needs_input") throw new Error("Lobster input requests are not supported by the OpenClaw Lobster tool yet");
-	return {
+	const normalized = {
 		ok: true,
 		status: envelope.status ?? "ok",
 		output: Array.isArray(envelope.output) ? envelope.output : [],
@@ -50,6 +50,8 @@ function normalizeEnvelope(envelope) {
 			...envelope.requiresApproval.approvalId ? { approvalId: envelope.requiresApproval.approvalId } : {}
 		} : null
 	};
+	if (Buffer.byteLength(JSON.stringify(normalized, null, 2), "utf8") > maxStdoutBytes) throw new Error("lobster runtime result exceeded maxStdoutBytes");
+	return normalized;
 }
 function isMissingPathError(error) {
 	return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
@@ -112,6 +114,7 @@ function createEmbeddedLobsterRunner(options) {
 		const runtime = await runtimePromise;
 		return await withTimeout(params.timeoutMs, async (signal) => {
 			const ctx = createEmbeddedToolContext(params, signal);
+			let envelope;
 			if (params.action === "run") {
 				const pipeline = params.pipeline?.trim() ?? "";
 				if (!pipeline) throw new Error("pipeline required");
@@ -124,27 +127,28 @@ function createEmbeddedLobsterRunner(options) {
 					} catch {
 						throw new Error("run --args-json must be valid JSON");
 					}
-					return normalizeEnvelope(await runtime.runToolRequest({
+					envelope = await runtime.runToolRequest({
 						filePath,
 						args,
 						ctx
-					}));
-				}
-				return normalizeEnvelope(await runtime.runToolRequest({
+					});
+				} else envelope = await runtime.runToolRequest({
 					pipeline,
 					ctx
-				}));
+				});
+			} else {
+				const token = params.token?.trim() ?? "";
+				const approvalId = params.approvalId?.trim() ?? "";
+				if (!token && !approvalId) throw new Error("token or approvalId required");
+				if (typeof params.approve !== "boolean") throw new Error("approve required");
+				envelope = await runtime.resumeToolRequest({
+					...token ? { token } : {},
+					...approvalId ? { approvalId } : {},
+					approved: params.approve,
+					ctx
+				});
 			}
-			const token = params.token?.trim() ?? "";
-			const approvalId = params.approvalId?.trim() ?? "";
-			if (!token && !approvalId) throw new Error("token or approvalId required");
-			if (typeof params.approve !== "boolean") throw new Error("approve required");
-			return normalizeEnvelope(await runtime.resumeToolRequest({
-				...token ? { token } : {},
-				...approvalId ? { approvalId } : {},
-				approved: params.approve,
-				ctx
-			}));
+			return normalizeEnvelope(envelope, Math.max(1024, params.maxStdoutBytes));
 		});
 	} };
 }
@@ -152,29 +156,25 @@ function createEmbeddedLobsterRunner(options) {
 //#region extensions/lobster/src/lobster-taskflow.ts
 function toJsonLike(value, seen = /* @__PURE__ */ new WeakSet()) {
 	if (value === null) return null;
-	switch (typeof value) {
-		case "boolean":
-		case "string": return value;
-		case "number": return Number.isFinite(value) ? value : String(value);
-		case "bigint": return value.toString();
-		case "undefined":
-		case "function":
-		case "symbol": return null;
-		case "object": {
-			if (value instanceof Date) return value.toISOString();
-			if (Array.isArray(value)) return value.map((item) => toJsonLike(item, seen));
-			if (seen.has(value)) return "[Circular]";
-			seen.add(value);
-			const jsonObject = {};
-			for (const [key, entry] of Object.entries(value)) {
-				if (entry === void 0 || typeof entry === "function" || typeof entry === "symbol") continue;
-				jsonObject[key] = toJsonLike(entry, seen);
-			}
-			seen.delete(value);
-			return jsonObject;
-		}
+	if (typeof value === "number") return Number.isFinite(value) ? value : String(value);
+	if (typeof value === "bigint") return value.toString();
+	if (typeof value === "boolean" || typeof value === "string") return value;
+	if (typeof value !== "object") return null;
+	if (value instanceof Date) return value.toISOString();
+	if (seen.has(value)) return "[Circular]";
+	seen.add(value);
+	if (Array.isArray(value)) {
+		const jsonArray = value.map((item) => toJsonLike(item, seen));
+		seen.delete(value);
+		return jsonArray;
+	}
+	const jsonObject = {};
+	for (const [key, entry] of Object.entries(value)) {
+		if (entry === void 0 || typeof entry === "function" || typeof entry === "symbol") continue;
+		jsonObject[key] = toJsonLike(entry, seen);
 	}
-	return null;
+	seen.delete(value);
+	return jsonObject;
 }
 function buildApprovalWaitState(envelope) {
 	const approval = envelope.requiresApproval;
@@ -186,40 +186,51 @@ function buildApprovalWaitState(envelope) {
 		...approval?.approvalId ? { approvalId: approval.approvalId } : {}
 	};
 }
-function applyEnvelopeToFlow(params) {
-	const { taskFlow, flow, envelope, waitingStep } = params;
-	const flowMutation = {
-		flowId: flow.flowId,
-		expectedRevision: flow.revision
-	};
-	if (!envelope.ok) return taskFlow.fail(flowMutation);
-	if (envelope.status === "needs_approval") return taskFlow.setWaiting({
-		...flowMutation,
-		currentStep: waitingStep,
-		waitJson: buildApprovalWaitState(envelope)
-	});
-	return taskFlow.finish(flowMutation);
-}
-async function executeManagedLobsterFlow(params, flow, failureFlowId = flow.flowId) {
+async function executeManagedLobsterFlow(params, flow) {
 	try {
 		const envelope = await params.runner.run(params.runnerParams);
-		const mutation = applyEnvelopeToFlow({
-			taskFlow: params.taskFlow,
-			flow,
-			envelope,
-			waitingStep: params.waitingStep ?? "await_lobster_approval"
-		});
+		if (envelope.ok && envelope.status === "cancelled") try {
+			const mutation = await params.taskFlow.cancel({
+				flowId: flow.flowId,
+				cfg: params.config
+			});
+			return mutation.cancelled ? {
+				ok: true,
+				envelope,
+				flow,
+				mutation
+			} : {
+				ok: false,
+				flow,
+				mutation,
+				error: /* @__PURE__ */ new Error(`TaskFlow cancellation failed: ${mutation.reason ?? "unknown"}`)
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				flow,
+				error: error instanceof Error ? error : new Error(String(error))
+			};
+		}
+		const flowMutation = {
+			flowId: flow.flowId,
+			expectedRevision: flow.revision
+		};
 		if (!envelope.ok) return {
 			ok: false,
 			flow,
-			mutation,
+			mutation: params.taskFlow.fail(flowMutation),
 			error: new Error(envelope.error.message)
 		};
 		return {
 			ok: true,
 			envelope,
 			flow,
-			mutation
+			mutation: envelope.status === "needs_approval" ? params.taskFlow.setWaiting({
+				...flowMutation,
+				currentStep: params.waitingStep ?? "await_lobster_approval",
+				waitJson: buildApprovalWaitState(envelope)
+			}) : params.taskFlow.finish(flowMutation)
 		};
 	} catch (error) {
 		const err = error instanceof Error ? error : new Error(String(error));
@@ -228,7 +239,7 @@ async function executeManagedLobsterFlow(params, flow, failureFlowId = flow.flow
 				ok: false,
 				flow,
 				mutation: params.taskFlow.fail({
-					flowId: failureFlowId,
+					flowId: flow.flowId,
 					expectedRevision: flow.revision
 				}),
 				error: err
@@ -268,7 +279,7 @@ async function resumeManagedLobsterFlow(params) {
 		mutation: resumed,
 		error: /* @__PURE__ */ new Error(`TaskFlow resume failed: ${resumed.code}`)
 	};
-	return await executeManagedLobsterFlow(params, resumed.flow, params.flowId);
+	return await executeManagedLobsterFlow(params, resumed.flow);
 }
 //#endregion
 //#region extensions/lobster/src/lobster-tool.ts
@@ -300,28 +311,29 @@ function parseOptionalFlowStateJson(value) {
 function isEmptyJsonObject(value) {
 	return value !== void 0 && value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === 0;
 }
-function parseRunFlowParams(params) {
-	const controllerId = readOptionalTrimmedString(params.flowControllerId, "flowControllerId");
-	const goal = readOptionalTrimmedString(params.flowGoal, "flowGoal");
-	const currentStep = readOptionalTrimmedString(params.flowCurrentStep, "flowCurrentStep");
-	const waitingStep = readOptionalTrimmedString(params.flowWaitingStep, "flowWaitingStep");
-	const stateJson = parseOptionalFlowStateJson(params.flowStateJson);
-	const resumeFlowId = readOptionalTrimmedString(params.flowId, "flowId");
-	const resumeRevision = readOptionalNumber(params.flowExpectedRevision, "flowExpectedRevision");
-	const stateJsonSignalsRunMode = stateJson !== void 0 && !isEmptyJsonObject(stateJson);
-	if (resumeFlowId !== void 0 || resumeRevision !== void 0 && resumeRevision !== 0) throw new Error("run action does not accept flowId or flowExpectedRevision");
-	if (!(controllerId !== void 0 || goal !== void 0 || currentStep !== void 0 || waitingStep !== void 0 || stateJsonSignalsRunMode)) return null;
-	if (!controllerId) throw new Error("flowControllerId required when using managed TaskFlow run mode");
-	if (!goal) throw new Error("flowGoal required when using managed TaskFlow run mode");
-	return {
-		controllerId,
-		goal,
-		...currentStep ? { currentStep } : {},
-		...waitingStep ? { waitingStep } : {},
-		...stateJson !== void 0 ? { stateJson } : {}
-	};
-}
-function parseResumeFlowParams(params) {
+function parseManagedFlowParams(action, params, runnerParams) {
+	if (action === "run") {
+		const controllerId = readOptionalTrimmedString(params.flowControllerId, "flowControllerId");
+		const goal = readOptionalTrimmedString(params.flowGoal, "flowGoal");
+		const currentStep = readOptionalTrimmedString(params.flowCurrentStep, "flowCurrentStep");
+		const waitingStep = readOptionalTrimmedString(params.flowWaitingStep, "flowWaitingStep");
+		const stateJson = parseOptionalFlowStateJson(params.flowStateJson);
+		const resumeFlowId = readOptionalTrimmedString(params.flowId, "flowId");
+		const resumeRevision = readOptionalNumber(params.flowExpectedRevision, "flowExpectedRevision");
+		const stateJsonSignalsRunMode = stateJson !== void 0 && !isEmptyJsonObject(stateJson);
+		if (resumeFlowId !== void 0 || resumeRevision !== void 0 && resumeRevision !== 0) throw new Error("run action does not accept flowId or flowExpectedRevision");
+		if (controllerId === void 0 && goal === void 0 && currentStep === void 0 && waitingStep === void 0 && !stateJsonSignalsRunMode) return null;
+		if (!controllerId) throw new Error("flowControllerId required when using managed TaskFlow run mode");
+		if (!goal) throw new Error("flowGoal required when using managed TaskFlow run mode");
+		return {
+			action,
+			controllerId,
+			goal,
+			...currentStep ? { currentStep } : {},
+			...waitingStep ? { waitingStep } : {},
+			...stateJson !== void 0 ? { stateJson } : {}
+		};
+	}
 	const flowId = readOptionalTrimmedString(params.flowId, "flowId");
 	const expectedRevision = readOptionalNumber(params.flowExpectedRevision, "flowExpectedRevision");
 	const currentStep = readOptionalTrimmedString(params.flowCurrentStep, "flowCurrentStep");
@@ -337,13 +349,21 @@ function parseResumeFlowParams(params) {
 	if (!(flowId !== void 0 || expectedRevision !== void 0 && expectedRevision !== 0 || currentStep !== void 0 || waitingStep !== void 0)) return null;
 	if (!flowId) throw new Error("flowId required when using managed TaskFlow resume mode");
 	if (expectedRevision === void 0) throw new Error("flowExpectedRevision required when using managed TaskFlow resume mode");
-	if (!token && !approvalId) throw new Error("token or approvalId required when using managed TaskFlow resume mode");
+	const credentialParams = token ? { token: runnerParams.token ?? token } : approvalId ? { approvalId: runnerParams.approvalId ?? approvalId } : null;
+	if (!credentialParams) throw new Error("token or approvalId required when using managed TaskFlow resume mode");
 	if (approve === void 0) throw new Error("approve required when using managed TaskFlow resume mode");
 	return {
+		action,
 		flowId,
 		expectedRevision,
 		...currentStep ? { currentStep } : {},
-		...waitingStep ? { waitingStep } : {}
+		...waitingStep ? { waitingStep } : {},
+		runnerParams: {
+			...runnerParams,
+			...credentialParams,
+			action,
+			approve
+		}
 	};
 }
 function resolveManagedFlowToolResult(result) {
@@ -402,30 +422,28 @@ function createLobsterTool(api, options) {
 				maxStdoutBytes
 			};
 			const taskFlow = options?.taskFlow;
-			if (action === "run") {
-				const flowParams = parseRunFlowParams(params);
-				if (flowParams) return resolveManagedFlowToolResult(await runManagedLobsterFlow({
-					taskFlow: requireTaskFlowRuntime(taskFlow, "run"),
-					runner,
-					runnerParams,
-					controllerId: flowParams.controllerId,
-					goal: flowParams.goal,
-					...flowParams.stateJson !== void 0 ? { stateJson: flowParams.stateJson } : {},
-					...flowParams.currentStep ? { currentStep: flowParams.currentStep } : {},
-					...flowParams.waitingStep ? { waitingStep: flowParams.waitingStep } : {}
-				}));
-			} else {
-				const flowParams = parseResumeFlowParams(params);
-				if (flowParams) return resolveManagedFlowToolResult(await resumeManagedLobsterFlow({
-					taskFlow: requireTaskFlowRuntime(taskFlow, "resume"),
-					runner,
-					runnerParams,
-					flowId: flowParams.flowId,
-					expectedRevision: flowParams.expectedRevision,
-					...flowParams.currentStep ? { currentStep: flowParams.currentStep } : {},
-					...flowParams.waitingStep ? { waitingStep: flowParams.waitingStep } : {}
-				}));
-			}
+			const flowParams = parseManagedFlowParams(action, params, runnerParams);
+			if (flowParams?.action === "run") return resolveManagedFlowToolResult(await runManagedLobsterFlow({
+				taskFlow: requireTaskFlowRuntime(taskFlow, "run"),
+				config: api.config,
+				runner,
+				runnerParams,
+				controllerId: flowParams.controllerId,
+				goal: flowParams.goal,
+				...flowParams.stateJson !== void 0 ? { stateJson: flowParams.stateJson } : {},
+				...flowParams.currentStep ? { currentStep: flowParams.currentStep } : {},
+				...flowParams.waitingStep ? { waitingStep: flowParams.waitingStep } : {}
+			}));
+			if (flowParams?.action === "resume") return resolveManagedFlowToolResult(await resumeManagedLobsterFlow({
+				taskFlow: requireTaskFlowRuntime(taskFlow, "resume"),
+				config: api.config,
+				runner,
+				runnerParams: flowParams.runnerParams,
+				flowId: flowParams.flowId,
+				expectedRevision: flowParams.expectedRevision,
+				...flowParams.currentStep ? { currentStep: flowParams.currentStep } : {},
+				...flowParams.waitingStep ? { waitingStep: flowParams.waitingStep } : {}
+			}));
 			const envelope = await runner.run(runnerParams);
 			if (!envelope.ok) throw new Error(envelope.error.message);
 			return jsonResult(envelope);

package/node_modules/@clawdbot/lobster/node_modules/fast-uri/.github/workflows/ci.yml

@@ -147,7 +147,7 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-    uses: fastify/workflows/.github/workflows/plugins-ci.yml@2073dc8e1f9e172bf42daa3843c9dbd31af1e8cb # v6.0.0
+    uses: fastify/workflows/.github/workflows/plugins-ci.yml@ef591e2186785d5ab36b9fe6a79c7ce2f1d94e57 # v7.0.0
     with:
       license-check: true
       lint: true

package/node_modules/@clawdbot/lobster/node_modules/fast-uri/.github/workflows/lock-threads.yml

@@ -16,4 +16,4 @@ jobs:
     permissions:
       issues: write
       pull-requests: write
-    uses: fastify/workflows/.github/workflows/lock-threads.yml@2073dc8e1f9e172bf42daa3843c9dbd31af1e8cb # v6.0.0
+    uses: fastify/workflows/.github/workflows/lock-threads.yml@ef591e2186785d5ab36b9fe6a79c7ce2f1d94e57 # v7.0.0

package/node_modules/@clawdbot/lobster/node_modules/fast-uri/SECURITY.md

@@ -11,10 +11,15 @@ official Fastify project package. It supplements the Fastify project's
 [WHATWG URL Standard](https://url.spec.whatwg.org/).
 
 Differences between `fast-uri` and WHATWG URL implementations are expected.
-Reports based on comparing or mixing parsers that follow these different
+Reports based solely on comparing or mixing parsers that follow these different
 standards are out of scope. Applications must use the same parsing and
 normalization rules for both security decisions and subsequent URI use.
 
+Reports are assessed based on reproducibility, documented supported usage, and
+concrete security impact—not merely on whether they mention WHATWG URL
+behavior. Reports demonstrating a parsing or normalization flaw in a supported
+scheme remain eligible for evaluation.
+
 ## Threat model
 
 `fast-uri`'s threat model extends the

package/node_modules/@clawdbot/lobster/node_modules/fast-uri/benchmark/benchmark.mjs

@@ -10,6 +10,21 @@ const ipv6 = '//[2001:db8::7]'
 const urn = 'urn:foo:a123,456'
 const urnuuid = 'urn:uuid:f81d4fae-7dec-11d0-a765-00a0c91e6bf6'
 
+const mailtoSimple = 'mailto:chris@example.com'
+const mailtoWithSubject = 'mailto:infobot@example.com?subject=current-issue'
+const mailtoWithBody = 'mailto:infobot@example.com?body=send%20current-issue%0D%0Asend%20index'
+const mailtoWithHeaders = 'mailto:list@example.org?In-Reply-To=%3C3469A91.D10AF4C@example.com%3E'
+const mailtoMultiple = 'mailto:joe@example.com,alice@example.org?subject=Test&body=NATTO'
+const mailtoEncoded = 'mailto:%22oh%5C%5Cno%22@example.org'
+
+const mailtoComponent = {
+  scheme: 'mailto',
+  to: ['chris@example.com'],
+  subject: 'current-issue',
+  body: 'send current-issue\r\nsend index',
+  headers: { 'In-Reply-To': '<3469A91.D10AF4C@example.com>' }
+}
+
 const urnuuidComponent = {
   scheme: 'urn',
   nid: 'uuid',
@@ -146,6 +161,62 @@ benchUriJs.add('urijs: equal', function () {
   uriJsEqual('example://a/b/c/%7Bfoo%7D', 'eXAMPLE://a/./b/../b/%63/%7bfoo%7d')
 })
 
+benchFastUri.add('fast-uri: parse mailto simple', function () {
+  fastUriParse(mailtoSimple)
+})
+benchUriJs.add('urijs: parse mailto simple', function () {
+  uriJsParse(mailtoSimple)
+})
+
+benchFastUri.add('fast-uri: parse mailto subject', function () {
+  fastUriParse(mailtoWithSubject)
+})
+benchUriJs.add('urijs: parse mailto subject', function () {
+  uriJsParse(mailtoWithSubject)
+})
+
+benchFastUri.add('fast-uri: parse mailto body CRLF', function () {
+  fastUriParse(mailtoWithBody)
+})
+benchUriJs.add('urijs: parse mailto body CRLF', function () {
+  uriJsParse(mailtoWithBody)
+})
+
+benchFastUri.add('fast-uri: parse mailto headers', function () {
+  fastUriParse(mailtoWithHeaders)
+})
+benchUriJs.add('urijs: parse mailto headers', function () {
+  uriJsParse(mailtoWithHeaders)
+})
+
+benchFastUri.add('fast-uri: parse mailto multi recipient', function () {
+  fastUriParse(mailtoMultiple)
+})
+benchUriJs.add('urijs: parse mailto multi recipient', function () {
+  uriJsParse(mailtoMultiple)
+})
+
+benchFastUri.add('fast-uri: parse mailto encoded local', function () {
+  fastUriParse(mailtoEncoded)
+})
+benchUriJs.add('urijs: parse mailto encoded local', function () {
+  uriJsParse(mailtoEncoded)
+})
+
+benchFastUri.add('fast-uri: serialize mailto', function () {
+  fastUriSerialize(mailtoComponent)
+})
+benchUriJs.add('urijs: serialize mailto', function () {
+  uriJsSerialize(mailtoComponent)
+})
+
+benchFastUri.add('fast-uri: serialize+parse mailto round-trip', function () {
+  fastUriSerialize(fastUriParse(mailtoWithBody))
+})
+benchUriJs.add('urijs: serialize+parse mailto round-trip', function () {
+  uriJsSerialize(uriJsParse(mailtoWithBody))
+})
+
 await benchFastUri.run()
 console.log(benchFastUri.name)
 console.table(benchFastUri.table())