@openclaw/lobster 2026.9.4 → 2026.9.6

package/node_modules/@clawdbot/lobster/dist/src/commands/stdlib/group_by.js

@@ -1,13 +1,4 @@
-function getByPath(obj, path) {
-    const parts = path.split(".").filter(Boolean);
-    let cur = obj;
-    for (const p of parts) {
-        if (cur == null)
-            return undefined;
-        cur = cur[p];
-    }
-    return cur;
-}
+import { getByPath } from "../../core/value_path.js";
 export const groupByCommand = {
     name: "groupBy",
     meta: {
@@ -36,20 +27,17 @@ export const groupByCommand = {
         if (!keyPath)
             throw new Error("groupBy requires --key");
         const groups = new Map();
-        const order = [];
         for await (const item of input) {
             const keyVal = getByPath(item, keyPath);
             const k = JSON.stringify(keyVal);
             if (!groups.has(k)) {
                 groups.set(k, { key: keyVal, items: [] });
-                order.push(k);
             }
             groups.get(k).items.push(item);
         }
         return {
             output: (async function* () {
-                for (const k of order) {
-                    const g = groups.get(k);
+                for (const g of groups.values()) {
                     yield { key: g.key, items: g.items, count: g.items.length };
                 }
             })(),

package/node_modules/@clawdbot/lobster/dist/src/commands/stdlib/group_by.js.map

@@ -1 +1 @@
-{"version":3,"file":"group_by.js","sourceRoot":"","sources":["../../../../src/commands/stdlib/group_by.ts"],"names":[],"mappings":"AAAA,SAAS,SAAS,CAAC,GAAQ,EAAE,IAAY;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,GAAG,GAAQ,GAAG,CAAC;IACnB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,GAAG,IAAI,IAAI;YAAE,OAAO,SAAS,CAAC;QAClC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,IAAI,EAAE,SAAS;IACf,IAAI,EAAE;QACJ,WAAW,EAAE,2CAA2C;QACxD,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qCAAqC,EAAE;gBAC3E,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;aAChD;YACD,QAAQ,EAAE,CAAC,KAAK,CAAC;SAClB;QACD,WAAW,EAAE,EAAE;KAChB;IACD,IAAI;QACF,OAAO,CACL,oCAAoC;YACpC,UAAU;YACV,gCAAgC;YAChC,WAAW;YACX,+CAA+C;YAC/C,UAAU;YACV,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAO;QAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAExD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsC,CAAC;QAC7D,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACxC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC1C,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QAED,OAAO;YACL,MAAM,EAAE,CAAC,KAAK,SAAS,CAAC;gBACtB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;oBACtB,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;oBACzB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC9D,CAAC;YACH,CAAC,CAAC,EAAE;SACL,CAAC;IACJ,CAAC;CACF,CAAC"}
+{"version":3,"file":"group_by.js","sourceRoot":"","sources":["../../../../src/commands/stdlib/group_by.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAErD,MAAM,CAAC,MAAM,cAAc,GAAG;IAC7B,IAAI,EAAE,SAAS;IACf,IAAI,EAAE;QACL,WAAW,EAAE,2CAA2C;QACxD,UAAU,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACX,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qCAAqC,EAAE;gBAC3E,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;aAC/C;YACD,QAAQ,EAAE,CAAC,KAAK,CAAC;SACjB;QACD,WAAW,EAAE,EAAE;KACf;IACD,IAAI;QACH,OAAO,CACN,oCAAoC;YACpC,UAAU;YACV,gCAAgC;YAChC,WAAW;YACX,+CAA+C;YAC/C,UAAU;YACV,0DAA0D,CAC1D,CAAC;IACH,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAO;QAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAExD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8C,CAAC;QAErE,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACxC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAED,OAAO;YACN,MAAM,EAAE,CAAC,KAAK,SAAS,CAAC;gBACvB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;oBACjC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC7D,CAAC;YACF,CAAC,CAAC,EAAE;SACJ,CAAC;IACH,CAAC;CACD,CAAC"}

package/node_modules/@clawdbot/lobster/dist/src/commands/stdlib/head.js.map

@@ -1 +1 @@
-{"version":3,"file":"head.js","sourceRoot":"","sources":["../../../../src/commands/stdlib/head.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE;QACJ,WAAW,EAAE,oBAAoB;QACjC,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yBAAyB,EAAE,OAAO,EAAE,EAAE,EAAE;gBAC1E,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;aAChD;YACD,QAAQ,EAAE,EAAE;SACb;QACD,WAAW,EAAE,EAAE;KAChB;IACD,IAAI;QACF,OAAO,sDAAsD,CAAC;IAChE,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAE5F,OAAO;YACL,MAAM,EAAE,CAAC,KAAK,SAAS,CAAC;gBACtB,IAAI,CAAC,GAAG,CAAC,CAAC;gBACV,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBAC/B,IAAI,CAAC,EAAE,IAAI,CAAC;wBAAE,MAAM;oBACpB,MAAM,IAAI,CAAC;gBACb,CAAC;YACH,CAAC,CAAC,EAAE;SACL,CAAC;IACJ,CAAC;CACF,CAAC"}
+{"version":3,"file":"head.js","sourceRoot":"","sources":["../../../../src/commands/stdlib/head.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG;IAC1B,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE;QACL,WAAW,EAAE,oBAAoB;QACjC,UAAU,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACX,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yBAAyB,EAAE,OAAO,EAAE,EAAE,EAAE;gBAC1E,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;aAC/C;YACD,QAAQ,EAAE,EAAE;SACZ;QACD,WAAW,EAAE,EAAE;KACf;IACD,IAAI;QACH,OAAO,sDAAsD,CAAC;IAC/D,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE;QACxB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAE5F,OAAO;YACN,MAAM,EAAE,CAAC,KAAK,SAAS,CAAC;gBACvB,IAAI,CAAC,GAAG,CAAC,CAAC;gBACV,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBAChC,IAAI,CAAC,EAAE,IAAI,CAAC;wBAAE,MAAM;oBACpB,MAAM,IAAI,CAAC;gBACZ,CAAC;YACF,CAAC,CAAC,EAAE;SACJ,CAAC;IACH,CAAC;CACD,CAAC"}

package/node_modules/@clawdbot/lobster/dist/src/commands/stdlib/json.js.map

@@ -1 +1 @@
-{"version":3,"file":"json.js","sourceRoot":"","sources":["../../../../src/commands/stdlib/json.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE;QACJ,WAAW,EAAE,gCAAgC;QAC7C,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QAC5D,WAAW,EAAE,EAAE;KAChB;IACD,IAAI;QACF,OAAO,iEAAiE,CAAC;IAC3E,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE;QACtB,MAAM,KAAK,GAAG,EAAE,CAAC;QACjB,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACnD,CAAC;CACF,CAAC;AAEF,KAAK,SAAS,CAAC,CAAC,WAAW,KAAI,CAAC"}
+{"version":3,"file":"json.js","sourceRoot":"","sources":["../../../../src/commands/stdlib/json.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG;IAC1B,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE;QACL,WAAW,EAAE,gCAAgC;QAC7C,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QAC5D,WAAW,EAAE,EAAE;KACf;IACD,IAAI;QACH,OAAO,iEAAiE,CAAC;IAC1E,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE;QACvB,MAAM,KAAK,GAAG,EAAE,CAAC;QACjB,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC;CACD,CAAC;AAEF,KAAK,SAAS,CAAC,CAAC,WAAW,KAAI,CAAC"}

package/node_modules/@clawdbot/lobster/dist/src/commands/stdlib/llm_invoke.js

@@ -1,9 +1,11 @@
+import { markLlmItem } from "../../core/llm_accounting.js";
 import path from "node:path";
 import { promises as fsp } from "node:fs";
 import { createHash } from "node:crypto";
 import { Ajv } from "ajv";
-import { ensureDirectory, isJsonSyntaxError, readStateJson, stableStringify, writeFileAtomic, writeStateJson, } from "../../state/store.js";
+import { diffAndStore, ensureDirectory, atomicWriteWasPublished, isJsonSyntaxError, readStateJsonWithLock, stableStringify, withFileLock, writeFileAtomic, } from "../../state/store.js";
 import { createCompileCached } from "../../validation.js";
+import { httpResponseLimitFromEnv, readResponseTextCapped } from "../../read_response_text.js";
 const ajv = new Ajv({ allErrors: true, strict: false });
 const compileCachedLocal = createCompileCached(ajv);
 const artifactSchema = {
@@ -89,6 +91,33 @@ const validatePayload = ajv.compile(payloadSchema);
 const validateResponseEnvelope = ajv.compile(responseSchema);
 const DEFAULT_MAX_VALIDATION_RETRIES = 1;
 const STATE_VERSION = 1;
+// Identity version of the response cache key. See computeCacheKey.
+const CACHE_KEY_VERSION = 2;
+/**
+ * Opens a charge for a live call, and only for one that costs something. An answer that reports
+ * no usage is billed nowhere however many times it is replayed, so a charge for it would sit in
+ * the ledger with nothing to settle it -- and would be handed to the next caller with a real
+ * call to account for, leaving that one's charge open to be billed a second time.
+ */
+function recordLiveCharge(ctx, cacheKey, item) {
+    const cost = chargeCostOf(item);
+    if (!cost)
+        return;
+    ledgerFrom(ctx)?.record(cacheKey, cost);
+}
+/** The cost of a live call, read from the item this module just built for it. */
+function chargeCostOf(item) {
+    const usage = item?.usage;
+    if (!usage || typeof usage !== "object")
+        return undefined;
+    return { model: typeof item?.model === "string" ? item.model : null, usage };
+}
+function ledgerFrom(ctx) {
+    const ledger = ctx?.llmSpendLedger;
+    if (!ledger || typeof ledger !== "object")
+        return null;
+    return typeof ledger.record === "function" && typeof ledger.claim === "function" ? ledger : null;
+}
 export const llmInvokeCommand = createLlmInvokeCommand({
     name: "llm.invoke",
     itemKind: "llm.invoke",
@@ -164,7 +193,7 @@ export function createLlmInvokeCommand(config) {
                     "schema-version": { type: "string", description: "Logical schema version for caching" },
                     "max-validation-retries": {
                         type: "number",
-                        description: "Retries when schema validation fails",
+                        description: "Extra model calls allowed after the first when schema validation fails (default 1)",
                     },
                     temperature: { type: "number", description: "Sampling temperature" },
                     "max-output-tokens": { type: "number", description: "Max completion tokens" },
@@ -190,7 +219,8 @@ export function createLlmInvokeCommand(config) {
                 "Features:",
                 "  - Typed payload validation before invoking the adapter.",
                 "  - Run-state + file cache so resumes do not re-call the LLM.",
-                "  - Optional JSON-schema enforcement with bounded retries.",
+                "  - Optional JSON-schema enforcement, retried at most --max-validation-retries times",
+                "    after the first call.",
                 "",
                 "Config:",
                 ...config.helpConfig.map((line) => `  - ${line}`),
@@ -204,6 +234,10 @@ export function createLlmInvokeCommand(config) {
 }
 async function runLlmInvoke({ input, args, ctx, config, }) {
     const env = ctx.env ?? process.env;
+    const signal = ctx?.signal;
+    // Run-state and cache hits return before any adapter call, so a cancelled run
+    // would otherwise still finish as a success.
+    throwIfCancelled(signal);
     const provider = resolveProvider(args, env, config.defaultProvider, ctx);
     const adapter = resolveAdapter({ provider, env, args, config, ctx });
     const prompt = extractPrompt(args);
@@ -236,6 +270,9 @@ async function runLlmInvoke({ input, args, ctx, config, }) {
     const inputArtifacts = [];
     for await (const item of input)
         inputArtifacts.push(item);
+    // Draining pipeline input waits on the upstream step, so a timeout can fire
+    // here. Re-check before the reuse lookups below can answer with a success.
+    throwIfCancelled(signal);
     const normalizedArtifacts = [...inputArtifacts, ...providedArtifacts].map(normalizeArtifact);
     const artifactHashes = normalizedArtifacts.map(hashArtifact);
     const cacheKey = computeCacheKey({
@@ -245,21 +282,29 @@ async function runLlmInvoke({ input, args, ctx, config, }) {
         schemaVersion,
         artifactHashes,
         outputSchema: userOutputSchema,
+        temperature,
+        maxOutputTokens,
     });
     if (stateKey && !forceRefresh) {
-        const stored = await readReusableLlmState(env, stateKey);
+        const stored = await readReusableLlmState(env, stateKey, ctx.signal);
+        // Reading run state is I/O of unbounded duration; a signal that aborted
+        // during it must not be overtaken by the replay below.
+        throwIfCancelled(signal);
         const reused = pickReusableState(stored, cacheKey, config.stateType);
         if (reused) {
+            const replay = { cacheKey, replayed: true };
             return {
-                output: streamOf(reused.items.map((item) => ({ ...item, source: "run_state", cached: true }))),
+                output: streamOf(reused.items.map((item) => markLlmItem({ ...item, source: "run_state", cached: true, replayed: true }, replay))),
             };
         }
     }
     if (!disableCache && !forceRefresh) {
-        const cache = await readCacheEntry(env, cacheKey, config.cacheNamespace);
+        const cache = await readCacheEntry(env, cacheKey, config.cacheNamespace, ctx.signal);
+        throwIfCancelled(signal);
         if (cache) {
+            const replay = { cacheKey, replayed: true };
             return {
-                output: streamOf(cache.items.map((item) => ({ ...item, source: "cache", cached: true }))),
+                output: streamOf(cache.items.map((item) => markLlmItem({ ...item, source: "cache", cached: true, replayed: true }, replay))),
             };
         }
     }
@@ -286,6 +331,7 @@ async function runLlmInvoke({ input, args, ctx, config, }) {
     let attempt = 0;
     let lastValidationErrors = [];
     while (true) {
+        throwIfCancelled(signal);
         attempt += 1;
         if (attempt > 1) {
             payload.retryContext = {
@@ -298,9 +344,16 @@ async function runLlmInvoke({ input, args, ctx, config, }) {
         }
         let responseEnvelope;
         try {
-            responseEnvelope = await adapter.invoke({ env, args, payload });
+            ctx.signal?.throwIfAborted();
+            responseEnvelope = await abortable(adapter.invoke({ env, args, payload, signal: ctx.signal }), signal);
+            ctx.signal?.throwIfAborted();
         }
         catch (err) {
+            // Cancellation is the caller's error, not an adapter failure: surface it
+            // as an abort so workflow timeout and abort handling still recognizes it,
+            // rather than wrapping it in a "request failed" adapter error.
+            if (signal?.aborted)
+                throw asCancellation(err, signal);
             throw new Error(`${config.name} request failed: ${err?.message ?? String(err)}`);
         }
         if (!validateResponseEnvelope(responseEnvelope)) {
@@ -319,37 +372,112 @@ async function runLlmInvoke({ input, args, ctx, config, }) {
             attempt,
             itemKind: config.itemKind,
         });
+        const live = { cacheKey, replayed: false };
+        for (const item of normalized)
+            markLlmItem(item, live);
+        // The provider has answered and been paid, so the charge is opened here rather than at
+        // either of the returns below. An attempt the local validator rejects never reaches one
+        // of them -- it goes round the loop and asks again -- and its call was as real as the one
+        // that eventually satisfies the schema. Opening it here also puts it before the writes
+        // that store the answer: either can fail once run state already holds a replayable copy,
+        // and the retry that replays it must still find a charge to settle.
+        recordLiveCharge(ctx, cacheKey, normalized[0]);
         if (!validator) {
+            ctx.signal?.throwIfAborted();
             await persistOutputs({
                 env,
                 stateKey,
                 cacheKey,
                 items: normalized,
                 stateType: config.stateType,
+                signal: ctx.signal,
+                afterStore: disableCache
+                    ? undefined
+                    : () => writeCacheEntry(env, cacheKey, normalized, config.cacheNamespace, ctx.signal),
             });
-            if (!disableCache)
-                await writeCacheEntry(env, cacheKey, normalized, config.cacheNamespace);
             return { output: streamOf(normalized) };
         }
         const structured = normalized[0]?.output?.data ?? null;
         if (validator(structured)) {
+            ctx.signal?.throwIfAborted();
             await persistOutputs({
                 env,
                 stateKey,
                 cacheKey,
                 items: normalized,
                 stateType: config.stateType,
+                signal: ctx.signal,
+                afterStore: disableCache
+                    ? undefined
+                    : () => writeCacheEntry(env, cacheKey, normalized, config.cacheNamespace, ctx.signal),
             });
-            if (!disableCache)
-                await writeCacheEntry(env, cacheKey, normalized, config.cacheNamespace);
             return { output: streamOf(normalized) };
         }
         lastValidationErrors = collectAjvErrors(validator.errors);
-        if (attempt > maxValidationRetries + 1) {
+        if (attempt > maxValidationRetries) {
             throw new Error(`${config.name} output failed schema validation: ${lastValidationErrors.join("; ")}`);
         }
     }
 }
+/**
+ * Build the error a cancelled run rejects with.
+ *
+ * The workflow runner only treats an error named `AbortError` or coded
+ * `ABORT_ERR` as cancellation; everything else follows the step's retry and
+ * `on_error` policy. A host may abort with any reason it likes, so passing
+ * `signal.reason` straight through means `controller.abort(new Error("stop"))`
+ * leaves a cancelled step looking like an ordinary failure -- retried, or
+ * swallowed by `on_error: continue` and reported as a successful run. Keep the
+ * host's message and hang its reason off `cause`, but mark the rejection so the
+ * runner recognizes it.
+ */
+function cancellationError(signal) {
+    const reason = signal.reason;
+    if (reason === undefined || reason === null) {
+        return new DOMException("The operation was aborted.", "AbortError");
+    }
+    if (reason?.name === "AbortError" || reason?.code === "ABORT_ERR")
+        return reason;
+    const message = typeof reason?.message === "string" && reason.message ? reason.message : String(reason);
+    const error = new Error(message, { cause: reason });
+    error.name = "AbortError";
+    error.code = "ABORT_ERR";
+    return error;
+}
+/** Rethrow `err` when it already reads as cancellation, else the run's reason. */
+function asCancellation(err, signal) {
+    if (err?.name === "AbortError" || err?.code === "ABORT_ERR")
+        return err;
+    return cancellationError(signal);
+}
+function throwIfCancelled(signal) {
+    if (signal?.aborted)
+        throw cancellationError(signal);
+}
+/**
+ * Reject as soon as the run is cancelled instead of waiting for `promise`.
+ * HTTP adapters are cancelled at the socket, but an injected `ctx.llmAdapters`
+ * adapter may ignore `ctx.signal` entirely; without this, one of those keeps a
+ * timed-out step waiting for as long as it likes.
+ */
+function abortable(promise, signal) {
+    if (!signal)
+        return promise;
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(cancellationError(signal));
+        // Observe `promise` before anything can settle the wrapper, including the
+        // already-aborted case below. An adapter can cancel the run from inside its own
+        // `invoke` and reject afterwards; rejecting here without watching that promise
+        // leaves the rejection unhandled, which ends the process under Node's default
+        // handling -- long after this step was cancelled cleanly.
+        promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", onAbort));
+        if (signal.aborted) {
+            onAbort();
+            return;
+        }
+        signal.addEventListener("abort", onAbort, { once: true });
+    });
+}
 function resolveProvider(args, env, defaultProvider, ctx) {
     const explicit = String(args.provider ?? env.LOBSTER_LLM_PROVIDER ?? "")
         .trim()
@@ -385,11 +513,12 @@ function resolveAdapter({ provider, env, args, config, ctx, }) {
         return {
             provider,
             source: typeof direct === "function" ? provider : (direct.source ?? provider),
-            async invoke({ payload }) {
-                return invoke({ env, args, payload, ctx });
+            async invoke({ payload, signal }) {
+                return invoke({ env, args, payload, ctx, signal });
             },
         };
     }
+    const maxResponseBytes = httpResponseLimitFromEnv(env);
     if (provider === "openclaw") {
         const openclawUrl = String(env.OPENCLAW_URL ?? env.CLAWD_URL ?? "").trim();
         if (!openclawUrl) {
@@ -400,8 +529,8 @@ function resolveAdapter({ provider, env, args, config, ctx, }) {
         return {
             provider,
             source: config.sourceForProvider?.(provider) ?? "openclaw",
-            async invoke({ payload }) {
-                return invokeOpenClawAdapter({ endpoint, token, payload });
+            async invoke({ payload, signal }) {
+                return invokeOpenClawAdapter({ endpoint, token, payload, signal, maxResponseBytes });
             },
         };
     }
@@ -414,8 +543,14 @@ function resolveAdapter({ provider, env, args, config, ctx, }) {
         return {
             provider,
             source: config.sourceForProvider?.(provider) ?? "pi",
-            async invoke({ payload }) {
-                return invokeHttpAdapter({ endpoint: buildAdapterEndpoint(adapterUrl), token, payload });
+            async invoke({ payload, signal }) {
+                return invokeHttpAdapter({
+                    endpoint: buildAdapterEndpoint(adapterUrl),
+                    maxResponseBytes,
+                    token,
+                    payload,
+                    signal,
+                });
             },
         };
     }
@@ -427,8 +562,14 @@ function resolveAdapter({ provider, env, args, config, ctx, }) {
     return {
         provider,
         source: config.sourceForProvider?.(provider) ?? "http",
-        async invoke({ payload }) {
-            return invokeHttpAdapter({ endpoint: buildAdapterEndpoint(adapterUrl), token, payload });
+        async invoke({ payload, signal }) {
+            return invokeHttpAdapter({
+                endpoint: buildAdapterEndpoint(adapterUrl),
+                maxResponseBytes,
+                token,
+                payload,
+                signal,
+            });
         },
     };
 }
@@ -451,9 +592,10 @@ function buildAdapterEndpoint(rawUrl) {
     }
     return endpoint;
 }
-async function invokeOpenClawAdapter({ endpoint, token, payload, }) {
+async function invokeOpenClawAdapter({ endpoint, token, payload, signal, maxResponseBytes, }) {
     const res = await fetch(endpoint, {
         method: "POST",
+        signal,
         headers: {
             "content-type": "application/json",
             ...(token ? { authorization: `Bearer ${token}` } : null),
@@ -464,7 +606,7 @@ async function invokeOpenClawAdapter({ endpoint, token, payload, }) {
             args: payload,
         }),
     });
-    const text = await res.text();
+    const text = await readResponseTextCapped(res, maxResponseBytes);
     if (!res.ok) {
         throw new Error(`${res.status} ${res.statusText}: ${text.slice(0, 400)}`);
     }
@@ -488,16 +630,17 @@ async function invokeOpenClawAdapter({ endpoint, token, payload, }) {
     }
     return { ok: true, result: parsed };
 }
-async function invokeHttpAdapter({ endpoint, token, payload, }) {
+async function invokeHttpAdapter({ endpoint, token, payload, signal, maxResponseBytes, }) {
     const res = await fetch(endpoint, {
         method: "POST",
+        signal,
         headers: {
             "content-type": "application/json",
             ...(token ? { authorization: `Bearer ${token}` } : null),
         },
         body: JSON.stringify(payload),
     });
-    const text = await res.text();
+    const text = await readResponseTextCapped(res, maxResponseBytes);
     if (!res.ok) {
         throw new Error(`${res.status} ${res.statusText}: ${text.slice(0, 400)}`);
     }
@@ -603,14 +746,24 @@ function hashArtifact(artifact) {
     const stable = stableStringify(artifact);
     return createHash("sha256").update(stable).digest("hex");
 }
-function computeCacheKey({ provider, prompt, model, schemaVersion, artifactHashes, outputSchema, }) {
+function computeCacheKey({ provider, prompt, model, schemaVersion, artifactHashes, outputSchema, temperature, maxOutputTokens, }) {
+    // `null` is the identity of an omitted parameter, distinct from any value a caller can
+    // pass, so an omitted request can never resolve to an entry written with an explicit one.
+    // The version separates this identity from the keys earlier releases wrote, where the two
+    // parameters were absent from the payload and a sampled answer therefore shared a key with
+    // an unsampled request. Bump it whenever the fields below change: entries under older
+    // versions become unreachable, which costs one re-invocation and never a wrong replay.
     const payload = {
+        cacheKeyVersion: CACHE_KEY_VERSION,
         provider,
         prompt,
         model: model || `${provider}-default`,
         schemaVersion,
         artifactHashes,
         outputSchema: outputSchema ?? null,
+        // The same predicate that decides whether each parameter is sent to the adapter.
+        temperature: Number.isFinite(temperature ?? NaN) ? Number(temperature) : null,
+        maxOutputTokens: Number.isFinite(maxOutputTokens ?? NaN) ? Number(maxOutputTokens) : null,
     };
     return createHash("sha256").update(stableStringify(payload)).digest("hex");
 }
@@ -646,9 +799,11 @@ function normalizeResult({ envelope, cacheKey, schemaVersion, artifactHashes, so
     };
     return [item];
 }
-async function persistOutputs({ env, stateKey, cacheKey, items, stateType, }) {
-    if (!stateKey)
+async function persistOutputs({ env, stateKey, cacheKey, items, stateType, signal, afterStore, }) {
+    if (!stateKey) {
+        await afterStore?.();
         return;
+    }
     const record = {
         type: stateType,
         version: STATE_VERSION,
@@ -656,11 +811,17 @@ async function persistOutputs({ env, stateKey, cacheKey, items, stateType, }) {
         items,
         storedAt: new Date().toISOString(),
     };
-    await writeStateJson({ env, key: stateKey, value: record });
+    await diffAndStore({
+        env,
+        key: stateKey,
+        value: record,
+        signal,
+        afterStore: afterStore ? () => afterStore() : undefined,
+    });
 }
-async function readReusableLlmState(env, stateKey) {
+async function readReusableLlmState(env, stateKey, signal) {
     try {
-        return await readStateJson({ env, key: stateKey });
+        return await readStateJsonWithLock({ env, key: stateKey, signal });
     }
     catch (err) {
         if (isJsonSyntaxError(err))
@@ -684,28 +845,85 @@ function collectAjvErrors(errors) {
         return [];
     return errors.map((err) => `${err.instancePath || "/"} ${err.message ?? ""}`.trim());
 }
-async function readCacheEntry(env, key, cacheNamespace) {
+async function readCacheEntry(env, key, cacheNamespace, signal) {
     const filePath = path.join(getCacheDir(env), cacheNamespace, `${key}.json`);
+    const read = async () => {
+        try {
+            const text = await fsp.readFile(filePath, "utf8");
+            const parsed = JSON.parse(text);
+            if (parsed?.cacheKey !== key || !Array.isArray(parsed.items))
+                return null;
+            return parsed;
+        }
+        catch (err) {
+            if (err?.code === "ENOENT")
+                return null;
+            if (isJsonSyntaxError(err))
+                return null;
+            throw err;
+        }
+    };
     try {
-        const text = await fsp.readFile(filePath, "utf8");
-        const parsed = JSON.parse(text);
-        if (parsed?.cacheKey !== key || !Array.isArray(parsed.items))
-            return null;
-        return parsed;
+        return await withFileLock({ filePath, signal, task: read });
     }
     catch (err) {
-        if (err?.code === "ENOENT")
-            return null;
-        if (isJsonSyntaxError(err))
+        if (err?.code === "ENOENT" || err?.code === "ENOTDIR")
             return null;
+        // A cache mounted read-only cannot have an active local writer because a
+        // writer first creates the same coordination lock. Preserve its reusable
+        // entries instead of requiring a lock-directory write for a read.
+        if (["EACCES", "EPERM", "EROFS"].includes(err?.code))
+            return read();
         throw err;
     }
 }
-async function writeCacheEntry(env, key, items, cacheNamespace) {
+async function writeCacheEntry(env, key, items, cacheNamespace, signal) {
     const dir = path.join(getCacheDir(env), cacheNamespace);
+    signal?.throwIfAborted();
     await ensureDirectory(dir);
     const filePath = path.join(dir, `${key}.json`);
-    await writeFileAtomic(filePath, JSON.stringify({ items, cacheKey: key, storedAt: new Date().toISOString() }, null, 2) + "\n");
+    const content = JSON.stringify({ items, cacheKey: key, storedAt: new Date().toISOString() }, null, 2) + "\n";
+    await withFileLock({
+        filePath,
+        signal,
+        task: async () => {
+            let previousContent = null;
+            try {
+                previousContent = await fsp.readFile(filePath);
+            }
+            catch (err) {
+                if (err?.code !== "ENOENT")
+                    throw err;
+            }
+            const restorePreviousContent = async () => {
+                // No cache reader or competing cache writer can observe this entry
+                // until this lock is released. Restore an entry replaced by a refresh;
+                // only remove the just-published file when none existed beforehand.
+                if (previousContent === null)
+                    await fsp.rm(filePath, { force: true });
+                else
+                    await writeFileAtomic(filePath, previousContent);
+            };
+            let cacheWasPublished = false;
+            try {
+                signal?.throwIfAborted();
+                const result = await writeFileAtomic(filePath, content, { signal });
+                cacheWasPublished = true;
+                if (result?.signalAbortedAfterCommit || signal?.aborted) {
+                    await restorePreviousContent();
+                    cacheWasPublished = false;
+                    signal?.throwIfAborted();
+                    throw new Error("LLM cache publication cancelled");
+                }
+            }
+            catch (err) {
+                if (cacheWasPublished || atomicWriteWasPublished(err)) {
+                    await restorePreviousContent();
+                }
+                throw err;
+            }
+        },
+    });
 }
 function getCacheDir(env) {
     if (env?.LOBSTER_CACHE_DIR)