@openclaw/openshell-sandbox 2026.7.1-beta.6 → 2026.7.2-beta.1

package/dist/index.js

@@ -9,12 +9,10 @@ import { MAX_TIMER_TIMEOUT_SECONDS } from "openclaw/plugin-sdk/number-runtime";
 import { z } from "zod";
 import { root } from "openclaw/plugin-sdk/file-access-runtime";
 import { FsSafeError, isPathInside, movePathWithCopyFallback } from "openclaw/plugin-sdk/security-runtime";
+import pLimit from "p-limit";
 //#region extensions/openshell/src/cli.ts
-function resolveOpenShellCommand(command) {
-	return command;
-}
 function buildOpenShellBaseArgv(config) {
-	const argv = [resolveOpenShellCommand(config.command)];
+	const argv = [config.command];
 	if (config.gateway) argv.push("--gateway", config.gateway);
 	if (config.gatewayEndpoint) argv.push("--gateway-endpoint", config.gatewayEndpoint);
 	return argv;
@@ -514,11 +512,10 @@ async function assertLocalPathSafety(params) {
 	const canonicalRoot = await fsPromises.realpath(params.root).catch(() => path.resolve(params.root));
 	const targetStats = await fsPromises.lstat(params.target.hostPath).catch(() => null);
 	if (!isPathInside(canonicalRoot, params.allowFinalSymlinkForUnlink && targetStats?.isSymbolicLink() ? path.resolve(canonicalRoot, path.relative(params.root, params.target.hostPath)) : await resolveCanonicalCandidate(params.target.hostPath))) throw new Error(`Sandbox path escapes allowed mounts; cannot access: ${params.target.containerPath}`);
-	const relative = path.relative(params.root, params.target.hostPath);
-	const segments = relative.split(path.sep).filter(Boolean).slice(0, Math.max(0, relative.split(path.sep).filter(Boolean).length));
+	const segments = path.relative(params.root, params.target.hostPath).split(path.sep).filter(Boolean);
 	let cursor = params.root;
-	for (let index = 0; index < segments.length; index += 1) {
-		cursor = path.join(cursor, segments[index]);
+	for (const [index, segment] of segments.entries()) {
+		cursor = path.join(cursor, segment);
 		const stats = await fsPromises.lstat(cursor).catch(() => null);
 		if (!stats) {
 			if (index === segments.length - 1 && params.allowMissingLeaf) return;
@@ -554,26 +551,7 @@ function createExcludeMatcher(excludeDirs) {
 	const excluded = new Set((excludeDirs ?? []).map((d) => normalizeLowercaseStringOrEmpty(d)));
 	return (name) => excluded.has(normalizeLowercaseStringOrEmpty(name));
 }
-function createConcurrencyLimiter(limit) {
-	let active = 0;
-	const queue = [];
-	const release = () => {
-		active -= 1;
-		queue.shift()?.();
-	};
-	return async (task) => {
-		if (active >= limit) await new Promise((resolve) => {
-			queue.push(resolve);
-		});
-		active += 1;
-		try {
-			return await task();
-		} finally {
-			release();
-		}
-	};
-}
-const runLimitedFs = createConcurrencyLimiter(COPY_TREE_FS_CONCURRENCY);
+const runLimitedFs = pLimit(COPY_TREE_FS_CONCURRENCY);
 async function lstatIfExists(targetPath) {
 	return await runLimitedFs(async () => await fsPromises.lstat(targetPath)).catch(() => null);
 }
@@ -583,7 +561,7 @@ async function copyTreeWithoutSymlinks(params) {
 	const targetStats = await lstatIfExists(params.targetPath);
 	if (params.preserveTargetSymlinks && targetStats?.isSymbolicLink()) return;
 	if (stats.isDirectory()) {
-		await runLimitedFs(async () => await fsPromises.mkdir(params.targetPath, { recursive: true }));
+		await runLimitedFs(fsPromises.mkdir, params.targetPath, { recursive: true });
 		const entries = await runLimitedFs(async () => await fsPromises.readdir(params.sourcePath));
 		await Promise.all(entries.map(async (entry) => {
 			await copyTreeWithoutSymlinks({
@@ -595,7 +573,7 @@ async function copyTreeWithoutSymlinks(params) {
 		return;
 	}
 	if (stats.isFile()) {
-		await runLimitedFs(async () => await fsPromises.mkdir(path.dirname(params.targetPath), { recursive: true }));
+		await runLimitedFs(fsPromises.mkdir, path.dirname(params.targetPath), { recursive: true });
 		await runLimitedFs(async () => await fsPromises.copyFile(params.sourcePath, params.targetPath));
 	}
 }
@@ -606,10 +584,10 @@ async function replaceDirectoryContents(params) {
 	await Promise.all(existing.filter((entry) => !isExcluded(entry)).map(async (entry) => {
 		const targetPath = path.join(params.targetDir, entry);
 		if ((await lstatIfExists(targetPath))?.isSymbolicLink()) return;
-		await runLimitedFs(async () => await fsPromises.rm(targetPath, {
+		await runLimitedFs(fsPromises.rm, targetPath, {
 			recursive: true,
 			force: true
-		}));
+		});
 	}));
 	const sourceEntries = await fsPromises.readdir(params.sourceDir);
 	for (const entry of sourceEntries) {

package/node_modules/p-limit/index.d.ts

@@ -0,0 +1,136 @@
+export type LimitFunction = {
+	/**
+	The number of promises that are currently running.
+	*/
+	readonly activeCount: number;
+
+	/**
+	The number of promises that are waiting to run (i.e. their internal `fn` was not called yet).
+	*/
+	readonly pendingCount: number;
+
+	/**
+	Get or set the concurrency limit.
+	*/
+	concurrency: number;
+
+	/**
+	Discard pending promises that are waiting to run.
+
+	This might be useful if you want to teardown the queue at the end of your program's lifecycle or discard any function calls referencing an intermediary state of your app.
+
+	Note: This does not cancel promises that are already running.
+
+	When `rejectOnClear` is enabled, pending promises are rejected with an `AbortError`.
+	This is recommended if you await the returned promises, for example with `Promise.all`, so pending tasks do not remain unresolved after `clearQueue()`.
+	*/
+	clearQueue: () => void;
+
+	/**
+	Process an iterable of inputs with limited concurrency.
+
+	The mapper function receives the item value and its index.
+
+	This is a convenience function for processing inputs that arrive in batches. For more complex use cases, see [p-map](https://github.com/sindresorhus/p-map).
+
+	@param iterable - An iterable containing an argument for the given function.
+	@param mapperFunction - Promise-returning/async function.
+	@returns A promise equivalent to `Promise.all(Array.from(iterable, (item, index) => limit(mapperFunction, item, index)))`.
+	*/
+	map: <Input, ReturnType> (
+		iterable: Iterable<Input>,
+		mapperFunction: (input: Input, index: number) => PromiseLike<ReturnType> | ReturnType
+	) => Promise<ReturnType[]>;
+
+	/**
+	@param fn - Promise-returning/async function.
+	@param arguments - Any arguments to pass through to `fn`. Support for passing arguments on to the `fn` is provided in order to be able to avoid creating unnecessary closures. You probably don't need this optimization unless you're pushing a *lot* of functions.
+
+	Warning: Avoid calling the same `limit` function inside a function that is already limited by it. This can create a deadlock where inner tasks never run. Use a separate limiter for inner tasks.
+
+	@returns The promise returned by calling `fn(...arguments)`.
+	*/
+	<Arguments extends unknown[], ReturnType>(
+		function_: (...arguments_: Arguments) => PromiseLike<ReturnType> | ReturnType,
+		...arguments_: Arguments
+	): Promise<ReturnType>;
+};
+
+/**
+Run multiple promise-returning & async functions with limited concurrency.
+
+@param concurrency - Concurrency limit. Minimum: `1`. You can pass a number or an options object with a `concurrency` property.
+@returns A `limit` function.
+
+@example
+```
+import pLimit from 'p-limit';
+
+const limit = pLimit(1);
+
+const input = [
+	limit(() => fetchSomething('foo')),
+	limit(() => fetchSomething('bar')),
+	limit(() => doSomething())
+];
+
+// Only one promise is run at once
+const result = await Promise.all(input);
+console.log(result);
+```
+
+@example
+```
+import pLimit from 'p-limit';
+
+const limit = pLimit({concurrency: 1});
+```
+*/
+export default function pLimit(concurrency: number | Options): LimitFunction;
+
+export type Options = {
+	/**
+	Concurrency limit.
+
+	Minimum: `1`.
+	*/
+	readonly concurrency: number;
+
+	/**
+	Reject pending promises with an `AbortError` when `clearQueue()` is called.
+
+	Default: `false`.
+
+	This is recommended if you await the returned promises, for example with `Promise.all`, so pending tasks do not remain unresolved after `clearQueue()`.
+	*/
+	readonly rejectOnClear?: boolean;
+};
+
+/**
+Returns a function with limited concurrency.
+
+The returned function manages its own concurrent executions, allowing you to call it multiple times without exceeding the specified concurrency limit.
+
+Ideal for scenarios where you need to control the number of simultaneous executions of a single function, rather than managing concurrency across multiple functions.
+
+@param function_ - Promise-returning/async function.
+@return Function with limited concurrency.
+
+@example
+```
+import {limitFunction} from 'p-limit';
+
+const limitedFunction = limitFunction(async () => {
+	return doSomething();
+}, {concurrency: 1});
+
+const input = Array.from({length: 10}, limitedFunction);
+
+// Only one promise is run at once.
+await Promise.all(input);
+```
+*/
+export function limitFunction<Arguments extends unknown[], ReturnType>(
+	function_: (...arguments_: Arguments) => PromiseLike<ReturnType>,
+	options: Options
+): (...arguments_: Arguments) => Promise<ReturnType>;

package/node_modules/p-limit/index.js

@@ -0,0 +1,127 @@
+import Queue from 'yocto-queue';
+
+export default function pLimit(concurrency) {
+	let rejectOnClear = false;
+
+	if (typeof concurrency === 'object') {
+		({concurrency, rejectOnClear = false} = concurrency);
+	}
+
+	validateConcurrency(concurrency);
+
+	if (typeof rejectOnClear !== 'boolean') {
+		throw new TypeError('Expected `rejectOnClear` to be a boolean');
+	}
+
+	const queue = new Queue();
+	let activeCount = 0;
+
+	const resumeNext = () => {
+		// Process the next queued function if we're under the concurrency limit
+		if (activeCount < concurrency && queue.size > 0) {
+			activeCount++;
+			queue.dequeue().run();
+		}
+	};
+
+	const next = () => {
+		activeCount--;
+		resumeNext();
+	};
+
+	const run = async (function_, resolve, arguments_) => {
+		// Execute the function and capture the result promise
+		const result = (async () => function_(...arguments_))();
+
+		// Resolve immediately with the promise (don't wait for completion)
+		resolve(result);
+
+		// Wait for the function to complete (success or failure)
+		// We catch errors here to prevent unhandled rejections,
+		// but the original promise rejection is preserved for the caller
+		try {
+			await result;
+		} catch {}
+
+		// Decrement active count and process next queued function
+		next();
+	};
+
+	const enqueue = (function_, resolve, reject, arguments_) => {
+		const queueItem = {reject};
+
+		// Queue the internal resolve function instead of the run function
+		// to preserve the asynchronous execution context.
+		new Promise(internalResolve => { // eslint-disable-line promise/param-names
+			queueItem.run = internalResolve;
+			queue.enqueue(queueItem);
+		}).then(run.bind(undefined, function_, resolve, arguments_)); // eslint-disable-line promise/prefer-await-to-then
+
+		// Start processing immediately if we haven't reached the concurrency limit
+		if (activeCount < concurrency) {
+			resumeNext();
+		}
+	};
+
+	const generator = (function_, ...arguments_) => new Promise((resolve, reject) => {
+		enqueue(function_, resolve, reject, arguments_);
+	});
+
+	Object.defineProperties(generator, {
+		activeCount: {
+			get: () => activeCount,
+		},
+		pendingCount: {
+			get: () => queue.size,
+		},
+		clearQueue: {
+			value() {
+				if (!rejectOnClear) {
+					queue.clear();
+					return;
+				}
+
+				const abortError = AbortSignal.abort().reason;
+
+				while (queue.size > 0) {
+					queue.dequeue().reject(abortError);
+				}
+			},
+		},
+		concurrency: {
+			get: () => concurrency,
+
+			set(newConcurrency) {
+				validateConcurrency(newConcurrency);
+				concurrency = newConcurrency;
+
+				queueMicrotask(() => {
+					// eslint-disable-next-line no-unmodified-loop-condition
+					while (activeCount < concurrency && queue.size > 0) {
+						resumeNext();
+					}
+				});
+			},
+		},
+		map: {
+			async value(iterable, function_) {
+				const promises = Array.from(iterable, (value, index) => this(function_, value, index));
+				return Promise.all(promises);
+			},
+		},
+	});
+
+	return generator;
+}
+
+export function limitFunction(function_, options) {
+	const limit = pLimit(options);
+
+	return (...arguments_) => limit(() => function_(...arguments_));
+}
+
+function validateConcurrency(concurrency) {
+	if (!((Number.isInteger(concurrency) || concurrency === Number.POSITIVE_INFINITY) && concurrency > 0)) {
+		throw new TypeError('Expected `concurrency` to be a number from 1 and up');
+	}
+}

package/node_modules/p-limit/license

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/node_modules/p-limit/package.json

@@ -0,0 +1,58 @@
+{
+	"name": "p-limit",
+	"version": "7.3.0",
+	"description": "Run multiple promise-returning & async functions with limited concurrency",
+	"license": "MIT",
+	"repository": "sindresorhus/p-limit",
+	"funding": "https://github.com/sponsors/sindresorhus",
+	"author": {
+		"name": "Sindre Sorhus",
+		"email": "sindresorhus@gmail.com",
+		"url": "https://sindresorhus.com"
+	},
+	"type": "module",
+	"exports": {
+		"types": "./index.d.ts",
+		"default": "./index.js"
+	},
+	"sideEffects": false,
+	"engines": {
+		"node": ">=20"
+	},
+	"scripts": {
+		"test": "xo && ava && tsd",
+		"benchmark": "node benchmark.js"
+	},
+	"files": [
+		"index.js",
+		"index.d.ts"
+	],
+	"keywords": [
+		"promise",
+		"limit",
+		"limited",
+		"concurrency",
+		"throttle",
+		"throat",
+		"rate",
+		"batch",
+		"ratelimit",
+		"task",
+		"queue",
+		"async",
+		"await",
+		"promises",
+		"bluebird"
+	],
+	"dependencies": {
+		"yocto-queue": "^1.2.1"
+	},
+	"devDependencies": {
+		"ava": "^6.4.1",
+		"in-range": "^3.0.0",
+		"random-int": "^3.0.0",
+		"time-span": "^5.1.0",
+		"tsd": "^0.33.0",
+		"xo": "^1.2.1"
+	}
+}

package/node_modules/p-limit/readme.md

@@ -0,0 +1,173 @@
+# p-limit
+
+> Run multiple promise-returning & async functions with limited concurrency
+
+*Works in Node.js and browsers.*
+
+## Install
+
+```sh
+npm install p-limit
+```
+
+## Usage
+
+```js
+import pLimit from 'p-limit';
+
+const limit = pLimit(1);
+
+const input = [
+	limit(() => fetchSomething('foo')),
+	limit(() => fetchSomething('bar')),
+	limit(() => doSomething())
+];
+
+// Only one promise is run at once
+const result = await Promise.all(input);
+console.log(result);
+```
+
+## API
+
+### pLimit(concurrency) <sup>default export</sup>
+
+Returns a `limit` function.
+
+#### concurrency
+
+Type: `number | object`\
+Minimum: `1`
+
+Concurrency limit.
+
+You can pass a number or an options object with a `concurrency` property.
+
+#### rejectOnClear
+
+Type: `boolean`\
+Default: `false`
+
+Reject pending promises with an `AbortError` when `clearQueue()` is called.
+This is recommended if you await the returned promises, for example with `Promise.all`, so pending tasks do not remain unresolved after `clearQueue()`.
+
+```js
+import pLimit from 'p-limit';
+
+const limit = pLimit({concurrency: 1});
+```
+
+### limit(fn, ...args)
+
+Returns the promise returned by calling `fn(...args)`.
+
+#### fn
+
+Type: `Function`
+
+Promise-returning/async function.
+
+#### args
+
+Any arguments to pass through to `fn`.
+
+Support for passing arguments on to the `fn` is provided in order to be able to avoid creating unnecessary closures. You probably don't need this optimization unless you're pushing a *lot* of functions.
+
+Warning: Avoid calling the same `limit` function inside a function that is already limited by it. This can create a deadlock where inner tasks never run. Use a separate limiter for inner tasks.
+
+### limit.map(iterable, mapperFunction)
+
+Process an iterable of inputs with limited concurrency.
+
+The mapper function receives the item value and its index.
+
+Returns a promise equivalent to `Promise.all(Array.from(iterable, (item, index) => limit(mapperFunction, item, index)))`.
+
+This is a convenience function for processing inputs that arrive in batches. For more complex use cases, see [p-map](https://github.com/sindresorhus/p-map).
+
+### limit.activeCount
+
+The number of promises that are currently running.
+
+### limit.pendingCount
+
+The number of promises that are waiting to run (i.e. their internal `fn` was not called yet).
+
+### limit.clearQueue()
+
+Discard pending promises that are waiting to run.
+
+This might be useful if you want to teardown the queue at the end of your program's lifecycle or discard any function calls referencing an intermediary state of your app.
+
+Note: This does not cancel promises that are already running.
+
+When `rejectOnClear` is enabled, pending promises are rejected with an `AbortError`.
+This is recommended if you await the returned promises, for example with `Promise.all`, so pending tasks do not remain unresolved after `clearQueue()`.
+
+### limit.concurrency
+
+Get or set the concurrency limit.
+
+### limitFunction(fn, options) <sup>named export</sup>
+
+Returns a function with limited concurrency.
+
+The returned function manages its own concurrent executions, allowing you to call it multiple times without exceeding the specified concurrency limit.
+
+Ideal for scenarios where you need to control the number of simultaneous executions of a single function, rather than managing concurrency across multiple functions.
+
+```js
+import {limitFunction} from 'p-limit';
+
+const limitedFunction = limitFunction(async () => {
+	return doSomething();
+}, {concurrency: 1});
+
+const input = Array.from({length: 10}, limitedFunction);
+
+// Only one promise is run at once.
+await Promise.all(input);
+```
+
+#### fn
+
+Type: `Function`
+
+Promise-returning/async function.
+
+#### options
+
+Type: `object`
+
+#### concurrency
+
+Type: `number`\
+Minimum: `1`
+
+Concurrency limit.
+
+#### rejectOnClear
+
+Type: `boolean`\
+Default: `false`
+
+Reject pending promises with an `AbortError` when `clearQueue()` is called.
+This is recommended if you await the returned promises, for example with `Promise.all`, so pending tasks do not remain unresolved after `clearQueue()`.
+
+## Recipes
+
+See [recipes.md](recipes.md) for common use cases and patterns.
+
+## FAQ
+
+### How is this different from the [`p-queue`](https://github.com/sindresorhus/p-queue) package?
+
+This package is only about limiting the number of concurrent executions, while `p-queue` is a fully featured queue implementation with lots of different options, introspection, and ability to pause the queue.
+
+## Related
+
+- [p-throttle](https://github.com/sindresorhus/p-throttle) - Throttle promise-returning & async functions
+- [p-debounce](https://github.com/sindresorhus/p-debounce) - Debounce promise-returning & async functions
+- [p-map](https://github.com/sindresorhus/p-map) - Run promise-returning & async functions concurrently with different inputs
+- [p-all](https://github.com/sindresorhus/p-all) - Run promise-returning & async functions concurrently with optional limited concurrency
+- [More…](https://github.com/sindresorhus/promise-fun)

package/node_modules/yocto-queue/index.d.ts

@@ -0,0 +1,75 @@
+export default class Queue<ValueType> implements Iterable<ValueType> {
+	/**
+	The size of the queue.
+	*/
+	readonly size: number;
+
+	/**
+	Tiny queue data structure.
+
+	The instance is an [`Iterable`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Iteration_protocols), which means you can iterate over the queue front to back with a “for…of” loop, or use spreading to convert the queue to an array. Don't do this unless you really need to though, since it's slow.
+
+	@example
+	```
+	import Queue from 'yocto-queue';
+
+	const queue = new Queue();
+
+	queue.enqueue('🦄');
+	queue.enqueue('🌈');
+
+	console.log(queue.size);
+	//=> 2
+
+	console.log(...queue);
+	//=> '🦄 🌈'
+
+	console.log(queue.dequeue());
+	//=> '🦄'
+
+	console.log(queue.dequeue());
+	//=> '🌈'
+	```
+	*/
+	constructor();
+
+	/**
+	The instance is an [`Iterable`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Iteration_protocols), which means you can iterate over the queue front to back with a “for…of” loop. Using the iterator will not remove the items from the queue. If you want that, use `drain()` instead.
+ 
+	You can also use spreading to convert the queue to an array. Don't do this unless you really need to though, since it's slow.
+	*/
+	[Symbol.iterator](): IterableIterator<ValueType>;
+
+	/**
+	Returns an iterator that dequeues items as you consume it.
+
+	This allows you to empty the queue while processing its items.
+
+	If you want to not remove items as you consume it, use the `Queue` object as an iterator.
+	*/
+	drain(): IterableIterator<ValueType>;
+
+	/**
+	Add a value to the queue.
+	*/
+	enqueue(value: ValueType): void;
+
+	/**
+	Remove the next value in the queue.
+
+	@returns The removed value or `undefined` if the queue is empty.
+	*/
+	dequeue(): ValueType | undefined;
+
+	/**
+	Get the next value in the queue without removing it.
+
+	@returns The value or `undefined` if the queue is empty.
+	*/
+	peek(): ValueType | undefined;
+
+	/**
+	Clear the queue.
+	*/
+	clear(): void;
+}

package/node_modules/yocto-queue/index.js

@@ -0,0 +1,90 @@
+/*
+How it works:
+`this.#head` is an instance of `Node` which keeps track of its current value and nests another instance of `Node` that keeps the value that comes after it. When a value is provided to `.enqueue()`, the code needs to iterate through `this.#head`, going deeper and deeper to find the last value. However, iterating through every single item is slow. This problem is solved by saving a reference to the last value as `this.#tail` so that it can reference it to add a new value.
+*/
+
+class Node {
+	value;
+	next;
+
+	constructor(value) {
+		this.value = value;
+	}
+}
+
+export default class Queue {
+	#head;
+	#tail;
+	#size;
+
+	constructor() {
+		this.clear();
+	}
+
+	enqueue(value) {
+		const node = new Node(value);
+
+		if (this.#head) {
+			this.#tail.next = node;
+			this.#tail = node;
+		} else {
+			this.#head = node;
+			this.#tail = node;
+		}
+
+		this.#size++;
+	}
+
+	dequeue() {
+		const current = this.#head;
+		if (!current) {
+			return;
+		}
+
+		this.#head = this.#head.next;
+		this.#size--;
+
+		// Clean up tail reference when queue becomes empty
+		if (!this.#head) {
+			this.#tail = undefined;
+		}
+
+		return current.value;
+	}
+
+	peek() {
+		if (!this.#head) {
+			return;
+		}
+
+		return this.#head.value;
+
+		// TODO: Node.js 18.
+		// return this.#head?.value;
+	}
+
+	clear() {
+		this.#head = undefined;
+		this.#tail = undefined;
+		this.#size = 0;
+	}
+
+	get size() {
+		return this.#size;
+	}
+
+	* [Symbol.iterator]() {
+		let current = this.#head;
+
+		while (current) {
+			yield current.value;
+			current = current.next;
+		}
+	}
+
+	* drain() {
+		while (this.#head) {
+			yield this.dequeue();
+		}
+	}
+}

package/node_modules/yocto-queue/license

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/node_modules/yocto-queue/package.json

@@ -0,0 +1,48 @@
+{
+	"name": "yocto-queue",
+	"version": "1.2.2",
+	"description": "Tiny queue data structure",
+	"license": "MIT",
+	"repository": "sindresorhus/yocto-queue",
+	"funding": "https://github.com/sponsors/sindresorhus",
+	"author": {
+		"name": "Sindre Sorhus",
+		"email": "sindresorhus@gmail.com",
+		"url": "https://sindresorhus.com"
+	},
+	"type": "module",
+	"exports": "./index.js",
+	"types": "./index.d.ts",
+	"sideEffects": false,
+	"engines": {
+		"node": ">=12.20"
+	},
+	"scripts": {
+		"//test": "xo && ava && tsd",
+		"test": "ava && tsd"
+	},
+	"files": [
+		"index.js",
+		"index.d.ts"
+	],
+	"keywords": [
+		"queue",
+		"data",
+		"structure",
+		"algorithm",
+		"queues",
+		"queuing",
+		"list",
+		"array",
+		"linkedlist",
+		"fifo",
+		"enqueue",
+		"dequeue",
+		"data-structure"
+	],
+	"devDependencies": {
+		"ava": "^3.15.0",
+		"tsd": "^0.17.0",
+		"xo": "^0.44.0"
+	}
+}

package/node_modules/yocto-queue/readme.md

@@ -0,0 +1,80 @@
+# yocto-queue [![](https://badgen.net/bundlephobia/minzip/yocto-queue)](https://bundlephobia.com/result?p=yocto-queue)
+
+> Tiny queue data structure
+
+You should use this package instead of an array if you do a lot of `Array#push()` and `Array#shift()` on large arrays, since `Array#shift()` has [linear time complexity](https://medium.com/@ariel.salem1989/an-easy-to-use-guide-to-big-o-time-complexity-5dcf4be8a444#:~:text=O(N)%E2%80%94Linear%20Time) *O(n)* while `Queue#dequeue()` has [constant time complexity](https://medium.com/@ariel.salem1989/an-easy-to-use-guide-to-big-o-time-complexity-5dcf4be8a444#:~:text=O(1)%20%E2%80%94%20Constant%20Time) *O(1)*. That makes a huge difference for large arrays.
+
+> A [queue](https://en.wikipedia.org/wiki/Queue_(abstract_data_type)) is an ordered list of elements where an element is inserted at the end of the queue and is removed from the front of the queue. A queue works based on the first-in, first-out ([FIFO](https://en.wikipedia.org/wiki/FIFO_(computing_and_electronics))) principle.
+
+## Install
+
+```sh
+npm install yocto-queue
+```
+
+## Usage
+
+```js
+import Queue from 'yocto-queue';
+
+const queue = new Queue();
+
+queue.enqueue('🦄');
+queue.enqueue('🌈');
+
+console.log(queue.size);
+//=> 2
+
+console.log(...queue);
+//=> '🦄 🌈'
+
+console.log(queue.dequeue());
+//=> '🦄'
+
+console.log(queue.dequeue());
+//=> '🌈'
+```
+
+## API
+
+### `queue = new Queue()`
+
+The instance is an [`Iterable`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Iteration_protocols), which means you can iterate over the queue front to back with a “for…of” loop. Using the iterator will not remove the items from the queue. If you want that, use [`drain()`](#drain) instead.
+
+You can also use spreading to convert the queue to an array. Don't do this unless you really need to though, since it's slow.
+
+#### `.enqueue(value)`
+
+Add a value to the queue.
+
+#### `.dequeue()`
+
+Remove the next value in the queue.
+
+Returns the removed value or `undefined` if the queue is empty.
+
+#### `.peek()`
+
+Get the next value in the queue without removing it.
+
+Returns the value or `undefined` if the queue is empty.
+
+#### `.drain()`
+
+Returns an iterator that dequeues items as you consume it.
+
+This allows you to empty the queue while processing its items.
+
+If you want to not remove items as you consume it, use the `Queue` object as an iterator.
+
+#### `.clear()`
+
+Clear the queue.
+
+#### `.size`
+
+The size of the queue.
+
+## Related
+
+- [quick-lru](https://github.com/sindresorhus/quick-lru) - Simple “Least Recently Used” (LRU) cache

package/npm-shrinkwrap.json

@@ -1,16 +1,44 @@
 {
   "name": "@openclaw/openshell-sandbox",
-  "version": "2026.7.1-beta.6",
+  "version": "2026.7.2-beta.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@openclaw/openshell-sandbox",
-      "version": "2026.7.1-beta.6",
+      "version": "2026.7.2-beta.1",
       "dependencies": {
+        "p-limit": "7.3.0",
         "zod": "4.4.3"
       }
     },
+    "node_modules/p-limit": {
+      "version": "7.3.0",
+      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-7.3.0.tgz",
+      "integrity": "sha512-7cIXg/Z0M5WZRblrsOla88S4wAK+zOQQWeBYfV3qJuJXMr+LnbYjaadrFaS0JILfEDPVqHyKnZ1Z/1d6J9VVUw==",
+      "license": "MIT",
+      "dependencies": {
+        "yocto-queue": "^1.2.1"
+      },
+      "engines": {
+        "node": ">=20"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/yocto-queue": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-1.2.2.tgz",
+      "integrity": "sha512-4LCcse/U2MHZ63HAJVE+v71o7yOdIe4cZ70Wpf8D/IyjDKYQLV5GD46B+hSTjJsvV5PztjvHoU580EftxjDZFQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.20"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/zod": {
       "version": "4.4.3",
       "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/openshell-sandbox",
-  "version": "2026.7.1-beta.6",
+  "version": "2026.7.2-beta.1",
   "description": "OpenClaw sandbox backend for the NVIDIA OpenShell CLI with mirrored local workspaces and SSH command execution.",
   "repository": {
     "type": "git",
@@ -8,6 +8,7 @@
   },
   "type": "module",
   "dependencies": {
+    "p-limit": "7.3.0",
     "zod": "4.4.3"
   },
   "openclaw": {
@@ -20,10 +21,10 @@
       "minHostVersion": ">=2026.5.12-beta.1"
     },
     "compat": {
-      "pluginApi": ">=2026.7.1-beta.6"
+      "pluginApi": ">=2026.7.2-beta.1"
     },
     "build": {
-      "openclawVersion": "2026.7.1-beta.6",
+      "openclawVersion": "2026.7.2-beta.1",
       "bundledDist": false
     },
     "release": {
@@ -41,7 +42,7 @@
     "README.md"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.7.1-beta.6"
+    "openclaw": ">=2026.7.2-beta.1"
   },
   "peerDependenciesMeta": {
     "openclaw": {
@@ -49,6 +50,7 @@
     }
   },
   "bundledDependencies": [
+    "p-limit",
     "zod"
   ]
 }