$ the-wire · showcase
Crabbox hardens provisioning recovery, OpenClaw proves QA coverage
By RepoJournal · Filed · About OpenClaw
2 people shipped this
Crabbox fixes stuck Azure leases and untracked cloud resources after interrupted provisioning, while OpenClaw adds primary QA proof for core agent runtime behaviors.
Crabbox shipped a set of fixes targeting provisioning and sync failures left behind by coordinator deployments and transient SSH drops. Azure provisioning can now recover a lease stuck in provisioning when a coordinator deployment interrupts the flow after a public IP, network interface, or OS disk was created but before the VM existed. Azure discovers all paginated VM, NIC, public-IP, and disk inventory in the lease's persisted subscription to clean up the exact-owned partial resource set [1]. Similarly, negotiated managed-provider leases are protected from untracked, billable cloud resources when a coordinator-version change replaces the Durable Object before the cloud identity persists; scheduled fleet maintenance now detects the interruption, waits through a deployment settle period, and recovers using one provider path [2].
The same attention to interrupted work applies to sync: a transient SSH exit 255 can no longer abort safe remote preparation or finalization after expensive work completed. The retry boundary now retries exactly once for explicitly idempotent SSH bookkeeping, including remote workdir creation, git and sync-manifest seed operations, manifest pruning, and token-scoped sync finalization [3]. Separately, the Daytona snapshot bootstrap path is now admin-only and explicitly confirmed, securing reusable snapshots through the coordinator and closing the prior one-off route that accepted mutable image inputs [4].
On the OpenClaw side, the news is QA coverage rather than runtime behavior. The team added primary executable proof for several agent-runtime guarantees that previously only had secondary fixture ownership. One new Vitest scenario proves the real `apply_patch` and `edit` tools from `createOpenClawCodingTools` persist exact workspace bytes, return actionable receipts, and reject traversal mutations [5]. Another scenario proves agent session scope continuity across turns: fresh turns reuse one canonical session scope, preserve prior context, and stay isolated from other session keys [6]. Tool approval controls now have a composed scenario driving a generic sentinel tool through the production `before_tool_call` wrapper and the real embedded plugin approval broker, covering pending identity, deny and allow-once decisions, and rewritten execution arguments [7]. Packaged browser profiles are now verified at the distribution boundary with a real Docker image and the pinned Chromium revision [8]. In a smaller change, Telegram automatic deliveries are now recorded in the sent-message ledger, restoring bot-owned reaction checks and removing the per-send full-ledger expiry scan [9].
Action items
- → Deploy the Crabbox fixes for provisioning recovery and SSH sync retry before relying on scheduled fleet maintenance openclaw/crabbox [immediate]
- → Review the new admin-only Daytona snapshot bootstrap for your coordinator workflow openclaw/crabbox [plan]
- → Run the new QA scenarios in CI to confirm your agent runtime preserves session scope and enforces tool approval openclaw/openclaw [plan]
References
- [1] fix(azure): clean partial resources after interrupted provisioning ↗ openclaw/crabbox
- [2] fix: recover provisioning interrupted by coordinator deployments ↗ openclaw/crabbox
- [3] fix(sync): recover finalization after transient SSH disconnect ↗ openclaw/crabbox
- [4] fix(daytona): secure reusable snapshot bootstrap ↗ openclaw/crabbox
- [5] chore(qa): prove workspace mutation tools ↗ openclaw/openclaw
- [6] test(qa): prove agent session scope continuity ↗ openclaw/openclaw
- [7] fix(qa): prove agent tool approval controls ↗ openclaw/openclaw
- [8] test(qa): cover packaged browser profiles ↗ openclaw/openclaw
- [9] fix(telegram): record automatic delivery message ids ↗ openclaw/openclaw
