feat(provider): add OpenComputer sandbox provider (REST API)

[zozo123]

What

Adds provider: opencomputer (aliases oc, open-computer): a delegated-run provider for OpenComputer full Linux VMs that runs entirely on the OpenComputer REST API — no oc CLI process at runtime. Crabbox owns local config, repo claims, sync manifests/guardrails, slugs, timing, and normalized list/status rendering; OpenComputer owns the VM and transport.

Everything is off-argv

• Auth — API key sent only in the X-API-Key header. Resolved from CRABBOX_OPENCOMPUTER_API_KEY / OPENCOMPUTER_API_KEY / the oc config file (~/.oc/config.json, written by oc config set api-key). Never persisted in Crabbox config, never on argv.
• Env forwarding — --allow-env/--env-from-profile ride in the exec request body (POST /api/sandboxes/<id>/exec/run, envs field), so values never touch a command line.
• Sync — the working-tree tar is uploaded via PUT /api/sandboxes/<id>/files (content in the request body), then extracted in-sandbox. Archive-sync feature advertised, so --force-sync-large and --sync-only are honored; --checksum rejected.

Lifecycle (all REST)

POST /api/sandboxes (sizing only as a valid CPU/memory tier, else the service default) → file-API sync → POST .../exec/run (cwd = workspace, env in body, exit code mirrored) → DELETE /api/sandboxes/<id> (skipped with --keep).

Why API instead of the CLI

Per the maintainer suggestion: there is no Go SDK (TS/Python only), but the REST surface is complete and was confirmed live. Going API-only removes the oc binary dependency, keeps every secret/payload off argv, makes env forwarding native, gives reliable exit codes, and is a net −500 LOC vs the CLI hybrid.

Verification

• gofmt, go vet, go test -race, scripts/check-docs.sh clean; core coverage 91% ≥ 90%.
• Unit tests run against an httptest fake API (assert env in the exec body not argv, sync via file API, exit-code propagation, --sync-only skips the command, --keep retains, missing key errors before any create).
• e2e against app.opencomputer.dev: create → file-API archive sync (multi-file, read back inside the box) → exec/run → native env (--allow-env value printed from inside) → --sync-only → teardown — all over REST, no leftover sandboxes.

🤖 Generated with Claude Code

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed June 11, 2026, 3:07 AM ET / 07:07 UTC.

Summary
Review failed before ClawSweeper could summarize the requested change.

Reproducibility: unclear. The review failed before ClawSweeper could establish a reproduction path.

Review metrics: none identified.

Merge readiness
Overall: 🌊 off-meta tidepool
Proof: 🌊 off-meta tidepool
Patch quality: 🌊 off-meta tidepool
Result: rating does not apply to this item.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Risk before merge

• [P1] No close action taken because the review did not complete.

Maintainer options:

1. Decide the mitigation before merge
   Retry the Codex review after fixing the execution failure.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

• [P1] Review did not complete, so no work-lane recommendation was made.

Review details

Best possible solution:

Retry the Codex review after fixing the execution failure.

Do we have a high-confidence way to reproduce the issue?

Unclear. The review failed before ClawSweeper could establish a reproduction path.

Is this the best way to solve the issue?

Unclear. Retry the review first so ClawSweeper can evaluate the actual issue and fix direction.

AGENTS.md: unclear because the file could not be read completely.

Codex review notes: model internal, reasoning high; reviewed against d56ce8028f30.

Label changes

Label changes:

• add rating: 🌊 off-meta tidepool: Overall readiness is 🌊 off-meta tidepool; proof is 🌊 off-meta tidepool and patch quality is 🌊 off-meta tidepool.
• remove status: 📣 needs proof: Current PR status no longer selects a status label.
• remove P2: Current review triage priority is none.
• remove merge-risk: 🚨 security-boundary: Current PR review selected no merge-risk labels.
• remove rating: 🦐 gold shrimp: Current PR rating is rating: 🌊 off-meta tidepool, so this older rating label is no longer current.
• remove merge-risk: 🚨 availability: Current PR review selected no merge-risk labels.

Label justifications:

• rating: 🌊 off-meta tidepool: Overall readiness is 🌊 off-meta tidepool; proof is 🌊 off-meta tidepool and patch quality is 🌊 off-meta tidepool.

Evidence reviewed

What I checked:

• failure reason: codex execution failed.
• codex failure detail: Codex review failed for this PR with exit 1.
• codex stdout: Per-item Codex failure; continuing with the rest of the shard.

Likely related people:

• unknown: Codex failed before it could trace repository history. (role: review did not complete; confidence: low)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[zozo123]

@clawsweeper re-review

Addressed both blockers in 989f05e:

• [P1] Removed env forwarding entirely; --allow-env/--env-from-profile are now rejected before any sandbox is created, so no secret (cleartext or base64) ever reaches argv. Deleted the env-profile/writeRemoteFile path.
• [P2] Provider now advertises FeatureArchiveSync, so --force-sync-large and --sync-only are honored; added focused coverage.

PR body updated with redacted live e2e output (sync, --sync-only, env-rejection).

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/27155937018
• Updated: 2026-06-08T17:50:56.335Z

[zozo123]

@clawsweeper re-review

Addressed the second-round findings in 69c424e:

• [P2] Env gate now rejects only explicit forwarding (EnvSummary from --allow-env/--env-from-profile, or any non-CI/NODE_OPTIONS name), mirroring the wandb implicit-default carve-out. Crabbox's implicit CI/NODE_OPTIONS defaults no longer fail ordinary runs; explicit forwarding still errors before any oc call. Added regression tests for both paths.
• [P3] Reverted the CHANGELOG.md edit — the Unreleased section is release-owned (matching the Tenki provider PR).

Re-verified e2e: a run with CI/NODE_OPTIONS set proceeds (exit 0); --allow-env is rejected before sandbox creation.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/27156707727
• Updated: 2026-06-08T18:01:49.881Z

[zozo123]

Update (cef7d5a): env forwarding now works — safely, off-argv — via the OpenComputer REST API.

Per the maintainer suggestion to use the API: oc exec can't carry values off argv, so instead of dropping env forwarding, Crabbox now writes the forwarded env to a sourced profile inside the sandbox via PUT /api/sandboxes/<id>/files. The profile content travels in the HTTP request body and the key in the X-API-Key header — neither touches local or remote argv. The command is wrapped to source the profile.

• API key reused from oc config (~/.oc/config.json) or CRABBOX_OPENCOMPUTER_API_KEY/OPENCOMPUTER_API_KEY; no new secret in Crabbox config, sent only as a header.
• New apiclient.go (uses Runtime.HTTP, fully unit-tested); tests assert the upload body carries the value while argv does not, plus the no-key error path.
• Ephemeral boxes skip profile cleanup (destroyed on teardown).

e2e against app.opencomputer.dev: --allow-env REAL_SECRET -- printenv REAL_SECRET prints the value from inside the box; secret absent from every oc exec argv.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/27158265435
• Updated: 2026-06-08T18:33:15.371Z

[zozo123]

Update (c981dc3): reworked to run entirely on the OpenComputer REST API — no oc CLI at runtime.

This addresses the "can we do it all via the API" direction end to end:

• Lifecycle (create/status/list/kill), command execution (exec/run), and file sync (PUT .../files) all go through the REST API with X-API-Key.
• Env forwarding is now native in the exec body (envs) — no profile-file hack; secrets never touch argv.
• Sync uploads the tar via the file API (request body), then extracts in-sandbox.
• Removed the oc CLI dependency, cli.go/env.go, and the cliPath config (net −500 LOC).

Verified e2e against app.opencomputer.dev: create → file-API sync (files read back) → exec/run → native env → --sync-only → teardown, all REST, no leftover sandboxes. Local gates green (race, docs, coverage 91%).

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/27159203083
• Updated: 2026-06-08T18:49:30.488Z

[steipete]

Live OpenComputer E2E passed on b9e476d19201e8b45a324c7af75732bb63101e30.

Proof covered:

• burst sandbox create, archive sync, Linux command execution, and automatic delete
• retained create, status, and list visibility
• retained workspace resync
• --no-sync reuse with off-argv environment forwarding
• out-of-band sandbox deletion followed by explicit stale-claim cleanup
• final list contained no retained claim

Local gates also passed: go test -race ./..., focused go vet, Worker format/lint/typecheck/tests/build, docs generation, and commit autoreview with no actionable findings.

[steipete]

@clawsweeper re-review

Exact-head closeout proof for b9e476d19201e8b45a324c7af75732bb63101e30:

• Local: go vet ./..., go test -race ./..., and scripts/check-docs.sh pass.
• Autoreview: clean after fixing OpenComputer server-type metadata, dedicated tag reads, burst-capacity plumbing, and the alpha restart warning.
• Exact binary SHA-256: 189654d6600e8e9e3537a4c054eb2807af65861c7915460d1dd9fb72a6f2796a.
• Reserved live proof: reservation 10164cc4-3b23-4703-89d7-422f07e01109, run started at 06:57 UTC inside its 06:45-07:00 UTC slot.
• Real provider lifecycle passed: one-shot create/sync/exec/delete (sb-4e17d664), retained create/status/list (sb-a312a5d6), staged resync, no-sync reuse with off-argv secret env forwarding, direct API deletion, explicit missing-claim cleanup, and final inventory count zero.
• GitHub CI run https://github.com/openclaw/crabbox/actions/runs/27329581271 completed successfully: Scripts, Docs, Worker, Go, and Release Check are all green.

The ClawSweeper retry failed in its review runner without reporting a patch finding; the exact-head repo autoreview above completed cleanly.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Failed
• Detail: The targeted re-review did not finish cleanly. Check the workflow run for details.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/27329970603
• Updated: 2026-06-11T07:08:08.375Z