fix: support Apple container 1.0.0 inspect JSON

[clawsweeper]

Summary

• accept apple-container inspect/list JSON where status is either a string or an object with state
• discover IP addresses from both top-level networks[] and status.networks[] while preserving CIDR stripping
• add focused table-driven coverage for decodeInspect, status(), ip(), and list parsing

Fixes #354

Validation

• go test ./internal/providers/applecontainer
• go test ./internal/providers/all
• go vet ./...

ClawSweeper 🐠 replacement reef notes:

• Cluster: issue-openclaw-crabbox-354
• Source PRs: none
• Credit: Source issue by @coygeek: Fix apple-container parsing for Apple container 1.0.0 JSON #354.; Use a closing reference in the PR body: Fixes Fix apple-container parsing for Apple container 1.0.0 JSON #354.; No contributor implementation PR is being replaced; feat: add apple-container local development provider #192 is only historical context for the existing provider.
• Validation: go test ./internal/providers/applecontainer; go test ./internal/providers/all; go vet ./...
• Replacement reason: ClawSweeper could not update the source PR branch directly, so it opened a writable replacement PR instead.

fish notes: reasoning high; reviewed against 54b08c5.

[clawsweeper]

Codex review: passed. Reviewed June 15, 2026, 12:45 AM ET / 04:45 UTC.

Summary
The branch updates the apple-container inspect/list JSON parser to accept string or object status values, reads IPs from top-level or status-scoped networks, and adds focused provider tests.

Reproducibility: yes. Current main unmarshals apple-container status into a Go string and only reads top-level networks, so the supplied Apple container 1.0.0 object-status JSON fails before IP discovery.

Review metrics: 2 noteworthy metrics.

• Changed surface: 2 files, +131/-17. The functional diff is confined to the apple-container parser and adjacent tests.
• Release-owned files: 0 changed. The earlier CHANGELOG.md blocker has been removed from the current PR head.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• none.

Risk before merge

• [P1] I did not run an Apple silicon live smoke against the PR head; review confidence comes from source inspection, the reporter's runtime failure log, and the added parser tests.

Maintainer options:

1. Decide the mitigation before merge
   Merge the provider-local parser and regression tests once exact-head checks and maintainer review are satisfied, then let the PR close Fix apple-container parsing for Apple container 1.0.0 JSON #354.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

• No ClawSweeper repair is needed; the branch already contains the narrow code/test fix and the remaining action is normal PR checks and maintainer review.

Security
Cleared: The diff only changes Go JSON parsing and adjacent tests; it adds no dependencies, workflows, secret handling, or new code-execution surface.

Review details

Best possible solution:

Merge the provider-local parser and regression tests once exact-head checks and maintainer review are satisfied, then let the PR close #354.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main unmarshals apple-container status into a Go string and only reads top-level networks, so the supplied Apple container 1.0.0 object-status JSON fails before IP discovery.

Is this the best way to solve the issue?

Yes. The PR uses a provider-local compatibility decoder and helper changes, preserving the older JSON shape without changing Crabbox core or provider architecture.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 569f76e5068a.

Label changes

Label changes:

• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a ClawSweeper bot PR, so the external contributor real-behavior proof gate does not apply.

Label justifications:

• P2: This fixes a concrete apple-container provider runtime compatibility bug with limited provider-specific blast radius.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a ClawSweeper bot PR, so the external contributor real-behavior proof gate does not apply.

Evidence reviewed

What I checked:

• Repository policy read: Read the full target AGENTS.md; provider-boundary and focused-test guidance apply because the change stays inside the apple-container provider adapter and adjacent tests. (AGENTS.md:1, 569f76e5068a)
• Current-main bug path: Current main models inspectContainer.Status as a string and only scans top-level Networks, so object-valued status with status.networks is unsupported. (internal/providers/applecontainer/client.go:18, 569f76e5068a)
• Shared parser call sites: Both container ls and container inspect flow through decodeInspect, so the parser change covers inventory, inspect, resolve, and wait-for-network-address paths. (internal/providers/applecontainer/backend.go:489, 569f76e5068a)
• PR implementation: At PR head, inspectStatus.UnmarshalJSON accepts the old string form and the new object form, while status() and ip() read Status.State and both network locations with CIDR stripping. (internal/providers/applecontainer/client.go:19, d4c00f2cb5ba)
• PR regression coverage: The PR adds list parsing coverage for object-status networks plus decodeInspect and IP extraction coverage for the new shape while preserving old cases. (internal/providers/applecontainer/backend_test.go:404, d4c00f2cb5ba)
• Current PR surface: GitHub reports the current PR head changes only internal/providers/applecontainer/client.go and internal/providers/applecontainer/backend_test.go; the earlier CHANGELOG.md edit is gone. (d4c00f2cb5ba)

Likely related people:

• zozo123: Authored the merged apple-container provider PR that introduced the provider parser, backend, and tests touched by this fix. (role: feature introducer; confidence: high; commits: 2fc37beecc6d; files: internal/providers/applecontainer/client.go, internal/providers/applecontainer/backend.go, internal/providers/applecontainer/backend_test.go)
• steipete: Merged the original provider PR and authored recent apple-container hardening commits touching the same provider area. (role: recent area contributor and merger; confidence: high; commits: a1c6cc732a57, e815ced5703f, e95f63a9d73d; files: internal/providers/applecontainer/client.go, internal/providers/applecontainer/backend.go, internal/providers/applecontainer/backend_test.go)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[clawsweeper]

🦞👀
ClawSweeper saw the passing review, but did not merge yet.

Source: clawsweeper[bot]
Feedback: structured ClawSweeper verdict: pass (sha=d4c00f2cb5ba3716b7fecd35b7e3199da8ba56f3)
Merge status: PR is in ClawSweeper autofix mode; merge is disabled

I left the PR open for the remaining gate instead of bypassing it.

Automerge progress:

• 2026-06-15 04:36:06 UTC review requested repair 24169e332944 (structured ClawSweeper marker: fix-required (finding=review-feedback sha=24169e...)

• 2026-06-15 04:36:32 UTC repair queued 24169e332944 (autonomous) Run: https://github.com/openclaw/clawsweeper/actions/runs/27524323827

• 2026-06-15 04:37:59 UTC repair started (running) in 1s Run: https://github.com/openclaw/clawsweeper/actions/runs/27524323827 automerge-openclaw-crabbox-356

• 2026-06-15 04:38:04 UTC validation plan (passed) in 6s Run: https://github.com/openclaw/clawsweeper/actions/runs/27524323827 git diff --check

• 2026-06-15 04:38:14 UTC Codex write preflight (passed) in 16s Run: https://github.com/openclaw/clawsweeper/actions/runs/27524323827 danger-full-access

• 2026-06-15 04:40:09 UTC Codex edit 1 24169e332944 (complete) in 2m 11s Run: https://github.com/openclaw/clawsweeper/actions/runs/27524323827 exit 0

• 2026-06-15 04:40:34 UTC validation and review 1 d4c00f2cb5ba (complete) in 2m 36s Run: https://github.com/openclaw/clawsweeper/actions/runs/27524323827 already-current

• 2026-06-15 04:40:38 UTC repair completed d4c00f2cb5ba (branch updated) in 2m 40s Run: https://github.com/openclaw/clawsweeper/actions/runs/27524323827 initial automerge rebase is delegated to Codex repair

• 2026-06-15 04:40:38 UTC review queued d4c00f2cb5ba (after repair)

• 2026-06-15 04:50:41 UTC automerge wait d4c00f2cb5ba (waiting) in 12m 43s Run: https://github.com/openclaw/clawsweeper/actions/runs/27524323827 waiting for GitHub checks: Go:IN_PROGRESS, Release Check:IN_PROGRESS

• 2026-06-15 04:46:06 UTC review passed d4c00f2cb5ba (structured ClawSweeper verdict: pass (sha=d4c00f2cb5ba3716b7fecd35b7e3199da8ba5...)

• 2026-06-15 04:50:42 UTC repair finished d4c00f2cb5ba (pushed) in 12m 44s Run: https://github.com/openclaw/clawsweeper/actions/runs/27524323827 repair_contributor_branch

[steipete]

Landed in 10dc3de.

Verification:

• go test ./internal/providers/applecontainer ./internal/providers/all
• go vet ./...
• .agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main --parallel-tests 'go test ./internal/providers/applecontainer ./internal/providers/all && go vet ./...' --stream-engine-output — clean, no actionable findings
• Exact-head CI run https://github.com/openclaw/crabbox/actions/runs/27524451803 — Apple VZ, Scripts, Worker, Go, Docs, and Release Check all passed

Maintainer changelog credit added in 4c91ede5. Caveat: no live Apple container 1.0 smoke was run; proof is the reporter's runtime JSON/failure, regression coverage, local validation, and green CI.