Add crabbox.sh by OpenClaw remote execution integration

[zozo123]

Summary

• Adds a provider-generic crabbox.sh integration with a SIMPLE worker and MCP server bridge for trusted remote command execution.
• Defaults to Crabbox local-container so users can try it with Docker and no cloud credentials, while still supporting any provider exposed by the installed crabbox binary through provider, profiles, env, and Crabbox config.
• Documents the Crabbox/OpenClaw trust boundary, task contract, retry mapping, local proof path, Islo config path, and operational guardrails.
• Adds AI workflow examples for Crabbox over MCP and an external SIMPLE worker.

Test plan

• PASS: python3 -m py_compile integrations/crabbox/*.py
• PASS: python3 -m json.tool ai/examples/23-crabbox-mcp-run.json >/dev/null && python3 -m json.tool ai/examples/24-crabbox-simple-worker.json >/dev/null && python3 -m json.tool integrations/crabbox/taskdefs/crabbox_run_taskdef.json >/dev/null
• PASS: provider-generic bridge smoke assertions for request parsing, command construction, exit classification, and default provider selection.
• PASS: python3 integrations/crabbox/conductor_crabbox_worker.py --help >/dev/null
• PASS: worker fake-client e2e below: process_task produced IN_PROGRESS heartbeats/logs and final COMPLETED from Crabbox local-container.
• PASS: temporary venv install of integrations/crabbox/requirements.txt, then python3 integrations/crabbox/crabbox_mcp_server.py --help >/dev/null
• PASS: crabbox --version -> 0.26.0
• PASS: bridge-driven Crabbox local-container e2e proof below.
• PASS/BLOCKED AS EXPECTED: bridge-driven Islo proof path returns FAILED_WITH_TERMINAL_ERROR because this environment has no ISLO_API_KEY.
• BLOCKED: ./gradlew :conductor-ai:test --tests org.conductoross.conductor.ai.examples.ExampleWorkflowValidationTest -> local machine has no Java runtime.
• BLOCKED: ./gradlew spotlessApply -> local machine has no Java runtime.

Worker e2e proof

Ran process_task with a fake Conductor client and a real Crabbox local-container task. It streamed logs, sent repeated IN_PROGRESS updates, then completed successfully.

worker e2e fake-client passed
updates ['IN_PROGRESS', ..., 'COMPLETED']
logs 27

Crabbox local-container proof

Credential-free e2e smoke through the bridge succeeded. This proves the Python bridge can call Crabbox, Crabbox can provision a Docker-backed local lease, sync the repo, run validation remotely, emit timing JSON, and clean up.

python3 - <<'PY'
import sys
sys.path.insert(0, 'integrations/crabbox')
from crabbox_bridge import CrabboxRequest, run_crabbox
result = run_crabbox(CrabboxRequest.from_mapping({
    'provider': 'local-container',
    'command': 'python3 -m py_compile integrations/crabbox/*.py && python3 -m json.tool ai/examples/23-crabbox-mcp-run.json >/dev/null && python3 -m json.tool ai/examples/24-crabbox-simple-worker.json >/dev/null && python3 -m json.tool integrations/crabbox/taskdefs/crabbox_run_taskdef.json >/dev/null',
    'shell': True,
    'workspaceDir': '.',
    'timeoutSeconds': 300,
}))
print(result['status'])
print(result['exitCode'])
print(result['reason'])
raise SystemExit(0 if result['status'] == 'COMPLETED' and result['exitCode'] == 0 else 1)
PY

Stable output:

COMPLETED
0
crabbox command completed
provisioning provider=local-container ...
sync candidate: 3489 files, 29.3 MiB
running on 127.0.0.1 python3 -m py_compile integrations/crabbox/*.py ...
command complete ... exit=0
"provider":"local-container" ... "exitCode":0 ... "leaseStopped":true

Crabbox Islo proof

Attempted the same bridge path with provider: islo:

python3 - <<'PY'
import sys
sys.path.insert(0, 'integrations/crabbox')
from crabbox_bridge import CrabboxRequest, run_crabbox
result = run_crabbox(CrabboxRequest.from_mapping({
    'provider': 'islo',
    'command': 'python3 --version',
    'shell': True,
    'workspaceDir': '.',
    'timeoutSeconds': 60,
}))
print(result['status'])
print(result['exitCode'])
print(result['reason'])
print(result['outputTail'])
PY

Result:

FAILED_WITH_TERMINAL_ERROR
2
crabbox configuration or authentication failed
provider=islo requires ISLO_API_KEY

The Islo path is wired and classified correctly, but this environment needs ISLO_API_KEY or CRABBOX_ISLO_API_KEY to complete a real remote Islo run.