[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M698QA7624WGTPX7F8PJ12F2":3,"skill-same:01M698QA7624WGTPX7F8PJ12F2":66},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":43,"commitSha":44,"skillDirectory":45,"forksCount":46,"repositoryHtmlUrl":47,"repositoryHomepageUrl":48,"ownerHtmlUrl":49,"ownerBlogUrl":48,"ownerDescription":50,"updatedAt":51,"install":52,"resources":65},"01M698QA7624WGTPX7F8PJ12F2","crabbox",null,"Use Crabbox from macOS, Linux, or native Windows controllers to run OpenClaw Windows node builds, tests, and targeted proof on remote native Windows or WSL2 hosts, including Azure or brokered AWS leases and static SSH hosts. Use when remote Windows validation is needed or the user asks for Crabbox validation. Always report the actual provider, lease id, run URL, command, and result.","openclaw\u002Fopenclaw-windows-node","openclaw","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F252820863?v=4","01M698P3FSAZ6B4R928ZF19KPT","01M698Q6SND6RHZDPP8ZM0NSP7",2198,"MIT","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw-windows-node\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fcrabbox\u002FSKILL.md",[],[5,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,9],"provider","when","result","static","for","hosts","URL","remote","native","id","tests","use","command","node","report","run","azure","windows","linux","macos","2026-11-10 10:12:30",false,"---\nname: crabbox\ndescription: Use Crabbox from macOS, Linux, or native Windows controllers to run OpenClaw Windows node builds, tests, and targeted proof on remote native Windows or WSL2 hosts, including Azure or brokered AWS leases and static SSH hosts. Use when remote Windows validation is needed or the user asks for Crabbox validation. Always report the actual provider, lease id, run URL, command, and result.\n---\n\n# Crabbox\n\nUse Crabbox as the transport for Windows-specific validation of this repository.\nSync the current checkout to a native Windows host, run the same PowerShell and\ndotnet entrypoints required locally, collect the result, and stop leases created\nfor the task.\n\nThis is a focused port of the OpenClaw Crabbox workflow. Do not copy its Linux\n`pnpm`, Blacksmith Testbox, macOS, Docker, package, or OpenClaw gateway-runtime\nlanes into this repository. They do not prove the Windows node.\n\n## Select the target\n\n| Need | Provider and target |\n|---|---|\n| Normal build, unit tests, CLI, WinUI, installer, or native Windows behavior | `--provider azure --target windows --windows-mode normal` |\n| WSL-side gateway\u002Fsetup behavior on a Windows host | `--provider azure --target windows --windows-mode wsl2` |\n| An operator-managed Windows machine | `--provider ssh --target windows --windows-mode normal --static-host \u003Chost>` |\n| Azure is unavailable and the operator accepts the older AWS Windows path | `--provider aws --target windows --windows-mode normal` |\n\nPrefer Azure for Windows and WSL2 work when the installed Crabbox CLI advertises\nit and Azure auth is already configured. Do not use WSL2 as proof for native\nWinUI, MSIX, Windows App SDK, PowerShell, registry, or Windows process behavior.\nDo not use Linux Testbox for this repo's required closeout validation.\n\nRoutine use of an already configured Crabbox environment is part of completing\nrequested remote validation. This includes task-owned leases, temporary state,\nand clean task-owned checkouts or worktrees. Preserve user-managed checkouts,\nbranches, unrelated edits, trust boundaries, credentials, production access,\nbudgets, and publication controls. A dirty, missing, or occupied checkout is a\nreason to create an isolated task-owned checkout, not to overwrite it.\n\n## First checks\n\nRun from the repository root. Crabbox sync mirrors the current checkout,\nincluding tracked and relevant untracked changes.\n\nUse an installed, verified Crabbox binary by default. Do not assume a sibling\nsource checkout is trusted or overwrite its unrelated work. When the task is to\ntest or repair Crabbox itself, verify its canonical upstream and build it from a\nclean task-owned checkout instead.\n\n```sh\nexport CRABBOX=\"$(command -v crabbox)\"\nexport CRABBOX_PROVIDER=\"${CRABBOX_PROVIDER:-azure}\"\ntest -n \"$CRABBOX\"\n\"$CRABBOX\" --version\n\"$CRABBOX\" run --help 2>&1 | rg 'provider|target|windows-mode|static-host|script-stdin|timing-json'\n\"$CRABBOX\" config path\n\"$CRABBOX\" whoami\ngit status --short --branch\ngit rev-parse HEAD\n```\n\nKeep `CRABBOX` and `CRABBOX_PROVIDER` exported in the shell that runs the\nremaining commands. If an automation tool starts a fresh shell for each call,\nreplace them below with the resolved binary path and selected provider.\n\nRequire the CLI to list the intended provider and the `windows` target before\nstarting a lease. Use explicit provider and target flags; this repository has no\n`.crabbox.yaml`, so inherited user defaults are not a validation contract.\n\n### Native Windows controller\n\nWhen the Crabbox CLI itself runs on Windows, use PowerShell and verify the\ninstalled binary:\n\n```powershell\n$Crabbox = (Get-Command crabbox.exe -ErrorAction Stop).Source\n$CrabboxProvider = \"azure\"\n\nGet-Command ssh, tar, git -ErrorAction Stop\n& $Crabbox --version\n& $Crabbox config path\ngit status --short --branch\ngit rev-parse HEAD\n```\n\nUse `& $Crabbox` and `$CrabboxProvider` in place of `\"$CRABBOX\"` and\n`\"$CRABBOX_PROVIDER\"` in later examples. PowerShell 5.1 or newer is sufficient\nfor the controller commands.\n\nFor direct Azure, authenticate interactively and persist the approved location\nbefore warming a lease:\n\n```powershell\nGet-Command az -ErrorAction Stop\naz login\n& $Crabbox azure login --location \u003Capproved-location>\n& $Crabbox doctor --provider azure --target windows\n```\n\nDo not copy `az login` output or Crabbox config contents into logs, PRs, or\nchat. `crabbox azure login` stores Azure identifiers in the user config reported\nby `crabbox config path`. Set location with `azure login`; `warmup` has no\n`--location` flag.\n\nNative Windows targets use local `tar` plus archive transfer, so a Windows\ncontroller does not need WSL or rsync for native-mode validation. POSIX and WSL2\ntargets use rsync. When `wsl.exe` exists, Crabbox prefers its rsync, so verify it\ninside the default distribution; without WSL, verify a native rsync is on PATH:\n\n```powershell\nif (Get-Command wsl.exe -ErrorAction SilentlyContinue) {\n    wsl.exe --exec sh -lc 'command -v rsync >\u002Fdev\u002Fnull'\n    if ($LASTEXITCODE -ne 0) { throw \"Install rsync in the default WSL distribution.\" }\n} else {\n    Get-Command rsync.exe -ErrorAction Stop\n}\n```\n\nUse Actions hydration only when the repository already owns a suitable workflow.\nLocal hydration supports WSL2 targets. Native Windows requires\n`crabbox actions hydrate --github-runner`; WSL2 may also use that mode when the\nworkflow needs full GitHub Actions semantics. Otherwise use normal `warmup` and\n`run` loops.\n\nTranslate later POSIX here-doc examples into a PowerShell here-string when\ncalling `--script-stdin` from Windows:\n\n```powershell\n$RemoteScript = @'\n# Copy the exact POWERSHELL body from the relevant example here.\n'@\n$PreviousOutputEncoding = $OutputEncoding\ntry {\n    $OutputEncoding = New-Object System.Text.UTF8Encoding -ArgumentList $false\n    $RemoteScript | & $Crabbox run `\n        --provider $CrabboxProvider `\n        --target windows `\n        --windows-mode normal `\n        --id \u003Clease-id> `\n        --preflight `\n        --timing-json `\n        --script-stdin --\n    $CrabboxExitCode = $LASTEXITCODE\n} finally {\n    $OutputEncoding = $PreviousOutputEncoding\n}\nif ($CrabboxExitCode -ne 0) { exit $CrabboxExitCode }\n```\n\nIf public SSH is blocked and the operator confirms an approved VPN route to the\nAzure virtual network is already active, opt into private addressing for that\nsession with `$env:CRABBOX_AZURE_NETWORK = \"private\"`, then rerun\n`crabbox doctor`. Do not port or automate organization-specific VPN,\ncertificate, vault, subscription, tenant, resource, address, or account setup\nin this skill.\n\nAzure requires its subscription auth and usually the Azure CLI. If Azure is\nunavailable, use AWS only with an existing Crabbox broker session. If normal AWS\nvalidation asks for `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, an AWS profile,\nor an EC2 instance role, stop: the command fell through to raw cloud auth. Check\n`crabbox config path`, `crabbox doctor`, and `crabbox whoami`, then authenticate\nthrough the broker if authorized:\n\n```sh\n\"$CRABBOX\" login --url https:\u002F\u002Fcrabbox.openclaw.ai --provider aws\nexport CRABBOX_PROVIDER=aws\n```\n\nDo not ask the user for raw cloud keys for routine repository validation. Report\nan auth blocker when neither Azure nor brokered AWS nor an approved static host\nis available.\n\nTreat contributor or fork code as untrusted until it has been reviewed. This\nrepo does not carry OpenClaw's sanitized Crabbox bootstrap, so do not run\nunreviewed code on a credentialed or operator-managed Windows host. Use\nsecretless fork CI, or review the exact head and diff before syncing it.\n`--fresh-pr` changes checkout mechanics; it does not make untrusted code safe.\n\n## Warm and reuse native Windows\n\nDo not warm a lease speculatively. When the first remote validation command is\nready, warm one lease and reuse it for tasks that need several iterations:\n\n```sh\n\"$CRABBOX\" warmup \\\n  --provider \"$CRABBOX_PROVIDER\" \\\n  --target windows \\\n  --windows-mode normal \\\n  --keep \\\n  --idle-timeout 90m \\\n  --ttl 240m \\\n  --timing-json\n```\n\nFor UI work, add `--desktop` to this warmup from the start and use the returned\nid as both `\u003Clease-id>` and `\u003Cdesktop-lease-id>`. Managed leases cannot gain\ndesktop capability after acquisition. Do not add `--desktop` to WSL2; managed\nWSL2 has no separate VNC desktop. Do not silently change providers merely to\ngain desktop support; report the capability blocker instead.\n\nSave the returned raw lease id. Report the provider, id, run URL, exact command,\nand result exactly as Crabbox returns them. Reuse the lease with\n`--id \u003Clease-id>`, but let each run sync the current checkout. Use `--no-sync`\nonly for an intentional rerun of unchanged source. If the remote tree looks\nstale, retry with `--full-resync` before replacing the lease.\n\n## Run required validation\n\nRun the repository-required closeout sequence on native Windows. The explicit\ntest-project builds prevent a fresh remote checkout from silently no-oping on\nthe later `--no-restore` test commands.\n\n```sh\n\"$CRABBOX\" run \\\n  --provider \"$CRABBOX_PROVIDER\" \\\n  --target windows \\\n  --windows-mode normal \\\n  --id \u003Clease-id> \\\n  --preflight \\\n  --timing-json \\\n  --script-stdin -- \u003C\u003C'POWERSHELL'\n$ErrorActionPreference = 'Stop'\n$env:OPENCLAW_REPO_ROOT = (Get-Location).Path\n\n& .\\build.ps1\nif ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }\n\ndotnet build .\\tests\\OpenClaw.Shared.Tests\\OpenClaw.Shared.Tests.csproj\nif ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }\n\ndotnet build .\\tests\\OpenClaw.Tray.Tests\\OpenClaw.Tray.Tests.csproj\nif ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }\n\ndotnet test .\\tests\\OpenClaw.Shared.Tests\\OpenClaw.Shared.Tests.csproj --no-restore\nif ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }\n\ndotnet test .\\tests\\OpenClaw.Tray.Tests\\OpenClaw.Tray.Tests.csproj --no-restore\nif ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }\nPOWERSHELL\n```\n\nIf prerequisites are missing, diagnose first with:\n\n```powershell\n.\\scripts\\setup-dev.ps1 -CheckOnly\n```\n\nUse `.\\scripts\\setup-dev.ps1` to install or verify prerequisites, then rerun the\ncomplete validation block. If an app locks build outputs, stop that process and\nrerun all required commands. Never report a prerequisite failure or a skipped\ntest as passing validation.\n\nAdd the targeted suite required by `AGENTS.md` for the touched subsystem. For\nexample, changes to `winnode`, MCP output, or command docs also require:\n\n```powershell\ndotnet build .\\tests\\OpenClaw.WinNode.Cli.Tests\\OpenClaw.WinNode.Cli.Tests.csproj\nif ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }\n\ndotnet test .\\tests\\OpenClaw.WinNode.Cli.Tests\\OpenClaw.WinNode.Cli.Tests.csproj --no-restore\nif ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }\n```\n\nMXC, `system.run`, approval, or Windows command-execution changes also require:\n\n```powershell\n.\\scripts\\validate-mxc-e2e.ps1\n```\n\nDo not treat `-AllowSkip` as merge validation for MXC-related work.\n\n## Use WSL2 narrowly\n\nUse WSL2 only when the behavior under test crosses the WSL gateway boundary.\nKeep the full native Windows closeout run above even when a targeted WSL2 proof\npasses. Warm WSL2 separately because its VM provisioning and bootstrap differ\nfrom native mode:\n\n```sh\n\"$CRABBOX\" warmup \\\n  --provider \"$CRABBOX_PROVIDER\" \\\n  --target windows \\\n  --windows-mode wsl2 \\\n  --keep \\\n  --idle-timeout 90m \\\n  --ttl 240m \\\n  --timing-json\n```\n\nSave the returned id as `\u003Cwsl2-lease-id>`, then run the focused WSL proof:\n\n```sh\n\"$CRABBOX\" run \\\n  --provider \"$CRABBOX_PROVIDER\" \\\n  --target windows \\\n  --windows-mode wsl2 \\\n  --id \u003Cwsl2-lease-id> \\\n  --preflight \\\n  --timing-json \\\n  --script-stdin -- \u003C\u003C'BASH'\nset -euo pipefail\n# Run the smallest repository WSL\u002Fsetup command that proves the changed path.\nBASH\n```\n\nRead `docs\u002FWSL_EXE_ARGV_PITFALL.md` before adding or changing any multi-line WSL\nscript passed through `RunInWslAsync`.\n\n## Use a static Windows host\n\nFor an operator-managed machine, use the SSH provider and make the target\ncontract explicit:\n\n```sh\n\"$CRABBOX\" run \\\n  --provider ssh \\\n  --target windows \\\n  --windows-mode normal \\\n  --static-host win-dev.local \\\n  --static-user \u003Cuser> \\\n  --preflight \\\n  --timing-json \\\n  -- dotnet --info\n```\n\nNative Windows sync requires OpenSSH, PowerShell, Git, and tar. Set\n`--static-port` or `--static-work-root` when the host differs from Crabbox\ndefaults. Never overwrite real tray settings during proof; use an isolated data\ndirectory as required by `AGENTS.md` and the proof-validation skill.\n\n## Collect real behavior proof\n\nRemote build and test output proves automation, not visible WinUI behavior. For\ntray, Settings, onboarding, chat\u002Fcanvas, or other UI claims, launch the isolated\napp in an interactive Windows session and capture current-head evidence:\n\n```sh\n\"$CRABBOX\" desktop launch \\\n  --provider \"$CRABBOX_PROVIDER\" \\\n  --target windows \\\n  --windows-mode normal \\\n  --id \u003Cdesktop-lease-id> \\\n  --webvnc \\\n  --open \\\n  --take-control -- \\\n  powershell.exe -NoProfile -ExecutionPolicy Bypass -File '.\\run-app-local.ps1' \\\n    -NoBuild -Isolated\n```\n\nIf the leased host has no interactive desktop, state that UI proof is blocked\nand keep the automated Crabbox result. For node\u002FMCP changes, collect the live\n`winnode --list-tools` and `winnode --command ...` proof required by\n`.agents\u002Fskills\u002Fopenclaw-proof-validation\u002FSKILL.md`.\n\n## Observe and troubleshoot\n\nUse Crabbox's built-in diagnostics before adding ad hoc logging:\n\n- `--preflight` prints the Windows workspace, SSH, PowerShell, execution policy,\n  long-path, temp, and tool probes.\n- `--timing-json` emits the machine-readable provider, lease, sync, command, and\n  exit summary.\n- `--debug` adds sync and transport diagnostics.\n- `--capture-stdout \u003Cpath>` and `--capture-stderr \u003Cpath>` retain noisy output\n  locally; treat captured output as potentially secret-bearing.\n- `--capture-on-fail` downloads standard failure artifacts when the direct\n  provider supports it.\n- `--keep-on-failure` preserves a failed one-shot lease for bounded debugging.\n- `--script \u003Cfile>` or `--script-stdin` avoids fragile multi-layer quoting;\n  native Windows scripts run through Windows PowerShell.\n\nUseful read-only commands:\n\n```sh\n\"$CRABBOX\" status --id \u003Clease-id> --wait\n\"$CRABBOX\" inspect --id \u003Clease-id> --json\n\"$CRABBOX\" history --limit 20\n\"$CRABBOX\" history --lease \u003Clease-id>\n\"$CRABBOX\" logs \u003Crun-id>\n\"$CRABBOX\" results \u003Crun-id>\n```\n\nOn failure, distinguish provider acquisition, SSH, sync, prerequisites, and the\ntest command. Retry transport or sync once with `--debug --timing-json`; rerun\nonly the focused failing command until understood, then rerun the full required\nvalidation. Do not silently move Windows proof to Linux or WSL2.\n\nOn a Windows controller, diagnose sync by target mode: native Windows should use\narchive transfer and needs local `tar`; POSIX or WSL2 uses rsync and selects WSL\nrsync whenever `wsl.exe` is installed. Do not install WSL solely for a native\nWindows target.\n\n## Cleanup and report\n\nStop every cloud lease created for the task unless the user explicitly asks\nfor a handoff window:\n\n```sh\n\"$CRABBOX\" stop --provider \"$CRABBOX_PROVIDER\" \u003Clease-id>\n\"$CRABBOX\" stop --provider \"$CRABBOX_PROVIDER\" \u003Cwsl2-lease-id>\n\"$CRABBOX\" stop --provider \"$CRABBOX_PROVIDER\" \u003Cdesktop-lease-id>\n\"$CRABBOX\" list --provider \"$CRABBOX_PROVIDER\"\n```\n\nRun only the unique stop commands for leases actually created. If providers\ndiffered, use each lease's actual provider instead of the current variable. Do\nnot stop shared or pre-existing leases. `crabbox stop` does not accept\n`--timing-json`. In the handoff or PR body, record:\n\n- source head SHA and whether the checkout was dirty\n- actual provider, target, Windows mode, raw lease id, and run URL\n- exact commands and pass\u002Ffail counts\n- focused real-behavior proof, or an explicit blocker\n- cleanup result\n\nNever call a WSL2 run native Windows proof, and never call a skipped\u002Fno-op test\nsuccessful validation.\n","# Crabbox\n\nUse Crabbox as the transport for Windows-specific validation of this repository.\nSync the current checkout to a native Windows host, run the same PowerShell and\ndotnet entrypoints required locally, collect the result, and stop leases created\nfor the task.\n\nThis is a focused port of the OpenClaw Crabbox workflow. Do not copy its Linux\n`pnpm`, Blacksmith Testbox, macOS, Docker, package, or OpenClaw gateway-runtime\nlanes into this repository. They do not prove the Windows node.\n\n## Select the target\n\n| Need | Provider and target |\n|---|---|\n| Normal build, unit tests, CLI, WinUI, installer, or native Windows behavior | `--provider azure --target windows --windows-mode normal` |\n| WSL-side gateway\u002Fsetup behavior on a Windows host | `--provider azure --target windows --windows-mode wsl2` |\n| An operator-managed Windows machine | `--provider ssh --target windows --windows-mode normal --static-host \u003Chost>` |\n| Azure is unavailable and the operator accepts the older AWS Windows path | `--provider aws --target windows --windows-mode normal` |\n\nPrefer Azure for Windows and WSL2 work when the installed Crabbox CLI advertises\nit and Azure auth is already configured. Do not use WSL2 as proof for native\nWinUI, MSIX, Windows App SDK, PowerShell, registry, or Windows process behavior.\nDo not use Linux Testbox for this repo's required closeout validation.\n\nRoutine use of an already configured Crabbox environment is part of completing\nrequested remote validation. This includes task-owned leases, temporary state,\nand clean task-owned checkouts or worktrees. Preserve user-managed checkouts,\nbranches, unrelated edits, trust boundaries, credentials, production access,\nbudgets, and publication controls. A dirty, missing, or occupied checkout is a\nreason to create an isolated task-owned checkout, not to overwrite it.\n\n## First checks\n\nRun from the repository root. Crabbox sync mirrors the current checkout,\nincluding tracked and relevant untracked changes.\n\nUse an installed, verified Crabbox binary by default. Do not assume a sibling\nsource checkout is trusted or overwrite its unrelated work. When the task is to\ntest or repair Crabbox itself, verify its canonical upstream and build it from a\nclean task-owned checkout instead.\n\n```sh\nexport CRABBOX=\"$(command -v crabbox)\"\nexport CRABBOX_PROVIDER=\"${CRABBOX_PROVIDER:-azure}\"\ntest -n \"$CRABBOX\"\n\"$CRABBOX\" --version\n\"$CRABBOX\" run --help 2>&1 | rg 'provider|target|windows-mode|static-host|script-stdin|timing-json'\n\"$CRABBOX\" config path\n\"$CRABBOX\" whoami\ngit status --short --branch\ngit rev-parse HEAD\n```\n\nKeep `CRABBOX` and `CRABBOX_PROVIDER` exported in the shell that runs the\nremaining commands. If an automation tool starts a fresh shell for each call,\nreplace them below with the resolved binary path and selected provider.\n\nRequire the CLI to list the intended provider and the `windows` target before\nstarting a lease. Use explicit provider and target flags; this repository has no\n`.crabbox.yaml`, so inherited user defaults are not a validation contract.\n\n### Native Windows controller\n\nWhen the Crabbox CLI itself runs on Windows, use PowerShell and verify the\ninstalled binary:\n\n```powershell\n$Crabbox = (Get-Command crabbox.exe -ErrorAction Stop).Source\n$CrabboxProvider = \"azure\"\n\nGet-Command ssh, tar, git -ErrorAction Stop\n& $Crabbox --version\n& $Crabbox config path\ngit status --short --branch\ngit rev-parse HEAD\n```\n\nUse `& $Crabbox` and `$CrabboxProvider` in place of `\"$CRABBOX\"` and\n`\"$CRABBOX_PROVIDER\"` in later examples. PowerShell 5.1 or newer is sufficient\nfor the controller commands.\n\nFor direct Azure, authenticate interactively and persist the approved location\nbefore warming a lease:\n\n```powershell\nGet-Command az -ErrorAction Stop\naz login\n& $Crabbox azure login --location \u003Capproved-location>\n& $Crabbox doctor --provider azure --target windows\n```\n\nDo not copy `az login` output or Crabbox config contents into logs, PRs, or\nchat. `crabbox azure login` stores Azure identifiers in the user config reported\nby `crabbox config path`. Set location with `azure login`; `warmup` has no\n`--location` flag.\n\nNative Windows targets use local `tar` plus archive transfer, so a Windows\ncontroller does not need WSL or rsync for native-mode validation. POSIX and WSL2\ntargets use rsync. When `wsl.exe` exists, Crabbox prefers its rsync, so verify it\ninside the default distribution; without WSL, verify a native rsync is on PATH:\n\n```powershell\nif (Get-Command wsl.exe -ErrorAction SilentlyContinue) {\n    wsl.exe --exec sh -lc 'command -v rsync >\u002Fdev\u002Fnull'\n    if ($LASTEXITCODE -ne 0) { throw \"Install rsync in the default WSL distribution.\" }\n} else {\n    Get-Command rsync.exe -ErrorAction Stop\n}\n```\n\nUse Actions hydration only when the repository already owns a suitable workflow.\nLocal hydration supports WSL2 targets. Native Windows requires\n`crabbox actions hydrate --github-runner`; WSL2 may also use that mode when the\nworkflow needs full GitHub Actions semantics. Otherwise use normal `warmup` and\n`run` loops.\n\nTranslate later POSIX here-doc examples into a PowerShell here-string when\ncalling `--script-stdin` from Windows:\n\n```powershell\n$RemoteScript = @'\n# Copy the exact POWERSHELL body from the relevant example here.\n'@\n$PreviousOutputEncoding = $OutputEncoding\ntry {\n    $OutputEncoding = New-Object System.Text.UTF8Encoding -ArgumentList $false\n    $RemoteScript | & $Crabbox run `\n        --provider $CrabboxProvider `\n        --target windows `\n        --windows-mode normal `\n        --id \u003Clease-id> `\n        --preflight `\n        --timing-json `\n        --script-stdin --\n    $CrabboxExitCode = $LASTEXITCODE\n} finally {\n    $OutputEncoding = $PreviousOutputEncoding\n}\nif ($CrabboxExitCode -ne 0) { exit $CrabboxExitCode }\n```\n\nIf public SSH is blocked and the operator confirms an approved VPN route to the\nAzure virtual network is already active, opt into private addressing for that\nsession with `$env:CRABBOX_AZURE_NETWORK = \"private\"`, then rerun\n`crabbox doctor`. Do not port or automate organization-specific VPN,\ncertificate, vault, subscription, tenant, resource, address, or account setup\nin this skill.\n\nAzure requires its subscription auth and usually the Azure CLI. If Azure is\nunavailable, use AWS only with an existing Crabbox broker session. If normal AWS\nvalidation asks for `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, an AWS profile,\nor an EC2 instance role, stop: the command fell through to raw cloud auth. Check\n`crabbox config path`, `crabbox doctor`, and `crabbox whoami`, then authenticate\nthrough the broker if authorized:\n\n```sh\n\"$CRABBOX\" login --url https:\u002F\u002Fcrabbox.openclaw.ai --provider aws\nexport CRABBOX_PROVIDER=aws\n```\n\nDo not ask the user for raw cloud keys for routine repository validation. Report\nan auth blocker when neither Azure nor brokered AWS nor an approved static host\nis available.\n\nTreat contributor or fork code as untrusted until it has been reviewed. This\nrepo does not carry OpenClaw's sanitized Crabbox bootstrap, so do not run\nunreviewed code on a credentialed or operator-managed Windows host. Use\nsecretless fork CI, or review the exact head and diff before syncing it.\n`--fresh-pr` changes checkout mechanics; it does not make untrusted code safe.\n\n## Warm and reuse native Windows\n\nDo not warm a lease speculatively. When the first remote validation command is\nready, warm one lease and reuse it for tasks that need several iterations:\n\n```sh\n\"$CRABBOX\" warmup \\\n  --provider \"$CRABBOX_PROVIDER\" \\\n  --target windows \\\n  --windows-mode normal \\\n  --keep \\\n  --idle-timeout 90m \\\n  --ttl 240m \\\n  --timing-json\n```\n\nFor UI work, add `--desktop` to this warmup from the start and use the returned\nid as both `\u003Clease-id>` and `\u003Cdesktop-lease-id>`. Managed leases cannot gain\ndesktop capability after acquisition. Do not add `--desktop` to WSL2; managed\nWSL2 has no separate VNC desktop. Do not silently change providers merely to\ngain desktop support; report the capability blocker instead.\n\nSave the returned raw lease id. Report the provider, id, run URL, exact command,\nand result exactly as Crabbox returns them. Reuse the lease with\n`--id \u003Clease-id>`, but let each run sync the current checkout. Use `--no-sync`\nonly for an intentional rerun of unchanged source. If the remote tree looks\nstale, retry with `--full-resync` before replacing the lease.\n\n## Run required validation\n\nRun the repository-required closeout sequence on native Windows. The explicit\ntest-project builds prevent a fresh remote checkout from silently no-oping on\nthe later `--no-restore` test commands.\n\n```sh\n\"$CRABBOX\" run \\\n  --provider \"$CRABBOX_PROVIDER\" \\\n  --target windows \\\n  --windows-mode normal \\\n  --id \u003Clease-id> \\\n  --preflight \\\n  --timing-json \\\n  --script-stdin -- \u003C\u003C'POWERSHELL'\n$ErrorActionPreference = 'Stop'\n$env:OPENCLAW_REPO_ROOT = (Get-Location).Path\n\n& .\\build.ps1\nif ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }\n\ndotnet build .\\tests\\OpenClaw.Shared.Tests\\OpenClaw.Shared.Tests.csproj\nif ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }\n\ndotnet build .\\tests\\OpenClaw.Tray.Tests\\OpenClaw.Tray.Tests.csproj\nif ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }\n\ndotnet test .\\tests\\OpenClaw.Shared.Tests\\OpenClaw.Shared.Tests.csproj --no-restore\nif ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }\n\ndotnet test .\\tests\\OpenClaw.Tray.Tests\\OpenClaw.Tray.Tests.csproj --no-restore\nif ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }\nPOWERSHELL\n```\n\nIf prerequisites are missing, diagnose first with:\n\n```powershell\n.\\scripts\\setup-dev.ps1 -CheckOnly\n```\n\nUse `.\\scripts\\setup-dev.ps1` to install or verify prerequisites, then rerun the\ncomplete validation block. If an app locks build outputs, stop that process and\nrerun all required commands. Never report a prerequisite failure or a skipped\ntest as passing validation.\n\nAdd the targeted suite required by `AGENTS.md` for the touched subsystem. For\nexample, changes to `winnode`, MCP output, or command docs also require:\n\n```powershell\ndotnet build .\\tests\\OpenClaw.WinNode.Cli.Tests\\OpenClaw.WinNode.Cli.Tests.csproj\nif ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }\n\ndotnet test .\\tests\\OpenClaw.WinNode.Cli.Tests\\OpenClaw.WinNode.Cli.Tests.csproj --no-restore\nif ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }\n```\n\nMXC, `system.run`, approval, or Windows command-execution changes also require:\n\n```powershell\n.\\scripts\\validate-mxc-e2e.ps1\n```\n\nDo not treat `-AllowSkip` as merge validation for MXC-related work.\n\n## Use WSL2 narrowly\n\nUse WSL2 only when the behavior under test crosses the WSL gateway boundary.\nKeep the full native Windows closeout run above even when a targeted WSL2 proof\npasses. Warm WSL2 separately because its VM provisioning and bootstrap differ\nfrom native mode:\n\n```sh\n\"$CRABBOX\" warmup \\\n  --provider \"$CRABBOX_PROVIDER\" \\\n  --target windows \\\n  --windows-mode wsl2 \\\n  --keep \\\n  --idle-timeout 90m \\\n  --ttl 240m \\\n  --timing-json\n```\n\nSave the returned id as `\u003Cwsl2-lease-id>`, then run the focused WSL proof:\n\n```sh\n\"$CRABBOX\" run \\\n  --provider \"$CRABBOX_PROVIDER\" \\\n  --target windows \\\n  --windows-mode wsl2 \\\n  --id \u003Cwsl2-lease-id> \\\n  --preflight \\\n  --timing-json \\\n  --script-stdin -- \u003C\u003C'BASH'\nset -euo pipefail\n# Run the smallest repository WSL\u002Fsetup command that proves the changed path.\nBASH\n```\n\nRead `docs\u002FWSL_EXE_ARGV_PITFALL.md` before adding or changing any multi-line WSL\nscript passed through `RunInWslAsync`.\n\n## Use a static Windows host\n\nFor an operator-managed machine, use the SSH provider and make the target\ncontract explicit:\n\n```sh\n\"$CRABBOX\" run \\\n  --provider ssh \\\n  --target windows \\\n  --windows-mode normal \\\n  --static-host win-dev.local \\\n  --static-user \u003Cuser> \\\n  --preflight \\\n  --timing-json \\\n  -- dotnet --info\n```\n\nNative Windows sync requires OpenSSH, PowerShell, Git, and tar. Set\n`--static-port` or `--static-work-root` when the host differs from Crabbox\ndefaults. Never overwrite real tray settings during proof; use an isolated data\ndirectory as required by `AGENTS.md` and the proof-validation skill.\n\n## Collect real behavior proof\n\nRemote build and test output proves automation, not visible WinUI behavior. For\ntray, Settings, onboarding, chat\u002Fcanvas, or other UI claims, launch the isolated\napp in an interactive Windows session and capture current-head evidence:\n\n```sh\n\"$CRABBOX\" desktop launch \\\n  --provider \"$CRABBOX_PROVIDER\" \\\n  --target windows \\\n  --windows-mode normal \\\n  --id \u003Cdesktop-lease-id> \\\n  --webvnc \\\n  --open \\\n  --take-control -- \\\n  powershell.exe -NoProfile -ExecutionPolicy Bypass -File '.\\run-app-local.ps1' \\\n    -NoBuild -Isolated\n```\n\nIf the leased host has no interactive desktop, state that UI proof is blocked\nand keep the automated Crabbox result. For node\u002FMCP changes, collect the live\n`winnode --list-tools` and `winnode --command ...` proof required by\n`.agents\u002Fskills\u002Fopenclaw-proof-validation\u002FSKILL.md`.\n\n## Observe and troubleshoot\n\nUse Crabbox's built-in diagnostics before adding ad hoc logging:\n\n- `--preflight` prints the Windows workspace, SSH, PowerShell, execution policy,\n  long-path, temp, and tool probes.\n- `--timing-json` emits the machine-readable provider, lease, sync, command, and\n  exit summary.\n- `--debug` adds sync and transport diagnostics.\n- `--capture-stdout \u003Cpath>` and `--capture-stderr \u003Cpath>` retain noisy output\n  locally; treat captured output as potentially secret-bearing.\n- `--capture-on-fail` downloads standard failure artifacts when the direct\n  provider supports it.\n- `--keep-on-failure` preserves a failed one-shot lease for bounded debugging.\n- `--script \u003Cfile>` or `--script-stdin` avoids fragile multi-layer quoting;\n  native Windows scripts run through Windows PowerShell.\n\nUseful read-only commands:\n\n```sh\n\"$CRABBOX\" status --id \u003Clease-id> --wait\n\"$CRABBOX\" inspect --id \u003Clease-id> --json\n\"$CRABBOX\" history --limit 20\n\"$CRABBOX\" history --lease \u003Clease-id>\n\"$CRABBOX\" logs \u003Crun-id>\n\"$CRABBOX\" results \u003Crun-id>\n```\n\nOn failure, distinguish provider acquisition, SSH, sync, prerequisites, and the\ntest command. Retry transport or sync once with `--debug --timing-json`; rerun\nonly the focused failing command until understood, then rerun the full required\nvalidation. Do not silently move Windows proof to Linux or WSL2.\n\nOn a Windows controller, diagnose sync by target mode: native Windows should use\narchive transfer and needs local `tar`; POSIX or WSL2 uses rsync and selects WSL\nrsync whenever `wsl.exe` is installed. Do not install WSL solely for a native\nWindows target.\n\n## Cleanup and report\n\nStop every cloud lease created for the task unless the user explicitly asks\nfor a handoff window:\n\n```sh\n\"$CRABBOX\" stop --provider \"$CRABBOX_PROVIDER\" \u003Clease-id>\n\"$CRABBOX\" stop --provider \"$CRABBOX_PROVIDER\" \u003Cwsl2-lease-id>\n\"$CRABBOX\" stop --provider \"$CRABBOX_PROVIDER\" \u003Cdesktop-lease-id>\n\"$CRABBOX\" list --provider \"$CRABBOX_PROVIDER\"\n```\n\nRun only the unique stop commands for leases actually created. If providers\ndiffered, use each lease's actual provider instead of the current variable. Do\nnot stop shared or pre-existing leases. `crabbox stop` does not accept\n`--timing-json`. In the handoff or PR body, record:\n\n- source head SHA and whether the checkout was dirty\n- actual provider, target, Windows mode, raw lease id, and run URL\n- exact commands and pass\u002Ffail counts\n- focused real-behavior proof, or an explicit blocker\n- cleanup result\n\nNever call a WSL2 run native Windows proof, and never call a skipped\u002Fno-op test\nsuccessful validation.\n",{"name":5,"description":7},"main","a4dd026cc5f85a444a0fcd05eef5b86282dbda8c",".agents\u002Fskills\u002Fcrabbox",349,"https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw-windows-node","https:\u002F\u002Fopenclaw.ai","https:\u002F\u002Fgithub.com\u002Fopenclaw","Your personal, open source AI assistant.","2026-11-14 18:13:49",{"source":8,"skillName":5,"commands":53,"prompt":63,"zipAvailable":64},[54,57,60],{"tool":55,"command":56},"npx","npx skills add openclaw\u002Fopenclaw-windows-node --skill crabbox",{"tool":58,"command":59},"bunx","bunx skills add openclaw\u002Fopenclaw-windows-node --skill crabbox",{"tool":61,"command":62},"pnpm","pnpm dlx skills add openclaw\u002Fopenclaw-windows-node --skill crabbox","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw-windows-node\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fcrabbox\u002FSKILL.md",true,[],[67,90,107,126,146,167],{"skillNo":68,"name":69,"nameZh":6,"description":70,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":71,"categories":72,"keywords":73,"publishedAt":38},"01M6KZCXK5PCYWWW5FCVDYPAXK","retrigger-flaky-ci","Triage failed CI on a pull request or the active branch, decide whether the failures come from its changes, and rerun only failures that are unrelated. Use when asked to retrigger, rerun, or kick CI on a PR with failing checks.","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw-windows-node\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fretrigger-flaky-ci\u002FSKILL.md",[],[74,75,19,76,77,78,29,79,80,81,82,83,84,85,86,87,88,89],"retrigger flaky ci","ci","unrelated","failing","rerun","triage","only","decide","request","active","pull request","pr","changes","branch","with","pull",{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":96,"publishedAt":38},"01M698QMQN5TQES4R7ZPTYAZF5","technical-documentation","Write, review, or restructure Windows node documentation and agent instructions using current source, task-focused explanations, and explicit fact preservation.","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw-windows-node\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Ftechnical-documentation\u002FSKILL.md",[],[97,98,99,100,35,101,102,31,103,104,105,106],"technical documentation","technical","documentation","agent instructions","source","preservation","write","instructions","review","task",{"skillNo":108,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":111,"categories":112,"keywords":113,"publishedAt":38},"01M698QKPXJ8ZG34MYHPPCAT4T","pr-simplify","Simplify your own Windows-node change to its smallest complete fix while preserving distinct regressions, platform contracts, and required proof. Use after implementation before PR preparation, after large repairs, or when asked to shrink a change or remove slop.","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw-windows-node\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fpr-simplify\u002FSKILL.md",[],[114,85,115,116,117,118,119,120,31,121,19,29,122,123,124,35,125],"pr simplify","simplify","contracts","slop","proof","implementation","preparation","change","fix","complete","remove","platform",{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":137,"publishedAt":38},"01M698QJEA384YPM8R9CPZ1YFD","openclaw-testing","Choose proportional OpenClaw Windows node tests, builds, packaging checks, and runtime proof, then diagnose failures without weakening required gates.","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw-windows-node\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fopenclaw-testing\u002FSKILL.md",[132],{"categoryNo":133,"categoryName":134,"taxonomyType":135,"taxonomyTypeDesc":136},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[138,9,139,35,118,31,140,141,28,142,143,144,145],"testing","openclaw testing","gates","runtime proof","choose","packaging","runtime","diagnose",{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":155,"publishedAt":38},"01M698QH7JVVA09769ER9P2TKY","openclaw-proof-validation","Plan and collect OpenClaw Windows validation\u002Fproof: tests, rubber-duck review, UI evidence, MCP output, and gateway runtime proof.","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw-windows-node\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fopenclaw-proof-validation\u002FSKILL.md",[152],{"categoryNo":153,"categoryName":154,"taxonomyType":135,"taxonomyTypeDesc":136},"01JBSEEDCAT000000000000023","Skill与智能体开发",[156,9,157,118,158,35,159,160,144,161,162,163,164,165,105,141,28,166],"openclaw proof validation","validation","evidence","gateway","MCP","duck","ui","ui evidence","plan","output","collect",{"skillNo":168,"name":169,"nameZh":6,"description":170,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":178,"publishedAt":38},"01M698QFXW9PDK8YZ467MBW5P1","openclaw-debugging","Debug OpenClaw Windows Companion, setup, Gateway connection, node capabilities, packaged permissions, updates, installers, and system.run by selecting the failing boundary and proof path before changing code.","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw-windows-node\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fopenclaw-debugging\u002FSKILL.md",[173],{"categoryNo":174,"categoryName":175,"taxonomyType":176,"taxonomyTypeDesc":177},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[179,180,9,35,181,118,182,183,184,185,159,186,187,31,33,188,189,190,191,77],"openclaw debugging","debugging","setup","connection","boundary","debug","system","path","companion","permissions","capabilities","code","updates"]