chore(crabbox): require Crabbox 0.69.0 (#162334)

Crabbox 0.69.0 ships openclaw/crabbox#2613, which #161465 needs to recover from backends that cannot capture native snapshots; older CLIs still pause the profile. It also carries GCP boot-disk selection per machine family (#2608) and definite capacity rejections (#2616). The managed fallback now downloads v0.69.0.

docs/ci/local-proof.md

@@ -289,9 +289,9 @@ is not generic compute offload. `.crabbox.yaml` defaults remote proof to
 credentials, so untrusted contributor or fork code must use secretless fork CI
 or sanitized direct AWS Crabbox instead.
 The wrapper uses the bundled Crabbox plugin's binary manager. All providers and
-cloud-worker profiles require Crabbox 0.67.0 or newer. This includes task-owned
+cloud-worker profiles require Crabbox 0.69.0 or newer. This includes task-owned
 Testbox SSH teardown, which prevents persistent SSH masters from keeping idle
-Testboxes alive. Missing or older binaries use a verified managed 0.67.0 release
+Testboxes alive. Missing or older binaries use a verified managed 0.69.0 release
 before provider discovery or lease work. The original binary stays untouched.
 Provider readiness and broker authentication still determine
 which configured backend can run the proof.

docs/gateway/cloud-workers/troubleshooting.md

@@ -28,7 +28,7 @@ Symptoms you may see when dispatching to or running on a cloud worker, and the c
 - **Session shows a reclaimed or suspended badge after being idle** — this is expected when its profile sets `suspendAfter`. The next message provisions a replacement worker, warm when an image exists.
 - **A warm image is unavailable** — a new allocation can select cold provisioning before its choice is recorded. An already admitted allocation keeps its original cold/checkpoint choice through retries. If its checkpoint cannot be forked, resolve the provider error or stop that allocation before starting a replacement; retry does not switch images silently.
 - **Warm-image migration or capacity blocks dispatch** — run `openclaw doctor --fix` for legacy state and follow its exact cleanup guidance. For capacity, stop outstanding workers or resolve pending image cleanup with `openclaw crabbox warm-images`; allocation choices and cleanup obligations are never evicted to make room.
-- **`checkpoint mode must be auto, native, or archive` and a paused capture** — the selected Crabbox provider, target, or coordinator does not support the requested native capture, and an older CLI did not report a definitive unsupported-capture receipt. Update Crabbox to a CLI that includes [Crabbox #2613](https://github.com/openclaw/crabbox/pull/2613). OpenClaw then records the latest refusal and continues provisioning; later workers use an existing compatible snapshot when one is available and otherwise provision cold (shown as **Cold only** in Snapshots). Each eligible worker retries capture, so Crabbox configuration changes apply to the next dispatch. Another refusal refreshes the marker timestamp; a successful capture clears it. Once no images, allocations, or operations remain, maintenance drops the marker-only row from local state after `warmImages.refreshAfter` without a new refusal. A capture already paused by an older CLI still needs [paused-capture recovery](/gateway/cloud-workers/warm-images#recover-a-paused-capture): that refusal happened before any checkpoint was created, but confirm the source lease and capture time in the Crabbox checkpoint catalog before using `--recover`. Set `settings.warmImage: false` on the profile as a workaround to stop capture attempts.
+- **`checkpoint mode must be auto, native, or archive` and a paused capture** — the selected Crabbox provider, target, or coordinator does not support the requested native capture, and an older CLI did not report a definitive unsupported-capture receipt. Update Crabbox to 0.69.0 or newer, which includes [Crabbox #2613](https://github.com/openclaw/crabbox/pull/2613). OpenClaw then records the latest refusal and continues provisioning; later workers use an existing compatible snapshot when one is available and otherwise provision cold (shown as **Cold only** in Snapshots). Each eligible worker retries capture, so Crabbox configuration changes apply to the next dispatch. Another refusal refreshes the marker timestamp; a successful capture clears it. Once no images, allocations, or operations remain, maintenance drops the marker-only row from local state after `warmImages.refreshAfter` without a new refusal. A capture already paused by an older CLI still needs [paused-capture recovery](/gateway/cloud-workers/warm-images#recover-a-paused-capture): that refusal happened before any checkpoint was created, but confirm the source lease and capture time in the Crabbox checkpoint catalog before using `--recover`. Set `settings.warmImage: false` on the profile as a workaround to stop capture attempts.
 - **Project image capture fails** — the session reports the underlying provider diagnostic, such as a checkpoint quota rejection, before its capture recovery instructions. Resolve that cause before retrying. An unresolved capture still blocks enrollment until provider artifacts and the recorded capture have been reconciled.
 - **Cloud bootstrap requests a rebuild** — run `pnpm build` in the Gateway source checkout, then restart the Gateway and retry. The running build, its package metadata, and the built plugin outputs must agree; editing source or matching the displayed version alone is insufficient.
 - **Cloud bootstrap download fails** — the error identifies the connection, TLS, HTTP-response, or body-transfer phase. Crabbox retries transient transport failures and HTTP 502/503/504 responses up to three attempts with short backoff, within the existing setup command deadline. Interrupted downloads retain their partial file and request the remaining bytes with `Range: bytes=N-`, so a slow or reset-prone proxy does not force every attempt back to byte zero. A full HTTP 200 response replaces the partial file; an inconsistent range discards it and retries from zero within the same attempt limit. The complete archive must still match its declared size and SHA-256 before installation; integrity failures discard partial bytes and stop. Each bootstrap artifact token permits up to three serial serves, counting both completed and interrupted full or ranged responses, so retries also work when a buffering proxy resets its downstream connection. Concurrent requests receive HTTP 503 with `transfer_in_progress`; these busy responses wait with backoff within the setup command's deadline without spending a download attempt. Other HTTP 503 responses still count toward the three-attempt limit. Bootstrap and node-worker-bundle transfer tokens share the size-derived bootstrap operation window of 45–95 minutes and are revoked as soon as enrollment or the operation ends; node-worker-bundle transfer tokens permit only one serve. Ranges reduce bytes per serve; retries never extend these lifetimes, raise serve budgets, or bypass owner revocation. Each retry logs the phase, error code, and attempt count. Integrity, identity, unsafe-path, TLS-pin, and HTTP 401/403/404/409/410 failures stop immediately. A `download TLS` reset happened before an HTTP response; check the worker provider's outbound policy and the Gateway's TLS endpoint from the worker, not only from the Gateway host. For an HTTP status, check proxy routing and download authorization. A `download body` error means response headers arrived; inspect the interrupted transfer, local disk, or archive-integrity error. Use a Gateway origin permitted by the provider's policy; do not disable certificate validation or bypass that policy.

docs/gateway/cloud-workers/warm-images.md

@@ -44,7 +44,7 @@ While Crabbox remains enabled with a configured worker profile, the Gateway's ex
 
 Before capture, OpenClaw removes per-lease worker identities, device tokens, and session state, including node-host workspaces and SSH-transport workspaces under `~/.openclaw-worker/workspaces`. Machine-level caches intentionally survive: npm caches, content-addressed node runtime and worker bundle installs under `~/.openclaw-worker`, and pristine Git seeds under `~/.openclaw-worker/git-seeds`. Project preparation starts with immutable Git content. Completed setup may retain ignored dependency/build output and change eligible source files; OpenClaw keeps separate pristine and completed manifests. A fresh dedicated node verifies that completion and binds the fixed workspace and `HOME` to one session. Initial project sync applies session changes relative to the pristine commit onto the completed setup, preserving setup-generated files and tracked setup edits that the session did not change. Session edits take precedence on changed paths. After a turn, reconciliation carries eligible generated output back to the Gateway. Accepted reconciliation results and explicit checkpoint restores apply their exact snapshots, including deletions of setup-generated files. A different session cannot claim that binding, and retirement leaves a permanent tombstone even after workspace files are removed. Images also retain whatever `settings.setup` wrote elsewhere, so keep setup credential-free and enable reuse only for mutually trusted workloads.
 
-Scrubbing has a three-minute timeout. Checkpoint creation requests `--wait --wait-timeout 2700000ms`, matching Crabbox's 45-minute native-capture budget before enrollment. On Daytona, source preparation and stopping share that budget with snapshot creation and readiness. A successful waited capture is recorded as available and can be reused without another availability inspection. The command deadline adds three minutes for command overhead, plus separate source lifecycle time: three minutes for Daytona recovery or two default 15-minute Machine0 stop/restore windows. Provisioning and teardown deadlines also cover capture maintenance, scrubbing, and child-process settlement. These limits do not grant another capture attempt. Scrub failure releases only its own capture reservation. Once creation starts, failure, timeout, or unusable output leaves its outcome uncertain: the profile stays paused until explicit recovery. One exception is a complete, normally exited `not_submitted` failure receipt from Crabbox for the same provider and lease, confirming that its local reservation was removed. OpenClaw then clears only that capture reservation. Provisioning still fails and stops the source lease because the receipt does not prove that source rollback succeeded. Optional teardown captures warn without failing successful source-lease cleanup. A separate complete `not_submitted` receipt with `reason: "native_unsupported"` and `localReservation: "none"` proves Crabbox refused native capture before reserving or submitting any capture. OpenClaw clears its capture reservation, records the latest refusal for that profile key, warns, and continues enrollment on the already-prepared, scrubbed source. A refusal does not retire an existing image, so later allocations still use a compatible snapshot when one remains. Each eligible worker retries capture, so Crabbox configuration changes apply to the next dispatch. The content-addressed node runtime survives scrubbing and is reused by enrollment; a refused attempt adds only the scrub and refused `checkpoint create`. Another refusal refreshes the marker timestamp, and a successful capture publishes the image and clears the marker. Once no images, allocations, or operations remain, maintenance drops the marker-only row from local state after `warmImages.refreshAfter` without a new refusal; capacity reclamation may evict it sooner. This exception requires a Crabbox CLI that reports unsupported native capture in [Crabbox #2613](https://github.com/openclaw/crabbox/pull/2613); older CLIs retain the uncertain, paused behavior. Set `settings.warmImage: false` on the profile to stop capture attempts. An unresolved project capture prevents node enrollment on that source, so fresh node credentials cannot enter a capture that may still be running. Lease cleanup still runs, and a retained usable image can serve new allocations. Capture needs a Crabbox CLI and backend that support fixed-ID checkpoint forks. Continuing a coordinator-retained `checkpoint_pending` response requires the CLI repair in [Crabbox #1698](https://github.com/openclaw/crabbox/pull/1698); older binaries can accept `--wait` and still fail on that response. Correct missing capabilities or permissions before recovering an uncertain capture.
+Scrubbing has a three-minute timeout. Checkpoint creation requests `--wait --wait-timeout 2700000ms`, matching Crabbox's 45-minute native-capture budget before enrollment. On Daytona, source preparation and stopping share that budget with snapshot creation and readiness. A successful waited capture is recorded as available and can be reused without another availability inspection. The command deadline adds three minutes for command overhead, plus separate source lifecycle time: three minutes for Daytona recovery or two default 15-minute Machine0 stop/restore windows. Provisioning and teardown deadlines also cover capture maintenance, scrubbing, and child-process settlement. These limits do not grant another capture attempt. Scrub failure releases only its own capture reservation. Once creation starts, failure, timeout, or unusable output leaves its outcome uncertain: the profile stays paused until explicit recovery. One exception is a complete, normally exited `not_submitted` failure receipt from Crabbox for the same provider and lease, confirming that its local reservation was removed. OpenClaw then clears only that capture reservation. Provisioning still fails and stops the source lease because the receipt does not prove that source rollback succeeded. Optional teardown captures warn without failing successful source-lease cleanup. A separate complete `not_submitted` receipt with `reason: "native_unsupported"` and `localReservation: "none"` proves Crabbox refused native capture before reserving or submitting any capture. OpenClaw clears its capture reservation, records the latest refusal for that profile key, warns, and continues enrollment on the already-prepared, scrubbed source. A refusal does not retire an existing image, so later allocations still use a compatible snapshot when one remains. Each eligible worker retries capture, so Crabbox configuration changes apply to the next dispatch. The content-addressed node runtime survives scrubbing and is reused by enrollment; a refused attempt adds only the scrub and refused `checkpoint create`. Another refusal refreshes the marker timestamp, and a successful capture publishes the image and clears the marker. Once no images, allocations, or operations remain, maintenance drops the marker-only row from local state after `warmImages.refreshAfter` without a new refusal; capacity reclamation may evict it sooner. This exception requires Crabbox 0.69.0 or newer, which reports unsupported native capture through [Crabbox #2613](https://github.com/openclaw/crabbox/pull/2613); older CLIs retain the uncertain, paused behavior. Set `settings.warmImage: false` on the profile to stop capture attempts. An unresolved project capture prevents node enrollment on that source, so fresh node credentials cannot enter a capture that may still be running. Lease cleanup still runs, and a retained usable image can serve new allocations. Capture needs a Crabbox CLI and backend that support fixed-ID checkpoint forks. Continuing a coordinator-retained `checkpoint_pending` response requires the CLI repair in [Crabbox #1698](https://github.com/openclaw/crabbox/pull/1698); older binaries can accept `--wait` and still fail on that response. Correct missing capabilities or permissions before recovering an uncertain capture.
 
 A warm start provisions a fresh lease with fresh node enrollment. Cold allocations and snapshot forks use the same configured lease lifetime, idle timeout, desktop setting, and public networking without Tailscale. A warm start reuses machine-level caches, not a per-session snapshot or a suspended process.
 

docs/gateway/config-cloud-workers.md

@@ -69,7 +69,7 @@ The bundled `crabbox` provider provisions a disposable machine through the local
 - `settings.class`: optional Crabbox machine class passed to `--class`. Omission leaves selection to Crabbox unless the placement supplies `machineClass`; OpenClaw does not invent a default or hardware size. Explicit `null`, empty or whitespace strings, and nonstring values are invalid. Edit classless profiles through **Settings → Advanced**.
 - `settings.ttl` and `settings.idleTimeout` (required): positive Go duration strings passed to `--ttl` and `--idle-timeout` as provider-side failsafes.
 - `settings.warmImage`: prepares a project's committed checkout and node runtime for capture before enrollment, then starts later workers for that project and profile from the image. Without a prepared Git project, capture remains at eligible worker teardown. Pair with `suspendAfter` so suspended sessions can wake warm. Enabled by default when a configured or placement class is known and `setupEnv` is empty or omitted. Without an effective class, omission stays cold. A nonempty `setupEnv` keeps the default cold because forwarded host environment could leave setup-derived credentials in a shared image. Explicit `true` opts in but requires a known effective class before provider commands; explicit `false` always stays cold. The resolved class and original cold/checkpoint choice are recorded before allocation and remain fixed through retries and restart. Images incur provider snapshot storage charges and retain machine-level caches, including pristine Git seeds, alongside whatever `setup` wrote outside scrubbed worker state. Scrubbing has a three-minute timeout. Checkpoint creation waits within Crabbox's native-capture budget plus command, source-lifecycle, and child-settlement allowances; it does not extend the configured lease TTL or idle timeout. An uncertain project capture blocks enrollment on its source but still permits lease cleanup. See [Warm images](/gateway/cloud-workers#warm-images) for refresh, retention, and Doctor migration and recovery.
-- `settings.binary`: optional absolute Crabbox executable path. Without it, OpenClaw checks the sibling Crabbox checkout, then executable entries on `PATH`. The plugin requires Crabbox 0.67.0 or newer for every target, including Daytona fixed-ID preparation, replay, and confirmed cleanup. If the selected binary is missing, outdated, or cannot report a supported version, the plugin downloads the supported release into its own versioned directory under `$OPENCLAW_STATE_DIR/tools/crabbox` (by default `~/.openclaw/tools/crabbox`). It verifies the official release checksum and executable version before using the copy. Existing binaries and profile settings are preserved. Later commands reuse the managed installation without another download. Damaged managed installations are replaced automatically; the previous directory is retained beside the replacement with a `.recovery-<id>` suffix for inspection. `openclaw doctor --fix` installs the managed copy ahead of the first worker operation. An installation failure stops the operation before allocation and reports the cause.
+- `settings.binary`: optional absolute Crabbox executable path. Without it, OpenClaw checks the sibling Crabbox checkout, then executable entries on `PATH`. The plugin requires Crabbox 0.69.0 or newer for every target, including Daytona fixed-ID preparation, replay, and confirmed cleanup. If the selected binary is missing, outdated, or cannot report a supported version, the plugin downloads the supported release into its own versioned directory under `$OPENCLAW_STATE_DIR/tools/crabbox` (by default `~/.openclaw/tools/crabbox`). It verifies the official release checksum and executable version before using the copy. Existing binaries and profile settings are preserved. Later commands reuse the managed installation without another download. Damaged managed installations are replaced automatically; the previous directory is retained beside the replacement with a `.recovery-<id>` suffix for inspection. `openclaw doctor --fix` installs the managed copy ahead of the first worker operation. An installation failure stops the operation before allocation and reports the cause.
 - `readyWorkers`: non-negative integer target per eligible local project or repository and profile; defaults to `1`. Set `0` to disable this profile's reserves while keeping warm-image reuse.
 - `cloudWorkers.preparedPool.maxTotal`: non-negative integer Gateway-wide reserve cap; defaults to `4`. Preparing workers and unconfirmed cleanup count toward both limits. Set `0` to drain unused reserves and stop refill. Reserves incur running-machine charges and expire from successful project demand using the provider's existing idle policy. See [Ready workers](/gateway/cloud-workers/warm-images#ready-workers).
 

docs/reference/test/remote-proof.md

@@ -39,7 +39,7 @@ path; it does not permit raw native callers or untrusted proof to reuse a
 lease across revisions.
 Older or missing receipts require stopping the owned lease and allocating a
 fresh one through the wrapper. `OPENCLAW_TESTBOX_ALLOW_STALE` cannot bypass
-these checks. All providers require Crabbox 0.67.0 or newer.
+these checks. All providers require Crabbox 0.69.0 or newer.
 
 The Testbox workflow registers a separate disposable checkout for native sync.
 The hydrated execution workspace stays at its original absolute path, so native

extensions/crabbox/src/crabbox-managed-binary.test.ts

@@ -181,10 +181,10 @@ describe("managed Crabbox", () => {
   });
 
   it("upgrades an old candidate, preserves its distribution, and reuses it offline", async () => {
-    const test = await fixture("0.66.0");
+    const test = await fixture("0.68.0");
     const params = test.options;
     await expect(ensureManagedCrabboxBinary(params)).resolves.toEqual(test.installed);
-    expect(await fs.readFile(test.candidate, "utf8")).toBe("0.66.0");
+    expect(await fs.readFile(test.candidate, "utf8")).toBe("0.68.0");
     expect(
       await fs.readFile(path.join(path.dirname(test.binary), "companion-helper"), "utf8"),
     ).toBe("keep me");
@@ -195,11 +195,11 @@ describe("managed Crabbox", () => {
         );
       }
     }
-    await fs.writeFile(test.binary, "0.68.0");
+    await fs.writeFile(test.binary, "0.70.0");
     test.fetch.mockRejectedValue(new Error("offline"));
     await expect(ensureManagedCrabboxBinary(params)).resolves.toEqual({
       binary: test.binary,
-      version: "0.68.0",
+      version: "0.70.0",
     });
     expect(test.fetch).toHaveBeenCalledTimes(2);
     expect(await fs.readdir(path.dirname(path.dirname(test.binary)))).toEqual([
@@ -586,13 +586,13 @@ describe("managed Crabbox", () => {
 
 describe("Crabbox version admission", () => {
   it.each([
-    ["0.55.0", "outdated"],
-    ["0.56.0", "outdated"],
-    ["0.67.0-rc.1", "outdated"],
+    ["0.67.0", "outdated"],
+    ["0.68.0", "outdated"],
+    ["0.69.0-rc.1", "outdated"],
     ["0.66.0", "outdated"],
     [CRABBOX_MIN_VERSION, "supported"],
-    ["0.67.0+build.1", "supported"],
-    ["0.68.0-dev", "supported"],
+    ["0.69.0+build.1", "supported"],
+    ["0.70.0-dev", "supported"],
     ["0.9007199254740993.0", "indeterminate"],
     ["development", "indeterminate"],
   ])("classifies %s as %s", async (version, status) => {

extensions/crabbox/src/crabbox-managed-binary.ts

@@ -6,7 +6,7 @@ import { runCommandWithTimeout, type SpawnResult } from "openclaw/plugin-sdk/pro
 import { resolveStateDir } from "openclaw/plugin-sdk/state-paths";
 import type { CrabboxCommandRunner } from "./crabbox-worker-command.js";
 
-export const CRABBOX_MIN_VERSION = "0.67.0";
+export const CRABBOX_MIN_VERSION = "0.69.0";
 const RELEASE_URL = `https://github.com/openclaw/crabbox/releases/download/v${CRABBOX_MIN_VERSION}`;
 const MAX_ARCHIVE_BYTES = 128 * 1024 * 1024;
 // Gateway startup contention can delay an otherwise healthy executable probe.

test/scripts/crabbox-wrapper.test.ts

@@ -174,7 +174,7 @@ async function main() {
     if (process.env.OPENCLAW_FAKE_CRABBOX_SELECTION_UNKNOWN_PATH) topFiles.push({ path: "not-a-source-candidate.txt" });
     process.stdout.write(JSON.stringify({ candidate: { files: topFiles.length + Number(process.env.OPENCLAW_FAKE_CRABBOX_SELECTION_COUNT_DELTA || "0") }, topFiles })); return;
   }
-  if (args[0] === "--version") { console.log(process.env.OPENCLAW_FAKE_CRABBOX_VERSION || "crabbox 0.67.0"); return; }
+  if (args[0] === "--version") { console.log(process.env.OPENCLAW_FAKE_CRABBOX_VERSION || "crabbox 0.69.0"); return; }
   if (args[0] === "run" && args[1] === "--help") { process.stdout.write(helpText); return; }
   if (args[0] === "warmup" && args[1] === "--help") { process.stdout.write(${JSON.stringify(`${helpText}${fakeWarmupValueOptionHelp}`)}); return; }
   if (args[0] === "actions" && args[1] === "hydrate" && args[2] === "--help") { process.stdout.write(${JSON.stringify(`${helpText}${fakeHydrateValueOptionHelp}`)}); return; }
@@ -277,7 +277,7 @@ main().catch((error) => { process.stderr.write(String(error?.stack || error) + "
         '  if [ -n "${OPENCLAW_FAKE_CRABBOX_INVOCATION_LOG:-}" ]; then',
         `    printf '%s\\n' '["--version"]' >> "$OPENCLAW_FAKE_CRABBOX_INVOCATION_LOG"`,
         "  fi",
-        `  printf '%s\\n' "\${OPENCLAW_FAKE_CRABBOX_VERSION:-crabbox 0.67.0}"`,
+        `  printf '%s\\n' "\${OPENCLAW_FAKE_CRABBOX_VERSION:-crabbox 0.69.0}"`,
         "  exit 0",
         "fi",
         'if [ "$#" -eq 2 ] && [ "$1" = "run" ] && [ "$2" = "--help" ]; then',
@@ -321,7 +321,7 @@ function makeSlowHelpCrabbox(helpText: string, delayMs: number): string {
     String.raw`
 const args = process.argv.slice(2);
 if (args[0] === "--version") {
-  console.log("crabbox 0.67.0");
+  console.log("crabbox 0.69.0");
 } else if (args[0] === "run" && args[1] === "--help") {
   setTimeout(() => { process.stderr.write(${JSON.stringify(runHelpText)}); process.exit(0); }, ${delayMs});
 }`,
@@ -1631,7 +1631,7 @@ describe("scripts/crabbox-wrapper", () => {
       const stateDir = path.join(root, "state");
       const platform = process.platform;
       const arch = process.arch === "x64" ? "amd64" : process.arch;
-      const managed = path.join(stateDir, "tools/crabbox/0.67.0", `${platform}-${arch}`, "crabbox");
+      const managed = path.join(stateDir, "tools/crabbox/0.69.0", `${platform}-${arch}`, "crabbox");
       mkdirSync(path.dirname(managed), { recursive: true });
       // Keep candidate and managed commands distinguishable at the executable boundary.
       const fake = path.join(makeFakeCrabbox(defaultProviderHelp), "crabbox-node");
@@ -1657,7 +1657,7 @@ describe("scripts/crabbox-wrapper", () => {
       };
       const result = runDefaultWrapper(["run", "--provider", provider, "--", "true"], options);
       expect(result.status, result.stderr).toBe(0);
-      expect(result.stderr).toContain(`version=0.67.0 provider=${provider}`);
+      expect(result.stderr).toContain(`version=0.69.0 provider=${provider}`);
       expect(readInvocations(candidateLog)).toEqual([["--version"]]);
       const calls = readInvocations(log);
       expect(calls[0]).toEqual(["--version"]);
@@ -2296,7 +2296,7 @@ describe("scripts/crabbox-wrapper", () => {
       const env = testHomeEnv(home);
       if (customState) {
         env.XDG_STATE_HOME = path.join(home, "selected state");
-        env.OPENCLAW_FAKE_CRABBOX_VERSION = "crabbox 0.67.0";
+        env.OPENCLAW_FAKE_CRABBOX_VERSION = "crabbox 0.69.0";
         const legacyKey = path.join(
           testCrabboxConfigDir(home),
           "testboxes",
@@ -2320,16 +2320,16 @@ describe("scripts/crabbox-wrapper", () => {
   );
 
   it.each([
-    { id: "tbx_default", createKey: true, state: "", version: "0.67.0", selectedKey: false },
-    { id: "tbx_selected", createKey: true, state: "state", version: "0.67.0", selectedKey: true },
-    { id: "blue-hermit", createKey: false, state: "", version: "0.67.0", selectedKey: false },
+    { id: "tbx_default", createKey: true, state: "", version: "0.69.0", selectedKey: false },
+    { id: "tbx_selected", createKey: true, state: "state", version: "0.69.0", selectedKey: true },
+    { id: "blue-hermit", createKey: false, state: "", version: "0.69.0", selectedKey: false },
     ...(process.platform === "win32"
       ? [
           {
             id: "tbx_namespaced",
             createKey: true,
             state: "namespaced",
-            version: "0.67.0",
+            version: "0.69.0",
             selectedKey: true,
           },
         ]
@@ -2389,7 +2389,7 @@ describe("scripts/crabbox-wrapper", () => {
         env: {
           ...testHomeEnv(home),
           XDG_STATE_HOME: stateRoot,
-          OPENCLAW_FAKE_CRABBOX_VERSION: "crabbox 0.67.0",
+          OPENCLAW_FAKE_CRABBOX_VERSION: "crabbox 0.69.0",
         },
       },
     );
@@ -2398,7 +2398,7 @@ describe("scripts/crabbox-wrapper", () => {
     expect(result.stderr).toContain("XDG_STATE_HOME must be absolute");
   });
 
-  it.each([{ version: "0.67.0", stateDirectory: "state " }])(
+  it.each([{ version: "0.69.0", stateDirectory: "state " }])(
     "fails before reuse when a Blacksmith Testbox is claimed by another repo ($version, $stateDirectory)",
     ({ version, stateDirectory }) => {
       const home = invocationLogTempDirs.make("openclaw-crabbox-home-");