providers and prints `set len=N secret=true` style summaries. On

`blacksmith-testbox`, env forwarding is unsupported; put secrets in the

Testbox workflow instead.

- `--env-from-profile <file>` plus `--allow-env NAME`: loads simple

`export NAME=value` / `NAME=value` lines from a local profile without

executing it, then forwards only allowlisted names. `--allow-env` is

repeatable and comma-separated. Profile values override ambient allowlisted

env values for that run.

- `--script <file>` / `--script-stdin`: upload a local script into

`.crabbox/scripts/` and execute it on the remote box. Shebang scripts execute

directly; scripts without a shebang run through `bash`. Arguments after `--`

become script args.

- `--fresh-pr owner/repo#123|URL|number`: skip dirty local sync and create a

fresh remote checkout of the GitHub PR. Bare numbers use the current repo's

GitHub origin. Add `--apply-local-patch` only when the current local

`git diff --binary HEAD` should be applied on top of that PR checkout.

- `--capture-stdout <path>` / `--capture-stderr <path>`: write remote streams to

local files and keep binary/noisy output out of retained logs. Parent

directories must already exist. These are direct-provider only.

```sh

mkdir -p .crabbox/logs

CRABBOX_ENV_ALLOW=OPENAI_API_KEY,OPENAI_BASE_URL \

pnpm crabbox:run -- --provider aws \

pnpm crabbox:run -- --provider aws \

--preflight \

--env-from-profile ~/.profile \

--allow-env OPENAI_API_KEY,OPENAI_BASE_URL \

--timing-json \

--capture-stdout .crabbox/logs/live-provider.stdout.log \

--capture-stderr .crabbox/logs/live-provider.stderr.log \

```

Do not pass `--capture-*`, `--download`, `--checksum`, `--force-sync-large`, or

`--sync-only` to delegated providers. Crabbox rejects them because the provider

owns sync or command transport.

`--sync-only` to delegated providers. Also do not pass `--script*` or

`--fresh-pr` there. Crabbox rejects these because the provider owns sync or

command transport.

## Efficient Bug E2E Verification

Keep it efficient:

- Reuse existing E2E scripts and helper assertions before writing ad hoc shell.

- Use `--script <file>` or `--script-stdin` for multi-line E2E commands instead

of quote-heavy `--shell` strings on direct SSH providers.

- Use `--fresh-pr <pr>` when validating an upstream PR in isolation from the

local dirty tree. Add `--apply-local-patch` only when testing a local fixup on

top of that PR.

- Use one-shot Crabbox for a single proof; use a reusable Testbox only when

several commands must share built images, installed packages, or live state.

- Prefer `OPENCLAW_CURRENT_PACKAGE_TGZ` with Docker/package lanes when testing a

- Slug/claim confusion: use the raw `tbx_...` id, or run one-shot without

`--id`.

- Sync/timing bug: add `--debug --timing-json`; capture the final JSON and the

printed Actions URL.

printed Actions URL. Large sync warnings now include top source directories

by file count and a hint to update `.crabboxignore` / `sync.exclude`; inspect

those before reaching for `--force-sync-large`.

- Cleanup uncertainty: run `blacksmith testbox list` and stop only boxes you

created.

- Testbox queued/capacity pressure: do not convert a broad changed gate or full