mlclaw 0.3.1 → 0.3.2

package/Dockerfile

@@ -1,8 +1,8 @@
 ARG OPENCLAW_VERSION=2026.7.1-beta.5
 ARG OPENCLAW_BASE_IMAGE=ghcr.io/openclaw/openclaw:${OPENCLAW_VERSION}
 ARG BROKERKIT_PLUGIN_VERSION=0.1.0
-ARG BROKERKIT_VERSION=fcfc5f2304436d952b18e7c9583bb378d1952776
-ARG MLCLAW_RUNTIME_IMAGE=ghcr.io/osolmaz/mlclaw:0.3.1-openclaw-2026.7.1-beta.5
+ARG BROKERKIT_VERSION=a2adf6e626bbd509605bb7c72a7f3a8b1c00f045
+ARG MLCLAW_RUNTIME_IMAGE=ghcr.io/osolmaz/mlclaw:0.3.2-openclaw-2026.7.1-beta.5
 
 FROM golang:1.26.5-bookworm AS hf-broker-build
 ARG BROKERKIT_VERSION
@@ -11,7 +11,17 @@ RUN git init /src \
   && git -C /src checkout --detach FETCH_HEAD \
   && test "$(git -C /src rev-parse HEAD)" = "$BROKERKIT_VERSION" \
   && cd /src \
-  && GOWORK=off go build -trimpath -o /out/hf-broker ./brokers/huggingface/cmd/hf-broker
+  && GOWORK=off go build -trimpath -o /out/hf-broker ./brokers/huggingface/cmd/hf-broker \
+  && /out/hf-broker policy render \
+    --preset request-all-agent-operations \
+    --client default \
+    --profile-out /out/hf-broker.policy-profile.json \
+    --output /out/hf-broker.scope.json \
+    --manifest-out /out/hf-broker.policy-manifest.json \
+  && /out/hf-broker doctor policy \
+    --profile /out/hf-broker.policy-profile.json \
+    --scope /out/hf-broker.scope.json \
+    --manifest /out/hf-broker.policy-manifest.json
 
 FROM node:24-bookworm-slim AS brokerkit-plugin-build
 ARG BROKERKIT_VERSION
@@ -69,7 +79,9 @@ COPY --from=sync-build /build/dist/hf-state-sync.js /app/hf-state-sync.js
 COPY --from=sync-build /build/dist/hf-tooling-seed.js /app/hf-tooling-seed.js
 COPY --from=sync-build /build/dist/mlclaw-space-runtime.js /app/mlclaw-space-runtime.js
 COPY --from=hf-broker-build /out/hf-broker /usr/local/bin/hf-broker
-COPY hf-broker.scope.json /app/hf-broker.scope.json
+COPY --from=hf-broker-build /out/hf-broker.scope.json /app/hf-broker.scope.json
+COPY --from=hf-broker-build /out/hf-broker.policy-profile.json /app/hf-broker.policy-profile.json
+COPY --from=hf-broker-build /out/hf-broker.policy-manifest.json /app/hf-broker.policy-manifest.json
 COPY --chown=node:node openclaw.default.json /app/openclaw.default.json
 COPY --chown=node:node entrypoint.sh /app/entrypoint.sh
 COPY --chown=node:node assets/ /app/assets/

package/README.md

@@ -209,10 +209,12 @@ merges every BrokerKit-compatible backend configured in
 `MLCLAW_OPERATOR_BROKERS_FILE` and lets administrators inspect, approve, deny,
 cancel, or revoke requests. The plugin registers the Gateway tab, while ML Claw
 serves the immutable packaged UI from its trusted HTTP boundary and gives it a
-small launcher inside the Gateway. Decisions open in an unframeable protected
-document with a renewable, short-lived, admin-bound browser token. Broker
-operator tokens remain in backend-only files and are never sent to the browser
-or OpenClaw. See
+small popover inside the Gateway. Administrators decide requests directly in
+the sandboxed popover when `MLCLAW_BROKERKIT_POPOVER_DECISIONS=true`; otherwise
+the popover remains read-only and decisions use the standalone protected page.
+Both flows use a renewable, short-lived, admin-bound browser token.
+Broker operator tokens remain in backend-only files and are never sent to the
+browser or OpenClaw. See
 [Operator Broker Configuration](docs/operator-brokers-config.md).
 
 - `/mlclaw/credentials`: connect or disconnect Hugging Face MCP and Research
@@ -239,9 +241,9 @@ MLCLAW_BRAND_SHORT_NAME=Bob
 MLCLAW_BRAND_THEME_COLOR=#111827
 MLCLAW_BRAND_LOGO=mlclaw.svg
 MLCLAW_BRAND_FAVICON=hf-logo.svg
-MLCLAW_BRAND_FAVICON_32=hf-logo.svg
+MLCLAW_BRAND_FAVICON_32=hf-logo.png
 MLCLAW_BRAND_FAVICON_ICO=hf-logo.svg
-MLCLAW_BRAND_APPLE_TOUCH_ICON=assistant-avatar.svg
+MLCLAW_BRAND_APPLE_TOUCH_ICON=hf-logo.png
 MLCLAW_BRAND_ASSISTANT_AVATAR=assistant-avatar.svg
 ```
 

package/dist/hf-tooling-seed.js

@@ -126,6 +126,18 @@ This workspace has Hugging Face tooling preinstalled. Use the Hugging Face CLI
 \`hf\`, \`hf-discover\`, and \`uv\` for Hub, dataset, model, Space, and bucket
 work.
 
+Protected Hugging Face mutations use the preconfigured HF Broker. Never ask
+the user for a Hugging Face token and never run \`hf auth login\`. Use the
+\`hf_repo_create\`, \`hf_operation_get\`, and \`hf_operation_wait\` MCP tools,
+or run \`hf-broker client repo create OWNER/NAME --type dataset\`. A protected
+action creates an approval in the ML Claw BrokerKit control and may also be
+sent through configured OpenClaw channels. The operation ID is resumable with
+\`hf-broker client operation wait ID\`.
+
+After repository creation, use the brokered Git transport for repository
+contents. The limited broker credential is not a Hugging Face Hub token; do
+not report it as missing Hub access.
+
 Hugging Face agent skills are available in both \`.agents/skills\` and
 \`skills\`. Prefer these skills when the task involves Hugging Face:
 

package/dist/mlclaw-space-runtime.js

@@ -26,7 +26,7 @@ var DEFAULT_BRAND_NAME = "ML Claw";
 var DEFAULT_THEME_COLOR = "#111827";
 var DEFAULT_LOGO_ASSET = "mlclaw.svg";
 var DEFAULT_HUGGING_FACE_ASSET = "hf-logo.svg";
-var DEFAULT_ASSISTANT_AVATAR_ASSET = "assistant-avatar.svg";
+var DEFAULT_HUGGING_FACE_PNG_ASSET = "hf-logo.png";
 function resolveBranding(env, agentName) {
   const defaultName = defaultBrandName(agentName);
   const name = cleanText(env.MLCLAW_BRAND_NAME) ?? defaultName;
@@ -41,16 +41,13 @@ function resolveBranding(env, agentName) {
     ),
     favicon32Asset: normalizeAssetRef(
       env.MLCLAW_BRAND_FAVICON_32 ?? env.MLCLAW_BRAND_FAVICON_PNG ?? env.MLCLAW_BRAND_FAVICON,
-      DEFAULT_HUGGING_FACE_ASSET
+      DEFAULT_HUGGING_FACE_PNG_ASSET
     ),
     faviconIcoAsset: normalizeAssetRef(
       env.MLCLAW_BRAND_FAVICON_ICO ?? env.MLCLAW_BRAND_FAVICON,
       DEFAULT_HUGGING_FACE_ASSET
     ),
-    appleTouchIconAsset: normalizeAssetRef(
-      env.MLCLAW_BRAND_APPLE_TOUCH_ICON ?? env.MLCLAW_BRAND_ASSISTANT_AVATAR,
-      DEFAULT_ASSISTANT_AVATAR_ASSET
-    )
+    appleTouchIconAsset: normalizeAssetRef(env.MLCLAW_BRAND_APPLE_TOUCH_ICON, DEFAULT_HUGGING_FACE_PNG_ASSET)
   };
 }
 function publicBranding(branding) {
@@ -62,33 +59,37 @@ function publicBranding(branding) {
   };
 }
 function brandingManifest(branding) {
-  return `${JSON.stringify({
-    name: branding.name,
-    short_name: branding.shortName,
-    description: `${branding.name} browser gateway`,
-    start_url: "./",
-    display: "standalone",
-    theme_color: branding.themeColor,
-    background_color: branding.themeColor,
-    icons: [
-      {
-        src: "./favicon.svg",
-        sizes: "any",
-        type: "image/svg+xml",
-        purpose: "any"
-      },
-      {
-        src: "./favicon-32.png",
-        sizes: "32x32",
-        type: "image/png"
-      },
-      {
-        src: "./apple-touch-icon.png",
-        sizes: "180x180",
-        type: "image/png"
-      }
-    ]
-  }, null, 2)}
+  return `${JSON.stringify(
+    {
+      name: branding.name,
+      short_name: branding.shortName,
+      description: `${branding.name} browser gateway`,
+      start_url: "./",
+      display: "standalone",
+      theme_color: branding.themeColor,
+      background_color: branding.themeColor,
+      icons: [
+        {
+          src: "./favicon.svg",
+          sizes: "any",
+          type: "image/svg+xml",
+          purpose: "any"
+        },
+        {
+          src: "./favicon-32.png",
+          sizes: "32x32",
+          type: "image/png"
+        },
+        {
+          src: "./apple-touch-icon.png",
+          sizes: "180x180",
+          type: "image/png"
+        }
+      ]
+    },
+    null,
+    2
+  )}
 `;
 }
 function defaultBrandName(agentName) {
@@ -4704,7 +4705,6 @@ var approvalSchema = external_exports.object({
   decided_at: external_exports.string().datetime({ offset: true }).optional(),
   decided_by: external_exports.string().max(200).optional(),
   decided_on_behalf_of: external_exports.string().max(200).optional(),
-  decision_reason: external_exports.string().max(2e3).optional(),
   presentation: external_exports.object({
     risk: external_exports.enum(["unknown", "low", "medium", "high", "critical"]),
     title: external_exports.string().min(1).max(200),
@@ -4808,7 +4808,6 @@ var BrokerOperatorClient = class {
           expected_revision: decision.expectedRevision,
           idempotency_key: decision.idempotencyKey,
           on_behalf_of: decision.onBehalfOf,
-          ...decision.reason ? { decision_reason: decision.reason } : {},
           ...decision.durationSeconds || decision.maxUses ? {
             constraints: {
               ...decision.durationSeconds ? { duration_seconds: decision.durationSeconds } : {},
@@ -5105,7 +5104,9 @@ function loadConfig(env = process.env) {
     routerToken: trim(env.MLCLAW_ROUTER_TOKEN ?? env.HF_ROUTER_TOKEN),
     brokerAgentUrl: trim(env.MLCLAW_HF_BROKER_URL),
     brokerAgentSecret: readOptionalSecret(trim(env.MLCLAW_HF_BROKER_AGENT_SECRET_FILE)),
+    brokerAgentSecretFile: trim(env.MLCLAW_HF_BROKER_AGENT_SECRET_FILE),
     operatorBrokers: loadOperatorBrokers(trim(env.MLCLAW_OPERATOR_BROKERS_FILE)),
+    brokerKitPopoverDecisions: env.MLCLAW_BROKERKIT_POPOVER_DECISIONS === "1" || env.MLCLAW_BROKERKIT_POPOVER_DECISIONS === "true",
     hubUrl: trim(env.HF_ENDPOINT) ?? "https://huggingface.co",
     openaiCredentialFile: trim(env.MLCLAW_OPENAI_CREDENTIAL_FILE) ?? "/tmp/mlclaw-secrets/openai.env",
     openaiCredentialStoreFile,
@@ -7360,7 +7361,81 @@ function signatureMatches(a, b) {
 }
 
 // src/mlclaw-space-runtime/delegated-brokerkit.ts
-import { createHash, createHmac as createHmac2, randomBytes as randomBytes3, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+import { createHash, createHmac as createHmac2, randomBytes as randomBytes4, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+
+// src/mlclaw-space-runtime/delegated-revisions.ts
+import { randomBytes as randomBytes3 } from "node:crypto";
+var DelegatedRevisions = class {
+  epoch = randomBytes3(16).toString("base64url");
+  revision = 0;
+  material = "";
+  current;
+  waiters = /* @__PURE__ */ new Set();
+  publish(material, value) {
+    if (this.current && material === this.material) return this.current;
+    this.material = material;
+    this.revision += 1;
+    this.current = value(this.cursor());
+    for (const waiter of [...this.waiters])
+      this.finish(waiter, { api_version: "brokerkit.io/operator-ui/v1", cursor: this.cursor(), changed: true });
+    return this.current;
+  }
+  wait(cursor, waitSeconds, signal) {
+    const observed = this.parse(cursor);
+    if (observed === void 0) return Promise.reject(revisionError("cursor_expired"));
+    if (observed !== this.revision) {
+      return Promise.resolve({ api_version: "brokerkit.io/operator-ui/v1", cursor: this.cursor(), changed: true });
+    }
+    if (this.waiters.size >= 256) return Promise.reject(revisionError("source_unavailable"));
+    if (signal?.aborted) return Promise.reject(abortError());
+    return new Promise((resolve, reject) => {
+      const waiter = {
+        resolve,
+        reject,
+        timer: setTimeout(() => {
+          this.finish(waiter, { api_version: "brokerkit.io/operator-ui/v1", cursor: this.cursor(), changed: false });
+        }, waitSeconds * 1e3),
+        ...signal ? { signal } : {}
+      };
+      waiter.timer.unref();
+      if (signal) {
+        waiter.abort = () => this.fail(waiter, abortError());
+        signal.addEventListener("abort", waiter.abort, { once: true });
+      }
+      this.waiters.add(waiter);
+    });
+  }
+  cursor() {
+    return `${this.epoch}.${this.revision.toString(36)}`;
+  }
+  parse(value) {
+    const match2 = /^([A-Za-z0-9_-]{22})\.([0-9a-z]{1,13})$/u.exec(value);
+    if (!match2 || match2[1] !== this.epoch) return void 0;
+    const revision = Number.parseInt(match2[2] ?? "", 36);
+    return Number.isSafeInteger(revision) && revision <= this.revision ? revision : void 0;
+  }
+  finish(waiter, value) {
+    this.cleanup(waiter);
+    waiter.resolve(value);
+  }
+  fail(waiter, error) {
+    this.cleanup(waiter);
+    waiter.reject(error);
+  }
+  cleanup(waiter) {
+    if (!this.waiters.delete(waiter)) return;
+    clearTimeout(waiter.timer);
+    if (waiter.signal && waiter.abort) waiter.signal.removeEventListener("abort", waiter.abort);
+  }
+};
+function revisionError(code) {
+  return Object.assign(new Error(code), { code });
+}
+function abortError() {
+  return new DOMException("The operation was aborted", "AbortError");
+}
+
+// src/mlclaw-space-runtime/delegated-brokerkit.ts
 var API_VERSION = "brokerkit.io/delegated-web/v1";
 var TOKEN_LIFETIME_SECONDS = 4 * 60;
 var MAX_PAGES_PER_SOURCE = 32;
@@ -7377,7 +7452,8 @@ var DelegatedBrokerKit = class {
   handles = /* @__PURE__ */ new Map();
   handlesByIdentity = /* @__PURE__ */ new Map();
   snapshotInFlight;
-  issueSession(actor) {
+  revisions = new DelegatedRevisions();
+  issueSession(actor, access) {
     const issuedAt = Math.floor(this.now().getTime() / 1e3);
     const expiresAt = issuedAt + TOKEN_LIFETIME_SECONDS;
     const payload = {
@@ -7386,15 +7462,17 @@ var DelegatedBrokerKit = class {
       subject: actor,
       issuedAt,
       expiresAt,
-      nonce: randomBytes3(16).toString("base64url")
+      nonce: randomBytes4(16).toString("base64url"),
+      access
     };
     const encoded = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
     const signature = this.sign(encoded);
     return {
       api_version: API_VERSION,
-      actor,
-      decision_token: `${encoded}.${signature}`,
-      expires_at: new Date(expiresAt * 1e3).toISOString()
+      token: `${encoded}.${signature}`,
+      expires_at: new Date(expiresAt * 1e3).toISOString(),
+      access,
+      renewal_transport: "direct"
     };
   }
   authorize(header) {
@@ -7404,7 +7482,7 @@ var DelegatedBrokerKit = class {
     const encoded = authenticatedTokenPayload(header, (value) => this.sign(value));
     if (!encoded) return void 0;
     const payload = parseTokenPayload(encoded);
-    return payload && tokenIsCurrent(payload, this.now()) ? { actor: payload.subject, sessionId: payload.nonce } : void 0;
+    return payload && tokenIsCurrent(payload, this.now()) ? { actor: payload.subject, sessionId: payload.nonce, access: payload.access } : void 0;
   }
   async snapshot() {
     if (this.snapshotInFlight) return this.snapshotInFlight;
@@ -7424,12 +7502,50 @@ var DelegatedBrokerKit = class {
     );
     const selected = selectSnapshotRequests(results, MAX_HANDLES);
     const reservedHandles = this.selectedExistingHandles(selected);
+    const sources = results.map((result) => result.source);
+    const requests = selected.map(
+      ({ source, request }) => project(source, request, this.handle(source.id, request, reservedHandles))
+    );
+    const material = JSON.stringify({
+      sources: sources.map((source) => ({
+        id: source.id,
+        label: source.label,
+        healthy: source.healthy,
+        ...source.error ? { error: source.error } : {}
+      })),
+      requests
+    });
+    return this.revisions.publish(material, (cursor) => ({
+      api_version: "brokerkit.io/operator-ui/v1",
+      cursor,
+      sources,
+      requests,
+      synchronized_at: synchronizedAt
+    }));
+  }
+  async events(cursor, waitSeconds, signal) {
+    await this.snapshot();
+    const waiting = this.revisions.wait(cursor, waitSeconds, signal);
+    const refresh = setInterval(() => void this.snapshot().catch(() => void 0), 1e3);
+    refresh.unref();
+    try {
+      return await waiting;
+    } catch (error) {
+      if (error instanceof Error && "code" in error && (error.code === "cursor_expired" || error.code === "source_unavailable")) {
+        throw delegatedError(error.code);
+      }
+      throw error;
+    } finally {
+      clearInterval(refresh);
+    }
+  }
+  async summary() {
+    const snapshot = await this.snapshot();
     return {
-      sources: results.map((result) => result.source),
-      requests: selected.map(
-        ({ source, request }) => project(source, request, this.handle(source.id, request, reservedHandles))
-      ),
-      synchronizedAt
+      api_version: snapshot.api_version,
+      cursor: snapshot.cursor,
+      pending: snapshot.requests.filter((value) => value.request.status === "pending").length,
+      healthy: snapshot.sources.every((source) => source.healthy)
     };
   }
   async detail(handle) {
@@ -7467,7 +7583,7 @@ var DelegatedBrokerKit = class {
       ]);
       const requests = reconcileRequests(pages.map((page2) => page2.requests));
       return {
-        source: deadline.signal.aborted ? { ...summary, healthy: false, error: "broker_timeout" } : pages.some((page2) => page2.truncated) ? { ...summary, healthy: false, error: "source_truncated" } : { ...summary, healthy: true, lastSyncAt: synchronizedAt },
+        source: deadline.signal.aborted ? { ...summary, healthy: false, error: "broker_timeout" } : pages.some((page2) => page2.truncated) ? { ...summary, healthy: false, error: "source_truncated" } : { ...summary, healthy: true, last_sync_at: synchronizedAt },
         requests
       };
     } catch (error) {
@@ -7512,7 +7628,7 @@ var DelegatedBrokerKit = class {
     if (this.handles.size >= MAX_HANDLES && !this.pruneOldestHandle(reservedHandles)) {
       throw delegatedError("source_unavailable");
     }
-    const handle = randomBytes3(18).toString("base64url");
+    const handle = randomBytes4(18).toString("base64url");
     const requestExpiry = Date.parse(handleExpiry(request));
     const expiresAtMs = Number.isFinite(requestExpiry) ? Math.min(requestExpiry, this.now().getTime() + 24 * 60 * 6e4) : this.now().getTime() + 5 * 6e4;
     this.handles.set(handle, { sourceId, requestId: request.id, revision: request.revision, expiresAtMs });
@@ -7611,7 +7727,7 @@ function delegatedError(code) {
   return new DelegatedBrokerKitError(code);
 }
 function project(source, request, handle) {
-  return { ...request, sourceId: source.id, sourceLabel: source.label, handle };
+  return { source_id: source.id, source_label: source.label, handle, request };
 }
 function requestIdentity(sourceId, requestId, revision) {
   return `${sourceId}\0${requestId}\0${revision}`;
@@ -7633,7 +7749,6 @@ function decisionOptions(record, action, expectedRevision, actor, options) {
     expectedRevision,
     idempotencyKey: decisionKey(record, action, actor),
     onBehalfOf: `mlclaw:${actor}`,
-    ...options.reason ? { reason: options.reason } : {},
     ...options.durationSeconds ? { durationSeconds: options.durationSeconds } : {},
     ...options.maxUses ? { maxUses: options.maxUses } : {}
   };
@@ -7678,10 +7793,10 @@ function validTokenPayload(value) {
   return hasExactTokenFields(record) && validTokenIdentity(record) && validTokenTimes(record) && validTokenNonce(record);
 }
 function hasExactTokenFields(record) {
-  return Object.keys(record).sort().join(",") === "audience,expiresAt,issuedAt,nonce,subject,version";
+  return Object.keys(record).sort().join(",") === "access,audience,expiresAt,issuedAt,nonce,subject,version";
 }
 function validTokenIdentity(record) {
-  return record.version === 1 && record.audience === "brokerkit-delegated-web" && typeof record.subject === "string" && record.subject.length >= 1 && record.subject.length <= 200;
+  return record.version === 1 && record.audience === "brokerkit-delegated-web" && (record.access === "read" || record.access === "decide") && typeof record.subject === "string" && record.subject.length >= 1 && record.subject.length <= 200;
 }
 function validTokenTimes(record) {
   return typeof record.issuedAt === "number" && Number.isSafeInteger(record.issuedAt) && typeof record.expiresAt === "number" && Number.isSafeInteger(record.expiresAt);
@@ -8429,6 +8544,7 @@ async function configureOpenClawGateway(config2) {
   };
   configureOpenClawModels(openclawConfig, config2);
   configureManagedMcpServers(openclawConfig, config2);
+  configureBrokerMcpServer(openclawConfig, config2);
   configureBrokerKitPlugin(openclawConfig, config2);
   await fs.mkdir(path.dirname(config2.openclawConfigPath), { recursive: true });
   await fs.writeFile(config2.openclawConfigPath, `${JSON.stringify(openclawConfig, null, 2)}
@@ -8438,6 +8554,24 @@ async function configureOpenClawGateway(config2) {
     await fs.chown(config2.openclawConfigPath, config2.openclawUid, config2.openclawGid);
   }
 }
+function configureBrokerMcpServer(openclawConfig, config2) {
+  const servers = object(object(openclawConfig, "mcp"), "servers");
+  if (!config2.brokerAgentUrl || !config2.brokerAgentSecretFile) {
+    delete servers["huggingface-broker"];
+    return;
+  }
+  const existing = objectValue2(servers["huggingface-broker"]);
+  servers["huggingface-broker"] = {
+    ...existing,
+    command: "/usr/local/bin/hf-broker",
+    args: ["mcp"],
+    env: {
+      MLCLAW_HF_BROKER_URL: config2.brokerAgentUrl,
+      MLCLAW_HF_BROKER_AGENT_SECRET_FILE: config2.brokerAgentSecretFile
+    },
+    ...existing?.enabled === false ? { enabled: false } : { enabled: true }
+  };
+}
 function configureBrokerKitPlugin(openclawConfig, config2) {
   const plugins = object(openclawConfig, "plugins");
   const load = object(plugins, "load");
@@ -8576,7 +8710,7 @@ function uniqueStrings(value, required) {
 }
 
 // src/mlclaw-space-runtime/openai-credentials.ts
-import { createCipheriv, createDecipheriv, hkdfSync, randomBytes as randomBytes4 } from "node:crypto";
+import { createCipheriv, createDecipheriv, hkdfSync, randomBytes as randomBytes5 } from "node:crypto";
 import fs2 from "node:fs/promises";
 import path2 from "node:path";
 function openAiConfigured(env = process.env) {
@@ -8645,7 +8779,7 @@ var OpenAiCredentialStore = class {
     if (!normalized) {
       throw new Error("valid OpenAI API key is required");
     }
-    const iv = randomBytes4(12);
+    const iv = randomBytes5(12);
     const cipher = createCipheriv("aes-256-gcm", this.key, iv);
     const ciphertext = Buffer.concat([cipher.update(normalized, "utf8"), cipher.final()]);
     const envelope = {
@@ -8656,7 +8790,7 @@ var OpenAiCredentialStore = class {
       ciphertext: ciphertext.toString("base64url")
     };
     const directory = path2.dirname(this.file);
-    const temporary = `${this.file}.${process.pid}.${randomBytes4(6).toString("hex")}.tmp`;
+    const temporary = `${this.file}.${process.pid}.${randomBytes5(6).toString("hex")}.tmp`;
     await fs2.mkdir(directory, { recursive: true, mode: 448 });
     try {
       await fs2.writeFile(temporary, `${JSON.stringify(envelope)}
@@ -8942,7 +9076,7 @@ function positiveNumber2(value) {
 }
 
 // src/mlclaw-space-runtime/cookies.ts
-import { createHmac as createHmac4, randomBytes as randomBytes5, timingSafeEqual as timingSafeEqual4 } from "node:crypto";
+import { createHmac as createHmac4, randomBytes as randomBytes6, timingSafeEqual as timingSafeEqual4 } from "node:crypto";
 function createSignedCookie(options, payload) {
   const body = Buffer.from(JSON.stringify({
     ...payload,
@@ -8991,7 +9125,7 @@ function clearCookie(name, secure) {
   });
 }
 function randomState() {
-  return randomBytes5(24).toString("base64url");
+  return randomBytes6(24).toString("base64url");
 }
 function sign2(value, secret) {
   return createHmac4("sha256", secret).update(value).digest("base64url");
@@ -9084,6 +9218,10 @@ function normalizeNext(value) {
 var SHELL_MARKER = "data-mlclaw-shell";
 var BRANDING_MARKER = "data-mlclaw-branding";
 var CONTROL_BRANDING_MARKER = "data-mlclaw-control-branding";
+var BROKERKIT_DELEGATED_UI_BOOTSTRAP = Buffer.from(
+  JSON.stringify({ version: 1, mode: "delegated-web", basePath: "/mlclaw/api/brokerkit" }),
+  "utf8"
+).toString("base64url");
 var CONTROL_BRANDING_SCRIPT_PATH = "/assets/mlclaw-control-branding.js";
 var CONTROL_BRANDING_SCRIPT = `(function () {
   var productName = "ML Claw";
@@ -9152,31 +9290,125 @@ var CONTROL_BRANDING_SCRIPT = `(function () {
       }
     });
   }
-  function brokerKitFrameIn(root, source) {
-    if (!root.querySelectorAll) return;
-    var frames = root.querySelectorAll("iframe");
-    for (var i = 0; i < frames.length; i++) {
-      try {
-        var frameUrl = new URL(frames[i].src, location.href);
-        if (frames[i].contentWindow === source && frameUrl.origin === location.origin &&
-            frameUrl.pathname === "/plugins/brokerkit/ui/" && !frameUrl.search) return frames[i];
-      } catch (_) {}
+  function installApprovals() {
+    var shell = document.querySelector("[data-mlclaw-shell]");
+    var button = document.querySelector("[data-mlclaw-approvals-button]");
+    var popover = document.querySelector("[data-mlclaw-approvals-popover]");
+    var frame = document.querySelector("[data-mlclaw-approvals-frame]");
+    var badge = document.querySelector("[data-mlclaw-approvals-badge]");
+    var close = document.querySelector("[data-mlclaw-approvals-close]");
+    if (!shell || !button || !popover || !frame || button.getAttribute("data-ready") === "1") return;
+    button.setAttribute("data-ready", "1");
+    function invalidateFrame() {
+      if (frame.contentWindow) {
+        frame.contentWindow.postMessage({ type: "brokerkit.operator-ui.invalidate", version: 1 }, "*");
+      }
+    }
+    function setOpen(open) {
+      popover.hidden = !open;
+      button.setAttribute("aria-expanded", open ? "true" : "false");
+      if (!open) return;
+      if (!frame.getAttribute("src")) frame.setAttribute("src", frame.getAttribute("data-src"));
+      else invalidateFrame();
+    }
+    frame.addEventListener("load", function () { if (!popover.hidden) invalidateFrame(); });
+    button.addEventListener("click", function () { setOpen(popover.hidden); });
+    if (close) close.addEventListener("click", function () { setOpen(false); });
+    document.addEventListener("click", function (event) {
+      if (!popover.hidden && !shell.contains(event.target)) setOpen(false);
+    });
+    document.addEventListener("keydown", function (event) {
+      if (event.key === "Escape") setOpen(false);
+    });
+    window.addEventListener("message", function (event) {
+      var data = event.data;
+      if (
+        event.source !== frame.contentWindow ||
+        !data ||
+        typeof data !== "object" ||
+        Object.keys(data).sort().join(",") !== "nonce,type,version" ||
+        data.type !== "brokerkit.delegated-web.open" ||
+        data.version !== 1 ||
+        typeof data.nonce !== "string" ||
+        !/^[a-f0-9]{32}$/.test(data.nonce)
+      ) return;
+      window.location.assign("/plugins/brokerkit/ui/#${BROKERKIT_DELEGATED_UI_BOOTSTRAP}");
+    });
+    var summaryCursor = "";
+    var stopped = false;
+    function acceptSummary(summary) {
+      if (
+        !summary ||
+        typeof summary !== "object" ||
+        Object.keys(summary).sort().join(",") !== "api_version,cursor,healthy,pending" ||
+        summary.api_version !== "brokerkit.io/operator-ui/v1" ||
+        typeof summary.cursor !== "string" ||
+        summary.cursor.length < 1 ||
+        summary.cursor.length > 128 ||
+        typeof summary.pending !== "number" ||
+        !Number.isSafeInteger(summary.pending) ||
+        summary.pending < 0 ||
+        typeof summary.healthy !== "boolean"
+      ) return false;
+      var changed = summaryCursor && summaryCursor !== summary.cursor;
+      summaryCursor = summary.cursor;
+      if (badge) {
+        badge.textContent = summary.pending > 99 ? "99+" : String(summary.pending);
+        badge.hidden = summary.pending < 1;
+      }
+      button.setAttribute("aria-label", summary.pending > 0 ? "Open approval requests (" + summary.pending + " pending)" : "Open approval requests");
+      if (changed) invalidateFrame();
+      return true;
+    }
+    function refresh() {
+      return fetch("/mlclaw/api/brokerkit/summary", { credentials: "same-origin", cache: "no-store" })
+        .then(function (response) { return response.ok ? response.json() : null; })
+        .then(acceptSummary)
+        .catch(function () { return false; });
     }
-    var elements = root.querySelectorAll("*");
-    for (var j = 0; j < elements.length; j++) {
-      if (elements[j].shadowRoot) {
-        var nested = brokerKitFrameIn(elements[j].shadowRoot, source);
-        if (nested) return nested;
+    function watch(delay) {
+      if (stopped) return;
+      if (!summaryCursor) {
+        refresh().then(function () { window.setTimeout(function () { watch(250); }, delay); });
+        return;
       }
+      fetch("/mlclaw/api/brokerkit/summary/events?cursor=" + encodeURIComponent(summaryCursor) + "&wait_seconds=25", {
+        credentials: "same-origin",
+        cache: "no-store"
+      }).then(function (response) {
+        if (response.status === 410) {
+          summaryCursor = "";
+          return null;
+        }
+        if (!response.ok) throw new Error("summary unavailable");
+        return response.json();
+      }).then(function (event) {
+        if (
+          event &&
+          typeof event === "object" &&
+          Object.keys(event).sort().join(",") === "api_version,changed,cursor" &&
+          event.api_version === "brokerkit.io/operator-ui/v1" &&
+          typeof event.cursor === "string" &&
+          event.cursor.length >= 1 &&
+          event.cursor.length <= 128 &&
+          typeof event.changed === "boolean"
+        ) {
+          summaryCursor = event.cursor;
+          if (event.changed) invalidateFrame();
+          return event.changed ? refresh() : true;
+        }
+        return false;
+      }).then(function (ok) {
+        window.setTimeout(function () { watch(ok ? 250 : Math.min(delay * 2, 30000)); }, ok ? 0 : delay);
+      }).catch(function () {
+        window.setTimeout(function () { watch(Math.min(delay * 2, 30000)); }, delay);
+      });
     }
+    refresh().then(function () { watch(250); });
+    window.setInterval(refresh, 300000);
+    window.addEventListener("focus", function () { refresh(); });
+    window.addEventListener("beforeunload", function () { stopped = true; });
   }
-  window.addEventListener("message", function (event) {
-    var message = event.data;
-    if (event.origin !== "null" || !message || message.type !== "brokerkit.delegated-web.open" ||
-        message.version !== 1 || typeof message.nonce !== "string" || !/^[a-f0-9]{32}$/.test(message.nonce)) return;
-    var frame = brokerKitFrameIn(document, event.source);
-    if (frame) location.assign(frame.src);
-  });
   if (!document.documentElement.hasAttribute(marker)) {
     document.documentElement.setAttribute(marker, "1");
     var attachShadow = Element.prototype.attachShadow;
@@ -9190,6 +9422,7 @@ var CONTROL_BRANDING_SCRIPT = `(function () {
     requestAnimationFrame(function () {
       observeExistingShadowRoots(document);
       scan(document);
+      installApprovals();
     });
   }
 })();
@@ -9222,6 +9455,13 @@ function rewriteOpenClawHtml(html, branding) {
 function injectMlClawShell(html, branding) {
   const shell = `
 <div ${SHELL_MARKER} style="position:fixed;left:max(12px,env(safe-area-inset-left));bottom:max(12px,env(safe-area-inset-bottom));z-index:2147483647;">
+  <section data-mlclaw-approvals-popover hidden aria-label="Approval requests" style="position:absolute;left:0;bottom:44px;box-sizing:border-box;width:min(420px,calc(100vw - 24px));height:min(620px,calc(100dvh - 72px));overflow:hidden;border:1px solid rgba(15,23,42,.16);border-radius:14px;background:white;box-shadow:0 18px 48px rgba(15,23,42,.24);">
+    <header style="box-sizing:border-box;display:flex;height:42px;align-items:center;justify-content:space-between;padding:0 10px 0 14px;border-bottom:1px solid rgba(15,23,42,.1);color:#111827;font:600 14px system-ui;">
+      <span>Approvals</span>
+      <button data-mlclaw-approvals-close type="button" aria-label="Close approval requests" style="display:grid;width:30px;height:30px;place-items:center;border:0;border-radius:7px;background:transparent;color:#475569;cursor:pointer;font:20px/1 system-ui;">&times;</button>
+    </header>
+    <iframe data-mlclaw-approvals-frame data-src="/plugins/brokerkit/ui/?embed=popover#${BROKERKIT_DELEGATED_UI_BOOTSTRAP}" title="Approval requests" sandbox="allow-scripts" style="display:block;width:100%;height:calc(100% - 42px);border:0;background:white;"></iframe>
+  </section>
   <div style="display:flex;gap:8px;align-items:center;">
   <a href="/mlclaw" aria-label="Open ${escapeHtml2(branding.name)} settings" title="${escapeHtml2(branding.name)}" style="box-sizing:border-box;display:flex;width:34px;height:34px;aspect-ratio:1/1;align-items:center;justify-content:center;border:1px solid rgba(15,23,42,.16);border-radius:8px;background:rgba(255,255,255,.94);box-shadow:0 8px 18px rgba(15,23,42,.14);color:#111827;text-decoration:none;">
     <svg aria-hidden="true" viewBox="0 0 24 24" width="18" height="18" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" style="display:block;width:18px;height:18px;">
@@ -9229,6 +9469,10 @@ function injectMlClawShell(html, branding) {
       <circle cx="12" cy="12" r="3"></circle>
     </svg>
   </a>
+  <button data-mlclaw-approvals-button type="button" aria-label="Open approval requests" aria-expanded="false" style="position:relative;box-sizing:border-box;display:grid;width:34px;height:34px;place-items:center;border:1px solid rgba(15,23,42,.16);border-radius:8px;background:rgba(255,255,255,.94);box-shadow:0 8px 18px rgba(15,23,42,.14);color:#111827;cursor:pointer;">
+    <svg aria-hidden="true" viewBox="0 0 24 24" width="18" height="18" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10.268 21a2 2 0 0 0 3.464 0"></path><path d="M3.262 15.326A1 1 0 0 0 4 17h16a1 1 0 0 0 .74-1.673C19.41 13.956 18 12.499 18 8A6 6 0 0 0 6 8c0 4.499-1.411 5.956-2.738 7.326"></path></svg>
+    <span data-mlclaw-approvals-badge hidden style="position:absolute;place-items:center;min-width:17px;height:17px;right:-6px;top:-7px;padding:0 4px;border:2px solid white;border-radius:999px;background:#dc2626;color:white;font:700 9px system-ui;"></span>
+  </button>
   </div>
 </div>
 `;
@@ -9272,6 +9516,9 @@ function createSpaceRuntimeApp(config2, controls) {
   const delegatedBrokerKit = new DelegatedBrokerKit(operatorBrokers, config2.sessionSecret);
   const allowDelegatedSessionSnapshot = fixedWindowRateLimit(12, 6e4);
   const allowDelegatedActorSnapshot = fixedWindowRateLimit(60, 6e4);
+  const allowBrokerKitSummary = fixedWindowRateLimit(12, 6e4);
+  const allowDelegatedEvents = fixedWindowRateLimit(60, 6e4);
+  const allowSummaryEvents = fixedWindowRateLimit(60, 6e4);
   const openAiCredentials = new OpenAiCredentialStore(config2.openaiCredentialStoreFile, config2.credentialKey);
   app.get("/health", (c) => health(c, config2, controls));
   app.get("/healthz", (c) => health(c, config2, controls));
@@ -9341,11 +9588,33 @@ function createSpaceRuntimeApp(config2, controls) {
     }
     return c.json(await statusPayload(config2, controls));
   });
+  app.get("/mlclaw/api/brokerkit/summary", async (c) => {
+    const auth = requireAdmin(c, config2);
+    if (auth instanceof Response) return auth;
+    if (!allowBrokerKitSummary(auth.username)) return c.json({ ok: false, error: "rate limited" }, 429);
+    try {
+      return c.json(await delegatedBrokerKit.summary());
+    } catch {
+      return c.json({ ok: false, error: "operator inbox unavailable" }, 503);
+    }
+  });
+  app.get("/mlclaw/api/brokerkit/summary/events", async (c) => {
+    const auth = requireAdmin(c, config2);
+    if (auth instanceof Response) return auth;
+    if (!allowSummaryEvents(auth.username)) return c.json({ ok: false, error: "rate limited" }, 429);
+    const input = delegatedEventQuery(c.req.url);
+    if (!input) return c.json({ ok: false, error: "invalid request" }, 400);
+    try {
+      return c.json(await delegatedBrokerKit.events(input.cursor, input.waitSeconds, c.req.raw.signal));
+    } catch (error) {
+      return delegatedFailure(c, error);
+    }
+  });
   app.options("/mlclaw/api/brokerkit/*", (c) => delegatedPreflight(c));
   app.post("/mlclaw/api/brokerkit/session", (c) => {
     const identity = delegatedIdentity(c, delegatedBrokerKit);
     if (!identity) return delegatedErrorResponse(c, "not_authorized", 401);
-    return delegatedJson(c, delegatedBrokerKit.issueSession(identity.actor));
+    return delegatedJson(c, delegatedBrokerKit.issueSession(identity.actor, identity.access));
   });
   app.get("/mlclaw/api/brokerkit/snapshot", async (c) => {
     const identity = delegatedIdentity(c, delegatedBrokerKit);
@@ -9359,6 +9628,18 @@ function createSpaceRuntimeApp(config2, controls) {
       return delegatedFailure(c, error);
     }
   });
+  app.get("/mlclaw/api/brokerkit/events", async (c) => {
+    const identity = delegatedIdentity(c, delegatedBrokerKit);
+    if (!identity) return delegatedErrorResponse(c, "not_authorized", 401);
+    if (!allowDelegatedEvents(identity.sessionId)) return delegatedErrorResponse(c, "rate_limited", 429);
+    const input = delegatedEventQuery(c.req.url);
+    if (!input) return delegatedErrorResponse(c, "invalid_input", 400);
+    try {
+      return delegatedJson(c, await delegatedBrokerKit.events(input.cursor, input.waitSeconds, c.req.raw.signal));
+    } catch (error) {
+      return delegatedFailure(c, error);
+    }
+  });
   app.get("/mlclaw/api/brokerkit/requests/:handle", async (c) => {
     const identity = delegatedIdentity(c, delegatedBrokerKit);
     if (!identity) return delegatedErrorResponse(c, "not_authorized", 401);
@@ -9371,23 +9652,22 @@ function createSpaceRuntimeApp(config2, controls) {
   for (const action of ["approve", "deny", "cancel", "revoke"]) {
     app.post(`/mlclaw/api/brokerkit/requests/:handle/${action}`, async (c) => {
       const identity = delegatedIdentity(c, delegatedBrokerKit);
-      if (!identity) return delegatedErrorResponse(c, "not_authorized", 401);
+      if (!identity || identity.access !== "decide") return delegatedErrorResponse(c, "not_authorized", 401);
       const body = await readBoundedJson(c, 16384);
-      if (!body || Object.keys(body).some((key) => !["expectedRevision", "reason", "constraints"].includes(key))) {
+      if (!body || Object.keys(body).some((key) => !["expectedRevision", "constraints"].includes(key))) {
         return delegatedErrorResponse(c, "invalid_input", 400);
       }
       const constraints = recordValue(body.constraints);
       const expectedRevision = positiveJsonInteger(body.expectedRevision);
       const durationSeconds = optionalPositiveJsonInteger(constraints?.durationSeconds);
       const maxUses = optionalPositiveJsonInteger(constraints?.maxUses);
-      if (!expectedRevision || body.reason !== void 0 && (typeof body.reason !== "string" || body.reason.length > 2e3) || body.constraints !== void 0 && (!constraints || Object.keys(constraints).some((key) => !["durationSeconds", "maxUses"].includes(key)) || durationSeconds === void 0 || maxUses === void 0) || durationSeconds === "invalid" || maxUses === "invalid" || action !== "approve" && (durationSeconds !== void 0 || maxUses !== void 0)) {
+      if (!expectedRevision || body.constraints !== void 0 && (!constraints || Object.keys(constraints).some((key) => !["durationSeconds", "maxUses"].includes(key)) || durationSeconds === void 0 || maxUses === void 0) || durationSeconds === "invalid" || maxUses === "invalid" || action !== "approve" && (durationSeconds !== void 0 || maxUses !== void 0)) {
         return delegatedErrorResponse(c, "invalid_input", 400);
       }
       try {
         return delegatedJson(
           c,
           await delegatedBrokerKit.decide(c.req.param("handle"), action, expectedRevision, identity.actor, {
-            ...typeof body.reason === "string" ? { reason: body.reason } : {},
             ...typeof durationSeconds === "number" ? { durationSeconds } : {},
             ...typeof maxUses === "number" ? { maxUses } : {}
           })
@@ -9668,16 +9948,28 @@ async function trustedBrokerKitUi(c, config2, delegatedBrokerKit) {
   if (relative === "index.html") {
     const destination = c.req.header("sec-fetch-dest");
     if (destination !== "iframe" && destination !== "document") return c.text("not found\n", 404);
+    const query = new URL(c.req.url).search;
+    const embeddedPopover = destination === "iframe" && query === "?embed=popover";
+    if (query && !embeddedPopover) return c.text("not found\n", 404);
     const auth = requireAdmin(c, config2);
     if (auth instanceof Response) return auth;
     try {
       const template = await fs3.readFile(file, "utf8");
-      const marker = destination === "iframe" ? '<meta name="brokerkit-delegated-top-level">' : `<meta name="brokerkit-delegated-session" content="${Buffer.from(
-        JSON.stringify(delegatedBrokerKit.issueSession(auth.username)),
+      const delegatedSession = destination === "document" || embeddedPopover;
+      const marker = !delegatedSession ? '<meta name="brokerkit-delegated-top-level">' : `<meta name="brokerkit-delegated-session" content="${Buffer.from(
+        JSON.stringify(
+          delegatedBrokerKit.issueSession(
+            auth.username,
+            embeddedPopover && !config2.brokerKitPopoverDecisions ? "read" : "decide"
+          )
+        ),
         "utf8"
       ).toString("base64url")}">`;
       if (!template.includes("</head>")) return c.text("not found\n", 404);
-      const headers2 = trustedBrokerKitHeaders(destination === "iframe" ? "launcher" : "top-level");
+      const headers2 = trustedBrokerKitHeaders(
+        embeddedPopover ? "popover" : destination === "iframe" ? "launcher" : "top-level",
+        new URL(c.req.url).origin
+      );
       headers2.set("content-type", "text/html; charset=utf-8");
       return new Response(template.replace("</head>", `${marker}</head>`), { status: 200, headers: headers2 });
     } catch {
@@ -9686,15 +9978,16 @@ async function trustedBrokerKitUi(c, config2, delegatedBrokerKit) {
   }
   const response = await serveFile(file, contentType(file), true);
   if (response.status !== 200) return response;
-  const headers = trustedBrokerKitHeaders("asset");
+  const headers = trustedBrokerKitHeaders("asset", new URL(c.req.url).origin);
   headers.set("content-type", response.headers.get("content-type") ?? "application/octet-stream");
   return new Response(response.body, { status: response.status, headers });
 }
-function trustedBrokerKitHeaders(mode) {
+function trustedBrokerKitHeaders(mode, origin) {
   const asset = mode === "asset";
+  const sandbox = mode === "top-level" || mode === "popover" ? "sandbox allow-scripts; " : "";
   const headers = new Headers({
     "cache-control": asset ? "public, max-age=31536000, immutable" : "no-store",
-    "content-security-policy": `sandbox allow-scripts; default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; frame-ancestors ${mode === "top-level" ? "'none'" : "'self'"}`,
+    "content-security-policy": `${sandbox}default-src 'self'; script-src 'self' ${origin}; style-src 'self' 'unsafe-inline' ${origin}; connect-src 'self' ${origin}; img-src 'self' data:; frame-ancestors ${mode === "top-level" ? "'none'" : "'self'"}`,
     "cross-origin-resource-policy": asset ? "cross-origin" : "same-origin",
     "referrer-policy": "no-referrer",
     "x-content-type-options": "nosniff",
@@ -9747,6 +10040,16 @@ function requireCsrf(c, config2, username) {
 function delegatedOriginAllowed(c) {
   return c.req.header("origin") === "null";
 }
+function delegatedEventQuery(urlValue) {
+  const url = new URL(urlValue);
+  if ([...url.searchParams.keys()].some((key) => key !== "cursor" && key !== "wait_seconds")) return void 0;
+  const cursor = url.searchParams.get("cursor") ?? "";
+  const wait = url.searchParams.get("wait_seconds") ?? "25";
+  if (cursor.length < 1 || cursor.length > 128 || !/^[A-Za-z0-9_.-]+$/u.test(cursor) || !/^(?:[1-9]|1[0-9]|2[0-5])$/u.test(wait)) {
+    return void 0;
+  }
+  return { cursor, waitSeconds: Number(wait) };
+}
 function delegatedIdentity(c, delegated) {
   if (!delegatedOriginAllowed(c)) return void 0;
   return delegated.authorizeSession(c.req.header("authorization"));
@@ -9769,7 +10072,7 @@ function delegatedErrorResponse(c, code, status) {
 }
 function delegatedFailure(c, error) {
   if (error instanceof DelegatedBrokerKitError) {
-    const status = error.code === "request_not_found" ? 404 : error.code === "revision_stale" || error.code === "action_not_allowed" ? 409 : 502;
+    const status = error.code === "request_not_found" ? 404 : error.code === "cursor_expired" ? 410 : error.code === "revision_stale" || error.code === "action_not_allowed" ? 409 : 502;
     return delegatedErrorResponse(c, error.code, status);
   }
   if (error instanceof BrokerOperatorError) {
@@ -10066,7 +10369,7 @@ function contentType(file) {
 }
 
 // src/mlclaw-space-runtime/mcp-credentials.ts
-import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, hkdfSync as hkdfSync2, randomBytes as randomBytes6 } from "node:crypto";
+import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, hkdfSync as hkdfSync2, randomBytes as randomBytes7 } from "node:crypto";
 import fs4 from "node:fs/promises";
 import path4 from "node:path";
 var DEFAULT_REFRESH_TIMEOUT_MS = 3e4;
@@ -10199,7 +10502,7 @@ var McpCredentialStore = class {
   async persist() {
     const directory = path4.dirname(this.options.file);
     await fs4.mkdir(directory, { recursive: true, mode: 448 });
-    const temporary = `${this.options.file}.${process.pid}.${randomBytes6(6).toString("hex")}.tmp`;
+    const temporary = `${this.options.file}.${process.pid}.${randomBytes7(6).toString("hex")}.tmp`;
     const encrypted = encryptDocument(this.document, this.key);
     try {
       await fs4.writeFile(temporary, `${JSON.stringify(encrypted)}
@@ -10277,7 +10580,7 @@ var InvalidCredentialFileError = class extends Error {
   }
 };
 function encryptDocument(document, key) {
-  const iv = randomBytes6(12);
+  const iv = randomBytes7(12);
   const cipher = createCipheriv2("aes-256-gcm", key, iv);
   const plaintext = Buffer.from(JSON.stringify(document), "utf8");
   const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
@@ -10766,6 +11069,8 @@ var OPENCLAW_ENV_ALLOWLIST = [
   "OPENCLAW_LIVE_DIR",
   "OPENCLAW_STATE_DIR",
   "OPENCLAW_WORKSPACE_DIR",
+  "MLCLAW_HF_BROKER_URL",
+  "MLCLAW_HF_BROKER_AGENT_SECRET_FILE",
   "TELEGRAM_API_ROOT",
   "TELEGRAM_ALLOWED_USERS",
   "TELEGRAM_BOT_TOKEN",

package/dist/mlclaw.mjs

@@ -14838,16 +14838,13 @@ import path12 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var DEFAULT_OPENCLAW_VERSION = "2026.7.1-beta.5";
 var DEFAULT_BROKERKIT_PLUGIN_VERSION = "0.1.0";
-var DEFAULT_BROKERKIT_VERSION = "fcfc5f2304436d952b18e7c9583bb378d1952776";
+var DEFAULT_BROKERKIT_VERSION = "a2adf6e626bbd509605bb7c72a7f3a8b1c00f045";
 var DEFAULT_RUNTIME_IMAGE_REPOSITORY = "ghcr.io/osolmaz/mlclaw";
 var PACKAGE_METADATA = readPackageMetadata();
 var PACKAGE_VERSION = packageString("version", "unknown");
 var OPENCLAW_VERSION = packageConfigString("openclawVersion", DEFAULT_OPENCLAW_VERSION);
 var OPENCLAW_BASE_IMAGE = `ghcr.io/openclaw/openclaw:${OPENCLAW_VERSION}`;
-var BROKERKIT_PLUGIN_VERSION = packageConfigString(
-  "brokerkitPluginVersion",
-  DEFAULT_BROKERKIT_PLUGIN_VERSION
-);
+var BROKERKIT_PLUGIN_VERSION = packageConfigString("brokerkitPluginVersion", DEFAULT_BROKERKIT_PLUGIN_VERSION);
 var BROKERKIT_VERSION = packageConfigString("brokerkitVersion", DEFAULT_BROKERKIT_VERSION);
 var RUNTIME_IMAGE_REPOSITORY = packageConfigString("runtimeImageRepository", DEFAULT_RUNTIME_IMAGE_REPOSITORY);
 var DEFAULT_RUNTIME_IMAGE_TAG = `${PACKAGE_VERSION}-openclaw-${OPENCLAW_VERSION}`;
@@ -14955,7 +14952,6 @@ async function generateSpaceRepo(sourceDir, outDir, options = {}) {
       ["dist/hf-tooling-seed.js", "runtime/hf-tooling-seed.js"],
       ["dist/mlclaw-space-runtime.js", "runtime/mlclaw-space-runtime.js"],
       ["entrypoint.sh", "runtime/entrypoint.sh"],
-      ["hf-broker.scope.json", "runtime/hf-broker.scope.json"],
       ["openclaw.default.json", "runtime/openclaw.default.json"],
       ["scripts/configure-huggingface-model.mjs", "runtime/scripts/configure-huggingface-model.mjs"],
       ["scripts/configure-telegram.mjs", "runtime/scripts/configure-telegram.mjs"],
@@ -14965,6 +14961,9 @@ async function generateSpaceRepo(sourceDir, outDir, options = {}) {
   for (const [from, to] of copies) {
     await copyExisting(path13.join(sourceDir, from), path13.join(outDir, to));
   }
+  const hfLogoPng = await fs12.readFile(path13.join(sourceDir, "assets/hf-logo.png"));
+  await fs12.writeFile(path13.join(outDir, "assets/hf-logo.png.base64"), `${hfLogoPng.toString("base64")}
+`, "utf8");
   await fs12.writeFile(
     path13.join(outDir, "Dockerfile"),
     options.runtimeImage ? imageDockerfile(options.runtimeImage) : bundledDockerfile(),
@@ -14986,7 +14985,17 @@ RUN git init /src \\
   && git -C /src checkout --detach FETCH_HEAD \\
   && test "$(git -C /src rev-parse HEAD)" = "$BROKERKIT_VERSION" \\
   && cd /src \\
-  && GOWORK=off go build -trimpath -o /out/hf-broker ./brokers/huggingface/cmd/hf-broker
+  && GOWORK=off go build -trimpath -o /out/hf-broker ./brokers/huggingface/cmd/hf-broker \\
+  && /out/hf-broker policy render \\
+    --preset request-all-agent-operations \\
+    --client default \\
+    --profile-out /out/hf-broker.policy-profile.json \\
+    --output /out/hf-broker.scope.json \\
+    --manifest-out /out/hf-broker.policy-manifest.json \\
+  && /out/hf-broker doctor policy \\
+    --profile /out/hf-broker.policy-profile.json \\
+    --scope /out/hf-broker.scope.json \\
+    --manifest /out/hf-broker.policy-manifest.json
 
 FROM node:24-bookworm-slim AS brokerkit-plugin-build
 ARG BROKERKIT_VERSION
@@ -15024,12 +15033,14 @@ COPY --chown=node:node runtime/hf-state-sync.js /app/hf-state-sync.js
 COPY --chown=node:node runtime/hf-tooling-seed.js /app/hf-tooling-seed.js
 COPY --chown=node:node runtime/mlclaw-space-runtime.js /app/mlclaw-space-runtime.js
 COPY --from=hf-broker-build /out/hf-broker /usr/local/bin/hf-broker
-COPY runtime/hf-broker.scope.json /app/hf-broker.scope.json
+COPY --from=hf-broker-build /out/hf-broker.scope.json /app/hf-broker.scope.json
+COPY --from=hf-broker-build /out/hf-broker.policy-profile.json /app/hf-broker.policy-profile.json
+COPY --from=hf-broker-build /out/hf-broker.policy-manifest.json /app/hf-broker.policy-manifest.json
 COPY --chown=node:node runtime/openclaw.default.json /app/openclaw.default.json
 COPY --chown=node:node runtime/entrypoint.sh /app/entrypoint.sh
 COPY --chown=node:node runtime/scripts/ /app/scripts/
 COPY --chown=node:node assets/ /app/assets/
-RUN chmod +x /app/entrypoint.sh
+RUN base64 -d /app/assets/hf-logo.png.base64 > /app/assets/hf-logo.png   && rm /app/assets/hf-logo.png.base64   && chown node:node /app/assets/hf-logo.png   && chmod +x /app/entrypoint.sh
 
 ENV PORT=7860
 ENV MLCLAW_OPENCLAW_PORT=7861

package/entrypoint.sh

@@ -29,7 +29,9 @@ prepare_hf_broker() {
   local operator_brokers_file="$HF_BROKER_RUN_DIR/operator-brokers.json"
   local agent_secret operator_secret
 
-  install -d -m 0750 -o root -g hf-broker "$HF_BROKER_RUN_DIR"
+  # OpenClaw may traverse this directory only to its own 0600 credential file.
+  # It cannot list the directory or read any broker-owned credential.
+  install -d -m 0711 -o root -g hf-broker "$HF_BROKER_RUN_DIR"
   agent_secret="$(od -An -N48 -tx1 /dev/urandom | tr -d ' \n')"
   operator_secret="$(od -An -N48 -tx1 /dev/urandom | tr -d ' \n')"
   printf '%s\n' "$broker_token" > "$token_file"
@@ -39,6 +41,7 @@ prepare_hf_broker() {
   printf 'mlclaw-control = %s\n' "$operator_secret" > "$broker_operator_secrets"
   printf '{"version":1,"brokers":[{"id":"hf-broker","label":"Hugging Face","url":"http://127.0.0.1:7864","token_file":"%s"}]}\n' "$operator_secret_file" > "$operator_brokers_file"
   chown hf-broker:hf-broker "$token_file" "$broker_agent_secrets" "$broker_operator_secrets"
+  chown "$OPENCLAW_IDENTITY" "$agent_secret_file"
   chmod 0600 "$token_file" "$agent_secret_file" "$operator_secret_file" "$broker_agent_secrets" "$broker_operator_secrets" "$operator_brokers_file"
 
   if [ -z "${MLCLAW_STATE_MOUNT_DIR:-}" ]; then
@@ -65,6 +68,13 @@ restore_protected_state() {
   fi
   install -d -m 0700 -o root -g root "$PROTECTED_STATE_DIR/control"
   install -d -m 0700 -o hf-broker -g hf-broker "$HF_BROKER_STATE_DIR"
+  rm -rf -- \
+    "$HF_BROKER_STATE_DIR/grants" \
+    "$HF_BROKER_STATE_DIR/operations" \
+    "$HF_BROKER_STATE_DIR/plans"
+  rm -f -- \
+    "$HF_BROKER_STATE_DIR/grants.json" \
+    "$HF_BROKER_STATE_DIR/operations.json"
   chown -R root:root "$PROTECTED_STATE_DIR/control"
   chown -R hf-broker:hf-broker "$HF_BROKER_STATE_DIR"
   chmod 0710 "$PROTECTED_STATE_DIR"
@@ -77,12 +87,6 @@ start_hf_broker() {
   fi
 
   install -d -m 0700 -o hf-broker -g hf-broker "$HF_BROKER_STATE_DIR"
-  install -d -m 0700 -o hf-broker -g hf-broker "$HF_BROKER_STATE_DIR/grants"
-  if [ ! -e "$HF_BROKER_STATE_DIR/grants/grants.json" ]; then
-    printf '{"grants":[]}\n' > "$HF_BROKER_STATE_DIR/grants/grants.json"
-    chown hf-broker:hf-broker "$HF_BROKER_STATE_DIR/grants/grants.json"
-    chmod 0600 "$HF_BROKER_STATE_DIR/grants/grants.json"
-  fi
   chown -R hf-broker:hf-broker "$HF_BROKER_STATE_DIR"
   chmod 0700 "$HF_BROKER_STATE_DIR"
 

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "mlclaw",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "license": "MIT",
   "config": {
     "openclawVersion": "2026.7.1-beta.5",
-    "brokerkitVersion": "fcfc5f2304436d952b18e7c9583bb378d1952776",
+    "brokerkitVersion": "a2adf6e626bbd509605bb7c72a7f3a8b1c00f045",
     "brokerkitPluginVersion": "0.1.0",
     "runtimeImageRepository": "ghcr.io/osolmaz/mlclaw"
   },
@@ -30,7 +30,6 @@
     "dist/mlclaw-space-runtime.js",
     "Dockerfile",
     "entrypoint.sh",
-    "hf-broker.scope.json",
     "mlclaw.ps1",
     "mlclaw.sh",
     "LICENSE",
@@ -56,9 +55,9 @@
     "pack:check": "node scripts/check-package.mjs",
     "prepack": "npm run build",
     "check:secrets": "node scripts/check-secrets.mjs",
-    "format": "prettier --check eslint.config.mjs vitest.config.ts vitest.stryker.config.ts package.json README.md src/hf-state-sync/archive.ts src/hf-state-sync/cli.ts src/hf-state-sync/paths.ts src/hf-state-sync/prepare.ts src/hf-state-sync/stage-worker.ts src/hf-state-sync/supervise.ts src/mlclaw-space-runtime/delegated-brokerkit.ts src/mlclaw-space-runtime/operator-brokers.ts src/mlclaw-space-runtime/openclaw-config.ts src/mlclaw-space-runtime/app.ts src/mlclaw-space-runtime/config.ts src/mlclaw-space-runtime/openai-credentials.ts src/mlclaw-space-runtime/server.ts src/mlclaw-space-runtime/shell.ts src/mlclaw-control-ui/src/main.tsx src/mlclaw-control-ui/src/styles.css src/mlclaw-control-ui/src/components/ui/utils.ts src/mlclaw/git.ts test/hf-state-sync.archive.test.ts test/hf-state-sync.roundtrip.test.ts test/hf-state-sync.supervise.test.ts test/mlclaw.bundle.test.ts test/mlclaw.delegated-brokerkit.test.ts test/mlclaw.generate-space.test.ts test/mlclaw.operator-brokers.test.ts test/mlclaw.runtime-image.test.ts test/mlclaw.space-runtime.test.ts docs/operator-brokers-config.md",
-    "format:write": "prettier --write eslint.config.mjs vitest.config.ts vitest.stryker.config.ts package.json README.md src/hf-state-sync/archive.ts src/hf-state-sync/cli.ts src/hf-state-sync/paths.ts src/hf-state-sync/prepare.ts src/hf-state-sync/stage-worker.ts src/hf-state-sync/supervise.ts src/mlclaw-space-runtime/delegated-brokerkit.ts src/mlclaw-space-runtime/operator-brokers.ts src/mlclaw-space-runtime/openclaw-config.ts src/mlclaw-space-runtime/app.ts src/mlclaw-space-runtime/config.ts src/mlclaw-space-runtime/openai-credentials.ts src/mlclaw-space-runtime/server.ts src/mlclaw-space-runtime/shell.ts src/mlclaw-control-ui/src/main.tsx src/mlclaw-control-ui/src/styles.css src/mlclaw-control-ui/src/components/ui/utils.ts src/mlclaw/git.ts test/hf-state-sync.archive.test.ts test/hf-state-sync.roundtrip.test.ts test/hf-state-sync.supervise.test.ts test/mlclaw.bundle.test.ts test/mlclaw.delegated-brokerkit.test.ts test/mlclaw.generate-space.test.ts test/mlclaw.operator-brokers.test.ts test/mlclaw.runtime-image.test.ts test/mlclaw.space-runtime.test.ts docs/operator-brokers-config.md",
-    "lint": "eslint --max-warnings 0 src/mlclaw-space-runtime/delegated-brokerkit.ts src/mlclaw-space-runtime/operator-brokers.ts src/mlclaw-space-runtime/openclaw-config.ts",
+    "format": "prettier --check eslint.config.mjs vitest.config.ts vitest.stryker.config.ts package.json README.md src/hf-state-sync/archive.ts src/hf-state-sync/cli.ts src/hf-state-sync/paths.ts src/hf-state-sync/prepare.ts src/hf-state-sync/stage-worker.ts src/hf-state-sync/supervise.ts src/mlclaw-space-runtime/delegated-brokerkit.ts src/mlclaw-space-runtime/delegated-revisions.ts src/mlclaw-space-runtime/operator-brokers.ts src/mlclaw-space-runtime/openclaw-config.ts src/mlclaw-space-runtime/app.ts src/mlclaw-space-runtime/config.ts src/mlclaw-space-runtime/openai-credentials.ts src/mlclaw-space-runtime/server.ts src/mlclaw-space-runtime/shell.ts src/mlclaw-control-ui/src/main.tsx src/mlclaw-control-ui/src/styles.css src/mlclaw-control-ui/src/components/ui/utils.ts src/mlclaw/git.ts test/hf-state-sync.archive.test.ts test/hf-state-sync.roundtrip.test.ts test/hf-state-sync.supervise.test.ts test/mlclaw.bundle.test.ts test/mlclaw.delegated-brokerkit.test.ts test/mlclaw.generate-space.test.ts test/mlclaw.operator-brokers.test.ts test/mlclaw.runtime-image.test.ts test/mlclaw.space-runtime.test.ts docs/operator-brokers-config.md",
+    "format:write": "prettier --write eslint.config.mjs vitest.config.ts vitest.stryker.config.ts package.json README.md src/hf-state-sync/archive.ts src/hf-state-sync/cli.ts src/hf-state-sync/paths.ts src/hf-state-sync/prepare.ts src/hf-state-sync/stage-worker.ts src/hf-state-sync/supervise.ts src/mlclaw-space-runtime/delegated-brokerkit.ts src/mlclaw-space-runtime/delegated-revisions.ts src/mlclaw-space-runtime/operator-brokers.ts src/mlclaw-space-runtime/openclaw-config.ts src/mlclaw-space-runtime/app.ts src/mlclaw-space-runtime/config.ts src/mlclaw-space-runtime/openai-credentials.ts src/mlclaw-space-runtime/server.ts src/mlclaw-space-runtime/shell.ts src/mlclaw-control-ui/src/main.tsx src/mlclaw-control-ui/src/styles.css src/mlclaw-control-ui/src/components/ui/utils.ts src/mlclaw/git.ts test/hf-state-sync.archive.test.ts test/hf-state-sync.roundtrip.test.ts test/hf-state-sync.supervise.test.ts test/mlclaw.bundle.test.ts test/mlclaw.delegated-brokerkit.test.ts test/mlclaw.generate-space.test.ts test/mlclaw.operator-brokers.test.ts test/mlclaw.runtime-image.test.ts test/mlclaw.space-runtime.test.ts docs/operator-brokers-config.md",
+    "lint": "eslint --max-warnings 0 src/mlclaw-space-runtime/delegated-brokerkit.ts src/mlclaw-space-runtime/delegated-revisions.ts src/mlclaw-space-runtime/operator-brokers.ts src/mlclaw-space-runtime/openclaw-config.ts",
     "coverage": "vitest run --coverage",
     "dry": "slophammer-ts dry .",
     "mutate": "stryker run --dryRunOnly",

package/hf-broker.scope.json

@@ -1,38 +0,0 @@
-{
-  "rules": [
-    {
-      "id": "mlclaw-read-repositories",
-      "effect": "allow",
-      "clients": ["default"],
-      "operations": ["repo.list", "repo.metadata.read", "repo.contents.read", "git.fetch"],
-      "targets": [
-        {"kind": "repo", "type": "*", "owner": "*", "name": "*"}
-      ]
-    },
-    {
-      "id": "mlclaw-append-repositories",
-      "effect": "allow",
-      "clients": ["default"],
-      "operations": ["git.push.append"],
-      "targets": [
-        {"kind": "repo", "type": "*", "owner": "*", "name": "*"}
-      ]
-    },
-    {
-      "id": "mlclaw-request-protected-repository-writes",
-      "effect": "request",
-      "clients": ["default"],
-      "operations": ["git.push.force", "git.ref.delete", "git.tag.update"],
-      "targets": [
-        {"kind": "repo", "type": "*", "owner": "*", "name": "*"}
-      ],
-      "grant_policy": {
-        "default_minutes": 5,
-        "max_minutes": 60,
-        "request_ttl_minutes": 15,
-        "default_max_uses": 1,
-        "max_uses": 3
-      }
-    }
-  ]
-}