mlclaw 0.3.1 → 0.3.4

package/dist/mlclaw.mjs

@@ -14836,18 +14836,15 @@ function sseDataToText(raw) {
 import fs11 from "node:fs";
 import path12 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-var DEFAULT_OPENCLAW_VERSION = "2026.7.1-beta.5";
-var DEFAULT_BROKERKIT_PLUGIN_VERSION = "0.1.0";
-var DEFAULT_BROKERKIT_VERSION = "fcfc5f2304436d952b18e7c9583bb378d1952776";
+var DEFAULT_OPENCLAW_VERSION = "2026.7.1";
+var DEFAULT_BROKERKIT_PLUGIN_VERSION = "0.2.1";
+var DEFAULT_BROKERKIT_VERSION = "hf-broker/v0.1.0";
 var DEFAULT_RUNTIME_IMAGE_REPOSITORY = "ghcr.io/osolmaz/mlclaw";
 var PACKAGE_METADATA = readPackageMetadata();
 var PACKAGE_VERSION = packageString("version", "unknown");
 var OPENCLAW_VERSION = packageConfigString("openclawVersion", DEFAULT_OPENCLAW_VERSION);
 var OPENCLAW_BASE_IMAGE = `ghcr.io/openclaw/openclaw:${OPENCLAW_VERSION}`;
-var BROKERKIT_PLUGIN_VERSION = packageConfigString(
-  "brokerkitPluginVersion",
-  DEFAULT_BROKERKIT_PLUGIN_VERSION
-);
+var BROKERKIT_PLUGIN_VERSION = packageConfigString("brokerkitPluginVersion", DEFAULT_BROKERKIT_PLUGIN_VERSION);
 var BROKERKIT_VERSION = packageConfigString("brokerkitVersion", DEFAULT_BROKERKIT_VERSION);
 var RUNTIME_IMAGE_REPOSITORY = packageConfigString("runtimeImageRepository", DEFAULT_RUNTIME_IMAGE_REPOSITORY);
 var DEFAULT_RUNTIME_IMAGE_TAG = `${PACKAGE_VERSION}-openclaw-${OPENCLAW_VERSION}`;
@@ -14955,7 +14952,6 @@ async function generateSpaceRepo(sourceDir, outDir, options = {}) {
       ["dist/hf-tooling-seed.js", "runtime/hf-tooling-seed.js"],
       ["dist/mlclaw-space-runtime.js", "runtime/mlclaw-space-runtime.js"],
       ["entrypoint.sh", "runtime/entrypoint.sh"],
-      ["hf-broker.scope.json", "runtime/hf-broker.scope.json"],
       ["openclaw.default.json", "runtime/openclaw.default.json"],
       ["scripts/configure-huggingface-model.mjs", "runtime/scripts/configure-huggingface-model.mjs"],
       ["scripts/configure-telegram.mjs", "runtime/scripts/configure-telegram.mjs"],
@@ -14965,6 +14961,9 @@ async function generateSpaceRepo(sourceDir, outDir, options = {}) {
   for (const [from, to] of copies) {
     await copyExisting(path13.join(sourceDir, from), path13.join(outDir, to));
   }
+  const hfLogoPng = await fs12.readFile(path13.join(sourceDir, "assets/hf-logo.png"));
+  await fs12.writeFile(path13.join(outDir, "assets/hf-logo.png.base64"), `${hfLogoPng.toString("base64")}
+`, "utf8");
   await fs12.writeFile(
     path13.join(outDir, "Dockerfile"),
     options.runtimeImage ? imageDockerfile(options.runtimeImage) : bundledDockerfile(),
@@ -14982,15 +14981,25 @@ ARG BROKERKIT_VERSION=${BROKERKIT_VERSION}
 FROM golang:1.26.5-bookworm AS hf-broker-build
 ARG BROKERKIT_VERSION
 RUN git init /src \\
-  && git -C /src fetch --depth=1 https://github.com/osolmaz/brokerkit.git "$BROKERKIT_VERSION" \\
-  && git -C /src checkout --detach FETCH_HEAD \\
-  && test "$(git -C /src rev-parse HEAD)" = "$BROKERKIT_VERSION" \\
+  && git -C /src fetch --depth=1 https://github.com/osolmaz/brokerkit.git "refs/tags/$BROKERKIT_VERSION:refs/tags/$BROKERKIT_VERSION" \\
+  && git -C /src checkout --detach "$BROKERKIT_VERSION" \\
+  && test "$(git -C /src rev-parse "refs/tags/$BROKERKIT_VERSION^{commit}")" = "$(git -C /src rev-parse HEAD)" \\
   && cd /src \\
-  && GOWORK=off go build -trimpath -o /out/hf-broker ./brokers/huggingface/cmd/hf-broker
+  && GOWORK=off go build -trimpath -o /out/hf-broker ./brokers/huggingface/cmd/hf-broker \\
+  && /out/hf-broker policy render \\
+    --preset request-all-agent-operations \\
+    --client default \\
+    --profile-out /out/hf-broker.policy-profile.json \\
+    --output /out/hf-broker.scope.json \\
+    --manifest-out /out/hf-broker.policy-manifest.json \\
+  && /out/hf-broker doctor policy \\
+    --profile /out/hf-broker.policy-profile.json \\
+    --scope /out/hf-broker.scope.json \\
+    --manifest /out/hf-broker.policy-manifest.json
 
 FROM node:24-bookworm-slim AS brokerkit-plugin-build
 ARG BROKERKIT_VERSION
-RUN apt-get update   && apt-get install -y --no-install-recommends ca-certificates git   && rm -rf /var/lib/apt/lists/*   && git init /src   && git -C /src fetch --depth=1 https://github.com/osolmaz/brokerkit.git "$BROKERKIT_VERSION"   && git -C /src checkout --detach FETCH_HEAD   && test "$(git -C /src rev-parse HEAD)" = "$BROKERKIT_VERSION"
+RUN apt-get update   && apt-get install -y --no-install-recommends ca-certificates git   && rm -rf /var/lib/apt/lists/*   && git init /src   && git -C /src fetch --depth=1 https://github.com/osolmaz/brokerkit.git "refs/tags/$BROKERKIT_VERSION:refs/tags/$BROKERKIT_VERSION"   && git -C /src checkout --detach "$BROKERKIT_VERSION"   && test "$(git -C /src rev-parse "refs/tags/$BROKERKIT_VERSION^{commit}")" = "$(git -C /src rev-parse HEAD)"
 WORKDIR /src
 RUN corepack enable   && pnpm install --frozen-lockfile   && pnpm --filter openclaw-brokerkit build   && pnpm --filter openclaw-brokerkit pack --pack-destination /out
 
@@ -15024,12 +15033,14 @@ COPY --chown=node:node runtime/hf-state-sync.js /app/hf-state-sync.js
 COPY --chown=node:node runtime/hf-tooling-seed.js /app/hf-tooling-seed.js
 COPY --chown=node:node runtime/mlclaw-space-runtime.js /app/mlclaw-space-runtime.js
 COPY --from=hf-broker-build /out/hf-broker /usr/local/bin/hf-broker
-COPY runtime/hf-broker.scope.json /app/hf-broker.scope.json
+COPY --from=hf-broker-build /out/hf-broker.scope.json /app/hf-broker.scope.json
+COPY --from=hf-broker-build /out/hf-broker.policy-profile.json /app/hf-broker.policy-profile.json
+COPY --from=hf-broker-build /out/hf-broker.policy-manifest.json /app/hf-broker.policy-manifest.json
 COPY --chown=node:node runtime/openclaw.default.json /app/openclaw.default.json
 COPY --chown=node:node runtime/entrypoint.sh /app/entrypoint.sh
 COPY --chown=node:node runtime/scripts/ /app/scripts/
 COPY --chown=node:node assets/ /app/assets/
-RUN chmod +x /app/entrypoint.sh
+RUN base64 -d /app/assets/hf-logo.png.base64 > /app/assets/hf-logo.png   && rm /app/assets/hf-logo.png.base64   && chown node:node /app/assets/hf-logo.png   && chmod +x /app/entrypoint.sh
 
 ENV PORT=7860
 ENV MLCLAW_OPENCLAW_PORT=7861

package/entrypoint.sh

@@ -29,7 +29,9 @@ prepare_hf_broker() {
   local operator_brokers_file="$HF_BROKER_RUN_DIR/operator-brokers.json"
   local agent_secret operator_secret
 
-  install -d -m 0750 -o root -g hf-broker "$HF_BROKER_RUN_DIR"
+  # OpenClaw may traverse this directory only to its own 0600 credential file.
+  # It cannot list the directory or read any broker-owned credential.
+  install -d -m 0711 -o root -g hf-broker "$HF_BROKER_RUN_DIR"
   agent_secret="$(od -An -N48 -tx1 /dev/urandom | tr -d ' \n')"
   operator_secret="$(od -An -N48 -tx1 /dev/urandom | tr -d ' \n')"
   printf '%s\n' "$broker_token" > "$token_file"
@@ -39,6 +41,7 @@ prepare_hf_broker() {
   printf 'mlclaw-control = %s\n' "$operator_secret" > "$broker_operator_secrets"
   printf '{"version":1,"brokers":[{"id":"hf-broker","label":"Hugging Face","url":"http://127.0.0.1:7864","token_file":"%s"}]}\n' "$operator_secret_file" > "$operator_brokers_file"
   chown hf-broker:hf-broker "$token_file" "$broker_agent_secrets" "$broker_operator_secrets"
+  chown "$OPENCLAW_IDENTITY" "$agent_secret_file"
   chmod 0600 "$token_file" "$agent_secret_file" "$operator_secret_file" "$broker_agent_secrets" "$broker_operator_secrets" "$operator_brokers_file"
 
   if [ -z "${MLCLAW_STATE_MOUNT_DIR:-}" ]; then
@@ -65,6 +68,13 @@ restore_protected_state() {
   fi
   install -d -m 0700 -o root -g root "$PROTECTED_STATE_DIR/control"
   install -d -m 0700 -o hf-broker -g hf-broker "$HF_BROKER_STATE_DIR"
+  rm -rf -- \
+    "$HF_BROKER_STATE_DIR/grants" \
+    "$HF_BROKER_STATE_DIR/operations" \
+    "$HF_BROKER_STATE_DIR/plans"
+  rm -f -- \
+    "$HF_BROKER_STATE_DIR/grants.json" \
+    "$HF_BROKER_STATE_DIR/operations.json"
   chown -R root:root "$PROTECTED_STATE_DIR/control"
   chown -R hf-broker:hf-broker "$HF_BROKER_STATE_DIR"
   chmod 0710 "$PROTECTED_STATE_DIR"
@@ -77,22 +87,14 @@ start_hf_broker() {
   fi
 
   install -d -m 0700 -o hf-broker -g hf-broker "$HF_BROKER_STATE_DIR"
-  install -d -m 0700 -o hf-broker -g hf-broker "$HF_BROKER_STATE_DIR/grants"
-  if [ ! -e "$HF_BROKER_STATE_DIR/grants/grants.json" ]; then
-    printf '{"grants":[]}\n' > "$HF_BROKER_STATE_DIR/grants/grants.json"
-    chown hf-broker:hf-broker "$HF_BROKER_STATE_DIR/grants/grants.json"
-    chmod 0600 "$HF_BROKER_STATE_DIR/grants/grants.json"
-  fi
   chown -R hf-broker:hf-broker "$HF_BROKER_STATE_DIR"
   chmod 0700 "$HF_BROKER_STATE_DIR"
 
   HF_BROKER_HF_TOKEN_FILE="$HF_BROKER_RUN_DIR/hf-token" \
   HF_BROKER_SECRETS_FILE="$HF_BROKER_RUN_DIR/agent-secrets.conf" \
   HF_BROKER_OPERATOR_SECRETS_FILE="$HF_BROKER_RUN_DIR/operator-secrets.conf" \
-  HF_BROKER_BIND_ADDR=127.0.0.1 \
-  HF_BROKER_PORT=7863 \
-  HF_BROKER_OPERATOR_BIND_ADDR=127.0.0.1 \
-  HF_BROKER_OPERATOR_PORT=7864 \
+  HF_BROKER_AGENT_ENDPOINT=tcp://127.0.0.1:7863 \
+  HF_BROKER_OPERATOR_ENDPOINT=tcp://127.0.0.1:7864 \
   HF_BROKER_SCOPE_FILE=/app/hf-broker.scope.json \
   HF_BROKER_STATE_DIR="$HF_BROKER_STATE_DIR" \
   gosu hf-broker:hf-broker /usr/local/bin/hf-broker &

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "mlclaw",
-  "version": "0.3.1",
+  "version": "0.3.4",
   "license": "MIT",
   "config": {
-    "openclawVersion": "2026.7.1-beta.5",
-    "brokerkitVersion": "fcfc5f2304436d952b18e7c9583bb378d1952776",
-    "brokerkitPluginVersion": "0.1.0",
+    "openclawVersion": "2026.7.1",
+    "brokerkitVersion": "hf-broker/v0.1.0",
+    "brokerkitPluginVersion": "0.2.1",
     "runtimeImageRepository": "ghcr.io/osolmaz/mlclaw"
   },
   "repository": {
@@ -30,7 +30,6 @@
     "dist/mlclaw-space-runtime.js",
     "Dockerfile",
     "entrypoint.sh",
-    "hf-broker.scope.json",
     "mlclaw.ps1",
     "mlclaw.sh",
     "LICENSE",
@@ -56,9 +55,9 @@
     "pack:check": "node scripts/check-package.mjs",
     "prepack": "npm run build",
     "check:secrets": "node scripts/check-secrets.mjs",
-    "format": "prettier --check eslint.config.mjs vitest.config.ts vitest.stryker.config.ts package.json README.md src/hf-state-sync/archive.ts src/hf-state-sync/cli.ts src/hf-state-sync/paths.ts src/hf-state-sync/prepare.ts src/hf-state-sync/stage-worker.ts src/hf-state-sync/supervise.ts src/mlclaw-space-runtime/delegated-brokerkit.ts src/mlclaw-space-runtime/operator-brokers.ts src/mlclaw-space-runtime/openclaw-config.ts src/mlclaw-space-runtime/app.ts src/mlclaw-space-runtime/config.ts src/mlclaw-space-runtime/openai-credentials.ts src/mlclaw-space-runtime/server.ts src/mlclaw-space-runtime/shell.ts src/mlclaw-control-ui/src/main.tsx src/mlclaw-control-ui/src/styles.css src/mlclaw-control-ui/src/components/ui/utils.ts src/mlclaw/git.ts test/hf-state-sync.archive.test.ts test/hf-state-sync.roundtrip.test.ts test/hf-state-sync.supervise.test.ts test/mlclaw.bundle.test.ts test/mlclaw.delegated-brokerkit.test.ts test/mlclaw.generate-space.test.ts test/mlclaw.operator-brokers.test.ts test/mlclaw.runtime-image.test.ts test/mlclaw.space-runtime.test.ts docs/operator-brokers-config.md",
-    "format:write": "prettier --write eslint.config.mjs vitest.config.ts vitest.stryker.config.ts package.json README.md src/hf-state-sync/archive.ts src/hf-state-sync/cli.ts src/hf-state-sync/paths.ts src/hf-state-sync/prepare.ts src/hf-state-sync/stage-worker.ts src/hf-state-sync/supervise.ts src/mlclaw-space-runtime/delegated-brokerkit.ts src/mlclaw-space-runtime/operator-brokers.ts src/mlclaw-space-runtime/openclaw-config.ts src/mlclaw-space-runtime/app.ts src/mlclaw-space-runtime/config.ts src/mlclaw-space-runtime/openai-credentials.ts src/mlclaw-space-runtime/server.ts src/mlclaw-space-runtime/shell.ts src/mlclaw-control-ui/src/main.tsx src/mlclaw-control-ui/src/styles.css src/mlclaw-control-ui/src/components/ui/utils.ts src/mlclaw/git.ts test/hf-state-sync.archive.test.ts test/hf-state-sync.roundtrip.test.ts test/hf-state-sync.supervise.test.ts test/mlclaw.bundle.test.ts test/mlclaw.delegated-brokerkit.test.ts test/mlclaw.generate-space.test.ts test/mlclaw.operator-brokers.test.ts test/mlclaw.runtime-image.test.ts test/mlclaw.space-runtime.test.ts docs/operator-brokers-config.md",
-    "lint": "eslint --max-warnings 0 src/mlclaw-space-runtime/delegated-brokerkit.ts src/mlclaw-space-runtime/operator-brokers.ts src/mlclaw-space-runtime/openclaw-config.ts",
+    "format": "prettier --check eslint.config.mjs vitest.config.ts vitest.stryker.config.ts package.json README.md src/hf-state-sync/archive.ts src/hf-state-sync/cli.ts src/hf-state-sync/paths.ts src/hf-state-sync/prepare.ts src/hf-state-sync/stage-worker.ts src/hf-state-sync/supervise.ts src/mlclaw-space-runtime/delegated-brokerkit.ts src/mlclaw-space-runtime/delegated-revisions.ts src/mlclaw-space-runtime/operator-brokers.ts src/mlclaw-space-runtime/openclaw-config.ts src/mlclaw-space-runtime/app.ts src/mlclaw-space-runtime/config.ts src/mlclaw-space-runtime/openai-credentials.ts src/mlclaw-space-runtime/server.ts src/mlclaw-space-runtime/shell.ts src/mlclaw-control-ui/src/main.tsx src/mlclaw-control-ui/src/styles.css src/mlclaw-control-ui/src/components/ui/utils.ts src/mlclaw/git.ts test/hf-state-sync.archive.test.ts test/hf-state-sync.roundtrip.test.ts test/hf-state-sync.supervise.test.ts test/mlclaw.brokerkit-agent-tools.test.ts test/mlclaw.bundle.test.ts test/mlclaw.delegated-brokerkit.test.ts test/mlclaw.generate-space.test.ts test/mlclaw.operator-brokers.test.ts test/mlclaw.runtime-image.test.ts test/mlclaw.space-runtime.test.ts docs/operator-brokers-config.md",
+    "format:write": "prettier --write eslint.config.mjs vitest.config.ts vitest.stryker.config.ts package.json README.md src/hf-state-sync/archive.ts src/hf-state-sync/cli.ts src/hf-state-sync/paths.ts src/hf-state-sync/prepare.ts src/hf-state-sync/stage-worker.ts src/hf-state-sync/supervise.ts src/mlclaw-space-runtime/delegated-brokerkit.ts src/mlclaw-space-runtime/delegated-revisions.ts src/mlclaw-space-runtime/operator-brokers.ts src/mlclaw-space-runtime/openclaw-config.ts src/mlclaw-space-runtime/app.ts src/mlclaw-space-runtime/config.ts src/mlclaw-space-runtime/openai-credentials.ts src/mlclaw-space-runtime/server.ts src/mlclaw-space-runtime/shell.ts src/mlclaw-control-ui/src/main.tsx src/mlclaw-control-ui/src/styles.css src/mlclaw-control-ui/src/components/ui/utils.ts src/mlclaw/git.ts test/hf-state-sync.archive.test.ts test/hf-state-sync.roundtrip.test.ts test/hf-state-sync.supervise.test.ts test/mlclaw.brokerkit-agent-tools.test.ts test/mlclaw.bundle.test.ts test/mlclaw.delegated-brokerkit.test.ts test/mlclaw.generate-space.test.ts test/mlclaw.operator-brokers.test.ts test/mlclaw.runtime-image.test.ts test/mlclaw.space-runtime.test.ts docs/operator-brokers-config.md",
+    "lint": "eslint --max-warnings 0 src/mlclaw-space-runtime/delegated-brokerkit.ts src/mlclaw-space-runtime/delegated-revisions.ts src/mlclaw-space-runtime/operator-brokers.ts src/mlclaw-space-runtime/openclaw-config.ts",
     "coverage": "vitest run --coverage",
     "dry": "slophammer-ts dry .",
     "mutate": "stryker run --dryRunOnly",

package/hf-broker.scope.json

@@ -1,38 +0,0 @@
-{
-  "rules": [
-    {
-      "id": "mlclaw-read-repositories",
-      "effect": "allow",
-      "clients": ["default"],
-      "operations": ["repo.list", "repo.metadata.read", "repo.contents.read", "git.fetch"],
-      "targets": [
-        {"kind": "repo", "type": "*", "owner": "*", "name": "*"}
-      ]
-    },
-    {
-      "id": "mlclaw-append-repositories",
-      "effect": "allow",
-      "clients": ["default"],
-      "operations": ["git.push.append"],
-      "targets": [
-        {"kind": "repo", "type": "*", "owner": "*", "name": "*"}
-      ]
-    },
-    {
-      "id": "mlclaw-request-protected-repository-writes",
-      "effect": "request",
-      "clients": ["default"],
-      "operations": ["git.push.force", "git.ref.delete", "git.tag.update"],
-      "targets": [
-        {"kind": "repo", "type": "*", "owner": "*", "name": "*"}
-      ],
-      "grant_policy": {
-        "default_minutes": 5,
-        "max_minutes": 60,
-        "request_ttl_minutes": 15,
-        "default_max_uses": 1,
-        "max_uses": 3
-      }
-    }
-  ]
-}