mlclaw 0.3.4 → 0.3.6

package/Dockerfile

@@ -2,7 +2,7 @@ ARG OPENCLAW_VERSION=2026.7.1
 ARG OPENCLAW_BASE_IMAGE=ghcr.io/openclaw/openclaw:${OPENCLAW_VERSION}
 ARG BROKERKIT_PLUGIN_VERSION=0.2.1
 ARG BROKERKIT_VERSION=hf-broker/v0.1.0
-ARG MLCLAW_RUNTIME_IMAGE=ghcr.io/osolmaz/mlclaw:0.3.4-openclaw-2026.7.1
+ARG MLCLAW_RUNTIME_IMAGE=ghcr.io/osolmaz/mlclaw:0.3.6-openclaw-2026.7.1
 
 FROM golang:1.26.5-bookworm AS hf-broker-build
 ARG BROKERKIT_VERSION
@@ -23,21 +23,6 @@ RUN git init /src \
     --scope /out/hf-broker.scope.json \
     --manifest /out/hf-broker.policy-manifest.json
 
-FROM node:24-bookworm-slim AS brokerkit-plugin-build
-ARG BROKERKIT_VERSION
-RUN apt-get update \
-  && apt-get install -y --no-install-recommends ca-certificates git \
-  && rm -rf /var/lib/apt/lists/* \
-  && git init /src \
-  && git -C /src fetch --depth=1 https://github.com/osolmaz/brokerkit.git "refs/tags/$BROKERKIT_VERSION:refs/tags/$BROKERKIT_VERSION" \
-  && git -C /src checkout --detach "$BROKERKIT_VERSION" \
-  && test "$(git -C /src rev-parse "refs/tags/$BROKERKIT_VERSION^{commit}")" = "$(git -C /src rev-parse HEAD)"
-WORKDIR /src
-RUN corepack enable \
-  && pnpm install --frozen-lockfile \
-  && pnpm --filter openclaw-brokerkit build \
-  && pnpm --filter openclaw-brokerkit pack --pack-destination /out
-
 # Stage 1: build the state-sync bundle so the runtime image needs no dev deps.
 FROM node:24-bookworm-slim AS sync-build
 WORKDIR /build
@@ -69,10 +54,8 @@ RUN python3 -m pip install --break-system-packages --no-cache-dir \
   "uv==0.11.28" \
   "hf-discover==1.3.7"
 ARG BROKERKIT_PLUGIN_VERSION
-COPY --from=brokerkit-plugin-build /out/openclaw-brokerkit-${BROKERKIT_PLUGIN_VERSION}.tgz /tmp/openclaw-brokerkit.tgz
 RUN npm install --omit=dev --omit=peer --no-audit --no-fund --prefix /opt/openclaw-plugins \
-  /tmp/openclaw-brokerkit.tgz \
-  && rm /tmp/openclaw-brokerkit.tgz \
+  "openclaw-brokerkit@${BROKERKIT_PLUGIN_VERSION}" \
   && test -f /opt/openclaw-plugins/node_modules/openclaw-brokerkit/openclaw.plugin.json
 
 COPY --from=sync-build /build/dist/hf-state-sync.js /app/hf-state-sync.js

package/README.md

@@ -86,12 +86,13 @@ Choose a Hugging Face Router model with `--model`:
 ```bash
 npx mlclaw@latest bootstrap \
   --name mlclaw \
-  --model huggingface/google/gemma-4-26B-A4B-it:deepinfra
+  --model huggingface/zai-org/GLM-5.2:fireworks-ai
 ```
 
 Recommended router-compatible options:
 
-- `huggingface/google/gemma-4-26B-A4B-it:deepinfra`: default quality target.
+- `huggingface/zai-org/GLM-5.2:fireworks-ai`: default long-context model with tool support.
+- `huggingface/google/gemma-4-26B-A4B-it:deepinfra`: lower-cost Gemma option with tool and structured-output support.
 - `huggingface/Qwen/Qwen3.6-35B-A3B:deepinfra`: strong Qwen 3.6 option with tool and structured-output support.
 - `huggingface/Qwen/Qwen3.6-27B:deepinfra`: live Qwen 3.6 option with tool and structured-output support.
 - `huggingface/zai-org/GLM-5.2:deepinfra`: long-context GLM option with tool and structured-output support.
@@ -102,10 +103,10 @@ Recommended router-compatible options:
 - `huggingface/deepseek-ai/DeepSeek-V4-Pro:deepinfra`: higher-quality long-context DeepSeek V4 option.
 - `huggingface/MiniMaxAI/MiniMax-M3:together`: long-context MiniMax option with tool and structured-output support.
 
-Fireworks alternatives are also included for GLM 5.2, Kimi K2.7 Code,
-GPT-OSS 120B and 20B, DeepSeek V4 Flash and Pro, and MiniMax M3. Use the
-provider suffix `:fireworks-ai`. The current Router catalog does not expose the
-Gemma 4 or Qwen 3.6 presets through Fireworks.
+Fireworks options are also included for Kimi K2.7 Code, GPT-OSS 120B and 20B,
+DeepSeek V4 Flash and Pro, and MiniMax M3. Use the provider suffix
+`:fireworks-ai`. The current Router catalog does not expose the Gemma 4 or Qwen
+3.6 presets through Fireworks.
 
 ## Optional Telegram
 
@@ -210,9 +211,9 @@ merges every BrokerKit-compatible backend configured in
 cancel, or revoke requests. The plugin registers the Gateway tab, while ML Claw
 serves the immutable packaged UI from its trusted HTTP boundary and gives it a
 small popover inside the Gateway. Administrators decide requests directly in
-the sandboxed popover when `MLCLAW_BROKERKIT_POPOVER_DECISIONS=true`; otherwise
-the popover remains read-only and decisions use the standalone protected page.
-Both flows use a renewable, short-lived, admin-bound browser token.
+the sandboxed popover by default. Set
+`MLCLAW_BROKERKIT_POPOVER_DECISIONS=false` only to make the popover read-only.
+The popover uses a renewable, short-lived, admin-bound browser token.
 Broker operator tokens remain in backend-only files and are never sent to the
 browser or OpenClaw. See
 [Operator Broker Configuration](docs/operator-brokers-config.md).

package/dist/mlclaw-space-runtime.js

@@ -129,16 +129,19 @@ function normalizeAssetRef(value, fallback) {
   return normalized;
 }
 
+// src/mlclaw-space-runtime/model-default.ts
+var DEFAULT_MODEL_ID = "zai-org/GLM-5.2";
+var DEFAULT_MODEL_PROVIDER = "fireworks-ai";
+var DEFAULT_MODEL = `huggingface/${DEFAULT_MODEL_ID}:${DEFAULT_MODEL_PROVIDER}`;
+
 // src/mlclaw-space-runtime/model-choices.ts
 var DEFAULT_ROUTER_PROVIDER = "deepinfra";
-var DEFAULT_ROUTER_MODEL_ID = "google/gemma-4-26B-A4B-it";
-var DEFAULT_MODEL = formatOpenClawModelRef(DEFAULT_ROUTER_MODEL_ID, DEFAULT_ROUTER_PROVIDER);
 var PRESET_MODEL_CHOICES = [
   freezeChoice({
     modelId: "google/gemma-4-26B-A4B-it",
     provider: "deepinfra",
     label: "Gemma 4 26B A4B",
-    note: "Default quality target on DeepInfra",
+    note: "Low-cost Gemma preset on DeepInfra",
     contextLength: 262144,
     pricing: { input: 0.07, output: 0.34 },
     supportsTools: true,
@@ -298,7 +301,7 @@ var PRESET_MODEL_CHOICES = [
     modelId: "zai-org/GLM-5.2",
     provider: "fireworks-ai",
     label: "GLM 5.2",
-    note: "Long-context GLM alternative on Fireworks",
+    note: "Default long-context GLM preset on Fireworks",
     contextLength: 1048576,
     pricing: { input: 1.4, output: 4.4 },
     supportsTools: true,
@@ -5106,7 +5109,7 @@ function loadConfig(env = process.env) {
     brokerAgentSecret: readOptionalSecret(trim(env.MLCLAW_HF_BROKER_AGENT_SECRET_FILE)),
     brokerAgentSecretFile: trim(env.MLCLAW_HF_BROKER_AGENT_SECRET_FILE),
     operatorBrokers: loadOperatorBrokers(trim(env.MLCLAW_OPERATOR_BROKERS_FILE)),
-    brokerKitPopoverDecisions: env.MLCLAW_BROKERKIT_POPOVER_DECISIONS === "1" || env.MLCLAW_BROKERKIT_POPOVER_DECISIONS === "true",
+    brokerKitPopoverDecisions: env.MLCLAW_BROKERKIT_POPOVER_DECISIONS !== "0" && env.MLCLAW_BROKERKIT_POPOVER_DECISIONS !== "false",
     hubUrl: trim(env.HF_ENDPOINT) ?? "https://huggingface.co",
     openaiCredentialFile: trim(env.MLCLAW_OPENAI_CREDENTIAL_FILE) ?? "/tmp/mlclaw-secrets/openai.env",
     openaiCredentialStoreFile,

package/dist/mlclaw.mjs

@@ -14997,12 +14997,6 @@ RUN git init /src \\
     --scope /out/hf-broker.scope.json \\
     --manifest /out/hf-broker.policy-manifest.json
 
-FROM node:24-bookworm-slim AS brokerkit-plugin-build
-ARG BROKERKIT_VERSION
-RUN apt-get update   && apt-get install -y --no-install-recommends ca-certificates git   && rm -rf /var/lib/apt/lists/*   && git init /src   && git -C /src fetch --depth=1 https://github.com/osolmaz/brokerkit.git "refs/tags/$BROKERKIT_VERSION:refs/tags/$BROKERKIT_VERSION"   && git -C /src checkout --detach "$BROKERKIT_VERSION"   && test "$(git -C /src rev-parse "refs/tags/$BROKERKIT_VERSION^{commit}")" = "$(git -C /src rev-parse HEAD)"
-WORKDIR /src
-RUN corepack enable   && pnpm install --frozen-lockfile   && pnpm --filter openclaw-brokerkit build   && pnpm --filter openclaw-brokerkit pack --pack-destination /out
-
 FROM ${OPENCLAW_BASE_IMAGE}
 
 LABEL org.opencontainers.image.source="https://github.com/osolmaz/mlclaw"
@@ -15026,8 +15020,7 @@ RUN python3 -m pip install --break-system-packages --no-cache-dir \\
   "uv==0.11.28" \\
   "hf-discover==1.3.7"
 ARG BROKERKIT_PLUGIN_VERSION
-COPY --from=brokerkit-plugin-build /out/openclaw-brokerkit-\${BROKERKIT_PLUGIN_VERSION}.tgz /tmp/openclaw-brokerkit.tgz
-RUN npm install --omit=dev --omit=peer --no-audit --no-fund --prefix /opt/openclaw-plugins   /tmp/openclaw-brokerkit.tgz   && rm /tmp/openclaw-brokerkit.tgz   && test -f /opt/openclaw-plugins/node_modules/openclaw-brokerkit/openclaw.plugin.json
+RUN npm install --omit=dev --omit=peer --no-audit --no-fund --prefix /opt/openclaw-plugins   "openclaw-brokerkit@\${BROKERKIT_PLUGIN_VERSION}"   && test -f /opt/openclaw-plugins/node_modules/openclaw-brokerkit/openclaw.plugin.json
 
 COPY --chown=node:node runtime/hf-state-sync.js /app/hf-state-sync.js
 COPY --chown=node:node runtime/hf-tooling-seed.js /app/hf-tooling-seed.js
@@ -15187,6 +15180,11 @@ async function assertNoLiveForeignLease(params) {
   );
 }
 
+// src/mlclaw-space-runtime/model-default.ts
+var DEFAULT_MODEL_ID = "zai-org/GLM-5.2";
+var DEFAULT_MODEL_PROVIDER = "fireworks-ai";
+var DEFAULT_MODEL = `huggingface/${DEFAULT_MODEL_ID}:${DEFAULT_MODEL_PROVIDER}`;
+
 // src/mlclaw/local-config.ts
 import fs13 from "node:fs/promises";
 import os5 from "node:os";
@@ -15326,7 +15324,7 @@ function delay(ms) {
 }
 
 // src/mlclaw/cli.ts
-var DEFAULT_MODEL = "huggingface/google/gemma-4-26B-A4B-it:deepinfra";
+var DEFAULT_MODEL2 = DEFAULT_MODEL;
 var DEFAULT_HARDWARE = "cpu-basic";
 var TELEGRAM_HARDWARE = "cpu-upgrade";
 var TELEGRAM_SLEEP_TIME = -1;
@@ -15374,7 +15372,7 @@ function createProgram(runtimeOverrides = {}) {
   program2.name("mlclaw").description("Deploy OpenClaw to a Hugging Face Space and private bucket").showHelpAfterError().exitOverride((err) => {
     throw err;
   });
-  program2.command("bootstrap", { isDefault: true }).description("Create or update a Hugging Face OpenClaw deployment").option("--owner <owner>", "Hugging Face user or organization").option("--name <name>", "Agent and runtime resource base name").option("--bucket <owner/bucket>", "State bucket to create or adopt").option("--gateway <local|space>", "Where the live gateway runs").option("--telegram-token <token>", "Optional Telegram bot token").option("--telegram-token-file <path>", "File containing TELEGRAM_BOT_TOKEN=... or a raw token").option("--telegram-user-id <id>", "Allowed Telegram user ID").option("--telegram-api-root <url>", "Telegram API root override").option("--telegram-proxy <url>", "Telegram proxy URL override").option("--hardware <flavor>", "Hugging Face Space hardware flavor").option("--sleep-time <seconds>", "Space sleep timeout in seconds; -1 means never sleep", parseInteger).option("--model <model>", "OpenClaw model identifier", DEFAULT_MODEL).option("--runtime-image <image>", "ML Claw runtime image").option("--bundled-runtime", "Generate a bundled Space runtime instead of using the prebuilt ML Claw image", false).option("--public-space", "Create the Hugging Face Space as public instead of private", false).addOption(new Option("--gateway-token <token>").hideHelp()).option("--router-token <token>", "Hugging Face Router inference token for Space gateway model calls").option("--router-token-file <path>", "File containing MLCLAW_ROUTER_TOKEN=..., HF_ROUTER_TOKEN=..., or a raw token").option("--docker-context <name>", "Docker context for local gateway mode").option("--no-pull", "Do not docker pull before starting a local gateway").option("--takeover", "Start even if a stale runtime lease is present", false).option("--yes", "Confirm paid hardware prompts for automation", false).action(async (opts) => {
+  program2.command("bootstrap", { isDefault: true }).description("Create or update a Hugging Face OpenClaw deployment").option("--owner <owner>", "Hugging Face user or organization").option("--name <name>", "Agent and runtime resource base name").option("--bucket <owner/bucket>", "State bucket to create or adopt").option("--gateway <local|space>", "Where the live gateway runs").option("--telegram-token <token>", "Optional Telegram bot token").option("--telegram-token-file <path>", "File containing TELEGRAM_BOT_TOKEN=... or a raw token").option("--telegram-user-id <id>", "Allowed Telegram user ID").option("--telegram-api-root <url>", "Telegram API root override").option("--telegram-proxy <url>", "Telegram proxy URL override").option("--hardware <flavor>", "Hugging Face Space hardware flavor").option("--sleep-time <seconds>", "Space sleep timeout in seconds; -1 means never sleep", parseInteger).option("--model <model>", "OpenClaw model identifier", DEFAULT_MODEL2).option("--runtime-image <image>", "ML Claw runtime image").option("--bundled-runtime", "Generate a bundled Space runtime instead of using the prebuilt ML Claw image", false).option("--public-space", "Create the Hugging Face Space as public instead of private", false).addOption(new Option("--gateway-token <token>").hideHelp()).option("--router-token <token>", "Hugging Face Router inference token for Space gateway model calls").option("--router-token-file <path>", "File containing MLCLAW_ROUTER_TOKEN=..., HF_ROUTER_TOKEN=..., or a raw token").option("--docker-context <name>", "Docker context for local gateway mode").option("--no-pull", "Do not docker pull before starting a local gateway").option("--takeover", "Start even if a stale runtime lease is present", false).option("--yes", "Confirm paid hardware prompts for automation", false).action(async (opts) => {
     await bootstrap(opts, runtime);
   });
   program2.command("update").description("Regenerate and upload current ML Claw Space files").argument("<owner/space>", "Hugging Face Space repo ID").option("--runtime-image <image>", "Runtime image to write into the generated Space Dockerfile").option("--bundled-runtime", "Generate a bundled Space runtime instead of using the prebuilt ML Claw image", false).option("--router-token <token>", "Dedicated Hugging Face Router inference token").option("--router-token-file <path>", "File containing MLCLAW_ROUTER_TOKEN=..., HF_ROUTER_TOKEN=..., or a raw token").option("--force", "Update even if the Space does not look like ML Claw", false).action(async (repoId, opts) => {
@@ -15445,7 +15443,7 @@ async function bootstrap(opts, runtime) {
   const bot = telegramToken ? await runtime.getTelegramBot(telegramToken, opts.telegramApiRoot) : void 0;
   let agentName = slugifyAgentName(opts.name ?? bot?.username ?? await promptAgentName(runtime));
   const telegramUserId = telegramToken ? opts.telegramUserId ?? runtime.env.TELEGRAM_ALLOWED_USERS ?? await promptRequired("Telegram allowed user ID", runtime) : void 0;
-  const model = opts.model ?? DEFAULT_MODEL;
+  const model = opts.model ?? DEFAULT_MODEL2;
   const runtimeImage = resolveRuntimeImage(opts.runtimeImage, runtime.env);
   const templateRuntimeImage = resolveSpaceRuntimeImage(opts, runtime.env);
   let plan;
@@ -16534,7 +16532,7 @@ async function update(repoId, opts, hub, hfToken, runtime) {
     await ensureUpdateRouterToken({
       repoId,
       agentName,
-      model: variables.get("OPENCLAW_MODEL")?.value ?? DEFAULT_MODEL,
+      model: variables.get("OPENCLAW_MODEL")?.value ?? DEFAULT_MODEL2,
       opts,
       hub,
       runtime
@@ -16706,7 +16704,7 @@ async function doctor(repoId, opts, hub, runtime) {
   }
   const staleTokenSecrets = ["HF_TOKEN", "HUGGINGFACE_HUB_TOKEN"].filter((key) => secrets.has(key));
   if (staleTokenSecrets.length > 0) {
-    const model = variables.get("OPENCLAW_MODEL")?.value ?? DEFAULT_MODEL;
+    const model = variables.get("OPENCLAW_MODEL")?.value ?? DEFAULT_MODEL2;
     const canDelete = canDeleteBroadTokenSecrets({
       model,
       routerTokenPresent: hasBrokerOrRouterTokenSecretMap(secrets)
@@ -17112,7 +17110,7 @@ export {
   DEFAULT_GATEWAY_LOCATION,
   DEFAULT_HARDWARE,
   DEFAULT_LOCAL_PORT,
-  DEFAULT_MODEL,
+  DEFAULT_MODEL2 as DEFAULT_MODEL,
   DEFAULT_SPACE_OPENCLAW_PORT,
   LOCAL_LIVE_DIR,
   LOCAL_VOLUME_MOUNT_PATH,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mlclaw",
-  "version": "0.3.4",
+  "version": "0.3.6",
   "license": "MIT",
   "config": {
     "openclawVersion": "2026.7.1",