mlclaw 0.4.10 → 0.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (10) hide show
  1. package/.agents/skills/mlclaw/SKILL.md +14 -0
  2. package/Dockerfile +3 -2
  3. package/README.md +35 -2
  4. package/assets/hf-tooling/manifest.json +9 -0
  5. package/assets/hf-tooling/skills/hf-broker/SKILL.md +126 -0
  6. package/dist/hf-tooling-seed.js +17 -0
  7. package/dist/mlclaw-space-runtime.js +6029 -301
  8. package/dist/mlclaw.mjs +698 -18
  9. package/entrypoint.sh +33 -1
  10. package/package.json +5 -5
package/entrypoint.sh CHANGED
@@ -9,6 +9,8 @@ export MLCLAW_OPENCLAW_UID="$OPENCLAW_UID"
9
9
  export MLCLAW_OPENCLAW_GID="$OPENCLAW_GID"
10
10
  HF_BROKER_ENABLED=0
11
11
  HF_BROKER_RUN_DIR="/run/mlclaw-hf-broker"
12
+ HF_BROKER_POLICY_DIR="$HF_BROKER_RUN_DIR/policy"
13
+ HF_BROKER_SCOPE_FILE="$HF_BROKER_POLICY_DIR/scope.json"
12
14
  STATE_HF_TOKEN=""
13
15
  RESTORED_PROTECTED_STATE_DIR="$LIVE_DIR/.mlclaw-protected"
14
16
  PROTECTED_STATE_DIR="/var/lib/mlclaw-protected"
@@ -50,6 +52,8 @@ prepare_hf_broker() {
50
52
 
51
53
  export MLCLAW_HF_BROKER_URL="http://127.0.0.1:7863"
52
54
  export MLCLAW_HF_BROKER_AGENT_SECRET_FILE="$agent_secret_file"
55
+ export HF_BROKER_AGENT_ENDPOINT="tcp://127.0.0.1:7863"
56
+ export HF_BROKER_SHARED_SECRET_FILE="$agent_secret_file"
53
57
  if [ "${MLCLAW_GATEWAY_LOCATION:-}" = "local" ]; then
54
58
  export MLCLAW_TRUSTED_HF_TOKEN_FILE="$token_file"
55
59
  fi
@@ -81,6 +85,32 @@ restore_protected_state() {
81
85
  chmod 0700 "$PROTECTED_STATE_DIR/control" "$HF_BROKER_STATE_DIR"
82
86
  }
83
87
 
88
+ render_hf_broker_policy() {
89
+ if [ "$HF_BROKER_ENABLED" != "1" ]; then
90
+ return
91
+ fi
92
+
93
+ local state_bucket="${OPENCLAW_HF_STATE_BUCKET:-}"
94
+ local protected_target=()
95
+ if [ -n "$state_bucket" ]; then
96
+ protected_target=(--protect-bucket "$state_bucket")
97
+ fi
98
+
99
+ install -d -m 0700 -o hf-broker -g hf-broker "$HF_BROKER_POLICY_DIR"
100
+ gosu hf-broker:hf-broker /usr/local/bin/hf-broker policy render \
101
+ --preset request-all-agent-operations \
102
+ --client default \
103
+ --profile-out "$HF_BROKER_POLICY_DIR/profile.json" \
104
+ --output "$HF_BROKER_SCOPE_FILE" \
105
+ --manifest-out "$HF_BROKER_POLICY_DIR/manifest.json" \
106
+ --replace \
107
+ "${protected_target[@]}"
108
+ gosu hf-broker:hf-broker /usr/local/bin/hf-broker doctor policy \
109
+ --profile "$HF_BROKER_POLICY_DIR/profile.json" \
110
+ --scope "$HF_BROKER_SCOPE_FILE" \
111
+ --manifest "$HF_BROKER_POLICY_DIR/manifest.json"
112
+ }
113
+
84
114
  start_hf_broker() {
85
115
  if [ "$HF_BROKER_ENABLED" != "1" ]; then
86
116
  return
@@ -95,7 +125,8 @@ start_hf_broker() {
95
125
  HF_BROKER_OPERATOR_SECRETS_FILE="$HF_BROKER_RUN_DIR/operator-secrets.conf" \
96
126
  HF_BROKER_AGENT_ENDPOINT=tcp://127.0.0.1:7863 \
97
127
  HF_BROKER_OPERATOR_ENDPOINT=tcp://127.0.0.1:7864 \
98
- HF_BROKER_SCOPE_FILE=/app/hf-broker.scope.json \
128
+ HF_BROKER_SCOPE_FILE="$HF_BROKER_SCOPE_FILE" \
129
+ HF_BROKER_XET_PYTHON=/usr/bin/python3 \
99
130
  HF_BROKER_STATE_DIR="$HF_BROKER_STATE_DIR" \
100
131
  gosu hf-broker:hf-broker /usr/local/bin/hf-broker &
101
132
  HF_BROKER_PID=$!
@@ -172,6 +203,7 @@ mkdir -p "$LIVE_DIR" "$WORKSPACE_DIR" "$STATE_DIR"
172
203
  chown_openclaw_live
173
204
  install -d -m 0710 -o root -g hf-broker "$PROTECTED_STATE_DIR"
174
205
  install -d -m 0700 -o root -g root "$PROTECTED_STATE_DIR/control"
206
+ render_hf_broker_policy
175
207
  start_hf_broker
176
208
 
177
209
  if [ -n "${OPENCLAW_AGENT_NAME:-}" ]; then
package/package.json CHANGED
@@ -1,10 +1,10 @@
1
1
  {
2
2
  "name": "mlclaw",
3
- "version": "0.4.10",
3
+ "version": "0.6.0",
4
4
  "license": "MIT",
5
5
  "config": {
6
6
  "openclawVersion": "2026.7.1",
7
- "brokerkitVersion": "hf-broker/v0.5.2",
7
+ "brokerkitVersion": "hf-broker/v0.6.2",
8
8
  "brokerkitPluginVersion": "0.4.1",
9
9
  "runtimeImageRepository": "ghcr.io/huggingface/mlclaw"
10
10
  },
@@ -55,9 +55,9 @@
55
55
  "pack:check": "node scripts/check-package.mjs",
56
56
  "prepack": "npm run build",
57
57
  "check:secrets": "node scripts/check-secrets.mjs",
58
- "format": "prettier --check eslint.config.mjs vitest.config.ts vitest.stryker.config.ts package.json README.md scripts/sync-release-config.mjs src/hf-state-sync/archive.ts src/hf-state-sync/cli.ts src/hf-state-sync/paths.ts src/hf-state-sync/prepare.ts src/hf-state-sync/stage-worker.ts src/hf-state-sync/supervise.ts src/mlclaw/auth.ts src/mlclaw/cli.ts src/mlclaw/deployment-state.ts src/mlclaw/docker.ts src/mlclaw/hf-broker-credential.ts src/mlclaw/hf-cli.ts src/mlclaw/hub-api.ts src/mlclaw/local-config.ts src/mlclaw/tailscale.ts src/mlclaw-space-runtime/delegated-brokerkit.ts src/mlclaw-space-runtime/delegated-revisions.ts src/mlclaw-space-runtime/operator-brokers.ts src/mlclaw-space-runtime/openclaw-config.ts src/mlclaw-space-runtime/app.ts src/mlclaw-space-runtime/config.ts src/mlclaw-space-runtime/local-access.ts src/mlclaw-space-runtime/openai-credentials.ts src/mlclaw-space-runtime/proxy.ts src/mlclaw-space-runtime/server.ts src/mlclaw-space-runtime/session.ts src/mlclaw-space-runtime/shell.ts src/mlclaw-control-ui/src/main.tsx src/mlclaw-control-ui/src/styles.css src/mlclaw-control-ui/src/components/ui/utils.ts src/mlclaw/git.ts test/hf-state-sync.archive.test.ts test/hf-state-sync.roundtrip.test.ts test/hf-state-sync.supervise.test.ts test/mlclaw.auth.test.ts test/mlclaw.brokerkit-agent-tools.test.ts test/mlclaw.bundle.test.ts test/mlclaw.cli.test.ts test/mlclaw.delegated-brokerkit.test.ts test/mlclaw.deployment-state.test.ts test/mlclaw.docker.test.ts test/mlclaw.generate-space.test.ts test/mlclaw.hf-broker-credential.test.ts test/mlclaw.hub-api.test.ts test/mlclaw.local-config.test.ts test/mlclaw.operator-brokers.test.ts test/mlclaw.runtime-image.test.ts test/mlclaw.space-runtime.test.ts test/mlclaw.tailscale.test.ts docs/operator-brokers-config.md",
59
- "format:write": "prettier --write eslint.config.mjs vitest.config.ts vitest.stryker.config.ts package.json README.md scripts/sync-release-config.mjs src/hf-state-sync/archive.ts src/hf-state-sync/cli.ts src/hf-state-sync/paths.ts src/hf-state-sync/prepare.ts src/hf-state-sync/stage-worker.ts src/hf-state-sync/supervise.ts src/mlclaw/auth.ts src/mlclaw/cli.ts src/mlclaw/deployment-state.ts src/mlclaw/docker.ts src/mlclaw/hf-broker-credential.ts src/mlclaw/hf-cli.ts src/mlclaw/hub-api.ts src/mlclaw/local-config.ts src/mlclaw/tailscale.ts src/mlclaw-space-runtime/delegated-brokerkit.ts src/mlclaw-space-runtime/delegated-revisions.ts src/mlclaw-space-runtime/operator-brokers.ts src/mlclaw-space-runtime/openclaw-config.ts src/mlclaw-space-runtime/app.ts src/mlclaw-space-runtime/config.ts src/mlclaw-space-runtime/local-access.ts src/mlclaw-space-runtime/openai-credentials.ts src/mlclaw-space-runtime/proxy.ts src/mlclaw-space-runtime/server.ts src/mlclaw-space-runtime/session.ts src/mlclaw-space-runtime/shell.ts src/mlclaw-control-ui/src/main.tsx src/mlclaw-control-ui/src/styles.css src/mlclaw-control-ui/src/components/ui/utils.ts src/mlclaw/git.ts test/hf-state-sync.archive.test.ts test/hf-state-sync.roundtrip.test.ts test/hf-state-sync.supervise.test.ts test/mlclaw.auth.test.ts test/mlclaw.brokerkit-agent-tools.test.ts test/mlclaw.bundle.test.ts test/mlclaw.cli.test.ts test/mlclaw.delegated-brokerkit.test.ts test/mlclaw.deployment-state.test.ts test/mlclaw.docker.test.ts test/mlclaw.generate-space.test.ts test/mlclaw.hf-broker-credential.test.ts test/mlclaw.hub-api.test.ts test/mlclaw.local-config.test.ts test/mlclaw.operator-brokers.test.ts test/mlclaw.runtime-image.test.ts test/mlclaw.space-runtime.test.ts test/mlclaw.tailscale.test.ts docs/operator-brokers-config.md",
60
- "lint": "eslint --max-warnings 0 src/mlclaw-space-runtime/delegated-brokerkit.ts src/mlclaw-space-runtime/delegated-revisions.ts src/mlclaw-space-runtime/operator-brokers.ts src/mlclaw-space-runtime/openclaw-config.ts",
58
+ "format": "prettier --check eslint.config.mjs vitest.config.ts vitest.stryker.config.ts package.json README.md scripts/sync-release-config.mjs src/hf-state-sync/archive.ts src/hf-state-sync/cli.ts src/hf-state-sync/paths.ts src/hf-state-sync/prepare.ts src/hf-state-sync/stage-worker.ts src/hf-state-sync/supervise.ts src/mlclaw/auth.ts src/mlclaw/cli.ts src/mlclaw/codex-auth.ts src/mlclaw/openai-codex-device-auth.ts src/mlclaw/deployment-state.ts src/mlclaw/docker.ts src/mlclaw/hf-broker-credential.ts src/mlclaw/hf-cli.ts src/mlclaw/hub-api.ts src/mlclaw/local-config.ts src/mlclaw/tailscale.ts src/mlclaw-space-runtime/codex-credentials.ts src/mlclaw-space-runtime/openai-models.ts src/mlclaw-space-runtime/openclaw-oauth-profile.ts src/mlclaw-space-runtime/openclaw-state-migration.ts src/mlclaw-space-runtime/delegated-brokerkit.ts src/mlclaw-space-runtime/delegated-revisions.ts src/mlclaw-space-runtime/operator-brokers.ts src/mlclaw-space-runtime/openclaw-config.ts src/mlclaw-space-runtime/app.ts src/mlclaw-space-runtime/config.ts src/mlclaw-space-runtime/local-access.ts src/mlclaw-space-runtime/mcp-integrations.ts src/mlclaw-space-runtime/openai-credentials.ts src/mlclaw-space-runtime/proxy.ts src/mlclaw-space-runtime/server.ts src/mlclaw-space-runtime/session.ts src/mlclaw-space-runtime/shell.ts src/mlclaw-control-ui/src/main.tsx src/mlclaw-control-ui/src/styles.css src/mlclaw-control-ui/src/components/ui/utils.ts src/mlclaw/git.ts test/hf-state-sync.archive.test.ts test/hf-state-sync.roundtrip.test.ts test/hf-state-sync.supervise.test.ts test/mlclaw.auth.test.ts test/mlclaw.brokerkit-agent-tools.test.ts test/mlclaw.bundle.test.ts test/mlclaw.cli.test.ts test/mlclaw.codex-credentials.test.ts test/mlclaw.delegated-brokerkit.test.ts test/mlclaw.deployment-state.test.ts test/mlclaw.docker.test.ts test/mlclaw.generate-space.test.ts test/mlclaw.hf-broker-credential.test.ts test/mlclaw.hub-api.test.ts test/mlclaw.local-config.test.ts test/mlclaw.openai-codex-device-auth.test.ts test/mlclaw.openclaw-oauth-profile.test.ts test/mlclaw.openclaw-state-migration.test.ts test/mlclaw.operator-brokers.test.ts test/mlclaw.runtime-image.test.ts test/mlclaw.space-runtime.test.ts test/mlclaw.tailscale.test.ts docs/operator-brokers-config.md",
59
+ "format:write": "prettier --write eslint.config.mjs vitest.config.ts vitest.stryker.config.ts package.json README.md scripts/sync-release-config.mjs src/hf-state-sync/archive.ts src/hf-state-sync/cli.ts src/hf-state-sync/paths.ts src/hf-state-sync/prepare.ts src/hf-state-sync/stage-worker.ts src/hf-state-sync/supervise.ts src/mlclaw/auth.ts src/mlclaw/cli.ts src/mlclaw/codex-auth.ts src/mlclaw/openai-codex-device-auth.ts src/mlclaw/deployment-state.ts src/mlclaw/docker.ts src/mlclaw/hf-broker-credential.ts src/mlclaw/hf-cli.ts src/mlclaw/hub-api.ts src/mlclaw/local-config.ts src/mlclaw/tailscale.ts src/mlclaw-space-runtime/codex-credentials.ts src/mlclaw-space-runtime/openai-models.ts src/mlclaw-space-runtime/openclaw-oauth-profile.ts src/mlclaw-space-runtime/openclaw-state-migration.ts src/mlclaw-space-runtime/delegated-brokerkit.ts src/mlclaw-space-runtime/delegated-revisions.ts src/mlclaw-space-runtime/operator-brokers.ts src/mlclaw-space-runtime/openclaw-config.ts src/mlclaw-space-runtime/app.ts src/mlclaw-space-runtime/config.ts src/mlclaw-space-runtime/local-access.ts src/mlclaw-space-runtime/mcp-integrations.ts src/mlclaw-space-runtime/openai-credentials.ts src/mlclaw-space-runtime/proxy.ts src/mlclaw-space-runtime/server.ts src/mlclaw-space-runtime/session.ts src/mlclaw-space-runtime/shell.ts src/mlclaw-control-ui/src/main.tsx src/mlclaw-control-ui/src/styles.css src/mlclaw-control-ui/src/components/ui/utils.ts src/mlclaw/git.ts test/hf-state-sync.archive.test.ts test/hf-state-sync.roundtrip.test.ts test/hf-state-sync.supervise.test.ts test/mlclaw.auth.test.ts test/mlclaw.brokerkit-agent-tools.test.ts test/mlclaw.bundle.test.ts test/mlclaw.cli.test.ts test/mlclaw.codex-credentials.test.ts test/mlclaw.delegated-brokerkit.test.ts test/mlclaw.deployment-state.test.ts test/mlclaw.docker.test.ts test/mlclaw.generate-space.test.ts test/mlclaw.hf-broker-credential.test.ts test/mlclaw.hub-api.test.ts test/mlclaw.local-config.test.ts test/mlclaw.openai-codex-device-auth.test.ts test/mlclaw.openclaw-oauth-profile.test.ts test/mlclaw.openclaw-state-migration.test.ts test/mlclaw.operator-brokers.test.ts test/mlclaw.runtime-image.test.ts test/mlclaw.space-runtime.test.ts test/mlclaw.tailscale.test.ts docs/operator-brokers-config.md",
60
+ "lint": "eslint --max-warnings 0 src/mlclaw-space-runtime/codex-credentials.ts src/mlclaw-space-runtime/openai-models.ts src/mlclaw-space-runtime/openclaw-oauth-profile.ts src/mlclaw-space-runtime/openclaw-state-migration.ts src/mlclaw-space-runtime/delegated-brokerkit.ts src/mlclaw-space-runtime/delegated-revisions.ts src/mlclaw-space-runtime/operator-brokers.ts src/mlclaw-space-runtime/openclaw-config.ts",
61
61
  "coverage": "vitest run --coverage",
62
62
  "dry": "slophammer-ts dry .",
63
63
  "mutate": "stryker run --dryRunOnly",