mlclaw 0.4.4 → 0.4.6

package/.agents/skills/mlclaw/SKILL.md

@@ -25,7 +25,7 @@ An ML Claw deployment has:
 - no explicit Space hardware request by default; Hugging Face assigns the
   default free CPU hardware unless `--hardware` or a feature requiring paid
   hardware is used;
-- a prebuilt `ghcr.io/osolmaz/mlclaw` runtime image by default;
+- a prebuilt `ghcr.io/huggingface/mlclaw` runtime image by default;
 - Hugging Face OAuth enabled on the Space;
 - automatic Hugging Face MCP and Research Agent integrations authorized by an
   admin-only OAuth step after ordinary Hugging Face sign-in;
@@ -126,7 +126,7 @@ Hugging Face account. The Space server proxies authenticated browser traffic to
 OpenClaw on loopback using trusted-proxy auth. Do not ask the user for an
 OpenClaw gateway token for the browser Space path.
 
-Generated Spaces use the prebuilt `ghcr.io/osolmaz/mlclaw:<package>-openclaw-<version>`
+Generated Spaces use the prebuilt `ghcr.io/huggingface/mlclaw:<package>-openclaw-<version>`
 image by default. Use `--bundled-runtime` only for development or emergency
 fallbacks where the Space must build all runtime files directly from the
 uploaded Space repository.

package/Dockerfile

@@ -1,8 +1,8 @@
 ARG OPENCLAW_VERSION=2026.7.1
 ARG OPENCLAW_BASE_IMAGE=ghcr.io/openclaw/openclaw:${OPENCLAW_VERSION}
-ARG BROKERKIT_PLUGIN_VERSION=0.3.1
+ARG BROKERKIT_PLUGIN_VERSION=0.3.2
 ARG BROKERKIT_VERSION=hf-broker/v0.4.0
-ARG MLCLAW_RUNTIME_IMAGE=ghcr.io/osolmaz/mlclaw:0.4.4-openclaw-2026.7.1
+ARG MLCLAW_RUNTIME_IMAGE=ghcr.io/huggingface/mlclaw:0.4.6-openclaw-2026.7.1
 
 FROM golang:1.26.5-bookworm AS hf-broker-build
 ARG BROKERKIT_VERSION
@@ -32,7 +32,7 @@ RUN npm ci --no-audit --no-fund && npm run build
 
 FROM ${OPENCLAW_BASE_IMAGE}
 
-LABEL org.opencontainers.image.source="https://github.com/osolmaz/mlclaw"
+LABEL org.opencontainers.image.source="https://github.com/huggingface/mlclaw"
 LABEL org.opencontainers.image.description="ML Claw runtime for OpenClaw on Hugging Face"
 
 USER root

package/README.md

@@ -8,6 +8,10 @@ ML Claw deploys an OpenClaw agent on Hugging Face with durable state in a
 private Storage Bucket. The default deployment is a private Hugging Face Space
 with a browser gateway protected by Hugging Face OAuth.
 
+[ml-intern](https://github.com/huggingface/ml-intern) is Hugging Face's
+open-source ML engineer for reading papers, training models, and shipping
+models.
+
 The browser never receives an OpenClaw gateway token. ML Claw authenticates the
 signed-in Hugging Face user, then proxies HTTP and WebSocket traffic to
 OpenClaw on loopback using OpenClaw trusted-proxy auth.
@@ -76,7 +80,7 @@ This creates:
 - a private Docker Space for the browser gateway when the account can host it;
 - a private Storage Bucket for OpenClaw state after the Space is accepted;
 - no explicit Space hardware request unless you pass `--hardware`;
-- a Docker Space that starts from the prebuilt `ghcr.io/osolmaz/mlclaw` image;
+- a Docker Space that starts from the prebuilt `ghcr.io/huggingface/mlclaw` image;
 - Hugging Face OAuth metadata for browser auth, Hugging Face MCP, and Research
   Agent access in the Space README;
 - Space variables, a bucket volume mount for state sync, and separate
@@ -386,12 +390,6 @@ Local gateways pass the broad credential only to the trusted state-sync
 supervisor for bucket I/O and to the trusted MCP integration proxy through a
 protected token file. Neither path passes it to OpenClaw.
 
-## Related
-
-[ml-intern](https://github.com/huggingface/ml-intern) is Hugging Face's
-open-source ML engineer for reading papers, training models, and shipping
-models.
-
 ## Costs
 
 - Browser Space gateway: `cpu-basic` is enough for the default browser gateway.

package/dist/mlclaw-space-runtime.js

@@ -10348,6 +10348,7 @@ function safeErrorClass(error) {
 }
 function delegatedHeaders(c) {
   c.header("access-control-allow-origin", "null");
+  c.header("access-control-allow-credentials", "true");
   c.header("cache-control", "no-store");
   c.header("vary", "origin");
   c.header("x-content-type-options", "nosniff");

package/dist/mlclaw.mjs

@@ -15375,9 +15375,9 @@ import fs12 from "node:fs";
 import path13 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var DEFAULT_OPENCLAW_VERSION = "2026.7.1";
-var DEFAULT_BROKERKIT_PLUGIN_VERSION = "0.3.1";
+var DEFAULT_BROKERKIT_PLUGIN_VERSION = "0.3.2";
 var DEFAULT_BROKERKIT_VERSION = "hf-broker/v0.4.0";
-var DEFAULT_RUNTIME_IMAGE_REPOSITORY = "ghcr.io/osolmaz/mlclaw";
+var DEFAULT_RUNTIME_IMAGE_REPOSITORY = "ghcr.io/huggingface/mlclaw";
 var PACKAGE_METADATA = readPackageMetadata();
 var PACKAGE_VERSION = packageString("version", "unknown");
 var OPENCLAW_VERSION = packageConfigString("openclawVersion", DEFAULT_OPENCLAW_VERSION);

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "mlclaw",
-  "version": "0.4.4",
+  "version": "0.4.6",
   "license": "MIT",
   "config": {
     "openclawVersion": "2026.7.1",
     "brokerkitVersion": "hf-broker/v0.4.0",
-    "brokerkitPluginVersion": "0.3.1",
-    "runtimeImageRepository": "ghcr.io/osolmaz/mlclaw"
+    "brokerkitPluginVersion": "0.3.2",
+    "runtimeImageRepository": "ghcr.io/huggingface/mlclaw"
   },
   "repository": {
     "type": "git",