mlclaw 0.5.0 → 0.6.0

package/.agents/skills/mlclaw/SKILL.md

@@ -290,6 +290,20 @@ settings to set a Space Secret; do not put the user's broad Hub token into the
 Space just so the browser app can mutate secrets. The key must never be logged
 or returned to the browser.
 
+Deployment-scoped ChatGPT login uses OpenAI's Codex device-code protocol
+directly and does not require the Codex CLI:
+
+```bash
+mlclaw credentials codex login <agent>
+```
+
+After login, ML Claw imports the deployment credential into a managed native
+OpenClaw OAuth profile. OpenClaw contacts OpenAI directly, refreshes the OAuth
+credential in its private auth store, and discovers the account-visible catalog
+under `openai/*`, including `openai/gpt-5.6-sol` when entitled. ML Claw does not
+proxy model discovery or inference. Normal `OPENAI_API_KEY` profiles continue
+to use the OpenAI Platform route.
+
 ## Branding
 
 ML Claw white-labels the browser gateway at the proxy layer. App Spaces default

package/Dockerfile

@@ -2,7 +2,7 @@ ARG OPENCLAW_VERSION=2026.7.1
 ARG OPENCLAW_BASE_IMAGE=ghcr.io/openclaw/openclaw:${OPENCLAW_VERSION}
 ARG BROKERKIT_PLUGIN_VERSION=0.4.1
 ARG BROKERKIT_VERSION=hf-broker/v0.6.2
-ARG MLCLAW_RUNTIME_IMAGE=ghcr.io/huggingface/mlclaw:0.5.0-openclaw-2026.7.1
+ARG MLCLAW_RUNTIME_IMAGE=ghcr.io/huggingface/mlclaw:0.6.0-openclaw-2026.7.1
 
 FROM golang:1.26.5-bookworm AS hf-broker-build
 ARG BROKERKIT_VERSION

package/README.md

@@ -371,6 +371,32 @@ never returned to the browser, exposed to the agent except as its intended
 OpenAI credential, or stored as plaintext in the state bucket. App Spaces do
 not keep broad Hugging Face authority in the web control process.
 
+To connect an OpenAI/ChatGPT account through Codex device login instead of an
+API key, target the specific deployment. ML Claw performs the device-code flow
+directly over HTTPS. It does not install, invoke, or depend on the Codex CLI.
+
+```bash
+mlclaw credentials codex login mlclaw
+mlclaw credentials codex status mlclaw
+mlclaw credentials codex logout mlclaw
+```
+
+`login` requests a one-time device code from OpenAI, prints the verification
+URL and code, polls for approval, encrypts the OAuth credential into the
+selected deployment's private state bucket, and restarts the deployment.
+OpenClaw then discovers the models visible to that ChatGPT account under its
+native `openai/*` provider. For example, an entitled account may expose
+`openai/gpt-5.6-sol` alongside the other live Codex models.
+
+At startup, ML Claw imports the encrypted login into a managed native OpenClaw
+OAuth profile. OpenClaw then contacts OpenAI directly for model discovery,
+Responses requests, and token refresh; ML Claw is not in the inference path.
+OpenClaw keeps its own model names, metadata, transport, and refreshed
+credential, and a normal `OPENAI_API_KEY` profile can coexist with the ChatGPT
+route. `status` and `logout` inspect or revoke the deployment-scoped login
+without exposing tokens. Raw OAuth tokens are never printed, stored in the
+Space repository or model configuration, or included in workspace files.
+
 ## How State Works
 
 OpenClaw runs against local disk inside the active runtime. In Space gateway