mlclaw 0.6.0 → 0.6.1

package/.agents/skills/mlclaw/SKILL.md

@@ -298,11 +298,13 @@ mlclaw credentials codex login <agent>
 ```
 
 After login, ML Claw imports the deployment credential into a managed native
-OpenClaw OAuth profile. OpenClaw contacts OpenAI directly, refreshes the OAuth
-credential in its private auth store, and discovers the account-visible catalog
-under `openai/*`, including `openai/gpt-5.6-sol` when entitled. ML Claw does not
-proxy model discovery or inference. Normal `OPENAI_API_KEY` profiles continue
-to use the OpenAI Platform route.
+OpenClaw OAuth profile and enables OpenClaw's bundled Codex app-server harness
+for `openai/*` agent models. OpenClaw contacts OpenAI directly, refreshes the
+OAuth credential in its private auth store, and discovers the account-visible
+catalog, including `openai/gpt-5.6-sol` when entitled. ML Claw does not proxy
+model discovery or inference and does not install or invoke a Codex CLI from
+`PATH`. Normal `OPENAI_API_KEY` profiles can coexist with subscription OAuth;
+OpenAI agent turns use the Codex harness with either credential type.
 
 ## Branding
 

package/Dockerfile

@@ -2,7 +2,7 @@ ARG OPENCLAW_VERSION=2026.7.1
 ARG OPENCLAW_BASE_IMAGE=ghcr.io/openclaw/openclaw:${OPENCLAW_VERSION}
 ARG BROKERKIT_PLUGIN_VERSION=0.4.1
 ARG BROKERKIT_VERSION=hf-broker/v0.6.2
-ARG MLCLAW_RUNTIME_IMAGE=ghcr.io/huggingface/mlclaw:0.6.0-openclaw-2026.7.1
+ARG MLCLAW_RUNTIME_IMAGE=ghcr.io/huggingface/mlclaw:0.6.1-openclaw-2026.7.1
 
 FROM golang:1.26.5-bookworm AS hf-broker-build
 ARG BROKERKIT_VERSION

package/README.md

@@ -389,13 +389,21 @@ native `openai/*` provider. For example, an entitled account may expose
 `openai/gpt-5.6-sol` alongside the other live Codex models.
 
 At startup, ML Claw imports the encrypted login into a managed native OpenClaw
-OAuth profile. OpenClaw then contacts OpenAI directly for model discovery,
-Responses requests, and token refresh; ML Claw is not in the inference path.
-OpenClaw keeps its own model names, metadata, transport, and refreshed
-credential, and a normal `OPENAI_API_KEY` profile can coexist with the ChatGPT
-route. `status` and `logout` inspect or revoke the deployment-scoped login
-without exposing tokens. Raw OAuth tokens are never printed, stored in the
-Space repository or model configuration, or included in workspace files.
+OAuth profile and enables OpenClaw's bundled Codex app-server harness for
+`openai/*` agent models. Codex owns the low-level model loop, native thread
+state, tool continuation, and compaction; OpenClaw continues to own channels,
+approvals, dynamic tools, model selection, and the visible transcript mirror.
+OpenClaw manages its compatible app-server binary, so ML Claw still does not
+install or invoke a Codex CLI from `PATH`.
+
+OpenClaw contacts OpenAI directly for model discovery, inference, and token
+refresh; ML Claw is not in the inference path. OpenClaw keeps its own model
+names, metadata, transport, and refreshed credential, and a normal
+`OPENAI_API_KEY` profile can coexist with the ChatGPT route. OpenAI agent models
+also use the Codex harness with API-key auth. `status` and `logout` inspect or
+revoke the deployment-scoped login without exposing tokens. Raw OAuth tokens
+are never printed, stored in the Space repository or model configuration, or
+included in workspace files.
 
 ## How State Works
 

package/dist/mlclaw-space-runtime.js

@@ -4571,6 +4571,7 @@ function readRuntimeSettings(file) {
 
 // src/mlclaw-space-runtime/server.ts
 import { spawn as spawn2 } from "node:child_process";
+import { randomBytes as randomBytes9 } from "node:crypto";
 import http3 from "node:http";
 import { Readable as Readable2 } from "node:stream";
 
@@ -12128,8 +12129,11 @@ async function configureOpenClawGateway(config2, options = {}) {
     allowedOrigins: config2.accessOrigins,
     embedSandbox: "scripts"
   };
-  configureOpenClawModels(openclawConfig, config2, Boolean(options.codexConfigured), Boolean(options.openAiConfigured));
-  configureOpenAiAuthMetadata(openclawConfig, Boolean(options.codexConfigured));
+  const codexConfigured = Boolean(options.codexConfigured);
+  const openAiConfigured2 = Boolean(options.openAiConfigured);
+  configureOpenClawModels(openclawConfig, config2, codexConfigured, openAiConfigured2);
+  configureOpenAiAuthMetadata(openclawConfig, codexConfigured);
+  configureCodexRuntimePlugin(openclawConfig, codexConfigured || openAiConfigured2);
   disableAutomaticSessionResets(openclawConfig);
   configureManagedMcpServers(openclawConfig, config2);
   configureBrokerMcpServer(openclawConfig, config2);
@@ -12208,6 +12212,31 @@ function brokerAgentScope(value) {
 function brokerApprovalMode(value) {
   return value === "auto" || value === "prompt" || value === "approve" ? value : void 0;
 }
+function configureCodexRuntimePlugin(openclawConfig, enabled) {
+  const plugins = object(openclawConfig, "plugins");
+  const entries = object(plugins, "entries");
+  const existing = objectValue2(entries.codex);
+  if (!enabled) {
+    if (existing) entries.codex = { ...existing, enabled: false };
+    return;
+  }
+  if (plugins.allow !== void 0) {
+    plugins.allow = uniqueStrings(uniqueStrings(plugins.allow, "openai"), "codex");
+  }
+  const existingConfig = objectValue2(existing?.config);
+  const existingAppServer = objectValue2(existingConfig?.appServer);
+  entries.codex = {
+    ...existing,
+    enabled: true,
+    config: {
+      ...existingConfig,
+      appServer: {
+        ...existingAppServer,
+        clearEnv: uniqueStrings(existingAppServer?.clearEnv, "OPENCLAW_GATEWAY_PASSWORD")
+      }
+    }
+  };
+}
 function configureBrokerKitPlugin(openclawConfig, config2) {
   const plugins = object(openclawConfig, "plugins");
   const load = object(plugins, "load");
@@ -12278,7 +12307,7 @@ function configureAgentModelChoices(defaults, config2, routerChoices, codexConfi
   };
   defaults.models = {
     ...Object.fromEntries(routerChoices.map((choice) => [choice.openclawModel, { alias: aliasForChoice(choice) }])),
-    ...openAiAvailable ? { "openai/*": { agentRuntime: { id: "openclaw" } } } : {}
+    ...openAiAvailable ? { "openai/*": { agentRuntime: { id: "codex" } } } : {}
   };
 }
 function resolvePrimaryModel(params) {
@@ -20150,6 +20179,7 @@ var SpaceRuntimeServer = class {
     });
   }
   openclaw;
+  openclawGatewayPassword = randomBytes9(48).toString("base64url");
   openclawStarting = false;
   openclawStopping = false;
   app;
@@ -20330,6 +20360,7 @@ var SpaceRuntimeServer = class {
         await this.syncOAuthProfile({ config: this.config, env });
         throw new Error("OpenAI OAuth credentials were revoked during native profile provisioning");
       }
+      env.OPENCLAW_GATEWAY_PASSWORD = this.openclawGatewayPassword;
       this.openclaw = spawn2(this.config.openclawCommand, this.config.openclawArgs, {
         stdio: "inherit",
         env,

package/dist/mlclaw.mjs

@@ -15383,7 +15383,7 @@ function nextLink(header) {
 
 // src/mlclaw/release-config.generated.ts
 var RELEASE_CONFIG = {
-  "packageVersion": "0.6.0",
+  "packageVersion": "0.6.1",
   "openclawVersion": "2026.7.1",
   "brokerkitVersion": "hf-broker/v0.6.2",
   "brokerkitPluginVersion": "0.4.1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mlclaw",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "license": "MIT",
   "config": {
     "openclawVersion": "2026.7.1",