Spaces:
Runtime error
Runtime error
Commit History
-
fix: revert invalid OpenClaw config keys causing RUNTIME_ERROR
- Remove auth.defaultScope and gateway.auth.scope (unrecognized by OpenClaw) - Remove security.scope from A2A gateway config - These caused "Config invalid" crash on all Spaces - Force rebuild (v3.6) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>9da0d8a -
fix: add operator scope to gateway auth and A2A security config
- Add scope: operator to gateway.auth to fix 'missing scope: operator.write' - Add scope: operator to A2A gateway security.scope - Add auth.defaultScope: operator for fallback - Force Docker rebuild (v3.5) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>ff25d4f -
feat: bilingual conversation, word-wrap bubbles, remove unused panels
- Conversation topic now concrete: survival/reproduction on HuggingFace - Bilingual output (EN/ZH) with language toggle in chat log panel - Fix guest bubble word wrap (was single-line, now wraps at 300px) - Remove memo, control-bar, guest-agent-panel (keep only chatlog) - Bubble and chatlog support text_zh field for Chinese translation - Force Docker rebuild (v3.3) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>b32e821 -
fix: switch conversation to English, longer replies (2-3 sentences), wider bubbles
3b2ade1 -
fix: clean up conversation prompt to avoid prefix leakage
e981ecd -
feat: chat log panel + improved conversation orchestrator
- Add /api/chatlog GET/POST endpoints for conversation display - Add chat log panel at bottom of Office frontend (Adam ↔ Eve dialogue) - Rewrite conversation-loop.py with history context for coherent dialogue - Frontend polls /api/chatlog every 5s and renders messages - Remove old bash conversation script87a2793 -
feat: add conversation bubble display and A2A chat orchestrator
- token-redirect.cjs: add bubbleText to /api/state, POST /api/bubble endpoint - frontend: show bubbleText from API in guest and Star bubbles immediately - frontend: filter out 'main' from guest list (Star already represents it) - conversation-loop.sh: orchestrate Adam/Eve eternal discussion via A2Aebfc885 -
fix: reduce verbose logging to prevent HF Spaces log viewer crashes
- Suppress huggingface_hub progress bars and verbose download logs - Remove per-file upload listing (just show summary count) - Remove per-file dataset verification listing - Reduce file tree debug to count only - Filter OpenClaw process output: skip download/progress noise, forward key lines only - All output still goes to log file for debugging2f79e09 -
fix: restore 302 redirect for token so frontend JS can read it from URL
Server-side URL rewrite changed req.url internally but the browser URL stayed as '/' — OpenClaw's frontend JS reads window.location.search for the token, so it couldn't find it and showed 'offline'. Restored 302 redirect which changes the browser URL to /?token=huggingclaw. The iframe CSP fix (moved earlier in the code) still applies correctly. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>0b2ec75
-
fix: apply iframe CSP fix before URL rewrite to prevent frame-ancestors 'none'
The writeHead wrapper that strips X-Frame-Options and fixes frame-ancestors was placed after the URL rewrite code. When req.url was rewritten and origEmit was called early, the iframe fix was never applied, causing 'frame-ancestors none' to block HF iframe embedding. Moved the fix to run immediately after the port check, before any routing logic. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>99ce7b7 -
fix: use server-side URL rewrite instead of 302 redirect for token injection
302 redirect was unreliable in incognito mode — the browser followed the redirect but OpenClaw's frontend sometimes failed to pick up the token. Server-side rewrite injects the token directly into req.url before OpenClaw processes it, eliminating the redirect round-trip. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>9a23aad -
Upload scripts/token-redirect.cjs with huggingface_hub
Verified signature1fc4864 -
Upload scripts/sync_hf.py with huggingface_hub
Verified signature2778fda -
Upload scripts/entrypoint.sh with huggingface_hub
Verified signature970eeac -
Upload scripts/token-redirect.cjs with huggingface_hub
Verified signaturebcc6655 -
Upload scripts/a2a-proxy.cjs with huggingface_hub
Verified signature8bd6f75 -
Upload scripts/a2a-proxy.cjs with huggingface_hub
Verified signatureb0a12d6 -
Upload scripts/entrypoint.sh with huggingface_hub
Verified signature0fa48ff -
Upload scripts/sync_hf.py with huggingface_hub
Verified signaturef18a4b6 -
Upload scripts/a2a-proxy.cjs with huggingface_hub
Verified signature8b27af4 -
Upload folder using huggingface_hub
Verified signature31cf062 -
feat: serve pixel office animation at / with static asset serving
- Add static file serving to a2a-proxy.cjs (/, /static/*, /admin) - Generate index.html from electron-standalone.html at Docker build time - Copy frontend directory into Docker image - Add officeName to /status response for frontend Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>c0338ad -
fix: accept 302 redirect as healthy in OpenClaw health check
The token-redirect module returns 302 on GET /, which caused the health check to report 'error' instead of 'idle'. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>5f20dc1 -
feat: add remote agent monitoring and A2A activity tracking to proxy
- Poll remote agents (Adam/Eve) via REMOTE_AGENTS env var - Intercept /agents endpoint to merge OpenClaw + remote agent states - Track A2A POST requests to show "writing" state during communication - Remote agent states mapped to Office areas (breakroom/writing/error) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>e6586a2 -
feat: add A2A gateway support (activated by A2A_PEERS env var)
- Add openclaw-a2a-gateway extension to Dockerfile - Add a2a-proxy.cjs for port routing (7860 proxy → 7861 OpenClaw, 18800 A2A) - Modify sync_hf.py: port 7861, A2A config only when A2A_PEERS is set - No impact when A2A_PEERS is not set (proxy transparently forwards)8ee58f9 -
Revert "feat: add pixel animation homepage with Express proxy layer"
This reverts commit 6cf74294015c25e76d77e66dfb929c3fb8ed5a2d.86b44f8
-
feat: add pixel animation homepage with Express proxy layer
- Add Star-Office-UI pixel animation as the default homepage (/) - Create Express proxy (proxy.cjs) on port 7860, OpenClaw moves to 7861 - Admin panel accessible via /admin with auto token injection - State bridge maps OpenClaw status to animation states - Frontend assets cloned from Star-Office-UI during Docker build - Add A2A gateway plugin support in Dockerfile and config - Prepare multi-agent infrastructure (peer polling, guest rendering) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>6cf7429
-
fix: switch Zhipu provider to Anthropic-compatible endpoint
The OpenAI-compatible endpoint (paas/v4) returns "insufficient balance" but the Anthropic-compatible endpoint (open.bigmodel.cn/api/anthropic) works. Updated api type to "anthropic-messages" and new API key set. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>3227ad9 -
fix: update Zhipu model IDs in default config and dataset template
These files still referenced deprecated glm-4-flash/glm-4-plus models, causing "Fallback active: zhipu/glm-4-flash" → 400 model not found. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>2a1b70d -
fix: update Zhipu AI model IDs to current API lineup
Replace deprecated glm-4-flash/plus/long with actual available models: glm-4.5-air, glm-4.5, glm-4.6, glm-4.7, glm-5 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>ae76fba -
fix: add required models array to zhipu provider config
df4b021 -
fix: rebuild providers from scratch on each startup
Prevents stale providers (e.g. openrouter with deleted key) from persisting via dataset backup. Also removes hardcoded model list from zhipu provider — let OpenClaw discover models dynamically. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>e3478dc -
feat: add Zhipu AI (z.ai) as a native LLM provider
- Read ZHIPU_API_KEY from environment - Configure Zhipu provider with GLM-4 models (flash/plus/long) - Auto-select glm-4-flash as default when Zhipu is the only provider - Pass ZHIPU_API_KEY through to OpenClaw process Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>306fbc6
-
feat: auto-fill gateway token via URL redirect
tao-shen +1: Claude Opus 4.6Add token-redirect.cjs preload script that redirects "/" to "/?token=GATEWAY_TOKEN". The Control UI reads token from URL params and auto-fills it, so users don't need to manually enter the token. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>9512030 -
fix: remove tao-shen/HuggingClaw-data refs to prevent unwanted linked spaces
tao-shen +1: Claude Opus 4.6HF scans README content to detect dataset references, causing duplicated Spaces to appear as "linked" to the original dataset. Replace all specific dataset repo names with generic examples and remove huggingface-dataset tag. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>750878a -
test: revert dataset derivation to observe linked spaces behavior
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>8c4d233 -
fix: restore OPENCLAW_DATASET_REPO priority over SPACE_ID derivation
Revert to original logic: user-specified OPENCLAW_DATASET_REPO takes priority. SPACE_ID auto-derivation is only used as fallback. This restores the linked-spaces association on the dataset page. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>7728a08 -
fix: always derive dataset from SPACE_ID, ignore OPENCLAW_DATASET_REPO on HF
When running on HF Spaces (SPACE_ID is set), always use {SPACE_ID}-data as the dataset name. This prevents duplicated Spaces from inheriting the original's dataset via copied secrets. OPENCLAW_DATASET_REPO is only used for local Docker without SPACE_ID. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>419ff91 -
fix: revert to token auth with default "huggingclaw"
auth.mode=none crashes on non-loopback bind. Revert to token mode with GATEWAY_TOKEN env var (default: huggingclaw). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>5a096f1 -
feat: default to no-auth mode — Control UI connects instantly
Use gateway auth.mode="none" by default so the Control UI auto-connects without any token. Users who want access control can set GATEWAY_TOKEN env var to require a token. Also restore AUTO_CREATE_DATASET check for dataset creation. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>3f16497 -
fix: auto-derive dataset name from SPACE_ID, not HF_TOKEN username
Always use {SPACE_ID}-data (e.g. tao-shen/HuggingClaw-data) so duplicated Spaces automatically get their own dataset repo. No longer requires AUTO_CREATE_DATASET for name derivation. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>8f454de -
feat: add GATEWAY_TOKEN env var (default: huggingclaw)
Users can override the gateway token via the GATEWAY_TOKEN environment variable in HF Spaces secrets. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>99d42f4 -
fix: restore dangerouslyDisableDeviceAuth for HF Spaces
HF Spaces has no CLI access, so device pairing approval is impossible. Must keep dangerouslyDisableDeviceAuth=true; access control relies on the gateway token instead. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>d2e3735 -
config: set hardcoded gateway token "huggingclaw" as default
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>a18f6b8 -
remove: drop gateway password/token auth entirely — device auth only
Access is now controlled purely by device pairing. Only browsers paired via the owner's HuggingFace profile page can connect. Removed OPENCLAW_PASSWORD from config, sync_hf.py, and README. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>8814392 -
security: enforce device auth — only paired browsers can access Control UI
Remove dangerouslyDisableDeviceAuth: true so that device pairing is enforced. Users must pair via the owner's HF profile page; incognito or third-party browsers will be denied access. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>7a3a430 -
feat: switch auth from password to token mode (persists in browser)
Token auth stores the credential in localStorage so user only needs to enter it once. Password auth requires re-entry on every page refresh. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>342dacc -
fix: always force dmPolicy=open + allowFrom=["*"] on every startup
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>1be188a -
fix: add allowFrom=["*"] required by dmPolicy=open
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>3c50513 -
fix: set Telegram dmPolicy=open and configWrites=true for HF Spaces
Personal bot — no need for strict pairing. Fixes "not authorized" error when user sends commands after pairing. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>27fc3a4