Spaces:
Runtime error
Runtime error
Commit History
-
feat: switch to password auth + project README
tao-shen +1: Claude Opus 4.6- Auth: password mode (default: "huggingclaw", override via OPENCLAW_PASSWORD secret) - Removed: inject-token.sh, global-token-fallback patch (no longer needed) - CSP: reverted script-src to 'self' (no inline scripts) - README: project intro, quick start, architecture, security docs Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>201eb72 -
fix: add 'unsafe-inline' to CSP script-src for token injection
tao-shen +1: Claude Opus 4.6The injected <script> tag that sets window.__OPENCLAW_AUTH_TOKEN__ was blocked by CSP script-src 'self'. Without 'unsafe-inline', the inline script never executes — so in incognito mode (no localStorage), the token is never set and WebSocket auth fails. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>ce71ed6 -
fix: use global variable for token injection (works in incognito iframe)
tao-shen +1: Claude Opus 4.6When HF Spaces embeds the Control UI in an iframe, Chrome incognito blocks third-party localStorage access. The token injection via localStorage silently fails, leaving the UI unable to authenticate. Changes: - Add source patch: storage.ts reads window.__OPENCLAW_AUTH_TOKEN__ as fallback when localStorage token is empty/unavailable - inject-token.sh: set window.__OPENCLAW_AUTH_TOKEN__ global variable in addition to localStorage (global always works) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>7b4c5b7 -
fix: disable auth (mode:none) + patch CSP frame-ancestors for HF iframe embedding
tao-shen331869d -
deploy: HuggingClaw with original Dockerfile
tao-shene7ab5f1