Spaces:
Paused
Paused
Commit History
-
fix: update monitor.ts patch for upstream refactor
Upstream OpenClaw refactored monitorWebInbox into smaller functions (normalizeInboundMessage, enrichInboundMessage, enqueueInboundMessage). Update the patch to match the new code structure — still moves recordChannelActivity to after message enrichment. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>82cff1a
-
feat: switch to password auth + project README
tao-shen +1: Claude Opus 4.6- Auth: password mode (default: "huggingclaw", override via OPENCLAW_PASSWORD secret) - Removed: inject-token.sh, global-token-fallback patch (no longer needed) - CSP: reverted script-src to 'self' (no inline scripts) - README: project intro, quick start, architecture, security docs Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>af9539c -
fix: add 'unsafe-inline' to CSP script-src for token injection
tao-shen +1: Claude Opus 4.6The injected <script> tag that sets window.__OPENCLAW_AUTH_TOKEN__ was blocked by CSP script-src 'self'. Without 'unsafe-inline', the inline script never executes — so in incognito mode (no localStorage), the token is never set and WebSocket auth fails. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>7636cf1 -
fix: use global variable for token injection (works in incognito iframe)
tao-shen +1: Claude Opus 4.6When HF Spaces embeds the Control UI in an iframe, Chrome incognito blocks third-party localStorage access. The token injection via localStorage silently fails, leaving the UI unable to authenticate. Changes: - Add source patch: storage.ts reads window.__OPENCLAW_AUTH_TOKEN__ as fallback when localStorage token is empty/unavailable - inject-token.sh: set window.__OPENCLAW_AUTH_TOKEN__ global variable in addition to localStorage (global always works) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>cb9a1fd -
fix: disable auth (mode:none) + patch CSP frame-ancestors for HF iframe embedding
tao-shen1469692 -
deploy: HuggingClaw with original Dockerfile
tao-shenb19d31a