From 7c5dc7415ba22709e3cebafdf0fb88c2a6a37e92 Mon Sep 17 00:00:00 2001 From: Onur Solmaz Date: Sat, 18 Jul 2026 23:43:44 +0800 Subject: [PATCH 1/2] fix(release): publish runtime under repository owner --- .github/workflows/publish.yml | 2 +- Dockerfile | 4 ++-- README.md | 2 +- dist/mlclaw.mjs | 2 +- ...16-gateway-location-implementation-plan.md | 2 +- ...ml-claw-cutover-and-space-template-plan.md | 2 +- ...7-08-template-space-release-maintenance.md | 4 ++-- docs/2026-07-09-prebuilt-mlclaw-image-plan.md | 22 +++++++++---------- docs/2026-07-09-settings-control-ui-plan.md | 2 +- ...-reconciliation-and-tailnet-access-plan.md | 2 +- package-lock.json | 4 ++-- package.json | 4 ++-- src/mlclaw/runtime-image.ts | 2 +- test/mlclaw.runtime-image.test.ts | 2 +- website/src/pages/getting-started.md | 2 +- 15 files changed, 29 insertions(+), 29 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index d12657b..93c277b 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -147,7 +147,7 @@ jobs: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} continue-on-error: true run: | - gh api --method PATCH /user/packages/container/mlclaw/visibility -f visibility=public + gh api --method PATCH /orgs/huggingface/packages/container/mlclaw/visibility -f visibility=public - name: Verify anonymous GHCR image pull if: ${{ github.event_name == 'release' || inputs.publish_image == 'true' || inputs.update_template_space == 'true' }} env: diff --git a/Dockerfile b/Dockerfile index 1ede20c..995d474 100644 --- a/Dockerfile +++ b/Dockerfile @@ -2,7 +2,7 @@ ARG OPENCLAW_VERSION=2026.7.1 ARG OPENCLAW_BASE_IMAGE=ghcr.io/openclaw/openclaw:${OPENCLAW_VERSION} ARG BROKERKIT_PLUGIN_VERSION=0.3.1 ARG BROKERKIT_VERSION=hf-broker/v0.4.0 -ARG MLCLAW_RUNTIME_IMAGE=ghcr.io/osolmaz/mlclaw:0.4.4-openclaw-2026.7.1 +ARG MLCLAW_RUNTIME_IMAGE=ghcr.io/huggingface/mlclaw:0.4.5-openclaw-2026.7.1 FROM golang:1.26.5-bookworm AS hf-broker-build ARG BROKERKIT_VERSION @@ -32,7 +32,7 @@ RUN npm ci --no-audit --no-fund && npm run build FROM ${OPENCLAW_BASE_IMAGE} -LABEL org.opencontainers.image.source="https://github.com/osolmaz/mlclaw" +LABEL org.opencontainers.image.source="https://github.com/huggingface/mlclaw" LABEL org.opencontainers.image.description="ML Claw runtime for OpenClaw on Hugging Face" USER root diff --git a/README.md b/README.md index 8c07d20..f1ec7b8 100644 --- a/README.md +++ b/README.md @@ -76,7 +76,7 @@ This creates: - a private Docker Space for the browser gateway when the account can host it; - a private Storage Bucket for OpenClaw state after the Space is accepted; - no explicit Space hardware request unless you pass `--hardware`; -- a Docker Space that starts from the prebuilt `ghcr.io/osolmaz/mlclaw` image; +- a Docker Space that starts from the prebuilt `ghcr.io/huggingface/mlclaw` image; - Hugging Face OAuth metadata for browser auth, Hugging Face MCP, and Research Agent access in the Space README; - Space variables, a bucket volume mount for state sync, and separate diff --git a/dist/mlclaw.mjs b/dist/mlclaw.mjs index 540a2e9..b1a4f8d 100755 --- a/dist/mlclaw.mjs +++ b/dist/mlclaw.mjs @@ -15377,7 +15377,7 @@ import { fileURLToPath as fileURLToPath2 } from "node:url"; var DEFAULT_OPENCLAW_VERSION = "2026.7.1"; var DEFAULT_BROKERKIT_PLUGIN_VERSION = "0.3.1"; var DEFAULT_BROKERKIT_VERSION = "hf-broker/v0.4.0"; -var DEFAULT_RUNTIME_IMAGE_REPOSITORY = "ghcr.io/osolmaz/mlclaw"; +var DEFAULT_RUNTIME_IMAGE_REPOSITORY = "ghcr.io/huggingface/mlclaw"; var PACKAGE_METADATA = readPackageMetadata(); var PACKAGE_VERSION = packageString("version", "unknown"); var OPENCLAW_VERSION = packageConfigString("openclawVersion", DEFAULT_OPENCLAW_VERSION); diff --git a/docs/2026-06-16-gateway-location-implementation-plan.md b/docs/2026-06-16-gateway-location-implementation-plan.md index ccc379a..6f4aef9 100644 --- a/docs/2026-06-16-gateway-location-implementation-plan.md +++ b/docs/2026-06-16-gateway-location-implementation-plan.md @@ -3,7 +3,7 @@ Status: implemented in PR #5; final review and CI validation in progress Superseded runtime decision: the default runtime image is now -`ghcr.io/osolmaz/mlclaw:-openclaw-`, not the older +`ghcr.io/huggingface/mlclaw:-openclaw-`, not the older `mlclaw-runtime` package name. See [`2026-07-09-prebuilt-mlclaw-image-plan.md`](2026-07-09-prebuilt-mlclaw-image-plan.md). diff --git a/docs/2026-07-08-ml-claw-cutover-and-space-template-plan.md b/docs/2026-07-08-ml-claw-cutover-and-space-template-plan.md index ffcde3f..6fe54bb 100644 --- a/docs/2026-07-08-ml-claw-cutover-and-space-template-plan.md +++ b/docs/2026-07-08-ml-claw-cutover-and-space-template-plan.md @@ -3,7 +3,7 @@ Status: proposed Superseded runtime decision: the default runtime image is now -`ghcr.io/osolmaz/mlclaw:-openclaw-`, and generated +`ghcr.io/huggingface/mlclaw:-openclaw-`, and generated Spaces use that prebuilt image by default. See [`2026-07-09-prebuilt-mlclaw-image-plan.md`](2026-07-09-prebuilt-mlclaw-image-plan.md). diff --git a/docs/2026-07-08-template-space-release-maintenance.md b/docs/2026-07-08-template-space-release-maintenance.md index 18968cb..aa0c543 100644 --- a/docs/2026-07-08-template-space-release-maintenance.md +++ b/docs/2026-07-08-template-space-release-maintenance.md @@ -47,7 +47,7 @@ On a GitHub release, the publish workflow must: 2. build the TypeScript artifacts; 3. run typecheck, tests, secret checks, and package checks; 4. publish `mlclaw` to npm; -5. publish the `ghcr.io/osolmaz/mlclaw` runtime image to GHCR; +5. publish the `ghcr.io/huggingface/mlclaw` runtime image to GHCR; 6. update the canonical Hugging Face template Space from the same built repo. The workflow updates the template Space with: @@ -65,7 +65,7 @@ setting the `template_space` input. The default remains `osolmaz/mlclaw`. The default Space Dockerfile should be: ```dockerfile -FROM ghcr.io/osolmaz/mlclaw:-openclaw- +FROM ghcr.io/huggingface/mlclaw:-openclaw- ``` The GHCR package must be public. Hugging Face Spaces pull the image without a diff --git a/docs/2026-07-09-prebuilt-mlclaw-image-plan.md b/docs/2026-07-09-prebuilt-mlclaw-image-plan.md index 864e27d..982ab5f 100644 --- a/docs/2026-07-09-prebuilt-mlclaw-image-plan.md +++ b/docs/2026-07-09-prebuilt-mlclaw-image-plan.md @@ -11,13 +11,13 @@ Implemented in the ML Claw cutover branch. ML Claw should publish and use one prebuilt Docker image: ```text -ghcr.io/osolmaz/mlclaw:-openclaw- +ghcr.io/huggingface/mlclaw:-openclaw- ``` For version `0.2.2`, the default image is: ```text -ghcr.io/osolmaz/mlclaw:0.2.2-openclaw-2026.7.1-beta.2 +ghcr.io/huggingface/mlclaw:0.2.2-openclaw-2026.7.1-beta.2 ``` The OpenClaw base image is pinned to the current beta release: @@ -56,7 +56,7 @@ Runtime image naming lives in `package.json`: The TypeScript CLI reads this metadata and derives: ```text -ghcr.io/osolmaz/mlclaw:-openclaw- +ghcr.io/huggingface/mlclaw:-openclaw- ``` The publish workflow reads the same metadata before building and tagging the @@ -68,7 +68,7 @@ By default, `mlclaw bootstrap`, `mlclaw update`, and `mlclaw gateway migrate --to space` generate a Space Dockerfile with one line: ```dockerfile -FROM ghcr.io/osolmaz/mlclaw:0.2.2-openclaw-2026.7.1-beta.2 +FROM ghcr.io/huggingface/mlclaw:0.2.2-openclaw-2026.7.1-beta.2 ``` The Space variable `MLCLAW_RUNTIME_IMAGE` must match that image tag. @@ -110,10 +110,10 @@ The GitHub Actions publish workflow must: The image tags are: ```text -ghcr.io/osolmaz/mlclaw:-openclaw- -ghcr.io/osolmaz/mlclaw:openclaw- -ghcr.io/osolmaz/mlclaw:sha- -ghcr.io/osolmaz/mlclaw:latest +ghcr.io/huggingface/mlclaw:-openclaw- +ghcr.io/huggingface/mlclaw:openclaw- +ghcr.io/huggingface/mlclaw:sha- +ghcr.io/huggingface/mlclaw:latest ``` The GHCR image package must be public. Hugging Face Spaces pull the image @@ -145,20 +145,20 @@ node dist/mlclaw.mjs update osolmaz/mlclaw-test --force The generated Space Dockerfile should contain: ```dockerfile -FROM ghcr.io/osolmaz/mlclaw:0.2.2-openclaw-2026.7.1-beta.2 +FROM ghcr.io/huggingface/mlclaw:0.2.2-openclaw-2026.7.1-beta.2 ``` Runtime validation: ```bash docker build -t mlclaw:test . -docker run --rm --entrypoint sh mlclaw:test -lc 'openclaw --version && test "$MLCLAW_RUNTIME_IMAGE" = "ghcr.io/osolmaz/mlclaw:0.2.2-openclaw-2026.7.1-beta.2"' +docker run --rm --entrypoint sh mlclaw:test -lc 'openclaw --version && test "$MLCLAW_RUNTIME_IMAGE" = "ghcr.io/huggingface/mlclaw:0.2.2-openclaw-2026.7.1-beta.2"' ``` Live validation after publish: ```bash -docker buildx imagetools inspect ghcr.io/osolmaz/mlclaw:0.2.2-openclaw-2026.7.1-beta.2 +docker buildx imagetools inspect ghcr.io/huggingface/mlclaw:0.2.2-openclaw-2026.7.1-beta.2 node dist/mlclaw.mjs doctor osolmaz/mlclaw node dist/mlclaw.mjs doctor osolmaz/mlclaw-test ``` diff --git a/docs/2026-07-09-settings-control-ui-plan.md b/docs/2026-07-09-settings-control-ui-plan.md index 009b8ec..58ded29 100644 --- a/docs/2026-07-09-settings-control-ui-plan.md +++ b/docs/2026-07-09-settings-control-ui-plan.md @@ -414,7 +414,7 @@ Build/package tests: - Vite control UI build is included in generated Space files; - package check includes the built assets needed by `mlclaw update`; -- generated Space starts from the prebuilt `ghcr.io/osolmaz/mlclaw` runtime image. +- generated Space starts from the prebuilt `ghcr.io/huggingface/mlclaw` runtime image. Live test: diff --git a/docs/2026-07-16-bootstrap-reconciliation-and-tailnet-access-plan.md b/docs/2026-07-16-bootstrap-reconciliation-and-tailnet-access-plan.md index 9b0b595..cdb3b15 100644 --- a/docs/2026-07-16-bootstrap-reconciliation-and-tailnet-access-plan.md +++ b/docs/2026-07-16-bootstrap-reconciliation-and-tailnet-access-plan.md @@ -205,7 +205,7 @@ Use a reserved control prefix separate from snapshot state: "tailscaleMode": "direct" }, "model": "huggingface/zai-org/GLM-5.2:fireworks-ai", - "runtimeImage": "ghcr.io/osolmaz/mlclaw:0.3.8-openclaw-2026.7.1", + "runtimeImage": "ghcr.io/huggingface/mlclaw:0.3.8-openclaw-2026.7.1", "space": { "repo": "example-user/mlclaw", "visibility": "private" diff --git a/package-lock.json b/package-lock.json index f426530..bcb45ac 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "mlclaw", - "version": "0.4.4", + "version": "0.4.5", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "mlclaw", - "version": "0.4.4", + "version": "0.4.5", "license": "MIT", "dependencies": { "@clack/prompts": "^1.4.0", diff --git a/package.json b/package.json index 33e97a8..23751db 100644 --- a/package.json +++ b/package.json @@ -1,12 +1,12 @@ { "name": "mlclaw", - "version": "0.4.4", + "version": "0.4.5", "license": "MIT", "config": { "openclawVersion": "2026.7.1", "brokerkitVersion": "hf-broker/v0.4.0", "brokerkitPluginVersion": "0.3.1", - "runtimeImageRepository": "ghcr.io/osolmaz/mlclaw" + "runtimeImageRepository": "ghcr.io/huggingface/mlclaw" }, "repository": { "type": "git", diff --git a/src/mlclaw/runtime-image.ts b/src/mlclaw/runtime-image.ts index 127b303..c4287ca 100644 --- a/src/mlclaw/runtime-image.ts +++ b/src/mlclaw/runtime-image.ts @@ -5,7 +5,7 @@ import { fileURLToPath } from "node:url"; const DEFAULT_OPENCLAW_VERSION = "2026.7.1"; const DEFAULT_BROKERKIT_PLUGIN_VERSION = "0.3.1"; export const DEFAULT_BROKERKIT_VERSION = "hf-broker/v0.4.0"; -const DEFAULT_RUNTIME_IMAGE_REPOSITORY = "ghcr.io/osolmaz/mlclaw"; +const DEFAULT_RUNTIME_IMAGE_REPOSITORY = "ghcr.io/huggingface/mlclaw"; const PACKAGE_METADATA = readPackageMetadata(); diff --git a/test/mlclaw.runtime-image.test.ts b/test/mlclaw.runtime-image.test.ts index d9d57ca..6e72144 100644 --- a/test/mlclaw.runtime-image.test.ts +++ b/test/mlclaw.runtime-image.test.ts @@ -51,7 +51,7 @@ describe("runtime image Dockerfile", () => { "COPY --from=hf-broker-build /out/hf-broker.policy-manifest.json /app/hf-broker.policy-manifest.json", ); expect(dockerfile).not.toContain("ghcr.io/osolmaz/mlclaw-runtime"); - expect(DEFAULT_RUNTIME_IMAGE).toBe(`ghcr.io/osolmaz/mlclaw:${PACKAGE_VERSION}-openclaw-${OPENCLAW_VERSION}`); + expect(DEFAULT_RUNTIME_IMAGE).toBe(`ghcr.io/huggingface/mlclaw:${PACKAGE_VERSION}-openclaw-${OPENCLAW_VERSION}`); expect(dockerfile).toContain("ENV PORT=7860"); expect(dockerfile).toContain("ENV OPENCLAW_GATEWAY_PORT=7861"); expect(dockerfile).toContain("EXPOSE 7860"); diff --git a/website/src/pages/getting-started.md b/website/src/pages/getting-started.md index 238c765..3797fe2 100644 --- a/website/src/pages/getting-started.md +++ b/website/src/pages/getting-started.md @@ -32,7 +32,7 @@ On Windows, PowerShell does the same: irm https://raw.githubusercontent.com/huggingface/mlclaw/main/mlclaw.ps1 | iex ``` -Bootstrap creates a private Storage Bucket for the agent's state, a private Docker Space for the browser gateway, and a local deployment manifest under `~/.config/mlclaw`. The Space starts from the prebuilt `ghcr.io/osolmaz/mlclaw` image and gets write-only secrets for session signing and credential encryption. Your Hugging Face token goes into the `MLCLAW_BROKER_HF_TOKEN` secret, which only the isolated broker process reads; the agent itself never sees it. [How it works](/how-it-works/) covers that boundary in detail. +Bootstrap creates a private Storage Bucket for the agent's state, a private Docker Space for the browser gateway, and a local deployment manifest under `~/.config/mlclaw`. The Space starts from the prebuilt `ghcr.io/huggingface/mlclaw` image and gets write-only secrets for session signing and credential encryption. Your Hugging Face token goes into the `MLCLAW_BROKER_HF_TOKEN` secret, which only the isolated broker process reads; the agent itself never sees it. [How it works](/how-it-works/) covers that boundary in detail. When the Space is up, open it and sign in with your Hugging Face account. You land in the OpenClaw browser gateway, which includes a small ML Claw control link for settings, status, credentials, and sign out. From e4dbabe4e5fb40d38060cefa55892ed23af8242c Mon Sep 17 00:00:00 2001 From: Onur Solmaz Date: Sat, 18 Jul 2026 23:48:28 +0800 Subject: [PATCH 2/2] docs(skill): update runtime image owner --- .agents/skills/mlclaw/SKILL.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.agents/skills/mlclaw/SKILL.md b/.agents/skills/mlclaw/SKILL.md index dd735dd..b248068 100644 --- a/.agents/skills/mlclaw/SKILL.md +++ b/.agents/skills/mlclaw/SKILL.md @@ -25,7 +25,7 @@ An ML Claw deployment has: - no explicit Space hardware request by default; Hugging Face assigns the default free CPU hardware unless `--hardware` or a feature requiring paid hardware is used; -- a prebuilt `ghcr.io/osolmaz/mlclaw` runtime image by default; +- a prebuilt `ghcr.io/huggingface/mlclaw` runtime image by default; - Hugging Face OAuth enabled on the Space; - automatic Hugging Face MCP and Research Agent integrations authorized by an admin-only OAuth step after ordinary Hugging Face sign-in; @@ -126,7 +126,7 @@ Hugging Face account. The Space server proxies authenticated browser traffic to OpenClaw on loopback using trusted-proxy auth. Do not ask the user for an OpenClaw gateway token for the browser Space path. -Generated Spaces use the prebuilt `ghcr.io/osolmaz/mlclaw:-openclaw-` +Generated Spaces use the prebuilt `ghcr.io/huggingface/mlclaw:-openclaw-` image by default. Use `--bundled-runtime` only for development or emergency fallbacks where the Space must build all runtime files directly from the uploaded Space repository.