fix: disable auth (mode:none) + patch CSP frame-ancestors for HF iframe embedding

Dockerfile

@@ -27,10 +27,12 @@ RUN echo "[build][layer2] Clone + install + build..." && START=$(date +%s) \
   && git clone --depth 1 https://github.com/openclaw/openclaw.git openclaw \
   && echo "[build] git clone: $(($(date +%s) - START))s" \
   && cd openclaw \
-  && if [ -f /app/patches/web-inbound-record-activity-after-body.patch ]; then \
-       patch -p1 < /app/patches/web-inbound-record-activity-after-body.patch \
-       && echo "[build] patch applied"; \
-     fi \
+  && for p in /app/patches/*.patch; do \
+       if [ -f "$p" ]; then \
+         patch -p1 < "$p" \
+         && echo "[build] patch applied: $(basename $p)"; \
+       fi; \
+     done \
   && T1=$(date +%s) \
   && pnpm install --frozen-lockfile \
   && echo "[build] pnpm install: $(($(date +%s) - T1))s" \

openclaw.json

@@ -3,7 +3,7 @@
     "mode": "local",
     "bind": "lan",
     "port": 7860,
-    "auth": {},
+    "auth": { "mode": "none" },
     "trustedProxies": [
       "0.0.0.0/0"
     ],

patches/hf-spaces-allow-iframe-embedding.patch

@@ -0,0 +1,27 @@
+diff --git a/src/gateway/control-ui-csp.ts b/src/gateway/control-ui-csp.ts
+index 8a7b56f..112b1c2 100644
+--- a/src/gateway/control-ui-csp.ts
++++ b/src/gateway/control-ui-csp.ts
+@@ -7,7 +7,7 @@ export function buildControlUiCspHeader(): string {
+     "default-src 'self'",
+     "base-uri 'none'",
+     "object-src 'none'",
+-    "frame-ancestors 'none'",
++    "frame-ancestors 'self' https://huggingface.co https://*.hf.space",
+     "script-src 'self'",
+     "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
+     "img-src 'self' data: https:",
+diff --git a/src/gateway/control-ui.ts b/src/gateway/control-ui.ts
+index ed7b733..7cc0ab9 100644
+--- a/src/gateway/control-ui.ts
++++ b/src/gateway/control-ui.ts
+@@ -98,7 +98,8 @@ type ControlUiAvatarMeta = {
+ };
+ 
+ function applyControlUiSecurityHeaders(res: ServerResponse) {
+-  res.setHeader("X-Frame-Options", "DENY");
++  // Allow embedding in HF Spaces iframes (X-Frame-Options removed, CSP frame-ancestors used instead)
++  // res.setHeader("X-Frame-Options", "DENY");
+   res.setHeader("Content-Security-Policy", buildControlUiCspHeader());
+   res.setHeader("X-Content-Type-Options", "nosniff");
+   res.setHeader("Referrer-Policy", "no-referrer");

scripts/entrypoint.sh

@@ -48,13 +48,6 @@ touch /home/node/logs/app.log
 ENTRYPOINT_END=$(date +%s)
 echo "[TIMER] Entrypoint (before sync_hf.py): $((ENTRYPOINT_END - BOOT_START))s"
 
-# ── Inject auto-token into Control UI (must happen at runtime, not build) ────
-INJECT_START=$(date +%s)
-if [ -x /home/node/scripts/inject-token.sh ]; then
-  OPENCLAW_APP_DIR=/app/openclaw bash /home/node/scripts/inject-token.sh
-fi
-echo "[TIMER] Token inject: $(($(date +%s) - INJECT_START))s"
-
 # ── Start OpenClaw via sync_hf.py (don't wait for DNS — it runs in bg) ─────
 echo "[entrypoint] Starting OpenClaw via sync_hf.py..."
 echo "[entrypoint] DNS resolution running in background (PID $DNS_PID), app will use it when ready"

scripts/sync_hf.py

@@ -327,7 +327,7 @@ class OpenClawFullSync:
                 "mode": "local",
                 "bind": "lan",
                 "port": 7860,
-                "auth": {},
+                "auth": {"mode": "none"},
                 "trustedProxies": ["0.0.0.0/0"],
                 "controlUi": {
                     "allowInsecureAuth": True,