fix: remove tao-shen/HuggingClaw-data refs to prevent unwanted linked spaces

test: revert dataset derivation to observe linked spaces behavior

fix: restore OPENCLAW_DATASET_REPO priority over SPACE_ID derivation

fix: always derive dataset from SPACE_ID, ignore OPENCLAW_DATASET_REPO on HF

fix: revert to token auth with default "huggingclaw"

feat: default to no-auth mode — Control UI connects instantly

fix: auto-derive dataset name from SPACE_ID, not HF_TOKEN username

feat: add GATEWAY_TOKEN env var (default: huggingclaw)

fix: restore dangerouslyDisableDeviceAuth for HF Spaces

config: set hardcoded gateway token "huggingclaw" as default

remove: drop gateway password/token auth entirely — device auth only

security: enforce device auth — only paired browsers can access Control UI

feat: switch auth from password to token mode (persists in browser)

fix: always force dmPolicy=open + allowFrom=["*"] on every startup

fix: add allowFrom=["*"] required by dmPolicy=open

fix: set Telegram dmPolicy=open and configWrites=true for HF Spaces

feat: telegram-proxy.cjs intercepts fetch() to bypass HF DNS block

fix: validate Telegram bot token format before probe (skip junk tokens)

fix: revert auth to password mode, add Telegram API auto-probe, background DNS

feat: switch auth from password to token for browser persistence

feat: derive dataset name from Space repo name to avoid conflicts

fix: remove leftover _ensure_telegram_credentials() call causing RUNTIME_ERROR

fix: patch config when dataset exists but is empty

feat: auto-derive dataset repo name from HF_TOKEN when AUTO_CREATE_DATASET=true

security: change AUTO_CREATE_DATASET default to false

docs: add detailed env var table with examples, change sync interval to 60s

chore: replace gpt-4o-mini with gpt-5-nano everywhere

chore: default model → openai/gpt-oss-20b:free (OpenAI open-source)

chore: default repo → HuggingClaw-data, default model → DeepSeek V3 (free)

fix: IndentationError in sync_hf.py line 161

Remove Telegram env vars, clean up README and .env.example

feat: add AUTO_CREATE_DATASET env var to control dataset auto-creation

feat: professional README, .env.example, architecture diagram

fix: ensure password auth is set in all startup paths

feat: switch to password auth + project README

fix: add dangerouslyDisableDeviceAuth for remote WS connections

fix: use fixed auth token + python-based token injection + restore entrypoint inject

fix: disable auth (mode:none) + patch CSP frame-ancestors for HF iframe embedding

fix: use auth:{} instead of auth:false (object required)

fix: disable gateway auth (HF provides access control), remove token inject hack

fix: remove empty apiKey (config invalid), add HF origins to CSP allowedOrigins

perf: node user build (-104s chown), merge RUN layers (-170s), plugin whitelist (-40s)

feat: add timing to all stages, fix OPENROUTER_API_KEY crash, async DNS

deploy: HuggingClaw with original Dockerfile