From fd0c846c597c236c767bc4405da5fd64821e3dfd Mon Sep 17 00:00:00 2001 From: Onur Solmaz <2453968+osolmaz@users.noreply.github.com> Date: Mon, 7 Sep 2026 18:12:36 +0800 Subject: [PATCH] fix(runtime): migrate state before OpenClaw setup --- Dockerfile | 2 +- dist/mlclaw.mjs | 2 +- entrypoint.sh | 41 +++++++++++++------------- package-lock.json | 4 +-- package.json | 2 +- src/mlclaw/release-config.generated.ts | 2 +- test/mlclaw.runtime-image.test.ts | 3 ++ 7 files changed, 29 insertions(+), 27 deletions(-) diff --git a/Dockerfile b/Dockerfile index ab470b9..a6061f7 100644 --- a/Dockerfile +++ b/Dockerfile @@ -3,7 +3,7 @@ ARG OPENCLAW_BASE_IMAGE=ghcr.io/openclaw/openclaw:${OPENCLAW_VERSION} ARG UNYOLO_PLUGIN_VERSION=0.7.3 ARG HF_BROKER_VERSION=hf-broker/v0.11.1 ARG TELEGRAM_BOT_MUX_VERSION=0.1.0 -ARG MLCLAW_RUNTIME_IMAGE=ghcr.io/huggingface/mlclaw:0.12.6-openclaw-2026.9.2 +ARG MLCLAW_RUNTIME_IMAGE=ghcr.io/huggingface/mlclaw:0.12.7-openclaw-2026.9.2 FROM ghcr.io/osolmaz/telegram-bot-mux:v${TELEGRAM_BOT_MUX_VERSION} AS telegram-bot-mux diff --git a/dist/mlclaw.mjs b/dist/mlclaw.mjs index 13364a5..ad36a2e 100755 --- a/dist/mlclaw.mjs +++ b/dist/mlclaw.mjs @@ -15383,7 +15383,7 @@ function nextLink(header) { // src/mlclaw/release-config.generated.ts var RELEASE_CONFIG = { - "packageVersion": "0.12.6", + "packageVersion": "0.12.7", "openclawVersion": "2026.9.2", "hfBrokerVersion": "hf-broker/v0.11.1", "telegramBotMuxVersion": "0.1.0", diff --git a/entrypoint.sh b/entrypoint.sh index 3c59483..6075773 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -401,6 +401,26 @@ echo "[unyolo] preparing renamed OpenClaw plugin configuration" env HOME=/home/node USER=node LOGNAME=node \ gosu "$OPENCLAW_IDENTITY" node /app/mlclaw-space-runtime.js prepare-unyolo-config +# Repair restored configuration and state before any OpenClaw command validates +# them. Newer OpenClaw releases can reject old configuration during setup. +echo "[openclaw-migrate] applying safe persisted-state migrations" +env \ + -u MLCLAW_CREDENTIAL_KEY \ + -u MLCLAW_SESSION_SECRET \ + -u SESSION_SECRET \ + -u OAUTH_CLIENT_SECRET \ + -u HF_TOKEN \ + -u HUGGINGFACE_HUB_TOKEN \ + -u MLCLAW_BROKER_HF_TOKEN \ + -u MLCLAW_ROUTER_TOKEN \ + -u HF_ROUTER_TOKEN \ + -u OPENAI_API_KEY \ + -u TELEGRAM_BOT_TOKEN \ + -u MLCLAW_UNYOLO_TELEGRAM_BOT_TOKEN \ + HOME=/home/node USER=node LOGNAME=node \ + gosu "$OPENCLAW_IDENTITY" node /app/openclaw.mjs doctor --fix --non-interactive +echo "[openclaw-migrate] persisted-state migrations complete" + # Let OpenClaw create its native workspace files. The ML Claw runtime waits for # native onboarding to finish before adding workspace tooling; OpenClaw treats # any preinstalled workspace skills as evidence that onboarding already ran. @@ -444,27 +464,6 @@ if [ -n "${TELEGRAM_BOT_TOKEN:-}" ] && [ "$TELEGRAM_BOT_MUX_ENABLED" != "1" ] && fi fi -# Run OpenClaw's safe persisted-state migrations before ML Claw imports the -# deployment-scoped OAuth profile. Newer OpenClaw releases reject writes to an -# older agent database until doctor migrates it in place. -echo "[openclaw-migrate] applying safe persisted-state migrations" -env \ - -u MLCLAW_CREDENTIAL_KEY \ - -u MLCLAW_SESSION_SECRET \ - -u SESSION_SECRET \ - -u OAUTH_CLIENT_SECRET \ - -u HF_TOKEN \ - -u HUGGINGFACE_HUB_TOKEN \ - -u MLCLAW_BROKER_HF_TOKEN \ - -u MLCLAW_ROUTER_TOKEN \ - -u HF_ROUTER_TOKEN \ - -u OPENAI_API_KEY \ - -u TELEGRAM_BOT_TOKEN \ - -u MLCLAW_UNYOLO_TELEGRAM_BOT_TOKEN \ - HOME=/home/node USER=node LOGNAME=node \ - gosu "$OPENCLAW_IDENTITY" node /app/openclaw.mjs doctor --fix --non-interactive -echo "[openclaw-migrate] persisted-state migrations complete" - chown_openclaw_live # The wrapper remains the trusted root supervisor so its OAuth credentials and # process environment are not readable by the unprivileged OpenClaw child. The diff --git a/package-lock.json b/package-lock.json index cba07b6..5889f88 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "mlclaw", - "version": "0.12.6", + "version": "0.12.7", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "mlclaw", - "version": "0.12.6", + "version": "0.12.7", "license": "MIT", "dependencies": { "@clack/prompts": "^1.4.0", diff --git a/package.json b/package.json index 9b15ea5..9e1a1f6 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "mlclaw", - "version": "0.12.6", + "version": "0.12.7", "license": "MIT", "config": { "openclawVersion": "2026.9.2", diff --git a/src/mlclaw/release-config.generated.ts b/src/mlclaw/release-config.generated.ts index 27dd7cb..ef9bb80 100644 --- a/src/mlclaw/release-config.generated.ts +++ b/src/mlclaw/release-config.generated.ts @@ -1,6 +1,6 @@ // Generated from package.json by scripts/sync-release-config.mjs. Do not edit. export const RELEASE_CONFIG = { - "packageVersion": "0.12.6", + "packageVersion": "0.12.7", "openclawVersion": "2026.9.2", "hfBrokerVersion": "hf-broker/v0.11.1", "telegramBotMuxVersion": "0.1.0", diff --git a/test/mlclaw.runtime-image.test.ts b/test/mlclaw.runtime-image.test.ts index 2f38002..288289f 100644 --- a/test/mlclaw.runtime-image.test.ts +++ b/test/mlclaw.runtime-image.test.ts @@ -241,6 +241,9 @@ describe("runtime image Dockerfile", () => { ); expect(entrypoint).toContain('export MLCLAW_STATE_HF_TOKEN="$STATE_HF_TOKEN"'); expect(entrypoint).toContain('gosu "$OPENCLAW_IDENTITY" node /app/openclaw.mjs doctor --fix --non-interactive'); + expect(entrypoint.indexOf("node /app/openclaw.mjs doctor --fix --non-interactive")).toBeLessThan( + entrypoint.indexOf("node /app/openclaw.mjs setup --baseline"), + ); expect(entrypoint.indexOf("node /app/openclaw.mjs doctor --fix --non-interactive")).toBeLessThan( entrypoint.indexOf("node /app/hf-state-sync.js supervise"), );