fix(runtime): migrate state before OpenClaw setup

Dockerfile

@@ -3,7 +3,7 @@ ARG OPENCLAW_BASE_IMAGE=ghcr.io/openclaw/openclaw:${OPENCLAW_VERSION}
 ARG UNYOLO_PLUGIN_VERSION=0.7.3
 ARG HF_BROKER_VERSION=hf-broker/v0.11.1
 ARG TELEGRAM_BOT_MUX_VERSION=0.1.0
-ARG MLCLAW_RUNTIME_IMAGE=ghcr.io/huggingface/mlclaw:0.12.6-openclaw-2026.9.2
+ARG MLCLAW_RUNTIME_IMAGE=ghcr.io/huggingface/mlclaw:0.12.7-openclaw-2026.9.2
 
 FROM ghcr.io/osolmaz/telegram-bot-mux:v${TELEGRAM_BOT_MUX_VERSION} AS telegram-bot-mux
 

dist/mlclaw.mjs

@@ -15383,7 +15383,7 @@ function nextLink(header) {
 
 // src/mlclaw/release-config.generated.ts
 var RELEASE_CONFIG = {
-  "packageVersion": "0.12.6",
+  "packageVersion": "0.12.7",
   "openclawVersion": "2026.9.2",
   "hfBrokerVersion": "hf-broker/v0.11.1",
   "telegramBotMuxVersion": "0.1.0",

entrypoint.sh

@@ -401,6 +401,26 @@ echo "[unyolo] preparing renamed OpenClaw plugin configuration"
 env HOME=/home/node USER=node LOGNAME=node \
   gosu "$OPENCLAW_IDENTITY" node /app/mlclaw-space-runtime.js prepare-unyolo-config
 
+# Repair restored configuration and state before any OpenClaw command validates
+# them. Newer OpenClaw releases can reject old configuration during setup.
+echo "[openclaw-migrate] applying safe persisted-state migrations"
+env \
+  -u MLCLAW_CREDENTIAL_KEY \
+  -u MLCLAW_SESSION_SECRET \
+  -u SESSION_SECRET \
+  -u OAUTH_CLIENT_SECRET \
+  -u HF_TOKEN \
+  -u HUGGINGFACE_HUB_TOKEN \
+  -u MLCLAW_BROKER_HF_TOKEN \
+  -u MLCLAW_ROUTER_TOKEN \
+  -u HF_ROUTER_TOKEN \
+  -u OPENAI_API_KEY \
+  -u TELEGRAM_BOT_TOKEN \
+  -u MLCLAW_UNYOLO_TELEGRAM_BOT_TOKEN \
+  HOME=/home/node USER=node LOGNAME=node \
+  gosu "$OPENCLAW_IDENTITY" node /app/openclaw.mjs doctor --fix --non-interactive
+echo "[openclaw-migrate] persisted-state migrations complete"
+
 # Let OpenClaw create its native workspace files. The ML Claw runtime waits for
 # native onboarding to finish before adding workspace tooling; OpenClaw treats
 # any preinstalled workspace skills as evidence that onboarding already ran.
@@ -444,27 +464,6 @@ if [ -n "${TELEGRAM_BOT_TOKEN:-}" ] && [ "$TELEGRAM_BOT_MUX_ENABLED" != "1" ] &&
   fi
 fi
 
-# Run OpenClaw's safe persisted-state migrations before ML Claw imports the
-# deployment-scoped OAuth profile. Newer OpenClaw releases reject writes to an
-# older agent database until doctor migrates it in place.
-echo "[openclaw-migrate] applying safe persisted-state migrations"
-env \
-  -u MLCLAW_CREDENTIAL_KEY \
-  -u MLCLAW_SESSION_SECRET \
-  -u SESSION_SECRET \
-  -u OAUTH_CLIENT_SECRET \
-  -u HF_TOKEN \
-  -u HUGGINGFACE_HUB_TOKEN \
-  -u MLCLAW_BROKER_HF_TOKEN \
-  -u MLCLAW_ROUTER_TOKEN \
-  -u HF_ROUTER_TOKEN \
-  -u OPENAI_API_KEY \
-  -u TELEGRAM_BOT_TOKEN \
-  -u MLCLAW_UNYOLO_TELEGRAM_BOT_TOKEN \
-  HOME=/home/node USER=node LOGNAME=node \
-  gosu "$OPENCLAW_IDENTITY" node /app/openclaw.mjs doctor --fix --non-interactive
-echo "[openclaw-migrate] persisted-state migrations complete"
-
 chown_openclaw_live
 # The wrapper remains the trusted root supervisor so its OAuth credentials and
 # process environment are not readable by the unprivileged OpenClaw child. The

package.json

@@ -1,6 +1,6 @@
 {
   "name": "mlclaw",
-  "version": "0.12.6",
+  "version": "0.12.7",
   "license": "MIT",
   "config": {
     "openclawVersion": "2026.9.2",

src/mlclaw/release-config.generated.ts

@@ -1,6 +1,6 @@
 // Generated from package.json by scripts/sync-release-config.mjs. Do not edit.
 export const RELEASE_CONFIG = {
-  "packageVersion": "0.12.6",
+  "packageVersion": "0.12.7",
   "openclawVersion": "2026.9.2",
   "hfBrokerVersion": "hf-broker/v0.11.1",
   "telegramBotMuxVersion": "0.1.0",

test/mlclaw.runtime-image.test.ts

@@ -241,6 +241,9 @@ describe("runtime image Dockerfile", () => {
     );
     expect(entrypoint).toContain('export MLCLAW_STATE_HF_TOKEN="$STATE_HF_TOKEN"');
     expect(entrypoint).toContain('gosu "$OPENCLAW_IDENTITY" node /app/openclaw.mjs doctor --fix --non-interactive');
+    expect(entrypoint.indexOf("node /app/openclaw.mjs doctor --fix --non-interactive")).toBeLessThan(
+      entrypoint.indexOf("node /app/openclaw.mjs setup --baseline"),
+    );
     expect(entrypoint.indexOf("node /app/openclaw.mjs doctor --fix --non-interactive")).toBeLessThan(
       entrypoint.indexOf("node /app/hf-state-sync.js supervise"),
     );