create-openclaw-bot 5.1.1 → 5.1.2

package/CHANGELOG.md

@@ -1,6 +1,18 @@
 # Changelog (English)
 
 
+## [5.1.2] — 2026-04-06
+
+### 🐛 Fix Shell Injection: Sync Script Now Uses Base64 Encoding
+
+The `node -e "...JSON.stringify(script)..."` approach caused `/bin/sh: Syntax error: "(" unexpected` because `JSON.stringify` produces a double-quoted string that breaks out of the surrounding `node -e "..."` shell argument.
+
+- **Fix**: sync script content is now **base64-encoded at compose-generation time** using `Buffer.from(script).toString('base64')`
+- The generated entrypoint becomes: `node -e "require('fs').writeFileSync('/tmp/sync.js',Buffer.from('<b64>','base64').toString())"`
+- Base64 output contains only `[A-Za-z0-9+/=]` — zero shell quoting issues, works in YAML `|` blocks without escaping
+- Applies to all compose generation paths: Docker web wizard (`setup.js` × 2) and Docker CLI (`cli.js` × 2)
+
+
 ## [5.1.1] — 2026-04-06
 
 ### 🔧 9Router Smart-Route Sync — Stable via API

package/CHANGELOG.vi.md

@@ -1,6 +1,18 @@
 # Changelog (Tiếng Việt)
 
 
+## [5.1.2] — 2026-04-06
+
+### 🐛 Fix Shell Injection: Sync Script Dùng Base64
+
+Approach node -e JSON.stringify gây lỗi /bin/sh: Syntax error "(" unexpected vì JSON.stringify sinh chuỗi double-quoted phá vỡ shell argument.
+
+- **Fix**: nội dung sync script nay được **base64-encode tại thời điểm gen compose** bằng Buffer.from(script).toString base64
+- Entrypoint sinh ra dạng: node -e writeFileSync Buffer.from b64 base64 toString
+- Base64 chỉ chứa [A-Za-z0-9+/=] — không có ký tự đặc biệt, hoạt động đúng trong YAML block
+- Áp dụng cho tất cả luồng gen compose: Docker web wizard (setup.js x2) và Docker CLI (cli.js x2)
+
+
 ## [5.1.1] — 2026-04-06
 
 ### 🔧 9Router Smart-Route Sync — Ổn định qua API

package/README.md

@@ -3,7 +3,7 @@
 # 🦞 OpenClaw Setup
 
 <p align="center">
-  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.1.1-0EA5E9?style=for-the-badge" alt="Version 5.1.1" /></a>
+  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.1.2-0EA5E9?style=for-the-badge" alt="Version 5.1.2" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup?tab=MIT-1-ov-file"><img src="https://img.shields.io/badge/LICENSE-MIT-success?style=for-the-badge" alt="MIT License" /></a>
   <a href="https://www.npmjs.com/package/create-openclaw-bot"><img src="https://img.shields.io/npm/v/create-openclaw-bot?style=for-the-badge&label=CLI&color=2563EB&logo=npm&logoColor=white" alt="NPM Version" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup/stargazers"><img src="https://img.shields.io/github/stars/tuanminhhole/openclaw-setup?style=for-the-badge&color=eab308&logo=github&logoColor=white" alt="GitHub Stars" /></a>
@@ -24,7 +24,7 @@ An interactive **CLI tool** and **Setup Wizard** to deploy your own free AI Bot
 
 ---
 
-## 🆕 What's new in v5.1.1
+## 🆕 What's new in v5.1.2
 
 - 💻 **OS-First Setup** — Step 1 is now choosing your OS (Windows, macOS, Ubuntu, VPS). All scripts, configs, and instructions are generated to match.
 - 🧠 **Gemma 4 — 4 sizes** — `gemma4:e2b` (~4 GB), `gemma4:e4b` (~8 GB), `gemma4:26b` (~18 GB), `gemma4:31b` (~24 GB). Auto-pulled on first launch.
@@ -112,7 +112,7 @@ Run in your terminal → follow the interactive prompts → startup script is ge
 2. Open this repo as your workspace
 3. Paste into chat:
    ```
-   Read SETUP.md and set up OpenClaw v5.1.1 for me.
+   Read SETUP.md and set up OpenClaw v5.1.2 for me.
    My bot token is X. Use 9Router (no API key).
    My project folder: <YOUR_PATH>
    ```

package/README.vi.md

@@ -3,7 +3,7 @@
 # 🦞 OpenClaw Setup
 
 <p align="center">
-  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.1.1-0EA5E9?style=for-the-badge" alt="Version 5.1.1" /></a>
+  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.1.2-0EA5E9?style=for-the-badge" alt="Version 5.1.2" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup?tab=MIT-1-ov-file"><img src="https://img.shields.io/badge/LICENSE-MIT-success?style=for-the-badge" alt="MIT License" /></a>
   <a href="https://www.npmjs.com/package/create-openclaw-bot"><img src="https://img.shields.io/npm/v/create-openclaw-bot?style=for-the-badge&label=CLI&color=2563EB&logo=npm&logoColor=white" alt="NPM Version" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup/stargazers"><img src="https://img.shields.io/github/stars/tuanminhhole/openclaw-setup?style=for-the-badge&color=eab308&logo=github&logoColor=white" alt="GitHub Stars" /></a>
@@ -24,7 +24,7 @@ Công cụ **CLI tương tác** và **Setup Wizard** để tự triển khai Bot
 
 ---
 
-## 🆕 Có gì mới trong v5.1.1
+## 🆕 Có gì mới trong v5.1.2
 
 - 💻 **OS-First Setup** — Bước đầu tiên bây giờ là chọn hệ điều hành của bạn (Windows, macOS, Ubuntu, VPS). Toàn bộ script, cấu hình và hướng dẫn được tạo ra phù hợp với lựa chọn đó.
 - 🧠 **Gemma 4 — 4 kích thước** — `gemma4:e2b` (~4 GB), `gemma4:e4b` (~8 GB), `gemma4:26b` (~18 GB), `gemma4:31b` (~24 GB). Tự pull về khi bot khởi động lần đầu.
@@ -112,7 +112,7 @@ Chạy lệnh trên trong Terminal → làm theo các prompt tương tác → sc
 2. Mở repo này làm workspace
 3. Paste vào chat:
    ```
-   Read SETUP.md and set up OpenClaw v5.1.1 for me.
+   Read SETUP.md and set up OpenClaw v5.1.2 for me.
    My bot token is X. Use 9Router (no API key).
    My project folder: <THƯ_MỤC_CỦA_BẠN>
    ```

package/cli.js

@@ -1,4 +1,4 @@
-#!/usr/bin/env node
+#!/usr/bin/env node
 
 import { input, select, checkbox, confirm } from '@inquirer/prompts';
 import fs from 'fs-extra';
@@ -1312,7 +1312,7 @@ ${dependsOn}${extraHosts}    ports:
       - -c
       - |
         npm install -g 9router
-        node -e "require('fs').writeFileSync('/tmp/sync.js',${JSON.stringify(syncComboScript)})"
+        node -e "require('fs').writeFileSync('/tmp/sync.js',Buffer.from('\${Buffer.from(syncComboScript).toString('base64')}','base64').toString())"
         node /tmp/sync.js > /tmp/sync.log 2>&1 &
         exec 9router -n -t -l -H 0.0.0.0 -p 20128 --skip-update
     environment:
@@ -1407,7 +1407,7 @@ ${hasBrowserDesktop ? `    extra_hosts:\n      - "host.docker.internal:host-gate
       - -c
       - |
         npm install -g 9router
-        node -e "require('fs').writeFileSync('/tmp/sync.js',${JSON.stringify(syncComboScript)})"
+        node -e "require('fs').writeFileSync('/tmp/sync.js',Buffer.from('\${Buffer.from(syncComboScript).toString('base64')}','base64').toString())"
         node /tmp/sync.js > /tmp/sync.log 2>&1 &
         exec 9router -n -t -l -H 0.0.0.0 -p 20128 --skip-update
     environment:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-openclaw-bot",
-  "version": "5.1.1",
+  "version": "5.1.2",
   "description": "Interactive CLI installer for OpenClaw Bot",
   "main": "cli.js",
   "bin": {

package/setup.js

@@ -1920,7 +1920,7 @@ ${dependsOn}${extraHosts}    volumes:
       - -c
       - |
         npm install -g 9router
-        node -e "require('fs').writeFileSync('/tmp/sync.js',${JSON.stringify(syncScript)})"
+        node -e "require('fs').writeFileSync('/tmp/sync.js',Buffer.from('\${Buffer.from(syncScript).toString('base64')}','base64').toString())"
         node /tmp/sync.js > /tmp/sync.log 2>&1 &
         exec 9router -n -t -l -H 0.0.0.0 -p 20128 --skip-update
     environment:
@@ -2016,7 +2016,7 @@ ${extraHostsBlock}
       - -c
       - |
         npm install -g 9router
-        node -e "require('fs').writeFileSync('/tmp/sync.js',${JSON.stringify(syncScript)})"
+        node -e "require('fs').writeFileSync('/tmp/sync.js',Buffer.from('\${Buffer.from(syncScript).toString('base64')}','base64').toString())"
         node /tmp/sync.js > /tmp/sync.log 2>&1 &
         exec 9router -n -t -l -H 0.0.0.0 -p 20128 --skip-update
     environment: