create-openclaw-bot 5.1.14 → 5.2.0

package/cli.js

@@ -5,11 +5,13 @@ import fs from 'fs-extra';
 import path from 'path';
 import os from 'os';
 import chalk from 'chalk';
-import { spawn, execSync, execFileSync } from 'child_process';
-const TELEGRAM_RELAY_PLUGIN_ID = 'openclaw-telegram-multibot-relay';
+import { spawn, execSync, execFileSync } from 'child_process';
+const TELEGRAM_RELAY_PLUGIN_RUNTIME_ID = 'telegram-multibot-relay';
+const TELEGRAM_RELAY_PLUGIN_PACKAGE = 'openclaw-telegram-multibot-relay';
 const OPENCLAW_NPM_SPEC = 'openclaw@2026.4.5';
-// Use plain npm package name — clawhub: protocol not supported in all OpenClaw versions
-const TELEGRAM_RELAY_PLUGIN_SPEC = TELEGRAM_RELAY_PLUGIN_ID;
+const OPENCLAW_RUNTIME_PACKAGES = 'grammy @grammyjs/runner @grammyjs/transformer-throttler @buape/carbon @larksuiteoapi/node-sdk @slack/web-api';
+// Use plain npm package name — clawhub: protocol not supported in all OpenClaw versions
+const TELEGRAM_RELAY_PLUGIN_SPEC = TELEGRAM_RELAY_PLUGIN_PACKAGE;
 
 // Install command: only use clawhub: spec (published to ClawHub)
 function buildRelayPluginInstallCommand(prefix = 'openclaw') {
@@ -20,13 +22,17 @@ function buildRelayPluginInstallCommandWin(prefix = 'openclaw') {
   return `${prefix} plugins install ${TELEGRAM_RELAY_PLUGIN_SPEC} || exit /b 0`;
 }
 
-function installRelayPluginForProject(projectDir, isVi) {
-  try {
-    execSync(`openclaw plugins install ${TELEGRAM_RELAY_PLUGIN_SPEC}`, { cwd: projectDir, stdio: 'ignore' });
-    return true;
-  } catch {
-    // silent fallback
-  }
+function installRelayPluginForProject(projectDir, isVi) {
+  try {
+    execSync(`openclaw plugins install ${TELEGRAM_RELAY_PLUGIN_SPEC}`, {
+      cwd: projectDir,
+      stdio: 'ignore',
+      env: getProjectRuntimeEnv(projectDir),
+    });
+    return true;
+  } catch {
+    // silent fallback
+  }
   console.log(chalk.yellow(isVi
     ? `\n⚠️  Chua the tu dong cai plugin. Sau khi bot chay, chay thu cong:\n   openclaw plugins install ${TELEGRAM_RELAY_PLUGIN_SPEC}`
     : `\n⚠️  Could not auto-install plugin. After the bot starts, run manually:\n   openclaw plugins install ${TELEGRAM_RELAY_PLUGIN_SPEC}`));
@@ -114,19 +120,23 @@ function resolveWindowsCommand(command) {
   }
 }
 
-function spawnBackgroundProcess(command, args, options = {}) {
-  const { cwd, env = {} } = options;
-  const mergedEnv = { ...process.env, ...env };
-
-  if (process.platform === 'win32') {
-    const resolvedCommand = resolveWindowsCommand(command);
-    const argList = args.map((arg) => quotePowerShellSingle(arg)).join(', ');
-    const startProcessScript = [
-      `$filePath = ${quotePowerShellSingle(resolvedCommand)}`,
-      `$workingDir = ${quotePowerShellSingle(cwd || process.cwd())}`,
-      `$argList = @(${argList})`,
-      "Start-Process -WindowStyle Hidden -FilePath $filePath -WorkingDirectory $workingDir -ArgumentList $argList"
-    ].join('; ');
+function spawnBackgroundProcess(command, args, options = {}) {
+  const { cwd, env = {} } = options;
+  const mergedEnv = { ...process.env, ...env };
+
+  if (process.platform === 'win32') {
+    const resolvedCommand = resolveWindowsCommand(command);
+    const argList = args.map((arg) => quotePowerShellSingle(arg)).join(', ');
+    const envAssignments = Object.entries(env)
+      .map(([key, value]) => `$env:${key}=${quotePowerShellSingle(String(value))}`)
+      .join('; ');
+    const startProcessScript = [
+      `$filePath = ${quotePowerShellSingle(resolvedCommand)}`,
+      `$workingDir = ${quotePowerShellSingle(cwd || process.cwd())}`,
+      `$argList = @(${argList})`,
+      ...(envAssignments ? [envAssignments] : []),
+      "Start-Process -WindowStyle Hidden -FilePath $filePath -WorkingDirectory $workingDir -ArgumentList $argList"
+    ].join('; ');
 
     return spawn('powershell.exe', ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-Command', startProcessScript], {
       cwd,
@@ -146,26 +156,38 @@ function spawnBackgroundProcess(command, args, options = {}) {
   });
 }
 
-function resolveNative9RouterDesktopLaunch() {
-  return {
-    command: process.execPath,
-    args: [path.join(getGlobalNpmRoot(), '9router', 'app', 'server.js')],
-    env: {
-      PORT: '20128',
-      HOSTNAME: '0.0.0.0'
-    }
-  };
-}
-
-function getNative9RouterDataDir() {
-  if (process.platform === 'win32') {
-    return path.join(process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming'), '9router');
-  }
-
-  return path.join(os.homedir(), '.9router');
-}
-
-function getGatewayAllowedOrigins(port) {
+function resolveNative9RouterDesktopLaunch() {
+  const serverEntry = get9RouterServerEntryCandidates().find((candidate) => fs.existsSync(candidate))
+    || get9RouterServerEntryCandidates()[0];
+  return {
+    command: process.execPath,
+    args: [serverEntry],
+    env: {
+      PORT: '20128',
+      HOSTNAME: '0.0.0.0'
+    }
+  };
+}
+
+function getProjectOpenClawHome(projectDir) {
+  return path.join(projectDir, '.openclaw');
+}
+
+function getProject9RouterDataDir(projectDir) {
+  return path.join(projectDir, '.9router');
+}
+
+function getProjectRuntimeEnv(projectDir, extraEnv = {}) {
+  return {
+    ...process.env,
+    OPENCLAW_HOME: getProjectOpenClawHome(projectDir),
+    OPENCLAW_STATE_DIR: getProjectOpenClawHome(projectDir),
+    DATA_DIR: getProject9RouterDataDir(projectDir),
+    ...extraEnv,
+  };
+}
+
+function getGatewayAllowedOrigins(port) {
   const normalizedPort = Number(port) || 18791;
   const origins = new Set([
     `http://localhost:${normalizedPort}`,
@@ -427,7 +449,7 @@ function resolveCommandOnPath(command) {
   }
 }
 
-function getGlobalNpmRoot() {
+function getGlobalNpmRoot() {
   try {
     return execSync('npm root -g', {
       stdio: ['ignore', 'pipe', 'ignore'],
@@ -435,13 +457,57 @@ function getGlobalNpmRoot() {
       shell: true,
       env: process.env
     }).trim();
-  } catch {
-    if (process.platform === 'win32') {
-      return path.join(process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming'), 'npm', 'node_modules');
-    }
-    return path.join(os.homedir(), '.local', 'lib', 'node_modules');
-  }
-}
+  } catch {
+    if (process.platform === 'win32') {
+      return path.join(process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming'), 'npm', 'node_modules');
+    }
+    return path.join(os.homedir(), '.local', 'share', 'npm', 'lib', 'node_modules');
+  }
+}
+
+function getNativeOpenClawRootDir(projectDir = '.') {
+  return path.join(projectDir, '.openclaw').replace(/\\/g, '/');
+}
+
+function getGeneratedWorkspaceRoot(deployMode, projectDir = '.') {
+  return deployMode === 'native' ? getNativeOpenClawRootDir(projectDir) : '/root/.openclaw';
+}
+
+function get9RouterServerEntryCandidates() {
+  const homeDir = os.homedir();
+  const npmRoots = [];
+
+  try {
+    const root = execSync('npm root -g', {
+      stdio: ['ignore', 'pipe', 'ignore'],
+      encoding: 'utf8',
+      shell: true,
+      env: process.env
+    }).trim();
+    if (root) npmRoots.push(root);
+  } catch {
+    // handled by fallback candidates below
+  }
+
+  const prefixes = [
+    process.env.npm_config_prefix,
+    process.env.NPM_CONFIG_PREFIX,
+    process.env.PREFIX,
+    process.env.NPM_PREFIX,
+    path.join(homeDir, '.local'),
+    path.join(homeDir, '.npm-global'),
+    path.join(homeDir, '.local', 'share', 'npm')
+  ].filter(Boolean);
+
+  for (const prefix of prefixes) {
+    npmRoots.push(path.join(prefix, 'lib', 'node_modules'));
+  }
+
+  npmRoots.push(path.join(homeDir, '.local', 'lib', 'node_modules'));
+  npmRoots.push(getGlobalNpmRoot());
+
+  return [...new Set(npmRoots.map((root) => path.join(root, '9router', 'app', 'server.js')))];
+}
 
 function indentBlock(text, spaces) {
   const prefix = ' '.repeat(spaces);
@@ -460,26 +526,26 @@ function build9RouterComposeEntrypointScript(syncScriptBase64) {
   ].join('\n');
 }
 
-async function writeNative9RouterSyncScript(projectDir) {
-  const syncScriptPath = path.join(projectDir, '.openclaw', '9router-smart-route-sync.js');
-  await fs.ensureDir(path.dirname(syncScriptPath));
-  await fs.writeFile(syncScriptPath, build9RouterSmartRouteSyncScript(path.join(getNative9RouterDataDir(), 'db.json')));
-  return syncScriptPath;
-}
+async function writeNative9RouterSyncScript(projectDir) {
+  const syncScriptPath = path.join(projectDir, '.openclaw', '9router-smart-route-sync.js');
+  await fs.ensureDir(path.dirname(syncScriptPath));
+  await fs.writeFile(syncScriptPath, build9RouterSmartRouteSyncScript(path.join(getProject9RouterDataDir(projectDir), 'db.json')));
+  return syncScriptPath;
+}
 
 function extractFirstHttpUrl(text) {
   const match = String(text || '').match(/https?:\/\/[^\s"'`]+/);
   return match ? match[0] : null;
 }
 
-function getTokenizedDashboardUrl(projectDir) {
-  try {
-    const output = execSync('openclaw dashboard', {
-      cwd: projectDir,
-      env: process.env,
-      encoding: 'utf8',
-      shell: true,
-      stdio: ['ignore', 'pipe', 'pipe'],
+function getTokenizedDashboardUrl(projectDir) {
+  try {
+    const output = execSync('openclaw dashboard', {
+      cwd: projectDir,
+      env: getProjectRuntimeEnv(projectDir),
+      encoding: 'utf8',
+      shell: true,
+      stdio: ['ignore', 'pipe', 'pipe'],
       timeout: 15000
     });
     return extractFirstHttpUrl(output);
@@ -607,14 +673,14 @@ function extractZaloPairingCode(text) {
   return null;
 }
 
-function approveZaloPairingCode({ pairingCode, projectDir, isVi }) {
-  try {
-    execSync(`openclaw pairing approve zalouser ${pairingCode}`, {
-      cwd: projectDir,
-      stdio: 'inherit',
-      shell: true,
-      env: process.env
-    });
+function approveZaloPairingCode({ pairingCode, projectDir, isVi }) {
+  try {
+    execSync(`openclaw pairing approve zalouser ${pairingCode}`, {
+      cwd: projectDir,
+      stdio: 'inherit',
+      shell: true,
+      env: getProjectRuntimeEnv(projectDir)
+    });
     console.log(chalk.green(isVi
       ? `✅ Da tu dong approve pairing code Zalo: ${pairingCode}`
       : `✅ Automatically approved the Zalo pairing code: ${pairingCode}`));
@@ -645,11 +711,12 @@ async function runNativeZaloPersonalLoginFlow({ isVi, projectDir }) {
     // ignore stale project QR cleanup failures
   }
 
-  const child = spawn('openclaw', ['channels', 'login', '--channel', 'zalouser', '--verbose'], {
-    cwd: projectDir,
-    stdio: ['inherit', 'pipe', 'pipe'],
-    shell: process.platform === 'win32'
-  });
+  const child = spawn('openclaw', ['channels', 'login', '--channel', 'zalouser', '--verbose'], {
+    cwd: projectDir,
+    stdio: ['inherit', 'pipe', 'pipe'],
+    shell: process.platform === 'win32',
+    env: getProjectRuntimeEnv(projectDir),
+  });
 
   let loginSucceeded = false;
   let approvedPairingCode = null;
@@ -712,14 +779,14 @@ async function runNativeZaloPersonalLoginFlow({ isVi, projectDir }) {
   }
 }
 
-function runPm2Save({ projectDir, isVi }) {
-  try {
-    execSync('pm2 save', {
-      cwd: projectDir,
-      stdio: 'inherit',
-      shell: true,
-      env: process.env
-    });
+function runPm2Save({ projectDir, isVi }) {
+  try {
+    execSync('pm2 save', {
+      cwd: projectDir,
+      stdio: 'inherit',
+      shell: true,
+      env: getProjectRuntimeEnv(projectDir)
+    });
   } catch {
     console.log(chalk.yellow(isVi
       ? '⚠️  PM2 save khong hoan tat. Bot van co the dang chay, nhung hay thu chay lai `pm2 save` sau.'
@@ -727,9 +794,9 @@ function runPm2Save({ projectDir, isVi }) {
   }
 }
 
-function startNative9RouterPm2({ isVi, projectDir, appName, syncScriptPath }) {
-  const routerAppName = `${appName}-9router`;
-  const routerLaunch = resolveNative9RouterDesktopLaunch();
+function startNative9RouterPm2({ isVi, projectDir, appName, syncScriptPath }) {
+  const routerAppName = `${appName}-9router`;
+  const routerLaunch = resolveNative9RouterDesktopLaunch();
   execFileSync('pm2', [
     'start',
     routerLaunch.command,
@@ -741,11 +808,11 @@ function startNative9RouterPm2({ isVi, projectDir, appName, syncScriptPath }) {
     'none',
     '--',
     ...routerLaunch.args
-  ], {
-    cwd: projectDir,
-    stdio: 'inherit',
-    env: { ...process.env, ...routerLaunch.env }
-  });
+  ], {
+    cwd: projectDir,
+    stdio: 'inherit',
+    env: getProjectRuntimeEnv(projectDir, routerLaunch.env)
+  });
   if (syncScriptPath) {
     const syncAppName = `${appName}-9router-sync`;
     const normalizedSyncScriptPath = syncScriptPath.replace(/\\/g, '/');
@@ -759,19 +826,19 @@ function startNative9RouterPm2({ isVi, projectDir, appName, syncScriptPath }) {
         projectDir.replace(/\\/g, '/'),
         '--interpreter',
         process.execPath
-      ], {
-        cwd: projectDir,
-        stdio: 'inherit',
-        env: process.env
-      });
+      ], {
+        cwd: projectDir,
+        stdio: 'inherit',
+        env: getProjectRuntimeEnv(projectDir)
+      });
     } catch {
       try {
-        execSync(`nohup "${process.execPath}" "${normalizedSyncScriptPath}" >/tmp/${syncAppName}.log 2>&1 &`, {
-          cwd: projectDir,
-          stdio: 'ignore',
-          shell: true,
-          env: process.env
-        });
+        execSync(`nohup "${process.execPath}" "${normalizedSyncScriptPath}" >/tmp/${syncAppName}.log 2>&1 &`, {
+          cwd: projectDir,
+          stdio: 'ignore',
+          shell: true,
+          env: getProjectRuntimeEnv(projectDir)
+        });
         console.log(chalk.yellow(isVi
           ? `⚠️  PM2 khong khoi dong duoc sync helper. Da fallback sang background node: /tmp/${syncAppName}.log`
           : `⚠️  PM2 could not start the sync helper. Fell back to a background node process: /tmp/${syncAppName}.log`));
@@ -787,24 +854,21 @@ function startNative9RouterPm2({ isVi, projectDir, appName, syncScriptPath }) {
   console.log(chalk.gray(isVi ? `   Xem log: pm2 logs ${routerAppName}` : `   View logs: pm2 logs ${routerAppName}`));
 }
 
-async function syncLocalConfigToHome(projectDir, isVi) {
-  const homedir = os.homedir();
-  const globalClawDir = path.join(homedir, '.openclaw');
-  const localClawDir = path.join(projectDir, '.openclaw');
-  try {
-    await fs.ensureDir(globalClawDir);
-    await fs.copy(localClawDir, globalClawDir, { overwrite: true });
-    console.log(chalk.green(`\n✅ ${isVi
-      ? 'Config đã được sync vào ~/.openclaw/ — openclaw sẵn sàng!'
-      : 'Config synced to ~/.openclaw/ — openclaw is ready!'}`));
-    return true;
-  } catch {
-    console.log(chalk.yellow(`\n⚠️  ${isVi
-      ? `Không thể tự sync config. Chạy thủ công:\n   cp -rn ${localClawDir}/. ${globalClawDir}/`
-      : `Could not auto-sync config. Run manually:\n   cp -rn ${localClawDir}/. ${globalClawDir}/`}`));
-    return false;
-  }
-}
+async function ensureProjectRuntimeDirs(projectDir, isVi) {
+  try {
+    await fs.ensureDir(getProjectOpenClawHome(projectDir));
+    await fs.ensureDir(getProject9RouterDataDir(projectDir));
+    console.log(chalk.green(`\n✅ ${isVi
+      ? 'Runtime project đã sẵn sàng trong thư mục đã chọn.'
+      : 'The project runtime directories are ready inside the chosen folder.'}`));
+    return true;
+  } catch {
+    console.log(chalk.yellow(`\n⚠️  ${isVi
+      ? `Không thể tạo runtime folders trong project. Hãy tự kiểm tra: ${projectDir}`
+      : `Could not create the runtime folders inside the project. Check: ${projectDir}`}`));
+    return false;
+  }
+}
 
 function buildTelegramPostInstallChecklist({ isVi, bots, groupId }) {
   const botList = bots.map((bot, idx) => `- **${bot?.name || `Bot ${idx + 1}`}** — token: ${String(bot?.token || '').slice(0, 10)}...`).join('\n');
@@ -963,17 +1027,17 @@ const CHANNELS = {
   'zalo-personal': { name: 'Zalo Personal (Quét QR)', type: 'zalo-personal', icon: '📱' }
 };
 
-const PROVIDERS = {
-  '9router': { name: '9Router Proxy (Khuyên dùng)', icon: '🔀', isProxy: true },
-  'openai': { name: 'OpenAI (ChatGPT)', icon: '🧠', envKey: 'OPENAI_API_KEY' },
-  'ollama': { name: 'Local Ollama', icon: '🏠', isLocal: true },
-  'google': { name: 'Google (Gemini)', icon: '⚡', envKey: 'GEMINI_API_KEY' },
-  'anthropic': { name: 'Anthropic (Claude)', icon: '🦄', envKey: 'ANTHROPIC_API_KEY' },
-  'xai': { name: 'xAI (Grok)', icon: '✖️', envKey: 'XAI_API_KEY' },
-  'groq': { name: 'Groq (LPU)', icon: '🏎️', envKey: 'GROQ_API_KEY' }
-};
-
-const SKILLS = [
+const PROVIDERS = {
+  '9router': { name: '9Router Proxy (Khuyên dùng)', icon: '🔀', isProxy: true, supportsEmbeddings: false },
+  'openai': { name: 'OpenAI (ChatGPT)', icon: '🧠', envKey: 'OPENAI_API_KEY', supportsEmbeddings: true },
+  'ollama': { name: 'Local Ollama', icon: '🏠', isLocal: true, supportsEmbeddings: true },
+  'google': { name: 'Google (Gemini)', icon: '⚡', envKey: 'GEMINI_API_KEY', supportsEmbeddings: true },
+  'anthropic': { name: 'Anthropic (Claude)', icon: '🦄', envKey: 'ANTHROPIC_API_KEY', supportsEmbeddings: false },
+  'xai': { name: 'xAI (Grok)', icon: '✖️', envKey: 'XAI_API_KEY', supportsEmbeddings: false },
+  'groq': { name: 'Groq (LPU)', icon: '🏎️', envKey: 'GROQ_API_KEY', supportsEmbeddings: false }
+};
+
+const SKILLS = [
   // Web Search removed — OpenClaw has native search built-in
   { value: 'browser', name: '🌐 Browser Automation (Playwright) (⭐ Khuyên dùng)', checked: false, slug: null },
   { value: 'memory', name: '🧠 Long-term Memory (⭐ Khuyên dùng)', checked: false, slug: 'memory' },
@@ -983,10 +1047,124 @@ const SKILLS = [
   { value: 'code-interpreter', name: '💻 Code Interpreter (Python/JS)', checked: false, slug: 'code-interpreter' },
   { value: 'email', name: '📧 Email Assistant', checked: false, slug: 'email-assistant' },
   { value: 'tts', name: '🔊 Text-To-Speech (OpenAI/ElevenLabs)', checked: false, slug: 'tts' },
-];
+];
+
+function providerSupportsMemoryEmbeddings(providerKey) {
+  return !!PROVIDERS[providerKey]?.supportsEmbeddings;
+}
+
+function getCliSkillChoices({ providerKey, isVi }) {
+  return SKILLS.map((skill) => {
+    if (skill.value !== 'memory') return { ...skill };
+    const recommended = providerSupportsMemoryEmbeddings(providerKey);
+    return {
+      ...skill,
+      name: recommended
+        ? (isVi ? '🧠 Long-term Memory (⭐ Khuyên dùng)' : '🧠 Long-term Memory (⭐ Recommended)')
+        : '🧠 Long-term Memory'
+    };
+  });
+}
+
 
+
+// ─── Upgrade Mode ──────────────────────────────────────────────────────────
+// Usage: npx create-openclaw-bot@latest upgrade
+// Auto-detects Docker vs Native, updates OpenClaw, rebuilds/restarts.
+// Does NOT touch .env, memory, sessions, credentials.
+async function runUpgrade() {
+  console.log(chalk.red('\n=================================='));
+  console.log(chalk.redBright(LOGO));
+  console.log(chalk.cyan('     🔄 OpenClaw Upgrade Mode     '));
+  console.log(chalk.red('==================================\n'));
+
+  const projectDir        = process.cwd();
+  const dockerComposePath = path.join(projectDir, 'docker', 'openclaw', 'docker-compose.yml');
+  const dockerfilePath    = path.join(projectDir, 'docker', 'openclaw', 'Dockerfile');
+  const dockerDir         = path.join(projectDir, 'docker', 'openclaw');
+  const nativeOpenClawDir = path.join(projectDir, '.openclaw');
+  const dotEnvPath        = path.join(projectDir, '.env');
+
+  const isDockerSetup = fs.existsSync(dockerComposePath);
+  const isNativeSetup = fs.existsSync(nativeOpenClawDir) &&
+    (fs.existsSync(dotEnvPath) || fs.existsSync(path.join(nativeOpenClawDir, 'openclaw.json')));
+
+  if (!isDockerSetup && !isNativeSetup) {
+    console.log(chalk.red('\n❌ Khong tim thay project OpenClaw trong thu muc hien tai.'));
+    console.log(chalk.gray('   Da kiem tra: ' + projectDir));
+    console.log(chalk.yellow('\n💡 Di chuyen vao thu muc bot roi chay lai:'));
+    console.log(chalk.white('   npx create-openclaw-bot@latest upgrade'));
+    console.log(chalk.gray('\n   Windows: double-click upgrade.ps1'));
+    console.log(chalk.gray('   Linux/Mac: bash upgrade.sh'));
+    process.exit(1);
+  }
+
+  const mode = isDockerSetup ? 'docker' : 'native';
+  const modeLabel = mode === 'docker' ? '🐳 Docker' : '⚡ Native / PM2';
+  console.log(chalk.green('\n✅ Phat hien: ' + modeLabel));
+  console.log(chalk.gray('   Project: ' + projectDir));
+  console.log(chalk.cyan('\n📦 Cap nhat len ' + OPENCLAW_NPM_SPEC + '...\n'));
+
+  if (mode === 'docker') {
+    // Patch Dockerfile: update pinned openclaw version + force CACHEBUST
+    if (fs.existsSync(dockerfilePath)) {
+      let fc = fs.readFileSync(dockerfilePath, 'utf8');
+      const patched = fc
+        .replace(/npm install -g openclaw@\S+/g, 'npm install -g ' + OPENCLAW_NPM_SPEC)
+        .replace(/ARG CACHEBUST=\d+/g, 'ARG CACHEBUST=' + Date.now());
+      if (patched !== fc) {
+        fs.writeFileSync(dockerfilePath, patched);
+        console.log(chalk.green('  ✅ Dockerfile updated → ' + OPENCLAW_NPM_SPEC));
+      } else {
+        const refreshed = fc.replace(/ARG CACHEBUST=\d+/g, 'ARG CACHEBUST=' + Date.now());
+        if (refreshed !== fc) fs.writeFileSync(dockerfilePath, refreshed);
+        console.log(chalk.gray('  ℹ️  Dockerfile da o ' + OPENCLAW_NPM_SPEC + ', refresh CACHEBUST'));
+      }
+    }
+    console.log(chalk.cyan('\n🐳 Dang rebuild container...'));
+    try {
+      execSync('docker compose build --no-cache', { cwd: dockerDir, stdio: 'inherit', shell: true });
+      execSync('docker compose up -d', { cwd: dockerDir, stdio: 'inherit', shell: true });
+      console.log(chalk.green('\n✅ Upgrade hoan tat! Bot dang chay voi phien ban moi.'));
+    } catch {
+      console.log(chalk.red('\n❌ Loi Docker. Chay thu cong:'));
+      console.log(chalk.white('   cd "' + dockerDir + '"'));
+      console.log(chalk.white('   docker compose build --no-cache && docker compose up -d'));
+      process.exit(1);
+    }
+  }
+
+  if (mode === 'native') {
+    const osChoice = process.platform === 'win32' ? 'windows' : process.platform === 'darwin' ? 'macos' : 'vps';
+    const installed = installGlobalPackage(OPENCLAW_NPM_SPEC, { isVi: true, osChoice, displayName: 'openclaw' });
+    if (installed) console.log(chalk.green('  ✅ openclaw → ' + OPENCLAW_NPM_SPEC));
+    try {
+      execSync('npm install -g 9router', { stdio: 'ignore', shell: true, env: process.env });
+      console.log(chalk.green('  ✅ 9router → latest'));
+    } catch { console.log(chalk.gray('  ℹ️  9router update skipped')); }
+    console.log(chalk.cyan('\n♻️  Restarting PM2...'));
+    try {
+      execSync('pm2 restart all', { stdio: 'inherit', shell: true });
+      console.log(chalk.green('\n✅ Upgrade hoan tat! PM2 da duoc restart.'));
+    } catch {
+      console.log(chalk.yellow('\n⚠️  Khong the tu restart PM2. Chay thu cong: pm2 restart all'));
+    }
+  }
+
+  const gatewayUrls = getReachableDashboardHosts(18791);
+  console.log(chalk.yellow('\n🧭 Dashboard: ' + (gatewayUrls[0] || 'http://localhost:18791')));
+  if (gatewayUrls.length > 1) console.log(chalk.gray('   Hoac: ' + gatewayUrls.slice(1).join(' , ')));
+  console.log(chalk.gray('\n   💡 Data cu (memory, sessions, 9Router OAuth) duoc giu nguyen.'));
+  console.log(chalk.gray('   💡 De thay doi config bot, mo lai index.html hoac chay npx create-openclaw-bot\n'));
+}
+
+async function main() {
+  // Upgrade subcommand: npx create-openclaw-bot@latest upgrade
+  if (process.argv[2] === 'upgrade' || process.argv.includes('--upgrade')) {
+    await runUpgrade();
+    return;
+  }
 
-async function main() {
   console.log(chalk.red('\n=================================='));
   console.log(chalk.redBright(LOGO));
   console.log(chalk.greenBright('     OpenClaw Auto Setup CLI     '));
@@ -1238,10 +1416,10 @@ async function main() {
   }
 
   // 4. Skills
-  const selectedSkills = await checkbox({
-    message: isVi ? 'Bật tính năng bổ sung (Space để chọn):' : 'Enable extra skills (Space to select):',
-    choices: SKILLS
-  });
+  const selectedSkills = await checkbox({
+    message: isVi ? 'Bật tính năng bổ sung (Space để chọn):' : 'Enable extra skills (Space to select):',
+    choices: getCliSkillChoices({ providerKey, isVi })
+  });
 
   let tavilyKey = '';
   // (web-search removed — native search built-in)
@@ -1371,7 +1549,7 @@ async function main() {
   }
   
   
-  const patchScript = `const fs=require('fs'),os=require('os'),p='/root/.openclaw/openclaw.json';if(fs.existsSync(p)){const c=JSON.parse(fs.readFileSync(p,'utf8'));const a=new Set(['http://localhost:18791','http://127.0.0.1:18791','http://0.0.0.0:18791']);for(const entries of Object.values(os.networkInterfaces()||{})){for(const entry of entries||[]){if(!entry||entry.internal||entry.family!=='IPv4'||!entry.address)continue;a.add('http://' + entry.address + ':18791');}}c.tools=Object.assign({},c.tools,{profile:'full',exec:{host:'gateway',security:'full',ask:'off'}});c.gateway=Object.assign({},c.gateway,{port:18791,bind:'custom',customBindHost:'0.0.0.0',controlUi:Object.assign({},c.gateway?.controlUi,{allowedOrigins:Array.from(a).filter(Boolean)})});fs.writeFileSync(p,JSON.stringify(c,null,2));}`;
+  const patchScript = `const fs=require('fs'),os=require('os'),p='/root/.openclaw/openclaw.json';if(fs.existsSync(p)){const c=JSON.parse(fs.readFileSync(p,'utf8'));const a=new Set(['http://localhost:18791','http://127.0.0.1:18791','http://0.0.0.0:18791']);for(const entries of Object.values(os.networkInterfaces()||{})){for(const entry of entries||[]){if(!entry||entry.internal||entry.family!=='IPv4'||!entry.address)continue;a.add('http://' + entry.address + ':18791');}}c.tools=Object.assign({},c.tools,{profile:'full',exec:{host:'gateway',security:'full',ask:'off'}});c.gateway=Object.assign({},c.gateway,{port:18791,bind:'loopback',controlUi:Object.assign({},c.gateway?.controlUi,{allowedOrigins:Array.from(a).filter(Boolean)})});delete c.gateway.customBindHost;fs.writeFileSync(p,JSON.stringify(c,null,2));}`;
   const b64Patch = Buffer.from(patchScript).toString('base64');
 
   // Browser Playwright (both desktop & server modes need chromium)
@@ -1384,8 +1562,9 @@ async function main() {
       ].join('\n')
     : '';
   // socat only for Desktop mode (bridge to host Chrome)
-  const socatApt = hasBrowserDesktop ? ' socat' : '';
-  const socatBridge = hasBrowserDesktop ? 'socat TCP-LISTEN:9222,fork,reuseaddr TCP:host.docker.internal:9222 & ' : '';
+  const socatApt = ' socat';
+  const socatBridge = hasBrowserDesktop ? 'socat TCP-LISTEN:9222,fork,reuseaddr TCP:host.docker.internal:9222 & ' : '';
+  const gatewayBridge = 'socat TCP-LISTEN:18791,fork,reuseaddr TCP:127.0.0.1:18791 & ';
 
   // Skills install at RUNTIME (not build-time — requires openclaw config + ClawHub auth)
   const skillSlugs = SKILLS
@@ -1409,7 +1588,7 @@ async function main() {
   dockerfileLines.push(
     '',
     `ARG CACHEBUST=${Date.now()}`,
-    `RUN npm install -g ${OPENCLAW_NPM_SPEC} grammy`,
+    `RUN npm install -g ${OPENCLAW_NPM_SPEC} ${OPENCLAW_RUNTIME_PACKAGES}`,
     '',
     '# Fix chat.send dropping resolved agent timeout into reply pipeline.',
     '# Without this, Telegram/WebChat paths fall back to an internal 300s default even when',
@@ -1420,7 +1599,7 @@ async function main() {
     '',
     'EXPOSE 18791',
     '',
-    `CMD sh -c "node -e \\"eval(Buffer.from('${b64Patch}','base64').toString())\\" && ${skillInstallCmd}${relayInstallCmd}${socatBridge}(while true; do sleep 5; openclaw devices approve --latest 2>/dev/null || true; done) & openclaw gateway run"`
+    `CMD sh -c "node -e \\"eval(Buffer.from('${b64Patch}','base64').toString())\\" && ${skillInstallCmd}${relayInstallCmd}${socatBridge}${gatewayBridge}(while true; do sleep 5; openclaw devices approve --latest 2>/dev/null || true; done) & openclaw gateway run"`
   );
   const dockerfile = dockerfileLines.join('\n');
 
@@ -1766,20 +1945,20 @@ ${hasBrowserDesktop ? `    extra_hosts:
 
     const sharedConfig = {
       meta: { lastTouchedVersion: '2026.3.24' },
-      agents: {
-        defaults: {
+      agents: {
+        defaults: {
           model: { primary: modelsPrimary, fallbacks: [] },
           compaction: { mode: 'safeguard' },
           timeoutSeconds: provider.isLocal ? 900 : 120,
           ...(provider.isLocal ? { llm: { idleTimeoutSeconds: 300 } } : {}),
         },
-        list: agentMetas.map((meta) => ({
-          id: meta.agentId,
-          name: meta.name,
-          workspace: `/root/.openclaw/${meta.workspaceDir}`,
-          agentDir: `/root/.openclaw/agents/${meta.agentId}/agent`,
-          model: { primary: modelsPrimary, fallbacks: [] },
-        })),
+        list: agentMetas.map((meta) => ({
+          id: meta.agentId,
+          name: meta.name,
+          workspace: `${deployMode === 'native' ? getNativeOpenClawRootDir(projectDir) : '/root/.openclaw'}/${meta.workspaceDir}`,
+          agentDir: `${deployMode === 'native' ? getNativeOpenClawRootDir(projectDir) : '/root/.openclaw'}/agents/${meta.agentId}/agent`,
+          model: { primary: modelsPrimary, fallbacks: [] },
+        })),
       },
       ...(providerKey === '9router' ? {
         models: {
@@ -1836,19 +2015,21 @@ ${hasBrowserDesktop ? `    extra_hosts:
       gateway: {
         port: 18791,
         mode: 'local',
-        bind: 'custom',
-        customBindHost: '0.0.0.0',
-        controlUi: {
-          allowedOrigins: getGatewayAllowedOrigins(18791),
-        },
-        auth: { mode: 'token', token: 'cli-dummy-token-xyz123' },
-      },
-    };
-    sharedConfig.plugins = {
-      entries: {
-        [TELEGRAM_RELAY_PLUGIN_ID]: { enabled: true },
-      },
-    };
+        bind: 'loopback',
+        controlUi: {
+          allowedOrigins: getGatewayAllowedOrigins(18791),
+        },
+        auth: { mode: 'token', token: 'cli-dummy-token-xyz123' },
+      },
+    };
+    sharedConfig.plugins = {
+      entries: {
+        [TELEGRAM_RELAY_PLUGIN_RUNTIME_ID]: { enabled: true },
+      },
+    };
+    if (!selectedSkills.includes('memory')) {
+      sharedConfig.plugins.slots = { ...(sharedConfig.plugins.slots || {}), memory: 'none' };
+    }
 
     if (hasBrowserDesktop) {
       sharedConfig.browser = {
@@ -1876,22 +2057,22 @@ ${hasBrowserDesktop ? `    extra_hosts:
         `      name: '${botName || 'openclaw-multibot'}',`,
         `      script: 'openclaw',`,
         `      args: 'gateway run',`,
-        `      cwd: '${projectDir.replace(/\\/g, '/')}',`,
-        `      interpreter: 'none',`,
-        `      autorestart: true,`,
-        `      watch: false,`,
-        `      env: { NODE_ENV: 'production' }`,
-        '    },',
-        '    {',
+        `      cwd: '${projectDir.replace(/\\/g, '/')}',`,
+        `      interpreter: 'none',`,
+        `      autorestart: true,`,
+        `      watch: false,`,
+        `      env: { NODE_ENV: 'production', OPENCLAW_HOME: '${path.join(projectDir, '.openclaw').replace(/\\/g, '/')}', DATA_DIR: '${path.join(projectDir, '.9router').replace(/\\/g, '/')}' }`,
+        '    },',
+        '    {',
         `      name: '${botName || 'openclaw-multibot'}-auto-approve',`,
         `      script: 'sh',`,
         `      args: '-c "while true; do npx --yes openclaw devices approve --latest 2>/dev/null || true; sleep 5; done"',`,
-        `      cwd: '${projectDir.replace(/\\/g, '/')}',`,
-        `      interpreter: 'none',`,
-        `      autorestart: true,`,
-        `      watch: false,`,
-        `      env: { NODE_ENV: 'production' }`,
-        '    }',
+        `      cwd: '${projectDir.replace(/\\/g, '/')}',`,
+        `      interpreter: 'none',`,
+        `      autorestart: true,`,
+        `      watch: false,`,
+        `      env: { NODE_ENV: 'production', OPENCLAW_HOME: '${path.join(projectDir, '.openclaw').replace(/\\/g, '/')}', DATA_DIR: '${path.join(projectDir, '.9router').replace(/\\/g, '/')}' }`,
+        '    }',
       ].join('\n');
       const ecosystemContent = [
         '// PM2 ecosystem — run: pm2 start ecosystem.config.js',
@@ -1956,7 +2137,7 @@ ${hasBrowserDesktop ? `    extra_hosts:
       const relayTargetNames = otherAgents.length ? otherAgents.map((peer) => `\`${peer.name}\``).join(', ') : '`bot khac`';
       const relayTargetIds = otherAgents.length ? otherAgents.map((peer) => `\`${peer.agentId}\``).join(', ') : '`agent-khac`';
       const agentsMd = `# ${isVi ? 'Huong dan van hanh' : 'Operating Manual'}\n\n## ${isVi ? 'Vai tro' : 'Role'}\n${isVi ? `Ban la **${meta.name}**, chuyen ve ${meta.desc}.` : `You are **${meta.name}**, focused on ${meta.desc}.`}\n\n## ${isVi ? 'Khi nao nen tra loi' : 'When To Reply'}\n- ${isVi ? `Coi user dang goi ban neu tin nhan co mot trong cac alias: ${ownAliases.map((alias) => `\`${alias}\``).join(', ')}.` : `Treat the message as addressed to you when it includes one of your aliases: ${ownAliases.map((alias) => `\`${alias}\``).join(', ')}.`}\n- ${isVi ? 'Neu user tag username Telegram cua ban thi luon tra loi.' : 'Always reply when your Telegram username is tagged.'}\n- ${isVi ? 'Reaction xac nhan se duoc gateway tu dong tha bang `👍` ngay khi nhan tin; khong can tu tha bang tay neu da thay ack.' : 'The gateway will auto-ack with `👍` as soon as a message arrives; do not manually duplicate the reaction if the ack already appeared.'}\n- ${isVi ? `Neu user dang goi ro bot khac ${relayTargetNames} thi khong cuop loi.` : `If the message is clearly calling another bot such as ${relayTargetNames}, do not hijack it.`}\n\n## ${isVi ? 'Phoi hop' : 'Coordination'}\n- ${isVi ? 'Dung `TEAM.md` lam nguon su that cho vai tro cua ca doi.' : 'Use `TEAM.md` as the source of truth for team roles.'}\n- ${isVi ? `Neu user bao ban hoi, chuyen viec, xin y kien, hoac phoi hop voi ${otherAgents.length ? otherAgents.map((peer) => peer.name).join(', ') : 'bot khac'}, hay dung agent-to-agent noi bo ngay trong turn hien tai.` : `If the user asks you to consult, delegate to, or coordinate with ${otherAgents.length ? otherAgents.map((peer) => peer.name).join(', ') : 'another bot'}, use internal agent-to-agent messaging in the same turn.`}\n- ${isVi ? 'Neu ban la bot mo loi, chi gui 1 cau mo dau ngan roi handoff ngay. Khong tu noi thay bot dich tru khi handoff that bai ro rang.' : 'If you are the caller bot, send only one short opener then hand off immediately. Do not speak for the target bot unless the handoff clearly fails.'}\n- ${isVi ? `Khi handoff, phai goi dung agent id ky thuat ${relayTargetIds}, khong dung ten hien thi.` : `When handing off, use the exact technical agent id ${relayTargetIds}, not the display name.`}\n- ${isVi ? 'Neu ban la bot dich nhan handoff, hay tra loi cong khai ngay trong cung Telegram chat/thread bang chinh account cua minh. Uu tien tra loi co `[[reply_to_current]]`; neu can, dung Telegram send/sendMessage action thay vi chi output thuong.' : 'If you are the target bot receiving a handoff, publish the real answer immediately into the same Telegram chat/thread from your own account. Prefer replying with `[[reply_to_current]]`; if needed, use the Telegram send/sendMessage action instead of plain assistant output.'}\n- ${isVi ? 'Khong bao user phai tag lai bot kia neu ban co the hoi noi bo duoc.' : 'Do not ask the user to tag the other bot again if you can consult internally.'}\n`;
-      const toolsMd = `# ${isVi ? 'Huong dan dung tool' : 'Tool Usage Guide'}\n\n${skillListStr}\n\n- ${isVi ? 'Tom tat ket qua tool thay vi dump raw output.' : 'Summarize tool output instead of dumping raw output.'}\n- ${isVi ? `Workspace cua ban la \`/root/.openclaw/${meta.workspaceDir}/\`.` : `Your workspace is \`/root/.openclaw/${meta.workspaceDir}/\`.`}\n- ${isVi ? 'Telegram da bat `ackReaction`, `replyToMode:first`, `actions.sendMessage`, va `actions.reactions`.' : 'Telegram is configured with `ackReaction`, `replyToMode:first`, `actions.sendMessage`, and `actions.reactions`.'}\n- ${isVi ? 'Khi can relay public bang account cua minh sau internal handoff, uu tien dung chinh outbound Telegram action thay vi tra loi mo ho.' : 'When you need to publish a public relay from your own account after an internal handoff, prefer the Telegram outbound action over an ambiguous plain-text reply.'}\n`;
+      const toolsMd = `# ${isVi ? 'Huong dan dung tool' : 'Tool Usage Guide'}\n\n${skillListStr}\n\n- ${isVi ? 'Tom tat ket qua tool thay vi dump raw output.' : 'Summarize tool output instead of dumping raw output.'}\n- ${isVi ? `Workspace cua ban la \`${getGeneratedWorkspaceRoot(deployMode, projectDir)}/${meta.workspaceDir}/\`.` : `Your workspace is \`${getGeneratedWorkspaceRoot(deployMode, projectDir)}/${meta.workspaceDir}/\`.`}\n- ${isVi ? 'Telegram da bat `ackReaction`, `replyToMode:first`, `actions.sendMessage`, va `actions.reactions`.' : 'Telegram is configured with `ackReaction`, `replyToMode:first`, `actions.sendMessage`, and `actions.reactions`.'}\n- ${isVi ? 'Khi can relay public bang account cua minh sau internal handoff, uu tien dung chinh outbound Telegram action thay vi tra loi mo ho.' : 'When you need to publish a public relay from your own account after an internal handoff, prefer the Telegram outbound action over an ambiguous plain-text reply.'}\n`;
       const relayMd = isVi
         ? `# Telegram Relay Playbook\n\n## Muc tieu\n- Cho phep bot mo loi goi bot dich noi bo, sau do bot dich tra loi cong khai bang chinh account cua minh.\n\n## Protocol\n1. Bot mo loi gui 1 cau ngan xac nhan se hoi bot dich.\n2. Bot mo loi handoff noi bo bang dung agent id trong \`TEAM.md\`.\n3. Bot dich tra loi cong khai trong cung chat/thread hien tai.\n4. Neu thay \`[[reply_to_current]]\` hoac Telegram send/sendMessage action kha dung, uu tien dung de bam dung message goc.\n5. Neu handoff that bai ro rang, chi bot mo loi moi duoc fallback tom tat.\n`
         : `# Telegram Relay Playbook\n\n## Goal\n- Let the caller bot consult the target bot internally, then have the target bot publish the real answer with its own Telegram account.\n\n## Protocol\n1. The caller bot sends one short acknowledgement.\n2. The caller bot hands off internally using the exact agent id from \`TEAM.md\`.\n3. The target bot publishes the real answer into the same chat/thread.\n4. If \`[[reply_to_current]]\` or Telegram send/sendMessage is available, prefer it so the answer attaches to the original user turn.\n5. Only the caller bot may summarize as fallback when the handoff clearly fails.\n`;
@@ -2080,11 +2261,14 @@ ${hasBrowserDesktop ? `    extra_hosts:
       channels: {},
       tools: { profile: 'full', exec: { host: 'gateway', security: 'full', ask: 'off' } },
       gateway: {
-        port: 18791 + (isMultiBot ? bIndex : 0), mode: 'local', bind: 'custom', customBindHost: '0.0.0.0',
-        controlUi: { allowedOrigins: getGatewayAllowedOrigins(18791 + (isMultiBot ? bIndex : 0)) },
-        auth: { mode: 'token', token: 'cli-dummy-token-xyz123' }
-      }
-    };
+        port: 18791 + (isMultiBot ? bIndex : 0), mode: 'local', bind: 'loopback',
+        controlUi: { allowedOrigins: getGatewayAllowedOrigins(18791 + (isMultiBot ? bIndex : 0)) },
+        auth: { mode: 'token', token: 'cli-dummy-token-xyz123' }
+      }
+    };
+    if (!selectedSkills.includes('memory')) {
+      botConfig.plugins = { ...(botConfig.plugins || {}), slots: { ...((botConfig.plugins && botConfig.plugins.slots) || {}), memory: 'none' } };
+    }
 
     if (hasBrowserDesktop) {
       botConfig.browser = {
@@ -2140,8 +2324,8 @@ ${hasBrowserDesktop ? `    extra_hosts:
     const skillListStr = selectedSkillNamesForMd.length > 0 ? selectedSkillNamesForMd.join('\n') : isVi ? '- _(Chưa có skill nào)_' : '- _(No skills installed)_';
   
     const toolsMd = isVi
-      ? `# Hướng dẫn sử dụng Tools\n\n## Danh sách skills đã cài\n${skillListStr}\n\n## Nguyên tắc chung\n- Ưu tiên dùng tool/skill phù hợp thay vì tự suy đoán\n- Nếu tool trả về lỗi → thử lại 1 lần, sau đó báo user\n- Không chạy tool liên tục mà không có mục đích rõ ràng\n- Luôn tóm tắt kết quả tool cho user thay vì dump raw output\n\n## Quy ước\n- Web Search: chỉ dùng khi cần thông tin realtime hoặc user yêu cầu\n- Browser: chỉ mở trang khi user yêu cầu cụ thể\n- Memory: tự ghi nhớ thông vị tự nhiên, không cần user nhắc\n\n## ⏰ Cron / Lên lịch nhắc nhở\n- OpenClaw CÓ hỗ trợ tool hệ thống để chạy Cron Job.\n- Khi user yêu cầu tạo nhắc nhở / lệnh tự động định kỳ, bạn hãy TỰ ĐỘNG dùng tool hệ thống để tạo. **Tuyệt đối không** bắt user dùng crontab hay Task Scheduler chạy tay trên host.\n- Ghi chú lỗi: Không điền "current" vào thư mục Session khi thao tác tool. Bỏ qua việc tra cứu file docs nội bộ ('cron-jobs.mdx') — hãy tin tưởng khả năng sử dụng tool của bạn.\n\n## 📁 File & Workspace\n- Bot có thể đọc/ghi file trong thư mục workspace: \`/root/.openclaw/workspace/\`\n- Dùng để lưu notes, scripts, cấu hình tạm\n\n## 🛠️ Tool Error Handling\n- Retry tối đa 2 lần nếu tool lỗi network\n- Nếu vẫn lỗi: báo user kèm mô tả lỗi cụ thể và gợi ý workaround\n`
-      : `# Tool Usage Guide\n\n## Installed Skills\n${skillListStr}\n\n## General Principles\n- Prefer using the right tool/skill over guessing\n- If a tool returns an error → retry once, then report to user\n- Don't run tools repeatedly without a clear purpose\n- Always summarize tool output for user instead of dumping raw data\n\n## Conventions\n- Web Search: only use when needing real-time info or user explicitly asks\n- Browser: only open pages when user specifically requests\n- Memory: proactively remember important info without user prompting\n\n## ⏰ Cron / Scheduled Tasks\n- OpenClaw natively supports system tools for Cron Jobs.\n- When the user asks to schedule tasks or reminders, use built-in tools automatically. Do NOT ask users to run manual crontab on the host.\n- Do NOT use "current" as a sessionKey for session tools.\n\n## 📁 File & Workspace\n- Bot can read/write files in workspace: \`/root/.openclaw/workspace/\`\n\n## 🛠️ Tool Error Handling\n- Retry up to 2 times on network errors\n- If still failing: report to user with specific error description and workaround\n`;
+      ? `# Hướng dẫn sử dụng Tools\n\n## Danh sách skills đã cài\n${skillListStr}\n\n## Nguyên tắc chung\n- Ưu tiên dùng tool/skill phù hợp thay vì tự suy đoán\n- Nếu tool trả về lỗi → thử lại 1 lần, sau đó báo user\n- Không chạy tool liên tục mà không có mục đích rõ ràng\n- Luôn tóm tắt kết quả tool cho user thay vì dump raw output\n\n## Quy ước\n- Web Search: chỉ dùng khi cần thông tin realtime hoặc user yêu cầu\n- Browser: chỉ mở trang khi user yêu cầu cụ thể\n- Memory: tự ghi nhớ thông vị tự nhiên, không cần user nhắc\n\n## ⏰ Cron / Lên lịch nhắc nhở\n- OpenClaw CÓ hỗ trợ tool hệ thống để chạy Cron Job.\n- Khi user yêu cầu tạo nhắc nhở / lệnh tự động định kỳ, bạn hãy TỰ ĐỘNG dùng tool hệ thống để tạo. **Tuyệt đối không** bắt user dùng crontab hay Task Scheduler chạy tay trên host.\n- Ghi chú lỗi: Không điền "current" vào thư mục Session khi thao tác tool. Bỏ qua việc tra cứu file docs nội bộ ('cron-jobs.mdx') — hãy tin tưởng khả năng sử dụng tool của bạn.\n\n## 📁 File & Workspace\n- Bot có thể đọc/ghi file trong thư mục workspace: \`${getGeneratedWorkspaceRoot(deployMode, projectDir)}/workspace/\`\n- Dùng để lưu notes, scripts, cấu hình tạm\n\n## 🛠️ Tool Error Handling\n- Retry tối đa 2 lần nếu tool lỗi network\n- Nếu vẫn lỗi: báo user kèm mô tả lỗi cụ thể và gợi ý workaround\n`
+      : `# Tool Usage Guide\n\n## Installed Skills\n${skillListStr}\n\n## General Principles\n- Prefer using the right tool/skill over guessing\n- If a tool returns an error → retry once, then report to user\n- Don't run tools repeatedly without a clear purpose\n- Always summarize tool output for user instead of dumping raw data\n\n## Conventions\n- Web Search: only use when needing real-time info or user explicitly asks\n- Browser: only open pages when user specifically requests\n- Memory: proactively remember important info without user prompting\n\n## ⏰ Cron / Scheduled Tasks\n- OpenClaw natively supports system tools for Cron Jobs.\n- When the user asks to schedule tasks or reminders, use built-in tools automatically. Do NOT ask users to run manual crontab on the host.\n- Do NOT use "current" as a sessionKey for session tools.\n\n## 📁 File & Workspace\n- Bot can read/write files in workspace: \`${getGeneratedWorkspaceRoot(deployMode, projectDir)}/workspace/\`\n\n## 🛠️ Tool Error Handling\n- Retry up to 2 times on network errors\n- If still failing: report to user with specific error description and workaround\n`;
   
     const memoryMd = `# ${isVi ? 'Bộ nhớ dài hạn' : 'Long-term Memory'}\n\n> File này lưu những điều quan trọng cần nhớ xuyên suốt các phiên hội thoại.\n\n## Ghi chú\n- _(Chưa có gì)_\n\n---`;
   
@@ -2210,7 +2394,7 @@ const { chromium } = require('playwright');
 })();
 `;
       await fs.writeFile(path.join(loopBotDir, '.openclaw', 'workspace', 'browser-tool.js'), browserToolJs);
-      const browserMd = `# Browser Automation (Desktop Mode)\n\nBot controls your actual Chrome on screen. Every action is visible!\n\n## Usage\n\`\`\`bash\nnode /root/.openclaw/workspace/browser-tool.js status\nnode /root/.openclaw/workspace/browser-tool.js open "https://google.com"\nnode /root/.openclaw/workspace/browser-tool.js get_text\nnode /root/.openclaw/workspace/browser-tool.js fill "input[name='q']" "search"\nnode /root/.openclaw/workspace/browser-tool.js press "Enter"\n\`\`\`\n\n## MANDATORY RULES\n- NEVER refuse to open the browser when user asks.\n- If ECONNREFUSED: tell user to run start-chrome-debug.bat first.\n`;
+      const browserMd = `# Browser Automation (Desktop Mode)\n\nBot controls your actual Chrome on screen. Every action is visible!\n\n## Usage\n\`\`\`bash\nnode ${getGeneratedWorkspaceRoot(deployMode, projectDir)}/workspace/browser-tool.js status\nnode ${getGeneratedWorkspaceRoot(deployMode, projectDir)}/workspace/browser-tool.js open "https://google.com"\nnode ${getGeneratedWorkspaceRoot(deployMode, projectDir)}/workspace/browser-tool.js get_text\nnode ${getGeneratedWorkspaceRoot(deployMode, projectDir)}/workspace/browser-tool.js fill "input[name='q']" "search"\nnode ${getGeneratedWorkspaceRoot(deployMode, projectDir)}/workspace/browser-tool.js press "Enter"\n\`\`\`\n\n## MANDATORY RULES\n- NEVER refuse to open the browser when user asks.\n- If ECONNREFUSED: tell user to run start-chrome-debug.bat first.\n`;
       await fs.writeFile(path.join(loopBotDir, '.openclaw', 'workspace', 'BROWSER.md'), browserMd);
     } else if (hasBrowserServer) {
       const browserServerMd = `# Browser Automation (Headless Server Mode)\n\nBot uses a headless Chromium instance running inside the Docker container. No GUI needed!\n\n## Notes\n- Running on Ubuntu Server / VPS (no GUI required)\n- Uses Playwright + Headless Chromium installed inside Docker\n- For Cloudflare bypass, switch to Desktop mode (requires Windows/Mac with Chrome)\n`;
@@ -2394,24 +2578,7 @@ fi
       }
     }
 
-    // ── Auto-sync generated config to ~/.openclaw so `openclaw` picks it up ──
-
-    const homedir = os.homedir();
-    const globalClawDir = path.join(homedir, '.openclaw');
-    const localClawDir = path.join(projectDir, '.openclaw');
-    try {
-      await fs.ensureDir(globalClawDir);
-      await fs.copy(localClawDir, globalClawDir, { overwrite: true });
-      console.log(chalk.green(`\n✅ ${isVi
-        ? `Config đã được sync vào ~/.openclaw/ — openclaw sẵn sàng!`
-        : `Config synced to ~/.openclaw/ — openclaw is ready!`}`));
-    } catch (syncErr) {
-      console.log(chalk.yellow(`\n⚠️  ${isVi
-        ? `Không thể tự sync config. Chạy thủ công:\n   cp -rn ${localClawDir}/. ${globalClawDir}/`
-        : `Could not auto-sync config. Run manually:\n   cp -rn ${localClawDir}/. ${globalClawDir}/`}`));
-    }
-
-    if (isMultiBot && channelKey === 'telegram') {
+    if (isMultiBot && channelKey === 'telegram') {
       console.log(chalk.yellow(`\n${isVi ? '📋 Xem hướng dẫn sau cài:' : '📋 Read post-install guide:'} ${path.join(projectDir, 'TELEGRAM-POST-INSTALL.md')}`));
     }
   } else {
@@ -2446,7 +2613,7 @@ fi
       native9RouterSyncScriptPath = await writeNative9RouterSyncScript(projectDir);
     }
 
-    await syncLocalConfigToHome(projectDir, isVi);
+    await ensureProjectRuntimeDirs(projectDir, isVi);
 
     if (isMultiBot && channelKey === 'telegram') {
       installRelayPluginForProject(projectDir, isVi);
@@ -2464,11 +2631,12 @@ fi
         if (providerKey === '9router') {
           startNative9RouterPm2({ isVi, projectDir, appName: botName || 'openclaw-multibot', syncScriptPath: native9RouterSyncScriptPath });
         }
-        execSync('pm2 start ecosystem.config.js && pm2 save', {
-          cwd: projectDir,
-          stdio: 'inherit',
-          shell: true
-        });
+        execSync('pm2 start ecosystem.config.js && pm2 save', {
+          cwd: projectDir,
+          stdio: 'inherit',
+          shell: true,
+          env: getProjectRuntimeEnv(projectDir)
+        });
         console.log(chalk.green(`\n🎉 ${isVi ? 'Setup hoan tat! Multi-bot native dang chay qua PM2.' : 'Setup complete! Native multi-bot is running via PM2.'}`));
         console.log(chalk.gray(isVi ? `   Xem log: pm2 logs ${botName || 'openclaw-multibot'}` : `   View logs: pm2 logs ${botName || 'openclaw-multibot'}`));
         printNativeDashboardAccessInfo({ isVi, providerKey, projectDir });
@@ -2483,11 +2651,24 @@ fi
         if (channelKey === 'zalo-personal') {
           await runNativeZaloPersonalLoginFlow({ isVi, projectDir });
         }
-        execSync(`pm2 start "openclaw gateway run" --name "${appName}" --cwd "${projectDir.replace(/\\/g, '/')}" && pm2 save`, {
-          cwd: projectDir,
-          stdio: 'inherit',
-          shell: true
-        });
+        execFileSync('pm2', [
+          'start',
+          'openclaw',
+          '--name',
+          appName,
+          '--cwd',
+          projectDir.replace(/\\/g, '/'),
+          '--interpreter',
+          'none',
+          '--',
+          'gateway',
+          'run'
+        ], {
+          cwd: projectDir,
+          stdio: 'inherit',
+          env: getProjectRuntimeEnv(projectDir)
+        });
+        runPm2Save({ projectDir, isVi });
         console.log(chalk.green(`\n🎉 ${isVi ? 'Setup hoan tat! Bot native dang chay qua PM2.' : 'Setup complete! Native bot is running via PM2.'}`));
         console.log(chalk.gray(isVi ? `   Xem log: pm2 logs ${appName}` : `   View logs: pm2 logs ${appName}`));
         printNativeDashboardAccessInfo({ isVi, providerKey, projectDir });
@@ -2499,16 +2680,17 @@ fi
       if (providerKey === '9router') {
         console.log(chalk.yellow(`\n${isVi ? 'Khoi dong 9Router native (background)...' : 'Starting native 9Router (background)...'}`));
         const native9RouterLaunch = resolveNative9RouterDesktopLaunch();
-        spawnBackgroundProcess(native9RouterLaunch.command, native9RouterLaunch.args, {
-          cwd: projectDir,
-          env: native9RouterLaunch.env
-        }).unref();
+        spawnBackgroundProcess(native9RouterLaunch.command, native9RouterLaunch.args, {
+          cwd: projectDir,
+          env: getProjectRuntimeEnv(projectDir, native9RouterLaunch.env)
+        }).unref();
         const routerHealth = await waitFor9RouterApiReady();
-        if (native9RouterSyncScriptPath) {
-          spawnBackgroundProcess(process.execPath, [native9RouterSyncScriptPath], {
-            cwd: projectDir
-          }).unref();
-        }
+        if (native9RouterSyncScriptPath) {
+          spawnBackgroundProcess(process.execPath, [native9RouterSyncScriptPath], {
+            cwd: projectDir,
+            env: getProjectRuntimeEnv(projectDir)
+          }).unref();
+        }
         console.log(chalk.gray(isVi
           ? '   9Router dashboard: http://localhost:20128/dashboard'
           : '   9Router dashboard: http://localhost:20128/dashboard'));
@@ -2523,11 +2705,12 @@ fi
       }
       console.log(chalk.yellow(`\n${isVi ? 'Khoi dong native bot (foreground)...' : 'Starting native bot (foreground)...'}`));
       const isZaloPersonal = channelKey === 'zalo-personal';
-      const child = spawn('openclaw', ['gateway', 'run'], {
-        cwd: projectDir,
-        stdio: isZaloPersonal ? ['inherit', 'pipe', 'pipe'] : 'inherit',
-        shell: process.platform === 'win32'
-      });
+      const child = spawn('openclaw', ['gateway', 'run'], {
+        cwd: projectDir,
+        stdio: isZaloPersonal ? ['inherit', 'pipe', 'pipe'] : 'inherit',
+        shell: process.platform === 'win32',
+        env: getProjectRuntimeEnv(projectDir),
+      });
       if (isZaloPersonal) {
         let approvedPairingCode = null;
         const onGatewayChunk = (chunk, target) => {