create-openclaw-bot 5.1.2 → 5.1.3

package/CHANGELOG.md

@@ -1,6 +1,17 @@
 # Changelog (English)
 
 
+## [5.1.3] — 2026-04-06
+
+### 🐜 Fix Docker Compose Variable Interpolation Leak
+
+The previous base64 fix introduced a regression where the template literal `${Buffer.from(...)}` was mistakenly escaped in the composition script, causing the literal string to leak into `docker-compose.yml` instead of the actual base64 computed value.
+
+- **Fix**: Precompute the base64 string completely in JavaScript (`const syncScriptBase64 = encodeBase64Utf8(syncScript)`) before injecting it into the compose template
+- This guarantees the generated compose file receives the raw base64 string without any template interpolator conflicts
+- Also cleans up testing logic validating these fixes
+
+
 ## [5.1.2] — 2026-04-06
 
 ### 🐛 Fix Shell Injection: Sync Script Now Uses Base64 Encoding

package/CHANGELOG.vi.md

@@ -1,6 +1,17 @@
 # Changelog (Tiếng Việt)
 
 
+## [5.1.3] — 2026-04-06
+
+### 🐜 Lỗi lọt biến nội suy vào giao diện Docker Compose
+
+Bản vá lỗi base64 trước đó đã gây ra lỗi mới (regression) do dùng ngoặc `${Buffer.from(...)}` bên trong chuỗi string sinh ra docker-compose. Điều này làm lọt nguyên đoạn text nội suy vào `docker-compose.yml` thay vì sinh ra chuỗi base64 thật.
+
+- **Fix**: Thực hiện tạo mã base64 hoàn chỉnh qua JavaScript (`const syncScriptBase64 = encodeBase64Utf8(syncScript)`) ngay từ ban đầu trước khi ghép chuỗi vào file compose
+- Đảm bảo file compose tạo thành nhận chính xác mã base64 thuần túy mà không bị lọt biến môi trường
+- Dọn dẹp lại script test tương ứng
+
+
 ## [5.1.2] — 2026-04-06
 
 ### 🐛 Fix Shell Injection: Sync Script Dùng Base64

package/README.md

@@ -3,7 +3,7 @@
 # 🦞 OpenClaw Setup
 
 <p align="center">
-  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.1.2-0EA5E9?style=for-the-badge" alt="Version 5.1.2" /></a>
+  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.1.3-0EA5E9?style=for-the-badge" alt="Version 5.1.3" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup?tab=MIT-1-ov-file"><img src="https://img.shields.io/badge/LICENSE-MIT-success?style=for-the-badge" alt="MIT License" /></a>
   <a href="https://www.npmjs.com/package/create-openclaw-bot"><img src="https://img.shields.io/npm/v/create-openclaw-bot?style=for-the-badge&label=CLI&color=2563EB&logo=npm&logoColor=white" alt="NPM Version" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup/stargazers"><img src="https://img.shields.io/github/stars/tuanminhhole/openclaw-setup?style=for-the-badge&color=eab308&logo=github&logoColor=white" alt="GitHub Stars" /></a>
@@ -24,7 +24,7 @@ An interactive **CLI tool** and **Setup Wizard** to deploy your own free AI Bot
 
 ---
 
-## 🆕 What's new in v5.1.2
+## 🆕 What's new in v5.1.3
 
 - 💻 **OS-First Setup** — Step 1 is now choosing your OS (Windows, macOS, Ubuntu, VPS). All scripts, configs, and instructions are generated to match.
 - 🧠 **Gemma 4 — 4 sizes** — `gemma4:e2b` (~4 GB), `gemma4:e4b` (~8 GB), `gemma4:26b` (~18 GB), `gemma4:31b` (~24 GB). Auto-pulled on first launch.
@@ -112,7 +112,7 @@ Run in your terminal → follow the interactive prompts → startup script is ge
 2. Open this repo as your workspace
 3. Paste into chat:
    ```
-   Read SETUP.md and set up OpenClaw v5.1.2 for me.
+   Read SETUP.md and set up OpenClaw v5.1.3 for me.
    My bot token is X. Use 9Router (no API key).
    My project folder: <YOUR_PATH>
    ```

package/README.vi.md

@@ -3,7 +3,7 @@
 # 🦞 OpenClaw Setup
 
 <p align="center">
-  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.1.2-0EA5E9?style=for-the-badge" alt="Version 5.1.2" /></a>
+  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.1.3-0EA5E9?style=for-the-badge" alt="Version 5.1.3" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup?tab=MIT-1-ov-file"><img src="https://img.shields.io/badge/LICENSE-MIT-success?style=for-the-badge" alt="MIT License" /></a>
   <a href="https://www.npmjs.com/package/create-openclaw-bot"><img src="https://img.shields.io/npm/v/create-openclaw-bot?style=for-the-badge&label=CLI&color=2563EB&logo=npm&logoColor=white" alt="NPM Version" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup/stargazers"><img src="https://img.shields.io/github/stars/tuanminhhole/openclaw-setup?style=for-the-badge&color=eab308&logo=github&logoColor=white" alt="GitHub Stars" /></a>
@@ -24,7 +24,7 @@ Công cụ **CLI tương tác** và **Setup Wizard** để tự triển khai Bot
 
 ---
 
-## 🆕 Có gì mới trong v5.1.2
+## 🆕 Có gì mới trong v5.1.3
 
 - 💻 **OS-First Setup** — Bước đầu tiên bây giờ là chọn hệ điều hành của bạn (Windows, macOS, Ubuntu, VPS). Toàn bộ script, cấu hình và hướng dẫn được tạo ra phù hợp với lựa chọn đó.
 - 🧠 **Gemma 4 — 4 kích thước** — `gemma4:e2b` (~4 GB), `gemma4:e4b` (~8 GB), `gemma4:26b` (~18 GB), `gemma4:31b` (~24 GB). Tự pull về khi bot khởi động lần đầu.
@@ -112,7 +112,7 @@ Chạy lệnh trên trong Terminal → làm theo các prompt tương tác → sc
 2. Mở repo này làm workspace
 3. Paste vào chat:
    ```
-   Read SETUP.md and set up OpenClaw v5.1.2 for me.
+   Read SETUP.md and set up OpenClaw v5.1.3 for me.
    My bot token is X. Use 9Router (no API key).
    My project folder: <THƯ_MỤC_CỦA_BẠN>
    ```

package/cli.js

@@ -312,9 +312,9 @@ function installLatestOpenClaw({ isVi, osChoice }) {
     : '✅ openclaw is now on the latest version!'));
 }
 
-function build9RouterSmartRouteSyncScript(dbPath) {
-  const safeDbPath = JSON.stringify(dbPath);
-  return `const fs=require('fs');
+function build9RouterSmartRouteSyncScript(dbPath) {
+  const safeDbPath = JSON.stringify(dbPath);
+  return `const fs=require('fs');
 const INTERVAL=30000;
 const p=${safeDbPath};
 const ROUTER='http://localhost:20128';
@@ -359,15 +359,32 @@ const sync = async () => {
     }
   } catch(e) { console.log('[sync-combo] Error:', e.message); }
 };
-setTimeout(sync, 5000);
-setInterval(sync, INTERVAL);`;
-}
-
-async function writeNative9RouterSyncScript(projectDir) {
-  const syncScriptPath = path.join(projectDir, '.openclaw', '9router-smart-route-sync.js');
-  await fs.ensureDir(path.dirname(syncScriptPath));
-  await fs.writeFile(syncScriptPath, build9RouterSmartRouteSyncScript(path.join(getNative9RouterDataDir(), 'db.json')));
-  return syncScriptPath;
+setTimeout(sync, 5000);
+setInterval(sync, INTERVAL);`;
+}
+
+function indentBlock(text, spaces) {
+  const prefix = ' '.repeat(spaces);
+  return String(text)
+    .split('\n')
+    .map((line) => `${prefix}${line}`)
+    .join('\n');
+}
+
+function build9RouterComposeEntrypointScript(syncScriptBase64) {
+  return [
+    'npm install -g 9router',
+    `node -e "require('fs').writeFileSync('/tmp/sync.js',Buffer.from('${syncScriptBase64}','base64').toString())"`,
+    'node /tmp/sync.js > /tmp/sync.log 2>&1 &',
+    'exec 9router -n -t -l -H 0.0.0.0 -p 20128 --skip-update'
+  ].join('\n');
+}
+
+async function writeNative9RouterSyncScript(projectDir) {
+  const syncScriptPath = path.join(projectDir, '.openclaw', '9router-smart-route-sync.js');
+  await fs.ensureDir(path.dirname(syncScriptPath));
+  await fs.writeFile(syncScriptPath, build9RouterSmartRouteSyncScript(path.join(getNative9RouterDataDir(), 'db.json')));
+  return syncScriptPath;
 }
 
 function extractFirstHttpUrl(text) {
@@ -1260,10 +1277,12 @@ async function main() {
   const agentId = botName.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/-$/, '') || 'chat';
   
   // ─── Dynamic Smart Route Sync Script ────────────────────────────────────────
-  // This script runs inside the 9Router container as a background loop.
-  // It reads the persisted 9Router DB directly so smart-route still works
-  // even when newer dashboard APIs require auth or change response shape.
-  const syncComboScript = build9RouterSmartRouteSyncScript('/root/.9router/db.json');
+  // This script runs inside the 9Router container as a background loop.
+  // It reads the persisted 9Router DB directly so smart-route still works
+  // even when newer dashboard APIs require auth or change response shape.
+  const syncComboScript = build9RouterSmartRouteSyncScript('/root/.9router/db.json');
+  const syncComboScriptBase64 = Buffer.from(syncComboScript).toString('base64');
+  const docker9RouterEntrypointScript = build9RouterComposeEntrypointScript(syncComboScriptBase64);
 
   // ─── Resolve primary model ───────────────────────────────────────────────────
   let modelsPrimary;
@@ -1307,17 +1326,14 @@ ${dependsOn}${extraHosts}    ports:
     image: node:22-slim
     container_name: 9router-multibot
     restart: always
-    entrypoint:
-      - /bin/sh
-      - -c
-      - |
-        npm install -g 9router
-        node -e "require('fs').writeFileSync('/tmp/sync.js',Buffer.from('\${Buffer.from(syncComboScript).toString('base64')}','base64').toString())"
-        node /tmp/sync.js > /tmp/sync.log 2>&1 &
-        exec 9router -n -t -l -H 0.0.0.0 -p 20128 --skip-update
-    environment:
-      - PORT=20128
-      - HOSTNAME=0.0.0.0
+    entrypoint:
+      - /bin/sh
+      - -c
+      - |
+${indentBlock(docker9RouterEntrypointScript, 8)}
+    environment:
+      - PORT=20128
+      - HOSTNAME=0.0.0.0
       - CI=true
     volumes:
       - 9router-data:/root/.9router
@@ -1402,17 +1418,14 @@ ${hasBrowserDesktop ? `    extra_hosts:\n      - "host.docker.internal:host-gate
     image: node:22-slim
     container_name: 9router-${agentId}
     restart: always
-    entrypoint:
-      - /bin/sh
-      - -c
-      - |
-        npm install -g 9router
-        node -e "require('fs').writeFileSync('/tmp/sync.js',Buffer.from('\${Buffer.from(syncComboScript).toString('base64')}','base64').toString())"
-        node /tmp/sync.js > /tmp/sync.log 2>&1 &
-        exec 9router -n -t -l -H 0.0.0.0 -p 20128 --skip-update
-    environment:
-      - PORT=20128
-      - HOSTNAME=0.0.0.0
+    entrypoint:
+      - /bin/sh
+      - -c
+      - |
+${indentBlock(docker9RouterEntrypointScript, 8)}
+    environment:
+      - PORT=20128
+      - HOSTNAME=0.0.0.0
       - CI=true
     volumes:
       - 9router-data:/root/.9router

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-openclaw-bot",
-  "version": "5.1.2",
+  "version": "5.1.3",
   "description": "Interactive CLI installer for OpenClaw Bot",
   "main": "cli.js",
   "bin": {

package/setup.js

@@ -1758,7 +1758,19 @@ model:
     // 3. Dockerfile
     const allPlugins = [];
     if (ch.pluginInstall) allPlugins.push(ch.pluginInstall);
-    state.config.plugins.forEach((pid) => {
+    const encodeBase64Utf8 = (value) => btoa(String.fromCharCode(...new TextEncoder().encode(String(value))));
+    const indentBlock = (text, spaces) => {
+      const prefix = ' '.repeat(spaces);
+      return String(text).split('\n').map((line) => `${prefix}${line}`).join('\n');
+    };
+    const build9RouterComposeEntrypointScript = (syncScriptBase64) => [
+      'npm install -g 9router',
+      `node -e "require('fs').writeFileSync('/tmp/sync.js',Buffer.from('${syncScriptBase64}','base64').toString())"`,
+      'node /tmp/sync.js > /tmp/sync.log 2>&1 &',
+      'exec 9router -n -t -l -H 0.0.0.0 -p 20128 --skip-update'
+    ].join('\n');
+
+    state.config.plugins.forEach((pid) => {
       const plug = PLUGINS.find((p) => p.id === pid);
       if (plug) allPlugins.push(plug.package);
     });
@@ -1834,7 +1846,7 @@ ${finalCmd}`;
     // Background loop inside 9Router container every 30s.
     // Read providerConnections directly from db.json so smart-route survives
     // dashboard auth/response changes in newer 9Router builds.
-    const syncScript = `const fs=require('fs');const INTERVAL=30000;const p='/root/.9router/db.json';
+    const syncScript = `const fs=require('fs');const INTERVAL=30000;const p='/root/.9router/db.json';
 const PM={codex:['cx/gpt-5.4','cx/gpt-5.3-codex','cx/gpt-5.3-codex-high','cx/gpt-5.2-codex','cx/gpt-5.2','cx/gpt-5.1-codex-max','cx/gpt-5.1-codex','cx/gpt-5.1','cx/gpt-5-codex'],'claude-code':['cc/claude-opus-4-6','cc/claude-sonnet-4-6','cc/claude-opus-4-5-20251101','cc/claude-sonnet-4-5-20250929','cc/claude-haiku-4-5-20251001'],github:['gh/gpt-5.4','gh/gpt-5.3-codex','gh/gpt-5.2-codex','gh/gpt-5.2','gh/gpt-5.1-codex-max','gh/gpt-5.1-codex','gh/gpt-5.1','gh/gpt-5','gh/gpt-4.1','gh/gpt-4o','gh/claude-opus-4.6','gh/claude-sonnet-4.6','gh/claude-sonnet-4.5','gh/claude-opus-4.5','gh/claude-haiku-4.5','gh/gemini-3-pro-preview','gh/gemini-3-flash-preview','gh/gemini-2.5-pro'],cursor:['cu/default','cu/claude-4.6-opus-max','cu/claude-4.5-opus-high-thinking','cu/claude-4.5-sonnet-thinking','cu/claude-4.5-sonnet','cu/gpt-5.3-codex','cu/gpt-5.2-codex','cu/gemini-3-flash-preview'],kilo:['kc/anthropic/claude-sonnet-4-20250514','kc/anthropic/claude-opus-4-20250514','kc/google/gemini-2.5-pro','kc/google/gemini-2.5-flash','kc/openai/gpt-4.1','kc/deepseek/deepseek-chat'],cline:['cl/anthropic/claude-sonnet-4.6','cl/anthropic/claude-opus-4.6','cl/openai/gpt-5.3-codex','cl/openai/gpt-5.4','cl/google/gemini-3.1-pro-preview'],'gemini-cli':['gc/gemini-3-flash-preview','gc/gemini-3-pro-preview'],iflow:['if/qwen3-coder-plus','if/kimi-k2','if/kimi-k2-thinking','if/glm-4.7','if/deepseek-r1','if/deepseek-v3.2','if/deepseek-v3','if/qwen3-max','if/qwen3-235b','if/iflow-rome-30ba3b'],qwen:['qw/qwen3-coder-plus','qw/qwen3-coder-flash','qw/vision-model','qw/coder-model'],kiro:['kr/claude-sonnet-4.5','kr/claude-haiku-4.5','kr/deepseek-3.2','kr/deepseek-3.1','kr/qwen3-coder-next'],ollama:['ollama/gemma4:e2b','ollama/gemma4:e4b','ollama/gemma4:26b','ollama/gemma4:31b','ollama/qwen3.5','ollama/kimi-k2.5','ollama/glm-5','ollama/glm-4.7-flash','ollama/minimax-m2.5','ollama/gpt-oss:120b'],'kimi-coding':['kmc/kimi-k2.5','kmc/kimi-k2.5-thinking','kmc/kimi-latest'],glm:['glm/glm-5.1','glm/glm-5','glm/glm-4.7'],'glm-cn':['glm/glm-5.1','glm/glm-5','glm/glm-4.7'],minimax:['minimax/MiniMax-M2.7','minimax/MiniMax-M2.5','minimax/MiniMax-M2.1'],kimi:['kimi/kimi-k2.5','kimi/kimi-k2.5-thinking','kimi/kimi-latest'],deepseek:['deepseek/deepseek-chat','deepseek/deepseek-reasoner'],xai:['xai/grok-4','xai/grok-4-fast-reasoning','xai/grok-code-fast-1'],mistral:['mistral/mistral-large-latest','mistral/codestral-latest'],groq:['groq/llama-3.3-70b-versatile','groq/openai/gpt-oss-120b'],cerebras:['cerebras/gpt-oss-120b'],alicode:['alicode/qwen3.5-plus','alicode/qwen3-coder-plus'],openai:['openai/gpt-4o','openai/gpt-4.1'],anthropic:['anthropic/claude-sonnet-4','anthropic/claude-haiku-3.5'],gemini:['gemini/gemini-2.5-flash','gemini/gemini-2.5-pro']};
 console.log('[sync-combo] 9Router sync loop started...');
 const sync = async () => {
@@ -1884,9 +1896,11 @@ const sync = async () => {
       console.log('[sync-combo] Created smart-route: ' + c.models.length + ' models');
     }
   } catch (e) { }
-};
-setTimeout(sync, 5000);
-setInterval(sync, INTERVAL);`;
+};
+setTimeout(sync, 5000);
+setInterval(sync, INTERVAL);`;
+    const syncScriptBase64 = encodeBase64Utf8(syncScript);
+    const docker9RouterEntrypointScript = build9RouterComposeEntrypointScript(syncScriptBase64);
 
     let compose;
     if (isMultiBotWizard) {
@@ -1915,17 +1929,14 @@ ${dependsOn}${extraHosts}    volumes:
     image: node:22-slim
     container_name: 9router-multibot
     restart: always
-    entrypoint:
-      - /bin/sh
-      - -c
-      - |
-        npm install -g 9router
-        node -e "require('fs').writeFileSync('/tmp/sync.js',Buffer.from('\${Buffer.from(syncScript).toString('base64')}','base64').toString())"
-        node /tmp/sync.js > /tmp/sync.log 2>&1 &
-        exec 9router -n -t -l -H 0.0.0.0 -p 20128 --skip-update
-    environment:
-      - PORT=20128
-      - HOSTNAME=0.0.0.0
+    entrypoint:
+      - /bin/sh
+      - -c
+      - |
+${indentBlock(docker9RouterEntrypointScript, 8)}
+    environment:
+      - PORT=20128
+      - HOSTNAME=0.0.0.0
       - CI=true
     volumes:
       - 9router-data:/root/.9router
@@ -2011,17 +2022,14 @@ ${extraHostsBlock}
     image: node:22-slim
     container_name: 9router
     restart: always
-    entrypoint:
-      - /bin/sh
-      - -c
-      - |
-        npm install -g 9router
-        node -e "require('fs').writeFileSync('/tmp/sync.js',Buffer.from('\${Buffer.from(syncScript).toString('base64')}','base64').toString())"
-        node /tmp/sync.js > /tmp/sync.log 2>&1 &
-        exec 9router -n -t -l -H 0.0.0.0 -p 20128 --skip-update
-    environment:
-      - PORT=20128
-      - HOSTNAME=0.0.0.0
+    entrypoint:
+      - /bin/sh
+      - -c
+      - |
+${indentBlock(docker9RouterEntrypointScript, 8)}
+    environment:
+      - PORT=20128
+      - HOSTNAME=0.0.0.0
       - CI=true
     volumes:
       - 9router-data:/root/.9router

package/tests/smoke-cli-logic.mjs

@@ -86,9 +86,12 @@ checks.push(() => expectMatch(
   'CLI fast-test mode must be able to reuse an existing 9Router install'
 ));
 
-checks.push(() => expectMatch(
-  cli,
-  /function build9RouterSmartRouteSyncScript\(dbPath\) \{[\s\S]*safeDbPath[\s\S]*providerConnections[\s\S]*smart-route[\s\S]*async function writeNative9RouterSyncScript\(projectDir\) \{[\s\S]*getNative9RouterDataDir\(\), 'db\.json'/s,
+checks.push(() => expect(
+  cli.includes('function build9RouterSmartRouteSyncScript(dbPath) {')
+    && cli.includes('const safeDbPath = JSON.stringify(dbPath);')
+    && cli.includes("const ROUTER='http://localhost:20128';")
+    && cli.includes("fetch(ROUTER + '/api/providers')")
+    && cli.includes("build9RouterSmartRouteSyncScript(path.join(getNative9RouterDataDir(), 'db.json'))"),
   'Native 9Router flow must write a smart-route sync script based on the platform-specific 9Router data directory'
 ));
 
@@ -100,8 +103,9 @@ checks.push(() => expectMatch(
 
 checks.push(() => expect(
   cli.includes("Removed smart-route (no active providers)")
-    && cli.includes("if(!a.length){removeSmartRoute();return;}")
-    && cli.includes("if(!m.length){removeSmartRoute();return;}"),
+    && cli.includes("if (!a.length) {")
+    && cli.includes("if (!m.length) {")
+    && cli.includes("removeSmartRoute();"),
   '9Router sync logic in CLI must remove stale smart-route combos when providers are disabled'
 ));
 
@@ -282,20 +286,21 @@ checks.push(() => expectMatch(
 
 checks.push(() => expectMatch(
   setup,
-  /function providerLines\(arr, shell\) \{[\s\S]*npm install -g 9router[\s\S]*npm root -g[\s\S]*Join-Path \$npmRoot[\s\S]*Start-Process -WindowStyle Hidden -FilePath ''node\.exe''[\s\S]*9router-smart-route-sync\.js/s,
+  /function providerLines\(arr, shell\) \{[\s\S]*npm install -g 9router[\s\S]*start "9Router" cmd \/k "9router -n -t -l -H 0\.0\.0\.0 -p 20128 --skip-update"[\s\S]*9router-smart-route-sync\.js/s,
   'Native script generation must install and start a standalone 9Router dashboard on port 20128'
 ));
 
 checks.push(() => expectMatch(
   setup,
-  /function native9RouterSyncScriptContent\(\) \{[\s\S]*process\.platform==='win32'[\s\S]*AppData[\s\S]*Roaming[\s\S]*providerConnections[\s\S]*smart-route/s,
-  'Native script generation must embed a 9Router smart-route sync script with the correct Windows data directory'
+  /function native9RouterSyncScriptContent\(\) \{[\s\S]*path\.join\(process\.env\.HOME\|\|process\.env\.USERPROFILE\|\|'\.'\,\'\.9router\'\,\'db\.json\'\)[\s\S]*providerConnections[\s\S]*smart-route/s,
+  'Native script generation must embed a 9Router smart-route sync script'
 ));
 
 checks.push(() => expect(
   setup.includes("Removed smart-route (no active providers)")
-    && setup.includes("if(!a.length){removeSmartRoute();return;}")
-    && setup.includes("if(!m.length){removeSmartRoute();return;}"),
+    && setup.includes("if (!a.length) {")
+    && setup.includes("if (!m.length) {")
+    && setup.includes("removeSmartRoute();"),
   '9Router sync logic in setup.js must remove stale smart-route combos when providers are disabled'
 ));
 
@@ -311,12 +316,22 @@ checks.push(() => expectMatch(
   'Dockerfile patching in CLI must resolve gateway-cli dist files dynamically instead of hardcoding one hash'
 ));
 
+checks.push(() => expect(
+  !cli.includes("Buffer.from('\\${Buffer.from(syncComboScript).toString('base64')}','base64')"),
+  'CLI must precompute the 9Router sync script base64 instead of leaking Docker Compose interpolation markers'
+));
+
 checks.push(() => expectMatch(
   setup,
   /readdirSync\(dir\)\.find\(n=>\/\^gateway-cli-.*\\\\\.js\$\/\.test\(n\)\)[\s\S]*skipping timeout patch/,
   'Dockerfile patching in setup.js must resolve gateway-cli dist files dynamically instead of hardcoding one hash'
 ));
 
+checks.push(() => expect(
+  !setup.includes("Buffer.from('\\${Buffer.from(syncScript).toString('base64')}','base64')"),
+  'Wizard compose generation must precompute the 9Router sync script base64 instead of leaking Docker Compose interpolation markers'
+));
+
 checks.push(() => expectMatch(
   setup,
   /else if \(state\.nativeOs === 'vps'\) \{[\s\S]*pm2 start --name openclaw-multibot -- sh -c "openclaw gateway run"[\s\S]*pm2 logs openclaw-multibot/s,