create-openclaw-bot 5.1.2 → 5.1.4

package/CHANGELOG.md

@@ -1,6 +1,25 @@
 # Changelog (English)
 
 
+## [5.1.4] — 2026-04-06
+
+### 🐞 Fix CLI Startup BOM Error & Improve Docker Timeout Patch
+
+- **Fix CLI BOM**: Removed the unexpected byte order mark (BOM) `\uFEFF` at the beginning of `cli.js` which could cause the shebang `#!/usr/bin/env node` to fail resolving or cause SyntaxErrors in certain environments
+- **Improve Docker Timeout Patching**: The backend timeout override injection (`300s`) during Docker build now defensively scans all `.js` files in the `openclaw/dist` directory rather than trying to fuzzy-find a specific `gateway-cli-*` hash. This ensures the patch succeeds across different OpenClaw backend builds without noisy console warnings
+
+
+## [5.1.3] — 2026-04-06
+
+### 🐜 Fix Docker Compose Variable Interpolation Leak
+
+The previous base64 fix introduced a regression where the template literal `${Buffer.from(...)}` was mistakenly escaped in the composition script, causing the literal string to leak into `docker-compose.yml` instead of the actual base64 computed value.
+
+- **Fix**: Precompute the base64 string completely in JavaScript (`const syncScriptBase64 = encodeBase64Utf8(syncScript)`) before injecting it into the compose template
+- This guarantees the generated compose file receives the raw base64 string without any template interpolator conflicts
+- Also cleans up testing logic validating these fixes
+
+
 ## [5.1.2] — 2026-04-06
 
 ### 🐛 Fix Shell Injection: Sync Script Now Uses Base64 Encoding

package/CHANGELOG.vi.md

@@ -1,6 +1,25 @@
 # Changelog (Tiếng Việt)
 
 
+## [5.1.4] — 2026-04-06
+
+### 🐞 Sửa lỗi BOM khởi động CLI & Tối ưu luồng vá Timeout trên Docker
+
+- **Sửa file CLI (BOM)**: Xóa tự động chèn BOM (`\uFEFF`) ở đầu file `cli.js`. Ký tự thừa này vốn làm hỏng shebang `#!/usr/bin/env node` và gây `SyntaxError: Unexpected token` trong nhiều môi trường khi chạy npx
+- **Cải thiện Docker Timeout Patch**: Quá trình can thiệp timeout (`300s`) trong lúc build Docker giờ chuyển sang scan quét toàn bộ các file `.js` trong thư mục `openclaw/dist` thay vì cố tìm file trùng hash `gateway-cli-*`. Giúp bản vá luôn áp dụng thành công trên các phiên bản backend khác biệt mà không in ra warning rác trên console
+
+
+## [5.1.3] — 2026-04-06
+
+### 🐜 Lỗi lọt biến nội suy vào giao diện Docker Compose
+
+Bản vá lỗi base64 trước đó đã gây ra lỗi mới (regression) do dùng ngoặc `${Buffer.from(...)}` bên trong chuỗi string sinh ra docker-compose. Điều này làm lọt nguyên đoạn text nội suy vào `docker-compose.yml` thay vì sinh ra chuỗi base64 thật.
+
+- **Fix**: Thực hiện tạo mã base64 hoàn chỉnh qua JavaScript (`const syncScriptBase64 = encodeBase64Utf8(syncScript)`) ngay từ ban đầu trước khi ghép chuỗi vào file compose
+- Đảm bảo file compose tạo thành nhận chính xác mã base64 thuần túy mà không bị lọt biến môi trường
+- Dọn dẹp lại script test tương ứng
+
+
 ## [5.1.2] — 2026-04-06
 
 ### 🐛 Fix Shell Injection: Sync Script Dùng Base64

package/README.md

@@ -3,7 +3,7 @@
 # 🦞 OpenClaw Setup
 
 <p align="center">
-  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.1.2-0EA5E9?style=for-the-badge" alt="Version 5.1.2" /></a>
+  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.1.4-0EA5E9?style=for-the-badge" alt="Version 5.1.4" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup?tab=MIT-1-ov-file"><img src="https://img.shields.io/badge/LICENSE-MIT-success?style=for-the-badge" alt="MIT License" /></a>
   <a href="https://www.npmjs.com/package/create-openclaw-bot"><img src="https://img.shields.io/npm/v/create-openclaw-bot?style=for-the-badge&label=CLI&color=2563EB&logo=npm&logoColor=white" alt="NPM Version" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup/stargazers"><img src="https://img.shields.io/github/stars/tuanminhhole/openclaw-setup?style=for-the-badge&color=eab308&logo=github&logoColor=white" alt="GitHub Stars" /></a>
@@ -24,7 +24,7 @@ An interactive **CLI tool** and **Setup Wizard** to deploy your own free AI Bot
 
 ---
 
-## 🆕 What's new in v5.1.2
+## 🆕 What's new in v5.1.4
 
 - 💻 **OS-First Setup** — Step 1 is now choosing your OS (Windows, macOS, Ubuntu, VPS). All scripts, configs, and instructions are generated to match.
 - 🧠 **Gemma 4 — 4 sizes** — `gemma4:e2b` (~4 GB), `gemma4:e4b` (~8 GB), `gemma4:26b` (~18 GB), `gemma4:31b` (~24 GB). Auto-pulled on first launch.
@@ -112,7 +112,7 @@ Run in your terminal → follow the interactive prompts → startup script is ge
 2. Open this repo as your workspace
 3. Paste into chat:
    ```
-   Read SETUP.md and set up OpenClaw v5.1.2 for me.
+   Read SETUP.md and set up OpenClaw v5.1.4 for me.
    My bot token is X. Use 9Router (no API key).
    My project folder: <YOUR_PATH>
    ```

package/README.vi.md

@@ -3,7 +3,7 @@
 # 🦞 OpenClaw Setup
 
 <p align="center">
-  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.1.2-0EA5E9?style=for-the-badge" alt="Version 5.1.2" /></a>
+  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.1.4-0EA5E9?style=for-the-badge" alt="Version 5.1.4" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup?tab=MIT-1-ov-file"><img src="https://img.shields.io/badge/LICENSE-MIT-success?style=for-the-badge" alt="MIT License" /></a>
   <a href="https://www.npmjs.com/package/create-openclaw-bot"><img src="https://img.shields.io/npm/v/create-openclaw-bot?style=for-the-badge&label=CLI&color=2563EB&logo=npm&logoColor=white" alt="NPM Version" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup/stargazers"><img src="https://img.shields.io/github/stars/tuanminhhole/openclaw-setup?style=for-the-badge&color=eab308&logo=github&logoColor=white" alt="GitHub Stars" /></a>
@@ -24,7 +24,7 @@ Công cụ **CLI tương tác** và **Setup Wizard** để tự triển khai Bot
 
 ---
 
-## 🆕 Có gì mới trong v5.1.2
+## 🆕 Có gì mới trong v5.1.4
 
 - 💻 **OS-First Setup** — Bước đầu tiên bây giờ là chọn hệ điều hành của bạn (Windows, macOS, Ubuntu, VPS). Toàn bộ script, cấu hình và hướng dẫn được tạo ra phù hợp với lựa chọn đó.
 - 🧠 **Gemma 4 — 4 kích thước** — `gemma4:e2b` (~4 GB), `gemma4:e4b` (~8 GB), `gemma4:26b` (~18 GB), `gemma4:31b` (~24 GB). Tự pull về khi bot khởi động lần đầu.
@@ -112,7 +112,7 @@ Chạy lệnh trên trong Terminal → làm theo các prompt tương tác → sc
 2. Mở repo này làm workspace
 3. Paste vào chat:
    ```
-   Read SETUP.md and set up OpenClaw v5.1.2 for me.
+   Read SETUP.md and set up OpenClaw v5.1.4 for me.
    My bot token is X. Use 9Router (no API key).
    My project folder: <THƯ_MỤC_CỦA_BẠN>
    ```

package/cli.js

@@ -1,4 +1,4 @@
-#!/usr/bin/env node
+#!/usr/bin/env node
 
 import { input, select, checkbox, confirm } from '@inquirer/prompts';
 import fs from 'fs-extra';
@@ -312,9 +312,9 @@ function installLatestOpenClaw({ isVi, osChoice }) {
     : '✅ openclaw is now on the latest version!'));
 }
 
-function build9RouterSmartRouteSyncScript(dbPath) {
-  const safeDbPath = JSON.stringify(dbPath);
-  return `const fs=require('fs');
+function build9RouterSmartRouteSyncScript(dbPath) {
+  const safeDbPath = JSON.stringify(dbPath);
+  return `const fs=require('fs');
 const INTERVAL=30000;
 const p=${safeDbPath};
 const ROUTER='http://localhost:20128';
@@ -359,15 +359,32 @@ const sync = async () => {
     }
   } catch(e) { console.log('[sync-combo] Error:', e.message); }
 };
-setTimeout(sync, 5000);
-setInterval(sync, INTERVAL);`;
-}
-
-async function writeNative9RouterSyncScript(projectDir) {
-  const syncScriptPath = path.join(projectDir, '.openclaw', '9router-smart-route-sync.js');
-  await fs.ensureDir(path.dirname(syncScriptPath));
-  await fs.writeFile(syncScriptPath, build9RouterSmartRouteSyncScript(path.join(getNative9RouterDataDir(), 'db.json')));
-  return syncScriptPath;
+setTimeout(sync, 5000);
+setInterval(sync, INTERVAL);`;
+}
+
+function indentBlock(text, spaces) {
+  const prefix = ' '.repeat(spaces);
+  return String(text)
+    .split('\n')
+    .map((line) => `${prefix}${line}`)
+    .join('\n');
+}
+
+function build9RouterComposeEntrypointScript(syncScriptBase64) {
+  return [
+    'npm install -g 9router',
+    `node -e "require('fs').writeFileSync('/tmp/sync.js',Buffer.from('${syncScriptBase64}','base64').toString())"`,
+    'node /tmp/sync.js > /tmp/sync.log 2>&1 &',
+    'exec 9router -n -t -l -H 0.0.0.0 -p 20128 --skip-update'
+  ].join('\n');
+}
+
+async function writeNative9RouterSyncScript(projectDir) {
+  const syncScriptPath = path.join(projectDir, '.openclaw', '9router-smart-route-sync.js');
+  await fs.ensureDir(path.dirname(syncScriptPath));
+  await fs.writeFile(syncScriptPath, build9RouterSmartRouteSyncScript(path.join(getNative9RouterDataDir(), 'db.json')));
+  return syncScriptPath;
 }
 
 function extractFirstHttpUrl(text) {
@@ -1244,7 +1261,7 @@ async function main() {
     '# Fix chat.send dropping resolved agent timeout into reply pipeline.',
     '# Without this, Telegram/WebChat paths fall back to an internal 300s default even when',
     '# agents.defaults.timeoutSeconds is higher in config.',
-    `RUN node -e "const fs=require('fs');const path=require('path');const dir='/usr/local/lib/node_modules/openclaw/dist';const file=(fs.readdirSync(dir).find(n=>/^gateway-cli-.*\\.js$/.test(n))||'');if(!file){console.warn('gateway cli dist file not found; skipping timeout patch');process.exit(0);}const p=path.join(dir,file);let s=fs.readFileSync(p,'utf8');const from='\\t\\t\\t\\t\\tonAgentRunStart: (runId) => {';const to='\\t\\t\\t\\t\\ttimeoutOverrideSeconds: Math.max(1, Math.ceil(timeoutMs / 1e3)),\\n\\t\\t\\t\\t\\tonAgentRunStart: (runId) => {';if(s.includes(to)){process.exit(0);}if(!s.includes(from)){console.warn('chat.send patch anchor not found; skipping timeout patch');process.exit(0);}s=s.replace(from,to);fs.writeFileSync(p,s);"`,
+    `RUN node -e "const fs=require('fs');const path=require('path');const dir='/usr/local/lib/node_modules/openclaw/dist';const from='\\t\\t\\t\\t\\tonAgentRunStart: (runId) => {';const to='\\t\\t\\t\\t\\ttimeoutOverrideSeconds: Math.max(1, Math.ceil(timeoutMs / 1e3)),\\n\\t\\t\\t\\t\\tonAgentRunStart: (runId) => {';const files=fs.readdirSync(dir).filter(n=>/\\.js$/.test(n));let patched=0;for(const file of files){const p=path.join(dir,file);let s='';try{s=fs.readFileSync(p,'utf8');}catch{continue;}if(s.includes(to)||!s.includes(from))continue;s=s.replace(from,to);fs.writeFileSync(p,s);patched++;}if(!patched){process.exit(0);}"`,
     '',
     'WORKDIR /root/.openclaw',
     '',
@@ -1260,10 +1277,12 @@ async function main() {
   const agentId = botName.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/-$/, '') || 'chat';
   
   // ─── Dynamic Smart Route Sync Script ────────────────────────────────────────
-  // This script runs inside the 9Router container as a background loop.
-  // It reads the persisted 9Router DB directly so smart-route still works
-  // even when newer dashboard APIs require auth or change response shape.
-  const syncComboScript = build9RouterSmartRouteSyncScript('/root/.9router/db.json');
+  // This script runs inside the 9Router container as a background loop.
+  // It reads the persisted 9Router DB directly so smart-route still works
+  // even when newer dashboard APIs require auth or change response shape.
+  const syncComboScript = build9RouterSmartRouteSyncScript('/root/.9router/db.json');
+  const syncComboScriptBase64 = Buffer.from(syncComboScript).toString('base64');
+  const docker9RouterEntrypointScript = build9RouterComposeEntrypointScript(syncComboScriptBase64);
 
   // ─── Resolve primary model ───────────────────────────────────────────────────
   let modelsPrimary;
@@ -1307,17 +1326,14 @@ ${dependsOn}${extraHosts}    ports:
     image: node:22-slim
     container_name: 9router-multibot
     restart: always
-    entrypoint:
-      - /bin/sh
-      - -c
-      - |
-        npm install -g 9router
-        node -e "require('fs').writeFileSync('/tmp/sync.js',Buffer.from('\${Buffer.from(syncComboScript).toString('base64')}','base64').toString())"
-        node /tmp/sync.js > /tmp/sync.log 2>&1 &
-        exec 9router -n -t -l -H 0.0.0.0 -p 20128 --skip-update
-    environment:
-      - PORT=20128
-      - HOSTNAME=0.0.0.0
+    entrypoint:
+      - /bin/sh
+      - -c
+      - |
+${indentBlock(docker9RouterEntrypointScript, 8)}
+    environment:
+      - PORT=20128
+      - HOSTNAME=0.0.0.0
       - CI=true
     volumes:
       - 9router-data:/root/.9router
@@ -1402,17 +1418,14 @@ ${hasBrowserDesktop ? `    extra_hosts:\n      - "host.docker.internal:host-gate
     image: node:22-slim
     container_name: 9router-${agentId}
     restart: always
-    entrypoint:
-      - /bin/sh
-      - -c
-      - |
-        npm install -g 9router
-        node -e "require('fs').writeFileSync('/tmp/sync.js',Buffer.from('\${Buffer.from(syncComboScript).toString('base64')}','base64').toString())"
-        node /tmp/sync.js > /tmp/sync.log 2>&1 &
-        exec 9router -n -t -l -H 0.0.0.0 -p 20128 --skip-update
-    environment:
-      - PORT=20128
-      - HOSTNAME=0.0.0.0
+    entrypoint:
+      - /bin/sh
+      - -c
+      - |
+${indentBlock(docker9RouterEntrypointScript, 8)}
+    environment:
+      - PORT=20128
+      - HOSTNAME=0.0.0.0
       - CI=true
     volumes:
       - 9router-data:/root/.9router

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-openclaw-bot",
-  "version": "5.1.2",
+  "version": "5.1.4",
   "description": "Interactive CLI installer for OpenClaw Bot",
   "main": "cli.js",
   "bin": {

package/setup.js

@@ -1758,7 +1758,19 @@ model:
     // 3. Dockerfile
     const allPlugins = [];
     if (ch.pluginInstall) allPlugins.push(ch.pluginInstall);
-    state.config.plugins.forEach((pid) => {
+    const encodeBase64Utf8 = (value) => btoa(String.fromCharCode(...new TextEncoder().encode(String(value))));
+    const indentBlock = (text, spaces) => {
+      const prefix = ' '.repeat(spaces);
+      return String(text).split('\n').map((line) => `${prefix}${line}`).join('\n');
+    };
+    const build9RouterComposeEntrypointScript = (syncScriptBase64) => [
+      'npm install -g 9router',
+      `node -e "require('fs').writeFileSync('/tmp/sync.js',Buffer.from('${syncScriptBase64}','base64').toString())"`,
+      'node /tmp/sync.js > /tmp/sync.log 2>&1 &',
+      'exec 9router -n -t -l -H 0.0.0.0 -p 20128 --skip-update'
+    ].join('\n');
+
+    state.config.plugins.forEach((pid) => {
       const plug = PLUGINS.find((p) => p.id === pid);
       if (plug) allPlugins.push(plug.package);
     });
@@ -1815,7 +1827,7 @@ RUN apt-get update && apt-get install -y git curl${browserAptExtra} && rm -rf /v
 
 ARG CACHEBUST=${Date.now()}
 RUN npm install -g openclaw@latest${skillLines}${browserInstallLines}
-RUN node -e "const fs=require('fs');const path=require('path');const dir='/usr/local/lib/node_modules/openclaw/dist';const file=(fs.readdirSync(dir).find(n=>/^gateway-cli-.*\\.js$/.test(n))||'');if(!file){console.warn('gateway cli dist file not found; skipping timeout patch');process.exit(0);}const p=path.join(dir,file);let s=fs.readFileSync(p,'utf8');const from='\\t\\t\\t\\t\\tonAgentRunStart: (runId) => {';const to='\\t\\t\\t\\t\\ttimeoutOverrideSeconds: Math.max(1, Math.ceil(timeoutMs / 1e3)),\\n\\t\\t\\t\\t\\tonAgentRunStart: (runId) => {';if(s.includes(to)){process.exit(0);}if(!s.includes(from)){console.warn('chat.send patch anchor not found; skipping timeout patch');process.exit(0);}s=s.replace(from,to);fs.writeFileSync(p,s);}"
+RUN node -e "const fs=require('fs');const path=require('path');const dir='/usr/local/lib/node_modules/openclaw/dist';const from='\\t\\t\\t\\t\\tonAgentRunStart: (runId) => {';const to='\\t\\t\\t\\t\\ttimeoutOverrideSeconds: Math.max(1, Math.ceil(timeoutMs / 1e3)),\\n\\t\\t\\t\\t\\tonAgentRunStart: (runId) => {';const files=fs.readdirSync(dir).filter(n=>/\\.js$/.test(n));let patched=0;for(const file of files){const p=path.join(dir,file);let s='';try{s=fs.readFileSync(p,'utf8');}catch{continue;}if(s.includes(to)||!s.includes(from))continue;s=s.replace(from,to);fs.writeFileSync(p,s);patched++;}if(!patched){process.exit(0);}"
 WORKDIR /root/.openclaw
 
 EXPOSE 18791
@@ -1834,7 +1846,7 @@ ${finalCmd}`;
     // Background loop inside 9Router container every 30s.
     // Read providerConnections directly from db.json so smart-route survives
     // dashboard auth/response changes in newer 9Router builds.
-    const syncScript = `const fs=require('fs');const INTERVAL=30000;const p='/root/.9router/db.json';
+    const syncScript = `const fs=require('fs');const INTERVAL=30000;const p='/root/.9router/db.json';
 const PM={codex:['cx/gpt-5.4','cx/gpt-5.3-codex','cx/gpt-5.3-codex-high','cx/gpt-5.2-codex','cx/gpt-5.2','cx/gpt-5.1-codex-max','cx/gpt-5.1-codex','cx/gpt-5.1','cx/gpt-5-codex'],'claude-code':['cc/claude-opus-4-6','cc/claude-sonnet-4-6','cc/claude-opus-4-5-20251101','cc/claude-sonnet-4-5-20250929','cc/claude-haiku-4-5-20251001'],github:['gh/gpt-5.4','gh/gpt-5.3-codex','gh/gpt-5.2-codex','gh/gpt-5.2','gh/gpt-5.1-codex-max','gh/gpt-5.1-codex','gh/gpt-5.1','gh/gpt-5','gh/gpt-4.1','gh/gpt-4o','gh/claude-opus-4.6','gh/claude-sonnet-4.6','gh/claude-sonnet-4.5','gh/claude-opus-4.5','gh/claude-haiku-4.5','gh/gemini-3-pro-preview','gh/gemini-3-flash-preview','gh/gemini-2.5-pro'],cursor:['cu/default','cu/claude-4.6-opus-max','cu/claude-4.5-opus-high-thinking','cu/claude-4.5-sonnet-thinking','cu/claude-4.5-sonnet','cu/gpt-5.3-codex','cu/gpt-5.2-codex','cu/gemini-3-flash-preview'],kilo:['kc/anthropic/claude-sonnet-4-20250514','kc/anthropic/claude-opus-4-20250514','kc/google/gemini-2.5-pro','kc/google/gemini-2.5-flash','kc/openai/gpt-4.1','kc/deepseek/deepseek-chat'],cline:['cl/anthropic/claude-sonnet-4.6','cl/anthropic/claude-opus-4.6','cl/openai/gpt-5.3-codex','cl/openai/gpt-5.4','cl/google/gemini-3.1-pro-preview'],'gemini-cli':['gc/gemini-3-flash-preview','gc/gemini-3-pro-preview'],iflow:['if/qwen3-coder-plus','if/kimi-k2','if/kimi-k2-thinking','if/glm-4.7','if/deepseek-r1','if/deepseek-v3.2','if/deepseek-v3','if/qwen3-max','if/qwen3-235b','if/iflow-rome-30ba3b'],qwen:['qw/qwen3-coder-plus','qw/qwen3-coder-flash','qw/vision-model','qw/coder-model'],kiro:['kr/claude-sonnet-4.5','kr/claude-haiku-4.5','kr/deepseek-3.2','kr/deepseek-3.1','kr/qwen3-coder-next'],ollama:['ollama/gemma4:e2b','ollama/gemma4:e4b','ollama/gemma4:26b','ollama/gemma4:31b','ollama/qwen3.5','ollama/kimi-k2.5','ollama/glm-5','ollama/glm-4.7-flash','ollama/minimax-m2.5','ollama/gpt-oss:120b'],'kimi-coding':['kmc/kimi-k2.5','kmc/kimi-k2.5-thinking','kmc/kimi-latest'],glm:['glm/glm-5.1','glm/glm-5','glm/glm-4.7'],'glm-cn':['glm/glm-5.1','glm/glm-5','glm/glm-4.7'],minimax:['minimax/MiniMax-M2.7','minimax/MiniMax-M2.5','minimax/MiniMax-M2.1'],kimi:['kimi/kimi-k2.5','kimi/kimi-k2.5-thinking','kimi/kimi-latest'],deepseek:['deepseek/deepseek-chat','deepseek/deepseek-reasoner'],xai:['xai/grok-4','xai/grok-4-fast-reasoning','xai/grok-code-fast-1'],mistral:['mistral/mistral-large-latest','mistral/codestral-latest'],groq:['groq/llama-3.3-70b-versatile','groq/openai/gpt-oss-120b'],cerebras:['cerebras/gpt-oss-120b'],alicode:['alicode/qwen3.5-plus','alicode/qwen3-coder-plus'],openai:['openai/gpt-4o','openai/gpt-4.1'],anthropic:['anthropic/claude-sonnet-4','anthropic/claude-haiku-3.5'],gemini:['gemini/gemini-2.5-flash','gemini/gemini-2.5-pro']};
 console.log('[sync-combo] 9Router sync loop started...');
 const sync = async () => {
@@ -1884,9 +1896,11 @@ const sync = async () => {
       console.log('[sync-combo] Created smart-route: ' + c.models.length + ' models');
     }
   } catch (e) { }
-};
-setTimeout(sync, 5000);
-setInterval(sync, INTERVAL);`;
+};
+setTimeout(sync, 5000);
+setInterval(sync, INTERVAL);`;
+    const syncScriptBase64 = encodeBase64Utf8(syncScript);
+    const docker9RouterEntrypointScript = build9RouterComposeEntrypointScript(syncScriptBase64);
 
     let compose;
     if (isMultiBotWizard) {
@@ -1915,17 +1929,14 @@ ${dependsOn}${extraHosts}    volumes:
     image: node:22-slim
     container_name: 9router-multibot
     restart: always
-    entrypoint:
-      - /bin/sh
-      - -c
-      - |
-        npm install -g 9router
-        node -e "require('fs').writeFileSync('/tmp/sync.js',Buffer.from('\${Buffer.from(syncScript).toString('base64')}','base64').toString())"
-        node /tmp/sync.js > /tmp/sync.log 2>&1 &
-        exec 9router -n -t -l -H 0.0.0.0 -p 20128 --skip-update
-    environment:
-      - PORT=20128
-      - HOSTNAME=0.0.0.0
+    entrypoint:
+      - /bin/sh
+      - -c
+      - |
+${indentBlock(docker9RouterEntrypointScript, 8)}
+    environment:
+      - PORT=20128
+      - HOSTNAME=0.0.0.0
       - CI=true
     volumes:
       - 9router-data:/root/.9router
@@ -2011,17 +2022,14 @@ ${extraHostsBlock}
     image: node:22-slim
     container_name: 9router
     restart: always
-    entrypoint:
-      - /bin/sh
-      - -c
-      - |
-        npm install -g 9router
-        node -e "require('fs').writeFileSync('/tmp/sync.js',Buffer.from('\${Buffer.from(syncScript).toString('base64')}','base64').toString())"
-        node /tmp/sync.js > /tmp/sync.log 2>&1 &
-        exec 9router -n -t -l -H 0.0.0.0 -p 20128 --skip-update
-    environment:
-      - PORT=20128
-      - HOSTNAME=0.0.0.0
+    entrypoint:
+      - /bin/sh
+      - -c
+      - |
+${indentBlock(docker9RouterEntrypointScript, 8)}
+    environment:
+      - PORT=20128
+      - HOSTNAME=0.0.0.0
       - CI=true
     volumes:
       - 9router-data:/root/.9router

package/tests/smoke-cli-logic.mjs

@@ -5,6 +5,7 @@ const root = process.cwd();
 const cli = fs.readFileSync(path.join(root, 'cli.js'), 'utf8');
 const setup = fs.readFileSync(path.join(root, 'setup.js'), 'utf8');
 const indexHtml = fs.readFileSync(path.join(root, 'index.html'), 'utf8');
+const cliBytes = fs.readFileSync(path.join(root, 'cli.js'));
 
 function expect(condition, message) {
   if (!condition) {
@@ -32,6 +33,11 @@ checks.push(() => expectMatch(
   'Ubuntu/VPS must default to native deploy mode'
 ));
 
+checks.push(() => expect(
+  !(cliBytes[0] === 0xef && cliBytes[1] === 0xbb && cliBytes[2] === 0xbf),
+  'CLI entrypoint must not include a UTF-8 BOM before the shebang'
+));
+
 checks.push(() => expectMatch(
   cli,
   /if \(deployMode === 'docker' && !isDockerInstalled\(\)\)/,
@@ -86,9 +92,12 @@ checks.push(() => expectMatch(
   'CLI fast-test mode must be able to reuse an existing 9Router install'
 ));
 
-checks.push(() => expectMatch(
-  cli,
-  /function build9RouterSmartRouteSyncScript\(dbPath\) \{[\s\S]*safeDbPath[\s\S]*providerConnections[\s\S]*smart-route[\s\S]*async function writeNative9RouterSyncScript\(projectDir\) \{[\s\S]*getNative9RouterDataDir\(\), 'db\.json'/s,
+checks.push(() => expect(
+  cli.includes('function build9RouterSmartRouteSyncScript(dbPath) {')
+    && cli.includes('const safeDbPath = JSON.stringify(dbPath);')
+    && cli.includes("const ROUTER='http://localhost:20128';")
+    && cli.includes("fetch(ROUTER + '/api/providers')")
+    && cli.includes("build9RouterSmartRouteSyncScript(path.join(getNative9RouterDataDir(), 'db.json'))"),
   'Native 9Router flow must write a smart-route sync script based on the platform-specific 9Router data directory'
 ));
 
@@ -100,8 +109,9 @@ checks.push(() => expectMatch(
 
 checks.push(() => expect(
   cli.includes("Removed smart-route (no active providers)")
-    && cli.includes("if(!a.length){removeSmartRoute();return;}")
-    && cli.includes("if(!m.length){removeSmartRoute();return;}"),
+    && cli.includes("if (!a.length) {")
+    && cli.includes("if (!m.length) {")
+    && cli.includes("removeSmartRoute();"),
   '9Router sync logic in CLI must remove stale smart-route combos when providers are disabled'
 ));
 
@@ -282,20 +292,21 @@ checks.push(() => expectMatch(
 
 checks.push(() => expectMatch(
   setup,
-  /function providerLines\(arr, shell\) \{[\s\S]*npm install -g 9router[\s\S]*npm root -g[\s\S]*Join-Path \$npmRoot[\s\S]*Start-Process -WindowStyle Hidden -FilePath ''node\.exe''[\s\S]*9router-smart-route-sync\.js/s,
+  /function providerLines\(arr, shell\) \{[\s\S]*npm install -g 9router[\s\S]*start "9Router" cmd \/k "9router -n -t -l -H 0\.0\.0\.0 -p 20128 --skip-update"[\s\S]*9router-smart-route-sync\.js/s,
   'Native script generation must install and start a standalone 9Router dashboard on port 20128'
 ));
 
 checks.push(() => expectMatch(
   setup,
-  /function native9RouterSyncScriptContent\(\) \{[\s\S]*process\.platform==='win32'[\s\S]*AppData[\s\S]*Roaming[\s\S]*providerConnections[\s\S]*smart-route/s,
-  'Native script generation must embed a 9Router smart-route sync script with the correct Windows data directory'
+  /function native9RouterSyncScriptContent\(\) \{[\s\S]*path\.join\(process\.env\.HOME\|\|process\.env\.USERPROFILE\|\|'\.'\,\'\.9router\'\,\'db\.json\'\)[\s\S]*providerConnections[\s\S]*smart-route/s,
+  'Native script generation must embed a 9Router smart-route sync script'
 ));
 
 checks.push(() => expect(
   setup.includes("Removed smart-route (no active providers)")
-    && setup.includes("if(!a.length){removeSmartRoute();return;}")
-    && setup.includes("if(!m.length){removeSmartRoute();return;}"),
+    && setup.includes("if (!a.length) {")
+    && setup.includes("if (!m.length) {")
+    && setup.includes("removeSmartRoute();"),
   '9Router sync logic in setup.js must remove stale smart-route combos when providers are disabled'
 ));
 
@@ -307,14 +318,24 @@ checks.push(() => expectMatch(
 
 checks.push(() => expectMatch(
   cli,
-  /readdirSync\(dir\)\.find\(n=>\/\^gateway-cli-.*\\\\\.js\$\/\.test\(n\)\)[\s\S]*skipping timeout patch/,
-  'Dockerfile patching in CLI must resolve gateway-cli dist files dynamically instead of hardcoding one hash'
+  /const files=fs\.readdirSync\(dir\)\.filter\(n=>\/\\\\\.js\$\/\.test\(n\)\)[\s\S]*let patched=0[\s\S]*if\(!patched\)\{process\.exit\(0\);\}/,
+  'Dockerfile patching in CLI must scan all OpenClaw dist JS files and silently skip when no timeout patch anchor exists'
+));
+
+checks.push(() => expect(
+  !cli.includes("Buffer.from('\\${Buffer.from(syncComboScript).toString('base64')}','base64')"),
+  'CLI must precompute the 9Router sync script base64 instead of leaking Docker Compose interpolation markers'
 ));
 
 checks.push(() => expectMatch(
   setup,
-  /readdirSync\(dir\)\.find\(n=>\/\^gateway-cli-.*\\\\\.js\$\/\.test\(n\)\)[\s\S]*skipping timeout patch/,
-  'Dockerfile patching in setup.js must resolve gateway-cli dist files dynamically instead of hardcoding one hash'
+  /const files=fs\.readdirSync\(dir\)\.filter\(n=>\/\\\\\.js\$\/\.test\(n\)\)[\s\S]*let patched=0[\s\S]*if\(!patched\)\{process\.exit\(0\);\}/,
+  'Dockerfile patching in setup.js must scan all OpenClaw dist JS files and silently skip when no timeout patch anchor exists'
+));
+
+checks.push(() => expect(
+  !setup.includes("Buffer.from('\\${Buffer.from(syncScript).toString('base64')}','base64')"),
+  'Wizard compose generation must precompute the 9Router sync script base64 instead of leaking Docker Compose interpolation markers'
 ));
 
 checks.push(() => expectMatch(