create-openclaw-bot 5.1.7 → 5.1.9

package/CHANGELOG.md

@@ -1,6 +1,22 @@
 # Changelog (English)
 
 
+## [5.1.9] — 2026-04-07
+
+### 🌟 Strict Schema Fix & WebCrypto UX Improvement
+
+- **Revert Unrecognized Config Key**: OpenClaw v2026.x.x enforces strict Zod schema validation. The previously injected `requireDeviceIdentity` flag caused an immediate startup crash (`Config invalid`). This version surgically removes the offending flag, ensuring the gateway boots successfully.
+- **Dynamic SSH Tunnel Helper**: Since WebCrypto strictly demands a secure context (HTTPS/localhost), accessing the dashboard via raw VPS IP triggers a `1008` error natively. The CLI now dynamically generates and prints the exact `ssh -L 18791:localhost:18791 ...` Port Forwarding command right in the terminal, guaranteeing a flawless, secure login experience for remote server operators without needing SSL.
+
+
+## [5.1.8] — 2026-04-07
+
+### 🌟 Dashboard VPS Connectivity & Token Login Fix
+
+- **Fix `requireDeviceIdentity` Error on VPS**: OpenClaw's WebCrypto E2E identity check inherently demands a secure browser context (HTTPS or localhost). For raw IPv4 VPS deployments, the `crypto.subtle` browser limitation causes WebSocket `code=1008` rejection upon token login. The setup tool now seamlessly injects `requireDeviceIdentity: false` into the `gateway.controlUi` configuration, granting you flawless remote login capabilities over standard HTTP networks.
+- **Dynamic Terminal URLs**: The programmatic CLI will now intelligently scan and log your external, reachable IPv4 addresses in the console output alongside the local endpoints. This eliminates confusion and guarantees that the automatically generated tokenized dashboard links are ready for immediate copy-pasting.
+
+
 ## [5.1.7] — 2026-04-07
 
 ### 🌟 Fix Control UI CORS & Native 9Router Path Resolution

package/CHANGELOG.vi.md

@@ -1,6 +1,22 @@
 # Changelog (Tiếng Việt)
 
 
+## [5.1.9] — 2026-04-07
+
+### 🌟 Trả lại Schema Chuẩn & Cải thiện UX WebCrypto
+
+- **Sửa lỗi sập Gateway do sai lầm Config**: OpenClaw bản mới nhất dùng Zod để khóa chặt Schema cấu hình. Cờ `requireDeviceIdentity` chêm vào bản 5.1.8 đã bị Backend từ chối thẳng thừng (`Unrecognized key`), dẫn đến server không thể khởi động vòng lặp. Bản 5.1.9 đã gỡ sạch cờ này, trả lại môi trường sạch để PM2 hoạt động 100%.
+- **Trợ lý SSH Tunnel Tự Động**: Bù lại sự khắt khe của WebCrypto khi dùng VPS/IP ngoài, Console giờ đây sẽ tự động in sẵn thần chú lệnh bẻ khóa `ssh -L ...` y hệt IP và Username thật của bạn. Bạn chỉ cần copy-paste để thông luồng một cách ngầu lòi, bảo mật tuyệt đối mà không cần mua Tên miền HTTPS.
+
+
+## [5.1.8] — 2026-04-07
+
+### 🌟 Sửa lỗi Đăng nhập Token (1008) & Cải tiến IP hiển thị trên VPS
+
+- **Tắt `requireDeviceIdentity` để vượt tường WebCrypto**: Do cơ chế bảo mật mới của Control UI bắt buộc trình duyệt phải dùng môi trường HTTPS (hoặc localhost) thì mới cấp quyền khởi tạo key mã hóa thiết bị E2E. Nếu dùng IP thường (HTTP) thì Dashboard sẽ báo lỗi đỏ `code=1008`. Bản setup mới nhất đã tự động chích cờ `requireDeviceIdentity: false` để tắt cơ chế ép buộc này đi, giúp bạn vào thẳng Dashboard bằng IP của VPS.
+- **Hiển thị Link Public ở Terminal**: Cấu trúc báo cáo của PM2 đã được viết lại để tự động tìm và sinh ra các đường dẫn kèm IPv4 Public (thay vì chỉ in mỗi `localhost`). Giờ đây bạn chỉ việc soi console và bấm/copy thẳng link vào trình duyệt mà không cần phải tự chế nữa.
+
+
 ## [5.1.7] — 2026-04-07
 
 ### 🌟 Sửa lỗi CORS Control UI & Đường dẫn 9Router Native

package/README.md

@@ -3,7 +3,7 @@
 # 🦞 OpenClaw Setup
 
 <p align="center">
-  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.1.7-0EA5E9?style=for-the-badge" alt="Version 5.1.7" /></a>
+  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.1.9-0EA5E9?style=for-the-badge" alt="Version 5.1.9" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup?tab=MIT-1-ov-file"><img src="https://img.shields.io/badge/LICENSE-MIT-success?style=for-the-badge" alt="MIT License" /></a>
   <a href="https://www.npmjs.com/package/create-openclaw-bot"><img src="https://img.shields.io/npm/v/create-openclaw-bot?style=for-the-badge&label=CLI&color=2563EB&logo=npm&logoColor=white" alt="NPM Version" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup/stargazers"><img src="https://img.shields.io/github/stars/tuanminhhole/openclaw-setup?style=for-the-badge&color=eab308&logo=github&logoColor=white" alt="GitHub Stars" /></a>
@@ -24,7 +24,7 @@ An interactive **CLI tool** and **Setup Wizard** to deploy your own free AI Bot
 
 ---
 
-## 🆕 What's new in v5.1.7
+## 🆕 What's new in v5.1.9
 
 - 💻 **OS-First Setup** — Step 1 is now choosing your OS (Windows, macOS, Ubuntu, VPS). All scripts, configs, and instructions are generated to match.
 - 🧠 **Gemma 4 — 4 sizes** — `gemma4:e2b` (~4 GB), `gemma4:e4b` (~8 GB), `gemma4:26b` (~18 GB), `gemma4:31b` (~24 GB). Auto-pulled on first launch.
@@ -112,7 +112,7 @@ Run in your terminal → follow the interactive prompts → startup script is ge
 2. Open this repo as your workspace
 3. Paste into chat:
    ```
-   Read SETUP.md and set up OpenClaw v5.1.7 for me.
+   Read SETUP.md and set up OpenClaw v5.1.9 for me.
    My bot token is X. Use 9Router (no API key).
    My project folder: <YOUR_PATH>
    ```

package/README.vi.md

@@ -3,7 +3,7 @@
 # 🦞 OpenClaw Setup
 
 <p align="center">
-  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.1.7-0EA5E9?style=for-the-badge" alt="Version 5.1.7" /></a>
+  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.1.9-0EA5E9?style=for-the-badge" alt="Version 5.1.9" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup?tab=MIT-1-ov-file"><img src="https://img.shields.io/badge/LICENSE-MIT-success?style=for-the-badge" alt="MIT License" /></a>
   <a href="https://www.npmjs.com/package/create-openclaw-bot"><img src="https://img.shields.io/npm/v/create-openclaw-bot?style=for-the-badge&label=CLI&color=2563EB&logo=npm&logoColor=white" alt="NPM Version" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup/stargazers"><img src="https://img.shields.io/github/stars/tuanminhhole/openclaw-setup?style=for-the-badge&color=eab308&logo=github&logoColor=white" alt="GitHub Stars" /></a>
@@ -24,7 +24,7 @@ Công cụ **CLI tương tác** và **Setup Wizard** để tự triển khai Bot
 
 ---
 
-## 🆕 Có gì mới trong v5.1.7
+## 🆕 Có gì mới trong v5.1.9
 
 - 💻 **OS-First Setup** — Bước đầu tiên bây giờ là chọn hệ điều hành của bạn (Windows, macOS, Ubuntu, VPS). Toàn bộ script, cấu hình và hướng dẫn được tạo ra phù hợp với lựa chọn đó.
 - 🧠 **Gemma 4 — 4 kích thước** — `gemma4:e2b` (~4 GB), `gemma4:e4b` (~8 GB), `gemma4:26b` (~18 GB), `gemma4:31b` (~24 GB). Tự pull về khi bot khởi động lần đầu.
@@ -112,7 +112,7 @@ Chạy lệnh trên trong Terminal → làm theo các prompt tương tác → sc
 2. Mở repo này làm workspace
 3. Paste vào chat:
    ```
-   Read SETUP.md and set up OpenClaw v5.1.7 for me.
+   Read SETUP.md and set up OpenClaw v5.1.9 for me.
    My bot token is X. Use 9Router (no API key).
    My project folder: <THƯ_MỤC_CỦA_BẠN>
    ```

package/cli.js

@@ -184,6 +184,45 @@ function getGatewayAllowedOrigins(port) {
   return Array.from(origins);
 }
 
+function getReachableDashboardHosts(port) {
+  const normalizedPort = Number(port) || 18791;
+  const hosts = [];
+  const pushHost = (host) => {
+    if (!host) return;
+    const url = `http://${host}:${normalizedPort}`;
+    if (!hosts.includes(url)) {
+      hosts.push(url);
+    }
+  };
+
+  pushHost('127.0.0.1');
+  pushHost('localhost');
+
+  for (const entries of Object.values(os.networkInterfaces() || {})) {
+    for (const entry of entries || []) {
+      if (!entry || entry.internal || entry.family !== 'IPv4' || !entry.address) {
+        continue;
+      }
+      pushHost(entry.address);
+    }
+  }
+
+  return hosts;
+}
+
+function rewriteDashboardUrlHost(urlText, fallbackPort, targetBaseUrl) {
+  try {
+    const target = new URL(targetBaseUrl);
+    const parsed = new URL(urlText);
+    parsed.protocol = target.protocol;
+    parsed.hostname = target.hostname;
+    parsed.port = target.port || String(fallbackPort || '');
+    return parsed.toString();
+  } catch {
+    return `${targetBaseUrl}${String(urlText || '').startsWith('/') ? '' : '/'}${String(urlText || '')}`;
+  }
+}
+
 async function waitFor9RouterApiReady({ port = 20128, timeoutMs = 15000 } = {}) {
   const deadline = Date.now() + timeoutMs;
   const candidates = [
@@ -441,27 +480,68 @@ function getTokenizedDashboardUrl(projectDir) {
   }
 }
 
-function printNativeDashboardAccessInfo({ isVi, providerKey, projectDir, gatewayPort = 18791 }) {
-  const dashboardUrl = `http://localhost:${gatewayPort}`;
-  const tokenizedUrl = getTokenizedDashboardUrl(projectDir);
-
-  console.log(chalk.yellow(`\n🧭 ${isVi ? 'Dashboard OpenClaw:' : 'OpenClaw Dashboard:'} ${dashboardUrl}`));
-
-  if (tokenizedUrl) {
-    console.log(chalk.green(isVi
-      ? `   → Mở link đã kèm token: ${tokenizedUrl}`
-      : `   → Open the tokenized link directly: ${tokenizedUrl}`));
-  } else {
-    console.log(chalk.gray(isVi
-      ? '   → Nếu dashboard đòi Gateway Token, chạy: openclaw dashboard'
-      : '   → If the dashboard asks for a Gateway Token, run: openclaw dashboard'));
-  }
-
-  if (providerKey === '9router') {
-    console.log(chalk.yellow(`\n🔀 ${isVi ? '9Router Dashboard:' : '9Router Dashboard:'} http://localhost:20128/dashboard`));
-    console.log(chalk.gray(isVi
-      ? '   → Mở dashboard 9Router → đăng nhập OAuth → kết nối provider miễn phí'
-      : '   → Open the 9Router dashboard → complete OAuth login → connect a free provider'));
+function printNativeDashboardAccessInfo({ isVi, providerKey, projectDir, gatewayPort = 18791 }) {
+  const gatewayUrls = getReachableDashboardHosts(gatewayPort);
+  const dashboardUrl = gatewayUrls[0] || `http://127.0.0.1:${gatewayPort}`;
+  const tokenizedUrl = getTokenizedDashboardUrl(projectDir);
+
+  console.log(chalk.yellow(`\n🧭 ${isVi ? 'Dashboard OpenClaw:' : 'OpenClaw Dashboard:'} ${dashboardUrl}`));
+  if (gatewayUrls.length > 1) {
+    console.log(chalk.gray(isVi
+      ? `   → Link khac co the mo duoc: ${gatewayUrls.slice(1).join(' , ')}`
+      : `   → Other reachable URLs: ${gatewayUrls.slice(1).join(' , ')}`));
+  }
+
+  if (tokenizedUrl) {
+    const tokenizedUrls = gatewayUrls.map((baseUrl) => rewriteDashboardUrlHost(tokenizedUrl, gatewayPort, baseUrl));
+    console.log(chalk.green(isVi
+      ? `   → Mở link đã kèm token: ${tokenizedUrls[0]}`
+      : `   → Open the tokenized link directly: ${tokenizedUrls[0]}`));
+    if (tokenizedUrls.length > 1) {
+      console.log(chalk.gray(isVi
+        ? `   → Ban mo tu may khac/WSL thi thu: ${tokenizedUrls.slice(1).join(' , ')}`
+        : `   → If you are opening from another machine/WSL, try: ${tokenizedUrls.slice(1).join(' , ')}`));
+    }
+
+    const externalHosts = gatewayUrls.filter(u => !u.includes('localhost') && !u.includes('127.0.0.1')).map(u => {
+      try { return new URL(u).hostname; } catch { return u; }
+    });
+    
+    if (externalHosts.length > 0) {
+      const mainIp = externalHosts[0];
+      const username = process.env.USER || 'user';
+      console.log(chalk.cyan(`\n🔐 ${isVi ? 'Bảo mật WebCrypto (Sửa Lỗi 1008)' : 'WebCrypto Security (Fix Error 1008)'}`));
+      console.log(chalk.gray(isVi
+        ? `   Nếu dùng các link IP ngoài (như ${mainIp}) bị lỗi từ chối kết nối WebCrypto (mã 1008):`
+        : `   If non-localhost IPs (like ${mainIp}) block WebCrypto connections with Error 1008:`));
+      console.log(chalk.white(isVi
+        ? `   1. Trên WSL/Máy nội bộ: Bạn CHỈ CẦN mở link http://127.0.0.1:${gatewayPort} là vào được.`
+        : `   1. On WSL/Local Network: Use the http://127.0.0.1:${gatewayPort} link directly.`));
+      console.log(chalk.white(isVi
+        ? `   2. Trên VPS Xa: Mở tab Terminal khác ở MÁY CỦA BẠN (Windows/Mac) chạy lệnh SSH Tunnel sau:`
+        : `   2. On Remote VPS: Run this SSH Tunnel command on YOUR LOCAL COMPUTER (Windows/Mac):`));
+      console.log(chalk.bgBlack.white(`      ssh -L ${gatewayPort}:localhost:${gatewayPort} ${username}@${mainIp}   `));
+      console.log(chalk.gray(isVi
+        ? `      Rồi quay lại trình duyệt mở link http://127.0.0.1:${gatewayPort}/#token=... là xong!`
+        : `      Then open the http://127.0.0.1:${gatewayPort}/#token=... link in your browser!`));
+    }
+  } else {
+    console.log(chalk.gray(isVi
+      ? '   → Nếu dashboard đòi Gateway Token, chạy: openclaw dashboard'
+      : '   → If the dashboard asks for a Gateway Token, run: openclaw dashboard'));
+  }
+
+  if (providerKey === '9router') {
+    const routerUrls = getReachableDashboardHosts(20128).map((baseUrl) => `${baseUrl}/dashboard`);
+    console.log(chalk.yellow(`\n🔀 ${isVi ? '9Router Dashboard:' : '9Router Dashboard:'} ${routerUrls[0] || 'http://127.0.0.1:20128/dashboard'}`));
+    if (routerUrls.length > 1) {
+      console.log(chalk.gray(isVi
+        ? `   → Link khac co the mo duoc: ${routerUrls.slice(1).join(' , ')}`
+        : `   → Other reachable URLs: ${routerUrls.slice(1).join(' , ')}`));
+    }
+    console.log(chalk.gray(isVi
+      ? '   → Mở dashboard 9Router → đăng nhập OAuth → kết nối provider miễn phí'
+      : '   → Open the 9Router dashboard → complete OAuth login → connect a free provider'));
     console.log(chalk.gray(isVi
       ? '   → Sau khi login 9Router xong, bot sẽ tự dùng model smart-route qua http://localhost:20128/v1'
       : '   → Once 9Router is logged in, the bot will use smart-route through http://localhost:20128/v1'));
@@ -2233,13 +2313,14 @@ fi
       if (code === 0) {
         console.log(chalk.green(`\n🎉 ${isVi ? 'Setup hoàn tất! Bot đang chạy.' : 'Setup complete! Bot is running.'}`));
         
-        if (providerKey === '9router') {
-          console.log(chalk.yellow(`\n🔀 ${isVi
-            ? '9Router Dashboard: http://localhost:20128/dashboard'
-            : '9Router Dashboard: http://localhost:20128/dashboard'}`));
-          console.log(chalk.gray(isVi
-            ? '   → Mở dashboard → đăng nhập OAuth để kết nối các Provider (iFlow, Gemini CLI, Claude Code...)'
-            : '   → Open dashboard → OAuth login to connect Providers (iFlow, Gemini CLI, Claude Code...)'));
+        if (providerKey === '9router') {
+          const routerDashboardUrl = `${getReachableDashboardHosts(20128)[0] || 'http://127.0.0.1:20128'}/dashboard`;
+          console.log(chalk.yellow(`\n🔀 ${isVi
+            ? `9Router Dashboard: ${routerDashboardUrl}`
+            : `9Router Dashboard: ${routerDashboardUrl}`}`));
+          console.log(chalk.gray(isVi
+            ? '   → Mở dashboard → đăng nhập OAuth để kết nối các Provider (iFlow, Gemini CLI, Claude Code...)'
+            : '   → Open dashboard → OAuth login to connect Providers (iFlow, Gemini CLI, Claude Code...)'));
           console.log(chalk.gray(isVi
             ? '   → Sau khi kết nối provider, bot sẽ tự động hoạt động qua combo "smart-route"'
             : '   → After connecting providers, bot works automatically via "smart-route" combo'));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-openclaw-bot",
-  "version": "5.1.7",
+  "version": "5.1.9",
   "description": "Interactive CLI installer for OpenClaw Bot",
   "main": "cli.js",
   "bin": {

package/setup.js

@@ -1,4 +1,4 @@
-/* ============================================
+/* ============================================
    OpenClaw Setup Wizard — Logic v2
    Multi-model, Multi-plugin, Multi-channel
    ============================================ */

package/tests/smoke-cli-logic.mjs

@@ -116,6 +116,14 @@ checks.push(() => expect(
   'CLI must derive control UI allowed origins from localhost plus non-internal IPv4 interfaces'
 ));
 
+checks.push(() => expect(
+  cli.includes('function getReachableDashboardHosts(port) {')
+    && cli.includes('pushHost(\'127.0.0.1\')')
+    && cli.includes('pushHost(\'localhost\')')
+    && cli.includes('function rewriteDashboardUrlHost(urlText, fallbackPort, targetBaseUrl) {'),
+  'CLI must derive reachable dashboard hosts and rewrite tokenized dashboard URLs for WSL/LAN access'
+));
+
 checks.push(() => expect(
   cli.includes("Removed smart-route (no active providers)")
     && cli.includes("if (!a.length) {")
@@ -144,7 +152,7 @@ checks.push(() => expectMatch(
 
 checks.push(() => expectMatch(
   cli,
-  /function printNativeDashboardAccessInfo\(\{ isVi, providerKey, projectDir, gatewayPort = 18791 \}\) \{[\s\S]*openclaw dashboard[\s\S]*9Router Dashboard:[\s\S]*localhost:20128\/dashboard/s,
+  /function printNativeDashboardAccessInfo\(\{ isVi, providerKey, projectDir, gatewayPort = 18791 \}\) \{[\s\S]*getReachableDashboardHosts\(gatewayPort\)[\s\S]*rewriteDashboardUrlHost[\s\S]*Other reachable URLs[\s\S]*getReachableDashboardHosts\(20128\)/s,
   'Native PM2 flow must expose dashboard access info and the tokenized dashboard command'
 ));
 

package/tmp_diff.patch

@@ -1,363 +0,0 @@
-diff --git a/cli.js b/cli.js
-index 4b32aaf..4323e60 100644
---- a/cli.js
-+++ b/cli.js
-@@ -146,34 +146,13 @@ function spawnBackgroundProcess(command, args, options = {}) {
- }
- 
- function resolveNative9RouterDesktopLaunch() {
--  if (process.platform === 'win32') {
--    const npmRoot = (() => {
--      try {
--        return execSync('npm root -g', {
--          stdio: ['ignore', 'pipe', 'ignore'],
--          encoding: 'utf8',
--          shell: true,
--          env: process.env
--        }).trim();
--      } catch {
--        return path.join(process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming'), 'npm', 'node_modules');
--      }
--    })();
--
--    return {
--      command: process.execPath,
--      args: [path.join(npmRoot, '9router', 'app', 'server.js')],
--      env: {
--        PORT: '20128',
--        HOSTNAME: '0.0.0.0'
--      }
--    };
--  }
--
-   return {
--    command: '9router',
--    args: ['-n', '-l', '-H', '0.0.0.0', '-p', '20128', '--skip-update'],
--    env: {}
-+    command: process.execPath,
-+    args: [path.join(getGlobalNpmRoot(), '9router', 'app', 'server.js')],
-+    env: {
-+      PORT: '20128',
-+      HOSTNAME: '0.0.0.0'
-+    }
-   };
- }
- 
-@@ -185,6 +164,26 @@ function getNative9RouterDataDir() {
-   return path.join(os.homedir(), '.9router');
- }
- 
-+function getGatewayAllowedOrigins(port) {
-+  const normalizedPort = Number(port) || 18791;
-+  const origins = new Set([
-+    `http://localhost:${normalizedPort}`,
-+    `http://127.0.0.1:${normalizedPort}`,
-+    `http://0.0.0.0:${normalizedPort}`
-+  ]);
-+
-+  for (const entries of Object.values(os.networkInterfaces() || {})) {
-+    for (const entry of entries || []) {
-+      if (!entry || entry.internal || entry.family !== 'IPv4' || !entry.address) {
-+        continue;
-+      }
-+      origins.add(`http://${entry.address}:${normalizedPort}`);
-+    }
-+  }
-+
-+  return Array.from(origins);
-+}
-+
- async function waitFor9RouterApiReady({ port = 20128, timeoutMs = 15000 } = {}) {
-   const deadline = Date.now() + timeoutMs;
-   const candidates = [
-@@ -380,6 +379,22 @@ function resolveCommandOnPath(command) {
-   }
- }
- 
-+function getGlobalNpmRoot() {
-+  try {
-+    return execSync('npm root -g', {
-+      stdio: ['ignore', 'pipe', 'ignore'],
-+      encoding: 'utf8',
-+      shell: true,
-+      env: process.env
-+    }).trim();
-+  } catch {
-+    if (process.platform === 'win32') {
-+      return path.join(process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming'), 'npm', 'node_modules');
-+    }
-+    return path.join(os.homedir(), '.local', 'lib', 'node_modules');
-+  }
-+}
-+
- function indentBlock(text, spaces) {
-   const prefix = ' '.repeat(spaces);
-   return String(text)
-@@ -625,10 +640,10 @@ function runPm2Save({ projectDir, isVi }) {
- 
- function startNative9RouterPm2({ isVi, projectDir, appName, syncScriptPath }) {
-   const routerAppName = `${appName}-9router`;
--  const routerCommand = resolveCommandOnPath('9router');
-+  const routerLaunch = resolveNative9RouterDesktopLaunch();
-   execFileSync('pm2', [
-     'start',
--    routerCommand,
-+    routerLaunch.command,
-     '--name',
-     routerAppName,
-     '--cwd',
-@@ -636,17 +651,11 @@ function startNative9RouterPm2({ isVi, projectDir, appName, syncScriptPath }) {
-     '--interpreter',
-     'none',
-     '--',
--    '-n',
--    '-l',
--    '-H',
--    '0.0.0.0',
--    '-p',
--    '20128',
--    '--skip-update'
-+    ...routerLaunch.args
-   ], {
-     cwd: projectDir,
-     stdio: 'inherit',
--    env: process.env
-+    env: { ...process.env, ...routerLaunch.env }
-   });
-   if (syncScriptPath) {
-     const syncAppName = `${appName}-9router-sync`;
-@@ -1273,7 +1282,7 @@ async function main() {
-   }
-   
-   
--  const patchScript = `const fs=require('fs'),p='/root/.openclaw/openclaw.json';if(fs.existsSync(p)){const c=JSON.parse(fs.readFileSync(p,'utf8'));c.tools=Object.assign({},c.tools,{profile:'full',exec:{host:'gateway',security:'full',ask:'off'}});c.gateway=Object.assign({},c.gateway,{port:18791,bind:'custom',customBindHost:'0.0.0.0'});fs.writeFileSync(p,JSON.stringify(c,null,2));}`;
-+  const patchScript = `const fs=require('fs'),os=require('os'),p='/root/.openclaw/openclaw.json';if(fs.existsSync(p)){const c=JSON.parse(fs.readFileSync(p,'utf8'));const a=new Set(['http://localhost:18791','http://127.0.0.1:18791','http://0.0.0.0:18791']);for(const entries of Object.values(os.networkInterfaces()||{})){for(const entry of entries||[]){if(!entry||entry.internal||entry.family!=='IPv4'||!entry.address)continue;a.add(\`http://\${entry.address}:18791\`);}}c.tools=Object.assign({},c.tools,{profile:'full',exec:{host:'gateway',security:'full',ask:'off'}});c.gateway=Object.assign({},c.gateway,{port:18791,bind:'custom',customBindHost:'0.0.0.0',controlUi:Object.assign({},c.gateway?.controlUi,{allowedOrigins:Array.from(a)})});fs.writeFileSync(p,JSON.stringify(c,null,2));}`;
-   const b64Patch = Buffer.from(patchScript).toString('base64');
- 
-   // Browser Playwright (both desktop & server modes need chromium)
-@@ -1737,6 +1746,9 @@ ${hasBrowserDesktop ? `    extra_hosts:
-         mode: 'local',
-         bind: 'custom',
-         customBindHost: '0.0.0.0',
-+        controlUi: {
-+          allowedOrigins: getGatewayAllowedOrigins(18791),
-+        },
-         auth: { mode: 'token', token: 'cli-dummy-token-xyz123' },
-       },
-     };
-@@ -1967,6 +1979,7 @@ ${hasBrowserDesktop ? `    extra_hosts:
-       tools: { profile: 'full', exec: { host: 'gateway', security: 'full', ask: 'off' } },
-       gateway: {
-         port: 18791 + (isMultiBot ? bIndex : 0), mode: 'local', bind: 'custom', customBindHost: '0.0.0.0',
-+        controlUi: { allowedOrigins: getGatewayAllowedOrigins(18791 + (isMultiBot ? bIndex : 0)) },
-         auth: { mode: 'token', token: 'cli-dummy-token-xyz123' }
-       }
-     };
-diff --git a/setup.js b/setup.js
-index 885a34a..2a33996 100644
---- a/setup.js
-+++ b/setup.js
-@@ -49,6 +49,20 @@
-     },
-   };
- 
-+  function getGatewayAllowedOrigins(port) {
-+    const normalizedPort = Number(port) || 18791;
-+    const origins = new Set([
-+      `http://localhost:${normalizedPort}`,
-+      `http://127.0.0.1:${normalizedPort}`,
-+      `http://0.0.0.0:${normalizedPort}`,
-+    ]);
-+    const currentHost = (window.location && window.location.hostname) ? window.location.hostname.trim() : '';
-+    if (currentHost) {
-+      origins.add(`http://${currentHost}:${normalizedPort}`);
-+    }
-+    return Array.from(origins);
-+  }
-+
- 
-   // ========== AI Providers & Models ==========
-   const PROVIDERS = {
-@@ -1581,6 +1595,9 @@ Write-Host "Chrome se tu dong bat Debug Mode moi khi ban dang nhap Windows (dela
-         port: 18791,
-         mode: 'local',
-         bind: '0.0.0.0',
-+        controlUi: {
-+          allowedOrigins: getGatewayAllowedOrigins(18791),
-+        },
-         auth: { mode: 'token', token: crypto.randomUUID().replace(/-/g, '') },
-       },
-     };
-@@ -1815,7 +1832,7 @@ model:
-       ? 'socat TCP-LISTEN:9222,fork,reuseaddr TCP:host.docker.internal:9222 & '
-       : '';
-     // Patch config on every startup to keep gateway settings stable
--    const patchCmd = `node -e \\"const fs=require('fs'),p='/root/.openclaw/openclaw.json';if(fs.existsSync(p)){const c=JSON.parse(fs.readFileSync(p,'utf8'));c.tools=Object.assign({},c.tools,{profile:'full',exec:{host:'gateway',security:'full',ask:'off'}});c.gateway=Object.assign({},c.gateway,{port:18791,bind:'custom',customBindHost:'0.0.0.0'});fs.writeFileSync(p,JSON.stringify(c,null,2));}\\" && `;
-+    const patchCmd = `node -e \\"const fs=require('fs'),os=require('os'),p='/root/.openclaw/openclaw.json';if(fs.existsSync(p)){const c=JSON.parse(fs.readFileSync(p,'utf8'));const a=new Set(['http://localhost:18791','http://127.0.0.1:18791','http://0.0.0.0:18791']);for(const entries of Object.values(os.networkInterfaces()||{})){for(const entry of entries||[]){if(!entry||entry.internal||entry.family!=='IPv4'||!entry.address)continue;a.add(\\\`http://\\\${entry.address}:18791\\\`);}}c.tools=Object.assign({},c.tools,{profile:'full',exec:{host:'gateway',security:'full',ask:'off'}});c.gateway=Object.assign({},c.gateway,{port:18791,bind:'custom',customBindHost:'0.0.0.0',controlUi:Object.assign({},c.gateway?.controlUi,{allowedOrigins:Array.from(a)})});fs.writeFileSync(p,JSON.stringify(c,null,2));}\\" && `;
-     // Auto-approve device pairing after gateway starts (required since v2026.3.x)
-     const autoApproveCmd = '(while true; do sleep 5; openclaw devices approve --latest 2>/dev/null || true; done) & ';
-     const finalCmd = `CMD sh -c "${pluginInstallCmd}${patchCmd}${browserPrefix}${autoApproveCmd}${gatewayCmd}"`;
-@@ -2875,7 +2892,7 @@ const sync=()=>{try{let db={};try{db=JSON.parse(fs.readFileSync(p,'utf8'));}catc
-           arr.push('timeout /t 5 /nobreak >nul');
-         } else {
-           arr.push('npm install -g 9router');
--          arr.push('nohup 9router -n -l -H 0.0.0.0 -p 20128 --skip-update >/tmp/9router.log 2>&1 &');
-+          arr.push('nohup env PORT=20128 HOSTNAME=0.0.0.0 node "$(npm root -g)/9router/app/server.js" >/tmp/9router.log 2>&1 &');
-           arr.push('nohup node ./.openclaw/9router-smart-route-sync.js >/tmp/9router-sync.log 2>&1 &');
-           arr.push('sleep 3');
-         }
-@@ -3040,6 +3057,9 @@ const sync=()=>{try{let db={};try{db=JSON.parse(fs.readFileSync(p,'utf8'));}catc
-           port: 18791,
-           mode: 'local',
-           bind: '0.0.0.0',
-+          controlUi: {
-+            allowedOrigins: getGatewayAllowedOrigins(18791),
-+          },
-           auth: { mode: 'token', token: crypto.randomUUID().replace(/-/g, '') },
-         },
-       };
-@@ -3153,6 +3173,9 @@ const sync=()=>{try{let db={};try{db=JSON.parse(fs.readFileSync(p,'utf8'));}catc
-           port: basePort,
-           mode: 'local',
-           bind: '0.0.0.0',
-+          controlUi: {
-+            allowedOrigins: getGatewayAllowedOrigins(basePort),
-+          },
-           auth: { mode: 'token', token: crypto.randomUUID().replace(/-/g, '') },
-         },
- 
-@@ -3536,7 +3559,7 @@ ${selectedSkillNames.length ? selectedSkillNames.join('\n') : '- _(No skills ins
-         appendShWriteCommands(vps, sharedNativeFileMap());
-         vps.push('echo "--- Starting shared gateway via PM2 ---"');
-         if (is9Router) {
--          vps.push('pm2 start --name openclaw-multibot-9router -- sh -c "9router -n -l -H 0.0.0.0 -p 20128 --skip-update"');
-+          vps.push('PORT=20128 HOSTNAME=0.0.0.0 pm2 start "$(npm root -g)/9router/app/server.js" --name openclaw-multibot-9router --interpreter "$(command -v node)"');
-           vps.push('pm2 start --name openclaw-multibot-9router-sync -- sh -c "node ./.openclaw/9router-smart-route-sync.js"');
-         }
-         vps.push('pm2 start --name openclaw-multibot -- sh -c "openclaw gateway run"');
-@@ -3549,7 +3572,7 @@ ${selectedSkillNames.length ? selectedSkillNames.join('\n') : '- _(No skills ins
-       } else {
-         appendShWriteCommands(vps, botFiles(0));
-         if (is9Router) {
--          vps.push('pm2 start --name openclaw-9router -- sh -c "9router -n -l -H 0.0.0.0 -p 20128 --skip-update"');
-+          vps.push('PORT=20128 HOSTNAME=0.0.0.0 pm2 start "$(npm root -g)/9router/app/server.js" --name openclaw-9router --interpreter "$(command -v node)"');
-           vps.push('pm2 start --name openclaw-9router-sync -- sh -c "node ./.openclaw/9router-smart-route-sync.js"');
-         }
-         vps.push('pm2 start --name openclaw -- sh -c "openclaw gateway run"');
-diff --git a/tests/smoke-cli-logic.mjs b/tests/smoke-cli-logic.mjs
-index 23c1982..0827726 100644
---- a/tests/smoke-cli-logic.mjs
-+++ b/tests/smoke-cli-logic.mjs
-@@ -107,6 +107,15 @@ checks.push(() => expectMatch(
-   'CLI must resolve the correct native 9Router data directory on both Windows and Unix'
- ));
- 
-+checks.push(() => expect(
-+  cli.includes('function getGatewayAllowedOrigins(port) {')
-+    && cli.includes('Object.values(os.networkInterfaces() || {})')
-+    && cli.includes('`http://localhost:${normalizedPort}`')
-+    && cli.includes('`http://127.0.0.1:${normalizedPort}`')
-+    && cli.includes('`http://0.0.0.0:${normalizedPort}`'),
-+  'CLI must derive control UI allowed origins from localhost plus non-internal IPv4 interfaces'
-+));
-+
- checks.push(() => expect(
-   cli.includes("Removed smart-route (no active providers)")
-     && cli.includes("if (!a.length) {")
-@@ -187,6 +196,18 @@ checks.push(() => expectMatch(
-   'Native 9Router config must target localhost instead of the Docker hostname'
- ));
- 
-+checks.push(() => expectMatch(
-+  cli,
-+  /controlUi:\s*\{\s*allowedOrigins: getGatewayAllowedOrigins\(18791\)/s,
-+  'Native shared gateway config must seed control UI allowed origins'
-+));
-+
-+checks.push(() => expectMatch(
-+  cli,
-+  /controlUi:\s*\{\s*allowedOrigins: getGatewayAllowedOrigins\(18791 \+ \(isMultiBot \? bIndex : 0\)\)/s,
-+  'Native per-bot gateway config must seed control UI allowed origins for each port'
-+));
-+
- checks.push(() => expectMatch(
-   cli,
-   /channelKey === 'zalo-personal'\) \{\s*botConfig\.channels\['zalouser'\] = \{\s*enabled: true,\s*dmPolicy: 'pairing',\s*autoReply: true/s,
-@@ -195,7 +216,7 @@ checks.push(() => expectMatch(
- 
- checks.push(() => expectMatch(
-   cli,
--  /function startNative9RouterPm2\(\{ isVi, projectDir, appName, syncScriptPath \}\) \{[\s\S]*resolveCommandOnPath\('9router'\)[\s\S]*execFileSync\('pm2'[\s\S]*--interpreter'?,?[\s\S]*none[\s\S]*'-n'[\s\S]*'-l'[\s\S]*'--skip-update'[\s\S]*nohup "\$\{process\.execPath\}" "\$\{normalizedSyncScriptPath\}" >\/tmp\/\$\{syncAppName\}\.log 2>&1 &[\s\S]*runPm2Save\(\{ projectDir, isVi \}\)/s,
-+  /function startNative9RouterPm2\(\{ isVi, projectDir, appName, syncScriptPath \}\) \{[\s\S]*resolveNative9RouterDesktopLaunch\(\)[\s\S]*execFileSync\('pm2'[\s\S]*routerLaunch\.command[\s\S]*--interpreter'?,?[\s\S]*none[\s\S]*routerLaunch\.args[\s\S]*routerLaunch\.env[\s\S]*nohup "\$\{process\.execPath\}" "\$\{normalizedSyncScriptPath\}" >\/tmp\/\$\{syncAppName\}\.log 2>&1 &[\s\S]*runPm2Save\(\{ projectDir, isVi \}\)/s,
-   'VPS native 9Router flow must start a standalone 9Router dashboard on port 20128 via PM2'
- ));
- 
-@@ -207,8 +228,8 @@ checks.push(() => expectMatch(
- 
- checks.push(() => expectMatch(
-   cli,
--  /function resolveNative9RouterDesktopLaunch\(\) \{[\s\S]*process\.platform === 'win32'[\s\S]*npm root -g[\s\S]*9router', 'app', 'server\.js'[\s\S]*PORT: '20128'[\s\S]*HOSTNAME: '0\.0\.0\.0'[\s\S]*command: '9router'[\s\S]*\['-n', '-l', '-H', '0\.0\.0\.0', '-p', '20128', '--skip-update'\]/s,
--  'Native desktop 9Router launch must bypass the interactive CLI menu on Windows while preserving the standard CLI launch elsewhere'
-+  /function resolveNative9RouterDesktopLaunch\(\) \{[\s\S]*command: process\.execPath[\s\S]*getGlobalNpmRoot\(\), '9router', 'app', 'server\.js'[\s\S]*PORT: '20128'[\s\S]*HOSTNAME: '0\.0\.0\.0'/s,
-+  'Native desktop 9Router launch must bypass the interactive CLI menu by running the 9Router server entry directly'
- ));
- 
- checks.push(() => expectMatch(
-@@ -292,7 +313,7 @@ checks.push(() => expectMatch(
- 
- checks.push(() => expectMatch(
-   setup,
--  /function providerLines\(arr, shell\) \{[\s\S]*npm install -g 9router[\s\S]*start "9Router" cmd \/k "9router -n -l -H 0\.0\.0\.0 -p 20128 --skip-update"[\s\S]*nohup 9router -n -l -H 0\.0\.0\.0 -p 20128 --skip-update[\s\S]*9router-smart-route-sync\.js/s,
-+  /function providerLines\(arr, shell\) \{[\s\S]*npm install -g 9router[\s\S]*start "9Router" cmd \/k "9router -n -l -H 0\.0\.0\.0 -p 20128 --skip-update"[\s\S]*nohup env PORT=20128 HOSTNAME=0\.0\.0\.0 node "\$\(npm root -g\)\/9router\/app\/server\.js"[\s\S]*9router-smart-route-sync\.js/s,
-   'Native script generation must install and start a standalone 9Router dashboard on port 20128'
- ));
- 
-@@ -340,13 +361,13 @@ checks.push(() => expect(
- 
- checks.push(() => expectMatch(
-   setup,
--  /else if \(state\.nativeOs === 'vps'\) \{[\s\S]*pm2 start --name openclaw-multibot -- sh -c "openclaw gateway run"[\s\S]*pm2 logs openclaw-multibot/s,
-+  /else if \(state\.nativeOs === 'vps'\) \{[\s\S]*PORT=20128 HOSTNAME=0\.0\.0\.0 pm2 start "\$\(npm root -g\)\/9router\/app\/server\.js" --name openclaw-multibot-9router --interpreter "\$\(command -v node\)"[\s\S]*pm2 start --name openclaw-multibot -- sh -c "openclaw gateway run"[\s\S]*pm2 logs openclaw-multibot/s,
-   'VPS multi-bot native script must start the shared gateway via PM2'
- ));
- 
- checks.push(() => expectMatch(
-   setup,
--  /else if \(state\.nativeOs === 'vps'\) \{[\s\S]*pm2 start --name openclaw -- sh -c "openclaw gateway run"[\s\S]*pm2 logs openclaw/s,
-+  /else if \(state\.nativeOs === 'vps'\) \{[\s\S]*PORT=20128 HOSTNAME=0\.0\.0\.0 pm2 start "\$\(npm root -g\)\/9router\/app\/server\.js" --name openclaw-9router --interpreter "\$\(command -v node\)"[\s\S]*pm2 start --name openclaw -- sh -c "openclaw gateway run"[\s\S]*pm2 logs openclaw/s,
-   'VPS single-bot native script must start one bot via PM2'
- ));
- 
-@@ -374,6 +395,32 @@ checks.push(() => expectMatch(
-   'Wizard copy must mention native auto-login and still show the dedicated Docker QR login command'
- ));
- 
-+checks.push(() => expect(
-+  setup.includes('function getGatewayAllowedOrigins(port) {')
-+    && setup.includes('window.location')
-+    && setup.includes('`http://localhost:${normalizedPort}`')
-+    && setup.includes('`http://127.0.0.1:${normalizedPort}`'),
-+  'Web wizard must expose a helper that seeds likely control UI origins'
-+));
-+
-+checks.push(() => expectMatch(
-+  setup,
-+  /controlUi:\s*\{\s*allowedOrigins: getGatewayAllowedOrigins\(18791\)/s,
-+  'Web wizard single-bot gateway config must seed control UI allowed origins'
-+));
-+
-+checks.push(() => expectMatch(
-+  setup,
-+  /controlUi:\s*\{\s*allowedOrigins: getGatewayAllowedOrigins\(basePort\)/s,
-+  'Web wizard per-bot gateway config must seed control UI allowed origins'
-+));
-+
-+checks.push(() => expectMatch(
-+  setup,
-+  /const patchCmd = `node -e \\\\"const fs=require\('fs'\),os=require\('os'\),p='\/root\/\.openclaw\/openclaw\.json';if\(fs\.existsSync\(p\)\)\{[\s\S]*allowedOrigins:Array\.from\(a\)/s,
-+  'Web wizard Docker patch command must add interface-based control UI allowed origins'
-+));
-+
- for (const check of checks) {
-   check();
- }