create-openclaw-bot 5.1.8 → 5.1.10

package/CHANGELOG.md

@@ -1,6 +1,21 @@
 # Changelog (English)
 
 
+## [5.1.10] — 2026-04-07
+
+### 🌟 Native UI Auto-Approve Bypasser
+
+- **Native PM2 Auto-Approve Loop**: The strict `pairing required` security feature mandates that all users manually execute an approval command in their terminal for new web dashboard authentications. While Docker deployments already included an automated bypass, the Native setup did not. This release introduces a dedicated `auto-approve` PM2 background daemon that infinitely polls and accepts new device keys, delivering a frictionless, zero-touch login experience identical to Docker deployments.
+
+
+## [5.1.9] — 2026-04-07
+
+### 🌟 Strict Schema Fix & WebCrypto UX Improvement
+
+- **Revert Unrecognized Config Key**: OpenClaw v2026.x.x enforces strict Zod schema validation. The previously injected `requireDeviceIdentity` flag caused an immediate startup crash (`Config invalid`). This version surgically removes the offending flag, ensuring the gateway boots successfully.
+- **Dynamic SSH Tunnel Helper**: Since WebCrypto strictly demands a secure context (HTTPS/localhost), accessing the dashboard via raw VPS IP triggers a `1008` error natively. The CLI now dynamically generates and prints the exact `ssh -L 18791:localhost:18791 ...` Port Forwarding command right in the terminal, guaranteeing a flawless, secure login experience for remote server operators without needing SSL.
+
+
 ## [5.1.8] — 2026-04-07
 
 ### 🌟 Dashboard VPS Connectivity & Token Login Fix

package/CHANGELOG.vi.md

@@ -1,6 +1,21 @@
 # Changelog (Tiếng Việt)
 
 
+## [5.1.10] — 2026-04-07
+
+### 🌟 Tự động Auto-Approve Thiết Bị cho Native VPS
+
+- **Bỏ Nhập Lệnh Thủ Công Trải Nghiệm PM2**: Cảnh báo `pairing required` (chờ duyệt thiết bị ghép nối E2E) trên giao diện Web buộc người dùng phải gõ lệnh đồng ý dưới Terminal. Ở luồng Docker, tính năng này đã được vô hiệu hóa bằng một đoạn script chạy ngầm tự gật đầu. Nhưng ở Native thì chưa! Phiên bản này chính thức nhúng thêm 1 tiến trình PM2 `auto-approve` siêu nhẹ chạy kẹp với các lệnh chính, giúp tự động gật đầu phê duyệt kết nối web mỗi 5 giây. Đảm bảo trải nghiệm "Click là vào" trên Native VPS mượt mà y hệt Docker!
+
+
+## [5.1.9] — 2026-04-07
+
+### 🌟 Trả lại Schema Chuẩn & Cải thiện UX WebCrypto
+
+- **Sửa lỗi sập Gateway do sai lầm Config**: OpenClaw bản mới nhất dùng Zod để khóa chặt Schema cấu hình. Cờ `requireDeviceIdentity` chêm vào bản 5.1.8 đã bị Backend từ chối thẳng thừng (`Unrecognized key`), dẫn đến server không thể khởi động vòng lặp. Bản 5.1.9 đã gỡ sạch cờ này, trả lại môi trường sạch để PM2 hoạt động 100%.
+- **Trợ lý SSH Tunnel Tự Động**: Bù lại sự khắt khe của WebCrypto khi dùng VPS/IP ngoài, Console giờ đây sẽ tự động in sẵn thần chú lệnh bẻ khóa `ssh -L ...` y hệt IP và Username thật của bạn. Bạn chỉ cần copy-paste để thông luồng một cách ngầu lòi, bảo mật tuyệt đối mà không cần mua Tên miền HTTPS.
+
+
 ## [5.1.8] — 2026-04-07
 
 ### 🌟 Sửa lỗi Đăng nhập Token (1008) & Cải tiến IP hiển thị trên VPS

package/README.md

@@ -3,7 +3,7 @@
 # 🦞 OpenClaw Setup
 
 <p align="center">
-  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.1.8-0EA5E9?style=for-the-badge" alt="Version 5.1.8" /></a>
+  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.1.10-0EA5E9?style=for-the-badge" alt="Version 5.1.10" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup?tab=MIT-1-ov-file"><img src="https://img.shields.io/badge/LICENSE-MIT-success?style=for-the-badge" alt="MIT License" /></a>
   <a href="https://www.npmjs.com/package/create-openclaw-bot"><img src="https://img.shields.io/npm/v/create-openclaw-bot?style=for-the-badge&label=CLI&color=2563EB&logo=npm&logoColor=white" alt="NPM Version" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup/stargazers"><img src="https://img.shields.io/github/stars/tuanminhhole/openclaw-setup?style=for-the-badge&color=eab308&logo=github&logoColor=white" alt="GitHub Stars" /></a>
@@ -24,7 +24,7 @@ An interactive **CLI tool** and **Setup Wizard** to deploy your own free AI Bot
 
 ---
 
-## 🆕 What's new in v5.1.8
+## 🆕 What's new in v5.1.10
 
 - 💻 **OS-First Setup** — Step 1 is now choosing your OS (Windows, macOS, Ubuntu, VPS). All scripts, configs, and instructions are generated to match.
 - 🧠 **Gemma 4 — 4 sizes** — `gemma4:e2b` (~4 GB), `gemma4:e4b` (~8 GB), `gemma4:26b` (~18 GB), `gemma4:31b` (~24 GB). Auto-pulled on first launch.
@@ -112,7 +112,7 @@ Run in your terminal → follow the interactive prompts → startup script is ge
 2. Open this repo as your workspace
 3. Paste into chat:
    ```
-   Read SETUP.md and set up OpenClaw v5.1.8 for me.
+   Read SETUP.md and set up OpenClaw v5.1.10 for me.
    My bot token is X. Use 9Router (no API key).
    My project folder: <YOUR_PATH>
    ```

package/README.vi.md

@@ -3,7 +3,7 @@
 # 🦞 OpenClaw Setup
 
 <p align="center">
-  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.1.8-0EA5E9?style=for-the-badge" alt="Version 5.1.8" /></a>
+  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.1.10-0EA5E9?style=for-the-badge" alt="Version 5.1.10" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup?tab=MIT-1-ov-file"><img src="https://img.shields.io/badge/LICENSE-MIT-success?style=for-the-badge" alt="MIT License" /></a>
   <a href="https://www.npmjs.com/package/create-openclaw-bot"><img src="https://img.shields.io/npm/v/create-openclaw-bot?style=for-the-badge&label=CLI&color=2563EB&logo=npm&logoColor=white" alt="NPM Version" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup/stargazers"><img src="https://img.shields.io/github/stars/tuanminhhole/openclaw-setup?style=for-the-badge&color=eab308&logo=github&logoColor=white" alt="GitHub Stars" /></a>
@@ -24,7 +24,7 @@ Công cụ **CLI tương tác** và **Setup Wizard** để tự triển khai Bot
 
 ---
 
-## 🆕 Có gì mới trong v5.1.8
+## 🆕 Có gì mới trong v5.1.10
 
 - 💻 **OS-First Setup** — Bước đầu tiên bây giờ là chọn hệ điều hành của bạn (Windows, macOS, Ubuntu, VPS). Toàn bộ script, cấu hình và hướng dẫn được tạo ra phù hợp với lựa chọn đó.
 - 🧠 **Gemma 4 — 4 kích thước** — `gemma4:e2b` (~4 GB), `gemma4:e4b` (~8 GB), `gemma4:26b` (~18 GB), `gemma4:31b` (~24 GB). Tự pull về khi bot khởi động lần đầu.
@@ -112,7 +112,7 @@ Chạy lệnh trên trong Terminal → làm theo các prompt tương tác → sc
 2. Mở repo này làm workspace
 3. Paste vào chat:
    ```
-   Read SETUP.md and set up OpenClaw v5.1.8 for me.
+   Read SETUP.md and set up OpenClaw v5.1.10 for me.
    My bot token is X. Use 9Router (no API key).
    My project folder: <THƯ_MỤC_CỦA_BẠN>
    ```

package/cli.js

@@ -5,7 +5,7 @@ import fs from 'fs-extra';
 import path from 'path';
 import os from 'os';
 import chalk from 'chalk';
-import { spawn, execSync, execFileSync } from 'child_process';
+import { spawn, execSync, execFileSync } from 'child_process';
 const TELEGRAM_RELAY_PLUGIN_ID = 'openclaw-telegram-multibot-relay';
 // Use plain npm package name — clawhub: protocol not supported in all OpenClaw versions
 const TELEGRAM_RELAY_PLUGIN_SPEC = TELEGRAM_RELAY_PLUGIN_ID;
@@ -95,7 +95,7 @@ function quotePowerShellSingle(value) {
   return `'${String(value).replace(/'/g, "''")}'`;
 }
 
-function resolveWindowsCommand(command) {
+function resolveWindowsCommand(command) {
   try {
     const output = execSync(`where.exe ${command}`, {
       stdio: ['ignore', 'pipe', 'ignore'],
@@ -145,88 +145,88 @@ function spawnBackgroundProcess(command, args, options = {}) {
   });
 }
 
-function resolveNative9RouterDesktopLaunch() {
-  return {
-    command: process.execPath,
-    args: [path.join(getGlobalNpmRoot(), '9router', 'app', 'server.js')],
-    env: {
-      PORT: '20128',
-      HOSTNAME: '0.0.0.0'
-    }
-  };
-}
-
-function getNative9RouterDataDir() {
-  if (process.platform === 'win32') {
-    return path.join(process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming'), '9router');
-  }
-
-  return path.join(os.homedir(), '.9router');
-}
-
-function getGatewayAllowedOrigins(port) {
-  const normalizedPort = Number(port) || 18791;
-  const origins = new Set([
-    `http://localhost:${normalizedPort}`,
-    `http://127.0.0.1:${normalizedPort}`,
-    `http://0.0.0.0:${normalizedPort}`
-  ]);
-
-  for (const entries of Object.values(os.networkInterfaces() || {})) {
-    for (const entry of entries || []) {
-      if (!entry || entry.internal || entry.family !== 'IPv4' || !entry.address) {
-        continue;
-      }
-      origins.add(`http://${entry.address}:${normalizedPort}`);
-    }
-  }
-
-  return Array.from(origins);
-}
-
-function getReachableDashboardHosts(port) {
-  const normalizedPort = Number(port) || 18791;
-  const hosts = [];
-  const pushHost = (host) => {
-    if (!host) return;
-    const url = `http://${host}:${normalizedPort}`;
-    if (!hosts.includes(url)) {
-      hosts.push(url);
-    }
-  };
-
-  pushHost('127.0.0.1');
-  pushHost('localhost');
-
-  for (const entries of Object.values(os.networkInterfaces() || {})) {
-    for (const entry of entries || []) {
-      if (!entry || entry.internal || entry.family !== 'IPv4' || !entry.address) {
-        continue;
-      }
-      pushHost(entry.address);
-    }
-  }
-
-  return hosts;
-}
-
-function rewriteDashboardUrlHost(urlText, fallbackPort, targetBaseUrl) {
-  try {
-    const target = new URL(targetBaseUrl);
-    const parsed = new URL(urlText);
-    parsed.protocol = target.protocol;
-    parsed.hostname = target.hostname;
-    parsed.port = target.port || String(fallbackPort || '');
-    return parsed.toString();
-  } catch {
-    return `${targetBaseUrl}${String(urlText || '').startsWith('/') ? '' : '/'}${String(urlText || '')}`;
-  }
-}
-
-async function waitFor9RouterApiReady({ port = 20128, timeoutMs = 15000 } = {}) {
-  const deadline = Date.now() + timeoutMs;
-  const candidates = [
-    `http://127.0.0.1:${port}/api/settings/require-login`,
+function resolveNative9RouterDesktopLaunch() {
+  return {
+    command: process.execPath,
+    args: [path.join(getGlobalNpmRoot(), '9router', 'app', 'server.js')],
+    env: {
+      PORT: '20128',
+      HOSTNAME: '0.0.0.0'
+    }
+  };
+}
+
+function getNative9RouterDataDir() {
+  if (process.platform === 'win32') {
+    return path.join(process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming'), '9router');
+  }
+
+  return path.join(os.homedir(), '.9router');
+}
+
+function getGatewayAllowedOrigins(port) {
+  const normalizedPort = Number(port) || 18791;
+  const origins = new Set([
+    `http://localhost:${normalizedPort}`,
+    `http://127.0.0.1:${normalizedPort}`,
+    `http://0.0.0.0:${normalizedPort}`
+  ]);
+
+  for (const entries of Object.values(os.networkInterfaces() || {})) {
+    for (const entry of entries || []) {
+      if (!entry || entry.internal || entry.family !== 'IPv4' || !entry.address) {
+        continue;
+      }
+      origins.add(`http://${entry.address}:${normalizedPort}`);
+    }
+  }
+
+  return Array.from(origins);
+}
+
+function getReachableDashboardHosts(port) {
+  const normalizedPort = Number(port) || 18791;
+  const hosts = [];
+  const pushHost = (host) => {
+    if (!host) return;
+    const url = `http://${host}:${normalizedPort}`;
+    if (!hosts.includes(url)) {
+      hosts.push(url);
+    }
+  };
+
+  pushHost('127.0.0.1');
+  pushHost('localhost');
+
+  for (const entries of Object.values(os.networkInterfaces() || {})) {
+    for (const entry of entries || []) {
+      if (!entry || entry.internal || entry.family !== 'IPv4' || !entry.address) {
+        continue;
+      }
+      pushHost(entry.address);
+    }
+  }
+
+  return hosts;
+}
+
+function rewriteDashboardUrlHost(urlText, fallbackPort, targetBaseUrl) {
+  try {
+    const target = new URL(targetBaseUrl);
+    const parsed = new URL(urlText);
+    parsed.protocol = target.protocol;
+    parsed.hostname = target.hostname;
+    parsed.port = target.port || String(fallbackPort || '');
+    return parsed.toString();
+  } catch {
+    return `${targetBaseUrl}${String(urlText || '').startsWith('/') ? '' : '/'}${String(urlText || '')}`;
+  }
+}
+
+async function waitFor9RouterApiReady({ port = 20128, timeoutMs = 15000 } = {}) {
+  const deadline = Date.now() + timeoutMs;
+  const candidates = [
+    `http://127.0.0.1:${port}/api/settings/require-login`,
     `http://127.0.0.1:${port}/api/version`
   ];
 
@@ -350,9 +350,9 @@ function installLatestOpenClaw({ isVi, osChoice }) {
     : '✅ openclaw is now on the latest version!'));
 }
 
-function build9RouterSmartRouteSyncScript(dbPath) {
-  const safeDbPath = JSON.stringify(dbPath);
-  return `const fs=require('fs');
+function build9RouterSmartRouteSyncScript(dbPath) {
+  const safeDbPath = JSON.stringify(dbPath);
+  return `const fs=require('fs');
 const INTERVAL=30000;
 const p=${safeDbPath};
 const ROUTER='http://localhost:20128';
@@ -397,65 +397,65 @@ const sync = async () => {
     }
   } catch(e) { console.log('[sync-combo] Error:', e.message); }
 };
-setTimeout(sync, 5000);
-setInterval(sync, INTERVAL);`;
-}
-
-function resolveCommandOnPath(command) {
-  if (process.platform === 'win32') {
-    return resolveWindowsCommand(command);
-  }
-
-  try {
-    return execSync(`command -v ${command}`, {
-      stdio: ['ignore', 'pipe', 'ignore'],
-      encoding: 'utf8',
-      shell: true,
-      env: process.env
-    }).trim() || command;
-  } catch {
-    return command;
-  }
-}
-
-function getGlobalNpmRoot() {
-  try {
-    return execSync('npm root -g', {
-      stdio: ['ignore', 'pipe', 'ignore'],
-      encoding: 'utf8',
-      shell: true,
-      env: process.env
-    }).trim();
-  } catch {
-    if (process.platform === 'win32') {
-      return path.join(process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming'), 'npm', 'node_modules');
-    }
-    return path.join(os.homedir(), '.local', 'lib', 'node_modules');
-  }
-}
-
-function indentBlock(text, spaces) {
-  const prefix = ' '.repeat(spaces);
-  return String(text)
-    .split('\n')
-    .map((line) => `${prefix}${line}`)
-    .join('\n');
-}
-
-function build9RouterComposeEntrypointScript(syncScriptBase64) {
-  return [
-    'npm install -g 9router',
-    `node -e "require('fs').writeFileSync('/tmp/sync.js',Buffer.from('${syncScriptBase64}','base64').toString())"`,
-    'node /tmp/sync.js > /tmp/sync.log 2>&1 &',
-    'exec 9router -n -l -H 0.0.0.0 -p 20128 --skip-update'
-  ].join('\n');
-}
-
-async function writeNative9RouterSyncScript(projectDir) {
-  const syncScriptPath = path.join(projectDir, '.openclaw', '9router-smart-route-sync.js');
-  await fs.ensureDir(path.dirname(syncScriptPath));
-  await fs.writeFile(syncScriptPath, build9RouterSmartRouteSyncScript(path.join(getNative9RouterDataDir(), 'db.json')));
-  return syncScriptPath;
+setTimeout(sync, 5000);
+setInterval(sync, INTERVAL);`;
+}
+
+function resolveCommandOnPath(command) {
+  if (process.platform === 'win32') {
+    return resolveWindowsCommand(command);
+  }
+
+  try {
+    return execSync(`command -v ${command}`, {
+      stdio: ['ignore', 'pipe', 'ignore'],
+      encoding: 'utf8',
+      shell: true,
+      env: process.env
+    }).trim() || command;
+  } catch {
+    return command;
+  }
+}
+
+function getGlobalNpmRoot() {
+  try {
+    return execSync('npm root -g', {
+      stdio: ['ignore', 'pipe', 'ignore'],
+      encoding: 'utf8',
+      shell: true,
+      env: process.env
+    }).trim();
+  } catch {
+    if (process.platform === 'win32') {
+      return path.join(process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming'), 'npm', 'node_modules');
+    }
+    return path.join(os.homedir(), '.local', 'lib', 'node_modules');
+  }
+}
+
+function indentBlock(text, spaces) {
+  const prefix = ' '.repeat(spaces);
+  return String(text)
+    .split('\n')
+    .map((line) => `${prefix}${line}`)
+    .join('\n');
+}
+
+function build9RouterComposeEntrypointScript(syncScriptBase64) {
+  return [
+    'npm install -g 9router',
+    `node -e "require('fs').writeFileSync('/tmp/sync.js',Buffer.from('${syncScriptBase64}','base64').toString())"`,
+    'node /tmp/sync.js > /tmp/sync.log 2>&1 &',
+    'exec 9router -n -l -H 0.0.0.0 -p 20128 --skip-update'
+  ].join('\n');
+}
+
+async function writeNative9RouterSyncScript(projectDir) {
+  const syncScriptPath = path.join(projectDir, '.openclaw', '9router-smart-route-sync.js');
+  await fs.ensureDir(path.dirname(syncScriptPath));
+  await fs.writeFile(syncScriptPath, build9RouterSmartRouteSyncScript(path.join(getNative9RouterDataDir(), 'db.json')));
+  return syncScriptPath;
 }
 
 function extractFirstHttpUrl(text) {
@@ -480,45 +480,68 @@ function getTokenizedDashboardUrl(projectDir) {
   }
 }
 
-function printNativeDashboardAccessInfo({ isVi, providerKey, projectDir, gatewayPort = 18791 }) {
-  const gatewayUrls = getReachableDashboardHosts(gatewayPort);
-  const dashboardUrl = gatewayUrls[0] || `http://127.0.0.1:${gatewayPort}`;
-  const tokenizedUrl = getTokenizedDashboardUrl(projectDir);
-
-  console.log(chalk.yellow(`\n🧭 ${isVi ? 'Dashboard OpenClaw:' : 'OpenClaw Dashboard:'} ${dashboardUrl}`));
-  if (gatewayUrls.length > 1) {
-    console.log(chalk.gray(isVi
-      ? `   → Link khac co the mo duoc: ${gatewayUrls.slice(1).join(' , ')}`
-      : `   → Other reachable URLs: ${gatewayUrls.slice(1).join(' , ')}`));
-  }
-
-  if (tokenizedUrl) {
-    const tokenizedUrls = gatewayUrls.map((baseUrl) => rewriteDashboardUrlHost(tokenizedUrl, gatewayPort, baseUrl));
-    console.log(chalk.green(isVi
-      ? `   → Mở link đã kèm token: ${tokenizedUrls[0]}`
-      : `   → Open the tokenized link directly: ${tokenizedUrls[0]}`));
-    if (tokenizedUrls.length > 1) {
-      console.log(chalk.gray(isVi
-        ? `   → Ban mo tu may khac/WSL thi thu: ${tokenizedUrls.slice(1).join(' , ')}`
-        : `   → If you are opening from another machine/WSL, try: ${tokenizedUrls.slice(1).join(' , ')}`));
-    }
-  } else {
-    console.log(chalk.gray(isVi
-      ? '   → Nếu dashboard đòi Gateway Token, chạy: openclaw dashboard'
-      : '   → If the dashboard asks for a Gateway Token, run: openclaw dashboard'));
-  }
-
-  if (providerKey === '9router') {
-    const routerUrls = getReachableDashboardHosts(20128).map((baseUrl) => `${baseUrl}/dashboard`);
-    console.log(chalk.yellow(`\n🔀 ${isVi ? '9Router Dashboard:' : '9Router Dashboard:'} ${routerUrls[0] || 'http://127.0.0.1:20128/dashboard'}`));
-    if (routerUrls.length > 1) {
-      console.log(chalk.gray(isVi
-        ? `   → Link khac co the mo duoc: ${routerUrls.slice(1).join(' , ')}`
-        : `   → Other reachable URLs: ${routerUrls.slice(1).join(' , ')}`));
-    }
-    console.log(chalk.gray(isVi
-      ? '   → Mở dashboard 9Router → đăng nhập OAuth → kết nối provider miễn phí'
-      : '   → Open the 9Router dashboard → complete OAuth login → connect a free provider'));
+function printNativeDashboardAccessInfo({ isVi, providerKey, projectDir, gatewayPort = 18791 }) {
+  const gatewayUrls = getReachableDashboardHosts(gatewayPort);
+  const dashboardUrl = gatewayUrls[0] || `http://127.0.0.1:${gatewayPort}`;
+  const tokenizedUrl = getTokenizedDashboardUrl(projectDir);
+
+  console.log(chalk.yellow(`\n🧭 ${isVi ? 'Dashboard OpenClaw:' : 'OpenClaw Dashboard:'} ${dashboardUrl}`));
+  if (gatewayUrls.length > 1) {
+    console.log(chalk.gray(isVi
+      ? `   → Link khac co the mo duoc: ${gatewayUrls.slice(1).join(' , ')}`
+      : `   → Other reachable URLs: ${gatewayUrls.slice(1).join(' , ')}`));
+  }
+
+  if (tokenizedUrl) {
+    const tokenizedUrls = gatewayUrls.map((baseUrl) => rewriteDashboardUrlHost(tokenizedUrl, gatewayPort, baseUrl));
+    console.log(chalk.green(isVi
+      ? `   → Mở link đã kèm token: ${tokenizedUrls[0]}`
+      : `   → Open the tokenized link directly: ${tokenizedUrls[0]}`));
+    if (tokenizedUrls.length > 1) {
+      console.log(chalk.gray(isVi
+        ? `   → Ban mo tu may khac/WSL thi thu: ${tokenizedUrls.slice(1).join(' , ')}`
+        : `   → If you are opening from another machine/WSL, try: ${tokenizedUrls.slice(1).join(' , ')}`));
+    }
+
+    const externalHosts = gatewayUrls.filter(u => !u.includes('localhost') && !u.includes('127.0.0.1')).map(u => {
+      try { return new URL(u).hostname; } catch { return u; }
+    });
+    
+    if (externalHosts.length > 0) {
+      const mainIp = externalHosts[0];
+      const username = process.env.USER || 'user';
+      console.log(chalk.cyan(`\n🔐 ${isVi ? 'Bảo mật WebCrypto (Sửa Lỗi 1008)' : 'WebCrypto Security (Fix Error 1008)'}`));
+      console.log(chalk.gray(isVi
+        ? `   Nếu dùng các link IP ngoài (như ${mainIp}) bị lỗi từ chối kết nối WebCrypto (mã 1008):`
+        : `   If non-localhost IPs (like ${mainIp}) block WebCrypto connections with Error 1008:`));
+      console.log(chalk.white(isVi
+        ? `   1. Trên WSL/Máy nội bộ: Bạn CHỈ CẦN mở link http://127.0.0.1:${gatewayPort} là vào được.`
+        : `   1. On WSL/Local Network: Use the http://127.0.0.1:${gatewayPort} link directly.`));
+      console.log(chalk.white(isVi
+        ? `   2. Trên VPS Xa: Mở tab Terminal khác ở MÁY CỦA BẠN (Windows/Mac) chạy lệnh SSH Tunnel sau:`
+        : `   2. On Remote VPS: Run this SSH Tunnel command on YOUR LOCAL COMPUTER (Windows/Mac):`));
+      console.log(chalk.bgBlack.white(`      ssh -L ${gatewayPort}:localhost:${gatewayPort} ${username}@${mainIp}   `));
+      console.log(chalk.gray(isVi
+        ? `      Rồi quay lại trình duyệt mở link http://127.0.0.1:${gatewayPort}/#token=... là xong!`
+        : `      Then open the http://127.0.0.1:${gatewayPort}/#token=... link in your browser!`));
+    }
+  } else {
+    console.log(chalk.gray(isVi
+      ? '   → Nếu dashboard đòi Gateway Token, chạy: openclaw dashboard'
+      : '   → If the dashboard asks for a Gateway Token, run: openclaw dashboard'));
+  }
+
+  if (providerKey === '9router') {
+    const routerUrls = getReachableDashboardHosts(20128).map((baseUrl) => `${baseUrl}/dashboard`);
+    console.log(chalk.yellow(`\n🔀 ${isVi ? '9Router Dashboard:' : '9Router Dashboard:'} ${routerUrls[0] || 'http://127.0.0.1:20128/dashboard'}`));
+    if (routerUrls.length > 1) {
+      console.log(chalk.gray(isVi
+        ? `   → Link khac co the mo duoc: ${routerUrls.slice(1).join(' , ')}`
+        : `   → Other reachable URLs: ${routerUrls.slice(1).join(' , ')}`));
+    }
+    console.log(chalk.gray(isVi
+      ? '   → Mở dashboard 9Router → đăng nhập OAuth → kết nối provider miễn phí'
+      : '   → Open the 9Router dashboard → complete OAuth login → connect a free provider'));
     console.log(chalk.gray(isVi
       ? '   → Sau khi login 9Router xong, bot sẽ tự dùng model smart-route qua http://localhost:20128/v1'
       : '   → Once 9Router is logged in, the bot will use smart-route through http://localhost:20128/v1'));
@@ -695,62 +718,62 @@ function runPm2Save({ projectDir, isVi }) {
   }
 }
 
-function startNative9RouterPm2({ isVi, projectDir, appName, syncScriptPath }) {
-  const routerAppName = `${appName}-9router`;
-  const routerLaunch = resolveNative9RouterDesktopLaunch();
-  execFileSync('pm2', [
-    'start',
-    routerLaunch.command,
-    '--name',
-    routerAppName,
-    '--cwd',
-    projectDir.replace(/\\/g, '/'),
-    '--interpreter',
-    'none',
-    '--',
-    ...routerLaunch.args
-  ], {
-    cwd: projectDir,
-    stdio: 'inherit',
-    env: { ...process.env, ...routerLaunch.env }
-  });
-  if (syncScriptPath) {
-    const syncAppName = `${appName}-9router-sync`;
-    const normalizedSyncScriptPath = syncScriptPath.replace(/\\/g, '/');
-    try {
-      execFileSync('pm2', [
-        'start',
-        normalizedSyncScriptPath,
-        '--name',
-        syncAppName,
-        '--cwd',
-        projectDir.replace(/\\/g, '/'),
-        '--interpreter',
-        process.execPath
-      ], {
-        cwd: projectDir,
-        stdio: 'inherit',
-        env: process.env
-      });
-    } catch {
-      try {
-        execSync(`nohup "${process.execPath}" "${normalizedSyncScriptPath}" >/tmp/${syncAppName}.log 2>&1 &`, {
-          cwd: projectDir,
-          stdio: 'ignore',
-          shell: true,
-          env: process.env
-        });
-        console.log(chalk.yellow(isVi
-          ? `⚠️  PM2 khong khoi dong duoc sync helper. Da fallback sang background node: /tmp/${syncAppName}.log`
-          : `⚠️  PM2 could not start the sync helper. Fell back to a background node process: /tmp/${syncAppName}.log`));
-      } catch {
-        console.log(chalk.yellow(isVi
-          ? `⚠️  Khong the khoi dong 9Router sync helper. 9Router van chay, nhung smart-route co the can dong bo thu cong sau.`
-          : `⚠️  Could not start the 9Router sync helper. 9Router is still running, but smart-route may need manual syncing later.`));
-      }
-    }
-  }
-  runPm2Save({ projectDir, isVi });
+function startNative9RouterPm2({ isVi, projectDir, appName, syncScriptPath }) {
+  const routerAppName = `${appName}-9router`;
+  const routerLaunch = resolveNative9RouterDesktopLaunch();
+  execFileSync('pm2', [
+    'start',
+    routerLaunch.command,
+    '--name',
+    routerAppName,
+    '--cwd',
+    projectDir.replace(/\\/g, '/'),
+    '--interpreter',
+    'none',
+    '--',
+    ...routerLaunch.args
+  ], {
+    cwd: projectDir,
+    stdio: 'inherit',
+    env: { ...process.env, ...routerLaunch.env }
+  });
+  if (syncScriptPath) {
+    const syncAppName = `${appName}-9router-sync`;
+    const normalizedSyncScriptPath = syncScriptPath.replace(/\\/g, '/');
+    try {
+      execFileSync('pm2', [
+        'start',
+        normalizedSyncScriptPath,
+        '--name',
+        syncAppName,
+        '--cwd',
+        projectDir.replace(/\\/g, '/'),
+        '--interpreter',
+        process.execPath
+      ], {
+        cwd: projectDir,
+        stdio: 'inherit',
+        env: process.env
+      });
+    } catch {
+      try {
+        execSync(`nohup "${process.execPath}" "${normalizedSyncScriptPath}" >/tmp/${syncAppName}.log 2>&1 &`, {
+          cwd: projectDir,
+          stdio: 'ignore',
+          shell: true,
+          env: process.env
+        });
+        console.log(chalk.yellow(isVi
+          ? `⚠️  PM2 khong khoi dong duoc sync helper. Da fallback sang background node: /tmp/${syncAppName}.log`
+          : `⚠️  PM2 could not start the sync helper. Fell back to a background node process: /tmp/${syncAppName}.log`));
+      } catch {
+        console.log(chalk.yellow(isVi
+          ? `⚠️  Khong the khoi dong 9Router sync helper. 9Router van chay, nhung smart-route co the can dong bo thu cong sau.`
+          : `⚠️  Could not start the 9Router sync helper. 9Router is still running, but smart-route may need manual syncing later.`));
+      }
+    }
+  }
+  runPm2Save({ projectDir, isVi });
   console.log(chalk.green(`\n✅ ${isVi ? '9Router da duoc khoi dong qua PM2.' : '9Router is running via PM2.'}`));
   console.log(chalk.gray(isVi ? `   Xem log: pm2 logs ${routerAppName}` : `   View logs: pm2 logs ${routerAppName}`));
 }
@@ -1339,7 +1362,7 @@ async function main() {
   }
   
   
-  const patchScript = `const fs=require('fs'),os=require('os'),p='/root/.openclaw/openclaw.json';if(fs.existsSync(p)){const c=JSON.parse(fs.readFileSync(p,'utf8'));const a=new Set(['http://localhost:18791','http://127.0.0.1:18791','http://0.0.0.0:18791']);for(const entries of Object.values(os.networkInterfaces()||{})){for(const entry of entries||[]){if(!entry||entry.internal||entry.family!=='IPv4'||!entry.address)continue;a.add(\`http://\${entry.address}:18791\`);}}c.tools=Object.assign({},c.tools,{profile:'full',exec:{host:'gateway',security:'full',ask:'off'}});c.gateway=Object.assign({},c.gateway,{port:18791,bind:'custom',customBindHost:'0.0.0.0',controlUi:Object.assign({},c.gateway?.controlUi,{allowedOrigins:Array.from(a),requireDeviceIdentity:false})});fs.writeFileSync(p,JSON.stringify(c,null,2));}`;
+  const patchScript = `const fs=require('fs'),os=require('os'),p='/root/.openclaw/openclaw.json';if(fs.existsSync(p)){const c=JSON.parse(fs.readFileSync(p,'utf8'));const a=new Set(['http://localhost:18791','http://127.0.0.1:18791','http://0.0.0.0:18791']);for(const entries of Object.values(os.networkInterfaces()||{})){for(const entry of entries||[]){if(!entry||entry.internal||entry.family!=='IPv4'||!entry.address)continue;a.add(\`http://\${entry.address}:18791\`);}}c.tools=Object.assign({},c.tools,{profile:'full',exec:{host:'gateway',security:'full',ask:'off'}});c.gateway=Object.assign({},c.gateway,{port:18791,bind:'custom',customBindHost:'0.0.0.0',controlUi:Object.assign({},c.gateway?.controlUi,{allowedOrigins:Array.from(a)})});fs.writeFileSync(p,JSON.stringify(c,null,2));}`;
   const b64Patch = Buffer.from(patchScript).toString('base64');
 
   // Browser Playwright (both desktop & server modes need chromium)
@@ -1382,7 +1405,7 @@ async function main() {
     '# Fix chat.send dropping resolved agent timeout into reply pipeline.',
     '# Without this, Telegram/WebChat paths fall back to an internal 300s default even when',
     '# agents.defaults.timeoutSeconds is higher in config.',
-    `RUN node -e "const fs=require('fs');const path=require('path');const dir='/usr/local/lib/node_modules/openclaw/dist';const from='\\t\\t\\t\\t\\tonAgentRunStart: (runId) => {';const to='\\t\\t\\t\\t\\ttimeoutOverrideSeconds: Math.max(1, Math.ceil(timeoutMs / 1e3)),\\n\\t\\t\\t\\t\\tonAgentRunStart: (runId) => {';const files=fs.readdirSync(dir).filter(n=>/\\.js$/.test(n));let patched=0;for(const file of files){const p=path.join(dir,file);let s='';try{s=fs.readFileSync(p,'utf8');}catch{continue;}if(s.includes(to)||!s.includes(from))continue;s=s.replace(from,to);fs.writeFileSync(p,s);patched++;}if(!patched){process.exit(0);}"`,
+    `RUN node -e "const fs=require('fs');const path=require('path');const dir='/usr/local/lib/node_modules/openclaw/dist';const from='\\t\\t\\t\\t\\tonAgentRunStart: (runId) => {';const to='\\t\\t\\t\\t\\ttimeoutOverrideSeconds: Math.max(1, Math.ceil(timeoutMs / 1e3)),\\n\\t\\t\\t\\t\\tonAgentRunStart: (runId) => {';const files=fs.readdirSync(dir).filter(n=>/\\.js$/.test(n));let patched=0;for(const file of files){const p=path.join(dir,file);let s='';try{s=fs.readFileSync(p,'utf8');}catch{continue;}if(s.includes(to)||!s.includes(from))continue;s=s.replace(from,to);fs.writeFileSync(p,s);patched++;}if(!patched){process.exit(0);}"`,
     '',
     'WORKDIR /root/.openclaw',
     '',
@@ -1398,12 +1421,12 @@ async function main() {
   const agentId = botName.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/-$/, '') || 'chat';
   
   // ─── Dynamic Smart Route Sync Script ────────────────────────────────────────
-  // This script runs inside the 9Router container as a background loop.
-  // It reads the persisted 9Router DB directly so smart-route still works
-  // even when newer dashboard APIs require auth or change response shape.
-  const syncComboScript = build9RouterSmartRouteSyncScript('/root/.9router/db.json');
-  const syncComboScriptBase64 = Buffer.from(syncComboScript).toString('base64');
-  const docker9RouterEntrypointScript = build9RouterComposeEntrypointScript(syncComboScriptBase64);
+  // This script runs inside the 9Router container as a background loop.
+  // It reads the persisted 9Router DB directly so smart-route still works
+  // even when newer dashboard APIs require auth or change response shape.
+  const syncComboScript = build9RouterSmartRouteSyncScript('/root/.9router/db.json');
+  const syncComboScriptBase64 = Buffer.from(syncComboScript).toString('base64');
+  const docker9RouterEntrypointScript = build9RouterComposeEntrypointScript(syncComboScriptBase64);
 
   // ─── Resolve primary model ───────────────────────────────────────────────────
   let modelsPrimary;
@@ -1447,14 +1470,14 @@ ${dependsOn}${extraHosts}    ports:
     image: node:22-slim
     container_name: 9router-multibot
     restart: always
-    entrypoint:
-      - /bin/sh
-      - -c
-      - |
-${indentBlock(docker9RouterEntrypointScript, 8)}
-    environment:
-      - PORT=20128
-      - HOSTNAME=0.0.0.0
+    entrypoint:
+      - /bin/sh
+      - -c
+      - |
+${indentBlock(docker9RouterEntrypointScript, 8)}
+    environment:
+      - PORT=20128
+      - HOSTNAME=0.0.0.0
       - CI=true
     volumes:
       - 9router-data:/root/.9router
@@ -1539,14 +1562,14 @@ ${hasBrowserDesktop ? `    extra_hosts:\n      - "host.docker.internal:host-gate
     image: node:22-slim
     container_name: 9router-${agentId}
     restart: always
-    entrypoint:
-      - /bin/sh
-      - -c
-      - |
-${indentBlock(docker9RouterEntrypointScript, 8)}
-    environment:
-      - PORT=20128
-      - HOSTNAME=0.0.0.0
+    entrypoint:
+      - /bin/sh
+      - -c
+      - |
+${indentBlock(docker9RouterEntrypointScript, 8)}
+    environment:
+      - PORT=20128
+      - HOSTNAME=0.0.0.0
       - CI=true
     volumes:
       - 9router-data:/root/.9router
@@ -1798,17 +1821,16 @@ ${hasBrowserDesktop ? `    extra_hosts:
           allow: agentMetas.map((meta) => meta.agentId),
         },
       },
-      gateway: {
-        port: 18791,
-        mode: 'local',
-        bind: 'custom',
-        customBindHost: '0.0.0.0',
-        controlUi: {
-          allowedOrigins: getGatewayAllowedOrigins(18791),
-          requireDeviceIdentity: false,
-        },
-        auth: { mode: 'token', token: 'cli-dummy-token-xyz123' },
-      },
+      gateway: {
+        port: 18791,
+        mode: 'local',
+        bind: 'custom',
+        customBindHost: '0.0.0.0',
+        controlUi: {
+          allowedOrigins: getGatewayAllowedOrigins(18791),
+        },
+        auth: { mode: 'token', token: 'cli-dummy-token-xyz123' },
+      },
     };
     sharedConfig.plugins = {
       entries: {
@@ -1847,6 +1869,16 @@ ${hasBrowserDesktop ? `    extra_hosts:
         `      autorestart: true,`,
         `      watch: false,`,
         `      env: { NODE_ENV: 'production' }`,
+        '    },',
+        '    {',
+        `      name: '${botName || 'openclaw-multibot'}-auto-approve',`,
+        `      script: 'sh',`,
+        `      args: '-c "while true; do npx --yes openclaw devices approve --latest 2>/dev/null || true; sleep 5; done"',`,
+        `      cwd: '${projectDir.replace(/\\/g, '/')}',`,
+        `      interpreter: 'none',`,
+        `      autorestart: true,`,
+        `      watch: false,`,
+        `      env: { NODE_ENV: 'production' }`,
         '    }',
       ].join('\n');
       const ecosystemContent = [
@@ -2035,11 +2067,11 @@ ${hasBrowserDesktop ? `    extra_hosts:
       commands: { native: 'auto', nativeSkills: 'auto', restart: true, ownerDisplay: 'raw' },
       channels: {},
       tools: { profile: 'full', exec: { host: 'gateway', security: 'full', ask: 'off' } },
-      gateway: {
-        port: 18791 + (isMultiBot ? bIndex : 0), mode: 'local', bind: 'custom', customBindHost: '0.0.0.0',
-        controlUi: { allowedOrigins: getGatewayAllowedOrigins(18791 + (isMultiBot ? bIndex : 0)), requireDeviceIdentity: false },
-        auth: { mode: 'token', token: 'cli-dummy-token-xyz123' }
-      }
+      gateway: {
+        port: 18791 + (isMultiBot ? bIndex : 0), mode: 'local', bind: 'custom', customBindHost: '0.0.0.0',
+        controlUi: { allowedOrigins: getGatewayAllowedOrigins(18791 + (isMultiBot ? bIndex : 0)) },
+        auth: { mode: 'token', token: 'cli-dummy-token-xyz123' }
+      }
     };
 
     if (hasBrowserDesktop) {
@@ -2291,14 +2323,14 @@ fi
       if (code === 0) {
         console.log(chalk.green(`\n🎉 ${isVi ? 'Setup hoàn tất! Bot đang chạy.' : 'Setup complete! Bot is running.'}`));
         
-        if (providerKey === '9router') {
-          const routerDashboardUrl = `${getReachableDashboardHosts(20128)[0] || 'http://127.0.0.1:20128'}/dashboard`;
-          console.log(chalk.yellow(`\n🔀 ${isVi
-            ? `9Router Dashboard: ${routerDashboardUrl}`
-            : `9Router Dashboard: ${routerDashboardUrl}`}`));
-          console.log(chalk.gray(isVi
-            ? '   → Mở dashboard → đăng nhập OAuth để kết nối các Provider (iFlow, Gemini CLI, Claude Code...)'
-            : '   → Open dashboard → OAuth login to connect Providers (iFlow, Gemini CLI, Claude Code...)'));
+        if (providerKey === '9router') {
+          const routerDashboardUrl = `${getReachableDashboardHosts(20128)[0] || 'http://127.0.0.1:20128'}/dashboard`;
+          console.log(chalk.yellow(`\n🔀 ${isVi
+            ? `9Router Dashboard: ${routerDashboardUrl}`
+            : `9Router Dashboard: ${routerDashboardUrl}`}`));
+          console.log(chalk.gray(isVi
+            ? '   → Mở dashboard → đăng nhập OAuth để kết nối các Provider (iFlow, Gemini CLI, Claude Code...)'
+            : '   → Open dashboard → OAuth login to connect Providers (iFlow, Gemini CLI, Claude Code...)'));
           console.log(chalk.gray(isVi
             ? '   → Sau khi kết nối provider, bot sẽ tự động hoạt động qua combo "smart-route"'
             : '   → After connecting providers, bot works automatically via "smart-route" combo'));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-openclaw-bot",
-  "version": "5.1.8",
+  "version": "5.1.10",
   "description": "Interactive CLI installer for OpenClaw Bot",
   "main": "cli.js",
   "bin": {

package/setup.js

@@ -1597,7 +1597,6 @@ Write-Host "Chrome se tu dong bat Debug Mode moi khi ban dang nhap Windows (dela
         bind: '0.0.0.0',
         controlUi: {
           allowedOrigins: getGatewayAllowedOrigins(18791),
-          requireDeviceIdentity: false,
         },
         auth: { mode: 'token', token: crypto.randomUUID().replace(/-/g, '') },
       },
@@ -1833,7 +1832,7 @@ model:
       ? 'socat TCP-LISTEN:9222,fork,reuseaddr TCP:host.docker.internal:9222 & '
       : '';
     // Patch config on every startup to keep gateway settings stable
-    const patchCmd = `node -e \\"const fs=require('fs'),os=require('os'),p='/root/.openclaw/openclaw.json';if(fs.existsSync(p)){const c=JSON.parse(fs.readFileSync(p,'utf8'));const a=new Set(['http://localhost:18791','http://127.0.0.1:18791','http://0.0.0.0:18791']);for(const entries of Object.values(os.networkInterfaces()||{})){for(const entry of entries||[]){if(!entry||entry.internal||entry.family!=='IPv4'||!entry.address)continue;a.add(\\\`http://\\\${entry.address}:18791\\\`);}}c.tools=Object.assign({},c.tools,{profile:'full',exec:{host:'gateway',security:'full',ask:'off'}});c.gateway=Object.assign({},c.gateway,{port:18791,bind:'custom',customBindHost:'0.0.0.0',controlUi:Object.assign({},c.gateway?.controlUi,{allowedOrigins:Array.from(a),requireDeviceIdentity:false})});fs.writeFileSync(p,JSON.stringify(c,null,2));}\\" && `;
+    const patchCmd = `node -e \\"const fs=require('fs'),os=require('os'),p='/root/.openclaw/openclaw.json';if(fs.existsSync(p)){const c=JSON.parse(fs.readFileSync(p,'utf8'));const a=new Set(['http://localhost:18791','http://127.0.0.1:18791','http://0.0.0.0:18791']);for(const entries of Object.values(os.networkInterfaces()||{})){for(const entry of entries||[]){if(!entry||entry.internal||entry.family!=='IPv4'||!entry.address)continue;a.add(\\\`http://\\\${entry.address}:18791\\\`);}}c.tools=Object.assign({},c.tools,{profile:'full',exec:{host:'gateway',security:'full',ask:'off'}});c.gateway=Object.assign({},c.gateway,{port:18791,bind:'custom',customBindHost:'0.0.0.0',controlUi:Object.assign({},c.gateway?.controlUi,{allowedOrigins:Array.from(a)})});fs.writeFileSync(p,JSON.stringify(c,null,2));}\\" && `;
     // Auto-approve device pairing after gateway starts (required since v2026.3.x)
     const autoApproveCmd = '(while true; do sleep 5; openclaw devices approve --latest 2>/dev/null || true; done) & ';
     const finalCmd = `CMD sh -c "${pluginInstallCmd}${patchCmd}${browserPrefix}${autoApproveCmd}${gatewayCmd}"`;
@@ -3060,7 +3059,6 @@ const sync=()=>{try{let db={};try{db=JSON.parse(fs.readFileSync(p,'utf8'));}catc
           bind: '0.0.0.0',
           controlUi: {
             allowedOrigins: getGatewayAllowedOrigins(18791),
-            requireDeviceIdentity: false,
           },
           auth: { mode: 'token', token: crypto.randomUUID().replace(/-/g, '') },
         },
@@ -3177,7 +3175,6 @@ const sync=()=>{try{let db={};try{db=JSON.parse(fs.readFileSync(p,'utf8'));}catc
           bind: '0.0.0.0',
           controlUi: {
             allowedOrigins: getGatewayAllowedOrigins(basePort),
-            requireDeviceIdentity: false,
           },
           auth: { mode: 'token', token: crypto.randomUUID().replace(/-/g, '') },
         },