create-openclaw-bot 5.13.0 → 5.13.3

package/README.md

@@ -7,7 +7,7 @@
 *Run one command → open the dashboard → your bot is live. Windows · macOS · Linux · VPS — Docker-powered, auto-installed for you.*
 
 <p align="center">
-  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.13.0-0EA5E9?style=for-the-badge" alt="Version 5.13.0" /></a>
+  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.13.3-0EA5E9?style=for-the-badge" alt="Version 5.13.3" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup?tab=MIT-1-ov-file"><img src="https://img.shields.io/badge/LICENSE-MIT-success?style=for-the-badge" alt="MIT License" /></a>
   <a href="https://www.npmjs.com/package/create-openclaw-bot"><img src="https://img.shields.io/npm/v/create-openclaw-bot?style=for-the-badge&label=CLI&color=2563EB&logo=npm&logoColor=white" alt="NPM Version" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup/stargazers"><img src="https://img.shields.io/github/stars/tuanminhhole/openclaw-setup?style=for-the-badge&color=eab308&logo=github&logoColor=white" alt="GitHub Stars" /></a>
@@ -44,7 +44,7 @@
 - ✨ **A cleaner Zalo control area**: Refresh and Login Again sit together above the bot list, while shared Zalo Connect and Zalo Mod versions move into the main status column.
 
 <details>
-<summary><b>Previous: What's new in v5.13.0</b></summary>
+<summary><b>Previous: What's new in v5.12.0</b></summary>
 
 - 💬 **OpenClaw Zalo Connect, ready in one click**: create a personal Zalo bot or press **Zalo Login** and Setup prepares the channel automatically, then opens the QR flow in the dashboard.
 - ⚡ **Install once, reconnect faster**: an existing Zalo Connect installation is reused instead of being downloaded again on every login or restart.

package/README.vi.md

@@ -7,7 +7,7 @@
 *Chạy một lệnh → mở dashboard → bot lên sóng. Windows · macOS · Linux · VPS — chạy trên Docker, tự cài giúp bạn.*
 
 <p align="center">
-  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.13.0-0EA5E9?style=for-the-badge" alt="Version 5.13.0" /></a>
+  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.13.3-0EA5E9?style=for-the-badge" alt="Version 5.13.3" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup?tab=MIT-1-ov-file"><img src="https://img.shields.io/badge/LICENSE-MIT-success?style=for-the-badge" alt="MIT License" /></a>
   <a href="https://www.npmjs.com/package/create-openclaw-bot"><img src="https://img.shields.io/npm/v/create-openclaw-bot?style=for-the-badge&label=CLI&color=2563EB&logo=npm&logoColor=white" alt="NPM Version" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup/stargazers"><img src="https://img.shields.io/github/stars/tuanminhhole/openclaw-setup?style=for-the-badge&color=eab308&logo=github&logoColor=white" alt="GitHub Stars" /></a>
@@ -44,7 +44,7 @@
 - ✨ **Khu điều khiển Zalo gọn hơn**: Làm mới và Đăng nhập lại nằm cùng hàng phía trên danh sách bot; phiên bản Zalo Connect và Zalo Mod được đưa sang cột trạng thái chung.
 
 <details>
-<summary><b>Trước đó: Có gì mới trong v5.13.0</b></summary>
+<summary><b>Trước đó: Có gì mới trong v5.12.0</b></summary>
 
 - 💬 **OpenClaw Zalo Connect, sẵn sàng trong một chạm**: tạo bot Zalo cá nhân hoặc bấm **Đăng nhập Zalo**, Setup tự chuẩn bị channel rồi mở luồng quét QR ngay trên dashboard.
 - ⚡ **Cài một lần, kết nối lại nhanh hơn**: nếu Zalo Connect đã có, Setup dùng lại bản hiện tại thay vì tải lại mỗi lần đăng nhập hay restart.

package/dist/server/local-server.js

@@ -759,6 +759,10 @@ async function detectRuntime(projectDir) {
 const _runtimeSynced = new Set();
 async function syncRuntimeState(projectDir, { full = false } = {}) {
   if (!projectDir || !existsSync(join(projectDir, '.openclaw', 'openclaw.json'))) return;
+  // New OpenClaw builds may create this directory during probing even when no
+  // attestation exists. Remove only the empty directory so it does not clutter
+  // the project tree; never touch a real `.attested` file.
+  await removeEmptyWorkspaceAttestations(projectDir).catch(() => {});
   const firstSync = full || !_runtimeSynced.has(projectDir);
   if (firstSync) {
     // Auto-migrate legacy /root/project paths → /home/node/project in openclaw.json
@@ -786,6 +790,15 @@ async function syncRuntimeState(projectDir, { full = false } = {}) {
   _runtimeSynced.add(projectDir);
 }
 
+async function removeEmptyWorkspaceAttestations(projectDir) {
+  const attestDir = join(projectDir, '.openclaw', 'workspace-attestations');
+  if (!existsSync(attestDir)) return false;
+  const entries = await fsp.readdir(attestDir);
+  if (entries.length > 0) return false;
+  await fsp.rmdir(attestDir);
+  return true;
+}
+
 /**
  * Migrate legacy /root/project/ paths to /home/node/project/ in openclaw.json.
  * Old projects may have been created with /root/project/ which doesn't match the
@@ -3276,7 +3289,7 @@ async function installFeature(projectDir, agentId, kind, id) {
       const botContainer = getBotContainerName(projectDir);
       sendLog(`[skill] Installing/updating clawhub:${slug} inside container ${botContainer} for agent ${agentId}...`);
       
-      const cmd = `cd /home/node/project && openclaw skills install ${slug} --agent ${agentId} --force`;
+      const cmd = `cd /home/node/project && openclaw skills install ${slug} --agent ${agentId} --force --acknowledge-clawhub-risk`;
       const cmdOut = await runCapture('docker', ['exec', botContainer, 'sh', '-lc', cmd], { cwd: projectDir, shell: false });
       
       if (cmdOut) {
@@ -3298,7 +3311,7 @@ async function installFeature(projectDir, agentId, kind, id) {
       await run('openclaw', ['doctor', '--fix'], { cwd: projectDir, env: openclawProjectEnv(projectDir) }).catch((err) => sendLog(`[skill] doctor --fix skipped: ${err.message}`));
       sendLog(`[skill] Installing clawhub:${slug} for agent ${agentId}...`);
       
-      await run('openclaw', ['skills', 'install', slug, '--agent', agentId, '--force'], {
+      await run('openclaw', ['skills', 'install', slug, '--agent', agentId, '--force', '--acknowledge-clawhub-risk'], {
         cwd: projectDir,
         env: openclawProjectEnv(projectDir)
       });
@@ -4210,4 +4223,4 @@ export async function startLocalInstaller({ host = '127.0.0.1', preferredPort =
   printRemoteAccessHint(port).catch(() => {});
 }
 
-export { createBotInProject, updateBotInProject, deleteBotInProject, validateOpenclawConfig, startZaloLogin, readBotCredentials, resolveProject9RouterApiKey, installCore, deleteProjectFolder, buildZaloHealthSnapshot };
+export { createBotInProject, updateBotInProject, deleteBotInProject, validateOpenclawConfig, startZaloLogin, readBotCredentials, resolveProject9RouterApiKey, installCore, deleteProjectFolder, buildZaloHealthSnapshot, removeEmptyWorkspaceAttestations };

package/dist/setup/data/channels.js

@@ -62,10 +62,10 @@
       credSteps: [
         { textVi: '⚠️ Zalo cá nhân chạy qua <strong>OpenClaw Zalo Connect (unofficial, zca-js)</strong> — tự động hoá tài khoản cá nhân có thể vi phạm điều khoản Zalo và khiến tài khoản bị hạn chế. <strong>Chỉ nên dùng tài khoản phụ.</strong>', textEn: '⚠️ Personal Zalo runs on <strong>OpenClaw Zalo Connect (unofficial, zca-js)</strong> — automating a personal account may violate Zalo terms and can get the account restricted. <strong>Use a secondary account.</strong>' },
         { textVi: 'Sau khi tạo bot, bấm <strong>Đăng nhập Zalo</strong> để quét QR ngay trong giao diện. Nếu cần chạy thủ công: <code>openclaw channels login --channel zalo-connect --account default</code>.', textEn: 'After creating the bot, click <strong>Zalo Login</strong> to scan the QR right in the UI. Manual fallback: <code>openclaw channels login --channel zalo-connect --account default</code>.' },
-        { textVi: 'Mặc định an toàn: DM theo cơ chế pairing, group tắt hết — sau khi quét QR hãy tự chọn DM/nhóm được phép trong cấu hình.', textEn: 'Secure defaults: DM uses pairing, all groups start disabled — after the QR scan, explicitly choose the allowed DMs/groups in the config.' },
+        { textVi: 'Sau khi quét QR, bot nhận được tin nhắn xác nhận Owner ngay; bạn có thể siết lại DM/nhóm sau trong cấu hình.', textEn: 'After QR login, the bot can receive the initial Owner confirmation immediately; you can tighten DM/group access later in config.' },
       ],
       // Mirrors buildZaloConnectChannelConfig() in bot-config-gen.js — keys validated
-      // against OpenClaw Zalo Connect 3.0.0's strict channel schema.
+      // against OpenClaw Zalo Connect 3.0.1's strict channel schema.
       channelConfig: {
         'zalo-connect': {
           enabled: true,
@@ -73,11 +73,11 @@
           accounts: {
             default: { enabled: true },
           },
-          dmPolicy: 'pairing',
-          allowFrom: [],
+          dmPolicy: 'open',
+          allowFrom: ['*'],
           groupPolicy: 'allowlist',
           groups: {
-            '*': { enabled: false, requireMention: true },
+            '*': { enabled: true, requireMention: false },
           },
         },
       },

package/dist/setup/shared/bot-config-gen.js

@@ -310,10 +310,9 @@
       channels.telegram = telegramConfig;
     } else if (isZaloPersonal(channelKey)) {
       // Zalo Personal → OpenClaw Zalo Connect, the only personal-Zalo backend.
-      // Secure defaults: DM pairing, empty
-      // allowFrom, all groups disabled + requireMention until the owner explicitly
-      // enables them post-QR. Never default to `allowFrom: ["*"]` / open groups.
-      // Every key below is validated against OpenClaw Zalo Connect 3.0.0's schema
+      // First-run defaults keep owner confirmation reachable immediately after QR:
+      // DMs are open to every sender and groups are enabled without requiring a mention.
+      // Every key below is validated against OpenClaw Zalo Connect 3.0.1's schema
       // (`additionalProperties: false`) — do NOT add keys (e.g. historyLimit,
       // groupAllowFrom) without re-checking `openclaw.plugin.json` first, an unknown
       // key crashes the gateway on boot.
@@ -336,11 +335,11 @@
       accounts: {
         default: { enabled: true },
       },
-      dmPolicy: 'pairing',
-      allowFrom: [],
+      dmPolicy: 'open',
+      allowFrom: ['*'],
       groupPolicy: 'allowlist',
       groups: {
-        '*': { enabled: false, requireMention: true },
+        '*': { enabled: true, requireMention: false },
       },
     };
   }

package/dist/setup/shared/common-gen.js

@@ -44,8 +44,8 @@
   // Pin the maintained fork tag so setup never falls back to upstream/ClawHub.
   const ZALO_CHANNEL_ID = 'zalo-connect';
   const ZALO_PLUGIN_ID = 'zalo-connect';
-  const ZALO_CONNECT_VERSION = '3.0.0';
-  const ZALO_CONNECT_PLUGIN_SPEC = 'https://github.com/tuanminhhole/openclaw-zalo-connect.git#v3.0.0';
+  const ZALO_CONNECT_VERSION = '3.0.1';
+  const ZALO_CONNECT_PLUGIN_SPEC = 'https://github.com/tuanminhhole/openclaw-zalo-connect.git#v3.0.1';
 
   function buildRelayPluginInstallCommand(prefix = 'openclaw') {
     return `if [ ! -d "$OPENCLAW_STATE_DIR/extensions/${TELEGRAM_RELAY_PLUGIN_ID}" ]; then ${prefix} plugins install ${TELEGRAM_RELAY_PLUGIN_SPEC} 2>/dev/null || true; fi`;

package/dist/setup/shared/docker-gen.js

@@ -244,10 +244,10 @@ if(touched){console.log('[patch-9router] Applied Codex compatibility patch.');}e
     const stateVolDecl = useStateVolume ? '\n  openclaw-state:' : '';
     const stateVolBlock = useStateVolume ? '\n\nvolumes:\n  openclaw-state:' : '';
     const skillLines = dockerfileSkillInstallMode === 'build' && allSkills.length > 0
-      ? `\n# Install skills (ClawHub)\n${allSkills.map((skill) => `RUN openclaw skills install ${skill} || echo "Warning: Failed to install ${skill} due to rate limits."`).join('\n')}\n`
+      ? `\n# Install skills (ClawHub)\n${allSkills.map((skill) => `RUN openclaw skills install ${skill} --acknowledge-clawhub-risk || echo "Warning: Failed to install ${skill} due to rate limits."`).join('\n')}\n`
       : '';
     const pluginLines = dockerfilePlugins.length > 0
-      ? `\n# Install plugins (ClawHub)\n${dockerfilePlugins.map((p) => `RUN openclaw plugins install ${p} || echo "Warning: Failed to install plugin ${p}"`).join('\n')}\n`
+      ? `\n# Install plugins (ClawHub)\n${dockerfilePlugins.map((p) => `RUN openclaw plugins install ${p} --acknowledge-clawhub-risk || echo "Warning: Failed to install plugin ${p}"`).join('\n')}\n`
       : '';
     const patchLine = `RUN node -e "const fs=require('fs');const path=require('path');const dir='/usr/local/lib/node_modules/openclaw/dist';const from='\\t\\t\\t\\t\\tonAgentRunStart: (runId) => {';const to='\\t\\t\\t\\t\\ttimeoutOverrideSeconds: Math.max(1, Math.ceil(timeoutMs / 1e3)),\\n\\t\\t\\t\\t\\tonAgentRunStart: (runId) => {';const files=fs.readdirSync(dir).filter(n=>/\\.js$/.test(n));let patched=0;for(const file of files){const p=path.join(dir,file);let s='';try{s=fs.readFileSync(p,'utf8');}catch{continue;}if(s.includes(to)||!s.includes(from))continue;s=s.replace(from,to);fs.writeFileSync(p,s);patched++;}if(!patched){process.exit(0);}"`;
     
@@ -295,7 +295,7 @@ if(touched){console.log('[patch-9router] Applied Codex compatibility patch.');}e
       '        echo "[entrypoint] warning: failed to clone plugin $spec"',
       '      fi',
       '      ;;',
-      '    *) openclaw plugins install "$spec" 2>/dev/null || echo "[entrypoint] warning: failed to install plugin $spec" ;;',
+      '    *) openclaw plugins install "$spec" --acknowledge-clawhub-risk 2>/dev/null || echo "[entrypoint] warning: failed to install plugin $spec" ;;',
       '  esac',
       '}',
       'ensure_skill() {',
@@ -305,7 +305,7 @@ if(touched){console.log('[patch-9router] Applied Codex compatibility patch.');}e
       '    return 0',
       '  fi',
       '  echo "[entrypoint] skill $id missing; installing"',
-      '  openclaw skills install "$id" 2>/dev/null || echo "[entrypoint] warning: failed to install skill $id"',
+      '  openclaw skills install "$id" --acknowledge-clawhub-risk 2>/dev/null || echo "[entrypoint] warning: failed to install skill $id"',
       '}',
       'echo "[entrypoint] ensuring runtime assets, then starting gateway"',
     ];
@@ -320,7 +320,7 @@ if(touched){console.log('[patch-9router] Applied Codex compatibility patch.');}e
       // install when extensions/zalo-connect already exists, so restarts never re-download
       // and a reconnect never reinstalls. No dist patching, no mentions.js, no watchdog
       // hacks: sticker/mention/reaction are native ZaloConnect actions.
-      const zaloConnectSpec = common.ZALO_CONNECT_PLUGIN_SPEC || 'https://github.com/tuanminhhole/openclaw-zalo-connect.git#v3.0.0';
+      const zaloConnectSpec = common.ZALO_CONNECT_PLUGIN_SPEC || 'https://github.com/tuanminhhole/openclaw-zalo-connect.git#v3.0.1';
       runtimeParts.push(`ensure_plugin zalo-connect "${zaloConnectSpec}"`);
     }
     runtimeParts.push('openclaw gateway run');

package/dist/web/app.js

@@ -899,12 +899,11 @@ function botListPanel(bots) {
     const role = (b.role || b.desc || b.description || '').trim() || t('Tr\u1ee3 l\u00fd OpenClaw','OpenClaw assistant');
     const isZalo = b.channel === 'zalo-personal';
     const health = isZalo ? zaloAccountHealth(b) : null;
-    const quickBadge = health?.running ? `<span class="zalo-quick-badge">${t('Đã kết nối','Connected')}</span>` : '';
-    const connection = !health ? t('Chưa rõ','Unknown') : health.running ? t('Hoạt động','Active') : health.lastError ? t('Mất kết nối','Disconnected') : t('Đang kết nối','Connecting');
+    const connection = !health ? t('Chưa rõ','Unknown') : health.running ? t('Đã kết nối','Connected') : health.lastError ? t('Mất kết nối','Disconnected') : t('Đang kết nối','Connecting');
     const login = !health ? t('Chưa rõ','Unknown') : health.sessionSaved ? t('Đã đăng nhập','Logged in') : t('Chưa đăng nhập','Not logged in');
     const connectionTone = health?.running ? 'ok' : health?.lastError ? 'bad' : 'warn';
     const loginTone = health?.sessionSaved ? 'ok' : health ? 'bad' : 'warn';
-    return `<article class="bot-item ${state.activeBotId===b.id?'active':''}" data-bot-id="${escapeHtml(b.id)}"><div class="bot-item-actions"><button class="bot-edit" data-edit-bot="${escapeHtml(b.id)}" title="${t('Sửa bot','Edit bot')}" aria-label="${t('Sửa bot','Edit bot')}">${actionIcon('edit')}</button><button class="bot-delete" data-delete-bot="${escapeHtml(b.id)}" title="${t('X\u00f3a bot','Delete bot')}" aria-label="${t('X\u00f3a bot','Delete bot')}">&times;</button></div><div class="bot-item-title"><b>${escapeHtml(b.name)}</b>${quickBadge}</div><small title="${escapeHtml(role)}">${escapeHtml(role)}</small>${isZalo ? `<div class="zalo-bot-health"><div><span>${t('Kết nối','Connection')}</span><em class="${connectionTone}">${connection}</em></div><div><span>${t('Đăng nhập','Login')}</span><em class="${loginTone}">${login}</em></div></div>` : ''}</article>`;
+    return `<article class="bot-item ${state.activeBotId===b.id?'active':''}" data-bot-id="${escapeHtml(b.id)}"><div class="bot-item-actions"><button class="bot-edit" data-edit-bot="${escapeHtml(b.id)}" title="${t('Sửa bot','Edit bot')}" aria-label="${t('Sửa bot','Edit bot')}">${actionIcon('edit')}</button><button class="bot-delete" data-delete-bot="${escapeHtml(b.id)}" title="${t('X\u00f3a bot','Delete bot')}" aria-label="${t('X\u00f3a bot','Delete bot')}">&times;</button></div><div class="bot-item-title"><b>${escapeHtml(b.name)}</b></div><small title="${escapeHtml(role)}">${escapeHtml(role)}</small>${isZalo ? `<div class="zalo-bot-health"><div><span>${t('Kết nối','Connection')}</span><em class="${connectionTone}">${connection}</em></div><div><span>${t('Đăng nhập','Login')}</span><em class="${loginTone}">${login}</em></div></div>` : ''}</article>`;
   });
   listItems.push(`
     <article class="bot-item bot-create-card" data-bot-modal="open">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-openclaw-bot",
-  "version": "5.13.0",
+  "version": "5.13.3",
   "description": "Interactive CLI installer for OpenClaw Bot",
   "main": "dist/cli.js",
   "bin": {