create-openclaw-bot 5.13.9 → 5.14.0

package/README.md

@@ -7,7 +7,7 @@
 *Run one command → open the dashboard → your bot is live. Windows · macOS · Linux · VPS — Docker-powered, auto-installed for you.*
 
 <p align="center">
-  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.13.9-0EA5E9?style=for-the-badge" alt="Version 5.13.9" /></a>
+  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.14.0-0EA5E9?style=for-the-badge" alt="Version 5.14.0" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup?tab=MIT-1-ov-file"><img src="https://img.shields.io/badge/LICENSE-MIT-success?style=for-the-badge" alt="MIT License" /></a>
   <a href="https://www.npmjs.com/package/create-openclaw-bot"><img src="https://img.shields.io/npm/v/create-openclaw-bot?style=for-the-badge&label=CLI&color=2563EB&logo=npm&logoColor=white" alt="NPM Version" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup/stargazers"><img src="https://img.shields.io/github/stars/tuanminhhole/openclaw-setup?style=for-the-badge&color=eab308&logo=github&logoColor=white" alt="GitHub Stars" /></a>
@@ -37,11 +37,18 @@
 
 ---
 
-## 🆕 What's New in v5.13.9
+## 🆕 What's New in v5.14.0
+
+- 🛠️ **Bots build their own skills**: ask your bot for a reusable capability ("make me a skill for X") and it writes the skill and puts it to work in the same reply — no approval step, no config editing. The skill is saved to `skills/<name>/SKILL.md` in the bot's workspace and loads itself. **Existing bots pick this up automatically on update.**
+
+<details>
+<summary><b>Previous: What's new in v5.13.9</b></summary>
 
 - 🧠 **Always-on memory for every bot (learning-memory)**: a new context-engine plugin injects your curated `MEMORY.md` + `USER.md` into **every** turn — including group chats, which the default recall skips. Bots stop forgetting context and rules over time: no more chiming in when nobody called them, or re-asking things you already told them. Auto-installed for new bots + a 1-click card in the dashboard.
 - 🧹 **Retired TencentDB Agent Memory** in favor of the always-on engine above (no external service needed). Existing bots are auto-migrated on update — the old learning-memory *skill* and the TencentDB plugin are removed automatically.
 
+</details>
+
 <details>
 <summary><b>Previous: What's new in v5.13.4</b></summary>
 

package/README.vi.md

@@ -7,7 +7,7 @@
 *Chạy một lệnh → mở dashboard → bot lên sóng. Windows · macOS · Linux · VPS — chạy trên Docker, tự cài giúp bạn.*
 
 <p align="center">
-  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.13.9-0EA5E9?style=for-the-badge" alt="Version 5.13.9" /></a>
+  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.14.0-0EA5E9?style=for-the-badge" alt="Version 5.14.0" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup?tab=MIT-1-ov-file"><img src="https://img.shields.io/badge/LICENSE-MIT-success?style=for-the-badge" alt="MIT License" /></a>
   <a href="https://www.npmjs.com/package/create-openclaw-bot"><img src="https://img.shields.io/npm/v/create-openclaw-bot?style=for-the-badge&label=CLI&color=2563EB&logo=npm&logoColor=white" alt="NPM Version" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup/stargazers"><img src="https://img.shields.io/github/stars/tuanminhhole/openclaw-setup?style=for-the-badge&color=eab308&logo=github&logoColor=white" alt="GitHub Stars" /></a>
@@ -37,11 +37,18 @@
 
 ---
 
-## 🆕 Có gì mới trong v5.13.9
+## 🆕 Có gì mới trong v5.14.0
+
+- 🛠️ **Bot tự tạo skill cho chính nó**: nhờ bot làm một kỹ năng dùng lại ("tạo cho anh skill X") là nó viết xong và dùng được ngay trong cùng câu trả lời — không còn bước chờ duyệt, không phải sửa cấu hình. Skill lưu vào `skills/<tên>/SKILL.md` trong workspace của bot và tự nạp. **Bot cũ tự nhận khi cập nhật.**
+
+<details>
+<summary><b>Trước đó: Có gì mới trong v5.13.9</b></summary>
 
 - 🧠 **Trí nhớ always-on cho mọi bot (learning-memory)**: plugin context-engine mới nạp `MEMORY.md` + `USER.md` đã chắt lọc vào **MỌI lượt** — kể cả trong nhóm (điều recall mặc định bỏ qua). Bot hết quên ngữ cảnh/quy tắc theo thời gian: không còn "nói leo" khi không ai gọi, không hỏi lại điều bạn đã dặn. Tự cài cho bot mới + có card 1-chạm trên dashboard.
 - 🧹 **Bỏ TencentDB Agent Memory**, thay bằng engine always-on ở trên (không cần dịch vụ ngoài). Bot cũ tự migrate khi cập nhật — *skill* learning-memory cũ và plugin TencentDB được gỡ tự động.
 
+</details>
+
 <details>
 <summary><b>Trước đó: Có gì mới trong v5.13.4</b></summary>
 

package/dist/setup/shared/bot-config-gen.js

@@ -114,10 +114,34 @@
           // nửa đêm và đặt cron/lịch vào quá khứ. Lấy tz người dùng chọn ở UI Cài đặt (mặc định VN).
           userTimezone,
           compaction: { mode: 'safeguard' },
-          // Trim stale tool results before Anthropic's prompt-cache TTL expires so the
-          // re-cache write stays small → lower token cost on long sessions, zero downside.
-          // The stable system prompt (AGENTS.md/SOUL.md…) stays cached above the boundary.
-          contextPruning: { mode: 'cache-ttl', ttl: '5m' },
+          // Trim stale tool results from context before each LLM call. Lowers token
+          // cost on long sessions AND keeps a heavy multi-step turn (deep research +
+          // file/PDF gen) from piling up tool output that overflows the model window
+          // mid tool-loop. These bots run on 9router (no Anthropic prompt cache), so a
+          // short 2m TTL lets pruning engage sooner inside a long turn — no cache
+          // downside. The stable system prompt (AGENTS.md/SOUL.md…) is never pruned.
+          contextPruning: { mode: 'cache-ttl', ttl: '2m' },
+          // Compress vision inputs — these bots are image-heavy (infographics, PDF
+          // charts, screenshots). "efficient" keeps vision-token cost down so an
+          // image-rich turn is far less likely to blow past the context window.
+          imageQuality: 'efficient',
+          // Downscale image payloads when sanitizing transcript/tool-result content
+          // (OpenClaw default is 1200px). Verified failure mode: the bot generated 4K
+          // infographics for a PDF and then read them back with the image tool — each
+          // read landed a ~100KB base64 blob in the transcript, and the overflow
+          // precheck counts that base64 as plain text (~14k tokens per image). Eight of
+          // them in one turn = 214k estimated tokens against a 180k budget → abort with
+          // "nothing to compact". 1024px keeps charts/screenshots legible to vision
+          // while roughly halving the payload.
+          imageMaxDimensionPx: 1024,
+          // Cap each persisted tool result. The model-context auto default is huge
+          // (64k chars/result at 200k tokens), so one heavy turn (e.g. deep research
+          // with 40+ web fetches) can pile up 200k+ tokens of tool output in a SINGLE
+          // unsplittable turn — which then can't be compacted ("nothing to compact")
+          // and poisons the session until a manual reset. 12k chars (~3k tokens) per
+          // result keeps per-source content substantial while making that runaway
+          // impossible. Applies to persisted results + overflow recovery.
+          contextLimits: { toolResultMaxChars: 12000 },
           // Agent-TURN budget (seconds). 120 was too short for multi-step cloud turns (OCR +
           // file gen + tool calls). 900 = OpenClaw's own native default and the practical max
           // we use. This is the turn budget — a DIFFERENT layer from 9router's per-request
@@ -240,8 +264,17 @@
     const skillEntries = buildSkillsEntries(skills, selectedSkills);
     // NOTE: the "zalo-actions" skill was removed — its guidance now lives in the `zalo-connect`
     // tool description itself (fork ≥ v3.0.2), so no per-bot skill entry is needed anymore.
+    //
+    // Skill Workshop `approvalPolicy: "auto"` lets the assistant author its own
+    // workspace skills end-to-end when the user asks ("tạo skill X"): create the
+    // proposal AND apply it in one turn, without a separate operator approval.
+    // Apply is still scanner-gated + workspace-scoped + rollback-tracked, so this
+    // stays safe. Workspace SKILL.md files auto-load via the skills watcher — no
+    // per-skill openclaw.json entry is needed. `autonomous.enabled` stays false so
+    // the bot only creates skills on explicit request, never spontaneously.
+    cfg.skills = { workshop: { approvalPolicy: 'auto' } };
     if (Object.keys(skillEntries).length > 0) {
-      cfg.skills = { entries: skillEntries };
+      cfg.skills.entries = skillEntries;
     }
 
     // ── plugins (memory-core dreaming + openclaw-zalo-mod) ────────────────────────────

package/dist/setup/shared/docker-gen.js

@@ -261,6 +261,23 @@ if(touched){console.log('[patch-9router] Applied Codex compatibility patch.');}e
     // context-engine plugin). Drop their config entries so they stop loading; the skill
     // folders + tencentdb install are removed by the shell steps that follow.
     const deprecatedCleanupScript = `const fs=require('fs'),path=require('path');const p=path.join(process.cwd(),'.openclaw','openclaw.json');if(fs.existsSync(p)){const c=JSON.parse(fs.readFileSync(p,'utf8'));let ch=false;if(c.plugins&&c.plugins.entries&&c.plugins.entries['memory-tencentdb']){delete c.plugins.entries['memory-tencentdb'];ch=true;}if(c.plugins&&Array.isArray(c.plugins.allow)){const n=c.plugins.allow.filter(x=>x!=='memory-tencentdb'&&x!=='@tencentdb-agent-memory/memory-tencentdb');if(n.length!==c.plugins.allow.length){c.plugins.allow=n;ch=true;}}if(c.skills&&c.skills.entries&&c.skills.entries['learning-memory']){delete c.skills.entries['learning-memory'];ch=true;}if(ch)fs.writeFileSync(p,JSON.stringify(c,null,2));}`;
+    // One-shot upgrade for projects created by an older setup (their openclaw.json was
+    // generated before these defaults existed, and bot-config-gen only runs when a bot is
+    // created/regenerated — so a plain rebuild would never pick them up):
+    //   • skills.workshop.approvalPolicy:'auto' → the assistant can author a workspace
+    //     skill end-to-end on request instead of stopping at "proposal awaiting approval".
+    //   • imageMaxDimensionPx / imageQuality / contextLimits.toolResultMaxChars → keep one
+    //     heavy turn (deep research, 4K chart read-back) from overflowing the context
+    //     window mid tool-loop, which cannot be compacted and poisons the session.
+    // Each key is only filled in when absent, so an operator's own tuning is never clobbered.
+    const contextDefaultsScript = `const fs=require('fs'),path=require('path');const p=path.join(process.cwd(),'.openclaw','openclaw.json');if(fs.existsSync(p)){const c=JSON.parse(fs.readFileSync(p,'utf8'));let ch=false;c.skills=c.skills||{};c.skills.workshop=c.skills.workshop||{};if(!c.skills.workshop.approvalPolicy){c.skills.workshop.approvalPolicy='auto';ch=true;}const d=(c.agents&&c.agents.defaults)?c.agents.defaults:null;if(d){if(d.imageMaxDimensionPx===undefined){d.imageMaxDimensionPx=1024;ch=true;}if(d.imageQuality===undefined){d.imageQuality='efficient';ch=true;}d.contextLimits=d.contextLimits||{};if(d.contextLimits.toolResultMaxChars===undefined){d.contextLimits.toolResultMaxChars=12000;ch=true;}}if(ch)fs.writeFileSync(p,JSON.stringify(c,null,2));}`;
+    // Companion backfill for the same older projects: their TOOLS.md was generated before the
+    // skill-authoring / long-turn guidance existed, and workspace files are only written when a
+    // bot is created — so a rebuild alone leaves the assistant stopping at "proposal awaiting
+    // approval" even once approvalPolicy is 'auto'. (TOOLS.md is listed in AGENTS.md as required
+    // reading, so guidance lands there rather than in the main manual.) Appends the block once
+    // per workspace, keyed off the `skill_workshop` marker, never rewriting a file that has it.
+    const agentsGuidanceScript = `const fs=require('fs'),path=require('path');const vi=['','## 🛠️ Tự tạo skill & việc dài','','**Tự tạo skill:** Khi user nhờ tạo một kỹ năng/quy trình dùng lại (vd _"tạo skill X"_), bạn TỰ làm từ đầu đến cuối — dùng tool **skill_workshop**: tạo proposal RỒI **apply luôn trong cùng lượt** (môi trường này bật approvalPolicy auto, không cần chờ ai duyệt). Skill ghi vào skills/<tên>/SKILL.md và **tự nạp** qua watcher — KHÔNG cần sửa openclaw.json. Đừng dừng ở _"đã tạo proposal, chờ duyệt"_. KHÔNG nhúng bí mật vào skill — đọc từ biến môi trường lúc chạy.','','**Việc dài, nhiều bước (research sâu, dựng báo cáo/PDF):** ảnh/chart bạn vừa tạo thì **đừng đọc lại** bằng tool ảnh (chèn thẳng file vào tài liệu; kiểm bằng file tồn tại / build thành công) — đọc lại ảnh lớn ngốn ngữ cảnh gấp nhiều lần bạn tưởng. Tạo hình cạnh dài khoảng 1280px, đừng 4K trừ khi user yêu cầu. Research nhiều nguồn thì dùng **sessions_spawn** mỗi nhánh một subagent, bảo chúng **ghi dữ liệu thô ra file** và **chỉ trả tóm tắt ngắn kèm đường dẫn**; bạn tổng hợp từ file.',''].join('\\n');const en=['','## 🛠️ Authoring skills & long work','','**Authoring skills:** When the user asks for a reusable capability (e.g. _"make a skill for X"_), do it end-to-end — use the **skill_workshop** tool: create the proposal AND **apply it in the same turn** (this environment sets approvalPolicy auto, so no separate approval is needed). The skill lands in skills/<name>/SKILL.md and **auto-loads** via the watcher — no openclaw.json edit required. Do not stop at _"proposal created, awaiting approval"_. Never hardcode secrets into a skill — read them from environment variables at runtime.','','**Long multi-step work (deep research, building reports/PDFs):** do not read back an image or chart you just made (drop the file straight in; verify via file exists / build succeeded) — re-reading a large image costs far more context than it looks. Render at about 1280px on the long edge, skip 4K unless asked. For multi-source research, use **sessions_spawn** with one subagent per branch, have them **write raw findings to files** and **return only a short summary plus paths**; synthesize from the files.',''].join('\\n');const root=path.join(process.cwd(),'.openclaw');let dirs=[];try{dirs=fs.readdirSync(root).filter(n=>n.indexOf('workspace')===0);}catch(e){}for(const d of dirs){const f=path.join(root,d,'TOOLS.md');try{if(!fs.existsSync(f))continue;const cur=fs.readFileSync(f,'utf8');if(cur.indexOf('skill_workshop')!==-1)continue;const isVi=/Kỹ năng|Ghi chú|Xử lý lỗi|môi trường/.test(cur);fs.appendFileSync(f,(cur.endsWith('\\n')?'':'\\n')+(isVi?vi:en));}catch(e){}}`;
     const securityCompatScript = `const fs=require('fs'),path=require('path');const scopes=['operator.admin','operator.pairing','operator.approvals'];function uniq(a){return Array.from(new Set([...(Array.isArray(a)?a:[]),...scopes]));}function walk(v){if(!v||typeof v!=='object')return;if(Array.isArray(v)){v.forEach(walk);return;}if(Array.isArray(v.scopes)||Array.isArray(v.approvedScopes)){v.scopes=uniq(v.scopes);v.approvedScopes=uniq(v.approvedScopes);}Object.values(v).forEach(walk);}const home=process.env.OPENCLAW_HOME||path.join(process.cwd(),'.openclaw');const state=process.env.OPENCLAW_STATE_DIR||home;const cfgPath=path.join(process.cwd(),'.openclaw','openclaw.json');if(fs.existsSync(cfgPath)){const c=JSON.parse(fs.readFileSync(cfgPath,'utf8'));const p=c.models&&c.models.providers&&c.models.providers['9router'];if(p){p.request=Object.assign({},p.request,{allowPrivateNetwork:true});}fs.writeFileSync(cfgPath,JSON.stringify(c,null,2));}for(const root of Array.from(new Set([home,state]))){const f=path.join(root,'devices','paired.json');if(fs.existsSync(f)){const d=JSON.parse(fs.readFileSync(f,'utf8'));walk(d);fs.writeFileSync(f,JSON.stringify(d,null,2));}}`;
 
     const runtimeParts = runtimeCommandParts.filter(Boolean);
@@ -335,6 +352,9 @@ if(touched){console.log('[patch-9router] Applied Codex compatibility patch.');}e
     runtimeParts.push(`node - <<'NODE'\n${deprecatedCleanupScript}\nNODE`);
     runtimeParts.push('find "$OPENCLAW_HOME" -maxdepth 4 -type d -path "*/skills/learning-memory" -exec rm -rf {} + 2>/dev/null || true');
     runtimeParts.push('if [ -d "$OPENCLAW_HOME/extensions/memory-tencentdb" ] || openclaw plugins list 2>/dev/null | grep -q memory-tencentdb; then openclaw plugins uninstall memory-tencentdb --force 2>/dev/null || true; fi');
+    // Backfill skill-authoring + context defaults for configs from an older setup (see above).
+    runtimeParts.push(`node - <<'NODE'\n${contextDefaultsScript}\nNODE`);
+    runtimeParts.push(`node - <<'NODE'\n${agentsGuidanceScript}\nNODE`);
     runtimeParts.push('openclaw gateway run');
     const runtimeScript = ['#!/bin/sh', 'set -e', ...runtimeParts].join('\n');
     let browserInstall = '';

package/dist/setup/shared/workspace-gen.js

@@ -1231,6 +1231,14 @@ Skills dùng chung. Setup là của riêng bạn. Tách ra nghĩa là cập nh
 
 - Xem chi tiết hướng dẫn các kỹ năng được cài đặt tại thư mục [skills](./skills/).
 
+**🛠️ Tự tạo skill:** Khi user nhờ tạo một kỹ năng/quy trình dùng lại (vd _"tạo skill X"_), bạn TỰ làm được từ đầu đến cuối — dùng tool \`skill_workshop\`: tạo proposal RỒI **apply luôn trong cùng lượt** (môi trường này đã bật \`approvalPolicy: auto\` nên không cần chờ ai duyệt). Skill sẽ được ghi vào \`skills/<tên>/SKILL.md\` trong workspace và **tự nạp** qua watcher — KHÔNG cần sửa \`openclaw.json\`. Đừng dừng ở bước _"đã tạo proposal, chờ sếp duyệt rồi áp dụng"_: user bảo tạo nghĩa là tạo xong dùng được ngay. Tuyệt đối KHÔNG nhúng bí mật (mật khẩu/token/tài khoản) vào nội dung skill — đọc chúng từ biến môi trường lúc chạy.
+
+**🧠 Việc dài, nhiều bước (research sâu, dựng báo cáo/PDF):** cửa sổ ngữ cảnh là tài nguyên — một lượt nhồi quá nhiều sẽ vỡ giữa đường và KHÔNG nén lại được. Ba quy tắc:
+
+- **Ảnh/chart bạn vừa tạo thì đừng đọc lại** bằng tool ảnh để "xem cho chắc". Chèn thẳng file vào tài liệu; muốn kiểm thì xem file có tồn tại / build thành công. Đọc lại một ảnh lớn tốn ngữ cảnh gấp nhiều lần bạn tưởng.
+- **Tạo hình ở cỡ vừa đủ** (cạnh dài ~1280px là đẹp cho báo cáo). Đừng làm 4K trừ khi user yêu cầu rõ.
+- **Research nhiều nguồn thì chia việc:** \`sessions_spawn\` mỗi nhánh một subagent (mỗi con có cửa sổ riêng), bảo chúng **ghi dữ liệu thô ra file** trong workspace và **chỉ trả về tóm tắt ngắn kèm đường dẫn file**. Bạn tổng hợp từ file. Đừng tự mình kéo hàng chục trang web vào một lượt.
+
 ## 📁 File & Workspace
 
 - Bot có thể đọc/ghi file trong thư mục workspace: \`${workspacePath}\`
@@ -1282,6 +1290,14 @@ Skills are shared. Your setup is yours. Keeping them apart means you can update
 
 - See detailed guidelines of installed skills in the [skills](./skills/) directory.
 
+**🛠️ Authoring skills:** When the user asks you to build a reusable capability (e.g. _"make a skill for X"_), you can do it end-to-end — use the \`skill_workshop\` tool: create the proposal AND **apply it in the same turn** (this environment sets \`approvalPolicy: auto\`, so no separate approval is needed). The skill lands in \`skills/<name>/SKILL.md\` in the workspace and **auto-loads** via the watcher — no \`openclaw.json\` edit required. Don't stop at _"proposal created, awaiting approval"_: if they asked you to build it, finish it so it works right away. Never hardcode secrets (passwords/tokens/accounts) into a skill's contents — read them from environment variables at runtime.
+
+**🧠 Long multi-step work (deep research, building reports/PDFs):** the context window is a budget — cram too much into one turn and it blows up mid-flight, with nothing left to compact. Three rules:
+
+- **Don't read back an image or chart you just made** to "double-check" it. Drop the file straight into the document; verify by checking the file exists or that the build succeeded. Re-reading a large image costs far more context than it looks.
+- **Render images at a sane size** (~1280px on the long edge looks great in a report). Skip 4K unless the user explicitly asks.
+- **Split multi-source research:** \`sessions_spawn\` one subagent per branch (each gets its own window), have them **write raw findings to files** in the workspace and **return only a short summary plus the file paths**. You synthesize from the files. Don't pull dozens of web pages into a single turn yourself.
+
 ## 📁 File & Workspace
 
 - Bot can read/write files in workspace: \`${workspacePath}\`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-openclaw-bot",
-  "version": "5.13.9",
+  "version": "5.14.0",
   "description": "Interactive CLI installer for OpenClaw Bot",
   "main": "dist/cli.js",
   "bin": {