create-openclaw-bot 5.15.2 → 5.16.0

package/dist/setup/shared/bot-config-gen.js

@@ -277,11 +277,19 @@
     }
 
     // ── gateway ──────────────────────────────────────────────────────────────
+    // Docker MUST bind 0.0.0.0 inside the container to be reachable at all, but that is contained:
+    // compose publishes the port as `127.0.0.1:<port>:<port>` (docker-gen), so the host still only
+    // answers on loopback. A NATIVE gateway has no port mapping to hide behind — 0.0.0.0 there puts
+    // it straight on the VPS's public interface, with the auth token crossing the wire in plaintext
+    // (the gateway speaks plain HTTP/WS) and, on a fresh VPS, no firewall in front of it. The
+    // `osChoice === 'vps'` clause predates native mode; keep native on loopback and reach it through
+    // an SSH tunnel, which is what docker-on-a-VPS effectively does too.
+    const openGatewayBind = deployMode === 'docker' || (osChoice === 'vps' && deployMode !== 'native');
     cfg.gateway = {
       port: gatewayPort,
       mode: 'local',
-      bind: (deployMode === 'docker' || osChoice === 'vps') ? 'custom' : 'loopback',
-      ...(deployMode === 'docker' || osChoice === 'vps' ? { customBindHost: '0.0.0.0' } : {}),
+      bind: openGatewayBind ? 'custom' : 'loopback',
+      ...(openGatewayBind ? { customBindHost: '0.0.0.0' } : {}),
       controlUi: {
         allowedOrigins: gatewayAllowedOrigins.length > 0
           ? gatewayAllowedOrigins

package/dist/setup/shared/common-gen.js

@@ -268,7 +268,13 @@ If setup reported a plugin install error, run this after the bot is running:
         {
           id: 'smart-route',
           name: 'Smart Proxy (Auto Route)',
-          contextWindow: 200000,
+          // smart-route fans out to whatever free upstreams the operator's combo holds, and the
+          // SMALLEST window in that pool is the real ceiling — many free models stop at 128k.
+          // Declaring 200k let sessions grow past what the route could actually accept: once
+          // full, even the compaction summarize call overflowed and every turn died with
+          // "auto-compaction could not recover" until /new. 131072 keeps compaction triggering
+          // (window - reserveTokens) while the summarize request still fits everywhere.
+          contextWindow: 131072,
           maxTokens: 8192,
           input: ['text', 'image'],
         },

package/dist/setup/shared/docker-gen.js

@@ -272,8 +272,12 @@ if(touched){console.log('[patch-9router] Applied Codex compatibility patch.');}e
     //   • imageMaxDimensionPx / imageQuality / contextLimits.toolResultMaxChars → keep one
     //     heavy turn (deep research, 4K chart read-back) from overflowing the context
     //     window mid tool-loop, which cannot be compacted and poisons the session.
+    //   • smart-route contextWindow 200000 → 131072: the old declared window exceeded the
+    //     smallest upstream in typical free-model combos, so full sessions deadlocked —
+    //     the compaction summarize call itself overflowed and only /new recovered. Only the
+    //     exact setup-written 200000 is rewritten; an operator's custom value is left alone.
     // Each key is only filled in when absent, so an operator's own tuning is never clobbered.
-    const contextDefaultsScript = `const fs=require('fs'),path=require('path');const p=path.join(process.cwd(),'.openclaw','openclaw.json');if(fs.existsSync(p)){const c=JSON.parse(fs.readFileSync(p,'utf8'));let ch=false;c.skills=c.skills||{};c.skills.workshop=c.skills.workshop||{};if(!c.skills.workshop.approvalPolicy){c.skills.workshop.approvalPolicy='auto';ch=true;}if(c.browser&&c.browser.enabled!==false){c.tools=c.tools||{};const dn=Array.isArray(c.tools.deny)?c.tools.deny:[];if(!dn.includes('browser')){dn.push('browser');c.tools.deny=dn;ch=true;}}const d=(c.agents&&c.agents.defaults)?c.agents.defaults:null;if(d){if(d.imageMaxDimensionPx===undefined){d.imageMaxDimensionPx=1024;ch=true;}if(d.imageQuality===undefined){d.imageQuality='efficient';ch=true;}d.contextLimits=d.contextLimits||{};if(d.contextLimits.toolResultMaxChars===undefined){d.contextLimits.toolResultMaxChars=12000;ch=true;}}if(ch)fs.writeFileSync(p,JSON.stringify(c,null,2));}`;
+    const contextDefaultsScript = `const fs=require('fs'),path=require('path');const p=path.join(process.cwd(),'.openclaw','openclaw.json');if(fs.existsSync(p)){const c=JSON.parse(fs.readFileSync(p,'utf8'));let ch=false;c.skills=c.skills||{};c.skills.workshop=c.skills.workshop||{};if(!c.skills.workshop.approvalPolicy){c.skills.workshop.approvalPolicy='auto';ch=true;}if(c.browser&&c.browser.enabled!==false){c.tools=c.tools||{};const dn=Array.isArray(c.tools.deny)?c.tools.deny:[];if(!dn.includes('browser')){dn.push('browser');c.tools.deny=dn;ch=true;}}const d=(c.agents&&c.agents.defaults)?c.agents.defaults:null;if(d){if(d.imageMaxDimensionPx===undefined){d.imageMaxDimensionPx=1024;ch=true;}if(d.imageQuality===undefined){d.imageQuality='efficient';ch=true;}d.contextLimits=d.contextLimits||{};if(d.contextLimits.toolResultMaxChars===undefined){d.contextLimits.toolResultMaxChars=12000;ch=true;}}const pr=c.models&&c.models.providers&&c.models.providers['9router'];if(pr&&Array.isArray(pr.models)){for(const m of pr.models){if(m&&m.id==='smart-route'&&m.contextWindow===200000){m.contextWindow=131072;ch=true;}}}if(ch)fs.writeFileSync(p,JSON.stringify(c,null,2));}`;
     // Companion backfill for the same older projects: their TOOLS.md was generated before the
     // skill-authoring / long-turn guidance existed, and workspace files are only written when a
     // bot is created — so a rebuild alone leaves the assistant stopping at "proposal awaiting
@@ -288,6 +292,17 @@ if(touched){console.log('[patch-9router] Applied Codex compatibility patch.');}e
       'export OPENCLAW_HOME="${OPENCLAW_HOME:-$PWD/.openclaw}"',
       'export OPENCLAW_STATE_DIR="${OPENCLAW_STATE_DIR:-$OPENCLAW_HOME}"',
       'mkdir -p "$OPENCLAW_HOME" "$OPENCLAW_STATE_DIR"',
+      // `openclaw plugins install` unpacks into extensions/.openclaw-install-stage-XXXXXX and removes
+      // it when it finishes. An interrupted install leaves the staging copy behind — and it still
+      // carries a plugin manifest, so the gateway logs "duplicate plugin id detected" on every boot
+      // and a stale build competes with the real one for the same id. Found on a production host: a
+      // zalo-connect 3.0.7 stage dir shadowing 3.0.17 for a week. Nothing is installing at entrypoint
+      // time, so any stage dir here is by definition abandoned.
+      'for stage in "$OPENCLAW_HOME"/extensions/.openclaw-install-stage-*; do',
+      '  [ -d "$stage" ] || continue',
+      '  echo "[entrypoint] removing abandoned plugin staging dir $(basename "$stage")"',
+      '  rm -rf "$stage"',
+      'done',
       'if [ "$OPENCLAW_STATE_DIR" != "$OPENCLAW_HOME" ]; then',
       '  for path in "$OPENCLAW_HOME"/*; do',
       '    [ -e "$path" ] || continue',

package/dist/setup/shared/host-ui-ps1.js

@@ -0,0 +1,179 @@
+// @ts-nocheck
+// PowerShell backend for host UI automation on Windows.
+//
+// Windows has no xdotool and no bundled CLI for input, so the actions are done the way the
+// no-dependency tools do it: P/Invoke into user32.dll for the pointer and keys (SetCursorPos /
+// mouse_event / keybd_event), System.Windows.Forms.SendKeys for text, System.Drawing's
+// CopyFromScreen for captures, and Get/Set-Clipboard for the clipboard. Shipping this as one
+// version-stamped .ps1 keeps the quoting sane: the server passes typed parameters, never a
+// composed command line.
+(function (root) {
+  const HOST_UI_PS1_VERSION = '1';
+
+  const HOST_UI_PS1 = String.raw`# OpenClaw host UI helper — version __VERSION__
+# Generated by openclaw-setup. Edits are overwritten when the version changes.
+param(
+  [Parameter(Mandatory = $true)][string]$Action,
+  [int]$X = -1,
+  [int]$Y = -1,
+  [int]$ToX = -1,
+  [int]$ToY = -1,
+  [int]$Amount = 3,
+  [string]$Text = '',
+  [string]$Button = 'left',
+  [int]$Clicks = 1,
+  [string]$Path = '',
+  [string]$Title = ''
+)
+
+$ErrorActionPreference = 'Stop'
+Add-Type -AssemblyName System.Windows.Forms, System.Drawing
+
+if (-not ('OpenClawUi' -as [type])) {
+  Add-Type -Namespace '' -Name OpenClawUi -MemberDefinition @'
+[DllImport("user32.dll")] public static extern bool SetCursorPos(int x, int y);
+[DllImport("user32.dll")] public static extern void mouse_event(uint flags, uint dx, uint dy, uint data, int extra);
+[DllImport("user32.dll")] public static extern bool SetForegroundWindow(System.IntPtr hWnd);
+[DllImport("user32.dll")] public static extern bool ShowWindow(System.IntPtr hWnd, int cmd);
+'@
+}
+
+$MOUSEEVENTF = @{
+  leftdown = 0x0002; leftup = 0x0004;
+  rightdown = 0x0008; rightup = 0x0010;
+  middledown = 0x0020; middleup = 0x0040;
+  wheel = 0x0800; hwheel = 0x01000;
+}
+
+function Out-Json($obj) { $obj | ConvertTo-Json -Compress -Depth 6 }
+
+function Move-Pointer([int]$px, [int]$py) {
+  if ($px -ge 0 -and $py -ge 0) { [OpenClawUi]::SetCursorPos($px, $py) | Out-Null; Start-Sleep -Milliseconds 40 }
+}
+
+function Invoke-Click([string]$btn, [int]$times) {
+  $down = $MOUSEEVENTF[($btn + 'down')]
+  $up = $MOUSEEVENTF[($btn + 'up')]
+  if (-not $down) { throw "unknown button: $btn" }
+  for ($i = 0; $i -lt [Math]::Max(1, $times); $i++) {
+    [OpenClawUi]::mouse_event($down, 0, 0, 0, 0)
+    [OpenClawUi]::mouse_event($up, 0, 0, 0, 0)
+    Start-Sleep -Milliseconds 60
+  }
+}
+
+# SendKeys needs its own escaping: + ^ % ~ ( ) { } [ ] are modifiers there, so literal text has
+# to be wrapped in braces or the bot's message silently turns into shortcuts.
+function ConvertTo-SendKeysLiteral([string]$s) {
+  $sb = New-Object System.Text.StringBuilder
+  foreach ($ch in $s.ToCharArray()) {
+    if ('+^%~(){}[]'.Contains($ch)) { [void]$sb.Append('{' + $ch + '}') }
+    elseif ($ch -eq [char]10) { [void]$sb.Append('{ENTER}') }
+    elseif ($ch -eq [char]9) { [void]$sb.Append('{TAB}') }
+    elseif ($ch -eq [char]13) { }
+    else { [void]$sb.Append($ch) }
+  }
+  $sb.ToString()
+}
+
+# "ctrl+shift+t" / "enter" / "cmd+a" (cmd is mapped to ctrl on Windows) → SendKeys syntax.
+function ConvertTo-SendKeysCombo([string]$combo) {
+  $named = @{
+    enter = '{ENTER}'; return = '{ENTER}'; tab = '{TAB}'; esc = '{ESC}'; escape = '{ESC}';
+    backspace = '{BACKSPACE}'; delete = '{DELETE}'; del = '{DELETE}'; home = '{HOME}'; end = '{END}';
+    pageup = '{PGUP}'; pagedown = '{PGDN}'; up = '{UP}'; down = '{DOWN}'; left = '{LEFT}'; right = '{RIGHT}';
+    space = ' '; f1 = '{F1}'; f2 = '{F2}'; f3 = '{F3}'; f4 = '{F4}'; f5 = '{F5}'; f6 = '{F6}';
+    f7 = '{F7}'; f8 = '{F8}'; f9 = '{F9}'; f10 = '{F10}'; f11 = '{F11}'; f12 = '{F12}';
+    printscreen = '{PRTSC}'; insert = '{INSERT}';
+  }
+  $prefix = ''
+  $parts = $combo.Split('+') | ForEach-Object { $_.Trim().ToLower() } | Where-Object { $_ }
+  $keyPart = ''
+  foreach ($p in $parts) {
+    switch ($p) {
+      'ctrl' { $prefix += '^' }
+      'control' { $prefix += '^' }
+      'cmd' { $prefix += '^' }      # macOS habit; Windows equivalent is Ctrl
+      'meta' { $prefix += '^' }
+      'alt' { $prefix += '%' }
+      'shift' { $prefix += '+' }
+      'win' { $prefix += '' }       # SendKeys cannot press Win; use the Windows key combos below
+      default { $keyPart = $p }
+    }
+  }
+  if (-not $keyPart) { throw "no key in combo: $combo" }
+  $mapped = if ($named.ContainsKey($keyPart)) { $named[$keyPart] } else { $keyPart }
+  $prefix + $mapped
+}
+
+switch ($Action) {
+  'screen_size' {
+    $b = [System.Windows.Forms.SystemInformation]::VirtualScreen
+    Out-Json @{ ok = $true; width = $b.Width; height = $b.Height; left = $b.Left; top = $b.Top }
+  }
+  'screenshot' {
+    if (-not $Path) { throw 'screenshot needs -Path' }
+    $b = [System.Windows.Forms.SystemInformation]::VirtualScreen
+    $bmp = New-Object System.Drawing.Bitmap $b.Width, $b.Height
+    $g = [System.Drawing.Graphics]::FromImage($bmp)
+    $g.CopyFromScreen($b.Left, $b.Top, 0, 0, $bmp.Size)
+    $dir = Split-Path -Parent $Path
+    if ($dir -and -not (Test-Path $dir)) { New-Item -ItemType Directory -Force -Path $dir | Out-Null }
+    $bmp.Save($Path, [System.Drawing.Imaging.ImageFormat]::Png)
+    $g.Dispose(); $bmp.Dispose()
+    Out-Json @{ ok = $true; path = $Path; width = $b.Width; height = $b.Height }
+  }
+  'mouse_move' { Move-Pointer $X $Y; Out-Json @{ ok = $true; x = $X; y = $Y } }
+  'click' { Move-Pointer $X $Y; Invoke-Click $Button $Clicks; Out-Json @{ ok = $true; button = $Button; clicks = $Clicks } }
+  'drag' {
+    Move-Pointer $X $Y
+    [OpenClawUi]::mouse_event($MOUSEEVENTF['leftdown'], 0, 0, 0, 0)
+    Start-Sleep -Milliseconds 80
+    Move-Pointer $ToX $ToY
+    [OpenClawUi]::mouse_event($MOUSEEVENTF['leftup'], 0, 0, 0, 0)
+    Out-Json @{ ok = $true; from = @($X, $Y); to = @($ToX, $ToY) }
+  }
+  'scroll' {
+    Move-Pointer $X $Y
+    $ticks = [Math]::Max(1, [Math]::Abs($Amount))
+    $delta = if ($Amount -lt 0) { -120 } else { 120 }
+    for ($i = 0; $i -lt $ticks; $i++) {
+      [OpenClawUi]::mouse_event($MOUSEEVENTF['wheel'], 0, 0, [uint32]([int]$delta -band 0xFFFFFFFF), 0)
+      Start-Sleep -Milliseconds 40
+    }
+    Out-Json @{ ok = $true; amount = $Amount }
+  }
+  'type' {
+    [System.Windows.Forms.SendKeys]::SendWait((ConvertTo-SendKeysLiteral $Text))
+    Out-Json @{ ok = $true; typed = $Text.Length }
+  }
+  'key' {
+    foreach ($combo in ($Text -split '\s+' | Where-Object { $_ })) {
+      [System.Windows.Forms.SendKeys]::SendWait((ConvertTo-SendKeysCombo $combo))
+      Start-Sleep -Milliseconds 60
+    }
+    Out-Json @{ ok = $true; keys = $Text }
+  }
+  'clipboard_get' { Out-Json @{ ok = $true; text = (Get-Clipboard -Raw) } }
+  'clipboard_set' { Set-Clipboard -Value $Text; Out-Json @{ ok = $true; length = $Text.Length } }
+  'windows' {
+    $list = Get-Process | Where-Object { $_.MainWindowTitle } |
+      Select-Object -First 40 @{n = 'title'; e = { $_.MainWindowTitle } }, @{n = 'process'; e = { $_.ProcessName } }, Id
+    Out-Json @{ ok = $true; windows = @($list) }
+  }
+  'focus' {
+    if (-not $Title) { throw 'focus needs -Title' }
+    $proc = Get-Process | Where-Object { $_.MainWindowTitle -like "*$Title*" } | Select-Object -First 1
+    if (-not $proc) { Out-Json @{ ok = $false; error = "no window matching: $Title" }; break }
+    [OpenClawUi]::ShowWindow($proc.MainWindowHandle, 9) | Out-Null   # SW_RESTORE
+    [OpenClawUi]::SetForegroundWindow($proc.MainWindowHandle) | Out-Null
+    Out-Json @{ ok = $true; focused = $proc.MainWindowTitle }
+  }
+  default { Out-Json @{ ok = $false; error = "unknown action: $Action" } }
+}
+`.replace('__VERSION__', HOST_UI_PS1_VERSION);
+
+  const api = { HOST_UI_PS1, HOST_UI_PS1_VERSION };
+  if (typeof module !== 'undefined' && module.exports) module.exports = api;
+  root.__openclawHostUiPs1 = api;
+})(typeof globalThis !== 'undefined' ? globalThis : this);

package/dist/web/app.js

@@ -413,7 +413,11 @@ function remoteAccessPanel(s = {}) {
   const host = r.host || '<your-server-ip>';
   const user = r.user || 'root';
   const portOf = (raw, def) => { try { return new URL(raw).port || def; } catch { return def; } };
-  const ports = Array.from(new Set([r.uiPort || 51789, portOf(s.gatewayUrl, 18789), portOf(s.routerUrl, 20128), 18790]));
+  // zalo-mod's dashboard is gateway port + 1, not a fixed 18790 — the same rule the plugin card's
+  // "Open" button uses. Hardcoding it meant any project whose gateway is not on 18789 got a tunnel
+  // command missing the dashboard port, and the dashboard then simply failed to load with no clue why.
+  const gwPort = Number(portOf(s.gatewayUrl, 18789));
+  const ports = Array.from(new Set([r.uiPort || 51789, gwPort, Number(portOf(s.routerUrl, 20128)), gwPort + 1]));
   const cmd = `ssh ${ports.map((p) => `-L ${p}:127.0.0.1:${p}`).join(' ')} ${user}@${host}`;
   return `<details class="card" style="margin-top:12px;" ${r.headless ? 'open' : ''}>
     <summary style="cursor:pointer; font-weight:600;">🌐 ${t('Mở từ máy khác (VPS/server)', 'Open from another machine (VPS/server)')}</summary>
@@ -1011,11 +1015,7 @@ function botListPanel(bots) {
   const listItems = bots.map(b => {
     const role = (b.role || b.desc || b.description || '').trim() || t('Tr\u1ee3 l\u00fd OpenClaw','OpenClaw assistant');
     const isZalo = b.channel === 'zalo-personal';
-    const health = isZalo ? zaloAccountHealth(b) : null;
-    const connection = !health ? t('Chưa rõ','Unknown') : health.running ? t('Đã kết nối','Connected') : health.lastError ? t('Mất kết nối','Disconnected') : t('Đang kết nối','Connecting');
-    const login = !health ? t('Chưa rõ','Unknown') : health.sessionSaved ? t('Đã đăng nhập','Logged in') : t('Chưa đăng nhập','Not logged in');
-    const connectionTone = health?.running ? 'ok' : health?.lastError ? 'bad' : 'warn';
-    const loginTone = health?.sessionSaved ? 'ok' : health ? 'bad' : 'warn';
+    const { connection, login, connectionTone, loginTone } = zaloHealthBadges(b);
     return `<article class="bot-item ${state.activeBotId===b.id?'active':''}" data-bot-id="${escapeHtml(b.id)}"><div class="bot-item-actions"><button class="bot-edit" data-edit-bot="${escapeHtml(b.id)}" title="${t('Sửa bot','Edit bot')}" aria-label="${t('Sửa bot','Edit bot')}">${actionIcon('edit')}</button><button class="bot-delete" data-delete-bot="${escapeHtml(b.id)}" title="${t('X\u00f3a bot','Delete bot')}" aria-label="${t('X\u00f3a bot','Delete bot')}">&times;</button></div><div class="bot-item-title"><b>${escapeHtml(b.name)}</b></div><small title="${escapeHtml(role)}">${escapeHtml(role)}</small>${isZalo ? `<div class="zalo-bot-health"><div><span>${t('Kết nối','Connection')}</span><em class="${connectionTone}">${connection}</em></div><div><span>${t('Đăng nhập','Login')}</span><em class="${loginTone}">${login}</em></div></div>` : ''}</article>`;
   });
   listItems.push(`
@@ -1623,7 +1623,10 @@ document.querySelectorAll('[data-project-pick-folder]').forEach(btn => btn.oncli
     body.projectDir = activeProjectDir();
     body.channel = state.botChannel || 'telegram';
     body.userTimezone = state.tz;
-    if (body.channel === 'zalo-personal') {
+    // Only the CREATE flow starts a Zalo QR login (the server kicks it off and sets
+    // loginStarted). Editing a bot (rename, persona...) must never pop the QR modal —
+    // the session is already saved and the PUT endpoint starts no login.
+    if (body.channel === 'zalo-personal' && !state.botEditId) {
       state.botModalOpen = false;
       state.zaloLoginOpen = true;
       state.zaloQrDataUrl = '';
@@ -1718,6 +1721,24 @@ function zaloAccountHealth(bot) {
     || accounts.find((account) => account.accountId === (bot?.accountId || 'default'))
     || null;
 }
+// Connection/login labels for one bot. lastError wins over running: the gateway keeps
+// running=true while the Zalo listener is stuck in a retry loop (e.g. "Đăng nhập thất
+// bại"), so a running-first check painted dead bots green.
+function zaloHealthBadges(bot) {
+  const health = bot?.channel === 'zalo-personal' ? zaloAccountHealth(bot) : null;
+  const loginFailed = !!health?.lastError && /đăng nhập|log ?in|auth|credential|session/i.test(String(health.lastError));
+  const connection = !health ? t('Chưa rõ','Unknown')
+    : health.lastError ? t('Mất kết nối','Disconnected')
+    : health.running ? t('Đã kết nối','Connected')
+    : t('Đang kết nối','Connecting');
+  const login = !health ? t('Chưa rõ','Unknown')
+    : loginFailed ? t('Phiên hết hạn','Session expired')
+    : health.sessionSaved ? t('Đã đăng nhập','Logged in')
+    : t('Chưa đăng nhập','Not logged in');
+  const connectionTone = !health ? 'warn' : health.lastError ? 'bad' : health.running ? 'ok' : 'warn';
+  const loginTone = !health ? 'warn' : loginFailed ? 'bad' : health.sessionSaved ? 'ok' : 'bad';
+  return { health, connection, login, connectionTone, loginTone };
+}
 function zaloToolbar(channelBots = []) {
   const active = channelBots.find((bot) => bot.id === state.activeBotId) || channelBots[0];
   const health = zaloAccountHealth(active);
@@ -1729,6 +1750,42 @@ async function loadZaloHealth(silent=false){
   try { state.zaloHealth = await api('/api/zalo/health' + projectQuery()); } catch (_) { state.zaloHealth = null; }
   if (!silent) render();
 }
+// Patch the connection/login badges of the rendered bot cards in place. render() rebuilds
+// the whole panel (killing focus/scroll), so the auto-refresh below must never call it.
+function updateZaloHealthDom() {
+  const bots = state.install?.bots || [];
+  document.querySelectorAll('.bot-item[data-bot-id] .zalo-bot-health').forEach((wrap) => {
+    const id = wrap.closest('[data-bot-id]')?.dataset.botId;
+    const bot = bots.find((b) => b.id === id);
+    if (!bot) return;
+    const badges = zaloHealthBadges(bot);
+    const ems = wrap.querySelectorAll('em');
+    if (ems[0]) { ems[0].className = badges.connectionTone; ems[0].textContent = badges.connection; }
+    if (ems[1]) { ems[1].className = badges.loginTone; ems[1].textContent = badges.login; }
+  });
+}
+// Live status: poll the health endpoint while Zalo bots are on screen (the server caches
+// the ~3s CLI probe with a short TTL, so this stays cheap) and patch the badges in place —
+// no more pressing "Làm mới" to see a bot drop or come back.
+const ZALO_HEALTH_POLL_MS = 10000;
+let zaloHealthPollBusy = false;
+// Debounced instant refresh for log-visible state changes (login saved, container
+// restarted...) so the badges flip within ~2s instead of waiting out a poll tick.
+let zaloHealthRefreshTimer = null;
+function scheduleZaloHealthRefresh() {
+  if (zaloHealthRefreshTimer) return;
+  zaloHealthRefreshTimer = setTimeout(async () => {
+    zaloHealthRefreshTimer = null;
+    try { await loadZaloHealth(true); updateZaloHealthDom(); } catch (_) {}
+  }, 1500);
+}
+setInterval(async () => {
+  if (document.hidden || zaloHealthPollBusy) return;
+  if (!activeProjectDir()) return;
+  if (!document.querySelector('.bot-item[data-bot-id] .zalo-bot-health')) return;
+  zaloHealthPollBusy = true;
+  try { await loadZaloHealth(true); updateZaloHealthDom(); } finally { zaloHealthPollBusy = false; }
+}, ZALO_HEALTH_POLL_MS);
 async function loadFeatureFlags(silent=false){
   const botId=currentBotId();
   if (!activeProjectDir()) { state.featureFlags = {}; state.featureInstalled = {}; state.featureVersions = {}; if (!silent) render(); return; }
@@ -1784,6 +1841,7 @@ function appendLogLine(line) {
     });
     return;
   }
+  if (/\[zalo-connect\].*(login saved|listener (connected|start failed)|restarted|login failed|logged out)/i.test(line)) scheduleZaloHealthRefresh();
   const html = `<p>${escapeHtml(line)}</p>`;
   if (state.zaloLoginOpen || /\[zalo-connect\]|zalo|qr|login|scan/i.test(line)) {
     state.zaloLoginLines.push(cleanTerminalLine(line));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-openclaw-bot",
-  "version": "5.15.2",
+  "version": "5.16.0",
   "description": "Interactive CLI installer for OpenClaw Bot",
   "main": "dist/cli.js",
   "bin": {