create-openclaw-bot 5.16.3 → 5.16.5

package/README.md

@@ -7,7 +7,7 @@
 *Run one command → open the dashboard → your bot is live. Windows · macOS · Linux · VPS — Docker-powered, auto-installed for you.*
 
 <p align="center">
-  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.16.3-0EA5E9?style=for-the-badge" alt="Version 5.16.3" /></a>
+  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.16.5-0EA5E9?style=for-the-badge" alt="Version 5.16.5" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup?tab=MIT-1-ov-file"><img src="https://img.shields.io/badge/LICENSE-MIT-success?style=for-the-badge" alt="MIT License" /></a>
   <a href="https://www.npmjs.com/package/create-openclaw-bot"><img src="https://img.shields.io/npm/v/create-openclaw-bot?style=for-the-badge&label=CLI&color=2563EB&logo=npm&logoColor=white" alt="NPM Version" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup/stargazers"><img src="https://img.shields.io/github/stars/tuanminhhole/openclaw-setup?style=for-the-badge&color=eab308&logo=github&logoColor=white" alt="GitHub Stars" /></a>
@@ -37,15 +37,36 @@
 
 ---
 
-## 🆕 What's New in v5.16.3
+## 🆕 What's New in v5.16.5
+
+- 🩹 **Native installs on OpenClaw 2026.8 are smooth from the first run** - this wave patches the remaining chain of issues measured on fresh customer machines: generated configs pass the new strict checks 100%, install steps run in the right order, and restarts/plugin installs no longer get blocked midway.
+- 🔑 **9Router login works on Docker**: the new 9Router blocks the default password for "remote" access - and inside Docker every request counts as remote, so 123456 could never log in. It works now (still change the password once you're in).
+- 🧹 **Deleting a project fully removes the old 9Router**: it used to keep running in the background holding the port, silently forking the next install onto a different port - now removal is clean and reinstalls land on the standard port.
+- 🔌 **Native machines auto-install the web-search plugin** (DuckDuckGo) with its capability consent - no more boot loops over a missing nod.
+
+<details>
+<summary><b>Previous: What's new in v5.16.3</b></summary>
+
+- 🚑 **The big OpenClaw 2026.8.1 catch-up**: fresh installs run smoothly (Docker and native, Windows/macOS/Linux), and existing machines heal themselves on upgrade - stale config cleaned, data relocated, and the old file that could mute the bot retired automatically.
+- 🤖 **The bot stops claiming "I can't see the file"**: files sent through chat come with clear directions for the AI.
+- 🔁 **9Router comes back on its own** after a server reboot or UI maintenance.
+- 🔄 **The in-app "Update" button really updates** on standard server installs.
+- 🧭 **One setup build manages both generations** (2026.7 and 2026.8).
+
+</details>
+
+<details>
+<summary><b>Previous: What's new in v5.15.3</b></summary>
 
 - 🖥️ **"Control PC" — let the bot open Chrome & apps on your machine**: a new toggle on each bot card turns on the ability for the bot to open Chrome or an allow-listed app (TeamViewer, Zalo, …) on the computer running it. **Off by default**, token-gated, allow-list only, desktop-only.
 - 🌐 **Browsing works out of the box on every OS**: the bot drives your real Chrome on a desktop (your logged-in profile, so sites don't flag it) and starts its own headless Chromium on a server — no more "no browser available" just because Chrome wasn't running.
 
+</details>
+
 <details>
 <summary><b>Previous: What's new in v5.14.1</b></summary>
 
-- 🦞 **Zalo bots acknowledge your message with a reaction**: an icon lands on your message right away, so you can see the bot picked it up while the answer is still being written. It runs in the channel layer, so it **costs no tokens**. On by default for new Zalo bots; change or disable it via `messages.ackReaction` in `openclaw.json`. Needs Zalo Connect 3.0.15+.
+- 🦞 **Zalo bots react to acknowledge your message**: an icon appears on the message you just sent, so you know the bot received it while it is still writing the reply. Runs at the chat-channel layer, so it **costs no tokens**. On by default for new Zalo bots; change the icon or turn it off via `messages.ackReaction` in `openclaw.json`. Needs Zalo Connect 3.0.15+.
 
 </details>
 

package/README.vi.md

@@ -7,7 +7,7 @@
 *Chạy một lệnh → mở dashboard → bot lên sóng. Windows · macOS · Linux · VPS — chạy trên Docker, tự cài giúp bạn.*
 
 <p align="center">
-  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.16.3-0EA5E9?style=for-the-badge" alt="Version 5.16.3" /></a>
+  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.16.5-0EA5E9?style=for-the-badge" alt="Version 5.16.5" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup?tab=MIT-1-ov-file"><img src="https://img.shields.io/badge/LICENSE-MIT-success?style=for-the-badge" alt="MIT License" /></a>
   <a href="https://www.npmjs.com/package/create-openclaw-bot"><img src="https://img.shields.io/npm/v/create-openclaw-bot?style=for-the-badge&label=CLI&color=2563EB&logo=npm&logoColor=white" alt="NPM Version" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup/stargazers"><img src="https://img.shields.io/github/stars/tuanminhhole/openclaw-setup?style=for-the-badge&color=eab308&logo=github&logoColor=white" alt="GitHub Stars" /></a>
@@ -37,11 +37,32 @@
 
 ---
 
-## 🆕 Có gì mới trong v5.16.3
+## 🆕 Có gì mới trong v5.16.5
+
+- 🩹 **Cài native trên OpenClaw 2026.8 mượt từ phát đầu** - đợt này vá nốt chuỗi lỗi đo được khi dựng máy khách mới: cấu hình sinh ra sạch 100% với bộ soát khắt khe của OpenClaw mới, các bước cài tự chạy đúng thứ tự, và mọi thao tác khởi động lại/cài plugin không còn bị chặn giữa chừng.
+- 🔑 **Đăng nhập 9Router hoạt động trên Docker**: bản 9Router mới chặn mật khẩu mặc định với truy cập "từ xa" - mà trong Docker thì mọi truy cập đều bị tính là từ xa, nên trước đây không cách nào vào được bằng 123456. Giờ đăng nhập bình thường (vào rồi vẫn nên đổi mật khẩu).
+- 🧹 **Xoá project gỡ sạch 9Router cũ**: trước đây 9Router cũ còn chạy ngầm giữ cổng, làm lần cài mới tự tách sang cổng khác mà không ai hay - giờ xoá là sạch, cài lại đúng cổng chuẩn.
+- 🔌 **Máy native tự cài đủ plugin tìm kiếm web** (DuckDuckGo) kèm xác nhận quyền - hết cảnh bot khởi động vòng lặp vì thiếu một cái gật đầu.
+
+<details>
+<summary><b>Trước đó: Có gì mới trong v5.16.3</b></summary>
+
+- 🚑 **Theo kịp OpenClaw 2026.8.1**: cài mới chạy mượt (đủ Docker lẫn native, Windows/macOS/Linux), máy cũ tự được chữa khi nâng cấp - tự dọn cấu hình lỗi thời, tự dời dữ liệu, tự gỡ file cũ từng khiến bot "câm".
+- 🤖 **Bot hết chối "không thấy file"**: file khách gửi qua chat được chỉ đường tận nơi cho AI.
+- 🔁 **9Router tự sống lại** sau khi máy chủ khởi động lại hay giao diện bảo trì.
+- 🔄 **Nút "Cập nhật" trong giao diện cập nhật thật** trên máy chủ cài kiểu chuẩn.
+- 🧭 **Một bản setup quản được cả máy đời cũ (2026.7) lẫn đời mới (2026.8)**.
+
+</details>
+
+<details>
+<summary><b>Trước đó: Có gì mới trong v5.15.3</b></summary>
 
 - 🖥️ **"Điều khiển máy" — cho bot mở Chrome & ứng dụng trên máy bạn**: nút mới trên thẻ mỗi bot, bật lên là bot mở được Chrome hoặc app trong danh sách cho phép (TeamViewer, Zalo, …) trên máy đang chạy bot. **Mặc định TẮT**, cần token, chỉ giới hạn danh sách bạn khai, chỉ dùng trên máy có màn hình.
 - 🌐 **Duyệt web chạy ngay trên mọi hệ điều hành**: máy để bàn thì bot dùng **Chrome thật** (profile đã đăng nhập, web ít nghi là bot), server thì tự mở Chromium headless — hết cảnh "không có trình duyệt" chỉ vì chưa mở Chrome.
 
+</details>
+
 <details>
 <summary><b>Trước đó: Có gì mới trong v5.14.1</b></summary>
 

package/dist/server/local-server.js

@@ -48,7 +48,11 @@ function specMajorMinor(spec) {
 }
 let hostOcMajorMinorCache = null;
 async function hostOpenclawMajorMinor() {
-  if (hostOcMajorMinorCache !== null) return hostOcMajorMinorCache;
+  // Cache only a REAL version: during bot creation this is first called before
+  // `npm i -g openclaw` has run, and caching that 0 forever made prepareNativeStateHome
+  // skip the 2026.8 state-home move — daemon install then failed with "non-default
+  // state dir" (measured on a fresh native install, 03/09/2026).
+  if (hostOcMajorMinorCache) return hostOcMajorMinorCache;
   const r = await runCapture('openclaw', ['--version'], { shell: false }).catch(() => null);
   hostOcMajorMinorCache = specMajorMinor(r && (r.stdout || r.stderr));
   return hostOcMajorMinorCache;
@@ -2939,7 +2943,20 @@ function migrationLeaseDeadline(text = '') {
 async function ocDaemon(projectDir, verb, extraArgs = []) {
   const args = ['daemon', verb, ...extraArgs];
   sendLog(`$ openclaw ${args.join(' ')}`);
-  const out = await runCapture('openclaw', args, { cwd: projectDir, env: nativeEnv(projectDir), shell: false, timeout: 120000 });
+  // openclaw 2026.8.x refuses EVERY `daemon *` verb (not just install) while OPENCLAW_HOME is
+  // set — "service management skipped: non-default state dir" (measured 03/09/2026: the
+  // post-plugin-install restart failed on a fresh native host). On the 2026.8 layout the
+  // state already lives at ~/.openclaw, so run daemon verbs with the plain account HOME and
+  // no OPENCLAW_* overrides; STOP even suggests --force for the operator gateway, so pass it.
+  let env = nativeEnv(projectDir);
+  if ((await hostOpenclawMajorMinor()) >= 202608) {
+    env = { ...env };
+    delete env.OPENCLAW_HOME;
+    delete env.OPENCLAW_STATE_DIR;
+    env.HOME = os.homedir();
+  }
+  if (verb === 'stop' && !extraArgs.includes('--force')) args.push('--force');
+  const out = await runCapture('openclaw', args, { cwd: projectDir, env, shell: false, timeout: 120000 });
   const text = `${out.stdout || ''}\n${out.stderr || ''}`;
   for (const line of text.split(/\r?\n/).map((l) => l.trimEnd()).filter(Boolean)) sendLog(line);
   return { ...out, text };
@@ -3274,6 +3291,10 @@ async function ensureNativePlugins(projectDir, { restart = false } = {}) {
   // actually declares the channel (mirrors docker-gen's `if (zaloBackend === 'zalo-connect')`).
   const wanted = new Set(['learning-memory']);
   if (cfg?.channels?.[ZALO_CHANNEL_ID] || cfg?.plugins?.entries?.[ZALO_PLUGIN_ID]) wanted.add(ZALO_PLUGIN_ID);
+  // openclaw >=2026.8 unbundled duckduckgo AND refuses to report ready while the config
+  // declares a plugin that lacks capability consent — the docker entrypoint ensures it,
+  // native must too (measured 03/09/2026: fresh install crash-looped on this).
+  if (cfg?.plugins?.entries?.duckduckgo) wanted.add('duckduckgo');
   const installed = [];
   for (const id of wanted) {
     const dir = join(projectDir, '.openclaw', 'extensions', id);
@@ -3492,12 +3513,13 @@ async function startNativeRuntime({ projectDir, osChoice = '', gatewayPort, rout
   // Plugins BEFORE the gateway's first boot — the container entrypoint installs them ahead of the
   // gateway for the same reason: a gateway that boots with its plugins already on disk loads them
   // straight away, needs no follow-up restart, and prints no "plugin not found" warnings.
-  await ensureNativePlugins(projectDir).catch((e) => sendLog(`[native] plugin bootstrap skipped: ${e.message}`));
-
-  // Config migrations BEFORE the first boot too — same ordering the container entrypoint uses
-  // (migrate, then start), so an adopted pre-existing project boots on the upgraded config.
+  // Config migrations FIRST: `openclaw plugins install` validates the config, so a config
+  // still carrying pre-2026.8 keys makes every plugin install fail before migrations ran
+  // (measured on a fresh native install, 03/09/2026 — learning-memory refused to install).
   await runNativeConfigMigrations(projectDir).catch(() => {});
 
+  await ensureNativePlugins(projectDir).catch((e) => sendLog(`[native] plugin bootstrap skipped: ${e.message}`));
+
   // Managed service = auto-restart (KeepAlive/Restart=always) and start-at-login, the native
   // equivalent of docker's `restart: always`. --force so re-running install updates the port.
   const env = nativeEnv(projectDir);
@@ -3544,6 +3566,13 @@ async function removeNativeRuntime(projectDir) {
   if (!isNativeProject(projectDir)) return false;
   const env = nativeEnv(projectDir);
   await run('openclaw', ['daemon', 'uninstall'], { cwd: projectDir, env }).catch((e) => sendLog(`[native] daemon uninstall: ${e.message}`));
+  // The 9router systemd unit has Restart=always: killing the listener alone brings it (or an
+  // orphaned child) back, the port stays busy, and the NEXT install silently forks off to a
+  // new router port that no ssh tunnel or oc-web table points at (measured 03/09/2026).
+  if (process.platform === 'linux') {
+    await run('systemctl', ['--user', 'disable', '--now', 'openclaw-9router.service'], {}).catch(() => {});
+    await run('systemctl', ['--user', 'disable', '--now', 'openclaw-9router-sync.service'], {}).catch(() => {});
+  }
   const routerPort = (readNativeMeta(projectDir) || {}).routerPort || NATIVE_DEFAULT_ROUTER_PORT;
   await killListenerOnPort(routerPort);
   return true;
@@ -6088,6 +6117,8 @@ const PLUGIN_NPM_SPEC = {
   // learning-memory ships on ClawHub as `openclaw-learning-memory` (manifest id is
   // `learning-memory`, used as the config key). Install by the full package spec.
   'learning-memory': 'clawhub:openclaw-learning-memory',
+  // duckduckgo is openclaw's own external plugin on npm, not a ClawHub package.
+  'duckduckgo': '@openclaw/duckduckgo-plugin',
 };
 const pluginInstallSpec = (id) => PLUGIN_NPM_SPEC[id] || `clawhub:${id}`;
 
@@ -6869,7 +6900,13 @@ async function handler(req, res, rootProjectDir) {
     if (url.pathname === '/api/setup/update' && req.method === 'POST') {
       const installerDir = resolve(__dirname, '../..');
       const isGit = existsSync(resolve(installerDir, '.git'));
-      const mode = isGit ? 'git' : 'github';
+      // npm -g install: the new-host template installs create-openclaw-bot globally and runs
+      // the UI as a systemd user service. Without its own branch this fell into the "github"
+      // relaunch path, which only restarted the OLD version (measured on vps_c-thu, 02/09/2026).
+      // npx installs also live under node_modules, so exclude the _npx cache explicitly.
+      const isNpx = /[\\/]_npx[\\/]/.test(installerDir);
+      const isGlobalNpm = !isGit && !isNpx && /[\\/]node_modules[\\/]create-openclaw-bot[\\/]?$/.test(installerDir);
+      const mode = isGit ? 'git' : (isGlobalNpm ? 'npm-global' : 'github');
       setImmediate(async () => {
         try {
           if (isGit) {
@@ -6883,6 +6920,11 @@ async function handler(req, res, rootProjectDir) {
               await run('npm', ['run', 'build'], { cwd: installerDir }).catch((e) =>
                 sendLog(`[update-setup] build skipped: ${e.message}`));
             }
+          } else if (isGlobalNpm) {
+            // Pull the latest from npm in place, then exit — the service manager (or the
+            // respawn path for a hand-run UI) relaunches onto the freshly installed dist.
+            sendLog('[update-setup] Global npm install detected — npm i -g create-openclaw-bot@latest…');
+            await run('npm', ['i', '-g', 'create-openclaw-bot@latest', '--no-audit', '--no-fund'], { cwd: installerDir });
           } else {
             // Ephemeral `npx github:…` install: nothing to pull in place — the relaunch
             // re-runs `npx github:…`, which fetches the latest from GitHub.

package/dist/setup/shared/bot-config-gen.js

@@ -141,7 +141,9 @@
           // and poisons the session until a manual reset. 12k chars (~3k tokens) per
           // result keeps per-source content substantial while making that runaway
           // impossible. Applies to persisted results + overflow recovery.
-          contextLimits: { toolResultMaxChars: 12000 },
+          // No contextLimits.toolResultMaxChars: openclaw 2026.8.x strict schema rejects the
+          // key outright (measured on a fresh native install, 03/09/2026) — the runaway-turn
+          // protection it provided is handled by the 2026.8 runtime itself.
           // Agent-TURN budget (seconds). 120 was too short for multi-step cloud turns (OCR +
           // file gen + tool calls). 900 = OpenClaw's own native default and the practical max
           // we use. This is the turn budget — a DIFFERENT layer from 9router's per-request

package/dist/setup/shared/docker-gen.js

@@ -562,6 +562,10 @@ ${indentBlock(docker9RouterEntrypointScript, 8)}
       - PORT=${routerPort}
       - HOSTNAME=0.0.0.0
       - CI=true
+      # 9router blocks the default password for "remote" access, and inside Docker every
+      # host request arrives via the bridge network, so it always counts as remote — without
+      # this the user can NEVER log in with the documented default (measured 02/09/2026).
+      - INITIAL_PASSWORD=123456
     volumes:
       - 9router-data:/root/.9router
       - ./sync.js:/tmp/sync.js:ro
@@ -656,6 +660,10 @@ ${indentBlock(docker9RouterEntrypointScript, 8)}
       - PORT=${routerPort}
       - HOSTNAME=0.0.0.0
       - CI=true
+      # 9router blocks the default password for "remote" access, and inside Docker every
+      # host request arrives via the bridge network, so it always counts as remote — without
+      # this the user can NEVER log in with the documented default (measured 02/09/2026).
+      - INITIAL_PASSWORD=123456
     volumes:
       - 9router-data:/root/.9router
       - ./sync.js:/tmp/sync.js:ro

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-openclaw-bot",
-  "version": "5.16.3",
+  "version": "5.16.5",
   "description": "Interactive CLI installer for OpenClaw Bot",
   "main": "dist/cli.js",
   "bin": {