create-openclaw-bot 5.16.4 → 5.16.6

package/README.md

@@ -7,7 +7,7 @@
 *Run one command → open the dashboard → your bot is live. Windows · macOS · Linux · VPS — Docker-powered, auto-installed for you.*
 
 <p align="center">
-  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.16.4-0EA5E9?style=for-the-badge" alt="Version 5.16.4" /></a>
+  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.16.6-0EA5E9?style=for-the-badge" alt="Version 5.16.6" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup?tab=MIT-1-ov-file"><img src="https://img.shields.io/badge/LICENSE-MIT-success?style=for-the-badge" alt="MIT License" /></a>
   <a href="https://www.npmjs.com/package/create-openclaw-bot"><img src="https://img.shields.io/npm/v/create-openclaw-bot?style=for-the-badge&label=CLI&color=2563EB&logo=npm&logoColor=white" alt="NPM Version" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup/stargazers"><img src="https://img.shields.io/github/stars/tuanminhhole/openclaw-setup?style=for-the-badge&color=eab308&logo=github&logoColor=white" alt="GitHub Stars" /></a>
@@ -37,13 +37,23 @@
 
 ---
 
-## 🆕 What's New in v5.16.4
+## 🆕 What's New in v5.16.6
 
-- 🚑 **The big OpenClaw 2026.8.1 catch-up — the old setup had gone stale; this wave heals it all in one pass.** OpenClaw (the platform the bots run on) shipped a major upgrade and changed the rules: configs are strictly checked, data moved to a new home, several install commands were renamed. With the old setup that meant fresh installs could stall, running bots suddenly went **silent**, and the admin screen showed **0 bots** while the bot was alive. As of 5.16.3–5.16.4: fresh installs run smoothly on 2026.8.1 (Docker and native, Windows/macOS/Linux), and **existing machines heal themselves on upgrade** — stale config cleaned, data relocated, and the old file that could mute the bot retired automatically.
-- 🤖 **The bot stops claiming "I can't see the file"**: files sent through chat now come with clear directions for the AI — even weaker models find them.
-- 🔁 **9Router (the AI model router) comes back on its own** after a server reboot or UI maintenance — previously it could die silently and the bot lost its brain.
-- 🔄 **The in-app "Update" button really updates now**: on standard server installs it used to just restart the old version while reporting success — now it pulls the latest and relaunches itself.
-- 🧭 **One setup build manages both generations** (2026.7 and 2026.8) — renamed commands are tried the new way first with an automatic fallback, so nobody is forced to upgrade overnight.
+- 🩹 **Native installs on OpenClaw 2026.8 are smooth from the first run** - this wave patches the remaining chain of issues measured on fresh customer machines: generated configs pass the new strict checks 100%, install steps run in the right order, and restarts/plugin installs no longer get blocked midway.
+- 🔑 **9Router login works on Docker**: the new 9Router blocks the default password for "remote" access - and inside Docker every request counts as remote, so 123456 could never log in. It works now (still change the password once you're in).
+- 🧹 **Deleting a project fully removes the old 9Router**: it used to keep running in the background holding the port, silently forking the next install onto a different port - now removal is clean and reinstalls land on the standard port.
+- 🔌 **Native machines auto-install the web-search plugin** (DuckDuckGo) with its capability consent - no more boot loops over a missing nod.
+
+<details>
+<summary><b>Previous: What's new in v5.16.3</b></summary>
+
+- 🚑 **The big OpenClaw 2026.8.1 catch-up**: fresh installs run smoothly (Docker and native, Windows/macOS/Linux), and existing machines heal themselves on upgrade - stale config cleaned, data relocated, and the old file that could mute the bot retired automatically.
+- 🤖 **The bot stops claiming "I can't see the file"**: files sent through chat come with clear directions for the AI.
+- 🔁 **9Router comes back on its own** after a server reboot or UI maintenance.
+- 🔄 **The in-app "Update" button really updates** on standard server installs.
+- 🧭 **One setup build manages both generations** (2026.7 and 2026.8).
+
+</details>
 
 <details>
 <summary><b>Previous: What's new in v5.15.3</b></summary>

package/README.vi.md

@@ -7,7 +7,7 @@
 *Chạy một lệnh → mở dashboard → bot lên sóng. Windows · macOS · Linux · VPS — chạy trên Docker, tự cài giúp bạn.*
 
 <p align="center">
-  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.16.4-0EA5E9?style=for-the-badge" alt="Version 5.16.4" /></a>
+  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.16.6-0EA5E9?style=for-the-badge" alt="Version 5.16.6" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup?tab=MIT-1-ov-file"><img src="https://img.shields.io/badge/LICENSE-MIT-success?style=for-the-badge" alt="MIT License" /></a>
   <a href="https://www.npmjs.com/package/create-openclaw-bot"><img src="https://img.shields.io/npm/v/create-openclaw-bot?style=for-the-badge&label=CLI&color=2563EB&logo=npm&logoColor=white" alt="NPM Version" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup/stargazers"><img src="https://img.shields.io/github/stars/tuanminhhole/openclaw-setup?style=for-the-badge&color=eab308&logo=github&logoColor=white" alt="GitHub Stars" /></a>
@@ -37,13 +37,23 @@
 
 ---
 
-## 🆕 Có gì mới trong v5.16.4
+## 🆕 Có gì mới trong v5.16.6
 
-- 🚑 **Theo kịp OpenClaw 2026.8.1 — bản setup cũ đã lỗi thời, đợt này chữa hết một lượt.** OpenClaw (nền tảng chạy bot) nâng cấp lớn và đổi nhiều "luật chơi": file cấu hình bị soát khắt khe hơn, chỗ lưu dữ liệu dời đi, vài lệnh cài đặt đổi tên. Với bản setup cũ, hệ quả là cài bot mới có thể đứng giữa chừng, bot đang chạy bỗng **im lặng không trả lời**, màn hình quản trị hiện **0 bot** dù bot vẫn sống. Từ 5.16.3–5.16.4: cài mới chạy mượt trên 2026.8.1 (đủ Docker lẫn native, Windows/macOS/Linux), **máy cũ tự được chữa khi nâng cấp** — tự dọn cấu hình lỗi thời, tự dời dữ liệu, tự gỡ file cũ từng khiến bot "câm".
-- 🤖 **Bot hết chối "không thấy file"**: file khách gửi qua chat giờ được chỉ đường tận nơi cho AI — kể cả model yếu cũng tìm được.
-- 🔁 **9Router (bộ định tuyến model AI) tự sống lại** sau khi máy chủ khởi động lại hay giao diện bảo trì — trước đây nó có thể chết im mà không ai hay, bot mất não.
-- 🔄 **Nút "Cập nhật" trong giao diện giờ cập nhật thật**: trên máy chủ cài kiểu chuẩn, trước đây nút chỉ khởi động lại bản cũ mà vẫn báo thành công — giờ bấm là setup tự kéo bản mới về rồi tự khởi động lại.
-- 🧭 **Một bản setup quản được cả máy đời cũ (2026.7) lẫn đời mới (2026.8)** — lệnh nào openclaw đổi tên thì setup tự thử tên mới rồi lùi về tên cũ, không bắt khách nâng cấp gấp.
+- 🩹 **Cài native trên OpenClaw 2026.8 mượt từ phát đầu** - đợt này vá nốt chuỗi lỗi đo được khi dựng máy khách mới: cấu hình sinh ra sạch 100% với bộ soát khắt khe của OpenClaw mới, các bước cài tự chạy đúng thứ tự, và mọi thao tác khởi động lại/cài plugin không còn bị chặn giữa chừng.
+- 🔑 **Đăng nhập 9Router hoạt động trên Docker**: bản 9Router mới chặn mật khẩu mặc định với truy cập "từ xa" - mà trong Docker thì mọi truy cập đều bị tính là từ xa, nên trước đây không cách nào vào được bằng 123456. Giờ đăng nhập bình thường (vào rồi vẫn nên đổi mật khẩu).
+- 🧹 **Xoá project gỡ sạch 9Router cũ**: trước đây 9Router cũ còn chạy ngầm giữ cổng, làm lần cài mới tự tách sang cổng khác mà không ai hay - giờ xoá là sạch, cài lại đúng cổng chuẩn.
+- 🔌 **Máy native tự cài đủ plugin tìm kiếm web** (DuckDuckGo) kèm xác nhận quyền - hết cảnh bot khởi động vòng lặp vì thiếu một cái gật đầu.
+
+<details>
+<summary><b>Trước đó: Có gì mới trong v5.16.3</b></summary>
+
+- 🚑 **Theo kịp OpenClaw 2026.8.1**: cài mới chạy mượt (đủ Docker lẫn native, Windows/macOS/Linux), máy cũ tự được chữa khi nâng cấp - tự dọn cấu hình lỗi thời, tự dời dữ liệu, tự gỡ file cũ từng khiến bot "câm".
+- 🤖 **Bot hết chối "không thấy file"**: file khách gửi qua chat được chỉ đường tận nơi cho AI.
+- 🔁 **9Router tự sống lại** sau khi máy chủ khởi động lại hay giao diện bảo trì.
+- 🔄 **Nút "Cập nhật" trong giao diện cập nhật thật** trên máy chủ cài kiểu chuẩn.
+- 🧭 **Một bản setup quản được cả máy đời cũ (2026.7) lẫn đời mới (2026.8)**.
+
+</details>
 
 <details>
 <summary><b>Trước đó: Có gì mới trong v5.15.3</b></summary>

package/dist/server/local-server.js

@@ -48,7 +48,11 @@ function specMajorMinor(spec) {
 }
 let hostOcMajorMinorCache = null;
 async function hostOpenclawMajorMinor() {
-  if (hostOcMajorMinorCache !== null) return hostOcMajorMinorCache;
+  // Cache only a REAL version: during bot creation this is first called before
+  // `npm i -g openclaw` has run, and caching that 0 forever made prepareNativeStateHome
+  // skip the 2026.8 state-home move — daemon install then failed with "non-default
+  // state dir" (measured on a fresh native install, 03/09/2026).
+  if (hostOcMajorMinorCache) return hostOcMajorMinorCache;
   const r = await runCapture('openclaw', ['--version'], { shell: false }).catch(() => null);
   hostOcMajorMinorCache = specMajorMinor(r && (r.stdout || r.stderr));
   return hostOcMajorMinorCache;
@@ -1790,6 +1794,22 @@ function bindingChannelId(channel = '') {
   return channel;
 }
 
+// OpenClaw ≥2026.8 materialises a DEFAULT agent `main` ("Trợ lý OpenClaw") the first time a
+// gateway boots against a roster it considers empty — which is exactly what happens in Docker
+// mode, where `docker compose up` runs while the project still has zero bots (writeCoreProject
+// seeds agents with an empty list). The entry is legitimate OpenClaw state and is left alone in
+// openclaw.json, but it is NOT a bot the operator created: showing it next to the real bot made
+// customers think a second Zalo bot appeared out of nowhere (measured on vps_tracy-hong, 03/09).
+//
+// Identified by disk, not by name: every bot this setup creates gets `workspace` in the config
+// AND that directory on disk. The materialised default has neither, so an operator who really
+// does name their bot `main` is never hidden.
+function isPhantomMainAgent(agent, projectDir, agentCount) {
+  if (!agent || agent.id !== 'main' || agentCount < 2) return false;
+  if (!agent.workspace) return true;
+  return !existsSync(join(projectDir, agent.workspace));
+}
+
 async function listConfiguredBots(projectDir) {
   const cfgPath = join(projectDir || '', '.openclaw', 'openclaw.json');
   if (!projectDir || !existsSync(cfgPath)) return [];
@@ -1797,7 +1817,8 @@ async function listConfiguredBots(projectDir) {
   const cfg = ensureConfigShape(parseJsonText(raw));
   const normalized = JSON.stringify(cfg, null, 2) + '\n';
   if (normalized !== raw) await fsp.writeFile(cfgPath, normalized, 'utf8');
-  const rows = await Promise.all(cfg.agents.list.map(async (agent) => {
+  const roster = cfg.agents.list.filter((agent) => !isPhantomMainAgent(agent, projectDir, cfg.agents.list.length));
+  const rows = await Promise.all(roster.map(async (agent) => {
     const identity = await readAgentIdentity(projectDir, agent);
     const meta = await readBotMeta(projectDir, agent, cfg);
     const env = await readProjectEnv(projectDir);
@@ -2391,10 +2412,32 @@ async function startZaloLogin(projectDir, agentId = "") {
   probeCacheClear(`zalohealth:${projectDir || ''}`);
   const cfgPath = join(projectDir, ".openclaw", "openclaw.json");
   if (!existsSync(cfgPath)) throw httpError(404, "openclaw.json not found");
-  const cfg = JSON.parse(await fsp.readFile(cfgPath, "utf8"));
-  const binding = (cfg.bindings || []).find((b) =>
+  const raw = await fsp.readFile(cfgPath, "utf8");
+  const cfg = ensureConfigShape(parseJsonText(raw));
+  let binding = (cfg.bindings || []).find((b) =>
     (!agentId || b.agentId === agentId) && b.match?.channel === "zalo-connect"
   );
+  // A roster with more than one agent makes OpenClaw ≥2026.8 refuse any channel operation that
+  // cannot name its owner: `AgentSelectionRequiredError — Multiple agents are configured, but
+  // this operation has no explicit owner`. That is exactly what a Docker project looks like once
+  // the gateway has materialised its default `main` agent alongside the real bot, and the QR
+  // login dies with it (measured on vps_tracy-hong, 03/09).
+  //
+  // `openclaw channels login` has no --agent flag (2026.8.1: only --channel/--account/--verbose),
+  // and neither does the channels.start call it makes into the gateway — so the owner can only be
+  // named the way OpenClaw's own error hint says: through a binding. Pin one to the real bot
+  // before the QR starts. Additive: an existing binding is never rewritten, and the phantom
+  // `main` is never the target.
+  if (!binding) {
+    const roster = (cfg.agents.list || []).filter((a) => !isPhantomMainAgent(a, projectDir, (cfg.agents.list || []).length));
+    const target = (agentId && roster.some((a) => a.id === agentId)) ? agentId : roster[0]?.id;
+    if (target) {
+      binding = { agentId: target, match: { channel: 'zalo-connect', accountId: 'default' } };
+      cfg.bindings = [...(cfg.bindings || []), binding];
+      await fsp.writeFile(cfgPath, JSON.stringify(cfg, null, 2) + '\n', 'utf8');
+      sendLog(`[zalo-connect] No zalo-connect binding found — pinned this QR login to agent [${target}] so OpenClaw knows who owns the channel.`);
+    }
+  }
   return startZaloConnectLogin(projectDir, binding?.match?.accountId || "default");
 }
 
@@ -2939,7 +2982,20 @@ function migrationLeaseDeadline(text = '') {
 async function ocDaemon(projectDir, verb, extraArgs = []) {
   const args = ['daemon', verb, ...extraArgs];
   sendLog(`$ openclaw ${args.join(' ')}`);
-  const out = await runCapture('openclaw', args, { cwd: projectDir, env: nativeEnv(projectDir), shell: false, timeout: 120000 });
+  // openclaw 2026.8.x refuses EVERY `daemon *` verb (not just install) while OPENCLAW_HOME is
+  // set — "service management skipped: non-default state dir" (measured 03/09/2026: the
+  // post-plugin-install restart failed on a fresh native host). On the 2026.8 layout the
+  // state already lives at ~/.openclaw, so run daemon verbs with the plain account HOME and
+  // no OPENCLAW_* overrides; STOP even suggests --force for the operator gateway, so pass it.
+  let env = nativeEnv(projectDir);
+  if ((await hostOpenclawMajorMinor()) >= 202608) {
+    env = { ...env };
+    delete env.OPENCLAW_HOME;
+    delete env.OPENCLAW_STATE_DIR;
+    env.HOME = os.homedir();
+  }
+  if (verb === 'stop' && !extraArgs.includes('--force')) args.push('--force');
+  const out = await runCapture('openclaw', args, { cwd: projectDir, env, shell: false, timeout: 120000 });
   const text = `${out.stdout || ''}\n${out.stderr || ''}`;
   for (const line of text.split(/\r?\n/).map((l) => l.trimEnd()).filter(Boolean)) sendLog(line);
   return { ...out, text };
@@ -3274,6 +3330,10 @@ async function ensureNativePlugins(projectDir, { restart = false } = {}) {
   // actually declares the channel (mirrors docker-gen's `if (zaloBackend === 'zalo-connect')`).
   const wanted = new Set(['learning-memory']);
   if (cfg?.channels?.[ZALO_CHANNEL_ID] || cfg?.plugins?.entries?.[ZALO_PLUGIN_ID]) wanted.add(ZALO_PLUGIN_ID);
+  // openclaw >=2026.8 unbundled duckduckgo AND refuses to report ready while the config
+  // declares a plugin that lacks capability consent — the docker entrypoint ensures it,
+  // native must too (measured 03/09/2026: fresh install crash-looped on this).
+  if (cfg?.plugins?.entries?.duckduckgo) wanted.add('duckduckgo');
   const installed = [];
   for (const id of wanted) {
     const dir = join(projectDir, '.openclaw', 'extensions', id);
@@ -3492,12 +3552,13 @@ async function startNativeRuntime({ projectDir, osChoice = '', gatewayPort, rout
   // Plugins BEFORE the gateway's first boot — the container entrypoint installs them ahead of the
   // gateway for the same reason: a gateway that boots with its plugins already on disk loads them
   // straight away, needs no follow-up restart, and prints no "plugin not found" warnings.
-  await ensureNativePlugins(projectDir).catch((e) => sendLog(`[native] plugin bootstrap skipped: ${e.message}`));
-
-  // Config migrations BEFORE the first boot too — same ordering the container entrypoint uses
-  // (migrate, then start), so an adopted pre-existing project boots on the upgraded config.
+  // Config migrations FIRST: `openclaw plugins install` validates the config, so a config
+  // still carrying pre-2026.8 keys makes every plugin install fail before migrations ran
+  // (measured on a fresh native install, 03/09/2026 — learning-memory refused to install).
   await runNativeConfigMigrations(projectDir).catch(() => {});
 
+  await ensureNativePlugins(projectDir).catch((e) => sendLog(`[native] plugin bootstrap skipped: ${e.message}`));
+
   // Managed service = auto-restart (KeepAlive/Restart=always) and start-at-login, the native
   // equivalent of docker's `restart: always`. --force so re-running install updates the port.
   const env = nativeEnv(projectDir);
@@ -3544,6 +3605,13 @@ async function removeNativeRuntime(projectDir) {
   if (!isNativeProject(projectDir)) return false;
   const env = nativeEnv(projectDir);
   await run('openclaw', ['daemon', 'uninstall'], { cwd: projectDir, env }).catch((e) => sendLog(`[native] daemon uninstall: ${e.message}`));
+  // The 9router systemd unit has Restart=always: killing the listener alone brings it (or an
+  // orphaned child) back, the port stays busy, and the NEXT install silently forks off to a
+  // new router port that no ssh tunnel or oc-web table points at (measured 03/09/2026).
+  if (process.platform === 'linux') {
+    await run('systemctl', ['--user', 'disable', '--now', 'openclaw-9router.service'], {}).catch(() => {});
+    await run('systemctl', ['--user', 'disable', '--now', 'openclaw-9router-sync.service'], {}).catch(() => {});
+  }
   const routerPort = (readNativeMeta(projectDir) || {}).routerPort || NATIVE_DEFAULT_ROUTER_PORT;
   await killListenerOnPort(routerPort);
   return true;
@@ -6088,6 +6156,8 @@ const PLUGIN_NPM_SPEC = {
   // learning-memory ships on ClawHub as `openclaw-learning-memory` (manifest id is
   // `learning-memory`, used as the config key). Install by the full package spec.
   'learning-memory': 'clawhub:openclaw-learning-memory',
+  // duckduckgo is openclaw's own external plugin on npm, not a ClawHub package.
+  'duckduckgo': '@openclaw/duckduckgo-plugin',
 };
 const pluginInstallSpec = (id) => PLUGIN_NPM_SPEC[id] || `clawhub:${id}`;
 

package/dist/setup/shared/bot-config-gen.js

@@ -141,7 +141,9 @@
           // and poisons the session until a manual reset. 12k chars (~3k tokens) per
           // result keeps per-source content substantial while making that runaway
           // impossible. Applies to persisted results + overflow recovery.
-          contextLimits: { toolResultMaxChars: 12000 },
+          // No contextLimits.toolResultMaxChars: openclaw 2026.8.x strict schema rejects the
+          // key outright (measured on a fresh native install, 03/09/2026) — the runaway-turn
+          // protection it provided is handled by the 2026.8 runtime itself.
           // Agent-TURN budget (seconds). 120 was too short for multi-step cloud turns (OCR +
           // file gen + tool calls). 900 = OpenClaw's own native default and the practical max
           // we use. This is the turn budget — a DIFFERENT layer from 9router's per-request
@@ -194,13 +196,15 @@
     // arbitrary emoji globally would make those channels reject every ack, so other
     // channels keep their existing behaviour until someone picks a value valid there.
     //
-    // 🦞 is sent as a Zalo *custom* reaction (emoji as rIcon + a hash as rType), which
-    // needs zalo-connect ≥3.0.15 — earlier versions only knew the 55 built-ins and would
-    // drop it silently. Scope "all" covers DMs and groups; in a mention-gated group the
-    // plugin still only reacts to messages that address the bot, since non-addressed ones
-    // are buffered as passive context before the reaction step.
+    // `/-heart` is one of Zalo's 55 BUILT-IN reactions, so every zalo-connect version can
+    // send it. The previous default (🦞) went out as a Zalo *custom* reaction (emoji as
+    // rIcon + a hash as rType), which needs zalo-connect ≥3.0.15 — on anything older it was
+    // dropped silently and the bot looked unresponsive until the reply landed.
+    // Scope "all" covers DMs and groups; in a mention-gated group the plugin still only
+    // reacts to messages that address the bot, since non-addressed ones are buffered as
+    // passive context before the reaction step.
     if (isZaloPersonal(channelKey)) {
-      cfg.messages = { ackReaction: '🦞', ackReactionScope: 'all', removeAckAfterReply: false };
+      cfg.messages = { ackReaction: '/-heart', ackReactionScope: 'all', removeAckAfterReply: false };
     }
 
     // ── commands ──────────────────────────────────────────────────────────────

package/dist/setup/shared/docker-gen.js

@@ -382,8 +382,11 @@ if(touched){console.log('[patch-9router] Applied Codex compatibility patch.');}e
       // seeded. Kept out of the shared migration because zalo-connect reads the GLOBAL
       // messages.ackReaction, and that same key also feeds Telegram/Discord/Slack/
       // WhatsApp — which accept only their own fixed reaction sets and would reject an
-      // arbitrary emoji. Absent-only, so an operator's own choice is never overwritten.
-      const ackReactionScript = `const fs=require('fs'),path=require('path');const p=path.join(process.cwd(),'.openclaw','openclaw.json');if(fs.existsSync(p)){const c=JSON.parse(fs.readFileSync(p,'utf8'));let ch=false;c.messages=c.messages||{};if(c.messages.ackReaction===undefined){c.messages.ackReaction='🦞';ch=true;}if(c.messages.ackReactionScope===undefined){c.messages.ackReactionScope='all';ch=true;}if(ch)fs.writeFileSync(p,JSON.stringify(c,null,2));}`;
+      // arbitrary emoji. Absent-only, so an operator's own choice is never overwritten —
+      // with one exception: the 🦞 this script itself used to seed is rewritten to
+      // `/-heart`. 🦞 only ships as a Zalo CUSTOM reaction (needs zalo-connect ≥3.0.15,
+      // silently dropped below that); `/-heart` is a built-in every version can send.
+      const ackReactionScript = `const fs=require('fs'),path=require('path');const p=path.join(process.cwd(),'.openclaw','openclaw.json');if(fs.existsSync(p)){const c=JSON.parse(fs.readFileSync(p,'utf8'));let ch=false;c.messages=c.messages||{};if(c.messages.ackReaction===undefined||c.messages.ackReaction==='🦞'){c.messages.ackReaction='/-heart';ch=true;}if(c.messages.ackReactionScope===undefined){c.messages.ackReactionScope='all';ch=true;}if(ch)fs.writeFileSync(p,JSON.stringify(c,null,2));}`;
       runtimeParts.push(`node - <<'NODE'\n${ackReactionScript}\nNODE`);
     }
     // Always-on memory context engine for every bot (see bot-config-gen: plugins.slots
@@ -562,6 +565,10 @@ ${indentBlock(docker9RouterEntrypointScript, 8)}
       - PORT=${routerPort}
       - HOSTNAME=0.0.0.0
       - CI=true
+      # 9router blocks the default password for "remote" access, and inside Docker every
+      # host request arrives via the bridge network, so it always counts as remote — without
+      # this the user can NEVER log in with the documented default (measured 02/09/2026).
+      - INITIAL_PASSWORD=123456
     volumes:
       - 9router-data:/root/.9router
       - ./sync.js:/tmp/sync.js:ro
@@ -656,6 +663,10 @@ ${indentBlock(docker9RouterEntrypointScript, 8)}
       - PORT=${routerPort}
       - HOSTNAME=0.0.0.0
       - CI=true
+      # 9router blocks the default password for "remote" access, and inside Docker every
+      # host request arrives via the bridge network, so it always counts as remote — without
+      # this the user can NEVER log in with the documented default (measured 02/09/2026).
+      - INITIAL_PASSWORD=123456
     volumes:
       - 9router-data:/root/.9router
       - ./sync.js:/tmp/sync.js:ro

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-openclaw-bot",
-  "version": "5.16.4",
+  "version": "5.16.6",
   "description": "Interactive CLI installer for OpenClaw Bot",
   "main": "dist/cli.js",
   "bin": {