create-openclaw-bot 5.16.5 → 5.16.6

package/README.md

@@ -7,7 +7,7 @@
 *Run one command → open the dashboard → your bot is live. Windows · macOS · Linux · VPS — Docker-powered, auto-installed for you.*
 
 <p align="center">
-  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.16.5-0EA5E9?style=for-the-badge" alt="Version 5.16.5" /></a>
+  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.16.6-0EA5E9?style=for-the-badge" alt="Version 5.16.6" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup?tab=MIT-1-ov-file"><img src="https://img.shields.io/badge/LICENSE-MIT-success?style=for-the-badge" alt="MIT License" /></a>
   <a href="https://www.npmjs.com/package/create-openclaw-bot"><img src="https://img.shields.io/npm/v/create-openclaw-bot?style=for-the-badge&label=CLI&color=2563EB&logo=npm&logoColor=white" alt="NPM Version" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup/stargazers"><img src="https://img.shields.io/github/stars/tuanminhhole/openclaw-setup?style=for-the-badge&color=eab308&logo=github&logoColor=white" alt="GitHub Stars" /></a>
@@ -37,7 +37,7 @@
 
 ---
 
-## 🆕 What's New in v5.16.5
+## 🆕 What's New in v5.16.6
 
 - 🩹 **Native installs on OpenClaw 2026.8 are smooth from the first run** - this wave patches the remaining chain of issues measured on fresh customer machines: generated configs pass the new strict checks 100%, install steps run in the right order, and restarts/plugin installs no longer get blocked midway.
 - 🔑 **9Router login works on Docker**: the new 9Router blocks the default password for "remote" access - and inside Docker every request counts as remote, so 123456 could never log in. It works now (still change the password once you're in).

package/README.vi.md

@@ -7,7 +7,7 @@
 *Chạy một lệnh → mở dashboard → bot lên sóng. Windows · macOS · Linux · VPS — chạy trên Docker, tự cài giúp bạn.*
 
 <p align="center">
-  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.16.5-0EA5E9?style=for-the-badge" alt="Version 5.16.5" /></a>
+  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.16.6-0EA5E9?style=for-the-badge" alt="Version 5.16.6" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup?tab=MIT-1-ov-file"><img src="https://img.shields.io/badge/LICENSE-MIT-success?style=for-the-badge" alt="MIT License" /></a>
   <a href="https://www.npmjs.com/package/create-openclaw-bot"><img src="https://img.shields.io/npm/v/create-openclaw-bot?style=for-the-badge&label=CLI&color=2563EB&logo=npm&logoColor=white" alt="NPM Version" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup/stargazers"><img src="https://img.shields.io/github/stars/tuanminhhole/openclaw-setup?style=for-the-badge&color=eab308&logo=github&logoColor=white" alt="GitHub Stars" /></a>
@@ -37,7 +37,7 @@
 
 ---
 
-## 🆕 Có gì mới trong v5.16.5
+## 🆕 Có gì mới trong v5.16.6
 
 - 🩹 **Cài native trên OpenClaw 2026.8 mượt từ phát đầu** - đợt này vá nốt chuỗi lỗi đo được khi dựng máy khách mới: cấu hình sinh ra sạch 100% với bộ soát khắt khe của OpenClaw mới, các bước cài tự chạy đúng thứ tự, và mọi thao tác khởi động lại/cài plugin không còn bị chặn giữa chừng.
 - 🔑 **Đăng nhập 9Router hoạt động trên Docker**: bản 9Router mới chặn mật khẩu mặc định với truy cập "từ xa" - mà trong Docker thì mọi truy cập đều bị tính là từ xa, nên trước đây không cách nào vào được bằng 123456. Giờ đăng nhập bình thường (vào rồi vẫn nên đổi mật khẩu).

package/dist/server/local-server.js

@@ -1794,6 +1794,22 @@ function bindingChannelId(channel = '') {
   return channel;
 }
 
+// OpenClaw ≥2026.8 materialises a DEFAULT agent `main` ("Trợ lý OpenClaw") the first time a
+// gateway boots against a roster it considers empty — which is exactly what happens in Docker
+// mode, where `docker compose up` runs while the project still has zero bots (writeCoreProject
+// seeds agents with an empty list). The entry is legitimate OpenClaw state and is left alone in
+// openclaw.json, but it is NOT a bot the operator created: showing it next to the real bot made
+// customers think a second Zalo bot appeared out of nowhere (measured on vps_tracy-hong, 03/09).
+//
+// Identified by disk, not by name: every bot this setup creates gets `workspace` in the config
+// AND that directory on disk. The materialised default has neither, so an operator who really
+// does name their bot `main` is never hidden.
+function isPhantomMainAgent(agent, projectDir, agentCount) {
+  if (!agent || agent.id !== 'main' || agentCount < 2) return false;
+  if (!agent.workspace) return true;
+  return !existsSync(join(projectDir, agent.workspace));
+}
+
 async function listConfiguredBots(projectDir) {
   const cfgPath = join(projectDir || '', '.openclaw', 'openclaw.json');
   if (!projectDir || !existsSync(cfgPath)) return [];
@@ -1801,7 +1817,8 @@ async function listConfiguredBots(projectDir) {
   const cfg = ensureConfigShape(parseJsonText(raw));
   const normalized = JSON.stringify(cfg, null, 2) + '\n';
   if (normalized !== raw) await fsp.writeFile(cfgPath, normalized, 'utf8');
-  const rows = await Promise.all(cfg.agents.list.map(async (agent) => {
+  const roster = cfg.agents.list.filter((agent) => !isPhantomMainAgent(agent, projectDir, cfg.agents.list.length));
+  const rows = await Promise.all(roster.map(async (agent) => {
     const identity = await readAgentIdentity(projectDir, agent);
     const meta = await readBotMeta(projectDir, agent, cfg);
     const env = await readProjectEnv(projectDir);
@@ -2395,10 +2412,32 @@ async function startZaloLogin(projectDir, agentId = "") {
   probeCacheClear(`zalohealth:${projectDir || ''}`);
   const cfgPath = join(projectDir, ".openclaw", "openclaw.json");
   if (!existsSync(cfgPath)) throw httpError(404, "openclaw.json not found");
-  const cfg = JSON.parse(await fsp.readFile(cfgPath, "utf8"));
-  const binding = (cfg.bindings || []).find((b) =>
+  const raw = await fsp.readFile(cfgPath, "utf8");
+  const cfg = ensureConfigShape(parseJsonText(raw));
+  let binding = (cfg.bindings || []).find((b) =>
     (!agentId || b.agentId === agentId) && b.match?.channel === "zalo-connect"
   );
+  // A roster with more than one agent makes OpenClaw ≥2026.8 refuse any channel operation that
+  // cannot name its owner: `AgentSelectionRequiredError — Multiple agents are configured, but
+  // this operation has no explicit owner`. That is exactly what a Docker project looks like once
+  // the gateway has materialised its default `main` agent alongside the real bot, and the QR
+  // login dies with it (measured on vps_tracy-hong, 03/09).
+  //
+  // `openclaw channels login` has no --agent flag (2026.8.1: only --channel/--account/--verbose),
+  // and neither does the channels.start call it makes into the gateway — so the owner can only be
+  // named the way OpenClaw's own error hint says: through a binding. Pin one to the real bot
+  // before the QR starts. Additive: an existing binding is never rewritten, and the phantom
+  // `main` is never the target.
+  if (!binding) {
+    const roster = (cfg.agents.list || []).filter((a) => !isPhantomMainAgent(a, projectDir, (cfg.agents.list || []).length));
+    const target = (agentId && roster.some((a) => a.id === agentId)) ? agentId : roster[0]?.id;
+    if (target) {
+      binding = { agentId: target, match: { channel: 'zalo-connect', accountId: 'default' } };
+      cfg.bindings = [...(cfg.bindings || []), binding];
+      await fsp.writeFile(cfgPath, JSON.stringify(cfg, null, 2) + '\n', 'utf8');
+      sendLog(`[zalo-connect] No zalo-connect binding found — pinned this QR login to agent [${target}] so OpenClaw knows who owns the channel.`);
+    }
+  }
   return startZaloConnectLogin(projectDir, binding?.match?.accountId || "default");
 }
 

package/dist/setup/shared/bot-config-gen.js

@@ -196,13 +196,15 @@
     // arbitrary emoji globally would make those channels reject every ack, so other
     // channels keep their existing behaviour until someone picks a value valid there.
     //
-    // 🦞 is sent as a Zalo *custom* reaction (emoji as rIcon + a hash as rType), which
-    // needs zalo-connect ≥3.0.15 — earlier versions only knew the 55 built-ins and would
-    // drop it silently. Scope "all" covers DMs and groups; in a mention-gated group the
-    // plugin still only reacts to messages that address the bot, since non-addressed ones
-    // are buffered as passive context before the reaction step.
+    // `/-heart` is one of Zalo's 55 BUILT-IN reactions, so every zalo-connect version can
+    // send it. The previous default (🦞) went out as a Zalo *custom* reaction (emoji as
+    // rIcon + a hash as rType), which needs zalo-connect ≥3.0.15 — on anything older it was
+    // dropped silently and the bot looked unresponsive until the reply landed.
+    // Scope "all" covers DMs and groups; in a mention-gated group the plugin still only
+    // reacts to messages that address the bot, since non-addressed ones are buffered as
+    // passive context before the reaction step.
     if (isZaloPersonal(channelKey)) {
-      cfg.messages = { ackReaction: '🦞', ackReactionScope: 'all', removeAckAfterReply: false };
+      cfg.messages = { ackReaction: '/-heart', ackReactionScope: 'all', removeAckAfterReply: false };
     }
 
     // ── commands ──────────────────────────────────────────────────────────────

package/dist/setup/shared/docker-gen.js

@@ -382,8 +382,11 @@ if(touched){console.log('[patch-9router] Applied Codex compatibility patch.');}e
       // seeded. Kept out of the shared migration because zalo-connect reads the GLOBAL
       // messages.ackReaction, and that same key also feeds Telegram/Discord/Slack/
       // WhatsApp — which accept only their own fixed reaction sets and would reject an
-      // arbitrary emoji. Absent-only, so an operator's own choice is never overwritten.
-      const ackReactionScript = `const fs=require('fs'),path=require('path');const p=path.join(process.cwd(),'.openclaw','openclaw.json');if(fs.existsSync(p)){const c=JSON.parse(fs.readFileSync(p,'utf8'));let ch=false;c.messages=c.messages||{};if(c.messages.ackReaction===undefined){c.messages.ackReaction='🦞';ch=true;}if(c.messages.ackReactionScope===undefined){c.messages.ackReactionScope='all';ch=true;}if(ch)fs.writeFileSync(p,JSON.stringify(c,null,2));}`;
+      // arbitrary emoji. Absent-only, so an operator's own choice is never overwritten —
+      // with one exception: the 🦞 this script itself used to seed is rewritten to
+      // `/-heart`. 🦞 only ships as a Zalo CUSTOM reaction (needs zalo-connect ≥3.0.15,
+      // silently dropped below that); `/-heart` is a built-in every version can send.
+      const ackReactionScript = `const fs=require('fs'),path=require('path');const p=path.join(process.cwd(),'.openclaw','openclaw.json');if(fs.existsSync(p)){const c=JSON.parse(fs.readFileSync(p,'utf8'));let ch=false;c.messages=c.messages||{};if(c.messages.ackReaction===undefined||c.messages.ackReaction==='🦞'){c.messages.ackReaction='/-heart';ch=true;}if(c.messages.ackReactionScope===undefined){c.messages.ackReactionScope='all';ch=true;}if(ch)fs.writeFileSync(p,JSON.stringify(c,null,2));}`;
       runtimeParts.push(`node - <<'NODE'\n${ackReactionScript}\nNODE`);
     }
     // Always-on memory context engine for every bot (see bot-config-gen: plugins.slots

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-openclaw-bot",
-  "version": "5.16.5",
+  "version": "5.16.6",
   "description": "Interactive CLI installer for OpenClaw Bot",
   "main": "dist/cli.js",
   "bin": {