create-openclaw-bot 5.17.0 → 5.17.2

package/dist/server/local-server.js

@@ -39,7 +39,7 @@ const CHROME_PROFILE_CACHE_DIRS = [
 ];
 
 // openclaw 2026.8.x replaced exec-approvals.json with shared SQLite state and BLOCKS every
-// message dispatch while the legacy file exists ("ExecApprovalsMigrationRequiredError" —
+// message dispatch while the legacy file exists ("ExecApprovalsMigrationRequiredError" -
 // measured on vps_c-thu 02/09/2026: the bot went silent with zero model calls, and doctor
 // refuses to migrate the file itself). The exec policy already lives in openclaw.json
 // (tools.exec), so on 2026.8+ we must neither write nor keep this file.
@@ -59,7 +59,7 @@ function invalidateHostOpenclawVersion() {
 async function hostOpenclawMajorMinor() {
   // Cache only a REAL version: during bot creation this is first called before
   // `npm i -g openclaw` has run, and caching that 0 forever made prepareNativeStateHome
-  // skip the 2026.8 state-home move — daemon install then failed with "non-default
+  // skip the 2026.8 state-home move - daemon install then failed with "non-default
   // state dir" (measured on a fresh native install, 03/09/2026).
   //
   // A real-but-STALE version is just as bad and does not self-heal: on a host that already
@@ -116,7 +116,7 @@ async function syncExecApprovals(projectDir, cfg) {
 /**
  * Write files into the bot container's plugin folder. Needed when `.openclaw/extensions` is a
  * Docker named volume: the host sees an empty directory, so there is nothing on disk to patch.
- * Best-effort — a stopped container or a project without Docker just yields 0.
+ * Best-effort - a stopped container or a project without Docker just yields 0.
  */
 async function pushBrowserScriptsIntoContainer(projectDir, aliases, files, sendLog = () => {}) {
   if (isNativeProject(projectDir)) return 0;
@@ -138,7 +138,7 @@ async function pushBrowserScriptsIntoContainer(projectDir, aliases, files, sendL
       try {
         await fsp.writeFile(tmp, content, 'utf8');
         // runCapture, not run: run() forces a shell on Windows, and the temp path goes through
-        // a home directory that usually has a space in it ("VT 2025") — cmd then splits it and
+        // a home directory that usually has a space in it ("VT 2025") - cmd then splits it and
         // docker cp fails with a usage error.
         const cp = await runCapture('docker', ['cp', tmp, `${container}:${dir}/${name}`], { shell: false, timeout: 20000 });
         if (cp.code !== 0) throw new Error(String(cp.stderr || cp.stdout || 'docker cp failed').trim());
@@ -159,7 +159,7 @@ async function pushBrowserScriptsIntoContainer(projectDir, aliases, files, sendL
 /**
  * The browser-automation plugin defaults every high-impact behaviour to off (ClawHub's review reads
  * broad defaults as "rogue agent", fairly). A dashboard install is an explicit, informed action, so
- * the flags are turned on here — and stay visible in openclaw.json for anyone who wants them off.
+ * the flags are turned on here - and stay visible in openclaw.json for anyone who wants them off.
  */
 function browserAutomationOptIns() {
   return { patchDocker: true, allowPageScripting: true, allowFileUpload: true };
@@ -217,7 +217,7 @@ async function connectPreferredChrome() {
   };
 
   // The shipped script is replaced outright rather than tweaked: it launches Chrome against a
-  // throwaway profile under %TEMP%, which is the single clearest bot signal a site can read —
+  // throwaway profile under %TEMP%, which is the single clearest bot signal a site can read -
   // no cookies, no logins, no history, no extensions, brand new on every run.
   //
   // The obvious fix, pointing --user-data-dir at the operator's real profile, is what earlier
@@ -229,7 +229,7 @@ async function connectPreferredChrome() {
   // So: a dedicated profile directory, seeded once from the real one. Cookies, logins,
   // history and extensions come along (that was the point of using the real profile), the
   // debug port is allowed because the directory is not the default one, and the operator's
-  // own Chrome can keep running next to it. Set OPENCLAW_CHROME_PROFILE_DIR to override —
+  // own Chrome can keep running next to it. Set OPENCLAW_CHROME_PROFILE_DIR to override -
   // anything except the default profile directory works.
   const chromeProfileCacheJunk = CHROME_PROFILE_CACHE_DIRS;
 
@@ -257,7 +257,7 @@ async function connectPreferredChrome() {
     'REM vi ban dieu khien dung profile rieng.',
     'powershell -NoProfile -Command "Get-CimInstance Win32_Process | Where-Object { $_.Name -eq \'chrome.exe\' -and $_.CommandLine -like \'*--remote-debugging-port=9222*\' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force }" >nul 2>&1',
     // `timeout` dies with "Input redirection is not supported" whenever stdin is not a
-    // console — which is every run from the dashboard, a scheduled task or SSH. ping waits
+    // console - which is every run from the dashboard, a scheduled task or SSH. ping waits
     // the same way and does not care.
     'ping -n 3 127.0.0.1 >nul',
     '',
@@ -375,8 +375,8 @@ async function connectPreferredChrome() {
   ].join('\n');
 
   // Scripts from before the dedicated-profile fix carry OPENCLAW_CHROME_PROFILE_DIR but point
-  // it at the default profile, so they are dead on Chrome 136+. The marker — not the variable
-  // name — decides whether a script is current; anything older is replaced.
+  // it at the default profile, so they are dead on Chrome 136+. The marker - not the variable
+  // name - decides whether a script is current; anything older is replaced.
   const patchChromeDebugScript = (content, isBat) => (
     content.includes(CHROME_SCRIPT_MARKER) ? content : (isBat ? startChromeBat : startChromeSh)
   );
@@ -454,7 +454,7 @@ async function connectPreferredChrome() {
       ['start-chrome-debug.sh', startChromeSh, '755'],
     ], sendLog);
     if (pushed > 0) {
-      sendLog(`[browser] Extensions live in a Docker volume — pushed ${pushed} start-chrome script(s) into the container so the plugin delivers the current one.`);
+      sendLog(`[browser] Extensions live in a Docker volume - pushed ${pushed} start-chrome script(s) into the container so the plugin delivers the current one.`);
     }
   }
 
@@ -478,7 +478,7 @@ Chrome launches with a profile copied from the operator's own on first run, so p
 
 The tool connects to whichever Chrome answers first: the operator's Chrome on the host, then a local one on \`127.0.0.1:9222\`. On a server with no desktop Chrome, the container starts its own headless Chromium there at boot, so the same commands work everywhere.
 
-**Use these commands, not OpenClaw's built-in \`browser\` tool** — that tool is switched off here because it cannot read page text or links, which is the whole reason this skill exists. If a command reports it cannot connect, the operator's Chrome is not running: ask them to run the debug script above. Do not conclude that the environment has no browser.
+**Use these commands, not OpenClaw's built-in \`browser\` tool** - that tool is switched off here because it cannot read page text or links, which is the whole reason this skill exists. If a command reports it cannot connect, the operator's Chrome is not running: ask them to run the debug script above. Do not conclude that the environment has no browser.
 
 ## Browser Commands
 
@@ -507,7 +507,7 @@ Do not call \`search-tool.js\`; browser-automation does not own search. Use \`we
   const hostOs = normalizeHostOs(await resolveProjectHostOs(projectDir));
   const shouldKeepBat = hostOs === 'win';
   // Shipped as start-chrome-debug.* by the plugin; delivered to the workspace as
-  // start-chrome.* — it launches Chrome with the debug port open, so "debug" in the name only
+  // start-chrome.* - it launches Chrome with the debug port open, so "debug" in the name only
   // ever made people think it was a developer-only thing.
   const scriptToKeep = shouldKeepBat ? 'start-chrome.bat' : 'start-chrome.sh';
   const legacyScripts = ['start-chrome-debug.bat', 'start-chrome-debug.sh', shouldKeepBat ? 'start-chrome.sh' : 'start-chrome.bat'];
@@ -568,7 +568,7 @@ async function fetchLatestSetupVersionBg() {
   if (isFetchingLatestSetup) return;
   isFetchingLatestSetup = true;
   try {
-    // Distribution is GitHub (not npm) — read the version straight from main so the
+    // Distribution is GitHub (not npm) - read the version straight from main so the
     // "latest" reflects `npx github:…`, not the stale last-published npm release.
     const resp = await fetch(
       'https://raw.githubusercontent.com/tuanminhhole/openclaw-setup/main/package.json',
@@ -646,7 +646,7 @@ function detectOs() {
   if (platform === 'linux') {
     // WSL always has a Windows desktop behind it, so it counts as a desktop. Otherwise a session
     // with no display server is a headless server, and the distinction is not cosmetic: 'vps' is
-    // what opens the gateway bind past loopback (bot-config-gen) — pick 'linux-desktop' on a VPS
+    // what opens the gateway bind past loopback (bot-config-gen) - pick 'linux-desktop' on a VPS
     // and the dashboard is only reachable through an SSH tunnel, while the browser tooling is set
     // up as though a local Chrome existed.
     if (os.release().toLowerCase().includes('microsoft')) return 'linux-desktop';
@@ -700,12 +700,12 @@ function getRealHomedir() {
 /**
  * Directories to search when a bare command is not sitting next to the running node.
  *
- * resolveBinPath's original assumption — "the CLI lives beside the node that runs me" — holds only
+ * resolveBinPath's original assumption - "the CLI lives beside the node that runs me" - holds only
  * while the Setup UI is launched by the same node that installed openclaw globally. It breaks the
  * moment the UI runs under the SYSTEM node while openclaw lives in an nvm prefix: `openclaw` stays a
  * bare name, spawn's own PATH lookup finds nothing either, and every skill/plugin install dies with
  * `spawn openclaw ENOENT`. Hit on a customer VPS 2026-08-28, right after the UI became a systemd
- * unit whose PATH carried only the system directories — `openclaw` existed the whole time, at
+ * unit whose PATH carried only the system directories - `openclaw` existed the whole time, at
  * /root/.nvm/versions/node/v24.20.0/bin/openclaw.
  *
  * PATH first (so an operator's own choice still wins), then nvm's per-version bins newest first,
@@ -727,6 +727,19 @@ function extraBinDirs() {
   return dirs;
 }
 
+/**
+ * Windows refuses to spawn a .cmd/.bat shim without a shell.
+ *
+ * Node has thrown a bare `spawn EINVAL` for that since the 2024 argument-injection fix, with no
+ * hint about which command or why. Every `openclaw` call here goes through `openclaw.cmd`, and
+ * ocCapture asks for `shell: false`, so on Windows those calls died on arrival: measured on a
+ * customer machine, the node host started and connected fine and then `nodes approve` failed with
+ * nothing but "spawn EINVAL" in the log. Force the shell for these, whatever the caller asked.
+ */
+function needsWindowsShell(bin) {
+  return process.platform === 'win32' && /\.(cmd|bat)"?$/i.test(String(bin || ''));
+}
+
 function resolveBinPath(cmd) {
   if (!cmd || cmd.includes('/') || cmd.includes('\\')) return cmd;
   const names = process.platform === 'win32' ? [`${cmd}.cmd`, `${cmd}.exe`, cmd] : [cmd];
@@ -751,8 +764,8 @@ function resolveBinPath(cmd) {
  *
  * Load-bearing for anything picked out of an nvm prefix: `openclaw` there is a shebang script
  * (`#!/usr/bin/env node`), so running it by absolute path still resolves `node` from the CHILD's
- * PATH. Without this the CLI is found and then executed by whatever node happens to be first —
- * the system one — which is not the node it was installed for.
+ * PATH. Without this the CLI is found and then executed by whatever node happens to be first -
+ * the system one - which is not the node it was installed for.
  */
 function binEnv(bin, extra = {}) {
   const env = { ...process.env, ...extra };
@@ -851,7 +864,7 @@ function globalNodeModulesDirs() {
 }
 
 // `9router --version` boots the whole CLI and takes ~4 SECONDS on a normal machine. /api/system
-// used to pay that on every single call — and the UI calls it after every action, so the whole
+// used to pay that on every single call - and the UI calls it after every action, so the whole
 // dashboard felt slow for one version string. The version is right there in package.json.
 function readGlobalPackageVersion(name) {
   for (const dir of globalNodeModulesDirs()) {
@@ -875,7 +888,7 @@ async function getCurrentRuntimeVersions() {
     nineRouter: readGlobalPackageVersion('9router'),
     node: process.version || '',
   };
-  // Only shell out for what disk did not answer — a global install in a prefix we do not know
+  // Only shell out for what disk did not answer - a global install in a prefix we do not know
   // about, mostly. Still cached, so an odd layout costs the slow probe once, not every request.
   const needCli = !fromDisk.openclaw || !fromDisk.nineRouter;
   if (needCli) {
@@ -1022,8 +1035,8 @@ function runCapture(cmd, args, opts = {}) {
   return new Promise((resolve) => {
     let stdout = '';
     let stderr = '';
-    const shell = opts.shell ?? process.platform === 'win32';
     const rawBin = resolveBinPath(cmd);
+    const shell = needsWindowsShell(rawBin) || (opts.shell ?? process.platform === 'win32');
     const bin = shell && rawBin.includes(' ') && !rawBin.startsWith('"') ? `"${rawBin}"` : rawBin;
     const child = spawn(bin, args, {
       cwd: opts.cwd,
@@ -1217,7 +1230,7 @@ async function detectRuntime(projectDir) {
     // Ask projectDeployMode, don't re-derive from the compose file: a project migrated to native
     // KEEPS its docker/ folder on purpose (that is the way back), so "compose file exists" stops
     // meaning "runs on docker" the moment migration lands. Getting this wrong made the dashboard
-    // report OpenClaw and 9Router OFFLINE on a machine whose native gateway was answering 200 —
+    // report OpenClaw and 9Router OFFLINE on a machine whose native gateway was answering 200 -
     // it was probing the stopped containers. Seen on win_kha, 10/09/2026.
     mode: projectDeployMode(projectDir),
     cliGatewayStatus,
@@ -1231,7 +1244,7 @@ async function detectRuntime(projectDir) {
 
 // Projects whose one-time migration + Docker-infra sync has already run this server lifetime.
 // The legacy-path migration, 9router-key resolution and Docker-file regeneration only need to
-// happen once per project (or after an explicit update) — not on every status poll. detectRuntime
+// happen once per project (or after an explicit update) - not on every status poll. detectRuntime
 // (cached) still refreshes ports/mode cheaply on each call so state stays current.
 const _runtimeSynced = new Set();
 async function syncRuntimeState(projectDir, { full = false } = {}) {
@@ -1263,7 +1276,7 @@ async function syncRuntimeState(projectDir, { full = false } = {}) {
   state.mode = state.mode || rt.mode;
   state.syncSource = rt.syncSource || 'config';
   state.installed = true;
-  // Auto-sync Docker files if outdated — only on first sync (or forced); the version stamp gate
+  // Auto-sync Docker files if outdated - only on first sync (or forced); the version stamp gate
   // inside syncDockerInfra already no-ops on matching versions, but skipping the call entirely
   // avoids the repeated file reads on every page load.
   if (firstSync && rt.mode === 'docker') {
@@ -1287,7 +1300,7 @@ async function removeEmptyWorkspaceAttestations(projectDir) {
  * Native counterpart of migrateContainerPaths. A native bot runs on the host with cwd = the
  * project dir, so any Docker/legacy container path baked into openclaw.json (e.g. an agent
  * `workspace` of "/home/node/project/.openclaw/workspace-x", left over from a bot created by an
- * older build or carried over from Docker) points at a directory that does not exist on the host —
+ * older build or carried over from Docker) points at a directory that does not exist on the host -
  * the gateway then fails every turn with `ENOENT: mkdir '/home/node'` and the bot never replies.
  * Strip the container prefix so the path becomes project-relative (what bot-config-gen now emits).
  */
@@ -1300,7 +1313,7 @@ async function migrateNativePaths(projectDir) {
   // writes the workspace under projectDir/.openclaw/<name>. A relative value can't satisfy both:
   //   ".openclaw/workspace-x"  → runtime doubles it to .openclaw/.openclaw/workspace-x (blank persona)
   //   "workspace-x"            → setup's own resolver looks in projectDir/workspace-x
-  // Only an ABSOLUTE host path is correct for both — the direct parallel of Docker's absolute
+  // Only an ABSOLUTE host path is correct for both - the direct parallel of Docker's absolute
   // "/home/node/project/.openclaw/workspace-x". Normalise every agent's workspace to it.
   const wsRoot = join(projectDir, '.openclaw');
   let changed = false;
@@ -1311,7 +1324,16 @@ async function migrateNativePaths(projectDir) {
     const abs = join(wsRoot, base);
     if (obj.workspace !== abs) { obj.workspace = abs; changed = true; }
   };
+  // Walk BOTH shapes. This reads the file with a raw JSON.parse (no ensureConfigShape), so on an
+  // openclaw >=2026.8 config - which keys agents by `agents.entries`, not `agents.list` - `.list`
+  // is simply undefined and the loop used to run over an empty array and fix nothing. A bot added
+  // to such a project kept whatever workspace path it was written with; when that was a container
+  // path the gateway refused to start at all and every bot in the project went down with it.
   for (const a of (cfg.agents?.list || [])) fix(a);
+  const entries = cfg.agents?.entries;
+  if (entries && typeof entries === 'object' && !Array.isArray(entries)) {
+    for (const a of Object.values(entries)) fix(a);
+  }
   fix(cfg.agents?.defaults);
   if (changed) {
     await fsp.copyFile(cfgPath, `${cfgPath}.bak`).catch(() => {});
@@ -1464,7 +1486,7 @@ function ensureConfigShape(cfg) {
   // `agents.list` in the FILE (measured on vps_c-thu: doctor moves list→entries, then the
   // whole UI shows 0 bots because everything here reads .list). Bridge the two shapes:
   // hydrate a hidden .list view from entries, and expose .entries as a getter built from
-  // .list — so JSON.stringify writes only schema-valid entries while every read/mutation
+  // .list - so JSON.stringify writes only schema-valid entries while every read/mutation
   // path in this file keeps working on .list unchanged. Configs that still use a real
   // list (openclaw ≤2026.7 projects) keep the old behavior untouched.
   const rawEntries = (cfg.agents.entries && typeof cfg.agents.entries === 'object' && !Array.isArray(cfg.agents.entries))
@@ -1515,7 +1537,7 @@ function ensureConfigShape(cfg) {
   cfg.channels = cfg.channels || {};
   cfg.bindings = Array.isArray(cfg.bindings) ? cfg.bindings : [];
   cfg.plugins = cfg.plugins || { entries: { 'memory-core': { config: { dreaming: { enabled: false } } } } };
-  // Preserve plugins.allow — needed for external plugins such as Zalo Connect.
+  // Preserve plugins.allow - needed for external plugins such as Zalo Connect.
   if (!cfg.plugins.allow) cfg.plugins.allow = [];
   cfg.tools = cfg.tools || { profile: 'full', exec: { host: 'gateway', security: 'full', ask: 'off' } };
   return cfg;
@@ -1540,7 +1562,7 @@ function zaloBackendForConfig(cfg) {
 }
 
 function ensureZaloConnectChannel(cfg) {
-  // Secure defaults — DM pairing, no groups enabled
+  // Secure defaults - DM pairing, no groups enabled
   // until the owner picks them. Existing zalo-connect config is preserved as-is.
   cfg.channels['zalo-connect'] = cfg.channels['zalo-connect'] || buildZaloConnectChannelConfig();
   cfg.channels['zalo-connect'].enabled = true;
@@ -1586,7 +1608,7 @@ function ensureZaloModPluginConfig(entry, cfg) {
     entry.config.dashboardPort = gwPort + 1;
   }
   // Seed the default bot's identity under bots.default (per-bot shape). zalo-mod
-  // treats bots.<profile> as the canonical source — do NOT write legacy top-level
+  // treats bots.<profile> as the canonical source - do NOT write legacy top-level
   // botName/zaloDisplayNames (they get stripped by the plugin's normalizer anyway).
   const firstAgentName = cfg.agents?.list?.[0]?.name;
   if (firstAgentName) {
@@ -1741,6 +1763,52 @@ async function appendEnvValue(projectDir, key, value) {
   await fsp.writeFile(envPath, env, 'utf8');
 }
 
+/**
+ * Ask openclaw itself whether the config we just wrote is schema-valid, and roll back if not.
+ *
+ * validateOpenclawConfig() below only checks the shapes THIS file cares about. openclaw's own
+ * schema is strict and rejects unknown keys, and it does so at BOOT: one bad key anywhere means
+ * `Gateway failed to start: Invalid config ...` and every bot in the project goes dark at once.
+ * The operator sees bots "not logged in" and reasonably concludes their sessions are gone, when
+ * nothing is wrong with the sessions at all.
+ *
+ * So: write, ask openclaw, and put the backup back the moment it complains. Restoring is always
+ * better than leaving a config in place that we already know will not boot.
+ * Returns null when the config is fine (or when we could not run the check), a message otherwise.
+ */
+async function verifyConfigOrRollback(projectDir) {
+  if (!isNativeProject(projectDir)) return null; // Docker is retired; only check what we run.
+  const cfgPath = join(projectDir, '.openclaw', 'openclaw.json');
+  const backup = `${cfgPath}.bak`;
+  const r = await ocCapture(projectDir, ['config', 'validate'], { timeout: 30000 }).catch(() => null);
+  if (!r) return null;                       // Could not run the CLI at all - do not guess.
+  const out = `${r.stdout || ''}${r.stderr || ''}`;
+  if (r.code === 0 || /Config valid/i.test(out)) return null;
+  // Fail SAFE: roll back only when openclaw actually says the config is bad. A non-zero exit can
+  // also mean it looked in the wrong place ("Config file not found") or that the CLI itself broke,
+  // and restoring a backup over a perfectly good config would be worse than the bug this guards.
+  // Wording measured on 2026.9.2: "OpenClaw config is invalid: ..." followed by "× openclaw.json:38
+  // - agents.entries.<id>: Unrecognized key: "role"". Match the shapes openclaw actually prints.
+  if (!/config is invalid|invalid config|unrecognized key|invalid input|invalid option|expected/i.test(out)) {
+    sendLog(`[config] Bỏ qua kiểm tra cấu hình (openclaw không kết luận được): ${out.trim().slice(0, 160)}`);
+    return null;
+  }
+  // Keep the rejected file next to the good one: it is the only evidence of what went wrong.
+  const rejected = `${cfgPath}.rejected-${Date.now()}`;
+  await fsp.copyFile(cfgPath, rejected).catch(() => {});
+  let restored = false;
+  if (existsSync(backup)) {
+    await fsp.copyFile(backup, cfgPath).catch(() => {});
+    restored = true;
+  }
+  const detail = out.split('\n').map((l) => l.trim()).filter(Boolean).slice(0, 4).join(' · ');
+  sendLog(`[config] openclaw từ chối cấu hình vừa ghi: ${detail}`);
+  sendLog(`[config] Bản bị từ chối giữ ở ${rejected}${restored ? '; đã khôi phục bản trước đó.' : '.'}`);
+  return restored
+    ? `Cấu hình vừa ghi bị openclaw từ chối nên đã khôi phục bản cũ (bot vẫn chạy bình thường). Lý do: ${detail}`
+    : `Cấu hình vừa ghi bị openclaw từ chối và không có bản sao lưu để khôi phục. Lý do: ${detail}`;
+}
+
 function validateOpenclawConfig(cfg) {
   if (!Array.isArray(cfg.agents?.list)) throw httpError(500, 'openclaw.json missing agents.list');
   for (const a of cfg.agents.list) {
@@ -1748,7 +1816,7 @@ function validateOpenclawConfig(cfg) {
   }
   if (!cfg.channels || typeof cfg.channels !== 'object') throw httpError(500, 'openclaw.json missing channels');
 
-  // Self-healing: two zalo-connect bindings can never share one account — one Zalo number, one
+  // Self-healing: two zalo-connect bindings can never share one account - one Zalo number, one
   // listener. An older edit path hardcoded `accountId: 'default'`, so an edited bot could end up
   // squatting the first bot's account while its own account sat unbound (no listener, and the
   // other bot answered in its place). Only repair where the intent is unambiguous: the agent
@@ -1764,7 +1832,7 @@ function validateOpenclawConfig(cfg) {
       if (owner.get(accountId) === agentId || !zaloAccounts[agentId]) continue;
       binding.match.accountId = agentId;
       owner.set(agentId, agentId);
-      sendLog(`[config] Bot "${agentId}" đang dùng chung account Zalo "${accountId}" với "${owner.get(accountId)}" — đã trả về account riêng "${agentId}".`);
+      sendLog(`[config] Bot "${agentId}" đang dùng chung account Zalo "${accountId}" với "${owner.get(accountId)}" - đã trả về account riêng "${agentId}".`);
     }
   }
 
@@ -1816,7 +1884,7 @@ function bindingChannelId(channel = '') {
 }
 
 // OpenClaw ≥2026.8 materialises a DEFAULT agent `main` ("Trợ lý OpenClaw") the first time a
-// gateway boots against a roster it considers empty — which is exactly what happens in Docker
+// gateway boots against a roster it considers empty - which is exactly what happens in Docker
 // mode, where `docker compose up` runs while the project still has zero bots (writeCoreProject
 // seeds agents with an empty list). The entry is legitimate OpenClaw state and is left alone in
 // openclaw.json, but it is NOT a bot the operator created: showing it next to the real bot made
@@ -1904,7 +1972,7 @@ async function deleteBotInProject(projectDir, agentId) {
   }
   if (cfg.channels?.telegram?.accounts?.[agentId]) delete cfg.channels.telegram.accounts[agentId];
 
-  // Drop any channel orphaned by this deletion — no binding references it and it has no accounts
+  // Drop any channel orphaned by this deletion - no binding references it and it has no accounts
   // (e.g. a Telegram channel whose only bot was just removed). An enabled channel with no account
   // keeps erroring in `channels status` ("not configured") and shows a broken card.
   const stillReferenced = new Set((cfg.bindings || []).map((b) => b.match?.channel).filter(Boolean));
@@ -1960,7 +2028,7 @@ function portStatus(port) {
  * listener. Docker tolerates that (compose publishes into loopback and fails loudly on a clash);
  * native binds the host directly, so it has to ask the host.
  *
- * `reserveNext` also requires port+1 to be free — that is where the zalo-mod dashboard lands.
+ * `reserveNext` also requires port+1 to be free - that is where the zalo-mod dashboard lands.
  */
 async function findFreeHostPort(start, { reserveNext = false, limit = 100 } = {}) {
   for (let port = start; port < start + limit; port++) {
@@ -2069,7 +2137,7 @@ async function createBotInProject(projectDir, body = {}, runtime = {}) {
   cfg.agents.list.push({
     id: agentId,
     name: botName,
-    // Relative workspace path — resolves against the process cwd (project root) in both docker
+    // Relative workspace path - resolves against the process cwd (project root) in both docker
     // and native. See buildOpenclawJson() for the full rationale.
     workspace: `.openclaw/${workspaceDir}`,
     agentDir: `agents/${agentId}/agent`,
@@ -2133,6 +2201,9 @@ async function createBotInProject(projectDir, body = {}, runtime = {}) {
   // so the generator's ".openclaw/workspace-x" would double. Rewrite to an absolute path now so
   // the bot reads its persona on the very first turn (not only after the next runtime sync).
   if (isNativeProject(projectDir)) await migrateNativePaths(projectDir).catch(() => {});
+  // Check AFTER the path normalisation above, so we validate exactly what the gateway will read.
+  const rejected = await verifyConfigOrRollback(projectDir).catch(() => null);
+  if (rejected) throw httpError(500, rejected);
   await syncExecApprovals(projectDir, cfg);
 
   const hasScheduler = !!(cfg.tools?.alsoAllow || []).includes('group:automation');
@@ -2163,7 +2234,7 @@ async function createBotInProject(projectDir, body = {}, runtime = {}) {
   // the token); don't pollute other channels' bot-meta.json with an empty appId.
   if (channel === 'fb-messenger') botMeta.appId = fbAppId;
   await writeBotMeta(projectDir, workspaceDir, botMeta);
-  // PC control is granted per PROJECT, so a bot added afterwards must get the same instructions —
+  // PC control is granted per PROJECT, so a bot added afterwards must get the same instructions -
   // its TOOLS.md was just written fresh and would otherwise have no host-control block at all.
   const hostCfg = await readHostControlConfig(projectDir).catch(() => null);
   if (hostCfg?.enabled) await writeHostControlAccess(projectDir, hostCfg).catch(() => {});
@@ -2196,7 +2267,7 @@ async function updateBotInProject(projectDir, agentId, body = {}, runtime = {})
   // The zalo-connect branch below used to hardcode 'default' (and this lookup only covered
   // telegram), so editing ANY Zalo bot re-pointed it at the FIRST bot's Zalo account: two
   // bindings claimed `default`, the earlier one won, and the edited bot's own account was left
-  // with no binding at all — so its listener never started and messages were answered by the
+  // with no binding at all - so its listener never started and messages were answered by the
   // other bot. Seen live on a 5-bot install (bot answered under the first bot's name).
   const previousBindings = (cfg.bindings || []).filter((b) => b.agentId === agentId);
   const previousAccountId = (ch) => previousBindings.find((b) => b.match?.channel === ch)?.match?.accountId || null;
@@ -2244,10 +2315,21 @@ async function updateBotInProject(projectDir, agentId, body = {}, runtime = {})
   }
 
   agent.name = botName;
-  agent.role = botDesc;
+  // NEVER put `role` (or any free-form field) on the agent entry. openclaw's schema is strict and
+  // rejects unknown keys outright: `agents.entries.<id>: Unrecognized key: "role"` makes the
+  // gateway refuse to boot, which takes down EVERY bot in the project, not just the edited one.
+  // Measured on a customer host: editing one bot silently killed all of them, and the dashboard
+  // then showed "chưa đăng nhập" for sessions that were perfectly intact.
+  // The description already has a home - bot-meta.json, written a few lines below - and that is
+  // what the UI reads back (readBotIdentity prefers meta.role). ensureConfigShape deletes this key
+  // on load precisely because it does not belong here; re-adding it on save just undid that.
   validateOpenclawConfig(cfg);
   if (existsSync(cfgPath)) await fsp.copyFile(cfgPath, `${cfgPath}.bak`);
   await fsp.writeFile(cfgPath, JSON.stringify(cfg, null, 2), 'utf8');
+  if (isNativeProject(projectDir)) await migrateNativePaths(projectDir).catch(() => {});
+  // Editing one bot must never be able to take the whole project down.
+  const rejectedEdit = await verifyConfigOrRollback(projectDir).catch(() => null);
+  if (rejectedEdit) throw httpError(500, rejectedEdit);
   await syncExecApprovals(projectDir, cfg);
 
   // Synchronize the token to .env files for the primary bot to ensure Docker picks it up
@@ -2341,7 +2423,7 @@ async function waitForDockerContainer(name, timeoutMs = 30000) {
  * The banner prints on EVERY invocation and quotes the offending config keys verbatim, so a project
  * whose zalo-connect plugin is missing has `channels.zalo-connect: unknown channel id: zalo-connect`
  * in the output of *any* command. A readiness check that greps stdout for a channel id therefore
- * reports "channel loaded" precisely when the plugin is absent — the check inverts itself. Strip the
+ * reports "channel loaded" precisely when the plugin is absent - the check inverts itself. Strip the
  * warnings before matching so only real command output counts.
  */
 function stripCliWarnings(text = '') {
@@ -2391,7 +2473,7 @@ async function waitForGatewayZaloReady(botContainer, projectDir, timeoutMs = 900
     await new Promise((r) => setTimeout(r, 5000));
   }
   if (!ready) {
-    sendLog('[zalo-connect] Gateway readiness timeout after ' + Math.round(timeoutMs / 1000) + 's — proceeding anyway.');
+    sendLog('[zalo-connect] Gateway readiness timeout after ' + Math.round(timeoutMs / 1000) + 's - proceeding anyway.');
   }
   return ready;
 }
@@ -2411,7 +2493,7 @@ async function waitForNativeGatewayZaloReady(projectDir, timeoutMs = 90000, chan
     // cannot possibly be loaded, so return right away and let the caller install it instead of
     // burning the whole timeout waiting for something that will never appear.
     if (!existsSync(extDir)) {
-      sendLog('[zalo-connect] Plugin folder .openclaw/extensions/zalo-connect is absent — not waiting.');
+      sendLog('[zalo-connect] Plugin folder .openclaw/extensions/zalo-connect is absent - not waiting.');
       return false;
     }
     if (await probeHttpOk(`http://127.0.0.1:${port}/health`, 2500)) {
@@ -2424,7 +2506,7 @@ async function waitForNativeGatewayZaloReady(projectDir, timeoutMs = 90000, chan
     }
     await new Promise((r) => setTimeout(r, 5000));
   }
-  if (!ready) sendLog('[zalo-connect] Native gateway readiness timeout after ' + Math.round(timeoutMs / 1000) + 's — proceeding anyway.');
+  if (!ready) sendLog('[zalo-connect] Native gateway readiness timeout after ' + Math.round(timeoutMs / 1000) + 's - proceeding anyway.');
   return ready;
 }
 
@@ -2439,13 +2521,13 @@ async function startZaloLogin(projectDir, agentId = "") {
     (!agentId || b.agentId === agentId) && b.match?.channel === "zalo-connect"
   );
   // A roster with more than one agent makes OpenClaw ≥2026.8 refuse any channel operation that
-  // cannot name its owner: `AgentSelectionRequiredError — Multiple agents are configured, but
+  // cannot name its owner: `AgentSelectionRequiredError - Multiple agents are configured, but
   // this operation has no explicit owner`. That is exactly what a Docker project looks like once
   // the gateway has materialised its default `main` agent alongside the real bot, and the QR
   // login dies with it (measured on vps_tracy-hong, 03/09).
   //
   // `openclaw channels login` has no --agent flag (2026.8.1: only --channel/--account/--verbose),
-  // and neither does the channels.start call it makes into the gateway — so the owner can only be
+  // and neither does the channels.start call it makes into the gateway - so the owner can only be
   // named the way OpenClaw's own error hint says: through a binding. Pin one to the real bot
   // before the QR starts. Additive: an existing binding is never rewritten, and the phantom
   // `main` is never the target.
@@ -2456,7 +2538,7 @@ async function startZaloLogin(projectDir, agentId = "") {
       binding = { agentId: target, match: { channel: 'zalo-connect', accountId: 'default' } };
       cfg.bindings = [...(cfg.bindings || []), binding];
       await fsp.writeFile(cfgPath, JSON.stringify(cfg, null, 2) + '\n', 'utf8');
-      sendLog(`[zalo-connect] No zalo-connect binding found — pinned this QR login to agent [${target}] so OpenClaw knows who owns the channel.`);
+      sendLog(`[zalo-connect] No zalo-connect binding found - pinned this QR login to agent [${target}] so OpenClaw knows who owns the channel.`);
     }
   }
   return startZaloConnectLogin(projectDir, binding?.match?.accountId || "default");
@@ -2467,7 +2549,7 @@ async function startZaloLogin(projectDir, agentId = "") {
 // container's tmpdir, announced with "QR image saved at: /tmp/zalo-connect-qr-<id>.png".
 // We watch stdout for that line, read the PNG out of the container, and push it to
 // the UI modal as a data URL ([zalo-connect:qr] log tag). Reconnect NEVER reinstalls the
-// plugin — install runs only when extensions/zalo-connect is absent, and always with the
+// plugin - install runs only when extensions/zalo-connect is absent, and always with the
 // pinned spec (never `latest`).
 async function startZaloConnectLogin(projectDir, accountId = 'default') {
   if (zaloLoginInFlight) {
@@ -2491,14 +2573,14 @@ async function startZaloConnectLogin(projectDir, accountId = 'default') {
       const gatewayReady = await waitForNativeGatewayZaloReady(projectDir, 180000);
       if (!gatewayReady) {
         // ensureNativePlugins is the single place that knows what a native project owes itself, and
-        // it skips whatever is already on disk — so this covers learning-memory too, and reconnects
+        // it skips whatever is already on disk - so this covers learning-memory too, and reconnects
         // on a healthy project cost nothing.
         const installed = await ensureNativePlugins(projectDir);
         if (installed.includes(ZALO_PLUGIN_ID)) {
           await restartNativeRuntime(projectDir).catch((err) => sendLog(`[native] restart skipped/failed: ${err.message}`));
           await waitForNativeGatewayZaloReady(projectDir, 180000);
         } else if (!existsSync(join(projectDir, '.openclaw', 'extensions', 'zalo-connect'))) {
-          sendLog('[zalo-connect] Cài plugin không thành công — thử lại bằng nút "Đăng nhập Zalo".');
+          sendLog('[zalo-connect] Cài plugin không thành công - thử lại bằng nút "Đăng nhập Zalo".');
         }
       }
     } else {
@@ -2510,23 +2592,23 @@ async function startZaloConnectLogin(projectDir, accountId = 'default') {
       // gateway is up but the plugin is genuinely absent (projects created before the
       // backend-aware entrypoint existed).
       const containerUp = await waitForDockerContainer(botContainer, 90000);
-      if (!containerUp) sendLog(`[zalo-connect] ${botContainer} chưa chạy sau 90s — vẫn thử tiếp...`);
+      if (!containerUp) sendLog(`[zalo-connect] ${botContainer} chưa chạy sau 90s - vẫn thử tiếp...`);
       const gatewayReady = await waitForGatewayZaloReady(botContainer, projectDir, 180000);
       if (!gatewayReady) {
         const check = await runCapture('docker', ['exec', botContainer, 'sh', '-lc', '[ -d "${OPENCLAW_HOME:-/home/node/project/.openclaw}/extensions/zalo-connect" ] && echo OK || echo MISSING'], { cwd: projectDir, shell: false }).catch(() => ({ stdout: 'ERR' }));
         if (String(check.stdout || '').trim() === 'MISSING') {
-          sendLog(`[zalo-connect] Plugin missing — installing ${ZALO_CONNECT_PLUGIN_SPEC}...`);
+          sendLog(`[zalo-connect] Plugin missing - installing ${ZALO_CONNECT_PLUGIN_SPEC}...`);
           const installCmd = `cd /home/node/project && (openclaw plugins install ${ZALO_CONNECT_PLUGIN_SPEC} --force --accept-capabilities || openclaw plugins install ${ZALO_CONNECT_PLUGIN_SPEC} --force ${LEGACY_CLAWHUB_FLAG}) 2>&1`;
           const inst = await runCapture('docker', ['exec', botContainer, 'sh', '-lc', installCmd], { cwd: projectDir, shell: false });
           const instOut = `${inst.stdout}\n${inst.stderr}`;
           for (const line of instOut.split(/\r?\n/).filter(Boolean)) sendLog(`[zalo-connect] ${line}`);
           if (/installed plugin/i.test(instOut)) {
-            // Gateway must reload to pick the plugin up — safe here: the gateway is past
+            // Gateway must reload to pick the plugin up - safe here: the gateway is past
             // its boot (we only reach this branch when it answered the exec above).
             await restartDockerBotContainer(projectDir).catch((err) => sendLog(`[docker] restart skipped/failed: ${err.message}`));
             await waitForGatewayZaloReady(botContainer, projectDir, 180000);
           } else {
-            sendLog('[zalo-connect] Cài plugin không thành công — thử lại bằng nút "Đăng nhập Zalo" sau khi container ổn định.');
+            sendLog('[zalo-connect] Cài plugin không thành công - thử lại bằng nút "Đăng nhập Zalo" sau khi container ổn định.');
           }
         }
       }
@@ -2544,7 +2626,7 @@ async function startZaloConnectLogin(projectDir, accountId = 'default') {
   const pushQr = async (pngPath) => {
     let b64 = '';
     if (native) {
-      // The CLI ran on the host, so the QR PNG is a real host path — read it directly.
+      // The CLI ran on the host, so the QR PNG is a real host path - read it directly.
       try {
         const st = await fsp.stat(pngPath);
         if (st.size > 100) b64 = (await fsp.readFile(pngPath)).toString('base64');
@@ -2604,7 +2686,7 @@ async function startZaloConnectLogin(projectDir, accountId = 'default') {
         zaloLoginInFlight = false;
       } else if (code !== 0 && !qrSent && !wasCancelled && attempt < MAX_ATTEMPTS) {
         const delay = RETRY_DELAYS[attempt] || 15000;
-        sendLog(`[zalo-connect] QR chưa sẵn sàng — thử lại sau ${delay / 1000}s...`);
+        sendLog(`[zalo-connect] QR chưa sẵn sàng - thử lại sau ${delay / 1000}s...`);
         setTimeout(runAttempt, delay);
       } else {
         if (!qrSent && !wasCancelled) sendLog('[zalo-connect] Login ended without a QR. Click "Đăng nhập Zalo" to retry.');
@@ -2742,7 +2824,7 @@ async function computeZaloHealth(projectDir) {
       meta.installedVersion = JSON.parse(await fsp.readFile(manifestHost, 'utf8')).version || null;
     } catch {
       // Only Docker projects keep the manifest inside a container. A native project has no
-      // container at all, and this fallback used to shell into one anyway — seconds of waiting on
+      // container at all, and this fallback used to shell into one anyway - seconds of waiting on
       // a `docker exec` that could never succeed, on a request the dashboard makes constantly.
       if (!native) {
         try {
@@ -2856,7 +2938,7 @@ function getBotServiceName(projectDir) {
 }
 
 // ═══════════════════════════════════════════════════════════════════════════════
-// Native runtime — openclaw + 9router straight on the host, no Docker
+// Native runtime - openclaw + 9router straight on the host, no Docker
 // ═══════════════════════════════════════════════════════════════════════════════
 // Two things replace the container:
 //   1. `docker exec <container> openclaw …`  →  `openclaw …` carrying the project env.
@@ -2871,14 +2953,14 @@ function getBotServiceName(projectDir) {
 const NATIVE_MARKER = 'native.json';
 // Native uses the same ports as everything else: openclaw's 18789 and 9router's 20128. It used to
 // jump a hundred above them unconditionally so it could sit next to a docker project, but that fired
-// even on a machine with nothing running at all — a fresh VPS still landed on 18889/20228, so every
+// even on a machine with nothing running at all - a fresh VPS still landed on 18889/20228, so every
 // tunnel command, bookmark and doc pointed at a port the user never chose. findFreeHostPort() now
 // handles coexistence by asking the host what is actually taken, which the fixed offset never did.
 const NATIVE_DEFAULT_GATEWAY_PORT = 18789;
 const NATIVE_DEFAULT_ROUTER_PORT = 20128;
 // The gateway's startup migrations hold a lease on the state directory for FIVE MINUTES, and a boot
 // that collides with it exits immediately instead of waiting. Any health wait shorter than that
-// lease reports failure on a gateway that was always going to come up on its own — the old 180s
+// lease reports failure on a gateway that was always going to come up on its own - the old 180s
 // could not outlast it even in the best case.
 const NATIVE_GATEWAY_HEALTH_TIMEOUT_MS = 420000;
 
@@ -2903,7 +2985,7 @@ function isNativeProject(projectDir) {
   return projectDeployMode(projectDir) === 'native';
 }
 
-/** launchd label / systemd unit / scheduled-task name — unique per project so installs coexist. */
+/** launchd label / systemd unit / scheduled-task name - unique per project so installs coexist. */
 function nativeServiceLabel(projectDir) {
   const meta = readNativeMeta(projectDir);
   if (meta && meta.label) return meta.label;
@@ -2915,7 +2997,7 @@ function nativeServiceLabel(projectDir) {
 function nativeEnv(projectDir, extra = {}) {
   const dir = projectDir || state.projectDir || '';
   // openclaw 2026.8.x fs-safe refuses atomic writes through a symlinked state dir
-  // ("Atomic replace parent must be a real directory") — hand it the real path. Native
+  // ("Atomic replace parent must be a real directory") - hand it the real path. Native
   // projects on 2026.8.x keep real state at ~/.openclaw with the project dir symlinked
   // (daemon install rejects a custom OPENCLAW_HOME), so this path IS a symlink there.
   let home = join(dir, '.openclaw');
@@ -2939,9 +3021,31 @@ function nativeEnv(projectDir, extra = {}) {
   };
 }
 
+/**
+ * Path to openclaw's own entry script, so we can run it with THIS node instead of its .cmd shim.
+ *
+ * The shim is a liability on Windows twice over: Node refuses to spawn a .cmd without a shell
+ * (`spawn EINVAL`), and the shim itself then re-resolves `node` from PATH - which fails with
+ * `'"node"' is not recognized as an internal or external command` whenever the installer's own
+ * environment does not carry node's directory. Both were measured on a customer machine, and both
+ * surfaced as "computer use does not work" rather than as anything to do with PATH. Calling the
+ * script directly with process.execPath sidesteps the shim entirely; the launchers already do it.
+ */
+function openclawEntryScript() {
+  for (const dir of globalNodeModulesDirs()) {
+    const entry = join(dir, 'openclaw', 'dist', 'index.js');
+    try { if (existsSync(entry)) return entry; } catch {}
+  }
+  return '';
+}
+
 /** Resolve `openclaw <args>` for whichever runtime this project uses. */
 function ocArgv(projectDir, args) {
   if (isNativeProject(projectDir)) {
+    const entry = openclawEntryScript();
+    // Prefer the script over the shim; fall back to the shim only when the global install is
+    // somewhere we did not expect, so an unusual layout still works as before.
+    if (entry) return { cmd: process.execPath, args: [entry, ...args], opts: { cwd: projectDir, env: nativeEnv(projectDir) } };
     return { cmd: 'openclaw', args, opts: { cwd: projectDir, env: nativeEnv(projectDir) } };
   }
   return { cmd: 'docker', args: ['exec', getBotContainerName(projectDir), 'openclaw', ...args], opts: { cwd: projectDir } };
@@ -2957,7 +3061,7 @@ function ocCapture(projectDir, args, opts = {}) {
   return runCapture(a.cmd, a.args, { shell: false, ...a.opts, ...opts, env: { ...(a.opts.env || {}), ...(opts.env || {}) } });
 }
 
-// openclaw 2026.8.x renamed the ClawHub consent flags — plugins: --accept-capabilities,
+// openclaw 2026.8.x renamed the ClawHub consent flags - plugins: --accept-capabilities,
 // skills: --acknowledge-install-policy-warning. 2026.7 and older only know
 // --acknowledge-clawhub-risk. Callers pass the NEW flag; when the CLI rejects it
 // ("does not recognize option") retry once with the legacy flag so an updated setup can
@@ -3007,7 +3111,7 @@ async function waitForNativeGatewayHealthy(projectDir, timeoutMs = 120000) {
  * The first gateway boot runs OpenClaw's startup migrations under a state-directory lease, and a
  * second gateway that tries to start meanwhile exits 1 with this message rather than waiting. The
  * docker path sidesteps it by never poking a booting container (see startZaloConnectLogin); when we
- * do hit it natively, the message carries the exact instant the lease frees — so wait that out
+ * do hit it natively, the message carries the exact instant the lease frees - so wait that out
  * instead of retrying blind into systemd's StartLimitBurst (5 per 60s, after which the unit is
  * abandoned for good).
  */
@@ -3023,7 +3127,7 @@ async function ocDaemon(projectDir, verb, extraArgs = []) {
   const args = ['daemon', verb, ...extraArgs];
   sendLog(`$ openclaw ${args.join(' ')}`);
   // openclaw 2026.8.x refuses EVERY `daemon *` verb (not just install) while OPENCLAW_HOME is
-  // set — "service management skipped: non-default state dir" (measured 03/09/2026: the
+  // set - "service management skipped: non-default state dir" (measured 03/09/2026: the
   // post-plugin-install restart failed on a fresh native host). On the 2026.8 layout the
   // state already lives at ~/.openclaw, so run daemon verbs with the plain account HOME and
   // no OPENCLAW_* overrides; STOP even suggests --force for the operator gateway, so pass it.
@@ -3052,11 +3156,11 @@ async function ocDaemon(projectDir, verb, extraArgs = []) {
  *
  * Health is confirmed over /health at the end rather than trusted from the CLI's exit code: the
  * CLI gives up verifying after ~13s while the generated unit allows 30s to start, so a slow but
- * perfectly healthy gateway reports "restart failed" — which used to send callers down a pointless
+ * perfectly healthy gateway reports "restart failed" - which used to send callers down a pointless
  * stop+start that raced the migration lease all over again.
  */
 /**
- * Docker projects replay the idempotent config migrations on every container start — the
+ * Docker projects replay the idempotent config migrations on every container start - the
  * entrypoint embeds contextDefaultsScript. Native projects have no entrypoint, so an existing
  * native bot never received those fixes (a bot created before 5.16.0 kept the smart-route
  * contextWindow at 200000 and stayed exposed to the compaction deadlock). Replaying the exact
@@ -3078,9 +3182,9 @@ async function runNativeConfigMigrations(projectDir) {
  * OpenClaw 2026.9 từ chối khởi động khi workspace còn ở dạng cũ:
  *   "Gateway failed to start: Legacy workspace setup state requires migration for
  *    …/workspace-<agent>; run openclaw doctor --fix."
- * Đo trên vps_thuy-le 07/09 — bot chết cho tới khi chạy tay `doctor --fix`. Việc dọn này chỉ
+ * Đo trên vps_thuy-le 07/09 - bot chết cho tới khi chạy tay `doctor --fix`. Việc dọn này chỉ
  * OpenClaw biết cách làm, nên gọi thẳng nó trước mỗi lần (re)start thay vì tự đoán rồi sửa mò.
- * Chỉ chạy trên 2026.9+ (bản cũ không có phép migrate đó), và lỗi ở đây KHÔNG chặn boot —
+ * Chỉ chạy trên 2026.9+ (bản cũ không có phép migrate đó), và lỗi ở đây KHÔNG chặn boot -
  * gateway vẫn được thử khởi động, cùng lắm là báo đúng lỗi cũ.
  */
 async function runOpenclawDoctorFixIfNeeded(projectDir) {
@@ -3094,8 +3198,52 @@ async function runOpenclawDoctorFixIfNeeded(projectDir) {
   }
 }
 
+/**
+ * Restart the gateway on Windows the way the double-click launcher starts it.
+ *
+ * Stops the running gateway process, then relaunches `gateway-start.cmd` through `run-hidden.vbs`
+ * - the exact pair "1 - KHOI DONG BOT" uses, so the gateway lands in the operator's own desktop
+ * session with no console window. Returns true only once the port answers again: a restart that
+ * silently left the bot down is the failure this whole function exists to avoid.
+ */
+async function restartWindowsGateway(projectDir) {
+  const vbs = join(projectDir, 'run-hidden.vbs');
+  const cmd = join(projectDir, 'gateway-start.cmd');
+  // The launchers are rewritten on every start, but a project from an older build may not have
+  // them yet. Write them now rather than failing - they are the supported way in on Windows.
+  if (!existsSync(vbs) || !existsSync(cmd)) {
+    const meta = readNativeMeta(projectDir) || {};
+    await writeWindowsLaunchers(
+      projectDir,
+      meta.gatewayPort || state.gatewayPort || NATIVE_DEFAULT_GATEWAY_PORT,
+      meta.routerPort || state.routerPort || NATIVE_DEFAULT_ROUTER_PORT,
+    ).catch((e) => sendLog(`[native] không tạo được launcher: ${e.message}`));
+  }
+  if (!existsSync(vbs) || !existsSync(cmd)) return false;
+
+  const meta = readNativeMeta(projectDir) || {};
+  const port = meta.gatewayPort || state.gatewayPort || NATIVE_DEFAULT_GATEWAY_PORT;
+  await runCapture('powershell', ['-NoProfile', '-Command',
+    "Get-CimInstance Win32_Process -Filter \"Name='node.exe'\" | Where-Object { $_.CommandLine -like '*openclaw*gateway --port*' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -EA SilentlyContinue }"],
+    { shell: false, timeout: 20000 }).catch(() => {});
+  // Give the socket time to be released, or the new gateway loses the port to its own corpse.
+  for (let i = 0; i < 10 && (await portStatus(port)) === 'online'; i++) {
+    await new Promise((r) => setTimeout(r, 1000));
+  }
+  startDetached('wscript.exe', [vbs, cmd], { cwd: projectDir });
+  for (let i = 0; i < 45; i++) {
+    await new Promise((r) => setTimeout(r, 2000));
+    if ((await portStatus(port)) === 'online') {
+      sendLog(`[native] Bot đã khởi động lại (cổng ${port}).`);
+      return true;
+    }
+  }
+  sendLog(`[native] Bot chưa lên lại sau 90s (cổng ${port}).`);
+  return false;
+}
+
 async function restartNativeRuntime(projectDir) {
-  // Every restart is a chance to repair a project installed before these fixes existed — the
+  // Every restart is a chance to repair a project installed before these fixes existed - the
   // calls are no-ops once the service env is complete, stray files are adopted, and the config
   // already carries the migrated defaults.
   await adoptStrayNativeHome(projectDir).catch(() => {});
@@ -3109,6 +3257,18 @@ async function restartNativeRuntime(projectDir) {
   };
   let res;
   if (process.platform === 'win32') {
+    // `openclaw daemon` cannot touch the gateway on Windows. It manages a Scheduled Task, and it
+    // refuses to create one for our layout at all: "service management skipped: non-default state
+    // dir or config path" (the project keeps its state in <project>\.openclaw, not the account
+    // home). So `daemon stop` + `daemon start` both report success against a service that does not
+    // exist, while the real gateway - started by "1 - KHOI DONG BOT" as a plain hidden process -
+    // keeps running untouched. Measured on a customer machine: `daemon status` said
+    // "Runtime: stopped · Service unit not found" while the port was demonstrably listening, and
+    // the dashboard's Restart button silently did nothing, so a config change never took effect.
+    // Restart it the same way the launcher starts it instead.
+    const restarted = await restartWindowsGateway(projectDir);
+    if (restarted) return;
+    sendLog('[native] Không khởi động lại được bằng launcher, thử qua daemon.');
     res = await stopStart();
   } else {
     res = await ocDaemon(projectDir, 'restart');
@@ -3122,14 +3282,14 @@ async function restartNativeRuntime(projectDir) {
   const deadline = migrationLeaseDeadline(res.text);
   if (deadline) {
     const waitMs = Math.max(0, Math.min(deadline - Date.now(), 300000)) + 3000;
-    sendLog(`[native] Startup migrations hold the state lease — waiting ${Math.ceil(waitMs / 1000)}s before retrying.`);
+    sendLog(`[native] Startup migrations hold the state lease - waiting ${Math.ceil(waitMs / 1000)}s before retrying.`);
     await new Promise((r) => setTimeout(r, waitMs));
     res = await ocDaemon(projectDir, 'restart');
     if (res.code !== 0) res = await stopStart();
   }
   // With the start limit lifted (hardenNativeServiceRestarts) systemd really does keep restarting a
   // crash-looping unit every RestartSec, so a gateway blocked by a lease we never saw still comes up
-  // on its own — give it the full lease window before calling the restart a failure.
+  // on its own - give it the full lease window before calling the restart a failure.
   if (!(await waitForNativeGatewayHealthy(projectDir, NATIVE_GATEWAY_HEALTH_TIMEOUT_MS))) {
     throw new Error('gateway did not answer /health after restart');
   }
@@ -3140,7 +3300,7 @@ async function restartNativeRuntime(projectDir) {
  * Make the generated service carry everything nativeEnv() promises.
  *
  * `openclaw daemon install` propagates only a fixed allow-list into the service it writes:
- * OPENCLAW_STATE_DIR survives, but OPENCLAW_HOME does NOT — verified on both a systemd user unit and
+ * OPENCLAW_STATE_DIR survives, but OPENCLAW_HOME does NOT - verified on both a systemd user unit and
  * a launchd env-wrapper. Anything resolving paths from OPENCLAW_HOME then falls back to `~/.openclaw`
  * and writes OUTSIDE the project. zalo-connect is the visible casualty: it stages inbound files and
  * its Zalo session credentials under the wrong home, so a PDF sent to the bot lands somewhere the
@@ -3204,7 +3364,7 @@ async function syncNativeServiceEnv(projectDir) {
  * Reunite a native project with the files an unset OPENCLAW_HOME scattered into `~/.openclaw`.
  *
  * This MUST run before syncNativeServiceEnv takes effect: once OPENCLAW_HOME is finally correct, the
- * plugin looks for its Zalo session inside the project — and if the credentials are still sitting in
+ * plugin looks for its Zalo session inside the project - and if the credentials are still sitting in
  * the home directory it finds nothing and demands a fresh QR login. Copy (never move) so a failed
  * run leaves the working original in place; skip anything the project already has.
  */
@@ -3234,7 +3394,7 @@ async function adoptStrayNativeHome(projectDir) {
 
 /**
  * `openclaw daemon install` has no `--system` flag, so on Linux the gateway becomes a systemd USER
- * unit — and a user manager without linger is torn down when that user's last session exits. On a
+ * unit - and a user manager without linger is torn down when that user's last session exits. On a
  * desktop the graphical session holds it open, which is why this never showed up on macOS or a
  * Linux desktop; on a VPS the bot dies the moment the operator closes SSH and never comes back
  * after a reboot. Linger is what makes a user unit behave like the `restart: always` container it
@@ -3249,7 +3409,7 @@ async function ensureSystemdLinger() {
   if (/Linger=yes/i.test(cur.stdout || '')) return true;
   const out = await runCapture('loginctl', ['enable-linger', user], { shell: false, timeout: 20000 });
   if (out.code === 0) {
-    sendLog(`[native] systemd linger enabled for "${user}" — the gateway now survives logout and reboot.`);
+    sendLog(`[native] systemd linger enabled for "${user}" - the gateway now survives logout and reboot.`);
     return true;
   }
   sendLog(`[native] WARNING: could not enable systemd linger for "${user}" (${(out.stderr || out.stdout || '').trim() || `exit ${out.code}`}).`);
@@ -3262,7 +3422,7 @@ async function ensureSystemdLinger() {
  *
  * `openclaw daemon install` writes `StartLimitBurst=5` / `StartLimitIntervalSec=60` next to
  * `Restart=always`. The gateway's startup migrations take a lease on the state directory that lasts
- * five minutes, and a boot that collides with it exits 1 *immediately* — so five collisions burn the
+ * five minutes, and a boot that collides with it exits 1 *immediately* - so five collisions burn the
  * whole limit in 30 seconds, systemd logs "Start request repeated too quickly", and the unit stays
  * dead for good even though the lease frees itself minutes later. Verified on a fresh Ubuntu 24.04
  * VPS (2026-08-28): the setup UI sat on "Waiting for gateway on 18789..." until it timed out, while
@@ -3277,7 +3437,7 @@ async function hardenNativeServiceRestarts(projectDir) {
   const dir = join(os.homedir(), '.config', 'systemd', 'user', `${unit}.d`);
   const file = join(dir, '99-openclaw-setup.conf');
   const body = [
-    '# Written by openclaw-setup — regenerated on every install, do not edit.',
+    '# Written by openclaw-setup - regenerated on every install, do not edit.',
     '# Startup migrations hold the state lease for ~5 minutes and a colliding boot exits at once, so',
     '# the stock StartLimitBurst=5/StartLimitIntervalSec=60 abandons the unit for good within 30s.',
     '# No start limit = systemd keeps retrying every RestartSec until the lease frees itself.',
@@ -3297,7 +3457,7 @@ async function hardenNativeServiceRestarts(projectDir) {
 
 /**
  * A unit parked at "Start request repeated too quickly" refuses every later `start` until its
- * failure is cleared — including the one that would finally succeed. Cheap and idempotent, so it
+ * failure is cleared - including the one that would finally succeed. Cheap and idempotent, so it
  * runs before each start and also repairs a project abandoned by an earlier install.
  */
 async function clearNativeServiceFailure(projectDir) {
@@ -3315,7 +3475,7 @@ async function clearNativeServiceFailure(projectDir) {
  *
  * The trap this exists for: an operator runs the port-forward command out of `ssh <host>-setup`
  * (`ssh -L 18789:127.0.0.1:18789 root@<host>`) while already logged INTO that host instead of from
- * their own machine. ssh binds 18789 locally and forwards it to 18789 on the same box — a self-loop
+ * their own machine. ssh binds 18789 locally and forwards it to 18789 on the same box - a self-loop
  * that accepts every connection and answers nothing. The gateway can then never bind its port, and
  * health probes hang instead of failing, so the port looks alive and is useless. Seen on a customer
  * VPS 2026-08-28. `ss` (iproute2) is used on Linux rather than `lsof`, which a minimal Ubuntu lacks.
@@ -3343,7 +3503,7 @@ async function describePortHolder(port) {
  *
  * Three causes, all indistinguishable from "still booting" without this: an ssh port-forward
  * self-loop holding the port (describePortHolder), the migration lease plus systemd's start limit
- * leaving the unit dead for good (hardenNativeServiceRestarts), or an ordinary crash on boot — for
+ * leaving the unit dead for good (hardenNativeServiceRestarts), or an ordinary crash on boot - for
  * which the unit's own journal is the only thing that ever says so.
  */
 async function reportNativeGatewayBlockage(projectDir, port) {
@@ -3351,7 +3511,7 @@ async function reportNativeGatewayBlockage(projectDir, port) {
   if (holder) {
     sendLog(`[native] Port ${port} is already held by → ${holder}`);
     if (/(^|\/|\s)ssh(\s|$)/.test(holder) && new RegExp(`-L\\s*\\d*:?${port}:`).test(holder)) {
-      sendLog(`[native] That is an SSH port-forward, not the gateway. \`ssh -L ${port}:...\` belongs on YOUR OWN machine — run it on the server and it steals port ${port} from the gateway and answers nothing. Kill that ssh process on the server, then start the gateway again.`);
+      sendLog(`[native] That is an SSH port-forward, not the gateway. \`ssh -L ${port}:...\` belongs on YOUR OWN machine - run it on the server and it steals port ${port} from the gateway and answers nothing. Kill that ssh process on the server, then start the gateway again.`);
     }
   }
   if (process.platform !== 'linux' || !isNativeProject(projectDir)) return;
@@ -3369,14 +3529,14 @@ async function reportNativeGatewayBlockage(projectDir, port) {
  * A container reinstalls its missing plugins on every boot; a native project has no entrypoint, so
  * nothing ever put zalo-connect or learning-memory on disk. The generated config declares both
  * anyway (bot-config-gen writes plugins.entries + allow + slots.contextEngine), so without this the
- * gateway boots with "plugin not found" warnings, `channels.zalo-connect` has no owner — Zalo login
- * fails with `Unsupported channel "zalo-connect"` — and the bot silently runs with no context
+ * gateway boots with "plugin not found" warnings, `channels.zalo-connect` has no owner - Zalo login
+ * fails with `Unsupported channel "zalo-connect"` - and the bot silently runs with no context
  * engine at all. Same set and same skip-if-present cheapness as ensure_plugin.
  */
 async function ensureNativePlugins(projectDir, { restart = false } = {}) {
   if (!isNativeProject(projectDir)) return [];
   // Same cleanup the container entrypoint does (docker-gen.js): an interrupted `plugins install`
-  // leaves extensions/.openclaw-install-stage-XXXXXX behind, and it still carries a plugin manifest —
+  // leaves extensions/.openclaw-install-stage-XXXXXX behind, and it still carries a plugin manifest -
   // so the gateway logs "duplicate plugin id detected" every boot and a stale build competes with the
   // real one for the same id. Native has no entrypoint, so it has to happen here.
   const extRoot = join(projectDir, '.openclaw', 'extensions');
@@ -3392,7 +3552,7 @@ async function ensureNativePlugins(projectDir, { restart = false } = {}) {
   const wanted = new Set(['learning-memory']);
   if (cfg?.channels?.[ZALO_CHANNEL_ID] || cfg?.plugins?.entries?.[ZALO_PLUGIN_ID]) wanted.add(ZALO_PLUGIN_ID);
   // openclaw >=2026.8 unbundled duckduckgo AND refuses to report ready while the config
-  // declares a plugin that lacks capability consent — the docker entrypoint ensures it,
+  // declares a plugin that lacks capability consent - the docker entrypoint ensures it,
   // native must too (measured 03/09/2026: fresh install crash-looped on this).
   if (cfg?.plugins?.entries?.duckduckgo) wanted.add('duckduckgo');
   const installed = [];
@@ -3405,7 +3565,7 @@ async function ensureNativePlugins(projectDir, { restart = false } = {}) {
     const text = `${out.stdout || ''}\n${out.stderr || ''}`;
     for (const line of text.split(/\r?\n/).map((l) => l.trimEnd()).filter(Boolean)) sendLog(`[native] ${line}`);
     if (existsSync(dir) || /installed plugin/i.test(text)) installed.push(id);
-    else sendLog(`[native] WARNING: could not install plugin ${id} — the bot will run without it.`);
+    else sendLog(`[native] WARNING: could not install plugin ${id} - the bot will run without it.`);
   }
   if (installed.length && restart) {
     sendLog(`[native] Restarting gateway to load: ${installed.join(', ')}`);
@@ -3454,7 +3614,7 @@ async function probeHttpOk(url, timeoutMs = 2000) {
 /**
  * Start 9router for a native project. Bound to loopback on purpose: openclaw talks to it over
  * localhost (see get9RouterBaseUrl), so exposing the LLM proxy on 0.0.0.0 would only create an
- * open relay — on a VPS that is a real risk. Data lives in the project so projects stay separate.
+ * open relay - on a VPS that is a real risk. Data lives in the project so projects stay separate.
  */
 async function startNative9Router(projectDir, { restart = false } = {}) {
   const meta = readNativeMeta(projectDir) || {};
@@ -3469,7 +3629,7 @@ async function startNative9Router(projectDir, { restart = false } = {}) {
     return routerPort;
   }
   // Linux: run 9router as a systemd USER unit, not a detached child. startDetached leaves the
-  // process inside THIS server's cgroup — restarting the setup-ui service (or rebooting the VPS)
+  // process inside THIS server's cgroup - restarting the setup-ui service (or rebooting the VPS)
   // silently killed 9router and the bot lost its model (measured on vps_c-thu, 02/09/2026).
   // macOS/Windows keep the detached process: no deployed native host runs there yet, and each
   // would need its own service wrapper (launchd/Task Scheduler).
@@ -3520,12 +3680,12 @@ async function installNative9RouterUnit(projectDir, routerPort, dataDir) {
 
 /**
  * openclaw 2026.8.x `daemon install` only manages the service when the state dir is the
- * canonical <account home>/.openclaw — a custom OPENCLAW_HOME is refused, and its fs-safe
+ * canonical <account home>/.openclaw - a custom OPENCLAW_HOME is refused, and its fs-safe
  * layer refuses atomic writes through a symlinked state dir ("parent must be a real
  * directory"). Measured on vps_c-thu 02/09/2026. So for 2026.8+ the REAL state lives at
  * ~/.openclaw and <project>/.openclaw becomes a symlink to it (junction on Windows, so no
  * admin rights needed). nativeEnv() realpaths the symlink, so every other CLI call keeps
- * working. One native project per OS account — which is how every deployed host runs.
+ * working. One native project per OS account - which is how every deployed host runs.
  * Returns the env for `daemon install` (plain HOME, no OPENCLAW_* overrides), or null when
  * the runtime is older than 2026.8 and nothing should change.
  */
@@ -3546,7 +3706,7 @@ async function prepareNativeStateHome(projectDir) {
     try {
       if (resolve(fs.realpathSync(projState)) === resolve(homeState)) return installEnv;
     } catch {}
-    throw new Error(`${projState} là symlink nhưng không trỏ về ${homeState} — kiểm tay trước khi cài service`);
+    throw new Error(`${projState} là symlink nhưng không trỏ về ${homeState} - kiểm tay trước khi cài service`);
   }
   const homeExists = existsSync(homeState) || (() => { try { fs.lstatSync(homeState); return true; } catch { return false; } })();
   if (homeExists) {
@@ -3555,8 +3715,8 @@ async function prepareNativeStateHome(projectDir) {
       // Reverse layout from an earlier hand-fix attempt: drop the link, the real dir moves in below.
       fs.unlinkSync(homeState);
     } else if (existsSync(join(homeState, 'openclaw.json'))) {
-      // A real, populated state dir that is not this project's — do not touch someone's data.
-      throw new Error(`${homeState} đã chứa state của một project khác — 2026.8 chỉ hỗ trợ MỘT project native mỗi tài khoản`);
+      // A real, populated state dir that is not this project's - do not touch someone's data.
+      throw new Error(`${homeState} đã chứa state của một project khác - 2026.8 chỉ hỗ trợ MỘT project native mỗi tài khoản`);
     } else {
       // Stray/partial dir (stale CLI runs create these): park it, keep nothing in the way.
       const parked = `${homeState}.bak-stray-${Date.now()}`;
@@ -3574,8 +3734,8 @@ async function prepareNativeStateHome(projectDir) {
  * Turn OpenClaw's real computer-use on or off for a project.
  *
  * Three pieces must line up, and a bot with only two of them reports "I don't have permission"
- * without saying which one is missing — that ambiguity cost a whole debugging session:
- *   1. `computer` (+ `screen`) allowed in tools.alsoAllow — otherwise the agent never receives
+ * without saying which one is missing - that ambiguity cost a whole debugging session:
+ *   1. `computer` (+ `screen`) allowed in tools.alsoAllow - otherwise the agent never receives
  *      the tool at all, no matter what else is configured;
  *   2. the `cua-computer` plugin, which is MANDATORY on Windows and ships disabled. It also has
  *      to be on plugins.allow, or enabling is refused with "blocked by allowlist";
@@ -3583,11 +3743,17 @@ async function prepareNativeStateHome(projectDir) {
  *      model-facing surface; the node is what actually touches the screen, which is why a
  *      correctly configured tool still does nothing on its own.
  *
- * The node host must run inside a real interactive desktop session — started from a service or
+ * The node host must run inside a real interactive desktop session - started from a service or
  * an SSH session it either dies with the session or cannot see a desktop at all. Launching it
  * from here works because the operator pressing the button is sitting at that desktop.
  */
 async function setComputerUse(projectDir, enable) {
+  // Docker is retired, and the node host has to touch a real desktop, so this only makes sense
+  // on a native project. Say so plainly instead of half-applying and leaving the operator to
+  // wonder why the bot still refuses.
+  if (!isNativeProject(projectDir)) {
+    return { ok: false, error: 'Chỉ dùng được với bot chạy native (không phải Docker).' };
+  }
   const cfgPath = join(projectDir, '.openclaw', 'openclaw.json');
   if (!existsSync(cfgPath)) return { ok: false, error: 'openclaw.json not found' };
   const cfg = JSON.parse(await fsp.readFile(cfgPath, 'utf8'));
@@ -3601,43 +3767,265 @@ async function setComputerUse(projectDir, enable) {
   if (enable) {
     allow.add('computer');
     allow.add('screen');
+    // Without this, `plugins enable` is refused outright with "blocked by allowlist".
     if (!cfg.plugins.allow.includes('cua-computer')) cfg.plugins.allow.push('cua-computer');
     cfg.plugins.entries['cua-computer'] = { ...(cfg.plugins.entries['cua-computer'] || {}), enabled: true };
+    // A fourth gate nobody sees until they hit it: the gateway keeps a per-platform allowlist of
+    // node commands. `computer.act` counts as a dangerous default and `screen.snapshot` as a
+    // desktop-host command, so BOTH are stripped from the defaults and the invoke is refused with
+    // `"screen.snapshot" is not in the allowlist for platform "windows"` - even though the plugin
+    // is enabled and the node is paired and approved. Only gateway.nodes.commands.allow puts them
+    // back (it is applied after the dangerous-command filter).
+    cfg.gateway = (cfg.gateway && typeof cfg.gateway === 'object') ? cfg.gateway : {};
+    cfg.gateway.nodes = (cfg.gateway.nodes && typeof cfg.gateway.nodes === 'object') ? cfg.gateway.nodes : {};
+    cfg.gateway.nodes.commands = (cfg.gateway.nodes.commands && typeof cfg.gateway.nodes.commands === 'object')
+      ? cfg.gateway.nodes.commands : {};
+    const nodeAllow = new Set(Array.isArray(cfg.gateway.nodes.commands.allow) ? cfg.gateway.nodes.commands.allow : []);
+    nodeAllow.add('screen.snapshot');
+    nodeAllow.add('computer.act');
+    cfg.gateway.nodes.commands.allow = [...nodeAllow];
   } else {
     allow.delete('computer');
     allow.delete('screen');
     if (cfg.plugins.entries['cua-computer']) cfg.plugins.entries['cua-computer'].enabled = false;
+    const nodeAllow = cfg.gateway?.nodes?.commands?.allow;
+    if (Array.isArray(nodeAllow)) {
+      cfg.gateway.nodes.commands.allow = nodeAllow.filter((c) => c !== 'screen.snapshot' && c !== 'computer.act');
+    }
+    // Leave the allowlist clean too, so a later re-enable is a deliberate act rather than a
+    // leftover permission nobody remembers granting.
+    cfg.plugins.allow = cfg.plugins.allow.filter((x) => x !== 'cua-computer');
   }
   cfg.tools.alsoAllow = [...allow];
   await fsp.writeFile(cfgPath, JSON.stringify(cfg, null, 2) + '\n', 'utf8');
 
   if (!enable) {
     await stopNodeHost().catch(() => {});
-    sendLog('[computer-use] Đã tắt: gỡ tool computer/screen và dừng node điều khiển.');
+    await restartNativeRuntime(projectDir).catch(() => {});
+    sendLog('[computer-use] Đã tắt: gỡ tool computer/screen, tắt plugin và dừng node điều khiển.');
     return { ok: true, enabled: false };
   }
 
-  sendLog('[computer-use] Đã bật tool computer + plugin cua-computer. Đang khởi động node điều khiển...');
+  // The gateway reads plugins and the tool allowlist at boot. openclaw itself says "Restart the
+  // gateway to apply" when a plugin is enabled - skip this and the switch reports success while
+  // the bot still has no computer tool, which is exactly the kind of silent half-success that
+  // sends the owner back to us.
+  sendLog('[computer-use] Đã bật tool computer + plugin cua-computer. Đang khởi động lại bot để nạp...');
+  // Stop the node host FIRST. Restarting the gateway drops its socket, and on some closes the node
+  // gives up with "reconnect paused ... exiting for supervisor restart" - there is no supervisor
+  // here, so it would sit dead while everything else looked fine. Start it fresh afterwards.
+  await stopNodeHost().catch(() => {});
+  await restartNativeRuntime(projectDir).catch((e) => sendLog(`[computer-use] restart: ${e.message}`));
+
   const meta = readNativeMeta(projectDir) || {};
   const port = meta.gatewayPort || state.gatewayPort || NATIVE_DEFAULT_GATEWAY_PORT;
+  // The node host cannot connect until the gateway is listening again.
+  let up = false;
+  for (let i = 0; i < 30; i++) {
+    if ((await portStatus(port)) === 'online') { up = true; break; }
+    await new Promise((r) => setTimeout(r, 2000));
+  }
+  if (!up) return { ok: false, error: `Bot chưa khởi động lại xong (cổng ${port}). Thử lại sau ít phút.` };
+
   await startNodeHost(projectDir, port);
-  return { ok: true, enabled: true, gatewayPort: port };
+  const running = await nodeHostRunning();
+  if (!running) return { ok: false, error: 'Đã bật quyền nhưng node điều khiển chưa chạy. Xem nhật ký để biết vì sao.' };
+
+  // The node registers its capability surface a moment after the socket opens, so the pending
+  // request is not there instantly. Give it a few rounds rather than approving once and hoping.
+  // The node publishes its capability surface a little after the socket opens, and the CUA driver
+  // is imported asynchronously on top of that, so the first look is expected to come up empty.
+  // Measured on a customer machine: connected and approved within seconds, capabilities visible
+  // roughly half a minute later. Checking a couple of times and giving up reports a working setup
+  // as broken, so wait properly.
+  let caps = await nodeHasComputerCaps(projectDir);
+  for (let i = 0; i < 20 && !caps; i++) {
+    await approvePendingNodes(projectDir).catch(() => {});
+    await new Promise((r) => setTimeout(r, 3000));
+    caps = await nodeHasComputerCaps(projectDir);
+  }
+  if (!caps) {
+    // Half-success, reported as such. Mở app và chạy lệnh đi đường `exec` nên vẫn dùng được bình
+    // thường; chỉ phần chụp/điều khiển màn hình là chưa. Trả ok:true để phần đã chạy được không bị
+    // báo thành hỏng - báo hỏng toàn bộ khiến người dùng tưởng mất luôn thứ đang chạy.
+    sendLog(`[computer-use] Node đã chạy nhưng chưa khai báo được khả năng màn hình. ${nodeCapsLastReason}`);
+    return {
+      ok: true,
+      enabled: true,
+      gatewayPort: port,
+      screenControl: false,
+      note: 'Bot mở ứng dụng và chạy lệnh trên máy được. Riêng chụp/điều khiển màn hình thì máy chưa '
+        + 'khai báo được khả năng này, nên tạm thời chưa dùng được.',
+    };
+  }
+  sendLog('[computer-use] Máy đã sẵn sàng: bot chụp màn hình, bấm chuột và gõ phím được.');
+  return { ok: true, enabled: true, gatewayPort: port, screenControl: true };
+}
+
+/**
+ * Read the gateway auth token out of the project config.
+ *
+ * The node host authenticates to the gateway over the same WebSocket everything else uses, and
+ * with `gateway.auth.mode: "token"` it is rejected before it can advertise anything:
+ *   `unauthorized: gateway token missing (provide gateway auth token)` -> exit code 1.
+ * Started detached, that failure is invisible: the process is simply gone a second later and the
+ * switch looks like it worked. Pass the token explicitly.
+ */
+function gatewayAuthToken(projectDir) {
+  try {
+    const cfg = JSON.parse(fs.readFileSync(join(projectDir, '.openclaw', 'openclaw.json'), 'utf8'));
+    const t = cfg?.gateway?.auth?.token;
+    return typeof t === 'string' && t ? t : '';
+  } catch { return ''; }
+}
+
+/**
+ * Give the node host a state dir of its own, holding nothing but what it needs.
+ *
+ * `openclaw node run` loads the plugins of whatever state dir it is pointed at. Point it at the
+ * bot's and it loads the bot's plugins too - including zalo-mod, which opens its dashboard port.
+ * The gateway already holds that port, so the node host dies on startup with
+ * `listen EADDRINUSE: address already in use 127.0.0.1:18790`, before it ever publishes
+ * `computer.act` / `screen.snapshot`. From the outside that is indistinguishable from "this
+ * machine cannot do computer use": the node appears paired and approved, yet advertises only the
+ * core capabilities. Measured on a customer machine, and it cost most of a day to see.
+ *
+ * A separate dir with only cua-computer enabled has no such plugin to collide with. The node still
+ * reaches the same gateway over loopback with the same token, so nothing else changes.
+ */
+async function prepareNodeHostHome(projectDir, gatewayPort) {
+  const home = join(projectDir, '.openclaw-node');
+  await fsp.mkdir(home, { recursive: true });
+  const cfg = {
+    gateway: {
+      port: Number(gatewayPort),
+      mode: 'local',
+      bind: 'loopback',
+      ...(gatewayAuthToken(projectDir) ? { auth: { mode: 'token', token: gatewayAuthToken(projectDir) } } : {}),
+    },
+    // Only the driver. Anything else here would be a plugin running twice on one machine.
+    plugins: { allow: ['cua-computer'], entries: { 'cua-computer': { enabled: true } } },
+  };
+  await fsp.writeFile(join(home, 'openclaw.json'), JSON.stringify(cfg, null, 2) + '\n', 'utf8');
+  return home;
 }
 
 /** Run `openclaw node run` detached so it outlives this request but stays in this desktop session. */
 async function startNodeHost(projectDir, gatewayPort) {
   if (await nodeHostRunning()) { sendLog('[computer-use] Node điều khiển đã chạy sẵn.'); return; }
-  const a = ocArgv(projectDir, ['node', 'run', '--host', '127.0.0.1', '--port', String(gatewayPort)]);
-  const child = spawn(a.cmd, a.args, { ...a.opts, detached: true, stdio: 'ignore', windowsHide: true });
-  child.on('error', (err) => sendLog(`[computer-use] không chạy được node host: ${err.message}`));
-  child.unref();
+  const token = gatewayAuthToken(projectDir);
+  if (!token) sendLog('[computer-use] Không đọc được gateway token - node có thể bị từ chối kết nối.');
+  // `--no-tls`: the gateway here is plain ws:// on loopback. Without it the node tries TLS and
+  // the handshake never completes.
+  const a = ocArgv(projectDir, ['node', 'run', '--host', '127.0.0.1', '--port', String(gatewayPort), '--no-tls']);
+  // Go through the same bin resolution + env merge as run()/runCapture(). Spawning `a.cmd` raw
+  // with only nativeEnv() drops PATH entirely, so on Windows `openclaw` does not even resolve.
+  const rawBin = resolveBinPath(a.cmd);
+  const shell = process.platform === 'win32';
+  const bin = shell && rawBin.includes(' ') && !rawBin.startsWith('"') ? `"${rawBin}"` : rawBin;
+  const nodeHome = await prepareNodeHostHome(projectDir, gatewayPort).catch((e) => {
+    sendLog(`[computer-use] không tạo được state riêng cho node: ${e.message}`);
+    return null;
+  });
+  if (process.platform === 'win32') {
+    // Node refuses to spawn the `openclaw.cmd` shim detached: `spawn EINVAL`, with nothing else
+    // logged. Go through the generated launcher and wscript, the same pair that starts the gateway
+    // here - it is the one shape proven to work on Windows, and it keeps the process in the
+    // operator's desktop session, which the screen driver requires.
+    await writeWindowsLaunchers(projectDir, gatewayPort,
+      (readNativeMeta(projectDir) || {}).routerPort || state.routerPort || NATIVE_DEFAULT_ROUTER_PORT)
+      .catch((e) => sendLog(`[computer-use] không ghi được launcher: ${e.message}`));
+    const vbs = join(projectDir, 'run-hidden.vbs');
+    const cmd = join(projectDir, 'node-host.cmd');
+    if (!existsSync(vbs) || !existsSync(cmd)) {
+      sendLog('[computer-use] thiếu node-host.cmd - không khởi động được node điều khiển.');
+      return;
+    }
+    startDetached('wscript.exe', [vbs, cmd], { cwd: projectDir });
+  } else {
+    const env = binEnv(rawBin, {
+      ...(a.opts.env || {}),
+      // Override the project's state dir: see prepareNodeHostHome for why sharing it kills the node.
+      ...(nodeHome ? { OPENCLAW_HOME: nodeHome, OPENCLAW_STATE_DIR: nodeHome } : {}),
+      ...(token ? { OPENCLAW_GATEWAY_TOKEN: token } : {}),
+    });
+    const child = spawn(bin, a.args, { cwd: a.opts.cwd, shell, env, detached: true, stdio: 'ignore', windowsHide: true });
+    child.on('error', (err) => sendLog(`[computer-use] không chạy được node host: ${err.message}`));
+    child.unref();
+  }
   // Confirm instead of assuming: a node host that failed to start looks exactly like one that
   // started, until the bot says it has no permission.
   for (let i = 0; i < 15; i++) {
     await new Promise((r) => setTimeout(r, 2000));
     if (await nodeHostRunning()) { sendLog('[computer-use] Node điều khiển đã kết nối.'); return; }
   }
-  sendLog('[computer-use] Node điều khiển chưa lên sau 30s — kiểm tra lại bằng `openclaw node status`.');
+  sendLog('[computer-use] Node điều khiển chưa lên sau 30s - kiểm tra lại bằng `openclaw node status`.');
+}
+
+/**
+ * Approve the node's capability surface.
+ *
+ * Connecting is not enough: the gateway parks the node's capability list as a pending pairing
+ * request and the node logs `node capability surface is awaiting operator approval` on a loop.
+ * Until someone approves it the node advertises nothing, so the bot answers "I don't have
+ * permission" even though every config key is right. The operator already consented by pressing
+ * the button, so approve it here instead of making them find a CLI id in a log file.
+ */
+async function approvePendingNodes(projectDir) {
+  const pending = await ocCapture(projectDir, ['nodes', 'pending'], { timeout: 20000 });
+  const text = `${pending.stdout || ''}\n${pending.stderr || ''}`;
+  const ids = [...new Set((text.match(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi) || []))];
+  if (!ids.length) return 0;
+  let done = 0;
+  for (const id of ids) {
+    const r = await ocCapture(projectDir, ['nodes', 'approve', id], { timeout: 20000 });
+    if (r.code === 0) { done++; sendLog(`[computer-use] Đã duyệt node ${id}.`); }
+    else sendLog(`[computer-use] Duyệt node ${id} không được: ${String(r.stderr || r.stdout || '').trim().slice(0, 200)}`);
+  }
+  return done;
+}
+
+/**
+ * Does the connected node actually offer screen control?
+ *
+ * A node can be connected and approved and still advertise only the core caps (file, system,
+ * browser...) when the CUA driver refuses to load - most often because the host was started
+ * outside an interactive desktop session. Checking the caps is the only way to tell a working
+ * setup from one that will fail on the first screenshot the owner asks for.
+ */
+let nodeCapsLastReason = '';
+
+async function nodeHasComputerCaps(projectDir) {
+  // Read JSON, never the table. `nodes status` renders a fixed-width table and wraps the Caps
+  // column, so a node that genuinely advertises "computer" and "screen" prints them as "comp" and
+  // "scre" across two rows - a text match on the table reports a working setup as broken, which is
+  // exactly what it did on a customer machine.
+  const r = await ocCapture(projectDir, ['nodes', 'status', '--json'], { timeout: 30000 });
+  const text = `${r.stdout || ''}`;
+  const start = text.indexOf('{');
+  if (start === -1) {
+    // Say what actually came back. "Not ready yet" and "the command failed" look identical from
+    // the outside, and guessing between them is what turns a five-minute fix into a long day.
+    nodeCapsLastReason = `không đọc được nodes status (exit ${r.code}): ${String(r.stderr || r.stdout || '').trim().slice(0, 160)}`;
+    return false;
+  }
+  let parsed;
+  try { parsed = JSON.parse(text.slice(start)); } catch (e) {
+    nodeCapsLastReason = `nodes status trả về dữ liệu không đọc được: ${e.message}`;
+    return false;
+  }
+  const nodes = Array.isArray(parsed?.nodes) ? parsed.nodes : [];
+  const ok = nodes.some((n) => {
+    const commands = Array.isArray(n?.commands) ? n.commands : [];
+    // Both halves or neither: the gateway only exposes Computer Use when the pair is effective.
+    return commands.includes('computer.act') && commands.includes('screen.snapshot');
+  });
+  if (!ok) {
+    nodeCapsLastReason = nodes.length
+      ? `node đã nối nhưng mới khai báo: ${(nodes[0].commands || []).join(', ') || '(chưa có lệnh nào)'}`
+      : 'gateway chưa thấy node nào';
+  }
+  return ok;
 }
 
 async function nodeHostRunning() {
@@ -3665,7 +4053,13 @@ async function stopNodeHost() {
  * install or update instead of leaving the customer pressing a stale copy.
  */
 async function writeWindowsLaunchers(projectDir, gatewayPort, routerPort) {
-  const files = buildWindowsLaunchers({ projectDir, gatewayPort, routerPort, setupPort: activeUiPort || 51789 });
+  // node-host.cmd needs the gateway token baked in: the node authenticates with it, and without
+  // one it exits within a second with `unauthorized: gateway token missing`.
+  const files = buildWindowsLaunchers({
+    projectDir, gatewayPort, routerPort,
+    setupPort: activeUiPort || 51789,
+    gatewayToken: gatewayAuthToken(projectDir),
+  });
   for (const [name, content] of Object.entries(files)) {
     await fsp.writeFile(join(projectDir, name), content, 'utf8');
   }
@@ -3685,11 +4079,11 @@ async function writeWindowsLaunchers(projectDir, gatewayPort, routerPort) {
  * file after an atomic rename. That check cannot pass through a Docker Desktop bind mount on
  * Windows, so the moment a docker image is rebuilt onto 2026.9.x the gateway can no longer write
  * its own config: every boot is unclean, the restart-loop breaker trips, and the bot is down with
- * a misleading "ENOENT: fstat". Measured end to end on win_kha, 09/09/2026 — native on the very
+ * a misleading "ENOENT: fstat". Measured end to end on win_kha, 09/09/2026 - native on the very
  * same NTFS path works, so the fault is the bind-mount layer, not the disk.
  *
  * The data lives in two different places and only one of them is visible on the host:
- * bind-mounted paths are already on disk, but named volumes are not — state (the sqlite DB with
+ * bind-mounted paths are already on disk, but named volumes are not - state (the sqlite DB with
  * every session), the plugin tree, and 9router's login live inside volumes. Copy those out FIRST;
  * everything after this point is reversible, the containers and image are left untouched.
  */
@@ -3698,11 +4092,11 @@ async function migrateDockerProjectToNative(projectDir, { osChoice = '' } = {})
   if (!existsSync(composeFile)) return false;
   sendLog('[migrate] Chuyển project từ Docker sang native...');
 
-  // 1. Stop the containers so nothing writes while we copy. Never `down -v` — that deletes the
+  // 1. Stop the containers so nothing writes while we copy. Never `down -v` - that deletes the
   //    very volumes holding the customer's sessions.
   await run('docker', ['compose', '-f', composeFile, 'stop']).catch(() => {});
   // Stopping is not enough: the containers carry a restart policy, so the next reboot brings them
-  // back and they grab 18789/18790 before the native gateway can bind — the native process then
+  // back and they grab 18789/18790 before the native gateway can bind - the native process then
   // dies with EADDRINUSE seconds after reporting "ready", which reads like a random crash.
   // Measured on win_kha after its first reboot, 10/09/2026. Clear the policy, keep the containers.
   const psAll = await runCapture('docker', ['compose', '-f', composeFile, 'ps', '-a', '--format', '{{.Name}}'], { shell: false });
@@ -3725,7 +4119,7 @@ async function migrateDockerProjectToNative(projectDir, { osChoice = '' } = {})
       let hostDir = null;
       if (dest.startsWith(`${CONTAINER_HOME}/`)) hostDir = join(projectDir, dest.slice(CONTAINER_HOME.length + 1));
       else if (dest === '/root/.9router' || dest.endsWith('/.9router')) hostDir = join(projectDir, '.9router');
-      if (!hostDir) { sendLog(`[migrate] bỏ qua volume ${volName} (${dest}) — không map được về project`); continue; }
+      if (!hostDir) { sendLog(`[migrate] bỏ qua volume ${volName} (${dest}) - không map được về project`); continue; }
       await fsp.mkdir(hostDir, { recursive: true });
       // Copy with a throwaway container: the volume has no host path we can read directly.
       const r = await runCapture('docker', [
@@ -3733,7 +4127,7 @@ async function migrateDockerProjectToNative(projectDir, { osChoice = '' } = {})
         'node:22-slim', 'sh', '-c', 'cp -a /__src/. /__dst/ 2>/dev/null; ls -A /__dst | head -1',
       ], { shell: false });
       if (r.stdout && r.stdout.trim()) { copied++; sendLog(`[migrate] ${volName} → ${hostDir}`); }
-      else sendLog(`[migrate] ${volName} rỗng hoặc không chép được — kiểm tra tay: ${hostDir}`);
+      else sendLog(`[migrate] ${volName} rỗng hoặc không chép được - kiểm tra tay: ${hostDir}`);
     }
   }
   sendLog(`[migrate] đã đưa ${copied} volume xuống đĩa.`);
@@ -3755,7 +4149,7 @@ async function migrateDockerProjectToNative(projectDir, { osChoice = '' } = {})
       //     /home/node/project so ".openclaw/workspace-x" resolved correctly. Native has no such
       //     guarantee: the customer double-clicks a launcher from wherever they filed it, and the
       //     agent then looks for its workspace under THAT folder and dies with WORKSPACE_VANISHED
-      //     — while agents that happen to carry an absolute path keep working, so only some bots
+      //     - while agents that happen to carry an absolute path keep working, so only some bots
       //     break. Exactly what happened when the launchers were moved into a Desktop subfolder
       //     (win_kha 10/09/2026). Pin every workspace to the project.
       {
@@ -3774,7 +4168,7 @@ async function migrateDockerProjectToNative(projectDir, { osChoice = '' } = {})
 
       // 3a-bis. Docker-only HOSTNAMES. `http://9router:20128` resolves through compose's internal
       //     DNS and nowhere else, so on native every model call dies with
-      //     `getaddrinfo ENOTFOUND 9router` — the bot still reacts (that is the channel, no model
+      //     `getaddrinfo ENOTFOUND 9router` - the bot still reacts (that is the channel, no model
       //     needed) but can never reply, which reads as "bot ignores me". Same story for
       //     host.docker.internal and the 192.168.65.x Desktop bridge. Measured win_kha 10/09/2026.
       text = text
@@ -3794,7 +4188,7 @@ async function migrateDockerProjectToNative(projectDir, { osChoice = '' } = {})
         sendLog('[migrate] gateway.bind → loopback (native bind thẳng lên host, 0.0.0.0 là mở ra mạng)');
       }
       // 3c. The browser-automation plugin rewrites the browser block on every boot, so simply
-      //     deleting the bad key below is not enough — it grows back and the config is invalid
+      //     deleting the bad key below is not enough - it grows back and the config is invalid
       //     again by the next restart (same shape as the old toolResultMaxChars reinfection).
       //     Take the pen away from it; patchDocker is pointless here now too.
       const baEntry = cfg.plugins && cfg.plugins.entries && cfg.plugins.entries['browser-automation'];
@@ -3818,7 +4212,7 @@ async function migrateDockerProjectToNative(projectDir, { osChoice = '' } = {})
     }
   }
 
-  // 4. Backup folders sitting inside extensions/ are still scanned as real plugins — that is where
+  // 4. Backup folders sitting inside extensions/ are still scanned as real plugins - that is where
   //    the long-standing "duplicate plugin id" warnings came from. A leading dot does NOT hide them
   //    on Windows, so move them out of the tree entirely.
   const extDir = join(projectDir, '.openclaw', 'extensions');
@@ -3833,7 +4227,7 @@ async function migrateDockerProjectToNative(projectDir, { osChoice = '' } = {})
   }
 
   // 5. zalo-connect wrote its Zalo sessions next to the container's HOME, which was itself
-  //    <project>/.openclaw — leaving them one level too deep. Lift them so 3.1.5's one-time
+  //    <project>/.openclaw - leaving them one level too deep. Lift them so 3.1.5's one-time
   //    migration finds them; without this every account comes back "not authenticated".
   const nested = join(projectDir, '.openclaw', '.openclaw');
   if (existsSync(nested)) {
@@ -3869,8 +4263,8 @@ async function startNativeRuntime({ projectDir, osChoice = '', gatewayPort, rout
 
   // Windows has no usable service story for this (see windows-launcher-gen.js): the Scheduled
   // Task openclaw installs is bound to a login session, so it dies with the SSH session and is
-  // refused outright when set to run at boot. Give the owner double-click launchers instead —
-  // the same shape as the .command files on macOS — and put the three they actually press on
+  // refused outright when set to run at boot. Give the owner double-click launchers instead -
+  // the same shape as the .command files on macOS - and put the three they actually press on
   // the Desktop where they can find them.
   if (process.platform === 'win32') {
     await writeWindowsLaunchers(projectDir, gwPort, rtPort).catch((e) => sendLog(`[native] launcher: ${e.message}`));
@@ -3899,12 +4293,12 @@ async function startNativeRuntime({ projectDir, osChoice = '', gatewayPort, rout
   await new Promise((r) => setTimeout(r, 8000));
   await applyResolved9RouterApiKey(projectDir).catch(() => {});
 
-  // Plugins BEFORE the gateway's first boot — the container entrypoint installs them ahead of the
+  // Plugins BEFORE the gateway's first boot - the container entrypoint installs them ahead of the
   // gateway for the same reason: a gateway that boots with its plugins already on disk loads them
   // straight away, needs no follow-up restart, and prints no "plugin not found" warnings.
   // Config migrations FIRST: `openclaw plugins install` validates the config, so a config
   // still carrying pre-2026.8 keys makes every plugin install fail before migrations ran
-  // (measured on a fresh native install, 03/09/2026 — learning-memory refused to install).
+  // (measured on a fresh native install, 03/09/2026 - learning-memory refused to install).
   await runNativeConfigMigrations(projectDir).catch(() => {});
 
   await ensureNativePlugins(projectDir).catch((e) => sendLog(`[native] plugin bootstrap skipped: ${e.message}`));
@@ -3926,8 +4320,8 @@ async function startNativeRuntime({ projectDir, osChoice = '', gatewayPort, rout
   await hardenNativeServiceRestarts(projectDir).catch((e) => sendLog(`[native] service hardening skipped: ${e.message}`));
   await clearNativeServiceFailure(projectDir).catch(() => {});
   // `daemon install` already STARTED the unit, and that first boot begins the state migrations that
-  // hold a five-minute lease on the state directory. This used to restart it right away — to pick up
-  // the env completed below — and the restart landed mid-migration: the lease was left behind, every
+  // hold a five-minute lease on the state directory. This used to restart it right away - to pick up
+  // the env completed below - and the restart landed mid-migration: the lease was left behind, every
   // following boot exited 1 until it expired, and systemd's start limit abandoned the unit long
   // before that. The setup UI then waited out its whole timeout on a service that was never coming
   // back (real Ubuntu 24.04 VPS, 2026-08-28). So let this boot finish UNDISTURBED first, and only
@@ -3943,7 +4337,7 @@ async function startNativeRuntime({ projectDir, osChoice = '', gatewayPort, rout
   if (envAdded.length || !firstBootOk) {
     sendLog(envAdded.length
       ? '[native] restarting gateway to load the completed service env'
-      : '[native] first boot never answered /health — restarting once to recover');
+      : '[native] first boot never answered /health - restarting once to recover');
     await restartNativeRuntime(projectDir).catch((e) => sendLog(`[native] restart after install: ${e.message}`));
   }
   sendLog(`[native] gateway service "${label}" running on 127.0.0.1:${gwPort}, 9router on 127.0.0.1:${rtPort}`);
@@ -3995,11 +4389,11 @@ async function syncDockerInfra(projectDir, force = false) {
   const compose = await readComposeText(projectDir);
 
   // If the compose was hand-customized (reverse-proxy/Traefik labels, an external network
-  // like `web`, or an explicit opt-out marker), DO NOT regenerate ANY infra file — a full
+  // like `web`, or an explicit opt-out marker), DO NOT regenerate ANY infra file - a full
   // docker-gen rewrite would wipe that routing (this once silently broke a live webhook).
   // Leave everything untouched; the version stamp stays old but each check just no-ops.
   if (/^\s*traefik\.|external:\s*true|openclaw-setup:\s*custom|openclaw-setup:keep/im.test(compose)) {
-    sendLog('[sync] Custom docker-compose.yml detected (Traefik/external network/keep marker) — leaving infra untouched to preserve your routing.');
+    sendLog('[sync] Custom docker-compose.yml detected (Traefik/external network/keep marker) - leaving infra untouched to preserve your routing.');
     return false;
   }
 
@@ -4049,7 +4443,7 @@ async function syncDockerInfra(projectDir, force = false) {
 
   sendLog(`[sync] Updating Docker infrastructure files (v${existingVersion} \u2192 v${SETUP_VERSION})`);
   await fsp.writeFile(join(dockerDir, 'Dockerfile'), docker.dockerfile, 'utf8');
-  // Capture the user's custom disk/folder mounts from the OLD compose before we overwrite it — a
+  // Capture the user's custom disk/folder mounts from the OLD compose before we overwrite it - a
   // full regen only re-emits the default volumes, so without this the bot loses granted drives.
   let carriedMounts = [];
   try {
@@ -4066,7 +4460,7 @@ async function syncDockerInfra(projectDir, force = false) {
       let cc = await fsp.readFile(join(dockerDir, 'docker-compose.yml'), 'utf8');
       if (!cc.includes(`:${dp}`)) {
         const gpStr = String(gatewayPort);
-        // Match the gateway published-port line whatever the host prefix is — the generated form is
+        // Match the gateway published-port line whatever the host prefix is - the generated form is
         // "127.0.0.1:<gw>:<gw>", so keying off the container port (":<gw>" before the quote) is the
         // only reliable anchor. The old `(?:\d+:)?` variant never matched the "127.0.0.1:" prefix.
         cc = cc.replace(
@@ -4098,13 +4492,13 @@ async function syncDockerInfra(projectDir, force = false) {
 }
 
 async function recreateDockerBot(projectDir) {
-  // Native: there is no image to rebuild — the gateway reads openclaw.json from disk on boot, so
+  // Native: there is no image to rebuild - the gateway reads openclaw.json from disk on boot, so
   // reloading config after a bot/plugin change is just a service restart. Callers stay unchanged.
   if (isNativeProject(projectDir)) {
     // Never restart a gateway that is still on its first boot: OpenClaw runs startup migrations
     // under a state lease, a restart mid-migration exits 1, and systemd's start limit can then
     // abandon the unit. This is the same trap the docker path avoids by waiting for the container
-    // before touching it (see startZaloConnectLogin) — wait for /health first.
+    // before touching it (see startZaloConnectLogin) - wait for /health first.
     await waitForNativeGatewayHealthy(projectDir, NATIVE_GATEWAY_HEALTH_TIMEOUT_MS);
     // The bot that was just created/edited may have added the Zalo channel or the context engine to
     // openclaw.json; put those plugins on disk now so this one reload loads them too.
@@ -4144,13 +4538,13 @@ async function updateRuntime(target, projectDir) {
     probeCacheClear();
     return { ok: true, target, spec, mode: 'native' };
   }
-  // A docker project asked to update is a docker project about to rebuild its image — which is
+  // A docker project asked to update is a docker project about to rebuild its image - which is
   // exactly the step that lands it on openclaw >=2026.9 and breaks writing through the bind mount
   // (see migrateDockerProjectToNative). So the update IS the migration: move the data onto native
   // first, then update the native way. Doing it here rather than on every page load keeps it a
   // deliberate act by the customer, not something that reshapes their machine behind their back.
   if (!isNativeProject(projectDir) && projectDir && existsSync(join(projectDir, 'docker', 'openclaw', 'docker-compose.yml'))) {
-    sendLog('[update] Project đang chạy Docker — chuyển sang native trước khi cập nhật.');
+    sendLog('[update] Project đang chạy Docker - chuyển sang native trước khi cập nhật.');
     await ensureNodeInstalled();
     await migrateDockerProjectToNative(projectDir, { osChoice: state.os || '' });
     await run('npm', ['install', '-g', OPENCLAW_NPM_SPEC]);
@@ -4201,7 +4595,7 @@ async function restartDockerBotContainer(projectDir = state.projectDir) {
   sendLog(`[docker] Restarting ${containerName} container...`);
   await run('docker', ['restart', containerName], { shell: false });
   await waitForDockerContainer(containerName);
-  // Restart may apply config/port changes — drop cached runtime/status for this project.
+  // Restart may apply config/port changes - drop cached runtime/status for this project.
   probeCacheClear(`runtime:${projectDir}`);
   return true;
 }
@@ -4253,7 +4647,7 @@ async function addBotMount(projectDir, hostPath, mountName = '') {
   // forward slashes on every OS, incl. `C:/Users/...`), drop trailing separators. This avoids
   // YAML backslash issues and keeps the path uniform.
   let cleanPath = String(hostPath || '').trim().replace(/\\+/g, '/').replace(/\/+$/, '');
-  // A bare Windows drive letter ("D:") is an INVALID Docker bind source — the trailing-slash strip
+  // A bare Windows drive letter ("D:") is an INVALID Docker bind source - the trailing-slash strip
   // above turns "D:/" into "D:". Restore the slash so mounting a whole drive (e.g. D:\) works.
   if (/^[a-zA-Z]:$/.test(cleanPath)) cleanPath += '/';
   if (!cleanPath) throw httpError(400, 'Đường dẫn ổ đĩa/thư mục đang trống');
@@ -4291,7 +4685,7 @@ async function addBotMount(projectDir, hostPath, mountName = '') {
 }
 
 // Sync a managed "granted mounts" block into every agent's AGENTS.md from the /mnt/* mounts in
-// docker-compose.yml (excludes /mnt/project — that's the project root, always mounted).
+// docker-compose.yml (excludes /mnt/project - that's the project root, always mounted).
 async function updateGrantedMountsInAgents(projectDir) {
   const cfgPath = join(projectDir, '.openclaw', 'openclaw.json');
   const composeFile = join(projectDir, 'docker', 'openclaw', 'docker-compose.yml');
@@ -4320,7 +4714,7 @@ async function updateGrantedMountsInAgents(projectDir) {
   const END = '<!-- granted-mounts:end -->';
   const block = mounts.length
     ? `${START}\n## 💽 Thư mục/ổ đĩa được cấp quyền (toàn project)\n`
-      + mounts.map((x) => `- \`${x.target}\` ← host \`${x.host}\` — bot được phép đọc/ghi tại đây.`).join('\n')
+      + mounts.map((x) => `- \`${x.target}\` ← host \`${x.host}\` - bot được phép đọc/ghi tại đây.`).join('\n')
       + `\n- Mặc định MỌI bot trong project đều dùng được các thư mục trên. Muốn giới hạn theo từng bot thì ghi rõ ngay dưới mục này.\n${END}`
     : '';
   const blockRe = new RegExp(`\\n*${START}[\\s\\S]*?${END}\\n*`);
@@ -4436,111 +4830,22 @@ async function getDockerBridgeIp() {
   } catch {}
   return '172.17.0.1';
 }
-// ── Host control ────────────────────────────────────────────────────────────────
-// The bot runs inside a container: it has no view of the host desktop and cannot start a
-// program there, which is why asking it to open TeamViewer gets a refusal. The installer,
-// though, already runs ON the host and already spawns processes (it launches Chrome). This
-// exposes that ability to the bot over a small HTTP service.
-//
-// Reachability: the dashboard itself binds to 127.0.0.1, which a container cannot reach, so
-// this listens on the Docker bridge address as well — the same approach the Chrome relay
-// uses, private to this machine and not routable from outside.
+// ── PC control ──────────────────────────────────────────────────────────────────
+// Letting the bot drive this machine is OpenClaw's `computer` + `screen` tools, nothing else.
+// Up to 5.17.1 the installer also ran a small HTTP service on 18795 that opened allow-listed apps
+// for the bot. It was removed: the tools do the job properly, and having a second, weaker path
+// beside them actively hurt. On a customer machine the bot kept answering "chưa có kết nối Host
+// Control" and never reached for the tools it already had.
 //
-// Everything is gated: the service only starts when hostControl.enabled is true, every
-// request needs the per-project token, and `open` accepts a key from the operator's own app
-// list rather than an arbitrary command line. Opening apps on the host is a real capability,
-// so it stays opt-in and enumerable instead of a general shell.
-const HOST_CONTROL_PORT = 18795;
-let _hostControlServer = null;
-// The project the running host-control service serves. Tracked separately from the server
-// singleton so enabling from a different (connected) project re-points the service without a
-// restart — the request handler reads config from THIS dir, not a value captured at first-start.
-let _hostControlProjectDir = null;
+// What is left is the switch itself, recorded per project in .openclaw/host-control.json.
 
 function hostControlConfigPath(projectDir) {
   return join(projectDir, '.openclaw', 'host-control.json');
 }
 
-/** Common install locations, so the app list is useful before anyone edits it. */
-function detectHostApps() {
-  const apps = {};
-  const add = (key, candidates) => {
-    for (const candidate of candidates) {
-      if (candidate && existsSync(candidate)) {
-        apps[key] = candidate;
-        return;
-      }
-    }
-  };
-  if (process.platform === 'win32') {
-    const pf = process.env['ProgramFiles'] || 'C:\\Program Files';
-    const pf86 = process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)';
-    const local = process.env.LOCALAPPDATA || join(os.homedir(), 'AppData', 'Local');
-    add('teamviewer', [join(pf, 'TeamViewer', 'TeamViewer.exe'), join(pf86, 'TeamViewer', 'TeamViewer.exe')]);
-    add('chrome', [join(pf, 'Google', 'Chrome', 'Application', 'chrome.exe'), join(pf86, 'Google', 'Chrome', 'Application', 'chrome.exe')]);
-    add('zalo', [join(local, 'Programs', 'Zalo', 'Zalo.exe'), join(local, 'Zalo', 'Zalo.exe')]);
-    add('explorer', ['C:\\Windows\\explorer.exe']);
-    add('notepad', ['C:\\Windows\\System32\\notepad.exe']);
-    // A hand-written shortlist only covers what WE thought of. Every customer machine has its
-    // own software, and the bot is useless the moment it is asked for something not on the list —
-    // "mở TeamViewer" fails not because the app is missing but because nobody enumerated it.
-    // The Start Menu is the one place Windows guarantees an entry per installed app, and a .lnk
-    // launches correctly without knowing where the .exe actually lives. Scanning it turns the
-    // list from "5 apps we guessed" into "everything this machine has", and it stays correct
-    // when the customer installs something new. Measured on win_kha: 5 → 182 apps.
-    Object.assign(apps, scanWindowsStartMenuApps(), apps); // hand-written entries win
-  } else if (process.platform === 'darwin') {
-    add('teamviewer', ['/Applications/TeamViewer.app']);
-    add('chrome', ['/Applications/Google Chrome.app']);
-    add('zalo', ['/Applications/Zalo.app']);
-    add('finder', ['/System/Library/CoreServices/Finder.app']);
-    // Same idea as Windows: enumerate what is really installed instead of guessing.
-    Object.assign(apps, scanMacApplications(), apps);
-  }
-  return apps;
-}
 
-/** Every .lnk under both Start Menu trees, keyed by a slug of its name. */
-function scanWindowsStartMenuApps() {
-  const apps = {};
-  // Uninstallers and doc links are not apps; opening one by accident is worse than not having it.
-  const SKIP = /(uninstall|gỡ cài đặt|go cai dat|readme|help|documentation|website|release notes|license|repair|modify)/i;
-  const roots = [
-    join(process.env.ProgramData || 'C:\\ProgramData', 'Microsoft', 'Windows', 'Start Menu', 'Programs'),
-    join(process.env.APPDATA || '', 'Microsoft', 'Windows', 'Start Menu', 'Programs'),
-  ];
-  const walk = (dir, depth = 0) => {
-    if (depth > 4) return;
-    let entries = [];
-    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
-    for (const e of entries) {
-      const p = join(dir, e.name);
-      if (e.isDirectory()) { walk(p, depth + 1); continue; }
-      if (!/\.lnk$/i.test(e.name)) continue;
-      const name = e.name.replace(/\.lnk$/i, '');
-      if (SKIP.test(name)) continue;
-      const key = slugify(name, '');
-      if (key && !apps[key]) apps[key] = p;
-    }
-  };
-  for (const r of roots) if (r) walk(r);
-  return apps;
-}
 
-/** Installed .app bundles, so macOS gets the same "everything on this machine" list. */
-function scanMacApplications() {
-  const apps = {};
-  for (const dir of ['/Applications', '/System/Applications', join(os.homedir(), 'Applications')]) {
-    let entries = [];
-    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { continue; }
-    for (const e of entries) {
-      if (!e.name.endsWith('.app')) continue;
-      const key = slugify(e.name.replace(/\.app$/, ''), '');
-      if (key && !apps[key]) apps[key] = join(dir, e.name);
-    }
-  }
-  return apps;
-}
+
 
 /** Resolve an executable on PATH synchronously (returns absolute path or ''). */
 function whichSync(name) {
@@ -4549,7 +4854,7 @@ function whichSync(name) {
     const out = execFileSync(finder, [name], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
     const hits = String(out).split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
     if (process.platform !== 'win32') return hits[0] || '';
-    // `where claude` lists the extensionless npm shim FIRST — a shell script Windows cannot spawn
+    // `where claude` lists the extensionless npm shim FIRST - a shell script Windows cannot spawn
     // ("spawn ...\\npm\\claude ENOENT"), which is how an allow-listed CLI ended up unusable for the
     // bot. Prefer something Windows can actually execute.
     const rank = (f) => {
@@ -4566,7 +4871,7 @@ function whichSync(name) {
 
 /**
  * What to actually spawn for an allow-listed command. Windows needs the indirection:
- *  - the path may be the extensionless npm shim (a shell script) — try the real siblings;
+ *  - the path may be the extensionless npm shim (a shell script) - try the real siblings;
  *  - a `.cmd`/`.bat` shim cannot be spawned without a shell on current Node, so read it and run
  *    what it points at (`…\pkg\bin\x.exe`, or node + a cli.js) directly.
  * Keeping shell:false matters: the bot supplies the arguments, and a shell would let one of them
@@ -4599,226 +4904,18 @@ function resolveHostExecutable(bin) {
   return { file: target, prefixArgs: [] };
 }
 
-/**
- * CLI tools the bot may RUN (not just open) via /api/host/exec — output is captured and
- * returned. Kept as a name→path allow-list, mirroring detectHostApps: the executable is fixed,
- * only allow-listed names run. Auto-detects Claude Code CLI; add more by editing
- * `.openclaw/host-control.json` → `commands`.
- */
-function detectHostCommands() {
-  const commands = {};
-  const claude = whichSync('claude');
-  if (claude) commands.claude = claude;
-  return commands;
-}
 
-/**
- * Extra capabilities the operator grants together with PC control: seeing the screen
- * (screenshot / screen recording) and running scripts through node or the Codex CLI.
- *
- * Kept out of detectHostCommands() on purpose. That one is the default list every project gets
- * as soon as the dashboard reads host-control state; these are only merged in when the operator
- * actually flips PC control on, so nothing is granted before they ask for it. `node` in
- * particular runs arbitrary code, which is why it takes an explicit act.
- */
-function detectHostCapabilityCommands() {
-  const commands = {};
-  // The installer is itself node, so this path is guaranteed to exist and to be the same
-  // interpreter the native bot runs under (the one macOS will attach the screen permission to).
-  commands.node = process.execPath;
-  for (const name of ['npx', 'codex', 'claude', 'ffmpeg']) {
-    const bin = whichSync(name);
-    if (bin) commands[name] = bin; // ffmpeg = screen recording on Linux/macOS
-  }
-  // The Codex CLI usually is not on PATH — it ships inside the desktop app. With it allow-listed
-  // the bot can hand a job to Codex headlessly (`codex exec "…"`) and read the answer back.
-  if (!commands.codex) {
-    const bundledCodex = resolveCodexCli(detectCodexApp());
-    if (bundledCodex) commands.codex = bundledCodex;
-  }
-  if (process.platform === 'darwin') {
-    // Both a screenshot (`-x`) and a screen recording (`-v -V <secs>`) tool.
-    if (existsSync('/usr/sbin/screencapture')) commands.screencapture = '/usr/sbin/screencapture';
-  } else if (process.platform === 'linux') {
-    for (const name of ['gnome-screenshot', 'spectacle', 'scrot', 'import']) {
-      const bin = whichSync(name);
-      if (bin) { commands.screenshot = bin; break; }
-    }
-  }
-  return commands;
-}
 
-/**
- * Merge the capability commands into the project's allow-list, and report what was added so the
- * dashboard can name it. Existing entries are left alone: an operator who pointed `node` at a
- * specific interpreter keeps that path.
- */
-function grantHostCapabilities(cfg) {
-  const detected = detectHostCapabilityCommands();
-  const added = [];
-  cfg.commands = cfg.commands || {};
-  for (const [name, bin] of Object.entries(detected)) {
-    if (!cfg.commands[name]) {
-      cfg.commands[name] = bin;
-      added.push(name);
-    }
-  }
-  // Desktop actions (/api/host/ui) come with the same grant: screenshot, pointer, keyboard,
-  // clipboard, windows. Built in, so they work on a machine with no Codex and no extra tools —
-  // on Linux they lean on xdotool/scrot, which the endpoint reports if missing.
-  if (cfg.ui !== true) {
-    cfg.ui = true;
-    added.push('desktop actions (screenshot/click/type)');
-  }
-  return added;
-}
-
-// Mouse/keyboard/screen control comes from the Codex desktop app's own `computer-use` plugin.
-// The bot reaches it by running `codex exec "<task>"`, which is a normal allow-listed command —
-// no OpenClaw-side harness, no second agent, no gateway restart. All this code has to do is make
-// sure the desktop app itself has computer-use installed and wired.
-//
-/** Where the desktop app that ships the Codex CLI + computer-use bundle lives. */
-function detectCodexApp() {
-  const candidates = process.platform === 'darwin'
-    ? [
-      { app: '/Applications/Codex.app', bundle: '/Applications/Codex.app/Contents/Resources/plugins/openai-bundled' },
-      { app: '/Applications/ChatGPT.app', bundle: '/Applications/ChatGPT.app/Contents/Resources/plugins/openai-bundled' },
-    ]
-    : process.platform === 'win32'
-      ? [
-        { app: join(process.env.LOCALAPPDATA || join(os.homedir(), 'AppData', 'Local'), 'Programs', 'Codex'), bundle: '' },
-        { app: join(process.env.LOCALAPPDATA || join(os.homedir(), 'AppData', 'Local'), 'Programs', 'ChatGPT'), bundle: '' },
-      ]
-      : [];
-  for (const candidate of candidates) {
-    if (existsSync(candidate.app)) {
-      return { present: true, app: candidate.app, bundle: candidate.bundle && existsSync(candidate.bundle) ? candidate.bundle : '' };
-    }
-  }
-  return { present: false, app: '', bundle: '' };
-}
 
-/**
- * Find a marketplace the Codex app-server has ALREADY registered that carries the computer-use
- * plugin, by reading its own `~/.codex/config.toml`.
- *
- * This matters because auto-install refuses to add new sources: pointing the plugin at a
- * marketplace directory it has not discovered fails with "auto-install only uses marketplaces
- * Codex app-server has already discovered … run /codex computer-use install". Naming a discovered
- * marketplace instead keeps provisioning fully automatic.
- */
-function detectCodexMarketplace() {
-  const codexHome = process.env.CODEX_HOME || join(getRealHomedir(), '.codex');
-  const configPath = join(codexHome, 'config.toml');
-  if (!existsSync(configPath)) return null;
-  let toml = '';
-  try {
-    toml = fs.readFileSync(configPath, 'utf8');
-  } catch (_) {
-    return null;
-  }
-  // Minimal line-based TOML read: [marketplaces.<name>] headers and their `source = "..."`. A full
-  // TOML parser is not worth pulling in for two fields of someone else's config.
-  let name = '';
-  for (const rawLine of toml.split(/\r?\n/)) {
-    const line = rawLine.trim();
-    const header = line.match(/^\[([^\]]+)\]$/);
-    if (header) {
-      const section = header[1];
-      name = section.startsWith('marketplaces.') ? section.slice('marketplaces.'.length).replace(/^["']|["']$/g, '') : '';
-      continue;
-    }
-    if (!name) continue;
-    const source = (line.match(/^source\s*=\s*"([^"]+)"$/) || [])[1];
-    if (source && existsSync(join(source, 'plugins', 'computer-use'))) return { name, source };
-  }
-  return null;
-}
 
-/** The Codex CLI that ships inside the desktop app (or one on PATH). */
-function resolveCodexCli(app) {
-  const bundled = app && app.app ? join(app.app, 'Contents', 'Resources', 'codex') : '';
-  if (bundled && existsSync(bundled)) return bundled;
-  return whichSync('codex');
-}
 
-/**
- * Last mile on the Codex side: the OpenClaw plugin can only USE computer-use, it cannot install it
- * into the desktop app. Two things have to be true there, and both are fixable with the app's own
- * CLI (verified on a real machine):
- *  - the `computer-use` plugin is installed from a discovered marketplace, and
- *  - the `computer-use` MCP server points at that installed plugin. A stale global entry (left by
- *    an earlier manual attempt) shadows the plugin's own and exposes zero tools, which surfaces as
- *    the confusing "Computer Use is ready" with nothing behind it.
- */
-async function ensureCodexComputerUsePlugin(app, marketplace) {
-  const result = { cli: resolveCodexCli(app), pluginInstalled: false, installedNow: false, mcpRepaired: false };
-  if (!result.cli || !marketplace) return result;
-  const list = await runCapture(result.cli, ['plugin', 'list'], { shell: false }).catch(() => null);
-  if (!list) return result;
-  const ref = `computer-use@${marketplace.name}`;
-  const row = `${list.stdout || ''}\n${list.stderr || ''}`.split(/\r?\n/).find((line) => line.trim().startsWith(ref));
-  if (!row) return result;
-  result.pluginInstalled = /\binstalled\b/.test(row) && !/not installed/.test(row);
-  if (!result.pluginInstalled) {
-    sendLog(`[computer-use] Cài plugin ${ref} vào app Codex…`);
-    const add = await runCapture(result.cli, ['plugin', 'add', ref], { shell: false }).catch((err) => ({ code: 1, stderr: err.message }));
-    result.installedNow = add.code === 0;
-    if (!result.installedNow) result.error = (add.stderr || add.stdout || '').trim().split(/\r?\n/).slice(-2).join(' ');
-    else result.pluginInstalled = true;
-  }
-  // Repair the MCP registration only when it clearly is NOT the plugin's own (its cwd lives under
-  // the plugin cache). Removing the global entry lets the plugin-provided server take over.
-  const mcp = await runCapture(result.cli, ['mcp', 'get', 'computer-use'], { shell: false }).catch(() => null);
-  const mcpText = mcp ? `${mcp.stdout || ''}${mcp.stderr || ''}` : '';
-  if (mcpText && !/plugins\/cache\//.test(mcpText)) {
-    sendLog('[computer-use] Gỡ khai báo MCP computer-use cũ (trỏ sai chỗ) để dùng bản của plugin…');
-    const removed = await runCapture(result.cli, ['mcp', 'remove', 'computer-use'], { shell: false }).catch(() => ({ code: 1 }));
-    result.mcpRepaired = removed.code === 0;
-  }
-  return result;
-}
 
-/**
- * Drop a tiny wrapper next to each workspace so GUI hand-off is one fixed command.
- *
- * Relying on the model to remember `--sandbox danger-full-access` does not work: a running session
- * still holds the TOOLS.md it loaded at session start, so a bot mid-conversation keeps calling
- * plain `codex exec`, gets "Computer Use was not approved to use <app>", and then invents a reason
- * (observed twice: it told the operator to grant Screen Recording, which was already granted).
- * With the wrapper the flags live on disk instead of in the prompt.
- */
-async function writeCodexTaskScript(projectDir, cliPath) {
-  const openclawDir = join(projectDir, '.openclaw');
-  if (!existsSync(openclawDir) || !cliPath) return '';
-  const body = [
-    '#!/bin/sh',
-    '# Managed by create-openclaw-bot — hand a desktop/GUI job to Codex and print its answer.',
-    '# Usage: pc-task.sh "mở TeamViewer và đọc ID trên màn hình"',
-    '# The sandbox flag is REQUIRED: the default read-only sandbox makes Codex refuse computer-use',
-    '# with "Computer Use was not approved to use <app>".',
-    'if [ $# -eq 0 ]; then echo "usage: pc-task.sh \\"việc cần làm\\"" >&2; exit 2; fi',
-    `exec ${JSON.stringify(cliPath)} exec --skip-git-repo-check --sandbox danger-full-access "$@"`,
-    '',
-  ].join('\n');
-  let written = '';
-  for (const entry of await fsp.readdir(openclawDir).catch(() => [])) {
-    if (!entry.startsWith('workspace')) continue;
-    const binDir = join(openclawDir, entry, 'bin');
-    await fsp.mkdir(binDir, { recursive: true }).catch(() => {});
-    const path = join(binDir, 'pc-task.sh');
-    await fsp.writeFile(path, body, 'utf8').catch(() => {});
-    await fsp.chmod(path, 0o755).catch(() => {});
-    written = path;
-  }
-  return written;
-}
+
 
 /**
  * macOS/Windows privacy panes for the permissions PC control needs. The OS never lets an app
  * grant these for you (that is the point of TCC), so the best we can do is take the operator
- * straight to the right pane and — for screen capture — poke the API so the system prompt appears.
+ * straight to the right pane and - for screen capture - poke the API so the system prompt appears.
  */
 function openPrivacyPane(kind) {
   const macPanes = {
@@ -4869,6 +4966,13 @@ async function probeScreenPermission() {
   return { supported: true, granted };
 }
 
+/**
+ * The on/off record for PC control. That is all it is now.
+ *
+ * It used to carry a token, an app allow-list and a command allow-list for a local HTTP service.
+ * The service is gone (OpenClaw's own `computer`/`screen` tools replaced it), so those fields have
+ * nothing left to gate. Old files keep them harmlessly; nothing reads them.
+ */
 async function readHostControlConfig(projectDir) {
   const path = hostControlConfigPath(projectDir);
   let cfg = {};
@@ -4877,24 +4981,8 @@ async function readHostControlConfig(projectDir) {
   } catch (_) {
     cfg = {};
   }
-  let changed = false;
   if (typeof cfg.enabled !== 'boolean') {
     cfg.enabled = false;
-    changed = true;
-  }
-  if (!cfg.token) {
-    cfg.token = _require('crypto').randomBytes(24).toString('hex');
-    changed = true;
-  }
-  if (!cfg.apps || typeof cfg.apps !== 'object') {
-    cfg.apps = detectHostApps();
-    changed = true;
-  }
-  if (!cfg.commands || typeof cfg.commands !== 'object') {
-    cfg.commands = detectHostCommands();
-    changed = true;
-  }
-  if (changed) {
     await fsp.mkdir(dirname(path), { recursive: true }).catch(() => {});
     await fsp.writeFile(path, JSON.stringify(cfg, null, 2), 'utf8').catch(() => {});
   }
@@ -4908,64 +4996,12 @@ function spawnDetached(command, args) {
   child.unref();
 }
 
-function openHostApp(target) {
-  if (process.platform === 'win32') {
-    // `start` needs a shell; the empty "" is the window title cmd expects before the path.
-    spawnDetached('cmd', ['/c', 'start', '', target]);
-    return;
-  }
-  if (process.platform === 'darwin') {
-    spawnDetached('open', [target]);
-    return;
-  }
-  spawnDetached('xdg-open', [target]);
-}
 
-/**
- * Run an allow-listed CLI (e.g. Claude Code) and return its output. Unlike openHostApp this is
- * NOT detached: we wait for it, capture stdout/stderr (capped), and enforce a timeout. No shell
- * (shell:false) so args are literal — no injection; the executable is fixed by the allow-list.
- */
-function runHostCommand(res, name, bin, args, input, timeoutMs) {
-  const MAX_OUT = 200_000; // ~200 KB cap per stream, so a runaway process can't flood the reply
-  return new Promise((resolveP) => {
-    let out = '';
-    let err = '';
-    let settled = false;
-    const finish = (payload, status) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      json(res, payload, status);
-      resolveP();
-    };
-    let child;
-    try {
-      const target = resolveHostExecutable(bin);
-      child = spawn(target.file, [...target.prefixArgs, ...args], { shell: false, windowsHide: true });
-    } catch (e) {
-      return finish({ ok: false, error: e.message }, 500);
-    }
-    const timer = setTimeout(() => {
-      try { child.kill('SIGKILL'); } catch (_) {}
-      finish({ ok: false, error: `timeout after ${timeoutMs}ms`, timedOut: true, stdout: out.slice(0, MAX_OUT), stderr: err.slice(0, MAX_OUT) }, 504);
-    }, timeoutMs);
-    child.stdout?.on('data', (d) => { if (out.length < MAX_OUT) out += d.toString(); });
-    child.stderr?.on('data', (d) => { if (err.length < MAX_OUT) err += d.toString(); });
-    child.on('error', (e) => finish({ ok: false, error: e.message }, 500));
-    child.on('close', (code) => {
-      sendLog(`[host-control] Đã chạy "${name}" (exit ${code}).`);
-      finish({ ok: code === 0, command: name, code, stdout: out.slice(0, MAX_OUT), stderr: err.slice(0, MAX_OUT) }, 200);
-    });
-    if (input != null) { try { child.stdin.write(input); } catch (_) {} }
-    try { child.stdin.end(); } catch (_) {}
-  });
-}
 
 /**
  * Desktop actions for the bot: see the screen, move and click, type, read the clipboard, list and
- * focus windows. The bot runs in a container with no desktop of its own, so the installer — which
- * already runs on the operator's machine and already opens apps for it — performs them.
+ * focus windows. The bot runs in a container with no desktop of its own, so the installer - which
+ * already runs on the operator's machine and already opens apps for it - performs them.
  *
  * No native modules: the approach follows the dependency-free tools (and Anthropic's own
  * computer-use reference, which drives xdotool + a screenshot binary):
@@ -4976,7 +5012,7 @@ function runHostCommand(res, name, bin, args, input, timeoutMs) {
  * do not fork per platform.
  *
  * Windows note: input injection and screen capture need a real desktop session. When the installer
- * itself was started over SSH there is none, and the capture fails — the error says so instead of
+ * itself was started over SSH there is none, and the capture fails - the error says so instead of
  * leaking a raw Win32Exception.
  */
 const HOST_UI_ACTIONS = new Set([
@@ -4990,7 +5026,7 @@ function hostUiScriptPath(projectDir) {
 
 async function ensureHostUiScript(projectDir) {
   const path = hostUiScriptPath(projectDir);
-  const stamp = `# OpenClaw host UI helper — version ${HOST_UI_PS1_VERSION}`;
+  const stamp = `# OpenClaw host UI helper - version ${HOST_UI_PS1_VERSION}`;
   try {
     if (existsSync(path) && (await fsp.readFile(path, 'utf8')).startsWith(stamp)) return path;
   } catch (_) {}
@@ -5021,461 +5057,56 @@ async function hostUiScreenshotTarget(projectDir) {
   return { hostPath: join(dir, name), containerPath: `/home/node/project/.openclaw/media/host-ui/${name}` };
 }
 
-async function runHostUiWindows(projectDir, action, body, shot) {
-  const script = await ensureHostUiScript(projectDir);
-  const args = ['-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', script, '-Action', action];
-  const push = (flag, value) => { if (value !== undefined && value !== null && value !== '') args.push(flag, String(value)); };
-  push('-X', body.x);
-  push('-Y', body.y);
-  push('-ToX', body.toX);
-  push('-ToY', body.toY);
-  push('-Amount', body.amount);
-  push('-Text', body.text);
-  push('-Button', body.button);
-  push('-Clicks', body.clicks);
-  push('-Title', body.title);
-  if (shot) push('-Path', shot.hostPath);
-  const r = await runCapture('powershell', args, { shell: false, timeout: 30000 });
-  const parsed = parseJsonText(String(r.stdout || '').trim(), null);
-  if (parsed) return parsed;
-  const err = String(r.stderr || r.stdout || '').trim();
-  if (/Win32Exception|CopyFromScreen|handle is invalid/i.test(err)) {
-    return { ok: false, error: 'no desktop session available. The installer must run in the logged-in desktop session (not over SSH) for screen capture and input to work.' };
-  }
-  return { ok: false, error: err.split('\n')[0] || `powershell exited ${r.code}` };
-}
-
-async function runHostUiMac(action, body, shot) {
-  const osa = (script) => runCapture('osascript', ['-e', script], { shell: false, timeout: 20000 });
-  const point = () => `{${Number(body.x) || 0}, ${Number(body.y) || 0}}`;
-  switch (action) {
-    case 'screenshot': {
-      const r = await runCapture('screencapture', ['-x', shot.hostPath], { shell: false, timeout: 20000 });
-      return r.code === 0 ? { ok: true, path: shot.hostPath } : { ok: false, error: String(r.stderr || 'screencapture failed').trim() };
-    }
-    case 'screen_size': {
-      const r = await osa('tell application "Finder" to get bounds of window of desktop');
-      const nums = String(r.stdout || '').trim().split(/\s*,\s*/).map(Number);
-      return nums.length === 4 ? { ok: true, width: nums[2], height: nums[3] } : { ok: false, error: 'could not read screen bounds' };
-    }
-    case 'mouse_move':
-    case 'click': {
-      // System Events can click at a point; a plain move has no equivalent, so a move is a click
-      // target set-up only. Accessibility permission is required (System Settings → Privacy).
-      const clicks = Math.max(1, Number(body.clicks) || 1);
-      if (action === 'mouse_move') return { ok: true, note: 'macOS has no pointer-move without a click; pass x/y to click instead', x: body.x, y: body.y };
-      for (let i = 0; i < clicks; i++) {
-        const r = await osa(`tell application "System Events" to click at ${point()}`);
-        if (r.code !== 0) return { ok: false, error: String(r.stderr || '').trim() || 'click failed (grant Accessibility permission)' };
-      }
-      return { ok: true, button: 'left', clicks };
-    }
-    case 'type': {
-      const text = String(body.text || '').replace(/\\/g, '\\\\').replace(/"/g, '\\"');
-      const r = await osa(`tell application "System Events" to keystroke "${text}"`);
-      return r.code === 0 ? { ok: true, typed: String(body.text || '').length } : { ok: false, error: String(r.stderr || '').trim() };
-    }
-    case 'key': {
-      const map = { enter: 'return', esc: 'escape', pageup: 'page up', pagedown: 'page down' };
-      for (const combo of String(body.text || '').split(/\s+/).filter(Boolean)) {
-        const parts = combo.toLowerCase().split('+').map((p) => p.trim()).filter(Boolean);
-        const key = map[parts[parts.length - 1]] || parts[parts.length - 1];
-        const mods = parts.slice(0, -1).map((m) => ({ ctrl: 'control down', control: 'control down', cmd: 'command down', meta: 'command down', alt: 'option down', option: 'option down', shift: 'shift down' })[m]).filter(Boolean);
-        const using = mods.length ? ` using {${mods.join(', ')}}` : '';
-        const named = ['return', 'escape', 'tab', 'space', 'delete', 'up', 'down', 'left', 'right', 'home', 'end', 'page up', 'page down'];
-        const script = named.includes(key)
-          ? `tell application "System Events" to key code ${{ return: 36, escape: 53, tab: 48, space: 49, delete: 51, up: 126, down: 125, left: 123, right: 124, home: 115, end: 119, 'page up': 116, 'page down': 121 }[key]}${using}`
-          : `tell application "System Events" to keystroke "${key}"${using}`;
-        const r = await osa(script);
-        if (r.code !== 0) return { ok: false, error: String(r.stderr || '').trim() };
-      }
-      return { ok: true, keys: body.text };
-    }
-    case 'scroll': {
-      const amount = Number(body.amount) || 3;
-      const dir = amount < 0 ? 121 : 116; // page down / page up
-      for (let i = 0; i < Math.abs(amount); i++) await osa(`tell application "System Events" to key code ${dir}`);
-      return { ok: true, amount };
-    }
-    case 'clipboard_get': {
-      const r = await runCapture('pbpaste', [], { shell: false, timeout: 10000 });
-      return { ok: true, text: String(r.stdout || '') };
-    }
-    case 'clipboard_set': {
-      const r = await runCapture('sh', ['-c', 'pbcopy'], { shell: false, timeout: 10000, input: String(body.text || '') });
-      return r.code === 0 ? { ok: true, length: String(body.text || '').length } : { ok: false, error: 'pbcopy failed' };
-    }
-    case 'windows': {
-      const r = await osa('tell application "System Events" to get name of every process whose background only is false');
-      const list = String(r.stdout || '').trim().split(/\s*,\s*/).filter(Boolean).map((title) => ({ title, process: title }));
-      return { ok: true, windows: list };
-    }
-    case 'focus': {
-      const title = String(body.title || '').replace(/"/g, '');
-      if (!title) return { ok: false, error: 'focus needs a title' };
-      const r = await osa(`tell application "${title}" to activate`);
-      return r.code === 0 ? { ok: true, focused: title } : { ok: false, error: String(r.stderr || '').trim() || `no app named ${title}` };
-    }
-    default:
-      return { ok: false, error: `unsupported on macOS: ${action}` };
-  }
-}
-
-async function runHostUiLinux(action, body, shot) {
-  const xdo = whichSync('xdotool');
-  const need = (bin, hint) => ({ ok: false, error: `${hint} needs ${bin}; install it (e.g. apt install ${bin})` });
-  switch (action) {
-    case 'screenshot': {
-      const tool = firstExistingCommand(['gnome-screenshot', 'scrot', 'spectacle', 'import']);
-      if (!tool) return need('scrot', 'screenshot');
-      const argv = tool.name === 'gnome-screenshot' ? ['-f', shot.hostPath]
-        : tool.name === 'spectacle' ? ['-b', '-n', '-o', shot.hostPath]
-          : tool.name === 'import' ? ['-window', 'root', shot.hostPath]
-            : [shot.hostPath];
-      const r = await runCapture(tool.bin, argv, { shell: false, timeout: 20000 });
-      return r.code === 0 ? { ok: true, path: shot.hostPath, tool: tool.name } : { ok: false, error: String(r.stderr || 'capture failed').trim() };
-    }
-    case 'screen_size': {
-      if (!xdo) return need('xdotool', 'screen_size');
-      const r = await runCapture(xdo, ['getdisplaygeometry'], { shell: false, timeout: 10000 });
-      const [w, h] = String(r.stdout || '').trim().split(/\s+/).map(Number);
-      return w && h ? { ok: true, width: w, height: h } : { ok: false, error: 'could not read display geometry' };
-    }
-    case 'mouse_move':
-    case 'click':
-    case 'drag':
-    case 'scroll':
-    case 'type':
-    case 'key':
-    case 'windows':
-    case 'focus': {
-      if (!xdo) return need('xdotool', action);
-      const button = { left: 1, middle: 2, right: 3 }[String(body.button || 'left')] || 1;
-      const argvFor = {
-        mouse_move: ['mousemove', String(body.x ?? 0), String(body.y ?? 0)],
-        click: ['mousemove', String(body.x ?? 0), String(body.y ?? 0), 'click', '--repeat', String(Math.max(1, Number(body.clicks) || 1)), String(button)],
-        drag: ['mousemove', String(body.x ?? 0), String(body.y ?? 0), 'mousedown', '1', 'mousemove', String(body.toX ?? 0), String(body.toY ?? 0), 'mouseup', '1'],
-        scroll: ['click', '--repeat', String(Math.max(1, Math.abs(Number(body.amount) || 3))), (Number(body.amount) || 3) < 0 ? '5' : '4'],
-        type: ['type', '--delay', '12', '--', String(body.text || '')],
-        key: ['key', ...String(body.text || '').split(/\s+/).filter(Boolean)],
-        windows: ['search', '--onlyvisible', '--name', '.'],
-        focus: ['search', '--onlyvisible', '--name', String(body.title || ''), 'windowactivate'],
-      }[action];
-      const r = await runCapture(xdo, argvFor, { shell: false, timeout: 20000 });
-      if (action === 'windows') {
-        const ids = String(r.stdout || '').trim().split(/\s+/).filter(Boolean).slice(0, 40);
-        const titles = [];
-        for (const id of ids) {
-          const t = await runCapture(xdo, ['getwindowname', id], { shell: false, timeout: 5000 });
-          const title = String(t.stdout || '').trim();
-          if (title) titles.push({ title, id });
-        }
-        return { ok: true, windows: titles };
-      }
-      return r.code === 0 ? { ok: true, action } : { ok: false, error: String(r.stderr || '').trim() || `xdotool exited ${r.code}` };
-    }
-    case 'clipboard_get': {
-      const tool = firstExistingCommand(['wl-paste', 'xclip', 'xsel']);
-      if (!tool) return need('xclip', 'clipboard_get');
-      const argv = tool.name === 'xclip' ? ['-o', '-selection', 'clipboard'] : tool.name === 'xsel' ? ['-b', '-o'] : [];
-      const r = await runCapture(tool.bin, argv, { shell: false, timeout: 10000 });
-      return { ok: true, text: String(r.stdout || '') };
-    }
-    case 'clipboard_set': {
-      const tool = firstExistingCommand(['wl-copy', 'xclip', 'xsel']);
-      if (!tool) return need('xclip', 'clipboard_set');
-      const argv = tool.name === 'xclip' ? ['-selection', 'clipboard'] : tool.name === 'xsel' ? ['-b', '-i'] : [];
-      const r = await runCapture(tool.bin, argv, { shell: false, timeout: 10000, input: String(body.text || '') });
-      return r.code === 0 ? { ok: true, length: String(body.text || '').length } : { ok: false, error: `${tool.name} failed` };
-    }
-    default:
-      return { ok: false, error: `unsupported on Linux: ${action}` };
-  }
-}
 
-async function runHostUi(projectDir, body = {}) {
-  const action = String(body.action || '').trim();
-  if (!HOST_UI_ACTIONS.has(action)) {
-    return { status: 400, payload: { ok: false, error: `unknown action: ${action || '(none)'}`, actions: [...HOST_UI_ACTIONS] } };
-  }
-  const shot = action === 'screenshot' ? await hostUiScreenshotTarget(projectDir) : null;
-  let result;
-  try {
-    if (process.platform === 'win32') result = await runHostUiWindows(projectDir, action, body, shot);
-    else if (process.platform === 'darwin') result = await runHostUiMac(action, body, shot);
-    else result = await runHostUiLinux(action, body, shot);
-  } catch (err) {
-    result = { ok: false, error: err.message };
-  }
-  if (shot && result?.ok) {
-    // The project folder is bind-mounted into the container, so hand back the path the bot can
-    // actually open — otherwise it gets a Windows path it cannot read and reports failure.
-    result.path = shot.hostPath;
-    result.containerPath = shot.containerPath;
-    result.bytes = existsSync(shot.hostPath) ? (await fsp.stat(shot.hostPath)).size : 0;
-  }
-  sendLog(`[host-control] UI "${action}" → ${result?.ok ? 'ok' : `lỗi: ${result?.error || 'unknown'}`}`);
-  return { status: result?.ok ? 200 : 500, payload: result };
-}
 
-async function handleHostControl(req, res, projectDir) {
-  const cfg = await readHostControlConfig(projectDir);
-  const url = new URL(req.url, 'http://localhost');
-  const presented = req.headers['x-openclaw-token'] || url.searchParams.get('token') || '';
-  if (!cfg.enabled) return json(res, { ok: false, error: 'host control is disabled' }, 403);
-  if (presented !== cfg.token) return json(res, { ok: false, error: 'invalid token' }, 401);
 
-  if (url.pathname === '/api/browser/start-chrome' && req.method === 'POST') {
-    try {
-      return json(res, await startChromeDebug());
-    } catch (err) {
-      return json(res, { ok: false, error: err.message }, err.status || 500);
-    }
-  }
-  if (url.pathname === '/api/host/apps' && req.method === 'GET') {
-    return json(res, { ok: true, apps: Object.keys(cfg.apps || {}), commands: Object.keys(cfg.commands || {}), platform: process.platform });
-  }
-  if (url.pathname === '/api/host/ui' && req.method === 'POST') {
-    // Part of PC control, but its own switch: seeing the screen and moving the pointer is a bigger
-    // step than opening an app, so it only answers once the operator has granted capabilities.
-    if (cfg.ui !== true) {
-      return json(res, { ok: false, error: 'desktop actions are not granted. Ask the operator to press "Điều khiển máy" again in the dashboard (that writes ui:true).' }, 403);
-    }
-    const body = await readJson(req).catch(() => ({}));
-    const { status, payload } = await runHostUi(projectDir, body || {});
-    return json(res, payload, status);
-  }
-  if (url.pathname === '/api/host/exec' && req.method === 'POST') {
-    const body = await readJson(req).catch(() => ({}));
-    const name = String(body.command || '').trim().toLowerCase();
-    if (!name) return json(res, { ok: false, error: 'missing "command"' }, 400);
-    const bin = (cfg.commands || {})[name];
-    if (!bin) {
-      return json(res, {
-        ok: false,
-        error: `"${name}" is not in this machine's command list`,
-        commands: Object.keys(cfg.commands || {}),
-      }, 404);
-    }
-    // Args are passed literally (spawn with shell:false) so nothing in them is re-interpreted
-    // by a shell — the executable is fixed to the allow-listed path, callers cannot pick a
-    // different binary or inject a second command.
-    const args = Array.isArray(body.args) ? body.args.map((a) => String(a)) : [];
-    const input = body.input != null ? String(body.input) : null;
-    const timeoutMs = Math.min(Math.max(Number(body.timeoutMs) || 180000, 1000), 600000);
-    return runHostCommand(res, name, bin, args, input, timeoutMs);
-  }
-  if (url.pathname === '/api/host/open' && req.method === 'POST') {
-    const body = await readJson(req).catch(() => ({}));
-    const key = String(body.app || body.target || '').trim();
-    if (!key) return json(res, { ok: false, error: 'missing "app"' }, 400);
-    const path = (cfg.apps || {})[key.toLowerCase()];
-    if (!path) {
-      return json(res, {
-        ok: false,
-        error: `"${key}" is not in this machine's app list`,
-        apps: Object.keys(cfg.apps || {}),
-      }, 404);
-    }
-    openHostApp(path);
-    sendLog(`[host-control] Đã mở "${key}" trên máy (${path}).`);
-    return json(res, { ok: true, app: key, path });
-  }
-  return json(res, { ok: false, error: 'unknown endpoint' }, 404);
-}
+
 
 /**
- * Teach every bot in the project how to reach the host-control service, and hand it the
- * token. Written into TOOLS.md as a managed block so flipping the switch off removes it
- * again — a bot that still had the instructions would keep trying an endpoint that now
- * refuses. `host.docker.internal` resolves in the container on every OS because the
- * generated compose maps it to host-gateway.
+ * Teach every bot in the project how to drive the machine with OpenClaw's own `computer` tool.
+ *
+ * This used to describe a local HTTP service on port 18795 that the bot called with curl. That
+ * service is gone: OpenClaw ships the real thing, and a second half-capable path next to it only
+ * gave the bot a way to fail. `computer` sees the screen and moves the pointer; `screen` takes the
+ * snapshot. Both arrive once the operator presses "Điều khiển máy", which allows the tools, enables
+ * cua-computer and starts the node host.
+ *
+ * Written as a managed block so switching PC control off removes the instructions again - a bot
+ * still holding them would keep reaching for a tool it no longer has.
  */
 async function writeHostControlAccess(projectDir, cfg) {
   const openclawDir = join(projectDir, '.openclaw');
   if (!existsSync(openclawDir)) return;
-  const native = isNativeProject(projectDir);
-  // Native bots run on the host itself; host.docker.internal only resolves from inside a container,
-  // so a native bot curling it fails ("could not connect"). Use loopback there instead.
-  const base = native ? `http://127.0.0.1:${HOST_CONTROL_PORT}` : `http://host.docker.internal:${HOST_CONTROL_PORT}`;
-  const apps = Object.keys(cfg.apps || {});
-  const commands = Object.keys(cfg.commands || {});
-  const execBlock = commands.length ? [
-    '',
-    'Chạy một CLI trên máy chủ và LẤY KẾT QUẢ về (chỉ lệnh trong danh sách; trả `{ok,code,stdout,stderr}`).',
-    'Dùng để giao việc cho công cụ dòng lệnh, ví dụ Claude Code:',
-    '',
-    '```sh',
-    `curl -s -X POST ${base}/api/host/exec -H "x-openclaw-token: ${cfg.token}" \\`,
-    '  -H "content-type: application/json" -d \'{"command":"claude","args":["-p","tóm tắt repo hiện tại"]}\'',
-    '```',
-    '',
-    `Lệnh khả dụng: ${commands.map((c) => `\`${c}\``).join(', ')}. Lệnh mặc định timeout 180s, output tối đa ~200KB/luồng.`,
-  ] : [];
-  // Desktop actions: one endpoint, same JSON on every OS, so the bot does not need per-platform
-  // instructions. Screenshots land in the project folder, which the container already sees.
-  const uiBlock = cfg.ui === true ? [
-    '',
-    '### Thao tác trên màn hình chủ',
-    '',
-    'Một endpoint duy nhất cho mọi hệ điều hành. Cách làm đúng: **chụp màn hình trước, xem toạ độ, rồi mới click** —',
-    'đừng đoán vị trí. Toạ độ tính bằng pixel màn hình, gốc ở góc trên-trái.',
-    '',
-    '```sh',
-    `curl -s -X POST ${base}/api/host/ui -H "x-openclaw-token: ${cfg.token}" \\`,
-    '  -H "content-type: application/json" -d \'{"action":"screenshot"}\'',
-    '```',
-    '',
-    'Trả về `containerPath` — **đọc/gửi ảnh bằng đường dẫn đó** (nằm trong project nên bạn thấy được),',
-    'kèm `width`/`height` để biết màn hình bao lớn.',
-    '',
-    'Các action khác (cùng dạng `{"action":...}`):',
-    '',
-    '- `screen_size` — kích thước màn hình',
-    '- `mouse_move` + `x`,`y` — di chuột',
-    '- `click` + `x`,`y`, tuỳ chọn `button` (`left`/`right`/`middle`) và `clicks` (2 = double-click)',
-    '- `drag` + `x`,`y`,`toX`,`toY` — kéo thả',
-    '- `scroll` + `amount` (âm = xuống), tuỳ chọn `x`,`y`',
-    '- `type` + `text` — gõ chữ vào cửa sổ đang focus',
-    '- `key` + `text` — nhấn tổ hợp, ví dụ `"ctrl+c"`, `"enter"`, `"alt+tab"`; nhiều tổ hợp thì cách nhau bằng space',
-    '- `clipboard_get` / `clipboard_set` + `text` — đọc/ghi clipboard',
-    '- `windows` — liệt kê cửa sổ đang mở; `focus` + `title` — đưa cửa sổ lên trước',
-    '',
-    'Nếu trả về lỗi "no desktop session available" thì installer đang chạy ngoài phiên desktop —',
-    'nói chủ mở lại installer trong máy, đừng thử cách khác.',
-    'Trên Linux, thiếu `xdotool`/`scrot` thì endpoint nói rõ cần cài gì — báo lại cho chủ.',
-  ] : [];
-  // Screen capture / recording — only advertised when the operator granted the matching tool, so
-  // the bot never tries a binary that is not on this machine's allow-list.
-  // Windows has no capture binary to allow-list (PowerShell does it inline), so the section shows
-  // up there too — a native bot runs the command itself, the allow-list only gates the bridge.
-  const hasCapture = commands.includes('screencapture') || commands.includes('screenshot') || commands.includes('ffmpeg') || (native && process.platform === 'win32');
-  const captureBlock = hasCapture ? [
-    '',
-    '### Chụp / quay màn hình',
-    '',
-    ...(commands.includes('screencapture') ? [
-      '- Chụp: `screencapture -x /tmp/shot.png` (thêm `-R x,y,w,h` để chụp một vùng, `-l <windowid>` chụp 1 cửa sổ).',
-      '- Quay: `screencapture -v -V 10 /tmp/rec.mov` (quay 10 giây rồi tự dừng).',
-    ] : []),
-    ...(commands.includes('screenshot') ? ['- Chụp: dùng lệnh `screenshot` (công cụ chụp của desktop này) với đường dẫn file đầu ra.'] : []),
-    ...(native && process.platform === 'win32' ? [
-      '- Chụp (Windows): `powershell -NoProfile -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bm=New-Object Drawing.Bitmap $b.Width,$b.Height; [Drawing.Graphics]::FromImage($bm).CopyFromScreen($b.Location,[Drawing.Point]::Empty,$b.Size); $bm.Save(\'C:\\Temp\\shot.png\')"` (tạo sẵn thư mục đích).',
-    ] : []),
-    ...(commands.includes('ffmpeg') ? ['- Quay bằng `ffmpeg` khi cần định dạng khác (macOS: `-f avfoundation`, Linux: `-f x11grab`, Windows: `-f gdigrab -i desktop`).'] : []),
-    '',
-    'Chụp xong thì ĐỌC file ảnh bằng tool đọc ảnh để phân tích, rồi xoá file tạm. Lần đầu macOS sẽ hỏi quyền **Screen Recording** cho `node`: nếu ảnh ra đen/rỗng hoặc lệnh lỗi quyền thì nhờ chủ bấm "Cấp quyền chụp/quay màn hình" trong dashboard, đừng thử vòng khác.',
-  ] : [];
-  const scriptCommands = commands.filter((c) => c === 'node' || c === 'npx' || c === 'codex' || c === 'claude');
-  const scriptBlock = scriptCommands.length ? [
-    '',
-    '### Chạy script & giao việc cho CLI khác',
-    '',
-    `Chủ đã cho phép: ${scriptCommands.map((c) => `\`${c}\``).join(', ')} — dùng cho việc tự động hoá nhỏ (ví dụ \`node -e "..."\`, \`node script.js\`).`,
-    ...(commands.includes('codex') ? [
-      '- Giao việc cho **Codex** (chạy ngầm, lấy kết quả text): `codex exec --skip-git-repo-check "việc cần làm"`. Việc cần nhìn/điều khiển màn hình thì thêm `--sandbox danger-full-access` (xem mục dưới). Lượt này tiêu quota gói ChatGPT của chủ, nên chỉ dùng khi chủ yêu cầu và mô tả việc gọn.',
-    ] : []),
-    ...(commands.includes('claude') ? [
-      '- Giao việc cho **Claude Code**: `claude -p "việc cần làm"` (một lượt, trả stdout).',
-    ] : []),
-    'Đây là quyền chạy mã tuỳ ý trên máy chủ: chỉ chạy khi chủ yêu cầu rõ, không cài thêm gì, không sửa file ngoài phạm vi được yêu cầu.',
-  ] : [];
   const startTag = '<!-- OPENCLAW:HOST_CONTROL:START -->';
   const endTag = '<!-- OPENCLAW:HOST_CONTROL:END -->';
-  // NATIVE: the bot runs directly on the host with `exec`, so it opens apps with the OS command —
-  // no bridge, no host.docker.internal (which doesn't resolve off-container anyway). DOCKER: the
-  // bot is in a container and can't see the desktop, so it must call the installer's host service.
-  const nativeBlock = [
+  const block = [
     startTag,
     '',
-    '## 🖥️ Điều khiển máy của chủ (host control — chế độ native)',
-    '',
-    'Bạn chạy TRỰC TIẾP trên máy của chủ và có quyền `exec`, nên mở ứng dụng bằng lệnh hệ điều hành — KHÔNG cần service/bridge nào (đừng dùng host.docker.internal hay curl cổng 18795):',
-    '',
-    '- macOS: `open -a "<Tên app>"` — ví dụ `open -a "TeamViewer"`',
-    '- Linux: `xdg-open <app|url>` hoặc chạy binary trực tiếp',
-    ...(process.platform === 'win32' ? [
-      '- Windows: **đừng** gọi `Start-Process <TênApp>` — tên app KHÔNG phải lệnh trên PATH, bạn sẽ nhận',
-      '  `The system cannot find the file specified`. Hãy tra shortcut trong Start Menu rồi mở nó:',
-      '',
-      '```sh',
-      'powershell -NoProfile -Command "$n=\'TeamViewer\'; $r=@(\"$env:ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\",\"$env:APPDATA\\Microsoft\\Windows\\Start Menu\\Programs\"); $l=Get-ChildItem $r -Recurse -Filter \"*$n*.lnk\" -EA SilentlyContinue | Select -First 1; if($l){ Start-Process $l.FullName } else { \"khong tim thay $n\" }"',
-      '```',
-      '',
-      'Đổi `TeamViewer` thành tên app cần mở. Cách này đúng với MỌI app đã cài, kể cả app chủ mới cài hôm qua,',
-      'vì Windows luôn đặt shortcut vào Start Menu và `.lnk` tự biết đường dẫn thật.',
-    ] : ['- Windows: `cmd /c start "" "<app>"`']),
-    '',
-    apps.length ? `App có trên máy này: ${apps.map((a) => `\`${a}\``).join(', ')}.` : 'Chủ chưa liệt kê app — mở theo tên app có trên máy.',
-    ...captureBlock,
-    ...scriptBlock,
-    '',
-    ...(commands.includes('codex') ? [
-      '### Điều khiển chuột/bàn phím & nhìn màn hình',
-      '',
-      'Bạn KHÔNG có tool điều khiển GUI. Việc đó giao cho **Codex** — nó có sẵn Computer Use. Dùng ĐÚNG script này (đã cài sẵn cờ cần thiết):',
-      '',
-      '```sh',
-      'bin/pc-task.sh "mở TeamViewer, đọc mật khẩu đang hiện trên màn hình rồi in ra"',
-      '```',
-      '',
-      '⚠️ **Đừng gọi `codex exec` trần.** Mặc định nó chạy sandbox read-only và tự từ chối computer-use với lỗi `Computer Use was not approved to use <app>` — KHÔNG phải do thiếu quyền Screen Recording, đừng bảo chủ đi cấp lại quyền. Script trên đã kèm `--sandbox danger-full-access` (mức `workspace-write` không đủ).',
-      '',
-      'Codex tự nhìn màn hình, click, gõ phím rồi trả kết quả text về cho bạn; bạn thuật lại cho chủ. Lưu ý:',
-      '',
-      '- Mô tả việc gọn nhưng đủ (mục tiêu + kết quả cần trả). Mỗi lượt tiêu quota gói ChatGPT của chủ, đừng gọi lung tung.',
-      '- Việc GUI có thể chạy lâu: đặt timeout rộng, đừng kết luận thất bại sớm.',
-      '- Computer Use từ chối vài app vì an toàn (Terminal, chính app ChatGPT/Codex): lỗi ghi rõ `not allowed to use the app ... for safety reasons` — báo chủ tự làm, đừng lách.',
-      '- Điều khiển chuột/bàn phím hiện chỉ chạy trên macOS. Trên Windows/Linux bạn vẫn mở app, chụp màn hình và chạy script được.',
-      '- Lỗi thật sự do thiếu quyền hệ điều hành sẽ nói về Screen Recording/Accessibility; chỉ khi đó mới nhờ chủ bấm nút cấp quyền trong dashboard. Luôn trích **nguyên văn** lỗi cho chủ thay vì đoán nguyên nhân.',
-      '',
-    ] : []),
-    'Chỉ mở app, chụp/quay màn hình hoặc điều khiển máy khi chủ yêu cầu rõ. Không tự ý chụp màn hình để "xem thử".',
-    '',
-    endTag,
-    '',
-  ].join('\n');
-  const dockerBlock = [
-    startTag,
+    '## 🖥️ Điều khiển máy của chủ',
     '',
-    '## 🖥️ Điều khiển máy của chủ (host control)',
+    'Chủ đã cho phép bạn dùng máy này. Bạn có hai công cụ dưới đây và hãy dùng THẲNG chúng - đừng',
+    'gọi HTTP, đừng tự dựng script PowerShell, đừng đi tìm dịch vụ phụ nào khác:',
     '',
-    'Bạn chạy trong container nên không thấy desktop của chủ. Muốn mở Chrome hay một ứng dụng trên máy thật thì gọi service của installer (chạy trên máy chủ) bằng `exec`:',
+    '- `screen` - chụp màn hình. Luôn chụp TRƯỚC khi định bấm hay gõ, để biết đang nhìn thấy gì.',
+    '- `computer` - rê chuột, bấm, gõ phím, kéo thả, cuộn, nhấn tổ hợp phím.',
     '',
-    '```sh',
-    `curl -s -X POST ${base}/api/browser/start-chrome -H "x-openclaw-token: ${cfg.token}"`,
-    '```',
+    'Cách mở một ứng dụng, ví dụ TeamViewer: chụp màn hình → bấm nút Start → gõ `TeamViewer` →',
+    'nhấn Enter → chụp lại để xác nhận nó đã mở. Cách này dùng được với MỌI app đã cài trên máy,',
+    'kể cả app vừa cài hôm qua, vì bạn thao tác đúng như người ngồi trước máy.',
     '',
-    'Mở ứng dụng (chỉ những app có trong danh sách của máy):',
+    '**Luôn kiểm chứng bằng mắt.** Sau mỗi bước quan trọng hãy chụp lại màn hình rồi mới nói đã xong.',
+    'Đừng báo "đã mở" khi chưa nhìn thấy cửa sổ của nó.',
     '',
-    '```sh',
-    `curl -s -X POST ${base}/api/host/open -H "x-openclaw-token: ${cfg.token}" \\`,
-    '  -H "content-type: application/json" -d \'{"app":"teamviewer"}\'',
-    '```',
+    '**Khi không dùng được:** nếu công cụ báo lỗi, hãy trích **nguyên văn** câu lỗi cho chủ và nói rõ',
+    'bạn đang định làm gì. Đừng đoán nguyên nhân, và đừng đi tìm đường vòng khác - không có đường',
+    'nào khác. Thường chỉ cần chủ bấm lại nút "Điều khiển máy" trong bảng điều khiển.',
     '',
-    'Xem danh sách app đang được phép:',
-    '',
-    '```sh',
-    `curl -s ${base}/api/host/apps -H "x-openclaw-token: ${cfg.token}"`,
-    '```',
-    '',
-    apps.length ? `App khả dụng trên máy này: ${apps.map((a) => `\`${a}\``).join(', ')}.` : 'Máy này chưa khai báo app nào — nhờ chủ thêm vào `.openclaw/host-control.json`.',
-    ...execBlock,
-    ...uiBlock,
-    // Docker only: a screenshot taken on the host lands on the HOST filesystem, which this
-    // container cannot read — say so instead of letting the bot hunt for a missing file.
-    ...(hasCapture ? [
-      '',
-      'Chụp/quay màn hình chạy trên MÁY CHỦ nên file ảnh nằm ở ổ đĩa của chủ, container này KHÔNG đọc được. Chụp vào một thư mục đã mount cho bot (nếu có) hoặc nhờ chủ gửi ảnh; đừng đoán nội dung màn hình.',
-    ] : []),
-    '',
-    'Nếu trả về `host control is disabled` thì chủ chưa bật quyền này — nói chủ bật trong dashboard,',
-    'đừng cố tìm đường khác. Chỉ mở app hoặc chạy lệnh khi chủ yêu cầu rõ.',
+    'Chỉ dùng khi chủ yêu cầu rõ. Không tự chụp màn hình để "xem thử", không tự bấm vào thứ chủ',
+    'không nhắc tới, và không gõ mật khẩu hay thông tin thanh toán vào bất cứ đâu.',
     '',
     endTag,
     '',
   ].join('\n');
-  const block = native ? nativeBlock : dockerBlock;
   for (const entry of await fsp.readdir(openclawDir).catch(() => [])) {
     if (!entry.startsWith('workspace')) continue;
     const toolsMd = join(openclawDir, entry, 'TOOLS.md');
@@ -5499,46 +5130,6 @@ function removeManagedBlockFrom(content, blockId) {
   return `${content.substring(0, startIdx).trimEnd()}\n${content.substring(endIdx + endTag.length).trimStart()}`.trim() + '\n';
 }
 
-async function ensureHostControl(projectDir) {
-  // Point the service at the project being enabled (re-points a service already running for
-  // another project — the handler reads _hostControlProjectDir per request).
-  _hostControlProjectDir = projectDir;
-  const cfg = await readHostControlConfig(projectDir);
-  if (!cfg.enabled) return { ok: false, reason: 'disabled' };
-  // Desktop only. Opening TeamViewer or an app needs a GUI, so a headless server has nothing
-  // to control — and, more importantly, it is where 0.0.0.0 would be a real exposure (a VPS
-  // has a public IP). Refusing here means the service never binds on a headless box, so the
-  // public-exposure question does not arise. A rare VPS-with-desktop can override with
-  // OPENCLAW_HOST_CONTROL_ALLOW_HEADLESS=1.
-  if (isHeadlessServer() && process.env.OPENCLAW_HOST_CONTROL_ALLOW_HEADLESS !== '1') {
-    return { ok: false, reason: 'headless server — no desktop to control' };
-  }
-  if (_hostControlServer) return { ok: true, port: HOST_CONTROL_PORT };
-  const bridgeIp = await getDockerBridgeIp().catch(() => null);
-  const server = http.createServer((req, res) => {
-    // Read the CURRENTLY active project each request, so re-pointing takes effect live.
-    handleHostControl(req, res, _hostControlProjectDir || projectDir).catch((err) => json(res, { ok: false, error: err.message }, 500));
-  });
-  // Bind all interfaces: the container reaches the host by different addresses per platform —
-  // docker0 (172.17.0.1) on native Linux, the Docker Desktop gateway (host.docker.internal,
-  // e.g. 192.168.65.254) on macOS/Windows — and binding one misses the others. The token is
-  // the guard here, not the interface: every request needs it, and the service only exists
-  // while the operator has host control switched on.
-  const bindOk = await new Promise((resolveP) => {
-    server.once('error', () => resolveP(false));
-    server.listen(HOST_CONTROL_PORT, '0.0.0.0', () => resolveP(true));
-  });
-  if (!bindOk) return { ok: false, reason: `port ${HOST_CONTROL_PORT} in use` };
-  _hostControlServer = server;
-  sendLog(`[host-control] Nghe ở 0.0.0.0:${HOST_CONTROL_PORT} (cần token) — bot có thể mở Chrome/app trên máy này.`);
-  if (bridgeIp && process.platform === 'linux') {
-    // ufw's default-deny drops container→host traffic silently. Scope the allow rule to the
-    // private bridge address only, so opening the port here does not expose it to the LAN.
-    run('sh', ['-c', `command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q "Status: active" && ufw allow in to ${bridgeIp} port ${HOST_CONTROL_PORT} proto tcp comment "openclaw host-control (docker bridge only)" || true`])
-      .catch(() => {});
-  }
-  return { ok: true, port: HOST_CONTROL_PORT, host: '0.0.0.0' };
-}
 
 async function ensureChromeRelay() {
   if (_chromeRelayServer) return true;
@@ -5558,7 +5149,7 @@ async function ensureChromeRelay() {
       // traffic to the relay. Open the port scoped to the PRIVATE bridge IP only (not reachable
       // from the internet). Best-effort; `ufw allow` skips duplicates on re-runs.
       run('sh', ['-c', `command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q "Status: active" && ufw allow in to ${bridgeIp} port 9222 proto tcp comment "openclaw chrome-debug relay (docker bridge only)" || true`])
-        .catch(() => sendLog('[chrome] Không thể tự mở firewall cho relay — nếu bot không thấy Chrome, chạy: ufw allow in to ' + bridgeIp + ' port 9222 proto tcp'));
+        .catch(() => sendLog('[chrome] Không thể tự mở firewall cho relay - nếu bot không thấy Chrome, chạy: ufw allow in to ' + bridgeIp + ' port 9222 proto tcp'));
       resolveP(true);
     });
   });
@@ -5567,9 +5158,9 @@ async function ensureChromeRelay() {
 // Launch real host Chrome in remote-debugging mode (port 9222) so the browser-automation plugin
 // can drive the user's actual Chrome (logged-in profile) instead of headless Chromium. The bot
 // reaches it via CDP (host.docker.internal:9222 from the container). Detached: keeps running after
-// this request. The debug port stays on loopback and no origin wildcard is passed — a Node CDP
+// this request. The debug port stays on loopback and no origin wildcard is passed - a Node CDP
 // client sends no Origin header, so the wildcard only widened who could drive the browser.
-// On a headless VPS there is no Chrome to open here — instead we start the bridge relay and hand
+// On a headless VPS there is no Chrome to open here - instead we start the bridge relay and hand
 // back copy-paste commands so the user runs Chrome on THEIR machine + a reverse SSH tunnel.
 // Where Chrome keeps the operator's own profile, per OS. Chrome must not already be running
 // on it when we attach the debug port, which is why the callers close Chrome first.
@@ -5586,7 +5177,7 @@ function defaultChromeProfileDir() {
 
 // The profile Chrome is actually launched with. Never the directory above: Chrome 136+ drops
 // --remote-debugging-port when it IS the default profile, so pointing there means Chrome opens
-// and port 9222 never answers — the failure the bot reports as "Chrome debug not connected".
+// and port 9222 never answers - the failure the bot reports as "Chrome debug not connected".
 function debugChromeProfileDir() {
   if (process.platform === 'win32') {
     const localAppData = process.env.LOCALAPPDATA || join(os.homedir(), 'AppData', 'Local');
@@ -5598,7 +5189,7 @@ function debugChromeProfileDir() {
 
 // Seed it from the real profile once, so the bot inherits the operator's cookies, logins,
 // history and extensions instead of browsing as a brand-new profile (the clearest bot signal
-// a site can read). Caches are skipped — Chrome rebuilds those, and copying them turns a few
+// a site can read). Caches are skipped - Chrome rebuilds those, and copying them turns a few
 // hundred MB into several GB. Best-effort: a profile that fails to copy still opens, just
 // signed out.
 async function copyChromeProfileTree(src, dst) {
@@ -5666,8 +5257,8 @@ async function startChromeDebug() {
   }
   const port = 9222;
   // Launch against a dedicated profile seeded from the operator's real one. A throwaway
-  // profile is the clearest bot signal a site can read — no cookies, no logins, no history,
-  // new on every run — and it also means the bot cannot use pages the operator is already
+  // profile is the clearest bot signal a site can read - no cookies, no logins, no history,
+  // new on every run - and it also means the bot cannot use pages the operator is already
   // signed in to; the real profile itself cannot be used because Chrome 136+ drops the debug
   // port on it. The port is not what gets flagged: Chrome started this way carries no
   // --enable-automation, so navigator.webdriver stays false and there is no banner.
@@ -5678,7 +5269,7 @@ async function startChromeDebug() {
   if (process.env.OPENCLAW_CHROME_SEED_PROFILE === '1') {
     await seedDebugChromeProfile(defaultChromeProfileDir(), userDataDir, sendLog);
   } else if (!existsSync(join(userDataDir, 'Default'))) {
-    sendLog('[chrome] Mở Chrome với profile điều khiển trống — đăng nhập 1 lần trong cửa sổ vừa mở. Muốn dùng sẵn đăng nhập của Chrome thường thì đặt OPENCLAW_CHROME_SEED_PROFILE=1 (sẽ chép cookie/đăng nhập/lịch sử sang profile đó).');
+    sendLog('[chrome] Mở Chrome với profile điều khiển trống - đăng nhập 1 lần trong cửa sổ vừa mở. Muốn dùng sẵn đăng nhập của Chrome thường thì đặt OPENCLAW_CHROME_SEED_PROFILE=1 (sẽ chép cookie/đăng nhập/lịch sử sang profile đó).');
   }
   const args = [
     `--remote-debugging-port=${port}`,
@@ -5710,7 +5301,7 @@ async function waitForDockerDaemon(timeoutMs) {
 
 // OpenClaw's own engines range, copied verbatim from its package.json:
 //   ">=22.22.3 <23 || >=24.15.0 <25 || >=25.9.0"
-// The gaps matter — Node 23.x and 25.0–25.8 are NOT usable — so "install the latest Node" is the
+// The gaps matter - Node 23.x and 25.0-25.8 are NOT usable - so "install the latest Node" is the
 // wrong instinct here. When we have to install, we install 24 LTS, which sits inside a supported
 // window and is what every working host in the fleet already runs.
 const NODE_TARGET_MAJOR = 24;
@@ -5725,7 +5316,7 @@ function nodeVersionSupported(raw) {
   return false;
 }
 
-// Native mode runs openclaw straight off the host, so the host's Node IS the runtime — unlike
+// Native mode runs openclaw straight off the host, so the host's Node IS the runtime - unlike
 // docker mode, where the image carried its own. A customer machine that never needed Node before
 // (or carries one outside openclaw's supported range) must get a usable one before anything else,
 // otherwise the install dies deep inside `npm i -g openclaw` with an unreadable engine error.
@@ -5738,7 +5329,7 @@ async function ensureNodeInstalled() {
   const why = current.ok
     ? `Node ${current.output.trim()} nằm ngoài dải OpenClaw hỗ trợ`
     : 'Máy chưa có Node';
-  sendLog(`[node] ${why} — đang cài Node ${NODE_TARGET_MAJOR} LTS...`);
+  sendLog(`[node] ${why} - đang cài Node ${NODE_TARGET_MAJOR} LTS...`);
 
   if (process.platform === 'linux') {
     const root = typeof process.getuid === 'function' && process.getuid() === 0;
@@ -5748,7 +5339,7 @@ async function ensureNodeInstalled() {
     await run('sh', ['-c',
       `curl -fsSL https://deb.nodesource.com/setup_${NODE_TARGET_MAJOR}.x | ${sudo}bash - && ${sudo}apt-get install -y nodejs`,
     ]).catch(async () => {
-      sendLog('[node] apt không dùng được — thử nvm...');
+      sendLog('[node] apt không dùng được - thử nvm...');
       await run('sh', ['-c',
         `export NVM_DIR="$HOME/.nvm"; curl -fsSL https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash && . "$NVM_DIR/nvm.sh" && nvm install ${NODE_TARGET_MAJOR} && nvm alias default ${NODE_TARGET_MAJOR}`,
       ]);
@@ -5796,7 +5387,7 @@ async function ensureDockerInstalled(osChoice) {
     const root = typeof process.getuid === 'function' && process.getuid() === 0;
     const sudo = root ? '' : 'sudo ';
     if (!cliOk.ok) {
-      sendLog('[docker] Chưa có Docker — đang tự cài Docker Engine mới nhất qua script chính thức get.docker.com (1–3 phút)...');
+      sendLog('[docker] Chưa có Docker - đang tự cài Docker Engine mới nhất qua script chính thức get.docker.com (1-3 phút)...');
       await run('sh', ['-c', `curl -fsSL https://get.docker.com -o /tmp/get-docker.sh && ${sudo}sh /tmp/get-docker.sh`]);
       if (!root) await run('sh', ['-c', 'sudo usermod -aG docker "$USER" || true']).catch(() => {});
     }
@@ -5821,7 +5412,7 @@ async function ensureDockerInstalled(osChoice) {
     sendLog('[docker] Mở Docker Desktop và chờ daemon khởi động...');
     await run('open', ['-a', 'Docker']).catch(() => {});
     if (!(await waitForDockerDaemon(120000))) {
-      throw httpError(500, 'Đã cài Docker Desktop — hãy mở Docker Desktop, hoàn tất cấp quyền lần đầu, đợi biểu tượng cá voi báo "running" rồi cài lại.');
+      throw httpError(500, 'Đã cài Docker Desktop - hãy mở Docker Desktop, hoàn tất cấp quyền lần đầu, đợi biểu tượng cá voi báo "running" rồi cài lại.');
     }
     sendLog('[docker] Docker đã sẵn sàng.');
     return;
@@ -5844,7 +5435,7 @@ async function ensureDockerInstalled(osChoice) {
     sendLog('[docker] Mở Docker Desktop và chờ daemon khởi động...');
     await run('cmd', ['/c', 'start', '', '%ProgramFiles%\\Docker\\Docker\\Docker Desktop.exe']).catch(() => {});
     if (!(await waitForDockerDaemon(120000))) {
-      throw httpError(500, 'Đã cài Docker Desktop — Windows có thể cần bật WSL2 và khởi động lại máy. Hãy mở Docker Desktop, đợi "running" (hoặc reboot nếu được yêu cầu) rồi cài lại.');
+      throw httpError(500, 'Đã cài Docker Desktop - Windows có thể cần bật WSL2 và khởi động lại máy. Hãy mở Docker Desktop, đợi "running" (hoặc reboot nếu được yêu cầu) rồi cài lại.');
     }
     sendLog('[docker] Docker đã sẵn sàng.');
     return;
@@ -5862,7 +5453,7 @@ async function installCore({ osChoice, mode, projectDir, gatewayPort = 18789, ro
   state.os = osChoice;
   state.startedAt = new Date().toISOString();
   try {
-    // Native binds the host directly, so it needs ports nothing else holds — but only when something
+    // Native binds the host directly, so it needs ports nothing else holds - but only when something
     // actually holds them. Ask the host rather than assuming: a fresh machine keeps openclaw's and
     // 9router's real defaults, and a machine that already runs a docker project (or an SSH tunnel to
     // a remote bot) steps to the next free pair instead.
@@ -5877,16 +5468,16 @@ async function installCore({ osChoice, mode, projectDir, gatewayPort = 18789, ro
     }
     sendLog('OpenClaw local installer started');
     sendLog(`Target: OS=${osChoice}, mode=${mode}, project=${projectDir}, gatewayPort=${gatewayPort}, routerPort=${routerPort}`);
-    // Make sure Docker is present (auto-install on Linux/VPS) before doing any work — fail fast
+    // Make sure Docker is present (auto-install on Linux/VPS) before doing any work - fail fast
     // with a clear message rather than deep inside `docker compose up`. Native mode has no
     // container, so it skips this entirely (that is much of the point of choosing it).
-    // Native has no image to carry a runtime, so the host's Node IS the runtime — get a supported
+    // Native has no image to carry a runtime, so the host's Node IS the runtime - get a supported
     // one on the machine before npm touches anything. Docker still needs the daemon instead.
     if (mode === 'native') await ensureNodeInstalled();
     else await ensureDockerInstalled(osChoice);
     await writeCoreProject({ projectDir, osChoice, mode, gatewayPort, routerPort, userTimezone });
     await run('npm', ['install', '-g', OPENCLAW_NPM_SPEC]);
-    // The global runtime just changed — every version gate after this point (notably
+    // The global runtime just changed - every version gate after this point (notably
     // prepareNativeStateHome) must read the NEW version, not the one this host booted with.
     invalidateHostOpenclawVersion();
     await run('npm', ['install', '-g', NINE_ROUTER_NPM_SPEC]);
@@ -5989,7 +5580,7 @@ async function listMarkdownFiles(projectDir, agentId = '') {
 
 async function saveState(rootProjectDir) {
   // Selecting, adding or removing a project all end up here, and all of them make the cached
-  // project list wrong — drop it so the next request rebuilds instead of showing the old set.
+  // project list wrong - drop it so the next request rebuilds instead of showing the old set.
   probeCacheClear('projects:');
   const file = join(rootProjectDir, STATE_FILE);
   await fsp.writeFile(file, JSON.stringify({
@@ -6068,7 +5659,7 @@ function isRestrictedSystemDir(dirPath) {
 }
 
 // Project roots of OpenClaw bot containers currently running under Docker. This is the
-// strongest, OS/-environment-agnostic signal that a real project lives on this machine —
+// strongest, OS/-environment-agnostic signal that a real project lives on this machine -
 // so a fresh `npx github:…` run (e.g. on a VPS where bots are already running) targets the
 // live project instead of defaulting to an empty ~/openclaw-setup folder.
 async function discoverDockerBotProjectRoots() {
@@ -6100,19 +5691,19 @@ async function discoverDockerBotProjectRoots() {
 
 // Native installs have no container to inspect, so we can't detect them the way Docker bots are
 // found. Instead scan for the `.openclaw/native.json` marker one level under the home dir and the
-// launcher's parent — that covers the folders users actually pick (e.g. ~/openclaw-native, D:\bot)
+// launcher's parent - that covers the folders users actually pick (e.g. ~/openclaw-native, D:\bot)
 // without a full filesystem walk. Mirrors discoverDockerBotProjectRoots so discoverProjects can
 // surface native projects even when this install has no saved state for them.
 // A directory whose .openclaw merely HOLDS another project's state is not a project of its
 // own. openclaw 2026.8.x native layout puts the real state at ~/.openclaw with the project
-// dir symlinked to it — without this filter the account home shows up as a phantom "root"
+// dir symlinked to it - without this filter the account home shows up as a phantom "root"
 // project tab after every refresh (measured on vps_c-thu). The native marker's `label` was
 // written from the ORIGINAL project dir, so a mismatch identifies the phantom.
 /**
  * Two paths can be the same project: a native install links the account home and the project dir
  * together, so `~/.openclaw` and `<project>/.openclaw` resolve to one directory on disk. Scanning
  * finds both and the dashboard then lists the SAME bots twice under two project names (seen on
- * win_kha as "bot" and "VT 2025", 4 identical bots online in each — 10/09/2026).
+ * win_kha as "bot" and "VT 2025", 4 identical bots online in each - 10/09/2026).
  *
  * Dedupe on where `.openclaw` really lands, and keep the entry that IS the real directory: the
  * link side is an artefact of the install layout, not somewhere the customer put a project.
@@ -6140,7 +5731,7 @@ function isPhantomStateDirProject(dir) {
   try {
     const meta = readNativeMeta(dir);
     if (!meta || !meta.label) return false;
-    // Compare against the label DERIVED from the directory name — nativeServiceLabel()
+    // Compare against the label DERIVED from the directory name - nativeServiceLabel()
     // itself returns meta.label first, which would make this check always pass.
     const derived = `ai.openclaw.gateway.${slugify(basename(dir || 'openclaw'), 'bot')}`;
     return meta.label !== derived;
@@ -6246,7 +5837,7 @@ async function ensureProjectsLoaded(rootProjectDir) {
 }
 
 // The project list costs docker/native probes per project. It changes when someone creates or
-// deletes a project — not between two page loads — so serve it from a short cache and refresh in
+// deletes a project - not between two page loads - so serve it from a short cache and refresh in
 // the background: the dashboard opens instantly and is at most a few seconds stale.
 const PROJECTS_TTL_MS = 10000;
 function discoverProjects(rootProjectDir) {
@@ -6265,7 +5856,7 @@ async function computeDiscoverProjects(rootProjectDir) {
     }
   }
 
-  // Same idea for native installs — detect by marker since there is no container to inspect.
+  // Same idea for native installs - detect by marker since there is no container to inspect.
   for (const dr of await discoverNativeProjectRoots(rootProjectDir)) {
     if (!state.projects.some(p => resolve(p.projectDir) === resolve(dr))) {
       const meta = await buildProjectMeta(dr).catch(() => null);
@@ -6282,11 +5873,11 @@ async function computeDiscoverProjects(rootProjectDir) {
   }
 
   // Drop phantom state-dir "projects" that slipped into the saved list (e.g. the account
-  // home after a 2026.8.x native state move) — and keep them out of the persisted state.
+  // home after a 2026.8.x native state move) - and keep them out of the persisted state.
   state.projects = state.projects.filter((p) => !isPhantomStateDirProject(p.projectDir));
   // The label check above only catches projects that carry a marker with a mismatched label.
   // A linked twin without one still slips through and the dashboard shows the same bots under
-  // two project names, both "online" — collapse those onto the real directory.
+  // two project names, both "online" - collapse those onto the real directory.
   const keepDirs = new Set(dedupeProjectsByRealState(state.projects.map((p) => p.projectDir)));
   state.projects = state.projects.filter((p) => keepDirs.has(p.projectDir));
 
@@ -6312,7 +5903,7 @@ async function computeDiscoverProjects(rootProjectDir) {
 }
 
 async function resolveProjectDir(rootProjectDir, body = {}) {
-  // Every acceptance path below must refuse phantom state-dir "projects" — the browser can
+  // Every acceptance path below must refuse phantom state-dir "projects" - the browser can
   // keep sending a remembered projectDir (e.g. "/root") long after it stopped being one,
   // and accepting it re-saves the phantom into state on the next saveState().
   if (body.projectDir && existsSync(join(resolve(String(body.projectDir)), '.openclaw', 'openclaw.json'))
@@ -6372,8 +5963,8 @@ async function connectExistingProject(projectDir, rootProjectDir) {
   if (!existsSync(join(resolved, '.openclaw', 'openclaw.json'))) throw httpError(404, 'openclaw.json not found in selected project');
   if (isPhantomStateDirProject(resolved)) throw httpError(400, `${resolved} chỉ là nơi chứa state của project khác (symlink 2026.8.x), không phải project riêng`);
   // Switch the active project + return its bots FAST (a plain file read). The heavy runtime
-  // probing — detectRuntime runs `openclaw gateway status` + `config get` (slow CLI / docker
-  // exec) and used to run TWICE here (syncRuntimeState + buildProjectMeta), ~6s total — is
+  // probing - detectRuntime runs `openclaw gateway status` + `config get` (slow CLI / docker
+  // exec) and used to run TWICE here (syncRuntimeState + buildProjectMeta), ~6s total - is
   // deferred to the background so the UI switches instantly. The frontend's loadStatus/loadSystem
   // refresh live status + versions right after.
   state.projectDir = resolved;
@@ -6502,7 +6093,7 @@ async function applyFeatureToggle(projectDir, agentId, kind, id, enabled) {
 
   const k = `${kind}:${id}`;
 
-  // zalo-connect is required by any Zalo bot — refuse to disable it while a Zalo binding exists
+  // zalo-connect is required by any Zalo bot - refuse to disable it while a Zalo binding exists
   // (the UI also locks the toggle; this is the backend guard).
   if (kind === 'plugin' && (id === 'zalo-connect' || id === 'openclaw-zalo-connect') && !enabled) {
     const hasZaloBot = (cfg.bindings || []).some((b) => b?.match?.channel === 'zalo-connect');
@@ -6731,7 +6322,7 @@ async function installFeature(projectDir, agentId, kind, id) {
     }
 
     if (isNativeProject(projectDir)) {
-      // Native: no container — install on the host with the project env (ocCapture) so the
+      // Native: no container - install on the host with the project env (ocCapture) so the
       // skill lands in this project's workspace, then reload the managed gateway service.
       sendLog(`[skill] Installing/updating clawhub:${slug} natively for agent ${agentId}...`);
       const out = await ocCaptureInstall(projectDir, ['skills', 'install', slug, '--agent', agentId, '--force', '--acknowledge-install-policy-warning']);
@@ -6790,7 +6381,7 @@ async function installFeature(projectDir, agentId, kind, id) {
   }
 
   if (kind === 'plugin') {
-    // zalo-connect ships on ClawHub (package `openclaw-zalo-connect`) — install/update via
+    // zalo-connect ships on ClawHub (package `openclaw-zalo-connect`) - install/update via
     // clawhub:latest like other plugins, so the dashboard "Update" button always fetches the newest
     // published version (no tag pin to bump each release).
     if (id === 'zalo-connect' || id === 'openclaw-zalo-connect') {
@@ -6846,7 +6437,7 @@ async function installFeature(projectDir, agentId, kind, id) {
 
     let composeDir = null;
     if (isNativeProject(projectDir)) {
-      // Native: no container to exec into — same CLI, run on the host with the project env so it
+      // Native: no container to exec into - same CLI, run on the host with the project env so it
       // installs into this project's .openclaw/extensions instead of the default ~/.openclaw.
       composeDir = null;
     } else if (existsSync(join(projectDir, 'docker-compose.yml'))) {
@@ -6901,7 +6492,7 @@ async function installFeature(projectDir, agentId, kind, id) {
             hostOs: await resolveProjectHostOs(projectDir),
             // The plugin ships these off: editing the Docker build files, running page JavaScript
             // and uploading local files are things it will not do until an operator says so.
-            // Installing it from this dashboard IS that operator saying so — otherwise browsing
+            // Installing it from this dashboard IS that operator saying so - otherwise browsing
             // would need a hand-edited config right after a one-click install.
             ...browserAutomationOptIns(),
           });
@@ -6941,7 +6532,7 @@ async function installFeature(projectDir, agentId, kind, id) {
       // Browser-automation plugin needs Docker rebuild for Playwright/Chromium deps
       const isBrowserPlugin = id === 'openclaw-browser-automation' || id === 'browser-automation';
       if (isNativeProject(projectDir)) {
-        // Native: no container — reload the managed gateway service so the plugin loads.
+        // Native: no container - reload the managed gateway service so the plugin loads.
         sendLog('[plugin] Restarting native gateway to apply plugin...');
         await restartNativeRuntime(projectDir).catch((err) => sendLog(`[plugin] restart failed: ${err.message}`));
       } else if (isBrowserPlugin && composeDir) {
@@ -7012,7 +6603,7 @@ async function installFeature(projectDir, agentId, kind, id) {
             hostOs: await resolveProjectHostOs(projectDir),
             // The plugin ships these off: editing the Docker build files, running page JavaScript
             // and uploading local files are things it will not do until an operator says so.
-            // Installing it from this dashboard IS that operator saying so — otherwise browsing
+            // Installing it from this dashboard IS that operator saying so - otherwise browsing
             // would need a hand-edited config right after a one-click install.
             ...browserAutomationOptIns(),
           });
@@ -7031,7 +6622,7 @@ async function installFeature(projectDir, agentId, kind, id) {
       }
     }
   }
-  // A skill/plugin install changes container packages and may restart it — drop cached
+  // A skill/plugin install changes container packages and may restart it - drop cached
   // extension versions and runtime status so the next page load re-probes fresh.
   probeCacheClear(`extver:${projectDir}`);
   probeCacheClear(`runtime:${projectDir}`);
@@ -7198,7 +6789,7 @@ async function getFeatureFlags(projectDir, agentId = '') {
     'plugin:openclaw-facebook-crawler': isActuallyInstalled(aliases.crawler),
     'plugin:openclaw-n8n-facebook-poster': isActuallyInstalled(aliases.poster),
     // fb-messenger is auto-added to plugins.allow by the wizard, so the allow-list is NOT
-    // proof of install — require a real extension dir or an install record instead.
+    // proof of install - require a real extension dir or an install record instead.
     'plugin:openclaw-fb-messenger': extensionDirExists(aliases.fbMessenger)
       || aliases.fbMessenger.some((a) => installedKeys.has(a) || Array.from(installedSpecs).some((spec) => spec.includes(a))),
     'plugin:learning-memory': isActuallyInstalled(aliases.learningMemory),
@@ -7215,7 +6806,7 @@ async function getFeatureFlags(projectDir, agentId = '') {
     'plugin:zalo-connect': await getInstalledPluginVersion(projectDir, aliases.zaloConnect),
   };
   // Docker: the container's extensions volume is the SOURCE OF TRUTH for installed
-  // plugin versions — clawhub/plugin installs run inside the container, so a host copy
+  // plugin versions - clawhub/plugin installs run inside the container, so a host copy
   // (bind-mounted .openclaw or a stale installs.json) can lag behind after an update.
   // When the container reports a version, it OVERRIDES the host value (not just fills
   // empties) so the card shows the actually-installed version, not a stale one. Native
@@ -7418,25 +7009,18 @@ async function handler(req, res, rootProjectDir) {
       // start-chrome-debug is the old path; kept so an already-open dashboard keeps working.
       return json(res, await startChromeDebug());
     }
-    // Host control: read/flip the switch and see which apps this machine offers. The bot does
-    // not come through here (the dashboard is loopback-only) — it calls the bridge-bound
-    // service from ensureHostControl.
+    // PC control: read or flip the switch. There is no service behind it any more - enabling
+    // configures OpenClaw's own `computer`/`screen` tools and starts the node host that drives
+    // the screen.
     if (url.pathname === '/api/host/control' && req.method === 'GET') {
-      // Target the SELECTED project (not the launch root), so host-control provisions the bot
-      // the operator is actually looking at — a connected project can differ from rootProjectDir.
+      // Target the SELECTED project (not the launch root), so this provisions the bot the
+      // operator is actually looking at - a connected project can differ from rootProjectDir.
       const projectDir = await resolveProjectDir(rootProjectDir, {});
       const cfg = await readHostControlConfig(projectDir);
       return json(res, {
         ok: true,
         enabled: cfg.enabled,
-        port: HOST_CONTROL_PORT,
-        apps: Object.keys(cfg.apps || {}),
-        commands: Object.keys(cfg.commands || {}),
-        running: Boolean(_hostControlServer),
         native: isNativeProject(projectDir),
-        // What enabling will additionally grant, so the confirm dialog can spell it out.
-        grants: Object.keys(detectHostCapabilityCommands()),
-        codexApp: detectCodexApp(),
       });
     }
     if (url.pathname === '/api/host/control' && req.method === 'POST') {
@@ -7444,18 +7028,11 @@ async function handler(req, res, rootProjectDir) {
       const projectDir = await resolveProjectDir(rootProjectDir, body);
       const cfg = await readHostControlConfig(projectDir);
       if (typeof body.enabled === 'boolean') cfg.enabled = body.enabled;
-      if (body.apps && typeof body.apps === 'object') cfg.apps = body.apps;
-      if (body.commands && typeof body.commands === 'object') cfg.commands = body.commands;
-      // Turning PC control ON is the operator's explicit ask, so it is also where the screen
-      // capture / recording and node-script permissions get granted (opt out with grants:false).
-      const granted = cfg.enabled && body.grants !== false ? grantHostCapabilities(cfg) : [];
-      if (granted.length) sendLog(`[host-control] Đã cấp thêm quyền chạy: ${granted.join(', ')}.`);
-      // Pressing this button means "let the bot drive this machine", so it must deliver the real
-      // thing — OpenClaw's own `computer` tool (screenshot → click → type → drag), not just the
-      // ability to launch an app. That tool needs three separate pieces switched on together, and
-      // any one missing leaves the bot insisting it has no permission:
-      //   • the tool allowed for agents, • the cua-computer plugin (mandatory on Windows),
-      //   • a running node host advertising computer.act + screen.snapshot.
+      // Pressing this button means "let the bot drive this machine", and it delivers exactly that:
+      // OpenClaw's own `computer` tool (screenshot -> click -> type -> drag). That needs four
+      // things switched on together, and any one missing leaves the bot insisting it has no
+      // permission: the tools allowed for agents, the cua-computer plugin, those two node commands
+      // on the gateway's per-platform allowlist, and a node host advertising them.
       // Doing it here rather than in a side script matters: the node host must live in a real
       // interactive desktop session, and the operator pressing this button IS in one.
       const computerUse = await setComputerUse(projectDir, cfg.enabled).catch((e) => {
@@ -7463,39 +7040,21 @@ async function handler(req, res, rootProjectDir) {
         return { ok: false, error: e.message };
       });
       await fsp.writeFile(hostControlConfigPath(projectDir), JSON.stringify(cfg, null, 2), 'utf8');
-      let started = { ok: false, reason: 'disabled' };
-      if (cfg.enabled) started = await ensureHostControl(projectDir);
-      // Always rewrite the workspace guidance: enabling adds the block (with the token),
-      // disabling strips it so a bot never keeps instructions for an endpoint now refusing.
+      // Always rewrite the workspace guidance: enabling adds the block, disabling strips it so a
+      // bot never keeps instructions for a capability it no longer has.
       await writeHostControlAccess(projectDir, cfg).catch(() => {});
       sendLog(`[host-control] ${cfg.enabled ? 'Đã BẬT' : 'Đã TẮT'} quyền điều khiển máy cho bot.`);
       if (cfg.enabled && computerUse?.ok) sendLog('[host-control] Bot có thể chụp màn hình, click chuột, gõ phím trên máy này.');
-      // Make sure the Codex desktop app can actually do GUI work, so `codex exec` is enough for
-      // the bot: install computer-use into the app and repair its MCP registration. Nothing is
-      // installed into the OpenClaw project and the gateway never restarts.
-      let codex = null;
-      if (cfg.enabled && body.codex !== false && (cfg.commands || {}).codex) {
-        const app = detectCodexApp();
-        codex = await ensureCodexComputerUsePlugin(app, detectCodexMarketplace())
-          .then((r) => ({ ...r, app }))
-          .catch((err) => ({ error: err.message, app }));
-        // The wrapper carries the sandbox flag, so a bot cannot get the invocation wrong.
-        codex.taskScript = await writeCodexTaskScript(projectDir, (cfg.commands || {}).codex).catch(() => '');
-      }
       return json(res, {
         ok: true,
         enabled: cfg.enabled,
-        started,
-        apps: Object.keys(cfg.apps || {}),
-        commands: Object.keys(cfg.commands || {}),
-        granted,
         native: isNativeProject(projectDir),
-        codex,
+        computerUse,
       });
     }
     // Take the operator to the OS privacy pane PC control needs (screen recording, accessibility).
     // The OS alone can grant these; `probe` additionally triggers the macOS screen-capture prompt
-    // for this node binary — the same interpreter the native bot runs under.
+    // for this node binary - the same interpreter the native bot runs under.
     if (url.pathname === '/api/host/permissions' && req.method === 'POST') {
       const body = await readJson(req).catch(() => ({}));
       const kind = String(body.kind || 'screen').toLowerCase();
@@ -7518,32 +7077,32 @@ async function handler(req, res, rootProjectDir) {
         try {
           if (isGit) {
             // Clone/dev install: pull the latest (committed dist comes with it).
-            sendLog('[update-setup] Git install detected — pulling latest from GitHub…');
+            sendLog('[update-setup] Git install detected - pulling latest from GitHub…');
             await run('git', ['pull', '--ff-only'], { cwd: installerDir });
             await run('npm', ['install', '--omit=dev', '--no-audit', '--no-fund'], { cwd: installerDir });
-            // docs_dev (build tooling) is gitignored, so clones can't rebuild — and
+            // docs_dev (build tooling) is gitignored, so clones can't rebuild - and
             // don't need to: dist/ is committed. Only rebuild when tooling is present.
             if (existsSync(resolve(installerDir, 'docs_dev'))) {
               await run('npm', ['run', 'build'], { cwd: installerDir }).catch((e) =>
                 sendLog(`[update-setup] build skipped: ${e.message}`));
             }
           } else if (isGlobalNpm) {
-            // Pull the latest from npm in place, then exit — the service manager (or the
+            // Pull the latest from npm in place, then exit - the service manager (or the
             // respawn path for a hand-run UI) relaunches onto the freshly installed dist.
             // Cài vào ĐÚNG prefix của bản đang chạy, không phải prefix mà `npm` trong PATH
             // của service trỏ tới. Máy khách hay có HAI npm global (nvm + npm hệ thống): đo trên
-            // vps_thuy-le 07/09 — bản đang chạy ở `/usr/lib/node_modules` (5.16.5) mà `npm i -g`
+            // vps_thuy-le 07/09 - bản đang chạy ở `/usr/lib/node_modules` (5.16.5) mà `npm i -g`
             // lại cài vào `/root/.nvm/versions/node/v24.20.0/lib/node_modules` (5.16.7). Log báo
-            // "updated successfully", service restart, mà giao diện vẫn bản cũ — không ai hiểu nổi.
+            // "updated successfully", service restart, mà giao diện vẫn bản cũ - không ai hiểu nổi.
             // installerDir = <prefix>/lib/node_modules/create-openclaw-bot ⇒ lùi 3 cấp là prefix.
             const npmPrefix = resolve(installerDir, '..', '..', '..');
             const prefixArgs = /[\\/]lib[\\/]node_modules[\\/]create-openclaw-bot[\\/]?$/.test(installerDir)
               ? ['--prefix', npmPrefix]
               : [];
-            sendLog(`[update-setup] Global npm install detected — npm i -g create-openclaw-bot@latest${prefixArgs.length ? ` (prefix ${npmPrefix})` : ''}…`);
+            sendLog(`[update-setup] Global npm install detected - npm i -g create-openclaw-bot@latest${prefixArgs.length ? ` (prefix ${npmPrefix})` : ''}…`);
             await run('npm', ['i', '-g', 'create-openclaw-bot@latest', '--no-audit', '--no-fund', ...prefixArgs], { cwd: installerDir });
           } else {
-            // Ephemeral `npx github:…` install: nothing to pull in place — the relaunch
+            // Ephemeral `npx github:…` install: nothing to pull in place - the relaunch
             // re-runs `npx github:…`, which fetches the latest from GitHub.
             sendLog('[update-setup] Fetching the latest from GitHub on relaunch…');
           }
@@ -7563,7 +7122,7 @@ async function handler(req, res, rootProjectDir) {
       if (result.warning) sendLog(`⚠️ ${result.warning}`);
       // A first Zalo bot changes the project's docker infra needs (the entrypoint must
       // install the pinned zalo-connect plugin BEFORE the gateway starts). Force-resync so
-      // the recreate below ships the zaloBackend-aware entrypoint — without this, the
+      // the recreate below ships the zaloBackend-aware entrypoint - without this, the
       // login flow has to install mid-boot and restart the container, which can
       // interrupt OpenClaw's first-run migrations and wedge its state lease.
       if (result.channel === 'zalo-personal') {
@@ -7657,14 +7216,14 @@ async function handler(req, res, rootProjectDir) {
       }
       if (req.method === 'PUT') {
         // Allow the same text types the file tree marks editable (it exposes .json/.js/.yml/…,
-        // not just .md — the old .md-only guard made "Save" silently fail on those files).
+        // not just .md - the old .md-only guard made "Save" silently fail on those files).
         const writableExt = new Set(['.md', '.txt', '.json', '.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx', '.yml', '.yaml', '.env', '.sh', '.bat', '.ps1', '.html', '.css']);
         if (!writableExt.has(extname(name).toLowerCase())) throw httpError(400, `Loại file này không hỗ trợ sửa từ UI (${extname(name) || 'không có đuôi'})`);
         const body = await readJson(req);
         const projectDir = await resolveProjectDir(rootProjectDir, body);
         const file = safeJoin(projectDir, name);
         const content = String(body.content || '');
-        // Don't let a typo brick openclaw.json & friends — reject invalid JSON with a clear error.
+        // Don't let a typo brick openclaw.json & friends - reject invalid JSON with a clear error.
         if (extname(name).toLowerCase() === '.json') {
           try { JSON.parse(content); } catch (e) { throw httpError(400, `JSON không hợp lệ: ${e.message}`); }
         }
@@ -7733,7 +7292,7 @@ function openUrl(url) {
 function restartInstaller() {
   // Emit the phrase the UI watches for (see appendLogLine) BEFORE we tear down the
   // server, so the browser tab starts polling and then reloads onto the new UI once
-  // it's back up on the SAME host/port — instead of hanging on a dead server.
+  // it's back up on the SAME host/port - instead of hanging on a dead server.
   sendLog('[update-setup] Setup Wizard updated successfully! Restarting UI to apply the new version...');
 
   const underSystemd = !!(process.env.INVOCATION_ID || process.env.JOURNAL_STREAM);
@@ -7747,11 +7306,11 @@ function restartInstaller() {
         try { activeServerInstance.close(); } catch {}
       }
 
-      // Under a service manager (systemd, pm2, …) just exit — it relaunches us with
+      // Under a service manager (systemd, pm2, …) just exit - it relaunches us with
       // the freshly pulled code. Re-spawning ourselves would escape the unit and
       // collide on the port.
       if (underSystemd) {
-        sendLog('[update-setup] Service-managed install — exiting so the supervisor relaunches the new version.');
+        sendLog('[update-setup] Service-managed install - exiting so the supervisor relaunches the new version.');
         setTimeout(() => process.exit(0), 400);
         return;
       }
@@ -7765,13 +7324,13 @@ function restartInstaller() {
 
       let bin, spawnArgs, opts;
       if (isNpx) {
-        // Ephemeral `npx github:…` run — re-fetch the latest from GitHub and relaunch.
+        // Ephemeral `npx github:…` run - re-fetch the latest from GitHub and relaunch.
         const win = process.platform === 'win32';
         bin = win ? 'npx.cmd' : 'npx';
         spawnArgs = ['-y', 'github:tuanminhhole/openclaw-setup', ...uiArgs];
         opts = { detached: true, stdio: 'inherit', shell: win };
       } else {
-        // Local clone / file install — re-run this entry (git pull already updated it).
+        // Local clone / file install - re-run this entry (git pull already updated it).
         bin = process.argv[0];
         spawnArgs = [process.argv[1], ...uiArgs];
         opts = { detached: true, stdio: 'inherit', shell: false };
@@ -7795,7 +7354,7 @@ function restartInstaller() {
 
 /**
  * One-time convenience: drop a short `openclaw-ui` command into the user's shell
- * profile so reopening the wizard later is a single word — no long manual setup.
+ * profile so reopening the wizard later is a single word - no long manual setup.
  * OS/shell-aware, idempotent, and fully best-effort (never throws, never blocks
  * startup). Only runs for npx-installed users (the cache dir must exist).
  */
@@ -7803,7 +7362,7 @@ function ensureReopenShortcut() {
   try {
     const home = os.homedir();
     const cliPath = join(home, '.openclaw-setup', 'node_modules', 'create-openclaw-bot', 'dist', 'cli.js');
-    if (!existsSync(cliPath)) return; // running from a cloned repo (dev) — nothing to shortcut
+    if (!existsSync(cliPath)) return; // running from a cloned repo (dev) - nothing to shortcut
     const MARK = '# >>> openclaw-ui (auto-added by OpenClaw Setup) >>>';
     const END = '# <<< openclaw-ui <<<';
 
@@ -7818,7 +7377,7 @@ function ensureReopenShortcut() {
       const block = `\n${MARK}\nfunction openclaw-ui { $env:OPENCLAW_SETUP_WIZARD="true"; node "${cliPath.replace(/\\/g, '\\\\')}" }\n${END}\n`;
       fs.mkdirSync(dirname(profile), { recursive: true });
       fs.appendFileSync(profile, block, 'utf8');
-      console.log("✓ Shortcut installed — open a NEW PowerShell and type:  openclaw-ui");
+      console.log("✓ Shortcut installed - open a NEW PowerShell and type:  openclaw-ui");
     } else {
       const shell = process.env.SHELL || '';
       const rcName = shell.includes('zsh') ? '.zshrc' : shell.includes('bash') ? '.bashrc' : '.profile';
@@ -7827,7 +7386,7 @@ function ensureReopenShortcut() {
       if (content.includes(MARK)) { console.log("💡 Reopen anytime with:  openclaw-ui"); return; }
       const block = `\n${MARK}\nalias openclaw-ui='OPENCLAW_SETUP_WIZARD=true node "${cliPath}"'\n${END}\n`;
       fs.appendFileSync(rc, block, 'utf8');
-      console.log(`✓ Shortcut added to ~/${rcName} — open a NEW terminal (or run 'source ~/${rcName}') and type:  openclaw-ui`);
+      console.log(`✓ Shortcut added to ~/${rcName} - open a NEW terminal (or run 'source ~/${rcName}') and type:  openclaw-ui`);
     }
   } catch { /* best-effort: a shortcut failure must never break startup */ }
 }
@@ -7864,10 +7423,10 @@ function isLocalPortListening(port, host = '127.0.0.1', timeout = 400) {
     sock.once('error', () => done(false));
   });
 }
-// On a headless server there's no local browser — print an SSH-tunnel command so the
+// On a headless server there's no local browser - print an SSH-tunnel command so the
 // operator can reach the dashboard AND the Open-web UIs from their own machine. This is
 // the discoverable answer for ANY user on a VPS (no manual ssh-config knowledge needed).
-// CHỈ forward những port đang THỰC SỰ listen trên host — gateway (18789) / 9Router (20128)
+// CHỈ forward những port đang THỰC SỰ listen trên host - gateway (18789) / 9Router (20128)
 // thường nằm trong Docker, không bind ra host, nên nếu forward cứng sẽ đẻ ra hàng loạt
 // "channel: open failed: connect failed: Connection refused" vô nghĩa ở phía client.
 async function printRemoteAccessHint(uiPort) {
@@ -7890,7 +7449,7 @@ async function printRemoteAccessHint(uiPort) {
   // itself: the gateway can no longer bind 18789, and the self-loop accepts connections while
   // answering nothing, so the port looks alive and the whole install hangs on "Waiting for gateway".
   // Cost a customer VPS install on 2026-08-28.
-  console.log('   ⚠️  Run that line on YOUR OWN machine — NOT in this shell. On the server it');
+  console.log('   ⚠️  Run that line on YOUR OWN machine - NOT in this shell. On the server it');
   console.log(`      steals port ${ports.join('/')} from the bot and the install never finishes.`);
   console.log('');
 }
@@ -7907,12 +7466,46 @@ async function detectExistingSetupUi(host, port) {
   }
 }
 
+/**
+ * On Windows, explain a port we could not bind instead of silently moving.
+ *
+ * Hyper-V / WinNAT reserves blocks of TCP ports for its own dynamic use, and anything inside a
+ * block fails to bind with no useful error. The blocks are re-randomised AT EVERY BOOT, so a port
+ * that worked yesterday is simply gone today - which is what happened on a customer machine:
+ * 51739-51838 swallowed the dashboard's 51789, the UI hopped to 51839, and the operator's SSH
+ * tunnel (pointing at 51789) went dead with nothing anywhere saying why.
+ *
+ * Returns a printable explanation, or '' when the port is not inside a reserved block.
+ */
+async function windowsReservedPortNote(port) {
+  if (process.platform !== 'win32') return '';
+  const r = await runCapture('netsh', ['interface', 'ipv4', 'show', 'excludedportrange', 'protocol=tcp'],
+    { timeout: 15000 }).catch(() => null);
+  if (!r || r.code !== 0) return '';
+  for (const line of String(r.stdout || '').split('\n')) {
+    const m = line.trim().match(/^(\d+)\s+(\d+)/);
+    if (!m) continue;
+    const start = Number(m[1]);
+    const end = Number(m[2]);
+    if (port < start || port > end) continue;
+    return [
+      `Windows đang giữ dải cổng ${start}-${end}, trong đó có ${port}, nên không mở được cổng này.`,
+      'Dải đó do Hyper-V/WinNAT cấp phát lại MỖI LẦN khởi động máy, nên hôm qua dùng được mà hôm nay thì không.',
+      `Giữ chỗ ${port} vĩnh viễn bằng PowerShell chạy quyền Administrator:`,
+      '  net stop winnat',
+      `  netsh int ipv4 add excludedportrange protocol=tcp startport=${port} numberofports=1 store=persistent`,
+      '  net start winnat',
+    ].join('\n');
+  }
+  return '';
+}
+
 export async function startLocalInstaller({ host = '127.0.0.1', preferredPort = 51789, openBrowser = true, projectDir = process.cwd() } = {}) {
   const port = await findPort(host, preferredPort);
   if (port !== preferredPort && (await detectExistingSetupUi(host, preferredPort))) {
     // Another Setup UI already owns the preferred port (a systemd service, an earlier npx run…).
     // Hopping to :51790 here is exactly how operators end up with SSH tunnels and printed hints
-    // pointing at a port nothing serves — so reuse the running instance instead of starting a
+    // pointing at a port nothing serves - so reuse the running instance instead of starting a
     // second one, and keep this process alive so an `ssh -L … "npx create-openclaw-bot"`
     // one-liner still holds the tunnel open. If the other instance ever goes away, take the
     // port over so the URL keeps working without the operator re-running anything.
@@ -7921,20 +7514,25 @@ export async function startLocalInstaller({ host = '127.0.0.1', preferredPort =
     activeUiPort = preferredPort;
     activeUiProjectDir = projectDir;
     console.log(`OpenClaw Setup UI is already running: ${url}`);
-    console.log('Reusing the running instance — nothing new was started. Keep this window open if it holds your SSH tunnel.');
+    console.log('Reusing the running instance - nothing new was started. Keep this window open if it holds your SSH tunnel.');
     ensureReopenShortcut();
     if (openBrowser) openUrl(url);
     printRemoteAccessHint(preferredPort).catch(() => {});
     const takeover = setInterval(async () => {
       if ((await findPort(host, preferredPort)) !== preferredPort) return; // still busy
       clearInterval(takeover);
-      console.log(`Port ${preferredPort} freed up — starting a Setup UI there to keep ${url} working.`);
+      console.log(`Port ${preferredPort} freed up - starting a Setup UI there to keep ${url} working.`);
       startLocalInstaller({ host, preferredPort, openBrowser: false, projectDir }).catch(() => {});
     }, 5000);
     return;
   }
   if (port !== preferredPort) {
-    console.log(`⚠ Port ${preferredPort} is busy with something that is not a Setup UI — using ${port} instead.`);
+    console.log(`⚠ Port ${preferredPort} is busy with something that is not a Setup UI - using ${port} instead.`);
+    // A port the operator has bookmarked or tunnelled to is worth one extra check before we give
+    // up on it: on Windows the cause is usually invisible, and naming it turns a lost afternoon
+    // into one command.
+    const note = await windowsReservedPortNote(preferredPort).catch(() => '');
+    if (note) console.log(note);
   }
   activeUiHost = host;
   activeUiPort = port;
@@ -7947,9 +7545,6 @@ export async function startLocalInstaller({ host = '127.0.0.1', preferredPort =
   ensureReopenShortcut();
   if (openBrowser) openUrl(url);
   printRemoteAccessHint(port).catch(() => {});
-  // Bring the host-control service back up when the operator left it enabled, so the bot's
-  // saved instructions keep working across installer restarts.
-  ensureHostControl(projectDir).catch(() => {});
   // Warm the probes the first page load would otherwise wait on (project list, runtime versions,
   // public IP, Zalo status). They run while the browser is still starting, so the dashboard opens
   // against a warm cache instead of paying for docker and CLI round-trips on first paint.
@@ -7961,4 +7556,4 @@ export async function startLocalInstaller({ host = '127.0.0.1', preferredPort =
   ]).catch(() => {});
 }
 
-export { patchBrowserAutomationHostPreference, debugChromeProfileDir, defaultChromeProfileDir, createBotInProject, updateBotInProject, deleteBotInProject, validateOpenclawConfig, startZaloLogin, readBotCredentials, resolveProject9RouterApiKey, installCore, deleteProjectFolder, buildZaloHealthSnapshot, removeEmptyWorkspaceAttestations, runHostCommand, detectHostCommands, detectHostCapabilityCommands, grantHostCapabilities, detectCodexApp, detectCodexMarketplace, resolveCodexCli, openPrivacyPane, projectDeployMode, isNativeProject, nativeServiceLabel, nativeEnv, ocArgv, migrateNativePaths, discoverNativeProjectRoots, detectOs, stripCliWarnings, migrationLeaseDeadline, ensureNativePlugins, findFreeHostPort, syncNativeServiceEnv, adoptStrayNativeHome, runNativeConfigMigrations, detectExistingSetupUi, nodeVersionSupported, migrateDockerProjectToNative, dedupeProjectsByRealState, hardenNativeServiceRestarts, clearNativeServiceFailure, describePortHolder, reportNativeGatewayBlockage };
+export { patchBrowserAutomationHostPreference, debugChromeProfileDir, defaultChromeProfileDir, createBotInProject, updateBotInProject, deleteBotInProject, validateOpenclawConfig, startZaloLogin, readBotCredentials, resolveProject9RouterApiKey, installCore, deleteProjectFolder, buildZaloHealthSnapshot, removeEmptyWorkspaceAttestations, openPrivacyPane, projectDeployMode, isNativeProject, nativeServiceLabel, nativeEnv, ocArgv, migrateNativePaths, discoverNativeProjectRoots, detectOs, stripCliWarnings, migrationLeaseDeadline, ensureNativePlugins, findFreeHostPort, syncNativeServiceEnv, adoptStrayNativeHome, runNativeConfigMigrations, detectExistingSetupUi, nodeVersionSupported, migrateDockerProjectToNative, dedupeProjectsByRealState, hardenNativeServiceRestarts, clearNativeServiceFailure, describePortHolder, reportNativeGatewayBlockage };