create-openclaw-bot 5.7.10 → 5.8.0

package/dist/setup.js

@@ -1,13 +1,13 @@
 /* ============================================
-   OpenClaw Setup Wizard — Logic v2
+   OpenClaw Setup Wizard — Logic v2
    Multi-model, Multi-plugin, Multi-channel
    ============================================ */
-// AUTO-GENERATED by build.mjs — edit files in src/setup/ instead
+// AUTO-GENERATED by build.mjs — edit files in src/setup/ instead
 
 (function () {
   'use strict';
 
-  // ── Globals: CDN logos, state, shared utils (setup/data/header.js) ─
+  // ── Globals: CDN logos, state, shared utils (setup/data/header.js) ─
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -76,7 +76,7 @@
     || 'grammy @grammyjs/runner @grammyjs/transformer-throttler @buape/carbon @larksuiteoapi/node-sdk @slack/web-api';
 
   function getGatewayAllowedOrigins(port) {
-    const normalizedPort = Number(port) || 18791;
+    const normalizedPort = Number(port) || 18789;
     const origins = new Set([
       `http://localhost:${normalizedPort}`,
       `http://127.0.0.1:${normalizedPort}`,
@@ -89,7 +89,7 @@
     return Array.from(origins);
   }
 
-  // ── PROVIDERS object (setup/data/providers.js) ─────────────────────
+  // ── PROVIDERS object (setup/data/providers.js) ─────────────────────
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -212,7 +212,7 @@
   };
 
 
-  // ── CHANNELS, system prompts, security rules (setup/data/channels.js) 
+  // ── CHANNELS, system prompts, security rules (setup/data/channels.js) 
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -383,7 +383,7 @@
 - ✅ Limit exposed ports (only 38789)`,
   };
 
-  // ── PLUGINS list (setup/data/plugins.js) ───────────────────────────
+  // ── PLUGINS list (setup/data/plugins.js) ───────────────────────────
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -445,7 +445,7 @@
   ];
 
 
-  // ── SKILLS list (setup/data/skills.js) ─────────────────────────────
+  // ── SKILLS list (setup/data/skills.js) ─────────────────────────────
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -616,10 +616,10 @@
   }
 
 
-  // ── Shared runtime constants, relay helpers, auth profile builders (setup/shared/common-gen.js) 
+  // ── Shared runtime constants, relay helpers, auth profile builders (setup/shared/common-gen.js) 
 // @ts-nocheck
 (function (root) {
-  const OPENCLAW_NPM_SPEC = 'openclaw@2026.5.4';
+  const OPENCLAW_NPM_SPEC = 'openclaw@latest';
   const OPENCLAW_RUNTIME_PACKAGES = 'grammy @grammyjs/runner @grammyjs/transformer-throttler @buape/carbon @larksuiteoapi/node-sdk @slack/web-api';
   const NINE_ROUTER_NPM_SPEC = '9router@latest';
   const NINE_ROUTER_PORT = 20128;
@@ -861,8 +861,9 @@ If setup reported a plugin install error, run this after the bot is running:
     return JSON.stringify(buildAuthProfilesJson(options), null, 2);
   }
 
-  function get9RouterBaseUrl(deployMode = 'native') {
-    return deployMode === 'docker' ? `${NINE_ROUTER_DOCKER_API_BASE_URL}/v1` : `${NINE_ROUTER_API_BASE_URL}/v1`;
+  function get9RouterBaseUrl(deployMode = 'native', routerPort) {
+    const port = routerPort || NINE_ROUTER_PORT;
+    return deployMode === 'docker' ? `http://9router:${port}/v1` : `http://localhost:${port}/v1`;
   }
 
   function build9RouterProviderConfig(baseUrl = `${NINE_ROUTER_API_BASE_URL}/v1`) {
@@ -870,6 +871,9 @@ If setup reported a plugin install error, run this after the bot is running:
       baseUrl,
       apiKey: NINE_ROUTER_PROXY_API_KEY,
       api: 'openai-completions',
+      request: {
+        allowPrivateNetwork: true,
+      },
       models: [
         {
           id: 'smart-route',
@@ -877,18 +881,12 @@ If setup reported a plugin install error, run this after the bot is running:
           contextWindow: 200000,
           maxTokens: 8192,
         },
-        ...SUPPORTED_CODEX_MODELS.map((id) => ({
-          id,
-          name: `Codex ${id.slice(3).replace(/-/g, ' ').replace(/\b\w/g, (char) => char.toUpperCase())}`,
-          contextWindow: 200000,
-          maxTokens: 8192,
-        })),
       ],
     };
   }
 
-  function buildGatewayConfig(port = 18791, deployMode = 'native', allowedOrigins = [], osChoice = '') {
-    const normalizedPort = Number(port) || 18791;
+  function buildGatewayConfig(port = 18789, deployMode = 'native', allowedOrigins = [], osChoice = '') {
+    const normalizedPort = Number(port) || 18789;
     const cfg = {
       port: normalizedPort,
       mode: 'local',
@@ -933,7 +931,7 @@ if (typeof exports !== 'undefined' && typeof globalThis !== 'undefined' && globa
   Object.assign(exports, globalThis.__openclawCommon);
 }
 
-  // ── Shared workspace file builders (IDENTITY, SOUL, AGENTS, TOOLS, TEAMS...) (setup/shared/workspace-gen.js) 
+  // ── Shared workspace file builders (IDENTITY, SOUL, AGENTS, TOOLS, TEAMS...) (setup/shared/workspace-gen.js) 
 /** @typedef {typeof globalThis & { __openclawWorkspace?: Record<string, Function> }} OpenClawWorkspaceRoot */
 
 const workspaceRoot = /** @type {OpenClawWorkspaceRoot} */ (
@@ -1187,8 +1185,9 @@ const CDP_URL = 'http://127.0.0.1:9222';
     const { isVi = true, variant = 'wizard', workspaceRoot = '' } = options;
     const wsRoot = workspaceRoot.replace(/\/+$/, '');
     const btPath = wsRoot ? `${wsRoot}/browser-tool.js` : 'browser-tool.js';
+    const modeHeading = variant === 'cli-server' ? '# Headless Server Mode\n\n' : '';
 
-    return `# Navigation
+    return `${modeHeading}# Navigation
 node ${btPath} status
 node ${btPath} open "https://google.com"
 node ${btPath} get_url
@@ -1460,7 +1459,7 @@ if (typeof exports !== 'undefined' && workspaceRoot.__openclawWorkspace) {
   Object.assign(exports, workspaceRoot.__openclawWorkspace);
 }
 
-  // ── Centralized bot config builders (openclaw.json, exec-approvals, .env) (setup/shared/bot-config-gen.js) 
+  // ── Centralized bot config builders (openclaw.json, exec-approvals, .env) (setup/shared/bot-config-gen.js) 
 // @ts-nocheck
 /**
  * @fileoverview Centralized bot configuration builders — single source of truth.
@@ -1514,7 +1513,7 @@ if (typeof exports !== 'undefined' && workspaceRoot.__openclawWorkspace) {
    * @param {Array}  opts.skills           - Full SKILLS registry array
    * @param {boolean} opts.hasBrowserDesktop - Browser desktop mode
    * @param {boolean} opts.hasBrowserServer  - Browser server mode
-   * @param {number} [opts.gatewayPort=18791]
+   * @param {number} [opts.gatewayPort=18789]
    * @param {Array}  [opts.gatewayAllowedOrigins]
    * @param {string} [opts.osChoice]       - 'windows' | 'macos' | 'vps' | 'ubuntu'
    * @param {string} [opts.selectedModel]  - For Ollama: specific model selected
@@ -1533,10 +1532,11 @@ if (typeof exports !== 'undefined' && workspaceRoot.__openclawWorkspace) {
       skills = [],
       hasBrowserDesktop = false,
       hasBrowserServer = false,
-      gatewayPort = 18791,
+      gatewayPort = 18789,
       gatewayAllowedOrigins = [],
       osChoice = '',
       selectedModel = '',
+      routerPort,
     } = opts;
 
     const common = _common;
@@ -1547,7 +1547,7 @@ if (typeof exports !== 'undefined' && workspaceRoot.__openclawWorkspace) {
     const agentsList = agentMetas.map((meta) => ({
       id: meta.agentId,
       ...(meta.name ? { name: meta.name } : {}),
-      workspace: `.openclaw/${meta.workspaceDir || 'workspace-' + meta.agentId}`,
+      workspace: `/root/project/.openclaw/${meta.workspaceDir || 'workspace-' + meta.agentId}`,
       agentDir: `agents/${meta.agentId}/agent`,
       model: { primary: model, fallbacks: [] },
     }));
@@ -1571,7 +1571,7 @@ if (typeof exports !== 'undefined' && workspaceRoot.__openclawWorkspace) {
         mode: 'merge',
         providers: {
           '9router': common.build9RouterProviderConfig(
-            common.get9RouterBaseUrl ? common.get9RouterBaseUrl(deployMode) : 'http://9router:20128/v1'
+            common.get9RouterBaseUrl ? common.get9RouterBaseUrl(deployMode, routerPort) : `http://9router:${routerPort || 20128}/v1`
           ),
         },
       };
@@ -1597,6 +1597,9 @@ if (typeof exports !== 'undefined' && workspaceRoot.__openclawWorkspace) {
 
     // ── commands ──────────────────────────────────────────────────────────────
     cfg.commands = { native: 'auto', nativeSkills: 'auto', restart: true, ownerDisplay: 'raw' };
+    if (selectedSkills.includes('scheduler')) {
+      cfg.commands.ownerAllowFrom = ['*'];
+    }
 
     // ── bindings (multi-bot or Zalo) ─────────────────────────────────────────
     if (isMultiBot && channelKey === 'telegram') {
@@ -1614,6 +1617,9 @@ if (typeof exports !== 'undefined' && workspaceRoot.__openclawWorkspace) {
 
     // ── tools ────────────────────────────────────────────────────────────────
     cfg.tools = { profile: 'full', exec: { host: 'gateway', security: 'full', ask: 'off' } };
+    if (selectedSkills.includes('scheduler')) {
+      cfg.tools.alsoAllow = ['group:automation'];
+    }
     if (isMultiBot) {
       cfg.tools.agentToAgent = {
         enabled: true,
@@ -1924,7 +1930,7 @@ if (typeof exports !== 'undefined' && typeof globalThis !== 'undefined' && globa
   Object.assign(exports, globalThis.__openclawBotConfig);
 }
 
-  // ── Shared install artifacts: Chrome debug, uninstall, skill catalog (setup/shared/install-gen.js) 
+  // ── Shared install artifacts: Chrome debug, uninstall, skill catalog (setup/shared/install-gen.js) 
 // @ts-nocheck
 // install-gen.js — Build install/runtime artifacts (Chrome debug, uninstall, skill catalog)
 // Workspace .md files are in workspace-gen.js (single source of truth).
@@ -2043,12 +2049,12 @@ fi
     }
 
     if (os === 'vps') {
-      return { name: 'uninstall-openclaw-vps.sh', content: `#!/usr/bin/env bash\nset -e\nPROJECT_DIR="${absUnix}"\nAPP_NAME="${appName}"\necho ""\necho "============================================================"\necho "  OpenClaw Uninstaller - VPS / Ubuntu Server"\necho "  Project: $PROJECT_DIR"\necho "  PM2 app: $APP_NAME"\necho "============================================================"\necho ""\nread -rp "Type YES to confirm full removal: " CONFIRM\nif [ "$CONFIRM" != "YES" ]; then echo "Cancelled."; exit 0; fi\necho "[1/5] Stopping PM2 processes..."\nif command -v pm2 &>/dev/null; then\n  pm2 delete "$APP_NAME" "$APP_NAME-9router" "$APP_NAME-9router-sync" openclaw openclaw-multibot 2>/dev/null || true\n  pm2 save --force 2>/dev/null || true\nfi\necho "[2/5] Killing leftover processes on ports 18791 / 20128..."\nfor port in 18791 20128; do\n  pid=$(lsof -ti tcp:$port 2>/dev/null || true)\n  [ -n "$pid" ] && kill -9 $pid 2>/dev/null || true\ndone\necho "[3/5] Uninstalling npm packages..."\nnpm uninstall -g openclaw 9router pm2 grammy @grammyjs/runner @grammyjs/transformer-throttler @buape/carbon @larksuiteoapi/node-sdk @slack/web-api 2>/dev/null || true\necho "[4/5] Removing project directory..."\n[ -d "$PROJECT_DIR" ] && rm -rf "$PROJECT_DIR" && echo "   OK: Deleted $PROJECT_DIR" || echo "   INFO: Not found."\necho "[5/5] Checking home-level .9router / .openclaw..."\nfor dir in "$HOME/.9router" "$HOME/.openclaw"; do\n  if [ -d "$dir" ]; then\n    read -rp "Delete $dir ? [YES/no]: " CLEAN\n    [ "$CLEAN" = "YES" ] && rm -rf "$dir" && echo "   OK: Deleted $dir" || echo "   Kept: $dir"\n  fi\ndone\n` };
+      return { name: 'uninstall-openclaw-vps.sh', content: `#!/usr/bin/env bash\nset -e\nPROJECT_DIR="${absUnix}"\nAPP_NAME="${appName}"\necho ""\necho "============================================================"\necho "  OpenClaw Uninstaller - VPS / Ubuntu Server"\necho "  Project: $PROJECT_DIR"\necho "  PM2 app: $APP_NAME"\necho "============================================================"\necho ""\nread -rp "Type YES to confirm full removal: " CONFIRM\nif [ "$CONFIRM" != "YES" ]; then echo "Cancelled."; exit 0; fi\necho "[1/5] Stopping PM2 processes..."\nif command -v pm2 &>/dev/null; then\n  pm2 delete "$APP_NAME" "$APP_NAME-9router" "$APP_NAME-9router-sync" openclaw openclaw-multibot 2>/dev/null || true\n  pm2 save --force 2>/dev/null || true\nfi\necho "[2/5] Killing leftover processes on ports 18789 / 20128..."\nfor port in 18789 20128; do\n  pid=$(lsof -ti tcp:$port 2>/dev/null || true)\n  [ -n "$pid" ] && kill -9 $pid 2>/dev/null || true\ndone\necho "[3/5] Uninstalling npm packages..."\nnpm uninstall -g openclaw 9router pm2 grammy @grammyjs/runner @grammyjs/transformer-throttler @buape/carbon @larksuiteoapi/node-sdk @slack/web-api 2>/dev/null || true\necho "[4/5] Removing project directory..."\n[ -d "$PROJECT_DIR" ] && rm -rf "$PROJECT_DIR" && echo "   OK: Deleted $PROJECT_DIR" || echo "   INFO: Not found."\necho "[5/5] Checking home-level .9router / .openclaw..."\nfor dir in "$HOME/.9router" "$HOME/.openclaw"; do\n  if [ -d "$dir" ]; then\n    read -rp "Delete $dir ? [YES/no]: " CLEAN\n    [ "$CLEAN" = "YES" ] && rm -rf "$dir" && echo "   OK: Deleted $dir" || echo "   Kept: $dir"\n  fi\ndone\n` };
     }
 
     if (os === 'linux' || os === 'linux-desktop' || os === 'macos') {
       const label = os === 'macos' ? 'macOS' : 'Linux Desktop';
-      return { name: 'uninstall-openclaw.sh', content: `#!/usr/bin/env bash\nset -e\nPROJECT_DIR="${absUnix}"\necho ""\necho "============================================================"\necho "  OpenClaw Uninstaller - ${label} Native"\necho "  Project: $PROJECT_DIR"\necho "============================================================"\necho ""\nread -rp "Type YES to confirm full removal: " CONFIRM\nif [ "$CONFIRM" != "YES" ]; then echo "Cancelled."; exit 0; fi\necho "[1/4] Stopping openclaw and 9router processes..."\npkill -f "openclaw gateway run" 2>/dev/null || true\npkill -f "9router.*20128" 2>/dev/null || true\npkill -f "9router-smart-route" 2>/dev/null || true\npkill -f "$PROJECT_DIR" 2>/dev/null || true\nfor port in 18791 20128; do\n  pid=$(lsof -ti tcp:$port 2>/dev/null || true)\n  [ -n "$pid" ] && kill -9 $pid 2>/dev/null || true\ndone\necho "[2/4] Uninstalling npm packages..."\nnpm uninstall -g openclaw 9router grammy @grammyjs/runner @grammyjs/transformer-throttler @buape/carbon @larksuiteoapi/node-sdk @slack/web-api 2>/dev/null || true\nsudo npm uninstall -g openclaw 9router 2>/dev/null || true\necho "[3/4] Removing project directory..."\n[ -d "$PROJECT_DIR" ] && rm -rf "$PROJECT_DIR" && echo "   OK: Deleted $PROJECT_DIR" || echo "   INFO: Not found."\necho "[4/4] Checking home-level .9router / .openclaw..."\nfor dir in "$HOME/.9router" "$HOME/.openclaw"; do\n  if [ -d "$dir" ]; then\n    read -rp "Delete $dir ? [YES/no]: " CLEAN\n    [ "$CLEAN" = "YES" ] && rm -rf "$dir" && echo "   OK: Deleted $dir" || echo "   Kept: $dir"\n  fi\ndone\n` };
+      return { name: 'uninstall-openclaw.sh', content: `#!/usr/bin/env bash\nset -e\nPROJECT_DIR="${absUnix}"\necho ""\necho "============================================================"\necho "  OpenClaw Uninstaller - ${label} Native"\necho "  Project: $PROJECT_DIR"\necho "============================================================"\necho ""\nread -rp "Type YES to confirm full removal: " CONFIRM\nif [ "$CONFIRM" != "YES" ]; then echo "Cancelled."; exit 0; fi\necho "[1/4] Stopping openclaw and 9router processes..."\npkill -f "openclaw gateway run" 2>/dev/null || true\npkill -f "9router.*20128" 2>/dev/null || true\npkill -f "9router-smart-route" 2>/dev/null || true\npkill -f "$PROJECT_DIR" 2>/dev/null || true\nfor port in 18789 20128; do\n  pid=$(lsof -ti tcp:$port 2>/dev/null || true)\n  [ -n "$pid" ] && kill -9 $pid 2>/dev/null || true\ndone\necho "[2/4] Uninstalling npm packages..."\nnpm uninstall -g openclaw 9router grammy @grammyjs/runner @grammyjs/transformer-throttler @buape/carbon @larksuiteoapi/node-sdk @slack/web-api 2>/dev/null || true\nsudo npm uninstall -g openclaw 9router 2>/dev/null || true\necho "[3/4] Removing project directory..."\n[ -d "$PROJECT_DIR" ] && rm -rf "$PROJECT_DIR" && echo "   OK: Deleted $PROJECT_DIR" || echo "   INFO: Not found."\necho "[4/4] Checking home-level .9router / .openclaw..."\nfor dir in "$HOME/.9router" "$HOME/.openclaw"; do\n  if [ -d "$dir" ]; then\n    read -rp "Delete $dir ? [YES/no]: " CLEAN\n    [ "$CLEAN" = "YES" ] && rm -rf "$dir" && echo "   OK: Deleted $dir" || echo "   Kept: $dir"\n  fi\ndone\n` };
     }
 
     return null;
@@ -2144,7 +2150,7 @@ fi
     L.push('echo.');
     L.push(isVi ? 'echo [OK] OpenClaw Gateway da khoi dong trong cua so moi!' : 'echo [OK] OpenClaw Gateway started in a new window!');
     L.push('echo.');
-    L.push('echo OpenClaw Dashboard:  http://127.0.0.1:18791');
+    L.push('echo OpenClaw Dashboard:  http://127.0.0.1:18789');
     if (is9Router) L.push('echo 9Router Dashboard:  http://127.0.0.1:20128/dashboard');
     L.push('echo.');
     L.push(isVi ? 'echo Ban co the dong cua so nay.' : 'echo You may close this window.');
@@ -2218,7 +2224,7 @@ fi
       }
       L.push('pm2 save >/dev/null 2>&1 || true');
       L.push('echo ""');
-      L.push('echo "OpenClaw Dashboard: http://127.0.0.1:18791"');
+      L.push('echo "OpenClaw Dashboard: http://127.0.0.1:18789"');
       if (is9Router) L.push('echo "9Router Dashboard:  http://127.0.0.1:20128/dashboard"');
       L.push('echo ""');
       L.push(isVi ? 'echo "Log gateway: pm2 logs $APP_NAME"' : 'echo "Gateway logs: pm2 logs $APP_NAME"');
@@ -2269,7 +2275,7 @@ fi
     L.push(isVi ? `echo "[OK] Gateway khoi dong (PID $GW_PID). Log: ${logFileGw}"` : `echo "[OK] Gateway started (PID $GW_PID). Log: ${logFileGw}"`);
     L.push('');
     L.push('echo ""');
-    L.push('echo "OpenClaw Dashboard: http://127.0.0.1:18791"');
+    L.push('echo "OpenClaw Dashboard: http://127.0.0.1:18789"');
     if (is9Router) L.push('echo "9Router Dashboard:  http://127.0.0.1:20128/dashboard"');
     L.push('echo ""');
     L.push(isVi ? 'echo "Bot dang chay background. Dung: openclaw gateway stop"' : 'echo "Bot running in background. Stop: openclaw gateway stop"');
@@ -2367,7 +2373,7 @@ fi
     "Write-Host \"\"",
     "if ($exitCode -eq 0) {",
     "    Write-Host \"  🎉 Upgrade hoan tat!\" -ForegroundColor Green",
-    "    Write-Host \"     Dashboard: http://localhost:18791\" -ForegroundColor Cyan",
+    "    Write-Host \"     Dashboard: http://localhost:18789\" -ForegroundColor Cyan",
     "} else {",
     "    Write-Host \"  ⚠️  Ma loi: $exitCode — xem log o tren.\" -ForegroundColor Yellow",
     "}",
@@ -2456,7 +2462,7 @@ fi
     "echo \"\"",
     "if [ $EXIT_CODE -eq 0 ]; then",
     "    echo -e \"${GREEN}  🎉 Upgrade hoan tat!${NC}\"",
-    "    echo -e \"${CYAN}     Dashboard: http://localhost:18791${NC}\"",
+    "    echo -e \"${CYAN}     Dashboard: http://localhost:18789${NC}\"",
     "else",
     "    echo -e \"${YELLOW}  ⚠️  Ma loi: $EXIT_CODE — xem log o tren.${NC}\"",
     "fi",
@@ -2492,7 +2498,7 @@ if (typeof exports !== 'undefined' && typeof globalThis !== 'undefined' && globa
   Object.assign(exports, globalThis.__openclawInstall);
 }
 
-  // ── Shared Docker artifact helpers for wizard + CLI (setup/shared/docker-gen.js) 
+  // ── Shared Docker artifact helpers for wizard + CLI (setup/shared/docker-gen.js) 
 // @ts-nocheck
 (function (root) {
   const common = (typeof globalThis !== 'undefined' && globalThis.__openclawCommon) || {};
@@ -2512,65 +2518,106 @@ if (typeof exports !== 'undefined' && typeof globalThis !== 'undefined' && globa
     return String(text).split('\n').map((line) => `${prefix}${line}`).join('\n');
   }
 
-  function build9RouterSmartRouteSyncScript(dbPath) {
-    return `const fs=require('fs');const INTERVAL=30000;const p='${dbPath}';
-const PM=${JSON.stringify(SMART_ROUTE_PROVIDER_MODELS)};
-const PREF=${JSON.stringify(SMART_ROUTE_PROVIDER_ORDER)};
-console.log('[sync-combo] 9Router sync loop started...');
-const sync = async () => {
-  try {
-    let db = {};
-    try { db = JSON.parse(fs.readFileSync(p, 'utf8')); } catch(e){}
-    if (!db.combos) db.combos = [];
-    const removeSmartRoute = () => {
-      const next = db.combos.filter(x => x.id !== 'smart-route');
-      if (next.length !== db.combos.length) {
-        db.combos = next;
-        fs.writeFileSync(p, JSON.stringify(db, null, 2));
-        console.log('[sync-combo] Removed smart-route (no active providers)');
-      }
-    };
-    const res = await fetch('http://localhost:20128/api/providers');
-    if (!res.ok) { console.log('[sync-combo] API not ready, retrying...'); return; }
-    const d = await res.json();
-    const rawConnections = Array.isArray(d.connections) ? d.connections : Array.isArray(d.providerConnections) ? d.providerConnections : [];
-    const activeConns = rawConnections.filter(c => c && c.provider && c.isActive !== false && !c.disabled);
-    const a = [...new Set(activeConns.map(c => c.provider))];
-    if (!a.length) { console.log('[sync-combo] No active providers reported; keeping existing smart-route'); return; }
-    a.sort((x, y) => (PREF.indexOf(x) === -1 ? 99 : PREF.indexOf(x)) - (PREF.indexOf(y) === -1 ? 99 : PREF.indexOf(y)));
-    const m = [];
-    for (const pv of a) {
-      if (PM[pv]) m.push(...PM[pv]);
-      const conns = activeConns.filter(c => c.provider === pv);
-      for (const c of conns) {
-        if (Array.isArray(c.models)) {
-          for (const mdl of c.models) {
-            const mdlId = typeof mdl === 'string' ? mdl : mdl.id;
-            if (mdlId && !m.includes(mdlId) && !m.includes(pv + '/' + mdlId)) {
-               m.push(pv + '/' + mdlId);
-            }
-          }
-        }
-      }
-    }
-    if (!m.length) { console.log('[sync-combo] No mapped models for active providers; keeping existing smart-route'); return; }
-    const c = { id: 'smart-route', name: 'smart-route', alias: 'smart-route', models: m };
-    const i = db.combos.findIndex(x => x.id === 'smart-route');
-    if (i >= 0) {
-      if (JSON.stringify(db.combos[i].models) !== JSON.stringify(c.models)) {
-        db.combos[i] = c;
-        fs.writeFileSync(p, JSON.stringify(db, null, 2));
-        console.log('[sync-combo] Updated smart-route: ' + c.models.length + ' models');
-      }
-    } else {
-      db.combos.push(c);
-      fs.writeFileSync(p, JSON.stringify(db, null, 2));
-      console.log('[sync-combo] Created smart-route: ' + c.models.length + ' models');
-    }
-  } catch (e) {}
-};
-setTimeout(sync, 5000);
-setInterval(sync, INTERVAL);`;
+  function build9RouterSmartRouteSyncScript() {
+    const lines = [
+      "const fs = require('fs');",
+      "const INTERVAL = 30000;",
+      "const DB_PATH = '/root/.9router/db/data.sqlite';",
+      "const PORT = process.env.PORT || 20128;",
+      "const COMBO_NAME = 'smart-route';",
+      "const API_BASE = `http://localhost:${PORT}`;",
+      "",
+      "function ensureSettings() {",
+      "  try {",
+      "    let db = null;",
+      "    try {",
+      "      const { DatabaseSync } = require('node:sqlite');",
+      "      db = new DatabaseSync(DB_PATH);",
+      "    } catch {",
+      "      let Database;",
+      "      try { Database = require('/usr/local/lib/node_modules/better-sqlite3'); } catch {",
+      "        try { Database = require('better-sqlite3'); } catch { return; }",
+      "      }",
+      "      db = Database(DB_PATH);",
+      "    }",
+      '    const existing = db.prepare("SELECT * FROM settings WHERE id = 1").get();',
+      "    if (!existing) {",
+      '      db.prepare("INSERT INTO settings (id, data) VALUES (1, ?)").run(JSON.stringify({ requireLogin: false }));',
+      "    } else {",
+      "      try {",
+      "        const data = JSON.parse(existing.data || '{}');",
+      "        if (data.requireLogin !== false) {",
+      "          data.requireLogin = false;",
+      '          db.prepare("UPDATE settings SET data = ? WHERE id = 1").run(JSON.stringify(data));',
+      "        }",
+      "      } catch {}",
+      "    }",
+      "    db.close();",
+      "  } catch (e) {}",
+      "}",
+      "",
+      "const sync = async () => {",
+      "  try {",
+      "    if (!fs.existsSync(DB_PATH)) return;",
+      "",
+      "    let existingCombo = null;",
+      "    try {",
+      "      const resp = await fetch(`${API_BASE}/api/combos`);",
+      "      if (resp.status === 401) {",
+      "        ensureSettings();",
+      "        return;",
+      "      }",
+      "      const data = await resp.json();",
+      "      if (data.combos) {",
+      "        existingCombo = data.combos.find(c => c.name === COMBO_NAME);",
+      "      }",
+      "    } catch (e) { return; }",
+      "",
+      "    if (existingCombo) return;",
+      "",
+      "    let activeProviders = [];",
+      "    try {",
+      "      const resp = await fetch(`${API_BASE}/api/providers`);",
+      "      const data = await resp.json();",
+      "      const conns = data.connections || data.providerConnections || [];",
+      "      activeProviders = [...new Set(",
+      "        conns.filter(c => c && c.provider && c.isActive !== false && !c.disabled).map(c => c.provider)",
+      "      )];",
+      "    } catch (e) { return; }",
+      "",
+      "    if (!activeProviders.length) return;",
+      "",
+      "    let models = [];",
+      "    try {",
+      "      const resp = await fetch(`${API_BASE}/api/models`);",
+      "      const data = await resp.json();",
+      "      if (data.models && Array.isArray(data.models)) {",
+      "        models = data.models",
+      "          .filter(m => activeProviders.includes(m.provider))",
+      "          .filter(m => !/(embedding|image|tts|stt|audio|vision)/i.test(m.model))",
+      "          .map(m => m.fullModel);",
+      "      }",
+      "      models = [...new Set(models)];",
+      "    } catch (e) { return; }",
+      "",
+      "    if (!models.length) return;",
+      "",
+      "    try {",
+      "      await fetch(`${API_BASE}/api/combos`, {",
+      "        method: 'POST',",
+      "        headers: { 'Content-Type': 'application/json' },",
+      "        body: JSON.stringify({ name: COMBO_NAME, models })",
+      "      });",
+      "      console.log('[sync-combo] Created smart-route with ' + models.length + ' models');",
+      "    } catch (e) {}",
+      "  } catch (e) {}",
+      "};",
+      "",
+      "if (fs.existsSync(DB_PATH)) ensureSettings();",
+      "setTimeout(sync, 10000);",
+      "setInterval(sync, INTERVAL);",
+    ];
+    return lines.join('\n');
   }
 
 function build9RouterPatchScript() {
@@ -2635,20 +2682,20 @@ for(const root of roots){if(!root||!fs.existsSync(root))continue;touched+=patchP
 if(touched){console.log('[patch-9router] Applied Codex compatibility patch.');}else{console.log('[patch-9router] No compatible 9router source files found to patch.');}`;
   }
 
-  function build9RouterComposeEntrypointScript(syncScriptBase64, patchScriptBase64) {
+  function build9RouterComposeEntrypointScript(routerPort) {
+      const port = routerPort || 20128;
       const nineRouterSpec = (typeof globalThis !== 'undefined' && globalThis.__openclawCommon && globalThis.__openclawCommon.NINE_ROUTER_NPM_SPEC) || '9router@latest';
       return [
-      `npm install -g ${nineRouterSpec}`,
-      `node -e "require('fs').writeFileSync('/tmp/patch-9router.js',Buffer.from('${patchScriptBase64}','base64').toString())"`,
-      `node -e "require('fs').writeFileSync('/tmp/sync.js',Buffer.from('${syncScriptBase64}','base64').toString())"`,
+      `npm install -g ` + nineRouterSpec + ` better-sqlite3`,
       'node /tmp/patch-9router.js || true',
+      'node -e "const fs=require(\'fs\'),path=require(\'path\'); const DB_PATH=\'/root/.9router/db/data.sqlite\'; const dir=path.dirname(DB_PATH); if(!fs.existsSync(dir))fs.mkdirSync(dir,{recursive:true}); try{ const {DatabaseSync}=require(\'node:sqlite\'); const db=new DatabaseSync(DB_PATH); db.prepare(\'CREATE TABLE IF NOT EXISTS settings (id INTEGER PRIMARY KEY CHECK (id = 1), data TEXT NOT NULL)\').run(); const existing=db.prepare(\'SELECT * FROM settings WHERE id = 1\').get(); if(!existing){ db.prepare(\'INSERT INTO settings (id, data) VALUES (1, ?)\').run(JSON.stringify({requireLogin:false})); } db.close(); }catch(e){}" || true',
       'node /tmp/sync.js > /tmp/sync.log 2>&1 &',
-      'exec 9router -n -l -H 0.0.0.0 -p 20128 --skip-update'
+      `exec 9router -n -l -H 0.0.0.0 -p ${port} --skip-update`
     ].join('\n');
   }
 
   function buildGatewayPatchCmd() {
-    return `node -e \\"const fs=require('fs'),os=require('os'),path=require('path'),p=path.join(process.cwd(),'.openclaw','openclaw.json');if(fs.existsSync(p)){const c=JSON.parse(fs.readFileSync(p,'utf8'));const a=new Set(['http://localhost:18791','http://127.0.0.1:18791','http://0.0.0.0:18791']);for(const entries of Object.values(os.networkInterfaces()||{})){for(const entry of entries||[]){if(!entry||entry.internal||entry.family!=='IPv4'||!entry.address)continue;a.add('http://' + entry.address + ':18791');}}c.tools=Object.assign({},c.tools,{profile:'full',exec:{host:'gateway',security:'full',ask:'off'}});c.gateway=Object.assign({},c.gateway,{port:18791,bind:'custom',customBindHost:'0.0.0.0',controlUi:Object.assign({},c.gateway?.controlUi,{allowedOrigins:Array.from(a).filter(Boolean)})});fs.writeFileSync(p,JSON.stringify(c,null,2));}\\"`;
+    return `node -e \\"const fs=require('fs'),os=require('os'),path=require('path'),p=path.join(process.cwd(),'.openclaw','openclaw.json');if(fs.existsSync(p)){const c=JSON.parse(fs.readFileSync(p,'utf8'));const gp=Number(process.env.OPENCLAW_GATEWAY_PORT||process.env.OPENCLAW_PORT)||c.gateway?.port||18789;const a=new Set(['http://localhost:'+gp,'http://127.0.0.1:'+gp,'http://0.0.0.0:'+gp]);for(const entries of Object.values(os.networkInterfaces()||{})){for(const entry of entries||[]){if(!entry||entry.internal||entry.family!=='IPv4'||!entry.address)continue;a.add('http://' + entry.address + ':'+gp);}}const p9=c.models&&c.models.providers&&c.models.providers['9router'];if(p9){p9.request=Object.assign({},p9.request,{allowPrivateNetwork:true});}c.tools=Object.assign({},c.tools,{profile:'full',exec:{host:'gateway',security:'full',ask:'off'}});c.gateway=Object.assign({},c.gateway,{port:gp,bind:'custom',customBindHost:'0.0.0.0',controlUi:Object.assign({},c.gateway?.controlUi,{allowedOrigins:Array.from(a).filter(Boolean)})});fs.writeFileSync(p,JSON.stringify(c,null,2));}\\"`;
   }
 
   function buildDockerArtifacts(options) {
@@ -2665,7 +2712,7 @@ if(touched){console.log('[patch-9router] Applied Codex compatibility patch.');}e
       dockerfilePlugins = [],
       dockerfileSkillInstallMode = 'none',
       runtimeCommandParts = [],
-      volumeMount = '../../.openclaw:/root/project/.openclaw\\n      - ../../:/mnt/project',
+      volumeMount = '../../.openclaw:/root/project/.openclaw\n      - ../../:/mnt/project',
       singleComposeName = 'oc-bot',
       multiComposeName = 'oc-multibot',
       singleAppContainerName = 'openclaw-bot',
@@ -2678,7 +2725,8 @@ if(touched){console.log('[patch-9router] Applied Codex compatibility patch.');}e
       multiOllamaNumParallel = 1,
       singleOllamaNumParallel = 1,
       emitBrowserInstall = true,
-
+      gatewayPort = 18789,
+      routerPort = 20128,
     } = options;
 
     const browserAptExtra = hasBrowser ? ' xvfb socat' : '';
@@ -2704,10 +2752,9 @@ if(touched){console.log('[patch-9router] Applied Codex compatibility patch.');}e
     // Dynamic runtime configuration: backup config before any first-run install, restore after.
     // Missing plugin install may touch openclaw.json, so preserve critical fields.
     const backupConfigScript = `const fs=require('fs'),path=require('path'),p=path.join(process.cwd(),'.openclaw','openclaw.json'),b=p.replace('openclaw.json','.openclaw-config-backup.json');if(fs.existsSync(p)){fs.copyFileSync(p,b);}`;
-    const backupConfigB64 = encodeBase64Utf8(backupConfigScript);
 
-    const restoreConfigScript = `const fs=require('fs'),os=require('os'),path=require('path'),p=path.join(process.cwd(),'.openclaw','openclaw.json'),b=p.replace('openclaw.json','.openclaw-config-backup.json');if(fs.existsSync(p)&&fs.existsSync(b)){const c=JSON.parse(fs.readFileSync(p,'utf8'));const bk=JSON.parse(fs.readFileSync(b,'utf8'));const keep=['agents','channels','bindings','commands','models','browser','skills'];for(const k of keep){if(bk[k]&&!c[k])c[k]=bk[k];}const a=new Set(['http://localhost:18791','http://127.0.0.1:18791','http://0.0.0.0:18791']);for(const entries of Object.values(os.networkInterfaces()||{})){for(const entry of entries||[]){if(!entry||entry.internal||entry.family!=='IPv4'||!entry.address)continue;a.add('http://'+entry.address+':18791');}}c.tools=Object.assign({},c.tools,{profile:'full',exec:{host:'gateway',security:'full',ask:'off'}});c.gateway=Object.assign({},c.gateway,{port:18791,bind:'custom',customBindHost:'0.0.0.0',mode:c.gateway?.mode||bk.gateway?.mode||'local',controlUi:Object.assign({},c.gateway?.controlUi,{allowedOrigins:Array.from(a).filter(Boolean)})});fs.writeFileSync(p,JSON.stringify(c,null,2));fs.unlinkSync(b);}`;
-    const restoreConfigB64 = encodeBase64Utf8(restoreConfigScript);
+    const restoreConfigScript = `const fs=require('fs'),os=require('os'),path=require('path'),p=path.join(process.cwd(),'.openclaw','openclaw.json'),b=p.replace('openclaw.json','.openclaw-config-backup.json');if(fs.existsSync(p)&&fs.existsSync(b)){const c=JSON.parse(fs.readFileSync(p,'utf8'));const bk=JSON.parse(fs.readFileSync(b,'utf8'));const keep=['agents','channels','bindings','commands','models','browser','skills','plugins','tools'];for(const k of keep){if(bk[k]&&!c[k])c[k]=bk[k];}const gp=Number(process.env.OPENCLAW_GATEWAY_PORT||process.env.OPENCLAW_PORT)||c.gateway?.port||bk.gateway?.port||18789;const a=new Set(['http://localhost:'+gp,'http://127.0.0.1:'+gp,'http://0.0.0.0:'+gp]);for(const entries of Object.values(os.networkInterfaces()||{})){for(const entry of entries||[]){if(!entry||entry.internal||entry.family!=='IPv4'||!entry.address)continue;a.add('http://'+entry.address+':'+gp);}}c.tools=Object.assign({},c.tools,{profile:'full',exec:{host:'gateway',security:'full',ask:'off'}});c.gateway=Object.assign({},c.gateway,{port:gp,bind:'custom',customBindHost:'0.0.0.0',mode:c.gateway?.mode||bk.gateway?.mode||'local',controlUi:Object.assign({},c.gateway?.controlUi,{allowedOrigins:Array.from(a).filter(Boolean)})});fs.writeFileSync(p,JSON.stringify(c,null,2));fs.unlinkSync(b);}`;
+    const securityCompatScript = `const fs=require('fs'),path=require('path');const scopes=['operator.admin','operator.pairing','operator.approvals'];function uniq(a){return Array.from(new Set([...(Array.isArray(a)?a:[]),...scopes]));}function walk(v){if(!v||typeof v!=='object')return;if(Array.isArray(v)){v.forEach(walk);return;}if(Array.isArray(v.scopes)||Array.isArray(v.approvedScopes)){v.scopes=uniq(v.scopes);v.approvedScopes=uniq(v.approvedScopes);}Object.values(v).forEach(walk);}const home=process.env.OPENCLAW_HOME||path.join(process.cwd(),'.openclaw');const state=process.env.OPENCLAW_STATE_DIR||home;const cfgPath=path.join(process.cwd(),'.openclaw','openclaw.json');if(fs.existsSync(cfgPath)){const c=JSON.parse(fs.readFileSync(cfgPath,'utf8'));const p=c.models&&c.models.providers&&c.models.providers['9router'];if(p){p.request=Object.assign({},p.request,{allowPrivateNetwork:true});}fs.writeFileSync(cfgPath,JSON.stringify(c,null,2));}for(const root of Array.from(new Set([home,state]))){const f=path.join(root,'devices','paired.json');if(fs.existsSync(f)){const d=JSON.parse(fs.readFileSync(f,'utf8'));walk(d);fs.writeFileSync(f,JSON.stringify(d,null,2));}}`;
 
     const runtimeParts = runtimeCommandParts.filter(Boolean);
     const runtimePrelude = [
@@ -2746,9 +2793,34 @@ if(touched){console.log('[patch-9router] Applied Codex compatibility patch.');}e
     ];
     runtimeParts.unshift(...runtimePrelude);
     // Backup config BEFORE plugin installs (runtimeCommandParts may contain plugin install commands)
-    runtimeParts.unshift(`node -e 'eval(Buffer.from("${backupConfigB64}","base64").toString())'`);
+    runtimeParts.unshift(`node - <<'NODE'\n${backupConfigScript}\nNODE`);
     // Restore config AFTER plugin installs (which may clobber openclaw.json)
-    runtimeParts.push(`node -e 'eval(Buffer.from("${restoreConfigB64}","base64").toString())'`);
+    runtimeParts.push(`node - <<'NODE'\n${restoreConfigScript}\nNODE`);
+    runtimeParts.push(`node - <<'NODE'\n${securityCompatScript}\nNODE`);
+    // Zalouser stability: patch watchdog tolerance and add auto-restart monitor
+    runtimeParts.push([
+      '# Patch zalouser watchdog tolerance (35s -> 90s) to survive provider auth pre-warming',
+      'ZALO_JS=$(find "$OPENCLAW_HOME" -path "*/zalouser/dist/zalo-js-*.js" -type f 2>/dev/null | head -1)',
+      'if [ -n "$ZALO_JS" ] && grep -q "35e3" "$ZALO_JS" 2>/dev/null; then',
+      '  sed -i "s/LISTENER_WATCHDOG_MAX_GAP_MS\\\\s*=\\\\s*35e3/LISTENER_WATCHDOG_MAX_GAP_MS = 90e3/" "$ZALO_JS"',
+      '  echo "[entrypoint] patched zalouser watchdog gap: 35s -> 90s"',
+      'fi',
+    ].join('\\n'));
+    runtimeParts.push([
+      '# Zalo channel auto-restart monitor (background)',
+      '(',
+      '  sleep 180',
+      '  while true; do',
+      '    sleep 60',
+      '    STATUS=$(openclaw channels status 2>/dev/null | grep -i "Zalo Personal" || true)',
+      '    if echo "$STATUS" | grep -qi "stopped"; then',
+      '      echo "[zalo-monitor] Zalo channel stopped - restarting container in 5s"',
+      '      sleep 5',
+      '      kill 1 2>/dev/null || true',
+      '    fi',
+      '  done',
+      ') &',
+    ].join('\\n'));
     if (hasBrowser) {
       runtimeParts.push('socat TCP-LISTEN:9222,fork,reuseaddr TCP:host.docker.internal:9222 &');
       runtimeParts.push('Xvfb :99 -screen 0 1280x720x24 > /dev/null 2>&1 & DISPLAY=:99 openclaw gateway run');
@@ -2756,7 +2828,6 @@ if(touched){console.log('[patch-9router] Applied Codex compatibility patch.');}e
       runtimeParts.push('openclaw gateway run');
     }
     const runtimeScript = ['#!/bin/sh', 'set -e', ...runtimeParts].join('\n');
-    const runtimeScriptB64 = encodeBase64Utf8(runtimeScript);
     const dockerfile = `FROM node:22-slim
 
 RUN apt-get update && apt-get install -y git curl python3${browserAptExtra} && rm -rf /var/lib/apt/lists/*
@@ -2765,21 +2836,20 @@ ARG OPENCLAW_VER="${openClawNpmSpec}"
 ARG CACHE_BUST=""
 RUN echo "CACHE_BUST=$CACHE_BUST" && npm install -g $OPENCLAW_VER ${openClawRuntimePackages}${skillLines}${pluginLines}
 ${patchLine}
-RUN node -e "require('fs').writeFileSync('/usr/local/bin/openclaw-entrypoint.sh', Buffer.from('${runtimeScriptB64}','base64').toString())" && chmod +x /usr/local/bin/openclaw-entrypoint.sh
+COPY entrypoint.sh /usr/local/bin/openclaw-entrypoint.sh
+RUN chmod +x /usr/local/bin/openclaw-entrypoint.sh
 WORKDIR /root/project
 
-EXPOSE 18791
+EXPOSE ${gatewayPort}
 
 CMD ["/bin/sh", "/usr/local/bin/openclaw-entrypoint.sh"]`;
 
-    const syncScript = build9RouterSmartRouteSyncScript('/root/.9router/db.json');
-    const syncScriptBase64 = encodeBase64Utf8(syncScript);
-const patchScript = build9RouterPatchScript();
-    const patchScriptBase64 = encodeBase64Utf8(patchScript);
-    const docker9RouterEntrypointScript = build9RouterComposeEntrypointScript(syncScriptBase64, patchScriptBase64);
+    const syncScript = build9RouterSmartRouteSyncScript();
+    const patchScript = build9RouterPatchScript();
+    const docker9RouterEntrypointScript = build9RouterComposeEntrypointScript(routerPort);
     const extraHostsBlock = `    extra_hosts:\n      - "host.docker.internal:host-gateway"`;
 
-    const appEnvironmentBlock = '    environment:\n      - OPENCLAW_HOME=/root/project/.openclaw\n      - OPENCLAW_STATE_DIR=/root/project/.openclaw\n      - OPENCLAW_ALLOW_INSECURE_PRIVATE_WS=1\n    tmpfs:\n      - /root/project/.openclaw/plugin-runtime-deps\n';
+    const appEnvironmentBlock = `    environment:\n      - OPENCLAW_HOME=/root/project/.openclaw\n      - OPENCLAW_STATE_DIR=/root/project/.openclaw\n      - OPENCLAW_ALLOW_INSECURE_PRIVATE_WS=1\n      - OPENCLAW_GATEWAY_PORT=${gatewayPort}\n      - OPENCLAW_PORT=${gatewayPort}\n    tmpfs:\n      - /root/project/.openclaw/plugin-runtime-deps\n`;
 
     let compose;
     if (isMultiBot) {
@@ -2797,11 +2867,11 @@ services:
     container_name: ${multiAppContainerName}
     restart: always
     env_file:
-      - .env
+      - ../../.env
 ${appEnvironmentBlock}${dependsOn}${extraHosts}    volumes:
       - ${volumeMount}
     ports:
-      - "18791:18791"
+      - "${gatewayPort}:${gatewayPort}"
 
   9router:
     image: node:22-slim
@@ -2813,13 +2883,15 @@ ${appEnvironmentBlock}${dependsOn}${extraHosts}    volumes:
       - |
 ${indentBlock(docker9RouterEntrypointScript, 8)}
     environment:
-      - PORT=20128
+      - PORT=${routerPort}
       - HOSTNAME=0.0.0.0
       - CI=true
     volumes:
       - 9router-data:/root/.9router
+      - ./sync.js:/tmp/sync.js:ro
+      - ./patch-9router.js:/tmp/patch-9router.js:ro
     ports:
-      - "20128:20128"
+      - "${routerPort}:${routerPort}"
 
 volumes:
   9router-data:`;
@@ -2832,11 +2904,11 @@ services:
     container_name: ${multiAppContainerName}
     restart: always
     env_file:
-      - .env
+      - ../../.env
 ${appEnvironmentBlock}${dependsOn}${extraHosts}    volumes:
       - ${volumeMount}
     ports:
-      - "18791:18791"
+      - "${gatewayPort}:${gatewayPort}"
 
   ollama:
     image: ollama/ollama:latest
@@ -2872,11 +2944,11 @@ services:
     container_name: ${multiAppContainerName}
     restart: always
     env_file:
-      - .env
+      - ../../.env
 ${appEnvironmentBlock}${extraHosts}    volumes:
       - ${volumeMount}
     ports:
-      - "18791:18791"`;
+      - "${gatewayPort}:${gatewayPort}"`;
       }
     } else if (is9Router) {
       compose = `name: ${singleComposeName}
@@ -2886,13 +2958,14 @@ services:
     container_name: ${singleAppContainerName}
     restart: always
     env_file:
-      - .env
+      - ../../.env
     depends_on:
       - 9router
 ${appEnvironmentBlock}${hasBrowser ? `${extraHostsBlock}\n` : ''}    volumes:
       - ${volumeMount}
+      - openclaw-plugins:/root/project/.openclaw/npm
     ports:
-      - "18791:18791"
+      - "${gatewayPort}:${gatewayPort}"
 
   9router:
     image: node:22-slim
@@ -2904,16 +2977,19 @@ ${appEnvironmentBlock}${hasBrowser ? `${extraHostsBlock}\n` : ''}    volumes:
       - |
 ${indentBlock(docker9RouterEntrypointScript, 8)}
     environment:
-      - PORT=20128
+      - PORT=${routerPort}
       - HOSTNAME=0.0.0.0
       - CI=true
     volumes:
       - 9router-data:/root/.9router
+      - ./sync.js:/tmp/sync.js:ro
+      - ./patch-9router.js:/tmp/patch-9router.js:ro
     ports:
-      - "20128:20128"
+      - "${routerPort}:${routerPort}"
 
 volumes:
-  9router-data:`;
+  9router-data:
+  openclaw-plugins:`;
     } else if (isLocal) {
       const ollamaModelTag = String(selectedModel || 'ollama/gemma4:e2b').replace('ollama/', '');
       compose = `name: ${singleComposeName}
@@ -2922,12 +2998,12 @@ services:
     build: .
     container_name: ${singleAppContainerName}
     restart: always
-    env_file: .env
+    env_file: ../../.env
 ${appEnvironmentBlock}    depends_on:
       ollama:
         condition: service_healthy
 ${hasBrowser ? `${extraHostsBlock}\n` : ''}    ports:
-      - "18791:18791"
+      - "${gatewayPort}:${gatewayPort}"
     volumes:
       - ${volumeMount}
 
@@ -2965,17 +3041,19 @@ services:
     container_name: ${singleAppContainerName}
     restart: always
     env_file:
-      - .env
+      - ../../.env
 ${appEnvironmentBlock}${plainSingleExtraHosts ? `${extraHostsBlock}\n` : ''}    volumes:
       - ${volumeMount}
     ports:
-      - "18791:18791"`;
+      - "${gatewayPort}:${gatewayPort}"`;
     }
 
     return {
       dockerfile,
       compose,
+      entrypointScript: runtimeScript,
       syncScript,
+      patchScript,
       docker9RouterEntrypointScript,
       gatewayPatchCmd: buildGatewayPatchCmd(),
     };
@@ -2996,7 +3074,9 @@ if (typeof exports !== 'undefined' && typeof globalThis !== 'undefined' && globa
   Object.assign(exports, globalThis.__openclawDockerGen);
 }
 
-  // ── buildNativeScriptCtx and shared native runtime helpers (setup/generators/native-helpers-gen.js) 
+
+
+  // ── buildNativeScriptCtx and shared native runtime helpers (setup/generators/native-helpers-gen.js) 
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -3048,15 +3128,101 @@ function buildNativeScriptCtx(options) {
   });
 
   function native9RouterSyncScriptContent() {
-    return `const fs=require('fs');
-const path=require('path');
-const INTERVAL=30000;
-const p=path.join(process.env.DATA_DIR||'.9router','db.json');
-const ROUTER='${globalThis.__openclawCommon.NINE_ROUTER_API_BASE_URL}';
-const PM=${JSON.stringify(SMART_ROUTE_PROVIDER_MODELS)};
-const PREF=${JSON.stringify(SMART_ROUTE_PROVIDER_ORDER)};
-console.log('[sync-combo] 9Router sync loop started...');
-const sync=async()=>{try{const res=await fetch(ROUTER+'/api/providers');if(!res.ok){console.log('[sync-combo] API not ready, retrying...');return;}const d=await res.json();const rawConnections=Array.isArray(d.connections)?d.connections:Array.isArray(d.providerConnections)?d.providerConnections:[];const a=[...new Set(rawConnections.filter(c=>c&&c.provider&&c.isActive!==false&&!c.disabled).map(c=>c.provider))];let db={};try{db=JSON.parse(fs.readFileSync(p,'utf8'));}catch{}if(!db.combos)db.combos=[];const removeSmartRoute=()=>{const next=db.combos.filter(x=>x.id!=='smart-route');if(next.length!==db.combos.length){db.combos=next;fs.writeFileSync(p,JSON.stringify(db,null,2));console.log('[sync-combo] Removed smart-route (no active providers)');}};if(!a.length){removeSmartRoute();return;}a.sort((x,y)=>(PREF.indexOf(x)===-1?99:PREF.indexOf(x))-(PREF.indexOf(y)===-1?99:PREF.indexOf(y)));const m=a.flatMap(provider=>PM[provider]||[]);if(!m.length){removeSmartRoute();return;}const c={id:'smart-route',name:'smart-route',alias:'smart-route',models:m};const i=db.combos.findIndex(x=>x.id==='smart-route');if(i>=0){if(JSON.stringify(db.combos[i].models)!==JSON.stringify(c.models)){db.combos[i]=c;fs.writeFileSync(p,JSON.stringify(db,null,2));console.log('[sync-combo] Updated smart-route: '+c.models.length+' models from: '+a.join(','));}}else{db.combos.push(c);fs.writeFileSync(p,JSON.stringify(db,null,2));console.log('[sync-combo] Created smart-route: '+c.models.length+' models from: '+a.join(','));}}catch(e){console.log('[sync-combo] Error:',e.message);}};setTimeout(sync,5000);setInterval(sync,INTERVAL);`;
+    return `const fs = require('fs');
+const path = require('path');
+const INTERVAL = 30000;
+const DB_PATH = path.join(process.env.DATA_DIR || '.9router', 'db', 'data.sqlite');
+const PORT = process.env.PORT || 20128;
+const COMBO_NAME = 'smart-route';
+const API_BASE = \\\`http://localhost:\\\${PORT}\\\`;
+
+function ensureSettings() {
+  try {
+    let Database;
+    try {
+      const cp = require('child_process');
+      const npmRoot = cp.execSync('npm root -g').toString().trim();
+      Database = require(path.join(npmRoot, '9router', 'node_modules', 'better-sqlite3'));
+    } catch {
+      try { Database = require('better-sqlite3'); } catch { return; }
+    }
+    const db = Database(DB_PATH);
+    const existing = db.prepare("SELECT * FROM settings WHERE id = 1").get();
+    if (!existing) {
+      db.prepare("INSERT INTO settings (id, data) VALUES (1, ?)").run(JSON.stringify({ requireLogin: false }));
+    } else {
+      try {
+        const data = JSON.parse(existing.data || '{}');
+        if (data.requireLogin !== false) {
+          data.requireLogin = false;
+          db.prepare("UPDATE settings SET data = ? WHERE id = 1").run(JSON.stringify(data));
+        }
+      } catch {}
+    }
+    db.close();
+  } catch (e) {}
+}
+
+const sync = async () => {
+  try {
+    if (!fs.existsSync(DB_PATH)) return;
+
+    let existingCombo = null;
+    try {
+      const resp = await fetch(\\\`\\\${API_BASE}/api/combos\\\`);
+      if (resp.status === 401) {
+        ensureSettings();
+        return;
+      }
+      const data = await resp.json();
+      if (data.combos) {
+        existingCombo = data.combos.find(c => c.name === COMBO_NAME);
+      }
+    } catch (e) { return; }
+
+    if (existingCombo) return;
+
+    let activeProviders = [];
+    try {
+      const resp = await fetch(\\\`\\\${API_BASE}/api/providers\\\`);
+      const data = await resp.json();
+      const conns = data.connections || data.providerConnections || [];
+      activeProviders = [...new Set(
+        conns.filter(c => c && c.provider && c.isActive !== false && !c.disabled).map(c => c.provider)
+      )];
+    } catch (e) { return; }
+
+    if (!activeProviders.length) return;
+
+    let models = [];
+    try {
+      const resp = await fetch(\\\`\\\${API_BASE}/api/models\\\`);
+      const data = await resp.json();
+      if (data.models && Array.isArray(data.models)) {
+        models = data.models
+          .filter(m => activeProviders.includes(m.provider))
+          .filter(m => !/(embedding|image|tts|stt|audio|vision)/i.test(m.model))
+          .map(m => m.fullModel);
+      }
+      models = [...new Set(models)];
+    } catch (e) { return; }
+
+    if (!models.length) return;
+
+    try {
+      await fetch(\\\`\\\${API_BASE}/api/combos\\\`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ name: COMBO_NAME, models })
+      });
+      console.log('[sync-combo] Created smart-route with ' + models.length + ' models');
+    } catch (e) {}
+  } catch (e) {}
+};
+
+if (fs.existsSync(DB_PATH)) ensureSettings();
+setTimeout(sync, 10000);
+setInterval(sync, INTERVAL);`;
   }
 
   function native9RouterServerEntryLookup() {
@@ -3202,12 +3368,16 @@ const sync=async()=>{try{const res=await fetch(ROUTER+'/api/providers');if(!res.
         list: multiBotAgentMetas.map((meta) => ({
           id: meta.agentId,
           name: meta.name,
-          workspace: '.openclaw/' + meta.workspaceDir,
-          agentDir: `agents/${meta.agentId}/agent`,
           model: { primary: state.config.model, fallbacks: [] },
         })),
       },
-      commands: { native: 'auto', nativeSkills: 'auto', restart: true, ownerDisplay: 'raw' },
+      commands: {
+        native: 'auto',
+        nativeSkills: 'auto',
+        restart: true,
+        ownerDisplay: 'raw',
+        ...(state.config.skills.includes('scheduler') ? { ownerAllowFrom: ['*'] } : {}),
+      },
       bindings: multiBotAgentMetas.map((meta) => ({
         agentId: meta.agentId,
         match: { channel: 'telegram', accountId: meta.accountId },
@@ -3234,6 +3404,7 @@ const sync=async()=>{try{const res=await fetch(ROUTER+'/api/providers');if(!res.
       },
       tools: {
         profile: 'full',
+        ...(state.config.skills.includes('scheduler') ? { alsoAllow: ['group:automation'] } : {}),
         exec: { host: 'gateway', security: 'full', ask: 'off' },
         agentToAgent: {
           enabled: true,
@@ -3254,12 +3425,11 @@ const sync=async()=>{try{const res=await fetch(ROUTER+'/api/providers');if(!res.
         }
       } : {}),
       gateway: {
-        port: 18791,
+        port: 18789,
         mode: 'local',
-        bind: state.nativeOs === 'vps' ? 'custom' : 'loopback',
-        ...(state.nativeOs === 'vps' ? { customBindHost: '0.0.0.0' } : {}),
+        bind: state.nativeOs === 'vps' ? 'lan' : 'loopback',
         controlUi: {
-          allowedOrigins: getGatewayAllowedOrigins(18791),
+          allowedOrigins: getGatewayAllowedOrigins(18789),
         },
         auth: { mode: 'token', token: crypto.randomUUID().replace(/-/g, '') },
       },
@@ -3324,7 +3494,7 @@ const sync=async()=>{try{const res=await fetch(ROUTER+'/api/providers');if(!res.
   };
 }
 
-  // ── botEnvContent, botConfigContent, botWorkspaceFiles, botFiles, helpers (setup/generators/config-gen.js) 
+  // ── botEnvContent, botConfigContent, botWorkspaceFiles, botFiles, helpers (setup/generators/config-gen.js) 
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -3381,12 +3551,12 @@ const sync=async()=>{try{const res=await fetch(ROUTER+'/api/providers');if(!res.
       const bot = state.bots[botIndex] || {};
       const botName = bot.name || `Bot ${botIndex + 1}`;
       const agentId = botName.toLowerCase().replace(/[^a-z0-9]+/g, '-');
-      const basePort = 18791 + botIndex;
+      const basePort = 18789 + botIndex;
       const groupId = state.groupId || '';
 
       // Force use global provider if proxy mode is chosen globally, else use bot specific provider
       const botProvider = (provider && provider.isProxy) ? provider : (PROVIDERS[bot.provider] || provider);
-      const actualModel = botProvider.isProxy ? provider.models[0].id : (bot.model || state.config.model);
+      const actualModel = botProvider.isProxy ? 'smart-route' : (bot.model || state.config.model);
       const bcfg = globalThis.__openclawBotConfig;
 
       const cfg = bcfg.buildOpenclawJson({
@@ -3554,7 +3724,7 @@ const sync=async()=>{try{const res=await fetch(ROUTER+'/api/providers');if(!res.
       }));
     }
 
-  // ── generateZaloLoginBat, generateZaloLoginSh (unified) (setup/generators/zalo-login-gen.js) 
+  // ── generateZaloLoginBat, generateZaloLoginSh (unified) (setup/generators/zalo-login-gen.js) 
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -3591,15 +3761,13 @@ const sync=async()=>{try{const res=await fetch(ROUTER+'/api/providers');if(!res.
  * @param {string} opts.projectDirVar  - BAT var for project dir    e.g. '%PROJECT_DIR%'
  * @param {string} opts.label          - Unique BAT label suffix (avoid duplicate labels)
  *                                       e.g. 'win', 'multi', 'combo'
- * @param {boolean} [opts.useInstance] - Use --instance default flag (for multi-bot flows)
+ * @param {boolean} [opts.useInstance] - Reserved for QR file suffix only.
  * @returns {string[]} Lines to push into the bat script
  */
 function generateZaloLoginBat(opts) {
   const { homeVar, projectDirVar, label = 'default', useInstance = false } = opts;
   const credPath = `${homeVar}\\credentials\\zalouser\\credentials.json`;
-  const loginCmd = useInstance
-    ? 'openclaw channels login --channel zalouser --instance default --verbose'
-    : 'openclaw channels login --channel zalouser --verbose';
+  const loginCmd = 'openclaw channels login --channel zalouser --verbose';
   const contLabel = `:zalo_continue_${label}`;
   const retryLabel = `:retry_zalo_${label}`;
 
@@ -3639,15 +3807,13 @@ function generateZaloLoginBat(opts) {
  * @param {object} opts
  * @param {string} opts.homeVar       - Shell var for OPENCLAW_HOME  e.g. '$OPENCLAW_HOME'
  * @param {string} opts.projectDirVar - Shell var for project dir    e.g. '$PROJECT_DIR'
- * @param {boolean} [opts.useInstance] - Use --instance default flag
+ * @param {boolean} [opts.useInstance] - Reserved for QR file suffix only.
  * @returns {string[]} Lines to push into the sh script
  */
 function generateZaloLoginSh(opts) {
   const { homeVar, projectDirVar, useInstance = false } = opts;
   const credPath = `${homeVar}/credentials/zalouser/credentials.json`;
-  const loginCmd = useInstance
-    ? 'openclaw channels login --channel zalouser --instance default --verbose'
-    : 'openclaw channels login --channel zalouser --verbose';
+  const loginCmd = 'openclaw channels login --channel zalouser --verbose';
 
   return [
     `# ── Zalo Personal Login (idempotent) ─────────────────────────────────`,
@@ -3671,7 +3837,7 @@ function generateZaloLoginSh(opts) {
   ];
 }
 
-  // ── generateStartScript wizard wrapper (delegates to install-gen) (setup/generators/gateway-start-gen.js) 
+  // ── generateStartScript wizard wrapper (delegates to install-gen) (setup/generators/gateway-start-gen.js) 
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -3718,7 +3884,7 @@ function generateStartScript() {
   return null;
 }
 
-  // ── generateUninstallScript, setup script download helpers (setup/generators/download-gen.js) 
+  // ── generateUninstallScript, setup script download helpers (setup/generators/download-gen.js) 
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -3975,7 +4141,7 @@ window.__downloadGen = {
   updateDockerDlLabel,
 };
 
-  // ── Windows .bat — if (state.nativeOs === "win") block (setup/os/win-bat.js) 
+  // ── Windows .bat — if (state.nativeOs === "win") block (setup/os/win-bat.js) 
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -4027,8 +4193,8 @@ function generateWinBat(ctx) {
 
   function appendDashboardInfo(arr) {
     arr.push('echo.');
-    arr.push('echo OpenClaw Dashboard: http://127.0.0.1:18791');
-    arr.push('echo Other reachable URLs: http://localhost:18791');
+    arr.push('echo OpenClaw Dashboard: http://127.0.0.1:18789');
+    arr.push('echo Other reachable URLs: http://localhost:18789');
     arr.push('echo If the dashboard asks for a Gateway Token, run: openclaw dashboard');
     if (is9Router) {
       arr.push('echo.');
@@ -4120,7 +4286,7 @@ function generateWinBat(ctx) {
   return { scriptName, scriptContent };
 }
 
-  // ── macOS .sh — if (state.nativeOs === "macos") block (setup/os/macos-sh.js) 
+  // ── macOS .sh — if (state.nativeOs === "macos") block (setup/os/macos-sh.js) 
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -4238,7 +4404,7 @@ function generateMacOsSh(ctx) {
   return { scriptName, scriptContent };
 }
 
-  // ── VPS/PM2 .sh — if (state.nativeOs === "vps") block (setup/os/vps-sh.js) 
+  // ── VPS/PM2 .sh — if (state.nativeOs === "vps") block (setup/os/vps-sh.js) 
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -4352,7 +4518,7 @@ GWEOF`);
   }
 
   vps.push('echo ""');
-  vps.push('echo "Dashboard: http://127.0.0.1:18791"');
+  vps.push('echo "Dashboard: http://127.0.0.1:18789"');
   if (is9Router) vps.push('echo "9Router:   http://127.0.0.1:20128/dashboard"');
   vps.push('echo ""');
   vps.push(`echo "Restart:   bash start-bot.sh"`);
@@ -4363,7 +4529,7 @@ GWEOF`);
   return { scriptName, scriptContent };
 }
 
-  // ── Linux Desktop .sh — if (state.nativeOs === "linux-desktop") block (setup/os/linux-sh.js) 
+  // ── Linux Desktop .sh — if (state.nativeOs === "linux-desktop") block (setup/os/linux-sh.js) 
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -4426,7 +4592,7 @@ function generateLinuxSh(ctx) {
   return { scriptName, scriptContent };
 }
 
-  // ── UI init, language/channel/deploy controllers, form rendering (setup/ui/controller.js) 
+  // ── UI init, language/channel/deploy controllers, form rendering (setup/ui/controller.js) 
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -5075,7 +5241,7 @@ function generateLinuxSh(ctx) {
     envContent.textContent = lines.join('\n');
   }
 
-  // ── Multi-bot state + UI (setup/ui/multi-bot.js) ───────────────────
+  // ── Multi-bot state + UI (setup/ui/multi-bot.js) ───────────────────
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -5424,7 +5590,7 @@ function generateLinuxSh(ctx) {
 
   // ========== Step 1: Deploy Mode + OS ==========
 
-  // ── Step navigation, validation (setup/ui/steps.js) ────────────────
+  // ── Step navigation, validation (setup/ui/steps.js) ────────────────
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -5584,7 +5750,7 @@ function generateLinuxSh(ctx) {
 
   // ========== Step 2: Bot Config ==========
 
-  // ── generateOutput + generateNativeScript + clipboard (setup/ui/output.js) 
+  // ── generateOutput + generateNativeScript + clipboard (setup/ui/output.js) 
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -5751,15 +5917,26 @@ Write-Host "Chrome se tu dong bat Debug Mode moi khi ban dang nhap Windows (dela
         },
         list: [{
           id: agentId,
-          workspace: `.openclaw/workspace-${agentId}`,
+          name: botName,
+          workspace: `/root/project/.openclaw/workspace-${agentId}`,
           agentDir: `agents/${agentId}/agent`,
           model: { primary: state.config.model, fallbacks: [] },
         }],
       },
-      commands: { native: 'auto', nativeSkills: 'auto', restart: true, ownerDisplay: 'raw' },
+      commands: {
+        native: 'auto',
+        nativeSkills: 'auto',
+        restart: true,
+        ownerDisplay: 'raw',
+        ...(state.config.skills.includes('scheduler') ? { ownerAllowFrom: ['*'] } : {}),
+      },
       channels: ch.channelConfig,
-      tools: { profile: 'full', exec: { host: 'gateway', security: 'full', ask: 'off' } },
-      gateway: common.buildGatewayConfig(18791, 'native', getGatewayAllowedOrigins(18791)),
+      tools: {
+        profile: 'full',
+        ...(state.config.skills.includes('scheduler') ? { alsoAllow: ['group:automation'] } : {}),
+        exec: { host: 'gateway', security: 'full', ask: 'off' },
+      },
+      gateway: common.buildGatewayConfig(18789, state.deployMode, getGatewayAllowedOrigins(18789), state.nativeOs || ''),
     };
 
     // 9Router: add proxy endpoint config under models.providers
@@ -5849,7 +6026,7 @@ Write-Host "Chrome se tu dong bat Debug Mode moi khi ban dang nhap Windows (dela
       clawConfig.agents.list = multiBotAgentMetas.map((meta) => ({
         id: meta.agentId,
         name: meta.name,
-        workspace: '.openclaw/' + meta.workspaceDir,
+        workspace: `/root/project/.openclaw/${meta.workspaceDir}`,
         agentDir: `agents/${meta.agentId}/agent`,
         model: { primary: state.config.model, fallbacks: [] },
       }));
@@ -5880,6 +6057,7 @@ Write-Host "Chrome se tu dong bat Debug Mode moi khi ban dang nhap Windows (dela
       };
       clawConfig.tools = {
         ...(clawConfig.tools || {}),
+        ...(state.config.skills.includes('scheduler') ? { alsoAllow: ['group:automation'] } : {}),
         agentToAgent: {
           enabled: true,
           allow: multiBotAgentMetas.map((meta) => meta.agentId),
@@ -5974,6 +6152,9 @@ model:
       dockerfileSkillInstallMode: 'build',
       runtimeCommandParts: [
         pluginInstallCmd,
+        // zalouser: use npm install (not openclaw plugins install) to avoid openclaw.json writes
+        // ClawHub build gives error:not configured; npm version works correctly
+        state.channel === 'zalo-personal' ? 'ensure_zalouser' : '',
         'while true; do sleep 5; openclaw devices approve --latest 2>/dev/null || true; done >/dev/null 2>&1 &'
       ].filter(Boolean),
       plainSingleExtraHosts: true,
@@ -5983,6 +6164,7 @@ model:
     });
     const dockerfile = dockerArtifacts.dockerfile;
     const compose = dockerArtifacts.compose;
+    const entrypointScript = dockerArtifacts.entrypointScript;
     // isMultiBot => unified into isMultiBot above
     setOutput('out-dockerfile', dockerfile);
     setOutput('out-compose', compose);
@@ -6396,6 +6578,7 @@ fi
       if (!isNativeMode) {
         sharedFiles['docker/openclaw/Dockerfile'] = dockerfile;
         sharedFiles['docker/openclaw/docker-compose.yml'] = compose;
+        sharedFiles['docker/openclaw/entrypoint.sh'] = entrypointScript;
         sharedFiles['docker/openclaw/.env'] = rootEnvContent;
       }
       sharedFiles[globalThis.__openclawCommon.TELEGRAM_SETUP_GUIDE_FILENAME] = buildTelegramPostInstallChecklist();
@@ -6467,6 +6650,7 @@ fi
       if (!isNativeMode) {
         singleFiles['docker/openclaw/Dockerfile'] = dockerfile;
         singleFiles['docker/openclaw/docker-compose.yml'] = compose;
+        singleFiles['docker/openclaw/entrypoint.sh'] = entrypointScript;
         singleFiles['docker/openclaw/.env'] = rootEnvContent;
       }
       state._generatedFiles = singleFiles;
@@ -6635,38 +6819,46 @@ fi
   // ========== Zalo Personal Login Guide (post-setup) ==========
   function generateZaloOnboardGuide() {
     const lang = document.getElementById('cfg-language')?.value || 'vi';
-    setOutput('out-zalo-onboard-cmd', `docker compose stop ai-bot
-docker compose run --rm --no-deps ai-bot openclaw channels login --channel zalouser --verbose
-docker compose up -d --force-recreate ai-bot
-docker compose exec ai-bot openclaw channels status --probe`);
+    const isVi = lang === 'vi';
+    const containerName = state.botCount > 1 ? 'openclaw-multibot' : 'openclaw-bot';
 
-    if (lang === 'vi') {
+    setOutput('out-zalo-onboard-cmd', `# ${isVi ? 'Bước 1: Dọn dẹp session cũ' : 'Step 1: Clean up old session'}
+docker exec ${containerName} rm -f /root/project/.openclaw/credentials/zalouser/credentials.json
+
+# ${isVi ? 'Bước 2: Kích hoạt màn hình login QR (Quét mã trên terminal)' : 'Step 2: Start login QR (Scan on terminal)'}
+docker exec -it ${containerName} openclaw channels login --channel zalouser --verbose
+
+# ${isVi ? 'Bước 3: Khởi động lại container sau khi login thành công' : 'Step 3: Restart container after successful login'}
+docker restart ${containerName}`);
+
+    if (isVi) {
       setOutput('out-zalo-onboard-guide', `┌─────────────────────────────────────────────────────┐
-│  Chạy lệnh bên trái để OpenClaw tạo QR đăng nhập.   │
+│  Chạy các lệnh bên trái để đăng nhập Zalo Personal  │
+│  theo quy trình chuẩn 4 bước.                       │
 ├─────────────────────────────────────────────────────┤
-│  1. Đảm bảo container/gateway đã chạy xong.         │
-│  2. Stop ai-bot, login bằng compose run one-shot.   │
-│  3. OpenClaw sẽ in ra đường dẫn file QR trong /tmp. │
-│  4. Copy file QR ra ngoài nếu cần:                  │
-│     docker cp openclaw-bot:/tmp/openclaw/           │
+│  1. Lệnh 1 xoá file credentials.json cũ để tránh     │
+│     lỗi xung đột "Already linked".                  │
+│  2. Lệnh 2 mở màn hình login. Quét mã QR hiện trên   │
+│     terminal hoặc lấy file từ container:            │
+│     docker cp ${containerName}:/tmp/openclaw/           │
 │       openclaw-zalouser-qr-default.png .            │
-│  5. Mở ảnh QR → quét bằng app Zalo → xác nhận.      │
-│  6. Start lại: docker compose up -d --force-recreate│
-│  7. Chạy channels status --probe, phải thấy running.│
+│  3. Sau khi quét xong và terminal báo thành công,    │
+│     nhấn Ctrl+C để thoát.                           │
+│  4. Chạy Lệnh 3 để restart container giúp nhận tin. │
 └─────────────────────────────────────────────────────┘`);
     } else {
       setOutput('out-zalo-onboard-guide', `┌─────────────────────────────────────────────────────┐
-│  Run the command on the left to generate a Zalo QR. │
+│  Run the commands on the left to login Zalo Personal│
+│  following the standard 4-step workflow.            │
 ├─────────────────────────────────────────────────────┤
-│  1. Make sure the container/gateway is already up.  │
-│  2. Stop ai-bot; login with compose run one-shot.   │
-│  3. OpenClaw prints the QR image path under /tmp.   │
-│  4. Copy the QR out if needed:                      │
-│     docker cp openclaw-bot:/tmp/openclaw/           │
+│  1. Command 1 deletes the old credentials.json file  │
+│     to avoid "Already linked" conflicts.            │
+│  2. Command 2 opens the login interface. Scan the   │
+│     QR on your terminal or copy the image file:      │
+│     docker cp ${containerName}:/tmp/openclaw/           │
 │       openclaw-zalouser-qr-default.png .            │
-│  5. Open the image → scan with Zalo mobile app.     │
-│  6. Start again: docker compose up -d --force-re... │
-│  7. Run channels status --probe; it should run.     │
+│  3. Once scanned and successful, press Ctrl+C.       │
+│  4. Run Command 3 to restart the container.         │
 └─────────────────────────────────────────────────────┘`);
     }
   }