create-openclaw-bot 5.7.10 → 5.8.1

package/dist/setup.js

@@ -1,13 +1,13 @@
 /* ============================================
-   OpenClaw Setup Wizard — Logic v2
+   OpenClaw Setup Wizard — Logic v2
    Multi-model, Multi-plugin, Multi-channel
    ============================================ */
-// AUTO-GENERATED by build.mjs — edit files in src/setup/ instead
+// AUTO-GENERATED by build.mjs — edit files in src/setup/ instead
 
 (function () {
   'use strict';
 
-  // ── Globals: CDN logos, state, shared utils (setup/data/header.js) ─
+  // ── Globals: CDN logos, state, shared utils (setup/data/header.js) ─
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -76,7 +76,7 @@
     || 'grammy @grammyjs/runner @grammyjs/transformer-throttler @buape/carbon @larksuiteoapi/node-sdk @slack/web-api';
 
   function getGatewayAllowedOrigins(port) {
-    const normalizedPort = Number(port) || 18791;
+    const normalizedPort = Number(port) || 18789;
     const origins = new Set([
       `http://localhost:${normalizedPort}`,
       `http://127.0.0.1:${normalizedPort}`,
@@ -89,7 +89,7 @@
     return Array.from(origins);
   }
 
-  // ── PROVIDERS object (setup/data/providers.js) ─────────────────────
+  // ── PROVIDERS object (setup/data/providers.js) ─────────────────────
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -212,7 +212,7 @@
   };
 
 
-  // ── CHANNELS, system prompts, security rules (setup/data/channels.js) 
+  // ── CHANNELS, system prompts, security rules (setup/data/channels.js) 
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -383,7 +383,7 @@
 - ✅ Limit exposed ports (only 38789)`,
   };
 
-  // ── PLUGINS list (setup/data/plugins.js) ───────────────────────────
+  // ── PLUGINS list (setup/data/plugins.js) ───────────────────────────
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -406,6 +406,13 @@
  */
   // ========== Available Plugins (npm packages — runtime/channel extensions) ==========
   const PLUGINS = [
+    {
+      id: 'browser-automation',
+      name: 'Browser Automation ⭐',
+      icon: '🌐',
+      descVi: 'Smart Search + Điều khiển trình duyệt Chrome/Chromium (ẩn & thật)', descEn: 'Smart Search + Chrome/Chromium browser control (headless & real)',
+      package: 'openclaw-browser-automation',
+    },
     {
       id: 'telegram-multibot-relay',
       name: 'Telegram Multi-Bot Relay',
@@ -445,7 +452,7 @@
   ];
 
 
-  // ── SKILLS list (setup/data/skills.js) ─────────────────────────────
+  // ── SKILLS list (setup/data/skills.js) ─────────────────────────────
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -468,14 +475,6 @@
  */
   // ========== Available Skills (ClawHub registry — agent capabilities) ==========
   const SKILLS = [
-    {
-      id: 'browser',
-      name: 'Browser Automation ⭐(Khuyên dùng)',
-      icon: '🌐',
-      descVi: 'Tự động thao tác trình duyệt (Playwright)', descEn: 'Automated browser control (Playwright)',
-      slug: 'browser-automation',
-      noteVi: 'Cần bật Chrome Debug Mode trên máy host', noteEn: 'Requires Chrome Debug Mode on host',
-    },
     {
       id: 'memory',
       name: 'Long-term Memory ⭐(Khuyên dùng)',
@@ -574,7 +573,7 @@
         className: 'plugin-card__badge plugin-card__badge--recommended'
       };
     }
-    if (skill.id === 'browser' || skill.id === 'scheduler') {
+    if (skill.id === 'scheduler') {
       return {
         text: isVi ? 'Khuyên dùng' : 'Recommended',
         className: 'plugin-card__badge plugin-card__badge--recommended'
@@ -616,10 +615,10 @@
   }
 
 
-  // ── Shared runtime constants, relay helpers, auth profile builders (setup/shared/common-gen.js) 
+  // ── Shared runtime constants, relay helpers, auth profile builders (setup/shared/common-gen.js) 
 // @ts-nocheck
 (function (root) {
-  const OPENCLAW_NPM_SPEC = 'openclaw@2026.5.4';
+  const OPENCLAW_NPM_SPEC = 'openclaw@latest';
   const OPENCLAW_RUNTIME_PACKAGES = 'grammy @grammyjs/runner @grammyjs/transformer-throttler @buape/carbon @larksuiteoapi/node-sdk @slack/web-api';
   const NINE_ROUTER_NPM_SPEC = '9router@latest';
   const NINE_ROUTER_PORT = 20128;
@@ -861,8 +860,9 @@ If setup reported a plugin install error, run this after the bot is running:
     return JSON.stringify(buildAuthProfilesJson(options), null, 2);
   }
 
-  function get9RouterBaseUrl(deployMode = 'native') {
-    return deployMode === 'docker' ? `${NINE_ROUTER_DOCKER_API_BASE_URL}/v1` : `${NINE_ROUTER_API_BASE_URL}/v1`;
+  function get9RouterBaseUrl(deployMode = 'native', routerPort) {
+    const port = routerPort || NINE_ROUTER_PORT;
+    return deployMode === 'docker' ? `http://9router:${port}/v1` : `http://localhost:${port}/v1`;
   }
 
   function build9RouterProviderConfig(baseUrl = `${NINE_ROUTER_API_BASE_URL}/v1`) {
@@ -870,6 +870,9 @@ If setup reported a plugin install error, run this after the bot is running:
       baseUrl,
       apiKey: NINE_ROUTER_PROXY_API_KEY,
       api: 'openai-completions',
+      request: {
+        allowPrivateNetwork: true,
+      },
       models: [
         {
           id: 'smart-route',
@@ -877,18 +880,12 @@ If setup reported a plugin install error, run this after the bot is running:
           contextWindow: 200000,
           maxTokens: 8192,
         },
-        ...SUPPORTED_CODEX_MODELS.map((id) => ({
-          id,
-          name: `Codex ${id.slice(3).replace(/-/g, ' ').replace(/\b\w/g, (char) => char.toUpperCase())}`,
-          contextWindow: 200000,
-          maxTokens: 8192,
-        })),
       ],
     };
   }
 
-  function buildGatewayConfig(port = 18791, deployMode = 'native', allowedOrigins = [], osChoice = '') {
-    const normalizedPort = Number(port) || 18791;
+  function buildGatewayConfig(port = 18789, deployMode = 'native', allowedOrigins = [], osChoice = '') {
+    const normalizedPort = Number(port) || 18789;
     const cfg = {
       port: normalizedPort,
       mode: 'local',
@@ -933,7 +930,7 @@ if (typeof exports !== 'undefined' && typeof globalThis !== 'undefined' && globa
   Object.assign(exports, globalThis.__openclawCommon);
 }
 
-  // ── Shared workspace file builders (IDENTITY, SOUL, AGENTS, TOOLS, TEAMS...) (setup/shared/workspace-gen.js) 
+  // ── Shared workspace file builders (IDENTITY, SOUL, AGENTS, TOOLS, TEAMS...) (setup/shared/workspace-gen.js) 
 /** @typedef {typeof globalThis & { __openclawWorkspace?: Record<string, Function> }} OpenClawWorkspaceRoot */
 
 const workspaceRoot = /** @type {OpenClawWorkspaceRoot} */ (
@@ -1061,6 +1058,226 @@ function buildBootstrapDoc(options = {}) {
       : `# BOOTSTRAP\n\n## Startup role\n- You are **${botName}**.\n- Your identity, role, and style are already defined in **IDENTITY.md**, **SOUL.md**, and **AGENTS.md**.\n- Use those files as the highest-priority source of truth for your persona in this workspace.\n\n## Mandatory\n- Do not ask the user to redefine your name, vibe, persona, signature emoji, or assistant style.\n- Do not say you just woke up, just came online, are choosing your identity, or any similar onboarding line.\n- Do not behave like a blank freshly-created bot.\n- If the user only sends a short opener like "hi" or "alo", greet briefly and reply in your existing role.\n\n## Telegram\n- Before EVERY user-visible Telegram reply, if the current turn exposes a native reaction tool/action, use it to add \`👍\` first unless \`👍\` is already present.\n- Never claim that you reacted unless the tool actually ran and the reaction is real on the chat.\n- If the target chat does not support real reactions or the tool is not exposed, still reply normally and do not mention the technical limitation.\n`;
   }
 
+  function buildSearchToolJs() {
+    return `/**
+ * search-tool.js — Stealth search via Playwright Headless Chromium or CDP fallback
+ * Zero tokens, no API keys, concurrent multi-engine scraping (Google + Bing + DuckDuckGo).
+ * Usage: node search-tool.js "<query>" [limit]
+ */
+let playwright;
+try {
+    playwright = require('playwright-core');
+} catch (e) {
+    try {
+        playwright = require('/usr/local/lib/node_modules/openclaw/node_modules/playwright-core');
+    } catch (err) {
+        try {
+            const path = require('path');
+            playwright = require(path.join(process.cwd(), 'node_modules', 'playwright-core'));
+        } catch (x) {
+            console.error(JSON.stringify({ error: 'Playwright not found! Install it or run within OpenClaw environment.' }));
+            process.exit(1);
+        }
+    }
+}
+const { chromium } = playwright;
+
+const query = process.argv[2];
+const limit = parseInt(process.argv[3]) || 5;
+const CDP_URL = 'http://127.0.0.1:9222';
+
+if (!query) {
+    console.error(JSON.stringify({ error: 'Usage: node search-tool.js "<query>" [limit]' }));
+    process.exit(1);
+}
+
+(async () => {
+    let browser;
+    let ctx;
+    let isStandalone = false;
+    try {
+        // Try connecting to active Chrome CDP first
+        try {
+            browser = await chromium.connectOverCDP(CDP_URL, { timeout: 3000 });
+            ctx = browser.contexts()[0];
+        } catch (e) {
+            // Fallback to standalone headless Chromium launch
+            browser = await chromium.launch({
+                headless: true,
+                args: [
+                    '--no-sandbox',
+                    '--disable-gpu',
+                    '--disable-dev-shm-usage',
+                    '--disable-blink-features=AutomationControlled'
+                ]
+            });
+            isStandalone = true;
+            ctx = await browser.newContext({
+                userAgent: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36'
+            });
+        }
+
+        // Run search queries concurrently on three search engines
+        const [googleResults, bingResults, ddgResults] = await Promise.all([
+            // Google
+            (async () => {
+                const page = await ctx.newPage();
+                try {
+                    await page.goto('https://www.google.com/search?q=' + encodeURIComponent(query) + '&hl=vi', { waitUntil: 'domcontentloaded', timeout: 10000 });
+                    const res = await page.evaluate(() => {
+                        const list = [];
+                        const links = Array.from(document.querySelectorAll('a h3'));
+                        for (const head of links) {
+                            const a = head.closest('a');
+                            if (!a) continue;
+                            const url = a.href;
+                            const title = head.textContent || '';
+                            let snippet = '';
+                            let parent = a.parentElement;
+                            while (parent && parent.tagName !== 'DIV') {
+                                parent = parent.parentElement;
+                            }
+                            if (parent) {
+                                const descEl = parent.parentElement?.querySelector('.VwiC3b, .yHGvwa, div[style*="-webkit-line-clamp"]');
+                                if (descEl) {
+                                    snippet = descEl.textContent || '';
+                                } else {
+                                    const texts = Array.from(parent.parentElement?.querySelectorAll('div, span') || [])
+                                        .map(el => el.textContent.trim())
+                                        .filter(txt => txt.length > 30 && !txt.includes(title));
+                                    if (texts.length > 0) snippet = texts[0];
+                                }
+                            }
+                            if (url && title) {
+                                list.push({ title, url, snippet });
+                            }
+                        }
+                        return list;
+                    });
+                    await page.close();
+                    return res;
+                } catch (e) {
+                    if (page) await page.close();
+                    return [];
+                }
+            })(),
+
+            // Bing
+            (async () => {
+                const page = await ctx.newPage();
+                try {
+                    await page.goto('https://www.bing.com/search?q=' + encodeURIComponent(query), { waitUntil: 'domcontentloaded', timeout: 10000 });
+                    const res = await page.evaluate(() => {
+                        const list = [];
+                        const items = document.querySelectorAll('li.b_algo');
+                        for (const item of items) {
+                            const titleEl = item.querySelector('h2 a');
+                            if (!titleEl) continue;
+                            const title = titleEl.textContent || '';
+                            const url = titleEl.href;
+                            let snippet = '';
+                            const snippetEl = item.querySelector('.b_caption p, .b_snippet, p');
+                            if (snippetEl) {
+                                snippet = snippetEl.textContent || '';
+                            }
+                            if (url && title) {
+                                list.push({ title, url, snippet });
+                            }
+                        }
+                        return list;
+                    });
+                    await page.close();
+                    return res;
+                } catch (e) {
+                    if (page) await page.close();
+                    return [];
+                }
+            })(),
+
+            // DuckDuckGo
+            (async () => {
+                const page = await ctx.newPage();
+                try {
+                    await page.goto('https://html.duckduckgo.com/html/?q=' + encodeURIComponent(query), { waitUntil: 'domcontentloaded', timeout: 10000 });
+                    const res = await page.evaluate(() => {
+                        const list = [];
+                        const elements = document.querySelectorAll('.result');
+                        for (const el of elements) {
+                            const titleEl = el.querySelector('.result__title a');
+                            const snippetEl = el.querySelector('.result__snippet');
+                            if (titleEl) {
+                                list.push({
+                                    title: titleEl.textContent.trim(),
+                                    url: titleEl.href,
+                                    snippet: snippetEl ? snippetEl.textContent.trim() : ''
+                                });
+                            }
+                        }
+                        return list;
+                    });
+                    await page.close();
+                    return res;
+                } catch (e) {
+                    if (page) await page.close();
+                    return [];
+                }
+            })()
+        ]);
+
+        // Deduplicate results by normalized URL
+        const allResults = [...googleResults, ...bingResults, ...ddgResults];
+        const uniqueResults = [];
+        const seenUrls = new Set();
+        for (const res of allResults) {
+            if (!res.url || !res.title) continue;
+            let normUrl = res.url.replace(/^(https?:\\/\\/)?(www\\.)?/, '').toLowerCase();
+            if (normUrl.endsWith('/')) normUrl = normUrl.slice(0, -1);
+            if (!seenUrls.has(normUrl)) {
+                seenUrls.add(normUrl);
+                uniqueResults.push(res);
+            }
+        }
+
+        // Score results to prioritize numeric price data for financial queries
+        const isPriceQuery = /giá|vàng|đô|usd|sjc|sh|hôm nay|price|gold|rate|vnd|xe|vnđ/i.test(query);
+        const scoredResults = uniqueResults.map(res => {
+            let score = 0;
+            // Base length score
+            score += Math.min(res.snippet.length / 50, 5);
+
+            if (isPriceQuery) {
+                // Number density check
+                const numCount = (res.snippet.match(/\\d+/g) || []).length;
+                score += Math.min(numCount * 2, 10);
+
+                // Priority keywords boost
+                if (/lượng|chỉ|triệu|nghìn|vnd|usd|sjc|xe|bán|mua|giá/i.test(res.snippet)) {
+                    score += 8;
+                }
+            }
+            return { ...res, score };
+        });
+
+        // Sort by score desc
+        scoredResults.sort((a, b) => b.score - a.score);
+
+        // Map back to output format and limit
+        const output = scoredResults.map(({ score, ...rest }) => rest).slice(0, limit);
+        console.log(JSON.stringify(output, null, 2));
+
+    } catch (err) {
+        console.error(JSON.stringify({ error: err.message }));
+    } finally {
+        if (browser && isStandalone) {
+            try {
+                await browser.close();
+            } catch(e) {}
+        }
+    }
+})();
+`;
+  }
+
   function buildBrowserToolJs(variant = 'wizard') {
     // v2: Full-featured browser-tool.js matching OpenClaw native browser plugin capabilities
     // Both 'cli' and 'wizard' variants now use the same full script
@@ -1187,8 +1404,18 @@ const CDP_URL = 'http://127.0.0.1:9222';
     const { isVi = true, variant = 'wizard', workspaceRoot = '' } = options;
     const wsRoot = workspaceRoot.replace(/\/+$/, '');
     const btPath = wsRoot ? `${wsRoot}/browser-tool.js` : 'browser-tool.js';
+    let modeHeading = '';
+    if (variant === 'cli-server') {
+      modeHeading = isVi
+        ? `# 🌍 Trình duyệt ảo (Browser Automation)\n\n## 💡 Hướng dẫn vận hành:\n- **Script điều khiển:** \`browser-tool.js\` (Mọi câu lệnh browser đều chạy qua script này).\n- **Môi trường chạy:**\n  - **Trên VPS / Linux Server (Headless):** Trình duyệt chạy ngầm hoàn toàn độc lập (Headless) bên trong Docker / Server qua Xvfb. Không thể mở màn hình Chrome thật.\n  - **Trên Máy tính cá nhân (Windows/Mac) - Dù chạy Docker hay Native:**\n    - **Mặc định:** Chạy ngầm (headless) cực kỳ ổn định.\n    - **Chế độ quan sát (Xem bot click):** Nếu bạn muốn xem trực tiếp Chrome thật hoạt động trên màn hình, hãy chạy file \`start-chrome-debug.bat\` (trên Windows) hoặc \`start-chrome-debug.sh\` (trên Mac) ở máy của bạn **trước khi** bot kết nối! Bot sẽ tự động chuyển sang điều khiển màn hình Chrome thật của bạn.\n- **Kết nối mặc định:** \`http://127.0.0.1:9222\`\n\n`
+        : `# 🌍 Browser Automation\n\n## 💡 Operating Guide:\n- **Control script:** \`browser-tool.js\` (All browser commands are executed through this script).\n- **Running environment:**\n  - **On VPS / Linux Server (Headless Server Mode):** The browser runs fully headless and isolated inside Docker / Server via Xvfb. No GUI Chrome can be launched.\n  - **On Personal Computers (Windows/Mac) - Docker or Native:**\n    - **Default:** Runs headless and stable in the background.\n    - **Observer Mode (Visual Chrome GUI):** If you want to see the real Chrome window being controlled, run \`start-chrome-debug.bat\` (on Windows) or \`start-chrome-debug.sh\` (on Mac) on your host machine **before** the bot connects! The bot will automatically hook into your real desktop Chrome.\n- **Default endpoint:** \`http://127.0.0.1:9222\`\n\n`;
+    } else {
+      modeHeading = isVi
+        ? `# 🌍 Hướng dẫn Browser (Chrome CDP)\n- **Script điều khiển:** \`browser-tool.js\`\n- **Kết nối Chrome debug:** \`http://127.0.0.1:9222\`\n- **Xem trực quan:** Hãy chạy file \`start-chrome-debug.bat\` (trên Windows) hoặc \`start-chrome-debug.sh\` (trên Mac) để mở Chrome chế độ Debug.\n\n`
+        : `# 🌍 Browser Guide (Chrome CDP)\n- **Control script:** \`browser-tool.js\`\n- **Chrome debug endpoint:** \`http://127.0.0.1:9222\`\n- **Visual interface:** Run \`start-chrome-debug.bat\` (on Windows) or \`start-chrome-debug.sh\` (on Mac) to open Chrome in Debug mode.\n\n`;
+    }
 
-    return `# Navigation
+    return `${modeHeading}# Navigation
 node ${btPath} status
 node ${btPath} open "https://google.com"
 node ${btPath} get_url
@@ -1291,11 +1518,37 @@ node ${btPath} close_tab 2`;
     const browserRef = hasBrowser
       ? (browserDocVariant === 'cli-server'
         ? (isVi
-          ? `\n\n## \uD83C\uDF10 Browser Automation\n- Xem hướng dẫn chi tiết tại **BROWSER.md**\n- Chế độ hiện tại: browser native/headless của OpenClaw trong Docker hoặc server\n- Nếu browser lỗi, thử lại 1 lần rồi mới báo user với lỗi cụ thể`
-          : `\n\n## \uD83C\uDF10 Browser Automation\n- See detailed guide at **BROWSER.md**\n- Current mode: native/headless OpenClaw browser inside Docker or server\n- If browser fails, retry once before reporting the concrete error to the user`)
+          ? `\n\n## 🌐 Browser Automation
+- Xem hướng dẫn chi tiết tại **BROWSER.md**
+- Script điều khiển: \`browser-tool.js\`
+- Chế độ hiện tại: 
+  - **Trên VPS / Linux Server:** Chạy ngầm độc lập qua Docker hoặc Xvfb.
+  - **Trên Windows/Mac (Docker hoặc Native):** Chạy ngầm mặc định, hoặc chạy file \`start-chrome-debug.bat\` / \`start-chrome-debug.sh\` để xem trình duyệt trực quan trên màn hình.
+- Kết nối mặc định: \`http://127.0.0.1:9222\`
+- **Tìm kiếm Web:** Nếu không có công cụ Web Search (hoặc Web Search không khả dụng/bị lỗi), hãy **luôn sử dụng ngay công cụ terminal (exec/run_command) để chạy lệnh: \`node search-tool.js "<từ khóa>" 5\`**! Lệnh này sẽ tự động chạy ngầm qua DuckDuckGo/Google/Bing bằng trình duyệt ngầm tàng hình của bạn và trả về kết quả JSON sạch ngay lập tức. Tuyệt đối KHÔNG được mở trình duyệt thủ công, chụp ảnh màn hình hay click tìm kiếm bằng tay từng bước!
+- Nếu browser lỗi, thử lại 1 lần rồi mới báo user với lỗi cụ thể`
+          : `\n\n## 🌐 Browser Automation
+- See detailed guide at **BROWSER.md**
+- Control script: \`browser-tool.js\`
+- Current mode: 
+  - **On VPS / Linux Server:** Runs headless via Docker or Xvfb.
+  - **On Windows/Mac (Docker or Native):** Runs headless by default, or run \`start-chrome-debug.bat\` / \`start-chrome-debug.sh\` to see the GUI.
+- Default endpoint: \`http://127.0.0.1:9222\`
+- **Web Searching:** If the Web Search tool is unavailable or fails, **always use your terminal execution tool (exec/run_command) to run: \`node search-tool.js "<query>" 5\`**! This will automatically execute the search via DuckDuckGo/Google/Bing under stealth browser mode and return a clean JSON result immediately. Never open the browser manually, take screenshots, or click the search button step-by-step!
+- If browser fails, retry once before reporting the concrete error to the user`)
         : (isVi
-          ? `\n\n## \uD83C\uDF10 Browser Automation\n- Xem hướng dẫn chi tiết tại **BROWSER.md**\n- Script điều khiển: \`browser-tool.js\`\n- Kết nối Chrome debug: \`http://127.0.0.1:9222\`\n- Nếu tool/profile hỏi đường browser desktop, dùng profile \`host-chrome\` trước`
-          : `\n\n## \uD83C\uDF10 Browser Automation\n- See detailed guide at **BROWSER.md**\n- Control script: \`browser-tool.js\`\n- Chrome debug endpoint: \`http://127.0.0.1:9222\`\n- If a desktop browser profile is needed, use the \`host-chrome\` profile first`))
+          ? `\n\n## 🌐 Browser Automation
+- Xem hướng dẫn chi tiết tại **BROWSER.md**
+- Script điều khiển: \`browser-tool.js\`
+- Kết nối Chrome debug: \`http://127.0.0.1:9222\`
+- **Tìm kiếm Web:** Hãy **luôn sử dụng ngay công cụ terminal (exec/run_command) để chạy lệnh: \`node search-tool.js "<từ khóa>" 5\`**! Lệnh này sẽ tự động chạy ngầm qua DuckDuckGo/Google/Bing bằng trình duyệt ngầm tàng hình của bạn và trả về kết quả JSON sạch ngay lập tức. Tuyệt đối KHÔNG được mở trình duyệt thủ công, chụp ảnh màn hình hay click tìm kiếm bằng tay từng bước!
+- Nếu tool/profile hỏi đường browser desktop, dùng profile \`host-chrome\` trước`
+          : `\n\n## 🌐 Browser Automation
+- See detailed guide at **BROWSER.md**
+- Control script: \`browser-tool.js\`
+- Chrome debug endpoint: \`http://127.0.0.1:9222\`
+- **Web Searching:** If the Web Search tool is unavailable or fails, **always use your terminal execution tool (exec/run_command) to run: \`node search-tool.js "<query>" 5\`**! This will automatically execute the search via DuckDuckGo/Google/Bing under stealth browser mode and return a clean JSON result immediately. Never open the browser manually, take screenshots, or click the search button step-by-step!
+- If a desktop browser profile is needed, use the \`host-chrome\` profile first`))
       : '';
 
     const telegramSection = (variant === 'relay')
@@ -1306,8 +1559,38 @@ node ${btPath} close_tab 2`;
 
     const cronSection = hasScheduler
       ? (isVi
-        ? `\n\n## \u23F0 Cron / Lên lịch nhắc nhở\n- OpenClaw có hỗ trợ tool hệ thống để chạy Cron Job.\n- Khi user yêu cầu tạo nhắc nhở / lệnh tự động định kỳ, bạn hãy TỰ ĐỘNG dùng tool hệ thống để tạo. **Tuyệt đối không** bắt user dùng crontab hay Task Scheduler chạy tay trên host.\n- Khi thao tác tool cho cron/scheduler, **không điền \`current\` vào thư mục Session**.\n- Bỏ qua việc tra cứu docs nội bộ như \`cron-jobs.mdx\`; tin tưởng khả năng dùng tool hiện có để hoàn thành yêu cầu.`
-        : `\n\n## \u23F0 Cron / Scheduled Tasks\n- OpenClaw natively supports system tools for Cron Jobs.\n- When the user asks to schedule tasks or reminders, use the built-in tools automatically. Do NOT ask users to run crontab or Task Scheduler manually on the host.\n- When operating cron/scheduler tools, do **not** put \`current\` into the Session directory.\n- Skip internal doc lookups such as \`cron-jobs.mdx\`; rely on the available tools and complete the scheduling task directly.`)
+        ? `\n\n## \u23F0 Cron / Lên lịch nhắc nhở (tool: \`cron\`)
+- **Tên tool chính xác:** Tên công cụ là \`cron\` (tuyệt đối không nhầm là \`native\` hay command line bên ngoài).
+- **Khi tạo cronjob mới (action \`add\`):**
+  - **TUYỆT ĐỐI KHÔNG điền trường \`agentId\`** trong object \`job\` (hãy bỏ qua/omitted trường này). Hệ thống OpenClaw sẽ tự động gán chính xác ID của bạn vào job đó.
+  - Tuyệt đối **không tự điền** \`agentId\` là \`"bot"\` hay \`"main"\`, vì làm vậy sẽ khiến cronjob thuộc về agent khác và bạn sẽ mất quyền kiểm soát/xóa nó sau này.
+- **Khi user yêu cầu tắt/bật/xóa cronjob:**
+  1. **Bước 1 (Tìm kiếm):** Gọi tool \`cron\` với action \`list\` (và \`includeDisabled: true\`) để xem danh sách tất cả cronjob đang chạy trên hệ thống và tìm đúng \`jobId\` phù hợp với yêu cầu.
+  2. **Bước 2 (Xử lý):**
+     - Để xóa: Gọi action \`remove\` với \`id\` tìm được.
+     - Để tắt/tạm dừng: Gọi action \`update\` với \`id\` và patch \`{"enabled": false}\`.
+     - Để bật lại: Gọi action \`update\` với \`id\` và patch \`{"enabled": true}\`.
+  3. **Tuyên bố trung thực:** Tuyệt đối không bao giờ trả lời "đã xóa" hay "không có" dựa trên suy đoán của bản thân mà chưa gọi tool \`cron\` để kiểm tra thực tế.
+- Khi user yêu cầu tạo nhắc nhở / lệnh tự động định kỳ, bạn hãy TỰ ĐỘNG dùng tool \`cron\` (action \`add\`) để tạo. **Tuyệt đối không** bắt user dùng crontab hay Task Scheduler chạy tay trên host.
+- Khi thao tác tool cho cron/scheduler, **không điền \`current\` vào thư mục Session**.
+- **QUAN TRỌNG VỀ TARGETING GROUP CHAT**: Khi tạo hoặc cấu hình cron job gửi tin nhắn thông báo (announce mode) đến một Group Chat, giá trị của trường \`delivery.to\` **bắt buộc** phải sử dụng tiền tố \`group:\` trước ID của group (ví dụ: \`group:3815464776067464419\` hoặc \`group:xxxx\`). Tuyệt đối không được chỉ điền ID thuần túy vì hệ thống sẽ hiểu nhầm đó là một DM chat cá nhân (direct message) và gửi sai địa chỉ.
+- Bỏ qua việc tra cứu docs nội bộ như \`cron-jobs.mdx\`; tin tưởng khả năng dùng tool hiện có để hoàn thành yêu cầu.`
+        : `\n\n## \u23F0 Cron / Scheduled Tasks (tool: \`cron\`)
+- **Exact tool name:** The tool name is \`cron\` (never mistake it for \`native\` or external command lines).
+- **When creating a new cronjob (action \`add\`):**
+  - **ABSOLUTELY DO NOT specify the \`agentId\` field** in the \`job\` object (leave this field omitted). The OpenClaw system will automatically assign your correct agent ID to that job.
+  - Never manually specify \`agentId\` as \`"bot"\` or \`"main"\`, as this will cause the cronjob to belong to another agent and you will lose control to manage/delete it later.
+- **When the user requests to disable/enable/delete a cronjob:**
+  1. **Step 1 (Search):** Call the \`cron\` tool with action \`list\` (and \`includeDisabled: true\`) to view all cron jobs on the system and find the matching \`jobId\`.
+  2. **Step 2 (Processing):**
+     - To delete: Call action \`remove\` with the \`id\` found.
+     - To disable/pause: Call action \`update\` with \`id\` and patch \`{"enabled": false}\`.
+     - To enable: Call action \`update\` with \`id\` and patch \`{"enabled": true}\`.
+  3. **Honest statement:** Never claim a job is "deleted" or "not found" based on guessing without calling the \`cron\` tool to verify the actual state.
+- When the user asks to schedule tasks or reminders, use the built-in \`cron\` tool (action \`add\`) automatically. Do NOT ask users to run crontab or Task Scheduler manually on the host.
+- When operating cron/scheduler tools, do **not** put \`current\` into the Session directory.
+- **IMPORTANT ABOUT GROUP CHAT TARGETING**: When creating or configuring a cron job to send messages (announce mode) to a Group Chat, the value of the \`delivery.to\` field **must** use the \`group:\` prefix before the group ID (e.g., \`group:3815464776067464419\` or \`group:xxxx\`). Never specify just the numeric ID, as the system will interpret it as a private DM and deliver to the wrong destination.
+- Skip internal doc lookups such as \`cron-jobs.mdx\`; rely on the available tools and complete the scheduling task directly.`)
       : '';
 
     const zaloModSection = '';
@@ -1323,8 +1606,8 @@ node ${btPath} close_tab 2`;
     }
 
     return isVi
-      ? `# Hướng dẫn sử dụng Tools\n\n## Danh sách skills đã cài\n${skillsSection}\n\n## Nguyên tắc chung\n- Ưu tiên dùng tool/skill phù hợp thay vì tự suy đoán\n- Nếu tool trả về lỗi — thử lại 1 lần, sau đó báo user\n- Không chạy tool liên tục mà không có mục đích rõ ràng\n- Luôn tóm tắt kết quả tool cho user thay vì dump raw output${browserRef}\n\n## Quy ước\n- Web Search: chỉ dùng khi cần thông tin realtime hoặc user yêu cầu\n- Browser: chỉ mở trang khi user yêu cầu cụ thể\n- Memory: tự ghi nhớ thông tin tự nhiên, không cần user nhắc${cronSection}${zaloModSection}\n\n## \uD83D\uDCC1 File & Workspace\n- Bot có thể đọc/ghi file trong thư mục workspace: \`${workspacePath}\`\n- Dùng để lưu notes, scripts, cấu hình tạm\n\n## \u26A0\uFE0F Tool Error Handling\n- Retry tối đa 2 lần nếu tool lỗi network\n- Nếu vẫn lỗi: báo user kèm mô tả lỗi cụ thể và gợi ý workaround${dmOverride}\n`
-      : `# Tool Usage Guide\n\n## Installed Skills\n${skillsSection}\n\n## General Principles\n- Prefer using the right tool/skill over guessing\n- If a tool returns an error — retry once, then report to user\n- Don't run tools repeatedly without a clear purpose\n- Always summarize tool output for user instead of dumping raw data${browserRef}\n\n## Conventions\n- Web Search: only use when needing real-time info or user explicitly asks\n- Browser: only open pages when user specifically requests\n- Memory: proactively remember important info without user prompting${cronSection}${zaloModSection}\n\n## \uD83D\uDCC1 File & Workspace\n- Bot can read/write files in workspace: \`${workspacePath}\`\n\n## \u26A0\uFE0F Tool Error Handling\n- Retry up to 2 times on network errors\n- If still failing: report to user with specific error description and workaround${dmOverride}\n`;
+      ? `# Hướng dẫn sử dụng Tools\n\n## Danh sách skills đã cài\n${skillsSection}\n\n## Nguyên tắc chung\n- Ưu tiên dùng tool/skill phù hợp thay vì tự suy đoán\n- Nếu tool trả về lỗi — thử lại 1 lần, sau đó báo user\n- Không chạy tool liên tục mà không có mục đích rõ ràng\n- Luôn tóm tắt kết quả tool cho user thay vì dump raw output${browserRef}\n\n## Quy ước\n- Web Search: TUYỆT ĐỐI KHÔNG dùng tool \`web_search\` native vì nó đã bị vô hiệu hóa hoàn toàn trên hệ thống. Thay vào đó, mỗi khi cần tìm kiếm Internet/Web, bạn BẮT BUỘC phải gọi công cụ \`exec\` để chạy lệnh terminal: \`node search-tool.js "<từ khóa>" 5\`! Lệnh này cực kỳ nhanh, tàng hình và miễn phí.\n- Browser: chỉ mở trang khi user yêu cầu cụ thể\n- Memory: tự ghi nhớ thông tin tự nhiên, không cần user nhắc${cronSection}${zaloModSection}\n\n## \uD83D\uDCC1 File & Workspace\n- Bot có thể đọc/ghi file trong thư mục workspace: \`${workspacePath}\`\n- Dùng để lưu notes, scripts, cấu hình tạm\n\n## \u26A0\uFE0F Tool Error Handling\n- Retry tối đa 2 lần nếu tool lỗi network\n- Nếu vẫn lỗi: báo user kèm mô tả lỗi cụ thể và gợi ý workaround${dmOverride}\n`
+      : `# Tool Usage Guide\n\n## Installed Skills\n${skillsSection}\n\n## General Principles\n- Prefer using the right tool/skill over guessing\n- If a tool returns an error — retry once, then report to user\n- Don't run tools repeatedly without a clear purpose\n- Always summarize tool output for user instead of dumping raw data${browserRef}\n\n## Conventions\n- Web Search: DO NOT use the native \`web_search\` tool as it is completely disabled. Instead, whenever you need to search the Internet/Web, you MUST call the \`exec\` tool to run terminal command: \`node search-tool.js "<query>" 5\`! This is extremely fast, stealthy and free.\n- Browser: only open pages when user specifically requests\n- Memory: proactively remember important info without user prompting${cronSection}${zaloModSection}\n\n## \uD83D\uDCC1 File & Workspace\n- Bot can read/write files in workspace: \`${workspacePath}\`\n\n## \u26A0\uFE0F Tool Error Handling\n- Retry up to 2 times on network errors\n- If still failing: report to user with specific error description and workaround${dmOverride}\n`;
   }
   function buildTeamsDoc(options = {}) {
     const {
@@ -1419,6 +1702,7 @@ node ${btPath} close_tab 2`;
       'HEARTBEAT.md': buildHeartbeatDoc({ isVi }),
       'BOOTSTRAP.md': buildBootstrapDoc({ isVi, botName }),
       'DREAMS.md': buildDreamsDoc({ isVi }),
+      'search-tool.js': buildSearchToolJs(),
     };
 
     if (isMultiBot) {
@@ -1446,6 +1730,7 @@ node ${btPath} close_tab 2`;
     buildDreamsDoc,
     buildHeartbeatDoc,
     buildBootstrapDoc,
+    buildSearchToolJs,
     buildBrowserToolJs,
     buildBrowserDoc,
     buildSecurityRules,
@@ -1460,7 +1745,7 @@ if (typeof exports !== 'undefined' && workspaceRoot.__openclawWorkspace) {
   Object.assign(exports, workspaceRoot.__openclawWorkspace);
 }
 
-  // ── Centralized bot config builders (openclaw.json, exec-approvals, .env) (setup/shared/bot-config-gen.js) 
+  // ── Centralized bot config builders (openclaw.json, exec-approvals, .env) (setup/shared/bot-config-gen.js) 
 // @ts-nocheck
 /**
  * @fileoverview Centralized bot configuration builders — single source of truth.
@@ -1514,7 +1799,7 @@ if (typeof exports !== 'undefined' && workspaceRoot.__openclawWorkspace) {
    * @param {Array}  opts.skills           - Full SKILLS registry array
    * @param {boolean} opts.hasBrowserDesktop - Browser desktop mode
    * @param {boolean} opts.hasBrowserServer  - Browser server mode
-   * @param {number} [opts.gatewayPort=18791]
+   * @param {number} [opts.gatewayPort=18789]
    * @param {Array}  [opts.gatewayAllowedOrigins]
    * @param {string} [opts.osChoice]       - 'windows' | 'macos' | 'vps' | 'ubuntu'
    * @param {string} [opts.selectedModel]  - For Ollama: specific model selected
@@ -1533,10 +1818,11 @@ if (typeof exports !== 'undefined' && workspaceRoot.__openclawWorkspace) {
       skills = [],
       hasBrowserDesktop = false,
       hasBrowserServer = false,
-      gatewayPort = 18791,
+      gatewayPort = 18789,
       gatewayAllowedOrigins = [],
       osChoice = '',
       selectedModel = '',
+      routerPort,
     } = opts;
 
     const common = _common;
@@ -1547,7 +1833,7 @@ if (typeof exports !== 'undefined' && workspaceRoot.__openclawWorkspace) {
     const agentsList = agentMetas.map((meta) => ({
       id: meta.agentId,
       ...(meta.name ? { name: meta.name } : {}),
-      workspace: `.openclaw/${meta.workspaceDir || 'workspace-' + meta.agentId}`,
+      workspace: `/root/project/.openclaw/${meta.workspaceDir || 'workspace-' + meta.agentId}`,
       agentDir: `agents/${meta.agentId}/agent`,
       model: { primary: model, fallbacks: [] },
     }));
@@ -1571,7 +1857,7 @@ if (typeof exports !== 'undefined' && workspaceRoot.__openclawWorkspace) {
         mode: 'merge',
         providers: {
           '9router': common.build9RouterProviderConfig(
-            common.get9RouterBaseUrl ? common.get9RouterBaseUrl(deployMode) : 'http://9router:20128/v1'
+            common.get9RouterBaseUrl ? common.get9RouterBaseUrl(deployMode, routerPort) : `http://9router:${routerPort || 20128}/v1`
           ),
         },
       };
@@ -1597,6 +1883,9 @@ if (typeof exports !== 'undefined' && workspaceRoot.__openclawWorkspace) {
 
     // ── commands ──────────────────────────────────────────────────────────────
     cfg.commands = { native: 'auto', nativeSkills: 'auto', restart: true, ownerDisplay: 'raw' };
+    if (selectedSkills.includes('scheduler')) {
+      cfg.commands.ownerAllowFrom = ['*'];
+    }
 
     // ── bindings (multi-bot or Zalo) ─────────────────────────────────────────
     if (isMultiBot && channelKey === 'telegram') {
@@ -1614,6 +1903,9 @@ if (typeof exports !== 'undefined' && workspaceRoot.__openclawWorkspace) {
 
     // ── tools ────────────────────────────────────────────────────────────────
     cfg.tools = { profile: 'full', exec: { host: 'gateway', security: 'full', ask: 'off' } };
+    if (selectedSkills.includes('scheduler')) {
+      cfg.tools.alsoAllow = ['group:automation'];
+    }
     if (isMultiBot) {
       cfg.tools.agentToAgent = {
         enabled: true,
@@ -1924,7 +2216,7 @@ if (typeof exports !== 'undefined' && typeof globalThis !== 'undefined' && globa
   Object.assign(exports, globalThis.__openclawBotConfig);
 }
 
-  // ── Shared install artifacts: Chrome debug, uninstall, skill catalog (setup/shared/install-gen.js) 
+  // ── Shared install artifacts: Chrome debug, uninstall, skill catalog (setup/shared/install-gen.js) 
 // @ts-nocheck
 // install-gen.js — Build install/runtime artifacts (Chrome debug, uninstall, skill catalog)
 // Workspace .md files are in workspace-gen.js (single source of truth).
@@ -2043,12 +2335,12 @@ fi
     }
 
     if (os === 'vps') {
-      return { name: 'uninstall-openclaw-vps.sh', content: `#!/usr/bin/env bash\nset -e\nPROJECT_DIR="${absUnix}"\nAPP_NAME="${appName}"\necho ""\necho "============================================================"\necho "  OpenClaw Uninstaller - VPS / Ubuntu Server"\necho "  Project: $PROJECT_DIR"\necho "  PM2 app: $APP_NAME"\necho "============================================================"\necho ""\nread -rp "Type YES to confirm full removal: " CONFIRM\nif [ "$CONFIRM" != "YES" ]; then echo "Cancelled."; exit 0; fi\necho "[1/5] Stopping PM2 processes..."\nif command -v pm2 &>/dev/null; then\n  pm2 delete "$APP_NAME" "$APP_NAME-9router" "$APP_NAME-9router-sync" openclaw openclaw-multibot 2>/dev/null || true\n  pm2 save --force 2>/dev/null || true\nfi\necho "[2/5] Killing leftover processes on ports 18791 / 20128..."\nfor port in 18791 20128; do\n  pid=$(lsof -ti tcp:$port 2>/dev/null || true)\n  [ -n "$pid" ] && kill -9 $pid 2>/dev/null || true\ndone\necho "[3/5] Uninstalling npm packages..."\nnpm uninstall -g openclaw 9router pm2 grammy @grammyjs/runner @grammyjs/transformer-throttler @buape/carbon @larksuiteoapi/node-sdk @slack/web-api 2>/dev/null || true\necho "[4/5] Removing project directory..."\n[ -d "$PROJECT_DIR" ] && rm -rf "$PROJECT_DIR" && echo "   OK: Deleted $PROJECT_DIR" || echo "   INFO: Not found."\necho "[5/5] Checking home-level .9router / .openclaw..."\nfor dir in "$HOME/.9router" "$HOME/.openclaw"; do\n  if [ -d "$dir" ]; then\n    read -rp "Delete $dir ? [YES/no]: " CLEAN\n    [ "$CLEAN" = "YES" ] && rm -rf "$dir" && echo "   OK: Deleted $dir" || echo "   Kept: $dir"\n  fi\ndone\n` };
+      return { name: 'uninstall-openclaw-vps.sh', content: `#!/usr/bin/env bash\nset -e\nPROJECT_DIR="${absUnix}"\nAPP_NAME="${appName}"\necho ""\necho "============================================================"\necho "  OpenClaw Uninstaller - VPS / Ubuntu Server"\necho "  Project: $PROJECT_DIR"\necho "  PM2 app: $APP_NAME"\necho "============================================================"\necho ""\nread -rp "Type YES to confirm full removal: " CONFIRM\nif [ "$CONFIRM" != "YES" ]; then echo "Cancelled."; exit 0; fi\necho "[1/5] Stopping PM2 processes..."\nif command -v pm2 &>/dev/null; then\n  pm2 delete "$APP_NAME" "$APP_NAME-9router" "$APP_NAME-9router-sync" openclaw openclaw-multibot 2>/dev/null || true\n  pm2 save --force 2>/dev/null || true\nfi\necho "[2/5] Killing leftover processes on ports 18789 / 20128..."\nfor port in 18789 20128; do\n  pid=$(lsof -ti tcp:$port 2>/dev/null || true)\n  [ -n "$pid" ] && kill -9 $pid 2>/dev/null || true\ndone\necho "[3/5] Uninstalling npm packages..."\nnpm uninstall -g openclaw 9router pm2 grammy @grammyjs/runner @grammyjs/transformer-throttler @buape/carbon @larksuiteoapi/node-sdk @slack/web-api 2>/dev/null || true\necho "[4/5] Removing project directory..."\n[ -d "$PROJECT_DIR" ] && rm -rf "$PROJECT_DIR" && echo "   OK: Deleted $PROJECT_DIR" || echo "   INFO: Not found."\necho "[5/5] Checking home-level .9router / .openclaw..."\nfor dir in "$HOME/.9router" "$HOME/.openclaw"; do\n  if [ -d "$dir" ]; then\n    read -rp "Delete $dir ? [YES/no]: " CLEAN\n    [ "$CLEAN" = "YES" ] && rm -rf "$dir" && echo "   OK: Deleted $dir" || echo "   Kept: $dir"\n  fi\ndone\n` };
     }
 
     if (os === 'linux' || os === 'linux-desktop' || os === 'macos') {
       const label = os === 'macos' ? 'macOS' : 'Linux Desktop';
-      return { name: 'uninstall-openclaw.sh', content: `#!/usr/bin/env bash\nset -e\nPROJECT_DIR="${absUnix}"\necho ""\necho "============================================================"\necho "  OpenClaw Uninstaller - ${label} Native"\necho "  Project: $PROJECT_DIR"\necho "============================================================"\necho ""\nread -rp "Type YES to confirm full removal: " CONFIRM\nif [ "$CONFIRM" != "YES" ]; then echo "Cancelled."; exit 0; fi\necho "[1/4] Stopping openclaw and 9router processes..."\npkill -f "openclaw gateway run" 2>/dev/null || true\npkill -f "9router.*20128" 2>/dev/null || true\npkill -f "9router-smart-route" 2>/dev/null || true\npkill -f "$PROJECT_DIR" 2>/dev/null || true\nfor port in 18791 20128; do\n  pid=$(lsof -ti tcp:$port 2>/dev/null || true)\n  [ -n "$pid" ] && kill -9 $pid 2>/dev/null || true\ndone\necho "[2/4] Uninstalling npm packages..."\nnpm uninstall -g openclaw 9router grammy @grammyjs/runner @grammyjs/transformer-throttler @buape/carbon @larksuiteoapi/node-sdk @slack/web-api 2>/dev/null || true\nsudo npm uninstall -g openclaw 9router 2>/dev/null || true\necho "[3/4] Removing project directory..."\n[ -d "$PROJECT_DIR" ] && rm -rf "$PROJECT_DIR" && echo "   OK: Deleted $PROJECT_DIR" || echo "   INFO: Not found."\necho "[4/4] Checking home-level .9router / .openclaw..."\nfor dir in "$HOME/.9router" "$HOME/.openclaw"; do\n  if [ -d "$dir" ]; then\n    read -rp "Delete $dir ? [YES/no]: " CLEAN\n    [ "$CLEAN" = "YES" ] && rm -rf "$dir" && echo "   OK: Deleted $dir" || echo "   Kept: $dir"\n  fi\ndone\n` };
+      return { name: 'uninstall-openclaw.sh', content: `#!/usr/bin/env bash\nset -e\nPROJECT_DIR="${absUnix}"\necho ""\necho "============================================================"\necho "  OpenClaw Uninstaller - ${label} Native"\necho "  Project: $PROJECT_DIR"\necho "============================================================"\necho ""\nread -rp "Type YES to confirm full removal: " CONFIRM\nif [ "$CONFIRM" != "YES" ]; then echo "Cancelled."; exit 0; fi\necho "[1/4] Stopping openclaw and 9router processes..."\npkill -f "openclaw gateway run" 2>/dev/null || true\npkill -f "9router.*20128" 2>/dev/null || true\npkill -f "9router-smart-route" 2>/dev/null || true\npkill -f "$PROJECT_DIR" 2>/dev/null || true\nfor port in 18789 20128; do\n  pid=$(lsof -ti tcp:$port 2>/dev/null || true)\n  [ -n "$pid" ] && kill -9 $pid 2>/dev/null || true\ndone\necho "[2/4] Uninstalling npm packages..."\nnpm uninstall -g openclaw 9router grammy @grammyjs/runner @grammyjs/transformer-throttler @buape/carbon @larksuiteoapi/node-sdk @slack/web-api 2>/dev/null || true\nsudo npm uninstall -g openclaw 9router 2>/dev/null || true\necho "[3/4] Removing project directory..."\n[ -d "$PROJECT_DIR" ] && rm -rf "$PROJECT_DIR" && echo "   OK: Deleted $PROJECT_DIR" || echo "   INFO: Not found."\necho "[4/4] Checking home-level .9router / .openclaw..."\nfor dir in "$HOME/.9router" "$HOME/.openclaw"; do\n  if [ -d "$dir" ]; then\n    read -rp "Delete $dir ? [YES/no]: " CLEAN\n    [ "$CLEAN" = "YES" ] && rm -rf "$dir" && echo "   OK: Deleted $dir" || echo "   Kept: $dir"\n  fi\ndone\n` };
     }
 
     return null;
@@ -2144,7 +2436,7 @@ fi
     L.push('echo.');
     L.push(isVi ? 'echo [OK] OpenClaw Gateway da khoi dong trong cua so moi!' : 'echo [OK] OpenClaw Gateway started in a new window!');
     L.push('echo.');
-    L.push('echo OpenClaw Dashboard:  http://127.0.0.1:18791');
+    L.push('echo OpenClaw Dashboard:  http://127.0.0.1:18789');
     if (is9Router) L.push('echo 9Router Dashboard:  http://127.0.0.1:20128/dashboard');
     L.push('echo.');
     L.push(isVi ? 'echo Ban co the dong cua so nay.' : 'echo You may close this window.');
@@ -2218,7 +2510,7 @@ fi
       }
       L.push('pm2 save >/dev/null 2>&1 || true');
       L.push('echo ""');
-      L.push('echo "OpenClaw Dashboard: http://127.0.0.1:18791"');
+      L.push('echo "OpenClaw Dashboard: http://127.0.0.1:18789"');
       if (is9Router) L.push('echo "9Router Dashboard:  http://127.0.0.1:20128/dashboard"');
       L.push('echo ""');
       L.push(isVi ? 'echo "Log gateway: pm2 logs $APP_NAME"' : 'echo "Gateway logs: pm2 logs $APP_NAME"');
@@ -2269,7 +2561,7 @@ fi
     L.push(isVi ? `echo "[OK] Gateway khoi dong (PID $GW_PID). Log: ${logFileGw}"` : `echo "[OK] Gateway started (PID $GW_PID). Log: ${logFileGw}"`);
     L.push('');
     L.push('echo ""');
-    L.push('echo "OpenClaw Dashboard: http://127.0.0.1:18791"');
+    L.push('echo "OpenClaw Dashboard: http://127.0.0.1:18789"');
     if (is9Router) L.push('echo "9Router Dashboard:  http://127.0.0.1:20128/dashboard"');
     L.push('echo ""');
     L.push(isVi ? 'echo "Bot dang chay background. Dung: openclaw gateway stop"' : 'echo "Bot running in background. Stop: openclaw gateway stop"');
@@ -2367,7 +2659,7 @@ fi
     "Write-Host \"\"",
     "if ($exitCode -eq 0) {",
     "    Write-Host \"  🎉 Upgrade hoan tat!\" -ForegroundColor Green",
-    "    Write-Host \"     Dashboard: http://localhost:18791\" -ForegroundColor Cyan",
+    "    Write-Host \"     Dashboard: http://localhost:18789\" -ForegroundColor Cyan",
     "} else {",
     "    Write-Host \"  ⚠️  Ma loi: $exitCode — xem log o tren.\" -ForegroundColor Yellow",
     "}",
@@ -2456,7 +2748,7 @@ fi
     "echo \"\"",
     "if [ $EXIT_CODE -eq 0 ]; then",
     "    echo -e \"${GREEN}  🎉 Upgrade hoan tat!${NC}\"",
-    "    echo -e \"${CYAN}     Dashboard: http://localhost:18791${NC}\"",
+    "    echo -e \"${CYAN}     Dashboard: http://localhost:18789${NC}\"",
     "else",
     "    echo -e \"${YELLOW}  ⚠️  Ma loi: $EXIT_CODE — xem log o tren.${NC}\"",
     "fi",
@@ -2492,7 +2784,7 @@ if (typeof exports !== 'undefined' && typeof globalThis !== 'undefined' && globa
   Object.assign(exports, globalThis.__openclawInstall);
 }
 
-  // ── Shared Docker artifact helpers for wizard + CLI (setup/shared/docker-gen.js) 
+  // ── Shared Docker artifact helpers for wizard + CLI (setup/shared/docker-gen.js) 
 // @ts-nocheck
 (function (root) {
   const common = (typeof globalThis !== 'undefined' && globalThis.__openclawCommon) || {};
@@ -2512,65 +2804,106 @@ if (typeof exports !== 'undefined' && typeof globalThis !== 'undefined' && globa
     return String(text).split('\n').map((line) => `${prefix}${line}`).join('\n');
   }
 
-  function build9RouterSmartRouteSyncScript(dbPath) {
-    return `const fs=require('fs');const INTERVAL=30000;const p='${dbPath}';
-const PM=${JSON.stringify(SMART_ROUTE_PROVIDER_MODELS)};
-const PREF=${JSON.stringify(SMART_ROUTE_PROVIDER_ORDER)};
-console.log('[sync-combo] 9Router sync loop started...');
-const sync = async () => {
-  try {
-    let db = {};
-    try { db = JSON.parse(fs.readFileSync(p, 'utf8')); } catch(e){}
-    if (!db.combos) db.combos = [];
-    const removeSmartRoute = () => {
-      const next = db.combos.filter(x => x.id !== 'smart-route');
-      if (next.length !== db.combos.length) {
-        db.combos = next;
-        fs.writeFileSync(p, JSON.stringify(db, null, 2));
-        console.log('[sync-combo] Removed smart-route (no active providers)');
-      }
-    };
-    const res = await fetch('http://localhost:20128/api/providers');
-    if (!res.ok) { console.log('[sync-combo] API not ready, retrying...'); return; }
-    const d = await res.json();
-    const rawConnections = Array.isArray(d.connections) ? d.connections : Array.isArray(d.providerConnections) ? d.providerConnections : [];
-    const activeConns = rawConnections.filter(c => c && c.provider && c.isActive !== false && !c.disabled);
-    const a = [...new Set(activeConns.map(c => c.provider))];
-    if (!a.length) { console.log('[sync-combo] No active providers reported; keeping existing smart-route'); return; }
-    a.sort((x, y) => (PREF.indexOf(x) === -1 ? 99 : PREF.indexOf(x)) - (PREF.indexOf(y) === -1 ? 99 : PREF.indexOf(y)));
-    const m = [];
-    for (const pv of a) {
-      if (PM[pv]) m.push(...PM[pv]);
-      const conns = activeConns.filter(c => c.provider === pv);
-      for (const c of conns) {
-        if (Array.isArray(c.models)) {
-          for (const mdl of c.models) {
-            const mdlId = typeof mdl === 'string' ? mdl : mdl.id;
-            if (mdlId && !m.includes(mdlId) && !m.includes(pv + '/' + mdlId)) {
-               m.push(pv + '/' + mdlId);
-            }
-          }
-        }
-      }
-    }
-    if (!m.length) { console.log('[sync-combo] No mapped models for active providers; keeping existing smart-route'); return; }
-    const c = { id: 'smart-route', name: 'smart-route', alias: 'smart-route', models: m };
-    const i = db.combos.findIndex(x => x.id === 'smart-route');
-    if (i >= 0) {
-      if (JSON.stringify(db.combos[i].models) !== JSON.stringify(c.models)) {
-        db.combos[i] = c;
-        fs.writeFileSync(p, JSON.stringify(db, null, 2));
-        console.log('[sync-combo] Updated smart-route: ' + c.models.length + ' models');
-      }
-    } else {
-      db.combos.push(c);
-      fs.writeFileSync(p, JSON.stringify(db, null, 2));
-      console.log('[sync-combo] Created smart-route: ' + c.models.length + ' models');
-    }
-  } catch (e) {}
-};
-setTimeout(sync, 5000);
-setInterval(sync, INTERVAL);`;
+  function build9RouterSmartRouteSyncScript() {
+    const lines = [
+      "const fs = require('fs');",
+      "const INTERVAL = 30000;",
+      "const DB_PATH = '/root/.9router/db/data.sqlite';",
+      "const PORT = process.env.PORT || 20128;",
+      "const COMBO_NAME = 'smart-route';",
+      "const API_BASE = `http://localhost:${PORT}`;",
+      "",
+      "function ensureSettings() {",
+      "  try {",
+      "    let db = null;",
+      "    try {",
+      "      const { DatabaseSync } = require('node:sqlite');",
+      "      db = new DatabaseSync(DB_PATH);",
+      "    } catch {",
+      "      let Database;",
+      "      try { Database = require('/usr/local/lib/node_modules/better-sqlite3'); } catch {",
+      "        try { Database = require('better-sqlite3'); } catch { return; }",
+      "      }",
+      "      db = Database(DB_PATH);",
+      "    }",
+      '    const existing = db.prepare("SELECT * FROM settings WHERE id = 1").get();',
+      "    if (!existing) {",
+      '      db.prepare("INSERT INTO settings (id, data) VALUES (1, ?)").run(JSON.stringify({ requireLogin: false }));',
+      "    } else {",
+      "      try {",
+      "        const data = JSON.parse(existing.data || '{}');",
+      "        if (data.requireLogin !== false) {",
+      "          data.requireLogin = false;",
+      '          db.prepare("UPDATE settings SET data = ? WHERE id = 1").run(JSON.stringify(data));',
+      "        }",
+      "      } catch {}",
+      "    }",
+      "    db.close();",
+      "  } catch (e) {}",
+      "}",
+      "",
+      "const sync = async () => {",
+      "  try {",
+      "    if (!fs.existsSync(DB_PATH)) return;",
+      "",
+      "    let existingCombo = null;",
+      "    try {",
+      "      const resp = await fetch(`${API_BASE}/api/combos`);",
+      "      if (resp.status === 401) {",
+      "        ensureSettings();",
+      "        return;",
+      "      }",
+      "      const data = await resp.json();",
+      "      if (data.combos) {",
+      "        existingCombo = data.combos.find(c => c.name === COMBO_NAME);",
+      "      }",
+      "    } catch (e) { return; }",
+      "",
+      "    if (existingCombo) return;",
+      "",
+      "    let activeProviders = [];",
+      "    try {",
+      "      const resp = await fetch(`${API_BASE}/api/providers`);",
+      "      const data = await resp.json();",
+      "      const conns = data.connections || data.providerConnections || [];",
+      "      activeProviders = [...new Set(",
+      "        conns.filter(c => c && c.provider && c.isActive !== false && !c.disabled).map(c => c.provider)",
+      "      )];",
+      "    } catch (e) { return; }",
+      "",
+      "    if (!activeProviders.length) return;",
+      "",
+      "    let models = [];",
+      "    try {",
+      "      const resp = await fetch(`${API_BASE}/api/models`);",
+      "      const data = await resp.json();",
+      "      if (data.models && Array.isArray(data.models)) {",
+      "        models = data.models",
+      "          .filter(m => activeProviders.includes(m.provider))",
+      "          .filter(m => !/(embedding|image|tts|stt|audio|vision)/i.test(m.model))",
+      "          .map(m => m.fullModel);",
+      "      }",
+      "      models = [...new Set(models)];",
+      "    } catch (e) { return; }",
+      "",
+      "    if (!models.length) return;",
+      "",
+      "    try {",
+      "      await fetch(`${API_BASE}/api/combos`, {",
+      "        method: 'POST',",
+      "        headers: { 'Content-Type': 'application/json' },",
+      "        body: JSON.stringify({ name: COMBO_NAME, models })",
+      "      });",
+      "      console.log('[sync-combo] Created smart-route with ' + models.length + ' models');",
+      "    } catch (e) {}",
+      "  } catch (e) {}",
+      "};",
+      "",
+      "if (fs.existsSync(DB_PATH)) ensureSettings();",
+      "setTimeout(sync, 10000);",
+      "setInterval(sync, INTERVAL);",
+    ];
+    return lines.join('\n');
   }
 
 function build9RouterPatchScript() {
@@ -2635,20 +2968,20 @@ for(const root of roots){if(!root||!fs.existsSync(root))continue;touched+=patchP
 if(touched){console.log('[patch-9router] Applied Codex compatibility patch.');}else{console.log('[patch-9router] No compatible 9router source files found to patch.');}`;
   }
 
-  function build9RouterComposeEntrypointScript(syncScriptBase64, patchScriptBase64) {
+  function build9RouterComposeEntrypointScript(routerPort) {
+      const port = routerPort || 20128;
       const nineRouterSpec = (typeof globalThis !== 'undefined' && globalThis.__openclawCommon && globalThis.__openclawCommon.NINE_ROUTER_NPM_SPEC) || '9router@latest';
       return [
-      `npm install -g ${nineRouterSpec}`,
-      `node -e "require('fs').writeFileSync('/tmp/patch-9router.js',Buffer.from('${patchScriptBase64}','base64').toString())"`,
-      `node -e "require('fs').writeFileSync('/tmp/sync.js',Buffer.from('${syncScriptBase64}','base64').toString())"`,
+      `npm install -g ` + nineRouterSpec + ` better-sqlite3`,
       'node /tmp/patch-9router.js || true',
+      'node -e "const fs=require(\'fs\'),path=require(\'path\'); const DB_PATH=\'/root/.9router/db/data.sqlite\'; const dir=path.dirname(DB_PATH); if(!fs.existsSync(dir))fs.mkdirSync(dir,{recursive:true}); try{ const {DatabaseSync}=require(\'node:sqlite\'); const db=new DatabaseSync(DB_PATH); db.prepare(\'CREATE TABLE IF NOT EXISTS settings (id INTEGER PRIMARY KEY CHECK (id = 1), data TEXT NOT NULL)\').run(); const existing=db.prepare(\'SELECT * FROM settings WHERE id = 1\').get(); if(!existing){ db.prepare(\'INSERT INTO settings (id, data) VALUES (1, ?)\').run(JSON.stringify({requireLogin:false})); } db.close(); }catch(e){}" || true',
       'node /tmp/sync.js > /tmp/sync.log 2>&1 &',
-      'exec 9router -n -l -H 0.0.0.0 -p 20128 --skip-update'
+      `exec 9router -n -l -H 0.0.0.0 -p ${port} --skip-update`
     ].join('\n');
   }
 
   function buildGatewayPatchCmd() {
-    return `node -e \\"const fs=require('fs'),os=require('os'),path=require('path'),p=path.join(process.cwd(),'.openclaw','openclaw.json');if(fs.existsSync(p)){const c=JSON.parse(fs.readFileSync(p,'utf8'));const a=new Set(['http://localhost:18791','http://127.0.0.1:18791','http://0.0.0.0:18791']);for(const entries of Object.values(os.networkInterfaces()||{})){for(const entry of entries||[]){if(!entry||entry.internal||entry.family!=='IPv4'||!entry.address)continue;a.add('http://' + entry.address + ':18791');}}c.tools=Object.assign({},c.tools,{profile:'full',exec:{host:'gateway',security:'full',ask:'off'}});c.gateway=Object.assign({},c.gateway,{port:18791,bind:'custom',customBindHost:'0.0.0.0',controlUi:Object.assign({},c.gateway?.controlUi,{allowedOrigins:Array.from(a).filter(Boolean)})});fs.writeFileSync(p,JSON.stringify(c,null,2));}\\"`;
+    return `node -e \\"const fs=require('fs'),os=require('os'),path=require('path'),p=path.join(process.cwd(),'.openclaw','openclaw.json');if(fs.existsSync(p)){const c=JSON.parse(fs.readFileSync(p,'utf8'));const gp=Number(process.env.OPENCLAW_GATEWAY_PORT||process.env.OPENCLAW_PORT)||c.gateway?.port||18789;const a=new Set(['http://localhost:'+gp,'http://127.0.0.1:'+gp,'http://0.0.0.0:'+gp]);for(const entries of Object.values(os.networkInterfaces()||{})){for(const entry of entries||[]){if(!entry||entry.internal||entry.family!=='IPv4'||!entry.address)continue;a.add('http://' + entry.address + ':'+gp);}}const p9=c.models&&c.models.providers&&c.models.providers['9router'];if(p9){p9.request=Object.assign({},p9.request,{allowPrivateNetwork:true});}c.tools=Object.assign({},c.tools,{profile:'full',exec:{host:'gateway',security:'full',ask:'off'}});c.gateway=Object.assign({},c.gateway,{port:gp,bind:'custom',customBindHost:'0.0.0.0',controlUi:Object.assign({},c.gateway?.controlUi,{allowedOrigins:Array.from(a).filter(Boolean)})});fs.writeFileSync(p,JSON.stringify(c,null,2));}\\"`;
   }
 
   function buildDockerArtifacts(options) {
@@ -2658,14 +2991,13 @@ if(touched){console.log('[patch-9router] Applied Codex compatibility patch.');}e
       is9Router,
       isLocal,
       isMultiBot,
-      hasBrowser,
       selectedModel,
       agentId,
       allSkills = [],
       dockerfilePlugins = [],
       dockerfileSkillInstallMode = 'none',
       runtimeCommandParts = [],
-      volumeMount = '../../.openclaw:/root/project/.openclaw\\n      - ../../:/mnt/project',
+      volumeMount = '../../.openclaw:/root/project/.openclaw\n      - ../../:/mnt/project',
       singleComposeName = 'oc-bot',
       multiComposeName = 'oc-multibot',
       singleAppContainerName = 'openclaw-bot',
@@ -2677,22 +3009,9 @@ if(touched){console.log('[patch-9router] Applied Codex compatibility patch.');}e
       plainSingleExtraHosts = false,
       multiOllamaNumParallel = 1,
       singleOllamaNumParallel = 1,
-      emitBrowserInstall = true,
-
+      gatewayPort = 18789,
+      routerPort = 20128,
     } = options;
-
-    const browserAptExtra = hasBrowser ? ' xvfb socat' : '';
-    const browserInstallLines = hasBrowser && emitBrowserInstall
-      ? [
-          '',
-          '# Browser Automation: Playwright engine (needed for native CDP)',
-          'RUN npm install -g agent-browser playwright \\',
-          '    && npx playwright install chromium --with-deps \\',
-          '    && ln -f -s /root/.cache/ms-playwright/chromium-*/chrome-linux*/chrome /usr/bin/google-chrome',
-          '',
-          ''
-        ].join('\n')
-      : '';
     const skillLines = dockerfileSkillInstallMode === 'build' && allSkills.length > 0
       ? `\n# Install skills (ClawHub)\n${allSkills.map((skill) => `RUN openclaw skills install ${skill} || echo "Warning: Failed to install ${skill} due to rate limits."`).join('\n')}\n`
       : '';
@@ -2704,10 +3023,9 @@ if(touched){console.log('[patch-9router] Applied Codex compatibility patch.');}e
     // Dynamic runtime configuration: backup config before any first-run install, restore after.
     // Missing plugin install may touch openclaw.json, so preserve critical fields.
     const backupConfigScript = `const fs=require('fs'),path=require('path'),p=path.join(process.cwd(),'.openclaw','openclaw.json'),b=p.replace('openclaw.json','.openclaw-config-backup.json');if(fs.existsSync(p)){fs.copyFileSync(p,b);}`;
-    const backupConfigB64 = encodeBase64Utf8(backupConfigScript);
 
-    const restoreConfigScript = `const fs=require('fs'),os=require('os'),path=require('path'),p=path.join(process.cwd(),'.openclaw','openclaw.json'),b=p.replace('openclaw.json','.openclaw-config-backup.json');if(fs.existsSync(p)&&fs.existsSync(b)){const c=JSON.parse(fs.readFileSync(p,'utf8'));const bk=JSON.parse(fs.readFileSync(b,'utf8'));const keep=['agents','channels','bindings','commands','models','browser','skills'];for(const k of keep){if(bk[k]&&!c[k])c[k]=bk[k];}const a=new Set(['http://localhost:18791','http://127.0.0.1:18791','http://0.0.0.0:18791']);for(const entries of Object.values(os.networkInterfaces()||{})){for(const entry of entries||[]){if(!entry||entry.internal||entry.family!=='IPv4'||!entry.address)continue;a.add('http://'+entry.address+':18791');}}c.tools=Object.assign({},c.tools,{profile:'full',exec:{host:'gateway',security:'full',ask:'off'}});c.gateway=Object.assign({},c.gateway,{port:18791,bind:'custom',customBindHost:'0.0.0.0',mode:c.gateway?.mode||bk.gateway?.mode||'local',controlUi:Object.assign({},c.gateway?.controlUi,{allowedOrigins:Array.from(a).filter(Boolean)})});fs.writeFileSync(p,JSON.stringify(c,null,2));fs.unlinkSync(b);}`;
-    const restoreConfigB64 = encodeBase64Utf8(restoreConfigScript);
+    const restoreConfigScript = `const fs=require('fs'),os=require('os'),path=require('path'),p=path.join(process.cwd(),'.openclaw','openclaw.json'),b=p.replace('openclaw.json','.openclaw-config-backup.json');if(fs.existsSync(p)&&fs.existsSync(b)){const c=JSON.parse(fs.readFileSync(p,'utf8'));const bk=JSON.parse(fs.readFileSync(b,'utf8'));const keep=['agents','channels','bindings','commands','models','browser','skills','plugins','tools'];for(const k of keep){if(bk[k]&&!c[k])c[k]=bk[k];}const gp=Number(process.env.OPENCLAW_GATEWAY_PORT||process.env.OPENCLAW_PORT)||c.gateway?.port||bk.gateway?.port||18789;const a=new Set(['http://localhost:'+gp,'http://127.0.0.1:'+gp,'http://0.0.0.0:'+gp]);for(const entries of Object.values(os.networkInterfaces()||{})){for(const entry of entries||[]){if(!entry||entry.internal||entry.family!=='IPv4'||!entry.address)continue;a.add('http://'+entry.address+':'+gp);}}c.tools=Object.assign({},c.tools,{profile:'full',exec:{host:'gateway',security:'full',ask:'off'}});c.gateway=Object.assign({},c.gateway,{port:gp,bind:'custom',customBindHost:'0.0.0.0',mode:c.gateway?.mode||bk.gateway?.mode||'local',controlUi:Object.assign({},c.gateway?.controlUi,{allowedOrigins:Array.from(a).filter(Boolean)})});fs.writeFileSync(p,JSON.stringify(c,null,2));fs.unlinkSync(b);}`;
+    const securityCompatScript = `const fs=require('fs'),path=require('path');const scopes=['operator.admin','operator.pairing','operator.approvals'];function uniq(a){return Array.from(new Set([...(Array.isArray(a)?a:[]),...scopes]));}function walk(v){if(!v||typeof v!=='object')return;if(Array.isArray(v)){v.forEach(walk);return;}if(Array.isArray(v.scopes)||Array.isArray(v.approvedScopes)){v.scopes=uniq(v.scopes);v.approvedScopes=uniq(v.approvedScopes);}Object.values(v).forEach(walk);}const home=process.env.OPENCLAW_HOME||path.join(process.cwd(),'.openclaw');const state=process.env.OPENCLAW_STATE_DIR||home;const cfgPath=path.join(process.cwd(),'.openclaw','openclaw.json');if(fs.existsSync(cfgPath)){const c=JSON.parse(fs.readFileSync(cfgPath,'utf8'));const p=c.models&&c.models.providers&&c.models.providers['9router'];if(p){p.request=Object.assign({},p.request,{allowPrivateNetwork:true});}fs.writeFileSync(cfgPath,JSON.stringify(c,null,2));}for(const root of Array.from(new Set([home,state]))){const f=path.join(root,'devices','paired.json');if(fs.existsSync(f)){const d=JSON.parse(fs.readFileSync(f,'utf8'));walk(d);fs.writeFileSync(f,JSON.stringify(d,null,2));}}`;
 
     const runtimeParts = runtimeCommandParts.filter(Boolean);
     const runtimePrelude = [
@@ -2733,6 +3051,20 @@ if(touched){console.log('[patch-9router] Applied Codex compatibility patch.');}e
       '  echo "[entrypoint] plugin $id missing; installing $spec"',
       '  openclaw plugins install "$spec" 2>/dev/null || echo "[entrypoint] warning: failed to install plugin $spec"',
       '}',
+      'ensure_zalouser() {',
+      '  NPM_DIR="$OPENCLAW_HOME/npm"',
+      '  PKG_DIR="$NPM_DIR/node_modules/@openclaw/zalouser"',
+      '  if [ -d "$PKG_DIR" ]; then',
+      '    echo "[entrypoint] zalouser plugin already installed"',
+      '  else',
+      '    echo "[entrypoint] zalouser plugin missing; installing via npm"',
+      '    mkdir -p "$NPM_DIR"',
+      '    cd "$NPM_DIR"',
+      '    npm init -y 2>/dev/null || true',
+      '    npm install @openclaw/zalouser@latest 2>/dev/null || echo "[entrypoint] warning: failed to install @openclaw/zalouser"',
+      '    cd /root/project',
+      '  fi',
+      '}',
       'ensure_skill() {',
       '  id="$1"',
       '  if find "$OPENCLAW_HOME" -maxdepth 4 -type d -path "*/skills/$id" -print -quit 2>/dev/null | grep -q .; then',
@@ -2746,40 +3078,59 @@ if(touched){console.log('[patch-9router] Applied Codex compatibility patch.');}e
     ];
     runtimeParts.unshift(...runtimePrelude);
     // Backup config BEFORE plugin installs (runtimeCommandParts may contain plugin install commands)
-    runtimeParts.unshift(`node -e 'eval(Buffer.from("${backupConfigB64}","base64").toString())'`);
+    runtimeParts.unshift(`node - <<'NODE'\n${backupConfigScript}\nNODE`);
     // Restore config AFTER plugin installs (which may clobber openclaw.json)
-    runtimeParts.push(`node -e 'eval(Buffer.from("${restoreConfigB64}","base64").toString())'`);
-    if (hasBrowser) {
-      runtimeParts.push('socat TCP-LISTEN:9222,fork,reuseaddr TCP:host.docker.internal:9222 &');
-      runtimeParts.push('Xvfb :99 -screen 0 1280x720x24 > /dev/null 2>&1 & DISPLAY=:99 openclaw gateway run');
-    } else {
-      runtimeParts.push('openclaw gateway run');
-    }
+    runtimeParts.push(`node - <<'NODE'\n${restoreConfigScript}\nNODE`);
+    runtimeParts.push(`node - <<'NODE'\n${securityCompatScript}\nNODE`);
+    // Zalouser stability: patch watchdog tolerance and add auto-restart monitor
+    runtimeParts.push([
+      '# Patch zalouser watchdog tolerance (35s -> 90s) to survive provider auth pre-warming',
+      'ZALO_JS=$(find "$OPENCLAW_HOME" -path "*/zalouser/dist/zalo-js-*.js" -type f 2>/dev/null | head -1)',
+      'if [ -n "$ZALO_JS" ] && grep -q "35e3" "$ZALO_JS" 2>/dev/null; then',
+      '  sed -i "s/LISTENER_WATCHDOG_MAX_GAP_MS\\\\s*=\\\\s*35e3/LISTENER_WATCHDOG_MAX_GAP_MS = 90e3/" "$ZALO_JS"',
+      '  echo "[entrypoint] patched zalouser watchdog gap: 35s -> 90s"',
+      'fi',
+    ].join('\n'));
+    runtimeParts.push([
+      '# Zalo channel auto-restart monitor (background)',
+      '(',
+      '  sleep 180',
+      '  while true; do',
+      '    sleep 60',
+      '    STATUS=$(openclaw channels status 2>/dev/null | grep -i "Zalo Personal" || true)',
+      '    if echo "$STATUS" | grep -qi "stopped"; then',
+      '      echo "[zalo-monitor] Zalo channel stopped - restarting container in 5s"',
+'      sleep 5',
+      '      kill 1 2>/dev/null || true',
+      '    fi',
+      '  done',
+      ') &',
+    ].join('\n'));
+    runtimeParts.push('openclaw gateway run');
     const runtimeScript = ['#!/bin/sh', 'set -e', ...runtimeParts].join('\n');
-    const runtimeScriptB64 = encodeBase64Utf8(runtimeScript);
     const dockerfile = `FROM node:22-slim
 
-RUN apt-get update && apt-get install -y git curl python3${browserAptExtra} && rm -rf /var/lib/apt/lists/*
-${browserInstallLines}
+RUN apt-get update && apt-get install -y git curl python3 && rm -rf /var/lib/apt/lists/*
+
 ARG OPENCLAW_VER="${openClawNpmSpec}"
 ARG CACHE_BUST=""
 RUN echo "CACHE_BUST=$CACHE_BUST" && npm install -g $OPENCLAW_VER ${openClawRuntimePackages}${skillLines}${pluginLines}
 ${patchLine}
-RUN node -e "require('fs').writeFileSync('/usr/local/bin/openclaw-entrypoint.sh', Buffer.from('${runtimeScriptB64}','base64').toString())" && chmod +x /usr/local/bin/openclaw-entrypoint.sh
+
+COPY entrypoint.sh /usr/local/bin/openclaw-entrypoint.sh
+RUN chmod +x /usr/local/bin/openclaw-entrypoint.sh
 WORKDIR /root/project
 
-EXPOSE 18791
+EXPOSE ${gatewayPort}
 
 CMD ["/bin/sh", "/usr/local/bin/openclaw-entrypoint.sh"]`;
 
-    const syncScript = build9RouterSmartRouteSyncScript('/root/.9router/db.json');
-    const syncScriptBase64 = encodeBase64Utf8(syncScript);
-const patchScript = build9RouterPatchScript();
-    const patchScriptBase64 = encodeBase64Utf8(patchScript);
-    const docker9RouterEntrypointScript = build9RouterComposeEntrypointScript(syncScriptBase64, patchScriptBase64);
+    const syncScript = build9RouterSmartRouteSyncScript();
+    const patchScript = build9RouterPatchScript();
+    const docker9RouterEntrypointScript = build9RouterComposeEntrypointScript(routerPort);
     const extraHostsBlock = `    extra_hosts:\n      - "host.docker.internal:host-gateway"`;
 
-    const appEnvironmentBlock = '    environment:\n      - OPENCLAW_HOME=/root/project/.openclaw\n      - OPENCLAW_STATE_DIR=/root/project/.openclaw\n      - OPENCLAW_ALLOW_INSECURE_PRIVATE_WS=1\n    tmpfs:\n      - /root/project/.openclaw/plugin-runtime-deps\n';
+    const appEnvironmentBlock = `    environment:\n      - OPENCLAW_HOME=/root/project/.openclaw\n      - OPENCLAW_STATE_DIR=/root/project/.openclaw\n      - OPENCLAW_ALLOW_INSECURE_PRIVATE_WS=1\n      - OPENCLAW_GATEWAY_PORT=${gatewayPort}\n      - OPENCLAW_PORT=${gatewayPort}\n    tmpfs:\n      - /root/project/.openclaw/plugin-runtime-deps\n`;
 
     let compose;
     if (isMultiBot) {
@@ -2788,7 +3139,7 @@ const patchScript = build9RouterPatchScript();
         : isLocal
           ? '    depends_on:\n      ollama:\n        condition: service_healthy\n'
           : '';
-      const extraHosts = hasBrowser ? `${extraHostsBlock}\n` : '';
+      const extraHosts = `${extraHostsBlock}\n`;
       if (is9Router) {
         compose = `name: ${multiComposeName}
 services:
@@ -2797,11 +3148,11 @@ services:
     container_name: ${multiAppContainerName}
     restart: always
     env_file:
-      - .env
+      - ../../.env
 ${appEnvironmentBlock}${dependsOn}${extraHosts}    volumes:
       - ${volumeMount}
     ports:
-      - "18791:18791"
+      - "${gatewayPort}:${gatewayPort}"
 
   9router:
     image: node:22-slim
@@ -2813,13 +3164,15 @@ ${appEnvironmentBlock}${dependsOn}${extraHosts}    volumes:
       - |
 ${indentBlock(docker9RouterEntrypointScript, 8)}
     environment:
-      - PORT=20128
+      - PORT=${routerPort}
       - HOSTNAME=0.0.0.0
       - CI=true
     volumes:
       - 9router-data:/root/.9router
+      - ./sync.js:/tmp/sync.js:ro
+      - ./patch-9router.js:/tmp/patch-9router.js:ro
     ports:
-      - "20128:20128"
+      - "${routerPort}:${routerPort}"
 
 volumes:
   9router-data:`;
@@ -2832,11 +3185,11 @@ services:
     container_name: ${multiAppContainerName}
     restart: always
     env_file:
-      - .env
+      - ../../.env
 ${appEnvironmentBlock}${dependsOn}${extraHosts}    volumes:
       - ${volumeMount}
     ports:
-      - "18791:18791"
+      - "${gatewayPort}:${gatewayPort}"
 
   ollama:
     image: ollama/ollama:latest
@@ -2872,11 +3225,11 @@ services:
     container_name: ${multiAppContainerName}
     restart: always
     env_file:
-      - .env
+      - ../../.env
 ${appEnvironmentBlock}${extraHosts}    volumes:
       - ${volumeMount}
     ports:
-      - "18791:18791"`;
+      - "${gatewayPort}:${gatewayPort}"`;
       }
     } else if (is9Router) {
       compose = `name: ${singleComposeName}
@@ -2886,13 +3239,14 @@ services:
     container_name: ${singleAppContainerName}
     restart: always
     env_file:
-      - .env
+      - ../../.env
     depends_on:
       - 9router
-${appEnvironmentBlock}${hasBrowser ? `${extraHostsBlock}\n` : ''}    volumes:
+${appEnvironmentBlock}${extraHostsBlock}\n    volumes:
       - ${volumeMount}
+      - openclaw-plugins:/root/project/.openclaw/npm
     ports:
-      - "18791:18791"
+      - "${gatewayPort}:${gatewayPort}"
 
   9router:
     image: node:22-slim
@@ -2904,16 +3258,19 @@ ${appEnvironmentBlock}${hasBrowser ? `${extraHostsBlock}\n` : ''}    volumes:
       - |
 ${indentBlock(docker9RouterEntrypointScript, 8)}
     environment:
-      - PORT=20128
+      - PORT=${routerPort}
       - HOSTNAME=0.0.0.0
       - CI=true
     volumes:
       - 9router-data:/root/.9router
+      - ./sync.js:/tmp/sync.js:ro
+      - ./patch-9router.js:/tmp/patch-9router.js:ro
     ports:
-      - "20128:20128"
+      - "${routerPort}:${routerPort}"
 
 volumes:
-  9router-data:`;
+  9router-data:
+  openclaw-plugins:`;
     } else if (isLocal) {
       const ollamaModelTag = String(selectedModel || 'ollama/gemma4:e2b').replace('ollama/', '');
       compose = `name: ${singleComposeName}
@@ -2922,12 +3279,12 @@ services:
     build: .
     container_name: ${singleAppContainerName}
     restart: always
-    env_file: .env
+    env_file: ../../.env
 ${appEnvironmentBlock}    depends_on:
       ollama:
         condition: service_healthy
-${hasBrowser ? `${extraHostsBlock}\n` : ''}    ports:
-      - "18791:18791"
+${extraHostsBlock}\n    ports:
+      - "${gatewayPort}:${gatewayPort}"
     volumes:
       - ${volumeMount}
 
@@ -2965,17 +3322,19 @@ services:
     container_name: ${singleAppContainerName}
     restart: always
     env_file:
-      - .env
+      - ../../.env
 ${appEnvironmentBlock}${plainSingleExtraHosts ? `${extraHostsBlock}\n` : ''}    volumes:
       - ${volumeMount}
     ports:
-      - "18791:18791"`;
+      - "${gatewayPort}:${gatewayPort}"`;
     }
 
     return {
       dockerfile,
       compose,
+      entrypointScript: runtimeScript,
       syncScript,
+      patchScript,
       docker9RouterEntrypointScript,
       gatewayPatchCmd: buildGatewayPatchCmd(),
     };
@@ -2996,7 +3355,9 @@ if (typeof exports !== 'undefined' && typeof globalThis !== 'undefined' && globa
   Object.assign(exports, globalThis.__openclawDockerGen);
 }
 
-  // ── buildNativeScriptCtx and shared native runtime helpers (setup/generators/native-helpers-gen.js) 
+
+
+  // ── buildNativeScriptCtx and shared native runtime helpers (setup/generators/native-helpers-gen.js) 
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -3017,10 +3378,9 @@ function buildNativeScriptCtx(options) {
   const ch = CHANNELS[state.channel];
   const is9Router = !!(provider && provider.isProxy);
   const isOllama = !!(provider && provider.isLocal);
-  const hasBrowser = state.config.skills.includes('browser');
   const nativeSkillConfigs = state.config.skills
     .map((sid) => SKILLS.find((s) => s.id === sid))
-    .filter((skill) => skill && skill.id !== 'scheduler' && skill.slug && skill.slug !== 'browser-automation');
+    .filter((skill) => skill && skill.id !== 'scheduler' && skill.slug);
   const selectedModel = (state.config.model || 'ollama/gemma4:e2b').replace('ollama/', '');
   const isMultiBot = state.botCount > 1 && state.channel === 'telegram';
   const projectDir = state.config.projectPath || '.';
@@ -3040,7 +3400,6 @@ function buildNativeScriptCtx(options) {
   Object.assign(globalThis, {
     isVi,
     provider,
-    hasBrowser,
     is9Router,
     selectedModel,
     isMultiBot,
@@ -3048,15 +3407,101 @@ function buildNativeScriptCtx(options) {
   });
 
   function native9RouterSyncScriptContent() {
-    return `const fs=require('fs');
-const path=require('path');
-const INTERVAL=30000;
-const p=path.join(process.env.DATA_DIR||'.9router','db.json');
-const ROUTER='${globalThis.__openclawCommon.NINE_ROUTER_API_BASE_URL}';
-const PM=${JSON.stringify(SMART_ROUTE_PROVIDER_MODELS)};
-const PREF=${JSON.stringify(SMART_ROUTE_PROVIDER_ORDER)};
-console.log('[sync-combo] 9Router sync loop started...');
-const sync=async()=>{try{const res=await fetch(ROUTER+'/api/providers');if(!res.ok){console.log('[sync-combo] API not ready, retrying...');return;}const d=await res.json();const rawConnections=Array.isArray(d.connections)?d.connections:Array.isArray(d.providerConnections)?d.providerConnections:[];const a=[...new Set(rawConnections.filter(c=>c&&c.provider&&c.isActive!==false&&!c.disabled).map(c=>c.provider))];let db={};try{db=JSON.parse(fs.readFileSync(p,'utf8'));}catch{}if(!db.combos)db.combos=[];const removeSmartRoute=()=>{const next=db.combos.filter(x=>x.id!=='smart-route');if(next.length!==db.combos.length){db.combos=next;fs.writeFileSync(p,JSON.stringify(db,null,2));console.log('[sync-combo] Removed smart-route (no active providers)');}};if(!a.length){removeSmartRoute();return;}a.sort((x,y)=>(PREF.indexOf(x)===-1?99:PREF.indexOf(x))-(PREF.indexOf(y)===-1?99:PREF.indexOf(y)));const m=a.flatMap(provider=>PM[provider]||[]);if(!m.length){removeSmartRoute();return;}const c={id:'smart-route',name:'smart-route',alias:'smart-route',models:m};const i=db.combos.findIndex(x=>x.id==='smart-route');if(i>=0){if(JSON.stringify(db.combos[i].models)!==JSON.stringify(c.models)){db.combos[i]=c;fs.writeFileSync(p,JSON.stringify(db,null,2));console.log('[sync-combo] Updated smart-route: '+c.models.length+' models from: '+a.join(','));}}else{db.combos.push(c);fs.writeFileSync(p,JSON.stringify(db,null,2));console.log('[sync-combo] Created smart-route: '+c.models.length+' models from: '+a.join(','));}}catch(e){console.log('[sync-combo] Error:',e.message);}};setTimeout(sync,5000);setInterval(sync,INTERVAL);`;
+    return `const fs = require('fs');
+const path = require('path');
+const INTERVAL = 30000;
+const DB_PATH = path.join(process.env.DATA_DIR || '.9router', 'db', 'data.sqlite');
+const PORT = process.env.PORT || 20128;
+const COMBO_NAME = 'smart-route';
+const API_BASE = \\\`http://localhost:\\\${PORT}\\\`;
+
+function ensureSettings() {
+  try {
+    let Database;
+    try {
+      const cp = require('child_process');
+      const npmRoot = cp.execSync('npm root -g').toString().trim();
+      Database = require(path.join(npmRoot, '9router', 'node_modules', 'better-sqlite3'));
+    } catch {
+      try { Database = require('better-sqlite3'); } catch { return; }
+    }
+    const db = Database(DB_PATH);
+    const existing = db.prepare("SELECT * FROM settings WHERE id = 1").get();
+    if (!existing) {
+      db.prepare("INSERT INTO settings (id, data) VALUES (1, ?)").run(JSON.stringify({ requireLogin: false }));
+    } else {
+      try {
+        const data = JSON.parse(existing.data || '{}');
+        if (data.requireLogin !== false) {
+          data.requireLogin = false;
+          db.prepare("UPDATE settings SET data = ? WHERE id = 1").run(JSON.stringify(data));
+        }
+      } catch {}
+    }
+    db.close();
+  } catch (e) {}
+}
+
+const sync = async () => {
+  try {
+    if (!fs.existsSync(DB_PATH)) return;
+
+    let existingCombo = null;
+    try {
+      const resp = await fetch(\\\`\\\${API_BASE}/api/combos\\\`);
+      if (resp.status === 401) {
+        ensureSettings();
+        return;
+      }
+      const data = await resp.json();
+      if (data.combos) {
+        existingCombo = data.combos.find(c => c.name === COMBO_NAME);
+      }
+    } catch (e) { return; }
+
+    if (existingCombo) return;
+
+    let activeProviders = [];
+    try {
+      const resp = await fetch(\\\`\\\${API_BASE}/api/providers\\\`);
+      const data = await resp.json();
+      const conns = data.connections || data.providerConnections || [];
+      activeProviders = [...new Set(
+        conns.filter(c => c && c.provider && c.isActive !== false && !c.disabled).map(c => c.provider)
+      )];
+    } catch (e) { return; }
+
+    if (!activeProviders.length) return;
+
+    let models = [];
+    try {
+      const resp = await fetch(\\\`\\\${API_BASE}/api/models\\\`);
+      const data = await resp.json();
+      if (data.models && Array.isArray(data.models)) {
+        models = data.models
+          .filter(m => activeProviders.includes(m.provider))
+          .filter(m => !/(embedding|image|tts|stt|audio|vision)/i.test(m.model))
+          .map(m => m.fullModel);
+      }
+      models = [...new Set(models)];
+    } catch (e) { return; }
+
+    if (!models.length) return;
+
+    try {
+      await fetch(\\\`\\\${API_BASE}/api/combos\\\`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ name: COMBO_NAME, models })
+      });
+      console.log('[sync-combo] Created smart-route with ' + models.length + ' models');
+    } catch (e) {}
+  } catch (e) {}
+};
+
+if (fs.existsSync(DB_PATH)) ensureSettings();
+setTimeout(sync, 10000);
+setInterval(sync, INTERVAL);`;
   }
 
   function native9RouterServerEntryLookup() {
@@ -3202,12 +3647,16 @@ const sync=async()=>{try{const res=await fetch(ROUTER+'/api/providers');if(!res.
         list: multiBotAgentMetas.map((meta) => ({
           id: meta.agentId,
           name: meta.name,
-          workspace: '.openclaw/' + meta.workspaceDir,
-          agentDir: `agents/${meta.agentId}/agent`,
           model: { primary: state.config.model, fallbacks: [] },
         })),
       },
-      commands: { native: 'auto', nativeSkills: 'auto', restart: true, ownerDisplay: 'raw' },
+      commands: {
+        native: 'auto',
+        nativeSkills: 'auto',
+        restart: true,
+        ownerDisplay: 'raw',
+        ...(state.config.skills.includes('scheduler') ? { ownerAllowFrom: ['*'] } : {}),
+      },
       bindings: multiBotAgentMetas.map((meta) => ({
         agentId: meta.agentId,
         match: { channel: 'telegram', accountId: meta.accountId },
@@ -3234,6 +3683,7 @@ const sync=async()=>{try{const res=await fetch(ROUTER+'/api/providers');if(!res.
       },
       tools: {
         profile: 'full',
+        ...(state.config.skills.includes('scheduler') ? { alsoAllow: ['group:automation'] } : {}),
         exec: { host: 'gateway', security: 'full', ask: 'off' },
         agentToAgent: {
           enabled: true,
@@ -3254,12 +3704,11 @@ const sync=async()=>{try{const res=await fetch(ROUTER+'/api/providers');if(!res.
         }
       } : {}),
       gateway: {
-        port: 18791,
+        port: 18789,
         mode: 'local',
-        bind: state.nativeOs === 'vps' ? 'custom' : 'loopback',
-        ...(state.nativeOs === 'vps' ? { customBindHost: '0.0.0.0' } : {}),
+        bind: state.nativeOs === 'vps' ? 'lan' : 'loopback',
         controlUi: {
-          allowedOrigins: getGatewayAllowedOrigins(18791),
+          allowedOrigins: getGatewayAllowedOrigins(18789),
         },
         auth: { mode: 'token', token: crypto.randomUUID().replace(/-/g, '') },
       },
@@ -3304,7 +3753,6 @@ const sync=async()=>{try{const res=await fetch(ROUTER+'/api/providers');if(!res.
     provider,
     is9Router,
     isOllama,
-    hasBrowser,
     selectedModel,
     isMultiBot,
     projectDir,
@@ -3324,7 +3772,7 @@ const sync=async()=>{try{const res=await fetch(ROUTER+'/api/providers');if(!res.
   };
 }
 
-  // ── botEnvContent, botConfigContent, botWorkspaceFiles, botFiles, helpers (setup/generators/config-gen.js) 
+  // ── botEnvContent, botConfigContent, botWorkspaceFiles, botFiles, helpers (setup/generators/config-gen.js) 
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -3340,7 +3788,6 @@ const sync=async()=>{try{const res=await fetch(ROUTER+'/api/providers');if(!res.
  * @global {boolean} isVi        - Vietnamese language mode
  * @global {object}  provider    - Current primary provider config
  * @global {boolean} isMultiBot  - Multi-bot mode flag
- * @global {boolean} hasBrowser  - Browser plugin selected
  * @global {boolean} is9Router   - 9Router proxy mode
  * @global {string}  projectDir  - Output project directory path
  * @global {Function} getGatewayAllowedOrigins
@@ -3381,12 +3828,12 @@ const sync=async()=>{try{const res=await fetch(ROUTER+'/api/providers');if(!res.
       const bot = state.bots[botIndex] || {};
       const botName = bot.name || `Bot ${botIndex + 1}`;
       const agentId = botName.toLowerCase().replace(/[^a-z0-9]+/g, '-');
-      const basePort = 18791 + botIndex;
+      const basePort = 18789 + botIndex;
       const groupId = state.groupId || '';
 
       // Force use global provider if proxy mode is chosen globally, else use bot specific provider
       const botProvider = (provider && provider.isProxy) ? provider : (PROVIDERS[bot.provider] || provider);
-      const actualModel = botProvider.isProxy ? provider.models[0].id : (bot.model || state.config.model);
+      const actualModel = botProvider.isProxy ? 'smart-route' : (bot.model || state.config.model);
       const bcfg = globalThis.__openclawBotConfig;
 
       const cfg = bcfg.buildOpenclawJson({
@@ -3405,8 +3852,8 @@ const sync=async()=>{try{const res=await fetch(ROUTER+'/api/providers');if(!res.
         groupId,
         selectedSkills: state.config.skills,
         skills: SKILLS,
-        hasBrowserDesktop: hasBrowser && state.browserMode === 'desktop',
-        hasBrowserServer: hasBrowser && state.browserMode !== 'desktop',
+        hasBrowserDesktop: false,
+        hasBrowserServer: false,
         gatewayPort: basePort,
         gatewayAllowedOrigins: getGatewayAllowedOrigins(basePort),
         osChoice: state.nativeOs || '',
@@ -3476,7 +3923,7 @@ const sync=async()=>{try{const res=await fetch(ROUTER+'/api/providers');if(!res.
         agentWorkspaceDir,
         persona: bot.persona || '',
         userInfo: state.config.userInfo || '',
-        hasBrowser,
+        hasBrowser: false,
         soulVariant: 'wizard',
         memoryVariant: 'wizard',
         hasZaloMod: state.channel === 'zalo-personal',
@@ -3554,7 +4001,7 @@ const sync=async()=>{try{const res=await fetch(ROUTER+'/api/providers');if(!res.
       }));
     }
 
-  // ── generateZaloLoginBat, generateZaloLoginSh (unified) (setup/generators/zalo-login-gen.js) 
+  // ── generateZaloLoginBat, generateZaloLoginSh (unified) (setup/generators/zalo-login-gen.js) 
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -3591,15 +4038,13 @@ const sync=async()=>{try{const res=await fetch(ROUTER+'/api/providers');if(!res.
  * @param {string} opts.projectDirVar  - BAT var for project dir    e.g. '%PROJECT_DIR%'
  * @param {string} opts.label          - Unique BAT label suffix (avoid duplicate labels)
  *                                       e.g. 'win', 'multi', 'combo'
- * @param {boolean} [opts.useInstance] - Use --instance default flag (for multi-bot flows)
+ * @param {boolean} [opts.useInstance] - Reserved for QR file suffix only.
  * @returns {string[]} Lines to push into the bat script
  */
 function generateZaloLoginBat(opts) {
   const { homeVar, projectDirVar, label = 'default', useInstance = false } = opts;
   const credPath = `${homeVar}\\credentials\\zalouser\\credentials.json`;
-  const loginCmd = useInstance
-    ? 'openclaw channels login --channel zalouser --instance default --verbose'
-    : 'openclaw channels login --channel zalouser --verbose';
+  const loginCmd = 'openclaw channels login --channel zalouser --verbose';
   const contLabel = `:zalo_continue_${label}`;
   const retryLabel = `:retry_zalo_${label}`;
 
@@ -3639,15 +4084,13 @@ function generateZaloLoginBat(opts) {
  * @param {object} opts
  * @param {string} opts.homeVar       - Shell var for OPENCLAW_HOME  e.g. '$OPENCLAW_HOME'
  * @param {string} opts.projectDirVar - Shell var for project dir    e.g. '$PROJECT_DIR'
- * @param {boolean} [opts.useInstance] - Use --instance default flag
+ * @param {boolean} [opts.useInstance] - Reserved for QR file suffix only.
  * @returns {string[]} Lines to push into the sh script
  */
 function generateZaloLoginSh(opts) {
   const { homeVar, projectDirVar, useInstance = false } = opts;
   const credPath = `${homeVar}/credentials/zalouser/credentials.json`;
-  const loginCmd = useInstance
-    ? 'openclaw channels login --channel zalouser --instance default --verbose'
-    : 'openclaw channels login --channel zalouser --verbose';
+  const loginCmd = 'openclaw channels login --channel zalouser --verbose';
 
   return [
     `# ── Zalo Personal Login (idempotent) ─────────────────────────────────`,
@@ -3671,7 +4114,7 @@ function generateZaloLoginSh(opts) {
   ];
 }
 
-  // ── generateStartScript wizard wrapper (delegates to install-gen) (setup/generators/gateway-start-gen.js) 
+  // ── generateStartScript wizard wrapper (delegates to install-gen) (setup/generators/gateway-start-gen.js) 
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -3718,7 +4161,7 @@ function generateStartScript() {
   return null;
 }
 
-  // ── generateUninstallScript, setup script download helpers (setup/generators/download-gen.js) 
+  // ── generateUninstallScript, setup script download helpers (setup/generators/download-gen.js) 
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -3975,7 +4418,7 @@ window.__downloadGen = {
   updateDockerDlLabel,
 };
 
-  // ── Windows .bat — if (state.nativeOs === "win") block (setup/os/win-bat.js) 
+  // ── Windows .bat — if (state.nativeOs === "win") block (setup/os/win-bat.js) 
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -3985,7 +4428,7 @@ window.__downloadGen = {
  */
 function generateWinBat(ctx) {
   const {
-    ch, isVi, provider, is9Router, isOllama, hasBrowser, selectedModel, isMultiBot, projectDir, todayStamp, allPlugins, pluginCmd, nativeSkillInstallCmds, nativeSkillConfigs, providerLines, sharedNativeFileMap, sharedNativeEnvContent, sharedNativeExecApprovalsContent, sharedNativeConfigContent, native9RouterSyncScriptContent, native9RouterServerEntryLookup, windowsHiddenNodeLaunch, generateUninstallScript,
+    ch, isVi, provider, is9Router, isOllama, selectedModel, isMultiBot, projectDir, todayStamp, allPlugins, pluginCmd, nativeSkillInstallCmds, nativeSkillConfigs, providerLines, sharedNativeFileMap, sharedNativeEnvContent, sharedNativeExecApprovalsContent, sharedNativeConfigContent, native9RouterSyncScriptContent, native9RouterServerEntryLookup, windowsHiddenNodeLaunch, generateUninstallScript,
   } = ctx;
   // state, PROVIDERS, SKILLS, PLUGINS, CHANNELS are IIFE-level globals
   let scriptContent;
@@ -4027,8 +4470,8 @@ function generateWinBat(ctx) {
 
   function appendDashboardInfo(arr) {
     arr.push('echo.');
-    arr.push('echo OpenClaw Dashboard: http://127.0.0.1:18791');
-    arr.push('echo Other reachable URLs: http://localhost:18791');
+    arr.push('echo OpenClaw Dashboard: http://127.0.0.1:18789');
+    arr.push('echo Other reachable URLs: http://localhost:18789');
     arr.push('echo If the dashboard asks for a Gateway Token, run: openclaw dashboard');
     if (is9Router) {
       arr.push('echo.');
@@ -4038,11 +4481,6 @@ function generateWinBat(ctx) {
   }
 
   providerLines(lines, 'bat');
-  if (hasBrowser) {
-    lines.push('echo Cai Browser Automation runtime...');
-    lines.push('call npm install -g agent-browser playwright || goto :fail');
-    lines.push('call npx playwright install chromium || goto :fail');
-  }
   if (nativeSkillInstallCmds.length > 0) {
     lines.push('echo Cai skills...');
     lines.push(...nativeSkillInstallCmds);
@@ -4120,7 +4558,7 @@ function generateWinBat(ctx) {
   return { scriptName, scriptContent };
 }
 
-  // ── macOS .sh — if (state.nativeOs === "macos") block (setup/os/macos-sh.js) 
+  // ── macOS .sh — if (state.nativeOs === "macos") block (setup/os/macos-sh.js) 
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -4130,7 +4568,7 @@ function generateWinBat(ctx) {
  */
 function generateMacOsSh(ctx) {
   const {
-    ch, isVi, provider, is9Router, isOllama, hasBrowser, selectedModel, isMultiBot, projectDir, todayStamp, allPlugins, pluginCmd, nativeSkillInstallCmds, nativeSkillConfigs, providerLines, sharedNativeFileMap, sharedNativeEnvContent, sharedNativeExecApprovalsContent, sharedNativeConfigContent, native9RouterSyncScriptContent, native9RouterServerEntryLookup, windowsHiddenNodeLaunch, generateUninstallScript,
+    ch, isVi, provider, is9Router, isOllama, selectedModel, isMultiBot, projectDir, todayStamp, allPlugins, pluginCmd, nativeSkillInstallCmds, nativeSkillConfigs, providerLines, sharedNativeFileMap, sharedNativeEnvContent, sharedNativeExecApprovalsContent, sharedNativeConfigContent, native9RouterSyncScriptContent, native9RouterServerEntryLookup, windowsHiddenNodeLaunch, generateUninstallScript,
   } = ctx;
   // state, PROVIDERS, SKILLS, PLUGINS, CHANNELS are IIFE-level globals
   let scriptContent;
@@ -4238,7 +4676,7 @@ function generateMacOsSh(ctx) {
   return { scriptName, scriptContent };
 }
 
-  // ── VPS/PM2 .sh — if (state.nativeOs === "vps") block (setup/os/vps-sh.js) 
+  // ── VPS/PM2 .sh — if (state.nativeOs === "vps") block (setup/os/vps-sh.js) 
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -4248,7 +4686,7 @@ function generateMacOsSh(ctx) {
  */
 function generateVpsSh(ctx) {
   const {
-    ch, isVi, provider, is9Router, isOllama, hasBrowser, selectedModel, isMultiBot, projectDir, todayStamp, allPlugins, pluginCmd, nativeSkillInstallCmds, nativeSkillConfigs, providerLines, sharedNativeFileMap, sharedNativeEnvContent, sharedNativeExecApprovalsContent, sharedNativeConfigContent, native9RouterSyncScriptContent, native9RouterServerEntryLookup, windowsHiddenNodeLaunch, generateUninstallScript,
+    ch, isVi, provider, is9Router, isOllama, selectedModel, isMultiBot, projectDir, todayStamp, allPlugins, pluginCmd, nativeSkillInstallCmds, nativeSkillConfigs, providerLines, sharedNativeFileMap, sharedNativeEnvContent, sharedNativeExecApprovalsContent, sharedNativeConfigContent, native9RouterSyncScriptContent, native9RouterServerEntryLookup, windowsHiddenNodeLaunch, generateUninstallScript,
   } = ctx;
   // state, PROVIDERS, SKILLS, PLUGINS, CHANNELS are IIFE-level globals
   let scriptContent;
@@ -4352,7 +4790,7 @@ GWEOF`);
   }
 
   vps.push('echo ""');
-  vps.push('echo "Dashboard: http://127.0.0.1:18791"');
+  vps.push('echo "Dashboard: http://127.0.0.1:18789"');
   if (is9Router) vps.push('echo "9Router:   http://127.0.0.1:20128/dashboard"');
   vps.push('echo ""');
   vps.push(`echo "Restart:   bash start-bot.sh"`);
@@ -4363,7 +4801,7 @@ GWEOF`);
   return { scriptName, scriptContent };
 }
 
-  // ── Linux Desktop .sh — if (state.nativeOs === "linux-desktop") block (setup/os/linux-sh.js) 
+  // ── Linux Desktop .sh — if (state.nativeOs === "linux-desktop") block (setup/os/linux-sh.js) 
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -4373,7 +4811,7 @@ GWEOF`);
  */
 function generateLinuxSh(ctx) {
   const {
-    ch, isVi, provider, is9Router, isOllama, hasBrowser, selectedModel, isMultiBot, projectDir, todayStamp, allPlugins, pluginCmd, nativeSkillInstallCmds, nativeSkillConfigs, providerLines, sharedNativeFileMap, sharedNativeEnvContent, sharedNativeExecApprovalsContent, sharedNativeConfigContent, native9RouterSyncScriptContent, native9RouterServerEntryLookup, windowsHiddenNodeLaunch, generateUninstallScript,
+    ch, isVi, provider, is9Router, isOllama, selectedModel, isMultiBot, projectDir, todayStamp, allPlugins, pluginCmd, nativeSkillInstallCmds, nativeSkillConfigs, providerLines, sharedNativeFileMap, sharedNativeEnvContent, sharedNativeExecApprovalsContent, sharedNativeConfigContent, native9RouterSyncScriptContent, native9RouterServerEntryLookup, windowsHiddenNodeLaunch, generateUninstallScript,
   } = ctx;
   // state, PROVIDERS, SKILLS, PLUGINS, CHANNELS are IIFE-level globals
   let scriptContent;
@@ -4426,7 +4864,7 @@ function generateLinuxSh(ctx) {
   return { scriptName, scriptContent };
 }
 
-  // ── UI init, language/channel/deploy controllers, form rendering (setup/ui/controller.js) 
+  // ── UI init, language/channel/deploy controllers, form rendering (setup/ui/controller.js) 
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -5075,7 +5513,7 @@ function generateLinuxSh(ctx) {
     envContent.textContent = lines.join('\n');
   }
 
-  // ── Multi-bot state + UI (setup/ui/multi-bot.js) ───────────────────
+  // ── Multi-bot state + UI (setup/ui/multi-bot.js) ───────────────────
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -5424,7 +5862,7 @@ function generateLinuxSh(ctx) {
 
   // ========== Step 1: Deploy Mode + OS ==========
 
-  // ── Step navigation, validation (setup/ui/steps.js) ────────────────
+  // ── Step navigation, validation (setup/ui/steps.js) ────────────────
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -5584,7 +6022,7 @@ function generateLinuxSh(ctx) {
 
   // ========== Step 2: Bot Config ==========
 
-  // ── generateOutput + generateNativeScript + clipboard (setup/ui/output.js) 
+  // ── generateOutput + generateNativeScript + clipboard (setup/ui/output.js) 
 // @ts-nocheck
 /* eslint-disable no-undef, no-unused-vars */
 /**
@@ -5628,68 +6066,6 @@ function generateLinuxSh(ctx) {
     const routerNotice = document.getElementById('9router-notice');
     if (routerNotice) routerNotice.style.display = is9Router ? '' : 'none';
 
-    // Show/hide Browser Automation notice + generate scripts
-    const browserNotice = document.getElementById('browser-notice');
-    const hasBrowserSkill = state.config.skills.includes('browser');
-    if (browserNotice) browserNotice.style.display = hasBrowserSkill ? '' : 'none';
-
-    if (hasBrowserSkill) {
-      // Chrome Debug .bat script
-      const chromeBat = `@echo off
-echo ============================================
-echo   OpenClaw - Chrome Debug Mode
-echo ============================================
-echo.
-echo Dang tat Chrome cu (neu co)...
-taskkill /F /IM chrome.exe >nul 2>&1
-timeout /t 3 /nobreak >nul
-echo Dang mo Chrome voi Debug Mode...
-start "" "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" ^
-  --remote-debugging-port=9222 ^
-  --remote-allow-origins=* ^
-  --user-data-dir="%TEMP%\\chrome-debug"
-timeout /t 4 /nobreak >nul
-powershell -Command "try { Invoke-WebRequest -Uri 'http://localhost:9222/json/version' -UseBasicParsing -TimeoutSec 5 | Out-Null; Write-Host 'OK! Chrome Debug Mode dang chay tren port 9222.' -ForegroundColor Green } catch { Write-Host 'LOI: Port 9222 chua mo. Thu lai.' -ForegroundColor Red }"
-echo.
-pause`;
-      setOutput('out-chrome-bat', chromeBat);
-
-      // Task Scheduler PowerShell script
-      const taskPs1 = `# ============================================
-# OpenClaw - Auto-start Chrome Debug khi logon
-# Chay script nay 1 lan voi Run as Administrator
-# ============================================
-
-# Duong dan toi file .bat
-$batPath = "$env:USERPROFILE\\start-chrome-debug.bat"
-
-# Kiem tra file .bat ton tai
-if (-not (Test-Path $batPath)) {
-  Write-Host "LOI: Khong tim thay $batPath" -ForegroundColor Red
-  Write-Host "Hay luu file start-chrome-debug.bat vao $env:USERPROFILE truoc." -ForegroundColor Yellow
-  exit 1
-}
-
-# Tao Scheduled Task
-$action   = New-ScheduledTaskAction -Execute $batPath
-$trigger  = New-ScheduledTaskTrigger -AtLogOn
-$trigger.Delay = "PT10S"   # Delay 10 giay sau khi logon
-$settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable
-
-Register-ScheduledTask \\
-  -TaskName "OpenClaw-ChromeDebug" \\
-  -Description "Tu dong bat Chrome Debug Mode cho OpenClaw Browser Automation" \\
-  -Action $action \\
-  -Trigger $trigger \\
-  -Settings $settings \\
-  -Force
-
-Write-Host ""
-Write-Host "DONE! Task 'OpenClaw-ChromeDebug' da duoc tao." -ForegroundColor Green
-Write-Host "Chrome se tu dong bat Debug Mode moi khi ban dang nhap Windows (delay 10s)." -ForegroundColor Cyan`;
-      setOutput('out-task-ps1', taskPs1);
-    }
-
     // Show/hide docker vs native output based on deployMode
     const dockerOut = document.getElementById('docker-output');
     const nativeOut = document.getElementById('native-output');
@@ -5718,8 +6094,6 @@ Write-Host "Chrome se tu dong bat Debug Mode moi khi ban dang nhap Windows (dela
       : 'Script is generated from your choices. Download and run — everything else is handled automatically.';
 
     const agentId = state.config.botName.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/-$/, '') || 'chat';
-
-    const hasBrowser = state.config.skills.includes('browser');
     // isMultiBot => unified into isMultiBot above
     const multiBotAgentMetas = isMultiBot
       ? state.bots.slice(0, state.botCount).map((bot, idx) => {
@@ -5751,15 +6125,26 @@ Write-Host "Chrome se tu dong bat Debug Mode moi khi ban dang nhap Windows (dela
         },
         list: [{
           id: agentId,
-          workspace: `.openclaw/workspace-${agentId}`,
+          name: botName,
+          workspace: `/root/project/.openclaw/workspace-${agentId}`,
           agentDir: `agents/${agentId}/agent`,
           model: { primary: state.config.model, fallbacks: [] },
         }],
       },
-      commands: { native: 'auto', nativeSkills: 'auto', restart: true, ownerDisplay: 'raw' },
+      commands: {
+        native: 'auto',
+        nativeSkills: 'auto',
+        restart: true,
+        ownerDisplay: 'raw',
+        ...(state.config.skills.includes('scheduler') ? { ownerAllowFrom: ['*'] } : {}),
+      },
       channels: ch.channelConfig,
-      tools: { profile: 'full', exec: { host: 'gateway', security: 'full', ask: 'off' } },
-      gateway: common.buildGatewayConfig(18791, 'native', getGatewayAllowedOrigins(18791)),
+      tools: {
+        profile: 'full',
+        ...(state.config.skills.includes('scheduler') ? { alsoAllow: ['group:automation'] } : {}),
+        exec: { host: 'gateway', security: 'full', ask: 'off' },
+      },
+      gateway: common.buildGatewayConfig(18789, state.deployMode, getGatewayAllowedOrigins(18789), state.nativeOs || ''),
     };
 
     // 9Router: add proxy endpoint config under models.providers
@@ -5797,19 +6182,6 @@ Write-Host "Chrome se tu dong bat Debug Mode moi khi ban dang nhap Windows (dela
       };
     }
 
-    // Browser Automation: inject browser config
-    if (hasBrowser) {
-      clawConfig.browser = {
-        enabled: true,
-        defaultProfile: 'host-chrome',
-        profiles: {
-          'host-chrome': {
-            cdpUrl: 'http://127.0.0.1:9222',
-            color: '#4285F4',
-          },
-        },
-      };
-    }
 
     // Skills: register all selected skills in openclaw.json → skills.entries
     // This makes OpenClaw actually load and enable them at runtime
@@ -5818,8 +6190,6 @@ Write-Host "Chrome se tu dong bat Debug Mode moi khi ban dang nhap Windows (dela
       state.config.skills.forEach((sid) => {
         const skill = SKILLS.find((s) => s.id === sid);
         if (!skill) return;
-        // Native browser tools are loaded automatically via the root 'browser' config
-        if (skill.slug === 'browser-automation') return;
         // scheduler is now native cron (not a skill), skip registering in skills.entries
         if (skill.id === 'scheduler' || !skill.slug) return;
         
@@ -5849,7 +6219,7 @@ Write-Host "Chrome se tu dong bat Debug Mode moi khi ban dang nhap Windows (dela
       clawConfig.agents.list = multiBotAgentMetas.map((meta) => ({
         id: meta.agentId,
         name: meta.name,
-        workspace: '.openclaw/' + meta.workspaceDir,
+        workspace: `/root/project/.openclaw/${meta.workspaceDir}`,
         agentDir: `agents/${meta.agentId}/agent`,
         model: { primary: state.config.model, fallbacks: [] },
       }));
@@ -5880,6 +6250,7 @@ Write-Host "Chrome se tu dong bat Debug Mode moi khi ban dang nhap Windows (dela
       };
       clawConfig.tools = {
         ...(clawConfig.tools || {}),
+        ...(state.config.skills.includes('scheduler') ? { alsoAllow: ['group:automation'] } : {}),
         agentToAgent: {
           enabled: true,
           allow: multiBotAgentMetas.map((meta) => meta.agentId),
@@ -5946,7 +6317,7 @@ model:
     const allSkills = [];
     state.config.skills.forEach((sid) => {
       const skill = SKILLS.find((s) => s.id === sid);
-      if (skill && skill.slug && skill.slug !== 'browser-automation') {
+      if (skill && skill.slug) {
         allSkills.push(skill.slug);
       }
     });
@@ -5966,7 +6337,6 @@ model:
       is9Router,
       isLocal,
       isMultiBot: state.botCount > 1 && (state.channel === 'telegram'),
-      hasBrowser,
       selectedModel: state.config.model || 'ollama/gemma4:e2b',
       agentId: 'bot',
       allSkills,
@@ -5974,6 +6344,9 @@ model:
       dockerfileSkillInstallMode: 'build',
       runtimeCommandParts: [
         pluginInstallCmd,
+        // zalouser: use npm install (not openclaw plugins install) to avoid openclaw.json writes
+        // ClawHub build gives error:not configured; npm version works correctly
+        state.channel === 'zalo-personal' ? 'ensure_zalouser' : '',
         'while true; do sleep 5; openclaw devices approve --latest 2>/dev/null || true; done >/dev/null 2>&1 &'
       ].filter(Boolean),
       plainSingleExtraHosts: true,
@@ -5983,6 +6356,7 @@ model:
     });
     const dockerfile = dockerArtifacts.dockerfile;
     const compose = dockerArtifacts.compose;
+    const entrypointScript = dockerArtifacts.entrypointScript;
     // isMultiBot => unified into isMultiBot above
     setOutput('out-dockerfile', dockerfile);
     setOutput('out-compose', compose);
@@ -6122,12 +6496,6 @@ _This file is yours to evolve. If someone asks to change it, confirm with the us
 `;
 
     // ── AGENTS.md — Hướng dẫn vận hành ("operating manual")
-    const browserAgentSection = hasBrowser ? `
-## Sử dụng Trình Duyệt (Browser Automation)
-- BẠN SỞ HỮU GIAO DIỆN TRÌNH DUYỆT CHROME THẬT CỦA USER thông qua script \`browser-tool.js\`. ĐỌC NGAY FILE \`BROWSER.md\` để biết cách dùng.
-- BẮT BUỘC dùng \`bash\` để gõ \`node ~/browser-tool.js ...\` khi có yêu cầu liên quan đến web thay vì dùng web_search!
-- KHÔNG BAO GIỜ từ chối mở trình duyệt với lý do "không có giao diện" hay "máy chủ không có browser".
-` : '';
 
     const agentsMd = lang === 'vi'
       ? `# Hướng dẫn vận hành
@@ -6155,7 +6523,6 @@ Bạn hỗ trợ người dùng trong mọi tác vụ hàng ngày thông qua tin
 - Luôn xác nhận kết quả tool trước khi trả lời user
 - Nếu tool lỗi → thông báo rõ ràng, đề xuất cách khác
 
-${browserAgentSection}
 ${state.config.securityRules}
 `
 
@@ -6239,143 +6606,6 @@ _Update this file as you learn more about the user. Ask before changing._
     // ── MEMORY.md — via scaffold builder
     const memoryMd = _scaffold.buildMemoryDoc({ isVi, variant: 'wizard' });
 
-    // Browser tool files (generated into workspace when hasBrowser)
-    const browserToolJs = `/**
- * browser-tool.js - Connect to real Windows Chrome via CDP
- * Flow: Docker -> socat (port 9222) -> host.docker.internal:9222 -> user's Chrome
- */
-const { chromium } = require('/usr/local/lib/node_modules/openclaw/node_modules/playwright-core');
-const action = process.argv[2];
-const param1 = process.argv[3];
-const param2 = process.argv[4];
-const CDP_URL = 'http://127.0.0.1:9222';
-(async () => {
-    let browser;
-    try {
-        browser = await chromium.connectOverCDP(CDP_URL, { timeout: 5000 });
-        const ctx = browser.contexts()[0];
-        const pages = ctx.pages();
-        let page = pages.length > 0 ? pages[0] : await ctx.newPage();
-        if (action === 'open') {
-            console.log('[Browser] Mo trang: ' + param1);
-            await page.goto(param1, { waitUntil: 'domcontentloaded', timeout: 30000 });
-            await page.waitForTimeout(1500);
-            console.log('[Browser] Da mo: ' + (await page.title()) + ' | ' + page.url());
-        } else if (action === 'get_text') {
-            const text = await page.evaluate(() => {
-                document.querySelectorAll('script,style,noscript,svg').forEach(e => e.remove());
-                return document.body.innerText.trim();
-            });
-            console.log(text.substring(0, 4000));
-        } else if (action === 'click') {
-            await page.locator(param1).first().click({ timeout: 5000 });
-            await page.waitForTimeout(600);
-            console.log('[Browser] Da click: ' + param1);
-        } else if (action === 'fill') {
-            await page.locator(param1).first().fill(param2, { timeout: 5000 });
-            console.log('[Browser] Da dien "' + param2 + '" vao: ' + param1);
-        } else if (action === 'press') {
-            await page.keyboard.press(param1);
-            await page.waitForTimeout(1000);
-            console.log('[Browser] Da nhan phim: ' + param1);
-        } else if (action === 'status') {
-            console.log('[Browser] Ket noi Chrome that! Tab: ' + (await page.title()) + ' | ' + page.url());
-        } else {
-            console.log('Lenh: open <url> | get_text | click <sel> | fill <sel> <text> | press <key> | status');
-        }
-    } catch(e) {
-        if (e.message.includes('ECONNREFUSED') || e.message.includes('Timeout')) {
-            console.error('[Browser] Ban chua bat Chrome Debug! Hay click dup vao start-chrome-debug.bat roi thu lai.');
-        } else {
-            console.error('[Browser] Loi:', e.message);
-        }
-    } finally {
-        if (browser) await browser.close();
-    }
-`;
-
-    const browserMd = `# Dieu Khien Trinh Duyet (Browser Automation)
-
-Bot dieu khien Chrome THAT tren man hinh Windows cua ban. Moi thao tac hien thi truc tiep!
-
-## Lenh su dung (chay qua bash)
-
-\\\`\\\`\\\`bash
-node ~/browser-tool.js status
-node ~/browser-tool.js open "https://google.com"
-node ~/browser-tool.js get_text
-node ~/browser-tool.js fill "input[name='q']" "tu khoa"
-node ~/browser-tool.js press "Enter"
-node ~/browser-tool.js click "#button"
-\\\`\\\`\\\`
-
-## QUY TAC BAT BUOC
-- KHONG BAO GIO tu choi mo trinh duyet.
-- Neu loi ECONNREFUSED: bao user bat lai start-chrome-debug.bat.
-- KHONG dung web_search khi user yeu cau browser.
-`;
-
-    const chromeBatContent = `@echo off
-echo ====== OpenClaw - Chrome Debug Mode ======
-echo.
-echo Dang tat Chrome cu (neu co)...
-taskkill /F /IM chrome.exe >nul 2>&1
-timeout /t 3 /nobreak >nul
-echo Dang mo Chrome voi Debug Mode...
-start "" "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" ^
-  --remote-debugging-port=9222 ^
-  --remote-allow-origins=* ^
-  --user-data-dir="%TEMP%\\chrome-debug"
-timeout /t 4 /nobreak >nul
-powershell -Command "try { Invoke-WebRequest -Uri 'http://localhost:9222/json/version' -UseBasicParsing -TimeoutSec 5 | Out-Null; Write-Host 'OK! Chrome Debug Mode dang chay.' -ForegroundColor Green } catch { Write-Host 'LOI: Port 9222 chua mo.' -ForegroundColor Red }"
-echo.
-pause
-`;
-
-    const chromeShContent = `#!/usr/bin/env bash
-# ====== OpenClaw - Chrome Debug Mode (Mac/Linux) ======
-set -e
-echo "====== OpenClaw - Chrome Debug Mode ======"
-echo ""
-
-# Detect Chrome path
-if [[ "$OSTYPE" == "darwin"* ]]; then
-  CHROME_BIN="/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
-  [ ! -f "$CHROME_BIN" ] && CHROME_BIN="/Applications/Chromium.app/Contents/MacOS/Chromium"
-  [ ! -f "$CHROME_BIN" ] && CHROME_BIN="/Applications/Google Chrome Canary.app/Contents/MacOS/Google Chrome Canary"
-else
-  CHROME_BIN="$(command -v google-chrome || command -v google-chrome-stable || command -v chromium-browser || command -v chromium || echo '')"
-fi
-[ -n "$CHROME_DEBUG_BIN" ] && CHROME_BIN="$CHROME_DEBUG_BIN"
-
-if [ -z "$CHROME_BIN" ] || { [ ! -f "$CHROME_BIN" ] && [ ! -x "$CHROME_BIN" ]; }; then
-  echo -e "\\033[31mERROR: Chrome/Chromium not found.\\033[0m"
-  echo "Install Chrome or: export CHROME_DEBUG_BIN=/path/to/chrome"
-  exit 1
-fi
-
-echo "Using: $CHROME_BIN"
-echo "Killing existing Chrome debug instances..."
-pkill -f -- "--remote-debugging-port=9222" 2>/dev/null || true
-sleep 2
-
-TMP_DIR="\${TMPDIR:-/tmp}/chrome-debug-openclaw"
-mkdir -p "$TMP_DIR"
-
-echo "Starting Chrome in Debug Mode (port 9222)..."
-"$CHROME_BIN" \\
-  --remote-debugging-port=9222 \\
-  --remote-allow-origins=* \\
-  --user-data-dir="$TMP_DIR" &
-
-sleep 4
-if curl -s http://localhost:9222/json/version > /dev/null 2>&1; then
-  echo -e "\\033[32mOK! Chrome Debug Mode is running on port 9222.\\033[0m"
-else
-  echo -e "\\033[31mERROR: Port 9222 not responding.\\033[0m"
-  exit 1
-fi
-`;
 
     const envText = (document.getElementById('env-content')?.textContent || '').trim();
     const rootEnvContent = envText ? `${envText}\n` : '';
@@ -6396,6 +6626,7 @@ fi
       if (!isNativeMode) {
         sharedFiles['docker/openclaw/Dockerfile'] = dockerfile;
         sharedFiles['docker/openclaw/docker-compose.yml'] = compose;
+        sharedFiles['docker/openclaw/entrypoint.sh'] = entrypointScript;
         sharedFiles['docker/openclaw/.env'] = rootEnvContent;
       }
       sharedFiles[globalThis.__openclawCommon.TELEGRAM_SETUP_GUIDE_FILENAME] = buildTelegramPostInstallChecklist();
@@ -6429,10 +6660,6 @@ fi
         });
         sharedFiles[`.openclaw/${meta.workspaceDir}/TEAMS.md`] = _scaffold.buildTeamsDoc({ isVi });
         sharedFiles[`.openclaw/${meta.workspaceDir}/MEMORY.md`] = memoryMd;
-        if (hasBrowser) {
-          sharedFiles[`.openclaw/${meta.workspaceDir}/browser-tool.js`] = browserToolJs;
-          sharedFiles[`.openclaw/${meta.workspaceDir}/BROWSER.md`] = browserMd;
-        }
       }
       state._generatedFiles = sharedFiles;
     } else {
@@ -6452,10 +6679,6 @@ fi
         }),
         [`.openclaw/workspace-${agentId}/MEMORY.md`]: memoryMd,
         '.gitignore': isNativeMode ? '.env\nnode_modules/' : '.env\ndocker/openclaw/.env\nnode_modules/',
-        ...(hasBrowser ? {
-          [`.openclaw/workspace-${agentId}/browser-tool.js`]: browserToolJs,
-          [`.openclaw/workspace-${agentId}/BROWSER.md`]: browserMd,
-        } : {}),
       };
       if (rootEnvContent) {
         singleFiles['.env'] = rootEnvContent;
@@ -6467,6 +6690,7 @@ fi
       if (!isNativeMode) {
         singleFiles['docker/openclaw/Dockerfile'] = dockerfile;
         singleFiles['docker/openclaw/docker-compose.yml'] = compose;
+        singleFiles['docker/openclaw/entrypoint.sh'] = entrypointScript;
         singleFiles['docker/openclaw/.env'] = rootEnvContent;
       }
       state._generatedFiles = singleFiles;
@@ -6476,8 +6700,6 @@ fi
     // chrome-debug, start-bot, uninstall added ONCE here, not per-bot-mode block
     if (isNativeMode) {
       const _files = state._generatedFiles;
-      _files['start-chrome-debug.bat'] = chromeBatContent;
-      _files['start-chrome-debug.sh'] = chromeShContent;
       _files['start-bot.bat'] = generateStartBotBat({
         projectDir: state.config.projectPath || '.',
         openclawHome: (state.config.projectPath || '.') + '\\.openclaw',
@@ -6635,38 +6857,46 @@ fi
   // ========== Zalo Personal Login Guide (post-setup) ==========
   function generateZaloOnboardGuide() {
     const lang = document.getElementById('cfg-language')?.value || 'vi';
-    setOutput('out-zalo-onboard-cmd', `docker compose stop ai-bot
-docker compose run --rm --no-deps ai-bot openclaw channels login --channel zalouser --verbose
-docker compose up -d --force-recreate ai-bot
-docker compose exec ai-bot openclaw channels status --probe`);
+    const isVi = lang === 'vi';
+    const containerName = state.botCount > 1 ? 'openclaw-multibot' : 'openclaw-bot';
+
+    setOutput('out-zalo-onboard-cmd', `# ${isVi ? 'Bước 1: Dọn dẹp session cũ' : 'Step 1: Clean up old session'}
+docker exec ${containerName} rm -f /root/project/.openclaw/credentials/zalouser/credentials.json
 
-    if (lang === 'vi') {
+# ${isVi ? 'Bước 2: Kích hoạt màn hình login QR (Quét mã trên terminal)' : 'Step 2: Start login QR (Scan on terminal)'}
+docker exec -it ${containerName} openclaw channels login --channel zalouser --verbose
+
+# ${isVi ? 'Bước 3: Khởi động lại container sau khi login thành công' : 'Step 3: Restart container after successful login'}
+docker restart ${containerName}`);
+
+    if (isVi) {
       setOutput('out-zalo-onboard-guide', `┌─────────────────────────────────────────────────────┐
-│  Chạy lệnh bên trái để OpenClaw tạo QR đăng nhập.   │
+│  Chạy các lệnh bên trái để đăng nhập Zalo Personal  │
+│  theo quy trình chuẩn 4 bước.                       │
 ├─────────────────────────────────────────────────────┤
-│  1. Đảm bảo container/gateway đã chạy xong.         │
-│  2. Stop ai-bot, login bằng compose run one-shot.   │
-│  3. OpenClaw sẽ in ra đường dẫn file QR trong /tmp. │
-│  4. Copy file QR ra ngoài nếu cần:                  │
-│     docker cp openclaw-bot:/tmp/openclaw/           │
+│  1. Lệnh 1 xoá file credentials.json cũ để tránh     │
+│     lỗi xung đột "Already linked".                  │
+│  2. Lệnh 2 mở màn hình login. Quét mã QR hiện trên   │
+│     terminal hoặc lấy file từ container:            │
+│     docker cp ${containerName}:/tmp/openclaw/           │
 │       openclaw-zalouser-qr-default.png .            │
-│  5. Mở ảnh QR → quét bằng app Zalo → xác nhận.      │
-│  6. Start lại: docker compose up -d --force-recreate│
-│  7. Chạy channels status --probe, phải thấy running.│
+│  3. Sau khi quét xong và terminal báo thành công,    │
+│     nhấn Ctrl+C để thoát.                           │
+│  4. Chạy Lệnh 3 để restart container giúp nhận tin. │
 └─────────────────────────────────────────────────────┘`);
     } else {
       setOutput('out-zalo-onboard-guide', `┌─────────────────────────────────────────────────────┐
-│  Run the command on the left to generate a Zalo QR. │
+│  Run the commands on the left to login Zalo Personal│
+│  following the standard 4-step workflow.            │
 ├─────────────────────────────────────────────────────┤
-│  1. Make sure the container/gateway is already up.  │
-│  2. Stop ai-bot; login with compose run one-shot.   │
-│  3. OpenClaw prints the QR image path under /tmp.   │
-│  4. Copy the QR out if needed:                      │
-│     docker cp openclaw-bot:/tmp/openclaw/           │
+│  1. Command 1 deletes the old credentials.json file  │
+│     to avoid "Already linked" conflicts.            │
+│  2. Command 2 opens the login interface. Scan the   │
+│     QR on your terminal or copy the image file:      │
+│     docker cp ${containerName}:/tmp/openclaw/           │
 │       openclaw-zalouser-qr-default.png .            │
-│  5. Open the image → scan with Zalo mobile app.     │
-│  6. Start again: docker compose up -d --force-re... │
-│  7. Run channels status --probe; it should run.     │
+│  3. Once scanned and successful, press Ctrl+C.       │
+│  4. Run Command 3 to restart the container.         │
 └─────────────────────────────────────────────────────┘`);
     }
   }