create-openclaw-bot 5.8.4 → 5.8.8

package/dist/server/local-server.js

@@ -13,7 +13,7 @@ function loadSharedModule(modulePath, globalName) {
   if (loaded && Object.keys(loaded).length > 0) return loaded;
   return globalThis[globalName] || loaded || {};
 }
-const { buildWorkspaceFileMap, buildCronjobSkillMd, buildInfographicGeneratorSkillMd, buildInfographicGeneratorJs } = loadSharedModule('../setup/shared/workspace-gen.js', '__openclawWorkspace');
+const { buildWorkspaceFileMap, buildCronjobSkillMd, buildInfographicGeneratorSkillMd, buildInfographicGeneratorJs, buildStickerMentionSkillMd, buildStickerMentionJs } = loadSharedModule('../setup/shared/workspace-gen.js', '__openclawWorkspace');
 const { buildOpenclawJson, buildEnvFileContent, buildExecApprovalsJson } = loadSharedModule('../setup/shared/bot-config-gen.js', '__openclawBotConfig');
 const { buildDockerArtifacts } = loadSharedModule('../setup/shared/docker-gen.js', '__openclawDockerGen');
 const { OPENCLAW_NPM_SPEC, NINE_ROUTER_NPM_SPEC, build9RouterProviderConfig, get9RouterBaseUrl } = loadSharedModule('../setup/shared/common-gen.js', '__openclawCommon');
@@ -22,6 +22,27 @@ const dataExport = loadSharedModule('../setup/data/index.js', '__openclawData');
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const WEB_DIR = resolve(__dirname, '../web');
 const SETUP_VERSION = (() => { try { return JSON.parse(fs.readFileSync(resolve(__dirname, '../../package.json'), 'utf8')).version || '0.0.0'; } catch { return '0.0.0'; } })();
+let latestSetupVersionCache = SETUP_VERSION;
+let isFetchingLatestSetup = false;
+
+async function fetchLatestSetupVersionBg() {
+  if (isFetchingLatestSetup) return;
+  isFetchingLatestSetup = true;
+  try {
+    const resp = await fetch('https://registry.npmjs.org/create-openclaw-bot/latest', { signal: AbortSignal.timeout(4000) });
+    if (resp.ok) {
+      const data = await resp.json();
+      if (data.version) {
+        latestSetupVersionCache = data.version;
+      }
+    }
+  } catch (e) {
+  } finally {
+    isFetchingLatestSetup = false;
+  }
+}
+fetchLatestSetupVersionBg().catch(() => {});
+
 const DEFAULT_PROJECT_NAME = 'openclaw-bot';
 const STATE_FILE = '.openclaw-setup-state.json';
 const DEFAULT_MODEL = 'smart-route';
@@ -75,6 +96,31 @@ function detectOs() {
   return 'linux-desktop';
 }
 
+function getRealHomedir() {
+  const home = os.homedir();
+  if (process.platform === 'win32') return home;
+  const sudoUser = process.env.SUDO_USER;
+  if (sudoUser && (home === '/root' || home.startsWith('/root/'))) {
+    const userHome = process.platform === 'darwin' ? `/Users/${sudoUser}` : `/home/${sudoUser}`;
+    if (existsSync(userHome)) {
+      return userHome;
+    }
+  }
+  return home;
+}
+
+function resolveBinPath(cmd) {
+  if (!cmd || cmd.includes('/') || cmd.includes('\\')) return cmd;
+  const nodeBinDir = dirname(process.argv[0]);
+  const localPath = join(nodeBinDir, process.platform === 'win32' ? `${cmd}.cmd` : cmd);
+  if (existsSync(localPath)) return localPath;
+  const localExe = join(nodeBinDir, process.platform === 'win32' ? `${cmd}.exe` : cmd);
+  if (existsSync(localExe)) return localExe;
+  const nodeModulesBin = join(process.cwd(), 'node_modules', '.bin', process.platform === 'win32' ? `${cmd}.cmd` : cmd);
+  if (existsSync(nodeModulesBin)) return nodeModulesBin;
+  return cmd;
+}
+
 // Blacklist of Windows system/large directories that should never be walked
 const SYSTEM_DIR_BLACKLIST = new Set([
   'windows', 'program files', 'program files (x86)', 'programdata',
@@ -107,7 +153,7 @@ function recommendedMode(osChoice) {
 function commandExists(cmd, args = ['--version']) {
   return new Promise((resolve) => {
     const shell = process.platform === 'win32';
-    execFile(cmd, args, { windowsHide: true, timeout: 5000, shell }, (err, stdout, stderr) => {
+    execFile(resolveBinPath(cmd), args, { windowsHide: true, timeout: 5000, shell }, (err, stdout, stderr) => {
       resolve({ ok: !err, output: String(stdout || stderr || '').trim() });
     });
   });
@@ -116,7 +162,7 @@ function commandExists(cmd, args = ['--version']) {
 function run(cmd, args, opts = {}) {
   return new Promise((resolve, reject) => {
     sendLog(`$ ${cmd} ${args.join(' ')}`);
-    const child = spawn(cmd, args, { cwd: opts.cwd, shell: process.platform === 'win32', env: { ...process.env, ...(opts.env || {}) } });
+    const child = spawn(resolveBinPath(cmd), args, { cwd: opts.cwd, shell: process.platform === 'win32', env: { ...process.env, ...(opts.env || {}) } });
     let stdout = '';
     let resolved = false;
     child.stdout.on('data', (d) => {
@@ -146,7 +192,7 @@ function run(cmd, args, opts = {}) {
 
 function startDetached(cmd, args, opts = {}) {
   sendLog(`$ ${cmd} ${args.join(' ')} &`);
-  const child = spawn(cmd, args, {
+  const child = spawn(resolveBinPath(cmd), args, {
     cwd: opts.cwd,
     shell: process.platform === 'win32',
     detached: true,
@@ -154,6 +200,10 @@ function startDetached(cmd, args, opts = {}) {
     windowsHide: opts.windowsHide ?? true,
     env: { ...process.env, ...(opts.env || {}) },
   });
+  child.on('error', (err) => {
+    sendLog(`[error] Failed to start background command "${cmd}": ${err.message}`);
+    console.error(`Failed to start background command "${cmd}":`, err);
+  });
   child.unref();
   return child.pid;
 }
@@ -243,7 +293,7 @@ function runCapture(cmd, args, opts = {}) {
   return new Promise((resolve) => {
     let stdout = '';
     let stderr = '';
-    const child = spawn(cmd, args, {
+    const child = spawn(resolveBinPath(cmd), args, {
       cwd: opts.cwd,
       shell: opts.shell ?? process.platform === 'win32',
       windowsHide: opts.windowsHide ?? true,
@@ -425,6 +475,8 @@ async function detectRuntime(projectDir) {
 
 async function syncRuntimeState(projectDir) {
   if (!projectDir || !existsSync(join(projectDir, '.openclaw', 'openclaw.json'))) return;
+  // Auto-migrate legacy /root/project paths → /home/node/project in openclaw.json
+  await migrateContainerPaths(projectDir).catch(() => {});
   await applyResolved9RouterApiKey(projectDir).catch(() => {});
   const rt = await detectRuntime(projectDir).catch(() => null);
   if (!rt) return;
@@ -444,6 +496,38 @@ async function syncRuntimeState(projectDir) {
   }
 }
 
+/**
+ * Migrate legacy /root/project/ paths to /home/node/project/ in openclaw.json.
+ * Old projects may have been created with /root/project/ which doesn't match the
+ * Docker volume mount point (/home/node/project/.openclaw).
+ * Also clears stale workspace attestation files to prevent WorkspaceVanishedError.
+ */
+async function migrateContainerPaths(projectDir) {
+  const cfgPath = join(projectDir, '.openclaw', 'openclaw.json');
+  if (!existsSync(cfgPath)) return;
+  let raw = await fsp.readFile(cfgPath, 'utf8');
+  if (!raw.includes('/root/project/')) return;
+  // Replace all /root/project/ references with /home/node/project/
+  const updated = raw.replace(/\/root\/project\//g, '/home/node/project/');
+  if (updated !== raw) {
+    await fsp.writeFile(cfgPath, updated, 'utf8');
+    sendLog('[migrate] Fixed legacy /root/project/ paths → /home/node/project/ in openclaw.json');
+    // Clear stale workspace attestations to avoid WorkspaceVanishedError
+    const attestDir = join(projectDir, '.openclaw', 'workspace-attestations');
+    if (existsSync(attestDir)) {
+      try {
+        const files = await fsp.readdir(attestDir);
+        for (const f of files) {
+          if (f.endsWith('.attested')) {
+            await fsp.unlink(join(attestDir, f)).catch(() => {});
+          }
+        }
+        sendLog('[migrate] Cleared stale workspace attestation files');
+      } catch {}
+    }
+  }
+}
+
 function uniqueSlug(base, used) {
   let out = base;
   let i = 2;
@@ -525,6 +609,10 @@ function ensureConfigShape(cfg) {
       delete agent.desc;
       delete agent.description;
       delete agent.persona;
+      // Auto-fix legacy /root/project paths → /home/node/project (Docker container path)
+      if (agent.workspace && agent.workspace.includes('/root/project/')) {
+        agent.workspace = agent.workspace.replace('/root/project/', '/home/node/project/');
+      }
     }
     agent.model = agent.model || { primary: cfg.agents.defaults.model.primary, fallbacks: [] };
     if (!agent.model.primary || agent.model.primary === '9router/smart-route' || agent.model.primary === 'openai/smart-route') agent.model.primary = DEFAULT_MODEL;
@@ -696,7 +784,7 @@ async function resolveProject9RouterApiKey(projectDir, cfg = null) {
   }
   const nativeApiKey = read9RouterApiKeyFromSqlite(join(projectDir || '', '.9router', 'db', 'data.sqlite'));
   if (nativeApiKey) return nativeApiKey;
-  const homeApiKey = read9RouterApiKeyFromSqlite(join(os.homedir(), '.9router', 'db', 'data.sqlite'));
+  const homeApiKey = read9RouterApiKeyFromSqlite(join(getRealHomedir(), '.9router', 'db', 'data.sqlite'));
   if (homeApiKey) return homeApiKey;
   return '';
 }
@@ -954,7 +1042,7 @@ async function createBotInProject(projectDir, body = {}, runtime = {}) {
     providerKey: '9router',
     deployMode: runtime.mode || state.mode || 'docker',
     osChoice: runtime.os || state.os || detectOs(),
-    selectedSkills: [],
+    selectedSkills: ['memory', 'image-gen', 'web-search', 'scheduler'],
     skills: dataExport.SKILLS || [],
     agentMetas: [],
   }));
@@ -974,7 +1062,7 @@ async function createBotInProject(projectDir, body = {}, runtime = {}) {
   cfg.agents.list.push({
     id: agentId,
     name: botName,
-    workspace: `/root/project/.openclaw/${workspaceDir}`,
+    workspace: `/home/node/project/.openclaw/${workspaceDir}`,
     agentDir: `agents/${agentId}/agent`,
     model: { primary: model === '9router/smart-route' || model === 'openai/smart-route' ? DEFAULT_MODEL : model, fallbacks: [] },
   });
@@ -1022,7 +1110,9 @@ async function createBotInProject(projectDir, body = {}, runtime = {}) {
     userInfo,
     agentWorkspaceDir: workspaceDir,
     workspacePath: `.openclaw/${workspaceDir}`,
+    channel,
     hasZaloMod: channel === 'zalo-personal',
+    hasZaloSticker: channel === 'zalo-personal',
     hasScheduler,
     hasImageGen,
   });
@@ -1053,7 +1143,7 @@ async function updateBotInProject(projectDir, agentId, body = {}, runtime = {})
   const userDesc = String(body.userDescription || body.userDesc || '').trim();
   const userInfo = [userName ? `- **Tên:** ${userName}` : '', userDesc ? `- **Mô tả:** ${userDesc}` : ''].filter(Boolean).join('\n');
   const workspaceDir = workspaceRelForAgent(agent, cfg, projectDir) || `workspace-${agentId}`;
-  agent.workspace = `/root/project/.openclaw/${workspaceDir}`;
+  agent.workspace = `/home/node/project/.openclaw/${workspaceDir}`;
   agent.agentDir = `agents/${agentId}/agent`;
 
   // Find the existing accountId from bindings BEFORE removing them
@@ -1124,7 +1214,9 @@ async function updateBotInProject(projectDir, agentId, body = {}, runtime = {})
     userInfo,
     agentWorkspaceDir: workspaceDir,
     workspacePath: `.openclaw/${workspaceDir}`,
+    channel,
     hasZaloMod: channel === 'zalo-personal',
+    hasZaloSticker: channel === 'zalo-personal',
     hasScheduler,
     hasImageGen,
   });
@@ -1133,6 +1225,7 @@ async function updateBotInProject(projectDir, agentId, body = {}, runtime = {})
     await fsp.mkdir(dirname(join(wsRoot, name)), { recursive: true });
     await fsp.writeFile(join(wsRoot, name), content || '', 'utf8');
   }
+
   return { ok: true, agentId, channel, workspace: `.openclaw/${workspaceDir}` };
 }
 
@@ -1196,8 +1289,46 @@ async function waitForGatewayZaloReady(botContainer, projectDir, timeoutMs = 900
   return ready;
 }
 
-async function startZaloUserLogin(projectDir, mode = state.mode) {
-  const qrPaths = ['/tmp/openclaw/openclaw-zalouser-qr.png', '/tmp/openclaw/openclaw-zalouser-qr-default.png'];
+async function startZaloUserLogin(projectDir, mode = state.mode, agentId = '') {
+  let profile = 'default';
+  if (agentId) {
+    try {
+      const cfgPath = join(projectDir, '.openclaw', 'openclaw.json');
+      if (existsSync(cfgPath)) {
+        const cfg = JSON.parse(await fsp.readFile(cfgPath, 'utf8'));
+        const binding = (cfg.bindings || []).find(b => b.agentId === agentId && b.match?.channel === 'zalouser');
+        if (binding?.match?.accountId) {
+          profile = binding.match.accountId;
+        }
+      }
+    } catch (e) {
+      sendLog(`[zalouser] Warning: Failed to parse openclaw.json: ${e.message}`);
+    }
+  } else if (state.activeBotId) {
+    try {
+      const cfgPath = join(projectDir, '.openclaw', 'openclaw.json');
+      if (existsSync(cfgPath)) {
+        const cfg = JSON.parse(await fsp.readFile(cfgPath, 'utf8'));
+        const binding = (cfg.bindings || []).find(b => b.agentId === state.activeBotId && b.match?.channel === 'zalouser');
+        if (binding?.match?.accountId) {
+          profile = binding.match.accountId;
+        }
+      }
+    } catch (e) {}
+  }
+
+  const qrPaths = [
+    `/tmp/openclaw/openclaw-zalouser-qr-${profile}.png`,
+    `/tmp/openclaw-1000/openclaw-zalouser-qr-${profile}.png`
+  ];
+  if (profile === 'default') {
+    qrPaths.push(
+      '/tmp/openclaw/openclaw-zalouser-qr.png',
+      '/tmp/openclaw-1000/openclaw-zalouser-qr.png',
+      '/tmp/openclaw/openclaw-zalouser-qr-default.png'
+    );
+  }
+
   if (zaloLoginInFlight) {
     setImmediate(async () => {
       try {
@@ -1214,7 +1345,7 @@ async function startZaloUserLogin(projectDir, mode = state.mode) {
     return { message: 'Zalo login is already running. Keep this modal open...' };
   }
   zaloLoginInFlight = true;
-  sendLog('[zalouser] Preparing login. QR will be generated for the UI modal.');
+  sendLog(`[zalouser] Preparing login for profile [${profile}]. QR will be generated for the UI modal.`);
   const composeFile = join(projectDir, 'docker', 'openclaw', 'docker-compose.yml');
   if ((mode === 'docker' || existsSync(composeFile)) && existsSync(composeFile)) {
     const botContainer = getBotContainerName(projectDir);
@@ -1223,8 +1354,8 @@ async function startZaloUserLogin(projectDir, mode = state.mode) {
     const checkRegistryScript = `
 const fs = require('fs');
 try {
-  const dist = '/root/project/.openclaw/npm/node_modules/@openclaw/zalouser/dist/index.js';
-  const inst = '/root/project/.openclaw/plugins/installs.json';
+  const dist = '/home/node/project/.openclaw/npm/node_modules/@openclaw/zalouser/dist/index.js';
+  const inst = '/home/node/project/.openclaw/plugins/installs.json';
   if (!fs.existsSync(dist)) { console.log('MISSING'); process.exit(0); }
   if (!fs.existsSync(inst)) { console.log('MISSING_CHANNELS'); process.exit(0); }
   const j = JSON.parse(fs.readFileSync(inst, 'utf8'));
@@ -1244,17 +1375,17 @@ try {
       const fixScript = `
 const fs=require('fs');
 const cp=require('child_process');
-const cfg='/root/project/.openclaw/openclaw.json';
-const bk='/root/project/.openclaw/openclaw.json.zalo-backup';
+const cfg='/home/node/project/.openclaw/openclaw.json';
+const bk='/home/node/project/.openclaw/openclaw.json.zalo-backup';
 try{if(fs.existsSync(cfg))fs.copyFileSync(cfg,bk);}catch(e){}
 // Detect gateway version and pin zalouser plugin to match, preventing createSetupTranslator mismatch
 let gatewayVer='';
 try{gatewayVer=cp.execSync('openclaw --version 2>/dev/null',{encoding:'utf8'}).trim().replace(/[^0-9.]/g,'');}catch(e){}
 const pluginSpec=gatewayVer ? '@openclaw/zalouser@'+gatewayVer : '@openclaw/zalouser';
 console.log('Installing plugin via CLI: '+pluginSpec+'...');
-try{cp.execSync('cd /root/project && openclaw plugins install '+pluginSpec+' --force',{stdio:'inherit'});}catch(e){
+try{cp.execSync('cd /home/node/project && openclaw plugins install '+pluginSpec+' --force',{stdio:'inherit'});}catch(e){
   // Fallback: try without version pin if exact version not found on registry
-  if(gatewayVer){console.log('Pinned version failed, trying latest...');try{cp.execSync('cd /root/project && openclaw plugins install @openclaw/zalouser --force',{stdio:'inherit'});}catch(e2){console.error('Install failed');}}
+  if(gatewayVer){console.log('Pinned version failed, trying latest...');try{cp.execSync('cd /home/node/project && openclaw plugins install @openclaw/zalouser --force',{stdio:'inherit'});}catch(e2){console.error('Install failed');}}
   else{console.error('Install failed');}
 }
 try{
@@ -1278,10 +1409,10 @@ try{
 }catch(e){}
 try{
   console.log('Patching zalouser stability settings...');
-  cp.execSync('ZALO_JS=$(find "/root/project/.openclaw" -path "*/zalouser/dist/zalo-js*.js" -type f 2>/dev/null | head -1); if [ -n "$ZALO_JS" ]; then sed -i "s/LISTENER_WATCHDOG_MAX_GAP_MS = 35e3/LISTENER_WATCHDOG_MAX_GAP_MS = 120e3/g" "$ZALO_JS"; echo "Patched watchdog gap to 120s"; fi', {shell:true,stdio:'inherit'});
+  cp.execSync('ZALO_JS=$(find "/home/node/project/.openclaw" -path "*/zalouser/dist/zalo-js*.js" -type f 2>/dev/null | head -1); if [ -n "$ZALO_JS" ]; then sed -i "s/LISTENER_WATCHDOG_MAX_GAP_MS = 35e3/LISTENER_WATCHDOG_MAX_GAP_MS = 120e3/g" "$ZALO_JS"; echo "Patched watchdog gap to 120s"; fi', {shell:true,stdio:'inherit'});
 }catch(e){}
 try{
-  const ep = '/root/project/docker/openclaw/entrypoint.sh';
+  const ep = '/home/node/project/docker/openclaw/entrypoint.sh';
   if (fs.existsSync(ep)) {
     let content = fs.readFileSync(ep, 'utf8');
     if (!content.includes('zalo-monitor')) {
@@ -1312,11 +1443,12 @@ try{
     }
     
     // Clean old credentials & QR files inside container
-    const credPath = '/root/project/.openclaw/credentials/zalouser/credentials.json';
-    await runCapture('docker', ['exec', botContainer, 'sh', '-lc', `rm -f ${credPath} ${qrPaths.join(' ')}`], { cwd: projectDir, shell: false });
+    const credFile = profile === 'default' ? 'credentials.json' : `credentials-${profile}.json`;
+    const credPath = `/home/node/project/.openclaw/credentials/zalouser/${credFile}`;
+    await runCapture('docker', ['exec', botContainer, 'sh', '-lc', `rm -f ${credPath} ${qrPaths.join(' ')}`], { cwd: projectDir, shell: false }).catch(() => {});
     
     sendLog('[zalouser] Generating Zalo QR. The image will appear automatically.');
-    const loginCmd = 'cd /root/project && openclaw channels login --channel zalouser --verbose';
+    const loginCmd = `cd /home/node/project && openclaw channels login --channel zalouser --account ${profile} --verbose`;
     
     // Retry-based login: the zalouser plugin may need time to connect to Zalo servers.
     // The CLI often exits with "Still preparing QR" on the first attempt.
@@ -1507,6 +1639,33 @@ async function recreateDockerBot(projectDir) {
   sendLog(`[docker] Recreating ${serviceName} to reload openclaw.json/.env...`);
   await run('docker', ['compose', '-f', composeFile, 'up', '-d', '--build', '--force-recreate', serviceName], { cwd: projectDir });
   await waitForDockerContainer(containerName);
+
+  // Automatically run Zalo sticker-mention patch if skill is enabled and agent is zalo-personal
+  try {
+    const cfgPath = join(projectDir, '.openclaw', 'openclaw.json');
+    if (existsSync(cfgPath)) {
+      const cfg = JSON.parse(await fsp.readFile(cfgPath, 'utf8'));
+      const stickerMentionOn = !!cfg.skills?.entries?.['sticker-mention']?.enabled;
+      if (stickerMentionOn) {
+        for (const a of cfg.agents?.list || []) {
+          const binding = (cfg.bindings || []).find((b) => b.agentId === a.id);
+          const channel = binding?.match?.channel || 'telegram';
+          if (channel === 'zalo-personal') {
+            const workspaceDir = workspaceRelForAgent(a, cfg, projectDir) || `workspace-${a.id}`;
+            const mentionsJsPath = join(projectDir, '.openclaw', workspaceDir, 'skills/sticker-mention/mentions.js');
+            if (existsSync(mentionsJsPath)) {
+              sendLog(`[zalo-patch] Automatically running mentions.js inside container ${containerName}...`);
+              const patchCmd = await runCapture('docker', ['exec', containerName, 'node', `/home/node/project/.openclaw/${workspaceDir}/skills/sticker-mention/mentions.js`], { cwd: projectDir, shell: false });
+              sendLog(`[zalo-patch] Output: ${patchCmd.stdout || ''} ${patchCmd.stderr || ''}`);
+            }
+          }
+        }
+      }
+    }
+  } catch (err) {
+    sendLog(`[zalo-patch] Failed to auto-run mentions.js: ${err.message}`);
+  }
+
   return true;
 }
 
@@ -1567,7 +1726,7 @@ async function writeCoreProject({ projectDir, osChoice, mode, gatewayPort = 1878
   await fsp.mkdir(openclawHome, { recursive: true });
   await fsp.mkdir(join(openclawHome, 'plugin-runtime-deps'), { recursive: true });
 
-  const selectedSkills = ['memory', 'image-gen', 'web-search'];
+  const selectedSkills = ['memory', 'image-gen', 'web-search', 'scheduler'];
   const agentMetas = [];
   const common = { channelKey: 'telegram', providerKey: '9router', model: DEFAULT_MODEL, deployMode: mode, osChoice, selectedSkills, skills: dataExport.SKILLS || [], agentMetas, gatewayPort, routerPort };
   const cfg = buildOpenclawJson(common);
@@ -1631,7 +1790,7 @@ async function installCore({ osChoice, mode, projectDir, gatewayPort = 18789, ro
       await fsp.mkdir(dockerDir, { recursive: true });
       const envContent = existsSync(rootEnvPath)
         ? await fsp.readFile(rootEnvPath, 'utf8')
-        : buildEnvFileContent({ channelKey: 'telegram', providerKey: '9router', deployMode: mode, osChoice, selectedSkills: [], skills: dataExport.SKILLS || [], agentMetas: [], apiKey: '', botToken: '' });
+        : buildEnvFileContent({ channelKey: 'telegram', providerKey: '9router', deployMode: mode, osChoice, selectedSkills: ['memory', 'image-gen', 'web-search', 'scheduler'], skills: dataExport.SKILLS || [], agentMetas: [], apiKey: '', botToken: '' });
       await fsp.writeFile(dockerEnvPath, envContent, 'utf8');
       sendLog(`Docker env ready: ${dockerEnvPath}`);
       await run('docker', ['compose', 'up', '-d', '--build'], { cwd: dockerDir });
@@ -1750,37 +1909,86 @@ async function loadSavedState(rootProjectDir) {
   }
 }
 
+function isRestrictedSystemDir(dirPath) {
+  if (!dirPath) return true;
+  const lower = resolve(dirPath).toLowerCase();
+  
+  if (SYSTEM_DIR_BLACKLIST.has(basename(lower))) return true;
+  
+  const winDir = process.env.SystemRoot ? resolve(process.env.SystemRoot).toLowerCase() : 'c:\\windows';
+  const programFiles = process.env.ProgramFiles ? resolve(process.env.ProgramFiles).toLowerCase() : 'c:\\program files';
+  const programFilesX86 = process.env['ProgramFiles(x86)'] ? resolve(process.env['ProgramFiles(x86)']).toLowerCase() : 'c:\\program files (x86)';
+  
+  if (lower.startsWith(winDir) || lower.startsWith(programFiles) || lower.startsWith(programFilesX86)) {
+    return true;
+  }
+  
+  if (lower.includes(':\\users\\') || lower.endsWith(':\\users')) {
+    const home = resolve(getRealHomedir()).toLowerCase();
+    if (lower !== home && !lower.startsWith(home + '\\') && !lower.startsWith(home + '/')) {
+      return true;
+    }
+  }
+
+  if (process.platform !== 'win32') {
+    const unixBlacklist = new Set([
+      'usr', 'var', 'proc', 'sys', 'dev', 'etc', 'sbin', 'bin', 'lib', 'lib64', 'run', 'tmp', 'boot', 'lost+found', 'srv', 'mnt', 'media', 'opt'
+    ]);
+    if (unixBlacklist.has(basename(lower))) return true;
+    
+    if (lower.startsWith('/home') || lower.startsWith('/root')) {
+      const realHome = resolve(getRealHomedir()).toLowerCase();
+      if (lower !== realHome && !lower.startsWith(realHome + '/')) {
+        return true;
+      }
+    }
+  }
+
+  return false;
+}
+
 async function findLatestProject(rootProjectDir) {
+  const realHome = getRealHomedir();
   const roots = [
     process.env.OPENCLAW_PROJECT_DIR,
     process.env.OPENCLAW_HOME ? dirname(process.env.OPENCLAW_HOME) : '',
     rootProjectDir,
     join(rootProjectDir, DEFAULT_PROJECT_NAME),
     dirname(rootProjectDir),
-    os.homedir(),
-  ];
-  // Scan all available drives, walking top-level dirs but skipping system folders
+    realHome,
+    join(realHome, 'Documents'),
+  ].filter(Boolean);
+  
   const drives = await getAvailableDrives();
   for (const drive of drives) {
     const entries = await fsp.readdir(drive, { withFileTypes: true }).catch(() => []);
     for (const e of entries) {
       if (e.isDirectory() && !e.name.startsWith('$') && !SYSTEM_DIR_BLACKLIST.has(e.name.toLowerCase())) {
-        roots.push(join(drive, e.name));
+        const fullPath = join(drive, e.name);
+        if (!isRestrictedSystemDir(fullPath)) {
+          roots.push(fullPath);
+        }
       }
     }
   }
   const candidates = [];
+  const seen = new Set();
   async function walk(dir, depth = 0) {
     if (!dir || depth > 2 || !existsSync(dir)) return;
-    if (existsSync(join(dir, '.openclaw', 'openclaw.json'))) {
-      const st = await fsp.stat(join(dir, '.openclaw', 'openclaw.json')).catch(() => null);
-      if (st) candidates.push({ dir, mtimeMs: st.mtimeMs });
+    const full = resolve(dir);
+    if (isRestrictedSystemDir(full)) return;
+    if (seen.has(full)) return;
+    seen.add(full);
+
+    if (existsSync(join(full, '.openclaw', 'openclaw.json'))) {
+      const st = await fsp.stat(join(full, '.openclaw', 'openclaw.json')).catch(() => null);
+      if (st) candidates.push({ dir: full, mtimeMs: st.mtimeMs });
       return;
     }
-    const entries = await fsp.readdir(dir, { withFileTypes: true }).catch(() => []);
+    const entries = await fsp.readdir(full, { withFileTypes: true }).catch(() => []);
     for (const e of entries) {
       if (e.isDirectory() && !e.name.startsWith('.') && e.name !== 'node_modules' && !SYSTEM_DIR_BLACKLIST.has(e.name.toLowerCase())) {
-        await walk(join(dir, e.name), depth + 1);
+        await walk(join(full, e.name), depth + 1);
       }
     }
   }
@@ -1790,21 +1998,34 @@ async function findLatestProject(rootProjectDir) {
 }
 
 async function discoverProjects(rootProjectDir) {
+  const realHome = getRealHomedir();
   const roots = [
     process.env.OPENCLAW_PROJECT_DIR,
     rootProjectDir,
     dirname(rootProjectDir),
     process.env.OPENCLAW_HOME ? dirname(process.env.OPENCLAW_HOME) : '',
-  ];
-  // Add all available drives for scanning
+    realHome,
+    join(realHome, 'Documents'),
+  ].filter(Boolean);
+  
   const drives = await getAvailableDrives();
-  for (const drive of drives) roots.push(drive);
+  for (const drive of drives) {
+    const entries = await fsp.readdir(drive, { withFileTypes: true }).catch(() => []);
+    for (const e of entries) {
+      if (e.isDirectory() && !e.name.startsWith('$') && !SYSTEM_DIR_BLACKLIST.has(e.name.toLowerCase())) {
+        const fullPath = join(drive, e.name);
+        if (!isRestrictedSystemDir(fullPath)) {
+          roots.push(fullPath);
+        }
+      }
+    }
+  }
   const seen = new Set();
   const hits = [];
   async function walk(dir, depth = 0) {
     if (!dir || depth > 2 || !existsSync(dir)) return;
     const full = resolve(dir);
-    if (full === resolve(os.homedir())) return;
+    if (isRestrictedSystemDir(full)) return;
     if (seen.has(full)) return;
     seen.add(full);
     const cfgPath = join(full, '.openclaw', 'openclaw.json');
@@ -1832,7 +2053,7 @@ async function discoverProjects(rootProjectDir) {
     const entries = await fsp.readdir(full, { withFileTypes: true }).catch(() => []);
     for (const e of entries) {
       if (!e.isDirectory()) continue;
-      if (e.name === 'node_modules' || e.name.startsWith('.git') || SYSTEM_DIR_BLACKLIST.has(e.name.toLowerCase())) continue;
+      if (e.name === 'node_modules' || e.name.startsWith('.') || SYSTEM_DIR_BLACKLIST.has(e.name.toLowerCase())) continue;
       await walk(join(full, e.name), depth + 1);
     }
   }
@@ -1907,9 +2128,10 @@ async function connectPickedProject(projectName, rootProjectDir) {
 
 async function deleteProjectFolder(projectDir, rootProjectDir) {
   const resolved = resolve(String(projectDir || ''));
-  const home = resolve(os.homedir());
+  const home = resolve(getRealHomedir());
+  const rootHome = resolve(os.homedir());
   if (!existsSync(join(resolved, '.openclaw', 'openclaw.json'))) throw httpError(404, 'openclaw.json not found in selected project');
-  if (resolved === home || /^[A-Za-z]:\\?$/.test(resolved)) throw httpError(403, 'Refusing to delete home/root folder');
+  if (resolved === home || resolved === rootHome || /^[A-Za-z]:\\?$/.test(resolved)) throw httpError(403, 'Refusing to delete home/root folder');
   const projects = await discoverProjects(rootProjectDir).catch(() => []);
   const meta = projects.find((p) => resolve(p.projectDir) === resolved);
   if (!meta || !meta.botCount) throw httpError(403, 'Refusing to delete a folder that is not a detected bot project');
@@ -2020,6 +2242,12 @@ async function applyFeatureToggle(projectDir, agentId, kind, id, enabled) {
   }
 
   if (kind === 'skill' && id === 'cron') {
+    cfg.skills = cfg.skills || { entries: {} };
+    cfg.skills.entries = cfg.skills.entries || {};
+    delete cfg.skills.entries['cron'];
+    cfg.skills.entries['cronjob'] = cfg.skills.entries['cronjob'] || {};
+    cfg.skills.entries['cronjob'].enabled = !!enabled;
+
     if (enabled) {
       cfg.tools = cfg.tools || { profile: 'full', exec: { host: 'gateway', security: 'full', ask: 'off' } };
       cfg.tools.alsoAllow = Array.from(new Set([...(cfg.tools.alsoAllow || []), 'group:automation']));
@@ -2103,6 +2331,51 @@ async function applyFeatureToggle(projectDir, agentId, kind, id, enabled) {
     }
   }
 
+  if (kind === 'skill' && id === 'sticker-mention') {
+    cfg.skills = cfg.skills || { entries: {} };
+    cfg.skills.entries = cfg.skills.entries || {};
+    cfg.skills.entries['sticker-mention'] = cfg.skills.entries['sticker-mention'] || {};
+    cfg.skills.entries['sticker-mention'].enabled = !!enabled;
+
+    for (const a of cfg.agents.list) {
+      const sf = await readWorkspaceText(projectDir, a, 'skills/sticker-mention/SKILL.md');
+      const jsf = await readWorkspaceText(projectDir, a, 'skills/sticker-mention/mentions.js');
+      if (enabled) {
+        await fsp.mkdir(dirname(sf.file), { recursive: true });
+        await fsp.writeFile(sf.file, buildStickerMentionSkillMd(), 'utf8');
+        await fsp.writeFile(jsf.file, buildStickerMentionJs(), 'utf8');
+      } else {
+        const binding = (cfg.bindings || []).find((b) => b.agentId === a.id);
+        const channel = binding?.match?.channel || 'telegram';
+        if (channel === 'zalo-personal' && existsSync(jsf.file)) {
+          try {
+            const hasDocker = existsSync(join(projectDir, 'docker', 'openclaw', 'docker-compose.yml'));
+            if (hasDocker) {
+              const botContainer = getBotContainerName(projectDir);
+              const workspaceDir = workspaceRelForAgent(a, cfg, projectDir) || `workspace-${a.id}`;
+              sendLog('[zalo-patch] Running restore before disabling skill...');
+              await runCapture('docker', ['exec', botContainer, 'node', `/home/node/project/.openclaw/${workspaceDir}/skills/sticker-mention/mentions.js`, '--restore'], { cwd: projectDir, shell: false });
+            }
+          } catch (e) {
+            sendLog(`[zalo-patch] Restore failed: ${e.message}`);
+          }
+        }
+        if (existsSync(sf.file)) await fsp.rm(sf.file, { force: true });
+        if (existsSync(jsf.file)) await fsp.rm(jsf.file, { force: true });
+      }
+    }
+
+    // Write cfgPath early so recreation reads updated openclaw.json
+    await fsp.writeFile(cfgPath, JSON.stringify(cfg, null, 2), 'utf8');
+
+    // Recreate container to apply updated openclaw.json
+    const hasDocker = existsSync(join(projectDir, 'docker', 'openclaw', 'docker-compose.yml'));
+    if (hasDocker) {
+      sendLog(`[docker] Sticker & Mention skill toggled to ${enabled}. Recreating containers...`);
+      await recreateDockerBot(projectDir).catch((err) => sendLog(`[docker] Warning: Failed to recreate container: ${err.message}`));
+    }
+  }
+
   if (kind === 'plugin') {
     cfg.plugins = cfg.plugins || { entries: {} };
     cfg.plugins.entries = cfg.plugins.entries || {};
@@ -2160,7 +2433,7 @@ async function installFeature(projectDir, agentId, kind, id) {
       const botContainer = getBotContainerName(projectDir);
       sendLog(`[plugin] Installing/updating clawhub:${id} inside container ${botContainer}...`);
       
-      const cmd = `cd /root/project && openclaw plugins install clawhub:${id} --force`;
+      const cmd = `cd /home/node/project && openclaw plugins install clawhub:${id} --force`;
       const cmdOut = await runCapture('docker', ['exec', botContainer, 'sh', '-lc', cmd], { cwd: projectDir, shell: false });
       
       if (cmdOut) {
@@ -2316,7 +2589,7 @@ async function getFeatureFlags(projectDir, agentId = '') {
   const cfg = existsSync(cfgPath) ? ensureConfigShape(JSON.parse(await fsp.readFile(cfgPath, 'utf8').catch(() => '{}'))) : {};
   const aid = agentId || cfg.agents?.list?.[0]?.id || 'bot';
   const browserOn = !!cfg.browser?.enabled;
-  const cronOn = !!(cfg.tools?.alsoAllow || []).includes('group:automation');
+  const cronOn = !!cfg.skills?.entries?.['cronjob']?.enabled || !!cfg.skills?.entries?.['cron']?.enabled || !!(cfg.tools?.alsoAllow || []).includes('group:automation');
   const fresh = cfg;
   const freshSaved = {};
   const installsPath = join(projectDir || '', '.openclaw', 'plugins', 'installs.json');
@@ -2345,6 +2618,7 @@ async function getFeatureFlags(projectDir, agentId = '') {
     );
   const imageGenOn = !!cfg.skills?.entries?.['image-gen']?.enabled;
   const webSearchOn = isEnabled(['duckduckgo']);
+  const stickerMentionOn = !!cfg.skills?.entries?.['sticker-mention']?.enabled;
   const aliases = {
     browser: ['openclaw-browser-automation', 'browser-automation'],
     zalo: ['openclaw-zalo-mod', 'zalo-mod'],
@@ -2356,6 +2630,7 @@ async function getFeatureFlags(projectDir, agentId = '') {
     'skill:cron': cronOn,
     'skill:image-gen': imageGenOn,
     'skill:web-search': webSearchOn,
+    'skill:sticker-mention': stickerMentionOn,
     'plugin:openclaw-browser-automation': isEnabled(aliases.browser),
     'plugin:openclaw-zalo-mod': isEnabled(aliases.zalo),
     'plugin:openclaw-facebook-crawler': isEnabled(aliases.crawler),
@@ -2425,14 +2700,8 @@ async function handler(req, res, rootProjectDir) {
       };
       const projects = await discoverProjects(rootProjectDir).catch(() => []);
 
-      let latestSetupVersion = SETUP_VERSION;
-      try {
-        const resp = await fetch('https://registry.npmjs.org/create-openclaw-bot/latest', { signal: AbortSignal.timeout(3000) });
-        if (resp.ok) {
-          const data = await resp.json();
-          if (data.version) latestSetupVersion = data.version;
-        }
-      } catch (e) {}
+      fetchLatestSetupVersionBg().catch(() => {});
+      const latestSetupVersion = latestSetupVersionCache;
 
       return json(res, {
         os: osChoice,
@@ -2581,7 +2850,7 @@ async function handler(req, res, rootProjectDir) {
         const token = String(body.token || '').trim();
         sendLog(`[telegram] Registering Telegram channel via CLI inside ${botContainer}...`);
         try {
-          const regResult = await runCapture('docker', ['exec', botContainer, 'sh', '-lc', `cd /root/project && openclaw channels add telegram --token "${token}"`], { cwd: projectDir, shell: false });
+          const regResult = await runCapture('docker', ['exec', botContainer, 'sh', '-lc', `cd /home/node/project && openclaw channels add telegram --token "${token}"`], { cwd: projectDir, shell: false });
           sendLog(`[telegram] CLI registration output:\n${regResult.stdout}\n${regResult.stderr}`);
           sendLog(`[telegram] Restarting ${botContainer} container to load the registered channel...`);
           await restartDockerBotContainer(projectDir).catch((err) => sendLog(`[telegram] Container restart failed: ${err.message}`));
@@ -2598,7 +2867,7 @@ async function handler(req, res, rootProjectDir) {
         // Delay login start to let the recreated container fully boot gateway + plugins
         setTimeout(async () => {
           try {
-            const login = await startZaloUserLogin(projectDir, state.mode);
+            const login = await startZaloUserLogin(projectDir, state.mode, result.agentId);
             if (login?.qrDataUrl) sendLog(`[zalouser:qr] ${login.qrDataUrl}`);
             if (login?.message) sendLog(`[zalouser] ${login.message}`);
           } catch (err) {
@@ -2618,10 +2887,12 @@ async function handler(req, res, rootProjectDir) {
       return json(res, result);
     }
     if (url.pathname === '/api/zalo/login' && req.method === 'POST') {
-      const projectDir = await resolveProjectDir(rootProjectDir);
+      const body = await readJson(req).catch(() => ({}));
+      const agentId = body.agentId || '';
+      const projectDir = await resolveProjectDir(rootProjectDir, body);
       setImmediate(async () => {
         try {
-          const login = await startZaloUserLogin(projectDir, state.mode);
+          const login = await startZaloUserLogin(projectDir, state.mode, agentId);
           if (login?.qrDataUrl) sendLog(`[zalouser:qr] ${login.qrDataUrl}`);
           if (login?.message) sendLog(`[zalouser] ${login.message}`);
         } catch (err) {
@@ -2704,6 +2975,9 @@ function openUrl(url) {
   const cmd = process.platform === 'win32' ? 'cmd' : process.platform === 'darwin' ? 'open' : 'xdg-open';
   const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
   const child = spawn(cmd, args, { detached: true, stdio: 'ignore', shell: false, windowsHide: true });
+  child.on('error', (err) => {
+    sendLog(`[openUrl] Warning: Could not open browser automatically (${err.message}). Please navigate to ${url} manually.`);
+  });
   child.unref();
 }