diff --git a/.github/workflows/build-node-musl.yml b/.github/workflows/build-node-musl.yml
new file mode 100644
index 0000000..8cedbaf
--- /dev/null
+++ b/.github/workflows/build-node-musl.yml
@@ -0,0 +1,70 @@
+name: Build Node.js ARM64 musl
+
+on:
+  workflow_dispatch:
+    inputs:
+      node_version:
+        description: 'Node.js 版本 (如 22.16.0)'
+        required: true
+        default: '22.16.0'
+
+jobs:
+  build:
+    name: Build Node.js ${{ github.event.inputs.node_version }} ARM64 musl
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+        with:
+          platforms: linux/arm64
+
+      - name: Build Node.js ARM64 musl portable
+        run: |
+          NODE_VER="${{ github.event.inputs.node_version }}"
+          mkdir -p dist
+          echo "=== Building Node.js v${NODE_VER} ARM64 musl portable tarball ==="
+          docker run --rm --platform linux/arm64 \
+            -v "$PWD/dist:/output" \
+            -v "$PWD/scripts/build-node-musl.sh:/build-node-musl.sh:ro" \
+            -e "NODE_VER=${NODE_VER}" \
+            alpine:3.21 sh /build-node-musl.sh
+
+      - name: Verify tarball
+        run: |
+          echo "=== Output files ==="
+          ls -lh dist/
+          echo ""
+          echo "=== Tarball contents (first 20 entries) ==="
+          tar tJf dist/*.tar.xz | head -20
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: node-arm64-musl
+          path: dist/*.tar.xz
+
+      - name: Create/Update Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: node-bins
+          name: "Node.js Prebuilt Binaries (musl)"
+          files: dist/*.tar.xz
+          draft: false
+          prerelease: false
+          make_latest: false
+          body: |
+            预编译的 Node.js ARM64 musl 二进制文件，供 ARM64 OpenWrt/iStoreOS 设备使用。
+
+            Node.js 官方 [unofficial-builds](https://unofficial-builds.nodejs.org/) 仅提供 x64 musl 构建，不提供 ARM64 musl。
+            此 Release 使用 Alpine Linux ARM64 (musl libc) 环境打包。
+
+            **注意**: 实际 Node.js 版本可能与文件名中的版本略有差异（取决于 Alpine 仓库提供的版本），
+            但主版本号 (v22.x) 保证兼容。
+
+            `openclaw-env setup` 会在 ARM64 musl 设备上自动从此处下载。
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f0c7666..b9ab84f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -58,6 +58,22 @@ jobs:
       - name: List outputs
         run: ls -lh dist/
 
+      - name: Extract changelog
+        id: changelog
+        run: |
+          VER="${{ steps.version.outputs.version }}"
+          # 提取当前版本的 CHANGELOG 内容 (从 ## [version] 到下一个 ## [ 之间)
+          CHANGELOG=$(awk "/^## \\[${VER}\\]/{found=1; next} /^## \\[/{if(found) exit} found{print}" CHANGELOG.md)
+          if [ -z "$CHANGELOG" ]; then
+            CHANGELOG="暂无更新日志"
+          fi
+          # 写入多行输出
+          {
+            echo "content<<CHANGELOG_EOF"
+            echo "$CHANGELOG"
+            echo "CHANGELOG_EOF"
+          } >> "$GITHUB_OUTPUT"
+
       - name: Upload artifacts
         uses: actions/upload-artifact@v4
         with:
@@ -78,6 +94,10 @@ jobs:
 
             OpenClaw AI 网关的 OpenWrt LuCI 管理插件。
 
+            ### 更新日志
+
+            ${{ steps.changelog.outputs.content }}
+
             ### 下载说明
 
             | 文件 | 说明 |
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a038523..d874fcd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,29 @@
 
 格式基于 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.0.0/)。
 
+## [1.0.1] - 2026-03-02
+
+### 修复
+- **P0** web-pty.js `loadAuthToken` 读取错误的 UCI key `luci_token` → `pty_token`
+- **P0** init.d `get_oc_entry()` 管道子 shell 导致返回值丢失，改用临时文件重定向
+- **P1** Gateway procd respawn 无限重试 (`3600 5 0`) → 限制最多 5 次 (`3600 5 5`)
+- **P1** Telegram 配对流程管道子 shell 变量丢失，改用临时文件避免子 shell
+- **P1** `openclaw.lua` PID 提取 `sed` 正则不可靠，改用 `awk` + `split`
+- **P2** init.d 和 uci-defaults 弱 token fallback (`echo "auto_$(date +%s)"`) → `dd if=/dev/urandom`
+- **P2** `oc-config.sh` 恢复出厂 `timeout` 命令可能不存在，添加 `command -v` 检查和降级方案
+- **P2** web-pty.js SIGTERM 不清理 HTTPS server，统一 `shutdown()` 函数
+
+### 新增
+- GitHub Copilot 配置新增 OAuth 授权登录方式 (通过 `copilot-proxy` 插件)
+- `uci-defaults` 首次安装时自动生成 `pty_token`
+- Web 控制台和状态面板显示当前活跃模型名称
+
+### 改进
+- Qwen 使用 `models.dashscope` 键名、SiliconFlow 使用 `models.siliconflow`，避免 `models.custom` 键冲突
+- `get_openclaw_version()` 从 `package.json` 读取版本号，不再每次启动 Node.js 进程
+- PTY 终端 WebSocket 重连策略改为无限重连 (`MAX_RETRY=Infinity`)
+- Makefile `PKG_VERSION` 从 `VERSION` 文件动态读取
+
 ## [1.0.0] - 2026-03-02
 
 ### 新增
diff --git a/Makefile b/Makefile
index 0450e7d..9542dff 100644
--- a/Makefile
+++ b/Makefile
@@ -6,7 +6,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-openclaw
-PKG_VERSION:=1.0.0
+PKG_VERSION:=$(strip $(shell cat $(CURDIR)/VERSION 2>/dev/null || echo "1.0.0"))
 PKG_RELEASE:=1
 
 PKG_MAINTAINER:=10000ge10000 <10000ge10000@users.noreply.github.com>
diff --git a/README.md b/README.md
index b9c5e1d..9c07a62 100644
--- a/README.md
+++ b/README.md
@@ -85,7 +85,23 @@ sh /etc/uci-defaults/99-openclaw
 rm -f /tmp/luci-indexcache /tmp/luci-modulecache/*
 ```
 
-## 🔰 首次使用
+## � 一键部署下载
+
+OpenClaw 支持全平台一键部署，请根据你的设备选择对应方式。
+
+> **💡 提示**：OpenWrt 路由器请直接使用下方 [📦 安装](#-安装) 章节的命令，无需使用本节下载包。
+
+| 平台 | 下载链接 | 说明 |
+|------|----------|------|
+| 🐧 Linux (Ubuntu/Debian) | [夸克网盘](https://pan.quark.cn/s/c25bb5c20db1) | 或直接 `curl -fsSL "https://alist.910501.xyz/d/openclaw/install.sh?sign=RUSBfm1vy35Z-2S86e-Hr0s1bR2u_rATHXEpY888zi8=:0" \| bash` |
+| 🪟 Windows (Win10/Win11) | [夸克网盘](https://pan.quark.cn/s/af01a152dad7) | 解压后右键「一键安装.bat」以管理员身份运行 |
+| 🍎 macOS (Intel & Apple Silicon) | [夸克网盘](https://pan.quark.cn/s/99bad2c03e5c) | 解压后 `bash setup.sh` 授权，再双击「一键安装.command」 |
+| 🐂 飞牛 NAS (FnOS) | [夸克网盘](https://pan.quark.cn/s/fea2552a1b73) | 离线 FPK 包，在应用商店「手动安装」 |
+| 📡 OpenWrt 路由器 | [GitHub Releases](https://github.com/10000ge10000/luci-app-openclaw/releases/latest) | 见下方安装章节 |
+
+---
+
+## �🔰 首次使用
 
 1. 打开 LuCI → 服务 → OpenClaw，点击「安装运行环境」
 2. 安装完成后服务会自动启动，点击「刷新页面」查看状态
@@ -118,6 +134,64 @@ luci-app-openclaw/
 └── .github/workflows/build.yml       # GitHub Actions
 ```
 
+## 📡 OpenWrt 路由器专属说明
+
+### 为什么选择路由器部署？
+
+路由器 24 小时在线，天然适合作为 AI 网关的宿主——家里所有设备共享同一个 AI 服务，Telegram / Discord 消息也能全天候响应，无需常开电脑。
+
+### 支持的设备
+
+| 架构 | 典型设备 | 支持状态 |
+|------|----------|----------|
+| x86_64 | N100 / N5105 软路由、iStoreOS 小主机 | ✅ 完全支持 |
+| aarch64 | Raspberry Pi 4/5、R4S、部分 ARM64 路由器 | ✅ 完全支持 |
+| 32 位 ARM | 老款 MT7620 / MT7621 路由器 | ❌ 不支持（Node.js 22 无 32 位包） |
+
+### 安装步骤（OpenWrt / iStoreOS）
+
+**第一步：安装 LuCI 插件**
+
+```bash
+# 推荐：.run 自解压包，一行搞定
+wget https://github.com/10000ge10000/luci-app-openclaw/releases/latest/download/luci-app-openclaw.run
+sh luci-app-openclaw.run
+```
+
+**第二步：安装 OpenClaw 运行环境**
+
+打开 LuCI → **服务** → **OpenClaw** → 点击「📦 安装运行环境」，脚本会自动完成：
+- 检测 CPU 架构（x86_64 / aarch64）
+- 检测 C 库类型（glibc / musl，绝大多数 OpenWrt 为 musl）
+- 下载对应 Node.js 22 预编译包
+- 安装 pnpm 和 OpenClaw 本体
+
+> **网络慢？** 可在路由器 SSH 中指定国内镜像加速 Node.js 下载：
+> ```bash
+> NODE_MIRROR=https://npmmirror.com/mirrors/node openclaw-env setup
+> ```
+
+**第三步：配置 AI 模型和消息渠道**
+
+进入「**配置管理**」页面，在内嵌 Web 终端中使用交互式向导，选数字即可完成配置，支持：
+- OpenAI / Anthropic Claude / Google Gemini / DeepSeek / GitHub Copilot / OpenRouter / 通义千问 / Grok / Groq / 硅基流动 等 12+ 家提供商
+- Telegram / Discord / 飞书 / Slack 消息渠道
+
+**第四步：用 Telegram 与 AI 对话**
+
+配置完 Telegram Bot Token 后，重启网关即可在 Telegram 直接给 Bot 发消息，路由器全天候在线响应。
+
+### 与其他平台脚本的区别
+
+| 对比项 | Linux/Mac/Win 脚本 | OpenWrt 插件 |
+|--------|-------------------|--------------|
+| 管理界面 | 命令行菜单 | LuCI 可视化界面 |
+| 开机自启 | 系统服务 / 守护进程 | procd 托管，崩溃自动重启 |
+| 安装包格式 | .sh / .bat / .command | .run / .ipk |
+| Node.js 来源 | 官方 + npm 镜像 | 自动检测 musl/glibc，按需拉取 |
+
+---
+
 ## ❓ 常见问题
 
 **安装后 LuCI 菜单没有出现**
diff --git a/VERSION b/VERSION
index 3eefcb9..7dea76e 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.0.0
+1.0.1
diff --git a/luasrc/controller/openclaw.lua b/luasrc/controller/openclaw.lua
index efcea54..b09e80c 100644
--- a/luasrc/controller/openclaw.lua
+++ b/luasrc/controller/openclaw.lua
@@ -4,8 +4,27 @@ module("luci.controller.openclaw", package.seeall)
 -- 公共辅助: 获取 OpenClaw 版本号
 local function get_openclaw_version()
 	local sys = require "luci.sys"
-	local ver = sys.exec("[ -x /opt/openclaw/node/bin/node ] && for d in /opt/openclaw/global/lib/node_modules/openclaw /opt/openclaw/global/node_modules/openclaw /opt/openclaw/global/*/node_modules/openclaw; do [ -f \"$d/openclaw.mjs\" ] && /opt/openclaw/node/bin/node \"$d/openclaw.mjs\" --version 2>/dev/null && break; [ -f \"$d/dist/cli.js\" ] && /opt/openclaw/node/bin/node \"$d/dist/cli.js\" --version 2>/dev/null && break; done"):gsub("%s+", "")
-	return ver
+	-- 优先从 package.json 读取版本号 (轻量)，避免每次启动 node 进程
+	local dirs = {
+		"/opt/openclaw/global/lib/node_modules/openclaw",
+		"/opt/openclaw/global/node_modules/openclaw",
+	}
+	-- pnpm 版本目录
+	local pnpm_glob = sys.exec("ls -d /opt/openclaw/global/*/node_modules/openclaw 2>/dev/null"):gsub("%s+$", "")
+	for d in pnpm_glob:gmatch("[^\n]+") do
+		dirs[#dirs + 1] = d
+	end
+	for _, d in ipairs(dirs) do
+		local pkg = d .. "/package.json"
+		local f = io.open(pkg, "r")
+		if f then
+			local content = f:read("*a")
+			f:close()
+			local ver = content:match('"version"%s*:%s*"([^"]+)"')
+			if ver and ver ~= "" then return ver end
+		end
+	end
+	return ""
 end
 
 function index()
@@ -99,9 +118,22 @@ function action_status()
 	local pty_check = sys.exec("netstat -tlnp 2>/dev/null | grep -c ':" .. pty_port .. " ' || echo 0"):gsub("%s+", "")
 	result.pty_running = (tonumber(pty_check) or 0) > 0
 
+	-- 读取当前活跃模型
+	local config_file = "/opt/openclaw/data/.openclaw/openclaw.json"
+	local cf = io.open(config_file, "r")
+	if cf then
+		local content = cf:read("*a")
+		cf:close()
+		-- 简单正则提取 "primary": "xxx"
+		local model = content:match('"primary"%s*:%s*"([^"]+)"')
+		if model and model ~= "" then
+			result.active_model = model
+		end
+	end
+
 	-- PID 和内存
 	if result.gateway_running then
-		local pid = sys.exec("netstat -tlnp 2>/dev/null | grep ':" .. port .. " ' | head -1 | sed 's|.* \\([0-9]*\\)/.*|\\1|'"):gsub("%s+", "")
+		local pid = sys.exec("netstat -tlnp 2>/dev/null | awk '/:" .. port .. " /{split($NF,a,\"/\");print a[1];exit}'"):gsub("%s+", "")
 		if pid and pid ~= "" then
 			result.pid = pid
 			-- 内存 (VmRSS from /proc)
diff --git a/luasrc/view/openclaw/console.htm b/luasrc/view/openclaw/console.htm
index da796b1..ccde507 100644
--- a/luasrc/view/openclaw/console.htm
+++ b/luasrc/view/openclaw/console.htm
@@ -73,6 +73,9 @@ local port = uci:get("openclaw", "main", "port") or "18789"
 	<span class="label">网关地址：</span>
 	<span class="value" id="oc-console-addr">-</span>
 	<span class="sep">|</span>
+	<span class="label">活跃模型：</span>
+	<span class="value" id="oc-console-model" style="color:#555;">-</span>
+	<span class="sep">|</span>
 	<span class="label">状态：</span>
 	<span id="oc-console-status-text">检查中...</span>
 	<a id="oc-console-open-btn" class="btn-open" href="#" target="_blank" rel="noopener" style="display:none;">
@@ -99,6 +102,7 @@ local port = uci:get("openclaw", "main", "port") or "18789"
 	var container = document.getElementById('oc-console-container');
 	var loading = document.getElementById('oc-console-loading');
 	var addrEl = document.getElementById('oc-console-addr');
+	var modelEl = document.getElementById('oc-console-model');
 	var statusTextEl = document.getElementById('oc-console-status-text');
 	var openBtn = document.getElementById('oc-console-open-btn');
 
@@ -124,6 +128,9 @@ local port = uci:get("openclaw", "main", "port") or "18789"
 				try {
 					var d = JSON.parse(x.responseText);
 					var url = getConsoleUrl();
+					if (d.active_model) {
+						modelEl.textContent = d.active_model;
+					}
 					if (d.gateway_running) {
 						statusTextEl.innerHTML = '<span style="color:#1a7f37;">● 网关运行中</span>';
 						openBtn.href = url;
diff --git a/luasrc/view/openclaw/status.htm b/luasrc/view/openclaw/status.htm
index 1f9397f..1d2809b 100644
--- a/luasrc/view/openclaw/status.htm
+++ b/luasrc/view/openclaw/status.htm
@@ -69,6 +69,7 @@
 			<tr><td>运行状态</td><td id="oc-st-status"><span class="oc-badge oc-badge-unknown">加载中...</span></td></tr>
 			<tr><td>网关服务</td><td id="oc-st-gateway">-</td></tr>
 			<tr><td>配置终端</td><td id="oc-st-pty">-</td></tr>
+			<tr><td>活跃模型</td><td id="oc-st-model">-</td></tr>
 			<tr><td>进程 PID</td><td id="oc-st-pid">-</td></tr>
 			<tr><td>内存占用</td><td id="oc-st-mem">-</td></tr>
 			<tr><td>运行时间</td><td id="oc-st-uptime">-</td></tr>
@@ -113,6 +114,13 @@
 
 				document.getElementById('oc-st-pid').textContent = d.pid || '-';
 
+				var modelEl = document.getElementById('oc-st-model');
+				if (d.active_model) {
+					modelEl.innerHTML = '<code style="padding:2px 8px;background:#f0f3f6;border-radius:4px;font-size:12px;">' + d.active_model + '</code>';
+				} else {
+					modelEl.textContent = '未配置';
+				}
+
 				var memEl = document.getElementById('oc-st-mem');
 				if (d.memory_kb > 0) {
 					var mb = (d.memory_kb / 1024).toFixed(1);
diff --git a/root/etc/init.d/openclaw b/root/etc/init.d/openclaw
index 3d562aa..74be67b 100755
--- a/root/etc/init.d/openclaw
+++ b/root/etc/init.d/openclaw
@@ -27,17 +27,22 @@ for ver_dir in "${OC_GLOBAL}"/*/node_modules/openclaw; do
 $ver_dir"
 done
 
-local d
-echo "$search_dirs" | while read -r d; do
+local d _tmpf
+_tmpf=$(mktemp)
+echo "$search_dirs" > "$_tmpf"
+while read -r d; do
 [ -z "$d" ] && continue
 if [ -f "${d}/openclaw.mjs" ]; then
 echo "${d}/openclaw.mjs"
+rm -f "$_tmpf"
 return
 elif [ -f "${d}/dist/cli.js" ]; then
 echo "${d}/dist/cli.js"
+rm -f "$_tmpf"
 return
 fi
-done
+done < "$_tmpf"
+rm -f "$_tmpf"
 }
 
 patch_iframe_headers() {
@@ -75,7 +80,7 @@ fi
 
 # 如果仍然没有 token，生成一个新的
 if [ -z "$token" ]; then
-	token=$(head -c 24 /dev/urandom | hexdump -e '24/1 "%02x"' 2>/dev/null || openssl rand -hex 24 2>/dev/null || echo "auto_$(date +%s)")
+	token=$(head -c 24 /dev/urandom | hexdump -e '24/1 "%02x"' 2>/dev/null || openssl rand -hex 24 2>/dev/null || dd if=/dev/urandom bs=24 count=1 2>/dev/null | od -An -tx1 | tr -d ' \n' | head -c 48)
 fi
 
 # 确保 token 写回 UCI
@@ -176,18 +181,22 @@ OC_GLOBAL="$OC_GLOBAL" \
 OC_DATA="$OC_DATA" \
 PATH="${NODE_BASE}/bin:${OC_GLOBAL}/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 procd_set_param user openclaw
-procd_set_param respawn 3600 5 0
+procd_set_param respawn 3600 5 5
 procd_set_param stdout 1
 procd_set_param stderr 1
 procd_set_param pidfile /var/run/openclaw.pid
 procd_close_instance
 
 # 启动 Web PTY 配置终端 (辅助服务)
-# 生成 PTY 会话 token 用于 WebSocket 认证
+# 复用已有 PTY token，只在不存在时才生成新的
+# 这样避免服务重启时 PTY WebSocket 连接因 token 变化而断开
 local pty_token
-pty_token=$(head -c 16 /dev/urandom | hexdump -e '16/1 "%02x"' 2>/dev/null || openssl rand -hex 16 2>/dev/null || echo "pty_$(date +%s)")
-uci set openclaw.main.pty_token="$pty_token"
-uci commit openclaw 2>/dev/null
+pty_token=$(uci -q get openclaw.main.pty_token || echo "")
+if [ -z "$pty_token" ]; then
+	pty_token=$(head -c 16 /dev/urandom | hexdump -e '16/1 "%02x"' 2>/dev/null || openssl rand -hex 16 2>/dev/null || echo "pty_$(date +%s)")
+	uci set openclaw.main.pty_token="$pty_token"
+	uci commit openclaw 2>/dev/null
+fi
 
 procd_open_instance "pty"
 procd_set_param command "$NODE_BIN" /usr/share/openclaw/web-pty.js
@@ -230,24 +239,57 @@ echo "正在调用 openclaw-env setup..."
 }
 
 restart_gateway() {
-# 仅重启 Gateway procd 实例，不影响 Web PTY
-# 使用 stop+start 而非 kill，可重置 procd crash loop 计数器
+# 仅重启 Gateway 进程，通过 kill 触发 procd respawn
+# 绝对不能调用 start_service，否则会重启 PTY 实例
+
 local port
 port=$(uci -q get openclaw.main.port || echo "18789")
 
-# 停止 gateway 实例 (通过 ubus，不影响 PTY 实例)
-ubus call service stop '{"name":"openclaw","instance":"gateway"}' 2>/dev/null || true
+# ── 第一步: kill 监听端口的 gateway 子进程 (openclaw-gateway) ──
+# openclaw 启动后会 fork 出 openclaw-gateway 子进程实际监听端口
+# 必须先杀子进程释放端口，否则 procd respawn 的新实例会因端口冲突而崩溃
+local port_pid=""
+if command -v ss >/dev/null 2>&1; then
+	port_pid=$(ss -tlnp 2>/dev/null | grep ":${port} " | sed -n 's/.*pid=\([0-9]*\).*/\1/p' | head -1)
+else
+	port_pid=$(netstat -tlnp 2>/dev/null | grep ":${port} " | sed -n 's|.* \([0-9]*\)/.*|\1|p' | head -1)
+fi
+[ -n "$port_pid" ] && kill "$port_pid" 2>/dev/null
 
-# 等待端口释放
-local i=0
-while [ $i -lt 8 ]; do
-	netstat -tln 2>/dev/null | grep -q ":${port} " || break
-	sleep 1; i=$((i+1))
+# ── 第二步: kill procd 管理的 gateway 主进程 (openclaw) ──
+# procd 追踪的是主进程 PID，kill 它才能触发 respawn
+local gw_pid=""
+gw_pid=$(ubus call service list '{"name":"openclaw"}' 2>/dev/null | \
+	jsonfilter -e '$.openclaw.instances.gateway.pid' 2>/dev/null) || true
+
+if [ -n "$gw_pid" ] && kill -0 "$gw_pid" 2>/dev/null; then
+	kill "$gw_pid" 2>/dev/null
+fi
+
+# ── 第三步: 兜底 — kill 所有 openclaw gateway 相关残留进程 ──
+# 避免任何残留进程占据端口
+sleep 1
+for pid in $(pgrep -f "openclaw-gateway" 2>/dev/null) $(pgrep -f "openclaw.*gateway.*run" 2>/dev/null); do
+	kill "$pid" 2>/dev/null
 done
 
-# 重新启动整个服务 (procd 会重建 gateway 实例，同时保留 PTY 实例)
-# procd 的 start_service 幂等：已运行的实例不会重复启动
-/etc/init.d/openclaw start >/dev/null 2>&1
+# ── 第四步: 等待端口真正释放 (最多 5 秒) ──
+local wait_count=0
+while [ $wait_count -lt 5 ]; do
+	if command -v ss >/dev/null 2>&1; then
+		ss -tlnp 2>/dev/null | grep -q ":${port} " || break
+	else
+		netstat -tlnp 2>/dev/null | grep -q ":${port} " || break
+	fi
+	sleep 1
+	wait_count=$((wait_count + 1))
+done
+
+# ── 第五步: 如果 procd 中没有 gateway 服务注册 (首次/崩溃)，调用 start ──
+if [ -z "$gw_pid" ]; then
+	/etc/init.d/openclaw start >/dev/null 2>&1
+fi
+# 如果 gw_pid 存在，procd respawn 会自动重启 gateway
 }
 
 status_service() {
diff --git a/root/etc/uci-defaults/99-openclaw b/root/etc/uci-defaults/99-openclaw
index d81bcec..a046eed 100755
--- a/root/etc/uci-defaults/99-openclaw
+++ b/root/etc/uci-defaults/99-openclaw
@@ -33,9 +33,17 @@ chown -R openclaw:openclaw /opt/openclaw 2>/dev/null || true
 # 生成随机 Token (如果尚未设置)
 CURRENT_TOKEN=$(uci -q get openclaw.main.token)
 if [ -z "$CURRENT_TOKEN" ]; then
-	TOKEN=$(head -c 24 /dev/urandom | hexdump -e '24/1 "%02x"' 2>/dev/null || openssl rand -hex 24 2>/dev/null || echo "changeme_$(date +%s)")
+	TOKEN=$(head -c 24 /dev/urandom | hexdump -e '24/1 "%02x"' 2>/dev/null || dd if=/dev/urandom bs=24 count=1 2>/dev/null | od -An -tx1 | tr -d ' \n' | head -c 48)
 	uci set openclaw.main.token="$TOKEN"
 	uci commit openclaw
 fi
 
+# 生成 PTY Token (如果尚未设置)
+CURRENT_PTY_TOKEN=$(uci -q get openclaw.main.pty_token)
+if [ -z "$CURRENT_PTY_TOKEN" ]; then
+	PTY_TOKEN=$(head -c 24 /dev/urandom | hexdump -e '24/1 "%02x"' 2>/dev/null || dd if=/dev/urandom bs=24 count=1 2>/dev/null | od -An -tx1 | tr -d ' \n' | head -c 48)
+	uci set openclaw.main.pty_token="$PTY_TOKEN"
+	uci commit openclaw
+fi
+
 exit 0
diff --git a/root/usr/bin/openclaw-env b/root/usr/bin/openclaw-env
index 1b8323e..a6fdbf5 100755
--- a/root/usr/bin/openclaw-env
+++ b/root/usr/bin/openclaw-env
@@ -23,10 +23,13 @@ NODE_BIN="${NODE_BASE}/bin/node"
 NPM_BIN="${NODE_BASE}/bin/npm"
 PNPM_BIN="${OC_GLOBAL}/bin/pnpm"
 
+# Node.js 官方镜像 + musl 非官方构建
 # Node.js 官方镜像 + musl 非官方构建
 NODE_MIRROR="${NODE_MIRROR:-https://nodejs.org/dist}"
 NODE_MIRROR_CN="https://npmmirror.com/mirrors/node"
 NODE_MUSL_MIRROR="https://unofficial-builds.nodejs.org/download/release"
+# 项目自托管 ARM64 musl Node.js (unofficial-builds 仅提供 x64 musl)
+NODE_SELF_HOST="https://github.com/10000ge10000/luci-app-openclaw/releases/download/node-bins"
 
 export PATH="${NODE_BASE}/bin:${OC_GLOBAL}/bin:$PATH"
 
@@ -99,26 +102,7 @@ download_node() {
 	local libc_type
 	libc_type=$(detect_libc)
 
-	local tarball=""
-	local url="" url_fallback=""
-
-	if [ "$libc_type" = "musl" ]; then
-		tarball="node-v${node_ver}-${node_arch}-musl.tar.xz"
-		url="${NODE_MUSL_MIRROR}/v${node_ver}/${tarball}"
-		url_fallback=""
-		echo ""
-		echo "=== 下载 Node.js v${node_ver} (${node_arch}, musl libc) ==="
-	else
-		tarball="node-v${node_ver}-${node_arch}.tar.xz"
-		url="${NODE_MIRROR}/v${node_ver}/${tarball}"
-		url_fallback="${NODE_MIRROR_CN}/v${node_ver}/${tarball}"
-		echo ""
-		echo "=== 下载 Node.js v${node_ver} (${node_arch}, glibc) ==="
-	fi
-
-	local tmp_file="/tmp/${tarball}"
-
-	# 如果已存在且版本正确, 跳过
+	# 如果已存在且版本兼容, 跳过
 	if [ -x "$NODE_BIN" ]; then
 		local current_ver
 		current_ver=$("$NODE_BIN" --version 2>/dev/null | sed 's/^v//')
@@ -126,19 +110,67 @@ download_node() {
 			log_info "Node.js v${node_ver} 已安装, 跳过下载"
 			return 0
 		fi
+		# ARM64 musl 使用 Alpine 打包，版本号可能不完全匹配
+		# 只要主版本号相同即认为兼容 (如 22.15.1 vs 22.16.0)
+		local cur_major=$(echo "$current_ver" | cut -d. -f1)
+		local want_major=$(echo "$node_ver" | cut -d. -f1)
+		if [ "$cur_major" = "$want_major" ]; then
+			log_info "Node.js v${current_ver} 已安装 (兼容 v${node_ver}), 跳过下载"
+			return 0
+		fi
 		log_warn "当前 Node.js v${current_ver}, 将更新到 v${node_ver}"
 	fi
 
-	# 下载 (带重试)
+	# ── 构建下载 URL 列表 (按优先级排列) ──
+	local mirror_list=""
+	local musl_tarball="node-v${node_ver}-${node_arch}-musl.tar.xz"
+	local glibc_tarball="node-v${node_ver}-${node_arch}.tar.xz"
+
+	if [ "$libc_type" = "musl" ]; then
+		echo ""
+		echo "=== 下载 Node.js v${node_ver} (${node_arch}, musl libc) ==="
+
+		if [ "$node_arch" = "linux-arm64" ]; then
+			# ARM64 musl: unofficial-builds 不提供，从项目自托管下载
+			# 1) 项目自托管 ARM64 musl 构建
+			mirror_list="${NODE_SELF_HOST}/${musl_tarball}"
+			# 2) unofficial-builds (留作将来可能支持)
+			mirror_list="$mirror_list ${NODE_MUSL_MIRROR}/v${node_ver}/${musl_tarball}"
+		else
+			# x64 musl: unofficial-builds 提供
+			# 1) unofficial-builds
+			mirror_list="${NODE_MUSL_MIRROR}/v${node_ver}/${musl_tarball}"
+			# 2) npmmirror 镜像
+			mirror_list="$mirror_list ${NODE_MIRROR_CN}/v${node_ver}/${musl_tarball}"
+		fi
+	else
+		echo ""
+		echo "=== 下载 Node.js v${node_ver} (${node_arch}, glibc) ==="
+
+		mirror_list="${NODE_MIRROR}/v${node_ver}/${glibc_tarball}"
+		mirror_list="$mirror_list ${NODE_MIRROR_CN}/v${node_ver}/${glibc_tarball}"
+	fi
+
+	# ── 逐个尝试下载 ──
 	local downloaded=0
-	local mirror_list="$url"
-	[ -n "$url_fallback" ] && mirror_list="$url $url_fallback"
+	local tmp_file="/tmp/node-v${node_ver}.tar.xz"
+	local attempt=0
+	local total=$(echo "$mirror_list" | wc -w)
+
 	for mirror_url in $mirror_list; do
-		echo "  正在从 ${mirror_url} 下载..."
+		attempt=$((attempt + 1))
+		echo "  正在从 ${mirror_url} 下载... (${attempt}/${total})"
 		if curl -fSL --connect-timeout 15 --max-time 300 -o "$tmp_file" "$mirror_url" 2>/dev/null || \
 		   wget -q --timeout=15 -O "$tmp_file" "$mirror_url" 2>/dev/null; then
-			downloaded=1
-			break
+			# 校验文件大小 (Node.js xz 压缩包至少 5MB; Alpine 精简包约 12MB, 官方完整包约 30MB)
+			local fsize=$(wc -c < "$tmp_file" 2>/dev/null || echo 0)
+			if [ "$fsize" -gt 5000000 ] 2>/dev/null; then
+				downloaded=1
+				break
+			else
+				log_warn "文件大小异常 (${fsize} bytes), 跳过"
+				rm -f "$tmp_file"
+			fi
 		fi
 		log_warn "下载失败, 尝试备用镜像..."
 	done
@@ -158,7 +190,9 @@ download_node() {
 
 	# 验证
 	if [ -x "$NODE_BIN" ]; then
-		log_info "Node.js $($NODE_BIN --version) 安装成功"
+		local installed_ver
+		installed_ver=$("$NODE_BIN" --version 2>/dev/null || echo "unknown")
+		log_info "Node.js ${installed_ver} 安装成功"
 	else
 		log_error "Node.js 安装验证失败"
 		exit 1
diff --git a/root/usr/share/openclaw/oc-config.sh b/root/usr/share/openclaw/oc-config.sh
index 5009a01..61d9086 100755
--- a/root/usr/share/openclaw/oc-config.sh
+++ b/root/usr/share/openclaw/oc-config.sh
@@ -164,14 +164,13 @@ restart_gateway() {
 	port=$(json_get gateway.port)
 	port=${port:-18789}
 
-	# ── 使用 init.d restart_gateway: 只重启 Gateway 实例，不影响 PTY 终端 ──
-	# 发 SIGTERM 给 gateway 进程，procd 自动 respawn，避免 crash loop 计数累积
+	# ── kill gateway 进程，让 procd respawn ──
 	/etc/init.d/openclaw restart_gateway >/dev/null 2>&1
 
-	# ── 等待端口监听，最多 60 秒 (Node.js 冷启动实测约 40 秒) ──
-	echo -e "  ${YELLOW}⏳ Gateway 启动中，请稍候 (约 40 秒)...${NC}"
+	# ── 等待端口恢复 (最多 30 秒，含端口释放 + Node.js 冷启动) ──
+	echo -e "  ${YELLOW}⏳ Gateway 启动中，请稍候 (约 15-30 秒)...${NC}"
 	local waited=0
-	while [ $waited -lt 60 ]; do
+	while [ $waited -lt 30 ]; do
 		sleep 3
 		waited=$((waited + 3))
 		if check_port_listening "$port"; then
@@ -180,28 +179,10 @@ restart_gateway() {
 		fi
 	done
 
-	# ── 超时仍未就绪: 先确认进程是否其实已经在运行 ──
-	# (可能端口刚好在轮询间隙启动完成)
-	if check_port_listening "$port"; then
-		echo -e "  ${GREEN}✅ Gateway 已重启成功${NC}"
-		return 0
-	fi
-
-	# ── 确实未启动: 可能 procd crash loop 保护触发，用 start 解除 ──
-	echo -e "  ${YELLOW}⏳ 正在尝试再次启动...${NC}"
-	/etc/init.d/openclaw start >/dev/null 2>&1 &
-	waited=0
-	while [ $waited -lt 30 ]; do
-		sleep 3
-		waited=$((waited + 3))
-		if check_port_listening "$port"; then
-			echo -e "  ${GREEN}✅ Gateway 已重启成功${NC}"
-			return 0
-		fi
-	done
-
-	echo -e "  ${RED}❌ Gateway 可能未正常启动${NC}"
+	# 30 秒内没就绪，提示用户但不继续阻塞
+	echo -e "  ${YELLOW}⏳ Gateway 仍在启动中，请稍后确认${NC}"
 	echo -e "  ${CYAN}   查看日志: logread -e openclaw${NC}"
+	echo ""
 }
 
 ask_restart() {
@@ -474,32 +455,53 @@ configure_model() {
 		7)
 			echo ""
 			echo -e "  ${BOLD}GitHub Copilot 配置${NC}"
-			echo -e "  ${YELLOW}需要有效的 GitHub Copilot 订阅${NC}"
-			echo -e "  ${YELLOW}获取 Token: https://github.com/settings/tokens (需 copilot 权限)${NC}"
+			echo -e "  ${YELLOW}需要有效的 GitHub Copilot 订阅 (Free/Pro/Business 均可)${NC}"
+			echo -e "  ${YELLOW}使用 OAuth 自动认证，无需手动输入 Token${NC}"
 			echo ""
-			prompt_with_default "请输入 GitHub Token (ghp_...)" "" api_key
-			if [ -n "$api_key" ]; then
-				json_set models.github-copilot.apiKey "$api_key"
-				echo ""
-				echo -e "  ${CYAN}可用模型:${NC}"
-				echo -e "    ${CYAN}a)${NC} github-copilot/claude-sonnet-4 — Claude Sonnet 4 (推荐)"
-				echo -e "    ${CYAN}b)${NC} github-copilot/gpt-5.2         — GPT-5.2"
-				echo -e "    ${CYAN}c)${NC} github-copilot/gemini-2.5-pro  — Gemini 2.5 Pro"
-				echo -e "    ${CYAN}d)${NC} github-copilot/o3              — o3"
-				echo -e "    ${CYAN}e)${NC} 手动输入模型名"
-				echo ""
-				prompt_with_default "请选择模型" "a" model_choice
-				case "$model_choice" in
-					a) model_name="github-copilot/claude-sonnet-4" ;;
-					b) model_name="github-copilot/gpt-5.2" ;;
-					c) model_name="github-copilot/gemini-2.5-pro" ;;
-					d) model_name="github-copilot/o3" ;;
-					e) prompt_with_default "请输入模型名称" "github-copilot/claude-sonnet-4" model_name ;;
-					*) model_name="github-copilot/claude-sonnet-4" ;;
-				esac
-				json_set agents.defaults.model.primary "$model_name"
-				echo -e "  ${GREEN}✅ GitHub Copilot 已配置，活跃模型: ${model_name}${NC}"
-			fi
+			echo -e "  ${CYAN}配置方式:${NC}"
+			echo -e "    ${CYAN}a)${NC} 通过 OAuth 授权登录 (推荐)"
+			echo -e "    ${CYAN}b)${NC} 手动输入 GitHub Token (ghp_...)"
+			echo ""
+			prompt_with_default "请选择" "a" copilot_mode
+			case "$copilot_mode" in
+				a)
+					echo ""
+					echo -e "  ${CYAN}启用 Copilot Proxy 插件...${NC}"
+					enable_auth_plugins
+					echo -e "  ${CYAN}启动 GitHub Copilot OAuth 授权...${NC}"
+					oc_cmd models auth login --provider copilot-proxy --set-default || echo -e "  ${YELLOW}OAuth 授权已退出${NC}"
+					echo ""
+					ask_restart
+					;;
+				b|*)
+					echo ""
+					echo -e "  ${YELLOW}获取 Token: https://github.com/settings/tokens (需 copilot 权限)${NC}"
+					echo ""
+					prompt_with_default "请输入 GitHub Token (ghp_...)" "" api_key
+					if [ -n "$api_key" ]; then
+						json_set models.github-copilot.apiKey "$api_key"
+						echo ""
+						echo -e "  ${CYAN}可用模型:${NC}"
+						echo -e "    ${CYAN}a)${NC} github-copilot/claude-sonnet-4 — Claude Sonnet 4 (推荐)"
+						echo -e "    ${CYAN}b)${NC} github-copilot/gpt-5.2         — GPT-5.2"
+						echo -e "    ${CYAN}c)${NC} github-copilot/gemini-2.5-pro  — Gemini 2.5 Pro"
+						echo -e "    ${CYAN}d)${NC} github-copilot/o3              — o3"
+						echo -e "    ${CYAN}e)${NC} 手动输入模型名"
+						echo ""
+						prompt_with_default "请选择模型" "a" model_choice
+						case "$model_choice" in
+							a) model_name="github-copilot/claude-sonnet-4" ;;
+							b) model_name="github-copilot/gpt-5.2" ;;
+							c) model_name="github-copilot/gemini-2.5-pro" ;;
+							d) model_name="github-copilot/o3" ;;
+							e) prompt_with_default "请输入模型名称" "github-copilot/claude-sonnet-4" model_name ;;
+							*) model_name="github-copilot/claude-sonnet-4" ;;
+						esac
+						json_set agents.defaults.model.primary "$model_name"
+						echo -e "  ${GREEN}✅ GitHub Copilot 已配置，活跃模型: ${model_name}${NC}"
+					fi
+					;;
+			esac
 			;;
 		8)
 			echo ""
@@ -527,8 +529,8 @@ configure_model() {
 					echo ""
 					prompt_with_default "请输入阿里云 API Key (sk-...)" "" api_key
 					if [ -n "$api_key" ]; then
-						json_set models.custom.apiKey "$api_key"
-						json_set models.custom.baseUrl "https://dashscope.aliyuncs.com/compatible-mode/v1"
+						json_set models.dashscope.apiKey "$api_key"
+						json_set models.dashscope.baseUrl "https://dashscope.aliyuncs.com/compatible-mode/v1"
 						echo ""
 						echo -e "  ${CYAN}可用模型:${NC}"
 						echo -e "    ${CYAN}a)${NC} qwen-max        — 通义千问旗舰 (推荐)"
@@ -613,8 +615,8 @@ configure_model() {
 			echo ""
 			prompt_with_default "请输入 SiliconFlow API Key" "" api_key
 			if [ -n "$api_key" ]; then
-				json_set models.custom.apiKey "$api_key"
-				json_set models.custom.baseUrl "https://api.siliconflow.cn/v1"
+				json_set models.siliconflow.apiKey "$api_key"
+				json_set models.siliconflow.baseUrl "https://api.siliconflow.cn/v1"
 				echo ""
 				echo -e "  ${CYAN}可用模型:${NC}"
 				echo -e "    ${CYAN}a)${NC} deepseek-ai/DeepSeek-V3      — DeepSeek V3 (推荐)"
@@ -924,8 +926,10 @@ telegram_pairing() {
 		fi
 
 		if [ -n "$codes" ]; then
-			# ash 不支持 <<<, 使用 echo | while
-			echo "$codes" | while IFS= read -r code; do
+			# 逐个处理配对码 (避免管道子 shell 变量丢失问题)
+			local _codes_tmp="/tmp/oc_pair_codes_$$"
+			echo "$codes" > "$_codes_tmp"
+			while IFS= read -r code; do
 				[ -z "$code" ] && continue
 				echo -e "  ${CYAN}发现配对请求: ${code}${NC}"
 				local approve=$(oc_cmd pairing approve telegram "$code" 2>&1)
@@ -933,7 +937,8 @@ telegram_pairing() {
 					echo ""
 					echo -e "  ${GREEN}${BOLD}🎉 Telegram 配对成功！${NC}"
 				fi
-			done
+			done < "$_codes_tmp"
+			rm -f "$_codes_tmp"
 			# 检查是否还有待配对的
 			local re_check=$(oc_cmd pairing list telegram --json 2>/dev/null || echo "")
 			local re_codes=$(echo "$re_check" | grep -o '"code"[[:space:]]*:[[:space:]]*"[^"]*"' | cut -d'"' -f4)
@@ -1170,7 +1175,17 @@ reset_to_defaults() {
 
 				echo -e "  ${CYAN}[4/5] 重新初始化...${NC}"
 				# 尝试 onboard，超时 10 秒避免阻塞
-				timeout 10 sh -c "$(which node 2>/dev/null || echo "$NODE_BIN") \"$OC_ENTRY\" onboard --non-interactive --accept-risk" >/dev/null 2>&1 || true
+				local _node_bin
+				_node_bin=$(which node 2>/dev/null || echo "$NODE_BIN")
+				if command -v timeout >/dev/null 2>&1; then
+					timeout 10 sh -c "\"$_node_bin\" \"$OC_ENTRY\" onboard --non-interactive --accept-risk" >/dev/null 2>&1 || true
+				else
+					"$_node_bin" "$OC_ENTRY" onboard --non-interactive --accept-risk >/dev/null 2>&1 &
+					local _ob_pid=$!
+					sleep 10
+					kill "$_ob_pid" 2>/dev/null || true
+					wait "$_ob_pid" 2>/dev/null || true
+				fi
 				echo -e "  ${GREEN}   初始化完成${NC}"
 
 				echo -e "  ${CYAN}[5/5] 应用 OpenWrt 适配配置...${NC}"
diff --git a/root/usr/share/openclaw/ui/index.html b/root/usr/share/openclaw/ui/index.html
index 18d8df1..768e850 100644
--- a/root/usr/share/openclaw/ui/index.html
+++ b/root/usr/share/openclaw/ui/index.html
@@ -135,7 +135,7 @@
   let ws = null;
   let connected = false;
   let retryCount = 0;
-  const MAX_RETRY = 20;
+  const MAX_RETRY = Infinity;
   let retryTimer = null;
   let wasEverConnected = false;
 
diff --git a/root/usr/share/openclaw/web-pty.js b/root/usr/share/openclaw/web-pty.js
index 28b415e..5c5855e 100644
--- a/root/usr/share/openclaw/web-pty.js
+++ b/root/usr/share/openclaw/web-pty.js
@@ -29,7 +29,7 @@ const MAX_SESSIONS = parseInt(process.env.OC_MAX_SESSIONS || '5', 10);
 function loadAuthToken() {
   try {
     const { execSync } = require('child_process');
-    const t = execSync('uci -q get openclaw.main.luci_token 2>/dev/null', { encoding: 'utf8', timeout: 3000 }).trim();
+    const t = execSync('uci -q get openclaw.main.pty_token 2>/dev/null', { encoding: 'utf8', timeout: 3000 }).trim();
     return t || '';
   } catch { return ''; }
 }
@@ -263,6 +263,7 @@ function handleUpgrade(req, socket, head) {
 // ── 服务器实例 ──
 const httpServer = http.createServer(handleRequest);
 httpServer.on('upgrade', handleUpgrade);
+let httpsServer = null;
 
 httpServer.listen(PORT, HOST, () => {
   console.log(`[oc-config] HTTP listening on ${HOST}:${PORT}`);
@@ -273,7 +274,7 @@ httpServer.listen(PORT, HOST, () => {
 const HTTPS_PORT = PORT + 1;
 try {
   if (fs.existsSync(SSL_CERT) && fs.existsSync(SSL_KEY)) {
-    const httpsServer = https.createServer({ cert: fs.readFileSync(SSL_CERT), key: fs.readFileSync(SSL_KEY) }, handleRequest);
+    httpsServer = https.createServer({ cert: fs.readFileSync(SSL_CERT), key: fs.readFileSync(SSL_KEY) }, handleRequest);
     httpsServer.on('upgrade', handleUpgrade);
     httpsServer.listen(HTTPS_PORT, HOST, () => console.log(`[oc-config] HTTPS listening on ${HOST}:${HTTPS_PORT}`));
     httpsServer.on('error', (e) => console.log(`[oc-config] HTTPS port ${HTTPS_PORT}: ${e.message}`));
@@ -281,5 +282,6 @@ try {
 } catch (e) { console.log(`[oc-config] SSL init: ${e.message}`); }
 
 httpServer.on('error', (e) => { console.error(`[oc-config] Fatal: ${e.message}`); process.exit(1); });
-process.on('SIGTERM', () => { console.log('[oc-config] Shutdown'); httpServer.close(); process.exit(0); });
-process.on('SIGINT', () => { httpServer.close(); process.exit(0); });
+function shutdown() { console.log('[oc-config] Shutdown'); httpServer.close(); if (httpsServer) httpsServer.close(); process.exit(0); }
+process.on('SIGTERM', shutdown);
+process.on('SIGINT', shutdown);
diff --git a/scripts/build-node-musl.sh b/scripts/build-node-musl.sh
new file mode 100755
index 0000000..31158c0
--- /dev/null
+++ b/scripts/build-node-musl.sh
@@ -0,0 +1,42 @@
+#!/bin/sh
+# 在 Alpine ARM64 Docker 容器内运行
+# 环境变量: NODE_VER (目标版本号), /output (输出目录)
+set -e
+
+apk add --no-cache nodejs npm xz
+
+ACTUAL_VER=$(node --version | sed 's/^v//')
+echo "Alpine Node.js version: v${ACTUAL_VER} (requested: v${NODE_VER})"
+
+# 打包为 portable tarball (与官方 tarball 相同结构)
+PKG_NAME="node-v${NODE_VER}-linux-arm64-musl"
+PKG_DIR="/tmp/${PKG_NAME}"
+mkdir -p "${PKG_DIR}/bin" "${PKG_DIR}/lib/node_modules" "${PKG_DIR}/include/node"
+
+cp "$(which node)" "${PKG_DIR}/bin/"
+chmod +x "${PKG_DIR}/bin/node"
+
+# 复制 npm
+if [ -d /usr/lib/node_modules/npm ]; then
+  cp -r /usr/lib/node_modules/npm "${PKG_DIR}/lib/node_modules/"
+fi
+
+# 创建 npm wrapper
+printf '#!/bin/sh\nexec "$(dirname "$0")/node" "$(dirname "$0")/../lib/node_modules/npm/bin/npm-cli.js" "$@"\n' \
+  > "${PKG_DIR}/bin/npm"
+# 创建 npx wrapper
+printf '#!/bin/sh\nexec "$(dirname "$0")/node" "$(dirname "$0")/../lib/node_modules/npm/bin/npx-cli.js" "$@"\n' \
+  > "${PKG_DIR}/bin/npx"
+chmod +x "${PKG_DIR}/bin/npm" "${PKG_DIR}/bin/npx"
+
+# 验证
+echo "=== Verification ==="
+"${PKG_DIR}/bin/node" --version
+"${PKG_DIR}/bin/node" -e "console.log(process.arch, process.platform, process.versions.modules)"
+"${PKG_DIR}/bin/npm" --version 2>/dev/null || echo "npm wrapper created"
+
+# 打包
+cd /tmp
+tar cJf "/output/${PKG_NAME}.tar.xz" "${PKG_NAME}"
+ls -lh "/output/${PKG_NAME}.tar.xz"
+echo "=== Done: ${PKG_NAME}.tar.xz ==="