@clawscarf/cli 0.1.0-alpha.1

package/scripts/installation/resolve.js

@@ -0,0 +1,217 @@
+import { verifyReleaseTool } from "./files.js";
+import { hostedOidc, hostedConnections } from "../cloud/registration.js";
+import { dirname, resolve, join } from "node:path";
+import { loadGatewayConfiguration } from "../deployment/model-gateway.js";
+import { createServer } from "node:net";
+import { releaseSchema } from "../release/definition.js";
+import { parseLocalInput, } from "../deployment/configuration.js";
+import { loadInitialModels } from "../deployment/models.js";
+import { loadInitialConnections, readInitialConnectionToken, } from "../deployment/connections.js";
+import { readTeamMaterials } from "../deployment/team.js";
+import { installationSchema } from "./configuration.js";
+import { fingerprint, readInputFile, readJson } from "./files.js";
+import { InstallationError } from "./errors.js";
+import { openPack } from "../packs/source.js";
+export async function allocatePorts() {
+    const servers = Array.from({ length: 7 }, () => createServer());
+    try {
+        const ports = [];
+        for (const server of servers) {
+            await new Promise((resolve, reject) => {
+                server.once("error", reject);
+                server.listen(0, "127.0.0.1", resolve);
+            });
+            const address = server.address();
+            if (!address || typeof address === "string")
+                throw new InstallationError("unavailable", "Cannot allocate local ports.");
+            ports.push(address.port);
+        }
+        return ports;
+    }
+    finally {
+        await Promise.all(servers
+            .filter((s) => s.listening)
+            .map((s) => new Promise((resolve, reject) => s.close((error) => {
+            if (error)
+                reject(error);
+            else
+                resolve();
+        }))));
+    }
+}
+/** Resolve files against their owning document; validate before any allocation. */
+export async function resolveInstallation(configFile, internalPorts) {
+    const config = installationSchema.parse(await readJson(configFile));
+    const base = dirname(resolve(configFile));
+    const path = (value) => resolve(base, value);
+    const releasePath = path(config.releaseFile);
+    const release = releaseSchema.parse(await readJson(releasePath));
+    if (!release.platforms.some((platform) => platform === `${process.platform}-${process.arch}`))
+        throw new InstallationError("unsupported_platform", "This release does not support this host platform.");
+    const toolBase = dirname(releasePath);
+    const cli = resolve(toolBase, release.tools.openshell.cli.file);
+    const gateway = resolve(toolBase, release.tools.openshell.gateway.file);
+    await verifyReleaseTool(cli, release.tools.openshell.cli.sha256);
+    await verifyReleaseTool(gateway, release.tools.openshell.gateway.sha256);
+    const [controller, management, native, nativeWidgets, database, browser, models,] = internalPorts;
+    const inputs = {};
+    async function inputFile(value, secret) {
+        const filename = path(value);
+        inputs[filename] = fingerprint(await readInputFile(filename, secret));
+        return filename;
+    }
+    const exposure = config.exposure;
+    const access = config.access.mode === "hosted"
+        ? {
+            ...config.access,
+            ...(await hostedOidc(await inputFile(config.access.registrationFile, true))),
+        }
+        : config.access;
+    const cloudConnections = await hostedConnections(config, configFile);
+    const input = parseLocalInput({
+        name: config.name,
+        administratorName: access.administratorName,
+        runtimeImage: release.images.gateway,
+        companionImage: release.images.companion,
+        ...(config.browser.enabled ? { relayImage: release.images.relay } : {}),
+        openshellCli: cli,
+        openshellGateway: gateway,
+        openshellClientImage: release.images.openshellClient,
+        cpu: config.resources.runtime.cpu,
+        memory: config.resources.runtime.memory,
+        ports: {
+            controller,
+            management,
+            native,
+            nativeWidgets,
+            database,
+            application: exposure.mode === "local"
+                ? exposure.applicationPort
+                : Number(new URL(exposure.applicationOrigin).port || "443"),
+            widgets: exposure.mode === "local"
+                ? exposure.widgetPort
+                : Number(new URL(exposure.widgetOrigin).port || "443"),
+        },
+        ...(config.browser.enabled
+            ? {
+                browser: {
+                    image: release.images.browser?.chromium,
+                    nodeImage: release.images.browser?.node,
+                    dnsImage: release.images.browser?.dns,
+                    egressImage: release.images.browser?.egress,
+                    port: browser,
+                },
+            }
+            : {}),
+        team: {
+            ...(exposure.mode === "https"
+                ? {
+                    origin: exposure.applicationOrigin,
+                    widgetOrigin: exposure.widgetOrigin,
+                    certificateFile: await inputFile(exposure.certificateFile, false),
+                    keyFile: await inputFile(exposure.keyFile, true),
+                }
+                : {
+                    origin: `http://127.0.0.1:${String(exposure.applicationPort)}`,
+                    widgetOrigin: `http://127.0.0.1:${String(exposure.widgetPort)}`,
+                }),
+            issuer: access.issuer,
+            clientId: access.clientId,
+            clientSecretFile: await inputFile(access.clientSecretFile, true),
+            ...("administratorSubject" in access && access.administratorSubject
+                ? {
+                    administratorSubject: access.administratorSubject,
+                    administratorEmail: access.administratorEmail,
+                }
+                : {}),
+        },
+        ...(config.models.mode === "external"
+            ? {
+                models: {
+                    configurationFile: await inputFile(config.models.configurationFile, false),
+                    runtimeKeyFile: await inputFile(config.models.credentialFile, true),
+                    ...(config.models.caFile
+                        ? { caFile: await inputFile(config.models.caFile, false) }
+                        : {}),
+                },
+            }
+            : {}),
+        ...(config.models.mode === "litellm"
+            ? {
+                modelGateway: {
+                    configurationFile: await inputFile(config.models.configurationFile, false),
+                    upstreamEnvironmentFile: await inputFile(config.models.upstreamEnvironmentFile, true),
+                    image: release.images.models,
+                    port: models,
+                },
+                models: {
+                    configurationFile: join(path(config.stateDirectory), "private/models/native.json"),
+                    runtimeKeyFile: join(path(config.stateDirectory), "private/models/runtime-key"),
+                    caFile: join(path(config.stateDirectory), "private/management-ca.pem"),
+                },
+            }
+            : {}),
+        ...(cloudConnections
+            ? {
+                connections: {
+                    mode: "external",
+                    brokerUrl: cloudConnections.brokerUrl,
+                    managementKeyFile: await inputFile(cloudConnections.managementKeyFile, true),
+                },
+            }
+            : {}),
+    });
+    if (input.modelGateway)
+        await loadGatewayConfiguration(input.modelGateway.configurationFile, input.modelGateway.upstreamEnvironmentFile);
+    else
+        await loadInitialModels(input.models);
+    await readTeamMaterials(input.team);
+    await loadInitialConnections(input.connections);
+    const connectorCredentialFile = cloudConnections
+        ? await inputFile(cloudConnections.credentialFile, true)
+        : undefined;
+    if (connectorCredentialFile)
+        await readInitialConnectionToken(connectorCredentialFile);
+    const members = new Set();
+    const packs = [];
+    for (const selected of config.packs) {
+        const pack = await openPack(path(selected.directory));
+        for (const id of selected.members) {
+            const member = pack.manifest.members.find((m) => m.id === id);
+            if (!member || members.has(id))
+                throw new InstallationError("invalid_configuration", "Pack member selections must exist and have unique agent IDs.");
+            members.add(id);
+            if (member.requirements.connections.length &&
+                (config.connections.mode === "disabled" || !selected.bindingsFile))
+                throw new InstallationError("invalid_configuration", "This pack requires Connections and explicit account bindings.");
+        }
+        const bindingsFile = selected.bindingsFile
+            ? await inputFile(selected.bindingsFile, true)
+            : undefined;
+        inputs[`pack:${pack.root}`] = pack.digest;
+        packs.push({
+            directory: pack.root,
+            digest: pack.digest,
+            members: selected.members,
+            ...(bindingsFile
+                ? { bindingsFile, bindingsDigest: inputs[bindingsFile] }
+                : {}),
+        });
+    }
+    const packSelection = {
+        packs,
+        ...(config.packOperator
+            ? { python: path(config.packOperator.pythonExecutable) }
+            : {}),
+    };
+    return {
+        config,
+        release,
+        input,
+        stateDirectory: path(config.stateDirectory),
+        connectorCredentialFile,
+        packSelection,
+        fingerprint: fingerprint(JSON.stringify({ config, release, inputs, releasePath })),
+        internalPorts,
+    };
+}

package/scripts/installation/runtime.js

@@ -0,0 +1,87 @@
+import { randomUUID } from "node:crypto";
+import { chmod, copyFile, mkdir, open, rename, rm, writeFile, } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { releaseSchema } from "../release/definition.js";
+import { readJson, verifyReleaseTool } from "./files.js";
+import { InstallationError } from "./errors.js";
+/** Installation-owned paths survive npm cache cleanup and later CLI updates. */
+export async function retainRuntime(source, directory) {
+    const release = releaseSchema.parse(await readJson(source));
+    const target = join(directory, "runtime");
+    await mkdir(join(target, "tools"), { recursive: true, mode: 0o700 });
+    for (const name of ["cli", "gateway"]) {
+        const tool = release.tools.openshell[name];
+        const original = resolve(dirname(source), tool.file);
+        tool.file = `tools/openshell${name === "gateway" ? "-gateway" : ""}`;
+        try {
+            await verifyReleaseTool(original, tool.sha256);
+            await copyFile(original, join(target, tool.file));
+            await chmod(join(target, tool.file), 0o700);
+        }
+        catch (error) {
+            if (!(error instanceof Error &&
+                "code" in error &&
+                error.code === "ENOENT" &&
+                tool.url))
+                throw error;
+        }
+    }
+    await writeFile(join(target, "release.json"), JSON.stringify(release, null, 2) + "\n", { mode: 0o600, flag: "wx" });
+    return "./runtime/release.json";
+}
+/** Download only absent tools; corrupt or replaced executables always fail verification. */
+export async function acquireRuntimeTools(releaseFile, options) {
+    const release = releaseSchema.parse(await readJson(releaseFile));
+    for (const name of ["cli", "gateway"]) {
+        options.signal?.throwIfAborted();
+        const tool = release.tools.openshell[name];
+        const file = resolve(dirname(releaseFile), tool.file);
+        try {
+            await verifyReleaseTool(file, tool.sha256);
+            continue;
+        }
+        catch (error) {
+            if (!(error instanceof Error &&
+                "code" in error &&
+                error.code === "ENOENT"))
+                throw error;
+        }
+        if (!options.acquire || !tool.url)
+            throw new InstallationError("release_mismatch", `The OpenShell ${name} is missing. ${tool.url ? "Run configure to download it." : "This development runtime requires its locally prepared tools."}`);
+        options.report?.(`Downloading OpenShell ${name} ${release.tools.openshell.version}`);
+        const temporary = `${file}.${randomUUID()}.part`;
+        const signal = AbortSignal.any([
+            AbortSignal.timeout(5 * 60_000),
+            ...(options.signal ? [options.signal] : []),
+        ]);
+        await mkdir(dirname(file), { recursive: true, mode: 0o700 });
+        try {
+            const response = await fetch(tool.url, { signal }).catch(() => {
+                options.signal?.throwIfAborted();
+                throw new InstallationError("unavailable", `Could not download OpenShell ${name}. Check network access and retry configure.`);
+            });
+            if (!response.ok ||
+                !response.body ||
+                new URL(response.url).protocol !== "https:")
+                throw new InstallationError("unavailable", `Could not download OpenShell ${name}. Check network access and retry configure.`);
+            const output = await open(temporary, "wx", 0o700);
+            try {
+                let size = 0;
+                for await (const chunk of response.body) {
+                    size += chunk.byteLength;
+                    if (size > 256 * 1024 * 1024)
+                        throw new InstallationError("release_mismatch", "Runtime tool download exceeds its size limit.");
+                    await output.writeFile(chunk);
+                }
+            }
+            finally {
+                await output.close();
+            }
+            await verifyReleaseTool(temporary, tool.sha256);
+            await rename(temporary, file);
+        }
+        finally {
+            await rm(temporary, { force: true });
+        }
+    }
+}

package/scripts/installation/save.js

@@ -0,0 +1,95 @@
+import { openPack } from "../packs/source.js";
+import { retainRuntime } from "./runtime.js";
+import { cp, mkdir, rm, writeFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { readInputFile } from "./files.js";
+import { installationSchema, } from "./configuration.js";
+/** Unsaved generated inputs stay in memory until the user accepts the preview. */
+export class SetupInputs {
+    directory;
+    files = new Map();
+    constructor(directory) {
+        this.directory = directory;
+    }
+    async readJson(path) {
+        const bytes = this.files.get(path) ?? (await readInputFile(path));
+        return JSON.parse(bytes.toString("utf8"));
+    }
+    set(name, value) {
+        const path = resolve(this.directory, "secrets", name);
+        this.files.set(path, Buffer.from(value));
+        return path;
+    }
+}
+/** Copy credentials into the new private installation directory, never into its JSON. */
+export async function saveConfiguration(directory, value, inputs, retained = false) {
+    const config = installationSchema.parse(value);
+    const files = new Map();
+    async function secret(source, name) {
+        const path = join("secrets", name);
+        files.set(path, inputs?.files.get(source) ?? (await readInputFile(source, true)));
+        return `./${path}`;
+    }
+    const modelConfiguration = inputs?.files.get(config.models.configurationFile) ??
+        (await readInputFile(config.models.configurationFile));
+    files.set("models.json", modelConfiguration);
+    config.models.configurationFile = "./models.json";
+    if (!retained && config.access.mode === "oidc")
+        config.access.clientSecretFile = await secret(config.access.clientSecretFile, "oidc-client-secret");
+    if (!retained && config.exposure.mode === "https")
+        config.exposure.keyFile = await secret(config.exposure.keyFile, "tls-key.pem");
+    if (config.models.mode === "external")
+        config.models.credentialFile = await secret(config.models.credentialFile, "model-key");
+    if (config.models.mode === "litellm")
+        config.models.upstreamEnvironmentFile = await secret(config.models.upstreamEnvironmentFile, "models.env");
+    for (const [index, pack] of config.packs.entries())
+        if (pack.bindingsFile)
+            pack.bindingsFile = await secret(pack.bindingsFile, `pack-${String(index)}-bindings.json`);
+    // Exclusive creation also protects against another installer winning the same path.
+    await mkdir(directory, { mode: 0o700 });
+    try {
+        if (!retained)
+            config.releaseFile = await retainRuntime(resolve(config.releaseFile), directory);
+        if (config.packs.length)
+            await mkdir(resolve(directory, config.stateDirectory), {
+                recursive: true,
+                mode: 0o700,
+            });
+        for (const pack of config.packs) {
+            const source = await openPack(pack.directory);
+            const destination = join(resolve(directory, config.stateDirectory), "pack-sources", source.digest);
+            if (resolve(pack.directory) !== destination) {
+                await cp(source.root, destination, {
+                    recursive: true,
+                    errorOnExist: true,
+                    force: false,
+                }).catch(async (error) => {
+                    if (!(error instanceof Error &&
+                        "code" in error &&
+                        error.code === "EEXIST"))
+                        throw error;
+                    if ((await openPack(destination)).digest !== source.digest)
+                        throw error;
+                });
+                pack.directory = destination;
+            }
+        }
+        if (files.size)
+            await mkdir(join(directory, "secrets"), { mode: 0o700 });
+        for (const [path, bytes] of files)
+            await writeFile(join(directory, path), bytes, {
+                mode: 0o600,
+                flag: "wx",
+            });
+        const path = join(directory, "installation.json");
+        await writeFile(path, JSON.stringify(config, null, 2) + "\n", {
+            mode: 0o600,
+            flag: "wx",
+        });
+        return path;
+    }
+    catch (error) {
+        await rm(directory, { recursive: true, force: true });
+        throw error;
+    }
+}

package/scripts/installation/setup.js

@@ -0,0 +1,91 @@
+import { recipeModelRoutes } from "./models.js";
+import { resolve } from "node:path";
+import { releaseSchema } from "../release/definition.js";
+import { readJson } from "./files.js";
+import { InstallationError } from "./errors.js";
+import { installationCatalog, readRecipe, validateRecipe, } from "./recipes/catalog.js";
+import { defaultCloudUrl } from "../cloud/url.js";
+export async function readRuntime(releaseFile) {
+    releaseFile = resolve(releaseFile);
+    const release = releaseSchema.parse(await readJson(releaseFile));
+    if (!release.platforms.some((platform) => platform === `${process.platform}-${process.arch}`))
+        throw new InstallationError("unsupported_platform", "This runtime release does not support this host platform. No fallback protection mode is available.");
+    return { release, releaseFile };
+}
+export async function setupContext(options, retainedRelease) {
+    const catalog = await installationCatalog();
+    let recipe = catalog.recipes.find((recipe) => recipe.id === options.recipe);
+    if (!retainedRelease && !recipe) {
+        if (!options.recipe)
+            throw new InstallationError("invalid_configuration", "Choose a recipe from clawscarf recipes or supply a recipe file.");
+        if (!options.recipe.endsWith(".json"))
+            throw new InstallationError("invalid_configuration", `Unknown recipe: ${options.recipe}`);
+        recipe = await readRecipe(resolve(options.recipe));
+        validateRecipe(recipe, catalog);
+        const selectedId = recipe.id;
+        catalog.recipes = [
+            recipe,
+            ...catalog.recipes.filter((item) => item.id !== selectedId),
+        ];
+    }
+    const file = retainedRelease ?? recipe?.runtime;
+    if (!file)
+        throw new InstallationError("invalid_configuration", "The recipe must select a runtime release.");
+    return {
+        ...catalog,
+        ...(await readRuntime(file)),
+        recipeId: recipe?.id,
+        cloudUrl: options.cloudUrl ?? defaultCloudUrl,
+    };
+}
+/** Both the menu and noninteractive configuration start from these exact defaults. */
+export function recipeConfiguration(context, recipeId) {
+    const recipe = context.recipes.find((recipe) => recipe.id === recipeId);
+    if (!recipe)
+        throw new InstallationError("invalid_configuration", `Unknown recipe: ${recipeId}`);
+    return {
+        schemaVersion: 1,
+        name: "team",
+        releaseFile: context.releaseFile,
+        stateDirectory: "./state",
+        exposure: { mode: "local", applicationPort: 18800, widgetPort: 18802 },
+        access: {
+            mode: "hosted",
+            administratorName: "Administrator",
+            registrationFile: "./secrets/hosted-login.json",
+            cloudUrl: context.cloudUrl,
+        },
+        resources: structuredClone(recipe.defaults.resources),
+        browser: structuredClone(recipe.defaults.browser),
+        connections: {
+            mode: recipe.defaults.connections?.enabled ? "hosted" : "disabled",
+            cloudUrl: context.cloudUrl,
+            registrationFile: "./secrets/connections-registration.json",
+        },
+        packs: recipe.packs.map((pack) => ({
+            directory: packDirectory(context, pack.id),
+            members: [...pack.members],
+        })),
+        recipe: {
+            id: recipe.id,
+            version: recipe.version,
+            release: context.release.version,
+        },
+    };
+}
+export function recipeModelFile(models, inputs, catalog) {
+    return inputs.set("recipe-models.json", JSON.stringify(recipeModelRoutes(models, catalog), null, 2) + "\n");
+}
+export function assertReleaseCapabilities(context, config) {
+    if (config.browser.enabled &&
+        (!context.release.images.browser || !context.release.images.relay))
+        throw new InstallationError("invalid_configuration", "This release does not include browser images.");
+    if (config.models.mode === "litellm" && !context.release.images.models)
+        throw new InstallationError("invalid_configuration", "This release does not include LiteLLM.");
+}
+function packDirectory(context, id) {
+    const pack = context.packs.find((item) => item.id === id);
+    if (!pack)
+        throw new InstallationError("invalid_configuration", `Unknown pack: ${id}`);
+    return pack.directory;
+}

package/scripts/models/catalog.js

@@ -0,0 +1,9 @@
+import { z } from "zod";
+import { modelSchema } from "./configuration.js";
+export const modelCatalogSchema = z
+    .array(z.strictObject({
+    provider: z.string().min(1),
+    model: modelSchema.extend({ route: modelSchema.shape.route.unwrap() }),
+    reasoningLevels: z.array(z.enum(["low", "medium", "high"])),
+}))
+    .max(512);

package/scripts/models/configuration.js

@@ -0,0 +1,184 @@
+import { OperatorError } from "../errors.js";
+import { z } from "zod";
+export const modelSchema = z.strictObject({
+    id: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._/-]{0,159}$/),
+    name: z.string().min(1).max(200),
+    api: z.enum(["openai-completions", "openai-responses"]).optional(),
+    enabled: z.boolean(),
+    contextWindow: z.number().int().positive(),
+    maxTokens: z.number().int().positive(),
+    reasoning: z.boolean(),
+    tools: z.boolean(),
+    input: z.array(z.enum(["text", "image"])).min(1),
+    route: z
+        .strictObject({
+        model: z.string().min(1).max(200),
+        apiKeyEnv: z.string().regex(/^[A-Z][A-Z0-9_]+$/),
+        apiBase: z.url().optional(),
+    })
+        .optional(),
+});
+const thinkingDefault = z.enum(["low", "medium", "high"]);
+export const gatewayRoutesSchema = z.strictObject({
+    models: z.array(modelSchema).min(1).max(512),
+    defaultModel: z.string().min(1),
+    thinkingDefault: thinkingDefault.optional(),
+});
+export const configurationSchema = z
+    .discriminatedUnion("mode", [
+    z.strictObject({ mode: z.literal("disabled") }),
+    z.strictObject({
+        mode: z.enum(["external", "litellm"]),
+        baseUrl: z.url(),
+        models: z.array(modelSchema).min(1).max(512),
+        defaultModel: z.string().nullable(),
+        thinkingDefault: thinkingDefault.optional(),
+    }),
+])
+    .superRefine((value, context) => {
+    if (value.mode === "disabled")
+        return;
+    const url = new URL(value.baseUrl);
+    if (url.username ||
+        url.password ||
+        url.search ||
+        url.hash ||
+        !(url.protocol === "https:" ||
+            (url.protocol === "http:" &&
+                ["127.0.0.1", "[::1]", "localhost"].includes(url.hostname))))
+        context.addIssue({
+            code: "custom",
+            message: "Use HTTPS, or HTTP only on loopback, without URL credentials.",
+        });
+    const ids = new Set(value.models.map((model) => model.id));
+    if (ids.size !== value.models.length ||
+        !value.models.some((model) => model.enabled))
+        context.addIssue({
+            code: "custom",
+            message: "Require unique models and at least one enabled model.",
+        });
+    if (value.defaultModel !== null &&
+        !value.models.some((model) => model.enabled && model.id === value.defaultModel))
+        context.addIssue({
+            code: "custom",
+            message: "The default must be an enabled model.",
+        });
+    if (value.mode === "litellm" &&
+        value.models.some((model) => model.enabled && !model.route))
+        context.addIssue({
+            code: "custom",
+            message: "Every enabled LiteLLM model needs an upstream route.",
+        });
+});
+export const tokenVariable = "CLAWSCARF_MODEL_TOKEN";
+export function nativeModelProvider(config) {
+    return {
+        baseUrl: config.baseUrl,
+        api: "openai-completions",
+        agentRuntime: { id: "openclaw" },
+        apiKey: {
+            source: "env",
+            provider: "clawscarf-models",
+            id: tokenVariable,
+        },
+        models: config.models
+            .filter((model) => model.enabled)
+            .map((model) => ({
+            id: model.id,
+            name: model.name,
+            ...(model.api ? { api: model.api } : {}),
+            input: model.input,
+            reasoning: model.reasoning,
+            contextWindow: model.contextWindow,
+            maxTokens: model.maxTokens,
+            compat: {
+                supportsTools: model.tools,
+                supportsUsageInStreaming: true,
+                // Permit explicit strict:false on compatible routes; preserve optional tool arguments.
+                supportsStrictMode: true,
+            },
+        })),
+    };
+}
+export function nativeAssignments(config) {
+    if (config.mode === "disabled")
+        return [];
+    const defaults = nativeModelDefaults(config);
+    const assignments = [
+        {
+            path: "secrets.providers.clawscarf-models",
+            value: { source: "env", allowlist: [tokenVariable] },
+        },
+        {
+            path: "models.providers.clawscarf",
+            value: nativeModelProvider(config),
+        },
+    ];
+    if (defaults.model.primary !== undefined)
+        assignments.push({
+            path: "agents.defaults.model.primary",
+            value: defaults.model.primary,
+        });
+    if (defaults.thinkingDefault)
+        assignments.push({
+            path: "agents.defaults.thinkingDefault",
+            value: defaults.thinkingDefault,
+        });
+    return assignments;
+}
+export function nativeModelDefaults(config) {
+    return {
+        model: {
+            ...(config.defaultModel === null
+                ? {}
+                : { primary: `clawscarf/${config.defaultModel}` }),
+        },
+        ...(config.thinkingDefault
+            ? { thinkingDefault: config.thinkingDefault }
+            : {}),
+    };
+}
+export function liteLlmConfiguration(config) {
+    if (config.mode !== "litellm")
+        throw new OperatorError("Select LiteLLM mode before rendering its configuration.");
+    return {
+        model_list: config.models
+            .filter((model) => model.enabled)
+            .map((model) => {
+            if (!model.route)
+                throw new OperatorError("A LiteLLM route is required.");
+            return {
+                model_name: model.id,
+                litellm_params: {
+                    model: model.route.model,
+                    api_key: `os.environ/${model.route.apiKeyEnv}`,
+                    ...(model.route.apiBase ? { api_base: model.route.apiBase } : {}),
+                    num_retries: 0,
+                    timeout: 300,
+                },
+                model_info: {
+                    max_input_tokens: model.contextWindow,
+                    max_output_tokens: model.maxTokens,
+                    supports_function_calling: model.tools,
+                    supports_reasoning: model.reasoning,
+                },
+            };
+        }),
+        litellm_settings: {
+            num_retries: 0,
+            request_timeout: 300,
+            turn_off_message_logging: true,
+            set_verbose: false,
+            drop_params: false,
+            telemetry: false,
+        },
+        router_settings: { num_retries: 0, disable_cooldowns: true },
+        general_settings: {
+            master_key: "os.environ/LITELLM_MASTER_KEY",
+            database_url: "os.environ/DATABASE_URL",
+            disable_spend_logs: true,
+            disable_error_logs: true,
+            store_model_in_db: false,
+        },
+    };
+}