@openclaw/radius-provider 2026.9.5

package/README.md

@@ -0,0 +1,16 @@
+# OpenClaw Radius Provider
+
+Connect OpenClaw to Earendil's Radius gateway with browser sign-in or an
+organization API key. The plugin discovers account-visible models and supports
+native Pi message streaming, reasoning, images on supported models, and tool calls.
+
+```bash
+openclaw plugins install @openclaw/radius-provider
+openclaw models auth login --provider radius --method oauth --set-default
+openclaw models list --provider radius --refresh
+```
+
+For API-key setups, use `--method api-key` or `RADIUS_API_KEY`.
+Requests use the selected organization's credits and policies.
+
+See [Radius setup and configuration](https://docs.openclaw.ai/providers/radius).

package/assets/activity.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <path fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5" d="M3 12a9 9 0 1 0 18 0a9 9 0 1 0 -18 0Z M12 12 19 5" />
+  <path fill="currentColor" stroke="none" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5" d="M10.5 12a1.5 1.5 0 1 0 3 0a1.5 1.5 0 1 0 -3 0Z" />
+</svg>

package/dist/catalog.js

@@ -0,0 +1,111 @@
+import { fetchLiveProviderModelRows } from "openclaw/plugin-sdk/provider-catalog-live-runtime";
+import { asFiniteNumberInRange, asOptionalRecord, asPositiveSafeInteger, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+//#region extensions/radius/catalog.ts
+const RADIUS_BASE_URL = "https://radius.pi.dev/v1";
+const THINKING_LEVELS = [
+	"off",
+	"minimal",
+	"low",
+	"medium",
+	"high",
+	"xhigh",
+	"max"
+];
+function readRates(value) {
+	const row = asOptionalRecord(value);
+	const input = asFiniteNumberInRange(row?.input, { min: 0 });
+	const output = asFiniteNumberInRange(row?.output, { min: 0 });
+	const cacheRead = asFiniteNumberInRange(row?.cacheRead, { min: 0 });
+	const cacheWrite = asFiniteNumberInRange(row?.cacheWrite, { min: 0 });
+	return input !== void 0 && output !== void 0 && cacheRead !== void 0 && cacheWrite !== void 0 ? {
+		input,
+		output,
+		cacheRead,
+		cacheWrite
+	} : void 0;
+}
+function readCost(value) {
+	const rates = readRates(value);
+	if (!rates) return;
+	const tiers = asOptionalRecord(value)?.tiers;
+	if (tiers === void 0) return rates;
+	if (!Array.isArray(tiers)) return;
+	const thresholds = [{
+		start: 0,
+		rates
+	}];
+	for (const tier of tiers) {
+		const tierRates = readRates(tier);
+		const threshold = asFiniteNumberInRange(asOptionalRecord(tier)?.inputTokensAbove, { min: 0 });
+		if (!tierRates || threshold === void 0 || !Number.isSafeInteger(threshold + 1)) return;
+		thresholds.push({
+			start: threshold + 1,
+			rates: tierRates
+		});
+	}
+	thresholds.sort((left, right) => left.start - right.start);
+	if (thresholds.some((tier, index) => index > 0 && tier.start === thresholds[index - 1]?.start)) return;
+	return {
+		...rates,
+		...tiers.length > 0 ? { tieredPricing: thresholds.map((tier, index) => {
+			const next = thresholds[index + 1];
+			const range = next ? [tier.start, next.start] : [tier.start];
+			return Object.assign({}, tier.rates, { range });
+		}) } : {}
+	};
+}
+function readModel(value) {
+	const row = asOptionalRecord(value);
+	const id = normalizeOptionalString(row?.id);
+	const name = normalizeOptionalString(row?.name);
+	const cost = readCost(row?.cost);
+	const contextWindow = asPositiveSafeInteger(row?.contextWindow);
+	const maxTokens = asPositiveSafeInteger(row?.maxTokens);
+	if (!row || !id || !name || !cost || !contextWindow || !maxTokens || row.enabled === false || typeof row.reasoning !== "boolean" || !Array.isArray(row.input) || row.input.length === 0 || row.input.some((input) => input !== "text" && input !== "image")) return;
+	const input = row.input.filter((item) => item === "text" || item === "image");
+	let thinkingLevelMap;
+	if (row.thinkingLevelMap !== void 0) {
+		const levels = asOptionalRecord(row.thinkingLevelMap);
+		if (!levels) return;
+		thinkingLevelMap = {};
+		for (const level of THINKING_LEVELS) {
+			const mapped = levels[level];
+			if (mapped !== void 0) {
+				if (mapped !== null && typeof mapped !== "string") return;
+				thinkingLevelMap[level] = mapped;
+			}
+		}
+	}
+	return {
+		id,
+		name,
+		reasoning: row.reasoning,
+		input,
+		cost,
+		contextWindow,
+		maxTokens,
+		...thinkingLevelMap ? { thinkingLevelMap } : {}
+	};
+}
+async function fetchRadiusCatalog(apiKey, signal) {
+	const documents = await fetchLiveProviderModelRows({
+		providerId: "radius",
+		endpoint: `${RADIUS_BASE_URL}/config`,
+		discoveryApiKey: apiKey,
+		signal,
+		requireHttps: true,
+		readRows: (body) => [body]
+	});
+	const config = asOptionalRecord(documents[0]);
+	const baseUrl = normalizeOptionalString(config?.baseUrl);
+	if (!baseUrl || !Array.isArray(config?.models)) throw new Error("Invalid Radius catalog: expected baseUrl and models");
+	const endpoint = new URL(baseUrl);
+	if (endpoint.protocol !== "https:" || endpoint.username || endpoint.password || endpoint.search || endpoint.hash) throw new Error("Invalid Radius catalog base URL");
+	return {
+		baseUrl: baseUrl.replace(/\/+$/u, ""),
+		api: "pi-messages",
+		models: config.models.map(readModel).filter((model) => model !== void 0)
+	};
+}
+//#endregion
+export { RADIUS_BASE_URL, fetchRadiusCatalog };

package/dist/index.js

@@ -0,0 +1,170 @@
+import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
+import { buildOauthProviderAuthResult, resolveOAuthApiKeyMarker } from "openclaw/plugin-sdk/provider-auth";
+import { runLiveProviderCatalog } from "openclaw/plugin-sdk/provider-catalog-live-runtime";
+import { defineSingleProviderPluginEntry } from "openclaw/plugin-sdk/provider-entry";
+//#region extensions/radius/openclaw.plugin.json
+var openclaw_plugin_default = {
+	id: "radius",
+	name: "Radius",
+	description: "Radius model gateway provider.",
+	categories: ["models"],
+	activation: { "onStartup": false },
+	enabledByDefault: true,
+	providers: ["radius"],
+	modelCatalog: { "discovery": { "radius": "refreshable" } },
+	setup: { "providers": [{
+		"id": "radius",
+		"envVars": ["RADIUS_API_KEY"]
+	}] },
+	providerAuthChoices: [{
+		"provider": "radius",
+		"method": "oauth",
+		"choiceId": "radius",
+		"appGuidedAuth": "oauth",
+		"credentialOnly": true,
+		"channelLogin": {},
+		"choiceLabel": "Radius (browser sign-in)",
+		"groupId": "radius",
+		"groupLabel": "Radius",
+		"groupHint": "Browser sign-in or API key"
+	}, {
+		"provider": "radius",
+		"method": "api-key",
+		"choiceId": "radius-api-key",
+		"appGuidedSecret": true,
+		"choiceLabel": "Radius API key",
+		"groupId": "radius",
+		"groupLabel": "Radius",
+		"groupHint": "Browser sign-in or API key",
+		"optionKey": "radiusApiKey",
+		"cliFlag": "--radius-api-key",
+		"cliOption": "--radius-api-key <key>",
+		"cliDescription": "Radius organization API key"
+	}],
+	configSchema: {
+		"type": "object",
+		"additionalProperties": false,
+		"properties": {}
+	}
+};
+//#endregion
+//#region extensions/radius/index.ts
+const loadCatalog = createLazyRuntimeModule(() => import("./catalog.js"));
+const loadOAuth = createLazyRuntimeModule(() => import("./oauth.js"));
+const loadStream = createLazyRuntimeModule(() => import("./stream.js"));
+function defaultModel(catalog) {
+	const model = catalog.models.find((entry) => entry.id === "balanced") ?? catalog.models[0];
+	if (!model) throw new Error("Radius returned no available models. Check your organization's model access.");
+	return `radius/${model.id}`;
+}
+var radius_default = defineSingleProviderPluginEntry({
+	id: "radius",
+	name: "Radius Provider",
+	description: "Radius model gateway with organization-scoped authentication and native streaming",
+	manifest: openclaw_plugin_default,
+	provider: {
+		label: "Radius",
+		docsPath: "/providers/radius",
+		manifestAuth: {
+			noteTitle: "Radius",
+			noteMessage: "Create an organization API key at https://radius.earendil.com. Requests use that organization's credits and policies.",
+			resolveDefaultModel: async ({ apiKey, signal }) => defaultModel(await (await loadCatalog()).fetchRadiusCatalog(apiKey, signal))
+		},
+		extraAuth: [{
+			id: "oauth",
+			label: "Radius browser sign-in",
+			hint: "Pair your browser and choose a Radius organization",
+			kind: "device_code",
+			wizard: {
+				choiceId: "radius",
+				choiceLabel: "Radius (browser sign-in)",
+				groupId: "radius",
+				groupLabel: "Radius",
+				groupHint: "Browser sign-in or API key"
+			},
+			run: async (ctx) => {
+				const credentials = await (await loadOAuth()).loginRadiusOAuth(ctx);
+				const notes = ["Radius access is scoped to the organization selected in your browser. Tokens refresh automatically."];
+				if (ctx.credentialOnly) {
+					ctx.assertCurrent?.();
+					return {
+						profiles: [{
+							profileId: "radius:default",
+							credential: {
+								type: "oauth",
+								provider: "radius",
+								...credentials
+							}
+						}],
+						notes
+					};
+				}
+				const catalog = await (await loadCatalog()).fetchRadiusCatalog(credentials.access, ctx.signal);
+				ctx.assertCurrent?.();
+				return buildOauthProviderAuthResult({
+					providerId: "radius",
+					defaultModel: defaultModel(catalog),
+					access: credentials.access,
+					refresh: credentials.refresh,
+					expires: credentials.expires,
+					notes
+				});
+			}
+		}],
+		catalog: {
+			order: "profile",
+			run: async (ctx) => {
+				const { apiKey, discoveryApiKey, profileId } = ctx.resolveProviderAuth("radius", { oauthMarker: resolveOAuthApiKeyMarker("radius") });
+				if (!discoveryApiKey) return null;
+				return await runLiveProviderCatalog({
+					providerId: "radius",
+					profileId,
+					run: async () => ({ provider: {
+						...await (await loadCatalog()).fetchRadiusCatalog(discoveryApiKey),
+						apiKey
+					} })
+				});
+			}
+		},
+		prepareDynamicModel: async (ctx) => {
+			const { resolveApiKeyForProvider } = await import("openclaw/plugin-sdk/provider-auth-runtime");
+			const { apiKey } = await resolveApiKeyForProvider({
+				provider: "radius",
+				cfg: ctx.config,
+				agentDir: ctx.agentDir,
+				workspaceDir: ctx.workspaceDir,
+				...ctx.authProfileId ? {
+					profileId: ctx.authProfileId,
+					lockedProfile: true
+				} : {}
+			});
+			if (!apiKey) return;
+			const catalog = await (await loadCatalog()).fetchRadiusCatalog(apiKey);
+			const model = catalog.models.find((entry) => entry.id === ctx.modelId);
+			return model ? {
+				id: model.id,
+				name: model.name,
+				provider: "radius",
+				api: "pi-messages",
+				baseUrl: catalog.baseUrl,
+				reasoning: model.reasoning,
+				input: model.input,
+				cost: model.cost,
+				contextWindow: model.contextWindow,
+				maxTokens: model.maxTokens,
+				thinkingLevelMap: model.thinkingLevelMap
+			} : void 0;
+		},
+		createStreamFn: () => async (...args) => (await loadStream()).createRadiusStreamFn()(...args),
+		buildReplayPolicy: () => ({
+			sanitizeToolCallIds: false,
+			preserveSignatures: true,
+			appendOnlyRuntimeContext: true,
+			dropThinkingBlocks: false,
+			dropReasoningFromHistory: false
+		}),
+		refreshOAuth: async (credential) => (await loadOAuth()).refreshRadiusOAuthCredential(credential)
+	}
+});
+//#endregion
+export { radius_default as default };

package/dist/oauth.js

@@ -0,0 +1,162 @@
+import { asFiniteNumberInRange } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { MAX_TIMER_TIMEOUT_MS, positiveSecondsToSafeMilliseconds, resolveExpiresAtMsFromDurationMs } from "openclaw/plugin-sdk/number-runtime";
+import { readProviderJsonObjectResponse } from "openclaw/plugin-sdk/provider-http";
+import { throwIfOAuthLoginAborted } from "openclaw/plugin-sdk/provider-oauth-runtime";
+import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
+import { sleep } from "openclaw/plugin-sdk/text-utility-runtime";
+//#region extensions/radius/oauth.ts
+const OAUTH_BASE_URL = "https://radius.pi.dev/v1/oauth";
+const CLIENT_ID = "pi-gateway";
+const REQUEST_TIMEOUT_MS = 3e4;
+var RadiusOAuthError = class extends Error {
+	constructor(code, status) {
+		super(`Radius OAuth request failed (HTTP ${status}). Retry sign-in.`);
+		this.code = typeof code === "string" && [
+			"authorization_pending",
+			"slow_down",
+			"access_denied",
+			"expired_token"
+		].includes(code) ? code : void 0;
+	}
+};
+async function postOAuthForm(endpoint, fields, signal, beforeRequest) {
+	const { response, release } = await fetchWithSsrFGuard({
+		url: `${OAUTH_BASE_URL}/${endpoint}`,
+		init: {
+			method: "POST",
+			headers: {
+				Accept: "application/json",
+				"Content-Type": "application/x-www-form-urlencoded"
+			},
+			body: new URLSearchParams({
+				client_id: CLIENT_ID,
+				...fields
+			})
+		},
+		signal,
+		beforeRequest,
+		timeoutMs: REQUEST_TIMEOUT_MS,
+		requireHttps: true,
+		policy: { hostnameAllowlist: ["radius.pi.dev"] },
+		auditContext: `radius.oauth.${endpoint}`
+	});
+	try {
+		const payload = await readProviderJsonObjectResponse(response, "Radius OAuth", {
+			maxBytes: 65536,
+			requestHeaders: {}
+		});
+		if (!response.ok || payload.error !== void 0) throw new RadiusOAuthError(payload.error, response.status);
+		return payload;
+	} finally {
+		await release();
+	}
+}
+function parseToken(payload, previousRefresh) {
+	const lifetimeMs = positiveSecondsToSafeMilliseconds(payload.expires_in);
+	const expires = lifetimeMs === void 0 ? void 0 : resolveExpiresAtMsFromDurationMs(lifetimeMs, { bufferMs: Math.min(6e4, Math.floor(lifetimeMs / 2)) });
+	const refresh = payload.refresh_token ?? previousRefresh;
+	if (typeof payload.access_token !== "string" || !payload.access_token.trim() || typeof refresh !== "string" || !refresh.trim() || expires === void 0 || payload.scope !== void 0 && typeof payload.scope !== "string") throw new Error("Radius OAuth returned invalid credentials. Retry sign-in.");
+	return {
+		access: payload.access_token,
+		refresh,
+		expires
+	};
+}
+function parseDevice(payload) {
+	const lifetimeMs = positiveSecondsToSafeMilliseconds(payload.expires_in);
+	const expiresAt = lifetimeMs === void 0 ? void 0 : resolveExpiresAtMsFromDurationMs(lifetimeMs);
+	const intervalSeconds = payload.interval === void 0 ? 5 : asFiniteNumberInRange(payload.interval, {
+		min: Number.MIN_VALUE,
+		max: MAX_TIMER_TIMEOUT_MS / 1e3
+	});
+	const intervalMs = intervalSeconds === void 0 ? void 0 : Math.ceil(intervalSeconds * 1e3);
+	if (typeof payload.device_code !== "string" || !payload.device_code.trim() || typeof payload.user_code !== "string" || !payload.user_code.trim() || typeof payload.verification_uri !== "string" || expiresAt === void 0 || intervalMs === void 0 || intervalMs > MAX_TIMER_TIMEOUT_MS) throw new Error("Radius OAuth returned an invalid device authorization response.");
+	let url;
+	try {
+		url = new URL(payload.verification_uri);
+	} catch {
+		throw new Error("Radius OAuth returned an invalid verification URL.");
+	}
+	if (url.origin !== "https://radius.earendil.com" || url.username || url.password) throw new Error("Radius OAuth returned an invalid verification URL.");
+	return {
+		deviceCode: payload.device_code,
+		userCode: payload.user_code,
+		verificationUri: url.href,
+		expiresAt,
+		intervalMs
+	};
+}
+async function loginRadiusOAuth(ctx) {
+	const assertCurrent = () => {
+		throwIfOAuthLoginAborted(ctx.signal);
+		ctx.assertCurrent?.();
+	};
+	assertCurrent();
+	const payload = await postOAuthForm("device", { scope: "gateway offline_access" }, ctx.signal, assertCurrent);
+	assertCurrent();
+	const device = parseDevice(payload);
+	if (ctx.prompter.deviceCode) {
+		await ctx.openUrl(device.verificationUri);
+		await ctx.prompter.deviceCode({
+			title: "Radius sign-in",
+			code: device.userCode,
+			expiresInMinutes: Math.ceil((device.expiresAt - Date.now()) / 6e4),
+			message: "Enter this one-time code to sign in to Radius."
+		});
+	} else await ctx.prompter.note(`Open ${device.verificationUri} and enter code ${device.userCode} to sign in to Radius.`, "Radius sign-in");
+	assertCurrent();
+	if (!ctx.isRemote && !ctx.prompter.deviceCode) {
+		try {
+			await ctx.openUrl(device.verificationUri);
+		} catch {}
+		assertCurrent();
+	}
+	const progress = ctx.prompter.progress("Waiting for Radius approval…");
+	let completed = false;
+	try {
+		let intervalMs = device.intervalMs;
+		while (Date.now() < device.expiresAt) {
+			await sleep(Math.min(intervalMs, device.expiresAt - Date.now()), ctx.signal);
+			assertCurrent();
+			if (Date.now() >= device.expiresAt) break;
+			try {
+				const token = await postOAuthForm("token", {
+					grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+					device_code: device.deviceCode
+				}, ctx.signal, assertCurrent);
+				assertCurrent();
+				const credentials = parseToken(token);
+				completed = true;
+				return credentials;
+			} catch (error) {
+				assertCurrent();
+				if (!(error instanceof RadiusOAuthError)) throw error;
+				switch (error.code) {
+					case "authorization_pending": break;
+					case "slow_down":
+						intervalMs = Math.min(intervalMs + 5e3, MAX_TIMER_TIMEOUT_MS);
+						break;
+					case "access_denied": throw new Error("Radius sign-in was denied. Retry sign-in when ready.", { cause: error });
+					case "expired_token": throw new Error("Radius device code expired. Start sign-in again.", { cause: error });
+					default: throw error;
+				}
+			}
+		}
+		throw new Error("Radius device code expired. Start sign-in again.");
+	} finally {
+		progress.stop(completed ? "Radius sign-in complete" : "Radius sign-in stopped");
+	}
+}
+async function refreshRadiusOAuthCredential(credential) {
+	if (!credential.refresh.trim()) throw new Error("Radius refresh token is missing. Sign in again.");
+	const payload = await postOAuthForm("token", {
+		grant_type: "refresh_token",
+		refresh_token: credential.refresh
+	});
+	return {
+		...credential,
+		...parseToken(payload, credential.refresh)
+	};
+}
+//#endregion
+export { loginRadiusOAuth, refreshRadiusOAuthCredential };

package/dist/stream.js

@@ -0,0 +1,291 @@
+import { asOptionalRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { createProviderHttpError } from "openclaw/plugin-sdk/provider-http";
+import { createAssistantMessageEventStream, createToolArgumentPreviewSchedule, parseStreamingJson } from "openclaw/plugin-sdk/llm";
+import { buildGuardedModelFetch, createEmptyTransportUsage, failTransportStream, notifyProviderHttpResponse, parseTerminalToolCallArguments } from "openclaw/plugin-sdk/provider-transport-runtime";
+//#region extensions/radius/stream.ts
+const MAX_SSE_EVENT_BYTES = 16777216;
+function record(value) {
+	const parsed = asOptionalRecord(value);
+	if (!parsed) throw new Error("Invalid Radius stream event object");
+	return parsed;
+}
+function string(value) {
+	if (typeof value !== "string") throw new Error("Invalid Radius stream string");
+	return value;
+}
+function number(value) {
+	if (typeof value !== "number" || !Number.isFinite(value) || value < 0) throw new Error("Invalid Radius usage value");
+	return value;
+}
+function usage(value) {
+	const raw = record(value);
+	const cost = record(raw.cost);
+	return {
+		...raw,
+		input: number(raw.input),
+		output: number(raw.output),
+		cacheRead: number(raw.cacheRead),
+		cacheWrite: number(raw.cacheWrite),
+		totalTokens: number(raw.totalTokens),
+		cost: {
+			...cost,
+			input: number(cost.input),
+			output: number(cost.output),
+			cacheRead: number(cost.cacheRead),
+			cacheWrite: number(cost.cacheWrite),
+			total: number(cost.total)
+		}
+	};
+}
+function createEventConverter(partial) {
+	const toolJson = /* @__PURE__ */ new Map();
+	return (raw) => {
+		const event = record(raw);
+		const type = string(event.type);
+		if (type === "done" || type === "error") {
+			partial.usage = usage(event.usage);
+			if (event.responseId !== void 0) partial.responseId = string(event.responseId);
+			const reason = event.reason;
+			if (type === "done" && (reason === "stop" || reason === "length" || reason === "toolUse")) {
+				if (toolJson.size > 0) throw new Error("Radius stream ended with an unfinished tool call");
+				partial.stopReason = reason;
+				return {
+					type,
+					reason,
+					message: partial
+				};
+			}
+			if (type === "error" && (reason === "error" || reason === "aborted")) {
+				partial.stopReason = reason;
+				partial.errorMessage = event.errorMessage === void 0 ? "Radius request failed" : string(event.errorMessage);
+				return {
+					type,
+					reason,
+					error: partial
+				};
+			}
+			throw new Error("Invalid Radius terminal reason");
+		}
+		if (type === "start") return {
+			type,
+			partial
+		};
+		const contentIndex = event.contentIndex;
+		if (typeof contentIndex !== "number" || !Number.isSafeInteger(contentIndex) || contentIndex < 0) throw new Error("Invalid Radius content index");
+		if (type === "text_start" || type === "thinking_start" || type === "toolcall_start") {
+			if (contentIndex !== partial.content.length) throw new Error("Out-of-order Radius content block");
+			if (type === "text_start") partial.content.push({
+				type: "text",
+				text: ""
+			});
+			else if (type === "thinking_start") partial.content.push({
+				type: "thinking",
+				thinking: ""
+			});
+			else {
+				partial.content.push({
+					type: "toolCall",
+					id: string(event.id),
+					name: string(event.toolName),
+					arguments: {}
+				});
+				toolJson.set(contentIndex, {
+					json: "",
+					shouldPreview: createToolArgumentPreviewSchedule()
+				});
+			}
+			return {
+				type,
+				contentIndex,
+				partial
+			};
+		}
+		const block = partial.content[contentIndex];
+		switch (type) {
+			case "text_delta": {
+				if (block?.type !== "text") break;
+				const delta = string(event.delta);
+				block.text += delta;
+				return {
+					type,
+					contentIndex,
+					delta,
+					partial
+				};
+			}
+			case "text_end":
+				if (block?.type !== "text") break;
+				block.text = string(event.content);
+				if (event.contentSignature !== void 0) block.textSignature = string(event.contentSignature);
+				return {
+					type,
+					contentIndex,
+					content: block.text,
+					partial
+				};
+			case "thinking_delta": {
+				if (block?.type !== "thinking") break;
+				const delta = string(event.delta);
+				block.thinking += delta;
+				return {
+					type,
+					contentIndex,
+					delta,
+					partial
+				};
+			}
+			case "thinking_end":
+				if (block?.type !== "thinking") break;
+				block.thinking = string(event.content);
+				if (event.contentSignature !== void 0) block.thinkingSignature = string(event.contentSignature);
+				if (event.redacted !== void 0 && typeof event.redacted !== "boolean") throw new Error("Invalid Radius redacted thinking flag");
+				block.redacted = event.redacted;
+				return {
+					type,
+					contentIndex,
+					content: block.thinking,
+					partial
+				};
+			case "toolcall_delta": {
+				const pending = toolJson.get(contentIndex);
+				if (block?.type !== "toolCall" || !pending) break;
+				const delta = string(event.delta);
+				pending.json += delta;
+				if (pending.shouldPreview(pending.json.length)) block.arguments = parseStreamingJson(pending.json);
+				return {
+					type,
+					contentIndex,
+					delta,
+					partial
+				};
+			}
+			case "toolcall_end": {
+				if (block?.type !== "toolCall" || !toolJson.has(contentIndex)) break;
+				const call = record(event.toolCall);
+				if (call.type !== "toolCall" || call.id !== block.id || call.name !== block.name) throw new Error("Radius terminal tool call does not match its start");
+				block.arguments = parseTerminalToolCallArguments(call.arguments);
+				if (call.thoughtSignature !== void 0) block.thoughtSignature = string(call.thoughtSignature);
+				toolJson.delete(contentIndex);
+				return {
+					type,
+					contentIndex,
+					toolCall: block,
+					partial
+				};
+			}
+		}
+		throw new Error("Invalid Radius stream event or content block sequence");
+	};
+}
+async function* readEvents(body, signal) {
+	const reader = body.getReader();
+	const decoder = new TextDecoder();
+	let buffer = "";
+	const cancel = () => {
+		reader.cancel(signal?.reason).catch(() => void 0);
+	};
+	signal?.addEventListener("abort", cancel, { once: true });
+	try {
+		while (true) {
+			signal?.throwIfAborted();
+			const { done, value } = await reader.read();
+			signal?.throwIfAborted();
+			buffer += done ? decoder.decode() : decoder.decode(value, { stream: true });
+			for (;;) {
+				const boundary = /\r\n\r\n|\n\n|\r\r/u.exec(buffer);
+				if (!boundary && !done) break;
+				const frame = boundary ? buffer.slice(0, boundary.index) : buffer;
+				if (Buffer.byteLength(frame, "utf8") > MAX_SSE_EVENT_BYTES) throw new Error("Radius SSE event exceeds 16 MiB");
+				buffer = boundary ? buffer.slice(boundary.index + boundary[0].length) : "";
+				const data = frame.split(/\r\n|\n|\r/u).filter((line) => line.startsWith("data:")).map((line) => line.slice(5).trimStart()).join("\n");
+				if (data && data !== "[DONE]") yield JSON.parse(data);
+				if (!boundary) break;
+			}
+			if (Buffer.byteLength(buffer, "utf8") > MAX_SSE_EVENT_BYTES) throw new Error("Radius SSE event exceeds 16 MiB");
+			if (done) return;
+		}
+	} finally {
+		signal?.removeEventListener("abort", cancel);
+		await reader.cancel().catch(() => void 0);
+		reader.releaseLock();
+	}
+}
+/** Radius speaks Pi's native message protocol, not an OpenAI-compatible API. */
+function createRadiusStreamFn() {
+	return (model, context, options) => {
+		const stream = createAssistantMessageEventStream();
+		const partial = {
+			role: "assistant",
+			content: [],
+			api: model.api,
+			provider: model.provider,
+			model: model.id,
+			usage: createEmptyTransportUsage(),
+			stopReason: "stop",
+			timestamp: Date.now()
+		};
+		const convert = createEventConverter(partial);
+		(async () => {
+			let response;
+			try {
+				if (!options?.apiKey) throw new Error("No Radius access token configured. Run openclaw models auth login --provider radius.");
+				options.signal?.throwIfAborted();
+				let payload = {
+					model: model.id,
+					context,
+					options: {
+						temperature: options.temperature,
+						maxTokens: options.maxTokens,
+						reasoning: options.reasoning === "off" ? void 0 : options.reasoning,
+						cacheRetention: options.cacheRetention,
+						sessionId: options.sessionId,
+						toolChoice: options.toolChoice
+					}
+				};
+				const replacement = await options.onPayload?.(payload, model);
+				if (replacement !== void 0) payload = replacement;
+				options.signal?.throwIfAborted();
+				response = await buildGuardedModelFetch(model, options.timeoutMs, { sanitizeSse: false })(`${model.baseUrl.replace(/\/+$/u, "")}/messages`, {
+					method: "POST",
+					headers: {
+						authorization: `Bearer ${options.apiKey}`,
+						accept: "text/event-stream",
+						"content-type": "application/json",
+						...model.headers,
+						...options.headers
+					},
+					body: JSON.stringify(payload),
+					signal: options.signal
+				});
+				await notifyProviderHttpResponse({
+					options,
+					response,
+					model
+				});
+				if (!response.ok) throw await createProviderHttpError(response, "Radius request failed");
+				if (!response.body) throw new Error("Radius response has no body");
+				for await (const raw of readEvents(response.body, options.signal)) {
+					const event = convert(raw);
+					stream.push(event);
+					if (event.type === "done" || event.type === "error") {
+						stream.end();
+						return;
+					}
+				}
+				throw new Error("Radius stream ended without a terminal event");
+			} catch (error) {
+				failTransportStream({
+					stream,
+					output: partial,
+					signal: options?.signal,
+					error
+				});
+			} finally {
+				await response?.body?.cancel().catch(() => void 0);
+			}
+		})();
+		return stream;
+	};
+}
+//#endregion
+export { createRadiusStreamFn };

package/openclaw.plugin.json

@@ -0,0 +1,40 @@
+{
+  "id": "radius",
+  "name": "Radius",
+  "description": "Radius model gateway provider.",
+  "categories": ["models"],
+  "activation": { "onStartup": false },
+  "enabledByDefault": true,
+  "providers": ["radius"],
+  "modelCatalog": { "discovery": { "radius": "refreshable" } },
+  "setup": { "providers": [{ "id": "radius", "envVars": ["RADIUS_API_KEY"] }] },
+  "providerAuthChoices": [
+    {
+      "provider": "radius",
+      "method": "oauth",
+      "choiceId": "radius",
+      "appGuidedAuth": "oauth",
+      "credentialOnly": true,
+      "channelLogin": {},
+      "choiceLabel": "Radius (browser sign-in)",
+      "groupId": "radius",
+      "groupLabel": "Radius",
+      "groupHint": "Browser sign-in or API key"
+    },
+    {
+      "provider": "radius",
+      "method": "api-key",
+      "choiceId": "radius-api-key",
+      "appGuidedSecret": true,
+      "choiceLabel": "Radius API key",
+      "groupId": "radius",
+      "groupLabel": "Radius",
+      "groupHint": "Browser sign-in or API key",
+      "optionKey": "radiusApiKey",
+      "cliFlag": "--radius-api-key",
+      "cliOption": "--radius-api-key <key>",
+      "cliDescription": "Radius organization API key"
+    }
+  ],
+  "configSchema": { "type": "object", "additionalProperties": false, "properties": {} }
+}

package/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "@openclaw/radius-provider",
+  "version": "2026.9.5",
+  "description": "OpenClaw Radius model gateway provider plugin.",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/openclaw/openclaw"
+  },
+  "type": "module",
+  "openclaw": {
+    "extensions": [
+      "./index.ts"
+    ],
+    "install": {
+      "clawhubSpec": "clawhub:@openclaw/radius-provider",
+      "npmSpec": "@openclaw/radius-provider",
+      "defaultChoice": "npm",
+      "minHostVersion": ">=2026.9.4"
+    },
+    "compat": {
+      "pluginApi": ">=2026.9.5"
+    },
+    "build": {
+      "openclawVersion": "2026.9.5",
+      "bundledDist": false
+    },
+    "release": {
+      "publishToClawHub": true,
+      "publishToNpm": true
+    },
+    "runtimeExtensions": [
+      "./dist/index.js"
+    ]
+  },
+  "files": [
+    "dist/**",
+    "openclaw.plugin.json",
+    "README.md",
+    "assets/icon.png",
+    "assets/activity.svg"
+  ],
+  "peerDependencies": {
+    "openclaw": ">=2026.9.5"
+  },
+  "peerDependenciesMeta": {
+    "openclaw": {
+      "optional": true
+    }
+  },
+  "bundledDependencies": []
+}