clawtamer 0.1.1

package/bin/clawtamer.js

@@ -0,0 +1,1205 @@
+#!/usr/bin/env node
+"use strict";
+
+const fs = require("node:fs");
+const path = require("node:path");
+const os = require("node:os");
+const { execFileSync } = require("node:child_process");
+const readline = require("node:readline/promises");
+const { stdin, stdout } = require("node:process");
+const { API_BASE, OPENCLAW_DIR_NAME } = require("../src/config");
+
+const HELP = `
+Usage: clawtamer [command] [options]
+
+Commands:
+  init             Setup flow for both new and existing users
+  status           Show local + remote status
+  test             Send a test proxy request
+  savings [period] Show savings (7d, 30d, lifetime)
+  doctor           Diagnose setup issues
+  store-key        Rotate stored Anthropic key
+  restore          Remove clawtamer config patch
+  remove           Alias for restore
+
+Options:
+  --key <key>      Back-compat key flag (context dependent)
+  --proxy-key <k>  Explicit Clawtamer API key (sk-cltm-...)
+  --upstream-key <k> Explicit Anthropic key (sk-ant-...)
+  --existing-user  Skip signup and use existing Clawtamer proxy key flow
+  --new-user       Force new-user signup flow
+  --skip-install-test Skip automatic post-install proxy validation
+  --email <email>  Email used for signup
+  --yes, -y        Auto-confirm interactive prompts
+  --dry-run        Validate signup/preflight but do not edit openclaw.json
+  --activate       Force activation even if proxy preflight fails
+  --api-base <url> Override API base URL
+  --dir <path>     Override OpenClaw root directory
+  --help           Show this help
+  --version        Show version
+`.trim();
+
+const USE_COLOR = Boolean(stdout.isTTY) && !process.env.NO_COLOR;
+const ANSI = {
+  reset: "\x1b[0m",
+  bold: "\x1b[1m",
+  dim: "\x1b[2m",
+  red: "\x1b[31m",
+  green: "\x1b[32m",
+  yellow: "\x1b[33m",
+  cyan: "\x1b[36m"
+};
+
+function paint(text, code) {
+  if (!USE_COLOR) return String(text);
+  return `${code}${text}${ANSI.reset}`;
+}
+
+function info(text) {
+  return paint(text, ANSI.cyan);
+}
+
+function success(text) {
+  return paint(text, ANSI.green);
+}
+
+function warn(text) {
+  return paint(text, ANSI.yellow);
+}
+
+function danger(text) {
+  return paint(text, ANSI.red);
+}
+
+function dim(text) {
+  return paint(text, ANSI.dim);
+}
+
+function bold(text) {
+  return paint(text, ANSI.bold);
+}
+
+function parseArgs(argv) {
+  const flags = {};
+  let command = null;
+
+  for (let i = 2; i < argv.length; i += 1) {
+    const token = argv[i];
+
+    if (token === "-y") {
+      flags["--yes"] = true;
+      continue;
+    }
+
+    if (token.startsWith("--")) {
+      const next = argv[i + 1];
+      const boolFlags = new Set(["--help", "--version", "--yes", "--verbose", "--dry-run", "--activate"]);
+      if (!boolFlags.has(token) && next && !next.startsWith("--")) {
+        flags[token] = next;
+        i += 1;
+      } else {
+        flags[token] = true;
+      }
+      continue;
+    }
+
+    if (!command) {
+      command = token;
+      continue;
+    }
+
+    if (!flags._) flags._ = [];
+    flags._.push(token);
+  }
+
+  return { command: command || "init", flags };
+}
+
+function banner() {
+  console.log(bold(info("Clawtamer CLI")));
+  console.log(dim("Tame the lobster."));
+}
+
+function logStep(flags, message) {
+  if (!flags["--verbose"]) return;
+  console.log(dim(`[debug] ${message}`));
+}
+
+function getApiBase(flags, config) {
+  if (flags["--api-base"]) return String(flags["--api-base"]);
+  const local = config?.models?.providers?.clawtamer?.baseUrl;
+  if (local) return local;
+  return API_BASE;
+}
+
+function findOpenClawConfig(baseDir) {
+  const candidates = getConfigSearchPaths(baseDir);
+
+  for (const candidate of candidates) {
+    try {
+      const raw = fs.readFileSync(candidate, "utf8");
+      return { configPath: candidate, config: JSON.parse(raw) };
+    } catch {
+      // continue
+    }
+  }
+
+  return null;
+}
+
+function getConfigSearchPaths(baseDir) {
+  const paths = [];
+  const activeConfigPath = detectActiveConfigPath(baseDir);
+  if (activeConfigPath) paths.push(activeConfigPath);
+  if (process.env.OPENCLAW_CONFIG_PATH) paths.push(path.resolve(String(process.env.OPENCLAW_CONFIG_PATH)));
+  if (process.env.OPENCLAW_HOME) paths.push(path.join(process.env.OPENCLAW_HOME, "openclaw.json"));
+  paths.push(path.join(baseDir, OPENCLAW_DIR_NAME, "openclaw.json"));
+  paths.push(path.join(baseDir, "..", OPENCLAW_DIR_NAME, "openclaw.json"));
+  paths.push(path.join(baseDir, "openclaw.json"));
+  paths.push(path.join(baseDir, "..", "openclaw.json"));
+  paths.push(path.join(os.homedir(), OPENCLAW_DIR_NAME, "openclaw.json"));
+  return unique(paths.map((p) => path.resolve(p)));
+}
+
+function detectActiveConfigPath(baseDir) {
+  try {
+    const out = execFileSync("openclaw", ["config", "file"], {
+      cwd: baseDir,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    const firstLine = out.split(/\r?\n/).map((l) => l.trim()).find(Boolean);
+    if (!firstLine) return null;
+    const rawPath = firstLine.replace(/^Config file:\s*/i, "");
+    if (rawPath.startsWith("~/")) return path.join(os.homedir(), rawPath.slice(2));
+    return rawPath;
+  } catch {
+    return null;
+  }
+}
+
+function getStorageDir(configDir) {
+  return path.join(configDir, "clawtamer");
+}
+
+function loadMetadata(configDir) {
+  try {
+    return JSON.parse(fs.readFileSync(path.join(getStorageDir(configDir), "metadata.json"), "utf8"));
+  } catch {
+    return {};
+  }
+}
+
+function saveMetadata(configDir, data) {
+  const dir = getStorageDir(configDir);
+  fs.mkdirSync(dir, { recursive: true });
+  const existing = loadMetadata(configDir);
+  fs.writeFileSync(path.join(dir, "metadata.json"), JSON.stringify({ ...existing, ...data }, null, 2) + "\n");
+}
+
+function clearMetadata(configDir) {
+  try {
+    fs.unlinkSync(path.join(getStorageDir(configDir), "metadata.json"));
+  } catch {}
+}
+
+async function promptText(question, { secret = false, required = true } = {}) {
+  if (!stdin.isTTY || !stdout.isTTY) {
+    throw new Error(`Interactive prompt unavailable for "${question.trim()}". Use CLI flags instead.`);
+  }
+
+  const rl = readline.createInterface({ input: stdin, output: stdout });
+  try {
+    if (!secret) {
+      const ans = (await rl.question(question)).trim();
+      if (required && !ans) return promptText(question, { secret, required });
+      return ans;
+    }
+
+    const oldWrite = stdout.write;
+    oldWrite.call(stdout, `${question} (input hidden): `);
+    stdout.write = function mutedWrite(chunk, encoding, cb) {
+      if (typeof chunk === "string" && chunk.includes("\n")) {
+        return oldWrite.call(stdout, chunk, encoding, cb);
+      }
+      return true;
+    };
+
+    const ans = (await rl.question("")).trim();
+    stdout.write = oldWrite;
+    oldWrite.call(stdout, "\n");
+
+    if (required && !ans) {
+      oldWrite.call(stdout, "No input captured. Retrying with visible input for reliability.\n");
+      return promptText(question, { secret: false, required });
+    }
+    return ans;
+  } finally {
+    rl.close();
+  }
+}
+
+async function confirm(question, fallbackNo = true) {
+  const answer = (await promptText(`${question} `, { required: false })).toLowerCase();
+  if (!answer) return !fallbackNo;
+  return answer === "y" || answer === "yes";
+}
+
+function canPromptInteractively() {
+  return Boolean(stdin.isTTY && stdout.isTTY);
+}
+
+function mask(value) {
+  if (!value || value.length < 8) return "***";
+  return `${value.slice(0, 6)}...${value.slice(-4)}`;
+}
+
+async function httpJson(url, options = {}) {
+  const timeoutMs = Number(options.timeoutMs || 30_000);
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+
+  try {
+    const response = await fetch(url, { ...options, signal: controller.signal });
+    const text = await response.text();
+    let data;
+    try {
+      data = text ? JSON.parse(text) : {};
+    } catch {
+      data = { raw: text };
+    }
+    return { ok: response.ok, status: response.status, data, headers: response.headers };
+  } catch (err) {
+    if (err.name === "AbortError") {
+      throw new Error(`Request timeout after ${timeoutMs}ms for ${url}`);
+    }
+    throw err;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+function ensureAnthropicKey(key) {
+  const raw = String(key || "").trim();
+  if (!raw.startsWith("sk-ant-")) {
+    throw new Error("Anthropic key must start with sk-ant-");
+  }
+  if (/\s/.test(raw)) {
+    throw new Error("Anthropic key cannot contain spaces or newlines");
+  }
+  if ((raw.match(/sk-ant-/g) || []).length > 1) {
+    throw new Error("Anthropic key appears pasted multiple times. Paste one key only.");
+  }
+  if (raw.length < 24 || raw.length > 500) {
+    throw new Error("Anthropic key length looks invalid. Paste a full key from console.anthropic.com.");
+  }
+}
+
+function ensureProxyKey(key) {
+  const raw = String(key || "").trim();
+  if (!raw.startsWith("sk-cltm-")) {
+    throw new Error("Clawtamer API key must start with sk-cltm-");
+  }
+  if (/\s/.test(raw)) {
+    throw new Error("Clawtamer API key cannot contain spaces or newlines");
+  }
+  if ((raw.match(/sk-cltm-/g) || []).length > 1) {
+    throw new Error("Clawtamer API key appears pasted multiple times. Paste one key only.");
+  }
+}
+
+function ensureEmail(value) {
+  const email = String(value || "").trim().toLowerCase();
+  if (!email) {
+    throw new Error("Email is required");
+  }
+  const rx = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+  if (!rx.test(email)) {
+    throw new Error("Enter a valid email address (example: you@example.com)");
+  }
+  if (email.length > 254) {
+    throw new Error("Email is too long");
+  }
+  return email;
+}
+
+async function promptValidated(question, validate) {
+  while (true) {
+    const answer = await promptText(question);
+    const err = validate(answer);
+    if (!err) return answer;
+    console.warn(err);
+  }
+}
+
+async function promptAnthropicKey(question) {
+  return promptValidated(question, (value) => {
+    try {
+      ensureAnthropicKey(value);
+      return null;
+    } catch (err) {
+      return err.message || String(err);
+    }
+  });
+}
+
+async function promptProxyKey(question) {
+  return promptValidated(question, (value) => {
+    try {
+      ensureProxyKey(value);
+      return null;
+    } catch (err) {
+      return err.message || String(err);
+    }
+  });
+}
+
+async function promptAccountMode() {
+  const answer = (
+    await promptText("Did you sign up at https://www.clawtamer.ai/dashboard? (y/N): ", { required: false })
+  )
+    .trim()
+    .toLowerCase();
+  if (answer === "y" || answer === "yes") return "existing";
+  return "new";
+}
+
+function ensureObjectPath(target, keys) {
+  let ref = target;
+  for (const key of keys) {
+    if (!ref[key] || typeof ref[key] !== "object") ref[key] = {};
+    ref = ref[key];
+  }
+  return ref;
+}
+
+function upsertClawtamerProvider(config, apiBase, proxyKey) {
+  ensureObjectPath(config, ["models", "providers"]);
+  const modelEntry = (id, name, input) => ({
+    id,
+    name,
+    contextWindow: 200000,
+    maxTokens: 8192,
+    reasoning: false,
+    input
+  });
+  config.models.providers.clawtamer = {
+    baseUrl: apiBase,
+    apiKey: proxyKey,
+    api: "anthropic-messages",
+    models: [
+      modelEntry("auto", "Auto (Clawtamer optimizer)", ["text"]),
+      modelEntry("claude-haiku-4-5", "Claude Haiku 4.5", ["text"]),
+      modelEntry("claude-sonnet-4-5", "Claude Sonnet 4.5", ["text", "image"]),
+      modelEntry("claude-opus-4-6", "Claude Opus 4.6", ["text", "image"])
+    ]
+  };
+}
+
+function ensureClawtamerAllowlist(config) {
+  const allow = ensureObjectPath(config, ["agents", "defaults", "models"]);
+  if (!allow["clawtamer/auto"]) allow["clawtamer/auto"] = { alias: "Clawtamer Auto" };
+  if (!allow["clawtamer/claude-haiku-4-5"]) allow["clawtamer/claude-haiku-4-5"] = { alias: "Clawtamer Haiku 4.5" };
+  if (!allow["clawtamer/claude-sonnet-4-5"]) allow["clawtamer/claude-sonnet-4-5"] = { alias: "Clawtamer Sonnet 4.5" };
+  if (!allow["clawtamer/claude-opus-4-6"]) allow["clawtamer/claude-opus-4-6"] = { alias: "Clawtamer Opus 4.6" };
+}
+
+function collectAgentOverrideWarnings(configDir) {
+  const warnings = [];
+  const agentsRoot = path.join(configDir, "agents");
+  if (!fs.existsSync(agentsRoot)) return warnings;
+
+  const entries = fs.readdirSync(agentsRoot, { withFileTypes: true }).filter((e) => e.isDirectory());
+  for (const entry of entries) {
+    const agentName = entry.name;
+    const candidate = path.join(agentsRoot, agentName, "agent", "openclaw.json");
+    if (!fs.existsSync(candidate)) continue;
+
+    try {
+      const parsed = JSON.parse(fs.readFileSync(candidate, "utf8"));
+      const directPrimary = parsed?.model?.primary;
+      const defaultsPrimary = parsed?.agents?.defaults?.model?.primary;
+      const chosen = directPrimary || defaultsPrimary || null;
+      if (chosen && !String(chosen).startsWith("clawtamer/")) {
+        warnings.push({
+          agent: agentName,
+          model: String(chosen),
+          file: candidate
+        });
+      }
+    } catch {
+      // ignore invalid agent config files
+    }
+  }
+
+  return warnings;
+}
+
+function writeConfig(configPath, config) {
+  const dir = path.dirname(configPath);
+  const tmp = path.join(dir, `.openclaw.json.clawtamer.tmp-${Date.now()}`);
+  fs.writeFileSync(tmp, JSON.stringify(config, null, 2) + "\n", "utf8");
+  fs.renameSync(tmp, configPath);
+}
+
+function cloneJson(value) {
+  return value === undefined ? undefined : JSON.parse(JSON.stringify(value));
+}
+
+function unique(values) {
+  return [...new Set(values.filter(Boolean))];
+}
+
+function ensureBackupFile(configPath) {
+  const backupPath = `${configPath}.bak.clawtamer`;
+  if (!fs.existsSync(backupPath)) {
+    fs.writeFileSync(backupPath, fs.readFileSync(configPath, "utf8"), "utf8");
+  }
+  return backupPath;
+}
+
+function buildFallbacks(previousModelConfig) {
+  const previousPrimary = previousModelConfig?.primary;
+  const previousFallbacks = Array.isArray(previousModelConfig?.fallbacks) ? previousModelConfig.fallbacks : [];
+  const safePrevious = [previousPrimary, ...previousFallbacks].filter((m) => !String(m || "").startsWith("clawtamer/"));
+  const merged = unique(safePrevious);
+  if (merged.length > 0) return merged;
+  return ["anthropic/claude-sonnet-4-5"];
+}
+
+function detectBaselineModel(modelConfig) {
+  const primary = modelConfig?.primary;
+  const fallbacks = Array.isArray(modelConfig?.fallbacks) ? modelConfig.fallbacks : [];
+  const candidates = [primary, ...fallbacks].filter(Boolean).map((m) => String(m));
+  const firstNonClawtamer = candidates.find((m) => !m.startsWith("clawtamer/"));
+  return firstNonClawtamer || "anthropic/claude-opus-4-6";
+}
+
+async function preflightProxy(apiBase, proxyKey, flags) {
+  logStep(flags, "Running proxy readiness check...");
+  const payload = {
+    model: "claude-sonnet-4-5",
+    max_tokens: 16,
+    messages: [{ role: "user", content: "Reply with: ok" }]
+  };
+
+  const result = await httpJson(`${apiBase}/v1/messages`, {
+    method: "POST",
+    headers: { "content-type": "application/json", "x-api-key": proxyKey },
+    body: JSON.stringify(payload),
+    timeoutMs: 45_000
+  });
+
+  if (!result.ok) {
+    const reason = result.data?.error?.message || JSON.stringify(result.data);
+    return { ok: false, reason: reason || `HTTP ${result.status}` };
+  }
+  return { ok: true };
+}
+
+async function runPreflightWithRetry(apiBase, proxyKey, flags, attempts = 2) {
+  let last = { ok: false, reason: "not-run" };
+  for (let i = 1; i <= attempts; i += 1) {
+    try {
+      last = await preflightProxy(apiBase, proxyKey, flags);
+    } catch (err) {
+      last = { ok: false, reason: err.message || String(err) };
+    }
+    if (last.ok) return last;
+    logStep(flags, `Preflight attempt ${i}/${attempts} failed: ${last.reason}`);
+    if (i < attempts) {
+      await new Promise((resolve) => setTimeout(resolve, 800));
+    }
+  }
+  return last;
+}
+
+async function runInstallValidation(apiBase, proxyKey) {
+  const payload = {
+    model: "claude-sonnet-4-5",
+    max_tokens: 24,
+    messages: [{ role: "user", content: "Reply with the word: healthy" }]
+  };
+
+  const r = await httpJson(`${apiBase}/v1/messages`, {
+    method: "POST",
+    headers: { "content-type": "application/json", "x-api-key": proxyKey },
+    body: JSON.stringify(payload),
+    timeoutMs: 45_000
+  });
+
+  if (!r.ok) {
+    const reason = r.data?.error?.message || JSON.stringify(r.data);
+    return { ok: false, reason: reason || `HTTP ${r.status}` };
+  }
+
+  return {
+    ok: true,
+    routedModel: r.headers.get("x-clawtamer-routed-model") || "n/a",
+    savedUsd: r.headers.get("x-clawtamer-saved-usd") || "n/a",
+    requestId: r.headers.get("x-clawtamer-request-id") || "n/a"
+  };
+}
+
+async function signupWithRetry(apiBase, payload, flags, attempts = 2) {
+  let last = null;
+  for (let i = 1; i <= attempts; i += 1) {
+    last = await httpJson(`${apiBase}/v1/signup`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(payload),
+      timeoutMs: 30_000
+    });
+
+    if (last.ok && last.data?.api_key) return last;
+    const status = Number(last.status || 0);
+    const retryable = status >= 500 || status === 429 || status === 0;
+    if (!retryable || i >= attempts) break;
+    logStep(flags, `Signup attempt ${i}/${attempts} failed with HTTP ${status}; retrying...`);
+    await new Promise((resolve) => setTimeout(resolve, 1000));
+  }
+  return last;
+}
+
+async function storeUpstreamKey(apiBase, proxyKey, upstreamKey) {
+  return httpJson(`${apiBase}/v1/store-key`, {
+    method: "POST",
+    headers: { "content-type": "application/json", "x-api-key": proxyKey },
+    body: JSON.stringify({ upstream_key: upstreamKey }),
+    timeoutMs: 30_000
+  });
+}
+
+async function cmdInit(flags) {
+  const baseDir = flags["--dir"] || process.cwd();
+  logStep(flags, `Searching OpenClaw config under: ${baseDir}`);
+  const found = findOpenClawConfig(baseDir);
+  if (!found) {
+    const searchPaths = getConfigSearchPaths(baseDir);
+    console.error("No OpenClaw config found.");
+    console.error("");
+    console.error("Clawtamer patches an existing OpenClaw config. Run from an OpenClaw project, or use --dir <path>.");
+    console.error("");
+    console.error("Paths checked:");
+    searchPaths.forEach((p) => console.error(`  - ${p}`));
+    console.error("");
+    console.error("If you don't have OpenClaw yet, install it first. Then run `clawtamer init` from that project.");
+    process.exit(1);
+  }
+
+  const { configPath, config } = found;
+  const configDir = path.dirname(configPath);
+  const apiBase = getApiBase(flags, config);
+  logStep(flags, `Using config: ${configPath}`);
+  logStep(flags, `Using API base: ${apiBase}`);
+
+  const existing = config.models?.providers?.clawtamer;
+  if (existing && !flags["--yes"]) {
+    const proceed = await confirm("Clawtamer is already configured. Reapply setup? (y/N)", true);
+    if (!proceed) {
+      console.log("No changes applied.");
+      return;
+    }
+  }
+
+  const modeFromFlags = flags["--new-user"] ? "new" : flags["--existing-user"] ? "existing" : null;
+  const accountMode = modeFromFlags || (canPromptInteractively() ? await promptAccountMode() : "new");
+  const emailPrompt =
+    accountMode === "existing"
+      ? "Please enter your account email (please use the same email you used to signup): "
+      : "Please enter your account email (you will use this to access your dashboard): ";
+  const emailInput = flags["--email"] || (await promptValidated(emailPrompt, (value) => {
+    try {
+      ensureEmail(value);
+      return null;
+    } catch (err) {
+      return err.message || String(err);
+    }
+  }));
+  const email = ensureEmail(emailInput);
+  const explicitProxyKey = flags["--proxy-key"] || (String(flags["--key"] || "").startsWith("sk-cltm-") ? flags["--key"] : null);
+  const upstreamKey = flags["--upstream-key"] || (String(flags["--key"] || "").startsWith("sk-ant-") ? flags["--key"] : null);
+  if (upstreamKey) ensureAnthropicKey(upstreamKey);
+  if (explicitProxyKey) ensureProxyKey(explicitProxyKey);
+
+  let resolvedUpstreamKey = upstreamKey;
+  let resolvedProxyKey = explicitProxyKey;
+  if (!resolvedProxyKey && accountMode === "existing" && canPromptInteractively()) {
+    resolvedProxyKey = await promptProxyKey(
+      "Please enter your existing Clawtamer API key (sk-cltm-...). Don't know it? Log in at https://www.clawtamer.ai/login then open Dashboard and click 'Reveal API Key': "
+    );
+  }
+  if (!resolvedUpstreamKey && canPromptInteractively()) {
+    resolvedUpstreamKey = await promptAnthropicKey(
+      "Please enter your Anthropic API key (get it from https://console.anthropic.com/settings/keys): "
+    );
+  }
+  if (resolvedUpstreamKey) {
+    ensureAnthropicKey(resolvedUpstreamKey);
+    console.log(success(`Anthropic key successfully detected: ${mask(resolvedUpstreamKey)}`));
+  }
+  if (!resolvedUpstreamKey && !resolvedProxyKey) {
+    console.error("Missing credentials. Provide --upstream-key sk-ant-... or --proxy-key sk-cltm-..., or run interactively.");
+    process.exit(1);
+  }
+  const detectedBaselineModel = detectBaselineModel(config.agents?.defaults?.model || {});
+
+  let proxyKey = resolvedProxyKey || null;
+  if (!proxyKey) {
+    logStep(flags, "Creating your Clawtamer account...");
+    const signup = await signupWithRetry(apiBase, {
+      email,
+      upstream_key: resolvedUpstreamKey,
+      provider: "anthropic",
+      framework: "openclaw",
+      baseline_model: detectedBaselineModel
+    });
+
+    if (!signup.ok || !signup.data?.api_key) {
+      const code = String(signup.data?.error?.code || signup.data?.code || "").toUpperCase();
+      if (code.includes("EMAIL_EXISTS") || code.includes("ACCOUNT_EXISTS")) {
+        if (canPromptInteractively()) {
+          console.warn(warn("This email already exists. Switching to existing-user flow."));
+          proxyKey = await promptProxyKey(
+            "Please enter your existing Clawtamer API key (sk-cltm-...). Don't know it? Log in at https://www.clawtamer.ai/login then open Dashboard and click 'Reveal API Key': "
+          );
+          logStep(flags, "Existing account key captured.");
+        } else {
+          console.error("This email already exists. Re-run with your existing proxy key:");
+          console.error("  npx clawtamer init --proxy-key sk-cltm-... --email <email>");
+          process.exit(1);
+        }
+      } else {
+        console.error("Signup failed:", signup.data?.error || signup.data);
+        if (Number(signup.status || 0) >= 500) {
+          console.error("Server error during signup (e.g. bad gateway). Please retry in a moment.");
+        }
+        process.exit(1);
+      }
+    }
+    if (!proxyKey) {
+      proxyKey = signup.data.api_key;
+      logStep(flags, "Signup complete.");
+    }
+  } else {
+    logStep(flags, "Using provided proxy key (signup skipped).");
+  }
+
+  const dryRun = Boolean(flags["--dry-run"]);
+
+  if (resolvedUpstreamKey && !dryRun) {
+    const store = await storeUpstreamKey(apiBase, proxyKey, resolvedUpstreamKey);
+    if (!store.ok) {
+      console.error("Failed to store upstream key:", store.data?.error || store.data);
+      process.exit(1);
+    }
+    logStep(flags, "Upstream key linked.");
+  }
+
+  let preflight = await runPreflightWithRetry(apiBase, proxyKey, flags, 2);
+
+  if (!preflight.ok && !dryRun && canPromptInteractively()) {
+    console.warn(warn(`Preflight failed: ${preflight.reason}`));
+    console.warn(warn("Let's retry by relinking your Anthropic key."));
+    console.warn(warn("You can find it at: https://console.anthropic.com/settings/keys"));
+
+    for (let i = 1; i <= 2; i += 1) {
+      const retryKey = await promptAnthropicKey(`Anthropic API key retry (${i}/2): `);
+      console.log(success(`Anthropic key successfully detected: ${mask(retryKey)}`));
+      const storeRetry = await storeUpstreamKey(apiBase, proxyKey, retryKey);
+      if (!storeRetry.ok) {
+        console.warn(warn(`Could not store retry key (${i}/2): ${JSON.stringify(storeRetry.data?.error || storeRetry.data)}`));
+        continue;
+      }
+      preflight = await runPreflightWithRetry(apiBase, proxyKey, flags, 2);
+      if (preflight.ok) {
+        resolvedUpstreamKey = retryKey;
+        logStep(flags, "Preflight passed after Anthropic key retry.");
+        break;
+      }
+    }
+  }
+
+  const originalModelConfig = cloneJson(config.agents?.defaults?.model || {});
+  const originalDefaultsModels = cloneJson(config.agents?.defaults?.models || null);
+  const originalModel = originalModelConfig?.primary || null;
+  const shouldActivate = Boolean(preflight.ok || flags["--activate"]);
+
+  if (!preflight.ok) {
+    console.warn(warn(`Preflight failed: ${preflight.reason}`));
+    if (!flags["--activate"]) {
+      console.warn(warn("Safety mode: provider will be added, but primary model will NOT be switched."));
+      console.warn(warn("Use --activate to force switch (not recommended)."));
+    } else {
+      console.warn(warn("Forced activation enabled despite failed preflight."));
+    }
+  } else {
+    logStep(flags, "Preflight passed.");
+  }
+
+  if (dryRun) {
+    console.log("Dry run complete. No OpenClaw config changes were written.");
+    console.log(`Proxy key: ${mask(proxyKey)}`);
+    return;
+  }
+
+  logStep(flags, "Applying OpenClaw config patch...");
+  ensureBackupFile(configPath);
+
+  upsertClawtamerProvider(config, apiBase, proxyKey);
+  ensureClawtamerAllowlist(config);
+
+  ensureObjectPath(config, ["agents", "defaults", "model"]);
+
+  if (shouldActivate) {
+    config.agents.defaults.model.primary = "clawtamer/auto";
+    config.agents.defaults.model.fallbacks = buildFallbacks(originalModelConfig);
+  }
+
+  writeConfig(configPath, config);
+  logStep(flags, "Config patch saved.");
+  saveMetadata(configDir, {
+    originalModelConfig,
+    originalDefaultsModels,
+    originalModel,
+    activated: shouldActivate,
+    setupTimestamp: new Date().toISOString(),
+    apiBase,
+    configPath,
+    email,
+    apiKey: proxyKey
+  });
+
+  if (shouldActivate) {
+    const postActivation = await runPreflightWithRetry(apiBase, proxyKey, flags, 2);
+    if (!postActivation.ok) {
+      console.warn(`Post-activation health check failed: ${postActivation.reason}`);
+      console.warn("Safety rollback: keeping provider installed but reverting default model to previous settings.");
+      const rollbackConfig = cloneJson(config);
+      rollbackConfig.agents.defaults.model = originalModelConfig || {};
+      writeConfig(configPath, rollbackConfig);
+      saveMetadata(configDir, {
+        activated: false,
+        activationAutoDisabled: true,
+        activationAutoDisabledReason: postActivation.reason
+      });
+    }
+  }
+
+  if (!flags["--skip-install-test"]) {
+    logStep(flags, "Running automatic post-install proxy test...");
+    const installValidation = await runInstallValidation(apiBase, proxyKey);
+    if (!installValidation.ok) {
+      console.warn(`Post-install test failed: ${installValidation.reason}`);
+      console.warn("Safety mode: keeping provider installed but leaving model staged.");
+      const rollbackConfig = cloneJson(config);
+      rollbackConfig.agents.defaults.model = originalModelConfig || {};
+      writeConfig(configPath, rollbackConfig);
+      saveMetadata(configDir, {
+        activated: false,
+        activationAutoDisabled: true,
+        activationAutoDisabledReason: installValidation.reason,
+        installTestFailed: true
+      });
+      console.warn("Suggested next steps:");
+      console.warn("1) Verify your Anthropic key at https://console.anthropic.com/settings/keys");
+      console.warn("2) Run: npx clawtamer store-key --dir " + baseDir);
+      console.warn("3) Run: npx clawtamer test --dir " + baseDir);
+    } else {
+      console.log("");
+      console.log(bold(info("Post-install verification:")));
+      if (flags["--verbose"]) {
+        console.log(`- routed model: ${installValidation.routedModel}`);
+        console.log(`- saved usd: ${installValidation.savedUsd}`);
+        console.log(`- request id: ${installValidation.requestId}`);
+        console.log("");
+      }
+      console.log(bold(success("All tests completed SUCCESSFULLY.")));
+      console.log("");
+      console.log("Clawtamer is installed and now routing your requests.");
+      console.log("Clawtamer will automatically route requests and reduce API cost.");
+      console.log("");
+      console.log("Track savings anytime:");
+      console.log("- npx clawtamer savings");
+      console.log("- Dashboard: https://www.clawtamer.ai/dashboard");
+    }
+  }
+
+  const finalMeta = loadMetadata(configDir);
+  const finalActivated = Boolean(finalMeta.activated);
+
+  console.log("");
+  console.log(bold(success("Clawtamer setup COMPLETED.")));
+  if (flags["--verbose"]) {
+    console.log(`Config: ${configPath}`);
+    console.log(`Proxy key: ${mask(proxyKey)}`);
+    if (finalActivated) {
+      console.log("Mode: active (primary=clawtamer/auto with preserved fallbacks)");
+    } else {
+      console.log("Mode: staged (provider installed only, primary unchanged)");
+    }
+  }
+  console.log("");
+  console.log(bold(warn("PLEASE RESTART YOUR GATEWAY (if already running):")));
+  console.log("1. Stop current gateway process (Ctrl+C where it is running).");
+  console.log("2. Start again: openclaw gateway");
+  console.log("3. Then open a new chat session and verify model/provider.");
+  const overrideWarnings = collectAgentOverrideWarnings(configDir);
+  if (overrideWarnings.length > 0) {
+    console.warn(warn("Warning: one or more agent-level model overrides may bypass clawtamer/auto:"));
+    overrideWarnings.forEach((w) => {
+      console.warn(`- agent=${w.agent} model=${w.model}`);
+      logStep(flags, `  file: ${w.file}`);
+    });
+    console.warn("Update those agent configs to clawtamer/auto (or remove agent-level primary) to enforce proxy routing.");
+  }
+  console.log("");
+  console.log(success("Enjoy your savings with Clawtamer!"));
+}
+
+async function resolveProxyKey(flags, configDir, config) {
+  if (flags["--proxy-key"]) return String(flags["--proxy-key"]);
+  if (flags["--key"]) return String(flags["--key"]);
+  const fromConfig = config.models?.providers?.clawtamer?.apiKey;
+  if (fromConfig) return fromConfig;
+  const meta = loadMetadata(configDir);
+  if (meta?.apiKey) return meta.apiKey;
+  return null;
+}
+
+async function cmdStatus(flags) {
+  const baseDir = flags["--dir"] || process.cwd();
+  const found = findOpenClawConfig(baseDir);
+  if (!found) {
+    console.error("No OpenClaw config found.");
+    process.exit(1);
+  }
+
+  const { configPath, config } = found;
+  const configDir = path.dirname(configPath);
+  const apiBase = getApiBase(flags, config);
+  logStep(flags, `Status check using API base: ${apiBase}`);
+  const provider = config.models?.providers?.clawtamer;
+
+  if (!provider) {
+    console.log("Clawtamer is not configured yet.");
+    return;
+  }
+
+  const key = await resolveProxyKey(flags, configDir, config);
+  if (!key) {
+    console.log("Clawtamer appears configured locally but no proxy key was found.");
+    return;
+  }
+
+  let savings = null;
+  try {
+    const r = await httpJson(`${apiBase}/v1/savings`, { headers: { "x-api-key": key } });
+    if (r.ok) savings = r.data;
+  } catch {
+    // ignore
+  }
+
+  console.log(bold(info("Clawtamer status")));
+  console.log(`${dim("-")} config: ${configPath}`);
+  console.log(`${dim("-")} proxy: ${provider.baseUrl}`);
+  console.log(`${dim("-")} key: ${mask(key)}`);
+  if (savings) {
+    console.log(`${dim("-")} requests: ${savings.requests}`);
+    console.log(`${dim("-")} saved_usd_lifetime: ${savings.saved_usd_lifetime}`);
+    console.log(`${dim("-")} monthly_message_count: ${savings.monthly_message_count}`);
+    if (savings.paywall_status) {
+      console.log(`${dim("-")} paywall_status: ${savings.paywall_status}`);
+    }
+    if (Number.isFinite(Number(savings.paywall_remaining_hours))) {
+      console.log(`${dim("-")} paywall_remaining_hours: ${savings.paywall_remaining_hours}`);
+    }
+    if (Number.isFinite(Number(savings.paywall_remaining_messages))) {
+      console.log(`${dim("-")} paywall_remaining_messages: ${savings.paywall_remaining_messages}`);
+    }
+    if (savings.paywall_upgrade_url) {
+      console.log(`${dim("-")} upgrade_url: ${savings.paywall_upgrade_url}`);
+    }
+  }
+}
+
+async function cmdTest(flags) {
+  const baseDir = flags["--dir"] || process.cwd();
+  const found = findOpenClawConfig(baseDir);
+  if (!found) {
+    console.error("No OpenClaw config found.");
+    process.exit(1);
+  }
+
+  const { configPath, config } = found;
+  const configDir = path.dirname(configPath);
+  const apiBase = getApiBase(flags, config);
+  logStep(flags, `Running proxy test against: ${apiBase}`);
+  const key = await resolveProxyKey(flags, configDir, config);
+
+  if (!key) {
+    console.error("No Clawtamer key found.");
+    process.exit(1);
+  }
+
+  ensureProxyKey(key);
+
+  const payload = {
+    model: "claude-sonnet-4-5",
+    max_tokens: 24,
+    messages: [{ role: "user", content: "Reply with the word: healthy" }]
+  };
+
+  const r = await httpJson(`${apiBase}/v1/messages`, {
+    method: "POST",
+    headers: { "content-type": "application/json", "x-api-key": key },
+    body: JSON.stringify(payload)
+  });
+
+  if (!r.ok) {
+    console.error("Test failed:", r.data?.error || r.data);
+    process.exit(1);
+  }
+
+  console.log(success("Proxy test passed."));
+  console.log(`${dim("-")} routed model: ${r.headers.get("x-clawtamer-routed-model") || "n/a"}`);
+  console.log(`${dim("-")} saved usd: ${r.headers.get("x-clawtamer-saved-usd") || "n/a"}`);
+  console.log(`${dim("-")} request id: ${r.headers.get("x-clawtamer-request-id") || "n/a"}`);
+  console.log(`${dim("-")} paywall status: ${r.headers.get("x-clawtamer-paywall-status") || "n/a"}`);
+  console.log(`${dim("-")} upgrade url: ${r.headers.get("x-clawtamer-upgrade-url") || "n/a"}`);
+}
+
+async function cmdSavings(flags) {
+  const rawPeriod = String(flags._?.[0] || "7d").toLowerCase();
+  const period = rawPeriod === "24h" ? "7d" : rawPeriod;
+  const allowed = new Set(["7d", "30d", "lifetime"]);
+  if (!allowed.has(period)) {
+    console.error(danger(`Invalid period: ${rawPeriod}. Use one of: 7d, 30d, lifetime`));
+    process.exit(1);
+  }
+  const baseDir = flags["--dir"] || process.cwd();
+  const found = findOpenClawConfig(baseDir);
+  if (!found) {
+    console.error("No OpenClaw config found.");
+    process.exit(1);
+  }
+
+  const { configPath, config } = found;
+  const configDir = path.dirname(configPath);
+  const apiBase = getApiBase(flags, config);
+  logStep(flags, `Fetching insights (${period}) from: ${apiBase}`);
+  const key = await resolveProxyKey(flags, configDir, config);
+
+  if (!key) {
+    console.error("No Clawtamer key found.");
+    process.exit(1);
+  }
+
+  const [lifetimeRes, periodRes] = await Promise.all([
+    httpJson(`${apiBase}/v1/savings`, { headers: { "x-api-key": key } }),
+    period === "lifetime"
+      ? Promise.resolve({ ok: true, data: null })
+      : httpJson(`${apiBase}/v1/insights?period=${encodeURIComponent(period)}`, {
+          headers: { "x-api-key": key }
+        })
+  ]);
+
+  if (!lifetimeRes.ok) {
+    console.error(danger("Failed to fetch lifetime savings:"), lifetimeRes.data?.error || lifetimeRes.data);
+    process.exit(1);
+  }
+  if (!periodRes.ok) {
+    console.error(danger("Failed to fetch period insights:"), periodRes.data?.error || periodRes.data);
+    process.exit(1);
+  }
+
+  console.log(bold(info("Savings")));
+  console.log(`${dim("-")} lifetime_saved_usd: ${lifetimeRes.data.saved_usd_lifetime}`);
+  console.log(`${dim("-")} lifetime_requests: ${lifetimeRes.data.requests}`);
+  console.log(`${dim("-")} monthly_message_count: ${lifetimeRes.data.monthly_message_count}`);
+
+  if (period !== "lifetime" && periodRes.data) {
+    console.log(`${dim("-")} period: ${periodRes.data.period || period}`);
+    console.log(`${dim("-")} period_requests: ${periodRes.data.total_requests}`);
+    console.log(`${dim("-")} period_saved_tokens: ${periodRes.data.saved_tokens}`);
+    console.log(`${dim("-")} period_estimated_savings_usd: ${periodRes.data.estimated_savings_usd}`);
+    if (periodRes.data.routing_breakdown) {
+      console.log(
+        `${dim("-")} routing: simple ${periodRes.data.routing_breakdown.simple}% | mid ${periodRes.data.routing_breakdown.mid}% | complex ${periodRes.data.routing_breakdown.complex}% | reasoning ${periodRes.data.routing_breakdown.reasoning}%`
+      );
+    }
+  }
+}
+
+async function cmdStoreKey(flags) {
+  const baseDir = flags["--dir"] || process.cwd();
+  const found = findOpenClawConfig(baseDir);
+  if (!found) {
+    console.error("No OpenClaw config found.");
+    process.exit(1);
+  }
+
+  const { configPath, config } = found;
+  const configDir = path.dirname(configPath);
+  const apiBase = getApiBase(flags, config);
+  logStep(flags, `Rotating upstream key via: ${apiBase}`);
+  const proxyKey = await resolveProxyKey(flags, configDir, config);
+
+  if (!proxyKey) {
+    console.error("No Clawtamer proxy key found.");
+    process.exit(1);
+  }
+
+  const upstreamKey = flags["--upstream-key"] || (!flags["--proxy-key"] ? flags["--key"] : null) || (await promptText("New Anthropic API key: ", { secret: true }));
+  ensureAnthropicKey(upstreamKey);
+
+  const r = await httpJson(`${apiBase}/v1/store-key`, {
+    method: "POST",
+    headers: { "content-type": "application/json", "x-api-key": proxyKey },
+    body: JSON.stringify({ upstream_key: upstreamKey })
+  });
+
+  if (!r.ok) {
+    console.error("Failed to store key:", r.data?.error || r.data);
+    process.exit(1);
+  }
+
+  console.log(success(`Upstream key rotated successfully. last4=${r.data.key_last4}`));
+}
+
+async function cmdRestore(flags) {
+  const baseDir = flags["--dir"] || process.cwd();
+  const found = findOpenClawConfig(baseDir);
+  if (!found) {
+    console.error("No OpenClaw config found.");
+    process.exit(1);
+  }
+
+  const { configPath, config } = found;
+  const configDir = path.dirname(configPath);
+  const metadata = loadMetadata(configDir);
+
+  if (!flags["--yes"]) {
+    const proceed = await confirm("Remove Clawtamer from this OpenClaw config? (y/N)", true);
+    if (!proceed) return;
+  }
+
+  if (config.models?.providers?.clawtamer) {
+    delete config.models.providers.clawtamer;
+  }
+
+  ensureObjectPath(config, ["agents", "defaults", "model"]);
+
+  if (metadata.originalModelConfig && typeof metadata.originalModelConfig === "object") {
+    config.agents.defaults.model = metadata.originalModelConfig;
+  } else if (metadata.originalModel) {
+    config.agents.defaults.model.primary = metadata.originalModel;
+    delete config.agents.defaults.model.fallbacks;
+  }
+
+  // Restore allowlist state as it existed before install, if we captured it.
+  if (Object.prototype.hasOwnProperty.call(metadata, "originalDefaultsModels")) {
+    if (metadata.originalDefaultsModels && typeof metadata.originalDefaultsModels === "object") {
+      config.agents.defaults.models = metadata.originalDefaultsModels;
+    } else if (config.agents.defaults.models && typeof config.agents.defaults.models === "object") {
+      delete config.agents.defaults.models["clawtamer/auto"];
+      delete config.agents.defaults.models["clawtamer/claude-haiku-4-5"];
+      delete config.agents.defaults.models["clawtamer/claude-sonnet-4-5"];
+      delete config.agents.defaults.models["clawtamer/claude-opus-4-6"];
+      if (Object.keys(config.agents.defaults.models).length === 0) {
+        delete config.agents.defaults.models;
+      }
+    }
+  }
+
+  writeConfig(configPath, config);
+  clearMetadata(configDir);
+
+  console.log(success("Clawtamer restore complete (provider removed)."));
+}
+
+async function cmdDoctor(flags) {
+  const issues = [];
+  const warns = [];
+  const passes = [];
+
+  const major = Number(process.versions.node.split(".")[0]);
+  if (major >= 22) passes.push(`Node.js ${process.versions.node}`);
+  else issues.push(`Node.js ${process.versions.node} (requires >=22)`);
+
+  const baseDir = flags["--dir"] || process.cwd();
+  const found = findOpenClawConfig(baseDir);
+  if (!found) {
+    issues.push("No OpenClaw config found");
+  } else {
+    passes.push(`OpenClaw config found at ${found.configPath}`);
+    const provider = found.config?.models?.providers?.clawtamer;
+    if (provider) passes.push("Clawtamer provider configured");
+    else warns.push("Clawtamer provider not configured yet (run init)");
+  }
+
+  if (issues.length) {
+    console.log(danger("[FAIL]"));
+    issues.forEach((i) => console.log(`- ${i}`));
+    warns.forEach((w) => console.log(`${warn("- [WARN]")} ${w}`));
+    process.exit(1);
+  }
+
+  console.log(success("[PASS]"));
+  passes.forEach((p) => console.log(`- ${p}`));
+  warns.forEach((w) => console.log(`${warn("- [WARN]")} ${w}`));
+}
+
+async function main() {
+  const { command, flags } = parseArgs(process.argv);
+
+  if (flags["--help"]) {
+    banner();
+    console.log("");
+    console.log(HELP);
+    return;
+  }
+
+  if (flags["--version"]) {
+    const pkg = require("../package.json");
+    console.log(pkg.version);
+    return;
+  }
+
+  switch (command) {
+    case "init":
+      await cmdInit(flags);
+      break;
+    case "login":
+      await cmdInit({ ...flags, "--existing-user": true });
+      break;
+    case "status":
+      await cmdStatus(flags);
+      break;
+    case "test":
+      await cmdTest(flags);
+      break;
+    case "savings":
+      await cmdSavings(flags);
+      break;
+    case "doctor":
+      await cmdDoctor(flags);
+      break;
+    case "store-key":
+      await cmdStoreKey(flags);
+      break;
+    case "restore":
+    case "remove":
+      await cmdRestore(flags);
+      break;
+    default:
+      console.error(`Unknown command: ${command}`);
+      console.log(HELP);
+      process.exit(1);
+  }
+}
+
+main().catch((err) => {
+  console.error(err.message || err);
+  process.exit(1);
+});