Update setup-hf-config.mjs

setup-hf-config.mjs

@@ -1,270 +1,232 @@
-import fs   from "node:fs";
+import fs from "node:fs";
 import path from "node:path";
 import https from "node:https";
 
-// ============================================================
-// OpenClaw HF Spaces - Production Config Writer
-//
-// Storage: HF Storage Bucket at /data (100 GB persistent).
-// All runtime data lives in OPENCLAW_HOME/.openclaw/.
-//
-// Config priority:
-//   1. Existing openclaw.json in bucket  -> PATCH env vars only
-//   2. /app/openclaw-template.json       -> use as base + patch
-//   3. Neither                           -> minimal fresh + patch
-//
-// Always patched from env vars (never lost on restart):
-//   gateway.auth, gateway.controlUi, gateway.trustedProxies
-//   agents.defaults.workspace, agents.defaults.model
-//   env.vars, models.providers.*.apiKey, channels.telegram
-// ============================================================
+// OpenClaw / Hugging Face Spaces configuration writer.
+// Persistent state: /data/.openclaw (OPENCLAW_HOME=/data).
+// Telegram uses OpenClaw's default long-polling transport.
+// Device pairing is deliberately left to OpenClaw's supported pairing flow.
 
-var HOME        = process.env.OPENCLAW_HOME || process.env.HOME || "/home/user";
-var STATE_DIR   = path.join(HOME, ".openclaw");
-var CONFIG_PATH = path.join(STATE_DIR, "openclaw.json");
-var WORKSPACE   = path.join(STATE_DIR, "workspace");
-var SPACE_HOST  = (process.env.SPACE_HOST || "").trim();
-var TEMPLATE    = "/app/openclaw-template.json";
+const HOME = process.env.OPENCLAW_HOME || process.env.HOME || "/data";
+const STATE_DIR = path.join(HOME, ".openclaw");
+const CONFIG_PATH = path.join(STATE_DIR, "openclaw.json");
+const WORKSPACE = path.join(STATE_DIR, "workspace");
+const TEMPLATE = "/app/openclaw-template.json";
+const SPACE_HOST = (process.env.SPACE_HOST || "").trim().replace(/^https?:\/\//, "").replace(/\/+$/, "");
 
-function log(msg)  { console.log("[setup] " + msg); }
-function err(msg)  { console.error("[setup] ERROR: " + msg); }
-
-log("Starting... HOME=" + HOME);
-
-// ----------------------------------------------------------------
-// Helpers
-// ----------------------------------------------------------------
-function envStr(key) { return (process.env[key] || "").trim(); }
-
-function parseList(val) {
-  if (!val || !val.trim()) return [];
-  return val.split(",").map(function(s){ return s.trim(); }).filter(Boolean);
+function log(message) {
+  console.log("[setup] " + message);
+}
+function fatal(message) {
+  console.error("[setup] FATAL: " + message);
+  process.exit(1);
+}
+function envStr(key) {
+  return (process.env[key] || "").trim();
+}
+function parseList(value) {
+  return value ? value.split(",").map((x) => x.trim()).filter(Boolean) : [];
 }
 
-// ----------------------------------------------------------------
-// Auth (required)
-// ----------------------------------------------------------------
-var gatewayToken    = envStr("OPENCLAW_GATEWAY_TOKEN");
-var gatewayPassword = envStr("OPENCLAW_GATEWAY_PASSWORD");
+// Require explicit Gateway authentication. Token is preferred.
+const gatewayToken = envStr("OPENCLAW_GATEWAY_TOKEN");
+const gatewayPassword = envStr("OPENCLAW_GATEWAY_PASSWORD");
 if (!gatewayToken && !gatewayPassword) {
-  err("FATAL: set OPENCLAW_GATEWAY_TOKEN in Secrets");
-  process.exit(0);
+  fatal("Set OPENCLAW_GATEWAY_TOKEN (recommended) or OPENCLAW_GATEWAY_PASSWORD in Space Secrets.");
+}
+if (!SPACE_HOST) {
+  fatal("SPACE_HOST is empty. Confirm this is running as a Hugging Face Space.");
 }
 
-// ----------------------------------------------------------------
-// Default model
-// ----------------------------------------------------------------
-var defaultModel = envStr("OPENCLAW_HF_DEFAULT_MODEL") || "google/gemini-2.0-flash";
+const publicOrigin = "https://" + SPACE_HOST;
+const defaultModel = envStr("OPENCLAW_HF_DEFAULT_MODEL") || "google/gemini-2.0-flash";
 
-// ----------------------------------------------------------------
-// Provider API key detection
-// ----------------------------------------------------------------
-var EXCLUDE_PREFIXES = [
-  "OPENCLAW_", "SPACE_", "SYSTEM_", "HF_",
-  "NODE_", "PATH", "HOME", "USER", "PWD", "LANG", "LC_",
-  "npm_", "HOSTNAME", "SHELL", "TERM", "SHLVL"
+// Provider API key discovery, preserving the original project's naming convention.
+const EXCLUDE_PREFIXES = [
+  "OPENCLAW_", "SPACE_", "SYSTEM_", "HF_", "NODE_", "PATH", "HOME",
+  "USER", "PWD", "LANG", "LC_", "npm_", "HOSTNAME", "SHELL", "TERM", "SHLVL"
 ];
-var INCLUDE_SUFFIXES = [
-  "_API_KEY", "_SECRET_KEY", "_ACCESS_TOKEN",
-  "_BOT_TOKEN", "_AUTH_TOKEN", "_APP_KEY"
+const INCLUDE_SUFFIXES = [
+  "_API_KEY", "_SECRET_KEY", "_ACCESS_TOKEN", "_BOT_TOKEN", "_AUTH_TOKEN", "_APP_KEY"
 ];
-
-function isProviderKey(k) {
-  var i;
-  for (i = 0; i < EXCLUDE_PREFIXES.length; i++) {
-    if (k.indexOf(EXCLUDE_PREFIXES[i]) === 0) return false;
-  }
-  for (i = 0; i < INCLUDE_SUFFIXES.length; i++) {
-    var s = INCLUDE_SUFFIXES[i];
-    if (k.length > s.length && k.indexOf(s) === k.length - s.length) return true;
-  }
-  return false;
+function isProviderKey(key) {
+  if (EXCLUDE_PREFIXES.some((prefix) => key.startsWith(prefix))) return false;
+  return INCLUDE_SUFFIXES.some((suffix) => key.length > suffix.length && key.endsWith(suffix));
 }
-
-var providerKeys = Object.keys(process.env).filter(function(k) {
-  return isProviderKey(k) && envStr(k);
-}).sort();
-
-log("Provider keys (" + providerKeys.length + "): " + providerKeys.join(", "));
-
-// ----------------------------------------------------------------
-// Trusted proxies (HF internal + standard RFC1918)
-// ----------------------------------------------------------------
-var envProxies = parseList(envStr("OPENCLAW_GATEWAY_TRUSTED_PROXIES"));
-var trustedProxies = envProxies.length > 0 ? envProxies : [
-  "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16",
-  "10.16.0.0/12",  "10.20.0.0/12",
-  "10.16.4.123",   "10.16.7.92",   "10.16.18.232",
-  "10.16.34.155",  "10.16.43.133", "10.16.1.206",
-  "10.16.37.110",  "10.16.43.246",
-  "10.20.1.9",     "10.20.1.222",  "10.20.26.157",  "10.20.31.87",
-  "10.20.0.1",     "172.17.0.1",   "127.0.0.1"
-];
-
-// ----------------------------------------------------------------
-// Provider -> env var mapping
-// ----------------------------------------------------------------
-var PROVIDER_KEY_MAP = {
-  "openrouter":  "OPENROUTER_API_KEY",
-  "siliconflow": "SILICONFLOW_API_KEY",
-  "deepseek":    "DEEPSEEK_API_KEY",
-  "groq":        "GROQ_API_KEY",
-  "google":      "GOOGLE_API_KEY",
-  "gemini":      "GEMINI_API_KEY",
-  "minimax":     "MINIMAX_API_KEY",
-  "zai":         "ZAI_API_KEY",
-  "github":         "GITHUB_MODELS_API_KEY",
+const providerKeys = Object.keys(process.env)
+  .filter((key) => isProviderKey(key) && envStr(key))
+  .sort();
+
+const PROVIDER_KEY_MAP = {
+  openrouter: "OPENROUTER_API_KEY",
+  siliconflow: "SILICONFLOW_API_KEY",
+  deepseek: "DEEPSEEK_API_KEY",
+  groq: "GROQ_API_KEY",
+  google: "GOOGLE_API_KEY",
+  gemini: "GEMINI_API_KEY",
+  minimax: "MINIMAX_API_KEY",
+  zai: "ZAI_API_KEY",
+  github: "GITHUB_MODELS_API_KEY",
   "github-copilot": "GITHUB_MODELS_API_KEY",
-  "openai":      "OPENAI_API_KEY",
-  "anthropic":   "ANTHROPIC_API_KEY"
+  openai: "OPENAI_API_KEY",
+  anthropic: "ANTHROPIC_API_KEY"
 };
 
+// Prefer explicitly supplied proxy CIDRs. The fallback retains the exact
+// HF-internal addresses already present in the supplied deployment file,
+// but removes broad RFC1918 trust ranges such as 10.0.0.0/8.
+const envProxies = parseList(envStr("OPENCLAW_GATEWAY_TRUSTED_PROXIES"));
+const trustedProxies = envProxies.length ? envProxies : [
+  "10.16.4.123", "10.16.7.92", "10.16.18.232", "10.16.34.155",
+  "10.16.43.133", "10.16.1.206", "10.16.37.110", "10.16.43.246",
+  "10.20.1.9", "10.20.1.222", "10.20.26.157", "10.20.31.87",
+  "10.20.0.1", "172.17.0.1", "127.0.0.1"
+];
+
 function patchProviderKeys(config) {
-  if (!config.models || !config.models.providers) return;
-  var providers = config.models.providers;
-  Object.keys(providers).forEach(function(name) {
-    var lower  = name.toLowerCase();
-    var envKey = PROVIDER_KEY_MAP[lower];
-    var val    = envKey ? envStr(envKey) : "";
-    if (!val) {
-      // fuzzy match: find any provider key whose name contains the provider name
-      var found = providerKeys.find(function(k) {
-        return k.toLowerCase().indexOf(lower) >= 0;
-      });
-      if (found) val = envStr(found);
+  const providers = config.models && config.models.providers;
+  if (!providers || typeof providers !== "object") return;
+
+  for (const [name, provider] of Object.entries(providers)) {
+    if (!provider || typeof provider !== "object") continue;
+    const lower = name.toLowerCase();
+    const mapped = PROVIDER_KEY_MAP[lower];
+    let value = mapped ? envStr(mapped) : "";
+
+    if (!value) {
+      const matched = providerKeys.find((key) => key.toLowerCase().includes(lower));
+      if (matched) value = envStr(matched);
     }
-    if (val) {
-      providers[name].apiKey = val;
-      log("Provider key set: " + name + " <- " + (envKey || "fuzzy"));
-    } else if (providers[name].apiKey === "WILL_BE_SET_BY_ENV") {
-      delete providers[name].apiKey;
-      log("Provider key missing (skipped): " + name);
+
+    if (value) {
+      provider.apiKey = value;
+      log("Provider API key configured: " + name);
+    } else if (provider.apiKey === "WILL_BE_SET_BY_ENV") {
+      delete provider.apiKey;
+      log("Provider API key not supplied; placeholder removed: " + name);
     }
-  });
+  }
 }
 
-// ----------------------------------------------------------------
-// Telegram webhook helpers
-// ----------------------------------------------------------------
-function tgRequest(token, method, body) {
-  return new Promise(function(resolve) {
-    var data = JSON.stringify(body || {});
-    var req  = https.request({
+function clearTelegramWebhook(token) {
+  return new Promise((resolve) => {
+    const body = JSON.stringify({ drop_pending_updates: false });
+    const req = https.request({
       hostname: "api.telegram.org",
-      path:     "/bot" + token + "/" + method,
-      method:   "POST",
-      headers:  {
-        "Content-Type":   "application/json",
-        "Content-Length": Buffer.byteLength(data)
+      path: "/bot" + token + "/deleteWebhook",
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "Content-Length": Buffer.byteLength(body)
       }
-    }, function(res) {
-      var buf = "";
-      res.on("data", function(c) { buf += c; });
-      res.on("end",  function() {
-        try { resolve(JSON.parse(buf)); } catch(e) { resolve(null); }
+    }, (res) => {
+      let data = "";
+      res.on("data", (chunk) => { data += chunk; });
+      res.on("end", () => {
+        try {
+          const result = JSON.parse(data);
+          if (result && result.ok) {
+            log("Removed any old Telegram webhook; pending updates were preserved.");
+          } else {
+            log("WARNING: Telegram deleteWebhook returned: " + (result?.description || "unknown response"));
+          }
+        } catch {
+          log("WARNING: Could not parse Telegram deleteWebhook response.");
+        }
+        resolve();
       });
     });
-    req.on("error",   function() { resolve(null); });
-    req.setTimeout(10000, function() { req.destroy(); resolve(null); });
-    req.write(data);
+    req.setTimeout(10000, () => {
+      req.destroy();
+      log("WARNING: Telegram deleteWebhook timed out; polling may remain blocked by an old webhook.");
+      resolve();
+    });
+    req.on("error", (error) => {
+      log("WARNING: Telegram deleteWebhook failed: " + error.message);
+      resolve();
+    });
+    req.write(body);
     req.end();
   });
 }
 
-async function setupWebhook(token) {
-  if (!SPACE_HOST) {
-    log("Telegram: no SPACE_HOST - webhook skipped");
-    return;
-  }
-  var targetUrl = "https://" + SPACE_HOST + "/tg-webhook";
-
-  // Check if webhook already points to our URL - skip if already set
-  var info = await tgRequest(token, "getWebhookInfo", {});
-  if (info && info.ok && info.result && info.result.url === targetUrl) {
-    log("Telegram: webhook already set -> " + targetUrl);
-    return;
+function seedWorkspace() {
+  fs.mkdirSync(WORKSPACE, { recursive: true });
+  fs.mkdirSync(path.join(WORKSPACE, "memory"), { recursive: true });
+
+  const soulPath = path.join(WORKSPACE, "SOUL.md");
+  if (!fs.existsSync(soulPath)) {
+    fs.writeFileSync(soulPath, [
+      "# Soul", "",
+      "You are a helpful, warm, concise AI assistant.", "",
+      "## Language", "",
+      "Default language: Simplified Chinese.",
+      "Always reply in Chinese unless the user writes in another language first.", "",
+      "## Tone", "",
+      "- Natural and friendly, not overly formal",
+      "- Concise and to the point"
+    ].join("\n") + "\n", { encoding: "utf8", mode: 0o600 });
+    log("Created workspace/SOUL.md");
   }
 
-  var r = await tgRequest(token, "setWebhook", {
-    url: targetUrl, drop_pending_updates: true, max_connections: 10
-  });
-  if (r && r.ok) {
-    log("Telegram: webhook registered -> " + targetUrl);
-  } else {
-    var desc = r && r.description ? r.description : "unknown error";
-    log("Telegram: webhook failed (" + desc + ")");
-    log("Telegram: set manually at:");
-    log("  https://api.telegram.org/bot" + token + "/setWebhook?url=" + targetUrl + "&drop_pending_updates=true");
+  const memoryPath = path.join(WORKSPACE, "MEMORY.md");
+  if (!fs.existsSync(memoryPath)) {
+    fs.writeFileSync(memoryPath, "# Long-term Memory\n\n<!-- OpenClaw writes important facts here. -->\n",
+      { encoding: "utf8", mode: 0o600 });
+    log("Created workspace/MEMORY.md");
   }
 }
 
-// ----------------------------------------------------------------
-// Seed workspace (first boot only - bucket persists after)
-// ----------------------------------------------------------------
-function seedWorkspace() {
-  var soul = path.join(WORKSPACE, "SOUL.md");
-  if (!fs.existsSync(soul)) {
-    fs.writeFileSync(soul, [
-      "# Soul",
-      "",
-      "You are a helpful, warm, concise AI assistant.",
-      "",
-      "## Language",
-      "",
-      "Default language: Simplified Chinese.",
-      "Always reply in Chinese unless the user writes in another language first.",
-      "",
-      "## Tone",
-      "",
-      "- Natural and friendly, not overly formal",
-      "- Concise and to the point"
-    ].join("\n") + "\n", "utf-8");
-    log("Seeded SOUL.md");
+function loadBaseConfig() {
+  if (fs.existsSync(CONFIG_PATH)) {
+    try {
+      const parsed = JSON.parse(fs.readFileSync(CONFIG_PATH, "utf8"));
+      log("Loaded persistent Bucket config.");
+      return { config: parsed, source: "bucket" };
+    } catch (error) {
+      // Never overwrite a corrupt persistent config silently.
+      fatal("Persistent config is invalid JSON (" + error.message + "). Backup it and repair it before restarting.");
+    }
   }
-  var mem = path.join(WORKSPACE, "MEMORY.md");
-  if (!fs.existsSync(mem)) {
-    fs.writeFileSync(mem, [
-      "# Long-term Memory",
-      "",
-      "<!-- OpenClaw writes important facts here. -->"
-    ].join("\n") + "\n", "utf-8");
-    log("Seeded MEMORY.md");
+
+  if (fs.existsSync(TEMPLATE)) {
+    try {
+      const parsed = JSON.parse(fs.readFileSync(TEMPLATE, "utf8"));
+      log("Loaded openclaw.json template for first boot.");
+      return { config: parsed, source: "template" };
+    } catch (error) {
+      fatal("Template JSON is invalid (" + error.message + ").");
+    }
   }
+
+  log("No template found; creating a minimal first-boot config.");
+  return {
+    config: { gateway: {}, agents: { defaults: {} }, env: { vars: {} } },
+    source: "fresh"
+  };
 }
 
-// ----------------------------------------------------------------
-// Apply all env-derived patches to a config object
-// ----------------------------------------------------------------
-function applyEnvPatches(config, tgToken) {
-  // Auth
+function applyEnvironment(config) {
   config.gateway = config.gateway || {};
+  config.gateway.mode = "local";
+  config.gateway.port = 7860;
+  config.gateway.bind = "lan";
   config.gateway.auth = gatewayToken
-    ? { mode: "token",    token:    gatewayToken    }
+    ? { mode: "token", token: gatewayToken }
     : { mode: "password", password: gatewayPassword };
 
-// Control UI security configuration
-config.gateway.controlUi = config.gateway.controlUi || {};
-
-// Remove retired and unsafe legacy options
-delete config.gateway.controlUi.dangerouslyDisableDeviceAuth;
-delete config.gateway.controlUi.dangerouslyAllowHostHeaderOriginFallback;
+  // Control UI: allow only this Space's HTTPS origin.
+  // Keep device authentication enabled; do not use insecure bypass flags.
+  config.gateway.publicOrigin = publicOrigin;
+  config.gateway.controlUi = config.gateway.controlUi || {};
+  config.gateway.controlUi.enabled = true;
+  config.gateway.controlUi.allowedOrigins = [publicOrigin];
+  config.gateway.controlUi.allowInsecureAuth = false;
+  delete config.gateway.controlUi.dangerouslyDisableDeviceAuth;
+  delete config.gateway.controlUi.dangerouslyAllowHostHeaderOriginFallback;
 
-// HTTPS is provided by Hugging Face Spaces
-delete config.gateway.controlUi.allowInsecureAuth;
-
-// Restrict browser origin to this Space
-if (SPACE_HOST) {
-  config.gateway.controlUi.allowedOrigins = [
-    "https://" + SPACE_HOST
-  ];
-} else {
-  delete config.gateway.controlUi.allowedOrigins;
-}
-
-  // Always refresh trusted proxies (HF pod IPs can change)
   config.gateway.trustedProxies = trustedProxies;
 
-  // Agents
   config.agents = config.agents || {};
   config.agents.defaults = config.agents.defaults || {};
   config.agents.defaults.workspace = WORKSPACE;
@@ -273,113 +235,68 @@ if (SPACE_HOST) {
     config.agents.defaults.model = defaultModel;
   }
 
-  // Env vars (all provider keys available inside agent tools)
   config.env = config.env || {};
-  config.env.vars = {};
-  providerKeys.forEach(function(k) { config.env.vars[k] = envStr(k); });
-
-  // Model provider API keys
+  config.env.vars = config.env.vars || {};
+  for (const key of providerKeys) config.env.vars[key] = envStr(key);
   patchProviderKeys(config);
 
-  // Telegram channel
-  if (tgToken) {
+  const telegramToken = envStr("TELEGRAM_BOT_TOKEN");
+  if (telegramToken) {
     config.channels = config.channels || {};
     config.channels.telegram = config.channels.telegram || {};
-    config.channels.telegram.enabled  = true;
+    config.channels.telegram.enabled = true;
     config.channels.telegram.accounts = config.channels.telegram.accounts || {};
+    const existingMain = config.channels.telegram.accounts.main || {};
     config.channels.telegram.accounts.main = {
-      botToken: tgToken,
-      apiRoot:  "https://api.telegram.org"
+      ...existingMain,
+      botToken: telegramToken,
+      apiRoot: existingMain.apiRoot || "https://api.telegram.org"
     };
+    // Do not set webhookUrl: long polling is OpenClaw's default transport.
+    delete config.channels.telegram.webhookUrl;
+    delete config.channels.telegram.webhookSecret;
+    delete config.channels.telegram.webhookPath;
+    log("Telegram configured for default long polling.");
+  } else {
+    log("TELEGRAM_BOT_TOKEN not set; existing Telegram config, if any, is preserved.");
   }
 
   return config;
 }
 
-// ----------------------------------------------------------------
-// Main
-// ----------------------------------------------------------------
-(async function() {
-  // Ensure directories exist
-  fs.mkdirSync(STATE_DIR,                        { recursive: true });
-  fs.mkdirSync(WORKSPACE,                        { recursive: true });
-  fs.mkdirSync(path.join(WORKSPACE, "memory"),   { recursive: true });
-
-  // Seed workspace on first boot
+try {
+  fs.mkdirSync(STATE_DIR, { recursive: true });
   seedWorkspace();
 
-  // Telegram webhook
-  var tgToken = envStr("TELEGRAM_BOT_TOKEN");
-  if (tgToken) {
-    await setupWebhook(tgToken);
-  } else {
-    log("Telegram: disabled (no TELEGRAM_BOT_TOKEN)");
-  }
-
-  // Load base config
-  // Standard OpenClaw pattern: the bucket config is the single source
-  // of truth. It contains everything: models, channels, telegram bindings,
-  // devices, credentials. It persists across all restarts unchanged.
-  // The template (uploaded openclaw.json) is only used on first boot
-  // when no bucket config exists yet.
-  //
-  // To update models/providers after first boot: use the Control UI.
-  // Changes are saved directly to the bucket config automatically.
-  var config = null;
-  var mode   = "";
+  const { config, source } = loadBaseConfig();
+  const telegramToken = envStr("TELEGRAM_BOT_TOKEN");
+  if (telegramToken) await clearTelegramWebhook(telegramToken);
+  const patched = applyEnvironment(config);
 
-  // Primary: bucket config (preserves ALL user settings across restarts)
-  if (fs.existsSync(CONFIG_PATH)) {
-    try {
-      config = JSON.parse(fs.readFileSync(CONFIG_PATH, "utf-8").trim());
-      mode = "bucket (full config preserved)";
-    } catch(e) {
-      log("Bucket config unreadable (" + e.message + ") - falling back to template");
-    }
-  }
-
-  // First boot only: use template to seed the bucket
-  if (!config && fs.existsSync(TEMPLATE)) {
-    try {
-      config = JSON.parse(fs.readFileSync(TEMPLATE, "utf-8").trim());
-      mode = "template (first boot - seeding bucket)";
-    } catch(e) {
-      log("Template unreadable (" + e.message + ")");
-    }
-  }
-
-  if (!config) {
-    config = { gateway: {}, agents: { defaults: {} }, env: { vars: {} } };
-    mode   = "fresh (no template found)";
-  }
-
-  // Apply env patches
-  config = applyEnvPatches(config, tgToken);
-
-  // Atomic write: backup then overwrite
+  const tempPath = CONFIG_PATH + ".tmp";
   if (fs.existsSync(CONFIG_PATH)) {
     fs.copyFileSync(CONFIG_PATH, CONFIG_PATH + ".bak");
   }
-  fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2), "utf-8");
-
-  // Summary
-  var provCount = config.models && config.models.providers
-    ? Object.keys(config.models.providers).length : 0;
-  var modelCount = config.models && config.models.providers
-    ? Object.values(config.models.providers).reduce(function(n, p) {
-        return n + (p.models ? p.models.length : 0);
-      }, 0) : 0;
-
-  log("Done. Mode: " + mode);
-  log("  auth      = " + (gatewayToken ? "token" : "password"));
-  log("  model     = " + (config.agents.defaults.model || defaultModel));
-  log("  workspace = " + WORKSPACE);
-  log("  proxies   = " + trustedProxies.length);
-  log("  env.vars  = " + providerKeys.length);
-  log("  providers = " + provCount + " (" + modelCount + " models)");
-  log("  storage   = bucket at /data (100 GB persistent)");
-
-})().catch(function(e) {
-  err("Fatal: " + e.message);
-  process.exit(0);
-});
+  fs.writeFileSync(tempPath, JSON.stringify(patched, null, 2) + "\n",
+    { encoding: "utf8", mode: 0o600 });
+  fs.renameSync(tempPath, CONFIG_PATH);
+  try { fs.chmodSync(CONFIG_PATH, 0o600); } catch {}
+
+  const providerCount = patched.models && patched.models.providers
+    ? Object.keys(patched.models.providers).length : 0;
+  const modelCount = patched.models && patched.models.providers
+    ? Object.values(patched.models.providers).reduce(
+        (total, provider) => total + (Array.isArray(provider.models) ? provider.models.length : 0), 0)
+    : 0;
+
+  log("Config written successfully. source=" + source);
+  log("Gateway auth=" + (gatewayToken ? "token" : "password"));
+  log("Gateway origin=" + publicOrigin);
+  log("Workspace=" + WORKSPACE);
+  log("Trusted proxy entries=" + trustedProxies.length);
+  log("Provider keys detected=" + providerKeys.length);
+  log("Providers=" + providerCount + "; models=" + modelCount);
+  log("Persistent state=" + STATE_DIR);
+} catch (error) {
+  fatal(error && error.stack ? error.stack : String(error));
+}