openclaw/dist/auth-model-policy-Bqa9LJZ9.mjs

Multi-channel AI gateway with extensible messaging integrations

import { r as normalizeProviderId } from "./provider-id-D1VImdKk.mjs";
import { I as materializeModelPolicyAllowlist, v as resolveMutableAgentEntry, z as parseModelPolicyWildcardRef } from "./agent-scope-config-CDYpzA0r.mjs";
import { r as normalizeAgentModelRefForConfig } from "./model-input-C9K4a_6k.mjs";
import "./model-ref-shared-KBg0y299.mjs";
import { m as resolveConfiguredModelPolicyAllow } from "./model-selection-shared-DcM6hdAC.mjs";
import { C as attachRuntimeConfigWriteApplication, T as createRuntimeConfigWriteApplication } from "./io.runtime-BsUXSsD4.mjs";
import { i as captureGatewayRootWorkAdmissionContinuationScope } from "./gateway-work-admission-rc4ZgKq_.mjs";
import { t as applyPrimaryModel } from "./provider-model-primary-CBQXA_V3.mjs";
import { r as logConfigUpdated } from "./logging-BBc-wU1i.mjs";
import { l as resolveModelsTargetAgent, u as updateConfig } from "./shared-zVYpFkgx.mjs";
import { isDeepStrictEqual } from "node:util";
//#region src/commands/models/auth-model-policy.ts
var ProviderModelPolicyChangedError = class extends Error {
	constructor(config) {
		super("Model restrictions changed during sign-in. Choose model access again.");
		this.config = config;
	}
};
function applyProviderLoginDefaultModel(config, model) {
	const next = applyPrimaryModel(config, model);
	if (resolveConfiguredModelPolicyAllow({ cfg: config }).configPath === "agents.defaults.models") {
		next.agents ??= {};
		next.agents.defaults ??= {};
		next.agents.defaults.models = config.agents?.defaults?.models;
	}
	return next;
}
/** Provider setup defaults cannot supply consent to change model restrictions. */
function withoutProviderModelPolicy(patch, config) {
	const connection = structuredClone(patch);
	if (connection.agents?.defaults) {
		delete connection.agents.defaults.modelPolicy;
		if (resolveConfiguredModelPolicyAllow({ cfg: config }).configPath === "agents.defaults.models") delete connection.agents.defaults.models;
	}
	for (const agent of Object.values(connection.agents?.entries ?? {})) delete agent.modelPolicy;
	return connection;
}
function snapshotPolicy(config, agentId) {
	const policy = resolveConfiguredModelPolicyAllow({
		cfg: config,
		agentId
	});
	return {
		path: policy.configPath ? policy.repairConfigPath : null,
		refs: [...new Set(policy.refs.map((ref) => parseModelPolicyWildcardRef(ref)?.key ?? normalizeAgentModelRefForConfig(ref)))].toSorted()
	};
}
function prepareProviderModelAccess(params) {
	const provider = normalizeProviderId(params.provider);
	const policy = snapshotPolicy(params.config, params.agentId);
	if (policy.refs.length === 0 || policy.refs.includes(`${provider}/*`)) return;
	const prompt = {
		message: `Your current model restrictions may hide ${params.providerLabel} models. Choose which models to show.`,
		initialValue: "keep",
		options: [{
			value: "all",
			label: `Show all ${params.providerLabel} models`
		}, {
			value: "keep",
			label: "Keep current restrictions"
		}]
	};
	return {
		provider,
		providerLabel: params.providerLabel,
		agentId: params.agentId,
		policy,
		prompt
	};
}
async function completeProviderModelAccess(params) {
	const prepared = params.prepared;
	if (!prepared) return {
		kind: "unchanged",
		message: ""
	};
	params.assertCurrent?.();
	if (params.onRequested) {
		params.onRequested(prepared);
		return {
			kind: "deferred",
			message: ""
		};
	}
	const choice = await params.prompter.select(prepared.prompt);
	params.assertCurrent?.();
	if (choice !== "all") {
		params.runtime.log("Current model restrictions kept.");
		return {
			kind: "unchanged",
			message: "Current model restrictions kept."
		};
	}
	const application = createRuntimeConfigWriteApplication(captureGatewayRootWorkAdmissionContinuationScope()?.run);
	await updateConfig((config) => {
		params.assertCurrent?.(config);
		resolveModelsTargetAgent(config, prepared.agentId, { kind: "mutation" });
		if (!isDeepStrictEqual(snapshotPolicy(config, prepared.agentId), prepared.policy)) throw new ProviderModelPolicyChangedError(config);
		const policy = resolveConfiguredModelPolicyAllow({
			cfg: config,
			agentId: prepared.agentId
		});
		const allow = [...policy.refs, `${prepared.provider}/*`];
		if (policy.repairConfigPath === "agents.entries.*.modelPolicy.allow") {
			const agent = resolveMutableAgentEntry(config, prepared.agentId);
			if (!agent) throw new Error(`Agent "${prepared.agentId}" no longer exists.`);
			agent.modelPolicy = {
				...agent.modelPolicy,
				allow
			};
		} else {
			config.agents ??= {};
			config.agents.defaults ??= {};
			const defaults = config.agents.defaults;
			if (policy.configPath === "agents.defaults.models" && materializeModelPolicyAllowlist(config).kind === "deferred") defaults.models = {
				...defaults.models,
				[`${prepared.provider}/*`]: {}
			};
			else defaults.modelPolicy = {
				...defaults.modelPolicy,
				allow
			};
		}
		return config;
	}, void 0, params.beforeCommit, attachRuntimeConfigWriteApplication({ assertCurrent: params.assertCurrent }, application));
	const status = application.claimed ? await application.result : "unclaimed";
	logConfigUpdated(params.runtime);
	const message = status === "applied" ? `All ${prepared.providerLabel} models are now visible.` : application.claimed ? "Model access was saved, but OpenClaw has not confirmed it is active. Open Settings and select Apply changes, then send /models." : "Model access saved. Application by the running Gateway is not confirmed. Run `openclaw gateway restart` to apply it.";
	params.runtime.log(message);
	return {
		kind: "saved",
		application: status,
		message
	};
}
//#endregion
export { withoutProviderModelPolicy as a, prepareProviderModelAccess as i, applyProviderLoginDefaultModel as n, completeProviderModelAccess as r, ProviderModelPolicyChangedError as t };