Use separate env vars for model chain

README.md

@@ -27,9 +27,9 @@ This Space runs the [OpenClaw](https://github.com/openclaw/openclaw) gateway so
    - **`OPENCODE_API_KEY`** — (optional) OpenCode Zen API key. OpenClaw reads this directly from the gateway environment for the `opencode` provider.
    - **`SUPABASE_URL`** — (recommended) Supabase project URL for external state backup.
    - **`SUPABASE_KEY`** — (recommended) Supabase service key or project API key with insert/update access to your sync table.
-   - **`OPENCLAW_DEFAULT_MODEL`** — (optional) Primary model ref. This repo now defaults to `huggingface/Qwen/Qwen3-8B`.
-   - **`OPENCLAW_FALLBACK_MODELS`** — (optional) Comma-separated fallback model refs. This repo now defaults to `huggingface/deepseek-ai/DeepSeek-R1,gpt-codex`.
-   - **`OPENCLAW_HF_DEFAULT_MODEL`** — (optional, legacy alias) Backwards-compatible alias for `OPENCLAW_DEFAULT_MODEL`. If both are set, `OPENCLAW_DEFAULT_MODEL` wins.
+   - **`OPENCLAW_MODEL_PRIMARY`** — (recommended) Primary model ref. This repo now defaults to `huggingface/Qwen/Qwen3-8B`.
+   - **`OPENCLAW_MODEL_FALLBACK_1`** — (recommended) First fallback model ref. Default is `huggingface/deepseek-ai/DeepSeek-R1`.
+   - **`OPENCLAW_MODEL_FALLBACK_2`** — (recommended) Second fallback model ref. Default is `gpt-codex`.
    - **`OPENCLAW_GATEWAY_TRUSTED_PROXIES`** — (optional) Comma-separated proxy IPs (e.g. `10.20.31.87,10.20.26.157`). The startup script writes this into `gateway.trustedProxies`; set if you see “Proxy headers detected from untrusted address” or pairing/unauthorized. Use **Variables** if you prefer (IPs need not be secret).
    - **`OPENCLAW_CONTROL_UI_ALLOWED_ORIGINS`** — (optional) Comma-separated origins (e.g. `https://your-space.hf.space`). Written to `gateway.controlUi.allowedOrigins` so only those origins can open the Control UI; useful to lock down to your Space URL.
    - **`TELEGRAM_BOT_TOKEN`** — (optional) Telegram BotFather token. This is the only Telegram setting you need for a minimal setup.
@@ -60,8 +60,9 @@ SUPABASE_KEY=<your supabase service key>
 TELEGRAM_BOT_TOKEN=<botfather token>
 
 Variables
-OPENCLAW_DEFAULT_MODEL=huggingface/Qwen/Qwen3-8B
-OPENCLAW_FALLBACK_MODELS=huggingface/deepseek-ai/DeepSeek-R1,gpt-codex
+OPENCLAW_MODEL_PRIMARY=huggingface/Qwen/Qwen3-8B
+OPENCLAW_MODEL_FALLBACK_1=huggingface/deepseek-ai/DeepSeek-R1
+OPENCLAW_MODEL_FALLBACK_2=gpt-codex
 OPENCLAW_CONTROL_UI_ALLOWED_ORIGINS=https://your-space.hf.space
 OPENCLAW_SUPABASE_TABLE=openclaw_state
 OPENCLAW_SYNC_INTERVAL_MS=300000
@@ -143,9 +144,9 @@ The startup script `setup-hf-config.mjs` reads the following from **Secrets** or
 
 | Env variable | Config path | Format |
 |--------------|------------|--------|
-| `OPENCLAW_DEFAULT_MODEL` | `agents.defaults.model.primary` | Generic model ref string |
-| `OPENCLAW_FALLBACK_MODELS` | `agents.defaults.model.fallbacks` | Comma-separated model refs |
-| `OPENCLAW_HF_DEFAULT_MODEL` | `agents.defaults.model.primary` | Legacy alias for `OPENCLAW_DEFAULT_MODEL` |
+| `OPENCLAW_MODEL_PRIMARY` | `agents.defaults.model.primary` | Primary model ref string |
+| `OPENCLAW_MODEL_FALLBACK_1` | `agents.defaults.model.fallbacks[0]` | First fallback model ref |
+| `OPENCLAW_MODEL_FALLBACK_2` | `agents.defaults.model.fallbacks[1]` | Second fallback model ref |
 | `OPENCLAW_GATEWAY_TOKEN` | `gateway.auth.mode` + `gateway.auth.token` | Any string |
 | `OPENCLAW_GATEWAY_PASSWORD` | `gateway.auth.mode` + `gateway.auth.password` | Any string (token wins if both set) |
 | `OPENCLAW_GATEWAY_TRUSTED_PROXIES` | `gateway.trustedProxies` | Comma-separated IPs |

guide.md

@@ -51,8 +51,9 @@ TELEGRAM_BOT_TOKEN=<你的 telegram bot token>
 請加入：
 
 ```text
-OPENCLAW_DEFAULT_MODEL=huggingface/Qwen/Qwen3-8B
-OPENCLAW_FALLBACK_MODELS=huggingface/deepseek-ai/DeepSeek-R1,gpt-codex
+OPENCLAW_MODEL_PRIMARY=huggingface/Qwen/Qwen3-8B
+OPENCLAW_MODEL_FALLBACK_1=huggingface/deepseek-ai/DeepSeek-R1
+OPENCLAW_MODEL_FALLBACK_2=gpt-codex
 OPENCLAW_CONTROL_UI_ALLOWED_ORIGINS=https://你的-space-url.hf.space
 OPENCLAW_SUPABASE_TABLE=openclaw_state
 OPENCLAW_SYNC_INTERVAL_MS=300000
@@ -152,8 +153,9 @@ SUPABASE_KEY
 ### 必填 Variables
 
 ```text
-OPENCLAW_DEFAULT_MODEL=huggingface/Qwen/Qwen3-8B
-OPENCLAW_FALLBACK_MODELS=huggingface/deepseek-ai/DeepSeek-R1,gpt-codex
+OPENCLAW_MODEL_PRIMARY=huggingface/Qwen/Qwen3-8B
+OPENCLAW_MODEL_FALLBACK_1=huggingface/deepseek-ai/DeepSeek-R1
+OPENCLAW_MODEL_FALLBACK_2=gpt-codex
 ```
 
 ### 建議 Variables

setup-hf-config.mjs

@@ -2,8 +2,8 @@
 /**
  * One-time setup for OpenClaw on Hugging Face Spaces.
  * Runs at container startup; writes or merges openclaw.json from env (Secrets/Variables):
- * - agents.defaults.model.primary from OPENCLAW_DEFAULT_MODEL / OPENCLAW_HF_DEFAULT_MODEL.
- * - agents.defaults.model.fallbacks from OPENCLAW_FALLBACK_MODELS.
+ * - agents.defaults.model.primary from OPENCLAW_MODEL_PRIMARY.
+ * - agents.defaults.model.fallbacks from OPENCLAW_MODEL_FALLBACK_1..N.
  * - gateway.auth: OPENCLAW_GATEWAY_TOKEN (token) or OPENCLAW_GATEWAY_PASSWORD (password); token wins if both set.
  * - gateway.controlUi.dangerouslyDisableDeviceAuth when auth is set (no device pairing in Spaces).
  * - gateway.trustedProxies from OPENCLAW_GATEWAY_TRUSTED_PROXIES, or default HF proxy IPs so the UI works without extra config.
@@ -46,14 +46,28 @@ function parseBoolean(raw) {
   return undefined;
 }
 
+function readIndexedEnv(prefix) {
+  return Object.keys(process.env)
+    .filter((key) => key.startsWith(prefix))
+    .map((key) => {
+      const suffix = key.slice(prefix.length);
+      const index = Number.parseInt(suffix, 10);
+      return Number.isFinite(index) ? { key, index } : null;
+    })
+    .filter(Boolean)
+    .sort((a, b) => a.index - b.index)
+    .map(({ key }) => process.env[key]?.trim())
+    .filter(Boolean);
+}
+
+const fallbackModelsFromIndexedEnv = readIndexedEnv("OPENCLAW_MODEL_FALLBACK_");
 const defaultModel =
-  process.env.OPENCLAW_DEFAULT_MODEL?.trim() ||
-  process.env.OPENCLAW_HF_DEFAULT_MODEL?.trim() ||
+  process.env.OPENCLAW_MODEL_PRIMARY?.trim() ||
   "huggingface/Qwen/Qwen3-8B";
-const fallbackModels = parseCsv(
-  process.env.OPENCLAW_FALLBACK_MODELS?.trim() ||
-  "huggingface/deepseek-ai/DeepSeek-R1,gpt-codex",
-);
+const fallbackModels =
+  fallbackModelsFromIndexedEnv.length > 0
+    ? fallbackModelsFromIndexedEnv
+    : ["huggingface/deepseek-ai/DeepSeek-R1", "gpt-codex"];
 const gatewayToken = readGatewayToken();
 const gatewayPassword = process.env.OPENCLAW_GATEWAY_PASSWORD?.trim();
 const telegramBotToken = process.env.TELEGRAM_BOT_TOKEN?.trim();
@@ -170,6 +184,8 @@ const authKind = useTokenAuth ? "token" : usePasswordAuth ? "password" : "none";
 const parts = [
   `model=${defaultModel}`,
   `fallbacks=${fallbackModels.length}`,
+  `fallback_1=${fallbackModels[0] || "-"}`,
+  `fallback_2=${fallbackModels[1] || "-"}`,
   `token_present=${useTokenAuth ? "1" : "0"}`,
   `password_present=${usePasswordAuth ? "1" : "0"}`,
   `auth=${authKind}`,