setup.py

"""
Generate the full Denario Scientists fleet from config.py.

Usage:
    python setup.py -n 2          # generate configs for 2 scientists
    python setup.py -n 2 --up     # generate and start 2 scientists
    python setup.py --reset -n 3  # wipe and regenerate for 3 scientists
"""

import argparse
import copy
import glob
import json
import os
import shutil
import subprocess
import sys
import time

import yaml

import config as cfg

PROJECT_DIR = os.path.dirname(os.path.abspath(__file__))


def parse_args():
    parser = argparse.ArgumentParser(description="Denario Scientists fleet setup")
    parser.add_argument("-n", "--scientists", type=int, default=cfg.N_SCIENTISTS,
                        help=f"Number of scientists to deploy (default: {cfg.N_SCIENTISTS})")
    parser.add_argument("--up", action="store_true", help="Build and start containers")
    parser.add_argument("--reset", action="store_true", help="Wipe configs and regenerate")
    parser.add_argument("--full-reset", action="store_true", help="Wipe everything including work dirs")
    parser.add_argument("--model", type=str, default=None,
                        help=f"Override default model (default: {cfg.DEFAULT_MODEL})")
    return parser.parse_args()


def _emit_claude_lines(lines, s):
    """Append a Claude-Code-native scientist service to the compose `lines`.

    No OpenClaw: the container runs `claude --remote-control "<name>"` with the
    denario plugin (`--plugin-dir`), which auto-starts the denario + cmbagent_lg
    MCP servers (via the plugin's .mcp.json, configured by DENARIO_MCP_*). You
    drive it from claude.ai/code or the mobile app by session name. Remote
    Control is outbound-only, so there are no published ports and no healthcheck.
    """
    name = s["name"]
    idx = name.split("-")[1]
    anthropic_key = f"${{ANTHROPIC_API_KEY_{idx}:-${{ANTHROPIC_API_KEY}}}}"
    gemini_key = f"${{GEMINI_API_KEY_{idx}:-${{GEMINI_API_KEY}}}}"
    google_key = f"${{GOOGLE_API_KEY_{idx}:-${{GOOGLE_API_KEY}}}}"
    google_gemini_key = f"${{GOOGLE_GEMINI_API_KEY_{idx}:-${{GOOGLE_GEMINI_API_KEY}}}}"

    env = {
        "HOME": "/home/node",
        "TERM": "xterm-256color",
        "SCIENTIST_NAME": name,
        # Wiring for the denario plugin's bundled .mcp.json (env-var configured).
        "DENARIO_MCP_PYTHON": "/opt/denario-venv/bin/python",
        "DENARIO_MCP_DIR": "/opt/denario-venv/lib/python3.12/site-packages/denario/mcp_servers",
        "DENARIO_WORK_DIR": "/home/node/work",
        "DENARIO_PARAMS_FILE": "/home/node/work/params.yaml",
        # Provider keys the MCP server reads (results/idea/methods/paper stages).
        "ANTHROPIC_API_KEY": anthropic_key,
        "OPENAI_API_KEY": "${OPENAI_API_KEY}",
        "GEMINI_API_KEY": gemini_key,
        "GOOGLE_API_KEY": google_key,
        "GOOGLE_GEMINI_API_KEY": google_gemini_key,
        "PERPLEXITY_API_KEY": "${PERPLEXITY_API_KEY}",
        "MATERIALS_API_KEY": "${MATERIALS_API_KEY}",
        "MP_API_KEY": "${MATERIALS_API_KEY}",
        "GITHUB_TOKEN": "${GITHUB_TOKEN}",
        "GITHUB_ORG": "${GITHUB_ORG:-ParallelScience}",
        "GEMMA4_URL": "${GEMMA4_URL:-http://host.docker.internal:8010/v1}",
        # Container reproducibility + a hook to pass extra `claude` flags
        # (e.g. trust/permission bypass) without rebuilding.
        "DISABLE_AUTOUPDATER": "1",
        "CLAUDE_EXTRA_ARGS": "${CLAUDE_EXTRA_ARGS:-}",
        "TZ": "${TZ:-UTC}",
    }
    volumes = [
        f"./scientists/{name}/work:/home/node/work",
        f"./scientists/{name}/claude:/home/node/.claude",
        "../denario-claude-plugin:/opt/denario-plugin:ro",
        "./entrypoint.claude.sh:/app/entrypoint.claude.sh:ro",
        "${DATA_DIR:-./data}:/home/node/data:ro",
        "./tools:/home/node/tools:ro",
        # claude.ai /login credentials (Remote Control needs subscription OAuth,
        # NOT a setup-token) seeded into the session. Per-scientist override
        # CLAUDE_CREDENTIALS_FILE_<N> in .env (own account/seat → no shared-token
        # refresh race), falling back to a shared CLAUDE_CREDENTIALS_FILE, then
        # the host default.
        f"${{CLAUDE_CREDENTIALS_FILE_{idx}:-${{CLAUDE_CREDENTIALS_FILE:-/home/cmbagent/.claude/.credentials.json}}}}:/seed/credentials.json:ro",
        "${DENARIO_TOKEN_DIR:-/home/cmbagent/.denario}:/home/node/.denario",
    ]

    lines.append(f"  {name}:")
    lines.append("    build:")
    lines.append("      context: ../denario-scientists")
    lines.append("      dockerfile: ../denario-scientists/Dockerfile.claude")
    lines.append("      additional_contexts:")
    lines.append("        cmbagent_lg-src: ../cmbagent_lg")
    lines.append("        denario-src: ../Denario")
    lines.append(f"    container_name: {name}")
    lines.append("    environment:")
    for k, v in env.items():
        lines.append(f"      {k}: {v}")
    lines.append("    volumes:")
    for v in volumes:
        lines.append(f"      - {v}")
    lines.append(f"    cpus: \"{s.get('cpus', '4')}\"")
    lines.append(f"    mem_limit: {s.get('memory', '8g')}")
    if s.get("gpus"):
        lines.append("    deploy:")
        lines.append("      resources:")
        lines.append("        reservations:")
        lines.append("          devices:")
        lines.append("            - driver: nvidia")
        lines.append("              device_ids:")
        for did in s["gpus"]:
            lines.append(f"                - \"{did}\"")
        lines.append("              capabilities:")
        lines.append("                - gpu")
    lines.append("    init: true")
    lines.append("    restart: unless-stopped")
    # Remote Control is an interactive session — keep a pty alive in the
    # detached container so it doesn't exit immediately.
    lines.append("    tty: true")
    lines.append("    stdin_open: true")
    lines.append("    extra_hosts:")
    lines.append('      - "host.docker.internal:host-gateway"')
    lines.append("    command:")
    lines.append('      - "sh"')
    lines.append('      - "/app/entrypoint.claude.sh"')
    lines.append("")


def generate_compose(fleet):
    """Generate docker-compose.yml from scientist configs."""
    services = {}
    for s in fleet:
        if s.get("backend", cfg.DEFAULT_BACKEND) == "claude":
            continue  # Claude-Code scientists are emitted separately, below.
        name = s["name"]
        idx = name.split("-")[1]
        # Per-scientist API key overrides: fall back to the shared key when
        # <NAME>_<N> isn't set in .env (nested substitution, compose v2+).
        anthropic_key = f"${{ANTHROPIC_API_KEY_{idx}:-${{ANTHROPIC_API_KEY}}}}"
        gemini_key = f"${{GEMINI_API_KEY_{idx}:-${{GEMINI_API_KEY}}}}"
        google_key = f"${{GOOGLE_API_KEY_{idx}:-${{GOOGLE_API_KEY}}}}"
        google_gemini_key = f"${{GOOGLE_GEMINI_API_KEY_{idx}:-${{GOOGLE_GEMINI_API_KEY}}}}"
        services[name] = {
            "build": {
                "context": "../openclaw",
                "dockerfile": "../denario-scientists/Dockerfile",
                "additional_contexts": {
                    "cmbagent_lg-src": "../cmbagent_lg",
                    "denario-src": "../Denario",
                },
            },
            "container_name": name,
            "environment": {
                "HOME": "/home/node",
                "TERM": "xterm-256color",
                "SCIENTIST_NAME": name,
                "OPENCLAW_GATEWAY_TOKEN": f"${{{name.upper().replace('-', '_')}_TOKEN:-{s['token']}}}",
                "OPENCLAW_ALLOW_INSECURE_PRIVATE_WS": "1",
                "ANTHROPIC_API_KEY": anthropic_key,
                "OPENAI_API_KEY": "${OPENAI_API_KEY}",
                "GEMINI_API_KEY": gemini_key,
                "GOOGLE_API_KEY": google_key,
                "GOOGLE_GEMINI_API_KEY": google_gemini_key,
                "MINIMAX_API_KEY": "${MINIMAX_API_KEY}",
                "NVIDIA_API_KEY": "${NVIDIA_API_KEY}",
                "ZAI_API_KEY": "${ZAI_API_KEY}",
                # Materials Project API — exposed under both names so bare
                # MPRester() (which reads MP_API_KEY) works without the
                # engineer having to know our custom env var name.
                "MATERIALS_API_KEY": "${MATERIALS_API_KEY}",
                "MP_API_KEY": "${MATERIALS_API_KEY}",
                # Perplexity API — used by Denario's paper module to look up
                # citations (langgraph_agents/paper_module/literature.py).
                "PERPLEXITY_API_KEY": "${PERPLEXITY_API_KEY}",
                # Host-side vLLM Gemma 4 31B (reached via host.docker.internal).
                # Override with GEMMA4_URL in .env if the endpoint moves.
                "GEMMA4_URL": "${GEMMA4_URL:-http://host.docker.internal:8010/v1}",
                # openclaw's vllm provider needs any non-empty auth value;
                # the host vLLM serves without auth but the plugin gates on it.
                "VLLM_API_KEY": "${VLLM_API_KEY:-EMPTY}",
                "GITHUB_TOKEN": "${GITHUB_TOKEN}",
                "GITHUB_ORG": "${GITHUB_ORG:-ParallelScience}",
                "ELEVENLABS_API_KEY": "${ELEVENLABS_API_KEY}",
                "ELEVENLABS_VOICE_ID": s["voice_id"],
                "DENARIO_WORK_DIR": "/home/node/work",
                "TZ": "${TZ:-UTC}",
                # Per-scientist Slack app tokens (e.g. SLACK_BOT_TOKEN_1, SLACK_APP_TOKEN_1)
                "SLACK_BOT_TOKEN": f"${{SLACK_BOT_TOKEN_{name.split('-')[1]}}}",
                "SLACK_APP_TOKEN": f"${{SLACK_APP_TOKEN_{name.split('-')[1]}}}",
            },
            "volumes": [
                f"./scientists/{name}/config:/home/node/.openclaw",
                f"./scientists/{name}/workspace:/home/node/.openclaw/workspace",
                f"./scientists/{name}/work:/home/node/work",
                "./auto-pair.sh:/app/auto-pair.sh:ro",
                "./entrypoint.sh:/app/entrypoint.sh:ro",
                "./cancel-watcher.py:/app/cancel-watcher.py:ro",
                "./bootstrap:/app/bootstrap:ro",
                "${DATA_DIR:-./data}:/home/node/data:ro",
                "./tools:/home/node/tools:ro",
                # Valency OAuth token cache. RW so the in-container refresh
                # path can write back to the shared file (UID 1000 on both
                # host and container, so no perms issue). Override the host
                # path with DENARIO_TOKEN_DIR in .env if needed.
                "${DENARIO_TOKEN_DIR:-/home/cmbagent/.denario}:/home/node/.denario",
            ],
            "ports": [
                f"{s['gateway_port']}:18789",
                f"{s['bridge_port']}:18790",
            ],
            # Service-level resource limits (enforced by docker compose up)
            "cpus": s.get("cpus", "4"),
            "mem_limit": s.get("memory", "8g"),
            # deploy.resources.reservations for GPU passthrough only
            **({"deploy": {
                "resources": {
                    "reservations": {
                        "devices": [{
                            "driver": "nvidia",
                            "device_ids": s["gpus"],
                            "capabilities": ["gpu"],
                        }]
                    }
                }
            }} if s.get("gpus") else {}),
            "init": True,
            "restart": "unless-stopped",
            # Let containers reach the host-side vLLM (GEMMA4_URL) via the
            # standard host.docker.internal alias — on Linux this requires an
            # explicit host-gateway mapping.
            "extra_hosts": ["host.docker.internal:host-gateway"],
            "command": [
                "sh", "/app/entrypoint.sh",
            ],
            "healthcheck": {
                "test": ["CMD", "node", "-e",
                         "fetch('http://127.0.0.1:18789/healthz').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"],
                "interval": "30s",
                "timeout": "5s",
                "retries": 5,
                "start_period": "20s",
            },
        }

    lines = ["services:"]
    for svc_name, svc in services.items():
        lines.append(f"  {svc_name}:")
        lines.append(f"    build:")
        lines.append(f"      context: {svc['build']['context']}")
        lines.append(f"      dockerfile: {svc['build']['dockerfile']}")
        if "additional_contexts" in svc["build"]:
            lines.append(f"      additional_contexts:")
            for k, v in svc["build"]["additional_contexts"].items():
                lines.append(f"        {k}: {v}")
        lines.append(f"    container_name: {svc['container_name']}")
        lines.append(f"    environment:")
        for k, v in svc["environment"].items():
            lines.append(f"      {k}: {v}")
        lines.append(f"    volumes:")
        for v in svc["volumes"]:
            lines.append(f"      - {v}")
        lines.append(f"    ports:")
        for p in svc["ports"]:
            lines.append(f'      - "{p}"')
        lines.append(f"    cpus: \"{svc['cpus']}\"")
        lines.append(f"    mem_limit: {svc['mem_limit']}")
        if "deploy" in svc:
            res = svc["deploy"]["resources"]["reservations"]
            lines.append(f"    deploy:")
            lines.append(f"      resources:")
            lines.append(f"        reservations:")
            lines.append(f"          devices:")
            for dev in res["devices"]:
                lines.append(f"            - driver: {dev['driver']}")
                lines.append(f"              device_ids:")
                for did in dev["device_ids"]:
                    lines.append(f"                - \"{did}\"")
                lines.append(f"              capabilities:")
                for cap in dev["capabilities"]:
                    lines.append(f"                - {cap}")
        lines.append(f"    init: true")
        lines.append(f"    restart: unless-stopped")
        if svc.get("extra_hosts"):
            lines.append(f"    extra_hosts:")
            for h in svc["extra_hosts"]:
                lines.append(f'      - "{h}"')
        cmd = svc["command"]
        lines.append(f"    command:")
        for c in cmd:
            lines.append(f'      - "{c}"')
        hc = svc["healthcheck"]
        lines.append(f"    healthcheck:")
        lines.append(f'      test: ["CMD", "node", "-e", "{hc["test"][3]}"]')
        lines.append(f"      interval: {hc['interval']}")
        lines.append(f"      timeout: {hc['timeout']}")
        lines.append(f"      retries: {hc['retries']}")
        lines.append(f"      start_period: {hc['start_period']}")
        lines.append("")

    # Claude-Code-native scientists (driven via `claude --remote-control`,
    # controlled from claude.ai/code — no OpenClaw gateway, no inbound port).
    for s in fleet:
        if s.get("backend", cfg.DEFAULT_BACKEND) == "claude":
            _emit_claude_lines(lines, s)

    path = os.path.join(PROJECT_DIR, "docker-compose.yml")
    with open(path, "w") as f:
        f.write("\n".join(lines) + "\n")
    print(f"  Generated docker-compose.yml ({len(fleet)} scientists)")


def install_bootstrap_files():
    """Copy SOUL.md and AGENTS.md to the shared bootstrap/ directory.

    The entrypoint.sh copies these into each scientist's workspace on every
    container start, BEFORE the gateway runs. This ensures our files take
    priority over OpenClaw's default templates.
    """
    bootstrap_dir = os.path.join(PROJECT_DIR, "bootstrap")
    os.makedirs(bootstrap_dir, exist_ok=True)

    for src_name, dst_name in [("soul.md", "SOUL.md"), ("agents.md", "AGENTS.md")]:
        src = os.path.join(PROJECT_DIR, src_name)
        if os.path.exists(src):
            shutil.copy2(src, os.path.join(bootstrap_dir, dst_name))

    print(f"  Installed bootstrap files: {os.listdir(bootstrap_dir)}")


def _install_workspace_files(config_dir: str, workspace_dir: str, scientist: dict):
    """Install per-scientist workspace files."""
    # SOUL.md + AGENTS.md also go to workspace (for setup.py --reset scenarios)
    soul_src = os.path.join(PROJECT_DIR, "soul.md")
    if os.path.exists(soul_src):
        shutil.copy2(soul_src, os.path.join(workspace_dir, "SOUL.md"))
        soul_dir = os.path.join(config_dir, "agents", "main", "agent")
        os.makedirs(soul_dir, exist_ok=True)
        shutil.copy2(soul_src, os.path.join(soul_dir, "soul.md"))

    agents_src = os.path.join(PROJECT_DIR, "agents.md")
    if os.path.exists(agents_src):
        shutil.copy2(agents_src, os.path.join(workspace_dir, "AGENTS.md"))

    # IDENTITY.md — per-scientist (identity only; hardware lives in TOOLS.md)
    with open(os.path.join(workspace_dir, "IDENTITY.md"), "w") as f:
        f.write(
            f"# Identity\n\n"
            f"- **Name:** {scientist['name']}\n"
            f"- **Role:** Denario research scientist\n"
        )

    # TOOLS.md — per-scientist local setup. Every fact is pulled from config.py
    # (scientist dict + PARAMS_OVERRIDES) so Denario's params.yaml and TOOLS.md
    # share a single source of truth for hardware.
    hardware = (
        cfg.PARAMS_OVERRIDES.get(scientist["name"], {}).get("hardware_constraints")
        or cfg.DEFAULT_HARDWARE_CONSTRAINTS
    )
    with open(os.path.join(workspace_dir, "TOOLS.md"), "w") as f:
        f.write(
            f"# TOOLS.md — Local Setup for {scientist['name']}\n\n"
            f"## Model\n\n"
            f"- Default agent: `{scientist['model']}`\n\n"
            f"## Hardware\n\n"
            f"{hardware}\n\n"
            f"## Gateway ports (host-side)\n\n"
            f"- Gateway UI: {scientist['gateway_port']}\n"
            f"- Bridge: {scientist['bridge_port']}\n"
        )

    # Remove files we don't need
    for filename in ["BOOTSTRAP.md", "HEARTBEAT.md", "USER.md"]:
        filepath = os.path.join(workspace_dir, filename)
        if os.path.exists(filepath):
            os.remove(filepath)


def generate_dirs_and_configs(fleet):
    """Create config/workspace dirs and openclaw.json for each scientist."""
    for s in fleet:
        name = s["name"]
        if s.get("backend", cfg.DEFAULT_BACKEND) == "claude":
            _generate_claude_dirs(s)
            continue
        config_dir = os.path.join(PROJECT_DIR, "scientists", name, "config")
        workspace_dir = os.path.join(PROJECT_DIR, "scientists", name, "workspace")
        work_dir = os.path.join(PROJECT_DIR, "scientists", name, "work")
        os.makedirs(config_dir, exist_ok=True)
        os.makedirs(workspace_dir, exist_ok=True)
        os.makedirs(work_dir, exist_ok=True)

        config_path = os.path.join(config_dir, "openclaw.json")
        if not os.path.exists(config_path):
            config = {
                "gateway": {
                    "controlUi": {
                        "allowedOrigins": [
                            f"http://localhost:{s['gateway_port']}",
                            f"http://127.0.0.1:{s['gateway_port']}",
                        ]
                    }
                },
                "agents": {
                    "defaults": {
                        "model": s["model"],
                        "timeoutSeconds": 3600,
                        "bootstrapMaxChars": 50000,
                        # Disable the 30-min heartbeat loop. It fires an
                        # embedded run against agent:main:main with full
                        # session context every interval, which on scientists
                        # with large transcripts (esp. denario-3) was costing
                        # >$17/day per scientist in idle "nothing to do" turns.
                        # "0m" is the documented disable value — see
                        # openclaw/docs/gateway/heartbeat.md.
                        "heartbeat": {"every": "0m"},
                    },
                    "list": [
                        {
                            "id": "main",
                            "identity": {
                                "name": name,
                            },
                        }
                    ],
                },
                "channels": {
                    "slack": {
                        "mode": "socket",
                        "enabled": True,
                        "allowBots": True,
                        "groupPolicy": "open",
                        "dmPolicy": "open",
                        "allowFrom": ["*"],
                        "streaming": {
                            "mode": "partial",
                            "nativeTransport": True,
                        },
                    }
                },
                "mcp": {
                    "servers": {
                        "denario": {
                            "command": "/opt/denario-venv/bin/python",
                            "args": [cfg.DENARIO_MCP_SERVER_PATH],
                        }
                    }
                },
                "talk": {
                    "provider": "elevenlabs",
                    "providers": {
                        "elevenlabs": {
                            "voiceId": s["voice_id"],
                            "modelId": "eleven_multilingual_v2",
                        }
                    },
                },
                "messages": {
                    "tts": {
                        "auto": "inbound",
                        "provider": "elevenlabs",
                        "providers": {
                            "elevenlabs": {
                                "voiceId": s["voice_id"],
                                "modelId": "eleven_multilingual_v2",
                            }
                        },
                    }
                },
                "browser": {"enabled": False},
                "cron": {"enabled": False},
                "plugins": {
                    "entries": {
                        "slack": {"enabled": True},
                        "memory-core": {"enabled": True},
                        "device-pair": {"enabled": False},
                        "phone-control": {"enabled": False},
                        "talk-voice": {"enabled": True},
                        "elevenlabs": {"enabled": True},
                        "openai": {"enabled": True},
                    }
                },
                "skills": {"entries": {}},
                "commands": {
                    "native": "auto",
                    "nativeSkills": False,
                    "restart": False,
                },
                "tools": {
                    "profile": "full",
                    "exec": {
                        "security": "full",
                        "ask": "off",
                    },
                    "media": {
                        "audio": {
                            "enabled": True,
                            "models": [
                                {
                                    "type": "provider",
                                    "provider": "openai",
                                    "model": "whisper-1",
                                    "timeoutSeconds": 60,
                                }
                            ],
                            "echoTranscript": True,
                            "echoFormat": '📝 "{transcript}"',
                        },
                    },
                },
            }

            # Explicit self-hosted provider catalog (e.g. local vLLM for
            # Gemma 4). When declared in config.py, openclaw skips discovery
            # and uses these models directly.
            vllm_catalog = getattr(cfg, "VLLM_PROVIDER_CATALOGS", {}).get(name)
            if vllm_catalog:
                config.setdefault("models", {}).setdefault("providers", {})["vllm"] = vllm_catalog

            with open(config_path, "w") as f:
                json.dump(config, f, indent=2)
            print(f"  Created config for {name}")
        else:
            print(f"  Config exists for {name}")

        _install_workspace_files(config_dir, workspace_dir, s)
        _install_params(work_dir, s)
        print(f"  Installed workspace for {name}")


def _generate_claude_dirs(s):
    """Per-scientist dirs/config for a Claude-Code-native scientist.

    No openclaw.json: the denario plugin (mounted at /opt/denario-plugin, loaded
    via `--plugin-dir`) provides the skills + the bundled MCP servers. We create
    the work dir (+ params.yaml the MCP server reads) and a host-backed `.claude`
    dir holding settings.json (and, after first start, the seeded credentials,
    session history, and refreshed tokens).
    """
    name = s["name"]
    work_dir = os.path.join(PROJECT_DIR, "scientists", name, "work")
    claude_dir = os.path.join(PROJECT_DIR, "scientists", name, "claude")
    os.makedirs(work_dir, exist_ok=True)
    os.makedirs(claude_dir, exist_ok=True)

    settings_path = os.path.join(claude_dir, "settings.json")
    if not os.path.exists(settings_path):
        settings = {
            # Pin updates off inside the container (image controls the version).
            "env": {"DISABLE_AUTOUPDATER": "1"},
            "autoUpdatesChannel": "stable",
            # Pin the permission mode explicitly to "default". This suppresses the
            # PROACTIVE "Enable auto mode?" startup offer, which otherwise BLOCKS
            # the session before Remote Control registers (so it never appears in
            # the dashboard). With this set, the session boots straight to a live,
            # RC-connected prompt; the driver can switch to auto mode in-session
            # (Shift+Tab) from claude.ai/code if they want autonomy.
            "permissions": {"defaultMode": "default"},
        }
        with open(settings_path, "w") as f:
            json.dump(settings, f, indent=2)
        print(f"  Created Claude config for {name}")
    else:
        print(f"  Claude config exists for {name}")

    _install_params(work_dir, s)
    print(f"  Installed work dir for {name} (claude backend)")


def _deep_merge(base: dict, overrides: dict) -> dict:
    """Recursively merge overrides into a copy of base."""
    result = copy.deepcopy(base)
    for k, v in overrides.items():
        if k in result and isinstance(result[k], dict) and isinstance(v, dict):
            result[k] = _deep_merge(result[k], v)
        else:
            result[k] = copy.deepcopy(v)
    return result


def _install_params(work_dir: str, scientist: dict):
    """Generate per-scientist params.yaml (base + overrides from config)."""
    base_path = os.path.join(PROJECT_DIR, "data", "params.yaml")
    out_path = os.path.join(work_dir, "params.yaml")

    with open(base_path) as f:
        params = yaml.safe_load(f)

    overrides = cfg.PARAMS_OVERRIDES.get(scientist["name"])
    if overrides:
        params = _deep_merge(params, overrides)

    # Inject default hardware_constraints if not already set by overrides
    if "hardware_constraints" not in params:
        params["hardware_constraints"] = cfg.DEFAULT_HARDWARE_CONSTRAINTS

    with open(out_path, "w") as f:
        yaml.dump(params, f, default_flow_style=False, sort_keys=False)


def ensure_env_tokens(fleet):
    """Ensure .env has tokens for all scientists."""
    env_path = os.path.join(PROJECT_DIR, ".env")
    if os.path.exists(env_path):
        with open(env_path) as f:
            content = f.read()
    else:
        content = ""

    added = []
    for s in fleet:
        token_var = s["name"].upper().replace("-", "_") + "_TOKEN"
        if token_var not in content:
            content += f"\n{token_var}={s['token']}"
            added.append(token_var)

    if added:
        with open(env_path, "w") as f:
            f.write(content.strip() + "\n")
        print(f"  Added tokens to .env: {', '.join(added)}")
    else:
        print(f"  All tokens present in .env")


def reset_configs(fleet):
    """Reset openclaw.json for all scientists."""
    for s in fleet:
        config_path = os.path.join(PROJECT_DIR, "scientists", s["name"], "config", "openclaw.json")
        if os.path.exists(config_path):
            os.remove(config_path)
            print(f"  Reset {s['name']} config")
        for f in glob.glob(os.path.join(PROJECT_DIR, "scientists", s["name"], "config", "openclaw.json.bak*")):
            os.remove(f)


def full_reset(fleet):
    """Wipe everything: configs, sessions, work dirs."""
    print("  Stopping containers...")
    subprocess.run(["docker", "compose", "down"], cwd=PROJECT_DIR, capture_output=True)

    for s in fleet:
        name = s["name"]
        base = os.path.join(PROJECT_DIR, "scientists", name)

        for f in glob.glob(os.path.join(base, "config", "openclaw.json*")):
            os.remove(f)

        for subdir in ["config/agents", "config/logs", "config/cron",
                        "config/devices", "config/identity", "config/canvas",
                        "work"]:
            dirpath = os.path.join(base, subdir)
            if os.path.exists(dirpath):
                subprocess.run(["docker", "run", "--rm",
                                "-v", f"{os.path.abspath(dirpath)}:/data",
                                "alpine", "rm", "-rf", "/data"],
                               capture_output=True)
                print(f"  [{name}] Wiped {subdir}")

        workspace_dir = os.path.join(base, "workspace")
        if os.path.exists(workspace_dir):
            for f in os.listdir(workspace_dir):
                if f not in ("SOUL.md", "IDENTITY.md"):
                    fpath = os.path.join(workspace_dir, f)
                    if os.path.isfile(fpath):
                        os.remove(fpath)
                    elif os.path.isdir(fpath):
                        shutil.rmtree(fpath, ignore_errors=True)
            print(f"  [{name}] Cleaned workspace")

        print(f"  [{name}] Reset complete")


def main():
    args = parse_args()

    # Override config with CLI args
    n = args.scientists
    if args.model:
        cfg.DEFAULT_MODEL = args.model
    fleet = cfg.scientists(n)

    print(f"Denario Scientists Setup ({n} scientists)")
    print("=" * 50)

    if args.full_reset:
        print("\nFull reset (wipe everything)...")
        full_reset(fleet)
    elif args.reset:
        print("\nResetting configs...")
        reset_configs(fleet)

    print("\nInstalling bootstrap files...")
    install_bootstrap_files()

    print("\nGenerating configs...")
    generate_dirs_and_configs(fleet)

    print("\nChecking .env tokens...")
    ensure_env_tokens(fleet)

    print("\nGenerating docker-compose.yml...")
    generate_compose(fleet)

    if args.up:
        print("\nBuilding and starting containers...")
        subprocess.run(["docker", "compose", "build"], cwd=PROJECT_DIR)
        subprocess.run(["docker", "compose", "up", "-d"], cwd=PROJECT_DIR)

    print("\nDone.")
    print(f"\nScientist Control UIs:")
    for s in fleet:
        if s.get("backend", cfg.DEFAULT_BACKEND) == "claude":
            print(f"  {s['name']}: Claude Code remote-control — open claude.ai/code "
                  f"and select session '{s['name']}'")
        else:
            print(f"  {s['name']}: http://localhost:{s['gateway_port']}/#token={s['token']}")


if __name__ == "__main__":
    main()