Function envFile

ts/workflow-cli/cli/deploy/generate.ts:154–181

(cfg: DeployConfig)

// document (<name>-secrets.json). This file carries only non-secret runtime knobs
// plus the web-search key (engine-wide device env, not a per-resource secret).
export function envFile(cfg: DeployConfig): string {
  // Only present when the workflow has a WebSearchTool node (cfg.webSearch set).
  const webSearchSection = cfg.webSearch
    ? `# ----- Web search -----
ENGINE_WEB_SEARCH_PROVIDER=${cfg.webSearch.provider}
ENGINE_WEB_SEARCH_API_KEY=${cfg.webSearch.apiKey}

`
    : "";

  return `# Edge Agents engine — operator configuration.
# Auto-generated by \`fh-workflow deploy\`. Loaded into the engine via the compose
# \`env_file\`. Secret values: chmod 600 this file after editing.

${webSearchSection}# ----- Runtime -----
ENGINE_LOG_LEVEL=${cfg.logLevel}     # debug | info | warn | error
`;
}

// Exported for testing purposes only.
export function readme(spec: DeploymentSpec, cfg: DeployConfig, hasProviderModel: boolean, hasSecrets = false): string {
  const localProviders = Object.keys(cfg.llmKeys).filter((id) => Boolean(cfg.llmKeys[id]));
  const providerBlock =
    localProviders.length === 0
      ? "_No provider keys set._ An Agent that uses a catalog model will fail at build — supply the matching provider key at deploy."
      : localProviders.map((id) => `- **${id}** — runs locally (your API key, in \`engine-secrets.json\`)`).join("\n");

  const engine = spec.components.find((c) => c.name === "engine");
  const hasHardware = (engine?.devices?.length ?? 0) > 0 || Boolean(engine?.privileged);
  // All on-device models share ONE llama server; their GGUFs live together in that
  // component's workspace dir (./workspaces/llama/) — the host bind mount the