setup

name	setup
description	Run initial NanoClaw setup. Use when user wants to install dependencies, configure QQ bot, register their main channel, or start the background services. Triggers on "setup", "install", "configure nanoclaw", or first-time setup requests.

NanoClaw Setup (QQ Channel)

Run setup steps automatically. Only pause when user action is required (QQ bot credentials, configuration choices). Setup uses bash setup.sh for bootstrap, then npx tsx setup/index.ts --step <name> for all other steps. Steps emit structured status blocks to stdout. Verbose logs go to logs/setup.log.

Principle: When something is broken or missing, fix it. Don't tell the user to go fix it themselves unless it genuinely requires their manual action (e.g. copying credentials from QQ open platform). If a dependency is missing, install it. If a service won't start, diagnose and repair. Ask the user for permission when needed, then do the work.

UX Note: Use AskUserQuestion for all user-facing questions.

1. Bootstrap (Node.js + Dependencies)

Run bash setup.sh and parse the status block.

• If NODE_OK=false -> Node.js is missing or too old. Use AskUserQuestion: Would you like me to install Node.js 22? If confirmed:
  • macOS: brew install node@22 (if brew available) or install nvm then nvm install 22
  • Linux: curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash - && sudo apt-get install -y nodejs, or nvm
  • After installing Node, re-run bash setup.sh
• If DEPS_OK=false -> Read logs/setup.log. Try: delete node_modules and package-lock.json, re-run bash setup.sh. If native module build fails, install build tools (xcode-select --install on macOS, build-essential on Linux), then retry.
• If NATIVE_OK=false -> better-sqlite3 failed to load. Install build tools and re-run.
• Record PLATFORM and IS_WSL for later steps.

2. Check Environment

Run npx tsx setup/index.ts --step environment and parse the status block.

• If HAS_REGISTERED_GROUPS=true -> note existing config, offer to skip or reconfigure
• Record APPLE_CONTAINER and DOCKER values for step 3

3. Container Runtime

3a. Choose runtime

Check the preflight results for APPLE_CONTAINER and DOCKER, and the PLATFORM from step 1.

• PLATFORM=linux -> Docker (only option)
• PLATFORM=macos + APPLE_CONTAINER=installed -> Use AskUserQuestion: Docker (default, cross-platform) or Apple Container (native macOS)? If Apple Container, run /convert-to-apple-container now, then skip to 3c.
• PLATFORM=macos + APPLE_CONTAINER=not_found -> Docker (default)

3a-docker. Install Docker

• DOCKER=running -> continue to 3b
• DOCKER=installed_not_running -> start Docker: open -a Docker (macOS) or sudo systemctl start docker (Linux). Wait 15s, re-check with docker info.
• DOCKER=not_found -> Use AskUserQuestion: Docker is required for running agents. Would you like me to install it? If confirmed:
  • macOS: install via brew install --cask docker, then open -a Docker and wait for it to start. If brew not available, direct to Docker Desktop download at https://docker.com/products/docker-desktop
  • Linux: install with curl -fsSL https://get.docker.com | sh && sudo usermod -aG docker $USER. Note: user may need to log out/in for group membership.

3b. Apple Container conversion gate (if needed)

If the chosen runtime is Apple Container, you MUST check whether the source code has already been converted from Docker to Apple Container. Do NOT skip this step. Run:

grep -q "CONTAINER_RUNTIME_BIN = 'container'" src/container-runtime.ts && echo "ALREADY_CONVERTED" || echo "NEEDS_CONVERSION"

If NEEDS_CONVERSION, the source code still uses Docker as the runtime. You MUST run the /convert-to-apple-container skill NOW, before proceeding to the build step.

If ALREADY_CONVERTED, the code already uses Apple Container. Continue to 3c.

If the chosen runtime is Docker, no conversion is needed - Docker is the default. Continue to 3c.

3c. Build and test

Run npx tsx setup/index.ts --step container -- --runtime <chosen> and parse the status block.

If BUILD_OK=false: Read logs/setup.log tail for the build error.

• Cache issue (stale layers): docker builder prune -f (Docker) or container builder stop && container builder rm && container builder start (Apple Container). Retry.
• Dockerfile syntax or missing files: diagnose from the log and fix, then retry.

If TEST_OK=false but BUILD_OK=true: The image built but won't run. Check logs - common cause is runtime not fully started. Wait a moment and retry the test.

4. iFlow Authentication (No Script)

If HAS_ENV=true from step 2, read .env and check for IFLOW_API_KEY or IFLOW_OAUTH_TOKEN. If present, confirm with user: keep or reconfigure?

AskUserQuestion: iFlow API key or OAuth token?

API key: Tell user to add IFLOW_API_KEY=<key> to .env. OAuth token: Tell user to add IFLOW_OAUTH_TOKEN=<token> to .env.

Do NOT collect the credentials in chat.

5. QQ Bot Configuration

QQ bot uses the QQ Open Platform (https://bot.q.qq.com). You need to obtain credentials from the platform.

AskUserQuestion: Do you have QQ bot credentials (AppID and ClientSecret) from the QQ Open Platform?

If no: Guide user to:

1. Visit https://bot.q.qq.com and log in with QQ
2. Create a new bot or use existing one
3. Copy the AppID and ClientSecret from bot settings

If yes: Collect credentials:

Ask for AppID first, then ClientSecret. Add to .env:

QQ_APP_ID=<appid>
QQ_CLIENT_SECRET=<secret>
QQ_SANDBOX=true
QQ_AUTO_REGISTER=true

Also add to disable WhatsApp (not needed for QQ setup):

ENABLE_WHATSAPP=false

6. Configure Trigger and Assistant Name

AskUserQuestion: What trigger word should the bot respond to? (default: Andy)

Update .env with ASSISTANT_NAME=<name> if different from Andy.

7. Auto-Registration Configuration

QQ channel supports auto-registration. When a user sends a message to the bot (either in a group with @mention or via direct message), the chat is automatically registered.

AskUserQuestion: Enable auto-registration for new chats? (Recommended: Yes)

If yes, ensure .env has QQ_AUTO_REGISTER=true.

If no, set QQ_AUTO_REGISTER=false and manually register specific chats via the database.

8. Mount Allowlist

AskUserQuestion: Agent access to external directories?

No: npx tsx setup/index.ts --step mounts -- --empty Yes: Collect paths/permissions. npx tsx setup/index.ts --step mounts -- --json '{"allowedRoots":[...],"blockedPatterns":[],"nonMainReadOnly":true}'

9. Start Service

If service already running: unload first.

• macOS: launchctl unload ~/Library/LaunchAgents/com.nanoclaw.plist
• Linux: systemctl --user stop nanoclaw (or systemctl stop nanoclaw if root)

Run npx tsx setup/index.ts --step service and parse the status block.

If FALLBACK=wsl_no_systemd: WSL without systemd detected. Tell user they can either enable systemd in WSL (echo -e "[boot]\nsystemd=true" | sudo tee /etc/wsl.conf then restart WSL) or use the generated start-nanoclaw.sh wrapper.

If DOCKER_GROUP_STALE=true: The user was added to the docker group after their session started - the systemd service can't reach the Docker socket. Ask user to run these two commands:

1. Immediate fix: sudo setfacl -m u:$(whoami):rw /var/run/docker.sock
2. Persistent fix (re-applies after every Docker restart):

sudo mkdir -p /etc/systemd/system/docker.service.d
sudo tee /etc/systemd/system/docker.service.d/socket-acl.conf << 'EOF'
[Service]
ExecStartPost=/usr/bin/setfacl -m u:USERNAME:rw /var/run/docker.sock
EOF
sudo systemctl daemon-reload

Replace USERNAME with the actual username (from whoami). Run the two sudo commands separately - the tee heredoc first, then daemon-reload. After user confirms setfacl ran, re-run the service step.

If SERVICE_LOADED=false:

• Read logs/setup.log for the error.
• macOS: check launchctl list | grep nanoclaw. If PID=- and status non-zero, read logs/nanoclaw.error.log.
• Linux: check systemctl --user status nanoclaw.
• Re-run the service step after fixing.

10. Verify

Run npx tsx setup/index.ts --step verify and parse the status block.

If STATUS=failed, fix each:

• SERVICE=stopped -> npm run build, then restart: launchctl kickstart -k gui/$(id -u)/com.nanoclaw (macOS) or systemctl --user restart nanoclaw (Linux) or bash start-nanoclaw.sh (WSL nohup)
• SERVICE=not_found -> re-run step 9
• CREDENTIALS=missing -> re-run step 4
• QQ_CREDENTIALS=missing -> re-run step 5
• MOUNT_ALLOWLIST=missing -> npx tsx setup/index.ts --step mounts -- --empty

Tell user to test: send a message to the QQ bot (direct message or @mention in group). Show: tail -f logs/nanoclaw.log

Troubleshooting

Service not starting: Check logs/nanoclaw.error.log. Common: wrong Node path (re-run step 9), missing .env (step 4), missing QQ credentials (step 5).

Container agent fails ("agent process exited with code 1"): Ensure the container runtime is running - open -a Docker (macOS Docker), container system start (Apple Container), or sudo systemctl start docker (Linux). Check container logs in groups/main/logs/container-*.log.

No response to QQ messages:

1. Check QQ credentials in .env: QQ_APP_ID and QQ_CLIENT_SECRET
2. Verify bot is registered at https://bot.q.qq.com
3. Check if using sandbox mode - set QQ_SANDBOX=false for production
4. Check logs: tail -f logs/nanoclaw.log
5. For group messages, ensure bot is @mentioned
6. Check trigger pattern - main channel may not need prefix

QQ WebSocket disconnected:

1. Check network connectivity
2. Verify access token is valid (auto-refreshes every ~2 hours)
3. Check logs for reconnection attempts
4. Restart service: launchctl kickstart -k gui/$(id -u)/com.nanoclaw (macOS) or systemctl --user restart nanoclaw (Linux)

QQ API errors:

• 401/403: Invalid credentials, re-run step 5
• 400/422: Message format issue, check markdown content
• Rate limiting: Messages are auto-queued and sent with delays

Unload service: macOS: launchctl unload ~/Library/LaunchAgents/com.nanoclaw.plist | Linux: systemctl --user stop nanoclaw

QQ Channel Notes

• JID Format: qq:{group_openid} for groups, qq:c2c:{user_openid} for direct messages
• Trigger: Group messages require @mention; direct messages do not
• Auto-registration: New chats are automatically registered when QQ_AUTO_REGISTER=true
• Sandbox mode: Use QQ_SANDBOX=true for testing; set to false for production
• Message format: Supports Markdown; falls back to plain text if markdown fails