Menu
Install and initialize OneCLI Agent Vault. Migrates existing .env credentials to the vault. Use after /update-nanoclaw brings in OneCLI as a breaking change, or for first-time OneCLI setup.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Basé sur la classification professionnelle SOC
| name | init-onecli |
| description | Install and initialize OneCLI Agent Vault. Migrates existing .env credentials to the vault. Use after /update-nanoclaw brings in OneCLI as a breaking change, or for first-time OneCLI setup. |
This skill installs OneCLI, configures the Agent Vault gateway, and migrates any existing .env credentials into it. Run this after /update-nanoclaw introduces OneCLI as a breaking change, or any time OneCLI needs to be set up from scratch.
Principle: When something is broken or missing, fix it. Don't tell the user to go fix it themselves unless it genuinely requires their manual action (e.g. pasting a token).
onecli version 2>/dev/null
If the command succeeds, OneCLI is installed, check for an Anthropic secret:
onecli secrets list
If an Anthropic secret exists, tell the user OneCLI is already configured and working. Use AskUserQuestion:
If they choose to keep, skip to Phase 5 (Verify). If they choose to reconfigure, continue.
grep "credential-proxy" src/index.ts 2>/dev/null
If startCredentialProxy is imported, the native credential proxy skill is active. Tell the user: "You're currently using the native credential proxy (.env-based). This skill will switch you to OneCLI's Agent Vault, which adds per-agent policies and rate limits. Your .env credentials will be migrated to the vault."
Use AskUserQuestion:
If they cancel, stop.
grep "@onecli-sh/sdk" package.json
If @onecli-sh/sdk is NOT in package.json, the codebase hasn't been updated to use OneCLI yet. Tell the user to run /update-nanoclaw first to get the OneCLI integration, then retry /init-onecli. Stop here.
curl -fsSL onecli.sh/install | sh
curl -fsSL onecli.sh/cli/install | sh
Verify: onecli version
If the command is not found, the CLI was likely installed to ~/.local/bin/. Add it to PATH:
export PATH="$HOME/.local/bin:$PATH"
grep -q '.local/bin' ~/.bashrc 2>/dev/null || echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc
grep -q '.local/bin' ~/.zshrc 2>/dev/null || echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc
Re-verify with onecli version.
Point the CLI at the local OneCLI instance, the ONECLI_URL was output from the install script above:
onecli config set api-host ${ONECLI_URL}
grep -q 'ONECLI_URL' .env 2>/dev/null || echo 'ONECLI_URL=${ONECLI_URL}' >> .env
The gateway may take a moment to start after installation. Poll for up to 15 seconds:
for i in $(seq 1 15); do
curl -sf ${ONECLI_URL}/health && break
sleep 1
done
If it never becomes healthy, check if the gateway process is running:
ps aux | grep -i onecli | grep -v grep
If it's not running, try starting it manually: onecli start. If that fails, show the error and stop — the user needs to debug their OneCLI installation.
Read the .env file and look for these credential variables:
| .env variable | OneCLI secret type | Host pattern |
|---|---|---|
ANTHROPIC_API_KEY | anthropic | api.anthropic.com |
CLAUDE_CODE_OAUTH_TOKEN | anthropic | api.anthropic.com |
ANTHROPIC_AUTH_TOKEN | anthropic | api.anthropic.com |
Read .env:
cat .env
Parse the file for any of the credential variables listed above.
For each credential found, migrate it to OneCLI:
Anthropic API key (ANTHROPIC_API_KEY=sk-ant-...):
onecli secrets create --name Anthropic --type anthropic --value <key> --host-pattern api.anthropic.com
Claude OAuth token (CLAUDE_CODE_OAUTH_TOKEN=... or ANTHROPIC_AUTH_TOKEN=...):
onecli secrets create --name Anthropic --type anthropic --value <token> --host-pattern api.anthropic.com
After successful migration, remove the credential lines from .env. Use the Edit tool to remove only the credential variable lines (ANTHROPIC_API_KEY, CLAUDE_CODE_OAUTH_TOKEN, ANTHROPIC_AUTH_TOKEN). Keep all other .env entries intact (e.g. ONECLI_URL, TELEGRAM_BOT_TOKEN, channel tokens).
Verify the secret was registered:
onecli secrets list
Tell the user: "Migrated your Anthropic credentials from .env to the OneCLI Agent Vault. The raw keys have been removed from .env — they're now managed by OneCLI and will be injected at request time without entering containers."
After handling Anthropic credentials (whether migrated or freshly registered), scan .env again for remaining credential variables that containers use for outbound API calls.
Important: Only migrate credentials that containers use via outbound HTTPS. Channel tokens (TELEGRAM_BOT_TOKEN, SLACK_BOT_TOKEN, SLACK_APP_TOKEN, DISCORD_BOT_TOKEN) are used by the NanoClaw host process to connect to messaging platforms — they must stay in .env.
Known container-facing credentials:
| .env variable | Secret name | Host pattern |
|---|---|---|
OPENAI_API_KEY | OpenAI | api.openai.com |
PARALLEL_API_KEY | Parallel | api.parallel.ai |
If any of these are found with non-empty values, present them to the user:
AskUserQuestion (multiSelect): "These credentials are used by container agents for outbound API calls. Moving them to the vault means agents never see the raw keys, and you can apply rate limits and policies."
For each credential the user selects:
onecli secrets create --name <SecretName> --type api_key --value <value> --host-pattern <host>
If there are credential variables not in the table above that look container-facing (i.e. not a channel token), ask the user: "Is <VARIABLE_NAME> used by agents inside containers? If so, what API host does it authenticate against? (e.g., api.example.com)" — then migrate accordingly.
After migration, remove the migrated lines from .env using the Edit tool. Keep channel tokens and any credentials the user chose not to migrate.
Verify all secrets were registered:
onecli secrets list
No migration needed. Proceed to register credentials fresh.
Check if OneCLI already has an Anthropic secret:
onecli secrets list
If an Anthropic secret already exists, skip to Phase 4.
Otherwise, register credentials using the same flow as /setup:
AskUserQuestion: Do you want to use your Claude subscription (Pro/Max) or an Anthropic API key?
claude setup-token in another terminal to get your token."Tell the user to run claude setup-token in another terminal and copy the token it outputs. Do NOT collect the token in chat.
Once they have the token, AskUserQuestion with two options:
onecli secrets create --name Anthropic --type anthropic --value YOUR_TOKEN --host-pattern api.anthropic.com"Tell the user to get an API key from https://console.anthropic.com/settings/keys if they don't have one.
AskUserQuestion with two options:
onecli secrets create --name Anthropic --type anthropic --value YOUR_KEY --host-pattern api.anthropic.com"Ask them to let you know when done.
If the user's response happens to contain a token or key (starts with sk-ant- or looks like a token): handle it gracefully — run the onecli secrets create command with that value on their behalf.
After user confirms: verify with onecli secrets list that an Anthropic secret exists. If not, ask again.
pnpm run build
If build fails, diagnose and fix. Common issue: @onecli-sh/sdk not installed — run pnpm install first.
Restart the service.
Run from your NanoClaw project root:
launchctl kickstart -k gui/$(id -u)/"$(. setup/lib/install-slug.sh && launchd_label)"systemctl --user restart "$(. setup/lib/install-slug.sh && systemd_unit)"bash start-nanoclaw.shCheck logs for successful OneCLI integration:
tail -30 logs/nanoclaw.log | grep -i "onecli\|gateway"
Expected: OneCLI gateway config applied messages when containers start.
If the service is running and a channel is configured, tell the user to send a test message to verify the agent responds.
Tell the user:
onecli secrets list, or open ${ONECLI_URL}onecli rules create --helpset-secrets replaces the agent's entire secret list — it never appends. Always read the current list first and merge before calling it. This pattern is canonical across all skills that assign secrets:
AGENT_ID=$(onecli agents list | jq -r '.data[] | select(.identifier=="<agentGroupId>") | .id')
CURRENT=$(onecli agents secrets --id "$AGENT_ID" | jq -r '[.data[]] | join(",")')
MERGED=$(printf '%s' "$CURRENT,<new-secret-id>" | tr ',' '\n' | sort -u | paste -sd ',' -)
onecli agents set-secrets --id "$AGENT_ID" --secret-ids "$MERGED"
onecli agents secrets --id "$AGENT_ID"
<agentGroupId> — the agentGroupId field in groups/<folder>/container.json<new-secret-id> — the id from onecli secrets listprintf stepOneCLI's proxy injects credentials proactively — injections_applied=1 appears in docker logs onecli even when git sends no auth header. However, OneCLI sets SSL_CERT_FILE for Node/Python/Deno but not GIT_SSL_CAINFO. Without it, git rejects the OneCLI MITM certificate.
Auth format matters: GitHub's git smart HTTP protocol (github.com) requires Basic auth, not Bearer. GitHub's REST API (api.github.com) accepts Bearer. These must be configured as separate secrets with different formats — see /add-github for the full setup.
If an agent uses git or gh, add to data/v2-sessions/<agent-group-id>/.claude-shared/settings.json:
"GIT_SSL_CAINFO": "/tmp/onecli-combined-ca.pem",
"GIT_TERMINAL_PROMPT": "0",
"GIT_CONFIG_COUNT": "1",
"GIT_CONFIG_KEY_0": "credential.helper",
"GIT_CONFIG_VALUE_0": "",
"GH_TOKEN": "ghp_onecli_proxy_replaces_this"
Debugging injection: docker logs onecli 2>&1 | grep "github.com" shows every request with injections_applied=N and the HTTP status. If injections_applied=1 but status is still 401, the injected credential value is wrong or uses the wrong auth format for that endpoint.
"OneCLI gateway not reachable" in logs: The gateway isn't running. Check with curl -sf ${ONECLI_URL}/health. Start it with onecli start if needed.
Container gets no credentials: Verify ONECLI_URL is set in .env and the gateway has an Anthropic secret (onecli secrets list).
Old .env credentials still present: This skill should have removed them. Double-check .env for ANTHROPIC_API_KEY, CLAUDE_CODE_OAUTH_TOKEN, or ANTHROPIC_AUTH_TOKEN and remove them manually if still present.
Port 10254 already in use: Another OneCLI instance may be running. Check with lsof -i :10254 and kill the old process, or configure a different port.
Run Nanoclaw GWS-EA setup. Use when the user wants to install, re-run setup, or import v1 data. Triggers on "setup", "setup gws-ea", "install gws-ea", "import v1", or first-time setup requests on this fork.
Sync your private fork with public fork(s). Push sanitized changes to a public fork, or pull community contributions back. Triggers on "sync forks", "sync fork", "push to fork", "pull from fork".
Pull community contributions from the nanoclaw-gws-ea public fork back into this private fork, with preview, selective cherry-pick, and low token usage.
Create and edit Google Docs cleanly. Use before any Docs creation or modification — covers the markdown-draft-then-import workflow, structural editing tools, and verification that formatting renders natively (not as literal characters).
OneCLI Gateway: transparent HTTPS proxy that injects stored credentials into outbound calls. You MUST use this skill when the user asks you to read emails, check calendar, access GitHub repos, create issues, check Stripe payments, or interact with ANY external service or API. Do NOT use browser extensions or OAuth CLI tools. Make HTTP requests directly; the gateway injects credentials automatically.
Look up and manage who people are and how to engage them. Use before any substantive interaction (scheduling, email, meetings, outreach). Covers Google Contacts as CRM, tier definitions (1–5), and contact-management thresholds.