If an `upstream` remote pointing to `https://github.com/qwibitai/nanoclaw.git` is missing,

git remote add upstream https://github.com/qwibitai/nanoclaw.git

git remote add upstream https://github.com/qwibitai/nanoclaw.git

If an `upstream` remote pointing to `https://github.com/qwibitai/nanoclaw.git` is missing,

git remote add upstream https://github.com/qwibitai/nanoclaw.git

git remote add upstream https://github.com/qwibitai/nanoclaw.git

description: Install and initialize OneCLI Agent Vault. Migrates existing .env credentials to the vault. Use after /update-nanoclaw brings in OneCLI as a breaking change, or for first-time OneCLI setup.

This skill installs OneCLI, configures the Agent Vault gateway, and migrates any existing `.env` credentials into it. Run this after `/update-nanoclaw` introduces OneCLI as a breaking change, or any time OneCLI needs to be set up from scratch.

If the command succeeds, OneCLI is installed, check for an Anthropic secret:

If an Anthropic secret exists, tell the user OneCLI is already configured and working. Use AskUserQuestion:

1. **Keep current setup** — description: "OneCLI is installed and has credentials configured. Nothing to do."

2. **Reconfigure** — description: "Start fresh — reinstall OneCLI and re-register credentials."

If `startCredentialProxy` is imported, the native credential proxy skill is active. Tell the user: "You're currently using the native credential proxy (`.env`-based). This skill will switch you to OneCLI's Agent Vault, which adds per-agent policies and rate limits. Your `.env` credentials will be migrated to the vault."

1. **Continue** — description: "Switch to OneCLI Agent Vault."

curl -fsSL onecli.sh/install | sh

Point the CLI at the local OneCLI instance, the ONECLI_URL was output from the install script above:

onecli config set api-host ${ONECLI_URL}

grep -q 'ONECLI_URL' .env 2>/dev/null || echo 'ONECLI_URL=${ONECLI_URL}' >> .env

The gateway may take a moment to start after installation. Poll for up to 15 seconds:

for i in $(seq 1 15); do

curl -sf ${ONECLI_URL}/health && break

sleep 1

If it never becomes healthy, check if the gateway process is running:

If it's not running, try starting it manually: `onecli start`. If that fails, show the error and stop — the user needs to debug their OneCLI installation.

For each credential found, migrate it to OneCLI:

After successful migration, remove the credential lines from `.env`. Use the Edit tool to remove only the credential variable lines (`ANTHROPIC_API_KEY`, `CLAUDE_CODE_OAUTH_TOKEN`, `ANTHROPIC_AUTH_TOKEN`). Keep all other `.env` entries intact (e.g. `ONECLI_URL`, `TELEGRAM_BOT_TOKEN`, channel tokens).

Tell the user: "Migrated your Anthropic credentials from `.env` to the OneCLI Agent Vault. The raw keys have been removed from `.env` — they're now managed by OneCLI and will be injected at request time without entering containers."

Check if OneCLI already has an Anthropic secret:

1. **Dashboard** — description: "Best if you have a browser on this machine. Open ${ONECLI_URL} and add the secret in the UI. Use type 'anthropic' and paste your token as the value."

1. **Dashboard** — description: "Best if you have a browser on this machine. Open ${ONECLI_URL} and add the secret in the UI."

- OneCLI Agent Vault is now managing credentials

- To manage secrets: `onecli secrets list`, or open ${ONECLI_URL}

**"OneCLI gateway not reachable" in logs:** The gateway isn't running. Check with `curl -sf ${ONECLI_URL}/health`. Start it with `onecli start` if needed.

**Container gets no credentials:** Verify `ONECLI_URL` is set in `.env` and the gateway has an Anthropic secret (`onecli secrets list`).

**Port 10254 already in use:** Another OneCLI instance may be running. Check with `lsof -i :10254` and kill the old process, or configure a different port.