Run initial NanoClaw setup. Use when user wants to install dependencies, authenticate messaging channels, register their main channel, or start the background services. Triggers on "setup", "install", "configure nanoclaw", or first-time setup requests.
Run setup steps automatically. Only pause when user action is required (channel authentication, configuration choices). Setup uses bash setup.sh for bootstrap, then npx tsx setup/index.ts --step <name> for all other steps. Steps emit structured status blocks to stdout. Verbose logs go to logs/setup.log.
Principle: When something is broken or missing, fix it. Don't tell the user to go fix it themselves unless it genuinely requires their manual action (e.g. authenticating a channel, pasting a secret token). If a dependency is missing, install it. If a service won't start, diagnose and repair. Ask the user for permission when needed, then do the work.
UX Note: Use AskUserQuestion for multiple-choice questions only (e.g. "Docker or Apple Container?", "which channels?"). Do NOT use it when free-text input is needed (e.g. phone numbers, tokens, paths) — just ask the question in plain text and wait for the user's reply.
Check the git remote configuration to ensure the user has a fork and upstream is configured.
Run:
git remote -vCase A — origin points to qwibitai/nanoclaw (user cloned directly):
The user cloned instead of forking. AskUserQuestion: "You cloned NanoClaw directly. We recommend forking so you can push your customizations. Would you like to set up a fork?"
If fork: instruct the user to fork qwibitai/nanoclaw on GitHub (they need to do this in their browser), then ask them for their GitHub username. Run:
git remote rename origin upstream
git remote add origin https://github.com/<their-username>/nanoclaw.git
git push --force origin main
Verify with git remote -v.
If continue without fork: add upstream so they can still pull updates:
git remote add upstream https://github.com/qwibitai/nanoclaw.git
Case B — origin points to user's fork, no upstream remote:
Add upstream:
git remote add upstream https://github.com/qwibitai/nanoclaw.git
Case C — both origin (user's fork) and upstream (qwibitai) exist:
Already configured. Continue.
Verify: git remote -v should show origin → user's repo, upstream → qwibitai/nanoclaw.git.
Run bash setup.sh and parse the status block.
AskUserQuestion: Would you like me to install Node.js 22? If confirmed:
brew install node@22 (if brew available) or install nvm then nvm install 22curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash - && sudo apt-get install -y nodejs, or nvmbash setup.shlogs/setup.log. Try: delete node_modules, re-run bash setup.sh. If native module build fails, install build tools (xcode-select --install on macOS, build-essential on Linux), then retry.Run npx tsx setup/index.ts --step environment and parse the status block.
Check for an existing OpenClaw installation:
ls -d ~/.openclaw 2>/dev/null || ls -d ~/.clawdbot 2>/dev/null
If a directory is found, AskUserQuestion:
/migrate-from-openclaw anytime later."If "Migrate now": invoke /migrate-from-openclaw, then return here and continue at step 2a (Timezone).
Run npx tsx setup/index.ts --step timezone and parse the status block.
IST-2). AskUserQuestion: "What is your timezone?" with common options (America/New_York, Europe/London, Asia/Jerusalem, Asia/Tokyo) and an "Other" escape. Then re-run: npx tsx setup/index.ts --step timezone -- --tz <their-answer>.Check the preflight results for APPLE_CONTAINER and DOCKER, and the PLATFORM from step 1.
/convert-to-apple-container now, then skip to 3c.open -a Docker (macOS) or sudo systemctl start docker (Linux). Wait 15s, re-check with docker info.AskUserQuestion: Docker is required for running agents. Would you like me to install it? If confirmed:
brew install --cask docker, then open -a Docker and wait for it to start. If brew not available, direct to Docker Desktop download at https://docker.com/products/docker-desktopcurl -fsSL https://get.docker.com | sh && sudo usermod -aG docker $USER. Note: user may need to log out/in for group membership.If the chosen runtime is Apple Container, you MUST check whether the source code has already been converted from Docker to Apple Container. Do NOT skip this step. Run:
grep -q "CONTAINER_RUNTIME_BIN = 'container'" src/container-runtime.ts && echo "ALREADY_CONVERTED" || echo "NEEDS_CONVERSION"
If NEEDS_CONVERSION, the source code still uses Docker as the runtime. You MUST run the /convert-to-apple-container skill NOW, before proceeding to the build step.
If ALREADY_CONVERTED, the code already uses Apple Container. Continue to 3c.
If the chosen runtime is Docker, no conversion is needed. Continue to 3c.
Run npx tsx setup/index.ts --step container -- --runtime <chosen> and parse the status block.
If BUILD_OK=false: Read logs/setup.log tail for the build error.
docker builder prune -f (Docker) or container builder stop && container builder rm && container builder start (Apple Container). Retry.If TEST_OK=false but BUILD_OK=true: The image built but won't run. Check logs — common cause is runtime not fully started. Wait a moment and retry the test.
The credential system depends on the container runtime chosen in step 3.
Install OneCLI and its CLI tool:
curl -fsSL onecli.sh/install | sh
curl -fsSL onecli.sh/cli/install | sh
Verify both installed: onecli version. If the command is not found, the CLI was likely installed to ~/.local/bin/. Add it to PATH for the current session and persist it:
export PATH="$HOME/.local/bin:$PATH"
# Persist for future sessions (append to shell profile if not already present)
grep -q '.local/bin' ~/.bashrc 2>/dev/null || echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc
grep -q '.local/bin' ~/.zshrc 2>/dev/null || echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc
Then re-verify with onecli version.
Point the CLI at the local OneCLI instance, the ONECLI_URL was output from the install script above:
onecli config set api-host ${ONECLI_URL}
Ensure .env has the OneCLI URL (create the file if it doesn't exist):
grep -q 'ONECLI_URL' .env 2>/dev/null || echo 'ONECLI_URL=${ONECLI_URL}' >> .env
Check if a secret already exists:
onecli secrets list
If an Anthropic secret is listed, confirm with user: keep or reconfigure? If keeping, skip to step 5.
AskUserQuestion: Do you want to use your Claude subscription (Pro/Max) or an Anthropic API key?
claude setup-token in another terminal to get your token."Tell the user:
Run
claude setup-tokenin another terminal. It will output a token — copy it but don't paste it here.
Then stop and wait for the user to confirm they have the token. Do NOT proceed until they respond.
Once they confirm, they register it with OneCLI. AskUserQuestion with two options:
onecli secrets create --name Anthropic --type anthropic --value YOUR_TOKEN --host-pattern api.anthropic.com"Tell the user to get an API key from https://console.anthropic.com/settings/keys if they don't have one.
Then AskUserQuestion with two options:
onecli secrets create --name Anthropic --type anthropic --value YOUR_KEY --host-pattern api.anthropic.com"Ask them to let you know when done.
If the user's response happens to contain a token or key (starts with sk-ant-): handle it gracefully — run the onecli secrets create command with that value on their behalf.
After user confirms: verify with onecli secrets list that an Anthropic secret exists. If not, ask again.
Apple Container is not compatible with OneCLI. The credential proxy code is already included in the apple-container branch — do NOT invoke /use-native-credential-proxy (it would conflict with already-applied code).
Instead, just configure the credentials in .env:
AskUserQuestion: Do you want to use your Claude subscription (Pro/Max) or an Anthropic API key?
claude setup-token in another terminal to get your token."For subscription: tell the user to run claude setup-token in another terminal. Stop and wait for the user to confirm they have completed this step successfully before proceeding.
Once confirmed, add the token to .env:
echo 'CLAUDE_CODE_OAUTH_TOKEN=<their-token>' >> .env
For API key: add to .env:
echo 'ANTHROPIC_API_KEY=<their-key>' >> .env
Verify the proxy starts: npm run dev should show "Credential proxy listening" in the logs.
AskUserQuestion (multiSelect): Which messaging channels do you want to enable?
Delegate to each selected channel's own skill. Each channel skill handles its own code installation, authentication, registration, and JID resolution. This avoids duplicating channel-specific logic and ensures JIDs are always correct.
For each selected channel, invoke its skill:
/add-whatsapp/add-telegram/add-slack/add-discordEach skill will:
git merge of the skill branch).envAfter all channel skills complete, install dependencies and rebuild — channel merges may introduce new packages:
npm install && npm run build
If the build fails, read the error output and fix it (usually a missing dependency). Then continue to step 6.
AskUserQuestion: Agent access to external directories?
No: npx tsx setup/index.ts --step mounts -- --empty
Yes: Collect paths/permissions. npx tsx setup/index.ts --step mounts -- --json '{"allowedRoots":[...],"blockedPatterns":[],"nonMainReadOnly":true}'
If service already running: unload first.
launchctl unload ~/Library/LaunchAgents/com.nanoclaw.plistsystemctl --user stop nanoclaw (or systemctl stop nanoclaw if root)Run npx tsx setup/index.ts --step service and parse the status block.
If FALLBACK=wsl_no_systemd: WSL without systemd detected. Tell user they can either enable systemd in WSL (echo -e "[boot]\nsystemd=true" | sudo tee /etc/wsl.conf then restart WSL) or use the generated start-nanoclaw.sh wrapper.
If DOCKER_GROUP_STALE=true: The user was added to the docker group after their session started — the systemd service can't reach the Docker socket. Ask user to run these two commands:
sudo setfacl -m u:$(whoami):rw /var/run/docker.socksudo mkdir -p /etc/systemd/system/docker.service.d
sudo tee /etc/systemd/system/docker.service.d/socket-acl.conf << 'EOF'
[Service]
ExecStartPost=/usr/bin/setfacl -m u:USERNAME:rw /var/run/docker.sock
EOF
sudo systemctl daemon-reload
Replace USERNAME with the actual username (from whoami). Run the two sudo commands separately — the tee heredoc first, then daemon-reload. After user confirms setfacl ran, re-run the service step.
If SERVICE_LOADED=false:
logs/setup.log for the error.launchctl list | grep nanoclaw. If PID=- and status non-zero, read logs/nanoclaw.error.log.systemctl --user status nanoclaw.Run npx tsx setup/index.ts --step verify and parse the status block.
If STATUS=failed, fix each:
npm run build, then restart: launchctl kickstart -k gui/$(id -u)/com.nanoclaw (macOS) or systemctl --user restart nanoclaw (Linux) or bash start-nanoclaw.sh (WSL nohup)onecli secrets list; Apple Container: check .env for credentials)not_found for any channel → re-invoke that channel's skill (e.g. /add-telegram)npx tsx setup/index.ts --step mounts -- --emptyTell user to test: send a message in their registered chat. Show: tail -f logs/nanoclaw.log
Service not starting: Check logs/nanoclaw.error.log. Common: wrong Node path (re-run step 7), credential system not running (Docker: check curl ${ONECLI_URL}/api/health; Apple Container: check .env credentials), missing channel credentials (re-invoke channel skill).
Container agent fails ("Claude Code process exited with code 1"): Ensure the container runtime is running — open -a Docker (macOS Docker), container system start (Apple Container), or sudo systemctl start docker (Linux). Check container logs in groups/main/logs/container-*.log.
No response to messages: Check trigger pattern. Main channel doesn't need prefix. Check DB: npx tsx setup/index.ts --step verify. Check logs/nanoclaw.log.
Channel not connecting: Verify the channel's credentials are set in .env. Channels auto-enable when their credentials are present. For WhatsApp: check store/auth/creds.json exists. For token-based channels: check token values in .env. Restart the service after any .env change.
Unload service: macOS: launchctl unload ~/Library/LaunchAgents/com.nanoclaw.plist | Linux: systemctl --user stop nanoclaw
.claude/skills/setup/diagnostics.md.