fix(onboard): gate post-install API-key prompt on explicit selection for env-only skills (#74382)

lonexreb · lonexreb · commit bd7fa0aec460 · 2026-05-03T02:51:12.000-05:00
Address Codex/clawsweeper P2 on PR #74891: the bins-only guard let `openai-whisper-api` (env-only missing on hosts with curl present) prompt for OPENAI_API_KEY even when the user opted into only the local `openai-whisper` skill. Bring env-only-missing skills into the dependency multiselect so the user gets an explicit Set up missing skill dependencies choice for them, then tighten the post-install prompt guard to require selection regardless of whether binaries are missing. The install loop already short-circuits env-only entries via `installable.find()`. Tests: add two regression cases — env-only skill not selected (no prompt) and env-only skill explicitly selected (prompt + no install attempted). All 6 setupSkills tests pass.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -42,6 +42,7 @@ Docs: https://docs.openclaw.ai
 
 - Media: treat legacy Word/OLE attachments with `application/msword` or `application/x-cfb` MIME as binary so printable-looking `.doc` files are not embedded into prompts as text. Fixes #54176; carries forward #54380. Thanks @andyliu.
 - Config: accept documented `browser.tabCleanup` keys in strict root config validation, so configured tab cleanup no longer fails before runtime reads it. Fixes #74577. Thanks @lonexreb and @ezdlp.
+- Onboard/skills: gate the post-install API-key prompt on the user's explicit dependency-multiselect choice for both binary-bearing and env-only skills, so a user who selects only local `openai-whisper` is no longer asked for `OPENAI_API_KEY` for the unselected `openai-whisper-api` skill on systems where `curl` is already present. Fixes #74382. Thanks @lonexreb.
 - Cron: validate disabled job schedule edits before persisting updates, so invalid cron changes no longer partially mutate stored jobs. Fixes #74459. Thanks @yfge.
 - Channels/status: keep Telegram, Slack, and Google Chat read-only allowlist/default-target accessors on config-only paths, so status and channel summaries do not resolve SecretRef-backed runtime credentials. Thanks @eusine.
 - Active Memory: clarify the deprecated `modelFallbackPolicy` warning and config help so `modelFallback` is described as a chain-resolution last resort, not runtime failover. (#74602) Thanks @jeffrey701.
diff --git a/src/commands/onboard-skills.test.ts b/src/commands/onboard-skills.test.ts
@@ -249,4 +249,65 @@ describe("setupSkills", () => {
     const askedForApiKey = confirmCalls.some(([arg]) => arg.message.includes("Set OPENAI_API_KEY"));
     expect(askedForApiKey).toBe(true);
   });
+
+  it("does not prompt for an API key for an env-only-missing skill the user did not select", async () => {
+    if (process.platform === "win32") {
+      return;
+    }
+
+    mockMissingBrewStatus([
+      createBundledSkill({
+        name: "openai-whisper",
+        description: "Local whisper CLI (no API key)",
+        bins: ["whisper"],
+        installLabel: "Install OpenAI Whisper (brew)",
+      }),
+      createBundledSkill({
+        name: "openai-whisper-api",
+        description: "OpenAI Whisper API (curl already present)",
+        bins: [],
+        installLabel: "Install curl (brew)",
+        primaryEnv: "OPENAI_API_KEY",
+        envMissing: ["OPENAI_API_KEY"],
+      }),
+    ]);
+
+    const { prompter } = createPrompter({ multiselect: ["openai-whisper"] });
+    await setupSkills({} as OpenClawConfig, "/tmp/ws", runtime, prompter);
+
+    const confirmCalls = (
+      prompter.confirm as unknown as { mock: { calls: Array<[{ message: string }]> } }
+    ).mock.calls;
+    const askedForApiKey = confirmCalls.some(([arg]) => arg.message.includes("Set OPENAI_API_KEY"));
+    expect(askedForApiKey).toBe(false);
+  });
+
+  it("prompts for an API key for an env-only-missing skill the user explicitly selected", async () => {
+    if (process.platform === "win32") {
+      return;
+    }
+
+    mockMissingBrewStatus([
+      createBundledSkill({
+        name: "openai-whisper-api",
+        description: "OpenAI Whisper API (curl already present)",
+        bins: [],
+        installLabel: "Install curl (brew)",
+        primaryEnv: "OPENAI_API_KEY",
+        envMissing: ["OPENAI_API_KEY"],
+      }),
+    ]);
+
+    const { prompter } = createPrompter({ multiselect: ["openai-whisper-api"] });
+    mocks.installSkill.mockClear();
+    await setupSkills({} as OpenClawConfig, "/tmp/ws", runtime, prompter);
+
+    const confirmCalls = (
+      prompter.confirm as unknown as { mock: { calls: Array<[{ message: string }]> } }
+    ).mock.calls;
+    const askedForApiKey = confirmCalls.some(([arg]) => arg.message.includes("Set OPENAI_API_KEY"));
+    expect(askedForApiKey).toBe(true);
+    // Install loop must not run installSkill for env-only entries.
+    expect(mocks.installSkill).not.toHaveBeenCalled();
+  });
 });
diff --git a/src/commands/onboard-skills.ts b/src/commands/onboard-skills.ts
@@ -84,22 +84,32 @@ export async function setupSkills(
   const installable = missing.filter(
     (skill) => skill.install.length > 0 && skill.missing.bins.length > 0,
   );
+  const envOnlyConfigurable = missing.filter(
+    (skill) =>
+      Boolean(skill.primaryEnv) && skill.missing.env.length > 0 && skill.missing.bins.length === 0,
+  );
+  const configurable = [...installable, ...envOnlyConfigurable];
   let next: OpenClawConfig = cfg;
   const installSelected = new Set<string>();
-  if (installable.length > 0) {
+  if (configurable.length > 0) {
     const toInstall = await prompter.multiselect({
-      message: "Install missing skill dependencies",
+      message: "Set up missing skill dependencies",
       options: [
         {
           value: "__skip__",
           label: "Skip for now",
-          hint: "Continue without installing dependencies",
+          hint: "Continue without configuring dependencies",
         },
-        ...installable.map((skill) => ({
-          value: skill.name,
-          label: `${skill.emoji ?? "🧩"} ${skill.name}`,
-          hint: formatSkillHint(skill),
-        })),
+        ...configurable.map((skill) => {
+          const isEnvOnly = skill.missing.bins.length === 0;
+          return {
+            value: skill.name,
+            label: `${skill.emoji ?? "🧩"} ${skill.name}`,
+            hint: isEnvOnly
+              ? `Configure ${skill.primaryEnv ?? "credentials"}`
+              : formatSkillHint(skill),
+          };
+        }),
       ],
     });
 
@@ -206,7 +216,7 @@ export async function setupSkills(
     if (!skill.primaryEnv || skill.missing.env.length === 0) {
       continue;
     }
-    if (skill.missing.bins.length > 0 && !installSelected.has(skill.name)) {
+    if (!installSelected.has(skill.name)) {
       continue;
     }
     const wantsKey = await prompter.confirm({
