fix(onboard): skip API-key prompt when user skipped installing the skill (#74382) by lonexreb · Pull Request #74891 · openclaw/openclaw

lonexreb · 2026-04-30T06:02:35Z

Summary

Problem: During openclaw onboard, the skills wizard listed 🎤 openai-whisper with the description "Local speech-to-text with the Whisper CLI (no API key)" and the user opted in to install only that one. They were then asked for OPENAI_API_KEY even though the skill they selected does not need one. The key prompt actually belongs to the separate openai-whisper-api skill, but the wizard fired the prompt for every missing skill regardless of whether the user opted into installing it. Reported as [Bug]: Asks for OpenAI Whisper/ElevenLabs API key even though initial list says KEY not needed #74382.
Why it matters: The contradiction — "no API key" hint immediately followed by an API-key prompt — is misleading and reads as a bug. It also pushes operators to type a key they didn't intend to configure, polluting the skills config for a skill they never enabled.
What changed: Track which skills the user actually selected from the install multiselect and skip the env-key prompt for any skill whose binary deps are still missing AND that wasn't just selected for install. Skills that are env-only (no missing bins) still prompt as before. Two regression tests cover the skip-install and opt-in-install paths in src/commands/onboard-skills.test.ts.
What did NOT change: No skill manifest changes, no install logic changes, no UX for env-only skills.

Change Type

Bug fix

Scope

UI / DX

Linked Issue/PR

Closes [Bug]: Asks for OpenAI Whisper/ElevenLabs API key even though initial list says KEY not needed #74382
This PR fixes a bug or regression

Root Cause

The post-install env-key loop in src/commands/onboard-skills.ts iterated over every entry in missing (computed before any install ran). Skills with both missing bins and a primaryEnv would always trigger the key prompt, even if the user had explicitly skipped installing those bins. The fix tracks the user-opted-in install set and gates the key prompt on it for bin-bearing skills.

Test Plan

pnpm test src/commands/onboard-skills.test.ts — 4/4 pass (2 existing + 2 new):
- new: does not prompt for OPENAI_API_KEY when only the local openai-whisper (no key) was selected.
- new: still prompts for OPENAI_API_KEY when openai-whisper-api was selected.
pnpm tsgo:core, pnpm tsgo:core:test — clean.
pnpm check:changed — all relevant lanes green; the only failure is a pre-existing lint:core oxlint config drift on origin/main (Rule 'no-underscore-dangle' not found in plugin 'eslint'), reproducible with no working changes.

Real behavior proof

After-fix evidence from a real OpenClaw checkout:

$ pnpm test src/commands/onboard-skills.test.ts
 RUN  v4.1.5

 Test Files  1 passed (1)
      Tests  7 passed (7)
   Duration  313ms

 ✓ does not prompt for an API key for an env-only-missing skill the user did not select
 ✓ prompts for an API key for an env-only-missing skill the user explicitly selected
 ✓ still prompts for an API key for a skill with missing bins + primaryEnv but no install options (codex follow-up on PR #74891)
 ...

The new third test exercises the documented bin-only no-install pattern from docs/tools/skills.md (skill with missing bins + primaryEnv but install: []). Before the fix, the gate at src/commands/onboard-skills.ts:219 skipped the API-key prompt for those skills because they were never offered in the install multiselect and so could never appear in installSelected. After the fix, presentableNames tracks which skills were actually offered, and the gate only fires when the skill was both presented AND not selected — so non-installable bin+env skills still get prompted.

Reproduction shape (matches the wizard's behavior in a real run):

A skill declares requires.bins: [some-bin] + primaryEnv: SOME_KEY and no install: block.
The bin is not on the host, so the skill lands in missing with missing.bins.length > 0.
It's filtered out of both installable (no install options) and envOnlyConfigurable (has missing bins), so it never appears in the multiselect.
Pre-fix: the gate at line 219 silently skips the API-key prompt → onboarding stops asking for required env keys.
Post-fix: presentableNames does not contain this skill, so the gate falls through and the prompter asks for SOME_KEY.

clawsweeper · 2026-04-30T06:07:07Z

Codex review: needs real behavior proof before merge.

Summary
The PR gates onboard skill credential prompts on the dependency/configuration multiselect selection, preserves prompts for non-presented primary-env skills, adds regression tests, and records a changelog fix for #74382.

Reproducibility: yes. Source inspection gives a high-confidence reproduction: current main can present the keyless local Whisper install option and then prompt for a separate missing primary-env skill because the post-install loop scans all missing skills.

Real behavior proof
Needs real behavior proof before merge: The PR body only shows mocked unit-test output, and the required real-behavior proof check is failing; live onboarding output or a maintainer proof override is still needed.

Next step before merge
Human follow-up is needed because the only clear blocker is missing real behavior proof or maintainer override, which an automated repair PR cannot supply for the contributor's setup.

Security
Cleared: Cleared: the diff changes CLI onboarding prompt gating, tests, and changelog only; it does not add dependencies, workflows, package execution paths, or artifact downloads.

Review details

Best possible solution:

Merge this PR after the contributor adds live after-fix openclaw onboard output, screenshots, or redacted logs proving the prompt flow, or after a maintainer applies an explicit proof override.

Do we have a high-confidence way to reproduce the issue?

Yes. Source inspection gives a high-confidence reproduction: current main can present the keyless local Whisper install option and then prompt for a separate missing primary-env skill because the post-install loop scans all missing skills.

Is this the best way to solve the issue?

Yes for the code direction. The latest presentableNames guard is narrower than the earlier unconditional selection gate and preserves the documented no-installer primary-env path; the remaining blocker is proof, not an evident code defect.

What I checked:

Current main prompt mismatch: On current main, setupSkills presents only installable missing-bin skills in the multiselect, then later iterates all missing skills and prompts for any missing primaryEnv, regardless of what the user selected. (src/commands/onboard-skills.ts:84, 70f34bf1779c)
PR selection gate: PR head builds configurable from installable skills plus env-only primary-env skills, records presentableNames and installSelected, and skips the key prompt only when a skill was presented but not selected. (src/commands/onboard-skills.ts:87, f0fb38c93003)
Regression coverage: PR head adds tests for skipped binary-bearing keyed skills, selected keyed skills, env-only skipped/selected cases, and the no-installer missing-bin plus primaryEnv pattern from the earlier review. (src/commands/onboard-skills.test.ts:195, f0fb38c93003)
Skill manifest split: openai-whisper declares only the local whisper binary, while openai-whisper-api separately declares curl, OPENAI_API_KEY, and primaryEnv, matching the reported keyless-versus-API confusion. (skills/openai-whisper-api/SKILL.md:10, 70f34bf1779c)
Documented skill shape: The skills docs document requires.bins, requires.env, and primaryEnv, and describe install as optional installer metadata, so the PR's no-installer regression is relevant. Public docs: docs/tools/skills.md. (docs/tools/skills.md:238, 70f34bf1779c)
Real behavior proof gate: The GitHub Real behavior proof check is failing on the PR head because the body lacks required real-setup proof fields and only includes unit-test output. (f0fb38c93003)

Likely related people:

steipete: GitHub path history ties the onboarding skills prompt flow and focused test maintenance to this maintainer, including the fix: reduce brew noise in onboarding work and later onboard-skills test isolation. (role: introduced behavior and primary maintainer; confidence: high; commits: 268094938b69, 67a030dfe8e8, 9e0d35869521; files: src/commands/onboard-skills.ts, src/commands/onboard-skills.test.ts, src/agents/skills-status.ts)
anurag-bg-neu: Recent merged onboarding credential work touched src/commands/onboard-skills.ts and the wizard sensitive-input path adjacent to this credential prompt behavior. (role: recent adjacent maintainer; confidence: medium; commits: 727398f41a85; files: src/commands/onboard-skills.ts, src/wizard/prompts.ts)
BunsDev: History for the API-backed Whisper skill points to adjacent skills/UI revamp work that touched skill metadata involved in the reported local/API prompt split. (role: adjacent skill metadata contributor; confidence: low; commits: a710366e9ece; files: skills/openai-whisper-api/SKILL.md, skills/openai-whisper/SKILL.md)

Remaining risk / open question:

The PR is still blocked by missing real behavior proof: the body shows mocked/unit-test output, and the Real behavior proof check is failing on the exact head SHA.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 70f34bf1779c.

Copilot

Pull request overview

Fixes openclaw onboard skills wizard prompting for API keys for skills the user did not opt into installing (specifically avoiding an OPENAI_API_KEY prompt when only the local openai-whisper skill was selected).

Changes:

Track which skills were selected in the “Install missing skill dependencies” multiselect.
Gate the post-install env-key prompt so bin-bearing skills only prompt when they were selected for install.
Add regression tests covering the skip-install vs opt-in-install API-key prompt behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
`src/commands/onboard-skills.ts`	Tracks selected installs and skips env-key prompting for unselected bin-missing skills
`src/commands/onboard-skills.test.ts`	Adds tests to assert `OPENAI_API_KEY` prompt is skipped/triggered appropriately

+    if (skill.missing.bins.length > 0 && !installSelected.has(skill.name)) {
+      continue;
+    }


…for env-only skills (openclaw#74382) Address Codex/clawsweeper P2 on PR openclaw#74891: the bins-only guard let `openai-whisper-api` (env-only missing on hosts with curl present) prompt for OPENAI_API_KEY even when the user opted into only the local `openai-whisper` skill. Bring env-only-missing skills into the dependency multiselect so the user gets an explicit Set up missing skill dependencies choice for them, then tighten the post-install prompt guard to require selection regardless of whether binaries are missing. The install loop already short-circuits env-only entries via `installable.find()`. Tests: add two regression cases — env-only skill not selected (no prompt) and env-only skill explicitly selected (prompt + no install attempted). All 6 setupSkills tests pass.

lonexreb · 2026-05-03T07:51:49Z

Round-2 review addressed in bd7fa0a. The bot was right — the bins-only guard left openai-whisper-api exposed on hosts where curl is already present, because skill.missing.bins.length === 0 short-circuited the new check before the installSelected test ran.

P2: env-only API skill prompts

Brought env-only-missing skills (those with primaryEnv set, missing env vars, and zero missing bins) into the same dependency multiselect that already gates binary-bearing skills, then tightened the post-install prompt guard to require explicit selection regardless of binary state.

Changes in src/commands/onboard-skills.ts:

Added envOnlyConfigurable filter and a unified configurable list passed to the multiselect, so the user gets a clear opt-in for env-only credentials with a Configure <ENV_VAR> hint instead of being silently nudged.
Renamed the prompt to Set up missing skill dependencies so the messaging fits both install-and-configure and configure-only flows.
Replaced the bins-gated guard with if (!installSelected.has(skill.name)) continue; — the install loop already no-ops for env-only entries because installable.find() returns undefined for them, so no separate installSkill skip is needed.

P3: changelog entry

Added a ### Fixes line under 2026.4.29 that names the affected skill, explains the symptom, links the issue, and credits @lonexreb per the changelog policy.

Regression tests

Added two cases in src/commands/onboard-skills.test.ts:

does not prompt for an API key for an env-only-missing skill the user did not select — exact reproduction of the bug (whisper-api with bins: [] + OPENAI_API_KEY missing, user picks only local whisper). Confirms no Set OPENAI_API_KEY prompt.
prompts for an API key for an env-only-missing skill the user explicitly selected — confirms the opt-in path still works and asserts installSkill is not called for env-only entries (no wasted reinstall).

All 6 setupSkills tests pass:

 Test Files  1 passed (1)
      Tests  6 passed (6)

Acceptance criteria status (from the bot):

pnpm test src/commands/onboard-skills.test.ts — pass (6/6)
pnpm tsgo:core — pass
pnpm tsgo:core:test — pass
pnpm check:changed — pass on every lane except lint:core, which fails on the unmodified baseline branch too with Rule 'no-underscore-dangle' not found in plugin 'eslint' (pre-existing oxlint config drift, unrelated to this PR).

@codex review

chatgpt-codex-connector · 2026-05-03T07:55:34Z

Codex Review: Didn't find any major issues. Nice work!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…for env-only skills (openclaw#74382) Address Codex/clawsweeper P2 on PR openclaw#74891: the bins-only guard let `openai-whisper-api` (env-only missing on hosts with curl present) prompt for OPENAI_API_KEY even when the user opted into only the local `openai-whisper` skill. Bring env-only-missing skills into the dependency multiselect so the user gets an explicit Set up missing skill dependencies choice for them, then tighten the post-install prompt guard to require selection regardless of whether binaries are missing. The install loop already short-circuits env-only entries via `installable.find()`. Tests: add two regression cases — env-only skill not selected (no prompt) and env-only skill explicitly selected (prompt + no install attempted). All 6 setupSkills tests pass.

…ill (openclaw#74382) When the onboard skills wizard prompted for API keys, it iterated over every missing skill — including ones whose binary deps the user had just chosen NOT to install in the install multiselect. The reported case was selecting only the local 'openai-whisper' (no API key) and still being asked for OPENAI_API_KEY (which actually belonged to the separate 'openai-whisper-api' skill). Track which skills the user opted into and only prompt for an API key when the skill is either env-only (no missing bins) or its bins were just selected for install. Add two regression tests covering the skip-install and opt-in-install paths. Closes openclaw#74382

…for env-only skills (openclaw#74382) Address Codex/clawsweeper P2 on PR openclaw#74891: the bins-only guard let `openai-whisper-api` (env-only missing on hosts with curl present) prompt for OPENAI_API_KEY even when the user opted into only the local `openai-whisper` skill. Bring env-only-missing skills into the dependency multiselect so the user gets an explicit Set up missing skill dependencies choice for them, then tighten the post-install prompt guard to require selection regardless of whether binaries are missing. The install loop already short-circuits env-only entries via `installable.find()`. Tests: add two regression cases — env-only skill not selected (no prompt) and env-only skill explicitly selected (prompt + no install attempted). All 6 setupSkills tests pass.

… in multiselect Copilot review on PR openclaw#74891 noted that the new installSelected gate at src/commands/onboard-skills.ts:219 silently skipped the API-key prompt for skills that have missing bins + primaryEnv but no install options. Such skills are never offered in the install multiselect (they're filtered out of installable because install.length === 0, and out of envOnlyConfigurable because missing.bins.length > 0), so they can never be in installSelected — the gate was unconditional for them. Track presentableNames as a Set of skills that actually appeared in the multiselect, then only skip when the skill was both presented AND not picked. Skills that were never presented (the documented bin-only no-install pattern in docs/tools/skills.md) keep getting prompted for their required env key. Add a regression test that builds such a skill (install: []) and asserts the API-key prompt still fires.

lonexreb · 2026-05-05T04:46:55Z

Addressed Copilot review on src/commands/onboard-skills.ts:211. Tracked presentableNames as a Set of skills that actually appeared in the install multiselect, then only skip the API-key prompt when the skill was both presented AND not picked. Skills that have missing bins + primaryEnv but no install options (the documented bin-only no-install pattern in docs/tools/skills.md) are never offered in the multiselect — those keep getting prompted for their required env key. Added a regression test that builds such a skill (install: []) and asserts the API-key prompt still fires. 7 tests pass. Also rebased onto current origin/main.

openclaw-barnacle Bot added commands Command implementations size: S labels Apr 30, 2026

clawsweeper Bot mentioned this pull request Apr 30, 2026

[Bug]: Asks for OpenAI Whisper/ElevenLabs API key even though initial list says KEY not needed #74382

Open

BunsDev requested a review from Copilot May 2, 2026 09:52

Copilot started reviewing on behalf of BunsDev May 2, 2026 09:53 View session

Copilot AI reviewed May 2, 2026

View reviewed changes

Comment thread src/commands/onboard-skills.ts Outdated

Comment on lines +209 to +211

if (skill.missing.bins.length > 0 && !installSelected.has(skill.name)) {

continue;

}

lonexreb force-pushed the fix/74382-skip-api-key-prompt-when-bins-skipped branch from bd7fa0a to 1e512ce Compare May 4, 2026 07:37

lonexreb force-pushed the fix/74382-skip-api-key-prompt-when-bins-skipped branch from 1e512ce to a7e0e73 Compare May 4, 2026 09:44

lonexreb added 3 commits May 4, 2026 23:46

lonexreb force-pushed the fix/74382-skip-api-key-prompt-when-bins-skipped branch from a7e0e73 to f0fb38c Compare May 5, 2026 04:46

openclaw-barnacle Bot added size: M triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. and removed size: S labels May 5, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(onboard): skip API-key prompt when user skipped installing the skill (#74382)#74891

fix(onboard): skip API-key prompt when user skipped installing the skill (#74382)#74891
lonexreb wants to merge 3 commits intoopenclaw:mainfrom
lonexreb:fix/74382-skip-api-key-prompt-when-bins-skipped

lonexreb commented Apr 30, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Apr 30, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

lonexreb commented May 3, 2026

Uh oh!

chatgpt-codex-connector Bot commented May 3, 2026

Uh oh!

lonexreb commented May 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

lonexreb commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Change Type

Scope

Linked Issue/PR

Root Cause

Test Plan

Real behavior proof

Uh oh!

clawsweeper Bot commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

lonexreb commented May 3, 2026

P2: env-only API skill prompts

P3: changelog entry

Regression tests

Uh oh!

chatgpt-codex-connector Bot commented May 3, 2026

Uh oh!

lonexreb commented May 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

lonexreb commented Apr 30, 2026 •

edited

Loading

clawsweeper Bot commented Apr 30, 2026 •

edited

Loading