Streamline OpenClaw onboarding by fuller-stack-dev · Pull Request #98218 · openclaw/openclaw

fuller-stack-dev · 2026-06-30T16:43:05Z

Summary

Make bare openclaw launch onboarding for fresh config and launch the TUI for configured installs, using a reachable gateway when available and falling back to local mode.
Streamline onboarding reruns by preserving existing config/model choices, skipping hooks and skill API-key prompts, auto-installing trusted bundled skill dependencies, and defaulting to simpler channel/search choices.
Add compact arrow-key onboarding navigation with replay safety boundaries, current-provider keep options, visible option notes, container-aware session gateway startup, and TUI repaint/exit fixes.
Make openclaw setup a full onboarding alias, including non-interactive auth/provider flags and migration import options.

Verification

node scripts/run-vitest.mjs src/cli/program/register.setup.test.ts src/cli/program/register.onboard.test.ts src/wizard/setup.migration-import.test.ts src/wizard/clack-prompter.test.ts src/wizard/navigation-prompter.test.ts src/cli/run-main.exit.test.ts src/wizard/setup.finalize.test.ts src/wizard/clack-navigation-prompts.test.ts src/wizard/setup.test.ts src/commands/onboard-skills.test.ts
git diff --check && git diff --name-only upstream/main..HEAD | xargs pnpm exec oxfmt --check --threads=1
node scripts/run-tsgo.mjs -p tsconfig.core.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core.tsbuildinfo
node scripts/run-tsgo.mjs -p test/tsconfig/tsconfig.core.test.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core-test.tsbuildinfo
$AUTOREVIEW --mode branch --base upstream/main
docker build -t openclaw:onboarding-main-revamp .
docker run --rm openclaw:onboarding-main-revamp openclaw --version -> OpenClaw 2026.6.10

clawsweeper · 2026-06-30T16:45:55Z

Codex review: found issues before merge. Reviewed June 30, 2026, 2:17 PM ET / 18:17 UTC.

Summary
The PR changes first-run/setup routing, onboarding prompt navigation, setup rerun defaults, skill dependency installation, gateway/TUI launch behavior, migration-provider discovery, and related docs/tests.

PR surface: Source +2275, Tests +2011, Docs +1, Other +3. Total +4290 across 55 files.

Reproducibility: yes. for the PR-introduced issues: source comparison shows the setup routing change, the removed skill install selection, and the new config key without matching baseline coverage. I did not run the changed CLI flows because this review is read-only.

Review metrics: 3 noteworthy metrics.

Config Surface: 1 added. wizard.securityAcknowledgedAt is a new persisted config key, so generated schema/docs baselines and upgrade behavior need maintainer attention before merge.
CLI Defaults: 2 changed. Bare openclaw and openclaw setup routing changes affect first-run, source-checkout, and scripted setup workflows.
Install Consent: 1 explicit selection path removed. The previous multiselect/skip prompt protected users before dependency installers that can run package managers or downloads.

Stored data model
Persistent data-model change detected: migration/backfill/repair: src/cli/program/register.onboard.ts, migration/backfill/repair: src/plugins/migration-provider-runtime.ts, migration/backfill/repair: src/wizard/i18n/locales/en.ts, migration/backfill/repair: src/wizard/setup.migration-import.test.ts, migration/backfill/repair: src/wizard/setup.ts, serialized state: src/wizard/navigation-prompter.ts, and 1 more. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🌊 off-meta tidepool
Patch quality: 🧂 unranked krab
Result: blocked by patch quality or review findings.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

Restore an explicit consent boundary before bundled skill dependency installers run.
Preserve or fully update the source-checkout baseline setup workflow before changing the public setup default.
Refresh config help quality coverage and generated baseline hashes for wizard.securityAcknowledgedAt.

Mantis proof suggestion
The PR changes visible CLI onboarding, setup, and TUI launch behavior that would benefit from terminal proof after blockers are resolved. A maintainer can ask Mantis to capture proof by posting this exact PR comment:

@openclaw-mantis visual task: record fresh openclaw onboarding, setup --baseline, and configured bare openclaw TUI launch paths, with private tokens and local addresses redacted.

Risk before merge

[P1] Changing plain openclaw setup from baseline initialization to full onboarding can break documented source-checkout and scripted setup workflows unless the full public contract moves with it.
[P1] Automatic bundled skill dependency installation removes the prior explicit selection/skip boundary before package-manager and download-capable installers run.
[P1] The new wizard.securityAcknowledgedAt persisted config key is not fully reflected in config baseline/quality coverage at PR head.
[P1] The broader onboarding PR at feat(onboard): streamline setup with agent-assisted configuration #93265 overlaps this direction but remains open and conflicting, so maintainers need to choose sequencing before either branch becomes canonical.

Maintainer options:

Repair Consent, Setup Contract, And Baselines (recommended)
Restore an explicit user selection or confirmation before bundled skill installers run, align the setup baseline/onboarding CLI and docs contract, and refresh generated config baseline coverage before another maintainer pass.
Accept The New Defaults Deliberately
Maintainers can intentionally accept setup-as-onboarding and automatic trusted bundled installs, but that should be a visible product/security decision with upgrade notes and real flow proof.
Pause For Onboarding Consolidation
If the broader onboarding branch owns the long-term design, pause this PR and port only unique TUI, prompt, or migration fixes that still apply.

Next step before merge

[P2] Protected maintainer PR with product/security-sensitive onboarding defaults needs human sequencing rather than close, automerge, or automated repair.

Security
Needs attention: Automatic bundled dependency installation changes a local code-execution consent boundary and needs explicit consent restoration or maintainer security approval.

Review findings

[P1] Restore explicit consent before bundled skill installs — src/commands/onboard-skills.ts:158
[P1] Align setup alias with source-checkout workflows — src/cli/program/register.setup.ts:112-121
[P2] Refresh config baseline coverage for the wizard key — src/config/zod-schema.ts:584

Review details

Best possible solution:

Land only after maintainers confirm the setup/onboarding direction, preserve or fully migrate the baseline setup contract, restore explicit installer consent or record a security decision, refresh config baselines, and sequence this branch against the broader onboarding PR.

Do we have a high-confidence way to reproduce the issue?

Yes for the PR-introduced issues: source comparison shows the setup routing change, the removed skill install selection, and the new config key without matching baseline coverage. I did not run the changed CLI flows because this review is read-only.

Is this the best way to solve the issue?

No. The direction may be useful, but this is not the best merge shape until setup compatibility, installer consent, config baseline coverage, and sequencing with the broader onboarding PR are resolved.

Full review comments:

[P1] Restore explicit consent before bundled skill installs — src/commands/onboard-skills.ts:158
The PR now treats every trusted bundled installable skill as selected after an informational note, then calls installSkill. Those recipes can run package managers or downloads, so keep an explicit selection/skip or confirmation boundary unless maintainers make a visible security decision.
Confidence: 0.9
[P1] Align setup alias with source-checkout workflows — src/cli/program/register.setup.ts:112-121
All non---baseline openclaw setup calls now run onboarding, but README.md and docs/start/setup.md at this head still document pnpm openclaw setup as the baseline initializer before gateway:watch. Preserve the baseline default for those workflows or update the full public scripted surface before changing this CLI contract.
Confidence: 0.88
[P2] Refresh config baseline coverage for the wizard key — src/config/zod-schema.ts:584
wizard.securityAcknowledgedAt is added to the schema/help/docs surface, but the config help quality expected-key list and generated config-baseline hash are not updated. Refresh the config docs/schema baseline coverage so checks and docs match the new persisted key.
Confidence: 0.84

Overall correctness: patch is incorrect
Overall confidence: 0.88

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 3f147ae5cacc.

Label changes

Label justifications:

P2: This is broad onboarding/CLI improvement work with concrete merge blockers, but it is not an active shipped outage.
merge-risk: 🚨 compatibility: The PR changes setup defaults, docs contract, and config surface in ways that can affect existing scripts, source-checkout workflows, and upgrades.
merge-risk: 🚨 auth-provider: The PR changes setup auth/provider flags, keep-current model behavior, migration import options, and credential-adjacent onboarding paths.
merge-risk: 🚨 security-boundary: The PR changes the user-consent boundary before dependency-installing bundled skill recipes.
rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🌊 off-meta tidepool and patch quality is 🧂 unranked krab.
status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: The external-contributor proof gate does not apply because live GitHub marks the author as MEMBER and the PR carries the protected maintainer label; the supplied tests and Docker version check remain supplemental.

Evidence reviewed

PR surface:

Source +2275, Tests +2011, Docs +1, Other +3. Total +4290 across 55 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	30	3146	871	+2275
Tests	17	2086	75	+2011
Docs	7	19	18	+1
Config	0	0	0	0
Generated	0	0	0	0
Other	1	3	0	+3
Total	55	5254	964	+4290

Security concerns:

[high] Automatic dependency installs lose explicit selection — src/commands/onboard-skills.ts:158
The PR auto-selects trusted bundled skills and invokes installers that can run package managers, Go/uv installers, or downloads; this should remain behind explicit consent or a maintainer-approved product/security decision.
Confidence: 0.9

What I checked:

Repository policy read: Root AGENTS.md and the relevant docs, scripts, plugins, gateway, TUI, and test scoped guides were read; setup/default/config/provider/security-boundary changes are compatibility-sensitive under the root review policy. (AGENTS.md:1, 3f147ae5cacc)
Live PR state: Live GitHub shows this PR is open, non-draft, mergeable but unstable, has the protected maintainer label, and currently points at head 0a6e90d. (0a6e90d8f651)
Current setup contract: Current main keeps plain openclaw setup on baseline config/workspace creation and routes to onboarding only for --wizard or explicit onboarding flags. (src/cli/program/register.setup.ts:55, 3f147ae5cacc)
PR setup default change: At PR head, only --baseline runs the baseline setup command; all other setup invocations fall through to setupWizardCommand. (src/cli/program/register.setup.ts:112, 0a6e90d8f651)
Source-checkout docs still depend on setup baseline: At PR head, README source checkout instructions still use pnpm openclaw setup as the first-run config/workspace initializer before pnpm gateway:watch. (README.md:240, 0a6e90d8f651)
Current skill install consent: Current main asks whether to configure skills and then presents a multiselect with a skip option before dependency installation. (src/commands/onboard-skills.ts:86, 3f147ae5cacc)

Likely related people:

steipete: Peter Steinberger authored multiple setup wizard/config baseline commits that define the current setup and generated-config surfaces this PR changes. (role: historical setup and config-baseline contributor; confidence: high; commits: 5c120cb36ca3, 656848dcd7d0, 7611d41136a1; files: src/cli/program/register.setup.ts, src/wizard/setup.ts, docs/.generated/config-baseline.sha256)
vincentkoc: Vincent Koc has recent history on wizard setup cold paths and config doc baseline separation that intersects the new persisted wizard key and setup behavior. (role: recent config and wizard contributor; confidence: medium; commits: bb1b30d32979, f5c3b409ea74, 3a72d2d6deb6; files: src/wizard/setup.ts, src/config/doc-baseline.ts, src/config/schema.help.quality.test.ts)
RomneyDa: Dallin Romney's merged PR chore(ci): dedupe QA live credential check #97947 is the current-line blame on the setup and onboarding-skills files, though the commit title suggests adjacent cleanup rather than feature ownership. (role: recent area contributor; confidence: medium; commits: a107b95ee788; files: src/cli/program/register.setup.ts, src/commands/onboard-skills.ts)
thebenignhacker: Libria authored the merged skill/plugin code safety scanner PR, which is adjacent to the dependency-install consent boundary changed here. (role: adjacent install-security contributor; confidence: medium; commits: bc88e58fcfa0; files: src/skills/lifecycle/install.ts, src/plugins/install-security-scan.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

fuller-stack-dev · 2026-06-30T18:22:15Z

Land-ready proof for exact head 0a6e90d8f65151e3f5e54bcc777fa07bdcfe5348.

What changed:

Streamlined openclaw / openclaw setup onboarding so fresh config starts onboarding, existing config starts the TUI, and setup/onboarding share the flow.
Kept reruns biased toward existing config, current model/provider preservation, skip-first channel/search choices where appropriate, persistent compact navigation hints, and first-launch-only security acknowledgement.
Made skill dependency installation automatic during onboarding and removed the hooks prompt from the flow per maintainer product direction.
Hardened gateway-backed TUI launch probes so env credentials are honored and remote configured gateways are not probed unsafely from bare openclaw startup.
Updated CLI docs for the new setup/onboard behavior.

Local proof after the latest rebase:

OPENCLAW_VITEST_MAX_WORKERS=2 OPENCLAW_TEST_PROJECTS_PARALLEL=2 OPENCLAW_VITEST_SHARD_NAME=compact-large-whole-1 OPENCLAW_VITEST_NO_OUTPUT_TIMEOUT_MS=300000 OPENCLAW_VITEST_NO_OUTPUT_RETRY=1 node scripts/test-projects.mjs test/vitest/vitest.ui.config.ts test/vitest/vitest.wizard.config.ts
node scripts/run-vitest.mjs src/cli/run-main.exit.test.ts src/cli/program/register.setup.test.ts src/cli/program/register.onboard.test.ts src/wizard/setup.migration-import.test.ts src/wizard/clack-prompter.test.ts src/wizard/navigation-prompter.test.ts src/wizard/setup.finalize.test.ts src/wizard/clack-navigation-prompts.test.ts src/wizard/setup.test.ts src/commands/onboard-skills.test.ts
node scripts/run-tsgo.mjs -p test/tsconfig/tsconfig.core.test.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core-test.tsbuildinfo
node scripts/run-tsgo.mjs -p tsconfig.core.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core.tsbuildinfo
node scripts/run-oxlint.mjs --tsconfig config/tsconfig/oxlint.core.json src/wizard/setup.finalize.test.ts src/wizard/setup.test.ts
pnpm lint --threads=8
git diff --check
autoreview --mode branch --base upstream/main returned clean with no accepted/actionable findings.

GitHub proof:

PR checks are green for 0a6e90d8f65151e3f5e54bcc777fa07bdcfe5348: 67 successful, 0 failed, 0 pending.
No unresolved review threads.

Known gap:

I used the focused local onboarding/TUI proof plus GitHub’s full PR matrix rather than running a local full-suite replacement.

* feat: streamline onboarding setup flow * fix: harden onboarding preflight installs * test: isolate gateway preflight safety env * fix: keep local gateway probes on loopback * fix: honor onboarding node manager installs * docs: align setup onboarding reference * fix: harden bare gateway probe fallback * fix: honor env gateway auth in bare TUI probe * test: isolate wizard TUI hatch mocks

openclaw-barnacle Bot added cli CLI command changes scripts Repository scripts commands Command implementations size: XL maintainer Maintainer-authored PR labels Jun 30, 2026

fuller-stack-dev self-assigned this Jun 30, 2026

fuller-stack-dev force-pushed the codex/onboarding-main-revamp branch from 639f234 to d02d88d Compare June 30, 2026 17:03

openclaw-barnacle Bot added docs Improvements or additions to documentation gateway Gateway runtime labels Jun 30, 2026

clawsweeper Bot added the merge-risk: 🚨 auth-provider 🚨 May break OAuth, tokens, provider routing, model choice, or credentials. label Jun 30, 2026

fuller-stack-dev force-pushed the codex/onboarding-main-revamp branch 2 times, most recently from ee5925b to e9bc5f6 Compare June 30, 2026 17:54

fuller-stack-dev added 9 commits June 30, 2026 11:05

feat: streamline onboarding setup flow

1f97bd5

fix: harden onboarding preflight installs

a802784

test: isolate gateway preflight safety env

7d582a5

fix: keep local gateway probes on loopback

d15a376

fix: honor onboarding node manager installs

20ca753

docs: align setup onboarding reference

779f820

fix: harden bare gateway probe fallback

e627a5a

fix: honor env gateway auth in bare TUI probe

db7384a

test: isolate wizard TUI hatch mocks

0a6e90d

fuller-stack-dev force-pushed the codex/onboarding-main-revamp branch from e9bc5f6 to 0a6e90d Compare June 30, 2026 18:05

fuller-stack-dev merged commit 786abe7 into openclaw:main Jun 30, 2026
94 checks passed

github-actions Bot mentioned this pull request Jun 30, 2026

📡 Upstream Digest — 2026-06-30 19:44 UTC curtismercier/openclaw-mods#1178

Open

This was referenced Jul 1, 2026

Add Teams delegated auth for plugin tools #77784

Open

fix(installer): bypass onboard exec when existing config is present #81154

Closed

clawsweeper Bot mentioned this pull request Jul 1, 2026

fix(onboard): skip API-key prompt when user skipped installing the skill (#74382) #74891

Closed

3 tasks

This was referenced Jul 4, 2026

feat(onboard): streamline setup with agent-assisted configuration #93265

Draft

[Feature]: Add "go back" navigation during onboarding wizard #7456

Closed

steipete mentioned this pull request Jul 6, 2026

fix(onboard): keep the wizard alive through provider auth failures and polish standalone install UX #100632

Merged

This was referenced Jul 9, 2026

improve: warn before non-ClawHub plugin installs #102197

Merged

Onboarding migration import commits config before applying the migration plan, then locks retry behind fresh-setup gate #103262

Closed

vincentkoc mentioned this pull request Jul 13, 2026

refactor(onboard): remove obsolete node manager options #106593

Merged

MoerAI mentioned this pull request Jul 14, 2026

fix(ai): normalize non-conforming tool-call ids reaching Anthropic/Google targets (#95623) #107279

Open

clawsweeper Bot mentioned this pull request Jul 17, 2026

feat: report Pi and OpenCode in guided setup #109624

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Streamline OpenClaw onboarding#98218

Streamline OpenClaw onboarding#98218
fuller-stack-dev merged 9 commits into
openclaw:mainfrom
fuller-stack-dev:codex/onboarding-main-revamp

fuller-stack-dev commented Jun 30, 2026

Uh oh!

clawsweeper Bot commented Jun 30, 2026 •

edited

Loading

Uh oh!

fuller-stack-dev commented Jun 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

fuller-stack-dev commented Jun 30, 2026

Summary

Verification

Uh oh!

clawsweeper Bot commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fuller-stack-dev commented Jun 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

clawsweeper Bot commented Jun 30, 2026 •

edited

Loading