bot/docs/cli/onboard.md

summary, read_when, title

summary	read_when	title
CLI reference for `hanzo-bot onboard` (interactive onboarding wizard)	You want guided setup for gateway, workspace, auth, channels, and skills	onboard

hanzo-bot onboard

Interactive onboarding wizard (local or remote Gateway setup).

Related guides

• CLI onboarding hub: Onboarding Wizard (CLI)
• Onboarding overview: Onboarding Overview
• CLI onboarding reference: CLI Onboarding Reference
• CLI automation: CLI Automation
• macOS onboarding: Onboarding (macOS App)

Examples

hanzo-bot onboard
hanzo-bot onboard --flow quickstart
hanzo-bot onboard --flow manual
hanzo-bot onboard --mode remote --remote-url wss://gateway-host:18789

For plaintext private-network ws:// targets (trusted networks only), set BOT_ALLOW_INSECURE_PRIVATE_WS=1 in the onboarding process environment.

Non-interactive custom provider:

hanzo-bot onboard --non-interactive \
  --auth-choice custom-api-key \
  --custom-base-url "https://llm.example.com/v1" \
  --custom-model-id "foo-large" \
  --custom-api-key "$CUSTOM_API_KEY" \
  --secret-input-mode plaintext \
  --custom-compatibility openai

--custom-api-key is optional in non-interactive mode. If omitted, onboarding checks CUSTOM_API_KEY.

Store provider keys as refs instead of plaintext:

hanzo-bot onboard --non-interactive \
  --auth-choice openai-api-key \
  --secret-input-mode ref \
  --accept-risk

With --secret-input-mode ref, onboarding writes env-backed refs instead of plaintext key values. For auth-profile backed providers this writes keyRef entries; for custom providers this writes models.providers.<id>.apiKey as an env ref (for example { source: "env", provider: "default", id: "CUSTOM_API_KEY" }).

Non-interactive ref mode contract:

• Set the provider env var in the onboarding process environment (for example OPENAI_API_KEY).
• Do not pass inline key flags (for example --openai-api-key) unless that env var is also set.
• If an inline key flag is passed without the required env var, onboarding fails fast with guidance.

Gateway token options in non-interactive mode:

• --gateway-auth token --gateway-token <token> stores a plaintext token.
• --gateway-auth token --gateway-token-ref-env <name> stores gateway.auth.token as an env SecretRef.
• --gateway-token and --gateway-token-ref-env are mutually exclusive.
• --gateway-token-ref-env requires a non-empty env var in the onboarding process environment.
• With --install-daemon, when token auth requires a token, SecretRef-managed gateway tokens are validated but not persisted as resolved plaintext in supervisor service environment metadata.
• With --install-daemon, if token mode requires a token and the configured token SecretRef is unresolved, onboarding fails closed with remediation guidance.
• With --install-daemon, if both gateway.auth.token and gateway.auth.password are configured and gateway.auth.mode is unset, onboarding blocks install until mode is set explicitly.

Example:

export BOT_GATEWAY_TOKEN="your-token"
hanzo-bot onboard --non-interactive \
  --mode local \
  --auth-choice skip \
  --gateway-auth token \
  --gateway-token-ref-env BOT_GATEWAY_TOKEN \
  --accept-risk

Interactive onboarding behavior with reference mode:

• Choose Use secret reference when prompted.
• Then choose either:
  • Environment variable
  • Configured secret provider (file or exec)
• Onboarding performs a fast preflight validation before saving the ref.
  • If validation fails, onboarding shows the error and lets you retry.

Non-interactive Z.AI endpoint choices:

Note: --auth-choice zai-api-key now auto-detects the best Z.AI endpoint for your key (prefers the general API with zai/glm-5). If you specifically want the GLM Coding Plan endpoints, pick zai-coding-global or zai-coding-cn.

# Promptless endpoint selection
hanzo-bot onboard --non-interactive \
  --auth-choice zai-coding-global \
  --zai-api-key "$ZAI_API_KEY"

# Other Z.AI endpoint choices:
# --auth-choice zai-coding-cn
# --auth-choice zai-global
# --auth-choice zai-cn

Non-interactive Mistral example:

hanzo-bot onboard --non-interactive \
  --auth-choice mistral-api-key \
  --mistral-api-key "$MISTRAL_API_KEY"

Flow notes:

• quickstart: minimal prompts, auto-generates a gateway token.
• manual: full prompts for port/bind/auth (alias of advanced).
• Local onboarding DM scope behavior: CLI Onboarding Reference.
• Fastest first chat: hanzo-bot dashboard (Control UI, no channel setup).
• Custom Provider: connect any OpenAI or Anthropic compatible endpoint, including hosted providers not listed. Use Unknown to auto-detect.

Common follow-up commands

hanzo-bot configure
hanzo-bot agents add <name>

`--json` does not imply non-interactive mode. Use `--non-interactive` for scripts.