Cherry-pick upstream 16a9fdc89 with conflict resolution:
- Add isSecretRef type guard to types.secrets.ts
- Add ApiKeyStorageOptions to onboard-auth.credentials.ts
- Add provider field to SecretRef constructions in apply-helpers
- Fix max_tokens for verification probes (5/16 → 1024)
- Fix timeout test to match 30s verify timeout
- Fix writeOAuthCredentials to return profileId
- Fix branding (OpenClaw → Bot) in apply-helpers and docs
- Add withEnvAsync import to provider-auth tests
Co-authored-by: Hanzo Dev <[email protected]>
4.3 KiB
summary, read_when, title, sidebarTitle
| summary | read_when | title | sidebarTitle | ||
|---|---|---|---|---|---|
| CLI onboarding wizard: guided setup for gateway, workspace, channels, and skills |
|
Onboarding Wizard (CLI) | Onboarding: CLI |
Onboarding Wizard (CLI)
The onboarding wizard is the recommended way to set up Hanzo Bot on macOS, Linux, or Windows (via WSL2; strongly recommended). It configures a local Gateway or a remote Gateway connection, plus channels, skills, and workspace defaults in one guided flow.
hanzo-bot onboard
To reconfigure later:
hanzo-bot configure
hanzo-bot agents add <name>
QuickStart vs Advanced
The wizard starts with QuickStart (defaults) vs Advanced (full control).
- Local gateway (loopback) - Workspace default (or existing workspace) - Gateway port **18789** - Gateway auth **Token** (auto‑generated, even on loopback) - Tailscale exposure **Off** - Telegram + WhatsApp DMs default to **allowlist** (you'll be prompted for your phone number) - Exposes every step (mode, workspace, gateway, channels, daemon, skills).What the wizard configures
Local mode (default) walks you through these steps:
- Model/Auth — Anthropic API key (recommended), OpenAI, or Custom Provider
(OpenAI-compatible, Anthropic-compatible, or Unknown auto-detect). Pick a default model.
For non-interactive runs,
--secret-input-mode refstores env-backed refs in auth profiles instead of plaintext API key values. In non-interactiverefmode, the provider env var must be set; passing inline key flags without that env var fails fast. In interactive runs, choosing secret reference mode lets you point at either an environment variable or an encryptedsopsfile pointer, with a fast preflight validation before saving. - Workspace — Location for agent files (default
~/.hanzo/bot/workspace). Seeds bootstrap files. - Gateway — Port, bind address, auth mode, Tailscale exposure.
- Channels — WhatsApp, Telegram, Discord, Google Chat, Mattermost, Signal, BlueBubbles, or iMessage.
- Daemon — Installs a LaunchAgent (macOS) or systemd user unit (Linux/WSL2).
- Health check — Starts the Gateway and verifies it's running.
- Skills — Installs recommended skills and optional dependencies.
Remote mode only configures the local client to connect to a Gateway elsewhere. It does not install or change anything on the remote host.
Add another agent
Use hanzo-bot agents add <name> to create a separate agent with its own workspace,
sessions, and auth profiles. Running without --workspace launches the wizard.
What it sets:
agents.list[].nameagents.list[].workspaceagents.list[].agentDir
Notes:
- Default workspaces follow
~/.hanzo/bot/workspace-<agentId>. - Add
bindingsto route inbound messages (the wizard can do this). - Non-interactive flags:
--model,--agent-dir,--bind,--non-interactive.
Full reference
For detailed step-by-step breakdowns, non-interactive scripting, Signal setup, RPC API, and a full list of config fields the wizard writes, see the Wizard Reference.
Related docs
- CLI command reference:
hanzo-bot onboard - Onboarding overview: Onboarding Overview
- macOS app onboarding: Onboarding
- Agent first-run ritual: Agent Bootstrapping