/sc-onboarding — Guided credential setup

Use this skill when the user is setting up si-coder-agent for the first time, or after they install a new /sc-* domain skill that needs new credentials.

Two modes

Mode A — AI-driven (default, interactive)

Triggered when the user runs /sc-onboarding from Claude / OpenClaw / Gemini.

The AI MUST:

1. Ask which domains they want. Present a checklist (core deploy domains shown;

see the "Required vars per domain" table below or skills/sc-onboarding/lib/onboarding-domains.js DOMAIN_VARS for the full list, including the stub domains):

• [ ] github (always required for any deploy)
• [ ] dokploy (Dokploy CRUD + deploy targets)
• [ ] convex (Convex self-hosted)
• [ ] hostinger (optional DNS automation)
• [ ] vercel (Vercel online frontend)
• [ ] convex-cloud (Convex Cloud backend)
• [ ] cf (Cloudflare, future) · stripe · clerk · supabase · resend (stubs)

1. Run `scripts/scan-env.js --domains <list>` to detect which required vars are already set in the user's environment (via process.env + ~/.bashrc parse).
2. For each missing var, prompt the user via `AskUserQuestion` with the per-var description from steps/<domain>.md. NEVER ask for vars that are already set unless the user says "reset" or "rotate".
3. Write only the new values to ~/.bashrc by piping the pairs via stdin so the raw secret never lands in argv (ps aux / /proc/<pid>/cmdline / shell history):

   printf 'KEY=VALUE\nKEY2=VALUE2\n' | node scripts/scan-env.js --write-stdin

Each KEY=VALUE is validated against the shared VALIDATORS (same source of truth as the CLI wizard) before anything is written; on the first failure it prints KEY failed validation and exits 1 without writing any pair (all-or-nothing). A legacy argv form (scripts/scan-env.js --write KEY=VALUE [KEY=VALUE...], pairs positional before or after the boolean --write) still exists for non-secret keys only — never pass secrets as argv. Both paths append an idempotent managed block delimited by # --- si-coder onboarding --- / # --- end si-coder onboarding ---; keys are deduped on each run and existing exports outside the block are not edited.

1. Confirm: source ~/.bashrc + tell the user which /sc-* skill they can now use.

NEVER ask the user to paste a value if it is already exported. Never log the value back to the user — confirm by hash/length only.

Flow

flowchart TD
    A([/sc-onboarding]) --> B[Pick domains<br/>ticked checklist]
    B --> C[Scan sources:<br/>process.env + ~/.bashrc]
    C --> D[Resolve DOMAIN_VARS<br/>required + optional<br/>per ticked domain]
    D --> E{For each var:<br/>already set in<br/>env or ~/.bashrc?}
    E -- yes --> F[Skip<br/>never re-prompt]
    E -- no --> G{required?}
    G -- required --> H[Prompt for value<br/>missing required]
    G -- optional --> I[Prompt for value<br/>missing optional<br/>blank = skip]
    H --> J[Validate against VALIDATORS]
    I --> J
    J -- fail --> H
    J -- pass --> K[Collect into updates]
    F --> L
    K --> L{any updates<br/>to write?}
    L -- no --> M([Done — nothing to write])
    L -- yes --> N[Merge into managed block<br/># --- si-coder onboarding --- ... end<br/>dedup keys, single-quote escape]
    N --> O[Write ~/.bashrc<br/>chmod 0600]
    O --> P([source ~/.bashrc])

Mode B — One-shot CLI (non-AI)

For users who clone the repo and want a scripted setup:

bash install.sh                        # symlink skills to ~/.claude/skills/
node bin/onboard.js                    # interactive readline wizard
node bin/onboard.js --domains convex,dokploy,github   # non-interactive checklist

The CLI (bin/onboard.js) reads steps/<domain>.md only for the human-readable prompt text/context it shows per domain. The per-key validators are NOT in the step markdown — they live in the VALIDATORS registry in skills/sc-onboarding/lib/onboarding-domains.js (the same source of truth scripts/scan-env.js uses), which bin/onboard.js imports and applies before writing to ~/.bashrc.

Required vars per domain

Mirrors skills/sc-onboarding/lib/onboarding-domains.js DOMAIN_VARS (the single source of truth).

Stub domains pre-register vars so /sc-onboarding can collect them; their /sc-* skills are not implemented yet. See steps/*.md for how to obtain each one.

Safety

• Never echo secrets back to the user — confirm with a capped preview only (at most the first ~25% of the value, max 4 chars) plus …[len=N].
• Never overwrite an existing export silently. Detect existing values, ask before rotating.
• The append block is a fixed, dedup-managed block delimited by # --- si-coder onboarding --- / # --- end si-coder onboarding ---, so the user can audit/remove it later.