init-onecli

# Initialize OneCLI Agent Vault This skill installs OneCLI, configures the Agent Vault gateway, and migrates any existing `.env` credentials into it. Run this after `/update-nanoclaw` introduces OneCLI as a breaking change, or any time OneCLI needs to be set up from scratch. **Principle:** When something is broken or missing, fix it. Don't tell the user to go fix it themselves unless it genuinely requires their manual action (e.g. pasting a token). ## Phase 1: Pre-flight ### Check if OneCLI is already working ```bash onecli version 2>/dev/null ``` If the command succeeds, OneCLI is installed, check for an Anthropic secret: ```bash onecli secrets list ``` If an Anthropic secret exists, tell the user OneCLI is already configured and working. Use AskUserQuestion: 1. **Keep current setup** — description: "OneCLI is installed and has credentials configured. Nothing to do." 2. **Reconfigure** — description: "Start fresh — reinstall OneCLI and re-register credentials." If they choose to keep, skip to Phase 5 (Verify). If they choose to reconfigure, continue. ### Check for native credential proxy ```bash grep "credential-proxy" src/index.ts 2>/dev/null ``` If `startCredentialProxy` is imported, the native credential proxy skill is active. Tell the user: "You're currently using the native credential proxy (`.env`-based). This skill will switch you to OneCLI's Agent Vault, which adds per-agent policies and rate limits. Your `.env` credentials will be migrated to the vault....