nanoclaw-fleet: Skill for Claude Code

Use Native Credential Proxy

This skill replaces the OneCLI gateway with NanoClaw's built-in credential proxy. Containers get credentials injected via a local HTTP proxy that reads from .env — no external services needed.

Phase 1: Pre-flight

Check if already applied

Check if src/credential-proxy.ts is imported in src/index.ts:

grep "credential-proxy" src/index.ts

If it shows an import for startCredentialProxy, the native proxy is already active. Skip to Phase 3 (Setup).

Check if OneCLI is active

grep "@onecli-sh/sdk" package.json

If @onecli-sh/sdk appears, OneCLI is the active credential provider. Proceed with Phase 2 to replace it.

If neither check matches, you may be on an older version. Run /update-nanoclaw first, then retry.

Phase 2: Apply Code Changes

Ensure upstream remote

git remote -v

If upstream is missing, add it:

git remote add upstream https://github.com/qwibitai/nanoclaw.git

Merge the skill branch

git fetch upstream skill/native-credential-proxy
git merge upstream/skill/native-credential-proxy || {
  git checkout --theirs pnpm-lock.yaml
  git add pnpm-lock.yaml
  git merge --continue
}

This merges in:

• src/credential-proxy.ts and src/credential-proxy.test.ts (the proxy implementation)
• Restored credential proxy usage in src/index.ts, src/container-runner.ts, src/container-runtime.ts, src/config.ts
• Removed @onecli-sh/sdk dependency
• Restored CREDENTIAL_PROXY_PORT config (default 3001)
• Restored platform-aware proxy bind address detection
• Reverted setup skill to .env-based credential instructions

If the merge reports conflicts beyond pnpm-lock.yaml, resolve them by reading the conflicted files and understanding the intent of both sides.

Update main group CLAUDE.md

Replace the OneCLI auth reference with the native proxy:

In groups/main/CLAUDE.md, replace:

OneCLI manages credentials (including Anthropic auth) — run onecli --help.