/add-vercel

name: add-vercel
description: Add Vercel deployment capability to NanoClaw agents. Installs the Vercel CLI in agent containers and sets up OneCLI credential injection for api.vercel.com. Use when the user wants agents to deploy web applications to Vercel.

Add Vercel

This skill gives NanoClaw agents the ability to deploy web applications to Vercel. It installs the Vercel CLI in agent containers and configures OneCLI to inject Vercel credentials automatically.

**Principle:** Do the work — don't tell the user to do it. Only ask for their input when it genuinely requires manual action (pasting a token).

Phase 1: Pre-flight

Check if already applied

Check if the container skill exists:

test -d container/skills/vercel-cli && echo "INSTALLED" || echo "NOT_INSTALLED"

If `INSTALLED`, skip to Phase 3 (Configure Credentials).

Check prerequisites

Verify OneCLI is working (required for credential injection):

onecli version 2>/dev/null && echo "ONECLI_OK" || echo "ONECLI_MISSING"

If `ONECLI_MISSING`, tell the user to run `/init-onecli` first, then retry `/add-vercel`. Stop here.

Phase 2: Install Container Skill

Copy the bundled container skill into the container skills directory:

rsync -a .claude/skills/add-vercel/container-skills/ container/skills/

Verify:

head -5 container/skills/vercel-cli/SKILL.md

Phase 3: Configure Credentials

Check the OneCLI gateway first

The Vercel secret reaches only the groups it is attached to, through OneCLI agent grants. On an older gateway a saved secret reaches every agent and the attach step fails, so check the gateway and CLI before asking for a token or saving one. It reads only:

sh .claude/skills/add-onecli/scripts/check-grants-gateway.sh /add-vercel

If it fails, show the user the message as it is and stop: do not ask for the token or save it, and do not attach it to agents by hand.

Check if Vercel credential already exists

onecli secrets list --max 0 2>/dev/null | jq -r '(if type == "array" then . else .data end)[] | select(.hostPattern == "api.vercel.com") | "\(.id)  \(.name)  created \(.createdAt)"'

If a Vercel credential already exists, skip to [Attach the secret to the groups that use Vercel](#attach-the-secret-to-the-groups-that-use-vercel): a re-run still asks which groups get it.

Set up Vercel API credential

The agent needs a Vercel personal access token. Tell the user:

> I need your Vercel personal access token. Go to https://vercel.com/account/tokens and create one with these settings: > > - **Token name:** `nanoclaw` (or any name you'll recognize) > - **Scope:** "Full Account" — the agent needs to create projects, deploy, and manage domains > - **Expiration:** "No expiration" recommended (avoids credential rotation), or pick a date if your security policy requires it > > After creating the token, copy it — you'll only see it once.

Once the user provides the token, add it to OneCLI from a file in a private temporary directory. Never put the token in a shell command: any local user can read a running command's text with `ps`. Make the directory:

mktemp -d "${TMPDIR:-/tmp}/nanoclaw-vercel-token.XXXXXX"

Write the token, and nothing else, to `token` in the printed directory with your file-writing tool, not a shell command. Then put the directory in `D` and run the block right away. If you are not going to run it (the user stops, or the token was wrong), delete the directory with `rm -rf` first. OneCLI's own output is dropped, since a gateway error can quote the token. The block also clears a directory of yours that an earlier run left more than 10 minutes ago, when it stopped before this step:

(
D="<directory printed by mktemp -d>"
trap 'rm -rf "$D"; find -H "${TMPDIR:-/tmp}" -maxdepth 1 -name "nanoclaw-vercel-token.*" -user "$(id -u)" -mmin +10 -exec rm -rf {} + 2>/dev/null' EXIT
onecli secrets create \
  --name "Vercel API Token" \
  --type generic \
  --file "$D/token" \
  --host-pattern "api.vercel.com" \
  --header-name "Authorization" \
  --value-format "Bearer {value}" >/dev/null 2>&1 \
  || { echo "OneCLI did not save the token: check that onecli secrets list works, then ask for the token again" >&2; exit 1; }
)

Verify:

onecli secrets list --max 0 | jq -r '(if type == "array" then . else .data end)[] | select(.hostPattern == "api.vercel.com") | "\(.id)  \(.name)  created \(.createdAt)"'

Attach the secret to the groups that use Vercel

A OneCLI agent receives only the secrets attached to it, and NanoClaw gives a group only its model credential on its own. List the agent groups and ask the user which ones should be able to deploy to Vercel:

ncl groups list --json --limit 100000 | jq -r '.data[] | "\(.id)  \(.name)"'

Put the chosen group ids, comma-separated, in `VERCEL_GROUPS` and run the block. If OneCLI holds more than one Vercel token, the block lists them (id, name, creation time) and stops: ask the user which one they saved and put its id in `VERCEL_SECRET`. The block attaches the Vercel secret to each chosen group's OneCLI agent, creating the agent for a group that has not run yet (NanoClaw adds its model credential on its first spawn). Attaching adds this one secret and leaves each agent's other grants alone; other groups, and groups created later, do not get it:

(
VERCEL_GROUPS="<agent-group-id>,<agent-group-id>"
VERCEL_SECRET=""
L=$(onecli secrets list --max 0) && [ -n "$(printf '%s' "$L" | tr -d '[:space:]')" ] || { echo "could not list OneCLI secrets" >&2; exit 1; }
T=$(printf '%s' "$L" | jq -c '[(if type == "array" then . else .data end)[] | select(.hostPattern == "api.vercel.com") | {id, name, createdAt}]') || { echo "could not read the OneCLI secret list" >&2; exit 1; }
if [ -n "$VERCEL_SECRET" ]; then
  S=$(printf '%s' "$T" | jq -r --arg s "$VERCEL_SECRET" '.[] | select(.id == $s) | .id'); [ -n "$S" ] || { echo "'$VERCEL_SECRET' is not