1. Two questions. Total. The only inputs you ask the user for are the Telegram bot token and the LLM access (one of three options — see Step 1). Everything else — VM name, zone, image, SSH key, security-group ingress, chat_id — is decided silently from safe defaults or auto-detected.
2. Never ask "are you sure" for actions inside this wizard's own scope (creating its own VM, its own security group, its own bot pairing). Only confirm if you're about to destroy something the user might want to keep (an existing VM with the same name).
3. Never show shell commands, flags, paths, or stack traces to the user unless they explicitly ask "what did you run?". Progress is plain language: "Создаю VM…", "Ставлю OpenClaw…", "Проверяю что бот отвечает…".
4. Validate inputs upfront with a one-call test (Telegram

   /getMe

   , LLM key probe). Don't burn 15 minutes on a VM bootstrap with a bad key.
5. Auto-fix prerequisites silently when it's safe — install

   yc

   CLI, generate an SSH key, switch endpoint to Kazakhstan. Only stop and ask the user when something can't be done without their input (

   yc init

   OAuth login, no billing account).
6. One language — and the bot speaks it too. If the user wrote to the agent in Russian, all wizard prompts are in Russian, and the OpenClaw bot itself is configured to reply in Russian. Detect the user's language from their first few messages, pass it through to cloud-init as

   {{USER_LANGUAGE}}

   (ISO 639-1:

   ru

   /

   en

   /

   kk

   /...), and the bootstrap script appends a localization block to the bot's

   USER.md

   . Default if you can't tell:

   ru

   (workshop audience).
7. No emojis in user-facing text unless the user used them first.

• Local-machine OpenClaw install → use

  openclaw/install.sh

  in this repo (the user runs it on their laptop)
• AWS / GCP / Azure / other Yandex Cloud regions → this skill is hard-coded for Yandex Cloud Kazakhstan (kz1-a)
• Adding a second agent or a second bot to an existing OpenClaw VM → out of scope
• Preparing the workshop as an organizer (creating N folders + keys for participants) → use

  prepare-yc-workshop

  (the matching organizer-side skill) — this skill is for the participant

oauth.yandex.kz

yc init

bundle-NN.json

bundle-NN.json

yc

1. The user pasted a file path that resolves to a JSON whose

   $schema

   starts with

   openclaw-workshop-bundle@

   .
2. The user said one of: "у меня workshop-ключ", "вот bundle от организатора", "I have a workshop key", "organizer gave me a key file", "у меня нет своего Yandex Cloud, есть только ключ от воркшопа".
3. A file matching

   bundle-*.json

   is present in the user's current working directory or

   ~/Downloads

   (offered with a one-line confirmation).

yc

• KZ has its own endpoint

  api.yandexcloud.kz:443

  . The Russian endpoint

  api.cloud.yandex.net:443

  and the KZ endpoint serve different clouds, folders, and OAuth realms. Mixing them is the #1 cause of "wizard says no billing / no cloud" when both exist.
• Setting

  yc config set endpoint api.yandexcloud.kz:443

  does NOT auto-update

  cloud-id

  or

  folder-id

  . If you only flip the endpoint and don't re-set cloud-id/folder-id, every subsequent

  yc compute / vpc / resource-manager

  command will fail with NotFound, because those IDs belong to the RU realm.
• The KZ endpoint exposes a smaller command set:

  iam

  ,

  quota-manager

  ,

  resource-manager

  ,

  compute

  ,

  vpc

  ,

  dns

  ,

  managed-kubernetes

  .

  yc billing

  does NOT exist on the KZ endpoint. Calling

  yc billing account list

  always errors out — don't use it for any check.
• Use named profiles (

  yc config profile create/activate

  ) instead of editing the active config. The user almost certainly already has profiles for their other clouds — don't clobber them.

1. Explicit file path in what the user said. Resolve the path; if it's a readable JSON whose

   $schema

   field starts with

   openclaw-workshop-bundle@

   , set

   MODE=plan-b

   and

   BUNDLE_PATH=<path>

   .
2. Phrase match. If the user wrote any of these (or close paraphrase) in the activation message:
   • "У меня workshop-ключ" / "вот bundle от организатора" / "ключ от воркшопа"
   • "I have a workshop key" / "organizer gave me a key file"
   • "Bundle from the organizer is here:" → followed by path
   • Then ask one clarifier: "Где лежит файл

     bundle-NN.json

     от организатора? (можешь перетащить файл в чат, или просто путь)" — accept the path, validate the

     $schema

     , set

     MODE=plan-b

     .
3. Auto-discovery. Glob

   bundle-*.json

   in

   $PWD

   ,

   ~/Downloads

   ,

   ~/Desktop

   . If exactly one match whose

   $schema

   starts with

   openclaw-workshop-bundle@

   , ask once: "Нашёл workshop-ключ

   bundle-NN.json

   в

   <path>

   . Это от организатора? (да / нет)". On "да" →

   MODE=plan-b

   . On "нет" → continue to next step.
4. Default. No bundle detected →

   MODE=plan-a

   . Don't ask "do you have a workshop key?" upfront — that's friction for the >50% of users who have their own YC and would treat the question as noise.

SCHEMA=$(jq -r '."$schema" // empty' "$BUNDLE_PATH" 2>/dev/null)
[[ "$SCHEMA" =~ ^openclaw-workshop-bundle@ ]] \
  || { say "Это не похоже на workshop-bundle от организатора. Проверь, что прислали правильный файл."; stop; }

After this block, the active profile is either the user's pre-existing KZ-pointing profile (preserve their settings — they know what they're doing) or our fresh `openclaw-kz` profile (we'll fill it in steps d-f).

**d. OAuth token + endpoint on the active profile.** Check `yc config get token` and `yc config get endpoint`:

- Both already set, endpoint is KZ → ✅ skip ahead.
- Endpoint set to KZ but no token → ask the user once (see below).
- Token set but wrong endpoint → silently `yc config set endpoint api.yandexcloud.kz:443`.
- Nothing set (fresh profile) → ask the user once for an OAuth token.

The OAuth ask is **the only mandatory user prompt in Step 0**. Say exactly:

> Для работы с Yandex Cloud Kazakhstan нужен OAuth-токен (один раз). Открой в браузере:
>
> https://oauth.yandex.kz/authorize?response_type=token&client_id=1a6990aa636648e9b2ef855fa7bec2fb
>
> Войди под своим Yandex ID, разреши доступ. После редиректа браузер покажет URL вида `https://oauth.yandex.kz/verification_code#access_token=y0_XXXXXX…&token_type=bearer&expires_in=...`. Скопируй значение `access_token=…` (длинная строка между `=` и `&`) и пришли мне.

After receiving the token: `yc config set token <token>`, then set the endpoint **and** the zone in the same breath:

```bash
yc config set endpoint api.yandexcloud.kz:443
yc config set compute-default-zone kz1-a

compute-default-zone

yc config set endpoint

yc compute *

--zone

ru-central1-a

CLOUD_ID=$(yc config get cloud-id 2>/dev/null || true)
if [[ -z "$CLOUD_ID" ]]; then
  CLOUD_ID=$(yc resource-manager cloud list --format json | jq -r '.[0].id // empty')
  [[ -n "$CLOUD_ID" ]] && yc config set cloud-id "$CLOUD_ID"
fi

FOLDER_ID=$(yc config get folder-id 2>/dev/null || true)
if [[ -z "$FOLDER_ID" ]]; then
  FOLDER_ID=$(yc resource-manager folder list --cloud-id "$CLOUD_ID" --format json | jq -r '.[0].id // empty')
  [[ -n "$FOLDER_ID" ]] && yc config set folder-id "$FOLDER_ID"
fi

• cloud list

  returns empty → the OAuth token is for a Yandex ID that has no clouds in KZ. Tell the user: "Похоже, у тебя нет облака в Yandex Cloud Kazakhstan. Создай облако в https://kz.console.yandex.cloud, потом запусти меня снова." Stop.

• cloud list

  returns multiple → use the first, but tell the user one line: "Использую облако

  <NAME>

  . Если это не то — скажи, переключусь."
• Same logic for folder.

yc billing account list

ls ~/.ssh/id_ed25519.pub

ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 -N "" -C "openclaw-yc-$(date +%Y%m%d)"

yc compute instance get --name openclaw-bot 2>/dev/null

openclaw-bot-XXXX

Сейчас поставлю тебе OpenClaw-бота в Yandex Cloud. От тебя нужны две вещи (~5 минут).

1) Telegram bot token. Открой @BotFather в Telegram → отправь

/newbot

→ придумай имя (любое) → придумай username, заканчивающийся на

bot

→ BotFather пришлёт токен. Пришли его мне.

2) Доступ к LLM — выбери ОДИН из трёх вариантов:

A) Anthropic API ключ (рекомендую первым, лучшее качество) Открой https://console.anthropic.com/settings/keys → Create Key. Ключ начинается на

sk-ant-

. На https://console.anthropic.com/settings/billing должно быть ≥$5.

B) OpenRouter API ключ (один ключ к Anthropic + OpenAI + 200 моделям) Открой https://openrouter.ai/keys → Create Key. Начинается на

sk-or-

. Нужен баланс ≥$5 на openrouter.ai/credits.

C) OpenAI Codex через ChatGPT подписку (бесплатно если уже платишь Plus или Pro) Не нужен ключ. Просто напиши слово «Codex». После установки бота я попрошу ввести 8-символьный код на auth.openai.com — один раз.

Пришли мне токен Telegram и один из трёх (ключ или слово «Codex»). Хоть в одном сообщении, хоть по отдельности. Я никуда не сохраняю и не показываю значения обратно.

case "$LLM_INPUT" in
  sk-ant-*)
    LLM_PROVIDER=anthropic ;;
  sk-or-*)
    LLM_PROVIDER=openrouter ;;
  Codex|codex|CODEX|ChatGPT|chatgpt|OpenAI*|"openai codex"|OAuth|oauth)
    LLM_PROVIDER=openai-codex
    LLM_API_KEY=""   # OAuth flow — no key at this stage
    ;;
  *)
    say "Не распознал — это Anthropic-ключ (начинается на sk-ant-), OpenRouter-ключ (sk-or-) или слово 'Codex'?" && reprompt
    ;;
esac

undefined

NETWORK_ID=$(yc vpc network get --name default --format json 2>/dev/null | jq -r .id 2>/dev/null)
if [[ -z "$NETWORK_ID" ]]; then
  NETWORK_ID=$(yc vpc network create --name default --format json | jq -r .id)
fi

SUBNET_ID=$(yc vpc subnet get --name default-kz1-a --format json 2>/dev/null | jq -r .id 2>/dev/null)
if [[ -z "$SUBNET_ID" ]]; then
  # Pick a /24 from 10.130.x.x that doesn't collide with the user's other subnets
  SUBNET_ID=$(yc vpc subnet create \
    --name default-kz1-a \
    --network-id "$NETWORK_ID" \
    --zone kz1-a \
    --range 10.130.0.0/24 \
    --format json | jq -r .id)
fi

MY_IP=$(curl -fsS --max-time 5 https://api.ipify.org 2>/dev/null \
  || curl -fsS --max-time 5 https://icanhazip.com 2>/dev/null \
  || echo "")  # empty → fall back to 0.0.0.0/0 (fail2ban catches the rest)

TELEGRAM_CHAT_ID

• {{TELEGRAM_BOT_TOKEN}}

  — from Step 1.

• {{SSH_PUBLIC_KEY}}

  — content of

  ~/.ssh/id_ed25519.pub

  .

• {{LLM_ENV_LINE}}

  — depends on the chosen LLM provider:

  Provider	Substituted line
  anthropic	ANTHROPIC_API_KEY=<key>
  openrouter	OPENROUTER_API_KEY=<key>
  openai-codex	(empty string — no env var at this stage; OAuth fills the profile after Step 4.5)

/tmp/openclaw-cloud-init.yaml

SSH_CIDR="${MY_IP:+${MY_IP}/32}"
SSH_CIDR="${SSH_CIDR:-0.0.0.0/0}"

SG_ID=$(yc vpc security-group create \
  --name "${VM_NAME}-sg" \
  --network-id "$NETWORK_ID" \
  --rule "direction=ingress,port=22,protocol=tcp,v4-cidrs=[${SSH_CIDR}]" \
  --rule "direction=egress,from-port=0,to-port=65535,protocol=any,v4-cidrs=[0.0.0.0/0]" \
  --format json | jq -r .id)

--network-id

--network-name

standard-v3

standard-v2

PLATFORM=standard-v3
yc compute instance create \
  --name "${VM_NAME}" \
  --zone kz1-a \
  --platform "$PLATFORM" \
  --cores 2 --memory 4 \
  --network-interface "subnet-id=${SUBNET_ID},nat-ip-version=ipv4,security-group-ids=${SG_ID}" \
  --create-boot-disk "type=network-ssd,size=30,image-folder-id=standard-images,image-family=ubuntu-2404-lts" \
  --ssh-key ~/.ssh/id_ed25519.pub \
  --metadata-from-file user-data=/tmp/openclaw-cloud-init.yaml \
  --hostname "${VM_NAME}" \
  --format json > /tmp/openclaw-vm.json 2>/tmp/openclaw-vm.err

anthropic

openrouter

gateway.env

openai-codex

ssh -tt -o ServerAliveInterval=30 openclaw@$IP \
  "openclaw models auth login --provider openai-codex --device-code" \
  | tee /tmp/openclaw-oauth.log

• A URL like

  https://auth.openai.com/codex/device

  (or

  https://auth.openai.com/device

  )
• An 8-character code like

  ABCD-1234

/tmp/openclaw-oauth.log

Последний шаг — подключи бота к ChatGPT.

Открой в браузере: https://auth.openai.com/codex/device

Введи код: ABCD-1234

Войди под аккаунтом ChatGPT (Plus или Pro) и разреши доступ. Жду до 15 минут.

auth-profiles.json

[shown on the local device only]

/tmp/openclaw-oauth.log

• Retry with

  ssh -tt

  if you didn't already — the masking is triggered by a TTY check that some non-interactive SSH invocations fail.
• If retry doesn't help: run the auth command directly inside a fresh SSH session (

  ssh openclaw@$IP

  →

  openclaw models auth login --provider openai-codex --device-code

  ), pull the code from there, then resume the wizard.

undefined

Pro subscription

Plus subscription — gpt-4o is the best available

If after 15 minutes the SSH session timed out and `auth-profiles.json` still has no `openai-codex` profile: tell the user "не получилось войти в ChatGPT, давай попробуем ещё раз" and re-run the SSH `openclaw models auth login` command. Don't kill the VM — only the OAuth step needs to be retried.

1. Telegram delivers

   /start

   to the bot.
2. OpenClaw enforces

   dmPolicy=pairing

   — it does not drop the message, it calls

   issuePairingChallenge()

   , records a pending request in the gateway, and the bot replies to the user with the pairing code + instructions (something like "To complete pairing, ask your admin to run

   openclaw pairing approve telegram ABCD-1234

   "). The user sees this message; they shouldn't reply to it.
3. The pending request lives in

   openclaw pairing list telegram --format json

   until either approved or expired.

Бот готов. Открой его в Telegram: https://t.me/{{BOT_USERNAME}} и нажми

/start

.

Бот пришлёт тебе короткое сообщение с кодом — ничего с ним делать не надо, я подтвержу доступ автоматически за пару секунд. После этого можешь начать переписываться с ботом как обычно.

ssh openclaw@$IP "
  timeout 90 journalctl --user -u openclaw-gateway -f --no-pager 2>/dev/null \
    | grep -m1 -E 'telegram.*sent|outgoing.*telegram|sendMessage.*ok'
"

references/04-troubleshooting.md

getUpdates

LAST_OFFSET=$(curl -fsS "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/getUpdates?offset=-1" \
  | jq -r '.result[-1].update_id // 0')

for i in $(seq 1 45); do
  REPLY=$(curl -fsS "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/getUpdates?offset=$((LAST_OFFSET+1))&timeout=2" \
    | jq -r '.result[]? | select(.message.from.is_bot==true) | .message.text' \
    | head -n1)
  [[ -n "$REPLY" ]] && break
  sleep 2
done

[[ -z "$REPLY" ]] && fail "Не вижу ответа бота в getUpdates через 90с"

getUpdates

Бот должен был тебе ответить в Telegram. Ответил?

references/04-troubleshooting.md

openclaw-user-onboarding

USER.md

IP

external_ipv4_address

CHAT_ID

getUpdates

BOT_TOKEN

USER_LANGUAGE

AGENT_TYPE

main

Бот живой. Последний шаг — расскажи о себе коротко, чтобы я с первого сообщения был полезным.

openclaw-user-onboarding

1. Asks the five questions in one message
2. Parses the user's free-form reply
3. Renders

   USER.md

   from the template
4. Shows a 15-line preview, asks for confirmation
5. Atomic SCP upload to

   ~/.openclaw/workspace/USER.md

   (mode 600, owned by

   openclaw:openclaw

   )
6. Resets the active Telegram session (or restarts gateway as fallback)
7. Returns control to this wizard

openclaw-user-onboarding

openclaw-user-onboarding

1. Endpoint vs cloud-id mismatch. Setting

   endpoint=api.yandexcloud.kz:443

   does NOT auto-update

   cloud-id

   or

   folder-id

   . If you only flip the endpoint, every subsequent

   yc compute / vpc / resource-manager

   call sees an empty result because it's looking up RU IDs against the KZ realm. Always update all three together — endpoint, cloud-id, folder-id — or use a separate profile.

2. yc billing

   doesn't exist on KZ endpoint. Calling

   yc billing account list

   errors with

   Unknown command 'billing account list'

   . Don't use it for any pre-flight check. Detect billing problems from the actual

   yc compute instance create

   error message, not by trying to list accounts.

3. yc resource-manager cloud list

   returning empty. When the OAuth token doesn't match the realm (RU token on KZ endpoint, or vice versa), the call succeeds with an empty array — not an auth error. If empty, the answer is "wrong token", not "no cloud".

4. --network-name default

   lookup is fragile. When the folder has multiple networks (common after the user experiments), the named lookup can pick the wrong one or fail silently. Always resolve to a network-id first (

   yc vpc network get --name default

   ) and pass

   --network-id

   to subsequent commands.
5. Subnet not auto-provisioned. Default subnet

   default-kz1-a

   is created with the default network in most cases, but not all. New empty folders sometimes lack it. Always check before referencing it in instance create.

• references/01-prerequisites.md

  — yc CLI install, KZ endpoint init, SSH key, billing checks (most are silent now; only OAuth login and missing billing surface to the user)

• references/02-network-and-security.md

  — security-group rules, public-IP rationale, hardening choices

• references/03-openclaw-config.md

  — Telegram pairing flow, Anthropic auth, workspace seeding

• references/04-troubleshooting.md

  — 7 failure modes with copy-paste fixes

• references/05-workshop-key-mode.md

  — Plan B (workshop bundle) end-to-end: schema check, profile carve-out, what NOT to do, organizer hand-off

• scripts/cloud-init.yaml

  — the full VM bootstrap (Node, OpenClaw, hardening, ceo-ai-os workspace, systemd user service)

openclaw-guide

1. During install — if cloud-init logs surface something this skill doesn't know about, the agent reads

   openclaw-guide/references/06-troubleshooting.md

   instead of guessing.
2. After install — when the user asks "how do I add Slack?", "how do I make the bot wake me up at 8am?", "what skills should I install?", the agent reads

   openclaw-guide/references/use-cases.md

   and

   openclaw-guide/references/channels.md

   to advise. This wizard is silent after Step 5; the guide owns ongoing consultation.

npx skills add CodeAlive-AI/ceo-ai-os@install-openclaw-to-yc -g
npx skills add CodeAlive-AI/ceo-ai-os@openclaw-guide -g

npx

https://github.com/CodeAlive-AI/ceo-ai-os

skills/install-openclaw-to-yc

skills/openclaw-guide

• Multi-agent setups (two agents on one VM) — out of scope
• WhatsApp / Discord / Slack channels — Telegram only here; for other channels see

  openclaw-guide/references/channels.md

• Use-case design (morning brief, research workflows, decision playbooks) — see

  openclaw-guide/references/use-cases.md

• Backup and migration — separate skill
• Production-grade hardening (SELinux, kernel sysctl, SSH cert auth) — overkill for a workshop / personal CEO bot
• Cost optimisation past the trial grant —

  references/04-troubleshooting.md

  §7