src/lib/onboard.ts (1)

344-345: Please run the messaging-focused E2Es on this onboarding path.

This touches core onboarding behavior for channel selection/token handling, so messaging-compatible-endpoint-e2e, hermes-discord-e2e, and hermes-slack-e2e are the highest-signal regressions to exercise before merge.

As per coding guidelines, "src/lib/onboard.ts: This file contains core onboarding logic. Changes here affect the full sandbox creation and configuration flow." and the listed E2E recommendations.

Also applies to: 5089-5090, 5138-5138, 5150-5150, 5687-5687, 8263-8263

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/onboard.ts` around lines 344 - 345, Run the messaging-focused
end-to-end suites to validate changes to channel selection and token handling in
src/lib/onboard.ts: execute messaging-compatible-endpoint-e2e,
hermes-discord-e2e, and hermes-slack-e2e (and re-run any failing runs listed
near the referenced changes) to exercise logic in channelHasStaticToken,
getChannelTokenKeys, listChannels and getMessagingToken; if tests fail, trace
the onboarding flow in onboard.ts, reproduce the failing scenario locally, and
fix the code paths that mishandle channel selection or token retrieval so the
E2Es pass before merging.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

src/lib/onboard.ts (1)

8260-8319: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Don't short-circuit tokenless channels out of the rest of setup.

This continue still skips every later prompt in the loop, so tokenless channels never collect server/mention/allowlist config. Only gate the static-token/app-token prompts behind channelHasStaticToken(ch) and let the rest of the per-channel setup keep running.

Suggested fix

-    if (!channelHasStaticToken(ch)) continue;
-    if (getMessagingToken(ch.envKey)) {
-      console.log(`  ✓ ${ch.name} — already configured`);
-    } else {
-      console.log("");
-      console.log(`  ${ch.help}`);
-      const token = normalizeCredentialValue(await prompt(`  ${ch.label}: `, { secret: true }));
-      if (token && ch.tokenFormat && !ch.tokenFormat.test(token)) {
-        console.log(
-          `  ✗ Invalid format. ${ch.tokenFormatHint || "Check the token and try again."}`,
-        );
-        console.log(`  Skipped ${ch.name} (invalid token format)`);
-        enabled.delete(ch.name);
-        continue;
-      }
-      if (token) {
-        saveCredential(ch.envKey, token);
-        process.env[ch.envKey] = token;
-        console.log(`  ✓ ${ch.name} token saved`);
-      } else {
-        console.log(`  Skipped ${ch.name} (no token entered)`);
-        enabled.delete(ch.name);
-        continue;
-      }
-    }
-    if (ch.appTokenEnvKey) {
-      const existingAppToken = getMessagingToken(ch.appTokenEnvKey);
-      if (existingAppToken) {
-        console.log(`  ✓ ${ch.name} app token — already configured`);
-      } else {
-        console.log("");
-        console.log(`  ${ch.appTokenHelp}`);
-        const appToken = normalizeCredentialValue(
-          await prompt(`  ${ch.appTokenLabel}: `, { secret: true }),
-        );
-        if (appToken && ch.appTokenFormat && !ch.appTokenFormat.test(appToken)) {
-          console.log(
-            `  ✗ Invalid format. ${ch.appTokenFormatHint || "Check the token and try again."}`,
-          );
-          console.log(`  Skipped ${ch.name} app token (invalid token format)`);
-          enabled.delete(ch.name);
-          continue;
-        }
-        if (appToken) {
-          saveCredential(ch.appTokenEnvKey, appToken);
-          process.env[ch.appTokenEnvKey] = appToken;
-          console.log(`  ✓ ${ch.name} app token saved`);
-        } else {
-          console.log(`  Skipped ${ch.name} app token (Socket Mode requires both tokens)`);
-          enabled.delete(ch.name);
-          continue;
-        }
-      }
-    }
+    if (channelHasStaticToken(ch)) {
+      if (getMessagingToken(ch.envKey)) {
+        console.log(`  ✓ ${ch.name} — already configured`);
+      } else {
+        console.log("");
+        console.log(`  ${ch.help}`);
+        const token = normalizeCredentialValue(await prompt(`  ${ch.label}: `, { secret: true }));
+        if (token && ch.tokenFormat && !ch.tokenFormat.test(token)) {
+          console.log(
+            `  ✗ Invalid format. ${ch.tokenFormatHint || "Check the token and try again."}`,
+          );
+          console.log(`  Skipped ${ch.name} (invalid token format)`);
+          enabled.delete(ch.name);
+          continue;
+        }
+        if (token) {
+          saveCredential(ch.envKey, token);
+          process.env[ch.envKey] = token;
+          console.log(`  ✓ ${ch.name} token saved`);
+        } else {
+          console.log(`  Skipped ${ch.name} (no token entered)`);
+          enabled.delete(ch.name);
+          continue;
+        }
+      }
+      if (ch.appTokenEnvKey) {
+        const existingAppToken = getMessagingToken(ch.appTokenEnvKey);
+        if (existingAppToken) {
+          console.log(`  ✓ ${ch.name} app token — already configured`);
+        } else {
+          console.log("");
+          console.log(`  ${ch.appTokenHelp}`);
+          const appToken = normalizeCredentialValue(
+            await prompt(`  ${ch.appTokenLabel}: `, { secret: true }),
+          );
+          if (appToken && ch.appTokenFormat && !ch.appTokenFormat.test(appToken)) {
+            console.log(
+              `  ✗ Invalid format. ${ch.appTokenFormatHint || "Check the token and try again."}`,
+            );
+            console.log(`  Skipped ${ch.name} app token (invalid token format)`);
+            enabled.delete(ch.name);
+            continue;
+          }
+          if (appToken) {
+            saveCredential(ch.appTokenEnvKey, appToken);
+            process.env[ch.appTokenEnvKey] = appToken;
+            console.log(`  ✓ ${ch.name} app token saved`);
+          } else {
+            console.log(`  Skipped ${ch.name} app token (Socket Mode requires both tokens)`);
+            enabled.delete(ch.name);
+            continue;
+          }
+        }
+      }
+    }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/onboard.ts` around lines 8260 - 8319, The loop over selected channels
currently uses "if (!channelHasStaticToken(ch)) continue;" which short-circuits
the rest of per-channel setup (server/mention/allowlist config) for tokenless
channels; instead, only skip the static-token/app-token prompt blocks when
channelHasStaticToken(ch) is false. Move the static token prompt logic (the
branch that checks getMessagingToken(ch.envKey), reads prompt, validates format,
calls saveCredential and sets process.env) and the app token block (the
ch.appTokenEnvKey branch) behind a conditional like "if
(channelHasStaticToken(ch)) { ... }" so that channels without static tokens
still execute the subsequent per-channel configuration and you remove the early
"continue" that currently skips the rest of the loop.