From 30cac9006f0908372cd0e94078c1b8007cd33c2e Mon Sep 17 00:00:00 2001
From: Michel Santos <MichelSantos@users.noreply.github.com>
Date: Sun, 12 Apr 2026 13:21:00 -0400
Subject: [PATCH] CLI: Fix onboard advisory to update the configuration and
 security files

---
 cmd/picoclaw/internal/cliui/onboard.go | 35 ++++++++++++++++++++------
 1 file changed, 27 insertions(+), 8 deletions(-)

diff --git a/cmd/picoclaw/internal/cliui/onboard.go b/cmd/picoclaw/internal/cliui/onboard.go
index e74cf68c6..fe33c8fa8 100644
--- a/cmd/picoclaw/internal/cliui/onboard.go
+++ b/cmd/picoclaw/internal/cliui/onboard.go
@@ -2,9 +2,12 @@ package cliui
 
 import (
 	"fmt"
+	"path/filepath"
 	"strings"
 
 	"github.com/charmbracelet/lipgloss"
+
+	"github.com/sipeed/picoclaw/pkg/config"
 )
 
 // PrintOnboardComplete prints the post-onboard “ready” message and next steps.
@@ -24,9 +27,11 @@ func printOnboardPlain(logo string, encrypt bool, configPath string) {
 		fmt.Println("       export PICOCLAW_KEY_PASSPHRASE=<your-passphrase>   # Linux/macOS")
 		fmt.Println("       set PICOCLAW_KEY_PASSPHRASE=<your-passphrase>      # Windows cmd")
 		fmt.Println("")
-		fmt.Println("  2. Add your API key to", configPath)
+		fmt.Println("  2. Add your selected LLM to the `model_name` field in", configPath)
+		fmt.Println("  3. Add your API key to", securityPath(configPath))
 	} else {
-		fmt.Println("  1. Add your API key to", configPath)
+		fmt.Println("  1. Add your selected LLM to the `model_name` field in", configPath)
+		fmt.Println("  2. Add your API key to", securityPath(configPath))
 	}
 	fmt.Println("")
 	fmt.Println("     Recommended:")
@@ -36,9 +41,9 @@ func printOnboardPlain(logo string, encrypt bool, configPath string) {
 	fmt.Println("     See README.md for 17+ supported providers.")
 	fmt.Println("")
 	if encrypt {
-		fmt.Println("  3. Chat: picoclaw agent -m \"Hello!\"")
+		fmt.Println("  4. Chat: picoclaw agent -m \"Hello!\"")
 	} else {
-		fmt.Println("  2. Chat: picoclaw agent -m \"Hello!\"")
+		fmt.Println("  3. Chat: picoclaw agent -m \"Hello!\"")
 	}
 }
 
@@ -85,13 +90,19 @@ func buildOnboardingSteps(encrypt bool, configPath string) string {
 		b.WriteString("1. Set your encryption passphrase before starting picoclaw:\n")
 		b.WriteString("   export PICOCLAW_KEY_PASSPHRASE=<your-passphrase>   # Linux/macOS\n")
 		b.WriteString("   set PICOCLAW_KEY_PASSPHRASE=<your-passphrase>      # Windows cmd\n\n")
-		b.WriteString("2. Add your API key to\n   ")
+		b.WriteString("2. Add your selected LLM to the `model_name` field in\n   ")
 		b.WriteString(configPath)
 		b.WriteString("\n")
+		b.WriteString("3. Add your API key to\n   ")
+		b.WriteString(securityPath(configPath))
+		b.WriteString("\n")
 	} else {
-		b.WriteString("1. Add your API key to\n   ")
+		b.WriteString("1. Add your selected LLM to the `model_name` field in\n   ")
 		b.WriteString(configPath)
 		b.WriteString("\n")
+		b.WriteString("2. Add your API key to\n   ")
+		b.WriteString(securityPath(configPath))
+		b.WriteString("\n")
 	}
 	return b.String()
 }
@@ -104,7 +115,15 @@ func recommendedBlock() string {
 
 func chatStep(encrypt bool) string {
 	if encrypt {
-		return "3. Chat:\n   picoclaw agent -m \"Hello!\""
+		return "4. Chat:\n   picoclaw agent -m \"Hello!\""
 	}
-	return "2. Chat:\n   picoclaw agent -m \"Hello!\""
+	return "3. Chat:\n   picoclaw agent -m \"Hello!\""
+}
+
+// Derive the expected path of the security configuration file
+// from the general configuration file path.
+// NOTE: Function duplicated from config/security.go#securityPath()
+func securityPath(configPath string) string {
+	configDir := filepath.Dir(configPath)
+	return filepath.Join(configDir, config.SecurityConfigFile)
 }