docs: stabilize starter prompt credential capture

docs/_components/StarterPrompt.tsx

@@ -89,15 +89,20 @@ Instead, collect the required choices from me first, one clickable selection at
 
 ## Handle Tokens Securely and Visually
 
-When you need an API key, bot token, app token, or other secret, prefer a local visual credential form instead of chat.
-
-- Ask permission before creating a local credential form.
-- Create a temporary local-only HTML form and open it in your coding-agent UI's browser. Bind any helper server to \`127.0.0.1\` on a random local port. Do not use external scripts, analytics, CDNs, or network resources.
-- Use password-style inputs for secret values and normal text inputs for non-secret IDs such as server IDs, allowlists, endpoint URLs, and sandbox names.
+When you need an API key, bot token, app token, or other secret, prefer the checked-in NemoClaw local credential form instead of chat.
+
+- Ask permission before opening a local credential form.
+- Do not generate, rewrite, or redesign credential-form HTML. Use the repository form template from this URL exactly: https://raw.githubusercontent.com/NVIDIA/NemoClaw/c9aac7dc12bacdaa4d38af552b893021049ee836/docs/resources/local-credential-form.html
+- Fetch that template or use the local repo copy when available, verify its SHA-256 digest is \`cc746703ab514cf33d7131915f16e8dc19346b26a4d953c5125be81449d6e6f6\`, write the exact bytes into a private temporary directory, then serve it from a helper bound to \`127.0.0.1\` on a random local port.
+- Treat that immutable URL and digest as one reviewed trust boundary. Stop if verification fails; do not substitute a different URL, template, or digest.
+- Open the served loopback URL, not the raw GitHub URL, in your coding-agent UI's browser. Configure fields with query parameters such as \`?fields=NVIDIA_INFERENCE_API_KEY:secret\` or \`?fields=NEMOCLAW_ENDPOINT_URL:text,NEMOCLAW_MODEL:text,COMPATIBLE_API_KEY:secret\`.
+- Implement only the tiny loopback helper around the template: serve the HTML file, accept its \`POST /submit\` JSON payload, keep submitted values in memory, and expose no external network listener. When serving the HTML response, include the HTTP header \`Content-Security-Policy: frame-ancestors 'none'\` because browsers do not enforce that directive from a meta tag.
+- Use \`:secret\` fields for secret values and \`:text\` fields for non-secret IDs such as server IDs, allowlists, endpoint URLs, and sandbox names.
 - Keep submitted secrets only in memory long enough to run the approved command. Do not print them, write them to logs, commit them, or paste them into chat.
 - If you must write a temporary file for the helper, use a private temporary directory, restrict permissions when possible, and delete it immediately after use.
 - Show me a redacted summary before running commands, such as \`TELEGRAM_BOT_TOKEN=********\`, and ask permission to continue.
 - After the command finishes, shut down the local helper and delete the temporary HTML file.
+- If your environment cannot serve a loopback helper, use the local terminal, a secure secret prompt, or the local app prompt that needs the credential. Do not fall back to generated form HTML.
 
 Use this provider mapping for non-interactive setup:
 

docs/get-started/quickstart-hermes.mdx

@@ -28,7 +28,7 @@ The first Hermes build can take several minutes because NemoClaw builds the Herm
 
 Copy the starter prompt into Cursor, Claude Code, Codex, Copilot, or another local coding agent when you want the assistant to install NemoClaw with you.
 The prompt points your agent to [AI Agent Docs](../resources/agent-skills), this quickstart, the Markdown docs, and the optional `nemoclaw-user-guide` skill.
-It also asks your agent to confirm Hermes as the selected agent before it builds the install or onboard command.
+It also asks your agent to confirm Hermes as the selected agent before it builds the install or onboard command, and to reuse the checked-in local credential form for secrets.
 
 <StarterPromptButton />
 

docs/get-started/quickstart.mdx

@@ -24,7 +24,7 @@ Review the [Prerequisites](prerequisites) before following this guide.
 
 Copy the starter prompt into Cursor, Claude Code, Codex, Copilot, or another local coding agent when you want the assistant to install NemoClaw with you.
 The prompt points your agent to [AI Agent Docs](../resources/agent-skills), this quickstart, the Markdown docs, and the optional `nemoclaw-user-guide` skill.
-It also tells your agent to collect choices before launching interactive commands and to handle credentials outside the chat transcript.
+It also tells your agent to collect choices before launching interactive commands and to reuse the checked-in local credential form for secrets.
 
 <StarterPromptButton />
 

docs/index.mdx

@@ -45,7 +45,7 @@ Install NemoClaw and run the onboard wizard to get started.
 ### From Your Coding Agent
 
 Copy the starter prompt and paste it into your local coding agent, such as Cursor, Claude Code, Codex, Copilot, or another assistant that can run local commands with your approval.
-The prompt tells your agent to use NemoClaw skills when available, bootstrap the docs-routing skill when it is missing, fetch the Markdown docs, ask whether you want OpenClaw, Hermes, or Deep Agents, collect choices one question at a time, and avoid asking you to paste secrets into chat.
+The prompt tells your agent to use NemoClaw skills when available, bootstrap the docs-routing skill when it is missing, fetch the Markdown docs, ask whether you want OpenClaw, Hermes, or Deep Agents, collect choices one question at a time, and reuse the checked-in local credential form instead of asking you to paste secrets into chat.
 
 <StarterPromptButton />
 

docs/resources/agent-skills.mdx

@@ -20,7 +20,7 @@ Use this page when you want your agent to help with installation, inference conf
 ## Give Your Agent the Starter Prompt
 
 The fastest path is to copy the starter prompt from the NemoClaw home page and paste it into your local coding agent.
-The prompt tells the agent to use NemoClaw skills when available, bootstrap the docs-routing skill when missing, use the Markdown docs, ask one question at a time, run commands only with permission, and handle credentials safely.
+The prompt tells the agent to use NemoClaw skills when available, bootstrap the docs-routing skill when missing, use the Markdown docs, ask one question at a time, run commands only with permission, and reuse the checked-in local credential form for secrets.
 NemoClaw keeps the prompt text in a shared docs source so the copy button and manual fallback render the same content.
 
 <StarterPromptButton />