$npx -y skills add ya5huk/findash --skill setupUse when the user says "set up findash", "onboard", "first-time setup", "get findash running", "configure findash", or is installing the plugin for the first time. Runs findash-doctor's safe auto-fixes, then guides the human through the steps only they can do — creating `.secrets
| 1 | # setup |
| 2 | |
| 3 | First-time onboarding for findash. You **automate everything safe and local**, then **guide the human** through everything that needs them. You never enter the user's secrets yourself and never run anything that captures their passwords through this session — you tell them exactly what to put where, and they do it. |
| 4 | |
| 5 | ## Steps |
| 6 | |
| 7 | ### 1. Run the doctor's auto-fixes |
| 8 | |
| 9 | Run the `findash-doctor` skill (diagnose → auto-fix → report). It creates `data/ inbox/ output/ .secrets/`, fixes file modes, runs `npm install`, bundles the vendor assets, and inits the DB. Read its report: the **🚫 Blockers** and **⚠️ Optional** lines are exactly the steps below that the human still has to do. See [`../findash-doctor/SKILL.md`](../findash-doctor/SKILL.md). |
| 10 | |
| 11 | ### 2. Secrets — one file, filled in by the user |
| 12 | |
| 13 | Tell the user to create `.secrets/findash` and `chmod 600` it. Give them this single block to paste and edit — they keep only the sections they need: |
| 14 | |
| 15 | ```ini |
| 16 | # .secrets/findash — chmod 600. Omit any section you don't use. |
| 17 | [drive] |
| 18 | root_folder_id=<from your vault folder's Drive URL: drive.google.com/drive/folders/<ID>> |
| 19 | |
| 20 | [hapoalim] |
| 21 | user_code=<your hapoalim user code> |
| 22 | password=<your hapoalim password> |
| 23 | |
| 24 | [cal] |
| 25 | username=<your cal username> |
| 26 | password=<your cal password> |
| 27 | |
| 28 | [telegram] |
| 29 | bot_token=<from @BotFather> |
| 30 | chat_id=<your numeric id, from @userinfobot> |
| 31 | |
| 32 | [pdf-passwords] |
| 33 | <payslip-filename-pattern>=<password> |
| 34 | |
| 35 | [ibkr] |
| 36 | # IBKR auth is the official Interactive Brokers connector you add in Claude (no |
| 37 | # password here). The account IBKR maps onto is resolved automatically by |
| 38 | # /findash:fetch-investments and stored in the DB — nothing to set here. |
| 39 | # account_name=<legacy override only — pre-existing installs> |
| 40 | # account_ids=<comma-separated IBKR account ids> |
| 41 | # base_currency=ILS |
| 42 | ``` |
| 43 | |
| 44 | Then: `chmod 600 .secrets/findash`. |
| 45 | |
| 46 | **Do not collect these values in the conversation or write the file yourself** — the user pastes their own secrets in. rclone's OAuth token lives separately in `rclone.conf` (step 3), not here. |
| 47 | |
| 48 | **Coming from the old per-file layout?** Legacy `.secrets/{drive,hapoalim,cal,telegram,pdf-passwords}` files are **no longer read**. Tell the user to copy each value into the matching `[section]` of `.secrets/findash` and delete the old files — until they do, that integration won't work. Don't move their secrets for them. |
| 49 | |
| 50 | ### 3. Steps only the human can do |
| 51 | |
| 52 | These need a browser or an interactive terminal — you cannot do them, so print the exact commands and let the user run them: |
| 53 | |
| 54 | - **rclone Google Drive OAuth:** `rclone config` to authorize Drive, then make sure the token ends up at `./rclone.conf` (chmod 600). doctor moves `~/.config/rclone/rclone.conf` → `./rclone.conf` automatically if it finds it there. Drive powers manual-drop ingest + the weekly DB backup; without it the daily flow still runs degraded (bank fetch + dashboard), so this step can be deferred. |
| 55 | - **Telegram bot (only if you want delivery):** create a bot via `@BotFather` → `/newbot`, tap **Start** so it can DM you, then put `bot_token` + `chat_id` in `.secrets/findash` `[telegram]`. |
| 56 | - **Bank-scraper browser seeding (only if you use fetch):** one interactive run per source to seed the trusted-device cookie: |
| 57 | ``` |
| 58 | node scripts/fetch_bank.js --company=hapoalim --setup |
| 59 | node scripts/fetch_bank.js --company=visaCal --setup |
| 60 | ``` |
| 61 | Log in, complete OTP / CAPTCHA, trust the device, then press Enter. The profile is saved under `~/.cache/findash/chromium-profile/<companyId>/` and reused silently afterward. |
| 62 | - **IBKR portfolio (only if you use Interactive Brokers):** IBKR is **not** a findash MCP server — it's Anthropic's official **Interactive Brokers connector**, added through Claude's own connector directory. Its auth is interactive-only, so the daily run attempts it best-effort and unattended runs skip it with a warning. |
| 63 | 1. **Add the connector once:** in Claude, `+` → **Connectors** → **Add connector** → **Browse connectors**, search **"ibkr"**, pick **Interactive Brokers (IBKR)** (under *Anthropic & Partners*), and log in with your IBKR credentials. Confirm with `/mcp` (`Interactive Brokers (IBKR) · connected`), and restart Claude Code so the session picks it up. |
| 64 | 2. **Account mapping is automatic.** `fetch-investments` resolves which findash account IBKR |
| 65 | feeds (attaching to an existing broker when the ledgers clearly match — some brokers are |
| 66 | IBKR wrappers underneath — creating one for IBKR-only users, asking only when genuinely |
| 67 | ambiguous) and persists the choice in the DB. There is nothing to configure by hand. |
| 68 | 3. **Pull your trades:** |