getbased-agent-stack 0.5.4__tar.gz → 0.5.6__tar.gz

{getbased_agent_stack-0.5.4/src/getbased_agent_stack.egg-info → getbased_agent_stack-0.5.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: getbased-agent-stack
-Version: 0.5.4
+Version: 0.5.6
 Summary: One-command install of the full getbased agent stack — getbased-mcp + getbased-rag + getbased-dashboard
 License-Expression: AGPL-3.0-or-later
 Requires-Python: >=3.10
@@ -8,7 +8,7 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: getbased-mcp>=0.2.6
 Requires-Dist: getbased-rag>=0.7.2
-Requires-Dist: getbased-dashboard>=0.6.4
+Requires-Dist: getbased-dashboard>=0.6.5
 Provides-Extra: full
 Requires-Dist: getbased-rag[full]>=0.7.2; extra == "full"
 Provides-Extra: test
@@ -79,7 +79,7 @@ getbased-stack init --yes
 
 The wizard (~30 seconds):
 
-1. Prompts for your `GETBASED_TOKEN` and `GETBASED_AGENT_CONTEXT_KEY` (skip if you don't use Agent Access; `--yes` keeps current values and lets you set them later with `getbased-stack set ...`)
+1. Prompts for your `GETBASED_TOKEN` and `GETBASED_AGENT_CONTEXT_KEY` when you opt into Agent Access (skip if you don't use Agent Access; `--yes` skips prompts)
 2. Generates a rag API key if one doesn't exist
 3. Writes `~/.config/getbased/env` (mode 0600) — the shared config file
 4. Installs systemd user units for rag + dashboard, enables them, starts them

{getbased_agent_stack-0.5.4 → getbased_agent_stack-0.5.6}/README.md

@@ -60,7 +60,7 @@ getbased-stack init --yes
 
 The wizard (~30 seconds):
 
-1. Prompts for your `GETBASED_TOKEN` and `GETBASED_AGENT_CONTEXT_KEY` (skip if you don't use Agent Access; `--yes` keeps current values and lets you set them later with `getbased-stack set ...`)
+1. Prompts for your `GETBASED_TOKEN` and `GETBASED_AGENT_CONTEXT_KEY` when you opt into Agent Access (skip if you don't use Agent Access; `--yes` skips prompts)
 2. Generates a rag API key if one doesn't exist
 3. Writes `~/.config/getbased/env` (mode 0600) — the shared config file
 4. Installs systemd user units for rag + dashboard, enables them, starts them

{getbased_agent_stack-0.5.4 → getbased_agent_stack-0.5.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "getbased-agent-stack"
-version = "0.5.4"
+version = "0.5.6"
 description = "One-command install of the full getbased agent stack — getbased-mcp + getbased-rag + getbased-dashboard"
 readme = "README.md"
 license = "AGPL-3.0-or-later"
@@ -14,7 +14,7 @@ requires-python = ">=3.10"
 dependencies = [
     "getbased-mcp>=0.2.6",
     "getbased-rag>=0.7.2",
-    "getbased-dashboard>=0.6.4",
+    "getbased-dashboard>=0.6.5",
 ]
 
 [project.optional-dependencies]

{getbased_agent_stack-0.5.4 → getbased_agent_stack-0.5.6}/src/getbased_agent_stack/__init__.py

@@ -5,4 +5,4 @@ plus a small CLI that proxies to the real binaries. Everything
 interesting lives in the sibling repos.
 """
 
-__version__ = "0.5.4"
+__version__ = "0.5.6"

{getbased_agent_stack-0.5.4 → getbased_agent_stack-0.5.6}/src/getbased_agent_stack/cli.py

@@ -16,9 +16,12 @@ python-dotenv. The env file format is simple enough that we own it.
 from __future__ import annotations
 
 import argparse
+import base64
+import json
 import os
 import secrets
 import shutil
+import subprocess
 import sys
 from pathlib import Path
 
@@ -289,6 +292,143 @@ def cmd_mcp_config(args: argparse.Namespace) -> int:
     return 0
 
 
+def _decode_setup_payload(setup: str) -> "dict[str, str]":
+    prefix = "gbsetup_v1_"
+    if not setup.startswith(prefix):
+        raise ValueError("setup code must start with gbsetup_v1_")
+    raw = setup[len(prefix):].strip()
+    if not raw:
+        raise ValueError("empty setup payload")
+    padded = raw + "=" * (-len(raw) % 4)
+    try:
+        data = json.loads(base64.urlsafe_b64decode(padded.encode("ascii")).decode("utf-8"))
+    except Exception as exc:
+        raise ValueError("setup payload is not valid base64url JSON") from exc
+    if not isinstance(data, dict) or data.get("version") != 1:
+        raise ValueError("unsupported setup payload version")
+    token = str(data.get("token") or "").strip()
+    context_key = str(data.get("contextKey") or data.get("context_key") or "").strip()
+    gateway = str(data.get("gateway") or "https://sync.getbased.health").strip()
+    if not token:
+        raise ValueError("setup payload is missing token")
+    if not context_key:
+        raise ValueError("setup payload is missing contextKey")
+    if not gateway.startswith(("https://", "http://")):
+        raise ValueError("gateway must be an http(s) URL")
+    return {"token": token, "context_key": context_key, "gateway": gateway}
+
+
+def _run_checked(cmd: "list[str]", label: str, *, required: bool = True, input_text: str | None = None) -> bool:
+    try:
+        res = subprocess.run(cmd, text=True, input=input_text, capture_output=True, check=False)
+    except FileNotFoundError:
+        if required:
+            print(f"{label} failed: command not found: {cmd[0]}", file=sys.stderr)
+        else:
+            print(f"  skipped {label}: command not found: {cmd[0]}")
+        return False
+    if res.returncode == 0:
+        return True
+    msg = (res.stderr or res.stdout or "").strip()
+    if required:
+        print(f"{label} failed ({res.returncode})" + (f": {msg}" if msg else ""), file=sys.stderr)
+    else:
+        print(f"  skipped {label}: command exited {res.returncode}" + (f" ({msg})" if msg else ""))
+    return False
+
+
+def _process_tree_contains_hermes() -> bool:
+    """True when this command is running inside a Hermes-managed child process.
+
+    Restarting Hermes from a command spawned by the running gateway can SIGTERM
+    the setup process before it reports success. A normal SSH/shell terminal on
+    the same host will not have `hermes` in its parent process tree, so the
+    one-paste setup still performs the restart there.
+    """
+    if os.environ.get("GETBASED_STACK_ASSUME_HERMES_CHILD") == "1":
+        return True
+    if os.environ.get("GETBASED_STACK_ASSUME_HERMES_CHILD") == "0":
+        return False
+    pid = os.getppid()
+    seen: set[int] = set()
+    while pid > 1 and pid not in seen:
+        seen.add(pid)
+        proc = Path("/proc") / str(pid)
+        try:
+            comm = (proc / "comm").read_text(errors="ignore").strip().lower()
+            cmdline = (proc / "cmdline").read_text(errors="ignore").replace("\x00", " ").lower()
+            if comm == "hermes" or "hermes" in cmdline:
+                return True
+            stat = (proc / "stat").read_text(errors="ignore")
+            # /proc/<pid>/stat format: pid (comm) state ppid ...; comm may contain
+            # spaces, so split after the final ')'.
+            rest = stat.rsplit(")", 1)[1].strip().split()
+            pid = int(rest[1]) if len(rest) > 1 else 1
+        except Exception:
+            return False
+    return False
+
+
+def _maybe_restart_hermes_gateway(hermes: str, *, no_restart: bool) -> None:
+    if no_restart:
+        print("• Hermes gateway restart skipped by --no-restart. Run it manually after setup if Hermes is already running.")
+        return
+    if _process_tree_contains_hermes():
+        print("• Hermes gateway restart skipped because this setup is running inside Hermes. Restart Hermes from an external shell after this command finishes.")
+        return
+    if _run_checked([hermes, "gateway", "restart"], "Hermes gateway restart", required=False):
+        print("✓ Hermes gateway restart requested")
+    else:
+        print("• Restart Hermes manually if it is already running: hermes gateway restart")
+
+
+def cmd_connect(args: argparse.Namespace) -> int:
+    client = args.client
+    try:
+        setup = _decode_setup_payload(args.setup)
+    except ValueError as e:
+        print(f"Invalid setup: {e}", file=sys.stderr)
+        return 2
+
+    current = env_file.read_env_file()
+    current["GETBASED_STACK_MANAGED"] = "1"
+    current["GETBASED_TOKEN"] = setup["token"]
+    current["GETBASED_AGENT_CONTEXT_KEY"] = setup["context_key"]
+    current["GETBASED_GATEWAY"] = setup["gateway"]
+    current.setdefault("LENS_URL", "http://127.0.0.1:8322")
+    path = env_file.write_env_file(current)
+    print(f"✓ Agent Access credentials stored in {path} (mode 0600)")
+
+    mcp_cmd = shutil.which("getbased-mcp") or "getbased-mcp"
+
+    if client == "hermes":
+        hermes = shutil.which("hermes")
+        if not hermes:
+            print("Hermes CLI not found on PATH. Install Hermes or paste `getbased-stack mcp-config hermes` manually.", file=sys.stderr)
+            return 1
+        add_cmd = [
+            hermes, "mcp", "add", "getbased",
+            "--command", mcp_cmd,
+            "--env", "GETBASED_STACK_MANAGED=1",
+        ]
+        if not _run_checked(add_cmd, "Hermes MCP registration", input_text="y\ny\n"):
+            return 1
+        print("✓ Hermes MCP server registered")
+        if _run_checked([hermes, "mcp", "test", "getbased"], "Hermes MCP test", required=False):
+            print("✓ Connection test passed")
+        else:
+            print("• Connection test skipped/failed; run `hermes mcp test getbased` after restarting Hermes.")
+        if not args.no_restart:
+            _maybe_restart_hermes_gateway(hermes, no_restart=args.no_restart)
+        else:
+            _maybe_restart_hermes_gateway(hermes, no_restart=True)
+        print("Done. Ask Hermes: “Read my getbased profile.”")
+        return 0
+
+    print(f"Stored Agent Access credentials. Generate/paste this client config next: getbased-stack mcp-config {client}")
+    return 0
+
+
 def cmd_version(args: argparse.Namespace) -> int:
     try:
         import importlib.metadata as md
@@ -375,6 +515,23 @@ def build_parser() -> argparse.ArgumentParser:
         help="Which client to emit for.",
     )
 
+    pc = sub.add_parser("connect", help="Store an Agent Access setup code and configure a client.")
+    pc.add_argument(
+        "client",
+        choices=mcp_configs.SUPPORTED_CLIENTS,
+        help="Which client to configure.",
+    )
+    pc.add_argument(
+        "--setup",
+        required=True,
+        help="Private gbsetup_v1_... setup code copied from getbased Settings → Agent Access.",
+    )
+    pc.add_argument(
+        "--no-restart",
+        action="store_true",
+        help="Do not try to restart Hermes gateway after registering the MCP server.",
+    )
+
     sub.add_parser("version", help="Print installed package versions.")
 
     return p
@@ -387,6 +544,7 @@ COMMANDS = {
     "status": cmd_status,
     "set": cmd_set,
     "mcp-config": cmd_mcp_config,
+    "connect": cmd_connect,
     "version": cmd_version,
 }
 

{getbased_agent_stack-0.5.4 → getbased_agent_stack-0.5.6}/src/getbased_agent_stack/mcp_configs.py

@@ -16,14 +16,25 @@ import shutil
 from typing import Callable
 
 
-SUPPORTED_CLIENTS = ("claude-desktop", "claude-code", "cursor", "cline", "hermes")
-
-# Single-token list for the Hermes snippet. Matches the tool set the MCP
-# server exposes as of getbased-mcp 0.2.2. Keep alphabetical for diff-friendliness.
+SUPPORTED_CLIENTS = (
+    "claude-desktop",
+    "claude-code",
+    "cursor",
+    "cline",
+    "hermes",
+    "openclaw",
+    "codex",
+)
+
+# Single-token list for the Hermes snippet. Matches the lab-context +
+# knowledge tools exposed by current getbased-mcp. Keep alphabetical for
+# diff-friendliness.
 HERMES_ENABLED_TOOLS = [
+    "getbased_lab_context",
     "getbased_lens_config",
     "getbased_list_profiles",
-    "getbased_read_profile",
+    "getbased_section",
+    "getbased_wearables_series",
     "knowledge_activate_library",
     "knowledge_list_libraries",
     "knowledge_search",
@@ -115,6 +126,49 @@ def emit_cline(resolver: Callable[[str], "str | None"] = shutil.which) -> str:
     return banner + json.dumps(payload, indent=2) + "\n"
 
 
+def emit_openclaw(resolver: Callable[[str], "str | None"] = shutil.which) -> str:
+    """OpenClaw nests MCP servers under `mcp.servers.<name>` rather than
+    the Anthropic-style top-level `mcpServers` key."""
+    cmd = _resolve_mcp_binary(resolver)
+    body = {
+        "mcp": {
+            "servers": {
+                "getbased": {
+                    "command": cmd,
+                    "args": [],
+                    "env": {"GETBASED_STACK_MANAGED": "1"},
+                }
+            }
+        }
+    }
+    banner = "// Paste into ~/.openclaw/openclaw.json, or adapt for `openclaw mcp set getbased`.\n"
+    banner = _prepend_warning(banner, _resolver_warning(cmd))
+    return banner + json.dumps(body, indent=2) + "\n"
+
+
+def emit_codex(resolver: Callable[[str], "str | None"] = shutil.which) -> str:
+    """OpenAI Codex CLI uses TOML config under ~/.codex/config.toml."""
+    cmd = _resolve_mcp_binary(resolver)
+    warning = _resolver_warning(cmd)
+    lines = [
+        "# Paste into ~/.codex/config.toml",
+        "# Merge with existing [mcp_servers.*] tables if present.",
+    ]
+    if warning:
+        lines.append("#")
+        lines.extend(f"# {line}" for line in warning.splitlines())
+    lines.extend([
+        "",
+        '[mcp_servers.getbased]',
+        f'command = {json.dumps(cmd)}',
+        "args = []",
+        "",
+        '[mcp_servers.getbased.env]',
+        'GETBASED_STACK_MANAGED = "1"',
+    ])
+    return "\n".join(lines) + "\n"
+
+
 def emit_hermes(resolver: Callable[[str], "str | None"] = shutil.which) -> str:
     """Hermes uses YAML — we emit by hand (no yaml dep) since the shape
     is trivial. Includes enabled_tools for parity with the existing
@@ -172,6 +226,10 @@ def emit(client: str, resolver: Callable[[str], "str | None"] = shutil.which) ->
             return emit_cline(resolver)
         case "hermes":
             return emit_hermes(resolver)
+        case "openclaw":
+            return emit_openclaw(resolver)
+        case "codex":
+            return emit_codex(resolver)
         case _:
             raise ValueError(
                 f"unknown client {client!r}. Supported: {', '.join(SUPPORTED_CLIENTS)}"

{getbased_agent_stack-0.5.4 → getbased_agent_stack-0.5.6/src/getbased_agent_stack.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: getbased-agent-stack
-Version: 0.5.4
+Version: 0.5.6
 Summary: One-command install of the full getbased agent stack — getbased-mcp + getbased-rag + getbased-dashboard
 License-Expression: AGPL-3.0-or-later
 Requires-Python: >=3.10
@@ -8,7 +8,7 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: getbased-mcp>=0.2.6
 Requires-Dist: getbased-rag>=0.7.2
-Requires-Dist: getbased-dashboard>=0.6.4
+Requires-Dist: getbased-dashboard>=0.6.5
 Provides-Extra: full
 Requires-Dist: getbased-rag[full]>=0.7.2; extra == "full"
 Provides-Extra: test
@@ -79,7 +79,7 @@ getbased-stack init --yes
 
 The wizard (~30 seconds):
 
-1. Prompts for your `GETBASED_TOKEN` and `GETBASED_AGENT_CONTEXT_KEY` (skip if you don't use Agent Access; `--yes` keeps current values and lets you set them later with `getbased-stack set ...`)
+1. Prompts for your `GETBASED_TOKEN` and `GETBASED_AGENT_CONTEXT_KEY` when you opt into Agent Access (skip if you don't use Agent Access; `--yes` skips prompts)
 2. Generates a rag API key if one doesn't exist
 3. Writes `~/.config/getbased/env` (mode 0600) — the shared config file
 4. Installs systemd user units for rag + dashboard, enables them, starts them

{getbased_agent_stack-0.5.4 → getbased_agent_stack-0.5.6}/src/getbased_agent_stack.egg-info/requires.txt

@@ -1,6 +1,6 @@
 getbased-mcp>=0.2.6
 getbased-rag>=0.7.2
-getbased-dashboard>=0.6.4
+getbased-dashboard>=0.6.5
 
 [full]
 getbased-rag[full]>=0.7.2

{getbased_agent_stack-0.5.4 → getbased_agent_stack-0.5.6}/tests/test_cli.py

@@ -217,6 +217,22 @@ def test_mcp_config_hermes(stack_home):
     assert "enabled_tools:" in out
 
 
+def test_mcp_config_openclaw(stack_home):
+    rc, out, _ = _run(["mcp-config", "openclaw"])
+    assert rc == 0
+    assert '"mcp"' in out
+    assert '"servers"' in out
+    assert '"GETBASED_STACK_MANAGED": "1"' in out
+
+
+def test_mcp_config_codex(stack_home):
+    rc, out, _ = _run(["mcp-config", "codex"])
+    assert rc == 0
+    assert "[mcp_servers.getbased]" in out
+    assert "[mcp_servers.getbased.env]" in out
+    assert 'GETBASED_STACK_MANAGED = "1"' in out
+
+
 def test_mcp_config_unknown_client():
     rc, _, _ = _run(["mcp-config", "vim"])
     # argparse rejects before our code runs — exit code 2, SystemExit
@@ -224,6 +240,114 @@ def test_mcp_config_unknown_client():
     assert rc != 0
 
 
+# ── connect ───────────────────────────────────────────────────────────
+
+
+def _setup_blob(token="tok_123", context_key="ctx_456", gateway="https://sync.getbased.health"):
+    import base64
+    import json
+
+    payload = json.dumps({
+        "version": 1,
+        "token": token,
+        "contextKey": context_key,
+        "gateway": gateway,
+    }, separators=(",", ":")).encode()
+    return "gbsetup_v1_" + base64.urlsafe_b64encode(payload).decode().rstrip("=")
+
+
+def test_connect_hermes_setup_blob_stores_secrets_and_registers_mcp(stack_home, monkeypatch):
+    monkeypatch.setenv("GETBASED_STACK_ASSUME_HERMES_CHILD", "0")
+    calls = []
+    monkeypatch.setattr(cli.shutil, "which", lambda name: {
+        "getbased-mcp": "/usr/local/bin/getbased-mcp",
+        "hermes": "/usr/local/bin/hermes",
+    }.get(name))
+
+    def fake_run(cmd, **kwargs):
+        calls.append((cmd, kwargs.get("input")))
+        class Result:
+            returncode = 0
+            stdout = "ok"
+            stderr = ""
+        return Result()
+
+    monkeypatch.setattr(cli.subprocess, "run", fake_run)
+
+    rc, out, err = _run(["connect", "hermes", "--setup", _setup_blob()])
+
+    assert rc == 0, err
+    data = env_file.read_env_file()
+    assert data["GETBASED_STACK_MANAGED"] == "1"
+    assert data["GETBASED_TOKEN"] == "tok_123"
+    assert data["GETBASED_AGENT_CONTEXT_KEY"] == "ctx_456"
+    assert data["GETBASED_GATEWAY"] == "https://sync.getbased.health"
+    assert ([
+        "/usr/local/bin/hermes", "mcp", "add", "getbased",
+        "--command", "/usr/local/bin/getbased-mcp",
+        "--env", "GETBASED_STACK_MANAGED=1",
+    ], "y\ny\n") in calls
+    assert (["/usr/local/bin/hermes", "mcp", "test", "getbased"], None) in calls
+    assert (["/usr/local/bin/hermes", "gateway", "restart"], None) in calls
+    assert "Hermes MCP server registered" in out
+    assert "Connection test passed" in out
+    assert "tok_123" not in out
+    assert "ctx_456" not in out
+
+
+def test_connect_rejects_malformed_setup_blob(stack_home):
+    rc, out, err = _run(["connect", "hermes", "--setup", "not-a-setup-code"])
+    assert rc == 2
+    assert "Invalid setup" in err
+    assert env_file.read_env_file() == {}
+
+
+def test_connect_non_hermes_clients_store_credentials_and_point_to_config(stack_home, monkeypatch):
+    monkeypatch.setattr(cli.shutil, "which", lambda name: "/usr/local/bin/getbased-mcp" if name == "getbased-mcp" else None)
+    rc, out, err = _run(["connect", "openclaw", "--setup", _setup_blob()])
+    assert rc == 0, err
+    data = env_file.read_env_file()
+    assert data["GETBASED_STACK_MANAGED"] == "1"
+    assert data["GETBASED_TOKEN"] == "tok_123"
+    assert data["GETBASED_AGENT_CONTEXT_KEY"] == "ctx_456"
+    assert "getbased-stack mcp-config openclaw" in out
+    assert "tok_123" not in out
+    assert "ctx_456" not in out
+
+
+def test_connect_codex_is_an_allowed_setup_target(stack_home, monkeypatch):
+    monkeypatch.setattr(cli.shutil, "which", lambda name: "/usr/local/bin/getbased-mcp" if name == "getbased-mcp" else None)
+    rc, out, err = _run(["connect", "codex", "--setup", _setup_blob()])
+    assert rc == 0, err
+    assert "getbased-stack mcp-config codex" in out
+
+
+def test_connect_skips_gateway_restart_when_running_inside_hermes(stack_home, monkeypatch):
+    monkeypatch.setenv("GETBASED_STACK_ASSUME_HERMES_CHILD", "1")
+    calls = []
+    monkeypatch.setattr(cli.shutil, "which", lambda name: {
+        "getbased-mcp": "/usr/local/bin/getbased-mcp",
+        "hermes": "/usr/local/bin/hermes",
+    }.get(name))
+
+    def fake_run(cmd, **kwargs):
+        calls.append((cmd, kwargs.get("input")))
+        class Result:
+            returncode = 0
+            stdout = "ok"
+            stderr = ""
+        return Result()
+
+    monkeypatch.setattr(cli.subprocess, "run", fake_run)
+
+    rc, out, err = _run(["connect", "hermes", "--setup", _setup_blob()])
+
+    assert rc == 0, err
+    assert (["/usr/local/bin/hermes", "mcp", "test", "getbased"], None) in calls
+    assert all(cmd != ["/usr/local/bin/hermes", "gateway", "restart"] for cmd, _ in calls)
+    assert "restart skipped because this setup is running inside Hermes" in out
+
+
 # ── init (non-interactive via EOF on stdin) ───────────────────────────
 
 

{getbased_agent_stack-0.5.4 → getbased_agent_stack-0.5.6}/tests/test_mcp_configs.py

@@ -33,6 +33,8 @@ def test_supported_clients_stable_list():
         "cursor",
         "cline",
         "hermes",
+        "openclaw",
+        "codex",
     )
 
 
@@ -63,6 +65,27 @@ def test_hermes_emits_yaml_shape():
     assert "      - knowledge_search" in out
 
 
+def test_openclaw_emits_nested_mcp_servers_shape():
+    out = mcp_configs.emit("openclaw", resolver=_fake_resolver())
+    json_lines = [line for line in out.splitlines() if not line.startswith("//")]
+    payload = json.loads("\n".join(json_lines))
+    assert "mcpServers" not in payload
+    server = payload["mcp"]["servers"]["getbased"]
+    assert server["command"] == "/usr/local/bin/getbased-mcp"
+    assert server["args"] == []
+    assert server["env"] == {"GETBASED_STACK_MANAGED": "1"}
+
+
+def test_codex_emits_toml_shape():
+    out = mcp_configs.emit("codex", resolver=_fake_resolver())
+    assert "# Paste into ~/.codex/config.toml" in out
+    assert "[mcp_servers.getbased]" in out
+    assert 'command = "/usr/local/bin/getbased-mcp"' in out
+    assert "args = []" in out
+    assert "[mcp_servers.getbased.env]" in out
+    assert 'GETBASED_STACK_MANAGED = "1"' in out
+
+
 def test_no_secret_values_in_snippets():
     """A snippet must never carry a concrete token or key value. Prose
     comments may mention these variable names for context, but the emitted
@@ -104,6 +127,12 @@ def test_fallback_emits_warning_for_hermes():
     assert "WARNING" in out
 
 
+@pytest.mark.parametrize("client", ["openclaw", "codex"])
+def test_fallback_emits_warning_for_new_agent_clients(client):
+    out = mcp_configs.emit(client, resolver=_fake_resolver(found=None))
+    assert "WARNING" in out
+
+
 def test_no_warning_when_binary_resolved():
     """When shutil.which does find the binary, the warning banner must
     not appear — we don't want to cry wolf on successful installs."""