getbased-agent-stack 0.5.5__tar.gz → 0.5.7__tar.gz

{getbased_agent_stack-0.5.5 → getbased_agent_stack-0.5.7}/PKG-INFO

@@ -1,16 +1,16 @@
 Metadata-Version: 2.4
 Name: getbased-agent-stack
-Version: 0.5.5
+Version: 0.5.7
 Summary: One-command install of the full getbased agent stack — getbased-mcp + getbased-rag + getbased-dashboard
 License-Expression: AGPL-3.0-or-later
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: getbased-mcp>=0.2.6
-Requires-Dist: getbased-rag>=0.7.2
-Requires-Dist: getbased-dashboard>=0.6.4
+Requires-Dist: getbased-mcp>=0.2.7
+Requires-Dist: getbased-rag>=0.7.4
+Requires-Dist: getbased-dashboard>=0.6.6
 Provides-Extra: full
-Requires-Dist: getbased-rag[full]>=0.7.2; extra == "full"
+Requires-Dist: getbased-rag[full]>=0.7.4; extra == "full"
 Provides-Extra: test
 Requires-Dist: pytest>=8.0; extra == "test"
 Requires-Dist: httpx>=0.27; extra == "test"
@@ -19,7 +19,7 @@ Dynamic: license-file
 
 # getbased-agent-stack
 
-Meta-package bundling the full [getbased](https://getbased.health) agent stack into one install: the MCP adapter, the RAG engine, the browser dashboard, an orchestration CLI (`init` / `install` / `mcp-config`), hardened systemd units for rag + dashboard, and paste-ready configs for Claude Desktop/Code, Cursor, Cline, and Hermes.
+Meta-package bundling the full [getbased](https://getbased.health) agent stack into one install: the MCP adapter, the local knowledge server, the browser dashboard, an orchestration CLI (`init` / `install` / `connect` / `mcp-config`), systemd user units for the knowledge server + dashboard, and paste-ready configs for Claude Code, Claude Desktop, Cursor, Cline, Codex CLI, Hermes, and OpenClaw.
 
 Part of the [getbased-agents monorepo](https://github.com/elkimek/getbased-agents).
 
@@ -31,7 +31,15 @@ Linux, one command:
 curl -sSL https://getbased.health/install.sh | bash
 ```
 
-Runs end-to-end: installs `getbased-agent-stack[full]` via whichever of `uv` or `pipx` is available, exposes sibling binaries, runs `getbased-stack init --yes`, and starts rag + dashboard as systemd user services. [Read the script first](https://github.com/elkimek/get-based-site/blob/main/install.sh) if you're cautious.
+Runs end-to-end: installs `getbased-agent-stack[full]` via whichever of `uv` or `pipx` is available, exposes sibling binaries, runs a non-interactive local-only init, and starts the knowledge server + dashboard as systemd user services. [Read the script first](https://github.com/elkimek/get-based-site/blob/main/install.sh) if you're cautious.
+
+If you are connecting a private getbased profile, copy the command from **Settings → Agent Access** in the app. It uses the same installer and then runs `getbased-stack connect` for the selected client:
+
+```bash
+curl -fsSL https://getbased.health/install.sh | bash -s -- connect <target> --setup 'gbsetup_v1_...'
+```
+
+That setup payload contains private credentials. Keep it out of logs and public issues.
 
 Manual — pipx:
 
@@ -56,7 +64,7 @@ uv tool install \
 Pulls:
 
 - [`getbased-mcp`](https://github.com/elkimek/getbased-agents/tree/main/packages/mcp) — stdio MCP server that Claude Code / Hermes / OpenClaw spawn
-- [`getbased-rag`](https://github.com/elkimek/getbased-agents/tree/main/packages/rag) — local RAG knowledge server (FastAPI + Qdrant + MiniLM/BGE)
+- [`getbased-rag`](https://github.com/elkimek/getbased-agents/tree/main/packages/rag) — local knowledge server (FastAPI + Qdrant + MiniLM/BGE)
 - [`getbased-dashboard`](https://github.com/elkimek/getbased-agents/tree/main/packages/dashboard) — web UI for library management, MCP config generation, and agent-activity inspection
 - The `getbased-stack` discovery CLI
 - `[full]` extra: PDF/DOCX parsers + ONNX runtime for hardware-accelerated embeddings
@@ -74,7 +82,7 @@ getbased-stack init
 Non-interactive (for scripted installs and curl | bash; `install.sh` uses this):
 
 ```bash
-getbased-stack init --yes
+getbased-stack init --yes --local-only
 ```
 
 The wizard (~30 seconds):
@@ -86,10 +94,16 @@ The wizard (~30 seconds):
 
 On non-systemd hosts (Docker, macOS, WSL1) step 4 writes the unit files but skips activation with a clear message instead of crashing — re-run on a systemd-enabled host or start `lens serve` + `getbased-dashboard serve` manually.
 
-Then paste one line into your MCP client:
+Private setup from the app:
+
+```bash
+getbased-stack connect hermes --setup 'gbsetup_v1_...'
+```
+
+Manual config helper:
 
 ```bash
-getbased-stack mcp-config claude-desktop   # or: claude-code, cursor, cline, hermes
+getbased-stack mcp-config claude-desktop   # or: claude-code, cursor, cline, codex, hermes, openclaw
 ```
 
 The snippet carries only `GETBASED_STACK_MANAGED=1` in its env block. No secrets in client configs — every MCP spawn reads the shared env file and loads the token + rag URL + API key path from there.
@@ -144,7 +158,7 @@ Claude Code / Hermes / OpenClaw          Browser
    │        │                          │             │
    │ HTTP   │ HTTP                     │ proxies     │ spawns stdio for Test
    ▼        ▼                          ▼             ▼
-sync GW   getbased-rag  ◀──────────────┘       getbased-mcp
+context gateway   getbased-rag  ◀────────┘     getbased-mcp
           (localhost:8322)
 ```
 
@@ -162,6 +176,7 @@ The dashboard is likewise stateless — it proxies rag for Knowledge operations,
 | 0.1.x | ≥0.2.0 | ≥0.1.0 | — | v1 (multi-library) |
 | 0.2.x | ≥0.2.2 | ≥0.6.0 | ≥0.5.0 | v1 (+ streaming ingest, per-library models) |
 | 0.4.x | ≥0.2.3 | ≥0.7.1 | ≥0.6.1 | v1 (+ shared env file, `getbased-stack init`, systemd units) |
+| 0.5.x | ≥0.2.7 | ≥0.7.4 | ≥0.6.6 | v1 (+ `getbased-stack connect`, multi-client setup targets; explicit local-only scripted init) |
 
 Bump the meta's major when sibling protocols break; bump siblings freely for normal features.
 

getbased_agent_stack-0.5.5/src/getbased_agent_stack.egg-info/PKG-INFO → getbased_agent_stack-0.5.7/README.md

@@ -1,25 +1,6 @@
-Metadata-Version: 2.4
-Name: getbased-agent-stack
-Version: 0.5.5
-Summary: One-command install of the full getbased agent stack — getbased-mcp + getbased-rag + getbased-dashboard
-License-Expression: AGPL-3.0-or-later
-Requires-Python: >=3.10
-Description-Content-Type: text/markdown
-License-File: LICENSE
-Requires-Dist: getbased-mcp>=0.2.6
-Requires-Dist: getbased-rag>=0.7.2
-Requires-Dist: getbased-dashboard>=0.6.4
-Provides-Extra: full
-Requires-Dist: getbased-rag[full]>=0.7.2; extra == "full"
-Provides-Extra: test
-Requires-Dist: pytest>=8.0; extra == "test"
-Requires-Dist: httpx>=0.27; extra == "test"
-Requires-Dist: pytest-timeout>=2.3; extra == "test"
-Dynamic: license-file
-
 # getbased-agent-stack
 
-Meta-package bundling the full [getbased](https://getbased.health) agent stack into one install: the MCP adapter, the RAG engine, the browser dashboard, an orchestration CLI (`init` / `install` / `mcp-config`), hardened systemd units for rag + dashboard, and paste-ready configs for Claude Desktop/Code, Cursor, Cline, and Hermes.
+Meta-package bundling the full [getbased](https://getbased.health) agent stack into one install: the MCP adapter, the local knowledge server, the browser dashboard, an orchestration CLI (`init` / `install` / `connect` / `mcp-config`), systemd user units for the knowledge server + dashboard, and paste-ready configs for Claude Code, Claude Desktop, Cursor, Cline, Codex CLI, Hermes, and OpenClaw.
 
 Part of the [getbased-agents monorepo](https://github.com/elkimek/getbased-agents).
 
@@ -31,7 +12,15 @@ Linux, one command:
 curl -sSL https://getbased.health/install.sh | bash
 ```
 
-Runs end-to-end: installs `getbased-agent-stack[full]` via whichever of `uv` or `pipx` is available, exposes sibling binaries, runs `getbased-stack init --yes`, and starts rag + dashboard as systemd user services. [Read the script first](https://github.com/elkimek/get-based-site/blob/main/install.sh) if you're cautious.
+Runs end-to-end: installs `getbased-agent-stack[full]` via whichever of `uv` or `pipx` is available, exposes sibling binaries, runs a non-interactive local-only init, and starts the knowledge server + dashboard as systemd user services. [Read the script first](https://github.com/elkimek/get-based-site/blob/main/install.sh) if you're cautious.
+
+If you are connecting a private getbased profile, copy the command from **Settings → Agent Access** in the app. It uses the same installer and then runs `getbased-stack connect` for the selected client:
+
+```bash
+curl -fsSL https://getbased.health/install.sh | bash -s -- connect <target> --setup 'gbsetup_v1_...'
+```
+
+That setup payload contains private credentials. Keep it out of logs and public issues.
 
 Manual — pipx:
 
@@ -56,7 +45,7 @@ uv tool install \
 Pulls:
 
 - [`getbased-mcp`](https://github.com/elkimek/getbased-agents/tree/main/packages/mcp) — stdio MCP server that Claude Code / Hermes / OpenClaw spawn
-- [`getbased-rag`](https://github.com/elkimek/getbased-agents/tree/main/packages/rag) — local RAG knowledge server (FastAPI + Qdrant + MiniLM/BGE)
+- [`getbased-rag`](https://github.com/elkimek/getbased-agents/tree/main/packages/rag) — local knowledge server (FastAPI + Qdrant + MiniLM/BGE)
 - [`getbased-dashboard`](https://github.com/elkimek/getbased-agents/tree/main/packages/dashboard) — web UI for library management, MCP config generation, and agent-activity inspection
 - The `getbased-stack` discovery CLI
 - `[full]` extra: PDF/DOCX parsers + ONNX runtime for hardware-accelerated embeddings
@@ -74,7 +63,7 @@ getbased-stack init
 Non-interactive (for scripted installs and curl | bash; `install.sh` uses this):
 
 ```bash
-getbased-stack init --yes
+getbased-stack init --yes --local-only
 ```
 
 The wizard (~30 seconds):
@@ -86,10 +75,16 @@ The wizard (~30 seconds):
 
 On non-systemd hosts (Docker, macOS, WSL1) step 4 writes the unit files but skips activation with a clear message instead of crashing — re-run on a systemd-enabled host or start `lens serve` + `getbased-dashboard serve` manually.
 
-Then paste one line into your MCP client:
+Private setup from the app:
+
+```bash
+getbased-stack connect hermes --setup 'gbsetup_v1_...'
+```
+
+Manual config helper:
 
 ```bash
-getbased-stack mcp-config claude-desktop   # or: claude-code, cursor, cline, hermes
+getbased-stack mcp-config claude-desktop   # or: claude-code, cursor, cline, codex, hermes, openclaw
 ```
 
 The snippet carries only `GETBASED_STACK_MANAGED=1` in its env block. No secrets in client configs — every MCP spawn reads the shared env file and loads the token + rag URL + API key path from there.
@@ -144,7 +139,7 @@ Claude Code / Hermes / OpenClaw          Browser
    │        │                          │             │
    │ HTTP   │ HTTP                     │ proxies     │ spawns stdio for Test
    ▼        ▼                          ▼             ▼
-sync GW   getbased-rag  ◀──────────────┘       getbased-mcp
+context gateway   getbased-rag  ◀────────┘     getbased-mcp
           (localhost:8322)
 ```
 
@@ -162,6 +157,7 @@ The dashboard is likewise stateless — it proxies rag for Knowledge operations,
 | 0.1.x | ≥0.2.0 | ≥0.1.0 | — | v1 (multi-library) |
 | 0.2.x | ≥0.2.2 | ≥0.6.0 | ≥0.5.0 | v1 (+ streaming ingest, per-library models) |
 | 0.4.x | ≥0.2.3 | ≥0.7.1 | ≥0.6.1 | v1 (+ shared env file, `getbased-stack init`, systemd units) |
+| 0.5.x | ≥0.2.7 | ≥0.7.4 | ≥0.6.6 | v1 (+ `getbased-stack connect`, multi-client setup targets; explicit local-only scripted init) |
 
 Bump the meta's major when sibling protocols break; bump siblings freely for normal features.
 

{getbased_agent_stack-0.5.5 → getbased_agent_stack-0.5.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "getbased-agent-stack"
-version = "0.5.5"
+version = "0.5.7"
 description = "One-command install of the full getbased agent stack — getbased-mcp + getbased-rag + getbased-dashboard"
 readme = "README.md"
 license = "AGPL-3.0-or-later"
@@ -12,15 +12,15 @@ requires-python = ">=3.10"
 # Pulls every sibling package. Bump this meta when a sibling protocol
 # bump requires coordinated release.
 dependencies = [
-    "getbased-mcp>=0.2.6",
-    "getbased-rag>=0.7.2",
-    "getbased-dashboard>=0.6.4",
+    "getbased-mcp>=0.2.7",
+    "getbased-rag>=0.7.4",
+    "getbased-dashboard>=0.6.6",
 ]
 
 [project.optional-dependencies]
 # `full` includes PDF/DOCX parsers and ONNX acceleration (pre-exported
 # weights — no PyTorch/transformers/optimum dance).
-full = ["getbased-rag[full]>=0.7.2"]
+full = ["getbased-rag[full]>=0.7.4"]
 # For contributors running the integration test harness.
 test = ["pytest>=8.0", "httpx>=0.27", "pytest-timeout>=2.3"]
 

{getbased_agent_stack-0.5.5 → getbased_agent_stack-0.5.7}/src/getbased_agent_stack/__init__.py

@@ -5,4 +5,4 @@ plus a small CLI that proxies to the real binaries. Everything
 interesting lives in the sibling repos.
 """
 
-__version__ = "0.5.5"
+__version__ = "0.5.7"

{getbased_agent_stack-0.5.5 → getbased_agent_stack-0.5.7}/src/getbased_agent_stack/cli.py

@@ -1,7 +1,7 @@
 """getbased-stack — orchestration CLI.
 
 Subcommands:
-  init           — interactive one-time setup: token, API key, systemd units
+  init           — interactive one-time setup: API key, systemd units
   install        — install/refresh the bundled systemd user units
   uninstall      — stop, disable, and remove the systemd units
   status         — show env file, units, and linger state
@@ -93,6 +93,7 @@ def cmd_init(args: argparse.Namespace) -> int:
     # for scripted installs (curl | bash) where stdin is unavailable and
     # the EOF-returns-default path still triggers a getpass echo warning.
     non_interactive = getattr(args, "yes", False)
+    local_only = getattr(args, "local_only", False)
 
     print("getbased-stack init — one-time setup")
     if non_interactive:
@@ -110,21 +111,43 @@ def cmd_init(args: argparse.Namespace) -> int:
     masked = "****" + current_token[-4:] if current_token else "(unset)"
     key_masked = "****" + current_context_key[-4:] if current_context_key else "(unset)"
     print(f"[1/4] Agent Access token + context key (token: {masked}, key: {key_masked})")
-    if non_interactive:
-        token = current_token
-        context_key = current_context_key
-        print("  keeping current values (set with `getbased-stack set GETBASED_TOKEN=…` and `getbased-stack set GETBASED_AGENT_CONTEXT_KEY=…` later).")
-    else:
-        token = _prompt(
-            "Paste GETBASED_TOKEN (press Enter to keep current / skip)",
-            default=current_token,
-            secret=True,
+    token = current_token
+    context_key = current_context_key
+    gateway = existing.get("GETBASED_GATEWAY", "")
+    setup_code = (getattr(args, "setup", "") or "").strip()
+    if setup_code:
+        try:
+            setup_values = _decode_setup_payload(setup_code)
+        except ValueError as e:
+            print(f"Invalid setup: {e}", file=sys.stderr)
+            return 2
+        token = setup_values["token"]
+        context_key = setup_values["context_key"]
+        gateway = setup_values["gateway"]
+        print("  setup code accepted — Agent Access credentials will be stored.")
+    elif token and context_key:
+        print("  existing Agent Access credentials found — keeping them.")
+    elif local_only:
+        print(
+            "  no complete Agent Access credentials yet — continuing local-only. "
+            "Blood-work Agent Access tools stay disabled until you run "
+            "`getbased-stack connect hermes --setup gbsetup_v1_…` or rerun "
+            "`getbased-stack init --setup gbsetup_v1_…`."
         )
-        context_key = _prompt(
-            "Paste GETBASED_AGENT_CONTEXT_KEY (press Enter to keep current / skip)",
-            default=current_context_key,
-            secret=True,
+    elif non_interactive:
+        print(
+            "  Agent Access setup code required for non-interactive first-run setup. "
+            "Pass `--setup gbsetup_v1_…`, or add `--local-only` to install only "
+            "rag/dashboard without Agent Access."
+        )
+        return 2
+    else:
+        print(
+            "  Agent Access setup code required for full first-run setup. Rerun "
+            "with `getbased-stack init --setup gbsetup_v1_…`, or pass "
+            "`--local-only` if you only want rag/dashboard without Agent Access."
         )
+        return 2
 
     # 2. API key
     key_path = Path(existing.get("LENS_API_KEY_FILE", str(_default_api_key_file())))
@@ -144,6 +167,8 @@ def cmd_init(args: argparse.Namespace) -> int:
         merged["GETBASED_TOKEN"] = token
     if context_key:
         merged["GETBASED_AGENT_CONTEXT_KEY"] = context_key
+    if gateway:
+        merged["GETBASED_GATEWAY"] = gateway
     merged["LENS_API_KEY_FILE"] = str(key_path)
     merged.setdefault("LENS_URL", "http://127.0.0.1:8322")
     path = env_file.write_env_file(merged)
@@ -166,17 +191,20 @@ def cmd_init(args: argparse.Namespace) -> int:
     _print_linger_hint(strict=False)
 
     # 6. MCP config pointers
-    print("\nNext steps for Agent Access:")
-    print("  1. In getbased, enable Cross-device Sync and Agent Access.")
-    print("  2. Copy both values from Settings → Agent Access:")
-    print("     GETBASED_TOKEN and GETBASED_AGENT_CONTEXT_KEY.")
-    print("  3. Save them here with:")
-    print("     getbased-stack set GETBASED_TOKEN=...")
-    print("     getbased-stack set GETBASED_AGENT_CONTEXT_KEY=...")
-
-    print("\nConfigure your MCP client(s):")
-    for client in mcp_configs.SUPPORTED_CLIENTS:
-        print(f"  getbased-stack mcp-config {client}")
+    if token and context_key:
+        print("\nAgent Access credentials are configured ✓")
+        print("  Generate or refresh client config with:")
+        for client in mcp_configs.SUPPORTED_CLIENTS:
+            print(f"    getbased-stack mcp-config {client}")
+    else:
+        print("\nNext steps for Agent Access:")
+        print("  1. In getbased, enable Cross-device Sync and Agent Access.")
+        print("  2. Copy the private setup code from Settings → Agent Access.")
+        print("  3. Store it here and register your MCP client with:")
+        print("     getbased-stack connect hermes --setup gbsetup_v1_...")
+        print("  4. Or generate a manual client config with:")
+        for client in mcp_configs.SUPPORTED_CLIENTS:
+            print(f"     getbased-stack mcp-config {client}")
 
     return 0
 
@@ -483,7 +511,7 @@ def build_parser() -> argparse.ArgumentParser:
     sub = p.add_subparsers(dest="command")
 
     pinit = sub.add_parser(
-        "init", help="Interactive one-time setup (token, API key, units)."
+        "init", help="Interactive one-time setup (API key, units)."
     )
     pinit.add_argument(
         "-y",
@@ -491,6 +519,16 @@ def build_parser() -> argparse.ArgumentParser:
         action="store_true",
         help="Non-interactive: take defaults on every prompt. Use for scripted installs.",
     )
+    pinit.add_argument(
+        "--setup",
+        default="",
+        help="Private gbsetup_v1_... setup code from getbased Settings → Agent Access.",
+    )
+    pinit.add_argument(
+        "--local-only",
+        action="store_true",
+        help="Install rag/dashboard without Agent Access credentials; run connect later.",
+    )
 
     pi = sub.add_parser("install", help="Install + start the systemd user units.")
     pi.add_argument("--no-enable", action="store_true", help="Copy files only; don't enable.")

{getbased_agent_stack-0.5.5 → getbased_agent_stack-0.5.7}/src/getbased_agent_stack/env_file.py

@@ -10,7 +10,6 @@ from __future__ import annotations
 
 import os
 from pathlib import Path
-from typing import Iterable
 
 
 ENV_PATH_COMMENT = """\

{getbased_agent_stack-0.5.5 → getbased_agent_stack-0.5.7}/src/getbased_agent_stack/mcp_configs.py

@@ -16,7 +16,15 @@ import shutil
 from typing import Callable
 
 
-SUPPORTED_CLIENTS = ("claude-desktop", "claude-code", "cursor", "cline", "hermes")
+SUPPORTED_CLIENTS = (
+    "claude-desktop",
+    "claude-code",
+    "cursor",
+    "cline",
+    "hermes",
+    "openclaw",
+    "codex",
+)
 
 # Single-token list for the Hermes snippet. Matches the lab-context +
 # knowledge tools exposed by current getbased-mcp. Keep alphabetical for
@@ -118,6 +126,49 @@ def emit_cline(resolver: Callable[[str], "str | None"] = shutil.which) -> str:
     return banner + json.dumps(payload, indent=2) + "\n"
 
 
+def emit_openclaw(resolver: Callable[[str], "str | None"] = shutil.which) -> str:
+    """OpenClaw nests MCP servers under `mcp.servers.<name>` rather than
+    the Anthropic-style top-level `mcpServers` key."""
+    cmd = _resolve_mcp_binary(resolver)
+    body = {
+        "mcp": {
+            "servers": {
+                "getbased": {
+                    "command": cmd,
+                    "args": [],
+                    "env": {"GETBASED_STACK_MANAGED": "1"},
+                }
+            }
+        }
+    }
+    banner = "// Paste into ~/.openclaw/openclaw.json, or adapt for `openclaw mcp set getbased`.\n"
+    banner = _prepend_warning(banner, _resolver_warning(cmd))
+    return banner + json.dumps(body, indent=2) + "\n"
+
+
+def emit_codex(resolver: Callable[[str], "str | None"] = shutil.which) -> str:
+    """OpenAI Codex CLI uses TOML config under ~/.codex/config.toml."""
+    cmd = _resolve_mcp_binary(resolver)
+    warning = _resolver_warning(cmd)
+    lines = [
+        "# Paste into ~/.codex/config.toml",
+        "# Merge with existing [mcp_servers.*] tables if present.",
+    ]
+    if warning:
+        lines.append("#")
+        lines.extend(f"# {line}" for line in warning.splitlines())
+    lines.extend([
+        "",
+        '[mcp_servers.getbased]',
+        f'command = {json.dumps(cmd)}',
+        "args = []",
+        "",
+        '[mcp_servers.getbased.env]',
+        'GETBASED_STACK_MANAGED = "1"',
+    ])
+    return "\n".join(lines) + "\n"
+
+
 def emit_hermes(resolver: Callable[[str], "str | None"] = shutil.which) -> str:
     """Hermes uses YAML — we emit by hand (no yaml dep) since the shape
     is trivial. Includes enabled_tools for parity with the existing
@@ -164,18 +215,19 @@ def emit_hermes(resolver: Callable[[str], "str | None"] = shutil.which) -> str:
 
 def emit(client: str, resolver: Callable[[str], "str | None"] = shutil.which) -> str:
     """Dispatch to the right emitter. Raises ValueError on unknown client."""
-    match client:
-        case "claude-desktop":
-            return emit_claude_desktop(resolver)
-        case "claude-code":
-            return emit_claude_code(resolver)
-        case "cursor":
-            return emit_cursor(resolver)
-        case "cline":
-            return emit_cline(resolver)
-        case "hermes":
-            return emit_hermes(resolver)
-        case _:
-            raise ValueError(
-                f"unknown client {client!r}. Supported: {', '.join(SUPPORTED_CLIENTS)}"
-            )
+    emitters = {
+        "claude-desktop": emit_claude_desktop,
+        "claude-code": emit_claude_code,
+        "cursor": emit_cursor,
+        "cline": emit_cline,
+        "hermes": emit_hermes,
+        "openclaw": emit_openclaw,
+        "codex": emit_codex,
+    }
+    try:
+        emitter = emitters[client]
+    except KeyError as e:
+        raise ValueError(
+            f"unknown client {client!r}. Supported: {', '.join(SUPPORTED_CLIENTS)}"
+        ) from e
+    return emitter(resolver)

{getbased_agent_stack-0.5.5 → getbased_agent_stack-0.5.7}/src/getbased_agent_stack/units.py

@@ -13,7 +13,7 @@ import subprocess
 from dataclasses import dataclass
 from importlib import resources
 from pathlib import Path
-from typing import Callable, Iterable
+from typing import Callable
 
 # Units this package ships. Order matters for start: rag first (dashboard
 # Wants=+After= rag), so systemctl picks the right order naturally anyway.

getbased_agent_stack-0.5.5/README.md → getbased_agent_stack-0.5.7/src/getbased_agent_stack.egg-info/PKG-INFO

@@ -1,6 +1,25 @@
+Metadata-Version: 2.4
+Name: getbased-agent-stack
+Version: 0.5.7
+Summary: One-command install of the full getbased agent stack — getbased-mcp + getbased-rag + getbased-dashboard
+License-Expression: AGPL-3.0-or-later
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: getbased-mcp>=0.2.7
+Requires-Dist: getbased-rag>=0.7.4
+Requires-Dist: getbased-dashboard>=0.6.6
+Provides-Extra: full
+Requires-Dist: getbased-rag[full]>=0.7.4; extra == "full"
+Provides-Extra: test
+Requires-Dist: pytest>=8.0; extra == "test"
+Requires-Dist: httpx>=0.27; extra == "test"
+Requires-Dist: pytest-timeout>=2.3; extra == "test"
+Dynamic: license-file
+
 # getbased-agent-stack
 
-Meta-package bundling the full [getbased](https://getbased.health) agent stack into one install: the MCP adapter, the RAG engine, the browser dashboard, an orchestration CLI (`init` / `install` / `mcp-config`), hardened systemd units for rag + dashboard, and paste-ready configs for Claude Desktop/Code, Cursor, Cline, and Hermes.
+Meta-package bundling the full [getbased](https://getbased.health) agent stack into one install: the MCP adapter, the local knowledge server, the browser dashboard, an orchestration CLI (`init` / `install` / `connect` / `mcp-config`), systemd user units for the knowledge server + dashboard, and paste-ready configs for Claude Code, Claude Desktop, Cursor, Cline, Codex CLI, Hermes, and OpenClaw.
 
 Part of the [getbased-agents monorepo](https://github.com/elkimek/getbased-agents).
 
@@ -12,7 +31,15 @@ Linux, one command:
 curl -sSL https://getbased.health/install.sh | bash
 ```
 
-Runs end-to-end: installs `getbased-agent-stack[full]` via whichever of `uv` or `pipx` is available, exposes sibling binaries, runs `getbased-stack init --yes`, and starts rag + dashboard as systemd user services. [Read the script first](https://github.com/elkimek/get-based-site/blob/main/install.sh) if you're cautious.
+Runs end-to-end: installs `getbased-agent-stack[full]` via whichever of `uv` or `pipx` is available, exposes sibling binaries, runs a non-interactive local-only init, and starts the knowledge server + dashboard as systemd user services. [Read the script first](https://github.com/elkimek/get-based-site/blob/main/install.sh) if you're cautious.
+
+If you are connecting a private getbased profile, copy the command from **Settings → Agent Access** in the app. It uses the same installer and then runs `getbased-stack connect` for the selected client:
+
+```bash
+curl -fsSL https://getbased.health/install.sh | bash -s -- connect <target> --setup 'gbsetup_v1_...'
+```
+
+That setup payload contains private credentials. Keep it out of logs and public issues.
 
 Manual — pipx:
 
@@ -37,7 +64,7 @@ uv tool install \
 Pulls:
 
 - [`getbased-mcp`](https://github.com/elkimek/getbased-agents/tree/main/packages/mcp) — stdio MCP server that Claude Code / Hermes / OpenClaw spawn
-- [`getbased-rag`](https://github.com/elkimek/getbased-agents/tree/main/packages/rag) — local RAG knowledge server (FastAPI + Qdrant + MiniLM/BGE)
+- [`getbased-rag`](https://github.com/elkimek/getbased-agents/tree/main/packages/rag) — local knowledge server (FastAPI + Qdrant + MiniLM/BGE)
 - [`getbased-dashboard`](https://github.com/elkimek/getbased-agents/tree/main/packages/dashboard) — web UI for library management, MCP config generation, and agent-activity inspection
 - The `getbased-stack` discovery CLI
 - `[full]` extra: PDF/DOCX parsers + ONNX runtime for hardware-accelerated embeddings
@@ -55,7 +82,7 @@ getbased-stack init
 Non-interactive (for scripted installs and curl | bash; `install.sh` uses this):
 
 ```bash
-getbased-stack init --yes
+getbased-stack init --yes --local-only
 ```
 
 The wizard (~30 seconds):
@@ -67,10 +94,16 @@ The wizard (~30 seconds):
 
 On non-systemd hosts (Docker, macOS, WSL1) step 4 writes the unit files but skips activation with a clear message instead of crashing — re-run on a systemd-enabled host or start `lens serve` + `getbased-dashboard serve` manually.
 
-Then paste one line into your MCP client:
+Private setup from the app:
+
+```bash
+getbased-stack connect hermes --setup 'gbsetup_v1_...'
+```
+
+Manual config helper:
 
 ```bash
-getbased-stack mcp-config claude-desktop   # or: claude-code, cursor, cline, hermes
+getbased-stack mcp-config claude-desktop   # or: claude-code, cursor, cline, codex, hermes, openclaw
 ```
 
 The snippet carries only `GETBASED_STACK_MANAGED=1` in its env block. No secrets in client configs — every MCP spawn reads the shared env file and loads the token + rag URL + API key path from there.
@@ -125,7 +158,7 @@ Claude Code / Hermes / OpenClaw          Browser
    │        │                          │             │
    │ HTTP   │ HTTP                     │ proxies     │ spawns stdio for Test
    ▼        ▼                          ▼             ▼
-sync GW   getbased-rag  ◀──────────────┘       getbased-mcp
+context gateway   getbased-rag  ◀────────┘     getbased-mcp
           (localhost:8322)
 ```
 
@@ -143,6 +176,7 @@ The dashboard is likewise stateless — it proxies rag for Knowledge operations,
 | 0.1.x | ≥0.2.0 | ≥0.1.0 | — | v1 (multi-library) |
 | 0.2.x | ≥0.2.2 | ≥0.6.0 | ≥0.5.0 | v1 (+ streaming ingest, per-library models) |
 | 0.4.x | ≥0.2.3 | ≥0.7.1 | ≥0.6.1 | v1 (+ shared env file, `getbased-stack init`, systemd units) |
+| 0.5.x | ≥0.2.7 | ≥0.7.4 | ≥0.6.6 | v1 (+ `getbased-stack connect`, multi-client setup targets; explicit local-only scripted init) |
 
 Bump the meta's major when sibling protocols break; bump siblings freely for normal features.
 

getbased_agent_stack-0.5.7/src/getbased_agent_stack.egg-info/requires.txt

@@ -0,0 +1,11 @@
+getbased-mcp>=0.2.7
+getbased-rag>=0.7.4
+getbased-dashboard>=0.6.6
+
+[full]
+getbased-rag[full]>=0.7.4
+
+[test]
+pytest>=8.0
+httpx>=0.27
+pytest-timeout>=2.3

{getbased_agent_stack-0.5.5 → getbased_agent_stack-0.5.7}/tests/test_cli.py

@@ -14,7 +14,7 @@ from pathlib import Path
 import pytest
 
 from getbased_agent_stack import cli, env_file, units
-from getbased_agent_stack.units import CommandResult, UnitManager
+from getbased_agent_stack.units import CommandResult
 
 
 @pytest.fixture
@@ -217,6 +217,22 @@ def test_mcp_config_hermes(stack_home):
     assert "enabled_tools:" in out
 
 
+def test_mcp_config_openclaw(stack_home):
+    rc, out, _ = _run(["mcp-config", "openclaw"])
+    assert rc == 0
+    assert '"mcp"' in out
+    assert '"servers"' in out
+    assert '"GETBASED_STACK_MANAGED": "1"' in out
+
+
+def test_mcp_config_codex(stack_home):
+    rc, out, _ = _run(["mcp-config", "codex"])
+    assert rc == 0
+    assert "[mcp_servers.getbased]" in out
+    assert "[mcp_servers.getbased.env]" in out
+    assert 'GETBASED_STACK_MANAGED = "1"' in out
+
+
 def test_mcp_config_unknown_client():
     rc, _, _ = _run(["mcp-config", "vim"])
     # argparse rejects before our code runs — exit code 2, SystemExit
@@ -286,6 +302,26 @@ def test_connect_rejects_malformed_setup_blob(stack_home):
     assert env_file.read_env_file() == {}
 
 
+def test_connect_non_hermes_clients_store_credentials_and_point_to_config(stack_home, monkeypatch):
+    monkeypatch.setattr(cli.shutil, "which", lambda name: "/usr/local/bin/getbased-mcp" if name == "getbased-mcp" else None)
+    rc, out, err = _run(["connect", "openclaw", "--setup", _setup_blob()])
+    assert rc == 0, err
+    data = env_file.read_env_file()
+    assert data["GETBASED_STACK_MANAGED"] == "1"
+    assert data["GETBASED_TOKEN"] == "tok_123"
+    assert data["GETBASED_AGENT_CONTEXT_KEY"] == "ctx_456"
+    assert "getbased-stack mcp-config openclaw" in out
+    assert "tok_123" not in out
+    assert "ctx_456" not in out
+
+
+def test_connect_codex_is_an_allowed_setup_target(stack_home, monkeypatch):
+    monkeypatch.setattr(cli.shutil, "which", lambda name: "/usr/local/bin/getbased-mcp" if name == "getbased-mcp" else None)
+    rc, out, err = _run(["connect", "codex", "--setup", _setup_blob()])
+    assert rc == 0, err
+    assert "getbased-stack mcp-config codex" in out
+
+
 def test_connect_skips_gateway_restart_when_running_inside_hermes(stack_home, monkeypatch):
     monkeypatch.setenv("GETBASED_STACK_ASSUME_HERMES_CHILD", "1")
     calls = []
@@ -315,6 +351,14 @@ def test_connect_skips_gateway_restart_when_running_inside_hermes(stack_home, mo
 # ── init (non-interactive via EOF on stdin) ───────────────────────────
 
 
+def test_init_requires_setup_or_local_only_on_clean_interactive_run(stack_home, fake_shell):
+    rc, out, _ = _run(["init"])
+    assert rc == 2
+    assert "--setup" in out
+    assert "--local-only" in out
+    assert env_file.read_env_file() == {}
+
+
 def test_init_idempotent_with_empty_input(stack_home, fake_shell, monkeypatch):
     """Feed EOF for every prompt: init should complete using defaults
     without crashing. This validates the wizard is non-blocking when
@@ -323,7 +367,7 @@ def test_init_idempotent_with_empty_input(stack_home, fake_shell, monkeypatch):
     monkeypatch.setattr("builtins.input", lambda *a, **kw: "")
     monkeypatch.setattr("getpass.getpass", lambda *a, **kw: "")
 
-    rc, out, _ = _run(["init"])
+    rc, out, _ = _run(["init", "--local-only"])
     assert rc == 0
     # Env file created
     path = env_file.env_file_path()
@@ -337,32 +381,46 @@ def test_init_idempotent_with_empty_input(stack_home, fake_shell, monkeypatch):
 
 
 def test_init_preserves_existing_token(stack_home, fake_shell, monkeypatch):
-    """Re-running init with EOF on token prompt must not wipe the stored
-    value. The wizard uses the previous token as default."""
+    """Re-running init must not wipe an explicitly stored token."""
     env_file.write_env_file(
         {"GETBASED_TOKEN": "preserved_value", "GETBASED_STACK_MANAGED": "1"}
     )
     monkeypatch.setattr("builtins.input", lambda *a, **kw: "")
     monkeypatch.setattr("getpass.getpass", lambda *a, **kw: "")
 
-    _run(["init"])
+    _run(["init", "--local-only"])
     assert env_file.read_env_file()["GETBASED_TOKEN"] == "preserved_value"
 
 
-def test_init_accepts_new_token(stack_home, fake_shell, monkeypatch):
+def test_init_accepts_setup_blob(stack_home, fake_shell, monkeypatch):
+    """First-run init can store the private Agent Access setup code without
+    prompting for raw token/context-key values separately."""
     inputs = iter([""])  # accept install prompt with default
     monkeypatch.setattr("builtins.input", lambda *a, **kw: next(inputs, ""))
-    monkeypatch.setattr("getpass.getpass", lambda *a, **kw: "brand_new_token")
+    monkeypatch.setattr(
+        "getpass.getpass",
+        lambda *a, **kw: (_ for _ in ()).throw(AssertionError("getpass called")),
+    )
 
-    _run(["init"])
-    assert env_file.read_env_file()["GETBASED_TOKEN"] == "brand_new_token"
+    rc, out, err = _run([
+        "init",
+        "--setup",
+        _setup_blob(token="brand_new_token", context_key="ctx_new", gateway="https://sync.example"),
+    ])
+    assert rc == 0, err
+    data = env_file.read_env_file()
+    assert data["GETBASED_TOKEN"] == "brand_new_token"
+    assert data["GETBASED_AGENT_CONTEXT_KEY"] == "ctx_new"
+    assert data["GETBASED_GATEWAY"] == "https://sync.example"
+    assert "brand_new_token" not in out
+    assert "ctx_new" not in out
 
 
 def test_init_generates_api_key(stack_home, fake_shell, monkeypatch):
     monkeypatch.setattr("builtins.input", lambda *a, **kw: "")
     monkeypatch.setattr("getpass.getpass", lambda *a, **kw: "")
 
-    _run(["init"])
+    _run(["init", "--local-only"])
     key_file = Path(env_file.read_env_file()["LENS_API_KEY_FILE"])
     assert key_file.exists()
     key = key_file.read_text().strip()
@@ -383,15 +441,14 @@ def test_init_reuses_existing_api_key(stack_home, fake_shell, monkeypatch):
     monkeypatch.setattr("builtins.input", lambda *a, **kw: "")
     monkeypatch.setattr("getpass.getpass", lambda *a, **kw: "")
 
-    _run(["init"])
+    _run(["init", "--local-only"])
     assert key_path.read_text().strip() == "preexisting_key"
 
 
-def test_init_yes_flag_skips_all_prompts(stack_home, fake_shell, monkeypatch):
+def test_init_yes_requires_setup_or_local_only_without_prompts(stack_home, fake_shell, monkeypatch):
     """`init --yes` must not call input() or getpass() at all. Scripted
-    installers (curl | bash) can't service prompts and the EOF fallback
-    triggers a Python getpass echo warning that pollutes output.
-    Strict assertion: any prompt call fails the test."""
+    installers (curl | bash) cannot service prompts, so a clean full setup
+    needs --setup; local-only installs must say so explicitly."""
     def _forbid_input(*a, **kw):
         raise AssertionError("input() called under --yes")
 
@@ -402,24 +459,25 @@ def test_init_yes_flag_skips_all_prompts(stack_home, fake_shell, monkeypatch):
     monkeypatch.setattr("getpass.getpass", _forbid_getpass)
 
     rc, out, _ = _run(["init", "--yes"])
-    assert rc == 0
+    assert rc == 2
     # Banner reflects the mode so the user sees what happened
     assert "non-interactive" in out.lower()
-    assert "GETBASED_TOKEN and GETBASED_AGENT_CONTEXT_KEY" in out
-    assert "getbased-stack set GETBASED_AGENT_CONTEXT_KEY" in out
-    # Env file + units still land
-    assert env_file.env_file_path().exists()
-    assert (stack_home / "config" / "systemd" / "user" / "getbased-rag.service").exists()
-
-
-def test_init_yes_installs_units_without_asking(stack_home, fake_shell, monkeypatch):
-    """Default for the install-units prompt is Yes, so --yes must also
-    install + start. If this regressed to skip, install.sh would
-    silently leave services off."""
+    assert "--setup" in out
+    assert "--local-only" in out
+    # A successful-looking first-run install without credentials would leave
+    # Agent Access broken, so --yes must stop before writing env/units unless
+    # the caller explicitly opts into --local-only.
+    assert not env_file.env_file_path().exists()
+    assert not (stack_home / "config" / "systemd" / "user" / "getbased-rag.service").exists()
+
+
+def test_init_yes_local_only_installs_units_without_asking(stack_home, fake_shell, monkeypatch):
+    """When the caller explicitly chooses local-only, --yes must install
+    + start without prompting."""
     monkeypatch.setattr("builtins.input", lambda *a, **kw: "")
     monkeypatch.setattr("getpass.getpass", lambda *a, **kw: "")
 
-    _run(["init", "--yes"])
+    _run(["init", "--yes", "--local-only"])
     # UnitManager.install() writes service files under XDG_CONFIG_HOME
     assert (stack_home / "config" / "systemd" / "user" / "getbased-rag.service").exists()
     assert (stack_home / "config" / "systemd" / "user" / "getbased-dashboard.service").exists()
@@ -435,7 +493,7 @@ def test_init_yes_survives_missing_systemctl(stack_home, fake_shell, monkeypatch
     monkeypatch.setattr("builtins.input", lambda *a, **kw: "")
     monkeypatch.setattr("getpass.getpass", lambda *a, **kw: "")
 
-    rc, out, _ = _run(["init", "--yes"])
+    rc, out, _ = _run(["init", "--yes", "--local-only"])
     assert rc == 0
     # Unit files still written (for re-run on a systemd-enabled host)
     assert (stack_home / "config" / "systemd" / "user" / "getbased-rag.service").exists()
@@ -448,7 +506,11 @@ def test_init_yes_preserves_existing_token(stack_home, fake_shell, monkeypatch):
     """Non-interactive mode must not nuke a previously-saved token —
     it takes the 'keep current' default, same as pressing Enter."""
     env_file.write_env_file(
-        {"GETBASED_TOKEN": "keep_me", "GETBASED_STACK_MANAGED": "1"}
+        {
+            "GETBASED_TOKEN": "keep_me",
+            "GETBASED_AGENT_CONTEXT_KEY": "ctx_keep",
+            "GETBASED_STACK_MANAGED": "1",
+        }
     )
     # No input/getpass expected, but stub defensively in case a future
     # code path adds an unguarded prompt — test still catches it.
@@ -465,10 +527,10 @@ def test_init_is_reentrant(stack_home, fake_shell, monkeypatch):
     monkeypatch.setattr("builtins.input", lambda *a, **kw: "")
     monkeypatch.setattr("getpass.getpass", lambda *a, **kw: "")
 
-    _run(["init"])
+    _run(["init", "--local-only"])
     key1 = (stack_home / "data" / "getbased" / "lens" / "api_key").read_text()
 
-    _run(["init"])
+    _run(["init", "--local-only"])
     key2 = (stack_home / "data" / "getbased" / "lens" / "api_key").read_text()
 
     assert key1 == key2, "init must not rotate an existing API key"

{getbased_agent_stack-0.5.5 → getbased_agent_stack-0.5.7}/tests/test_mcp_configs.py

@@ -33,6 +33,8 @@ def test_supported_clients_stable_list():
         "cursor",
         "cline",
         "hermes",
+        "openclaw",
+        "codex",
     )
 
 
@@ -63,6 +65,27 @@ def test_hermes_emits_yaml_shape():
     assert "      - knowledge_search" in out
 
 
+def test_openclaw_emits_nested_mcp_servers_shape():
+    out = mcp_configs.emit("openclaw", resolver=_fake_resolver())
+    json_lines = [line for line in out.splitlines() if not line.startswith("//")]
+    payload = json.loads("\n".join(json_lines))
+    assert "mcpServers" not in payload
+    server = payload["mcp"]["servers"]["getbased"]
+    assert server["command"] == "/usr/local/bin/getbased-mcp"
+    assert server["args"] == []
+    assert server["env"] == {"GETBASED_STACK_MANAGED": "1"}
+
+
+def test_codex_emits_toml_shape():
+    out = mcp_configs.emit("codex", resolver=_fake_resolver())
+    assert "# Paste into ~/.codex/config.toml" in out
+    assert "[mcp_servers.getbased]" in out
+    assert 'command = "/usr/local/bin/getbased-mcp"' in out
+    assert "args = []" in out
+    assert "[mcp_servers.getbased.env]" in out
+    assert 'GETBASED_STACK_MANAGED = "1"' in out
+
+
 def test_no_secret_values_in_snippets():
     """A snippet must never carry a concrete token or key value. Prose
     comments may mention these variable names for context, but the emitted
@@ -104,6 +127,12 @@ def test_fallback_emits_warning_for_hermes():
     assert "WARNING" in out
 
 
+@pytest.mark.parametrize("client", ["openclaw", "codex"])
+def test_fallback_emits_warning_for_new_agent_clients(client):
+    out = mcp_configs.emit(client, resolver=_fake_resolver(found=None))
+    assert "WARNING" in out
+
+
 def test_no_warning_when_binary_resolved():
     """When shutil.which does find the binary, the warning banner must
     not appear — we don't want to cry wolf on successful installs."""

{getbased_agent_stack-0.5.5 → getbased_agent_stack-0.5.7}/tests/test_units.py

@@ -6,11 +6,6 @@ is contacted — these tests run on a dev laptop, CI, Windows, anywhere.
 """
 from __future__ import annotations
 
-from pathlib import Path
-from typing import Callable
-
-import pytest
-
 from getbased_agent_stack import units
 from getbased_agent_stack.units import CommandResult, SERVICE_NAMES, UnitManager
 
@@ -230,7 +225,7 @@ def test_uninstall_sequence(tmp_path):
 def test_uninstall_noop_when_nothing_installed(tmp_path):
     shell = FakeShell()
     mgr = UnitManager(unit_dir=tmp_path, shell=shell)
-    log = mgr.uninstall()
+    mgr.uninstall()
     # Disable is still attempted (safe) but no daemon-reload because no files removed
     reloads = [c for c in shell.calls if c == ["systemctl", "--user", "daemon-reload"]]
     assert reloads == []

getbased_agent_stack-0.5.5/src/getbased_agent_stack.egg-info/requires.txt

@@ -1,11 +0,0 @@
-getbased-mcp>=0.2.6
-getbased-rag>=0.7.2
-getbased-dashboard>=0.6.4
-
-[full]
-getbased-rag[full]>=0.7.2
-
-[test]
-pytest>=8.0
-httpx>=0.27
-pytest-timeout>=2.3