getbased-agent-stack 0.5.6__tar.gz → 0.5.8__tar.gz

{getbased_agent_stack-0.5.6 → getbased_agent_stack-0.5.8}/PKG-INFO

@@ -1,16 +1,16 @@
 Metadata-Version: 2.4
 Name: getbased-agent-stack
-Version: 0.5.6
+Version: 0.5.8
 Summary: One-command install of the full getbased agent stack — getbased-mcp + getbased-rag + getbased-dashboard
 License-Expression: AGPL-3.0-or-later
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: getbased-mcp>=0.2.6
-Requires-Dist: getbased-rag>=0.7.2
-Requires-Dist: getbased-dashboard>=0.6.5
+Requires-Dist: getbased-mcp>=0.2.8
+Requires-Dist: getbased-rag>=0.7.5
+Requires-Dist: getbased-dashboard>=0.6.7
 Provides-Extra: full
-Requires-Dist: getbased-rag[full]>=0.7.2; extra == "full"
+Requires-Dist: getbased-rag[full]>=0.7.5; extra == "full"
 Provides-Extra: test
 Requires-Dist: pytest>=8.0; extra == "test"
 Requires-Dist: httpx>=0.27; extra == "test"
@@ -19,7 +19,7 @@ Dynamic: license-file
 
 # getbased-agent-stack
 
-Meta-package bundling the full [getbased](https://getbased.health) agent stack into one install: the MCP adapter, the RAG engine, the browser dashboard, an orchestration CLI (`init` / `install` / `mcp-config`), hardened systemd units for rag + dashboard, and paste-ready configs for Claude Desktop/Code, Cursor, Cline, and Hermes.
+Meta-package bundling the full [getbased](https://getbased.health) agent stack into one install: the MCP adapter, the local knowledge server, the browser dashboard, an orchestration CLI (`init` / `install` / `connect` / `mcp-config`), systemd user units for the knowledge server + dashboard, and paste-ready configs for Claude Code, Claude Desktop, Cursor, Cline, Codex CLI, Hermes, and OpenClaw.
 
 Part of the [getbased-agents monorepo](https://github.com/elkimek/getbased-agents).
 
@@ -31,7 +31,15 @@ Linux, one command:
 curl -sSL https://getbased.health/install.sh | bash
 ```
 
-Runs end-to-end: installs `getbased-agent-stack[full]` via whichever of `uv` or `pipx` is available, exposes sibling binaries, runs `getbased-stack init --yes`, and starts rag + dashboard as systemd user services. [Read the script first](https://github.com/elkimek/get-based-site/blob/main/install.sh) if you're cautious.
+Runs end-to-end: installs `getbased-agent-stack[full]` via whichever of `uv` or `pipx` is available, exposes sibling binaries, runs a non-interactive local-only init, and starts the knowledge server + dashboard as systemd user services. [Read the script first](https://github.com/elkimek/get-based-site/blob/main/install.sh) if you're cautious.
+
+If you are connecting a private getbased profile, copy the command from **Settings → Agent Access** in the app. It uses the same installer and then runs `getbased-stack connect` for the selected client:
+
+```bash
+curl -fsSL https://getbased.health/install.sh | bash -s -- connect <target> --setup 'gbsetup_v1_...'
+```
+
+That setup payload contains private credentials. Keep it out of logs and public issues.
 
 Manual — pipx:
 
@@ -56,7 +64,7 @@ uv tool install \
 Pulls:
 
 - [`getbased-mcp`](https://github.com/elkimek/getbased-agents/tree/main/packages/mcp) — stdio MCP server that Claude Code / Hermes / OpenClaw spawn
-- [`getbased-rag`](https://github.com/elkimek/getbased-agents/tree/main/packages/rag) — local RAG knowledge server (FastAPI + Qdrant + MiniLM/BGE)
+- [`getbased-rag`](https://github.com/elkimek/getbased-agents/tree/main/packages/rag) — local knowledge server (FastAPI + Qdrant + MiniLM/BGE)
 - [`getbased-dashboard`](https://github.com/elkimek/getbased-agents/tree/main/packages/dashboard) — web UI for library management, MCP config generation, and agent-activity inspection
 - The `getbased-stack` discovery CLI
 - `[full]` extra: PDF/DOCX parsers + ONNX runtime for hardware-accelerated embeddings
@@ -74,7 +82,7 @@ getbased-stack init
 Non-interactive (for scripted installs and curl | bash; `install.sh` uses this):
 
 ```bash
-getbased-stack init --yes
+getbased-stack init --yes --local-only
 ```
 
 The wizard (~30 seconds):
@@ -86,10 +94,16 @@ The wizard (~30 seconds):
 
 On non-systemd hosts (Docker, macOS, WSL1) step 4 writes the unit files but skips activation with a clear message instead of crashing — re-run on a systemd-enabled host or start `lens serve` + `getbased-dashboard serve` manually.
 
-Then paste one line into your MCP client:
+Private setup from the app:
+
+```bash
+getbased-stack connect hermes --setup 'gbsetup_v1_...'
+```
+
+Manual config helper:
 
 ```bash
-getbased-stack mcp-config claude-desktop   # or: claude-code, cursor, cline, hermes
+getbased-stack mcp-config claude-desktop   # or: claude-code, cursor, cline, codex, hermes, openclaw
 ```
 
 The snippet carries only `GETBASED_STACK_MANAGED=1` in its env block. No secrets in client configs — every MCP spawn reads the shared env file and loads the token + rag URL + API key path from there.
@@ -144,7 +158,7 @@ Claude Code / Hermes / OpenClaw          Browser
    │        │                          │             │
    │ HTTP   │ HTTP                     │ proxies     │ spawns stdio for Test
    ▼        ▼                          ▼             ▼
-sync GW   getbased-rag  ◀──────────────┘       getbased-mcp
+context gateway   getbased-rag  ◀────────┘     getbased-mcp
           (localhost:8322)
 ```
 
@@ -162,6 +176,7 @@ The dashboard is likewise stateless — it proxies rag for Knowledge operations,
 | 0.1.x | ≥0.2.0 | ≥0.1.0 | — | v1 (multi-library) |
 | 0.2.x | ≥0.2.2 | ≥0.6.0 | ≥0.5.0 | v1 (+ streaming ingest, per-library models) |
 | 0.4.x | ≥0.2.3 | ≥0.7.1 | ≥0.6.1 | v1 (+ shared env file, `getbased-stack init`, systemd units) |
+| 0.5.x | ≥0.2.8 | ≥0.7.5 | ≥0.6.7 | v1 (+ `getbased-stack connect`, multi-client setup targets; explicit local-only scripted init) |
 
 Bump the meta's major when sibling protocols break; bump siblings freely for normal features.
 

getbased_agent_stack-0.5.6/src/getbased_agent_stack.egg-info/PKG-INFO → getbased_agent_stack-0.5.8/README.md

@@ -1,25 +1,6 @@
-Metadata-Version: 2.4
-Name: getbased-agent-stack
-Version: 0.5.6
-Summary: One-command install of the full getbased agent stack — getbased-mcp + getbased-rag + getbased-dashboard
-License-Expression: AGPL-3.0-or-later
-Requires-Python: >=3.10
-Description-Content-Type: text/markdown
-License-File: LICENSE
-Requires-Dist: getbased-mcp>=0.2.6
-Requires-Dist: getbased-rag>=0.7.2
-Requires-Dist: getbased-dashboard>=0.6.5
-Provides-Extra: full
-Requires-Dist: getbased-rag[full]>=0.7.2; extra == "full"
-Provides-Extra: test
-Requires-Dist: pytest>=8.0; extra == "test"
-Requires-Dist: httpx>=0.27; extra == "test"
-Requires-Dist: pytest-timeout>=2.3; extra == "test"
-Dynamic: license-file
-
 # getbased-agent-stack
 
-Meta-package bundling the full [getbased](https://getbased.health) agent stack into one install: the MCP adapter, the RAG engine, the browser dashboard, an orchestration CLI (`init` / `install` / `mcp-config`), hardened systemd units for rag + dashboard, and paste-ready configs for Claude Desktop/Code, Cursor, Cline, and Hermes.
+Meta-package bundling the full [getbased](https://getbased.health) agent stack into one install: the MCP adapter, the local knowledge server, the browser dashboard, an orchestration CLI (`init` / `install` / `connect` / `mcp-config`), systemd user units for the knowledge server + dashboard, and paste-ready configs for Claude Code, Claude Desktop, Cursor, Cline, Codex CLI, Hermes, and OpenClaw.
 
 Part of the [getbased-agents monorepo](https://github.com/elkimek/getbased-agents).
 
@@ -31,7 +12,15 @@ Linux, one command:
 curl -sSL https://getbased.health/install.sh | bash
 ```
 
-Runs end-to-end: installs `getbased-agent-stack[full]` via whichever of `uv` or `pipx` is available, exposes sibling binaries, runs `getbased-stack init --yes`, and starts rag + dashboard as systemd user services. [Read the script first](https://github.com/elkimek/get-based-site/blob/main/install.sh) if you're cautious.
+Runs end-to-end: installs `getbased-agent-stack[full]` via whichever of `uv` or `pipx` is available, exposes sibling binaries, runs a non-interactive local-only init, and starts the knowledge server + dashboard as systemd user services. [Read the script first](https://github.com/elkimek/get-based-site/blob/main/install.sh) if you're cautious.
+
+If you are connecting a private getbased profile, copy the command from **Settings → Agent Access** in the app. It uses the same installer and then runs `getbased-stack connect` for the selected client:
+
+```bash
+curl -fsSL https://getbased.health/install.sh | bash -s -- connect <target> --setup 'gbsetup_v1_...'
+```
+
+That setup payload contains private credentials. Keep it out of logs and public issues.
 
 Manual — pipx:
 
@@ -56,7 +45,7 @@ uv tool install \
 Pulls:
 
 - [`getbased-mcp`](https://github.com/elkimek/getbased-agents/tree/main/packages/mcp) — stdio MCP server that Claude Code / Hermes / OpenClaw spawn
-- [`getbased-rag`](https://github.com/elkimek/getbased-agents/tree/main/packages/rag) — local RAG knowledge server (FastAPI + Qdrant + MiniLM/BGE)
+- [`getbased-rag`](https://github.com/elkimek/getbased-agents/tree/main/packages/rag) — local knowledge server (FastAPI + Qdrant + MiniLM/BGE)
 - [`getbased-dashboard`](https://github.com/elkimek/getbased-agents/tree/main/packages/dashboard) — web UI for library management, MCP config generation, and agent-activity inspection
 - The `getbased-stack` discovery CLI
 - `[full]` extra: PDF/DOCX parsers + ONNX runtime for hardware-accelerated embeddings
@@ -74,7 +63,7 @@ getbased-stack init
 Non-interactive (for scripted installs and curl | bash; `install.sh` uses this):
 
 ```bash
-getbased-stack init --yes
+getbased-stack init --yes --local-only
 ```
 
 The wizard (~30 seconds):
@@ -86,10 +75,16 @@ The wizard (~30 seconds):
 
 On non-systemd hosts (Docker, macOS, WSL1) step 4 writes the unit files but skips activation with a clear message instead of crashing — re-run on a systemd-enabled host or start `lens serve` + `getbased-dashboard serve` manually.
 
-Then paste one line into your MCP client:
+Private setup from the app:
+
+```bash
+getbased-stack connect hermes --setup 'gbsetup_v1_...'
+```
+
+Manual config helper:
 
 ```bash
-getbased-stack mcp-config claude-desktop   # or: claude-code, cursor, cline, hermes
+getbased-stack mcp-config claude-desktop   # or: claude-code, cursor, cline, codex, hermes, openclaw
 ```
 
 The snippet carries only `GETBASED_STACK_MANAGED=1` in its env block. No secrets in client configs — every MCP spawn reads the shared env file and loads the token + rag URL + API key path from there.
@@ -144,7 +139,7 @@ Claude Code / Hermes / OpenClaw          Browser
    │        │                          │             │
    │ HTTP   │ HTTP                     │ proxies     │ spawns stdio for Test
    ▼        ▼                          ▼             ▼
-sync GW   getbased-rag  ◀──────────────┘       getbased-mcp
+context gateway   getbased-rag  ◀────────┘     getbased-mcp
           (localhost:8322)
 ```
 
@@ -162,6 +157,7 @@ The dashboard is likewise stateless — it proxies rag for Knowledge operations,
 | 0.1.x | ≥0.2.0 | ≥0.1.0 | — | v1 (multi-library) |
 | 0.2.x | ≥0.2.2 | ≥0.6.0 | ≥0.5.0 | v1 (+ streaming ingest, per-library models) |
 | 0.4.x | ≥0.2.3 | ≥0.7.1 | ≥0.6.1 | v1 (+ shared env file, `getbased-stack init`, systemd units) |
+| 0.5.x | ≥0.2.8 | ≥0.7.5 | ≥0.6.7 | v1 (+ `getbased-stack connect`, multi-client setup targets; explicit local-only scripted init) |
 
 Bump the meta's major when sibling protocols break; bump siblings freely for normal features.
 

{getbased_agent_stack-0.5.6 → getbased_agent_stack-0.5.8}/pyproject.toml

@@ -1,10 +1,10 @@
 [build-system]
-requires = ["setuptools>=68.0", "wheel"]
+requires = ["setuptools>=83.0.0", "wheel"]
 build-backend = "setuptools.build_meta"
 
 [project]
 name = "getbased-agent-stack"
-version = "0.5.6"
+version = "0.5.8"
 description = "One-command install of the full getbased agent stack — getbased-mcp + getbased-rag + getbased-dashboard"
 readme = "README.md"
 license = "AGPL-3.0-or-later"
@@ -12,15 +12,15 @@ requires-python = ">=3.10"
 # Pulls every sibling package. Bump this meta when a sibling protocol
 # bump requires coordinated release.
 dependencies = [
-    "getbased-mcp>=0.2.6",
-    "getbased-rag>=0.7.2",
-    "getbased-dashboard>=0.6.5",
+    "getbased-mcp>=0.2.8",
+    "getbased-rag>=0.7.5",
+    "getbased-dashboard>=0.6.7",
 ]
 
 [project.optional-dependencies]
 # `full` includes PDF/DOCX parsers and ONNX acceleration (pre-exported
 # weights — no PyTorch/transformers/optimum dance).
-full = ["getbased-rag[full]>=0.7.2"]
+full = ["getbased-rag[full]>=0.7.5"]
 # For contributors running the integration test harness.
 test = ["pytest>=8.0", "httpx>=0.27", "pytest-timeout>=2.3"]
 

{getbased_agent_stack-0.5.6 → getbased_agent_stack-0.5.8}/src/getbased_agent_stack/__init__.py

@@ -5,4 +5,4 @@ plus a small CLI that proxies to the real binaries. Everything
 interesting lives in the sibling repos.
 """
 
-__version__ = "0.5.6"
+__version__ = "0.5.8"

{getbased_agent_stack-0.5.6 → getbased_agent_stack-0.5.8}/src/getbased_agent_stack/cli.py

@@ -1,7 +1,7 @@
 """getbased-stack — orchestration CLI.
 
 Subcommands:
-  init           — interactive one-time setup: token, API key, systemd units
+  init           — interactive one-time setup: API key, systemd units
   install        — install/refresh the bundled systemd user units
   uninstall      — stop, disable, and remove the systemd units
   status         — show env file, units, and linger state
@@ -93,6 +93,7 @@ def cmd_init(args: argparse.Namespace) -> int:
     # for scripted installs (curl | bash) where stdin is unavailable and
     # the EOF-returns-default path still triggers a getpass echo warning.
     non_interactive = getattr(args, "yes", False)
+    local_only = getattr(args, "local_only", False)
 
     print("getbased-stack init — one-time setup")
     if non_interactive:
@@ -110,21 +111,43 @@ def cmd_init(args: argparse.Namespace) -> int:
     masked = "****" + current_token[-4:] if current_token else "(unset)"
     key_masked = "****" + current_context_key[-4:] if current_context_key else "(unset)"
     print(f"[1/4] Agent Access token + context key (token: {masked}, key: {key_masked})")
-    if non_interactive:
-        token = current_token
-        context_key = current_context_key
-        print("  keeping current values (set with `getbased-stack set GETBASED_TOKEN=…` and `getbased-stack set GETBASED_AGENT_CONTEXT_KEY=…` later).")
-    else:
-        token = _prompt(
-            "Paste GETBASED_TOKEN (press Enter to keep current / skip)",
-            default=current_token,
-            secret=True,
+    token = current_token
+    context_key = current_context_key
+    gateway = existing.get("GETBASED_GATEWAY", "")
+    setup_code = (getattr(args, "setup", "") or "").strip()
+    if setup_code:
+        try:
+            setup_values = _decode_setup_payload(setup_code)
+        except ValueError as e:
+            print(f"Invalid setup: {e}", file=sys.stderr)
+            return 2
+        token = setup_values["token"]
+        context_key = setup_values["context_key"]
+        gateway = setup_values["gateway"]
+        print("  setup code accepted — Agent Access credentials will be stored.")
+    elif token and context_key:
+        print("  existing Agent Access credentials found — keeping them.")
+    elif local_only:
+        print(
+            "  no complete Agent Access credentials yet — continuing local-only. "
+            "Blood-work Agent Access tools stay disabled until you run "
+            "`getbased-stack connect hermes --setup gbsetup_v1_…` or rerun "
+            "`getbased-stack init --setup gbsetup_v1_…`."
         )
-        context_key = _prompt(
-            "Paste GETBASED_AGENT_CONTEXT_KEY (press Enter to keep current / skip)",
-            default=current_context_key,
-            secret=True,
+    elif non_interactive:
+        print(
+            "  Agent Access setup code required for non-interactive first-run setup. "
+            "Pass `--setup gbsetup_v1_…`, or add `--local-only` to install only "
+            "rag/dashboard without Agent Access."
+        )
+        return 2
+    else:
+        print(
+            "  Agent Access setup code required for full first-run setup. Rerun "
+            "with `getbased-stack init --setup gbsetup_v1_…`, or pass "
+            "`--local-only` if you only want rag/dashboard without Agent Access."
         )
+        return 2
 
     # 2. API key
     key_path = Path(existing.get("LENS_API_KEY_FILE", str(_default_api_key_file())))
@@ -144,6 +167,8 @@ def cmd_init(args: argparse.Namespace) -> int:
         merged["GETBASED_TOKEN"] = token
     if context_key:
         merged["GETBASED_AGENT_CONTEXT_KEY"] = context_key
+    if gateway:
+        merged["GETBASED_GATEWAY"] = gateway
     merged["LENS_API_KEY_FILE"] = str(key_path)
     merged.setdefault("LENS_URL", "http://127.0.0.1:8322")
     path = env_file.write_env_file(merged)
@@ -166,17 +191,20 @@ def cmd_init(args: argparse.Namespace) -> int:
     _print_linger_hint(strict=False)
 
     # 6. MCP config pointers
-    print("\nNext steps for Agent Access:")
-    print("  1. In getbased, enable Cross-device Sync and Agent Access.")
-    print("  2. Copy both values from Settings → Agent Access:")
-    print("     GETBASED_TOKEN and GETBASED_AGENT_CONTEXT_KEY.")
-    print("  3. Save them here with:")
-    print("     getbased-stack set GETBASED_TOKEN=...")
-    print("     getbased-stack set GETBASED_AGENT_CONTEXT_KEY=...")
-
-    print("\nConfigure your MCP client(s):")
-    for client in mcp_configs.SUPPORTED_CLIENTS:
-        print(f"  getbased-stack mcp-config {client}")
+    if token and context_key:
+        print("\nAgent Access credentials are configured ✓")
+        print("  Generate or refresh client config with:")
+        for client in mcp_configs.SUPPORTED_CLIENTS:
+            print(f"    getbased-stack mcp-config {client}")
+    else:
+        print("\nNext steps for Agent Access:")
+        print("  1. In getbased, enable Cross-device Sync and Agent Access.")
+        print("  2. Copy the private setup code from Settings → Agent Access.")
+        print("  3. Store it here and register your MCP client with:")
+        print("     getbased-stack connect hermes --setup gbsetup_v1_...")
+        print("  4. Or generate a manual client config with:")
+        for client in mcp_configs.SUPPORTED_CLIENTS:
+            print(f"     getbased-stack mcp-config {client}")
 
     return 0
 
@@ -483,7 +511,7 @@ def build_parser() -> argparse.ArgumentParser:
     sub = p.add_subparsers(dest="command")
 
     pinit = sub.add_parser(
-        "init", help="Interactive one-time setup (token, API key, units)."
+        "init", help="Interactive one-time setup (API key, units)."
     )
     pinit.add_argument(
         "-y",
@@ -491,6 +519,16 @@ def build_parser() -> argparse.ArgumentParser:
         action="store_true",
         help="Non-interactive: take defaults on every prompt. Use for scripted installs.",
     )
+    pinit.add_argument(
+        "--setup",
+        default="",
+        help="Private gbsetup_v1_... setup code from getbased Settings → Agent Access.",
+    )
+    pinit.add_argument(
+        "--local-only",
+        action="store_true",
+        help="Install rag/dashboard without Agent Access credentials; run connect later.",
+    )
 
     pi = sub.add_parser("install", help="Install + start the systemd user units.")
     pi.add_argument("--no-enable", action="store_true", help="Copy files only; don't enable.")

{getbased_agent_stack-0.5.6 → getbased_agent_stack-0.5.8}/src/getbased_agent_stack/env_file.py

@@ -10,7 +10,6 @@ from __future__ import annotations
 
 import os
 from pathlib import Path
-from typing import Iterable
 
 
 ENV_PATH_COMMENT = """\

{getbased_agent_stack-0.5.6 → getbased_agent_stack-0.5.8}/src/getbased_agent_stack/mcp_configs.py

@@ -215,22 +215,19 @@ def emit_hermes(resolver: Callable[[str], "str | None"] = shutil.which) -> str:
 
 def emit(client: str, resolver: Callable[[str], "str | None"] = shutil.which) -> str:
     """Dispatch to the right emitter. Raises ValueError on unknown client."""
-    match client:
-        case "claude-desktop":
-            return emit_claude_desktop(resolver)
-        case "claude-code":
-            return emit_claude_code(resolver)
-        case "cursor":
-            return emit_cursor(resolver)
-        case "cline":
-            return emit_cline(resolver)
-        case "hermes":
-            return emit_hermes(resolver)
-        case "openclaw":
-            return emit_openclaw(resolver)
-        case "codex":
-            return emit_codex(resolver)
-        case _:
-            raise ValueError(
-                f"unknown client {client!r}. Supported: {', '.join(SUPPORTED_CLIENTS)}"
-            )
+    emitters = {
+        "claude-desktop": emit_claude_desktop,
+        "claude-code": emit_claude_code,
+        "cursor": emit_cursor,
+        "cline": emit_cline,
+        "hermes": emit_hermes,
+        "openclaw": emit_openclaw,
+        "codex": emit_codex,
+    }
+    try:
+        emitter = emitters[client]
+    except KeyError as e:
+        raise ValueError(
+            f"unknown client {client!r}. Supported: {', '.join(SUPPORTED_CLIENTS)}"
+        ) from e
+    return emitter(resolver)

{getbased_agent_stack-0.5.6 → getbased_agent_stack-0.5.8}/src/getbased_agent_stack/units.py

@@ -13,7 +13,7 @@ import subprocess
 from dataclasses import dataclass
 from importlib import resources
 from pathlib import Path
-from typing import Callable, Iterable
+from typing import Callable
 
 # Units this package ships. Order matters for start: rag first (dashboard
 # Wants=+After= rag), so systemctl picks the right order naturally anyway.

getbased_agent_stack-0.5.6/README.md → getbased_agent_stack-0.5.8/src/getbased_agent_stack.egg-info/PKG-INFO

@@ -1,6 +1,25 @@
+Metadata-Version: 2.4
+Name: getbased-agent-stack
+Version: 0.5.8
+Summary: One-command install of the full getbased agent stack — getbased-mcp + getbased-rag + getbased-dashboard
+License-Expression: AGPL-3.0-or-later
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: getbased-mcp>=0.2.8
+Requires-Dist: getbased-rag>=0.7.5
+Requires-Dist: getbased-dashboard>=0.6.7
+Provides-Extra: full
+Requires-Dist: getbased-rag[full]>=0.7.5; extra == "full"
+Provides-Extra: test
+Requires-Dist: pytest>=8.0; extra == "test"
+Requires-Dist: httpx>=0.27; extra == "test"
+Requires-Dist: pytest-timeout>=2.3; extra == "test"
+Dynamic: license-file
+
 # getbased-agent-stack
 
-Meta-package bundling the full [getbased](https://getbased.health) agent stack into one install: the MCP adapter, the RAG engine, the browser dashboard, an orchestration CLI (`init` / `install` / `mcp-config`), hardened systemd units for rag + dashboard, and paste-ready configs for Claude Desktop/Code, Cursor, Cline, and Hermes.
+Meta-package bundling the full [getbased](https://getbased.health) agent stack into one install: the MCP adapter, the local knowledge server, the browser dashboard, an orchestration CLI (`init` / `install` / `connect` / `mcp-config`), systemd user units for the knowledge server + dashboard, and paste-ready configs for Claude Code, Claude Desktop, Cursor, Cline, Codex CLI, Hermes, and OpenClaw.
 
 Part of the [getbased-agents monorepo](https://github.com/elkimek/getbased-agents).
 
@@ -12,7 +31,15 @@ Linux, one command:
 curl -sSL https://getbased.health/install.sh | bash
 ```
 
-Runs end-to-end: installs `getbased-agent-stack[full]` via whichever of `uv` or `pipx` is available, exposes sibling binaries, runs `getbased-stack init --yes`, and starts rag + dashboard as systemd user services. [Read the script first](https://github.com/elkimek/get-based-site/blob/main/install.sh) if you're cautious.
+Runs end-to-end: installs `getbased-agent-stack[full]` via whichever of `uv` or `pipx` is available, exposes sibling binaries, runs a non-interactive local-only init, and starts the knowledge server + dashboard as systemd user services. [Read the script first](https://github.com/elkimek/get-based-site/blob/main/install.sh) if you're cautious.
+
+If you are connecting a private getbased profile, copy the command from **Settings → Agent Access** in the app. It uses the same installer and then runs `getbased-stack connect` for the selected client:
+
+```bash
+curl -fsSL https://getbased.health/install.sh | bash -s -- connect <target> --setup 'gbsetup_v1_...'
+```
+
+That setup payload contains private credentials. Keep it out of logs and public issues.
 
 Manual — pipx:
 
@@ -37,7 +64,7 @@ uv tool install \
 Pulls:
 
 - [`getbased-mcp`](https://github.com/elkimek/getbased-agents/tree/main/packages/mcp) — stdio MCP server that Claude Code / Hermes / OpenClaw spawn
-- [`getbased-rag`](https://github.com/elkimek/getbased-agents/tree/main/packages/rag) — local RAG knowledge server (FastAPI + Qdrant + MiniLM/BGE)
+- [`getbased-rag`](https://github.com/elkimek/getbased-agents/tree/main/packages/rag) — local knowledge server (FastAPI + Qdrant + MiniLM/BGE)
 - [`getbased-dashboard`](https://github.com/elkimek/getbased-agents/tree/main/packages/dashboard) — web UI for library management, MCP config generation, and agent-activity inspection
 - The `getbased-stack` discovery CLI
 - `[full]` extra: PDF/DOCX parsers + ONNX runtime for hardware-accelerated embeddings
@@ -55,7 +82,7 @@ getbased-stack init
 Non-interactive (for scripted installs and curl | bash; `install.sh` uses this):
 
 ```bash
-getbased-stack init --yes
+getbased-stack init --yes --local-only
 ```
 
 The wizard (~30 seconds):
@@ -67,10 +94,16 @@ The wizard (~30 seconds):
 
 On non-systemd hosts (Docker, macOS, WSL1) step 4 writes the unit files but skips activation with a clear message instead of crashing — re-run on a systemd-enabled host or start `lens serve` + `getbased-dashboard serve` manually.
 
-Then paste one line into your MCP client:
+Private setup from the app:
+
+```bash
+getbased-stack connect hermes --setup 'gbsetup_v1_...'
+```
+
+Manual config helper:
 
 ```bash
-getbased-stack mcp-config claude-desktop   # or: claude-code, cursor, cline, hermes
+getbased-stack mcp-config claude-desktop   # or: claude-code, cursor, cline, codex, hermes, openclaw
 ```
 
 The snippet carries only `GETBASED_STACK_MANAGED=1` in its env block. No secrets in client configs — every MCP spawn reads the shared env file and loads the token + rag URL + API key path from there.
@@ -125,7 +158,7 @@ Claude Code / Hermes / OpenClaw          Browser
    │        │                          │             │
    │ HTTP   │ HTTP                     │ proxies     │ spawns stdio for Test
    ▼        ▼                          ▼             ▼
-sync GW   getbased-rag  ◀──────────────┘       getbased-mcp
+context gateway   getbased-rag  ◀────────┘     getbased-mcp
           (localhost:8322)
 ```
 
@@ -143,6 +176,7 @@ The dashboard is likewise stateless — it proxies rag for Knowledge operations,
 | 0.1.x | ≥0.2.0 | ≥0.1.0 | — | v1 (multi-library) |
 | 0.2.x | ≥0.2.2 | ≥0.6.0 | ≥0.5.0 | v1 (+ streaming ingest, per-library models) |
 | 0.4.x | ≥0.2.3 | ≥0.7.1 | ≥0.6.1 | v1 (+ shared env file, `getbased-stack init`, systemd units) |
+| 0.5.x | ≥0.2.8 | ≥0.7.5 | ≥0.6.7 | v1 (+ `getbased-stack connect`, multi-client setup targets; explicit local-only scripted init) |
 
 Bump the meta's major when sibling protocols break; bump siblings freely for normal features.
 

getbased_agent_stack-0.5.8/src/getbased_agent_stack.egg-info/requires.txt

@@ -0,0 +1,11 @@
+getbased-mcp>=0.2.8
+getbased-rag>=0.7.5
+getbased-dashboard>=0.6.7
+
+[full]
+getbased-rag[full]>=0.7.5
+
+[test]
+pytest>=8.0
+httpx>=0.27
+pytest-timeout>=2.3

{getbased_agent_stack-0.5.6 → getbased_agent_stack-0.5.8}/tests/test_cli.py

@@ -14,7 +14,7 @@ from pathlib import Path
 import pytest
 
 from getbased_agent_stack import cli, env_file, units
-from getbased_agent_stack.units import CommandResult, UnitManager
+from getbased_agent_stack.units import CommandResult
 
 
 @pytest.fixture
@@ -351,6 +351,14 @@ def test_connect_skips_gateway_restart_when_running_inside_hermes(stack_home, mo
 # ── init (non-interactive via EOF on stdin) ───────────────────────────
 
 
+def test_init_requires_setup_or_local_only_on_clean_interactive_run(stack_home, fake_shell):
+    rc, out, _ = _run(["init"])
+    assert rc == 2
+    assert "--setup" in out
+    assert "--local-only" in out
+    assert env_file.read_env_file() == {}
+
+
 def test_init_idempotent_with_empty_input(stack_home, fake_shell, monkeypatch):
     """Feed EOF for every prompt: init should complete using defaults
     without crashing. This validates the wizard is non-blocking when
@@ -359,7 +367,7 @@ def test_init_idempotent_with_empty_input(stack_home, fake_shell, monkeypatch):
     monkeypatch.setattr("builtins.input", lambda *a, **kw: "")
     monkeypatch.setattr("getpass.getpass", lambda *a, **kw: "")
 
-    rc, out, _ = _run(["init"])
+    rc, out, _ = _run(["init", "--local-only"])
     assert rc == 0
     # Env file created
     path = env_file.env_file_path()
@@ -373,32 +381,46 @@ def test_init_idempotent_with_empty_input(stack_home, fake_shell, monkeypatch):
 
 
 def test_init_preserves_existing_token(stack_home, fake_shell, monkeypatch):
-    """Re-running init with EOF on token prompt must not wipe the stored
-    value. The wizard uses the previous token as default."""
+    """Re-running init must not wipe an explicitly stored token."""
     env_file.write_env_file(
         {"GETBASED_TOKEN": "preserved_value", "GETBASED_STACK_MANAGED": "1"}
     )
     monkeypatch.setattr("builtins.input", lambda *a, **kw: "")
     monkeypatch.setattr("getpass.getpass", lambda *a, **kw: "")
 
-    _run(["init"])
+    _run(["init", "--local-only"])
     assert env_file.read_env_file()["GETBASED_TOKEN"] == "preserved_value"
 
 
-def test_init_accepts_new_token(stack_home, fake_shell, monkeypatch):
+def test_init_accepts_setup_blob(stack_home, fake_shell, monkeypatch):
+    """First-run init can store the private Agent Access setup code without
+    prompting for raw token/context-key values separately."""
     inputs = iter([""])  # accept install prompt with default
     monkeypatch.setattr("builtins.input", lambda *a, **kw: next(inputs, ""))
-    monkeypatch.setattr("getpass.getpass", lambda *a, **kw: "brand_new_token")
+    monkeypatch.setattr(
+        "getpass.getpass",
+        lambda *a, **kw: (_ for _ in ()).throw(AssertionError("getpass called")),
+    )
 
-    _run(["init"])
-    assert env_file.read_env_file()["GETBASED_TOKEN"] == "brand_new_token"
+    rc, out, err = _run([
+        "init",
+        "--setup",
+        _setup_blob(token="brand_new_token", context_key="ctx_new", gateway="https://sync.example"),
+    ])
+    assert rc == 0, err
+    data = env_file.read_env_file()
+    assert data["GETBASED_TOKEN"] == "brand_new_token"
+    assert data["GETBASED_AGENT_CONTEXT_KEY"] == "ctx_new"
+    assert data["GETBASED_GATEWAY"] == "https://sync.example"
+    assert "brand_new_token" not in out
+    assert "ctx_new" not in out
 
 
 def test_init_generates_api_key(stack_home, fake_shell, monkeypatch):
     monkeypatch.setattr("builtins.input", lambda *a, **kw: "")
     monkeypatch.setattr("getpass.getpass", lambda *a, **kw: "")
 
-    _run(["init"])
+    _run(["init", "--local-only"])
     key_file = Path(env_file.read_env_file()["LENS_API_KEY_FILE"])
     assert key_file.exists()
     key = key_file.read_text().strip()
@@ -419,15 +441,14 @@ def test_init_reuses_existing_api_key(stack_home, fake_shell, monkeypatch):
     monkeypatch.setattr("builtins.input", lambda *a, **kw: "")
     monkeypatch.setattr("getpass.getpass", lambda *a, **kw: "")
 
-    _run(["init"])
+    _run(["init", "--local-only"])
     assert key_path.read_text().strip() == "preexisting_key"
 
 
-def test_init_yes_flag_skips_all_prompts(stack_home, fake_shell, monkeypatch):
+def test_init_yes_requires_setup_or_local_only_without_prompts(stack_home, fake_shell, monkeypatch):
     """`init --yes` must not call input() or getpass() at all. Scripted
-    installers (curl | bash) can't service prompts and the EOF fallback
-    triggers a Python getpass echo warning that pollutes output.
-    Strict assertion: any prompt call fails the test."""
+    installers (curl | bash) cannot service prompts, so a clean full setup
+    needs --setup; local-only installs must say so explicitly."""
     def _forbid_input(*a, **kw):
         raise AssertionError("input() called under --yes")
 
@@ -438,24 +459,25 @@ def test_init_yes_flag_skips_all_prompts(stack_home, fake_shell, monkeypatch):
     monkeypatch.setattr("getpass.getpass", _forbid_getpass)
 
     rc, out, _ = _run(["init", "--yes"])
-    assert rc == 0
+    assert rc == 2
     # Banner reflects the mode so the user sees what happened
     assert "non-interactive" in out.lower()
-    assert "GETBASED_TOKEN and GETBASED_AGENT_CONTEXT_KEY" in out
-    assert "getbased-stack set GETBASED_AGENT_CONTEXT_KEY" in out
-    # Env file + units still land
-    assert env_file.env_file_path().exists()
-    assert (stack_home / "config" / "systemd" / "user" / "getbased-rag.service").exists()
-
-
-def test_init_yes_installs_units_without_asking(stack_home, fake_shell, monkeypatch):
-    """Default for the install-units prompt is Yes, so --yes must also
-    install + start. If this regressed to skip, install.sh would
-    silently leave services off."""
+    assert "--setup" in out
+    assert "--local-only" in out
+    # A successful-looking first-run install without credentials would leave
+    # Agent Access broken, so --yes must stop before writing env/units unless
+    # the caller explicitly opts into --local-only.
+    assert not env_file.env_file_path().exists()
+    assert not (stack_home / "config" / "systemd" / "user" / "getbased-rag.service").exists()
+
+
+def test_init_yes_local_only_installs_units_without_asking(stack_home, fake_shell, monkeypatch):
+    """When the caller explicitly chooses local-only, --yes must install
+    + start without prompting."""
     monkeypatch.setattr("builtins.input", lambda *a, **kw: "")
     monkeypatch.setattr("getpass.getpass", lambda *a, **kw: "")
 
-    _run(["init", "--yes"])
+    _run(["init", "--yes", "--local-only"])
     # UnitManager.install() writes service files under XDG_CONFIG_HOME
     assert (stack_home / "config" / "systemd" / "user" / "getbased-rag.service").exists()
     assert (stack_home / "config" / "systemd" / "user" / "getbased-dashboard.service").exists()
@@ -471,7 +493,7 @@ def test_init_yes_survives_missing_systemctl(stack_home, fake_shell, monkeypatch
     monkeypatch.setattr("builtins.input", lambda *a, **kw: "")
     monkeypatch.setattr("getpass.getpass", lambda *a, **kw: "")
 
-    rc, out, _ = _run(["init", "--yes"])
+    rc, out, _ = _run(["init", "--yes", "--local-only"])
     assert rc == 0
     # Unit files still written (for re-run on a systemd-enabled host)
     assert (stack_home / "config" / "systemd" / "user" / "getbased-rag.service").exists()
@@ -484,7 +506,11 @@ def test_init_yes_preserves_existing_token(stack_home, fake_shell, monkeypatch):
     """Non-interactive mode must not nuke a previously-saved token —
     it takes the 'keep current' default, same as pressing Enter."""
     env_file.write_env_file(
-        {"GETBASED_TOKEN": "keep_me", "GETBASED_STACK_MANAGED": "1"}
+        {
+            "GETBASED_TOKEN": "keep_me",
+            "GETBASED_AGENT_CONTEXT_KEY": "ctx_keep",
+            "GETBASED_STACK_MANAGED": "1",
+        }
     )
     # No input/getpass expected, but stub defensively in case a future
     # code path adds an unguarded prompt — test still catches it.
@@ -501,10 +527,10 @@ def test_init_is_reentrant(stack_home, fake_shell, monkeypatch):
     monkeypatch.setattr("builtins.input", lambda *a, **kw: "")
     monkeypatch.setattr("getpass.getpass", lambda *a, **kw: "")
 
-    _run(["init"])
+    _run(["init", "--local-only"])
     key1 = (stack_home / "data" / "getbased" / "lens" / "api_key").read_text()
 
-    _run(["init"])
+    _run(["init", "--local-only"])
     key2 = (stack_home / "data" / "getbased" / "lens" / "api_key").read_text()
 
     assert key1 == key2, "init must not rotate an existing API key"

{getbased_agent_stack-0.5.6 → getbased_agent_stack-0.5.8}/tests/test_units.py

@@ -6,11 +6,6 @@ is contacted — these tests run on a dev laptop, CI, Windows, anywhere.
 """
 from __future__ import annotations
 
-from pathlib import Path
-from typing import Callable
-
-import pytest
-
 from getbased_agent_stack import units
 from getbased_agent_stack.units import CommandResult, SERVICE_NAMES, UnitManager
 
@@ -230,7 +225,7 @@ def test_uninstall_sequence(tmp_path):
 def test_uninstall_noop_when_nothing_installed(tmp_path):
     shell = FakeShell()
     mgr = UnitManager(unit_dir=tmp_path, shell=shell)
-    log = mgr.uninstall()
+    mgr.uninstall()
     # Disable is still attempted (safe) but no daemon-reload because no files removed
     reloads = [c for c in shell.calls if c == ["systemctl", "--user", "daemon-reload"]]
     assert reloads == []

getbased_agent_stack-0.5.6/src/getbased_agent_stack.egg-info/requires.txt

@@ -1,11 +0,0 @@
-getbased-mcp>=0.2.6
-getbased-rag>=0.7.2
-getbased-dashboard>=0.6.5
-
-[full]
-getbased-rag[full]>=0.7.2
-
-[test]
-pytest>=8.0
-httpx>=0.27
-pytest-timeout>=2.3