mirror of
https://github.com/garrytan/gbrain.git
synced 2026-07-27 22:15:33 +00:00
* fix: gbrain auth create dropped the name on the bare (no-flag) form Extract parseAuthCreateArgs; only exclude the --takes-holders value from the positional search when the flag is present (rest[takesIdx+1] resolved to rest[0] when takesIdx === -1, silently dropping the name). Add regression test. * feat: gbrain connect — one-command Claude Code onboarding from a bearer token New connect command prints a paste-ready claude-mcp-add block (or --install wires it + smoke-tests the token via a raw-bearer get_brain_identity probe). Direct HTTP MCP, literal-token default, URL normalization, token header-injection guard, --json redaction, execFileSync (no shell). Wired into CLI_ONLY + CLI_ONLY_SELF_HELP + handleCliOnly. 58 unit + 3 PGLite-E2E cases; e2e-test-map updated. * docs: lead CLAUDE_CODE.md with gbrain connect (remote fast path) + README one-liner Regenerate llms-full.txt for the README change. * refactor: pre-landing review fixes for gbrain connect - DRY: single DEFAULT_PROBE_TIMEOUT_MS + shared isAuthErrorMessage predicate - reuse promptLine (shared stdin lifecycle) for the --install confirm - harden redactToken with a Bearer <value> scrub (defense in depth) - +8 tests: orchestrator guard paths, deterministic timeout, invalid --timeout-ms, Bearer-redaction * fix: adversarial-review hardening for gbrain connect - probe: Promise.race the call against a real timer so a stalled connect()/SSE handshake (signal alone doesn't cover it) can't hang --install indefinitely - probe: close transport even if client.connect() throws - parseArgs: reject a missing/flag-shaped value (e.g. --token --install) - block link-local / cloud-metadata hosts (169.254/fe80:/fd00:ec2::254) — keeps localhost + RFC1918 LAN brains working - non-interactive --install now requires --yes - clearer message when --force removed then add failed +8 tests covering each * fix: codex-review P2s for gbrain connect - POSIX single-quote the rendered claude-mcp-add command so a token with shell metacharacters ($(), backticks) can't trigger command substitution on paste - detect IPv4-mapped IPv6 metadata addresses (::ffff:169.254.x.x / ::ffff:a9fe:*) so they don't bypass the link-local guard +3 tests * chore: bump version and changelog (v0.42.2.0) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: document gbrain connect + connect-probe in CLAUDE.md Key files (v0.42.2.0) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat: gbrain connect — add codex and perplexity agents --agent codex emits 'codex mcp add ... --bearer-token-env-var GBRAIN_REMOTE_TOKEN' (token read from the env var at runtime, never in Codex config; --install runs it). --agent perplexity prints the URL + token for the Settings → Connectors GUI (no --install). Generalized the command file: AGENT_SPECS table, buildCodexMcpAddArgv, cmdString(binary,argv), binary-generic ConnectDeps (hasBinary/runBinary/env), agent-aware buildConnectBlock/buildJson. +25 tests. * docs: codex + perplexity connect paths (new CODEX.md, README, CHANGELOG, CLAUDE.md) Regenerate llms-full.txt for the CLAUDE.md/README edits. * test: real-CLI E2E for connect — drive actual claude + codex against a live server Adds claude-code + codex cases to connect-bearer.test.ts that run the real 'claude mcp add' / 'codex mcp add' through 'gbrain connect --install' against a live 'gbrain serve --http' (sandboxed HOME/CODEX_HOME), then assert via 'claude mcp get' / 'codex mcp get' that the server registered (and codex's token stays out of config). Skips when the binary is absent. Perplexity is GUI-only so it's print-asserted. Regen llms for the CLAUDE.md note. * docs: perplexity OAuth + serve --bind/--public-url footgun (per Perplexity feedback) PERPLEXITY.md now documents the host-side HTTP setup (gbrain serve --http --bind 0.0.0.0 --public-url, the v0.34 ECONNREFUSED footgun) and the OAuth 2.1 client_credentials path (gbrain auth register-client) alongside the legacy bearer token. The 'connect --agent perplexity' output points at the same bind/public-url requirement + PERPLEXITY.md. * feat: gbrain connect --oauth — client-credentials path for perplexity/generic OAuth is the correct path for a third-party cloud connector (Perplexity): instead of a long-lived full-access bearer token, the connector gets Issuer URL + Client ID + Client Secret and mints short-lived scoped tokens. --oauth --register mints a least-privilege client on the host (shells gbrain auth register-client); --oauth --client-id/--client-secret uses an existing one. Rejected for claude-code/codex (bearer) and with --install. Issuer derived from the mcp-url. New E2E proves the full chain: register → connect --oauth → OAuth discovery → /token client_credentials mint → get_brain_identity tool call against a live server. Docs: PERPLEXITY.md leads with OAuth; README + CLAUDE.md updated; +18 unit cases. * docs: add gbrain connect to INSTALL.md MCP section + link CODEX.md The remote-client onboarding command was documented in README/CLAUDE_CODE/CODEX/ PERPLEXITY but missing from INSTALL.md §3 (the natural 'how do I connect a client' home). Add the one-command connect how-to (claude-code/codex/perplexity) and the missing docs/mcp/CODEX.md link. * fix: connect LEARN_INSTRUCTION names put_page, not CLI-only capture The self-orientation block told a connected agent that `capture` is an available MCP tool. It isn't — `capture` is a CLI-only convenience command; the MCP write tool is `put_page`. An agent that followed the instruction hit "unknown tool". Drop capture; put_page was already in the list. Adds a regression block to connect.test.ts. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat: serve --http surfaces skill-publishing status (banner + nudge) When mcp.publish_skills is OFF, connected agents can search/write but can't call list_skills/get_skill, so the host's skill catalog is invisible to them. The startup banner now shows a Skills: line, and a stderr nudge fires when off with the paste-ready fix. Pure skillPublishStatus() helper, unit-tested. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test: prove the local stdio MCP funnel end-to-end Spawns real `gbrain serve` (stdio) against a freshly init --pglite brain and drives the official MCP SDK client through initialize -> tools/list -> tools/call (get_brain_identity + search). Pins the advertised core-tool set against what the server actually exposes (asserts capture is NOT advertised). This funnel had zero e2e coverage before. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test: make batch-retry-audit ENOENT case hermetic The 'no-op when audit dir does not exist' case called pruneOldBatchRetryAuditFiles(30) without a GBRAIN_AUDIT_DIR override, so it read the real ~/.gbrain/audit and flaked (kept:1) on any dev machine with a batch-retry-*.jsonl on disk. Point it at a guaranteed-missing temp subdir, matching this file's own hermetic-header contract. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: two-funnel coding-agent onboarding (Claude Code / Codex) New tutorial docs/tutorials/connect-coding-agent.md: Path A (connect to an existing brain) + Path B (start from nothing, local stdio), the brain-first protocol to paste into CLAUDE.md/AGENTS.md, and the four translatable habits. README gains a 'Quick start: Claude Code or Codex' fork separating lightweight retrieval from the full autonomous install. INSTALL.md shows the one-command wire-up at the standalone CLI section. mcp/CLAUDE_CODE + CODEX cross-link the tutorial + note publish_skills + capture-is-CLI-only. Tutorial promoted to Shipped in the tutorials index. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore: changelog + regenerated llms (v0.42.2.0) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: CLAUDE.md Key Files annotation for two-funnel onboarding wave Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
236 lines
9.4 KiB
Markdown
236 lines
9.4 KiB
Markdown
# Give your coding agent a memory: GBrain + Claude Code / Codex
|
|
|
|
Coding agents got very good at code. They're still amnesiac about everything
|
|
else. Claude Code and Codex forget your last conversation, can't tell you what
|
|
you decided three meetings ago, and re-derive context you already have written
|
|
down somewhere. GBrain is the retrieval layer that fixes that: search, synthesis,
|
|
and a self-wiring knowledge graph, wired into your agent over MCP.
|
|
|
|
There are two ways to do this. Pick the one that matches where you are:
|
|
|
|
- **Path A — I already run a brain** (OpenClaw, Hermes, or any `gbrain serve`
|
|
host) and I want my Claude Code / Codex to reach the same brain. → [jump to Path A](#path-a-connect-an-agent-to-a-brain-you-already-have)
|
|
- **Path B — I have nothing yet.** Spin up a local brain in 2 seconds and wire it
|
|
into my coding agent. → [jump to Path B](#path-b-start-from-nothing-local-brain-local-agent)
|
|
|
|
Both end in the same place: an agent that searches your brain before it answers,
|
|
and writes new knowledge back as you work. The last section,
|
|
[Now make it actually useful](#now-make-it-actually-useful), is the same for both
|
|
and is the part that changes how you work.
|
|
|
|
Prerequisite for either path: `bun install -g github:garrytan/gbrain`.
|
|
|
|
---
|
|
|
|
## Path A: connect an agent to a brain you already have
|
|
|
|
You already have a populated brain (the OpenClaw / Hermes case: it's on your
|
|
agent host, full of meetings, people, and ideas). You want Claude Code on your
|
|
laptop, and Codex too, to query it. This is the remote path: the host serves
|
|
HTTP, your laptop agents connect with a token.
|
|
|
|
### A1. On the host: serve over HTTP
|
|
|
|
If your host isn't already serving HTTP MCP, start it:
|
|
|
|
```bash
|
|
gbrain serve --http --bind 0.0.0.0 --public-url https://your-host.example.com
|
|
```
|
|
|
|
Two flags matter and people skip them:
|
|
|
|
- **`--bind 0.0.0.0`** — the default bind is `127.0.0.1` (loopback only), which
|
|
silently refuses every remote connection. If your agent "can't reach the
|
|
brain" and you didn't pass this, that's why. `gbrain serve --http` warns you at
|
|
startup when `--public-url` is set without `--bind`.
|
|
- **`--public-url`** — the externally reachable HTTPS URL (your Render/Railway
|
|
URL, ngrok domain, Tailscale Funnel, etc.). It's the issuer the OAuth/MCP
|
|
layer advertises.
|
|
|
|
Watch the startup banner. It now prints a `Skills:` line:
|
|
|
|
```
|
|
║ Skills: published ║
|
|
```
|
|
|
|
If it says `not published`, your connected agents will be able to search and
|
|
write but won't see your skill catalog (the OpenClaw skills that make your setup
|
|
special). Turn it on:
|
|
|
|
```bash
|
|
gbrain config set mcp.publish_skills true
|
|
```
|
|
|
|
(New brains from `gbrain init` default this ON. Brains upgraded from before
|
|
v0.41.36 stay OFF until you opt in, so this is the common gotcha for existing
|
|
OpenClaw users.)
|
|
|
|
### A2. On the host: mint a token
|
|
|
|
```bash
|
|
gbrain auth create "laptop-agents"
|
|
```
|
|
|
|
Copy the `gbrain_…` token it prints. It's a long-lived, full-access secret. Treat
|
|
it like a password; prefer a scoped OAuth client for anything cloud-hosted (see
|
|
[DEPLOY.md](../mcp/DEPLOY.md)).
|
|
|
|
### A3. On the laptop: one command per agent
|
|
|
|
```bash
|
|
# Claude Code
|
|
gbrain connect https://your-host.example.com/mcp --token gbrain_xxx --install
|
|
|
|
# Codex
|
|
gbrain connect https://your-host.example.com/mcp --token gbrain_xxx --agent codex --install
|
|
```
|
|
|
|
`--install` runs the agent's `mcp add` for you AND smoke-tests the token: it
|
|
actually calls `get_brain_identity` before handing off, so a wrong or expired
|
|
token fails right now, not silently on the agent's first request. You'll see:
|
|
|
|
```
|
|
Added MCP server 'gbrain' -> https://your-host.example.com/mcp.
|
|
Verified: {"version":"0.42.x","engine":"postgres","page_count":146646,...}
|
|
```
|
|
|
|
Drop `--install` to print a paste-ready block instead (useful when the host and
|
|
the agent are different machines, or you want to read before you run). Codex
|
|
reads the bearer from `$GBRAIN_REMOTE_TOKEN` at runtime, so the token never lands
|
|
in Codex's config file. Keep that variable exported in your shell profile.
|
|
|
|
### A4. Verify
|
|
|
|
In the agent: *"Call get_brain_identity, then search my brain for [a topic you
|
|
know is in there]."* You should get your own pages back. Done.
|
|
|
|
Full per-client detail: [Claude Code](../mcp/CLAUDE_CODE.md),
|
|
[Codex](../mcp/CODEX.md), [Perplexity](../mcp/PERPLEXITY.md).
|
|
|
|
---
|
|
|
|
## Path B: start from nothing (local brain, local agent)
|
|
|
|
No OpenClaw, no server, no token. The lowest-friction path in the whole product:
|
|
a local PGLite brain in the same process your agent spawns. Zero server, zero
|
|
tunnel.
|
|
|
|
### B1. Create a local brain
|
|
|
|
```bash
|
|
gbrain init --pglite # 2 seconds; embedded Postgres via WASM, no Docker
|
|
```
|
|
|
|
### B2. Put something in it
|
|
|
|
A brain with nothing in it answers nothing, so an empty brain on day one feels
|
|
broken. Two ways to fill it:
|
|
|
|
```bash
|
|
# Bulk-import a folder of markdown you already have:
|
|
gbrain import ~/notes/
|
|
|
|
# Or capture as you go (one thought at a time):
|
|
gbrain capture "Decided to use PGLite as the default engine: zero-config beats Postgres for <1000 files."
|
|
```
|
|
|
|
You don't have to import everything up front. The capture-as-you-go habit (see
|
|
the next section) means the brain fills with the decisions and context you
|
|
generate while working, and is genuinely useful by day two.
|
|
|
|
### B3. Wire it into your coding agent
|
|
|
|
```bash
|
|
# Claude Code
|
|
claude mcp add gbrain -- gbrain serve
|
|
|
|
# Codex
|
|
codex mcp add gbrain -- gbrain serve
|
|
```
|
|
|
|
That's the whole wire-up. No token, no URL, no tunnel. The agent spawns
|
|
`gbrain serve` as a stdio subprocess and talks to your local brain directly.
|
|
|
|
### B4. Verify
|
|
|
|
In the agent: *"search my brain for PGLite"* (or whatever you just captured). You
|
|
get the page back. The same brain is now query-able from the CLI
|
|
(`gbrain query "..."`) and from your agent.
|
|
|
|
---
|
|
|
|
## Now make it actually useful
|
|
|
|
Connecting is the easy part. The value comes from teaching your agent a few
|
|
habits. These are the patterns that turn a coding agent into a knowledge-aware
|
|
one. Paste the protocol below into your agent's instructions file
|
|
(`CLAUDE.md` for Claude Code, `AGENTS.md` for Codex / Cursor / others), then lean
|
|
on the patterns.
|
|
|
|
### The brain-first protocol (paste this in)
|
|
|
|
```markdown
|
|
## Brain-first protocol
|
|
|
|
You have a knowledge brain connected over MCP. Before answering any question
|
|
about people, companies, decisions, projects, or past context:
|
|
|
|
1. **Search first.** Call `search` (or `query` for a synthesized answer) against
|
|
the brain BEFORE answering from memory or asking me. If the brain has the
|
|
answer, use it. Never ask "who is X?" or "what did we decide about Y?" before
|
|
searching — the brain probably already knows.
|
|
2. **Write back.** When I make a decision, mention a new person/company, or land
|
|
on an idea worth keeping, write it to the brain with `put_page` (entity pages
|
|
under people/, companies/; decisions under decisions/ or notes/). One insight,
|
|
one page, linked.
|
|
3. **Cite.** When you answer from the brain, name the page you used.
|
|
```
|
|
|
|
### The four patterns worth stealing
|
|
|
|
These come straight from a production OpenClaw setup. They translate directly to
|
|
any coding agent with GBrain connected:
|
|
|
|
**1. Brain-first lookup (never ask what you can retrieve).** The single highest-
|
|
value habit. Before the agent asks you "which repo?" or "who owns this?", it
|
|
searches. Try: *"What did we decide about the auth rewrite?"* and watch it pull
|
|
the decision page instead of asking you to re-explain.
|
|
|
|
**2. Ambient capture (your brain as a side effect of working).** Don't make
|
|
saving a separate chore. Tell the agent: *"As we work, capture any decision or
|
|
new idea to the brain without interrupting."* After a month of this, you have
|
|
hundreds of linked pages and patterns you didn't know were there.
|
|
|
|
**3. Briefing from your brain (not from the internet).** *"What do I need to know
|
|
before my 2pm with the Acme team?"* pulls your meeting history, the people,
|
|
what's still open, what the brain doesn't know yet. The agent does your prep
|
|
because it read your context. (`query` gives you the synthesized answer with
|
|
citations; this is the example on the [README](../../README.md).)
|
|
|
|
**4. whoknows (expertise routing).** *"Who do I know who's shipped a rate
|
|
limiter in Postgres?"* The `find_experts` tool ranks people in your brain by
|
|
relevance + recency. Useful the moment your brain has more than a handful of
|
|
people in it.
|
|
|
|
That's the spine of it. Two commands to connect, one protocol to paste, four
|
|
habits to build. Your agent stops being amnesiac.
|
|
|
|
---
|
|
|
|
## Troubleshooting
|
|
|
|
| Symptom | Cause | Fix |
|
|
|---|---|---|
|
|
| Agent "can't reach the brain" (Path A) | `gbrain serve --http` bound to loopback | Restart with `--bind 0.0.0.0` |
|
|
| `list_skills` returns nothing / errors | Skill publishing OFF on the host | `gbrain config set mcp.publish_skills true` |
|
|
| Token rejected on first call | Wrong/expired token | Re-mint with `gbrain auth create`; `--install` smoke-tests it for you |
|
|
| `unknown tool: capture` | `capture` is CLI-only, not an MCP tool | Use `put_page` over MCP; `capture` only on the CLI |
|
|
| Empty results (Path B) | Brain has nothing in it yet | `gbrain import ~/notes/` or `gbrain capture "..."` |
|
|
|
|
## Next steps
|
|
|
|
- Go full autonomous: the overnight enrichment daemon ([dream cycle](../../CHANGELOG.md)) fixes citations, dedupes people, builds scorecards while you sleep. See `gbrain autopilot --install`.
|
|
- Run a real agent platform on top: [personal-brain tutorial](personal-brain.md).
|
|
- Scale to a team: [company-brain tutorial](company-brain.md).
|
|
- Every MCP client's exact setup: [`docs/mcp/`](../mcp/).
|