Skip to content

feat(cli): connect Claude Code and Codex with agent setup - #1997

Draft
rodboev wants to merge 18 commits into
mainfrom
pr/agent-setup-9
Draft

rodboev wants to merge 18 commits into
mainfrom
pr/agent-setup-9

Conversation

@rodboev

@rodboev rodboev commented Nov 14, 2026 •

Copy link
Copy Markdown
Contributor

Claude Code and Codex users can connect to Forge's hooks and MCP with one command. Today they run agent-hook install, which without --agent writes hooks for all 11 agents, and then copy the MCP URL from mcp quickstart into each client by hand.

kenn-forge agent setup
kenn-forge agent setup --check

Setup installs hooks for the installed Claude Code and Codex clients and registers the running daemon's MCP URL with both. When the API requires auth, the entry references KENN_FORGE_API_TOKEN instead of the token, and outside Forge-launched terminals, setup tells you to export it from the reported token_path. When setup can't finish, you see:

  • With the daemon stopped, the MCP line reads failed: Forge daemon isn't running and names kenn-forge daemon start. --check exits non-zero.
  • With a relative data_dir, the hooks line fails and asks for an absolute one.
  • --print gives the manual MCP commands, including the token export when it's missing.
  • Every repair command setup prints keeps your --config.
  • mcp quickstart drops its leading OK when MCP is inactive and points to agent setup.

When the config doesn't set its own data_dir, hooks now pass --home, so an agent started later with a different KENN_FORGE_HOME still reports to the daemon chosen at setup. This needs kenn-io/kit#368 released. go.mod pins go.kenn.io/kit to a pseudo-version of that branch, so bump it to the release once it ships.

Agent users need a single setup command that connects hooks and the running MCP companion. The existing hook installer selects every supported agent, and quickstart can report success while the companion is inactive.

Use Kit's setup report so each integration can explain its own recovery. Keep Kit's released configuration behavior until its bearer preservation change ships.
Agent setup needs to find the same daemon and install hooks for the configuration the user chose. Recovery commands must retain that choice, including paths with spaces.

When the daemon is stopped, a manual setup command cannot be generated yet. Report the reason and the next step so print mode does not silently produce no output. Config errors can have several causes, so reserve the data directory instruction for a relative path.
Keep coverage at the Forge integration boundary so dependency behavior does not obscure regressions in discovery, guidance, and hook setup. Exercise malformed configuration through the actual loader and check the order of daemon setup steps at their source.
Agent setup must use the selected configuration for discovery and hooks, and guide users to the right repair when it cannot load that configuration.
Print mode needs to explain how to connect when an agent cannot use the required token reference. An empty result leaves the user without a command or a next step.

The setup check already supplies guidance for failed and unknown states, so its empty-step fallback is unnecessary.
Agent setup must retain user settings while updating Forge's token reference. Removing the old reference when authentication is disabled also lets clients connect without a stale credential.
Hooks need to reach the daemon selected during setup even when an agent starts with a different environment. Manual MCP setup also needs the token location so users can authenticate outside Forge-launched terminals.

Keep recovery instructions tied to the selected configuration and point users at the underlying setup error.
Agent setup tests should catch mistakes in Forge's guidance and token selection without duplicating checks owned by the setup library. Keeping distinct daemon and authentication cases makes those regressions visible while reducing redundant fixtures.
The hook command already owns its flags, and its install options have only one caller. Keeping those definitions together makes the selected daemon settings easier to follow without changing how hooks find it.
@rodboev

rodboev commented Nov 14, 2026

Copy link
Copy Markdown
Contributor Author

This draft waits for a Kit release containing kenn-io/kit#368, which supplies the MCP settings preservation used here.

@roborev-ci

roborev-ci Bot commented Nov 14, 2026

Copy link
Copy Markdown

roborev: Combined Review (d79529e)

Verdict: Changes require fixes for 1 finding.

Medium

  • cmd/kenn-forge/agent_setup.go:167: Following the printed PowerShell authentication command can fail to read your token file. It leaves apostrophes unescaped and treats brackets as wildcards. This affects users running agent setup --print with authentication enabled, KENN_FORGE_API_TOKEN unset, and apostrophes or brackets in the token path.

    Fix: Double embedded apostrophes and read the token file by its literal path so apostrophes and brackets are handled correctly. Where: cmd/kenn-forge/agent_setup.go, withTokenGuidance, Get-Content -LiteralPath


Reviewers: 3x codex, codex (security), codex (test-value) | Synthesis: codex, 2m12s | Total: 10m14s

Agent setup prints a token read command for users who authenticate outside a Forge terminal. PowerShell interprets apostrophes and brackets in paths as syntax or wildcard patterns, so the command must preserve the path as a literal.
A first-time user can run setup before the daemon creates its configuration. Report how to start the daemon in that case, while keeping check mode free of writes.

Keep hook commands consistent with existing installations and preserve user credentials when authentication changes. Setup uses the default configuration selected by the environment.
Keep coverage for daemon discovery and token selection while removing cases that repeat the same Forge behavior or exercise the setup library's own contracts.
A mistyped config path left installed hooks unable to reach Forge and made MCP discovery report a stopped daemon. Reject that path before installing hooks or reporting listener status.

A fresh installation can still use the default path before the daemon creates its config.
Agent hooks need to reach the same daemon when the agent starts with a different environment. Setup also needs to honor a custom config and report MCP status when hook configuration fails.

A missing default config is normal on a fresh install, while a missing custom config signals a selection error.
An upgrade should keep trusted hook commands when the configuration already selects the daemon's data directory. Configurations that depend on the home directory still need that selection carried into the hook's environment.

Setup checks need to identify the token required for the next attempt, and quickstart guidance must retain a custom configuration path.
Repeated setup cases obscured which failures each test could catch. Keep the distinct config and guidance paths covered while making a missing default config check exercise hook discovery.
Agent setup needs to retain selected agents and the existing trusted hook command while giving users the daemon's next step. Keep the config file check for hook homes because runtime sources report the winning environment override and treat an empty file value as explicit.
The lint check rejects the existing condition. Preserve the exception for a missing default config while keeping the check clear to the linter.
@roborev-ci

roborev-ci Bot commented Nov 14, 2026

Copy link
Copy Markdown

roborev: Combined Review (504b523)

Verdict: Changes require fixes for 1 finding.

Medium

  • cmd/kenn-forge/agent_hook.go:339: Agents silently lose activity updates and launch instructions after setup. MCP connects correctly, but hooks save the default directory. This happens whenever TOML omits data_dir, setup uses KENN_FORGE_DATA_DIR, and agents start without it.

    Fix: Pin hooks to the loaded effective data directory unless the configuration file already specifies one, preserve existing commands in that case, and verify hooks work after removing the setup-time override. Where: resolveAgentHookTarget, agentHookHome, cmd/kenn-forge/agent_hook.go, agent_hook_cli_test.go


Reviewers: 3x codex, codex (security), codex (test-value) | Synthesis: codex, 5m5s | Total: 13m0s

cpcloud pushed a commit to kenn-io/kit that referenced this pull request Nov 14, 2026
…368)

Users who tune an app's MCP server in Claude Code or Codex keep those settings when the app reinstalls it with env values, headers, or a bearer reference. Before, an app that supplied `BearerTokenEnvVar` as `APP_TOKEN` replaced the whole entry, so a user's `User='keep'` header, `tool_timeout_sec=20`, and Codex `enabled=false` disappeared. Now they stay.

Before, rerunning setup with only the URL after turning off authentication left `bearer_token_env_var='APP_TOKEN'` in place, and Codex refused to connect while `APP_TOKEN` was unset. An app now names that variable in the new `Server.PreviousBearerTokenEnvVar` field, and setup removes it. When the app omits authentication, setup keeps any bearer setting the app doesn't name.

App values win for the env and header keys the app supplies, and keys it stops supplying stay until the user removes them. Args follow the app, so a hand-added flag such as `--write` makes Check report the server as outdated. Check uses the same merge as Install.

Needed by kenn-io/docbank#1491


Needed by kenn-io/forge#1997


Co-authored-by: Rod Boev <rodboev@users.noreply.github.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant