multicorn-shield 0.1.6 → 0.1.8

package/README.md

@@ -1,3 +1,5 @@
+![Multicorn Shield](readme-header.svg)
+
 # Multicorn Shield
 
 The permissions and control layer for AI agents. Open source.

package/dist/openclaw-hook/handler.js

@@ -411,6 +411,12 @@ async function ensureAgent(agentName, apiKey, baseUrl, failMode) {
 }
 async function ensureConsent(agentName, apiKey, baseUrl, scope) {
   if (agentRecord === null) return;
+  const apiScopes = await fetchGrantedScopes(agentRecord.id, apiKey, baseUrl);
+  if (apiScopes.length > 0) {
+    grantedScopes = apiScopes;
+    lastScopeRefresh = Date.now();
+    return;
+  }
   if (scope !== void 0) {
     const requestedScope = {
       service: scope.service,
@@ -468,8 +474,9 @@ var handler = async (event) => {
   const permitted = isPermitted(event);
   if (!permitted) {
     const capitalizedService = mapping.service.charAt(0).toUpperCase() + mapping.service.slice(1);
+    const dashboardUrl = deriveDashboardUrl(config.baseUrl);
     event.messages.push(
-      `Permission denied: ${capitalizedService} ${mapping.permissionLevel} access is not allowed. Visit the Multicorn Shield dashboard to manage permissions.`
+      `Permission denied: ${capitalizedService} ${mapping.permissionLevel} access is not allowed. Check pending approvals at ${dashboardUrl}/approvals `
     );
     void logAction(
       {

package/dist/openclaw-plugin/index.js

@@ -495,53 +495,20 @@ var pluginLogger = null;
 var pluginConfig;
 var connectionLogged = false;
 var SCOPE_REFRESH_INTERVAL_MS = 6e4;
+var cachedMulticornConfig = null;
+function loadMulticornConfig() {
+  try {
+    const configPath = path.join(os.homedir(), ".multicorn", "config.json");
+    const raw = fs.readFileSync(configPath, "utf-8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
 function readConfig() {
   const pc = pluginConfig ?? {};
-  let resolvedApiKey = asString(pc["apiKey"]) ?? process.env["MULTICORN_API_KEY"] ?? "";
-  let resolvedBaseUrl = asString(pc["baseUrl"]) ?? process.env["MULTICORN_BASE_URL"] ?? "";
-  if (!resolvedApiKey) {
-    try {
-      const multicornConfigPath = path.join(os.homedir(), ".multicorn", "config.json");
-      const multicornConfigContent = fs.readFileSync(multicornConfigPath, "utf-8");
-      const multicornConfig = JSON.parse(multicornConfigContent);
-      if (multicornConfig && typeof multicornConfig.apiKey === "string" && multicornConfig.apiKey.length > 0) {
-        resolvedApiKey = multicornConfig.apiKey;
-        if (!resolvedBaseUrl) {
-          resolvedBaseUrl = multicornConfig.baseUrl ?? "https://api.multicorn.ai";
-        }
-      }
-    } catch {
-    }
-  }
-  if (!resolvedApiKey) {
-    try {
-      const configPath = path.join(os.homedir(), ".openclaw", "openclaw.json");
-      const configContent = fs.readFileSync(configPath, "utf-8");
-      const config = JSON.parse(configContent);
-      const hooks = config["hooks"];
-      const internal = hooks?.["internal"];
-      const entries = internal?.["entries"];
-      const shieldEntry = entries?.["multicorn-shield"];
-      const env = shieldEntry?.env;
-      if (env) {
-        const hookApiKey = asString(env["MULTICORN_API_KEY"]);
-        const hookBaseUrl = asString(env["MULTICORN_BASE_URL"]);
-        if (hookApiKey) {
-          resolvedApiKey = hookApiKey;
-          resolvedBaseUrl = resolvedBaseUrl || (hookBaseUrl ?? "https://api.multicorn.ai");
-          pluginLogger?.warn(
-            "Multicorn Shield: Reading config from hooks.internal.entries. For cleaner setup, set MULTICORN_API_KEY as a system environment variable."
-          );
-        } else if (hookBaseUrl) {
-          resolvedBaseUrl = resolvedBaseUrl || hookBaseUrl;
-        }
-      }
-    } catch {
-    }
-  }
-  if (!resolvedBaseUrl) {
-    resolvedBaseUrl = "https://api.multicorn.ai";
-  }
+  const resolvedApiKey = asString(process.env["MULTICORN_API_KEY"]) ?? asString(cachedMulticornConfig?.apiKey) ?? "";
+  const resolvedBaseUrl = asString(process.env["MULTICORN_BASE_URL"]) ?? asString(cachedMulticornConfig?.baseUrl) ?? "https://api.multicorn.ai";
   const agentName = asString(pc["agentName"]) ?? process.env["MULTICORN_AGENT_NAME"] ?? null;
   const failModeRaw = asString(pc["failMode"]) ?? process.env["MULTICORN_FAIL_MODE"] ?? "open";
   const failMode = failModeRaw === "closed" ? "closed" : "open";
@@ -609,6 +576,17 @@ async function ensureAgent(agentName, apiKey, baseUrl, failMode) {
 }
 async function ensureConsent(agentName, apiKey, baseUrl, scope) {
   if (agentRecord === null) return;
+  const apiScopes = await fetchGrantedScopes(
+    agentRecord.id,
+    apiKey,
+    baseUrl,
+    pluginLogger ?? void 0
+  );
+  if (apiScopes.length > 0) {
+    grantedScopes = apiScopes;
+    lastScopeRefresh = Date.now();
+    return;
+  }
   if (scope !== void 0) {
     const requestedScope = {
       service: scope.service,
@@ -707,7 +685,9 @@ function buildApprovalDescription(agentName, permissionLevel, service, toolName,
 async function beforeToolCall(event, ctx) {
   const config = readConfig();
   if (config.apiKey.length === 0) {
-    pluginLogger?.warn("MULTICORN_API_KEY is not set. Skipping permission checks.");
+    pluginLogger?.warn(
+      "Multicorn Shield: No API key found. Run 'npx multicorn-proxy init' or set MULTICORN_API_KEY."
+    );
     return void 0;
   }
   const agentName = resolveAgentName(ctx.sessionKey ?? "", config.agentName);
@@ -804,7 +784,8 @@ async function beforeToolCall(event, ctx) {
     await ensureConsent(agentName, config.apiKey, config.baseUrl, mapping);
   }
   const capitalizedService = mapping.service.charAt(0).toUpperCase() + mapping.service.slice(1);
-  const reason = `${capitalizedService} ${mapping.permissionLevel} access is not allowed. Visit the Multicorn Shield dashboard to manage permissions.`;
+  const dashboardUrl = deriveDashboardUrl(config.baseUrl);
+  const reason = `${capitalizedService} ${mapping.permissionLevel} access is not allowed. Check pending approvals at ${dashboardUrl}/approvals `;
   return { block: true, blockReason: reason };
 }
 function afterToolCall(event, ctx) {
@@ -837,13 +818,14 @@ var plugin = {
   register(api) {
     pluginLogger = api.logger;
     pluginConfig = api.pluginConfig;
+    cachedMulticornConfig = loadMulticornConfig();
     api.on("before_tool_call", beforeToolCall, { priority: 10 });
     api.on("after_tool_call", afterToolCall);
     api.logger.info("Multicorn Shield plugin registered.");
     const config = readConfig();
     if (config.apiKey.length === 0) {
       api.logger.error(
-        "Multicorn Shield: No API key found. Run `npx multicorn-proxy init` to set up your API key, or set MULTICORN_API_KEY in your OpenClaw config (~/.openclaw/openclaw.json \u2192 plugins.entries.multicorn-shield.env.MULTICORN_API_KEY). Get a key from your Multicorn dashboard (Settings \u2192 API Keys)."
+        "Multicorn Shield: No API key found. Run 'npx multicorn-proxy init' or set MULTICORN_API_KEY."
       );
     } else {
       api.logger.info(`Multicorn Shield connecting to ${config.baseUrl}`);
@@ -862,6 +844,7 @@ function resetState() {
   lastScopeRefresh = 0;
   pluginLogger = null;
   pluginConfig = void 0;
+  cachedMulticornConfig = null;
   connectionLogged = false;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "multicorn-shield",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "The control layer for AI agents: permissions, consent, spending limits, and audit logging.",
   "license": "MIT",
   "type": "module",