multicorn-shield 0.12.0 → 1.0.0

package/dist/multicorn-proxy.js

@@ -1,31 +1,23 @@
 #!/usr/bin/env node
-import { existsSync } from 'fs';
-import { mkdir, writeFile, readFile, copyFile, chmod, unlink } from 'fs/promises';
-import { join, dirname } from 'path';
+import { existsSync, statSync } from 'fs';
+import { readFile, mkdir, writeFile, copyFile, chmod, unlink } from 'fs/promises';
+import { dirname, join } from 'path';
 import { homedir } from 'os';
 import { fileURLToPath } from 'url';
 import { createInterface } from 'readline';
-import { spawn } from 'child_process';
 import { createHash } from 'crypto';
+import { spawn } from 'child_process';
 import 'stream';
 
-var style = {
-  violet: (s) => `\x1B[38;2;124;58;237m${s}\x1B[0m`,
-  violetLight: (s) => `\x1B[38;2;167;139;250m${s}\x1B[0m`,
-  green: (s) => `\x1B[38;2;34;197;94m${s}\x1B[0m`,
-  yellow: (s) => `\x1B[38;2;245;158;11m${s}\x1B[0m`,
-  red: (s) => `\x1B[38;2;239;68;68m${s}\x1B[0m`,
-  cyan: (s) => `\x1B[38;2;6;182;212m${s}\x1B[0m`,
-  bold: (s) => `\x1B[1m${s}\x1B[0m`,
-  dim: (s) => `\x1B[2m${s}\x1B[0m`
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
 };
-var BANNER = [
-  " \u2588\u2588\u2588 \u2588  \u2588 \u2588 \u2588\u2588\u2588 \u2588   \u2588\u2588\u2584 ",
-  " \u2588   \u2588  \u2588 \u2588 \u2588   \u2588   \u2588  \u2588",
-  " \u2588\u2588\u2588 \u2588\u2588\u2588\u2588 \u2588 \u2588\u2588  \u2588   \u2588  \u2588",
-  "   \u2588 \u2588  \u2588 \u2588 \u2588   \u2588   \u2588  \u2588",
-  " \u2588\u2588\u2588 \u2588  \u2588 \u2588 \u2588\u2588\u2588 \u2588\u2588\u2588 \u2588\u2588\u2580 "
-].map((line) => style.violet(line)).join("\n");
 function withSpinner(message) {
   const frames = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
   let i = 0;
@@ -43,10 +35,17 @@ function withSpinner(message) {
     }
   };
 }
-var CONFIG_DIR = join(homedir(), ".multicorn");
-var CONFIG_PATH = join(CONFIG_DIR, "config.json");
-var OPENCLAW_CONFIG_PATH = join(homedir(), ".openclaw", "openclaw.json");
-var ANSI_PATTERN = new RegExp(String.fromCharCode(27) + "\\[[0-9;]*[a-zA-Z]", "g");
+function isExistingDirectory(path) {
+  try {
+    if (!existsSync(path)) return false;
+    return statSync(path).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function nativePluginSkippedSaveNote(wizardCommand, productName) {
+  return "\n" + style.dim("Your agent config has been saved. Run ") + style.cyan(wizardCommand) + style.dim(` again after installing ${productName} to complete hook setup.`) + "\n";
+}
 function stripAnsi(str) {
   return str.replace(ANSI_PATTERN, "");
 }
@@ -190,7 +189,6 @@ async function saveConfig(config) {
     mode: 384
   });
 }
-var OPENCLAW_MIN_VERSION = "2026.2.26";
 async function detectOpenClaw() {
   let raw;
   try {
@@ -356,7 +354,8 @@ async function isCursorConnected() {
       const url = rec["url"];
       if (typeof url === "string" && url.includes("multicorn")) return true;
       const args = rec["args"];
-      if (Array.isArray(args) && args.includes("multicorn-proxy")) return true;
+      if (Array.isArray(args) && (args.includes("multicorn-shield") || args.includes("multicorn-proxy")))
+        return true;
     }
     return false;
   } catch (err) {
@@ -426,6 +425,18 @@ async function installWindsurfNativeHooks() {
       `Could not find Shield Windsurf hook scripts at ${srcPre}. If you use npm, install the latest multicorn-shield package.`
     );
   }
+  const windsurfConfigDir = join(homedir(), ".codeium", "windsurf");
+  if (!isExistingDirectory(windsurfConfigDir)) {
+    process.stderr.write(
+      style.yellow("\u26A0") + "  Windsurf does not appear to be installed (~/.codeium/windsurf/ not found).\n\n"
+    );
+    process.stderr.write(
+      "Open Windsurf at least once so this folder exists, or install from:\n  " + style.cyan("https://windsurf.com/download") + "\n\n"
+    );
+    process.stderr.write("Then run this wizard again:\n");
+    process.stderr.write("  " + style.cyan("npx multicorn-shield init") + "\n");
+    throw new NativePluginPrerequisiteMissingError();
+  }
   const installDir = getWindsurfHooksInstallDir();
   await mkdir(installDir, { recursive: true });
   const destPre = join(installDir, "pre-action.cjs");
@@ -489,6 +500,19 @@ async function installClineNativeHooks() {
       `Could not find Shield Cline hook scripts at ${srcPre}. If you use npm, install the latest multicorn-shield package.`
     );
   }
+  const clineDocsDir = join(homedir(), "Documents", "Cline");
+  if (!isExistingDirectory(clineDocsDir)) {
+    process.stderr.write(
+      style.yellow("\u26A0") + "  Cline does not appear to be installed (~/Documents/Cline/ not found).\n\n"
+    );
+    process.stderr.write("Install the Cline VS Code extension first. See:\n");
+    process.stderr.write(
+      "  " + style.cyan("https://docs.cline.bot/getting-started/installing-cline") + "\n\n"
+    );
+    process.stderr.write("Then run this wizard again:\n");
+    process.stderr.write("  " + style.cyan("npx multicorn-shield init") + "\n");
+    throw new NativePluginPrerequisiteMissingError();
+  }
   const installDir = getClineHooksInstallDir();
   await mkdir(installDir, { recursive: true });
   const destPre = join(installDir, "pre-tool-use.cjs");
@@ -531,29 +555,203 @@ async function promptClineIntegrationMode(ask) {
   }
   return choice === 1 ? "native" : "hosted";
 }
-var PLATFORM_LABELS = [
-  "OpenClaw",
-  "Claude Code",
-  "Cursor",
-  "Windsurf",
-  "Cline",
-  "Local MCP / Other"
-];
-var PLATFORM_BY_SELECTION = {
-  1: "openclaw",
-  2: "claude-code",
-  3: "cursor",
-  4: "windsurf",
-  5: "cline",
-  6: "other-mcp"
-};
-var DEFAULT_AGENT_NAMES = {
-  openclaw: "my-openclaw-agent",
-  "claude-code": "my-claude-code-agent",
-  cursor: "my-cursor-agent",
-  windsurf: "my-windsurf-agent",
-  cline: "my-cline-agent"
-};
+function getGeminiCliHooksInstallDir() {
+  return join(homedir(), ".multicorn", "gemini-cli-hooks");
+}
+function getGeminiCliSettingsPath() {
+  return join(homedir(), ".gemini", "settings.json");
+}
+function geminiInnerHooksReferenceShield(inner, multicornName) {
+  if (!Array.isArray(inner)) return false;
+  for (const h of inner) {
+    if (typeof h !== "object" || h === null) continue;
+    const rec = h;
+    if (rec["name"] === multicornName) return true;
+    const cmd = rec["command"];
+    if (typeof cmd === "string" && cmd.includes("gemini-cli-hooks")) return true;
+  }
+  return false;
+}
+function geminiHookEventsReferenceShield(arr) {
+  if (!Array.isArray(arr)) return false;
+  for (const entry of arr) {
+    if (typeof entry !== "object" || entry === null) continue;
+    const hooks = entry["hooks"];
+    if (geminiInnerHooksReferenceShield(hooks, "multicorn-shield") || geminiInnerHooksReferenceShield(hooks, "multicorn-shield-log")) {
+      return true;
+    }
+  }
+  return false;
+}
+function geminiSettingsHasMulticornHooks(hooks) {
+  if (hooks === null || typeof hooks !== "object" || Array.isArray(hooks)) return false;
+  const h = hooks;
+  return geminiHookEventsReferenceShield(h["BeforeTool"]) || geminiHookEventsReferenceShield(h["AfterTool"]);
+}
+function geminiFilterInnerHooks(inner) {
+  if (!Array.isArray(inner)) return [];
+  return inner.filter((h) => {
+    if (typeof h !== "object" || h === null) return true;
+    const rec = h;
+    if (rec["name"] === "multicorn-shield" || rec["name"] === "multicorn-shield-log") return false;
+    const cmd = rec["command"];
+    if (typeof cmd === "string" && cmd.includes("gemini-cli-hooks")) return false;
+    return true;
+  });
+}
+function geminiStripMatcherGroups(arr) {
+  if (!Array.isArray(arr)) return [];
+  const out = [];
+  for (const entry of arr) {
+    if (typeof entry !== "object" || entry === null) continue;
+    const e = entry;
+    const filtered = geminiFilterInnerHooks(e["hooks"]);
+    if (filtered.length > 0) {
+      out.push({ ...e, hooks: filtered });
+    }
+  }
+  return out;
+}
+function geminiStripMulticornHookEntries(hooks) {
+  const out = { ...hooks };
+  out["BeforeTool"] = geminiStripMatcherGroups(out["BeforeTool"]);
+  out["AfterTool"] = geminiStripMatcherGroups(out["AfterTool"]);
+  return out;
+}
+async function installGeminiCliNativeHooks(ask) {
+  const root = multicornShieldPackageRoot();
+  const srcBefore = join(root, "plugins", "gemini-cli", "hooks", "scripts", "before-tool.cjs");
+  const srcAfter = join(root, "plugins", "gemini-cli", "hooks", "scripts", "after-tool.cjs");
+  const srcShared = join(root, "plugins", "gemini-cli", "hooks", "scripts", "shared.cjs");
+  if (!existsSync(srcBefore) || !existsSync(srcAfter) || !existsSync(srcShared)) {
+    throw new Error(
+      `Could not find Shield Gemini CLI hook scripts at ${srcBefore}. If you use npm, install the latest multicorn-shield package.`
+    );
+  }
+  const geminiConfigDir = join(homedir(), ".gemini");
+  if (!isExistingDirectory(geminiConfigDir)) {
+    process.stderr.write(
+      style.yellow("\u26A0") + "  Gemini CLI does not appear to be installed (~/.gemini/ not found).\n\n"
+    );
+    process.stderr.write("Install Gemini CLI first:\n");
+    process.stderr.write("  " + style.cyan("npm install -g @google/gemini-cli") + "\n\n");
+    process.stderr.write("Then run this wizard again:\n");
+    process.stderr.write("  " + style.cyan("npx multicorn-shield init") + "\n");
+    throw new NativePluginPrerequisiteMissingError();
+  }
+  const installDir = getGeminiCliHooksInstallDir();
+  await mkdir(installDir, { recursive: true });
+  const destBefore = join(installDir, "before-tool.cjs");
+  const destAfter = join(installDir, "after-tool.cjs");
+  const destShared = join(installDir, "shared.cjs");
+  await copyFile(srcBefore, destBefore);
+  await copyFile(srcAfter, destAfter);
+  await copyFile(srcShared, destShared);
+  const mode = 493;
+  await chmod(destBefore, mode);
+  await chmod(destAfter, mode);
+  await chmod(destShared, mode);
+  const settingsPath = getGeminiCliSettingsPath();
+  let existing = {};
+  try {
+    const rawText = await readFile(settingsPath, "utf8");
+    const parsed = JSON.parse(rawText);
+    if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
+      existing = parsed;
+    }
+  } catch (err) {
+    if (isErrnoException(err) && err.code === "ENOENT") {
+      existing = {};
+    } else {
+      process.stderr.write(
+        style.yellow("\u26A0") + ` Could not parse ${settingsPath}. Create valid JSON or remove the file, then run init again.
+`
+      );
+      throw new Error(`Invalid Gemini CLI settings at ${settingsPath}`);
+    }
+  }
+  const hooksRaw = existing["hooks"];
+  const hooksObj = typeof hooksRaw === "object" && hooksRaw !== null && !Array.isArray(hooksRaw) ? hooksRaw : {};
+  if (geminiSettingsHasMulticornHooks(hooksObj)) {
+    const answer = await ask(
+      "Existing Multicorn Shield hooks were found in ~/.gemini/settings.json. Overwrite? (Y/n) "
+    );
+    if (answer.trim().toLowerCase() === "n") {
+      throw new Error("Installation cancelled: existing Shield hooks left unchanged.");
+    }
+  }
+  const cleaned = geminiStripMulticornHookEntries({ ...hooksObj });
+  const beforeArr = Array.isArray(cleaned["BeforeTool"]) ? [...cleaned["BeforeTool"]] : [];
+  const afterArr = Array.isArray(cleaned["AfterTool"]) ? [...cleaned["AfterTool"]] : [];
+  const beforeCmd = `node ${destBefore}`;
+  const afterCmd = `node ${destAfter}`;
+  beforeArr.push({
+    matcher: ".*",
+    hooks: [
+      {
+        type: "command",
+        name: "multicorn-shield",
+        command: beforeCmd,
+        timeout: 6e4
+      }
+    ]
+  });
+  afterArr.push({
+    matcher: ".*",
+    hooks: [
+      {
+        type: "command",
+        name: "multicorn-shield-log",
+        command: afterCmd,
+        timeout: 1e4
+      }
+    ]
+  });
+  existing["hooks"] = {
+    ...cleaned,
+    BeforeTool: beforeArr,
+    AfterTool: afterArr
+  };
+  await mkdir(dirname(settingsPath), { recursive: true });
+  await writeFile(settingsPath, JSON.stringify(existing, null, 2) + "\n", "utf8");
+}
+async function promptGeminiCliIntegrationMode(ask) {
+  process.stderr.write("\n" + style.bold("Gemini CLI integration") + "\n");
+  process.stderr.write(
+    "  " + style.violet("1") + ". Native plugin (recommended) - Gemini CLI Hooks see every file, terminal, web, and MCP action\n"
+  );
+  process.stderr.write(
+    "  " + style.violet("2") + ". Hosted proxy - govern MCP traffic only (paste proxy URL into Gemini CLI settings)\n"
+  );
+  let choice = 0;
+  while (choice === 0) {
+    const input = await ask("Choose integration (1-2): ");
+    const num = parseInt(input.trim(), 10);
+    if (num === 1) choice = 1;
+    if (num === 2) choice = 2;
+  }
+  return choice === 1 ? "native" : "hosted";
+}
+function getClaudeDesktopConfigPath() {
+  switch (process.platform) {
+    case "win32":
+      return join(
+        process.env["APPDATA"] ?? join(homedir(), "AppData", "Roaming"),
+        "Claude",
+        "claude_desktop_config.json"
+      );
+    case "linux":
+      return join(homedir(), ".config", "Claude", "claude_desktop_config.json");
+    default:
+      return join(
+        homedir(),
+        "Library",
+        "Application Support",
+        "Claude",
+        "claude_desktop_config.json"
+      );
+  }
+}
 async function promptPlatformSelection(ask) {
   process.stderr.write(
     "\n" + style.bold(style.violet("Which platform are you connecting?")) + "\n"
@@ -572,13 +770,13 @@ async function promptPlatformSelection(ask) {
     );
   }
   process.stderr.write(
-    style.dim("     Pick 6 if you want to wrap a local MCP server with multicorn-proxy --wrap.") + "\n"
+    style.dim("     Pick 8 if you want to wrap a local MCP server with multicorn-shield --wrap.") + "\n"
   );
   let selection = 0;
   while (selection === 0) {
-    const input = await ask("Select (1-6): ");
+    const input = await ask("Select (1-8): ");
     const num = parseInt(input.trim(), 10);
-    if (num >= 1 && num <= 6) {
+    if (num >= 1 && num <= 8) {
       selection = num;
     }
   }
@@ -587,10 +785,10 @@ async function promptPlatformSelection(ask) {
 async function promptWindsurfIntegrationMode(ask) {
   process.stderr.write("\n" + style.bold("Windsurf integration") + "\n");
   process.stderr.write(
-    "  " + style.violet("1") + ". Native plugin (recommended) \u2014 Cascade Hooks see every file, terminal, and MCP action\n"
+    "  " + style.violet("1") + ". Native plugin (recommended) - Cascade Hooks see every file, terminal, and MCP action\n"
   );
   process.stderr.write(
-    "  " + style.violet("2") + ". Hosted proxy \u2014 govern MCP traffic only (paste proxy URL into mcp_config)\n"
+    "  " + style.violet("2") + ". Hosted proxy - govern MCP traffic only (paste proxy URL into mcp_config)\n"
   );
   let choice = 0;
   while (choice === 0) {
@@ -699,9 +897,9 @@ async function createProxyConfig(baseUrl, apiKey, agentName, targetUrl, serverNa
   return typeof data?.["proxy_url"] === "string" ? data["proxy_url"] : "";
 }
 function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
-  const usesInlineKey = platform === "cursor" || platform === "windsurf" || platform === "cline";
+  const usesInlineKey = platform === "cursor" || platform === "claude-desktop" || platform === "windsurf" || platform === "cline" || platform === "gemini-cli";
   const authHeader = usesInlineKey ? `Bearer ${apiKey}` : "Bearer YOUR_SHIELD_API_KEY";
-  const urlKey = platform === "windsurf" ? "serverUrl" : "url";
+  const urlKey = platform === "windsurf" ? "serverUrl" : platform === "gemini-cli" ? "httpUrl" : "url";
   const mcpSnippet = JSON.stringify(
     {
       mcpServers: {
@@ -720,6 +918,8 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
     process.stderr.write("\n" + style.dim("Add this to your OpenClaw agent config:") + "\n\n");
   } else if (platform === "claude-code") {
     process.stderr.write("\n" + style.dim("Add this to your Claude Code MCP config:") + "\n\n");
+  } else if (platform === "claude-desktop") {
+    process.stderr.write("\n" + style.dim(`Add this to ${getClaudeDesktopConfigPath()}:`) + "\n\n");
   } else if (platform === "windsurf") {
     process.stderr.write(
       "\n" + style.dim("Add this to ~/.codeium/windsurf/mcp_config.json:") + "\n\n"
@@ -741,6 +941,12 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
         "  Linux: ~/.config/Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json"
       ) + "\n\n"
     );
+  } else if (platform === "gemini-cli") {
+    process.stderr.write(
+      "\n" + style.dim(
+        "Add this to ~/.gemini/settings.json (create the file if it does not exist). For project-specific config, use .gemini/settings.json in your project root. Restart Gemini CLI after saving. Run /mcp to verify the server is connected."
+      ) + "\n\n"
+    );
   } else {
     process.stderr.write("\n" + style.dim("Add this to ~/.cursor/mcp.json:") + "\n\n");
   }
@@ -764,6 +970,9 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
       ) + "\n"
     );
   }
+  if (platform === "claude-desktop") {
+    process.stderr.write(style.dim("Then restart Claude Desktop to load the MCP server.") + "\n");
+  }
   if (platform === "cline") {
     process.stderr.write(
       style.dim(
@@ -780,7 +989,6 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
     );
   }
 }
-var DEFAULT_SHIELD_API_BASE_URL = "https://api.multicorn.ai";
 async function runInit(explicitBaseUrl) {
   if (!process.stdin.isTTY) {
     process.stderr.write(
@@ -865,10 +1073,11 @@ async function runInit(explicitBaseUrl) {
   };
   let configuring = true;
   while (configuring) {
+    let postSaveNativeSkipNote = null;
     const selection = await promptPlatformSelection(ask);
     const selectedPlatform = PLATFORM_BY_SELECTION[selection] ?? "cursor";
     const selectedLabel = PLATFORM_LABELS[selection - 1] ?? "Cursor";
-    if (selection === 6) {
+    if (selection === 8) {
       const raw = existing !== null ? { ...existing } : {};
       raw["apiKey"] = apiKey;
       raw["baseUrl"] = resolvedBaseUrl;
@@ -883,7 +1092,7 @@ async function runInit(explicitBaseUrl) {
         );
         process.stderr.write(
           "\n" + style.bold("Try it:") + " " + style.cyan(
-            "npx multicorn-proxy --wrap npx @modelcontextprotocol/server-filesystem /tmp"
+            "npx multicorn-shield --wrap npx @modelcontextprotocol/server-filesystem /tmp"
           ) + "\n"
         );
       } catch (error) {
@@ -933,7 +1142,7 @@ An agent for ${selectedLabel} already exists: ${style.cyan(existingForPlatform.n
       }
       if (detection.status === "not-found") {
         process.stderr.write(
-          style.red("\u2717") + " OpenClaw is not installed. Install OpenClaw first, then run npx multicorn-proxy init again.\n"
+          style.red("\u2717") + " OpenClaw is not installed. Install OpenClaw first, then run npx multicorn-shield init again.\n"
         );
         rl.close();
         return null;
@@ -1047,8 +1256,22 @@ An agent for ${selectedLabel} already exists: ${style.cyan(existingForPlatform.n
           });
           setupSucceeded = true;
         } catch (error) {
-          const detail = error instanceof Error ? error.message : String(error);
-          process.stderr.write(style.red("\u2717 ") + detail + "\n");
+          if (error instanceof NativePluginPrerequisiteMissingError) {
+            postSaveNativeSkipNote = nativePluginSkippedSaveNote(
+              "npx multicorn-shield init",
+              "Windsurf"
+            );
+            configuredAgents.push({
+              selection,
+              platform: selectedPlatform,
+              platformLabel: selectedLabel,
+              agentName
+            });
+            setupSucceeded = true;
+          } else {
+            const detail = error instanceof Error ? error.message : String(error);
+            process.stderr.write(style.red("\u2717 ") + detail + "\n");
+          }
         }
       } else {
         const { targetUrl, shortName } = await promptProxyConfig(ask, agentName);
@@ -1092,6 +1315,91 @@ An agent for ${selectedLabel} already exists: ${style.cyan(existingForPlatform.n
           setupSucceeded = true;
         }
       }
+    } else if (selection === 7) {
+      const geminiMode = await promptGeminiCliIntegrationMode(ask);
+      if (geminiMode === "native") {
+        try {
+          await installGeminiCliNativeHooks(ask);
+          process.stderr.write("\n" + style.bold("Shield Gemini CLI hooks installed") + "\n\n");
+          process.stderr.write(
+            style.dim("Hook scripts: ") + style.cyan(getGeminiCliHooksInstallDir()) + "\n"
+          );
+          process.stderr.write(
+            style.dim("Settings updated at ") + style.cyan("~/.gemini/settings.json") + "\n"
+          );
+          process.stderr.write(
+            style.dim(
+              "The Shield hook runs with your user permissions. It intercepts Gemini CLI tool calls to check permissions and log activity. Review the scripts if that is a concern."
+            ) + "\n"
+          );
+          configuredAgents.push({
+            selection,
+            platform: selectedPlatform,
+            platformLabel: selectedLabel,
+            agentName,
+            geminiCliIntegration: "native"
+          });
+          setupSucceeded = true;
+        } catch (error) {
+          if (error instanceof NativePluginPrerequisiteMissingError) {
+            postSaveNativeSkipNote = nativePluginSkippedSaveNote(
+              "npx multicorn-shield init",
+              "Gemini CLI"
+            );
+            configuredAgents.push({
+              selection,
+              platform: selectedPlatform,
+              platformLabel: selectedLabel,
+              agentName
+            });
+            setupSucceeded = true;
+          } else {
+            const detail = error instanceof Error ? error.message : String(error);
+            process.stderr.write(style.red("\u2717 ") + detail + "\n");
+          }
+        }
+      } else {
+        const { targetUrl, shortName } = await promptProxyConfig(ask, agentName);
+        let proxyUrl = "";
+        let created = false;
+        while (!created) {
+          const spinner = withSpinner("Creating proxy config...");
+          try {
+            proxyUrl = await createProxyConfig(
+              resolvedBaseUrl,
+              apiKey,
+              agentName,
+              targetUrl,
+              shortName,
+              selectedPlatform
+            );
+            spinner.stop(true, "Proxy config created!");
+            created = true;
+          } catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            spinner.stop(false, detail);
+            const retry = await ask("Try again? (Y/n) ");
+            if (retry.trim().toLowerCase() === "n") {
+              break;
+            }
+          }
+        }
+        if (created && proxyUrl.length > 0) {
+          process.stderr.write("\n" + style.bold("Your Shield proxy URL:") + "\n");
+          process.stderr.write("  " + style.cyan(proxyUrl) + "\n");
+          printPlatformSnippet(selectedPlatform, proxyUrl, shortName, apiKey);
+          configuredAgents.push({
+            selection,
+            platform: selectedPlatform,
+            platformLabel: selectedLabel,
+            agentName,
+            shortName,
+            proxyUrl,
+            geminiCliIntegration: "hosted"
+          });
+          setupSucceeded = true;
+        }
+      }
     } else if (selection === 5) {
       const clineMode = await promptClineIntegrationMode(ask);
       if (clineMode === "native") {
@@ -1112,8 +1420,22 @@ An agent for ${selectedLabel} already exists: ${style.cyan(existingForPlatform.n
           });
           setupSucceeded = true;
         } catch (error) {
-          const detail = error instanceof Error ? error.message : String(error);
-          process.stderr.write(style.red("\u2717 ") + detail + "\n");
+          if (error instanceof NativePluginPrerequisiteMissingError) {
+            postSaveNativeSkipNote = nativePluginSkippedSaveNote(
+              "npx multicorn-shield init",
+              "Cline"
+            );
+            configuredAgents.push({
+              selection,
+              platform: selectedPlatform,
+              platformLabel: selectedLabel,
+              agentName
+            });
+            setupSucceeded = true;
+          } else {
+            const detail = error instanceof Error ? error.message : String(error);
+            process.stderr.write(style.red("\u2717 ") + detail + "\n");
+          }
         }
       } else {
         const { targetUrl, shortName } = await promptProxyConfig(ask, agentName);
@@ -1215,9 +1537,14 @@ An agent for ${selectedLabel} already exists: ${style.cyan(existingForPlatform.n
           style.green("\u2713") + ` Config saved to ${style.cyan(CONFIG_PATH)}
 `
         );
+        if (postSaveNativeSkipNote != null) {
+          process.stderr.write(postSaveNativeSkipNote);
+          postSaveNativeSkipNote = null;
+        }
       } catch (error) {
         const detail = error instanceof Error ? error.message : String(error);
         process.stderr.write(style.red(`Failed to save config: ${detail}`) + "\n");
+        postSaveNativeSkipNote = null;
       }
     }
     const another = await ask("\nConnect another agent? (Y/n) ");
@@ -1291,6 +1618,22 @@ An agent for ${selectedLabel} already exists: ${style.cyan(existingForPlatform.n
         "\n" + style.bold("To complete your Cline hosted-proxy setup:") + "\n  1. If you don't have Cline yet, install it from the VS Code marketplace\n  2. Open your Cline MCP settings file and paste the config snippet shown above\n  3. Restart Cline or reload the VS Code window\n"
       );
     }
+    const geminiCliNativeConfigured = configuredAgents.some(
+      (a) => a.platform === "gemini-cli" && a.geminiCliIntegration === "native"
+    );
+    const geminiCliHostedConfigured = configuredAgents.some(
+      (a) => a.platform === "gemini-cli" && a.geminiCliIntegration === "hosted"
+    );
+    if (geminiCliNativeConfigured) {
+      blocks.push(
+        "\n" + style.bold("Gemini CLI native hooks:") + "\n  Your Gemini CLI hooks are installed. Restart Gemini CLI to activate Shield governance.\n"
+      );
+    }
+    if (geminiCliHostedConfigured) {
+      blocks.push(
+        "\n" + style.bold("To complete your Gemini CLI setup:") + "\n  1. Open " + style.cyan("~/.gemini/settings.json") + "\n  2. Paste the config snippet shown above\n  3. Restart Gemini CLI, then run /mcp to verify\n"
+      );
+    }
     if (blocks.length > 0) {
       process.stderr.write("\n" + style.bold(style.violet("Next steps")) + "\n");
       process.stderr.write(blocks.join("") + "\n");
@@ -1298,22 +1641,96 @@ An agent for ${selectedLabel} already exists: ${style.cyan(existingForPlatform.n
   }
   return lastConfig;
 }
+var style, BANNER, NativePluginPrerequisiteMissingError, CONFIG_DIR, CONFIG_PATH, OPENCLAW_CONFIG_PATH, ANSI_PATTERN, OPENCLAW_MIN_VERSION, PLATFORM_LABELS, PLATFORM_BY_SELECTION, DEFAULT_AGENT_NAMES, DEFAULT_SHIELD_API_BASE_URL;
+var init_config = __esm({
+  "src/proxy/config.ts"() {
+    style = {
+      violet: (s) => `\x1B[38;2;124;58;237m${s}\x1B[0m`,
+      violetLight: (s) => `\x1B[38;2;167;139;250m${s}\x1B[0m`,
+      green: (s) => `\x1B[38;2;34;197;94m${s}\x1B[0m`,
+      yellow: (s) => `\x1B[38;2;245;158;11m${s}\x1B[0m`,
+      red: (s) => `\x1B[38;2;239;68;68m${s}\x1B[0m`,
+      cyan: (s) => `\x1B[38;2;6;182;212m${s}\x1B[0m`,
+      bold: (s) => `\x1B[1m${s}\x1B[0m`,
+      dim: (s) => `\x1B[2m${s}\x1B[0m`
+    };
+    BANNER = [
+      " \u2588\u2588\u2588 \u2588  \u2588 \u2588 \u2588\u2588\u2588 \u2588   \u2588\u2588\u2584 ",
+      " \u2588   \u2588  \u2588 \u2588 \u2588   \u2588   \u2588  \u2588",
+      " \u2588\u2588\u2588 \u2588\u2588\u2588\u2588 \u2588 \u2588\u2588  \u2588   \u2588  \u2588",
+      "   \u2588 \u2588  \u2588 \u2588 \u2588   \u2588   \u2588  \u2588",
+      " \u2588\u2588\u2588 \u2588  \u2588 \u2588 \u2588\u2588\u2588 \u2588\u2588\u2588 \u2588\u2588\u2580 "
+    ].map((line) => style.violet(line)).join("\n");
+    NativePluginPrerequisiteMissingError = class extends Error {
+      constructor() {
+        super("Native plugin prerequisites not met");
+        this.name = "NativePluginPrerequisiteMissingError";
+      }
+    };
+    CONFIG_DIR = join(homedir(), ".multicorn");
+    CONFIG_PATH = join(CONFIG_DIR, "config.json");
+    OPENCLAW_CONFIG_PATH = join(homedir(), ".openclaw", "openclaw.json");
+    ANSI_PATTERN = new RegExp(String.fromCharCode(27) + "\\[[0-9;]*[a-zA-Z]", "g");
+    OPENCLAW_MIN_VERSION = "2026.2.26";
+    PLATFORM_LABELS = [
+      "OpenClaw",
+      "Claude Code",
+      "Cursor",
+      "Windsurf",
+      "Cline",
+      "Claude Desktop",
+      "Gemini CLI",
+      "Local MCP / Other"
+    ];
+    PLATFORM_BY_SELECTION = {
+      1: "openclaw",
+      2: "claude-code",
+      3: "cursor",
+      4: "windsurf",
+      5: "cline",
+      6: "claude-desktop",
+      7: "gemini-cli",
+      8: "other-mcp"
+    };
+    DEFAULT_AGENT_NAMES = {
+      openclaw: "my-openclaw-agent",
+      "claude-code": "my-claude-code-agent",
+      cursor: "my-cursor-agent",
+      windsurf: "my-windsurf-agent",
+      cline: "my-cline-agent",
+      "claude-desktop": "my-claude-desktop-agent",
+      "gemini-cli": "my-gemini-cli-agent"
+    };
+    DEFAULT_SHIELD_API_BASE_URL = "https://api.multicorn.ai";
+  }
+});
 
 // src/types/index.ts
-var PERMISSION_LEVELS = {
-  Read: "read",
-  Write: "write",
-  Execute: "execute",
-  Publish: "publish",
-  Create: "create"
-};
+var PERMISSION_LEVELS;
+var init_types = __esm({
+  "src/types/index.ts"() {
+    PERMISSION_LEVELS = {
+      Read: "read",
+      Write: "write",
+      Execute: "execute",
+      Publish: "publish",
+      Create: "create"
+    };
+  }
+});
 
 // src/scopes/scope-parser.ts
-var VALID_PERMISSION_LEVELS = new Set(Object.values(PERMISSION_LEVELS));
-[...VALID_PERMISSION_LEVELS].join(", ");
 function formatScope(scope) {
   return `${scope.permissionLevel}:${scope.service}`;
 }
+var VALID_PERMISSION_LEVELS;
+var init_scope_parser = __esm({
+  "src/scopes/scope-parser.ts"() {
+    init_types();
+    VALID_PERMISSION_LEVELS = new Set(Object.values(PERMISSION_LEVELS));
+    [...VALID_PERMISSION_LEVELS].join(", ");
+  }
+});
 
 // src/scopes/scope-validator.ts
 function validateScopeAccess(grantedScopes, requested) {
@@ -1341,6 +1758,11 @@ function hasScope(grantedScopes, requested) {
     (granted) => granted.service === requested.service && granted.permissionLevel === requested.permissionLevel
   );
 }
+var init_scope_validator = __esm({
+  "src/scopes/scope-validator.ts"() {
+    init_scope_parser();
+  }
+});
 
 // src/logger/action-logger.ts
 function createActionLogger(config) {
@@ -1514,6 +1936,10 @@ function createActionLogger(config) {
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
+var init_action_logger = __esm({
+  "src/logger/action-logger.ts"() {
+  }
+});
 
 // src/spending/spending-checker.ts
 function createSpendingChecker(config) {
@@ -1646,13 +2072,12 @@ function validateLimits(limits) {
 function dollarsToCents(dollars) {
   return Math.round(dollars * 100);
 }
+var init_spending_checker = __esm({
+  "src/spending/spending-checker.ts"() {
+  }
+});
 
 // src/proxy/interceptor.ts
-var BLOCKED_ERROR_CODE = -32e3;
-var SPENDING_BLOCKED_ERROR_CODE = -32001;
-var INTERNAL_ERROR_CODE = -32002;
-var SERVICE_UNREACHABLE_ERROR_CODE = -32003;
-var AUTH_ERROR_CODE = -32004;
 function parseJsonRpcLine(line) {
   const trimmed = line.trim();
   if (trimmed.length === 0) return null;
@@ -1720,7 +2145,7 @@ function buildServiceUnreachableResponse(id, dashboardUrl) {
   };
 }
 function buildAuthErrorResponse(id) {
-  const message = "Action blocked: Shield API key is invalid or has been revoked. Run npx multicorn-proxy init to reconfigure.";
+  const message = "Action blocked: Shield API key is invalid or has been revoked. Run npx multicorn-shield init to reconfigure.";
   return {
     jsonrpc: "2.0",
     id,
@@ -1752,9 +2177,16 @@ function capitalize(str) {
   const first = str[0];
   return first !== void 0 ? first.toUpperCase() + str.slice(1) : str;
 }
-var MULTICORN_DIR = join(homedir(), ".multicorn");
-var SCOPES_PATH = join(MULTICORN_DIR, "scopes.json");
-var CACHE_META_PATH = join(MULTICORN_DIR, "cache-meta.json");
+var BLOCKED_ERROR_CODE, SPENDING_BLOCKED_ERROR_CODE, INTERNAL_ERROR_CODE, SERVICE_UNREACHABLE_ERROR_CODE, AUTH_ERROR_CODE;
+var init_interceptor = __esm({
+  "src/proxy/interceptor.ts"() {
+    BLOCKED_ERROR_CODE = -32e3;
+    SPENDING_BLOCKED_ERROR_CODE = -32001;
+    INTERNAL_ERROR_CODE = -32002;
+    SERVICE_UNREACHABLE_ERROR_CODE = -32003;
+    AUTH_ERROR_CODE = -32004;
+  }
+});
 function cacheKey(agentName, apiKey) {
   return createHash("sha256").update(`${agentName}:${apiKey}`).digest("hex").slice(0, 16);
 }
@@ -1825,10 +2257,14 @@ async function saveCachedScopes(agentName, agentId, scopes, apiKey) {
 function isScopesCacheFile(value) {
   return typeof value === "object" && value !== null;
 }
-
-// src/proxy/consent.ts
-var CONSENT_POLL_INTERVAL_MS = 3e3;
-var CONSENT_POLL_TIMEOUT_MS = 5 * 60 * 1e3;
+var MULTICORN_DIR, SCOPES_PATH, CACHE_META_PATH;
+var init_scope_cache = __esm({
+  "src/openclaw/scope-cache.ts"() {
+    MULTICORN_DIR = join(homedir(), ".multicorn");
+    SCOPES_PATH = join(MULTICORN_DIR, "scopes.json");
+    CACHE_META_PATH = join(MULTICORN_DIR, "cache-meta.json");
+  }
+});
 function deriveDashboardUrl(baseUrl) {
   try {
     const url = new URL(baseUrl);
@@ -1853,13 +2289,6 @@ function deriveDashboardUrl(baseUrl) {
     return "https://app.multicorn.ai";
   }
 }
-var ShieldAuthError = class _ShieldAuthError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "ShieldAuthError";
-    Object.setPrototypeOf(this, _ShieldAuthError.prototype);
-  }
-};
 async function findAgentByName(agentName, apiKey, baseUrl) {
   let response;
   try {
@@ -2052,13 +2481,25 @@ function isPermissionShape(value) {
   const obj = value;
   return typeof obj["service"] === "string" && typeof obj["read"] === "boolean" && typeof obj["write"] === "boolean" && typeof obj["execute"] === "boolean" && (obj["revoked_at"] === null || obj["revoked_at"] === void 0 || typeof obj["revoked_at"] === "string");
 }
-
-// src/proxy/index.ts
-var DEFAULT_SCOPE_REFRESH_INTERVAL_MS = 6e4;
+var CONSENT_POLL_INTERVAL_MS, CONSENT_POLL_TIMEOUT_MS, ShieldAuthError;
+var init_consent = __esm({
+  "src/proxy/consent.ts"() {
+    init_scope_cache();
+    CONSENT_POLL_INTERVAL_MS = 3e3;
+    CONSENT_POLL_TIMEOUT_MS = 5 * 60 * 1e3;
+    ShieldAuthError = class _ShieldAuthError extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "ShieldAuthError";
+        Object.setPrototypeOf(this, _ShieldAuthError.prototype);
+      }
+    };
+  }
+});
 function createProxyServer(config) {
   if (!config.baseUrl.startsWith("https://") && !config.baseUrl.startsWith("http://localhost") && !config.baseUrl.startsWith("http://127.0.0.1")) {
     throw new Error(
-      `[multicorn-proxy] Base URL must use HTTPS. Received: "${config.baseUrl}". Use https:// or http://localhost for local development.`
+      `[multicorn-shield] Base URL must use HTTPS. Received: "${config.baseUrl}". Use https:// or http://localhost for local development.`
     );
   }
   let child = null;
@@ -2155,7 +2596,7 @@ function createProxyServer(config) {
           if (actionLogger !== null) {
             if (!config.agentName || config.agentName.trim().length === 0) {
               process.stderr.write(
-                "[multicorn-proxy] Cannot log action: agent name not resolved\n"
+                "[multicorn-shield] Cannot log action: agent name not resolved\n"
               );
             } else {
               config.logger.debug("Logging blocked action (post-consent).", {
@@ -2185,7 +2626,7 @@ function createProxyServer(config) {
             if (actionLogger !== null) {
               if (!config.agentName || config.agentName.trim().length === 0) {
                 process.stderr.write(
-                  "[multicorn-proxy] Cannot log action: agent name not resolved\n"
+                  "[multicorn-shield] Cannot log action: agent name not resolved\n"
                 );
               } else {
                 config.logger.debug("Logging blocked action (spending).", {
@@ -2214,7 +2655,7 @@ function createProxyServer(config) {
       }
       if (actionLogger !== null) {
         if (!config.agentName || config.agentName.trim().length === 0) {
-          process.stderr.write("[multicorn-proxy] Cannot log action: agent name not resolved\n");
+          process.stderr.write("[multicorn-shield] Cannot log action: agent name not resolved\n");
         } else {
           config.logger.debug("Logging approved action.", {
             agent: config.agentName,
@@ -2296,7 +2737,7 @@ function createProxyServer(config) {
         agent: config.agentName
       });
       process.stderr.write(
-        "\nError: API key was rejected by the Multicorn service.\nCheck your key at https://app.multicorn.ai/settings#api-keys or run `npx multicorn-proxy init` to reconfigure.\n\n"
+        "\nError: API key was rejected by the Multicorn service.\nCheck your key at https://app.multicorn.ai/settings#api-keys or run `npx multicorn-shield init` to reconfigure.\n\n"
       );
       throw new Error("API key was rejected by the Multicorn service.");
     }
@@ -2369,12 +2810,17 @@ function extractCostCents(args) {
   if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) return 0;
   return dollarsToCents(amount);
 }
-var LOG_LEVELS = {
-  debug: 0,
-  info: 1,
-  warn: 2,
-  error: 3
-};
+var DEFAULT_SCOPE_REFRESH_INTERVAL_MS;
+var init_proxy = __esm({
+  "src/proxy/index.ts"() {
+    init_scope_validator();
+    init_action_logger();
+    init_spending_checker();
+    init_interceptor();
+    init_consent();
+    DEFAULT_SCOPE_REFRESH_INTERVAL_MS = 6e4;
+  }
+});
 function createLogger(level, output = process.stderr) {
   const minLevel = LOG_LEVELS[level];
   function write(logLevel, msg, data) {
@@ -2405,8 +2851,93 @@ function createLogger(level, output = process.stderr) {
 function isValidLogLevel(value) {
   return typeof value === "string" && Object.hasOwn(LOG_LEVELS, value);
 }
+var LOG_LEVELS;
+var init_logger = __esm({
+  "src/proxy/logger.ts"() {
+    LOG_LEVELS = {
+      debug: 0,
+      info: 1,
+      warn: 2,
+      error: 3
+    };
+  }
+});
+function getExtensionBackupPath() {
+  return join(homedir(), ".multicorn", EXTENSION_BACKUP_FILENAME);
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function readExtensionBackup() {
+  try {
+    const raw = await readFile(getExtensionBackupPath(), "utf8");
+    const parsed = JSON.parse(raw);
+    if (!isRecord(parsed)) return null;
+    if (parsed["version"] !== 1) return null;
+    if (typeof parsed["createdAt"] !== "string") return null;
+    if (typeof parsed["claudeDesktopConfigPath"] !== "string") return null;
+    const mcpServers = parsed["mcpServers"];
+    if (!isRecord(mcpServers)) return null;
+    return {
+      version: 1,
+      createdAt: parsed["createdAt"],
+      claudeDesktopConfigPath: parsed["claudeDesktopConfigPath"],
+      mcpServers
+    };
+  } catch {
+    return null;
+  }
+}
+var EXTENSION_BACKUP_FILENAME;
+var init_config_reader = __esm({
+  "src/extension/config-reader.ts"() {
+    EXTENSION_BACKUP_FILENAME = "extension-backup.json";
+  }
+});
+function isErrnoException2(e) {
+  return typeof e === "object" && e !== null && "code" in e;
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function restoreClaudeDesktopMcpFromBackup() {
+  const backup = await readExtensionBackup();
+  if (backup === null) {
+    throw new Error(
+      "No Shield extension backup found. Expected ~/.multicorn/extension-backup.json from a previous Shield Desktop Extension session."
+    );
+  }
+  const configPath = getClaudeDesktopConfigPath();
+  let root = {};
+  try {
+    const raw = await readFile(configPath, "utf8");
+    const parsed = JSON.parse(raw);
+    if (isRecord2(parsed)) {
+      root = parsed;
+    }
+  } catch (error) {
+    if (!isErrnoException2(error) || error.code !== "ENOENT") {
+      throw error;
+    }
+  }
+  root["mcpServers"] = backup.mcpServers;
+  await mkdir(dirname(configPath), { recursive: true });
+  await writeFile(configPath, JSON.stringify(root, null, 2) + "\n", { encoding: "utf8" });
+}
+var init_restore = __esm({
+  "src/extension/restore.ts"() {
+    init_config();
+    init_config_reader();
+  }
+});
 
-// bin/multicorn-proxy.ts
+// bin/multicorn-shield.ts
+var multicorn_shield_exports = {};
+__export(multicorn_shield_exports, {
+  parseArgs: () => parseArgs,
+  resolveWrapConfig: () => resolveWrapConfig,
+  runCli: () => runCli
+});
 function parseArgs(argv) {
   const args = argv.slice(2);
   let subcommand = "help";
@@ -2429,7 +2960,7 @@ function parseArgs(argv) {
       const name = args[i + 1];
       if (name === void 0 || name.startsWith("-")) {
         process.stderr.write("Error: delete-agent requires an agent name.\n");
-        process.stderr.write("Example: npx multicorn-proxy delete-agent my-agent\n");
+        process.stderr.write("Example: npx multicorn-shield delete-agent my-agent\n");
         process.exit(1);
       }
       deleteAgentName = name;
@@ -2481,7 +3012,7 @@ function parseArgs(argv) {
       }
       if (remaining.length === 0) {
         process.stderr.write("Error: --wrap requires a command to run.\n");
-        process.stderr.write("Example: npx multicorn-proxy --wrap my-mcp-server\n");
+        process.stderr.write("Example: npx multicorn-shield --wrap my-mcp-server\n");
         process.exit(1);
       }
       wrapCommand = remaining[0] ?? "";
@@ -2534,19 +3065,22 @@ function parseArgs(argv) {
 function printHelp() {
   process.stderr.write(
     [
-      "multicorn-proxy: MCP permission proxy",
+      "multicorn-shield: MCP permission proxy and Shield setup",
       "",
       "Usage:",
-      "  npx multicorn-proxy init",
+      "  npx multicorn-shield init",
       "      Interactive setup. Saves API key to ~/.multicorn/config.json.",
       "",
-      "  npx multicorn-proxy agents",
+      "  npx multicorn-shield restore",
+      "      Restore MCP servers in claude_desktop_config.json from the Shield extension backup.",
+      "",
+      "  npx multicorn-shield agents",
       "      List configured agents and show which is the default.",
       "",
-      "  npx multicorn-proxy delete-agent <name>",
+      "  npx multicorn-shield delete-agent <name>",
       "      Remove a saved agent.",
       "",
-      "  npx multicorn-proxy --wrap <command> [args...]",
+      "  npx multicorn-shield --wrap <command> [args...]",
       "      Start <command> as an MCP server and proxy all tool calls through",
       "      Shield's permission layer.",
       "",
@@ -2558,14 +3092,22 @@ function printHelp() {
       "  --agent-name <name>   Override agent name derived from the wrapped command",
       "",
       "Examples:",
-      "  npx multicorn-proxy init",
-      "  npx multicorn-proxy --wrap npx @modelcontextprotocol/server-filesystem /tmp",
-      "  npx multicorn-proxy --wrap my-mcp-server --log-level debug",
+      "  npx multicorn-shield init",
+      "  npx multicorn-shield --wrap npx @modelcontextprotocol/server-filesystem /tmp",
+      "  npx multicorn-shield --wrap my-mcp-server --log-level debug",
       ""
     ].join("\n")
   );
 }
-async function main() {
+async function runCli() {
+  const first = process.argv[2];
+  if (first === "restore") {
+    await restoreClaudeDesktopMcpFromBackup();
+    process.stderr.write(
+      "Restored MCP server entries from ~/.multicorn/extension-backup.json into Claude Desktop config.\nRestart Claude Desktop to apply changes.\n"
+    );
+    return;
+  }
   const cli = parseArgs(process.argv);
   const logger = createLogger(cli.logLevel);
   if (cli.subcommand === "help") {
@@ -2580,13 +3122,13 @@ async function main() {
     const config2 = await loadConfig();
     if (config2 === null) {
       process.stderr.write(
-        "No config found. Run `npx multicorn-proxy init` to set up your API key.\n"
+        "No config found. Run `npx multicorn-shield init` to set up your API key.\n"
       );
       process.exit(1);
     }
     const agents = collectAgentsFromConfig(config2);
     if (agents.length === 0) {
-      process.stderr.write("No agents configured. Run `npx multicorn-proxy init` to add one.\n");
+      process.stderr.write("No agents configured. Run `npx multicorn-shield init` to add one.\n");
       process.exit(0);
     }
     const def = config2.defaultAgent;
@@ -2676,7 +3218,7 @@ async function resolveWrapConfig(cli, logger) {
     return config;
   }
   process.stderr.write(
-    "No API key found. Provide one via the --api-key flag, the MULTICORN_API_KEY environment variable, or run `npx multicorn-proxy init` to set up a config file.\n"
+    "No API key found. Provide one via the --api-key flag, the MULTICORN_API_KEY environment variable, or run `npx multicorn-shield init` to set up a config file.\n"
   );
   process.exit(1);
 }
@@ -2704,14 +3246,32 @@ function deriveAgentName(command) {
   const base = command.split("/").pop() ?? command;
   return base.replace(/\.[cm]?[jt]s$/, "");
 }
-var isDirectRun = process.argv[1] !== void 0 && (import.meta.url.endsWith(process.argv[1]) || import.meta.url === `file://${process.argv[1]}` || import.meta.url.endsWith("/multicorn-proxy.js") || import.meta.url.endsWith("/multicorn-proxy.ts"));
-if (isDirectRun && process.env["VITEST"] === void 0) {
-  main().catch((error) => {
-    const message = error instanceof Error ? error.message : String(error);
-    process.stderr.write(`Fatal error: ${message}
+var isDirectRun;
+var init_multicorn_shield = __esm({
+  "bin/multicorn-shield.ts"() {
+    init_config();
+    init_proxy();
+    init_logger();
+    init_consent();
+    init_restore();
+    isDirectRun = process.argv[1] !== void 0 && (import.meta.url.endsWith(process.argv[1]) || import.meta.url === `file://${process.argv[1]}` || import.meta.url.endsWith("/multicorn-shield.js") || import.meta.url.endsWith("/multicorn-shield.ts"));
+    if (isDirectRun && process.env["VITEST"] === void 0) {
+      runCli().catch((error) => {
+        const message = error instanceof Error ? error.message : String(error);
+        process.stderr.write(`Fatal error: ${message}
 `);
-    process.exit(1);
-  });
-}
+        process.exit(1);
+      });
+    }
+  }
+});
 
-export { parseArgs, resolveWrapConfig };
+// bin/multicorn-proxy.ts
+process.stderr.write("Warning: multicorn-proxy is deprecated. Use multicorn-shield instead.\n");
+var { runCli: runCli2 } = await Promise.resolve().then(() => (init_multicorn_shield(), multicorn_shield_exports));
+void runCli2().catch((error) => {
+  const message = error instanceof Error ? error.message : String(error);
+  process.stderr.write(`Fatal error: ${message}
+`);
+  process.exit(1);
+});