multicorn-shield 0.2.2 → 0.4.0

package/dist/multicorn-proxy.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { existsSync } from 'fs';
-import { readFile, writeFile, mkdir, unlink } from 'fs/promises';
+import { readFile, mkdir, writeFile, unlink } from 'fs/promises';
 import { join } from 'path';
 import { homedir } from 'os';
 import { createInterface } from 'readline';
@@ -45,7 +45,18 @@ function withSpinner(message) {
 var CONFIG_DIR = join(homedir(), ".multicorn");
 var CONFIG_PATH = join(CONFIG_DIR, "config.json");
 var OPENCLAW_CONFIG_PATH = join(homedir(), ".openclaw", "openclaw.json");
-var OPENCLAW_MIN_VERSION = "2026.2.26";
+var ANSI_PATTERN = new RegExp(String.fromCharCode(27) + "\\[[0-9;]*[a-zA-Z]", "g");
+function stripAnsi(str) {
+  return str.replace(ANSI_PATTERN, "");
+}
+function normalizeAgentName(raw) {
+  return raw.toLowerCase().replace(/\s+/g, "-").replace(/[^a-z0-9-]/g, "").replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "").slice(0, 50);
+}
+function isProxyConfig(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const obj = value;
+  return typeof obj["apiKey"] === "string" && typeof obj["baseUrl"] === "string";
+}
 async function loadConfig() {
   try {
     const raw = await readFile(CONFIG_PATH, "utf8");
@@ -63,113 +74,6 @@ async function saveConfig(config) {
     mode: 384
   });
 }
-function isErrnoException(e) {
-  return typeof e === "object" && e !== null && "code" in e;
-}
-async function updateOpenClawConfigIfPresent(apiKey, baseUrl, agentName) {
-  let raw;
-  try {
-    raw = await readFile(OPENCLAW_CONFIG_PATH, "utf8");
-  } catch (e) {
-    if (isErrnoException(e) && e.code === "ENOENT") {
-      return "not-found";
-    }
-    throw e;
-  }
-  let obj;
-  try {
-    obj = JSON.parse(raw);
-  } catch {
-    return "parse-error";
-  }
-  let hooks = obj["hooks"];
-  if (hooks === void 0 || typeof hooks !== "object") {
-    hooks = {};
-    obj["hooks"] = hooks;
-  }
-  let internal = hooks["internal"];
-  if (internal === void 0 || typeof internal !== "object") {
-    internal = { enabled: true, entries: {} };
-    hooks["internal"] = internal;
-  }
-  let entries = internal["entries"];
-  if (entries === void 0 || typeof entries !== "object") {
-    entries = {};
-    internal["entries"] = entries;
-  }
-  let shield = entries["multicorn-shield"];
-  if (shield === void 0 || typeof shield !== "object") {
-    shield = { enabled: true, env: {} };
-    entries["multicorn-shield"] = shield;
-  }
-  let env = shield["env"];
-  if (env === void 0 || typeof env !== "object") {
-    env = {};
-    shield["env"] = env;
-  }
-  env["MULTICORN_API_KEY"] = apiKey;
-  env["MULTICORN_BASE_URL"] = baseUrl;
-  if (agentName !== void 0) {
-    env["MULTICORN_AGENT_NAME"] = agentName;
-    const agentsList = obj["agents"];
-    const list = agentsList?.["list"];
-    if (Array.isArray(list) && list.length > 0) {
-      const first = list[0];
-      if (first["id"] !== agentName) {
-        first["id"] = agentName;
-        first["name"] = agentName;
-      }
-    } else {
-      if (agentsList !== void 0 && typeof agentsList === "object") {
-        agentsList["list"] = [{ id: agentName, name: agentName }];
-      } else {
-        obj["agents"] = { list: [{ id: agentName, name: agentName }] };
-      }
-    }
-  }
-  await writeFile(OPENCLAW_CONFIG_PATH, JSON.stringify(obj, null, 2) + "\n", {
-    encoding: "utf8"
-  });
-  return "updated";
-}
-async function detectOpenClaw() {
-  let raw;
-  try {
-    raw = await readFile(OPENCLAW_CONFIG_PATH, "utf8");
-  } catch (e) {
-    if (isErrnoException(e) && e.code === "ENOENT") {
-      return { status: "not-found", version: null };
-    }
-    throw e;
-  }
-  let obj;
-  try {
-    obj = JSON.parse(raw);
-  } catch {
-    return { status: "parse-error", version: null };
-  }
-  const meta = obj["meta"];
-  if (typeof meta === "object" && meta !== null) {
-    const v = meta["lastTouchedVersion"];
-    if (typeof v === "string" && v.length > 0) {
-      return { status: "detected", version: v };
-    }
-  }
-  return { status: "detected", version: null };
-}
-function isVersionAtLeast(version, minimum) {
-  const vParts = version.split(".").map(Number);
-  const mParts = minimum.split(".").map(Number);
-  const len = Math.max(vParts.length, mParts.length);
-  for (let i = 0; i < len; i++) {
-    const v = vParts[i] ?? 0;
-    const m = mParts[i] ?? 0;
-    if (Number.isNaN(v) || Number.isNaN(m)) return false;
-    if (v > m) return true;
-    if (v < m) return false;
-  }
-  return true;
-}
 async function validateApiKey(apiKey, baseUrl) {
   try {
     const response = await fetch(`${baseUrl}/api/v1/agents`, {
@@ -194,9 +98,6 @@ async function validateApiKey(apiKey, baseUrl) {
     };
   }
 }
-function normalizeAgentName(raw) {
-  return raw.toLowerCase().replace(/\s+/g, "-").replace(/[^a-z0-9-]/g, "").replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "").slice(0, 50);
-}
 async function isOpenClawConnected() {
   try {
     const raw = await readFile(OPENCLAW_CONFIG_PATH, "utf8");
@@ -219,84 +120,227 @@ function isClaudeCodeConnected() {
     return false;
   }
 }
-function getClaudeDesktopConfigPath() {
-  switch (process.platform) {
-    case "win32":
-      return join(
-        process.env["APPDATA"] ?? join(homedir(), "AppData", "Roaming"),
-        "Claude",
-        "claude_desktop_config.json"
-      );
-    case "linux":
-      return join(homedir(), ".config", "Claude", "claude_desktop_config.json");
-    default:
-      return join(
-        homedir(),
-        "Library",
-        "Application Support",
-        "Claude",
-        "claude_desktop_config.json"
-      );
-  }
-}
-async function updateClaudeDesktopConfig(agentName, mcpServerCommand, overwrite = false) {
-  if (!/^[a-zA-Z0-9_-]+$/.test(agentName)) {
-    throw new Error("Agent name must contain only letters, numbers, hyphens, and underscores");
-  }
-  const configPath = getClaudeDesktopConfigPath();
-  let obj = {};
-  let fileExists = false;
-  try {
-    const raw = await readFile(configPath, "utf8");
-    fileExists = true;
-    try {
-      obj = JSON.parse(raw);
-    } catch {
-      return "parse-error";
-    }
-  } catch (e) {
-    if (isErrnoException(e) && e.code === "ENOENT") {
-      fileExists = false;
-    } else {
-      throw e;
-    }
-  }
-  let mcpServers = obj["mcpServers"];
-  if (mcpServers === void 0 || typeof mcpServers !== "object") {
-    mcpServers = {};
-    obj["mcpServers"] = mcpServers;
-  }
-  if (mcpServers[agentName] !== void 0 && !overwrite) {
-    return "skipped";
-  }
-  const commandParts = mcpServerCommand.trim().split(/\s+/);
-  mcpServers[agentName] = {
-    command: "npx",
-    args: ["multicorn-proxy", "--wrap", ...commandParts, "--agent-name", agentName]
-  };
-  const configDir = join(configPath, "..");
-  if (!fileExists) {
-    await mkdir(configDir, { recursive: true });
-  }
-  await writeFile(configPath, JSON.stringify(obj, null, 2) + "\n", { encoding: "utf8" });
-  return fileExists ? "updated" : "created";
+function getCursorConfigPath() {
+  return join(homedir(), ".cursor", "mcp.json");
 }
-async function isClaudeDesktopConnected() {
+async function isCursorConnected() {
   try {
-    const raw = await readFile(getClaudeDesktopConfigPath(), "utf8");
+    const raw = await readFile(getCursorConfigPath(), "utf8");
     const obj = JSON.parse(raw);
     const mcpServers = obj["mcpServers"];
     if (mcpServers === void 0 || typeof mcpServers !== "object") return false;
     for (const entry of Object.values(mcpServers)) {
       if (typeof entry !== "object" || entry === null) continue;
-      const args = entry["args"];
+      const rec = entry;
+      const url = rec["url"];
+      if (typeof url === "string" && url.includes("multicorn")) return true;
+      const args = rec["args"];
       if (Array.isArray(args) && args.includes("multicorn-proxy")) return true;
     }
     return false;
-  } catch {
+  } catch (err) {
+    process.stderr.write(
+      `Warning: could not check Cursor connection status: ${err instanceof Error ? err.message : String(err)}
+`
+    );
     return false;
   }
 }
+var PLATFORM_LABELS = ["OpenClaw", "Claude Code", "Cursor"];
+var PLATFORM_BY_SELECTION = {
+  1: "openclaw",
+  2: "claude-code",
+  3: "cursor"
+};
+var DEFAULT_AGENT_NAMES = {
+  openclaw: "my-openclaw-agent",
+  "claude-code": "my-claude-code-agent",
+  cursor: "my-cursor-agent"
+};
+async function promptPlatformSelection(ask) {
+  process.stderr.write(
+    "\n" + style.bold(style.violet("Which platform are you connecting?")) + "\n"
+  );
+  const connectedFlags = [
+    await isOpenClawConnected(),
+    isClaudeCodeConnected(),
+    await isCursorConnected()
+  ];
+  for (let i = 0; i < PLATFORM_LABELS.length; i++) {
+    const marker = connectedFlags[i] ? " " + style.green("\u2713") + style.dim(" connected") : "";
+    process.stderr.write(
+      `  ${style.violet(String(i + 1))}. ${PLATFORM_LABELS[i] ?? ""}${marker}
+`
+    );
+  }
+  let selection = 0;
+  while (selection === 0) {
+    const input = await ask("Select (1-3): ");
+    const num = parseInt(input.trim(), 10);
+    if (num >= 1 && num <= 3) {
+      selection = num;
+    }
+  }
+  return selection;
+}
+async function promptAgentName(ask, platform) {
+  const defaultAgentName = DEFAULT_AGENT_NAMES[platform] ?? "my-agent";
+  let agentName = "";
+  while (agentName.length === 0) {
+    const input = await ask(
+      `
+What would you like to call this agent? ${style.dim(`(${defaultAgentName})`)} `
+    );
+    const raw = input.trim().length > 0 ? input.trim() : defaultAgentName;
+    const transformed = normalizeAgentName(raw);
+    if (transformed.length === 0) {
+      process.stderr.write(
+        style.red("Agent name must contain letters or numbers. Please try again.") + "\n"
+      );
+      continue;
+    }
+    if (transformed !== raw) {
+      process.stderr.write(style.yellow("Agent name set to: ") + style.cyan(transformed) + "\n");
+    }
+    agentName = transformed;
+  }
+  return agentName;
+}
+async function promptProxyConfig(ask, agentName) {
+  let targetUrl = "";
+  while (targetUrl.length === 0) {
+    process.stderr.write(
+      "\n" + style.bold("Target MCP server URL:") + "\n" + style.dim(
+        "The URL of the MCP server you want Shield to protect. Example: https://your-server.example.com/mcp"
+      ) + "\n"
+    );
+    const input = await ask("URL: ");
+    if (input.trim().length === 0) {
+      process.stderr.write(style.red("MCP server URL is required.") + "\n");
+      continue;
+    }
+    try {
+      new URL(input.trim());
+    } catch {
+      process.stderr.write(
+        style.red(
+          "\u2717 That does not look like a valid URL. Please enter a full URL including the scheme (e.g. https://your-server.example.com/mcp)."
+        ) + "\n"
+      );
+      continue;
+    }
+    targetUrl = input.trim();
+  }
+  const defaultShortName = normalizeAgentName(agentName) || "shield-mcp";
+  const shortNameInput = await ask(
+    `
+Short name (a nickname for this connection, used in your proxy URL): ${style.dim(`(${defaultShortName})`)} `
+  );
+  const shortName = shortNameInput.trim().length > 0 ? normalizeAgentName(shortNameInput.trim()) || defaultShortName : defaultShortName;
+  return { targetUrl, shortName };
+}
+async function createProxyConfig(baseUrl, apiKey, agentName, targetUrl, serverName, platform) {
+  let response;
+  try {
+    response = await fetch(`${baseUrl}/api/v1/proxy/config`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "X-Multicorn-Key": apiKey
+      },
+      body: JSON.stringify({
+        server_name: serverName,
+        target_url: targetUrl,
+        platform,
+        agent_name: agentName
+      }),
+      signal: AbortSignal.timeout(1e4)
+    });
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    throw new Error(`Failed to create proxy config: ${detail}`);
+  }
+  if (!response.ok) {
+    let errorMsg = `Shield API returned an error (HTTP ${String(response.status)}). Check your agent name and target URL, then try again.`;
+    try {
+      const errBody = await response.json();
+      const errObj = errBody["error"];
+      if (typeof errObj?.["message"] === "string") {
+        errorMsg = stripAnsi(errObj["message"]);
+      } else if (typeof errBody["message"] === "string") {
+        errorMsg = stripAnsi(errBody["message"]);
+      } else if (typeof errBody["detail"] === "string") {
+        errorMsg = stripAnsi(errBody["detail"]);
+      }
+    } catch {
+    }
+    throw new Error(errorMsg);
+  }
+  const envelope = await response.json();
+  const data = envelope["data"];
+  return typeof data?.["proxy_url"] === "string" ? data["proxy_url"] : "";
+}
+function printPlatformSnippet(platform, routingToken, shortName) {
+  const mcpSnippet = JSON.stringify(
+    {
+      mcpServers: {
+        [shortName]: {
+          url: routingToken,
+          headers: {
+            Authorization: "Bearer YOUR_SHIELD_API_KEY"
+          }
+        }
+      }
+    },
+    null,
+    2
+  );
+  if (platform === "openclaw") {
+    process.stderr.write("\n" + style.dim("Add this to your OpenClaw agent config:") + "\n\n");
+  } else if (platform === "claude-code") {
+    process.stderr.write("\n" + style.dim("Add this to your Claude Code MCP config:") + "\n\n");
+  } else {
+    process.stderr.write("\n" + style.dim("Add this to ~/.cursor/mcp.json:") + "\n\n");
+  }
+  process.stderr.write(style.cyan(mcpSnippet) + "\n\n");
+  process.stderr.write(
+    style.dim(
+      "Replace YOUR_SHIELD_API_KEY with your API key. Find it in Settings > API keys at https://app.multicorn.ai/settings/api-keys"
+    ) + "\n"
+  );
+  if (platform === "cursor") {
+    process.stderr.write(
+      style.dim(
+        "Then restart Cursor and check Settings > Tools & MCPs for a green status indicator."
+      ) + "\n"
+    );
+    process.stderr.write(
+      style.dim(
+        `Ask Cursor to use your MCP server by its short name. For example: "use the ${shortName} tool to list files in /tmp"`
+      ) + "\n"
+    );
+  }
+}
+function printOpenClawInstructions() {
+  process.stderr.write("\n" + style.green("\u2713") + " Agent registered!\n");
+  process.stderr.write(
+    "\nTo connect this agent, add the Multicorn Shield plugin to your OpenClaw agent:\n"
+  );
+  process.stderr.write("\n  " + style.cyan("openclaw plugins add multicorn-shield") + "\n");
+  process.stderr.write(
+    "\nThen start your agent. Shield will monitor and protect tool calls automatically.\n"
+  );
+}
+function printClaudeCodeInstructions() {
+  process.stderr.write("\n" + style.green("\u2713") + " Agent registered!\n");
+  process.stderr.write(
+    "\nTo connect this agent, install the Multicorn Shield plugin in Claude Code:\n"
+  );
+  process.stderr.write("\n  " + style.cyan("claude plugins install multicorn-shield") + "\n");
+  process.stderr.write(
+    "\nThen start a new Claude Code session. Shield will monitor and protect tool calls automatically.\n"
+  );
+}
 async function runInit(baseUrl = "https://api.multicorn.ai", platform) {
   if (!process.stdin.isTTY) {
     process.stderr.write(
@@ -305,20 +349,15 @@ async function runInit(baseUrl = "https://api.multicorn.ai", platform) {
     process.exit(1);
   }
   const rl = createInterface({ input: process.stdin, output: process.stderr });
-  function ask(question) {
-    return new Promise((resolve) => {
-      rl.question(question, (answer) => {
-        resolve(answer);
-      });
-    });
-  }
+  const ask = (question) => new Promise((resolve) => {
+    rl.question(question, resolve);
+  });
   process.stderr.write("\n" + BANNER + "\n");
   process.stderr.write(style.dim("Agent governance for the AI era") + "\n\n");
   process.stderr.write(style.bold(style.violet("Multicorn Shield proxy setup")) + "\n\n");
   process.stderr.write(
     style.dim("Get your API key at https://app.multicorn.ai/settings/api-keys") + "\n\n"
   );
-  let apiKey = "";
   const existing = await loadConfig().catch(() => null);
   if (baseUrl === "https://api.multicorn.ai") {
     if (existing !== null && existing.baseUrl.length > 0) {
@@ -330,6 +369,7 @@ async function runInit(baseUrl = "https://api.multicorn.ai", platform) {
       }
     }
   }
+  let apiKey = "";
   if (existing !== null && existing.apiKey.startsWith("mcs_") && existing.apiKey.length >= 8) {
     const masked = "mcs_..." + existing.apiKey.slice(-4);
     process.stderr.write("Found existing API key: " + style.cyan(masked) + "\n");
@@ -360,7 +400,14 @@ async function runInit(baseUrl = "https://api.multicorn.ai", platform) {
     spinner.stop(true, "Key validated");
     apiKey = key;
   }
-  const configuredPlatforms = /* @__PURE__ */ new Set();
+  if (!baseUrl.startsWith("https://") && !baseUrl.startsWith("http://localhost") && !baseUrl.startsWith("http://127.0.0.1")) {
+    process.stderr.write(
+      style.red(`\u2717 Shield API base URL must use HTTPS. Got: ${baseUrl}`) + "\n"
+    );
+    rl.close();
+    return null;
+  }
+  const configuredAgents = [];
   let lastConfig = {
     apiKey,
     baseUrl,
@@ -368,239 +415,55 @@ async function runInit(baseUrl = "https://api.multicorn.ai", platform) {
   };
   let configuring = true;
   while (configuring) {
-    process.stderr.write(
-      "\n" + style.bold(style.violet("Which platform are you connecting?")) + "\n"
-    );
-    const platformLabels = ["OpenClaw", "Claude Code", "Claude Desktop", "Other MCP Agent"];
-    const openClawConnected = await isOpenClawConnected();
-    const claudeCodeConnected = isClaudeCodeConnected();
-    const claudeDesktopConnected = await isClaudeDesktopConnected();
-    for (let i = 0; i < platformLabels.length; i++) {
-      const sessionMarker = configuredPlatforms.has(i + 1) ? " " + style.green("\u2713") : "";
-      let connectedMarker = "";
-      if (!configuredPlatforms.has(i + 1)) {
-        if (i === 0 && openClawConnected) {
-          connectedMarker = " " + style.green("\u2713") + style.dim(" connected");
-        } else if (i === 1 && claudeCodeConnected) {
-          connectedMarker = " " + style.green("\u2713") + style.dim(" connected");
-        } else if (i === 2 && claudeDesktopConnected) {
-          connectedMarker = " " + style.green("\u2713") + style.dim(" connected");
-        }
-      }
-      process.stderr.write(
-        `  ${style.violet(String(i + 1))}. ${platformLabels[i] ?? ""}${sessionMarker}${connectedMarker}
-`
-      );
-    }
-    let selection = 0;
-    while (selection === 0) {
-      const input = await ask("Select (1-4): ");
-      const num = parseInt(input.trim(), 10);
-      if (num >= 1 && num <= 4) {
-        selection = num;
-      }
-    }
-    let agentName = "";
-    while (agentName.length === 0) {
-      const input = await ask("\nWhat would you like to call this agent? ");
-      if (input.trim().length === 0) continue;
-      const transformed = normalizeAgentName(input);
-      if (transformed.length === 0) {
-        process.stderr.write(
-          style.red("Agent name must contain letters or numbers. Please try again.") + "\n"
-        );
-        continue;
-      }
-      if (transformed !== input.trim()) {
-        process.stderr.write(style.yellow("Agent name set to: ") + style.cyan(transformed) + "\n");
-      }
-      agentName = transformed;
-    }
+    const selection = await promptPlatformSelection(ask);
+    const selectedPlatform = PLATFORM_BY_SELECTION[selection] ?? "cursor";
+    const selectedLabel = PLATFORM_LABELS[selection - 1] ?? "Cursor";
+    const agentName = await promptAgentName(ask, selectedPlatform);
     if (selection === 1) {
-      let detection;
-      try {
-        detection = await detectOpenClaw();
-      } catch (error) {
-        const detail = error instanceof Error ? error.message : String(error);
-        process.stderr.write(style.red("\u2717") + ` Failed to read OpenClaw config: ${detail}
-`);
-        rl.close();
-        return null;
-      }
-      if (detection.status === "not-found") {
-        process.stderr.write(
-          style.red("\u2717") + " OpenClaw is not installed. Install OpenClaw first, then run npx multicorn-proxy init again.\n"
-        );
-        rl.close();
-        return null;
-      }
-      if (detection.status === "parse-error") {
-        process.stderr.write(
-          style.red("\u2717") + " Could not update OpenClaw config. Set MULTICORN_API_KEY in ~/.openclaw/openclaw.json manually.\n"
-        );
-      }
-      if (detection.status === "detected") {
-        if (detection.version !== null) {
-          process.stderr.write(
-            style.green("\u2713") + ` OpenClaw detected ${style.dim(`(${detection.version})`)}
-`
-          );
-          if (isVersionAtLeast(detection.version, OPENCLAW_MIN_VERSION)) {
-            process.stderr.write(
-              style.green("\u2713") + " " + style.green("Version compatible") + "\n"
-            );
-          } else {
-            process.stderr.write(
-              style.yellow("\u26A0") + ` Shield has been tested with OpenClaw ${style.cyan(OPENCLAW_MIN_VERSION)} and above. Your version (${detection.version}) may work but is untested. We recommend upgrading to at least ${style.cyan(OPENCLAW_MIN_VERSION)}.
-`
-            );
-            const answer = await ask("Continue anyway? (y/N) ");
-            if (answer.trim().toLowerCase() !== "y") {
-              rl.close();
-              return null;
-            }
-          }
-        } else {
-          process.stderr.write(
-            style.yellow("\u26A0") + " Could not detect OpenClaw version. Continuing anyway.\n"
-          );
-        }
-        const spinner = withSpinner("Updating OpenClaw config...");
-        try {
-          const result = await updateOpenClawConfigIfPresent(apiKey, baseUrl, agentName);
-          if (result === "not-found") {
-            spinner.stop(false, "OpenClaw config disappeared unexpectedly.");
-            rl.close();
-            return null;
-          }
-          if (result === "parse-error") {
-            spinner.stop(
-              false,
-              "Could not update OpenClaw config. Set MULTICORN_API_KEY in ~/.openclaw/openclaw.json manually."
-            );
-          } else {
-            spinner.stop(
-              true,
-              "OpenClaw config updated at " + style.cyan("~/.openclaw/openclaw.json")
-            );
-          }
-        } catch (error) {
-          const detail = error instanceof Error ? error.message : String(error);
-          spinner.stop(false, `Failed to update OpenClaw config: ${detail}`);
-        }
-      }
+      printOpenClawInstructions();
+      configuredAgents.push({ platformLabel: selectedLabel, agentName });
     } else if (selection === 2) {
-      process.stderr.write("\nTo connect Claude Code to Shield:\n\n");
-      process.stderr.write(
-        "  " + style.bold("Step 1") + " - Add the Multicorn marketplace:\n    " + style.cyan("claude plugin marketplace add Multicorn-AI/multicorn-shield") + "\n\n"
-      );
-      process.stderr.write(
-        "  " + style.bold("Step 2") + " - Install the plugin:\n    " + style.cyan("claude plugin install multicorn-shield@multicorn-shield") + "\n\n"
-      );
-      process.stderr.write(
-        "  " + style.bold("Step 3") + " - Start Claude Code:\n    " + style.cyan("claude") + "\n\n"
-      );
-      process.stderr.write(
-        style.dim("Run /plugin inside Claude Code to confirm multicorn-shield is installed.") + "\n"
-      );
-      process.stderr.write(
-        style.dim("Requires Claude Code to be installed. Get it at https://code.claude.com") + "\n"
-      );
-    } else if (selection === 3) {
-      const mcpCommand = await ask(
-        "\nWhat MCP server should Shield govern for this agent?\nThis is the command you'd normally use to start your MCP server.\nExample: npx -y @modelcontextprotocol/server-filesystem /tmp\nLeave blank to skip and configure later: "
-      );
-      if (mcpCommand.trim().length === 0) {
-        const configPath = getClaudeDesktopConfigPath();
-        process.stderr.write("\n" + style.dim("Add this to your Claude Desktop config at:") + "\n");
-        process.stderr.write("  " + style.cyan(configPath) + "\n\n");
-        const snippet = JSON.stringify(
-          {
-            mcpServers: {
-              [agentName]: {
-                command: "npx",
-                args: [
-                  "multicorn-proxy",
-                  "--wrap",
-                  "<your-mcp-server-command>",
-                  "--agent-name",
-                  agentName
-                ]
-              }
-            }
-          },
-          null,
-          2
-        );
-        process.stderr.write(style.cyan(snippet) + "\n\n");
-      } else {
-        let shouldWrite = true;
-        const spinner = withSpinner("Updating Claude Desktop config...");
+      printClaudeCodeInstructions();
+      configuredAgents.push({ platformLabel: selectedLabel, agentName });
+    } else {
+      const { targetUrl, shortName } = await promptProxyConfig(ask, agentName);
+      let proxyUrl = "";
+      let created = false;
+      while (!created) {
+        const spinner = withSpinner("Creating proxy config...");
         try {
-          let result = await updateClaudeDesktopConfig(agentName, mcpCommand.trim());
-          if (result === "skipped") {
-            spinner.stop(false, `Agent "${agentName}" already exists in Claude Desktop config.`);
-            const overwrite = await ask("Overwrite the existing entry? (y/N) ");
-            if (overwrite.trim().toLowerCase() === "y") {
-              const retrySpinner = withSpinner("Updating Claude Desktop config...");
-              result = await updateClaudeDesktopConfig(agentName, mcpCommand.trim(), true);
-              retrySpinner.stop(
-                true,
-                "Claude Desktop config updated at " + style.cyan(getClaudeDesktopConfigPath())
-              );
-            } else {
-              shouldWrite = false;
-              process.stderr.write(style.dim("Skipped. Existing config left unchanged.") + "\n");
-            }
-          } else if (result === "parse-error") {
-            spinner.stop(false, "Claude Desktop config file contains invalid JSON.");
-            const configPath = getClaudeDesktopConfigPath();
-            process.stderr.write(
-              style.yellow("\u26A0") + " Fix the JSON in " + style.cyan(configPath) + " or add this entry manually:\n\n"
-            );
-            const snippet = JSON.stringify(
-              {
-                mcpServers: {
-                  [agentName]: {
-                    command: "npx",
-                    args: [
-                      "multicorn-proxy",
-                      "--wrap",
-                      ...mcpCommand.trim().split(/\s+/),
-                      "--agent-name",
-                      agentName
-                    ]
-                  }
-                }
-              },
-              null,
-              2
-            );
-            process.stderr.write(style.cyan(snippet) + "\n\n");
-          } else {
-            const verb = result === "created" ? "Created" : "Updated";
-            spinner.stop(
-              true,
-              verb + " Claude Desktop config at " + style.cyan(getClaudeDesktopConfigPath())
-            );
-            process.stderr.write(style.dim("Restart Claude Desktop to pick up changes.") + "\n");
-          }
+          proxyUrl = await createProxyConfig(
+            baseUrl,
+            apiKey,
+            agentName,
+            targetUrl,
+            shortName,
+            selectedPlatform
+          );
+          spinner.stop(true, "Proxy config created!");
+          created = true;
         } catch (error) {
           const detail = error instanceof Error ? error.message : String(error);
-          spinner.stop(false, `Failed to update Claude Desktop config: ${detail}`);
-          shouldWrite = false;
+          spinner.stop(false, detail);
+          const retry = await ask("Try again? (Y/n) ");
+          if (retry.trim().toLowerCase() === "n") {
+            break;
+          }
         }
       }
-    } else {
-      process.stderr.write("\n" + style.dim("Start the Shield proxy with:") + "\n");
-      process.stderr.write(
-        "  " + style.cyan(
-          `npx multicorn-proxy --wrap <your-mcp-server-command> --agent-name ${agentName}`
-        ) + "\n\n"
-      );
+      if (created && proxyUrl.length > 0) {
+        process.stderr.write("\n" + style.bold("Your Shield proxy URL:") + "\n");
+        process.stderr.write("  " + style.cyan(proxyUrl) + "\n");
+        printPlatformSnippet(selectedPlatform, proxyUrl, shortName);
+        configuredAgents.push({
+          platformLabel: selectedLabel,
+          agentName,
+          shortName,
+          proxyUrl
+        });
+      }
     }
-    configuredPlatforms.add(selection);
-    lastConfig = { apiKey, baseUrl, agentName, ...{} };
+    lastConfig = { apiKey, baseUrl, agentName, platform: selectedPlatform };
     try {
       await saveConfig(lastConfig);
       process.stderr.write(style.green("\u2713") + ` Config saved to ${style.cyan(CONFIG_PATH)}
@@ -609,52 +472,24 @@ async function runInit(baseUrl = "https://api.multicorn.ai", platform) {
       const detail = error instanceof Error ? error.message : String(error);
       process.stderr.write(style.red(`Failed to save config: ${detail}`) + "\n");
     }
-    if (configuredPlatforms.size >= 4) {
-      configuring = false;
-      continue;
-    }
-    const another = await ask("\nWould you like to configure another agent? (y/N) ");
-    if (another.trim().toLowerCase() !== "y") {
+    const another = await ask("\nConnect another agent? (Y/n) ");
+    if (another.trim().toLowerCase() === "n") {
       configuring = false;
     }
   }
   rl.close();
-  process.stderr.write("\n" + style.bold(style.violet("Setup complete")) + "\n\n");
-  const allPlatforms = ["OpenClaw", "Claude Code", "Claude Desktop", "Other MCP Agent"];
-  for (const idx of configuredPlatforms) {
-    process.stderr.write(`  ${style.green("\u2713")} ${allPlatforms[idx - 1] ?? ""}
-`);
-  }
-  process.stderr.write("\n" + style.bold(style.violet("Next steps")) + "\n");
-  const blocks = [];
-  if (configuredPlatforms.has(1)) {
-    blocks.push(
-      "\n" + style.bold("To complete your OpenClaw setup:") + "\n  \u2192 Restart your gateway: " + style.cyan("openclaw gateway restart") + "\n  \u2192 Start a session: " + style.cyan("openclaw tui") + "\n"
-    );
-  }
-  if (configuredPlatforms.has(2)) {
-    blocks.push(
-      "\n" + style.bold("To complete your Claude Code setup:") + "\n  \u2192 Add marketplace: " + style.cyan("claude plugin marketplace add Multicorn-AI/multicorn-shield") + "\n  \u2192 Install plugin: " + style.cyan("claude plugin install multicorn-shield@multicorn-shield") + "\n"
-    );
-  }
-  if (configuredPlatforms.has(3)) {
-    blocks.push(
-      "\n" + style.bold("To complete your Claude Desktop setup:") + "\n  \u2192 Restart Claude Desktop to pick up config changes\n"
-    );
-  }
-  if (configuredPlatforms.has(4)) {
-    blocks.push(
-      "\n" + style.bold("To complete your Other MCP Agent setup:") + "\n  \u2192 Start your agent with: " + style.cyan("npx multicorn-proxy --wrap <your-server> --agent-name <name>") + "\n"
-    );
+  if (configuredAgents.length > 0) {
+    process.stderr.write("\n" + style.bold(style.violet("Setup complete")) + "\n\n");
+    for (const agent of configuredAgents) {
+      process.stderr.write(
+        `  ${style.green("\u2713")} ${agent.platformLabel} - ${style.cyan(agent.agentName)}${agent.proxyUrl != null ? ` ${style.dim(`(${agent.proxyUrl})`)}` : ""}
+`
+      );
+    }
+    process.stderr.write("\n");
   }
-  process.stderr.write(blocks.join("") + "\n");
   return lastConfig;
 }
-function isProxyConfig(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const obj = value;
-  return typeof obj["apiKey"] === "string" && typeof obj["baseUrl"] === "string";
-}
 
 // src/types/index.ts
 var PERMISSION_LEVELS = {
@@ -1340,7 +1175,6 @@ async function resolveAgentRecord(agentName, apiKey, baseUrl, logger, platform)
   const cachedScopes = await loadCachedScopes(agentName, apiKey);
   if (cachedScopes !== null && cachedScopes.length > 0) {
     logger.debug("Loaded scopes from cache.", { agent: agentName, count: cachedScopes.length });
-    return { id: "", name: agentName, scopes: cachedScopes };
   }
   let agent = await findAgentByName(agentName, apiKey, baseUrl);
   if (agent?.authInvalid) {
@@ -1357,6 +1191,10 @@ async function resolveAgentRecord(agentName, apiKey, baseUrl, logger, platform)
         return { id: "", name: agentName, scopes: [], authInvalid: true };
       }
       const detail = error instanceof Error ? error.message : String(error);
+      if (cachedScopes !== null && cachedScopes.length > 0) {
+        logger.warn("Service unreachable. Using cached scopes.", { error: detail });
+        return { id: "", name: agentName, scopes: cachedScopes };
+      }
       logger.warn("Could not reach Multicorn service. Running with empty permissions.", {
         error: detail
       });
@@ -1485,16 +1323,26 @@ function createProxyServer(config) {
       }
       const service = extractServiceFromToolName(toolParams.name);
       const action = extractActionFromToolName(toolParams.name);
+      config.logger.debug("Extracted tool identity.", {
+        tool: toolParams.name,
+        service,
+        action
+      });
       const requestedScope = { service, permissionLevel: "execute" };
       const validation = validateScopeAccess(grantedScopes, requestedScope);
-      config.logger.debug("Tool call intercepted.", {
+      config.logger.debug("Scope validation result.", {
         tool: toolParams.name,
-        service,
-        allowed: validation.allowed
+        allowed: validation.allowed,
+        scopeCount: grantedScopes.length
       });
       if (!validation.allowed) {
         await ensureConsent(requestedScope);
         const revalidation = validateScopeAccess(grantedScopes, requestedScope);
+        config.logger.debug("Post-consent revalidation result.", {
+          tool: toolParams.name,
+          allowed: revalidation.allowed,
+          scopeCount: grantedScopes.length
+        });
         if (!revalidation.allowed) {
           if (actionLogger !== null) {
             if (!config.agentName || config.agentName.trim().length === 0) {
@@ -1502,12 +1350,18 @@ function createProxyServer(config) {
                 "[multicorn-proxy] Cannot log action: agent name not resolved\n"
               );
             } else {
+              config.logger.debug("Logging blocked action (post-consent).", {
+                agent: config.agentName,
+                service,
+                action
+              });
               await actionLogger.logAction({
                 agent: config.agentName,
                 service,
                 actionType: action,
                 status: "blocked"
               });
+              config.logger.debug("Blocked action logged.", { tool: toolParams.name });
             }
           }
           return JSON.stringify(
@@ -1526,12 +1380,18 @@ function createProxyServer(config) {
                   "[multicorn-proxy] Cannot log action: agent name not resolved\n"
                 );
               } else {
+                config.logger.debug("Logging blocked action (spending).", {
+                  agent: config.agentName,
+                  service,
+                  action
+                });
                 await actionLogger.logAction({
                   agent: config.agentName,
                   service,
                   actionType: action,
                   status: "blocked"
                 });
+                config.logger.debug("Spending-blocked action logged.", { tool: toolParams.name });
               }
             }
             const blocked = buildSpendingBlockedResponse(
@@ -1548,12 +1408,18 @@ function createProxyServer(config) {
         if (!config.agentName || config.agentName.trim().length === 0) {
           process.stderr.write("[multicorn-proxy] Cannot log action: agent name not resolved\n");
         } else {
+          config.logger.debug("Logging approved action.", {
+            agent: config.agentName,
+            service,
+            action
+          });
           await actionLogger.logAction({
             agent: config.agentName,
             service,
             actionType: action,
             status: "approved"
           });
+          config.logger.debug("Approved action logged.", { tool: toolParams.name });
         }
       }
       return null;
@@ -1747,6 +1613,38 @@ function parseArgs(argv) {
       }
       wrapCommand = next;
       wrapArgs = args.slice(i + 2);
+      const cleaned = [];
+      for (let j = 0; j < wrapArgs.length; j++) {
+        const token = wrapArgs[j];
+        if (token === "--agent-name") {
+          const value = wrapArgs[j + 1];
+          if (value !== void 0) {
+            agentName = value;
+            j++;
+          }
+        } else if (token === "--log-level") {
+          const value = wrapArgs[j + 1];
+          if (value !== void 0 && isValidLogLevel(value)) {
+            logLevel = value;
+            j++;
+          }
+        } else if (token === "--base-url") {
+          const value = wrapArgs[j + 1];
+          if (value !== void 0) {
+            baseUrl = value;
+            j++;
+          }
+        } else if (token === "--dashboard-url") {
+          const value = wrapArgs[j + 1];
+          if (value !== void 0) {
+            dashboardUrl = value;
+            j++;
+          }
+        } else if (token !== void 0) {
+          cleaned.push(token);
+        }
+      }
+      wrapArgs = cleaned;
       break;
     } else if (arg === "--log-level") {
       const next = args[i + 1];
@@ -1840,7 +1738,7 @@ Use https:// or http://localhost for local development.
     baseUrl: finalBaseUrl,
     dashboardUrl: finalDashboardUrl,
     logger,
-    platform: "other-mcp"
+    platform: config.platform ?? "other-mcp"
   });
   async function shutdown() {
     logger.info("Shutting down.");