multicorn-shield 0.2.2 → 0.6.0

package/dist/multicorn-proxy.js

@@ -45,17 +45,106 @@ function withSpinner(message) {
 var CONFIG_DIR = join(homedir(), ".multicorn");
 var CONFIG_PATH = join(CONFIG_DIR, "config.json");
 var OPENCLAW_CONFIG_PATH = join(homedir(), ".openclaw", "openclaw.json");
-var OPENCLAW_MIN_VERSION = "2026.2.26";
+var ANSI_PATTERN = new RegExp(String.fromCharCode(27) + "\\[[0-9;]*[a-zA-Z]", "g");
+function stripAnsi(str) {
+  return str.replace(ANSI_PATTERN, "");
+}
+function normalizeAgentName(raw) {
+  return raw.toLowerCase().replace(/\s+/g, "-").replace(/[^a-z0-9-]/g, "").replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "").slice(0, 50);
+}
+function isErrnoException(e) {
+  return typeof e === "object" && e !== null && "code" in e;
+}
+function isProxyConfig(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const obj = value;
+  return typeof obj["apiKey"] === "string" && typeof obj["baseUrl"] === "string";
+}
+function isAgentEntry(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const o = value;
+  return typeof o["name"] === "string" && typeof o["platform"] === "string";
+}
+function getAgentByPlatform(config, platform) {
+  const list = config.agents;
+  if (list === void 0 || list.length === 0) return void 0;
+  return list.find((a) => a.platform === platform);
+}
+function getDefaultAgent(config) {
+  const list = config.agents;
+  if (list === void 0 || list.length === 0) return void 0;
+  const defName = config.defaultAgent;
+  if (typeof defName === "string" && defName.length > 0) {
+    const match = list.find((a) => a.name === defName);
+    if (match !== void 0) return match;
+  }
+  return list[0];
+}
+function collectAgentsFromConfig(cfg) {
+  if (cfg === null) return [];
+  if (cfg.agents !== void 0 && cfg.agents.length > 0) {
+    return cfg.agents.map((a) => ({ name: a.name, platform: a.platform }));
+  }
+  const raw = cfg;
+  const legacyName = raw["agentName"];
+  const legacyPlatform = raw["platform"];
+  if (typeof legacyName === "string" && legacyName.length > 0) {
+    const plat = typeof legacyPlatform === "string" && legacyPlatform.length > 0 ? legacyPlatform : "unknown";
+    return [{ name: legacyName, platform: plat }];
+  }
+  return [];
+}
 async function loadConfig() {
   try {
     const raw = await readFile(CONFIG_PATH, "utf8");
     const parsed = JSON.parse(raw);
     if (!isProxyConfig(parsed)) return null;
-    return parsed;
+    const obj = parsed;
+    const agentNameRaw = obj["agentName"];
+    const agentsRaw = obj["agents"];
+    const hasNonEmptyAgents = Array.isArray(agentsRaw) && agentsRaw.length > 0 && agentsRaw.every((e) => isAgentEntry(e));
+    const needsMigrate = typeof agentNameRaw === "string" && agentNameRaw.length > 0 && !hasNonEmptyAgents;
+    if (!needsMigrate) {
+      return parsed;
+    }
+    const platform = typeof obj["platform"] === "string" && obj["platform"].length > 0 ? obj["platform"] : "unknown";
+    const next = { ...obj };
+    delete next["agentName"];
+    delete next["platform"];
+    next["agents"] = [{ name: agentNameRaw, platform }];
+    next["defaultAgent"] = agentNameRaw;
+    const migrated = next;
+    await saveConfig(migrated);
+    return migrated;
   } catch {
     return null;
   }
 }
+async function deleteAgentByName(name) {
+  const config = await loadConfig();
+  if (config === null) return false;
+  const agents = collectAgentsFromConfig(config);
+  const idx = agents.findIndex((a) => a.name === name);
+  if (idx === -1) return false;
+  const nextAgents = agents.filter((_, i) => i !== idx);
+  let defaultAgent = config.defaultAgent;
+  if (defaultAgent === name) {
+    defaultAgent = void 0;
+  }
+  const raw = { ...config };
+  if (nextAgents.length > 0) {
+    raw["agents"] = nextAgents;
+  } else {
+    delete raw["agents"];
+  }
+  if (defaultAgent !== void 0 && defaultAgent.length > 0) {
+    raw["defaultAgent"] = defaultAgent;
+  } else {
+    delete raw["defaultAgent"];
+  }
+  await saveConfig(raw);
+  return true;
+}
 async function saveConfig(config) {
   await mkdir(CONFIG_DIR, { recursive: true, mode: 448 });
   await writeFile(CONFIG_PATH, JSON.stringify(config, null, 2) + "\n", {
@@ -63,8 +152,44 @@ async function saveConfig(config) {
     mode: 384
   });
 }
-function isErrnoException(e) {
-  return typeof e === "object" && e !== null && "code" in e;
+var OPENCLAW_MIN_VERSION = "2026.2.26";
+async function detectOpenClaw() {
+  let raw;
+  try {
+    raw = await readFile(OPENCLAW_CONFIG_PATH, "utf8");
+  } catch (e) {
+    if (isErrnoException(e) && e.code === "ENOENT") {
+      return { status: "not-found", version: null };
+    }
+    throw e;
+  }
+  let obj;
+  try {
+    obj = JSON.parse(raw);
+  } catch {
+    return { status: "parse-error", version: null };
+  }
+  const meta = obj["meta"];
+  if (typeof meta === "object" && meta !== null) {
+    const v = meta["lastTouchedVersion"];
+    if (typeof v === "string" && v.length > 0) {
+      return { status: "detected", version: v };
+    }
+  }
+  return { status: "detected", version: null };
+}
+function isVersionAtLeast(version, minimum) {
+  const vParts = version.split(".").map(Number);
+  const mParts = minimum.split(".").map(Number);
+  const len = Math.max(vParts.length, mParts.length);
+  for (let i = 0; i < len; i++) {
+    const v = vParts[i] ?? 0;
+    const m = mParts[i] ?? 0;
+    if (Number.isNaN(v) || Number.isNaN(m)) return false;
+    if (v > m) return true;
+    if (v < m) return false;
+  }
+  return true;
 }
 async function updateOpenClawConfigIfPresent(apiKey, baseUrl, agentName) {
   let raw;
@@ -132,44 +257,6 @@ async function updateOpenClawConfigIfPresent(apiKey, baseUrl, agentName) {
   });
   return "updated";
 }
-async function detectOpenClaw() {
-  let raw;
-  try {
-    raw = await readFile(OPENCLAW_CONFIG_PATH, "utf8");
-  } catch (e) {
-    if (isErrnoException(e) && e.code === "ENOENT") {
-      return { status: "not-found", version: null };
-    }
-    throw e;
-  }
-  let obj;
-  try {
-    obj = JSON.parse(raw);
-  } catch {
-    return { status: "parse-error", version: null };
-  }
-  const meta = obj["meta"];
-  if (typeof meta === "object" && meta !== null) {
-    const v = meta["lastTouchedVersion"];
-    if (typeof v === "string" && v.length > 0) {
-      return { status: "detected", version: v };
-    }
-  }
-  return { status: "detected", version: null };
-}
-function isVersionAtLeast(version, minimum) {
-  const vParts = version.split(".").map(Number);
-  const mParts = minimum.split(".").map(Number);
-  const len = Math.max(vParts.length, mParts.length);
-  for (let i = 0; i < len; i++) {
-    const v = vParts[i] ?? 0;
-    const m = mParts[i] ?? 0;
-    if (Number.isNaN(v) || Number.isNaN(m)) return false;
-    if (v > m) return true;
-    if (v < m) return false;
-  }
-  return true;
-}
 async function validateApiKey(apiKey, baseUrl) {
   try {
     const response = await fetch(`${baseUrl}/api/v1/agents`, {
@@ -194,9 +281,6 @@ async function validateApiKey(apiKey, baseUrl) {
     };
   }
 }
-function normalizeAgentName(raw) {
-  return raw.toLowerCase().replace(/\s+/g, "-").replace(/[^a-z0-9-]/g, "").replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "").slice(0, 50);
-}
 async function isOpenClawConnected() {
   try {
     const raw = await readFile(OPENCLAW_CONFIG_PATH, "utf8");
@@ -219,85 +303,211 @@ function isClaudeCodeConnected() {
     return false;
   }
 }
-function getClaudeDesktopConfigPath() {
-  switch (process.platform) {
-    case "win32":
-      return join(
-        process.env["APPDATA"] ?? join(homedir(), "AppData", "Roaming"),
-        "Claude",
-        "claude_desktop_config.json"
-      );
-    case "linux":
-      return join(homedir(), ".config", "Claude", "claude_desktop_config.json");
-    default:
-      return join(
-        homedir(),
-        "Library",
-        "Application Support",
-        "Claude",
-        "claude_desktop_config.json"
-      );
-  }
-}
-async function updateClaudeDesktopConfig(agentName, mcpServerCommand, overwrite = false) {
-  if (!/^[a-zA-Z0-9_-]+$/.test(agentName)) {
-    throw new Error("Agent name must contain only letters, numbers, hyphens, and underscores");
-  }
-  const configPath = getClaudeDesktopConfigPath();
-  let obj = {};
-  let fileExists = false;
-  try {
-    const raw = await readFile(configPath, "utf8");
-    fileExists = true;
-    try {
-      obj = JSON.parse(raw);
-    } catch {
-      return "parse-error";
-    }
-  } catch (e) {
-    if (isErrnoException(e) && e.code === "ENOENT") {
-      fileExists = false;
-    } else {
-      throw e;
-    }
-  }
-  let mcpServers = obj["mcpServers"];
-  if (mcpServers === void 0 || typeof mcpServers !== "object") {
-    mcpServers = {};
-    obj["mcpServers"] = mcpServers;
-  }
-  if (mcpServers[agentName] !== void 0 && !overwrite) {
-    return "skipped";
-  }
-  const commandParts = mcpServerCommand.trim().split(/\s+/);
-  mcpServers[agentName] = {
-    command: "npx",
-    args: ["multicorn-proxy", "--wrap", ...commandParts, "--agent-name", agentName]
-  };
-  const configDir = join(configPath, "..");
-  if (!fileExists) {
-    await mkdir(configDir, { recursive: true });
-  }
-  await writeFile(configPath, JSON.stringify(obj, null, 2) + "\n", { encoding: "utf8" });
-  return fileExists ? "updated" : "created";
+function getCursorConfigPath() {
+  return join(homedir(), ".cursor", "mcp.json");
 }
-async function isClaudeDesktopConnected() {
+async function isCursorConnected() {
   try {
-    const raw = await readFile(getClaudeDesktopConfigPath(), "utf8");
+    const raw = await readFile(getCursorConfigPath(), "utf8");
     const obj = JSON.parse(raw);
     const mcpServers = obj["mcpServers"];
     if (mcpServers === void 0 || typeof mcpServers !== "object") return false;
     for (const entry of Object.values(mcpServers)) {
       if (typeof entry !== "object" || entry === null) continue;
-      const args = entry["args"];
+      const rec = entry;
+      const url = rec["url"];
+      if (typeof url === "string" && url.includes("multicorn")) return true;
+      const args = rec["args"];
       if (Array.isArray(args) && args.includes("multicorn-proxy")) return true;
     }
     return false;
-  } catch {
+  } catch (err) {
+    process.stderr.write(
+      `Warning: could not check Cursor connection status: ${err instanceof Error ? err.message : String(err)}
+`
+    );
     return false;
   }
 }
-async function runInit(baseUrl = "https://api.multicorn.ai", platform) {
+var PLATFORM_LABELS = ["OpenClaw", "Claude Code", "Cursor"];
+var PLATFORM_BY_SELECTION = {
+  1: "openclaw",
+  2: "claude-code",
+  3: "cursor"
+};
+var DEFAULT_AGENT_NAMES = {
+  openclaw: "my-openclaw-agent",
+  "claude-code": "my-claude-code-agent",
+  cursor: "my-cursor-agent"
+};
+async function promptPlatformSelection(ask) {
+  process.stderr.write(
+    "\n" + style.bold(style.violet("Which platform are you connecting?")) + "\n"
+  );
+  const connectedFlags = [
+    await isOpenClawConnected(),
+    isClaudeCodeConnected(),
+    await isCursorConnected()
+  ];
+  for (let i = 0; i < PLATFORM_LABELS.length; i++) {
+    const marker = connectedFlags[i] ? " " + style.green("\u2713") + style.dim(" connected") : "";
+    process.stderr.write(
+      `  ${style.violet(String(i + 1))}. ${PLATFORM_LABELS[i] ?? ""}${marker}
+`
+    );
+  }
+  let selection = 0;
+  while (selection === 0) {
+    const input = await ask("Select (1-3): ");
+    const num = parseInt(input.trim(), 10);
+    if (num >= 1 && num <= 3) {
+      selection = num;
+    }
+  }
+  return selection;
+}
+async function promptAgentName(ask, platform) {
+  const defaultAgentName = DEFAULT_AGENT_NAMES[platform] ?? "my-agent";
+  let agentName = "";
+  while (agentName.length === 0) {
+    const input = await ask(
+      `
+What would you like to call this agent? ${style.dim(`(${defaultAgentName})`)} `
+    );
+    const raw = input.trim().length > 0 ? input.trim() : defaultAgentName;
+    const transformed = normalizeAgentName(raw);
+    if (transformed.length === 0) {
+      process.stderr.write(
+        style.red("Agent name must contain letters or numbers. Please try again.") + "\n"
+      );
+      continue;
+    }
+    if (transformed !== raw) {
+      process.stderr.write(style.yellow("Agent name set to: ") + style.cyan(transformed) + "\n");
+    }
+    agentName = transformed;
+  }
+  return agentName;
+}
+async function promptProxyConfig(ask, agentName) {
+  let targetUrl = "";
+  while (targetUrl.length === 0) {
+    process.stderr.write(
+      "\n" + style.bold("Target MCP server URL:") + "\n" + style.dim(
+        "The URL of the MCP server you want Shield to protect. Example: https://your-server.example.com/mcp"
+      ) + "\n"
+    );
+    const input = await ask("URL: ");
+    if (input.trim().length === 0) {
+      process.stderr.write(style.red("MCP server URL is required.") + "\n");
+      continue;
+    }
+    try {
+      new URL(input.trim());
+    } catch {
+      process.stderr.write(
+        style.red(
+          "\u2717 That does not look like a valid URL. Please enter a full URL including the scheme (e.g. https://your-server.example.com/mcp)."
+        ) + "\n"
+      );
+      continue;
+    }
+    targetUrl = input.trim();
+  }
+  const defaultShortName = normalizeAgentName(agentName) || "shield-mcp";
+  const shortNameInput = await ask(
+    `
+Short name (a nickname for this connection, used in your proxy URL): ${style.dim(`(${defaultShortName})`)} `
+  );
+  const shortName = shortNameInput.trim().length > 0 ? normalizeAgentName(shortNameInput.trim()) || defaultShortName : defaultShortName;
+  return { targetUrl, shortName };
+}
+async function createProxyConfig(baseUrl, apiKey, agentName, targetUrl, serverName, platform) {
+  let response;
+  try {
+    response = await fetch(`${baseUrl}/api/v1/proxy/config`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "X-Multicorn-Key": apiKey
+      },
+      body: JSON.stringify({
+        server_name: serverName,
+        target_url: targetUrl,
+        platform,
+        agent_name: agentName
+      }),
+      signal: AbortSignal.timeout(1e4)
+    });
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    throw new Error(`Failed to create proxy config: ${detail}`);
+  }
+  if (!response.ok) {
+    let errorMsg = `Shield API returned an error (HTTP ${String(response.status)}). Check your agent name and target URL, then try again.`;
+    try {
+      const errBody = await response.json();
+      const errObj = errBody["error"];
+      if (typeof errObj?.["message"] === "string") {
+        errorMsg = stripAnsi(errObj["message"]);
+      } else if (typeof errBody["message"] === "string") {
+        errorMsg = stripAnsi(errBody["message"]);
+      } else if (typeof errBody["detail"] === "string") {
+        errorMsg = stripAnsi(errBody["detail"]);
+      }
+    } catch {
+    }
+    throw new Error(errorMsg);
+  }
+  const envelope = await response.json();
+  const data = envelope["data"];
+  return typeof data?.["proxy_url"] === "string" ? data["proxy_url"] : "";
+}
+function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
+  const authHeader = platform === "cursor" ? `Bearer ${apiKey}` : "Bearer YOUR_SHIELD_API_KEY";
+  const mcpSnippet = JSON.stringify(
+    {
+      mcpServers: {
+        [shortName]: {
+          url: routingToken,
+          headers: {
+            Authorization: authHeader
+          }
+        }
+      }
+    },
+    null,
+    2
+  );
+  if (platform === "openclaw") {
+    process.stderr.write("\n" + style.dim("Add this to your OpenClaw agent config:") + "\n\n");
+  } else if (platform === "claude-code") {
+    process.stderr.write("\n" + style.dim("Add this to your Claude Code MCP config:") + "\n\n");
+  } else {
+    process.stderr.write("\n" + style.dim("Add this to ~/.cursor/mcp.json:") + "\n\n");
+  }
+  process.stderr.write(style.cyan(mcpSnippet) + "\n\n");
+  if (platform !== "cursor") {
+    process.stderr.write(
+      style.dim(
+        "Replace YOUR_SHIELD_API_KEY with your API key. Find it in Settings > API keys at https://app.multicorn.ai/settings/api-keys"
+      ) + "\n"
+    );
+  }
+  if (platform === "cursor") {
+    process.stderr.write(
+      style.dim(
+        "Then restart Cursor and check Settings > Tools & MCPs for a green status indicator."
+      ) + "\n"
+    );
+    process.stderr.write(
+      style.dim(
+        `Ask Cursor to use your MCP server by its short name. For example: "use the ${shortName} tool to list files in /tmp"`
+      ) + "\n"
+    );
+  }
+}
+async function runInit(baseUrl = "https://api.multicorn.ai") {
   if (!process.stdin.isTTY) {
     process.stderr.write(
       style.red("Error: interactive terminal required. Cannot run init with piped input.") + "\n"
@@ -305,20 +515,15 @@ async function runInit(baseUrl = "https://api.multicorn.ai", platform) {
     process.exit(1);
   }
   const rl = createInterface({ input: process.stdin, output: process.stderr });
-  function ask(question) {
-    return new Promise((resolve) => {
-      rl.question(question, (answer) => {
-        resolve(answer);
-      });
-    });
-  }
+  const ask = (question) => new Promise((resolve) => {
+    rl.question(question, resolve);
+  });
   process.stderr.write("\n" + BANNER + "\n");
   process.stderr.write(style.dim("Agent governance for the AI era") + "\n\n");
   process.stderr.write(style.bold(style.violet("Multicorn Shield proxy setup")) + "\n\n");
   process.stderr.write(
     style.dim("Get your API key at https://app.multicorn.ai/settings/api-keys") + "\n\n"
   );
-  let apiKey = "";
   const existing = await loadConfig().catch(() => null);
   if (baseUrl === "https://api.multicorn.ai") {
     if (existing !== null && existing.baseUrl.length > 0) {
@@ -330,6 +535,7 @@ async function runInit(baseUrl = "https://api.multicorn.ai", platform) {
       }
     }
   }
+  let apiKey = "";
   if (existing !== null && existing.apiKey.startsWith("mcs_") && existing.apiKey.length >= 8) {
     const masked = "mcs_..." + existing.apiKey.slice(-4);
     process.stderr.write("Found existing API key: " + style.cyan(masked) + "\n");
@@ -360,62 +566,46 @@ async function runInit(baseUrl = "https://api.multicorn.ai", platform) {
     spinner.stop(true, "Key validated");
     apiKey = key;
   }
-  const configuredPlatforms = /* @__PURE__ */ new Set();
+  if (!baseUrl.startsWith("https://") && !baseUrl.startsWith("http://localhost") && !baseUrl.startsWith("http://127.0.0.1")) {
+    process.stderr.write(
+      style.red(`\u2717 Shield API base URL must use HTTPS. Got: ${baseUrl}`) + "\n"
+    );
+    rl.close();
+    return null;
+  }
+  const configuredAgents = [];
+  let currentAgents = collectAgentsFromConfig(existing);
   let lastConfig = {
     apiKey,
     baseUrl,
-    ...{}
+    ...currentAgents.length > 0 ? {
+      agents: currentAgents,
+      defaultAgent: existing !== null && typeof existing.defaultAgent === "string" && existing.defaultAgent.length > 0 ? existing.defaultAgent : currentAgents[currentAgents.length - 1]?.name ?? ""
+    } : {}
   };
   let configuring = true;
   while (configuring) {
-    process.stderr.write(
-      "\n" + style.bold(style.violet("Which platform are you connecting?")) + "\n"
-    );
-    const platformLabels = ["OpenClaw", "Claude Code", "Claude Desktop", "Other MCP Agent"];
-    const openClawConnected = await isOpenClawConnected();
-    const claudeCodeConnected = isClaudeCodeConnected();
-    const claudeDesktopConnected = await isClaudeDesktopConnected();
-    for (let i = 0; i < platformLabels.length; i++) {
-      const sessionMarker = configuredPlatforms.has(i + 1) ? " " + style.green("\u2713") : "";
-      let connectedMarker = "";
-      if (!configuredPlatforms.has(i + 1)) {
-        if (i === 0 && openClawConnected) {
-          connectedMarker = " " + style.green("\u2713") + style.dim(" connected");
-        } else if (i === 1 && claudeCodeConnected) {
-          connectedMarker = " " + style.green("\u2713") + style.dim(" connected");
-        } else if (i === 2 && claudeDesktopConnected) {
-          connectedMarker = " " + style.green("\u2713") + style.dim(" connected");
-        }
-      }
+    const selection = await promptPlatformSelection(ask);
+    const selectedPlatform = PLATFORM_BY_SELECTION[selection] ?? "cursor";
+    const selectedLabel = PLATFORM_LABELS[selection - 1] ?? "Cursor";
+    const existingForPlatform = currentAgents.find((a) => a.platform === selectedPlatform);
+    if (existingForPlatform !== void 0) {
       process.stderr.write(
-        `  ${style.violet(String(i + 1))}. ${platformLabels[i] ?? ""}${sessionMarker}${connectedMarker}
+        `
+An agent for ${selectedLabel} already exists: ${style.cyan(existingForPlatform.name)}
 `
       );
-    }
-    let selection = 0;
-    while (selection === 0) {
-      const input = await ask("Select (1-4): ");
-      const num = parseInt(input.trim(), 10);
-      if (num >= 1 && num <= 4) {
-        selection = num;
-      }
-    }
-    let agentName = "";
-    while (agentName.length === 0) {
-      const input = await ask("\nWhat would you like to call this agent? ");
-      if (input.trim().length === 0) continue;
-      const transformed = normalizeAgentName(input);
-      if (transformed.length === 0) {
-        process.stderr.write(
-          style.red("Agent name must contain letters or numbers. Please try again.") + "\n"
-        );
+      const replace = await ask("Replace it? (Y/n) ");
+      if (replace.trim().toLowerCase() === "n") {
+        const another2 = await ask("\nConnect another agent? (Y/n) ");
+        if (another2.trim().toLowerCase() === "n") {
+          configuring = false;
+        }
         continue;
       }
-      if (transformed !== input.trim()) {
-        process.stderr.write(style.yellow("Agent name set to: ") + style.cyan(transformed) + "\n");
-      }
-      agentName = transformed;
     }
+    const agentName = await promptAgentName(ask, selectedPlatform);
+    let setupSucceeded = false;
     if (selection === 1) {
       let detection;
       try {
@@ -489,6 +679,13 @@ async function runInit(baseUrl = "https://api.multicorn.ai", platform) {
           spinner.stop(false, `Failed to update OpenClaw config: ${detail}`);
         }
       }
+      configuredAgents.push({
+        selection,
+        platform: selectedPlatform,
+        platformLabel: selectedLabel,
+        agentName
+      });
+      setupSucceeded = true;
     } else if (selection === 2) {
       process.stderr.write("\nTo connect Claude Code to Shield:\n\n");
       process.stderr.write(
@@ -497,164 +694,126 @@ async function runInit(baseUrl = "https://api.multicorn.ai", platform) {
       process.stderr.write(
         "  " + style.bold("Step 2") + " - Install the plugin:\n    " + style.cyan("claude plugin install multicorn-shield@multicorn-shield") + "\n\n"
       );
-      process.stderr.write(
-        "  " + style.bold("Step 3") + " - Start Claude Code:\n    " + style.cyan("claude") + "\n\n"
-      );
-      process.stderr.write(
-        style.dim("Run /plugin inside Claude Code to confirm multicorn-shield is installed.") + "\n"
-      );
       process.stderr.write(
         style.dim("Requires Claude Code to be installed. Get it at https://code.claude.com") + "\n"
       );
-    } else if (selection === 3) {
-      const mcpCommand = await ask(
-        "\nWhat MCP server should Shield govern for this agent?\nThis is the command you'd normally use to start your MCP server.\nExample: npx -y @modelcontextprotocol/server-filesystem /tmp\nLeave blank to skip and configure later: "
-      );
-      if (mcpCommand.trim().length === 0) {
-        const configPath = getClaudeDesktopConfigPath();
-        process.stderr.write("\n" + style.dim("Add this to your Claude Desktop config at:") + "\n");
-        process.stderr.write("  " + style.cyan(configPath) + "\n\n");
-        const snippet = JSON.stringify(
-          {
-            mcpServers: {
-              [agentName]: {
-                command: "npx",
-                args: [
-                  "multicorn-proxy",
-                  "--wrap",
-                  "<your-mcp-server-command>",
-                  "--agent-name",
-                  agentName
-                ]
-              }
-            }
-          },
-          null,
-          2
-        );
-        process.stderr.write(style.cyan(snippet) + "\n\n");
-      } else {
-        let shouldWrite = true;
-        const spinner = withSpinner("Updating Claude Desktop config...");
+      configuredAgents.push({
+        selection,
+        platform: selectedPlatform,
+        platformLabel: selectedLabel,
+        agentName
+      });
+      setupSucceeded = true;
+    } else {
+      const { targetUrl, shortName } = await promptProxyConfig(ask, agentName);
+      let proxyUrl = "";
+      let created = false;
+      while (!created) {
+        const spinner = withSpinner("Creating proxy config...");
         try {
-          let result = await updateClaudeDesktopConfig(agentName, mcpCommand.trim());
-          if (result === "skipped") {
-            spinner.stop(false, `Agent "${agentName}" already exists in Claude Desktop config.`);
-            const overwrite = await ask("Overwrite the existing entry? (y/N) ");
-            if (overwrite.trim().toLowerCase() === "y") {
-              const retrySpinner = withSpinner("Updating Claude Desktop config...");
-              result = await updateClaudeDesktopConfig(agentName, mcpCommand.trim(), true);
-              retrySpinner.stop(
-                true,
-                "Claude Desktop config updated at " + style.cyan(getClaudeDesktopConfigPath())
-              );
-            } else {
-              shouldWrite = false;
-              process.stderr.write(style.dim("Skipped. Existing config left unchanged.") + "\n");
-            }
-          } else if (result === "parse-error") {
-            spinner.stop(false, "Claude Desktop config file contains invalid JSON.");
-            const configPath = getClaudeDesktopConfigPath();
-            process.stderr.write(
-              style.yellow("\u26A0") + " Fix the JSON in " + style.cyan(configPath) + " or add this entry manually:\n\n"
-            );
-            const snippet = JSON.stringify(
-              {
-                mcpServers: {
-                  [agentName]: {
-                    command: "npx",
-                    args: [
-                      "multicorn-proxy",
-                      "--wrap",
-                      ...mcpCommand.trim().split(/\s+/),
-                      "--agent-name",
-                      agentName
-                    ]
-                  }
-                }
-              },
-              null,
-              2
-            );
-            process.stderr.write(style.cyan(snippet) + "\n\n");
-          } else {
-            const verb = result === "created" ? "Created" : "Updated";
-            spinner.stop(
-              true,
-              verb + " Claude Desktop config at " + style.cyan(getClaudeDesktopConfigPath())
-            );
-            process.stderr.write(style.dim("Restart Claude Desktop to pick up changes.") + "\n");
-          }
+          proxyUrl = await createProxyConfig(
+            baseUrl,
+            apiKey,
+            agentName,
+            targetUrl,
+            shortName,
+            selectedPlatform
+          );
+          spinner.stop(true, "Proxy config created!");
+          created = true;
         } catch (error) {
           const detail = error instanceof Error ? error.message : String(error);
-          spinner.stop(false, `Failed to update Claude Desktop config: ${detail}`);
-          shouldWrite = false;
+          spinner.stop(false, detail);
+          const retry = await ask("Try again? (Y/n) ");
+          if (retry.trim().toLowerCase() === "n") {
+            break;
+          }
         }
       }
-    } else {
-      process.stderr.write("\n" + style.dim("Start the Shield proxy with:") + "\n");
-      process.stderr.write(
-        "  " + style.cyan(
-          `npx multicorn-proxy --wrap <your-mcp-server-command> --agent-name ${agentName}`
-        ) + "\n\n"
-      );
-    }
-    configuredPlatforms.add(selection);
-    lastConfig = { apiKey, baseUrl, agentName, ...{} };
-    try {
-      await saveConfig(lastConfig);
-      process.stderr.write(style.green("\u2713") + ` Config saved to ${style.cyan(CONFIG_PATH)}
-`);
-    } catch (error) {
-      const detail = error instanceof Error ? error.message : String(error);
-      process.stderr.write(style.red(`Failed to save config: ${detail}`) + "\n");
+      if (created && proxyUrl.length > 0) {
+        process.stderr.write("\n" + style.bold("Your Shield proxy URL:") + "\n");
+        process.stderr.write("  " + style.cyan(proxyUrl) + "\n");
+        printPlatformSnippet(selectedPlatform, proxyUrl, shortName, apiKey);
+        configuredAgents.push({
+          selection,
+          platform: selectedPlatform,
+          platformLabel: selectedLabel,
+          agentName,
+          shortName,
+          proxyUrl
+        });
+        setupSucceeded = true;
+      }
     }
-    if (configuredPlatforms.size >= 4) {
-      configuring = false;
-      continue;
+    if (setupSucceeded) {
+      currentAgents = currentAgents.filter((a) => a.platform !== selectedPlatform);
+      currentAgents.push({ name: agentName, platform: selectedPlatform });
+      const raw = existing !== null ? { ...existing } : {};
+      raw["apiKey"] = apiKey;
+      raw["baseUrl"] = baseUrl;
+      raw["agents"] = currentAgents;
+      raw["defaultAgent"] = agentName;
+      delete raw["agentName"];
+      delete raw["platform"];
+      lastConfig = raw;
+      try {
+        await saveConfig(lastConfig);
+        process.stderr.write(
+          style.green("\u2713") + ` Config saved to ${style.cyan(CONFIG_PATH)}
+`
+        );
+      } catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        process.stderr.write(style.red(`Failed to save config: ${detail}`) + "\n");
+      }
     }
-    const another = await ask("\nWould you like to configure another agent? (y/N) ");
-    if (another.trim().toLowerCase() !== "y") {
+    const another = await ask("\nConnect another agent? (Y/n) ");
+    if (another.trim().toLowerCase() === "n") {
       configuring = false;
     }
   }
   rl.close();
-  process.stderr.write("\n" + style.bold(style.violet("Setup complete")) + "\n\n");
-  const allPlatforms = ["OpenClaw", "Claude Code", "Claude Desktop", "Other MCP Agent"];
-  for (const idx of configuredPlatforms) {
-    process.stderr.write(`  ${style.green("\u2713")} ${allPlatforms[idx - 1] ?? ""}
-`);
-  }
-  process.stderr.write("\n" + style.bold(style.violet("Next steps")) + "\n");
-  const blocks = [];
-  if (configuredPlatforms.has(1)) {
-    blocks.push(
-      "\n" + style.bold("To complete your OpenClaw setup:") + "\n  \u2192 Restart your gateway: " + style.cyan("openclaw gateway restart") + "\n  \u2192 Start a session: " + style.cyan("openclaw tui") + "\n"
-    );
-  }
-  if (configuredPlatforms.has(2)) {
-    blocks.push(
-      "\n" + style.bold("To complete your Claude Code setup:") + "\n  \u2192 Add marketplace: " + style.cyan("claude plugin marketplace add Multicorn-AI/multicorn-shield") + "\n  \u2192 Install plugin: " + style.cyan("claude plugin install multicorn-shield@multicorn-shield") + "\n"
-    );
-  }
-  if (configuredPlatforms.has(3)) {
-    blocks.push(
-      "\n" + style.bold("To complete your Claude Desktop setup:") + "\n  \u2192 Restart Claude Desktop to pick up config changes\n"
-    );
-  }
-  if (configuredPlatforms.has(4)) {
-    blocks.push(
-      "\n" + style.bold("To complete your Other MCP Agent setup:") + "\n  \u2192 Start your agent with: " + style.cyan("npx multicorn-proxy --wrap <your-server> --agent-name <name>") + "\n"
-    );
+  if (configuredAgents.length > 0) {
+    process.stderr.write("\n" + style.bold(style.violet("Setup complete")) + "\n\n");
+    for (const agent of configuredAgents) {
+      process.stderr.write(
+        `  ${style.green("\u2713")} ${agent.platformLabel} - ${style.cyan(agent.agentName)}${agent.proxyUrl != null ? ` ${style.dim(`(${agent.proxyUrl})`)}` : ""}
+`
+      );
+    }
+    process.stderr.write("\n");
+    const configuredPlatforms = new Set(configuredAgents.map((a) => a.platform));
+    process.stderr.write("\n" + style.bold(style.violet("Next steps")) + "\n");
+    const blocks = [];
+    if (configuredPlatforms.has("openclaw")) {
+      blocks.push(
+        "\n" + style.bold("To complete your OpenClaw setup:") + "\n  \u2192 Restart your gateway: " + style.cyan("openclaw gateway restart") + "\n  \u2192 Start a session: " + style.cyan("openclaw tui") + "\n"
+      );
+    }
+    if (configuredPlatforms.has("claude-code")) {
+      blocks.push(
+        "\n" + style.bold("To complete your Claude Code setup:") + "\n  \u2192 Add marketplace: " + style.cyan("claude plugin marketplace add Multicorn-AI/multicorn-shield") + "\n  \u2192 Install plugin: " + style.cyan("claude plugin install multicorn-shield@multicorn-shield") + "\n"
+      );
+    }
+    if (configuredPlatforms.has("claude-desktop")) {
+      blocks.push(
+        "\n" + style.bold("To complete your Claude Desktop setup:") + "\n  \u2192 Restart Claude Desktop to pick up config changes\n"
+      );
+    }
+    if (configuredPlatforms.has("cursor")) {
+      blocks.push(
+        "\n" + style.bold("To complete your Cursor setup:") + "\n  \u2192 Restart Cursor to pick up MCP config changes\n"
+      );
+    }
+    if (configuredPlatforms.has("other-mcp")) {
+      blocks.push(
+        "\n" + style.bold("To complete your Other MCP Agent setup:") + "\n  \u2192 Start your agent with: " + style.cyan("npx multicorn-proxy --wrap <your-server> --agent-name <name>") + "\n"
+      );
+    }
+    process.stderr.write(blocks.join("") + "\n");
   }
-  process.stderr.write(blocks.join("") + "\n");
   return lastConfig;
 }
-function isProxyConfig(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const obj = value;
-  return typeof obj["apiKey"] === "string" && typeof obj["baseUrl"] === "string";
-}
 
 // src/types/index.ts
 var PERMISSION_LEVELS = {
@@ -1340,7 +1499,6 @@ async function resolveAgentRecord(agentName, apiKey, baseUrl, logger, platform)
   const cachedScopes = await loadCachedScopes(agentName, apiKey);
   if (cachedScopes !== null && cachedScopes.length > 0) {
     logger.debug("Loaded scopes from cache.", { agent: agentName, count: cachedScopes.length });
-    return { id: "", name: agentName, scopes: cachedScopes };
   }
   let agent = await findAgentByName(agentName, apiKey, baseUrl);
   if (agent?.authInvalid) {
@@ -1357,6 +1515,10 @@ async function resolveAgentRecord(agentName, apiKey, baseUrl, logger, platform)
         return { id: "", name: agentName, scopes: [], authInvalid: true };
       }
       const detail = error instanceof Error ? error.message : String(error);
+      if (cachedScopes !== null && cachedScopes.length > 0) {
+        logger.warn("Service unreachable. Using cached scopes.", { error: detail });
+        return { id: "", name: agentName, scopes: cachedScopes };
+      }
       logger.warn("Could not reach Multicorn service. Running with empty permissions.", {
         error: detail
       });
@@ -1485,16 +1647,26 @@ function createProxyServer(config) {
       }
       const service = extractServiceFromToolName(toolParams.name);
       const action = extractActionFromToolName(toolParams.name);
+      config.logger.debug("Extracted tool identity.", {
+        tool: toolParams.name,
+        service,
+        action
+      });
       const requestedScope = { service, permissionLevel: "execute" };
       const validation = validateScopeAccess(grantedScopes, requestedScope);
-      config.logger.debug("Tool call intercepted.", {
+      config.logger.debug("Scope validation result.", {
         tool: toolParams.name,
-        service,
-        allowed: validation.allowed
+        allowed: validation.allowed,
+        scopeCount: grantedScopes.length
       });
       if (!validation.allowed) {
         await ensureConsent(requestedScope);
         const revalidation = validateScopeAccess(grantedScopes, requestedScope);
+        config.logger.debug("Post-consent revalidation result.", {
+          tool: toolParams.name,
+          allowed: revalidation.allowed,
+          scopeCount: grantedScopes.length
+        });
         if (!revalidation.allowed) {
           if (actionLogger !== null) {
             if (!config.agentName || config.agentName.trim().length === 0) {
@@ -1502,12 +1674,18 @@ function createProxyServer(config) {
                 "[multicorn-proxy] Cannot log action: agent name not resolved\n"
               );
             } else {
+              config.logger.debug("Logging blocked action (post-consent).", {
+                agent: config.agentName,
+                service,
+                action
+              });
               await actionLogger.logAction({
                 agent: config.agentName,
                 service,
                 actionType: action,
                 status: "blocked"
               });
+              config.logger.debug("Blocked action logged.", { tool: toolParams.name });
             }
           }
           return JSON.stringify(
@@ -1526,12 +1704,18 @@ function createProxyServer(config) {
                   "[multicorn-proxy] Cannot log action: agent name not resolved\n"
                 );
               } else {
+                config.logger.debug("Logging blocked action (spending).", {
+                  agent: config.agentName,
+                  service,
+                  action
+                });
                 await actionLogger.logAction({
                   agent: config.agentName,
                   service,
                   actionType: action,
                   status: "blocked"
                 });
+                config.logger.debug("Spending-blocked action logged.", { tool: toolParams.name });
               }
             }
             const blocked = buildSpendingBlockedResponse(
@@ -1548,12 +1732,18 @@ function createProxyServer(config) {
         if (!config.agentName || config.agentName.trim().length === 0) {
           process.stderr.write("[multicorn-proxy] Cannot log action: agent name not resolved\n");
         } else {
+          config.logger.debug("Logging approved action.", {
+            agent: config.agentName,
+            service,
+            action
+          });
           await actionLogger.logAction({
             agent: config.agentName,
             service,
             actionType: action,
             status: "approved"
           });
+          config.logger.debug("Approved action logged.", { tool: toolParams.name });
         }
       }
       return null;
@@ -1733,10 +1923,23 @@ function parseArgs(argv) {
   let baseUrl = "https://api.multicorn.ai";
   let dashboardUrl = "";
   let agentName = "";
+  let deleteAgentName = "";
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
     if (arg === "init") {
       subcommand = "init";
+    } else if (arg === "agents") {
+      subcommand = "agents";
+    } else if (arg === "delete-agent") {
+      subcommand = "delete-agent";
+      const name = args[i + 1];
+      if (name === void 0 || name.startsWith("-")) {
+        process.stderr.write("Error: delete-agent requires an agent name.\n");
+        process.stderr.write("Example: npx multicorn-proxy delete-agent my-agent\n");
+        process.exit(1);
+      }
+      deleteAgentName = name;
+      i++;
     } else if (arg === "--wrap") {
       subcommand = "wrap";
       const next = args[i + 1];
@@ -1747,6 +1950,38 @@ function parseArgs(argv) {
       }
       wrapCommand = next;
       wrapArgs = args.slice(i + 2);
+      const cleaned = [];
+      for (let j = 0; j < wrapArgs.length; j++) {
+        const token = wrapArgs[j];
+        if (token === "--agent-name") {
+          const value = wrapArgs[j + 1];
+          if (value !== void 0) {
+            agentName = value;
+            j++;
+          }
+        } else if (token === "--log-level") {
+          const value = wrapArgs[j + 1];
+          if (value !== void 0 && isValidLogLevel(value)) {
+            logLevel = value;
+            j++;
+          }
+        } else if (token === "--base-url") {
+          const value = wrapArgs[j + 1];
+          if (value !== void 0) {
+            baseUrl = value;
+            j++;
+          }
+        } else if (token === "--dashboard-url") {
+          const value = wrapArgs[j + 1];
+          if (value !== void 0) {
+            dashboardUrl = value;
+            j++;
+          }
+        } else if (token !== void 0) {
+          cleaned.push(token);
+        }
+      }
+      wrapArgs = cleaned;
       break;
     } else if (arg === "--log-level") {
       const next = args[i + 1];
@@ -1774,7 +2009,16 @@ function parseArgs(argv) {
       }
     }
   }
-  return { subcommand, wrapCommand, wrapArgs, logLevel, baseUrl, dashboardUrl, agentName };
+  return {
+    subcommand,
+    wrapCommand,
+    wrapArgs,
+    logLevel,
+    baseUrl,
+    dashboardUrl,
+    agentName,
+    deleteAgentName
+  };
 }
 function printHelp() {
   process.stderr.write(
@@ -1785,6 +2029,12 @@ function printHelp() {
       "  npx multicorn-proxy init",
       "      Interactive setup. Saves API key to ~/.multicorn/config.json.",
       "",
+      "  npx multicorn-proxy agents",
+      "      List configured agents and show which is the default.",
+      "",
+      "  npx multicorn-proxy delete-agent <name>",
+      "      Remove a saved agent.",
+      "",
       "  npx multicorn-proxy --wrap <command> [args...]",
       "      Start <command> as an MCP server and proxy all tool calls through",
       "      Shield's permission layer.",
@@ -1814,6 +2064,40 @@ async function main() {
     await runInit(cli.baseUrl);
     return;
   }
+  if (cli.subcommand === "agents") {
+    const config2 = await loadConfig();
+    if (config2 === null) {
+      process.stderr.write(
+        "No config found. Run `npx multicorn-proxy init` to set up your API key.\n"
+      );
+      process.exit(1);
+    }
+    const agents = collectAgentsFromConfig(config2);
+    if (agents.length === 0) {
+      process.stderr.write("No agents configured. Run `npx multicorn-proxy init` to add one.\n");
+      process.exit(0);
+    }
+    const def = config2.defaultAgent;
+    process.stdout.write("Configured agents:\n");
+    for (const a of agents) {
+      const mark = a.name === def ? " (default)" : "";
+      process.stdout.write(`${a.name} (${a.platform})${mark}
+`);
+    }
+    return;
+  }
+  if (cli.subcommand === "delete-agent") {
+    const safeName = cli.deleteAgentName.replace(/[^\x20-\x7E]/g, "");
+    const ok = await deleteAgentByName(cli.deleteAgentName);
+    if (!ok) {
+      process.stderr.write(`No agent named "${safeName}" in config.
+`);
+      process.exit(1);
+    }
+    process.stdout.write(`Removed agent "${safeName}".
+`);
+    return;
+  }
   if (!cli.baseUrl.startsWith("https://") && !cli.baseUrl.startsWith("http://localhost") && !cli.baseUrl.startsWith("http://127.0.0.1")) {
     process.stderr.write(
       `Error: --base-url must use HTTPS. Received: "${cli.baseUrl}"
@@ -1829,9 +2113,11 @@ Use https:// or http://localhost for local development.
     );
     process.exit(1);
   }
-  const agentName = cli.agentName.length > 0 ? cli.agentName : config.agentName !== void 0 && config.agentName.length > 0 ? config.agentName : deriveAgentName(cli.wrapCommand);
+  const agentName = resolveWrapAgentName(cli, config);
   const finalBaseUrl = cli.baseUrl !== "https://api.multicorn.ai" ? cli.baseUrl : config.baseUrl;
   const finalDashboardUrl = cli.dashboardUrl !== "" ? cli.dashboardUrl : deriveDashboardUrl(finalBaseUrl);
+  const legacyPlatform = config.platform;
+  const platformForServer = typeof legacyPlatform === "string" && legacyPlatform.length > 0 ? legacyPlatform : "other-mcp";
   const proxy = createProxyServer({
     command: cli.wrapCommand,
     commandArgs: cli.wrapArgs,
@@ -1840,7 +2126,7 @@ Use https:// or http://localhost for local development.
     baseUrl: finalBaseUrl,
     dashboardUrl: finalDashboardUrl,
     logger,
-    platform: "other-mcp"
+    platform: platformForServer
   });
   async function shutdown() {
     logger.info("Shutting down.");
@@ -1855,6 +2141,26 @@ Use https:// or http://localhost for local development.
   });
   await proxy.start();
 }
+function resolveWrapAgentName(cli, config) {
+  if (cli.agentName.length > 0) {
+    return cli.agentName;
+  }
+  const legacyPlatform = config.platform;
+  const legacyAgentName = config.agentName;
+  const platformKey = typeof legacyPlatform === "string" && legacyPlatform.length > 0 ? legacyPlatform : "other-mcp";
+  const fromPlatform = getAgentByPlatform(config, platformKey);
+  if (fromPlatform !== void 0) {
+    return fromPlatform.name;
+  }
+  const fallbackDefault = getDefaultAgent(config);
+  if (fallbackDefault !== void 0) {
+    return fallbackDefault.name;
+  }
+  if (typeof legacyAgentName === "string" && legacyAgentName.length > 0) {
+    return legacyAgentName;
+  }
+  return deriveAgentName(cli.wrapCommand);
+}
 function deriveAgentName(command) {
   const base = command.split("/").pop() ?? command;
   return base.replace(/\.[cm]?[jt]s$/, "");