multicorn-shield 0.6.2 → 0.8.0

package/dist/index.cjs

@@ -2106,7 +2106,7 @@ var MulticornShield = class {
    *
    * @example
    * ```ts
-   * const shield = new MulticornShield({ apiKey: 'mcs_your_key_here' });
+   * const shield = new MulticornShield({ apiKey: 'mcs_live_abc123...' });
    * ```
    */
   constructor(config) {
@@ -2463,16 +2463,20 @@ function validateBaseUrl(baseUrl) {
     );
   }
 }
+var PLACEHOLDER_KEYS = /* @__PURE__ */ new Set(["mcs_your_key_here"]);
+var INVALID_KEY_MESSAGE = "Invalid Multicorn Shield API key. Get your key at https://app.multicorn.ai/settings";
 function validateApiKey(apiKey) {
+  if (typeof apiKey !== "string" || apiKey.length === 0) {
+    throw new Error(INVALID_KEY_MESSAGE);
+  }
   if (!apiKey.startsWith(API_KEY_PREFIX)) {
-    throw new Error(
-      `[MulticornShield] Invalid API key format. Keys must start with "${API_KEY_PREFIX}". Find your API key in the Multicorn dashboard under Settings \u2192 API Keys.`
-    );
+    throw new Error(INVALID_KEY_MESSAGE);
   }
   if (apiKey.length < MIN_API_KEY_LENGTH) {
-    throw new Error(
-      `[MulticornShield] API key is too short (${String(apiKey.length)} characters). Minimum length is ${String(MIN_API_KEY_LENGTH)} characters. Find your API key in the Multicorn dashboard under Settings \u2192 API Keys.`
-    );
+    throw new Error(INVALID_KEY_MESSAGE);
+  }
+  if (PLACEHOLDER_KEYS.has(apiKey)) {
+    throw new Error(INVALID_KEY_MESSAGE);
   }
 }
 

package/dist/index.d.cts

@@ -1902,7 +1902,7 @@ declare function createMcpAdapter(config: McpAdapterConfig): McpAdapter;
  * @example
  * ```ts
  * const shield = new MulticornShield({
- *   apiKey: 'mcs_your_key_here',
+ *   apiKey: 'mcs_live_abc123...',
  *   baseUrl: 'https://api.multicorn.ai',
  *   timeout: 5000,
  * });
@@ -1938,7 +1938,7 @@ interface MulticornShieldConfig {
      * @example
      * ```ts
      * const shield = new MulticornShield({
-     *   apiKey: 'mcs_your_key_here',
+     *   apiKey: 'mcs_live_abc123...',
      *   onError: (err) => myLogger.warn(err.message),
      * });
      * ```
@@ -2052,7 +2052,7 @@ declare class MulticornShield {
      *
      * @example
      * ```ts
-     * const shield = new MulticornShield({ apiKey: 'mcs_your_key_here' });
+     * const shield = new MulticornShield({ apiKey: 'mcs_live_abc123...' });
      * ```
      */
     constructor(config: MulticornShieldConfig);

package/dist/index.d.ts

@@ -1902,7 +1902,7 @@ declare function createMcpAdapter(config: McpAdapterConfig): McpAdapter;
  * @example
  * ```ts
  * const shield = new MulticornShield({
- *   apiKey: 'mcs_your_key_here',
+ *   apiKey: 'mcs_live_abc123...',
  *   baseUrl: 'https://api.multicorn.ai',
  *   timeout: 5000,
  * });
@@ -1938,7 +1938,7 @@ interface MulticornShieldConfig {
      * @example
      * ```ts
      * const shield = new MulticornShield({
-     *   apiKey: 'mcs_your_key_here',
+     *   apiKey: 'mcs_live_abc123...',
      *   onError: (err) => myLogger.warn(err.message),
      * });
      * ```
@@ -2052,7 +2052,7 @@ declare class MulticornShield {
      *
      * @example
      * ```ts
-     * const shield = new MulticornShield({ apiKey: 'mcs_your_key_here' });
+     * const shield = new MulticornShield({ apiKey: 'mcs_live_abc123...' });
      * ```
      */
     constructor(config: MulticornShieldConfig);

package/dist/index.js

@@ -2104,7 +2104,7 @@ var MulticornShield = class {
    *
    * @example
    * ```ts
-   * const shield = new MulticornShield({ apiKey: 'mcs_your_key_here' });
+   * const shield = new MulticornShield({ apiKey: 'mcs_live_abc123...' });
    * ```
    */
   constructor(config) {
@@ -2461,16 +2461,20 @@ function validateBaseUrl(baseUrl) {
     );
   }
 }
+var PLACEHOLDER_KEYS = /* @__PURE__ */ new Set(["mcs_your_key_here"]);
+var INVALID_KEY_MESSAGE = "Invalid Multicorn Shield API key. Get your key at https://app.multicorn.ai/settings";
 function validateApiKey(apiKey) {
+  if (typeof apiKey !== "string" || apiKey.length === 0) {
+    throw new Error(INVALID_KEY_MESSAGE);
+  }
   if (!apiKey.startsWith(API_KEY_PREFIX)) {
-    throw new Error(
-      `[MulticornShield] Invalid API key format. Keys must start with "${API_KEY_PREFIX}". Find your API key in the Multicorn dashboard under Settings \u2192 API Keys.`
-    );
+    throw new Error(INVALID_KEY_MESSAGE);
   }
   if (apiKey.length < MIN_API_KEY_LENGTH) {
-    throw new Error(
-      `[MulticornShield] API key is too short (${String(apiKey.length)} characters). Minimum length is ${String(MIN_API_KEY_LENGTH)} characters. Find your API key in the Multicorn dashboard under Settings \u2192 API Keys.`
-    );
+    throw new Error(INVALID_KEY_MESSAGE);
+  }
+  if (PLACEHOLDER_KEYS.has(apiKey)) {
+    throw new Error(INVALID_KEY_MESSAGE);
   }
 }
 

package/dist/multicorn-proxy.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { existsSync } from 'fs';
-import { readFile, writeFile, mkdir, unlink } from 'fs/promises';
+import { mkdir, writeFile, readFile, unlink } from 'fs/promises';
 import { join } from 'path';
 import { homedir } from 'os';
 import { createInterface } from 'readline';
@@ -366,16 +366,39 @@ async function isCursorConnected() {
     return false;
   }
 }
-var PLATFORM_LABELS = ["OpenClaw", "Claude Code", "Cursor"];
+function getWindsurfConfigPath() {
+  return join(homedir(), ".codeium", "windsurf", "mcp_config.json");
+}
+async function isWindsurfConnected() {
+  try {
+    const raw = await readFile(getWindsurfConfigPath(), "utf8");
+    const obj = JSON.parse(raw);
+    const mcpServers = obj["mcpServers"];
+    if (mcpServers === void 0 || typeof mcpServers !== "object") return false;
+    for (const entry of Object.values(mcpServers)) {
+      if (typeof entry !== "object" || entry === null) continue;
+      const rec = entry;
+      const url = rec["serverUrl"];
+      if (typeof url === "string" && url.includes("multicorn")) return true;
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}
+var PLATFORM_LABELS = ["OpenClaw", "Claude Code", "Cursor", "Windsurf", "Local MCP / Other"];
 var PLATFORM_BY_SELECTION = {
   1: "openclaw",
   2: "claude-code",
-  3: "cursor"
+  3: "cursor",
+  4: "windsurf",
+  5: "other-mcp"
 };
 var DEFAULT_AGENT_NAMES = {
   openclaw: "my-openclaw-agent",
   "claude-code": "my-claude-code-agent",
-  cursor: "my-cursor-agent"
+  cursor: "my-cursor-agent",
+  windsurf: "my-windsurf-agent"
 };
 async function promptPlatformSelection(ask) {
   process.stderr.write(
@@ -384,20 +407,24 @@ async function promptPlatformSelection(ask) {
   const connectedFlags = [
     await isOpenClawConnected(),
     isClaudeCodeConnected(),
-    await isCursorConnected()
+    await isCursorConnected(),
+    await isWindsurfConnected()
   ];
   for (let i = 0; i < PLATFORM_LABELS.length; i++) {
-    const marker = connectedFlags[i] ? " " + style.green("\u2713") + style.dim(" connected") : "";
+    const marker = i < connectedFlags.length && connectedFlags[i] ? " " + style.dim("\u25CF detected locally") : "";
     process.stderr.write(
       `  ${style.violet(String(i + 1))}. ${PLATFORM_LABELS[i] ?? ""}${marker}
 `
     );
   }
+  process.stderr.write(
+    style.dim("     Pick 5 if you want to wrap a local MCP server with multicorn-proxy --wrap.") + "\n"
+  );
   let selection = 0;
   while (selection === 0) {
-    const input = await ask("Select (1-3): ");
+    const input = await ask("Select (1-5): ");
     const num = parseInt(input.trim(), 10);
-    if (num >= 1 && num <= 3) {
+    if (num >= 1 && num <= 5) {
       selection = num;
     }
   }
@@ -501,12 +528,14 @@ async function createProxyConfig(baseUrl, apiKey, agentName, targetUrl, serverNa
   return typeof data?.["proxy_url"] === "string" ? data["proxy_url"] : "";
 }
 function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
-  const authHeader = platform === "cursor" ? `Bearer ${apiKey}` : "Bearer YOUR_SHIELD_API_KEY";
+  const usesInlineKey = platform === "cursor" || platform === "windsurf";
+  const authHeader = usesInlineKey ? `Bearer ${apiKey}` : "Bearer YOUR_SHIELD_API_KEY";
+  const urlKey = platform === "windsurf" ? "serverUrl" : "url";
   const mcpSnippet = JSON.stringify(
     {
       mcpServers: {
         [shortName]: {
-          url: routingToken,
+          [urlKey]: routingToken,
           headers: {
             Authorization: authHeader
           }
@@ -520,14 +549,18 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
     process.stderr.write("\n" + style.dim("Add this to your OpenClaw agent config:") + "\n\n");
   } else if (platform === "claude-code") {
     process.stderr.write("\n" + style.dim("Add this to your Claude Code MCP config:") + "\n\n");
+  } else if (platform === "windsurf") {
+    process.stderr.write(
+      "\n" + style.dim("Add this to ~/.codeium/windsurf/mcp_config.json:") + "\n\n"
+    );
   } else {
     process.stderr.write("\n" + style.dim("Add this to ~/.cursor/mcp.json:") + "\n\n");
   }
   process.stderr.write(style.cyan(mcpSnippet) + "\n\n");
-  if (platform !== "cursor") {
+  if (!usesInlineKey) {
     process.stderr.write(
       style.dim(
-        "Replace YOUR_SHIELD_API_KEY with your API key. Find it in Settings > API keys at https://app.multicorn.ai/settings/api-keys"
+        "Replace YOUR_SHIELD_API_KEY with your API key. Find it in Settings > API keys at https://app.multicorn.ai/settings#api-keys"
       ) + "\n"
     );
   }
@@ -543,6 +576,14 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
       ) + "\n"
     );
   }
+  if (platform === "windsurf") {
+    process.stderr.write(style.dim("Then restart Windsurf (Cmd/Ctrl+Q, then reopen).") + "\n");
+    process.stderr.write(
+      style.dim(
+        "Open the Cascade panel and verify the server appears with a green status indicator."
+      ) + "\n"
+    );
+  }
 }
 var DEFAULT_SHIELD_API_BASE_URL = "https://api.multicorn.ai";
 async function runInit(explicitBaseUrl) {
@@ -560,7 +601,7 @@ async function runInit(explicitBaseUrl) {
   process.stderr.write(style.dim("Agent governance for the AI era") + "\n\n");
   process.stderr.write(style.bold(style.violet("Multicorn Shield proxy setup")) + "\n\n");
   process.stderr.write(
-    style.dim("Get your API key at https://app.multicorn.ai/settings/api-keys") + "\n\n"
+    style.dim("Get your API key at https://app.multicorn.ai/settings#api-keys") + "\n\n"
   );
   const existing = await loadConfig().catch(() => null);
   let resolvedBaseUrl;
@@ -632,6 +673,40 @@ async function runInit(explicitBaseUrl) {
     const selection = await promptPlatformSelection(ask);
     const selectedPlatform = PLATFORM_BY_SELECTION[selection] ?? "cursor";
     const selectedLabel = PLATFORM_LABELS[selection - 1] ?? "Cursor";
+    if (selection === 5) {
+      const raw = existing !== null ? { ...existing } : {};
+      raw["apiKey"] = apiKey;
+      raw["baseUrl"] = resolvedBaseUrl;
+      delete raw["agentName"];
+      delete raw["platform"];
+      lastConfig = raw;
+      try {
+        await saveConfig(lastConfig);
+        process.stderr.write(
+          style.green("\u2713") + ` Config saved to ${style.cyan(CONFIG_PATH)}
+`
+        );
+        process.stderr.write(
+          "\n" + style.bold("Try it:") + " " + style.cyan(
+            "npx multicorn-proxy --wrap npx @modelcontextprotocol/server-filesystem /tmp"
+          ) + "\n"
+        );
+      } catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        process.stderr.write(style.red(`Failed to save config: ${detail}`) + "\n");
+      }
+      configuredAgents.push({
+        selection,
+        platform: selectedPlatform,
+        platformLabel: selectedLabel,
+        agentName: ""
+      });
+      const another2 = await ask("\nConnect another agent? (Y/n) ");
+      if (another2.trim().toLowerCase() === "n") {
+        configuring = false;
+      }
+      continue;
+    }
     const existingForPlatform = currentAgents.find((a) => a.platform === selectedPlatform);
     if (existingForPlatform !== void 0) {
       process.stderr.write(
@@ -820,14 +895,15 @@ An agent for ${selectedLabel} already exists: ${style.cyan(existingForPlatform.n
   if (configuredAgents.length > 0) {
     process.stderr.write("\n" + style.bold(style.violet("Setup complete")) + "\n\n");
     for (const agent of configuredAgents) {
+      const namePart = agent.agentName.length > 0 ? ` - ${style.cyan(agent.agentName)}` : "";
+      const urlPart = agent.proxyUrl != null ? ` ${style.dim(`(${agent.proxyUrl})`)}` : "";
       process.stderr.write(
-        `  ${style.green("\u2713")} ${agent.platformLabel} - ${style.cyan(agent.agentName)}${agent.proxyUrl != null ? ` ${style.dim(`(${agent.proxyUrl})`)}` : ""}
+        `  ${style.green("\u2713")} ${agent.platformLabel}${namePart}${urlPart}
 `
       );
     }
     process.stderr.write("\n");
     const configuredPlatforms = new Set(configuredAgents.map((a) => a.platform));
-    process.stderr.write("\n" + style.bold(style.violet("Next steps")) + "\n");
     const blocks = [];
     if (configuredPlatforms.has("openclaw")) {
       blocks.push(
@@ -846,15 +922,23 @@ An agent for ${selectedLabel} already exists: ${style.cyan(existingForPlatform.n
     }
     if (configuredPlatforms.has("cursor")) {
       blocks.push(
-        "\n" + style.bold("To complete your Cursor setup:") + "\n  \u2192 Restart Cursor to pick up MCP config changes\n"
+        "\n" + style.bold("To complete your Cursor setup:") + "\n  1. If you don't have Cursor yet, download it from " + style.cyan("https://cursor.com/downloads") + "\n  2. Open " + style.cyan("~/.cursor/mcp.json") + " and paste the config snippet shown above\n  3. Restart Cursor (or launch it for the first time) to load the new MCP server\n"
       );
     }
-    if (configuredPlatforms.has("other-mcp")) {
+    if (configuredPlatforms.has("windsurf")) {
       blocks.push(
-        "\n" + style.bold("To complete your Other MCP Agent setup:") + "\n  \u2192 Start your agent with: " + style.cyan("npx multicorn-proxy --wrap <your-server> --agent-name <name>") + "\n"
+        "\n" + style.bold("To complete your Windsurf setup:") + "\n  1. If you don't have Windsurf yet, download it from " + style.cyan("https://windsurf.com/download") + "\n  2. Open " + style.cyan("~/.codeium/windsurf/mcp_config.json") + " and paste the config snippet shown above\n  3. Restart Windsurf (or launch it for the first time) to load the new MCP server\n"
       );
     }
-    process.stderr.write(blocks.join("") + "\n");
+    if (configuredPlatforms.has("windsurf")) {
+      blocks.push(
+        "\n" + style.bold("To complete your Windsurf setup:") + "\n  Config file: " + style.cyan("~/.codeium/windsurf/mcp_config.json") + "\n  Restart Windsurf to load the new MCP server.\n"
+      );
+    }
+    if (blocks.length > 0) {
+      process.stderr.write("\n" + style.bold(style.violet("Next steps")) + "\n");
+      process.stderr.write(blocks.join("") + "\n");
+    }
   }
   return lastConfig;
 }
@@ -1851,6 +1935,15 @@ function createProxyServer(config) {
     agentId = agentRecord.id;
     grantedScopes = agentRecord.scopes;
     authInvalid = agentRecord.authInvalid === true;
+    if (authInvalid) {
+      config.logger.error("API key rejected by the Multicorn service.", {
+        agent: config.agentName
+      });
+      process.stderr.write(
+        "\nError: API key was rejected by the Multicorn service.\nCheck your key at https://app.multicorn.ai/settings#api-keys or run `npx multicorn-proxy init` to reconfigure.\n\n"
+      );
+      throw new Error("API key was rejected by the Multicorn service.");
+    }
     config.logger.info("Agent resolved.", {
       agent: config.agentName,
       id: agentId,
@@ -1968,6 +2061,7 @@ function parseArgs(argv) {
   let dashboardUrl = "";
   let agentName = "";
   let deleteAgentName = "";
+  let apiKey = void 0;
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
     if (arg === "init") {
@@ -1986,46 +2080,56 @@ function parseArgs(argv) {
       i++;
     } else if (arg === "--wrap") {
       subcommand = "wrap";
-      const next = args[i + 1];
-      if (next === void 0 || next.startsWith("-")) {
-        process.stderr.write("Error: --wrap requires a command to run.\n");
-        process.stderr.write("Example: npx multicorn-proxy --wrap my-mcp-server\n");
-        process.exit(1);
-      }
-      wrapCommand = next;
-      wrapArgs = args.slice(i + 2);
-      const cleaned = [];
-      for (let j = 0; j < wrapArgs.length; j++) {
-        const token = wrapArgs[j];
+      const tail = args.slice(i + 1);
+      const remaining = [];
+      for (let j = 0; j < tail.length; j++) {
+        const token = tail[j];
+        if (token === void 0) continue;
+        if (remaining.length > 0) {
+          remaining.push(token);
+          continue;
+        }
         if (token === "--agent-name") {
-          const value = wrapArgs[j + 1];
+          const value = tail[j + 1];
           if (value !== void 0) {
             agentName = value;
             j++;
           }
         } else if (token === "--log-level") {
-          const value = wrapArgs[j + 1];
+          const value = tail[j + 1];
           if (value !== void 0 && isValidLogLevel(value)) {
             logLevel = value;
             j++;
           }
         } else if (token === "--base-url") {
-          const value = wrapArgs[j + 1];
+          const value = tail[j + 1];
           if (value !== void 0) {
             baseUrl = value;
             j++;
           }
         } else if (token === "--dashboard-url") {
-          const value = wrapArgs[j + 1];
+          const value = tail[j + 1];
           if (value !== void 0) {
             dashboardUrl = value;
             j++;
           }
-        } else if (token !== void 0) {
-          cleaned.push(token);
+        } else if (token === "--api-key") {
+          const value = tail[j + 1];
+          if (value !== void 0) {
+            apiKey = value;
+            j++;
+          }
+        } else {
+          remaining.push(token);
         }
       }
-      wrapArgs = cleaned;
+      if (remaining.length === 0) {
+        process.stderr.write("Error: --wrap requires a command to run.\n");
+        process.stderr.write("Example: npx multicorn-proxy --wrap my-mcp-server\n");
+        process.exit(1);
+      }
+      wrapCommand = remaining[0] ?? "";
+      wrapArgs = remaining.slice(1);
       break;
     } else if (arg === "--log-level") {
       const next = args[i + 1];
@@ -2051,6 +2155,12 @@ function parseArgs(argv) {
         agentName = next;
         i++;
       }
+    } else if (arg === "--api-key") {
+      const next = args[i + 1];
+      if (next !== void 0) {
+        apiKey = next;
+        i++;
+      }
     }
   }
   return {
@@ -2061,7 +2171,8 @@ function parseArgs(argv) {
     baseUrl,
     dashboardUrl,
     agentName,
-    deleteAgentName
+    deleteAgentName,
+    apiKey
   };
 }
 function printHelp() {
@@ -2084,6 +2195,7 @@ function printHelp() {
       "      Shield's permission layer.",
       "",
       "Options:",
+      "  --api-key <key>       Multicorn API key (overrides MULTICORN_API_KEY env var and config file)",
       "  --log-level <level>   Log level: debug | info | warn | error  (default: info)",
       "  --base-url <url>      Multicorn API base URL  (default: https://api.multicorn.ai)",
       "  --dashboard-url <url> Dashboard URL for consent page  (default: derived from --base-url)",
@@ -2150,13 +2262,7 @@ async function main() {
       process.exit(1);
     }
   }
-  const config = await loadConfig();
-  if (config === null) {
-    process.stderr.write(
-      "No config found. Run `npx multicorn-proxy init` to set up your API key.\n"
-    );
-    process.exit(1);
-  }
+  const config = await resolveWrapConfig(cli, logger);
   const finalBaseUrl = cli.baseUrl !== void 0 && cli.baseUrl.length > 0 ? cli.baseUrl : config.baseUrl;
   if (cli.baseUrl === void 0 || cli.baseUrl.length === 0) {
     if (!isAllowedShieldApiBaseUrl(finalBaseUrl)) {
@@ -2193,6 +2299,31 @@ async function main() {
   });
   await proxy.start();
 }
+async function resolveWrapConfig(cli, logger) {
+  if (cli.apiKey !== void 0 && cli.apiKey.length > 0) {
+    logger.debug("Using API key from --api-key flag.");
+    return {
+      apiKey: cli.apiKey,
+      baseUrl: cli.baseUrl ?? DEFAULT_SHIELD_API_BASE_URL
+    };
+  }
+  const envKey = process.env["MULTICORN_API_KEY"];
+  if (typeof envKey === "string" && envKey.length > 0) {
+    logger.debug("Using API key from MULTICORN_API_KEY environment variable.");
+    return {
+      apiKey: envKey,
+      baseUrl: cli.baseUrl ?? DEFAULT_SHIELD_API_BASE_URL
+    };
+  }
+  const config = await loadConfig();
+  if (config !== null) {
+    return config;
+  }
+  process.stderr.write(
+    "No API key found. Provide one via the --api-key flag, the MULTICORN_API_KEY environment variable, or run `npx multicorn-proxy init` to set up a config file.\n"
+  );
+  process.exit(1);
+}
 function resolveWrapAgentName(cli, config) {
   if (cli.agentName.length > 0) {
     return cli.agentName;
@@ -2217,9 +2348,14 @@ function deriveAgentName(command) {
   const base = command.split("/").pop() ?? command;
   return base.replace(/\.[cm]?[jt]s$/, "");
 }
-main().catch((error) => {
-  const message = error instanceof Error ? error.message : String(error);
-  process.stderr.write(`Fatal error: ${message}
+var isDirectRun = process.argv[1] !== void 0 && (import.meta.url.endsWith(process.argv[1]) || import.meta.url === `file://${process.argv[1]}` || import.meta.url.endsWith("/multicorn-proxy.js") || import.meta.url.endsWith("/multicorn-proxy.ts"));
+if (isDirectRun && process.env["VITEST"] === void 0) {
+  main().catch((error) => {
+    const message = error instanceof Error ? error.message : String(error);
+    process.stderr.write(`Fatal error: ${message}
 `);
-  process.exit(1);
-});
+    process.exit(1);
+  });
+}
+
+export { parseArgs, resolveWrapConfig };

package/dist/shield-extension.js

@@ -22358,7 +22358,7 @@ async function writeExtensionBackup(claudeDesktopConfigPath, mcpServers) {
 
 // package.json
 var package_default = {
-  version: "0.6.2"};
+  version: "0.8.0"};
 
 // src/package-meta.ts
 var PACKAGE_VERSION = package_default.version;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "multicorn-shield",
-  "version": "0.6.2",
+  "version": "0.8.0",
   "description": "The control layer for AI agents: permissions, consent, spending limits, and audit logging.",
   "license": "MIT",
   "type": "module",