multicorn-shield 1.3.4 → 1.3.6

package/CHANGELOG.md

@@ -9,6 +9,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Bump `version` in `package.json` before publishing to npm.
 
+## [1.3.6] - 2026-05-08
+
+### Fixed
+
+- Hosted proxy URLs now embed the API key as a query parameter fallback for MCP clients that don't send static Authorization headers (fixes Cursor, Claude Desktop, and other clients that ignore the headers config during discovery)
+
+## [1.3.5] - 2026-05-08
+
+### Fixed
+
+- Replace flow no longer shows duplicate agent names (deduplication fix from 1.3.4 was incomplete)
+
 ## [1.3.3] - 2026-05-08
 
 ### Fixed

package/dist/multicorn-proxy.js

@@ -1564,6 +1564,41 @@ async function createProxyConfig(baseUrl, apiKey, agentName, targetUrl, serverNa
   const data = envelope["data"];
   return typeof data?.["proxy_url"] === "string" ? data["proxy_url"] : "";
 }
+function shouldEmbedKeyInHostedProxyUrl(platform) {
+  return HOSTED_PROXY_PLATFORMS_WITH_URL_KEY.has(platform);
+}
+function hostedProxyUrlWithKeyParam(proxyUrl, apiKey) {
+  if (apiKey.length === 0) {
+    process.stderr.write(
+      style.yellow("\u26A0") + " Could not add key to proxy URL: API key is empty; using URL without key query parameter.\n"
+    );
+    return proxyUrl;
+  }
+  try {
+    const u = new URL(proxyUrl);
+    u.searchParams.set("key", apiKey);
+    return u.toString();
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    process.stderr.write(
+      style.yellow("\u26A0") + " Could not parse proxy URL to append key query parameter; using URL unchanged. " + style.dim(detail) + "\n"
+    );
+    return proxyUrl;
+  }
+}
+function formatHostedProxyUrlForStderr(platform, proxyUrl, apiKey) {
+  if (!shouldEmbedKeyInHostedProxyUrl(platform) || apiKey.length === 0) {
+    return proxyUrl;
+  }
+  try {
+    const u = new URL(proxyUrl);
+    const redactedLabel = apiKey.length <= 4 ? "****" : `mcs_...${apiKey.slice(-4)}`;
+    u.searchParams.set("key", redactedLabel);
+    return u.toString();
+  } catch {
+    return proxyUrl;
+  }
+}
 function writeMcpAddedLine(shortName, filePath) {
   process.stderr.write(
     style.green("\u2713") + ' MCP server "' + shortName + '" added to ' + style.cyan(filePath) + "\n"
@@ -1713,8 +1748,9 @@ function printHostedProxyPostWriteHints(platform, shortName) {
 }
 async function applyHostedProxyMcpConfig(platform, proxyUrl, shortName, apiKey, workspacePath) {
   const authHeader = `Bearer ${apiKey}`;
+  const proxyUrlWithKeyWhenNeeded = shouldEmbedKeyInHostedProxyUrl(platform) ? hostedProxyUrlWithKeyParam(proxyUrl, apiKey) : proxyUrl;
   if (platform === "gemini-cli") {
-    await mergeGeminiHostedMcpServersIntoSettings(shortName, proxyUrl, apiKey);
+    await mergeGeminiHostedMcpServersIntoSettings(shortName, proxyUrlWithKeyWhenNeeded, apiKey);
     process.stderr.write(
       style.dim(
         "For project-specific config, copy the mcpServers entry into .gemini/settings.json in your project root. Restart Gemini CLI if it is already running."
@@ -1739,20 +1775,24 @@ async function applyHostedProxyMcpConfig(platform, proxyUrl, shortName, apiKey,
     let result = "parse-error";
     if (platform === "cursor") {
       result = await mergeMcpServersObjectStyle(getCursorMcpJsonPath(), shortName, {
-        url: proxyUrl,
+        url: proxyUrlWithKeyWhenNeeded,
         headers: { Authorization: authHeader }
       });
       if (result === "parse-error") {
         printHostedProxyJsonParseWarning(getCursorMcpJsonPath());
       }
     } else if (platform === "claude-desktop") {
-      result = await mergeClaudeDesktopHostedMcpRemote(shortName, proxyUrl, apiKey);
+      result = await mergeClaudeDesktopHostedMcpRemote(
+        shortName,
+        proxyUrlWithKeyWhenNeeded,
+        apiKey
+      );
       if (result === "parse-error") {
         printHostedProxyJsonParseWarning(getClaudeDesktopConfigPath());
       }
     } else if (platform === "windsurf") {
       result = await mergeMcpServersObjectStyle(getWindsurfMcpConfigPath(), shortName, {
-        serverUrl: proxyUrl,
+        serverUrl: proxyUrlWithKeyWhenNeeded,
         headers: { Authorization: authHeader }
       });
       if (result === "parse-error") {
@@ -1760,25 +1800,30 @@ async function applyHostedProxyMcpConfig(platform, proxyUrl, shortName, apiKey,
       }
     } else if (platform === "cline") {
       result = await mergeMcpServersObjectStyle(getClineMcpSettingsPath(), shortName, {
-        url: proxyUrl,
+        url: proxyUrlWithKeyWhenNeeded,
         headers: { Authorization: authHeader }
       });
       if (result === "parse-error") {
         printHostedProxyJsonParseWarning(getClineMcpSettingsPath());
       }
     } else if (platform === "kilo-code") {
-      result = await mergeKiloCodeProjectMcp(workspacePath, shortName, proxyUrl, apiKey);
+      result = await mergeKiloCodeProjectMcp(
+        workspacePath,
+        shortName,
+        proxyUrlWithKeyWhenNeeded,
+        apiKey
+      );
       if (result === "parse-error") {
         printHostedProxyJsonParseWarning(join(workspacePath, ".kilocode", "mcp.json"));
       }
     } else if (platform === "continue-dev") {
-      result = await mergeContinueHostedMcp(shortName, proxyUrl, apiKey);
+      result = await mergeContinueHostedMcp(shortName, proxyUrlWithKeyWhenNeeded, apiKey);
       if (result === "parse-error") {
         printHostedProxyJsonParseWarning(getContinueConfigJsonPath());
       }
     } else {
       result = await mergeMcpServersObjectStyle(getCursorMcpJsonPath(), shortName, {
-        url: proxyUrl,
+        url: proxyUrlWithKeyWhenNeeded,
         headers: { Authorization: authHeader }
       });
       if (result === "parse-error") {
@@ -1823,6 +1868,7 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
   ]);
   const usesInlineKey = hostedInlinePlatforms.has(platform);
   const authHeader = usesInlineKey ? `Bearer ${apiKey}` : "Bearer YOUR_SHIELD_API_KEY";
+  const urlInSnippet = usesInlineKey && shouldEmbedKeyInHostedProxyUrl(platform) ? hostedProxyUrlWithKeyParam(routingToken, apiKey) : routingToken;
   let snippetText;
   if (platform === "github-copilot") {
     snippetText = JSON.stringify(
@@ -1831,7 +1877,7 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
           servers: {
             [shortName]: {
               type: "http",
-              url: routingToken,
+              url: urlInSnippet,
               headers: {
                 Authorization: authHeader
               }
@@ -1843,13 +1889,13 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
       2
     );
   } else if (platform === "goose") {
-    snippetText = gooseHostedProxyYaml(shortName, routingToken, authHeader);
+    snippetText = gooseHostedProxyYaml(shortName, urlInSnippet, authHeader);
   } else if (platform === "gemini-cli") {
     snippetText = JSON.stringify(
       {
         mcpServers: {
           [shortName]: {
-            httpUrl: routingToken,
+            httpUrl: urlInSnippet,
             headers: {
               Authorization: authHeader
             }
@@ -1865,7 +1911,7 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
         mcpServers: {
           [shortName]: {
             command: "npx",
-            args: ["-y", "mcp-remote", routingToken, "--header", `Authorization: ${authHeader}`]
+            args: ["-y", "mcp-remote", urlInSnippet, "--header", `Authorization: ${authHeader}`]
           }
         }
       },
@@ -1879,7 +1925,7 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
           {
             name: shortName,
             type: "streamable-http",
-            url: routingToken,
+            url: urlInSnippet,
             headers: {
               Authorization: authHeader
             }
@@ -1895,7 +1941,7 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
       {
         mcpServers: {
           [shortName]: {
-            [urlKey]: routingToken,
+            [urlKey]: urlInSnippet,
             headers: {
               Authorization: authHeader
             }
@@ -1988,31 +2034,41 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
     process.stderr.write(style.dim("Start a new Goose session after updating config.") + "\n");
   }
 }
-function dedupeAgentsByName(agents) {
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const a of agents) {
-    if (seen.has(a.name)) continue;
-    seen.add(a.name);
-    out.push(a);
+function agentDisplayNameDedupeKey(name) {
+  return name.trim().toLowerCase();
+}
+function normalizeAgentEntryForMerge(a) {
+  const name = a.name.trim();
+  const ws = typeof a.workspacePath === "string" && a.workspacePath.length > 0 ? a.workspacePath : void 0;
+  return ws !== void 0 ? { name, platform: a.platform, workspacePath: ws } : { name, platform: a.platform };
+}
+function mergeAgentEntryDupPair(first, second) {
+  const name = first.name.trim();
+  const platform = first.platform;
+  const ws = typeof first.workspacePath === "string" && first.workspacePath.length > 0 ? first.workspacePath : typeof second.workspacePath === "string" && second.workspacePath.length > 0 ? second.workspacePath : void 0;
+  return ws !== void 0 ? { name, platform, workspacePath: ws } : { name, platform };
+}
+function mergeAgentsForUniqueNames(agents) {
+  const byKey = /* @__PURE__ */ new Map();
+  for (const raw of agents) {
+    const key = agentDisplayNameDedupeKey(raw.name);
+    const candidate = normalizeAgentEntryForMerge(raw);
+    const prev = byKey.get(key);
+    byKey.set(key, prev === void 0 ? candidate : mergeAgentEntryDupPair(prev, candidate));
   }
-  return out;
+  return [...byKey.values()];
 }
 function mergeAgentsForPlatform(localAgents, remoteAgents, selectedPlatform) {
-  const byName = /* @__PURE__ */ new Map();
+  const merged = [];
   for (const a of localAgents) {
     if (a.platform !== selectedPlatform) continue;
-    if (!byName.has(a.name)) {
-      byName.set(a.name, { ...a });
-    }
+    merged.push(a);
   }
   for (const r of remoteAgents) {
     if (r.platform !== selectedPlatform) continue;
-    if (!byName.has(r.name)) {
-      byName.set(r.name, { name: r.name, platform: selectedPlatform });
-    }
+    merged.push({ name: r.name, platform: selectedPlatform });
   }
-  return [...byName.values()];
+  return mergeAgentsForUniqueNames(merged);
 }
 async function runInit(explicitBaseUrl, options) {
   const verbose = options?.verbose === true;
@@ -2151,8 +2207,10 @@ async function runInit(explicitBaseUrl, options) {
       continue;
     }
     const remoteAccountAgents = await fetchRemoteAgentsSummaries(apiKey, resolvedBaseUrl);
-    const agentsForPlatform = dedupeAgentsByName(
-      mergeAgentsForPlatform(currentAgents, remoteAccountAgents, selectedPlatform)
+    const agentsForPlatform = mergeAgentsForPlatform(
+      currentAgents,
+      remoteAccountAgents,
+      selectedPlatform
     );
     const localForPlatformCount = currentAgents.filter(
       (a) => a.platform === selectedPlatform
@@ -2414,7 +2472,9 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
         }
         if (created && proxyUrl.length > 0) {
           process.stderr.write("\n" + style.bold("Your Shield proxy URL:") + "\n");
-          process.stderr.write("  " + style.cyan(proxyUrl) + "\n");
+          process.stderr.write(
+            "  " + style.cyan(formatHostedProxyUrlForStderr(selectedPlatform, proxyUrl, apiKey)) + "\n"
+          );
           await applyHostedProxyMcpConfig(
             selectedPlatform,
             proxyUrl,
@@ -2505,7 +2565,9 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
         }
         if (created && proxyUrl.length > 0) {
           process.stderr.write("\n" + style.bold("Your Shield proxy URL:") + "\n");
-          process.stderr.write("  " + style.cyan(proxyUrl) + "\n");
+          process.stderr.write(
+            "  " + style.cyan(formatHostedProxyUrlForStderr(selectedPlatform, proxyUrl, apiKey)) + "\n"
+          );
           await applyHostedProxyMcpConfig(
             selectedPlatform,
             proxyUrl,
@@ -2590,7 +2652,9 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
         }
         if (created && proxyUrl.length > 0) {
           process.stderr.write("\n" + style.bold("Your Shield proxy URL:") + "\n");
-          process.stderr.write("  " + style.cyan(proxyUrl) + "\n");
+          process.stderr.write(
+            "  " + style.cyan(formatHostedProxyUrlForStderr(selectedPlatform, proxyUrl, apiKey)) + "\n"
+          );
           await applyHostedProxyMcpConfig(
             selectedPlatform,
             proxyUrl,
@@ -2638,7 +2702,9 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
       }
       if (created && proxyUrl.length > 0) {
         process.stderr.write("\n" + style.bold("Your Shield proxy URL:") + "\n");
-        process.stderr.write("  " + style.cyan(proxyUrl) + "\n");
+        process.stderr.write(
+          "  " + style.cyan(formatHostedProxyUrlForStderr(selectedPlatform, proxyUrl, apiKey)) + "\n"
+        );
         await applyHostedProxyMcpConfig(
           selectedPlatform,
           proxyUrl,
@@ -2659,7 +2725,10 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
     }
     if (setupSucceeded) {
       if (removeAgentNameBeforeSave !== void 0) {
-        currentAgents = currentAgents.filter((a) => a.name !== removeAgentNameBeforeSave);
+        const removeKey = agentDisplayNameDedupeKey(removeAgentNameBeforeSave);
+        currentAgents = currentAgents.filter(
+          (a) => agentDisplayNameDedupeKey(a.name) !== removeKey
+        );
       }
       currentAgents.push({
         name: agentName,
@@ -2816,7 +2885,7 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
   }
   return lastConfig;
 }
-var SECRET_JSON_FILE_OPTIONS, style, BANNER, NativePluginPrerequisiteMissingError, CONFIG_DIR, CONFIG_PATH, OPENCLAW_CONFIG_PATH, ANSI_PATTERN, OPENCLAW_MIN_VERSION, INIT_WIZARD_PLATFORM_REGISTRY, INIT_WIZARD_MENU_SECTIONS, INIT_WIZARD_SELECTION_MAX, PLATFORM_BY_SELECTION, DEFAULT_SHIELD_API_BASE_URL;
+var SECRET_JSON_FILE_OPTIONS, style, BANNER, NativePluginPrerequisiteMissingError, CONFIG_DIR, CONFIG_PATH, OPENCLAW_CONFIG_PATH, ANSI_PATTERN, OPENCLAW_MIN_VERSION, INIT_WIZARD_PLATFORM_REGISTRY, INIT_WIZARD_MENU_SECTIONS, INIT_WIZARD_SELECTION_MAX, PLATFORM_BY_SELECTION, HOSTED_PROXY_PLATFORMS_WITH_URL_KEY, DEFAULT_SHIELD_API_BASE_URL;
 var init_config = __esm({
   "src/proxy/config.ts"() {
     init_consent();
@@ -2907,6 +2976,14 @@ var init_config = __esm({
     PLATFORM_BY_SELECTION = Object.fromEntries(
       INIT_WIZARD_PLATFORM_REGISTRY.map((e, i) => [i + 1, e.slug])
     );
+    HOSTED_PROXY_PLATFORMS_WITH_URL_KEY = /* @__PURE__ */ new Set([
+      "cursor",
+      "claude-desktop",
+      "github-copilot",
+      "kilo-code",
+      "continue-dev",
+      "goose"
+    ]);
     DEFAULT_SHIELD_API_BASE_URL = "https://api.multicorn.ai";
   }
 });

package/dist/multicorn-shield.js

@@ -1635,6 +1635,49 @@ async function createProxyConfig(baseUrl, apiKey, agentName, targetUrl, serverNa
   const data = envelope["data"];
   return typeof data?.["proxy_url"] === "string" ? data["proxy_url"] : "";
 }
+var HOSTED_PROXY_PLATFORMS_WITH_URL_KEY = /* @__PURE__ */ new Set([
+  "cursor",
+  "claude-desktop",
+  "github-copilot",
+  "kilo-code",
+  "continue-dev",
+  "goose"
+]);
+function shouldEmbedKeyInHostedProxyUrl(platform) {
+  return HOSTED_PROXY_PLATFORMS_WITH_URL_KEY.has(platform);
+}
+function hostedProxyUrlWithKeyParam(proxyUrl, apiKey) {
+  if (apiKey.length === 0) {
+    process.stderr.write(
+      style.yellow("\u26A0") + " Could not add key to proxy URL: API key is empty; using URL without key query parameter.\n"
+    );
+    return proxyUrl;
+  }
+  try {
+    const u = new URL(proxyUrl);
+    u.searchParams.set("key", apiKey);
+    return u.toString();
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    process.stderr.write(
+      style.yellow("\u26A0") + " Could not parse proxy URL to append key query parameter; using URL unchanged. " + style.dim(detail) + "\n"
+    );
+    return proxyUrl;
+  }
+}
+function formatHostedProxyUrlForStderr(platform, proxyUrl, apiKey) {
+  if (!shouldEmbedKeyInHostedProxyUrl(platform) || apiKey.length === 0) {
+    return proxyUrl;
+  }
+  try {
+    const u = new URL(proxyUrl);
+    const redactedLabel = apiKey.length <= 4 ? "****" : `mcs_...${apiKey.slice(-4)}`;
+    u.searchParams.set("key", redactedLabel);
+    return u.toString();
+  } catch {
+    return proxyUrl;
+  }
+}
 function writeMcpAddedLine(shortName, filePath) {
   process.stderr.write(
     style.green("\u2713") + ' MCP server "' + shortName + '" added to ' + style.cyan(filePath) + "\n"
@@ -1784,8 +1827,9 @@ function printHostedProxyPostWriteHints(platform, shortName) {
 }
 async function applyHostedProxyMcpConfig(platform, proxyUrl, shortName, apiKey, workspacePath) {
   const authHeader = `Bearer ${apiKey}`;
+  const proxyUrlWithKeyWhenNeeded = shouldEmbedKeyInHostedProxyUrl(platform) ? hostedProxyUrlWithKeyParam(proxyUrl, apiKey) : proxyUrl;
   if (platform === "gemini-cli") {
-    await mergeGeminiHostedMcpServersIntoSettings(shortName, proxyUrl, apiKey);
+    await mergeGeminiHostedMcpServersIntoSettings(shortName, proxyUrlWithKeyWhenNeeded, apiKey);
     process.stderr.write(
       style.dim(
         "For project-specific config, copy the mcpServers entry into .gemini/settings.json in your project root. Restart Gemini CLI if it is already running."
@@ -1810,20 +1854,24 @@ async function applyHostedProxyMcpConfig(platform, proxyUrl, shortName, apiKey,
     let result = "parse-error";
     if (platform === "cursor") {
       result = await mergeMcpServersObjectStyle(getCursorMcpJsonPath(), shortName, {
-        url: proxyUrl,
+        url: proxyUrlWithKeyWhenNeeded,
         headers: { Authorization: authHeader }
       });
       if (result === "parse-error") {
         printHostedProxyJsonParseWarning(getCursorMcpJsonPath());
       }
     } else if (platform === "claude-desktop") {
-      result = await mergeClaudeDesktopHostedMcpRemote(shortName, proxyUrl, apiKey);
+      result = await mergeClaudeDesktopHostedMcpRemote(
+        shortName,
+        proxyUrlWithKeyWhenNeeded,
+        apiKey
+      );
       if (result === "parse-error") {
         printHostedProxyJsonParseWarning(getClaudeDesktopConfigPath());
       }
     } else if (platform === "windsurf") {
       result = await mergeMcpServersObjectStyle(getWindsurfMcpConfigPath(), shortName, {
-        serverUrl: proxyUrl,
+        serverUrl: proxyUrlWithKeyWhenNeeded,
         headers: { Authorization: authHeader }
       });
       if (result === "parse-error") {
@@ -1831,25 +1879,30 @@ async function applyHostedProxyMcpConfig(platform, proxyUrl, shortName, apiKey,
       }
     } else if (platform === "cline") {
       result = await mergeMcpServersObjectStyle(getClineMcpSettingsPath(), shortName, {
-        url: proxyUrl,
+        url: proxyUrlWithKeyWhenNeeded,
         headers: { Authorization: authHeader }
       });
       if (result === "parse-error") {
         printHostedProxyJsonParseWarning(getClineMcpSettingsPath());
       }
     } else if (platform === "kilo-code") {
-      result = await mergeKiloCodeProjectMcp(workspacePath, shortName, proxyUrl, apiKey);
+      result = await mergeKiloCodeProjectMcp(
+        workspacePath,
+        shortName,
+        proxyUrlWithKeyWhenNeeded,
+        apiKey
+      );
       if (result === "parse-error") {
         printHostedProxyJsonParseWarning(join(workspacePath, ".kilocode", "mcp.json"));
       }
     } else if (platform === "continue-dev") {
-      result = await mergeContinueHostedMcp(shortName, proxyUrl, apiKey);
+      result = await mergeContinueHostedMcp(shortName, proxyUrlWithKeyWhenNeeded, apiKey);
       if (result === "parse-error") {
         printHostedProxyJsonParseWarning(getContinueConfigJsonPath());
       }
     } else {
       result = await mergeMcpServersObjectStyle(getCursorMcpJsonPath(), shortName, {
-        url: proxyUrl,
+        url: proxyUrlWithKeyWhenNeeded,
         headers: { Authorization: authHeader }
       });
       if (result === "parse-error") {
@@ -1894,6 +1947,7 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
   ]);
   const usesInlineKey = hostedInlinePlatforms.has(platform);
   const authHeader = usesInlineKey ? `Bearer ${apiKey}` : "Bearer YOUR_SHIELD_API_KEY";
+  const urlInSnippet = usesInlineKey && shouldEmbedKeyInHostedProxyUrl(platform) ? hostedProxyUrlWithKeyParam(routingToken, apiKey) : routingToken;
   let snippetText;
   if (platform === "github-copilot") {
     snippetText = JSON.stringify(
@@ -1902,7 +1956,7 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
           servers: {
             [shortName]: {
               type: "http",
-              url: routingToken,
+              url: urlInSnippet,
               headers: {
                 Authorization: authHeader
               }
@@ -1914,13 +1968,13 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
       2
     );
   } else if (platform === "goose") {
-    snippetText = gooseHostedProxyYaml(shortName, routingToken, authHeader);
+    snippetText = gooseHostedProxyYaml(shortName, urlInSnippet, authHeader);
   } else if (platform === "gemini-cli") {
     snippetText = JSON.stringify(
       {
         mcpServers: {
           [shortName]: {
-            httpUrl: routingToken,
+            httpUrl: urlInSnippet,
             headers: {
               Authorization: authHeader
             }
@@ -1936,7 +1990,7 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
         mcpServers: {
           [shortName]: {
             command: "npx",
-            args: ["-y", "mcp-remote", routingToken, "--header", `Authorization: ${authHeader}`]
+            args: ["-y", "mcp-remote", urlInSnippet, "--header", `Authorization: ${authHeader}`]
           }
         }
       },
@@ -1950,7 +2004,7 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
           {
             name: shortName,
             type: "streamable-http",
-            url: routingToken,
+            url: urlInSnippet,
             headers: {
               Authorization: authHeader
             }
@@ -1966,7 +2020,7 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
       {
         mcpServers: {
           [shortName]: {
-            [urlKey]: routingToken,
+            [urlKey]: urlInSnippet,
             headers: {
               Authorization: authHeader
             }
@@ -2059,31 +2113,41 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
     process.stderr.write(style.dim("Start a new Goose session after updating config.") + "\n");
   }
 }
-function dedupeAgentsByName(agents) {
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const a of agents) {
-    if (seen.has(a.name)) continue;
-    seen.add(a.name);
-    out.push(a);
+function agentDisplayNameDedupeKey(name) {
+  return name.trim().toLowerCase();
+}
+function normalizeAgentEntryForMerge(a) {
+  const name = a.name.trim();
+  const ws = typeof a.workspacePath === "string" && a.workspacePath.length > 0 ? a.workspacePath : void 0;
+  return ws !== void 0 ? { name, platform: a.platform, workspacePath: ws } : { name, platform: a.platform };
+}
+function mergeAgentEntryDupPair(first, second) {
+  const name = first.name.trim();
+  const platform = first.platform;
+  const ws = typeof first.workspacePath === "string" && first.workspacePath.length > 0 ? first.workspacePath : typeof second.workspacePath === "string" && second.workspacePath.length > 0 ? second.workspacePath : void 0;
+  return ws !== void 0 ? { name, platform, workspacePath: ws } : { name, platform };
+}
+function mergeAgentsForUniqueNames(agents) {
+  const byKey = /* @__PURE__ */ new Map();
+  for (const raw of agents) {
+    const key = agentDisplayNameDedupeKey(raw.name);
+    const candidate = normalizeAgentEntryForMerge(raw);
+    const prev = byKey.get(key);
+    byKey.set(key, prev === void 0 ? candidate : mergeAgentEntryDupPair(prev, candidate));
   }
-  return out;
+  return [...byKey.values()];
 }
 function mergeAgentsForPlatform(localAgents, remoteAgents, selectedPlatform) {
-  const byName = /* @__PURE__ */ new Map();
+  const merged = [];
   for (const a of localAgents) {
     if (a.platform !== selectedPlatform) continue;
-    if (!byName.has(a.name)) {
-      byName.set(a.name, { ...a });
-    }
+    merged.push(a);
   }
   for (const r of remoteAgents) {
     if (r.platform !== selectedPlatform) continue;
-    if (!byName.has(r.name)) {
-      byName.set(r.name, { name: r.name, platform: selectedPlatform });
-    }
+    merged.push({ name: r.name, platform: selectedPlatform });
   }
-  return [...byName.values()];
+  return mergeAgentsForUniqueNames(merged);
 }
 var DEFAULT_SHIELD_API_BASE_URL = "https://api.multicorn.ai";
 async function runInit(explicitBaseUrl, options) {
@@ -2223,8 +2287,10 @@ async function runInit(explicitBaseUrl, options) {
       continue;
     }
     const remoteAccountAgents = await fetchRemoteAgentsSummaries(apiKey, resolvedBaseUrl);
-    const agentsForPlatform = dedupeAgentsByName(
-      mergeAgentsForPlatform(currentAgents, remoteAccountAgents, selectedPlatform)
+    const agentsForPlatform = mergeAgentsForPlatform(
+      currentAgents,
+      remoteAccountAgents,
+      selectedPlatform
     );
     const localForPlatformCount = currentAgents.filter(
       (a) => a.platform === selectedPlatform
@@ -2486,7 +2552,9 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
         }
         if (created && proxyUrl.length > 0) {
           process.stderr.write("\n" + style.bold("Your Shield proxy URL:") + "\n");
-          process.stderr.write("  " + style.cyan(proxyUrl) + "\n");
+          process.stderr.write(
+            "  " + style.cyan(formatHostedProxyUrlForStderr(selectedPlatform, proxyUrl, apiKey)) + "\n"
+          );
           await applyHostedProxyMcpConfig(
             selectedPlatform,
             proxyUrl,
@@ -2577,7 +2645,9 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
         }
         if (created && proxyUrl.length > 0) {
           process.stderr.write("\n" + style.bold("Your Shield proxy URL:") + "\n");
-          process.stderr.write("  " + style.cyan(proxyUrl) + "\n");
+          process.stderr.write(
+            "  " + style.cyan(formatHostedProxyUrlForStderr(selectedPlatform, proxyUrl, apiKey)) + "\n"
+          );
           await applyHostedProxyMcpConfig(
             selectedPlatform,
             proxyUrl,
@@ -2662,7 +2732,9 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
         }
         if (created && proxyUrl.length > 0) {
           process.stderr.write("\n" + style.bold("Your Shield proxy URL:") + "\n");
-          process.stderr.write("  " + style.cyan(proxyUrl) + "\n");
+          process.stderr.write(
+            "  " + style.cyan(formatHostedProxyUrlForStderr(selectedPlatform, proxyUrl, apiKey)) + "\n"
+          );
           await applyHostedProxyMcpConfig(
             selectedPlatform,
             proxyUrl,
@@ -2710,7 +2782,9 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
       }
       if (created && proxyUrl.length > 0) {
         process.stderr.write("\n" + style.bold("Your Shield proxy URL:") + "\n");
-        process.stderr.write("  " + style.cyan(proxyUrl) + "\n");
+        process.stderr.write(
+          "  " + style.cyan(formatHostedProxyUrlForStderr(selectedPlatform, proxyUrl, apiKey)) + "\n"
+        );
         await applyHostedProxyMcpConfig(
           selectedPlatform,
           proxyUrl,
@@ -2731,7 +2805,10 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
     }
     if (setupSucceeded) {
       if (removeAgentNameBeforeSave !== void 0) {
-        currentAgents = currentAgents.filter((a) => a.name !== removeAgentNameBeforeSave);
+        const removeKey = agentDisplayNameDedupeKey(removeAgentNameBeforeSave);
+        currentAgents = currentAgents.filter(
+          (a) => agentDisplayNameDedupeKey(a.name) !== removeKey
+        );
       }
       currentAgents.push({
         name: agentName,

package/dist/shield-extension.js

@@ -22417,7 +22417,7 @@ async function writeExtensionBackup(claudeDesktopConfigPath, mcpServers) {
 
 // package.json
 var package_default = {
-  version: "1.3.4"};
+  version: "1.3.6"};
 
 // src/package-meta.ts
 var PACKAGE_VERSION = package_default.version;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "multicorn-shield",
-  "version": "1.3.4",
+  "version": "1.3.6",
   "description": "The control layer for AI agents: permissions, consent, spending limits, and audit logging.",
   "license": "MIT",
   "author": "Multicorn AI Pty Ltd",