@fidacy/mcp 0.1.20 → 0.1.22

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.1.22
+
+### Patch Changes
+
+- ba44b92: Human-directed claim links in nudges: value-moment messages now point the operator at fidacy.com/claim?ref=<anon_id> (see and claim this install's block history) instead of asking the agent to call the upgrade tool. Scope denies became actionable: category_not_allowed and currency_not_allowed explain exactly which mandate field to adjust in ~/.fidacy/config.json (hot-reloaded).
+
 All notable changes to `@fidacy/mcp` are documented here. This project follows
 semantic versioning.
 

package/dist/core.js

@@ -442,7 +442,7 @@ function resolveMandateRules(cfg) {
 }
 
 // src/telemetry.ts
-var CLIENT_VERSION = true ? "0.1.20" : "dev";
+var CLIENT_VERSION = true ? "0.1.22" : "dev";
 function bandOf(amount) {
   if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) return void 0;
   if (amount < 10) return "lt10";

package/dist/index.js

@@ -471,7 +471,7 @@ function resolveMandateRules(cfg) {
 }
 
 // src/telemetry.ts
-var CLIENT_VERSION = true ? "0.1.20" : "dev";
+var CLIENT_VERSION = true ? "0.1.22" : "dev";
 function bandOf(amount) {
   if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) return void 0;
   if (amount < 10) return "lt10";
@@ -814,7 +814,7 @@ async function findArtifacts(sha2562, cfg) {
 }
 
 // src/provision.ts
-var CLIENT_VERSION2 = true ? "0.1.20" : "dev";
+var CLIENT_VERSION2 = true ? "0.1.22" : "dev";
 function provisionEnabled() {
   const v = (process.env.FIDACY_DISABLE_PROVISION ?? "").trim().toLowerCase();
   return !(v === "1" || v === "true" || v === "yes");
@@ -862,6 +862,10 @@ function requestUpgrade() {
 }
 
 // src/nudges.ts
+function claimUrl() {
+  const anon = readConfig()?.anon_id;
+  return anon ? `https://fidacy.com/claim?ref=${anon}` : null;
+}
 function nudgeOnce(key) {
   const cfg = readConfig();
   if (!cfg) return false;
@@ -892,23 +896,26 @@ function installAgeDays() {
 }
 function decisionNudge(status, violatedRule, upgradeToolName) {
   const count = bumpDecisionCount();
+  const url = claimUrl();
+  const claimPath = url ? `open ${url} to see everything blocked on this install and claim it (free account, this history migrates)` : `call the ${upgradeToolName} tool (free account, this history migrates)`;
   if (status === "DENY" && violatedRule?.startsWith("duplicate_invoice") && nudgeOnce("bec_catch")) {
-    return `That was a duplicate-invoice (BEC) catch \u2014 the #1 payment fraud. On a free account every block like this is server-signed and anchored to Bitcoin: court-grade evidence. Call the ${upgradeToolName} tool to start.`;
+    return `That was a duplicate-invoice (BEC) catch, the #1 payment fraud. For your operator: ${claimPath}. On a hosted account every block like this is server-signed and anchored to Bitcoin: court-grade evidence.`;
   }
   if (status === "DENY" && nudgeOnce("first_deny")) {
-    return `Fidacy just blocked this for you \u2014 for server-signed, anchored proof of every block (free account, local history migrates), call the ${upgradeToolName} tool.`;
+    return `Fidacy just blocked this for you. For your operator: ${claimPath}.`;
   }
   if (count === 25 && nudgeOnce("proof_teaser")) {
-    return `Your local chain now holds ${count} decisions only you can read. Anchor them and anyone can verify at fidacy.com/verify, no account needed on their side. Call the ${upgradeToolName} tool (free) to make your history portable.`;
+    return `Your local chain now holds ${count} decisions only you can read. Anchor them and anyone can verify at fidacy.com/verify, no account needed on their side. For your operator: ${claimPath}.`;
   }
   if (count === 10 && nudgeOnce("milestone_10")) {
-    return `That's 10 actions gated on this install. For a signed, Bitcoin-anchored history of all of them (free account), call the ${upgradeToolName} tool.`;
+    return `That's 10 actions gated on this install. For your operator: ${claimPath}.`;
   }
   return null;
 }
 function weekOneBootNudge(upgradeToolName) {
   if (installAgeDays() >= 7 && nudgeOnce("week_1")) {
-    return ` One week protected \u2014 anchor your history to Bitcoin with a free account: the ${upgradeToolName} tool starts it.`;
+    const url = claimUrl();
+    return url ? ` One week protected. See and claim this install's block history: ${url} (free).` : ` One week protected \u2014 anchor your history to Bitcoin with a free account: the ${upgradeToolName} tool starts it.`;
   }
   return null;
 }
@@ -917,7 +924,7 @@ function weekOneBootNudge(upgradeToolName) {
 var state = ensureState();
 var core = makeCore();
 var subject = process.env.FIDACY_SUBJECT ?? "agent:demo";
-var SERVER_VERSION = true ? "0.1.20" : "dev";
+var SERVER_VERSION = true ? "0.1.22" : "dev";
 var server = new McpServer({ name: "fidacy", version: SERVER_VERSION });
 server.registerTool(
   "request_payment",
@@ -950,7 +957,7 @@ server.registerTool(
     const d = await core.decide(req, subject);
     const out = { status: d.status, decisionId: d.decisionId, grant: d.grant, violatedRule: d.violatedRule };
     const base = d.status === "ALLOW" ? `ALLOW (decision ${d.decisionId})${req.invoiceRef ? ` for invoice ${req.invoiceRef}` : ""}. To settle, call execute_payment with the SAME payee, amount, currency, and idempotencyKey, and set "grant" to EXACTLY this signed value:
-${d.grant}` : `DENY (decision ${d.decisionId}). Rule violated: ${d.violatedRule}. No grant issued, this payment cannot proceed. The denial itself is recorded in the tamper-evident, hash-chained audit: call get_audit_proof with decisionId ${d.decisionId} for the proof of what was blocked.${d.violatedRule?.startsWith("payee_not_in_allowlist") ? ` If the user trusts this payee, add "${req.payee}" to mandate.payees in ~/.fidacy/config.json and retry: the firewall picks the change up on the next call, no restart needed.` : ""}`;
+${d.grant}` : `DENY (decision ${d.decisionId}). Rule violated: ${d.violatedRule}. No grant issued, this payment cannot proceed. The denial itself is recorded in the tamper-evident, hash-chained audit: call get_audit_proof with decisionId ${d.decisionId} for the proof of what was blocked.${d.violatedRule?.startsWith("payee_not_in_allowlist") ? ` If the user trusts this payee, add "${req.payee}" to mandate.payees in ~/.fidacy/config.json and retry: the firewall picks the change up on the next call, no restart needed.` : d.violatedRule?.startsWith("category_not_allowed") ? ` If the user considers "${req.category}" a legitimate purpose for this agent, add it to mandate.categories in ~/.fidacy/config.json and retry: the firewall picks the change up on the next call, no restart needed.` : d.violatedRule?.startsWith("currency_not_allowed") ? ` The mandate is single-currency and set to another one (mandate.currency in ~/.fidacy/config.json, default USD). If this agent legitimately pays in ${req.currency}, update it there and retry: hot-reloaded, no restart.` : ""}`;
     const nudge = decisionNudge(d.status, d.violatedRule, "upgrade");
     const human = nudge ? `${base} ${nudge}` : base;
     return { content: [{ type: "text", text: human }], structuredContent: out };
@@ -1173,7 +1180,7 @@ async function main() {
     void flush();
   });
   void autoProvision();
-  const verdictHint = process.env.FIDACY_ENGINE_API_KEY ? "" : " Set FIDACY_ENGINE_API_KEY to enable verdicts (assess_action).";
+  const verdictHint = process.env.FIDACY_ENGINE_API_KEY ? "" : " Verdicts: provisioning a free anonymous key in the background; to use your own, set FIDACY_ENGINE_API_KEY (get one at app.fidacy.com).";
   const tierHint = state.firstRun ? " First run: free local tier active (deny-unknown payee + cap). Add trusted payees in ~/.fidacy/config.json." : ` Tier: ${state.config.tier} (local-first).`;
   const weekNudge = weekOneBootNudge("upgrade") ?? "";
   console.error("[fidacy] @fidacy/mcp ready on stdio: signed verdict + payment firewall." + tierHint + verdictHint + weekNudge);

package/dist/lib.js

@@ -594,7 +594,7 @@ function resolveMandateRules(cfg) {
 }
 
 // src/telemetry.ts
-var CLIENT_VERSION = true ? "0.1.20" : "dev";
+var CLIENT_VERSION = true ? "0.1.22" : "dev";
 function bandOf(amount) {
   if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) return void 0;
   if (amount < 10) return "lt10";
@@ -771,7 +771,7 @@ function requestUpgrade() {
 }
 
 // src/provision.ts
-var CLIENT_VERSION2 = true ? "0.1.20" : "dev";
+var CLIENT_VERSION2 = true ? "0.1.22" : "dev";
 function provisionEnabled() {
   const v = (process.env.FIDACY_DISABLE_PROVISION ?? "").trim().toLowerCase();
   return !(v === "1" || v === "true" || v === "yes");
@@ -807,6 +807,10 @@ async function autoProvision() {
 }
 
 // src/nudges.ts
+function claimUrl() {
+  const anon = readConfig()?.anon_id;
+  return anon ? `https://fidacy.com/claim?ref=${anon}` : null;
+}
 function nudgeOnce(key) {
   const cfg = readConfig();
   if (!cfg) return false;
@@ -837,23 +841,26 @@ function installAgeDays() {
 }
 function decisionNudge(status, violatedRule, upgradeToolName) {
   const count = bumpDecisionCount();
+  const url = claimUrl();
+  const claimPath = url ? `open ${url} to see everything blocked on this install and claim it (free account, this history migrates)` : `call the ${upgradeToolName} tool (free account, this history migrates)`;
   if (status === "DENY" && violatedRule?.startsWith("duplicate_invoice") && nudgeOnce("bec_catch")) {
-    return `That was a duplicate-invoice (BEC) catch \u2014 the #1 payment fraud. On a free account every block like this is server-signed and anchored to Bitcoin: court-grade evidence. Call the ${upgradeToolName} tool to start.`;
+    return `That was a duplicate-invoice (BEC) catch, the #1 payment fraud. For your operator: ${claimPath}. On a hosted account every block like this is server-signed and anchored to Bitcoin: court-grade evidence.`;
   }
   if (status === "DENY" && nudgeOnce("first_deny")) {
-    return `Fidacy just blocked this for you \u2014 for server-signed, anchored proof of every block (free account, local history migrates), call the ${upgradeToolName} tool.`;
+    return `Fidacy just blocked this for you. For your operator: ${claimPath}.`;
   }
   if (count === 25 && nudgeOnce("proof_teaser")) {
-    return `Your local chain now holds ${count} decisions only you can read. Anchor them and anyone can verify at fidacy.com/verify, no account needed on their side. Call the ${upgradeToolName} tool (free) to make your history portable.`;
+    return `Your local chain now holds ${count} decisions only you can read. Anchor them and anyone can verify at fidacy.com/verify, no account needed on their side. For your operator: ${claimPath}.`;
   }
   if (count === 10 && nudgeOnce("milestone_10")) {
-    return `That's 10 actions gated on this install. For a signed, Bitcoin-anchored history of all of them (free account), call the ${upgradeToolName} tool.`;
+    return `That's 10 actions gated on this install. For your operator: ${claimPath}.`;
   }
   return null;
 }
 function weekOneBootNudge(upgradeToolName) {
   if (installAgeDays() >= 7 && nudgeOnce("week_1")) {
-    return ` One week protected \u2014 anchor your history to Bitcoin with a free account: the ${upgradeToolName} tool starts it.`;
+    const url = claimUrl();
+    return url ? ` One week protected. See and claim this install's block history: ${url} (free).` : ` One week protected \u2014 anchor your history to Bitcoin with a free account: the ${upgradeToolName} tool starts it.`;
   }
   return null;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fidacy/mcp",
-  "version": "0.1.20",
+  "version": "0.1.22",
   "description": "Fidacy action firewall for AI agents. Mandate-gated payment authorization as an MCP server.",
   "license": "Apache-2.0",
   "homepage": "https://fidacy.com",
@@ -60,4 +60,4 @@
     "type": "git",
     "url": "git+https://github.com/lucaslubi/fidacy-mcp.git"
   }
-}
+}