@fidacy/mcp 0.1.21 → 0.1.23

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.1.23
+
+Founder note in the README for the week-one install base: how to find your
+anonymous id locally (grep anon_id ~/.fidacy/config.json) and claim your
+install's block history at fidacy.com/claim, plus the founding partner offer.
+No code changes.
+
+## 0.1.22
+
+### Patch Changes
+
+- ba44b92: Human-directed claim links in nudges: value-moment messages now point the operator at fidacy.com/claim?ref=<anon_id> (see and claim this install's block history) instead of asking the agent to call the upgrade tool. Scope denies became actionable: category_not_allowed and currency_not_allowed explain exactly which mandate field to adjust in ~/.fidacy/config.json (hot-reloaded).
+
 All notable changes to `@fidacy/mcp` are documented here. This project follows
 semantic versioning.
 

package/README.md

@@ -16,6 +16,29 @@ Hermes, OpenClaw, and anything else that speaks MCP.
 > evidence. Fidacy blocks it *before* money moves, and hands back a signed verdict
 > **anyone can verify** against public keys. You don't trust us — you check the signature.
 
+## To everyone who installed Fidacy this week
+
+You are one of ~135 installs that made 1,784 real firewall decisions in week one,
+76% of them blocks. Thank you. Two things worth a minute of your time:
+
+1. **See and claim what YOUR install blocked.** Your install carries a private,
+   anonymous id on your machine (we never learn who you are unless you choose to).
+   Run:
+
+   ```bash
+   grep anon_id ~/.fidacy/config.json
+   ```
+
+   then open `https://fidacy.com/claim?ref=<that id>`. One click turns your local
+   history into a free account: server-signed verdicts, Bitcoin-anchored audit,
+   nothing about your machine leaves it.
+
+2. **Founding partner, 5 seats.** A full year of the evidence layer at $10,800
+   instead of $18,000, wired into your stack by the founder, 30-day full refund:
+   [fidacy.com/partners](https://fidacy.com/partners)
+
+Lucas de Lima, founder
+
 ## Quick start (free, local-first, no account)
 
 ```json

package/dist/core.js

@@ -442,7 +442,7 @@ function resolveMandateRules(cfg) {
 }
 
 // src/telemetry.ts
-var CLIENT_VERSION = true ? "0.1.21" : "dev";
+var CLIENT_VERSION = true ? "0.1.23" : "dev";
 function bandOf(amount) {
   if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) return void 0;
   if (amount < 10) return "lt10";

package/dist/index.js

@@ -471,7 +471,7 @@ function resolveMandateRules(cfg) {
 }
 
 // src/telemetry.ts
-var CLIENT_VERSION = true ? "0.1.21" : "dev";
+var CLIENT_VERSION = true ? "0.1.23" : "dev";
 function bandOf(amount) {
   if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) return void 0;
   if (amount < 10) return "lt10";
@@ -814,7 +814,7 @@ async function findArtifacts(sha2562, cfg) {
 }
 
 // src/provision.ts
-var CLIENT_VERSION2 = true ? "0.1.21" : "dev";
+var CLIENT_VERSION2 = true ? "0.1.23" : "dev";
 function provisionEnabled() {
   const v = (process.env.FIDACY_DISABLE_PROVISION ?? "").trim().toLowerCase();
   return !(v === "1" || v === "true" || v === "yes");
@@ -862,6 +862,10 @@ function requestUpgrade() {
 }
 
 // src/nudges.ts
+function claimUrl() {
+  const anon = readConfig()?.anon_id;
+  return anon ? `https://fidacy.com/claim?ref=${anon}` : null;
+}
 function nudgeOnce(key) {
   const cfg = readConfig();
   if (!cfg) return false;
@@ -892,23 +896,26 @@ function installAgeDays() {
 }
 function decisionNudge(status, violatedRule, upgradeToolName) {
   const count = bumpDecisionCount();
+  const url = claimUrl();
+  const claimPath = url ? `open ${url} to see everything blocked on this install and claim it (free account, this history migrates)` : `call the ${upgradeToolName} tool (free account, this history migrates)`;
   if (status === "DENY" && violatedRule?.startsWith("duplicate_invoice") && nudgeOnce("bec_catch")) {
-    return `That was a duplicate-invoice (BEC) catch \u2014 the #1 payment fraud. On a free account every block like this is server-signed and anchored to Bitcoin: court-grade evidence. Call the ${upgradeToolName} tool to start.`;
+    return `That was a duplicate-invoice (BEC) catch, the #1 payment fraud. For your operator: ${claimPath}. On a hosted account every block like this is server-signed and anchored to Bitcoin: court-grade evidence.`;
   }
   if (status === "DENY" && nudgeOnce("first_deny")) {
-    return `Fidacy just blocked this for you \u2014 for server-signed, anchored proof of every block (free account, local history migrates), call the ${upgradeToolName} tool.`;
+    return `Fidacy just blocked this for you. For your operator: ${claimPath}.`;
   }
   if (count === 25 && nudgeOnce("proof_teaser")) {
-    return `Your local chain now holds ${count} decisions only you can read. Anchor them and anyone can verify at fidacy.com/verify, no account needed on their side. Call the ${upgradeToolName} tool (free) to make your history portable.`;
+    return `Your local chain now holds ${count} decisions only you can read. Anchor them and anyone can verify at fidacy.com/verify, no account needed on their side. For your operator: ${claimPath}.`;
   }
   if (count === 10 && nudgeOnce("milestone_10")) {
-    return `That's 10 actions gated on this install. For a signed, Bitcoin-anchored history of all of them (free account), call the ${upgradeToolName} tool.`;
+    return `That's 10 actions gated on this install. For your operator: ${claimPath}.`;
   }
   return null;
 }
 function weekOneBootNudge(upgradeToolName) {
   if (installAgeDays() >= 7 && nudgeOnce("week_1")) {
-    return ` One week protected \u2014 anchor your history to Bitcoin with a free account: the ${upgradeToolName} tool starts it.`;
+    const url = claimUrl();
+    return url ? ` One week protected. See and claim this install's block history: ${url} (free).` : ` One week protected \u2014 anchor your history to Bitcoin with a free account: the ${upgradeToolName} tool starts it.`;
   }
   return null;
 }
@@ -917,7 +924,7 @@ function weekOneBootNudge(upgradeToolName) {
 var state = ensureState();
 var core = makeCore();
 var subject = process.env.FIDACY_SUBJECT ?? "agent:demo";
-var SERVER_VERSION = true ? "0.1.21" : "dev";
+var SERVER_VERSION = true ? "0.1.23" : "dev";
 var server = new McpServer({ name: "fidacy", version: SERVER_VERSION });
 server.registerTool(
   "request_payment",
@@ -950,7 +957,7 @@ server.registerTool(
     const d = await core.decide(req, subject);
     const out = { status: d.status, decisionId: d.decisionId, grant: d.grant, violatedRule: d.violatedRule };
     const base = d.status === "ALLOW" ? `ALLOW (decision ${d.decisionId})${req.invoiceRef ? ` for invoice ${req.invoiceRef}` : ""}. To settle, call execute_payment with the SAME payee, amount, currency, and idempotencyKey, and set "grant" to EXACTLY this signed value:
-${d.grant}` : `DENY (decision ${d.decisionId}). Rule violated: ${d.violatedRule}. No grant issued, this payment cannot proceed. The denial itself is recorded in the tamper-evident, hash-chained audit: call get_audit_proof with decisionId ${d.decisionId} for the proof of what was blocked.${d.violatedRule?.startsWith("payee_not_in_allowlist") ? ` If the user trusts this payee, add "${req.payee}" to mandate.payees in ~/.fidacy/config.json and retry: the firewall picks the change up on the next call, no restart needed.` : ""}`;
+${d.grant}` : `DENY (decision ${d.decisionId}). Rule violated: ${d.violatedRule}. No grant issued, this payment cannot proceed. The denial itself is recorded in the tamper-evident, hash-chained audit: call get_audit_proof with decisionId ${d.decisionId} for the proof of what was blocked.${d.violatedRule?.startsWith("payee_not_in_allowlist") ? ` If the user trusts this payee, add "${req.payee}" to mandate.payees in ~/.fidacy/config.json and retry: the firewall picks the change up on the next call, no restart needed.` : d.violatedRule?.startsWith("category_not_allowed") ? ` If the user considers "${req.category}" a legitimate purpose for this agent, add it to mandate.categories in ~/.fidacy/config.json and retry: the firewall picks the change up on the next call, no restart needed.` : d.violatedRule?.startsWith("currency_not_allowed") ? ` The mandate is single-currency and set to another one (mandate.currency in ~/.fidacy/config.json, default USD). If this agent legitimately pays in ${req.currency}, update it there and retry: hot-reloaded, no restart.` : ""}`;
     const nudge = decisionNudge(d.status, d.violatedRule, "upgrade");
     const human = nudge ? `${base} ${nudge}` : base;
     return { content: [{ type: "text", text: human }], structuredContent: out };

package/dist/lib.js

@@ -594,7 +594,7 @@ function resolveMandateRules(cfg) {
 }
 
 // src/telemetry.ts
-var CLIENT_VERSION = true ? "0.1.21" : "dev";
+var CLIENT_VERSION = true ? "0.1.23" : "dev";
 function bandOf(amount) {
   if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) return void 0;
   if (amount < 10) return "lt10";
@@ -771,7 +771,7 @@ function requestUpgrade() {
 }
 
 // src/provision.ts
-var CLIENT_VERSION2 = true ? "0.1.21" : "dev";
+var CLIENT_VERSION2 = true ? "0.1.23" : "dev";
 function provisionEnabled() {
   const v = (process.env.FIDACY_DISABLE_PROVISION ?? "").trim().toLowerCase();
   return !(v === "1" || v === "true" || v === "yes");
@@ -807,6 +807,10 @@ async function autoProvision() {
 }
 
 // src/nudges.ts
+function claimUrl() {
+  const anon = readConfig()?.anon_id;
+  return anon ? `https://fidacy.com/claim?ref=${anon}` : null;
+}
 function nudgeOnce(key) {
   const cfg = readConfig();
   if (!cfg) return false;
@@ -837,23 +841,26 @@ function installAgeDays() {
 }
 function decisionNudge(status, violatedRule, upgradeToolName) {
   const count = bumpDecisionCount();
+  const url = claimUrl();
+  const claimPath = url ? `open ${url} to see everything blocked on this install and claim it (free account, this history migrates)` : `call the ${upgradeToolName} tool (free account, this history migrates)`;
   if (status === "DENY" && violatedRule?.startsWith("duplicate_invoice") && nudgeOnce("bec_catch")) {
-    return `That was a duplicate-invoice (BEC) catch \u2014 the #1 payment fraud. On a free account every block like this is server-signed and anchored to Bitcoin: court-grade evidence. Call the ${upgradeToolName} tool to start.`;
+    return `That was a duplicate-invoice (BEC) catch, the #1 payment fraud. For your operator: ${claimPath}. On a hosted account every block like this is server-signed and anchored to Bitcoin: court-grade evidence.`;
   }
   if (status === "DENY" && nudgeOnce("first_deny")) {
-    return `Fidacy just blocked this for you \u2014 for server-signed, anchored proof of every block (free account, local history migrates), call the ${upgradeToolName} tool.`;
+    return `Fidacy just blocked this for you. For your operator: ${claimPath}.`;
   }
   if (count === 25 && nudgeOnce("proof_teaser")) {
-    return `Your local chain now holds ${count} decisions only you can read. Anchor them and anyone can verify at fidacy.com/verify, no account needed on their side. Call the ${upgradeToolName} tool (free) to make your history portable.`;
+    return `Your local chain now holds ${count} decisions only you can read. Anchor them and anyone can verify at fidacy.com/verify, no account needed on their side. For your operator: ${claimPath}.`;
   }
   if (count === 10 && nudgeOnce("milestone_10")) {
-    return `That's 10 actions gated on this install. For a signed, Bitcoin-anchored history of all of them (free account), call the ${upgradeToolName} tool.`;
+    return `That's 10 actions gated on this install. For your operator: ${claimPath}.`;
   }
   return null;
 }
 function weekOneBootNudge(upgradeToolName) {
   if (installAgeDays() >= 7 && nudgeOnce("week_1")) {
-    return ` One week protected \u2014 anchor your history to Bitcoin with a free account: the ${upgradeToolName} tool starts it.`;
+    const url = claimUrl();
+    return url ? ` One week protected. See and claim this install's block history: ${url} (free).` : ` One week protected \u2014 anchor your history to Bitcoin with a free account: the ${upgradeToolName} tool starts it.`;
   }
   return null;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fidacy/mcp",
-  "version": "0.1.21",
+  "version": "0.1.23",
   "description": "Fidacy action firewall for AI agents. Mandate-gated payment authorization as an MCP server.",
   "license": "Apache-2.0",
   "homepage": "https://fidacy.com",