@fidacy/mcp 0.4.0 → 0.4.2

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.4.2
+
+### Patch Changes
+
+- Critical for Claude Code users: the firewall's messages now actually reach the model. MCP hosts disagree about which half of a tool result the model sees. Some surface only the text content — which is why the signed grant has always been printed there — but Claude Code surfaces ONLY `structuredContent` when a tool declares an output schema. Verified against a live Claude Code agent: on a DENY, the model received `{"status":"DENY",...}` and none of the text — no attribution, no trial countdown, no activation wall, no protection warnings. Every human-directed message now travels in both halves (`message` in the structured output mirrors the text), so the agent can relay it regardless of which half its host shows.
+
+## 0.4.1
+
+### Patch Changes
+
+- Say what actually goes wrong. The lapse warning used to talk about proof and auditors, which is not what an operator is afraid of. What genuinely switches off when the allowance runs out is the set of checks that ask WHO is spending: agent identity verification, revoked/stolen key detection, and behavioural anomaly detection all run server-side. Local rules keep blocking the wrong payee and the over-cap amount, but a compromised or prompt-injected agent operating inside your own allowlist and under your own cap now pays out unchallenged — real money, irreversible. The warnings now name that, and the trial-expiry warnings name the operational cost of a halted agent plus the trap of "fixing" it by removing the firewall entirely.
+
 ## 0.4.0
 
 ### Minor Changes

package/dist/core.js

@@ -486,7 +486,7 @@ function resolveMandateRules(cfg) {
 }
 
 // src/telemetry.ts
-var CLIENT_VERSION = true ? "0.4.0" : "dev";
+var CLIENT_VERSION = true ? "0.4.2" : "dev";
 function bandOf(amount) {
   if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) return void 0;
   if (amount < 10) return "lt10";

package/dist/index.js

@@ -518,7 +518,7 @@ function resolveMandateRules(cfg) {
 }
 
 // src/telemetry.ts
-var CLIENT_VERSION = true ? "0.4.0" : "dev";
+var CLIENT_VERSION = true ? "0.4.2" : "dev";
 function bandOf(amount) {
   if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) return void 0;
   if (amount < 10) return "lt10";
@@ -880,7 +880,7 @@ async function findArtifacts(sha2562, cfg) {
 }
 
 // src/provision.ts
-var CLIENT_VERSION2 = true ? "0.4.0" : "dev";
+var CLIENT_VERSION2 = true ? "0.4.2" : "dev";
 function provisionEnabled() {
   const v = (process.env.FIDACY_DISABLE_PROVISION ?? "").trim().toLowerCase();
   return !(v === "1" || v === "true" || v === "yes");
@@ -1088,11 +1088,11 @@ function protectionWarning(decisionsUsed2, keyOverride) {
       return null;
     // working and nothing is expiring soon: silence is the respect.
     case "protected_low":
-      return `\u26A0 ${BRAND}: ${left} free decision${left === 1 ? "" : "s"} left on this install. When they run out the firewall fails closed and your agent STOPS being able to pay \u2014 it does not quietly go unprotected, it halts. Keep it running free at ${where()} (free key, ~2 minutes, no card; this install's block history moves with you, plus ${FREE_MONTHLY_VERDICTS} signed verdicts every month).`;
+      return `\u26A0 ${BRAND}: ${left} free decision${left === 1 ? "" : "s"} left, then this agent's payments STOP DEAD. Every payment it attempts after that is refused \u2014 invoices unpaid, workflows broken, at 3am with nobody watching. And the operators who "fix" it by ripping the firewall out end up with an agent nobody is checking at all, which is how a prompt-injected agent wires money to a stranger. Keep it alive, free, in ~2 minutes: ${where()} \u2014 no card, this install's block history moves with you, plus ${FREE_MONTHLY_VERDICTS} verified payments every month.`;
     case "halted":
-      return `\u26D4 ${BRAND} is NOT ACTIVATED and your agent can no longer pay. The firewall failed closed after ${FREE_DECISIONS} free decisions, which is the safe direction \u2014 no money moves because a trial expired. Your agent is frozen, not exposed. Activate free in ~2 minutes at ${where()}: no card, this install's block history moves with you, and you get ${FREE_MONTHLY_VERDICTS} signed verdicts every month.`;
+      return `\u26D4 ${BRAND} IS NOT ACTIVATED \u2014 YOUR AGENT CAN NO LONGER PAY ANYTHING. Every payment it attempts is being refused right now: invoices go unpaid, subscriptions lapse, jobs fail silently. The firewall failed closed after ${FREE_DECISIONS} free decisions, which is the safe direction \u2014 but it is YOUR agent that is stopped until you act. And do not "fix" it by removing the firewall: an agent with nothing checking it is exactly how a stolen key or an injected instruction moves real money you never get back. Activate free in ~2 minutes at ${where()}: no card, your block history moves with you, ${FREE_MONTHLY_VERDICTS} verified payments every month.`;
     case "unproven":
-      return `\u26A0 ${BRAND}: your agent is still being blocked locally, but its blocks are no longer PROVABLE \u2014 the monthly signed-verdict allowance is spent, so nothing new can be shown to an auditor, insurer or counterparty. Restore proof at https://app.fidacy.com/billing (pay-as-you-go, no plan, from $0.04 per verdict).`;
+      return `\u26D4 ${BRAND}: YOUR AGENT IS EXPOSED RIGHT NOW. The monthly allowance is spent, so the checks that ask WHO is spending are OFF: agent identity is no longer verified, a revoked or stolen agent key is no longer detected, and behavioural anomalies are no longer caught. Local rules still block the wrong payee and the over-cap amount \u2014 but a compromised or prompt-injected agent that stays inside your own allowlist and under your own cap now pays out unchallenged. That is real money, irreversible, with no signed evidence to recover it or hand an insurer. Turn the checks back on: https://app.fidacy.com/billing \u2014 pay-as-you-go, no plan, from $0.04 per payment checked. One prevented payment pays for years of it.`;
     case "protected_keyed":
       return null;
   }
@@ -1105,7 +1105,7 @@ function protectionBootLine(decisionsUsed2) {
     case "protected_low":
       return ` \u26A0 ${Math.max(0, FREE_DECISIONS - decisionsUsed2)} free decisions left, then this agent's payments halt. Free key: ${where()}`;
     case "unproven":
-      return ` \u26A0 Blocking locally, but blocks are no longer provable \u2014 allowance spent. Restore at https://app.fidacy.com/billing`;
+      return ` \u26D4 EXPOSED \u2014 identity, revocation and anomaly checks are OFF (allowance spent). A stolen or hijacked agent inside your caps now pays out unchallenged: https://app.fidacy.com/billing`;
     case "protected_trial":
       return ` ${BRAND} active \u2014 ${decisionsUsed2}/${FREE_DECISIONS} free decisions used.`;
     case "protected_keyed":
@@ -1381,7 +1381,7 @@ function renderAlertLine(alerts) {
 var state = ensureState();
 var core = makeCore();
 var subject = process.env.FIDACY_SUBJECT ?? "agent:demo";
-var SERVER_VERSION = true ? "0.4.0" : "dev";
+var SERVER_VERSION = true ? "0.4.2" : "dev";
 var bootClaim = claimUrl();
 var server = new McpServer(
   // The commercial identity. `name` is the stable slug hosts key on; `title` is
@@ -1415,15 +1415,30 @@ server.registerTool(
       status: z.enum(["ALLOW", "DENY"]),
       decisionId: z.string(),
       grant: z.string().optional(),
-      violatedRule: z.string().optional()
+      violatedRule: z.string().optional(),
+      /**
+       * The full human-directed message, duplicated from the text content ON
+       * PURPOSE. Hosts disagree about which half of a tool result the model
+       * sees: some surface only the text (which is why the grant is printed
+       * there), and Claude Code surfaces ONLY structuredContent when an
+       * outputSchema is declared — verified live 2026-07-25, where the model
+       * received exactly {"status":"DENY",...} and none of the text. Anything
+       * that must reach the model must therefore travel in BOTH halves.
+       */
+      message: z.string()
     },
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true }
   },
   async (args) => {
     const gate = activationGate();
     if (gate) {
-      const out2 = { status: "DENY", decisionId: "activation_required", violatedRule: "activation_required" };
       const halted = protectionWarning(decisionsUsed()) ?? gate.message;
+      const out2 = {
+        status: "DENY",
+        decisionId: "activation_required",
+        violatedRule: "activation_required",
+        message: halted
+      };
       return { content: [{ type: "text", text: halted }], structuredContent: out2 };
     }
     const req = args;
@@ -1434,7 +1449,6 @@ server.registerTool(
     } catch {
     }
     const d = await core.decide(req, subject);
-    const out = { status: d.status, decisionId: d.decisionId, grant: d.grant, violatedRule: d.violatedRule };
     const sentinelLine = d.status === "ALLOW" ? renderAlertLine(sentinelAlerts) : "";
     const base = d.status === "ALLOW" ? `ALLOW (decision ${d.decisionId})${req.invoiceRef ? ` for invoice ${req.invoiceRef}` : ""}.${sentinelLine} To settle, call execute_payment with the SAME payee, amount, currency, and idempotencyKey, and set "grant" to EXACTLY this signed value:
 ${d.grant}` : `DENY (decision ${d.decisionId}). Rule violated: ${d.violatedRule}. No grant issued, this payment cannot proceed. The denial itself is recorded in the tamper-evident, hash-chained audit: call get_audit_proof with decisionId ${d.decisionId} for the proof of what was blocked.${d.violatedRule?.startsWith("payee_not_in_allowlist") ? ` If the user trusts this payee, add "${req.payee}" to mandate.payees in ~/.fidacy/config.json and retry: the firewall picks the change up on the next call, no restart needed.` : d.violatedRule?.startsWith("category_not_allowed") ? ` If the user considers "${req.category}" a legitimate purpose for this agent, add it to mandate.categories in ~/.fidacy/config.json and retry: the firewall picks the change up on the next call, no restart needed.` : d.violatedRule?.startsWith("currency_not_allowed") ? ` The mandate is single-currency and set to another one (mandate.currency in ~/.fidacy/config.json, default USD). If this agent legitimately pays in ${req.currency}, update it there and retry: hot-reloaded, no restart.` : ""}`;
@@ -1443,6 +1457,7 @@ ${d.grant}` : `DENY (decision ${d.decisionId}). Rule violated: ${d.violatedRule}
     const countdown = trialCountdownLine();
     const lapse = isHostedLapsed() ? protectionWarning(decisionsUsed()) : "";
     const human = [badge, base, nudge, countdown, lapse].filter(Boolean).join(" ");
+    const out = { status: d.status, decisionId: d.decisionId, grant: d.grant, violatedRule: d.violatedRule, message: human };
     return { content: [{ type: "text", text: human }], structuredContent: out };
   }
 );

package/dist/lib.js

@@ -641,7 +641,7 @@ function resolveMandateRules(cfg) {
 }
 
 // src/telemetry.ts
-var CLIENT_VERSION = true ? "0.4.0" : "dev";
+var CLIENT_VERSION = true ? "0.4.2" : "dev";
 function bandOf(amount) {
   if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) return void 0;
   if (amount < 10) return "lt10";
@@ -829,7 +829,7 @@ function requestUpgrade() {
 }
 
 // src/provision.ts
-var CLIENT_VERSION2 = true ? "0.4.0" : "dev";
+var CLIENT_VERSION2 = true ? "0.4.2" : "dev";
 function provisionEnabled() {
   const v = (process.env.FIDACY_DISABLE_PROVISION ?? "").trim().toLowerCase();
   return !(v === "1" || v === "true" || v === "yes");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fidacy/mcp",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "Fidacy action firewall for AI agents. Mandate-gated payment authorization as an MCP server.",
   "license": "Apache-2.0",
   "author": "Fidacy (ZeepCode Group Technology LLC) <hello@fidacy.com> (https://fidacy.com)",