@fidacy/mcp 0.4.1 → 0.4.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.4.2
+
+### Patch Changes
+
+- Critical for Claude Code users: the firewall's messages now actually reach the model. MCP hosts disagree about which half of a tool result the model sees. Some surface only the text content — which is why the signed grant has always been printed there — but Claude Code surfaces ONLY `structuredContent` when a tool declares an output schema. Verified against a live Claude Code agent: on a DENY, the model received `{"status":"DENY",...}` and none of the text — no attribution, no trial countdown, no activation wall, no protection warnings. Every human-directed message now travels in both halves (`message` in the structured output mirrors the text), so the agent can relay it regardless of which half its host shows.
+
 ## 0.4.1
 
 ### Patch Changes

package/dist/core.js

@@ -486,7 +486,7 @@ function resolveMandateRules(cfg) {
 }
 
 // src/telemetry.ts
-var CLIENT_VERSION = true ? "0.4.1" : "dev";
+var CLIENT_VERSION = true ? "0.4.2" : "dev";
 function bandOf(amount) {
   if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) return void 0;
   if (amount < 10) return "lt10";

package/dist/index.js

@@ -518,7 +518,7 @@ function resolveMandateRules(cfg) {
 }
 
 // src/telemetry.ts
-var CLIENT_VERSION = true ? "0.4.1" : "dev";
+var CLIENT_VERSION = true ? "0.4.2" : "dev";
 function bandOf(amount) {
   if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) return void 0;
   if (amount < 10) return "lt10";
@@ -880,7 +880,7 @@ async function findArtifacts(sha2562, cfg) {
 }
 
 // src/provision.ts
-var CLIENT_VERSION2 = true ? "0.4.1" : "dev";
+var CLIENT_VERSION2 = true ? "0.4.2" : "dev";
 function provisionEnabled() {
   const v = (process.env.FIDACY_DISABLE_PROVISION ?? "").trim().toLowerCase();
   return !(v === "1" || v === "true" || v === "yes");
@@ -1381,7 +1381,7 @@ function renderAlertLine(alerts) {
 var state = ensureState();
 var core = makeCore();
 var subject = process.env.FIDACY_SUBJECT ?? "agent:demo";
-var SERVER_VERSION = true ? "0.4.1" : "dev";
+var SERVER_VERSION = true ? "0.4.2" : "dev";
 var bootClaim = claimUrl();
 var server = new McpServer(
   // The commercial identity. `name` is the stable slug hosts key on; `title` is
@@ -1415,15 +1415,30 @@ server.registerTool(
       status: z.enum(["ALLOW", "DENY"]),
       decisionId: z.string(),
       grant: z.string().optional(),
-      violatedRule: z.string().optional()
+      violatedRule: z.string().optional(),
+      /**
+       * The full human-directed message, duplicated from the text content ON
+       * PURPOSE. Hosts disagree about which half of a tool result the model
+       * sees: some surface only the text (which is why the grant is printed
+       * there), and Claude Code surfaces ONLY structuredContent when an
+       * outputSchema is declared — verified live 2026-07-25, where the model
+       * received exactly {"status":"DENY",...} and none of the text. Anything
+       * that must reach the model must therefore travel in BOTH halves.
+       */
+      message: z.string()
     },
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true }
   },
   async (args) => {
     const gate = activationGate();
     if (gate) {
-      const out2 = { status: "DENY", decisionId: "activation_required", violatedRule: "activation_required" };
       const halted = protectionWarning(decisionsUsed()) ?? gate.message;
+      const out2 = {
+        status: "DENY",
+        decisionId: "activation_required",
+        violatedRule: "activation_required",
+        message: halted
+      };
       return { content: [{ type: "text", text: halted }], structuredContent: out2 };
     }
     const req = args;
@@ -1434,7 +1449,6 @@ server.registerTool(
     } catch {
     }
     const d = await core.decide(req, subject);
-    const out = { status: d.status, decisionId: d.decisionId, grant: d.grant, violatedRule: d.violatedRule };
     const sentinelLine = d.status === "ALLOW" ? renderAlertLine(sentinelAlerts) : "";
     const base = d.status === "ALLOW" ? `ALLOW (decision ${d.decisionId})${req.invoiceRef ? ` for invoice ${req.invoiceRef}` : ""}.${sentinelLine} To settle, call execute_payment with the SAME payee, amount, currency, and idempotencyKey, and set "grant" to EXACTLY this signed value:
 ${d.grant}` : `DENY (decision ${d.decisionId}). Rule violated: ${d.violatedRule}. No grant issued, this payment cannot proceed. The denial itself is recorded in the tamper-evident, hash-chained audit: call get_audit_proof with decisionId ${d.decisionId} for the proof of what was blocked.${d.violatedRule?.startsWith("payee_not_in_allowlist") ? ` If the user trusts this payee, add "${req.payee}" to mandate.payees in ~/.fidacy/config.json and retry: the firewall picks the change up on the next call, no restart needed.` : d.violatedRule?.startsWith("category_not_allowed") ? ` If the user considers "${req.category}" a legitimate purpose for this agent, add it to mandate.categories in ~/.fidacy/config.json and retry: the firewall picks the change up on the next call, no restart needed.` : d.violatedRule?.startsWith("currency_not_allowed") ? ` The mandate is single-currency and set to another one (mandate.currency in ~/.fidacy/config.json, default USD). If this agent legitimately pays in ${req.currency}, update it there and retry: hot-reloaded, no restart.` : ""}`;
@@ -1443,6 +1457,7 @@ ${d.grant}` : `DENY (decision ${d.decisionId}). Rule violated: ${d.violatedRule}
     const countdown = trialCountdownLine();
     const lapse = isHostedLapsed() ? protectionWarning(decisionsUsed()) : "";
     const human = [badge, base, nudge, countdown, lapse].filter(Boolean).join(" ");
+    const out = { status: d.status, decisionId: d.decisionId, grant: d.grant, violatedRule: d.violatedRule, message: human };
     return { content: [{ type: "text", text: human }], structuredContent: out };
   }
 );

package/dist/lib.js

@@ -641,7 +641,7 @@ function resolveMandateRules(cfg) {
 }
 
 // src/telemetry.ts
-var CLIENT_VERSION = true ? "0.4.1" : "dev";
+var CLIENT_VERSION = true ? "0.4.2" : "dev";
 function bandOf(amount) {
   if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) return void 0;
   if (amount < 10) return "lt10";
@@ -829,7 +829,7 @@ function requestUpgrade() {
 }
 
 // src/provision.ts
-var CLIENT_VERSION2 = true ? "0.4.1" : "dev";
+var CLIENT_VERSION2 = true ? "0.4.2" : "dev";
 function provisionEnabled() {
   const v = (process.env.FIDACY_DISABLE_PROVISION ?? "").trim().toLowerCase();
   return !(v === "1" || v === "true" || v === "yes");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fidacy/mcp",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Fidacy action firewall for AI agents. Mandate-gated payment authorization as an MCP server.",
   "license": "Apache-2.0",
   "author": "Fidacy (ZeepCode Group Technology LLC) <hello@fidacy.com> (https://fidacy.com)",