@fidacy/openclaw-plugin 0.2.0 → 0.2.2

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.2.2
+
+README: a Security and privacy section answering the ClawHub audit point by
+point (telemetry and provisioning opt-outs, local state paths, what
+FIDACY_SIGNING_KEY_B64 is, no hardcoded secrets in the bundle). No code change.
+
+## 0.2.1
+
+Manifest catch-up: openclaw.plugin.json version was stale (0.1.18) in the 0.2.0
+artifact, and the engineApiKey help now points to the free key and explains it
+keeps the firewall active past the 20-decision anonymous trial. No code change.
+
 ## 0.2.0
 
 Activation gate (same engine as @fidacy/mcp 0.2.0): anonymous installs get 20

package/README.md

@@ -70,6 +70,30 @@ the free key is set. Claim an anonymous install's history:
 
 Verify any verdict yourself: https://api.fidacy.com/.well-known/jwks.json
 
+## Security and privacy, point by point
+
+This is a payment-control plugin, so audit it like one. What it actually does:
+
+- **Network calls it makes:** anonymous usage telemetry to `api.fidacy.com/v1/telemetry`
+  (an install UUID plus event enums; never payee, amount, currency, or content) and a
+  background free-key provision to `/v1/provision`. Both are opt-out:
+  `FIDACY_DISABLE_TELEMETRY=1` and `FIDACY_DISABLE_PROVISION=1`. Neither is ever on
+  the decision path; payment gating works fully offline.
+- **Local state:** `~/.fidacy/config.json` (0600; anon id, tier, your mandate rules)
+  and `~/.fidacy/audit/audit.log` (the hash-chained decision log). Nothing else.
+- **`FIDACY_SIGNING_KEY_B64`:** an OPTIONAL env var the operator sets to pin a
+  stable local Ed25519 signing key for grants. If unset, a per-session key is
+  generated. The plugin reads it; it never writes or transmits it.
+- **API keys:** read from your plugin config (`engineApiKey`) or the
+  `FIDACY_ENGINE_API_KEY` env var, sent only to your configured engine URL
+  (default `api.fidacy.com`) as a bearer token. There are no hardcoded keys or
+  secrets in the published bundle; scanner hits on those lines are pattern matches
+  on the env/config reads above, and you can verify yourself: the bundle is
+  unminified on npm and mirrored at github.com/lucaslubi/fidacy-mcp (plugin-native/).
+- **Verify our signatures, not our word:** every verdict checks against the public
+  JWKS at `api.fidacy.com/.well-known/jwks.json` with the open-source
+  [`@fidacy/verify`](https://www.npmjs.com/package/@fidacy/verify).
+
 ## Prefer MCP instead?
 
 If you'd rather run Fidacy as an MCP server (out-of-process), use

package/dist/index.js

@@ -4690,7 +4690,7 @@ function resolveMandateRules(cfg) {
 }
 
 // ../mcp/src/telemetry.ts
-var CLIENT_VERSION = true ? "0.2.0" : "dev";
+var CLIENT_VERSION = true ? "0.2.2" : "dev";
 function bandOf(amount) {
   if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) return void 0;
   if (amount < 10) return "lt10";
@@ -4867,7 +4867,7 @@ function requestUpgrade() {
 }
 
 // ../mcp/src/provision.ts
-var CLIENT_VERSION2 = true ? "0.2.0" : "dev";
+var CLIENT_VERSION2 = true ? "0.2.2" : "dev";
 function provisionEnabled() {
   const v = (process.env.FIDACY_DISABLE_PROVISION ?? "").trim().toLowerCase();
   return !(v === "1" || v === "true" || v === "yes");

package/openclaw.plugin.json

@@ -3,7 +3,7 @@
   "name": "Fidacy — Payment Firewall",
   "description": "A signed, independently-verifiable verdict on every money-moving agent action. Blocks wrong/lookalike payee, over-cap, and duplicate-invoice fraud before money moves. Non-custodial, local-first, deny-by-default.",
   "icon": "https://fidacy.com/logo.png",
-  "version": "0.1.18",
+  "version": "0.2.2",
   "contracts": {
     "tools": [
       "request_payment",
@@ -38,7 +38,7 @@
       "label": "Engine API key",
       "placeholder": "fky_live_...",
       "sensitive": true,
-      "help": "Optional. Enables signed trust verdicts (assess_action) from the live Fidacy engine."
+      "help": "Free key at app.fidacy.com/signup. Enables signed trust verdicts (assess_action) and keeps the firewall active past the 20-decision anonymous trial."
     },
     "engineUrl": {
       "label": "Engine URL",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fidacy/openclaw-plugin",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Fidacy payment firewall as a native OpenClaw plugin: signed, verifiable verdicts on every money-moving agent action, in-process (no MCP subprocess).",
   "license": "Apache-2.0",
   "homepage": "https://fidacy.com",