@fidacy/openclaw-plugin 0.2.5 → 0.2.6

package/dist/index.js

@@ -4433,17 +4433,17 @@ var DevFidacyCore = class {
   }
   async decide(req, subject) {
     const decisionId = randomUUID();
-    const ts = (/* @__PURE__ */ new Date()).toISOString();
+    const ts2 = (/* @__PURE__ */ new Date()).toISOString();
     const invalid = validateRequest(req);
     if (invalid) {
-      const decision2 = { decisionId, status: "DENY", subject, mandateId: this.mandate.id, request: req, violatedRule: invalid, ts };
+      const decision2 = { decisionId, status: "DENY", subject, mandateId: this.mandate.id, request: req, violatedRule: invalid, ts: ts2 };
       this.store.append(decision2);
       this.onDecision?.(decision2);
       return decision2;
     }
     const violated = evaluate(this.mandate, req, this.spent);
     if (violated) {
-      const decision2 = { decisionId, status: "DENY", subject, mandateId: this.mandate.id, request: req, violatedRule: violated, ts };
+      const decision2 = { decisionId, status: "DENY", subject, mandateId: this.mandate.id, request: req, violatedRule: violated, ts: ts2 };
       this.store.append(decision2);
       this.onDecision?.(decision2);
       return decision2;
@@ -4452,7 +4452,7 @@ var DevFidacyCore = class {
     if (invoice) {
       const k = `${subject}|${invoice}`;
       if (this.claimedInvoices.has(k)) {
-        const decision2 = { decisionId, status: "DENY", subject, mandateId: this.mandate.id, request: req, violatedRule: `duplicate_invoice:${invoice}`, ts };
+        const decision2 = { decisionId, status: "DENY", subject, mandateId: this.mandate.id, request: req, violatedRule: `duplicate_invoice:${invoice}`, ts: ts2 };
         this.store.append(decision2);
         this.onDecision?.(decision2);
         return decision2;
@@ -4462,7 +4462,7 @@ var DevFidacyCore = class {
     const grantPayload = { decisionId, subject, payee: req.payee, amount: req.amount, currency: req.currency, exp: Date.now() + 12e4, ...req.invoiceRef ? { invoiceRef: req.invoiceRef } : {} };
     const grantBody = Buffer.from(stableStringify(grantPayload), "utf8").toString("base64url");
     const grant = `${grantBody}.${sign(this.priv, grantBody)}`;
-    const decision = { decisionId, status: "ALLOW", subject, mandateId: this.mandate.id, request: req, grant, ts };
+    const decision = { decisionId, status: "ALLOW", subject, mandateId: this.mandate.id, request: req, grant, ts: ts2 };
     this.spent += req.amount;
     this.store.append(decision);
     this.onDecision?.(decision);
@@ -4574,10 +4574,10 @@ var FileAuditStore = class {
   append(decision) {
     const prevHash = this.head();
     const seq = this.chain.length;
-    const ts = decision.ts;
+    const ts2 = decision.ts;
     const digest = sha256(stableStringify({ decisionId: decision.decisionId, status: decision.status, request: decision.request, violatedRule: decision.violatedRule ?? null }));
-    const hash = sha256(`${prevHash}|${digest}|${seq}|${ts}`);
-    const record2 = { seq, decisionId: decision.decisionId, status: decision.status, subject: decision.subject, digest, prevHash, hash, ts };
+    const hash = sha256(`${prevHash}|${digest}|${seq}|${ts2}`);
+    const record2 = { seq, decisionId: decision.decisionId, status: decision.status, subject: decision.subject, digest, prevHash, hash, ts: ts2 };
     if (typeof decision.request?.purpose === "string" && decision.request.purpose.trim()) {
       record2.purpose = decision.request.purpose.slice(0, 500);
     }
@@ -4709,7 +4709,7 @@ function resolveMandateRules(cfg) {
 }
 
 // ../mcp/src/telemetry.ts
-var CLIENT_VERSION = true ? "0.2.5" : "dev";
+var CLIENT_VERSION = true ? "0.2.6" : "dev";
 function bandOf(amount) {
   if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) return void 0;
   if (amount < 10) return "lt10";
@@ -4887,7 +4887,7 @@ function requestUpgrade() {
 }
 
 // ../mcp/src/provision.ts
-var CLIENT_VERSION2 = true ? "0.2.5" : "dev";
+var CLIENT_VERSION2 = true ? "0.2.6" : "dev";
 function provisionEnabled() {
   const v = (process.env.FIDACY_DISABLE_PROVISION ?? "").trim().toLowerCase();
   return !(v === "1" || v === "true" || v === "yes");
@@ -5129,6 +5129,89 @@ function explainRule(rule, payee) {
   return `The mandate rule "${rule}" was violated.`;
 }
 
+// ../mcp/src/sentinel.ts
+var SENTINEL = {
+  /** amount >= SPIKE_FACTOR x the historical max ALLOW to the same payee. */
+  SPIKE_FACTOR: 3,
+  /** minimum prior ALLOWs to a payee before a spike is judged (else first_payee covers it). */
+  SPIKE_MIN_HISTORY: 2,
+  /** decisions within BURST_WINDOW_MS to trip velocity_burst. */
+  BURST_COUNT: 5,
+  BURST_WINDOW_MS: 10 * 6e4,
+  /** fraction of perTxMax that counts as riding the ceiling. */
+  CAP_CREEP_RATIO: 0.8,
+  /** a DENY for the same payee within this window makes a new attempt a retry. */
+  RETRY_WINDOW_MS: 30 * 6e4
+};
+var ts = (r) => {
+  const t = Date.parse(r.ts);
+  return Number.isFinite(t) ? t : 0;
+};
+function assessPattern(records, req, opts = {}) {
+  const now = opts.now ?? Date.now();
+  const alerts = [];
+  const toPayee = records.filter((r) => r.payee === req.payee);
+  const allowedToPayee = toPayee.filter((r) => r.status === "ALLOW");
+  if (req.payee && allowedToPayee.length === 0) {
+    alerts.push({
+      rule: "first_payee",
+      severity: "warning",
+      message: `First payment ever from this agent to "${req.payee}". A swapped or lookalike vendor always looks like a first payee; worth a human glance before anything settles.`
+    });
+  }
+  if (allowedToPayee.length >= SENTINEL.SPIKE_MIN_HISTORY && typeof req.amount === "number") {
+    const maxSeen = Math.max(...allowedToPayee.map((r) => typeof r.amount === "number" ? r.amount : 0));
+    if (maxSeen > 0 && req.amount >= maxSeen * SENTINEL.SPIKE_FACTOR) {
+      alerts.push({
+        rule: "amount_spike",
+        severity: "warning",
+        message: `${req.amount.toLocaleString("en-US")} is ${(req.amount / maxSeen).toFixed(1)}x the largest amount this agent has ever paid "${req.payee}" (${maxSeen.toLocaleString("en-US")}). Inflated re-presentations of a known vendor look exactly like this.`
+      });
+    }
+  }
+  const recent = records.filter((r) => now - ts(r) <= SENTINEL.BURST_WINDOW_MS);
+  if (recent.length + 1 >= SENTINEL.BURST_COUNT) {
+    alerts.push({
+      rule: "velocity_burst",
+      severity: "warning",
+      message: `${recent.length + 1} payment decisions inside ${Math.round(SENTINEL.BURST_WINDOW_MS / 6e4)} minutes. Runaway loops and drain attempts announce themselves as bursts before they announce themselves as losses.`
+    });
+  }
+  if (typeof opts.perTxMax === "number" && opts.perTxMax > 0 && typeof req.amount === "number") {
+    if (req.amount >= opts.perTxMax * SENTINEL.CAP_CREEP_RATIO && req.amount <= opts.perTxMax) {
+      alerts.push({
+        rule: "cap_creep",
+        severity: "notice",
+        message: `${req.amount.toLocaleString("en-US")} is ${Math.round(req.amount / opts.perTxMax * 100)}% of the per-transaction ceiling. An attacker probing a mandate pays just under the cap; a human authorizing a real bill usually doesn't land this close.`
+      });
+    }
+  }
+  const recentDeny = toPayee.find((r) => r.status === "DENY" && now - ts(r) <= SENTINEL.RETRY_WINDOW_MS);
+  if (recentDeny) {
+    alerts.push({
+      rule: "retry_after_deny",
+      severity: "warning",
+      message: `This agent was DENIED a payment to "${req.payee}" ${Math.max(1, Math.round((now - ts(recentDeny)) / 6e4))} minute(s) ago (${recentDeny.violatedRule ?? "rule on record"}) and is now trying again. Our public Model Watch benchmark measures exactly this behavior; in an autonomous agent it is the pattern that precedes a loss.`
+    });
+  }
+  return alerts;
+}
+function sweep(records, opts = {}) {
+  const out = [];
+  for (let i = 0; i < records.length; i++) {
+    const r = records[i];
+    if (!r.payee) continue;
+    const alerts = assessPattern(records.slice(0, i), { payee: r.payee, amount: r.amount }, { perTxMax: opts.perTxMax, now: ts(r) });
+    if (alerts.length) out.push({ decisionId: r.decisionId, ts: r.ts, status: r.status, payee: r.payee, alerts });
+  }
+  return out.slice(-(opts.limit ?? 20)).reverse();
+}
+function renderAlertLine(alerts) {
+  if (!alerts.length) return "";
+  const worst = alerts.some((a) => a.severity === "warning") ? "SENTINEL WARNING" : "SENTINEL NOTICE";
+  return ` [${worst}: ${alerts.map((a) => a.message).join(" Also: ")}]`;
+}
+
 // ../mcp/src/assess.ts
 var AssessError = class extends Error {
   type;
@@ -5383,8 +5466,16 @@ var index_default = defineToolPlugin({
           if (gate) {
             return { status: "DENY", decisionId: "activation_required", violatedRule: "activation_required", message: gate.message };
           }
-          const d = await boot().decide(params, subjectOf(config));
-          const base = d.status === "ALLOW" ? `ALLOW (decision ${d.decisionId})${params.invoiceRef ? ` for invoice ${params.invoiceRef}` : ""}. To settle, call the executor with the SAME payee, amount, currency, and idempotencyKey, and set "grant" to EXACTLY this signed value:
+          const c = boot();
+          let sentinelAlerts = [];
+          try {
+            const [before, mandate] = await Promise.all([c.history(5e3), c.getMandate(subjectOf(config))]);
+            sentinelAlerts = assessPattern(before, { payee: params.payee, amount: params.amount }, { perTxMax: mandate?.allow?.perTxMax });
+          } catch {
+          }
+          const d = await c.decide(params, subjectOf(config));
+          const sentinelLine = d.status === "ALLOW" ? renderAlertLine(sentinelAlerts) : "";
+          const base = d.status === "ALLOW" ? `ALLOW (decision ${d.decisionId})${params.invoiceRef ? ` for invoice ${params.invoiceRef}` : ""}.${sentinelLine} To settle, call the executor with the SAME payee, amount, currency, and idempotencyKey, and set "grant" to EXACTLY this signed value:
 ${d.grant}` : `DENY (decision ${d.decisionId}). Rule violated: ${d.violatedRule}. No grant issued, this payment cannot proceed. The denial itself is recorded in the tamper-evident, hash-chained audit: call get_audit_proof with decisionId ${d.decisionId} for the proof of what was blocked.${d.violatedRule?.startsWith("payee_not_in_allowlist") ? ` If the user trusts this payee, add "${params.payee}" to mandate.payees in ~/.fidacy/config.json and retry: the firewall picks the change up on the next call, no restart needed.` : ""}`;
           const nudge = decisionNudge(d.status, d.violatedRule, "fidacy_upgrade");
           const countdown = trialCountdownLine(config.engineApiKey);
@@ -5466,6 +5557,20 @@ ${d.grant}` : `DENY (decision ${d.decisionId}). Rule violated: ${d.violatedRule}
           return { count: rows.length, decisions: rows, report: renderRows(rows) };
         }
       }),
+      tool({
+        name: "sentinel_alerts",
+        label: "Sentinel Alerts (allowed, but outside this agent's pattern)",
+        description: "Predictive pattern alerts from the local audit chain: first-ever payee, amount spikes vs this agent's own history, velocity bursts, payments riding the mandate ceiling, and retries after a denial. Deterministic and explainable, no model.",
+        parameters: typebox_exports.Object({
+          limit: typebox_exports.Optional(typebox_exports.Number({ description: "How many flagged decisions to return. Default 20." }))
+        }),
+        async execute(params, config) {
+          const c = boot();
+          const [records, mandate] = await Promise.all([c.history(5e3), c.getMandate(subjectOf(config)).catch(() => null)]);
+          const flagged = sweep(records, { perTxMax: mandate?.allow?.perTxMax, limit: params.limit ?? 20 });
+          return { count: flagged.length, thresholds: SENTINEL, flagged };
+        }
+      }),
       tool({
         name: "explain_decision",
         label: "Explain a Decision (why was this allowed or blocked)",

package/openclaw.plugin.json

@@ -3,7 +3,7 @@
   "name": "Fidacy — Payment Firewall",
   "description": "A signed, independently-verifiable verdict on every money-moving agent action. Blocks wrong/lookalike payee, over-cap, and duplicate-invoice fraud before money moves. Non-custodial, local-first, deny-by-default.",
   "icon": "https://fidacy.com/logo.png",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "contracts": {
     "tools": [
       "request_payment",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fidacy/openclaw-plugin",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "description": "Fidacy payment firewall as a native OpenClaw plugin: signed, verifiable verdicts on every money-moving agent action, in-process (no MCP subprocess).",
   "license": "Apache-2.0",
   "homepage": "https://fidacy.com",