@fidacy/openclaw-plugin 0.2.7 → 0.2.9

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 0.2.9
+
+### Patch Changes
+
+- 48e1a28: Rebundle with @fidacy/mcp 0.3.0: the free-trial decision counter now survives the background auto-provision write (it was being wiped, resetting the 20-decision anonymous trial on every restart), and anonymous telemetry counts tool usage (tool_use event, allowlisted tool name only, never content).
+
+## 0.2.8
+
+### Patch Changes
+
+- 2e846a7: Funnel: move the strongest claim nudge before the activation wall, and make the
+  first-block nudge scary-but-true.
+
+  The proof-teaser nudge fired at decision 25, stranded behind the 20-decision
+  activation wall: once the firewall fails closed at 20, denied calls stop
+  advancing the counter, so 25 was never reached and the single strongest reason
+  to claim (the history you already built) never showed. It now fires at 15, five
+  decisions before the wall — carrot before stick, which is the highest-converting
+  moment the PLG research points to.
+
+  The first-deny nudge now cites the real $441,788 agent incident. Grounded fear,
+  never manufactured: for a company whose pitch is verify-don't-trust, a cited
+  fact converts and a fabricated panic would be self-refuting.
+
 ## 0.2.7
 
 ### Patch Changes

package/dist/index.js

@@ -4709,7 +4709,7 @@ function resolveMandateRules(cfg) {
 }
 
 // ../mcp/src/telemetry.ts
-var CLIENT_VERSION = true ? "0.2.7" : "dev";
+var CLIENT_VERSION = true ? "0.2.9" : "dev";
 function bandOf(amount) {
   if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) return void 0;
   if (amount < 10) return "lt10";
@@ -4760,7 +4760,7 @@ function resultOf(status, violatedRule) {
   if (r.startsWith("non_positive_amount") || r.startsWith("invalid_")) return "deny_invalid";
   return "deny_scope";
 }
-function record(type, result, band, capRatio) {
+function record(type, result, band, capRatio, action) {
   if (!telemetryEnabled()) return;
   buffer.push({
     type,
@@ -4769,7 +4769,8 @@ function record(type, result, band, capRatio) {
     shell: currentShell,
     ...result ? { result } : {},
     ...band ? { band } : {},
-    ...capRatio ? { cap_ratio: capRatio } : {}
+    ...capRatio ? { cap_ratio: capRatio } : {},
+    ...action ? { action } : {}
   });
   if (!flushTimer) {
     flushTimer = setTimeout(() => {
@@ -4887,7 +4888,7 @@ function requestUpgrade() {
 }
 
 // ../mcp/src/provision.ts
-var CLIENT_VERSION2 = true ? "0.2.7" : "dev";
+var CLIENT_VERSION2 = true ? "0.2.9" : "dev";
 function provisionEnabled() {
   const v = (process.env.FIDACY_DISABLE_PROVISION ?? "").trim().toLowerCase();
   return !(v === "1" || v === "true" || v === "yes");
@@ -4911,8 +4912,9 @@ async function autoProvision() {
     if (!res.ok) return "failed";
     const data = await res.json();
     if (typeof data.api_key !== "string" || !data.api_key) return "failed";
+    const fresh = readConfig() ?? cfg;
     writeConfig({
-      ...cfg,
+      ...fresh,
       api_key: data.api_key,
       tier: data.tier === "paid" ? "paid" : "free"
     });
@@ -4947,7 +4949,7 @@ function bumpDecisionCount() {
   sessionDecisions += 1;
   const cfg = readConfig();
   if (!cfg) return sessionDecisions;
-  const n = (cfg.decisions_count ?? 0) + 1;
+  const n = Math.max((cfg.decisions_count ?? 0) + 1, sessionDecisions);
   cfg.decisions_count = n;
   try {
     writeConfig(cfg);
@@ -4963,13 +4965,13 @@ function decisionNudge(status, violatedRule, upgradeToolName) {
     return `That was a duplicate-invoice (BEC) catch, the #1 payment fraud. For your operator: ${claimPath}. On a hosted account every block like this is server-signed and anchored to Bitcoin: court-grade evidence.`;
   }
   if (status === "DENY" && nudgeOnce("first_deny")) {
-    return `Fidacy just blocked this for you. For your operator: ${claimPath}.`;
+    return `Fidacy just blocked this payment before it moved. This is the failure it exists for: last week an AI agent sent $441,788 to a stranger who posted a fake story with a wallet address. Nothing was checking it. For your operator: ${claimPath}.`;
   }
   if (status === "ALLOW" && nudgeOnce("first_allow")) {
     return `Fidacy authorized this and signed the decision. For your operator: ${claimPath}.`;
   }
-  if (count === 25 && nudgeOnce("proof_teaser")) {
-    return `Your local chain now holds ${count} decisions only you can read. Anchor them and anyone can verify at fidacy.com/verify, no account needed on their side. For your operator: ${claimPath}.`;
+  if (count === 15 && nudgeOnce("proof_teaser")) {
+    return `Fidacy has now checked ${count} payments on this agent and stands between it and the wrong one, the prompt-injected payee, the duplicate, the over-limit charge. That protection pauses after 20 decisions without a free key. Keep the agent covered: ${claimPath}.`;
   }
   if (count === 10 && nudgeOnce("milestone_10")) {
     return `That's 10 actions gated on this install. For your operator: ${claimPath}.`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fidacy/openclaw-plugin",
-  "version": "0.2.7",
+  "version": "0.2.9",
   "description": "Fidacy payment firewall as a native OpenClaw plugin: signed, verifiable verdicts on every money-moving agent action, in-process (no MCP subprocess).",
   "license": "Apache-2.0",
   "author": "Fidacy (ZeepCode Group Technology LLC) <hello@fidacy.com> (https://fidacy.com)",
@@ -56,8 +56,8 @@
     "openclaw": "2026.6.11",
     "typebox": "1.1.39",
     "typescript": "^5.6.3",
-    "@fidacy/firewall": "0.1.1",
-    "@fidacy/mcp": "0.2.9"
+    "@fidacy/mcp": "0.3.0",
+    "@fidacy/firewall": "0.1.1"
   },
   "scripts": {
     "build": "node scripts/bundle.mjs",