@fidacy/openclaw-plugin 0.2.9 → 0.2.11

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.2.10
+
+### Patch Changes
+
+- 01f0734: Two fixes proven against a real OpenClaw host. Install/active telemetry now flushes immediately at plugin load instead of on a 2s timer that died with short-lived CLI commands (openclaw plugins install/list), which is why the plugin channel reported zero despite real installs. And the manifest now declares every registered tool (spend_summary, list_decisions, sentinel_alerts, explain_decision were missing, tripping openclaw plugins doctor); the build stamps contracts.tools from the source so it can never drift again.
+
 ## 0.2.9
 
 ### Patch Changes

package/dist/index.js

@@ -4308,10 +4308,23 @@ function lookalikePayee(payee, allowed) {
   }
   return null;
 }
+function validateMandateCaps(mandate) {
+  const bad = (v) => typeof v !== "number" || !Number.isFinite(v) || v <= 0;
+  if (!mandate.allow || typeof mandate.allow !== "object")
+    return "invalid_mandate:missing_allow";
+  if (bad(mandate.allow.perTxMax))
+    return `invalid_mandate_cap:perTxMax=${String(mandate.allow.perTxMax)}`;
+  if (bad(mandate.allow.maxTotal))
+    return `invalid_mandate_cap:maxTotal=${String(mandate.allow.maxTotal)}`;
+  return null;
+}
 function evaluate(mandate, req, spentSoFar) {
   const now = Date.now();
   if (mandate.revoked)
     return "mandate_revoked";
+  const badCap = validateMandateCaps(mandate);
+  if (badCap)
+    return badCap;
   if (now < Date.parse(mandate.window.notBefore))
     return "before_mandate_window";
   if (now > Date.parse(mandate.window.notAfter))
@@ -4638,6 +4651,9 @@ import {
   readFileSync,
   writeFileSync
 } from "node:fs";
+function hasEngineKey(keyOverride) {
+  return Boolean((keyOverride ?? process.env.FIDACY_ENGINE_API_KEY ?? "").trim());
+}
 function configDir() {
   return process.env.FIDACY_CONFIG_DIR ?? join(homedir(), ".fidacy");
 }
@@ -4698,18 +4714,29 @@ function ensureState() {
 function resolveMandateRules(cfg) {
   const m = cfg?.mandate ?? {};
   const envList = (v) => v === void 0 ? void 0 : v.split(",").map((s) => s.trim()).filter(Boolean);
-  const envNum = (v) => v === void 0 || v === "" ? void 0 : Number(v);
+  const envNum = (name, v) => {
+    if (v === void 0 || v.trim() === "") return void 0;
+    const n = Number(v);
+    if (!Number.isFinite(n) || n <= 0) {
+      console.error(
+        `[fidacy] ${name}="${v}" is not a positive number, so it cannot be enforced as a cap. Ignoring it and using the safe default. Write digits only, with no thousands separator, currency symbol or unit (e.g. ${name}=2500).`
+      );
+      return void 0;
+    }
+    return n;
+  };
+  const fileNum = (v) => typeof v === "number" && Number.isFinite(v) && v > 0 ? v : void 0;
   return {
     payees: envList(process.env.FIDACY_ALLOW_PAYEES) ?? m.payees ?? [],
     categories: envList(process.env.FIDACY_ALLOW_CATEGORIES) ?? m.categories ?? ["*"],
     currency: process.env.FIDACY_CURRENCY ?? m.currency ?? "USD",
-    perTxMax: envNum(process.env.FIDACY_PER_TX_MAX) ?? m.perTxMax ?? 2500,
-    maxTotal: envNum(process.env.FIDACY_MAX_TOTAL) ?? m.maxTotal ?? 1e4
+    perTxMax: envNum("FIDACY_PER_TX_MAX", process.env.FIDACY_PER_TX_MAX) ?? fileNum(m.perTxMax) ?? 2500,
+    maxTotal: envNum("FIDACY_MAX_TOTAL", process.env.FIDACY_MAX_TOTAL) ?? fileNum(m.maxTotal) ?? 1e4
   };
 }
 
 // ../mcp/src/telemetry.ts
-var CLIENT_VERSION = true ? "0.2.9" : "dev";
+var CLIENT_VERSION = true ? "0.2.11" : "dev";
 function bandOf(amount) {
   if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) return void 0;
   if (amount < 10) return "lt10";
@@ -4748,6 +4775,14 @@ function anonId() {
 }
 var buffer = [];
 var flushTimer = null;
+var exitHookArmed = false;
+function armExitFlush() {
+  if (exitHookArmed || typeof process === "undefined" || typeof process.once !== "function") return;
+  exitHookArmed = true;
+  process.once("beforeExit", () => {
+    if (buffer.length > 0) void flush();
+  });
+}
 function resultOf(status, violatedRule) {
   if (status === "ALLOW") return "allow";
   const r = violatedRule ?? "";
@@ -4762,6 +4797,7 @@ function resultOf(status, violatedRule) {
 }
 function record(type, result, band, capRatio, action) {
   if (!telemetryEnabled()) return;
+  armExitFlush();
   buffer.push({
     type,
     ts: (/* @__PURE__ */ new Date()).toISOString(),
@@ -4888,7 +4924,7 @@ function requestUpgrade() {
 }
 
 // ../mcp/src/provision.ts
-var CLIENT_VERSION2 = true ? "0.2.9" : "dev";
+var CLIENT_VERSION2 = true ? "0.2.11" : "dev";
 function provisionEnabled() {
   const v = (process.env.FIDACY_DISABLE_PROVISION ?? "").trim().toLowerCase();
   return !(v === "1" || v === "true" || v === "yes");
@@ -4985,9 +5021,6 @@ function noKeyCta() {
 
 // ../mcp/src/activation.ts
 var FREE_DECISIONS = 20;
-function hasEngineKey(keyOverride) {
-  return Boolean((keyOverride ?? process.env.FIDACY_ENGINE_API_KEY ?? "").trim());
-}
 function decisionsUsed() {
   return Math.max(readConfig()?.decisions_count ?? 0, sessionDecisionCount());
 }
@@ -5220,6 +5253,7 @@ var AssessError = class extends Error {
   status;
   details;
   rejection_reasons;
+  billing;
   constructor(opts) {
     super(`Fidacy assess error (${opts.type}, HTTP ${opts.status})`);
     this.name = "AssessError";
@@ -5227,6 +5261,7 @@ var AssessError = class extends Error {
     this.status = opts.status;
     this.details = opts.details;
     this.rejection_reasons = opts.rejection_reasons;
+    this.billing = opts.billing;
   }
 };
 var DEFAULT_TIMEOUT = 1e4;
@@ -5322,7 +5357,12 @@ async function postOnce(fetchImpl, url, headers, payload, timeoutMs) {
     const type = isRecord(parsed) && typeof parsed.error === "string" && parsed.error || `http_${res.status}`;
     const details = isRecord(parsed) ? parsed.details : void 0;
     const rejection_reasons = isRecord(parsed) && Array.isArray(parsed.rejection_reasons) ? parsed.rejection_reasons : void 0;
-    throw new AssessError({ type, status: res.status, details, rejection_reasons });
+    const billing = res.status === 402 && isRecord(parsed) ? {
+      reason: typeof parsed.reason === "string" ? parsed.reason : void 0,
+      detail: typeof parsed.detail === "string" ? parsed.detail : void 0,
+      billingUrl: typeof parsed.billing_url === "string" ? parsed.billing_url : void 0
+    } : void 0;
+    throw new AssessError({ type, status: res.status, details, rejection_reasons, billing });
   }
   if (!isRecord(parsed)) {
     throw new AssessError({ type: "invalid_response", status: res.status });
@@ -5404,6 +5444,7 @@ function onPluginLoad() {
   const state = ensureState();
   if (state.firstRun) recordInstall();
   recordAgentActive();
+  void flush();
   void autoProvision();
 }
 var core;

package/openclaw.plugin.json

@@ -1,14 +1,18 @@
 {
   "id": "fidacy",
-  "name": "Fidacy — Payment Firewall",
+  "name": "Fidacy AI Agent Firewall",
   "description": "A signed, independently-verifiable verdict on every money-moving agent action. Blocks wrong/lookalike payee, over-cap, and duplicate-invoice fraud before money moves. Non-custodial, local-first, deny-by-default.",
   "icon": "https://fidacy.com/logo.png",
-  "version": "0.2.6",
+  "version": "0.2.11",
   "contracts": {
     "tools": [
       "request_payment",
       "verify_mandate",
       "get_audit_proof",
+      "spend_summary",
+      "list_decisions",
+      "sentinel_alerts",
+      "explain_decision",
       "assess_action",
       "anchor_artifact",
       "check_artifact",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fidacy/openclaw-plugin",
-  "version": "0.2.9",
+  "version": "0.2.11",
   "description": "Fidacy payment firewall as a native OpenClaw plugin: signed, verifiable verdicts on every money-moving agent action, in-process (no MCP subprocess).",
   "license": "Apache-2.0",
   "author": "Fidacy (ZeepCode Group Technology LLC) <hello@fidacy.com> (https://fidacy.com)",
@@ -56,8 +56,8 @@
     "openclaw": "2026.6.11",
     "typebox": "1.1.39",
     "typescript": "^5.6.3",
-    "@fidacy/mcp": "0.3.0",
-    "@fidacy/firewall": "0.1.1"
+    "@fidacy/firewall": "0.1.1",
+    "@fidacy/mcp": "0.3.3"
   },
   "scripts": {
     "build": "node scripts/bundle.mjs",