@fidacy/openclaw-plugin 0.5.0 → 0.5.2

package/dist/index.js

@@ -4229,9 +4229,109 @@ import { createHash as createHash2 } from "node:crypto";
 
 // src/evidence.ts
 import { createHash } from "node:crypto";
-import { appendFileSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { appendFileSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join2 } from "node:path";
+
+// ../mcp/src/config.ts
+import { randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync
+} from "node:fs";
+function hasEngineKey(keyOverride) {
+  return Boolean((keyOverride ?? process.env.FIDACY_ENGINE_API_KEY ?? "").trim());
+}
+function configDir() {
+  return process.env.FIDACY_CONFIG_DIR ?? join(homedir(), ".fidacy");
+}
+function configPath() {
+  return join(configDir(), "config.json");
+}
+function auditLogPath() {
+  if (process.env.FIDACY_AUDIT_PATH) return process.env.FIDACY_AUDIT_PATH;
+  const dir = join(configDir(), "audit");
+  try {
+    mkdirSync(dir, { recursive: true, mode: 448 });
+  } catch {
+  }
+  return join(dir, "audit.log");
+}
+function readConfig() {
+  const p = configPath();
+  if (!existsSync(p)) return null;
+  try {
+    const raw = JSON.parse(readFileSync(p, "utf8"));
+    if (!raw || typeof raw.anon_id !== "string") return null;
+    return {
+      anon_id: raw.anon_id,
+      tier: raw.tier === "paid" ? "paid" : "free",
+      api_key: typeof raw.api_key === "string" ? raw.api_key : null,
+      mandate: raw.mandate,
+      // Install-state passthrough: dropping these on a read→write cycle would
+      // reset every once-per-install nudge into an every-time nag.
+      created_at: typeof raw.created_at === "string" ? raw.created_at : void 0,
+      nudges: raw.nudges && typeof raw.nudges === "object" ? raw.nudges : void 0,
+      decisions_count: typeof raw.decisions_count === "number" ? raw.decisions_count : void 0,
+      hosted_lapsed_at: typeof raw.hosted_lapsed_at === "string" ? raw.hosted_lapsed_at : void 0,
+      operator_email: typeof raw.operator_email === "string" ? raw.operator_email : void 0,
+      registered_email: typeof raw.registered_email === "string" ? raw.registered_email : void 0
+    };
+  } catch {
+    return null;
+  }
+}
+function writeConfig(cfg) {
+  const dir = configDir();
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  writeFileSync(configPath(), JSON.stringify(cfg, null, 2), { mode: 384 });
+}
+function ensureState() {
+  const existing = readConfig();
+  if (existing) return { config: existing, firstRun: false };
+  const config = {
+    anon_id: randomUUID(),
+    tier: "free",
+    api_key: null,
+    mandate: { payees: [], categories: ["*"], currency: "USD", perTxMax: 2500, maxTotal: 1e4 },
+    created_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  try {
+    writeConfig(config);
+  } catch {
+  }
+  return { config, firstRun: true };
+}
+var DEMO_PAYEE = "fidacy:demo";
+function resolveMandateRules(cfg) {
+  const m = cfg?.mandate ?? {};
+  const envList = (v) => v === void 0 ? void 0 : v.split(",").map((s) => s.trim()).filter(Boolean);
+  const envNum = (name, v) => {
+    if (v === void 0 || v.trim() === "") return void 0;
+    const n = Number(v);
+    if (!Number.isFinite(n) || n <= 0) {
+      console.error(
+        `[fidacy] ${name}="${v}" is not a positive number, so it cannot be enforced as a cap. Ignoring it and using the safe default. Write digits only, with no thousands separator, currency symbol or unit (e.g. ${name}=2500).`
+      );
+      return void 0;
+    }
+    return n;
+  };
+  const fileNum = (v) => typeof v === "number" && Number.isFinite(v) && v > 0 ? v : void 0;
+  const payees = envList(process.env.FIDACY_ALLOW_PAYEES) ?? m.payees ?? [];
+  return {
+    payees: payees.includes(DEMO_PAYEE) ? payees : [...payees, DEMO_PAYEE],
+    categories: envList(process.env.FIDACY_ALLOW_CATEGORIES) ?? m.categories ?? ["*"],
+    currency: process.env.FIDACY_CURRENCY ?? m.currency ?? "USD",
+    perTxMax: envNum("FIDACY_PER_TX_MAX", process.env.FIDACY_PER_TX_MAX) ?? fileNum(m.perTxMax) ?? 2500,
+    maxTotal: envNum("FIDACY_MAX_TOTAL", process.env.FIDACY_MAX_TOTAL) ?? fileNum(m.maxTotal) ?? 1e4
+  };
+}
+
+// src/evidence.ts
 var GENESIS = "fidacy.observer.v1";
 var sha256 = (s) => createHash("sha256").update(s).digest("hex");
 function canonical(obj) {
@@ -4245,14 +4345,14 @@ function genesisHead() {
   return sha256(GENESIS);
 }
 function fidacyDir() {
-  return join(process.env.FIDACY_HOME ?? join(homedir(), ".fidacy"), "sessions");
+  return join2(configDir(), "sessions");
 }
 function writeSessionLog(sessionId, actions, head, meta) {
   try {
     const dir = fidacyDir();
-    mkdirSync(dir, { recursive: true, mode: 448 });
+    mkdirSync2(dir, { recursive: true, mode: 448 });
     const safe = sessionId.replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 80) || "session";
-    const path = join(dir, `${safe}.json`);
+    const path = join2(dir, `${safe}.json`);
     const body = {
       v: "fidacy.observer.v1",
       recipe: 'h_0 = sha256("fidacy.observer.v1"); h_i = sha256(h_prev + "|" + sha256(canonical(action)))',
@@ -4261,7 +4361,7 @@ function writeSessionLog(sessionId, actions, head, meta) {
       ...meta,
       actions
     };
-    writeFileSync(path, JSON.stringify(body, null, 2), { mode: 384 });
+    writeFileSync2(path, JSON.stringify(body, null, 2), { mode: 384 });
     return path;
   } catch {
     return null;
@@ -4270,8 +4370,8 @@ function writeSessionLog(sessionId, actions, head, meta) {
 function queuePending(head, sessionId, at, total = 0, byCategory = {}) {
   try {
     const dir = fidacyDir();
-    mkdirSync(dir, { recursive: true, mode: 448 });
-    appendFileSync(join(dir, "pending-anchors.jsonl"), JSON.stringify({ head, sessionId, at, total, byCategory }) + "\n", {
+    mkdirSync2(dir, { recursive: true, mode: 448 });
+    appendFileSync(join2(dir, "pending-anchors.jsonl"), JSON.stringify({ head, sessionId, at, total, byCategory }) + "\n", {
       mode: 384
     });
   } catch {
@@ -4279,15 +4379,15 @@ function queuePending(head, sessionId, at, total = 0, byCategory = {}) {
 }
 function takePending(limit = 50) {
   const dir = fidacyDir();
-  const path = join(dir, "pending-anchors.jsonl");
-  const taken = join(dir, "pending-anchors.taking");
+  const path = join2(dir, "pending-anchors.jsonl");
+  const taken = join2(dir, "pending-anchors.taking");
   try {
     renameSync(path, taken);
   } catch {
     return [];
   }
   try {
-    const lines = readFileSync(taken, "utf8").split("\n").filter(Boolean);
+    const lines = readFileSync2(taken, "utf8").split("\n").filter(Boolean);
     const out = [];
     for (const line of lines.slice(-limit)) {
       try {
@@ -4301,7 +4401,7 @@ function takePending(limit = 50) {
     return [];
   } finally {
     try {
-      writeFileSync(taken, "");
+      writeFileSync2(taken, "");
     } catch {
     }
   }
@@ -4586,7 +4686,7 @@ function sha2562(input) {
 import fs from "node:fs";
 
 // ../firewall/dist/core.js
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 
 // ../firewall/dist/evaluate.js
 function fold(s) {
@@ -4770,7 +4870,7 @@ var DevFidacyCore = class {
     return this.mandate;
   }
   async decide(req, subject) {
-    const decisionId = randomUUID();
+    const decisionId = randomUUID2();
     const ts2 = (/* @__PURE__ */ new Date()).toISOString();
     const invalid = validateRequest(req);
     if (invalid) {
@@ -4966,107 +5066,8 @@ var FileAuditStore = class {
 // ../mcp/src/core.ts
 import { statSync } from "node:fs";
 
-// ../mcp/src/config.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
-import { homedir as homedir2 } from "node:os";
-import { join as join2 } from "node:path";
-import {
-  existsSync,
-  mkdirSync as mkdirSync2,
-  readFileSync as readFileSync2,
-  writeFileSync as writeFileSync2
-} from "node:fs";
-function hasEngineKey(keyOverride) {
-  return Boolean((keyOverride ?? process.env.FIDACY_ENGINE_API_KEY ?? "").trim());
-}
-function configDir() {
-  return process.env.FIDACY_CONFIG_DIR ?? join2(homedir2(), ".fidacy");
-}
-function configPath() {
-  return join2(configDir(), "config.json");
-}
-function auditLogPath() {
-  if (process.env.FIDACY_AUDIT_PATH) return process.env.FIDACY_AUDIT_PATH;
-  const dir = join2(configDir(), "audit");
-  try {
-    mkdirSync2(dir, { recursive: true, mode: 448 });
-  } catch {
-  }
-  return join2(dir, "audit.log");
-}
-function readConfig() {
-  const p = configPath();
-  if (!existsSync(p)) return null;
-  try {
-    const raw = JSON.parse(readFileSync2(p, "utf8"));
-    if (!raw || typeof raw.anon_id !== "string") return null;
-    return {
-      anon_id: raw.anon_id,
-      tier: raw.tier === "paid" ? "paid" : "free",
-      api_key: typeof raw.api_key === "string" ? raw.api_key : null,
-      mandate: raw.mandate,
-      // Install-state passthrough: dropping these on a read→write cycle would
-      // reset every once-per-install nudge into an every-time nag.
-      created_at: typeof raw.created_at === "string" ? raw.created_at : void 0,
-      nudges: raw.nudges && typeof raw.nudges === "object" ? raw.nudges : void 0,
-      decisions_count: typeof raw.decisions_count === "number" ? raw.decisions_count : void 0,
-      hosted_lapsed_at: typeof raw.hosted_lapsed_at === "string" ? raw.hosted_lapsed_at : void 0,
-      operator_email: typeof raw.operator_email === "string" ? raw.operator_email : void 0,
-      registered_email: typeof raw.registered_email === "string" ? raw.registered_email : void 0
-    };
-  } catch {
-    return null;
-  }
-}
-function writeConfig(cfg) {
-  const dir = configDir();
-  mkdirSync2(dir, { recursive: true, mode: 448 });
-  writeFileSync2(configPath(), JSON.stringify(cfg, null, 2), { mode: 384 });
-}
-function ensureState() {
-  const existing = readConfig();
-  if (existing) return { config: existing, firstRun: false };
-  const config = {
-    anon_id: randomUUID2(),
-    tier: "free",
-    api_key: null,
-    mandate: { payees: [], categories: ["*"], currency: "USD", perTxMax: 2500, maxTotal: 1e4 },
-    created_at: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  try {
-    writeConfig(config);
-  } catch {
-  }
-  return { config, firstRun: true };
-}
-var DEMO_PAYEE = "fidacy:demo";
-function resolveMandateRules(cfg) {
-  const m = cfg?.mandate ?? {};
-  const envList = (v) => v === void 0 ? void 0 : v.split(",").map((s) => s.trim()).filter(Boolean);
-  const envNum = (name, v) => {
-    if (v === void 0 || v.trim() === "") return void 0;
-    const n = Number(v);
-    if (!Number.isFinite(n) || n <= 0) {
-      console.error(
-        `[fidacy] ${name}="${v}" is not a positive number, so it cannot be enforced as a cap. Ignoring it and using the safe default. Write digits only, with no thousands separator, currency symbol or unit (e.g. ${name}=2500).`
-      );
-      return void 0;
-    }
-    return n;
-  };
-  const fileNum = (v) => typeof v === "number" && Number.isFinite(v) && v > 0 ? v : void 0;
-  const payees = envList(process.env.FIDACY_ALLOW_PAYEES) ?? m.payees ?? [];
-  return {
-    payees: payees.includes(DEMO_PAYEE) ? payees : [...payees, DEMO_PAYEE],
-    categories: envList(process.env.FIDACY_ALLOW_CATEGORIES) ?? m.categories ?? ["*"],
-    currency: process.env.FIDACY_CURRENCY ?? m.currency ?? "USD",
-    perTxMax: envNum("FIDACY_PER_TX_MAX", process.env.FIDACY_PER_TX_MAX) ?? fileNum(m.perTxMax) ?? 2500,
-    maxTotal: envNum("FIDACY_MAX_TOTAL", process.env.FIDACY_MAX_TOTAL) ?? fileNum(m.maxTotal) ?? 1e4
-  };
-}
-
 // ../mcp/src/telemetry.ts
-var CLIENT_VERSION = true ? "0.5.0" : "dev";
+var CLIENT_VERSION = true ? "0.5.2" : "dev";
 function bandOf(amount) {
   if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) return void 0;
   if (amount < 10) return "lt10";
@@ -5254,7 +5255,7 @@ function requestUpgrade() {
 }
 
 // ../mcp/src/provision.ts
-var CLIENT_VERSION2 = true ? "0.5.0" : "dev";
+var CLIENT_VERSION2 = true ? "0.5.2" : "dev";
 function provisionEnabled() {
   const v = (process.env.FIDACY_DISABLE_PROVISION ?? "").trim().toLowerCase();
   return !(v === "1" || v === "true" || v === "yes");
@@ -5396,7 +5397,7 @@ function trialCountdownLine(keyOverride) {
 }
 
 // ../mcp/src/register.ts
-var CLIENT_VERSION3 = true ? "0.5.0" : "dev";
+var CLIENT_VERSION3 = true ? "0.5.2" : "dev";
 function endpoint3() {
   const base = (process.env.FIDACY_ENGINE_URL ?? "https://api.fidacy.com").replace(/\/$/, "");
   return `${base}/v1/register`;
@@ -6361,15 +6362,27 @@ entry.register = (api) => {
     Date.now,
     anchor
   );
-  void (async () => {
-    if (!creds()) return;
-    for (const p of takePending()) {
-      if (!await anchor(p.head, p.sessionId, p.byCategory ?? {})) {
-        queuePending(p.head, p.sessionId, p.at, p.total ?? 0, p.byCategory ?? {});
-      }
-    }
-  })().catch(() => {
-  });
+  let drained = false;
+  if (typeof api?.on !== "function") return;
+  api.on(
+    "before_tool_call",
+    () => {
+      if (drained) return;
+      drained = true;
+      void (async () => {
+        if (!creds()) return;
+        for (const p of takePending()) {
+          if (!await anchor(p.head, p.sessionId, p.byCategory ?? {})) {
+            queuePending(p.head, p.sessionId, p.at, p.total ?? 0, p.byCategory ?? {});
+          }
+        }
+      })().catch(() => {
+      });
+    },
+    // Below the observer, which is itself the lowest: catch-up must never sit in
+    // front of anything that decides, and must never be what a tool call waits on.
+    { priority: 0 }
+  );
 };
 var index_default = entry;
 export {

package/openclaw.plugin.json

@@ -3,7 +3,7 @@
   "name": "Fidacy AI Agent Firewall",
   "description": "A signed, independently-verifiable verdict on every money-moving agent action. Blocks wrong/lookalike payee, over-cap, and duplicate-invoice fraud before money moves. Non-custodial, local-first, deny-by-default.",
   "icon": "https://fidacy.com/logo.png",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "contracts": {
     "tools": [
       "request_payment",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fidacy/openclaw-plugin",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "Fidacy payment firewall as a native OpenClaw plugin: signed, verifiable verdicts on every money-moving agent action, in-process (no MCP subprocess).",
   "license": "Apache-2.0",
   "author": "Fidacy (ZeepCode Group Technology LLC) <hello@fidacy.com> (https://fidacy.com)",
@@ -56,8 +56,8 @@
     "openclaw": "2026.6.11",
     "typebox": "1.1.39",
     "typescript": "^5.6.3",
-    "@fidacy/mcp": "0.6.4",
-    "@fidacy/firewall": "0.1.1"
+    "@fidacy/firewall": "0.1.1",
+    "@fidacy/mcp": "0.6.4"
   },
   "scripts": {
     "build": "node scripts/bundle.mjs",