@fidacy/openclaw-plugin 0.5.3 → 0.5.4

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.5.4
+
+### Patch Changes
+
+- Scope disclosure. A ClawHub security audit of 0.5.3 flagged that the plugin "observes all agent tool calls and stores or anchors session metadata beyond the clearly advertised payment scope". Correct: since 0.5.0 the plugin hooks every tool call to build the session report, while the manifest description still promised only signed verdicts on money-moving actions. Anyone installing read a smaller promise than the software keeps.
+
+  The manifest description now leads with the observer and names what stays on the machine (command, file path, arguments) versus what leaves (per-category counts and a hash), plus FIDACY_DISABLE_TELEMETRY. The README opens with that split, before any pitch, and includes the opt-in operatorEmail.
+
+  No behaviour change: same code as 0.5.3, honest labelling.
+
+  On the static-analysis hit for FIDACY_ENGINE_API_KEY plus a network call: that is your own credential going only to the engineUrl you configured, the shape of any API client. The README already carries the command that proves no credential literal ships in the package, and it passes.
+
 ## 0.2.10
 
 ### Patch Changes

package/README.md

@@ -2,26 +2,53 @@
 
 ![Fidacy blocks a BEC lookalike-payee payment, then allows the legit one with a signed Ed25519 grant](https://raw.githubusercontent.com/lucaslubi/fidacy-mcp/main/assets/fidacy-firewall-demo.svg)
 
-Fidacy payment firewall as a **native OpenClaw plugin**. Registers five agent tools
-in-process (no MCP subprocess, no `npx` spawn):
+Fidacy firewall for AI agents as a **native OpenClaw plugin**: the payment
+firewall plus a session observer, registered in-process (no MCP subprocess, no
+`npx` spawn).
 
-- `request_payment` — authorize a payment against the active signed mandate.
+## What this plugin observes, and what leaves your machine
+
+Read this before installing. Since 0.5.0 the plugin is not payment-only: it
+hooks every agent tool call to build a session report, and each session ends in
+a hash digest anyone can recompute.
+
+Stays on your machine, always:
+
+- the command, file path and arguments of every tool call
+- the full session log (`~/.fidacy/sessions/`), which is yours to delete
+- your mandate and config (`~/.fidacy/`)
+
+Leaves your machine:
+
+- per-category counts (for example `shell: 9, file: 4`) and the session digest,
+  anchored via the Fidacy engine when the install is activated
+- anonymous telemetry events (install, session, decision counts; a random UUID,
+  never a name or hostname). Disable with `FIDACY_DISABLE_TELEMETRY=1`.
+- your email, only if you set `operatorEmail`, which is opt-in and removable
+
+## The tools
+
+- `request_payment`: authorize a payment against the active signed mandate.
   ALLOW returns a short-lived Ed25519 grant the executor requires; DENY returns the
   violated rule and no grant.
-- `verify_mandate` — the active mandate envelope + Fidacy's public key.
-- `get_audit_proof` — tamper-evident, hash-chained proof for any decision.
-- `assess_action` — a SIGNED trust verdict from the live Fidacy engine
+- `verify_mandate`: the active mandate envelope + Fidacy's public key.
+- `get_audit_proof`: tamper-evident, hash-chained proof for any decision.
+- `assess_action`: a SIGNED trust verdict from the live Fidacy engine
   (requires an engine API key), verifiable by anyone via `@fidacy/verify`.
-- `fidacy_upgrade` — upgrade the local install to a real Fidacy account.
+- `fidacy_upgrade`: upgrade the local install to a real Fidacy account.
+
+Plus `spend_summary`, `list_decisions`, `sentinel_alerts`, `explain_decision`,
+`anchor_artifact` and `check_artifact`.
 
-Same engine as [`@fidacy/mcp`](https://www.npmjs.com/package/@fidacy/mcp) — one
+Same engine as [`@fidacy/mcp`](https://www.npmjs.com/package/@fidacy/mcp): one
 engine, many shells. Local-first, deny-by-default, non-custodial: Fidacy authorizes,
 it never holds funds.
 
 ## To everyone who installed Fidacy
 
-You are one of ~170 installs that have made 2,100+ real firewall decisions to
-date, over 99% of them blocks. Thank you. Two things worth a minute of your time:
+Excluding our own test traffic, installs like yours have made about 1,600 real
+firewall decisions to date, over 99% of them blocks. Thank you. Two things worth
+a minute of your time:
 
 1. **See and claim what YOUR install blocked.** Your install carries a private,
    anonymous id on your machine (we never learn who you are unless you choose to).
@@ -37,10 +64,10 @@ Lucas de Lima, founder
 
 ## Install (2 minutes)
 
-**Step 1 — get your free API key** at
+**Step 1: get your free API key** at
 [app.fidacy.com/signup](https://app.fidacy.com/signup) (free tier, no card).
 
-**Step 2 — install and set the key:**
+**Step 2: install and set the key.**
 
 ```bash
 openclaw plugins install @fidacy/openclaw-plugin
@@ -132,7 +159,7 @@ with SHA-256 and send only the 64 hex characters.
 ## Prefer MCP instead?
 
 If you'd rather run Fidacy as an MCP server (out-of-process), use
-`openclaw mcp add fidacy --command npx --arg -y --arg @fidacy/mcp` — same tools,
+`openclaw mcp add fidacy --command npx --arg -y --arg @fidacy/mcp` , same tools,
 same engine. This plugin is the native, in-process variant.
 
 ## Build (development)
@@ -143,7 +170,7 @@ pnpm --filter @fidacy/openclaw-plugin typecheck  # tsc against the real openclaw
 ```
 
 `openclaw/plugin-sdk/*` stays external (the host provides it at runtime); everything
-else — the shared `@fidacy/firewall` engine and `@fidacy/mcp` shell wiring — is
+else (the shared `@fidacy/firewall` engine and `@fidacy/mcp` shell wiring) is
 inlined so the published package is self-contained.
 
 Apache-2.0 · https://fidacy.com

package/dist/index.js

@@ -4426,6 +4426,24 @@ function sessionLabel(sessionId, total, byCategory) {
   }
   return parts.join(" ").slice(0, 120);
 }
+function sessionSummary(opts) {
+  const by = {};
+  for (const [cat, n] of Object.entries(opts.byCategory)) if (n > 0) by[cat] = n;
+  const s = {
+    v: 1,
+    // Mesmo saneamento do rótulo: o host vem de código nosso, mas o campo é
+    // limitado na origem para que uma string estranha vire um valor curto e
+    // legível em vez de um 400 que perderia o registro inteiro da sessão.
+    host: opts.host.replace(/[^a-z0-9-]/gi, "").slice(0, 40) || "unknown",
+    session_id: opts.sessionId.replace(/[^A-Za-z0-9-]/g, "").slice(0, 64) || "unknown",
+    total: opts.total
+  };
+  if (Object.keys(by).length) s.by_category = by;
+  if (opts.truncated) s.truncated = true;
+  if (opts.startedAt) s.started_at = opts.startedAt;
+  if (opts.endedAt) s.ended_at = opts.endedAt;
+  return s;
+}
 
 // ../mcp/src/observer.ts
 var EXACT = {
@@ -5067,7 +5085,7 @@ var FileAuditStore = class {
 import { statSync } from "node:fs";
 
 // ../mcp/src/telemetry.ts
-var CLIENT_VERSION = true ? "0.5.3" : "dev";
+var CLIENT_VERSION = true ? "0.5.4" : "dev";
 function bandOf(amount) {
   if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) return void 0;
   if (amount < 10) return "lt10";
@@ -5255,7 +5273,7 @@ function requestUpgrade() {
 }
 
 // ../mcp/src/provision.ts
-var CLIENT_VERSION2 = true ? "0.5.3" : "dev";
+var CLIENT_VERSION2 = true ? "0.5.4" : "dev";
 function provisionEnabled() {
   const v = (process.env.FIDACY_DISABLE_PROVISION ?? "").trim().toLowerCase();
   return !(v === "1" || v === "true" || v === "yes");
@@ -5397,7 +5415,7 @@ function trialCountdownLine(keyOverride) {
 }
 
 // ../mcp/src/register.ts
-var CLIENT_VERSION3 = true ? "0.5.3" : "dev";
+var CLIENT_VERSION3 = true ? "0.5.4" : "dev";
 function endpoint3() {
   const base = (process.env.FIDACY_ENGINE_URL ?? "https://api.fidacy.com").replace(/\/$/, "");
   return `${base}/v1/register`;
@@ -6340,6 +6358,10 @@ entry.register = (api) => {
           sha256: head,
           kind: "custom",
           label: sessionLabel(sessionId, total, byCategory),
+          // O contrato estruturado que o console lê. `host` é o campo que o
+          // rótulo nunca teve, e sem ele este plugin e o hook de Claude Code
+          // escreviam linhas indistinguíveis.
+          summary: sessionSummary({ host: "openclaw", sessionId, total, byCategory }),
           // Which install produced the session, so a fleet view can group by
           // machine. The anon id is a random UUID minted on this machine and
           // tied to no person, which is the point: the cockpit answers "which

package/openclaw.plugin.json

@@ -1,9 +1,9 @@
 {
   "id": "fidacy",
   "name": "Fidacy AI Agent Firewall",
-  "description": "A signed, independently-verifiable verdict on every money-moving agent action. Blocks wrong/lookalike payee, over-cap, and duplicate-invoice fraud before money moves. Non-custodial, local-first, deny-by-default.",
+  "description": "Firewall for AI agents. Watches every action the agent takes and ends each session in a digest anyone can recompute; commands, paths and arguments never leave your machine, only counts and a hash. Blocks wrong/lookalike payee, over-cap and duplicate-invoice fraud before money moves. Non-custodial, local-first, deny-by-default. Anonymous telemetry (counts only) can be disabled with FIDACY_DISABLE_TELEMETRY=1.",
   "icon": "https://fidacy.com/logo.png",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "contracts": {
     "tools": [
       "request_payment",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fidacy/openclaw-plugin",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "description": "Fidacy payment firewall as a native OpenClaw plugin: signed, verifiable verdicts on every money-moving agent action, in-process (no MCP subprocess).",
   "license": "Apache-2.0",
   "author": "Fidacy (ZeepCode Group Technology LLC) <hello@fidacy.com> (https://fidacy.com)",
@@ -47,21 +47,21 @@
       "npmSpec": "@fidacy/openclaw-plugin"
     }
   },
+  "scripts": {
+    "build": "node scripts/bundle.mjs",
+    "typecheck": "tsc --noEmit",
+    "test": "npm run build && node --test test/*.test.mjs"
+  },
   "engines": {
     "node": ">=20"
   },
   "devDependencies": {
+    "@fidacy/firewall": "workspace:*",
+    "@fidacy/mcp": "workspace:*",
     "@types/node": "^22.10.0",
     "esbuild": "^0.24.0",
     "openclaw": "2026.6.11",
     "typebox": "1.1.39",
-    "typescript": "^5.6.3",
-    "@fidacy/firewall": "0.1.1",
-    "@fidacy/mcp": "0.7.0"
-  },
-  "scripts": {
-    "build": "node scripts/bundle.mjs",
-    "typecheck": "tsc --noEmit",
-    "test": "npm run build && node --test test/*.test.mjs"
+    "typescript": "^5.6.3"
   }
-}
+}