@fidacy/openclaw-plugin 0.5.8 → 0.5.10

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 0.5.10
+
+### Patch Changes
+
+- 1d9d11d: Corrects a false privacy claim that 0.5.9 introduced, and closes the endpoint list properly.
+
+  0.5.9 stated that this plugin never writes the session log to disk. That is wrong. At the end of every session it writes `~/.fidacy/sessions/<session-id>.json` (file 0600, directory 0700) holding the full action record: the command, file path and arguments of every tool call it observed, plus the hash chain over them. The path is even printed on the `[fidacy] log` line in your terminal. The claim came from reading the plugin's own source imports, which do not reference the writer, instead of the shipped bundle, where the observer that calls it is inlined. On a plugin that watches everything an agent does, that is the single most important fact to state correctly, so it is now the first thing in the disclosure and the first item in the file list.
+
+  Also corrected: the network list was described as complete while covering only the default local mode. Setting `FIDACY_MODE=http` moves the decision itself to a hosted core and adds `/v1/decide`, `/v1/mandate/get`, `/v1/audit/proof` and `/v1/audit/list`, which carry the payment request. That path is now disclosed and marked as the one thing that is genuinely on the decision path.
+
+  Documentation only, no behaviour change. Every claim in this version was verified against `dist/index.js`, the artifact that actually ships, rather than against the source tree or the previous README.
+
+## 0.5.9
+
+### Patch Changes
+
+- 5090ab4: Closes the two gaps the 0.5.8 scan named: "material disclosure gaps around session logs and outbound anchoring".
+
+  - **Session logs.** 0.5.8 deleted a wrong claim (a `~/.fidacy/sessions/` directory this plugin never creates) without replacing it, which left the loudest question unanswered: the plugin sees the command, path and arguments of every tool call, so where does that go? It is held in memory for the life of the process and never written to disk. What survives is the digest plus per-category counts. The readable session log belongs to the separate MCP-plus-hooks install, which is now named so the difference is explicit.
+  - **Outbound anchoring.** The endpoint was listed but not its trigger, and the trigger is the non-obvious part: when an engine key is set, queued session digests are drained on the first tool call of a LATER session, not at the end of the session that produced them, and nothing asks first. Now stated, along with how to stop it.
+  - A fourth local file, the `pending-anchors.taking` lock, was still undisclosed. The list now names all four.
+
+  Documentation only. Every claim checked against the code: the plugin imports `queuePending`, `sessionLabel`, `sessionSummary` and `takePending` from the shared evidence module, and never `writeSessionLog`.
+
 ## 0.5.8
 
 ### Patch Changes

package/README.md

@@ -12,38 +12,63 @@ Read this before installing. Since 0.5.0 the plugin is not payment-only: it
 hooks every agent tool call to build a session report, and each session ends in
 a hash digest anyone can recompute.
 
-Stays on your machine, always:
-
-- the command, file path and arguments of every tool call
-- your mandate and config (`~/.fidacy/`), which is yours to delete
+**The session log IS written to disk, and it holds the detail.** At the end of
+each session the plugin writes `~/.fidacy/sessions/<session-id>.json` (file mode
+0600, directory 0700) containing the full action record: the command, file path
+and arguments of every tool call it observed, plus the hash chain over them. The
+path is printed in your terminal at session end, on the `[fidacy] log` line, so
+you can open it and read exactly what was kept. It stays on your machine and it
+is yours to delete. Read this paragraph as the important one: this plugin
+observes everything the agent does, and that observation lands on your disk.
+
+What leaves is only the hash digest of that record plus per-category counts (for
+example `shell: 9, file: 4`). The commands, paths and arguments themselves are
+never transmitted.
 
 Written to disk, and this is the complete list:
 
-- `~/.fidacy/config.json` (mode 0600): the anonymous install id, tier, and your
+- `~/.fidacy/sessions/<session-id>.json` (0600, directory 0700): the full action
+  record described above
+- `~/.fidacy/config.json` (0600): the anonymous install id, tier, and your
   mandate rules
 - `~/.fidacy/audit/audit.log`: the hash-chained decision log
-- `~/.fidacy/pending-anchors.jsonl`: session digests waiting to be anchored,
-  written only while an anchor is queued and cleared once it lands
+- `~/.fidacy/pending-anchors.jsonl`: one line per finished session holding its
+  digest, id, timestamp and per-category counts, with no command, path or
+  argument. Lines are removed once anchored.
+- `~/.fidacy/pending-anchors.taking`: a lock file, present only while that queue
+  is being drained
+
+`rm -rf ~/.fidacy` clears all five.
 
-Leaves your machine, and this is the complete list of hosts and paths. Every one
-goes to your configured engine (`https://api.fidacy.com` by default) and nowhere
-else:
+Leaves your machine. Every one goes to your configured engine
+(`https://api.fidacy.com` by default) and nowhere else. In the default local mode
+these five are the complete list:
 
 - `/v1/telemetry`: anonymous usage events (install, session, decision counts; a
   random UUID, never a name or hostname). Off with `FIDACY_DISABLE_TELEMETRY=1`.
 - `/v1/provision`: a background free-key request. Off with
   `FIDACY_DISABLE_PROVISION=1`.
-- `/v1/artifacts`: per-category counts (for example `shell: 9, file: 4`) and the
-  session digest, plus any hash you anchor with `anchor_artifact`. Hashes and
-  counts only; no file content and no command text.
+- `/v1/artifacts`: per-category counts and the session digest, plus any hash you
+  anchor with `anchor_artifact`. Hashes and counts only; no file content and no
+  command text. **This one is automatic, so be clear on when it fires:** if an
+  engine key is set, the queued digests are drained on the first tool call of a
+  LATER session, not at the end of the session that produced them. Nobody
+  confirms it. With no engine key nothing is ever sent and the queue simply
+  sits on your disk; delete `~/.fidacy/pending-anchors.jsonl` to discard it.
 - `/v1/assess`: only when you call `assess_action` yourself, and only if you set
   an engine API key. Sends the action you passed to the tool.
 - `/v1/register`: only if you set `operatorEmail`, which is opt-in and removable.
   Sends that email and nothing else.
 
-With `FIDACY_DISABLE_TELEMETRY=1`, `FIDACY_DISABLE_PROVISION=1`, no engine key
-and no `operatorEmail`, the plugin makes no network calls at all and gates
-payments entirely offline.
+There is a sixth path, and it is opt-in: setting `FIDACY_MODE=http` moves the
+decision itself to a hosted core, which adds `/v1/decide`, `/v1/mandate/get`,
+`/v1/audit/proof` and `/v1/audit/list`. Those carry the payment request, so leave
+`FIDACY_MODE` unset if you want decisions to stay on your machine. The default is
+local.
+
+With `FIDACY_DISABLE_TELEMETRY=1`, `FIDACY_DISABLE_PROVISION=1`, no engine key,
+no `operatorEmail` and `FIDACY_MODE` unset, the plugin makes no network calls at
+all and gates payments entirely offline.
 
 ## The tools
 
@@ -122,16 +147,21 @@ Verify any verdict yourself: https://api.fidacy.com/.well-known/jwks.json
 
 This is a payment-control plugin, so audit it like one. What it actually does:
 
-- **Network calls it makes:** the five endpoints listed under "what leaves your
-  machine" above, all on your configured engine and nowhere else. That list is
-  stated once, at the top, on purpose: this section used to carry a second,
-  shorter copy naming only two of them, and a privacy disclosure that
-  contradicts itself is worse than a long one. None of the five is ever on the
-  decision path; payment gating works fully offline.
-- **Local state:** the three files listed above, and nothing else. This bullet
-  used to name two of them and end with "Nothing else", which was not true:
-  `pending-anchors.jsonl` was never disclosed. Delete `~/.fidacy` to clear all
-  of it.
+- **Network calls it makes:** the five default endpoints listed under "what
+  leaves your machine" above, plus the four that only exist if you opt into
+  `FIDACY_MODE=http`. The list is stated once, at the top, on purpose: this
+  section used to carry a second, shorter copy naming only two of them, and a
+  privacy disclosure that contradicts itself is worse than a long one. None of
+  the default five is on the decision path, so payment gating works fully
+  offline. The `FIDACY_MODE=http` four ARE the decision path, which is the whole
+  reason that switch is opt-in and called out separately.
+- **Local state:** the five files listed above, and nothing else. Earlier
+  versions of this bullet were wrong twice over: it named two files and ended
+  with "Nothing else" while `pending-anchors.jsonl` went undisclosed, and a
+  later attempt to fix that claimed the session log was never written to disk at
+  all. It is written, it holds the command, path and arguments of every observed
+  tool call, and it is the first item on the list above. `rm -rf ~/.fidacy`
+  clears everything.
 - **`FIDACY_SIGNING_KEY_B64`:** an OPTIONAL env var the operator sets to pin a
   stable local Ed25519 signing key for grants. If unset, a per-session key is
   generated. The plugin reads it; it never writes or transmits it.

package/dist/index.js

@@ -5102,7 +5102,7 @@ var FileAuditStore = class {
 import { statSync } from "node:fs";
 
 // ../mcp/src/telemetry.ts
-var CLIENT_VERSION = true ? "0.5.8" : "dev";
+var CLIENT_VERSION = true ? "0.5.10" : "dev";
 function bandOf(amount) {
   if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) return void 0;
   if (amount < 10) return "lt10";
@@ -5317,7 +5317,7 @@ function requestUpgrade() {
 }
 
 // ../mcp/src/provision.ts
-var CLIENT_VERSION2 = true ? "0.5.8" : "dev";
+var CLIENT_VERSION2 = true ? "0.5.10" : "dev";
 function provisionEnabled() {
   const v = (process.env.FIDACY_DISABLE_PROVISION ?? "").trim().toLowerCase();
   return !(v === "1" || v === "true" || v === "yes");
@@ -5460,7 +5460,7 @@ function trialCountdownLine(keyOverride) {
 }
 
 // ../mcp/src/register.ts
-var CLIENT_VERSION3 = true ? "0.5.8" : "dev";
+var CLIENT_VERSION3 = true ? "0.5.10" : "dev";
 function endpoint3() {
   const base = (process.env.FIDACY_ENGINE_URL ?? "https://api.fidacy.com").replace(/\/$/, "");
   return `${base}/v1/register`;

package/openclaw.plugin.json

@@ -3,7 +3,7 @@
   "name": "Fidacy AI Agent Firewall",
   "description": "Firewall for AI agents. Watches every action the agent takes and ends each session in a digest anyone can recompute; commands, paths and arguments never leave your machine, only counts and a hash. Blocks wrong/lookalike payee, over-cap and duplicate-invoice fraud before money moves. Non-custodial, local-first, deny-by-default. Anonymous telemetry (counts only) can be disabled with FIDACY_DISABLE_TELEMETRY=1.",
   "icon": "https://fidacy.com/logo.png",
-  "version": "0.5.8",
+  "version": "0.5.10",
   "contracts": {
     "tools": [
       "request_payment",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fidacy/openclaw-plugin",
-  "version": "0.5.8",
+  "version": "0.5.10",
   "description": "Fidacy payment firewall as a native OpenClaw plugin: signed, verifiable verdicts on every money-moving agent action, in-process (no MCP subprocess).",
   "license": "Apache-2.0",
   "author": "Fidacy (ZeepCode Group Technology LLC) <hello@fidacy.com> (https://fidacy.com)",