@fidacy/openclaw-plugin 0.5.8 → 0.5.9

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.5.9
+
+### Patch Changes
+
+- 5090ab4: Closes the two gaps the 0.5.8 scan named: "material disclosure gaps around session logs and outbound anchoring".
+
+  - **Session logs.** 0.5.8 deleted a wrong claim (a `~/.fidacy/sessions/` directory this plugin never creates) without replacing it, which left the loudest question unanswered: the plugin sees the command, path and arguments of every tool call, so where does that go? It is held in memory for the life of the process and never written to disk. What survives is the digest plus per-category counts. The readable session log belongs to the separate MCP-plus-hooks install, which is now named so the difference is explicit.
+  - **Outbound anchoring.** The endpoint was listed but not its trigger, and the trigger is the non-obvious part: when an engine key is set, queued session digests are drained on the first tool call of a LATER session, not at the end of the session that produced them, and nothing asks first. Now stated, along with how to stop it.
+  - A fourth local file, the `pending-anchors.taking` lock, was still undisclosed. The list now names all four.
+
+  Documentation only. Every claim checked against the code: the plugin imports `queuePending`, `sessionLabel`, `sessionSummary` and `takePending` from the shared evidence module, and never `writeSessionLog`.
+
 ## 0.5.8
 
 ### Patch Changes

package/README.md

@@ -12,18 +12,25 @@ Read this before installing. Since 0.5.0 the plugin is not payment-only: it
 hooks every agent tool call to build a session report, and each session ends in
 a hash digest anyone can recompute.
 
-Stays on your machine, always:
-
-- the command, file path and arguments of every tool call
-- your mandate and config (`~/.fidacy/`), which is yours to delete
+**The session log is never written to disk by this plugin.** The plugin sees the
+command, file path and arguments of every tool call, and keeps that record in
+memory for the life of the process only. It is not persisted, not on shutdown,
+not anywhere. What survives a session is the hash digest of that record plus
+per-category counts (for example `shell: 9, file: 4`), and nothing else from it.
+If you want the readable session log on disk, that is the separate MCP-plus-hooks
+install (`npx @fidacy/mcp install-hooks`), which writes `~/.fidacy/sessions/`.
+This plugin does not: it never calls the function that writes them.
 
 Written to disk, and this is the complete list:
 
 - `~/.fidacy/config.json` (mode 0600): the anonymous install id, tier, and your
   mandate rules
 - `~/.fidacy/audit/audit.log`: the hash-chained decision log
-- `~/.fidacy/pending-anchors.jsonl`: session digests waiting to be anchored,
-  written only while an anchor is queued and cleared once it lands
+- `~/.fidacy/pending-anchors.jsonl` (directory mode 0700): one line per finished
+  session holding its digest, id, timestamp and per-category counts. No command,
+  path or argument. Lines are removed once anchored.
+- `~/.fidacy/pending-anchors.taking`: a lock file, present only while that queue
+  is being drained
 
 Leaves your machine, and this is the complete list of hosts and paths. Every one
 goes to your configured engine (`https://api.fidacy.com` by default) and nowhere
@@ -33,9 +40,13 @@ else:
   random UUID, never a name or hostname). Off with `FIDACY_DISABLE_TELEMETRY=1`.
 - `/v1/provision`: a background free-key request. Off with
   `FIDACY_DISABLE_PROVISION=1`.
-- `/v1/artifacts`: per-category counts (for example `shell: 9, file: 4`) and the
-  session digest, plus any hash you anchor with `anchor_artifact`. Hashes and
-  counts only; no file content and no command text.
+- `/v1/artifacts`: per-category counts and the session digest, plus any hash you
+  anchor with `anchor_artifact`. Hashes and counts only; no file content and no
+  command text. **This one is automatic, so be clear on when it fires:** if an
+  engine key is set, the queued digests are drained on the first tool call of a
+  LATER session, not at the end of the session that produced them. Nobody
+  confirms it. With no engine key nothing is ever sent and the queue simply
+  sits on your disk; delete `~/.fidacy/pending-anchors.jsonl` to discard it.
 - `/v1/assess`: only when you call `assess_action` yourself, and only if you set
   an engine API key. Sends the action you passed to the tool.
 - `/v1/register`: only if you set `operatorEmail`, which is opt-in and removable.
@@ -128,7 +139,7 @@ This is a payment-control plugin, so audit it like one. What it actually does:
   shorter copy naming only two of them, and a privacy disclosure that
   contradicts itself is worse than a long one. None of the five is ever on the
   decision path; payment gating works fully offline.
-- **Local state:** the three files listed above, and nothing else. This bullet
+- **Local state:** the four files listed above, and nothing else. This bullet
   used to name two of them and end with "Nothing else", which was not true:
   `pending-anchors.jsonl` was never disclosed. Delete `~/.fidacy` to clear all
   of it.

package/dist/index.js

@@ -5102,7 +5102,7 @@ var FileAuditStore = class {
 import { statSync } from "node:fs";
 
 // ../mcp/src/telemetry.ts
-var CLIENT_VERSION = true ? "0.5.8" : "dev";
+var CLIENT_VERSION = true ? "0.5.9" : "dev";
 function bandOf(amount) {
   if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) return void 0;
   if (amount < 10) return "lt10";
@@ -5317,7 +5317,7 @@ function requestUpgrade() {
 }
 
 // ../mcp/src/provision.ts
-var CLIENT_VERSION2 = true ? "0.5.8" : "dev";
+var CLIENT_VERSION2 = true ? "0.5.9" : "dev";
 function provisionEnabled() {
   const v = (process.env.FIDACY_DISABLE_PROVISION ?? "").trim().toLowerCase();
   return !(v === "1" || v === "true" || v === "yes");
@@ -5460,7 +5460,7 @@ function trialCountdownLine(keyOverride) {
 }
 
 // ../mcp/src/register.ts
-var CLIENT_VERSION3 = true ? "0.5.8" : "dev";
+var CLIENT_VERSION3 = true ? "0.5.9" : "dev";
 function endpoint3() {
   const base = (process.env.FIDACY_ENGINE_URL ?? "https://api.fidacy.com").replace(/\/$/, "");
   return `${base}/v1/register`;

package/openclaw.plugin.json

@@ -3,7 +3,7 @@
   "name": "Fidacy AI Agent Firewall",
   "description": "Firewall for AI agents. Watches every action the agent takes and ends each session in a digest anyone can recompute; commands, paths and arguments never leave your machine, only counts and a hash. Blocks wrong/lookalike payee, over-cap and duplicate-invoice fraud before money moves. Non-custodial, local-first, deny-by-default. Anonymous telemetry (counts only) can be disabled with FIDACY_DISABLE_TELEMETRY=1.",
   "icon": "https://fidacy.com/logo.png",
-  "version": "0.5.8",
+  "version": "0.5.9",
   "contracts": {
     "tools": [
       "request_payment",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fidacy/openclaw-plugin",
-  "version": "0.5.8",
+  "version": "0.5.9",
   "description": "Fidacy payment firewall as a native OpenClaw plugin: signed, verifiable verdicts on every money-moving agent action, in-process (no MCP subprocess).",
   "license": "Apache-2.0",
   "author": "Fidacy (ZeepCode Group Technology LLC) <hello@fidacy.com> (https://fidacy.com)",