@fidacy/openclaw-plugin 0.5.9 → 0.5.10

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.5.10
+
+### Patch Changes
+
+- 1d9d11d: Corrects a false privacy claim that 0.5.9 introduced, and closes the endpoint list properly.
+
+  0.5.9 stated that this plugin never writes the session log to disk. That is wrong. At the end of every session it writes `~/.fidacy/sessions/<session-id>.json` (file 0600, directory 0700) holding the full action record: the command, file path and arguments of every tool call it observed, plus the hash chain over them. The path is even printed on the `[fidacy] log` line in your terminal. The claim came from reading the plugin's own source imports, which do not reference the writer, instead of the shipped bundle, where the observer that calls it is inlined. On a plugin that watches everything an agent does, that is the single most important fact to state correctly, so it is now the first thing in the disclosure and the first item in the file list.
+
+  Also corrected: the network list was described as complete while covering only the default local mode. Setting `FIDACY_MODE=http` moves the decision itself to a hosted core and adds `/v1/decide`, `/v1/mandate/get`, `/v1/audit/proof` and `/v1/audit/list`, which carry the payment request. That path is now disclosed and marked as the one thing that is genuinely on the decision path.
+
+  Documentation only, no behaviour change. Every claim in this version was verified against `dist/index.js`, the artifact that actually ships, rather than against the source tree or the previous README.
+
 ## 0.5.9
 
 ### Patch Changes

package/README.md

@@ -12,29 +12,37 @@ Read this before installing. Since 0.5.0 the plugin is not payment-only: it
 hooks every agent tool call to build a session report, and each session ends in
 a hash digest anyone can recompute.
 
-**The session log is never written to disk by this plugin.** The plugin sees the
-command, file path and arguments of every tool call, and keeps that record in
-memory for the life of the process only. It is not persisted, not on shutdown,
-not anywhere. What survives a session is the hash digest of that record plus
-per-category counts (for example `shell: 9, file: 4`), and nothing else from it.
-If you want the readable session log on disk, that is the separate MCP-plus-hooks
-install (`npx @fidacy/mcp install-hooks`), which writes `~/.fidacy/sessions/`.
-This plugin does not: it never calls the function that writes them.
+**The session log IS written to disk, and it holds the detail.** At the end of
+each session the plugin writes `~/.fidacy/sessions/<session-id>.json` (file mode
+0600, directory 0700) containing the full action record: the command, file path
+and arguments of every tool call it observed, plus the hash chain over them. The
+path is printed in your terminal at session end, on the `[fidacy] log` line, so
+you can open it and read exactly what was kept. It stays on your machine and it
+is yours to delete. Read this paragraph as the important one: this plugin
+observes everything the agent does, and that observation lands on your disk.
+
+What leaves is only the hash digest of that record plus per-category counts (for
+example `shell: 9, file: 4`). The commands, paths and arguments themselves are
+never transmitted.
 
 Written to disk, and this is the complete list:
 
-- `~/.fidacy/config.json` (mode 0600): the anonymous install id, tier, and your
+- `~/.fidacy/sessions/<session-id>.json` (0600, directory 0700): the full action
+  record described above
+- `~/.fidacy/config.json` (0600): the anonymous install id, tier, and your
   mandate rules
 - `~/.fidacy/audit/audit.log`: the hash-chained decision log
-- `~/.fidacy/pending-anchors.jsonl` (directory mode 0700): one line per finished
-  session holding its digest, id, timestamp and per-category counts. No command,
-  path or argument. Lines are removed once anchored.
+- `~/.fidacy/pending-anchors.jsonl`: one line per finished session holding its
+  digest, id, timestamp and per-category counts, with no command, path or
+  argument. Lines are removed once anchored.
 - `~/.fidacy/pending-anchors.taking`: a lock file, present only while that queue
   is being drained
 
-Leaves your machine, and this is the complete list of hosts and paths. Every one
-goes to your configured engine (`https://api.fidacy.com` by default) and nowhere
-else:
+`rm -rf ~/.fidacy` clears all five.
+
+Leaves your machine. Every one goes to your configured engine
+(`https://api.fidacy.com` by default) and nowhere else. In the default local mode
+these five are the complete list:
 
 - `/v1/telemetry`: anonymous usage events (install, session, decision counts; a
   random UUID, never a name or hostname). Off with `FIDACY_DISABLE_TELEMETRY=1`.
@@ -52,9 +60,15 @@ else:
 - `/v1/register`: only if you set `operatorEmail`, which is opt-in and removable.
   Sends that email and nothing else.
 
-With `FIDACY_DISABLE_TELEMETRY=1`, `FIDACY_DISABLE_PROVISION=1`, no engine key
-and no `operatorEmail`, the plugin makes no network calls at all and gates
-payments entirely offline.
+There is a sixth path, and it is opt-in: setting `FIDACY_MODE=http` moves the
+decision itself to a hosted core, which adds `/v1/decide`, `/v1/mandate/get`,
+`/v1/audit/proof` and `/v1/audit/list`. Those carry the payment request, so leave
+`FIDACY_MODE` unset if you want decisions to stay on your machine. The default is
+local.
+
+With `FIDACY_DISABLE_TELEMETRY=1`, `FIDACY_DISABLE_PROVISION=1`, no engine key,
+no `operatorEmail` and `FIDACY_MODE` unset, the plugin makes no network calls at
+all and gates payments entirely offline.
 
 ## The tools
 
@@ -133,16 +147,21 @@ Verify any verdict yourself: https://api.fidacy.com/.well-known/jwks.json
 
 This is a payment-control plugin, so audit it like one. What it actually does:
 
-- **Network calls it makes:** the five endpoints listed under "what leaves your
-  machine" above, all on your configured engine and nowhere else. That list is
-  stated once, at the top, on purpose: this section used to carry a second,
-  shorter copy naming only two of them, and a privacy disclosure that
-  contradicts itself is worse than a long one. None of the five is ever on the
-  decision path; payment gating works fully offline.
-- **Local state:** the four files listed above, and nothing else. This bullet
-  used to name two of them and end with "Nothing else", which was not true:
-  `pending-anchors.jsonl` was never disclosed. Delete `~/.fidacy` to clear all
-  of it.
+- **Network calls it makes:** the five default endpoints listed under "what
+  leaves your machine" above, plus the four that only exist if you opt into
+  `FIDACY_MODE=http`. The list is stated once, at the top, on purpose: this
+  section used to carry a second, shorter copy naming only two of them, and a
+  privacy disclosure that contradicts itself is worse than a long one. None of
+  the default five is on the decision path, so payment gating works fully
+  offline. The `FIDACY_MODE=http` four ARE the decision path, which is the whole
+  reason that switch is opt-in and called out separately.
+- **Local state:** the five files listed above, and nothing else. Earlier
+  versions of this bullet were wrong twice over: it named two files and ended
+  with "Nothing else" while `pending-anchors.jsonl` went undisclosed, and a
+  later attempt to fix that claimed the session log was never written to disk at
+  all. It is written, it holds the command, path and arguments of every observed
+  tool call, and it is the first item on the list above. `rm -rf ~/.fidacy`
+  clears everything.
 - **`FIDACY_SIGNING_KEY_B64`:** an OPTIONAL env var the operator sets to pin a
   stable local Ed25519 signing key for grants. If unset, a per-session key is
   generated. The plugin reads it; it never writes or transmits it.

package/dist/index.js

@@ -5102,7 +5102,7 @@ var FileAuditStore = class {
 import { statSync } from "node:fs";
 
 // ../mcp/src/telemetry.ts
-var CLIENT_VERSION = true ? "0.5.9" : "dev";
+var CLIENT_VERSION = true ? "0.5.10" : "dev";
 function bandOf(amount) {
   if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) return void 0;
   if (amount < 10) return "lt10";
@@ -5317,7 +5317,7 @@ function requestUpgrade() {
 }
 
 // ../mcp/src/provision.ts
-var CLIENT_VERSION2 = true ? "0.5.9" : "dev";
+var CLIENT_VERSION2 = true ? "0.5.10" : "dev";
 function provisionEnabled() {
   const v = (process.env.FIDACY_DISABLE_PROVISION ?? "").trim().toLowerCase();
   return !(v === "1" || v === "true" || v === "yes");
@@ -5460,7 +5460,7 @@ function trialCountdownLine(keyOverride) {
 }
 
 // ../mcp/src/register.ts
-var CLIENT_VERSION3 = true ? "0.5.9" : "dev";
+var CLIENT_VERSION3 = true ? "0.5.10" : "dev";
 function endpoint3() {
   const base = (process.env.FIDACY_ENGINE_URL ?? "https://api.fidacy.com").replace(/\/$/, "");
   return `${base}/v1/register`;

package/openclaw.plugin.json

@@ -3,7 +3,7 @@
   "name": "Fidacy AI Agent Firewall",
   "description": "Firewall for AI agents. Watches every action the agent takes and ends each session in a digest anyone can recompute; commands, paths and arguments never leave your machine, only counts and a hash. Blocks wrong/lookalike payee, over-cap and duplicate-invoice fraud before money moves. Non-custodial, local-first, deny-by-default. Anonymous telemetry (counts only) can be disabled with FIDACY_DISABLE_TELEMETRY=1.",
   "icon": "https://fidacy.com/logo.png",
-  "version": "0.5.9",
+  "version": "0.5.10",
   "contracts": {
     "tools": [
       "request_payment",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fidacy/openclaw-plugin",
-  "version": "0.5.9",
+  "version": "0.5.10",
   "description": "Fidacy payment firewall as a native OpenClaw plugin: signed, verifiable verdicts on every money-moving agent action, in-process (no MCP subprocess).",
   "license": "Apache-2.0",
   "author": "Fidacy (ZeepCode Group Technology LLC) <hello@fidacy.com> (https://fidacy.com)",