@fidacy/openclaw-plugin 0.5.9 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## 0.6.0
+
+### Minor Changes
+
+- The firewall stops governing only the verb and starts governing the destination, which is the axis an agent cannot rename.
+
+  **Why this exists.** Verified against the published binary: with all eight action classes blocked, `mcp__pipedrive__deals_export`, `mcp__pipedrive__update_person`, `curl api.pipedrive.com` and a WebFetch to the same host all went through. A verb list is infinite and always behind; an agent that wants to export your CRM only has to call the tool something else. But no action can avoid having a destination: every access has a host, an MCP server or a path. The destination is a short list you write once, and a destination you never declared no longer passes in silence. Same polarity the payment firewall always had: never "block the bad payees", always "only these".
+
+  **What you can now say.** "My agent reads Pipedrive, but never exports or modifies anything, and never touches a system I did not declare." Three lines of config, enforced offline, and both the allow and the refusal are signed.
+
+  **`ask`, the mode that keeps the firewall from being bureaucracy.** Without it there are only two extremes, and a tool that only blocks gets switched off so the agent can work. An unusual action now neither passes nor stalls the agent: it is refused immediately with a message that says it is a pending question, not a verdict, and approving it lets the retry through.
+
+  **Three bugs found and fixed while building this**, each caught by a test before it reached anyone:
+
+  - The normalisation written to prevent evasion was creating it: collapsing separators everywhere turned `rm -rf` into `rm .rf` and destroyed the flag.
+  - `classifyAction` only lowercased, so `mcp__gmail__email_send` never matched the `email.send` pattern because of one separator, and `verb_with_underscore` is how every MCP server names a tool. A class in `ask` was letting through the exact action it governs.
+  - Normalising the patterns trimmed `'rm '` into `'rm'`, which then matched `crm`, `form` and `confirm`. `hubspot.crm.export` was being classified as deleting files, and a false positive that blocks innocent work is the fastest route to being uninstalled.
+
+  **The first-run config now writes itself out in full.** It only ever contained the `mandate` block, so nobody discovered that `systems` and `actionClasses` exist: the whole destination axis was built and invisible. `systems` starts empty and `actionClasses` start in `log`, so nothing changes for an existing agent until you tighten it.
+
+## 0.5.10
+
+### Patch Changes
+
+- 1d9d11d: Corrects a false privacy claim that 0.5.9 introduced, and closes the endpoint list properly.
+
+  0.5.9 stated that this plugin never writes the session log to disk. That is wrong. At the end of every session it writes `~/.fidacy/sessions/<session-id>.json` (file 0600, directory 0700) holding the full action record: the command, file path and arguments of every tool call it observed, plus the hash chain over them. The path is even printed on the `[fidacy] log` line in your terminal. The claim came from reading the plugin's own source imports, which do not reference the writer, instead of the shipped bundle, where the observer that calls it is inlined. On a plugin that watches everything an agent does, that is the single most important fact to state correctly, so it is now the first thing in the disclosure and the first item in the file list.
+
+  Also corrected: the network list was described as complete while covering only the default local mode. Setting `FIDACY_MODE=http` moves the decision itself to a hosted core and adds `/v1/decide`, `/v1/mandate/get`, `/v1/audit/proof` and `/v1/audit/list`, which carry the payment request. That path is now disclosed and marked as the one thing that is genuinely on the decision path.
+
+  Documentation only, no behaviour change. Every claim in this version was verified against `dist/index.js`, the artifact that actually ships, rather than against the source tree or the previous README.
+
 ## 0.5.9
 
 ### Patch Changes

package/README.md

@@ -12,29 +12,37 @@ Read this before installing. Since 0.5.0 the plugin is not payment-only: it
 hooks every agent tool call to build a session report, and each session ends in
 a hash digest anyone can recompute.
 
-**The session log is never written to disk by this plugin.** The plugin sees the
-command, file path and arguments of every tool call, and keeps that record in
-memory for the life of the process only. It is not persisted, not on shutdown,
-not anywhere. What survives a session is the hash digest of that record plus
-per-category counts (for example `shell: 9, file: 4`), and nothing else from it.
-If you want the readable session log on disk, that is the separate MCP-plus-hooks
-install (`npx @fidacy/mcp install-hooks`), which writes `~/.fidacy/sessions/`.
-This plugin does not: it never calls the function that writes them.
+**The session log IS written to disk, and it holds the detail.** At the end of
+each session the plugin writes `~/.fidacy/sessions/<session-id>.json` (file mode
+0600, directory 0700) containing the full action record: the command, file path
+and arguments of every tool call it observed, plus the hash chain over them. The
+path is printed in your terminal at session end, on the `[fidacy] log` line, so
+you can open it and read exactly what was kept. It stays on your machine and it
+is yours to delete. Read this paragraph as the important one: this plugin
+observes everything the agent does, and that observation lands on your disk.
+
+What leaves is only the hash digest of that record plus per-category counts (for
+example `shell: 9, file: 4`). The commands, paths and arguments themselves are
+never transmitted.
 
 Written to disk, and this is the complete list:
 
-- `~/.fidacy/config.json` (mode 0600): the anonymous install id, tier, and your
+- `~/.fidacy/sessions/<session-id>.json` (0600, directory 0700): the full action
+  record described above
+- `~/.fidacy/config.json` (0600): the anonymous install id, tier, and your
   mandate rules
 - `~/.fidacy/audit/audit.log`: the hash-chained decision log
-- `~/.fidacy/pending-anchors.jsonl` (directory mode 0700): one line per finished
-  session holding its digest, id, timestamp and per-category counts. No command,
-  path or argument. Lines are removed once anchored.
+- `~/.fidacy/pending-anchors.jsonl`: one line per finished session holding its
+  digest, id, timestamp and per-category counts, with no command, path or
+  argument. Lines are removed once anchored.
 - `~/.fidacy/pending-anchors.taking`: a lock file, present only while that queue
   is being drained
 
-Leaves your machine, and this is the complete list of hosts and paths. Every one
-goes to your configured engine (`https://api.fidacy.com` by default) and nowhere
-else:
+`rm -rf ~/.fidacy` clears all five.
+
+Leaves your machine. Every one goes to your configured engine
+(`https://api.fidacy.com` by default) and nowhere else. In the default local mode
+these five are the complete list:
 
 - `/v1/telemetry`: anonymous usage events (install, session, decision counts; a
   random UUID, never a name or hostname). Off with `FIDACY_DISABLE_TELEMETRY=1`.
@@ -52,9 +60,15 @@ else:
 - `/v1/register`: only if you set `operatorEmail`, which is opt-in and removable.
   Sends that email and nothing else.
 
-With `FIDACY_DISABLE_TELEMETRY=1`, `FIDACY_DISABLE_PROVISION=1`, no engine key
-and no `operatorEmail`, the plugin makes no network calls at all and gates
-payments entirely offline.
+There is a sixth path, and it is opt-in: setting `FIDACY_MODE=http` moves the
+decision itself to a hosted core, which adds `/v1/decide`, `/v1/mandate/get`,
+`/v1/audit/proof` and `/v1/audit/list`. Those carry the payment request, so leave
+`FIDACY_MODE` unset if you want decisions to stay on your machine. The default is
+local.
+
+With `FIDACY_DISABLE_TELEMETRY=1`, `FIDACY_DISABLE_PROVISION=1`, no engine key,
+no `operatorEmail` and `FIDACY_MODE` unset, the plugin makes no network calls at
+all and gates payments entirely offline.
 
 ## The tools
 
@@ -133,16 +147,21 @@ Verify any verdict yourself: https://api.fidacy.com/.well-known/jwks.json
 
 This is a payment-control plugin, so audit it like one. What it actually does:
 
-- **Network calls it makes:** the five endpoints listed under "what leaves your
-  machine" above, all on your configured engine and nowhere else. That list is
-  stated once, at the top, on purpose: this section used to carry a second,
-  shorter copy naming only two of them, and a privacy disclosure that
-  contradicts itself is worse than a long one. None of the five is ever on the
-  decision path; payment gating works fully offline.
-- **Local state:** the four files listed above, and nothing else. This bullet
-  used to name two of them and end with "Nothing else", which was not true:
-  `pending-anchors.jsonl` was never disclosed. Delete `~/.fidacy` to clear all
-  of it.
+- **Network calls it makes:** the five default endpoints listed under "what
+  leaves your machine" above, plus the four that only exist if you opt into
+  `FIDACY_MODE=http`. The list is stated once, at the top, on purpose: this
+  section used to carry a second, shorter copy naming only two of them, and a
+  privacy disclosure that contradicts itself is worse than a long one. None of
+  the default five is on the decision path, so payment gating works fully
+  offline. The `FIDACY_MODE=http` four ARE the decision path, which is the whole
+  reason that switch is opt-in and called out separately.
+- **Local state:** the five files listed above, and nothing else. Earlier
+  versions of this bullet were wrong twice over: it named two files and ended
+  with "Nothing else" while `pending-anchors.jsonl` went undisclosed, and a
+  later attempt to fix that claimed the session log was never written to disk at
+  all. It is written, it holds the command, path and arguments of every observed
+  tool call, and it is the first item on the list above. `rm -rf ~/.fidacy`
+  clears everything.
 - **`FIDACY_SIGNING_KEY_B64`:** an OPTIONAL env var the operator sets to pin a
   stable local Ed25519 signing key for grants. If unset, a per-session key is
   generated. The plugin reads it; it never writes or transmits it.