@fidacy/openclaw-plugin 0.7.0 → 0.9.0

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## 0.9.0
+
+### Minor Changes
+
+- Fidacy can now ask the 452 people who already installed it whether to turn on full protection, without them ever opening a terminal.
+
+  The problem was that **2 of 407** MCP installs had ever run `install-hooks`. Without that hook an MCP server only sees calls to its own tools, so deleting a file, reading a secret or reaching a CRM goes nowhere near us. For 99% of the base the product is a payment gate that almost never fires, and there was no way to ask those people anything: they do not open terminals, do not read changelogs, and the guided setup only helps whoever installs next.
+
+  Two things solve it together. The installed base is **not** stuck in the past — hosts launch the server as `npx -y @fidacy/mcp` with no version pin, so every agent restart already pulls the newest build. And the protocol has elicitation: during a tool call, a server may ask the user for input _through the host_, and they answer in a dialog inside the tool they already use.
+
+  So on the next payment decision, the operator is asked once, in their own UI, and one click wires it in — existing hooks merged around, backup kept, every path printed.
+
+  It asks only while processing a call, only if the client declares the capability, only once per install ever, and it never blocks or delays a decision. Where elicitation is not supported it degrades to a line in the tool result, which is still better than the silence it replaces.
+
+## 0.8.0
+
+### Minor Changes
+
+- `protect` now offers to turn the firewall on, because without that step none of it is enforced.
+
+  The measurement is the whole argument: **2 of 407** MCP installs had ever run `install-hooks`. The command exists, it is careful, and nobody finds it. An MCP server only ever sees calls to its own tools — deleting a file, reading a secret or reaching your CRM goes through the agent's host, not through us. So every answer someone gives about what their agent may do was being written to a firewall that was not in the path.
+
+  Asking at the end of `protect` is the difference, because it is the one moment there is a human at the terminal thinking about exactly this.
+
+  It asks; it never installs on its own. That file is someone's editor config, and writing to it without consent is both what put us in a security review on ClawHub and, more to the point, the exact thing this product exists to stop an agent from doing. Existing hooks are merged around, a backup is kept, and every path touched is printed. Say no and your answers are still saved, with the command to enforce them later.
+
 ## 0.7.0
 
 ### Minor Changes

package/dist/index.js

@@ -5178,7 +5178,7 @@ function sessionIdOf(ctx) {
 import { statSync } from "node:fs";
 
 // ../mcp/src/telemetry.ts
-var CLIENT_VERSION = true ? "0.7.0" : "dev";
+var CLIENT_VERSION = true ? "0.8.0" : "dev";
 function bandOf(amount) {
   if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) return void 0;
   if (amount < 10) return "lt10";
@@ -5393,7 +5393,7 @@ function requestUpgrade() {
 }
 
 // ../mcp/src/provision.ts
-var CLIENT_VERSION2 = true ? "0.7.0" : "dev";
+var CLIENT_VERSION2 = true ? "0.8.0" : "dev";
 function provisionEnabled() {
   const v = (process.env.FIDACY_DISABLE_PROVISION ?? "").trim().toLowerCase();
   return !(v === "1" || v === "true" || v === "yes");
@@ -5536,7 +5536,7 @@ function trialCountdownLine(keyOverride) {
 }
 
 // ../mcp/src/register.ts
-var CLIENT_VERSION3 = true ? "0.7.0" : "dev";
+var CLIENT_VERSION3 = true ? "0.8.0" : "dev";
 function endpoint3() {
   const base = (process.env.FIDACY_ENGINE_URL ?? "https://api.fidacy.com").replace(/\/$/, "");
   return `${base}/v1/register`;

package/openclaw.plugin.json

@@ -3,7 +3,7 @@
   "name": "Fidacy AI Agent Firewall",
   "description": "Firewall for AI agents. Watches every action the agent takes and ends each session in a digest anyone can recompute; commands, paths and arguments never leave your machine, only counts and a hash. Blocks wrong/lookalike payee, over-cap and duplicate-invoice fraud before money moves. Non-custodial, local-first, deny-by-default. Anonymous telemetry (counts only) can be disabled with FIDACY_DISABLE_TELEMETRY=1.",
   "icon": "https://fidacy.com/logo.png",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "contracts": {
     "tools": [
       "request_payment",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fidacy/openclaw-plugin",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "Fidacy payment firewall as a native OpenClaw plugin: signed, verifiable verdicts on every money-moving agent action, in-process (no MCP subprocess).",
   "license": "Apache-2.0",
   "author": "Fidacy (ZeepCode Group Technology LLC) <hello@fidacy.com> (https://fidacy.com)",
@@ -57,7 +57,7 @@
     "typebox": "1.1.39",
     "typescript": "^5.6.3",
     "@fidacy/firewall": "0.1.1",
-    "@fidacy/mcp": "0.9.0"
+    "@fidacy/mcp": "0.11.0"
   },
   "scripts": {
     "build": "node scripts/bundle.mjs",