v1.9.0

Fixed

• A policy answer without a decision now blocks the tool call instead of allowing it. When the AxonFlow agent answers check_policy with a result that carries no boolean allowed, or a result flagged isError, the pre-tool hook now blocks the call with the reason, and the post-tool hook tells the agent not to use output it could not check. Before this, both hooks read such an answer as allowed; on Community SaaS the Free-tier limit answers exactly that way, so tool calls over the limit ran ungoverned with nothing shown.
• Over the Community SaaS Free-tier limit, tool calls are blocked with the upgrade prompt instead of running ungoverned. The upgrade prompt still prints at most once a day, and the back-off still stops network traffic until the limit resets; while it holds, the pre-tool hook blocks and the post-tool hook raises a governance alert. The 401 credential pause is unchanged.
• An unknown JSON-RPC error code from the agent now fails closed. Parse errors (-32700) and internal errors (-32603) still fail open as transient.
• The MCP session now sends its credential with the Basic scheme, so a platform that checks credentials accepts it. Codex sends an MCP header's variable exactly as it is set: it adds no scheme and expands nothing. The plugin mapped Authorization to AXONFLOW_AUTH, which holds the bare base64 the hooks prefix themselves, so on Community SaaS and Enterprise every MCP tool call (explain, overrides, audit search, policies) was refused with 401; plain Community admitted it. .mcp.json and scripts/install-mcp-with-headers.sh now map Authorization to a new variable, set as export AXONFLOW_MCP_AUTHORIZATION="Basic $AXONFLOW_AUTH", and the installer prints that line when AXONFLOW_AUTH is set and the new variable is not. Behaviour change: with only AXONFLOW_AUTH set, the MCP session now sends no Authorization header instead of the bare one. Plain Community admits either; a platform that checks credentials refused the bare header and refuses the absent one until you export the new variable, and a credential without its scheme is never sent. The hooks are unchanged. Re-run the installer after upgrading.