Order Samurai 2.4.3

Order Samurai 2.4.3. See CHANGELOG.md.

Order Samurai 2.2.1

Order Samurai 2.2.1

A security update. Please install it. It fixes issues found in an Oct 13 security audit of the installer and licensing code. The three installer and file issues below need a file already placed on your machine, or another user account on it, before they can do anything. They're still worth closing.

To upgrade: re-run the installer from the website, or download order-samurai-core.zip below and check it against order-samurai-core.zip.sha256. Then run samurai doctor.

Security fixes

• The piped installer always downloads the release. On macOS's built-in bash, running curl … | bash from a folder that happened to contain bin/samurai ran that local copy instead of downloading and checksum-verifying the release. The installer now uses a local copy only when you run the script file yourself. Homebrew bash wasn't affected.
• Licensing ignores planted code. samurai license and the Pro check could load Python code placed in the folder above your install, in the current folder, or on PYTHONPATH. They now load only Order Samurai's own bundled code.
• The license backup is private from the start. When you uninstall, the license backup is created readable by you alone. Before, other users on the same machine could briefly read it, and a link placed at the backup path could redirect where it was written.
• Lemon Squeezy refunds revoke Pro. A Lemon Squeezy license marked disabled or refunded now switches the machine back to Free at the next re-check, the same as a Gumroad refund. Going offline still never costs you Pro.

Licensing change

• New license keys activate through Gumroad only. The Lemon Squeezy fallback could accept keys Gumroad didn't recognise, so it's retired for new activations. If you already activated through Lemon Squeezy, nothing changes for you.

Documentation

• The privacy policy and onboarding guide now describe the license re-check as it actually works. Pro is re-checked at most once a day during the 21-day refund window, and a network failure never revokes it. After the window closes, the license is only re-checked when you run samurai license --refresh.

Full details are in CHANGELOG.md.

Order Samurai 2.2.0

Order Samurai 2.2.0

Your dashboard history survives rebuilds, several metrics read more accurately, and the code behind the dashboard was reorganised with no change in behaviour. If you're coming from 2.1.1, this release also brings everything from 2.1.2 to 2.1.4, summarised further down.

To upgrade: re-run the installer, or download order-samurai-core.zip below and check it against order-samurai-core.zip.sha256. Then run samurai doctor.

What you'll notice

• History stops getting wiped. Rebuilding the dashboard snapshot used to erase the series it can't recompute (scout counts, run-log and security signals) and leave a single point. They now keep their earlier values, and your newest live reading survives the rebuild. If telemetry can't be read, history is left untouched instead of being rewritten empty. If the write fails or is interrupted (full disk, Ctrl-C), the previous file is restored. To get the old behaviour back, set BACKFILL_CARRY_FORWARD=false.
• Sparklines and trend arrows compare like with like. They now compare the current 30-day value only with earlier 30-day readings, not with one-week totals. Right after a rebuild you may see only two points per metric, and anomaly and trend warnings come back as new readings build up.
• Project scores may shift. A telemetry tag now counts toward one project only, so sessions shared by similarly named projects are no longer counted twice.
• Fewer refresh failures and fake numbers. A transcript deleted mid-scan is skipped instead of failing the whole refresh. A missing or unreadable vibe score shows "no data" instead of a made-up number.
• Idle weeks are no longer failures. Mechanism Liveness reports "idle by design" instead of FAIL when the reflex heartbeat shows the engine was deliberately idle and no run happened. A corrupt or unreadable execution log still fails.
• Cache Hit Rate is stricter. It counts only usage records whose token counts are fully known. The number is expected to stay the same on a standard install; setups that only have raw telemetry now show "no data" instead of a guess.
• Skill Routing Adherence is stricter. It credits a skill only when it was invoked in the same session after the detection, and ignores the hiring-review nudge. Values can change if you have routing logs.
• Daily digest link. The "Review:" link now reads http://localhost:4322/ (same local dashboard as before).

Known limits

• Three new metrics show SIMULATED on a standard install: Stale Branches, Tickets Stuck at the Lane, and Approved, Never Executed. They only work in the AgenticaOS development layout and are never flagged, so you can ignore them. Their fix hints mention /git-hygiene and /captain, which Order Samurai doesn't ship.
• The dashboard card for Mechanism Liveness shows no value and no explanation for the new "idle by design" state yet.

For anyone calling the Python API

• call_routed_llm() (also agentica_core.model_router.call_llm) gained two optional arguments, num_ctx and force_json, placed before project. If your own code passes project positionally, pass it as project= instead. Order Samurai's own code already does.
• New opt-in LLMGateway.generate_strict(): one isolated Claude CLI call with no tools, no MCP and bounded input and output. Nothing in Order Samurai calls it yet.
• agentica_core/aggregate.py is now a facade over six aggregate_* modules. Every name you imported before still imports, and output is byte-identical on the recorded test payloads.

Since 2.1.1 (2.1.2 to 2.1.4, which shipped without notes)

• Protection for more coding agents. samurai install now installs the prompt-injection guard for Codex, Cursor and Gemini CLI as well as Claude Code, and detects which ones you have. It names agents it can't protect yet (Windsurf, Goose, Cline, OpenCode, Aider, Continue) and exits with an error instead of claiming success when it finds no supported agent. Each agent has coverage limits, listed in the CHANGELOG; for Gemini CLI, the guard only runs in folders you've marked as trusted.
• The secret scrubber works on a standard install. In 2.1.1 it depended on a file a standard install doesn't include, so it scrubbed nothing. samurai doctor now runs each hook for real instead of only checking that it's registered.
• Install works on Homebrew Python and other "externally managed" Pythons, using a private environment in ~/.samurai/venv.
• More reliable installs. The web installer retries when the zip and its checksum don't match right after a release. Install no longer registers the hooks twice when a hook registry already runs them, and uninstall no longer reports success when it couldn't remove a hook.
• Quieter, safer guard log. It no longer records tool calls that passed, and it redacts secrets from the entries it keeps.
• Clearer failures. The daily digest prints a warning before falling back to Mail.app. Doctor says why a hook's criticality is unknown.
• Dashboard. Previous and next controls for categorised reflex stacks, and the selected card stays put when other alerts clear.
• One support address: support@agentica-llc.biz, now printed at the end of samurai doctor and the installer.

Full details are in CHANGELOG.md.

Order Samurai 2.1.4

Order Samurai 2.1.4

Newer version available. v2.2.0 includes everything below, plus dashboard history that survives rebuilds and more accurate metrics. Install that one unless you need this exact version.

This release extends the prompt-injection guard beyond Claude Code and makes installs more dependable. If you're coming from 2.1.1, it also includes the 2.1.2 and 2.1.3 fixes listed at the end.

Protection for more coding agents

• samurai install now installs the prompt-injection guard for Codex, Cursor and Gemini CLI as well as Claude Code. It detects which ones you have and prints one result line for each. Choose them yourself with --harness claude,codex,cursor,gemini or SAMURAI_HARNESS.
• Install and doctor now name agents found on your machine that Order Samurai can't protect yet: Windsurf, Goose, Cline, OpenCode, Aider and Continue. That way a machine running Claude Code alongside one of them isn't mistaken for fully covered.
• samurai install exits with an error when it finds no supported agent, instead of reporting success with nothing protected.
• Each new agent has coverage limits, listed in full in the CHANGELOG. In short:
  • Codex: runs the guard only after you approve it in /hooks.
  • Cursor: doesn't cover file reads or Tab completions.
  • Gemini CLI: runs no hooks in folders you haven't marked as trusted.
  • Doctor: checks each one's setup but doesn't claim it's enforced.

More reliable installs

• The web installer retries when the zip and its checksum don't match just after a release, instead of failing.
• On Homebrew and other "externally managed" Pythons, install puts its dependencies in a private environment, ~/.samurai/venv.
• If a hook registry already runs the guard and scrubber, install doesn't register them a second time.
• Re-installing leaves unchanged hooks alone. Uninstall removes only what Order Samurai wrote, and no longer reports success when it couldn't remove a hook.
• Config files are written safely: changes are atomic, permissions are kept, and an unreadable ~/.claude/settings.json is never replaced.

Clearer failures

• The daily digest prints a warning before falling back to Mail.app, naming the error but never the key.
• Doctor's hook-health rows say why a hook's criticality is unknown when the hook registry can't be loaded.
• execution/verify_falsifiability.py reports a crashing check as an error and finishes the rest, instead of stopping with a traceback.

Also new

• One support address: support@agentica-llc.biz. It's printed at the end of samurai doctor and after a successful install.

From 2.1.2 and 2.1.3

• 2.1.3: secret scrubbing works on a standard install. In 2.1.1 the scrubber depended on a file a standard install doesn't include, so it scrubbed nothing. samurai doctor now runs each hook for real and fails if one errors or hangs.
• 2.1.2: dashboard. Previous and next controls for categorised reflex stacks, and the selected card stays put when other alerts clear.

Full details are in CHANGELOG.md.

Order Samurai v2.1.1

[2.1.1] - 2026-10-04

Fixed

• A license key disabled in Gumroad now revokes Pro on the next refund-window re-check, the same as a refund.

Order Samurai v2.1.0

[2.1.0] - 2026-10-04

Added

• One-command Pro install: after installing, install.sh asks for the license key from the Gumroad receipt (input hidden) and activates it, or keeps the Free tier when you press Enter. The key never goes on a command line or into shell history.

Fixed

• Revoke Pro after a refund: an activated license is re-checked online at most once per 24 hours during the refund window (purchase + 21 days). Only a confirmed refund, chargeback or lost dispute revokes. A network failure never does, so offline activation keeps working.
• samurai license masks the buyer's email (b****@example.com) as well as the key.
• Installer: hooks are registered at bin/, where the scripts ship; hook script paths are quoted so installs under folders with spaces work; installer child processes no longer read stdin.
• The secret scanner applies directory exclusions only below the scan root. A checkout under a directory with an excluded name was previously skipped entirely.
• The HITL alert digest ages proposed backlog items by creation time.
• The demo dashboard no longer renders blank when repair history is empty.

Security

• Lockfile bump clears two critical npm advisories (shell-quote 1.9.0, concurrently 9.2.4).

v2.0.1

Fixed

• Label static demo reflexes as sample data, not live telemetry.
• Use recorded Craft Improvements for the Arts headline instead of conflating
  deliverables with estimated human hours saved.
• Document complete dependency/hook setup, current support channels, online
  Gumroad activation and the limits of refund revocation for offline entitlements.
• Align the synthetic demo and customer ZIP with the reviewed public source.

Order Samurai v1.0.1 — critical hook wiring fix

Critical fix — v1.0.0 did not protect anything

If you installed v1.0.0, you were not protected. Upgrade and re-run samurai install.

samurai install registered its hooks into ~/.claude/hooks/settings.json using an entry
shape of {"name", "command", "async"}. Claude Code loads ~/.claude/settings.json and
parses {"matcher", "hooks": [{"type": "command", ...}]} — so neither the path nor the
schema matched, and the prompt-injection guard and secret scrubber never ran. Meanwhile
samurai doctor reported 5/5 checks passed, because it accepted Order Samurai's own
~/.samurai/settings.json as proof of registration.

Fixed

• Correct target and schema. Hooks are registered into ~/.claude/settings.json in
  Claude Code's own format. The merge preserves your existing hooks and unrelated settings,
  and re-running replaces our entries rather than duplicating them.
• samurai doctor fails honestly. Registration is asserted only against the file Claude
  Code actually loads. It will now report FAIL if the guard is not wired.
• samurai uninstall can no longer damage your Claude Code config. It previously
  deregistered by name and then restored the newest settings.json.bak.* — but both
  settings files shared that basename, so it could drop Order Samurai's file on top of your
  real config. Uninstall is now surgical, and backups are labelled per target.
• samurai uninstall preserves a paid Pro license. It removed ~/.samurai wholesale,
  silently deleting license.json. The license is now copied to
  ~/order-samurai-license-backup.json first.
• Settings writes are atomic (temp file + os.replace).

Install steps corrected

The installer previously told you to run samurai status, which is not a command, and
omitted samurai install — the step that actually registers the hooks. Downloading alone
protected nothing. Correct sequence:

curl -fsSL https://www.ordersamurai.ai/install.sh | bash
export PATH="$HOME/.samurai/core/bin:$PATH"
samurai install     # registers the hooks
samurai doctor      # verifies protection

Upgrading from 1.0.0

Re-run the installer, then samurai install, then samurai doctor. Uninstall also removes
the stale v1.0.0 hook file.

Regression coverage

tests/test_hook_wiring.py asserts the guard lands in the file Claude Code loads, in the
schema it parses, idempotently, without clobbering user settings — and that doctor fails
when it is absent. The pre-existing tests/test_samurai_installer.py asserted the broken
path and schema, which is how this shipped; it now asserts the real contract.

Full suite: 1,496 passed, 9 skipped.

Verifying your download

shasum -a 256 -c order-samurai-core.zip.sha256

Expected: 6cff414f11183332083c4d888869acc30f131cd000a2fdca0549637604905bc8

Order Samurai v1.0.0 — DEPRECATED, use v1.0.1

⚠️ DEPRECATED — do not use. This release does not protect anything.

If you installed v1.0.0, you were never protected. Please upgrade to
v1.0.1
and re-run samurai install.

samurai install registered its hooks into ~/.claude/hooks/settings.json using entries
shaped {"name", "command", "async"}. Claude Code loads ~/.claude/settings.json and
parses {"matcher", "hooks": [{"type": "command", ...}]} — so neither the path nor the
schema matched. The prompt-injection guard and secret scrubber never ran.

samurai doctor reported 5/5 checks passed throughout, because it accepted Order
Samurai's own ~/.samurai/settings.json as proof of registration. A passing health check
on this version is not evidence that you were protected.

Two further defects in this release:

• samurai uninstall could damage your Claude Code configuration. It deregistered by
  name, then restored the newest settings.json.bak.* — but both settings files share that
  basename, so it could write Order Samurai's file over your real ~/.claude/settings.json.
• samurai uninstall silently deleted a paid Pro license. It removed ~/.samurai
  wholesale, taking license.json with it.

Upgrading

curl -fsSL https://www.ordersamurai.ai/install.sh | bash
export PATH="$HOME/.samurai/core/bin:$PATH"
samurai install     # registers the hooks (this step was missing from v1.0.0's instructions)
samurai doctor      # now fails honestly if the guard is not wired

v1.0.1 also removes the stale v1.0.0 hook file on uninstall. Full detail:
CHANGELOG.

---

Order Samurai v1.0.0 - Local-First Governance & Security Layer for Autonomous Coding Agent Fleets