Order Samurai v1.0.1 — critical hook wiring fix

Critical fix — v1.0.0 did not protect anything

If you installed v1.0.0, you were not protected. Upgrade and re-run samurai install.

samurai install registered its hooks into ~/.claude/hooks/settings.json using an entry
shape of {"name", "command", "async"}. Claude Code loads ~/.claude/settings.json and
parses {"matcher", "hooks": [{"type": "command", ...}]} — so neither the path nor the
schema matched, and the prompt-injection guard and secret scrubber never ran. Meanwhile
samurai doctor reported 5/5 checks passed, because it accepted Order Samurai's own
~/.samurai/settings.json as proof of registration.

Fixed

• Correct target and schema. Hooks are registered into ~/.claude/settings.json in
  Claude Code's own format. The merge preserves your existing hooks and unrelated settings,
  and re-running replaces our entries rather than duplicating them.
• samurai doctor fails honestly. Registration is asserted only against the file Claude
  Code actually loads. It will now report FAIL if the guard is not wired.
• samurai uninstall can no longer damage your Claude Code config. It previously
  deregistered by name and then restored the newest settings.json.bak.* — but both
  settings files shared that basename, so it could drop Order Samurai's file on top of your
  real config. Uninstall is now surgical, and backups are labelled per target.
• samurai uninstall preserves a paid Pro license. It removed ~/.samurai wholesale,
  silently deleting license.json. The license is now copied to
  ~/order-samurai-license-backup.json first.
• Settings writes are atomic (temp file + os.replace).

Install steps corrected

The installer previously told you to run samurai status, which is not a command, and
omitted samurai install — the step that actually registers the hooks. Downloading alone
protected nothing. Correct sequence:

curl -fsSL https://www.ordersamurai.ai/install.sh | bash
export PATH="$HOME/.samurai/core/bin:$PATH"
samurai install     # registers the hooks
samurai doctor      # verifies protection

Upgrading from 1.0.0

Re-run the installer, then samurai install, then samurai doctor. Uninstall also removes
the stale v1.0.0 hook file.

Regression coverage

tests/test_hook_wiring.py asserts the guard lands in the file Claude Code loads, in the
schema it parses, idempotently, without clobbering user settings — and that doctor fails
when it is absent. The pre-existing tests/test_samurai_installer.py asserted the broken
path and schema, which is how this shipped; it now asserts the real contract.

Full suite: 1,496 passed, 9 skipped.

Verifying your download

shasum -a 256 -c order-samurai-core.zip.sha256

Expected: 6cff414f11183332083c4d888869acc30f131cd000a2fdca0549637604905bc8