yoru v0.4.1

Security patch for 0.4.0, from a pre-GA penetration-test pass. No API shape
changes and no CLI change; yoru-cli stays at 0.3.0.

Security

• Outbound webhook signing secrets are now encrypted at rest (Fernet), for both
  the per-user and the org/admin webhook surfaces. The key comes from
  WEBHOOK_SECRET_ENCRYPTION_KEY, or is generated once and persisted at
  backend/data/.webhook_secret_key; back that file up, a lost key makes stored
  secrets unreadable. The org/admin webhook API no longer returns the secret on
  every read, only on create and regenerate. (23b1a3b, task:bb1f35fc)
• The session and refresh cookies now carry Secure when
  ENVIRONMENT=production. The refresh cookie was hardcoded to Secure=false.
  (23b1a3b, task:bb1f35fc)
• Deleting a red-flag rule (DELETE /orgs/{org_id}/red-flag-rules/{rule_id})
  now requires an org owner or admin; a plain member could delete an owner's
  rule. (23b1a3b, task:bb1f35fc)
• Updating a red-flag rule (PATCH) now requires an org owner or admin, or the
  rule's creator; a plain member could disable someone else's rule. Creating a
  rule stays open to members. (877d7fd, task:4e5a32c4)
• GET /auth/org/identities: the pentest's cross-tenant finding did not
  reproduce (the endpoint already required an org admin); the existing denial
  tests were re-run and no code changed. (23b1a3b, task:bb1f35fc)
• POST /sessions/events now refuses events for a session owned by another
  identity; any org's hook token could previously append to and hijack another
  identity's audit trail. (96c75fd, task:dc033681)

Changed

• LICENSING.md and LICENSE scope no longer name the retired Receipt product,
  receipt.dev, or opentruth.ch. (e37f737, task:98ec4d50)
• Dashboard tests: OrgIdentitiesPage and TokensPage vitest cases no longer
  depend on the wall clock. Test-only, no runtime change. (2f72612,
  task:dccf35db)

yoru v0.4.0

Org-scoped identity and a CTO console. Every paired CLI is now a first-class
identity that belongs to an org, the dashboard leads with exceptions instead of
raw activity, and audit capture no longer depends on Claude Code's transcript
file alone: git commits and pushes are captured and reconciled directly.

Pairs with yoru-cli 0.3.0. A 0.2.x CLI still pairs and streams events; it just
does not carry identity slots, git capture, or the tailer fixes, which live in
the CLI.

Added

• Identity keystone. The paired CLI token is the identity: approval records the
  machine hostname, org admins list identities per org (GET /auth/org/identities), and the dashboard shows both the org view and "My
  machines" with hostname and last-seen, so a device that went quiet stands
  out. (f96cace, 2434351, e53ad0d, 57c5a92)
• Default org routing. An event that matches no workspace rule falls back to
  the token's default_org_id workspace instead of landing in "Personal"; the
  dashboard shows an explicit header while that fallback is in effect.
  (d305f70, 352cfe8)
• Token analytics. Day/week token and cost rollups at GET /analytics/tokens,
  drillable by org, user, and repo. The Usage page is redesigned as an org-cost
  console for the CTO persona. (4b7021c, 69a9659, 60be1ba, 85c5775)
• Exceptions rollup. Org-wide red-flag BI: flagged sessions per period, top
  rules, top offenders. GET /activity gains a flagged filter.
  (fc05b56, 8c8718a)
• Exception-first dashboard. / and /feed lead with flagged sessions by
  default; the full activity stream is one click away. (c9d556b)
• Session detail leads with the synthesis card; the heavy panels (cost,
  integrity, causal replay, step-through replay, full timeline) collapse below
  it. (668e796)
• Skill-safety red flags. A deterministic 16-rule category (prompt injection,
  reverse shells, exfiltration, hard-coded secrets, credential-path reads,
  cloud-metadata probes) evaluated on events that touch skill content. No LLM,
  not user-editable. (04810c7)
• Custom red-flag rules show their org-defined name and severity as badges
  across the dashboard, with follow-ups on the session hero.
  (026685c, 60b6987)
• Git capture (B3). The CLI installs opt-in post-commit/pre-push hooks and
  reconciles git log every 60s so --no-verify and pre-init commits still
  land. The backend ingests commit and force-push events under a stable session
  id, and session detail shows an audit badge with agent_confidence
  (declared/unknown) and whether enforcement is available.
  (e050c8d, a238b6e, b62cbcd, db18309, 631ee94)
• Canonical event. Red-flag scanning runs on a provider-neutral
  CanonicalEvent instead of Claude Code's raw event shape, so events from
  other agents get the same rules. (e31f64a)
• Shared wire contract package packages/yoru-contract (MIT) for the
  device-code pairing DTOs used by both the CLI and the backend. (7bdb49d)
• Pairing page distinguishes invalid, expired, and already-paired codes.
  (283a717)
• Frontend test harness (vitest + Testing Library) and a hermetic Playwright
  screenshot suite. (852790e, 14e1e7e)
• Authz primitives documented: require_org_admin gates org-wide actions,
  visible_scope_sync decides which rows a caller sees. (3d4e97f)

Fixed

• Org selection stays in sync across browser tabs. (082e791)
• Organizations page no longer crashes when the API returns a non-array
  items. (ae29126, 18c1fb1)
• Marketing hero no longer overflows on mobile. (6e6b20a)

CI

• skill-gate review-verdict check uses a general left-anchored regex with a
  pinned selftest, so domain-scoped review skills pass. (1140bef)

CLI (yoru-cli 0.3.0, released alongside)

The CLI is versioned separately; these landed in this repo over the same
window and ship as yoru-cli 0.3.0.

• Identity slots. Local state (config.json, tail-state.json,
  enforce.json) is scoped per paired identity instead of per $HOME, so two
  devs on one machine, or one dev re-pairing, no longer overwrite each other.
  (73c5f3f)
• yoru doctor prints the active identity and warns when several slots exist.
  (813e2ab)
• yoru logout and token rotation without a full re-pair. (9cb68fd)
• yoru init --force revokes the previous token server-side instead of only
  overwriting the local file. (527d6d9)
• Git capture: yoru init offers opt-in post-commit/pre-push hooks for
  that repo, plus a 60s git log reconcile that backfills commits made with
  --no-verify or before init; hook and reconcile paths produce the same
  session id and entry uuid. Hostname is sent at pairing.
  (e050c8d, a238b6e, b62cbcd, f1fbf9d, f96cace)
• Force-push events carry their kind. (db18309)
• Transcript tailer: tail-state.json guarded by flock (run lock + state
  lock) so two tailers cannot clobber each other (832c4f9); yoru status no
  longer truncates the run-lock file while probing it (d7e6f2f); drains stream
  the unread remainder instead of one whole-file read (bfa86a0); backfill no
  longer races the running tailer's in-memory state (307778e).

yoru v0.3.0

Automated mirror release for v0.3.0.

yoru v0.2.1

Automated mirror release for v0.2.1.

yoru v0.2.0

Local-export share levers + dashboard replay.

• Shareable receipt PNG (self-contained, owner-exported — nothing hosted)
• Replay GIF export (animated session replay, TSU-44 redaction-scrubbed)
• Live step-through replay player in the authed dashboard
• Durable transcript-tailer + entry_uuid dedup (events survive backend downtime, exactly-once)

Self-hosted, owner-only. Share = the image you export from your own instance.

yoru v0.1.0

yoru — audit-grade session receipts for autonomous AI coding agents. Install a Claude Code hook and every tool call, file edit, prompt, response, and red-flag event streams to a dashboard you run, plus a per-session A–F grade (Throughput / Reliability / Safety).

First public beta. Self-hosted only — you run it on your own box. There is no hosted yoru, no signup, no cloud tier.

What works today

• Backend (FastAPI, AGPL-3.0): event ingest, red-flag detection, A–F scoring. Pluggable auth (local scrypt+JWT default, or Supabase) and DB (SQLite default, or Postgres).
• Dashboard (React, AGPL-3.0): live sessions, per-session trail, token/cost recap, fleet totals.
• CLI (yoru-cli, MIT — pip install yoru-cli): init (install hook + device-pair, --server required), doctor, share. The hook POSTs with a 2s timeout so a yoru outage never stalls your terminal.
• Red-flag taxonomy (6, flagged at ingest): secret, env, shell, db, migration, ci.
• Shareable receipts: flip a session public → a redacted /s/<id> page (secrets / home paths / git remotes scrubbed before anything is exposed); private by default.

Run it

```
git clone https://github.com/TsukumoHQ/yoru && cd yoru
cp .env.example backend/.env # SQLite + local auth, zero external services
docker compose up # api :8002 + dashboard :5173
```
See `docs/SELF-HOST.md`. Postgres / Supabase / SMTP / OAuth are all optional.

Beta caveats

• Self-hosted-only; billing is gated off by default.
• Naming is half-migrated (Receipt → yoru): some rcpt_ tokens and RECEIPT_* env vars remain — load-bearing, documented in .env.example.

Licensing: server + dashboard AGPL-3.0, CLI MIT. See `LICENSING.md`.