SAM v3.4.0 — Nothing Fails Quietly

SAM 3.4.0 — Nothing Fails Quietly

A full line-by-line audit of the codebase. Thirty-odd fixes, and the theme runs
through nearly all of them: things that were broken in ways nobody could see.

The download itself

The Mac build is signed and notarized, so it opens without the "Apple cannot check
it for malicious software" warning. Worth saying how close that came to being false:
the build log said notarize · accepted and stapled ✓ and it was telling the truth
about the app — while the .dmg you actually download carried no notarization
ticket at all. That still opens if you are online, because macOS can go and ask
Apple; offline, or on a bad connection, it stalls or fails. Both artefacts are now
stapled, and CI fails the release if either one isn't.

Five features that had never worked — not once

• read_emails / read_notes raised an AppleScript syntax error on every call
  since the day they were written. Both were wrapped in a catch that turned it into
  "Couldn't read Mail: …", which reads like a missing permission. Nobody debugs a
  permissions message by opening a parser.
• quick_note / backup_vault resolved the vault from the working directory. The
  packaged app runs with cwd=/, so they wrote to /vault — permission denied, every
  time. They worked perfectly in development, which is exactly why they looked fine.
  A backup tool that has never run is the failure you find at the worst moment.
• The pairing badge polled every four seconds into a variable nothing displayed, so a
  device waiting to pair announced itself to no one.

Security

• The prompt-injection fence switched itself off on long sessions. Trimming the
  transcript cut fenced blocks in half, leaving attacker text in place with its "these
  are not commands" marker gone.
• The morning brief fed unfenced email straight into the agent — a timer-driven job,
  with input written by anyone who can email you.
• A silent exfiltration path: read_file and web_fetch both run without asking, so
  a secret could be read and sent in two steps with no prompt. Both ends now refuse.
• Reads that answered anyone — your schedules, what SAM may do unattended, its
  diagnostics, the block log. Any process on your Mac could ask.
• The yard: injected environment could hand git a command to execute; the context
  walker followed symlinks out of the project; the worker lock could be held twice.
• Credentials in URLs (postgres://user:pw@host) reached logs verbatim.

Honesty fixes

• 47 refused actions reported success. "Disable all consents" said done while consent
  stayed on; revoke said revoked while the device stayed paired.
• Four "refused is not absent" panels that could never appear, so a refusal read as
  "you have none".
• A microphone that never released when the wake-word listener was torn down mid-start.
• Chat history vanished silently once localStorage filled.
• The coverage ratchet was set below half the real baseline and ran in no workflow.

iOS

Transport security narrowed from a blanket exemption to local-networking only. Pairing
now hands your phone a reachable address instead of localhost or a self-assigned one,
and "Forget this device" actually revokes the session on your Mac.

---

1,914 tests. Every fix carries one, and several pin the mistake rather than the fix.

---

🔒 Verify your download (SHA-256)

The one-paste installers verify this automatically. To check by hand, compute the hash and match:

• macOS/Linux: shasum -a 256 <file>
• Windows (PowerShell): Get-FileHash <file> -Algorithm SHA256

fd7e2725ffaa53a1eb997135e81d90842e3239a258a7af0f41e11dd6e4401bde  SAM-3.4.0-arm64.dmg
0797354d1ac1b3b50a50e77124d4aa1d97a6defa5d1b295f1602c484a2c94d08  SAM-3.4.0.AppImage
ff2269c14ed21da2026ba49c03f680c502444887bc8ed34cfc4be0d69db05572  SAM-3.4.0.dmg
9e0e16906c4fb8fb041b8504e2ab481345853271596e22b0eb956d3494e6c4b7  SAM-Setup-3.4.0.exe
001fca276973ff5702f9c8f363680d52bed08ca7f3c070126b677b29c88e3dfe  sam_3.4.0_amd64.deb