Ask Key 1.0.4

Ask Key 1.0.4

A small polish release. The group field in the New credential window now matches the other inputs, Windows Hello recovers from a failed prompt, and the Guard service shows the Ask Key icon.

Fixes

• The group field has a single rounded frame. The editable group picker drew a second inner box and an accent underline whose square ends stuck out past the rounded corners. It now uses the same frame as Type and Agent permission.
• A failed Windows Hello prompt no longer leaves a dead button. If Hello fails, for example in the first seconds after waking the PC, Ask Key retries once after three seconds while Hello still reports itself available. If it still fails, the passphrase field opens instead of a collapsed box.
• The Guard service uses the Ask Key icon in Task Manager instead of the generic console icon.

Documentation

• The README is now written as user documentation.

Upgrading from 1.0.3

Run AskKeySetup-1.0.4.exe over the existing install, or use Check for updates inside Ask Key. The install is in place: saved credentials are not touched.

Verify your download

Get-FileHash -Algorithm SHA256 .\AskKeySetup-1.0.4.exe

Compare with the matching line in AskKey-1.0.4.sha256.

Uninstalling keeps saved credentials in %APPDATA%\AskKey. This build is unsigned, so Windows SmartScreen will warn.

See the English README.

---

Ask Key 1.0.4

一次小修版。新建凭据页的分组框和其余输入框统一了外观，Windows Hello 失败后能自己恢复，Guard 服务也换上了请旨的图标。

修复

• 分组框只剩一层圆角边框。 可编辑的分组下拉框内部还画着一个输入框和一条蓝色下划线，下划线的方头会伸出圆角之外。现在它和"类型""Agent 权限"使用同一套边框。
• Windows Hello 失败后不再留下一个死按钮。 如果 Hello 验证失败（例如电脑刚唤醒的头几秒），请旨会在三秒后重试一次，前提是系统仍报告 Hello 可用。仍然失败时会直接展开输入口令的输入框，而不是聚焦一个折叠的框。
• Guard 服务在任务管理器里显示请旨图标，不再是默认的控制台图标。

文档

• README 已改写为面向用户的使用文档。

从 1.0.3 升级

直接运行 AskKeySetup-1.0.4.exe 覆盖安装，或在请旨里用检查更新。这是原地安装，不会动已保存的凭据。

校验下载

Get-FileHash -Algorithm SHA256 .\AskKeySetup-1.0.4.exe

与 AskKey-1.0.4.sha256 中对应的一行比对。

卸载不会删除 %APPDATA%\AskKey 中保存的凭据。当前构建未签名，Windows SmartScreen 会提示。

完整说明见 中文 README.

Ask Key 1.0.3

Ask Key 1.0.3

Windows Hello now unlocks Ask Key only when an Agent actually needs it, and commands an Agent runs can use OpenSSH again.

Unlocking

• Ask Key starts silently. At login it stays in the tray without opening a window. When an Agent request arrives while the vault is locked, Ask Key brings its unlock screen to the front instead of leaving the request to fail quietly.
• Windows Hello is asked once. After you unlock, read approvals inside the session window you chose in Settings (5, 15, 30 or 60 minutes) no longer ask again. A write approval still asks every time, because it hands an Agent plaintext or grants a lasting permission.
• A locked request is never half-run. It fails closed with a vault_locked status that tells the Agent to retry the same operation ID after you unlock. --wait-for-approval keeps the command, its working directory and its environment in memory and resumes in the same process.
• A single left click on the tray icon opens the window.

Fixes

• OpenSSH works again. Commands started through Ask Key received a filtered environment without ProgramData, which made ssh.exe and its family exit with code 255 and no output. ssh, scp, sftp, ssh-keygen and ssh-keyscan all run again.
• The background-start notification names the unlock method this vault actually has. It used to promise Windows Hello even when no Hello enrollment existed.
• The post-update Agent-access notice is translated.
• Settings has a switch for automatic update checks. Turning it off stops the background check; the manual button still works.

Upgrading from 1.0.2

Run AskKeySetup-1.0.3.exe over the existing install, or use Check for updates inside Ask Key. The install is in place: saved credentials are not touched.

Verify your download

Get-FileHash -Algorithm SHA256 .\AskKeySetup-1.0.3.exe

Compare with the matching line in AskKey-1.0.3.sha256.

Uninstalling keeps saved credentials in %APPDATA%\AskKey. This build is unsigned, so Windows SmartScreen will warn.

See the English README.

---

Ask Key 1.0.3

Windows Hello 现在只在 Agent 真正需要时才解锁，Agent 运行的命令也恢复支持 OpenSSH。

解锁

• 开机静默启动。 登录后只留在托盘，不弹窗口。vault 锁定时如果有 Agent 请求进来，请旨会把解锁界面切到前台，而不是让请求悄悄失败。
• Windows Hello 只问一次。 解锁后在设置里选定的会话时长内（5 / 15 / 30 / 60 分钟），读取类审批不再重复询问。写入类审批每次都会问，因为它会把明文交给 Agent 或授予长期权限。
• 锁定时不会执行一半。 请求以 vault_locked 状态失败，并明确告诉 Agent 解锁后用同一个 operation_id 重试。--wait-for-approval 会把命令、工作目录和环境变量留在内存里，解锁后同一进程继续执行。
• 左键单击托盘图标即可打开窗口。

修复

• OpenSSH 恢复可用。 通过请旨启动的命令，其继承环境缺少 ProgramData，导致 ssh.exe 一族以 255 静默退出。ssh、scp、sftp、ssh-keygen、ssh-keyscan 均已正常。
• 后台启动通知按这个 vault 实际有的方式说明。 以前即使没有绑定 Hello，也会提示用 Windows Hello。
• 升级后的 Agent 访问提示已翻译。
• 设置里新增「自动检查更新」开关。 关掉后不再后台检查，手动按钮仍然可用。

从 1.0.2 升级

直接运行 AskKeySetup-1.0.3.exe 覆盖安装，或在请旨里用检查更新。这是原地安装，不会动已保存的凭据。

校验下载

Get-FileHash -Algorithm SHA256 .\AskKeySetup-1.0.3.exe

与 AskKey-1.0.3.sha256 中对应的一行比对。

卸载不会删除 %APPDATA%\AskKey 中保存的凭据。当前构建未签名，Windows SmartScreen 会提示。

完整说明见 中文 README。

Ask Key 1.0.2

Ask Key 1.0.2

Ask Key can now update itself. Nothing is downloaded until you ask for it.

Updates

• Check for updates is in Settings. Ask Key looks for a newer release in the background at startup and tells you through a tray notification when it finds one. Open Settings → 更新 / Updates to see the version, download it, and restart into it.
• Updating needs one UAC prompt. Ask Key is installed per-machine, so the updater asks Windows for permission once and then replaces the app.
• Nothing installs on its own. There is no silent download and no silent restart: an update only starts when you choose it.
• A portable or development build has nothing to update into, and says so instead of reporting an error.

Upgrading from 1.0.1

Use Check for updates inside Ask Key. If you prefer the installer, download AskKeySetup-1.0.2.exe and run it over the existing install.

If you are on 1.0.0

Update to 1.0.2 directly. Releases now include the Velopack feed files (AskKey-1.0.2-full.nupkg, releases.win.json, assets.win.json, RELEASES) that an installed build reads to find a newer version; 1.0.1 did not include them.

Verify your download

Get-FileHash -Algorithm SHA256 .\AskKeySetup-1.0.2.exe

Compare with the matching line in AskKey-1.0.2.sha256.

Uninstalling keeps saved credentials in %APPDATA%\AskKey. This build is unsigned, so Windows SmartScreen will warn.

See the English README.

---

Ask Key 1.0.2

请旨现在可以自己更新了。下载前仍然需要你确认，不会自动安装。

更新

• 设置里新增「检查更新」。 启动时会在后台检查新版本，找到后用托盘通知告知。到设置 → 更新查看版本、下载并重启进入新版本。
• 更新只需要一次 UAC。 请旨按全机器安装，更新程序会向 Windows 申请一次权限，然后替换应用本身。
• 不会自动安装。 没有静默下载，也没有静默重启：只有你点了才会开始更新。
• 便携版和开发版没有可更新的安装位置，会直接说明情况，而不是报错。

从 1.0.1 升级

直接在请旨里用检查更新即可。也可以下载 AskKeySetup-1.0.2.exe 直接覆盖安装。

如果你还在 1.0.0

可以直接更新到 1.0.2。本次发布附带 Velopack 更新源文件（AskKey-1.0.2-full.nupkg、releases.win.json、assets.win.json、RELEASES），已安装的版本靠它们找到新版本；1.0.1 没有附带这些文件。

校验下载

Get-FileHash -Algorithm SHA256 .\AskKeySetup-1.0.2.exe

与 AskKey-1.0.2.sha256 中对应的一行比对。

卸载不会删除 %APPDATA%\AskKey 中保存的凭据。当前构建未签名，Windows SmartScreen 会提示。

完整说明见 中文 README。

Ask Key 1.0.1

Ask Key 1.0.1

Security fixes for three issues found in a review of 1.0.0, plus download verification. No features and no UI changes beyond one notice described below.

Security

• Agent-access pause state is now authenticated. Pause was a plain row in the local database, and a missing row read as "not paused". A program running as you could delete that row while Ask Key was closed and turn Agent access back on at the next start, without the Windows Hello confirmation that resuming normally asks for. Pause state now lives in a record encrypted with a key derived from your vault key, and a missing or unverifiable record reads as paused.
• Security settings are now authenticated. Whether read requests need confirmation, how long timed allowances last, and how long the management session lasts were read from settings.json, which is also writable by any program running as you. Editing that file could switch off read confirmation or set a session far longer than any option in Settings. These values now live in the same authenticated policy, and out-of-range values fall back to the strict defaults.
• The Broker now checks the host it connects to. A program running as you could stand up its own AskKey.exe in a known install folder and answer the pipe. The helper now requires the host to be the AskKey.exe belonging to its own install folder, and signed builds compare the publisher.

One-time notice after updating

Agent access is paused the first time you open Ask Key after this update, and a dialog explains why. This is the new policy failing closed on a library created before it existed. Choose Resume Agent access to turn it back on; the notice appears once.

Verify your download

Releases now include AskKey-1.0.1.sha256. After downloading:

Get-FileHash -Algorithm SHA256 .\AskKeySetup-1.0.1.exe

Compare with the matching line in AskKey-1.0.1.sha256.

Install

1. Download AskKeySetup-1.0.1.exe and allow the single UAC prompt. It installs Ask Key and the Ask Key Guard service. Running it over an existing 1.0.0 install upgrades in place; no uninstall is needed.
2. Open Ask Key, complete onboarding, and resume Agent access.

Uninstalling keeps saved credentials in %APPDATA%\AskKey. This build is unsigned, so Windows SmartScreen will warn.

See the English README.

---

Ask Key 1.0.1

修复了评审 1.0.0 时发现的三个安全问题，并增加了下载校验方式。除下面提到的一次性提示外，没有功能变化，界面也没有改动。

安全

• Agent 访问暂停状态现在经过认证。 暂停原本是本地数据库里的一行普通记录，而这一行不存在就等于「未暂停」。以你的身份运行的程序可以在 Ask Key 关闭时删掉它，下次启动就把 Agent 访问打开，完全绕过恢复时要求的 Windows Hello 确认。暂停状态现在存放在一条用 vault key 派生的密钥加密的记录里，记录缺失或无法验证时一律读作暂停。
• 安全设置现在经过认证。 读取请求是否需要确认、临时授权时长、管理会话时长原本从 settings.json 读取，而该文件同样可被任何以你的身份运行的程序改写。修改它就能关掉读取确认，或把会话设得远超设置里的任何选项。这些值现在放在同一份经过认证的策略里，超出范围的数值会退回严格默认值。
• Broker 现在会校验它连接的主机。 以你的身份运行的程序可以在已知安装目录里放一个自己的 AskKey.exe 来应答管道。Helper 现在要求主机必须是属于自身安装目录的那个 AskKey.exe，签名构建还会比较发布者。

更新后的一次性提示

更新后第一次打开 Ask Key 时，Agent 访问处于暂停状态，会弹窗说明原因。这是新策略在旧库上按「失败即关闭」规则处理的结果。选择恢复 Agent 访问即可重新开启，该提示只出现一次。

校验下载

本次发布附带 AskKey-1.0.1.sha256。下载后执行：

Get-FileHash -Algorithm SHA256 .\AskKeySetup-1.0.1.exe

与 AskKey-1.0.1.sha256 中对应的一行比对。

安装

1. 下载 AskKeySetup-1.0.1.exe，允许一次 UAC。安装器会同时安装 Ask Key 和 Ask Key Guard 服务。直接覆盖已装的 1.0.0 即可升级，不需要先卸载。
2. 打开 Ask Key，完成首次启动设置，并恢复 Agent 访问。

卸载不会删除 %APPDATA%\AskKey 中保存的凭据。当前构建未签名，Windows SmartScreen 会提示。

完整说明见 中文 README。

Ask Key 1.0.0

Ask Key 1.0.0

Ask Key is a Windows credential manager with a local approval broker for AI agents. This first stable release includes high-security mode, Windows Hello unlock, passphrase changes, tray controls, and a unified WinUI interface.

Install

1. If an earlier Ask Key build is installed, uninstall it first.
2. Download AskKeySetup-1.0.0.exe and allow the single UAC prompt. It installs both Ask Key and the Ask Key Guard service.
3. Open Ask Key from the Start menu and complete onboarding.

• Uninstalling Ask Key keeps saved credentials in %APPDATA%\AskKey.
• This build is unsigned, so Windows SmartScreen will warn.
• AskKey-win-Setup.exe is a per-user install without Guard and cannot use Windows Hello unlock.
• The standalone MSIs are for repair or advanced deployment only.

See the English README.

---

Ask Key 1.0.0

Ask Key 是为 AI Agent 提供本地审批的 Windows 凭据管理器。首个正式版包含高安全模式、Windows Hello 解锁、修改口令、托盘菜单和统一的 WinUI 界面。

安装

1. 如果安装过旧版 Ask Key，请先卸载。
2. 下载 AskKeySetup-1.0.0.exe，允许一次 UAC。安装器会同时安装 Ask Key 和 Ask Key Guard 服务。
3. 从开始菜单打开 Ask Key，完成首次启动设置。

• 卸载 Ask Key 不会删除 %APPDATA%\AskKey 中保存的凭据。
• 当前构建未签名，Windows SmartScreen 会提示。
• AskKey-win-Setup.exe 是当前用户安装，不含 Guard，不能使用 Windows Hello 解锁。
• 分离 MSI 仅供修复或高级部署使用。

完整说明见 中文 README。