Repository navigation

Releases

CmdWarden 0.12.0 Latest

Latest

github-actions released this 24 Oct 13:00

v0.12.0

8d82f46

CmdWarden 0.12.0

Make AI coding agents ask before they use your CLI secrets on Windows.

Install

Way	Command or file
winget	`winget install BasantPandey.CmdWarden` (when the winget catalog has this version)
Setup zip	Download `CmdWarden.0.12.0-setup.zip`, extract it, double-click `install.cmd`
Portable zip	Extract `CmdWarden.0.12.0-win-x64.zip` and run `cw.exe`
dotnet tool	Download `CmdWarden.0.12.0.nupkg` to a folder, then `dotnet tool install -g CmdWarden --add-source <folder>` (needs the .NET 10 SDK)

The winget package, the setup zip, and the portable zip carry their own .NET runtime. No .NET install and no admin prompt.

Then run cw setup. It sets up everything and shows a real Approval Gate card.

Signature

This release is not signed yet: Windows SmartScreen may warn. Compare the sha256 of the zip with this page. A signed release shows Valid here:

Get-ChildItem "$env:LOCALAPPDATA\CmdWarden\app" -Recurse -Include cw.exe, CmdWarden.*.exe |
  Get-AuthenticodeSignature | Format-Table Status, Path

Where it came from

GitHub signs a build provenance record for each file of this release. Check that a file came from this repo and its release workflow:

gh attestation verify CmdWarden.0.12.0-setup.zip --repo BasantPandey/CmdWarden

CmdWarden.0.12.0.intoto.jsonl holds the same records, for a check with no network: add --bundle CmdWarden.0.12.0.intoto.jsonl.
CmdWarden.0.12.0.cdx.json is the SBOM in CycloneDX format. It lists each package in the portable zip.

Update and remove

cw update installs the newest release after a sha256 check. A winget install updates with winget upgrade BasantPandey.CmdWarden.
cw uninstall removes CmdWarden and every change it made.

Code signing policy

Read the Code signing policy: who signs CmdWarden, and how.

Assets 8

CmdWarden 0.11.0

github-actions released this 23 Oct 18:45

v0.11.0

2c209a0

CmdWarden 0.11.0

Make AI coding agents ask before they use your CLI secrets on Windows.

Install

Way	Command or file
winget	`winget install BasantPandey.CmdWarden` (when the winget catalog has this version)
Setup zip	Download `CmdWarden.0.11.0-setup.zip`, extract it, double-click `install.cmd`
Portable zip	Extract `CmdWarden.0.11.0-win-x64.zip` and run `cw.exe`
dotnet tool	Download `CmdWarden.0.11.0.nupkg` to a folder, then `dotnet tool install -g CmdWarden --add-source <folder>` (needs the .NET 10 SDK)

The winget package, the setup zip, and the portable zip carry their own .NET runtime. No .NET install and no admin prompt.

Then run cw setup. It sets up everything and shows a real Approval Gate card.

Signature

This release is not signed yet: Windows SmartScreen may warn. Compare the sha256 of the zip with this page. A signed release shows Valid here:

Get-ChildItem "$env:LOCALAPPDATA\CmdWarden\app" -Recurse -Include cw.exe, CmdWarden.*.exe |
  Get-AuthenticodeSignature | Format-Table Status, Path

Where it came from

GitHub signs a build provenance record for each file of this release. Check that a file came from this repo and its release workflow:

gh attestation verify CmdWarden.0.11.0-setup.zip --repo BasantPandey/CmdWarden

Update and remove

cw update installs the newest release after a sha256 check. A winget install updates with winget upgrade BasantPandey.CmdWarden.
cw uninstall removes CmdWarden and every change it made.

Code signing policy

Read the Code signing policy: who signs CmdWarden, and how.

Assets 6

CmdWarden 0.10.0

github-actions released this 23 Oct 17:44

v0.10.0

a0be24a

CmdWarden 0.10.0

Make AI coding agents ask before they use your CLI secrets on Windows.

Install

Way	Command or file
winget	`winget install BasantPandey.CmdWarden` (when the winget catalog has this version)
Setup zip	Download `CmdWarden.0.10.0-setup.zip`, extract it, double-click `install.cmd`
Portable zip	Extract `CmdWarden.0.10.0-win-x64.zip` and run `cw.exe`
dotnet tool	Download `CmdWarden.0.10.0.nupkg` to a folder, then `dotnet tool install -g CmdWarden --add-source <folder>` (needs the .NET 10 SDK)

The winget package, the setup zip, and the portable zip carry their own .NET runtime. No .NET install and no admin prompt.

Then run cw setup. It sets up everything and shows a real Approval Gate card.

Signature

This release is not signed yet: Windows SmartScreen may warn. Compare the sha256 of the zip with this page. A signed release shows Valid here:

Get-ChildItem "$env:LOCALAPPDATA\CmdWarden\app" -Recurse -Include cw.exe, CmdWarden.*.exe |
  Get-AuthenticodeSignature | Format-Table Status, Path

Update and remove

cw update installs the newest release after a sha256 check. A winget install updates with winget upgrade BasantPandey.CmdWarden.
cw uninstall removes CmdWarden and every change it made.

Code signing policy

Read the Code signing policy: who signs CmdWarden, and how.

Assets 6

CmdWarden 0.9.0

github-actions released this 22 Oct 06:25

v0.9.0

707148e

What is new in 0.9.0

Security fix: a program cannot move the pointer onto Approve. An agent could move the pointer onto Approve Once with no input event. Your next click then approved the request. Now a click counts only when your own mouse moves brought the pointer onto the card. If the card opens under the pointer, move the mouse off the card and back (#82).
Gate decisions in the Windows Event Log. cw audit eventlog on copies each gate decision to the Application log, source CmdWarden. A SIEM can collect it. It asks for admin once. No event has a secret value (#48).
Team rules from a git repo. cw policy sync <git repo> reads cmdwarden-team.json and sets the maximum level for each launcher kind and tool. A team rule only lowers a level, so a changed repo cannot open the gate. cw policy list shows each rule and its source (#47).
Fix: a vulnerable System.Security.Cryptography.Pkcs package is replaced with 10.0.13 (GHSA-846f-f764-76mx).
Docs: the code signing policy and a Linux (Omarchy) port plan (#49).

From 0.8.x: run cw update.

CmdWarden 0.9.0

Make AI coding agents ask before they use your CLI secrets on Windows.

Install

Way	Command or file
winget	`winget install BasantPandey.CmdWarden` (when the winget catalog has this version)
Setup zip	Download `CmdWarden.0.9.0-setup.zip`, extract it, double-click `install.cmd`
Portable zip	Extract `CmdWarden.0.9.0-win-x64.zip` and run `cw.exe`
dotnet tool	Download `CmdWarden.0.9.0.nupkg` to a folder, then `dotnet tool install -g CmdWarden --add-source <folder>` (needs the .NET 10 SDK)

The winget package, the setup zip, and the portable zip carry their own .NET runtime. No .NET install and no admin prompt.

Then run cw setup. It sets up everything and shows a real Approval Gate card.

Signature

This release is not signed yet: Windows SmartScreen may warn. Compare the sha256 of the zip with this page. A signed release shows Valid here:

Get-ChildItem "$env:LOCALAPPDATA\CmdWarden\app" -Recurse -Include cw.exe, CmdWarden.*.exe |
  Get-AuthenticodeSignature | Format-Table Status, Path

Update and remove

cw update installs the newest release after a sha256 check. A winget install updates with winget upgrade BasantPandey.CmdWarden.
cw uninstall removes CmdWarden and every change it made.

Code signing policy

Read the Code signing policy: who signs CmdWarden, and how.

Assets 6

CmdWarden 0.8.1

github-actions released this 28 Sep 06:06

v0.8.1

a67cc8b

What is new in 0.8.1

The setup zip installs again. In 0.8.0, install.cmd stopped at once with exit code 1. The cause: Windows PowerShell 5.1 gives the installer an empty folder path at start. An update to 0.8.0 with cw update failed too (#79).
The 1 key works on the Approval Gate card. When the card offers Allow for session, 1 selects Approve Once. In 0.8.0, a real press of 1 did nothing (#78).
Docs: a new test plan. The install page shows the setup zip first until the winget package is in the catalog (#64).

From 0.8.0: run cw update. It runs the installer of the new setup zip, so it works.

CmdWarden 0.8.1

Make AI coding agents ask before they use your CLI secrets on Windows.

Install

Way	Command or file
winget	`winget install BasantPandey.CmdWarden` (when the winget catalog has this version)
Setup zip	Download `CmdWarden.0.8.1-setup.zip`, extract it, double-click `install.cmd`
Portable zip	Extract `CmdWarden.0.8.1-win-x64.zip` and run `cw.exe`
dotnet tool	Download `CmdWarden.0.8.1.nupkg` to a folder, then `dotnet tool install -g CmdWarden --add-source <folder>` (needs the .NET 10 SDK)

The winget package, the setup zip, and the portable zip carry their own .NET runtime. No .NET install and no admin prompt.

Then run cw setup. It sets up everything and shows a real Approval Gate card.

Signature

This release is not signed yet: Windows SmartScreen may warn. Compare the sha256 of the zip with this page. A signed release shows Valid here:

Get-ChildItem "$env:LOCALAPPDATA\CmdWarden\app" -Recurse -Include cw.exe, CmdWarden.*.exe |
  Get-AuthenticodeSignature | Format-Table Status, Path

Update and remove

cw update installs the newest release after a sha256 check. A winget install updates with winget upgrade BasantPandey.CmdWarden.
cw uninstall removes CmdWarden and every change it made.

Assets 6

CmdWarden 0.8.0

github-actions released this 27 Sep 16:40

v0.8.0

1334d0a

What is new in 0.8.0

Two commands to the first block. winget install BasantPandey.CmdWarden, then cw setup. No .NET install and no admin prompt: CmdWarden carries its own runtime (#64, #65).
cw setup enrolls your terminal, hardens the tools it finds, wires Claude Code, Cursor, and Codex, and shows a real card. cw try shows the card at any time with a fake secret (#65).
Codex support in the policy hook, the leak guard, and the MCP server, and the Codex sandbox accounts (#66).
.env guard. cw env import moves the values into the vault. cw inject --env-file .env -- <cmd> gives them back with one card (#67).
Fewer cards. New policy files let low-risk writes run. "Allow for session" is the default button. The tray counts the cards of today (#68).
Masked output. cw inject shows [CmdWarden: NAME] in place of each value (#69).
cw protect turns on the secret protections of Claude Code and Codex (#70).
Self-protection. The hook stops cw commands that turn protection off. New trust page (#71).

CmdWarden 0.8.0

Make AI coding agents ask before they use your CLI secrets on Windows.

Install

Way	Command or file
winget	`winget install BasantPandey.CmdWarden` (when the winget catalog has this version)
Setup zip	Download `CmdWarden.0.8.0-setup.zip`, extract it, double-click `install.cmd`
Portable zip	Extract `CmdWarden.0.8.0-win-x64.zip` and run `cw.exe`
dotnet tool	Download `CmdWarden.0.8.0.nupkg` to a folder, then `dotnet tool install -g CmdWarden --add-source <folder>` (needs the .NET 10 SDK)

The winget package, the setup zip, and the portable zip carry their own .NET runtime. No .NET install and no admin prompt.

Then run cw setup. It sets up everything and shows a real Approval Gate card.

Signature

This release is not signed yet: Windows SmartScreen may warn. Compare the sha256 of the zip with this page. A signed release shows Valid here:

Get-ChildItem "$env:LOCALAPPDATA\CmdWarden\app" -Recurse -Include cw.exe, CmdWarden.*.exe |
  Get-AuthenticodeSignature | Format-Table Status, Path

Update and remove

cw update installs the newest release after a sha256 check. A winget install updates with winget upgrade BasantPandey.CmdWarden.
cw uninstall removes CmdWarden and every change it made.

Assets 6

CmdWarden 0.7.0

github-actions released this 27 Sep 12:28

v0.7.0

d9348aa

What is new in 0.7.0

Tray icon. See live session allows and blocks. Revoke one allow or all of them from the menu (#43).
Edit policy in the Vault app. Change the level per tool and launcher with no command line (#44).
cw update and cw uninstall. Install the newest release after a sha256 check, or remove CmdWarden in one step (#45).
Timed session grants. "Allow for session" ends after a set time or when the launcher is idle (#46).
Release signing step. The release workflow can sign every exe (#42). This release is not signed yet: no signing key is set.
Fix: the identity check now compares the file hash of an Authenticode signature.

CmdWarden 0.7.0

First-catalog Windows CLI secret gate (Session Agent, vault, policy, harden/shims, scan).

Assets

Asset	Use
`CmdWarden.0.7.0-setup.zip`	Easiest: extract, then double-click `install.cmd`. No download, no GitHub login.
`CmdWarden.0.7.0.nupkg`	Install as a global dotnet tool by hand
`CmdWarden.0.7.0-win-x64.zip`	Unzipped binaries: `cw.exe`, `cmdwarden.exe`, `agent/`, `shim-payload/` (needs .NET 10 runtime)

Install with the setup zip (easiest)

Download CmdWarden.0.7.0-setup.zip and extract it.
Double-click install.cmd. When the .NET 10 SDK is missing, the installer offers to install it with winget.
To remove CmdWarden: Windows Settings > Apps > CmdWarden > Uninstall, or double-click uninstall.cmd.

Install as dotnet tool (by hand)

Download CmdWarden.0.7.0.nupkg from this Release into a local folder (e.g. C:\packages).
If the repository is private, sign in to GitHub in the browser first.
Install:

dotnet tool install -g CmdWarden --add-source C:\packages --version 0.7.0
cw version
cw doctor

Use the zip (optional)

Download and extract CmdWarden.0.7.0-win-x64.zip.
Run cw.exe / cmdwarden.exe from the extract folder (or add it to PATH).
Session Agent is under agent\CmdWarden.Agent.exe; harden payloads under shim-payload\.

Signature

Every CmdWarden exe and dll carries a signature when the release was signed. Check them:

Get-ChildItem "$env:USERPROFILE\.dotnet\tools\.store\cmdwarden" -Recurse -Include cw.dll, CmdWarden.*.exe |
  Get-AuthenticodeSignature | Format-Table Status, Path

After install

See the repository README and user guide for cw agent start, policy enroll, cw harden, and cw scan.
Install is binaries only; harden is opt-in for PATH shims.

Update

cw update

cw update downloads CmdWarden.<version>-setup.zip, checks its sha256, and runs its installer.
To remove CmdWarden, run cw uninstall.

Assets 5

CmdWarden 0.6.0

github-actions released this 26 Sep 15:57

v0.6.0

b9d7149

CmdWarden 0.6.0

First-catalog Windows CLI secret gate (Session Agent, vault, policy, harden/shims, scan).

Assets

Asset	Use
`CmdWarden.0.6.0-setup.zip`	Easiest: extract, then double-click `install.cmd`. No download, no GitHub login.
`CmdWarden.0.6.0.nupkg`	Install as a global dotnet tool by hand
`CmdWarden.0.6.0-win-x64.zip`	Unzipped binaries: `cw.exe`, `cmdwarden.exe`, `agent/`, `shim-payload/` (needs .NET 10 runtime)

Install with the setup zip (easiest)

Download CmdWarden.0.6.0-setup.zip and extract it.
Double-click install.cmd. When the .NET 10 SDK is missing, the installer offers to install it with winget.
To remove CmdWarden: Windows Settings > Apps > CmdWarden > Uninstall, or double-click uninstall.cmd.

Install as dotnet tool (by hand)

Download CmdWarden.0.6.0.nupkg from this Release into a local folder (e.g. C:\packages).
If the repository is private, sign in to GitHub in the browser first.
Install:

dotnet tool install -g CmdWarden --add-source C:\packages --version 0.6.0
cw version
cw doctor

Use the zip (optional)

Download and extract CmdWarden.0.6.0-win-x64.zip.
Run cw.exe / cmdwarden.exe from the extract folder (or add it to PATH).
Session Agent is under agent\CmdWarden.Agent.exe; harden payloads under shim-payload\.

After install

See the repository README and user guide for cw agent start, policy enroll, cw harden, and cw scan.
Install is binaries only; harden is opt-in for PATH shims.

Update (tool)

dotnet tool update -g CmdWarden --add-source C:\packages --version <new-version>

Assets 5

CmdWarden 0.5.0

github-actions released this 26 Sep 08:32

v0.5.0

bb51ea5

CmdWarden 0.5.0

First-catalog Windows CLI secret gate (Session Agent, vault, policy, harden/shims, scan).

Assets

Asset	Use
`CmdWarden.0.5.0-setup.zip`	Easiest: extract, then double-click `install.cmd`. No download, no GitHub login.
`CmdWarden.0.5.0.nupkg`	Install as a global dotnet tool by hand
`CmdWarden.0.5.0-win-x64.zip`	Unzipped binaries: `cw.exe`, `cmdwarden.exe`, `agent/`, `shim-payload/` (needs .NET 10 runtime)

Install with the setup zip (easiest)

Download CmdWarden.0.5.0-setup.zip and extract it.
Double-click install.cmd. When the .NET 10 SDK is missing, the installer offers to install it with winget.
To remove CmdWarden: Windows Settings > Apps > CmdWarden > Uninstall, or double-click uninstall.cmd.

Install as dotnet tool (by hand)

Download CmdWarden.0.5.0.nupkg from this Release into a local folder (e.g. C:\packages).
If the repository is private, sign in to GitHub in the browser first.
Install:

dotnet tool install -g CmdWarden --add-source C:\packages --version 0.5.0
cw version
cw doctor

Use the zip (optional)

Download and extract CmdWarden.0.5.0-win-x64.zip.
Run cw.exe / cmdwarden.exe from the extract folder (or add it to PATH).
Session Agent is under agent\CmdWarden.Agent.exe; harden payloads under shim-payload\.

After install

See the repository README and user guide for cw agent start, policy enroll, cw harden, and cw scan.
Install is binaries only; harden is opt-in for PATH shims.

Update (tool)

dotnet tool update -g CmdWarden --add-source C:\packages --version <new-version>

Assets 5

CmdWarden 0.3.0

github-actions released this 25 Sep 16:31

v0.3.0

68a5f76

CmdWarden 0.3.0

First-catalog Windows CLI secret gate (Session Agent, vault, policy, harden/shims, scan).

Assets

Asset	Use
`CmdWarden.0.3.0-setup.zip`	Easiest: extract, then double-click `install.cmd`. No download, no GitHub login.
`CmdWarden.0.3.0.nupkg`	Install as a global dotnet tool by hand
`CmdWarden.0.3.0-win-x64.zip`	Unzipped binaries: `cw.exe`, `cmdwarden.exe`, `agent/`, `shim-payload/` (needs .NET 10 runtime)

Install with the setup zip (easiest)

Download CmdWarden.0.3.0-setup.zip and extract it.
Double-click install.cmd. When the .NET 10 SDK is missing, the installer offers to install it with winget.
To remove CmdWarden: Windows Settings > Apps > CmdWarden > Uninstall, or double-click uninstall.cmd.

Install as dotnet tool (by hand)

Download CmdWarden.0.3.0.nupkg from this Release into a local folder (e.g. C:\packages).
If the repository is private, sign in to GitHub in the browser first.
Install:

dotnet tool install -g CmdWarden --add-source C:\packages --version 0.3.0
cw version
cw doctor

Use the zip (optional)

Download and extract CmdWarden.0.3.0-win-x64.zip.
Run cw.exe / cmdwarden.exe from the extract folder (or add it to PATH).
Session Agent is under agent\CmdWarden.Agent.exe; harden payloads under shim-payload\.

After install

See the repository README and user guide for cw agent start, policy enroll, cw harden, and cw scan.
Install is binaries only; harden is opt-in for PATH shims.

Update (tool)

dotnet tool update -g CmdWarden --add-source C:\packages --version <new-version>

Assets 5

CmdWarden 0.12.0

CmdWarden 0.12.0

Install

Signature

Where it came from

Update and remove

Code signing policy

Uh oh!

CmdWarden 0.11.0

CmdWarden 0.11.0

Install

Signature

Where it came from

Update and remove

Code signing policy

Uh oh!

CmdWarden 0.10.0

CmdWarden 0.10.0

Install

Signature

Update and remove

Code signing policy

Uh oh!

CmdWarden 0.9.0

What is new in 0.9.0

CmdWarden 0.9.0

Install

Signature

Update and remove

Code signing policy

Uh oh!

CmdWarden 0.8.1

What is new in 0.8.1

CmdWarden 0.8.1

Install

Signature

Update and remove

Uh oh!

CmdWarden 0.8.0

What is new in 0.8.0

CmdWarden 0.8.0

Install

Signature

Update and remove

Uh oh!

CmdWarden 0.7.0

What is new in 0.7.0

CmdWarden 0.7.0

Assets

Install with the setup zip (easiest)

Install as dotnet tool (by hand)

Use the zip (optional)

Signature

After install

Update

Uh oh!

CmdWarden 0.6.0

CmdWarden 0.6.0

Assets

Install with the setup zip (easiest)

Install as dotnet tool (by hand)

Use the zip (optional)

After install

Update (tool)

Uh oh!

CmdWarden 0.5.0

CmdWarden 0.5.0

Assets

Install with the setup zip (easiest)

Install as dotnet tool (by hand)

Use the zip (optional)

After install

Update (tool)

Uh oh!

CmdWarden 0.3.0

CmdWarden 0.3.0

Assets

Install with the setup zip (easiest)

Install as dotnet tool (by hand)

Use the zip (optional)