Skip to content

CmdWarden 0.9.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Oct 06:25
· 54 commits to main since this release
v0.9.0
707148e

What is new in 0.9.0

  • Security fix: a program cannot move the pointer onto Approve. An agent could move the pointer onto Approve Once with no input event. Your next click then approved the request. Now a click counts only when your own mouse moves brought the pointer onto the card. If the card opens under the pointer, move the mouse off the card and back (#82).
  • Gate decisions in the Windows Event Log. cw audit eventlog on copies each gate decision to the Application log, source CmdWarden. A SIEM can collect it. It asks for admin once. No event has a secret value (#48).
  • Team rules from a git repo. cw policy sync <git repo> reads cmdwarden-team.json and sets the maximum level for each launcher kind and tool. A team rule only lowers a level, so a changed repo cannot open the gate. cw policy list shows each rule and its source (#47).
  • Fix: a vulnerable System.Security.Cryptography.Pkcs package is replaced with 10.0.13 (GHSA-846f-f764-76mx).
  • Docs: the code signing policy and a Linux (Omarchy) port plan (#49).

From 0.8.x: run cw update.

CmdWarden 0.9.0

Make AI coding agents ask before they use your CLI secrets on Windows.

Install

Way Command or file
winget winget install BasantPandey.CmdWarden (when the winget catalog has this version)
Setup zip Download CmdWarden.0.9.0-setup.zip, extract it, double-click install.cmd
Portable zip Extract CmdWarden.0.9.0-win-x64.zip and run cw.exe
dotnet tool Download CmdWarden.0.9.0.nupkg to a folder, then dotnet tool install -g CmdWarden --add-source <folder> (needs the .NET 10 SDK)

The winget package, the setup zip, and the portable zip carry their own .NET runtime. No .NET install and no admin prompt.

Then run cw setup. It sets up everything and shows a real Approval Gate card.

Signature

This release is not signed yet: Windows SmartScreen may warn. Compare the sha256 of the zip with this page. A signed release shows Valid here:

Get-ChildItem "$env:LOCALAPPDATA\CmdWarden\app" -Recurse -Include cw.exe, CmdWarden.*.exe |
  Get-AuthenticodeSignature | Format-Table Status, Path

Update and remove

cw update installs the newest release after a sha256 check. A winget install updates with winget upgrade BasantPandey.CmdWarden.
cw uninstall removes CmdWarden and every change it made.

Code signing policy

Read the Code signing policy: who signs CmdWarden, and how.

Assets 6
Loading