Skip to content

v1.2.4 — Windows: run as SYSTEM (MDM privilege-check fix)

Choose a tag to compare

View all tags
@LordGameleo LordGameleo released this 06 Jul 11:26
v1.2.4
1641563
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Windows fix: the binary now runs as the SYSTEM account that MDM (Intune/SCCM/GPO) uses.

Fix

  • Accept SYSTEM integrity in the privilege check. checkRoot() on Windows only accepted High integrity (S-1-16-12288, elevated admin) and rejected everything else with error: must be run as Administrator. SYSTEM runs at System integrity (S-1-16-16384) — higher than High, but not matched — so the binary failed on every real Windows MDM run. It now accepts System integrity as well. (macOS/Linux unaffected — they check os.Getuid() == 0.)

Merged PRs

  • Windows: accept SYSTEM integrity in checkRoot (MDM runs as SYSTEM) (source#11)

Full changelog: v1.2.3...v1.2.4

Known follow-up

Windows per-user CLI detection still uses the elevated LookPath (the user-context detection in v1.2.3 covered macOS/Linux only). If claude/codex are installed per-user, detection under SYSTEM may still miss them — tracked separately (read HKCU\Environment PATH).

Assets

Prebuilt binaries for macOS (arm64/amd64), Linux (amd64), and Windows (amd64), built from source main @ 53127df with -trimpath -ldflags="-s -w".

Assets 6
Loading