Hush v0.0.4

Fixes CLI login failures reporting service response has no valid vault revision when an intermediary weakens or removes HTTP ETags.

• The service now sends an independent X-Hush-Revision header and Cache-Control: no-store, no-transform.
• The CLI prefers this revision header and remains compatible with legacy strong and weak ETags. Both formats normalize to the same revision before snapshot comparison.
• Missing, malformed, and out-of-range revisions still fail closed. Device-key decryption and authentication checks remain required.
• Adds regression coverage for key retrieval, ETag removal, mixed response representations, and revision headers on service reads and writes.

Self-hosted deployments should update the service and CLI together. Existing enrollment is preserved; rerun hush login after upgrading without running hush init or hush logout.

curl -fsSL https://raw.githubusercontent.com/txchen/hush/master/install.sh | bash
hush version
hush login

Hush v0.0.3

Hush v0.0.3 fixes CLI snapshot handling and improves installation guidance.

• Retry from a fresh Profile list when its revision differs from the device key response, avoiding stale Profile IDs during concurrent changes. Retries remain bounded to three attempts.
• Support hush -h without credentials.
• Fix installer and documentation links to use the repository's master branch.
• Add npx skills add txchen/hush --skill hush instructions, including a global Codex example. Clarify device enrollment, local credential writes, and safe handling of Profile metadata in the skill.
• Migrate service tooling to cf, keep deployment identity in a Git-ignored local file, and allow master passwords of at least 12 characters.

Validation: Go race tests and vet, cryptographic interoperability checks, three-platform archive builds, installer tests, and a disposable skill installation. The release workflow also runs service/Web tests and native installation checks before publishing these archives.

Upgrade:

curl -fsSL https://raw.githubusercontent.com/txchen/hush/master/install.sh | bash
hush version

Existing enrolled devices retain their credentials; no re-enrollment is needed.

Hush v0.0.2

Fixes three issues found during the repository review:

• Reject C1 Unicode control characters in names at the service boundary, matching CLI validation and preventing one invalid Profile name from breaking unrelated CLI executions.
• Clear revealed plaintext when the vault snapshot changes, including after edits and refreshes. Discard reveals that finish against an outdated snapshot.
• Audit raw reads of the vault, secrets, and devices database tables before returning ciphertext or wrapped keys. Audit records contain the table name, never row contents.

Includes regression tests, browser tests in release CI, and CI coverage for the master branch.

Also includes the standalone Bash installer, Hush agent skill, and documentation improvements added since v0.0.1. Download the appropriate archive below and verify it against SHA256SUMS, or use the installer documented in the README.

Service and Web fixes require redeploying the application from this release; replacing the CLI binary alone does not update the hosted service.

Hush CLI 0.0.1

First release of the Hush CLI for unattended coding-agent workflows.

• Linux x86_64 (linux/amd64), Linux ARM64, and Apple Silicon macOS binaries.
• One-time device enrollment with local private-key generation and Cloudflare Access Service Token authentication.
• status, secret list, and profile list, including JSON metadata output.
• hush exec <profile> -- <command> [args...] fetches ciphertext online, decrypts locally, and injects only the selected Profile's environment variables.
• Direct process execution preserves arguments, standard streams, signals, and exit status. Service or decryption failures prevent execution.
• Private local credential files (0700 directory, 0600 files), no persistent vault-content cache, and local logout.

Download the archive matching your machine and verify it against SHA256SUMS. Linux binaries are statically linked; minimal containers still require a CA certificate bundle. macOS binaries are not Developer ID signed or notarized.

Installation and enrollment guide

Device credentials permit unattended access and must be protected. The CLI does not sandbox child commands or redact their output. Production Cloudflare configuration and one-time Web enrollment are required.

Validation: release CI passed service/Web checks, native Linux x86_64 and ARM64 tests, Alpine tests on both Linux architectures, and native Apple Silicon tests on macOS 14, 15, and 26. Attached archives were produced by this tag's CI build.