Hush CLI 0.0.1

First release of the Hush CLI for unattended coding-agent workflows.

• Linux x86_64 (linux/amd64), Linux ARM64, and Apple Silicon macOS binaries.
• One-time device enrollment with local private-key generation and Cloudflare Access Service Token authentication.
• status, secret list, and profile list, including JSON metadata output.
• hush exec <profile> -- <command> [args...] fetches ciphertext online, decrypts locally, and injects only the selected Profile's environment variables.
• Direct process execution preserves arguments, standard streams, signals, and exit status. Service or decryption failures prevent execution.
• Private local credential files (0700 directory, 0600 files), no persistent vault-content cache, and local logout.

Download the archive matching your machine and verify it against SHA256SUMS. Linux binaries are statically linked; minimal containers still require a CA certificate bundle. macOS binaries are not Developer ID signed or notarized.

Installation and enrollment guide

Device credentials permit unattended access and must be protected. The CLI does not sandbox child commands or redact their output. Production Cloudflare configuration and one-time Web enrollment are required.

Validation: release CI passed service/Web checks, native Linux x86_64 and ARM64 tests, Alpine tests on both Linux architectures, and native Apple Silicon tests on macOS 14, 15, and 26. Attached archives were produced by this tag's CI build.