Keeper Commander: baixar versions anteriors

Features
- PAM Cloud Azure credential generation can now authenticate via an interactive Microsoft Entra sign-in (OAuth 2.0 authorization code flow with PKCE over a local loopback redirect), so Azure credentials can be generated without ever passing a password or MFA code through Commander.
- Export and the pam action debug dump command now support Service Mode JSON output, allowing these commands to be driven and consumed programmatically through Service Mode.
Fixes
- Fixed inheritance handling when revoking a parent folder's access on nested share folders: converting an inherited grant into a direct one now adds a new recipient-encrypted folder key instead of updating the inherited row, and explicit denials of inherited access are now tracked so a child folder no longer loses its access state or folder key when the parent grant is revoked.

Commander 18.1.5
Highlights
- Added nsf-move to move records and folders within Nested Shared Folders (NSF), including moves to the NSF root.
- Enhanced CyberArk imports to retain more account and platform metadata, including custom platform properties and LogonDomain-aware usernames.
- Added support for configuring multiple Google Chat approval spaces.
Enhancements
- SaaS PAM plugins can now use a record configuration-field type. Commander validates that the referenced record exists and is in a shared folder available to the gateway.
- Added input validation for SaaS PAM URL, integer, number, and boolean configuration fields.
- Active Directory SCIM imports support prefixing --group with + to select that group's direct subgroups.
- Improved Active Directory SCIM diagnostics for unresolved groups and skipped directory entries.
Fixes
- Fixed Nested Shared Folder rename operations when a folder is referenced by name or path.
- Fixed Service Mode FILEDATA substitutions for Windows paths.
Security and compatibility
- Hardened Service Mode by blocking the -- argument separator and legacy commands that could bypass Service Mode restrictions.
- Added shell-specific validation for SSH, PsPasswd, and Unix password rotation inputs to prevent command injection.
Full Changelog: v18.1.4...v18.1.5

Commander 18.1.1 Release Notes

Released: 2026-08-14

New Features

NSF Import Support — The import command now supports Nested Share Folder (NSF) records and folders, including permissions.

Improvements

PAM tunnel diagnose — Fixed four diagnostic accuracy issues: GOV region server targeting for port-443 tests, region display for non-US servers, WebSocket tests now correctly fail on HTTP 4xx/5xx responses, and WebRTC sample color coding.
Team name validation — Added validation when resolving team names during key fetching to prevent ambiguous UID-shaped strings from being misclassified as teams.
API timeout — Default response timeout increased from 120 s to 300 s to align with backend timeouts.
Correct Azure import library name — Fixed incorrect library reference for Azure imports.
EPM SCIM user/group IDs — SCIM user and group output now includes the Id field.
JSON output for additional commands — --format json is now supported for PAM list and info commands, and for record-history --action view.
Service command accepts service names — The service command can now be referenced by service name in addition to UID.

Bug Fixes

PAM RBI edit in NSF — Fixed pam rbi edit so that NSF RBI settings are correctly persisted via update_pam_record.
PAM workflow policy enforcement — PAM workflow admin commands are now blocked after the workflow-settings policy is revoked.
Docker one-shot commands — Fixed Docker containers hanging indefinitely after executing one-shot commands; the container now exits with the wrapped command's status unless running in service mode or with KEEPER_KEEP_ALIVE set.
Docker service setup ownership — Ownership is now required before Commander adopts existing Docker setup folders and KSM apps to prevent unintended takeover.

Keeper Commander release v18.0.13
New Features
• CyberArk → KeeperPAM migration — Added a new pam project cyberark-import command to migrate CyberArk safes, accounts, platforms, and policies into KeeperPAM. See docs/cyberark-pam-import.md for details.
Improvements
• import --no-shortcuts — Added a --no-shortcuts flag to the import command. When an imported record is identical to an existing vault record, import normally creates a shortcut; with --no-shortcuts it creates a new record instead.

Keeper Commander release v18.0.13
New Features
- CyberArk → KeeperPAM migration — Added a new pam project cyberark-import command to migrate CyberArk safes, accounts, platforms, and policies into KeeperPAM. See docs/cyberark-pam-import.md for details.
Improvements
- import --no-shortcuts — Added a --no-shortcuts flag to the import command. When an imported record is identical to an existing vault record, import normally creates a shortcut; with --no-shortcuts it creates a new record instead.

Keeper Commander release version v18.0.12
New Features
- CNAPP integration commands — Added new commands and helpers for CNAPP (Cloud-Native Application Protection) integration.
- Slack multi-channel approvals — Added setup for Slack multi-channel approvals and Slack record sync-down.=
- Secrets Manager usage report — New secrets-manager usage report matching the KSM widgets in Admin Console.
- pamGitHubConfiguration record support — Added support for the GitHub configuration record type in PAM.
- NSF support in PAM commands — Added Native Shared Folder (NSF) folder and record support to PAM commands.
- NSF support in workflow commands — Workflow commands now support Native Shared Folders.
- Import from Bitwarden — Bitwarden collections are now mapped to Keeper folders during import.
Improvements
- record-add self-destruct — record-add with self-destruct now returns the record UID and supports --format=json.
- NSF child folder permissions — Support for denying permission inheritance from Commander when sharing or changing NSF child folder permissions.
- transfer command help — Improved help text for the Managed Company transfer command.
Bug Fixes
- Fixed a misleading communication error when assigning a team to an admin role.
- Fixed whoami command failing for trial enterprise accounts.
- Exposed the owner flag in classic shared folder get JSON output.
- Fixed share-folder record expiration and Record Owner Edit (ROE) handling.
- Fixed redundant full syncs during Docker Service Mode startup.
- Fixed import command to only update records when in the same folder.

Commander 18.0.11
Bug Fixes
- Import command — Records are now only updated when they belong to the same folder as the import target.
- PAM config list — Fixed CRON expression parsing dropping the seconds field from 6-part Quartz CRON expressions when displaying PAM configuration schedules.
- SSO login over SSH — Fixed a failure when using SSO authentication in remote/SSH sessions where clipboard access (pyperclip) is unavailable.

What's New in 18.0.10
New Features
- Vault-style passphrase generation — Added passphrase generation to Commander CLI.
- PAM action service map — New pam action service map command to map users to discovered Windows services.
- PAM connection AI toggles — pam connection ai now supports --enabled/-e and --session-terminate/-st flags to configure resource-level AI settings.
Improvements
- PAM graph migration — Service discovery migrated from the user service graph to the PAM graph.
Bug Fixes
- Fixed KEEPER_SSL_CERT_FILE being ignored for SSL verification in REST, PAM, tunnel HTTP, and DAG connections.
- Fixed nsf-mkdir to correctly resolve existing parent folder UIDs in paths instead of treating them as literal names.
- Fixed non-owners being able to attach PAM rotation scripts; uploads are now flagged with is_script for server-side owner enforcement.
- Fixed OS type detection by lowercasing the value before comparing against "windows".
- Fixed mc_transfer_perform to respect the treeKeyTypeId property.

New Features
- KeeperAI PAM Connection Settings (pam connection ai)
New command to manage KeeperAI settings on PAM resources and remote browser instances. Supports show, set, unset, and remove operations for AI configuration on PAM connections.
- PAM Gateway Online Filter
pam gateway list now accepts --online (-o) to filter results to only online gateways, along with gateway totals in the output.
- Enterprise MSP Transfer
Added support for transferring an enterprise to another MSP (KC-1024).
- Thycotic Import: Selective Secret IDs
import --format thycotic now accepts --secret-ids (comma-separated) to import or inspect specific secrets by ID — useful for debugging cases where the Thycotic lookup API omits secrets due to security policies.
- KCM: Port Mapping Defaults and Empty User Handling
KCM export now supports connections with empty user or port fields: missing ports fall back to protocol defaults (configurable via KCM_mappings.json), connections missing a user are logged for follow-up, and allow-file-uploads is available for RBI connections.
Bug Fixes
- Security: SQL Injection in MSSQL Password Rotation
Fixed a SQL injection vulnerability in MSSQL password rotation and added input validation to reject unsafe --password values.
- PAM Rotation Edit: SaaS Profile Fix (DR-1280)
Fixed an issue where pam rotation edit did not correctly apply SaaS profiles.
- IAM User Link Rotation Request Shape
Fixed the permission-check rotation request for IAM user links — configurationUid, matching revision, and an explicit empty resourceUid are now sent to correctly handle IAM rotation semantics.
- NSF Share Expiration and Folder Labels (KC-1307–1310)
- Fixed expiration updates for nsf-share-folder and nsf-share-record
- Enforced a one-minute minimum on NSF and classic share expiration
- Standardized list/search record_category output to lowercase (classic/nested)
- Renamed Supershell Drive folder labels to Nested Shared Folder (Shared) and Nested Shared Folder (NonShared)
Enhancements
- NSF Record Add/Update Policy Enforcement
nsf-record-add and nsf-record-update now enforce GENERATED_PASSWORD_COMPLEXITY and RESTRICT_RECORD_TYPES enterprise policies.

Keeper Commander 18.0.8
PAM: Expanded Database Protocol Support
- pam connection edit and pam import now support seven additional database protocols: mariadb, oracle, mongodb, redis, elasticsearch, clickhouse, and dynamodb (in addition to the existing mysql, postgresql, and sql-server)
PAM: RBI (Remote Browser Isolation) Enhancements
- pam rbi edit: new --session-persistence option with none, user, or resource modes
- New RBI settings in pam import and pam extend: allow_file_uploads, allow_file_downloads, disable_audio, audio_channels, audio_bps, audio_sample_rate
PAM: Scrollback Buffer for Terminal and Database Connections
- pam import/pam extend now support a scrollback setting for SSH, Kubernetes, CLI-capable database, and Windows Remote App connections — aligned with Web Vault behavior
get Command: Secret Field Masking
- The get command now masks all secret-type fields and custom fields in --detail and --fields output, preventing accidental exposure of sensitive values in console output or logs
record-add: Label Control
- New --labels=on/off flag to omit redundant labels on standard fields when creating records programmatically or via scripts
Bug Fixes
- KSM: Fixed sync spinner corrupting console output
- PAM/Discovery: Switched DAG transport to legacy JSON single-stream mode; removed use_per_graph_endpoints flag that caused routing errors
- LastPass import: Handle Base64-encoded private keys during vault import
- Docker: Fixed persistent login error handling in interactive console sessions; improved record lookup fallback in keeper get shell integration

Keeper Commander release v18.0.7
Bug fixes
- kcm-import --output filename tighten file permissions

Keeper Commander 18.0.6
New Features
- Universal Secret Sync — New commands to configure and run synchronization of secrets across networks:
- pam universal-sync-config (alias usc) — manage sync configurations with list/l, add/a, edit/e, and remove/rm subcommands.
- pam universal-sync-run (alias usr) — run a configured Universal Sync.
- pamCloudResource workflow support — pamCloudResource is now a supported workflow type.
Bug Fixes
- pam launch crash on empty DAG parentRef — Fixed a crash when the DAG parentRef value was empty.
- pam launch DAGPathException — Fixed via UID-exact vertex lookup with an added guard.
- pam launch spurious error on logout — No longer shows a guacd_error notice on a normal logout).
- pam connection edit — Fixed handling of connection settings and launch/admin credentials.
- Service mode /health rate limiting — The /health endpoint is now exempt from the global API rate limit.

Keeper Commander 18.0.5
✨ New Features
- Universal Secret Sync — new commands for syncing secrets across providers.
- Cloud secret import to Nested Shared Folders — import cloud secrets directly into Nested Shared Folders.
- CyberArk import — import users and teams from CyberArk, with membership download support.
- PAM RBI file transfers — added Remote Browser Isolation file uploads/downloads, plus pam connection edit --scrollback.
- Combined folder search — find/search now supports multiple -c flags to search across folders.
- NSF folder data in share-report — share-report now includes NSF (non-shared folder) data.
🐛 Bug Fixes
- pam connection edit — fixed editing of connection settings and launch/admin credentials.
- Service mode — exempt the /health endpoint from API rate limiting; fixed Service Mode delete response handling.
- Tunnel — close and unregister the tube when the connection state changes to closed.
- Nested Shared Folders CLI — fixed record updates and nested directory creation.
- Enterprise — limit enterprise object name lengths; ei role column now a string instead of a dict.
- Workflow — removed force-close escalation on lease expiry; soft-close only.
- epm scim (AzureAD) — use UPN as the username; improved epm scim ad manual.
- Slack — fixed keyring slack-app issue.
- KCM import — resolved Windows file-permissions mismatch during sync.
🔧 Internal / Maintenance
- Updated generated proto files.
- Docker image build now uses the config.json file from params.

Keeper Commander 18.0.4
Security
- Service mode hardening: Restricted cross-API-key usage on GET requests and blocked command injection via line breaks in service-mode payloads.
New features
- share-folder --roe / list-sf --roe-eligible: Added Restrict-Outside-Editing flags to share-folder and a matching filter to list-sf so you can find and create folders that are ROE-eligible.
- list-sf now available in service mode: Added list-sf to the integration command list so it can be invoked over the REST service.
- Platform-standard config location: config.json is now stored in the OS-appropriate user data folder by default (still overridable via KEEPER_CONFIG_FILE / --config).
Bug fixes
- import --update duplicating Login records
- Custom labels extended to login, url, oneTimeCode, and password

Keeper Commander release version v18.0.3
Highlights
- Added nhi-report for Non-Human Identity reporting.
- Added OS-native keychain storage for Commander configuration.
- Renamed KeeperDrive CLI commands from the kd-* prefix to nsf-*.

Keeper Commander 18.0.2
Features & Enhancements
- connect / ssh: confirmation prompt before shell command execution
- pam search --device — new flag to look up PAM Gateways and the PAM Configurations bound to them
- share-record: --rotate-on-expiration (ROE) flag — sharing can now be marked to rotate the underlying record when access expires
- Docker service integration improvements
Fixes
- action-report: targets like -t no-logon / -t no-update were returning all active users instead of the filtered set
- User-folder API response now includes path and records fields again
Security
- Local DAG SQLite database is now created with 0o600 permissions instead of world-writable 0o777

Keeper Commander 18.0.1
Breaking changes
- Dropped Python 3.7 support. Minimum supported Python is now 3.8
New commands & features
SSO / Identity
- New sso-cloud command suite for managing Keeper SSO Connect Cloud configurations.
Cloud Secrets
- New cloud secrets import commands for importing secrets from external cloud providers.
KeeperPAM
- New pam connection jit command for managing Just-In-Time (JIT) settings on PAM resource records.
- New --proxy flag for pam tunnel start to enable KeeperDB Proxy mode.
- New saas profile option for pam rotation edit.
- pam launch now available from SuperShell.
- pam tunnel diagnose gains TURN/STUN end-to-end probes and per-test flags; log noise reduced.
- pam project import / extend now supports defining workflows.
Enterprise policy
- Implemented enforcement of Record Password and Record Types policies.
- shared-manager role label renamed to share-manager.
Other
- Password strength now graded via zxcvbn.
- PAM Workflow improvements and workflow-window session hard close.
- Rotation skip feature added (cp-rotation-skip-feat).
- KeeperDrive search command updated.
Fixes & Improvements
- Tunnel: SO_REUSEADDR disabled on tunnel start (prevents binding conflicts).
- PAM record update: added validations on update path.
- KeeperDrive: fixed role labels, kd-shortcut titles, removed kd-rndir inherit flags.
- Service mode: legacy service-config record titles handled gracefully on startup.
- Login UX: correct login --server hint shown for batch vs. shell mode.

Keeper Commander 18.0.0 — Release Notes
This is a major release headlined by KeeperDrive — a brand-new command suite for managing folders, records, sharing, and permissions through the Keeper API. It also adds KCM/Guacamole import for PAM, JSON output for rotation status, automation modes for tunnels, and a new way to add KSM tokens to existing applications.
KeeperDrive
A new kd-* command family for working with KeeperDrive folders, records, sharing, and permissions. All commands require authentication and a synced vault. Visibility is gated behind a feature flag so the commands appear only for permitted users.
The full reference is in KEEPER_DRIVE_COMMANDS.md.
Permission roles
The five sharing roles supported across folder and record commands:
─────────────────────┬─────────────────────────────────────────────────
Role │Description
─────────────────────┼─────────────────────────────────────────────────
viewer │Read-only access
─────────────────────┼─────────────────────────────────────────────────
shared-manager │Can manage access grants
─────────────────────┼─────────────────────────────────────────────────
content-manager │Can add / edit records
─────────────────────┼─────────────────────────────────────────────────
content-share-manager│Can add / remove / edit records and manage access
─────────────────────┼─────────────────────────────────────────────────
full-manager │Full control
─────────────────────┴─────────────────────────────────────────────────
Folder commands
- kd-mkdir — create a folder. Supports --color {none,red,orange,yellow,green,blue,gray} and --no-inherit for permission inheritance. // escapes a literal / inside a folder name.
- kd-rndir — rename a folder, change its color, or toggle permission inheritance (--inherit / --no-inherit). -q suppresses the confirmation message.
- kd-list — list KeeperDrive folders and records from the local cache. --folders / --records filters, --format {table,csv,json} and --output FILE for export. Each row reports share status and accessor count.
- kd-rmdir — remove folders. Always shows an impact preview before prompting. Modes: folder-trash (default, recoverable) or delete-permanent (irreversible). Supports --force, --dry-run, --quiet, max 100 folders per invocation.
- kd-share-folder — grant or remove access (-a {grant,remove}) to one or more folders for one or more recipients (-e is repeatable). @existing / @current targets all current users in the folder. Time-limited shares via --expire-at <ISO> or --expire-in <30d|6mo|1y|24h|30mi|never>.
Record commands
- kd-record-add — create a record. Required: -t TITLE, -rt TYPE. Optional: -n NOTES, --folder. Fields use type=value or type.label=value notation; run with --syntax-help for the full grammar.
- kd-record-update — update title, type, notes, or field values for one or more records (-r is repeatable).
- kd-rm — remove records with an impact preview. Operations:
- owner-trash (default) — move to owner's trash, recoverable.
- folder-trash — remove from a folder and trash.
- unlink — remove from a specific folder only (requires --folder).
Supports --force, --dry-run, max 500 records per invocation.
- kd-ln — link a record into a folder (kd-ln <record> <folder>) without removing it from its current location.
- kd-shortcut list / kd-shortcut keep — manage records that appear in more than one folder. list shows multi-folder records with --format {table,csv,json} and --output; keep retains a record in one folder and unlinks it from all others, with -f to skip the confirmation prompt.
Sharing commands
- kd-share-record — single command for grant / revoke / transfer-ownership via -a {grant,revoke,owner}. Required: -e EMAIL (repeatable), -r ROLE for grant. Supports -R/--recursive for bulk sharing across a folder tree, --contacts-only, --force, --dry-run, and --expire-at / --expire-in. -a grant on an already-shared record updates the existing role.
- kd-record-permission — bulk update sharing across all records in a folder (and optio

Keeper Commander 17.2.15 — Release Notes
PAM bug fixes
- Added proper error message when Workflow blocks connection
- Increased WebRTC connect timeout to accomodate for ephemeral accounts
- Added JIT / Ephemeral suport to pam launch command

Keeper Commander release version v17.2.13
PAM Fixes
- Fix rotation settings linking to PAM Configuration instead of PAM Directory when directory_uid is provided
- Skip email delivery gracefully when email.config_name is set to none/null
- Add Gateway version check
- Continue with PAM User creation when AD user already exists instead of failing
- Send DN instead of username for add-to-group operations
- Warn when delivery.share_to user may not exist in Keeper
- Remove stale delivery.method and resource_uid references
Service Mode Fixes
- Add concurrent v1 compatibility to service queue mode
- Fix queued v1 timeout race in service mode
- Keep queue-backed v1 requests waiting after processing starts

Release Notes — v17.2.12
New Features
- Bulk Legacy Record Conversion — Added convert-all command for converting legacy records in bulk
- Secrets Manager Client Revoke — Added command for quick device revocation in secrets-manager
- Secrets Manager Update — Added update option for secret-manager and updated the app get command
- PAM Gateway Edit — Added pam gateway edit command
- Action Report Move — Added move option to action-report with all-status and recursive search support
Improvements
- EPM Policy Fixes — Multiple fixes and improvements to EPM policies
- EPM Policy Time Filter — Fixed time filter to use hour integer format (HH-HH)
- EPM Policy Controls — Corrected file access policy name and control handling
- PAM Launch Improvements — Improved pam launch command
Bug Fixes
- Shared Folder get by Name — Resolved an issue where get on a shared folder returned only basic fields
- KDBX Export Sanitization — Sanitize XML text in KDBX exports and fix workflow proto import
Full Changelog: v17.2.11...v17.2.12

Release Notes — v17.2.11 (April 1, 2026)
New Features
- Atlassian Onboarding: Added AD user creation via Gateway with support for username templates.
- Domain Alias Commands — New commands for managing domain aliases.
- KEPM Report Value Command — Added report value command for KEPM.
- PAM Launch "Connect As" — Added "Connect As" options to pam launch, allowing additional records to provide credentials and host:port (#1871).
- PAM Launch Key-Event Input — Added key-event input support in pam launch for session recording (#1900).
- PAM Tunnel Diagnose Enhancements — Extended pam tunnel diagnose with full gateway readiness testing (#1885).
- Share Folder Enhancements — Added path, userId, and expiration date fields to the share folder command (#1893).
Improvements
- Share Report & Security Audit Report — Updates to share-report and security-audit-report commands (#1896).
- Secrets Folder Matching — Folders are now matched by name at any depth, reusing their IDs for secrets lookup.
- PAM Launch SSH Key Lookup — Improved lookup for launch credentials with SSH keys only (#1886).
- Decreased WebRTC Log Verbosity — Reduced log noise from keeper-pam-webrtc-rs during terminal sessions (#1879).
- Updated DAG & Discovery Modules — Updated keeper_dag and discovery_common modules.
Bug Fixes
- PEDM Policy Filters — policy add command now creates all filters.
- V2 Record Restriction — New clients are prevented from editing or adding v2 records.
- PAM Launch Fixes — Fixed double newlines on some terminals (Linux, macOS), improved handling of non-terminal protocols (#1870).
- Launch Credential Update — Fixed launch credential not updating on repeated edit of launch-user (#1884).
- PAM Launch Port Override — Fixed connection port override for pamHostname (#1881).
- Security Audit Logic — Fixed needs_security_audit logic.
- Duplicate Warnings — Fixed duplicate warnings in msp-add and en add.
- Two-Factor Duration Display — Fixed enforcement display to show single value instead of cumulative list.
- EPM Bugfixes
- Service Mode JSON — Fixed JSON handling in service mode (#1882).
- Broken Import — Fixed broken import after refactoring (#1888).

Keeper Commander release version v17.2.10
New Features
- CSPM Integration Type — Added CSPM as a supported integration type for public-api-key
- pam action debug command — New pam action debug command that dumps all record-related data as JSON for troubleshooting.
- PAM Graph Inspection — Added inspect_resource_in_graph functionality with a bugfix for JIT/AI encryption settings.
- KCM Export Script — Script to export KCM resources into a PAM Project template
- PAM KCM Importer: Template File Support — The PAM KCM Importer now accepts a template JSON file as input
Improvements
- Terminal Resize Support — Added terminal size tracking and resize event forwarding to guacd for better remote session handling.
- Custom-Field Fallback — Implemented fallback for config and service_config file types when no file storage is configured (KC-KEPM related).
- Field Label Population — record-add now populates field labels from the record type schema.
- Field Lookup by Type — Field lookup now falls back to field type when field type label is missing.
- SaaS User ACL Fix — Ensured ACL attributes are correctly set for SaaS users.
Bug Fixes
- Password Score Hang — Fixed an issue where password score calculation would hang if the password was too long.

Keeper Commander release version v17.2.9
New Features
- Implemented teams-app-setup command for Microsoft Teams integration
- Added launch_credentials support to pam project import and pam project extend commands
- Added Kubernetes config generation to PAM import tooling
- Added example PAM import generator script
Improvements
- Fixed stdout/stderr separation for POSIX-compliant piping
- Upgraded keeper_pam_webrtc_rs to >= 2.0.1
Bug Fixes
- Suppressed noisy "Successfully authenticated with Persistent Login" message in batch mode
- Fixed aging row mapping bug that could map aging columns to wrong records when rows had identical content
- Fixed staleness scope for filtered compliance queries to prevent full enterprise sync on filtered runs
- Fixed MSP node resolution and enforcement JSON output
Full Changelog: v17.2.8...v17.2.9

Keeper Commander release version v17.2.8
New Features
- Added --aging flag to compliance report with record aging data (created, last_modified, last_rotation, last_pw_change)
- Added --username and --team filters to all compliance subcommands
- Added --resolve-teams flag to sfr and team-report for expanding team filter to individual team members
- Added pam project extend command
- Added --keeper-db-proxy (-kdbp) flag to pam tunnel edit for pamDatabase records
- Added --launch-user (-lu) flag to pam connection edit for setting launch credentials
- Updated SaaS commands to use new saasConfiguration record type
- Added Enforcement and Managed Node Details to enterprise-info Roles output
Improvements
- Incremental compliance data sync with per-user staleness tracking to avoid full re-fetches on warm cache
- Per-user cache invalidation for filtered compliance reports — only stale users are fetched from the API
- Dynamic chunking with probe timeouts for preliminary compliance data fetching
- Client-side request timeouts to prevent indefinite hangs during compliance sync
- Enterprise and MSP command improvements
Bug Fixes
- Fixed trickle ICE handling for pam launch command
- Fixed lsf returning "No shared folders found" when no search string was provided
- Fixed cc and ls commands to restore regex search behavior
- Fixed invalid base64 handling
- Fixed ACL lookup skipping for configuration records (which have no parent)
- Prevented PAM records from being used in One-Time Shares
- Filtered false-positive record_password_change events in compliance report (first-set events discarded)
Full Changelog: v17.2.7...v17.2.8

Keeper Commander release version v17.2.7
New Features
- Added JIT (Just-In-Time) and AI features to PAM project import
Improvements
- Improved Gateway lookup - when missing or not shared, fallback to pam/get_configuration_controller API
- Updated commander help and command list validation logic to include aliases
Bug Fixes
- Fixed pam action debug info when viewing a PAM configuration
- Fixed duplicate attachments during slack-app-setup
- Fixed GitHub Issues #1783 & #1791
- Fixed websocket connection timing for newer websockets library
- Quieted noisy logs and added checked fields
Full Changelog: v17.2.6...v17.2.7

Keeper Commander release version v17.2.6
New Features
- supershell: claude-code-like interface for executing commands
- CLI search: token-based matching by default (tokens can appear in any order)
- Service mode: --self-destruct-flag now returns share-url response
Improvements
- supershell: enhanced focus indicators with green left border showing active pane
- supershell: improved text selection with double-click word selection and auto-copy
- supershell: vim-style scrolling (j/k, Ctrl+d/u) in shell output pane
- supershell: improved help screen with consistent theme-aware colors
- action-report: use fetch_audit_event function to query events
Bug Fixes
- Fixed supershell copy, batch mode output, and ngrok domain handling
Full Changelog: v17.2.5...v17.2.6

Keeper Commander release version v17.2.5
Improvements
- Discovery: bug fixes and improvements
- msp update: improvements
- pam launch: establish ssh sessions with ssh key credentials only
- Automate Docker-Service Mode & Slack app configuration
- Fix compliance-report chunking for >5000 users
- Enterprise command improvements and bug fixes
Full Changelog: v17.2.4...v17.2.5

Keeper Commander release version v17.2.4
Improvements
- Batch Mode: do not write help information to stdout
Full Changelog: v17.2.3...v17.2.4

Keeper Commander release version v17.2.3
Improvements
- Service mode bug fixes
Full Changelog: v17.2.2...v17.2.3

Keeper Commander release version v17.2.2
New Features
- SuperShell: a full screen TUI vault browser
- pam launch command: launches a connection to a PAM resource
- Reset password during login flow
Improvements
- compliance report: bug fixes and improvements
- Discovery: Rule Engine Changes
Full Changelog: v17.2.1...v17.2.2

Keeper Commander release version v17.2.1
New Features
- QRC implementation using MLKEM
- Added healthcheck support in service mode
Improvements
- KEPM addon support for MSPs
- record-history command: JSON output
- pedm scim command: make password argument optional
Full Changelog: v17.2.0...v17.2.1

Keeper Commander release version v17.2.0
New Features
- pedm scim command: populates KEPM collections with Azure and AD users and groups
- Gateway scaling
Improvements
- Graph endpoints refactoring
Full Changelog: v17.1.18...v17.2.0

Keeper Commander release version v17.1.18
Improvements
- Update enforcement policy definitions
Full Changelog: v17.1.17...v17.1.18

Keeper Commander release version v17.1.17
New Features
- this-device 2fa_expiration: added sub-command to change 2FA expiration.
Bug Fixes
- risk management: command help
- Session resumption bug fix
Full Changelog: v17.1.16...v17.1.17

Keeper Commander release version v17.1.16
New Features
- Enterprise Domain Management commands
Full Changelog: v17.1.15...v17.1.16

Keeper Commander release version v17.1.15
Fixes / Improvements
- pedm approval view command is added
- Risk management ID Mapping updated
- credential-provision command is added
- Fixes for Service Mode
- email-config command is added
- Fixes for Commander login-status (edited)
Full Changelog: v17.1.14...v17.1.15

Keeper Commander release version v17.1.14
Fixes / Improvements
- pam import command: import domain, gcp, oci configurations
- PEDM: ARAM reports
- Google Cloud Platform support
- delete-all command: update implementation
Full Changelog: v17.1.13...v17.1.14

Keeper Commander release version v17.1.13
Fixes / Improvements
- pam rotate command: fix CRON schedules
- Respect "MASTER_PASSWORD_REENTRY" enforcement
- totp and ls commands: improve output
- Service mode bug fixes
- audit-report command: output regex filtering
Full Changelog: v17.1.12...v17.1.13

Keeper Commander release version v17.1.12
New Features
- PEDM
Full Changelog: v17.1.11...v17.1.12

Keeper Commander release version v17.1.11
New Features
- Docker: KSM based authentication
- Docker: KSM Utility
- Added Support for Cloudflare in Service Mode
Fixes / Improvements
- pam config command: AD configuration
- pam config edit command: --key-event argument
Full Changelog: v17.1.10...v17.1.11

Keeper Commander release version v17.1.10
New Features
- Service mode help system
Full Changelog: v17.1.9...v17.1.10

Keeper Commander release version v17.1.9
New Features
- Device Management Commands
- Publish Commander container on new builds
Fixes / Improvements
- pam rbi edit command
- login-status command
- Improve service mode functionality and CLI usability
- Persist API params in global state for reuse
Full Changelog: v17.1.8...v17.1.9

Keeper Commander release version v17.1.8
Fixes / Improvements
- pam import command improvements
- Dockerfile creates commander user
Full Changelog: v17.1.7...v17.1.8

Keeper Commander release version v17.1.6
Fixes / Improvements
- import command: CyberArk user portal support
- audit-alert command: bulk enable/disable
- pam rotation edit command: bug fixes
- one-time-share command: support editable shares
- Commander service mode: added API versioning
Full Changelog: v17.1.6...v17.1.7

Keeper Commander release version v17.1.6
Fixes / Improvements
- audit alert command: support bulk enable/disable
- pam tunnel stop command: gracefully shutdown websocket connection
- breachwatch command: improve command messages
- pam rotation edit folder command: bug fixes
Full Changelog: v17.1.5...v17.1.6

Keeper Commander release version v17.1.5
Fixes / Improvements
- Resolved biometric login compatibility on Enterprise devices with Windows Hello
Full Changelog: v17.1.4...v17.1.5

Keeper Commander release version v17.1.4
New Features
- Passkey Authentication
Fixes / Improvements
- RESTRICT_TOTP_FIELD enforcement support
- KSM app sharing: bg fixes
- PAM: use Trickle Ice when connecting using WebRTC
- Prevent creation of nodes with empty names
- import: suppress certificate errors during file upload
- Fix the GovCloud endpoint subdomain
Full Changelog: v17.1.3...v17.1.4

Keeper Commander release version v17.1.3
Fixes / Improvements
- list-team command: Fix duplication bug and add sort option
- Update 'warning' color for better readability
- Update SaaS config creation to allow field type multiline
- download-membership command: ignore Lastpass shared folders with empty names
- Improve SSL certificate handling for corporate environments
- record-add command: comprehensive documentation
- KSM app-sharing: grant minimal user-access to app-shares regardless of app-user's membership type
- KSM app-sharing: disable sharing app w/ admin permissions
- Fix Yubikey 'largeBlob' login issue
Full Changelog: v17.1.2...v17.1.3

Keeper Commander release version v17.1.2
Fixes / Improvements
- fix empty security data
- dropped support for Python3.6
- Examples for pam project import command
Full Changelog: v17.1.1...v17.1.2

Keeper Commander release version v17.1.1
Fixes / Improvements
- pam project command
- CyberArk import: bug fixes
- Bug fixes
Full Changelog: v17.1.0...v17.1.1

Keeper Commander release version v17.1.0
Fixes / Improvements
- Service mode: mask password in logs
- PDF report output: support TTF fonts in binary build
- pam rotate command: rotate multiple records
- license-consumption-report command: added
- Bug fixes
Full Changelog: v17.0.21...v17.1.0

Keeper Commander release version v17.0.21
Fixes / Improvements
- pam gateway command: version column is added
- fido2 v2.0.0
- reports: pdf output target
- Service mode: fixes
Full Changelog: v17.0.20...v17.0.21

Keeper Commander release version v17.0.20
Fixes / Improvements
- CyberArk import Improvements
Full Changelog: v17.0.19...v17.0.20

Keeper Commander release version v17.0.19
Fixes / Improvements
- audit-report: support shared folder filter for record audit events
- CyberArk import Improvements
Full Changelog: v17.0.18...v17.0.19

Keeper Commander release version v17.0.18
Fixes / Improvements
- Keeper Sevice Mode: bug fixes
- pam debug command: Improve logging
Full Changelog: v17.0.17...v17.0.18

Keeper Commander release version v17.0.17
Fixes / Improvements
- Service Mode: bug fixes
- Import from Dashline
- rus-as command: MacOS and Linux
Full Changelog: v17.0.16...v17.0.17

Keeper Commander release version v17.0.16
Fixes / Improvements
- Suppress team key warning in batch mode
- CyberArk import: bug fixes
- Allow user to set special characters for PAM rotation.
Full Changelog: v17.0.14...v17.0.16

Keeper Commander release version v17.0.14
Fixes / Improvements
- Suppress team key warning in batch mode
- CyberArk import: bug fixes
Full Changelog: v17.0.13...v17.0.14

Keeper Commander release version v17.0.14
Fixes / Improvements
- Security Audit improvements
- CyberArk import: bug fixes
Full Changelog: v17.0.13...v17.0.14

Keeper Commander release version v17.0.12
Fixes / Improvements
- Binary build uses Python 3.12
- Discovery & Rotation: chunk database writes.
Full Changelog: v17.0.11...v17.0.12

Keeper Commander release version v17.0.11
Fixes / Improvements
- Commander's Service Mode Docker deployment
- distributor command: PAN add on support
- add security-score data support
Full Changelog: v17.0.10...v17.0.11

Keeper Commander release version v17.0.10
What's Changed
Misc. fixes and improvements to list-team, Compliance Reporting, share-folder, PAM connections
Full Changelog: v17.0.8...v17.0.10

Keeper Commander release version v17.0.9
What's Changed
Additions
- Commander's Service Mode
- pam action saas command: SaaS rotation commands
- pam connection command: Manage PAM Connections
Fixes / Improvements
- enterprise-node command: change node name bug fix
- share-record command: verify the sharee user email
- password-report command: bug fixes
Full Changelog: v17.0.8...v17.0.9

Keeper Commander release version v17.0.6
Fixes / Improvements
- rotate command: support password length
- import command: CyberArk Privileged Access Cloud
- share-folder and pam config commands: use 3-state value for permissions
- compliance report command: improvements
Full Changelog: v17.0.6...v17.0.8

Keeper Commander release version v17.0.6Fixes / Improvements
- pam discovery improve user discovery
- pam action service command is added
- rotate command: support for custom record types
Full Changelog: https://github.com/Keeper-Security/Commander/compare/v17.0.5...v17.0.6

Keeper Commander release version v17.0.5Fixes / Improvements
- switch-to-mc command: fix for EC-Only MSP
- pam legacy command: switch to PAMv1 command set
- pam config command: remote browser isolation
Full Changelog: https://github.com/Keeper-Security/Commander/compare/v17.0.4...v17.0.5

Keeper Commander release version v17.0.4Fixes / Improvements
- pam action gateway-info command: display gateway verbose information
- pam action rotate command: fix
Full Changelog: https://github.com/Keeper-Security/Commander/compare/v17.0.3...v17.0.4

Keeper Commander release version v17.0.3Fixes / Improvements
- msp-billing-report: add 'max_licenses' column
- fix for share-folder bug w/ share-folder --e TEAM
- fix for pam tunnel start command
- fix for pad discovery command
- multiple fixes for EC-Only enterprises

Keeper Commander release version v16.11.22What's Changed
Additions
- PAM Discovery & Rotation commands
Fixes / Improvements
- msp-convert-node command: bug fix
- clipboard-copy command: output to variable
Full Changelog: https://github.com/Keeper-Security/Commander/compare/v16.11.22...v17.0.2

Keeper Commander release version v16.11.22What's Changed
Additions
- CyberArk import support
Fixes / Improvements
- msp-billing-report: fix for avg. license count bug for non-company-level reports, added initial and final billing period license-count snapshot for non-daily reports
- fix for team-creation bug w/ enterprise-team --add
- fix for fido compatibility bug
- fix/optimization for `transform-folderz
Full Changelog: https://github.com/Keeper-Security/Commander/compare/v16.11.21...v16.11.22

Keeper Commander release version v16.11.21What's Changed
Improvements / Fixes
- transform-folder: Fix for bug "exceeded_depth" error.
- import: attachments are not imported from KeePass
- PAM enforcements
Full Changelog: https://github.com/Keeper-Security/Commander/compare/v16.11.20...v16.11.21

Keeper Commander release version v16.11.20What's Changed
Improvements / Fixes
- clipboard-copy: Fix for bug preventing output of compound fields
- Python3.13 support
Full Changelog: https://github.com/Keeper-Security/Commander/compare/v16.11.19...v16.11.20

Keeper Commander release version v16.11.19What's Changed
Improvements / Fixes
- audit-alert: Fix for bug preventing adding of web hook recipients
- automator: Allow multiple automators per a node
Full Changelog: https://github.com/Keeper-Security/Commander/compare/v16.11.18...v16.11.19

Keeper Commander release version v16.11.18What's Changed
Additions
- Risk Management Dashboard (risk-management user/alert)
Improvements / Fixes
- share-record: Fix for bug preventing creation of new record-shares
- RSA encryption phase-out
Full Changelog: https://github.com/Keeper-Security/Commander/compare/v16.11.17...v16.11.18

Keeper Commander release version v16.11.17What's Changed
- security-audit-report: Fix for bug resulting in incompatibility between console and Commander, minor output format change
- ots/share list/create: Added support for batch operations
Full Changelog: https://github.com/Keeper-Security/Commander/compare/v16.11.16...v16.11.17

Keeper Commander release version v16.11.16What's Changed
- connect command: Bug-fix for handling special characters
Full Changelog: https://github.com/Keeper-Security/Commander/compare/v16.11.15...v16.11.16

Keeper Commander release version v16.11.15What's Changed
- Added scripts for AWS Lambda set-up example
- AWS plugin: Bug-fix for cross-account IAM Access Key rotation
Full Changelog: https://github.com/Keeper-Security/Commander/compare/v16.11.14...v16.11.15

Keeper Commander release version v16.11.14What's Changed
Fixes / Improvements
- Minor bug-fixes for automator, share-record
- SDK: Config file no longer written to filesystem when no filename is specified in non-CLI mode
Full Changelog: https://github.com/Keeper-Security/Commander/compare/v16.11.13...v16.11.14

Keeper Commander release version v16.11.13What's Changed
Misc. login-flow bug-fixes / error-loggingFull Changelog: https://github.com/Keeper-Security/Commander/compare/v16.11.12...v16.11.13

Keeper Commander release version v16.11.12What's Changed
Bug-fixes:
- record-permission: owned records are skipped
Full Changelog: https://github.com/Keeper-Security/Commander/compare/v16.11.11...v16.11.12

Keeper Commander release version v16.11.11What's Changed
Improvements:
- ssh: allow use of pamUser record credentials
- LastPass import: improve error-handling/reporting
Bug-fixes:
- find-duplicate --scope=enterprise: exclude deleted records from report
Full Changelog: https://github.com/Keeper-Security/Commander/compare/v16.11.10...v16.11.11

Keeper Commander release version v16.11.10What's Changed
- security-audit-report:
1. Support for detecting and resetting vaults with mis-aligned summary scores (via --attempt-fix option)
2. "Sync Pending" column in report to indicate vaults with inaccurate summary scores due to unfinished security-data sync
3. Fix for error when incremental data "strength" field not defined (vault now flagged for fixing via --attempt-fix option)
4. Misc. help text improvements
- 2FA Login bug-fix
Full Changelog: https://github.com/Keeper-Security/Commander/compare/v16.11.9...v16.11.10

Keeper Commander release version v16.11.9What's Changed
Additions:
- trash: Support for viewing and restoring deleted shared records and share folders
- security-audit-report: Support for repairing corrupted security-audit data
Improvements/Bug-fixes:
- transform-folder: Share permissions now removed from share folders prior to transformation/removal
- enterprise-role:
1. fix for bug not allowing setting of role enforcement policy RESTRICT_MOBILE_ACCESS
2. enabled execution of command in non-interactive mode
Full Changelog: https://github.com/Keeper-Security/Commander/compare/v16.11.8...v16.11.9

Keeper Commander release version v16.11.8What's Changed
Improvements / Bug-fixes
- security-audit-report error-reporting: more granular and specific error messages when decoding fails
- aging-report: fix for pre-mature command exit when neither cut-off date nor period are specified
- import --format json: ignore imported record schema if record-type exists
Full Changelog: https://github.com/Keeper-Security/Commander/compare/v16.11.7...v16.11.8