AgentGuard

Public alpha · Windows amd64

Install AgentGuard.
Verified and ready on PATH.

The installer downloads the pinned v0.1.0-alpha.4 release, verifies its SHA-256 checksum, and places a stable agentguard.exe on your user PATH.

Download install.ps1 Use the manual path

Unsupported pre-release for Windows amd64 only. There is no background process, silent update, or package-manager installation.

INSTALL AND VERIFY

One script, then one project command.

Download install.ps1, review it, and run it in PowerShell. It verifies the release before changing the installation or PATH:

powershell -NoProfile -ExecutionPolicy Bypass -File .\install.ps1
# Open a new terminal, then:
cd C:\path\to\your\project
agentguard init

agentguard init uses the current project directory and the stable installed executable by default, then reports the settings and binary paths it configured.

MANUAL INSTALL AND VERIFY

Keep the executable and checksum together.

For the fully manual path, download the versioned executable and matching checksum, then run:

$exe = Get-Item .\agentguard-v0.1.0-alpha.4-windows-amd64.exe
$expected = (Get-Content "$($exe.FullName).sha256").Split()[0].ToLowerInvariant()
$actual = (Get-FileHash -Algorithm SHA256 $exe.FullName).Hash.ToLowerInvariant()
if ($actual -ne $expected) { throw "checksum mismatch: refusing to run" }
& $exe.FullName version

Keep the verified executable at a stable path named agentguard.exe. From a disposable project, register it with agentguard init; --dir and --binary remain available for an explicit custom setup.

HUMAN-CONTROLLED UPDATES

Check, download, verify, replace.

  1. Run agentguard version --check. It verifies the signed website manifest and prints the current website download URL when a newer release exists.
  2. Stop active AgentGuard commands, download the newly published install.ps1, review it, and run it. The script downloads the pinned executable and matching checksum, verifies them, and replaces the stable agentguard.exe.
  3. For a manual update, download both versioned files, repeat the PowerShell checksum verification above, keep the old executable as a rollback copy, and replace the stable executable.
  4. Run agentguard version and agentguard doctor --dir <project> to verify the replacement.
  5. Run agentguard init again only when the release announcement explicitly says the hook contract changed. A normal binary replacement does not rewrite settings.

AgentGuard only reports availability. It does not download, execute, replace, or restart anything.