Release 1.2.2

New Features

Device Management — Admin Commands

New CLI commands and SDK support for enterprise device administration:

• device-admin list — List all devices across the enterprise with filtering options
• device-admin action logout — Remotely log out a device
• device-admin action remove — Remove a device from the enterprise

Device Management — Lock/Unlock

New commands for locking and unlocking devices and accounts:

• device action lock / device action unlock — Lock or unlock a specific device
• account-lock / account-unlock — Lock or unlock a user account

PAM — Rotate on Expire for Shared Folders

PAM rotation now supports the rotate on expire flag for shared folders containing PAM user type records. Updated commands: pam rotate, pam discover, and share-folder.

---

Bug Fixes

• NSF permission fixes — Corrected permission enforcement for Nested Shared Folders (NSF) and record sharing. Resolved incorrect permission grants when sharing records within NSF structures.
• Device command resolution — Removed substring matching for device selection; commands now require an exact device match. Also fixed resolution ambiguity when an action targets multiple devices.

---

Internal

• Added unit tests for device management commands, NSF permission logic, and share rotate-on-expiration behavior.

Release 1.2.1

Release Notes — v1.2.1

Patch release with bug fixes for NSF team sharing and sync-down error handling.

Bug Fixes

• NSF team key encryption — Fixed issue in sharing folder with teams
• Sync down — Fixed team UID resolution in error logging when team key decryption fails during sync
• NSF record sharing — Improved error messages

Release 1.2.0

Release Notes — v1.2.0

New CLI Commands

• NSF (Nested Shared Folders) — nsf-list, nsf-get, nsf-mkdir, nsf-rmdir, nsf-rndir, nsf-rm, nsf-ln, nsf-record-add, nsf-record-update, nsf-record-details, nsf-share-folder, nsf-share-record, nsf-record-permission, nsf-transfer-record, nsf-shortcut

• KeeperPAM — pam command group: gateway management, configuration, rotation, connections, RBI, discovery, SaaS, services, and debug utilities

• MSP — msp-down, msp-info, msp-add, msp-update, msp-remove, msp-convert-node, msp-copy-role, msp-billing-report, msp-legacy-report, switch-to-mc, switch-to-msp

• Device Management — device-list, device-rename, device-remove, device-logout

• One-Time Share — share-create, share-remove, share-list

• Record Permissions — record-permission

• Secrets Manager — App update and share update commands added to secrets-manager-app / secrets-manager-share

SDK Enhancements

• Nested Shared Folders — Full NSF support: management, sync, sharing, crypto, and storage (nsf_management.py, nsf_sync.py, nsf_sharing.py, memory_nsf_storage.py, sqlite_nsf_storage.py)

• One-Time Share — New one_time_share.py module for creating, listing, and removing one-time shares

• Skip-Sync Sharing — New skip_sync.py for sharing/revoking shared folders with teams and users without a full vault sync

• Commander Config — New configuration.py for loading SDK config from Keeper Commander config files

• KeeperPAM / DAG — Keeper DAG helper library for PAM graph and tunnel operations; email and router utilities for gateway workflows

• Device Management — New device_management.py authentication module with protobuf support

• MSP Auth — Extended msp_auth.py for managed company operations and role switching

• KSM Management — App update and share-update support added to ksm_management.py

• Share Management — Extended share_management_utils.py for v3/v4 record sharing and permission handling

Examples & Documentation

• Persistent Login & MFA — All SDK example scripts updated with persistent login flow and MFA support

• New Examples — NSF (17 scripts), MSP (10 scripts), device management (4 scripts), one-time share, skip-sync sharing, sharing commands, KSM app clients/secrets, AWS Lambda list-records sample

• README — Updated sample scripts and usage documentation

Bug Fixes

• Fixed sync_down: manageUsers now correctly copied into team manage_users
• Fixed password report command output and logic
• Fixed KEPM policy handling in PEDM admin
• Fixed share-report and security-audit-report generation

Release 1.1.0

Release Notes — v1.1.0

New CLI Commands

• generate — Password generation with multiple strategies (basic, advanced, diceware, recovery phrase, crypto-based)
• 2fa — Manage two-factor authentication methods for enterprise users, including YubiKey support
• pam-gateway — PAM gateway management commands
• compliance — Compliance reporting commands (record access, shared folders, teams, summary)
• enterprise-push — Push records to enterprise users
• aging-report / action-report — Vault aging and action reporting
• security-audit-report — Security audit report generation
• share-report / shared-records-report / external-shares-report — Share and external share reporting
• breachwatch-report — BreachWatch report command
• user-report — Enterprise user report command
• verify-records / verify-shared-folder — Record and shared folder integrity verification
• reset-password — Reset user password
• team-approve — Team approval command

SDK Enhancements

• Record & Folder Share Management — Full sharing API added to SDK: shares_management.py, share_management_utils.py, shared_record.py
• Share Reports — share_report.py, shared_records_report.py, external_shares_report.py added to vault module
• Expanded KSM Management — Significant additions to Secrets Manager application management (ksm_management.py)
• Security Audit Report — New security_audit_report.py in enterprise module
• User Report — New user_report.py in enterprise module
• Compliance Module — New compliance.py with SOX compliance storage support
• Two-Factor Auth Utilities — New two_fa_utils.py for 2FA management helpers
• certificate_check property — endpoint.set_certificate_check() to toggle TLS verification
• PEDM improvements — Approval extension, "last seen" tracking, expiration parser

Bug Fixes

• Fixed asyncio event loop cleanup when using SSO authentication with push notifications (login websocket now closed immediately after auth
  completes)
• Fixed invalid device error recovery during login
• Various SDK and CLI bug fixes
• Fixed User-Role and Team-Role correlation handling

Release 1.0.1

Keeper Commander release version v1.0.1

New Features

• Keeper Endpoint Privilege Manager commands.

Full Changelog: Keeper-Security/Commander@v1.0.0...v1.0.1

Release 1.0.0

v1.0.0

Release 1.0.0