Skip to main content

Install on Windows

SigmaShake works on Windows 10 (Build 17063+) and Windows 11, x64 only. ARM64 native support is on the roadmap; for now ARM64 devices can run the x64 build under Windows on Arm emulation.

Free forever for individuals. 5,000 governance evaluations per day, no signup, no credit card. Upgrade to Pro any time for unlimited evals and team-wide audit sync.

Quick install​

Pick one. They all install the same ssg.exe and co-binaries.

winget install SigmaShake.SSG

Adds ssg to PATH automatically as a portable command alias — open a new terminal and ssg --version works immediately.

PowerShell one-liner​

iwr -useb https://install.sigmashake.com/install.ps1 | iex

This script:

  1. Downloads @sigmashake/ssg-win32-x64 straight from the npm registry CDN — no Node.js or npm needed.
  2. Verifies the tarball against a pinned SHA-256.
  3. Extracts to %LOCALAPPDATA%\Programs\ssg\ (default).
  4. Adds that directory to your User Path environment variable.
  5. Optionally runs ssg setup (skip with -NoSetup).

Open a fresh terminal after the install so PATH picks up the new directory.

npm / pnpm​

pnpm add -g @sigmashake/ssg
# or
npm install -g @sigmashake/ssg

The npm coordinator package resolves to @sigmashake/ssg-win32-x64 and drops the same binaries into your global node_modules.

Verify the install​

ssg --version           # should print: 0.29.85 (or newer)
ssg --help

If ssg isn't found after a fresh PowerShell installer run, open a new terminal. PATH changes don't propagate into the shell that ran the installer.

First-run setup — ssg init​

cd C:\path\to\your-project
ssg init

This does four things on Windows:

  1. Writes .sigmashake/ (governance rules + presets) into your project.
  2. Auto-detects every AI agent on the machine (Claude Code, Cursor, Copilot, Codex, Gemini CLI, Antigravity, etc.) and wires C:\…\ssg-hookw.exe hook eval into each adapter's settings file.
  3. Patches .vscode/mcp.json to register the ssg-governance MCP server for GitHub Copilot.
  4. Registers a Windows Task Scheduler entry so ssg daemon starts at user login and restarts on crash.

Then it prints a status report you can verify with ssg status.

Why ssg-hookw.exe? It is the windowless twin of ssg.exe, built against the Windows GUI subsystem so Claude Code's PreToolUse hook doesn't briefly flash a console window every time you fire a tool call. Functionally identical to ssg hook <subcommand>.

What got installed​

ssg init writes these files into your project (all reversible):

PathPurpose
.sigmashake/config.tomlDashboard port, eval timeout, per-agent toggles
.sigmashake/rules/security.rulesStarter security rules (destructive shell, .env reads)
.sigmashake/presets/minimal.rulesBare-minimum starter preset
.sigmashake/presets/strict.rulesStricter preset with deploy approval gates
.gitignore (modify)Appends .sigmashake/rules/autopilot.rules
.claude/settings.jsonAdds 8 hook entries (PreToolUse, UserPromptSubmit, …)
.vscode/mcp.jsonRegisters the ssg-governance MCP server
.gemini/policies/ssg-governance.tomlGemini CLI policy file (if Gemini installed)

Useful flags​

FlagWhat it does
--client=<name>Install one adapter only (claude-code, copilot, cursor, codex, gemini, antigravity, pi)
--smartDetect your project's tech stack and pull matching Hub rulesets
--globalWrite hook config to %USERPROFILE%\.claude\settings.json so it covers every project
--no-autostartSkip the Task Scheduler entry (set SSG_NO_AUTOSTART=1 to make it the default)

Daemon control​

ssg autostart status     # is the Task Scheduler entry present and running?
ssg autostart disable    # stop + remove the scheduled task
ssg autostart enable     # install + start the scheduled task (idempotent)

The autostart entry runs as your user — no elevated permissions, no system service.

Restart VS Code after init​

If the Copilot adapter was installed, VS Code needs a restart to load the new MCP server registration from .vscode/mcp.json. Close every window and re-open the workspace.

Use it for free​

You're done — ssg works immediately on the Free tier:

  • 5,000 evals/day (resets at local midnight)
  • All adapters (Claude Code, Cursor, Copilot, Gemini, Codex, etc.)
  • All built-in rules (security, destructive-ops, secrets, etc.)
  • Local audit log at %USERPROFILE%\.sigmashake\audit.db

Check your usage anytime:

ssg status
ssg flight                # last 24h dashboard

Upgrade to Pro (optional)​

ssg auth login           # opens accounts.sigmashake.com in your browser

Pro is $60/month or $500/year. Enterprise pricing on sigmashake.com/pricing. The license JWT is issued automatically after payment — re-run ssg auth login to refresh.

SigmaShake Desktop — the desktop app (optional)​

SigmaShake Desktop is a tray app that wraps ssg for non-CLI users. It runs the governance daemon, surfaces approvals as native Windows toasts, and opens the dashboard in a webview.

Download​

BuildDownload
Windows x64 (.exe)SigmaShakeDesktop.exe

The .exe is a self-extracting bundle (~14–16 MB). Delta-patch updates keep your install current after first launch.

Install​

  1. Run the downloaded .exe.
  2. SmartScreen will warn "Windows protected your PC" on first launch — the binary is Azure Code Signed but Microsoft's reputation cache lags behind every new release. Click More info → Run anyway.
  3. The app drops into your system tray (no taskbar entry).

What it does​

  • Lives in the system tray — right-click for Open Dashboard, Settings, Diagnostics, Quit.
  • Health probe every 5 s — tray icon turns red if the governance daemon stops.
  • Native Windows toasts when an agent's tool call hits an ask-mode rule.
  • Auto-launches ssg daemon + ssg serve on startup; manages port hunting in the 5599–5603 range.
  • Bundles its own copy of ssg.exe — installing the desktop app also installs the CLI under %LOCALAPPDATA%\Programs\SigmaShakeDesktop\resources\ssg.exe. If you installed the CLI separately via winget or PowerShell, the standalone CLI takes precedence on PATH.

First-run wizard​

The desktop app opens a one-time wizard asking which profile to apply:

  • Personal — relaxed defaults, single-user, no audit sync
  • Professional — strict defaults, structured logging, team-sync ready
  • Enterprise — fail-closed mode, license required, MDM-ready

For solo developers: pick Personal. Change later in Settings.

Combined CLI + Desktop install​

The fastest path for a brand-new Windows machine:

# 1. CLI (winget gets PATH right)
winget install SigmaShake.SSG

# 2. Desktop app (drag-and-drop install)
# https://download.sigmashake.com/desktop/electrobun/stable-windows-x64-SigmaShakeDesktop.exe

# 3. Wire your project
cd C:\path\to\your-project
ssg init
ssg status              # verify daemon, dashboard, hooks

If you're a Claude Code user, you can ask Claude to do this for you with /init-windows — the skill resolves the ssg.exe path, runs ssg init in the project, and reports a single-page status. See the skill source at shared/agent-config/skills/init-windows/SKILL.md.

Update​

The CLI auto-updates inside its version range. To pull the latest:

winget upgrade SigmaShake.SSG              # if installed via winget
pnpm add -g @sigmashake/ssg@latest         # if installed via npm
iwr -useb https://install.sigmashake.com/install.ps1 | iex   # PowerShell installer is idempotent
ssg update                                  # all install methods

SigmaShake Desktop checks for updates on launch and prompts when a new version is available.

Uninstall​

ssg uninstall --yes                         # remove ssg + %USERPROFILE%\.sigmashake\
winget uninstall SigmaShake.SSG             # if installed via winget
# or remove %LOCALAPPDATA%\Programs\ssg\ manually for the PowerShell installer

# Desktop app:
# Settings → Apps → SigmaShake Desktop → Uninstall

ssg uninstall cleans up:

  • %USERPROFILE%\.sigmashake\ (audit log, license, daemon socket)
  • All .claude/settings.json files in your home tree (strips ssg hook entries)
  • Any %USERPROFILE%\.gemini\, %USERPROFILE%\.codex\ adapter configs
  • The Task Scheduler entry registered by ssg autostart enable

It does not touch winget's own metadata or installed node_modules.

Permissions you'll be asked for​

PermissionWhyWhen asked
SmartScreen pass-throughReputation cache for newly-signed buildsFirst launch of SigmaShake Desktop
NotificationsNative Windows toasts for ask-mode rulesFirst time SigmaShake Desktop fires a toast
NetworkOnly used for ssg auth login and Hub ruleset pullsFirst Pro upgrade or first --smart init

ssg (CLI) does NOT request: microphone, camera, location, or any elevated/admin permission. Every governance evaluation is local.

Troubleshooting​

ssg: command not found after PowerShell install​

You're in the same terminal that ran the installer. Open a new PowerShell window — PATH only updates for new shells. Or run:

$env:Path += ";$env:LOCALAPPDATA\Programs\ssg"

…to patch the current session.

ssg init says "ssg" not found on PATH even though I just installed it​

This is the same shell-vs-environment issue. From the binary's install directory:

& "$env:LOCALAPPDATA\Programs\ssg\ssg.exe" install

ssg install is the official PATH-fix command — it writes the install directory to your user Path env var. Open a new terminal afterwards.

Hooks fire but Claude Code doesn't see decisions​

Restart Claude Code. Hooks are read once at process start.

Brief black console flash on every tool call in Claude Code​

This is an upstream Claude Code Windows bug, not an SSG bug. When Claude Code fires a hook on Windows, it wraps the configured command string in bash.exe -c "..." and spawns Git Bash without setting the windowsHide flag. Git Bash is a CONSOLE-subsystem PE, so Windows allocates a fresh conhost.exe window for it — the visible flash you see on every tool call.

SSG ships ssg-hookw.exe as a GUI-subsystem (windowless) binary so the loader never allocates a console for it directly. That fix works only when Claude Code spawns the binary itself; once Anthropic's CLI wraps the command in bash.exe -c, the bash process is the one allocating the console, and SSG can't override it from outside.

What we've done to reduce the noise (v0.29.90+):

  • Removed the wasted Windows daemon-respawn fork that fired on every hook eval (the Unix-socket existence check is meaningless on Windows — the Task-Scheduler-managed daemon is already running).
  • Verified every remaining child spawn in the eval path passes windowsHide:true to Bun so any console subsystem child is hidden.

Workarounds while waiting on Anthropic:

  1. Use SigmaShake Desktop — it bundles the dashboard in a native window and surfaces approvals as Windows toasts, so you can run Claude Code in --no-hook mode (or skip the CLI entirely for approval workflows).
  2. Run Claude Code from a fully detached terminal session (e.g. WezTerm or Windows Terminal pinned to a workspace) so the flashes are confined to that workspace and don't steal foreground focus.

Track the upstream fix: if you see this and want to push for a Claude Code fix, file an issue at github.com/anthropics/claude-code with a reproducer pointing at this section.

Daemon won't start at login​

ssg autostart status
schtasks /Query /TN "SigmaShake-Daemon" /V /FO LIST

Re-register with ssg autostart enable. If the task is in a failed state, manually delete it via Task Scheduler and re-enable.

Dashboard port 5599 is busy​

Edit .sigmashake/config.toml and change dashboard_port. Restart with ssg daemon --stop && ssg daemon. Port hunting (5599→5603) is automatic when SigmaShake Desktop starts the daemon, but a CLI-launched daemon honors your config exactly.

package/bin/ssg.exe SHA256 mismatch during PowerShell install​

The installer pins a SHA-256 per release. If you see this, the npm registry served you a different binary than expected — almost always because you're between an OS-specific Windows publish and the coordinator package catch-up. Wait an hour and retry, or pull the canonical zip from github.com/sigmashakeinc/ssg/releases.

SigmaShake Desktop won't launch​

  1. Run from PowerShell to surface the actual error: 
    & "$env:LOCALAPPDATA\Programs\SigmaShakeDesktop\SigmaShakeDesktop.exe"
  2. Check %USERPROFILE%\.sigmashake\desktop.<date>.log.
  3. File a bug at github.com/sigmashakeinc/sigmashake-mono/issues.

Other SigmaShake products on Windows​

ProductStatus on WindowsWhat it does
ssg CLI✅ ProductionThe governance engine. Free 5,000 evals/day. Install via winget/npm/PowerShell above.
SigmaShake Desktop✅ ProductionSystem-tray app. Download from sigmashake.com/desktop or the .exe link earlier on this page.
SigmaShake Voice🟡 RoadmapWhisper-powered voice-to-text. macOS + Linux today; Windows on the v1 roadmap.
SigmaShake Gaze❌ Linux-only (v0)Webcam eye-tracking. Windows support on the v1 roadmap.

What's next​