> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/release-notes/developer-tools/commander/commander-18.1.6.md). # Commander 18.1.6 Released on Sep 29, 2026 This release adds KeeperPAM proxy and import capabilities. It also strengthens Service Mode and enterprise permission checks. Several reliability fixes are included. ### Highlights * Added KeeperRDP and KeeperSSH Proxy support for PAM tunnels, alongside KeeperDB Proxy. Use `pam tunnel start --proxy` to select the applicable resource proxy. Use `--credential` to override the linked RDP or SSH credential when permitted. Proxy-ready messages now appear after connection. * Added `pam tunnel edit --keeper-proxy on|off|default` for supported resource protocols. Improved tunnel discovery, cross-process cleanup, proxy diagnostics, and ephemeral JIT credential handling. * Added Nested Shared Folder support to CyberArk PAM project imports with `--nsf`. Imports include folders, records, rotation, and PAM configuration. They can also match an existing shared folder by UID. * Added HashiCorp Vault PAM configuration through `pam config new/edit --environment hashicorp`. Configure the Vault URL, token, namespace, mount path, and HashiCorp ID. ### Security and access controls * Service Mode now blocks access to its own configuration records. It also protects integration configuration records, including SailPoint configuration. App-setup commands are restricted to their allowlists. Variable expansion cannot bypass the SailPoint command guard. * Delegated administrators cannot grant or revoke sensitive enterprise privileges they do not hold. PAM gateway creation and removal now enforce the `allow_pam_gateway` policy, including legacy commands. * Sensitive typed-record values are masked in record-add, record-update, debug, and Service Mode API logs. ### Fixes and improvements * Fixed stale revision errors when editing PAM rotation by refreshing the cache. Restored the gateway name in `pam rotation info`. * Fixed Service Mode background operation and tunneling on Windows. * Fixed truncated `application_info` and `account_info` fields in `epm approval list` JSON and CSV output. * Fixed an incorrect “Supported columns” warning for base fields in `enterprise-info`. * Improved enterprise root-node renaming, display-name handling, and root-node visibility. * Added an optional path-aware mode for `keeper-dag` edges. Edges on different paths are no longer inadvertently deactivated. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.keeper.io/release-notes/developer-tools/commander/commander-18.1.6.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.