You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This project is in an unstable active-development phase. Git history may be rewritten and files may be added or removed at any time.
🚫 Do NOT submit Pull Requests — unsolicited PRs will not be accepted.
✅ If you encounter a problem, please open an Issue instead.
⚠️ Forks may permanently diverge from upstream due to history rewrites.
Replicate your entire Windows development environment, applications, and personal dotfiles on any new machine with a single command — plus an integrated suite of system-administration, terminal, FTP, Cloudflare DDNS, LAN clipboard sync, and monitoring tools.
Supports Chinese (zh) / English (en) / Deutsch (de) with live in-app language switching.
User & permission group management: fine-grained read/write permissions; MLSD perm facts advertised to the client (disables unavailable actions automatically)
Discover & pair: finds other machines on the LAN that also run OwO! OwOWinDeployer (UDP multicast beacon — presence only), then pairs them with a one-time 6-digit PIN. The PIN never goes on the wire — both sides prove it via a mutual HMAC challenge/response (PBKDF2), then derive an AES-256-GCM session key for an end-to-end encrypted link.
Share text + images: a shared board syncs both ways — preview entries, add text manually, delete propagates across devices, and copy any entry back to the local clipboard. Image thumbnails + a fit-to-pane preview; click to open full size in a window.
Robust discovery: per-interface multicast + directed subnet broadcast, a listen-NIC picker for machines with many virtual adapters, and a manual connect-by-IP fallback for networks that block multicast.
Optional, off by default: auto-mirror to the local clipboard (true sync) and persist history to disk; otherwise clipboard content stays in memory and clears on exit.
Device cap: the open-source build shares up to 2 devices; the transport is abstracted for a future relay-server build that lifts the cap beyond the LAN.
Process Manager (M5)
Tree view grouped by application: real-time CPU / RAM display
Filter, bulk actions (launch / kill / restart)
Icons extracted from running processes, automatically grouped
System Overview (M5)
CPU · RAM · disk · battery · Windows activation status at a glance
Enhanced SMART: bundled smartctl (ships with every release) reads internal NVMe/SATA and external USB drives; auto-detects ASMedia / JMicron / Realtek USB bridge chips; NVMe health log + full ATA attribute table; prompts admin relaunch when permissions are insufficient
Disk type badge: NVMe / SSD / HDD / USB
Safe USB eject: per-card eject button; offers force-eject (dismount volumes + release handles) when the OS rejects the request; removes the card from the UI immediately on success
One-click export of installed software inventory (CSV / HTML / JSON)
Live language switching: Chinese (zh) / English (en) / Deutsch (de) — no restart required, all UI text updates instantly
First-run auto-detect: follows the OS UI language (zh / de preferred; otherwise defaults to English)
CLI: --lang zh/en/de flag or WINDEPLOY_LANG environment variable
Software catalog summaries translated via catalog/i18n/{en,de}.json sidecars; 1,450 UI keys × 3 languages
Confirm dialogs use localized button labels (not fixed to the OS language)
scripts/check-i18n.ps1 enforces key-set and placeholder parity across all three languages
Cloudflare DDNS (Developer Mode)
Manage DNS records (A / AAAA / CNAME / MX / TXT etc.) via the Cloudflare API
Auto DDNS: polls the machine's public IP on a timer and updates the designated A record when the IP changes — ideal for residential dynamic-IP connections
Multiple domains / records supported; toggle Cloudflare proxy (orange cloud) per record
Config (API token · Zone · records) stored locally with encryption; tray menu shows current DDNS status
Security Hardening (v1.2.1)
FTPS certificate pinning (TOFU): first-connect fingerprint recorded; subsequent mismatch is refused with a clear warning
WSL injection protection: WSL operations invoke wsl.exe directly via ArgumentList (no cmd shell), distribution names validated against a strict allowlist
Web server config injection protection: vhost server_name / document root / cert paths reject ;{}#" and newline characters, preventing directive injection into nginx/Apache configs
EXE installer SHA-256 verification: when the catalog provides a sha256 field, the downloaded installer is verified before execution
ViewModel event leak fix: transient VMs (software detail, service detail) are properly disposed on navigate-away, eliminating static CultureChanged subscription leaks
App Reliability
Global crash handler: catches unhandled exceptions on the UI thread, AppDomain, and Tasks; writes crash.log and shows an error dialog — the app stays alive instead of silently crashing to the desktop
The script verifies winget, downloads the latest OwOWinDeployer.exe from GitHub Releases, and launches it.
Direct Download
Visit the Releases page and download OwOWinDeployer.exe (GUI) or owowindeployer.exe (CLI, also shipped as the shorter alias owodeploy.exe).
Prefer the ZIP package: the folder-based ZIP is less likely to trigger antivirus heuristics than the single-file self-extracting EXE.
Build & Development (requires .NET SDK 10)
# Build the full solution
dotnet build OwOWinDeployer.sln
# Run the GUI
dotnet run --project src/OwOWinDeployer.App
# Run the CLI
dotnet run --project src/OwOWinDeployer.Cli -- list
dotnet run --project src/OwOWinDeployer.Cli -- plan --profile dev
dotnet run --project src/OwOWinDeployer.Cli -- apply --profile dev --yes
Build release packages (locally, same variants as the release CI)
powershell -ExecutionPolicy Bypass -File scripts/build.ps1
# Prompts which variant(s) to build (default: framework only). Each becomes one ZIP under build/# (GUI + CLI + catalog/configs/assets/tools); intermediate folders are removed after zipping:# OwO-Win-Deployer-v<ver>-win-x64-framework.zip (framework-dependent, smallest — needs .NET 10 desktop runtime)# OwO-Win-Deployer-v<ver>-win-x64-singlefile.zip (self-contained single OwOWinDeployer.exe)# OwO-Win-Deployer-v<ver>-win-x64-with-runtime.zip (self-contained, multi-file — no .NET needed on target)# The singlefile variant also leaves build/OwOWinDeployer.exe, runnable as-is.# Skip the prompt with -Variant (framework | singlefile | with-runtime | all):
powershell -ExecutionPolicy Bypass -File scripts/build.ps1 -Variant all
powershell -ExecutionPolicy Bypass -File scripts/build.ps1 -Variant singlefile -Run # build, then launch
Pushing a v* tag triggers .github/workflows/release.yml, which builds and attaches both EXEs to a GitHub Release automatically.
CLI Reference
owowindeployer <command> [options]
# or use the shorter alias:
owodeploy <command> [options]
Command
Description
list
List all catalog software (optional --category filter)
plan
Show install / already-installed plan (no execution, dry-run)
Windows Blocked the App / "Unknown Publisher" Warning
This application is not code-signed. Windows SmartScreen / Defender may block it or warn "Unknown Publisher". This is not malware (full source code and CI pipeline are public).
Situation
Resolution
SmartScreen blue dialog
Click "More info → Run anyway"
Prefer the ZIP package
Extract and run OwOWinDeployer.exe from the folder — less likely to trigger heuristics than the single-file EXE
Defender quarantined the file
Go to "Windows Security → Virus & threat protection → Protection history" and restore the file; you can also submit a false-positive report at Microsoft WDSI
Permanent fix (developers)
Set repository secrets SIGN_PFX_BASE64 + SIGN_PFX_PASSWORD — the Release CI already includes an Authenticode signing step
Developer Mode
WSL, System Tweaks, Advanced Tools, Cloudflare DDNS, and other advanced features are gated behind Developer Mode. Enable it in Settings → Developer Options — the left navigation panel updates instantly. A confirmation dialog is shown before activation; please read it carefully.
Security Notes
SSH private keys: generated fresh per device, never written to configs/
Config redaction: tokens, passwords, api_key, secret fields auto-removed on export; keywords are customizable
Registry tweaks: all changes on the Tweaks page can be reversed from the same page
UAC elevation: requested only when needed (SFC / DISM / system-level PATH writes); not held persistently
FTPS: trust-on-first-use certificate pinning; changed certs are refused
WSL: distro names validated against an allowlist before use in any shell invocation
Server configs: vhost paths reject shell-injection metacharacters
Known Limitations
The mingw catalog entry contains a placeholder URL — fill in the real download URL in catalog.json before use
ConPTY terminal requires Windows 10 Build 17763+; the terminal page is disabled on older builds
Some winget IDs are marked TODO: — run validate before applying
Third-Party Dependencies
This app is built on the following open-source libraries — many thanks to their authors. Each is used under its own license.
System text-to-speech for the hardware temperature voice alerts
MIT
License
Edition: Community — this open-source build is provided free, for personal study and research only. Commercial use of any kind is not permitted; for a commercial license contact the author (see below).
This project is released to the public under the CC BY-NC-SA 4.0 (Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International) license. Full terms: LICENSE.
License Summary
Right
Description
Attribution (BY)
You must credit the author and indicate whether changes were made
NonCommercial (NC)
You may not use this project or derivatives for commercial purposes
ShareAlike (SA)
Modified / derivative works must be released under the same license
Permitted Uses
Personal learning, research, and non-commercial projects
Copying, modifying, and redistributing under the three conditions above
Prohibited Uses
Using this project or any derivative in commercial products, services, or for profit
Publishing a modified version as closed-source
Removing or altering copyright notices
Author's Reserved Rights
HanskiJay (GitHub: Tommy131) is the sole copyright holder and is not bound by the NonCommercial restriction. The author retains all rights, including commercial use and the right to issue the software under different terms (dual-licensing).
{ "id": "nodejs", "name": "Node.js 24", "category": "dev", "default": true, "install": { "method": "winget", "id": "OpenJS.NodeJS" }, "detect": { "cmd": "node" }, "config": { "source": "configs/nodejs", "files": [".npmrc"], "applyWhen": "ifInstalled" } }