What's new in tl v0.9.9: Windows users blocked by Smart App Control get a one-command fix

A new tl release is out today: v0.9.9. This one is a targeted fix for Windows users who’ve been hitting a wall with Smart App Control (SAC) or a strict WDAC policy — the kind of security setup that’s common on corporate laptops and increasingly the default on new Windows 11 machines. If the CLI was refusing to start with a Code Integrity error, this release makes it work again, in one command.

Run tl update (or, if tl won’t even launch, see the bootstrap below) and you’re good.

What was going wrong

When you install tl on Windows via pipx or uv, the installer drops a small launcher stub onto your PATH — a tiny tl.exe that hands off to Python behind the scenes. That stub is unsigned, and Windows Smart App Control has an increasingly firm opinion about running unsigned executables. On locked-down machines you’d see a Code Integrity error — Windows silently refuses to run the CLI at all.

Some readers have been living with that for a while: a colleague sends them a tl prompt to try, they paste it in, and the terminal just… rejects it. Nothing to click, no obvious next step.

The fix: one command

v0.9.9 adds a small new setup command:

tl setup windows

Under the hood it writes a tiny tl.cmd file that launches the CLI through the already-signed python.exe that ships with your Python install — and puts that ahead of the blocked stub on your PATH. Smart App Control has no problem with signed Python, so from that moment on, tl just works. Nothing to sign yourself, no policy exceptions to request from IT, no elevation.

If tl is already blocked

If Smart App Control has already blocked the stub, you obviously can’t run tl to fix it. For that case, there’s a bootstrap through the signed interpreter directly:

& "$env:USERPROFILE\pipx\venvs\thoughtleaders-cli\Scripts\python.exe" -m tl_cli setup windows

That runs the exact same setup windows command via signed Python, writes the wrapper, and puts you back on the happy path. From the next terminal, plain tl works.

Related: this release also officially wires up python -m tl_cli as a first-class way to launch the CLI. So even in an environment where you can’t or don’t want to use the PATH entry, this shape always works.

What this means for the team

If you’ve had a colleague — an account manager, a marketing analyst, a channel researcher — tell you “I tried to install tl but my laptop won’t let me run it,” this is the version that fixes their day. Send them the tl setup windows command. That’s it.

For the AI-agent workflows the CLI powers, nothing changes. The same prompts your team uses on Mac and Linux now run identically on Windows, on locked-down machines, without an IT ticket.

Prompt shapes that are worth a fresh try on a machine that used to reject tl:

• “I’m looking at [brand]. Give me their top 10 sponsored channels this quarter with average views, and pick three that are undersubscribed for the categories they land in.”
• “Find channels in the finance category that ran a sponsorship in the last 60 days and haven’t been contacted by our team yet. Save the shortlist.”
• “Pull last month’s upload volume for these five channels, and flag anyone whose cadence dropped materially — it usually means a channel is winding down or pivoting.”

If any of those used to fail before you got past tl --version, they don’t anymore.

Updating

If you have a working tl install already, tl update grabs v0.9.9 on your next command. On a fresh Windows machine, run pipx install thoughtleaders-cli (or uv tool install) and then follow up with tl setup windows before your first real prompt — that one extra step now guarantees it launches cleanly on any Windows configuration you’re likely to meet in the field.

tl changelog shows the full running log of what’s landed since your last release.