feat(windows): MSI self-update via stable bootstrap and SYSTEM updater

.github/workflows/fuzz.yml

@@ -35,6 +35,7 @@ jobs:
           - ./internal/detector/configaudit
           - ./internal/state
           - ./internal/detector/credentials
+          - ./internal/updatestate
     env:
       CGO_ENABLED: '0'
       # Short campaigns on the PR and merge-queue paths so they don't hold up a

.github/workflows/tests.yml

@@ -112,6 +112,28 @@ jobs:
         with:
           go-version-file: go.mod
       - run: make test
+      - name: Test self-update fault injection (selfupdate_faults tag)
+        run: go test -race -count=1 -tags selfupdate_faults,selfupdate_testkeys ./internal/faultinject/ ./internal/updatestate/ ./internal/selfupdate/ ./internal/authenticode/ ./internal/telemetry/
+      - name: Test bootstrap fault checkpoints (selfupdate_faults tag)
+        run: go test -race -count=1 -tags selfupdate_faults ./internal/launcher/
+
+  # Self-update U0 harness on Linux: the trace-driven kill matrix and the
+  # state corruption matrix (portable parts; Windows runs them natively in
+  # test-windows-native).
+  test-selfupdate-linux:
+    name: Test (self-update kill matrix, linux)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        with:
+          go-version-file: go.mod
+      - run: go test -race -count=1 -tags selfupdate_faults,selfupdate_testkeys ./internal/faultinject/ ./internal/updatestate/ ./internal/selfupdate/
 
   # These packages have Windows-only code and Windows-specific behavior whose
   # tests the macOS test job can only cross-compile, not run:
@@ -126,6 +148,9 @@ jobs:
   #   - executor: Readlink on a real directory junction (ModeIrregular entry,
   #     NT-namespace target), which the skills detector's junction folding
   #     depends on
+  #   - updatestate: MoveFileEx state replace, LockFileEx, protected DACLs
+  #   - selfupdate: native arch (IsWow64Process2), WinHTTP machine proxy
+  #   - authenticode: WinVerifyTrust against a test-signed copy (elevated runner)
   #   - detector TestReal_*: the Kiro CLI registry reader against a scratch
   #     HKCU key, and skills junction folding over real junctions (the rest of
   #     the detector suite assumes a POSIX host, hence the -run filter)
@@ -144,10 +169,25 @@ jobs:
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: go.mod
-      - run: go test -race -count=1 ./internal/devicepolicy/ ./internal/secureuserfile/ ./internal/detector/credentials/ ./internal/safepath/ ./internal/executor/
+      - run: go test -race -count=1 ./internal/devicepolicy/ ./internal/secureuserfile/ ./internal/detector/credentials/ ./internal/safepath/ ./internal/executor/ ./internal/updatestate/ ./internal/selfupdate/ ./internal/authenticode/ ./internal/awakeclock/
       - run: go test -race -count=1 -run '^TestReal_' ./internal/detector/
       - name: Test scheduled scan console suppression
-        run: go test -race -count=1 -run 'Test(IsTaskRegistered|DetectInvocationMethod_Windows|HideWindow)' ./internal/schtasks/ ./internal/telemetry/ ./internal/winproc/
+        run: go test -race -count=1 -run 'Test(IsTaskRegistered|DetectInvocationMethod_Windows|HideWindow|StopUnderThenWaitReleased)' ./internal/schtasks/ ./internal/telemetry/ ./internal/winproc/
+      # One command per step: the default pwsh shell only fails a step on the
+      # LAST native command's exit code, so a multi-line run would mask an
+      # earlier failure.
+      - name: Test self-update fault injection + U0 kill matrix (selfupdate_faults tag)
+        run: go test -race -count=1 -tags selfupdate_faults,selfupdate_testkeys ./internal/faultinject/ ./internal/updatestate/ ./internal/selfupdate/ ./internal/authenticode/
+      - name: Test scan panic/hang run classification (selfupdate_faults tag)
+        run: go test -race -count=1 -tags selfupdate_faults,selfupdate_testkeys -run 'Test(ScanPanicIsABadRun|ScanHangAfterStartedIsABadRun)' ./internal/telemetry/
+      - name: Authenticode against test-signed binaries (verbose, shows skips)
+        run: go test -count=1 -v -run 'TestVerify|TestForgedBag|TestTrustData|TestSameSeedPublisher' ./internal/authenticode/
+      - name: Test launcher bootstrap mode
+        run: go test -race -count=1 ./internal/launcher/
+      - name: Test launcher bootstrap fault checkpoints (selfupdate_faults tag)
+        run: go test -race -count=1 -tags selfupdate_faults ./internal/launcher/
+      - name: Test self-update scheduled tasks
+        run: go test -race -count=1 -run 'Test(UpdateTask|ResolveBootstrapRoot|BuildCreateArgs_Bootstrap|InstallUpdateTask|Uninstall_|TerminateUnder|WaitForInstanceMutex|StopProcess)' ./internal/schtasks/
 
   smoke:
     name: Smoke Tests

CHANGELOG.md

@@ -11,6 +11,7 @@ See [VERSIONING.md](VERSIONING.md) for why the version starts at 1.8.1.
 
 ### Added
 
+- **Windows MSI installs update themselves.** The MSI now installs a stable bootstrap, a seed copy of the agent and a SYSTEM `StepSecurity Dev Machine Guard (Update)` task. The task follows the tenant's `latest-binary` target. It verifies each release's SSH-signed checksums, sha256 and Authenticode publisher (it must match the running agent), stages it as an immutable `versions\<v>` directory, smoke-tests it as SYSTEM and switches only when no scan is running. A new version is on probation until a scan reaches the backend; two crashes roll it back and quarantine it on that device. Every outcome is reported as a `run-status` event with `status: "update"`. The MSI never downgrades a self-updated device, and repairs keep the current version. `AUTOUPDATE=0` opts out (the device still reports `update_disabled`). Devices on older MSIs need one final MSI push. See `docs/windows-self-update.md`, and `docs/windows-self-update-admin.md` for SCCM/Intune admins (network and proxy requirements, the safe repair command, verifying devices and troubleshooting by update event).
 - Passive PHP/Composer package inventory and configuration audit for developer machines. Collects project and global declarations, lockfiles and installed receipts, with redacted settings and configuration findings. PHP, Composer, plugins and scripts are never executed.
 - GitHub Copilot plugin inventory for the CLI, standalone app and VS Code. Collects recorded installations and live directory-marketplace selections, supplied skills, custom agents, command/rule/hook/LSP declarations, and sanitized plugin/user/project MCP definitions. Collection is file-only; uncertain formats report incomplete coverage. Runtime activation is not inferred. No Copilot usage or credential collection is added.
 

cmd/stepsecurity-dev-machine-guard-task/main.go

@@ -25,6 +25,16 @@
 //     `powershell.exe -File loader.ps1 send-telemetry` in the same
 //     no-console envelope the MSI flow uses for the agent.
 //
+//   - Bootstrap mode. Invoked under the file name
+//     stepsecurity-dev-machine-guard-bootstrap.exe (the MSI installs a
+//     second copy of this launcher under that name), the verbs run /
+//     update / adopt-seed resolve the self-update state.json pointer and
+//     launch the versioned binaries. See internal/launcher/bootstrap.go.
+//
+// When launched by the bootstrap (STEPSEC_BOOTSTRAP_VERSION set), failing to
+// resolve or start the agent exits 70 so the run counts as bad (D5); other
+// invocations keep their legacy exit codes.
+//
 // The agent (and any --exec target) stays console-subsystem so
 // interactive CLI use continues to work normally.
 //
@@ -40,14 +50,13 @@ import (
 	"os"
 	"os/exec"
 	"syscall"
-	"unsafe"
 
+	"github.com/step-security/dev-machine-guard/internal/faultinject"
 	"github.com/step-security/dev-machine-guard/internal/launcher"
+	"github.com/step-security/dev-machine-guard/internal/winproc"
 	"golang.org/x/sys/windows"
 )
 
-const createNoWindow uint32 = 0x08000000
-
 func main() {
 	os.Exit(run(os.Args[1:]))
 }
@@ -56,6 +65,11 @@ func main() {
 // after the program name (os.Args[1:] in main); accepting it explicitly
 // keeps the windows-only test path open if we add one later.
 func run(argv []string) int {
+	if me, err := os.Executable(); err == nil && launcher.IsBootstrapBinary(me) {
+		return launcher.NewBootstrap(me, winproc.IsLocalSystem).Main(argv)
+	}
+	underBootstrap := os.Getenv(launcher.EnvBootstrapVersion) != ""
+
 	target, childArgs, err := launcher.ResolveTarget(argv)
 	if err != nil {
 		// Two distinct failure shapes, matched to the legacy contract:
@@ -76,16 +90,22 @@ func run(argv []string) int {
 			fmt.Fprintln(os.Stderr, err)
 			return 2
 		}
+		if underBootstrap {
+			return launcher.ExitCannotStart
+		}
 		return 1
 	}
 
 	cmd := exec.Command(target, childArgs...)
 	cmd.SysProcAttr = &syscall.SysProcAttr{
 		HideWindow:    true,
-		CreationFlags: createNoWindow,
+		CreationFlags: launcher.CreateNoWindow,
 	}
 
 	if err := cmd.Start(); err != nil {
+		if underBootstrap {
+			return launcher.ExitCannotStart
+		}
 		return 1
 	}
 
@@ -94,17 +114,18 @@ func run(argv []string) int {
 	// exit, which fires the kill. Failure here only weakens lifecycle
 	// (orphan possible on forced termination), not the work the child
 	// was started to do.
-	if job, jerr := newKillOnCloseJob(); jerr == nil {
-		if h, oerr := windows.OpenProcess(
-			windows.PROCESS_SET_QUOTA|windows.PROCESS_TERMINATE,
-			false,
-			uint32(cmd.Process.Pid),
-		); oerr == nil {
-			_ = windows.AssignProcessToJobObject(job, h)
-			_ = windows.CloseHandle(h)
+	if job, jerr := launcher.NewKillOnCloseJob(); jerr == nil {
+		if aerr := launcher.AssignToJob(job, cmd.Process.Pid); aerr != nil {
+			_ = windows.CloseHandle(job)
 		}
 	}
 
+	// Lets a test build crash a version's scans after launch (harness
+	// baked fault boot.launched@user:exit2); a no-op in release builds.
+	if underBootstrap {
+		_ = faultinject.Point("boot.launched")
+	}
+
 	if err := cmd.Wait(); err != nil {
 		var ee *exec.ExitError
 		if errors.As(err, &ee) {
@@ -114,27 +135,3 @@ func run(argv []string) int {
 	}
 	return 0
 }
-
-func newKillOnCloseJob() (windows.Handle, error) {
-	job, err := windows.CreateJobObject(nil, nil)
-	if err != nil {
-		return 0, err
-	}
-	info := windows.JOBOBJECT_EXTENDED_LIMIT_INFORMATION{
-		BasicLimitInformation: windows.JOBOBJECT_BASIC_LIMIT_INFORMATION{
-			// BREAKAWAY_OK lets the agent's CREATE_BREAKAWAY_FROM_JOB spawns
-			// (WSL guest scans) outlive this run instead of being killed.
-			LimitFlags: windows.JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE | windows.JOB_OBJECT_LIMIT_BREAKAWAY_OK,
-		},
-	}
-	if _, err := windows.SetInformationJobObject(
-		job,
-		windows.JobObjectExtendedLimitInformation,
-		uintptr(unsafe.Pointer(&info)),
-		uint32(unsafe.Sizeof(info)),
-	); err != nil {
-		_ = windows.CloseHandle(job)
-		return 0, err
-	}
-	return job, nil
-}

cmd/stepsecurity-dev-machine-guard/main.go

@@ -74,6 +74,10 @@ func main() {
 		os.Exit(aiagentscli.RunHook(os.Stdin, os.Stdout, os.Stderr, os.Args[2:]))
 	}
 
+	// agent.prestart fault checkpoint and the Windows self-update verbs
+	// (self-update --system, self-check); they exit here.
+	runEarlyVerbs(os.Args[1:])
+
 	// Load persisted config (~/.stepsecurity/config.json) before parsing CLI
 	// --config must be honoured before Load(), which runs ahead of flag
 	// parsing and keeps the first values it reads.
@@ -238,6 +242,7 @@ func main() {
 			APIEndpoint:   cfg.ConfigAPIEndpoint,
 			APIKey:        cfg.ConfigAPIKey,
 			ScanFrequency: cfg.ConfigScanFrequency,
+			AutoUpdate:    cfg.ConfigAutoUpdate,
 		}
 		if opts.APIKey == "" {
 			// Env-var fallback keeps the secret off the msiexec command
@@ -274,6 +279,7 @@ func main() {
 			log.Error("Enterprise configuration not found. Run '%s configure' or download the script from your StepSecurity dashboard.", os.Args[0])
 			os.Exit(1)
 		}
+		reportBootstrapFallback()
 		// Server-driven run gate: exit 0 quietly when the backend says this
 		// invocation isn't due (or another instance is mid-scan). Sits before
 		// the watchdog and telemetry.Run so a skipped wakeup posts no beacon,
@@ -294,7 +300,7 @@ func main() {
 		if telemetryErr != nil {
 			restoreTarget()
 			log.Error("%v", telemetryErr)
-			os.Exit(1)
+			os.Exit(telemetry.ExitCode(telemetryErr))
 		}
 		runHookStateReconcile(exec, log, cfg)
 		if targetOK {
@@ -417,7 +423,7 @@ func main() {
 			} else {
 				restoreTarget()
 				log.Error("%v", telemetryErr)
-				os.Exit(1)
+				os.Exit(telemetry.ExitCode(telemetryErr))
 			}
 		}
 		runHookStateReconcile(exec, log, cfg)
@@ -546,7 +552,7 @@ func main() {
 			restoreTarget()
 			if telemetryErr != nil {
 				log.Error("%v", telemetryErr)
-				os.Exit(1)
+				os.Exit(telemetry.ExitCode(telemetryErr))
 			}
 		default:
 			log.Debug("dispatch: community scan (default)")