Add signed Windows Agent updates and versioned installation

.github/workflows/agent-desktop-build.yml

@@ -546,6 +546,7 @@ jobs:
         variant: [dev, prod]
     env:
       MAPLE_RELEASE_PROFILE: ${{ matrix.variant }}
+      MAPLE_PACKAGE_BUILD_NUMBER: ${{ github.run_number }}
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
         with:
@@ -598,6 +599,7 @@ jobs:
         variant: [dev]
     env:
       MAPLE_RELEASE_PROFILE: ${{ matrix.variant }}
+      MAPLE_PACKAGE_BUILD_NUMBER: ${{ github.run_number }}
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
         with:
@@ -634,6 +636,7 @@ jobs:
         variant: ${{ fromJSON(github.event_name == 'pull_request' && '["dev"]' || '["dev","prod"]') }}
     env:
       MAPLE_RELEASE_PROFILE: ${{ matrix.variant }}
+      MAPLE_PACKAGE_BUILD_NUMBER: ${{ github.run_number }}
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
         with:
@@ -661,7 +664,7 @@ jobs:
           done
         env:
           GH_TOKEN: ${{ github.token }}
-      - name: Verify downloaded Windows package and install lifecycle
+      - name: Verify downloaded Windows package and profile-specific install policy
         run: |
           # The stock image exports these Azure CLI tooling/cache paths.
           # Keep other Azure/signing variables visible to the fail-closed guard.

.github/workflows/agent-updates-publish.yml

@@ -21,6 +21,11 @@ on:
         required: true
         default: true
         type: boolean
+      include_windows:
+        description: Include qualified Windows packages after Windows update delivery is activated
+        required: true
+        default: false
+        type: boolean
 
 permissions:
   contents: read
@@ -53,10 +58,15 @@ jobs:
         env:
           ACTIVATED: ${{ vars.AGENT_UPDATES_ENABLED }}
           PUBLIC_KEY: ${{ vars.AGENT_UPDATE_PUBLIC_KEY }}
+          INCLUDE_WINDOWS: ${{ inputs.include_windows }}
+          WINDOWS_ACTIVATED: ${{ vars.AGENT_WINDOWS_UPDATES_ENABLED }}
         run: |
           set -euo pipefail
           [ "$ACTIVATED" = true ] || { echo 'Agent update production setup has not been activated by its owner.' >&2; exit 1; }
           [ -n "$PUBLIC_KEY" ] || { echo 'Agent public update key is not configured.' >&2; exit 1; }
+          if [ "$INCLUDE_WINDOWS" = true ]; then
+            [ "$WINDOWS_ACTIVATED" = true ] || { echo 'Windows update delivery has not completed its owner-approved native qualification.' >&2; exit 1; }
+          fi
           printf '%s\n' "$PUBLIC_KEY" > public-key.pub
       - name: Verify exact build, download final packages and prepare without secrets
         env:
@@ -65,12 +75,15 @@ jobs:
           RELEASE_VERSION: ${{ inputs.version }}
           RELEASE_NOTES: ${{ inputs.notes }}
           INCLUDE_LINUX: ${{ inputs.include_linux }}
+          INCLUDE_WINDOWS: ${{ inputs.include_windows }}
         run: |
           nix develop --no-update-lock-file .#ci -c bash -euo pipefail <<'PREPARE'
           linux_args=()
+          windows_args=()
           if [ "$INCLUDE_LINUX" = true ]; then linux_args=(--linux); fi
+          if [ "$INCLUDE_WINDOWS" = true ]; then windows_args=(--windows); fi
           python3 services/agent-updates/publisher/publisher.py trust \
-            --run-id "$BUILD_RUN_ID" "${linux_args[@]}" --output trust.json
+            --run-id "$BUILD_RUN_ID" "${linux_args[@]}" "${windows_args[@]}" --output trust.json
           gh run download "$BUILD_RUN_ID" --repo "$GITHUB_REPOSITORY" \
             --name "$(jq -er .artifacts.macos trust.json)" --dir packages/macos
           linux_args=()
@@ -79,10 +92,16 @@ jobs:
               --name "$(jq -er .artifacts.linux trust.json)" --dir packages/linux
             linux_args=(--linux packages/linux)
           fi
+          windows_args=()
+          if [ "$INCLUDE_WINDOWS" = true ]; then
+            gh run download "$BUILD_RUN_ID" --repo "$GITHUB_REPOSITORY" \
+              --name "$(jq -er .artifacts.windows trust.json)" --dir packages/windows
+            windows_args=(--windows packages/windows)
+          fi
           printf '%s' "$RELEASE_NOTES" > notes.txt
           python3 services/agent-updates/publisher/publisher.py prepare \
             --run-id "$BUILD_RUN_ID" --version "$RELEASE_VERSION" --build "$(jq -er .build trust.json)" \
-            --macos packages/macos "${linux_args[@]}" --notes-file notes.txt --public-key public-key.pub --output bundle
+            --macos packages/macos "${linux_args[@]}" "${windows_args[@]}" --notes-file notes.txt --public-key public-key.pub --output bundle
           PREPARE
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:

.github/workflows/agent-windows-signature-probe.yml

@@ -0,0 +1,96 @@
+name: Agent Windows Historical Signature Probe
+
+permissions:
+  contents: read
+  actions: read
+
+on:
+  workflow_dispatch:
+    inputs:
+      producer_run:
+        description: Exact trusted master Desktop producer run
+        type: string
+        required: true
+      producer_attempt:
+        description: Exact completed producer attempt
+        type: string
+        required: true
+      source_sha:
+        description: Exact producer source SHA
+        type: string
+        required: true
+      artifact_id:
+        description: Exact final Prod Windows artifact ID
+        type: string
+        required: true
+      zip_sha256:
+        description: Exact API artifact ZIP SHA256
+        type: string
+        required: true
+      zip_bytes:
+        description: Exact API artifact ZIP byte size
+        type: string
+        required: true
+      pe_member:
+        description: Exact signed PE basename in the artifact
+        type: string
+        required: true
+      pe_sha256:
+        description: Exact signed PE SHA256
+        type: string
+        required: true
+
+jobs:
+  signature-probe:
+    runs-on: windows-2025
+    timeout-minutes: 20
+    env:
+      CARGO_TERM_COLOR: never
+      CARGO_INCREMENTAL: 0
+      CARGO_PROFILE_DEV_DEBUG: 0
+      RUSTFLAGS: -D warnings
+      MAPLE_PROBE_RUN: ${{ inputs.producer_run }}
+      MAPLE_PROBE_ATTEMPT: ${{ inputs.producer_attempt }}
+      MAPLE_PROBE_SOURCE: ${{ inputs.source_sha }}
+      MAPLE_PROBE_ARTIFACT: ${{ inputs.artifact_id }}
+      MAPLE_PROBE_ZIP_SHA: ${{ inputs.zip_sha256 }}
+      MAPLE_PROBE_ZIP_BYTES: ${{ inputs.zip_bytes }}
+      MAPLE_PROBE_PE_MEMBER: ${{ inputs.pe_member }}
+      MAPLE_PROBE_PE_SHA: ${{ inputs.pe_sha256 }}
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
+        with:
+          toolchain: 1.98.0
+      - uses: ilammy/msvc-dev-cmd@a102174a2b586eec2ea151a69e6fd14404a8ce7c
+        with:
+          arch: x64
+      - name: Select and verify the native linker
+        working-directory: apps/maple-agent
+        shell: pwsh
+        run: python3 ../../scripts/ci/agent_windows.py
+      - name: Validate the exact historical reference without execution
+        shell: pwsh
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: python3 scripts/ci/windows_signature_reference.py
+      - name: Run the production Authenticode verifier against the reference
+        working-directory: apps/maple-agent
+        shell: pwsh
+        run: |
+          $reference = Join-Path $env:RUNNER_TEMP 'maple-windows-signature-probe/reference.exe'
+          $result = Join-Path $env:RUNNER_TEMP 'maple-windows-signature-probe/signature-result.json'
+          cargo run -p maple-agent-updater --locked --example windows_signature_probe -- $reference $env:MAPLE_PROBE_PE_SHA > $result
+          if ($LASTEXITCODE -ne 0) { throw 'Native historical signature interoperability probe failed.' }
+      - name: Preserve exact selection and native result
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: windows-historical-signature-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            ${{ runner.temp }}/maple-windows-signature-probe/selection.json
+            ${{ runner.temp }}/maple-windows-signature-probe/signature-result.json
+          if-no-files-found: error
+          retention-days: 14

.github/workflows/agent-windows-updater-tests.yml

@@ -0,0 +1,154 @@
+name: Agent Windows Updater Tests
+
+# Native component tests run without the signing/publishing environments. A
+# green result is not qualification of an official signed installed upgrade.
+permissions:
+  contents: read
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/agent-windows-updater-tests.yml"
+      - "scripts/ci/windows-updater-tests.ps1"
+      - "scripts/ci/windows-app-typecheck.ps1"
+      - "scripts/ci/test_windows_updater_workflow.py"
+      - "scripts/ci/agent_windows.py"
+      - "apps/maple-agent/Cargo.toml"
+      - "apps/maple-agent/Cargo.lock"
+      - "apps/maple-agent/app/Cargo.toml"
+      - "apps/maple-agent/crates/maple-agent-updater/**"
+      - "apps/maple-agent/release_profile.rs"
+      - "apps/maple-agent/release-profiles.json"
+      - "apps/maple-agent/app/src/main.rs"
+      - "apps/maple-agent/app/src/profile.rs"
+      - "apps/maple-agent/app/src/update.rs"
+      - "apps/maple-agent/app/src/desktop.rs"
+      - "apps/maple-agent/app/src/desktop/**"
+      - "apps/maple-agent/app/src/windows_bootstrap.rs"
+      - "apps/maple-agent/scripts/windows-release.py"
+      - "apps/maple-agent/scripts/windows-installer.nsi"
+      - "apps/maple-agent/scripts/release-info.py"
+  push:
+    branches: [master]
+    paths:
+      - ".github/workflows/agent-windows-updater-tests.yml"
+      - "scripts/ci/windows-updater-tests.ps1"
+      - "scripts/ci/windows-app-typecheck.ps1"
+      - "scripts/ci/test_windows_updater_workflow.py"
+      - "scripts/ci/agent_windows.py"
+      - "apps/maple-agent/Cargo.toml"
+      - "apps/maple-agent/Cargo.lock"
+      - "apps/maple-agent/app/Cargo.toml"
+      - "apps/maple-agent/crates/maple-agent-updater/**"
+      - "apps/maple-agent/release_profile.rs"
+      - "apps/maple-agent/release-profiles.json"
+      - "apps/maple-agent/app/src/main.rs"
+      - "apps/maple-agent/app/src/profile.rs"
+      - "apps/maple-agent/app/src/update.rs"
+      - "apps/maple-agent/app/src/desktop.rs"
+      - "apps/maple-agent/app/src/desktop/**"
+      - "apps/maple-agent/app/src/windows_bootstrap.rs"
+      - "apps/maple-agent/scripts/windows-release.py"
+      - "apps/maple-agent/scripts/windows-installer.nsi"
+      - "apps/maple-agent/scripts/release-info.py"
+  workflow_dispatch:
+
+concurrency:
+  group: agent-windows-updater-tests-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  app-typecheck:
+    name: Windows app and test target typecheck
+    runs-on: windows-2025
+    timeout-minutes: 30
+    env:
+      CARGO_TERM_COLOR: never
+      CARGO_INCREMENTAL: 0
+      CARGO_PROFILE_DEV_DEBUG: 0
+      RUSTFLAGS: -D warnings
+    steps:
+      - name: Checkout the tested source
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+      - name: Install the repository's pinned Windows Rust
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
+        with:
+          toolchain: 1.98.0
+      - name: Select Windows MSVC and SDK
+        uses: ilammy/msvc-dev-cmd@a102174a2b586eec2ea151a69e6fd14404a8ce7c
+        with:
+          arch: x64
+      - name: Select native Windows Perl for the static crypto build
+        shell: bash
+        run: |
+          native_perl=/c/Strawberry/perl/bin/perl.exe
+          if [ ! -x "$native_perl" ]; then
+            echo 'Native Windows Perl is missing from the runner' >&2
+            exit 1
+          fi
+          "$native_perl" -MLocale::Maketext::Simple -MIPC::Cmd -e 'die "OpenSSL requires native Windows Perl\n" unless $^O eq "MSWin32"; print "$^V\n"'
+          native_perl_windows="$(cygpath -m "$native_perl")"
+          printf 'OPENSSL_SRC_PERL=%s\n' "$native_perl_windows" >> "$GITHUB_ENV"
+      - name: Pin and smoke-test the selected Windows linker
+        working-directory: apps/maple-agent
+        shell: pwsh
+        run: python3 ../../scripts/ci/agent_windows.py
+      - name: Select the SDK shader compiler for GPUI
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          if (-not $env:WindowsSdkVerBinPath) { throw 'Selected Windows SDK binary path is missing' }
+          $fxc = Join-Path $env:WindowsSdkVerBinPath 'x64/fxc.exe'
+          if (-not (Test-Path -LiteralPath $fxc -PathType Leaf)) { throw 'Selected SDK shader compiler is missing' }
+          "GPUI_FXC_PATH=$fxc" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+      - name: Typecheck the Windows application and every app test target
+        shell: pwsh
+        run: ./scripts/ci/windows-app-typecheck.ps1
+      - name: Retain the typecheck receipt and complete Cargo log
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: windows-app-typecheck-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/maple-windows-app-typecheck/
+          if-no-files-found: error
+          retention-days: 14
+
+  native-updater:
+    name: Native Windows updater component tests
+    runs-on: windows-2025
+    timeout-minutes: 35
+    env:
+      CARGO_TERM_COLOR: never
+      CARGO_INCREMENTAL: 0
+      CARGO_PROFILE_DEV_DEBUG: 0
+      RUSTFLAGS: -D warnings
+    steps:
+      - name: Checkout the tested source
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+      - name: Install the repository's pinned Windows Rust
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
+        with:
+          toolchain: 1.98.0
+      - name: Select Windows MSVC and SDK
+        uses: ilammy/msvc-dev-cmd@a102174a2b586eec2ea151a69e6fd14404a8ce7c
+        with:
+          arch: x64
+      - name: Pin and smoke-test the selected Windows linker
+        working-directory: apps/maple-agent
+        shell: pwsh
+        run: python3 ../../scripts/ci/agent_windows.py
+      - name: Exercise the native updater and bootstrap
+        shell: pwsh
+        run: ./scripts/ci/windows-updater-tests.ps1
+      - name: Retain the native test receipt and logs
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: windows-updater-native-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/maple-windows-updater-tests/
+          if-no-files-found: error
+          retention-days: 14

apps/maple-agent/README.md

@@ -626,8 +626,9 @@ check.
 
 ## Update and release boundary
 
-Automatic updates currently support macOS and Linux. Windows Dev/Prod installers
-are Actions downloads with manual upgrades; see [desktop builds](docs/desktop-builds.md).
+Packaged Prod updates support macOS, Linux and Windows through separate signed
+platform feeds. Windows also provides a signed per-user manual installer;
+see [desktop builds](docs/desktop-builds.md).
 
 Packaged Prod builds use the independent signed Agent update feed. Dev and
 unpackaged/MDE builds do not check a production updater. The Prod profile pins