feat: add windows support by swarit-stepsecurity · Pull Request #17 · step-security/dev-machine-guard

swarit-stepsecurity · 2026-04-08T14:26:00Z

What does this PR do?

Adds official windows support.

Type of change

Bug fix
Enhancement
Documentation

Testing

Tested on macOS (version: ___)
Binary runs without errors: ./stepsecurity-dev-machine-guard --verbose
JSON output is valid: ./stepsecurity-dev-machine-guard --json | python3 -m json.tool
No secrets or credentials included
Lint passes: make lint
Tests pass: make test

Related Issues

Signed-off-by: Swarit Pandey <swarit@stepsecurity.io>

Signed-off-by: Swarit Pandey <swarit@stepsecurity.io> chore: more golint issues - rebase this Signed-off-by: Swarit Pandey <swarit@stepsecurity.io>

Signed-off-by: Swarit Pandey <swarit@stepsecurity.io>

Copilot

Pull request overview

Adds official Windows support across the agent runtime, detectors, output, and install/uninstall flows.

Changes:

Introduces Windows-specific execution helpers (shell dispatching, process checks), device info collection, and scheduled-task based install/uninstall via schtasks.
Extends multiple detectors (IDEs, MCP configs, AI tools, Node scans, frameworks) to work on Windows paths and conventions, with accompanying tests.
Adds Windows build/deploy tooling and updates CLI/output labeling for Windows.

Reviewed changes

Copilot reviewed 38 out of 39 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
tests/test_smoke_go.sh	Updates smoke test expectation for the CLI “unknown option” message.
scripts/deploy-windows.sh	New helper script to build, SCP, and optionally run the Windows binary remotely.
internal/telemetry/telemetry.go	Uses detected platform in telemetry payload; makes HTTP body closing explicit/ignored.
internal/telemetry/logcapture.go	Ignores pipe close errors during log capture finalization.
internal/schtasks/schtasks_test.go	Adds unit tests for Windows Task Scheduler install/uninstall helpers.
internal/schtasks/schtasks.go	Implements Windows scheduled scanning via `schtasks` (install/uninstall).
internal/output/pretty.go	Labels OS as Windows when applicable in pretty output.
internal/output/html_test.go	Adjusts test cleanup to ignore remove errors.
internal/output/html.go	Ignores file close errors; labels OS as Windows/macOS in template.
internal/lock/lock_windows.go	Adds Windows lockfile location + PID liveness check via `tasklist`.
internal/lock/lock_unix.go	Moves Unix lockfile location + PID liveness check behind `!windows` build tag.
internal/lock/lock.go	Refactors lockfile constant into per-OS files; ignores close error when writing PID.
internal/launchd/launchd.go	Ignores close/remove errors while installing/uninstalling launchd plist.
internal/executor/mock.go	Adds GOOS override setter for cross-platform tests.
internal/executor/executor_windows.go	Adds Windows implementations for `IsRoot` and `RunAsUser`.
internal/executor/executor_unix.go	Moves Unix implementations for `IsRoot` and `RunAsUser` behind `!windows`.
internal/executor/executor.go	Removes Unix-only `IsRoot`/`RunAsUser` from common file; keeps interface + shared ops.
internal/device/device_test.go	Adds Windows device-gathering unit test.
internal/device/device.go	Makes device gathering platform-aware; adds Windows serial/OS version collection.
internal/detector/shellcmd.go	Adds platform-aware shell execution and quoting helper.
internal/detector/process.go	Adds cross-platform process-running checks (pgrep vs tasklist).
internal/detector/nodescan_test.go	Adds Windows-focused tests for node global/project scans and path handling.
internal/detector/nodescan.go	Uses platform-aware shell runner/quoting; improves node_modules path detection.
internal/detector/nodeproject.go	Normalizes path slashes to detect bun install directory on Windows.
internal/detector/nodepm_test.go	Adds Windows tests for package manager detection and project PM detection.
internal/detector/mcp_test.go	Adds Windows test for MCP config path resolution via env expansion.
internal/detector/mcp.go	Adds Windows config path support; refactors config path resolution; tweaks JSONC comment stripping loop.
internal/detector/ide_test.go	Adds Windows tests for VS Code and Claude detection.
internal/detector/ide.go	Adds Windows IDE detection paths, binary/version detection, and registry-based version fallback.
internal/detector/framework_test.go	Adds Windows test for Ollama detection including tasklist-based running check.
internal/detector/framework.go	Adds Windows LM Studio detection path/version; uses cross-platform process checks.
internal/detector/extension.go	Uses `filepath.Join` for extension paths to support Windows separators.
internal/detector/aicli.go	Improves tilde expansion (filepath-safe), Windows .exe lookup, version normalization, env-path resolution, and temp home fallback.
internal/detector/agent_test.go	Adds Windows test for Claude Cowork detection/version via registry.
internal/detector/agent.go	Uses `filepath.Join`; adds Windows support for Claude Cowork detection/version.
internal/cli/cli.go	Normalizes “unknown option” error message; updates help text for scheduled scanning; ignores stdout write errors.
cmd/stepsecurity-dev-machine-guard/main.go	Routes enterprise install/uninstall to `schtasks` on Windows, `launchd` otherwise.
Makefile	Adds `build-windows` and `deploy-windows` targets.
.gitignore	Ignores built binaries more broadly, including `*.exe`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-14T05:37:26Z

scripts/deploy-windows.sh

+    if [[ -n "$KEY" ]]; then
+        scp $SSH_OPTS -i "$KEY" "$src" "${USER}@${HOST}:${dst}"
+    elif [[ -n "$PASSWORD" ]]; then
+        SSHPASS="$PASSWORD" sshpass -e scp $SSH_OPTS "$src" "${USER}@${HOST}:${dst}"
+    fi


In scp_cmd, if neither --key nor DEPLOY_PASSWORD is provided, the function becomes a no-op (no scp is executed) and the script still prints "Deployed successfully". This makes failures confusing and can result in later steps failing for unrelated reasons. Mirror ssh_cmd's behavior by adding an explicit else branch that errors out when no auth method is configured (and consider sharing the sshpass presence check here too).

Copilot · 2026-04-14T05:37:26Z

scripts/deploy-windows.sh

+    elif [[ -n "$PASSWORD" ]]; then
+        SSHPASS="$PASSWORD" sshpass -e scp $SSH_OPTS "$src" "${USER}@${HOST}:${dst}"
+    fi


The password-auth branch uses sshpass without checking that it exists (unlike ssh_cmd). With set -e, this will fail as "command not found" without a clear message. Add the same command -v sshpass guard (or refactor so both ssh/scp paths share a single validation).

Copilot · 2026-04-14T05:37:27Z

internal/detector/aicli.go

+	for _, p := range parts {
+		trimmed := strings.TrimLeft(p, "v")
+		if len(trimmed) > 0 && trimmed[0] >= '0' && trimmed[0] <= '9' {
+			return p


cleanVersionString looks like it intends to normalize versions like "v1.2.3" to "1.2.3" (it computes trimmed := strings.TrimLeft(p, "v") and the doc examples omit the leading v), but it currently returns p rather than trimmed. This means version strings can retain the leading 'v' unexpectedly. Return the trimmed token (or update the comment/examples if keeping the 'v' is intentional).

Suggested change

return p

return trimmed

Copilot · 2026-04-14T05:37:27Z

internal/schtasks/schtasks.go

+	_, stderr, exitCode, err := exec.Run(ctx, "schtasks", args...)
+	if err != nil || exitCode != 0 {
+		return fmt.Errorf("failed to create scheduled task: %s", stderr)
+	}


Install drops useful error context when schtasks fails: it ignores err and exitCode and returns an error built only from stderr (which can be empty, e.g. if the executable is missing or the executor returns a non-zero exit without stderr). Include the exit code and wrap/append the underlying err (and optionally stdout/stderr) so failures are diagnosable.

Copilot · 2026-04-14T05:37:27Z

internal/schtasks/schtasks.go

+	_, stderr, exitCode, err := exec.Run(ctx, "schtasks", "/delete", "/tn", taskName, "/f")
+	if err != nil || exitCode != 0 {
+		return fmt.Errorf("failed to delete scheduled task: %s", stderr)
+	}


doUninstall has the same issue as Install: it discards err/exitCode and reports only stderr, which can be empty and hides the real cause of failure. Return an error that includes the exit code and wraps the underlying err (and include stderr/stdout for troubleshooting).

Copilot · 2026-04-14T05:37:27Z

internal/schtasks/schtasks_test.go

+	_ = Install(mock, newTestLogger())
+	// If we got past the config parsing without panic, the frequency was handled correctly.
+}


TestInstall_CustomFrequency doesn't assert any observable behavior (it ignores Install's return value and only relies on "no panic"), so it will pass even if custom frequency handling regresses. Consider refactoring the frequency parsing/task-argument construction into a helper that can be unit-tested deterministically (or stub the expected schtasks /create invocation and assert the "/mo" value).

feat: add windows support

e8c63df

Signed-off-by: Swarit Pandey <swarit@stepsecurity.io>

swarit-stepsecurity marked this pull request as draft April 8, 2026 14:26

swarit-stepsecurity mentioned this pull request Apr 8, 2026

[Feature]: Add Windows support #2

Open

swarit-stepsecurity added 2 commits April 13, 2026 20:47

feat(windows): add npm scanning

ba8c71d

Signed-off-by: Swarit Pandey <swarit@stepsecurity.io>

chore(ci): golint issues

f8a456c

Signed-off-by: Swarit Pandey <swarit@stepsecurity.io> chore: more golint issues - rebase this Signed-off-by: Swarit Pandey <swarit@stepsecurity.io>

swarit-stepsecurity force-pushed the swarit/feat/windows-support branch from 6711936 to f8a456c Compare April 13, 2026 17:31

feat(windows): add support for openvsx and npm

f988cd3

Signed-off-by: Swarit Pandey <swarit@stepsecurity.io>

swarit-stepsecurity marked this pull request as ready for review April 14, 2026 04:00

feat(windows): add scheduled tasks

64ef737

Signed-off-by: Swarit Pandey <swarit@stepsecurity.io>

ashishkurmi requested a review from Copilot April 14, 2026 05:32

Copilot started reviewing on behalf of ashishkurmi April 14, 2026 05:32 View session

Copilot AI reviewed Apr 14, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add windows support#17

feat: add windows support#17
swarit-stepsecurity wants to merge 5 commits intostep-security:mainfrom
swarit-stepsecurity:swarit/feat/windows-support

swarit-stepsecurity commented Apr 8, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 14, 2026

Uh oh!

Copilot AI Apr 14, 2026

Uh oh!

Copilot AI Apr 14, 2026

Uh oh!

Copilot AI Apr 14, 2026

Uh oh!

Copilot AI Apr 14, 2026

Uh oh!

Copilot AI Apr 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

swarit-stepsecurity commented Apr 8, 2026

What does this PR do?

Type of change

Testing

Related Issues

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants