feat(devicepolicy): enforce VS Code extension allowlist

.github/workflows/tests.yml

@@ -96,6 +96,26 @@ jobs:
           go-version-file: go.mod
       - run: make test
 
+  # devicepolicy has Windows-only code (the registry managed-policy probe) and
+  # Windows-specific behavior (%APPDATA% settings-path resolution) whose tests
+  # the macOS test job can only cross-compile, not run. This job executes the
+  # package natively; scoped to it so the rest of the suite (which assumes a
+  # POSIX host) is untouched.
+  test-windows-devicepolicy:
+    name: Test (windows devicepolicy)
+    runs-on: windows-latest
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        with:
+          go-version-file: go.mod
+      - run: go test -race -count=1 ./internal/devicepolicy/
+
   smoke:
     name: Smoke Tests
     runs-on: macos-latest

cmd/stepsecurity-dev-machine-guard/main.go

@@ -19,6 +19,7 @@ import (
 	"github.com/step-security/dev-machine-guard/internal/config"
 	"github.com/step-security/dev-machine-guard/internal/detector/configaudit"
 	"github.com/step-security/dev-machine-guard/internal/device"
+	"github.com/step-security/dev-machine-guard/internal/devicepolicy"
 	"github.com/step-security/dev-machine-guard/internal/executor"
 	"github.com/step-security/dev-machine-guard/internal/featuregate"
 	"github.com/step-security/dev-machine-guard/internal/launchd"
@@ -250,6 +251,7 @@ func main() {
 			os.Exit(1)
 		}
 		runHookStateReconcile(exec, log)
+		runIDEExtensionEnforce(exec, log)
 
 	case "install":
 		_, _ = fmt.Fprintf(os.Stdout, "StepSecurity Dev Machine Guard v%s\n\n", buildinfo.Version)
@@ -302,6 +304,7 @@ func main() {
 				log.Warn("could not trigger initial scan (%v) — the scheduled task will fire on its next interval", err)
 			}
 			runHookStateReconcile(exec, log)
+			runIDEExtensionEnforce(exec, log)
 			return
 		}
 
@@ -337,6 +340,7 @@ func main() {
 			}
 		}
 		runHookStateReconcile(exec, log)
+		runIDEExtensionEnforce(exec, log)
 
 	case "uninstall":
 		_, _ = fmt.Fprintf(os.Stdout, "StepSecurity Dev Machine Guard v%s\n\n", buildinfo.Version)
@@ -637,3 +641,69 @@ func runHookStateReconcile(exec executor.Executor, log *progress.Logger) {
 		aiagentscli.AppendError("reconcile", "reconcile_failed", err.Error(), "")
 	}
 }
+
+// devicePolicyEnforceTimeout caps the entire IDE-extension enforcement step (fetch +
+// managed-policy probe + settings.json write/readback + compliance report).
+// The two network calls are each bounded by devicepolicy.DefaultHTTPTimeout; the
+// rest is local file/registry I/O.
+const devicePolicyEnforceTimeout = 30 * time.Second
+
+// runIDEExtensionEnforce fetches the device's effective IDE-extension policy
+// and converges the user-scope VS Code settings.json (extensions.allowed) to
+// match, then reports compliance — all on the existing scheduled cycle and the
+// existing agent auth channel. Windows, macOS, and Linux are all enforced this
+// way; a device whose VS Code is already governed by a real MDM policy
+// (registry / policy.json / managed preferences) is detected by the
+// reconciler's probe and reported mdm_managed instead. Gated behind
+// FeatureDevicePolicy and a silent no-op in community mode (enterprise
+// config missing). Failures are logged but never crash main.
+func runIDEExtensionEnforce(exec executor.Executor, log *progress.Logger) {
+	if !featuregate.IsEnabled(featuregate.FeatureDevicePolicy) {
+		log.Debug("ide-extension enforce: skipped (feature gated)")
+		return
+	}
+	writer, ok := devicepolicy.NewWriter()
+	if !ok {
+		log.Debug("ide-extension enforce: skipped (no settings path on this platform)")
+		return
+	}
+	cfg, ok := ingest.Snapshot()
+	if !ok {
+		log.Debug("ide-extension enforce: skipped (no enterprise config)")
+		return
+	}
+	fetcher, ok := devicepolicy.NewHTTPFetcher(cfg, nil)
+	if !ok {
+		log.Debug("ide-extension enforce: skipped (fetcher init refused config)")
+		return
+	}
+	reporter, ok := devicepolicy.NewHTTPReporter(cfg, nil)
+	if !ok {
+		log.Debug("ide-extension enforce: skipped (reporter init refused config)")
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), devicePolicyEnforceTimeout)
+	defer cancel()
+
+	dev := device.Gather(ctx, exec)
+	if dev.SerialNumber == "" || dev.SerialNumber == "unknown" {
+		log.Warn("ide-extension enforce: device serial unresolved; skipping")
+		return
+	}
+
+	r := &devicepolicy.Reconciler{
+		Fetcher:    fetcher,
+		Reporter:   reporter,
+		Writer:     writer,
+		CustomerID: cfg.CustomerID,
+		DeviceID:   dev.SerialNumber,
+		Platform:   dev.Platform,
+		// Probe defaults to devicepolicy.ProbeManagedPolicy (per-OS) when nil.
+		Logf: func(format string, args ...any) { log.Debug(format, args...) },
+	}
+	if err := r.Reconcile(ctx); err != nil {
+		log.Warn("ide-extension enforce: %v", err)
+		aiagentscli.AppendError("devicepolicy", "enforce_failed", err.Error(), "")
+	}
+}

go.mod

@@ -8,6 +8,7 @@ require (
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
 	github.com/google/uuid v1.6.0
 	github.com/pelletier/go-toml/v2 v2.3.1
+	github.com/tailscale/hujson v0.0.0-20260302212456-ecc657c15afd
 	github.com/tidwall/gjson v1.18.0
 	github.com/tidwall/pretty v1.2.1
 	github.com/tidwall/sjson v1.2.5

go.sum

@@ -1,9 +1,13 @@
+github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
+github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/pelletier/go-toml/v2 v2.3.1 h1:MYEvvGnQjeNkRF1qUuGolNtNExTDwct51yp7olPtrEc=
 github.com/pelletier/go-toml/v2 v2.3.1/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/tailscale/hujson v0.0.0-20260302212456-ecc657c15afd h1:Rf9uhF1+VJ7ZHqxrG8pJ6YacmHvVCmByDmGbAWCc/gA=
+github.com/tailscale/hujson v0.0.0-20260302212456-ecc657c15afd/go.mod h1:EbW0wDK/qEUYI0A5bqq0C2kF8JTQwWONmGDBbzsxxHo=
 github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
 github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=
 github.com/tidwall/gjson v1.18.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=

internal/aiagents/adapter/adapter.go

@@ -81,7 +81,7 @@ type InstallResult struct {
 
 	// BackupFiles are pre-existing files Install copied aside before
 	// rewriting, named with the .dmg-<UTC stamp>.bak suffix from
-	// internal/aiagents/atomicfile.
+	// internal/atomicfile.
 	BackupFiles []string
 
 	// CreatedDirs are parent directories Install mkdir'd. Order is

internal/aiagents/adapter/claudecode/settings.go

@@ -14,9 +14,9 @@ import (
 	"github.com/tidwall/pretty"
 	"github.com/tidwall/sjson"
 
-	"github.com/step-security/dev-machine-guard/internal/aiagents/atomicfile"
 	"github.com/step-security/dev-machine-guard/internal/aiagents/configedit"
 	"github.com/step-security/dev-machine-guard/internal/aiagents/event"
+	"github.com/step-security/dev-machine-guard/internal/atomicfile"
 )
 
 // settingsDoc holds raw bytes for ~/.claude/settings.json. orig is the

internal/aiagents/adapter/codex/settings.go

@@ -15,9 +15,9 @@ import (
 	"github.com/tidwall/pretty"
 	"github.com/tidwall/sjson"
 
-	"github.com/step-security/dev-machine-guard/internal/aiagents/atomicfile"
 	"github.com/step-security/dev-machine-guard/internal/aiagents/configedit"
 	"github.com/step-security/dev-machine-guard/internal/aiagents/event"
+	"github.com/step-security/dev-machine-guard/internal/atomicfile"
 )
 
 const (