Use the Windows installer for Warp Agent CLI autoupdates by kevinyang372 · Pull Request #14477 · warpdotdev/warp

kevinyang372 · 2026-07-29T16:51:41Z

Description

Make Windows Warp Agent CLI background updates download and execute the same signed Inno installer used for initial installation.

Windows no longer parses or installs ZIP payloads in Rust. The updater verifies the installer with WinVerifyTrust, invokes it silently against the detected managed root, verifies the completed version and active pointer, and then performs conservative lease-aware cleanup. Unix tarball updates, polling, status, telemetry, custom-root detection, and live-version leases are unchanged.

Artifact publication remains intentionally disabled. This replaces reference PR #14446 without modifying it.

Depends on #14476 and warpdotdev/warp-server#13497.

Implementation plan: https://staging.warp.dev/drive/notebook/BI2TyxneCNDssiTUVIF0iK

Linked Issue

The linked issue is labeled ready-to-spec or ready-to-implement.
Where appropriate, screenshots or a short video of the implementation are included below.

Testing

./script/format
Repository-prescribed split Clippy checks
cargo test -p warp_tui --lib autoupdate --features release_bundle,standalone,crash_reporting — 17 passed
Windows tests retain Authenticode rejection, installed-payload validation, custom-root arguments, current/previous behavior, rollback retention, and live-version garbage collection
Native Windows and cross-repository release validation will be linked after the remote branches are exercised
I have manually tested my changes locally with ./script/run

Agent Mode

Warp Agent Mode - This PR was created via Warp's AI Agent Mode

CHANGELOG-NONE

Co-Authored-By: Warp agent@warp.dev

kevinyang372 · 2026-07-29T16:51:54Z

This stack of pull requests is managed by Graphite. Learn more about stacking.

oz-for-oss · 2026-07-29T16:54:56Z

@kevinyang372

I'm starting a first review of this pull request.

You can view the conversation on Warp.

I completed the review and no human review was requested for this pull request.

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

oz-for-oss

Overview

This PR changes Warp Agent CLI autoupdates on Windows to download, verify, and execute the signed Inno installer instead of unpacking ZIP payloads in Rust, while leaving Unix archive updates mostly unchanged.

Concerns

The Windows silent installer invocation does not pass the background-update flags that keep Inno from treating this as a normal install, so it can prompt/close the running process or skip update-specific handling.
The Authenticode verification only checks that the file chains to any trusted code-signing publisher and disables revocation checking, which is too weak for a silent autoupdate executable.

Security

The downloaded installer and installed payload executables should be verified against Warp's expected publisher/certificate identity with revocation checks enabled before execution/acceptance.

Verdict

Found: 0 critical, 2 important, 0 suggestions

Request changes

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

acarl005

I think a wholistic pass over the generated unit tests is needed as there is a lot of things being tested that don't fall under the purview of unit tests.

acarl005 · 2026-07-30T22:14:19Z

+}
+
+#[test]
+fn windows_installer_arguments_preserve_custom_root() {


I would delete this windows_installer_arguments_preserve_custom_root test (and just inline windows_installer_args)

I could simplify these. tests!

Removed the argument test and the windows_installer_args helper. The installer arguments are now inlined at the execution call site in 9bd38f0.

acarl005 · 2026-07-30T22:25:36Z

+}
+
+#[cfg(windows)]
+fn verify_authenticode_signer(path: &Path) -> Result<String> {


I don't think signature verification is necessary. The GUI is already performing unattended upgrades on auto-update. We rely on the HTTPS/TLS security to ensure that the file we download is legitimate. This is redundant. I'd remove this whole procedure.

Removed the entire WinTrust/Authenticode verification procedure and the resulting windows crate dependency in 9bd38f0. The updater now relies on the existing HTTPS/TLS download path, matching the GUI autoupdate model.

acarl005 · 2026-07-30T22:31:02Z

+        "/update=1".into(),
+        "/NOCLOSEAPPLICATIONS".into(),
+        install_dir,
+        "/SKIP_PATH_UPDATE=1".into(),


Oops. I missed this detail when reviewing #14475 but with Inno Setup scripts it's conventional to use all uppercase for built-in params and lowercase for custom params. That's why it's /update=1. Same goes for param:WARP_BIN_DIR and any others in script/windows/tui-installer.iss

Suggested change

"/SKIP_PATH_UPDATE=1".into(),

"/skip_path_update=1".into(),

Ah I didn't know that

Updated in 9bd38f0: this is now /skip_path_update=1, and all custom parameters in tui-installer.iss and its integration test (warp_bin_dir, skip_path_update, and allow_downgrade) are lowercase.

acarl005 · 2026-07-30T22:36:31Z

+        fs::copy(&signed_executable, version_dir.join("vcruntime140.dll")).unwrap();
+        fs::copy(&signed_executable, version_dir.join("vcruntime140_1.dll")).unwrap();
+        fs::copy(&signed_executable, version_dir.join("msvcp140.dll")).unwrap();
+    }


This smells like out-of-scope for unit testing.

Fully removed in c0f66f0. The Rust completeness checks and unit fixtures no longer enumerate or create the Windows packaged payload files; shared updater tests now create only the binary and resources/. Installer payload completeness remains covered by the Inno installer integration test.

acarl005 · 2026-07-30T22:42:17Z

+        .chain(std::iter::once(0))
+        .collect::<Vec<_>>();
+    let result = unsafe {
+        MoveFileExW(


We're dropping down to the low-level Win32 API to move a file with MoveFileExW instead of calling std::fs::rename?? It looks like it's for the purpose of passing the MOVEFILE_WRITE_THROUGH flag. That does add an extra level of guarantee that the file is flushed to disk... but this function is guarded with cfg(test) and I really doubt that such esoteric stuff is needed for a unit test. This smells like it's very out-of-scope for unit tests.

Will remove this

Removed the test-only Windows point_current_at/MoveFileExW implementation and the atomic activation unit test in 9bd38f0. Cross-platform tests now write the Windows text pointer directly as fixture setup.

acarl005 · 2026-07-30T22:45:02Z

+    if let Some(system_root) = std::env::var_os("SystemRoot").map(PathBuf::from) {
+        candidates.push(system_root.join("System32/WindowsPowerShell/v1.0/powershell.exe"));


hardcoded separators are an anti-pattern. see here:

warp/app/src/terminal/available_shells.rs

Lines 730 to 735 in cd45ebb

let user_location = Path::new(&local_app_data_path)

.join("Programs")

.join("Git")

.join("usr")

.join("bin")

.join("bash.exe");

Removed this signed-executable discovery fixture in 9bd38f0, including the hardcoded-separator paths. The simplified Windows fixture setup now constructs paths exclusively with Path::join.

Co-Authored-By: Warp <agent@warp.dev>

cla-bot Bot added the cla-signed label Jul 29, 2026

kevinyang372 mentioned this pull request Jul 29, 2026

Build Warp Agent CLI with the Windows installer #14475

Merged

4 tasks

kevinyang372 mentioned this pull request Jul 29, 2026

Build the Windows Warp Agent CLI installer in dev releases #14476

Merged

4 tasks

kevinyang372 marked this pull request as ready for review July 29, 2026 16:54

oz-for-oss Bot reviewed Jul 29, 2026

View reviewed changes

Comment thread crates/warp_tui/src/autoupdate.rs Outdated

Comment thread crates/warp_tui/src/autoupdate.rs Outdated

kevinyang372 force-pushed the 07-29-use_windows_warp_agent_cli_installer_for_autoupdates branch from 58ace2d to eabae0d Compare July 29, 2026 17:37

kevinyang372 force-pushed the 07-29-use_windows_warp_agent_cli_installer_for_autoupdates branch 2 times, most recently from f1491fa to ba1452d Compare July 29, 2026 21:07

kevinyang372 requested a review from acarl005 July 29, 2026 21:17

kevinyang372 force-pushed the 07-29-use_windows_warp_agent_cli_installer_for_autoupdates branch from ba1452d to 7d04937 Compare July 29, 2026 21:31

kevinyang372 force-pushed the 07-29-use_windows_warp_agent_cli_installer_for_autoupdates branch from 7d04937 to a0beaf4 Compare July 30, 2026 02:27

kevinyang372 force-pushed the 07-29-use_windows_warp_agent_cli_installer_for_autoupdates branch 2 times, most recently from 9f15233 to c39e9c5 Compare July 30, 2026 22:46

acarl005 requested changes Jul 30, 2026

View reviewed changes

kevinyang372 force-pushed the 07-29-use_windows_warp_agent_cli_installer_for_autoupdates branch 2 times, most recently from 9bd38f0 to c0f66f0 Compare July 30, 2026 23:25

kevinyang372 requested a review from acarl005 July 30, 2026 23:26

acarl005 approved these changes Jul 30, 2026

View reviewed changes

Base automatically changed from 07-29-build_windows_warp_agent_cli_inno_in_dev_releases to master July 31, 2026 01:31

Use the Windows installer for Warp Agent CLI autoupdates

16434a6

Co-Authored-By: Warp <agent@warp.dev>

kevinyang372 force-pushed the 07-29-use_windows_warp_agent_cli_installer_for_autoupdates branch from c0f66f0 to 16434a6 Compare July 31, 2026 01:47

kevinyang372 merged commit d9ed472 into master Jul 31, 2026
42 of 44 checks passed

kevinyang372 deleted the 07-29-use_windows_warp_agent_cli_installer_for_autoupdates branch July 31, 2026 03:59

		if let Some(system_root) = std::env::var_os("SystemRoot").map(PathBuf::from) {
		candidates.push(system_root.join("System32/WindowsPowerShell/v1.0/powershell.exe"));

	let user_location = Path::new(&local_app_data_path)
	.join("Programs")
	.join("Git")
	.join("usr")
	.join("bin")
	.join("bash.exe");

Uh oh!

Conversation

kevinyang372 commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Linked Issue

Testing

Agent Mode

Uh oh!

kevinyang372 commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

oz-for-oss Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

oz-for-oss Bot left a comment

Choose a reason for hiding this comment

Overview

Concerns

Security

Verdict

Uh oh!

Uh oh!

Uh oh!

acarl005 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kevinyang372 Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kevinyang372 Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

kevinyang372 commented Jul 29, 2026 •

edited

Loading

kevinyang372 commented Jul 29, 2026 •

edited

Loading

oz-for-oss Bot commented Jul 29, 2026 •

edited

Loading

kevinyang372 Jul 30, 2026 •

edited

Loading

kevinyang372 Jul 30, 2026 •

edited

Loading