feat(agent): remote self-uninstall over the control channel (VA-87) #90

Merged

Claude-Run merged 1 commit from feat/VA-87-remote-self-uninstall into main

2026-06-29 22:19:58 +02:00

Claude-Run commented

2026-06-29 22:13:22 +02:00

Member

Add an uninstall action to the post-auth control-channel dispatcher so the server can tell a connected agent to fully remove itself when a device is deleted. The agent acks the command FIRST (so the server can complete the delete) and only then spawns a detached teardown that removes the service unit and binary, wipes the enrolled identity/certs and the entire settings + data dirs, and exits the process so the removed binary cannot reconnect.

Full removal is a separate path from the audit-preserving CLI uninstall: install::uninstall_full / uninstall_full_self (systemd system + user, mode picked from the effective uid) and install_windows::uninstall_service_full (SCM service, scheduling the running exe for delete-on-reboot via MoveFileEx when it cannot be deleted live). The state-preserving CLI uninstall_system / uninstall_user / uninstall_service are unchanged. Teardown is best-effort: the identity/state wipe runs even if unit/binary removal fails, and the process exits regardless.

The teardown+exit is gated behind a new DispatchContext::apply_uninstall flag (mirroring apply_oobupdate): off by default so tests and detached dispatchers only ack, flipped on in the production net.rs wiring. Tests cover the ack-without-teardown contract, the flag default/builder, and that the full wipe removes the enrolled identity dir and is idempotent.

#VA-87

Add an `uninstall` action to the post-auth control-channel dispatcher so the server can tell a connected agent to fully remove itself when a device is deleted. The agent acks the command FIRST (so the server can complete the delete) and only then spawns a detached teardown that removes the service unit and binary, wipes the enrolled identity/certs and the entire settings + data dirs, and exits the process so the removed binary cannot reconnect. Full removal is a separate path from the audit-preserving CLI uninstall: `install::uninstall_full` / `uninstall_full_self` (systemd system + user, mode picked from the effective uid) and `install_windows::uninstall_service_full` (SCM service, scheduling the running exe for delete-on-reboot via MoveFileEx when it cannot be deleted live). The state-preserving CLI `uninstall_system` / `uninstall_user` / `uninstall_service` are unchanged. Teardown is best-effort: the identity/state wipe runs even if unit/binary removal fails, and the process exits regardless. The teardown+exit is gated behind a new `DispatchContext::apply_uninstall` flag (mirroring `apply_oobupdate`): off by default so tests and detached dispatchers only ack, flipped on in the production net.rs wiring. Tests cover the ack-without-teardown contract, the flag default/builder, and that the full wipe removes the enrolled identity dir and is idempotent. #VA-87

Claude-Run added 1 commit

2026-06-29 22:13:22 +02:00

feat(agent): remote self-uninstall over the control channel (VA-87)

Check / fmt + clippy + tests (pull_request) Successful in 6m24s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

d82069582f

Add an `uninstall` action to the post-auth control-channel dispatcher so the server can tell a connected agent to fully remove itself when a device is deleted. The agent acks the command FIRST (so the server can complete the delete) and only then spawns a detached teardown that removes the service unit and binary, wipes the enrolled identity/certs and the entire settings + data dirs, and exits the process so the removed binary cannot reconnect.

Full removal is a separate path from the audit-preserving CLI uninstall: `install::uninstall_full` / `uninstall_full_self` (systemd system + user, mode picked from the effective uid) and `install_windows::uninstall_service_full` (SCM service, scheduling the running exe for delete-on-reboot via MoveFileEx when it cannot be deleted live). The state-preserving CLI `uninstall_system` / `uninstall_user` / `uninstall_service` are unchanged. Teardown is best-effort: the identity/state wipe runs even if unit/binary removal fails, and the process exits regardless.

The teardown+exit is gated behind a new `DispatchContext::apply_uninstall` flag (mirroring `apply_oobupdate`): off by default so tests and detached dispatchers only ack, flipped on in the production net.rs wiring. Tests cover the ack-without-teardown contract, the flag default/builder, and that the full wipe removes the enrolled identity dir and is idempotent.

#VA-87