feat(agent): implement package broker

[Vladyslav Nikonov (vnikonov-devolutions)]

Implements now package broker (Also see UniGetUI WIP branch Devolutions/UniGetUI#4826)

Implemented

• Policy parsing (both json and yaml), evaluation, JSON scheme generation.
• Dry-run executor
• Windows executor/command builder for winget & PowerShell; needs refining but implements most of the functionality
• Elevated/non elevated execution with user impersonation.
• Pipe auth - validate effective user & calling executable signature
• Made some updated to initial PoC schema - cleaned up, renamed and restructured some fields, added new request/response for polling operation status

Not implemented yet

• Other managers except winget and powershell

Steps to run this branch:

• Compile and replace DevolutionsAgent.exe from this branch.
• Add new agent config fields:
  • "PackageBroker":{"Enabled":true, "PolicyPath": "C:/path/to/policy.json"}
  • If testing with non-MSI UniGetUI isntallation, disable signature validation:
    "__debug__": { "skip_broker_signature_validation": true }
• Create empty UseAgentBroker file at %LOCALAPPDATA%/UniGetUI/Configuration (UniGetUI uses file-based config)
• Start Agent
• Start UniGetUI, test

Do not merge yet, testing in progress

[github-actions]

Let maintainers know that an action is required on their side

• Add the label release-required Please cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module) when you request a maintainer to cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module)

• Add the label release-blocker Follow-up is required before cutting a new release if a follow-up is required before cutting a new release

• Add the label publish-required Please publish libraries (`Devolutions.Gateway.Utils`, OpenAPI clients, etc) when you request a maintainer to publish libraries (Devolutions.Gateway.Utils, OpenAPI clients, etc.)

• Add the label publish-blocker Follow-up is required before publishing libraries if a follow-up is required before publishing libraries

[Copilot]

Pull request overview

Implements an early Windows package broker for Devolutions Agent.

Changes:

• Adds policy loading, evaluation, live reload, and sample scenarios.
• Adds authenticated named-pipe APIs, operation tracking, and status polling.
• Adds WinGet/PowerShell command builders and elevated execution.

Reviewed changes

Copilot reviewed 47 out of 48 changed files in this pull request and generated 24 comments.

Show a summary per file

File	Description
.gitattributes	Adds asset and YAML attributes.
Cargo.lock	Locks new broker dependencies.
devolutions-agent/Cargo.toml	Adds broker dependencies and Windows features.
devolutions-agent/src/lib.rs	Exposes Windows broker modules.
devolutions-agent/src/service.rs	Starts the configured broker task.
devolutions-agent/src/config.rs	Adds broker and debug configuration.
devolutions-agent/src/code_signing.rs	Centralizes signature validation.
devolutions-agent/src/updater/package.rs	Reuses signature helpers.
devolutions-agent/src/broker/mod.rs	Defines broker modules.
devolutions-agent/src/broker/auth.rs	Authenticates pipe clients.
devolutions-agent/src/broker/task.rs	Coordinates broker subsystems.
devolutions-agent/src/broker/pipe.rs	Implements named-pipe transport.
devolutions-agent/src/broker/policy_loader.rs	Loads JSON/YAML policies.
devolutions-agent/src/broker/policy_watcher.rs	Implements policy hot reload.
devolutions-agent/src/broker/operation_tracker.rs	Tracks asynchronous operations.
devolutions-agent/src/broker/server/mod.rs	Implements broker API behavior.
devolutions-agent/src/broker/server/connection.rs	Serves HTTP pipe connections.
devolutions-agent/src/broker/server/execution.rs	Runs background operations.
devolutions-agent/src/broker/server/responses.rs	Builds API responses.
devolutions-agent/src/broker/executor/mod.rs	Defines execution abstractions.
devolutions-agent/src/broker/executor/output.rs	Handles output and exit codes.
devolutions-agent/src/broker/executor/windows/mod.rs	Implements Windows execution plans.
devolutions-agent/src/broker/executor/windows/process.rs	Creates user-token processes.
devolutions-agent/src/broker/executor/windows/token.rs	Resolves sessions and tokens.
devolutions-agent/src/broker/command_builder/mod.rs	Dispatches command construction.
devolutions-agent/src/broker/command_builder/winget.rs	Builds WinGet commands.
devolutions-agent/src/broker/command_builder/powershell.rs	Builds PowerShell commands.
devolutions-agent/src/broker/evaluator/mod.rs	Implements policy precedence.
devolutions-agent/src/broker/evaluator/matching.rs	Matches request attributes.
devolutions-agent/src/broker/evaluator/constraints.rs	Enforces rule constraints.
devolutions-agent/src/broker/evaluator/version.rs	Matches version ranges.
devolutions-agent/src/broker/evaluator/wildcard.rs	Implements wildcard matching.
devolutions-agent/src/broker/evaluator/tests.rs	Tests policy evaluation.
devolutions-agent/src/broker/scenario_tests.rs	Runs sample scenarios.
devolutions-agent/src/broker/assets/samples/corporate-allowlist.policy.json	Adds allowlist policy sample.
devolutions-agent/src/broker/assets/samples/deny-risky-options.policy.json	Adds deny-list policy sample.
devolutions-agent/src/broker/assets/samples/scenarios/baseline.scenarios.json	Defines baseline scenarios.
devolutions-agent/src/broker/assets/samples/requests/winget-vscode-install.request.json	Adds allowed request sample.
devolutions-agent/src/broker/assets/samples/requests/winget-vscode-skiphash.request.json	Adds risky request sample.
devolutions-agent/src/broker/assets/samples/requests/winget-unknown-install.request.json	Adds denied request sample.
crates/devolutions-agent-shared/Cargo.toml	Adds temporary-file dependencies.
crates/devolutions-agent-shared/src/lib.rs	Exposes temporary-file utilities.
crates/devolutions-agent-shared/src/temp_file.rs	Adds shared temporary-script handling.
devolutions-session/Cargo.toml	Removes direct tempfile dependency.
devolutions-session/src/main.rs	Removes obsolete dependency import.
devolutions-session/src/dvc/fs.rs	Re-exports the shared guard.
devolutions-session/src/dvc/task.rs	Uses shared script utilities.
devolutions-session/src/dvc/process.rs	Converts I/O execution errors.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Vladyslav Nikonov (vnikonov-devolutions)]

Current improvements list (generated by Copilot):

Priority	Workstream	Missing / improvement
P0	Secure process execution	Timeout currently terminates only the root process. Add Windows Job Object / process-tree cleanup so installers, PowerShell children, and nested processes cannot survive timeout.
P0	Secure temp scripts	Broker scripts are no longer in user TEMP, but the helper still creates/keeps files by path and then applies ACL after creation. Build a Windows secure temp-script helper: broker-controlled directory, create with DACL up front, grant only target user read/execute, keep safe handle/sharing semantics until launch.
P0	WinGet trust model	Current trusted WinGet resolution still accepts %LOCALAPPDATA%\Microsoft\WindowsApps\winget.exe. Validate Microsoft/AppInstaller identity or resolve via a safer AppX/app execution alias path, not just path prefix.
P0	Default policy discovery	If default policy is absent, the watcher pins package-broker-policy.json; creating .yaml / .yml later will not resume. Default watcher should track all supported candidate extensions.
P0	Config schema/docs	config_schema.json and user docs do not mention PackageBroker or SkipBrokerSignatureValidation. This blocks reliable deployment/configuration.
P0	PowerShell capability mismatch	Capabilities advertise PowerShell custom parameters as supported, but command builder now rejects them. Either advertise supports_custom_parameters: false for PowerShell managers or implement safe structured parameter parsing.
P0	Effective user identity	Unqualified effective_user is still accepted and can be ambiguous across domains/local accounts. Prefer requiring domain-qualified identity or, better, bind to SID.
P1	Source binding	WinGet uses --source  only; policy can include source.url, but execution does not verify name-to-URL mapping. Add source URL/type verification or reject URL-bearing WinGet requests until supported.
P1	PowerShell command correctness	Verify real PowerShellGet/PSResourceGet behavior for -Repository on uninstall and version flags on update through integration tests. Current builders are unit-tested syntactically only.
P1	Policy defaults	PolicyConstraints::default() is permissive for risky options: custom params, pre/post commands, kill-before-operation, skip hash, interactive. Decide whether broker should enforce safer defaults or ship hardened policy templates.
P1	Version matching	API says package versions are lenient/non-SemVer, but range matching now requires SemVer. Need manager-specific comparators or clear policy documentation that ranges only apply to SemVer-compatible versions.
P1	Package name matching	package_names criteria currently fail closed because requests do not carry display names. Either implement package-name resolution or remove/diagnose unsupported criteria.
P1	Operation lifecycle	Cancellation is only timeout-driven. Add explicit cancel endpoint/task control if clients need to stop long-running installs.
P1	Operation ownership/idempotency	Owner key is built from request strings after validation. Store owner identity from authenticated/canonical pipe client data instead, and define whether retry fingerprints should include volatile fields like created_at / diagnostics flags.
P1	Shutdown cleanup	Broker now uses CancellationToken, but only the pipe server task is joined. Join watcher, relay, and eviction tasks to guarantee clean service shutdown.
P1	Concurrency control	No per-user/global operation limits or queueing. Add throttling to avoid parallel installers fighting over MSI/WinGet/PowerShell state.
P1	Output truncation marker	Bounded reader drops old bytes but no longer tracks whether truncation occurred before tail_utf8. Add a real tail buffer with a truncated flag.
P1	Auditability	Add structured audit logs for evaluate/execute/status: authenticated user, client exe thumbprint, policy id/revision, rule id, operation id, result. Keep command args redacted.
P2	Structured status details	details is always None. Either keep unsupported, or add useful details: reboot required, known WinGet/MSI reason, package manager, policy rule, timeout cause.
P2	Health diagnostics	Health only says ready/paused and policy id. Include last policy load error/revision/time for supportability.
P2	Client packaging story	Server validates a signed client executable path, but this branch does not define/distribute the expected broker client binary or installation path contract.
P2	Integration tests	Add Windows integration tests for named-pipe auth, status auth, signature-skip mode, real process launch, UTF-8 capture, timeout kill, policy reload, default missing policy recovery.
P2	Shared Windows helpers	Move DACL/temp-script/process-tree helpers into shared/win wrapper crates once stable; current broker-local Win32 ACL code duplicates updater patterns.
P2	Performance cleanup	Wildcard matching compiles regexes on every evaluation. Cache compiled patterns or use a glob matcher if policies grow.

Suggested parallel split:

Track	Can own independently
Execution/security	Job-object timeout, secure temp scripts, WinGet trust, SID/domain identity.
Manager semantics	WinGet source verification, PowerShell parameter/capability fixes, real manager integration tests.
Policy engine	Default policy multi-extension watching, version comparators, package-name support, safer constraints.
API/lifecycle	Operation cancellation, ownership/idempotency cleanup, concurrency limits, structured status.
Ops/docs	Config schema, docs, sample policies, audit/health improvements.
Test harness	Windows end-to-end broker tests and fixtures that other tracks can reuse.

[Benoît Cortier (CBenoit)]

Given the diff size, I’ll honestly not be able to review as well as I wish I could. For the sake of merging quickly, do you think you could flag me some areas that you think are worth spending extra time reviewing on my end? Can you double check that nothing that is stable today is affected by this? The idea is that it’s okay to merge a POC in a somewhat unfinished state for improved velocity, so it’s easier to iterate together with follow up PRs against master, but it should not impact negatively any other stable component. Anything that is affecting other stable modules should be extracted in a dedicated PR so I can perform the usual hardened review. Otherwise, I’ll just conduct a minimal review and approve possibly with follow up suggestions. How does that sound?

[Vladyslav Nikonov (vnikonov-devolutions)]

do you think you could flag me some areas that you think are worth spending extra time reviewing on my end

I think mostly windows executor need some review for critical security issues, and the code from devolutions-agent/updater which was moved to shared code but other than that, I think everything stable is untouched