feat(agent): expose active package policy by CBenoit · Pull Request #1937 · Devolutions/devolutions-gateway

Benoît Cortier (CBenoit) · 2026-08-17T18:30:06Z

Exposes the validated active package-broker policy through the shared authenticated GET /v1/policy route. Clients receive a stable policy snapshot, while unavailable policies return a structured 503 response without leaking policy source or file-security details.

Coordinated Phase 1 pull requests: Devolutions/now-libraries#93 defines the shared contract, Devolutions/devolutions-gateway#1937 implements the Agent endpoint, and Devolutions/UniGetUI#5292 consumes it.

The Agent implementation was integrated against exact shared contract head 032a8f2376bf4ef32e94f04fe672651dd22227a3 using a temporary external Cargo patch for now-policy, now-policy-api, and now-policy-server-template. It implements the required active_policy trait method and keeps policy/API enum and identifier mappings explicit in the broker after removal of the shared policy-compat conversions. No local paths, git dependencies, or temporary sources are committed.

Focused server tests passed (22/22), focused evaluator tests passed (25/25), broker Clippy passed with warnings denied, and the Devolutions Agent build passed. The full broker run passed 253 tests with 1 ignored before the pre-existing host-specific winget_app_exec_alias_passes_elevated_verification test rejected the local WindowsApps winget.exe DACL because it grants the current user write access.

Commit ab7591b5a8efe00c9a084d295cbbeda95fea1a57 applies a registry-only Cargo.lock correction after removal of policy-compat: it removes the two obsolete optional now-policy dependency edges so cargo metadata --locked and Linux locked jobs can resolve the tracked manifest. This lockfile correction contains no local path sources and is separate from the expected Windows compile blocker against the published 0.3.x crates.

This draft remains blocked until now-policy-api 0.4.0 and now-policy-server-template 0.4.0 are published and the final registry versions are available. Do not replace that publication gate with local or git dependencies.

Issue: Devolutions/now-libraries#93

Co-authored-by: Copilot App 223556219+Copilot@users.noreply.github.com

Expose the validated active package-broker policy through the shared authenticated GET /v1/policy route. Return a structured unavailable error without leaking policy source or file-security details. This requires now-policy-api and now-policy-server-template 0.4.0 from Devolutions/now-libraries#93 before the change can ship. Issue: Devolutions/now-libraries#93 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Benoît Cortier (CBenoit) · 2026-08-17T18:31:14Z

Implementation notes:

Implements the shared PackageBrokerServer::policy override from feat: add active package policy inspection contract now-libraries#93.
Reuses the named-pipe client's captured executable identity and existing Authenticode validation before policy access.
Clones the active Arc<PolicyDocument> while holding the read lock, releases the lock, and only then clones the owned response document for serialization.
Reuses the generic BrokerPaused error mapping for HTTP 503 and does not expose watcher errors, paths, source documents, security descriptors, or policy bodies in logs.
Covers empty and full policy serialization, structured unavailable responses, unsigned-client rejection, existing routes, implicit HEAD, rejected methods, unknown-route 404, and concurrent replacement without mixed snapshots.

Validated against frozen shared commit 961e833c929793116b697e0943a7573ad6e21398 by temporarily patching all three policy crates from one external checkout so PolicyDocument has a single Cargo package identity. No patch paths or temporary lockfile changes are committed.

Commands and results:

cargo +nightly fmt --all
# passed

cargo test --config <temporary-patch-config> -p now-package-broker server::tests::policy_route_rejects_unsigned_client
# 1 passed

cargo test --config <temporary-patch-config> -p now-package-broker --features dev-skip-broker-signature server::tests::policy_
# 4 passed

cargo test --config <temporary-patch-config> -p now-package-broker server::tests::concurrent_policy_replacement_returns_only_complete_snapshots
# 1 passed

cargo clippy --config <temporary-patch-config> -p now-package-broker --all-targets -- -D warnings
cargo clippy --config <temporary-patch-config> -p now-package-broker --all-targets --features dev-skip-broker-signature -- -D warnings
cargo clippy --workspace --tests --config <temporary-patch-config> -- -D warnings
# passed

cargo build -j 2 -p devolutions-agent --config <temporary-patch-config>
# passed

cargo test -j 2 --workspace --config <temporary-patch-config>
# stopped after 251 passed and 1 ignored because the existing host-specific
# winget_app_exec_alias_passes_elevated_verification test rejected the local
# WindowsApps winget.exe DACL

The draft remains blocked until now-policy-api 0.4.0 and now-policy-server-template 0.4.0 are published and the tracked manifest/lockfile can move from 0.3.x to those registry releases.

Note

LLM-assisted content (no human feedback).

Copilot

Pull request overview

Adds authenticated active-policy inspection to the Agent’s package broker.

Changes:

Implements GET /v1/policy with structured responses.
Reuses connection authentication and adds snapshot/concurrency tests.
Remains blocked on publishing and committing the 0.4.0 dependencies.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
`crates/now-package-broker/src/server/mod.rs`	Implements and tests policy retrieval.
`crates/now-package-broker/src/auth.rs`	Exposes connection-level authentication for the endpoint.

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Return a generic policy-unavailable message so clients cannot infer whether the active policy is file-backed, missing, or corrupt. Issue: Devolutions/now-libraries#93 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Adopt the final shared server trait and keep policy-domain conversions owned by the broker after the compatibility feature removal. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Record the registry graph after removing the obsolete policy compatibility features so locked CI can resolve the manifest consistently. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Exercise the policy HTTP contract from the repository integration tests while keeping authentication and snapshot-locking invariants beside the broker implementation. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Launch the Agent through its CLI and issue HTTP requests over a real Tokio named-pipe client. Build the test Agent with the development signature bypass while requiring the matching debug configuration opt-in. Remove the in-process broker test harness and its testsuite dependencies; retain authentication and snapshot-locking invariants as broker unit tests. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Move privileged policy endpoint coverage into a dedicated tester so the active-policy path cannot silently skip in normal test runs. Run it as LocalSystem in CI with a development-only signature bypass. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 11 out of 12 changed files in this pull request and generated 2 comments.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Benoît Cortier (CBenoit) mentioned this pull request Aug 17, 2026

feat: add active package policy inspection contract Devolutions/now-libraries#93

Merged

Benoît Cortier (CBenoit) requested a balanced review from Copilot August 18, 2026 03:58

Copilot started reviewing on behalf of Benoît Cortier (CBenoit) August 18, 2026 03:58 View session

Copilot AI reviewed Aug 18, 2026

View reviewed changes

Comment thread crates/now-package-broker/src/server/mod.rs Outdated

fix(agent): hide policy source details

4c6dc53

Return a generic policy-unavailable message so clients cannot infer whether the active policy is file-backed, missing, or corrupt. Issue: Devolutions/now-libraries#93 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Benoît Cortier (CBenoit) mentioned this pull request Aug 18, 2026

Add read-only package broker policy inspector Devolutions/UniGetUI#5292

Draft

Benoît Cortier (CBenoit) and others added 8 commits August 26, 2026 21:19

fix(agent): align policy contract integration

03b3710

Adopt the final shared server trait and keep policy-domain conversions owned by the broker after the compatibility feature removal. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

build(agent): refresh policy dependency lock

ab7591b

Record the registry graph after removing the obsolete policy compatibility features so locked CI can resolve the manifest consistently. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

refactor(agent): localize policy API alias

2a3f0b6

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

refactor(agent): simplify policy match expression

d67d895

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

test(agent): move policy routes to testsuite

04f7486

Exercise the policy HTTP contract from the repository integration tests while keeping authentication and snapshot-locking invariants beside the broker implementation. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

chore: merge origin/master

1ee9a37

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Benoît Cortier (CBenoit) requested a balanced review from Copilot August 28, 2026 16:54

Copilot started reviewing on behalf of Benoît Cortier (CBenoit) August 28, 2026 16:55 View session

Copilot AI reviewed Aug 28, 2026

View reviewed changes

Comment thread .github/workflows/ci.yml

Comment thread crates/now-package-broker/Cargo.toml

ci: preserve Agent policy build failures

c760e37

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Navigation Menu

Uh oh!

feat(agent): expose active package policy - #1937

feat(agent): expose active package policy#1937
Benoît Cortier (CBenoit) wants to merge 11 commits into
masterfrom
cbenoit-plan-agent-policy-endpoint

Benoît Cortier (CBenoit) commented Aug 17, 2026 •

edited

Loading

Uh oh!

Benoît Cortier (CBenoit) commented Aug 17, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Benoît Cortier (CBenoit) commented Aug 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Benoît Cortier (CBenoit) commented Aug 17, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Benoît Cortier (CBenoit) commented Aug 17, 2026 •

edited

Loading