feat(agent): implement package broker#1847
Open
Vladyslav Nikonov (vnikonov-devolutions) wants to merge 3 commits into
Open
feat(agent): implement package broker#1847Vladyslav Nikonov (vnikonov-devolutions) wants to merge 3 commits into
Vladyslav Nikonov (vnikonov-devolutions) wants to merge 3 commits into
Conversation
Let maintainers know that an action is required on their side
|
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Vladyslav Nikonov (vnikonov-devolutions)
force-pushed
the
feat/unigetui-package-broker-integration
branch
from
2158cf9 to
83fa0b1
Compare
Vladyslav Nikonov (vnikonov-devolutions)
changed the title
Vladyslav Nikonov (vnikonov-devolutions)
marked this pull request as ready for review
Copilot started reviewing on behalf of
Vladyslav Nikonov (vnikonov-devolutions)
July 14, 2026 14:45
View session
Contributor
There was a problem hiding this comment.
Pull request overview
Implements an early Windows package broker for Devolutions Agent.
Changes:
- Adds policy loading, evaluation, live reload, and sample scenarios.
- Adds authenticated named-pipe APIs, operation tracking, and status polling.
- Adds WinGet/PowerShell command builders and elevated execution.
Reviewed changes
Copilot reviewed 47 out of 48 changed files in this pull request and generated 24 comments.
Show a summary per file
| File | Description |
|---|---|
.gitattributes |
Adds asset and YAML attributes. |
Cargo.lock |
Locks new broker dependencies. |
devolutions-agent/Cargo.toml |
Adds broker dependencies and Windows features. |
devolutions-agent/src/lib.rs |
Exposes Windows broker modules. |
devolutions-agent/src/service.rs |
Starts the configured broker task. |
devolutions-agent/src/config.rs |
Adds broker and debug configuration. |
devolutions-agent/src/code_signing.rs |
Centralizes signature validation. |
devolutions-agent/src/updater/package.rs |
Reuses signature helpers. |
devolutions-agent/src/broker/mod.rs |
Defines broker modules. |
devolutions-agent/src/broker/auth.rs |
Authenticates pipe clients. |
devolutions-agent/src/broker/task.rs |
Coordinates broker subsystems. |
devolutions-agent/src/broker/pipe.rs |
Implements named-pipe transport. |
devolutions-agent/src/broker/policy_loader.rs |
Loads JSON/YAML policies. |
devolutions-agent/src/broker/policy_watcher.rs |
Implements policy hot reload. |
devolutions-agent/src/broker/operation_tracker.rs |
Tracks asynchronous operations. |
devolutions-agent/src/broker/server/mod.rs |
Implements broker API behavior. |
devolutions-agent/src/broker/server/connection.rs |
Serves HTTP pipe connections. |
devolutions-agent/src/broker/server/execution.rs |
Runs background operations. |
devolutions-agent/src/broker/server/responses.rs |
Builds API responses. |
devolutions-agent/src/broker/executor/mod.rs |
Defines execution abstractions. |
devolutions-agent/src/broker/executor/output.rs |
Handles output and exit codes. |
devolutions-agent/src/broker/executor/windows/mod.rs |
Implements Windows execution plans. |
devolutions-agent/src/broker/executor/windows/process.rs |
Creates user-token processes. |
devolutions-agent/src/broker/executor/windows/token.rs |
Resolves sessions and tokens. |
devolutions-agent/src/broker/command_builder/mod.rs |
Dispatches command construction. |
devolutions-agent/src/broker/command_builder/winget.rs |
Builds WinGet commands. |
devolutions-agent/src/broker/command_builder/powershell.rs |
Builds PowerShell commands. |
devolutions-agent/src/broker/evaluator/mod.rs |
Implements policy precedence. |
devolutions-agent/src/broker/evaluator/matching.rs |
Matches request attributes. |
devolutions-agent/src/broker/evaluator/constraints.rs |
Enforces rule constraints. |
devolutions-agent/src/broker/evaluator/version.rs |
Matches version ranges. |
devolutions-agent/src/broker/evaluator/wildcard.rs |
Implements wildcard matching. |
devolutions-agent/src/broker/evaluator/tests.rs |
Tests policy evaluation. |
devolutions-agent/src/broker/scenario_tests.rs |
Runs sample scenarios. |
devolutions-agent/src/broker/assets/samples/corporate-allowlist.policy.json |
Adds allowlist policy sample. |
devolutions-agent/src/broker/assets/samples/deny-risky-options.policy.json |
Adds deny-list policy sample. |
devolutions-agent/src/broker/assets/samples/scenarios/baseline.scenarios.json |
Defines baseline scenarios. |
devolutions-agent/src/broker/assets/samples/requests/winget-vscode-install.request.json |
Adds allowed request sample. |
devolutions-agent/src/broker/assets/samples/requests/winget-vscode-skiphash.request.json |
Adds risky request sample. |
devolutions-agent/src/broker/assets/samples/requests/winget-unknown-install.request.json |
Adds denied request sample. |
crates/devolutions-agent-shared/Cargo.toml |
Adds temporary-file dependencies. |
crates/devolutions-agent-shared/src/lib.rs |
Exposes temporary-file utilities. |
crates/devolutions-agent-shared/src/temp_file.rs |
Adds shared temporary-script handling. |
devolutions-session/Cargo.toml |
Removes direct tempfile dependency. |
devolutions-session/src/main.rs |
Removes obsolete dependency import. |
devolutions-session/src/dvc/fs.rs |
Re-exports the shared guard. |
devolutions-session/src/dvc/task.rs |
Uses shared script utilities. |
devolutions-session/src/dvc/process.rs |
Converts I/O execution errors. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+58
to
+60
| let policy_path = match &self.config.policy_path { | ||
| Some(path) => std::path::PathBuf::from(path), | ||
| None => policy_loader::find_default_policy().context("failed to find default broker policy")?, |
| }); | ||
|
|
||
| // Bridge the agent's ShutdownSignal to the Notify used by subsystems. | ||
| let shutdown_notify = Arc::new(Notify::new()); |
Comment on lines
+96
to
+98
| async fn status(&self, request: StatusRequest) -> Result<StatusResponse, ErrorResponse> { | ||
| self.state.status(request).await | ||
| } |
| capture_output: request.capture_output, | ||
| }; | ||
|
|
||
| let (operation_id, is_new_operation) = self.tracker.register(&request.request_id, generated_operation_id); |
Comment on lines
+170
to
+172
| if is_new_operation { | ||
| self.tracker.mark_running(&operation_id); | ||
| execution::spawn_execution( |
Comment on lines
+85
to
+88
| Err(error) => { | ||
| error!(%error, "Failed to create policy file watcher"); | ||
| return; | ||
| } |
Comment on lines
+91
to
+93
| if let Err(error) = watcher.watch(&watch_path, RecursiveMode::NonRecursive) { | ||
| error!(%error, path = %watch_path.display(), "Failed to watch policy directory"); | ||
| return; |
Comment on lines
+51
to
+53
| if let Some(version) = request.package.version.as_deref() { | ||
| append_flag_value(&mut script, "-RequiredVersion", version); | ||
| } |
Comment on lines
+149
to
+152
| // Wait for agent shutdown signal. | ||
| shutdown_signal.wait().await; | ||
| info!("package broker received shutdown signal"); | ||
| shutdown_notify.notify_waiters(); |
Comment on lines
+84
to
+93
| match request.operation { | ||
| Operation::Install => { | ||
| if let Some(version) = request.package.version.as_deref() { | ||
| append_flag_value(&mut script, "-Version", version); | ||
| } | ||
| } | ||
| Operation::Update => append_raw(&mut script, "-Force"), | ||
| // Uninstall removes the installed resource without pinning a version. | ||
| Operation::Uninstall => {} | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements now package broker (Also see UniGetUI WIP branch Devolutions/UniGetUI#4826)
This is still in early DRAFT, but can be compiled/tested for further development.
Implemented
Not implemented yet
Steps to run this branch:
"PackageBroker":{"Enabled":true, "PolicyPath": "C:/path/to/policy.json"}"__debug__": { "skip_broker_signature_validation": true }UseAgentBrokerfile at%LOCALAPPDATA%/UniGetUI/Configuration(UniGetUI uses file-based config)