feat(agent)!: expose active package policy by CBenoit · Pull Request #1937 · Devolutions/devolutions-gateway

Benoît Cortier (CBenoit) · 2026-08-17T18:30:06Z

Exposes the validated active package-broker policy through the authenticated GET /v1/policy route. Clients receive a stable snapshot, while an unavailable policy returns the shared structured 404 response without exposing policy source or file-security details.

Uses the official now-policy 0.3.0, now-policy-api 0.4.0, and now-policy-server-template 0.4.0 releases. Phase 1 remains read-only: policy management, validation, and replacement routes are not exposed.

Package policy files are now JSON-only. Deployments using .yaml or .yml policy files must convert them to .json; unsupported extensions and YAML content are rejected rather than silently parsed.

Coordinated stack: Devolutions/now-libraries#93 defines the shared contract, this PR implements the Agent endpoint, and Devolutions/UniGetUI#5292 consumes it. Keep this PR open while Phase 2 #1963 is restacked and the full stack is finalized.

BREAKING CHANGE: Package broker policy files must use JSON; YAML and YML are no longer discovered or parsed.

Issue: Devolutions/now-libraries#93

Co-authored-by: Copilot App 223556219+Copilot@users.noreply.github.com

Expose the validated active package-broker policy through the shared authenticated GET /v1/policy route. Return a structured unavailable error without leaking policy source or file-security details. This requires now-policy-api and now-policy-server-template 0.4.0 from Devolutions/now-libraries#93 before the change can ship. Issue: Devolutions/now-libraries#93 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Benoît Cortier (CBenoit) · 2026-08-17T18:31:14Z

Implementation notes:

Uses official crates.io releases now-policy 0.3.0, now-policy-api 0.4.0, and now-policy-server-template 0.4.0 with no path or git patches.
Serves a stable clone of the validated in-memory Arc<PolicyDocument> through authenticated GET /v1/policy; the policy lock is released before response serialization.
Preserves existing named-pipe executable signature authorization, policy owner/DACL validation, and YAML policy-file compatibility.
Returns structured NotFound/404 when policy inspection has no active policy, while package evaluation continues to return BrokerPaused/503.
Does not expose policy source, path, reason, security metadata, or policy-body logs.
Keeps Phase 1 read-only by hiding the shared management and validation routes and rejecting mutation methods with 405 plus Allow: GET, HEAD.

Validation on exact head 8e9cc98e4103b40ddc3511aef39462d9f7610a7a:

cargo +nightly fmt --all -- --check
cargo build --workspace --locked
cargo clippy --workspace --tests --locked -- -D warnings
cargo test --workspace --locked -- --skip winget_app_exec_alias_passes_elevated_verification
cargo test -p now-package-broker --locked policy_response_returns_not_found_when_unavailable
cargo test -p now-package-broker --locked package_evaluation_without_policy_remains_paused
cargo test -p now-package-broker --locked concurrent_policy_replacement_returns_only_complete_snapshots

All commands passed. The skipped test is an existing host-specific check whose local WindowsApps winget.exe grants the current user write access; an unfiltered broker run passed 253 tests with 1 ignored before that expected local DACL failure.

CI run https://github.com/Devolutions/devolutions-gateway/actions/runs/33828611066 passed all 42 checks, including locked Linux/Windows tests and Clippy, Windows Agent builds, and the Agent policy end-to-end test under LocalSystem.

Copilot's exact-head review generated zero findings and left zero unresolved threads. Its Needs a closer look disposition is solely for human scrutiny of the intentionally draft, security-sensitive cross-repository stack.

Note

LLM-assisted content (no human feedback).

Copilot

Pull request overview

Adds authenticated active-policy inspection to the Agent’s package broker.

Changes:

Implements GET /v1/policy with structured responses.
Reuses connection authentication and adds snapshot/concurrency tests.
Remains blocked on publishing and committing the 0.4.0 dependencies.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
`crates/now-package-broker/src/server/mod.rs`	Implements and tests policy retrieval.
`crates/now-package-broker/src/auth.rs`	Exposes connection-level authentication for the endpoint.

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Return a generic policy-unavailable message so clients cannot infer whether the active policy is file-backed, missing, or corrupt. Issue: Devolutions/now-libraries#93 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Adopt the final shared server trait and keep policy-domain conversions owned by the broker after the compatibility feature removal. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Record the registry graph after removing the obsolete policy compatibility features so locked CI can resolve the manifest consistently. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Exercise the policy HTTP contract from the repository integration tests while keeping authentication and snapshot-locking invariants beside the broker implementation. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Launch the Agent through its CLI and issue HTTP requests over a real Tokio named-pipe client. Build the test Agent with the development signature bypass while requiring the matching debug configuration opt-in. Remove the in-process broker test harness and its testsuite dependencies; retain authentication and snapshot-locking invariants as broker unit tests. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Move privileged policy endpoint coverage into a dedicated tester so the active-policy path cannot silently skip in normal test runs. Run it as LocalSystem in CI with a development-only signature bypass. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 11 out of 12 changed files in this pull request and generated 2 comments.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Use the official policy contract releases while preserving the Phase 1 read-only endpoint and existing YAML policy loading. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

🟡 Changes recommended

The custom 405 response violates HTTP requirements by omitting the Allow header.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Files reviewed: 12/13 changed files
Comments generated: 1
Review effort level: Balanced

Include the mandatory Allow header when Phase 1 rejects mutation methods on the policy endpoint. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

🔵 Needs a closer look

The coordinated stack remains intentionally draft, and the latest Windows validation was still running during review.

Review details

Files reviewed: 12/13 changed files
Comments generated: 0 new
Review effort level: Balanced

Copilot

🟡 Changes recommended

The unavailable-policy response returns 503 although the linked shared contract specifies structured 404 behavior.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Files reviewed: 12/13 changed files
Comments generated: 1
Review effort level: Balanced

Keep active-policy inspection aligned with the shared 404 contract while package operations continue to report BrokerPaused when no policy can be evaluated. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

🔵 Needs a closer look

The implementation is clean and CI passes, but the coordinated stack is intentionally still in draft pending finalization.

Review details

Files reviewed: 12/13 changed files
Comments generated: 0 new
Review effort level: Balanced

Copilot

🔵 Needs a closer look

The security-sensitive cross-repository contract remains explicitly draft pending final stack coordination.

Review details

Files reviewed: 12/13 changed files
Comments generated: 0 new
Review effort level: Balanced

Add authenticated policy management and validation for the package broker. Persist JSON policies atomically with secure path, ACL, concurrency, receipt, watcher, and audit checks while preserving stable runtime snapshots. Stacked on #1937. Uses the contract from Devolutions/now-libraries#99. UniGetUI policy management depends on this API. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Remove package-policy YAML discovery and parsing so unsupported files fail instead of being silently accepted. Issue: #1847 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

🟡 Changes recommended

It silently removes released YAML policy compatibility and rewrites the corresponding historical changelog entry.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

CHANGELOG.md:48

This edits the already-published 2026.2.4 release entry to claim that release supported JSON only, although the implementation shipped there accepted JSON, YAML, and YML. Keep the historical entry accurate; if YAML support is intentionally removed now, record that in the new release's notes instead.

Files reviewed: 16/17 changed files
Comments generated: 1
Review effort level: Balanced

Keep the 2026.2.4 changelog accurate while the current PR documents the intentional JSON-only migration. Issue: #1847 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Benoît Cortier (CBenoit) mentioned this pull request Aug 17, 2026

feat: add active package policy inspection contract Devolutions/now-libraries#93

Merged

Benoît Cortier (CBenoit) requested a balanced review from Copilot August 18, 2026 03:58

Copilot started reviewing on behalf of Benoît Cortier (CBenoit) August 18, 2026 03:58 View session

Copilot AI reviewed Aug 18, 2026

View reviewed changes

Comment thread crates/now-package-broker/src/server/mod.rs Outdated

fix(agent): hide policy source details

4c6dc53

Return a generic policy-unavailable message so clients cannot infer whether the active policy is file-backed, missing, or corrupt. Issue: Devolutions/now-libraries#93 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Benoît Cortier (CBenoit) mentioned this pull request Aug 18, 2026

Add read-only package broker policy inspector Devolutions/UniGetUI#5292

Open

Benoît Cortier (CBenoit) and others added 8 commits August 26, 2026 21:19

fix(agent): align policy contract integration

03b3710

Adopt the final shared server trait and keep policy-domain conversions owned by the broker after the compatibility feature removal. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

build(agent): refresh policy dependency lock

ab7591b

Record the registry graph after removing the obsolete policy compatibility features so locked CI can resolve the manifest consistently. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

refactor(agent): localize policy API alias

2a3f0b6

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

refactor(agent): simplify policy match expression

d67d895

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

test(agent): move policy routes to testsuite

04f7486

Exercise the policy HTTP contract from the repository integration tests while keeping authentication and snapshot-locking invariants beside the broker implementation. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

chore: merge origin/master

1ee9a37

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Benoît Cortier (CBenoit) requested a balanced review from Copilot August 28, 2026 16:54

Copilot started reviewing on behalf of Benoît Cortier (CBenoit) August 28, 2026 16:55 View session

Copilot AI reviewed Aug 28, 2026

View reviewed changes

Comment thread .github/workflows/ci.yml

Comment thread crates/now-package-broker/Cargo.toml Outdated

ci: preserve Agent policy build failures

c760e37

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Benoît Cortier (CBenoit) mentioned this pull request Aug 29, 2026

feat(agent,agent-installer): add transactional policy store #1963

Draft

build(agent): adopt published policy crates

1abdba0

Use the official policy contract releases while preserving the Phase 1 read-only endpoint and existing YAML policy loading. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Benoît Cortier (CBenoit) requested a balanced review from Copilot September 4, 2026 01:35

Copilot started reviewing on behalf of Benoît Cortier (CBenoit) September 4, 2026 01:35 View session

Copilot AI reviewed Sep 4, 2026

View reviewed changes

Comment thread crates/now-package-broker/src/server/mod.rs

fix(agent): advertise allowed policy methods

8fe3eea

Include the mandatory Allow header when Phase 1 rejects mutation methods on the policy endpoint. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Benoît Cortier (CBenoit) requested a balanced review from Copilot September 4, 2026 01:40

Copilot started reviewing on behalf of Benoît Cortier (CBenoit) September 4, 2026 01:41 View session

Copilot AI reviewed Sep 4, 2026

View reviewed changes

Benoît Cortier (CBenoit) requested a balanced review from Copilot September 4, 2026 02:02

Copilot started reviewing on behalf of Benoît Cortier (CBenoit) September 4, 2026 02:03 View session

Copilot AI reviewed Sep 4, 2026

View reviewed changes

Comment thread crates/now-package-broker/src/server/mod.rs Outdated

Benoît Cortier (CBenoit) requested a balanced review from Copilot September 4, 2026 02:08

Copilot started reviewing on behalf of Benoît Cortier (CBenoit) September 4, 2026 02:08 View session

fix(agent): report missing policy as not found

8e9cc98

Keep active-policy inspection aligned with the shared 404 contract while package operations continue to report BrokerPaused when no policy can be evaluated. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot AI reviewed Sep 4, 2026

View reviewed changes

Benoît Cortier (CBenoit) requested a balanced review from Copilot September 4, 2026 03:10

Copilot started reviewing on behalf of Benoît Cortier (CBenoit) September 4, 2026 03:11 View session

Copilot AI reviewed Sep 4, 2026

View reviewed changes

Benoît Cortier (CBenoit) marked this pull request as ready for review September 4, 2026 13:43

Benoît Cortier (CBenoit) requested review from a team as code owners September 4, 2026 13:43

Benoît Cortier (CBenoit) commented Sep 4, 2026

View reviewed changes

Comment thread crates/agent-policy-tester/Cargo.toml

Benoît Cortier (CBenoit) commented Sep 4, 2026

View reviewed changes

Comment thread crates/now-package-broker/src/policy_loader.rs Outdated

fix(agent): require JSON package policies

402a391

Remove package-policy YAML discovery and parsing so unsupported files fail instead of being silently accepted. Issue: #1847 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Benoît Cortier (CBenoit) requested a balanced review from Copilot September 4, 2026 18:26

Copilot started reviewing on behalf of Benoît Cortier (CBenoit) September 4, 2026 18:26 View session

Copilot AI reviewed Sep 4, 2026

View reviewed changes

Comment thread crates/now-package-broker/src/policy_loader.rs

docs(agent): preserve policy release history

7e2ab37

Keep the 2026.2.4 changelog accurate while the current PR documents the intentional JSON-only migration. Issue: #1847 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Benoît Cortier (CBenoit) changed the title ~~feat(agent): expose active package policy~~ feat(agent)!: expose active package policy Sep 4, 2026

Marc-André Moreau (mamoreau-devolutions) approved these changes Sep 5, 2026

View reviewed changes

Navigation Menu

Uh oh!

feat(agent)!: expose active package policy - #1937

feat(agent)!: expose active package policy#1937
Benoît Cortier (CBenoit) wants to merge 16 commits into
masterfrom
cbenoit-plan-agent-policy-endpoint

Benoît Cortier (CBenoit) commented Aug 17, 2026 •

edited

Loading

Uh oh!

Benoît Cortier (CBenoit) commented Aug 17, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Benoît Cortier (CBenoit) commented Aug 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Benoît Cortier (CBenoit) commented Aug 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Suppressed comments (1)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

Benoît Cortier (CBenoit) commented Aug 17, 2026 •

edited

Loading

Benoît Cortier (CBenoit) commented Aug 17, 2026 •

edited

Loading