feat(agent,agent-installer): add policy consent helper

[Benoît Cortier (CBenoit)]

Adds an Agent-installed consent helper that lets supported UniGetUI installations request protected policy updates with explicit elevation consent.

The helper authenticates the running UniGetUI and Agent images, preserves policy validation and conflict semantics, and is installed and discovered through the Agent MSI for both default per-user and all-users UniGetUI deployments.

Issue: #1963

[Benoît Cortier (CBenoit)]

Implementation notes:

• Keeps the private UniGetUI elevation protocol at version 2.0 and forwards only the official policy replacement fields.
• Authenticates retained UniGetUI and Agent process/image identities, current or transition signer pins, fresh whole-chain revocation status, product/version identity, LocalSystem broker identity, and protected trusted-writer installation paths.
• Pins the connected Agent mapped image and every custom installation-directory ancestor against reparse or untrusted-writer replacement before policy data is sent.
• Installs and signs one x64/ARM64 NativeAOT helper through the Agent MSI and publishes transactional machine discovery values.
• Verified with 53 helper tests, 76 installer tests, full locked Rust workspace tests and Clippy, i686 broker compilation, ARM64 managed compilation, and an x64 NativeAOT PE/no-CLR/manifest/size check.
• Local ARM64 NativeAOT linking remains unavailable because this workstation lacks the MSVC ARM64 C++ tools; CI retains the ARM64 NativeAOT build.
• Signer provenance was verified from signed UniGetUI 2026.2.7 and 3.3.7 release artifacts and recorded beside both SPKI pins.

Note

Human-tuned, LLM-assisted content.

[Copilot]

🟡 Changes recommended

Version parsing and cancellation handling can reject valid callers or return incorrect protocol outcomes.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds an elevated Agent policy-consent helper that authenticates UniGetUI and the Agent broker before forwarding policy updates.

Changes:

• Adds the NativeAOT consent helper, protocol, authentication, and tests.
• Restricts broker policy writes to the installed helper.
• Packages, signs, registers, and tests the helper in CI.

File summaries

File	Description
package/AgentWindowsManaged/Resources/Includes.cs	Shares helper discovery constants.
package/AgentWindowsManaged/Program.cs	Installs and registers the helper.
package/AgentWindowsManaged/DevolutionsAgent.csproj	Links the shared contract.
package/AgentWindowsManaged.Tests/PackageBrokerInstallerTests.cs	Tests registry discovery.
package/AgentPolicyConsent/Protocol.cs	Defines helper framing and validation.
package/AgentPolicyConsent/Program.cs	Implements the helper workflow.
package/AgentPolicyConsent/PolicyConsentContract.cs	Defines identity and signer constants.
package/AgentPolicyConsent/PeerTrust.cs	Authenticates UI and broker processes.
package/AgentPolicyConsent/DevolutionsAgentPolicyConsent.csproj	Configures the NativeAOT executable.
package/AgentPolicyConsent/BrokerClient.cs	Forwards policy updates to the broker.
package/AgentPolicyConsent/app.manifest	Requires administrator elevation.
package/AgentPolicyConsent.Tests/ProtocolTests.cs	Tests protocol and trust behavior.
package/AgentPolicyConsent.Tests/DevolutionsAgentPolicyConsent.Tests.csproj	Configures helper tests.
crates/now-package-broker/src/server/mod.rs	Applies helper-specific write authentication.
crates/now-package-broker/src/auth.rs	Validates the installed helper identity.
ci/package-agent-windows.ps1	Adds the helper to MSI packaging.
.github/workflows/package.yml	Signs and repackages the helper.
.github/workflows/ci.yml	Builds and tests the helper.

Review details

• Files reviewed: 18/18 changed files
• Comments generated: 3
• Review effort level: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

Helper credential validation does not conform to the canonical policy API character restrictions.

Review details

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

package/AgentPolicyConsent/Protocol.cs:71

• These fields are policy-store credentials, but IsCredential accepts every printable ASCII character after the first one. The canonical policy API restricts store tokens and validation receipts to [A-Za-z0-9._~:-] (now-libraries management.rs, PolicyStoreToken/PolicyValidationReceipt), so values containing spaces, quotes, slashes, etc. pass this protocol boundary and are only rejected later by the broker. Apply the canonical character rule here (and to returned store tokens) so malformed helper requests fail as protocol errors rather than entering the privileged write path.

• Files reviewed: 18/18 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

🔵 Needs a closer look

Security-critical native authentication, elevation, protocol, and multi-architecture packaging changes warrant final human review.

Review details

• Files reviewed: 18/18 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

🟡 Changes recommended

The critical SourceName matching issue remains unresolved for non-PowerShell package managers.

Get a fresh assessment by requesting another Copilot review.

Review details

• Files reviewed: 28/29 changed files
• Comments generated: 1
• Review effort level: Lite (auto)

Note

Copilot is running an experiment and ran this review at Lite.

[Copilot]

🔵 Needs a closer look

A critical policy-validation mismatch remains, and the security-sensitive changes require human review.

Review details

• Files reviewed: 28/29 changed files
• Comments generated: 1
• Review effort level: Lite (auto)

Note

Copilot is running an experiment and ran this review at Lite.

[Copilot]

🔵 Needs a closer look

A moderate 32-bit registry-view discovery gap remains unresolved, and the security-sensitive changes require human review.

Review details

Suppressed comments (1)

package/AgentWindowsManaged/Program.cs:495

• On a 64-bit Agent MSI this selects only the 64-bit HKLM view, but UniGetUI also publishes a win-x86 build and a 32-bit process reads HKLM\Software through the WOW6432Node view by default. Those supported UniGetUI installations therefore cannot discover the helper even though the comment says discovery follows the consumer's native view. Publish the discovery contract to both registry views on 64-bit systems (or explicitly constrain supported host architectures).

    internal static bool Use64BitRegistryView(Platform? platform) =>
        platform is Platform.x64 or Platform.arm64;

• Files reviewed: 29/30 changed files
• Comments generated: 0 new
• Review effort level: Lite (auto)

Note

Copilot is running an experiment and ran this review at Lite.

[Copilot]

🔵 Needs a closer look

Update the validator version and receipt fixtures; the registry-view duplication remains a minor maintainability concern.

Review details

Suppressed comments (2)

crates/now-package-broker/src/policy_store/validation.rs:428

• This adds a new authoritative validation rejection while VALIDATOR_VERSION remains now-package-broker-policy-validator/10. That value is returned to clients and is part of the validation-receipt MAC, so consumers cannot distinguish this changed validation contract from version 10; increment the validator version and update the receipt/version fixtures together.

    for (source_index, source_name) in rule.match_criteria.source_names.iter().enumerate() {
        if !evaluator::source_name_is_unambiguous(source_name.as_ref()) {
            findings.push(rule_finding(
                rule,
                PolicyFindingSeverity::Error,

package/AgentWindowsManaged/Program.cs:505

• The WOW6432Node values duplicate the seven native-view definitions above. Because both views implement the same discovery contract, a future field added to one block can silently make 32-bit UniGetUI installations undiscoverable; define the field list once and project it to the requested registry view, with a parity assertion.

    internal static IEnumerable<RegValue> CreatePolicyConsentRegistryValuesFor32BitConsumers(
        Platform? platform,
        Version productVersion)
    {
        if (!Use64BitRegistryView(platform))

• Files reviewed: 29/30 changed files
• Comments generated: 0 new
• Review effort level: Lite (auto)

Note

Copilot is running an experiment and ran this review at Lite.