feat(agent,agent-installer): add policy consent helper

[Benoît Cortier (CBenoit)]

Adds an Agent-installed consent helper that lets supported UniGetUI installations request protected policy updates with explicit elevation consent.

The helper authenticates the running UniGetUI and Agent images, preserves policy validation and conflict semantics, and is installed and discovered through the Agent MSI for both default per-user and all-users UniGetUI deployments.

Issue: #1963

[Benoît Cortier (CBenoit)]

Implementation notes:

• Keeps the private UniGetUI elevation protocol at version 2.0 and forwards only the official policy replacement fields.
• Authenticates retained UniGetUI and Agent process/image identities, current or transition signer pins, fresh whole-chain revocation status, product/version identity, LocalSystem broker identity, and protected trusted-writer installation paths.
• Pins the connected Agent mapped image and every custom installation-directory ancestor against reparse or untrusted-writer replacement before policy data is sent.
• Installs and signs one x64/ARM64 NativeAOT helper through the Agent MSI and publishes transactional machine discovery values.
• Verified with 53 helper tests, 76 installer tests, full locked Rust workspace tests and Clippy, i686 broker compilation, ARM64 managed compilation, and an x64 NativeAOT PE/no-CLR/manifest/size check.
• Local ARM64 NativeAOT linking remains unavailable because this workstation lacks the MSVC ARM64 C++ tools; CI retains the ARM64 NativeAOT build.
• Signer provenance was verified from signed UniGetUI 2026.2.7 and 3.3.7 release artifacts and recorded beside both SPKI pins.

Note

Human-tuned, LLM-assisted content.

[Copilot]

🟡 Changes recommended

Version parsing and cancellation handling can reject valid callers or return incorrect protocol outcomes.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds an elevated Agent policy-consent helper that authenticates UniGetUI and the Agent broker before forwarding policy updates.

Changes:

• Adds the NativeAOT consent helper, protocol, authentication, and tests.
• Restricts broker policy writes to the installed helper.
• Packages, signs, registers, and tests the helper in CI.

File summaries

File	Description
package/AgentWindowsManaged/Resources/Includes.cs	Shares helper discovery constants.
package/AgentWindowsManaged/Program.cs	Installs and registers the helper.
package/AgentWindowsManaged/DevolutionsAgent.csproj	Links the shared contract.
package/AgentWindowsManaged.Tests/PackageBrokerInstallerTests.cs	Tests registry discovery.
package/AgentPolicyConsent/Protocol.cs	Defines helper framing and validation.
package/AgentPolicyConsent/Program.cs	Implements the helper workflow.
package/AgentPolicyConsent/PolicyConsentContract.cs	Defines identity and signer constants.
package/AgentPolicyConsent/PeerTrust.cs	Authenticates UI and broker processes.
package/AgentPolicyConsent/DevolutionsAgentPolicyConsent.csproj	Configures the NativeAOT executable.
package/AgentPolicyConsent/BrokerClient.cs	Forwards policy updates to the broker.
package/AgentPolicyConsent/app.manifest	Requires administrator elevation.
package/AgentPolicyConsent.Tests/ProtocolTests.cs	Tests protocol and trust behavior.
package/AgentPolicyConsent.Tests/DevolutionsAgentPolicyConsent.Tests.csproj	Configures helper tests.
crates/now-package-broker/src/server/mod.rs	Applies helper-specific write authentication.
crates/now-package-broker/src/auth.rs	Validates the installed helper identity.
ci/package-agent-windows.ps1	Adds the helper to MSI packaging.
.github/workflows/package.yml	Signs and repackages the helper.
.github/workflows/ci.yml	Builds and tests the helper.

Review details

• Files reviewed: 18/18 changed files
• Comments generated: 3
• Review effort level: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

Helper credential validation does not conform to the canonical policy API character restrictions.

Review details

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

package/AgentPolicyConsent/Protocol.cs:71

• These fields are policy-store credentials, but IsCredential accepts every printable ASCII character after the first one. The canonical policy API restricts store tokens and validation receipts to [A-Za-z0-9._~:-] (now-libraries management.rs, PolicyStoreToken/PolicyValidationReceipt), so values containing spaces, quotes, slashes, etc. pass this protocol boundary and are only rejected later by the broker. Apply the canonical character rule here (and to returned store tokens) so malformed helper requests fail as protocol errors rather than entering the privileged write path.

• Files reviewed: 18/18 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

🔵 Needs a closer look

Security-critical native authentication, elevation, protocol, and multi-architecture packaging changes warrant final human review.

Review details

• Files reviewed: 18/18 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.