feat(agent): expose active package policy

.github/workflows/ci.yml

@@ -1270,6 +1270,65 @@ jobs:
           psexec -accepteula -s pwsh.exe $scriptPath
           Get-Content -Path ./crates/pedm-simulator/pedm-simulator_run-expect-elevation.out
 
+  agent-policy-e2e:
+    name: Agent policy end-to-end test
+    runs-on: windows-2022
+    needs: [preflight]
+
+    steps:
+      - name: Checkout ${{ github.repository }}
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.preflight.outputs.ref }}
+
+      - name: Setup Rust cache
+        uses: ./.github/actions/setup-rust-cache
+        with:
+          sccache-enabled: ${{ needs.preflight.outputs.sccache }}
+
+      # Keep this installation aligned with the PEDM simulator job.
+      - name: Install PsExec
+        shell: pwsh
+        run: |
+          $expectedHash = '4F49964CC9CBAC2B5D87BDC8F9526012E9C4B243D8B7D0C0BB51F254A721CA2E'
+          $zipPath = Join-Path $env:RUNNER_TEMP 'PSTools.zip'
+          $toolsDir = Join-Path $env:RUNNER_TEMP 'PSTools'
+          Invoke-WebRequest -Uri 'https://download.sysinternals.com/files/PSTools.zip' -OutFile $zipPath
+          $actualHash = (Get-FileHash -Path $zipPath -Algorithm SHA256).Hash
+          if ($actualHash -ne $expectedHash) {
+            throw "PSTools.zip checksum mismatch: expected $expectedHash, got $actualHash"
+          }
+          Expand-Archive -Path $zipPath -DestinationPath $toolsDir
+          Add-Content -Path $env:GITHUB_PATH -Value $toolsDir
+
+      - name: Build Agent policy test executables
+        shell: pwsh
+        run: |
+          cargo build --locked -p devolutions-agent --features dev-skip-broker-signature
+          if ($LASTEXITCODE -ne 0) {
+            exit $LASTEXITCODE
+          }
+          cargo build --locked -p agent-policy-tester
+          if ($LASTEXITCODE -ne 0) {
+            exit $LASTEXITCODE
+          }
+
+      - name: Run Agent policy tester as LocalSystem
+        shell: pwsh
+        run: |
+          $scriptPath = Resolve-Path -Path "./crates/agent-policy-tester/run-as-system.ps1"
+          psexec -accepteula -s pwsh.exe -NoProfile -File $scriptPath
+          $exitCode = $LASTEXITCODE
+          Get-Content -Path ./crates/agent-policy-tester/agent-policy-tester.out
+          if ($exitCode -ne 0) {
+            exit $exitCode
+          }
+
+      - name: Show sccache stats
+        if: ${{ needs.preflight.outputs.sccache == 'true' && !cancelled() }}
+        shell: pwsh
+        run: sccache --show-stats
+
   secure-memory-verifier:
     name: secure-memory-verifier
     runs-on: windows-2022
@@ -1298,7 +1357,7 @@ jobs:
   success:
     name: Success
     if: ${{ always() }}
-    needs: [tests, agent-tunnel-e2e, lints, check-dependencies, jetsocat-lipo, devolutions-gateway-powershell, devolutions-gateway, devolutions-gateway-merge, devolutions-pedm-desktop, devolutions-agent, devolutions-agent-merge, devolutions-pedm-client, dotnet-utils-tests, winapi-sanitizer-tests, winapi-miri, pedm-simulator, secure-memory-verifier]
+    needs: [tests, agent-tunnel-e2e, agent-policy-e2e, lints, check-dependencies, jetsocat-lipo, devolutions-gateway-powershell, devolutions-gateway, devolutions-gateway-merge, devolutions-pedm-desktop, devolutions-agent, devolutions-agent-merge, devolutions-pedm-client, dotnet-utils-tests, winapi-sanitizer-tests, winapi-miri, pedm-simulator, secure-memory-verifier]
     runs-on: ubuntu-latest
 
     steps:

crates/agent-policy-tester/.gitignore

@@ -0,0 +1 @@
+/agent-policy-tester.out

crates/agent-policy-tester/Cargo.toml

@@ -0,0 +1,17 @@
+[package]
+name = "agent-policy-tester"
+version = "0.0.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+anyhow = "1"
+
+[target.'cfg(windows)'.dependencies]
+fastrand = "2"
+serde_json = "1"
+tempfile = "3"
+tokio = { version = "1", features = ["io-util", "macros", "net", "process", "rt-multi-thread", "time"] }
+
+[lints]
+workspace = true

crates/agent-policy-tester/run-as-system.ps1

@@ -0,0 +1,16 @@
+$ErrorActionPreference = "Stop"
+
+$workspacePath = (Resolve-Path (Join-Path $PSScriptRoot "../..")).Path
+$testerPath = Join-Path $workspacePath "target/debug/agent-policy-tester.exe"
+$agentPath = Join-Path $workspacePath "target/debug/devolutions-agent.exe"
+$outputPath = Join-Path $PSScriptRoot "agent-policy-tester.out"
+
+try {
+    & $testerPath $agentPath 2>&1 | Out-File $outputPath
+    $exitCode = $LASTEXITCODE
+} catch {
+    $_ | Out-File $outputPath -Append
+    exit 1
+}
+
+exit $exitCode

crates/agent-policy-tester/src/main.rs

@@ -0,0 +1,13 @@
+#[cfg(windows)]
+mod windows;
+
+#[cfg(windows)]
+#[tokio::main]
+async fn main() -> anyhow::Result<()> {
+    windows::run().await
+}
+
+#[cfg(not(windows))]
+fn main() -> anyhow::Result<()> {
+    anyhow::bail!("agent policy tester only supports Windows")
+}