From 80d02a71d64348fcd9553142b055a4262fc1cb4c Mon Sep 17 00:00:00 2001
From: Vladyslav Nikonov <mail@pacmancoder.xyz>
Date: Tue, 14 Jul 2026 17:37:59 +0300
Subject: [PATCH 1/4] refactor(agent-shared): share temporary script helpers

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 crates/devolutions-agent-shared/Cargo.toml    |  2 +
 crates/devolutions-agent-shared/src/lib.rs    |  1 +
 .../devolutions-agent-shared/src/temp_file.rs | 66 +++++++++++++++++++
 devolutions-session/Cargo.toml                |  2 -
 devolutions-session/src/dvc/fs.rs             | 66 +------------------
 devolutions-session/src/dvc/process.rs        |  6 ++
 devolutions-session/src/dvc/task.rs           | 18 ++---
 devolutions-session/src/main.rs               |  4 +-
 8 files changed, 84 insertions(+), 81 deletions(-)
 create mode 100644 crates/devolutions-agent-shared/src/temp_file.rs

diff --git a/crates/devolutions-agent-shared/Cargo.toml b/crates/devolutions-agent-shared/Cargo.toml
index f51135bf1..2b2714b81 100644
--- a/crates/devolutions-agent-shared/Cargo.toml
+++ b/crates/devolutions-agent-shared/Cargo.toml
@@ -14,7 +14,9 @@ camino = "1.1"
 cfg-if = "1"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
+tempfile = "3"
 thiserror = "2"
+tracing = "0.1"
 
 [target.'cfg(windows)'.dependencies]
 windows-registry = "0.5"
diff --git a/crates/devolutions-agent-shared/src/lib.rs b/crates/devolutions-agent-shared/src/lib.rs
index dabbc4619..85edfa6be 100644
--- a/crates/devolutions-agent-shared/src/lib.rs
+++ b/crates/devolutions-agent-shared/src/lib.rs
@@ -2,6 +2,7 @@
 pub mod windows;
 
 mod date_version;
+pub mod temp_file;
 mod update_manifest;
 mod update_status;
 
diff --git a/crates/devolutions-agent-shared/src/temp_file.rs b/crates/devolutions-agent-shared/src/temp_file.rs
new file mode 100644
index 000000000..5cbb0626d
--- /dev/null
+++ b/crates/devolutions-agent-shared/src/temp_file.rs
@@ -0,0 +1,66 @@
+use std::fs;
+use std::io::{self, Write as _};
+use std::path::{Path, PathBuf};
+
+use tracing::error;
+
+pub const BATCH_UTF8_PREAMBLE: &str = "@chcp 65001 > nul";
+pub const POWERSHELL_UTF8_ENCODING_PREAMBLE: &str =
+    "$OutputEncoding = [Console]::InputEncoding = [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new()";
+
+/// Guard for a temporary file that is removed on drop.
+pub struct TmpFileGuard {
+    path: PathBuf,
+}
+
+impl TmpFileGuard {
+    pub fn new(extension: &str) -> io::Result<Self> {
+        Self::with_prefix_in("devolutions-", extension, None)
+    }
+
+    pub fn with_prefix_in(prefix: &str, extension: &str, temp_dir: Option<&Path>) -> io::Result<Self> {
+        let suffix = format!(".{extension}");
+        let mut builder = tempfile::Builder::new();
+        builder.prefix(prefix).suffix(&suffix);
+
+        let tempfile = match temp_dir {
+            Some(temp_dir) => builder.tempfile_in(temp_dir),
+            None => builder.tempfile(),
+        }?;
+
+        let (_file, path) = tempfile.keep().map_err(|error| error.error)?;
+
+        Ok(Self { path })
+    }
+
+    pub fn write_content(&self, content: &str) -> io::Result<()> {
+        self.write_bytes(content.as_bytes())
+    }
+
+    pub fn write_bytes(&self, content: &[u8]) -> io::Result<()> {
+        fs::write(&self.path, content)
+    }
+
+    /// Write content as UTF-8 with a BOM prefix for Windows PowerShell 5.x script files.
+    pub fn write_content_utf8_bom(&self, content: &str) -> io::Result<()> {
+        let mut file = fs::File::create(&self.path)?;
+        file.write_all(b"\xEF\xBB\xBF")?;
+        file.write_all(content.as_bytes())
+    }
+
+    pub fn path(&self) -> &Path {
+        &self.path
+    }
+
+    pub fn path_string(&self) -> String {
+        self.path.display().to_string()
+    }
+}
+
+impl Drop for TmpFileGuard {
+    fn drop(&mut self) {
+        if let Err(error) = fs::remove_file(&self.path) {
+            error!(%error, path = %self.path.display(), "Failed to remove temporary file");
+        }
+    }
+}
diff --git a/devolutions-session/Cargo.toml b/devolutions-session/Cargo.toml
index 9699b6d8d..74207b053 100644
--- a/devolutions-session/Cargo.toml
+++ b/devolutions-session/Cargo.toml
@@ -17,7 +17,6 @@ dvc = [
     "dep:async-trait",
     "dep:windows",
     "dep:now-proto-pdu",
-    "dep:tempfile",
     "dep:thiserror",
     "dep:win-api-wrappers",
 ]
@@ -38,7 +37,6 @@ futures = "0.3"
 tokio = { version = "1", features = ["macros", "sync", "time"] }
 
 async-trait = { version = "0.1", optional = true }
-tempfile = { version = "3", optional = true }
 thiserror = { version = "2", optional = true }
 win-api-wrappers = { path = "../crates/win-api-wrappers", optional = true }
 
diff --git a/devolutions-session/src/dvc/fs.rs b/devolutions-session/src/dvc/fs.rs
index 2c609c6e3..df8c318a4 100644
--- a/devolutions-session/src/dvc/fs.rs
+++ b/devolutions-session/src/dvc/fs.rs
@@ -1,65 +1 @@
-use std::path::PathBuf;
-
-use tracing::error;
-
-use crate::dvc::encoding::DataEncoding;
-
-/// Guard for created temporary file. Associated file is deleted on drop.
-pub struct TmpFileGuard(PathBuf);
-
-impl TmpFileGuard {
-    pub fn new(extension: &str) -> anyhow::Result<Self> {
-        // Create empty temporary file and release the handle.
-        let (_file, path) = tempfile::Builder::new()
-            .prefix("devolutions-")
-            .suffix(&format!(".{extension}"))
-            .tempfile()?
-            .keep()?;
-
-        Ok(Self(path))
-    }
-
-    pub fn write_content(&self, content: &str) -> anyhow::Result<()> {
-        std::fs::write(&self.0, content)?;
-        Ok(())
-    }
-
-    /// Write content transcoded from UTF-8 to the specified encoding.
-    pub fn write_content_encoded(&self, content: &str, encoding: DataEncoding) -> anyhow::Result<()> {
-        let bytes = encoding.encode_str(content);
-        std::fs::write(&self.0, &*bytes)?;
-        Ok(())
-    }
-
-    /// Write content as UTF-8 with a BOM prefix (for Windows PowerShell 5.x script files).
-    pub fn write_content_utf8_bom(&self, content: &str) -> anyhow::Result<()> {
-        use std::io::Write as _;
-
-        let mut file = std::fs::File::create(&self.0)?;
-        file.write_all(b"\xEF\xBB\xBF")?;
-        file.write_all(content.as_bytes())?;
-        Ok(())
-    }
-
-    pub fn path(&self) -> &PathBuf {
-        &self.0
-    }
-
-    pub fn path_string(&self) -> String {
-        format!("{}", self.0.display())
-    }
-}
-
-impl Drop for TmpFileGuard {
-    fn drop(&mut self) {
-        // We can't use `MoveFileExW` for scheduled deletion by OS via MOVEFILE_DELAY_UNTIL_REBOOT
-        // because it requires administrative rights to work, however devolutions-session
-        // is running under non-elevated user account.
-        // (see [MSDN](https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-movefileexa#remarks)).
-
-        if let Err(error) = std::fs::remove_file(&self.0) {
-            let path = format!("{}", self.0.display());
-            error!(%error, path, "Failed to remove temporary file");
-        }
-    }
-}
+pub use devolutions_agent_shared::temp_file::TmpFileGuard;
diff --git a/devolutions-session/src/dvc/process.rs b/devolutions-session/src/dvc/process.rs
index c7c56f3fa..95efb007e 100644
--- a/devolutions-session/src/dvc/process.rs
+++ b/devolutions-session/src/dvc/process.rs
@@ -46,6 +46,12 @@ impl From<windows::core::Error> for ExecError {
     }
 }
 
+impl From<std::io::Error> for ExecError {
+    fn from(error: std::io::Error) -> Self {
+        ExecError::Other(error.into())
+    }
+}
+
 impl<T: Send + Sync + 'static> From<tokio::sync::mpsc::error::SendError<T>> for ExecError {
     fn from(error: tokio::sync::mpsc::error::SendError<T>) -> Self {
         ExecError::Other(error.into())
diff --git a/devolutions-session/src/dvc/task.rs b/devolutions-session/src/dvc/task.rs
index 21e47cba8..e98d6e98b 100644
--- a/devolutions-session/src/dvc/task.rs
+++ b/devolutions-session/src/dvc/task.rs
@@ -2,6 +2,7 @@ use std::collections::HashMap;
 
 use anyhow::{Context, bail};
 use async_trait::async_trait;
+use devolutions_agent_shared::temp_file::{BATCH_UTF8_PREAMBLE, POWERSHELL_UTF8_ENCODING_PREAMBLE, TmpFileGuard};
 use devolutions_gateway_task::Task;
 use now_proto_pdu::ironrdp_core::IntoOwned;
 use now_proto_pdu::{
@@ -37,7 +38,6 @@ use windows::core::PCWSTR;
 
 use crate::dvc::channel::{WinapiSignaledSender, bounded_mpsc_channel, winapi_signaled_mpsc_channel};
 use crate::dvc::encoding::DataEncoding;
-use crate::dvc::fs::TmpFileGuard;
 use crate::dvc::io::run_dvc_io;
 use crate::dvc::process::{ExecError, ServerChannelEvent, WinApiProcess, WinApiProcessBuilder};
 use crate::dvc::rdm::RdmMessageProcessor;
@@ -663,7 +663,7 @@ impl MessageProcessor {
         // - RAW_ENCODING: pass through raw bytes without transcoding.
         // - UNICODE_CONSOLE: inject `@chcp 65001`, write file as BOM-less UTF-8, IO passthrough.
         let (file_encoding, io_encoding) = if batch_msg.is_unicode_console() {
-            script = format!("@chcp 65001 > nul\r\n{}", script);
+            script = format!("{BATCH_UTF8_PREAMBLE}\r\n{script}");
             (DataEncoding::Raw, DataEncoding::Raw)
         } else if batch_msg.is_raw_encoding() {
             (DataEncoding::from_oem_codepage(), DataEncoding::Raw)
@@ -672,7 +672,7 @@ impl MessageProcessor {
         };
 
         let tmp_file = TmpFileGuard::new("bat")?;
-        tmp_file.write_content_encoded(&script, file_encoding)?;
+        tmp_file.write_bytes(&file_encoding.encode_str(&script))?;
 
         let parameters = format!("/Q /C \"{}\"", tmp_file.path_string());
 
@@ -723,10 +723,7 @@ impl MessageProcessor {
             let mut script = winps_msg.command().to_owned();
             if winps_msg.is_unicode_console() {
                 // Inject UTF-8 encoding setup for Windows PowerShell.
-                script = format!(
-                    "$OutputEncoding = [Console]::InputEncoding = [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new()\r\n{}",
-                    script
-                );
+                script = format!("{POWERSHELL_UTF8_ENCODING_PREAMBLE}\r\n{script}");
             }
             let tmp_file = TmpFileGuard::new("ps1")?;
             tmp_file.write_content_utf8_bom(&script)?;
@@ -786,13 +783,10 @@ impl MessageProcessor {
             let mut script = pwsh_msg.command().to_owned();
             if pwsh_msg.is_unicode_console() {
                 // Inject UTF-8 encoding setup for PowerShell 7+.
-                script = format!(
-                    "$OutputEncoding = [Console]::InputEncoding = [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new()\r\n{}",
-                    script
-                );
+                script = format!("{POWERSHELL_UTF8_ENCODING_PREAMBLE}\r\n{script}");
             }
             let tmp_file = TmpFileGuard::new("ps1")?;
-            tmp_file.write_content_encoded(&script, DataEncoding::Raw)?;
+            tmp_file.write_content(&script)?;
             params.push("-Command".to_owned());
             params.push(format!("\"{}\"", tmp_file.path_string()));
             Some(tmp_file)
diff --git a/devolutions-session/src/main.rs b/devolutions-session/src/main.rs
index a7b0056ba..97fea4c8c 100644
--- a/devolutions-session/src/main.rs
+++ b/devolutions-session/src/main.rs
@@ -4,8 +4,8 @@
 
 #[cfg(all(windows, feature = "dvc"))]
 use ::{
-    async_trait as _, devolutions_agent_shared as _, now_proto_pdu as _, tempfile as _, thiserror as _,
-    win_api_wrappers as _, windows as _,
+    async_trait as _, devolutions_agent_shared as _, now_proto_pdu as _, thiserror as _, win_api_wrappers as _,
+    windows as _,
 };
 use ::{
     camino as _, cfg_if as _, ctrlc as _, devolutions_log as _, futures as _, parking_lot as _, serde as _,

From 327354a3668de8169a70b52408bc76f89c3bcbfc Mon Sep 17 00:00:00 2001
From: Vladyslav Nikonov <mail@pacmancoder.xyz>
Date: Tue, 14 Jul 2026 17:38:06 +0300
Subject: [PATCH 2/4] feat(agent): add package broker policy engine

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .gitattributes                                |   3 +
 .../samples/corporate-allowlist.policy.json   | 134 ++++++
 .../samples/deny-risky-options.policy.json    |  81 ++++
 .../winget-unknown-install.request.json       |  31 ++
 .../winget-vscode-install.request.json        |  32 ++
 .../winget-vscode-skiphash.request.json       |  31 ++
 .../samples/scenarios/baseline.scenarios.json |  38 ++
 .../src/broker/command_builder/mod.rs         |  38 ++
 .../src/broker/command_builder/powershell.rs  | 293 +++++++++++++
 .../src/broker/command_builder/winget.rs      | 209 +++++++++
 .../src/broker/evaluator/constraints.rs       | 229 ++++++++++
 .../src/broker/evaluator/matching.rs          | 215 +++++++++
 devolutions-agent/src/broker/evaluator/mod.rs | 114 +++++
 .../src/broker/evaluator/tests.rs             | 214 +++++++++
 .../src/broker/evaluator/version.rs           | 107 +++++
 .../src/broker/evaluator/wildcard.rs          |  50 +++
 .../src/broker/executor/output.rs             | 413 ++++++++++++++++++
 .../src/broker/scenario_tests.rs              | 131 ++++++
 18 files changed, 2363 insertions(+)
 create mode 100644 devolutions-agent/src/broker/assets/samples/corporate-allowlist.policy.json
 create mode 100644 devolutions-agent/src/broker/assets/samples/deny-risky-options.policy.json
 create mode 100644 devolutions-agent/src/broker/assets/samples/requests/winget-unknown-install.request.json
 create mode 100644 devolutions-agent/src/broker/assets/samples/requests/winget-vscode-install.request.json
 create mode 100644 devolutions-agent/src/broker/assets/samples/requests/winget-vscode-skiphash.request.json
 create mode 100644 devolutions-agent/src/broker/assets/samples/scenarios/baseline.scenarios.json
 create mode 100644 devolutions-agent/src/broker/command_builder/mod.rs
 create mode 100644 devolutions-agent/src/broker/command_builder/powershell.rs
 create mode 100644 devolutions-agent/src/broker/command_builder/winget.rs
 create mode 100644 devolutions-agent/src/broker/evaluator/constraints.rs
 create mode 100644 devolutions-agent/src/broker/evaluator/matching.rs
 create mode 100644 devolutions-agent/src/broker/evaluator/mod.rs
 create mode 100644 devolutions-agent/src/broker/evaluator/tests.rs
 create mode 100644 devolutions-agent/src/broker/evaluator/version.rs
 create mode 100644 devolutions-agent/src/broker/evaluator/wildcard.rs
 create mode 100644 devolutions-agent/src/broker/executor/output.rs
 create mode 100644 devolutions-agent/src/broker/scenario_tests.rs

diff --git a/.gitattributes b/.gitattributes
index 1f8b44bb4..8df0e1b4b 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -22,3 +22,6 @@ devolutions-gateway/openapi/dotnet-client/docs/** linguist-generated merge=binar
 devolutions-gateway/openapi/dotnet-subscriber/src/** linguist-generated merge=binary
 devolutions-gateway/openapi/ts-angular-client/api/** linguist-generated merge=binary
 devolutions-gateway/openapi/ts-angular-client/model/** linguist-generated merge=binary
+
+# Sample assets produce huge LoC counts; exclude them from language statistics.
+devolutions-agent/src/broker/assets/** linguist-generated
diff --git a/devolutions-agent/src/broker/assets/samples/corporate-allowlist.policy.json b/devolutions-agent/src/broker/assets/samples/corporate-allowlist.policy.json
new file mode 100644
index 000000000..4d50bc494
--- /dev/null
+++ b/devolutions-agent/src/broker/assets/samples/corporate-allowlist.policy.json
@@ -0,0 +1,134 @@
+{
+  "$schema": "https://devolutions.net/schemas/now-policy.schema.1.0.json",
+  "PolicyVersion": "1.0.0",
+  "PolicyType": "PackageBrokerPolicy",
+  "Metadata": {
+    "Id": "contoso.desktop.standard-allowlist",
+    "Publisher": "Contoso IT",
+    "Revision": 4,
+    "PublishedAt": "2026-05-05T00:00:00Z",
+    "Description": "Fail-closed policy for standard workstation package installs."
+  },
+  "Enforcement": {
+    "DefaultDecision": "Deny",
+    "RulePrecedence": "PriorityThenDeny"
+  },
+  "Rules": [
+    {
+      "Id": "deny.integrity-bypass",
+      "Enabled": true,
+      "Priority": 10,
+      "Decision": "Deny",
+      "Reason": "Integrity and publisher checks cannot be bypassed by brokered requests.",
+      "Match": {
+        "Operations": [
+          "Install",
+          "Update"
+        ],
+        "SkipHashCheck": [
+          true
+        ]
+      }
+    },
+    {
+      "Id": "deny.custom-parameters",
+      "Enabled": true,
+      "Priority": 20,
+      "Decision": "Deny",
+      "Reason": "Custom package-manager parameters are not allowed in the workstation allow list.",
+      "Match": {
+        "HasCustomParameters": [
+          true
+        ]
+      }
+    },
+    {
+      "Id": "deny.prepost-commands",
+      "Enabled": true,
+      "Priority": 30,
+      "Decision": "Deny",
+      "Reason": "Pre and post operation commands are not allowed in the workstation allow list.",
+      "Match": {
+        "HasPrePostCommands": [
+          true
+        ]
+      }
+    },
+    {
+      "Id": "allow.winget.vscode",
+      "Enabled": true,
+      "Priority": 100,
+      "Decision": "Allow",
+      "Reason": "Visual Studio Code is approved for managed workstations.",
+      "Match": {
+        "Operations": [
+          "Install",
+          "Update"
+        ],
+        "Managers": [
+          "Winget"
+        ],
+        "Sources": [
+          "winget"
+        ],
+        "PackageIdentifiers": [
+          "Microsoft.VisualStudioCode"
+        ],
+        "Scopes": [
+          "User",
+          "Machine"
+        ],
+        "Architectures": [
+          "X64",
+          "Arm64"
+        ]
+      },
+      "Constraints": {
+        "AllowInteractive": false,
+        "AllowSkipHashCheck": false,
+        "AllowPreRelease": false,
+        "AllowCustomParameters": false,
+        "AllowPrePostCommands": false,
+        "AllowKillBeforeOperation": false
+      }
+    },
+    {
+      "Id": "allow.winget.powertoys",
+      "Enabled": true,
+      "Priority": 100,
+      "Decision": "Allow",
+      "Reason": "PowerToys is approved for developer workstations.",
+      "Match": {
+        "Operations": [
+          "Install",
+          "Update"
+        ],
+        "Managers": [
+          "Winget"
+        ],
+        "Sources": [
+          "winget"
+        ],
+        "PackageIdentifiers": [
+          "Microsoft.PowerToys"
+        ],
+        "Scopes": [
+          "User",
+          "Machine"
+        ],
+        "Architectures": [
+          "X64",
+          "Arm64"
+        ]
+      },
+      "Constraints": {
+        "AllowInteractive": false,
+        "AllowSkipHashCheck": false,
+        "AllowPreRelease": false,
+        "AllowCustomParameters": false,
+        "AllowPrePostCommands": false,
+        "AllowKillBeforeOperation": false
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/devolutions-agent/src/broker/assets/samples/deny-risky-options.policy.json b/devolutions-agent/src/broker/assets/samples/deny-risky-options.policy.json
new file mode 100644
index 000000000..5ddf8d1a9
--- /dev/null
+++ b/devolutions-agent/src/broker/assets/samples/deny-risky-options.policy.json
@@ -0,0 +1,81 @@
+{
+  "$schema": "https://devolutions.net/schemas/now-policy.schema.1.0.json",
+  "PolicyVersion": "1.0.0",
+  "PolicyType": "PackageBrokerPolicy",
+  "Metadata": {
+    "Id": "contoso.desktop.deny-risky-options",
+    "Publisher": "Contoso IT",
+    "Revision": 2,
+    "PublishedAt": "2026-05-05T00:00:00Z",
+    "Description": "Default-allow policy that blocks risky broker request options."
+  },
+  "Enforcement": {
+    "DefaultDecision": "Allow",
+    "RulePrecedence": "PriorityThenDeny"
+  },
+  "Rules": [
+    {
+      "Id": "deny.integrity-bypass",
+      "Priority": 10,
+      "Decision": "Deny",
+      "Reason": "Do not broker installs that skip WinGet hash checks or PowerShell publisher checks.",
+      "Match": {
+        "Operations": [
+          "Install",
+          "Update"
+        ],
+        "SkipHashCheck": [
+          true
+        ]
+      }
+    },
+    {
+      "Id": "deny.manager-custom-parameters",
+      "Priority": 20,
+      "Decision": "Deny",
+      "Reason": "Custom package-manager parameters require a dedicated exception policy.",
+      "Match": {
+        "HasCustomParameters": [
+          true
+        ]
+      }
+    },
+    {
+      "Id": "deny.prepost-commands",
+      "Priority": 30,
+      "Decision": "Deny",
+      "Reason": "Pre and post operation commands are outside the package manager trust boundary.",
+      "Match": {
+        "HasPrePostCommands": [
+          true
+        ]
+      }
+    },
+    {
+      "Id": "deny.kill-process-actions",
+      "Priority": 40,
+      "Decision": "Deny",
+      "Reason": "Killing processes before a brokered package operation is not allowed by this policy.",
+      "Match": {
+        "HasKillBeforeOperation": [
+          true
+        ]
+      }
+    },
+    {
+      "Id": "deny.unapproved-winget-source",
+      "Priority": 50,
+      "Decision": "Deny",
+      "Reason": "Only the default WinGet source is accepted by this deny-list sample.",
+      "Match": {
+        "Managers": [
+          "Winget"
+        ],
+        "Sources": [
+          "msstore",
+          "winget-fonts"
+        ]
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/devolutions-agent/src/broker/assets/samples/requests/winget-unknown-install.request.json b/devolutions-agent/src/broker/assets/samples/requests/winget-unknown-install.request.json
new file mode 100644
index 000000000..264f2f8c9
--- /dev/null
+++ b/devolutions-agent/src/broker/assets/samples/requests/winget-unknown-install.request.json
@@ -0,0 +1,31 @@
+{
+  "RequestKind": "PackageRequest",
+  "RequestVersion": "1.0",
+  "RequestId": "req-winget-unknown-install",
+  "CreatedAt": "2026-05-05T12:05:00Z",
+  "Operation": "Install",
+  "Manager": "Winget",
+  "Source": {
+    "Name": "winget",
+    "Url": "https://cdn.winget.microsoft.com/cache"
+  },
+  "Package": {
+    "Id": "Example.UnapprovedTool",
+    "Architecture": "X64"
+  },
+  "Options": {
+    "Scope": "User",
+    "Interactive": false,
+    "SkipHashCheck": false,
+    "PreRelease": false,
+    "CustomParameters": [],
+    "KillBeforeOperation": []
+  },
+  "Client": {
+    "RequestedElevation": "Standard",
+    "EffectiveUser": "CONTOSO\\alice",
+    "ClientVersion": "3.2.0",
+    "Transport": "HttpNamedPipe",
+    "ClientExecutablePath": "C:\\Program Files\\Devolutions\\NOW\\now-client.exe"
+  }
+}
diff --git a/devolutions-agent/src/broker/assets/samples/requests/winget-vscode-install.request.json b/devolutions-agent/src/broker/assets/samples/requests/winget-vscode-install.request.json
new file mode 100644
index 000000000..d771627f0
--- /dev/null
+++ b/devolutions-agent/src/broker/assets/samples/requests/winget-vscode-install.request.json
@@ -0,0 +1,32 @@
+{
+  "RequestKind": "PackageRequest",
+  "RequestVersion": "1.0",
+  "RequestId": "req-winget-vscode-install",
+  "CreatedAt": "2026-05-05T12:00:00Z",
+  "Operation": "Install",
+  "Manager": "Winget",
+  "Source": {
+    "Name": "winget",
+    "Url": "https://cdn.winget.microsoft.com/cache"
+  },
+  "Package": {
+    "Id": "Microsoft.VisualStudioCode",
+    "Architecture": "X64"
+  },
+  "Options": {
+    "Scope": "Machine",
+    "Interactive": false,
+    "SkipHashCheck": false,
+    "PreRelease": false,
+    "CustomParameters": [],
+    "KillBeforeOperation": []
+  },
+  "Client": {
+    "RequestedElevation": "Elevated",
+    "EffectiveUser": "CONTOSO\\alice",
+    "ClientVersion": "3.2.0",
+    "Transport": "HttpNamedPipe",
+    "ClientExecutablePath": "C:\\Program Files\\Devolutions\\NOW\\now-client.exe"
+  },
+  "IncludeCommandPreview": true
+}
diff --git a/devolutions-agent/src/broker/assets/samples/requests/winget-vscode-skiphash.request.json b/devolutions-agent/src/broker/assets/samples/requests/winget-vscode-skiphash.request.json
new file mode 100644
index 000000000..92a566cd5
--- /dev/null
+++ b/devolutions-agent/src/broker/assets/samples/requests/winget-vscode-skiphash.request.json
@@ -0,0 +1,31 @@
+{
+  "RequestKind": "PackageRequest",
+  "RequestVersion": "1.0",
+  "RequestId": "req-winget-vscode-skiphash",
+  "CreatedAt": "2026-05-05T12:10:00Z",
+  "Operation": "Install",
+  "Manager": "Winget",
+  "Source": {
+    "Name": "winget",
+    "Url": "https://cdn.winget.microsoft.com/cache"
+  },
+  "Package": {
+    "Id": "Microsoft.VisualStudioCode",
+    "Architecture": "X64"
+  },
+  "Options": {
+    "Scope": "Machine",
+    "Interactive": false,
+    "SkipHashCheck": true,
+    "PreRelease": false,
+    "CustomParameters": [],
+    "KillBeforeOperation": []
+  },
+  "Client": {
+    "RequestedElevation": "Elevated",
+    "EffectiveUser": "CONTOSO\\alice",
+    "ClientVersion": "3.2.0",
+    "Transport": "HttpNamedPipe",
+    "ClientExecutablePath": "C:\\Program Files\\Devolutions\\NOW\\now-client.exe"
+  }
+}
diff --git a/devolutions-agent/src/broker/assets/samples/scenarios/baseline.scenarios.json b/devolutions-agent/src/broker/assets/samples/scenarios/baseline.scenarios.json
new file mode 100644
index 000000000..9e8ee611e
--- /dev/null
+++ b/devolutions-agent/src/broker/assets/samples/scenarios/baseline.scenarios.json
@@ -0,0 +1,38 @@
+{
+  "ScenarioSet": "baseline",
+  "Description": "Broad end-to-end scenarios for the gateway-owned package broker policy flow.",
+  "Scenarios": [
+    {
+      "Id": "baseline.winget.vscode.allow",
+      "Policy": "corporate-allowlist.policy.json",
+      "Request": "requests/winget-vscode-install.request.json",
+      "ExpectedDecision": "Allow",
+      "ExpectedRuleId": "allow.winget.vscode",
+      "Tags": ["baseline", "winget", "allowlist"]
+    },
+    {
+      "Id": "baseline.winget.unknown.default-deny",
+      "Policy": "corporate-allowlist.policy.json",
+      "Request": "requests/winget-unknown-install.request.json",
+      "ExpectedDecision": "Deny",
+      "ExpectedRuleId": "<default>",
+      "Tags": ["baseline", "winget", "default-deny"]
+    },
+    {
+      "Id": "baseline.winget.skiphash.deny",
+      "Policy": "corporate-allowlist.policy.json",
+      "Request": "requests/winget-vscode-skiphash.request.json",
+      "ExpectedDecision": "Deny",
+      "ExpectedRuleId": "deny.integrity-bypass",
+      "Tags": ["baseline", "winget", "risky-options"]
+    },
+    {
+      "Id": "baseline.default-allow.normal-install",
+      "Policy": "deny-risky-options.policy.json",
+      "Request": "requests/winget-vscode-install.request.json",
+      "ExpectedDecision": "Allow",
+      "ExpectedRuleId": "<default>",
+      "Tags": ["baseline", "winget", "default-allow"]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/devolutions-agent/src/broker/command_builder/mod.rs b/devolutions-agent/src/broker/command_builder/mod.rs
new file mode 100644
index 000000000..f50bd0a00
--- /dev/null
+++ b/devolutions-agent/src/broker/command_builder/mod.rs
@@ -0,0 +1,38 @@
+//! Command-line builders for package manager operations.
+//!
+//! Constructs the commands the broker would execute from validated request fields.
+//! The broker never executes client-supplied commands directly.
+
+pub mod powershell;
+pub mod winget;
+
+use now_policy_api::{ManagerName, PackageRequest};
+
+/// Build a command line from a validated request, dispatching to the appropriate
+/// package manager builder.
+///
+/// Returns the command as a list of arguments (first element is the executable).
+pub fn build_command(request: &PackageRequest) -> Vec<String> {
+    match request.manager {
+        ManagerName::Winget => winget::build_winget_command(request),
+        ManagerName::PowerShell => powershell::build_powershell5_command(request),
+        ManagerName::PowerShell7 => powershell::build_powershell7_command(request),
+    }
+}
+
+/// Append `--flag value` to command if value is `Some` and non-empty.
+pub(crate) fn set_if_specified(command: &mut Vec<String>, flag: &str, value: Option<&str>) {
+    if let Some(v) = value
+        && !v.is_empty()
+    {
+        command.push(flag.to_owned());
+        command.push(v.to_owned());
+    }
+}
+
+/// Append `--flag` to command if value is true.
+pub(crate) fn set_if_true(command: &mut Vec<String>, flag: &str, value: bool) {
+    if value {
+        command.push(flag.to_owned());
+    }
+}
diff --git a/devolutions-agent/src/broker/command_builder/powershell.rs b/devolutions-agent/src/broker/command_builder/powershell.rs
new file mode 100644
index 000000000..7318cc7ea
--- /dev/null
+++ b/devolutions-agent/src/broker/command_builder/powershell.rs
@@ -0,0 +1,293 @@
+//! PowerShell command-line builders for WinPS 5.x and PowerShell 7.x.
+//!
+//! These mirror package broker client PowerShell manager helpers so the broker runs the
+//! same command the unelevated client would have run:
+//! - PowerShell 5 uses PowerShellGet (`Install-Module`/`Update-Module`/`Uninstall-Module`)
+//!   prepared as `powershell.exe -NoProfile -Command <script>`.
+//! - PowerShell 7 uses PSResourceGet (`Install-PSResource`/`Update-PSResource`/
+//!   `Uninstall-PSResource`) prepared as `pwsh.exe -NoProfile -Command <script>`.
+//!
+//! The Windows executor materializes these scripts into temporary `.ps1` files before launch.
+//!
+//! Neither builder pins a `-Repository`/source: the package source is
+//! part of the policy-matched request identity, but the executed command lets the
+//! PowerShell module resolver pick the repository. Options that don't apply to
+//! PowerShell modules (interactive, custom install location, winget's no-upgrade /
+//! uninstall-previous) are intentionally omitted.
+
+use now_policy_api::{Operation, PackageRequest, Scope};
+
+/// Build a Windows PowerShell 5.x (PowerShellGet) command from a validated request.
+pub fn build_powershell5_command(request: &PackageRequest) -> Vec<String> {
+    let mut script = String::new();
+
+    let verb = match request.operation {
+        Operation::Install => "Install-Module",
+        Operation::Update => "Update-Module",
+        Operation::Uninstall => "Uninstall-Module",
+    };
+
+    append_raw(&mut script, verb);
+    append_flag_value(&mut script, "-Name", &request.package.id.0);
+    append_raw(&mut script, "-Confirm:$false");
+    append_raw(&mut script, "-Force");
+
+    if !matches!(request.operation, Operation::Uninstall) {
+        if request.options.pre_release {
+            append_raw(&mut script, "-AllowPrerelease");
+        }
+
+        match request.options.scope {
+            Some(Scope::Machine) => append_raw(&mut script, "-Scope AllUsers"),
+            Some(Scope::User) | None => append_raw(&mut script, "-Scope CurrentUser"),
+        }
+    }
+
+    if matches!(request.operation, Operation::Install) {
+        if request.options.skip_hash_check {
+            append_raw(&mut script, "-SkipPublisherCheck");
+        }
+
+        if let Some(version) = request.package.version.as_deref() {
+            append_flag_value(&mut script, "-RequiredVersion", version);
+        }
+    }
+
+    for param in &request.options.custom_parameters {
+        if !param.is_empty() {
+            append_raw(&mut script, &param.0);
+        }
+    }
+
+    vec![
+        "powershell.exe".to_owned(),
+        "-NoProfile".to_owned(),
+        "-Command".to_owned(),
+        script,
+    ]
+}
+
+/// Build a PowerShell 7.x (PSResourceGet) command from a validated request.
+pub fn build_powershell7_command(request: &PackageRequest) -> Vec<String> {
+    let mut script = String::new();
+
+    let verb = match request.operation {
+        Operation::Install => "Install-PSResource",
+        Operation::Update => "Update-PSResource",
+        Operation::Uninstall => "Uninstall-PSResource",
+    };
+
+    append_raw(&mut script, verb);
+    append_flag_value(&mut script, "-Name", &request.package.id.0);
+    append_raw(&mut script, "-Confirm:$false");
+
+    match request.operation {
+        Operation::Install => {
+            if let Some(version) = request.package.version.as_deref() {
+                append_flag_value(&mut script, "-Version", version);
+            }
+        }
+        Operation::Update => append_raw(&mut script, "-Force"),
+        // Uninstall removes the installed resource without pinning a version.
+        Operation::Uninstall => {}
+    }
+
+    if !matches!(request.operation, Operation::Uninstall) {
+        append_raw(&mut script, "-TrustRepository");
+        append_raw(&mut script, "-AcceptLicense");
+
+        if request.options.pre_release {
+            append_raw(&mut script, "-Prerelease");
+        }
+
+        match request.options.scope {
+            Some(Scope::Machine) => append_raw(&mut script, "-Scope AllUsers"),
+            Some(Scope::User) | None => append_raw(&mut script, "-Scope CurrentUser"),
+        }
+    }
+
+    for param in &request.options.custom_parameters {
+        if !param.is_empty() {
+            append_raw(&mut script, &param.0);
+        }
+    }
+
+    vec![
+        "pwsh.exe".to_owned(),
+        "-NoProfile".to_owned(),
+        "-Command".to_owned(),
+        script,
+    ]
+}
+
+fn append_raw(script: &mut String, value: &str) {
+    if !script.is_empty() {
+        script.push(' ');
+    }
+    script.push_str(value);
+}
+
+fn append_flag_value(script: &mut String, flag_or_verb: &str, value: &str) {
+    append_raw(script, flag_or_verb);
+    append_raw(script, &quote_ps(value));
+}
+
+fn quote_ps(value: &str) -> String {
+    let escaped = value.replace('"', "`\"");
+    format!("\"{escaped}\"")
+}
+
+#[cfg(test)]
+mod tests {
+    use chrono::Utc;
+    use now_policy_api::*;
+
+    use super::*;
+
+    fn make_request(manager: ManagerName) -> PackageRequest {
+        PackageRequest {
+            request_kind: PackageRequestKind,
+            request_version: API_VERSION_STR.into(),
+            request_id: ResourceId::from("req-ps-1"),
+            created_at: Utc::now(),
+            operation: Operation::Install,
+            manager,
+            source: RequestSource {
+                name: "PSGallery".to_owned(),
+                url: None,
+            },
+            package: RequestPackage {
+                id: PackageIdentifier::from("Pester".to_owned()),
+                version: Some(VersionString("5.6.0".to_owned())),
+                architecture: None,
+                channel: None,
+            },
+            options: RequestOptions {
+                scope: Some(Scope::User),
+                interactive: false,
+                skip_hash_check: false,
+                pre_release: false,
+                custom_install_location: None,
+                custom_parameters: Vec::new(),
+                pre_operation_command: None,
+                post_operation_command: None,
+                kill_before_operation: Vec::new(),
+                uninstall_previous: false,
+                no_upgrade: false,
+            },
+            client: ClientContext {
+                transport: Transport::HttpNamedPipe,
+                requested_elevation: Elevation::Elevated,
+                effective_user: "DOMAIN\\user".to_owned(),
+                client_executable_path: "C:\\Program Files\\Devolutions\\Package Broker\\PackageBrokerClient.exe"
+                    .to_owned(),
+                client_version: "1.0.0".to_owned(),
+            },
+            include_command_preview: false,
+            capture_output: false,
+        }
+    }
+
+    /// The full PowerShell command line is `exe -NoProfile -Command <script>`.
+    fn script_of(cmd: &[String]) -> &str {
+        assert_eq!(cmd[1], "-NoProfile");
+        assert_eq!(cmd[2], "-Command");
+        &cmd[3]
+    }
+
+    #[test]
+    fn powershell5_install_matches_package_broker_client_semantics() {
+        let request = make_request(ManagerName::PowerShell);
+        let cmd = build_powershell5_command(&request);
+        let script = script_of(&cmd);
+        assert_eq!(cmd[0], "powershell.exe");
+        // verb, then -Name <id>, -Confirm:$false, -Force.
+        assert!(script.starts_with("Install-Module -Name \"Pester\" -Confirm:$false -Force"));
+        assert!(script.contains("-Scope CurrentUser"));
+        assert!(script.contains("-RequiredVersion \"5.6.0\""));
+        // The package broker client does not pin a repository for PowerShell operations.
+        assert!(!script.contains("-Repository"));
+    }
+
+    #[test]
+    fn powershell5_machine_scope_is_allusers() {
+        let mut request = make_request(ManagerName::PowerShell);
+        request.options.scope = Some(Scope::Machine);
+        let cmd = build_powershell5_command(&request);
+        let script = script_of(&cmd);
+        assert!(script.contains("-Scope AllUsers"));
+    }
+
+    #[test]
+    fn powershell5_prerelease_and_skiphash() {
+        let mut request = make_request(ManagerName::PowerShell);
+        request.options.pre_release = true;
+        request.options.skip_hash_check = true;
+        let cmd = build_powershell5_command(&request);
+        let script = script_of(&cmd);
+        assert!(script.contains("-AllowPrerelease"));
+        assert!(script.contains("-SkipPublisherCheck"));
+    }
+
+    #[test]
+    fn powershell5_uninstall_omits_scope_and_version() {
+        let mut request = make_request(ManagerName::PowerShell);
+        request.operation = Operation::Uninstall;
+        let cmd = build_powershell5_command(&request);
+        let script = script_of(&cmd);
+        assert!(script.starts_with("Uninstall-Module -Name \"Pester\""));
+        assert!(!script.contains("-Scope"));
+        assert!(!script.contains("-RequiredVersion"));
+        assert!(!script.contains("-SkipPublisherCheck"));
+    }
+
+    #[test]
+    fn powershell7_install_matches_package_broker_client_semantics() {
+        let request = make_request(ManagerName::PowerShell7);
+        let cmd = build_powershell7_command(&request);
+        let script = script_of(&cmd);
+        assert_eq!(cmd[0], "pwsh.exe");
+        assert!(script.starts_with("Install-PSResource -Name \"Pester\" -Confirm:$false"));
+        assert!(script.contains("-Version \"5.6.0\""));
+        assert!(script.contains("-TrustRepository"));
+        assert!(script.contains("-AcceptLicense"));
+        assert!(script.contains("-Scope CurrentUser"));
+        assert!(!script.contains("-Repository"));
+    }
+
+    #[test]
+    fn powershell7_update_uses_force_not_version() {
+        let mut request = make_request(ManagerName::PowerShell7);
+        request.operation = Operation::Update;
+        let cmd = build_powershell7_command(&request);
+        let script = script_of(&cmd);
+        assert!(script.contains("Update-PSResource"));
+        assert!(script.contains("-Force"));
+        assert!(!script.contains("-Version"));
+        assert!(script.contains("-TrustRepository"));
+    }
+
+    #[test]
+    fn powershell7_uninstall_omits_version_and_trust_flags() {
+        let mut request = make_request(ManagerName::PowerShell7);
+        request.operation = Operation::Uninstall;
+        let cmd = build_powershell7_command(&request);
+        let script = script_of(&cmd);
+        assert!(script.starts_with("Uninstall-PSResource -Name \"Pester\" -Confirm:$false"));
+        // Uninstall must not pin a version (it would remove only the matching version,
+        // or fail if it does not match what is installed).
+        assert!(!script.contains("-Version"));
+        assert!(!script.contains("-TrustRepository"));
+        assert!(!script.contains("-AcceptLicense"));
+        assert!(!script.contains("-Scope"));
+    }
+
+    #[test]
+    fn powershell_custom_parameters_are_appended() {
+        let mut request = make_request(ManagerName::PowerShell7);
+        request.options.custom_parameters = vec![CustomParameterString("-Reinstall".to_owned())];
+        let cmd = build_powershell7_command(&request);
+        let script = script_of(&cmd);
+        assert!(script.contains("-Reinstall"));
+    }
+}
diff --git a/devolutions-agent/src/broker/command_builder/winget.rs b/devolutions-agent/src/broker/command_builder/winget.rs
new file mode 100644
index 000000000..b985fcdc9
--- /dev/null
+++ b/devolutions-agent/src/broker/command_builder/winget.rs
@@ -0,0 +1,209 @@
+//! WinGet command-line builder.
+
+use now_policy_api::{Architecture, Operation, PackageRequest, Scope};
+
+use super::{set_if_specified, set_if_true};
+
+/// Build the WinGet command line from a validated request.
+///
+/// Returns the command as a list of arguments (first element is the executable).
+pub fn build_winget_command(request: &PackageRequest) -> Vec<String> {
+    let operation = match request.operation {
+        Operation::Install => "install",
+        Operation::Update => "upgrade",
+        Operation::Uninstall => "uninstall",
+    };
+
+    let mut command = vec![
+        "winget.exe".to_owned(),
+        operation.to_owned(),
+        "--id".to_owned(),
+        request.package.id.0.clone(),
+        "--source".to_owned(),
+        request.source.name.clone(),
+        "--exact".to_owned(),
+        "--accept-source-agreements".to_owned(),
+    ];
+
+    // Version pinning applies to install/update; uninstall removes whatever version is
+    // installed (pinning a possibly-mismatched version would fail the uninstall).
+    if !matches!(request.operation, Operation::Uninstall) {
+        set_if_specified(&mut command, "--version", request.package.version.as_deref());
+    }
+
+    set_if_specified(
+        &mut command,
+        "--architecture",
+        request.package.architecture.map(|arch| match arch {
+            Architecture::X86 => "x86",
+            Architecture::X64 => "x64",
+            Architecture::Arm64 => "arm64",
+            Architecture::Neutral => "neutral",
+        }),
+    );
+
+    set_if_specified(
+        &mut command,
+        "--scope",
+        match request.options.scope {
+            Some(Scope::User) => Some("user"),
+            Some(Scope::Machine) => Some("machine"),
+            None => None,
+        },
+    );
+
+    set_if_true(&mut command, "--interactive", request.options.interactive);
+
+    set_if_true(&mut command, "--silent", !request.options.interactive);
+    set_if_true(&mut command, "--disable-interactivity", !request.options.interactive);
+
+    set_if_true(&mut command, "--ignore-security-hash", request.options.skip_hash_check);
+
+    set_if_specified(
+        &mut command,
+        "--location",
+        request.options.custom_install_location.as_deref(),
+    );
+
+    // `--no-upgrade` only applies to install (skip if a version is already present).
+    if matches!(request.operation, Operation::Install) {
+        set_if_true(&mut command, "--no-upgrade", request.options.no_upgrade);
+    }
+
+    // `--uninstall-previous` applies to upgrade (remove the previous version).
+    if matches!(request.operation, Operation::Update) {
+        set_if_true(&mut command, "--uninstall-previous", request.options.uninstall_previous);
+    }
+
+    // Append any custom parameters.
+    for param in &request.options.custom_parameters {
+        if !param.is_empty() {
+            command.push(param.0.clone());
+        }
+    }
+
+    if matches!(request.operation, Operation::Install | Operation::Update) {
+        command.push("--accept-package-agreements".to_owned());
+    }
+
+    command
+}
+
+#[cfg(test)]
+mod tests {
+    use chrono::Utc;
+    use now_policy_api::*;
+
+    use super::*;
+
+    fn make_request() -> PackageRequest {
+        PackageRequest {
+            request_kind: PackageRequestKind,
+            request_version: API_VERSION_STR.into(),
+            request_id: ResourceId::from("req-1"),
+            created_at: Utc::now(),
+            operation: Operation::Install,
+            manager: ManagerName::Winget,
+            source: RequestSource {
+                name: "winget".to_owned(),
+                url: None,
+            },
+            package: RequestPackage {
+                id: PackageIdentifier::from("Mozilla.Firefox".to_owned()),
+                version: None,
+                architecture: None,
+                channel: None,
+            },
+            options: RequestOptions {
+                scope: None,
+                interactive: false,
+                skip_hash_check: false,
+                pre_release: false,
+                custom_install_location: None,
+                custom_parameters: Vec::new(),
+                pre_operation_command: None,
+                post_operation_command: None,
+                kill_before_operation: Vec::new(),
+                uninstall_previous: false,
+                no_upgrade: false,
+            },
+            client: ClientContext {
+                transport: Transport::HttpNamedPipe,
+                requested_elevation: Elevation::Elevated,
+                effective_user: "DOMAIN\\user".to_owned(),
+                client_executable_path: "C:\\Program Files\\Devolutions\\Package Broker\\PackageBrokerClient.exe"
+                    .to_owned(),
+                client_version: "1.0.0".to_owned(),
+            },
+            include_command_preview: false,
+            capture_output: false,
+        }
+    }
+
+    #[test]
+    fn test_basic_install_command() {
+        let request = make_request();
+        let cmd = build_winget_command(&request);
+        assert_eq!(cmd[0], "winget.exe");
+        assert_eq!(cmd[1], "install");
+        assert!(cmd.contains(&"--id".to_owned()));
+        assert!(cmd.contains(&"Mozilla.Firefox".to_owned()));
+        assert!(cmd.contains(&"--silent".to_owned()));
+        assert!(cmd.contains(&"--accept-source-agreements".to_owned()));
+    }
+
+    #[test]
+    fn test_upgrade_command() {
+        let mut request = make_request();
+        request.operation = Operation::Update;
+        request.package.version = Some(VersionString("120.0.0".to_owned()));
+
+        let cmd = build_winget_command(&request);
+        assert_eq!(cmd[1], "upgrade");
+        assert!(cmd.contains(&"--version".to_owned()));
+        assert!(cmd.contains(&"120.0.0".to_owned()));
+    }
+
+    #[test]
+    fn test_no_upgrade_flag_on_install_only() {
+        let mut request = make_request();
+        request.options.no_upgrade = true;
+
+        // Install: flag is emitted.
+        let cmd = build_winget_command(&request);
+        assert!(cmd.contains(&"--no-upgrade".to_owned()));
+
+        // Update: `--no-upgrade` is not an upgrade flag, so it must not appear.
+        request.operation = Operation::Update;
+        let cmd = build_winget_command(&request);
+        assert!(!cmd.contains(&"--no-upgrade".to_owned()));
+    }
+
+    #[test]
+    fn test_uninstall_previous_flag_on_update_only() {
+        let mut request = make_request();
+        request.options.uninstall_previous = true;
+
+        // Install: `--uninstall-previous` is an upgrade flag, so it must not appear.
+        let cmd = build_winget_command(&request);
+        assert!(!cmd.contains(&"--uninstall-previous".to_owned()));
+
+        // Update: flag is emitted.
+        request.operation = Operation::Update;
+        let cmd = build_winget_command(&request);
+        assert!(cmd.contains(&"--uninstall-previous".to_owned()));
+    }
+
+    #[test]
+    fn test_uninstall_omits_version() {
+        let mut request = make_request();
+        request.operation = Operation::Uninstall;
+        request.package.version = Some(VersionString("120.0.0".to_owned()));
+
+        // Even when the request carries a version, uninstall must not pin it.
+        let cmd = build_winget_command(&request);
+        assert_eq!(cmd[1], "uninstall");
+        assert!(!cmd.contains(&"--version".to_owned()));
+        assert!(!cmd.contains(&"120.0.0".to_owned()));
+    }
+}
diff --git a/devolutions-agent/src/broker/evaluator/constraints.rs b/devolutions-agent/src/broker/evaluator/constraints.rs
new file mode 100644
index 000000000..864265076
--- /dev/null
+++ b/devolutions-agent/src/broker/evaluator/constraints.rs
@@ -0,0 +1,229 @@
+//! Policy constraint checks.
+
+use now_policy::PolicyConstraints;
+use now_policy_api::PackageRequest;
+
+use super::RequestFlags;
+use super::wildcard::wildcard_any_vec;
+
+pub(super) fn constraints_pass(
+    constraints: &Option<PolicyConstraints>,
+    request: &PackageRequest,
+    flags: &RequestFlags,
+) -> bool {
+    let Some(c) = constraints else {
+        return true;
+    };
+
+    if !c.allow_interactive && request.options.interactive {
+        return false;
+    }
+    if !c.allow_skip_hash_check && request.options.skip_hash_check {
+        return false;
+    }
+    if !c.allow_pre_release && request.options.pre_release {
+        return false;
+    }
+    if !c.allow_custom_install_location && flags.has_custom_install_location {
+        return false;
+    }
+    if !c.allow_custom_parameters && flags.has_custom_parameters {
+        return false;
+    }
+    if !c.allow_pre_post_commands && flags.has_pre_post_commands {
+        return false;
+    }
+    if !c.allow_kill_before_operation && flags.has_kill_before_operation {
+        return false;
+    }
+    if !c.allow_uninstall_previous && flags.has_uninstall_previous {
+        return false;
+    }
+    // `allow_upgrade` gates the request's `no_upgrade` flag (skip-upgrade-if-present).
+    if !c.allow_upgrade && flags.no_upgrade {
+        return false;
+    }
+
+    // Check install location patterns.
+    if flags.has_custom_install_location
+        && !c.allowed_install_location_patterns.is_empty()
+        && !wildcard_any_vec(&flags.custom_install_location, &c.allowed_install_location_patterns)
+    {
+        return false;
+    }
+
+    // Check custom parameters.
+    for param in &flags.custom_parameters {
+        if !c.denied_custom_parameters.is_empty() && wildcard_any_vec(param, &c.denied_custom_parameters) {
+            return false;
+        }
+        if !c.allowed_custom_parameters.is_empty() || !c.allowed_custom_parameter_patterns.is_empty() {
+            let exact_allowed = c
+                .allowed_custom_parameters
+                .iter()
+                .any(|v| v.eq_ignore_ascii_case(param));
+            let pattern_allowed = wildcard_any_vec(param, &c.allowed_custom_parameter_patterns);
+            if !exact_allowed && !pattern_allowed {
+                return false;
+            }
+        }
+    }
+
+    true
+}
+
+#[cfg(test)]
+mod tests {
+    use chrono::Utc;
+    use now_policy::{CustomParameterString, StringPattern};
+    use now_policy_api as api;
+
+    use super::*;
+
+    fn request() -> PackageRequest {
+        PackageRequest {
+            request_kind: api::PackageRequestKind,
+            request_version: api::API_VERSION_STR.into(),
+            request_id: api::ResourceId::from("req-1"),
+            created_at: Utc::now(),
+            operation: api::Operation::Install,
+            manager: api::ManagerName::Winget,
+            source: api::RequestSource {
+                name: "winget".to_owned(),
+                url: None,
+            },
+            package: api::RequestPackage {
+                id: api::PackageIdentifier("Contoso.Tools".to_owned()),
+                version: None,
+                architecture: None,
+                channel: None,
+            },
+            options: api::RequestOptions {
+                scope: None,
+                interactive: false,
+                skip_hash_check: false,
+                pre_release: false,
+                custom_install_location: None,
+                custom_parameters: Vec::new(),
+                pre_operation_command: None,
+                post_operation_command: None,
+                kill_before_operation: Vec::new(),
+                uninstall_previous: false,
+                no_upgrade: false,
+            },
+            client: api::ClientContext {
+                transport: api::Transport::HttpNamedPipe,
+                requested_elevation: api::Elevation::Elevated,
+                effective_user: "DOMAIN\\user".to_owned(),
+                client_executable_path: "C:\\Program Files\\Devolutions\\Package Broker\\PackageBrokerClient.exe"
+                    .to_owned(),
+                client_version: "1.0.0".to_owned(),
+            },
+            include_command_preview: false,
+            capture_output: false,
+        }
+    }
+
+    fn flags() -> RequestFlags {
+        RequestFlags {
+            has_custom_parameters: false,
+            has_custom_install_location: false,
+            has_pre_post_commands: false,
+            has_kill_before_operation: false,
+            has_uninstall_previous: false,
+            no_upgrade: false,
+            custom_install_location: String::new(),
+            custom_parameters: Vec::new(),
+        }
+    }
+
+    #[test]
+    fn missing_constraints_are_permissive() {
+        assert!(constraints_pass(&None, &request(), &flags()));
+    }
+
+    #[test]
+    fn boolean_risky_option_gates_are_enforced() {
+        let mut request = request();
+        request.options.interactive = true;
+
+        let constraints = PolicyConstraints {
+            allow_interactive: false,
+            ..Default::default()
+        };
+
+        assert!(!constraints_pass(&Some(constraints), &request, &flags()));
+    }
+
+    #[test]
+    fn install_location_must_match_allowed_patterns_when_present() {
+        let constraints = PolicyConstraints {
+            allowed_install_location_patterns: vec![StringPattern("C:\\Tools\\*".to_owned())],
+            ..Default::default()
+        };
+
+        let mut matching_flags = flags();
+        matching_flags.has_custom_install_location = true;
+        matching_flags.custom_install_location = "C:\\Tools\\Contoso".to_owned();
+        assert!(constraints_pass(
+            &Some(constraints.clone()),
+            &request(),
+            &matching_flags
+        ));
+
+        let mut non_matching_flags = matching_flags;
+        non_matching_flags.custom_install_location = "D:\\Temp\\Contoso".to_owned();
+        assert!(!constraints_pass(&Some(constraints), &request(), &non_matching_flags));
+    }
+
+    #[test]
+    fn denied_custom_parameter_takes_precedence() {
+        let constraints = PolicyConstraints {
+            allowed_custom_parameter_patterns: vec![CustomParameterString("--*".to_owned())],
+            denied_custom_parameters: vec![CustomParameterString("--force".to_owned())],
+            ..Default::default()
+        };
+
+        let mut flags = flags();
+        flags.has_custom_parameters = true;
+        flags.custom_parameters = vec!["--force".to_owned()];
+
+        assert!(!constraints_pass(&Some(constraints), &request(), &flags));
+    }
+
+    #[test]
+    fn custom_parameter_allowlist_accepts_exact_or_pattern_matches() {
+        let constraints = PolicyConstraints {
+            allowed_custom_parameters: vec![CustomParameterString("--silent".to_owned())],
+            allowed_custom_parameter_patterns: vec![CustomParameterString("/log=*".to_owned())],
+            ..Default::default()
+        };
+
+        let mut exact_flags = flags();
+        exact_flags.has_custom_parameters = true;
+        exact_flags.custom_parameters = vec!["--SILENT".to_owned()];
+        assert!(constraints_pass(&Some(constraints.clone()), &request(), &exact_flags));
+
+        let mut pattern_flags = flags();
+        pattern_flags.has_custom_parameters = true;
+        pattern_flags.custom_parameters = vec!["/log=C:\\Temp\\install.log".to_owned()];
+        assert!(constraints_pass(&Some(constraints.clone()), &request(), &pattern_flags));
+
+        let mut rejected_flags = flags();
+        rejected_flags.has_custom_parameters = true;
+        rejected_flags.custom_parameters = vec!["--force".to_owned()];
+        assert!(!constraints_pass(&Some(constraints), &request(), &rejected_flags));
+    }
+
+    #[test]
+    fn allow_upgrade_controls_no_upgrade_requests() {
+        let constraints = PolicyConstraints {
+            allow_upgrade: false,
+            ..Default::default()
+        };
+        let mut flags = flags();
+        flags.no_upgrade = true;
+
+        assert!(!constraints_pass(&Some(constraints), &request(), &flags));
+    }
+}
diff --git a/devolutions-agent/src/broker/evaluator/matching.rs b/devolutions-agent/src/broker/evaluator/matching.rs
new file mode 100644
index 000000000..26720b93b
--- /dev/null
+++ b/devolutions-agent/src/broker/evaluator/matching.rs
@@ -0,0 +1,215 @@
+//! Rule matching primitives.
+
+use std::collections::BTreeSet;
+
+use now_policy::{Architecture, Elevation, ManagerName, Operation, PolicyRule, Scope};
+use now_policy_api::PackageRequest;
+
+use super::RequestFlags;
+use super::constraints::constraints_pass;
+use super::version::version_range_matches;
+use super::wildcard::wildcard_any;
+
+pub(super) fn rule_matches(
+    rule: &PolicyRule,
+    request: &PackageRequest,
+    flags: &RequestFlags,
+    effective_version: &str,
+) -> bool {
+    let m = &rule.match_criteria;
+
+    operations_match(request.operation.into(), &m.operations)
+        && managers_match(request.manager.into(), &m.managers)
+        && wildcard_any(&request.source.name, &m.sources)
+        && wildcard_any(&request.package.id, &m.package_identifiers)
+        && m.package_names.is_empty()
+        && string_in_set(effective_version, &m.versions)
+        && version_range_matches(effective_version, &m.version_range)
+        && scopes_match(request.options.scope.map(Into::into), &m.scopes)
+        && architectures_match(request.package.architecture.map(Into::into), &m.architectures)
+        && elevation_match(request.client.requested_elevation.into(), &m.elevation)
+        && bool_in_set(request.options.interactive, &m.interactive)
+        && bool_in_set(request.options.skip_hash_check, &m.skip_hash_check)
+        && bool_in_set(request.options.pre_release, &m.pre_release)
+        && bool_in_set(flags.has_custom_parameters, &m.has_custom_parameters)
+        && bool_in_set(flags.has_custom_install_location, &m.has_custom_install_location)
+        && bool_in_set(flags.has_pre_post_commands, &m.has_pre_post_commands)
+        && bool_in_set(flags.has_kill_before_operation, &m.has_kill_before_operation)
+        && bool_in_set(flags.has_uninstall_previous, &m.has_uninstall_previous)
+        && constraints_pass(&rule.constraints, request, flags)
+}
+
+fn operations_match(op: Operation, allowed: &BTreeSet<Operation>) -> bool {
+    allowed.is_empty() || allowed.contains(&op)
+}
+
+fn managers_match(name: ManagerName, allowed: &BTreeSet<ManagerName>) -> bool {
+    allowed.is_empty() || allowed.contains(&name)
+}
+
+fn scopes_match(scope: Option<Scope>, allowed: &BTreeSet<Scope>) -> bool {
+    if allowed.is_empty() {
+        return true;
+    }
+    match scope {
+        Some(s) => allowed.contains(&s),
+        None => true, // No scope specified = don't restrict.
+    }
+}
+
+fn architectures_match(arch: Option<Architecture>, allowed: &BTreeSet<Architecture>) -> bool {
+    if allowed.is_empty() {
+        return true;
+    }
+    match arch {
+        Some(a) => allowed.contains(&a),
+        None => true, // No architecture specified = don't restrict.
+    }
+}
+
+fn elevation_match(elev: Elevation, allowed: &BTreeSet<Elevation>) -> bool {
+    allowed.is_empty() || allowed.contains(&elev)
+}
+
+fn bool_in_set(value: bool, set: &BTreeSet<bool>) -> bool {
+    set.is_empty() || set.contains(&value)
+}
+
+fn string_in_set<S: AsRef<str>>(value: &str, set: &BTreeSet<S>) -> bool {
+    if set.is_empty() {
+        return true;
+    }
+    if value.is_empty() {
+        // If no version specified and set requires specific versions, don't match.
+        return false;
+    }
+    set.iter().any(|item| item.as_ref() == value)
+}
+
+#[cfg(test)]
+mod tests {
+    use chrono::Utc;
+    use now_policy::{Decision, PolicyMatch, ResourceId, StringPattern};
+    use now_policy_api as api;
+
+    use super::*;
+
+    fn request() -> PackageRequest {
+        PackageRequest {
+            request_kind: api::PackageRequestKind,
+            request_version: api::API_VERSION_STR.into(),
+            request_id: api::ResourceId::from("req-1"),
+            created_at: Utc::now(),
+            operation: api::Operation::Install,
+            manager: api::ManagerName::Winget,
+            source: api::RequestSource {
+                name: "winget".to_owned(),
+                url: None,
+            },
+            package: api::RequestPackage {
+                id: api::PackageIdentifier("Microsoft.VisualStudioCode".to_owned()),
+                version: Some(api::VersionString("1.2.3".to_owned())),
+                architecture: Some(api::Architecture::X64),
+                channel: None,
+            },
+            options: api::RequestOptions {
+                scope: Some(api::Scope::Machine),
+                interactive: false,
+                skip_hash_check: false,
+                pre_release: false,
+                custom_install_location: None,
+                custom_parameters: Vec::new(),
+                pre_operation_command: None,
+                post_operation_command: None,
+                kill_before_operation: Vec::new(),
+                uninstall_previous: false,
+                no_upgrade: false,
+            },
+            client: api::ClientContext {
+                transport: api::Transport::HttpNamedPipe,
+                requested_elevation: api::Elevation::Elevated,
+                effective_user: "DOMAIN\\user".to_owned(),
+                client_executable_path: "C:\\Program Files\\Devolutions\\Package Broker\\PackageBrokerClient.exe"
+                    .to_owned(),
+                client_version: "1.0.0".to_owned(),
+            },
+            include_command_preview: false,
+            capture_output: false,
+        }
+    }
+
+    fn rule(match_criteria: PolicyMatch) -> PolicyRule {
+        PolicyRule {
+            id: ResourceId::from("rule"),
+            enabled: true,
+            priority: 100,
+            decision: Decision::Allow,
+            reason: None,
+            match_criteria,
+            constraints: None,
+        }
+    }
+
+    fn matches(match_criteria: PolicyMatch) -> bool {
+        let request = request();
+        let flags = RequestFlags::from_request(&request);
+        rule_matches(&rule(match_criteria), &request, &flags, "1.2.3")
+    }
+
+    #[test]
+    fn empty_match_criteria_match_any_request() {
+        assert!(matches(PolicyMatch::default()));
+    }
+
+    #[test]
+    fn manager_operation_source_and_package_criteria_must_all_match() {
+        assert!(matches(PolicyMatch {
+            operations: BTreeSet::from([Operation::Install]),
+            managers: BTreeSet::from([ManagerName::Winget]),
+            sources: BTreeSet::from([StringPattern("winget".to_owned())]),
+            package_identifiers: BTreeSet::from([StringPattern("Microsoft.*Code".to_owned())]),
+            ..Default::default()
+        }));
+
+        assert!(!matches(PolicyMatch {
+            managers: BTreeSet::from([ManagerName::PowerShell]),
+            ..Default::default()
+        }));
+    }
+
+    #[test]
+    fn absent_scope_or_architecture_in_request_does_not_restrict_matching() {
+        let mut request = request();
+        request.options.scope = None;
+        request.package.architecture = None;
+        let flags = RequestFlags::from_request(&request);
+        let rule = rule(PolicyMatch {
+            scopes: BTreeSet::from([Scope::Machine]),
+            architectures: BTreeSet::from([Architecture::X64]),
+            ..Default::default()
+        });
+
+        assert!(rule_matches(&rule, &request, &flags, "1.2.3"));
+    }
+
+    #[test]
+    fn package_name_criteria_fail_closed_until_request_contains_display_name() {
+        assert!(!matches(PolicyMatch {
+            package_names: BTreeSet::from([StringPattern("Visual Studio Code".to_owned())]),
+            ..Default::default()
+        }));
+    }
+
+    #[test]
+    fn boolean_flags_match_request_options() {
+        let mut request = request();
+        request.options.interactive = true;
+        let flags = RequestFlags::from_request(&request);
+        let rule = rule(PolicyMatch {
+            interactive: BTreeSet::from([true]),
+            ..Default::default()
+        });
+
+        assert!(rule_matches(&rule, &request, &flags, "1.2.3"));
+    }
+}
diff --git a/devolutions-agent/src/broker/evaluator/mod.rs b/devolutions-agent/src/broker/evaluator/mod.rs
new file mode 100644
index 000000000..127cf8ffe
--- /dev/null
+++ b/devolutions-agent/src/broker/evaluator/mod.rs
@@ -0,0 +1,114 @@
+//! Policy evaluation engine.
+//!
+//! Implements the broker flow described in the package broker policies spec:
+//! 1. Match enabled rules against request
+//! 2. Sort by priority (lowest wins), deny wins on tie
+//! 3. Fall back to `enforcement.defaultDecision`
+
+use now_policy::{Decision, PolicyDocument};
+use now_policy_api::PackageRequest;
+
+mod constraints;
+mod matching;
+mod version;
+mod wildcard;
+
+#[cfg(test)]
+mod tests;
+
+/// Result of policy evaluation.
+#[derive(Debug, Clone)]
+pub struct PolicyDecision {
+    pub decision: Decision,
+    pub rule_id: String,
+    pub reason: String,
+}
+
+struct RequestFlags {
+    has_custom_parameters: bool,
+    has_custom_install_location: bool,
+    has_pre_post_commands: bool,
+    has_kill_before_operation: bool,
+    has_uninstall_previous: bool,
+    no_upgrade: bool,
+    custom_install_location: String,
+    custom_parameters: Vec<String>,
+}
+
+impl RequestFlags {
+    fn from_request(request: &PackageRequest) -> Self {
+        Self {
+            has_custom_parameters: !request.options.custom_parameters.is_empty(),
+            has_custom_install_location: request
+                .options
+                .custom_install_location
+                .as_deref()
+                .is_some_and(|location| !location.is_empty()),
+            has_pre_post_commands: request.options.pre_operation_command.is_some()
+                || request.options.post_operation_command.is_some(),
+            has_kill_before_operation: !request.options.kill_before_operation.is_empty(),
+            has_uninstall_previous: request.options.uninstall_previous,
+            no_upgrade: request.options.no_upgrade,
+            custom_install_location: request.options.custom_install_location.clone().unwrap_or_default(),
+            custom_parameters: request
+                .options
+                .custom_parameters
+                .iter()
+                .map(|parameter| parameter.as_ref().to_owned())
+                .collect(),
+        }
+    }
+}
+
+/// Evaluate a parsed request against a parsed policy document.
+///
+/// Both the policy and request should have already been deserialized into typed structs.
+/// This function performs the rule-matching logic only.
+pub fn evaluate(policy: &PolicyDocument, request: &PackageRequest) -> PolicyDecision {
+    let flags = RequestFlags::from_request(request);
+    let effective_version = version::get_effective_version(request);
+
+    let mut matched_rules: Vec<(&str, u32, Decision, &str)> = Vec::new();
+
+    for rule in &policy.rules {
+        if !rule.enabled {
+            continue;
+        }
+
+        if matching::rule_matches(rule, request, &flags, &effective_version) {
+            matched_rules.push((
+                &rule.id,
+                rule.priority,
+                rule.decision,
+                rule.reason.as_deref().unwrap_or("Rule matched."),
+            ));
+        }
+    }
+
+    if matched_rules.is_empty() {
+        return PolicyDecision {
+            decision: policy.enforcement.default_decision,
+            rule_id: "<default>".to_owned(),
+            reason: format!(
+                "No enabled rule matched; using defaultDecision '{}'.",
+                policy.enforcement.default_decision
+            ),
+        };
+    }
+
+    // Sort: lowest priority first, deny wins on tie.
+    matched_rules.sort_by(|a, b| {
+        a.1.cmp(&b.1).then_with(|| {
+            let a_is_deny = a.2 == Decision::Deny;
+            let b_is_deny = b.2 == Decision::Deny;
+            b_is_deny.cmp(&a_is_deny)
+        })
+    });
+
+    let winner = matched_rules[0];
+    PolicyDecision {
+        decision: winner.2,
+        rule_id: winner.0.to_owned(),
+        reason: winner.3.to_owned(),
+    }
+}
diff --git a/devolutions-agent/src/broker/evaluator/tests.rs b/devolutions-agent/src/broker/evaluator/tests.rs
new file mode 100644
index 000000000..50a03dbc3
--- /dev/null
+++ b/devolutions-agent/src/broker/evaluator/tests.rs
@@ -0,0 +1,214 @@
+#![allow(clippy::unwrap_used)]
+
+use std::collections::BTreeSet;
+
+use chrono::Utc;
+use now_policy::{
+    Decision, PackageBrokerPolicy, PolicyDocument, PolicyEnforcement, PolicyMatch, PolicyMetadata, PolicyRule,
+    PolicySchemaUri, ResourceId, RulePrecedence, SemanticVersion, StringPattern,
+};
+use now_policy_api::{self as api, PackageRequest};
+
+use super::evaluate;
+
+fn make_policy(default_decision: Decision, rules: Vec<PolicyRule>) -> PolicyDocument {
+    PolicyDocument {
+        _schema: PolicySchemaUri,
+        policy_version: SemanticVersion::from("1.0.0"),
+        policy_type: PackageBrokerPolicy,
+        metadata: PolicyMetadata {
+            id: ResourceId::from("test-policy"),
+            publisher: "Test".to_owned(),
+            revision: 1,
+            published_at: Utc::now(),
+            valid_from: None,
+            valid_until: None,
+            description: None,
+            support_url: None,
+        },
+        enforcement: PolicyEnforcement {
+            default_decision,
+            rule_precedence: RulePrecedence::PriorityThenDeny,
+            audit_mode: None,
+        },
+        rules,
+    }
+}
+
+fn make_request(operation: api::Operation, package_id: &str) -> PackageRequest {
+    PackageRequest {
+        request_kind: api::PackageRequestKind,
+        request_version: api::API_VERSION_STR.into(),
+        request_id: api::ResourceId::from("req-1"),
+        created_at: Utc::now(),
+        operation,
+        manager: api::ManagerName::Winget,
+        source: api::RequestSource {
+            name: "winget".to_owned(),
+            url: None,
+        },
+        package: api::RequestPackage {
+            id: api::PackageIdentifier(package_id.to_owned()),
+            version: None,
+            architecture: None,
+            channel: None,
+        },
+        options: api::RequestOptions {
+            scope: None,
+            interactive: false,
+            skip_hash_check: false,
+            pre_release: false,
+            custom_install_location: None,
+            custom_parameters: Vec::new(),
+            pre_operation_command: None,
+            post_operation_command: None,
+            kill_before_operation: Vec::new(),
+            uninstall_previous: false,
+            no_upgrade: false,
+        },
+        client: api::ClientContext {
+            transport: api::Transport::HttpNamedPipe,
+            requested_elevation: api::Elevation::Elevated,
+            effective_user: "DOMAIN\\user".to_owned(),
+            client_executable_path: "C:\\Program Files\\Devolutions\\Package Broker\\PackageBrokerClient.exe"
+                .to_owned(),
+            client_version: "1.0.0".to_owned(),
+        },
+        include_command_preview: false,
+        capture_output: false,
+    }
+}
+
+#[test]
+fn allow_matching_package() {
+    let policy = make_policy(
+        Decision::Deny,
+        vec![PolicyRule {
+            id: ResourceId::from("allow-firefox"),
+            enabled: true,
+            priority: 100,
+            decision: Decision::Allow,
+            reason: Some("Firefox is allowed.".to_owned()),
+            match_criteria: PolicyMatch {
+                package_identifiers: BTreeSet::from([StringPattern("Mozilla.Firefox".to_owned())]),
+                ..Default::default()
+            },
+            constraints: None,
+        }],
+    );
+
+    let request = make_request(api::Operation::Install, "Mozilla.Firefox");
+    let result = evaluate(&policy, &request);
+    assert_eq!(result.decision, Decision::Allow);
+    assert_eq!(result.rule_id, "allow-firefox");
+}
+
+#[test]
+fn deny_unmatched_package() {
+    let policy = make_policy(
+        Decision::Deny,
+        vec![PolicyRule {
+            id: ResourceId::from("allow-firefox"),
+            enabled: true,
+            priority: 100,
+            decision: Decision::Allow,
+            reason: None,
+            match_criteria: PolicyMatch {
+                package_identifiers: BTreeSet::from([StringPattern("Mozilla.Firefox".to_owned())]),
+                ..Default::default()
+            },
+            constraints: None,
+        }],
+    );
+
+    let request = make_request(api::Operation::Install, "Evil.Malware");
+    let result = evaluate(&policy, &request);
+    assert_eq!(result.decision, Decision::Deny);
+    assert_eq!(result.rule_id, "<default>");
+}
+
+#[test]
+fn disabled_rules_are_ignored() {
+    let policy = make_policy(
+        Decision::Deny,
+        vec![PolicyRule {
+            id: ResourceId::from("disabled-allow"),
+            enabled: false,
+            priority: 1,
+            decision: Decision::Allow,
+            reason: None,
+            match_criteria: PolicyMatch {
+                package_identifiers: BTreeSet::from([StringPattern("Some.Package".to_owned())]),
+                ..Default::default()
+            },
+            constraints: None,
+        }],
+    );
+
+    let request = make_request(api::Operation::Install, "Some.Package");
+    let result = evaluate(&policy, &request);
+    assert_eq!(result.decision, Decision::Deny);
+    assert_eq!(result.rule_id, "<default>");
+}
+
+#[test]
+fn lower_priority_number_wins() {
+    let policy = make_policy(
+        Decision::Deny,
+        vec![
+            PolicyRule {
+                id: ResourceId::from("allow-low-priority"),
+                enabled: true,
+                priority: 200,
+                decision: Decision::Allow,
+                reason: None,
+                match_criteria: PolicyMatch::default(),
+                constraints: None,
+            },
+            PolicyRule {
+                id: ResourceId::from("deny-high-priority"),
+                enabled: true,
+                priority: 100,
+                decision: Decision::Deny,
+                reason: None,
+                match_criteria: PolicyMatch::default(),
+                constraints: None,
+            },
+        ],
+    );
+
+    let result = evaluate(&policy, &make_request(api::Operation::Install, "Some.Package"));
+    assert_eq!(result.decision, Decision::Deny);
+    assert_eq!(result.rule_id, "deny-high-priority");
+}
+
+#[test]
+fn deny_wins_priority_ties() {
+    let policy = make_policy(
+        Decision::Allow,
+        vec![
+            PolicyRule {
+                id: ResourceId::from("allow-tie"),
+                enabled: true,
+                priority: 100,
+                decision: Decision::Allow,
+                reason: None,
+                match_criteria: PolicyMatch::default(),
+                constraints: None,
+            },
+            PolicyRule {
+                id: ResourceId::from("deny-tie"),
+                enabled: true,
+                priority: 100,
+                decision: Decision::Deny,
+                reason: None,
+                match_criteria: PolicyMatch::default(),
+                constraints: None,
+            },
+        ],
+    );
+
+    let result = evaluate(&policy, &make_request(api::Operation::Install, "Some.Package"));
+    assert_eq!(result.decision, Decision::Deny);
+    assert_eq!(result.rule_id, "deny-tie");
+}
diff --git a/devolutions-agent/src/broker/evaluator/version.rs b/devolutions-agent/src/broker/evaluator/version.rs
new file mode 100644
index 000000000..452187fcb
--- /dev/null
+++ b/devolutions-agent/src/broker/evaluator/version.rs
@@ -0,0 +1,107 @@
+//! Request version matching helpers.
+
+use now_policy::VersionRange;
+use now_policy_api::PackageRequest;
+
+pub(super) fn get_effective_version(request: &PackageRequest) -> String {
+    match &request.package.version {
+        Some(v) => v.0.clone(),
+        None => String::new(),
+    }
+}
+
+pub(super) fn version_range_matches(version: &str, range: &Option<VersionRange>) -> bool {
+    let Some(range) = range else {
+        return true;
+    };
+    if version.is_empty() {
+        return false;
+    }
+    if version.contains('-') && !range.include_prerelease {
+        return false;
+    }
+    if let Some(min) = &range.min_version
+        && !min.is_empty()
+        && compare_versions(version, min) < 0
+    {
+        return false;
+    }
+    if let Some(max) = &range.max_version
+        && !max.is_empty()
+        && compare_versions(version, max) > 0
+    {
+        return false;
+    }
+    true
+}
+
+/// Simple numeric version comparison (e.g. "1.2.3" vs "1.2.4").
+fn compare_versions(a: &str, b: &str) -> i32 {
+    let parse = |s: &str| -> Vec<u64> {
+        s.split(['.', '-', '+'])
+            .filter_map(|part| part.parse::<u64>().ok())
+            .collect()
+    };
+
+    let va = parse(a);
+    let vb = parse(b);
+    let len = va.len().max(vb.len());
+
+    for i in 0..len {
+        let pa = va.get(i).copied().unwrap_or(0);
+        let pb = vb.get(i).copied().unwrap_or(0);
+        if pa < pb {
+            return -1;
+        }
+        if pa > pb {
+            return 1;
+        }
+    }
+    0
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn range(min: Option<&str>, max: Option<&str>, include_prerelease: bool) -> Option<VersionRange> {
+        Some(VersionRange {
+            min_version: min.map(ToOwned::to_owned),
+            max_version: max.map(ToOwned::to_owned),
+            include_prerelease,
+        })
+    }
+
+    #[test]
+    fn absent_range_accepts_empty_or_present_versions() {
+        assert!(version_range_matches("", &None));
+        assert!(version_range_matches("1.2.3", &None));
+    }
+
+    #[test]
+    fn configured_range_rejects_missing_version() {
+        assert!(!version_range_matches("", &range(Some("1.0.0"), None, false)));
+    }
+
+    #[test]
+    fn inclusive_min_and_max_bounds_are_enforced() {
+        let range = range(Some("1.2.0"), Some("1.4.0"), false);
+        assert!(!version_range_matches("1.1.9", &range));
+        assert!(version_range_matches("1.2.0", &range));
+        assert!(version_range_matches("1.3.5", &range));
+        assert!(version_range_matches("1.4.0", &range));
+        assert!(!version_range_matches("1.4.1", &range));
+    }
+
+    #[test]
+    fn prerelease_versions_require_explicit_opt_in() {
+        assert!(!version_range_matches(
+            "1.2.3-beta.1",
+            &range(Some("1.0.0"), Some("2.0.0"), false)
+        ));
+        assert!(version_range_matches(
+            "1.2.3-beta.1",
+            &range(Some("1.0.0"), Some("2.0.0"), true)
+        ));
+    }
+}
diff --git a/devolutions-agent/src/broker/evaluator/wildcard.rs b/devolutions-agent/src/broker/evaluator/wildcard.rs
new file mode 100644
index 000000000..68e99df85
--- /dev/null
+++ b/devolutions-agent/src/broker/evaluator/wildcard.rs
@@ -0,0 +1,50 @@
+//! Case-insensitive wildcard matching helpers.
+
+use std::collections::BTreeSet;
+
+pub(super) fn wildcard_any<S: AsRef<str>>(value: &str, patterns: &BTreeSet<S>) -> bool {
+    patterns.is_empty() || patterns.iter().any(|pattern| wildcard_match(value, pattern.as_ref()))
+}
+
+pub(super) fn wildcard_any_vec<S: AsRef<str>>(value: &str, patterns: &[S]) -> bool {
+    patterns.iter().any(|pattern| wildcard_match(value, pattern.as_ref()))
+}
+
+fn wildcard_match(value: &str, pattern: &str) -> bool {
+    // Convert glob pattern to regex: escape everything except *, which becomes .*
+    let regex_pattern = format!("^{}$", regex::escape(pattern).replace(r"\*", ".*"));
+    regex::RegexBuilder::new(&regex_pattern)
+        .case_insensitive(true)
+        .build()
+        .is_ok_and(|re| re.is_match(value))
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::BTreeSet;
+
+    use now_policy::StringPattern;
+
+    use super::*;
+
+    #[test]
+    fn empty_pattern_set_matches_everything() {
+        assert!(wildcard_any(
+            "Microsoft.VisualStudioCode",
+            &BTreeSet::<StringPattern>::new()
+        ));
+    }
+
+    #[test]
+    fn wildcard_match_is_case_insensitive() {
+        let patterns = BTreeSet::from([StringPattern("microsoft.*code".to_owned())]);
+        assert!(wildcard_any("Microsoft.VisualStudioCode", &patterns));
+    }
+
+    #[test]
+    fn wildcard_does_not_treat_regex_metacharacters_as_regex() {
+        let patterns = BTreeSet::from([StringPattern("Contoso.Tools+".to_owned())]);
+        assert!(wildcard_any("Contoso.Tools+", &patterns));
+        assert!(!wildcard_any("Contoso.Toolss", &patterns));
+    }
+}
diff --git a/devolutions-agent/src/broker/executor/output.rs b/devolutions-agent/src/broker/executor/output.rs
new file mode 100644
index 000000000..901ee1a17
--- /dev/null
+++ b/devolutions-agent/src/broker/executor/output.rs
@@ -0,0 +1,413 @@
+//! Output capture and exit-code helpers.
+
+/// Maximum amount of captured process output retained (the tail is kept).
+pub const MAX_CAPTURED_OUTPUT_BYTES: usize = 10 * 1024;
+
+/// Outcome of executing a command plan: the main command's exit code and a
+/// tail-truncated, UTF-8 capture of its combined stdout+stderr.
+#[derive(Debug, Clone, Default)]
+pub struct ExecutionOutput {
+    pub exit_code: i32,
+    pub stdout: String,
+}
+
+/// Keep the last [`MAX_CAPTURED_OUTPUT_BYTES`] of `bytes`, decoded lossily as UTF-8.
+///
+/// When truncated, a marker line is prepended so consumers can tell output was dropped.
+pub fn tail_utf8(bytes: &[u8]) -> String {
+    if bytes.len() <= MAX_CAPTURED_OUTPUT_BYTES {
+        return String::from_utf8_lossy(bytes).into_owned();
+    }
+    let tail = &bytes[bytes.len() - MAX_CAPTURED_OUTPUT_BYTES..];
+    format!(
+        "[... output truncated to last {} KiB ...]\n{}",
+        MAX_CAPTURED_OUTPUT_BYTES / 1024,
+        String::from_utf8_lossy(tail)
+    )
+}
+
+/// Official WinGet HRESULT messages from `AppInstallerErrors.h`.
+const WINGET_EXIT_CODE_MESSAGES: &[(u32, &str)] = &[
+    (0x8A15_0001, "WinGet: an internal error occurred"),
+    (0x8A15_0002, "WinGet: invalid command-line arguments"),
+    (0x8A15_0003, "WinGet: command failed"),
+    (0x8A15_0004, "WinGet: failed to load the manifest"),
+    (0x8A15_0005, "WinGet: operation was interrupted by a control signal"),
+    (0x8A15_0006, "WinGet: shell execution install failed"),
+    (0x8A15_0007, "WinGet: manifest version is not supported"),
+    (0x8A15_0008, "WinGet: download failed"),
+    (0x8A15_0009, "WinGet: cannot write to an older source index"),
+    (0x8A15_000A, "WinGet: source index integrity is compromised"),
+    (0x8A15_000B, "WinGet: sources are invalid"),
+    (0x8A15_000C, "WinGet: source name already exists"),
+    (0x8A15_000D, "WinGet: source type is invalid"),
+    (0x8A15_000E, "WinGet: package is a bundle"),
+    (0x8A15_000F, "WinGet: source data is missing"),
+    (0x8A15_0010, "WinGet: no applicable installer found"),
+    (0x8A15_0011, "WinGet: installer hash mismatch"),
+    (0x8A15_0012, "WinGet: source name does not exist"),
+    (0x8A15_0013, "WinGet: source argument already exists"),
+    (0x8A15_0014, "WinGet: no package matched the query"),
+    (0x8A15_0015, "WinGet: no sources are configured"),
+    (0x8A15_0016, "WinGet: multiple packages matched the query"),
+    (0x8A15_0017, "WinGet: no manifest found"),
+    (0x8A15_0018, "WinGet: extension failed to provide package data"),
+    (0x8A15_0019, "WinGet: command requires administrator privileges"),
+    (0x8A15_001A, "WinGet: source is not secure"),
+    (0x8A15_001B, "WinGet: Microsoft Store source is blocked by policy"),
+    (0x8A15_001C, "WinGet: Microsoft Store app is blocked by policy"),
+    (0x8A15_001D, "WinGet: experimental feature is disabled"),
+    (0x8A15_001E, "WinGet: Microsoft Store install failed"),
+    (0x8A15_001F, "WinGet: shell completion input was invalid"),
+    (0x8A15_0020, "WinGet: failed to initialize YAML parser"),
+    (0x8A15_0021, "WinGet: YAML contains an invalid mapping key"),
+    (0x8A15_0022, "WinGet: YAML contains a duplicate mapping key"),
+    (0x8A15_0023, "WinGet: YAML operation is invalid"),
+    (0x8A15_0024, "WinGet: failed to build YAML document"),
+    (0x8A15_0025, "WinGet: YAML emitter state is invalid"),
+    (0x8A15_0026, "WinGet: YAML data is invalid"),
+    (0x8A15_0027, "WinGet: YAML parser failed"),
+    (0x8A15_0028, "WinGet: manifest validation reported warnings"),
+    (0x8A15_0029, "WinGet: manifest validation failed"),
+    (0x8A15_002A, "WinGet: manifest is invalid"),
+    (0x8A15_002B, "WinGet: update is not applicable"),
+    (0x8A15_002C, "WinGet: one or more updates failed"),
+    (0x8A15_002D, "WinGet: installer security check failed"),
+    (0x8A15_002E, "WinGet: downloaded file size does not match the manifest"),
+    (0x8A15_002F, "WinGet: uninstall information was not found"),
+    (0x8A15_0030, "WinGet: uninstall command failed"),
+    (0x8A15_0031, "WinGet: ICU break iterator failed"),
+    (0x8A15_0032, "WinGet: ICU case mapping failed"),
+    (0x8A15_0033, "WinGet: ICU regular expression failed"),
+    (0x8A15_0034, "WinGet: one or more imported packages failed to install"),
+    (0x8A15_0035, "WinGet: not all requested packages were found"),
+    (0x8A15_0036, "WinGet: JSON file is invalid"),
+    (0x8A15_0037, "WinGet: source is not remote"),
+    (0x8A15_0038, "WinGet: REST source is not supported"),
+    (0x8A15_0039, "WinGet: REST source returned invalid data"),
+    (0x8A15_003A, "WinGet: operation is blocked by policy"),
+    (0x8A15_003B, "WinGet: REST API returned an internal error"),
+    (0x8A15_003C, "WinGet: REST source URL is invalid"),
+    (0x8A15_003D, "WinGet: REST API returned an unsupported MIME type"),
+    (0x8A15_003E, "WinGet: REST source version is invalid"),
+    (0x8A15_003F, "WinGet: source data integrity check failed"),
+    (0x8A15_0040, "WinGet: failed to read stream data"),
+    (0x8A15_0041, "WinGet: package agreements were not accepted"),
+    (0x8A15_0042, "WinGet: failed to read prompt input"),
+    (0x8A15_0043, "WinGet: source request is not supported"),
+    (0x8A15_0044, "WinGet: REST API endpoint was not found"),
+    (0x8A15_0045, "WinGet: failed to open source"),
+    (0x8A15_0046, "WinGet: source agreements were not accepted"),
+    (0x8A15_0047, "WinGet: custom header exceeds the maximum length"),
+    (0x8A15_0048, "WinGet: resource file is missing"),
+    (0x8A15_0049, "WinGet: MSI install failed"),
+    (0x8A15_004A, "WinGet: msiexec argument is invalid"),
+    (0x8A15_004B, "WinGet: failed to open all sources"),
+    (0x8A15_004C, "WinGet: dependency validation failed"),
+    (0x8A15_004D, "WinGet: package is missing"),
+    (0x8A15_004E, "WinGet: table column is invalid"),
+    (
+        0x8A15_004F,
+        "WinGet: upgrade version is not newer than the installed version",
+    ),
+    (0x8A15_0050, "WinGet: upgrade version is unknown"),
+    (0x8A15_0051, "WinGet: ICU conversion failed"),
+    (0x8A15_0052, "WinGet: portable install failed"),
+    (0x8A15_0053, "WinGet: portable package does not support reparse points"),
+    (0x8A15_0054, "WinGet: portable package already exists"),
+    (0x8A15_0055, "WinGet: portable symlink path is a directory"),
+    (0x8A15_0056, "WinGet: installer prohibits elevation"),
+    (0x8A15_0057, "WinGet: portable uninstall failed"),
+    (0x8A15_0058, "WinGet: installed version validation failed"),
+    (0x8A15_0059, "WinGet: argument is not supported"),
+    (0x8A15_005A, "WinGet: argument contains an embedded null character"),
+    (0x8A15_005B, "WinGet: nested installer was not found"),
+    (0x8A15_005C, "WinGet: failed to extract archive"),
+    (0x8A15_005D, "WinGet: nested installer path is invalid"),
+    (0x8A15_005E, "WinGet: pinned certificate does not match"),
+    (0x8A15_005F, "WinGet: install location is required"),
+    (0x8A15_0060, "WinGet: archive scan failed"),
+    (0x8A15_0061, "WinGet: package is already installed"),
+    (0x8A15_0062, "WinGet: pin already exists"),
+    (0x8A15_0063, "WinGet: pin does not exist"),
+    (0x8A15_0064, "WinGet: failed to open pinning index"),
+    (0x8A15_0065, "WinGet: one or more installs failed"),
+    (0x8A15_0066, "WinGet: one or more uninstalls failed"),
+    (0x8A15_0067, "WinGet: not all single-package queries were found"),
+    (0x8A15_0068, "WinGet: package is pinned"),
+    (0x8A15_0069, "WinGet: package is a stub"),
+    (0x8A15_006A, "WinGet: application termination signal was received"),
+    (0x8A15_006B, "WinGet: failed to download dependencies"),
+    (0x8A15_006C, "WinGet: download command is prohibited"),
+    (0x8A15_006D, "WinGet: service is unavailable"),
+    (0x8A15_006E, "WinGet: resume identifier was not found"),
+    (0x8A15_006F, "WinGet: client version does not match the checkpoint"),
+    (0x8A15_0070, "WinGet: resume state is invalid"),
+    (0x8A15_0071, "WinGet: failed to open checkpoint index"),
+    (0x8A15_0072, "WinGet: resume limit was exceeded"),
+    (0x8A15_0073, "WinGet: authentication information is invalid"),
+    (0x8A15_0074, "WinGet: authentication type is not supported"),
+    (0x8A15_0075, "WinGet: authentication failed"),
+    (0x8A15_0076, "WinGet: interactive authentication is required"),
+    (0x8A15_0077, "WinGet: authentication was cancelled by the user"),
+    (0x8A15_0078, "WinGet: authentication used the wrong account"),
+    (0x8A15_0079, "WinGet: repair information was not found"),
+    (0x8A15_007A, "WinGet: repair is not applicable"),
+    (0x8A15_007B, "WinGet: repair command failed"),
+    (0x8A15_007C, "WinGet: repair is not supported"),
+    (0x8A15_007D, "WinGet: repair is prohibited in administrator context"),
+    (0x8A15_007E, "WinGet: SQLite connection was terminated"),
+    (0x8A15_007F, "WinGet: display catalog API failed"),
+    (0x8A15_0080, "WinGet: no applicable display catalog package found"),
+    (0x8A15_0081, "WinGet: SFS client API failed"),
+    (0x8A15_0082, "WinGet: no applicable SFS client package found"),
+    (0x8A15_0083, "WinGet: licensing API failed"),
+    (0x8A15_0084, "WinGet: SFS client package is not supported"),
+    (0x8A15_0085, "WinGet: licensing API returned forbidden"),
+    (0x8A15_0086, "WinGet: installer file is empty"),
+    (0x8A15_0087, "WinGet: font install failed"),
+    (0x8A15_0088, "WinGet: font file is not supported"),
+    (0x8A15_0089, "WinGet: font is already installed"),
+    (0x8A15_008A, "WinGet: font file was not found"),
+    (0x8A15_008B, "WinGet: font uninstall failed"),
+    (0x8A15_008C, "WinGet: font validation failed"),
+    (0x8A15_008D, "WinGet: font rollback failed"),
+    (
+        0x8A15_008E,
+        "WinGet: installed package uses a different installer technology",
+    ),
+    (0x8A15_0101, "WinGet installer: package is currently in use"),
+    (0x8A15_0102, "WinGet installer: another install is already in progress"),
+    (0x8A15_0103, "WinGet installer: a required file is in use"),
+    (0x8A15_0104, "WinGet installer: a dependency is missing"),
+    (0x8A15_0105, "WinGet installer: disk is full"),
+    (0x8A15_0106, "WinGet installer: memory is insufficient"),
+    (0x8A15_0107, "WinGet installer: network is unavailable"),
+    (0x8A15_0108, "WinGet installer: contact support"),
+    (0x8A15_0109, "WinGet installer: reboot required to finish installation"),
+    (0x8A15_010A, "WinGet installer: reboot required before installation"),
+    (0x8A15_010B, "WinGet installer: reboot was initiated"),
+    (0x8A15_010C, "WinGet installer: install was cancelled by the user"),
+    (0x8A15_010D, "WinGet installer: package is already installed"),
+    (0x8A15_010E, "WinGet installer: downgrade is not allowed"),
+    (0x8A15_010F, "WinGet installer: install is blocked by policy"),
+    (0x8A15_0110, "WinGet installer: dependency install failed"),
+    (
+        0x8A15_0111,
+        "WinGet installer: package is in use by another application",
+    ),
+    (0x8A15_0112, "WinGet installer: invalid installer parameter"),
+    (0x8A15_0113, "WinGet installer: system is not supported"),
+    (0x8A15_0114, "WinGet installer: upgrade is not supported"),
+    (0x8A15_0115, "WinGet installer: custom installer error"),
+    (0x8A15_0201, "WinGet installed status: uninstall entry was not found"),
+    (
+        0x0A15_0202,
+        "WinGet installed status: install location check is not applicable",
+    ),
+    (0x8A15_0203, "WinGet installed status: install location was not found"),
+    (0x8A15_0204, "WinGet installed status: file hash mismatch"),
+    (0x8A15_0205, "WinGet installed status: file was not found"),
+    (
+        0x0A15_0206,
+        "WinGet installed status: file found but hash was not checked",
+    ),
+    (0x8A15_0207, "WinGet installed status: file access failed"),
+    (0x8A15_C001, "WinGet configuration: configuration file is invalid"),
+    (0x8A15_C002, "WinGet configuration: YAML is invalid"),
+    (0x8A15_C003, "WinGet configuration: field type is invalid"),
+    (0x8A15_C004, "WinGet configuration: file version is not supported"),
+    (0x8A15_C005, "WinGet configuration: failed to apply configuration set"),
+    (0x8A15_C006, "WinGet configuration: duplicate identifier"),
+    (0x8A15_C007, "WinGet configuration: dependency is missing"),
+    (0x8A15_C008, "WinGet configuration: dependency is unsatisfied"),
+    (0x8A15_C009, "WinGet configuration: assertion failed"),
+    (
+        0x8A15_C00A,
+        "WinGet configuration: configuration unit was manually skipped",
+    ),
+    (0x8A15_C00B, "WinGet configuration: warning was not accepted"),
+    (0x8A15_C00C, "WinGet configuration: dependency cycle detected"),
+    (0x8A15_C00D, "WinGet configuration: field value is invalid"),
+    (0x8A15_C00E, "WinGet configuration: required field is missing"),
+    (0x8A15_C00F, "WinGet configuration: configuration test failed"),
+    (0x8A15_C010, "WinGet configuration: configuration test was not run"),
+    (
+        0x8A15_C011,
+        "WinGet configuration: failed to get current configuration state",
+    ),
+    (0x8A15_C012, "WinGet configuration: history item was not found"),
+    (
+        0x8A15_C013,
+        "WinGet configuration: parameter crossed an integrity boundary",
+    ),
+    (0x8A15_C101, "WinGet configuration unit: unit is not installed"),
+    (
+        0x8A15_C102,
+        "WinGet configuration unit: unit was not found in the repository",
+    ),
+    (0x8A15_C103, "WinGet configuration unit: multiple units matched"),
+    (0x8A15_C104, "WinGet configuration unit: failed to read current state"),
+    (0x8A15_C105, "WinGet configuration unit: test operation failed"),
+    (0x8A15_C106, "WinGet configuration unit: apply operation failed"),
+    (0x8A15_C107, "WinGet configuration unit: module conflict"),
+    (0x8A15_C108, "WinGet configuration unit: failed to import module"),
+    (
+        0x8A15_C109,
+        "WinGet configuration unit: operation returned an invalid result",
+    ),
+    (
+        0x8A15_C110,
+        "WinGet configuration unit: failed to set configuration root",
+    ),
+    (
+        0x8A15_C111,
+        "WinGet configuration unit: module import requires administrator privileges",
+    ),
+    (0x8A15_C112, "WinGet configuration: processor is not supported"),
+    (0x8A15_C113, "WinGet configuration: processor hash mismatch"),
+];
+
+/// Map a known WinGet or Windows Installer exit code to a short, human-readable
+/// description, if recognized.
+///
+/// WinGet returns documented `HRESULT`-style codes in the `0x8A15_xxxx` and
+/// `0x0A15_xxxx` ranges. Common MSI / Windows Installer codes are also
+/// recognized. Returns `None` for codes that are not in the known set, so callers
+/// can fall back to reporting the raw numeric code.
+#[allow(clippy::cast_sign_loss)]
+pub fn describe_exit_code(exit_code: i32) -> Option<String> {
+    let code = exit_code as u32;
+    if let Some((_, message)) = WINGET_EXIT_CODE_MESSAGES
+        .iter()
+        .find(|(known_code, _)| *known_code == code)
+    {
+        return Some((*message).to_owned());
+    }
+
+    let description = match code {
+        // MSI / Windows Installer.
+        1602 => "Windows Installer: the user cancelled the installation",
+        1603 => "Windows Installer: a fatal error occurred during installation",
+        1605 => "Windows Installer: the action is only valid for an installed product",
+        1618 => "Windows Installer: another installation is already in progress",
+        1619 => "Windows Installer: the installation package could not be opened",
+        1620 => "Windows Installer: the installation package is invalid",
+        1638 => "Windows Installer: another version of this product is already installed",
+        1641 => "Windows Installer: a reboot was initiated to complete the installation",
+        3010 => "Windows Installer: a reboot is required to complete the operation",
+        _ => return None,
+    };
+    Some(description.to_owned())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn tail_utf8_keeps_short_output_verbatim() {
+        let s = "hello world";
+        assert_eq!(tail_utf8(s.as_bytes()), s);
+    }
+
+    #[test]
+    fn tail_utf8_truncates_to_tail_with_marker() {
+        let big = vec![b'a'; MAX_CAPTURED_OUTPUT_BYTES + 5000];
+        let out = tail_utf8(&big);
+        assert!(out.starts_with("[... output truncated"));
+        // The retained tail is exactly MAX_CAPTURED_OUTPUT_BYTES of 'a's.
+        assert!(out.ends_with(&"a".repeat(MAX_CAPTURED_OUTPUT_BYTES)));
+        assert!(!out.ends_with(&"a".repeat(MAX_CAPTURED_OUTPUT_BYTES + 1)));
+    }
+
+    #[test]
+    fn tail_utf8_handles_invalid_utf8_lossily() {
+        let bytes = [0xff, 0xfe, b'h', b'i'];
+        let out = tail_utf8(&bytes);
+        assert!(out.ends_with("hi"));
+    }
+
+    #[test]
+    fn describe_exit_code_recognizes_winget_cli_error() {
+        // 0x8A150014 = APPINSTALLER_CLI_ERROR_NO_APPLICATIONS_FOUND.
+        assert_eq!(
+            describe_exit_code(signed_hresult(0x8A15_0014)).as_deref(),
+            Some("WinGet: no package matched the query")
+        );
+    }
+
+    #[test]
+    fn describe_exit_code_recognizes_signed_winget_hresult() {
+        assert_eq!(
+            describe_exit_code(-1_978_335_216).as_deref(),
+            Some("WinGet: no applicable installer found")
+        );
+    }
+
+    #[test]
+    fn describe_exit_code_recognizes_winget_installer_error() {
+        assert_eq!(
+            describe_exit_code(signed_hresult(0x8A15_0109)).as_deref(),
+            Some("WinGet installer: reboot required to finish installation")
+        );
+    }
+
+    #[test]
+    fn describe_exit_code_recognizes_winget_config_error() {
+        assert_eq!(
+            describe_exit_code(signed_hresult(0x8A15_C001)).as_deref(),
+            Some("WinGet configuration: configuration file is invalid")
+        );
+    }
+
+    #[test]
+    fn describe_exit_code_recognizes_winget_config_test_failure() {
+        assert_eq!(
+            describe_exit_code(signed_hresult(0x8A15_C00F)).as_deref(),
+            Some("WinGet configuration: configuration test failed")
+        );
+    }
+
+    #[test]
+    fn describe_exit_code_recognizes_winget_config_unit_error() {
+        assert_eq!(
+            describe_exit_code(signed_hresult(0x8A15_C104)).as_deref(),
+            Some("WinGet configuration unit: failed to read current state")
+        );
+    }
+
+    #[test]
+    fn describe_exit_code_recognizes_winget_config_processor_error() {
+        assert_eq!(
+            describe_exit_code(signed_hresult(0x8A15_C112)).as_deref(),
+            Some("WinGet configuration: processor is not supported")
+        );
+    }
+
+    #[test]
+    fn describe_exit_code_recognizes_winget_installed_status() {
+        assert_eq!(
+            describe_exit_code(signed_hresult(0x0A15_0206)).as_deref(),
+            Some("WinGet installed status: file found but hash was not checked")
+        );
+    }
+
+    #[test]
+    fn describe_exit_code_recognizes_msi_reboot_required() {
+        assert_eq!(
+            describe_exit_code(3010).as_deref(),
+            Some("Windows Installer: a reboot is required to complete the operation")
+        );
+    }
+
+    #[test]
+    fn describe_exit_code_returns_none_for_unknown() {
+        assert_eq!(describe_exit_code(1), None);
+        assert_eq!(describe_exit_code(0), None);
+    }
+
+    fn signed_hresult(code: u32) -> i32 {
+        i32::from_ne_bytes(code.to_ne_bytes())
+    }
+}
diff --git a/devolutions-agent/src/broker/scenario_tests.rs b/devolutions-agent/src/broker/scenario_tests.rs
new file mode 100644
index 000000000..e2ebab6a0
--- /dev/null
+++ b/devolutions-agent/src/broker/scenario_tests.rs
@@ -0,0 +1,131 @@
+//! High-level scenario tests using sample policies and requests.
+//!
+//! These tests keep broad end-to-end coverage for the broker policy concepts.
+//! Detailed rule matching and constraint behavior is covered by lower-level unit tests.
+
+#![allow(clippy::unwrap_used)]
+
+use std::path::{Path, PathBuf};
+
+use now_policy::PolicyDocument;
+use now_policy_api::PackageRequest;
+use serde::Deserialize;
+
+use super::evaluator;
+
+/// Local samples directory bundled inside the crate.
+fn samples_dir() -> PathBuf {
+    PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("src/broker/assets/samples")
+}
+
+// ─── Scenario file structures ────────────────────────────────────────────────
+
+#[derive(Deserialize)]
+#[serde(rename_all = "PascalCase")]
+struct ScenarioSet {
+    scenarios: Vec<Scenario>,
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "PascalCase")]
+struct Scenario {
+    id: String,
+    policy: String,
+    request: String,
+    expected_decision: String,
+    expected_rule_id: String,
+}
+
+// ─── Helper functions ────────────────────────────────────────────────────────
+
+fn load_json_file(path: &Path) -> serde_json::Value {
+    let content = std::fs::read_to_string(path).unwrap_or_else(|e| panic!("failed to read {}: {e}", path.display()));
+    serde_json::from_str(&content).unwrap_or_else(|e| panic!("failed to parse {}: {e}", path.display()))
+}
+
+fn load_policy(path: &Path) -> PolicyDocument {
+    let content = std::fs::read_to_string(path).unwrap_or_else(|e| panic!("failed to read {}: {e}", path.display()));
+    let ext = path.extension().and_then(|e| e.to_str()).unwrap_or("");
+    match ext {
+        "yaml" | "yml" => serde_yaml::from_str(&content)
+            .unwrap_or_else(|e| panic!("failed to deserialize YAML policy {}: {e}", path.display())),
+        _ => serde_json::from_str(&content)
+            .unwrap_or_else(|e| panic!("failed to deserialize policy {}: {e}", path.display())),
+    }
+}
+
+fn load_request(path: &Path) -> PackageRequest {
+    let value = load_json_file(path);
+    serde_json::from_value(value).unwrap_or_else(|e| panic!("failed to deserialize request {}: {e}", path.display()))
+}
+
+// ─── Scenario-driven evaluation tests ────────────────────────────────────────
+
+fn run_scenarios(scenario_file: &str) {
+    let dir = samples_dir();
+    let scenarios_path = dir.join("scenarios").join(scenario_file);
+    let content = std::fs::read_to_string(&scenarios_path)
+        .unwrap_or_else(|e| panic!("failed to read {}: {e}", scenarios_path.display()));
+    let scenario_set: ScenarioSet =
+        serde_json::from_str(&content).unwrap_or_else(|e| panic!("failed to parse scenarios: {e}"));
+
+    let mut failures: Vec<String> = Vec::new();
+
+    for scenario in &scenario_set.scenarios {
+        // Load policy.
+        let policy_path = dir.join(&scenario.policy);
+        let policy = match std::panic::catch_unwind(|| load_policy(&policy_path)) {
+            Ok(p) => p,
+            Err(_) => {
+                failures.push(format!("{}: failed to load policy {}", scenario.id, scenario.policy));
+                continue;
+            }
+        };
+
+        // Load request.
+        let request_path = dir.join(&scenario.request);
+        let request = match std::panic::catch_unwind(|| load_request(&request_path)) {
+            Ok(r) => r,
+            Err(_) => {
+                failures.push(format!("{}: failed to load request {}", scenario.id, scenario.request));
+                continue;
+            }
+        };
+
+        // Evaluate.
+        let decision = evaluator::evaluate(&policy, &request);
+
+        let expected_decision = match scenario.expected_decision.as_str() {
+            "Allow" => now_policy::Decision::Allow,
+            "Deny" => now_policy::Decision::Deny,
+            other => {
+                failures.push(format!("{}: unknown expectedDecision '{other}'", scenario.id));
+                continue;
+            }
+        };
+
+        if decision.decision != expected_decision {
+            failures.push(format!(
+                "{}: expected decision '{}' but got '{}' (rule: {})",
+                scenario.id, scenario.expected_decision, decision.decision, decision.rule_id
+            ));
+            continue;
+        }
+
+        if decision.rule_id != scenario.expected_rule_id {
+            failures.push(format!(
+                "{}: expected rule_id '{}' but got '{}'",
+                scenario.id, scenario.expected_rule_id, decision.rule_id
+            ));
+        }
+    }
+
+    if !failures.is_empty() {
+        panic!("{} scenario(s) failed:\n  {}", failures.len(), failures.join("\n  "));
+    }
+}
+
+#[test]
+fn core_policy_scenarios() {
+    run_scenarios("baseline.scenarios.json");
+}

From 801437367b9b50fb4632a6be89bc51a89098c836 Mon Sep 17 00:00:00 2001
From: Vladyslav Nikonov <mail@pacmancoder.xyz>
Date: Tue, 14 Jul 2026 17:38:12 +0300
Subject: [PATCH 3/4] feat(agent): wire package broker service

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 Cargo.lock                                    | 190 +++++-
 devolutions-agent/Cargo.toml                  |  13 +
 devolutions-agent/src/broker/auth.rs          | 185 ++++++
 devolutions-agent/src/broker/executor/mod.rs  |  86 +++
 .../src/broker/executor/windows/mod.rs        | 590 ++++++++++++++++++
 .../src/broker/executor/windows/process.rs    | 218 +++++++
 .../src/broker/executor/windows/token.rs      |  81 +++
 devolutions-agent/src/broker/mod.rs           |  18 +
 .../src/broker/operation_tracker.rs           | 177 ++++++
 devolutions-agent/src/broker/pipe.rs          | 149 +++++
 devolutions-agent/src/broker/policy_loader.rs |  85 +++
 .../src/broker/policy_watcher.rs              | 135 ++++
 .../src/broker/server/connection.rs           |  31 +
 .../src/broker/server/execution.rs            |  61 ++
 devolutions-agent/src/broker/server/mod.rs    | 305 +++++++++
 .../src/broker/server/responses.rs            | 148 +++++
 devolutions-agent/src/broker/task.rs          | 161 +++++
 devolutions-agent/src/code_signing.rs         | 103 +++
 devolutions-agent/src/config.rs               |  38 ++
 devolutions-agent/src/lib.rs                  |   4 +
 devolutions-agent/src/service.rs              |  17 +
 devolutions-agent/src/updater/package.rs      |  40 +-
 22 files changed, 2792 insertions(+), 43 deletions(-)
 create mode 100644 devolutions-agent/src/broker/auth.rs
 create mode 100644 devolutions-agent/src/broker/executor/mod.rs
 create mode 100644 devolutions-agent/src/broker/executor/windows/mod.rs
 create mode 100644 devolutions-agent/src/broker/executor/windows/process.rs
 create mode 100644 devolutions-agent/src/broker/executor/windows/token.rs
 create mode 100644 devolutions-agent/src/broker/mod.rs
 create mode 100644 devolutions-agent/src/broker/operation_tracker.rs
 create mode 100644 devolutions-agent/src/broker/pipe.rs
 create mode 100644 devolutions-agent/src/broker/policy_loader.rs
 create mode 100644 devolutions-agent/src/broker/policy_watcher.rs
 create mode 100644 devolutions-agent/src/broker/server/connection.rs
 create mode 100644 devolutions-agent/src/broker/server/execution.rs
 create mode 100644 devolutions-agent/src/broker/server/mod.rs
 create mode 100644 devolutions-agent/src/broker/server/responses.rs
 create mode 100644 devolutions-agent/src/broker/task.rs
 create mode 100644 devolutions-agent/src/code_signing.rs

diff --git a/Cargo.lock b/Cargo.lock
index 35503c1d0..b1a309844 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1191,6 +1191,15 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2f421161cb492475f1661ddc9815a745a1c894592070661180fdec3d4872e9c3"
 
+[[package]]
+name = "convert_case"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "633458d4ef8c78b72454de2d54fd6ab2e60f9e02be22f3c6104cdc8a4e0fceb9"
+dependencies = [
+ "unicode-segmentation",
+]
+
 [[package]]
 name = "core-foundation"
 version = "0.9.4"
@@ -1600,6 +1609,29 @@ dependencies = [
  "syn 1.0.109",
 ]
 
+[[package]]
+name = "derive_more"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d751e9e49156b02b44f9c1815bcb94b984cdcc4396ecc32521c739452808b134"
+dependencies = [
+ "derive_more-impl",
+]
+
+[[package]]
+name = "derive_more-impl"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "799a97264921d8623a957f6c3b9011f3b5492f557bbb7a5a19b7fa6d06ba8dcb"
+dependencies = [
+ "convert_case",
+ "proc-macro2 1.0.106",
+ "quote 1.0.46",
+ "rustc_version",
+ "syn 2.0.118",
+ "unicode-xid 0.2.6",
+]
+
 [[package]]
 name = "des"
 version = "0.9.0"
@@ -1617,11 +1649,13 @@ dependencies = [
  "anyhow",
  "async-trait",
  "aws-lc-rs",
+ "axum 0.8.9",
  "backoff",
  "base64 0.22.1",
  "bytes 1.12.1",
  "camino",
  "ceviche",
+ "chrono",
  "ctrlc",
  "devolutions-agent-shared",
  "devolutions-gateway-task",
@@ -1633,9 +1667,15 @@ dependencies = [
  "hex",
  "hostname 0.4.2",
  "http-client-proxy",
+ "hyper 1.10.1",
+ "hyper-util",
  "ipnetwork",
  "ironrdp",
+ "notify 7.0.0",
  "notify-debouncer-mini",
+ "now-policy",
+ "now-policy-api",
+ "now-policy-server-template",
  "parking_lot",
  "prost 0.13.5",
  "prost-types",
@@ -1643,12 +1683,14 @@ dependencies = [
  "quinn",
  "rand 0.8.7",
  "rcgen",
+ "regex",
  "reqwest",
  "rustls 0.23.42",
  "rustls-pemfile 2.2.0",
  "rustls-pki-types",
  "serde",
  "serde_json",
+ "serde_yaml",
  "sha2 0.10.9",
  "tap",
  "tempfile",
@@ -1659,6 +1701,7 @@ dependencies = [
  "tokio-stream",
  "tonic 0.12.3",
  "tonic-build",
+ "tower-service",
  "tracing",
  "url",
  "uuid",
@@ -1675,7 +1718,9 @@ dependencies = [
  "cfg-if",
  "serde",
  "serde_json",
+ "tempfile",
  "thiserror 2.0.18",
+ "tracing",
  "uuid",
  "windows-registry 0.5.3",
  "windows-result 0.3.4",
@@ -1943,7 +1988,6 @@ dependencies = [
  "serde",
  "serde_json",
  "tap",
- "tempfile",
  "thiserror 2.0.18",
  "tokio 1.52.3",
  "tracing",
@@ -2313,6 +2357,16 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "64cd1e32ddd350061ae6edb1b082d7c54915b5c672c389143b9a63403a109f24"
 
+[[package]]
+name = "filetime"
+version = "0.2.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c287a33c7f0a620c38e641e7f60827713987b3c0f26e8ddc9462cc69cf75759"
+dependencies = [
+ "cfg-if",
+ "libc",
+]
+
 [[package]]
 name = "find-msvc-tools"
 version = "0.1.9"
@@ -3217,6 +3271,17 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "inotify"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fdd168d97690d0b8c412d6b6c10360277f4d7ee495c5d0d5d5fe0854923255cc"
+dependencies = [
+ "bitflags 1.3.2",
+ "inotify-sys",
+ "libc",
+]
+
 [[package]]
 name = "inotify"
 version = "0.11.4"
@@ -4576,6 +4641,24 @@ version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9737e026353e5cd0736f98eddae28665118eb6f6600902a7f50db585621fecb6"
 
+[[package]]
+name = "notify"
+version = "7.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c533b4c39709f9ba5005d8002048266593c1cfaf3c5f0739d5b8ab0c6c504009"
+dependencies = [
+ "bitflags 2.13.0",
+ "filetime",
+ "inotify 0.10.2",
+ "kqueue",
+ "libc",
+ "log",
+ "mio",
+ "notify-types 1.0.1",
+ "walkdir",
+ "windows-sys 0.52.0",
+]
+
 [[package]]
 name = "notify"
 version = "8.2.0"
@@ -4584,12 +4667,12 @@ checksum = "4d3d07927151ff8575b7087f245456e549fea62edf0ec4e565a5ee50c8402bc3"
 dependencies = [
  "bitflags 2.13.0",
  "fsevent-sys",
- "inotify",
+ "inotify 0.11.4",
  "kqueue",
  "libc",
  "log",
  "mio",
- "notify-types",
+ "notify-types 2.1.0",
  "walkdir",
  "windows-sys 0.60.2",
 ]
@@ -4601,11 +4684,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a689eb4262184d9a1727f9087cd03883ea716682ab03ed24efec57d7716dccb8"
 dependencies = [
  "log",
- "notify",
- "notify-types",
+ "notify 8.2.0",
+ "notify-types 2.1.0",
  "tempfile",
 ]
 
+[[package]]
+name = "notify-types"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "585d3cb5e12e01aed9e8a1f70d5c6b5e86fe2a6e48fc8cd0b3e0b8df6f6eb174"
+dependencies = [
+ "instant",
+]
+
 [[package]]
 name = "notify-types"
 version = "2.1.0"
@@ -4615,6 +4707,57 @@ dependencies = [
  "bitflags 2.13.0",
 ]
 
+[[package]]
+name = "now-policy"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d87d7ba63d8fcbbae125f975c5e30a54ed4507027dd70d6daa0aa63003cac2e"
+dependencies = [
+ "chrono",
+ "schemars",
+ "semver",
+ "serde",
+ "serde_json",
+ "serde_yaml",
+ "thiserror 2.0.18",
+ "url",
+]
+
+[[package]]
+name = "now-policy-api"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b3837290f7ed48038a8ca4d9dfb98a0c44a5debe141cdd7d740d59eca4df4fa5"
+dependencies = [
+ "base64 0.22.1",
+ "chrono",
+ "derive_more",
+ "now-policy",
+ "schemars",
+ "semver",
+ "serde",
+ "serde_json",
+ "strum",
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "now-policy-server-template"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92afa468bf18b66af5d209caac39fcff241b07495c538d032221736e8a7f95c6"
+dependencies = [
+ "aide",
+ "async-trait",
+ "axum 0.8.9",
+ "now-policy",
+ "now-policy-api",
+ "schemars",
+ "serde",
+ "serde_json",
+ "serde_yaml",
+]
+
 [[package]]
 name = "now-proto-pdu"
 version = "0.4.3"
@@ -5530,7 +5673,7 @@ version = "0.4.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf3d2011ab5c909338f7887f4fc896d35932e29146c12c8d01da6b22a80ba759"
 dependencies = [
- "unicode-xid",
+ "unicode-xid 0.1.0",
 ]
 
 [[package]]
@@ -7080,6 +7223,27 @@ dependencies = [
  "unicode-properties",
 ]
 
+[[package]]
+name = "strum"
+version = "0.27.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af23d6f6c1a224baef9d3f61e287d2761385a5b88fdab4eb4c6f11aeb54c4bcf"
+dependencies = [
+ "strum_macros",
+]
+
+[[package]]
+name = "strum_macros"
+version = "0.27.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7695ce3845ea4b33927c055a39dc438a45b059f7c1b3d91d38d10355fb8cbca7"
+dependencies = [
+ "heck",
+ "proc-macro2 1.0.106",
+ "quote 1.0.46",
+ "syn 2.0.118",
+]
+
 [[package]]
 name = "subtle"
 version = "2.6.1"
@@ -7094,7 +7258,7 @@ checksum = "9ca4b3b69a77cbe1ffc9e198781b7acb0c7365a883670e8f1c1bc66fba79a5c5"
 dependencies = [
  "proc-macro2 0.4.30",
  "quote 0.6.13",
- "unicode-xid",
+ "unicode-xid 0.1.0",
 ]
 
 [[package]]
@@ -8248,12 +8412,24 @@ version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
 
+[[package]]
+name = "unicode-segmentation"
+version = "1.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
+
 [[package]]
 name = "unicode-xid"
 version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc72304796d0818e357ead4e000d19c9c174ab23dc11093ac919054d20a6a7fc"
 
+[[package]]
+name = "unicode-xid"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
+
 [[package]]
 name = "universal-hash"
 version = "0.5.1"
diff --git a/devolutions-agent/Cargo.toml b/devolutions-agent/Cargo.toml
index 8fc97cd93..727a12009 100644
--- a/devolutions-agent/Cargo.toml
+++ b/devolutions-agent/Cargo.toml
@@ -16,10 +16,12 @@ agent-tunnel-proto = { path = "../crates/agent-tunnel-proto" }
 anyhow = "1"
 backoff = "0.4"
 async-trait = "0.1"
+axum = { version = "0.8", default-features = false, features = ["http1", "json", "tokio", "original-uri", "matched-path"] }
 base64 = "0.22"
 bytes = "1"
 camino = { version = "1.1", features = ["serde1"] }
 ceviche = "0.7"
+chrono = { version = "0.4", features = ["serde"] }
 ctrlc = "3.5"
 devolutions-agent-shared = { path = "../crates/devolutions-agent-shared" }
 devolutions-gateway-task = { path = "../crates/devolutions-gateway-task" }
@@ -27,14 +29,21 @@ devolutions-log = { path = "../crates/devolutions-log" }
 futures = "0.3"
 hex = "0.4"
 hostname = "0.4"
+hyper = { version = "1", features = ["http1", "server"] }
+hyper-util = { version = "0.1", features = ["tokio", "server", "server-auto", "service"] }
 http-client-proxy = { path = "../crates/http-client-proxy" }
 ipnetwork = "0.20"
+notify = { version = "7", default-features = false, features = ["macos_kqueue"] }
+now-policy = "0.1"
+now-policy-api = { version = "0.1", features = ["policy-compat"] }
+now-policy-server-template = { version = "0.1", features = ["policy-compat"] }
 parking_lot = "0.12"
 prost = "0.13"
 prost-types = "0.13"
 quinn = "0.11"
 rand = "0.8" # FIXME(@CBenoit): maybe we don't need this crate
 rcgen = { version = "0.13", features = ["pem"] }
+regex = "1"
 reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-native-roots", "http2", "socks", "json"] }
 rustls = { version = "0.23", default-features = false, features = ["std", "ring"] }
 rustls-pemfile = "2.2"
@@ -42,11 +51,13 @@ rustls-pki-types = "1"
 sha2 = "0.10"
 serde_json = "1"
 serde = { version = "1", features = ["derive"] }
+serde_yaml = "0.9"
 tap = "1.0"
 tempfile = "3"
 tokio-rustls = { version = "0.26", default-features = false, features = ["logging", "tls12", "ring"] }
 tokio-stream = "0.1"
 tonic = { version = "0.12", features = ["transport"] }
+tower-service = "0.3"
 tracing = "0.1"
 url = { version = "2.5", features = ["serde"] }
 x509-parser = "0.16"
@@ -73,6 +84,7 @@ features = [
     "fs",
     "process",
     "sync",
+    "time",
 ]
 
 [target.'cfg(windows)'.dependencies]
@@ -96,6 +108,7 @@ features = [
     "Win32_Security_Cryptography",
     "Win32_Security_Authorization",
     "Win32_System_ApplicationInstallationAndServicing",
+    "Win32_System_Pipes",
     "Win32_System_RemoteDesktop",
 ]
 
diff --git a/devolutions-agent/src/broker/auth.rs b/devolutions-agent/src/broker/auth.rs
new file mode 100644
index 000000000..cd8acacb3
--- /dev/null
+++ b/devolutions-agent/src/broker/auth.rs
@@ -0,0 +1,185 @@
+//! Package broker pipe client authentication.
+
+use std::path::{Path, PathBuf};
+
+use anyhow::{Context as _, bail};
+use now_policy_api::PackageRequest;
+use tokio::net::windows::named_pipe::NamedPipeServer;
+use tracing::{debug, warn};
+use win_api_wrappers::process::Process;
+use windows::Win32::Security::TOKEN_QUERY;
+use windows::Win32::System::Threading::PROCESS_QUERY_LIMITED_INFORMATION;
+
+use crate::code_signing::validate_devolutions_authenticode_signature;
+
+#[derive(Clone, Debug)]
+pub(crate) struct PipeClient {
+    process_id: u32,
+    executable_path: PathBuf,
+    user: ClientUser,
+}
+
+#[derive(Clone, Debug)]
+struct ClientUser {
+    domain: String,
+    name: String,
+}
+
+impl PipeClient {
+    pub(crate) fn from_connected_pipe(server: &NamedPipeServer) -> anyhow::Result<Self> {
+        let process_id = connected_pipe_client_process_id(server).context("failed to query pipe client process id")?;
+        let process = Process::get_by_pid(process_id, PROCESS_QUERY_LIMITED_INFORMATION)
+            .with_context(|| format!("failed to open pipe client process {process_id}"))?;
+        let executable_path = process
+            .exe_path()
+            .with_context(|| format!("failed to query pipe client process {process_id} executable path"))?;
+        let sid = process
+            .token(TOKEN_QUERY)
+            .with_context(|| format!("failed to open pipe client process {process_id} token"))?
+            .sid_and_attributes()
+            .with_context(|| format!("failed to query pipe client process {process_id} token user"))?
+            .sid;
+        let account = sid
+            .lookup_account(None)
+            .with_context(|| format!("failed to resolve pipe client process {process_id} user"))?;
+        let user = ClientUser {
+            domain: account.domain_name.to_string_lossy(),
+            name: account.name.to_string_lossy(),
+        };
+
+        Ok(Self {
+            process_id,
+            executable_path,
+            user,
+        })
+    }
+
+    pub(crate) fn validate_request(
+        &self,
+        request: &PackageRequest,
+        skip_signature_validation: bool,
+    ) -> anyhow::Result<()> {
+        self.validate_effective_user(&request.client.effective_user)?;
+        self.validate_executable_path(&request.client.client_executable_path)?;
+
+        if skip_signature_validation {
+            warn!("DEBUG MODE: Skipping package broker client signature validation");
+            return Ok(());
+        }
+
+        let thumbprint = validate_devolutions_authenticode_signature(&self.executable_path)?;
+
+        debug!(
+            process_id = self.process_id,
+            executable = %self.executable_path.display(),
+            certificate_thumbprint = %thumbprint,
+            "Package broker pipe client authenticated"
+        );
+
+        Ok(())
+    }
+
+    fn validate_effective_user(&self, effective_user: &str) -> anyhow::Result<()> {
+        if same_user(effective_user, &self.user) {
+            return Ok(());
+        }
+
+        bail!(
+            "pipe client user '{}\\{}' does not match request effective_user '{}'",
+            self.user.domain,
+            self.user.name,
+            effective_user
+        )
+    }
+
+    fn validate_executable_path(&self, requested_executable_path: &str) -> anyhow::Result<()> {
+        let requested_path = Path::new(requested_executable_path);
+        if !requested_path.is_absolute() {
+            bail!("request client executable path is not absolute");
+        }
+
+        let actual_path = canonicalize_for_comparison(&self.executable_path).with_context(|| {
+            format!(
+                "failed to canonicalize pipe client executable path '{}'",
+                self.executable_path.display()
+            )
+        })?;
+        let requested_path = canonicalize_for_comparison(requested_path).with_context(|| {
+            format!(
+                "failed to canonicalize request client executable path '{}'",
+                requested_executable_path
+            )
+        })?;
+
+        if same_windows_path(&actual_path, &requested_path) {
+            return Ok(());
+        }
+
+        bail!(
+            "pipe client executable '{}' does not match request client executable '{}'",
+            actual_path.display(),
+            requested_path.display()
+        )
+    }
+}
+
+fn connected_pipe_client_process_id(server: &NamedPipeServer) -> anyhow::Result<u32> {
+    use std::os::windows::io::AsRawHandle as _;
+
+    use windows::Win32::Foundation::HANDLE;
+    use windows::Win32::System::Pipes::GetNamedPipeClientProcessId;
+
+    let mut process_id = 0u32;
+    let handle = HANDLE(server.as_raw_handle());
+
+    // SAFETY: `server` is a connected named-pipe server instance and the process id
+    // output pointer is valid for the duration of the call.
+    unsafe { GetNamedPipeClientProcessId(handle, &mut process_id) }?;
+
+    Ok(process_id)
+}
+
+fn same_user(expected: &str, actual: &ClientUser) -> bool {
+    let Some((expected_domain, expected_name)) = expected.rsplit_once('\\') else {
+        return expected.eq_ignore_ascii_case(&actual.name);
+    };
+
+    expected_domain.eq_ignore_ascii_case(&actual.domain) && expected_name.eq_ignore_ascii_case(&actual.name)
+}
+
+fn canonicalize_for_comparison(path: &Path) -> anyhow::Result<PathBuf> {
+    Ok(std::fs::canonicalize(path)?)
+}
+
+fn same_windows_path(left: &Path, right: &Path) -> bool {
+    left.as_os_str()
+        .to_string_lossy()
+        .eq_ignore_ascii_case(&right.as_os_str().to_string_lossy())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn client_user() -> ClientUser {
+        ClientUser {
+            domain: "CONTOSO".to_owned(),
+            name: "alice".to_owned(),
+        }
+    }
+
+    #[test]
+    fn same_user_matches_domain_qualified_user() {
+        assert!(same_user("contoso\\ALICE", &client_user()));
+    }
+
+    #[test]
+    fn same_user_matches_unqualified_user() {
+        assert!(same_user("ALICE", &client_user()));
+    }
+
+    #[test]
+    fn same_user_rejects_wrong_domain() {
+        assert!(!same_user("FABRIKAM\\alice", &client_user()));
+    }
+}
diff --git a/devolutions-agent/src/broker/executor/mod.rs b/devolutions-agent/src/broker/executor/mod.rs
new file mode 100644
index 000000000..9f6fe9b2c
--- /dev/null
+++ b/devolutions-agent/src/broker/executor/mod.rs
@@ -0,0 +1,86 @@
+//! Command execution module.
+//!
+//! Handles running commands under the specified user identity.
+
+use async_trait::async_trait;
+use now_policy_api::{Elevation, Scope};
+use tracing::info;
+
+mod output;
+
+#[cfg(windows)]
+mod windows;
+
+pub use output::{ExecutionOutput, MAX_CAPTURED_OUTPUT_BYTES, describe_exit_code, tail_utf8};
+#[cfg(windows)]
+pub use windows::WindowsExecutor;
+
+/// Execution context passed from the server to the executor.
+///
+/// Describes the full ordered plan the broker runs on the user's behalf:
+/// process kills, an optional pre-operation shell command, the main
+/// package-manager command, and an optional post-operation shell command.
+#[derive(Debug, Clone)]
+pub struct ExecutionContext {
+    /// Process image names to terminate before the operation (best-effort).
+    pub kill_processes: Vec<String>,
+    /// Optional shell command to run before the main command (`cmd.exe /S /C`).
+    pub pre_command: Option<String>,
+    /// The main package-manager command line as separate arguments (exe + args).
+    pub command: Vec<String>,
+    /// Optional shell command to run after the main command (`cmd.exe /S /C`).
+    pub post_command: Option<String>,
+    /// Windows identity of the target user (e.g., `DOMAIN\username`).
+    pub effective_user: String,
+    /// Requested elevation level.
+    pub elevation: Elevation,
+    /// Installation scope (machine scope requires elevation).
+    pub scope: Option<Scope>,
+    /// When true, capture the main command's combined stdout+stderr.
+    pub capture_output: bool,
+}
+
+/// Trait for command execution strategies.
+#[async_trait]
+pub trait CommandExecutor: Send + Sync {
+    /// Execute a command under the given context.
+    ///
+    /// Returns the main command's exit code and captured output on success.
+    /// The method blocks (async) until the spawned process exits or a fatal error occurs during launch.
+    async fn execute(&self, ctx: &ExecutionContext) -> anyhow::Result<ExecutionOutput>;
+}
+
+/// Dry-run executor that only logs commands without running them.
+pub struct DryRunExecutor;
+
+#[async_trait]
+impl CommandExecutor for DryRunExecutor {
+    async fn execute(&self, ctx: &ExecutionContext) -> anyhow::Result<ExecutionOutput> {
+        info!(
+            effective_user = %ctx.effective_user,
+            kill_processes = ?ctx.kill_processes,
+            pre_command = ?ctx.pre_command,
+            command = %ctx.command.join(" "),
+            post_command = ?ctx.post_command,
+            elevation = %ctx.elevation,
+            "Dry-run: would execute plan"
+        );
+        Ok(ExecutionOutput::default())
+    }
+}
+
+/// Create the appropriate command executor for the current platform.
+///
+/// On Windows, returns a `WindowsExecutor` that uses raw Win32 APIs.
+/// On other platforms, returns a `DryRunExecutor` since named pipes
+/// and WinGet are not available.
+pub fn create_platform_executor() -> Box<dyn CommandExecutor> {
+    #[cfg(windows)]
+    {
+        Box::new(WindowsExecutor::new())
+    }
+    #[cfg(not(windows))]
+    {
+        Box::new(DryRunExecutor)
+    }
+}
diff --git a/devolutions-agent/src/broker/executor/windows/mod.rs b/devolutions-agent/src/broker/executor/windows/mod.rs
new file mode 100644
index 000000000..437b26dbf
--- /dev/null
+++ b/devolutions-agent/src/broker/executor/windows/mod.rs
@@ -0,0 +1,590 @@
+//! Windows command executor.
+//!
+//! Uses a unified `CreateProcessAsUserW` code path for both SYSTEM (service) and
+//! current-user (development) modes.
+
+use std::path::{Path, PathBuf};
+
+use anyhow::{Context as _, bail};
+use async_trait::async_trait;
+use devolutions_agent_shared::temp_file::{BATCH_UTF8_PREAMBLE, POWERSHELL_UTF8_ENCODING_PREAMBLE, TmpFileGuard};
+use now_policy_api::{Elevation, Scope};
+use tracing::{debug, info, warn};
+use win_api_wrappers::process::Process;
+use win_api_wrappers::security::privilege::{self, ScopedPrivileges};
+use win_api_wrappers::token::Token;
+use win_api_wrappers::utils;
+use windows::Win32::Security::{TOKEN_ADJUST_PRIVILEGES, TOKEN_ALL_ACCESS, TOKEN_QUERY};
+
+use super::{CommandExecutor, ExecutionContext, ExecutionOutput};
+
+mod process;
+mod token;
+
+use process::create_process;
+use token::{detect_running_as_system, find_user_session, get_elevated_token};
+
+/// Windows command executor using `win-api-wrappers` safe abstractions.
+///
+/// Detects whether it runs as SYSTEM (service mode) or as a normal user (dev mode).
+/// Both modes use a unified `create_process_as_user` code path.
+pub struct WindowsExecutor {
+    is_system: bool,
+}
+
+impl Default for WindowsExecutor {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl WindowsExecutor {
+    pub fn new() -> Self {
+        let is_system = detect_running_as_system();
+        if is_system {
+            info!("Executor initialized in SYSTEM (service) mode");
+        } else {
+            info!("Executor initialized in user (development) mode");
+        }
+        Self { is_system }
+    }
+}
+
+#[async_trait]
+impl CommandExecutor for WindowsExecutor {
+    async fn execute(&self, ctx: &ExecutionContext) -> anyhow::Result<ExecutionOutput> {
+        let requires_elevation = ctx.elevation == Elevation::Elevated || ctx.scope == Some(Scope::Machine);
+
+        if !self.is_system && requires_elevation {
+            bail!(
+                "elevated execution requested but broker is not running as SYSTEM; \
+                 elevation is only supported in service mode"
+            );
+        }
+
+        let is_system = self.is_system;
+        let ctx = ctx.clone();
+
+        // All Win32 calls are blocking — run in a blocking thread.
+        tokio::task::spawn_blocking(move || {
+            if is_system {
+                execute_as_system(&ctx)
+            } else {
+                execute_as_current_user(&ctx)
+            }
+        })
+        .await
+        .context("blocking task panicked")?
+    }
+}
+
+/// Execute a command in the context of the target user's session (SYSTEM mode).
+///
+/// Steps:
+/// 1. Find the user's active session via WTS enumeration.
+/// 2. Get the session token.
+/// 3. If elevated execution is requested, obtain the linked elevated token.
+/// 4. Set the token session ID and create the process.
+/// 5. Wait for the process to exit and return the exit code.
+fn execute_as_system(ctx: &ExecutionContext) -> anyhow::Result<ExecutionOutput> {
+    let requires_elevation = ctx.elevation == Elevation::Elevated || ctx.scope == Some(Scope::Machine);
+
+    info!(
+        effective_user = %ctx.effective_user,
+        command = %ctx.command.join(" "),
+        requires_elevation,
+        "Starting SYSTEM-mode execution"
+    );
+
+    // Enable privileges required by CreateProcessAsUserW when running as SYSTEM.
+    // These are held by SYSTEM but not enabled by default.
+    let mut process_token = Process::current_process()
+        .token(TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY)
+        .context("failed to open process token for privilege adjustment")?;
+
+    debug!("Enabling SeTcb privilege");
+    let mut _priv_tcb =
+        ScopedPrivileges::enter(&mut process_token, &[privilege::SE_TCB_NAME]).context("failed to enable SeTcb")?;
+
+    debug!("Enabling SeAssignPrimaryToken privilege");
+    let mut _priv_primary = ScopedPrivileges::enter(_priv_tcb.token_mut(), &[privilege::SE_ASSIGNPRIMARYTOKEN_NAME])
+        .context("failed to enable SeAssignPrimaryToken")?;
+
+    debug!("Enabling SeIncreaseQuota privilege");
+    let _priv_quota = ScopedPrivileges::enter(_priv_primary.token_mut(), &[privilege::SE_INCREASE_QUOTA_NAME])
+        .context("failed to enable SeIncreaseQuota")?;
+
+    debug!("All privileges enabled, finding user session");
+
+    let session_id = find_user_session(&ctx.effective_user).context("failed to find active session for user")?;
+
+    info!(
+        effective_user = %ctx.effective_user,
+        session_id,
+        "Found user session"
+    );
+
+    debug!(session_id, "Calling Token::for_session");
+    let user_token = Token::for_session(session_id).context("failed to obtain user token for session")?;
+
+    debug!("Duplicating user token as primary");
+    let primary_token = token::duplicate_as_primary(&user_token).context("failed to duplicate token as primary")?;
+
+    let mut execution_token = if requires_elevation {
+        debug!("Attempting to get elevated token");
+        match get_elevated_token(&primary_token) {
+            Ok(elevated) => {
+                info!("Using elevated (linked) token");
+                elevated
+            }
+            Err(error) => {
+                warn!(%error, "Could not obtain elevated token, using primary");
+                primary_token
+            }
+        }
+    } else {
+        debug!("Using non-elevated primary token");
+        primary_token
+    };
+
+    // Assign the target session to the token before process creation.
+    debug!(session_id, "Setting token session ID");
+    execution_token
+        .set_session_id(session_id)
+        .context("failed to set token session ID")?;
+
+    info!(
+        command = %ctx.command.join(" "),
+        session_id,
+        "Running execution plan"
+    );
+
+    let output = run_plan(&execution_token, ctx, session_id)?;
+
+    info!(
+        effective_user = %ctx.effective_user,
+        command = %ctx.command.join(" "),
+        exit_code = output.exit_code,
+        "Plan completed under user token"
+    );
+
+    Ok(output)
+}
+
+/// Execute a command as the current user (development mode).
+///
+/// Opens the current process token and uses the same `create_process_as_user`
+/// code path as SYSTEM mode, ensuring consistent behavior (environment, desktop, flags).
+fn execute_as_current_user(ctx: &ExecutionContext) -> anyhow::Result<ExecutionOutput> {
+    info!(
+        effective_user = %ctx.effective_user,
+        command = %ctx.command.join(" "),
+        "Executing command as current user (dev mode)"
+    );
+
+    let token = Process::current_process()
+        .token(TOKEN_ALL_ACCESS)
+        .context("failed to open current process token")?;
+
+    let session_id = token.session_id().context("failed to query token session ID")?;
+
+    let output = run_plan(&token, ctx, session_id)?;
+
+    info!(
+        command = %ctx.command.join(" "),
+        exit_code = output.exit_code,
+        "Plan completed under current user token"
+    );
+
+    Ok(output)
+}
+
+/// Run the full execution plan under `token`: best-effort process kills, an
+/// optional pre-operation command (must succeed), the main package-manager
+/// command, then an optional post-operation command (failures are logged).
+///
+/// Returns the exit code and captured output of the main command.
+fn run_plan(token: &Token, ctx: &ExecutionContext, session_id: u32) -> anyhow::Result<ExecutionOutput> {
+    // 1. Kill requested processes (best-effort; a missing process is not an error).
+    for process_name in &ctx.kill_processes {
+        let kill_cmd = vec![
+            "taskkill.exe".to_owned(),
+            "/F".to_owned(),
+            "/IM".to_owned(),
+            process_name.clone(),
+        ];
+        match create_process(token, &kill_cmd, session_id, false) {
+            Ok(out) => info!(%process_name, exit_code = out.exit_code, "Kill-before-operation completed"),
+            Err(error) => warn!(%process_name, %error, "Kill-before-operation failed (ignored)"),
+        }
+    }
+
+    // 2. Pre-operation command — must succeed before the main operation runs.
+    if let Some(pre) = &ctx.pre_command {
+        info!(command = %pre, "Running pre-operation command");
+        let command = prepare_shell_command(token, pre)?;
+        let out = create_process(token, command.args(), session_id, ctx.capture_output)
+            .context("failed to run pre-operation command")?;
+        if out.exit_code != 0 {
+            bail!(
+                "pre-operation command exited with code {}: {}",
+                out.exit_code,
+                out.stdout.trim()
+            );
+        }
+    }
+
+    // 3. Main package-manager command.
+    let command = prepare_main_command(token, &ctx.command)?;
+    let output = create_process(token, command.args(), session_id, ctx.capture_output)?;
+
+    // 4. Post-operation command — runs after the main command; failures are logged only.
+    if let Some(post) = &ctx.post_command {
+        info!(command = %post, "Running post-operation command");
+        let command = prepare_shell_command(token, post)?;
+        match create_process(token, command.args(), session_id, false) {
+            Ok(out) if out.exit_code == 0 => {}
+            Ok(out) => warn!(exit_code = out.exit_code, "Post-operation command exited non-zero"),
+            Err(error) => warn!(%error, "Post-operation command failed"),
+        }
+    }
+
+    Ok(output)
+}
+
+fn prepare_main_command(token: &Token, command: &[String]) -> anyhow::Result<PreparedCommand> {
+    let temp_dir = user_temp_dir(token);
+    prepare_main_command_in(command, temp_dir.as_deref())
+}
+
+fn prepare_main_command_in(command: &[String], temp_dir: Option<&Path>) -> anyhow::Result<PreparedCommand> {
+    if let Some(script) = powershell_inline_script(command) {
+        return prepare_powershell_script(command, script, temp_dir);
+    }
+
+    if executable_is(command, "winget.exe") {
+        return prepare_winget_script(command, temp_dir);
+    }
+
+    Ok(PreparedCommand::raw(command))
+}
+
+fn prepare_shell_command(token: &Token, payload: &str) -> anyhow::Result<PreparedCommand> {
+    let temp_dir = user_temp_dir(token);
+    prepare_shell_command_in(payload, temp_dir.as_deref())
+}
+
+/// Build a `cmd.exe` invocation for a client-supplied shell payload using a temporary batch file.
+///
+/// The code page is switched to UTF-8 so captured output can be decoded consistently.
+fn prepare_shell_command_in(payload: &str, temp_dir: Option<&Path>) -> anyhow::Result<PreparedCommand> {
+    let script = format!("{BATCH_UTF8_PREAMBLE}\r\n{payload}");
+    let temp_script = broker_temp_script("bat", temp_dir)?;
+    temp_script.write_content(&script).with_context(|| {
+        format!(
+            "failed to write broker temporary script at {}",
+            temp_script.path().display()
+        )
+    })?;
+
+    let command = vec![
+        "cmd.exe".to_owned(),
+        "/D".to_owned(),
+        "/V:OFF".to_owned(),
+        "/Q".to_owned(),
+        "/C".to_owned(),
+        temp_script.path_string(),
+    ];
+
+    Ok(PreparedCommand::with_script(command, temp_script))
+}
+
+fn prepare_powershell_script(
+    command: &[String],
+    script: &str,
+    temp_dir: Option<&Path>,
+) -> anyhow::Result<PreparedCommand> {
+    command.first().context("empty PowerShell command")?;
+    let is_windows_powershell = executable_is(command, "powershell.exe");
+    let script = powershell_script_with_utf8_preamble(script);
+    let temp_script = broker_temp_script("ps1", temp_dir)?;
+    if is_windows_powershell {
+        temp_script.write_content_utf8_bom(&script).with_context(|| {
+            format!(
+                "failed to write broker temporary script at {}",
+                temp_script.path().display()
+            )
+        })?;
+    } else {
+        temp_script.write_content(&script).with_context(|| {
+            format!(
+                "failed to write broker temporary script at {}",
+                temp_script.path().display()
+            )
+        })?;
+    }
+
+    let mut prepared = command[..2].to_vec();
+    prepared.push("-Command".to_owned());
+    prepared.push(format!("& {}", quote_powershell_literal(&temp_script.path_string())));
+
+    Ok(PreparedCommand::with_script(prepared, temp_script))
+}
+
+fn powershell_script_with_utf8_preamble(script: &str) -> String {
+    format!("{POWERSHELL_UTF8_ENCODING_PREAMBLE}\r\n{script}")
+}
+
+fn prepare_winget_script(command: &[String], temp_dir: Option<&Path>) -> anyhow::Result<PreparedCommand> {
+    let mut script = String::new();
+    script.push_str("@echo off\r\n");
+    script.push_str(BATCH_UTF8_PREAMBLE);
+    script.push_str("\r\nset \"NO_COLOR=1\"\r\n");
+
+    let (executable, args) = command.split_first().context("empty WinGet command")?;
+    append_batch_argument(&mut script, executable)?;
+    for arg in args {
+        script.push(' ');
+        append_batch_argument(&mut script, arg)?;
+    }
+    script.push_str("\r\nexit /b %ERRORLEVEL%\r\n");
+
+    let temp_script = broker_temp_script("bat", temp_dir)?;
+    temp_script.write_content(&script).with_context(|| {
+        format!(
+            "failed to write broker temporary script at {}",
+            temp_script.path().display()
+        )
+    })?;
+
+    let prepared = vec![
+        "cmd.exe".to_owned(),
+        "/D".to_owned(),
+        "/V:OFF".to_owned(),
+        "/Q".to_owned(),
+        "/C".to_owned(),
+        temp_script.path_string(),
+    ];
+
+    Ok(PreparedCommand::with_script(prepared, temp_script))
+}
+
+fn powershell_inline_script(command: &[String]) -> Option<&str> {
+    if command.len() == 4
+        && (executable_is(command, "powershell.exe") || executable_is(command, "pwsh.exe"))
+        && command[2].eq_ignore_ascii_case("-Command")
+    {
+        Some(command[3].as_str())
+    } else {
+        None
+    }
+}
+
+fn broker_temp_script(extension: &str, temp_dir: Option<&Path>) -> anyhow::Result<TmpFileGuard> {
+    TmpFileGuard::with_prefix_in("devolutions-broker-", extension, temp_dir)
+        .context("failed to create broker temporary script")
+}
+
+fn executable_is(command: &[String], expected_name: &str) -> bool {
+    command.first().is_some_and(|executable| {
+        Path::new(executable)
+            .file_name()
+            .and_then(|name| name.to_str())
+            .is_some_and(|name| name.eq_ignore_ascii_case(expected_name))
+    })
+}
+
+fn user_temp_dir(token: &Token) -> Option<PathBuf> {
+    let user_env = match utils::environment_block(Some(token), false) {
+        Ok(user_env) => user_env,
+        Err(error) => {
+            warn!(%error, "Failed to load user environment block for broker script temp path");
+            return None;
+        }
+    };
+
+    let temp_dir = user_env
+        .iter()
+        .find(|(key, _)| key.eq_ignore_ascii_case("TEMP"))
+        .or_else(|| user_env.iter().find(|(key, _)| key.eq_ignore_ascii_case("TMP")))
+        .map(|(_, value)| PathBuf::from(value));
+
+    match temp_dir {
+        Some(path) if path.is_dir() => Some(path),
+        Some(path) => {
+            warn!(path = %path.display(), "User temp path is not a directory; using default temp path");
+            None
+        }
+        None => {
+            warn!("User environment does not define TEMP or TMP; using default temp path");
+            None
+        }
+    }
+}
+
+fn quote_powershell_literal(value: &str) -> String {
+    format!("'{}'", value.replace('\'', "''"))
+}
+
+fn append_batch_argument(script: &mut String, value: &str) -> anyhow::Result<()> {
+    if value.contains(['\0', '\r', '\n']) {
+        bail!("winget command arguments cannot contain control line separators");
+    }
+
+    script.push('"');
+
+    let mut backslashes = 0;
+    for c in value.chars() {
+        match c {
+            '\\' => backslashes += 1,
+            '"' => {
+                for _ in 0..=(backslashes * 2) {
+                    script.push('\\');
+                }
+                script.push('"');
+                backslashes = 0;
+            }
+            '%' => {
+                for _ in 0..backslashes {
+                    script.push('\\');
+                }
+                script.push_str("%%");
+                backslashes = 0;
+            }
+            c => {
+                for _ in 0..backslashes {
+                    script.push('\\');
+                }
+                script.push(c);
+                backslashes = 0;
+            }
+        }
+    }
+
+    for _ in 0..(backslashes * 2) {
+        script.push('\\');
+    }
+    script.push('"');
+
+    Ok(())
+}
+
+struct PreparedCommand {
+    command: Vec<String>,
+    _script: Option<TmpFileGuard>,
+}
+
+impl PreparedCommand {
+    fn raw(command: &[String]) -> Self {
+        Self {
+            command: command.to_vec(),
+            _script: None,
+        }
+    }
+
+    fn with_script(command: Vec<String>, script: TmpFileGuard) -> Self {
+        Self {
+            command,
+            _script: Some(script),
+        }
+    }
+
+    fn args(&self) -> &[String] {
+        &self.command
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{POWERSHELL_UTF8_ENCODING_PREAMBLE, prepare_main_command_in, prepare_shell_command_in};
+
+    #[test]
+    fn shell_command_uses_utf8_temp_batch_file() {
+        let temp_dir = tempfile::tempdir().expect("create temp dir");
+        let command = prepare_shell_command_in("echo héllo", Some(temp_dir.path())).expect("prepare shell command");
+
+        assert_eq!(command.args()[0], "cmd.exe");
+        assert_eq!(command.args()[1], "/D");
+        assert_eq!(command.args()[2], "/V:OFF");
+        assert_eq!(command.args()[3], "/Q");
+        assert_eq!(command.args()[4], "/C");
+        assert!(command.args()[5].ends_with(".bat"));
+
+        let script = std::fs::read_to_string(&command.args()[5]).expect("read temp script");
+        assert_eq!(script, "@chcp 65001 > nul\r\necho héllo");
+    }
+
+    #[test]
+    fn powershell_command_uses_temp_script_file() {
+        let temp_dir = tempfile::tempdir().expect("create temp dir");
+        let command = vec![
+            "powershell.exe".to_owned(),
+            "-NoProfile".to_owned(),
+            "-Command".to_owned(),
+            "Write-Output 'héllo'".to_owned(),
+        ];
+        let command = prepare_main_command_in(&command, Some(temp_dir.path())).expect("prepare PowerShell command");
+
+        assert_eq!(command.args()[0], "powershell.exe");
+        assert_eq!(command.args()[1], "-NoProfile");
+        assert_eq!(command.args()[2], "-Command");
+        assert!(command.args()[3].starts_with("& '"));
+
+        let script = std::fs::read(&command.args()[3][3..command.args()[3].len() - 1]).expect("read temp script");
+        assert!(script.starts_with(b"\xEF\xBB\xBF"));
+        let script = String::from_utf8_lossy(&script);
+        assert!(script.contains(POWERSHELL_UTF8_ENCODING_PREAMBLE));
+        assert!(script.contains("\r\nWrite-Output 'héllo'"));
+    }
+
+    #[test]
+    fn powershell7_command_uses_bomless_utf8_temp_script_file() {
+        let temp_dir = tempfile::tempdir().expect("create temp dir");
+        let command = vec![
+            "pwsh.exe".to_owned(),
+            "-NoProfile".to_owned(),
+            "-Command".to_owned(),
+            "Write-Output 'héllo'".to_owned(),
+        ];
+        let command = prepare_main_command_in(&command, Some(temp_dir.path())).expect("prepare PowerShell command");
+
+        assert_eq!(command.args()[0], "pwsh.exe");
+        assert_eq!(command.args()[1], "-NoProfile");
+        assert_eq!(command.args()[2], "-Command");
+        assert!(command.args()[3].starts_with("& '"));
+
+        let script = std::fs::read(&command.args()[3][3..command.args()[3].len() - 1]).expect("read temp script");
+        assert!(!script.starts_with(b"\xEF\xBB\xBF"));
+        let script = String::from_utf8(script).expect("script is UTF-8");
+        assert!(script.starts_with(POWERSHELL_UTF8_ENCODING_PREAMBLE));
+        assert!(script.contains("\r\nWrite-Output 'héllo'"));
+    }
+
+    #[test]
+    fn winget_command_uses_batch_wrapper_for_utf8_output() {
+        let temp_dir = tempfile::tempdir().expect("create temp dir");
+        let command = vec![
+            "winget.exe".to_owned(),
+            "install".to_owned(),
+            "--id".to_owned(),
+            "Vendor.Package&Name".to_owned(),
+            "100%".to_owned(),
+            "Quoted\"Value".to_owned(),
+        ];
+        let command = prepare_main_command_in(&command, Some(temp_dir.path())).expect("prepare WinGet command");
+
+        assert_eq!(command.args()[0], "cmd.exe");
+        assert_eq!(command.args()[1], "/D");
+        assert_eq!(command.args()[2], "/V:OFF");
+        assert_eq!(command.args()[3], "/Q");
+        assert_eq!(command.args()[4], "/C");
+
+        let script = std::fs::read_to_string(&command.args()[5]).expect("read temp script");
+        assert!(script.starts_with("@echo off\r\n@chcp 65001 > nul\r\nset \"NO_COLOR=1\""));
+        assert!(
+            script
+                .contains("\"winget.exe\" \"install\" \"--id\" \"Vendor.Package&Name\" \"100%%\" \"Quoted\\\"Value\"")
+        );
+        assert!(script.contains("exit /b %ERRORLEVEL%"));
+    }
+}
diff --git a/devolutions-agent/src/broker/executor/windows/process.rs b/devolutions-agent/src/broker/executor/windows/process.rs
new file mode 100644
index 000000000..c39f249b3
--- /dev/null
+++ b/devolutions-agent/src/broker/executor/windows/process.rs
@@ -0,0 +1,218 @@
+//! Process creation helpers for Windows execution.
+
+use std::io::Read as _;
+use std::path::{Path, PathBuf};
+
+use anyhow::{Context as _, bail};
+use tracing::{debug, error, info};
+use win_api_wrappers::process::{self, StartupInfo};
+use win_api_wrappers::security::attributes::SecurityAttributesInit;
+use win_api_wrappers::token::Token;
+use win_api_wrappers::utils::{self, CommandLine, Pipe, WideString};
+use windows::Win32::System::Threading::{
+    CREATE_NEW_CONSOLE, NORMAL_PRIORITY_CLASS, STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES,
+};
+use windows::Win32::UI::WindowsAndMessaging::SW_HIDE;
+
+use crate::broker::executor::{ExecutionOutput, tail_utf8};
+
+/// Create a process under the given token and wait for exit.
+///
+/// This is the unified process-creation path used by both SYSTEM and current-user modes.
+/// The process always runs with no visible window (`STARTF_USESHOWWINDOW` + `SW_HIDE`, the
+/// same approach `devolutions-session` uses). When `capture` is true, the child's
+/// stdout+stderr are redirected into a single pipe and returned (tail-truncated to
+/// [`crate::broker::executor::MAX_CAPTURED_OUTPUT_BYTES`]); otherwise no output is captured.
+///
+/// Returns the process exit code and (when captured) its output.
+#[allow(clippy::cast_possible_wrap)]
+pub(super) fn create_process(
+    token: &Token,
+    command: &[String],
+    session_id: u32,
+    capture: bool,
+) -> anyhow::Result<ExecutionOutput> {
+    let cmd_line = CommandLine::new(command.to_vec());
+
+    debug!(
+        command_line = %command.join(" "),
+        session_id,
+        capture,
+        "Building process creation parameters"
+    );
+
+    // Resolve the executable using the user's environment PATH.
+    // CreateProcessAsUserW searches the CALLING process's PATH (SYSTEM) to find the
+    // executable, not the child's environment block. Since tools like winget.exe live
+    // in per-user directories (e.g. %LOCALAPPDATA%\Microsoft\WindowsApps), we must
+    // resolve the full path ourselves using the user's environment.
+    let user_env = utils::environment_block(Some(token), false).context("failed to load user environment block")?;
+
+    let exe_name = command.first().context("empty command")?;
+    let resolved_exe = resolve_executable(exe_name, &user_env).with_context(|| {
+        format!(
+            "could not find '{}' in user's PATH: {:?}",
+            exe_name,
+            user_env.get("Path").or_else(|| user_env.get("PATH"))
+        )
+    })?;
+
+    info!(
+        exe = %resolved_exe.display(),
+        "Resolved executable path from user environment"
+    );
+
+    // The window is always hidden. `WinSta0\Default` keeps the process on the interactive
+    // desktop; `SW_HIDE` keeps any console it allocates invisible.
+    let mut startup_info = StartupInfo {
+        desktop: WideString::from("WinSta0\\Default"),
+        flags: STARTF_USESHOWWINDOW,
+        show_window: u16::try_from(SW_HIDE.0).expect("SW_HIDE fits into u16"),
+        ..Default::default()
+    };
+
+    // Capture pipes are only set up when requested. They must be kept alive through
+    // process creation, and the child's ends closed afterwards so the reader sees EOF.
+    let inheritable = SecurityAttributesInit {
+        inherit_handle: true,
+        ..Default::default()
+    }
+    .init();
+    let (output_read, held_output_write, held_stdin_read) = if capture {
+        let (out_read, out_write) =
+            Pipe::new_anonymous(Some(&inheritable), 0).context("failed to create output capture pipe")?;
+        // Empty stdin (write end closed immediately so the child reads EOF).
+        let (in_read, in_write) = Pipe::new_anonymous(Some(&inheritable), 0).context("failed to create stdin pipe")?;
+        drop(in_write);
+
+        startup_info.flags = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW;
+        startup_info.std_input = in_read.handle.raw();
+        startup_info.std_output = out_write.handle.raw();
+        startup_info.std_error = out_write.handle.raw();
+
+        (Some(out_read), Some(out_write), Some(in_read))
+    } else {
+        (None, None, None)
+    };
+
+    let creation_flags = CREATE_NEW_CONSOLE | NORMAL_PRIORITY_CLASS;
+
+    debug!("Calling process::create_process_as_user");
+
+    let process_info = match process::create_process_as_user(
+        Some(token),
+        Some(&resolved_exe),
+        Some(&cmd_line),
+        None,
+        None,
+        // Inherit handles only when capturing (so the child receives the pipe ends).
+        capture,
+        creation_flags,
+        Some(&user_env),
+        None,
+        &mut startup_info,
+    ) {
+        Ok(info) => info,
+        Err(error) => {
+            error!(
+                error = format!("{error:#}"),
+                command_line = %command.join(" "),
+                exe = %resolved_exe.display(),
+                session_id,
+                "create_process_as_user failed"
+            );
+            return Err(error).with_context(|| {
+                format!(
+                    "CreateProcessAsUserW failed for '{}' (session {})",
+                    resolved_exe.display(),
+                    session_id
+                )
+            });
+        }
+    };
+
+    // Close our copies of the child's handles so the read end observes EOF on exit.
+    drop(held_output_write);
+    drop(held_stdin_read);
+
+    info!(
+        session_id,
+        pid = process_info.process_id,
+        capture,
+        "Process spawned, waiting for exit"
+    );
+
+    // Drain the pipe on a separate thread so a child producing more output than the pipe
+    // buffer can hold does not deadlock against our wait-for-exit.
+    let reader = output_read.map(|mut pipe| {
+        std::thread::spawn(move || {
+            let mut buffer = Vec::new();
+            let _ = pipe.read_to_end(&mut buffer);
+            buffer
+        })
+    });
+
+    // Wait for the process to exit (no timeout; the server enforces an overall timeout).
+    process_info.process.wait(None).context("failed to wait for process")?;
+
+    let exit_code = process_info
+        .process
+        .exit_code()
+        .context("failed to get process exit code")?;
+
+    let stdout = match reader {
+        Some(handle) => tail_utf8(&handle.join().unwrap_or_default()),
+        None => String::new(),
+    };
+
+    Ok(ExecutionOutput {
+        exit_code: exit_code as i32,
+        stdout,
+    })
+}
+
+/// Resolve an executable name to its full path using the given environment's PATH.
+///
+/// Handles both absolute paths and bare names (e.g., `winget.exe`).
+/// Appends `.exe` if no extension is present and the file is not found as-is.
+fn resolve_executable(exe_name: &str, env: &std::collections::HashMap<String, String>) -> anyhow::Result<PathBuf> {
+    let exe_path = Path::new(exe_name);
+
+    // If already an absolute path, just verify it exists.
+    if exe_path.is_absolute() {
+        if exe_path.exists() {
+            return Ok(exe_path.to_owned());
+        }
+        bail!("executable not found at absolute path: {}", exe_path.display());
+    }
+
+    // Get PATH from environment (case-insensitive key lookup).
+    let path_var = env
+        .iter()
+        .find(|(k, _)| k.eq_ignore_ascii_case("PATH"))
+        .map(|(_, v)| v.as_str())
+        .unwrap_or_default();
+
+    let extensions: &[&str] = if exe_path.extension().is_some() {
+        &[""]
+    } else {
+        &["", ".exe", ".cmd", ".bat", ".com"]
+    };
+
+    for dir in path_var.split(';') {
+        let dir = dir.trim();
+        if dir.is_empty() {
+            continue;
+        }
+        for ext in extensions {
+            let mut candidate = PathBuf::from(dir);
+            let file_name = format!("{}{}", exe_name, ext);
+            candidate.push(&file_name);
+            if candidate.exists() {
+                return Ok(candidate);
+            }
+        }
+    }
+
+    bail!("executable '{}' not found in PATH", exe_name);
+}
diff --git a/devolutions-agent/src/broker/executor/windows/token.rs b/devolutions-agent/src/broker/executor/windows/token.rs
new file mode 100644
index 000000000..1202c6d89
--- /dev/null
+++ b/devolutions-agent/src/broker/executor/windows/token.rs
@@ -0,0 +1,81 @@
+//! Token and session helpers for Windows execution.
+
+use anyhow::{Context as _, bail};
+use win_api_wrappers::identity::sid::Sid;
+use win_api_wrappers::process::Process;
+use win_api_wrappers::token::{Token, TokenElevationType};
+use win_api_wrappers::wts;
+use windows::Win32::Security::{SecurityImpersonation, TOKEN_ALL_ACCESS, TOKEN_QUERY, TokenPrimary};
+
+/// Detect whether the current process is running under the SYSTEM account.
+///
+/// Compares the process token SID against S-1-5-18 (LocalSystem).
+pub(super) fn detect_running_as_system() -> bool {
+    let Ok(token) = Process::current_process().token(TOKEN_QUERY) else {
+        return false;
+    };
+
+    let Ok(sid_and_attrs) = token.sid_and_attributes() else {
+        return false;
+    };
+
+    let Ok(system_sid) = Sid::from_well_known(windows::Win32::Security::WinLocalSystemSid, None) else {
+        return false;
+    };
+
+    sid_and_attrs.sid == system_sid
+}
+
+pub(super) fn duplicate_as_primary(token: &Token) -> anyhow::Result<Token> {
+    token.duplicate(TOKEN_ALL_ACCESS, None, SecurityImpersonation, TokenPrimary)
+}
+
+/// Enumerate WTS sessions to find one belonging to `effective_user`.
+///
+/// `effective_user` can be `DOMAIN\user` or just `user`.
+pub(super) fn find_user_session(effective_user: &str) -> anyhow::Result<u32> {
+    let target_username = effective_user
+        .rsplit('\\')
+        .next()
+        .unwrap_or(effective_user)
+        .to_lowercase();
+
+    let sessions = wts::get_sessions().context("failed to enumerate WTS sessions")?;
+
+    for session in &sessions {
+        if session.session_id == 0 {
+            continue;
+        }
+
+        if let Ok(session_user) = wts::get_session_user_name(session.session_id)
+            && session_user.to_lowercase() == target_username
+        {
+            return Ok(session.session_id);
+        }
+    }
+
+    anyhow::bail!("no active session found for user '{effective_user}'")
+}
+
+/// Attempt to obtain an elevated (linked) token from a filtered/limited token.
+///
+/// On UAC-enabled systems with split tokens, the standard user token has a linked
+/// elevated token. This function retrieves it when elevation is requested.
+pub(super) fn get_elevated_token(token: &Token) -> anyhow::Result<Token> {
+    let elevation_type = token.elevation_type().context("failed to query elevation type")?;
+
+    match elevation_type {
+        TokenElevationType::Full => {
+            // Already elevated — duplicate as primary.
+            duplicate_as_primary(token).context("failed to duplicate full token")
+        }
+        TokenElevationType::Limited => {
+            // Obtain the linked (elevated) token and duplicate as primary.
+            let linked = token.linked_token().context("failed to get linked token")?;
+            duplicate_as_primary(&linked).context("failed to duplicate linked token")
+        }
+        TokenElevationType::Default => {
+            bail!("token elevation type is Default; cannot elevate (UAC may be disabled)");
+        }
+    }
+}
diff --git a/devolutions-agent/src/broker/mod.rs b/devolutions-agent/src/broker/mod.rs
new file mode 100644
index 000000000..8c8e00f43
--- /dev/null
+++ b/devolutions-agent/src/broker/mod.rs
@@ -0,0 +1,18 @@
+//! Package broker module.
+//!
+//! Provides policy evaluation and command execution for package operations,
+//! communicating over a Windows named pipe using HTTP/1.1.
+
+pub(crate) mod auth;
+pub mod command_builder;
+pub mod evaluator;
+pub mod executor;
+pub mod operation_tracker;
+pub mod pipe;
+pub mod policy_loader;
+pub mod policy_watcher;
+pub mod server;
+pub mod task;
+
+#[cfg(test)]
+mod scenario_tests;
diff --git a/devolutions-agent/src/broker/operation_tracker.rs b/devolutions-agent/src/broker/operation_tracker.rs
new file mode 100644
index 000000000..e00bc1faf
--- /dev/null
+++ b/devolutions-agent/src/broker/operation_tracker.rs
@@ -0,0 +1,177 @@
+//! Operation tracker — tracks in-flight and recently completed operations.
+//!
+//! Each tracked operation holds the current status and is updated by a background
+//! task that waits for the process to exit. Completed operations are retained for
+//! a configurable retention period before being evicted.
+
+use std::collections::HashMap;
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+
+use chrono::{DateTime, Utc};
+use now_policy_api::{OperationStatus, ResourceId};
+use tokio::sync::Notify;
+
+/// How long completed/failed operation results are retained for status queries.
+const RESULT_RETENTION: Duration = Duration::from_secs(5 * 60); // 5 minutes.
+
+/// Maximum operation runtime before declaring timeout.
+const OPERATION_TIMEOUT: Duration = Duration::from_secs(60 * 60); // 1 hour.
+
+/// Internal state of a tracked operation.
+#[derive(Debug, Clone)]
+pub struct TrackedOperation {
+    /// Original request identifier.
+    pub request_id: ResourceId,
+    /// Current status.
+    pub status: OperationStatus,
+    /// When the process was launched (Some after CreateProcess succeeds).
+    pub started_at: Option<DateTime<Utc>>,
+    /// When the operation completed/failed.
+    pub completed_at: Option<DateTime<Utc>>,
+    /// Process exit code (when available).
+    pub exit_code: Option<i32>,
+    /// Human-readable note.
+    pub note: Option<String>,
+    /// Captured combined stdout+stderr (tail-truncated), when the request opted in.
+    pub stdout: Option<String>,
+    /// When this entry should be evicted (set upon completion/failure).
+    pub expires_at: Option<DateTime<Utc>>,
+}
+
+/// Thread-safe operation tracker.
+#[derive(Clone)]
+pub struct OperationTracker {
+    state: Arc<Mutex<TrackerState>>,
+}
+
+struct TrackerState {
+    operations: HashMap<String, TrackedOperation>,
+    request_index: HashMap<String, String>,
+}
+
+impl Default for OperationTracker {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl OperationTracker {
+    pub fn new() -> Self {
+        Self {
+            state: Arc::new(Mutex::new(TrackerState {
+                operations: HashMap::new(),
+                request_index: HashMap::new(),
+            })),
+        }
+    }
+
+    /// Register a new operation as Starting.
+    ///
+    /// Returns the operation ID and whether this call created a new operation.
+    pub fn register(&self, request_id: &ResourceId, operation_id: ResourceId) -> (ResourceId, bool) {
+        let mut state = self.state.lock().expect("tracker lock poisoned");
+        let request_key = request_id.to_string();
+        if let Some(existing_operation_id) = state.request_index.get(&request_key) {
+            return (ResourceId::from(existing_operation_id.as_str()), false);
+        }
+
+        let operation_key = operation_id.to_string();
+        state.request_index.insert(request_key, operation_key.clone());
+        state.operations.insert(
+            operation_key,
+            TrackedOperation {
+                request_id: request_id.clone(),
+                status: OperationStatus::Starting,
+                started_at: None,
+                completed_at: None,
+                exit_code: None,
+                note: None,
+                stdout: None,
+                expires_at: None,
+            },
+        );
+        (operation_id, true)
+    }
+
+    /// Mark an operation as Running (process launched).
+    pub fn mark_running(&self, request_id: &str) {
+        let mut state = self.state.lock().expect("tracker lock poisoned");
+        if let Some(op) = state.operations.get_mut(request_id) {
+            op.status = OperationStatus::Running;
+            op.started_at = Some(Utc::now());
+        }
+    }
+
+    /// Mark an operation as finished with an exit code, a status note (success message or
+    /// short error summary), and optionally captured output.
+    pub fn mark_completed(&self, request_id: &str, exit_code: i32, note: String, stdout: Option<String>) {
+        let mut state = self.state.lock().expect("tracker lock poisoned");
+        if let Some(op) = state.operations.get_mut(request_id) {
+            let now = Utc::now();
+            op.status = if exit_code == 0 {
+                OperationStatus::Completed
+            } else {
+                OperationStatus::Failed
+            };
+            op.exit_code = Some(exit_code);
+            op.note = Some(note);
+            op.stdout = stdout;
+            op.completed_at = Some(now);
+            op.expires_at = Some(now + chrono::Duration::from_std(RESULT_RETENTION).expect("valid duration"));
+        }
+    }
+
+    /// Mark an operation as Failed without a process exit code (launch failure or timeout).
+    pub fn mark_failed(&self, request_id: &str, note: String, stdout: Option<String>) {
+        let mut state = self.state.lock().expect("tracker lock poisoned");
+        if let Some(op) = state.operations.get_mut(request_id) {
+            let now = Utc::now();
+            op.status = OperationStatus::Failed;
+            op.note = Some(note);
+            op.stdout = stdout;
+            op.completed_at = Some(now);
+            op.expires_at = Some(now + chrono::Duration::from_std(RESULT_RETENTION).expect("valid duration"));
+        }
+    }
+
+    /// Query the current state of an operation.
+    pub fn get(&self, request_id: &str) -> Option<TrackedOperation> {
+        let state = self.state.lock().expect("tracker lock poisoned");
+        state.operations.get(request_id).cloned()
+    }
+
+    /// Remove expired entries. Called periodically.
+    pub fn evict_expired(&self) {
+        let now = Utc::now();
+        let mut state = self.state.lock().expect("tracker lock poisoned");
+        state.operations.retain(|_, op| match op.expires_at {
+            Some(expiry) => now < expiry,
+            None => true, // Still running, keep it.
+        });
+        let retained_operation_ids: std::collections::HashSet<_> = state.operations.keys().cloned().collect();
+        state
+            .request_index
+            .retain(|_, operation_id| retained_operation_ids.contains(operation_id));
+    }
+
+    /// Returns the operation timeout duration.
+    pub fn operation_timeout() -> Duration {
+        OPERATION_TIMEOUT
+    }
+
+    /// Spawn a background task that periodically evicts expired operations.
+    pub fn spawn_eviction_task(self, shutdown: Arc<Notify>) {
+        tokio::spawn(async move {
+            let interval = Duration::from_secs(30);
+            loop {
+                tokio::select! {
+                    _ = shutdown.notified() => break,
+                    _ = tokio::time::sleep(interval) => {
+                        self.evict_expired();
+                    }
+                }
+            }
+        });
+    }
+}
diff --git a/devolutions-agent/src/broker/pipe.rs b/devolutions-agent/src/broker/pipe.rs
new file mode 100644
index 000000000..285a223a7
--- /dev/null
+++ b/devolutions-agent/src/broker/pipe.rs
@@ -0,0 +1,149 @@
+//! Named pipe transport for Windows.
+//!
+//! Creates a named pipe server with appropriate ACLs and accepts connections,
+//! forwarding them to the HTTP server.
+
+#[cfg(windows)]
+mod windows_pipe {
+    use std::sync::Arc;
+
+    use anyhow::Context as _;
+    use tokio::net::windows::named_pipe::{NamedPipeServer, ServerOptions};
+    use tokio::sync::Notify;
+    use tracing::{error, info, warn};
+    use win_api_wrappers::identity::sid::Sid;
+    use win_api_wrappers::security::acl::{Acl, ExplicitAccess, InheritableAcl, InheritableAclKind, Trustee};
+    use win_api_wrappers::security::attributes::SecurityAttributesInit;
+    use windows::Win32::Foundation::GENERIC_ALL;
+    use windows::Win32::Security;
+    use windows::Win32::Security::Authorization::SET_ACCESS;
+    use windows::Win32::Storage::FileSystem::{FILE_GENERIC_READ, FILE_GENERIC_WRITE};
+
+    use crate::broker::auth::PipeClient;
+    use crate::broker::server::{BrokerState, build_router_for_client, serve_connection};
+
+    /// Default pipe name for the package broker.
+    pub const DEFAULT_PIPE_NAME: &str = r"\\.\pipe\Devolutions.Now.PackageBroker.v1";
+
+    /// Start the named pipe server and accept connections until shutdown.
+    pub async fn run_pipe_server(state: Arc<BrokerState>, shutdown: Arc<Notify>) -> anyhow::Result<()> {
+        let pipe_name = state.pipe_name.clone();
+        info!(%pipe_name, "Starting named pipe server");
+
+        loop {
+            // Create a new pipe instance for each connection.
+            let server = create_pipe_instance(&pipe_name)?;
+
+            tokio::select! {
+                result = server.connect() => {
+                    match result {
+                        Ok(()) => {
+                            let client = match PipeClient::from_connected_pipe(&server) {
+                                Ok(client) => client,
+                                Err(error) => {
+                                    warn!(%error, "Rejected named pipe client");
+                                    continue;
+                                }
+                            };
+                            info!("Client connected to named pipe");
+                            let router = build_router_for_client(Arc::clone(&state), client);
+                            tokio::spawn(async move {
+                                serve_connection(server, router).await;
+                                info!("Client disconnected from named pipe");
+                            });
+                        }
+                        Err(error) => {
+                            error!(%error, "Failed to accept pipe connection");
+                        }
+                    }
+                }
+                _ = shutdown.notified() => {
+                    info!("Pipe server shutting down");
+                    return Ok(());
+                }
+            }
+        }
+    }
+
+    fn create_pipe_instance(pipe_name: &str) -> anyhow::Result<NamedPipeServer> {
+        let security_attributes =
+            build_pipe_security_attributes().context("failed to build pipe security attributes")?;
+
+        // SAFETY: `create_with_security_attributes_raw` requires a pointer to a valid
+        // `SECURITY_ATTRIBUTES` that stays alive for the duration of the call. The pointer
+        // comes from `security_attributes` (a `win_api_wrappers::security::SecurityAttributes`),
+        // a local binding that owns the structure and its security descriptor and is dropped
+        // only at the end of this function, well after the call returns. `CreateNamedPipeW`
+        // copies the descriptor at creation, so the pointer is not retained afterwards.
+        let server = unsafe {
+            ServerOptions::new()
+                .first_pipe_instance(false)
+                .create_with_security_attributes_raw(pipe_name, security_attributes.as_mut_ptr().cast())
+        }?;
+
+        Ok(server)
+    }
+
+    /// Build a security descriptor that grants:
+    /// - SYSTEM: full control
+    /// - Administrators: full control
+    /// - BUILTIN\Users: read + write (allows interactive users to connect)
+    fn build_pipe_security_attributes() -> anyhow::Result<win_api_wrappers::security::attributes::SecurityAttributes> {
+        let system_sid =
+            Sid::from_well_known(Security::WinLocalSystemSid, None).context("failed to create SYSTEM SID")?;
+        let admins_sid = Sid::from_well_known(Security::WinBuiltinAdministratorsSid, None)
+            .context("failed to create Administrators SID")?;
+        let users_sid =
+            Sid::from_well_known(Security::WinBuiltinUsersSid, None).context("failed to create Users SID")?;
+
+        let entries = [
+            ExplicitAccess {
+                access_permissions: GENERIC_ALL.0,
+                access_mode: SET_ACCESS,
+                inheritance: Security::ACE_FLAGS(0),
+                trustee: Trustee::Sid(system_sid),
+            },
+            ExplicitAccess {
+                access_permissions: GENERIC_ALL.0,
+                access_mode: SET_ACCESS,
+                inheritance: Security::ACE_FLAGS(0),
+                trustee: Trustee::Sid(admins_sid),
+            },
+            ExplicitAccess {
+                access_permissions: FILE_GENERIC_READ.0 | FILE_GENERIC_WRITE.0,
+                access_mode: SET_ACCESS,
+                inheritance: Security::ACE_FLAGS(0),
+                trustee: Trustee::Sid(users_sid),
+            },
+        ];
+
+        let empty_acl = Acl::new().context("failed to create empty ACL")?;
+        let dacl = empty_acl.set_entries(&entries).context("failed to set ACL entries")?;
+
+        let attrs = SecurityAttributesInit {
+            dacl: Some(InheritableAcl {
+                kind: InheritableAclKind::Protected,
+                acl: dacl,
+            }),
+            ..Default::default()
+        }
+        .init();
+
+        Ok(attrs)
+    }
+}
+
+#[cfg(windows)]
+pub use windows_pipe::*;
+
+/// Fallback for non-Windows (pipe transport not supported).
+#[cfg(not(windows))]
+pub const DEFAULT_PIPE_NAME: &str = "not-supported-on-this-platform";
+
+#[cfg(not(windows))]
+pub async fn run_pipe_server(
+    _state: std::sync::Arc<crate::broker::server::BrokerState>,
+    _shutdown: std::sync::Arc<tokio::sync::Notify>,
+) -> anyhow::Result<()> {
+    anyhow::bail!("named pipe transport is only supported on Windows")
+}
diff --git a/devolutions-agent/src/broker/policy_loader.rs b/devolutions-agent/src/broker/policy_loader.rs
new file mode 100644
index 000000000..ad412285d
--- /dev/null
+++ b/devolutions-agent/src/broker/policy_loader.rs
@@ -0,0 +1,85 @@
+//! Policy file loader.
+//!
+//! Loads policy documents from the configured directory.
+//! Supports both JSON (`.json`) and YAML (`.yaml`, `.yml`) formats.
+//! Default location: `%PROGRAMDATA%/Devolutions/Agent/`
+
+use std::path::{Path, PathBuf};
+
+use now_policy::PolicyDocument;
+use now_policy::schema::{parse_policy_json, parse_policy_yaml};
+use tracing::info;
+
+/// Default policy directory.
+pub fn default_policy_dir() -> PathBuf {
+    if cfg!(windows) {
+        let program_data = std::env::var("PROGRAMDATA").unwrap_or_else(|_| r"C:\ProgramData".to_owned());
+        PathBuf::from(program_data).join("Devolutions").join("Agent")
+    } else {
+        PathBuf::from("/etc/devolutions-agent")
+    }
+}
+
+/// Base name for the policy file (without extension).
+const POLICY_FILE_BASE: &str = "package-broker-policy";
+
+/// Supported policy file extensions in priority order.
+const POLICY_EXTENSIONS: &[&str] = &["json", "yaml", "yml"];
+
+/// Load a policy document from a file path.
+///
+/// The file format is detected from the extension:
+/// - `.json` — parsed as JSON
+/// - `.yaml` or `.yml` — parsed as YAML
+///
+/// Deserialization performs all validation (structure, types, length constraints, patterns).
+pub fn load_policy(path: &Path) -> anyhow::Result<PolicyDocument> {
+    let content = std::fs::read_to_string(path)
+        .map_err(|e| anyhow::anyhow!("failed to read policy file at {}: {e}", path.display()))?;
+
+    let policy = deserialize_policy(&content, path)?;
+
+    info!(
+        policy_id = %policy.metadata.id,
+        revision = policy.metadata.revision,
+        rules_count = policy.rules.len(),
+        "Loaded policy"
+    );
+
+    Ok(policy)
+}
+
+/// Deserialize policy content, detecting format from file extension.
+fn deserialize_policy(content: &str, path: &Path) -> anyhow::Result<PolicyDocument> {
+    let ext = path
+        .extension()
+        .and_then(|e| e.to_str())
+        .unwrap_or("")
+        .to_ascii_lowercase();
+
+    match ext.as_str() {
+        "yaml" | "yml" => {
+            parse_policy_yaml(content).map_err(|e| anyhow::anyhow!("invalid YAML policy at {}: {e}", path.display()))
+        }
+        _ => parse_policy_json(content).map_err(|e| anyhow::anyhow!("invalid JSON policy at {}: {e}", path.display())),
+    }
+}
+
+/// Find the policy file in the default location.
+///
+/// Searches for `package-broker-policy.{json,yaml,yml}` in priority order.
+pub fn find_default_policy() -> anyhow::Result<PathBuf> {
+    let dir = default_policy_dir();
+
+    for ext in POLICY_EXTENSIONS {
+        let path = dir.join(format!("{POLICY_FILE_BASE}.{ext}"));
+        if path.exists() {
+            return Ok(path);
+        }
+    }
+
+    anyhow::bail!(
+        "policy file not found in {}; create package-broker-policy.{{json,yaml,yml}} to enable the broker",
+        dir.display()
+    )
+}
diff --git a/devolutions-agent/src/broker/policy_watcher.rs b/devolutions-agent/src/broker/policy_watcher.rs
new file mode 100644
index 000000000..bb4bb5ab7
--- /dev/null
+++ b/devolutions-agent/src/broker/policy_watcher.rs
@@ -0,0 +1,135 @@
+//! Policy file watcher with live reload.
+//!
+//! Watches the policy file for changes and reloads it when modified.
+//! If the file becomes unavailable or corrupted, the broker pauses
+//! (denies all requests) until a valid policy is available again.
+
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+use std::time::Duration;
+
+use notify::{RecommendedWatcher, RecursiveMode, Watcher};
+use now_policy::PolicyDocument;
+use tokio::sync::{Notify, watch};
+use tracing::{error, info, warn};
+
+use crate::broker::policy_loader;
+
+/// State of the policy: either loaded and active, or unavailable.
+#[derive(Debug, Clone)]
+pub enum PolicyState {
+    /// A valid policy is loaded and active.
+    Active(Arc<PolicyDocument>),
+    /// The policy file is missing or corrupted; broker should deny all requests.
+    Unavailable { reason: String },
+}
+
+/// Watches a policy file (JSON or YAML) and sends updates via a channel.
+///
+/// On startup, attempts to load the policy. If it fails, starts in `Unavailable` state.
+/// When the file is modified, reloads it. If reload fails, transitions to `Unavailable`.
+/// When a valid file becomes available again, transitions back to `Active`.
+pub struct PolicyWatcher {
+    path: PathBuf,
+    state_tx: watch::Sender<PolicyState>,
+}
+
+impl PolicyWatcher {
+    /// Create a new watcher for the given policy file path.
+    ///
+    /// Returns the watcher and a receiver for policy state changes.
+    pub fn new(path: PathBuf) -> (Self, watch::Receiver<PolicyState>) {
+        let initial_state = match policy_loader::load_policy(&path) {
+            Ok(policy) => PolicyState::Active(Arc::new(policy)),
+            Err(e) => PolicyState::Unavailable { reason: e.to_string() },
+        };
+
+        let (state_tx, state_rx) = watch::channel(initial_state);
+
+        let watcher = Self { path, state_tx };
+
+        (watcher, state_rx)
+    }
+
+    /// Start watching the policy file for changes.
+    ///
+    /// This spawns a background task that watches the policy file's parent directory
+    /// and reloads the policy when the file is modified, created, or removed.
+    /// The task runs until the shutdown notify is triggered.
+    pub async fn watch(self, shutdown: Arc<Notify>) {
+        let path = self.path.clone();
+        let state_tx = self.state_tx;
+        let dir = path.parent().unwrap_or_else(|| Path::new(".")).to_owned();
+
+        let (fs_tx, mut fs_rx) = tokio::sync::mpsc::channel::<()>(16);
+        let (watcher_stop_tx, watcher_stop_rx) = std::sync::mpsc::channel::<()>();
+
+        // Set up file watcher in a blocking context.
+        let watch_path = dir.clone();
+        let _watcher_handle = tokio::task::spawn_blocking(move || {
+            let rt_tx = fs_tx;
+            let mut watcher: RecommendedWatcher =
+                match notify::recommended_watcher(move |res: notify::Result<notify::Event>| {
+                    if let Ok(event) = res {
+                        // Only react to modify/create/remove events.
+                        use notify::EventKind;
+                        match event.kind {
+                            EventKind::Modify(_) | EventKind::Create(_) | EventKind::Remove(_) => {
+                                let _ = rt_tx.blocking_send(());
+                            }
+                            _ => {}
+                        }
+                    }
+                }) {
+                    Ok(watcher) => watcher,
+                    Err(error) => {
+                        error!(%error, "Failed to create policy file watcher");
+                        return;
+                    }
+                };
+
+            if let Err(error) = watcher.watch(&watch_path, RecursiveMode::NonRecursive) {
+                error!(%error, path = %watch_path.display(), "Failed to watch policy directory");
+                return;
+            }
+
+            let _ = watcher_stop_rx.recv();
+        });
+
+        // Debounce interval to avoid rapid reloads.
+        let debounce = Duration::from_millis(500);
+
+        loop {
+            tokio::select! {
+                _ = shutdown.notified() => {
+                    info!("Policy watcher shutting down");
+                    let _ = watcher_stop_tx.send(());
+                    break;
+                }
+                Some(()) = fs_rx.recv() => {
+                    // Debounce: drain any additional events that arrived.
+                    tokio::time::sleep(debounce).await;
+                    while fs_rx.try_recv().is_ok() {}
+
+                    // Attempt reload.
+                    match policy_loader::load_policy(&path) {
+                        Ok(policy) => {
+                            info!(
+                                policy_id = %policy.metadata.id,
+                                revision = policy.metadata.revision,
+                                "Policy reloaded successfully"
+                            );
+                            let _ = state_tx.send(PolicyState::Active(Arc::new(policy)));
+                        }
+                        Err(e) => {
+                            warn!(error = %e, "Policy reload failed; broker paused");
+                            let _ = state_tx.send(PolicyState::Unavailable {
+                                reason: e.to_string(),
+                            });
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
diff --git a/devolutions-agent/src/broker/server/connection.rs b/devolutions-agent/src/broker/server/connection.rs
new file mode 100644
index 000000000..5c2b0af47
--- /dev/null
+++ b/devolutions-agent/src/broker/server/connection.rs
@@ -0,0 +1,31 @@
+//! Router and connection serving helpers.
+
+use hyper_util::rt::{TokioExecutor, TokioIo};
+use tokio::io::{AsyncRead, AsyncWrite};
+use tracing::warn;
+
+/// Serve one HTTP connection (a named-pipe instance or a TCP stream) using the router.
+pub async fn serve_connection<S>(stream: S, router: axum::Router)
+where
+    S: AsyncRead + AsyncWrite + Unpin + Send + 'static,
+{
+    use tower_service::Service as _;
+
+    let socket = TokioIo::new(stream);
+
+    let mut make_service = router.into_make_service();
+    let tower_service = match make_service.call(()).await {
+        Ok(service) => service,
+        Err(infallible) => match infallible {},
+    };
+    let hyper_service = hyper_util::service::TowerToHyperService::new(tower_service);
+
+    if let Err(error) = hyper_util::server::conn::auto::Builder::new(TokioExecutor::new())
+        .http1()
+        .keep_alive(false)
+        .serve_connection_with_upgrades(socket, hyper_service)
+        .await
+    {
+        warn!(error = %error, "Connection error");
+    }
+}
diff --git a/devolutions-agent/src/broker/server/execution.rs b/devolutions-agent/src/broker/server/execution.rs
new file mode 100644
index 000000000..9b7c47ebd
--- /dev/null
+++ b/devolutions-agent/src/broker/server/execution.rs
@@ -0,0 +1,61 @@
+//! Background execution task handling.
+
+use std::sync::Arc;
+
+use now_policy_api::ResourceId;
+use tracing::{error, info};
+
+use crate::broker::executor::{CommandExecutor, ExecutionContext};
+use crate::broker::operation_tracker::OperationTracker;
+
+pub(super) fn spawn_execution(
+    executor: Arc<dyn CommandExecutor>,
+    tracker: OperationTracker,
+    operation_id: ResourceId,
+    context: ExecutionContext,
+) {
+    let exe_name = context.command.first().cloned().unwrap_or_else(|| "process".to_owned());
+    let operation_id_string = operation_id.to_string();
+
+    tokio::spawn(async move {
+        let timeout = OperationTracker::operation_timeout();
+        match tokio::time::timeout(timeout, executor.execute(&context)).await {
+            Ok(Ok(output)) => {
+                let stdout = (!output.stdout.is_empty()).then_some(output.stdout);
+                let note = if output.exit_code == 0 {
+                    "process exited successfully".to_owned()
+                } else {
+                    #[allow(clippy::cast_sign_loss)]
+                    let unsigned = output.exit_code as u32;
+                    match crate::broker::executor::describe_exit_code(output.exit_code) {
+                        Some(description) => format!(
+                            "{exe_name} exited with code {} (0x{unsigned:08X}): {description}",
+                            output.exit_code
+                        ),
+                        None => format!("{exe_name} exited with code {} (0x{unsigned:08X})", output.exit_code),
+                    }
+                };
+                info!(
+                    operation_id = %operation_id_string,
+                    exit_code = output.exit_code,
+                    "Background execution completed"
+                );
+                tracker.mark_completed(&operation_id_string, output.exit_code, note, stdout);
+            }
+            Ok(Err(error)) => {
+                let note = format!("{error:#}");
+                error!(operation_id = %operation_id_string, %error, "Background execution failed");
+                tracker.mark_failed(&operation_id_string, note, None);
+            }
+            Err(_elapsed) => {
+                let note = format!("operation timed out after {} seconds", timeout.as_secs());
+                error!(
+                    operation_id = %operation_id_string,
+                    timeout_secs = timeout.as_secs(),
+                    "Background execution timed out"
+                );
+                tracker.mark_failed(&operation_id_string, note, None);
+            }
+        }
+    });
+}
diff --git a/devolutions-agent/src/broker/server/mod.rs b/devolutions-agent/src/broker/server/mod.rs
new file mode 100644
index 000000000..d403d47f2
--- /dev/null
+++ b/devolutions-agent/src/broker/server/mod.rs
@@ -0,0 +1,305 @@
+//! Runtime implementation of the shared NOW package broker server facade.
+
+use std::sync::{Arc, RwLock};
+
+use async_trait::async_trait;
+use base64::Engine as _;
+use chrono::{DateTime, Utc};
+use now_policy::PolicyDocument;
+use now_policy_api::{
+    Base64Utf8Data, CapabilitiesResponse, CapabilitiesResponseKind, Decision, DecisionInfo, ErrorCode, ErrorResponse,
+    EvaluationResponse, EvaluationResponseKind, ExecutionResponse, ExecutionResponseKind, HealthResponse,
+    HealthResponseKind, HealthStatus, OperationStatus, OperationSubmission, PackageRequest, StatusRequest,
+    StatusResponse, StatusResponseKind, Transport,
+};
+use now_policy_server_template::{MAX_REQUEST_BODY_BYTES, PackageBrokerServer, SharedPackageBrokerServer};
+use tracing::{info, trace, warn};
+
+use crate::broker::auth::PipeClient;
+use crate::broker::command_builder::build_command;
+use crate::broker::evaluator;
+use crate::broker::executor::{CommandExecutor, ExecutionContext};
+use crate::broker::operation_tracker::OperationTracker;
+
+mod connection;
+mod execution;
+mod responses;
+
+pub use connection::serve_connection;
+use responses::{
+    api_version, default_manager_capabilities, diagnostics, error_response, new_operation_id, parse_rule_id,
+    policy_info, policy_validity_failure, request_summary, server_context,
+};
+
+/// Shared server state.
+pub struct BrokerState {
+    /// Current policy. `None` means the broker is paused (policy file missing or corrupted).
+    pub policy: RwLock<Option<Arc<PolicyDocument>>>,
+    pub executor: Arc<dyn CommandExecutor>,
+    pub pipe_name: String,
+    pub tracker: OperationTracker,
+    pub skip_signature_validation: bool,
+}
+
+struct EvaluatedRequest {
+    policy: Arc<PolicyDocument>,
+    received_at: DateTime<Utc>,
+    completed_at: DateTime<Utc>,
+    decision: DecisionInfo,
+    would_execute: bool,
+    command: Vec<String>,
+}
+
+/// Build the axum router for a single authenticated pipe client.
+pub(crate) fn build_router_for_client(state: Arc<BrokerState>, client: PipeClient) -> axum::Router {
+    let server: SharedPackageBrokerServer = Arc::new(BrokerConnection { state, client });
+    axum::Router::from(now_policy_server_template::api_router_from_shared(server))
+}
+
+struct BrokerConnection {
+    state: Arc<BrokerState>,
+    client: PipeClient,
+}
+
+#[async_trait]
+impl PackageBrokerServer for BrokerConnection {
+    async fn health(&self) -> HealthResponse {
+        self.state.health().await
+    }
+
+    async fn capabilities(&self) -> CapabilitiesResponse {
+        self.state.capabilities().await
+    }
+
+    async fn evaluate(&self, request: PackageRequest) -> Result<EvaluationResponse, ErrorResponse> {
+        self.client
+            .validate_request(&request, self.state.skip_signature_validation)
+            .map_err(|error| {
+                warn!(error = format!("{error:#}"), "Rejected package broker evaluate request");
+                error_response(ErrorCode::Unauthorized, "pipe client authentication failed")
+            })?;
+
+        self.state.evaluate(request).await
+    }
+
+    async fn execute(&self, request: PackageRequest) -> Result<ExecutionResponse, ErrorResponse> {
+        self.client
+            .validate_request(&request, self.state.skip_signature_validation)
+            .map_err(|error| {
+                warn!(error = format!("{error:#}"), "Rejected package broker execute request");
+                error_response(ErrorCode::Unauthorized, "pipe client authentication failed")
+            })?;
+
+        self.state.execute(request).await
+    }
+
+    async fn status(&self, request: StatusRequest) -> Result<StatusResponse, ErrorResponse> {
+        self.state.status(request).await
+    }
+}
+
+#[async_trait]
+impl PackageBrokerServer for BrokerState {
+    async fn health(&self) -> HealthResponse {
+        let policy_guard = self.policy.read().expect("policy lock poisoned");
+        let (status, policy_id) = match policy_guard.as_ref() {
+            Some(policy) => (HealthStatus::Ready, policy.metadata.id.to_string()),
+            None => (HealthStatus::Paused, String::new()),
+        };
+
+        HealthResponse {
+            response_kind: HealthResponseKind,
+            response_version: api_version(),
+            server: server_context(),
+            status,
+            policy_id,
+        }
+    }
+
+    async fn capabilities(&self) -> CapabilitiesResponse {
+        CapabilitiesResponse {
+            response_kind: CapabilitiesResponseKind,
+            response_version: api_version(),
+            server: server_context(),
+            transports: vec![Transport::HttpNamedPipe],
+            managers: default_manager_capabilities(),
+            max_request_body_bytes: MAX_REQUEST_BODY_BYTES as u64,
+        }
+    }
+
+    async fn evaluate(&self, request: PackageRequest) -> Result<EvaluationResponse, ErrorResponse> {
+        let evaluated = self.evaluate_request(&request)?;
+
+        Ok(EvaluationResponse {
+            response_kind: EvaluationResponseKind,
+            response_version: api_version(),
+            server: server_context(),
+            request_id: request.request_id.clone(),
+            received_at: evaluated.received_at,
+            completed_at: evaluated.completed_at,
+            request: request_summary(&request),
+            decision: evaluated.decision,
+            would_execute: evaluated.would_execute,
+            policy: policy_info(&evaluated.policy),
+            diagnostics: diagnostics(&evaluated.command, request.include_command_preview)?,
+        })
+    }
+
+    async fn execute(&self, request: PackageRequest) -> Result<ExecutionResponse, ErrorResponse> {
+        let evaluated = self.evaluate_request(&request)?;
+        let operation = if evaluated.would_execute {
+            let generated_operation_id = new_operation_id()?;
+            let submitted_at = Utc::now();
+            let context = ExecutionContext {
+                kill_processes: request
+                    .options
+                    .kill_before_operation
+                    .iter()
+                    .map(|process| process.0.clone())
+                    .collect(),
+                pre_command: request.options.pre_operation_command.clone(),
+                command: evaluated.command.clone(),
+                post_command: request.options.post_operation_command.clone(),
+                effective_user: request.client.effective_user.clone(),
+                elevation: request.client.requested_elevation,
+                scope: request.options.scope,
+                capture_output: request.capture_output,
+            };
+
+            let (operation_id, is_new_operation) = self.tracker.register(&request.request_id, generated_operation_id);
+            if is_new_operation {
+                self.tracker.mark_running(&operation_id);
+                execution::spawn_execution(
+                    Arc::clone(&self.executor),
+                    self.tracker.clone(),
+                    operation_id.clone(),
+                    context,
+                );
+            }
+            let status = self
+                .tracker
+                .get(&operation_id)
+                .map_or(OperationStatus::Starting, |operation| operation.status);
+
+            Some(OperationSubmission {
+                operation_id,
+                status,
+                submitted_at,
+            })
+        } else {
+            None
+        };
+
+        Ok(ExecutionResponse {
+            response_kind: ExecutionResponseKind,
+            response_version: api_version(),
+            server: server_context(),
+            request_id: request.request_id.clone(),
+            received_at: evaluated.received_at,
+            completed_at: evaluated.completed_at,
+            request: request_summary(&request),
+            decision: evaluated.decision,
+            policy: policy_info(&evaluated.policy),
+            operation,
+            diagnostics: diagnostics(&evaluated.command, request.include_command_preview)?,
+        })
+    }
+
+    async fn status(&self, request: StatusRequest) -> Result<StatusResponse, ErrorResponse> {
+        let Some(operation) = self.tracker.get(&request.operation_id) else {
+            return Err(error_response(ErrorCode::NotFound, "operation not found"));
+        };
+
+        Ok(StatusResponse {
+            response_kind: StatusResponseKind,
+            response_version: api_version(),
+            server: server_context(),
+            operation_id: request.operation_id,
+            request_id: operation.request_id,
+            status: operation.status,
+            started_at: operation.started_at,
+            completed_at: operation.completed_at,
+            exit_code: operation.exit_code,
+            message: operation.note,
+            details: None,
+            stdout: operation
+                .stdout
+                .map(|stdout| Base64Utf8Data(base64::engine::general_purpose::STANDARD.encode(stdout))),
+        })
+    }
+}
+
+impl BrokerState {
+    fn evaluate_request(&self, request: &PackageRequest) -> Result<EvaluatedRequest, ErrorResponse> {
+        let received_at = Utc::now();
+        let policy = {
+            let guard = self.policy.read().expect("policy lock poisoned");
+            match guard.as_ref() {
+                Some(policy) => Arc::clone(policy),
+                None => {
+                    return Err(error_response(
+                        ErrorCode::BrokerPaused,
+                        "policy file is unavailable or corrupted",
+                    ));
+                }
+            }
+        };
+
+        if let Some(reason) = policy_validity_failure(&policy, received_at) {
+            warn!(%reason, "Rejecting request: policy outside validity window");
+            return Err(error_response(ErrorCode::Forbidden, reason));
+        }
+
+        trace!(
+            operation = %request.operation,
+            manager = %request.manager,
+            package_id = %request.package.id,
+            request_id = %request.request_id,
+            "Evaluating policy for request",
+        );
+
+        let decision = evaluator::evaluate(&policy, request);
+        let audit_mode = policy.enforcement.audit_mode == Some(true);
+        if audit_mode {
+            info!(
+                real_decision = %decision.decision,
+                rule_id = %decision.rule_id,
+                "Audit mode enabled; decision is not enforced",
+            );
+        }
+
+        let effective_decision = if audit_mode {
+            Decision::Allow
+        } else {
+            decision.decision.into()
+        };
+
+        let reason = if audit_mode && decision.decision != now_policy::Decision::Allow {
+            format!(
+                "[Audit mode] Not enforced. Policy decision was {} (rule '{}'): {}",
+                decision.decision, decision.rule_id, decision.reason
+            )
+        } else {
+            decision.reason
+        };
+
+        let command = if effective_decision == Decision::Allow {
+            build_command(request)
+        } else {
+            Vec::new()
+        };
+
+        Ok(EvaluatedRequest {
+            policy,
+            received_at,
+            completed_at: Utc::now(),
+            decision: DecisionInfo {
+                decision: effective_decision,
+                rule_id: parse_rule_id(&decision.rule_id)?,
+                reason,
+            },
+            would_execute: effective_decision == Decision::Allow,
+            command,
+        })
+    }
+}
diff --git a/devolutions-agent/src/broker/server/responses.rs b/devolutions-agent/src/broker/server/responses.rs
new file mode 100644
index 000000000..5d172a82c
--- /dev/null
+++ b/devolutions-agent/src/broker/server/responses.rs
@@ -0,0 +1,148 @@
+//! NOW API response mapping helpers.
+
+use chrono::{DateTime, Utc};
+use now_policy::PolicyDocument;
+use now_policy_api::{
+    API_VERSION_STR, ApiVersion, Architecture, ErrorCode, ErrorResponse, ErrorResponseKind, ManagerCapability,
+    ManagerName, Operation, OperationDiagnostics, PackageRequest, RequestSummary, ResourceId, ResponsePolicyInfo,
+    RuleId, Scope, ServerContext, Transport,
+};
+
+use crate::broker::operation_tracker::OperationTracker;
+
+pub(super) fn api_version() -> ApiVersion {
+    API_VERSION_STR.into()
+}
+
+pub(super) fn server_context() -> ServerContext {
+    ServerContext {
+        server_version: env!("CARGO_PKG_VERSION").to_owned(),
+        transport: Transport::HttpNamedPipe,
+    }
+}
+
+pub(super) fn default_manager_capabilities() -> Vec<ManagerCapability> {
+    vec![
+        ManagerCapability {
+            manager: ManagerName::Winget,
+            operations: vec![Operation::Install, Operation::Update, Operation::Uninstall],
+            scopes: vec![Scope::User, Scope::Machine],
+            architectures: vec![
+                Architecture::X86,
+                Architecture::X64,
+                Architecture::Arm64,
+                Architecture::Neutral,
+            ],
+            supports_custom_parameters: true,
+            supports_custom_install_location: true,
+            supports_capture_output: true,
+            supports_details: true,
+            max_operation_timeout_seconds: Some(OperationTracker::operation_timeout().as_secs()),
+        },
+        ManagerCapability {
+            manager: ManagerName::PowerShell,
+            operations: vec![Operation::Install, Operation::Update, Operation::Uninstall],
+            scopes: vec![Scope::User, Scope::Machine],
+            architectures: vec![Architecture::Neutral],
+            supports_custom_parameters: true,
+            supports_custom_install_location: false,
+            supports_capture_output: true,
+            supports_details: false,
+            max_operation_timeout_seconds: Some(OperationTracker::operation_timeout().as_secs()),
+        },
+        ManagerCapability {
+            manager: ManagerName::PowerShell7,
+            operations: vec![Operation::Install, Operation::Update, Operation::Uninstall],
+            scopes: vec![Scope::User, Scope::Machine],
+            architectures: vec![Architecture::Neutral],
+            supports_custom_parameters: true,
+            supports_custom_install_location: false,
+            supports_capture_output: true,
+            supports_details: false,
+            max_operation_timeout_seconds: Some(OperationTracker::operation_timeout().as_secs()),
+        },
+    ]
+}
+
+pub(super) fn request_summary(request: &PackageRequest) -> RequestSummary {
+    RequestSummary {
+        manager: Some(request.manager),
+        source: Some(request.source.name.clone()),
+        package_id: Some(request.package.id.clone()),
+        operation: Some(request.operation),
+    }
+}
+
+pub(super) fn policy_info(policy: &PolicyDocument) -> ResponsePolicyInfo {
+    ResponsePolicyInfo {
+        id: policy.metadata.id.clone().into(),
+        revision: policy.metadata.revision,
+        policy_version: policy.policy_version.clone().into(),
+    }
+}
+
+pub(super) fn diagnostics(
+    command: &[String],
+    include_command_preview: bool,
+) -> Result<Option<OperationDiagnostics>, ErrorResponse> {
+    if !include_command_preview {
+        return Ok(None);
+    }
+
+    let mut command_preview = Vec::with_capacity(command.len());
+    for arg in command {
+        let parsed = now_policy_api::CommandString::parse(arg).map_err(|error| {
+            error_response(
+                ErrorCode::InternalError,
+                format!("failed to build command preview: {error}"),
+            )
+        })?;
+        command_preview.push(parsed);
+    }
+
+    Ok(Some(OperationDiagnostics { command_preview }))
+}
+
+pub(super) fn parse_rule_id(rule_id: &str) -> Result<RuleId, ErrorResponse> {
+    RuleId::parse(rule_id).map_err(|error| {
+        error_response(
+            ErrorCode::InternalError,
+            format!("invalid policy rule id in evaluation result: {error}"),
+        )
+    })
+}
+
+pub(super) fn new_operation_id() -> Result<ResourceId, ErrorResponse> {
+    let raw = format!("op-{}", uuid::Uuid::new_v4());
+    ResourceId::parse(&raw).map_err(|error| {
+        error_response(
+            ErrorCode::InternalError,
+            format!("failed to generate operation id: {error}"),
+        )
+    })
+}
+
+pub(super) fn policy_validity_failure(policy: &PolicyDocument, now: DateTime<Utc>) -> Option<String> {
+    if let Some(valid_from) = policy.metadata.valid_from
+        && now < valid_from
+    {
+        return Some(format!("policy is not active until {valid_from} (current time {now})"));
+    }
+    if let Some(valid_until) = policy.metadata.valid_until
+        && now > valid_until
+    {
+        return Some(format!("policy expired at {valid_until} (current time {now})"));
+    }
+    None
+}
+
+pub(super) fn error_response(code: ErrorCode, message: impl Into<String>) -> ErrorResponse {
+    ErrorResponse {
+        response_kind: ErrorResponseKind,
+        response_version: api_version(),
+        server: server_context(),
+        code,
+        message: message.into(),
+        details: Vec::new(),
+    }
+}
diff --git a/devolutions-agent/src/broker/task.rs b/devolutions-agent/src/broker/task.rs
new file mode 100644
index 000000000..e10c52e61
--- /dev/null
+++ b/devolutions-agent/src/broker/task.rs
@@ -0,0 +1,161 @@
+//! Package broker entry point
+
+use std::sync::{Arc, RwLock};
+
+use anyhow::Context as _;
+use async_trait::async_trait;
+use devolutions_gateway_task::{ShutdownSignal, Task};
+use tokio::sync::Notify;
+use tracing::{info, warn};
+
+use crate::broker::executor::{self, CommandExecutor};
+use crate::broker::pipe::DEFAULT_PIPE_NAME;
+use crate::broker::policy_loader;
+use crate::broker::policy_watcher::{PolicyState, PolicyWatcher};
+use crate::broker::server::BrokerState;
+
+/// Configuration for the broker task.
+#[derive(Debug, Clone)]
+pub struct BrokerTaskConfig {
+    /// Named pipe name to listen on.
+    pub pipe_name: String,
+    /// Path to the policy file. If `None`, uses the default location.
+    /// Supports `.json`, `.yaml`, and `.yml` extensions.
+    pub policy_path: Option<String>,
+    /// Skip Authenticode signature validation for the broker client executable.
+    pub skip_signature_validation: bool,
+}
+
+impl Default for BrokerTaskConfig {
+    fn default() -> Self {
+        Self {
+            pipe_name: DEFAULT_PIPE_NAME.to_owned(),
+            policy_path: None,
+            skip_signature_validation: false,
+        }
+    }
+}
+
+pub struct BrokerTask {
+    config: BrokerTaskConfig,
+}
+
+impl BrokerTask {
+    pub fn new(config: BrokerTaskConfig) -> Self {
+        Self { config }
+    }
+}
+
+#[async_trait]
+impl Task for BrokerTask {
+    type Output = anyhow::Result<()>;
+
+    const NAME: &'static str = "package-broker";
+
+    async fn run(self, mut shutdown_signal: ShutdownSignal) -> Self::Output {
+        // Resolve policy file path.
+
+        let policy_path = match &self.config.policy_path {
+            Some(path) => std::path::PathBuf::from(path),
+            None => policy_loader::find_default_policy().context("failed to find default broker policy")?,
+        };
+
+        // Create policy watcher with initial load attempt.
+        let (watcher, mut state_rx) = PolicyWatcher::new(policy_path.clone());
+
+        // Log initial state.
+        match &*state_rx.borrow() {
+            PolicyState::Active(policy) => {
+                info!(
+                    policy_id = %policy.metadata.id,
+                    policy_revision = %policy.metadata.revision,
+                    path = %policy_path.display(),
+                    "Loaded package broker policy"
+                );
+            }
+            PolicyState::Unavailable { reason } => {
+                warn!(
+                    %reason,
+                    path = %policy_path.display(),
+                    "Policy unavailable at startup; broker will pause until a valid policy is provided"
+                );
+            }
+        }
+
+        let executor: Arc<dyn CommandExecutor> = executor::create_platform_executor().into();
+
+        // Initialize BrokerState with current policy (or None if unavailable).
+        let initial_policy = match &*state_rx.borrow() {
+            PolicyState::Active(policy) => Some(Arc::clone(policy)),
+            PolicyState::Unavailable { .. } => None,
+        };
+
+        let state = Arc::new(BrokerState {
+            policy: RwLock::new(initial_policy),
+            executor,
+            pipe_name: self.config.pipe_name.clone(),
+            tracker: crate::broker::operation_tracker::OperationTracker::new(),
+            skip_signature_validation: self.config.skip_signature_validation,
+        });
+
+        // Bridge the agent's ShutdownSignal to the Notify used by subsystems.
+        let shutdown_notify = Arc::new(Notify::new());
+
+        // Spawn policy watcher task.
+        let watcher_shutdown = Arc::clone(&shutdown_notify);
+        tokio::spawn(async move {
+            watcher.watch(watcher_shutdown).await;
+        });
+
+        // Spawn policy state relay: updates BrokerState when policy watcher reports changes.
+        let relay_state = Arc::clone(&state);
+        let relay_shutdown = Arc::clone(&shutdown_notify);
+        tokio::spawn(async move {
+            loop {
+                tokio::select! {
+                    _ = relay_shutdown.notified() => break,
+                    result = state_rx.changed() => {
+                        if result.is_err() {
+                            // Sender dropped (watcher exited).
+                            break;
+                        }
+                        let new_policy = match &*state_rx.borrow_and_update() {
+                            PolicyState::Active(policy) => {
+                                info!(
+                                    policy_id = %policy.metadata.id,
+                                    revision = policy.metadata.revision,
+                                    "Policy hot-reloaded; broker resumed"
+                                );
+                                Some(Arc::clone(policy))
+                            }
+                            PolicyState::Unavailable { reason } => {
+                                warn!(%reason, "Policy became unavailable; broker paused");
+                                None
+                            }
+                        };
+                        *relay_state.policy.write().expect("policy lock poisoned") = new_policy;
+                    }
+                }
+            }
+        });
+
+        // Spawn pipe server.
+        let server_shutdown = Arc::clone(&shutdown_notify);
+        let server_handle = tokio::spawn({
+            let state = Arc::clone(&state);
+            async move { crate::broker::pipe::run_pipe_server(state, server_shutdown).await }
+        });
+
+        // Wait for agent shutdown signal.
+        shutdown_signal.wait().await;
+        info!("package broker received shutdown signal");
+        shutdown_notify.notify_waiters();
+
+        // Wait for the server task to finish.
+        match server_handle.await {
+            Ok(Ok(())) => Ok(()),
+            Ok(Err(error)) => Err(error).context("broker pipe server error"),
+            Err(error) => Err(error).context("broker server task panicked"),
+        }
+    }
+}
diff --git a/devolutions-agent/src/code_signing.rs b/devolutions-agent/src/code_signing.rs
new file mode 100644
index 000000000..0edd2badb
--- /dev/null
+++ b/devolutions-agent/src/code_signing.rs
@@ -0,0 +1,103 @@
+//! Windows code-signing validation helpers.
+
+use std::path::Path;
+
+use anyhow::{Context as _, bail};
+use win_api_wrappers::security::crypt::{AuthenticodeSignatureStatus, authenticode_status};
+
+/// List of allowed thumbprints for Devolutions code signing certificates.
+pub(crate) const DEVOLUTIONS_CERT_THUMBPRINTS: &[&str] = &[
+    "3f5202a9432d54293bdfe6f7e46adb0a6f8b3ba6",
+    "8db5a43bb8afe4d2ffb92da9007d8997a4cc4e13",
+    "50f753333811ff11f1920274afde3ffd4468b210",
+];
+
+pub(crate) fn certificate_sha1_thumbprint(cert_der: &[u8]) -> anyhow::Result<[u8; 20]> {
+    use windows::Win32::Security::Cryptography::{CALG_SHA1, CryptHashCertificate};
+
+    let mut thumbprint = [0u8; 20];
+    let mut thumbprint_size = u32::try_from(thumbprint.len()).expect("SHA-1 length fits in u32");
+
+    // SAFETY: `cert_der` points to encoded certificate bytes for the duration of the call.
+    // `thumbprint` and `thumbprint_size` are valid writable output pointers.
+    unsafe {
+        CryptHashCertificate(
+            None,
+            CALG_SHA1,
+            0,
+            cert_der,
+            Some(thumbprint.as_mut_ptr()),
+            &mut thumbprint_size,
+        )
+    }
+    .context("failed to calculate certificate thumbprint")?;
+
+    if usize::try_from(thumbprint_size).expect("thumbprint size fits in usize") != thumbprint.len() {
+        bail!("certificate thumbprint has unexpected length");
+    }
+
+    Ok(thumbprint)
+}
+
+pub(crate) fn is_devolutions_certificate_thumbprint(calculated_thumbprint: &[u8; 20]) -> bool {
+    DEVOLUTIONS_CERT_THUMBPRINTS.iter().any(|thumbprint| {
+        let mut thumbprint_bytes = [0u8; 20];
+        hex::decode_to_slice(thumbprint, &mut thumbprint_bytes)
+            .expect("BUG: Invalid thumbprint in `DEVOLUTIONS_CERT_THUMBPRINTS`");
+
+        &thumbprint_bytes == calculated_thumbprint
+    })
+}
+
+pub(crate) fn validate_devolutions_authenticode_signature(path: &Path) -> anyhow::Result<String> {
+    let wintrust_result = authenticode_status(path).with_context(|| {
+        format!(
+            "failed to read authenticode signature for client executable '{}'",
+            path.display()
+        )
+    })?;
+
+    if !matches!(wintrust_result.status, AuthenticodeSignatureStatus::Valid) {
+        bail!("client executable signature is not valid: {:?}", wintrust_result.status);
+    }
+
+    let signer = wintrust_result
+        .provider
+        .as_ref()
+        .and_then(|provider| provider.signers.first())
+        .context("client executable signature has no signer")?;
+    let signing_cert = signer
+        .cert_chain
+        .first()
+        .context("client executable signature has no signing certificate")?;
+
+    let thumbprint = certificate_sha1_thumbprint(&signing_cert.cert.encoded)?;
+    if !is_devolutions_certificate_thumbprint(&thumbprint) {
+        bail!(
+            "client executable is signed with an unexpected certificate thumbprint: {}",
+            hex::encode(thumbprint)
+        );
+    }
+
+    Ok(hex::encode(thumbprint))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn recognizes_devolutions_certificate_thumbprints() {
+        for thumbprint in DEVOLUTIONS_CERT_THUMBPRINTS {
+            let mut thumbprint_bytes = [0u8; 20];
+            hex::decode_to_slice(thumbprint, &mut thumbprint_bytes)
+                .expect("test thumbprint should be valid hexadecimal");
+            assert!(is_devolutions_certificate_thumbprint(&thumbprint_bytes));
+        }
+    }
+
+    #[test]
+    fn rejects_unknown_certificate_thumbprint() {
+        assert!(!is_devolutions_certificate_thumbprint(&[0u8; 20]));
+    }
+}
diff --git a/devolutions-agent/src/config.rs b/devolutions-agent/src/config.rs
index c6b07e202..672cfcaec 100644
--- a/devolutions-agent/src/config.rs
+++ b/devolutions-agent/src/config.rs
@@ -20,6 +20,7 @@ pub struct Conf {
     pub remote_desktop: RemoteDesktopConf,
     pub pedm: dto::PedmConf,
     pub session: dto::SessionConf,
+    pub package_broker: dto::PackageBrokerConf,
     pub tunnel: TunnelConf,
     pub psu_agent: Option<PsuConf>,
     pub proxy: dto::ProxyConf,
@@ -174,6 +175,7 @@ impl Conf {
                 .unwrap_or_default()
                 .pipe(Option::<PsuConf>::try_from)
                 .context("invalid PSU agent config")?,
+            package_broker: conf_file.package_broker.clone().unwrap_or_default(),
             tunnel: conf_file
                 .tunnel
                 .clone()
@@ -511,6 +513,30 @@ pub mod dto {
         }
     }
 
+    #[derive(PartialEq, Eq, Debug, Clone, Serialize, Deserialize)]
+    #[serde(rename_all = "PascalCase")]
+    pub struct PackageBrokerConf {
+        /// Enable package broker module (disabled by default)
+        pub enabled: bool,
+        /// Named pipe name to listen on (optional, uses default if omitted)
+        #[serde(skip_serializing_if = "Option::is_none")]
+        pub pipe_name: Option<String>,
+        /// Path to the policy JSON file (optional, uses default location if omitted)
+        #[serde(skip_serializing_if = "Option::is_none")]
+        pub policy_path: Option<String>,
+    }
+
+    #[allow(clippy::derivable_impls)]
+    impl Default for PackageBrokerConf {
+        fn default() -> Self {
+            Self {
+                enabled: false,
+                pipe_name: None,
+                policy_path: None,
+            }
+        }
+    }
+
     #[derive(PartialEq, Eq, Debug, Clone, Serialize, Deserialize)]
     #[serde(rename_all = "PascalCase")]
     pub struct TunnelConf {
@@ -691,6 +717,10 @@ pub mod dto {
         #[serde(default, skip_serializing_if = "Option::is_none")]
         pub session: Option<SessionConf>,
 
+        /// Package broker configuration
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        pub package_broker: Option<PackageBrokerConf>,
+
         /// Agent Tunnel configuration
         #[serde(skip_serializing_if = "Option::is_none")]
         pub tunnel: Option<TunnelConf>,
@@ -732,6 +762,7 @@ pub mod dto {
                 proxy: None,
                 debug: None,
                 session: Some(SessionConf { enabled: false }),
+                package_broker: None,
                 tunnel: None,
                 psu_agent: None,
                 rest: serde_json::Map::new(),
@@ -810,6 +841,12 @@ pub mod dto {
         /// Useful for testing with unsigned or test-signed packages.
         #[serde(default)]
         pub skip_msi_signature_validation: bool,
+
+        /// Skip package broker client executable signature validation
+        ///
+        /// Useful for testing with unsigned or test-signed broker clients.
+        #[serde(default)]
+        pub skip_broker_signature_validation: bool,
     }
 
     /// Manual Default trait implementation just to make sure default values are deliberates
@@ -824,6 +861,7 @@ pub mod dto {
                 allow_unsafe_updater_urls: false,
                 skip_updater_hash_validation: false,
                 skip_msi_signature_validation: false,
+                skip_broker_signature_validation: false,
             }
         }
     }
diff --git a/devolutions-agent/src/lib.rs b/devolutions-agent/src/lib.rs
index b508f1889..d0d05e994 100644
--- a/devolutions-agent/src/lib.rs
+++ b/devolutions-agent/src/lib.rs
@@ -5,6 +5,10 @@ use ctrlc as _;
 #[macro_use]
 extern crate tracing;
 
+#[cfg(windows)]
+pub mod broker;
+#[cfg(windows)]
+pub(crate) mod code_signing;
 pub mod config;
 pub mod domain_detect;
 pub mod enrollment;
diff --git a/devolutions-agent/src/service.rs b/devolutions-agent/src/service.rs
index dfd6d0012..1b28eee3f 100644
--- a/devolutions-agent/src/service.rs
+++ b/devolutions-agent/src/service.rs
@@ -2,6 +2,10 @@ use std::time::Duration;
 
 use anyhow::Context;
 use devolutions_agent::AgentServiceEvent;
+#[cfg(windows)]
+use devolutions_agent::broker::pipe::DEFAULT_PIPE_NAME;
+#[cfg(windows)]
+use devolutions_agent::broker::task::{BrokerTask, BrokerTaskConfig};
 use devolutions_agent::config::ConfHandle;
 use devolutions_agent::log::AgentLog;
 use devolutions_agent::psu_agent::PsuAgentTask;
@@ -215,6 +219,19 @@ async fn spawn_tasks(conf_handle: ConfHandle) -> anyhow::Result<TasksCtx> {
             tasks.register(PedmTask::new())
         }
 
+        if conf.package_broker.enabled {
+            let broker_config = BrokerTaskConfig {
+                pipe_name: conf
+                    .package_broker
+                    .pipe_name
+                    .clone()
+                    .unwrap_or_else(|| DEFAULT_PIPE_NAME.to_owned()),
+                policy_path: conf.package_broker.policy_path.clone(),
+                skip_signature_validation: conf.debug.skip_broker_signature_validation,
+            };
+            tasks.register(BrokerTask::new(broker_config));
+        }
+
         if conf.session.enabled {
             let session_manager = SessionManager::default();
             let tx = session_manager.service_event_tx();
diff --git a/devolutions-agent/src/updater/package.rs b/devolutions-agent/src/updater/package.rs
index 6484fc54c..3289c82d2 100644
--- a/devolutions-agent/src/updater/package.rs
+++ b/devolutions-agent/src/updater/package.rs
@@ -6,16 +6,10 @@ use camino::{Utf8Path, Utf8PathBuf};
 use uuid::Uuid;
 use win_api_wrappers::utils::WideString;
 
+use crate::code_signing::{certificate_sha1_thumbprint, is_devolutions_certificate_thumbprint};
 use crate::updater::io::remove_file_on_reboot;
 use crate::updater::{AGENT_UPDATE_IN_PROGRESS, Product, UpdaterCtx, UpdaterError};
 
-/// List of allowed thumbprints for Devolutions code signing certificates
-const DEVOLUTIONS_CERT_THUMBPRINTS: &[&str] = &[
-    "3f5202a9432d54293bdfe6f7e46adb0a6f8b3ba6",
-    "8db5a43bb8afe4d2ffb92da9007d8997a4cc4e13",
-    "50f753333811ff11f1920274afde3ffd4468b210",
-];
-
 /// Filename of the updater shim executable installed alongside the agent.
 const AGENT_UPDATER_SHIM_NAME: &str = "DevolutionsAgentUpdater.exe";
 
@@ -403,9 +397,7 @@ pub(crate) fn validate_package(ctx: &UpdaterCtx, path: &Utf8Path) -> Result<(),
 }
 
 fn validate_msi(ctx: &UpdaterCtx, path: &Utf8Path) -> Result<(), UpdaterError> {
-    use windows::Win32::Security::Cryptography::{
-        CALG_SHA1, CERT_CONTEXT, CertFreeCertificateContext, CryptHashCertificate,
-    };
+    use windows::Win32::Security::Cryptography::{CERT_CONTEXT, CertFreeCertificateContext};
     use windows::Win32::System::ApplicationInstallationAndServicing::{
         MSI_INVALID_HASH_IS_FATAL, MsiGetFileSignatureInformationW,
     };
@@ -458,10 +450,6 @@ fn validate_msi(ctx: &UpdaterCtx, path: &Utf8Path) -> Result<(), UpdaterError> {
         });
     }
 
-    const SHA1_HASH_SIZE: u8 = 20;
-    let mut calculated_cert_sha1 = [0u8; SHA1_HASH_SIZE as usize];
-    let mut calculated_cert_sha1_size = u32::from(SHA1_HASH_SIZE);
-
     // SAFETY: `cert_context.0` validity is checked above.
     let cert_data = unsafe { (*cert_context.0).pbCertEncoded };
     // SAFETY: `cert_context.0` validity is checked above.
@@ -475,32 +463,12 @@ fn validate_msi(ctx: &UpdaterCtx, path: &Utf8Path) -> Result<(), UpdaterError> {
         )
     };
 
-    // SAFETY: `encoded_slice` validity is ensured by `OwnedCertContext`, and `calculated_cert_sha1`
-    // and `calculated_cert_sha1_size` are valid pointers, therefore the function is safe to call.
-    unsafe {
-        CryptHashCertificate(
-            None,
-            CALG_SHA1,
-            0,
-            encoded_slice,
-            Some(&mut calculated_cert_sha1 as *mut u8),
-            &mut calculated_cert_sha1_size as *mut u32,
-        )
-    }
-    .map_err(|_| UpdaterError::MsiCertHash {
+    let calculated_cert_sha1 = certificate_sha1_thumbprint(encoded_slice).map_err(|_| UpdaterError::MsiCertHash {
         product: ctx.product,
         msi_path: path.to_owned(),
     })?;
 
-    let is_thumbprint_valid = DEVOLUTIONS_CERT_THUMBPRINTS.iter().any(|thumbprint| {
-        let mut thumbprint_bytes = [0u8; 20];
-        hex::decode_to_slice(thumbprint, &mut thumbprint_bytes)
-            .expect("BUG: Invalid thumbprint in `DEVOLUTIONS_CERT_THUMBPRINTS`");
-
-        thumbprint_bytes == calculated_cert_sha1
-    });
-
-    if !is_thumbprint_valid {
+    if !is_devolutions_certificate_thumbprint(&calculated_cert_sha1) {
         return Err(UpdaterError::MsiCertificateThumbprint {
             product: ctx.product,
             thumbprint: hex::encode(calculated_cert_sha1),

From 26094bd4cb4010ea1072d370ce9b3d15d6691f18 Mon Sep 17 00:00:00 2001
From: Vladyslav Nikonov <mail@pacmancoder.xyz>
Date: Wed, 15 Jul 2026 12:06:53 +0300
Subject: [PATCH 4/4] fix(agent): address package broker review issues

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 Cargo.lock                                    |   2 +
 devolutions-agent/Cargo.toml                  |   2 +
 devolutions-agent/src/broker/auth.rs          |  22 +-
 .../src/broker/command_builder/mod.rs         |   4 +-
 .../src/broker/command_builder/powershell.rs  | 124 +++++---
 .../src/broker/evaluator/matching.rs          |  14 +-
 .../src/broker/evaluator/version.rs           |  62 ++--
 devolutions-agent/src/broker/executor/mod.rs  |  21 +-
 .../src/broker/executor/output.rs             |   3 +
 .../src/broker/executor/windows/mod.rs        | 289 +++++++++++++-----
 .../src/broker/executor/windows/process.rs    | 106 +++++--
 .../src/broker/executor/windows/token.rs      |  21 +-
 .../src/broker/operation_tracker.rs           |  94 +++++-
 devolutions-agent/src/broker/pipe.rs          |  16 +-
 devolutions-agent/src/broker/policy_loader.rs |   5 +
 .../src/broker/policy_watcher.rs              |  14 +-
 .../src/broker/server/execution.rs            |  25 +-
 devolutions-agent/src/broker/server/mod.rs    |  62 +++-
 .../src/broker/server/responses.rs            |   2 +-
 devolutions-agent/src/broker/task.rs          |  27 +-
 20 files changed, 650 insertions(+), 265 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index b1a309844..90e924a4e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1688,6 +1688,7 @@ dependencies = [
  "rustls 0.23.42",
  "rustls-pemfile 2.2.0",
  "rustls-pki-types",
+ "semver",
  "serde",
  "serde_json",
  "serde_yaml",
@@ -1699,6 +1700,7 @@ dependencies = [
  "tokio 1.52.3",
  "tokio-rustls",
  "tokio-stream",
+ "tokio-util",
  "tonic 0.12.3",
  "tonic-build",
  "tower-service",
diff --git a/devolutions-agent/Cargo.toml b/devolutions-agent/Cargo.toml
index 727a12009..463965127 100644
--- a/devolutions-agent/Cargo.toml
+++ b/devolutions-agent/Cargo.toml
@@ -52,10 +52,12 @@ sha2 = "0.10"
 serde_json = "1"
 serde = { version = "1", features = ["derive"] }
 serde_yaml = "0.9"
+semver = "1"
 tap = "1.0"
 tempfile = "3"
 tokio-rustls = { version = "0.26", default-features = false, features = ["logging", "tls12", "ring"] }
 tokio-stream = "0.1"
+tokio-util = "0.7"
 tonic = { version = "0.12", features = ["transport"] }
 tower-service = "0.3"
 tracing = "0.1"
diff --git a/devolutions-agent/src/broker/auth.rs b/devolutions-agent/src/broker/auth.rs
index cd8acacb3..7f5fd6479 100644
--- a/devolutions-agent/src/broker/auth.rs
+++ b/devolutions-agent/src/broker/auth.rs
@@ -3,7 +3,7 @@
 use std::path::{Path, PathBuf};
 
 use anyhow::{Context as _, bail};
-use now_policy_api::PackageRequest;
+use now_policy_api::{ClientContext, PackageRequest, StatusRequest};
 use tokio::net::windows::named_pipe::NamedPipeServer;
 use tracing::{debug, warn};
 use win_api_wrappers::process::Process;
@@ -59,9 +59,25 @@ impl PipeClient {
         request: &PackageRequest,
         skip_signature_validation: bool,
     ) -> anyhow::Result<()> {
-        self.validate_effective_user(&request.client.effective_user)?;
-        self.validate_executable_path(&request.client.client_executable_path)?;
+        self.validate_client_context(&request.client)?;
+        self.validate_signature(skip_signature_validation)
+    }
+
+    pub(crate) fn validate_status_request(
+        &self,
+        request: &StatusRequest,
+        skip_signature_validation: bool,
+    ) -> anyhow::Result<()> {
+        self.validate_client_context(&request.client)?;
+        self.validate_signature(skip_signature_validation)
+    }
+
+    fn validate_client_context(&self, client: &ClientContext) -> anyhow::Result<()> {
+        self.validate_effective_user(&client.effective_user)?;
+        self.validate_executable_path(&client.client_executable_path)
+    }
 
+    fn validate_signature(&self, skip_signature_validation: bool) -> anyhow::Result<()> {
         if skip_signature_validation {
             warn!("DEBUG MODE: Skipping package broker client signature validation");
             return Ok(());
diff --git a/devolutions-agent/src/broker/command_builder/mod.rs b/devolutions-agent/src/broker/command_builder/mod.rs
index f50bd0a00..f1706fb18 100644
--- a/devolutions-agent/src/broker/command_builder/mod.rs
+++ b/devolutions-agent/src/broker/command_builder/mod.rs
@@ -12,9 +12,9 @@ use now_policy_api::{ManagerName, PackageRequest};
 /// package manager builder.
 ///
 /// Returns the command as a list of arguments (first element is the executable).
-pub fn build_command(request: &PackageRequest) -> Vec<String> {
+pub fn build_command(request: &PackageRequest) -> anyhow::Result<Vec<String>> {
     match request.manager {
-        ManagerName::Winget => winget::build_winget_command(request),
+        ManagerName::Winget => Ok(winget::build_winget_command(request)),
         ManagerName::PowerShell => powershell::build_powershell5_command(request),
         ManagerName::PowerShell7 => powershell::build_powershell7_command(request),
     }
diff --git a/devolutions-agent/src/broker/command_builder/powershell.rs b/devolutions-agent/src/broker/command_builder/powershell.rs
index 7318cc7ea..f1e6f3fc9 100644
--- a/devolutions-agent/src/broker/command_builder/powershell.rs
+++ b/devolutions-agent/src/broker/command_builder/powershell.rs
@@ -9,16 +9,17 @@
 //!
 //! The Windows executor materializes these scripts into temporary `.ps1` files before launch.
 //!
-//! Neither builder pins a `-Repository`/source: the package source is
-//! part of the policy-matched request identity, but the executed command lets the
-//! PowerShell module resolver pick the repository. Options that don't apply to
-//! PowerShell modules (interactive, custom install location, winget's no-upgrade /
-//! uninstall-previous) are intentionally omitted.
+//! Both builders bind the policy-matched request source as the PowerShell repository.
+//! Options that don't apply to PowerShell modules (interactive, custom install
+//! location, winget's no-upgrade / uninstall-previous) are intentionally omitted.
 
+use anyhow::bail;
 use now_policy_api::{Operation, PackageRequest, Scope};
 
 /// Build a Windows PowerShell 5.x (PowerShellGet) command from a validated request.
-pub fn build_powershell5_command(request: &PackageRequest) -> Vec<String> {
+pub fn build_powershell5_command(request: &PackageRequest) -> anyhow::Result<Vec<String>> {
+    validate_powershell_request(request)?;
+
     let mut script = String::new();
 
     let verb = match request.operation {
@@ -29,6 +30,7 @@ pub fn build_powershell5_command(request: &PackageRequest) -> Vec<String> {
 
     append_raw(&mut script, verb);
     append_flag_value(&mut script, "-Name", &request.package.id.0);
+    append_repository(&mut script, request)?;
     append_raw(&mut script, "-Confirm:$false");
     append_raw(&mut script, "-Force");
 
@@ -43,7 +45,7 @@ pub fn build_powershell5_command(request: &PackageRequest) -> Vec<String> {
         }
     }
 
-    if matches!(request.operation, Operation::Install) {
+    if matches!(request.operation, Operation::Install | Operation::Update) {
         if request.options.skip_hash_check {
             append_raw(&mut script, "-SkipPublisherCheck");
         }
@@ -53,22 +55,18 @@ pub fn build_powershell5_command(request: &PackageRequest) -> Vec<String> {
         }
     }
 
-    for param in &request.options.custom_parameters {
-        if !param.is_empty() {
-            append_raw(&mut script, &param.0);
-        }
-    }
-
-    vec![
+    Ok(vec![
         "powershell.exe".to_owned(),
         "-NoProfile".to_owned(),
         "-Command".to_owned(),
         script,
-    ]
+    ])
 }
 
 /// Build a PowerShell 7.x (PSResourceGet) command from a validated request.
-pub fn build_powershell7_command(request: &PackageRequest) -> Vec<String> {
+pub fn build_powershell7_command(request: &PackageRequest) -> anyhow::Result<Vec<String>> {
+    validate_powershell_request(request)?;
+
     let mut script = String::new();
 
     let verb = match request.operation {
@@ -79,15 +77,18 @@ pub fn build_powershell7_command(request: &PackageRequest) -> Vec<String> {
 
     append_raw(&mut script, verb);
     append_flag_value(&mut script, "-Name", &request.package.id.0);
+    append_repository(&mut script, request)?;
     append_raw(&mut script, "-Confirm:$false");
 
     match request.operation {
-        Operation::Install => {
+        Operation::Install | Operation::Update => {
             if let Some(version) = request.package.version.as_deref() {
                 append_flag_value(&mut script, "-Version", version);
             }
+            if matches!(request.operation, Operation::Update) {
+                append_raw(&mut script, "-Force");
+            }
         }
-        Operation::Update => append_raw(&mut script, "-Force"),
         // Uninstall removes the installed resource without pinning a version.
         Operation::Uninstall => {}
     }
@@ -106,18 +107,38 @@ pub fn build_powershell7_command(request: &PackageRequest) -> Vec<String> {
         }
     }
 
-    for param in &request.options.custom_parameters {
-        if !param.is_empty() {
-            append_raw(&mut script, &param.0);
-        }
-    }
-
-    vec![
+    Ok(vec![
         "pwsh.exe".to_owned(),
         "-NoProfile".to_owned(),
         "-Command".to_owned(),
         script,
-    ]
+    ])
+}
+
+fn validate_powershell_request(request: &PackageRequest) -> anyhow::Result<()> {
+    if request.source.url.is_some() {
+        bail!("PowerShell package sources with URLs are not supported by the broker");
+    }
+    if request.source.name.trim().is_empty() {
+        bail!("PowerShell package source name is required");
+    }
+    if let Some(param) = request.options.custom_parameters.iter().find(|param| !param.is_empty()) {
+        bail!(
+            "PowerShell custom parameters are not supported by the broker: {}",
+            param.0
+        );
+    }
+
+    Ok(())
+}
+
+fn append_repository(script: &mut String, request: &PackageRequest) -> anyhow::Result<()> {
+    let repository = request.source.name.trim();
+    if repository.is_empty() {
+        bail!("PowerShell package source name is required");
+    }
+    append_flag_value(script, "-Repository", repository);
+    Ok(())
 }
 
 fn append_raw(script: &mut String, value: &str) {
@@ -133,8 +154,8 @@ fn append_flag_value(script: &mut String, flag_or_verb: &str, value: &str) {
 }
 
 fn quote_ps(value: &str) -> String {
-    let escaped = value.replace('"', "`\"");
-    format!("\"{escaped}\"")
+    let escaped = value.replace('\'', "''");
+    format!("'{escaped}'")
 }
 
 #[cfg(test)]
@@ -198,22 +219,20 @@ mod tests {
     #[test]
     fn powershell5_install_matches_package_broker_client_semantics() {
         let request = make_request(ManagerName::PowerShell);
-        let cmd = build_powershell5_command(&request);
+        let cmd = build_powershell5_command(&request).expect("build command");
         let script = script_of(&cmd);
         assert_eq!(cmd[0], "powershell.exe");
         // verb, then -Name <id>, -Confirm:$false, -Force.
-        assert!(script.starts_with("Install-Module -Name \"Pester\" -Confirm:$false -Force"));
+        assert!(script.starts_with("Install-Module -Name 'Pester' -Repository 'PSGallery' -Confirm:$false -Force"));
         assert!(script.contains("-Scope CurrentUser"));
-        assert!(script.contains("-RequiredVersion \"5.6.0\""));
-        // The package broker client does not pin a repository for PowerShell operations.
-        assert!(!script.contains("-Repository"));
+        assert!(script.contains("-RequiredVersion '5.6.0'"));
     }
 
     #[test]
     fn powershell5_machine_scope_is_allusers() {
         let mut request = make_request(ManagerName::PowerShell);
         request.options.scope = Some(Scope::Machine);
-        let cmd = build_powershell5_command(&request);
+        let cmd = build_powershell5_command(&request).expect("build command");
         let script = script_of(&cmd);
         assert!(script.contains("-Scope AllUsers"));
     }
@@ -223,7 +242,7 @@ mod tests {
         let mut request = make_request(ManagerName::PowerShell);
         request.options.pre_release = true;
         request.options.skip_hash_check = true;
-        let cmd = build_powershell5_command(&request);
+        let cmd = build_powershell5_command(&request).expect("build command");
         let script = script_of(&cmd);
         assert!(script.contains("-AllowPrerelease"));
         assert!(script.contains("-SkipPublisherCheck"));
@@ -233,9 +252,9 @@ mod tests {
     fn powershell5_uninstall_omits_scope_and_version() {
         let mut request = make_request(ManagerName::PowerShell);
         request.operation = Operation::Uninstall;
-        let cmd = build_powershell5_command(&request);
+        let cmd = build_powershell5_command(&request).expect("build command");
         let script = script_of(&cmd);
-        assert!(script.starts_with("Uninstall-Module -Name \"Pester\""));
+        assert!(script.starts_with("Uninstall-Module -Name 'Pester' -Repository 'PSGallery'"));
         assert!(!script.contains("-Scope"));
         assert!(!script.contains("-RequiredVersion"));
         assert!(!script.contains("-SkipPublisherCheck"));
@@ -244,26 +263,25 @@ mod tests {
     #[test]
     fn powershell7_install_matches_package_broker_client_semantics() {
         let request = make_request(ManagerName::PowerShell7);
-        let cmd = build_powershell7_command(&request);
+        let cmd = build_powershell7_command(&request).expect("build command");
         let script = script_of(&cmd);
         assert_eq!(cmd[0], "pwsh.exe");
-        assert!(script.starts_with("Install-PSResource -Name \"Pester\" -Confirm:$false"));
-        assert!(script.contains("-Version \"5.6.0\""));
+        assert!(script.starts_with("Install-PSResource -Name 'Pester' -Repository 'PSGallery' -Confirm:$false"));
+        assert!(script.contains("-Version '5.6.0'"));
         assert!(script.contains("-TrustRepository"));
         assert!(script.contains("-AcceptLicense"));
         assert!(script.contains("-Scope CurrentUser"));
-        assert!(!script.contains("-Repository"));
     }
 
     #[test]
-    fn powershell7_update_uses_force_not_version() {
+    fn powershell7_update_uses_force_and_version() {
         let mut request = make_request(ManagerName::PowerShell7);
         request.operation = Operation::Update;
-        let cmd = build_powershell7_command(&request);
+        let cmd = build_powershell7_command(&request).expect("build command");
         let script = script_of(&cmd);
         assert!(script.contains("Update-PSResource"));
         assert!(script.contains("-Force"));
-        assert!(!script.contains("-Version"));
+        assert!(script.contains("-Version '5.6.0'"));
         assert!(script.contains("-TrustRepository"));
     }
 
@@ -271,9 +289,9 @@ mod tests {
     fn powershell7_uninstall_omits_version_and_trust_flags() {
         let mut request = make_request(ManagerName::PowerShell7);
         request.operation = Operation::Uninstall;
-        let cmd = build_powershell7_command(&request);
+        let cmd = build_powershell7_command(&request).expect("build command");
         let script = script_of(&cmd);
-        assert!(script.starts_with("Uninstall-PSResource -Name \"Pester\" -Confirm:$false"));
+        assert!(script.starts_with("Uninstall-PSResource -Name 'Pester' -Repository 'PSGallery' -Confirm:$false"));
         // Uninstall must not pin a version (it would remove only the matching version,
         // or fail if it does not match what is installed).
         assert!(!script.contains("-Version"));
@@ -283,11 +301,19 @@ mod tests {
     }
 
     #[test]
-    fn powershell_custom_parameters_are_appended() {
+    fn powershell_custom_parameters_are_rejected() {
         let mut request = make_request(ManagerName::PowerShell7);
         request.options.custom_parameters = vec![CustomParameterString("-Reinstall".to_owned())];
-        let cmd = build_powershell7_command(&request);
+        let error = build_powershell7_command(&request).expect_err("custom parameters should fail");
+        assert!(error.to_string().contains("custom parameters"));
+    }
+
+    #[test]
+    fn powershell_literals_escape_apostrophes() {
+        let mut request = make_request(ManagerName::PowerShell);
+        request.package.id = PackageIdentifier::from("Vendor's.Module".to_owned());
+        let cmd = build_powershell5_command(&request).expect("build command");
         let script = script_of(&cmd);
-        assert!(script.contains("-Reinstall"));
+        assert!(script.contains("-Name 'Vendor''s.Module'"));
     }
 }
diff --git a/devolutions-agent/src/broker/evaluator/matching.rs b/devolutions-agent/src/broker/evaluator/matching.rs
index 26720b93b..213ae8d08 100644
--- a/devolutions-agent/src/broker/evaluator/matching.rs
+++ b/devolutions-agent/src/broker/evaluator/matching.rs
@@ -51,20 +51,14 @@ fn scopes_match(scope: Option<Scope>, allowed: &BTreeSet<Scope>) -> bool {
     if allowed.is_empty() {
         return true;
     }
-    match scope {
-        Some(s) => allowed.contains(&s),
-        None => true, // No scope specified = don't restrict.
-    }
+    scope.is_some_and(|s| allowed.contains(&s))
 }
 
 fn architectures_match(arch: Option<Architecture>, allowed: &BTreeSet<Architecture>) -> bool {
     if allowed.is_empty() {
         return true;
     }
-    match arch {
-        Some(a) => allowed.contains(&a),
-        None => true, // No architecture specified = don't restrict.
-    }
+    arch.is_some_and(|a| allowed.contains(&a))
 }
 
 fn elevation_match(elev: Elevation, allowed: &BTreeSet<Elevation>) -> bool {
@@ -178,7 +172,7 @@ mod tests {
     }
 
     #[test]
-    fn absent_scope_or_architecture_in_request_does_not_restrict_matching() {
+    fn absent_scope_or_architecture_in_request_fails_when_rule_restricts_them() {
         let mut request = request();
         request.options.scope = None;
         request.package.architecture = None;
@@ -189,7 +183,7 @@ mod tests {
             ..Default::default()
         });
 
-        assert!(rule_matches(&rule, &request, &flags, "1.2.3"));
+        assert!(!rule_matches(&rule, &request, &flags, "1.2.3"));
     }
 
     #[test]
diff --git a/devolutions-agent/src/broker/evaluator/version.rs b/devolutions-agent/src/broker/evaluator/version.rs
index 452187fcb..f0e9185ef 100644
--- a/devolutions-agent/src/broker/evaluator/version.rs
+++ b/devolutions-agent/src/broker/evaluator/version.rs
@@ -2,6 +2,7 @@
 
 use now_policy::VersionRange;
 use now_policy_api::PackageRequest;
+use semver::Version;
 
 pub(super) fn get_effective_version(request: &PackageRequest) -> String {
     match &request.package.version {
@@ -17,47 +18,34 @@ pub(super) fn version_range_matches(version: &str, range: &Option<VersionRange>)
     if version.is_empty() {
         return false;
     }
-    if version.contains('-') && !range.include_prerelease {
+    let Ok(version) = Version::parse(version) else {
+        return false;
+    };
+
+    if !version.pre.is_empty() && !range.include_prerelease {
         return false;
     }
     if let Some(min) = &range.min_version
         && !min.is_empty()
-        && compare_versions(version, min) < 0
     {
-        return false;
+        let Ok(min) = Version::parse(min) else {
+            return false;
+        };
+        if version < min {
+            return false;
+        }
     }
     if let Some(max) = &range.max_version
         && !max.is_empty()
-        && compare_versions(version, max) > 0
     {
-        return false;
-    }
-    true
-}
-
-/// Simple numeric version comparison (e.g. "1.2.3" vs "1.2.4").
-fn compare_versions(a: &str, b: &str) -> i32 {
-    let parse = |s: &str| -> Vec<u64> {
-        s.split(['.', '-', '+'])
-            .filter_map(|part| part.parse::<u64>().ok())
-            .collect()
-    };
-
-    let va = parse(a);
-    let vb = parse(b);
-    let len = va.len().max(vb.len());
-
-    for i in 0..len {
-        let pa = va.get(i).copied().unwrap_or(0);
-        let pb = vb.get(i).copied().unwrap_or(0);
-        if pa < pb {
-            return -1;
-        }
-        if pa > pb {
-            return 1;
+        let Ok(max) = Version::parse(max) else {
+            return false;
+        };
+        if version > max {
+            return false;
         }
     }
-    0
+    true
 }
 
 #[cfg(test)]
@@ -104,4 +92,18 @@ mod tests {
             &range(Some("1.0.0"), Some("2.0.0"), true)
         ));
     }
+
+    #[test]
+    fn semantic_prerelease_ordering_is_enforced() {
+        assert!(!version_range_matches(
+            "1.0.0-alpha.2",
+            &range(Some("1.0.0-alpha.10"), None, true)
+        ));
+    }
+
+    #[test]
+    fn invalid_versions_fail_closed_when_range_is_configured() {
+        assert!(!version_range_matches("1.2", &range(Some("1.0.0"), None, false)));
+        assert!(!version_range_matches("1.2.3", &range(Some("1.0"), None, false)));
+    }
 }
diff --git a/devolutions-agent/src/broker/executor/mod.rs b/devolutions-agent/src/broker/executor/mod.rs
index 9f6fe9b2c..bb0143a98 100644
--- a/devolutions-agent/src/broker/executor/mod.rs
+++ b/devolutions-agent/src/broker/executor/mod.rs
@@ -3,6 +3,7 @@
 //! Handles running commands under the specified user identity.
 
 use async_trait::async_trait;
+use chrono::{DateTime, Utc};
 use now_policy_api::{Elevation, Scope};
 use tracing::info;
 
@@ -40,6 +41,8 @@ pub struct ExecutionContext {
     pub capture_output: bool,
 }
 
+pub type ProcessStartedCallback = std::sync::Arc<dyn Fn(DateTime<Utc>) + Send + Sync>;
+
 /// Trait for command execution strategies.
 #[async_trait]
 pub trait CommandExecutor: Send + Sync {
@@ -47,7 +50,11 @@ pub trait CommandExecutor: Send + Sync {
     ///
     /// Returns the main command's exit code and captured output on success.
     /// The method blocks (async) until the spawned process exits or a fatal error occurs during launch.
-    async fn execute(&self, ctx: &ExecutionContext) -> anyhow::Result<ExecutionOutput>;
+    async fn execute(
+        &self,
+        ctx: &ExecutionContext,
+        process_started: Option<ProcessStartedCallback>,
+    ) -> anyhow::Result<ExecutionOutput>;
 }
 
 /// Dry-run executor that only logs commands without running them.
@@ -55,13 +62,17 @@ pub struct DryRunExecutor;
 
 #[async_trait]
 impl CommandExecutor for DryRunExecutor {
-    async fn execute(&self, ctx: &ExecutionContext) -> anyhow::Result<ExecutionOutput> {
+    async fn execute(
+        &self,
+        ctx: &ExecutionContext,
+        _process_started: Option<ProcessStartedCallback>,
+    ) -> anyhow::Result<ExecutionOutput> {
         info!(
             effective_user = %ctx.effective_user,
             kill_processes = ?ctx.kill_processes,
-            pre_command = ?ctx.pre_command,
-            command = %ctx.command.join(" "),
-            post_command = ?ctx.post_command,
+            has_pre_command = ctx.pre_command.is_some(),
+            command_len = ctx.command.len(),
+            has_post_command = ctx.post_command.is_some(),
             elevation = %ctx.elevation,
             "Dry-run: would execute plan"
         );
diff --git a/devolutions-agent/src/broker/executor/output.rs b/devolutions-agent/src/broker/executor/output.rs
index 901ee1a17..131d8e179 100644
--- a/devolutions-agent/src/broker/executor/output.rs
+++ b/devolutions-agent/src/broker/executor/output.rs
@@ -1,5 +1,7 @@
 //! Output capture and exit-code helpers.
 
+use chrono::{DateTime, Utc};
+
 /// Maximum amount of captured process output retained (the tail is kept).
 pub const MAX_CAPTURED_OUTPUT_BYTES: usize = 10 * 1024;
 
@@ -9,6 +11,7 @@ pub const MAX_CAPTURED_OUTPUT_BYTES: usize = 10 * 1024;
 pub struct ExecutionOutput {
     pub exit_code: i32,
     pub stdout: String,
+    pub started_at: Option<DateTime<Utc>>,
 }
 
 /// Keep the last [`MAX_CAPTURED_OUTPUT_BYTES`] of `bytes`, decoded lossily as UTF-8.
diff --git a/devolutions-agent/src/broker/executor/windows/mod.rs b/devolutions-agent/src/broker/executor/windows/mod.rs
index 437b26dbf..4d87b0289 100644
--- a/devolutions-agent/src/broker/executor/windows/mod.rs
+++ b/devolutions-agent/src/broker/executor/windows/mod.rs
@@ -13,10 +13,10 @@ use tracing::{debug, info, warn};
 use win_api_wrappers::process::Process;
 use win_api_wrappers::security::privilege::{self, ScopedPrivileges};
 use win_api_wrappers::token::Token;
-use win_api_wrappers::utils;
+use win_api_wrappers::utils::WideString;
 use windows::Win32::Security::{TOKEN_ADJUST_PRIVILEGES, TOKEN_ALL_ACCESS, TOKEN_QUERY};
 
-use super::{CommandExecutor, ExecutionContext, ExecutionOutput};
+use super::{CommandExecutor, ExecutionContext, ExecutionOutput, ProcessStartedCallback};
 
 mod process;
 mod token;
@@ -52,7 +52,11 @@ impl WindowsExecutor {
 
 #[async_trait]
 impl CommandExecutor for WindowsExecutor {
-    async fn execute(&self, ctx: &ExecutionContext) -> anyhow::Result<ExecutionOutput> {
+    async fn execute(
+        &self,
+        ctx: &ExecutionContext,
+        process_started: Option<ProcessStartedCallback>,
+    ) -> anyhow::Result<ExecutionOutput> {
         let requires_elevation = ctx.elevation == Elevation::Elevated || ctx.scope == Some(Scope::Machine);
 
         if !self.is_system && requires_elevation {
@@ -64,13 +68,14 @@ impl CommandExecutor for WindowsExecutor {
 
         let is_system = self.is_system;
         let ctx = ctx.clone();
+        let process_started = process_started.clone();
 
         // All Win32 calls are blocking — run in a blocking thread.
         tokio::task::spawn_blocking(move || {
             if is_system {
-                execute_as_system(&ctx)
+                execute_as_system(&ctx, process_started)
             } else {
-                execute_as_current_user(&ctx)
+                execute_as_current_user(&ctx, process_started)
             }
         })
         .await
@@ -86,12 +91,14 @@ impl CommandExecutor for WindowsExecutor {
 /// 3. If elevated execution is requested, obtain the linked elevated token.
 /// 4. Set the token session ID and create the process.
 /// 5. Wait for the process to exit and return the exit code.
-fn execute_as_system(ctx: &ExecutionContext) -> anyhow::Result<ExecutionOutput> {
+fn execute_as_system(
+    ctx: &ExecutionContext,
+    process_started: Option<ProcessStartedCallback>,
+) -> anyhow::Result<ExecutionOutput> {
     let requires_elevation = ctx.elevation == Elevation::Elevated || ctx.scope == Some(Scope::Machine);
 
     info!(
         effective_user = %ctx.effective_user,
-        command = %ctx.command.join(" "),
         requires_elevation,
         "Starting SYSTEM-mode execution"
     );
@@ -132,16 +139,9 @@ fn execute_as_system(ctx: &ExecutionContext) -> anyhow::Result<ExecutionOutput>
 
     let mut execution_token = if requires_elevation {
         debug!("Attempting to get elevated token");
-        match get_elevated_token(&primary_token) {
-            Ok(elevated) => {
-                info!("Using elevated (linked) token");
-                elevated
-            }
-            Err(error) => {
-                warn!(%error, "Could not obtain elevated token, using primary");
-                primary_token
-            }
-        }
+        let elevated = get_elevated_token(&primary_token).context("failed to obtain elevated token")?;
+        info!("Using elevated (linked) token");
+        elevated
     } else {
         debug!("Using non-elevated primary token");
         primary_token
@@ -153,17 +153,12 @@ fn execute_as_system(ctx: &ExecutionContext) -> anyhow::Result<ExecutionOutput>
         .set_session_id(session_id)
         .context("failed to set token session ID")?;
 
-    info!(
-        command = %ctx.command.join(" "),
-        session_id,
-        "Running execution plan"
-    );
+    info!(session_id, "Running execution plan");
 
-    let output = run_plan(&execution_token, ctx, session_id)?;
+    let output = run_plan(&execution_token, ctx, session_id, process_started)?;
 
     info!(
         effective_user = %ctx.effective_user,
-        command = %ctx.command.join(" "),
         exit_code = output.exit_code,
         "Plan completed under user token"
     );
@@ -175,10 +170,12 @@ fn execute_as_system(ctx: &ExecutionContext) -> anyhow::Result<ExecutionOutput>
 ///
 /// Opens the current process token and uses the same `create_process_as_user`
 /// code path as SYSTEM mode, ensuring consistent behavior (environment, desktop, flags).
-fn execute_as_current_user(ctx: &ExecutionContext) -> anyhow::Result<ExecutionOutput> {
+fn execute_as_current_user(
+    ctx: &ExecutionContext,
+    process_started: Option<ProcessStartedCallback>,
+) -> anyhow::Result<ExecutionOutput> {
     info!(
         effective_user = %ctx.effective_user,
-        command = %ctx.command.join(" "),
         "Executing command as current user (dev mode)"
     );
 
@@ -188,13 +185,9 @@ fn execute_as_current_user(ctx: &ExecutionContext) -> anyhow::Result<ExecutionOu
 
     let session_id = token.session_id().context("failed to query token session ID")?;
 
-    let output = run_plan(&token, ctx, session_id)?;
+    let output = run_plan(&token, ctx, session_id, process_started)?;
 
-    info!(
-        command = %ctx.command.join(" "),
-        exit_code = output.exit_code,
-        "Plan completed under current user token"
-    );
+    info!(exit_code = output.exit_code, "Plan completed under current user token");
 
     Ok(output)
 }
@@ -204,16 +197,21 @@ fn execute_as_current_user(ctx: &ExecutionContext) -> anyhow::Result<ExecutionOu
 /// command, then an optional post-operation command (failures are logged).
 ///
 /// Returns the exit code and captured output of the main command.
-fn run_plan(token: &Token, ctx: &ExecutionContext, session_id: u32) -> anyhow::Result<ExecutionOutput> {
+fn run_plan(
+    token: &Token,
+    ctx: &ExecutionContext,
+    session_id: u32,
+    process_started: Option<ProcessStartedCallback>,
+) -> anyhow::Result<ExecutionOutput> {
     // 1. Kill requested processes (best-effort; a missing process is not an error).
     for process_name in &ctx.kill_processes {
         let kill_cmd = vec![
-            "taskkill.exe".to_owned(),
+            trusted_system32_executable("taskkill.exe"),
             "/F".to_owned(),
             "/IM".to_owned(),
             process_name.clone(),
         ];
-        match create_process(token, &kill_cmd, session_id, false) {
+        match create_process(token, &kill_cmd, session_id, false, None) {
             Ok(out) => info!(%process_name, exit_code = out.exit_code, "Kill-before-operation completed"),
             Err(error) => warn!(%process_name, %error, "Kill-before-operation failed (ignored)"),
         }
@@ -221,9 +219,9 @@ fn run_plan(token: &Token, ctx: &ExecutionContext, session_id: u32) -> anyhow::R
 
     // 2. Pre-operation command — must succeed before the main operation runs.
     if let Some(pre) = &ctx.pre_command {
-        info!(command = %pre, "Running pre-operation command");
+        info!("Running pre-operation command");
         let command = prepare_shell_command(token, pre)?;
-        let out = create_process(token, command.args(), session_id, ctx.capture_output)
+        let out = create_process(token, command.args(), session_id, ctx.capture_output, None)
             .context("failed to run pre-operation command")?;
         if out.exit_code != 0 {
             bail!(
@@ -236,13 +234,13 @@ fn run_plan(token: &Token, ctx: &ExecutionContext, session_id: u32) -> anyhow::R
 
     // 3. Main package-manager command.
     let command = prepare_main_command(token, &ctx.command)?;
-    let output = create_process(token, command.args(), session_id, ctx.capture_output)?;
+    let output = create_process(token, command.args(), session_id, ctx.capture_output, process_started)?;
 
     // 4. Post-operation command — runs after the main command; failures are logged only.
     if let Some(post) = &ctx.post_command {
-        info!(command = %post, "Running post-operation command");
+        info!("Running post-operation command");
         let command = prepare_shell_command(token, post)?;
-        match create_process(token, command.args(), session_id, false) {
+        match create_process(token, command.args(), session_id, false, None) {
             Ok(out) if out.exit_code == 0 => {}
             Ok(out) => warn!(exit_code = out.exit_code, "Post-operation command exited non-zero"),
             Err(error) => warn!(%error, "Post-operation command failed"),
@@ -253,25 +251,29 @@ fn run_plan(token: &Token, ctx: &ExecutionContext, session_id: u32) -> anyhow::R
 }
 
 fn prepare_main_command(token: &Token, command: &[String]) -> anyhow::Result<PreparedCommand> {
-    let temp_dir = user_temp_dir(token);
-    prepare_main_command_in(command, temp_dir.as_deref())
+    let user_env = win_api_wrappers::utils::environment_block(Some(token), false)
+        .context("failed to load user environment block")?;
+    prepare_main_command_in(command, None, Some(&user_env))
 }
 
-fn prepare_main_command_in(command: &[String], temp_dir: Option<&Path>) -> anyhow::Result<PreparedCommand> {
+fn prepare_main_command_in(
+    command: &[String],
+    temp_dir: Option<&Path>,
+    user_env: Option<&std::collections::HashMap<String, String>>,
+) -> anyhow::Result<PreparedCommand> {
     if let Some(script) = powershell_inline_script(command) {
         return prepare_powershell_script(command, script, temp_dir);
     }
 
     if executable_is(command, "winget.exe") {
-        return prepare_winget_script(command, temp_dir);
+        return prepare_winget_script(command, temp_dir, user_env);
     }
 
     Ok(PreparedCommand::raw(command))
 }
 
-fn prepare_shell_command(token: &Token, payload: &str) -> anyhow::Result<PreparedCommand> {
-    let temp_dir = user_temp_dir(token);
-    prepare_shell_command_in(payload, temp_dir.as_deref())
+fn prepare_shell_command(_token: &Token, payload: &str) -> anyhow::Result<PreparedCommand> {
+    prepare_shell_command_in(payload, None)
 }
 
 /// Build a `cmd.exe` invocation for a client-supplied shell payload using a temporary batch file.
@@ -286,9 +288,10 @@ fn prepare_shell_command_in(payload: &str, temp_dir: Option<&Path>) -> anyhow::R
             temp_script.path().display()
         )
     })?;
+    protect_temp_script(&temp_script)?;
 
     let command = vec![
-        "cmd.exe".to_owned(),
+        trusted_system32_executable("cmd.exe"),
         "/D".to_owned(),
         "/V:OFF".to_owned(),
         "/Q".to_owned(),
@@ -323,8 +326,14 @@ fn prepare_powershell_script(
             )
         })?;
     }
+    protect_temp_script(&temp_script)?;
 
     let mut prepared = command[..2].to_vec();
+    prepared[0] = if is_windows_powershell {
+        trusted_windows_powershell_executable()
+    } else {
+        trusted_powershell7_executable()
+    };
     prepared.push("-Command".to_owned());
     prepared.push(format!("& {}", quote_powershell_literal(&temp_script.path_string())));
 
@@ -335,14 +344,22 @@ fn powershell_script_with_utf8_preamble(script: &str) -> String {
     format!("{POWERSHELL_UTF8_ENCODING_PREAMBLE}\r\n{script}")
 }
 
-fn prepare_winget_script(command: &[String], temp_dir: Option<&Path>) -> anyhow::Result<PreparedCommand> {
+fn prepare_winget_script(
+    command: &[String],
+    temp_dir: Option<&Path>,
+    user_env: Option<&std::collections::HashMap<String, String>>,
+) -> anyhow::Result<PreparedCommand> {
     let mut script = String::new();
     script.push_str("@echo off\r\n");
     script.push_str(BATCH_UTF8_PREAMBLE);
     script.push_str("\r\nset \"NO_COLOR=1\"\r\n");
 
     let (executable, args) = command.split_first().context("empty WinGet command")?;
-    append_batch_argument(&mut script, executable)?;
+    let executable = user_env.map_or_else(
+        || Ok(executable.clone()),
+        |env| resolve_winget_executable(env).map(|path| path.display().to_string()),
+    )?;
+    append_batch_argument(&mut script, &executable)?;
     for arg in args {
         script.push(' ');
         append_batch_argument(&mut script, arg)?;
@@ -356,9 +373,10 @@ fn prepare_winget_script(command: &[String], temp_dir: Option<&Path>) -> anyhow:
             temp_script.path().display()
         )
     })?;
+    protect_temp_script(&temp_script)?;
 
     let prepared = vec![
-        "cmd.exe".to_owned(),
+        trusted_system32_executable("cmd.exe"),
         "/D".to_owned(),
         "/V:OFF".to_owned(),
         "/Q".to_owned(),
@@ -385,6 +403,77 @@ fn broker_temp_script(extension: &str, temp_dir: Option<&Path>) -> anyhow::Resul
         .context("failed to create broker temporary script")
 }
 
+fn protect_temp_script(temp_script: &TmpFileGuard) -> anyhow::Result<()> {
+    // Owner keeps full control; interactive users only need read access to execute the script.
+    const SCRIPT_DACL: &str = "D:PAI(A;;FA;;;SY)(A;;FA;;;BA)(A;;FA;;;OW)(A;;FR;;;BU)";
+    set_file_dacl(temp_script.path(), SCRIPT_DACL)
+}
+
+fn set_file_dacl(path: &Path, acl: &str) -> anyhow::Result<()> {
+    use windows::Win32::Foundation::{ERROR_SUCCESS, FALSE, HLOCAL, LocalFree};
+    use windows::Win32::Security::Authorization::{
+        ConvertStringSecurityDescriptorToSecurityDescriptorW, SDDL_REVISION_1, SE_FILE_OBJECT, SetNamedSecurityInfoW,
+    };
+    use windows::Win32::Security::{ACL, DACL_SECURITY_INFORMATION, GetSecurityDescriptorDacl, PSECURITY_DESCRIPTOR};
+
+    struct OwnedSecurityDescriptor(PSECURITY_DESCRIPTOR);
+
+    impl Drop for OwnedSecurityDescriptor {
+        fn drop(&mut self) {
+            if self.0.0.is_null() {
+                return;
+            }
+            // SAFETY: The descriptor pointer is returned by `ConvertStringSecurityDescriptorToSecurityDescriptorW`.
+            unsafe { LocalFree(Some(HLOCAL(self.0.0))) };
+        }
+    }
+
+    let acl = WideString::from(acl);
+    let mut security_descriptor = OwnedSecurityDescriptor(PSECURITY_DESCRIPTOR::default());
+
+    // SAFETY: `acl` is a valid null-terminated UTF-16 string and the output pointer is valid.
+    unsafe {
+        ConvertStringSecurityDescriptorToSecurityDescriptorW(
+            acl.as_pcwstr(),
+            SDDL_REVISION_1,
+            &mut security_descriptor.0 as *mut PSECURITY_DESCRIPTOR,
+            None,
+        )
+    }
+    .context("failed to convert broker script DACL")?;
+
+    let mut dacl_present = FALSE;
+    let mut dacl_defaulted = FALSE;
+    let mut dacl: *mut ACL = std::ptr::null_mut();
+
+    // SAFETY: All output pointers are valid and `security_descriptor` owns a valid descriptor.
+    unsafe { GetSecurityDescriptorDacl(security_descriptor.0, &mut dacl_present, &mut dacl, &mut dacl_defaulted) }
+        .context("failed to read broker script DACL")?;
+
+    if dacl.is_null() {
+        bail!("broker script DACL is null");
+    }
+
+    let path = WideString::from(path);
+    // SAFETY: `path` is a valid null-terminated UTF-16 path and `dacl` remains valid for the call.
+    let result = unsafe {
+        SetNamedSecurityInfoW(
+            path.as_pcwstr(),
+            SE_FILE_OBJECT,
+            DACL_SECURITY_INFORMATION,
+            None,
+            None,
+            Some(dacl),
+            None,
+        )
+    };
+    if result != ERROR_SUCCESS {
+        bail!("failed to set broker script DACL");
+    }
+
+    Ok(())
+}
+
 fn executable_is(command: &[String], expected_name: &str) -> bool {
     command.first().is_some_and(|executable| {
         Path::new(executable)
@@ -394,36 +483,70 @@ fn executable_is(command: &[String], expected_name: &str) -> bool {
     })
 }
 
-fn user_temp_dir(token: &Token) -> Option<PathBuf> {
-    let user_env = match utils::environment_block(Some(token), false) {
-        Ok(user_env) => user_env,
-        Err(error) => {
-            warn!(%error, "Failed to load user environment block for broker script temp path");
-            return None;
-        }
-    };
+fn quote_powershell_literal(value: &str) -> String {
+    format!("'{}'", value.replace('\'', "''"))
+}
+
+fn trusted_system32_executable(name: &str) -> String {
+    let system_root = std::env::var("SystemRoot").unwrap_or_else(|_| r"C:\Windows".to_owned());
+    PathBuf::from(system_root)
+        .join("System32")
+        .join(name)
+        .display()
+        .to_string()
+}
+
+fn trusted_windows_powershell_executable() -> String {
+    let system_root = std::env::var("SystemRoot").unwrap_or_else(|_| r"C:\Windows".to_owned());
+    PathBuf::from(system_root)
+        .join("System32")
+        .join("WindowsPowerShell")
+        .join("v1.0")
+        .join("powershell.exe")
+        .display()
+        .to_string()
+}
+
+fn trusted_powershell7_executable() -> String {
+    let program_files = std::env::var("ProgramFiles").unwrap_or_else(|_| r"C:\Program Files".to_owned());
+    PathBuf::from(program_files)
+        .join("PowerShell")
+        .join("7")
+        .join("pwsh.exe")
+        .display()
+        .to_string()
+}
 
-    let temp_dir = user_env
+fn resolve_winget_executable(env: &std::collections::HashMap<String, String>) -> anyhow::Result<PathBuf> {
+    let path_var = env
         .iter()
-        .find(|(key, _)| key.eq_ignore_ascii_case("TEMP"))
-        .or_else(|| user_env.iter().find(|(key, _)| key.eq_ignore_ascii_case("TMP")))
-        .map(|(_, value)| PathBuf::from(value));
-
-    match temp_dir {
-        Some(path) if path.is_dir() => Some(path),
-        Some(path) => {
-            warn!(path = %path.display(), "User temp path is not a directory; using default temp path");
-            None
-        }
-        None => {
-            warn!("User environment does not define TEMP or TMP; using default temp path");
-            None
+        .find(|(key, _)| key.eq_ignore_ascii_case("PATH"))
+        .map(|(_, value)| value.as_str())
+        .unwrap_or_default();
+    for dir in path_var.split(';') {
+        let candidate = PathBuf::from(dir).join("winget.exe");
+        if candidate.exists() && is_trusted_winget_path(&candidate, env) {
+            return Ok(candidate);
         }
     }
+    bail!("trusted winget.exe not found in target user PATH");
 }
 
-fn quote_powershell_literal(value: &str) -> String {
-    format!("'{}'", value.replace('\'', "''"))
+fn is_trusted_winget_path(candidate: &Path, env: &std::collections::HashMap<String, String>) -> bool {
+    let candidate = candidate.as_os_str().to_string_lossy().to_lowercase();
+    let program_files = env
+        .iter()
+        .find(|(key, _)| key.eq_ignore_ascii_case("ProgramFiles"))
+        .map(|(_, value)| value)
+        .map_or(r"C:\Program Files", |value| value)
+        .to_lowercase();
+    let local_app_data = env
+        .iter()
+        .find(|(key, _)| key.eq_ignore_ascii_case("LOCALAPPDATA"))
+        .map(|(_, value)| value.to_lowercase());
+
+    candidate.starts_with(&format!("{program_files}\\windowsapps\\"))
+        || local_app_data.is_some_and(|path| candidate == format!("{path}\\microsoft\\windowsapps\\winget.exe"))
 }
 
 fn append_batch_argument(script: &mut String, value: &str) -> anyhow::Result<()> {
@@ -503,7 +626,7 @@ mod tests {
         let temp_dir = tempfile::tempdir().expect("create temp dir");
         let command = prepare_shell_command_in("echo héllo", Some(temp_dir.path())).expect("prepare shell command");
 
-        assert_eq!(command.args()[0], "cmd.exe");
+        assert!(command.args()[0].ends_with(r"\System32\cmd.exe"));
         assert_eq!(command.args()[1], "/D");
         assert_eq!(command.args()[2], "/V:OFF");
         assert_eq!(command.args()[3], "/Q");
@@ -523,9 +646,10 @@ mod tests {
             "-Command".to_owned(),
             "Write-Output 'héllo'".to_owned(),
         ];
-        let command = prepare_main_command_in(&command, Some(temp_dir.path())).expect("prepare PowerShell command");
+        let command =
+            prepare_main_command_in(&command, Some(temp_dir.path()), None).expect("prepare PowerShell command");
 
-        assert_eq!(command.args()[0], "powershell.exe");
+        assert!(command.args()[0].ends_with(r"\System32\WindowsPowerShell\v1.0\powershell.exe"));
         assert_eq!(command.args()[1], "-NoProfile");
         assert_eq!(command.args()[2], "-Command");
         assert!(command.args()[3].starts_with("& '"));
@@ -546,9 +670,10 @@ mod tests {
             "-Command".to_owned(),
             "Write-Output 'héllo'".to_owned(),
         ];
-        let command = prepare_main_command_in(&command, Some(temp_dir.path())).expect("prepare PowerShell command");
+        let command =
+            prepare_main_command_in(&command, Some(temp_dir.path()), None).expect("prepare PowerShell command");
 
-        assert_eq!(command.args()[0], "pwsh.exe");
+        assert!(command.args()[0].ends_with(r"\PowerShell\7\pwsh.exe"));
         assert_eq!(command.args()[1], "-NoProfile");
         assert_eq!(command.args()[2], "-Command");
         assert!(command.args()[3].starts_with("& '"));
@@ -571,9 +696,9 @@ mod tests {
             "100%".to_owned(),
             "Quoted\"Value".to_owned(),
         ];
-        let command = prepare_main_command_in(&command, Some(temp_dir.path())).expect("prepare WinGet command");
+        let command = prepare_main_command_in(&command, Some(temp_dir.path()), None).expect("prepare WinGet command");
 
-        assert_eq!(command.args()[0], "cmd.exe");
+        assert!(command.args()[0].ends_with(r"\System32\cmd.exe"));
         assert_eq!(command.args()[1], "/D");
         assert_eq!(command.args()[2], "/V:OFF");
         assert_eq!(command.args()[3], "/Q");
diff --git a/devolutions-agent/src/broker/executor/windows/process.rs b/devolutions-agent/src/broker/executor/windows/process.rs
index c39f249b3..e6f4816f1 100644
--- a/devolutions-agent/src/broker/executor/windows/process.rs
+++ b/devolutions-agent/src/broker/executor/windows/process.rs
@@ -4,17 +4,20 @@ use std::io::Read as _;
 use std::path::{Path, PathBuf};
 
 use anyhow::{Context as _, bail};
-use tracing::{debug, error, info};
+use chrono::Utc;
+use tracing::{debug, error, info, warn};
 use win_api_wrappers::process::{self, StartupInfo};
 use win_api_wrappers::security::attributes::SecurityAttributesInit;
 use win_api_wrappers::token::Token;
 use win_api_wrappers::utils::{self, CommandLine, Pipe, WideString};
+use windows::Win32::Foundation::WAIT_TIMEOUT;
 use windows::Win32::System::Threading::{
     CREATE_NEW_CONSOLE, NORMAL_PRIORITY_CLASS, STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES,
 };
 use windows::Win32::UI::WindowsAndMessaging::SW_HIDE;
 
-use crate::broker::executor::{ExecutionOutput, tail_utf8};
+use crate::broker::executor::{ExecutionOutput, MAX_CAPTURED_OUTPUT_BYTES, ProcessStartedCallback, tail_utf8};
+use crate::broker::operation_tracker::OperationTracker;
 
 /// Create a process under the given token and wait for exit.
 ///
@@ -31,15 +34,11 @@ pub(super) fn create_process(
     command: &[String],
     session_id: u32,
     capture: bool,
+    process_started: Option<ProcessStartedCallback>,
 ) -> anyhow::Result<ExecutionOutput> {
     let cmd_line = CommandLine::new(command.to_vec());
 
-    debug!(
-        command_line = %command.join(" "),
-        session_id,
-        capture,
-        "Building process creation parameters"
-    );
+    debug!(session_id, capture, "Building process creation parameters");
 
     // Resolve the executable using the user's environment PATH.
     // CreateProcessAsUserW searches the CALLING process's PATH (SYSTEM) to find the
@@ -49,13 +48,7 @@ pub(super) fn create_process(
     let user_env = utils::environment_block(Some(token), false).context("failed to load user environment block")?;
 
     let exe_name = command.first().context("empty command")?;
-    let resolved_exe = resolve_executable(exe_name, &user_env).with_context(|| {
-        format!(
-            "could not find '{}' in user's PATH: {:?}",
-            exe_name,
-            user_env.get("Path").or_else(|| user_env.get("PATH"))
-        )
-    })?;
+    let resolved_exe = resolve_executable(exe_name, &user_env)?;
 
     info!(
         exe = %resolved_exe.display(),
@@ -116,7 +109,6 @@ pub(super) fn create_process(
         Err(error) => {
             error!(
                 error = format!("{error:#}"),
-                command_line = %command.join(" "),
                 exe = %resolved_exe.display(),
                 session_id,
                 "create_process_as_user failed"
@@ -130,6 +122,10 @@ pub(super) fn create_process(
             });
         }
     };
+    let started_at = Utc::now();
+    if let Some(process_started) = process_started {
+        process_started(started_at);
+    }
 
     // Close our copies of the child's handles so the read end observes EOF on exit.
     drop(held_output_write);
@@ -147,13 +143,47 @@ pub(super) fn create_process(
     let reader = output_read.map(|mut pipe| {
         std::thread::spawn(move || {
             let mut buffer = Vec::new();
-            let _ = pipe.read_to_end(&mut buffer);
+            let mut chunk = [0u8; 8192];
+            loop {
+                match pipe.read(&mut chunk) {
+                    Ok(0) => break,
+                    Ok(read) => {
+                        buffer.extend_from_slice(&chunk[..read]);
+                        if buffer.len() > MAX_CAPTURED_OUTPUT_BYTES {
+                            let excess = buffer.len() - MAX_CAPTURED_OUTPUT_BYTES;
+                            buffer.drain(..excess);
+                        }
+                    }
+                    Err(_) => break,
+                }
+            }
             buffer
         })
     });
 
-    // Wait for the process to exit (no timeout; the server enforces an overall timeout).
-    process_info.process.wait(None).context("failed to wait for process")?;
+    let timeout_ms = operation_timeout_ms();
+    if process_info
+        .process
+        .wait(Some(timeout_ms))
+        .context("failed to wait for process")?
+        == WAIT_TIMEOUT
+    {
+        warn!(
+            session_id,
+            pid = process_info.process_id,
+            timeout_ms,
+            "Process timed out; terminating"
+        );
+        process_info
+            .process
+            .terminate(1)
+            .context("failed to terminate timed-out process")?;
+        let _ = process_info.process.wait(None);
+        bail!(
+            "operation timed out after {} seconds",
+            OperationTracker::operation_timeout().as_secs()
+        );
+    }
 
     let exit_code = process_info
         .process
@@ -168,6 +198,7 @@ pub(super) fn create_process(
     Ok(ExecutionOutput {
         exit_code: exit_code as i32,
         stdout,
+        started_at: Some(started_at),
     })
 }
 
@@ -186,6 +217,10 @@ fn resolve_executable(exe_name: &str, env: &std::collections::HashMap<String, St
         bail!("executable not found at absolute path: {}", exe_path.display());
     }
 
+    if !exe_name.eq_ignore_ascii_case("winget.exe") {
+        bail!("broker command executable must be an absolute path: {exe_name}");
+    }
+
     // Get PATH from environment (case-insensitive key lookup).
     let path_var = env
         .iter()
@@ -208,11 +243,40 @@ fn resolve_executable(exe_name: &str, env: &std::collections::HashMap<String, St
             let mut candidate = PathBuf::from(dir);
             let file_name = format!("{}{}", exe_name, ext);
             candidate.push(&file_name);
-            if candidate.exists() {
+            if candidate.exists() && is_trusted_winget_path(&candidate, env) {
                 return Ok(candidate);
             }
         }
     }
 
-    bail!("executable '{}' not found in PATH", exe_name);
+    bail!("trusted executable '{exe_name}' not found in target user PATH");
+}
+
+fn operation_timeout_ms() -> u32 {
+    u32::try_from(OperationTracker::operation_timeout().as_millis()).unwrap_or(u32::MAX)
+}
+
+fn is_trusted_winget_path(candidate: &Path, env: &std::collections::HashMap<String, String>) -> bool {
+    if !candidate
+        .file_name()
+        .and_then(|name| name.to_str())
+        .is_some_and(|name| name.eq_ignore_ascii_case("winget.exe"))
+    {
+        return false;
+    }
+
+    let candidate = candidate.as_os_str().to_string_lossy().to_lowercase();
+    let program_files = env
+        .iter()
+        .find(|(key, _)| key.eq_ignore_ascii_case("ProgramFiles"))
+        .map(|(_, value)| value)
+        .map_or(r"C:\Program Files", |value| value)
+        .to_lowercase();
+    let local_app_data = env
+        .iter()
+        .find(|(key, _)| key.eq_ignore_ascii_case("LOCALAPPDATA"))
+        .map(|(_, value)| value.to_lowercase());
+
+    candidate.starts_with(&format!("{program_files}\\windowsapps\\"))
+        || local_app_data.is_some_and(|path| candidate == format!("{path}\\microsoft\\windowsapps\\winget.exe"))
 }
diff --git a/devolutions-agent/src/broker/executor/windows/token.rs b/devolutions-agent/src/broker/executor/windows/token.rs
index 1202c6d89..f59e46b8c 100644
--- a/devolutions-agent/src/broker/executor/windows/token.rs
+++ b/devolutions-agent/src/broker/executor/windows/token.rs
@@ -34,11 +34,12 @@ pub(super) fn duplicate_as_primary(token: &Token) -> anyhow::Result<Token> {
 ///
 /// `effective_user` can be `DOMAIN\user` or just `user`.
 pub(super) fn find_user_session(effective_user: &str) -> anyhow::Result<u32> {
-    let target_username = effective_user
-        .rsplit('\\')
-        .next()
-        .unwrap_or(effective_user)
-        .to_lowercase();
+    let (target_domain, target_username) = effective_user
+        .rsplit_once('\\')
+        .map_or((None, effective_user), |(domain, username)| {
+            (Some(domain.to_lowercase()), username)
+        });
+    let target_username = target_username.to_lowercase();
 
     let sessions = wts::get_sessions().context("failed to enumerate WTS sessions")?;
 
@@ -46,10 +47,20 @@ pub(super) fn find_user_session(effective_user: &str) -> anyhow::Result<u32> {
         if session.session_id == 0 {
             continue;
         }
+        if session.state != wts::WTSConnectState::Active {
+            continue;
+        }
 
         if let Ok(session_user) = wts::get_session_user_name(session.session_id)
             && session_user.to_lowercase() == target_username
         {
+            if let Some(target_domain) = &target_domain {
+                let session_domain = wts::get_session_domain_name(session.session_id)
+                    .with_context(|| format!("failed to query domain for session {}", session.session_id))?;
+                if !session_domain.eq_ignore_ascii_case(target_domain) {
+                    continue;
+                }
+            }
             return Ok(session.session_id);
         }
     }
diff --git a/devolutions-agent/src/broker/operation_tracker.rs b/devolutions-agent/src/broker/operation_tracker.rs
index e00bc1faf..38eac2949 100644
--- a/devolutions-agent/src/broker/operation_tracker.rs
+++ b/devolutions-agent/src/broker/operation_tracker.rs
@@ -8,9 +8,11 @@ use std::collections::HashMap;
 use std::sync::{Arc, Mutex};
 use std::time::Duration;
 
+use anyhow::{Context as _, bail};
 use chrono::{DateTime, Utc};
-use now_policy_api::{OperationStatus, ResourceId};
-use tokio::sync::Notify;
+use now_policy_api::{OperationStatus, PackageRequest, ResourceId};
+use sha2::{Digest as _, Sha256};
+use tokio_util::sync::CancellationToken;
 
 /// How long completed/failed operation results are retained for status queries.
 const RESULT_RETENTION: Duration = Duration::from_secs(5 * 60); // 5 minutes.
@@ -35,6 +37,8 @@ pub struct TrackedOperation {
     pub note: Option<String>,
     /// Captured combined stdout+stderr (tail-truncated), when the request opted in.
     pub stdout: Option<String>,
+    /// Authenticated operation owner.
+    pub owner_key: String,
     /// When this entry should be evicted (set upon completion/failure).
     pub expires_at: Option<DateTime<Utc>>,
 }
@@ -47,7 +51,18 @@ pub struct OperationTracker {
 
 struct TrackerState {
     operations: HashMap<String, TrackedOperation>,
-    request_index: HashMap<String, String>,
+    request_index: HashMap<RequestIndexKey, IndexedRequest>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+struct RequestIndexKey {
+    owner_key: String,
+    request_id: String,
+}
+
+struct IndexedRequest {
+    operation_id: String,
+    fingerprint: String,
 }
 
 impl Default for OperationTracker {
@@ -69,46 +84,78 @@ impl OperationTracker {
     /// Register a new operation as Starting.
     ///
     /// Returns the operation ID and whether this call created a new operation.
-    pub fn register(&self, request_id: &ResourceId, operation_id: ResourceId) -> (ResourceId, bool) {
+    pub fn register(
+        &self,
+        owner_key: &str,
+        request: &PackageRequest,
+        operation_id: ResourceId,
+    ) -> anyhow::Result<(ResourceId, bool)> {
         let mut state = self.state.lock().expect("tracker lock poisoned");
-        let request_key = request_id.to_string();
-        if let Some(existing_operation_id) = state.request_index.get(&request_key) {
-            return (ResourceId::from(existing_operation_id.as_str()), false);
+        let request_key = RequestIndexKey {
+            owner_key: owner_key.to_owned(),
+            request_id: request.request_id.to_string(),
+        };
+        let fingerprint = request_fingerprint(request)?;
+        if let Some(existing) = state.request_index.get(&request_key) {
+            if existing.fingerprint != fingerprint {
+                bail!("request id was already used by this client with a different request body");
+            }
+            return Ok((ResourceId::from(existing.operation_id.as_str()), false));
         }
 
         let operation_key = operation_id.to_string();
-        state.request_index.insert(request_key, operation_key.clone());
+        state.request_index.insert(
+            request_key,
+            IndexedRequest {
+                operation_id: operation_key.clone(),
+                fingerprint,
+            },
+        );
         state.operations.insert(
             operation_key,
             TrackedOperation {
-                request_id: request_id.clone(),
+                request_id: request.request_id.clone(),
                 status: OperationStatus::Starting,
                 started_at: None,
                 completed_at: None,
                 exit_code: None,
                 note: None,
                 stdout: None,
+                owner_key: owner_key.to_owned(),
                 expires_at: None,
             },
         );
-        (operation_id, true)
+        Ok((operation_id, true))
     }
 
     /// Mark an operation as Running (process launched).
-    pub fn mark_running(&self, request_id: &str) {
+    pub fn mark_running(&self, request_id: &str, started_at: DateTime<Utc>) {
         let mut state = self.state.lock().expect("tracker lock poisoned");
         if let Some(op) = state.operations.get_mut(request_id) {
             op.status = OperationStatus::Running;
-            op.started_at = Some(Utc::now());
+            op.started_at = Some(started_at);
         }
     }
 
     /// Mark an operation as finished with an exit code, a status note (success message or
     /// short error summary), and optionally captured output.
-    pub fn mark_completed(&self, request_id: &str, exit_code: i32, note: String, stdout: Option<String>) {
+    pub fn mark_completed(
+        &self,
+        request_id: &str,
+        exit_code: i32,
+        note: String,
+        stdout: Option<String>,
+        started_at: Option<DateTime<Utc>>,
+    ) {
         let mut state = self.state.lock().expect("tracker lock poisoned");
         if let Some(op) = state.operations.get_mut(request_id) {
             let now = Utc::now();
+            if op.started_at.is_none()
+                && let Some(started_at) = started_at
+            {
+                op.status = OperationStatus::Running;
+                op.started_at = Some(started_at);
+            }
             op.status = if exit_code == 0 {
                 OperationStatus::Completed
             } else {
@@ -141,6 +188,16 @@ impl OperationTracker {
         state.operations.get(request_id).cloned()
     }
 
+    /// Query the current state of an operation if owned by the authenticated client.
+    pub fn get_for_owner(&self, request_id: &str, owner_key: &str) -> Option<TrackedOperation> {
+        let state = self.state.lock().expect("tracker lock poisoned");
+        state
+            .operations
+            .get(request_id)
+            .filter(|operation| operation.owner_key == owner_key)
+            .cloned()
+    }
+
     /// Remove expired entries. Called periodically.
     pub fn evict_expired(&self) {
         let now = Utc::now();
@@ -152,7 +209,7 @@ impl OperationTracker {
         let retained_operation_ids: std::collections::HashSet<_> = state.operations.keys().cloned().collect();
         state
             .request_index
-            .retain(|_, operation_id| retained_operation_ids.contains(operation_id));
+            .retain(|_, request| retained_operation_ids.contains(&request.operation_id));
     }
 
     /// Returns the operation timeout duration.
@@ -161,12 +218,12 @@ impl OperationTracker {
     }
 
     /// Spawn a background task that periodically evicts expired operations.
-    pub fn spawn_eviction_task(self, shutdown: Arc<Notify>) {
+    pub fn spawn_eviction_task(self, shutdown: CancellationToken) {
         tokio::spawn(async move {
             let interval = Duration::from_secs(30);
             loop {
                 tokio::select! {
-                    _ = shutdown.notified() => break,
+                    _ = shutdown.cancelled() => break,
                     _ = tokio::time::sleep(interval) => {
                         self.evict_expired();
                     }
@@ -175,3 +232,8 @@ impl OperationTracker {
         });
     }
 }
+
+fn request_fingerprint(request: &PackageRequest) -> anyhow::Result<String> {
+    let bytes = serde_json::to_vec(request).context("failed to serialize package request for idempotency")?;
+    Ok(hex::encode(Sha256::digest(bytes)))
+}
diff --git a/devolutions-agent/src/broker/pipe.rs b/devolutions-agent/src/broker/pipe.rs
index 285a223a7..8668ad518 100644
--- a/devolutions-agent/src/broker/pipe.rs
+++ b/devolutions-agent/src/broker/pipe.rs
@@ -9,7 +9,7 @@ mod windows_pipe {
 
     use anyhow::Context as _;
     use tokio::net::windows::named_pipe::{NamedPipeServer, ServerOptions};
-    use tokio::sync::Notify;
+    use tokio_util::sync::CancellationToken;
     use tracing::{error, info, warn};
     use win_api_wrappers::identity::sid::Sid;
     use win_api_wrappers::security::acl::{Acl, ExplicitAccess, InheritableAcl, InheritableAclKind, Trustee};
@@ -26,13 +26,15 @@ mod windows_pipe {
     pub const DEFAULT_PIPE_NAME: &str = r"\\.\pipe\Devolutions.Now.PackageBroker.v1";
 
     /// Start the named pipe server and accept connections until shutdown.
-    pub async fn run_pipe_server(state: Arc<BrokerState>, shutdown: Arc<Notify>) -> anyhow::Result<()> {
+    pub async fn run_pipe_server(state: Arc<BrokerState>, shutdown: CancellationToken) -> anyhow::Result<()> {
         let pipe_name = state.pipe_name.clone();
         info!(%pipe_name, "Starting named pipe server");
 
+        let mut first_instance = true;
         loop {
             // Create a new pipe instance for each connection.
-            let server = create_pipe_instance(&pipe_name)?;
+            let server = create_pipe_instance(&pipe_name, first_instance)?;
+            first_instance = false;
 
             tokio::select! {
                 result = server.connect() => {
@@ -57,7 +59,7 @@ mod windows_pipe {
                         }
                     }
                 }
-                _ = shutdown.notified() => {
+                _ = shutdown.cancelled() => {
                     info!("Pipe server shutting down");
                     return Ok(());
                 }
@@ -65,7 +67,7 @@ mod windows_pipe {
         }
     }
 
-    fn create_pipe_instance(pipe_name: &str) -> anyhow::Result<NamedPipeServer> {
+    fn create_pipe_instance(pipe_name: &str, first_instance: bool) -> anyhow::Result<NamedPipeServer> {
         let security_attributes =
             build_pipe_security_attributes().context("failed to build pipe security attributes")?;
 
@@ -77,7 +79,7 @@ mod windows_pipe {
         // copies the descriptor at creation, so the pointer is not retained afterwards.
         let server = unsafe {
             ServerOptions::new()
-                .first_pipe_instance(false)
+                .first_pipe_instance(first_instance)
                 .create_with_security_attributes_raw(pipe_name, security_attributes.as_mut_ptr().cast())
         }?;
 
@@ -143,7 +145,7 @@ pub const DEFAULT_PIPE_NAME: &str = "not-supported-on-this-platform";
 #[cfg(not(windows))]
 pub async fn run_pipe_server(
     _state: std::sync::Arc<crate::broker::server::BrokerState>,
-    _shutdown: std::sync::Arc<tokio::sync::Notify>,
+    _shutdown: tokio_util::sync::CancellationToken,
 ) -> anyhow::Result<()> {
     anyhow::bail!("named pipe transport is only supported on Windows")
 }
diff --git a/devolutions-agent/src/broker/policy_loader.rs b/devolutions-agent/src/broker/policy_loader.rs
index ad412285d..747cf9a58 100644
--- a/devolutions-agent/src/broker/policy_loader.rs
+++ b/devolutions-agent/src/broker/policy_loader.rs
@@ -83,3 +83,8 @@ pub fn find_default_policy() -> anyhow::Result<PathBuf> {
         dir.display()
     )
 }
+
+/// Candidate default policy path used when no default policy file exists yet.
+pub fn default_policy_candidate() -> PathBuf {
+    default_policy_dir().join(format!("{POLICY_FILE_BASE}.json"))
+}
diff --git a/devolutions-agent/src/broker/policy_watcher.rs b/devolutions-agent/src/broker/policy_watcher.rs
index bb4bb5ab7..fe0d0d676 100644
--- a/devolutions-agent/src/broker/policy_watcher.rs
+++ b/devolutions-agent/src/broker/policy_watcher.rs
@@ -10,7 +10,8 @@ use std::time::Duration;
 
 use notify::{RecommendedWatcher, RecursiveMode, Watcher};
 use now_policy::PolicyDocument;
-use tokio::sync::{Notify, watch};
+use tokio::sync::watch;
+use tokio_util::sync::CancellationToken;
 use tracing::{error, info, warn};
 
 use crate::broker::policy_loader;
@@ -56,7 +57,7 @@ impl PolicyWatcher {
     /// This spawns a background task that watches the policy file's parent directory
     /// and reloads the policy when the file is modified, created, or removed.
     /// The task runs until the shutdown notify is triggered.
-    pub async fn watch(self, shutdown: Arc<Notify>) {
+    pub async fn watch(self, shutdown: CancellationToken) {
         let path = self.path.clone();
         let state_tx = self.state_tx;
         let dir = path.parent().unwrap_or_else(|| Path::new(".")).to_owned();
@@ -66,6 +67,7 @@ impl PolicyWatcher {
 
         // Set up file watcher in a blocking context.
         let watch_path = dir.clone();
+        let setup_state_tx = state_tx.clone();
         let _watcher_handle = tokio::task::spawn_blocking(move || {
             let rt_tx = fs_tx;
             let mut watcher: RecommendedWatcher =
@@ -84,12 +86,18 @@ impl PolicyWatcher {
                     Ok(watcher) => watcher,
                     Err(error) => {
                         error!(%error, "Failed to create policy file watcher");
+                        let _ = setup_state_tx.send(PolicyState::Unavailable {
+                            reason: format!("failed to create policy file watcher: {error}"),
+                        });
                         return;
                     }
                 };
 
             if let Err(error) = watcher.watch(&watch_path, RecursiveMode::NonRecursive) {
                 error!(%error, path = %watch_path.display(), "Failed to watch policy directory");
+                let _ = setup_state_tx.send(PolicyState::Unavailable {
+                    reason: format!("failed to watch policy directory {}: {error}", watch_path.display()),
+                });
                 return;
             }
 
@@ -101,7 +109,7 @@ impl PolicyWatcher {
 
         loop {
             tokio::select! {
-                _ = shutdown.notified() => {
+                _ = shutdown.cancelled() => {
                     info!("Policy watcher shutting down");
                     let _ = watcher_stop_tx.send(());
                     break;
diff --git a/devolutions-agent/src/broker/server/execution.rs b/devolutions-agent/src/broker/server/execution.rs
index 9b7c47ebd..4d3b8fd1f 100644
--- a/devolutions-agent/src/broker/server/execution.rs
+++ b/devolutions-agent/src/broker/server/execution.rs
@@ -5,7 +5,7 @@ use std::sync::Arc;
 use now_policy_api::ResourceId;
 use tracing::{error, info};
 
-use crate::broker::executor::{CommandExecutor, ExecutionContext};
+use crate::broker::executor::{CommandExecutor, ExecutionContext, ProcessStartedCallback};
 use crate::broker::operation_tracker::OperationTracker;
 
 pub(super) fn spawn_execution(
@@ -18,9 +18,13 @@ pub(super) fn spawn_execution(
     let operation_id_string = operation_id.to_string();
 
     tokio::spawn(async move {
-        let timeout = OperationTracker::operation_timeout();
-        match tokio::time::timeout(timeout, executor.execute(&context)).await {
-            Ok(Ok(output)) => {
+        let started_tracker = tracker.clone();
+        let started_operation_id = operation_id_string.clone();
+        let process_started: ProcessStartedCallback = Arc::new(move |started_at| {
+            started_tracker.mark_running(&started_operation_id, started_at);
+        });
+        match executor.execute(&context, Some(process_started)).await {
+            Ok(output) => {
                 let stdout = (!output.stdout.is_empty()).then_some(output.stdout);
                 let note = if output.exit_code == 0 {
                     "process exited successfully".to_owned()
@@ -40,22 +44,13 @@ pub(super) fn spawn_execution(
                     exit_code = output.exit_code,
                     "Background execution completed"
                 );
-                tracker.mark_completed(&operation_id_string, output.exit_code, note, stdout);
+                tracker.mark_completed(&operation_id_string, output.exit_code, note, stdout, output.started_at);
             }
-            Ok(Err(error)) => {
+            Err(error) => {
                 let note = format!("{error:#}");
                 error!(operation_id = %operation_id_string, %error, "Background execution failed");
                 tracker.mark_failed(&operation_id_string, note, None);
             }
-            Err(_elapsed) => {
-                let note = format!("operation timed out after {} seconds", timeout.as_secs());
-                error!(
-                    operation_id = %operation_id_string,
-                    timeout_secs = timeout.as_secs(),
-                    "Background execution timed out"
-                );
-                tracker.mark_failed(&operation_id_string, note, None);
-            }
         }
     });
 }
diff --git a/devolutions-agent/src/broker/server/mod.rs b/devolutions-agent/src/broker/server/mod.rs
index d403d47f2..4c51fe115 100644
--- a/devolutions-agent/src/broker/server/mod.rs
+++ b/devolutions-agent/src/broker/server/mod.rs
@@ -94,7 +94,15 @@ impl PackageBrokerServer for BrokerConnection {
     }
 
     async fn status(&self, request: StatusRequest) -> Result<StatusResponse, ErrorResponse> {
-        self.state.status(request).await
+        self.client
+            .validate_status_request(&request, self.state.skip_signature_validation)
+            .map_err(|error| {
+                warn!(error = format!("{error:#}"), "Rejected package broker status request");
+                error_response(ErrorCode::Unauthorized, "pipe client authentication failed")
+            })?;
+
+        let owner_key = request.client.owner_key();
+        self.state.status_for_client(request, owner_key).await
     }
 }
 
@@ -166,9 +174,12 @@ impl PackageBrokerServer for BrokerState {
                 capture_output: request.capture_output,
             };
 
-            let (operation_id, is_new_operation) = self.tracker.register(&request.request_id, generated_operation_id);
+            let owner_key = request.client_owner_key();
+            let (operation_id, is_new_operation) = self
+                .tracker
+                .register(&owner_key, &request, generated_operation_id)
+                .map_err(|error| error_response(ErrorCode::Conflict, format!("{error:#}")))?;
             if is_new_operation {
-                self.tracker.mark_running(&operation_id);
                 execution::spawn_execution(
                     Arc::clone(&self.executor),
                     self.tracker.clone(),
@@ -206,7 +217,22 @@ impl PackageBrokerServer for BrokerState {
     }
 
     async fn status(&self, request: StatusRequest) -> Result<StatusResponse, ErrorResponse> {
-        let Some(operation) = self.tracker.get(&request.operation_id) else {
+        self.status_for_client(request, String::new()).await
+    }
+}
+
+impl BrokerState {
+    async fn status_for_client(
+        &self,
+        request: StatusRequest,
+        owner_key: String,
+    ) -> Result<StatusResponse, ErrorResponse> {
+        let operation = if owner_key.is_empty() {
+            self.tracker.get(&request.operation_id)
+        } else {
+            self.tracker.get_for_owner(&request.operation_id, &owner_key)
+        };
+        let Some(operation) = operation else {
             return Err(error_response(ErrorCode::NotFound, "operation not found"));
         };
 
@@ -227,9 +253,7 @@ impl PackageBrokerServer for BrokerState {
                 .map(|stdout| Base64Utf8Data(base64::engine::general_purpose::STANDARD.encode(stdout))),
         })
     }
-}
 
-impl BrokerState {
     fn evaluate_request(&self, request: &PackageRequest) -> Result<EvaluatedRequest, ErrorResponse> {
         let received_at = Utc::now();
         let policy = {
@@ -284,7 +308,7 @@ impl BrokerState {
         };
 
         let command = if effective_decision == Decision::Allow {
-            build_command(request)
+            build_command(request).map_err(|error| error_response(ErrorCode::ValidationFailed, format!("{error:#}")))?
         } else {
             Vec::new()
         };
@@ -303,3 +327,27 @@ impl BrokerState {
         })
     }
 }
+
+trait ClientOwnerKey {
+    fn owner_key(&self) -> String;
+}
+
+impl ClientOwnerKey for now_policy_api::ClientContext {
+    fn owner_key(&self) -> String {
+        format!(
+            "{}|{}",
+            self.effective_user.to_lowercase(),
+            self.client_executable_path.to_lowercase()
+        )
+    }
+}
+
+trait PackageRequestClientOwner {
+    fn client_owner_key(&self) -> String;
+}
+
+impl PackageRequestClientOwner for PackageRequest {
+    fn client_owner_key(&self) -> String {
+        self.client.owner_key()
+    }
+}
diff --git a/devolutions-agent/src/broker/server/responses.rs b/devolutions-agent/src/broker/server/responses.rs
index 5d172a82c..1b25e012f 100644
--- a/devolutions-agent/src/broker/server/responses.rs
+++ b/devolutions-agent/src/broker/server/responses.rs
@@ -36,7 +36,7 @@ pub(super) fn default_manager_capabilities() -> Vec<ManagerCapability> {
             supports_custom_parameters: true,
             supports_custom_install_location: true,
             supports_capture_output: true,
-            supports_details: true,
+            supports_details: false,
             max_operation_timeout_seconds: Some(OperationTracker::operation_timeout().as_secs()),
         },
         ManagerCapability {
diff --git a/devolutions-agent/src/broker/task.rs b/devolutions-agent/src/broker/task.rs
index e10c52e61..6aa75b0a3 100644
--- a/devolutions-agent/src/broker/task.rs
+++ b/devolutions-agent/src/broker/task.rs
@@ -5,7 +5,7 @@ use std::sync::{Arc, RwLock};
 use anyhow::Context as _;
 use async_trait::async_trait;
 use devolutions_gateway_task::{ShutdownSignal, Task};
-use tokio::sync::Notify;
+use tokio_util::sync::CancellationToken;
 use tracing::{info, warn};
 
 use crate::broker::executor::{self, CommandExecutor};
@@ -57,7 +57,15 @@ impl Task for BrokerTask {
 
         let policy_path = match &self.config.policy_path {
             Some(path) => std::path::PathBuf::from(path),
-            None => policy_loader::find_default_policy().context("failed to find default broker policy")?,
+            None => policy_loader::find_default_policy().unwrap_or_else(|error| {
+                let candidate = policy_loader::default_policy_candidate();
+                warn!(
+                    %error,
+                    path = %candidate.display(),
+                    "Default broker policy is unavailable; broker will pause until this file is provided"
+                );
+                candidate
+            }),
         };
 
         // Create policy watcher with initial load attempt.
@@ -98,22 +106,23 @@ impl Task for BrokerTask {
             skip_signature_validation: self.config.skip_signature_validation,
         });
 
-        // Bridge the agent's ShutdownSignal to the Notify used by subsystems.
-        let shutdown_notify = Arc::new(Notify::new());
+        // Bridge the agent's ShutdownSignal to the cancellation token used by subsystems.
+        let shutdown = CancellationToken::new();
+        state.tracker.clone().spawn_eviction_task(shutdown.clone());
 
         // Spawn policy watcher task.
-        let watcher_shutdown = Arc::clone(&shutdown_notify);
+        let watcher_shutdown = shutdown.clone();
         tokio::spawn(async move {
             watcher.watch(watcher_shutdown).await;
         });
 
         // Spawn policy state relay: updates BrokerState when policy watcher reports changes.
         let relay_state = Arc::clone(&state);
-        let relay_shutdown = Arc::clone(&shutdown_notify);
+        let relay_shutdown = shutdown.clone();
         tokio::spawn(async move {
             loop {
                 tokio::select! {
-                    _ = relay_shutdown.notified() => break,
+                    _ = relay_shutdown.cancelled() => break,
                     result = state_rx.changed() => {
                         if result.is_err() {
                             // Sender dropped (watcher exited).
@@ -140,7 +149,7 @@ impl Task for BrokerTask {
         });
 
         // Spawn pipe server.
-        let server_shutdown = Arc::clone(&shutdown_notify);
+        let server_shutdown = shutdown.clone();
         let server_handle = tokio::spawn({
             let state = Arc::clone(&state);
             async move { crate::broker::pipe::run_pipe_server(state, server_shutdown).await }
@@ -149,7 +158,7 @@ impl Task for BrokerTask {
         // Wait for agent shutdown signal.
         shutdown_signal.wait().await;
         info!("package broker received shutdown signal");
-        shutdown_notify.notify_waiters();
+        shutdown.cancel();
 
         // Wait for the server task to finish.
         match server_handle.await {