[Richard Markiewicz (thenextman)]

Support elevated NOW execution through Windows UAC for Run, Process, Batch, Windows PowerShell, and PowerShell 7 using now-proto-pdu 0.5.0.

Negotiate elevation support, reject requests that cannot be elevated without falling back to standard execution, report denied consent, and signal unavailable stdio redirection. Track attached elevated process exit codes and retain script files while their processes run.

[github-actions]

Let maintainers know that an action is required on their side

• Add the label release-required Please cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module) when you request a maintainer to cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module)

• Add the label release-blocker Follow-up is required before cutting a new release if a follow-up is required before cutting a new release

• Add the label publish-required Please publish libraries (`Devolutions.Gateway.Utils`, OpenAPI clients, etc) when you request a maintainer to publish libraries (Devolutions.Gateway.Utils, OpenAPI clients, etc.)

• Add the label publish-blocker Follow-up is required before publishing libraries if a follow-up is required before publishing libraries

[Richard Markiewicz (thenextman)]

Draft for review; Windows runtime validation remains outstanding. The Windows-target library and tests compile with cargo check --locked -p devolutions-session --tests --target x86_64-pc-windows-gnu; this does not execute the tests or exercise UAC consent.

Changed lines (additions / deletions):

Category	Lines
Production code	+368 / -60
Tests	+33 / -5
Other files (manifest and lockfile)	+22 / -37

Runtime review should cover consent granted/denied, channel loss or renegotiation during consent, elevated cancellation/abort failures, script lifetime, exit codes, and STARTED_NO_IO_REDIRECTION across supported execution styles. Elevated processes are not assigned to the channel job and may outlive their channel.

The touched Run path retains an existing UNTESTED property: the directory buffer must remain alive through ShellExecuteW because consuming it would leave a dangling pointer; successful launches cannot establish pointer validity.

Note

LLM-assisted content (no human feedback).

[Copilot]

🟡 Changes recommended

Stale worker notifications after capability renegotiation can remove newly reused sessions and report the wrong execution’s outcome.

4 open issues

• Filter stale worker events after capability renegotiation · New
• Wait for elevated process after notification send failure · New
• Propagate elevated cancellation posting failures · New
• Map elevation failures to portable status codes · New

What changed in this PR

Adds Windows UAC elevation support to NOW execution in the session host, using now-proto-pdu 0.5.0.

Changes:

• Negotiates elevation for Run, Process, Batch, Windows PowerShell, and PowerShell 7 requests.
• Adds asynchronous elevated launches, consent-denial reporting, and unavailable-stdio signaling.
• Tracks attached elevated process exit codes and retains temporary scripts during execution.

File	Description
devolutions-session/​src/​dvc/​task.rs	Negotiates elevation and routes elevated execution requests.
devolutions-session/​src/​dvc/​process.rs	Implements elevated launches, notifications, and process lifetime handling.
devolutions-session/​src/​dvc/​now_message_dissector.rs	Adapts decode-error handling to the updated dependency API.
devolutions-session/​Cargo.toml	Updates now-proto-pdu to 0.5.0.
crates/​win-api-wrappers/​src/​process.rs	Adds process-ID lookup and adjusts shell execution support.
Cargo.lock	Locks the protocol upgrade and consolidates IronRDP dependencies.

_{Review effort: Balanced}

[Richard Markiewicz (thenextman)]

Addressed all four Copilot findings in 59bda9a and requested another review.

Each negotiation now has its own notification channel, elevated process cleanup retains scripts until exit, cancellation errors are reported without ending process monitoring, and known elevation failures use portable NOW statuses while ordinary launch failures retain platform errors.

Current PR line counts: production Rust +415/-91; tests +217/-6; manifests and lockfile +22/-37.

Windows-target Clippy with warnings denied, formatting, and oracle-marker checks pass locally. The new Windows regression tests are compiled but have not run locally; CI is running. Interactive UAC consent, credential prompts, and real cross-integrity cancellation still need Windows runtime verification; the lifecycle tests use ordinary Windows child processes to exercise cleanup and cancellation-failure handling without prompting for elevation.

Note

LLM-assisted content (no human feedback).