[Gabriel Dufresne (GabrielDuf)]

Problem

When UniGetUI cannot reach the Devolutions Agent package broker, the policy inspector and brokered package operations show the same generic message ("Devolutions Agent is unavailable" / "Agent broker unavailable") no matter why. While setting the broker up on a test machine, three different problems all looked identical:

1. The Agent's package broker is disabled by default ("PackageBroker":{"Enabled":false} in agent.json), so its pipe never exists.
2. The Agent rejects a UniGetUI executable that isn't owned by an administrator-protected principal (trusted-writer check). It accepts the connection, then closes it without replying. Every self-built or user-installed copy hits this.
3. The Agent returns 401 for an unsigned client on policy management.

Each needs a different fix, and the message pointed at none of them.

Change

When the broker cannot be reached, UniGetUI now narrows down the cause:

Situation	Detection	Message
Broker not running, Agent too old, or PackageBroker disabled	\\.\pipe\Devolutions.Now.PackageBroker.v1 is absent (checked by listing the pipe namespace, which does not connect)	The Devolutions Agent package broker is not running
Agent refuses this copy of UniGetUI	Pipe exists, but the broker closed the connection before sending a single response byte	Devolutions Agent refused this copy of UniGetUI (install for all users in an admin-protected location / use an official release)
401 from policy management	Status code / Unauthorized / Unauthenticated	Existing UniGetUI is not authorized to use the Devolutions Agent text, instead of "Access to policy management was denied" (which stays for 403 / AdministratorRequired)
Anything else		Unchanged generic message

A truncated response (at least one byte received) still counts as unavailable, so a broken reply is not reported as a rejection.

• BoundedNamedPipeBrokerTransport marks a connection closed before any response byte, whether the request write fails or the first read hits EOF.
• Brokered operations use the client library's transport, which hides that distinction, so on failure they make one diagnostic health request through the bounded transport. It is skipped whenever a test transport factory is installed, so tests never contact a real Agent on the developer's machine.
• New strings are added to lang_en.json only.

Testing

• Full UniGetUI.Windows.slnx test suite passes (x64), including TUI tests. Both dotnet format whitespace and dotnet format style gates are clean.
• New tests cover a refused connection versus a truncated response over a real named pipe, a missing pipe (without connecting), 401 mapping, the operation failure dialog for each diagnosis, and the inspector titles.
• Mutation check: removing the transport's marker makes the four "refused" tests fail.
• Live check against Devolutions Agent 2026.3.3: an executable owned by the current user is diagnosed as ConnectionClosed / ClientRejected, matching the Agent's own log (failed trusted-writer security validation … is not a trusted principal).

Not covered: the request-write-failure path has no deterministic unit test, because a test pipe can't reliably close before the client writes. The live check exercises it. The inspector page was not checked visually.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

The shared transport references an exception excluded from the elevated helper’s compilation, blocking Windows builds and publishing.

1 open issue

• Move BrokerUnreachableException into shared elevated-helper sources · New

What changed in this PR

This PR adds more specific Devolutions Agent broker diagnostics to package operations and the policy inspector, helping users distinguish setup problems from client rejection.

Changes:

• Detects missing broker pipes and connections closed before any response arrives.
• Adds targeted failure messages and separates authentication failures from policy-management access denials.
• Adds transport, service, operation, and view-model tests, plus English strings.

File	Description
src/​UniGetUI.Tests/​AgentPolicyInspectorViewModelTests.cs	Tests the new inspector status titles.
src/​UniGetUI.PackageEngine.Tests/​PackageOperationsTests.cs	Tests operation failure messages for each diagnosis.
src/​UniGetUI.PackageEngine.Tests/​BrokerPolicyTransportTests.cs	Tests disconnect classification and missing-pipe detection.
src/​UniGetUI.PackageEngine.Tests/​BrokerPolicyManagementServiceTests.cs	Tests authentication and reachability status mapping.
src/​UniGetUI.PackageEngine.Tests/​BrokerFailureDescriberTests.cs	Tests descriptions for diagnosed failures.
src/​UniGetUI.PackageEngine.Operations/​PackageOperations.cs	Diagnoses broker failures before notifying users.
src/​UniGetUI.PackageEngine.AgentBroker/​PolicyWriteElevation/​Shared/​BoundedNamedPipeBrokerTransport.cs	Marks connections closed before a response arrives.
src/​UniGetUI.PackageEngine.AgentBroker/​PolicyManagement/​BrokerPolicyManagementService.cs	Maps transport and authentication failures to specific statuses.
src/​UniGetUI.PackageEngine.AgentBroker/​PolicyManagement/​BrokerPolicyManagementModels.cs	Adds diagnostic status values.
src/​UniGetUI.PackageEngine.AgentBroker/​BrokerReachability.cs	Adds pipe detection and diagnostic health requests.
src/​UniGetUI.PackageEngine.AgentBroker/​BrokerPolicyFailure.cs	Centralizes authentication-failure detection.
src/​UniGetUI.PackageEngine.AgentBroker/​BrokerFailureDescriber.cs	Provides actionable broker failure descriptions.
src/​UniGetUI.Avalonia/​ViewModels/​Pages/​SettingsPages/​AgentPolicyInspectorViewModel.cs	Displays the new inspector messages.
src/​Languages/​lang_en.json	Adds English diagnostic strings.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No blocking issues remain, and targeted regression coverage supports the diagnostic mappings, fallback behavior, and user-facing messages.

No open issues 🎉

1 resolved since last review

• Move BrokerUnreachableException into shared elevated-helper sources

_{Review effort: Balanced}

[randy-but-a-ro]

🤖 Pull request was approved automatically: the AI review is complete and all its review threads are resolved. 🎉

Integration Details

{
	"deliveryId": "ddc5b1a0-d230-11f1-9624-87480a80b3bf",
	"headSha": "69ae32e7345def1cf9d6eda3a45fb448cc03ade4",
	"reviewer": "copilot-pull-request-reviewer[bot]"
}