feat(agent): audit package policy changes

.github/workflows/ci.yml

@@ -345,8 +345,6 @@ jobs:
           $VSINSTALLDIR = $(vswhere.exe -latest -requires Microsoft.VisualStudio.Component.VC.Llvm.Clang -property installationPath)
           Write-Output "LIBCLANG_PATH=$VSINSTALLDIR\VC\Tools\Llvm\x64\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
 
-          # Install Visual Studio Developer PowerShell Module for cmdlets such as Enter-VsDevShell
-          Install-Module VsDevShell -Force
         shell: pwsh
 
       - name: Configure Windows (arm) runner
@@ -687,9 +685,6 @@ jobs:
           # NASM is required by aws-lc-rs (used as rustls crypto backend)
           choco install nasm
 
-          # Install Visual Studio Developer PowerShell Module for cmdlets such as Enter-VsDevShell
-          Install-Module VsDevShell -Force
-
           # We need to add the NASM binary folder to the PATH manually.
           Write-Output "$Env:ProgramFiles\NASM" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
         shell: pwsh
@@ -698,9 +693,31 @@ jobs:
         id: find_mc
         if: ${{ matrix.os == 'windows' }}
         run: |
-          Enter-VsDevShell
-          $path = (Get-Command -Type Application mc).Source | Split-Path -Parent
+          $sdkRoots = @(
+            $Env:WindowsSdkDir
+            (Get-ItemPropertyValue -Path "HKLM:\SOFTWARE\Microsoft\Windows Kits\Installed Roots" -Name KitsRoot10 -ErrorAction SilentlyContinue)
+            "${Env:ProgramFiles(x86)}\Windows Kits\10"
+          ) | Where-Object { $_ } | Select-Object -Unique
+          $candidates = @()
+          if ($Env:WindowsSdkVerBinPath) {
+            $candidates += Join-Path $Env:WindowsSdkVerBinPath "mc.exe"
+            $candidates += Join-Path $Env:WindowsSdkVerBinPath "x64\mc.exe"
+          }
+          foreach ($root in $sdkRoots) {
+            $bin = Join-Path $root "bin"
+            $candidates += Join-Path $bin "x64\mc.exe"
+            $candidates += Get-ChildItem -LiteralPath $bin -Directory -ErrorAction SilentlyContinue |
+              Where-Object Name -Match '^\d+\.\d+\.\d+\.\d+$' |
+              Sort-Object { [version]$_.Name } -Descending |
+              ForEach-Object { Join-Path $_.FullName "x64\mc.exe" }
+          }
+          $mc = $candidates | Where-Object { Test-Path -LiteralPath $_ -PathType Leaf } | Select-Object -First 1
+          if (-Not $mc) {
+            throw "mc.exe was not found in the installed Windows SDK"
+          }
+          $path = Split-Path -Parent $mc
           Write-Output "windows_sdk_ver_bin_path=$path" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
+          Write-Output $path | Out-File -FilePath $env:GITHUB_PATH -Append -Encoding utf8
         shell: pwsh
 
       - name: Build
@@ -966,6 +983,37 @@ jobs:
         if: ${{ matrix.os == 'windows' }}
         uses: microsoft/setup-msbuild@v3
 
+      - name: Find mc.exe
+        id: find_mc
+        if: ${{ matrix.os == 'windows' }}
+        run: |
+          $sdkRoots = @(
+            $Env:WindowsSdkDir
+            (Get-ItemPropertyValue -Path "HKLM:\SOFTWARE\Microsoft\Windows Kits\Installed Roots" -Name KitsRoot10 -ErrorAction SilentlyContinue)
+            "${Env:ProgramFiles(x86)}\Windows Kits\10"
+          ) | Where-Object { $_ } | Select-Object -Unique
+          $candidates = @()
+          if ($Env:WindowsSdkVerBinPath) {
+            $candidates += Join-Path $Env:WindowsSdkVerBinPath "mc.exe"
+            $candidates += Join-Path $Env:WindowsSdkVerBinPath "x64\mc.exe"
+          }
+          foreach ($root in $sdkRoots) {
+            $bin = Join-Path $root "bin"
+            $candidates += Join-Path $bin "x64\mc.exe"
+            $candidates += Get-ChildItem -LiteralPath $bin -Directory -ErrorAction SilentlyContinue |
+              Where-Object Name -Match '^\d+\.\d+\.\d+\.\d+$' |
+              Sort-Object { [version]$_.Name } -Descending |
+              ForEach-Object { Join-Path $_.FullName "x64\mc.exe" }
+          }
+          $mc = $candidates | Where-Object { Test-Path -LiteralPath $_ -PathType Leaf } | Select-Object -First 1
+          if (-Not $mc) {
+            throw "mc.exe was not found in the installed Windows SDK"
+          }
+          $path = Split-Path -Parent $mc
+          Write-Output "windows_sdk_ver_bin_path=$path" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
+          Write-Output $path | Out-File -FilePath $env:GITHUB_PATH -Append -Encoding utf8
+        shell: pwsh
+
       - name: Build
         run: |
           if ($Env:RUNNER_OS -eq "Windows") {
@@ -976,6 +1024,7 @@ jobs:
             $Env:DAGENT_TUN2SOCKS_EXE = "${{ steps.tun2socks.outputs.tun2socks-executable-path }}"
             $Env:DAGENT_WINTUN_DLL = "${{ steps.tun2socks.outputs.wintun-library-path }}"
             $Env:DAGENT_MULTI_PWSH_EXECUTABLE = "${{ steps.multi-pwsh.outputs.executable-path }}"
+            $Env:WindowsSdkVerBinPath = '${{ steps.find_mc.outputs.windows_sdk_ver_bin_path }}'
           }
 
           if ($Env:RUNNER_OS -eq "Linux") {

crates/now-package-broker/Cargo.toml

@@ -39,6 +39,9 @@ regex = "1"
 semver = "1"
 serde_json = "1"
 sha2 = "0.10"
+sysevent = { path = "../sysevent" }
+sysevent-codes = { path = "../sysevent-codes" }
+sysevent-winevent = { path = "../sysevent-winevent" }
 tokio = { version = "1.52", features = ["net", "io-util", "rt", "macros", "parking_lot", "fs", "sync", "time"] }
 tokio-util = "0.7"
 tower-service = "0.3"