[Marc-André Moreau (mamoreau-devolutions)]

Keep NOW available across Agent restarts, RDP reconnects and transport failures. Discover active remote sessions at service startup and launch missing hosts under the user's token, or adopt hosts that already run. Wait for the previous host to terminate before replacing it, and retry failed recovery attempts with bounded backoff.

Reopen lost dynamic virtual channels, use overlapped reads and writes, and apply backpressure instead of dropping inbound messages. Write child stdin independently of output draining so a child that writes output before reading input does not deadlock the host.

Preserve normal channel shutdown as a successful host exit and relaunch watched hosts only after failures. Report malformed or short channel reads as errors, observe transport loss even while stdin is blocked, and bound I/O teardown before opening another channel.

While inbound messages are held back, no read is pending, so a lost client would go unnoticed. Probe such a channel with heartbeats only when the client enables them; otherwise no probe is sent. If the inbound backlog makes no progress, fail the channel after 30 seconds.

End attached executions with their channel. Each starts suspended and joins a kill-on-close job owned by the channel, so it and every process it starts are killed when the channel ends, is renegotiated, or the host exits. A process that cannot join the job is killed and the execution fails. Detached executions stay outside the job and keep running. Processes left running by an attached execution that already exited are killed with the channel too.

Return right after detached execution launches instead of setting up attached IO, which panicked the host for detached Process requests without temporary files. Keep the Run directory string alive while ShellExecuteW reads it.

Co-authored-by: Copilot App 223556219+Copilot@users.noreply.github.com

[github-actions]

Let maintainers know that an action is required on their side

• Add the label release-required Please cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module) when you request a maintainer to cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module)

• Add the label release-blocker Follow-up is required before cutting a new release if a follow-up is required before cutting a new release

• Add the label publish-required Please publish libraries (`Devolutions.Gateway.Utils`, OpenAPI clients, etc) when you request a maintainer to publish libraries (Devolutions.Gateway.Utils, OpenAPI clients, etc.)

• Add the label publish-blocker Follow-up is required before publishing libraries if a follow-up is required before publishing libraries

[Marc-André Moreau (mamoreau-devolutions)]

Draft while controlled Windows RDP acceptance and test-oracle cleanup remain outstanding.

Change weight against cf6b76ff (added/deleted lines; Rust test-module boundaries separate tests from shipping code):

Area	Added	Deleted
Production Rust	1,132	311
Tests	1,207	20
Other files (Cargo features)	3	0

Validation: 31 session-manager tests pass, including 15 consecutive runs of the complete targeted suite; all 41 session tests pass; targeted all-target Clippy passes with warnings denied. Windows incremental-cache permission warnings remain environmental. Both x64 executables build with the production profile and RUSTFLAGS=-C target-feature=+crt-static; PE normal and delay imports have no dynamic MSVC/UCRT dependency. Static review found four recovery races, which were corrected and re-reviewed with no significant remaining findings.

The startup regression was observed failing before discovery was added, and the queued-reconnect regression failed without the WTS recheck. Isolated mutations disabling the reconnect recheck, discarding queued SCM events, and disconnecting watcher notifications were caught by the respective regressions. The large-stdin regression also catches a mutant that stops draining output until the stdin writer finishes.

UNTESTED properties requiring live checks:

• SCM session notifications remain registered and queued while startup enumeration runs (session_manager.rs).
• Process watchers remain detached, unjoined standard threads rather than Tokio blocking-pool tasks, so a live session process cannot hold service shutdown open (session_manager.rs).
• A pending relaunch timer is never awaited during service shutdown (session_manager.rs).
• Failed-channel teardown releases the WTS handle before reopening, and a stalled overlapped cancellation is bounded by the host-failure watchdog while its IO buffers remain owned by the IO thread (dvc/task.rs).

Remaining limits: adopted hosts are not watched; abort/cancel messages behind backpressured stdin still wait; a reconnect termination timeout retains pending termination until another readiness event retries it; repeated failures eventually wait for logon/unlock rather than looping indefinitely. No candidate has been deployed by this change. The existing oracle: scaffold assertions still need independent sources, mutation justification, or removal before merge.

Production candidate: Agent SHA256 3593551D66C6704D2AB4896184129B5D653BE300BD1FAA48DF7CBD457CAF9111 (25,140,224 bytes); Session SHA256 C00CE72C2806B29E913D0F6457A7BDE0C7B0BEA3F3D8D233AECC88D7C16C77EB (3,511,808 bytes). These supersede earlier experimental candidates.

Note

LLM-assisted content (no human feedback).

[Copilot]

🟡 Changes recommended

Transport-loss detection, pre-launch retries, and I/O teardown still have unresolved failure paths that can prevent recovery or retain resources.

4 open issues

• Transport recovery stalls when queues are saturated · New
• Treat already-terminated process as successful termination · New
• Retry startup and reconnect recovery failures · New
• Blocked stdin writer leaks resources after session teardown · New

What changed in this PR

This PR improves NOW channel availability by adding Agent-side host recovery and making session transport and child-process I/O more resilient.

Changes:

• Discover active RDP sessions at startup and recover failed hosts with bounded retries.
• Reopen lost channels, use overlapped I/O, and preserve inbound messages through backpressure.
• Separate child stdin writes from output draining and propagate task failures through process exit codes.

File	Description
devolutions-session/​src/​main.rs	Return failure exit codes when session tasks fail.
devolutions-session/​src/​dvc/​task.rs	Coordinate channel recovery, teardown, and pending stdin sends.
devolutions-session/​src/​dvc/​process.rs	Move stdin writes to dedicated threads and test output/input progress.
devolutions-session/​src/​dvc/​io.rs	Add overlapped writes, inbound backpressure, cancellation, and transport tests.
devolutions-session/​Cargo.toml	Enable required Windows API features.
devolutions-agent/​src/​session_manager.rs	Discover sessions, watch hosts, and schedule recovery.
crates/​win-api-wrappers/​src/​wts.rs	Identify sessions using RDP.
crates/​win-api-wrappers/​src/​process.rs	Support waiting for process termination before replacement.

_{Review effort: Balanced}

[Marc-André Moreau (mamoreau-devolutions)]

Lines changed against master at 4db88457:

Category	Added	Removed
Production code	1342	381
Tests	1557	24
Other files (Cargo.toml)	4	0

Tests are counted from each Rust file's #[cfg(test)] module onward.

Note

LLM-assisted content (no human feedback).

[Marc-André Moreau (mamoreau-devolutions)]

Properties no test checks, each marked UNTESTED: at the code:

• devolutions-agent/src/session_manager.rs:451: SCM delivers session changes while the startup WTS enumeration runs.
• devolutions-agent/src/session_manager.rs:654: the host exit watcher is a detached std::thread that is never joined, so stopping the service is not held up by a running host.
• devolutions-agent/src/session_manager.rs:694: the relaunch timer is a detached task, so stopping the service is not held up by a pending relaunch.
• devolutions-session/src/dvc/io.rs:280: the backlog probe waits for any pending write and stays spaced by BACKLOG_PROBE_INTERVAL.
• devolutions-session/src/dvc/process.rs:810: a process that cannot join its channel's job, or cannot resume, is killed rather than left running.
• devolutions-session/src/dvc/task.rs:239: a failed channel's IO thread releases the WTS handle before a reopen, and a thread that does not stop ends the process.
• devolutions-session/src/dvc/task.rs:935: the Run directory buffer stays alive through ShellExecuteW.
• devolutions-session/src/main.rs:84: the host exits with a failure code exactly when a task failed or panicked.

Killing an attached execution tree when the host itself crashes relies on the OS closing the job handle; the tests cover only channel loss inside a running host.

Note

LLM-assisted content (no human feedback).

[Marc-André Moreau (mamoreau-devolutions)]

Change weight in b0bf2e27:

• Production (274 added, 49 removed): DVC backlog timeout, session-start retry state, blocked stdin-writer cleanup, and process-termination race handling across io.rs, session_manager.rs, process.rs, and win-api-wrappers/src/process.rs.
• Tests (232 added): regressions for saturated DVC queues, startup/reconnect recovery, process termination status, and blocked stdin-writer teardown.
• Other files: none.

Note

Human-tuned, LLM-assisted content.