[Marc-André Moreau (mamoreau-devolutions)]

The package broker only reported PowerShell 7 as available when the MSI installation existed under Program Files, so machines with the Microsoft Store installation could not broker PowerShell 7 operations. The broker now falls back to the user's pwsh.exe app execution alias, validated against the Microsoft.PowerShell package family like the winget.exe alias, and launches the WindowsApps target it pinned during that validation.

Several generated PowerShell commands passed parameters the cmdlets do not accept, so those operations always failed: -Repository on Uninstall-PSResource, Uninstall-Module and Update-Module, and -SkipPublisherCheck on Update-Module. Those commands act on installed modules, and Update-Module updates from the repository a module was installed from, so they now first check that every installed version, prereleases included, came from the policy-matched source and fail otherwise.

🤖 Generated with Claude Code

[Marc-André Moreau (mamoreau-devolutions)]

Lines changed:

Area	Added	Removed
Production code	158	18
Tests	194	14
Other files	0	0

Validation:

• Checked the cmdlet parameters against PSResourceGet 1.2.0 and PowerShellGet 2.2.5 / 1.0.0.1.
• Ran the generated installed-repository checks in real hosts (Windows PowerShell with PowerShellGet 2.2.5 and 1.0.0.1, and pwsh 7.6.9): a matching repository proceeds, a different repository and a missing module both exit with code 1.
• The opportunistic pwsh_app_exec_alias_resolves_to_windowsapps_target test resolved and pinned a real Store pwsh.exe alias locally.
• Known gap: the inbox PowerShellGet 1.0.0.1 has no -Scope or -AllowPrerelease on Update-Module, so Windows PowerShell updates still require PowerShellGet 2.x.

[github-actions]

Let maintainers know that an action is required on their side

• Add the label release-required Please cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module) when you request a maintainer to cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module)

• Add the label release-blocker Follow-up is required before cutting a new release if a follow-up is required before cutting a new release

• Add the label publish-required Please publish libraries (`Devolutions.Gateway.Utils`, OpenAPI clients, etc) when you request a maintainer to publish libraries (Devolutions.Gateway.Utils, OpenAPI clients, etc.)

• Add the label publish-blocker Follow-up is required before publishing libraries if a follow-up is required before publishing libraries

[Copilot]

🟡 Changes recommended

The review found an issue that should be addressed before approval.

3 open issues

• Policy matching still uses request.source.name (evaluator/matching.rs:31), but uninstall now… · New
• The new repository preflight omits -AllowPrerelease, although the subsequent Update-Module… · New
• The Store fallback drops the verified executable guard and returns the user-writable alias path. If… · New

What changed in this PR

This PR adds Microsoft Store PowerShell 7 discovery to the package broker and corrects unsupported PowerShell cmdlet arguments.

Changes:

• Fall back to the target user’s pwsh.exe alias when the MSI installation is absent.
• Extend alias validation to the Microsoft PowerShell package family.
• Remove unsupported parameters and check the installed repository before Windows PowerShell updates.

File	Description
crates/​now-package-broker/​src/​policy_security.rs	Adds PowerShell alias identity validation and tests.
crates/​now-package-broker/​src/​executor/​windows/​mod.rs	Adds Store PowerShell discovery for availability checks and command preparation.
crates/​now-package-broker/​src/​command_builder/​powershell.rs	Corrects cmdlet arguments and adds update repository checks and regression tests.

_{Review effort: Balanced}