Security
• agent：harden package broker file and executable validation (#1869) (5b0844d816) (DGW-419) (#1870) (d1bcc02e80) (#1872) (27f7fc9377) (#1889) (4e10a490f6) (#1906) (88799db384)
The Agent now validates package policy files, broker executables, signatures, ownership, and permissions before trusting them for elevated operations.
• agent：harden package broker client and execution isolation (#1871) (48f9b0c4b7) (#1873) (0e2f9a485c) (#1892) (1fe893d2b1) (#1902) (23a97845f8) (#1903) (4c4cd8792f)
The Agent now verifies the requesting Windows user, restricts temporary scripts and operation hooks, and protects the broker from connection floods.
• agent：restrict Agent Tunnel private key permissions on Windows (#1931) (f87b5d7a74)
New Agent Tunnel private keys are accessible only to SYSTEM and Administrators.
Features
• agent：add Chocolatey, Scoop, vcpkg, .NET, pip, Cargo, npm, and Bun package broker support (#1874) (8e66d24fe9) (#1876) (5e480c9804) (#1881) (235e3a29b5) (#1880) (d1c276bc57) (#1878) (911a658eed) (#1877) (3881db378e) (#1882) (f348786471) (#1879) (771cd11aae)
• agent：bundle multi-pwsh with the Windows installer (#1904) (d204d8e42b)
The Agent installer now includes the multi-pwsh executable required for PowerShell Universal integration.
• agent：publish a multi-architecture Docker container (#1912) (ec6951bcfb)
The Agent container enables PowerShell Universal by default and includes multi-pwsh support.
• agent：support package operation cancellation (#1913) (db23a516eb) (DGW-437)
Clients can cancel package operations through an asynchronous, idempotent endpoint.
• agent：stream package operation output and status updates (#1914) (f413772c4f) (DGW-438)
Clients receive live standard output, standard error, and status notifications through a dedicated channel for each operation.
• agent：[breaking] expose the active package policy (#1937) (ab34966851)
Authenticated clients can retrieve the validated active package policy through GET /v1/policy.
Package policy files must now use JSON; YAML policy files are rejected.
• dgw：download multi-clip recordings as ZIP archives (#1923) (e34e0a4b05)
GET /jet/jrec/pull/{id} streams recording.json and every clip in the session manifest as one archive.
• dgw：support VMConnect through RDCleanPath (#1372) (1c06391a0c) (Devolutions/IronRDP#1505)
• dgw：enable target-side Kerberos credential injection without debug flags (#1895) (0e91bbf503) (#1953) (f0828c91c2) (DVLS-14697)
Existing debug configuration keys still parse so deployments can upgrade without configuration errors.
• dgw：stabilize Agent Tunnel and persist authorization (#1958) (0086a50237) (#1947) (16a9cf7da4)
Agent Tunnel is now a stable, opt-in feature.
Accepted Agent identities and authorized keys persist across Gateway restarts; Agents enrolled before stabilization must be enrolled again.
• installer：configure Agent Tunnel during setup (#1969) (1b709918fe)
Administrators can enable Agent Tunnel and change its default UDP listening port of 4433.
• webapp：add ARD input-only encryption (#1965) (1eb4d47625)
• dgw,agent：route JMUX channels through connected agents (#1974) (fde0daff75)
Matching Agent Tunnel routes carry JMUX channels without falling back to direct TCP when the selected Agent route fails.
Bug Fixes
• agent：report and establish PowerShell DVC availability reliably (#1867) (27ffa7906e) (4528d093e8)
The Agent no longer advertises unavailable PowerShell execution, and transient DVC opens can retry until the negotiation deadline.
• dgw,agent：make Agent Tunnel DNS route matching explicit (#1884) ([29ec5ea5a2](https://github.com/Devolutions/devolutions-gateway/commit/29ec5ea5a20
