devops-bot-sdk 1.4.147__tar.gz → 1.4.149__tar.gz

{devops_bot_sdk-1.4.147 → devops_bot_sdk-1.4.149}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.4.147
+Version: 1.4.149
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.4.147 → devops_bot_sdk-1.4.149}/devops_bot_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.4.147
+Version: 1.4.149
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.4.147 → devops_bot_sdk-1.4.149}/sdk/__init__.py

@@ -1,6 +1,6 @@
 """AgentOS Desktop SDK — thin HTTPS/SSE client for the Electron app.
 
-Version: 1.4.147
+Version: 1.4.149
 
 Public surface:
   BackendClient.from_config()        — create client from ~/.agentos/config.toml
@@ -30,7 +30,7 @@ Rules:
   - All data egress through submit_webhook only
 """
 
-__version__ = "1.4.147"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
+__version__ = "1.4.149"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
 __author__  = "AgentOS"   # sdk.client.SDK_VERSION and the UI server version all read this.
 
 from sdk.client import BackendClient

{devops_bot_sdk-1.4.147 → devops_bot_sdk-1.4.149}/sdk/local_exec.py

@@ -244,16 +244,24 @@ def claude_cli_path() -> str | None:
     """Absolute path to the `claude` CLI, or None if it isn't on PATH.
 
     Resolution order:
-      1. ``AGENTOS_CLAUDE_CLI`` env var — explicit path override (escape hatch for
-         an install in a non-standard location).
+      1. ``AGENTOS_CLAUDE_CLI`` — explicit path override, read from the process env
+         OR ``~/.agentos/.env`` (same file as the IP allowlist). Escape hatch for an
+         install in a location the service's PATH doesn't cover.
       2. ``PATH`` (``shutil.which``) — cross-platform, no guessing.
 
-    The service must therefore RUN with a PATH that includes the CLI. The install
-    step bakes that in (see ``sdk.ui.service`` — systemd ``Environment=PATH`` /
-    launchd ``EnvironmentVariables``; Windows tasks inherit the user's PATH), so
-    ``engine=claude_code`` works without anyone editing a unit file.
+    The service normally RUNs with a PATH that includes the CLI (the install step
+    bakes that in — see ``sdk.ui.service``: systemd ``Environment=PATH`` / launchd
+    ``EnvironmentVariables``; Windows tasks inherit the user's PATH). When a unit
+    predates that or the CLI lives somewhere unusual, setting ``AGENTOS_CLAUDE_CLI``
+    in ``~/.agentos/.env`` fixes it with no unit editing.
     """
     override = os.environ.get("AGENTOS_CLAUDE_CLI", "").strip()
+    if not override:
+        try:
+            from sdk.config import _dotenv_value
+            override = (_dotenv_value("AGENTOS_CLAUDE_CLI") or "").strip()
+        except Exception:  # noqa: BLE001 — a config hiccup must never break resolution
+            override = ""
     if override and Path(override).exists():
         return override
     return shutil.which("claude")

{devops_bot_sdk-1.4.147 → devops_bot_sdk-1.4.149}/sdk/ui/ip_allowlist.py

@@ -20,16 +20,52 @@ import ipaddress
 import os
 import socket
 
+_TRUE = ("1", "true", "yes", "on")
+
+
+def _setting(name: str) -> str:
+    """Read an ``AGENTOS_UI_*`` toggle from the process env OR ``~/.agentos/.env``
+    (or a CWD ``.env``), so an operator can set it in the same file as the IP
+    allowlist without editing the service unit. Process env wins."""
+    val = os.environ.get(name, "").strip()
+    if val:
+        return val
+    try:
+        from sdk.config import _dotenv_value
+        return (_dotenv_value(name) or "").strip()
+    except Exception:  # noqa: BLE001 — a config hiccup must never break the server
+        return ""
+
 
 def public_mode() -> bool:
     """Opt-in PUBLIC mode (``AGENTOS_UI_PUBLIC=1``).
 
     When set, the SDK is a public, token-authenticated server: the IP gate is
-    lifted so Swagger (``/docs``) is browsable from any IP and every ``/api/ui/*``
-    path relies SOLELY on the ``co_`` token (``require_token``) as its credential.
-    Off by default — a plain launch stays locked to loopback + allowlisted IPs.
+    lifted so Swagger (``/docs``) is browsable from any IP over http and every
+    ``/api/ui/*`` path relies SOLELY on the ``co_`` token (``require_token``) as its
+    credential. Off by default — a plain launch stays locked to loopback +
+    allowlisted IPs. Read from the process env or ``~/.agentos/.env``.
+    """
+    return _setting("AGENTOS_UI_PUBLIC").lower() in _TRUE
+
+
+def cors_origins() -> list[str] | None:
+    """Browser (CORS) origins to allow, or ``None`` to leave CORS disabled.
+
+    Enabled when the server is PUBLIC (``AGENTOS_UI_PUBLIC=1``) or explicitly via
+    ``AGENTOS_UI_CORS=1``. Origins come from ``AGENTOS_UI_CORS_ORIGINS`` (comma/space
+    separated); default ``["*"]`` (any origin). ``*`` is safe here because every
+    data route is guarded by the ``co_`` token in the ``Authorization`` header (no
+    cookies), so a permissive origin can't be abused via ambient credentials.
+
+    Needed so a browser (e.g. Swagger "Try it out" served from another origin) can
+    call the API — without it the browser blocks the response as a CORS error.
     """
-    return os.environ.get("AGENTOS_UI_PUBLIC", "").strip().lower() in ("1", "true", "yes", "on")
+    enabled = public_mode() or _setting("AGENTOS_UI_CORS").lower() in _TRUE
+    if not enabled:
+        return None
+    raw = _setting("AGENTOS_UI_CORS_ORIGINS").replace(",", " ").split()
+    return raw or ["*"]
 
 
 def _loopback(ip: ipaddress._BaseAddress) -> bool:

{devops_bot_sdk-1.4.147 → devops_bot_sdk-1.4.149}/sdk/ui/server.py

@@ -41,6 +41,22 @@ def create_app():
     # this host's own IPs, and whitelisted IPs (the AI backend) may reach the server
     # AT ALL. Configure via AGENTOS_UI_ALLOWED_IPS or the config.toml `allowed_ips` key.
     app.add_middleware(IPAllowlistMiddleware)
+    # CORS (opt-in — on automatically in PUBLIC mode, or via AGENTOS_UI_CORS=1). Added
+    # AFTER the allowlist so it is the OUTERMOST layer: it answers browser preflight
+    # (OPTIONS) and attaches CORS headers to EVERY response — including a 403 from the
+    # allowlist — so the browser can read the real result instead of a bare "CORS
+    # error". Data routes stay guarded by the co_ token regardless.
+    from sdk.ui.ip_allowlist import cors_origins
+    _cors = cors_origins()
+    if _cors is not None:
+        from fastapi.middleware.cors import CORSMiddleware
+        app.add_middleware(
+            CORSMiddleware,
+            allow_origins=_cors,
+            allow_methods=["*"],
+            allow_headers=["*"],
+            allow_credentials=False,   # token is in the Authorization header, not cookies
+        )
     app.include_router(api_router)
 
     @app.get("/")

{devops_bot_sdk-1.4.147 → devops_bot_sdk-1.4.149}/sdk/ui/service.py

@@ -31,11 +31,24 @@ WIN_TASK = "AgentOS Control Panel"    # Windows scheduled-task name
 
 
 def _exe() -> str:
-    """Absolute path to the ``agentos-ui`` console script in this venv."""
-    bindir = Path(sys.executable).parent
+    """ABSOLUTE path to the ``agentos-ui`` console script.
+
+    Must be absolute: a service manager (systemd/launchd) does NOT search the
+    user's PATH for ExecStart, so a bare ``agentos-ui`` fails with 203/EXEC when
+    the script lives somewhere like ``~/.local/bin`` (a ``pip --user`` install) —
+    the common case on a VPS. Resolve, in order:
+      1. next to the running interpreter (venv installs),
+      2. on the current PATH (finds ``~/.local/bin`` at install time),
+      3. bare name as a last resort (kept only so install never hard-fails).
+    """
     name = "agentos-ui.exe" if IS_WINDOWS else "agentos-ui"
-    cand = bindir / name
-    return str(cand if cand.exists() else name)
+    cand = Path(sys.executable).parent / name
+    if cand.exists():
+        return str(cand)
+    found = shutil.which(name)
+    if found:
+        return str(Path(found).resolve())
+    return name
 
 
 def _run(argv: list[str]) -> tuple[int, str]: