devops-bot-sdk 1.6.38__tar.gz → 1.6.39__tar.gz

{devops_bot_sdk-1.6.38 → devops_bot_sdk-1.6.39}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.6.38
+Version: 1.6.39
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.6.38 → devops_bot_sdk-1.6.39}/devops_bot_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.6.38
+Version: 1.6.39
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.6.38 → devops_bot_sdk-1.6.39}/devops_bot_sdk.egg-info/SOURCES.txt

@@ -169,6 +169,7 @@ tests/test_resume.py
 tests/test_router.py
 tests/test_run_auto_agent_only.py
 tests/test_run_outputs.py
+tests/test_run_verdict_is_honest.py
 tests/test_schedule_api.py
 tests/test_scheduler.py
 tests/test_self_report.py
@@ -184,6 +185,7 @@ tests/test_ui_gate.py
 tests/test_ui_lifespan.py
 tests/test_update_timer.py
 tests/test_updater_extras.py
+tests/test_updater_reports_the_truth.py
 tests/test_url_access.py
 tests/test_vps_health.py
 tests/test_write_hook.py

{devops_bot_sdk-1.6.38 → devops_bot_sdk-1.6.39}/sdk/__init__.py

@@ -34,7 +34,7 @@ Rules:
   - All data egress through submit_webhook only
 """
 
-__version__ = "1.6.38"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
+__version__ = "1.6.39"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
 __author__  = "AgentOS"   # sdk.client.SDK_VERSION and the UI server version all read this.
 
 from sdk.client import BackendClient

{devops_bot_sdk-1.6.38 → devops_bot_sdk-1.6.39}/sdk/ipc/handlers.py

@@ -2083,10 +2083,20 @@ async def _run_local_pipeline(
             await asyncio.sleep(_KICKOFF_BACKOFF_S * kick_attempt)
 
     if not session_id:
+        # Name the call and the window. "ReadTimeout" on its own reads like a
+        # local fault and gets diagnosed as one (a proxy, a permissions problem,
+        # the wrong user account); what it actually means here is that the backend
+        # accepted the connection and then did not ack the kickoff in time.
+        detail = last_error
+        if "Timeout" in last_error:
+            detail = (f"{last_error} — POST /api/v1/orchestrate connected but sent "
+                      f"no session_id within {_kick_read_s:.0f}s. The backend is "
+                      f"slow or wedged, not this machine; raise the window with "
+                      f"AGENTOS_ORCHESTRATE_KICKOFF_TIMEOUT_S if it is merely slow.")
         await send(_error_envelope(
             thread_id,
             RuntimeError(
-                f"orchestrate failed after {_KICKOFF_ATTEMPTS} attempt(s): {last_error}"
+                f"orchestrate failed after {_KICKOFF_ATTEMPTS} attempt(s): {detail}"
             ),
         ).model_dump())
         return
@@ -5212,10 +5222,21 @@ async def handle_orchestrate_auto_local_run(
                 ).model_dump())
                 continue
 
+        # The run's status is what it ACHIEVED, not the fact that the loop reached
+        # its end. Every per-task failure above is handled (logged, ticket moved to
+        # Backlog, `continue`) so the loop always arrives here — and reporting that
+        # as "completed" told an operator whose only ticket had just died on a
+        # kickoff timeout that the run had succeeded, with `processed: 0` the sole
+        # contradicting evidence. `processed` counts the tasks that were actually
+        # carried through, so it is the honest basis for the verdict.
+        status = ("completed" if processed == total
+                  else "failed" if processed == 0
+                  else "partial")
         await send(Envelope(
             type=Envelope.TYPE_DONE, thread_id=thread_id,
-            data={"mode": "orchestrate-auto-local", "status": "completed",
-                  "processed": processed, "task_count": total},
+            data={"mode": "orchestrate-auto-local", "status": status,
+                  "processed": processed, "task_count": total,
+                  "failed": total - processed},
         ).model_dump())
 
     except Exception as exc:

{devops_bot_sdk-1.6.38 → devops_bot_sdk-1.6.39}/sdk/platform_compat.py

@@ -9,6 +9,37 @@ from __future__ import annotations
 import os
 import sys
 
+#: Non-cp1252 glyphs the SDK prints → an ASCII stand-in. See :func:`safe_print`.
+_ASCII_FALLBACK = str.maketrans({
+    "✓": "OK", "✗": "x", "→": "->", "↻": "~", "⚠": "!", "…": "...",
+    "▶": ">", "•": "-", "⏸": "||", "·": "-", "◐": "~",
+})
+
+
+def safe_print(message: str = "") -> None:
+    """``print`` that cannot take a command down on a legacy Windows codepage.
+
+    :func:`ensure_utf8_stdio` is the real fix and every entry point installs it.
+    This is the backstop for the case it cannot reach: a stdout with no
+    ``reconfigure`` (pythonw, or a stream already swapped for a plain file
+    object), where the first ``✓``/``▶`` still raises ``UnicodeEncodeError``.
+
+    Worth the belt and braces because the failure mode is not a garbled line but
+    a dead run — and it lands in the two places that hurt most. In the updater,
+    the banner prints BEFORE the upgrade that would fix it, so the crash recurs
+    on every run and the release that repairs it can never install itself. In
+    ``run_auto._send``, the glyph raises inside the ERROR handler, so the real
+    error is replaced by a UnicodeEncodeError traceback and is never seen at all.
+    """
+    try:
+        print(message)
+    except UnicodeEncodeError:
+        try:
+            print(message.translate(_ASCII_FALLBACK))
+        except UnicodeEncodeError:
+            # A glyph outside the table (engine output echoed into the line).
+            print(message.encode("ascii", "replace").decode("ascii"))
+
 
 def ensure_utf8_stdio() -> None:
     """Make stdout/stderr able to carry the SDK's ``✓ ↻ → ⚠`` glyphs ANYWHERE.

{devops_bot_sdk-1.6.38 → devops_bot_sdk-1.6.39}/sdk/run_auto.py

@@ -67,6 +67,10 @@ import os
 import sys
 from pathlib import Path
 
+# Import-cheap and dependency-free. safe_print degrades ✓/▶/✗ to ASCII when the
+# stream cannot hold them — the backstop behind ensure_utf8_stdio; see _send.
+from sdk.platform_compat import safe_print as _print
+
 _AGENTOS_DIR = Path.home() / ".agentos"
 _STOP_FILE = _AGENTOS_DIR / "auto.stop"
 _PID_FILE = _AGENTOS_DIR / "auto.pid"
@@ -540,8 +544,8 @@ def _run_report(argv: list[str]) -> None:
     mirrored into ``~/.agentos/auto.log`` so it is visible in
     ``agentos-auto logs -f``, which is where the summary line lands anyway.
     """
-    from sdk.exceptions import TokenNotConfigured
     from sdk import self_report
+    from sdk.exceptions import TokenNotConfigured
 
     texts = _flag_values(argv, "--text")
     files = _flag_values(argv, "--file")
@@ -911,6 +915,14 @@ _current_task: str | None = None
 
 
 async def _send(env: dict) -> None:
+    """Render one pipeline envelope to the console.
+
+    Prints through :func:`~sdk.platform_compat.safe_print`, not ``print``. Every
+    line here carries a glyph cp1252 cannot hold, and this function is where a
+    Windows encoding crash did the most damage: the ``✗`` below runs INSIDE the
+    handler's error path, so a stdout the shim could not reconfigure turned every
+    real failure into a UnicodeEncodeError traceback with the actual error lost.
+    """
     etype = env.get("type", "")
     data = env.get("data", {}) or {}
 
@@ -930,22 +942,22 @@ async def _send(env: dict) -> None:
             # A task-file run has nothing to do with the ticket queue; calling it
             # "orchestrate-auto" in the log sends the reader looking for a board.
             repos = ", ".join(Path(r).name for r in (data.get("repos") or []))
-            print(f"\n▶ plan (no ticket) — {data.get('title') or 'task file'}"
+            _print(f"\n▶ plan (no ticket) — {data.get('title') or 'task file'}"
                   + (f" · {repos}" if repos else "") + "\n")
         else:
-            print(f"\n▶ orchestrate-auto (local) — {data.get('task_count', 0)} task(s)\n")
+            _print(f"\n▶ orchestrate-auto (local) — {data.get('task_count', 0)} task(s)\n")
     elif etype == "step_update":
         step = data.get("current_step", "")
         pp = data.get("project_path")
-        print(f"  • {step}" + (f"   [{pp}]" if pp else "") + _agent_suffix(data))
+        _print(f"  • {step}" + (f"   [{pp}]" if pp else "") + _agent_suffix(data))
     elif etype == "awaiting_approval":
-        print(f"  ⏸ approval gate: {data.get('summary', data.get('jira_key', ''))}")
+        _print(f"  ⏸ approval gate: {data.get('summary', data.get('jira_key', ''))}")
     elif etype == "error":
-        print(f"  ✗ {data.get('message') or data.get('code') or data}")
+        _print(f"  ✗ {data.get('message') or data.get('code') or data}")
     elif etype == "done" and data.get("mode") == "plan-local":
         status = data.get("status", "")
         mark = {"completed": "✓", "partial": "◐"}.get(status, "✗")
-        print(f"\n{mark} plan {status} — {data.get('files_changed', 0)} file(s) changed")
+        _print(f"\n{mark} plan {status} — {data.get('files_changed', 0)} file(s) changed")
         for repo in data.get("repos") or []:
             line = f"   {'✓' if repo.get('succeeded') else '✗'} {Path(repo.get('repo') or '').name}"
             if repo.get("branch"):
@@ -954,19 +966,27 @@ async def _send(env: dict) -> None:
                 line += f" · {repo['pr']}"
             if repo.get("note"):
                 line += f" · {repo['note']}"
-            print(line)
+            _print(line)
             for issue in repo.get("issues") or []:
-                print(f"      ! {issue}")
-        print()
+                _print(f"      ! {issue}")
+        _print()
     elif etype == "done":
         status = data.get("status", "")
+        done_n, total_n = data.get("processed", 0), data.get("task_count", 0)
         if status == "paused":
-            print(f"\n⏸ paused after {data.get('processed', 0)}/{data.get('task_count', 0)} "
+            _print(f"\n⏸ paused after {done_n}/{total_n} "
                   f"task(s). run `agentos-auto resume` to continue.\n")
+        elif status in ("completed", "partial", "failed"):
+            # A ✓ on a run that carried nothing through is the same lie the
+            # handler used to tell (see its status line): mark what happened.
+            mark = {"completed": "✓", "partial": "◐"}.get(status, "✗")
+            count = f"{done_n}/{total_n}" if total_n else str(done_n)
+            _print(f"\n{mark} {status} — {count} task(s) carried through"
+                   + (" (see the failures above)" if done_n < total_n else "") + "\n")
         else:
-            print(f"\n✓ done — {json.dumps(data)[:400]}\n")
+            _print(f"\n✓ done — {json.dumps(data)[:400]}\n")
     else:
-        print(f"  [{etype}] {json.dumps(data)[:200]}")
+        _print(f"  [{etype}] {json.dumps(data)[:200]}")
 
 
 def _run_loop(workspace_root: str | None, only_keys: list[str] | None = None,

{devops_bot_sdk-1.6.38 → devops_bot_sdk-1.6.39}/sdk/updater.py

@@ -18,6 +18,13 @@ import os
 import platform
 import subprocess
 import sys
+from typing import NamedTuple
+
+# Import-cheap and dependency-free (it runs before anything else at startup).
+# _ASCII_FALLBACK is re-exported so a glyph added to an updater message is still
+# checked against a stand-in — tests/test_console_encoding.py.
+from sdk.platform_compat import _ASCII_FALLBACK  # noqa: F401
+from sdk.platform_compat import safe_print as _say
 
 _DIST        = "devops-bot-sdk"
 _EXTRAS      = "[ui]"   # control-panel deps (fastapi/uvicorn/starlette) — keep on every self-update
@@ -26,27 +33,6 @@ _GITHUB_SSH  = f"git+ssh://git@github.com/{_GITHUB_REPO}.git"
 _PYPI_JSON   = f"https://pypi.org/pypi/{_DIST}/json"
 
 
-#: Non-cp1252 glyphs this module prints → an ASCII stand-in. See :func:`_say`.
-_ASCII_FALLBACK = str.maketrans({"✓": "OK", "→": "->", "↻": "~", "⚠": "!", "…": "..."})
-
-
-def _say(message: str) -> None:
-    """``print`` that can never take the updater down on a legacy Windows codepage.
-
-    The real fix is ``platform_compat.ensure_utf8_stdio``, which every entry point
-    installs. This is the backstop for the one module that must not be allowed to
-    die: on the PyPI path the ``updating … → …`` banner prints BEFORE
-    ``self_update()`` runs, so a stdout that cannot encode ``→`` would deadlock the
-    updater against its own repair — the crash would recur on every single run,
-    and the release that fixes it could never install itself. Degrading to ASCII
-    keeps that from ever being possible again.
-    """
-    try:
-        print(message)
-    except UnicodeEncodeError:
-        print(message.translate(_ASCII_FALLBACK))
-
-
 def _with_extras(target: str) -> str:
     """Attach the ``[ui]`` extra so a self-update never drops the control-panel
     deps — the reason ``agentos-ui`` broke (``No module named 'starlette'``) after
@@ -243,18 +229,79 @@ def _install_candidates() -> list[str]:
     return _unique([_with_extras(c) for c in cands])
 
 
-def _pip_install(url: str, *, force: bool = False) -> bool:
-    """pip install --upgrade <url>. force=True adds --force-reinstall (repair)."""
-    extra = ["--force-reinstall", "--no-deps"] if force else []
+def _redact(text: str) -> str:
+    """Strip credentials out of pip output before it is printed or logged.
+
+    One install candidate is ``git+https://<token>@github.com/...`` built from the
+    user's GitHub OAuth token, and pip echoes the URL it failed on. Reporting pip
+    failures (which this module now does) must not write that token into
+    ``~/.agentos/auto.log`` or the panel's captured output.
+    """
+    import re
+    return re.sub(r"(https?://)[^/\s:@]+(?::[^/\s@]*)?@", r"\1***@", text)
+
+
+def _pip_install(
+    url: str, *, force: bool = False, no_deps: bool | None = None,
+    no_cache: bool = False,
+) -> tuple[bool, str]:
+    """``pip install --upgrade <url>``. Returns (exited-0, redacted output).
+
+    The output is returned rather than discarded because "pip exited non-zero" is
+    the single most useful thing to know about a box that will not update, and it
+    used to be swallowed whole — leaving a silent no-op that read as success.
+
+    ``force`` adds ``--force-reinstall`` (defaulting ``no_deps`` on, for the
+    corrupt-install repair path, which wants to replace our own files and nothing
+    else). ``no_cache`` bypasses pip's wheel cache — a cached wheel built from an
+    earlier clone of the same git ref is one of the ways an upgrade silently
+    installs the version it already had.
+    """
+    if no_deps is None:
+        no_deps = force
+    extra: list[str] = []
+    if force:
+        extra.append("--force-reinstall")
+    if no_deps:
+        extra.append("--no-deps")
+    if no_cache:
+        extra.append("--no-cache-dir")
     try:
-        subprocess.run(
+        proc = subprocess.run(
             [sys.executable, "-m", "pip", "install", "--upgrade", "--quiet",
              *extra, *_pip_flags(), url],
-            check=True, capture_output=True,
+            capture_output=True, text=True, errors="replace", timeout=900,
+            check=False,   # the exit code is the answer, not an exception
         )
-        return True
-    except Exception:  # noqa: BLE001
-        return False
+        out = _redact(((proc.stderr or "") + (proc.stdout or "")).strip())
+        return (proc.returncode == 0, out)
+    except Exception as exc:  # noqa: BLE001 — pip missing, timeout, unreadable env
+        return (False, _redact(str(exc)))
+
+
+def installed_version() -> str:
+    """The version pip has ON DISK, read in a FRESH interpreter.
+
+    :func:`current_version` answers from THIS process, and after a pip upgrade
+    that answer cannot be trusted: ``importlib.metadata`` caches its path scan,
+    and its ``sdk.__version__`` fallback is a module that was imported before the
+    upgrade ran. Comparing a post-upgrade reading against a pre-upgrade one is
+    exactly the check that decides whether we say "updated" or "already up to
+    date", so it has to come from a process that started after pip finished.
+    """
+    try:
+        r = subprocess.run(
+            [sys.executable, "-c",
+             f"from importlib.metadata import version; print(version({_DIST!r}))"],
+            capture_output=True, text=True, errors="replace", timeout=60,
+            check=False,
+        )
+        ver = (r.stdout or "").strip().splitlines()
+        if r.returncode == 0 and ver and ver[-1].strip():
+            return ver[-1].strip()
+    except Exception:  # noqa: BLE001,S110 — an unreadable child is not fatal here
+        pass
+    return current_version()
 
 
 def _verify_install() -> bool:
@@ -277,21 +324,106 @@ def _verify_install() -> bool:
 def _repair_install() -> bool:
     """Force-reinstall to recover from a corrupt upgrade; verifies the result."""
     for url in _install_candidates():
-        if _pip_install(url, force=True) and _verify_install():
+        ok, _out = _pip_install(url, force=True)
+        if ok and _verify_install():
             return True
     return False
 
 
+def _source_label(url: str) -> str:
+    """A short, token-free name for an install candidate, for failure messages."""
+    if "ssh://" in url:
+        return "git+ssh"
+    if "https://" in url:
+        return "git+https"
+    return "pypi"
+
+
+def _tail(text: str, lines: int = 2, width: int = 300) -> str:
+    """The last few lines of pip output — enough to name the cause, short enough
+    to sit in a log line."""
+    kept = [ln.strip() for ln in (text or "").splitlines() if ln.strip()][-lines:]
+    joined = " / ".join(kept)
+    return joined[:width] + ("…" if len(joined) > width else "")
+
+
+class UpgradeResult(NamedTuple):
+    """What an upgrade attempt actually did.
+
+    ``changed`` is the only claim worth making to a user: it is measured from the
+    version on disk before and after, not inferred from pip's exit code.
+    """
+    changed: bool      # the installed version really moved
+    before: str        # version on disk before the attempt
+    after: str         # version on disk after it
+    ran: bool          # at least one candidate's pip exited 0
+    detail: str        # why nothing moved / why every candidate failed
+
+
+def upgrade(target: str | None = None) -> UpgradeResult:
+    """Upgrade the installed SDK via pip, and VERIFY that it happened.
+
+    Tries the candidates in order (SSH → detected URL → token-HTTPS → PyPI) and,
+    after each pip that exits 0, re-reads the version from disk in a fresh
+    interpreter. A candidate that exits 0 without moving the version is a no-op,
+    not a success, so the walk continues to the next one instead of stopping
+    there.
+
+    That distinction is the whole point of this function. Treating pip's exit code
+    as the answer is what let a box sit for weeks on an ancient SDK while printing
+    "✓ already up to date" on every run: a git candidate resolved to a wheel it had
+    already installed, exited 0, short-circuited the candidate list before the PyPI
+    fallback was ever tried, and the unchanged version read as "current".
+
+    ``target`` is the version we know is published (from PyPI). When it is given
+    and the ordinary pass does not reach it, a second forced pass runs with
+    ``--force-reinstall --no-cache-dir`` — the escape hatch for a stale wheel
+    cache or a same-version direct reference pip decides to skip. Without it a
+    wedged box can never recover on its own, which is the state this repair is for.
+    """
+    before = installed_version()
+    candidates = _install_candidates()   # resolved once: it costs a token fetch
+    ran = False
+    notes: list[str] = []
+
+    def _reached(after: str) -> bool:
+        return bool(target) and _vtuple(after) >= _vtuple(target)
+
+    for forced in (False, True):
+        if forced and (not target or _reached(installed_version())):
+            break   # nothing published beyond us, or we already got there
+        for url in candidates:
+            ok, out = _pip_install(url, force=forced, no_deps=False, no_cache=forced)
+            label = _source_label(url) + (" (forced)" if forced else "")
+            if not ok:
+                notes.append(f"{label}: {_tail(out)}")
+                continue
+            ran = True
+            after = installed_version()
+            if _vtuple(after) != _vtuple(before) or _reached(after):
+                return UpgradeResult(after != before, before, after, True, "")
+            if not target:
+                # pip exited 0 and the version did not move. With no published
+                # version to check against, "no-op" and "already current" are the
+                # same observation — so stop here rather than reinstalling from
+                # three more candidates on every routine run.
+                return UpgradeResult(False, before, after, True, "")
+            notes.append(f"{label}: pip exited 0 but the installed version "
+                         f"stayed {after}")
+
+    after = installed_version()
+    return UpgradeResult(after != before, before, after, ran, "; ".join(notes))
+
+
 def self_update() -> bool:
-    """Upgrade the installed SDK via pip. Returns True on success.
+    """Upgrade the installed SDK via pip. True only if the version really moved.
 
-    Tries candidates in order (detected URL → SSH → token-HTTPS → PyPI),
-    stopping at the first success.
+    Thin wrapper over :func:`upgrade` — note that a box already on the newest
+    version returns False here (nothing changed), which is why callers that need
+    to tell "already current" from "the upgrade did not take" use ``upgrade()``
+    and read :attr:`UpgradeResult.after` instead of this boolean.
     """
-    for url in _install_candidates():
-        if _pip_install(url):
-            return True
-    return False
+    return upgrade().changed
 
 
 def _ensure_service(quiet: bool = False, *, restart: bool = False) -> None:
@@ -367,9 +499,15 @@ def _ensure_firewall(quiet: bool = False) -> None:
 def auto_update(quiet: bool = False) -> tuple[bool, str, str | None]:
     """Check for a newer version and upgrade if one exists.
 
-    GitHub installs: upgrades and compares version before/after (pip's git
-    backend does a fast fetch and only reinstalls if HEAD changed).
-    PyPI installs: checks PyPI version metadata first to avoid unnecessary work.
+    PyPI's published version is fetched on BOTH install paths, and not only to
+    skip needless work: it is the one independent fact available about whether
+    this box is current. A git install can legitimately be ahead of PyPI, so a
+    published version that is merely equal or older proves nothing — but a
+    published version STRICTLY NEWER than what is on disk after an upgrade
+    attempt proves the upgrade did not take, no matter what pip's exit code said.
+    That case is now reported (with pip's own reason) instead of being announced
+    as "✓ already up to date", and :func:`upgrade` has already tried a forced,
+    cache-bypassing reinstall to fix it.
 
     Returns (updated, version_before, version_after_or_none).
     No-op when AGENTOS_NO_UPDATE=1 or already up to date.
@@ -378,40 +516,62 @@ def auto_update(quiet: bool = False) -> tuple[bool, str, str | None]:
     if os.getenv("AGENTOS_NO_UPDATE"):
         return (False, cur, None)
 
+    latest = latest_pypi_version()
     is_github = _detect_install_url().startswith("git+")
+    behind_pypi = bool(latest) and _vtuple(latest) > _vtuple(cur)
 
-    if not is_github:
-        latest = latest_pypi_version()
-        if not latest or _vtuple(latest) <= _vtuple(cur):
-            _ensure_service(quiet, restart=False)   # already current — just self-heal the service
-            _ensure_firewall(quiet)
-            return (False, cur, latest)
-        if not quiet:
-            _say(f"updating {_DIST} {cur} → {latest} …")
-        ok = self_update()
-        if not quiet and ok:
-            _say("✓ updated.")
-        # Ensure the service exists + runs the new code (restart only on a real
-        # upgrade); also self-heals a missing/down service when already current.
-        _ensure_service(quiet, restart=ok)
+    # Nothing to do on a PyPI install that is already at (or past) the published
+    # version — a git install still checks its branch, which PyPI cannot answer for.
+    if not is_github and not behind_pypi:
+        _ensure_service(quiet, restart=False)   # already current — just self-heal the service
         _ensure_firewall(quiet)
-        return (ok, cur, latest if ok else None)
+        return (False, cur, latest)
 
-    # GitHub path
     if not quiet:
-        _say("checking for SDK updates …")
-    ok = self_update()
-    after = current_version()
-    updated = ok and after != cur
+        _say(f"updating {_DIST} {cur} → {latest} …" if behind_pypi
+             else "checking for SDK updates …")
+
+    result = upgrade(target=latest if behind_pypi else None)
     if not quiet:
-        if updated:
-            _say(f"✓ updated {cur} → {after}.")
-        elif ok:
-            _say(f"✓ already up to date (v{cur}).")
-        # silent on failure — continue on the existing version without noise
-    _ensure_service(quiet, restart=updated)
+        _report(result, latest)
+
+    # Ensure the service exists + runs the new code (restart only on a real
+    # upgrade); also self-heals a missing/down service when already current.
+    _ensure_service(quiet, restart=result.changed)
     _ensure_firewall(quiet)
-    return (updated, cur, after if updated else None)
+    return (result.changed, cur, result.after if result.changed else None)
+
+
+def _report(result: UpgradeResult, latest: str | None) -> None:
+    """Say what the upgrade attempt actually did.
+
+    The silent case is deliberate and narrow: on a git install with nothing newer
+    published, an upgrade that changed nothing is the ordinary state and we still
+    have no way to see the branch, so "already up to date (v…)" is the best claim
+    available. Everything else is either a real upgrade or a real problem, and a
+    problem the operator can act on beats a green tick they cannot trust.
+    """
+    if result.changed:
+        _say(f"✓ updated {result.before} → {result.after}.")
+        return
+
+    if latest and _vtuple(latest) > _vtuple(result.after):
+        _say(f"⚠ still on v{result.after} — v{latest} is published but the "
+             f"upgrade did not take.")
+        if result.detail:
+            _say(f"    pip said: {result.detail}")
+        _say("    fix it by hand with:\n"
+             f'      "{sys.executable}" -m pip install --upgrade --force-reinstall '
+             f'--no-cache-dir "{_DIST}{_EXTRAS}"')
+        return
+
+    if result.ran:
+        _say(f"✓ already up to date (v{result.after}).")
+    elif result.detail:
+        # Every candidate failed: no SSH key, no token, no network. Previously
+        # silent, which is indistinguishable from a successful check.
+        _say(f"⚠ could not check for updates (staying on v{result.after}).")
+        _say(f"    pip said: {result.detail}")
 
 
 def auto_update_and_reexec(module: str, argv: list[str]) -> None:

{devops_bot_sdk-1.6.38 → devops_bot_sdk-1.6.39}/tests/test_firewall_open_on_update.py

@@ -13,6 +13,7 @@ Two gaps this covers:
 """
 from __future__ import annotations
 
+import pytest
 from unittest.mock import patch
 
 from sdk import firewall, updater
@@ -159,12 +160,45 @@ class TestEnsureOpen:
 
 # ── The post-update hook ──────────────────────────────────────────────
 class TestEnsureFirewallHook:
-    def test_it_runs_on_every_auto_update_path(self):
-        """Three return paths in `auto_update`; all of them must check."""
-        import inspect
-
-        src = inspect.getsource(updater.auto_update)
-        assert src.count("_ensure_firewall(quiet)") == 3
+    @pytest.mark.parametrize(
+        "install_url, pypi_latest, result",
+        [
+            # PyPI install, nothing newer published — the early return.
+            ("devops-bot-sdk", "1.0.0", None),
+            # An upgrade that took.
+            ("git+ssh://git@github.com/x/y.git", "1.1.0",
+             updater.UpgradeResult(True, "1.0.0", "1.1.0", True, "")),
+            # An upgrade that did NOT take — the case that used to report success.
+            ("git+ssh://git@github.com/x/y.git", "1.1.0",
+             updater.UpgradeResult(False, "1.0.0", "1.0.0", True, "pip no-op")),
+        ],
+    )
+    def test_it_runs_on_every_auto_update_path(self, install_url, pypi_latest, result):
+        """Every way out of `auto_update` must have checked the firewall first.
+
+        Driven through the function rather than counted in its source: the number
+        of return paths is an implementation detail (merging the PyPI and GitHub
+        branches changed it), while "no outcome skips the check" is the property
+        that keeps a host with a shut port from being reported healthy forever.
+        """
+        calls: list[bool] = []
+        with patch.object(updater, "current_version", return_value="1.0.0"), \
+             patch.object(updater, "latest_pypi_version", return_value=pypi_latest), \
+             patch.object(updater, "_detect_install_url", return_value=install_url), \
+             patch.object(updater, "upgrade", return_value=result), \
+             patch.object(updater, "_ensure_service", lambda *a, **k: None), \
+             patch.object(updater, "_ensure_firewall", lambda *a, **k: calls.append(True)):
+            updater.auto_update(quiet=True)
+        assert calls, "auto_update returned without checking the firewall"
+
+    def test_the_opt_out_return_checks_nothing(self):
+        """AGENTOS_NO_UPDATE is the one exemption: it returns before the updater
+        does anything at all."""
+        calls: list[bool] = []
+        with patch.dict("os.environ", {"AGENTOS_NO_UPDATE": "1"}), \
+             patch.object(updater, "_ensure_firewall", lambda *a, **k: calls.append(True)):
+            updater.auto_update(quiet=True)
+        assert not calls
 
     def test_opt_out_env_var_skips_it(self):
         with patch.dict("os.environ", {"AGENTOS_NO_FIREWALL": "1"}), \