devops-bot-sdk 1.6.44__tar.gz → 1.6.46__tar.gz

{devops_bot_sdk-1.6.44 → devops_bot_sdk-1.6.46}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.6.44
+Version: 1.6.46
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.6.44 → devops_bot_sdk-1.6.46}/devops_bot_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.6.44
+Version: 1.6.46
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.6.44 → devops_bot_sdk-1.6.46}/sdk/__init__.py

@@ -1,6 +1,6 @@
 """AgentOS Desktop SDK — thin HTTPS/SSE client for the Electron app.
 
-Version: 1.6.44
+Version: 1.6.46
 
 Public surface:
   BackendClient.from_config()        — create client from ~/.agentos/config.toml
@@ -34,7 +34,7 @@ Rules:
   - All data egress through submit_webhook only
 """
 
-__version__ = "1.6.44"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
+__version__ = "1.6.46"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
 __author__  = "AgentOS"   # sdk.client.SDK_VERSION and the UI server version all read this.
 
 from sdk.client import BackendClient

{devops_bot_sdk-1.6.44 → devops_bot_sdk-1.6.46}/sdk/activity/collectors/windows_eventlog.py

@@ -14,6 +14,11 @@ The event parser and the processor are pure; only :class:`WindowsEventLogCollect
 touches the OS. Processes created by SYSTEM / LOCAL SERVICE / NETWORK SERVICE are
 skipped by default (``ignore_system``): they are thousands of events an hour of
 Windows housekeeping that no human or agent did.
+
+The collector's own polling is skipped too: every poll runs ``wevtutil.exe`` from the
+panel process (as the panel's user, not SYSTEM), and each of those is itself a 4688.
+Unfiltered, that is ~8,600 "Administrator ran wevtutil" events a day per VPS, each
+poll recording the previous one.
 """
 from __future__ import annotations
 
@@ -47,6 +52,9 @@ logger = logging.getLogger("sdk.activity.collectors.windows")
 _NS = "{http://schemas.microsoft.com/win/2004/08/events/event}"
 EVENT_IDS = (4688, 4624, 4634, 4647, 4625)
 _MAX_PID_CACHE = 20_000
+#: Executables the collector itself spawns to poll the log.
+_OWN_TOOLS = ("wevtutil.exe",)
+_MAX_OWN_PIDS = 1_000
 
 #: Logon types that are a PERSON at a keyboard / remote desktop.
 _INTERACTIVE = {2: SessionKind.CONSOLE, 11: SessionKind.CONSOLE, 10: SessionKind.RDP}
@@ -123,11 +131,14 @@ class WindowsEventProcessor:
         registry: AgentProcessRegistry | None = None,
         book: SessionBook | None = None,
         ignore_system: bool = True,
+        self_pid: int | None = None,
     ) -> None:
         self._agent_user = agent_user.lower() if agent_user else None
         self._registry = registry or AgentProcessRegistry()
         self._book = book or SessionBook()
         self._ignore_system = ignore_system
+        self._self_pid = os.getpid() if self_pid is None else self_pid
+        self._own: OrderedDict[int, None] = OrderedDict()   # pids of our own polls + children
         self._ppid: OrderedDict[int, int] = OrderedDict()
         self._logons: dict[str, str] = {}              # logon id → session key
         self._kinds: dict[str, SessionKind] = {}       # logon id → login kind
@@ -202,6 +213,9 @@ class WindowsEventProcessor:
         d = ev.data
         pid, ppid = _hex(d.get("NewProcessId")), _hex(d.get("ProcessId"))
         self._remember_ppid(pid, ppid)
+        image = d.get("NewProcessName", "")
+        if self._is_own_poll(pid, ppid, image):
+            return
         logon_id = d.get("SubjectLogonId", "").lower()
         if self._ignore_system and logon_id in _SYSTEM_LOGON_IDS:
             return
@@ -232,7 +246,6 @@ class WindowsEventProcessor:
                 session_key, started=ev.time, verdict=verdict, os_user=user,
             ).agent_run_id
 
-        image = d.get("NewProcessName", "")
         recorder.record_event(ActivityEvent(
             os=Os.WINDOWS, source=Source.WIN_EVENTLOG, category=Category.COMMAND, action="exec",
             occurredAt=ev.time, sessionKey=session_key,
@@ -243,6 +256,20 @@ class WindowsEventProcessor:
             metadata={"parent": d.get("ParentProcessName") or None},
         ))
 
+    def _is_own_poll(self, pid: int, ppid: int, image: str) -> bool:
+        """A ``wevtutil`` this process spawned to poll, or a child of one (its ``conhost``).
+
+        Matched by parent pid AND image name, so anything else the panel spawns —
+        an agent run, ``git``, ``claude`` — is still recorded.
+        """
+        name = image.rsplit("\\", 1)[-1].lower()
+        if not ((ppid == self._self_pid and name in _OWN_TOOLS) or ppid in self._own):
+            return False
+        self._own[pid] = None
+        while len(self._own) > _MAX_OWN_PIDS:
+            self._own.popitem(last=False)
+        return True
+
     def _remember_ppid(self, pid: int, ppid: int) -> None:
         self._ppid[pid] = ppid
         self._ppid.move_to_end(pid)

{devops_bot_sdk-1.6.44 → devops_bot_sdk-1.6.46}/sdk/ui/service.py

@@ -9,7 +9,9 @@ Per platform:
              ``loginctl enable-linger`` so it runs without an active login.
              ``Restart=always`` gives crash-recovery; ``enable`` gives boot-start.
   * macOS  — a launchd LaunchAgent with ``RunAtLoad`` + ``KeepAlive``.
-  * Windows — a Scheduled Task (``schtasks``) that runs the panel at logon.
+  * Windows — a Scheduled Task (``schtasks``) that runs the panel at logon, plus a
+             second, daily task that runs ``agentos-auto update`` (the systemd
+             timer's counterpart — without it a Windows box never updated itself).
 
 Everything is best-effort and returns ``(ok, message)`` so the caller (the
 ``agentos-ui install`` command and the bootstrap scripts) can report cleanly.
@@ -28,6 +30,7 @@ IS_MAC = sys.platform == "darwin"
 
 SERVICE_NAME = "agentos-ui"           # systemd unit / launchd label base
 WIN_TASK = "AgentOS Control Panel"    # Windows scheduled-task name
+WIN_UPDATE_TASK = "AgentOS Self-Update"  # Windows counterpart of agentos-update.timer
 
 
 def _exe() -> str:
@@ -166,7 +169,7 @@ def _auto_exe() -> str:
     minimal environment, and picking up a different venv's console script is how
     an updater ends up upgrading the wrong installation.
     """
-    candidate = Path(sys.executable).parent / "agentos-auto"
+    candidate = Path(sys.executable).parent / ("agentos-auto.exe" if IS_WINDOWS else "agentos-auto")
     if candidate.exists():
         return str(candidate)
     return shutil.which("agentos-auto") or "agentos-auto"
@@ -174,6 +177,8 @@ def _auto_exe() -> str:
 
 def update_timer_installed() -> bool:
     """Is the daily self-update timer present on this box?"""
+    if IS_WINDOWS:
+        return _run(["schtasks", "/Query", "/TN", WIN_UPDATE_TASK])[0] == 0
     if not _systemd_available():
         return False
     is_root = hasattr(os, "geteuid") and os.geteuid() == 0
@@ -185,6 +190,8 @@ def update_timer_installed() -> bool:
 def _install_update_timer() -> tuple[bool, str]:
     """Install (or refresh) the daily self-update timer. Best-effort by design —
     the panel must install even on a box where the timer cannot."""
+    if IS_WINDOWS:
+        return _install_update_schtask()
     if not _systemd_available():
         return False, "no systemd — skipping the self-update timer"
     home = str(Path.home())
@@ -378,7 +385,82 @@ def _install_schtask(host: str, port: int) -> tuple[bool, str]:
                   f"'Run whether user is logged on' + 'Restart on failure' in Task Scheduler.")
 
 
+def _update_task_xml(exe: str, home: str) -> str:
+    """Task Scheduler XML for the daily self-update — the systemd timer, translated.
+
+    XML rather than ``schtasks`` flags because the flags cannot express the two
+    settings that matter most: ``RandomDelay`` (the fleet must not clone from GitHub
+    in the same second) and ``StartWhenAvailable`` (a box that was off at the
+    scheduled time updates when it is next up — systemd's ``Persistent=true``).
+
+    It runs as the installing user with the highest available privileges, same as
+    the panel task: ``~/.agentos`` (token, ``.env``) lives in that user's profile, and
+    the updater's activity-audit step needs an elevated token to configure auditpol.
+    """
+    from xml.sax.saxutils import escape
+
+    delay_min = max(1, UPDATE_RANDOM_DELAY_S // 60)
+    return (
+        '<?xml version="1.0" encoding="UTF-16"?>\n'
+        '<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">\n'
+        "  <RegistrationInfo><Description>AgentOS SDK self-update (daily)</Description>"
+        "</RegistrationInfo>\n"
+        "  <Triggers>\n"
+        "    <CalendarTrigger>\n"
+        "      <StartBoundary>2026-01-01T03:00:00</StartBoundary>\n"
+        f"      <RandomDelay>PT{delay_min}M</RandomDelay>\n"
+        "      <ScheduleByDay><DaysInterval>1</DaysInterval></ScheduleByDay>\n"
+        "    </CalendarTrigger>\n"
+        "  </Triggers>\n"
+        "  <Principals><Principal id=\"Author\">"
+        "<LogonType>InteractiveToken</LogonType><RunLevel>HighestAvailable</RunLevel>"
+        "</Principal></Principals>\n"
+        "  <Settings>\n"
+        "    <StartWhenAvailable>true</StartWhenAvailable>\n"
+        "    <RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable>\n"
+        "    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\n"
+        "    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\n"
+        "    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>\n"
+        "    <ExecutionTimeLimit>PT1H</ExecutionTimeLimit>\n"
+        "  </Settings>\n"
+        '  <Actions Context="Author"><Exec>'
+        f"<Command>{escape(exe)}</Command><Arguments>update</Arguments>"
+        f"<WorkingDirectory>{escape(home)}</WorkingDirectory>"
+        "</Exec></Actions>\n"
+        "</Task>\n"
+    )
+
+
+def _install_update_schtask() -> tuple[bool, str]:
+    """Create (or replace) the daily self-update task. Best-effort, like the timer.
+
+    A SEPARATE task from the panel's for the same reason the systemd updater is a
+    separate unit: the update restarts the panel task, and an updater running inside
+    it would be ended part way through its own ``pip install``.
+    """
+    import tempfile
+
+    xml = _update_task_xml(_auto_exe(), str(Path.home()))
+    fd, path = tempfile.mkstemp(suffix=".xml")
+    try:
+        with os.fdopen(fd, "w", encoding="utf-16") as fh:   # schtasks /XML wants UTF-16
+            fh.write(xml)
+        rc, out = _run(["schtasks", "/Create", "/TN", WIN_UPDATE_TASK, "/XML", path, "/F"])
+    except OSError as exc:
+        return False, f"could not write the self-update task: {exc}"
+    finally:
+        try:
+            os.unlink(path)
+        except OSError:
+            pass
+    if rc != 0:
+        return False, f"could not create the self-update task:\n{out}"
+    return True, (f"self-update task '{WIN_UPDATE_TASK}' created — "
+                  f"daily, randomized, catches up after downtime")
+
+
 def _uninstall_schtask() -> tuple[bool, str]:
+    _run(["schtasks", "/Delete", "/TN", WIN_UPDATE_TASK, "/F"])
     _run(["schtasks", "/End", "/TN", WIN_TASK])
     rc, out = _run(["schtasks", "/Delete", "/TN", WIN_TASK, "/F"])
     return (rc == 0), (f"removed scheduled task '{WIN_TASK}'." if rc == 0 else out)
@@ -388,7 +470,9 @@ def _uninstall_schtask() -> tuple[bool, str]:
 
 def install(host: str = "0.0.0.0", port: int = 8765) -> tuple[bool, str]:
     if IS_WINDOWS:
-        return _install_schtask(host, port)
+        ok, msg = _install_schtask(host, port)
+        timer_ok, timer_msg = _install_update_timer()
+        return ok, f"{msg}\n  {'' if timer_ok else 'note: '}{timer_msg}"
     if IS_MAC:
         return _install_launchd(host, port)
     if _systemd_available():

{devops_bot_sdk-1.6.44 → devops_bot_sdk-1.6.46}/tests/test_activity_collectors.py

@@ -417,6 +417,36 @@ class TestWindowsProcessing:
         assert e["sessionKey"] == "agent-run:RUN1" and e["agentRunId"] == "RUN1"
         assert (e["actorType"], e["actorConfidence"]) == ("AGENT", 95)
 
+    def test_the_collectors_own_wevtutil_polls_are_not_recorded(self):
+        """Every poll spawns wevtutil from the panel (as the panel's user, not SYSTEM);
+        recording it would add ~8,600 self-referential events a day per VPS."""
+        _win(
+            _xml(4688, 1, NewProcessId="0x300", ProcessId="0x50", SubjectUserName="Administrator",
+                 SubjectLogonId="0xabc", NewProcessName="C:\\Windows\\System32\\wevtutil.exe",
+                 CommandLine="wevtutil qe Security /f:xml"),
+            # its console host is a child of the wevtutil, not of the panel
+            _xml(4688, 2, NewProcessId="0x301", ProcessId="0x300", SubjectUserName="Administrator",
+                 SubjectLogonId="0xabc", NewProcessName="C:\\Windows\\System32\\conhost.exe"),
+            self_pid=0x50,
+        )
+        assert _queued() == ([], [])
+
+    def test_other_children_of_the_panel_are_still_recorded(self):
+        """Only the poll tool is filtered — an agent run or git the panel spawns is not."""
+        _win(_xml(4688, 1, NewProcessId="0x300", ProcessId="0x50", SubjectUserName="Administrator",
+                  SubjectLogonId="0xabc", NewProcessName="C:\\Program Files\\Git\\cmd\\git.exe"),
+             self_pid=0x50)
+        _, events = _queued()
+        assert [e["processName"] for e in events] == ["git.exe"]
+
+    def test_a_wevtutil_someone_else_runs_is_recorded(self):
+        """A person auditing the box by hand is activity; only OUR polls are noise."""
+        _win(_xml(4688, 1, NewProcessId="0x300", ProcessId="0x77", SubjectUserName="alice",
+                  SubjectLogonId="0xabc", NewProcessName="C:\\Windows\\System32\\wevtutil.exe"),
+             self_pid=0x50)
+        _, events = _queued()
+        assert [e["processName"] for e in events] == ["wevtutil.exe"]
+
     def test_a_failed_logon_is_a_warning_event(self):
         _win(_xml(4625, 1, TargetUserName="admin", IpAddress="198.51.100.9"))
         _, events = _queued()

{devops_bot_sdk-1.6.44 → devops_bot_sdk-1.6.46}/tests/test_update_timer.py

@@ -134,3 +134,97 @@ class TestInstallation:
         ok, msg = service.install()
         assert ok is True
         assert "panel ok" in msg and "timer broke" in msg
+
+
+class TestWindowsUpdateTask:
+    """The Windows counterpart of the timer. Without it a Windows VPS only ever
+    updated when someone ran `agentos-auto update` by hand — so a feature shipped to
+    the fleet (the activity audit trail) silently never reached those boxes."""
+
+    _NS = "{http://schemas.microsoft.com/windows/2004/02/mit/task}"
+
+    def _xml(self, exe=r"C:\Users\Administrator\agentsystem\venv\Scripts\agentos-auto.exe"):
+        import xml.etree.ElementTree as ET
+        return ET.fromstring(service._update_task_xml(exe, r"C:\Users\Administrator")
+                             .split("\n", 1)[1])  # ET rejects the UTF-16 declaration on a str
+
+    def test_runs_agentos_auto_update(self):
+        ex = self._xml().find(f"{self._NS}Actions/{self._NS}Exec")
+        assert ex.findtext(f"{self._NS}Command").endswith("agentos-auto.exe")
+        assert ex.findtext(f"{self._NS}Arguments") == "update"
+        assert ex.findtext(f"{self._NS}WorkingDirectory") == r"C:\Users\Administrator"
+
+    def test_daily_and_randomized_like_the_timer(self):
+        trig = self._xml().find(f"{self._NS}Triggers/{self._NS}CalendarTrigger")
+        assert trig.findtext(f"{self._NS}ScheduleByDay/{self._NS}DaysInterval") == "1"
+        assert trig.findtext(f"{self._NS}RandomDelay") == f"PT{service.UPDATE_RANDOM_DELAY_S // 60}M"
+
+    def test_catches_up_after_downtime(self):
+        """systemd's Persistent=true: a box that was off at 03:00 updates when next up."""
+        assert self._xml().findtext(f"{self._NS}Settings/{self._NS}StartWhenAvailable") == "true"
+
+    def test_runs_elevated_as_the_user(self):
+        """Elevated so the updater's audit step can run auditpol; as the user so
+        ~/.agentos (token, .env) is the right profile."""
+        pr = self._xml().find(f"{self._NS}Principals/{self._NS}Principal")
+        assert pr.findtext(f"{self._NS}RunLevel") == "HighestAvailable"
+        assert pr.findtext(f"{self._NS}LogonType") == "InteractiveToken"
+
+    def test_a_path_with_xml_metacharacters_is_escaped(self):
+        exe = r"C:\R&D <x>\agentos-auto.exe"
+        assert self._xml(exe).find(
+            f"{self._NS}Actions/{self._NS}Exec/{self._NS}Command").text == exe
+
+    def test_creates_the_task_from_a_utf16_xml_file(self, monkeypatch):
+        monkeypatch.setattr(service, "IS_WINDOWS", True)
+        seen = {}
+
+        def fake_run(argv):
+            seen["argv"] = argv
+            seen["xml"] = Path(argv[argv.index("/XML") + 1]).read_text(encoding="utf-16")
+            return 0, "SUCCESS"
+        monkeypatch.setattr(service, "_run", fake_run)
+
+        ok, msg = service._install_update_timer()
+        assert ok is True and service.WIN_UPDATE_TASK in msg
+        assert seen["argv"][:4] == ["schtasks", "/Create", "/TN", service.WIN_UPDATE_TASK]
+        assert seen["argv"][-1] == "/F"
+        assert "<Arguments>update</Arguments>" in seen["xml"]
+        assert not Path(seen["argv"][seen["argv"].index("/XML") + 1]).exists()  # temp file removed
+
+    def test_a_failed_create_is_reported_not_raised(self, monkeypatch):
+        monkeypatch.setattr(service, "IS_WINDOWS", True)
+        monkeypatch.setattr(service, "_run", lambda argv: (1, "Access is denied."))
+        ok, msg = service._install_update_timer()
+        assert ok is False and "Access is denied." in msg
+
+    def test_detection_queries_the_task(self, monkeypatch):
+        monkeypatch.setattr(service, "IS_WINDOWS", True)
+        calls = []
+        monkeypatch.setattr(service, "_run", lambda argv: (calls.append(argv), (0, ""))[1])
+        assert service.update_timer_installed() is True
+        assert calls == [["schtasks", "/Query", "/TN", service.WIN_UPDATE_TASK]]
+        monkeypatch.setattr(service, "_run", lambda argv: (1, "cannot find"))
+        assert service.update_timer_installed() is False
+
+    def test_install_creates_both_tasks_and_a_timer_failure_is_not_fatal(self, monkeypatch):
+        monkeypatch.setattr(service, "IS_WINDOWS", True)
+        monkeypatch.setattr(service, "_install_schtask", lambda h, p: (True, "panel ok"))
+        monkeypatch.setattr(service, "_install_update_timer", lambda: (False, "timer broke"))
+        ok, msg = service.install()
+        assert ok is True and "panel ok" in msg and "timer broke" in msg
+
+    def test_uninstall_removes_the_update_task_too(self, monkeypatch):
+        monkeypatch.setattr(service, "IS_WINDOWS", True)
+        calls = []
+        monkeypatch.setattr(service, "_run", lambda argv: (calls.append(argv), (0, ""))[1])
+        service.uninstall()
+        assert ["schtasks", "/Delete", "/TN", service.WIN_UPDATE_TASK, "/F"] in calls
+        assert ["schtasks", "/Delete", "/TN", service.WIN_TASK, "/F"] in calls
+
+    def test_resolves_the_exe_console_script_on_windows(self, monkeypatch, tmp_path):
+        """A venv's Scripts dir holds agentos-auto.EXE; the bare name never exists there."""
+        (tmp_path / "agentos-auto.exe").write_text("")
+        monkeypatch.setattr(service, "IS_WINDOWS", True)
+        monkeypatch.setattr(service.sys, "executable", str(tmp_path / "python.exe"))
+        assert service._auto_exe() == str(tmp_path / "agentos-auto.exe")