devops-bot-sdk 1.6.44__tar.gz → 1.6.47__tar.gz

{devops_bot_sdk-1.6.44 → devops_bot_sdk-1.6.47}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.6.44
+Version: 1.6.47
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.6.44 → devops_bot_sdk-1.6.47}/devops_bot_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.6.44
+Version: 1.6.47
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.6.44 → devops_bot_sdk-1.6.47}/sdk/__init__.py

@@ -1,6 +1,6 @@
 """AgentOS Desktop SDK — thin HTTPS/SSE client for the Electron app.
 
-Version: 1.6.44
+Version: 1.6.47
 
 Public surface:
   BackendClient.from_config()        — create client from ~/.agentos/config.toml
@@ -34,7 +34,7 @@ Rules:
   - All data egress through submit_webhook only
 """
 
-__version__ = "1.6.44"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
+__version__ = "1.6.47"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
 __author__  = "AgentOS"   # sdk.client.SDK_VERSION and the UI server version all read this.
 
 from sdk.client import BackendClient

{devops_bot_sdk-1.6.44 → devops_bot_sdk-1.6.47}/sdk/activity/collectors/__init__.py

@@ -1,4 +1,4 @@
-"""OS-level collectors — opt-in (``AGENTOS_ACTIVITY_AUDIT=1``).
+"""OS-level collectors (``AGENTOS_ACTIVITY_AUDIT=1``, switched on by ``os_setup``).
 
     Linux    auditd         sdk.activity.collectors.linux_auditd
     Windows  Security log   sdk.activity.collectors.windows_eventlog
@@ -70,9 +70,45 @@ async def run_forever(collector: Any) -> None:
         logger.exception("activity collector crashed")
 
 
+async def _setup_then_run() -> None:
+    """Turn the OS audit on (``os_setup.ensure``), then run the collector — no restart.
+
+    The panel is the one process that is always running, so it is where a box whose
+    install/update ran unprivileged gets set up: as root/elevated directly, or through
+    passwordless ``sudo`` (Linux). In a thread, because a first run may install auditd.
+    """
+    from sdk.activity import os_setup
+
+    try:
+        _, msg = await asyncio.to_thread(os_setup.ensure)
+    except Exception as exc:  # noqa: BLE001 — ensure never raises, but be certain
+        logger.warning("activity audit setup crashed: %s", exc)
+        return
+    if msg:
+        logger.warning("%s", msg)
+    if not settings.audit_enabled():
+        return
+    try:
+        collector = make_collector()
+    except Exception as exc:  # noqa: BLE001
+        logger.warning("activity collector could not be created: %s", exc)
+        return
+    if collector is not None:
+        logger.info("activity collector starting (%s)", type(collector).__name__)
+        await run_forever(collector)
+
+
 def start() -> asyncio.Task[None] | None:
-    if not (settings.enabled() and settings.audit_enabled()):
+    if not settings.enabled():
         return None
+    if not settings.audit_enabled():
+        from sdk.activity import os_setup
+
+        # An explicit AGENTOS_ACTIVITY_AUDIT=0 / AGENTOS_NO_AUDIT_SETUP=1 is the
+        # operator's decision: respected, nothing touched.
+        if os_setup._opted_out():
+            return None
+        return asyncio.ensure_future(_setup_then_run())
     try:
         collector = make_collector()
     except Exception as exc:  # noqa: BLE001

{devops_bot_sdk-1.6.44 → devops_bot_sdk-1.6.47}/sdk/activity/collectors/linux_auditd.py

@@ -159,6 +159,11 @@ class AuditdParser:
             inner = re.search(r"msg='([^']*)'", body)
             if inner:
                 rec.update({f"m_{k}": v for k, v in _kv(inner.group(1)).items()})
+                # acct is quoted when printable and hex-encoded otherwise; as with EXECVE
+                # args, only the raw match says which ("dead" is a name AND valid hex).
+                for key, raw in _KV.findall(inner.group(1)):
+                    if key == "acct":
+                        rec["m_acct"] = _unquote(raw) if raw[:1] in "\"'" else _unhex(raw)
         if rtype == "EXECVE":
             # Quoting is the ONLY thing that tells a literal argument from a hex-encoded
             # one ("beef" is valid hex), so read it from the raw match, not from _kv.
@@ -217,9 +222,14 @@ class AuditdParser:
         terminal = rec.get("m_terminal", "")
 
         if not ok:
+            # The attempted account name: a failed login has no uid to resolve (it is
+            # unset, or an invalid user), so without acct the record says nothing about
+            # which names an attacker is trying.
+            acct = rec.get("m_acct", "")
+            tried = acct if acct and acct not in ("(unknown)", "?") else user
             recorder.record_event(ActivityEvent(
                 os=Os.LINUX, source=Source.AUDITD, category=Category.LOGIN, action="login.failed",
-                occurredAt=ts, osUser=user, target=remote, severity=Severity.WARNING,
+                occurredAt=ts, osUser=tried, target=remote, severity=Severity.WARNING,
                 actorType=ActorType.UNKNOWN, actorConfidence=0,
             ))
             return

{devops_bot_sdk-1.6.44 → devops_bot_sdk-1.6.47}/sdk/activity/collectors/windows_eventlog.py

@@ -14,6 +14,11 @@ The event parser and the processor are pure; only :class:`WindowsEventLogCollect
 touches the OS. Processes created by SYSTEM / LOCAL SERVICE / NETWORK SERVICE are
 skipped by default (``ignore_system``): they are thousands of events an hour of
 Windows housekeeping that no human or agent did.
+
+The collector's own polling is skipped too: every poll runs ``wevtutil.exe`` from the
+panel process (as the panel's user, not SYSTEM), and each of those is itself a 4688.
+Unfiltered, that is ~8,600 "Administrator ran wevtutil" events a day per VPS, each
+poll recording the previous one.
 """
 from __future__ import annotations
 
@@ -47,6 +52,9 @@ logger = logging.getLogger("sdk.activity.collectors.windows")
 _NS = "{http://schemas.microsoft.com/win/2004/08/events/event}"
 EVENT_IDS = (4688, 4624, 4634, 4647, 4625)
 _MAX_PID_CACHE = 20_000
+#: Executables the collector itself spawns to poll the log.
+_OWN_TOOLS = ("wevtutil.exe",)
+_MAX_OWN_PIDS = 1_000
 
 #: Logon types that are a PERSON at a keyboard / remote desktop.
 _INTERACTIVE = {2: SessionKind.CONSOLE, 11: SessionKind.CONSOLE, 10: SessionKind.RDP}
@@ -123,11 +131,14 @@ class WindowsEventProcessor:
         registry: AgentProcessRegistry | None = None,
         book: SessionBook | None = None,
         ignore_system: bool = True,
+        self_pid: int | None = None,
     ) -> None:
         self._agent_user = agent_user.lower() if agent_user else None
         self._registry = registry or AgentProcessRegistry()
         self._book = book or SessionBook()
         self._ignore_system = ignore_system
+        self._self_pid = os.getpid() if self_pid is None else self_pid
+        self._own: OrderedDict[int, None] = OrderedDict()   # pids of our own polls + children
         self._ppid: OrderedDict[int, int] = OrderedDict()
         self._logons: dict[str, str] = {}              # logon id → session key
         self._kinds: dict[str, SessionKind] = {}       # logon id → login kind
@@ -202,6 +213,9 @@ class WindowsEventProcessor:
         d = ev.data
         pid, ppid = _hex(d.get("NewProcessId")), _hex(d.get("ProcessId"))
         self._remember_ppid(pid, ppid)
+        image = d.get("NewProcessName", "")
+        if self._is_own_poll(pid, ppid, image):
+            return
         logon_id = d.get("SubjectLogonId", "").lower()
         if self._ignore_system and logon_id in _SYSTEM_LOGON_IDS:
             return
@@ -232,7 +246,6 @@ class WindowsEventProcessor:
                 session_key, started=ev.time, verdict=verdict, os_user=user,
             ).agent_run_id
 
-        image = d.get("NewProcessName", "")
         recorder.record_event(ActivityEvent(
             os=Os.WINDOWS, source=Source.WIN_EVENTLOG, category=Category.COMMAND, action="exec",
             occurredAt=ev.time, sessionKey=session_key,
@@ -243,6 +256,20 @@ class WindowsEventProcessor:
             metadata={"parent": d.get("ParentProcessName") or None},
         ))
 
+    def _is_own_poll(self, pid: int, ppid: int, image: str) -> bool:
+        """A ``wevtutil`` this process spawned to poll, or a child of one (its ``conhost``).
+
+        Matched by parent pid AND image name, so anything else the panel spawns —
+        an agent run, ``git``, ``claude`` — is still recorded.
+        """
+        name = image.rsplit("\\", 1)[-1].lower()
+        if not ((ppid == self._self_pid and name in _OWN_TOOLS) or ppid in self._own):
+            return False
+        self._own[pid] = None
+        while len(self._own) > _MAX_OWN_PIDS:
+            self._own.popitem(last=False)
+        return True
+
     def _remember_ppid(self, pid: int, ppid: int) -> None:
         self._ppid[pid] = ppid
         self._ppid.move_to_end(pid)

{devops_bot_sdk-1.6.44 → devops_bot_sdk-1.6.47}/sdk/activity/os_setup.py

@@ -19,6 +19,17 @@ the same contract:
   log anyway.)
 * **never raises** — an update must not fail because of the audit trail.
 
+**A panel that runs as an ordinary user** (a user systemd unit, the common case on
+a VPS set up without ``sudo``) was the gap that left most Linux boxes unaudited even
+when that user had root through ``sudo``. Three things now close it:
+
+* unprivileged, :func:`ensure` runs its privileged half through ``sudo -n`` when
+  sudo needs no password, so nobody has to type a command;
+* under ``sudo`` the flag goes into the INVOKING user's ``~/.agentos/.env``
+  (``SUDO_USER``), not ``/root`` — the panel never reads root's home;
+* ``auditd``'s ``log_group`` is set to that user's private group, because
+  ``audit.log`` is root-only and a collector that cannot read it records nothing.
+
 Opt out with ``AGENTOS_NO_AUDIT_SETUP=1``. An operator who set
 ``AGENTOS_ACTIVITY_AUDIT=0`` (or ``AGENTOS_ACTIVITY=0``) has decided already; that
 is respected and nothing is touched.
@@ -35,7 +46,9 @@ import logging
 import os
 import platform
 import shutil
+import re
 import subprocess
+import sys
 from pathlib import Path
 
 from sdk.activity import settings
@@ -52,6 +65,8 @@ RULES_TEXT = (
     f"-a always,exit -F arch=b64 -S execve -k {RULE_KEY}\n"
     f"-a always,exit -F arch=b32 -S execve -k {RULE_KEY}\n"
 )
+AUDITD_CONF = Path("/etc/audit/auditd.conf")
+AUDIT_LOG = Path("/var/log/audit/audit.log")
 _LINUX_MANUAL = (
     "sudo apt install auditd            # or: dnf install audit\n"
     f"sudo tee {RULES_PATH} <<'EOF'\n{RULES_TEXT}EOF\n"
@@ -112,6 +127,34 @@ def _is_privileged() -> bool:
     return hasattr(os, "geteuid") and os.geteuid() == 0
 
 
+def _panel_user() -> tuple[str, Path, int, int] | None:
+    """``(name, home, uid, gid)`` of the account the panel runs as, if it is NOT root.
+
+    Under ``sudo`` that is ``SUDO_USER`` — the person who typed the command, whose
+    ``~/.agentos`` the panel reads. Otherwise it is the current user. ``None`` when the
+    panel itself is root, or on a platform without ``pwd``: root needs no grant.
+    """
+    try:
+        import pwd
+    except ImportError:          # Windows
+        return None
+    sudo_user = os.environ.get("SUDO_USER", "").strip()
+    try:
+        if _is_privileged():
+            # Privileged WITHOUT sudo is a root panel (a system unit): nobody to grant,
+            # and no other home to write into. Never guess one from the real uid.
+            if not sudo_user or sudo_user == "root":
+                return None
+            pw = pwd.getpwnam(sudo_user)
+        else:
+            pw = pwd.getpwuid(os.getuid())
+    except (KeyError, OSError):
+        return None
+    if pw.pw_uid == 0:
+        return None
+    return pw.pw_name, Path(pw.pw_dir), pw.pw_uid, pw.pw_gid
+
+
 def _run(cmd: list[str], timeout: float = 60.0, env: dict | None = None) -> tuple[int, str]:
     """``(returncode, output)``; ``(-1, reason)`` when the command could not run."""
     try:
@@ -123,7 +166,29 @@ def _run(cmd: list[str], timeout: float = 60.0, env: dict | None = None) -> tupl
 
 
 def _env_file() -> Path:
-    return Path.home() / ".agentos" / ".env"
+    """The ``.env`` the PANEL reads: the sudo-invoking user's, never root's by accident."""
+    user = _panel_user() if _is_privileged() else None
+    home = user[1] if user else Path.home()
+    return home / ".agentos" / ".env"
+
+
+def _flag_value() -> str:
+    """``AGENTOS_ACTIVITY_AUDIT`` as the panel will see it: process env, then its ``.env``.
+
+    ``settings.setting`` reads ``Path.home()``'s ``.env``, which under ``sudo`` is root's
+    — not the file the panel reads — so the panel's file is read here directly.
+    """
+    val = os.environ.get(AUDIT_FLAG, "").strip()
+    if val:
+        return val
+    try:
+        for line in _env_file().read_text(encoding="utf-8").splitlines():
+            key, sep, value = line.strip().partition("=")
+            if sep and key.strip() == AUDIT_FLAG:
+                return value.strip().strip('"').strip("'")
+    except OSError:
+        pass
+    return settings.setting(AUDIT_FLAG)
 
 
 def _opted_out() -> bool:
@@ -131,7 +196,7 @@ def _opted_out() -> bool:
         return True
     falsey = {"0", "false", "no", "off"}
     return (settings.setting("AGENTOS_ACTIVITY").lower() in falsey
-            or settings.setting(AUDIT_FLAG).lower() in falsey)
+            or _flag_value().lower() in falsey)
 
 
 def _enable_flag() -> bool:
@@ -140,14 +205,23 @@ def _enable_flag() -> bool:
     Left alone when the flag is set ANYWHERE (process env or .env) — an explicit
     value is the operator's, including an explicit "on".
     """
-    if settings.setting(AUDIT_FLAG):
+    if _flag_value():
         return False
     path = _env_file()
     try:
+        created_dir = not path.parent.exists()
         path.parent.mkdir(parents=True, exist_ok=True)
         existing = path.read_text(encoding="utf-8") if path.exists() else ""
         sep = "" if (not existing or existing.endswith("\n")) else "\n"
         path.write_text(f"{existing}{sep}{AUDIT_FLAG}=1\n", encoding="utf-8")
+        # Written as root into a user's home: hand it back, or the panel (that user)
+        # could no longer edit its own .env — and a new ~/.agentos would be root's.
+        user = _panel_user() if _is_privileged() else None
+        if user:
+            _, _, uid, gid = user
+            if created_dir:
+                os.chown(path.parent, uid, gid)
+            os.chown(path, uid, gid)
         return True
     except OSError as exc:
         logger.warning("activity.os_setup.env_write_failed path=%s err=%s", path, exc)
@@ -215,9 +289,76 @@ def _ensure_linux() -> tuple[bool, list[str], str]:
             # Typically a container without audit support in its kernel namespace.
             return bool(done), done, f"audit rules did not load: {out.strip()[-300:]}"
         done.append("loaded audit rules")
+
+    user = _panel_user()
+    if user:
+        steps, err = _grant_log_read(user)
+        done.extend(steps)
+        if err:
+            return bool(done), done, err
     return bool(done), done, ""
 
 
+def _grant_log_read(user: tuple[str, Path, int, int]) -> tuple[list[str], str]:
+    """Let the panel's (non-root) user read ``audit.log``. ``(steps_done, error)``.
+
+    ``log_group`` in ``auditd.conf`` is what survives rotation (auditd applies it to
+    every new log file and the directory); the chgrp/chmod makes the CURRENT file
+    readable now, without waiting for a rotation. Only a USER-PRIVATE group (named
+    like the user) is used: granting a shared group such as ``users`` would hand the
+    log of every command on the box to every member of it.
+    """
+    import grp
+
+    name, _, _, gid = user
+    try:
+        group = grp.getgrgid(gid).gr_name
+    except KeyError:
+        group = ""
+    if group != name:
+        return [], (f"{name}'s primary group is {group or gid}, not a private group — "
+                    f"set log_group in {AUDITD_CONF} to a group only {name} is in")
+    done: list[str] = []
+    try:
+        text = AUDITD_CONF.read_text(encoding="utf-8") if AUDITD_CONF.exists() else ""
+        lines = text.splitlines(keepends=True)
+        found = changed = False
+        for i, line in enumerate(lines):
+            if re.match(r"\s*log_group\s*=", line):
+                found = True
+                if line.split("=", 1)[1].strip() != group:
+                    lines[i] = f"log_group = {group}\n"
+                    changed = True
+        if not found:
+            sep = "" if (not lines or lines[-1].endswith("\n")) else "\n"
+            lines.append(f"{sep}log_group = {group}\n")
+            changed = True
+        if changed:
+            AUDITD_CONF.write_text("".join(lines), encoding="utf-8")
+            # auditd re-reads its config on SIGHUP; `auditctl --signal` is audit ≥ 3.
+            if _run(["auditctl", "--signal", "reload"])[0] != 0:
+                _run(["pkill", "-HUP", "-x", "auditd"])
+            done.append(f"log_group = {group}")
+        for path, bits in ((AUDIT_LOG.parent, 0o050), (AUDIT_LOG, 0o040)):
+            if not path.exists():
+                continue
+            st = path.stat()
+            if st.st_gid != gid:
+                os.chown(path, -1, gid)
+            if st.st_mode & bits != bits:
+                os.chmod(path, (st.st_mode & 0o7777) | bits)
+            if st.st_gid != gid or st.st_mode & bits != bits:
+                if f"{AUDIT_LOG} readable by {name}" not in done:
+                    done.append(f"{AUDIT_LOG} readable by {name}")
+    except OSError as exc:
+        return done, f"could not make {AUDIT_LOG} readable by {name}: {exc}"
+    return done, ""
+
+
+def _log_readable() -> bool:
+    return os.access(AUDIT_LOG, os.R_OK)
+
+
 # ── Windows steps ───────────────────────────────────────────────────────────
 
 def _ensure_windows() -> tuple[bool, list[str], str]:
@@ -389,10 +530,14 @@ def ensure(apply: bool = True) -> tuple[bool, str]:
         manual = {"linux": _LINUX_MANUAL, "windows": _WIN_MANUAL, "darwin": _MAC_MANUAL}[sysname]
 
         if not apply or not _is_privileged():
-            if settings.audit_enabled():
-                return False, ""      # someone already set it up by hand
+            ready = settings.audit_enabled() and (sysname != "linux" or _log_readable())
+            if ready:
+                return False, ""      # set up already (by hand, or by an earlier run)
+            if apply and sysname == "linux" and _sudo_without_password():
+                return _ensure_via_sudo()
             return False, ("activity audit is not set up — human activity on this VPS is "
-                           "not being recorded. Run as root/Administrator:\n" + manual)
+                           f"not being recorded. Run once:\n  sudo {_agentos_exe()} "
+                           "activity-setup\nor by hand:\n" + manual)
 
         step = {"linux": _ensure_linux, "windows": _ensure_windows, "darwin": _ensure_macos}
         _, done, err = step[sysname]()
@@ -415,6 +560,41 @@ def ensure(apply: bool = True) -> tuple[bool, str]:
         return False, f"activity audit setup failed: {exc}"
 
 
+def _sudo_without_password() -> bool:
+    """Can this (unprivileged) process become root with no prompt? Never prompts."""
+    if not shutil.which("sudo"):
+        return False
+    return _run(["sudo", "-n", "true"], timeout=15)[0] == 0
+
+
+def _ensure_via_sudo() -> tuple[bool, str]:
+    """Run the privileged half as root through ``sudo -n``, as THIS user's ``SUDO_USER``.
+
+    The root run writes the flag into this user's ``.env`` and grants this user the
+    audit log, so the panel (this user) picks both up. Same interpreter, so the same
+    installation is what runs — never whatever ``agentos`` is first on root's PATH.
+    """
+    before = settings.audit_enabled()
+    rc, out = _run(["sudo", "-n", sys.executable, "-m", "sdk.activity.os_setup"], timeout=1800)
+    lines = [ln.strip() for ln in out.splitlines() if ln.strip()]
+    # cli() prints the outcome first ("activity audit …") and a restart hint after it.
+    last = next((ln for ln in lines if ln.startswith("activity audit")), lines[-1] if lines else "")
+    if rc != 0:
+        logger.warning("activity.os_setup.sudo_failed rc=%s out=%s", rc, out[-300:])
+        return False, f"activity audit setup incomplete (via sudo): {last or f'exit {rc}'}"
+    changed = settings.audit_enabled() and not before
+    return changed, (last if last and "already set up" not in last else
+                     ("activity audit enabled (via sudo)" if changed else ""))
+
+
+def _agentos_exe() -> str:
+    """Absolute ``agentos`` path, so ``sudo`` finds the venv / ~/.local/bin install."""
+    exe = Path(sys.executable).parent / ("agentos.exe" if _system() == "windows" else "agentos")
+    if exe.exists():
+        return str(exe)
+    return shutil.which("agentos") or "agentos"
+
+
 def cli(argv: list[str]) -> int:
     """``agentos activity-setup [--check]`` — run (or just report) the OS audit setup."""
     changed, msg = ensure(apply="--check" not in argv)
@@ -424,5 +604,11 @@ def cli(argv: list[str]) -> int:
         print("activity audit: already set up" if settings.audit_enabled()
               else "activity audit: nothing to do on this platform")
     if changed:
-        print("restart the panel for it to take effect: sudo systemctl restart agentos-ui")
+        print("restart the panel for it to take effect: systemctl --user restart agentos-ui "
+              "(or sudo systemctl restart agentos-ui for a system service). A running panel "
+              "also turns the collector on by itself at its next start.")
     return 1 if "incomplete" in msg or "failed" in msg else 0
+
+
+if __name__ == "__main__":      # `sudo -n python -m sdk.activity.os_setup` (see _ensure_via_sudo)
+    sys.exit(cli(sys.argv[1:]))

{devops_bot_sdk-1.6.44 → devops_bot_sdk-1.6.47}/sdk/ui/service.py

@@ -9,7 +9,9 @@ Per platform:
              ``loginctl enable-linger`` so it runs without an active login.
              ``Restart=always`` gives crash-recovery; ``enable`` gives boot-start.
   * macOS  — a launchd LaunchAgent with ``RunAtLoad`` + ``KeepAlive``.
-  * Windows — a Scheduled Task (``schtasks``) that runs the panel at logon.
+  * Windows — a Scheduled Task (``schtasks``) that runs the panel at logon, plus a
+             second, daily task that runs ``agentos-auto update`` (the systemd
+             timer's counterpart — without it a Windows box never updated itself).
 
 Everything is best-effort and returns ``(ok, message)`` so the caller (the
 ``agentos-ui install`` command and the bootstrap scripts) can report cleanly.
@@ -28,6 +30,7 @@ IS_MAC = sys.platform == "darwin"
 
 SERVICE_NAME = "agentos-ui"           # systemd unit / launchd label base
 WIN_TASK = "AgentOS Control Panel"    # Windows scheduled-task name
+WIN_UPDATE_TASK = "AgentOS Self-Update"  # Windows counterpart of agentos-update.timer
 
 
 def _exe() -> str:
@@ -166,7 +169,7 @@ def _auto_exe() -> str:
     minimal environment, and picking up a different venv's console script is how
     an updater ends up upgrading the wrong installation.
     """
-    candidate = Path(sys.executable).parent / "agentos-auto"
+    candidate = Path(sys.executable).parent / ("agentos-auto.exe" if IS_WINDOWS else "agentos-auto")
     if candidate.exists():
         return str(candidate)
     return shutil.which("agentos-auto") or "agentos-auto"
@@ -174,6 +177,8 @@ def _auto_exe() -> str:
 
 def update_timer_installed() -> bool:
     """Is the daily self-update timer present on this box?"""
+    if IS_WINDOWS:
+        return _run(["schtasks", "/Query", "/TN", WIN_UPDATE_TASK])[0] == 0
     if not _systemd_available():
         return False
     is_root = hasattr(os, "geteuid") and os.geteuid() == 0
@@ -185,6 +190,8 @@ def update_timer_installed() -> bool:
 def _install_update_timer() -> tuple[bool, str]:
     """Install (or refresh) the daily self-update timer. Best-effort by design —
     the panel must install even on a box where the timer cannot."""
+    if IS_WINDOWS:
+        return _install_update_schtask()
     if not _systemd_available():
         return False, "no systemd — skipping the self-update timer"
     home = str(Path.home())
@@ -378,7 +385,82 @@ def _install_schtask(host: str, port: int) -> tuple[bool, str]:
                   f"'Run whether user is logged on' + 'Restart on failure' in Task Scheduler.")
 
 
+def _update_task_xml(exe: str, home: str) -> str:
+    """Task Scheduler XML for the daily self-update — the systemd timer, translated.
+
+    XML rather than ``schtasks`` flags because the flags cannot express the two
+    settings that matter most: ``RandomDelay`` (the fleet must not clone from GitHub
+    in the same second) and ``StartWhenAvailable`` (a box that was off at the
+    scheduled time updates when it is next up — systemd's ``Persistent=true``).
+
+    It runs as the installing user with the highest available privileges, same as
+    the panel task: ``~/.agentos`` (token, ``.env``) lives in that user's profile, and
+    the updater's activity-audit step needs an elevated token to configure auditpol.
+    """
+    from xml.sax.saxutils import escape
+
+    delay_min = max(1, UPDATE_RANDOM_DELAY_S // 60)
+    return (
+        '<?xml version="1.0" encoding="UTF-16"?>\n'
+        '<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">\n'
+        "  <RegistrationInfo><Description>AgentOS SDK self-update (daily)</Description>"
+        "</RegistrationInfo>\n"
+        "  <Triggers>\n"
+        "    <CalendarTrigger>\n"
+        "      <StartBoundary>2026-01-01T03:00:00</StartBoundary>\n"
+        f"      <RandomDelay>PT{delay_min}M</RandomDelay>\n"
+        "      <ScheduleByDay><DaysInterval>1</DaysInterval></ScheduleByDay>\n"
+        "    </CalendarTrigger>\n"
+        "  </Triggers>\n"
+        "  <Principals><Principal id=\"Author\">"
+        "<LogonType>InteractiveToken</LogonType><RunLevel>HighestAvailable</RunLevel>"
+        "</Principal></Principals>\n"
+        "  <Settings>\n"
+        "    <StartWhenAvailable>true</StartWhenAvailable>\n"
+        "    <RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable>\n"
+        "    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\n"
+        "    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\n"
+        "    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>\n"
+        "    <ExecutionTimeLimit>PT1H</ExecutionTimeLimit>\n"
+        "  </Settings>\n"
+        '  <Actions Context="Author"><Exec>'
+        f"<Command>{escape(exe)}</Command><Arguments>update</Arguments>"
+        f"<WorkingDirectory>{escape(home)}</WorkingDirectory>"
+        "</Exec></Actions>\n"
+        "</Task>\n"
+    )
+
+
+def _install_update_schtask() -> tuple[bool, str]:
+    """Create (or replace) the daily self-update task. Best-effort, like the timer.
+
+    A SEPARATE task from the panel's for the same reason the systemd updater is a
+    separate unit: the update restarts the panel task, and an updater running inside
+    it would be ended part way through its own ``pip install``.
+    """
+    import tempfile
+
+    xml = _update_task_xml(_auto_exe(), str(Path.home()))
+    fd, path = tempfile.mkstemp(suffix=".xml")
+    try:
+        with os.fdopen(fd, "w", encoding="utf-16") as fh:   # schtasks /XML wants UTF-16
+            fh.write(xml)
+        rc, out = _run(["schtasks", "/Create", "/TN", WIN_UPDATE_TASK, "/XML", path, "/F"])
+    except OSError as exc:
+        return False, f"could not write the self-update task: {exc}"
+    finally:
+        try:
+            os.unlink(path)
+        except OSError:
+            pass
+    if rc != 0:
+        return False, f"could not create the self-update task:\n{out}"
+    return True, (f"self-update task '{WIN_UPDATE_TASK}' created — "
+                  f"daily, randomized, catches up after downtime")
+
+
 def _uninstall_schtask() -> tuple[bool, str]:
+    _run(["schtasks", "/Delete", "/TN", WIN_UPDATE_TASK, "/F"])
     _run(["schtasks", "/End", "/TN", WIN_TASK])
     rc, out = _run(["schtasks", "/Delete", "/TN", WIN_TASK, "/F"])
     return (rc == 0), (f"removed scheduled task '{WIN_TASK}'." if rc == 0 else out)
@@ -388,7 +470,9 @@ def _uninstall_schtask() -> tuple[bool, str]:
 
 def install(host: str = "0.0.0.0", port: int = 8765) -> tuple[bool, str]:
     if IS_WINDOWS:
-        return _install_schtask(host, port)
+        ok, msg = _install_schtask(host, port)
+        timer_ok, timer_msg = _install_update_timer()
+        return ok, f"{msg}\n  {'' if timer_ok else 'note: '}{timer_msg}"
     if IS_MAC:
         return _install_launchd(host, port)
     if _systemd_available():