devops-bot-sdk 1.6.46__tar.gz → 1.6.48__tar.gz

{devops_bot_sdk-1.6.46 → devops_bot_sdk-1.6.48}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.6.46
+Version: 1.6.48
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.6.46 → devops_bot_sdk-1.6.48}/devops_bot_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.6.46
+Version: 1.6.48
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.6.46 → devops_bot_sdk-1.6.48}/sdk/__init__.py

@@ -1,6 +1,6 @@
 """AgentOS Desktop SDK — thin HTTPS/SSE client for the Electron app.
 
-Version: 1.6.46
+Version: 1.6.48
 
 Public surface:
   BackendClient.from_config()        — create client from ~/.agentos/config.toml
@@ -34,7 +34,7 @@ Rules:
   - All data egress through submit_webhook only
 """
 
-__version__ = "1.6.46"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
+__version__ = "1.6.48"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
 __author__  = "AgentOS"   # sdk.client.SDK_VERSION and the UI server version all read this.
 
 from sdk.client import BackendClient

{devops_bot_sdk-1.6.46 → devops_bot_sdk-1.6.48}/sdk/activity/collectors/__init__.py

@@ -1,4 +1,4 @@
-"""OS-level collectors — opt-in (``AGENTOS_ACTIVITY_AUDIT=1``).
+"""OS-level collectors (``AGENTOS_ACTIVITY_AUDIT=1``, switched on by ``os_setup``).
 
     Linux    auditd         sdk.activity.collectors.linux_auditd
     Windows  Security log   sdk.activity.collectors.windows_eventlog
@@ -70,9 +70,45 @@ async def run_forever(collector: Any) -> None:
         logger.exception("activity collector crashed")
 
 
+async def _setup_then_run() -> None:
+    """Turn the OS audit on (``os_setup.ensure``), then run the collector — no restart.
+
+    The panel is the one process that is always running, so it is where a box whose
+    install/update ran unprivileged gets set up: as root/elevated directly, or through
+    passwordless ``sudo`` (Linux). In a thread, because a first run may install auditd.
+    """
+    from sdk.activity import os_setup
+
+    try:
+        _, msg = await asyncio.to_thread(os_setup.ensure)
+    except Exception as exc:  # noqa: BLE001 — ensure never raises, but be certain
+        logger.warning("activity audit setup crashed: %s", exc)
+        return
+    if msg:
+        logger.warning("%s", msg)
+    if not settings.audit_enabled():
+        return
+    try:
+        collector = make_collector()
+    except Exception as exc:  # noqa: BLE001
+        logger.warning("activity collector could not be created: %s", exc)
+        return
+    if collector is not None:
+        logger.info("activity collector starting (%s)", type(collector).__name__)
+        await run_forever(collector)
+
+
 def start() -> asyncio.Task[None] | None:
-    if not (settings.enabled() and settings.audit_enabled()):
+    if not settings.enabled():
         return None
+    if not settings.audit_enabled():
+        from sdk.activity import os_setup
+
+        # An explicit AGENTOS_ACTIVITY_AUDIT=0 / AGENTOS_NO_AUDIT_SETUP=1 is the
+        # operator's decision: respected, nothing touched.
+        if os_setup._opted_out():
+            return None
+        return asyncio.ensure_future(_setup_then_run())
     try:
         collector = make_collector()
     except Exception as exc:  # noqa: BLE001

{devops_bot_sdk-1.6.46 → devops_bot_sdk-1.6.48}/sdk/activity/collectors/linux_auditd.py

@@ -159,6 +159,11 @@ class AuditdParser:
             inner = re.search(r"msg='([^']*)'", body)
             if inner:
                 rec.update({f"m_{k}": v for k, v in _kv(inner.group(1)).items()})
+                # acct is quoted when printable and hex-encoded otherwise; as with EXECVE
+                # args, only the raw match says which ("dead" is a name AND valid hex).
+                for key, raw in _KV.findall(inner.group(1)):
+                    if key == "acct":
+                        rec["m_acct"] = _unquote(raw) if raw[:1] in "\"'" else _unhex(raw)
         if rtype == "EXECVE":
             # Quoting is the ONLY thing that tells a literal argument from a hex-encoded
             # one ("beef" is valid hex), so read it from the raw match, not from _kv.
@@ -217,9 +222,14 @@ class AuditdParser:
         terminal = rec.get("m_terminal", "")
 
         if not ok:
+            # The attempted account name: a failed login has no uid to resolve (it is
+            # unset, or an invalid user), so without acct the record says nothing about
+            # which names an attacker is trying.
+            acct = rec.get("m_acct", "")
+            tried = acct if acct and acct not in ("(unknown)", "?") else user
             recorder.record_event(ActivityEvent(
                 os=Os.LINUX, source=Source.AUDITD, category=Category.LOGIN, action="login.failed",
-                occurredAt=ts, osUser=user, target=remote, severity=Severity.WARNING,
+                occurredAt=ts, osUser=tried, target=remote, severity=Severity.WARNING,
                 actorType=ActorType.UNKNOWN, actorConfidence=0,
             ))
             return

{devops_bot_sdk-1.6.46 → devops_bot_sdk-1.6.48}/sdk/activity/os_setup.py

@@ -19,6 +19,17 @@ the same contract:
   log anyway.)
 * **never raises** — an update must not fail because of the audit trail.
 
+**A panel that runs as an ordinary user** (a user systemd unit, the common case on
+a VPS set up without ``sudo``) was the gap that left most Linux boxes unaudited even
+when that user had root through ``sudo``. Three things now close it:
+
+* unprivileged, :func:`ensure` runs its privileged half through ``sudo -n`` when
+  sudo needs no password, so nobody has to type a command;
+* under ``sudo`` the flag goes into the INVOKING user's ``~/.agentos/.env``
+  (``SUDO_USER``), not ``/root`` — the panel never reads root's home;
+* ``auditd``'s ``log_group`` is set to that user's private group, because
+  ``audit.log`` is root-only and a collector that cannot read it records nothing.
+
 Opt out with ``AGENTOS_NO_AUDIT_SETUP=1``. An operator who set
 ``AGENTOS_ACTIVITY_AUDIT=0`` (or ``AGENTOS_ACTIVITY=0``) has decided already; that
 is respected and nothing is touched.
@@ -35,7 +46,9 @@ import logging
 import os
 import platform
 import shutil
+import re
 import subprocess
+import sys
 from pathlib import Path
 
 from sdk.activity import settings
@@ -52,6 +65,8 @@ RULES_TEXT = (
     f"-a always,exit -F arch=b64 -S execve -k {RULE_KEY}\n"
     f"-a always,exit -F arch=b32 -S execve -k {RULE_KEY}\n"
 )
+AUDITD_CONF = Path("/etc/audit/auditd.conf")
+AUDIT_LOG = Path("/var/log/audit/audit.log")
 _LINUX_MANUAL = (
     "sudo apt install auditd            # or: dnf install audit\n"
     f"sudo tee {RULES_PATH} <<'EOF'\n{RULES_TEXT}EOF\n"
@@ -112,6 +127,34 @@ def _is_privileged() -> bool:
     return hasattr(os, "geteuid") and os.geteuid() == 0
 
 
+def _panel_user() -> tuple[str, Path, int, int] | None:
+    """``(name, home, uid, gid)`` of the account the panel runs as, if it is NOT root.
+
+    Under ``sudo`` that is ``SUDO_USER`` — the person who typed the command, whose
+    ``~/.agentos`` the panel reads. Otherwise it is the current user. ``None`` when the
+    panel itself is root, or on a platform without ``pwd``: root needs no grant.
+    """
+    try:
+        import pwd
+    except ImportError:          # Windows
+        return None
+    sudo_user = os.environ.get("SUDO_USER", "").strip()
+    try:
+        if _is_privileged():
+            # Privileged WITHOUT sudo is a root panel (a system unit): nobody to grant,
+            # and no other home to write into. Never guess one from the real uid.
+            if not sudo_user or sudo_user == "root":
+                return None
+            pw = pwd.getpwnam(sudo_user)
+        else:
+            pw = pwd.getpwuid(os.getuid())
+    except (KeyError, OSError):
+        return None
+    if pw.pw_uid == 0:
+        return None
+    return pw.pw_name, Path(pw.pw_dir), pw.pw_uid, pw.pw_gid
+
+
 def _run(cmd: list[str], timeout: float = 60.0, env: dict | None = None) -> tuple[int, str]:
     """``(returncode, output)``; ``(-1, reason)`` when the command could not run."""
     try:
@@ -123,7 +166,29 @@ def _run(cmd: list[str], timeout: float = 60.0, env: dict | None = None) -> tupl
 
 
 def _env_file() -> Path:
-    return Path.home() / ".agentos" / ".env"
+    """The ``.env`` the PANEL reads: the sudo-invoking user's, never root's by accident."""
+    user = _panel_user() if _is_privileged() else None
+    home = user[1] if user else Path.home()
+    return home / ".agentos" / ".env"
+
+
+def _flag_value() -> str:
+    """``AGENTOS_ACTIVITY_AUDIT`` as the panel will see it: process env, then its ``.env``.
+
+    ``settings.setting`` reads ``Path.home()``'s ``.env``, which under ``sudo`` is root's
+    — not the file the panel reads — so the panel's file is read here directly.
+    """
+    val = os.environ.get(AUDIT_FLAG, "").strip()
+    if val:
+        return val
+    try:
+        for line in _env_file().read_text(encoding="utf-8").splitlines():
+            key, sep, value = line.strip().partition("=")
+            if sep and key.strip() == AUDIT_FLAG:
+                return value.strip().strip('"').strip("'")
+    except OSError:
+        pass
+    return settings.setting(AUDIT_FLAG)
 
 
 def _opted_out() -> bool:
@@ -131,7 +196,7 @@ def _opted_out() -> bool:
         return True
     falsey = {"0", "false", "no", "off"}
     return (settings.setting("AGENTOS_ACTIVITY").lower() in falsey
-            or settings.setting(AUDIT_FLAG).lower() in falsey)
+            or _flag_value().lower() in falsey)
 
 
 def _enable_flag() -> bool:
@@ -140,14 +205,23 @@ def _enable_flag() -> bool:
     Left alone when the flag is set ANYWHERE (process env or .env) — an explicit
     value is the operator's, including an explicit "on".
     """
-    if settings.setting(AUDIT_FLAG):
+    if _flag_value():
         return False
     path = _env_file()
     try:
+        created_dir = not path.parent.exists()
         path.parent.mkdir(parents=True, exist_ok=True)
         existing = path.read_text(encoding="utf-8") if path.exists() else ""
         sep = "" if (not existing or existing.endswith("\n")) else "\n"
         path.write_text(f"{existing}{sep}{AUDIT_FLAG}=1\n", encoding="utf-8")
+        # Written as root into a user's home: hand it back, or the panel (that user)
+        # could no longer edit its own .env — and a new ~/.agentos would be root's.
+        user = _panel_user() if _is_privileged() else None
+        if user:
+            _, _, uid, gid = user
+            if created_dir:
+                os.chown(path.parent, uid, gid)
+            os.chown(path, uid, gid)
         return True
     except OSError as exc:
         logger.warning("activity.os_setup.env_write_failed path=%s err=%s", path, exc)
@@ -215,9 +289,76 @@ def _ensure_linux() -> tuple[bool, list[str], str]:
             # Typically a container without audit support in its kernel namespace.
             return bool(done), done, f"audit rules did not load: {out.strip()[-300:]}"
         done.append("loaded audit rules")
+
+    user = _panel_user()
+    if user:
+        steps, err = _grant_log_read(user)
+        done.extend(steps)
+        if err:
+            return bool(done), done, err
     return bool(done), done, ""
 
 
+def _grant_log_read(user: tuple[str, Path, int, int]) -> tuple[list[str], str]:
+    """Let the panel's (non-root) user read ``audit.log``. ``(steps_done, error)``.
+
+    ``log_group`` in ``auditd.conf`` is what survives rotation (auditd applies it to
+    every new log file and the directory); the chgrp/chmod makes the CURRENT file
+    readable now, without waiting for a rotation. Only a USER-PRIVATE group (named
+    like the user) is used: granting a shared group such as ``users`` would hand the
+    log of every command on the box to every member of it.
+    """
+    import grp
+
+    name, _, _, gid = user
+    try:
+        group = grp.getgrgid(gid).gr_name
+    except KeyError:
+        group = ""
+    if group != name:
+        return [], (f"{name}'s primary group is {group or gid}, not a private group — "
+                    f"set log_group in {AUDITD_CONF} to a group only {name} is in")
+    done: list[str] = []
+    try:
+        text = AUDITD_CONF.read_text(encoding="utf-8") if AUDITD_CONF.exists() else ""
+        lines = text.splitlines(keepends=True)
+        found = changed = False
+        for i, line in enumerate(lines):
+            if re.match(r"\s*log_group\s*=", line):
+                found = True
+                if line.split("=", 1)[1].strip() != group:
+                    lines[i] = f"log_group = {group}\n"
+                    changed = True
+        if not found:
+            sep = "" if (not lines or lines[-1].endswith("\n")) else "\n"
+            lines.append(f"{sep}log_group = {group}\n")
+            changed = True
+        if changed:
+            AUDITD_CONF.write_text("".join(lines), encoding="utf-8")
+            # auditd re-reads its config on SIGHUP; `auditctl --signal` is audit ≥ 3.
+            if _run(["auditctl", "--signal", "reload"])[0] != 0:
+                _run(["pkill", "-HUP", "-x", "auditd"])
+            done.append(f"log_group = {group}")
+        for path, bits in ((AUDIT_LOG.parent, 0o050), (AUDIT_LOG, 0o040)):
+            if not path.exists():
+                continue
+            st = path.stat()
+            if st.st_gid != gid:
+                os.chown(path, -1, gid)
+            if st.st_mode & bits != bits:
+                os.chmod(path, (st.st_mode & 0o7777) | bits)
+            if st.st_gid != gid or st.st_mode & bits != bits:
+                if f"{AUDIT_LOG} readable by {name}" not in done:
+                    done.append(f"{AUDIT_LOG} readable by {name}")
+    except OSError as exc:
+        return done, f"could not make {AUDIT_LOG} readable by {name}: {exc}"
+    return done, ""
+
+
+def _log_readable() -> bool:
+    return os.access(AUDIT_LOG, os.R_OK)
+
+
 # ── Windows steps ───────────────────────────────────────────────────────────
 
 def _ensure_windows() -> tuple[bool, list[str], str]:
@@ -389,10 +530,17 @@ def ensure(apply: bool = True) -> tuple[bool, str]:
         manual = {"linux": _LINUX_MANUAL, "windows": _WIN_MANUAL, "darwin": _MAC_MANUAL}[sysname]
 
         if not apply or not _is_privileged():
-            if settings.audit_enabled():
-                return False, ""      # someone already set it up by hand
+            ready = settings.audit_enabled() and (sysname != "linux" or _log_readable())
+            if ready:
+                return False, ""      # set up already (by hand, or by an earlier run)
+            if apply and sysname == "linux" and _sudo_without_password():
+                return _ensure_via_sudo()
+            import shlex
+
+            cmd = " ".join(shlex.quote(a) for a in _privileged_argv())
             return False, ("activity audit is not set up — human activity on this VPS is "
-                           "not being recorded. Run as root/Administrator:\n" + manual)
+                           f"not being recorded. Run once:\n  sudo {cmd}\nor by hand:\n"
+                           + manual)
 
         step = {"linux": _ensure_linux, "windows": _ensure_windows, "darwin": _ensure_macos}
         _, done, err = step[sysname]()
@@ -415,6 +563,68 @@ def ensure(apply: bool = True) -> tuple[bool, str]:
         return False, f"activity audit setup failed: {exc}"
 
 
+def _sudo_without_password() -> bool:
+    """Can this (unprivileged) process become root with no prompt? Never prompts."""
+    if not shutil.which("sudo"):
+        return False
+    return _run(["sudo", "-n", "true"], timeout=15)[0] == 0
+
+
+def _ensure_via_sudo() -> tuple[bool, str]:
+    """Run the privileged half as root through ``sudo -n``, as THIS user's ``SUDO_USER``.
+
+    The root run writes the flag into this user's ``.env`` and grants this user the
+    audit log, so the panel (this user) picks both up. Same interpreter, so the same
+    installation is what runs — never whatever ``agentos`` is first on root's PATH.
+    """
+    before = settings.audit_enabled()
+    rc, out = _run(["sudo", "-n", *_privileged_argv()], timeout=1800)
+    lines = [ln.strip() for ln in out.splitlines() if ln.strip()]
+    # cli() prints the outcome first ("activity audit …") and a restart hint after it.
+    last = next((ln for ln in lines if ln.startswith("activity audit")), lines[-1] if lines else "")
+    if rc != 0:
+        logger.warning("activity.os_setup.sudo_failed rc=%s out=%s", rc, out[-300:])
+        return False, f"activity audit setup incomplete (via sudo): {last or f'exit {rc}'}"
+    changed = settings.audit_enabled() and not before
+    return changed, (last if last and "already set up" not in last else
+                     ("activity audit enabled (via sudo)" if changed else ""))
+
+
+def _import_path() -> str:
+    """This process's import path, for the root child.
+
+    A ``pip install --user`` puts the SDK and its dependencies in the USER's site
+    directory (``~/.local/lib/pythonX.Y/site-packages``), which root's interpreter
+    never looks in. So ``sudo python3 -m sdk.activity.os_setup`` failed with
+    ``No module named 'sdk'``, and ``sudo agentos`` failed the same way even with a
+    full path. Handing the child exactly the path this process imports from makes it
+    import what we import: a --user install, a venv or an editable checkout alike.
+    (It runs as root from user-writable directories. That grants nothing, because
+    it only happens for a user who already has root through sudo.)
+    """
+    # Not the caller's working directory (``-m`` puts it on sys.path): a root child
+    # has no business importing whatever happens to sit in the folder someone ran the
+    # panel from. Kept only when the SDK itself lives there (an editable checkout).
+    sdk_home = str(Path(__file__).resolve().parents[2])
+    cwd = os.getcwd()
+    seen: list[str] = []
+    for p in sys.path:
+        if not p or not os.path.isdir(p):
+            continue
+        p = os.path.abspath(p)
+        if p == cwd and p != sdk_home:
+            continue
+        if p not in seen:
+            seen.append(p)
+    return os.pathsep.join(seen)
+
+
+def _privileged_argv() -> list[str]:
+    """The command (minus ``sudo``) that runs the privileged half: same interpreter,
+    same import path, through ``env`` so ``sudo``'s environment reset cannot drop it."""
+    return ["env", f"PYTHONPATH={_import_path()}", sys.executable, "-m", "sdk.activity.os_setup"]
+
+
 def cli(argv: list[str]) -> int:
     """``agentos activity-setup [--check]`` — run (or just report) the OS audit setup."""
     changed, msg = ensure(apply="--check" not in argv)
@@ -424,5 +634,11 @@ def cli(argv: list[str]) -> int:
         print("activity audit: already set up" if settings.audit_enabled()
               else "activity audit: nothing to do on this platform")
     if changed:
-        print("restart the panel for it to take effect: sudo systemctl restart agentos-ui")
+        print("restart the panel for it to take effect: systemctl --user restart agentos-ui "
+              "(or sudo systemctl restart agentos-ui for a system service). A running panel "
+              "also turns the collector on by itself at its next start.")
     return 1 if "incomplete" in msg or "failed" in msg else 0
+
+
+if __name__ == "__main__":      # `sudo -n python -m sdk.activity.os_setup` (see _ensure_via_sudo)
+    sys.exit(cli(sys.argv[1:]))

{devops_bot_sdk-1.6.46 → devops_bot_sdk-1.6.48}/tests/test_activity_collectors.py

@@ -216,6 +216,36 @@ class TestAuditdParsing:
         assert (events[0]["action"], events[0]["severity"]) == ("login.failed", "WARNING")
         assert events[0]["target"] == "198.51.100.9"
 
+    @pytest.mark.parametrize("acct, expected", [
+        ('"root"', "root"),
+        ('"admin"', "admin"),
+        ('"dead"', "dead"),            # quoted: a name, even though it is valid hex
+        ("6F7261636C65", "oracle"),    # unquoted hex: auditd's encoding
+    ])
+    def test_a_failed_login_records_the_account_that_was_tried(self, acct, expected):
+        """Without this every failed SSH login had osUser=None, so a brute force showed
+        which IPs attacked but never which accounts they were guessing."""
+        p = _parser()
+        _feed(p, [
+            "type=USER_LOGIN msg=audit(1696852800.000:11): pid=2000 uid=0 auid=4294967295 "
+            "ses=4294967295 msg='op=login id=4294967295 acct=" + acct + " exe=\"/usr/sbin/sshd\" "
+            "hostname=? addr=198.51.100.9 terminal=ssh res=failed'",
+            "type=EOE msg=audit(1696852800.000:11): ",
+        ])
+        _, events = _queued()
+        assert events[0]["action"] == "login.failed" and events[0]["osUser"] == expected
+
+    def test_an_unknown_account_on_a_failed_login_is_not_recorded_as_a_name(self):
+        p = _parser(user_name=L._default_user_name)   # the real resolver: unset uid → None
+        _feed(p, [
+            "type=USER_LOGIN msg=audit(1696852800.000:12): pid=2000 uid=0 auid=4294967295 "
+            "ses=4294967295 msg='op=login acct=\"(unknown)\" exe=\"/usr/sbin/sshd\" "
+            "hostname=? addr=198.51.100.9 terminal=ssh res=failed'",
+            "type=EOE msg=audit(1696852800.000:12): ",
+        ])
+        _, events = _queued()
+        assert events[0]["action"] == "login.failed" and "osUser" not in events[0]
+
     def test_garbage_lines_are_ignored(self):
         p = _parser()
         for junk in ("", "not an audit line", "type=SYSCALL garbage", "type=EOE msg=audit(x:y):"):
@@ -539,3 +569,64 @@ class TestRunner:
 
         monkeypatch.setattr(collectors, "make_collector", boom)
         assert collectors.start() is None
+
+
+class TestSetupAtPanelStart:
+    """A box whose install/update ran unprivileged is set up by the always-running panel,
+    then the collector starts in the same process — no restart, no command typed."""
+
+    def test_an_explicit_opt_out_starts_nothing(self, monkeypatch):
+        monkeypatch.setenv("AGENTOS_NO_AUDIT_SETUP", "1")
+        assert collectors.start() is None
+
+    def test_an_explicit_off_starts_nothing(self, monkeypatch):
+        monkeypatch.delenv("AGENTOS_NO_AUDIT_SETUP", raising=False)
+        monkeypatch.setenv("AGENTOS_ACTIVITY_AUDIT", "0")
+        assert collectors.start() is None
+
+    def test_setup_then_the_collector_runs_in_the_same_process(self, monkeypatch):
+        import asyncio
+
+        from sdk.activity import os_setup
+
+        monkeypatch.delenv("AGENTOS_NO_AUDIT_SETUP", raising=False)
+        monkeypatch.delenv("AGENTOS_ACTIVITY_AUDIT", raising=False)
+        monkeypatch.setattr(os_setup, "_opted_out", lambda: False)
+        ran = []
+
+        def fake_ensure(apply=True):
+            monkeypatch.setenv("AGENTOS_ACTIVITY_AUDIT", "1")   # what setup achieves
+            return True, "activity audit enabled — installed auditd"
+
+        class Collector:
+            def run(self):
+                ran.append("run")
+
+            def stop(self):
+                pass
+
+        monkeypatch.setattr(os_setup, "ensure", fake_ensure)
+        monkeypatch.setattr(collectors, "make_collector", lambda os_name=None: Collector())
+
+        async def go():
+            task = collectors.start()
+            assert task is not None
+            await task
+        asyncio.run(go())
+        assert ran == ["run"]
+
+    def test_no_collector_when_setup_could_not_finish(self, monkeypatch):
+        import asyncio
+
+        from sdk.activity import os_setup
+
+        monkeypatch.delenv("AGENTOS_NO_AUDIT_SETUP", raising=False)
+        monkeypatch.delenv("AGENTOS_ACTIVITY_AUDIT", raising=False)
+        monkeypatch.setattr(os_setup, "_opted_out", lambda: False)
+        monkeypatch.setattr(os_setup, "ensure", lambda apply=True: (False, "run: sudo agentos activity-setup"))
+        monkeypatch.setattr(collectors, "make_collector",
+                            lambda os_name=None: pytest.fail("collector built without audit"))
+
+        async def go():
+            await collectors.start()
+        asyncio.run(go())