devops-bot-sdk 1.6.47__tar.gz → 1.6.48__tar.gz

{devops_bot_sdk-1.6.47 → devops_bot_sdk-1.6.48}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.6.47
+Version: 1.6.48
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.6.47 → devops_bot_sdk-1.6.48}/devops_bot_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.6.47
+Version: 1.6.48
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.6.47 → devops_bot_sdk-1.6.48}/sdk/__init__.py

@@ -1,6 +1,6 @@
 """AgentOS Desktop SDK — thin HTTPS/SSE client for the Electron app.
 
-Version: 1.6.47
+Version: 1.6.48
 
 Public surface:
   BackendClient.from_config()        — create client from ~/.agentos/config.toml
@@ -34,7 +34,7 @@ Rules:
   - All data egress through submit_webhook only
 """
 
-__version__ = "1.6.47"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
+__version__ = "1.6.48"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
 __author__  = "AgentOS"   # sdk.client.SDK_VERSION and the UI server version all read this.
 
 from sdk.client import BackendClient

{devops_bot_sdk-1.6.47 → devops_bot_sdk-1.6.48}/sdk/activity/os_setup.py

@@ -535,9 +535,12 @@ def ensure(apply: bool = True) -> tuple[bool, str]:
                 return False, ""      # set up already (by hand, or by an earlier run)
             if apply and sysname == "linux" and _sudo_without_password():
                 return _ensure_via_sudo()
+            import shlex
+
+            cmd = " ".join(shlex.quote(a) for a in _privileged_argv())
             return False, ("activity audit is not set up — human activity on this VPS is "
-                           f"not being recorded. Run once:\n  sudo {_agentos_exe()} "
-                           "activity-setup\nor by hand:\n" + manual)
+                           f"not being recorded. Run once:\n  sudo {cmd}\nor by hand:\n"
+                           + manual)
 
         step = {"linux": _ensure_linux, "windows": _ensure_windows, "darwin": _ensure_macos}
         _, done, err = step[sysname]()
@@ -575,7 +578,7 @@ def _ensure_via_sudo() -> tuple[bool, str]:
     installation is what runs — never whatever ``agentos`` is first on root's PATH.
     """
     before = settings.audit_enabled()
-    rc, out = _run(["sudo", "-n", sys.executable, "-m", "sdk.activity.os_setup"], timeout=1800)
+    rc, out = _run(["sudo", "-n", *_privileged_argv()], timeout=1800)
     lines = [ln.strip() for ln in out.splitlines() if ln.strip()]
     # cli() prints the outcome first ("activity audit …") and a restart hint after it.
     last = next((ln for ln in lines if ln.startswith("activity audit")), lines[-1] if lines else "")
@@ -587,12 +590,39 @@ def _ensure_via_sudo() -> tuple[bool, str]:
                      ("activity audit enabled (via sudo)" if changed else ""))
 
 
-def _agentos_exe() -> str:
-    """Absolute ``agentos`` path, so ``sudo`` finds the venv / ~/.local/bin install."""
-    exe = Path(sys.executable).parent / ("agentos.exe" if _system() == "windows" else "agentos")
-    if exe.exists():
-        return str(exe)
-    return shutil.which("agentos") or "agentos"
+def _import_path() -> str:
+    """This process's import path, for the root child.
+
+    A ``pip install --user`` puts the SDK and its dependencies in the USER's site
+    directory (``~/.local/lib/pythonX.Y/site-packages``), which root's interpreter
+    never looks in. So ``sudo python3 -m sdk.activity.os_setup`` failed with
+    ``No module named 'sdk'``, and ``sudo agentos`` failed the same way even with a
+    full path. Handing the child exactly the path this process imports from makes it
+    import what we import: a --user install, a venv or an editable checkout alike.
+    (It runs as root from user-writable directories. That grants nothing, because
+    it only happens for a user who already has root through sudo.)
+    """
+    # Not the caller's working directory (``-m`` puts it on sys.path): a root child
+    # has no business importing whatever happens to sit in the folder someone ran the
+    # panel from. Kept only when the SDK itself lives there (an editable checkout).
+    sdk_home = str(Path(__file__).resolve().parents[2])
+    cwd = os.getcwd()
+    seen: list[str] = []
+    for p in sys.path:
+        if not p or not os.path.isdir(p):
+            continue
+        p = os.path.abspath(p)
+        if p == cwd and p != sdk_home:
+            continue
+        if p not in seen:
+            seen.append(p)
+    return os.pathsep.join(seen)
+
+
+def _privileged_argv() -> list[str]:
+    """The command (minus ``sudo``) that runs the privileged half: same interpreter,
+    same import path, through ``env`` so ``sudo``'s environment reset cannot drop it."""
+    return ["env", f"PYTHONPATH={_import_path()}", sys.executable, "-m", "sdk.activity.os_setup"]
 
 
 def cli(argv: list[str]) -> int:

{devops_bot_sdk-1.6.47 → devops_bot_sdk-1.6.48}/tests/test_activity_os_setup.py

@@ -233,7 +233,11 @@ def test_unprivileged_with_passwordless_sudo_sets_itself_up(box, monkeypatch, tm
     monkeypatch.setattr(O, "_run", run)
 
     changed, msg = O.ensure()
-    assert calls == [["sudo", "-n", O.sys.executable, "-m", "sdk.activity.os_setup"]]
+    assert len(calls) == 1
+    cmd = calls[0]
+    assert cmd[:3] == ["sudo", "-n", "env"]
+    assert cmd[3].startswith("PYTHONPATH=")
+    assert cmd[4:] == [O.sys.executable, "-m", "sdk.activity.os_setup"]
     assert changed is True
     assert msg.startswith("activity audit enabled")
 
@@ -247,13 +251,16 @@ def test_a_failing_sudo_run_is_reported_not_raised(box, monkeypatch):
     assert changed is False and "incomplete" in msg and "audit rules did not load" in msg
 
 
-def test_sudo_with_a_password_prints_one_command_with_an_absolute_path(box, monkeypatch):
+def test_sudo_with_a_password_prints_one_command_that_root_can_actually_run(box, monkeypatch):
+    """`sudo agentos activity-setup` cannot work for a --user install: root neither
+    finds `agentos` nor can import `sdk`. The hint carries the interpreter and path."""
     monkeypatch.setattr(O, "_is_privileged", lambda: False)
     monkeypatch.setattr(O, "_sudo_without_password", lambda: False)
-    monkeypatch.setattr(O, "_agentos_exe", lambda: "/home/umer/venv/bin/agentos")
+    monkeypatch.setattr(O, "_import_path", lambda: "/home/umer/.local/lib/python3.12/site-packages")
     changed, msg = O.ensure()
     assert changed is False
-    assert "sudo /home/umer/venv/bin/agentos activity-setup" in msg
+    assert ("sudo env PYTHONPATH=/home/umer/.local/lib/python3.12/site-packages "
+            f"{O.sys.executable} -m sdk.activity.os_setup") in msg
 
 
 def test_flag_on_but_log_unreadable_is_not_treated_as_set_up(box, monkeypatch):
@@ -264,7 +271,7 @@ def test_flag_on_but_log_unreadable_is_not_treated_as_set_up(box, monkeypatch):
     tried = []
     monkeypatch.setattr(O, "_sudo_without_password", lambda: tried.append(1) or False)
     _, msg = O.ensure()
-    assert tried and "activity-setup" in msg
+    assert tried and "-m sdk.activity.os_setup" in msg
 
 
 def test_sudo_is_never_tried_on_a_check(box, monkeypatch):
@@ -281,3 +288,26 @@ def test_privileged_without_sudo_is_a_root_panel_and_never_a_guessed_user(monkey
     assert O._panel_user() is None
     monkeypatch.setenv("SUDO_USER", "root")
     assert O._panel_user() is None
+
+
+def test_the_root_child_can_import_the_sdk_without_site_packages(tmp_path):
+    """Regression for a `pip install --user` box: under sudo, root's interpreter does
+    not see the user's site-packages (`No module named 'sdk'`). `-S` drops site-packages
+    the same way, so with only the PYTHONPATH we hand over, the import must succeed."""
+    import subprocess
+
+    argv = O._privileged_argv()
+    env = {"PATH": "/usr/bin:/bin", argv[1].split("=", 1)[0]: argv[1].split("=", 1)[1]}
+    proc = subprocess.run(
+        [argv[2], "-S", "-c", "import sdk.activity.os_setup"],
+        cwd=tmp_path, env=env, capture_output=True, text=True, timeout=60,
+    )
+    assert proc.returncode == 0, proc.stderr
+
+
+def test_the_working_directory_is_not_handed_to_root(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    monkeypatch.setattr(O.sys, "path", [str(tmp_path), "", *O.sys.path])
+    parts = O._import_path().split(O.os.pathsep)
+    assert str(tmp_path) not in parts
+    assert len(parts) == len(set(parts))