devops-bot-sdk 1.6.48__tar.gz → 1.6.49__tar.gz

{devops_bot_sdk-1.6.48 → devops_bot_sdk-1.6.49}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.6.48
+Version: 1.6.49
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.6.48 → devops_bot_sdk-1.6.49}/devops_bot_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.6.48
+Version: 1.6.49
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.6.48 → devops_bot_sdk-1.6.49}/sdk/__init__.py

@@ -1,6 +1,6 @@
 """AgentOS Desktop SDK — thin HTTPS/SSE client for the Electron app.
 
-Version: 1.6.48
+Version: 1.6.49
 
 Public surface:
   BackendClient.from_config()        — create client from ~/.agentos/config.toml
@@ -34,7 +34,7 @@ Rules:
   - All data egress through submit_webhook only
 """
 
-__version__ = "1.6.48"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
+__version__ = "1.6.49"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
 __author__  = "AgentOS"   # sdk.client.SDK_VERSION and the UI server version all read this.
 
 from sdk.client import BackendClient

{devops_bot_sdk-1.6.48 → devops_bot_sdk-1.6.49}/sdk/activity/collectors/linux_auditd.py

@@ -53,6 +53,8 @@ _UNSET = {"4294967295", "-1", "unset"}
 #: Records of one event share a serial; bound how many half-seen events we hold.
 _MAX_PENDING = 512
 _MAX_PID_CACHE = 20_000
+#: ``acct`` values on a failed login that are placeholders, not an account name.
+_NOT_A_NAME = ("(unknown)", "(invalid user)", "?")
 
 _HEADER = re.compile(r"type=(\w+) msg=audit\((\d+(?:\.\d+)?):(\d+)\):\s?(.*)")
 _KV = re.compile(r"""(\w+)=("[^"]*"|'[^']*'|\S+)""")
@@ -225,12 +227,17 @@ class AuditdParser:
             # The attempted account name: a failed login has no uid to resolve (it is
             # unset, or an invalid user), so without acct the record says nothing about
             # which names an attacker is trying.
+            # OpenSSH writes the literal "(invalid user)" (hex-encoded) when the name does
+            # not exist on the box, and never the name itself, so it is a flag, not a
+            # user. The attempted name is only in sshd's auth.log line.
             acct = rec.get("m_acct", "")
-            tried = acct if acct and acct not in ("(unknown)", "?") else user
+            invalid = acct == "(invalid user)"
+            tried = acct if acct and acct not in _NOT_A_NAME else user
             recorder.record_event(ActivityEvent(
                 os=Os.LINUX, source=Source.AUDITD, category=Category.LOGIN, action="login.failed",
                 occurredAt=ts, osUser=tried, target=remote, severity=Severity.WARNING,
                 actorType=ActorType.UNKNOWN, actorConfidence=0,
+                metadata={"invalidUser": True} if invalid else None,
             ))
             return
         if not _is_set(ses):

{devops_bot_sdk-1.6.48 → devops_bot_sdk-1.6.49}/tests/test_activity_collectors.py

@@ -235,6 +235,23 @@ class TestAuditdParsing:
         _, events = _queued()
         assert events[0]["action"] == "login.failed" and events[0]["osUser"] == expected
 
+    def test_an_invalid_user_attempt_is_flagged_not_named(self):
+        """Real line from a VPS (OpenSSH 9.8 sshd-session): the name of a NON-existent
+        account is never written; acct is the hex of "(invalid user)"."""
+        p = _parser(user_name=L._default_user_name)
+        _feed(p, [
+            "type=USER_LOGIN msg=audit(1791568160.154:240124): pid=1828747 uid=0 "
+            "auid=4294967295 ses=4294967295 subj=unconfined msg='op=login "
+            "acct=28696E76616C6964207573657229 exe=\"/usr/lib/openssh/sshd-session\" "
+            "hostname=? addr=80.94.92.55 terminal=sshd res=failed'UID=\"root\" AUID=\"unset\"",
+            "type=EOE msg=audit(1791568160.154:240124): ",
+        ])
+        _, events = _queued()
+        e = events[0]
+        assert e["action"] == "login.failed" and e["target"] == "80.94.92.55"
+        assert "osUser" not in e
+        assert e["metadata"] == {"invalidUser": True}
+
     def test_an_unknown_account_on_a_failed_login_is_not_recorded_as_a_name(self):
         p = _parser(user_name=L._default_user_name)   # the real resolver: unset uid → None
         _feed(p, [