devops-bot-sdk 1.6.69__tar.gz → 1.6.70__tar.gz

{devops_bot_sdk-1.6.69 → devops_bot_sdk-1.6.70}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.6.69
+Version: 1.6.70
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.6.69 → devops_bot_sdk-1.6.70}/devops_bot_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.6.69
+Version: 1.6.70
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.6.69 → devops_bot_sdk-1.6.70}/devops_bot_sdk.egg-info/SOURCES.txt

@@ -53,6 +53,7 @@ sdk/tickets.py
 sdk/updater.py
 sdk/url_access.py
 sdk/vps_health.py
+sdk/vps_identity.py
 sdk/write_hook.py
 sdk/activity/__init__.py
 sdk/activity/classifier.py
@@ -226,6 +227,7 @@ tests/test_updater_pep668.py
 tests/test_updater_reports_the_truth.py
 tests/test_url_access.py
 tests/test_vps_health.py
+tests/test_vps_only_reporting.py
 tests/test_windows_loop_identity.py
 tests/test_windows_task_paths.py
 tests/test_write_hook.py

{devops_bot_sdk-1.6.69 → devops_bot_sdk-1.6.70}/sdk/__init__.py

@@ -1,6 +1,6 @@
 """AgentOS Desktop SDK — thin HTTPS/SSE client for the Electron app.
 
-Version: 1.6.69
+Version: 1.6.70
 
 Public surface:
   BackendClient.from_config()        — create client from ~/.agentos/config.toml
@@ -34,7 +34,7 @@ Rules:
   - All data egress through submit_webhook only
 """
 
-__version__ = "1.6.69"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
+__version__ = "1.6.70"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
 __author__  = "AgentOS"   # sdk.client.SDK_VERSION and the UI server version all read this.
 
 from sdk.client import BackendClient

{devops_bot_sdk-1.6.69 → devops_bot_sdk-1.6.70}/sdk/activity/os_setup.py

@@ -188,6 +188,11 @@ def _flag_value() -> str:
                 return value.strip().strip('"').strip("'")
     except OSError:
         pass
+    # Under sudo, settings.setting reads ROOT's .env. Falling back to it made a
+    # flag left in /root/.agentos/.env answer for the panel user, so _enable_flag
+    # never wrote theirs and the collector never started — on every restart.
+    if _is_privileged() and _panel_user() is not None:
+        return ""
     return settings.setting(AUDIT_FLAG)
 
 

{devops_bot_sdk-1.6.69 → devops_bot_sdk-1.6.70}/sdk/activity/shipper.py

@@ -176,12 +176,57 @@ async def flush_once(
     return result
 
 
+def discard_spool(spool: Spool | None = None) -> int:
+    """Delete everything queued, without sending it. Returns the rows dropped."""
+    spool = spool or settings.get_spool()
+    dropped = 0
+    while True:
+        chunk = spool.next_chunk()
+        if not chunk:
+            return dropped
+        dropped += len(chunk)
+        spool.ack(chunk)
+
+
+async def ship_tick(
+    is_vps: Callable[[], Awaitable[bool | None]] | None = None,
+) -> FlushResult | None:
+    """One cron tick: ship only from the caller's assigned VPS.
+
+    The relay files every batch under the TOKEN's VPS, so a laptop running the SDK
+    with the same token put its own events in the VPS's audit trail. On a machine
+    that is definitely not the VPS the queue is discarded — kept, it would only grow
+    forever, since that machine will never be allowed to send it. When the answer
+    is unknown (profile unreachable) everything is kept for the next tick.
+    """
+    if is_vps is None:
+        from sdk import vps_identity
+        is_vps = vps_identity.is_assigned_vps
+    try:
+        verdict = await is_vps()
+    except Exception:  # noqa: BLE001 — is_assigned_vps never raises, but be certain
+        verdict = None
+    if verdict is None:
+        return None
+    if verdict is False:
+        try:
+            dropped = discard_spool()
+        except Exception as exc:  # noqa: BLE001
+            logger.warning("activity: could not discard the spool: %s", exc)
+            return None
+        if dropped:
+            logger.info("activity.not_assigned_vps discarded=%d (this machine is not the "
+                        "user's VPS; nothing is shipped from it)", dropped)
+        return None
+    return await flush_once()
+
+
 async def run_forever(interval_s: float | None = None, *, initial_delay_s: float = 30.0) -> None:
     """Flush every ``interval_s`` (default 5 minutes) until cancelled."""
     await asyncio.sleep(initial_delay_s)
     while True:
         try:
-            await flush_once()
+            await ship_tick()
             every = interval_s if interval_s is not None else settings.ship_interval_seconds()
             await asyncio.sleep(every)
         except asyncio.CancelledError:

{devops_bot_sdk-1.6.69 → devops_bot_sdk-1.6.70}/sdk/agents/activity.py

@@ -79,7 +79,7 @@ def describe(name: str, kind: str, result: dict | None, duration_s: float = 0.0,
 #     per-run event. So an agent run costs one POST no matter how chatty it is.
 _LINE_BUF: dict[str, list[str]] = {}
 _LINE_BUF_MAX_LINES = 40          # keep the tail — recent lines are the useful ones
-_LINE_BUF_MAX_CHARS = 4000        # bounded like _ACTIVITY_FLUSH_MAX_CHARS
+_LINE_BUF_MAX_CHARS = 4000        # trimmed to the gateway limit by client._fit_activity
 
 
 def note(bucket: str, text: str) -> None:

{devops_bot_sdk-1.6.69 → devops_bot_sdk-1.6.70}/sdk/client.py

@@ -121,9 +121,19 @@ def _notify_status(task_id: str, status: str) -> None:
 # `logger.info` line regardless of whether it buffers or POSTs.
 _ACTIVITY_FLUSH_MIN_S = float(os.getenv("AGENTOS_ACTIVITY_FLUSH_MIN_S", "") or 180.0)
 _ACTIVITY_FLUSH_MAX_S = float(os.getenv("AGENTOS_ACTIVITY_FLUSH_MAX_S", "") or 300.0)
-# Cap the coalesced payload so one flush can't POST a multi-megabyte body after a
-# very long, chatty run; keep the tail (most recent lines are the most useful).
-_ACTIVITY_FLUSH_MAX_CHARS = 8000
+# The gateway rejects an `activity` over 2000 characters with a 400 ("Activity
+# must be shorter than or equal to 2000 characters"). The cap used to be 8000, so
+# every coalesced flush and every long scheduled-run summary was refused and the
+# run left no trace in agent_activities. Keep the tail: the most recent lines are
+# the most useful.
+_ACTIVITY_MAX_CHARS = 2000
+
+
+def _fit_activity(text: str) -> str:
+    """``text`` cut to the gateway's limit, keeping the tail behind a ``…`` marker."""
+    if len(text) <= _ACTIVITY_MAX_CHARS:
+        return text
+    return "…\n" + text[-(_ACTIVITY_MAX_CHARS - 2):]
 
 
 class ActivityFlusher:
@@ -167,9 +177,7 @@ class ActivityFlusher:
         if not self._buf:
             return  # nothing pending → don't open a connection at all
         lines, self._buf = self._buf, []  # swap out atomically (no await between)
-        body = "\n".join(lines)
-        if len(body) > _ACTIVITY_FLUSH_MAX_CHARS:
-            body = "…\n" + body[-_ACTIVITY_FLUSH_MAX_CHARS:]
+        body = _fit_activity("\n".join(lines))
         try:
             await self._client.log_activity(body, task_id=self._task_id, immediate=True)
         except Exception as exc:  # noqa: BLE001 — never let a flush break a run
@@ -313,6 +321,29 @@ class BackendClient:
         except Exception as exc:
             raise BackendUnreachable(self._base_url, str(exc)) from exc
 
+    async def assigned_vps_ip(self) -> str:
+        """The IP of the caller's assigned VPS from ``GET /ml-api/users/profile``.
+
+        ``""`` when the profile names no VPS. Raises BackendUnreachable /
+        BackendAuthFailed — the caller (``sdk.vps_identity``) turns those into
+        "unknown" rather than "not a VPS".
+        """
+        from sdk.config import BE_DEFAULT_URL
+        from sdk.vps_identity import extract_vps_ip
+
+        url = f"{BE_DEFAULT_URL.rstrip('/')}/ml-api/users/profile"
+        headers = {**self._headers, "accept": "*/*", "developer-name": "null", "product": ""}
+        try:
+            async with httpx.AsyncClient(timeout=15.0) as client:
+                resp = await client.get(url, headers=headers)
+            _check_status(resp.status_code, url)
+            data = (resp.json() or {}).get("data") or {}
+        except (BackendAuthFailed, BackendVersionTooOld):
+            raise
+        except Exception as exc:
+            raise BackendUnreachable(url, str(exc)) from exc
+        return extract_vps_ip(data.get("user") or {})
+
     async def profile(self) -> UserProfile:
         """GET {BE}/ml-api/users/profile — the caller's role + department.
 
@@ -1766,7 +1797,7 @@ class BackendClient:
             "developer-name": "null",
             "product": "",
         }
-        body: dict[str, str] = {"activity": str(activity)}
+        body: dict[str, str] = {"activity": _fit_activity(str(activity))}
         tid = str(task_id or "").strip()
         if tid:
             body["taskId"] = tid
@@ -1800,7 +1831,7 @@ class BackendClient:
             return False
         url = f"{ML_GATEWAY_URL.rstrip('/')}/ml-api/agent-activity"
         headers = {**self._headers, "accept": "*/*", "developer-name": "null", "product": ""}
-        body: dict[str, str] = {"activity": str(activity), "agentId": aid}
+        body: dict[str, str] = {"activity": _fit_activity(str(activity)), "agentId": aid}
         tid = str(task_id or "").strip()
         if tid:
             body["taskId"] = tid

{devops_bot_sdk-1.6.69 → devops_bot_sdk-1.6.70}/sdk/vps_health.py

@@ -211,10 +211,18 @@ async def report_once(client: "BackendClient | None" = None) -> bool:
     """Collect + PATCH one health snapshot. Returns True on a 2xx. Never raises."""
     payload: dict[str, Any] = {}
     try:
-        payload = build_payload()
         if client is None:
             from sdk.client import BackendClient
             client = BackendClient.from_config()
+        # Only the assigned VPS may write the VPS row — a laptop running the SDK
+        # with the same token used to overwrite it (see sdk.vps_identity).
+        from sdk import vps_identity
+        verdict = await vps_identity.is_assigned_vps(client)
+        if verdict is not True:
+            reason = "not_assigned_vps" if verdict is False else "vps_identity_unknown"
+            _LAST.update({"at": _now_iso_ms(), "ok": False, "reason": reason, "payload": {}})
+            return False
+        payload = build_payload()
         ok = await client.report_vps_allocation(payload)
         _LAST.update({
             "at": payload.get("lastPingedAt", ""),

devops_bot_sdk-1.6.70/sdk/vps_identity.py

@@ -0,0 +1,174 @@
+"""Is THIS machine the caller's assigned VPS?
+
+Health pings (``sdk.vps_health``) and the activity trail (``sdk.activity.shipper``)
+both describe "your VPS", and both are keyed SERVER-side on the ``co_`` token — one
+``contabo_allocation`` row per user. So every machine that ran the SDK with that
+token reported as the VPS: a laptop's CPU, RAM, disk and uptime overwrote the VPS
+row every two hours, and the laptop's events landed in the VPS's audit trail. A
+user with the SDK on a laptop and a VPS had a "VPS" whose boot time was the
+laptop's.
+
+The answer comes from comparing the IP the platform has on record for the user's
+VPS (``GET /ml-api/users/profile`` → ``vps.ipAddress``, the field the backend's
+proxy already trusts) with this machine's own addresses. Nothing leaves the
+machine to find those — interface addresses plus the route-to-internet address —
+so the SDK's one-egress-path rule holds.
+
+Three answers, and the callers treat them differently:
+  ``True``   this is the assigned VPS — report.
+  ``False``  it is not (or the user has no VPS) — do not report.
+  ``None``   unknown (profile unreachable) — skip this tick, ask again next tick.
+             Never reported on a guess, and never cached.
+
+``AGENTOS_IS_VPS`` overrides the check: ``1`` for a VPS behind NAT whose public
+address is not on any interface, ``0`` to silence a machine outright.
+"""
+from __future__ import annotations
+
+import ipaddress
+import logging
+import os
+import socket
+import time
+from typing import TYPE_CHECKING, Any
+
+if TYPE_CHECKING:  # pragma: no cover — typing only
+    from sdk.client import BackendClient
+
+logger = logging.getLogger("sdk.vps_identity")
+
+#: A machine does not change into (or out of) a VPS often; a definite answer is
+#: reused this long so a 5-minute shipper does not fetch the profile every tick.
+CACHE_TTL_S = 6 * 3600.0
+
+_TRUTHY = {"1", "true", "yes", "on"}
+_FALSEY = {"0", "false", "no", "off"}
+
+# Profile shapes the ML backend has used for the VPS address — the same tolerant
+# set the AI backend reads (devops-bot-ai shared/dependencies._extract_vps_ip).
+_IP_KEYS = ("vpsIp", "vps_ip", "vpsIP", "vpsIpAddress", "vpsAddress", "vpsHost",
+            "serverIp", "server_ip", "ipAddress", "ip_address", "ip")
+_NESTED_KEYS = ("vps", "server", "machine", "allocation")
+_NESTED_FIELDS = ("ipAddress", "ip_address", "ip", "host", "address")
+
+_cache: dict[str, Any] = {"at": 0.0, "value": None}
+
+
+def _setting(name: str) -> str:
+    """Process env first, then ``~/.agentos/.env`` — same resolution as the panel toggles."""
+    val = (os.environ.get(name) or "").strip()
+    if val:
+        return val
+    try:
+        from sdk.config import _dotenv_value
+        return (_dotenv_value(name) or "").strip()
+    except Exception:  # noqa: BLE001 — a config read must never break reporting
+        return ""
+
+
+def override() -> bool | None:
+    """``AGENTOS_IS_VPS`` as a bool, or ``None`` when unset/unrecognised."""
+    raw = _setting("AGENTOS_IS_VPS").lower()
+    if raw in _TRUTHY:
+        return True
+    if raw in _FALSEY:
+        return False
+    return None
+
+
+def _as_ip(value: str) -> str:
+    """The bare IP in ``value`` (which may be a URL or ``host:port``), or ``""``."""
+    v = value.strip()
+    if "://" in v:
+        v = v.split("://", 1)[1]
+    v = v.split("/", 1)[0]
+    if v.startswith("[") and "]" in v:          # [ipv6]:port
+        v = v[1:v.index("]")]
+    elif v.count(":") == 1:                      # ipv4:port / host:port
+        v = v.split(":", 1)[0]
+    try:
+        return str(ipaddress.ip_address(v))
+    except ValueError:
+        return ""
+
+
+def extract_vps_ip(user: dict) -> str:
+    """The assigned VPS IP from a profile ``user`` object; ``""`` when it names none."""
+    for k in _IP_KEYS:
+        v = user.get(k)
+        if isinstance(v, str) and _as_ip(v):
+            return _as_ip(v)
+    for k in _NESTED_KEYS:
+        obj = user.get(k)
+        if isinstance(obj, str) and _as_ip(obj):
+            return _as_ip(obj)
+        if isinstance(obj, dict):
+            for f in _NESTED_FIELDS:
+                v = obj.get(f)
+                if isinstance(v, str) and _as_ip(v):
+                    return _as_ip(v)
+    return ""
+
+
+def local_addresses() -> set[str]:
+    """Every address this machine holds: interfaces, hostname, route to the internet."""
+    found: set[str] = set()
+    try:
+        import psutil
+        for addrs in psutil.net_if_addrs().values():
+            for a in addrs:
+                if a.family in (socket.AF_INET, socket.AF_INET6):
+                    ip = _as_ip(a.address.split("%", 1)[0])
+                    if ip:
+                        found.add(ip)
+    except Exception:  # noqa: BLE001 — psutil is an optional extra
+        pass
+    try:
+        for info in socket.getaddrinfo(socket.gethostname(), None):
+            ip = _as_ip(str(info[4][0]).split("%", 1)[0])
+            if ip:
+                found.add(ip)
+    except Exception:  # noqa: BLE001
+        pass
+    try:
+        from sdk.vps_health import _outbound_ip
+        ip = _as_ip(_outbound_ip())
+        if ip:
+            found.add(ip)
+    except Exception:  # noqa: BLE001
+        pass
+    return found
+
+
+async def is_assigned_vps(client: "BackendClient | None" = None) -> bool | None:
+    """``True`` / ``False`` / ``None`` (unknown) — see the module docstring. Never raises."""
+    forced = override()
+    if forced is not None:
+        return forced
+    now = time.monotonic()
+    if _cache["value"] is not None and now - _cache["at"] < CACHE_TTL_S:
+        return _cache["value"]
+    try:
+        if client is None:
+            from sdk.client import BackendClient
+            client = BackendClient.from_config()
+        assigned = await client.assigned_vps_ip()
+    except Exception as exc:  # noqa: BLE001 — offline / auth / not configured
+        logger.info("vps_identity.unknown err=%s", exc)
+        return None
+    if not assigned:
+        value, why = False, "no VPS is assigned to this user"
+    else:
+        value = assigned in local_addresses()
+        why = (f"this machine holds {assigned}" if value else
+               f"this machine does not hold the assigned VPS address {assigned} — "
+               f"set AGENTOS_IS_VPS=1 if it is the VPS behind NAT")
+    if value != _cache["value"]:
+        logger.info("vps_identity.%s (%s)", "assigned_vps" if value else "not_assigned_vps", why)
+    _cache.update(at=now, value=value)
+    return value
+
+
+def reset_cache() -> None:
+    """Forget the cached answer (tests, and after the user's VPS changes)."""
+    _cache.update(at=0.0, value=None)

{devops_bot_sdk-1.6.69 → devops_bot_sdk-1.6.70}/tests/test_vps_health.py

@@ -139,6 +139,15 @@ class _FakeClient:
 
 
 class TestReportOnce:
+    @pytest.fixture(autouse=True)
+    def on_the_assigned_vps(self, monkeypatch):
+        """These tests are about the PATCH; the VPS-only gate has its own tests."""
+        from sdk import vps_identity
+
+        async def yes(client=None):
+            return True
+        monkeypatch.setattr(vps_identity, "is_assigned_vps", yes)
+
     def test_patches_and_records_last(self, monkeypatch):
         monkeypatch.setattr(vps_health, "build_payload", lambda: {"status": "RUNNING",
                                                                  "lastPingedAt": "t"})

devops_bot_sdk-1.6.70/tests/test_vps_only_reporting.py

@@ -0,0 +1,234 @@
+"""Only the user's assigned VPS reports health and ships activity.
+
+The incident: a user ran the SDK on a laptop AND on their VPS with the same
+``co_`` token. Both health pings and the activity relay are keyed server-side on
+the token, so the laptop's CPU/RAM/disk/uptime overwrote the VPS row every two
+hours (the "VPS" booted when the laptop did, and showed the laptop's 85% disk),
+and the laptop's events were filed under the VPS's audit trail.
+"""
+from __future__ import annotations
+
+import asyncio
+
+import pytest
+
+from sdk import vps_health, vps_identity
+from sdk.activity import shipper
+
+
+@pytest.fixture(autouse=True)
+def hermetic(monkeypatch):
+    import sdk.config as cfg
+    monkeypatch.setattr(cfg, "_dotenv_value", lambda key: "")
+    monkeypatch.delenv("AGENTOS_IS_VPS", raising=False)
+    vps_identity.reset_cache()
+    yield
+    vps_identity.reset_cache()
+
+
+class _Client:
+    def __init__(self, assigned: str | Exception = "77.68.23.23", ok: bool = True) -> None:
+        self.assigned = assigned
+        self.ok = ok
+        self.profile_calls = 0
+        self.reports: list[dict] = []
+
+    async def assigned_vps_ip(self) -> str:
+        self.profile_calls += 1
+        if isinstance(self.assigned, Exception):
+            raise self.assigned
+        return self.assigned
+
+    async def report_vps_allocation(self, payload: dict) -> bool:
+        self.reports.append(payload)
+        return self.ok
+
+
+def _holds(monkeypatch, *ips: str) -> None:
+    monkeypatch.setattr(vps_identity, "local_addresses", lambda: set(ips))
+
+
+class TestProfileParsing:
+    @pytest.mark.parametrize("user, want", [
+        ({"vps": {"ipAddress": "77.68.23.23"}}, "77.68.23.23"),
+        ({"vpsIp": "77.68.23.23"}, "77.68.23.23"),
+        ({"vps": {"url": "http://77.68.23.23:8765"}, "vpsHost": "http://77.68.23.23:8765"},
+         "77.68.23.23"),
+        ({"server": {"host": "77.68.23.23:22"}}, "77.68.23.23"),
+        ({"vps": None}, ""),
+        ({"vps": {"ipAddress": "not-an-ip"}}, ""),
+        ({}, ""),
+    ])
+    def test_extracts_the_assigned_ip(self, user, want):
+        assert vps_identity.extract_vps_ip(user) == want
+
+
+class TestIsAssignedVps:
+    def test_the_vps_itself(self, monkeypatch):
+        _holds(monkeypatch, "127.0.0.1", "77.68.23.23")
+        assert asyncio.run(vps_identity.is_assigned_vps(_Client())) is True
+
+    def test_a_laptop_with_the_same_token(self, monkeypatch):
+        _holds(monkeypatch, "127.0.0.1", "192.168.18.16")
+        assert asyncio.run(vps_identity.is_assigned_vps(_Client())) is False
+
+    def test_a_user_with_no_vps(self, monkeypatch):
+        _holds(monkeypatch, "77.68.23.23")
+        assert asyncio.run(vps_identity.is_assigned_vps(_Client(assigned=""))) is False
+
+    def test_profile_unreachable_is_unknown_and_not_cached(self, monkeypatch):
+        _holds(monkeypatch, "77.68.23.23")
+        down = _Client(assigned=RuntimeError("offline"))
+        assert asyncio.run(vps_identity.is_assigned_vps(down)) is None
+        up = _Client()
+        assert asyncio.run(vps_identity.is_assigned_vps(up)) is True
+        assert up.profile_calls == 1
+
+    def test_a_definite_answer_is_cached(self, monkeypatch):
+        _holds(monkeypatch, "77.68.23.23")
+        client = _Client()
+        for _ in range(3):
+            assert asyncio.run(vps_identity.is_assigned_vps(client)) is True
+        assert client.profile_calls == 1
+
+    @pytest.mark.parametrize("raw, want", [("1", True), ("true", True), ("0", False), ("off", False)])
+    def test_override_wins_without_a_profile_call(self, monkeypatch, raw, want):
+        monkeypatch.setenv("AGENTOS_IS_VPS", raw)
+        _holds(monkeypatch)                       # holds nothing
+        client = _Client()
+        assert asyncio.run(vps_identity.is_assigned_vps(client)) is want
+        assert client.profile_calls == 0
+
+
+class TestHealthOnlyFromTheVps:
+    def test_a_laptop_sends_no_ping(self, monkeypatch):
+        _holds(monkeypatch, "192.168.18.16")
+        monkeypatch.setattr(vps_health, "build_payload", lambda: {"status": "RUNNING"})
+        client = _Client()
+        assert asyncio.run(vps_health.report_once(client)) is False
+        assert client.reports == []
+        assert vps_health.last_report()["last"]["reason"] == "not_assigned_vps"
+
+    def test_unknown_sends_no_ping(self, monkeypatch):
+        monkeypatch.setattr(vps_health, "build_payload", lambda: {"status": "RUNNING"})
+        client = _Client(assigned=RuntimeError("offline"))
+        assert asyncio.run(vps_health.report_once(client)) is False
+        assert client.reports == []
+        assert vps_health.last_report()["last"]["reason"] == "vps_identity_unknown"
+
+    def test_the_vps_pings(self, monkeypatch):
+        _holds(monkeypatch, "77.68.23.23")
+        monkeypatch.setattr(vps_health, "build_payload", lambda: {"status": "RUNNING"})
+        client = _Client()
+        assert asyncio.run(vps_health.report_once(client)) is True
+        assert client.reports == [{"status": "RUNNING"}]
+
+
+class TestActivityOnlyFromTheVps:
+    @pytest.fixture
+    def flushed(self, monkeypatch):
+        calls = []
+
+        async def fake_flush():
+            calls.append(1)
+            return shipper.FlushResult()
+        monkeypatch.setattr(shipper, "flush_once", fake_flush)
+        return calls
+
+    @staticmethod
+    def _answer(value):
+        async def f():
+            return value
+        return f
+
+    def test_the_vps_ships(self, flushed):
+        asyncio.run(shipper.ship_tick(self._answer(True)))
+        assert flushed == [1]
+
+    def test_unknown_keeps_everything_for_next_tick(self, monkeypatch, flushed):
+        discarded = []
+        monkeypatch.setattr(shipper, "discard_spool", lambda spool=None: discarded.append(1) or 0)
+        asyncio.run(shipper.ship_tick(self._answer(None)))
+        assert flushed == [] and discarded == []
+
+    def test_a_laptop_discards_instead_of_shipping(self, monkeypatch, flushed):
+        discarded = []
+        monkeypatch.setattr(shipper, "discard_spool", lambda spool=None: discarded.append(1) or 7)
+        asyncio.run(shipper.ship_tick(self._answer(False)))
+        assert flushed == [] and discarded == [1]
+
+    def test_discard_empties_a_real_spool(self, tmp_path):
+        from sdk.activity.spool import Spool
+
+        spool = Spool(tmp_path / "activity.db")
+        for i in range(3):
+            spool.add_event({"eventId": f"e{i}", "occurredAt": "2026-10-22T00:00:00Z",
+                             "category": "COMMAND", "action": "exec"})
+        assert spool.count() == 3
+        assert shipper.discard_spool(spool) == 3
+        assert spool.count() == 0
+
+
+class TestActivityFitsTheGatewayLimit:
+    """The gateway 400s an `activity` over 2000 chars; the cap was 8000."""
+
+    def test_short_text_is_untouched(self):
+        from sdk.client import _fit_activity
+        assert _fit_activity("ran 3 checks") == "ran 3 checks"
+
+    def test_long_text_keeps_the_tail_within_the_limit(self):
+        from sdk.client import _ACTIVITY_MAX_CHARS, _fit_activity
+        text = "old line\n" * 500 + "FINAL SUMMARY"
+        out = _fit_activity(text)
+        assert len(out) <= _ACTIVITY_MAX_CHARS == 2000
+        assert out.startswith("…\n") and out.endswith("FINAL SUMMARY")
+
+    def test_agent_activity_post_is_trimmed(self, monkeypatch):
+        import httpx
+        from sdk.client import BackendClient
+
+        sent = {}
+
+        class _Resp:
+            status_code = 201
+            text = ""
+
+        class _HTTP:
+            def __init__(self, *a, **k): pass
+            async def __aenter__(self): return self
+            async def __aexit__(self, *a): return False
+            async def post(self, url, json=None, headers=None):
+                sent.update(json)
+                return _Resp()
+        monkeypatch.setattr(httpx, "AsyncClient", _HTTP)
+        client = BackendClient.__new__(BackendClient)
+        client._headers = {}
+        assert asyncio.run(client.log_agent_activity("x" * 5000, agent_id="a1")) is True
+        assert len(sent["activity"]) == 2000
+
+
+class TestAuditFlagIsTheUsersNotRoots:
+    """Under sudo, a flag in /root/.agentos/.env answered for the panel user."""
+
+    def test_roots_dotenv_does_not_answer_for_the_panel_user(self, monkeypatch, tmp_path):
+        from sdk.activity import os_setup
+
+        user_home = tmp_path / "nouman"
+        monkeypatch.delenv(os_setup.AUDIT_FLAG, raising=False)
+        monkeypatch.setattr(os_setup, "_is_privileged", lambda: True)
+        monkeypatch.setattr(os_setup, "_panel_user", lambda: ("nouman", user_home, 1000, 1000))
+        monkeypatch.setattr(os_setup.settings, "setting", lambda name: "1")   # root's .env
+        assert os_setup._flag_value() == ""
+
+        (user_home / ".agentos").mkdir(parents=True)
+        (user_home / ".agentos" / ".env").write_text(f"{os_setup.AUDIT_FLAG}=1\n")
+        assert os_setup._flag_value() == "1"
+
+    def test_unprivileged_still_reads_settings(self, monkeypatch, tmp_path):
+        from sdk.activity import os_setup
+
+        monkeypatch.delenv(os_setup.AUDIT_FLAG, raising=False)
+        monkeypatch.setattr(os_setup, "_is_privileged", lambda: False)
+        monkeypatch.setattr(os_setup.Path, "home", classmethod(lambda cls: tmp_path))
+        monkeypatch.setattr(os_setup.settings, "setting", lambda name: "1")
+        assert os_setup._flag_value() == "1"