devops-bot-sdk 1.6.69__tar.gz → 1.6.71__tar.gz

{devops_bot_sdk-1.6.69 → devops_bot_sdk-1.6.71}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.6.69
+Version: 1.6.71
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.6.69 → devops_bot_sdk-1.6.71}/devops_bot_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.6.69
+Version: 1.6.71
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.6.69 → devops_bot_sdk-1.6.71}/devops_bot_sdk.egg-info/SOURCES.txt

@@ -53,6 +53,7 @@ sdk/tickets.py
 sdk/updater.py
 sdk/url_access.py
 sdk/vps_health.py
+sdk/vps_identity.py
 sdk/write_hook.py
 sdk/activity/__init__.py
 sdk/activity/classifier.py
@@ -143,6 +144,7 @@ sdk/ui/static/tickets.html
 sdk/vendor/aidraftsman-cli-0.1.0.tgz
 tests/test_activity_collectors.py
 tests/test_activity_core.py
+tests/test_activity_live_tracking.py
 tests/test_activity_macos.py
 tests/test_activity_os_setup.py
 tests/test_activity_pipeline.py
@@ -226,6 +228,7 @@ tests/test_updater_pep668.py
 tests/test_updater_reports_the_truth.py
 tests/test_url_access.py
 tests/test_vps_health.py
+tests/test_vps_only_reporting.py
 tests/test_windows_loop_identity.py
 tests/test_windows_task_paths.py
 tests/test_write_hook.py

{devops_bot_sdk-1.6.69 → devops_bot_sdk-1.6.71}/sdk/__init__.py

@@ -1,6 +1,6 @@
 """AgentOS Desktop SDK — thin HTTPS/SSE client for the Electron app.
 
-Version: 1.6.69
+Version: 1.6.71
 
 Public surface:
   BackendClient.from_config()        — create client from ~/.agentos/config.toml
@@ -34,7 +34,7 @@ Rules:
   - All data egress through submit_webhook only
 """
 
-__version__ = "1.6.69"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
+__version__ = "1.6.71"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
 __author__  = "AgentOS"   # sdk.client.SDK_VERSION and the UI server version all read this.
 
 from sdk.client import BackendClient

{devops_bot_sdk-1.6.69 → devops_bot_sdk-1.6.71}/sdk/activity/os_setup.py

@@ -188,6 +188,11 @@ def _flag_value() -> str:
                 return value.strip().strip('"').strip("'")
     except OSError:
         pass
+    # Under sudo, settings.setting reads ROOT's .env. Falling back to it made a
+    # flag left in /root/.agentos/.env answer for the panel user, so _enable_flag
+    # never wrote theirs and the collector never started — on every restart.
+    if _is_privileged() and _panel_user() is not None:
+        return ""
     return settings.setting(AUDIT_FLAG)
 
 

{devops_bot_sdk-1.6.69 → devops_bot_sdk-1.6.71}/sdk/activity/settings.py

@@ -23,8 +23,12 @@ from sdk.activity.spool import Spool
 
 logger = logging.getLogger("sdk.activity.settings")
 
-DEFAULT_SHIP_INTERVAL_S = 300.0
+# Live tracking: one POST a minute is far under the relay's 60/min budget, and the
+# five-minute default meant the newest activity was always up to five minutes stale.
+DEFAULT_SHIP_INTERVAL_S = 60.0
 MIN_SHIP_INTERVAL_S = 30.0
+#: Events older than this are discarded instead of shipped (``0`` keeps everything).
+DEFAULT_MAX_AGE_S = 3600.0
 _FALSEY = {"0", "false", "no", "off"}
 _TRUTHY = {"1", "true", "yes", "on"}
 
@@ -63,6 +67,22 @@ def ship_interval_seconds() -> float:
         return DEFAULT_SHIP_INTERVAL_S
 
 
+def max_age_seconds() -> float:
+    """``AGENTOS_ACTIVITY_MAX_AGE_S`` — how old an event may be and still ship.
+
+    Default one hour: the trail is for live tracking, and a backlog shipped
+    oldest-first kept busy hosts days behind. ``0`` disables the cut-off.
+    """
+    raw = setting("AGENTOS_ACTIVITY_MAX_AGE_S")
+    if not raw:
+        return DEFAULT_MAX_AGE_S
+    try:
+        return max(0.0, float(raw))
+    except ValueError:
+        logger.warning("AGENTOS_ACTIVITY_MAX_AGE_S=%r is not a number; using default", raw)
+        return DEFAULT_MAX_AGE_S
+
+
 def spool_path() -> Path:
     """``~/.agentos/activity.db`` — resolved at call time so tests can redirect HOME."""
     return Path.home() / ".agentos" / "activity.db"

{devops_bot_sdk-1.6.69 → devops_bot_sdk-1.6.71}/sdk/activity/shipper.py

@@ -1,4 +1,4 @@
-"""Ship the activity spool to devops-bot-ai every 5 minutes.
+"""Ship the activity spool to devops-bot-ai every minute, newest first.
 
 Same shape as ``sdk.vps_health``: an asyncio loop with a ``start()`` the UI
 server's lifespan calls, cancelled by the host on shutdown.
@@ -25,8 +25,10 @@ from __future__ import annotations
 
 import asyncio
 import logging
+import time
 from collections.abc import Awaitable, Callable
 from dataclasses import dataclass
+from datetime import datetime, timezone
 from typing import Any, Protocol
 
 from sdk.activity import settings
@@ -176,12 +178,82 @@ async def flush_once(
     return result
 
 
+def discard_spool(spool: Spool | None = None) -> int:
+    """Delete everything queued, without sending it. Returns the rows dropped."""
+    spool = spool or settings.get_spool()
+    dropped = 0
+    while True:
+        chunk = spool.next_chunk()
+        if not chunk:
+            return dropped
+        dropped += len(chunk)
+        spool.ack(chunk)
+
+
+def purge_stale_rows(spool: Spool | None = None, now: float | None = None) -> int:
+    """Discard what is older than ``settings.max_age_seconds()``. Returns rows removed."""
+    max_age = settings.max_age_seconds()
+    if max_age <= 0:
+        return 0
+    spool = spool or settings.get_spool()
+    cutoff = (now if now is not None else time.time()) - max_age
+    cutoff_iso = (datetime.fromtimestamp(cutoff, timezone.utc)
+                  .isoformat(timespec="milliseconds").replace("+00:00", "Z"))
+    dropped = spool.purge_stale(cutoff_iso)
+    if dropped:
+        logger.info("activity.stale_discarded rows=%d older_than_s=%.0f "
+                    "(live tracking: only recent activity is shipped)", dropped, max_age)
+    return dropped
+
+
+async def ship_tick(
+    is_vps: Callable[[], Awaitable[bool | None]] | None = None,
+) -> FlushResult | None:
+    """One cron tick: ship only from the caller's assigned VPS, newest first.
+
+    The relay files every batch under the TOKEN's VPS, so a laptop running the SDK
+    with the same token put its own events in the VPS's audit trail. On a machine
+    that is definitely not the VPS the queue is discarded — kept, it would only grow
+    forever, since that machine will never be allowed to send it. When the answer
+    is unknown (profile unreachable) everything recent is kept for the next tick.
+
+    Every tick first discards events older than ``AGENTOS_ACTIVITY_MAX_AGE_S``
+    (default one hour): the trail is for live tracking, and a backlog — a host
+    that was offline, or flooded by a brute-force attack — must never hold the
+    current activity back.
+    """
+    try:
+        purge_stale_rows()
+    except Exception as exc:  # noqa: BLE001 — a purge failure must not stop shipping
+        logger.warning("activity: stale purge failed: %s", exc)
+    if is_vps is None:
+        from sdk import vps_identity
+        is_vps = vps_identity.is_assigned_vps
+    try:
+        verdict = await is_vps()
+    except Exception:  # noqa: BLE001 — is_assigned_vps never raises, but be certain
+        verdict = None
+    if verdict is None:
+        return None
+    if verdict is False:
+        try:
+            dropped = discard_spool()
+        except Exception as exc:  # noqa: BLE001
+            logger.warning("activity: could not discard the spool: %s", exc)
+            return None
+        if dropped:
+            logger.info("activity.not_assigned_vps discarded=%d (this machine is not the "
+                        "user's VPS; nothing is shipped from it)", dropped)
+        return None
+    return await flush_once()
+
+
 async def run_forever(interval_s: float | None = None, *, initial_delay_s: float = 30.0) -> None:
-    """Flush every ``interval_s`` (default 5 minutes) until cancelled."""
+    """Flush every ``interval_s`` (default 60 s) until cancelled."""
     await asyncio.sleep(initial_delay_s)
     while True:
         try:
-            await flush_once()
+            await ship_tick()
             every = interval_s if interval_s is not None else settings.ship_interval_seconds()
             await asyncio.sleep(every)
         except asyncio.CancelledError:

{devops_bot_sdk-1.6.69 → devops_bot_sdk-1.6.71}/sdk/activity/spool.py

@@ -169,33 +169,68 @@ class Spool:
         max_sessions: int = MAX_SESSIONS_PER_CHUNK,
         max_bytes: int = MAX_CHUNK_BYTES,
     ) -> Chunk:
-        """The oldest rows that fit the per-request limits, in arrival order.
-
-        Arrival order matters: a session is queued before its first event, so
-        taking rows by ``seq`` ships a session no later than the events that
-        reference it. Does NOT remove anything — call :meth:`ack` after delivery.
+        """Queued sessions, then the NEWEST events, within the per-request limits.
+
+        Live tracking needs the latest activity first. Shipping oldest-first left
+        busy hosts (a brute-forced RDP port alone is thousands of events an hour)
+        days behind, so the dashboard showed Tuesday's events on Thursday. Sessions
+        still go first, in arrival order: they are few, and an event must never
+        reach the relay ahead of the session it references. Does NOT remove
+        anything — call :meth:`ack` after delivery.
         """
         chunk = Chunk()
-        n_events = n_sessions = size = 0
+        size = 0
         with self._lock:
-            rows = self._db.execute(
-                "SELECT seq, rev, kind, payload FROM spool ORDER BY seq LIMIT ?",
-                (max_events + max_sessions,),
+            sessions = self._db.execute(
+                "SELECT seq, rev, kind, payload FROM spool WHERE kind = 'session' "
+                "ORDER BY seq LIMIT ?",
+                (max_sessions,),
             ).fetchall()
-        for seq, rev, kind, payload in rows:
-            if kind == "event" and n_events >= max_events:
-                break  # keep strict order: stop rather than skip ahead
-            if kind == "session" and n_sessions >= max_sessions:
-                break
+            events = self._db.execute(
+                "SELECT seq, rev, kind, payload FROM spool WHERE kind = 'event' "
+                "ORDER BY seq DESC LIMIT ?",
+                (max_events,),
+            ).fetchall()
+        for seq, rev, kind, payload in [*sessions, *events]:
             if chunk.rows and size + len(payload) > max_bytes:
                 break
             # Re-fit on the way out too: rows queued by an older SDK predate the clamp.
             chunk.rows.append(Row(seq, rev, kind, fit_wire_limits(kind, json.loads(payload))))
-            n_events += kind == "event"
-            n_sessions += kind == "session"
             size += len(payload)
         return chunk
 
+    def purge_stale(self, cutoff_iso: str) -> int:
+        """Delete events that happened before ``cutoff_iso``, and sessions that ENDED
+        before it. Returns the rows removed.
+
+        For live tracking an event an hour old is history, and shipping it only
+        delays the current ones. Open sessions are kept whatever their age — a
+        login that is still going on is live state. ``cutoff_iso`` uses the wire
+        format (``2026-10-22T07:06:01.971Z``), so string order is time order.
+        """
+        with self._lock:
+            try:
+                cur = self._db.execute(
+                    "DELETE FROM spool WHERE "
+                    "(kind = 'event' AND json_extract(payload, '$.occurredAt') < ?) OR "
+                    "(kind = 'session' AND json_extract(payload, '$.endedAt') IS NOT NULL "
+                    " AND json_extract(payload, '$.endedAt') < ?)",
+                    (cutoff_iso, cutoff_iso),
+                )
+                return int(cur.rowcount or 0)
+            except sqlite3.OperationalError:
+                # SQLite built without JSON1: filter in Python instead.
+                stale = []
+                for seq, kind, payload in self._db.execute(
+                    "SELECT seq, kind, payload FROM spool"
+                ).fetchall():
+                    wire = json.loads(payload)
+                    when = wire.get("occurredAt") if kind == "event" else wire.get("endedAt")
+                    if when and str(when) < cutoff_iso:
+                        stale.append((seq,))
+                self._db.executemany("DELETE FROM spool WHERE seq = ?", stale)
+                return len(stale)
+
     # ── ack ──────────────────────────────────────────────────────────────────
 
     def ack(self, chunk: Chunk) -> None:

{devops_bot_sdk-1.6.69 → devops_bot_sdk-1.6.71}/sdk/agents/activity.py

@@ -79,7 +79,7 @@ def describe(name: str, kind: str, result: dict | None, duration_s: float = 0.0,
 #     per-run event. So an agent run costs one POST no matter how chatty it is.
 _LINE_BUF: dict[str, list[str]] = {}
 _LINE_BUF_MAX_LINES = 40          # keep the tail — recent lines are the useful ones
-_LINE_BUF_MAX_CHARS = 4000        # bounded like _ACTIVITY_FLUSH_MAX_CHARS
+_LINE_BUF_MAX_CHARS = 4000        # trimmed to the gateway limit by client._fit_activity
 
 
 def note(bucket: str, text: str) -> None:

{devops_bot_sdk-1.6.69 → devops_bot_sdk-1.6.71}/sdk/client.py

@@ -121,9 +121,19 @@ def _notify_status(task_id: str, status: str) -> None:
 # `logger.info` line regardless of whether it buffers or POSTs.
 _ACTIVITY_FLUSH_MIN_S = float(os.getenv("AGENTOS_ACTIVITY_FLUSH_MIN_S", "") or 180.0)
 _ACTIVITY_FLUSH_MAX_S = float(os.getenv("AGENTOS_ACTIVITY_FLUSH_MAX_S", "") or 300.0)
-# Cap the coalesced payload so one flush can't POST a multi-megabyte body after a
-# very long, chatty run; keep the tail (most recent lines are the most useful).
-_ACTIVITY_FLUSH_MAX_CHARS = 8000
+# The gateway rejects an `activity` over 2000 characters with a 400 ("Activity
+# must be shorter than or equal to 2000 characters"). The cap used to be 8000, so
+# every coalesced flush and every long scheduled-run summary was refused and the
+# run left no trace in agent_activities. Keep the tail: the most recent lines are
+# the most useful.
+_ACTIVITY_MAX_CHARS = 2000
+
+
+def _fit_activity(text: str) -> str:
+    """``text`` cut to the gateway's limit, keeping the tail behind a ``…`` marker."""
+    if len(text) <= _ACTIVITY_MAX_CHARS:
+        return text
+    return "…\n" + text[-(_ACTIVITY_MAX_CHARS - 2):]
 
 
 class ActivityFlusher:
@@ -167,9 +177,7 @@ class ActivityFlusher:
         if not self._buf:
             return  # nothing pending → don't open a connection at all
         lines, self._buf = self._buf, []  # swap out atomically (no await between)
-        body = "\n".join(lines)
-        if len(body) > _ACTIVITY_FLUSH_MAX_CHARS:
-            body = "…\n" + body[-_ACTIVITY_FLUSH_MAX_CHARS:]
+        body = _fit_activity("\n".join(lines))
         try:
             await self._client.log_activity(body, task_id=self._task_id, immediate=True)
         except Exception as exc:  # noqa: BLE001 — never let a flush break a run
@@ -313,6 +321,29 @@ class BackendClient:
         except Exception as exc:
             raise BackendUnreachable(self._base_url, str(exc)) from exc
 
+    async def assigned_vps_ip(self) -> str:
+        """The IP of the caller's assigned VPS from ``GET /ml-api/users/profile``.
+
+        ``""`` when the profile names no VPS. Raises BackendUnreachable /
+        BackendAuthFailed — the caller (``sdk.vps_identity``) turns those into
+        "unknown" rather than "not a VPS".
+        """
+        from sdk.config import BE_DEFAULT_URL
+        from sdk.vps_identity import extract_vps_ip
+
+        url = f"{BE_DEFAULT_URL.rstrip('/')}/ml-api/users/profile"
+        headers = {**self._headers, "accept": "*/*", "developer-name": "null", "product": ""}
+        try:
+            async with httpx.AsyncClient(timeout=15.0) as client:
+                resp = await client.get(url, headers=headers)
+            _check_status(resp.status_code, url)
+            data = (resp.json() or {}).get("data") or {}
+        except (BackendAuthFailed, BackendVersionTooOld):
+            raise
+        except Exception as exc:
+            raise BackendUnreachable(url, str(exc)) from exc
+        return extract_vps_ip(data.get("user") or {})
+
     async def profile(self) -> UserProfile:
         """GET {BE}/ml-api/users/profile — the caller's role + department.
 
@@ -1766,7 +1797,7 @@ class BackendClient:
             "developer-name": "null",
             "product": "",
         }
-        body: dict[str, str] = {"activity": str(activity)}
+        body: dict[str, str] = {"activity": _fit_activity(str(activity))}
         tid = str(task_id or "").strip()
         if tid:
             body["taskId"] = tid
@@ -1800,7 +1831,7 @@ class BackendClient:
             return False
         url = f"{ML_GATEWAY_URL.rstrip('/')}/ml-api/agent-activity"
         headers = {**self._headers, "accept": "*/*", "developer-name": "null", "product": ""}
-        body: dict[str, str] = {"activity": str(activity), "agentId": aid}
+        body: dict[str, str] = {"activity": _fit_activity(str(activity)), "agentId": aid}
         tid = str(task_id or "").strip()
         if tid:
             body["taskId"] = tid

{devops_bot_sdk-1.6.69 → devops_bot_sdk-1.6.71}/sdk/vps_health.py

@@ -211,10 +211,18 @@ async def report_once(client: "BackendClient | None" = None) -> bool:
     """Collect + PATCH one health snapshot. Returns True on a 2xx. Never raises."""
     payload: dict[str, Any] = {}
     try:
-        payload = build_payload()
         if client is None:
             from sdk.client import BackendClient
             client = BackendClient.from_config()
+        # Only the assigned VPS may write the VPS row — a laptop running the SDK
+        # with the same token used to overwrite it (see sdk.vps_identity).
+        from sdk import vps_identity
+        verdict = await vps_identity.is_assigned_vps(client)
+        if verdict is not True:
+            reason = "not_assigned_vps" if verdict is False else "vps_identity_unknown"
+            _LAST.update({"at": _now_iso_ms(), "ok": False, "reason": reason, "payload": {}})
+            return False
+        payload = build_payload()
         ok = await client.report_vps_allocation(payload)
         _LAST.update({
             "at": payload.get("lastPingedAt", ""),

devops_bot_sdk-1.6.71/sdk/vps_identity.py

@@ -0,0 +1,174 @@
+"""Is THIS machine the caller's assigned VPS?
+
+Health pings (``sdk.vps_health``) and the activity trail (``sdk.activity.shipper``)
+both describe "your VPS", and both are keyed SERVER-side on the ``co_`` token — one
+``contabo_allocation`` row per user. So every machine that ran the SDK with that
+token reported as the VPS: a laptop's CPU, RAM, disk and uptime overwrote the VPS
+row every two hours, and the laptop's events landed in the VPS's audit trail. A
+user with the SDK on a laptop and a VPS had a "VPS" whose boot time was the
+laptop's.
+
+The answer comes from comparing the IP the platform has on record for the user's
+VPS (``GET /ml-api/users/profile`` → ``vps.ipAddress``, the field the backend's
+proxy already trusts) with this machine's own addresses. Nothing leaves the
+machine to find those — interface addresses plus the route-to-internet address —
+so the SDK's one-egress-path rule holds.
+
+Three answers, and the callers treat them differently:
+  ``True``   this is the assigned VPS — report.
+  ``False``  it is not (or the user has no VPS) — do not report.
+  ``None``   unknown (profile unreachable) — skip this tick, ask again next tick.
+             Never reported on a guess, and never cached.
+
+``AGENTOS_IS_VPS`` overrides the check: ``1`` for a VPS behind NAT whose public
+address is not on any interface, ``0`` to silence a machine outright.
+"""
+from __future__ import annotations
+
+import ipaddress
+import logging
+import os
+import socket
+import time
+from typing import TYPE_CHECKING, Any
+
+if TYPE_CHECKING:  # pragma: no cover — typing only
+    from sdk.client import BackendClient
+
+logger = logging.getLogger("sdk.vps_identity")
+
+#: A machine does not change into (or out of) a VPS often; a definite answer is
+#: reused this long so a 5-minute shipper does not fetch the profile every tick.
+CACHE_TTL_S = 6 * 3600.0
+
+_TRUTHY = {"1", "true", "yes", "on"}
+_FALSEY = {"0", "false", "no", "off"}
+
+# Profile shapes the ML backend has used for the VPS address — the same tolerant
+# set the AI backend reads (devops-bot-ai shared/dependencies._extract_vps_ip).
+_IP_KEYS = ("vpsIp", "vps_ip", "vpsIP", "vpsIpAddress", "vpsAddress", "vpsHost",
+            "serverIp", "server_ip", "ipAddress", "ip_address", "ip")
+_NESTED_KEYS = ("vps", "server", "machine", "allocation")
+_NESTED_FIELDS = ("ipAddress", "ip_address", "ip", "host", "address")
+
+_cache: dict[str, Any] = {"at": 0.0, "value": None}
+
+
+def _setting(name: str) -> str:
+    """Process env first, then ``~/.agentos/.env`` — same resolution as the panel toggles."""
+    val = (os.environ.get(name) or "").strip()
+    if val:
+        return val
+    try:
+        from sdk.config import _dotenv_value
+        return (_dotenv_value(name) or "").strip()
+    except Exception:  # noqa: BLE001 — a config read must never break reporting
+        return ""
+
+
+def override() -> bool | None:
+    """``AGENTOS_IS_VPS`` as a bool, or ``None`` when unset/unrecognised."""
+    raw = _setting("AGENTOS_IS_VPS").lower()
+    if raw in _TRUTHY:
+        return True
+    if raw in _FALSEY:
+        return False
+    return None
+
+
+def _as_ip(value: str) -> str:
+    """The bare IP in ``value`` (which may be a URL or ``host:port``), or ``""``."""
+    v = value.strip()
+    if "://" in v:
+        v = v.split("://", 1)[1]
+    v = v.split("/", 1)[0]
+    if v.startswith("[") and "]" in v:          # [ipv6]:port
+        v = v[1:v.index("]")]
+    elif v.count(":") == 1:                      # ipv4:port / host:port
+        v = v.split(":", 1)[0]
+    try:
+        return str(ipaddress.ip_address(v))
+    except ValueError:
+        return ""
+
+
+def extract_vps_ip(user: dict) -> str:
+    """The assigned VPS IP from a profile ``user`` object; ``""`` when it names none."""
+    for k in _IP_KEYS:
+        v = user.get(k)
+        if isinstance(v, str) and _as_ip(v):
+            return _as_ip(v)
+    for k in _NESTED_KEYS:
+        obj = user.get(k)
+        if isinstance(obj, str) and _as_ip(obj):
+            return _as_ip(obj)
+        if isinstance(obj, dict):
+            for f in _NESTED_FIELDS:
+                v = obj.get(f)
+                if isinstance(v, str) and _as_ip(v):
+                    return _as_ip(v)
+    return ""
+
+
+def local_addresses() -> set[str]:
+    """Every address this machine holds: interfaces, hostname, route to the internet."""
+    found: set[str] = set()
+    try:
+        import psutil
+        for addrs in psutil.net_if_addrs().values():
+            for a in addrs:
+                if a.family in (socket.AF_INET, socket.AF_INET6):
+                    ip = _as_ip(a.address.split("%", 1)[0])
+                    if ip:
+                        found.add(ip)
+    except Exception:  # noqa: BLE001 — psutil is an optional extra
+        pass
+    try:
+        for info in socket.getaddrinfo(socket.gethostname(), None):
+            ip = _as_ip(str(info[4][0]).split("%", 1)[0])
+            if ip:
+                found.add(ip)
+    except Exception:  # noqa: BLE001
+        pass
+    try:
+        from sdk.vps_health import _outbound_ip
+        ip = _as_ip(_outbound_ip())
+        if ip:
+            found.add(ip)
+    except Exception:  # noqa: BLE001
+        pass
+    return found
+
+
+async def is_assigned_vps(client: "BackendClient | None" = None) -> bool | None:
+    """``True`` / ``False`` / ``None`` (unknown) — see the module docstring. Never raises."""
+    forced = override()
+    if forced is not None:
+        return forced
+    now = time.monotonic()
+    if _cache["value"] is not None and now - _cache["at"] < CACHE_TTL_S:
+        return _cache["value"]
+    try:
+        if client is None:
+            from sdk.client import BackendClient
+            client = BackendClient.from_config()
+        assigned = await client.assigned_vps_ip()
+    except Exception as exc:  # noqa: BLE001 — offline / auth / not configured
+        logger.info("vps_identity.unknown err=%s", exc)
+        return None
+    if not assigned:
+        value, why = False, "no VPS is assigned to this user"
+    else:
+        value = assigned in local_addresses()
+        why = (f"this machine holds {assigned}" if value else
+               f"this machine does not hold the assigned VPS address {assigned} — "
+               f"set AGENTOS_IS_VPS=1 if it is the VPS behind NAT")
+    if value != _cache["value"]:
+        logger.info("vps_identity.%s (%s)", "assigned_vps" if value else "not_assigned_vps", why)
+    _cache.update(at=now, value=value)
+    return value
+
+
+def reset_cache() -> None:
+    """Forget the cached answer (tests, and after the user's VPS changes)."""
+    _cache.update(at=0.0, value=None)

{devops_bot_sdk-1.6.69 → devops_bot_sdk-1.6.71}/tests/test_activity_collectors.py

@@ -31,8 +31,15 @@ def _isolated(tmp_path, monkeypatch):
 
 
 def _queued():
+    """Queued sessions and events in the order the collector RECORDED them.
+
+    The shipper sends newest-first (live tracking); these tests are about what a
+    collector recorded and in which order, so read the rows back by ``seq``.
+    """
     chunk = settings.get_spool().next_chunk()
-    return chunk.sessions, chunk.events
+    rows = sorted(chunk.rows, key=lambda r: r.seq)
+    return ([r.wire for r in rows if r.kind == "session"],
+            [r.wire for r in rows if r.kind == "event"])
 
 
 # ─────────────────────────────── Linux / auditd ───────────────────────────────