devops-bot-sdk 1.6.71__tar.gz → 1.6.73__tar.gz

{devops_bot_sdk-1.6.71 → devops_bot_sdk-1.6.73}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.6.71
+Version: 1.6.73
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.6.71 → devops_bot_sdk-1.6.73}/devops_bot_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.6.71
+Version: 1.6.73
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.6.71 → devops_bot_sdk-1.6.73}/sdk/__init__.py

@@ -1,6 +1,6 @@
 """AgentOS Desktop SDK — thin HTTPS/SSE client for the Electron app.
 
-Version: 1.6.71
+Version: 1.6.73
 
 Public surface:
   BackendClient.from_config()        — create client from ~/.agentos/config.toml
@@ -34,7 +34,7 @@ Rules:
   - All data egress through submit_webhook only
 """
 
-__version__ = "1.6.71"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
+__version__ = "1.6.73"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
 __author__  = "AgentOS"   # sdk.client.SDK_VERSION and the UI server version all read this.
 
 from sdk.client import BackendClient

{devops_bot_sdk-1.6.71 → devops_bot_sdk-1.6.73}/sdk/activity/collectors/windows_eventlog.py

@@ -9,6 +9,14 @@ docs/ACTIVITY_AUDIT.md). Events used:
   4624  logon                   → LOGIN event + the interactive session (types 2/10/11)
   4634 / 4647  logoff           → LOGOUT event, session closed
   4625  failed logon            → LOGIN event, action ``login.failed``
+  4778  RDP session reconnected → LOGIN event ``rdp.reconnect`` + the RDP session
+  4779  RDP session disconnected→ LOGOUT event ``rdp.disconnect``, session closed
+
+4778/4779 matter more than 4624 in practice: people leave their remote desktop
+session open and reconnect to it, which writes NO new 4624 type-10 logon. Without
+them a VPS used all day showed no session at all, and every command its person ran
+had no session to inherit — the fleet recorded 6 RDP sessions in two days.
+They need the "Other Logon/Logoff Events" audit subcategory (``os_setup``).
 
 The event parser and the processor are pure; only :class:`WindowsEventLogCollector`
 touches the OS. Processes created by SYSTEM / LOCAL SERVICE / NETWORK SERVICE are
@@ -50,7 +58,7 @@ from sdk.activity.models import (
 logger = logging.getLogger("sdk.activity.collectors.windows")
 
 _NS = "{http://schemas.microsoft.com/win/2004/08/events/event}"
-EVENT_IDS = (4688, 4624, 4634, 4647, 4625)
+EVENT_IDS = (4688, 4624, 4634, 4647, 4625, 4778, 4779)
 _MAX_PID_CACHE = 20_000
 #: Executables the collector itself spawns to poll the log.
 _OWN_TOOLS = ("wevtutil.exe",)
@@ -117,6 +125,11 @@ def _hex(value: str | None) -> int:
         return 0
 
 
+def _remote(ip: str) -> str | None:
+    """A client address worth recording; ``None`` for blanks and loopback."""
+    return ip if ip and ip not in ("-", "::1", "127.0.0.1", "LOCAL") else None
+
+
 def _is_person(user: str) -> bool:
     upper = user.upper()
     return bool(user) and not user.endswith("$") and upper not in _NON_PERSON_USERS \
@@ -153,6 +166,10 @@ class WindowsEventProcessor:
                 self._logoff(ev)
             elif ev.event_id == 4625:
                 self._failed_logon(ev)
+            elif ev.event_id == 4778:
+                self._rdp_reconnect(ev)
+            elif ev.event_id == 4779:
+                self._rdp_disconnect(ev)
         except Exception as exc:  # noqa: BLE001 — one bad record must not stop the poll
             logger.warning("eventlog: could not process %s/%s: %s", ev.event_id, ev.record_id, exc)
 
@@ -170,22 +187,65 @@ class WindowsEventProcessor:
         if kind is None or not _is_person(user):
             return
         logon_id = d.get("TargetLogonId", "").lower()
-        ip = d.get("IpAddress", "")
-        remote = ip if ip and ip not in ("-", "::1", "127.0.0.1") else None
+        remote = _remote(d.get("IpAddress", ""))
+        key, run_id = self._open_session(logon_id, user, kind, remote, ev.time)
+        recorder.record_event(ActivityEvent(
+            os=Os.WINDOWS, source=Source.WIN_EVENTLOG, category=Category.LOGIN, action="login",
+            occurredAt=ev.time, sessionKey=key, osUser=user, target=remote,
+            agentRunId=run_id, metadata={"logonType": logon_type},
+        ))
+
+    def _open_session(
+        self, logon_id: str, user: str, kind: SessionKind, remote: str | None, when: float,
+    ) -> tuple[str, str | None]:
+        """Start a person's session for ``logon_id``; returns (session key, agent run id)."""
         verdict = classify(ProcessFacts(
             login_kind=kind, has_tty=True, is_agent_os_user=self._is_agent_user(user),
         ))
-        key = f"win:{logon_id}:{int(ev.time)}"
+        key = f"win:{logon_id}:{int(when)}"
         info = self._book.ensure(
-            key, started=ev.time, verdict=verdict, kind=kind, os_user=user, remote_ip=remote,
+            key, started=when, verdict=verdict, kind=kind, os_user=user, remote_ip=remote,
         )
         self._logons[logon_id] = key
         self._kinds[logon_id] = kind
+        return key, info.agent_run_id
+
+    def _rdp_reconnect(self, ev: WinEvent) -> None:
+        """4778: someone came back to an existing desktop session — they are here now.
+
+        The logon id is the ORIGINAL logon's, so processes the person starts from here
+        on carry it as their ``SubjectLogonId`` and inherit this session.
+        """
+        d = ev.data
+        user = d.get("AccountName", "")
+        logon_id = d.get("LogonID", "").lower()
+        if not logon_id or not _is_person(user):
+            return
+        remote = _remote(d.get("ClientAddress", ""))
+        key = self._logons.get(logon_id)
+        run_id = None
+        if key is None:
+            key, run_id = self._open_session(logon_id, user, SessionKind.RDP, remote, ev.time)
         recorder.record_event(ActivityEvent(
-            os=Os.WINDOWS, source=Source.WIN_EVENTLOG, category=Category.LOGIN, action="login",
-            occurredAt=ev.time, sessionKey=key, osUser=user, target=remote,
-            agentRunId=info.agent_run_id, metadata={"logonType": logon_type},
+            os=Os.WINDOWS, source=Source.WIN_EVENTLOG, category=Category.LOGIN,
+            action="rdp.reconnect", occurredAt=ev.time, sessionKey=key, osUser=user,
+            target=remote, agentRunId=run_id,
+            metadata={"clientName": d.get("ClientName") or None},
+        ))
+
+    def _rdp_disconnect(self, ev: WinEvent) -> None:
+        """4779: the person left the desktop; the logon itself lives on until 4634."""
+        logon_id = ev.data.get("LogonID", "").lower()
+        key = self._logons.pop(logon_id, None)
+        self._kinds.pop(logon_id, None)
+        if not key:
+            return
+        recorder.record_event(ActivityEvent(
+            os=Os.WINDOWS, source=Source.WIN_EVENTLOG, category=Category.LOGOUT,
+            action="rdp.disconnect", occurredAt=ev.time, sessionKey=key,
+            osUser=ev.data.get("AccountName") or None,
         ))
+        self._book.end(key, ev.time)
 
     def _logoff(self, ev: WinEvent) -> None:
         logon_id = ev.data.get("TargetLogonId", "").lower()

{devops_bot_sdk-1.6.71 → devops_bot_sdk-1.6.73}/sdk/activity/os_setup.py

@@ -79,6 +79,9 @@ _WIN_SUBCATEGORIES = (
     ("Process Creation", ("/success:enable",)),
     ("Logon", ("/success:enable", "/failure:enable")),
     ("Logoff", ("/success:enable",)),
+    # 4778/4779 — RDP reconnect / disconnect. Most people reconnect to an open
+    # desktop rather than log on afresh, so without this nobody is ever "there".
+    ("Other Logon/Logoff Events", ("/success:enable",)),
 )
 _WIN_CMDLINE_KEY = r"HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit"
 _WIN_CMDLINE_VALUE = "ProcessCreationIncludeCmdLine_Enabled"
@@ -87,6 +90,7 @@ _WIN_MANUAL = (
     'auditpol /set /subcategory:"Process Creation" /success:enable\n'
     'auditpol /set /subcategory:"Logon" /success:enable /failure:enable\n'
     'auditpol /set /subcategory:"Logoff" /success:enable\n'
+    'auditpol /set /subcategory:"Other Logon/Logoff Events" /success:enable\n'
     f"reg add {_WIN_CMDLINE_KEY} /v {_WIN_CMDLINE_VALUE} /t REG_DWORD /d 1 /f\n"
     f"wevtutil sl Security /ms:{_WIN_LOG_BYTES}\n"
     f"then add {AUDIT_FLAG}=1 to %USERPROFILE%\\.agentos\\.env and restart the panel"

{devops_bot_sdk-1.6.71 → devops_bot_sdk-1.6.73}/tests/test_activity_collectors.py

@@ -507,6 +507,58 @@ class TestWindowsProcessing:
         assert (events[0]["action"], events[0]["severity"], events[0]["target"]) == (
             "login.failed", "WARNING", "198.51.100.9")
 
+    RECONNECT = dict(AccountName="alice", AccountDomain="WIN-HOST", LogonID="0xabc123",
+                     SessionName="RDP-Tcp#3", ClientName="ALICE-LAPTOP",
+                     ClientAddress="203.0.113.7")
+
+    def test_an_rdp_reconnect_is_a_human_session_its_commands_inherit(self):
+        """People reconnect to an open desktop; no fresh 4624 is written for it."""
+        _win(
+            _xml(4778, 1, **self.RECONNECT),
+            _xml(4688, 2, NewProcessId="0x200", ProcessId="0x100", SubjectUserName="alice",
+                 SubjectLogonId="0xabc123", NewProcessName="C:\\x\\chrome.exe"),
+        )
+        sessions, events = _queued()
+        s = sessions[0]
+        assert s["externalKey"].startswith("win:0xabc123:")
+        assert (s["kind"], s["actorType"], s["remoteIp"], s["osUser"]) == (
+            "RDP", "HUMAN", "203.0.113.7", "alice")
+        login, cmd = events
+        assert (login["category"], login["action"], login["sessionKey"]) == (
+            "LOGIN", "rdp.reconnect", s["externalKey"])
+        assert login["metadata"] == {"clientName": "ALICE-LAPTOP"}
+        assert (cmd["sessionKey"], cmd["actorType"]) == (s["externalKey"], "HUMAN")
+
+    def test_an_rdp_disconnect_closes_the_session(self):
+        _win(_xml(4778, 1, **self.RECONNECT),
+             _xml(4779, 2, **self.RECONNECT))
+        sessions, events = _queued()
+        assert "endedAt" in sessions[0]
+        assert (events[-1]["category"], events[-1]["action"]) == ("LOGOUT", "rdp.disconnect")
+
+    def test_a_reconnect_inside_a_session_we_already_track_reuses_it(self):
+        _win(_xml(4624, 1, **self.LOGON),
+             _xml(4778, 2, **self.RECONNECT))
+        sessions, events = _queued()
+        assert len(sessions) == 1
+        assert {e["sessionKey"] for e in events} == {sessions[0]["externalKey"]}
+
+    def test_disconnect_then_reconnect_opens_a_new_session(self):
+        _win(_xml(4778, 1, **self.RECONNECT),
+             _xml(4779, 2, time="2026-10-09T12:10:00Z", **self.RECONNECT),
+             _xml(4778, 3, time="2026-10-09T13:00:00Z", **self.RECONNECT))
+        sessions, _ = _queued()
+        assert len({s["externalKey"] for s in sessions}) == 2
+
+    @pytest.mark.parametrize("user", ["SYSTEM", "WIN-HOST$", "DWM-2", ""])
+    def test_a_reconnect_by_a_non_person_is_ignored(self, user):
+        _win(_xml(4778, 1, **{**self.RECONNECT, "AccountName": user}))
+        assert _queued() == ([], [])
+
+    def test_a_disconnect_for_an_unknown_logon_is_ignored(self):
+        _win(_xml(4779, 1, **self.RECONNECT))
+        assert _queued() == ([], [])
+
     def test_a_secret_on_the_command_line_is_redacted(self):
         _win(_xml(4624, 1, **self.LOGON),
              _xml(4688, 2, NewProcessId="0x200", ProcessId="0x100", SubjectUserName="alice",