devops-bot-sdk 1.6.75__tar.gz → 1.6.76__tar.gz

{devops_bot_sdk-1.6.75 → devops_bot_sdk-1.6.76}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.6.75
+Version: 1.6.76
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.6.75 → devops_bot_sdk-1.6.76}/devops_bot_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.6.75
+Version: 1.6.76
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.6.75 → devops_bot_sdk-1.6.76}/devops_bot_sdk.egg-info/SOURCES.txt

@@ -230,5 +230,6 @@ tests/test_url_access.py
 tests/test_vps_health.py
 tests/test_vps_only_reporting.py
 tests/test_windows_loop_identity.py
+tests/test_windows_panel_task.py
 tests/test_windows_task_paths.py
 tests/test_write_hook.py

{devops_bot_sdk-1.6.75 → devops_bot_sdk-1.6.76}/sdk/__init__.py

@@ -1,6 +1,6 @@
 """AgentOS Desktop SDK — thin HTTPS/SSE client for the Electron app.
 
-Version: 1.6.75
+Version: 1.6.76
 
 Public surface:
   BackendClient.from_config()        — create client from ~/.agentos/config.toml
@@ -34,7 +34,7 @@ Rules:
   - All data egress through submit_webhook only
 """
 
-__version__ = "1.6.75"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
+__version__ = "1.6.76"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
 __author__  = "AgentOS"   # sdk.client.SDK_VERSION and the UI server version all read this.
 
 from sdk.client import BackendClient

{devops_bot_sdk-1.6.75 → devops_bot_sdk-1.6.76}/sdk/ui/service.py

@@ -410,20 +410,118 @@ def _uninstall_launchd() -> tuple[bool, str]:
 
 # ── Windows (Scheduled Task) ────────────────────────────────────────────────
 
+#: Written when Windows refused the logged-out (S4U) panel task, so ``ensure`` does
+#: not rebuild the task on every update only to be refused again.
+_S4U_REFUSED_MARKER = Path.home() / ".agentos" / "panel_task_s4u_refused"
+
+
+def _windows_account() -> str:
+    """``DOMAIN\\user`` for the task principal — the user whose ~/.agentos holds the token."""
+    import getpass
+
+    user = os.environ.get("USERNAME") or getpass.getuser()
+    domain = os.environ.get("USERDOMAIN") or os.environ.get("COMPUTERNAME") or ""
+    return f"{domain}\\{user}" if domain else user
+
+
+def _panel_task_xml(exe: str, args: str, home: str, account: str) -> str:
+    """Task Scheduler XML for the panel: runs whether or not anyone is signed in.
+
+    The old task was ``/SC ONLOGON`` with an interactive token, so the panel — and
+    with it the health ping, the activity collector and the shipper — stopped the
+    moment the user signed out of RDP. A VPS used all day then reported nothing
+    from sign-out until the next sign-in ("VPS not reporting since 8h ago").
+
+    * ``S4U`` logon: runs without a stored password, signed in or not. It has no
+      Windows network credentials, which the panel does not use (HTTPS only).
+    * Boot AND logon triggers: up after a reboot with nobody signed in, and started
+      again at sign-in if it was down.
+    * Restart on failure, no execution time limit (the default is 72 h).
+    * ``HighestAvailable``: the collector reads the Security log, which needs an
+      elevated token — same as the old ``/RL HIGHEST``.
+    """
+    from xml.sax.saxutils import escape
+
+    who = escape(account)
+    return (
+        '<?xml version="1.0" encoding="UTF-16"?>\n'
+        '<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">\n'
+        "  <RegistrationInfo><Description>AgentOS control panel (health, activity, "
+        "ticket runs)</Description></RegistrationInfo>\n"
+        "  <Triggers>\n"
+        "    <BootTrigger><Enabled>true</Enabled><Delay>PT1M</Delay></BootTrigger>\n"
+        f"    <LogonTrigger><Enabled>true</Enabled><UserId>{who}</UserId></LogonTrigger>\n"
+        "  </Triggers>\n"
+        f'  <Principals><Principal id="Author"><UserId>{who}</UserId>'
+        "<LogonType>S4U</LogonType><RunLevel>HighestAvailable</RunLevel>"
+        "</Principal></Principals>\n"
+        "  <Settings>\n"
+        "    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>\n"
+        "    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\n"
+        "    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\n"
+        "    <StartWhenAvailable>true</StartWhenAvailable>\n"
+        "    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\n"
+        "    <RestartOnFailure><Interval>PT1M</Interval><Count>999</Count></RestartOnFailure>\n"
+        "  </Settings>\n"
+        '  <Actions Context="Author"><Exec>'
+        f"<Command>{escape(exe)}</Command><Arguments>{escape(args)}</Arguments>"
+        f"<WorkingDirectory>{escape(home)}</WorkingDirectory>"
+        "</Exec></Actions>\n"
+        "</Task>\n"
+    )
+
+
+def _create_task_from_xml(task: str, xml: str) -> tuple[int, str]:
+    import tempfile
+
+    fd, path = tempfile.mkstemp(suffix=".xml")
+    try:
+        with os.fdopen(fd, "w", encoding="utf-16") as fh:   # schtasks /XML wants UTF-16
+            fh.write(xml)
+        return _run(["schtasks", "/Create", "/TN", task, "/XML", path, "/F"])
+    except OSError as exc:
+        return 1, str(exc)
+    finally:
+        try:
+            os.unlink(path)
+        except OSError:
+            pass
+
+
 def _install_schtask(host: str, port: int) -> tuple[bool, str]:
     exe = _exe()
     refusal = _require_absolute(exe, WIN_TASK)
     if refusal:
         return False, refusal
-    tr = f'"{exe}" --host {host} --port {port} --no-browser'
-    rc, out = _run(["schtasks", "/Create", "/TN", WIN_TASK, "/TR", tr,
-                    "/SC", "ONLOGON", "/RL", "HIGHEST", "/F"])
+    args = f"--host {host} --port {port} --no-browser"
+    rc, out = _create_task_from_xml(
+        WIN_TASK, _panel_task_xml(exe, args, str(Path.home()), _windows_account()))
+    if rc == 0:
+        try:
+            _S4U_REFUSED_MARKER.unlink()
+        except OSError:
+            pass
+        _run(["schtasks", "/Run", "/TN", WIN_TASK])
+        return True, (f"installed scheduled task '{WIN_TASK}' — runs whether or not anyone "
+                      f"is signed in, restarts on failure, and is running now.")
+
+    # Windows refused it (e.g. a policy denying "Log on as a batch job"). Fall back to
+    # the at-logon task: worse — it stops at sign-out — but never worse than before.
+    try:
+        _S4U_REFUSED_MARKER.parent.mkdir(parents=True, exist_ok=True)
+        _S4U_REFUSED_MARKER.write_text(out[-2000:], encoding="utf-8")
+    except OSError:
+        pass
+    tr = f'"{exe}" {args}'
+    rc, out2 = _run(["schtasks", "/Create", "/TN", WIN_TASK, "/TR", tr,
+                     "/SC", "ONLOGON", "/RL", "HIGHEST", "/F"])
     if rc != 0:
-        return False, f"schtasks create failed:\n{out}"
+        return False, f"schtasks create failed:\n{out}\n{out2}"
     _run(["schtasks", "/Run", "/TN", WIN_TASK])
     return True, (f"installed scheduled task '{WIN_TASK}' — starts at logon and is "
-                  f"running now.\n  For crash-restart and no-login start, mark the task "
-                  f"'Run whether user is logged on' + 'Restart on failure' in Task Scheduler.")
+                  f"running now. NOTE: Windows refused the run-while-signed-out task, so "
+                  f"the panel STOPS when you sign out — disconnect from RDP instead of "
+                  f"signing out. Reason: {out.strip()[-300:]}")
 
 
 def _update_task_xml(exe: str, home: str) -> str:
@@ -527,6 +625,19 @@ def _schtask_points_nowhere(task: str) -> bool:
     return cmd is not None and not (Path(cmd).is_absolute() and Path(cmd).is_file())
 
 
+def _schtask_runs_signed_out(task: str) -> bool | None:
+    """True when ``task`` keeps running after sign-out; ``None`` if it cannot be read."""
+    rc, out = _run(["schtasks", "/Query", "/TN", task, "/XML"])
+    if rc != 0:
+        return None
+    return bool(re.search(r"<LogonType>\s*(S4U|Password)\s*</LogonType>", out))
+
+
+def _panel_task_needs_upgrade() -> bool:
+    """An at-logon panel task (pre-1.6.76) that Windows has not already refused to replace."""
+    return _schtask_runs_signed_out(WIN_TASK) is False and not _S4U_REFUSED_MARKER.exists()
+
+
 def _uninstall_schtask() -> tuple[bool, str]:
     _run(["schtasks", "/Delete", "/TN", WIN_UPDATE_TASK, "/F"])
     _run(["schtasks", "/End", "/TN", WIN_TASK])
@@ -855,6 +966,10 @@ def ensure(restart_running: bool = False) -> tuple[bool, str]:
         rok, rmsg = refresh()               # rebuilds the task with an absolute path
         return rok, (_with_token_warning(f"panel task pointed at a missing program — "
                                          f"rebuilt; {rmsg}") if rok else rmsg)
+    if IS_WINDOWS and _panel_task_needs_upgrade():
+        rok, rmsg = refresh()               # at-logon task → runs while signed out
+        return rok, (_with_token_warning(f"panel task now runs while signed out; {rmsg}")
+                     if rok else rmsg)
     if _is_active():
         stale = _restart_if_stale()
         if stale is not None:

devops_bot_sdk-1.6.76/tests/test_windows_panel_task.py

@@ -0,0 +1,135 @@
+"""The Windows panel task keeps running after the user signs out.
+
+The incident: the panel task was ``/SC ONLOGON`` with an interactive token, so
+the panel — health ping, activity collector, shipper, ticket runs — stopped the
+moment someone signed out of RDP. A VPS used all day showed "VPS not reporting
+since 8h ago" on the dashboard from sign-out until the next sign-in, and the
+existing task was never upgraded by an update.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from sdk.ui import service
+
+
+@pytest.fixture
+def windows(monkeypatch, tmp_path):
+    exe = tmp_path / "R&D" / "Scripts" / "agentos-ui.exe"
+    exe.parent.mkdir(parents=True)
+    exe.write_text("")
+    monkeypatch.setattr(service, "IS_WINDOWS", True)
+    monkeypatch.setattr(service, "_exe", lambda: str(exe))
+    monkeypatch.setattr(service, "_S4U_REFUSED_MARKER", tmp_path / ".agentos" / "refused")
+    monkeypatch.setenv("USERDOMAIN", "WIN-PND3HEN88VE")
+    monkeypatch.setenv("USERNAME", "Administrator")
+    return exe
+
+
+def _recorder(monkeypatch, *, xml_rc=0, xml_out=""):
+    calls, xmls = [], []
+
+    def run(argv):
+        calls.append(argv)
+        if "/XML" in argv and "/Create" in argv:
+            xmls.append(Path(argv[argv.index("/XML") + 1]).read_text(encoding="utf-16"))
+            return xml_rc, xml_out
+        return 0, ""
+    monkeypatch.setattr(service, "_run", run)
+    return calls, xmls
+
+
+class TestTheTaskDefinition:
+    def test_runs_signed_out_at_boot_and_logon_and_restarts(self, monkeypatch, windows):
+        _, xmls = _recorder(monkeypatch)
+        ok, msg = service._install_schtask("0.0.0.0", 8765)
+        assert ok is True and "signed in" in msg
+        xml = xmls[0]
+        assert "<LogonType>S4U</LogonType>" in xml
+        assert "<RunLevel>HighestAvailable</RunLevel>" in xml          # reads the Security log
+        assert "<BootTrigger>" in xml and "<LogonTrigger>" in xml
+        assert "<UserId>WIN-PND3HEN88VE\\Administrator</UserId>" in xml
+        assert "<RestartOnFailure>" in xml
+        assert "<ExecutionTimeLimit>PT0S</ExecutionTimeLimit>" in xml  # default would be 72 h
+        assert "R&amp;D" in xml                                        # the path is escaped
+
+    def test_the_task_is_started_after_creation(self, monkeypatch, windows):
+        calls, _ = _recorder(monkeypatch)
+        service._install_schtask("0.0.0.0", 8765)
+        assert ["schtasks", "/Run", "/TN", service.WIN_TASK] in calls
+
+
+class TestWhenWindowsRefusesIt:
+    def test_falls_back_to_the_at_logon_task_and_says_so(self, monkeypatch, windows):
+        calls, _ = _recorder(monkeypatch, xml_rc=1, xml_out="ERROR: Access is denied.")
+        ok, msg = service._install_schtask("0.0.0.0", 8765)
+        assert ok is True
+        fallback = calls[1]
+        assert fallback[fallback.index("/SC") + 1] == "ONLOGON"
+        assert "disconnect from RDP instead of signing out" in msg
+        assert service._S4U_REFUSED_MARKER.exists()                    # don't retry every update
+
+    def test_a_later_success_clears_the_refusal(self, monkeypatch, windows):
+        service._S4U_REFUSED_MARKER.parent.mkdir(parents=True)
+        service._S4U_REFUSED_MARKER.write_text("denied")
+        _recorder(monkeypatch)
+        service._install_schtask("0.0.0.0", 8765)
+        assert not service._S4U_REFUSED_MARKER.exists()
+
+
+def _query(monkeypatch, rc, logon_type):
+    xml = f"<Task><Principals><Principal><LogonType>{logon_type}</LogonType></Principal></Principals></Task>"
+    monkeypatch.setattr(service, "_run", lambda argv: (rc, xml))
+
+
+class TestDetection:
+    @pytest.mark.parametrize("logon_type, expected", [
+        ("InteractiveToken", False), ("S4U", True), ("Password", True)])
+    def test_reads_the_logon_type(self, monkeypatch, logon_type, expected):
+        _query(monkeypatch, 0, logon_type)
+        assert service._schtask_runs_signed_out(service.WIN_TASK) is expected
+
+    def test_an_unreadable_task_is_unknown_not_old(self, monkeypatch, windows):
+        _query(monkeypatch, 1, "InteractiveToken")
+        assert service._schtask_runs_signed_out(service.WIN_TASK) is None
+        assert service._panel_task_needs_upgrade() is False
+
+
+class TestEnsureUpgradesTheExistingTask:
+    @pytest.fixture
+    def installed(self, monkeypatch, windows):
+        monkeypatch.setattr(service, "_service_disabled", lambda: False)
+        monkeypatch.setattr(service, "is_installed", lambda: True)
+        monkeypatch.setattr(service, "update_timer_installed", lambda: True)
+        monkeypatch.setattr(service, "_needs_root_for_existing", lambda: False)
+        monkeypatch.setattr(service, "_schtask_points_nowhere", lambda task: False)
+        monkeypatch.setattr(service, "_with_token_warning", lambda m: m)
+        monkeypatch.setattr(service, "_is_active", lambda: True)
+        monkeypatch.setattr(service, "_restart_if_stale", lambda: None)
+        seen = {"refresh": 0}
+
+        def refresh():
+            seen["refresh"] += 1
+            return True, "service refreshed"
+        monkeypatch.setattr(service, "refresh", refresh)
+        return seen
+
+    def test_an_at_logon_task_is_rebuilt_on_the_next_update(self, monkeypatch, installed):
+        _query(monkeypatch, 0, "InteractiveToken")
+        ok, msg = service.ensure(restart_running=False)
+        assert ok is True and "runs while signed out" in msg
+        assert installed["refresh"] == 1
+
+    def test_an_already_upgraded_task_is_left_alone(self, monkeypatch, installed):
+        _query(monkeypatch, 0, "S4U")
+        service.ensure(restart_running=False)
+        assert installed["refresh"] == 0
+
+    def test_a_box_that_refused_it_is_not_rebuilt_every_update(self, monkeypatch, installed):
+        service._S4U_REFUSED_MARKER.parent.mkdir(parents=True)
+        service._S4U_REFUSED_MARKER.write_text("denied")
+        _query(monkeypatch, 0, "InteractiveToken")
+        service.ensure(restart_running=False)
+        assert installed["refresh"] == 0

{devops_bot_sdk-1.6.75 → devops_bot_sdk-1.6.76}/tests/test_windows_task_paths.py

@@ -88,11 +88,20 @@ class TestRefusesABareProgramName:
         exe.write_text("")
         calls = []
         monkeypatch.setattr(service, "_run", lambda argv: (calls.append(argv), (0, ""))[1])
+        xml_seen = []
+
+        def run(argv):
+            calls.append(argv)
+            if "/XML" in argv:
+                xml_seen.append(Path(argv[argv.index("/XML") + 1]).read_text(encoding="utf-16"))
+            return 0, ""
+        monkeypatch.setattr(service, "_run", run)
         ok, _ = service._install_schtask("0.0.0.0", 8765)
         assert ok is True
         create = calls[0]
         assert create[:4] == ["schtasks", "/Create", "/TN", service.WIN_TASK]
-        assert create[create.index("/TR") + 1].startswith(f'"{exe}" --host 0.0.0.0')
+        assert f"<Command>{exe}</Command>" in xml_seen[0]
+        assert "<Arguments>--host 0.0.0.0 --port 8765 --no-browser</Arguments>" in xml_seen[0]
 
 
 def _task_xml(command: str) -> str: