> For the complete documentation index, see [llms.txt](https://docs.we360.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.we360.ai/deployment-and-it-ops/deployment/agent-runtime-and-updates.md). # Agent Runtime & Update Reference This page is a machine-level reference for the desktop agent: which processes run, where they log, how auto-update works end to end, and the commands you can run locally to verify all of it. It is primarily written for **Windows Standard** installs, with Stealth and macOS notes where they differ. If you are diagnosing a broken agent rather than inspecting a healthy one, start with [Desktop Doctor](/deployment-and-it-ops/troubleshooting-and-support/desktop-doctor.md) and the [Tracker Failure Diagnostic Guide](/deployment-and-it-ops/troubleshooting-and-support/tracker-failure-guide.md). *** ## Runtime components ### Windows — Standard Install directory: `C:\Program Files\Zenstack\MyZenV2` | Component | Path | Role | | ---------------------- | -------------------------------------------------------- | ---------------------------------------------------------------------------------------- | | `MyZenV2.exe` | `C:\Program Files\Zenstack\MyZenV2\MyZenV2.exe` | Main tray application (tracking, screenshots, punch in/out UI). Runs per logged-in user. | | `zen_cli.exe` | `C:\Program Files\Zenstack\MyZenV2\zen_cli.exe` | Command-line helper used for install-time checks and diagnostics. | | `install_notifier.exe` | `C:\Program Files\Zenstack\MyZenV2\install_notifier.exe` | Notifies logged-in users after an update installs. | | `ffmpeg.exe` | `C:\Program Files\Zenstack\MyZenV2\ffmpeg.exe` | Screen-recording encoder, launched on demand by the main app. | | `version.txt` | `C:\Program Files\Zenstack\MyZenV2\version.txt` | The locally installed version. | {% hint style="info" %} **Windows Standard has no on-machine auto-updater today** — there is no resident updater process and no scheduled task. Machines are updated by deploying the new MSI through your normal software-distribution channel (Intune, GPO, SCCM, or a manual reinstall); the MSI upgrades in place and preserves configuration. A native auto-updater (mirroring the macOS launchd updater) is planned for an upcoming release. macOS Standard and Stealth (both platforms) do auto-update — see below. {% endhint %} ### Windows — Stealth Install directory: `C:\Program Files\zs`. The supervisors live outside the install directory: | Component | Path | Role | | --------------------- | --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `svcmonitor.exe` | `C:\Windows\svcmonitor.exe` | Windows service / watchdog. Runs the update check loop **inline** (there is no separate updater task for stealth), supervises the agent, and applies domain blocking. | | `svcrunner.exe` | `C:\Windows\svcrunner.exe` | Secondary watchdog that keeps `svcmonitor` and the agent alive. | | `MyZenV2.exe` (agent) | under `C:\Program Files\zs` | The tracking agent, run headless per user session. | ### macOS — Standard | Component | Path | | ----------------- | ----------------------------------------------------------------------------------------------------------------- | | Main app | `/Applications/MyZenV2.app` | | Installed version | `/Applications/MyZenV2.app/Contents/MacOS/version.txt` | | Updater | `updater` binary inside the app bundle, scheduled by the `standard-updater` launchd plist (same 12-hour cadence). | *** ## Log and data locations (Windows) | What | Location | | ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Main app logs (Standard) | `%APPDATA%\ai.we360\MyZen\logs\log_YYYY-MM-DD.log` | | Local activity database (Standard) | `%APPDATA%\ai.we360\MyZen\zs.db` | | App configuration (Standard) | `%APPDATA%\ai.we360\MyZen.ini` | | Go helper / updater logs | `zen--YYYY-MM-DD.log` in the process's temp directory — `%TEMP%` for per-user processes, `C:\Windows\Temp` (or `C:\ProgramData\Temp` if that is not writable) for `SYSTEM` processes such as `zs_manager.exe` and `svcmonitor.exe`. Example: `C:\Windows\Temp\zen-zs_manager-2026-07-14.log`. | | Stealth service logs | `C:\Windows\Temp\zen-svcmonitor-YYYY-MM-DD.log` — each service start logs one grep-friendly `Updater diagnostics:` line containing the resolved installer URL, remote version, and installed version. | {% hint style="info" %} **Enable verbose debug logging:** create an empty file named `.zs-debug` in `%TEMP%` or in the user's home directory. On the next start, the Go components switch to debug-level logging and force file logging on. Delete the file to return to normal. {% endhint %} On macOS, the equivalent app data directory is `~/Library/Application Support/ai.we360/MyZen/` (logs in `logs/`, database `zs.db`), and Go component logs go to the system temp directory with the same `zen--.log` naming. *** ## How auto-update works Auto-update currently applies to **macOS Standard** (the launchd-scheduled `updater` binary inside the app bundle) and **Stealth** (the update loop inside `svcmonitor`). Windows Standard is updated by redeploying the MSI — see the commands below. Every auto-update run walks the same pipeline: 1. **Resolve the tenant** from the local configuration. 2. **Auto-update policy gate.** The updater asks the We360 origin server whether this device/tenant allows auto-update: * A **device-level** setting (per machine) is checked first, then the **tenant manifest**'s auto-update flag. * If no tenant is configured yet (fresh install), updates are **allowed** so unconfigured machines don't strand on stale builds. * If a tenant *is* configured but the policy cannot be fetched, updates are **skipped** — the updater never installs without an authoritative "yes". 3. **Resolve the installer URL.** Server-first: `GET /discover/v1/tenant/{id}/update-urls/` on the origin server returns the per-tenant installer URLs by brand / OS / architecture / asset type. If the endpoint is unreachable or has no matching asset, the updater falls back to the CDN base URL baked into the binary at build time plus the canonical filename (`MyZenV2.msi` on Windows, `MyZenV2-.pkg` on macOS). 4. **Fetch the version manifest.** Every published installer has a JSON sidecar at `.version` containing `version`, `build_version`, `commit`, `built_at`, `md5`, brand, OS, and arch. Any network error, non-2xx response, or implausible version string skips the tick — the updater never installs from a junk response. 5. **Version gate.** The update proceeds only when the remote version is **strictly newer** than the local `version.txt` (semver comparison). This blocks accidental downgrades; a rollback requires publishing a higher-versioned build. 6. **Download, verify, install.** The installer is downloaded, its MD5 is verified against the manifest, and it is installed silently (`SYSTEM` context on Windows, so no UAC prompt). Users are then notified via `install_notifier`. ### Local override markers Three sentinel files under `C:\ProgramData` (or `/tmp` and `/etc` on Unix) let you veto updates on a specific machine — useful for pinning a machine during troubleshooting or QA: | File | Effect | | --------------------------------- | --------------------------------------------- | | `C:\ProgramData\zs-do-not-update` | Skip all update installs on this machine. | | `C:\ProgramData\zs-dev-mode` | Same skip, intended for development machines. | | `C:\ProgramData\zs-updater-abort` | Aborts an in-flight update. | Create them as empty files; delete them to re-enable updates. *** ## Local commands — checking the update system on a machine All commands below are for Windows Standard, run from an **elevated** PowerShell or Command Prompt unless noted. ### 1. What version is installed? ```powershell type "C:\Program Files\Zenstack\MyZenV2\version.txt" ``` ### 2. What version is published? Fetch the `.version` sidecar next to the published installer: ```powershell curl.exe https://portal.we360.ai/static/installers/MyZenV2.msi.version ``` You should get a small JSON document with `version`, `md5`, `built_at`, etc. If you get HTML instead, the URL is wrong or being intercepted by a proxy — see [Network & Security Hardening](/deployment-and-it-ops/security-and-hardening/network-and-security-hardening.md). Tenants with a custom installer base URL should substitute their own base path. ### 3. Update the machine Download the current MSI (see [Download Links & Utilities](/deployment-and-it-ops/deployment/agent-deployment-hub/download-links.md)) and install it over the existing version — it upgrades in place and preserves configuration: ```powershell msiexec /i MyZenV2.msi /qn ``` For fleet-wide updates use your normal channel: [Intune](/deployment-and-it-ops/deployment/agent-deployment-hub/mass-deployment/microsoft-intune.md), [GPO](/deployment-and-it-ops/deployment/agent-deployment-hub/mass-deployment/active-directory-gpo.md), or [command line](/deployment-and-it-ops/deployment/agent-deployment-hub/mass-deployment/command-line-msi.md). ### 4. Stealth machines Stealth has no standalone updater or scheduled task — `svcmonitor.exe` runs the same pipeline internally. To check it, grep the service log for the diagnostics line: ```powershell findstr /C:"Updater diagnostics" C:\Windows\Temp\zen-svcmonitor-*.log ``` The line includes `effective_base_url`, `installer_url`, `installed_version`, `remote_version`, and `is_remote_newer` — a complete snapshot of what the updater would do on its next tick. *** ## zs\_manager — online installer utility (Windows) `zs_manager.exe` is a **web-installer wrapper**: a small self-contained utility that resolves the correct installer for the machine's tenant, downloads it, and runs it silently. It is a support/IT tool — it is **not** part of the agent install, not a resident process, and not the mechanism by which deployed agents update. It is still **work in progress**, so treat its behavior as subject to change. The same binary also powers the renamed **standalone web installers** (e.g. `myzen-standalone.exe` for a standard install, or a stealth installer named after the license key) — those are distributed separately and behave as one-shot online installers; the `zs_manager.exe` download here is the raw utility with the mode switches below. Download: [zs\_manager.exe](https://portal.we360.ai/static/utils/windows/zs_manager.exe) (also listed on [Download Links & Utilities](/deployment-and-it-ops/deployment/agent-deployment-hub/download-links.md)). Run it elevated. Modes: | Command | What it does | | ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `zs_manager.exe /updater-standard` | Install/repair the **Standard** agent: checks the tenant's auto-update policy, resolves the installer URL, downloads, installs silently. Add `/patch-only` to refuse a full reinstall when the existing installation looks valid. | | `zs_manager.exe /updater-stealth` | Same flow for the **Stealth** agent (requires an onboarded machine with a valid key configuration). | | `... --dry-run` | Append to either mode to print a `[DRY-RUN]` report **without changing the machine**: system info, the live update context from the origin server (`AutoUpdateEnabled`, `InstallerBaseUrl`), and the exact installer URL a real run would download. This is the quickest way to check what the update system sees for a given machine/tenant. | Logs go to `zen-zs_manager-YYYY-MM-DD.log` in the temp directory (`C:\Windows\Temp` when run elevated). For testing, the `WE360_INSTALL_BASE_URL` environment variable overrides the built-in CDN fallback URL so the flow can be pointed at a staging or local HTTP server serving `MyZenV2.msi` + `MyZenV2.msi.version`. Per-tenant URLs returned by the origin server still take precedence over the override. *** ## macOS quick reference | Task | Command | | ----------------- | -------------------------------------------------------------------------------------- | | Installed version | `cat /Applications/MyZenV2.app/Contents/MacOS/version.txt` | | Updater config | `/Applications/MyZenV2.app/Contents/MacOS/updater --show-config` | | Dry-run | `sudo /Applications/MyZenV2.app/Contents/MacOS/updater --dry-run` | | Update schedule | `launchctl print system \| grep -i updater` (loaded from the `standard-updater` plist) | | Skip markers | `/tmp/zs-do-not-update`, `/etc/zs-dev-mode` | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.we360.ai/deployment-and-it-ops/deployment/agent-runtime-and-updates.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.