From 544d6686cfb6afb6cb43cc42924dee84be7115fd Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 12 Mar 2026 21:39:13 +0000
Subject: [PATCH 1/2] Bump black from 26.3.0 to 26.3.1

Bumps [black](https://github.com/psf/black) from 26.3.0 to 26.3.1.
- [Release notes](https://github.com/psf/black/releases)
- [Changelog](https://github.com/psf/black/blob/main/CHANGES.md)
- [Commits](https://github.com/psf/black/compare/26.3.0...26.3.1)

---
updated-dependencies:
- dependency-name: black
  dependency-version: 26.3.1
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 pyproject.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index 1a2de0020..3a4394e4a 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -15,7 +15,7 @@ dependencies = [
 
 [dependency-groups]
 dev = [
-    "black==26.3.0",
+    "black==26.3.1",
     "click==8.3.1",
     "isort==8.0.1",
     "mypy-extensions==1.1.0",

From b9fd5941fff68e9b04aea219ad71402ad4ab3147 Mon Sep 17 00:00:00 2001
From: Alexander Temp <alexander.temp@sit.nrw>
Date: Mon, 10 Aug 2026 08:18:10 +0200
Subject: [PATCH 2/2] fix(agent): separate download and upload paths for agent
 package transfer

Fixes #741

The `win_copy` and `copy` modules always expect their source file to
be located either on the Ansible controller, or on the target host
itself when `remote_src: true` is set. They cannot transparently
bridge a file between two different remote hosts.

Previously, a single path variable (`__checkmk_agent_agent.file.*`)
was used both as the destination for the initial package download
(which may run on a delegated host, e.g. `localhost`, depending on
`checkmk_agent_delegate_download`) and as the source/destination for
the subsequent copy task onto the actual target host. When the
download was delegated to a host different from the target, this
caused the copy task to fail, since the file did not exist at the
expected location on the target.

This change splits the previously shared path into two explicit,
independent path sets:

- `__checkmk_agent_agent.file.download.*`: where the package is
  downloaded to (on the delegated/download host).
- `__checkmk_agent_agent.file.upload.*`: where the package is
  copied/uploaded to on the target host, and subsequently installed
  from.

All download tasks (`get_url`/`win_get_url` via
`checkmk_agent_delegate_download`) now write to `file.download.*`,
while the `copy`/`win_copy` tasks explicitly use `file.download.*`
as `src` and `file.upload.*` as `dest`. Installation tasks
(`package`, `zypper`, `win_package`) now consistently reference
`file.upload.*`, since that is the final location on the target
host.

Additionally:
- `checkmk_agent_delegate_download` is changed from a
  hostname-based variable (defaulting to `inventory_hostname`) to a
  boolean, making the delegation intent explicit rather than
  implicit through hostname comparison.
- `__checkmk_agent_host_tmp_dir` (used for the download destination)
  is now defined centrally in `vars/main.yml`, while OS-specific
  `__checkmk_agent_lin_tmp_dir` / `__checkmk_agent_win_tmp_dir`
  variables are introduced for the upload destination on Linux and
  Windows targets respectively.

Signed-off-by: Alexander Temp <alexander.temp@sit.nrw>
---
 roles/agent/defaults/main.yml       |   2 +-
 roles/agent/tasks/Debian.yml        |   6 +-
 roles/agent/tasks/Linux-files.yml   | 352 +++++++++++++++++++---------
 roles/agent/tasks/Linux.yml         |  10 +-
 roles/agent/tasks/RedHat.yml        |   6 +-
 roles/agent/tasks/Suse.yml          |   6 +-
 roles/agent/tasks/Win32NT-files.yml |  24 +-
 roles/agent/tasks/Windows.yml       |  12 +-
 roles/agent/tasks/main.yml          |  26 +-
 roles/agent/vars/Debian.yml         |  13 +-
 roles/agent/vars/RedHat.yml         |  13 +-
 roles/agent/vars/Suse.yml           |  13 +-
 roles/agent/vars/Windows.yml        |  13 +-
 roles/agent/vars/main.yml           |   4 +
 14 files changed, 334 insertions(+), 166 deletions(-)

diff --git a/roles/agent/defaults/main.yml b/roles/agent/defaults/main.yml
index e6a6df6bc..aebaadc49 100644
--- a/roles/agent/defaults/main.yml
+++ b/roles/agent/defaults/main.yml
@@ -49,7 +49,7 @@ checkmk_agent_configure_firewall: true
 
 ## Delegation
 checkmk_agent_delegate_api_calls: 'localhost'
-checkmk_agent_delegate_download: "{{ inventory_hostname }}"
+checkmk_agent_delegate_download: true
 checkmk_agent_delegate_registration: false
 checkmk_agent_delegate_registration_target: "{{ inventory_hostname }}"
 
diff --git a/roles/agent/tasks/Debian.yml b/roles/agent/tasks/Debian.yml
index 12fc3d797..16d8db70c 100644
--- a/roles/agent/tasks/Debian.yml
+++ b/roles/agent/tasks/Debian.yml
@@ -2,7 +2,7 @@
 - name: "{{ ansible_facts['os_family'] }} Derivatives: Install host-specific {{ checkmk_agent_edition | upper }} Agent."
   become: true
   ansible.builtin.package:
-    deb: "{{ __checkmk_agent_agent.file.host }}"
+    deb: "{{ __checkmk_agent_agent.file.upload.host }}"
     force: "{{ checkmk_agent_force_install | bool }}"
     state: present
   when: |
@@ -14,7 +14,7 @@
 - name: "{{ ansible_facts['os_family'] }} Derivatives: Install folder-specific {{ checkmk_agent_edition | upper }} Agent."
   become: true
   ansible.builtin.package:
-    deb: "{{ __checkmk_agent_agent.file.pro }}"
+    deb: "{{ __checkmk_agent_agent.file.upload.pro }}"
     force: "{{ checkmk_agent_force_install | bool }}"
     state: present
   when: |
@@ -26,7 +26,7 @@
 - name: "{{ ansible_facts['os_family'] }} Derivatives: Install Vanilla Agent."
   become: true
   ansible.builtin.package:
-    deb: "{{ __checkmk_agent_agent.file.community }}"
+    deb: "{{ __checkmk_agent_agent.file.upload.community }}"
     force: "{{ checkmk_agent_force_install | bool }}"
     state: present
   when: |
diff --git a/roles/agent/tasks/Linux-files.yml b/roles/agent/tasks/Linux-files.yml
index dcf689e5b..2d83b0f3d 100644
--- a/roles/agent/tasks/Linux-files.yml
+++ b/roles/agent/tasks/Linux-files.yml
@@ -1,123 +1,245 @@
 ---
-- name: "{{ ansible_facts['system'] }}: Download host-specific {{ checkmk_agent_edition | upper }} Agent."
-  ansible.builtin.uri:
-    url:
-      "{{ __checkmk_agent_agent.url.pro }}?\
-      host_name={{ checkmk_agent_host_name }}&\
-      os_type={{ __checkmk_agent_files_mapping[ansible_facts['os_family']] }}&\
-      agent_type=host_name"
-    validate_certs: "{{ checkmk_agent_server_validate_certs | bool }}"
-    dest: "{{ __checkmk_agent_agent.file.host }}"
-    method: GET
-    headers:
-      Authorization: "Bearer {{ checkmk_agent_user }} {{ __checkmk_agent_auth }}"
-      Accept: "application/octet-stream"
-    timeout: "{{ checkmk_agent_download_timeout | default(omit) }}"
-  when: |
-    checkmk_agent_edition | lower != "community"
-  become: false
-  register: __checkmk_agent_host_download_state
-  # This task may fail, as we fall back to the vanilla agent later
-  failed_when: false
-  changed_when: __checkmk_agent_host_download_state.status is defined and __checkmk_agent_host_download_state.status == 200
-  delegate_to: "{{ checkmk_agent_delegate_download }}"
-  tags:
-    - download-package
+- name: Copy block for Linux target and Linux controller
+  when: not __checkmk_agent_delegate_is_windows
+  block:
+    - name: "{{ ansible_facts['system'] }}: Download host-specific {{ checkmk_agent_edition | upper }} Agent."
+      ansible.builtin.uri:
+        url: "{{ __checkmk_agent_agent.url.pro }}?\
+          host_name={{ checkmk_agent_host_name }}&\
+          os_type={{ __checkmk_agent_files_mapping[ansible_facts['os_family']] }}&\
+          agent_type=host_name"
+        validate_certs: "{{ checkmk_agent_server_validate_certs | bool }}"
+        dest: "{{ __checkmk_agent_agent.file.download.host }}"
+        method: GET
+        headers:
+          Authorization: "Bearer {{ checkmk_agent_user }} {{ __checkmk_agent_auth }}"
+          Accept: "application/octet-stream"
+        mode: "0644"
+        timeout: "{{ checkmk_agent_download_timeout | default(omit) }}"
+      when: |
+        checkmk_agent_edition | lower != "community"
+      become: false
+      register: __checkmk_agent_host_download_state
+      # This task may fail, as we fall back to the vanilla agent later
+      failed_when: false
+      changed_when: __checkmk_agent_host_download_state.status is defined and __checkmk_agent_host_download_state.status == 200
+      delegate_to: "{{ 'localhost' if checkmk_agent_delegate_download else 'inventory_hostname' }}"
+      tags:
+        - download-package
 
-- name: "Record host-specific agent download result."
-  ansible.builtin.set_fact:
-    checkmk_agent_host_specific: >-
-      {{ (__checkmk_agent_host_download_state.status is defined and __checkmk_agent_host_download_state.status == 200) | bool }}
-  tags:
-    - download-package
+    - name: "Record host-specific agent download result."
+      ansible.builtin.set_fact:
+        checkmk_agent_host_specific: >-
+          {{ (__checkmk_agent_host_download_state.status is defined and __checkmk_agent_host_download_state.status == 200) | bool }}
+      tags:
+        - download-package
 
-- name: "{{ ansible_facts['system'] }}: Download folder-specific {{ checkmk_agent_edition | upper }} Agent."
-  ansible.builtin.uri:
-    url:
-      "{{ __checkmk_agent_agent.url.pro }}?\
-      os_type={{ __checkmk_agent_files_mapping[ansible_facts['os_family']] }}&\
-      folder_name={{ checkmk_agent_folder }}&\
-      agent_type=generic"
-    validate_certs: "{{ checkmk_agent_server_validate_certs | bool }}"
-    dest: "{{ __checkmk_agent_agent.file.pro }}"
-    method: GET
-    headers:
-      Authorization: "Bearer {{ checkmk_agent_user }} {{ __checkmk_agent_auth }}"
-      Accept: "application/octet-stream"
-    timeout: "{{ checkmk_agent_download_timeout | default(omit) }}"
-  become: false
-  register: __checkmk_agent_folder_download_state
-  when: |
-    checkmk_agent_edition | lower != "community"
-    and checkmk_agent_folder is defined
-    and not checkmk_agent_host_specific | bool
-  retries: 3
-  delay: 10
-  # This task may fail, as we fall back to the vanilla agent later
-  failed_when: false
-  changed_when: __checkmk_agent_folder_download_state.status is defined and __checkmk_agent_folder_download_state.status == 200
-  delegate_to: "{{ checkmk_agent_delegate_download }}"
-  tags:
-    - download-package
+    - name: "{{ ansible_facts['system'] }}: Download folder-specific {{ checkmk_agent_edition | upper }} Agent."
+      ansible.builtin.uri:
+        url: "{{ __checkmk_agent_agent.url.pro }}?\
+          os_type={{ __checkmk_agent_files_mapping[ansible_facts['os_family']] }}&\
+          folder_name={{ checkmk_agent_folder }}&\
+          agent_type=generic"
+        validate_certs: "{{ checkmk_agent_server_validate_certs | bool }}"
+        dest: "{{ __checkmk_agent_agent.file.download.pro }}"
+        method: GET
+        headers:
+          Authorization: "Bearer {{ checkmk_agent_user }} {{ __checkmk_agent_auth }}"
+          Accept: "application/octet-stream"
+        mode: "0644"
+        timeout: "{{ checkmk_agent_download_timeout | default(omit) }}"
+      become: false
+      register: __checkmk_agent_folder_download_state
+      when: |
+        checkmk_agent_edition | lower != "community"
+        and checkmk_agent_folder is defined
+        and not checkmk_agent_host_specific | bool
+      retries: 3
+      delay: 10
+      # This task may fail, as we fall back to the vanilla agent later
+      failed_when: false
+      changed_when: __checkmk_agent_folder_download_state.status is defined and __checkmk_agent_folder_download_state.status == 200
+      delegate_to: "{{ 'localhost' if checkmk_agent_delegate_download else 'inventory_hostname' }}"
+      tags:
+        - download-package
 
-- name: "Record folder-specific agent download result."
-  ansible.builtin.set_fact:
-    checkmk_agent_folder_specific: >-
-      {{ (__checkmk_agent_folder_download_state.status is defined and __checkmk_agent_folder_download_state.status == 200) | bool }}
-  tags:
-    - download-package
+    - name: "Record folder-specific agent download result."
+      ansible.builtin.set_fact:
+        checkmk_agent_folder_specific: >-
+          {{ (__checkmk_agent_folder_download_state.status is defined and __checkmk_agent_folder_download_state.status == 200) | bool }}
+      tags:
+        - download-package
 
-- name: "{{ ansible_facts['system'] }}: Download Vanilla {{ checkmk_agent_edition | upper }} Agent."
-  ansible.builtin.get_url:  # This has to be the `get_url` module, as the download works different than for the bakery-based tasks.
-    url: "{{ __checkmk_agent_agent.url.community }}"
-    validate_certs: "{{ checkmk_agent_server_validate_certs | bool }}"
-    dest: "{{ __checkmk_agent_agent.file.community }}"
-    mode: '0644'
-    timeout: "{{ checkmk_agent_download_timeout | default(omit) }}"
-  become: false
-  register: __checkmk_agent_vanilla_download_state
-  when: |
-    checkmk_agent_edition | lower == "community"
-    or not (checkmk_agent_host_specific | bool or checkmk_agent_folder_specific | bool)
-  retries: 3
-  delay: 10
-  until: "not __checkmk_agent_vanilla_download_state.failed | bool"
-  delegate_to: "{{ checkmk_agent_delegate_download }}"
-  tags:
-    - download-package
+    - name: "{{ ansible_facts['system'] }}: Download Vanilla {{ checkmk_agent_edition | upper }} Agent."
+      ansible.builtin.get_url: # This has to be the `get_url` module, as the download works different than for the bakery-based tasks.
+        url: "{{ __checkmk_agent_agent.url.community }}"
+        validate_certs: "{{ checkmk_agent_server_validate_certs | bool }}"
+        dest: "{{ __checkmk_agent_agent.file.download.community }}"
+        mode: "0644"
+        timeout: "{{ checkmk_agent_download_timeout | default(omit) }}"
+      become: false
+      register: __checkmk_agent_vanilla_download_state
+      when: |
+        checkmk_agent_edition | lower == "community"
+        or not (checkmk_agent_host_specific | bool or checkmk_agent_folder_specific | bool)
+      retries: 3
+      delay: 10
+      until: "not __checkmk_agent_vanilla_download_state.failed | bool"
+      delegate_to: "{{ 'localhost' if checkmk_agent_delegate_download else 'inventory_hostname' }}"
+      tags:
+        - download-package
 
-- name: "{{ ansible_facts['system'] }}: Transfer host-specific {{ checkmk_agent_edition | upper }} Agent."
-  ansible.builtin.copy:
-    src: "{{ __checkmk_agent_agent.file.host }}"
-    dest: "{{ __checkmk_agent_agent.file.host }}"
-    mode: "0644"
-  when: |
-    checkmk_agent_edition | lower != "community"
-    and checkmk_agent_host_specific | bool
-    and checkmk_agent_delegate_download != inventory_hostname
-  tags:
-    - download-package
+    - name: "{{ ansible_facts['system'] }}: Transfer host-specific {{ checkmk_agent_edition | upper }} Agent."
+      ansible.builtin.copy:
+        src: "{{ __checkmk_agent_agent.file.download.host }}"
+        dest: "{{ __checkmk_agent_agent.file.upload.host }}"
+        mode: "0644"
+      when: |
+        checkmk_agent_edition | lower != "community"
+        and checkmk_agent_host_specific | bool
+        and checkmk_agent_delegate_download != inventory_hostname
+      tags:
+        - download-package
 
-- name: "{{ ansible_facts['system'] }}: Transfer folder-specific {{ checkmk_agent_edition | upper }} Agent."
-  ansible.builtin.copy:
-    src: "{{ __checkmk_agent_agent.file.pro }}"
-    dest: "{{ __checkmk_agent_agent.file.pro }}"
-    mode: "0644"
-  when: |
-    checkmk_agent_edition | lower != "community"
-    and checkmk_agent_folder_specific | bool
-    and checkmk_agent_delegate_download != inventory_hostname
-  tags:
-    - download-package
+    - name: "{{ ansible_facts['system'] }}: Transfer folder-specific {{ checkmk_agent_edition | upper }} Agent."
+      ansible.builtin.copy:
+        src: "{{ __checkmk_agent_agent.file.download.pro }}"
+        dest: "{{ __checkmk_agent_agent.file.upload.pro }}"
+        mode: "0644"
+      when: |
+        checkmk_agent_edition | lower != "community"
+        and checkmk_agent_folder_specific | bool
+        and checkmk_agent_delegate_download != inventory_hostname
+      tags:
+        - download-package
 
-- name: "{{ ansible_facts['system'] }}: Transfer Vanilla {{ checkmk_agent_edition | upper }} Agent."
-  ansible.builtin.copy:
-    src: "{{ __checkmk_agent_agent.file.community }}"
-    dest: "{{ __checkmk_agent_agent.file.community }}"
-    mode: "0644"
-  when: |
-    checkmk_agent_delegate_download != inventory_hostname
-    and (checkmk_agent_edition | lower == "community"
-    or not (checkmk_agent_host_specific | bool or checkmk_agent_folder_specific | bool))
-  tags:
-    - download-package
+    - name: "{{ ansible_facts['system'] }}: Transfer Vanilla {{ checkmk_agent_edition | upper }} Agent."
+      ansible.builtin.copy:
+        src: "{{ __checkmk_agent_agent.file.download.community }}"
+        dest: "{{ __checkmk_agent_agent.file.upload.community }}"
+        mode: "0644"
+      when: |
+        checkmk_agent_delegate_download != inventory_hostname
+        and (checkmk_agent_edition | lower == "community"
+        or not (checkmk_agent_host_specific | bool or checkmk_agent_folder_specific | bool))
+      tags:
+        - download-package
+
+- name: Copy block for Windows target and Linux controller
+  when: __checkmk_agent_delegate_is_windows
+  block:
+    - name: "{{ ansible_facts['system'] }}: Download host-specific {{ checkmk_agent_edition | upper }} Agent."
+      ansible.windows.win_get_url:
+        url: "{{ __checkmk_agent_agent.url.pro }}?\
+          host_name={{ checkmk_agent_host_name }}&\
+          os_type={{ __checkmk_agent_files_mapping[ansible_facts['os_family']] }}&\
+          agent_type=host_name"
+        validate_certs: "{{ checkmk_agent_server_validate_certs | bool }}"
+        dest: "{{ __checkmk_agent_agent.file.download.host }}"
+        method: GET
+        headers:
+          Authorization: "Bearer {{ checkmk_agent_user }} {{ __checkmk_agent_auth }}"
+          Accept: "application/octet-stream"
+        timeout: "{{ checkmk_agent_download_timeout | default(omit) }}"
+      when: |
+        checkmk_agent_edition | lower != "community"
+      become: false
+      register: __checkmk_agent_host_download_state
+      # This task may fail, as we fall back to the vanilla agent later
+      failed_when: false
+      changed_when: __checkmk_agent_host_download_state.status_code is defined and __checkmk_agent_host_download_state.status_code == 200
+      delegate_to: "{{ 'localhost' if checkmk_agent_delegate_download else 'inventory_hostname' }}"
+      tags:
+        - download-package
+
+    - name: "Record host-specific agent download result."
+      ansible.builtin.set_fact:
+        checkmk_agent_host_specific: >-
+          {{ (__checkmk_agent_host_download_state.status_code is defined and __checkmk_agent_host_download_state.status_code == 200) | bool }}
+      tags:
+        - download-package
+
+    - name: "{{ ansible_facts['system'] }}: Download folder-specific {{ checkmk_agent_edition | upper }} Agent."
+      ansible.windows.win_get_url:
+        url: "{{ __checkmk_agent_agent.url.pro }}?\
+          os_type={{ __checkmk_agent_files_mapping[ansible_facts['os_family']] }}&\
+          folder_name={{ checkmk_agent_folder }}&\
+          agent_type=generic"
+        validate_certs: "{{ checkmk_agent_server_validate_certs | bool }}"
+        dest: "{{ __checkmk_agent_agent.file.download.pro }}"
+        method: GET
+        headers:
+          Authorization: "Bearer {{ checkmk_agent_user }} {{ __checkmk_agent_auth }}"
+          Accept: "application/octet-stream"
+        timeout: "{{ checkmk_agent_download_timeout | default(omit) }}"
+      become: false
+      register: __checkmk_agent_folder_download_state
+      when: |
+        checkmk_agent_edition | lower != "community"
+        and checkmk_agent_folder is defined
+        and not checkmk_agent_host_specific | bool
+      retries: 3
+      delay: 10
+      # This task may fail, as we fall back to the vanilla agent later
+      failed_when: false
+      changed_when: __checkmk_agent_folder_download_state.status_code is defined and __checkmk_agent_folder_download_state.status_code == 200
+      delegate_to: "{{ 'localhost' if checkmk_agent_delegate_download else 'inventory_hostname' }}"
+      tags:
+        - download-package
+
+    - name: "Record folder-specific agent download result."
+      ansible.builtin.set_fact:
+        checkmk_agent_folder_specific: >-
+          {{ (__checkmk_agent_folder_download_state.status_code is defined and __checkmk_agent_folder_download_state.status_code == 200) | bool }}
+      tags:
+        - download-package
+
+    - name: "{{ ansible_facts['system'] }}: Download Vanilla {{ checkmk_agent_edition | upper }} Agent."
+      ansible.windows.win_get_url:
+        url: "{{ __checkmk_agent_agent.url.community }}"
+        validate_certs: "{{ checkmk_agent_server_validate_certs | bool }}"
+        dest: "{{ __checkmk_agent_agent.file.download.community }}"
+        timeout: "{{ checkmk_agent_download_timeout | default(omit) }}"
+      when: |
+        checkmk_agent_edition | lower == "community"
+        or not (checkmk_agent_host_specific | bool or checkmk_agent_folder_specific | bool)
+      register: __checkmk_agent_vanilla_download_state
+      retries: 3
+      delay: 10
+      until: "not __checkmk_agent_vanilla_download_state.failed | bool"
+      delegate_to: "{{ 'localhost' if checkmk_agent_delegate_download else 'inventory_hostname' }}"
+      tags:
+        - download-package
+
+    - name: "{{ ansible_facts['system'] }}: Transfer host-specific {{ checkmk_agent_edition | upper }} Agent."
+      ansible.windows.win_copy:
+        src: "{{ __checkmk_agent_agent.file.download.host }}"
+        dest: "{{ __checkmk_agent_agent.file.upload.host }}"
+      when: |
+        checkmk_agent_edition | lower != "community"
+        and checkmk_agent_host_specific | bool
+        and checkmk_agent_delegate_download != inventory_hostname
+      tags:
+        - download-package
+
+    - name: "{{ ansible_facts['system'] }}: Transfer folder-specific {{ checkmk_agent_edition | upper }} Agent."
+      ansible.windows.win_copy:
+        src: "{{ __checkmk_agent_agent.file.download.pro }}"
+        dest: "{{ __checkmk_agent_agent.file.upload.pro }}"
+      when: |
+        checkmk_agent_edition | lower != "community"
+        and checkmk_agent_folder_specific | bool
+        and checkmk_agent_delegate_download != inventory_hostname
+      tags:
+        - download-package
+
+    - name: "{{ ansible_facts['system'] }}: Transfer Vanilla {{ checkmk_agent_edition | upper }} Agent."
+      ansible.windows.win_copy:
+        src: "{{ __checkmk_agent_agent.file.download.community }}"
+        dest: "{{ __checkmk_agent_agent.file.upload.community }}"
+      when: |
+        checkmk_agent_delegate_download != inventory_hostname
+        and (checkmk_agent_edition | lower == "community"
+        or not (checkmk_agent_host_specific | bool or checkmk_agent_folder_specific | bool))
+      tags:
+        - download-package
diff --git a/roles/agent/tasks/Linux.yml b/roles/agent/tasks/Linux.yml
index 83dab09bf..93bf8b9c5 100644
--- a/roles/agent/tasks/Linux.yml
+++ b/roles/agent/tasks/Linux.yml
@@ -90,7 +90,7 @@
   tags:
     - manage-host
 
-- name: "Ensure registration readiness."  # noqa no-handler
+- name: "Ensure registration readiness." # noqa no-handler
   tags:
     - always
   block:
@@ -268,7 +268,7 @@
   tags:
     - register-agent
 
-- name: "{{ ansible_facts['system'] }}: Initial push of data for push agent."  # noqa no-changed-when
+- name: "{{ ansible_facts['system'] }}: Initial push of data for push agent." # noqa no-changed-when
   become: true
   ansible.builtin.command: cmk-agent-ctl push
   when: checkmk_agent_mode == 'push'
@@ -280,8 +280,8 @@
     path: "{{ item }}"
     state: absent
   loop:
-    - "{{ __checkmk_agent_agent.file.community }}"
-    - "{{ __checkmk_agent_agent.file.pro }}"
-    - "{{ __checkmk_agent_agent.file.host }}"
+    - "{{ __checkmk_agent_agent.file.upload.community }}"
+    - "{{ __checkmk_agent_agent.file.upload.pro }}"
+    - "{{ __checkmk_agent_agent.file.upload.host }}"
   tags:
     - download-package
diff --git a/roles/agent/tasks/RedHat.yml b/roles/agent/tasks/RedHat.yml
index 658b81651..ce1fa7ebb 100644
--- a/roles/agent/tasks/RedHat.yml
+++ b/roles/agent/tasks/RedHat.yml
@@ -2,7 +2,7 @@
 - name: "{{ ansible_facts['os_family'] }} Derivatives: Install host-specific {{ checkmk_agent_edition | upper }} Agent."
   become: true
   ansible.builtin.package:
-    name: "{{ __checkmk_agent_agent.file.host }}"
+    name: "{{ __checkmk_agent_agent.file.upload.host }}"
     state: present
     disable_gpg_check: true
   when: |
@@ -14,7 +14,7 @@
 - name: "{{ ansible_facts['os_family'] }} Derivatives: Install folder-specific {{ checkmk_agent_edition | upper }} Agent."
   become: true
   ansible.builtin.package:
-    name: "{{ __checkmk_agent_agent.file.pro }}"
+    name: "{{ __checkmk_agent_agent.file.upload.pro }}"
     state: present
     disable_gpg_check: true
   when: |
@@ -26,7 +26,7 @@
 - name: "{{ ansible_facts['os_family'] }} Derivatives: Install Vanilla Agent."
   become: true
   ansible.builtin.package:
-    name: "{{ __checkmk_agent_agent.file.community }}"
+    name: "{{ __checkmk_agent_agent.file.upload.community }}"
     state: present
     disable_gpg_check: true
   when: |
diff --git a/roles/agent/tasks/Suse.yml b/roles/agent/tasks/Suse.yml
index d46d85a82..6abc0e7d6 100644
--- a/roles/agent/tasks/Suse.yml
+++ b/roles/agent/tasks/Suse.yml
@@ -2,7 +2,7 @@
 - name: "{{ ansible_facts['os_family'] }} Derivatives: Install host-specific {{ checkmk_agent_edition | upper }} Agent."
   become: true
   community.general.zypper:
-    name: "{{ __checkmk_agent_agent.file.host }}"
+    name: "{{ __checkmk_agent_agent.file.upload.host }}"
     force: "{{ checkmk_agent_force_install | bool }}"
     state: present
     disable_gpg_check: true
@@ -15,7 +15,7 @@
 - name: "{{ ansible_facts['os_family'] }} Derivatives: Install folder-specific {{ checkmk_agent_edition | upper }} Agent."
   become: true
   community.general.zypper:
-    name: "{{ __checkmk_agent_agent.file.pro }}"
+    name: "{{ __checkmk_agent_agent.file.upload.pro }}"
     force: "{{ checkmk_agent_force_install | bool }}"
     state: present
     disable_gpg_check: true
@@ -28,7 +28,7 @@
 - name: "{{ ansible_facts['os_family'] }} Derivatives: Install Vanilla Agent."
   become: true
   community.general.zypper:
-    name: "{{ __checkmk_agent_agent.file.community }}"
+    name: "{{ __checkmk_agent_agent.file.upload.community }}"
     force: "{{ checkmk_agent_force_install | bool }}"
     state: present
     disable_gpg_check: true
diff --git a/roles/agent/tasks/Win32NT-files.yml b/roles/agent/tasks/Win32NT-files.yml
index 82453ee94..b1714aeff 100644
--- a/roles/agent/tasks/Win32NT-files.yml
+++ b/roles/agent/tasks/Win32NT-files.yml
@@ -7,7 +7,7 @@
       os_type={{ __checkmk_agent_files_mapping[ansible_facts['os_family']] }}&\
       agent_type=host_name"
     validate_certs: "{{ checkmk_agent_server_validate_certs | bool }}"
-    dest: "{{ __checkmk_agent_agent.file.host }}"
+    dest: "{{ __checkmk_agent_agent.file.download.host }}"
     method: GET
     headers:
       Authorization: "Bearer {{ checkmk_agent_user }} {{ __checkmk_agent_auth }}"
@@ -20,7 +20,7 @@
   # This task may fail, as we fall back to the vanilla agent later
   failed_when: false
   changed_when: __checkmk_agent_host_download_state.status_code is defined and __checkmk_agent_host_download_state.status_code == 200
-  delegate_to: "{{ checkmk_agent_delegate_download }}"
+  delegate_to: "{{ 'localhost' if checkmk_agent_delegate_download else 'inventory_hostname' }}"
   tags:
     - download-package
 
@@ -39,7 +39,7 @@
       folder_name={{ checkmk_agent_folder }}&\
       agent_type=generic"
     validate_certs: "{{ checkmk_agent_server_validate_certs | bool }}"
-    dest: "{{ __checkmk_agent_agent.file.pro }}"
+    dest: "{{ __checkmk_agent_agent.file.download.pro }}"
     method: GET
     headers:
       Authorization: "Bearer {{ checkmk_agent_user }} {{ __checkmk_agent_auth }}"
@@ -56,7 +56,7 @@
   # This task may fail, as we fall back to the vanilla agent later
   failed_when: false
   changed_when: __checkmk_agent_folder_download_state.status_code is defined and __checkmk_agent_folder_download_state.status_code == 200
-  delegate_to: "{{ checkmk_agent_delegate_download }}"
+  delegate_to: "{{ 'localhost' if checkmk_agent_delegate_download else 'inventory_hostname' }}"
   tags:
     - download-package
 
@@ -71,7 +71,7 @@
   ansible.windows.win_get_url:
     url: "{{ __checkmk_agent_agent.url.community }}"
     validate_certs: "{{ checkmk_agent_server_validate_certs | bool }}"
-    dest: "{{ __checkmk_agent_agent.file.community }}"
+    dest: "{{ __checkmk_agent_agent.file.download.community }}"
     timeout: "{{ checkmk_agent_download_timeout | default(omit) }}"
   when: |
     checkmk_agent_edition | lower == "community"
@@ -80,14 +80,14 @@
   retries: 3
   delay: 10
   until: "not __checkmk_agent_vanilla_download_state.failed | bool"
-  delegate_to: "{{ checkmk_agent_delegate_download }}"
+  delegate_to: "{{ 'localhost' if checkmk_agent_delegate_download else 'inventory_hostname' }}"
   tags:
     - download-package
 
 - name: "{{ ansible_facts['system'] }}: Transfer host-specific {{ checkmk_agent_edition | upper }} Agent."
   ansible.windows.win_copy:
-    src: "{{ __checkmk_agent_agent.file.host }}"
-    dest: "{{ __checkmk_agent_agent.file.host }}"
+    src: "{{ __checkmk_agent_agent.file.download.host }}"
+    dest: "{{ __checkmk_agent_agent.file.upload.host }}"
   when: |
     checkmk_agent_edition | lower != "community"
     and checkmk_agent_host_specific | bool
@@ -97,8 +97,8 @@
 
 - name: "{{ ansible_facts['system'] }}: Transfer folder-specific {{ checkmk_agent_edition | upper }} Agent."
   ansible.windows.win_copy:
-    src: "{{ __checkmk_agent_agent.file.pro }}"
-    dest: "{{ __checkmk_agent_agent.file.pro }}"
+    src: "{{ __checkmk_agent_agent.file.download.pro }}"
+    dest: "{{ __checkmk_agent_agent.file.upload.pro }}"
   when: |
     checkmk_agent_edition | lower != "community"
     and checkmk_agent_folder_specific | bool
@@ -108,8 +108,8 @@
 
 - name: "{{ ansible_facts['system'] }}: Transfer Vanilla {{ checkmk_agent_edition | upper }} Agent."
   ansible.windows.win_copy:
-    src: "{{ __checkmk_agent_agent.file.community }}"
-    dest: "{{ __checkmk_agent_agent.file.community }}"
+    src: "{{ __checkmk_agent_agent.file.download.community }}"
+    dest: "{{ __checkmk_agent_agent.file.upload.community }}"
   when: |
     checkmk_agent_delegate_download != inventory_hostname
     and (checkmk_agent_edition | lower == "community"
diff --git a/roles/agent/tasks/Windows.yml b/roles/agent/tasks/Windows.yml
index 28e0c91d1..b60c3e57b 100644
--- a/roles/agent/tasks/Windows.yml
+++ b/roles/agent/tasks/Windows.yml
@@ -1,7 +1,7 @@
 ---
 - name: "{{ ansible_facts['os_family'] }}: Install host-specific {{ checkmk_agent_edition | upper }} Agent."
   ansible.windows.win_package:
-    path: "{{ __checkmk_agent_agent.file.host }}"
+    path: "{{ __checkmk_agent_agent.file.upload.host }}"
     state: present
   when: |
     checkmk_agent_edition | lower != "community"
@@ -11,7 +11,7 @@
 
 - name: "{{ ansible_facts['os_family'] }}: Install folder-specific {{ checkmk_agent_edition | upper }} Agent."
   ansible.windows.win_package:
-    path: "{{ __checkmk_agent_agent.file.pro }}"
+    path: "{{ __checkmk_agent_agent.file.upload.pro }}"
     state: present
   when: |
     checkmk_agent_edition | lower != "community"
@@ -21,7 +21,7 @@
 
 - name: "{{ ansible_facts['os_family'] }}: Install Vanilla Agent."
   ansible.windows.win_package:
-    path: "{{ __checkmk_agent_agent.file.community }}"
+    path: "{{ __checkmk_agent_agent.file.upload.community }}"
     state: present
   when: |
     checkmk_agent_edition | lower == "community"
@@ -34,8 +34,8 @@
     path: "{{ item }}"
     state: absent
   loop:
-    - "{{ __checkmk_agent_agent.file.community }}"
-    - "{{ __checkmk_agent_agent.file.pro }}"
-    - "{{ __checkmk_agent_agent.file.host }}"
+    - "{{ __checkmk_agent_agent.file.upload.community }}"
+    - "{{ __checkmk_agent_agent.file.upload.pro }}"
+    - "{{ __checkmk_agent_agent.file.upload.host }}"
   tags:
     - download-package
diff --git a/roles/agent/tasks/main.yml b/roles/agent/tasks/main.yml
index 78e302ff2..ac9924e64 100644
--- a/roles/agent/tasks/main.yml
+++ b/roles/agent/tasks/main.yml
@@ -27,8 +27,30 @@
     - install-package
     - download-package
 
-- name: "{{ ansible_facts['system'] }}: Include agent package download tasks."
-  ansible.builtin.include_tasks: "{{ ansible_facts['system'] }}-files.yml"
+- name: "Preflight - Make sure facts for the delegate Host (Controller or Target Host) are present."
+  ansible.builtin.setup:
+  delegate_to: "{{ 'localhost' if checkmk_agent_delegate_download else inventory_hostname }}"
+  delegate_facts: true
+  tags:
+    - download-package
+
+- name: "Preflight - Set facts for the delegate Host (Controller or target Host)"
+  ansible.builtin.set_fact:
+    __checkmk_agent_delegate_is_windows: >-
+      {{ hostvars['localhost']['ansible_facts']['os_family'] == 'Windows' }}
+  tags:
+    - download-package
+
+- name: "{{ ansible_facts['system'] }}: Include agent package download tasks (Linux)."
+  ansible.builtin.include_tasks: "Linux-files.yml"
+  when: not __checkmk_agent_delegate_is_windows
+  tags:
+    - include-system-tasks
+    - download-package
+
+- name: "{{ ansible_facts['system'] }}: Include agent package download tasks (Windows)."
+  ansible.builtin.include_tasks: "Win32NT-files.yml"
+  when: __checkmk_agent_delegate_is_windows
   tags:
     - include-system-tasks
     - download-package
diff --git a/roles/agent/vars/Debian.yml b/roles/agent/vars/Debian.yml
index c1c1a55c8..2f2a49c24 100644
--- a/roles/agent/vars/Debian.yml
+++ b/roles/agent/vars/Debian.yml
@@ -1,11 +1,16 @@
 ---
-__checkmk_agent_host_tmp_dir: "/tmp"
+__checkmk_agent_lin_tmp_dir: "/tmp"
 
 __checkmk_agent_agent:
   url:
     community: "{{ __checkmk_agent_site_url }}/check_mk/agents/check-mk-agent_{{ checkmk_agent_version }}-1_all.deb"
     pro: "{{ __checkmk_agent_site_url }}/check_mk/api/1.0/domain-types/agent/actions/download_by_host/invoke"
   file:
-    community: "{{ __checkmk_agent_host_tmp_dir }}/check-mk-agent_{{ checkmk_agent_version }}-vanilla.deb"
-    pro: "{{ __checkmk_agent_host_tmp_dir }}/check-mk-agent_{{ checkmk_agent_version }}-generic.deb"
-    host: "{{ __checkmk_agent_host_tmp_dir }}/check-mk-agent_{{ checkmk_agent_version }}-{{ inventory_hostname }}.deb"
+    download:
+      community: "{{ __checkmk_agent_host_tmp_dir }}check-mk-agent_{{ checkmk_agent_version }}-vanilla.deb"
+      pro: "{{ __checkmk_agent_host_tmp_dir }}check-mk-agent_{{ checkmk_agent_version }}-generic.deb"
+      host: "{{ __checkmk_agent_host_tmp_dir }}check-mk-agent_{{ checkmk_agent_version }}-{{ inventory_hostname }}.deb"
+    upload:
+      community: "{{ __checkmk_agent_lin_tmp_dir }}/check-mk-agent_{{ checkmk_agent_version }}-vanilla.deb"
+      pro: "{{ __checkmk_agent_lin_tmp_dir }}/check-mk-agent_{{ checkmk_agent_version }}-generic.deb"
+      host: "{{ __checkmk_agent_lin_tmp_dir }}/check-mk-agent_{{ checkmk_agent_version }}-{{ inventory_hostname }}.deb"
diff --git a/roles/agent/vars/RedHat.yml b/roles/agent/vars/RedHat.yml
index cdd4a616e..b2b1a879d 100644
--- a/roles/agent/vars/RedHat.yml
+++ b/roles/agent/vars/RedHat.yml
@@ -1,11 +1,16 @@
 ---
-__checkmk_agent_host_tmp_dir: "/tmp"
+__checkmk_agent_lin_tmp_dir: "/tmp"
 
 __checkmk_agent_agent:
   url:
     community: "{{ __checkmk_agent_site_url }}/check_mk/agents/check-mk-agent-{{ checkmk_agent_version }}-1.noarch.rpm"
     pro: "{{ __checkmk_agent_site_url }}/check_mk/api/1.0/domain-types/agent/actions/download_by_host/invoke"
   file:
-    community: "{{ __checkmk_agent_host_tmp_dir }}/check-mk-agent-{{ checkmk_agent_version }}-1.noarch-vanilla.rpm"
-    pro: "{{ __checkmk_agent_host_tmp_dir }}/check-mk-agent-{{ checkmk_agent_version }}-1.noarch-generic.rpm"
-    host: "{{ __checkmk_agent_host_tmp_dir }}/check-mk-agent-{{ checkmk_agent_version }}-1.noarch-{{ inventory_hostname }}.rpm"
+    download:
+      community: "{{ __checkmk_agent_host_tmp_dir }}check-mk-agent-{{ checkmk_agent_version }}-1.noarch-vanilla.rpm"
+      pro: "{{ __checkmk_agent_host_tmp_dir }}check-mk-agent-{{ checkmk_agent_version }}-1.noarch-generic.rpm"
+      host: "{{ __checkmk_agent_host_tmp_dir }}check-mk-agent-{{ checkmk_agent_version }}-1.noarch-{{ inventory_hostname }}.rpm"
+    upload:
+      community: "{{ __checkmk_agent_host_tmp_dir }}/check-mk-agent-{{ checkmk_agent_version }}-1.noarch-vanilla.rpm"
+      pro: "{{ __checkmk_agent_host_tmp_dir }}/check-mk-agent-{{ checkmk_agent_version }}-1.noarch-generic.rpm"
+      host: "{{ __checkmk_agent_host_tmp_dir }}/check-mk-agent-{{ checkmk_agent_version }}-1.noarch-{{ inventory_hostname }}.rpm"
diff --git a/roles/agent/vars/Suse.yml b/roles/agent/vars/Suse.yml
index cdd4a616e..8431b70a8 100644
--- a/roles/agent/vars/Suse.yml
+++ b/roles/agent/vars/Suse.yml
@@ -1,11 +1,16 @@
 ---
-__checkmk_agent_host_tmp_dir: "/tmp"
+__checkmk_agent_lin_tmp_dir: "/tmp"
 
 __checkmk_agent_agent:
   url:
     community: "{{ __checkmk_agent_site_url }}/check_mk/agents/check-mk-agent-{{ checkmk_agent_version }}-1.noarch.rpm"
     pro: "{{ __checkmk_agent_site_url }}/check_mk/api/1.0/domain-types/agent/actions/download_by_host/invoke"
   file:
-    community: "{{ __checkmk_agent_host_tmp_dir }}/check-mk-agent-{{ checkmk_agent_version }}-1.noarch-vanilla.rpm"
-    pro: "{{ __checkmk_agent_host_tmp_dir }}/check-mk-agent-{{ checkmk_agent_version }}-1.noarch-generic.rpm"
-    host: "{{ __checkmk_agent_host_tmp_dir }}/check-mk-agent-{{ checkmk_agent_version }}-1.noarch-{{ inventory_hostname }}.rpm"
+    download:
+      community: "{{ __checkmk_agent_host_tmp_dir }}check-mk-agent-{{ checkmk_agent_version }}-1.noarch-vanilla.rpm"
+      pro: "{{ __checkmk_agent_host_tmp_dir }}check-mk-agent-{{ checkmk_agent_version }}-1.noarch-generic.rpm"
+      host: "{{ __checkmk_agent_host_tmp_dir }}check-mk-agent-{{ checkmk_agent_version }}-1.noarch-{{ inventory_hostname }}.rpm"
+    upload:
+      community: "{{ __checkmk_agent_lin_tmp_dir }}/check-mk-agent-{{ checkmk_agent_version }}-1.noarch-vanilla.rpm"
+      pro: "{{ __checkmk_agent_lin_tmp_dir }}/check-mk-agent-{{ checkmk_agent_version }}-1.noarch-generic.rpm"
+      host: "{{ __checkmk_agent_lin_tmp_dir }}/check-mk-agent-{{ checkmk_agent_version }}-1.noarch-{{ inventory_hostname }}.rpm"
diff --git a/roles/agent/vars/Windows.yml b/roles/agent/vars/Windows.yml
index 7a876e4ac..44552bcb4 100644
--- a/roles/agent/vars/Windows.yml
+++ b/roles/agent/vars/Windows.yml
@@ -1,5 +1,5 @@
 ---
-__checkmk_agent_host_tmp_dir: "C:\\Windows\\Temp"
+__checkmk_agent_win_tmp_dir: "C:\\Windows\\Temp"
 __checkmk_agent_controller_binary_path: "C:\\Program Files (x86)\\checkmk\\service\\cmk-agent-ctl.exe"
 __checkmk_agent_binary_path: "C:\\Program Files (x86)\\checkmk\\service\\check_mk_agent.exe"
 
@@ -8,6 +8,11 @@ __checkmk_agent_agent:
     community: "{{ __checkmk_agent_site_url }}/check_mk/agents/windows/check_mk_agent.msi"
     pro: "{{ __checkmk_agent_site_url }}/check_mk/api/1.0/domain-types/agent/actions/download_by_host/invoke"
   file:
-    community: "{{ __checkmk_agent_host_tmp_dir }}\\check-mk-agent_{{ checkmk_agent_version }}.msi"
-    pro: "{{ __checkmk_agent_host_tmp_dir }}\\check-mk-agent_{{ checkmk_agent_version }}.msi"
-    host: "{{ __checkmk_agent_host_tmp_dir }}\\check-mk-agent_{{ checkmk_agent_version }}-{{ inventory_hostname }}.msi"
+    download:
+      community: "{{ __checkmk_agent_host_tmp_dir }}check-mk-agent_{{ checkmk_agent_version }}.msi"
+      pro: "{{ __checkmk_agent_host_tmp_dir }}check-mk-agent_{{ checkmk_agent_version }}.msi"
+      host: "{{ __checkmk_agent_host_tmp_dir }}check-mk-agent_{{ checkmk_agent_version }}-{{ inventory_hostname }}.msi"
+    upload:
+      community: "{{ __checkmk_agent_win_tmp_dir }}\\check-mk-agent_{{ checkmk_agent_version }}.msi"
+      pro: "{{ __checkmk_agent_win_tmp_dir }}\\check-mk-agent_{{ checkmk_agent_version }}.msi"
+      host: "{{ __checkmk_agent_win_tmp_dir }}\\check-mk-agent_{{ checkmk_agent_version }}-{{ inventory_hostname }}.msi"
diff --git a/roles/agent/vars/main.yml b/roles/agent/vars/main.yml
index b5b50fb6b..e4f532467 100644
--- a/roles/agent/vars/main.yml
+++ b/roles/agent/vars/main.yml
@@ -37,3 +37,7 @@ __checkmk_agent_files_mapping:
   RedHat: linux_rpm
   Suse: linux_rpm
   Windows: windows_msi
+
+# Temporary directory to download the agent to (Win-Path if controller runs on Windows, Lin-Path if controller runs on Linux)
+# Hast to include the suffix directory delimiter (Win = \\, Lin = /)
+__checkmk_agent_host_tmp_dir: "/tmp/"
\ No newline at end of file