@bli-cockpit/cli 0.2.48 → 0.2.50

package/dist/autostart.js

@@ -1,65 +1,32 @@
-import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
 import os from "node:os";
-import path from "node:path";
-import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths } from "./local-state.js";
-import { savedDiscoveryLimitArgs } from "./discovery-limits.js";
-import { redactedHealthDetail } from "./health-detail.js";
-import { DARWIN_LOGIN_SHELL, resolveStableNodeExecutable, } from "./autostart-node-path.js";
-/** launchd LaunchAgent label; matches docs/runbooks/cockpit-launchd-sync.md. */
-export const AUTOSTART_LABEL = "com.bli.cockpit.sync";
-export const WINDOWS_AUTOSTART_TASK_NAME = "BLI Cockpit Sync";
-const WINDOWS_AUTOSTART_SCRIPT_NAME = "autostart-sync.ps1";
-const WINDOWS_AUTOSTART_REGISTRATION_SCRIPT_NAME = "autostart-register.ps1";
-/**
- * Windowless launcher for the scheduled sync (BLI-2677). Task Scheduler ran
- * powershell.exe directly under an interactive token, and PowerShell is a
- * console-subsystem binary, so every 15-minute tick flashed a conhost window
- * over whatever the operator was doing \u2014 on every Windows machine in the
- * fleet. wscript.exe is a GUI-subsystem host, so it never allocates a console,
- * and it starts the PowerShell child with window style 0 (hidden). S4U was
- * considered and rejected: it breaks on Microsoft-account logons and the task
- * deliberately stays on InteractiveToken with least privilege.
- */
-const WINDOWS_AUTOSTART_LAUNCHER_NAME = "autostart-sync.vbs";
-const WINDOWS_SYNC_LOG_NAME = "sync.log";
-/** With the window hidden, the log is the only place output goes; cap it so an
- * always-on machine syncing every 15 minutes cannot grow it without bound. */
-const WINDOWS_SYNC_LOG_LIMIT_BYTES = 10 * 1024 * 1024;
-const UTF8_BOM = "\uFEFF";
-export const DEFAULT_AUTOSTART_INTERVAL_SECONDS = 15 * 60;
-/**
- * macOS rewrites this file on every network transition (join, leave, DNS
- * change), so watching it retries spooled uploads the moment connectivity
- * returns instead of waiting out the StartInterval \u2014 the lid-closed-mid-upload
- * machine hopping caf\u00E9s is where most historical upload failures came from
- * (BLI-2604). The real file, not the /etc/resolv.conf symlink: launchd watches
- * the path it is given, and the symlink itself never changes. Burst fires are
- * cheap \u2014 the collection lock turns overlap into a named no-op.
- */
-export const DARWIN_NETWORK_CHANGE_SIGNAL = "/private/var/run/resolv.conf";
-const UNSUPPORTED_MESSAGE = "autostart is supported on macOS and Windows only";
-/**
- * What the tick says to sync.err.log when neither the registered node binary
- * nor a login-shell node exists. Named, actionable, path-free (BLI-3553).
+import { fileExists, unsupportedResult, } from "./autostart-contract.js";
+import { darwinAgentStatus, installDarwinAgent, uninstallDarwinAgent, } from "./autostart-darwin.js";
+import { readRegisteredDarwinRuntimePaths } from "./autostart-darwin-plist.js";
+import { installWindowsTask, uninstallWindowsTask, windowsTaskStatus, } from "./autostart-windows.js";
+import { readRegisteredWindowsRuntimePaths } from "./autostart-windows-scripts.js";
+/**
+ * Background collection's front door: install, uninstall, and status for the
+ * OS scheduler, whichever OS this is.
+ *
+ * Everything here picks a host family and delegates. The two families each own
+ * a render → write → register → validate stack of their own:
+ *
+ * - macOS: autostart-darwin.ts (launchctl) over autostart-darwin-plist.ts.
+ * - Windows: autostart-windows.ts (schtasks) over autostart-windows-scripts.ts
+ *   for what gets written and autostart-windows-task-xml.ts for what Windows
+ *   says it stored.
+ *
+ * Shared vocabulary — labels, options, results, settings resolution — lives in
+ * autostart-contract.ts and is re-exported here because this module is the
+ * import site the rest of the collector already knows (BLI-3571).
  */
-export const DARWIN_NODE_MISSING_MESSAGE = "[autostart] tick skipped: reason=node_binary_missing - the registered node binary is gone and no node is on the login PATH; run cockpit doctor to re-register";
-function plistPathFor(homeDir) {
-    return path.join(homeDir, "Library", "LaunchAgents", `${AUTOSTART_LABEL}.plist`);
-}
-function unsupportedResult(homeDir) {
-    return {
-        status: "unsupported",
-        label: AUTOSTART_LABEL,
-        plist_path: plistPathFor(homeDir ?? os.homedir()),
-        message: UNSUPPORTED_MESSAGE,
-    };
-}
+export { AUTOSTART_LABEL, DEFAULT_AUTOSTART_INTERVAL_SECONDS, WINDOWS_AUTOSTART_TASK_NAME, } from "./autostart-contract.js";
+export { DARWIN_NETWORK_CHANGE_SIGNAL, DARWIN_NODE_MISSING_MESSAGE, writeDarwinAutostartPlist, } from "./autostart-darwin-plist.js";
+export { launchdUserDomain, reregisterDarwinAgent, } from "./autostart-darwin.js";
 /**
- * Installs (or refreshes) the launchd LaunchAgent that keeps `cockpit sync`
- * running at login and every `intervalSeconds`. Mirrors the plist in
- * docs/runbooks/cockpit-launchd-sync.md exactly, but writes resolved absolute
- * log paths (launchd does not expand `$HOME`). The unload before load makes the
- * install idempotent — re-running picks up a changed repo/url/interval.
+ * Installs (or refreshes) the scheduled `cockpit sync` this machine's OS
+ * supports. Idempotent on both host families: re-running picks up changed
+ * roots, dashboard URL, or cadence.
  */
 export async function installAutostartAgent(options) {
     const platform = options.platform ?? process.platform;
@@ -67,140 +34,11 @@ export async function installAutostartAgent(options) {
         return installWindowsTask(options);
     if (platform !== "darwin")
         return unsupportedResult(options.homeDir);
-    const written = await writeDarwinAutostartPlist(options);
-    const { plist_path: plistPath, work_dir: workDir, work_dirs: resolvedWorkDirs, dashboard_url: dashboardUrl, interval_seconds: intervalSeconds, watch_path_count: watchPathCount, } = written;
-    // Unload first so a changed plist is actually picked up; a not-yet-loaded
-    // agent makes unload fail harmlessly, so the error is ignored.
-    await options.exec("launchctl", ["unload", plistPath]).catch(() => undefined);
-    const load = await options.exec("launchctl", ["load", plistPath]);
-    const loaded = load.code === 0;
-    // Both branches log, for the same reason the Windows path does: a line that
-    // only fires on failure cannot answer "did background collection get
-    // installed at all today?". Until BLI-3483 the macOS failure existed only in
-    // the returned `message`, which nothing on the sync path reads — a Mac could
-    // finish `cockpit onboard` with no scheduler and nothing in sync.err.log.
-    // Metadata only: launchctl's stderr can carry the state directory, so the
-    // exit code and the redacted first line travel, never the raw text.
-    if (loaded) {
-        console.error("[autostart] launchd agent loaded", JSON.stringify({
-            label: AUTOSTART_LABEL,
-            interval_seconds: intervalSeconds,
-            watch_path_count: watchPathCount,
-            node_path_reason: written.node_path_reason,
-        }));
-    }
-    else {
-        console.error("[autostart] launchctl load failed; this Mac has no background collection", JSON.stringify({
-            reason: "autostart_load_failed",
-            label: AUTOSTART_LABEL,
-            exit_code: load.code,
-            detail: launchctlDetail(load),
-        }));
-    }
-    return {
-        status: "installed",
-        label: AUTOSTART_LABEL,
-        plist_path: plistPath,
-        loaded,
-        interval_seconds: intervalSeconds,
-        work_dir: workDir,
-        work_dirs: resolvedWorkDirs,
-        dashboard_url: dashboardUrl,
-        ...(loaded
-            ? {}
-            : {
-                message: `launchctl load exited ${load.code}: ${launchctlDetail(load)}`,
-            }),
-    };
-}
-/**
- * Renders and writes the LaunchAgent plist without touching launchd.
- *
- * Split out of `installAutostartAgent` for BLI-3553: the detached macOS healer
- * (autostart-self-heal.ts) has to write the SAME plist this file writes and
- * then re-register it with `bootout`/`bootstrap` rather than `unload`/`load`,
- * and two renderers would be two chances to disagree. One writer, two
- * registration verbs.
- */
-export async function writeDarwinAutostartPlist(options) {
-    const homeDir = options.homeDir ?? os.homedir();
-    const workDirs = normalizeWorkDirs(options.repoRoots);
-    const workDir = path.resolve(options.repoRoot ?? workDirs[0] ?? process.cwd());
-    const resolvedWorkDirs = workDirs.length > 0 ? workDirs : [workDir];
-    const dashboardUrl = options.dashboardUrl ?? DEFAULT_DASHBOARD_URL;
-    const intervalSeconds = options.intervalSeconds ?? DEFAULT_AUTOSTART_INTERVAL_SECONDS;
-    const node = await schedulerNodeExecutable(options, "darwin");
-    const cliEntryPoint = path.resolve(options.cliEntryPoint ?? process.argv[1] ?? "");
-    const paths = getCollectorRuntimePaths(homeDir);
-    const plistPath = plistPathFor(homeDir);
-    const stdoutPath = path.join(paths.state_dir, "sync.log");
-    const stderrPath = path.join(paths.state_dir, "sync.err.log");
-    // launchd will not reliably watch a path that does not exist at load time, so
-    // only feed it the transcript dirs that are present right now. A missing dir
-    // is fine — the StartInterval floor still covers it. The network signal is
-    // appended unconditionally: it always exists on the Macs this plist targets,
-    // and an existence filter would drop it when rendering on another host.
-    const watchPaths = [
-        ...(await existingWatchPaths(homeDir)),
-        DARWIN_NETWORK_CHANGE_SIGNAL,
-    ];
-    await mkdir(path.dirname(plistPath), { recursive: true });
-    await mkdir(paths.state_dir, { recursive: true });
-    await writeFile(plistPath, renderPlist({
-        discoveryArgs: await savedDiscoveryLimitArgs(homeDir),
-        workDir,
-        workDirs: resolvedWorkDirs,
-        dashboardUrl,
-        intervalSeconds,
-        nodeExecutable: node.path,
-        cliEntryPoint,
-        stdoutPath,
-        stderrPath,
-        watchPaths,
-    }), "utf8");
-    return {
-        plist_path: plistPath,
-        work_dir: workDir,
-        work_dirs: resolvedWorkDirs,
-        dashboard_url: dashboardUrl,
-        interval_seconds: intervalSeconds,
-        node_executable: node.path,
-        node_path_reason: node.reason,
-        cli_entry_point: cliEntryPoint,
-        watch_path_count: watchPaths.length,
-    };
+    return installDarwinAgent(options);
 }
 /**
- * The node binary the scheduler should name. BOTH the writer and the read-back
- * validator go through here — if only the writer pinned the stable alias, every
- * machine would read "does not match the current Tower runtime" forever, which
- * is BLI-2541 with a new coat of paint.
- */
-async function schedulerNodeExecutable(options, platform) {
-    const resolver = platform === "win32" ? path.win32.resolve : path.resolve;
-    const given = resolver(options.nodeExecutable ?? process.execPath);
-    return resolveStableNodeExecutable(given, { platform });
-}
-/**
- * What `launchctl` actually said, or an honest account of it saying nothing.
- *
- * "unknown error" was the old fallback, and it is the least useful string in
- * the file: `launchctl load` exits nonzero with EMPTY stderr for the ordinary
- * cases — the agent is already loaded, or the plist was rejected — so the
- * message an operator saw named neither the exit code's meaning nor the
- * silence itself (BLI-3483). Exit 1 with no output is a fact; say so, and say
- * what to do next. stdout is consulted too because launchctl is inconsistent
- * about which stream it uses across macOS versions.
- */
-function launchctlDetail(result) {
-    const spoken = result.stderr.trim() || result.stdout.trim();
-    if (spoken)
-        return redactedHealthDetail(spoken);
-    return `no output on either stream (exit ${result.code}); the agent may already be loaded, or launchd rejected the plist — check \`launchctl print gui/$(id -u)/${AUTOSTART_LABEL}\``;
-}
-/**
- * Removes the LaunchAgent. Reports `absent` when there was nothing to remove so
- * the command is safe to run repeatedly.
+ * Removes the scheduled sync. Reports `absent` when there was nothing to
+ * remove, so the command is safe to run repeatedly.
  */
 export async function uninstallAutostartAgent(options) {
     const platform = options.platform ?? process.platform;
@@ -208,21 +46,11 @@ export async function uninstallAutostartAgent(options) {
         return uninstallWindowsTask(options);
     if (platform !== "darwin")
         return unsupportedResult(options.homeDir);
-    const homeDir = options.homeDir ?? os.homedir();
-    const plistPath = plistPathFor(homeDir);
-    if (!(await fileExists(plistPath))) {
-        return { status: "absent", label: AUTOSTART_LABEL, plist_path: plistPath };
-    }
-    // Same reasoning as the install path above: an agent that was never loaded
-    // makes unload fail harmlessly, and the plist is removed either way, so the
-    // error is deliberately ignored (BLI-3238).
-    await options.exec("launchctl", ["unload", plistPath]).catch(() => undefined);
-    await rm(plistPath, { force: true });
-    return { status: "uninstalled", label: AUTOSTART_LABEL, plist_path: plistPath };
+    return uninstallDarwinAgent(options);
 }
 /**
- * Reports whether the agent is installed, loaded, and still matches the
- * configured roots, cadence, dashboard URL, and Cockpit runtime.
+ * Reports whether the scheduled sync is installed, registered, and still
+ * matches the configured roots, cadence, dashboard URL, and Cockpit runtime.
  */
 export async function autostartStatus(options) {
     const platform = options.platform ?? process.platform;
@@ -230,883 +58,7 @@ export async function autostartStatus(options) {
         return windowsTaskStatus(options);
     if (platform !== "darwin")
         return unsupportedResult(options.homeDir);
-    const homeDir = options.homeDir ?? os.homedir();
-    const plistPath = plistPathFor(homeDir);
-    if (!(await fileExists(plistPath))) {
-        return { status: "absent", label: AUTOSTART_LABEL, plist_path: plistPath };
-    }
-    const workDirs = normalizeWorkDirs(options.repoRoots);
-    const workDir = path.resolve(options.repoRoot ?? workDirs[0] ?? process.cwd());
-    const resolvedWorkDirs = workDirs.length > 0 ? workDirs : [workDir];
-    const dashboardUrl = options.dashboardUrl ?? DEFAULT_DASHBOARD_URL;
-    const intervalSeconds = options.intervalSeconds ?? DEFAULT_AUTOSTART_INTERVAL_SECONDS;
-    const nodeExecutable = (await schedulerNodeExecutable(options, "darwin")).path;
-    const cliEntryPoint = path.resolve(options.cliEntryPoint ?? process.argv[1] ?? "");
-    const plist = await readFile(plistPath, "utf8").catch(() => "");
-    const registrationProblems = darwinAgentRegistrationProblems(plist, {
-        discoveryArgs: await savedDiscoveryLimitArgs(homeDir),
-        workDirs: resolvedWorkDirs,
-        dashboardUrl,
-        intervalSeconds,
-        nodeExecutable,
-        cliEntryPoint,
-    });
-    const list = await options.exec("launchctl", ["list", AUTOSTART_LABEL]);
-    if (list.code !== 0)
-        registrationProblems.unshift("agent is not loaded");
-    return {
-        status: registrationProblems.length === 0 ? "loaded" : "not_loaded",
-        label: AUTOSTART_LABEL,
-        plist_path: plistPath,
-        interval_seconds: intervalSeconds,
-        work_dir: workDir,
-        work_dirs: resolvedWorkDirs,
-        dashboard_url: dashboardUrl,
-        ...(registrationProblems.length > 0
-            ? {
-                message: `launchd agent needs repair: ${registrationProblems.join("; ")}`,
-            }
-            : {}),
-    };
-}
-async function installWindowsTask(options) {
-    const homeDir = options.homeDir ?? os.homedir();
-    const workDirs = normalizeWindowsWorkDirs(options.repoRoots);
-    const workDir = path.win32.resolve(options.repoRoot ?? workDirs[0] ?? process.cwd());
-    const resolvedWorkDirs = workDirs.length > 0 ? workDirs : [workDir];
-    const dashboardUrl = options.dashboardUrl ?? DEFAULT_DASHBOARD_URL;
-    const intervalSeconds = options.intervalSeconds ?? DEFAULT_AUTOSTART_INTERVAL_SECONDS;
-    const intervalMinutes = Math.max(1, Math.ceil(intervalSeconds / 60));
-    const scriptPath = path.join(getCollectorRuntimePaths(homeDir).state_dir, WINDOWS_AUTOSTART_SCRIPT_NAME);
-    const registrationPath = path.join(getCollectorRuntimePaths(homeDir).state_dir, WINDOWS_AUTOSTART_REGISTRATION_SCRIPT_NAME);
-    const launcherPath = windowsAutostartLauncherPath(homeDir);
-    const node = await schedulerNodeExecutable(options, "win32");
-    const nodeExecutable = node.path;
-    const cliEntryPoint = path.win32.resolve(options.cliEntryPoint ?? process.argv[1] ?? "");
-    await mkdir(path.dirname(scriptPath), { recursive: true });
-    await writeFile(scriptPath, `${UTF8_BOM}${renderWindowsSyncScript({
-        discoveryArgs: await savedDiscoveryLimitArgs(homeDir),
-        workDirs: resolvedWorkDirs,
-        dashboardUrl,
-        nodeExecutable,
-        cliEntryPoint,
-        syncLogPath: windowsSyncLogPath(homeDir),
-    })}`, "utf8");
-    // No BOM on the launcher: wscript.exe reads .vbs files as ANSI and treats a
-    // UTF-8 BOM as an invalid character. The rendered content is ASCII-safe for
-    // every path this fleet has.
-    await writeFile(launcherPath, renderWindowsLauncherScript({
-        powershellPath: windowsPowerShellPath(),
-        scriptPath,
-    }), "utf8");
-    await writeFile(registrationPath, `${UTF8_BOM}${renderWindowsRegistrationScript({
-        taskName: WINDOWS_AUTOSTART_TASK_NAME,
-        launcherPath,
-        intervalMinutes,
-    })}`, "utf8");
-    const created = await options.exec("powershell.exe", [
-        "-NoProfile",
-        "-NonInteractive",
-        "-ExecutionPolicy",
-        "Bypass",
-        "-File",
-        registrationPath,
-    ]);
-    // BLI-2996: before this, a nonzero exit here (schtasks rejected the
-    // registration script, or Set-ScheduledTask threw) skipped straight to the
-    // return with `verified: null` and never logged anything — the doctor row
-    // said "needs repair" every run with no way to tell "the rewrite itself
-    // never ran" apart from "it ran and Windows still disagrees" (BLI-2996,
-    // Brandon's machine: same silent non-convergence under two different
-    // validator messages across CLI versions). Metadata only: exit code and
-    // whether the process produced any output, never the stderr/stdout text
-    // (it can carry the state directory or a workspace path).
-    if (created.code !== 0) {
-        console.error("[autostart] windows task repair rewrite failed", JSON.stringify({
-            task_name: WINDOWS_AUTOSTART_TASK_NAME,
-            exit_code: created.code,
-            had_output: Boolean(created.stderr.trim() || created.stdout.trim()),
-        }));
-    }
-    const verified = created.code === 0
-        ? await windowsTaskStatus({
-            ...options,
-            repoRoot: workDir,
-            repoRoots: resolvedWorkDirs,
-            dashboardUrl,
-            intervalSeconds: intervalMinutes * 60,
-            nodeExecutable,
-            cliEntryPoint,
-        })
-        : null;
-    const loaded = verified?.status === "loaded";
-    // windowsTaskStatus() above already logs the needs-repair case (with the
-    // problem list) when the rewrite ran but the read-back still disagrees; log
-    // the converged branch here too, tagged as a repair outcome and by name, so
-    // "did the rewrite actually fix it this run" never depends on inferring it
-    // from a routine status log emitted for an unrelated reason.
-    if (created.code === 0 && loaded) {
-        console.error("[autostart] windows task repair converged", JSON.stringify({ task_name: WINDOWS_AUTOSTART_TASK_NAME }));
-    }
-    return {
-        status: "installed",
-        label: AUTOSTART_LABEL,
-        plist_path: scriptPath,
-        task_name: WINDOWS_AUTOSTART_TASK_NAME,
-        registration_path: registrationPath,
-        loaded,
-        interval_seconds: intervalMinutes * 60,
-        work_dir: workDir,
-        work_dirs: resolvedWorkDirs,
-        dashboard_url: dashboardUrl,
-        ...(loaded
-            ? {}
-            : {
-                message: created.code === 0
-                    ? verified?.message ??
-                        "Windows task registration could not be verified"
-                    : `PowerShell task registration exited ${created.code}: ${created.stderr.trim() ||
-                        created.stdout.trim() ||
-                        "unknown error"}`,
-            }),
-    };
-}
-async function uninstallWindowsTask(options) {
-    const scriptPath = windowsAutostartScriptPath(options.homeDir);
-    const registrationPath = windowsAutostartRegistrationScriptPath(options.homeDir);
-    const launcherPath = windowsAutostartLauncherPath(options.homeDir);
-    const current = await windowsTaskStatus(options);
-    if (current.status === "absent") {
-        await rm(scriptPath, { force: true });
-        await rm(registrationPath, { force: true });
-        await rm(launcherPath, { force: true });
-        return {
-            ...current,
-            plist_path: scriptPath,
-            registration_path: registrationPath,
-        };
-    }
-    const removed = await options.exec("schtasks.exe", [
-        "/Delete",
-        "/TN",
-        WINDOWS_AUTOSTART_TASK_NAME,
-        "/F",
-    ]);
-    if (removed.code === 0) {
-        await rm(scriptPath, { force: true });
-        await rm(registrationPath, { force: true });
-        await rm(launcherPath, { force: true });
-    }
-    return {
-        status: removed.code === 0 ? "uninstalled" : "not_loaded",
-        label: AUTOSTART_LABEL,
-        plist_path: scriptPath,
-        task_name: WINDOWS_AUTOSTART_TASK_NAME,
-        registration_path: registrationPath,
-        ...(removed.code === 0
-            ? {}
-            : {
-                message: `schtasks /Delete exited ${removed.code}: ${removed.stderr.trim() || removed.stdout.trim() || "unknown error"}`,
-            }),
-    };
-}
-async function windowsTaskStatus(options) {
-    const scriptPath = windowsAutostartScriptPath(options.homeDir);
-    const launcherPath = windowsAutostartLauncherPath(options.homeDir);
-    const query = await options.exec("schtasks.exe", [
-        "/Query",
-        "/TN",
-        WINDOWS_AUTOSTART_TASK_NAME,
-        "/XML",
-    ]);
-    if (query.code !== 0) {
-        const queryMessage = `${query.stderr}\n${query.stdout}`;
-        const taskIsKnownAbsent = query.code === 1 &&
-            /cannot find|not found|does not exist/iu.test(queryMessage);
-        // Metadata only: schtasks stderr can carry the state directory, so the exit
-        // code and the classification travel, never the text.
-        console.error("[autostart] windows task query failed", JSON.stringify({
-            task_name: WINDOWS_AUTOSTART_TASK_NAME,
-            exit_code: query.code,
-            status: taskIsKnownAbsent ? "absent" : "not_loaded",
-        }));
-        return {
-            status: taskIsKnownAbsent ? "absent" : "not_loaded",
-            label: AUTOSTART_LABEL,
-            plist_path: scriptPath,
-            task_name: WINDOWS_AUTOSTART_TASK_NAME,
-            message: query.stderr.trim() || query.stdout.trim() || undefined,
-        };
-    }
-    const disabled = /<Enabled>\s*false\s*<\/Enabled>/iu.test(query.stdout);
-    const intervalSeconds = options.intervalSeconds ?? DEFAULT_AUTOSTART_INTERVAL_SECONDS;
-    const intervalMinutes = Math.max(1, Math.ceil(intervalSeconds / 60));
-    const registrationProblems = windowsTaskRegistrationProblems(query.stdout, {
-        launcherPath,
-        intervalMinutes,
-        wscriptPath: windowsWScriptPath(),
-    });
-    if (disabled)
-        registrationProblems.unshift("task is disabled");
-    const scriptExists = await fileExists(scriptPath);
-    if (!scriptExists) {
-        registrationProblems.push("sync script is missing");
-    }
-    else if (options.repoRoots && options.repoRoots.length > 0) {
-        const expectedScript = `${UTF8_BOM}${renderWindowsSyncScript({
-            discoveryArgs: await savedDiscoveryLimitArgs(options.homeDir),
-            workDirs: normalizeWindowsWorkDirs(options.repoRoots),
-            dashboardUrl: options.dashboardUrl ?? DEFAULT_DASHBOARD_URL,
-            nodeExecutable: (await schedulerNodeExecutable(options, "win32")).path,
-            cliEntryPoint: path.win32.resolve(options.cliEntryPoint ?? process.argv[1] ?? ""),
-            syncLogPath: windowsSyncLogPath(options.homeDir),
-        })}`;
-        const currentScript = await readFile(scriptPath, "utf8").catch(() => null);
-        const scriptDifference = renderedFileDifference(currentScript, expectedScript);
-        if (scriptDifference) {
-            registrationProblems.push(`sync script does not match the current roots or Tower runtime (${describeDifference(scriptDifference)})`);
-        }
-    }
-    // Same shape as the sync-script checks: existence always, content only when
-    // the caller supplied roots (a bare `autostart status` stays permissive by
-    // design — see BLI-2362). The launcher's content depends on nothing but the
-    // PowerShell path and the sync-script path, but gating keeps the two
-    // commands' disagreement surface identical to the script check above.
-    const launcherExists = await fileExists(launcherPath);
-    if (!launcherExists) {
-        registrationProblems.push("sync launcher is missing");
-    }
-    else if (options.repoRoots && options.repoRoots.length > 0) {
-        const expectedLauncher = renderWindowsLauncherScript({
-            powershellPath: windowsPowerShellPath(),
-            scriptPath,
-        });
-        const currentLauncher = await readFile(launcherPath, "utf8").catch(() => null);
-        const launcherDifference = renderedFileDifference(currentLauncher, expectedLauncher);
-        if (launcherDifference) {
-            registrationProblems.push(`sync launcher does not match the current Tower runtime (${describeDifference(launcherDifference)})`);
-        }
-    }
-    // Both branches log. A line that only fires on failure cannot answer "did
-    // background collection validate at all today?", which is the question that
-    // would have caught a validator rejecting every healthy Windows task.
-    // Problem labels carry no paths, so they are safe to emit verbatim.
-    if (registrationProblems.length > 0) {
-        console.error("[autostart] windows task needs repair", JSON.stringify({
-            task_name: WINDOWS_AUTOSTART_TASK_NAME,
-            problem_count: registrationProblems.length,
-            problems: registrationProblems,
-        }));
-    }
-    else {
-        console.error("[autostart] windows task validated", JSON.stringify({
-            task_name: WINDOWS_AUTOSTART_TASK_NAME,
-            interval_minutes: intervalMinutes,
-        }));
-    }
-    return {
-        status: registrationProblems.length > 0 ? "not_loaded" : "loaded",
-        label: AUTOSTART_LABEL,
-        plist_path: scriptPath,
-        task_name: WINDOWS_AUTOSTART_TASK_NAME,
-        ...(registrationProblems.length > 0
-            ? {
-                message: `Windows task needs repair: ${registrationProblems.join("; ")}`,
-            }
-            : {}),
-    };
-}
-function renderedFileDifference(current, expected) {
-    const expectedLines = normalizedScriptLines(expected);
-    if (current === null) {
-        return {
-            reason: "file_unreadable",
-            first_differing_line: null,
-            current_line_count: null,
-            expected_line_count: expectedLines.length,
-        };
-    }
-    if (hasByteOrderMark(current) !== hasByteOrderMark(expected)) {
-        return {
-            reason: "byte_order_mark",
-            first_differing_line: 0,
-            current_line_count: normalizedScriptLines(current).length,
-            expected_line_count: expectedLines.length,
-        };
-    }
-    const currentLines = normalizedScriptLines(current);
-    const shared = Math.min(currentLines.length, expectedLines.length);
-    for (let index = 0; index < shared; index += 1) {
-        if (currentLines[index] !== expectedLines[index]) {
-            return {
-                reason: "line_content",
-                first_differing_line: index,
-                current_line_count: currentLines.length,
-                expected_line_count: expectedLines.length,
-            };
-        }
-    }
-    if (currentLines.length !== expectedLines.length) {
-        return {
-            reason: "line_count",
-            first_differing_line: shared,
-            current_line_count: currentLines.length,
-            expected_line_count: expectedLines.length,
-        };
-    }
-    return null;
-}
-/** Safe to print: a reason label, a line index, two counts. No content. */
-function describeDifference(difference) {
-    if (difference.reason === "file_unreadable")
-        return "file could not be read";
-    if (difference.reason === "byte_order_mark")
-        return "byte-order mark differs";
-    return `${difference.reason} at line ${difference.first_differing_line}, ${difference.current_line_count} lines on disk vs ${difference.expected_line_count} expected`;
-}
-function normalizedScriptLines(value) {
-    const withoutBom = hasByteOrderMark(value) ? value.slice(UTF8_BOM.length) : value;
-    return withoutBom
-        .replace(/\r\n/gu, "\n")
-        .replace(/\s+$/u, "")
-        .split("\n");
-}
-function hasByteOrderMark(value) {
-    return value.startsWith(UTF8_BOM);
-}
-function windowsAutostartScriptPath(homeDir) {
-    return path.join(getCollectorRuntimePaths(homeDir ?? os.homedir()).state_dir, WINDOWS_AUTOSTART_SCRIPT_NAME);
-}
-function windowsAutostartRegistrationScriptPath(homeDir) {
-    return path.join(getCollectorRuntimePaths(homeDir ?? os.homedir()).state_dir, WINDOWS_AUTOSTART_REGISTRATION_SCRIPT_NAME);
-}
-function windowsAutostartLauncherPath(homeDir) {
-    return path.join(getCollectorRuntimePaths(homeDir ?? os.homedir()).state_dir, WINDOWS_AUTOSTART_LAUNCHER_NAME);
-}
-function windowsSyncLogPath(homeDir) {
-    return path.join(getCollectorRuntimePaths(homeDir ?? os.homedir()).state_dir, WINDOWS_SYNC_LOG_NAME);
-}
-function renderWindowsRegistrationScript(options) {
-    return [
-        "$ErrorActionPreference = 'Stop'",
-        `$taskName = ${powershellLiteral(options.taskName)}`,
-        `$launcherPath = ${powershellLiteral(options.launcherPath)}`,
-        // wscript.exe is the windowless script host: the task runs the .vbs
-        // launcher, which starts PowerShell with its window hidden, so the
-        // 15-minute sync never flashes a terminal (BLI-2677). //B is batch mode —
-        // a script error becomes a nonzero exit instead of a modal dialog that
-        // would hang the scheduled run.
-        "$wscriptPath = Join-Path (Join-Path $env:SystemRoot 'System32') 'wscript.exe'",
-        // Windows PowerShell 5.1 passes a native argument's embedded quotes to
-        // CommandLineToArgvW unescaped, so a /TR value with bare quotes falls out
-        // of the quoted region at the first space inside a quoted path:
-        // `C:\Users\Brandon Chiem\...` reached schtasks as a stray `Chiem\...`
-        // argument and /Create exited 0x80004005 on every CLI version (BLI-2598).
-        // Escaping the embedded quotes as \" keeps the whole /TR value one
-        // argument; Task Scheduler still normalizes what it stores (BLI-2541),
-        // which the read-back validator already compares path-wise.
-        "$actionArgs = '//B \\\"' + $launcherPath + '\\\"'",
-        "$taskCommand = '\\\"' + $wscriptPath + '\\\" ' + $actionArgs",
-        `& schtasks.exe /Create /TN $taskName /TR $taskCommand /SC MINUTE /MO ${options.intervalMinutes} /IT /RL LIMITED /F | Out-Null`,
-        "if ($LASTEXITCODE -ne 0) { throw \"schtasks /Create exited $LASTEXITCODE\" }",
-        "$settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -MultipleInstances IgnoreNew",
-        "Set-ScheduledTask -TaskName $taskName -Settings $settings | Out-Null",
-        "",
-    ].join("\r\n");
-}
-/**
- * The .vbs launcher the scheduled task actually runs. WshShell.Run with window
- * style 0 starts PowerShell with its console hidden — no flash, no focus
- * steal — and waiting on the child propagates the sync exit code back to Task
- * Scheduler as LastTaskResult. VBScript escapes a quote inside a string by
- * doubling it; Windows paths cannot contain quotes, so the doubled quotes here
- * are only the fixed delimiters around the two paths.
- */
-function renderWindowsLauncherScript(options) {
-    const quotedPowershell = `""${options.powershellPath}""`;
-    const quotedScript = `""${options.scriptPath}""`;
-    return [
-        "' BLI Cockpit sync launcher (BLI-2677). wscript.exe never allocates a",
-        "' console and starts PowerShell hidden, so the 15-minute background sync",
-        "' does not flash a terminal over the operator. Sync output lands in",
-        "' sync.log next to this file instead of a visible window.",
-        "Option Explicit",
-        "Dim windowsShell, syncExitCode",
-        'Set windowsShell = CreateObject("WScript.Shell")',
-        `syncExitCode = windowsShell.Run("${quotedPowershell} -NoProfile -NonInteractive -ExecutionPolicy Bypass -File ${quotedScript}", 0, True)`,
-        "WScript.Quit syncExitCode",
-        "",
-    ].join("\r\n");
-}
-function renderWindowsSyncScript(options) {
-    const dashboardArgs = options.dashboardUrl === DEFAULT_DASHBOARD_URL
-        ? ""
-        : ` --dashboard-url ${powershellLiteral(options.dashboardUrl)}`;
-    const discoveryArgs = options.discoveryArgs.length > 0 ? ` ${options.discoveryArgs.join(" ")}` : "";
-    const commands = options.workDirs.flatMap((root) => [
-        "try {",
-        `  & $nodeExecutable $cliEntryPoint sync --workspace ${powershellLiteral(root)}${dashboardArgs}${discoveryArgs} --json 2>&1 | ForEach-Object { "$_" } | Add-Content -LiteralPath $syncLogPath -Encoding UTF8`,
-        "  if ($LASTEXITCODE -ne 0) { $exitCode = $LASTEXITCODE }",
-        "} catch {",
-        "  Add-Content -LiteralPath $syncLogPath -Encoding UTF8 -Value $_.Exception.Message",
-        "  $exitCode = 1",
-        "}",
-    ]);
-    return [
-        // 'Continue', not 'Stop': the collector logs to stderr on success as well
-        // as failure (that is the repo's logging contract), and Windows PowerShell
-        // 5.1 under 'Stop' turns the first redirected stderr line of a native
-        // command into a terminating NativeCommandError — 'Stop' would kill every
-        // healthy run at its first log line. Failures are tracked by exit code.
-        "$ErrorActionPreference = 'Continue'",
-        "$exitCode = 0",
-        `$nodeExecutable = ${powershellLiteral(options.nodeExecutable)}`,
-        `$cliEntryPoint = ${powershellLiteral(options.cliEntryPoint)}`,
-        // The task window is hidden (BLI-2677), so this log is the only place the
-        // sync's output exists; sync.err.log stays macOS-only because launchd does
-        // stream separation for free and PowerShell 5.1 does not.
-        `$syncLogPath = ${powershellLiteral(options.syncLogPath)}`,
-        `$syncLogFile = Get-Item -LiteralPath $syncLogPath -ErrorAction SilentlyContinue`,
-        `if ($syncLogFile -and $syncLogFile.Length -gt ${WINDOWS_SYNC_LOG_LIMIT_BYTES}) { Set-Content -LiteralPath $syncLogPath -Value '' -Encoding UTF8 }`,
-        ...commands,
-        "exit $exitCode",
-        "",
-    ].join("\r\n");
-}
-function windowsTaskRegistrationProblems(taskXml, expected) {
-    const decodedXml = decodeXmlEntities(taskXml);
-    const expectedInterval = windowsTaskInterval(expected.intervalMinutes);
-    const principalsBody = decodedXml
-        .match(/<Principals(?:\s[^>]*)?>([\s\S]*?)<\/Principals>/iu)?.[1] ??
-        "";
-    const principalBlocks = [
-        ...principalsBody.matchAll(/<Principal(?:\s[^>]*)?>[\s\S]*?<\/Principal>/giu),
-    ].map((match) => match[0]);
-    const principalRemainder = principalsBody
-        .replace(/<Principal(?:\s[^>]*)?>[\s\S]*?<\/Principal>/giu, "")
-        .trim();
-    const exactPrincipalBlock = principalBlocks.length === 1 && principalRemainder === ""
-        ? (principalBlocks[0] ?? "")
-        : "";
-    const principalId = exactPrincipalBlock
-        .match(/<Principal\s[^>]*\bid\s*=\s*["']([^"']+)["'][^>]*>/iu)?.[1] ??
-        null;
-    const triggersBody = decodedXml.match(/<Triggers(?:\s[^>]*)?>([\s\S]*?)<\/Triggers>/iu)?.[1] ??
-        "";
-    const triggerBlocks = [
-        ...triggersBody.matchAll(/<(?:TimeTrigger)(?:\s[^>]*)?>[\s\S]*?<\/(?:TimeTrigger)>/giu),
-    ].map((match) => match[0]);
-    const triggerRemainder = triggersBody
-        .replace(/<(?:TimeTrigger)(?:\s[^>]*)?>[\s\S]*?<\/(?:TimeTrigger)>/giu, "")
-        .trim();
-    const exactTriggerBlock = triggerBlocks.length === 1 && triggerRemainder === ""
-        ? (triggerBlocks[0] ?? "")
-        : "";
-    const repetitionBlocks = exactTriggerBlock
-        ? [
-            ...exactTriggerBlock.matchAll(/<Repetition(?:\s[^>]*)?>[\s\S]*?<\/Repetition>/giu),
-        ].map((match) => match[0])
-        : [];
-    const repetition = repetitionBlocks.length === 1 ? repetitionBlocks[0] ?? "" : "";
-    const actionsBody = decodedXml.match(/<Actions(?:\s[^>]*)?>([\s\S]*?)<\/Actions>/iu)?.[1] ?? "";
-    const actionContext = decodedXml
-        .match(/<Actions\s[^>]*\bContext\s*=\s*["']([^"']+)["'][^>]*>/iu)?.[1] ??
-        null;
-    const execBlocks = [
-        ...actionsBody.matchAll(/<Exec(?:\s[^>]*)?>[\s\S]*?<\/Exec>/giu),
-    ].map((match) => match[0]);
-    const actionRemainder = actionsBody
-        .replace(/<Exec(?:\s[^>]*)?>[\s\S]*?<\/Exec>/giu, "")
-        .trim();
-    const exactExecBlock = execBlocks.length === 1 && actionRemainder === "" ? execBlocks[0] : "";
-    // Strip a wrapping quote pair defensively: every real capture we have shows
-    // Task Scheduler storing <Command> unquoted, but the writer builds the /TR
-    // executable segment with the same \"-escaped quoting it uses for the
-    // launcher argument (BLI-2598), and there is no verified capture proving
-    // schtasks' own TR-splitting heuristic always discards those quotes rather
-    // than leaving them as literal text (BLI-2996 canary-gated gap). A stray
-    // pair of quotes should never be the reason a correctly-registered task
-    // reads as broken.
-    const command = stripSurroundingQuotes(exactExecBlock
-        ?.match(/<Command>\s*([^<]*?)\s*<\/Command>/iu)?.[1]
-        ?.trim() ?? "");
-    const actionArguments = exactExecBlock
-        .match(/<Arguments>\s*([^<]*?)\s*<\/Arguments>/iu)?.[1]
-        ?.trim() ?? "";
-    const expectedArgumentFlags = "//B";
-    const requirements = [
-        [
-            /<DisallowStartIfOnBatteries>\s*false\s*<\/DisallowStartIfOnBatteries>/iu,
-            "task is blocked on battery",
-        ],
-        [
-            /<StopIfGoingOnBatteries>\s*false\s*<\/StopIfGoingOnBatteries>/iu,
-            "task stops on battery",
-        ],
-        [
-            /<MultipleInstancesPolicy>\s*IgnoreNew\s*<\/MultipleInstancesPolicy>/iu,
-            "overlap policy is not IgnoreNew",
-        ],
-        [
-            /<StartWhenAvailable>\s*true\s*<\/StartWhenAvailable>/iu,
-            "missed-run recovery is disabled",
-        ],
-    ];
-    const problems = requirements
-        .filter(([pattern]) => !pattern.test(decodedXml))
-        .map(([, message]) => message);
-    if (!exactPrincipalBlock) {
-        problems.push("task must contain exactly one principal");
-    }
-    else {
-        if (!/<LogonType>\s*InteractiveToken\s*<\/LogonType>/iu.test(exactPrincipalBlock)) {
-            problems.push("logon type is not InteractiveToken");
-        }
-        // Windows omits <RunLevel> entirely when a task runs at the default
-        // LeastPrivilege, so `schtasks /Create ... /RL LIMITED` stores a principal
-        // block with no RunLevel element at all. Demanding the element asks Windows
-        // to state a default it never states, which is why this check failed on
-        // every Windows machine in the fleet and passed on none (0 of 4
-        // autostart-alive events ok, 2026-08-12). Absent means LeastPrivilege; only
-        // an explicit elevated value is a real problem.
-        const runLevel = exactPrincipalBlock
-            .match(/<RunLevel>\s*([^<]*?)\s*<\/RunLevel>/iu)?.[1]
-            ?.trim() || "LeastPrivilege";
-        if (!/^LeastPrivilege$/iu.test(runLevel)) {
-            problems.push(`task does not run with limited privileges (RunLevel=${runLevel})`);
-        }
-    }
-    if (actionContext && actionContext !== principalId) {
-        problems.push("task action context does not match its principal");
-    }
-    if (!exactTriggerBlock) {
-        problems.push("task must contain exactly one TimeTrigger");
-    }
-    if (repetitionBlocks.length !== 1) {
-        problems.push("task must contain exactly one repetition schedule");
-    }
-    else if (!new RegExp(`<Interval>\\s*${escapeRegExp(expectedInterval)}\\s*</Interval>`, "iu").test(repetition)) {
-        problems.push(`repetition interval is not ${expectedInterval}`);
-    }
-    if (/<EndBoundary>/iu.test(exactTriggerBlock)) {
-        problems.push("task trigger has an end boundary");
-    }
-    const randomDelay = exactTriggerBlock
-        .match(/<RandomDelay>\s*([^<]+?)\s*<\/RandomDelay>/iu)?.[1]
-        ?.trim()
-        .toUpperCase() ?? null;
-    if (randomDelay &&
-        !["PT0S", "PT0M", "PT0H"].includes(randomDelay)) {
-        problems.push("task trigger has a nonzero random delay");
-    }
-    if (!exactExecBlock) {
-        problems.push("task must contain exactly one Exec action");
-    }
-    if (!sameWindowsPath(command, expected.wscriptPath)) {
-        problems.push("task action does not run the expected windowless script host");
-    }
-    const actionArgumentProblem = windowsActionArgumentProblem(actionArguments, expectedArgumentFlags, expected.launcherPath);
-    if (actionArgumentProblem) {
-        problems.push(actionArgumentProblem);
-    }
-    if (/<Duration>/iu.test(repetition)) {
-        problems.push("repetition has a finite duration");
-    }
-    return problems;
-}
-function windowsPowerShellPath(env = process.env) {
-    const windowsRoot = env.SystemRoot ?? env.WINDIR ?? "C:\\Windows";
-    return path.win32.join(windowsRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
-}
-function windowsWScriptPath(env = process.env) {
-    const windowsRoot = env.SystemRoot ?? env.WINDIR ?? "C:\\Windows";
-    return path.win32.join(windowsRoot, "System32", "wscript.exe");
-}
-/**
- * Task Scheduler stores a normalized form of the action it was given, not the
- * string we passed: `schtasks /Create /TR "<host> <args>"` is split into
- * <Command> plus <Arguments>, and the quotes around a space-free script path
- * are dropped. Comparing <Arguments> against the exact string we built
- * therefore fails on a task that is registered perfectly — observed on
- * DESKTOP-G2UO1GK (CLI 0.2.13, 2026-08-12), where the stored value differed
- * from the expected one only by those quotes (BLI-2541).
- *
- * BLI-2996: that lesson was only ever applied to the pre-BLI-2677 `-File`
- * action. The wscript launcher pair (`//B "<launcher>"`) has NO verified
- * real-Windows capture — `windowlessWindowsTaskXml()` in autostart.test.ts is
- * SYNTHETIC, built by hand-editing the one real capture we have rather than
- * exported from a machine actually running this action. A repair that rewrites
- * the task correctly but is judged against a guessed shape can fail forever
- * without ever being wrong (Brandon's machine: same non-convergence under two
- * different validator messages across two CLI versions, neither of which ever
- * repaired anything). So this comparison is deliberately structural, not
- * positional: tokenize the way CommandLineToArgvW groups quoted/unquoted
- * arguments, then check flag-token-then-path-token semantically (a real path
- * comparison, case- and quote-insensitive) instead of demanding the exact
- * byte layout we happened to send. Whatever the wscript action's real
- * normalization turns out to be once a canary captures it, this only fails on
- * an actual different flag or different script — not on Windows' own
- * reformatting.
- */
-function windowsActionArgumentProblem(actionArguments, expectedFlags, expectedLauncherPath) {
-    const tokens = splitWindowsArgumentTokens(actionArguments);
-    if (tokens.length === 0) {
-        return "task action names no sync launcher to run";
-    }
-    if ((tokens[0] ?? "").toUpperCase() !== expectedFlags.toUpperCase()) {
-        return "task action does not run the launcher with the expected batch-mode flag";
-    }
-    if (tokens.length > 2) {
-        return "task action passes unexpected extra arguments to the sync launcher";
-    }
-    const launcherArgument = tokens[1];
-    if (!launcherArgument) {
-        return "task action names no sync launcher to run";
-    }
-    if (!sameWindowsPath(launcherArgument, expectedLauncherPath)) {
-        return "task action runs a script other than the Tower sync launcher";
-    }
-    return null;
-}
-/**
- * Quote-aware whitespace tokenizer for an already-XML-decoded `<Arguments>`
- * value: a `"..."` run is one token (quotes stripped, whitespace inside kept),
- * everything else splits on whitespace. Windows paths never contain a quote
- * character, so this does not need CommandLineToArgvW's backslash-escaping
- * rules — only its quoting rule — to tell "one argument with a space in it"
- * apart from "two arguments".
- */
-function splitWindowsArgumentTokens(value) {
-    const tokens = [];
-    let current = "";
-    let inQuotes = false;
-    let hasToken = false;
-    for (const char of value) {
-        if (char === '"') {
-            inQuotes = !inQuotes;
-            hasToken = true;
-            continue;
-        }
-        if (!inQuotes && /\s/u.test(char)) {
-            if (hasToken) {
-                tokens.push(current);
-                current = "";
-                hasToken = false;
-            }
-            continue;
-        }
-        current += char;
-        hasToken = true;
-    }
-    if (hasToken)
-        tokens.push(current);
-    return tokens;
-}
-/** Removes one wrapping pair of double quotes, if present. Used only to
- * normalize before a path comparison — never to reconstruct a shell-safe
- * value. */
-function stripSurroundingQuotes(value) {
-    const match = value.match(/^"([\s\S]*)"$/u);
-    return match ? match[1] : value;
-}
-function sameWindowsPath(left, right) {
-    if (!left || !right)
-        return false;
-    return path.win32.resolve(left).toLowerCase() ===
-        path.win32.resolve(right).toLowerCase();
-}
-function powershellLiteral(value) {
-    return `'${value.replace(/'/gu, "''")}'`;
-}
-function windowsTaskInterval(minutes) {
-    const hours = Math.floor(minutes / 60);
-    const remainingMinutes = minutes % 60;
-    return `PT${hours > 0 ? `${hours}H` : ""}${remainingMinutes > 0 ? `${remainingMinutes}M` : ""}`;
-}
-function decodeXmlEntities(value) {
-    return value
-        .replace(/&quot;/giu, '"')
-        .replace(/&apos;/giu, "'")
-        .replace(/&lt;/giu, "<")
-        .replace(/&gt;/giu, ">")
-        .replace(/&amp;/giu, "&");
-}
-function escapeRegExp(value) {
-    return value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
-}
-/**
- * The transcript directories whose changes should re-trigger a sync, in the
- * order they appear in WatchPaths. Resolved from the same homeDir as the plist
- * and log paths so `--home` redirects them together.
- */
-function watchPathCandidates(homeDir) {
-    return [
-        path.join(homeDir, ".claude", "projects"),
-        path.join(homeDir, ".codex", "sessions"),
-    ];
-}
-/** Subset of the transcript dirs that exist now (see the WatchPaths comment). */
-async function existingWatchPaths(homeDir) {
-    const candidates = watchPathCandidates(homeDir);
-    const present = await Promise.all(candidates.map((dir) => fileExists(dir)));
-    return candidates.filter((_, i) => present[i]);
-}
-function renderPlist(options) {
-    const roots = options.workDirs.length > 0 ? options.workDirs : [options.workDir];
-    const command = renderDarwinSyncCommand({
-        workDirs: roots,
-        dashboardUrl: options.dashboardUrl,
-        nodeExecutable: options.nodeExecutable,
-        cliEntryPoint: options.cliEntryPoint,
-        discoveryArgs: options.discoveryArgs,
-    });
-    return [
-        '<?xml version="1.0" encoding="UTF-8"?>',
-        '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
-        '<plist version="1.0">',
-        "<dict>",
-        "  <key>Label</key>",
-        `  <string>${xmlEscape(AUTOSTART_LABEL)}</string>`,
-        "  <key>ProgramArguments</key>",
-        "  <array>",
-        "    <string>/bin/zsh</string>",
-        "    <string>-c</string>",
-        `    <string>${xmlEscape(command)}</string>`,
-        "  </array>",
-        "  <key>StartInterval</key>",
-        `  <integer>${options.intervalSeconds}</integer>`,
-        "  <key>RunAtLoad</key>",
-        "  <true/>",
-        // WatchPaths makes a transcript write fire `cockpit sync` within seconds, so
-        // captures land near-real-time; StartInterval above is the safety-net floor.
-        // It fires often, but launchd single-flights the job, sync holds its own
-        // lock, and growing-transcript re-upload is damped — so cost stays bounded
-        // and no extra debounce is needed.
-        ...watchPathsBlock(options.watchPaths),
-        "  <key>StandardOutPath</key>",
-        `  <string>${xmlEscape(options.stdoutPath)}</string>`,
-        "  <key>StandardErrorPath</key>",
-        `  <string>${xmlEscape(options.stderrPath)}</string>`,
-        "</dict>",
-        "</plist>",
-        "",
-    ].join("\n");
-}
-function renderDarwinSyncCommand(options) {
-    const dashboardArg = options.dashboardUrl === DEFAULT_DASHBOARD_URL
-        ? ""
-        : ` --dashboard-url ${shellQuote(options.dashboardUrl)}`;
-    const discoveryArg = options.discoveryArgs.length > 0 ? ` ${options.discoveryArgs.join(" ")}` : "";
-    const commands = options.workDirs.map((root) => `"$node_bin" ${shellQuote(options.cliEntryPoint)} sync --workspace ${shellQuote(root)}${dashboardArg}${discoveryArg} --json || exit_code=1`);
-    return [
-        "exit_code=0",
-        ...darwinNodeResolutionPreamble(options.nodeExecutable),
-        ...commands,
-        'exit "$exit_code"',
-    ].join("; ");
-}
-/**
- * The registered node path first, a login-shell PATH lookup second, a named
- * failure third (BLI-3553).
- *
- * The hardcoded absolute path stays FIRST and stays the normal case — launchd
- * hands the tick `PATH=/usr/bin:/bin:/usr/sbin:/sbin` and nothing this fleet
- * runs lives there, which is the whole reason the plist names absolutes
- * (scheduled-self-update.ts:55-62). The fallback only fires when that path is
- * gone: `brew upgrade node` deleted the Cellar directory, `nvm uninstall`
- * removed a version, someone moved a prefix. Before this, that state was a
- * silent `exit 127` every 15 minutes forever, on every tick, with nothing in
- * sync.err.log naming it.
- *
- * `/bin/zsh -lc` because a login shell is where Homebrew's `brew shellenv` and
- * a machine's own PATH edits live; `command -v` because it is a builtin and
- * cannot itself be missing. Recovering here is deliberately temporary: running
- * under a node the plist does not name makes the next status read disagree,
- * which is exactly what wakes the self-heal up to re-register the new path.
- * A machine whose node is only on an INTERACTIVE shell's PATH (nvm sourced from
- * .zshrc) still fails — but now it fails with a reason in the log instead of a
- * bare 127.
- */
-function darwinNodeResolutionPreamble(nodeExecutable) {
-    return [
-        `node_bin=${shellQuote(nodeExecutable)}`,
-        `[ -x "$node_bin" ] || node_bin="$(${DARWIN_LOGIN_SHELL} -lc 'command -v node' 2>/dev/null)"`,
-        `[ -x "$node_bin" ] || { echo ${shellQuote(DARWIN_NODE_MISSING_MESSAGE)} >&2; exit 127; }`,
-    ];
-}
-function darwinAgentRegistrationProblems(plist, expected) {
-    if (!plist)
-        return ["plist could not be read"];
-    const problems = [];
-    if (!plist.includes(`  <string>${xmlEscape(AUTOSTART_LABEL)}</string>`)) {
-        problems.push("label does not match");
-    }
-    if (!plist.includes(`  <integer>${expected.intervalSeconds}</integer>`)) {
-        problems.push(`cadence is not ${expected.intervalSeconds} seconds`);
-    }
-    const expectedCommand = renderDarwinSyncCommand({
-        discoveryArgs: expected.discoveryArgs,
-        workDirs: expected.workDirs,
-        dashboardUrl: expected.dashboardUrl,
-        nodeExecutable: expected.nodeExecutable,
-        cliEntryPoint: expected.cliEntryPoint,
-    });
-    const expectedProgramArguments = [
-        "  <key>ProgramArguments</key>",
-        "  <array>",
-        "    <string>/bin/zsh</string>",
-        "    <string>-c</string>",
-        `    <string>${xmlEscape(expectedCommand)}</string>`,
-        "  </array>",
-    ].join("\n");
-    if (!plist.includes(expectedProgramArguments)) {
-        problems.push("command does not match the current roots, dashboard URL, or Tower runtime");
-    }
-    return problems;
-}
-function normalizeWorkDirs(repoRoots) {
-    if (!repoRoots)
-        return [];
-    const seen = new Set();
-    const normalized = [];
-    for (const root of repoRoots) {
-        const resolved = path.resolve(root);
-        if (seen.has(resolved))
-            continue;
-        seen.add(resolved);
-        normalized.push(resolved);
-    }
-    return normalized;
-}
-function normalizeWindowsWorkDirs(repoRoots) {
-    if (!repoRoots)
-        return [];
-    const seen = new Set();
-    const normalized = [];
-    for (const root of repoRoots) {
-        const resolved = path.win32.resolve(root);
-        const key = resolved.toLowerCase();
-        if (seen.has(key))
-            continue;
-        seen.add(key);
-        normalized.push(resolved);
-    }
-    return normalized;
-}
-/**
- * Renders the `<key>WatchPaths</key><array>…</array>` lines, or nothing when no
- * transcript dir exists yet (an empty array would tell launchd to watch
- * everything-and-nothing; omitting the key leaves StartInterval as the floor).
- */
-function watchPathsBlock(watchPaths) {
-    if (watchPaths.length === 0)
-        return [];
-    return [
-        "  <key>WatchPaths</key>",
-        "  <array>",
-        ...watchPaths.map((dir) => `    <string>${xmlEscape(dir)}</string>`),
-        "  </array>",
-    ];
+    return darwinAgentStatus(options);
 }
 /**
  * What the platform says it will run, parsed out of the registration itself
@@ -1117,19 +69,10 @@ function watchPathsBlock(watchPaths) {
 export async function readRegisteredRuntimePaths(options) {
     const platform = options.platform ?? process.platform;
     if (platform === "darwin") {
-        const plist = await readFile(plistPathFor(options.homeDir ?? os.homedir()), "utf8").catch(() => "");
-        const command = decodeXmlEntities(plist);
-        return {
-            node_executable: /node_bin='([^']*)'/u.exec(command)?.[1] ?? null,
-            cli_entry_point: /"\$node_bin" '([^']*)' sync /u.exec(command)?.[1] ?? null,
-        };
+        return readRegisteredDarwinRuntimePaths(options.homeDir ?? os.homedir());
     }
     if (platform === "win32") {
-        const script = await readFile(windowsAutostartScriptPath(options.homeDir), "utf8").catch(() => "");
-        return {
-            node_executable: /\$nodeExecutable = '([^']*)'/u.exec(script)?.[1] ?? null,
-            cli_entry_point: /\$cliEntryPoint = '([^']*)'/u.exec(script)?.[1] ?? null,
-        };
+        return readRegisteredWindowsRuntimePaths(options.homeDir);
     }
     return { node_executable: null, cli_entry_point: null };
 }
@@ -1160,60 +103,4 @@ export async function registeredRuntimePathProblems(options) {
         problems.push("registered Tower CLI entry point is missing");
     }
     return problems;
-}
-/** `gui/<uid>` — the per-user launchd domain the LaunchAgent lives in. */
-export function launchdUserDomain(uid = process.getuid?.() ?? 0) {
-    return `gui/${uid}`;
-}
-/**
- * Re-registers the LaunchAgent with the modern verbs (BLI-3553).
- *
- * `unload`/`load` is what the interactive install path uses and it stays there;
- * this exists for the DETACHED healer, where the difference matters:
- * `bootstrap` reports a rejected plist with a real error, whereas `load` is
- * documented-deprecated and exits nonzero with empty output for several
- * unrelated states (see launchctlDetail). The healer gets one shot and has no
- * human watching, so it uses the verb that says what went wrong.
- *
- * `bootout` on a service that is not loaded exits nonzero (`3: No such
- * process`); that is the expected steady state after the job that spawned us
- * exited, so it is not treated as a failure. Only `bootstrap` decides the
- * outcome. If it fails, the agent is left unloaded — recoverable, because
- * launchd bootstraps everything in ~/Library/LaunchAgents at the next login,
- * and the plist file itself was already rewritten before this call.
- */
-export async function reregisterDarwinAgent(options) {
-    const domain = launchdUserDomain(options.uid);
-    const bootout = await options
-        .exec("launchctl", ["bootout", `${domain}/${AUTOSTART_LABEL}`])
-        .catch(() => ({ code: 1, stdout: "", stderr: "" }));
-    const bootstrap = await options
-        .exec("launchctl", ["bootstrap", domain, options.plistPath])
-        .catch(() => ({ code: 1, stdout: "", stderr: "" }));
-    if (bootstrap.code === 0) {
-        return {
-            ok: true,
-            reason: "agent_rebootstrapped",
-            detail: `bootout exit ${bootout.code}`,
-        };
-    }
-    return {
-        ok: false,
-        reason: "bootstrap_failed",
-        detail: `launchctl bootstrap exited ${bootstrap.code}: ${launchctlDetail(bootstrap)}`,
-    };
-}
-function shellQuote(value) {
-    return `'${value.replace(/'/g, "'\\''")}'`;
-}
-function xmlEscape(value) {
-    return value
-        .replace(/&/g, "&amp;")
-        .replace(/</g, "&lt;")
-        .replace(/>/g, "&gt;")
-        .replace(/"/g, "&quot;")
-        .replace(/'/g, "&apos;");
-}
-async function fileExists(filePath) {
-    return stat(filePath).then(() => true, () => false);
 }