@bli-cockpit/cli 0.2.5 → 0.2.8

package/dist/autostart.js

@@ -1,11 +1,15 @@
-import { mkdir, rm, stat, writeFile } from "node:fs/promises";
+import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths } from "./local-state.js";
 /** launchd LaunchAgent label; matches docs/runbooks/cockpit-launchd-sync.md. */
 export const AUTOSTART_LABEL = "com.bli.cockpit.sync";
+export const WINDOWS_AUTOSTART_TASK_NAME = "BLI Cockpit Sync";
+const WINDOWS_AUTOSTART_SCRIPT_NAME = "autostart-sync.ps1";
+const WINDOWS_AUTOSTART_REGISTRATION_SCRIPT_NAME = "autostart-register.ps1";
+const UTF8_BOM = "\uFEFF";
 export const DEFAULT_AUTOSTART_INTERVAL_SECONDS = 15 * 60;
-const UNSUPPORTED_MESSAGE = "macOS-only for now; see docs/runbooks/cockpit-launchd-sync.md";
+const UNSUPPORTED_MESSAGE = "autostart is supported on macOS and Windows only";
 function plistPathFor(homeDir) {
     return path.join(homeDir, "Library", "LaunchAgents", `${AUTOSTART_LABEL}.plist`);
 }
@@ -26,6 +30,8 @@ function unsupportedResult(homeDir) {
  */
 export async function installAutostartAgent(options) {
     const platform = options.platform ?? process.platform;
+    if (platform === "win32")
+        return installWindowsTask(options);
     if (platform !== "darwin")
         return unsupportedResult(options.homeDir);
     const homeDir = options.homeDir ?? os.homedir();
@@ -34,6 +40,8 @@ export async function installAutostartAgent(options) {
     const resolvedWorkDirs = workDirs.length > 0 ? workDirs : [workDir];
     const dashboardUrl = options.dashboardUrl ?? DEFAULT_DASHBOARD_URL;
     const intervalSeconds = options.intervalSeconds ?? DEFAULT_AUTOSTART_INTERVAL_SECONDS;
+    const nodeExecutable = path.resolve(options.nodeExecutable ?? process.execPath);
+    const cliEntryPoint = path.resolve(options.cliEntryPoint ?? process.argv[1] ?? "");
     const paths = getCollectorRuntimePaths(homeDir);
     const plistPath = plistPathFor(homeDir);
     const stdoutPath = path.join(paths.state_dir, "sync.log");
@@ -49,6 +57,8 @@ export async function installAutostartAgent(options) {
         workDirs: resolvedWorkDirs,
         dashboardUrl,
         intervalSeconds,
+        nodeExecutable,
+        cliEntryPoint,
         stdoutPath,
         stderrPath,
         watchPaths,
@@ -80,6 +90,8 @@ export async function installAutostartAgent(options) {
  */
 export async function uninstallAutostartAgent(options) {
     const platform = options.platform ?? process.platform;
+    if (platform === "win32")
+        return uninstallWindowsTask(options);
     if (platform !== "darwin")
         return unsupportedResult(options.homeDir);
     const homeDir = options.homeDir ?? os.homedir();
@@ -92,12 +104,13 @@ export async function uninstallAutostartAgent(options) {
     return { status: "uninstalled", label: AUTOSTART_LABEL, plist_path: plistPath };
 }
 /**
- * Reports whether the agent is installed and loaded. `absent` when no plist
- * exists; otherwise `launchctl list <label>` exit code distinguishes `loaded`
- * (0) from `not_loaded` (non-zero).
+ * Reports whether the agent is installed, loaded, and still matches the
+ * configured roots, cadence, dashboard URL, and Cockpit runtime.
  */
 export async function autostartStatus(options) {
     const platform = options.platform ?? process.platform;
+    if (platform === "win32")
+        return windowsTaskStatus(options);
     if (platform !== "darwin")
         return unsupportedResult(options.homeDir);
     const homeDir = options.homeDir ?? os.homedir();
@@ -105,13 +118,396 @@ export async function autostartStatus(options) {
     if (!(await fileExists(plistPath))) {
         return { status: "absent", label: AUTOSTART_LABEL, plist_path: plistPath };
     }
+    const workDirs = normalizeWorkDirs(options.repoRoots);
+    const workDir = path.resolve(options.repoRoot ?? workDirs[0] ?? process.cwd());
+    const resolvedWorkDirs = workDirs.length > 0 ? workDirs : [workDir];
+    const dashboardUrl = options.dashboardUrl ?? DEFAULT_DASHBOARD_URL;
+    const intervalSeconds = options.intervalSeconds ?? DEFAULT_AUTOSTART_INTERVAL_SECONDS;
+    const nodeExecutable = path.resolve(options.nodeExecutable ?? process.execPath);
+    const cliEntryPoint = path.resolve(options.cliEntryPoint ?? process.argv[1] ?? "");
+    const plist = await readFile(plistPath, "utf8").catch(() => "");
+    const registrationProblems = darwinAgentRegistrationProblems(plist, {
+        workDirs: resolvedWorkDirs,
+        dashboardUrl,
+        intervalSeconds,
+        nodeExecutable,
+        cliEntryPoint,
+    });
     const list = await options.exec("launchctl", ["list", AUTOSTART_LABEL]);
+    if (list.code !== 0)
+        registrationProblems.unshift("agent is not loaded");
     return {
-        status: list.code === 0 ? "loaded" : "not_loaded",
+        status: registrationProblems.length === 0 ? "loaded" : "not_loaded",
         label: AUTOSTART_LABEL,
         plist_path: plistPath,
+        interval_seconds: intervalSeconds,
+        work_dir: workDir,
+        work_dirs: resolvedWorkDirs,
+        dashboard_url: dashboardUrl,
+        ...(registrationProblems.length > 0
+            ? {
+                message: `launchd agent needs repair: ${registrationProblems.join("; ")}`,
+            }
+            : {}),
+    };
+}
+async function installWindowsTask(options) {
+    const homeDir = options.homeDir ?? os.homedir();
+    const workDirs = normalizeWindowsWorkDirs(options.repoRoots);
+    const workDir = path.win32.resolve(options.repoRoot ?? workDirs[0] ?? process.cwd());
+    const resolvedWorkDirs = workDirs.length > 0 ? workDirs : [workDir];
+    const dashboardUrl = options.dashboardUrl ?? DEFAULT_DASHBOARD_URL;
+    const intervalSeconds = options.intervalSeconds ?? DEFAULT_AUTOSTART_INTERVAL_SECONDS;
+    const intervalMinutes = Math.max(1, Math.ceil(intervalSeconds / 60));
+    const scriptPath = path.join(getCollectorRuntimePaths(homeDir).state_dir, WINDOWS_AUTOSTART_SCRIPT_NAME);
+    const registrationPath = path.join(getCollectorRuntimePaths(homeDir).state_dir, WINDOWS_AUTOSTART_REGISTRATION_SCRIPT_NAME);
+    const nodeExecutable = path.win32.resolve(options.nodeExecutable ?? process.execPath);
+    const cliEntryPoint = path.win32.resolve(options.cliEntryPoint ?? process.argv[1] ?? "");
+    await mkdir(path.dirname(scriptPath), { recursive: true });
+    await writeFile(scriptPath, `${UTF8_BOM}${renderWindowsSyncScript({
+        workDirs: resolvedWorkDirs,
+        dashboardUrl,
+        nodeExecutable,
+        cliEntryPoint,
+    })}`, "utf8");
+    await writeFile(registrationPath, `${UTF8_BOM}${renderWindowsRegistrationScript({
+        taskName: WINDOWS_AUTOSTART_TASK_NAME,
+        scriptPath,
+        intervalMinutes,
+    })}`, "utf8");
+    const created = await options.exec("powershell.exe", [
+        "-NoProfile",
+        "-NonInteractive",
+        "-ExecutionPolicy",
+        "Bypass",
+        "-File",
+        registrationPath,
+    ]);
+    const verified = created.code === 0
+        ? await windowsTaskStatus({
+            ...options,
+            repoRoot: workDir,
+            repoRoots: resolvedWorkDirs,
+            dashboardUrl,
+            intervalSeconds: intervalMinutes * 60,
+            nodeExecutable,
+            cliEntryPoint,
+        })
+        : null;
+    const loaded = verified?.status === "loaded";
+    return {
+        status: "installed",
+        label: AUTOSTART_LABEL,
+        plist_path: scriptPath,
+        task_name: WINDOWS_AUTOSTART_TASK_NAME,
+        registration_path: registrationPath,
+        loaded,
+        interval_seconds: intervalMinutes * 60,
+        work_dir: workDir,
+        work_dirs: resolvedWorkDirs,
+        dashboard_url: dashboardUrl,
+        ...(loaded
+            ? {}
+            : {
+                message: created.code === 0
+                    ? verified?.message ??
+                        "Windows task registration could not be verified"
+                    : `PowerShell task registration exited ${created.code}: ${created.stderr.trim() ||
+                        created.stdout.trim() ||
+                        "unknown error"}`,
+            }),
+    };
+}
+async function uninstallWindowsTask(options) {
+    const scriptPath = windowsAutostartScriptPath(options.homeDir);
+    const registrationPath = windowsAutostartRegistrationScriptPath(options.homeDir);
+    const current = await windowsTaskStatus(options);
+    if (current.status === "absent") {
+        await rm(scriptPath, { force: true });
+        await rm(registrationPath, { force: true });
+        return {
+            ...current,
+            plist_path: scriptPath,
+            registration_path: registrationPath,
+        };
+    }
+    const removed = await options.exec("schtasks.exe", [
+        "/Delete",
+        "/TN",
+        WINDOWS_AUTOSTART_TASK_NAME,
+        "/F",
+    ]);
+    if (removed.code === 0) {
+        await rm(scriptPath, { force: true });
+        await rm(registrationPath, { force: true });
+    }
+    return {
+        status: removed.code === 0 ? "uninstalled" : "not_loaded",
+        label: AUTOSTART_LABEL,
+        plist_path: scriptPath,
+        task_name: WINDOWS_AUTOSTART_TASK_NAME,
+        registration_path: registrationPath,
+        ...(removed.code === 0
+            ? {}
+            : {
+                message: `schtasks /Delete exited ${removed.code}: ${removed.stderr.trim() || removed.stdout.trim() || "unknown error"}`,
+            }),
     };
 }
+async function windowsTaskStatus(options) {
+    const scriptPath = windowsAutostartScriptPath(options.homeDir);
+    const query = await options.exec("schtasks.exe", [
+        "/Query",
+        "/TN",
+        WINDOWS_AUTOSTART_TASK_NAME,
+        "/XML",
+    ]);
+    if (query.code !== 0) {
+        const queryMessage = `${query.stderr}\n${query.stdout}`;
+        const taskIsKnownAbsent = query.code === 1 &&
+            /cannot find|not found|does not exist/iu.test(queryMessage);
+        return {
+            status: taskIsKnownAbsent ? "absent" : "not_loaded",
+            label: AUTOSTART_LABEL,
+            plist_path: scriptPath,
+            task_name: WINDOWS_AUTOSTART_TASK_NAME,
+            message: query.stderr.trim() || query.stdout.trim() || undefined,
+        };
+    }
+    const disabled = /<Enabled>\s*false\s*<\/Enabled>/iu.test(query.stdout);
+    const intervalSeconds = options.intervalSeconds ?? DEFAULT_AUTOSTART_INTERVAL_SECONDS;
+    const intervalMinutes = Math.max(1, Math.ceil(intervalSeconds / 60));
+    const registrationProblems = windowsTaskRegistrationProblems(query.stdout, {
+        scriptPath,
+        intervalMinutes,
+        powershellPath: windowsPowerShellPath(),
+    });
+    if (disabled)
+        registrationProblems.unshift("task is disabled");
+    const scriptExists = await fileExists(scriptPath);
+    if (!scriptExists) {
+        registrationProblems.push("sync script is missing");
+    }
+    else if (options.repoRoots && options.repoRoots.length > 0) {
+        const expectedScript = `${UTF8_BOM}${renderWindowsSyncScript({
+            workDirs: normalizeWindowsWorkDirs(options.repoRoots),
+            dashboardUrl: options.dashboardUrl ?? DEFAULT_DASHBOARD_URL,
+            nodeExecutable: path.win32.resolve(options.nodeExecutable ?? process.execPath),
+            cliEntryPoint: path.win32.resolve(options.cliEntryPoint ?? process.argv[1] ?? ""),
+        })}`;
+        const currentScript = await readFile(scriptPath, "utf8").catch(() => null);
+        if (currentScript !== expectedScript) {
+            registrationProblems.push("sync script does not match the current roots or Cockpit runtime");
+        }
+    }
+    return {
+        status: registrationProblems.length > 0 ? "not_loaded" : "loaded",
+        label: AUTOSTART_LABEL,
+        plist_path: scriptPath,
+        task_name: WINDOWS_AUTOSTART_TASK_NAME,
+        ...(registrationProblems.length > 0
+            ? {
+                message: `Windows task needs repair: ${registrationProblems.join("; ")}`,
+            }
+            : {}),
+    };
+}
+function windowsAutostartScriptPath(homeDir) {
+    return path.join(getCollectorRuntimePaths(homeDir ?? os.homedir()).state_dir, WINDOWS_AUTOSTART_SCRIPT_NAME);
+}
+function windowsAutostartRegistrationScriptPath(homeDir) {
+    return path.join(getCollectorRuntimePaths(homeDir ?? os.homedir()).state_dir, WINDOWS_AUTOSTART_REGISTRATION_SCRIPT_NAME);
+}
+function renderWindowsRegistrationScript(options) {
+    return [
+        "$ErrorActionPreference = 'Stop'",
+        `$taskName = ${powershellLiteral(options.taskName)}`,
+        `$syncScriptPath = ${powershellLiteral(options.scriptPath)}`,
+        "$powershellPath = Join-Path $PSHOME 'powershell.exe'",
+        "$actionArgs = '-NoProfile -NonInteractive -ExecutionPolicy Bypass -File \"' + $syncScriptPath + '\"'",
+        "$taskCommand = '\"' + $powershellPath + '\" ' + $actionArgs",
+        `& schtasks.exe /Create /TN $taskName /TR $taskCommand /SC MINUTE /MO ${options.intervalMinutes} /IT /RL LIMITED /F | Out-Null`,
+        "if ($LASTEXITCODE -ne 0) { throw \"schtasks /Create exited $LASTEXITCODE\" }",
+        "$settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -MultipleInstances IgnoreNew",
+        "Set-ScheduledTask -TaskName $taskName -Settings $settings | Out-Null",
+        "",
+    ].join("\r\n");
+}
+function renderWindowsSyncScript(options) {
+    const dashboardArgs = options.dashboardUrl === DEFAULT_DASHBOARD_URL
+        ? ""
+        : ` --dashboard-url ${powershellLiteral(options.dashboardUrl)}`;
+    const commands = options.workDirs.flatMap((root) => [
+        "try {",
+        `  & $nodeExecutable $cliEntryPoint sync --workspace ${powershellLiteral(root)}${dashboardArgs} --json`,
+        "  if ($LASTEXITCODE -ne 0) { $exitCode = $LASTEXITCODE }",
+        "} catch {",
+        "  [Console]::Error.WriteLine($_.Exception.Message)",
+        "  $exitCode = 1",
+        "}",
+    ]);
+    return [
+        "$ErrorActionPreference = 'Stop'",
+        "$exitCode = 0",
+        `$nodeExecutable = ${powershellLiteral(options.nodeExecutable)}`,
+        `$cliEntryPoint = ${powershellLiteral(options.cliEntryPoint)}`,
+        ...commands,
+        "exit $exitCode",
+        "",
+    ].join("\r\n");
+}
+function windowsTaskRegistrationProblems(taskXml, expected) {
+    const decodedXml = decodeXmlEntities(taskXml);
+    const expectedInterval = windowsTaskInterval(expected.intervalMinutes);
+    const principalsBody = decodedXml
+        .match(/<Principals(?:\s[^>]*)?>([\s\S]*?)<\/Principals>/iu)?.[1] ??
+        "";
+    const principalBlocks = [
+        ...principalsBody.matchAll(/<Principal(?:\s[^>]*)?>[\s\S]*?<\/Principal>/giu),
+    ].map((match) => match[0]);
+    const principalRemainder = principalsBody
+        .replace(/<Principal(?:\s[^>]*)?>[\s\S]*?<\/Principal>/giu, "")
+        .trim();
+    const exactPrincipalBlock = principalBlocks.length === 1 && principalRemainder === ""
+        ? (principalBlocks[0] ?? "")
+        : "";
+    const principalId = exactPrincipalBlock
+        .match(/<Principal\s[^>]*\bid\s*=\s*["']([^"']+)["'][^>]*>/iu)?.[1] ??
+        null;
+    const triggersBody = decodedXml.match(/<Triggers(?:\s[^>]*)?>([\s\S]*?)<\/Triggers>/iu)?.[1] ??
+        "";
+    const triggerBlocks = [
+        ...triggersBody.matchAll(/<(?:TimeTrigger)(?:\s[^>]*)?>[\s\S]*?<\/(?:TimeTrigger)>/giu),
+    ].map((match) => match[0]);
+    const triggerRemainder = triggersBody
+        .replace(/<(?:TimeTrigger)(?:\s[^>]*)?>[\s\S]*?<\/(?:TimeTrigger)>/giu, "")
+        .trim();
+    const exactTriggerBlock = triggerBlocks.length === 1 && triggerRemainder === ""
+        ? (triggerBlocks[0] ?? "")
+        : "";
+    const repetitionBlocks = exactTriggerBlock
+        ? [
+            ...exactTriggerBlock.matchAll(/<Repetition(?:\s[^>]*)?>[\s\S]*?<\/Repetition>/giu),
+        ].map((match) => match[0])
+        : [];
+    const repetition = repetitionBlocks.length === 1 ? repetitionBlocks[0] ?? "" : "";
+    const actionsBody = decodedXml.match(/<Actions(?:\s[^>]*)?>([\s\S]*?)<\/Actions>/iu)?.[1] ?? "";
+    const actionContext = decodedXml
+        .match(/<Actions\s[^>]*\bContext\s*=\s*["']([^"']+)["'][^>]*>/iu)?.[1] ??
+        null;
+    const execBlocks = [
+        ...actionsBody.matchAll(/<Exec(?:\s[^>]*)?>[\s\S]*?<\/Exec>/giu),
+    ].map((match) => match[0]);
+    const actionRemainder = actionsBody
+        .replace(/<Exec(?:\s[^>]*)?>[\s\S]*?<\/Exec>/giu, "")
+        .trim();
+    const exactExecBlock = execBlocks.length === 1 && actionRemainder === "" ? execBlocks[0] : "";
+    const command = exactExecBlock
+        ?.match(/<Command>\s*([^<]*?)\s*<\/Command>/iu)?.[1]
+        ?.trim() ??
+        "";
+    const actionArguments = exactExecBlock
+        .match(/<Arguments>\s*([^<]*?)\s*<\/Arguments>/iu)?.[1]
+        ?.trim() ?? "";
+    const expectedActionArguments = `-NoProfile -NonInteractive -ExecutionPolicy Bypass -File "${expected.scriptPath}"`;
+    const requirements = [
+        [
+            /<DisallowStartIfOnBatteries>\s*false\s*<\/DisallowStartIfOnBatteries>/iu,
+            "task is blocked on battery",
+        ],
+        [
+            /<StopIfGoingOnBatteries>\s*false\s*<\/StopIfGoingOnBatteries>/iu,
+            "task stops on battery",
+        ],
+        [
+            /<MultipleInstancesPolicy>\s*IgnoreNew\s*<\/MultipleInstancesPolicy>/iu,
+            "overlap policy is not IgnoreNew",
+        ],
+        [
+            /<StartWhenAvailable>\s*true\s*<\/StartWhenAvailable>/iu,
+            "missed-run recovery is disabled",
+        ],
+    ];
+    const problems = requirements
+        .filter(([pattern]) => !pattern.test(decodedXml))
+        .map(([, message]) => message);
+    if (!exactPrincipalBlock) {
+        problems.push("task must contain exactly one principal");
+    }
+    else {
+        if (!/<LogonType>\s*InteractiveToken\s*<\/LogonType>/iu.test(exactPrincipalBlock)) {
+            problems.push("logon type is not InteractiveToken");
+        }
+        if (!/<RunLevel>\s*LeastPrivilege\s*<\/RunLevel>/iu.test(exactPrincipalBlock)) {
+            problems.push("task does not run with limited privileges");
+        }
+    }
+    if (actionContext && actionContext !== principalId) {
+        problems.push("task action context does not match its principal");
+    }
+    if (!exactTriggerBlock) {
+        problems.push("task must contain exactly one TimeTrigger");
+    }
+    if (repetitionBlocks.length !== 1) {
+        problems.push("task must contain exactly one repetition schedule");
+    }
+    else if (!new RegExp(`<Interval>\\s*${escapeRegExp(expectedInterval)}\\s*</Interval>`, "iu").test(repetition)) {
+        problems.push(`repetition interval is not ${expectedInterval}`);
+    }
+    if (/<EndBoundary>/iu.test(exactTriggerBlock)) {
+        problems.push("task trigger has an end boundary");
+    }
+    const randomDelay = exactTriggerBlock
+        .match(/<RandomDelay>\s*([^<]+?)\s*<\/RandomDelay>/iu)?.[1]
+        ?.trim()
+        .toUpperCase() ?? null;
+    if (randomDelay &&
+        !["PT0S", "PT0M", "PT0H"].includes(randomDelay)) {
+        problems.push("task trigger has a nonzero random delay");
+    }
+    if (!exactExecBlock) {
+        problems.push("task must contain exactly one Exec action");
+    }
+    if (!sameWindowsPath(command, expected.powershellPath)) {
+        problems.push("task action does not run the expected Windows PowerShell");
+    }
+    if (actionArguments !== expectedActionArguments) {
+        problems.push("task action arguments do not exactly run the Cockpit sync script");
+    }
+    if (/<Duration>/iu.test(repetition)) {
+        problems.push("repetition has a finite duration");
+    }
+    return problems;
+}
+function windowsPowerShellPath(env = process.env) {
+    const windowsRoot = env.SystemRoot ?? env.WINDIR ?? "C:\\Windows";
+    return path.win32.join(windowsRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+}
+function sameWindowsPath(left, right) {
+    if (!left || !right)
+        return false;
+    return path.win32.resolve(left).toLowerCase() ===
+        path.win32.resolve(right).toLowerCase();
+}
+function powershellLiteral(value) {
+    return `'${value.replace(/'/gu, "''")}'`;
+}
+function windowsTaskInterval(minutes) {
+    const hours = Math.floor(minutes / 60);
+    const remainingMinutes = minutes % 60;
+    return `PT${hours > 0 ? `${hours}H` : ""}${remainingMinutes > 0 ? `${remainingMinutes}M` : ""}`;
+}
+function decodeXmlEntities(value) {
+    return value
+        .replace(/&quot;/giu, '"')
+        .replace(/&apos;/giu, "'")
+        .replace(/&lt;/giu, "<")
+        .replace(/&gt;/giu, ">")
+        .replace(/&amp;/giu, "&");
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+}
 /**
  * The transcript directories whose changes should re-trigger a sync, in the
  * order they appear in WatchPaths. Resolved from the same homeDir as the plist
@@ -130,15 +526,13 @@ async function existingWatchPaths(homeDir) {
     return candidates.filter((_, i) => present[i]);
 }
 function renderPlist(options) {
-    // The work path is shell-quoted because it lands inside a `/bin/zsh -lc "…"`
-    // command string; the whole command is then XML-escaped for the <string>.
-    const dashboardArg = options.dashboardUrl === DEFAULT_DASHBOARD_URL
-        ? ""
-        : ` --dashboard-url ${shellQuote(options.dashboardUrl)}`;
     const roots = options.workDirs.length > 0 ? options.workDirs : [options.workDir];
-    const command = roots
-        .map((root) => `cockpit sync --workspace ${shellQuote(root)}${dashboardArg} --json`)
-        .join("; ");
+    const command = renderDarwinSyncCommand({
+        workDirs: roots,
+        dashboardUrl: options.dashboardUrl,
+        nodeExecutable: options.nodeExecutable,
+        cliEntryPoint: options.cliEntryPoint,
+    });
     return [
         '<?xml version="1.0" encoding="UTF-8"?>',
         '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
@@ -149,7 +543,7 @@ function renderPlist(options) {
         "  <key>ProgramArguments</key>",
         "  <array>",
         "    <string>/bin/zsh</string>",
-        "    <string>-lc</string>",
+        "    <string>-c</string>",
         `    <string>${xmlEscape(command)}</string>`,
         "  </array>",
         "  <key>StartInterval</key>",
@@ -162,11 +556,6 @@ function renderPlist(options) {
         // lock, and growing-transcript re-upload is damped — so cost stays bounded
         // and no extra debounce is needed.
         ...watchPathsBlock(options.watchPaths),
-        "  <key>EnvironmentVariables</key>",
-        "  <dict>",
-        "    <key>PATH</key>",
-        "    <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string>",
-        "  </dict>",
         "  <key>StandardOutPath</key>",
         `  <string>${xmlEscape(options.stdoutPath)}</string>`,
         "  <key>StandardErrorPath</key>",
@@ -176,6 +565,42 @@ function renderPlist(options) {
         "",
     ].join("\n");
 }
+function renderDarwinSyncCommand(options) {
+    const dashboardArg = options.dashboardUrl === DEFAULT_DASHBOARD_URL
+        ? ""
+        : ` --dashboard-url ${shellQuote(options.dashboardUrl)}`;
+    const commands = options.workDirs.map((root) => `${shellQuote(options.nodeExecutable)} ${shellQuote(options.cliEntryPoint)} sync --workspace ${shellQuote(root)}${dashboardArg} --json || exit_code=1`);
+    return ["exit_code=0", ...commands, 'exit "$exit_code"'].join("; ");
+}
+function darwinAgentRegistrationProblems(plist, expected) {
+    if (!plist)
+        return ["plist could not be read"];
+    const problems = [];
+    if (!plist.includes(`  <string>${xmlEscape(AUTOSTART_LABEL)}</string>`)) {
+        problems.push("label does not match");
+    }
+    if (!plist.includes(`  <integer>${expected.intervalSeconds}</integer>`)) {
+        problems.push(`cadence is not ${expected.intervalSeconds} seconds`);
+    }
+    const expectedCommand = renderDarwinSyncCommand({
+        workDirs: expected.workDirs,
+        dashboardUrl: expected.dashboardUrl,
+        nodeExecutable: expected.nodeExecutable,
+        cliEntryPoint: expected.cliEntryPoint,
+    });
+    const expectedProgramArguments = [
+        "  <key>ProgramArguments</key>",
+        "  <array>",
+        "    <string>/bin/zsh</string>",
+        "    <string>-c</string>",
+        `    <string>${xmlEscape(expectedCommand)}</string>`,
+        "  </array>",
+    ].join("\n");
+    if (!plist.includes(expectedProgramArguments)) {
+        problems.push("command does not match the current roots, dashboard URL, or Cockpit runtime");
+    }
+    return problems;
+}
 function normalizeWorkDirs(repoRoots) {
     if (!repoRoots)
         return [];
@@ -190,6 +615,21 @@ function normalizeWorkDirs(repoRoots) {
     }
     return normalized;
 }
+function normalizeWindowsWorkDirs(repoRoots) {
+    if (!repoRoots)
+        return [];
+    const seen = new Set();
+    const normalized = [];
+    for (const root of repoRoots) {
+        const resolved = path.win32.resolve(root);
+        const key = resolved.toLowerCase();
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        normalized.push(resolved);
+    }
+    return normalized;
+}
 /**
  * Renders the `<key>WatchPaths</key><array>…</array>` lines, or nothing when no
  * transcript dir exists yet (an empty array would tell launchd to watch