@lifeaitools/clauth 1.30.23 → 1.30.24

package/cli/commands/watchdog.js

@@ -1,209 +1,209 @@
-// cli/commands/watchdog.js
-// Manages the clauth watchdog Task Scheduler job on Windows.
-// clauth watchdog install   — register job (UAC elevation)
-// clauth watchdog uninstall — remove job (UAC elevation)
-// clauth watchdog status    — check if job is registered and running
-// clauth watchdog start     — start the job now without waiting for login
-
-import { execSync, spawnSync } from "child_process";
-import fs from "fs";
-import path from "path";
-import os from "os";
-import { fileURLToPath } from "url";
-import {
-  getRegistryPath,
-  getWatchdogStatuses,
-  readWatchdogEvents,
-  registerWatchdogManifest,
-  restartWatchdogService,
-} from "../watchdog-registry.js";
-
-const __dirname  = path.dirname(fileURLToPath(import.meta.url));
-const TASK_NAME  = "ClautWatchdog";
-const APPDATA    = process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming");
-const CLAUTH_DIR = path.join(APPDATA, "clauth");
-const DEST_PS1   = path.join(CLAUTH_DIR, "watchdog.ps1");
-const SOURCE_PS1 = path.join(__dirname, "..", "assets", "watchdog.ps1");
-const PS_EXE     = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe";
-
-function ensureWatchdogScript() {
-  fs.mkdirSync(CLAUTH_DIR, { recursive: true });
-  fs.copyFileSync(SOURCE_PS1, DEST_PS1);
-}
-
-function isElevated() {
-  try {
-    const result = execSync(`${PS_EXE} -NoProfile -Command "([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"`,
-      { stdio: "pipe", encoding: "utf8" });
-    return result.trim().toLowerCase() === "true";
-  } catch { return false; }
-}
-
-// Build the PowerShell registration command as a single string
-function buildRegisterCmd(ps1Path) {
-  const escaped = ps1Path.replace(/'/g, "''");
-  return [
-    `$action  = New-ScheduledTaskAction -Execute 'powershell.exe'`,
-    `  -Argument '-NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File \\"${escaped}\\"';`,
-    `$trigger  = New-ScheduledTaskTrigger -AtLogOn;`,
-    `$settings = New-ScheduledTaskSettingsSet -ExecutionTimeLimit 0 -RestartCount 3`,
-    `  -RestartInterval (New-TimeSpan -Minutes 1) -MultipleInstances IgnoreNew;`,
-    `Unregister-ScheduledTask -TaskName '${TASK_NAME}' -Confirm:$false -ErrorAction SilentlyContinue;`,
-    `Register-ScheduledTask -TaskName '${TASK_NAME}' -Action $action -Trigger $trigger`,
-    `  -Settings $settings -RunLevel Highest`,
-    `  -Description 'clauth daemon watchdog — restarts on port 52437 if not responding.';`,
-    `Write-Host 'Watchdog registered.'`,
-  ].join(" ");
-}
-
-function buildUnregisterCmd() {
-  return `Unregister-ScheduledTask -TaskName '${TASK_NAME}' -Confirm:$false -ErrorAction SilentlyContinue; Write-Host 'Watchdog removed.'`;
-}
-
-function runElevated(psCmd) {
-  // Wrap in Start-Process -Verb RunAs to trigger UAC dialog
-  const encoded = Buffer.from(psCmd, "utf16le").toString("base64");
-  const result = spawnSync(PS_EXE, [
-    "-NoProfile", "-Command",
-    `Start-Process -FilePath '${PS_EXE}' -Verb RunAs -Wait -ArgumentList '-NoProfile -ExecutionPolicy Bypass -EncodedCommand ${encoded}'`,
-  ], { stdio: "inherit", encoding: "utf8" });
-  return result.status === 0;
-}
-
-function runDirect(psCmd) {
-  const result = spawnSync(PS_EXE, [
-    "-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", psCmd,
-  ], { stdio: "inherit", encoding: "utf8" });
-  return result.status === 0;
-}
-
-function readScheduledTaskState() {
-  try {
-    const out = execSync(
-      `${PS_EXE} -NoProfile -Command "Get-ScheduledTask -TaskName '${TASK_NAME}' -ErrorAction SilentlyContinue | Select-Object -ExpandProperty State"`,
-      { encoding: "utf8", stdio: ["pipe","pipe","pipe"], timeout: 5000 }
-    ).trim();
-    if (out) return out;
-  } catch {}
-
-  try {
-    const out = execSync(`schtasks /Query /TN ${TASK_NAME} /FO LIST`, {
-      encoding: "utf8",
-      stdio: ["pipe","pipe","pipe"],
-      timeout: 5000,
-    });
-    const status = out.match(/^Status:\\s*(.+)$/mi)?.[1]?.trim();
-    return status || "Registered";
-  } catch {
-    return null;
-  }
-}
-
-export async function runWatchdog(action, opts = {}) {
-  if (action === "register") {
-    const manifestPath = opts.manifest || opts.args?.[0];
-    if (!manifestPath) {
-      console.log("Usage: clauth watchdog register <manifest.json>");
-      return;
-    }
-    const manifest = JSON.parse(fs.readFileSync(path.resolve(manifestPath), "utf8"));
-    const result = registerWatchdogManifest(manifest);
-    console.log(`Registered ${result.registered} watchdog service(s): ${result.services.join(", ")}`);
-    console.log(`Registry: ${getRegistryPath()}`);
-    return;
-  }
-
-  if (action === "list" || action === "services") {
-    const status = await getWatchdogStatuses();
-    console.log(JSON.stringify(status, null, 2));
-    return;
-  }
-
-  if (action === "events") {
-    const limit = opts.limit ? Number(opts.limit) : 100;
-    console.log(JSON.stringify(readWatchdogEvents(limit), null, 2));
-    return;
-  }
-
-  if (action === "restart") {
-    const serviceId = opts.service || opts.args?.[0];
-    if (!serviceId) {
-      console.log("Usage: clauth watchdog restart <service-id>");
-      return;
-    }
-    const result = restartWatchdogService(serviceId);
-    console.log(JSON.stringify(result, null, 2));
-    return;
-  }
-
-  if (os.platform() !== "win32") {
-    console.log("Watchdog auto-start is Windows-only. On Linux/macOS, use systemd or launchd.");
-    return;
-  }
-
-  if (action === "status" || !action) {
-    const state = readScheduledTaskState();
-    try {
-      if (state) {
-        console.log(`Watchdog task: ${TASK_NAME} — State: ${state}`);
-        console.log(`Script:        ${DEST_PS1}`);
-        console.log(`Log:           ${path.join(CLAUTH_DIR, "watchdog.log")}`);
-        const status = await getWatchdogStatuses();
-        console.log(`Services:      ${status.total} registered (${status.healthy} healthy, ${status.degraded} degraded, ${status.unreachable} unreachable)`);
-        console.log(`Registry:      ${getRegistryPath()}`);
-      } else {
-        console.log(`Watchdog task '${TASK_NAME}' is NOT registered.`);
-        console.log("Run: clauth watchdog install");
-      }
-    } catch {
-      console.log(`Watchdog task '${TASK_NAME}' is NOT registered.`);
-      console.log("Run: clauth watchdog install");
-    }
-    return;
-  }
-
-  if (action === "install") {
-    ensureWatchdogScript();
-    console.log(`\n  Installing clauth watchdog...`);
-    console.log(`  Script: ${DEST_PS1}`);
-    console.log(`  Task:   ${TASK_NAME} (runs at login)\n`);
-    console.log("  Windows will ask for administrator approval — please click Yes.\n");
-
-    const cmd = buildRegisterCmd(DEST_PS1);
-    const ok  = isElevated() ? runDirect(cmd) : runElevated(cmd);
-
-    if (ok) {
-      console.log("\n  Watchdog installed. Starting now...");
-      spawnSync(PS_EXE, [
-        "-NoProfile", "-Command", `Start-ScheduledTask -TaskName '${TASK_NAME}'`,
-      ], { stdio: "pipe" });
-      console.log("  Done. Watchdog is running.\n");
-    } else {
-      console.log("\n  Installation cancelled or failed.");
-      console.log(`  To install manually, run as Administrator:`);
-      console.log(`    clauth watchdog install\n`);
-    }
-    return;
-  }
-
-  if (action === "uninstall") {
-    console.log("\n  Removing clauth watchdog...");
-    console.log("  Windows will ask for administrator approval — please click Yes.\n");
-    const ok = isElevated() ? runDirect(buildUnregisterCmd()) : runElevated(buildUnregisterCmd());
-    if (ok) console.log("\n  Watchdog removed.\n");
-    else    console.log("\n  Removal cancelled or failed.\n");
-    return;
-  }
-
-  if (action === "start") {
-    console.log(`  Starting ${TASK_NAME}...`);
-    const r = spawnSync(PS_EXE, [
-      "-NoProfile", "-Command", `Start-ScheduledTask -TaskName '${TASK_NAME}'`,
-    ], { stdio: "inherit", encoding: "utf8" });
-    if (r.status === 0) console.log("  Watchdog started.");
-    else console.log("  Could not start — is it registered? Run: clauth watchdog install");
-    return;
-  }
-
-  console.log("Usage: clauth watchdog [install|uninstall|status|start|register|list|events|restart]");
-}
+// cli/commands/watchdog.js
+// Manages the clauth watchdog Task Scheduler job on Windows.
+// clauth watchdog install   — register job (UAC elevation)
+// clauth watchdog uninstall — remove job (UAC elevation)
+// clauth watchdog status    — check if job is registered and running
+// clauth watchdog start     — start the job now without waiting for login
+
+import { execSync, spawnSync } from "child_process";
+import fs from "fs";
+import path from "path";
+import os from "os";
+import { fileURLToPath } from "url";
+import {
+  getRegistryPath,
+  getWatchdogStatuses,
+  readWatchdogEvents,
+  registerWatchdogManifest,
+  restartWatchdogService,
+} from "../watchdog-registry.js";
+
+const __dirname  = path.dirname(fileURLToPath(import.meta.url));
+const TASK_NAME  = "ClautWatchdog";
+const APPDATA    = process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming");
+const CLAUTH_DIR = path.join(APPDATA, "clauth");
+const DEST_PS1   = path.join(CLAUTH_DIR, "watchdog.ps1");
+const SOURCE_PS1 = path.join(__dirname, "..", "assets", "watchdog.ps1");
+const PS_EXE     = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe";
+
+function ensureWatchdogScript() {
+  fs.mkdirSync(CLAUTH_DIR, { recursive: true });
+  fs.copyFileSync(SOURCE_PS1, DEST_PS1);
+}
+
+function isElevated() {
+  try {
+    const result = execSync(`${PS_EXE} -NoProfile -Command "([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"`,
+      { stdio: "pipe", encoding: "utf8" });
+    return result.trim().toLowerCase() === "true";
+  } catch { return false; }
+}
+
+// Build the PowerShell registration command as a single string
+function buildRegisterCmd(ps1Path) {
+  const escaped = ps1Path.replace(/'/g, "''");
+  return [
+    `$action  = New-ScheduledTaskAction -Execute 'powershell.exe'`,
+    `  -Argument '-NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File \\"${escaped}\\"';`,
+    `$trigger  = New-ScheduledTaskTrigger -AtLogOn;`,
+    `$settings = New-ScheduledTaskSettingsSet -ExecutionTimeLimit 0 -RestartCount 3`,
+    `  -RestartInterval (New-TimeSpan -Minutes 1) -MultipleInstances IgnoreNew;`,
+    `Unregister-ScheduledTask -TaskName '${TASK_NAME}' -Confirm:$false -ErrorAction SilentlyContinue;`,
+    `Register-ScheduledTask -TaskName '${TASK_NAME}' -Action $action -Trigger $trigger`,
+    `  -Settings $settings -RunLevel Highest`,
+    `  -Description 'clauth daemon watchdog — restarts on port 52437 if not responding.';`,
+    `Write-Host 'Watchdog registered.'`,
+  ].join(" ");
+}
+
+function buildUnregisterCmd() {
+  return `Unregister-ScheduledTask -TaskName '${TASK_NAME}' -Confirm:$false -ErrorAction SilentlyContinue; Write-Host 'Watchdog removed.'`;
+}
+
+function runElevated(psCmd) {
+  // Wrap in Start-Process -Verb RunAs to trigger UAC dialog
+  const encoded = Buffer.from(psCmd, "utf16le").toString("base64");
+  const result = spawnSync(PS_EXE, [
+    "-NoProfile", "-Command",
+    `Start-Process -FilePath '${PS_EXE}' -Verb RunAs -Wait -ArgumentList '-NoProfile -ExecutionPolicy Bypass -EncodedCommand ${encoded}'`,
+  ], { stdio: "inherit", encoding: "utf8" });
+  return result.status === 0;
+}
+
+function runDirect(psCmd) {
+  const result = spawnSync(PS_EXE, [
+    "-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", psCmd,
+  ], { stdio: "inherit", encoding: "utf8" });
+  return result.status === 0;
+}
+
+function readScheduledTaskState() {
+  try {
+    const out = execSync(
+      `${PS_EXE} -NoProfile -Command "Get-ScheduledTask -TaskName '${TASK_NAME}' -ErrorAction SilentlyContinue | Select-Object -ExpandProperty State"`,
+      { encoding: "utf8", stdio: ["pipe","pipe","pipe"], timeout: 5000 }
+    ).trim();
+    if (out) return out;
+  } catch {}
+
+  try {
+    const out = execSync(`schtasks /Query /TN ${TASK_NAME} /FO LIST`, {
+      encoding: "utf8",
+      stdio: ["pipe","pipe","pipe"],
+      timeout: 5000,
+    });
+    const status = out.match(/^Status:\\s*(.+)$/mi)?.[1]?.trim();
+    return status || "Registered";
+  } catch {
+    return null;
+  }
+}
+
+export async function runWatchdog(action, opts = {}) {
+  if (action === "register") {
+    const manifestPath = opts.manifest || opts.args?.[0];
+    if (!manifestPath) {
+      console.log("Usage: clauth watchdog register <manifest.json>");
+      return;
+    }
+    const manifest = JSON.parse(fs.readFileSync(path.resolve(manifestPath), "utf8"));
+    const result = registerWatchdogManifest(manifest);
+    console.log(`Registered ${result.registered} watchdog service(s): ${result.services.join(", ")}`);
+    console.log(`Registry: ${getRegistryPath()}`);
+    return;
+  }
+
+  if (action === "list" || action === "services") {
+    const status = await getWatchdogStatuses();
+    console.log(JSON.stringify(status, null, 2));
+    return;
+  }
+
+  if (action === "events") {
+    const limit = opts.limit ? Number(opts.limit) : 100;
+    console.log(JSON.stringify(readWatchdogEvents(limit), null, 2));
+    return;
+  }
+
+  if (action === "restart") {
+    const serviceId = opts.service || opts.args?.[0];
+    if (!serviceId) {
+      console.log("Usage: clauth watchdog restart <service-id>");
+      return;
+    }
+    const result = restartWatchdogService(serviceId);
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+
+  if (os.platform() !== "win32") {
+    console.log("Watchdog auto-start is Windows-only. On Linux/macOS, use systemd or launchd.");
+    return;
+  }
+
+  if (action === "status" || !action) {
+    const state = readScheduledTaskState();
+    try {
+      if (state) {
+        console.log(`Watchdog task: ${TASK_NAME} — State: ${state}`);
+        console.log(`Script:        ${DEST_PS1}`);
+        console.log(`Log:           ${path.join(CLAUTH_DIR, "watchdog.log")}`);
+        const status = await getWatchdogStatuses();
+        console.log(`Services:      ${status.total} registered (${status.healthy} healthy, ${status.degraded} degraded, ${status.unreachable} unreachable)`);
+        console.log(`Registry:      ${getRegistryPath()}`);
+      } else {
+        console.log(`Watchdog task '${TASK_NAME}' is NOT registered.`);
+        console.log("Run: clauth watchdog install");
+      }
+    } catch {
+      console.log(`Watchdog task '${TASK_NAME}' is NOT registered.`);
+      console.log("Run: clauth watchdog install");
+    }
+    return;
+  }
+
+  if (action === "install") {
+    ensureWatchdogScript();
+    console.log(`\n  Installing clauth watchdog...`);
+    console.log(`  Script: ${DEST_PS1}`);
+    console.log(`  Task:   ${TASK_NAME} (runs at login)\n`);
+    console.log("  Windows will ask for administrator approval — please click Yes.\n");
+
+    const cmd = buildRegisterCmd(DEST_PS1);
+    const ok  = isElevated() ? runDirect(cmd) : runElevated(cmd);
+
+    if (ok) {
+      console.log("\n  Watchdog installed. Starting now...");
+      spawnSync(PS_EXE, [
+        "-NoProfile", "-Command", `Start-ScheduledTask -TaskName '${TASK_NAME}'`,
+      ], { stdio: "pipe" });
+      console.log("  Done. Watchdog is running.\n");
+    } else {
+      console.log("\n  Installation cancelled or failed.");
+      console.log(`  To install manually, run as Administrator:`);
+      console.log(`    clauth watchdog install\n`);
+    }
+    return;
+  }
+
+  if (action === "uninstall") {
+    console.log("\n  Removing clauth watchdog...");
+    console.log("  Windows will ask for administrator approval — please click Yes.\n");
+    const ok = isElevated() ? runDirect(buildUnregisterCmd()) : runElevated(buildUnregisterCmd());
+    if (ok) console.log("\n  Watchdog removed.\n");
+    else    console.log("\n  Removal cancelled or failed.\n");
+    return;
+  }
+
+  if (action === "start") {
+    console.log(`  Starting ${TASK_NAME}...`);
+    const r = spawnSync(PS_EXE, [
+      "-NoProfile", "-Command", `Start-ScheduledTask -TaskName '${TASK_NAME}'`,
+    ], { stdio: "inherit", encoding: "utf8" });
+    if (r.status === 0) console.log("  Watchdog started.");
+    else console.log("  Could not start — is it registered? Run: clauth watchdog install");
+    return;
+  }
+
+  console.log("Usage: clauth watchdog [install|uninstall|status|start|register|list|events|restart]");
+}

package/cli/conf-path.js

@@ -1,21 +1,21 @@
-// conf-path.js
-// Returns Conf options that always resolve to the real system AppData on Windows.
-//
-// Problem: When clauth runs inside an Electron app (e.g. Claude Desktop), %APPDATA%
-// is sandboxed to a package-specific path. The daemon runs as a plain system process
-// using the real %APPDATA%, so the two processes write/read different config files.
-//
-// Fix: On Windows, always build the path from %USERPROFILE% which is never sandboxed.
-// On Mac/Linux Conf's default behavior is correct.
-
-import os from "os";
-import path from "path";
-
-export function getConfOptions() {
-  if (process.platform === "win32") {
-    const userProfile = process.env.USERPROFILE || os.homedir();
-    const cwd = path.join(userProfile, "AppData", "Roaming", "clauth-nodejs", "Config");
-    return { projectName: "clauth", cwd };
-  }
-  return { projectName: "clauth" };
-}
+// conf-path.js
+// Returns Conf options that always resolve to the real system AppData on Windows.
+//
+// Problem: When clauth runs inside an Electron app (e.g. Claude Desktop), %APPDATA%
+// is sandboxed to a package-specific path. The daemon runs as a plain system process
+// using the real %APPDATA%, so the two processes write/read different config files.
+//
+// Fix: On Windows, always build the path from %USERPROFILE% which is never sandboxed.
+// On Mac/Linux Conf's default behavior is correct.
+
+import os from "os";
+import path from "path";
+
+export function getConfOptions() {
+  if (process.platform === "win32") {
+    const userProfile = process.env.USERPROFILE || os.homedir();
+    const cwd = path.join(userProfile, "AppData", "Roaming", "clauth-nodejs", "Config");
+    return { projectName: "clauth", cwd };
+  }
+  return { projectName: "clauth" };
+}

package/cli/enrollment-script.js

@@ -1,82 +1,82 @@
-import fs from "fs";
-import os from "os";
-import path from "path";
-
-function shellSingleQuote(value) {
-  return `'${String(value ?? "").replace(/'/g, "''")}'`;
-}
-
-function posixShellQuote(value) {
-  return `'${String(value ?? "").replace(/'/g, "'\\\"'\\\"'")}'`;
-}
-
-export function enrollmentScriptName(label, target = "windows") {
-  const slug = String(label || "new-computer")
-    .toLowerCase()
-    .replace(/[^a-z0-9]+/g, "-")
-    .replace(/^-+|-+$/g, "")
-    .slice(0, 40) || "new-computer";
-  return `clauth-enroll-${slug}${target === "linux" ? ".sh" : ".ps1"}`;
-}
-
-function windowsScript({ supabaseUrl, anonKey, enrollmentCode }) {
-  return [
-    "$ErrorActionPreference = 'Stop'",
-    "$label = $env:COMPUTERNAME",
-    "if (-not $label) { $label = [System.Net.Dns]::GetHostName() }",
-    "npm install -g @lifeaitools/clauth@latest",
-    ["clauth setup", `--supabase-url ${shellSingleQuote(supabaseUrl)}`, `--anon-key ${shellSingleQuote(anonKey)}`, `--enrollment-code ${shellSingleQuote(enrollmentCode)}`, "--label \"$label\""].join(" "),
-    "clauth serve install",
-    "$self = $PSCommandPath",
-    "Start-Process powershell.exe -WindowStyle Hidden -ArgumentList @('-NoProfile','-Command',\"Start-Sleep -Seconds 2; & ('Remove' + '-Item') -LiteralPath '$self' -Force -ErrorAction SilentlyContinue\")",
-  ].join("\r\n");
-}
-
-function linuxScript({ supabaseUrl, anonKey, enrollmentCode }) {
-  return [
-    "#!/usr/bin/env sh",
-    "set -eu",
-    "label=$(hostname)",
-    "as_root() { if [ \"$(id -u)\" -eq 0 ]; then \"$@\"; elif command -v sudo >/dev/null; then sudo \"$@\"; else echo 'Root or sudo is required to install prerequisites.' >&2; exit 1; fi; }",
-    "install_prerequisites() {",
-    "  if command -v apt-get >/dev/null; then as_root apt-get update; as_root apt-get install -y nodejs npm openssl;",
-    "  elif command -v dnf >/dev/null; then as_root dnf install -y nodejs npm openssl;",
-    "  else echo 'Headless enrollment supports systemd hosts with apt-get or dnf. Install Node.js 18+, npm, and openssl, then rerun this script.' >&2; exit 1; fi",
-    "}",
-    "if ! command -v systemctl >/dev/null || ! command -v loginctl >/dev/null; then echo 'Headless enrollment requires systemd and loginctl.' >&2; exit 1; fi",
-    "if ! command -v node >/dev/null || ! command -v npm >/dev/null || ! command -v openssl >/dev/null; then install_prerequisites; fi",
-    "node_major=$(node -p \"process.versions.node.split('.')[0]\")",
-    "if [ \"$node_major\" -lt 18 ]; then echo 'Node.js 18+ is required.' >&2; exit 1; fi",
-    "if ! npm install -g @lifeaitools/clauth@latest; then as_root npm install -g @lifeaitools/clauth@latest; fi",
-    ["clauth setup", `--supabase-url ${posixShellQuote(supabaseUrl)}`, `--anon-key ${posixShellQuote(anonKey)}`, `--enrollment-code ${posixShellQuote(enrollmentCode)}`, '--label "$label"'].join(" "),
-    "user_name=$(id -un)",
-    "if loginctl enable-linger \"$user_name\"; then echo \"Linger enabled for $user_name.\"; elif as_root loginctl enable-linger \"$user_name\"; then echo \"Linger enabled for $user_name.\"; else echo 'Could not enable linger for unattended restart.' >&2; exit 1; fi",
-    "if ! test -t 0; then echo 'Headless enrollment requires an interactive TTY to set the vault password.' >&2; exit 1; fi",
-    "restore_echo() { stty echo 2>/dev/null || true; }",
-    "trap restore_echo EXIT HUP INT TERM",
-    "printf 'Re-enter the vault password to enable unattended restart: ' >&2",
-    "stty -echo",
-    "IFS= read -r vault_password",
-    "stty echo",
-    "trap - EXIT HUP INT TERM",
-    "printf '\\n' >&2",
-    "[ -n \"$vault_password\" ] || { echo 'A vault password is required for unattended restart.' >&2; exit 1; }",
-    "printf %s \"$vault_password\" | clauth serve install --pw-stdin",
-    "unset vault_password",
-    "rm -f -- \"$0\"",
-  ].join("\n");
-}
-
-export function writeEnrollmentScript({ supabaseUrl, anonKey, enrollmentCode, label, target = "windows", appDir } = {}) {
-  if (!["windows", "linux"].includes(target)) throw new Error(`Unsupported enrollment target: ${target}`);
-  const outputDir = appDir || (process.platform === "win32"
-    ? path.join(process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming"), "clauth")
-    : path.join(os.homedir(), ".config", "clauth"));
-  fs.mkdirSync(outputDir, { recursive: true });
-  const scriptPath = path.join(outputDir, enrollmentScriptName(label, target));
-  const script = target === "linux"
-    ? linuxScript({ supabaseUrl, anonKey, enrollmentCode })
-    : windowsScript({ supabaseUrl, anonKey, enrollmentCode });
-  fs.writeFileSync(scriptPath, `${script}\n`, { encoding: "utf8", mode: target === "linux" ? 0o700 : undefined });
-  return scriptPath;
-}
+import fs from "fs";
+import os from "os";
+import path from "path";
+
+function shellSingleQuote(value) {
+  return `'${String(value ?? "").replace(/'/g, "''")}'`;
+}
+
+function posixShellQuote(value) {
+  return `'${String(value ?? "").replace(/'/g, "'\\\"'\\\"'")}'`;
+}
+
+export function enrollmentScriptName(label, target = "windows") {
+  const slug = String(label || "new-computer")
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, 40) || "new-computer";
+  return `clauth-enroll-${slug}${target === "linux" ? ".sh" : ".ps1"}`;
+}
+
+function windowsScript({ supabaseUrl, anonKey, enrollmentCode }) {
+  return [
+    "$ErrorActionPreference = 'Stop'",
+    "$label = $env:COMPUTERNAME",
+    "if (-not $label) { $label = [System.Net.Dns]::GetHostName() }",
+    "npm install -g @lifeaitools/clauth@latest",
+    ["clauth setup", `--supabase-url ${shellSingleQuote(supabaseUrl)}`, `--anon-key ${shellSingleQuote(anonKey)}`, `--enrollment-code ${shellSingleQuote(enrollmentCode)}`, "--label \"$label\""].join(" "),
+    "clauth serve install",
+    "$self = $PSCommandPath",
+    "Start-Process powershell.exe -WindowStyle Hidden -ArgumentList @('-NoProfile','-Command',\"Start-Sleep -Seconds 2; & ('Remove' + '-Item') -LiteralPath '$self' -Force -ErrorAction SilentlyContinue\")",
+  ].join("\r\n");
+}
+
+function linuxScript({ supabaseUrl, anonKey, enrollmentCode }) {
+  return [
+    "#!/usr/bin/env sh",
+    "set -eu",
+    "label=$(hostname)",
+    "as_root() { if [ \"$(id -u)\" -eq 0 ]; then \"$@\"; elif command -v sudo >/dev/null; then sudo \"$@\"; else echo 'Root or sudo is required to install prerequisites.' >&2; exit 1; fi; }",
+    "install_prerequisites() {",
+    "  if command -v apt-get >/dev/null; then as_root apt-get update; as_root apt-get install -y nodejs npm openssl;",
+    "  elif command -v dnf >/dev/null; then as_root dnf install -y nodejs npm openssl;",
+    "  else echo 'Headless enrollment supports systemd hosts with apt-get or dnf. Install Node.js 18+, npm, and openssl, then rerun this script.' >&2; exit 1; fi",
+    "}",
+    "if ! command -v systemctl >/dev/null || ! command -v loginctl >/dev/null; then echo 'Headless enrollment requires systemd and loginctl.' >&2; exit 1; fi",
+    "if ! command -v node >/dev/null || ! command -v npm >/dev/null || ! command -v openssl >/dev/null; then install_prerequisites; fi",
+    "node_major=$(node -p \"process.versions.node.split('.')[0]\")",
+    "if [ \"$node_major\" -lt 18 ]; then echo 'Node.js 18+ is required.' >&2; exit 1; fi",
+    "if ! npm install -g @lifeaitools/clauth@latest; then as_root npm install -g @lifeaitools/clauth@latest; fi",
+    ["clauth setup", `--supabase-url ${posixShellQuote(supabaseUrl)}`, `--anon-key ${posixShellQuote(anonKey)}`, `--enrollment-code ${posixShellQuote(enrollmentCode)}`, '--label "$label"'].join(" "),
+    "user_name=$(id -un)",
+    "if loginctl enable-linger \"$user_name\"; then echo \"Linger enabled for $user_name.\"; elif as_root loginctl enable-linger \"$user_name\"; then echo \"Linger enabled for $user_name.\"; else echo 'Could not enable linger for unattended restart.' >&2; exit 1; fi",
+    "if ! test -t 0; then echo 'Headless enrollment requires an interactive TTY to set the vault password.' >&2; exit 1; fi",
+    "restore_echo() { stty echo 2>/dev/null || true; }",
+    "trap restore_echo EXIT HUP INT TERM",
+    "printf 'Re-enter the vault password to enable unattended restart: ' >&2",
+    "stty -echo",
+    "IFS= read -r vault_password",
+    "stty echo",
+    "trap - EXIT HUP INT TERM",
+    "printf '\\n' >&2",
+    "[ -n \"$vault_password\" ] || { echo 'A vault password is required for unattended restart.' >&2; exit 1; }",
+    "printf %s \"$vault_password\" | clauth serve install --pw-stdin",
+    "unset vault_password",
+    "rm -f -- \"$0\"",
+  ].join("\n");
+}
+
+export function writeEnrollmentScript({ supabaseUrl, anonKey, enrollmentCode, label, target = "windows", appDir } = {}) {
+  if (!["windows", "linux"].includes(target)) throw new Error(`Unsupported enrollment target: ${target}`);
+  const outputDir = appDir || (process.platform === "win32"
+    ? path.join(process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming"), "clauth")
+    : path.join(os.homedir(), ".config", "clauth"));
+  fs.mkdirSync(outputDir, { recursive: true });
+  const scriptPath = path.join(outputDir, enrollmentScriptName(label, target));
+  const script = target === "linux"
+    ? linuxScript({ supabaseUrl, anonKey, enrollmentCode })
+    : windowsScript({ supabaseUrl, anonKey, enrollmentCode });
+  fs.writeFileSync(scriptPath, `${script}\n`, { encoding: "utf8", mode: target === "linux" ? 0o700 : undefined });
+  return scriptPath;
+}