aidevops 3.5.892 → 3.8.2

package/setup-modules/agent-runtime.sh

@@ -0,0 +1,251 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MIT
+# SPDX-FileCopyrightText: 2025-2026 Marcus Quinn
+# Runtime agent deployment: convert and copy agents to each runtime's native directory.
+# Strips aidevops-only frontmatter (mode, subagents); keeps standard fields
+# (name, description, tools, model, permissionMode, hooks, mcpServers, etc.).
+# Split from agent-deploy.sh (t1940)
+
+# Shell safety baseline
+set -Eeuo pipefail
+IFS=$'\n\t'
+# shellcheck disable=SC2154  # rc is assigned by $? in the trap string
+trap 'rc=$?; echo "[ERROR] ${BASH_SOURCE[0]}:${LINENO} exit $rc" >&2' ERR
+shopt -s inherit_errexit 2>/dev/null || true
+
+# _convert_agent_frontmatter: strips aidevops-only fields from agent markdown.
+# Reads from stdin, writes converted content to stdout.
+# Tracks whether we're inside an indented block (subagents list) to correctly
+# skip its child lines without stripping other indented YAML fields.
+_convert_agent_frontmatter() {
+	local in_frontmatter=false
+	local frontmatter_started=false
+	local in_skip_block=false
+	local line_num=0
+
+	while IFS= read -r line || [[ -n "$line" ]]; do
+		line_num=$((line_num + 1))
+		if [[ $line_num -eq 1 && "$line" == "---" ]]; then
+			in_frontmatter=true
+			frontmatter_started=true
+			echo "$line"
+			continue
+		fi
+		if [[ "$frontmatter_started" == "true" && "$in_frontmatter" == "true" && "$line" == "---" ]]; then
+			in_frontmatter=false
+			echo "$line"
+			continue
+		fi
+		if [[ "$in_frontmatter" == "true" ]]; then
+			# Detect top-level keys (no leading whitespace)
+			case "$line" in
+			mode:*)
+				in_skip_block=false
+				continue
+				;;
+			subagents:*)
+				in_skip_block=true
+				continue
+				;;
+			esac
+			# If inside a skipped block, consume indented continuation lines
+			if [[ "$in_skip_block" == "true" ]]; then
+				case "$line" in
+				[[:space:]]*)
+					# Indented line under a skipped key — skip it
+					continue
+					;;
+				*)
+					# Non-indented line — we've left the skip block
+					in_skip_block=false
+					echo "$line"
+					;;
+				esac
+			else
+				echo "$line"
+			fi
+		else
+			echo "$line"
+		fi
+	done
+	return 0
+}
+
+# _is_agent_definition: check if a markdown file has agent frontmatter (name: field).
+# Returns 0 if the file is an agent definition, 1 otherwise.
+_is_agent_definition() {
+	local file="$1"
+	# Check first 30 lines for name: in YAML frontmatter (fast path)
+	head -30 "$file" 2>/dev/null | grep -q '^name:' 2>/dev/null
+	return $?
+}
+
+# _agent_source_dirs: list directories under agents_source that contain subagents.
+# Excludes framework infrastructure directories that are not agent definitions.
+_agent_source_dirs() {
+	local agents_source="$1"
+	local dir
+	for dir in "$agents_source"/*/; do
+		[[ -d "$dir" ]] || continue
+		local dirname
+		dirname=$(basename "$dir")
+		# Skip framework infrastructure directories
+		case "$dirname" in
+		scripts | reference | prompts | templates | configs | hooks | \
+			plugins | bundles | loop-state | advisories | aidevops | \
+			custom | draft | tests | rules)
+			continue
+			;;
+		*)
+			echo "$dir"
+			;;
+		esac
+	done
+	return 0
+}
+
+# _collect_agent_files: print "abspath|relpath" lines for all deployable agent files
+# under agents_source. Excludes AGENTS.md, SKILL.md stubs, and non-agent markdown.
+_collect_agent_files() {
+	local agents_source="$1"
+	local f bn
+
+	# Top-level agents
+	for f in "$agents_source"/*.md; do
+		[[ -f "$f" ]] || continue
+		bn=$(basename "$f")
+		[[ "$bn" == "AGENTS.md" ]] && continue
+		if _is_agent_definition "$f"; then
+			printf '%s|%s\n' "$f" "$bn"
+		fi
+	done
+
+	# Subagent directories (recursive)
+	local subdir
+	while IFS= read -r subdir; do
+		while IFS= read -r f; do
+			[[ -f "$f" ]] || continue
+			bn=$(basename "$f")
+			# Skip SKILL.md stubs — they're directory indexes, not real agents
+			[[ "$bn" == "SKILL.md" ]] && continue
+			if _is_agent_definition "$f"; then
+				local relpath="${f#"$agents_source"/}"
+				printf '%s|%s\n' "$f" "$relpath"
+			fi
+		done < <(find "$subdir" -name '*.md' -type f 2>/dev/null)
+	done < <(_agent_source_dirs "$agents_source")
+	return 0
+}
+
+# _deploy_agents_to_single_runtime: convert and copy all agent files to one runtime.
+# Arguments: runtime_id agent_dir agent_list_file
+# agent_list_file contains "abspath|relpath" lines produced by _collect_agent_files.
+# Prints the count of successfully deployed agents to stdout.
+_deploy_agents_to_single_runtime() {
+	local runtime_id="$1"
+	local agent_dir="$2"
+	local agent_list_file="$3"
+
+	# Only deploy if the runtime is actually installed
+	local binary config_path config_dir
+	binary=$(rt_binary "$runtime_id")
+	config_path=$(rt_config_path "$runtime_id")
+	config_dir="$(dirname "$config_path" 2>/dev/null)"
+
+	if ! type -P "$binary" >/dev/null 2>&1 && [[ ! -d "$config_dir" ]]; then
+		echo "0"
+		return 0
+	fi
+
+	mkdir -p "$agent_dir"
+	local agent_count=0
+	local src rel target target_parent
+
+	while IFS='|' read -r src rel; do
+		[[ -n "$src" && -n "$rel" ]] || continue
+		target="$agent_dir/$rel"
+		target_parent=$(dirname "$target")
+		[[ -d "$target_parent" ]] || mkdir -p "$target_parent"
+		if _convert_agent_frontmatter <"$src" >"$target"; then
+			agent_count=$((agent_count + 1))
+		fi
+	done <"$agent_list_file"
+
+	echo "$agent_count"
+	return 0
+}
+
+# deploy_agents_to_runtimes: main entry point called by setup.sh.
+# Iterates all installed runtimes with agent directory support, converts and
+# deploys aidevops agents to each runtime's native agent directory.
+# Only files with name: frontmatter are deployed. SKILL.md stubs are excluded.
+deploy_agents_to_runtimes() {
+	# Source runtime registry if not already loaded
+	local registry_script="${INSTALL_DIR:-.}/.agents/scripts/runtime-registry.sh"
+	if [[ -z "${_RUNTIME_REGISTRY_LOADED:-}" ]]; then
+		if [[ -f "$registry_script" ]]; then
+			# shellcheck source=/dev/null
+			source "$registry_script"
+		else
+			print_warning "Runtime registry not found — skipping agent deployment to runtimes"
+			return 0
+		fi
+	fi
+
+	local agents_source="${HOME}/.aidevops/agents"
+	if [[ ! -d "$agents_source" ]]; then
+		print_warning "No deployed agents found at $agents_source — skipping"
+		return 0
+	fi
+
+	# Build the agent file list once (shared across all runtimes) into a temp file.
+	# Each line: "abspath|relpath"
+	local agent_list_file
+	agent_list_file=$(mktemp)
+	trap 'rm -f "${agent_list_file:-}"' RETURN
+	_collect_agent_files "$agents_source" >"$agent_list_file"
+
+	local total_agents
+	total_agents=$(wc -l <"$agent_list_file" | tr -d ' ')
+	if [[ "$total_agents" -eq 0 ]]; then
+		print_warning "No agent definitions found in $agents_source"
+		return 0
+	fi
+
+	local deployed_count=0
+	local runtime_count=0
+
+	local runtime_id agent_dir agent_count display_name feature_flag
+	while IFS= read -r runtime_id; do
+		agent_dir=$(rt_agent_dir "$runtime_id")
+		[[ -z "$agent_dir" ]] && continue
+
+		# Feature flag gate — allow users to disable agent installation per
+		# runtime via AIDEVOPS_FEATURE_AGENTS_<SUFFIX>=no (see runtime-registry).
+		if declare -F rt_feature_agents >/dev/null 2>&1; then
+			feature_flag=$(rt_feature_agents "$runtime_id" 2>/dev/null || echo "yes")
+			if [[ "$feature_flag" != "yes" ]]; then
+				display_name=$(rt_display_name "$runtime_id")
+				print_info "Agent installation disabled for $display_name (feature flag)"
+				continue
+			fi
+		fi
+
+		agent_count=$(_deploy_agents_to_single_runtime "$runtime_id" "$agent_dir" "$agent_list_file")
+		# A count of 0 means runtime not installed (skipped) — don't increment runtime_count
+		if [[ "$agent_count" -gt 0 ]]; then
+			display_name=$(rt_display_name "$runtime_id")
+			print_info "Deployed $agent_count agents to $display_name ($agent_dir)"
+			deployed_count=$((deployed_count + agent_count))
+			runtime_count=$((runtime_count + 1))
+		fi
+	done < <(rt_list_with_agents)
+
+	if [[ $runtime_count -eq 0 ]]; then
+		print_info "No runtimes with agent directory support detected — skipping"
+	else
+		print_success "Deployed $deployed_count agent(s) across $runtime_count runtime(s)"
+	fi
+
+	return 0
+}

package/setup-modules/config.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: MIT
+# SPDX-FileCopyrightText: 2025-2026 Marcus Quinn
 # Configuration functions: setup_configs, set_permissions, ssh, aidevops-cli, opencode-config, claude-config, validate, extract-prompts, drift-check
 # Part of aidevops setup.sh modularization (t316.3)
 
@@ -393,3 +395,84 @@ PYEOF
 	echo "  Done -- $mcp_count new MCP servers added to Cursor config"
 	return 0
 }
+
+# Deploy slash commands to every installed runtime that supports them.
+#
+# Background: update_opencode_config and update_claude_config already invoke
+# the unified generator (.agents/scripts/generate-runtime-config.sh) for
+# their runtimes. The other per-client update_*_config functions (Codex,
+# Cursor, Droid, etc.) were written before the unified generator existed
+# and only handle MCP registration. This function closes that gap by
+# invoking the generator for every other installed client.
+#
+# Gated on rt_feature_commands so users can disable command installation
+# per-runtime via AIDEVOPS_FEATURE_COMMANDS_<SUFFIX>=no. Clients with no
+# _RT_COMMAND_DIR (windsurf, amp, kilo, aider) are skipped automatically.
+#
+# Fixes GH#18106 / t15474.
+deploy_commands_to_all_runtimes() {
+	local registry_script="${INSTALL_DIR:-.}/.agents/scripts/runtime-registry.sh"
+	local generator_script="${INSTALL_DIR:-.}/.agents/scripts/generate-runtime-config.sh"
+
+	if [[ ! -f "$registry_script" ]]; then
+		print_info "Runtime registry not found — skipping unified command deployment"
+		return 0
+	fi
+	if [[ ! -x "$generator_script" ]]; then
+		print_info "Runtime config generator not executable — skipping unified command deployment"
+		return 0
+	fi
+
+	# Source registry if not already loaded
+	if [[ -z "${_RUNTIME_REGISTRY_LOADED:-}" ]]; then
+		# shellcheck source=/dev/null
+		source "$registry_script"
+	fi
+
+	local runtime_id cmd_dir feature_flag display_name
+	local deployed_count=0 skipped_count=0
+
+	while IFS= read -r runtime_id; do
+		# OpenCode and Claude Code are already handled by their dedicated
+		# update_*_config functions above — skip to avoid double-deploy
+		# and keep the log output clean.
+		case "$runtime_id" in
+		opencode | claude-code) continue ;;
+		esac
+
+		# Skip runtimes with no command directory in the registry (repo-only
+		# clients like Windsurf/Amp, and clients without native slash command
+		# support like Kilo/Aider).
+		cmd_dir=$(rt_command_dir "$runtime_id" 2>/dev/null || echo "")
+		[[ -z "$cmd_dir" ]] && continue
+
+		# Honour the rt_feature_commands flag.
+		feature_flag=$(rt_feature_commands "$runtime_id" 2>/dev/null || echo "yes")
+		if [[ "$feature_flag" != "yes" ]]; then
+			display_name=$(rt_display_name "$runtime_id" 2>/dev/null || echo "$runtime_id")
+			print_info "Commands installation disabled for $display_name (feature flag)"
+			skipped_count=$((skipped_count + 1))
+			continue
+		fi
+
+		# Invoke the unified generator — it prints its own success/failure.
+		# Redirect stdin from /dev/null so the generator cannot accidentally
+		# read from the `while read` loop's process-substitution pipe and
+		# steal the remaining runtime IDs — a classic bash pitfall.
+		if "$generator_script" commands --runtime "$runtime_id" </dev/null; then
+			deployed_count=$((deployed_count + 1))
+		else
+			display_name=$(rt_display_name "$runtime_id" 2>/dev/null || echo "$runtime_id")
+			print_warning "Failed to deploy commands for $display_name"
+		fi
+	done < <(rt_detect_installed 2>/dev/null)
+
+	if [[ $deployed_count -gt 0 ]]; then
+		print_success "Deployed slash commands to $deployed_count additional runtime(s)"
+	elif [[ $skipped_count -gt 0 ]]; then
+		print_info "All remaining runtimes had commands installation disabled via feature flags"
+	else
+		print_info "No additional runtimes needed command deployment"
+	fi
+	return 0
+}

package/setup-modules/core.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: MIT
+# SPDX-FileCopyrightText: 2025-2026 Marcus Quinn
 # Core setup functions: requirements, permissions, location
 # Part of aidevops setup.sh modularization (t316.3)
 

package/setup-modules/mcp-setup.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: MIT
+# SPDX-FileCopyrightText: 2025-2026 Marcus Quinn
 # MCP setup functions: install_mcp_packages, resolve_mcp_binary, localwp, augment, seo, analytics, quickfile, browser-tools, opencode-plugins
 # Part of aidevops setup.sh modularization (t316.3)
 

package/setup-modules/migrations.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: MIT
+# SPDX-FileCopyrightText: 2025-2026 Marcus Quinn
 # Migration functions: migrate_* and cleanup_* functions
 # Part of aidevops setup.sh modularization (t316.3)
 
@@ -275,8 +277,9 @@ cleanup_stale_bun_opencode() {
 	if [[ "$npm_opencode" -eq 0 ]]; then
 		# npm version not installed — install it first, then clean up bun
 		if command -v npm >/dev/null 2>&1; then
+			local pin_ver="${OPENCODE_PINNED_VERSION:-latest}"
 			print_info "Installing opencode via npm (replacing bun install)..."
-			npm_global_install "opencode-ai" >/dev/null 2>&1 || true
+			npm_global_install "opencode-ai@${pin_ver}" >/dev/null 2>&1 || true
 		else
 			# Can't install npm version — leave bun version in place
 			return 0
@@ -299,6 +302,83 @@ cleanup_stale_bun_opencode() {
 	return 0
 }
 
+# t1929: Remove stale contributor/legacy health issue cache files and close
+# the corresponding GitHub issues. One-time migration — the root cause
+# (API failure in _get_runner_role defaulting to "contributor") is fixed
+# by the 4-layer role resolution in stats-functions.sh.
+#
+# Gated by a flag file so it runs exactly once per install.
+cleanup_stale_health_issue_caches() {
+	local flag_file="${HOME}/.aidevops/logs/.migrated-health-issue-caches-t1929"
+	[[ -f "$flag_file" ]] && return 0
+
+	local cache_dir="${HOME}/.aidevops/logs"
+	[[ -d "$cache_dir" ]] || return 0
+
+	local cleaned=0
+
+	# 1. Remove contributor cache files (the duplicates).
+	#    The correct files are health-issue-{user}-supervisor-{slug}.
+	local contributor_cache
+	for contributor_cache in "${cache_dir}"/health-issue-*-contributor-*; do
+		[[ -f "$contributor_cache" ]] || continue
+		local stale_num
+		stale_num=$(cat "$contributor_cache" 2>/dev/null || echo "")
+		# Extract slug from filename: health-issue-{user}-contributor-{slug}
+		# Best-effort close via gh if available and authenticated
+		if [[ -n "$stale_num" ]] && command -v gh &>/dev/null && gh auth status &>/dev/null 2>&1; then
+			local fname
+			fname=$(basename "$contributor_cache")
+			local slug_safe="${fname##*-contributor-}"
+			local supervisor_cache="${cache_dir}/health-issue-${fname%-contributor-*}-supervisor-${slug_safe}"
+			# Only close if there IS a supervisor counterpart (confirms it's a duplicate)
+			if [[ -f "$supervisor_cache" ]]; then
+				# Resolve actual slug from repos.json — the slug-safe format
+				# (hyphens replacing /) is lossy for owners/repos containing hyphens.
+				local repos_json="${HOME}/.config/aidevops/repos.json"
+				local repo_slug=""
+				if [[ -f "$repos_json" ]]; then
+					repo_slug=$(jq -r --arg ss "$slug_safe" \
+						'.initialized_repos[] | select((.slug // "") | gsub("/"; "-") == $ss) | .slug' \
+						"$repos_json" 2>/dev/null | head -1)
+				fi
+				if [[ -n "$repo_slug" ]]; then
+					# Remove "persistent" label first — a GitHub Actions workflow
+					# auto-reopens issues with this label (health issues get it on creation).
+					gh issue edit "$stale_num" --repo "$repo_slug" \
+						--remove-label persistent 2>/dev/null || true
+					gh issue close "$stale_num" --repo "$repo_slug" \
+						--comment "Closing duplicate contributor health issue (t1929 migration)." 2>/dev/null || true
+				fi
+			fi
+		fi
+		rm -f "$contributor_cache"
+		cleaned=$((cleaned + 1))
+	done
+
+	# 2. Remove legacy cache files (no role prefix, pre-role-naming).
+	#    Pattern: health-issue-{user}-{slug} where {slug} has no "supervisor" or "contributor".
+	local legacy_cache
+	for legacy_cache in "${cache_dir}"/health-issue-*; do
+		[[ -f "$legacy_cache" ]] || continue
+		local fname
+		fname=$(basename "$legacy_cache")
+		# Skip files that already have a role prefix (they're the correct format)
+		[[ "$fname" == *-supervisor-* || "$fname" == *-contributor-* ]] && continue
+		rm -f "$legacy_cache"
+		cleaned=$((cleaned + 1))
+	done
+
+	# Write flag file
+	mkdir -p "$(dirname "$flag_file")"
+	date -u +"%Y-%m-%dT%H:%M:%SZ" >"$flag_file"
+
+	if [[ "$cleaned" -gt 0 ]]; then
+		print_info "Cleaned up $cleaned stale health issue cache file(s) (t1929)"
+	fi
+	return 0
+}
+
 # Migrate legacy .agent symlink/directory to .agents in a single repo.
 # Args: $1 = repo_path
 # Prints: info messages for each migration action
@@ -1234,3 +1314,189 @@ migrate_orphaned_supervisor() {
 
 	return 0
 }
+
+# Backfill GitHub issue relationships from TODO.md metadata (t1889)
+# One-time migration: reads blocked-by:/blocks: and subtask hierarchy from
+# TODO.md in each pulse-enabled repo, and sets the corresponding GitHub
+# issue relationships (blocked-by, sub-issues) via the GraphQL API.
+#
+# Uses marker file to ensure it runs only once per install.
+# Safe to re-run — the GraphQL mutations are idempotent (duplicates are skipped).
+backfill_issue_relationships() {
+	local marker_file="$HOME/.aidevops/.migrations/t1889-relationships-backfill"
+	local marker_dir
+	marker_dir=$(dirname "$marker_file")
+
+	# Skip if already done
+	if [[ -f "$marker_file" ]]; then
+		return 0
+	fi
+
+	# Require gh CLI and authentication
+	if ! command -v gh &>/dev/null; then
+		print_warning "gh CLI not installed — skipping issue relationships backfill"
+		return 0
+	fi
+	if ! gh auth status &>/dev/null 2>&1; then
+		print_warning "gh CLI not authenticated — skipping issue relationships backfill"
+		return 0
+	fi
+
+	# Require jq for repos.json parsing
+	if ! command -v jq &>/dev/null; then
+		print_warning "jq not installed — skipping issue relationships backfill"
+		return 0
+	fi
+
+	local repos_file="$HOME/.config/aidevops/repos.json"
+	if [[ ! -f "$repos_file" ]]; then
+		print_info "No repos.json — skipping issue relationships backfill"
+		mkdir -p "$marker_dir"
+		touch "$marker_file"
+		return 0
+	fi
+
+	local sync_script="$HOME/.aidevops/agents/scripts/issue-sync-helper.sh"
+	if [[ ! -x "$sync_script" ]]; then
+		print_warning "issue-sync-helper.sh not found — skipping relationships backfill"
+		return 0
+	fi
+
+	print_info "Backfilling GitHub issue relationships (blocked-by, sub-issues) from TODO.md..."
+
+	local total_repos=0 total_rels=0 failed_repos=0
+	local repo_path repo_slug local_only
+
+	while IFS=$'\t' read -r repo_path repo_slug local_only; do
+		[[ -z "$repo_path" ]] && continue
+		local expanded_path="${repo_path/#\~/$HOME}"
+
+		# Skip local-only repos (no GitHub remote)
+		[[ "$local_only" == "true" ]] && continue
+
+		# Skip repos without TODO.md
+		[[ ! -f "$expanded_path/TODO.md" ]] && continue
+
+		# Skip repos with no ref:GH# entries
+		if ! grep -qE 'ref:GH#[0-9]+' "$expanded_path/TODO.md" 2>/dev/null; then
+			continue
+		fi
+
+		# Skip repos with no blocked-by:/blocks: or subtask entries
+		local has_deps=false
+		grep -qE 'blocked-by:|blocks:' "$expanded_path/TODO.md" 2>/dev/null && has_deps=true
+		grep -qE '^\s+- \[.\] t[0-9]+\.[0-9]+.*ref:GH#' "$expanded_path/TODO.md" 2>/dev/null && has_deps=true
+		[[ "$has_deps" == "false" ]] && continue
+
+		total_repos=$((total_repos + 1))
+		local repo_arg=""
+		[[ -n "$repo_slug" ]] && repo_arg="--repo $repo_slug"
+
+		print_info "  $(basename "$expanded_path"): syncing relationships..."
+		# shellcheck disable=SC2086
+		if (cd "$expanded_path" && bash "$sync_script" relationships $repo_arg --verbose 2>&1 | tail -3); then
+			true
+		else
+			print_warning "  $(basename "$expanded_path"): relationships sync had errors"
+			failed_repos=$((failed_repos + 1))
+		fi
+	done < <(jq -r '.initialized_repos[] | select(.pulse == true) | [.path, .slug, (.local_only // false | tostring)] | @tsv' "$repos_file" 2>/dev/null)
+
+	# Create marker directory and file
+	mkdir -p "$marker_dir"
+	date -u +%Y-%m-%dT%H:%M:%SZ >"$marker_file"
+
+	if [[ $total_repos -eq 0 ]]; then
+		print_info "No repos with relationship data to backfill"
+	elif [[ $failed_repos -eq 0 ]]; then
+		print_success "Issue relationships backfilled for $total_repos repo(s)"
+	else
+		print_warning "Backfilled $total_repos repo(s), $failed_repos had errors"
+	fi
+
+	return 0
+}
+
+# Migrate aidevops cron entries to systemd user timers (GH#17695 Finding D).
+# On Linux systems with systemd, scans cron for aidevops markers and removes
+# entries that have a corresponding systemd timer already installed. This
+# prevents dual-execution for existing installations that were set up before
+# the systemd preference was added.
+# Safe to run on macOS (no-op) and on Linux without systemd (no-op).
+# Idempotent: uses a marker file to run only once.
+migrate_cron_to_systemd() {
+	# Only run on Linux with systemd available
+	if [[ "$(uname -s)" == "Darwin" ]]; then
+		return 0
+	fi
+	if ! command -v systemctl >/dev/null 2>&1 || ! systemctl --user status >/dev/null 2>&1; then
+		return 0
+	fi
+
+	# Versioned migration marker — bump version when new entries are added so
+	# existing systems re-run the migration (GH#17861: added auto-update + repo-sync).
+	local marker_dir="$HOME/.aidevops/cache/migrations"
+	local marker_file="$marker_dir/cron-to-systemd-v2-done"
+	if [[ -f "$marker_file" ]]; then
+		return 0
+	fi
+
+	# Parallel arrays: cron markers and their corresponding systemd timer names.
+	# Bash 3.2 compatible (no associative arrays).
+	local cron_markers="aidevops: stats-wrapper
+aidevops: gh-failure-miner
+aidevops: process-guard
+aidevops: memory-pressure-monitor
+aidevops: screen-time-snapshot
+aidevops: contribution-watch
+aidevops: profile-readme-update
+aidevops: token-refresh
+aidevops-auto-update
+aidevops-repo-sync"
+
+	local systemd_timers="aidevops-stats-wrapper
+aidevops-gh-failure-miner
+aidevops-process-guard
+aidevops-memory-pressure-monitor
+aidevops-screen-time-snapshot
+aidevops-contribution-watch
+aidevops-profile-readme-update
+aidevops-token-refresh
+aidevops-auto-update
+aidevops-repo-sync"
+
+	local current_cron
+	current_cron=$(crontab -l 2>/dev/null) || current_cron=""
+	if [[ -z "$current_cron" ]]; then
+		mkdir -p "$marker_dir"
+		date -u +%Y-%m-%dT%H:%M:%SZ >"$marker_file"
+		return 0
+	fi
+
+	local migrated=0
+	local new_cron="$current_cron"
+	local i=0
+
+	while IFS= read -r marker; do
+		local timer_name
+		timer_name=$(echo "$systemd_timers" | sed -n "$((i + 1))p")
+		i=$((i + 1))
+		# Only remove cron entry if the corresponding systemd timer is active
+		if echo "$new_cron" | grep -qF "$marker" &&
+			systemctl --user is-enabled "${timer_name}.timer" >/dev/null 2>&1; then
+			new_cron=$(echo "$new_cron" | grep -vF "$marker")
+			migrated=$((migrated + 1))
+			print_info "Migrated $marker from cron to systemd (${timer_name}.timer)"
+		fi
+	done <<<"$cron_markers"
+
+	if [[ $migrated -gt 0 ]]; then
+		echo "$new_cron" | crontab -
+		print_success "Cron-to-systemd migration: $migrated scheduler(s) migrated"
+	fi
+
+	# Write versioned marker regardless of whether anything was migrated
+	mkdir -p "$marker_dir"
+	date -u +%Y-%m-%dT%H:%M:%SZ >"$marker_file"
+	return 0
+}

package/setup-modules/plugins.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: MIT
+# SPDX-FileCopyrightText: 2025-2026 Marcus Quinn
 # Plugin functions: deploy_plugins, sanitize_plugin_namespace, generate_agent_skills, create_skill_symlinks, check_skill_updates, scan_imported_skills, multi-tenant
 # Part of aidevops setup.sh modularization (t316.3)
 

package/setup-modules/post-setup.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: MIT
+# SPDX-FileCopyrightText: 2025-2026 Marcus Quinn
 # Post-setup functions: auto-update enablement, final instructions, onboarding prompt.
 # Part of aidevops setup.sh modularization (GH#5793)
 
@@ -26,7 +28,8 @@ setup_auto_update() {
 		"aidevops-auto-update" \
 		"$auto_update_script" \
 		"enable" \
-		"aidevops auto-update enable"; then
+		"aidevops auto-update enable" \
+		"aidevops-auto-update"; then
 		_auto_update_installed=true
 	fi
 	if [[ "$_auto_update_installed" == "false" ]]; then
@@ -162,6 +165,10 @@ setup_tabby() {
 
 	print_info "Tabby terminal detected"
 
+	# Ensure default local profile uses /bin/zsh (macOS).
+	# After macOS updates, Tabby can fall back to bash when this is unset.
+	bash "$tabby_helper" fix-shell || true
+
 	# Install zshrc hook (idempotent)
 	if ! bash "$tabby_helper" zshrc; then
 		print_warning "Failed to install Tabby zshrc hook — run manually: aidevops tabby zshrc"