redeploy 0.2.41__tar.gz → 0.2.43__tar.gz

{redeploy-0.2.41 → redeploy-0.2.43}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: redeploy
-Version: 0.2.41
+Version: 0.2.43
 Summary: Infrastructure migration toolkit: detect → plan → apply
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -12,6 +12,7 @@ Requires-Dist: loguru>=0.7
 Requires-Dist: paramiko>=3.0
 Requires-Dist: httpx>=0.25
 Requires-Dist: rich>=13.0
+Requires-Dist: jmespath>=1.0
 Requires-Dist: goal>=2.1.0
 Requires-Dist: costs>=0.1.20
 Requires-Dist: pfix>=0.1.60
@@ -27,17 +28,17 @@ Requires-Dist: pfix>=0.1.60; extra == "dev"
 
 ## AI Cost Tracking
 
-![PyPI](https://img.shields.io/badge/pypi-costs-blue) ![Version](https://img.shields.io/badge/version-0.2.41-blue) ![Python](https://img.shields.io/badge/python-3.9+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
-![AI Cost](https://img.shields.io/badge/AI%20Cost-$7.50-orange) ![Human Time](https://img.shields.io/badge/Human%20Time-20.4h-blue) ![Model](https://img.shields.io/badge/Model-openrouter%2Fqwen%2Fqwen3--coder--next-lightgrey)
+![PyPI](https://img.shields.io/badge/pypi-costs-blue) ![Version](https://img.shields.io/badge/version-0.2.43-blue) ![Python](https://img.shields.io/badge/python-3.9+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
+![AI Cost](https://img.shields.io/badge/AI%20Cost-$7.50-orange) ![Human Time](https://img.shields.io/badge/Human%20Time-21.0h-blue) ![Model](https://img.shields.io/badge/Model-openrouter%2Fqwen%2Fqwen3--coder--next-lightgrey)
 
-- 🤖 **LLM usage:** $7.5000 (62 commits)
-- 👤 **Human dev:** ~$2044 (20.4h @ $100/h, 30min dedup)
+- 🤖 **LLM usage:** $7.5000 (64 commits)
+- 👤 **Human dev:** ~$2099 (21.0h @ $100/h, 30min dedup)
 
 Generated on 2026-04-21 using [openrouter/qwen/qwen3-coder-next](https://openrouter.ai/qwen/qwen3-coder-next)
 
 ---
 
-![PyPI](https://img.shields.io/badge/pypi-redeploy-blue) ![Version](https://img.shields.io/badge/version-0.2.41-blue) ![Python](https://img.shields.io/badge/python-3.10+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
+![PyPI](https://img.shields.io/badge/pypi-redeploy-blue) ![Version](https://img.shields.io/badge/version-0.2.43-blue) ![Python](https://img.shields.io/badge/python-3.10+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
 
 Infrastructure migration and device deploy toolkit — VPS, Raspberry Pi kiosk, Podman Quadlet, k3s.
 
@@ -152,6 +153,72 @@ redeploy device-rm root@10.0.0.5
 
 Registry is stored at `~/.config/redeploy/devices.yaml` (chmod 600 — safe for SSH key paths).
 
+## Declarative config workflow
+
+redeploy supports a declarative configuration workflow for hardware settings — scan to YAML, edit locally, and apply to device:
+
+```bash
+# 1. Scan hardware state to YAML
+redeploy hardware pi@192.168.188.109 > hardware.yaml
+redeploy device-map pi@192.168.188.109 > device-map.yaml
+
+# 2. Edit YAML locally (e.g., change display rotation)
+# hardware.yaml:
+#   drm_outputs:
+#   - name: card0-DSI-2
+#     connector: DSI-2
+#     transform: '270'  # ← edit this value
+
+# 3. Apply config to remote device
+redeploy hardware pi@192.168.188.109 --apply-config hardware.yaml
+redeploy device-map pi@192.168.188.109 --apply-config device-map.yaml
+```
+
+**What `--apply-config` does:**
+- Applies display transforms via `wlr-randr` (Wayland compositor)
+- Updates kanshi config (`~/.config/kanshi/config`) for persistent display rotation
+- Sets backlight brightness and power state
+- Supports both YAML and JSON config files
+
+**Supported commands:**
+- `redeploy hardware --apply-config FILE`
+- `redeploy device-map --apply-config FILE`
+- `redeploy blueprint show FILE --apply-config FILE`
+
+## JMESPath query support
+
+Extract specific values from YAML/JSON output using JMESPath query language (similar to XPath for XML):
+
+```bash
+# Simple path queries
+redeploy hardware pi@192.168.188.109 --query "drm_outputs[0].transform"
+redeploy hardware pi@192.168.188.109 --query "kernel"
+redeploy device-map pi@192.168.188.109 --query "host"
+
+# Filter queries
+redeploy hardware pi@192.168.188.109 --query "backlights[?name==\`11-0045\`].brightness"
+redeploy hardware pi@192.168.188.109 --query "drm_outputs[?connector==\`DSI-2\`].transform"
+
+# From saved YAML files
+redeploy blueprint show blueprint.yaml --query "hardware.drm_outputs[0].transform"
+redeploy device-map --show device-map.yaml --query "tags"
+
+# JSON output
+redeploy hardware pi@192.168.188.109 --query "tags" --format json
+```
+
+**JMESPath features:**
+- **Simple paths:** `kernel`, `host`, `board`
+- **Array indexing:** `drm_outputs[0].transform`
+- **Filtering:** `[?name==\`11-0045\`]`
+- **Projections:** `backlights[0].[name,brightness]`
+- **Wildcards:** `drm_outputs[*].transform`
+
+**Supported commands:**
+- `redeploy hardware --query EXPR`
+- `redeploy device-map --query EXPR`
+- `redeploy blueprint show FILE --query EXPR`
+
 ## CLI reference
 
 ### `redeploy run SPEC [options]`
@@ -614,6 +681,90 @@ redeploy run examples/01-vps-version-bump/migration.yaml --plan-only
 redeploy run examples/04-rpi-kiosk/migration.yaml --plan-only
 ```
 
+## Hardware diagnostics commands
+
+### `redeploy hardware HOST [options]`
+
+Probe and diagnose hardware on a remote host (DSI display, DRM connectors, backlight, I2C, config.txt, Wayland compositor).
+
+| Option | Description |
+|--------|-------------|
+| `--format [yaml|json]` | Output format (default: yaml) |
+| `--fix` | Print fix commands for all issues found |
+| `--apply-fix COMPONENT` | Run fix for specific component via SSH |
+| `--panel PANEL_ID` | Specify panel ID explicitly |
+| `--list-panels` | List available panel definitions |
+| `--set-transform TRANSFORM` | Set display rotation for DSI output (normal, 90, 180, 270, flipped, etc.) |
+| `--apply-config FILE` | Apply display settings from YAML/JSON config file |
+| `--query EXPR` | Extract specific values using JMESPath query |
+| `--ssh-key PATH` | SSH private key path |
+
+```bash
+redeploy hardware pi@192.168.188.109
+redeploy hardware pi@192.168.188.109 --fix
+redeploy hardware pi@192.168.188.109 --set-transform 270
+redeploy hardware pi@192.168.188.109 --apply-config hardware.yaml
+redeploy hardware pi@192.168.188.109 --query "drm_outputs[0].transform"
+```
+
+### `redeploy device-map HOST [options]`
+
+Generate full device snapshot (hardware + infra + diagnostics).
+
+| Option | Description |
+|--------|-------------|
+| `--name TEXT` | Human-friendly device label |
+| `--tag TEXT` | Tag(s) to attach (repeatable) |
+| `--save` | Persist map to `~/.config/redeploy/device-maps/` |
+| `--out PATH` | Save to specific file |
+| `--format [yaml|json]` | Output format (default: yaml) |
+| `--no-infra` | Skip infra probe (hardware only) |
+| `--list` | List saved device maps |
+| `--show PATH` | Load and display saved device-map file |
+| `--diff PATH...` | Diff two saved device-map files |
+| `--apply-config FILE` | Apply hardware/infra settings from YAML config file |
+| `--query EXPR` | Extract specific values using JMESPath query |
+| `--ssh-key PATH` | SSH private key path |
+
+```bash
+redeploy device-map pi@192.168.188.109 --save --name "kiosk-lab"
+redeploy device-map --list
+redeploy device-map --show ~/.config/redeploy/device-maps/pi_at_192.168.188.109.yaml
+redeploy device-map pi@192.168.188.109 --apply-config device-map.yaml
+redeploy device-map pi@192.168.188.109 --query "hardware.drm_outputs[0].transform"
+```
+
+### `redeploy blueprint [command]`
+
+Manage device blueprints (capture, show, list, twin, migrate).
+
+#### `redeploy blueprint capture HOST [options]`
+
+Capture device state as blueprint.
+
+| Option | Description |
+|--------|-------------|
+| `--format [yaml|json]` | Output format (default: yaml) |
+| `--save` | Persist to `~/.config/redeploy/blueprints/` |
+| `--out PATH` | Save to specific file |
+| `--ssh-key PATH` | SSH private key path |
+
+#### `redeploy blueprint show FILE [options]`
+
+Display saved blueprint.
+
+| Option | Description |
+|--------|-------------|
+| `--format [yaml|json]` | Output format (default: yaml) |
+| `--apply-config FILE` | Apply blueprint settings from YAML config file |
+| `--query EXPR` | Extract specific values using JMESPath query |
+
+```bash
+redeploy blueprint capture pi@192.168.188.109 > blueprint.yaml
+redeploy blueprint show blueprint.yaml --apply-config blueprint.yaml
+redeploy blueprint show blueprint.yaml --query "hardware.drm_outputs[0].transform"
+```
+
 ## License
 
 Licensed under Apache-2.0.

{redeploy-0.2.41 → redeploy-0.2.43}/README.md

@@ -3,17 +3,17 @@
 
 ## AI Cost Tracking
 
-![PyPI](https://img.shields.io/badge/pypi-costs-blue) ![Version](https://img.shields.io/badge/version-0.2.41-blue) ![Python](https://img.shields.io/badge/python-3.9+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
-![AI Cost](https://img.shields.io/badge/AI%20Cost-$7.50-orange) ![Human Time](https://img.shields.io/badge/Human%20Time-20.4h-blue) ![Model](https://img.shields.io/badge/Model-openrouter%2Fqwen%2Fqwen3--coder--next-lightgrey)
+![PyPI](https://img.shields.io/badge/pypi-costs-blue) ![Version](https://img.shields.io/badge/version-0.2.43-blue) ![Python](https://img.shields.io/badge/python-3.9+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
+![AI Cost](https://img.shields.io/badge/AI%20Cost-$7.50-orange) ![Human Time](https://img.shields.io/badge/Human%20Time-21.0h-blue) ![Model](https://img.shields.io/badge/Model-openrouter%2Fqwen%2Fqwen3--coder--next-lightgrey)
 
-- 🤖 **LLM usage:** $7.5000 (62 commits)
-- 👤 **Human dev:** ~$2044 (20.4h @ $100/h, 30min dedup)
+- 🤖 **LLM usage:** $7.5000 (64 commits)
+- 👤 **Human dev:** ~$2099 (21.0h @ $100/h, 30min dedup)
 
 Generated on 2026-04-21 using [openrouter/qwen/qwen3-coder-next](https://openrouter.ai/qwen/qwen3-coder-next)
 
 ---
 
-![PyPI](https://img.shields.io/badge/pypi-redeploy-blue) ![Version](https://img.shields.io/badge/version-0.2.41-blue) ![Python](https://img.shields.io/badge/python-3.10+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
+![PyPI](https://img.shields.io/badge/pypi-redeploy-blue) ![Version](https://img.shields.io/badge/version-0.2.43-blue) ![Python](https://img.shields.io/badge/python-3.10+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
 
 Infrastructure migration and device deploy toolkit — VPS, Raspberry Pi kiosk, Podman Quadlet, k3s.
 
@@ -128,6 +128,72 @@ redeploy device-rm root@10.0.0.5
 
 Registry is stored at `~/.config/redeploy/devices.yaml` (chmod 600 — safe for SSH key paths).
 
+## Declarative config workflow
+
+redeploy supports a declarative configuration workflow for hardware settings — scan to YAML, edit locally, and apply to device:
+
+```bash
+# 1. Scan hardware state to YAML
+redeploy hardware pi@192.168.188.109 > hardware.yaml
+redeploy device-map pi@192.168.188.109 > device-map.yaml
+
+# 2. Edit YAML locally (e.g., change display rotation)
+# hardware.yaml:
+#   drm_outputs:
+#   - name: card0-DSI-2
+#     connector: DSI-2
+#     transform: '270'  # ← edit this value
+
+# 3. Apply config to remote device
+redeploy hardware pi@192.168.188.109 --apply-config hardware.yaml
+redeploy device-map pi@192.168.188.109 --apply-config device-map.yaml
+```
+
+**What `--apply-config` does:**
+- Applies display transforms via `wlr-randr` (Wayland compositor)
+- Updates kanshi config (`~/.config/kanshi/config`) for persistent display rotation
+- Sets backlight brightness and power state
+- Supports both YAML and JSON config files
+
+**Supported commands:**
+- `redeploy hardware --apply-config FILE`
+- `redeploy device-map --apply-config FILE`
+- `redeploy blueprint show FILE --apply-config FILE`
+
+## JMESPath query support
+
+Extract specific values from YAML/JSON output using JMESPath query language (similar to XPath for XML):
+
+```bash
+# Simple path queries
+redeploy hardware pi@192.168.188.109 --query "drm_outputs[0].transform"
+redeploy hardware pi@192.168.188.109 --query "kernel"
+redeploy device-map pi@192.168.188.109 --query "host"
+
+# Filter queries
+redeploy hardware pi@192.168.188.109 --query "backlights[?name==\`11-0045\`].brightness"
+redeploy hardware pi@192.168.188.109 --query "drm_outputs[?connector==\`DSI-2\`].transform"
+
+# From saved YAML files
+redeploy blueprint show blueprint.yaml --query "hardware.drm_outputs[0].transform"
+redeploy device-map --show device-map.yaml --query "tags"
+
+# JSON output
+redeploy hardware pi@192.168.188.109 --query "tags" --format json
+```
+
+**JMESPath features:**
+- **Simple paths:** `kernel`, `host`, `board`
+- **Array indexing:** `drm_outputs[0].transform`
+- **Filtering:** `[?name==\`11-0045\`]`
+- **Projections:** `backlights[0].[name,brightness]`
+- **Wildcards:** `drm_outputs[*].transform`
+
+**Supported commands:**
+- `redeploy hardware --query EXPR`
+- `redeploy device-map --query EXPR`
+- `redeploy blueprint show FILE --query EXPR`
+
 ## CLI reference
 
 ### `redeploy run SPEC [options]`
@@ -590,6 +656,90 @@ redeploy run examples/01-vps-version-bump/migration.yaml --plan-only
 redeploy run examples/04-rpi-kiosk/migration.yaml --plan-only
 ```
 
+## Hardware diagnostics commands
+
+### `redeploy hardware HOST [options]`
+
+Probe and diagnose hardware on a remote host (DSI display, DRM connectors, backlight, I2C, config.txt, Wayland compositor).
+
+| Option | Description |
+|--------|-------------|
+| `--format [yaml|json]` | Output format (default: yaml) |
+| `--fix` | Print fix commands for all issues found |
+| `--apply-fix COMPONENT` | Run fix for specific component via SSH |
+| `--panel PANEL_ID` | Specify panel ID explicitly |
+| `--list-panels` | List available panel definitions |
+| `--set-transform TRANSFORM` | Set display rotation for DSI output (normal, 90, 180, 270, flipped, etc.) |
+| `--apply-config FILE` | Apply display settings from YAML/JSON config file |
+| `--query EXPR` | Extract specific values using JMESPath query |
+| `--ssh-key PATH` | SSH private key path |
+
+```bash
+redeploy hardware pi@192.168.188.109
+redeploy hardware pi@192.168.188.109 --fix
+redeploy hardware pi@192.168.188.109 --set-transform 270
+redeploy hardware pi@192.168.188.109 --apply-config hardware.yaml
+redeploy hardware pi@192.168.188.109 --query "drm_outputs[0].transform"
+```
+
+### `redeploy device-map HOST [options]`
+
+Generate full device snapshot (hardware + infra + diagnostics).
+
+| Option | Description |
+|--------|-------------|
+| `--name TEXT` | Human-friendly device label |
+| `--tag TEXT` | Tag(s) to attach (repeatable) |
+| `--save` | Persist map to `~/.config/redeploy/device-maps/` |
+| `--out PATH` | Save to specific file |
+| `--format [yaml|json]` | Output format (default: yaml) |
+| `--no-infra` | Skip infra probe (hardware only) |
+| `--list` | List saved device maps |
+| `--show PATH` | Load and display saved device-map file |
+| `--diff PATH...` | Diff two saved device-map files |
+| `--apply-config FILE` | Apply hardware/infra settings from YAML config file |
+| `--query EXPR` | Extract specific values using JMESPath query |
+| `--ssh-key PATH` | SSH private key path |
+
+```bash
+redeploy device-map pi@192.168.188.109 --save --name "kiosk-lab"
+redeploy device-map --list
+redeploy device-map --show ~/.config/redeploy/device-maps/pi_at_192.168.188.109.yaml
+redeploy device-map pi@192.168.188.109 --apply-config device-map.yaml
+redeploy device-map pi@192.168.188.109 --query "hardware.drm_outputs[0].transform"
+```
+
+### `redeploy blueprint [command]`
+
+Manage device blueprints (capture, show, list, twin, migrate).
+
+#### `redeploy blueprint capture HOST [options]`
+
+Capture device state as blueprint.
+
+| Option | Description |
+|--------|-------------|
+| `--format [yaml|json]` | Output format (default: yaml) |
+| `--save` | Persist to `~/.config/redeploy/blueprints/` |
+| `--out PATH` | Save to specific file |
+| `--ssh-key PATH` | SSH private key path |
+
+#### `redeploy blueprint show FILE [options]`
+
+Display saved blueprint.
+
+| Option | Description |
+|--------|-------------|
+| `--format [yaml|json]` | Output format (default: yaml) |
+| `--apply-config FILE` | Apply blueprint settings from YAML config file |
+| `--query EXPR` | Extract specific values using JMESPath query |
+
+```bash
+redeploy blueprint capture pi@192.168.188.109 > blueprint.yaml
+redeploy blueprint show blueprint.yaml --apply-config blueprint.yaml
+redeploy blueprint show blueprint.yaml --query "hardware.drm_outputs[0].transform"
+```
+
 ## License
 
 Licensed under Apache-2.0.

{redeploy-0.2.41 → redeploy-0.2.43}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "redeploy"
-version = "0.2.41"
+version = "0.2.43"
 description = "Infrastructure migration toolkit: detect → plan → apply"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -17,6 +17,7 @@ dependencies = [
     "paramiko>=3.0",
     "httpx>=0.25",
     "rich>=13.0",
+    "jmespath>=1.0",
     "goal>=2.1.0",
     "costs>=0.1.20",
     "pfix>=0.1.60",

{redeploy-0.2.41 → redeploy-0.2.43}/redeploy/__init__.py

@@ -7,7 +7,7 @@ Public API (stable from 0.2.0, semver guaranteed)::
 
 Everything not listed in ``__all__`` is internal and may change without notice.
 """
-__version__ = "0.2.41"
+__version__ = "0.2.43"
 
 # ── Core models ───────────────────────────────────────────────────────────────
 from .models import (  # noqa: F401

{redeploy-0.2.41 → redeploy-0.2.43}/redeploy/apply/executor.py

@@ -16,6 +16,7 @@ from .handlers import (
     run_docker_health_wait, run_container_log_tail, run_http_check,
     run_version_check, run_plugin, run_wait, run_inline_script,
     run_ensure_config_line, run_raspi_config,
+    run_ensure_kanshi_profile, run_ensure_autostart_entry, run_ensure_browser_kiosk_script,
 )
 from .progress import ProgressEmitter
 from .rollback import rollback_steps
@@ -230,6 +231,9 @@ class Executor:
             StepAction.INLINE_SCRIPT:       lambda s: run_inline_script(s, self.probe, self.plan),
             StepAction.ENSURE_CONFIG_LINE:  lambda s: run_ensure_config_line(s, self.probe),
             StepAction.RASPI_CONFIG:        lambda s: run_raspi_config(s, self.probe),
+            StepAction.ENSURE_KANSHI_PROFILE:      lambda s: run_ensure_kanshi_profile(s, self.probe),
+            StepAction.ENSURE_AUTOSTART_ENTRY:     lambda s: run_ensure_autostart_entry(s, self.probe),
+            StepAction.ENSURE_BROWSER_KIOSK_SCRIPT: lambda s: run_ensure_browser_kiosk_script(s, self.probe),
         }
 
         handler = dispatch.get(step.action)

{redeploy-0.2.41 → redeploy-0.2.43}/redeploy/apply/handlers.py

@@ -398,3 +398,137 @@ def run_raspi_config(step: MigrationStep, probe: "RemoteProbe") -> None:
 
     step.status = StepStatus.DONE
     step.result = f"applied: {cmd}"
+
+
+# ── kiosk handlers ────────────────────────────────────────────────────────────
+
+def run_ensure_kanshi_profile(step: MigrationStep, probe: "RemoteProbe") -> None:
+    """Idempotently write or replace a named kanshi output profile.
+
+    step.command   — the profile block to write (rendered kanshi syntax)
+    step.config_file — kanshi config path (default: ~/.config/kanshi/config)
+    """
+    from ..hardware.kiosk.output_profiles import OutputProfile
+
+    profile_block = step.command
+    if not profile_block:
+        raise StepError(step, "ensure_kanshi_profile requires step.command with profile block")
+
+    config_path = step.config_file or "~/.config/kanshi/config"
+    mkdir_cmd = f"mkdir -p $(dirname {config_path})"
+    probe.run(mkdir_cmd, timeout=10)
+
+    r = probe.run(f"cat {config_path} 2>/dev/null || echo ''", timeout=10)
+    existing = r.out if r.ok else ""
+
+    # Extract profile name from block (first line: "profile <name> {")
+    first_line = profile_block.strip().splitlines()[0]
+    import re
+    m = re.match(r"profile\s+(\S+)\s*\{", first_line)
+    if not m:
+        raise StepError(step, f"Cannot parse profile name from block: {first_line!r}")
+    profile_name = m.group(1)
+
+    # Replace existing profile block or append
+    pattern = re.compile(
+        rf"^profile\s+{re.escape(profile_name)}\s*\{{[^}}]*\}}", re.MULTILINE | re.DOTALL
+    )
+    if pattern.search(existing):
+        if profile_block.strip() in existing:
+            step.status = StepStatus.DONE
+            step.result = f"no-op: profile '{profile_name}' already correct"
+            return
+        new_content = pattern.sub(profile_block.strip(), existing)
+        changed = True
+    else:
+        sep = "\n" if existing and not existing.endswith("\n") else ""
+        new_content = existing + sep + profile_block.strip() + "\n"
+        changed = True
+
+    encoded = base64.b64encode(new_content.encode()).decode()
+    tmp = f"/tmp/redeploy-kanshi-{step.id}.conf"
+    write_r = probe.run(
+        f"echo '{encoded}' | base64 -d | tee {tmp} > /dev/null && mv {tmp} {config_path}",
+        timeout=15,
+    )
+    if not write_r.ok:
+        raise StepError(step, f"Cannot write {config_path}: {write_r.stderr[:200]}")
+
+    # Reload kanshi if running
+    probe.run("pkill -SIGUSR1 kanshi 2>/dev/null || true", timeout=5)
+
+    step.status = StepStatus.DONE
+    step.result = f"profile '{profile_name}' written to {config_path}"
+
+
+def run_ensure_autostart_entry(step: MigrationStep, probe: "RemoteProbe") -> None:
+    """Idempotently add or replace a keyed entry in a compositor autostart file.
+
+    step.config_file — path to autostart file
+    step.config_line — the line to write (the entry body)
+    step.config_section — used as the entry key for idempotent marker
+    """
+    from ..hardware.kiosk.autostart import AutostartEntry, ensure_autostart_entry
+
+    if not step.config_file or not step.config_line:
+        raise StepError(step, "ensure_autostart_entry requires config_file and config_line")
+
+    key = step.config_section or "redeploy"
+    entry = AutostartEntry(key=key, line=step.config_line)
+
+    r = probe.run(f"cat {step.config_file} 2>/dev/null || echo ''", timeout=10)
+    existing = r.out if r.ok else ""
+
+    new_content, changed = ensure_autostart_entry(existing, entry)
+    if not changed:
+        step.status = StepStatus.DONE
+        step.result = f"no-op: entry [{key}] already correct"
+        return
+
+    mkdir_cmd = f"mkdir -p $(dirname {step.config_file})"
+    probe.run(mkdir_cmd, timeout=10)
+
+    encoded = base64.b64encode(new_content.encode()).decode()
+    tmp = f"/tmp/redeploy-autostart-{step.id}.txt"
+    write_r = probe.run(
+        f"echo '{encoded}' | base64 -d | tee {tmp} > /dev/null && mv {tmp} {step.config_file}",
+        timeout=15,
+    )
+    if not write_r.ok:
+        raise StepError(step, f"Cannot write {step.config_file}: {write_r.stderr[:200]}")
+
+    step.status = StepStatus.DONE
+    step.result = f"entry [{key}] written to {step.config_file}"
+
+
+def run_ensure_browser_kiosk_script(step: MigrationStep, probe: "RemoteProbe") -> None:
+    """Write a kiosk-launch.sh script to the remote device.
+
+    step.command   — the full script content to write
+    step.dst       — destination path (default: ~/kiosk-launch.sh)
+    """
+    script_content = step.command
+    if not script_content:
+        raise StepError(step, "ensure_browser_kiosk_script requires step.command with script body")
+
+    dst = step.dst or "~/kiosk-launch.sh"
+
+    r = probe.run(f"cat {dst} 2>/dev/null || echo ''", timeout=10)
+    existing = r.out if r.ok else ""
+    if existing.strip() == script_content.strip():
+        step.status = StepStatus.DONE
+        step.result = f"no-op: {dst} already correct"
+        return
+
+    encoded = base64.b64encode(script_content.encode()).decode()
+    tmp = f"/tmp/redeploy-kiosk-{step.id}.sh"
+    write_r = probe.run(
+        f"echo '{encoded}' | base64 -d | tee {tmp} > /dev/null"
+        f" && chmod +x {tmp} && mv {tmp} {dst}",
+        timeout=15,
+    )
+    if not write_r.ok:
+        raise StepError(step, f"Cannot write {dst}: {write_r.stderr[:200]}")
+
+    step.status = StepStatus.DONE
+    step.result = f"kiosk script written to {dst}"