diff --git a/src/generators/ps-helpers.ts b/src/generators/ps-helpers.ts
new file mode 100644
index 0000000..2b38b5f
--- /dev/null
+++ b/src/generators/ps-helpers.ts
@@ -0,0 +1,35 @@
+// src/generators/ps-helpers.ts
+// Shared PowerShell snippet builders used by both intune-install.ts and intune-detection.ts.
+// Keeping path constants and install block in one place guarantees the two scripts
+// always reference the same Windows paths — a mismatch would cause detection to fail
+// even when the app is correctly installed.
+
+import type { WizardState } from '../store/types';
+
+// Canonical Windows paths for each configPath option.
+// Note: %APPDATA% under SYSTEM resolves to
+//   C:\Windows\system32\config\systemprofile\AppData\Roaming\
+// Generated scripts include an inline comment warning about this.
+export const CONFIG_DIR: Record<WizardState['deployment']['configPath'], string> = {
+  'machine-wide': 'C:\\ProgramData\\rclone',
+  'user-profile': '%APPDATA%\\rclone',
+};
+
+// Conditional rclone binary download block (idempotent).
+// Returns the PowerShell snippet as a string.
+// Caller decides whether to include it based on state.deployment.includeInstall.
+export function buildRcloneInstallBlock(installPath: string): string {
+  return `
+# Download rclone binary (idempotent — skips if already present)
+$rclonePath = "${installPath}\\rclone.exe"
+if (-not (Test-Path $rclonePath)) {
+    $zipPath = "$env:TEMP\\rclone.zip"
+    Invoke-WebRequest -Uri 'https://downloads.rclone.org/rclone-current-windows-amd64.zip' -OutFile $zipPath -UseBasicParsing
+    Add-Type -AssemblyName System.IO.Compression.FileSystem
+    $zip = [System.IO.Compression.ZipFile]::OpenRead($zipPath)
+    $entry = $zip.Entries | Where-Object { $_.Name -eq 'rclone.exe' }
+    [System.IO.Compression.ZipFileExtensions]::ExtractToFile($entry, $rclonePath, $true)
+    $zip.Dispose()
+    Remove-Item $zipPath -Force
+}`;
+}