---
phase: 02-generators
plan: 03
subsystem: generators
tags: [powershell, intune, rclone, deployment, script-generation]

# Dependency graph
requires:
  - phase: 02-01
    provides: Generator test stubs and barrel index.ts
  - phase: 02-02
    provides: buildRcloneConf (rclone INI config generator)
provides:
  - buildIntuneInstall — generates PS install script with UTF-8 no-BOM config write, conditional rclone download
  - buildIntuneDetection — generates PS detection script with exit 0/1 and STDERR contamination guard
  - CONFIG_DIR + buildRcloneInstallBlock — shared PS path constants and install snippet
affects:
  - 02-04 (RMM script generator — same pattern, uses $ErrorActionPreference)
  - 03-ui (deploy step UI will call these generators with wizard state)

# Tech tracking
tech-stack:
  added: []
  patterns:
    - Shared constants module (ps-helpers.ts) to guarantee path consistency across related scripts
    - Here-string embedding for credential literals — prevents PS variable interpolation (security)
    - Intune detection contract: no $ErrorActionPreference, Write-Output + exit 0/1 only

key-files:
  created:
    - src/generators/ps-helpers.ts
    - src/generators/intune-install.ts
    - src/generators/intune-detection.ts
  modified: []

key-decisions:
  - "PS here-string (@'...'@) embeds config content as literals — no PS variable interpolation, satisfies credential non-echo requirement"
  - "buildIntuneDetection omits $ErrorActionPreference — Intune detection contract treats any STDERR as non-detection regardless of exit code"
  - "CONFIG_DIR shared via ps-helpers.ts — single source of truth ensures install and detection scripts always reference the same Windows paths"
  - "UTF-8 no-BOM write via [System.IO.File]::WriteAllText with UTF8Encoding($false) — Set-Content -Encoding UTF8 in PS 5.1 writes BOM"

patterns-established:
  - "Intune detection pattern: no $ErrorActionPreference, Write-Output signal, exit 0 / exit 1"
  - "Shared helpers module for cross-generator constants to prevent path drift"

requirements-completed: [DEPL-01, DEPL-02, DEPL-04, DEPL-05]

# Metrics
duration: resumed from partial
completed: 2026-03-26
---

# Phase 2 Plan 3: Intune Generators Summary

**Intune PowerShell install and detection generators with shared ps-helpers path map, UTF-8 no-BOM write idiom, and STDERR contamination guard**

## Performance

- **Duration:** Resumed from partial (previous run interrupted by rate limit)
- **Completed:** 2026-03-26
- **Tasks:** 2
- **Files modified:** 3

## Accomplishments

- buildIntuneInstall generates a PS install script: creates directory idempotently, writes rclone.conf via [System.IO.File]::WriteAllText with UTF-8 no-BOM encoding, conditionally includes rclone download block
- buildIntuneDetection generates a PS detection script: no $ErrorActionPreference, Write-Output signal, exit 0 when both rclone.exe and rclone.conf present, exit 1 otherwise
- ps-helpers.ts provides CONFIG_DIR (machine-wide: C:\ProgramData\rclone, user-profile: %APPDATA%\rclone) and buildRcloneInstallBlock — shared across both generators to guarantee path consistency

## Task Commits

Each task was committed atomically:

1. **Task 1: Create ps-helpers.ts shared module** - `6a7912d` (feat)
2. **Task 2: Implement buildIntuneInstall and buildIntuneDetection** - `495be0c` (feat)

## Files Created/Modified

- `src/generators/ps-helpers.ts` - CONFIG_DIR record and buildRcloneInstallBlock snippet builder
- `src/generators/intune-install.ts` - buildIntuneInstall pure function
- `src/generators/intune-detection.ts` - buildIntuneDetection pure function

## Decisions Made

- PS here-string (@'...'@) embeds config content as literals — no PS variable interpolation, satisfies credential non-echo requirement
- buildIntuneDetection omits $ErrorActionPreference — Intune detection contract treats any STDERR as non-detection regardless of exit code
- CONFIG_DIR shared via ps-helpers.ts — single source of truth ensures install and detection scripts always reference the same Windows paths
- UTF-8 no-BOM write via [System.IO.File]::WriteAllText with UTF8Encoding($false) — Set-Content -Encoding UTF8 in PS 5.1 writes BOM (a known incompatibility)

## Deviations from Plan

None - plan executed exactly as written. Previous run interrupted by rate limit but files were already correct when resumed; only required committing and SUMMARY creation.

## Issues Encountered

Previous run was interrupted by API rate limit before committing intune-install.ts and intune-detection.ts. Files were found complete and correct on resumption. Tests confirmed 15/15 passing before committing.

## User Setup Required

None - no external service configuration required.

## Next Phase Readiness

- All Intune generator tests (15 assertions) pass GREEN
- Full test suite (61 assertions) passes
- buildIntuneInstall and buildIntuneDetection ready for Phase 3 UI integration (deploy step)
- CONFIG_DIR from ps-helpers.ts guarantees install and detection scripts always match paths — no path drift risk

---
*Phase: 02-generators*
*Completed: 2026-03-26*