feat(agent): harden rust worktime fallback mode

windows/ActivityWatch.Windows.Common.psm1

@@ -996,6 +996,8 @@ function New-ActivityWatchDeploymentConfig {
             fileOpsEnabled = $FileOpsEnabled
             emailEnabled = $false
             worktimeSessionEnabled = $true
+            worktimeSessionMode = 'powershell_primary'
+            worktimeLegacyFallbackEnabled = $true
         }
         logging = [pscustomobject]@{
             localAgentLogsEnabled = $LocalAgentLogsEnabled
@@ -2035,7 +2037,11 @@ function Invoke-ActivityWatchRecoveryLoop {
                 $stateRoot = [string]$config.paths.stateRoot
                 $sessionCollectorScript = if ($config.paths.PSObject.Properties.Name -contains 'sessionCollectorScript') { [string]$config.paths.sessionCollectorScript } else { Join-Path $stateRoot 'worktime-session-collector.ps1' }
                 $worktimeSessionEnabled = if ($config.PSObject.Properties.Name -contains 'collectors' -and $config.collectors.PSObject.Properties.Name -contains 'worktimeSessionEnabled') { [bool]$config.collectors.worktimeSessionEnabled } else { $true }
-                if ($worktimeSessionEnabled) {
+                $worktimeSessionMode = if ($config.PSObject.Properties.Name -contains 'collectors' -and $config.collectors.PSObject.Properties.Name -contains 'worktimeSessionMode') { [string]$config.collectors.worktimeSessionMode } else { 'powershell_primary' }
+                $worktimeLegacyFallbackEnabled = if ($config.PSObject.Properties.Name -contains 'collectors' -and $config.collectors.PSObject.Properties.Name -contains 'worktimeLegacyFallbackEnabled') { [bool]$config.collectors.worktimeLegacyFallbackEnabled } else { $true }
+                $rustAgentRunning = @(Get-CimInstance Win32_Process -ErrorAction SilentlyContinue | Where-Object { $_.Name -ieq 'awatch-agent-rs.exe' }).Count -gt 0
+                $allowPowerShellWorktime = $worktimeSessionEnabled -and ($worktimeSessionMode -ine 'rust_primary' -or ($worktimeLegacyFallbackEnabled -and -not $rustAgentRunning))
+                if ($allowPowerShellWorktime) {
                     Start-ActivityWatchCollectorScriptGlobalIfNeeded -ScriptPath $sessionCollectorScript -ConfigPath $ConfigPath
                 }
 

windows/aw-collector-guard.ps1

@@ -489,9 +489,15 @@ function Invoke-GuardCycle {
     $worktimeAge = $bucketChecks["aw-worktime-sessions_$hostname"].ageSeconds
     $sessionCollectorScript = if ($config.paths.PSObject.Properties.Name -contains 'sessionCollectorScript') { [string]$config.paths.sessionCollectorScript } else { Join-Path $stateRoot 'worktime-session-collector.ps1' }
     $worktimeSessionEnabled = if ($config.PSObject.Properties.Name -contains 'collectors' -and $config.collectors.PSObject.Properties.Name -contains 'worktimeSessionEnabled') { [bool]$config.collectors.worktimeSessionEnabled } else { $true }
-    $sessionCollectorRunning = $worktimeSessionEnabled -and (Test-ActivityWatchCollectorRunningGlobal -ScriptPath $sessionCollectorScript)
+    $worktimeSessionMode = if ($config.PSObject.Properties.Name -contains 'collectors' -and $config.collectors.PSObject.Properties.Name -contains 'worktimeSessionMode') { [string]$config.collectors.worktimeSessionMode } else { 'powershell_primary' }
+    $worktimeLegacyFallbackEnabled = if ($config.PSObject.Properties.Name -contains 'collectors' -and $config.collectors.PSObject.Properties.Name -contains 'worktimeLegacyFallbackEnabled') { [bool]$config.collectors.worktimeLegacyFallbackEnabled } else { $true }
+    $rustAgentRunning = @(Get-CimInstance Win32_Process -ErrorAction SilentlyContinue | Where-Object { $_.Name -ieq 'awatch-agent-rs.exe' }).Count -gt 0
+    $rustPrimary = $worktimeSessionMode -ieq 'rust_primary'
+    $rustWorktimeStale = ($null -eq $worktimeAge -or [int]$worktimeAge -gt $HeadlessMaxAgeSeconds)
+    $allowPowerShellWorktime = $worktimeSessionEnabled -and (-not $rustPrimary -or ($worktimeLegacyFallbackEnabled -and (-not $rustAgentRunning -or $rustWorktimeStale)))
+    $sessionCollectorRunning = $allowPowerShellWorktime -and (Test-ActivityWatchCollectorRunningGlobal -ScriptPath $sessionCollectorScript)
     $headlessKey = 'headless:worktime-session'
-    $needsHeadlessAction = $worktimeSessionEnabled -and (-not $sessionCollectorRunning -or $null -eq $worktimeAge -or [int]$worktimeAge -gt $HeadlessMaxAgeSeconds)
+    $needsHeadlessAction = $allowPowerShellWorktime -and (-not $sessionCollectorRunning -or $rustWorktimeStale)
     if ($needsHeadlessAction) {
         $key = $headlessKey
         $allowed = Test-ActionAllowed -Runtime $Runtime -Key $key -CooldownSeconds $ActionCooldownSeconds -WindowSeconds $RestartWindowSeconds -MaxCount $MaxRestarts

windows/aw-standalone-service.ps1

@@ -82,6 +82,12 @@ while ($true) {
             if ($collectors.PSObject.Properties.Name -contains 'fileOpsEnabled') { $startFileOps = [bool]$collectors.fileOpsEnabled }
             if ($collectors.PSObject.Properties.Name -contains 'emailEnabled')   { $startEmail   = [bool]$collectors.emailEnabled }
             if ($collectors.PSObject.Properties.Name -contains 'worktimeSessionEnabled') { $startWorktime = [bool]$collectors.worktimeSessionEnabled }
+            $worktimeSessionMode = if ($collectors.PSObject.Properties.Name -contains 'worktimeSessionMode') { [string]$collectors.worktimeSessionMode } else { 'powershell_primary' }
+            $worktimeLegacyFallbackEnabled = if ($collectors.PSObject.Properties.Name -contains 'worktimeLegacyFallbackEnabled') { [bool]$collectors.worktimeLegacyFallbackEnabled } else { $true }
+            if ($worktimeSessionMode -ieq 'rust_primary') {
+                $rustAgentRunning = @(Get-CimInstance Win32_Process -ErrorAction SilentlyContinue | Where-Object { $_.Name -ieq 'awatch-agent-rs.exe' }).Count -gt 0
+                $startWorktime = $worktimeLegacyFallbackEnabled -and (-not $rustAgentRunning)
+            }
         }
         if ($isSession0) {
             $startBrowser = $false

windows/deploy-ensemble.ps1

@@ -179,6 +179,8 @@ $report = [ordered]@{
         windowEnabled = $WindowEnabled
         fileOpsEnabled = $FileOpsEnabled
         worktimeSessionEnabled = $true
+        worktimeSessionMode = 'powershell_primary'
+        worktimeLegacyFallbackEnabled = $true
     }
     hardeningApplied = (-not $SkipHardening)
 }

windows/install-standalone-service.ps1

@@ -95,6 +95,8 @@ $config = [pscustomobject]@{
         fileOpsEnabled = $true
         emailEnabled = $true
         worktimeSessionEnabled = $true
+        worktimeSessionMode = 'powershell_primary'
+        worktimeLegacyFallbackEnabled = $true
     }
     logging = [pscustomobject]@{
         localAgentLogsEnabled = $true