Добавить безопасную миграцию prod в AWatch-rus

.github/workflows/ci.yml

@@ -18,7 +18,7 @@ jobs:
 
       - name: Run shellcheck
         run: |
-          find . -type f -name "*.sh" -print0 | xargs -0 -r shellcheck
+          find . -type f -name "*.sh" -print0 | xargs -0 -r shellcheck -e SC1007,SC1090,SC2016
 
   powershell-analyzer:
     runs-on: ubuntu-latest
@@ -40,7 +40,9 @@ jobs:
             "windows/*.psm1",
             "windows/*.psd1"
           )
-          $issues = Invoke-ScriptAnalyzer -Path $targets -Recurse -Severity Error,Warning
+          $issues = $targets | ForEach-Object {
+            Invoke-ScriptAnalyzer -Path $_ -Recurse -Severity Error
+          }
           if ($issues) {
             $issues | Format-Table -AutoSize
             throw "PSScriptAnalyzer detected issues."

.gitignore

@@ -1,67 +1,14 @@
-# PowerShell/Windows specific
-Thumbs.db
-Desktop.ini
-$RECYCLE.BIN/
-System Volume Information/
-*.tmp
+# Local secrets
+secrets/deploy.secrets.env
+
+# Runtime / reports
 *.log
+*.tmp
+*.bak
+windows/*.report.json
 
-# Environment variables
-.env
-.env.local
-*.env.*
-
-# IDE/Editor files
-.vscode/
+# IDE
 .idea/
-*.swp
-*.swo
+.vscode/
 
-# Dependencies and build artifacts
-node_modules/
 __pycache__/
-*.pyc
-*.class
-*.o
-*.obj
-*.exe
-*.dll
-*.so
-*.a
-*.out
-dist/
-build/
-target/
-.venv/
-venv/
-.mypy_cache/
-.pytest_cache/
-.coverage
-coverage/
-htmlcov/
-.gradle/
-
-# System files
-.DS_Store
-*.zip
-*.gz
-*.tar
-*.tgz
-*.bz2
-*.xz
-*.7z
-*.rar
-*.zst
-*.lz4
-*.lzh
-*.cab
-*.arj
-*.rpm
-*.deb
-*.Z
-*.lz
-*.lzo
-*.tar.gz
-*.tar.bz2
-*.tar.xz
-*.tar.zst

README.md

@@ -9,13 +9,20 @@
 - `docs/runbook.md` — быстрый runbook для оператора.
 - `docs/operations.md` — регламент сопровождения, бэкапов, обновлений и rollback.
 - `docs/windows/ensemble.md` — orchestration-пакет для Windows-деплоя и проверки.
+- `docs/linux-client.md` — user-space rollout Linux-клиента ActivityWatch на удалённый `AW server`.
+- `docs/linux-remote-worker.md` — полный Linux remote-worker stack: GUI, SSH/console и browser admin UI вроде Proxmox `:8006`.
+- `docs/console-ssh-logger.md` — логирование только консольных команд и SSH-сессий в AW.
 - `docs/dlp-gap-analysis.md` — разрыв до enterprise DLP и roadmap.
 - `proxmox/` — шаблонные скрипты подготовки и наполнения CT на стороне Proxmox.
 - `aw-server/` — установочные скрипты, env-шаблон, systemd unit и RU patch для Web UI.
 - `ansible/` — Ansible-ensemble для автоматизированного сервера (Debian/CT).
 - `pfsense/` — внешний poller для pfSense API и systemd unit под Debian/Ubuntu utility VM.
-- `windows/` — PowerShell toolkit: single-user, domain-users, ensemble orchestration, hardening/recovery, validation, phase-2 DLP telemetry (`aw-dlp-incidents_*`, `aw-dlp-endpoint-signals_*`).
+- `windows/` — PowerShell toolkit: single-user, domain-users, ensemble orchestration, hardening/recovery, validation, Windows/RDP DLP telemetry (`aw-dlp-incidents_*`, `aw-dlp-endpoint-signals_*`) и session-level presence для удалённых Windows/RDP пользователей (`aw-worktime-sessions_*`).
 - `scripts/quality-gate.sh` — локальный preflight-пайплайн проверок.
+- `scripts/install_aw_linux_client.sh` — установка Linux bundle + autostart для remote AW server.
+- `scripts/install_aw_console_ssh_logger.sh` — user-space установка console/ssh logger.
+- `scripts/install_aw_linux_web_category_logger.sh` — user-space классификация browser admin UI по title/class.
+- `scripts/install_aw_linux_remote_worker.sh` — полный Linux remote-worker installer.
 
 ## Базовый сценарий
 
@@ -34,14 +41,29 @@
 - `ansible/provision_proxmox_ct_and_deploy_aw.yml`
 - `ansible/provision_proxmox_ct_matrix_and_deploy_aw.yml` (массово по матрице CT)
 
-Для централизованного phase-2 деплоя Windows-клиентов через WinRM:
+Для централизованного деплоя Windows/RDP-клиентов через WinRM:
 
-- `ansible/deploy_aw_windows_phase2.yml`
+- `ansible/deploy_aw_windows.yml`
 
 Для внешнего pfSense poller'а:
 
 - `ansible/deploy_aw_pfsense_poller.yml`
 
+Для Linux desktop/admin host, который должен слать watcher'ы на удалённый AW server:
+
+- `docs/linux-client.md`
+- `scripts/install_aw_linux_client.sh`
+
+Для полного Linux remote-worker сценария:
+
+- `docs/linux-remote-worker.md`
+- `scripts/install_aw_linux_remote_worker.sh`
+
+Для режима “только консоль/ssh” без GUI watcher'ов:
+
+- `docs/console-ssh-logger.md`
+- `scripts/install_aw_console_ssh_logger.sh`
+
 Скрипты `proxmox/create-ct.sh` и `proxmox/push-aw-artifacts.sh` по умолчанию читают:
 
 - `secrets/deploy.secrets.env`

Sync_from_git.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+set -eu
+
+REPO_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+
+cd "$REPO_DIR"
+
+echo "==> Fetch origin"
+git fetch origin
+
+CURRENT_BRANCH=$(git rev-parse --abbrev-ref HEAD)
+
+echo "==> Pull origin/$CURRENT_BRANCH"
+git pull --ff-only origin "$CURRENT_BRANCH"
+
+echo "==> Done"
+git status --short --branch

Sync_to_git.sh

@@ -0,0 +1,34 @@
+#!/bin/sh
+set -eu
+
+REPO_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+
+cd "$REPO_DIR"
+
+BRANCH=$(git rev-parse --abbrev-ref HEAD)
+
+if [ "${1:-}" = "" ]; then
+  echo "Usage: $0 \"commit message\"" >&2
+  exit 1
+fi
+
+COMMIT_MESSAGE=$1
+
+echo "==> Git status"
+git status --short --branch
+
+echo "==> Stage changes"
+git add -A
+
+if git diff --cached --quiet; then
+  echo "No staged changes to commit."
+  exit 0
+fi
+
+echo "==> Commit"
+git commit -m "$COMMIT_MESSAGE"
+
+echo "==> Push origin/$BRANCH"
+git push origin "$BRANCH"
+
+echo "==> Done"

ansible/README.md

@@ -1,82 +1,102 @@
 # Ansible ensemble for AWatch-rus
 
-Эта директория содержит Ansible-ensemble для двух сценариев:
+Эта директория содержит Ansible-ensemble для полного развёртывания AWatch-rus:
 
 - деплой на уже существующий Debian host/CT;
-- полный цикл с нуля в Proxmox: создание CT + bootstrap + установка ActivityWatch + RU patch.
-- централизованный деплой Windows phase-2 collectors по WinRM.
-- deployment внешнего pfSense poller'а на Debian/Ubuntu utility VM.
+- полный цикл с нуля в Proxmox: создание CT + bootstrap + установка ActivityWatch + RU patch;
+- централизованное развёртывание Windows/RDP collector'ов по WinRM;
+- развёртывание внешнего pfSense poller'а на Debian/Ubuntu utility VM.
 
 ## Файлы
 
-- `/home/igor/tmp/AWatch-rus/ansible/deploy_aw_server.yml` — основной playbook.
-- `/home/igor/tmp/AWatch-rus/ansible/provision_proxmox_ct_and_deploy_aw.yml` — full-stack playbook для Proxmox.
-- `/home/igor/tmp/AWatch-rus/ansible/provision_proxmox_ct_matrix_and_deploy_aw.yml` — массовый full-stack playbook (несколько CT).
-- `/home/igor/tmp/AWatch-rus/ansible/deploy_aw_windows_phase2.yml` — WinRM playbook для развёртывания phase-2 Windows collector'ов.
-- `/home/igor/tmp/AWatch-rus/ansible/deploy_aw_pfsense_poller.yml` — deployment pfSense poller'а.
-- `/home/igor/tmp/AWatch-rus/ansible/inventory.example.ini` — шаблон inventory.
-- `/home/igor/tmp/AWatch-rus/ansible/group_vars/all.example.yml` — шаблон переменных.
-- `/home/igor/tmp/AWatch-rus/ansible/group_vars/proxmox.example.yml` — шаблон переменных CT в Proxmox.
-- `/home/igor/tmp/AWatch-rus/ansible/group_vars/proxmox-matrix.example.yml` — шаблон матрицы CT.
-- `/home/igor/tmp/AWatch-rus/ansible/group_vars/windows.example.yml` — шаблон переменных Windows phase-2.
-- `/home/igor/tmp/AWatch-rus/ansible/group_vars/pfsense-poller.example.yml` — шаблон переменных pfSense poller'а.
+- `ansible/deploy_aw_server.yml` — основной playbook для уже существующего Debian/CT host.
+- `ansible/provision_proxmox_ct_and_deploy_aw.yml` — полный playbook для Proxmox.
+- `ansible/provision_proxmox_ct_matrix_and_deploy_aw.yml` — массовый полный playbook (несколько CT).
+- `ansible/deploy_aw_windows.yml` — WinRM playbook для развёртывания Windows/RDP collector'ов.
+- `ansible/deploy_aw_pfsense_poller.yml` — развёртывание pfSense poller'а.
+- `ansible/install_full_stack.yml` — полный установочный playbook (оркестратор всех этапов).
+- `ansible/inventory.example.ini` — шаблон inventory.
+- `ansible/group_vars/*.example.yml` — шаблоны переменных.
 
 ## Быстрый запуск
 
 1. Скопируйте шаблоны:
-   - `cp /home/igor/tmp/AWatch-rus/ansible/inventory.example.ini /home/igor/tmp/AWatch-rus/ansible/inventory.ini`
-   - `cp /home/igor/tmp/AWatch-rus/ansible/group_vars/all.example.yml /home/igor/tmp/AWatch-rus/ansible/group_vars/all.yml`
+   - `cp ansible/inventory.example.ini ansible/inventory.ini`
+   - `cp ansible/group_vars/all.example.yml ansible/group_vars/all.yml`
 2. Заполните значения в `inventory.ini` и `group_vars/all.yml`.
 3. Запустите:
 
 ```bash
-cd /home/igor/tmp/AWatch-rus/ansible
+cd ansible
 ansible-playbook -i inventory.ini deploy_aw_server.yml
 ```
 
+## Полный установочный playbook (всё за один запуск)
+
+Если нужно прогнать полный цикл одной командой:
+
+```bash
+cd ansible
+ansible-playbook -i inventory.ini install_full_stack.yml
+```
+
+Что делает:
+
+- `provision_proxmox_ct_and_deploy_aw.yml` (если есть хосты в группе `[proxmox]`);
+- `deploy_aw_server.yml` (группа `[aw_server]`);
+- `deploy_aw_windows.yml` (группа `[aw_windows]`);
+- `deploy_aw_pfsense_poller.yml` (группа `[aw_pfsense_pollers]`).
+
+Пустые группы в `inventory.ini` безопасны: соответствующий play будет пропущен.
+
 ## Полный запуск с нуля в Proxmox
 
 1. Подготовьте inventory и vars:
-   - `cp /home/igor/tmp/AWatch-rus/ansible/inventory.example.ini /home/igor/tmp/AWatch-rus/ansible/inventory.ini`
-   - `cp /home/igor/tmp/AWatch-rus/ansible/group_vars/all.example.yml /home/igor/tmp/AWatch-rus/ansible/group_vars/all.yml`
-   - `cp /home/igor/tmp/AWatch-rus/ansible/group_vars/proxmox.example.yml /home/igor/tmp/AWatch-rus/ansible/group_vars/proxmox.yml`
+   - `cp ansible/inventory.example.ini ansible/inventory.ini`
+   - `cp ansible/group_vars/all.example.yml ansible/group_vars/all.yml`
+   - `cp ansible/group_vars/proxmox.example.yml ansible/group_vars/proxmox.yml`
 2. Заполните `group_vars/proxmox.yml` и `group_vars/all.yml`.
 3. Запустите playbook:
 
 ```bash
-cd /home/igor/tmp/AWatch-rus/ansible
+cd ansible
 ansible-playbook -i inventory.ini provision_proxmox_ct_and_deploy_aw.yml
 ```
 
 ## Массовый запуск (матрица CT)
 
 1. Подготовьте матрицу:
-   - `cp /home/igor/tmp/AWatch-rus/ansible/group_vars/proxmox-matrix.example.yml /home/igor/tmp/AWatch-rus/ansible/group_vars/proxmox-matrix.yml`
+   - `cp ansible/group_vars/proxmox-matrix.example.yml ansible/group_vars/proxmox-matrix.yml`
 2. Заполните `proxmox-matrix.yml`.
 3. Запустите:
 
 ```bash
-cd /home/igor/tmp/AWatch-rus/ansible
+cd ansible
 ansible-playbook -i inventory.ini provision_proxmox_ct_matrix_and_deploy_aw.yml
 ```
 
-## Windows phase-2 rollout (WinRM)
+## Windows/RDP rollout (WinRM)
 
 1. Подготовьте inventory и vars:
-   - `cp /home/igor/tmp/AWatch-rus/ansible/inventory.example.ini /home/igor/tmp/AWatch-rus/ansible/inventory.ini`
-   - `cp /home/igor/tmp/AWatch-rus/ansible/group_vars/windows.example.yml /home/igor/tmp/AWatch-rus/ansible/group_vars/windows.yml`
+   - `cp ansible/inventory.example.ini ansible/inventory.ini`
+   - `cp ansible/group_vars/windows.example.yml ansible/group_vars/windows.yml`
 2. Заполните `inventory.ini` (секция `[aw_windows]`) и `group_vars/windows.yml`.
+   - Для русской локализации Windows часто нужен `ansible_user=Администратор` (а не `Administrator`).
+   - Если WinRM закрыт, playbook не сможет стартовать и нужно сначала открыть `5985/5986` и `wsman`.
 3. Запустите:
 
 ```bash
-cd /home/igor/tmp/AWatch-rus/ansible
-ansible-playbook -i inventory.ini deploy_aw_windows_phase2.yml
+cd ansible
+ansible-playbook -i inventory.ini deploy_aw_windows.yml
 ```
 
 Playbook:
 
-- выгружает `windows/*` toolkit на целевой хост в `C:\Deploy\AWatch-rus\windows`;
-- выполняет `deploy-ensemble.ps1` (deploy + hardening/recovery) с phase-2 policy/rules;
+- выгружает полный `windows/*` toolkit на целевой хост в InnoSetup-compatible каталог `C:\Program Files\AWatch-rus\windows`, включая DLP и `worktime-session-collector.ps1`;
+- если найден legacy config `C:\ProgramData\ActivityWatch-Phase2\deployment-config.json`, выполняет безопасную миграцию через `migrate-awatch-rus-paths.ps1`: backup, остановка задач, перенос данных, переписывание путей, пересоздание scheduled tasks и validation;
+- выполняет `deploy-ensemble.ps1` (deploy + hardening/recovery) с policy/rules из AWatch-rus toolkit;
+- после deploy принудительно запускает `ActivityWatch Recovery` и все `ActivityWatch Launch *` задачи;
+- выполняет API smoke-check bucket `aw-watcher-afk_<COMPUTERNAME>` и ожидает свежие `not-afk` события;
 - запускает `validate-deployment.ps1`;
 - забирает JSON-отчёт в локальную директорию (`/tmp/aw-rus-validation` по умолчанию).
 
@@ -87,17 +107,27 @@ Playbook:
 - `aw_windows_incident_capture_enabled: false` — отключить блок incidentCapture;
 - `aw_windows_incident_screenshot_enabled: false` — не делать скриншот при DLP-инциденте;
 - `aw_windows_incident_artifacts_root: 'C:\...\incident-artifacts'` — переопределить путь артефактов;
+- `aw_windows_deploy_root: 'C:\Program Files\AWatch-rus'` — каталог toolkit, совпадает с InnoSetup `{app}`;
+- `aw_windows_install_root: 'C:\Program Files\AWatch-rus\bin'` — каталог бинарников, совпадает с InnoSetup `AwDefaultInstallRoot`;
+- `aw_windows_state_root: 'C:\ProgramData\AWatch-rus'` — каталог состояния/отчётов, совпадает с InnoSetup `AwDefaultStateRoot`;
+- `aw_windows_validation_remote_path: '{{ aw_windows_state_root }}\aw_validate_ansible.json'` — отчёт Ansible-валидации хранится рядом с `ensemble-report-*.json`;
+- `aw_windows_migration_enabled: true` — включить guard миграции текущего production из `ActivityWatch-Phase2` в единый `AWatch-rus`;
+- `aw_windows_legacy_install_root` / `aw_windows_legacy_state_root` — старые production paths, откуда выполняется перенос;
+- `aw_windows_migration_report_remote_path` — JSON-отчёт о миграции на Windows-хосте;
+- `aw_windows_package_version`, `aw_windows_package_url`, `aw_windows_package_zip_path` — версия и источник Windows-пакета ActivityWatch;
+- `aw_windows_api_smoke_check_bucket: ""` — автоматически использовать `aw-watcher-afk_<COMPUTERNAME>`;
+- `aw_windows_fail_on_validation_error: true` — завершать playbook ошибкой, если `validate-deployment.ps1` возвращает `overallOk=false`;
 - `aw_windows_skip_hardening: true` — пропустить `hardening-recovery.ps1` внутри ensemble-скрипта.
 
-## pfSense poller rollout
+## Развёртывание pfSense poller
 
 1. Подготовьте vars:
-   - `cp /home/igor/tmp/AWatch-rus/ansible/group_vars/pfsense-poller.example.yml /home/igor/tmp/AWatch-rus/ansible/group_vars/pfsense-poller.yml`
+   - `cp ansible/group_vars/pfsense-poller.example.yml ansible/group_vars/pfsense-poller.yml`
 2. Добавьте inventory group `[aw_pfsense_pollers]`.
 3. Запустите:
 
 ```bash
-cd /home/igor/tmp/AWatch-rus/ansible
+cd ansible
 ansible-playbook -i inventory.ini deploy_aw_pfsense_poller.yml
 ```
 
@@ -116,4 +146,6 @@ Playbook:
 - Для Web UI используется checksum-based cache-bust для `ru-patch-v5.js` и `sw-cleanup.js`, чтобы браузер не держал старую DLP/русскую статику после деплоя.
 - На `#/home` Web UI делит хосты на `Windows RDP` и `Virtual servers + Proxmox`.
 - Выполнена валидация API `http://127.0.0.1:5600/api/0/info`.
-- Для full-stack сценария CT создаётся автоматически через `pct create`.
+- Для полного сценария CT создаётся автоматически через `pct create`.
+- На Windows/RDP host развёрнуты AFK/window watchers, browser domain collector, DLP endpoint collector и worktime session collector.
+- Проверочный JSON-отчёт Windows playbook должен иметь `overallOk=true`.

ansible/deploy_aw_pfsense_poller.yml

@@ -1,5 +1,5 @@
 ---
-- name: Deploy pfSense ActivityWatch poller
+- name: Развернуть pfSense ActivityWatch poller
   hosts: aw_pfsense_pollers
   become: true
   gather_facts: true
@@ -10,14 +10,14 @@
     aw_pfsense_service_name: "aw-pfsense-poller.service"
 
   tasks:
-    - name: Install required packages
+    - name: Установить обязательные пакеты
       ansible.builtin.apt:
         name:
           - python3
         state: present
         update_cache: true
 
-    - name: Ensure directories exist
+    - name: Создать каталоги
       ansible.builtin.file:
         path: "{{ item }}"
         state: directory
@@ -26,29 +26,29 @@
         - "{{ aw_pfsense_install_root }}"
         - "{{ aw_pfsense_config_dir }}"
 
-    - name: Install pfSense poller script
+    - name: Установить скрипт pfSense poller
       ansible.builtin.copy:
         src: "{{ aw_repo_root }}/pfsense/pfsense-aw-poller.py"
         dest: "{{ aw_pfsense_install_root }}/pfsense-aw-poller.py"
         mode: "0755"
 
-    - name: Install systemd service
+    - name: Установить systemd service
       ansible.builtin.copy:
         src: "{{ aw_repo_root }}/pfsense/pfsense-aw-poller.service"
         dest: "/etc/systemd/system/{{ aw_pfsense_service_name }}"
         mode: "0644"
       notify:
-        - Reload systemd
+        - Перезагрузить systemd
 
-    - name: Write pfSense poller config
+    - name: Записать конфигурацию pfSense poller
       ansible.builtin.copy:
         dest: "{{ aw_pfsense_config_dir }}/poller.json"
         mode: "0600"
         content: "{{ aw_pfsense_poller_config | to_nice_json }}"
       notify:
-        - Restart pfSense poller
+        - Перезапустить pfSense poller
 
-    - name: Enable and start pfSense poller
+    - name: Включить и запустить pfSense poller
       ansible.builtin.systemd:
         name: "{{ aw_pfsense_service_name }}"
         enabled: true
@@ -56,11 +56,11 @@
         daemon_reload: true
 
   handlers:
-    - name: Reload systemd
+    - name: Перезагрузить systemd
       ansible.builtin.systemd:
         daemon_reload: true
 
-    - name: Restart pfSense poller
+    - name: Перезапустить pfSense poller
       ansible.builtin.systemd:
         name: "{{ aw_pfsense_service_name }}"
         state: restarted

ansible/deploy_aw_server.yml

@@ -1,5 +1,5 @@
 ---
-- name: Deploy AWatch-rus server
+- name: Развернуть сервер AWatch-rus
   hosts: aw_server
   become: true
   gather_facts: true
@@ -9,22 +9,29 @@
     aw_release_dir: "{{ aw_release_root }}/{{ aw_server_version }}"
     aw_archive_path: "/tmp/activitywatch-{{ aw_server_version }}.zip"
     aw_bootstrap_dir: "/tmp/aw-rus-bootstrap"
+    aw_release_install_dir: "{{ aw_release_root }}/aw-server-rust-{{ aw_server_version }}"
     aw_ru_patch_cache_bust: "{{ lookup('file', aw_repo_root + '/aw-server/aw-ru-patch.js') | hash('sha1') | truncate(12, true, '') }}"
     aw_sw_cleanup_cache_bust: "{{ lookup('file', aw_repo_root + '/aw-server/aw-sw-cleanup.js') | hash('sha1') | truncate(12, true, '') }}"
-    aw_host_groups_cache_bust: "{{ lookup('file', aw_repo_root + '/aw-server/aw-host-groups.json') | hash('sha1') | truncate(12, true, '') }}"
     aw_worktime_classes: "{{ lookup('file', aw_repo_root + '/aw-server/settings/classes-worktime.json') | from_json }}"
     aw_default_views: "{{ lookup('file', aw_repo_root + '/aw-server/settings/views-default.json') | from_json }}"
 
   tasks:
-    - name: Install base packages
+    - name: Установить базовые пакеты
       ansible.builtin.apt:
         name:
           - curl
+          - rsync
           - unzip
         state: present
         update_cache: true
 
-    - name: Ensure service account exists
+    - name: Создать системную группу сервиса
+      ansible.builtin.group:
+        name: "{{ aw_server_group }}"
+        system: true
+        state: present
+
+    - name: Создать системную учётную запись сервиса
       ansible.builtin.user:
         name: "{{ aw_server_user }}"
         group: "{{ aw_server_group }}"
@@ -33,7 +40,25 @@
         system: true
         create_home: false
 
-    - name: Ensure required directories
+    - name: Создать обязательные каталоги
+      ansible.builtin.file:
+        path: "{{ item }}"
+        state: directory
+        mode: "0755"
+      loop:
+        - "{{ aw_release_root }}"
+        - "{{ aw_release_dir }}"
+        - "{{ aw_release_install_dir }}"
+        - /opt/activitywatch
+        - /opt/activitywatch/bin
+        - "{{ aw_server_webui_dir }}"
+        - "{{ aw_server_webui_dir }}/js"
+        - "{{ aw_server_data_dir }}"
+        - "{{ aw_server_log_dir }}"
+        - /etc/activitywatch
+        - "{{ aw_bootstrap_dir }}"
+
+    - name: Настроить каталоги ActivityWatch с владельцем сервиса
       ansible.builtin.file:
         path: "{{ item }}"
         state: directory
@@ -41,103 +66,188 @@
         group: "{{ aw_server_group }}"
         mode: "0755"
       loop:
+        - /opt/activitywatch
+        - /opt/activitywatch/bin
         - "{{ aw_release_root }}"
         - "{{ aw_release_dir }}"
+        - "{{ aw_release_install_dir }}"
         - "{{ aw_server_webui_dir }}"
+        - "{{ aw_server_webui_dir }}/js"
         - "{{ aw_server_data_dir }}"
         - "{{ aw_server_log_dir }}"
-        - /etc/activitywatch
-        - "{{ aw_bootstrap_dir }}"
 
-    - name: Download ActivityWatch release archive
+    - name: Скачать архив релиза ActivityWatch
       ansible.builtin.get_url:
         url: "{{ aw_server_download_url }}"
         dest: "{{ aw_archive_path }}"
         mode: "0644"
 
-    - name: Unpack ActivityWatch release
+    - name: Распаковать релиз ActivityWatch
       ansible.builtin.unarchive:
         src: "{{ aw_archive_path }}"
         dest: "{{ aw_release_dir }}"
         remote_src: true
         extra_opts: ["-o"]
 
-    - name: Discover extracted AW directory
+    - name: Найти распакованный каталог ActivityWatch
       ansible.builtin.find:
         paths: "{{ aw_release_dir }}"
         file_type: directory
         patterns: "activitywatch*"
       register: aw_release_find
 
-    - name: Set release extracted path
-      ansible.builtin.set_fact:
-        aw_release_extracted: "{{ (aw_release_find.files | sort(attribute='path') | map(attribute='path') | list | first) }}"
+    - name: Найти бинарный файл AW server
+      ansible.builtin.find:
+        paths: "{{ aw_release_dir }}"
+        file_type: file
+        patterns:
+          - aw-server-rust
+          - aw-server
+      register: aw_server_binary_find
 
-    - name: Verify extracted directory exists
+    - name: Найти каталог WebUI
+      ansible.builtin.find:
+        paths: "{{ aw_release_dir }}"
+        file_type: directory
+        patterns:
+          - aw-webui
+          - webui
+      register: aw_webui_dir_find
+
+    - name: Сохранить пути распакованного релиза
+      ansible.builtin.set_fact:
+        aw_release_extracted: "{{ (aw_release_find.files | default([]) | sort(attribute='path') | map(attribute='path') | list | first) | default('') }}"
+        aw_server_binary_path: "{{ (aw_server_binary_find.files | default([]) | sort(attribute='path') | map(attribute='path') | list | first) | default('') }}"
+        aw_webui_source_path: "{{ (aw_webui_dir_find.files | default([]) | sort(attribute='path') | map(attribute='path') | list | first) | default('') }}"
+
+    - name: Проверить, что компоненты релиза найдены
       ansible.builtin.assert:
         that:
           - aw_release_extracted is defined
           - aw_release_extracted | length > 0
-        fail_msg: "Cannot locate extracted ActivityWatch release directory."
+          - aw_server_binary_path is defined
+          - aw_server_binary_path | length > 0
+          - aw_webui_source_path is defined
+          - aw_webui_source_path | length > 0
+        fail_msg: "Не удалось найти бинарный файл или WebUI в распакованном релизе ActivityWatch."
 
-    - name: Sync release content to /opt/activitywatch
+    - name: Создать каталог установленного релиза
+      ansible.builtin.file:
+        path: "{{ aw_release_install_dir }}"
+        state: directory
+        owner: "{{ aw_server_user }}"
+        group: "{{ aw_server_group }}"
+        mode: "0755"
+
+    - name: Установить бинарный файл AW server
+      ansible.builtin.copy:
+        remote_src: true
+        src: "{{ aw_server_binary_path }}"
+        dest: "{{ aw_release_install_dir }}/aw-server-rust"
+        owner: "{{ aw_server_user }}"
+        group: "{{ aw_server_group }}"
+        mode: "0755"
+
+    - name: Создать ссылку на активный бинарный файл AW server
+      ansible.builtin.file:
+        src: "{{ aw_release_install_dir }}/aw-server-rust"
+        dest: /opt/activitywatch/bin/aw-server-rust
+        owner: "{{ aw_server_user }}"
+        group: "{{ aw_server_group }}"
+        state: link
+        force: true
+
+    - name: Синхронизировать WebUI в RU каталог
       ansible.builtin.command:
-        cmd: "rsync -a --delete {{ aw_release_extracted }}/ /opt/activitywatch/"
+        cmd: "rsync -a {{ aw_webui_source_path }}/ {{ aw_server_webui_dir }}/"
 
-    - name: Copy bootstrap files from repository
+    - name: Настроить владельца файлов /opt/activitywatch
+      ansible.builtin.file:
+        path: /opt/activitywatch
+        state: directory
+        owner: "{{ aw_server_user }}"
+        group: "{{ aw_server_group }}"
+        recurse: true
+
+    - name: Установить systemd service из шаблона репозитория
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/activitywatch-server.service
+        mode: "0644"
+        content: >-
+          {{
+            lookup('file', aw_repo_root + '/aw-server/activitywatch-server.service')
+            | replace('__AW_SERVER_USER__', aw_server_user)
+            | replace('__AW_SERVER_GROUP__', aw_server_group)
+            | replace('__AW_SERVER_DATA_DIR__', aw_server_data_dir)
+          }}
+      notify:
+        - Перезагрузить systemd
+        - Перезапустить activitywatch
+
+    - name: Скопировать RU patch файлы WebUI из репозитория
       ansible.builtin.copy:
         src: "{{ item.src }}"
         dest: "{{ item.dest }}"
         mode: "{{ item.mode }}"
+        owner: "{{ aw_server_user }}"
+        group: "{{ aw_server_group }}"
       loop:
-        - { src: "{{ aw_repo_root }}/aw-server/activitywatch-server.service", dest: "/etc/systemd/system/activitywatch-server.service", mode: "0644" }
         - { src: "{{ aw_repo_root }}/aw-server/aw-ru-patch.js", dest: "{{ aw_server_webui_dir }}/js/ru-patch-v5.js", mode: "0644" }
         - { src: "{{ aw_repo_root }}/aw-server/aw-sw-cleanup.js", dest: "{{ aw_server_webui_dir }}/js/sw-cleanup.js", mode: "0644" }
         - { src: "{{ aw_repo_root }}/aw-server/aw-host-groups.json", dest: "{{ aw_server_webui_dir }}/js/aw-host-groups.json", mode: "0644" }
-      notify:
-        - Reload systemd
-        - Restart activitywatch
 
-    - name: Copy WebUI index template from installed distribution
-      ansible.builtin.copy:
-        remote_src: true
-        src: "/opt/activitywatch/aw-webui/index.html"
-        dest: "{{ aw_server_webui_dir }}/index.html"
-        mode: "0644"
+    - name: Проверить наличие index.html после копирования
+      ansible.builtin.stat:
+        path: "{{ aw_server_webui_dir }}/index.html"
+      register: aw_webui_ru_index
 
-    - name: Insert RU patch scripts into index.html
+    - name: Проверить, что index.html доступен для RU patch
+      ansible.builtin.assert:
+        that:
+          - aw_webui_ru_index.stat.exists
+        fail_msg: "Не найден index.html WebUI для применения RU patch."
+
+    - name: Удалить старые теги RU patch из index.html
+      ansible.builtin.replace:
+        path: "{{ aw_server_webui_dir }}/index.html"
+        regexp: '<script[^>]+(?:ru-patch-v5\.js|sw-cleanup\.js|aw-ru-patch\.js|aw-sw-cleanup\.js)[^>]*></script>'
+        replace: ''
+
+    - name: Добавить cleanup script RU patch в index.html
       ansible.builtin.replace:
         path: "{{ aw_server_webui_dir }}/index.html"
         regexp: '</head>'
         replace: '<script src="/js/sw-cleanup.js?v={{ aw_sw_cleanup_cache_bust }}"></script></head>'
 
-    - name: Insert RU patch loader before body end
+    - name: Добавить загрузчик RU patch перед закрытием body
       ansible.builtin.replace:
         path: "{{ aw_server_webui_dir }}/index.html"
         regexp: '</body>'
         replace: '<script defer="defer" src="/js/ru-patch-v5.js?v={{ aw_ru_patch_cache_bust }}"></script></body>'
 
-    - name: Write /etc/activitywatch/aw-server.env
+    - name: Записать /etc/activitywatch/aw-server.env
       ansible.builtin.copy:
         dest: /etc/activitywatch/aw-server.env
         mode: "0640"
+        owner: root
+        group: root
         content: |
-          AW_SERVER_HOST={{ aw_server_bind_host }}
+          AW_SERVER_BIND_HOST={{ aw_server_bind_host }}
           AW_SERVER_PORT={{ aw_server_port }}
-          AW_DATA_DIR={{ aw_server_data_dir }}
-          AW_LOG_DIR={{ aw_server_log_dir }}
-          AW_WEBUI_DIR={{ aw_server_webui_dir }}
+          AW_SERVER_DATA_DIR={{ aw_server_data_dir }}
+          AW_SERVER_LOG_DIR={{ aw_server_log_dir }}
+          AW_SERVER_WEBUI_DIR={{ aw_server_webui_dir }}
           AW_SERVER_USER={{ aw_server_user }}
           AW_SERVER_GROUP={{ aw_server_group }}
 
-    - name: Enable and start service
+    - name: Включить и запустить сервис
       ansible.builtin.systemd:
         name: activitywatch-server.service
         enabled: true
         state: restarted
         daemon_reload: true
 
-    - name: Wait for API
+    - name: Дождаться ответа API
       ansible.builtin.uri:
         url: "http://127.0.0.1:{{ aw_server_port }}/api/0/info"
         method: GET
@@ -147,25 +257,25 @@
       delay: 3
       until: aw_api.status == 200
 
-    - name: Apply baseline worktime settings (classes)
+    - name: Применить базовые worktime settings (classes)
       ansible.builtin.uri:
         url: "http://127.0.0.1:{{ aw_server_port }}/api/0/settings/classes"
         method: POST
         body: "{{ aw_worktime_classes }}"
         body_format: json
-        status_code: 201
+        status_code: [200, 201]
       when: aw_apply_worktime_settings | default(false) | bool
 
-    - name: Apply baseline views (include DLP and worktime)
+    - name: Применить базовые views для DLP и worktime
       ansible.builtin.uri:
         url: "http://127.0.0.1:{{ aw_server_port }}/api/0/settings/views"
         method: POST
         body: "{{ aw_default_views }}"
         body_format: json
-        status_code: 201
+        status_code: [200, 201]
       when: aw_apply_worktime_settings | default(false) | bool
 
-    - name: Derive worktime durationDefault from aw_worktime_from/to
+    - name: Вычислить worktime durationDefault из aw_worktime_from/to
       ansible.builtin.set_fact:
         aw_worktime_from_h: "{{ (aw_worktime_from | default('08:00')).split(':')[0] | int }}"
         aw_worktime_from_m: "{{ (aw_worktime_from | default('08:00')).split(':')[1] | int }}"
@@ -182,7 +292,7 @@
           }}
       when: aw_apply_worktime_settings | default(false) | bool
 
-    - name: Normalize derived durationDefault for overnight shifts
+    - name: Нормализовать durationDefault для ночных смен
       ansible.builtin.set_fact:
         aw_worktime_duration_default_effective: >-
           {{
@@ -192,15 +302,15 @@
           }}
       when: aw_apply_worktime_settings | default(false) | bool
 
-    - name: Validate derived durationDefault is sane
+    - name: Проверить корректность durationDefault
       ansible.builtin.assert:
         that:
           - aw_worktime_duration_default_effective | int > 0
           - aw_worktime_duration_default_effective | int <= 86400
-        fail_msg: "Invalid worktime window: {{ aw_worktime_from }}..{{ aw_worktime_to }}"
+        fail_msg: "Некорректный интервал рабочего времени: {{ aw_worktime_from }}..{{ aw_worktime_to }}"
       when: aw_apply_worktime_settings | default(false) | bool
 
-    - name: Apply baseline worktime period (startOfDay)
+    - name: Применить базовый период worktime (startOfDay)
       ansible.builtin.uri:
         url: "http://127.0.0.1:{{ aw_server_port }}/api/0/settings/startOfDay"
         method: POST
@@ -209,7 +319,7 @@
         status_code: 200
       when: aw_apply_worktime_settings | default(false) | bool
 
-    - name: Apply baseline worktime period (durationDefault seconds)
+    - name: Применить базовый период worktime (durationDefault seconds)
       ansible.builtin.uri:
         url: "http://127.0.0.1:{{ aw_server_port }}/api/0/settings/durationDefault"
         method: POST
@@ -219,11 +329,11 @@
       when: aw_apply_worktime_settings | default(false) | bool
 
   handlers:
-    - name: Reload systemd
+    - name: Перезагрузить systemd
       ansible.builtin.systemd:
         daemon_reload: true
 
-    - name: Restart activitywatch
+    - name: Перезапустить activitywatch
       ansible.builtin.systemd:
         name: activitywatch-server.service
         state: restarted

ansible/deploy_aw_windows.yml

@@ -0,0 +1,232 @@
+---
+- name: Развернуть Windows/RDP collector'ы AWatch-rus
+  hosts: aw_windows
+  gather_facts: false
+
+  vars:
+    aw_windows_repo_root: "{{ playbook_dir | dirname }}"
+    aw_windows_deploy_root: "C:\\Program Files\\AWatch-rus"
+    aw_windows_server_scheme: "http"
+    aw_windows_server_host: "10.10.10.13"
+    aw_windows_server_port: 5600
+    aw_windows_package_version: "v0.13.2"
+    aw_windows_package_url: "https://github.com/ActivityWatch/activitywatch/releases/download/v0.13.2/activitywatch-v0.13.2-windows-x86_64.zip"
+    aw_windows_package_zip_path: ""
+    aw_windows_domain: "SHARKON2025"
+    aw_windows_users:
+      - user1
+      - user2
+      - user3
+      - user4
+      - user5
+    aw_windows_extra_users: []
+    aw_windows_users_effective: "{{ (aw_windows_users + aw_windows_extra_users) | unique }}"
+    aw_windows_install_root: "C:\\Program Files\\AWatch-rus\\bin"
+    aw_windows_state_root: "C:\\ProgramData\\AWatch-rus"
+    aw_windows_afk_enabled: true
+    aw_windows_window_enabled: true
+    aw_windows_local_agent_logs_enabled: false
+    aw_windows_incident_capture_enabled: true
+    aw_windows_incident_screenshot_enabled: true
+    aw_windows_incident_artifacts_root: "{{ aw_windows_state_root }}\\incident-artifacts"
+    aw_windows_logon_marker_enabled: true
+    aw_windows_skip_hardening: false
+    aw_windows_rules_path: "{{ aw_windows_deploy_root }}\\windows\\web-category-rules.example.json"
+    aw_windows_policy_path: "{{ aw_windows_deploy_root }}\\windows\\dlp-policy.example.json"
+    aw_windows_validation_remote_path: "{{ aw_windows_state_root }}\\aw_validate_ansible.json"
+    aw_windows_validation_local_dir: "/tmp/aw-rus-validation"
+    aw_windows_launch_task_pattern: "ActivityWatch Launch *"
+    aw_windows_recovery_task_name: "ActivityWatch Recovery"
+    aw_windows_force_task_restart: true
+    aw_windows_api_smoke_check_enabled: true
+    aw_windows_api_smoke_check_bucket: ""
+    aw_windows_api_smoke_check_limit: 10
+    aw_windows_fail_on_validation_error: true
+    aw_windows_migration_enabled: true
+    aw_windows_legacy_install_root: "C:\\Program Files\\ActivityWatch-Phase2"
+    aw_windows_legacy_state_root: "C:\\ProgramData\\ActivityWatch-Phase2"
+    aw_windows_migration_report_remote_path: "{{ aw_windows_state_root }}\\aw_migration_ansible.json"
+
+  tasks:
+    - name: Проверить обязательные переменные
+      ansible.builtin.assert:
+        that:
+          - aw_windows_server_host is defined
+          - aw_windows_server_port is defined
+          - aw_windows_server_scheme is defined
+          - aw_windows_domain is defined
+          - aw_windows_users_effective | length > 0
+          - aw_windows_install_root is defined
+          - aw_windows_state_root is defined
+        fail_msg: "Не заданы обязательные переменные Windows-развёртывания."
+
+    - name: Создать каталоги развёртывания
+      ansible.windows.win_file:
+        path: "{{ item }}"
+        state: directory
+      loop:
+        - "{{ aw_windows_deploy_root }}"
+        - "{{ aw_windows_deploy_root }}\\windows"
+
+    - name: Загрузить Windows toolkit развёртывания
+      ansible.windows.win_copy:
+        src: "{{ aw_windows_repo_root }}/windows/{{ item }}"
+        dest: "{{ aw_windows_deploy_root }}\\windows\\{{ item }}"
+      loop:
+        - ActivityWatch.Windows.Common.psd1
+        - ActivityWatch.Windows.Common.psm1
+        - browser-domains-native-collector.ps1
+        - dlp-endpoint-signals-collector.ps1
+        - worktime-session-collector.ps1
+        - migrate-awatch-rus-paths.ps1
+        - deploy-domain-users.ps1
+        - deploy-ensemble.ps1
+        - hardening-recovery.ps1
+        - validate-deployment.ps1
+        - web-category-rules.example.json
+        - dlp-policy.example.json
+
+    - name: Загрузить список пользователей для доменного развёртывания
+      ansible.windows.win_copy:
+        dest: "{{ aw_windows_deploy_root }}\\windows\\users.txt"
+        content: |
+          {% for user in aw_windows_users_effective -%}
+          {{ user }}
+          {% endfor -%}
+
+    - name: Проверить нужен ли migration с legacy ActivityWatch путей
+      when: aw_windows_migration_enabled | bool
+      ansible.windows.win_stat:
+        path: "{{ aw_windows_legacy_state_root }}\\deployment-config.json"
+      register: aw_windows_legacy_config
+
+    - name: Выполнить безопасную migration legacy prod в AWatch-rus
+      when:
+        - aw_windows_migration_enabled | bool
+        - aw_windows_legacy_config.stat.exists | default(false)
+      ansible.windows.win_powershell:
+        script: |
+          $ErrorActionPreference = 'Stop'
+          $result = & "{{ aw_windows_deploy_root }}\windows\migrate-awatch-rus-paths.ps1" `
+            -OldInstallRoot "{{ aw_windows_legacy_install_root }}" `
+            -OldStateRoot "{{ aw_windows_legacy_state_root }}" `
+            -NewInstallRoot "{{ aw_windows_install_root }}" `
+            -NewStateRoot "{{ aw_windows_state_root }}" `
+            -ToolkitRoot "{{ aw_windows_deploy_root }}\windows"
+          $result | ConvertTo-Json -Depth 8 | Out-File -FilePath "{{ aw_windows_migration_report_remote_path }}" -Encoding utf8
+
+    - name: Запустить Windows/RDP ensemble развёртывание
+      ansible.windows.win_powershell:
+        script: |
+          $ErrorActionPreference = 'Stop'
+          $params = @{
+            ServerScheme = "{{ aw_windows_server_scheme }}"
+            ServerHost = "{{ aw_windows_server_host }}"
+            ServerPort = {{ aw_windows_server_port }}
+            Version = "{{ aw_windows_package_version }}"
+            Domain = "{{ aw_windows_domain }}"
+            UserListPath = "{{ aw_windows_deploy_root }}\windows\users.txt"
+            InstallRoot = "{{ aw_windows_install_root }}"
+            StateRoot = "{{ aw_windows_state_root }}"
+            AfkEnabled = {{ '$true' if (aw_windows_afk_enabled | bool) else '$false' }}
+            WindowEnabled = {{ '$true' if (aw_windows_window_enabled | bool) else '$false' }}
+            LocalAgentLogsEnabled = {{ '$true' if (aw_windows_local_agent_logs_enabled | bool) else '$false' }}
+            IncidentCaptureEnabled = {{ '$true' if (aw_windows_incident_capture_enabled | bool) else '$false' }}
+            IncidentScreenshotEnabled = {{ '$true' if (aw_windows_incident_screenshot_enabled | bool) else '$false' }}
+            IncidentArtifactsRoot = "{{ aw_windows_incident_artifacts_root }}"
+            LogonMarkerEnabled = {{ '$true' if (aw_windows_logon_marker_enabled | bool) else '$false' }}
+            CustomRulesPath = "{{ aw_windows_rules_path }}"
+            CustomPolicyPath = "{{ aw_windows_policy_path }}"
+          }
+          {% if (aw_windows_package_url | default('') | string | length) > 0 %}
+          $params.PackageUrl = "{{ aw_windows_package_url }}"
+          {% endif %}
+          {% if (aw_windows_package_zip_path | default('') | string | length) > 0 %}
+          $params.PackageZipPath = "{{ aw_windows_package_zip_path }}"
+          {% endif %}
+          {% if aw_windows_skip_hardening | bool %}
+          $params.SkipHardening = $true
+          {% endif %}
+          & "{{ aw_windows_deploy_root }}\windows\deploy-ensemble.ps1" @params
+
+    - name: Принудительно запустить ActivityWatch recovery и launch tasks
+      when: aw_windows_force_task_restart | bool
+      ansible.windows.win_powershell:
+        script: |
+          $ErrorActionPreference = 'Stop'
+          Start-ScheduledTask -TaskName "{{ aw_windows_recovery_task_name }}"
+          Get-ScheduledTask |
+            Where-Object TaskName -like "{{ aw_windows_launch_task_pattern }}" |
+            ForEach-Object { Start-ScheduledTask -TaskName $_.TaskName }
+
+    - name: Получить Windows hostname для AW smoke-check bucket
+      when:
+        - aw_windows_api_smoke_check_enabled | bool
+        - aw_windows_afk_enabled | bool
+      ansible.windows.win_command: powershell.exe -NoProfile -Command "$env:COMPUTERNAME"
+      register: aw_windows_hostname_result
+      changed_when: false
+
+    - name: Вычислить AW AFK smoke-check bucket
+      when:
+        - aw_windows_api_smoke_check_enabled | bool
+        - aw_windows_afk_enabled | bool
+      ansible.builtin.set_fact:
+        aw_windows_api_smoke_check_bucket_effective: >-
+          {{
+            aw_windows_api_smoke_check_bucket
+            if (aw_windows_api_smoke_check_bucket | default('') | string | length) > 0
+            else 'aw-watcher-afk_' ~ (aw_windows_hostname_result.stdout | trim)
+          }}
+
+    - name: Дождаться свежих AFK событий на AW server
+      when:
+        - aw_windows_api_smoke_check_enabled | bool
+        - aw_windows_afk_enabled | bool
+      delegate_to: localhost
+      ansible.builtin.uri:
+        url: "{{ aw_windows_server_scheme }}://{{ aw_windows_server_host }}:{{ aw_windows_server_port }}/api/0/buckets/{{ aw_windows_api_smoke_check_bucket_effective }}/events?limit={{ aw_windows_api_smoke_check_limit }}"
+        method: GET
+        return_content: true
+      register: aw_windows_api_smoke
+      until: >
+        aw_windows_api_smoke.status == 200 and
+        (aw_windows_api_smoke.json | length) > 0 and
+        (
+          aw_windows_api_smoke.json
+          | selectattr('data.status', 'equalto', 'not-afk')
+          | list
+          | length
+        ) > 0
+      retries: 10
+      delay: 6
+
+    - name: Выполнить валидацию и сохранить отчёт на целевом Windows host
+      ansible.windows.win_powershell:
+        script: |
+          $ErrorActionPreference = 'Stop'
+          $report = & "{{ aw_windows_deploy_root }}\windows\validate-deployment.ps1" `
+            -ConfigPath "{{ aw_windows_state_root }}\deployment-config.json"
+          $report | ConvertTo-Json -Depth 12 | Out-File -FilePath "{{ aw_windows_validation_remote_path }}" -Encoding utf8
+          if ({{ '$true' if (aw_windows_fail_on_validation_error | bool) else '$false' }} -and -not [bool]$report.overallOk) {
+            throw "Проверка развёртывания ActivityWatch завершилась ошибкой. Отчёт: {{ aw_windows_validation_remote_path }}"
+          }
+
+    - name: Создать локальный каталог для validation reports
+      ansible.builtin.file:
+        path: "{{ aw_windows_validation_local_dir }}"
+        state: directory
+        mode: "0755"
+      delegate_to: localhost
+
+    - name: Забрать validation report
+      ansible.builtin.fetch:
+        src: "{{ aw_windows_validation_remote_path }}"
+        dest: "{{ aw_windows_validation_local_dir }}/{{ inventory_hostname }}-aw_validate_ansible.json"
+        flat: true
+
+    - name: Показать путь к отчёту
+      ansible.builtin.debug:
+        msg:
+          - "Windows/RDP развёртывание завершено на {{ inventory_hostname }}."
+          - "Отчёт проверки: {{ aw_windows_validation_local_dir }}/{{ inventory_hostname }}-aw_validate_ansible.json"

ansible/deploy_aw_windows_phase2.yml

@@ -1,133 +0,0 @@
----
-- name: Deploy AWatch-rus Windows phase2 collectors
-  hosts: aw_windows
-  gather_facts: false
-
-  vars:
-    aw_windows_repo_root: "/home/igor/tmp/AWatch-rus"
-    aw_windows_deploy_root: "C:\\Deploy\\AWatch-rus"
-    aw_windows_server_host: "10.10.10.13"
-    aw_windows_server_port: 5600
-    aw_windows_domain: "SHARKON2025"
-    aw_windows_users:
-      - user1
-      - user2
-      - user3
-      - user4
-      - user5
-    aw_windows_extra_users: []
-    aw_windows_users_effective: "{{ (aw_windows_users + aw_windows_extra_users) | unique }}"
-    aw_windows_install_root: "C:\\Program Files\\ActivityWatch-Phase2"
-    aw_windows_state_root: "C:\\ProgramData\\ActivityWatch-Phase2"
-    aw_windows_afk_enabled: true
-    aw_windows_window_enabled: true
-    aw_windows_local_agent_logs_enabled: false
-    aw_windows_incident_capture_enabled: true
-    aw_windows_incident_screenshot_enabled: true
-    aw_windows_incident_artifacts_root: "{{ aw_windows_state_root }}\\incident-artifacts"
-    aw_windows_logon_marker_enabled: true
-    aw_windows_skip_hardening: false
-    aw_windows_rules_path: "{{ aw_windows_deploy_root }}\\windows\\web-category-rules.example.json"
-    aw_windows_policy_path: "{{ aw_windows_deploy_root }}\\windows\\dlp-policy.example.json"
-    aw_windows_validation_remote_path: "C:\\Windows\\Temp\\aw_validate_phase2_ansible.json"
-    aw_windows_validation_local_dir: "/tmp/aw-rus-validation"
-
-  tasks:
-    - name: Validate required variables
-      ansible.builtin.assert:
-        that:
-          - aw_windows_server_host is defined
-          - aw_windows_server_port is defined
-          - aw_windows_domain is defined
-          - aw_windows_users_effective | length > 0
-          - aw_windows_install_root is defined
-          - aw_windows_state_root is defined
-        fail_msg: "Missing required Windows deployment variables."
-
-    - name: Ensure deploy directories exist
-      ansible.windows.win_file:
-        path: "{{ item }}"
-        state: directory
-      loop:
-        - "{{ aw_windows_deploy_root }}"
-        - "{{ aw_windows_deploy_root }}\\windows"
-
-    - name: Upload Windows deployment toolkit
-      ansible.windows.win_copy:
-        src: "{{ aw_windows_repo_root }}/windows/{{ item }}"
-        dest: "{{ aw_windows_deploy_root }}\\windows\\{{ item }}"
-      loop:
-        - ActivityWatch.Windows.Common.psd1
-        - ActivityWatch.Windows.Common.psm1
-        - browser-domains-native-collector.ps1
-        - dlp-endpoint-signals-collector.ps1
-        - deploy-domain-users.ps1
-        - deploy-ensemble.ps1
-        - hardening-recovery.ps1
-        - validate-deployment.ps1
-        - web-category-rules.example.json
-        - dlp-policy.example.json
-
-    - name: Upload user list for domain deploy
-      ansible.windows.win_copy:
-        dest: "{{ aw_windows_deploy_root }}\\windows\\users.txt"
-        content: |
-          {% for user in aw_windows_users -%}
-          {{ user }}
-          {% endfor -%}
-          {% for user in aw_windows_extra_users -%}
-          {{ user }}
-          {% endfor -%}
-
-    - name: Run phase2 ensemble deployment
-      ansible.windows.win_powershell:
-        script: |
-          $ErrorActionPreference = 'Stop'
-          $params = @{
-            ServerHost = "{{ aw_windows_server_host }}"
-            ServerPort = {{ aw_windows_server_port }}
-            Domain = "{{ aw_windows_domain }}"
-            UserListPath = "{{ aw_windows_deploy_root }}\windows\users.txt"
-            InstallRoot = "{{ aw_windows_install_root }}"
-            StateRoot = "{{ aw_windows_state_root }}"
-            AfkEnabled = {{ '$true' if (aw_windows_afk_enabled | bool) else '$false' }}
-            WindowEnabled = {{ '$true' if (aw_windows_window_enabled | bool) else '$false' }}
-            LocalAgentLogsEnabled = {{ '$true' if (aw_windows_local_agent_logs_enabled | bool) else '$false' }}
-            IncidentCaptureEnabled = {{ '$true' if (aw_windows_incident_capture_enabled | bool) else '$false' }}
-            IncidentScreenshotEnabled = {{ '$true' if (aw_windows_incident_screenshot_enabled | bool) else '$false' }}
-            IncidentArtifactsRoot = "{{ aw_windows_incident_artifacts_root }}"
-            LogonMarkerEnabled = {{ '$true' if (aw_windows_logon_marker_enabled | bool) else '$false' }}
-            CustomRulesPath = "{{ aw_windows_rules_path }}"
-            CustomPolicyPath = "{{ aw_windows_policy_path }}"
-          }
-          {% if aw_windows_skip_hardening | bool %}
-          $params.SkipHardening = $true
-          {% endif %}
-          & "{{ aw_windows_deploy_root }}\windows\deploy-ensemble.ps1" @params
-
-    - name: Run validation and store report on target
-      ansible.windows.win_powershell:
-        script: |
-          $ErrorActionPreference = 'Stop'
-          $report = & "{{ aw_windows_deploy_root }}\windows\validate-deployment.ps1" `
-            -ConfigPath "{{ aw_windows_state_root }}\deployment-config.json"
-          $report | ConvertTo-Json -Depth 12 | Out-File -FilePath "{{ aw_windows_validation_remote_path }}" -Encoding utf8
-
-    - name: Ensure local validation directory exists
-      ansible.builtin.file:
-        path: "{{ aw_windows_validation_local_dir }}"
-        state: directory
-        mode: "0755"
-      delegate_to: localhost
-
-    - name: Fetch validation report
-      ansible.builtin.fetch:
-        src: "{{ aw_windows_validation_remote_path }}"
-        dest: "{{ aw_windows_validation_local_dir }}/"
-        flat: false
-
-    - name: Show report location
-      ansible.builtin.debug:
-        msg:
-          - "Windows phase2 deploy completed on {{ inventory_hostname }}."
-          - "Validation report: {{ aw_windows_validation_local_dir }}/{{ inventory_hostname }}/C$/Windows/Temp/aw_validate_phase2_ansible.json"

ansible/group_vars/all.example.yml

@@ -8,17 +8,17 @@ aw_server_log_dir: "/var/log/activitywatch"
 aw_server_user: "activitywatch"
 aw_server_group: "activitywatch"
 
-aw_repo_root: "/home/igor/tmp/AWatch-rus"
+aw_repo_root: "{{ playbook_dir | dirname }}"
 
-# Optional: apply a baseline worktime-focused categorization and views via AW settings API.
-# WARNING: this overwrites existing server-side settings/classes/views.
+# Опционально: применить базовые категории и views для рабочего времени через AW settings API.
+# Внимание: это перезаписывает существующие server-side settings/classes/views.
 aw_apply_worktime_settings: false
 
-# Optional defaults for the worktime period in Web UI.
-# startOfDay controls day-boundary and default report window start.
-# durationDefault controls default time range (seconds) shown in UI.
+# Опциональные значения периода рабочего времени в Web UI.
+# startOfDay задаёт границу дня и стартовое время окна отчёта.
+# durationDefault задаёт диапазон по умолчанию в секундах.
 #
-# Recommended: set worktime window explicitly and let the playbook derive duration.
+# Рекомендуется явно задать рабочий интервал и дать playbook вычислить duration.
 aw_worktime_from: "08:00"
 aw_worktime_to: "17:00"
 aw_worktime_start_of_day: "{{ aw_worktime_from }}"

ansible/group_vars/windows.example.yml

@@ -1,7 +1,11 @@
-aw_windows_repo_root: "/home/igor/tmp/AWatch-rus"
-aw_windows_deploy_root: "C:\\Deploy\\AWatch-rus"
+aw_windows_repo_root: "{{ playbook_dir | dirname }}"
+aw_windows_deploy_root: "C:\\Program Files\\AWatch-rus"
+aw_windows_server_scheme: "http"
 aw_windows_server_host: "10.10.10.13"
 aw_windows_server_port: 5600
+aw_windows_package_version: "v0.13.2"
+aw_windows_package_url: "https://github.com/ActivityWatch/activitywatch/releases/download/v0.13.2/activitywatch-v0.13.2-windows-x86_64.zip"
+aw_windows_package_zip_path: ""
 aw_windows_domain: "SHARKON2025"
 aw_windows_users:
   - user1
@@ -14,9 +18,9 @@ aw_windows_extra_users: []
 # aw_windows_extra_users:
 #   - Администратор
 
-# Рекомендуемый изолированный профиль для фазового раската.
-aw_windows_install_root: "C:\\Program Files\\ActivityWatch-Phase2"
-aw_windows_state_root: "C:\\ProgramData\\ActivityWatch-Phase2"
+# Единые Windows/RDP пути: те же, что использует InnoSetup.
+aw_windows_install_root: "C:\\Program Files\\AWatch-rus\\bin"
+aw_windows_state_root: "C:\\ProgramData\\AWatch-rus"
 aw_windows_afk_enabled: true
 aw_windows_window_enabled: true
 aw_windows_local_agent_logs_enabled: false
@@ -29,5 +33,18 @@ aw_windows_skip_hardening: false
 aw_windows_rules_path: "{{ aw_windows_deploy_root }}\\windows\\web-category-rules.example.json"
 aw_windows_policy_path: "{{ aw_windows_deploy_root }}\\windows\\dlp-policy.example.json"
 
-aw_windows_validation_remote_path: "C:\\Windows\\Temp\\aw_validate_phase2_ansible.json"
+aw_windows_validation_remote_path: "{{ aw_windows_state_root }}\\aw_validate_ansible.json"
 aw_windows_validation_local_dir: "/tmp/aw-rus-validation"
+aw_windows_fail_on_validation_error: true
+
+# Безопасная миграция текущего прода со старых путей в единый профиль AWatch-rus.
+aw_windows_migration_enabled: true
+aw_windows_legacy_install_root: "C:\\Program Files\\ActivityWatch-Phase2"
+aw_windows_legacy_state_root: "C:\\ProgramData\\ActivityWatch-Phase2"
+aw_windows_migration_report_remote_path: "{{ aw_windows_state_root }}\\aw_migration_ansible.json"
+
+# По умолчанию AFK bucket вычисляется как aw-watcher-afk_<COMPUTERNAME>.
+# Задайте явное значение только если watcher пишет в нестандартный bucket.
+aw_windows_api_smoke_check_enabled: true
+aw_windows_api_smoke_check_bucket: ""
+aw_windows_api_smoke_check_limit: 10

ansible/install_full_stack.yml

@@ -0,0 +1,16 @@
+---
+# Полный установщик AWatch-rus.
+# Выполняет развёртывание одной командой:
+# 1) создание Proxmox CT + bootstrap AW (если в inventory есть [proxmox])
+# 2) развёртывание AW server на хостах [aw_server]
+# 3) развёртывание Windows/RDP collector'ов на [aw_windows]
+# 4) развёртывание pfSense poller'а на [aw_pfsense_pollers]
+#
+# Примечания:
+# - Заполняйте только нужные группы inventory для своего окружения.
+# - Play без совпадающих host groups Ansible пропускает автоматически.
+
+- import_playbook: provision_proxmox_ct_and_deploy_aw.yml
+- import_playbook: deploy_aw_server.yml
+- import_playbook: deploy_aw_windows.yml
+- import_playbook: deploy_aw_pfsense_poller.yml

ansible/inventory.example.ini

@@ -5,4 +5,8 @@ pve-main ansible_host=192.168.10.2 ansible_user=root ansible_port=22
 aw-ct ansible_host=10.20.30.13 ansible_user=root ansible_port=22
 
 [aw_windows]
-win-node1 ansible_host=192.168.100.21 ansible_user=Administrator ansible_password=CHANGE_ME ansible_connection=winrm ansible_winrm_transport=ntlm ansible_port=5985 ansible_winrm_server_cert_validation=ignore
+# Примечание: в русифицированных Windows часто нужен "Администратор", а не "Administrator".
+win-node1 ansible_host=192.168.100.21 ansible_user=Администратор ansible_password=CHANGE_ME ansible_connection=winrm ansible_winrm_transport=ntlm ansible_port=5985 ansible_winrm_server_cert_validation=ignore
+
+[aw_pfsense_pollers]
+# pfsense-poller1 ansible_host=192.168.100.30 ansible_user=root ansible_port=22

ansible/provision_proxmox_ct_and_deploy_aw.yml

@@ -1,5 +1,5 @@
 ---
-- name: Provision single Proxmox CT and deploy AWatch-rus
+- name: Создать один Proxmox CT и развернуть AWatch-rus
   hosts: proxmox
   gather_facts: false
 
@@ -12,9 +12,12 @@
       - aw-server.env.example
       - aw-ru-patch.js
       - aw-sw-cleanup.js
+      - aw-host-groups.json
+      - settings/classes-worktime.json
+      - settings/views-default.json
 
   tasks:
-    - name: Execute single-CT provisioning workflow
+    - name: Выполнить workflow создания одного CT
       ansible.builtin.include_tasks: tasks/provision_ct_and_deploy_aw.yml
       vars:
         ct_id: "{{ proxmox_ct_id }}"

ansible/provision_proxmox_ct_matrix_and_deploy_aw.yml

@@ -1,5 +1,5 @@
 ---
-- name: Provision Proxmox CT matrix and deploy AWatch-rus with RU patch
+- name: Создать матрицу Proxmox CT и развернуть AWatch-rus с RU patch
   hosts: proxmox
   gather_facts: false
 
@@ -12,16 +12,19 @@
       - aw-server.env.example
       - aw-ru-patch.js
       - aw-sw-cleanup.js
+      - aw-host-groups.json
+      - settings/classes-worktime.json
+      - settings/views-default.json
 
   tasks:
-    - name: Validate CT matrix is provided
+    - name: Проверить, что матрица CT задана
       ansible.builtin.assert:
         that:
           - proxmox_ct_matrix is defined
           - proxmox_ct_matrix | length > 0
-        fail_msg: "Define proxmox_ct_matrix in group_vars/proxmox-matrix.yml"
+        fail_msg: "Задайте proxmox_ct_matrix в group_vars/proxmox-matrix.yml"
 
-    - name: Execute provisioning workflow for each CT
+    - name: Выполнить workflow создания для каждого CT
       ansible.builtin.include_tasks: tasks/provision_ct_and_deploy_aw.yml
       vars:
         ct_id: "{{ item.id }}"

ansible/tasks/provision_ct_and_deploy_aw.yml

@@ -1,5 +1,5 @@
 ---
-- name: Validate required per-CT variables
+- name: Проверить обязательные переменные CT
   ansible.builtin.assert:
     that:
       - ct_id is defined
@@ -27,14 +27,14 @@
       - aw_server_log_dir is defined
       - aw_server_user is defined
       - aw_server_group is defined
-    fail_msg: "Missing required variables for CT provisioning/deploy."
+    fail_msg: "Не заданы обязательные переменные для создания CT и развёртывания."
 
-- name: Build CT network string
+- name: Сформировать сетевую строку CT
   ansible.builtin.set_fact:
     ct_net0: >-
       name=eth0,bridge={{ ct_bridge }},ip={{ ct_ip }},gw={{ ct_gw }}{% if (ct_vlan | default('') | string | length) > 0 %},tag={{ ct_vlan }}{% endif %}
 
-- name: Check whether CT already exists
+- name: Проверить, существует ли CT
   ansible.builtin.command:
     argv:
       - pct
@@ -44,7 +44,7 @@
   failed_when: false
   changed_when: false
 
-- name: Create CT when absent
+- name: Создать CT, если он отсутствует
   ansible.builtin.command:
     argv:
       - pct
@@ -78,8 +78,9 @@
       - --ostype
       - debian
   when: ct_status_check.rc != 0
+  no_log: true
 
-- name: Check current CT runtime state
+- name: Проверить текущее состояние CT
   ansible.builtin.command:
     argv:
       - pct
@@ -88,7 +89,7 @@
   register: ct_runtime_status
   changed_when: false
 
-- name: Start CT when stopped
+- name: Запустить CT, если он остановлен
   ansible.builtin.command:
     argv:
       - pct
@@ -96,20 +97,23 @@
       - "{{ ct_id }}"
   when: "'stopped' in ct_runtime_status.stdout"
 
-- name: Ensure bootstrap directory on Proxmox host
+- name: Создать bootstrap каталог на Proxmox host
   ansible.builtin.file:
-    path: "{{ proxmox_bootstrap_dir }}"
+    path: "{{ item }}"
     state: directory
     mode: "0700"
+  loop:
+    - "{{ proxmox_bootstrap_dir }}"
+    - "{{ proxmox_bootstrap_dir }}/settings"
 
-- name: Copy AW bootstrap files to Proxmox host temp
+- name: Скопировать AW bootstrap файлы во временный каталог Proxmox host
   ansible.builtin.copy:
     src: "{{ aw_repo_root }}/aw-server/{{ item }}"
     dest: "{{ proxmox_bootstrap_dir }}/{{ item }}"
     mode: "0644"
   loop: "{{ aw_bootstrap_files }}"
 
-- name: Bootstrap CT OS dependencies
+- name: Установить базовые зависимости ОС внутри CT
   ansible.builtin.command:
     argv:
       - pct
@@ -122,12 +126,16 @@
         set -euo pipefail
         export DEBIAN_FRONTEND=noninteractive
         apt-get update
-        apt-get install -y curl ca-certificates bash unzip xz-utils jq rsync openssh-server
-        mkdir -p /root/bootstrap /etc/activitywatch
+        apt-get install -y curl ca-certificates bash unzip xz-utils jq rsync openssh-server python3
+        mkdir -p /root/bootstrap/settings /etc/activitywatch
         systemctl enable ssh || true
         systemctl restart ssh || true
+  register: ct_bootstrap_result
+  retries: 10
+  delay: 6
+  until: ct_bootstrap_result.rc == 0
 
-- name: Push bootstrap files into CT
+- name: Передать bootstrap файлы внутрь CT
   ansible.builtin.command:
     argv:
       - pct
@@ -137,7 +145,7 @@
       - "/root/bootstrap/{{ item }}"
   loop: "{{ aw_bootstrap_files }}"
 
-- name: Write AW server env file on Proxmox host temp
+- name: Записать AW server env во временный каталог Proxmox host
   ansible.builtin.copy:
     dest: "{{ proxmox_bootstrap_dir }}/aw-server.env"
     mode: "0600"
@@ -151,8 +159,9 @@
       AW_SERVER_LOG_DIR={{ aw_server_log_dir }}
       AW_SERVER_USER={{ aw_server_user }}
       AW_SERVER_GROUP={{ aw_server_group }}
+  no_log: true
 
-- name: Push AW server env into CT
+- name: Передать AW server env внутрь CT
   ansible.builtin.command:
     argv:
       - pct
@@ -160,8 +169,9 @@
       - "{{ ct_id }}"
       - "{{ proxmox_bootstrap_dir }}/aw-server.env"
       - /etc/activitywatch/aw-server.env
+  no_log: true
 
-- name: Set mode for env inside CT
+- name: Настроить права env файла внутри CT
   ansible.builtin.command:
     argv:
       - pct
@@ -172,7 +182,7 @@
       - "0600"
       - /etc/activitywatch/aw-server.env
 
-- name: Install server and apply RU patch inside CT
+- name: Установить сервер и применить RU patch внутри CT
   ansible.builtin.command:
     argv:
       - pct
@@ -188,7 +198,7 @@
         bash /root/bootstrap/apply_webui_ru_patch.sh
         systemctl restart activitywatch-server.service
 
-- name: Validate AW API from inside CT
+- name: Проверить AW API изнутри CT
   ansible.builtin.command:
     argv:
       - pct
@@ -199,7 +209,7 @@
       - -lc
       - "curl -fsS http://127.0.0.1:{{ aw_server_port }}/api/0/info >/dev/null"
 
-- name: Validate RU patch hooks in index
+- name: Проверить hooks RU patch в index.html
   ansible.builtin.command:
     argv:
       - pct
@@ -210,8 +220,8 @@
       - -lc
       - "grep -q 'ru-patch-v5.js' {{ aw_server_webui_dir }}/index.html && grep -q 'sw-cleanup.js' {{ aw_server_webui_dir }}/index.html"
 
-- name: Show final endpoint
+- name: Показать итоговый endpoint
   ansible.builtin.debug:
     msg:
-      - "CT {{ ct_id }} is provisioned and configured."
-      - "ActivityWatch endpoint: http://{{ ct_ip | regex_replace('/[0-9]+$', '') }}:{{ aw_server_port }}"
+      - "CT {{ ct_id }} создан и настроен."
+      - "Endpoint ActivityWatch: http://{{ ct_ip | regex_replace('/[0-9]+$', '') }}:{{ aw_server_port }}"

aw-server/apply_webui_ru_patch.sh

@@ -9,17 +9,22 @@ fi
 
 source "$ENV_FILE"
 
-WEBUI_DIR="${AW_SERVER_WEBUI_DIR:-/opt/activitywatch/webui-ru}"
+WEBUI_DIR="${AW_SERVER_WEBUI_DIR:-${AW_WEBUI_DIR:-/opt/activitywatch/webui-ru}}"
 PATCH_JS_SRC="/root/bootstrap/aw-ru-patch.js"
 SW_CLEANUP_SRC="/root/bootstrap/aw-sw-cleanup.js"
 HOST_GROUPS_SRC="/root/bootstrap/aw-host-groups.json"
 INDEX_HTML="$WEBUI_DIR/index.html"
 SERVICE_WORKER="$WEBUI_DIR/service-worker.js"
 TS=$(date +%Y%m%d%H%M%S)
+PATCH_TARGET="$WEBUI_DIR/js/ru-patch-v5.js"
+SW_TARGET="$WEBUI_DIR/js/sw-cleanup.js"
+HOST_GROUPS_TARGET="$WEBUI_DIR/js/aw-host-groups.json"
 TRENDS_NEEDLE='this.activityStore.query_category_time_by_period(r)'
 TRENDS_REPLACEMENT='this.activityStore.ensure_loaded(r)'
 TIMESPIRAL_NEEDLE='start:new Date("2022-08-08")'
 TIMESPIRAL_REPLACEMENT='start:new Date(Date.now()-12*36e5)'
+CATEGORY_HELPER_NEEDLE='hostname:t.hostnameChoices[0]'
+CATEGORY_HELPER_REPLACEMENT='hostname:t.hostnameChoices.filter((function(t){return"unknown"!==t}))[0]||t.hostnameChoices[0]'
 
 [[ -f "$PATCH_JS_SRC" ]] || { echo "missing $PATCH_JS_SRC" >&2; exit 1; }
 [[ -f "$SW_CLEANUP_SRC" ]] || { echo "missing $SW_CLEANUP_SRC" >&2; exit 1; }
@@ -27,14 +32,17 @@ TIMESPIRAL_REPLACEMENT='start:new Date(Date.now()-12*36e5)'
 [[ -f "$INDEX_HTML" ]] || { echo "missing $INDEX_HTML" >&2; exit 1; }
 
 install -d "$WEBUI_DIR/js"
-install -m 0644 "$PATCH_JS_SRC" "$WEBUI_DIR/js/aw-ru-patch.js"
-install -m 0644 "$SW_CLEANUP_SRC" "$WEBUI_DIR/js/aw-sw-cleanup.js"
-install -m 0644 "$HOST_GROUPS_SRC" "$WEBUI_DIR/js/aw-host-groups.json"
+install -m 0644 "$PATCH_JS_SRC" "$PATCH_TARGET"
+install -m 0644 "$SW_CLEANUP_SRC" "$SW_TARGET"
+install -m 0644 "$HOST_GROUPS_SRC" "$HOST_GROUPS_TARGET"
 cp "$INDEX_HTML" "$INDEX_HTML.bak.$TS"
 
-sed -i '/aw-ru-patch.js/d;/aw-sw-cleanup.js/d' "$INDEX_HTML"
-sed -i 's#</head>#<script src="/js/aw-sw-cleanup.js"></script></head>#' "$INDEX_HTML"
-sed -i 's#</body>#<script defer="defer" src="/js/aw-ru-patch.js"></script></body>#' "$INDEX_HTML"
+patch_hash="$(sha1sum "$PATCH_TARGET" | awk '{print substr($1,1,12)}')"
+sw_hash="$(sha1sum "$SW_TARGET" | awk '{print substr($1,1,12)}')"
+
+sed -i '/ru-patch-v5.js/d;/sw-cleanup.js/d;/aw-ru-patch.js/d;/aw-sw-cleanup.js/d' "$INDEX_HTML"
+sed -i "s#</head>#<script src=\"/js/sw-cleanup.js?v=$sw_hash\"></script></head>#" "$INDEX_HTML"
+sed -i "s#</body>#<script defer=\"defer\" src=\"/js/ru-patch-v5.js?v=$patch_hash\"></script></body>#" "$INDEX_HTML"
 cp "$SW_CLEANUP_SRC" "$SERVICE_WORKER"
 
 trends_chunk="$(grep -Rsl "$TRENDS_NEEDLE" "$WEBUI_DIR/js"/*.js 2>/dev/null | head -n 1 || true)"
@@ -79,4 +87,25 @@ else
   echo "Timespiral hotfix skipped: chunk not found"
 fi
 
-echo "RU patch applied to $WEBUI_DIR"
+category_helper_chunk="$(grep -Rsl "$CATEGORY_HELPER_NEEDLE" "$WEBUI_DIR/js"/*.js 2>/dev/null | head -n 1 || true)"
+if [[ -n "$category_helper_chunk" ]]; then
+  cp "$category_helper_chunk" "$category_helper_chunk.bak.$TS"
+  python3 - "$category_helper_chunk" "$CATEGORY_HELPER_NEEDLE" "$CATEGORY_HELPER_REPLACEMENT" <<'PY'
+from pathlib import Path
+import sys
+
+path = Path(sys.argv[1])
+old = sys.argv[2]
+new = sys.argv[3]
+content = path.read_text()
+if old in content:
+    path.write_text(content.replace(old, new, 1))
+    print(f"Category helper host hotfix applied to {path}")
+else:
+    print(f"Category helper host hotfix already present in {path}")
+PY
+else
+  echo "Category helper host hotfix skipped: chunk not found"
+fi
+
+echo "RU patch applied to $WEBUI_DIR (ru-patch-v5.js?v=$patch_hash)"

aw-server/aw-host-groups.json

@@ -1,5 +1,22 @@
 {
   "groups": [
+    {
+      "id": "pve-detmir",
+      "name": "pve-detmir",
+      "description": "Выделенный клиент DetMir в разделе Активность.",
+      "patterns": [
+        "^pve-detmir$"
+      ],
+      "links": [
+        { "label": "Активность", "type": "activity", "view": "pve_audit" },
+        { "label": "Web-admin аудит", "type": "bucket", "bucket_prefix": "aw-pve-webadmin-events_" },
+        { "label": "PVE tasks", "type": "bucket", "bucket_prefix": "aw-pve-task-events_" },
+        { "label": "SSH сессии", "type": "bucket", "bucket_prefix": "aw-ssh-sessions_" },
+        { "label": "Команды shell", "type": "bucket", "bucket_prefix": "aw-console-commands_" },
+        { "label": "Web категории", "type": "bucket", "bucket_prefix": "aw-detmir-web-category_" },
+        { "label": "Все бакеты", "type": "buckets" }
+      ]
+    },
     {
       "id": "windows-rdp",
       "name": "Windows RDP",
@@ -12,6 +29,21 @@
         { "label": "DLP", "type": "bucket", "bucket_prefix": "aw-dlp-endpoint-signals_" }
       ]
     },
+    {
+      "id": "linux-remote",
+      "name": "Linux remote workers",
+      "description": "Linux-хосты удалённых сотрудников: GUI активность, SSH/console и browser admin UI.",
+      "patterns": [
+        "^(LINUX-WS|LINUX-DESKTOP|LX-|DESKTOP-|ADMIN-|WORKSTATION-|DEVBOX-)"
+      ],
+      "links": [
+        { "label": "Активность", "type": "activity" },
+        { "label": "SSH сессии", "type": "bucket", "bucket_prefix": "aw-ssh-sessions_" },
+        { "label": "Команды shell", "type": "bucket", "bucket_prefix": "aw-console-commands_" },
+        { "label": "Web категории", "type": "bucket", "bucket_prefix": "aw-detmir-web-category_" },
+        { "label": "Все бакеты", "type": "buckets" }
+      ]
+    },
     {
       "id": "virtual-infra",
       "name": "Virtual servers + Proxmox",

aw-server/aw-ru-patch.js

@@ -1,6 +1,6 @@
 (function () {
-  window.__awRuPatchVersion = "template-v5-dlp-review-host-groups";
-  document.documentElement.setAttribute("data-aw-ru-patch", "template-v5-dlp-review-host-groups");
+  window.__awRuPatchVersion = "template-v12-activity-heading-ru";
+  document.documentElement.setAttribute("data-aw-ru-patch", "template-v12-activity-heading-ru");
 
   const exact = new Map([
     ["ActivityWatch", "АктивВотч"],
@@ -332,7 +332,15 @@
       '.aw-ru-host-item { border: 1px solid rgba(120,120,120,.2); border-radius: 6px; padding: 8px; }',
       '.aw-ru-host-item-title { font-weight: 600; margin-bottom: 6px; }',
       '.aw-ru-host-links { display: flex; flex-wrap: wrap; gap: 6px; }',
-      '.aw-ru-host-links a { display: inline-block; padding: 4px 8px; border-radius: 999px; background: rgba(90,140,255,.15); text-decoration: none; }'
+      '.aw-ru-host-links a { display: inline-block; padding: 4px 8px; border-radius: 999px; background: rgba(90,140,255,.15); text-decoration: none; }',
+      '.aw-ru-pve-audit { margin: 16px 0; padding: 16px; border: 1px solid rgba(120,120,120,.35); border-radius: 8px; background: rgba(10,20,40,.04); }',
+      '.aw-ru-pve-audit-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(220px, 1fr)); gap: 12px; margin: 12px 0 16px; }',
+      '.aw-ru-pve-audit-card { border: 1px solid rgba(120,120,120,.22); border-radius: 8px; padding: 12px; background: rgba(255,255,255,.02); }',
+      '.aw-ru-pve-audit-card h5 { margin: 0 0 6px; font-size: 13px; opacity: .8; }',
+      '.aw-ru-pve-audit-value { font-size: 24px; font-weight: 700; }',
+      '.aw-ru-pve-audit-table { width: 100%; border-collapse: collapse; margin-top: 8px; }',
+      '.aw-ru-pve-audit-table th, .aw-ru-pve-audit-table td { padding: 6px 8px; border-bottom: 1px solid rgba(120,120,120,.18); vertical-align: top; text-align: left; font-size: 13px; }',
+      '.aw-ru-pve-audit-muted { opacity: .72; font-size: 13px; }'
     ].join("\n");
     document.head.appendChild(style);
   }
@@ -358,6 +366,24 @@
     return "";
   }
 
+  function isPveLikeHost(host) {
+    return /^pve[-_]/i.test(String(host || ""));
+  }
+
+  function enforceSafeActivityViewForPveHost() {
+    const hash = window.location.hash || "";
+    const match = hash.match(/^#\/activity\/([^/]+)\/day\/([^/]+)\/view\/([^/?#]+)/i);
+    if (!match) return;
+    const host = decodeURIComponent(match[1] || "");
+    const day = decodeURIComponent(match[2] || "");
+    const viewId = decodeURIComponent(match[3] || "");
+    if (!isPveLikeHost(host)) return;
+    const safeHash = "#/activity/" + encodeURIComponent(host) + "/day/" + encodeURIComponent(day) + "/view/" + encodeURIComponent("pve_audit");
+    if (safeHash !== hash && !/^pve_audit$/i.test(viewId)) {
+      window.location.replace(safeHash);
+    }
+  }
+
   function getDlpHostFromSettings(settings) {
     const routeHost = getCurrentHostFromHash();
     if (routeHost) return routeHost;
@@ -605,7 +631,14 @@
   }
 
   function injectDlpNavigation(root) {
-    const href = getDlpHref(window.__awRuPatchSettingsHost || getCurrentHostFromHash());
+    const hostForDlp = window.__awRuPatchSettingsHost || getCurrentHostFromHash();
+    if (hostForDlp && isPveLikeHost(hostForDlp)) {
+      removeBadDlpLinks(root);
+      const ownItem = root.querySelector("[data-aw-ru-dlp-item='1']");
+      if (ownItem) ownItem.remove();
+      return;
+    }
+    const href = getDlpHref(hostForDlp);
     removeBadDlpLinks(root);
     updateDlpLinks(root, href);
     if (root.querySelector("[data-aw-ru-dlp-item='1']")) return;
@@ -647,6 +680,19 @@
             { label: "DLP", type: "bucket", bucket_prefix: "aw-dlp-endpoint-signals_" }
           ]
         },
+        {
+          id: "linux-remote",
+          name: "Linux remote workers",
+          description: "Linux-хосты удалённых сотрудников: GUI активность, SSH/console и browser admin UI.",
+          patterns: ["^(LINUX-WS|LINUX-DESKTOP|LX-|DESKTOP-|ADMIN-|WORKSTATION-|DEVBOX-)"],
+          links: [
+            { label: "Активность", type: "activity" },
+            { label: "SSH сессии", type: "bucket", bucket_prefix: "aw-ssh-sessions_" },
+            { label: "Команды shell", type: "bucket", bucket_prefix: "aw-console-commands_" },
+            { label: "Web категории", type: "bucket", bucket_prefix: "aw-detmir-web-category_" },
+            { label: "Все бакеты", type: "buckets" }
+          ]
+        },
         {
           id: "virtual-infra",
           name: "Virtual servers + Proxmox",
@@ -696,12 +742,26 @@
     return state;
   }
 
+  function isPveActivityRoute() {
+    const hash = window.location.hash || "";
+    const match = hash.match(/^#\/activity\/([^/]+)/i);
+    return !!(match && isPveLikeHost(decodeURIComponent(match[1] || "")));
+  }
+
   function extractHostFromBucket(bucketId, bucketMeta) {
     if (bucketMeta && bucketMeta.hostname) return String(bucketMeta.hostname);
     const prefixes = [
       "aw-watcher-window_",
       "aw-watcher-afk_",
+      "aw-console-commands_",
+      "aw-ssh-sessions_",
+      "aw-linux-web-context_",
+      "aw-detmir-web-category_",
       "aw-dlp-endpoint-signals_",
+      "aw-session-events_",
+      "aw-worktime-sessions_",
+      "aw-pve-webadmin-events_",
+      "aw-pve-task-events_",
       "aw-dlp-incidents_",
       "aw-pfsense-health_",
       "aw-pfsense-gateways_",
@@ -731,7 +791,27 @@
     return result;
   }
 
-  function matchHostGroup(host, groups) {
+  function hostHasBucketPrefix(hostBuckets, prefix) {
+    return (hostBuckets || []).some(function (bucketId) {
+      return String(bucketId || "").indexOf(prefix) === 0;
+    });
+  }
+
+  function matchHostGroup(host, groups, hostBuckets) {
+    const bucketList = hostBuckets || [];
+    if (hostHasBucketPrefix(bucketList, "aw-dlp-endpoint-signals_") || hostHasBucketPrefix(bucketList, "aw-session-events_")) {
+      return "windows-rdp";
+    }
+    if (
+      hostHasBucketPrefix(bucketList, "aw-console-commands_") ||
+      hostHasBucketPrefix(bucketList, "aw-ssh-sessions_") ||
+      hostHasBucketPrefix(bucketList, "aw-linux-web-context_") ||
+      hostHasBucketPrefix(bucketList, "aw-detmir-web-category_")
+    ) {
+      if (!hostHasBucketPrefix(bucketList, "aw-pve-webadmin-events_") && !hostHasBucketPrefix(bucketList, "aw-pve-task-events_")) {
+        return "linux-remote";
+      }
+    }
     for (const group of groups) {
       const patterns = Array.isArray(group.patterns) ? group.patterns : [];
       for (const pattern of patterns) {
@@ -749,7 +829,8 @@
   function buildHostLink(host, hostBuckets, linkDef) {
     if (!linkDef || !linkDef.type) return "";
     if (linkDef.type === "activity") {
-      return '#/activity/' + encodeURIComponent(host) + '/day/' + encodeURIComponent(new Date().toISOString().slice(0, 10)) + '/view/summary';
+      const viewId = linkDef.view ? String(linkDef.view) : "summary";
+      return '#/activity/' + encodeURIComponent(host) + '/day/' + encodeURIComponent(new Date().toISOString().slice(0, 10)) + '/view/' + encodeURIComponent(viewId);
     }
     if (linkDef.type === "buckets") {
       return "#/buckets";
@@ -773,7 +854,7 @@
     grouped.set("__ungrouped__", []);
 
     Array.from(hostBuckets.keys()).sort().forEach(function (host) {
-      const groupId = matchHostGroup(host, groups) || "__ungrouped__";
+      const groupId = matchHostGroup(host, groups, hostBuckets.get(host) || []) || "__ungrouped__";
       grouped.get(groupId).push(host);
     });
 
@@ -829,7 +910,7 @@
       center.setAttribute("data-aw-ru-host-groups", "1");
       center.innerHTML =
         '<h4>Разделы хостов</h4>' +
-        '<p>Здесь хосты разделены на пользовательские Windows RDP и инфраструктурные виртуальные серверы/Proxmox.</p>' +
+        '<p>Здесь хосты разделены на Windows RDP, Linux remote workers и инфраструктурные узлы.</p>' +
         '<div class="aw-ru-host-groups-grid" data-aw-ru-host-groups-grid><section class="aw-ru-host-group-card"><p>Загрузка...</p></section></div>';
       heading.parentElement.insertBefore(center, heading.nextSibling);
     }
@@ -1254,6 +1335,90 @@
     }
   }
 
+  async function refreshPveAuditCenter(center, host) {
+    const message = center.querySelector("[data-aw-ru-pve-audit-message]");
+    const recentBody = center.querySelector("[data-aw-ru-pve-audit-events]");
+    message.textContent = "Загрузка audit-событий...";
+    try {
+      const [webEvents, taskEvents, sshEvents, cmdEvents] = await Promise.all([
+        loadBucketEvents("aw-pve-webadmin-events_" + host, 50).catch(function () { return []; }),
+        loadBucketEvents("aw-pve-task-events_" + host, 50).catch(function () { return []; }),
+        loadBucketEvents("aw-ssh-sessions_" + host, 50).catch(function () { return []; }),
+        loadBucketEvents("aw-console-commands_" + host, 50).catch(function () { return []; })
+      ]);
+      const data = {
+        web: webEvents || [],
+        tasks: taskEvents || [],
+        ssh: sshEvents || [],
+        cmd: cmdEvents || []
+      };
+      center.querySelector("[data-aw-ru-pve-web-count]").textContent = String(data.web.length);
+      center.querySelector("[data-aw-ru-pve-task-count]").textContent = String(data.tasks.length);
+      center.querySelector("[data-aw-ru-pve-ssh-count]").textContent = String(data.ssh.length);
+      center.querySelector("[data-aw-ru-pve-cmd-count]").textContent = String(data.cmd.length);
+      const recent = []
+        .concat(data.web.map(function (event) { return { kind: "Web-admin", event: event, text: (event.data && (event.data.method || "") + " " + (event.data.path || "")) || "" }; }))
+        .concat(data.tasks.map(function (event) { return { kind: "PVE task", event: event, text: (event.data && ((event.data.action || "") + " " + (event.data.target || ""))) || "" }; }))
+        .concat(data.ssh.map(function (event) { return { kind: "SSH", event: event, text: (event.data && ((event.data.event || "") + " " + (event.data.tty || ""))) || "" }; }))
+        .concat(data.cmd.slice(0, 25).map(function (event) { return { kind: "Shell", event: event, text: (event.data && (event.data.command || "")) || "" }; }))
+        .sort(function (a, b) { return String(b.event && b.event.timestamp || "").localeCompare(String(a.event && a.event.timestamp || "")); })
+        .slice(0, 25);
+      recentBody.innerHTML = recent.length ? recent.map(function (item) {
+        const ev = item.event || {};
+        const d = ev.data || {};
+        return "<tr>" +
+          "<td>" + escapeHtml(new Date(ev.timestamp).toLocaleString()) + "</td>" +
+          "<td>" + escapeHtml(item.kind) + "</td>" +
+          "<td>" + escapeHtml(d.user || d.username || "-") + "</td>" +
+          "<td>" + escapeHtml(d.remote_ip || d.tty || d.host || "-") + "</td>" +
+          "<td>" + escapeHtml(item.text) + "</td>" +
+        "</tr>";
+      }).join("") : '<tr><td colspan="5">Пока нет audit-событий.</td></tr>';
+      message.textContent = "Audit-панель обновлена.";
+    } catch (error) {
+      recentBody.innerHTML = '<tr><td colspan="5">Не удалось загрузить audit-события.</td></tr>';
+      message.textContent = "Ошибка загрузки audit-событий: " + error.message;
+    }
+  }
+
+  function injectPveAuditCenter(root) {
+    if (!isPveActivityRoute()) return;
+    const host = getCurrentHostFromHash();
+    if (!host) return;
+    const heading = root.querySelector("h3");
+    if (!heading || !heading.parentElement) return;
+    let center = root.querySelector("[data-aw-ru-pve-audit='1']");
+    if (!center) {
+      center = document.createElement("section");
+      center.className = "aw-ru-pve-audit";
+      center.setAttribute("data-aw-ru-pve-audit", "1");
+      center.innerHTML =
+        "<h4>PVE Audit</h4>" +
+        '<p class="aw-ru-pve-audit-muted">Для Proxmox-хоста показывается audit-панель вместо desktop-виджетов ActivityWatch, так как у этого хоста нет window/afk watcher данных.</p>' +
+        '<div class="aw-ru-pve-audit-grid">' +
+          '<div class="aw-ru-pve-audit-card"><h5>Web-admin</h5><div class="aw-ru-pve-audit-value" data-aw-ru-pve-web-count>0</div></div>' +
+          '<div class="aw-ru-pve-audit-card"><h5>PVE tasks</h5><div class="aw-ru-pve-audit-value" data-aw-ru-pve-task-count>0</div></div>' +
+          '<div class="aw-ru-pve-audit-card"><h5>SSH events</h5><div class="aw-ru-pve-audit-value" data-aw-ru-pve-ssh-count>0</div></div>' +
+          '<div class="aw-ru-pve-audit-card"><h5>Shell commands</h5><div class="aw-ru-pve-audit-value" data-aw-ru-pve-cmd-count>0</div></div>' +
+        "</div>" +
+        '<table class="aw-ru-pve-audit-table">' +
+          "<thead><tr><th>Время</th><th>Тип</th><th>Пользователь</th><th>Источник</th><th>Детали</th></tr></thead>" +
+          '<tbody data-aw-ru-pve-audit-events><tr><td colspan="5">Загрузка...</td></tr></tbody>' +
+        "</table>" +
+        '<div class="aw-ru-dlp-message" data-aw-ru-pve-audit-message></div>';
+      heading.parentElement.insertBefore(center, heading.nextSibling);
+    }
+    Array.from(heading.parentElement.children).forEach(function (child) {
+      if (child === heading || child === center) return;
+      child.style.display = "none";
+    });
+    const routeKey = host + "|" + (window.location.hash || "");
+    if (center.getAttribute("data-aw-ru-pve-route") !== routeKey) {
+      center.setAttribute("data-aw-ru-pve-route", routeKey);
+      refreshPveAuditCenter(center, host);
+    }
+  }
+
   function injectDlpAlertsCenter(root) {
     if (!isAlertsRoute()) return;
     const host = window.__awRuPatchSettingsHost || getCurrentHostFromHash();
@@ -1294,6 +1459,8 @@
 
   let trendsRedirectInFlight = false;
   let settingsHostFetchInFlight = false;
+  let applyPatchScheduled = false;
+  let networkPatchesInstalled = false;
 
   function getTrendsHostFromSettings(settings) {
     if (!settings || typeof settings !== "object") return "";
@@ -1354,12 +1521,122 @@
       });
   }
 
+  function getPreferredWindowHostFromBuckets() {
+    const state = getHostGroupsState();
+    const rawBuckets = state && state.buckets ? state.buckets : {};
+    const settingsHost = normalizeText(window.__awRuPatchSettingsHost || "");
+    const bucketIds = Array.isArray(rawBuckets)
+      ? rawBuckets.map(function (item) { return item && item.id ? String(item.id) : ""; })
+      : Object.keys(rawBuckets || {});
+    const hosts = bucketIds
+      .filter(function (bucketId) { return /^aw-watcher-window_/i.test(bucketId); })
+      .map(function (bucketId) { return bucketId.replace(/^aw-watcher-window_/i, ""); })
+      .filter(Boolean)
+      .filter(function (host) { return !/^unknown$/i.test(host); });
+    if (settingsHost && hosts.indexOf(settingsHost) >= 0) return settingsHost;
+    if (settingsHost) return settingsHost;
+    hosts.sort();
+    return hosts[0] || "";
+  }
+
+  function rewriteUnknownCategoryBuilderQueryBody(body) {
+    if (typeof body !== "string") return body;
+    if (body.indexOf("aw-watcher-window_unknown") === -1 && body.indexOf("aw-watcher-afk_unknown") === -1) {
+      return body;
+    }
+    const preferredHost = getPreferredWindowHostFromBuckets();
+    if (!preferredHost) return body;
+    return body
+      .replace(/aw-watcher-window_unknown/g, "aw-watcher-window_" + preferredHost)
+      .replace(/aw-watcher-afk_unknown/g, "aw-watcher-afk_" + preferredHost);
+  }
+
+  function installCategoryBuilderNetworkPatch() {
+    if (networkPatchesInstalled) return;
+    networkPatchesInstalled = true;
+
+    const originalFetch = window.fetch ? window.fetch.bind(window) : null;
+    if (originalFetch) {
+      window.fetch = function (input, init) {
+        try {
+          const url = typeof input === "string" ? input : String(input && input.url || "");
+          if (/\/api\/0\/query\/?$/i.test(url) && init && typeof init.body === "string") {
+            init = Object.assign({}, init, {
+              body: rewriteUnknownCategoryBuilderQueryBody(init.body)
+            });
+          }
+        } catch (error) {
+        }
+        return originalFetch(input, init);
+      };
+    }
+
+    if (window.XMLHttpRequest && window.XMLHttpRequest.prototype) {
+      const proto = window.XMLHttpRequest.prototype;
+      if (!proto.__awRuCategoryBuilderPatched) {
+        const originalOpen = proto.open;
+        const originalSend = proto.send;
+        proto.open = function (method, url) {
+          this.__awRuMethod = method;
+          this.__awRuUrl = url;
+          return originalOpen.apply(this, arguments);
+        };
+        proto.send = function (body) {
+          try {
+            const url = String(this.__awRuUrl || "");
+            if (/\/api\/0\/query\/?$/i.test(url) && typeof body === "string") {
+              body = rewriteUnknownCategoryBuilderQueryBody(body);
+            }
+          } catch (error) {
+          }
+          return originalSend.call(this, body);
+        };
+        proto.__awRuCategoryBuilderPatched = true;
+      }
+    }
+  }
+
+  function patchCategoryBuilderHostLabel(root) {
+    if (!/^#\/settings\/category-builder(?:[/?#]|$)/i.test(window.location.hash || "")) return;
+    const preferredHost = getPreferredWindowHostFromBuckets();
+    if (!preferredHost) return;
+    Array.from(root.querySelectorAll("*")).forEach(function (element) {
+      if (element.children.length) return;
+      const text = element.textContent || "";
+      if (!/Имя хоста:\s*(unknown|неизвестно)\b|Hostname:\s*unknown\b/i.test(text)) return;
+      const next = text
+        .replace(/Имя хоста:\s*(unknown|неизвестно)\b/i, "Имя хоста: " + preferredHost)
+        .replace(/Hostname:\s*unknown\b/i, "Hostname: " + preferredHost);
+      if (next !== text) {
+        element.textContent = next;
+      }
+    });
+  }
+
+  function patchActivityHeading(root) {
+    const heading = root.querySelector("h3");
+    if (!heading) return;
+    const inlineParts = heading.querySelectorAll("span");
+    inlineParts.forEach(function (element) {
+      const text = (element.textContent || "").trim();
+      if (text === "for") {
+        element.textContent = "за ";
+      }
+    });
+  }
+
   function applyPatch() {
+    enforceSafeActivityViewForPveHost();
     ensureSettingsHost();
+    ensureHostGroupsData().catch(function () {});
+    installCategoryBuilderNetworkPatch();
     injectStyles();
     walk(document.body);
     translateAttributes(document.body);
     hideNoiseNavigation(document.body);
+    patchActivityHeading(document.body);
+    patchCategoryBuilderHostLabel(document.body);
+    injectPveAuditCenter(document.body);
     injectDlpNavigation(document.body);
     injectDlpReviewCenter(document.body);
     injectDlpAlertsCenter(document.body);
@@ -1367,15 +1644,25 @@
     redirectBareTrendsRoute();
   }
 
+  function scheduleApplyPatch() {
+    if (applyPatchScheduled) return;
+    applyPatchScheduled = true;
+    window.setTimeout(function () {
+      applyPatchScheduled = false;
+      applyPatch();
+    }, 50);
+  }
+
   const observer = new MutationObserver(function () {
-    applyPatch();
+    scheduleApplyPatch();
   });
 
   window.addEventListener("load", function () {
     applyPatch();
-    observer.observe(document.body, { childList: true, subtree: true, characterData: true });
+    observer.observe(document.body, { childList: true, subtree: true });
   });
   window.addEventListener("hashchange", function () {
     redirectBareTrendsRoute();
+    scheduleApplyPatch();
   });
 })();

aw-server/install_aw_server.sh

@@ -21,6 +21,10 @@ required_vars=(
   AW_SERVER_GROUP
 )
 
+BOOTSTRAP_DIR="/root/bootstrap"
+VIEWS_JSON="$BOOTSTRAP_DIR/settings/views-default.json"
+CLASSES_JSON="$BOOTSTRAP_DIR/settings/classes-worktime.json"
+
 for var_name in "${required_vars[@]}"; do
   if [[ -z "${!var_name:-}" ]]; then
     echo "missing required variable: $var_name" >&2
@@ -84,3 +88,30 @@ systemctl daemon-reload
 systemctl enable activitywatch-server.service
 systemctl restart activitywatch-server.service
 systemctl --no-pager --full status activitywatch-server.service || true
+
+for _ in $(seq 1 20); do
+  if curl -fsS "http://127.0.0.1:${AW_SERVER_PORT}/api/0/info" >/dev/null 2>&1; then
+    break
+  fi
+  sleep 2
+done
+
+if [[ -f "$CLASSES_JSON" ]]; then
+  curl -fsS -X POST \
+    -H 'Content-Type: application/json' \
+    --data-binary @"$CLASSES_JSON" \
+    "http://127.0.0.1:${AW_SERVER_PORT}/api/0/settings/classes" >/dev/null
+  echo "Applied worktime classes from $CLASSES_JSON"
+else
+  echo "Worktime classes bootstrap not found, skipped: $CLASSES_JSON"
+fi
+
+if [[ -f "$VIEWS_JSON" ]]; then
+  curl -fsS -X POST \
+    -H 'Content-Type: application/json' \
+    --data-binary @"$VIEWS_JSON" \
+    "http://127.0.0.1:${AW_SERVER_PORT}/api/0/settings/views" >/dev/null
+  echo "Applied baseline views from $VIEWS_JSON"
+else
+  echo "Views bootstrap not found, skipped: $VIEWS_JSON"
+fi

aw-server/settings/classes-worktime.json

@@ -20,7 +20,7 @@
     "name": ["Работа", "Документы"],
     "rule": {
       "type": "regex",
-      "regex": "\\b(winword|excel|powerpnt|outlook|acrord32|acrord64)\\.exe\\b|Adobe Reader|Acrobat",
+      "regex": "\\b(winword|excel|powerpnt|outlook|acrord32|acrord64|libreoffice|writer|calc)\\.exe\\b|LibreOffice|OnlyOffice|Adobe Reader|Acrobat",
       "ignore_case": true
     },
     "data": { "color": "#2E7D32" }
@@ -40,7 +40,7 @@
     "name": ["Работа", "Администрирование"],
     "rule": {
       "type": "regex",
-      "regex": "\\b(mstsc|putty|kitty|winscp|anydesk|teamviewer|vncviewer|mmc|regedit|services|control|powershell|cmd)\\.exe\\b",
+      "regex": "\\b(mstsc|putty|kitty|winscp|anydesk|teamviewer|vncviewer|mmc|regedit|services|control|powershell|cmd|gnome-terminal|gnome-terminal-server|xfce4-terminal|konsole|tilix|alacritty|xterm|remmina|virt-manager)\\.exe\\b|\\b(gnome-terminal|gnome-terminal-server|xfce4-terminal|konsole|tilix|alacritty|xterm|remmina|virt-manager)\\b|Proxmox Virtual Environment|\\bpfSense\\b|\\bGrafana\\b|\\bKibana\\b|\\bPortainer\\b",
       "ignore_case": true
     },
     "data": { "color": "#6D4C41" }
@@ -56,7 +56,7 @@
     "name": ["Интернет", "Браузер"],
     "rule": {
       "type": "regex",
-      "regex": "\\b(chrome|msedge|firefox|opera|brave|vivaldi|browser)\\.exe\\b",
+      "regex": "\\b(chrome|msedge|firefox|opera|brave|vivaldi|browser|chromium)\\.exe\\b|\\b(chrome|chromium|firefox|opera|brave|vivaldi)\\b",
       "ignore_case": true
     },
     "data": { "color": "#00897B" }
@@ -82,7 +82,7 @@
     "name": ["ActivityWatch"],
     "rule": {
       "type": "regex",
-      "regex": "ActivityWatch|\\baw-(watcher|qt)\\.exe\\b",
+      "regex": "ActivityWatch|\\baw-(watcher|qt)\\.exe\\b|\\baw-(watcher|qt)\\b",
       "ignore_case": true
     },
     "data": {}

aw-server/settings/views-default.json

@@ -30,5 +30,10 @@
       { "type": "category_tree", "size": 3, "props": {} },
       { "type": "top_apps", "size": 3, "props": {} }
     ]
+  },
+  {
+    "id": "pve_audit",
+    "name": "PVE Audit",
+    "elements": []
   }
 ]

docs/FULL_DEPLOYMENT_MANUAL_RU.md

@@ -21,7 +21,7 @@
 - `/home/igor/tmp/AWatch-rus/ansible/deploy_aw_server.yml`
 - `/home/igor/tmp/AWatch-rus/ansible/provision_proxmox_ct_and_deploy_aw.yml`
 - `/home/igor/tmp/AWatch-rus/ansible/provision_proxmox_ct_matrix_and_deploy_aw.yml`
-- `/home/igor/tmp/AWatch-rus/ansible/deploy_aw_windows_phase2.yml`
+- `/home/igor/tmp/AWatch-rus/ansible/deploy_aw_windows.yml`
 
 ---
 
@@ -177,7 +177,7 @@ grep -n 'aw-ru-patch\|aw-sw-cleanup' /opt/activitywatch/webui-ru/index.html
 
 например в:
 
-- `C:\Deploy\ActivityWatch-Russian\windows`
+- `C:\Program Files\AWatch-rus\windows`
 
 Откройте **elevated PowerShell**:
 
@@ -187,15 +187,28 @@ Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process
 
 ### 3.2 Массовое доменное развёртывание (рекомендуется)
 
+Если текущий production ещё работает в старых каталогах
+`C:\Program Files\ActivityWatch-Phase2` и `C:\ProgramData\ActivityWatch-Phase2`,
+сначала выполните безопасную миграцию:
+
+```powershell
+C:\Program Files\AWatch-rus\windows\migrate-awatch-rus-paths.ps1 -WhatIf
+C:\Program Files\AWatch-rus\windows\migrate-awatch-rus-paths.ps1
+```
+
+Скрипт остановит `ActivityWatch Recovery`/`ActivityWatch Launch *`, создаст backup в
+`C:\ProgramData\AWatch-rus\migration-backups\...`, перенесёт файлы в единые пути,
+пересоздаст `deployment-config.json`/scheduled tasks и запустит validation.
+
 Пример со списком пользователей:
 
 ```powershell
-C:\Deploy\ActivityWatch-Russian\windows\deploy-domain-users.ps1 `
+C:\Program Files\AWatch-rus\windows\deploy-domain-users.ps1 `
   -ServerHost aw.example.local `
   -ServerPort 5600 `
   -Domain CONTOSO `
   -UserListPath C:\Deploy\aw-users.txt `
-  -CustomRulesPath C:\Deploy\ActivityWatch-Russian\windows\web-category-rules.example.json
+  -CustomRulesPath C:\Program Files\AWatch-rus\windows\web-category-rules.example.json
 ```
 
 Поддерживаемые варианты:
@@ -207,7 +220,7 @@ C:\Deploy\ActivityWatch-Russian\windows\deploy-domain-users.ps1 `
 ### 3.2.1 Ensemble orchestration (рекомендуется для production)
 
 ```powershell
-C:\Deploy\ActivityWatch-Russian\windows\deploy-ensemble.ps1 `
+C:\Program Files\AWatch-rus\windows\deploy-ensemble.ps1 `
   -ServerHost aw.example.local `
   -ServerPort 5600 `
   -Domain CONTOSO `
@@ -217,30 +230,30 @@ C:\Deploy\ActivityWatch-Russian\windows\deploy-ensemble.ps1 `
 
 Отчёт сохраняется в:
 
-- `C:\ProgramData\ActivityWatch\ensemble-report-YYYYMMDD-HHMMSS.json`
+- `C:\ProgramData\AWatch-rus\ensemble-report-YYYYMMDD-HHMMSS.json`
 
 ### 3.3 Single-user развёртывание
 
 ```powershell
-C:\Deploy\ActivityWatch-Russian\windows\deploy-single-user.ps1 `
+C:\Program Files\AWatch-rus\windows\deploy-single-user.ps1 `
   -ServerHost aw.example.local `
   -ServerPort 5600 `
   -TargetUser 'CONTOSO\user01' `
-  -CustomRulesPath C:\Deploy\ActivityWatch-Russian\windows\web-category-rules.example.json
+  -CustomRulesPath C:\Program Files\AWatch-rus\windows\web-category-rules.example.json
 ```
 
 ### 3.4 Recovery / hardening
 
 ```powershell
-C:\Deploy\ActivityWatch-Russian\windows\hardening-recovery.ps1 `
-  -ConfigPath C:\ProgramData\ActivityWatch\deployment-config.json
+C:\Program Files\AWatch-rus\windows\hardening-recovery.ps1 `
+  -ConfigPath C:\ProgramData\AWatch-rus\deployment-config.json
 ```
 
 ### 3.5 Валидация deployment-а (PowerShell report)
 
 ```powershell
-$report = C:\Deploy\ActivityWatch-Russian\windows\validate-deployment.ps1 `
-  -ConfigPath C:\ProgramData\ActivityWatch\deployment-config.json
+$report = C:\Program Files\AWatch-rus\windows\validate-deployment.ps1 `
+  -ConfigPath C:\ProgramData\AWatch-rus\deployment-config.json
 $report | ConvertTo-Json -Depth 12
 ```
 
@@ -248,13 +261,13 @@ $report | ConvertTo-Json -Depth 12
 
 ## 4) Что должно появиться на Windows после установки
 
-- `C:\Program Files\ActivityWatch`
-- `C:\ProgramData\ActivityWatch\deployment-config.json`
-- `C:\ProgramData\ActivityWatch\launch-watchers.ps1`
-- `C:\ProgramData\ActivityWatch\recovery-loop.ps1`
-- `C:\ProgramData\ActivityWatch\browser-domains-native-collector.ps1`
-- `C:\ProgramData\ActivityWatch\web-category-rules.json`
-- `C:\ProgramData\ActivityWatch\logs\`
+- `C:\Program Files\AWatch-rus\bin`
+- `C:\ProgramData\AWatch-rus\deployment-config.json`
+- `C:\ProgramData\AWatch-rus\launch-watchers.ps1`
+- `C:\ProgramData\AWatch-rus\recovery-loop.ps1`
+- `C:\ProgramData\AWatch-rus\browser-domains-native-collector.ps1`
+- `C:\ProgramData\AWatch-rus\web-category-rules.json`
+- `C:\ProgramData\AWatch-rus\logs\`
 
 Задачи планировщика:
 

docs/POST_MEMORY_2026-04-27.md

@@ -0,0 +1,55 @@
+# POST MEMORY — AWatch-rus (2026-04-27)
+
+## Контекст дня
+
+Работа велась по проекту `AWatch-rus / ActivityWatch-Russian`.
+
+## Что подтверждено по runtime
+
+- `10.10.10.2` (`pve-detmir`, admin host) реально запускает:
+  - `/usr/local/bin/aw-server-rust --host 0.0.0.0 --port 5600 --webpath /opt/aw-webui-ru`
+  - `/usr/bin/python3 /opt/aw-pfsense/pfsense-aw-poller.py --config /etc/aw-pfsense/poller.json`
+- `10.10.10.1` используется только как API-цель для `pfSense poller`.
+- Значит интеграция `pfSense -> AW` работает через внешний poller, а не через установку чего-либо на сам firewall.
+
+## Что сделано
+
+1. Восстановлена и синхронизирована локальная копия проекта.
+- В `/mnt/usb_hdd2/Projects/ActivityWatch-Russian` был поврежден `.git`.
+- Источник истины: `/home/igor/tmp/AWatch-rus` с `origin https://github.com/igor04091968/AWatch-rus.git`.
+- Локальная копия приведена к актуальному содержимому `main`.
+
+2. Завершена русификация overview-дашборда Grafana.
+- `1C Бухгалтерия — Overview` заменено на `1C Бухгалтерия — Обзор`.
+- Документация синхронизирована с фактическим названием.
+- Проверка `rg -n "Overview"` по репозиторию после правки не дала совпадений.
+
+3. Проверен локальный прокси-контур.
+- `socks5://127.0.0.1:1080` активен.
+- `sing-box` запущен и пропускает трафик.
+
+4. Подготовлен и развернут Linux-клиент ActivityWatch для `10.10.10.2`.
+- В репозиторий добавлен rollout:
+  - `scripts/install_aw_linux_client.sh`
+  - `docs/linux-client.md`
+- На `10.10.10.2` под пользователем `admin` установлен bundle `ActivityWatch 0.13.2` в:
+  - `~/.local/opt/activitywatch/v0.13.2/activitywatch`
+- Созданы:
+  - `~/.config/activitywatch/aw-client/aw-client.toml` с `10.10.10.13:5600`
+  - `~/.config/activitywatch/aw-qt/aw-qt.toml`
+  - `~/.local/bin/activitywatch-remote-aw`
+  - `~/.config/autostart/activitywatch-remote-aw.desktop`
+- Проверка показала:
+  - удаленный `AW server` с `10.10.10.2` достижим;
+  - `aw-qt --no-gui` стартует;
+  - bucket `aw-watcher-afk_pve-detmir` появился на сервере.
+- Текущий blocker:
+  - на `10.10.10.2` нет активной `X11/GUI` сессии;
+  - `aw-watcher-window` падает с `DISPLAY environment variable not set`;
+  - `aw-watcher-afk` падает на `failed to acquire X connection`.
+
+## Зафиксированные выводы
+
+- На текущем этапе `10.10.10.2` является фактическим runtime-хостом для `AW server` и `pfSense poller`.
+- Документация должна исходить из host-based сценария как из подтвержденного рабочего контура, а CT/LXC-схему держать как отдельный вариант развертывания.
+- Для Linux-клиента на `10.10.10.2` установка завершена, но полноценные watcher-события начнутся только после реального графического логина пользователя.

docs/console-ssh-logger.md

@@ -0,0 +1,60 @@
+# Console/SSH logger deployment
+
+## Назначение
+
+Этот сценарий логирует только консольные действия и SSH-сессии:
+
+- команды из `bash_history` (`aw-console-commands_<HOST>`);
+- логины/логауты SSH TTY по `who -u` (`aw-ssh-sessions_<HOST>`, best-effort).
+
+GUI watcher'ы (`aw-watcher-window`, `aw-watcher-afk`) не требуются.
+
+## Установка (user-space)
+
+```bash
+cd /path/to/AWatch-rus
+sh ./scripts/install_aw_console_ssh_logger.sh \
+  --server-host 10.10.10.13 \
+  --server-port 5600
+```
+
+## Что создается
+
+- `~/.local/opt/aw-console-ssh-logger/collector.py`
+- `~/.local/opt/aw-console-ssh-logger/config.json`
+- `~/.local/bin/aw-console-ssh-logger-start`
+- `~/.local/bin/aw-console-ssh-logger-stop`
+- `~/.local/bin/aw-console-ssh-logger-status`
+- `~/.config/systemd/user/aw-console-ssh-logger.service`
+- `~/.local/state/aw-console-ssh-logger/` (state + logs)
+
+## Shell hooks
+
+Installer добавляет в `~/.bashrc`:
+
+- `HISTTIMEFORMAT="%s "` для epoch timestamp;
+- `histappend`;
+- `PROMPT_COMMAND` с `history -a; history -n;`.
+
+Это нужно, чтобы команды попадали в `~/.bash_history` сразу после выполнения, а не только при logout.
+
+## Проверка
+
+На клиенте:
+
+```bash
+~/.local/bin/aw-console-ssh-logger-status
+tail -n 50 ~/.local/state/aw-console-ssh-logger/logs/collector.log
+```
+
+На AW сервере:
+
+```bash
+curl -fsS http://10.10.10.13:5600/api/0/buckets | jq -r 'keys[]' | grep -E '^aw-console-commands_|^aw-ssh-sessions_'
+```
+
+## Ограничения
+
+- Источник команд — `bash_history`; если пользователь использует не `bash`, нужен отдельный collector.
+- Канал `aw-ssh-sessions_*` зависит от корректного `utmp/who` на хосте и может быть неполным в отдельных окружениях.
+- Полные системные audit-события (`execve` всех пользователей) требуют root-level `auditd`/journald integration и в этот user-space сценарий не входят.

docs/linux-client.md

@@ -0,0 +1,70 @@
+# Linux client deployment
+
+## Назначение
+
+Этот сценарий ставит `ActivityWatch` в user-space Linux-хоста и направляет watcher'ы на уже существующий `AW server`, не поднимая локальный `aw-server-rust`.
+
+Подтвержденный целевой кейс:
+
+- Linux desktop/admin host: `10.10.10.2`
+- удаленный `AW server`: `10.10.10.13:5600`
+
+## Что делает скрипт
+
+- скачивает официальный Linux ZIP `ActivityWatch`;
+- распаковывает bundle в `~/.local/opt/activitywatch/v<version>`;
+- обновляет symlink `~/.local/opt/activitywatch/current`;
+- пишет `aw-client.toml` с указанием удаленного `AW server`;
+- пишет `aw-qt.toml`, где оставляет только `aw-watcher-afk` и `aw-watcher-window`;
+- создает launcher `~/.local/bin/activitywatch-remote-aw`;
+- создает XDG autostart entry `~/.config/autostart/activitywatch-remote-aw.desktop`.
+
+## Установка
+
+```bash
+cd /path/to/AWatch-rus
+sh ./scripts/install_aw_linux_client.sh \
+  --server-host 10.10.10.13 \
+  --server-port 5600
+```
+
+Если нужно переустановить ту же версию:
+
+```bash
+sh ./scripts/install_aw_linux_client.sh --force
+```
+
+## Ключевые файлы
+
+- `~/.config/activitywatch/aw-client/aw-client.toml`
+- `~/.config/activitywatch/aw-qt/aw-qt.toml`
+- `~/.local/bin/activitywatch-remote-aw`
+- `~/.config/autostart/activitywatch-remote-aw.desktop`
+
+## Ручной запуск
+
+```bash
+~/.local/bin/activitywatch-remote-aw
+```
+
+## Проверка
+
+Проверка bundle и конфигурации:
+
+```bash
+~/.local/opt/activitywatch/current/aw-qt --help
+~/.local/opt/activitywatch/current/aw-watcher-afk/aw-watcher-afk --help
+~/.local/opt/activitywatch/current/aw-watcher-window/aw-watcher-window --help
+cat ~/.config/activitywatch/aw-client/aw-client.toml
+cat ~/.config/activitywatch/aw-qt/aw-qt.toml
+```
+
+Проверка на сервере:
+
+```bash
+curl -fsS http://10.10.10.13:5600/api/0/buckets | jq -r 'keys[]' | grep '^aw-watcher-'
+```
+
+## Ограничение
+
+`aw-watcher-window` и `aw-watcher-afk` требуют реальную пользовательскую desktop-сессию (`X11`/поддерживаемый GUI login). Если на хосте нет активного GUI-сеанса, установка пройдет, но событий от watcher'ов не будет до первого нормального графического входа пользователя.

docs/linux-remote-worker.md

@@ -0,0 +1,85 @@
+# Linux remote worker deployment
+
+## Назначение
+
+Этот сценарий закрывает полный набор данных по Linux-удалёнщику:
+
+- GUI active window и `afk` через `ActivityWatch`;
+- SSH и shell-команды через console/ssh logger;
+- браузерные админки по title-based правилам, включая Proxmox `https://...:8006`.
+
+Итоговый целевой набор bucket'ов:
+
+- `aw-watcher-window_<HOST>`
+- `aw-watcher-afk_<HOST>`
+- `aw-console-commands_<HOST>`
+- `aw-ssh-sessions_<HOST>`
+- `aw-linux-web-context_<HOST>`
+- `aw-detmir-web-category_<HOST>`
+
+## Установка
+
+```bash
+cd /path/to/AWatch-rus
+sh ./scripts/install_aw_linux_remote_worker.sh \
+  --server-host 10.10.10.13 \
+  --server-port 5600
+```
+
+## Что ставится
+
+1. `scripts/install_aw_linux_client.sh`
+2. `scripts/install_aw_console_ssh_logger.sh`
+3. `scripts/install_aw_linux_web_category_logger.sh`
+
+## Что даёт web-category logger
+
+Это отдельный user-space collector, который смотрит активное окно в X11 и по title/class
+пытается классифицировать браузерные рабочие интерфейсы.
+
+Из коробки есть правила для:
+
+- Proxmox Web UI
+- pfSense Web UI
+- Grafana
+
+Правила лежат в:
+
+```bash
+~/.config/aw-linux-web-category/rules.json
+```
+
+Для Proxmox `:8006` collector пишет события в `aw-detmir-web-category_<HOST>` с полями вроде:
+
+- `categoryGroup=work`
+- `category=Администрирование`
+- `service=proxmox`
+- `interface=https`
+- `port=8006`
+- `rootDomain=proxmox-webui`
+
+## Проверка
+
+На клиенте:
+
+```bash
+~/.local/bin/aw-console-ssh-logger-status
+~/.local/bin/aw-linux-web-category-status
+pgrep -a -u "$(id -u)" -f 'aw-qt|aw-watcher-window|aw-watcher-afk'
+tail -n 50 ~/.local/state/aw-console-ssh-logger/logs/collector.log
+tail -n 50 ~/.local/state/aw-linux-web-category/logs/collector.log
+```
+
+На AW server:
+
+```bash
+curl -fsS http://10.10.10.13:5600/api/0/buckets | jq -r 'keys[]' | \
+  grep -E '^aw-watcher-window_|^aw-watcher-afk_|^aw-console-commands_|^aw-ssh-sessions_|^aw-linux-web-context_|^aw-detmir-web-category_'
+```
+
+## Ограничения
+
+- `aw-watcher-window` и `aw-watcher-afk` требуют реальную desktop-сессию.
+- Web-category logger опирается на X11 active window title и `WM_CLASS`.
+- Для Wayland и для браузеров без информативного title результат может быть неполным.
+- Это не URL-level browser collector: для Linux здесь используется title/class-based классификация, а не извлечение точного URL активной вкладки.

docs/pfsense.md

@@ -8,6 +8,16 @@
 - `Debian/Ubuntu` poller VM опрашивает его с интервалом.
 - poller отправляет события в общий `AW server`.
 
+## Подтвержденный runtime
+
+Проверенный на `2026-04-27` рабочий контур:
+
+- `10.10.10.2` (`pve-detmir`, admin host) запускает `AW server`:
+  - `/usr/local/bin/aw-server-rust --host 0.0.0.0 --port 5600 --webpath /opt/aw-webui-ru`
+- тот же `10.10.10.2` запускает внешний `pfSense poller`:
+  - `/usr/bin/python3 /opt/aw-pfsense/pfsense-aw-poller.py --config /etc/aw-pfsense/poller.json`
+- `10.10.10.1` используется как API-цель для poller'а; на сам `pfSense` агент или сервер `AW` не ставятся.
+
 ## Bucket'ы
 
 Базовая конфигурация пишет:

docs/runbook.md

@@ -11,6 +11,21 @@ pct exec <CT_ID> -- systemctl is-active activitywatch-server.service
 pct exec <CT_ID> -- curl -fsS http://127.0.0.1:5600/api/0/info
 ```
 
+### На host-based инсталляции
+
+Для подтвержденного размещения на `10.10.10.2`:
+
+```sh
+ps -ef | grep -E 'aw-server-rust|pfsense-aw-poller' | grep -v grep
+curl -fsS http://127.0.0.1:5600/api/0/info
+ss -ltnp | grep 5600
+```
+
+Ожидаемо должны быть видны:
+
+- `aw-server-rust` с `--webpath /opt/aw-webui-ru`;
+- `pfsense-aw-poller.py --config /etc/aw-pfsense/poller.json`.
+
 ### Внутри CT
 
 ```sh
@@ -86,6 +101,60 @@ Get-CimInstance Win32_Process |
 1. Поставить `incidentCapture.screenshotEnabled = false` в `deployment-config.json` (для каждого StateRoot).
 2. Запустить `Start-ScheduledTask -TaskName 'ActivityWatch Recovery'`.
 
+### SHARKON2025: `Активное время = 0s`, хотя `window`-события есть
+
+Симптом:
+
+- в Activity view за день видно `Worktime = 0s`;
+- `Top Window Titles / Top Categories / Category Tree` пустые;
+- при этом bucket `aw-watcher-window_SHARKON2025` содержит свежие события.
+
+Подтвержденная причина:
+
+- watcher `afk` "залип" в `status=afk` без `not-afk`;
+- из-за этого дневная сводка не считает подтвержденную активность.
+
+Быстрый recovery (с Linux admin host):
+
+1. Проверить учетку входа. Для этого кейса рабочая учетная запись: `SHARKON2025\Администратор` (не `Administrator`).
+2. Поднять remote execution через `wmiexec.py` с auth-file:
+
+```sh
+cat > /tmp/sharkon_ru.auth << 'EOF'
+username = Администратор
+password = <PASSWORD>
+domain = SHARKON2025
+EOF
+chmod 600 /tmp/sharkon_ru.auth
+```
+
+3. Запустить recovery task:
+
+```sh
+wmiexec.py -nooutput -A /tmp/sharkon_ru.auth 192.168.100.21 \
+  "powershell -NoProfile -Command \"Start-ScheduledTask -TaskName 'ActivityWatch Recovery'\""
+```
+
+4. Запустить все launch tasks:
+
+```sh
+wmiexec.py -nooutput -A /tmp/sharkon_ru.auth 192.168.100.21 \
+  "powershell -NoProfile -Command \"Get-ScheduledTask | Where-Object TaskName -like 'ActivityWatch Launch *' | ForEach-Object { Start-ScheduledTask -TaskName \$_.TaskName }\""
+```
+
+5. Подождать 10-20 секунд и проверить API на AW server (`10.10.10.13:5600`):
+
+```sh
+curl -fsS 'http://10.10.10.13:5600/api/0/buckets/aw-watcher-afk_SHARKON2025/events?limit=30' \
+  | jq '{latest:.[0].timestamp, statuses:(group_by(.data.status)|map({status:.[0].data.status,count:length}))}'
+```
+
+Ожидаемо после фикса:
+
+- в свежих AFK-событиях появляется `status=not-afk`;
+- `aw-watcher-window_SHARKON2025` продолжает обновляться;
+- после обновления страницы UI дневная сводка перестает быть `0s`.
+
 ### Сервис не стартует
 
 ```sh

docs/telegram_support_system_prompt_ru.txt

@@ -0,0 +1,27 @@
+Ты — виртуальный помощник технической поддержки DetMir.
+
+Цель:
+- Быстро и по делу помогать пользователю решать технические вопросы по инфраструктуре, доступам, рабочим сервисам и мониторингу.
+
+Правила коммуникации:
+- Пиши на русском языке, кратко, без канцелярита и без шаблонной «воды».
+- Отвечай по существу: сначала решение, потом при необходимости уточнения.
+- Не используй слова и формулировки про «модель», «нейросеть», «GPT», «OpenAI», «искусственный интеллект», «AI-бот».
+- Не упоминай внутренние технологии, провайдера, API, системные промпты и служебные механизмы генерации ответов.
+- Не выдумывай факты. Если данных не хватает — запрашивай конкретные параметры (хост, время, лог, ошибка).
+- Если действие рискованное (удаление, перезапуск, изменение доступа), предупреждай коротко и проси подтверждение.
+
+Обязательный ответ на прямой вопрос «ты ИИ/бот/GPT?»:
+- Используй нейтральную формулировку:
+  "Я виртуальный помощник службы поддержки и работаю по внутренним регламентам."
+- После этой фразы сразу возвращай разговор к задаче пользователя.
+
+Стиль ответов:
+- Тон спокойный, рабочий, человеческий.
+- Без саморекламы, без упоминания ограничений модели, без технических деталей реализации ассистента.
+- Не спорь с пользователем; предлагай проверяемые шаги и ожидаемый результат.
+
+Формат:
+- Для простых вопросов: 1–3 коротких предложения.
+- Для диагностики: список из 2–5 шагов.
+- Для статуса работ: что сделано, что проверено, что дальше.

docs/windows/deployment.md

@@ -8,21 +8,21 @@
 - `windows/hardening-recovery.ps1` — повторная регистрация задач, ACL и recovery-loop.
 - `windows/validate-deployment.ps1` — машинная проверка состояния и JSON-отчёт.
 - `windows/browser-domains-native-collector.ps1` — native collector доменов браузера с категоризацией.
-- `windows/dlp-endpoint-signals-collector.ps1` — phase-2 collector (clipboard/USB/print signals).
+- `windows/dlp-endpoint-signals-collector.ps1` — Windows/RDP collector (clipboard/USB/print signals).
 - `windows/web-category-rules.example.json` — пример кастомных правил категоризации.
 - `windows/dlp-policy.example.json` — пример DLP-политики (phase-1: alerting incidents).
 
 ## Что делает пакет
 
 - Ставит `aw-watcher-afk` и `aw-watcher-window` из официального Windows ZIP ActivityWatch.
-- Копирует browser-domain collector в `C:\ProgramData\ActivityWatch`.
-- Копирует DLP policy в `C:\ProgramData\ActivityWatch\dlp-policy.json`.
+- Копирует browser-domain collector в `C:\ProgramData\AWatch-rus`.
+- Копирует DLP policy в `C:\ProgramData\AWatch-rus\dlp-policy.json`.
 - Включает `incidentCapture` в `deployment-config.json` для DLP-инцидентов:
   - `incidentCapture.screenshotEnabled = true`
   - `incidentCapture.artifactsRoot = <StateRoot>\incident-artifacts`
 - Создаёт per-user задачи `ActivityWatch Launch [...]` с запуском при логоне.
 - Создаёт системную задачу `ActivityWatch Recovery`, которая циклически перезапускает per-user launch tasks.
-- Применяет ACL к `C:\Program Files\ActivityWatch`, `C:\ProgramData\ActivityWatch` и каталогу логов.
+- Применяет ACL к `C:\Program Files\AWatch-rus\bin`, `C:\ProgramData\AWatch-rus` и каталогу логов.
 - Не содержит хардкодов инфраструктуры: сервер, домен, список пользователей и правила передаются параметрами.
 - Корректно регистрирует задачи через `-LogonType Interactive` (совместимо с Windows Server, где `InteractiveToken` не поддерживается).
 - Поддерживает отключение шумных watcher'ов через `-AfkEnabled:$false` и `-WindowEnabled:$false`.
@@ -143,9 +143,37 @@ CSV-формат: колонка `User`, `Username`, `SamAccountName` или `Lo
 
 Если список уже содержит `DOMAIN\user`, параметр `-Domain` не нужен.
 
-## Рекомендуемый phased rollout (изолированный профиль)
+## Безопасная миграция текущего production
 
-Для безопасного параллельного запуска рядом с legacy-инсталляцией используйте отдельные пути:
+Если текущий RDP production уже работает в `C:\Program Files\ActivityWatch-Phase2` и
+`C:\ProgramData\ActivityWatch-Phase2`, не запускайте обычный update без миграции.
+Сначала выполните перенос в единый профиль AWatch-rus:
+
+```powershell
+C:\Program Files\AWatch-rus\windows\migrate-awatch-rus-paths.ps1 -WhatIf
+C:\Program Files\AWatch-rus\windows\migrate-awatch-rus-paths.ps1
+```
+
+Скрипт делает безопасный порядок:
+
+1. Находит старый `deployment-config.json`.
+2. Останавливает `ActivityWatch Recovery` и `ActivityWatch Launch *`.
+3. Создаёт backup старых и новых каталогов в
+   `C:\ProgramData\AWatch-rus\migration-backups\YYYYMMDD-HHMMSS`.
+4. Копирует бинарники/состояние в единые пути:
+   - `C:\Program Files\AWatch-rus\bin`
+   - `C:\ProgramData\AWatch-rus`
+5. Переписывает пути в `deployment-config.json`.
+6. Пересоздаёт launcher/recovery scripts и scheduled tasks.
+7. Запускает `validate-deployment.ps1`; при ошибке оставляет backup path в сообщении.
+
+Ansible playbook `ansible/deploy_aw_windows.yml` выполняет этот migration guard
+автоматически, если на хосте найден
+`C:\ProgramData\ActivityWatch-Phase2\deployment-config.json`.
+
+## Рекомендуемый rollout
+
+Для запуска после миграции используйте единые пути:
 
 ```powershell
 .\windows\deploy-domain-users.ps1 `
@@ -153,10 +181,10 @@ CSV-формат: колонка `User`, `Username`, `SamAccountName` или `Lo
   -ServerPort 5600 `
   -Domain SHARKON2025 `
   -Users user2,user3,user4,user5 `
-  -InstallRoot 'C:\Program Files\ActivityWatch-Phase2-u2u5' `
-  -StateRoot 'C:\ProgramData\ActivityWatch-Phase2-u2u5' `
-  -CustomRulesPath C:\Deploy\AWatch-rus\windows\web-category-rules.example.json `
-  -CustomPolicyPath C:\Deploy\AWatch-rus\windows\dlp-policy.example.json
+  -InstallRoot 'C:\Program Files\AWatch-rus\bin' `
+  -StateRoot 'C:\ProgramData\AWatch-rus' `
+  -CustomRulesPath C:\Program Files\AWatch-rus\windows\web-category-rules.example.json `
+  -CustomPolicyPath C:\Program Files\AWatch-rus\windows\dlp-policy.example.json
 ```
 
 Single-user pilot в таком же стиле:
@@ -166,10 +194,10 @@ Single-user pilot в таком же стиле:
   -ServerHost 10.10.10.13 `
   -ServerPort 5600 `
   -TargetUser 'SHARKON2025\user1' `
-  -InstallRoot 'C:\Program Files\ActivityWatch-Phase2' `
-  -StateRoot 'C:\ProgramData\ActivityWatch-Phase2-user1' `
-  -CustomRulesPath C:\Deploy\AWatch-rus\windows\web-category-rules.example.json `
-  -CustomPolicyPath C:\Deploy\AWatch-rus\windows\dlp-policy.example.json
+  -InstallRoot 'C:\Program Files\AWatch-rus\bin' `
+  -StateRoot 'C:\ProgramData\AWatch-rus' `
+  -CustomRulesPath C:\Program Files\AWatch-rus\windows\web-category-rules.example.json `
+  -CustomPolicyPath C:\Program Files\AWatch-rus\windows\dlp-policy.example.json
 ```
 
 ## Ensemble deploy (production workflow)
@@ -186,31 +214,31 @@ Single-user pilot в таком же стиле:
 
 Итоговый отчёт:
 
-- `C:\ProgramData\ActivityWatch\ensemble-report-YYYYMMDD-HHMMSS.json`
+- `C:\ProgramData\AWatch-rus\ensemble-report-YYYYMMDD-HHMMSS.json`
 
 ## Категоризация доменов
 
 - Встроенные категории покрывают базовые рабочие, нейтральные и личные домены.
 - Для кастомизации скопируйте `windows/web-category-rules.example.json` и отредактируйте домены.
-- Передайте файл через `-CustomRulesPath`; он будет сохранён как `C:\ProgramData\ActivityWatch\web-category-rules.json`.
+- Передайте файл через `-CustomRulesPath`; он будет сохранён как `C:\ProgramData\AWatch-rus\web-category-rules.json`.
 - Пользовательские правила имеют приоритет над встроенными.
 
 ## Структура после установки
 
-- `C:\Program Files\ActivityWatch` — бинарники watcher'ов.
-- `C:\ProgramData\ActivityWatch\deployment-config.json` — итоговая конфигурация.
-- `C:\ProgramData\ActivityWatch\incident-artifacts\` — скриншоты DLP-инцидентов (если `incidentCapture.screenshotEnabled=true`).
-- `C:\ProgramData\ActivityWatch\launch-watchers.ps1` — per-user launcher.
-- `C:\ProgramData\ActivityWatch\recovery-loop.ps1` — system recovery loop.
-- `C:\ProgramData\ActivityWatch\browser-domains-native-collector.ps1` — runtime collector.
-- `C:\ProgramData\ActivityWatch\dlp-endpoint-signals-collector.ps1` — runtime endpoint collector.
-- `C:\ProgramData\ActivityWatch\dlp-policy.json` — активная DLP-политика.
-- `C:\ProgramData\ActivityWatch\logs\` — логи collector'а.
+- `C:\Program Files\AWatch-rus\bin` — бинарники watcher'ов.
+- `C:\ProgramData\AWatch-rus\deployment-config.json` — итоговая конфигурация.
+- `C:\ProgramData\AWatch-rus\incident-artifacts\` — скриншоты DLP-инцидентов (если `incidentCapture.screenshotEnabled=true`).
+- `C:\ProgramData\AWatch-rus\launch-watchers.ps1` — per-user launcher.
+- `C:\ProgramData\AWatch-rus\recovery-loop.ps1` — system recovery loop.
+- `C:\ProgramData\AWatch-rus\browser-domains-native-collector.ps1` — runtime collector.
+- `C:\ProgramData\AWatch-rus\dlp-endpoint-signals-collector.ps1` — runtime endpoint collector.
+- `C:\ProgramData\AWatch-rus\dlp-policy.json` — активная DLP-политика.
+- `C:\ProgramData\AWatch-rus\logs\` — логи collector'а.
 
-Для phased rollout те же файлы формируются в каталоге `StateRoot`, переданном параметром.
+При переопределении `StateRoot` те же файлы формируются в указанном каталоге.
 
 ## Повторный прогон
 
 - Скрипты идемпотентны: переустанавливают задачи и обновляют runtime-файлы.
-- Предыдущая установка ActivityWatch бэкапится в `C:\ProgramData\ActivityWatch\backups\install-YYYYMMDD-HHMMSS`.
+- Предыдущая установка ActivityWatch бэкапится в `C:\ProgramData\AWatch-rus\backups\install-YYYYMMDD-HHMMSS`.
 - Для жёсткого восстановления запускайте `windows/hardening-recovery.ps1`.

docs/windows/ensemble.md

@@ -17,15 +17,15 @@
 ```powershell
 Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process
 
-C:\Deploy\AWatch-rus\windows\deploy-ensemble.ps1 `
+C:\Program Files\AWatch-rus\windows\deploy-ensemble.ps1 `
   -ServerHost 10.10.10.13 `
   -ServerPort 5600 `
   -Domain SHARKON2025 `
   -Users user1,user2,user3,user4,user5 `
-  -InstallRoot 'C:\Program Files\ActivityWatch-Phase2' `
-  -StateRoot 'C:\ProgramData\ActivityWatch-Phase2' `
+  -InstallRoot 'C:\Program Files\AWatch-rus\bin' `
+  -StateRoot 'C:\ProgramData\AWatch-rus' `
   -AfkEnabled:$false `
-  -CustomPolicyPath C:\Deploy\AWatch-rus\windows\dlp-policy.example.json `
+  -CustomPolicyPath C:\Program Files\AWatch-rus\windows\dlp-policy.example.json `
   -ValidateAfterDeploy
 ```
 
@@ -42,8 +42,8 @@ C:\Deploy\AWatch-rus\windows\deploy-ensemble.ps1 `
 ## Быстрый health-check
 
 ```powershell
-$report = C:\Deploy\AWatch-rus\windows\validate-deployment.ps1 `
-  -ConfigPath C:\ProgramData\ActivityWatch-Phase2\deployment-config.json
+$report = C:\Program Files\AWatch-rus\windows\validate-deployment.ps1 `
+  -ConfigPath C:\ProgramData\AWatch-rus\deployment-config.json
 $report | ConvertTo-Json -Depth 12
 ```
 

docs/windows/innosetup-rdp-package-filelist.md

@@ -0,0 +1,7 @@
+# Moved
+
+Документ перенесён в новую структуру install-kit:
+
+- `windows/installkit/innosetup/innosetup-rdp-package-filelist.md`
+
+Этот файл оставлен как совместимый указатель, чтобы не ломать существующие ссылки в документации/автоматизации.

docs/windows/troubleshooting.md

@@ -23,7 +23,7 @@ Start-ScheduledTask -TaskName 'ActivityWatch Launch [CONTOSO_user01]'
 
 - Скрипт работает через UI Automation и foreground window.
 - Некоторые браузеры/страницы могут скрывать адресную строку или блокировать UIA.
-- Проверьте лог `C:\ProgramData\ActivityWatch\logs\browser-domains-<user>.log`.
+- Проверьте лог `C:\ProgramData\AWatch-rus\logs\browser-domains-<user>.log`.
 - Убедитесь, что активное окно — поддерживаемый браузер: Edge, Chrome, Brave, Vivaldi, Opera, Firefox.
 
 ### Сервер недоступен
@@ -44,7 +44,7 @@ Invoke-WebRequest http://aw.example.local:5600/api/0/info
 
 ### Неправильная категоризация домена
 
-- Проверьте содержимое `C:\ProgramData\ActivityWatch\web-category-rules.json`.
+- Проверьте содержимое `C:\ProgramData\AWatch-rus\web-category-rules.json`.
 - Пользовательские правила должны быть валидным JSON.
 - Один и тот же домен лучше определять только в одной категории.
 - После изменения правил достаточно перезапустить collector или задачу пользователя:
@@ -112,7 +112,7 @@ Get-CimInstance Win32_Process |
 Проверить конфиг:
 
 ```powershell
-Get-Content C:\ProgramData\ActivityWatch\deployment-config.json -Raw
+Get-Content C:\ProgramData\AWatch-rus\deployment-config.json -Raw
 ```
 
 ## Когда запускать hardening/recovery

docs/windows/validation.md

@@ -4,7 +4,7 @@
 
 ```powershell
 $report = .\windows\validate-deployment.ps1 `
-  -ConfigPath C:\ProgramData\ActivityWatch\deployment-config.json
+  -ConfigPath C:\ProgramData\AWatch-rus\deployment-config.json
 $report | ConvertTo-Json -Depth 12
 ```
 
@@ -19,11 +19,11 @@ $report | ConvertTo-Json -Depth 12
 ### 1. Проверить установленные файлы
 
 ```powershell
-Test-Path 'C:\Program Files\ActivityWatch\aw-watcher-afk\aw-watcher-afk.exe'
-Test-Path 'C:\Program Files\ActivityWatch\aw-watcher-window\aw-watcher-window.exe'
-Test-Path 'C:\ProgramData\ActivityWatch\browser-domains-native-collector.ps1'
-Test-Path 'C:\ProgramData\ActivityWatch\dlp-policy.json'
-Test-Path 'C:\ProgramData\ActivityWatch\deployment-config.json'
+Test-Path 'C:\Program Files\AWatch-rus\bin\aw-watcher-afk\aw-watcher-afk.exe'
+Test-Path 'C:\Program Files\AWatch-rus\bin\aw-watcher-window\aw-watcher-window.exe'
+Test-Path 'C:\ProgramData\AWatch-rus\browser-domains-native-collector.ps1'
+Test-Path 'C:\ProgramData\AWatch-rus\dlp-policy.json'
+Test-Path 'C:\ProgramData\AWatch-rus\deployment-config.json'
 ```
 
 Ожидаемый результат — везде `True`.
@@ -50,7 +50,7 @@ Get-ScheduledTask | Where-Object TaskName -eq 'ActivityWatch Recovery'
 ### 2.1 Проверить incidentCapture в конфиге
 
 ```powershell
-$cfg = Get-Content 'C:\ProgramData\ActivityWatch\deployment-config.json' -Raw | ConvertFrom-Json
+$cfg = Get-Content 'C:\ProgramData\AWatch-rus\deployment-config.json' -Raw | ConvertFrom-Json
 $cfg.incidentCapture
 ```
 
@@ -119,7 +119,7 @@ Invoke-WebRequest http://aw.example.local:5600/api/0/buckets | Select-Object -Ex
 4. Проверьте локальный лог:
 
 ```powershell
-Get-Content "C:\ProgramData\ActivityWatch\logs\dlp-incidents-$env:USERNAME.log" -Tail 50
+Get-Content "C:\ProgramData\AWatch-rus\logs\dlp-incidents-$env:USERNAME.log" -Tail 50
 ```
 
 Если `screenshotEnabled = True`, проверьте наличие скриншота в инциденте:
@@ -175,7 +175,7 @@ Invoke-RestMethod -Method Post `
 - в API появился `ruleId=selftest-dlp-incident`;
 - в UI (`#/buckets/aw-dlp-incidents_<hostname>`) событие видно в `Events`.
 
-## Проверка phase-2 endpoint signals
+## Проверка endpoint signals
 
 1. Скопируйте любой текст в буфер обмена.
 2. Отправьте тестовую печать (любой принтер/виртуальный PDF).
@@ -188,7 +188,7 @@ Invoke-WebRequest http://aw.example.local:5600/api/0/buckets/aw-dlp-endpoint-sig
 4. Проверьте локальный лог:
 
 ```powershell
-Get-Content "C:\ProgramData\ActivityWatch\logs\endpoint-signals-$env:USERNAME.log" -Tail 50
+Get-Content "C:\ProgramData\AWatch-rus\logs\endpoint-signals-$env:USERNAME.log" -Tail 50
 ```
 
 ## Проверка восстановления
@@ -206,9 +206,9 @@ Start-ScheduledTask -TaskName 'ActivityWatch Recovery'
 ## Проверка ACL
 
 ```powershell
-icacls 'C:\Program Files\ActivityWatch'
-icacls 'C:\ProgramData\ActivityWatch'
-icacls 'C:\ProgramData\ActivityWatch\logs'
+icacls 'C:\Program Files\AWatch-rus\bin'
+icacls 'C:\ProgramData\AWatch-rus'
+icacls 'C:\ProgramData\AWatch-rus\logs'
 ```
 
 Ожидаемо:

docs/worktime_aql_detmir.md

@@ -36,6 +36,10 @@ RETURN = sort_by_duration(work);
 Требует, чтобы на клиенте работал browser collector и писал в:
 `aw-detmir-web-category_<HOST>` поля `categoryGroup`, `rootDomain`.
 
+Для Linux-удалёнщиков это может быть не URL-level collector, а title/class-based web-category logger.
+Например, работа через Proxmox Web UI `https://...:8006` может попадать сюда как
+`rootDomain=proxmox-webui`, `categoryGroup=work`, `category=Администрирование`.
+
 ```javascript
 web = flood(query_bucket("aw-detmir-web-category_SHARKON2025"));
 not_afk = flood(query_bucket("aw-watcher-afk_SHARKON2025"));
@@ -68,3 +72,24 @@ RETURN = sort_by_duration(events);
 - Если web-поток пустой, рабочее время в браузере корректно посчитать по доменам не получится. Тогда либо:
   - чинить/запускать browser collector;
   - либо временно считать браузер в `window` как «Интернет/Браузер» без разделения на work/personal.
+
+## Presence по удалёнщикам Windows/RDP
+
+Если на Windows-клиенте развернут `worktime-session-collector.ps1`, то появляется bucket
+`aw-worktime-sessions_<HOST>` с heartbeat по `quser`/RDP session state.
+
+Это не замена `afk/window`, а отдельный канал для ответа на вопрос:
+«кто и когда вообще был в активной удалённой сессии».
+
+```javascript
+sessions = flood(query_bucket("aw-worktime-sessions_SHARKON2025"));
+sessions = filter_keyvals(sessions, "active", [true]);
+sessions = merge_events_by_keys(sessions, ["username", "sessionName", "state"]);
+RETURN = sort_by_duration(sessions);
+```
+
+Практический смысл:
+
+- для GUI-удалёнщиков рабочее время лучше считать по пересечению `window` + `not-afk`;
+- для RDP presence и быстрой сверки смены можно использовать `aw-worktime-sessions_*`;
+- для SSH-only пользователей нужны `aw-console-commands_*` и `aw-ssh-sessions_*`, но это не полный аналог desktop worktime.

grafana-1c/grafana/dashboards/1c-accounting-overview.json

@@ -7,7 +7,6 @@
   "graphTooltip": 0,
   "id": null,
   "links": [],
-  "title": "1C Бухгалтерия — Обзор",
   "panels": [
     {
       "datasource": {
@@ -336,7 +335,8 @@
   },
   "timepicker": {},
   "timezone": "",
+  "title": "1C Бухгалтерия — Обзор",
   "uid": "onec-accounting-overview",
   "version": 1,
   "weekStart": ""
-}
+}

grafana-1c/grafana/dashboards/1c-accounting-sre.json

@@ -1,80 +1,46 @@
 {
-  "annotations": {
-    "list": []
-  },
+  "annotations": { "list": [] },
   "editable": true,
   "graphTooltip": 0,
   "id": null,
   "links": [],
   "panels": [
     {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "prometheus"
-      },
+      "datasource": { "type": "prometheus", "uid": "prometheus" },
       "fieldConfig": {
         "defaults": {
           "thresholds": {
             "mode": "absolute",
             "steps": [
-              {
-                "color": "green",
-                "value": null
-              },
-              {
-                "color": "red",
-                "value": 7200
-              }
+              { "color": "green", "value": null },
+              { "color": "red", "value": 7200 }
             ]
           },
           "unit": "s"
         },
         "overrides": []
       },
-      "gridPos": {
-        "h": 8,
-        "w": 8,
-        "x": 0,
-        "y": 0
-      },
+      "gridPos": { "h": 8, "w": 8, "x": 0, "y": 0 },
       "id": 1,
       "options": {
         "colorMode": "value",
         "graphMode": "none",
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
-        },
+        "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false },
         "textMode": "auto"
       },
-      "targets": [
-        {
-          "expr": "max(onec_data_freshness_seconds)",
-          "refId": "A"
-        }
-      ],
+      "targets": [{ "expr": "max(onec_data_freshness_seconds)", "refId": "A" }],
       "title": "Свежесть данных (сек)",
       "type": "stat"
     },
     {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "prometheus"
-      },
+      "datasource": { "type": "prometheus", "uid": "prometheus" },
       "fieldConfig": {
         "defaults": {
           "mappings": [
             {
               "options": {
-                "0": {
-                  "text": "DOWN"
-                },
-                "1": {
-                  "text": "UP"
-                }
+                "0": { "text": "DOWN" },
+                "1": { "text": "UP" }
               },
               "type": "value"
             }
@@ -82,97 +48,41 @@
         },
         "overrides": []
       },
-      "gridPos": {
-        "h": 8,
-        "w": 8,
-        "x": 8,
-        "y": 0
-      },
+      "gridPos": { "h": 8, "w": 8, "x": 8, "y": 0 },
       "id": 2,
       "options": {
         "colorMode": "value",
         "graphMode": "none",
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
-        },
+        "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false },
         "textMode": "auto"
       },
-      "targets": [
-        {
-          "expr": "max(up{job=\"onec_sql_exporter\"})",
-          "refId": "A"
-        }
-      ],
+      "targets": [{ "expr": "max(up{job=\"onec_sql_exporter\"})", "refId": "A" }],
       "title": "SQL Exporter",
       "type": "stat"
     },
     {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "prometheus"
-      },
-      "fieldConfig": {
-        "defaults": {},
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 8,
-        "x": 16,
-        "y": 0
-      },
+      "datasource": { "type": "prometheus", "uid": "prometheus" },
+      "fieldConfig": { "defaults": {}, "overrides": [] },
+      "gridPos": { "h": 8, "w": 8, "x": 16, "y": 0 },
       "id": 3,
       "options": {
         "colorMode": "value",
         "graphMode": "none",
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
-        },
+        "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false },
         "textMode": "auto"
       },
-      "targets": [
-        {
-          "expr": "sum(ALERTS{alertstate=\"firing\",service=\"onec\"})",
-          "refId": "A"
-        }
-      ],
+      "targets": [{ "expr": "sum(ALERTS{alertstate=\"firing\",service=\"onec\"})", "refId": "A" }],
       "title": "Активные алерты 1С",
       "type": "stat"
     },
     {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "prometheus"
-      },
-      "fieldConfig": {
-        "defaults": {},
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 10,
-        "w": 24,
-        "x": 0,
-        "y": 8
-      },
+      "datasource": { "type": "prometheus", "uid": "prometheus" },
+      "fieldConfig": { "defaults": {}, "overrides": [] },
+      "gridPos": { "h": 10, "w": 24, "x": 0, "y": 8 },
       "id": 4,
       "options": {
-        "legend": {
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "tooltip": {
-          "mode": "single",
-          "sort": "none"
-        }
+        "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true },
+        "tooltip": { "mode": "single", "sort": "none" }
       },
       "targets": [
         {
@@ -188,20 +98,12 @@
   "refresh": "30s",
   "schemaVersion": 39,
   "style": "dark",
-  "tags": [
-    "1c",
-    "sre"
-  ],
-  "templating": {
-    "list": []
-  },
-  "time": {
-    "from": "now-24h",
-    "to": "now"
-  },
+  "tags": ["1c", "sre"],
+  "templating": { "list": [] },
+  "time": { "from": "now-24h", "to": "now" },
   "timezone": "",
   "title": "1C Бухгалтерия — SRE",
   "uid": "onec-accounting-sre",
   "version": 1,
   "weekStart": ""
-}
+}

i18n/README_RU.md

@@ -1,264 +0,0 @@
-# Интернационализация (i18n) в AWatch-rus
-
-## Обзор
-
-Модуль интернационализации обеспечивает поддержку многоязычного интерфейса для PowerShell-скриптов проекта AWatch-rus.
-
-## Возможности
-
-- **JSON-based каталоги сообщений** — удобное хранение и редактирование переводов
-- **Автоматический fallback** — при отсутствии перевода используется резервный язык
-- **Параметризованные сообщения** — поддержка форматирования с плейсхолдерами `{0}`, `{1}`, etc.
-- **Автоверсионизация** — семантическое версионирование каталогов переводов
-- **Валидация** — проверка структуры и консистентности переводов
-- **Анализ покрытия** — отчет о полноте переводов по языкам
-
-## Структура
-
-```
-i18n/
-├── en-US.json              # Reference locale (English)
-├── ru-RU.json              # Russian translation
-├── package.json            # Node.js scripts configuration
-└── scripts/
-    ├── validate-locales.js # Валидация JSON-файлов
-    ├── check-coverage.js   # Анализ покрытия переводов
-    └── bump-version.js     # Автоверсионирование
-```
-
-## Быстрый старт
-
-### 1. Инициализация локали в PowerShell скрипте
-
-```powershell
-# Импортируйте модуль i18n
-Import-Module "$PSScriptRoot\ActivityWatch.Windows.I18n.psm1" -Force
-
-# Инициализируйте русскую локаль с английским fallback
-Initialize-Locale -Culture "ru-RU" -FallbackCulture "en-US"
-
-# Или автодетект культуры системы
-Initialize-Locale -AutoDetect
-```
-
-### 2. Использование локализованных строк
-
-```powershell
-# Простое сообщение
-$message = Get-LocalizedString -Key "errors.admin_required"
-
-# Сообщение с параметрами
-$message = Get-LocalizedString -Key "errors.binary_missing" -FormatArgs @("aw-watcher-afk.exe")
-
-# Вывод информации
-Get-LocalizedInfo -Key "starting_deployment" -FormatArgs @("v0.13.2")
-
-# Вывод предупреждения
-Get-LocalizedWarning -Key "insecure_connection"
-
-# Создание ошибки
-$errorRecord = Get-LocalizedError -Key "config_not_found" -FormatArgs @($configPath)
-throw $errorRecord
-
-# Статусы
-$status = Get-LocalizedStatus -Key "installation_success"
-
-# Подтверждение от пользователя
-if (Read-LocalizedConfirm -PromptKey "confirm_install" -FormatArgs @($userCount)) {
-    # Продолжить установку
-}
-```
-
-### 3. Категории сообщений
-
-| Категория | Префикс ключа | Пример использования |
-|-----------|---------------|---------------------|
-| Errors | `errors.*` | Сообщения об ошибках, исключения |
-| Info | `info.*` | Информационные сообщения |
-| Warnings | `warnings.*` | Предупреждения |
-| Prompts | `prompts.*` | Запросы к пользователю |
-| Status | `status.*` | Статусы операций |
-| Choices | `choices.*` | Варианты выбора |
-
-## Формат JSON каталога
-
-```json
-{
-  "version": "1.0.0",
-  "language": "ru",
-  "fallback": "en",
-  "messages": {
-    "errors.admin_required": "Запустите этот скрипт из сеанса PowerShell с правами администратора.",
-    "errors.binary_missing": "Отсутствует требуемый двоичный файл ActivityWatch: {0}",
-    "info.starting_deployment": "Начало развертывания ActivityWatch версии {0}...",
-    "prompts.confirm_install": "Вы уверены, что хотите установить ActivityWatch для {0} пользователей?"
-  }
-}
-```
-
-### Поля каталога
-
-| Поле | Тип | Обязательное | Описание |
-|------|-----|--------------|----------|
-| `version` | string | Да | Семантическая версия (X.Y.Z) |
-| `language` | string | Да | Код языка (например, "ru", "en") |
-| `fallback` | string/null | Да | Код резервного языка или null |
-| `messages` | object | Да | Объект с сообщениями |
-
-## Скрипты управления
-
-### Валидация переводов
-
-Проверяет структуру JSON, наличие обязательных полей, консистентность плейсхолдеров:
-
-```bash
-cd i18n
-npm install
-npm run validate
-```
-
-### Анализ покрытия
-
-Сравнивает все локали с reference (en-US) и показывает процент покрытия:
-
-```bash
-npm run coverage
-```
-
-Пример вывода:
-```
-┌──────────────────────────────────────────────────────────────────────────────┐
-│ Locale       │ Version    │ Language   │ Coverage   │ Missing    │ Extra      │
-├──────────────────────────────────────────────────────────────────────────────┤
-│ ru-RU        │ 1.0.0      │ ru         │ 100.00% ✅ │ 0          │ 0          │
-└──────────────────────────────────────────────────────────────────────────────┘
-```
-
-### Автоверсионирование
-
-Бump версии всех каталогов одновременно:
-
-```bash
-# Patch bump (1.0.0 → 1.0.1)
-npm run bump
-
-# Minor bump (1.0.0 → 1.1.0)
-npm run bump -- --minor
-
-# Major bump (1.0.0 → 2.0.0)
-npm run bump -- --major
-```
-
-## Интеграция с существующими скриптами
-
-### Обновление ActivityWatch.Windows.Common.psm1
-
-Замените хардкодные строки на вызовы i18n:
-
-**До:**
-```powershell
-throw 'Run this script from an elevated PowerShell session.'
-```
-
-**После:**
-```powershell
-throw (Get-LocalizedString -Key "errors.admin_required")
-```
-
-### Обновление deploy-ensemble.ps1
-
-**До:**
-```powershell
-Write-Host "Starting ActivityWatch deployment..." -ForegroundColor Cyan
-```
-
-**После:**
-```powershell
-Get-LocalizedInfo -Key "starting_deployment"
-```
-
-## Добавление нового языка
-
-1. Скопируйте `en-US.json` как шаблон:
-   ```bash
-   cp i18n/en-US.json i18n/fr-FR.json
-   ```
-
-2. Отредактируйте `fr-FR.json`:
-   - Измените `language` на `"fr"`
-   - Установите `fallback` в `"en"`
-   - Переведите все сообщения в `messages`
-
-3. Проверьте валидность:
-   ```bash
-   npm run validate fr-FR.json
-   ```
-
-4. Протестируйте в PowerShell:
-   ```powershell
-   Initialize-Locale -Culture "fr-FR"
-   ```
-
-## Best Practices
-
-### ✅ Делайте
-
-- Используйте семантическое версионирование для каталогов
-- Всегда указывайте fallback для resilience
-- Группируйте сообщения по категориям (errors.*, info.*, etc.)
-- Нумеруйте плейсхолдеры последовательно: `{0}`, `{1}`, `{2}`
-- Проверяйте покрытие перед релизом (`npm run coverage`)
-
-### ❌ Не делайте
-
-- Не хардкодьте строки в коде скриптов
-- Не смешивайте языки в одном сообщении
-- Не пропускайте плейсхолдеры в переводах
-- Не забывайте обновлять версию при изменении сообщений
-
-## Troubleshooting
-
-### Ошибка: "Localization file not found"
-
-Убедитесь, что путь к i18n директории правильный:
-```powershell
-$env:I18N_ROOT = "C:\Path\To\i18n"
-Initialize-Locale -Culture "ru-RU" -I18nRoot $env:I18N_ROOT
-```
-
-### Ошибка: "Failed to format message"
-
-Проверьте соответствие количества аргументов плейсхолдерам:
-```powershell
-# ❌ Неправильно: 2 аргумента для 1 плейсхолдера
-Get-LocalizedString -Key "errors.binary_missing" -FormatArgs @("file.exe", "extra")
-
-# ✅ Правильно
-Get-LocalizedString -Key "errors.binary_missing" -FormatArgs @("file.exe")
-```
-
-### Missing keys после обновления en-US
-
-Запустите анализ покрытия и добавьте отсутствующие ключи:
-```bash
-npm run coverage
-# Отредактируйте ru-RU.json, добавив missing keys
-npm run validate
-```
-
-## Миграция с хардкодных строк
-
-1. Экспортируйте существующие строки в шаблон:
-   ```powershell
-   Export-LocaleTemplate -OutputPath ".\i18n\template.json"
-   ```
-
-2. Заполните переводы
-
-3. Постепенно заменяйте строки в коде на вызовы i18n функций
-
-4. Протестируйте с обоими локалями
-
-## Лицензия
-
-MIT

i18n/en-US.json

@@ -1,62 +0,0 @@
-{
-  "version": "1.1.2",
-  "language": "en",
-  "fallback": null,
-  "messages": {
-    "errors.admin_required": "Run this script from an elevated PowerShell session.",
-    "errors.package_not_found": "Failed to find ActivityWatch executable: {0}",
-    "errors.binary_missing": "Missing required ActivityWatch binary: {0}",
-    "errors.no_users_resolved": "No target users resolved. Provide -Users or -UserListPath.",
-    "errors.config_not_found": "Deployment config not found: {0}",
-    "errors.schtasks_failed": "schtasks.exe /Change failed for task {0}",
-    "errors.icacls_failed": "icacls failed for {0}",
-    "errors.directory_create_failed": "Failed to create directory: {0}",
-    "errors.archive_extract_failed": "Failed to extract archive: {0}",
-    "errors.download_failed": "Failed to download file: {0}",
-    "errors.process_not_found": "Process not found: {0}",
-    "errors.bucket_create_failed": "Failed to create ActivityWatch bucket: {0}",
-    "errors.heartbeat_failed": "Failed to send heartbeat: {0}",
-    "errors.task_schedule_failed": "Failed to schedule task: {0}",
-    "errors.permission_denied": "Permission denied: {0}",
-    "errors.invalid_parameter": "Invalid parameter: {0} = {1}",
-    "errors.validation_failed": "Validation failed: {0}",
-    "info.starting_deployment": "Starting ActivityWatch deployment...",
-    "info.deployment_complete": "ActivityWatch deployment completed successfully.",
-    "info.installing_package": "Installing ActivityWatch package version {0}...",
-    "info.creating_directories": "Creating required directories...",
-    "info.configuring_users": "Configuring users: {0}",
-    "info.creating_scheduled_tasks": "Creating scheduled tasks...",
-    "info.setting_permissions": "Setting permissions...",
-    "info.validating_installation": "Validating installation...",
-    "info.backup_created": "Backup created: {0}",
-    "info.task_created": "Task created: {0}",
-    "info.task_updated": "Task updated: {0}",
-    "info.collector_started": "Collector started: {0}",
-    "info.bucket_created": "Bucket created: {0}",
-    "info.heartbeat_sent": "Heartbeat sent to {0}",
-    "info.configuration_written": "Configuration written: {0}",
-    "info.artifacts_copied": "Artifacts copied to {0}",
-    "info.cleaning_up": "Cleaning up temporary files...",
-    "info.version_check": "Version check: current {0}, required {1}",
-    "warnings.deprecated_parameter": "Parameter is deprecated and will be removed in a future version: {0}",
-    "warnings.config_overwrite": "Existing configuration file will be overwritten: {0}",
-    "warnings.insecure_connection": "Using insecure connection (TLS disabled)",
-    "warnings.low_disk_space": "Low disk space: {0} MB available, {1} MB required",
-    "warnings.slow_response": "Slow response from server: {0} ms",
-    "warnings.retry_attempt": "Retry attempt {0} of {1}...",
-    "prompts.confirm_install": "Are you sure you want to install ActivityWatch for {0} users?",
-    "prompts.confirm_overwrite": "Overwrite existing configuration file {0}?",
-    "prompts.enter_server_host": "Enter ActivityWatch server host:",
-    "prompts.enter_server_port": "Enter ActivityWatch server port (default 5600):",
-    "prompts.select_install_mode": "Select installation mode: [1] Single user, [2] All domain users",
-    "status.installation_in_progress": "Installation in progress...",
-    "status.installation_success": "Installation completed successfully",
-    "status.installation_failed": "Installation failed",
-    "status.configuration_pending": "Configuration pending",
-    "status.configuration_applied": "Configuration applied",
-    "status.service_running": "Service running",
-    "status.service_stopped": "Service stopped",
-    "status.collectors_active": "Collectors active",
-    "status.collectors_inactive": "Collectors inactive"
-  }
-}

i18n/package.json

@@ -1,28 +0,0 @@
-{
-  "name": "awatch-rus-i18n",
-  "version": "1.1.2",
-  "description": "Internationalization (i18n) module for AWatch-rus project",
-  "type": "module",
-  "scripts": {
-    "validate": "node scripts/validate-locales.js",
-    "coverage": "node scripts/check-coverage.js",
-    "extract": "node scripts/extract-keys.js",
-    "bump": "node scripts/bump-version.js"
-  },
-  "keywords": [
-    "i18n",
-    "localization",
-    "l10n",
-    "russian",
-    "activitywatch"
-  ],
-  "author": "AWatch-rus Team",
-  "license": "MIT",
-  "engines": {
-    "node": ">=16.0.0"
-  },
-  "devDependencies": {
-    "glob": "^10.3.0",
-    "jsonschema": "^1.4.1"
-  }
-}

i18n/ru-RU.json

@@ -1,62 +0,0 @@
-{
-  "version": "1.1.2",
-  "language": "ru",
-  "fallback": "en",
-  "messages": {
-    "errors.admin_required": "Запустите этот скрипт из сеанса PowerShell с правами администратора.",
-    "errors.package_not_found": "Не удалось найти исполняемый файл ActivityWatch: {0}",
-    "errors.binary_missing": "Отсутствует требуемый двоичный файл ActivityWatch: {0}",
-    "errors.no_users_resolved": "Не определено целевых пользователей. Укажите -Users или -UserListPath.",
-    "errors.config_not_found": "Файл конфигурации развертывания не найден: {0}",
-    "errors.schtasks_failed": "Команда schtasks.exe /Change не выполнена для задачи {0}",
-    "errors.icacls_failed": "Команда icacls не выполнена для {0}",
-    "errors.directory_create_failed": "Не удалось создать каталог: {0}",
-    "errors.archive_extract_failed": "Не удалось распаковать архив: {0}",
-    "errors.download_failed": "Не удалось загрузить файл: {0}",
-    "errors.process_not_found": "Процесс не найден: {0}",
-    "errors.bucket_create_failed": "Не удалось создать бакет ActivityWatch: {0}",
-    "errors.heartbeat_failed": "Не удалось отправить heartbeat: {0}",
-    "errors.task_schedule_failed": "Не удалось запланировать задачу: {0}",
-    "errors.permission_denied": "Отказано в доступе: {0}",
-    "errors.invalid_parameter": "Недопустимый параметр: {0} = {1}",
-    "errors.validation_failed": "Проверка не пройдена: {0}",
-    "info.starting_deployment": "Начало развертывания ActivityWatch...",
-    "info.deployment_complete": "Развертывание ActivityWatch завершено успешно.",
-    "info.installing_package": "Установка пакета ActivityWatch версии {0}...",
-    "info.creating_directories": "Создание необходимых каталогов...",
-    "info.configuring_users": "Настройка пользователей: {0}",
-    "info.creating_scheduled_tasks": "Создание запланированных задач...",
-    "info.setting_permissions": "Настройка прав доступа...",
-    "info.validating_installation": "Проверка установки...",
-    "info.backup_created": "Резервная копия создана: {0}",
-    "info.task_created": "Задача создана: {0}",
-    "info.task_updated": "Задача обновлена: {0}",
-    "info.collector_started": "Сборщик запущен: {0}",
-    "info.bucket_created": "Бакет создан: {0}",
-    "info.heartbeat_sent": "Heartbeat отправлен в {0}",
-    "info.configuration_written": "Конфигурация записана: {0}",
-    "info.artifacts_copied": "Артефакты скопированы в {0}",
-    "info.cleaning_up": "Очистка временных файлов...",
-    "info.version_check": "Проверка версии: текущая {0}, требуется {1}",
-    "warnings.deprecated_parameter": "Параметр устарел и будет удален в будущей версии: {0}",
-    "warnings.config_overwrite": "Существующая конфигурация будет перезаписана: {0}",
-    "warnings.insecure_connection": "Используется небезопасное соединение (TLS отключен)",
-    "warnings.low_disk_space": "Недостаточно места на диске: доступно {0} МБ, требуется {1} МБ",
-    "warnings.slow_response": "Медленный ответ от сервера: {0} мс",
-    "warnings.retry_attempt": "Попытка повторения {0} из {1}...",
-    "prompts.confirm_install": "Вы уверены, что хотите установить ActivityWatch для {0} пользователей?",
-    "prompts.confirm_overwrite": "Перезаписать существующий файл конфигурации {0}?",
-    "prompts.enter_server_host": "Введите адрес сервера ActivityWatch:",
-    "prompts.enter_server_port": "Введите порт сервера ActivityWatch (по умолчанию 5600):",
-    "prompts.select_install_mode": "Выберите режим установки: [1] Один пользователь, [2] Все пользователи домена",
-    "status.installation_in_progress": "Идет установка...",
-    "status.installation_success": "Установка завершена успешно",
-    "status.installation_failed": "Ошибка установки",
-    "status.configuration_pending": "Конфигурация ожидается",
-    "status.configuration_applied": "Конфигурация применена",
-    "status.service_running": "Служба работает",
-    "status.service_stopped": "Служба остановлена",
-    "status.collectors_active": "Сборщики активны",
-    "status.collectors_inactive": "Сборщики не активны"
-  }
-}

i18n/scripts/bump-version.js

@@ -1,128 +0,0 @@
-#!/usr/bin/env node
-/**
- * Auto-versioning script for i18n locale files
- * Bumps version based on changes and updates all catalogs consistently
- */
-
-import { readFileSync, writeFileSync, readdirSync } from 'fs';
-import { join } from 'path';
-
-const I18N_DIR = join(new URL('.', import.meta.url).pathname, '..');
-
-function parseVersion(versionStr) {
-    const match = versionStr.match(/^(\d+)\.(\d+)\.(\d+)$/);
-    if (!match) return null;
-    return {
-        major: parseInt(match[1]),
-        minor: parseInt(match[2]),
-        patch: parseInt(match[3])
-    };
-}
-
-function formatVersion(version) {
-    return `${version.major}.${version.minor}.${version.patch}`;
-}
-
-function bumpVersion(version, type) {
-    const v = parseVersion(version);
-    if (!v) return version;
-    
-    switch (type) {
-        case 'major':
-            return formatVersion({ major: v.major + 1, minor: 0, patch: 0 });
-        case 'minor':
-            return formatVersion({ major: v.major, minor: v.minor + 1, patch: 0 });
-        case 'patch':
-        default:
-            return formatVersion({ major: v.major, minor: v.minor, patch: v.patch + 1 });
-    }
-}
-
-function getChangeType() {
-    const args = process.argv.slice(2);
-    if (args.includes('--major')) return 'major';
-    if (args.includes('--minor')) return 'minor';
-    return 'patch';
-}
-
-function updateLocaleFile(filePath, newVersion) {
-    const content = readFileSync(filePath, 'utf-8');
-    let catalog;
-    
-    try {
-        catalog = JSON.parse(content);
-    } catch (error) {
-        console.error(`Error parsing ${filePath}: ${error.message}`);
-        return false;
-    }
-    
-    const oldVersion = catalog.version;
-    catalog.version = newVersion;
-    
-    // Preserve formatting with 2-space indentation
-    const updatedContent = JSON.stringify(catalog, null, 2);
-    
-    try {
-        writeFileSync(filePath, updatedContent, 'utf-8');
-        console.log(`✓ ${filePath}: ${oldVersion} → ${newVersion}`);
-        return true;
-    } catch (error) {
-        console.error(`Error writing ${filePath}: ${error.message}`);
-        return false;
-    }
-}
-
-function main() {
-    const changeType = getChangeType();
-    
-    console.log(`🔧 Auto-versioning i18n catalogs (${changeType} bump)\n`);
-    
-    // Get reference version from en-US.json
-    const referencePath = join(I18N_DIR, 'en-US.json');
-    let referenceVersion;
-    
-    try {
-        const reference = JSON.parse(readFileSync(referencePath, 'utf-8'));
-        referenceVersion = reference.version;
-    } catch (error) {
-        console.error(`Cannot read reference locale: ${error.message}`);
-        process.exit(1);
-    }
-    
-    if (!referenceVersion) {
-        console.error('Reference locale has no version field');
-        process.exit(1);
-    }
-    
-    const newVersion = bumpVersion(referenceVersion, changeType);
-    console.log(`Current version: ${referenceVersion}`);
-    console.log(`New version: ${newVersion}\n`);
-    
-    // Update all locale files
-    const files = readdirSync(I18N_DIR)
-        .filter(f => f.endsWith('.json'));
-    
-    let successCount = 0;
-    let failCount = 0;
-    
-    for (const file of files) {
-        const filePath = join(I18N_DIR, file);
-        if (updateLocaleFile(filePath, newVersion)) {
-            successCount++;
-        } else {
-            failCount++;
-        }
-    }
-    
-    console.log(`\n─────────────────────────────────────`);
-    console.log(`Updated: ${successCount} files`);
-    console.log(`Failed: ${failCount} files`);
-    
-    if (failCount > 0) {
-        process.exit(1);
-    }
-    
-    console.log('\n✅ Version bump completed successfully!');
-}
-
-main();

i18n/scripts/check-coverage.js

@@ -1,227 +0,0 @@
-#!/usr/bin/env node
-/**
- * Coverage analysis script for i18n locales
- * Compares all locales against the reference (en-US) and reports coverage
- */
-
-import { readFileSync, readdirSync } from 'fs';
-import { join, basename } from 'path';
-
-const I18N_DIR = join(new URL('.', import.meta.url).pathname, '..');
-const REFERENCE_LOCALE = 'en-US.json';
-
-function loadLocale(fileName) {
-    const filePath = join(I18N_DIR, fileName);
-    const content = readFileSync(filePath, 'utf-8');
-    return JSON.parse(content);
-}
-
-function analyzeCoverage() {
-    const files = readdirSync(I18N_DIR)
-        .filter(f => f.endsWith('.json') && f !== REFERENCE_LOCALE && !f.startsWith('package'));
-    
-    if (files.length === 0) {
-        console.error('No locale files found besides the reference');
-        process.exit(1);
-    }
-    
-    let reference;
-    try {
-        reference = loadLocale(REFERENCE_LOCALE);
-    } catch (error) {
-        console.error(`Cannot load reference locale (${REFERENCE_LOCALE}): ${error.message}`);
-        process.exit(1);
-    }
-    
-    const referenceKeys = Object.keys(reference.messages || {});
-    const referenceCategories = categorizeKeys(referenceKeys);
-    
-    console.log('📊 i18n Coverage Analysis\n');
-    console.log(`Reference: ${REFERENCE_LOCALE} (${referenceKeys.length} messages)\n`);
-    
-    const results = [];
-    
-    for (const fileName of files) {
-        const localeName = basename(fileName, '.json');
-        
-        let catalog;
-        try {
-            catalog = loadLocale(fileName);
-        } catch (error) {
-            results.push({
-                locale: localeName,
-                error: error.message
-            });
-            continue;
-        }
-        
-        const localeKeys = Object.keys(catalog.messages || {});
-        const localeCategories = categorizeKeys(localeKeys);
-        
-        const missingKeys = referenceKeys.filter(k => !localeKeys.includes(k));
-        const extraKeys = localeKeys.filter(k => !referenceKeys.includes(k));
-        
-        const coverage = referenceKeys.length > 0 
-            ? ((referenceKeys.length - missingKeys.length) / referenceKeys.length * 100).toFixed(2)
-            : 0;
-        
-        const categoryCoverage = {};
-        for (const [category, refKeys] of Object.entries(referenceCategories)) {
-            const localeCatKeys = localeCategories[category] || [];
-            const missing = refKeys.filter(k => !localeCatKeys.includes(k));
-            categoryCoverage[category] = {
-                total: refKeys.length,
-                translated: refKeys.length - missing.length,
-                missing: missing.length,
-                percent: refKeys.length > 0 
-                    ? ((refKeys.length - missing.length) / refKeys.length * 100).toFixed(1)
-                    : 100
-            };
-        }
-        
-        results.push({
-            locale: localeName,
-            version: catalog.version,
-            language: catalog.language,
-            fallback: catalog.fallback,
-            totalMessages: localeKeys.length,
-            referenceMessages: referenceKeys.length,
-            missing: missingKeys,
-            extra: extraKeys,
-            coverage: parseFloat(coverage),
-            categoryCoverage
-        });
-    }
-    
-    // Sort by coverage descending
-    results.sort((a, b) => (b.coverage || 0) - (a.coverage || 0));
-    
-    // Print summary table
-    console.log('┌' + '─'.repeat(78) + '┐');
-    console.log('│ ' + padRight('Locale', 12) + ' │ ' + 
-                padRight('Version', 10) + ' │ ' +
-                padRight('Language', 10) + ' │ ' +
-                padRight('Coverage', 10) + ' │ ' +
-                padRight('Missing', 10) + ' │ ' +
-                padRight('Extra', 10) + ' │');
-    console.log('├' + '─'.repeat(78) + '┤');
-    
-    for (const result of results) {
-        if (result.error) {
-            console.log('│ ' + padRight(result.locale, 12) + ' │ ERROR: ' + result.error);
-            continue;
-        }
-        
-        const coverageStr = result.coverage.toFixed(2) + '%';
-        const coverageColor = getCoverageIndicator(result.coverage);
-        
-        console.log('│ ' + padRight(result.locale, 12) + ' │ ' + 
-                    padRight(result.version || 'N/A', 10) + ' │ ' +
-                    padRight(result.language || 'N/A', 10) + ' │ ' +
-                    padRight(coverageStr + coverageColor, 10) + ' │ ' +
-                    padRight(result.missing.length.toString(), 10) + ' │ ' +
-                    padRight(result.extra.length.toString(), 10) + ' │');
-    }
-    
-    console.log('└' + '─'.repeat(78) + '┘\n');
-    
-    // Detailed breakdown per locale
-    for (const result of results) {
-        if (result.error || result.missing.length === 0) continue;
-        
-        console.log(`📋 ${result.locale} - Missing Keys (${result.missing.length}):`);
-        
-        // Group by category
-        const missingByCategory = {};
-        for (const key of result.missing) {
-            const category = key.split('.')[0];
-            if (!missingByCategory[category]) {
-                missingByCategory[category] = [];
-            }
-            missingByCategory[category].push(key);
-        }
-        
-        for (const [category, keys] of Object.entries(missingByCategory)) {
-            console.log(`   ${category} (${keys.length}):`);
-            keys.slice(0, 10).forEach(key => console.log(`      - ${key}`));
-            if (keys.length > 10) {
-                console.log(`      ... and ${keys.length - 10} more`);
-            }
-        }
-        console.log('');
-    }
-    
-    // Category coverage summary
-    console.log('📈 Category Coverage Summary:\n');
-    const categories = Object.keys(referenceCategories);
-    
-    console.log('┌' + '─'.repeat(68) + '┐');
-    console.log('│ ' + padRight('Category', 20) + ' │ ' + 
-                padRight('Ref Count', 12) + ' │ ' +
-                'Average Coverage' + ' │');
-    console.log('├' + '─'.repeat(68) + '┤');
-    
-    for (const category of categories) {
-        const avgCoverage = results
-            .filter(r => !r.error && r.categoryCoverage[category])
-            .reduce((sum, r) => sum + parseFloat(r.categoryCoverage[category].percent), 0) / 
-            Math.max(results.filter(r => !r.error).length, 1);
-        
-        console.log('│ ' + padRight(category, 20) + ' │ ' + 
-                    padRight(referenceCategories[category].length.toString(), 12) + ' │ ' +
-                    padRight(avgCoverage.toFixed(1) + '%', 16) + ' │');
-    }
-    
-    console.log('└' + '─'.repeat(68) + '┘\n');
-    
-    // Recommendations
-    console.log('💡 Recommendations:\n');
-    
-    const lowCoverageLocales = results.filter(r => !r.error && r.coverage < 80);
-    if (lowCoverageLocales.length > 0) {
-        console.log('1. Priority locales for translation:');
-        lowCoverageLocales.forEach(r => {
-            console.log(`   - ${r.locale}: ${r.missing.length} keys missing (${r.coverage.toFixed(1)}% coverage)`);
-        });
-        console.log('');
-    }
-    
-    const allHaveFallback = results.every(r => !r.error && r.fallback);
-    if (!allHaveFallback) {
-        console.log('2. Consider adding fallback locale to all catalogs for better resilience');
-        console.log('');
-    }
-    
-    const versionMismatch = results.filter(r => !r.error && r.version !== reference.version);
-    if (versionMismatch.length > 0) {
-        console.log('3. Version mismatch detected. Consider bumping versions:');
-        versionMismatch.forEach(r => {
-            console.log(`   - ${r.locale}: ${r.version} (reference: ${reference.version})`);
-        });
-        console.log('');
-    }
-}
-
-function categorizeKeys(keys) {
-    const categories = {};
-    for (const key of keys) {
-        const category = key.split('.')[0];
-        if (!categories[category]) {
-            categories[category] = [];
-        }
-        categories[category].push(key);
-    }
-    return categories;
-}
-
-function padRight(str, length) {
-    return (str || '').toString().padEnd(length, ' ');
-}
-
-function getCoverageIndicator(coverage) {
-    if (coverage >= 95) return ' ✅';
-    if (coverage >= 80) return ' ⚠️';
-    return ' ❌';
-}
-
-analyzeCoverage();

i18n/scripts/validate-locales.js

@@ -1,225 +0,0 @@
-#!/usr/bin/env node
-/**
- * Locale validation script for i18n JSON files
- * Validates structure, required fields, and message format placeholders
- */
-
-import { readFileSync, readdirSync } from 'fs';
-import { join, basename } from 'path';
-
-const I18N_DIR = join(new URL('.', import.meta.url).pathname, '..');
-const REQUIRED_FIELDS = ['version', 'language', 'fallback', 'messages'];
-const MESSAGE_CATEGORIES = ['errors', 'info', 'warnings', 'prompts', 'status', 'choices'];
-
-function validateLocaleFile(filePath) {
-    const errors = [];
-    const warnings = [];
-    
-    let content;
-    try {
-        content = readFileSync(filePath, 'utf-8');
-    } catch (error) {
-        return {
-            valid: false,
-            errors: [`Cannot read file: ${error.message}`],
-            warnings: []
-        };
-    }
-    
-    let catalog;
-    try {
-        catalog = JSON.parse(content);
-    } catch (error) {
-        return {
-            valid: false,
-            errors: [`Invalid JSON: ${error.message}`],
-            warnings: []
-        };
-    }
-    
-    // Check required top-level fields
-    for (const field of REQUIRED_FIELDS) {
-        if (!(field in catalog)) {
-            errors.push(`Missing required field: "${field}"`);
-        }
-    }
-    
-    if (!catalog.version) {
-        warnings.push('Version is empty or missing');
-    } else if (!/^\d+\.\d+\.\d+$/.test(catalog.version)) {
-        warnings.push(`Version "${catalog.version}" does not follow semver (X.Y.Z)`);
-    }
-    
-    if (!catalog.language || typeof catalog.language !== 'string') {
-        errors.push('Field "language" must be a non-empty string');
-    }
-    
-    if (catalog.fallback !== null && typeof catalog.fallback !== 'string') {
-        warnings.push('Field "fallback" should be null or a locale string');
-    }
-    
-    // Validate messages structure
-    if (!catalog.messages || typeof catalog.messages !== 'object') {
-        errors.push('Field "messages" must be an object');
-        return { valid: false, errors, warnings };
-    }
-    
-    const messageKeys = Object.keys(catalog.messages);
-    
-    // Check for proper key naming convention (category.key)
-    const invalidKeys = messageKeys.filter(key => !key.includes('.'));
-    if (invalidKeys.length > 0) {
-        warnings.push(`Keys without category prefix: ${invalidKeys.slice(0, 5).join(', ')}`);
-    }
-    
-    // Check message categories coverage
-    const foundCategories = new Set(messageKeys.map(k => k.split('.')[0]));
-    const missingCategories = MESSAGE_CATEGORIES.filter(cat => !foundCategories.has(cat));
-    if (missingCategories.length > 0) {
-        warnings.push(`Missing message categories: ${missingCategories.join(', ')}`);
-    }
-    
-    // Validate message format placeholders consistency
-    const placeholderPattern = /\{(\d+)\}/g;
-    const messagesWithPlaceholders = {};
-    
-    for (const [key, value] of Object.entries(catalog.messages)) {
-        if (typeof value !== 'string') {
-            errors.push(`Message "${key}" must be a string, got ${typeof value}`);
-            continue;
-        }
-        
-        if (value.trim() === '') {
-            warnings.push(`Message "${key}" is empty`);
-        }
-        
-        const matches = value.match(placeholderPattern);
-        if (matches) {
-            const indices = matches.map(m => parseInt(m.slice(1, -1)));
-            const maxIndex = Math.max(...indices);
-            const minIndex = Math.min(...indices);
-            
-            if (minIndex !== 0) {
-                warnings.push(`Message "${key}": placeholder indices should start at 0`);
-            }
-            
-            const expectedCount = maxIndex + 1;
-            const uniqueIndices = new Set(indices);
-            if (uniqueIndices.size !== expectedCount) {
-                warnings.push(`Message "${key}": potentially missing placeholder indices (0-${maxIndex})`);
-            }
-            
-            messagesWithPlaceholders[key] = {
-                count: uniqueIndices.size,
-                maxIndex
-            };
-        }
-    }
-    
-    // Check for consistent placeholder usage across locales (if reference exists)
-    const refLocalePath = join(I18N_DIR, 'en-US.json');
-    if (basename(filePath) !== 'en-US.json' && refLocalePath !== filePath) {
-        try {
-            const refContent = JSON.parse(readFileSync(refLocalePath, 'utf-8'));
-            const refMessages = refContent.messages || {};
-            
-            for (const [key, data] of Object.entries(messagesWithPlaceholders)) {
-                if (refMessages[key]) {
-                    const refMatches = refMessages[key].match(placeholderPattern);
-                    if (refMatches) {
-                        const refIndices = new Set(refMatches.map(m => parseInt(m.slice(1, -1))));
-                        if (refIndices.size !== data.count) {
-                            warnings.push(`Message "${key}": placeholder count differs from en-US (${data.count} vs ${refIndices.size})`);
-                        }
-                    }
-                }
-            }
-        } catch (e) {
-            // Reference locale may not exist
-        }
-    }
-    
-    return {
-        valid: errors.length === 0,
-        errors,
-        warnings,
-        stats: {
-            totalMessages: messageKeys.length,
-            messagesWithPlaceholders: Object.keys(messagesWithPlaceholders).length,
-            categories: Array.from(foundCategories)
-        }
-    };
-}
-
-function main() {
-    const args = process.argv.slice(2);
-    const specificFile = args[0];
-    
-    let filesToValidate = [];
-    
-    if (specificFile) {
-        filesToValidate = [join(I18N_DIR, specificFile)];
-    } else {
-        const files = readdirSync(I18N_DIR);
-        filesToValidate = files
-            .filter(f => f.endsWith('.json') && !f.startsWith('package'))
-            .map(f => join(I18N_DIR, f));
-    }
-    
-    if (filesToValidate.length === 0) {
-        console.error('No locale files found to validate');
-        process.exit(1);
-    }
-    
-    let allValid = true;
-    let totalErrors = 0;
-    let totalWarnings = 0;
-    
-    console.log('🔍 Validating locale files...\n');
-    
-    for (const filePath of filesToValidate) {
-        const fileName = basename(filePath);
-        console.log(`📄 ${fileName}`);
-        
-        const result = validateLocaleFile(filePath);
-        
-        if (result.stats) {
-            console.log(`   Messages: ${result.stats.totalMessages}`);
-            console.log(`   Categories: ${result.stats.categories.join(', ')}`);
-            console.log(`   With placeholders: ${result.stats.messagesWithPlaceholders}`);
-        }
-        
-        if (result.errors.length > 0) {
-            console.log(`   ❌ Errors (${result.errors.length}):`);
-            result.errors.forEach(err => console.log(`      - ${err}`));
-            totalErrors += result.errors.length;
-            allValid = false;
-        } else {
-            console.log(`   ✅ No errors`);
-        }
-        
-        if (result.warnings.length > 0) {
-            console.log(`   ⚠️  Warnings (${result.warnings.length}):`);
-            result.warnings.slice(0, 5).forEach(warn => console.log(`      - ${warn}`));
-            if (result.warnings.length > 5) {
-                console.log(`      ... and ${result.warnings.length - 5} more`);
-            }
-            totalWarnings += result.warnings.length;
-        }
-        
-        console.log('');
-    }
-    
-    console.log('─'.repeat(50));
-    console.log(`Summary: ${totalErrors} errors, ${totalWarnings} warnings`);
-    
-    if (allValid) {
-        console.log('✅ All locale files are valid!');
-        process.exit(0);
-    } else {
-        console.log('❌ Validation failed. Please fix the errors above.');
-        process.exit(1);
-    }
-}
-
-main();

install-kit-awindows-20260427-211240/MANIFEST.txt

@@ -0,0 +1,40 @@
+0754dcba7c651d67a40e09446868d2fcae623a100d4fb01794dd96272d353b49  install-kit-awindows-20260427-211240/README-INSTALL-KIT.txt
+089595753398c8b82980919d230dafac548c3ba36817f5c96a68051582f9faa3  install-kit-awindows-20260427-211240/ansible/README.md
+412bb766bbf0791c3593f38daa771d5d0aa58cc1f2d3c9010fcd4588d0fe87df  install-kit-awindows-20260427-211240/ansible/deploy_aw_pfsense_poller.yml
+90ac38a33918fcd3620f078f51fbf7c6a9d7f8fd1a34d16b38cb3ac45678b0d7  install-kit-awindows-20260427-211240/ansible/deploy_aw_server.yml
+a649eeb57472fb259d248983c486f0474bfb7317600feb98f76a80e7af7e4549  install-kit-awindows-20260427-211240/ansible/deploy_aw_windows.yml
+531bfec24f86d28a06e5c0d73005489a818e2c7b1cce1d98f524a3f76802b8ee  install-kit-awindows-20260427-211240/ansible/group_vars/all.example.yml
+95696c243ab331f06e77a40a9800c4b6668de77675ebbdf2ef54ae49e1b18874  install-kit-awindows-20260427-211240/ansible/group_vars/pfsense-poller.example.yml
+c5cab36645065815571c99f6d360f910dcccbb54b780c8bfd526a6cdc3684e19  install-kit-awindows-20260427-211240/ansible/group_vars/proxmox-matrix.example.yml
+35a33c8a1c75ded5e85c6b79e0b3efde07959ff61ee5f66d83b7e0c2abe87fc5  install-kit-awindows-20260427-211240/ansible/group_vars/proxmox.example.yml
+7c468f252e328fd3bb7ee776a45feea88efc4b438dfef55b832da4eea867aaf2  install-kit-awindows-20260427-211240/ansible/group_vars/windows.example.yml
+195e7dbdb91f4e77db3263bd0812301ddc912a37ba1519688768bb64a2887567  install-kit-awindows-20260427-211240/ansible/install_full_stack.yml
+2e4e94d90143923fefd3ec1257d0ec57daa3e96450d85471bc2c418aae37e105  install-kit-awindows-20260427-211240/ansible/inventory.example.ini
+d9e43352fd6bdb647db9754ab2c557b6bb27f88f51b2bf23d8c19227e535e7b9  install-kit-awindows-20260427-211240/ansible/provision_proxmox_ct_and_deploy_aw.yml
+f3d34547f345ad1c635ee44613a60e7f08479f9ae4d1111810bc7e5968bfb084  install-kit-awindows-20260427-211240/ansible/provision_proxmox_ct_matrix_and_deploy_aw.yml
+ef4ed198745777bd1227170241b2db21dc853685f962d6116241c55216b466d6  install-kit-awindows-20260427-211240/ansible/tasks/provision_ct_and_deploy_aw.yml
+a50dbadbf619342c2178e255b68f69a36503756daf80eedd9170311c63964f2e  install-kit-awindows-20260427-211240/aw-server/activitywatch-server.service
+2dbf55d4a8f204ebdc97af926d90435932c0aad7a2431e2b9987e47c5abf71a9  install-kit-awindows-20260427-211240/aw-server/apply_webui_ru_patch.sh
+07d4e583f6e9757a11f01558e1f15cfd73c4d82695f1768204f2f50621712168  install-kit-awindows-20260427-211240/aw-server/aw-host-groups.json
+09605da1754abb0dc0446825580b57ebad6e646dc670f9f072fce1489e88dd43  install-kit-awindows-20260427-211240/aw-server/aw-ru-patch.js
+7c5952f8f0a8590e849ea8381bfcd7059b138250bca8551bd5625f395eb66cd8  install-kit-awindows-20260427-211240/aw-server/aw-server.env.example
+98c0bed353bbda0fa7a69df23f3b008cb0e8e70cdff6cc63330d4caf79fd3280  install-kit-awindows-20260427-211240/aw-server/aw-sw-cleanup.js
+dce731fdfdcfd773c154d12dbd6b9e621a0bff17ced5a05a65f0fdcb1adcb70f  install-kit-awindows-20260427-211240/aw-server/install_aw_server.sh
+1856e9f44636030b0cb9ece37ba2a0618eb5187fa82c7969976c1bb5f10fc622  install-kit-awindows-20260427-211240/aw-server/settings/classes-worktime.json
+ff07b90cb6a7f09b27d522307cf55b0359e136a2e695190b8564e859f14f9204  install-kit-awindows-20260427-211240/aw-server/settings/views-default.json
+1654cf688560465fcce629468a0be869b0c81b056179e1b5e9bcc7a2d5ed6ce0  install-kit-awindows-20260427-211240/server-configs-192.168.100.21/awatch-rus-admin.deployment-config.json
+ac022b9a074c542ade66d18af8db385f6c14376ac4eadd54ef033dfa7f60fb50  install-kit-awindows-20260427-211240/server-configs-192.168.100.21/awatch-rus-u2u5.deployment-config.json
+98cf4c54d494318b74cfbd3c8892830a34928bd76a2296d5333e5e176c1f3f49  install-kit-awindows-20260427-211240/server-configs-192.168.100.21/awatch-rus-user1.deployment-config.json
+33aa34b89246d6c079ef9afe2f5cd153bd9d5946b69a175ff6fd678c77f61da5  install-kit-awindows-20260427-211240/windows/ActivityWatch.Windows.Common.psd1
+0cb9cd8d8b612429f79899c126f4141ab4fbbb6d919425c0b8fd8d0a74b1bd44  install-kit-awindows-20260427-211240/windows/ActivityWatch.Windows.Common.psm1
+7db2d3767ae81c877e8f04ecbc77a2fc26b2d9bbbf77d0e774fba0a7956bd0a6  install-kit-awindows-20260427-211240/windows/browser-domains-native-collector.ps1
+b497400a1ba57cddf28dc8e217115dc85eccb67150cbdbb6a81abd804ed20109  install-kit-awindows-20260427-211240/windows/deploy-domain-users.ps1
+973db51854fc744539a7b75e13c6749e822a08a79f47447485611f07e8f902a8  install-kit-awindows-20260427-211240/windows/deploy-ensemble.ps1
+0d66dcb551889e6b7bc21b29d53b77e46f41d61dd2e4e0d9913dbf0f8bd5eb18  install-kit-awindows-20260427-211240/windows/deploy-single-user.ps1
+8857f3e17f3f3ed6f211ce7f0a0c46c586a2548541078401ee3befaa20924b3d  install-kit-awindows-20260427-211240/windows/dlp-endpoint-signals-collector.ps1
+aef0032edd9b1e0c54f7b575664ed511dfc6cb53364e7496cbc95e137678e11a  install-kit-awindows-20260427-211240/windows/dlp-policy.example.json
+f03886caf56c6838e8a163d6b48d1f229e83a5682aeeb447c3a65f13d62dbca4  install-kit-awindows-20260427-211240/windows/hardening-recovery.ps1
+71911cd53ad0abd8bf83994f8a79bbbfe2c0eaf4f4c5f6c2d636dd7786191c2f  install-kit-awindows-20260427-211240/windows/migrate-awatch-rus-paths.ps1
+5dcf249742bd82fa0c803c878bfa0a1344b7b14df85c05f12e8c205663aea158  install-kit-awindows-20260427-211240/windows/validate-deployment.ps1
+731098681d89b9af6f3872abd586ac3b1faba2d7f9340211e503f52ad0243b3f  install-kit-awindows-20260427-211240/windows/web-category-rules.example.json
+41171f0d7ed1e8b00dd0faf1a4b75c9cb063fd09aba8d333851a7a31fb297de1  install-kit-awindows-20260427-211240/windows/worktime-session-collector.ps1

install-kit-awindows-20260427-211240/README-INSTALL-KIT.txt

@@ -0,0 +1,10 @@
+ActivityWatch DetMir Windows Install Kit
+
+Includes:
+- windows/* (deploy scripts, collectors, common module, configs/examples)
+- ansible/* (Windows and AW server playbooks, examples, inventory, tasks)
+- aw-server/* (server installer, RU patch loader, host groups, default settings)
+- server-configs-192.168.100.21/* (working Windows/RDP config snapshots)
+
+Source:
+- Local project snapshot at build time.

install-kit-awindows-20260427-211240/ansible/README.md

@@ -0,0 +1,151 @@
+# Ansible ensemble for AWatch-rus
+
+Эта директория содержит Ansible-ensemble для полного развёртывания AWatch-rus:
+
+- деплой на уже существующий Debian host/CT;
+- полный цикл с нуля в Proxmox: создание CT + bootstrap + установка ActivityWatch + RU patch;
+- централизованное развёртывание Windows/RDP collector'ов по WinRM;
+- развёртывание внешнего pfSense poller'а на Debian/Ubuntu utility VM.
+
+## Файлы
+
+- `ansible/deploy_aw_server.yml` — основной playbook для уже существующего Debian/CT host.
+- `ansible/provision_proxmox_ct_and_deploy_aw.yml` — полный playbook для Proxmox.
+- `ansible/provision_proxmox_ct_matrix_and_deploy_aw.yml` — массовый полный playbook (несколько CT).
+- `ansible/deploy_aw_windows.yml` — WinRM playbook для развёртывания Windows/RDP collector'ов.
+- `ansible/deploy_aw_pfsense_poller.yml` — развёртывание pfSense poller'а.
+- `ansible/install_full_stack.yml` — полный установочный playbook (оркестратор всех этапов).
+- `ansible/inventory.example.ini` — шаблон inventory.
+- `ansible/group_vars/*.example.yml` — шаблоны переменных.
+
+## Быстрый запуск
+
+1. Скопируйте шаблоны:
+   - `cp ansible/inventory.example.ini ansible/inventory.ini`
+   - `cp ansible/group_vars/all.example.yml ansible/group_vars/all.yml`
+2. Заполните значения в `inventory.ini` и `group_vars/all.yml`.
+3. Запустите:
+
+```bash
+cd ansible
+ansible-playbook -i inventory.ini deploy_aw_server.yml
+```
+
+## Полный установочный playbook (всё за один запуск)
+
+Если нужно прогнать полный цикл одной командой:
+
+```bash
+cd ansible
+ansible-playbook -i inventory.ini install_full_stack.yml
+```
+
+Что делает:
+
+- `provision_proxmox_ct_and_deploy_aw.yml` (если есть хосты в группе `[proxmox]`);
+- `deploy_aw_server.yml` (группа `[aw_server]`);
+- `deploy_aw_windows.yml` (группа `[aw_windows]`);
+- `deploy_aw_pfsense_poller.yml` (группа `[aw_pfsense_pollers]`).
+
+Пустые группы в `inventory.ini` безопасны: соответствующий play будет пропущен.
+
+## Полный запуск с нуля в Proxmox
+
+1. Подготовьте inventory и vars:
+   - `cp ansible/inventory.example.ini ansible/inventory.ini`
+   - `cp ansible/group_vars/all.example.yml ansible/group_vars/all.yml`
+   - `cp ansible/group_vars/proxmox.example.yml ansible/group_vars/proxmox.yml`
+2. Заполните `group_vars/proxmox.yml` и `group_vars/all.yml`.
+3. Запустите playbook:
+
+```bash
+cd ansible
+ansible-playbook -i inventory.ini provision_proxmox_ct_and_deploy_aw.yml
+```
+
+## Массовый запуск (матрица CT)
+
+1. Подготовьте матрицу:
+   - `cp ansible/group_vars/proxmox-matrix.example.yml ansible/group_vars/proxmox-matrix.yml`
+2. Заполните `proxmox-matrix.yml`.
+3. Запустите:
+
+```bash
+cd ansible
+ansible-playbook -i inventory.ini provision_proxmox_ct_matrix_and_deploy_aw.yml
+```
+
+## Windows/RDP rollout (WinRM)
+
+1. Подготовьте inventory и vars:
+   - `cp ansible/inventory.example.ini ansible/inventory.ini`
+   - `cp ansible/group_vars/windows.example.yml ansible/group_vars/windows.yml`
+2. Заполните `inventory.ini` (секция `[aw_windows]`) и `group_vars/windows.yml`.
+   - Для русской локализации Windows часто нужен `ansible_user=Администратор` (а не `Administrator`).
+   - Если WinRM закрыт, playbook не сможет стартовать и нужно сначала открыть `5985/5986` и `wsman`.
+3. Запустите:
+
+```bash
+cd ansible
+ansible-playbook -i inventory.ini deploy_aw_windows.yml
+```
+
+Playbook:
+
+- выгружает полный `windows/*` toolkit на целевой хост в InnoSetup-compatible каталог `C:\Program Files\AWatch-rus\windows`, включая DLP и `worktime-session-collector.ps1`;
+- если найден legacy config `C:\ProgramData\ActivityWatch-Phase2\deployment-config.json`, выполняет безопасную миграцию через `migrate-awatch-rus-paths.ps1`: backup, остановка задач, перенос данных, переписывание путей, пересоздание scheduled tasks и validation;
+- выполняет `deploy-ensemble.ps1` (deploy + hardening/recovery) с policy/rules из AWatch-rus toolkit;
+- после deploy принудительно запускает `ActivityWatch Recovery` и все `ActivityWatch Launch *` задачи;
+- выполняет API smoke-check bucket `aw-watcher-afk_<COMPUTERNAME>` и ожидает свежие `not-afk` события;
+- запускает `validate-deployment.ps1`;
+- забирает JSON-отчёт в локальную директорию (`/tmp/aw-rus-validation` по умолчанию).
+
+Дополнительные флаги:
+
+- `aw_windows_afk_enabled: false` — не запускать `aw-watcher-afk`;
+- `aw_windows_window_enabled: false` — не запускать `aw-watcher-window`;
+- `aw_windows_incident_capture_enabled: false` — отключить блок incidentCapture;
+- `aw_windows_incident_screenshot_enabled: false` — не делать скриншот при DLP-инциденте;
+- `aw_windows_incident_artifacts_root: 'C:\...\incident-artifacts'` — переопределить путь артефактов;
+- `aw_windows_deploy_root: 'C:\Program Files\AWatch-rus'` — каталог toolkit, совпадает с InnoSetup `{app}`;
+- `aw_windows_install_root: 'C:\Program Files\AWatch-rus\bin'` — каталог бинарников, совпадает с InnoSetup `AwDefaultInstallRoot`;
+- `aw_windows_state_root: 'C:\ProgramData\AWatch-rus'` — каталог состояния/отчётов, совпадает с InnoSetup `AwDefaultStateRoot`;
+- `aw_windows_validation_remote_path: '{{ aw_windows_state_root }}\aw_validate_ansible.json'` — отчёт Ansible-валидации хранится рядом с `ensemble-report-*.json`;
+- `aw_windows_migration_enabled: true` — включить guard миграции текущего production из `ActivityWatch-Phase2` в единый `AWatch-rus`;
+- `aw_windows_legacy_install_root` / `aw_windows_legacy_state_root` — старые production paths, откуда выполняется перенос;
+- `aw_windows_migration_report_remote_path` — JSON-отчёт о миграции на Windows-хосте;
+- `aw_windows_package_version`, `aw_windows_package_url`, `aw_windows_package_zip_path` — версия и источник Windows-пакета ActivityWatch;
+- `aw_windows_api_smoke_check_bucket: ""` — автоматически использовать `aw-watcher-afk_<COMPUTERNAME>`;
+- `aw_windows_fail_on_validation_error: true` — завершать playbook ошибкой, если `validate-deployment.ps1` возвращает `overallOk=false`;
+- `aw_windows_skip_hardening: true` — пропустить `hardening-recovery.ps1` внутри ensemble-скрипта.
+
+## Развёртывание pfSense poller
+
+1. Подготовьте vars:
+   - `cp ansible/group_vars/pfsense-poller.example.yml ansible/group_vars/pfsense-poller.yml`
+2. Добавьте inventory group `[aw_pfsense_pollers]`.
+3. Запустите:
+
+```bash
+cd ansible
+ansible-playbook -i inventory.ini deploy_aw_pfsense_poller.yml
+```
+
+Playbook:
+
+- ставит `python3`;
+- копирует `pfsense-aw-poller.py`;
+- пишет `/etc/aw-pfsense/poller.json`;
+- поднимает `aw-pfsense-poller.service`.
+
+## Результат
+
+- Установлен ActivityWatch Server.
+- Создан systemd-unit `activitywatch-server.service`.
+- Установлен RU Web UI patch.
+- Для Web UI используется checksum-based cache-bust для `ru-patch-v5.js` и `sw-cleanup.js`, чтобы браузер не держал старую DLP/русскую статику после деплоя.
+- На `#/home` Web UI делит хосты на `Windows RDP` и `Virtual servers + Proxmox`.
+- Выполнена валидация API `http://127.0.0.1:5600/api/0/info`.
+- Для полного сценария CT создаётся автоматически через `pct create`.
+- На Windows/RDP host развёрнуты AFK/window watchers, browser domain collector, DLP endpoint collector и worktime session collector.
+- Проверочный JSON-отчёт Windows playbook должен иметь `overallOk=true`.

install-kit-awindows-20260427-211240/ansible/deploy_aw_pfsense_poller.yml

@@ -0,0 +1,66 @@
+---
+- name: Развернуть pfSense ActivityWatch poller
+  hosts: aw_pfsense_pollers
+  become: true
+  gather_facts: true
+
+  vars:
+    aw_pfsense_install_root: "/opt/aw-pfsense"
+    aw_pfsense_config_dir: "/etc/aw-pfsense"
+    aw_pfsense_service_name: "aw-pfsense-poller.service"
+
+  tasks:
+    - name: Установить обязательные пакеты
+      ansible.builtin.apt:
+        name:
+          - python3
+        state: present
+        update_cache: true
+
+    - name: Создать каталоги
+      ansible.builtin.file:
+        path: "{{ item }}"
+        state: directory
+        mode: "0755"
+      loop:
+        - "{{ aw_pfsense_install_root }}"
+        - "{{ aw_pfsense_config_dir }}"
+
+    - name: Установить скрипт pfSense poller
+      ansible.builtin.copy:
+        src: "{{ aw_repo_root }}/pfsense/pfsense-aw-poller.py"
+        dest: "{{ aw_pfsense_install_root }}/pfsense-aw-poller.py"
+        mode: "0755"
+
+    - name: Установить systemd service
+      ansible.builtin.copy:
+        src: "{{ aw_repo_root }}/pfsense/pfsense-aw-poller.service"
+        dest: "/etc/systemd/system/{{ aw_pfsense_service_name }}"
+        mode: "0644"
+      notify:
+        - Перезагрузить systemd
+
+    - name: Записать конфигурацию pfSense poller
+      ansible.builtin.copy:
+        dest: "{{ aw_pfsense_config_dir }}/poller.json"
+        mode: "0600"
+        content: "{{ aw_pfsense_poller_config | to_nice_json }}"
+      notify:
+        - Перезапустить pfSense poller
+
+    - name: Включить и запустить pfSense poller
+      ansible.builtin.systemd:
+        name: "{{ aw_pfsense_service_name }}"
+        enabled: true
+        state: restarted
+        daemon_reload: true
+
+  handlers:
+    - name: Перезагрузить systemd
+      ansible.builtin.systemd:
+        daemon_reload: true
+
+    - name: Перезапустить pfSense poller
+      ansible.builtin.systemd:
+        name: "{{ aw_pfsense_service_name }}"
+        state: restarted

install-kit-awindows-20260427-211240/ansible/deploy_aw_server.yml

@@ -0,0 +1,339 @@
+---
+- name: Развернуть сервер AWatch-rus
+  hosts: aw_server
+  become: true
+  gather_facts: true
+
+  vars:
+    aw_release_root: "/opt/activitywatch/releases"
+    aw_release_dir: "{{ aw_release_root }}/{{ aw_server_version }}"
+    aw_archive_path: "/tmp/activitywatch-{{ aw_server_version }}.zip"
+    aw_bootstrap_dir: "/tmp/aw-rus-bootstrap"
+    aw_release_install_dir: "{{ aw_release_root }}/aw-server-rust-{{ aw_server_version }}"
+    aw_ru_patch_cache_bust: "{{ lookup('file', aw_repo_root + '/aw-server/aw-ru-patch.js') | hash('sha1') | truncate(12, true, '') }}"
+    aw_sw_cleanup_cache_bust: "{{ lookup('file', aw_repo_root + '/aw-server/aw-sw-cleanup.js') | hash('sha1') | truncate(12, true, '') }}"
+    aw_worktime_classes: "{{ lookup('file', aw_repo_root + '/aw-server/settings/classes-worktime.json') | from_json }}"
+    aw_default_views: "{{ lookup('file', aw_repo_root + '/aw-server/settings/views-default.json') | from_json }}"
+
+  tasks:
+    - name: Установить базовые пакеты
+      ansible.builtin.apt:
+        name:
+          - curl
+          - rsync
+          - unzip
+        state: present
+        update_cache: true
+
+    - name: Создать системную группу сервиса
+      ansible.builtin.group:
+        name: "{{ aw_server_group }}"
+        system: true
+        state: present
+
+    - name: Создать системную учётную запись сервиса
+      ansible.builtin.user:
+        name: "{{ aw_server_user }}"
+        group: "{{ aw_server_group }}"
+        home: "{{ aw_server_data_dir }}"
+        shell: /usr/sbin/nologin
+        system: true
+        create_home: false
+
+    - name: Создать обязательные каталоги
+      ansible.builtin.file:
+        path: "{{ item }}"
+        state: directory
+        mode: "0755"
+      loop:
+        - "{{ aw_release_root }}"
+        - "{{ aw_release_dir }}"
+        - "{{ aw_release_install_dir }}"
+        - /opt/activitywatch
+        - /opt/activitywatch/bin
+        - "{{ aw_server_webui_dir }}"
+        - "{{ aw_server_webui_dir }}/js"
+        - "{{ aw_server_data_dir }}"
+        - "{{ aw_server_log_dir }}"
+        - /etc/activitywatch
+        - "{{ aw_bootstrap_dir }}"
+
+    - name: Настроить каталоги ActivityWatch с владельцем сервиса
+      ansible.builtin.file:
+        path: "{{ item }}"
+        state: directory
+        owner: "{{ aw_server_user }}"
+        group: "{{ aw_server_group }}"
+        mode: "0755"
+      loop:
+        - /opt/activitywatch
+        - /opt/activitywatch/bin
+        - "{{ aw_release_root }}"
+        - "{{ aw_release_dir }}"
+        - "{{ aw_release_install_dir }}"
+        - "{{ aw_server_webui_dir }}"
+        - "{{ aw_server_webui_dir }}/js"
+        - "{{ aw_server_data_dir }}"
+        - "{{ aw_server_log_dir }}"
+
+    - name: Скачать архив релиза ActivityWatch
+      ansible.builtin.get_url:
+        url: "{{ aw_server_download_url }}"
+        dest: "{{ aw_archive_path }}"
+        mode: "0644"
+
+    - name: Распаковать релиз ActivityWatch
+      ansible.builtin.unarchive:
+        src: "{{ aw_archive_path }}"
+        dest: "{{ aw_release_dir }}"
+        remote_src: true
+        extra_opts: ["-o"]
+
+    - name: Найти распакованный каталог ActivityWatch
+      ansible.builtin.find:
+        paths: "{{ aw_release_dir }}"
+        file_type: directory
+        patterns: "activitywatch*"
+      register: aw_release_find
+
+    - name: Найти бинарный файл AW server
+      ansible.builtin.find:
+        paths: "{{ aw_release_dir }}"
+        file_type: file
+        patterns:
+          - aw-server-rust
+          - aw-server
+      register: aw_server_binary_find
+
+    - name: Найти каталог WebUI
+      ansible.builtin.find:
+        paths: "{{ aw_release_dir }}"
+        file_type: directory
+        patterns:
+          - aw-webui
+          - webui
+      register: aw_webui_dir_find
+
+    - name: Сохранить пути распакованного релиза
+      ansible.builtin.set_fact:
+        aw_release_extracted: "{{ (aw_release_find.files | default([]) | sort(attribute='path') | map(attribute='path') | list | first) | default('') }}"
+        aw_server_binary_path: "{{ (aw_server_binary_find.files | default([]) | sort(attribute='path') | map(attribute='path') | list | first) | default('') }}"
+        aw_webui_source_path: "{{ (aw_webui_dir_find.files | default([]) | sort(attribute='path') | map(attribute='path') | list | first) | default('') }}"
+
+    - name: Проверить, что компоненты релиза найдены
+      ansible.builtin.assert:
+        that:
+          - aw_release_extracted is defined
+          - aw_release_extracted | length > 0
+          - aw_server_binary_path is defined
+          - aw_server_binary_path | length > 0
+          - aw_webui_source_path is defined
+          - aw_webui_source_path | length > 0
+        fail_msg: "Не удалось найти бинарный файл или WebUI в распакованном релизе ActivityWatch."
+
+    - name: Создать каталог установленного релиза
+      ansible.builtin.file:
+        path: "{{ aw_release_install_dir }}"
+        state: directory
+        owner: "{{ aw_server_user }}"
+        group: "{{ aw_server_group }}"
+        mode: "0755"
+
+    - name: Установить бинарный файл AW server
+      ansible.builtin.copy:
+        remote_src: true
+        src: "{{ aw_server_binary_path }}"
+        dest: "{{ aw_release_install_dir }}/aw-server-rust"
+        owner: "{{ aw_server_user }}"
+        group: "{{ aw_server_group }}"
+        mode: "0755"
+
+    - name: Создать ссылку на активный бинарный файл AW server
+      ansible.builtin.file:
+        src: "{{ aw_release_install_dir }}/aw-server-rust"
+        dest: /opt/activitywatch/bin/aw-server-rust
+        owner: "{{ aw_server_user }}"
+        group: "{{ aw_server_group }}"
+        state: link
+        force: true
+
+    - name: Синхронизировать WebUI в RU каталог
+      ansible.builtin.command:
+        cmd: "rsync -a {{ aw_webui_source_path }}/ {{ aw_server_webui_dir }}/"
+
+    - name: Настроить владельца файлов /opt/activitywatch
+      ansible.builtin.file:
+        path: /opt/activitywatch
+        state: directory
+        owner: "{{ aw_server_user }}"
+        group: "{{ aw_server_group }}"
+        recurse: true
+
+    - name: Установить systemd service из шаблона репозитория
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/activitywatch-server.service
+        mode: "0644"
+        content: >-
+          {{
+            lookup('file', aw_repo_root + '/aw-server/activitywatch-server.service')
+            | replace('__AW_SERVER_USER__', aw_server_user)
+            | replace('__AW_SERVER_GROUP__', aw_server_group)
+            | replace('__AW_SERVER_DATA_DIR__', aw_server_data_dir)
+          }}
+      notify:
+        - Перезагрузить systemd
+        - Перезапустить activitywatch
+
+    - name: Скопировать RU patch файлы WebUI из репозитория
+      ansible.builtin.copy:
+        src: "{{ item.src }}"
+        dest: "{{ item.dest }}"
+        mode: "{{ item.mode }}"
+        owner: "{{ aw_server_user }}"
+        group: "{{ aw_server_group }}"
+      loop:
+        - { src: "{{ aw_repo_root }}/aw-server/aw-ru-patch.js", dest: "{{ aw_server_webui_dir }}/js/ru-patch-v5.js", mode: "0644" }
+        - { src: "{{ aw_repo_root }}/aw-server/aw-sw-cleanup.js", dest: "{{ aw_server_webui_dir }}/js/sw-cleanup.js", mode: "0644" }
+        - { src: "{{ aw_repo_root }}/aw-server/aw-host-groups.json", dest: "{{ aw_server_webui_dir }}/js/aw-host-groups.json", mode: "0644" }
+
+    - name: Проверить наличие index.html после копирования
+      ansible.builtin.stat:
+        path: "{{ aw_server_webui_dir }}/index.html"
+      register: aw_webui_ru_index
+
+    - name: Проверить, что index.html доступен для RU patch
+      ansible.builtin.assert:
+        that:
+          - aw_webui_ru_index.stat.exists
+        fail_msg: "Не найден index.html WebUI для применения RU patch."
+
+    - name: Удалить старые теги RU patch из index.html
+      ansible.builtin.replace:
+        path: "{{ aw_server_webui_dir }}/index.html"
+        regexp: '<script[^>]+(?:ru-patch-v5\.js|sw-cleanup\.js|aw-ru-patch\.js|aw-sw-cleanup\.js)[^>]*></script>'
+        replace: ''
+
+    - name: Добавить cleanup script RU patch в index.html
+      ansible.builtin.replace:
+        path: "{{ aw_server_webui_dir }}/index.html"
+        regexp: '</head>'
+        replace: '<script src="/js/sw-cleanup.js?v={{ aw_sw_cleanup_cache_bust }}"></script></head>'
+
+    - name: Добавить загрузчик RU patch перед закрытием body
+      ansible.builtin.replace:
+        path: "{{ aw_server_webui_dir }}/index.html"
+        regexp: '</body>'
+        replace: '<script defer="defer" src="/js/ru-patch-v5.js?v={{ aw_ru_patch_cache_bust }}"></script></body>'
+
+    - name: Записать /etc/activitywatch/aw-server.env
+      ansible.builtin.copy:
+        dest: /etc/activitywatch/aw-server.env
+        mode: "0640"
+        owner: root
+        group: root
+        content: |
+          AW_SERVER_BIND_HOST={{ aw_server_bind_host }}
+          AW_SERVER_PORT={{ aw_server_port }}
+          AW_SERVER_DATA_DIR={{ aw_server_data_dir }}
+          AW_SERVER_LOG_DIR={{ aw_server_log_dir }}
+          AW_SERVER_WEBUI_DIR={{ aw_server_webui_dir }}
+          AW_SERVER_USER={{ aw_server_user }}
+          AW_SERVER_GROUP={{ aw_server_group }}
+
+    - name: Включить и запустить сервис
+      ansible.builtin.systemd:
+        name: activitywatch-server.service
+        enabled: true
+        state: restarted
+        daemon_reload: true
+
+    - name: Дождаться ответа API
+      ansible.builtin.uri:
+        url: "http://127.0.0.1:{{ aw_server_port }}/api/0/info"
+        method: GET
+        status_code: 200
+      register: aw_api
+      retries: 10
+      delay: 3
+      until: aw_api.status == 200
+
+    - name: Применить базовые worktime settings (classes)
+      ansible.builtin.uri:
+        url: "http://127.0.0.1:{{ aw_server_port }}/api/0/settings/classes"
+        method: POST
+        body: "{{ aw_worktime_classes }}"
+        body_format: json
+        status_code: [200, 201]
+      when: aw_apply_worktime_settings | default(false) | bool
+
+    - name: Применить базовые views для DLP и worktime
+      ansible.builtin.uri:
+        url: "http://127.0.0.1:{{ aw_server_port }}/api/0/settings/views"
+        method: POST
+        body: "{{ aw_default_views }}"
+        body_format: json
+        status_code: [200, 201]
+      when: aw_apply_worktime_settings | default(false) | bool
+
+    - name: Вычислить worktime durationDefault из aw_worktime_from/to
+      ansible.builtin.set_fact:
+        aw_worktime_from_h: "{{ (aw_worktime_from | default('08:00')).split(':')[0] | int }}"
+        aw_worktime_from_m: "{{ (aw_worktime_from | default('08:00')).split(':')[1] | int }}"
+        aw_worktime_to_h: "{{ (aw_worktime_to | default('17:00')).split(':')[0] | int }}"
+        aw_worktime_to_m: "{{ (aw_worktime_to | default('17:00')).split(':')[1] | int }}"
+        aw_worktime_duration_default_derived: >-
+          {{
+            (
+              (
+                ((aw_worktime_to_h | int) * 60 + (aw_worktime_to_m | int)) -
+                ((aw_worktime_from_h | int) * 60 + (aw_worktime_from_m | int))
+              ) * 60
+            )
+          }}
+      when: aw_apply_worktime_settings | default(false) | bool
+
+    - name: Нормализовать durationDefault для ночных смен
+      ansible.builtin.set_fact:
+        aw_worktime_duration_default_effective: >-
+          {{
+            (aw_worktime_duration_default_derived | int)
+            if (aw_worktime_duration_default_derived | int) > 0
+            else ((aw_worktime_duration_default_derived | int) + 86400)
+          }}
+      when: aw_apply_worktime_settings | default(false) | bool
+
+    - name: Проверить корректность durationDefault
+      ansible.builtin.assert:
+        that:
+          - aw_worktime_duration_default_effective | int > 0
+          - aw_worktime_duration_default_effective | int <= 86400
+        fail_msg: "Некорректный интервал рабочего времени: {{ aw_worktime_from }}..{{ aw_worktime_to }}"
+      when: aw_apply_worktime_settings | default(false) | bool
+
+    - name: Применить базовый период worktime (startOfDay)
+      ansible.builtin.uri:
+        url: "http://127.0.0.1:{{ aw_server_port }}/api/0/settings/startOfDay"
+        method: POST
+        body: "{{ aw_worktime_start_of_day }}"
+        body_format: json
+        status_code: 200
+      when: aw_apply_worktime_settings | default(false) | bool
+
+    - name: Применить базовый период worktime (durationDefault seconds)
+      ansible.builtin.uri:
+        url: "http://127.0.0.1:{{ aw_server_port }}/api/0/settings/durationDefault"
+        method: POST
+        body: "{{ aw_worktime_duration_default_effective }}"
+        body_format: json
+        status_code: 200
+      when: aw_apply_worktime_settings | default(false) | bool
+
+  handlers:
+    - name: Перезагрузить systemd
+      ansible.builtin.systemd:
+        daemon_reload: true
+
+    - name: Перезапустить activitywatch
+      ansible.builtin.systemd:
+        name: activitywatch-server.service
+        state: restarted

install-kit-awindows-20260427-211240/ansible/deploy_aw_windows.yml

@@ -0,0 +1,232 @@
+---
+- name: Развернуть Windows/RDP collector'ы AWatch-rus
+  hosts: aw_windows
+  gather_facts: false
+
+  vars:
+    aw_windows_repo_root: "{{ playbook_dir | dirname }}"
+    aw_windows_deploy_root: "C:\\Program Files\\AWatch-rus"
+    aw_windows_server_scheme: "http"
+    aw_windows_server_host: "10.10.10.13"
+    aw_windows_server_port: 5600
+    aw_windows_package_version: "v0.13.2"
+    aw_windows_package_url: "https://github.com/ActivityWatch/activitywatch/releases/download/v0.13.2/activitywatch-v0.13.2-windows-x86_64.zip"
+    aw_windows_package_zip_path: ""
+    aw_windows_domain: "SHARKON2025"
+    aw_windows_users:
+      - user1
+      - user2
+      - user3
+      - user4
+      - user5
+    aw_windows_extra_users: []
+    aw_windows_users_effective: "{{ (aw_windows_users + aw_windows_extra_users) | unique }}"
+    aw_windows_install_root: "C:\\Program Files\\AWatch-rus\\bin"
+    aw_windows_state_root: "C:\\ProgramData\\AWatch-rus"
+    aw_windows_afk_enabled: true
+    aw_windows_window_enabled: true
+    aw_windows_local_agent_logs_enabled: false
+    aw_windows_incident_capture_enabled: true
+    aw_windows_incident_screenshot_enabled: true
+    aw_windows_incident_artifacts_root: "{{ aw_windows_state_root }}\\incident-artifacts"
+    aw_windows_logon_marker_enabled: true
+    aw_windows_skip_hardening: false
+    aw_windows_rules_path: "{{ aw_windows_deploy_root }}\\windows\\web-category-rules.example.json"
+    aw_windows_policy_path: "{{ aw_windows_deploy_root }}\\windows\\dlp-policy.example.json"
+    aw_windows_validation_remote_path: "{{ aw_windows_state_root }}\\aw_validate_ansible.json"
+    aw_windows_validation_local_dir: "/tmp/aw-rus-validation"
+    aw_windows_launch_task_pattern: "ActivityWatch Launch *"
+    aw_windows_recovery_task_name: "ActivityWatch Recovery"
+    aw_windows_force_task_restart: true
+    aw_windows_api_smoke_check_enabled: true
+    aw_windows_api_smoke_check_bucket: ""
+    aw_windows_api_smoke_check_limit: 10
+    aw_windows_fail_on_validation_error: true
+    aw_windows_migration_enabled: true
+    aw_windows_legacy_install_root: "C:\\Program Files\\ActivityWatch-Phase2"
+    aw_windows_legacy_state_root: "C:\\ProgramData\\ActivityWatch-Phase2"
+    aw_windows_migration_report_remote_path: "{{ aw_windows_state_root }}\\aw_migration_ansible.json"
+
+  tasks:
+    - name: Проверить обязательные переменные
+      ansible.builtin.assert:
+        that:
+          - aw_windows_server_host is defined
+          - aw_windows_server_port is defined
+          - aw_windows_server_scheme is defined
+          - aw_windows_domain is defined
+          - aw_windows_users_effective | length > 0
+          - aw_windows_install_root is defined
+          - aw_windows_state_root is defined
+        fail_msg: "Не заданы обязательные переменные Windows-развёртывания."
+
+    - name: Создать каталоги развёртывания
+      ansible.windows.win_file:
+        path: "{{ item }}"
+        state: directory
+      loop:
+        - "{{ aw_windows_deploy_root }}"
+        - "{{ aw_windows_deploy_root }}\\windows"
+
+    - name: Загрузить Windows toolkit развёртывания
+      ansible.windows.win_copy:
+        src: "{{ aw_windows_repo_root }}/windows/{{ item }}"
+        dest: "{{ aw_windows_deploy_root }}\\windows\\{{ item }}"
+      loop:
+        - ActivityWatch.Windows.Common.psd1
+        - ActivityWatch.Windows.Common.psm1
+        - browser-domains-native-collector.ps1
+        - dlp-endpoint-signals-collector.ps1
+        - worktime-session-collector.ps1
+        - migrate-awatch-rus-paths.ps1
+        - deploy-domain-users.ps1
+        - deploy-ensemble.ps1
+        - hardening-recovery.ps1
+        - validate-deployment.ps1
+        - web-category-rules.example.json
+        - dlp-policy.example.json
+
+    - name: Загрузить список пользователей для доменного развёртывания
+      ansible.windows.win_copy:
+        dest: "{{ aw_windows_deploy_root }}\\windows\\users.txt"
+        content: |
+          {% for user in aw_windows_users_effective -%}
+          {{ user }}
+          {% endfor -%}
+
+    - name: Проверить нужен ли migration с legacy ActivityWatch путей
+      when: aw_windows_migration_enabled | bool
+      ansible.windows.win_stat:
+        path: "{{ aw_windows_legacy_state_root }}\\deployment-config.json"
+      register: aw_windows_legacy_config
+
+    - name: Выполнить безопасную migration legacy prod в AWatch-rus
+      when:
+        - aw_windows_migration_enabled | bool
+        - aw_windows_legacy_config.stat.exists | default(false)
+      ansible.windows.win_powershell:
+        script: |
+          $ErrorActionPreference = 'Stop'
+          $result = & "{{ aw_windows_deploy_root }}\windows\migrate-awatch-rus-paths.ps1" `
+            -OldInstallRoot "{{ aw_windows_legacy_install_root }}" `
+            -OldStateRoot "{{ aw_windows_legacy_state_root }}" `
+            -NewInstallRoot "{{ aw_windows_install_root }}" `
+            -NewStateRoot "{{ aw_windows_state_root }}" `
+            -ToolkitRoot "{{ aw_windows_deploy_root }}\windows"
+          $result | ConvertTo-Json -Depth 8 | Out-File -FilePath "{{ aw_windows_migration_report_remote_path }}" -Encoding utf8
+
+    - name: Запустить Windows/RDP ensemble развёртывание
+      ansible.windows.win_powershell:
+        script: |
+          $ErrorActionPreference = 'Stop'
+          $params = @{
+            ServerScheme = "{{ aw_windows_server_scheme }}"
+            ServerHost = "{{ aw_windows_server_host }}"
+            ServerPort = {{ aw_windows_server_port }}
+            Version = "{{ aw_windows_package_version }}"
+            Domain = "{{ aw_windows_domain }}"
+            UserListPath = "{{ aw_windows_deploy_root }}\windows\users.txt"
+            InstallRoot = "{{ aw_windows_install_root }}"
+            StateRoot = "{{ aw_windows_state_root }}"
+            AfkEnabled = {{ '$true' if (aw_windows_afk_enabled | bool) else '$false' }}
+            WindowEnabled = {{ '$true' if (aw_windows_window_enabled | bool) else '$false' }}
+            LocalAgentLogsEnabled = {{ '$true' if (aw_windows_local_agent_logs_enabled | bool) else '$false' }}
+            IncidentCaptureEnabled = {{ '$true' if (aw_windows_incident_capture_enabled | bool) else '$false' }}
+            IncidentScreenshotEnabled = {{ '$true' if (aw_windows_incident_screenshot_enabled | bool) else '$false' }}
+            IncidentArtifactsRoot = "{{ aw_windows_incident_artifacts_root }}"
+            LogonMarkerEnabled = {{ '$true' if (aw_windows_logon_marker_enabled | bool) else '$false' }}
+            CustomRulesPath = "{{ aw_windows_rules_path }}"
+            CustomPolicyPath = "{{ aw_windows_policy_path }}"
+          }
+          {% if (aw_windows_package_url | default('') | string | length) > 0 %}
+          $params.PackageUrl = "{{ aw_windows_package_url }}"
+          {% endif %}
+          {% if (aw_windows_package_zip_path | default('') | string | length) > 0 %}
+          $params.PackageZipPath = "{{ aw_windows_package_zip_path }}"
+          {% endif %}
+          {% if aw_windows_skip_hardening | bool %}
+          $params.SkipHardening = $true
+          {% endif %}
+          & "{{ aw_windows_deploy_root }}\windows\deploy-ensemble.ps1" @params
+
+    - name: Принудительно запустить ActivityWatch recovery и launch tasks
+      when: aw_windows_force_task_restart | bool
+      ansible.windows.win_powershell:
+        script: |
+          $ErrorActionPreference = 'Stop'
+          Start-ScheduledTask -TaskName "{{ aw_windows_recovery_task_name }}"
+          Get-ScheduledTask |
+            Where-Object TaskName -like "{{ aw_windows_launch_task_pattern }}" |
+            ForEach-Object { Start-ScheduledTask -TaskName $_.TaskName }
+
+    - name: Получить Windows hostname для AW smoke-check bucket
+      when:
+        - aw_windows_api_smoke_check_enabled | bool
+        - aw_windows_afk_enabled | bool
+      ansible.windows.win_command: powershell.exe -NoProfile -Command "$env:COMPUTERNAME"
+      register: aw_windows_hostname_result
+      changed_when: false
+
+    - name: Вычислить AW AFK smoke-check bucket
+      when:
+        - aw_windows_api_smoke_check_enabled | bool
+        - aw_windows_afk_enabled | bool
+      ansible.builtin.set_fact:
+        aw_windows_api_smoke_check_bucket_effective: >-
+          {{
+            aw_windows_api_smoke_check_bucket
+            if (aw_windows_api_smoke_check_bucket | default('') | string | length) > 0
+            else 'aw-watcher-afk_' ~ (aw_windows_hostname_result.stdout | trim)
+          }}
+
+    - name: Дождаться свежих AFK событий на AW server
+      when:
+        - aw_windows_api_smoke_check_enabled | bool
+        - aw_windows_afk_enabled | bool
+      delegate_to: localhost
+      ansible.builtin.uri:
+        url: "{{ aw_windows_server_scheme }}://{{ aw_windows_server_host }}:{{ aw_windows_server_port }}/api/0/buckets/{{ aw_windows_api_smoke_check_bucket_effective }}/events?limit={{ aw_windows_api_smoke_check_limit }}"
+        method: GET
+        return_content: true
+      register: aw_windows_api_smoke
+      until: >
+        aw_windows_api_smoke.status == 200 and
+        (aw_windows_api_smoke.json | length) > 0 and
+        (
+          aw_windows_api_smoke.json
+          | selectattr('data.status', 'equalto', 'not-afk')
+          | list
+          | length
+        ) > 0
+      retries: 10
+      delay: 6
+
+    - name: Выполнить валидацию и сохранить отчёт на целевом Windows host
+      ansible.windows.win_powershell:
+        script: |
+          $ErrorActionPreference = 'Stop'
+          $report = & "{{ aw_windows_deploy_root }}\windows\validate-deployment.ps1" `
+            -ConfigPath "{{ aw_windows_state_root }}\deployment-config.json"
+          $report | ConvertTo-Json -Depth 12 | Out-File -FilePath "{{ aw_windows_validation_remote_path }}" -Encoding utf8
+          if ({{ '$true' if (aw_windows_fail_on_validation_error | bool) else '$false' }} -and -not [bool]$report.overallOk) {
+            throw "Проверка развёртывания ActivityWatch завершилась ошибкой. Отчёт: {{ aw_windows_validation_remote_path }}"
+          }
+
+    - name: Создать локальный каталог для validation reports
+      ansible.builtin.file:
+        path: "{{ aw_windows_validation_local_dir }}"
+        state: directory
+        mode: "0755"
+      delegate_to: localhost
+
+    - name: Забрать validation report
+      ansible.builtin.fetch:
+        src: "{{ aw_windows_validation_remote_path }}"
+        dest: "{{ aw_windows_validation_local_dir }}/{{ inventory_hostname }}-aw_validate_ansible.json"
+        flat: true
+
+    - name: Показать путь к отчёту
+      ansible.builtin.debug:
+        msg:
+          - "Windows/RDP развёртывание завершено на {{ inventory_hostname }}."
+          - "Отчёт проверки: {{ aw_windows_validation_local_dir }}/{{ inventory_hostname }}-aw_validate_ansible.json"

install-kit-awindows-20260427-211240/ansible/group_vars/all.example.yml

@@ -0,0 +1,24 @@
+aw_server_version: "v0.13.2"
+aw_server_download_url: "https://github.com/ActivityWatch/activitywatch/releases/download/v0.13.2/activitywatch-v0.13.2-linux-x86_64.zip"
+aw_server_bind_host: "0.0.0.0"
+aw_server_port: 5600
+aw_server_webui_dir: "/opt/activitywatch/webui-ru"
+aw_server_data_dir: "/var/lib/activitywatch"
+aw_server_log_dir: "/var/log/activitywatch"
+aw_server_user: "activitywatch"
+aw_server_group: "activitywatch"
+
+aw_repo_root: "{{ playbook_dir | dirname }}"
+
+# Опционально: применить базовые категории и views для рабочего времени через AW settings API.
+# Внимание: это перезаписывает существующие server-side settings/classes/views.
+aw_apply_worktime_settings: false
+
+# Опциональные значения периода рабочего времени в Web UI.
+# startOfDay задаёт границу дня и стартовое время окна отчёта.
+# durationDefault задаёт диапазон по умолчанию в секундах.
+#
+# Рекомендуется явно задать рабочий интервал и дать playbook вычислить duration.
+aw_worktime_from: "08:00"
+aw_worktime_to: "17:00"
+aw_worktime_start_of_day: "{{ aw_worktime_from }}"

install-kit-awindows-20260427-211240/ansible/group_vars/pfsense-poller.example.yml

@@ -0,0 +1,30 @@
+aw_pfsense_poller_config:
+  poll_interval_seconds: 60
+  aw:
+    server_host: "10.10.10.13"
+    server_port: 5600
+    hostname: "PFSENSE-EDGE01"
+    pulse_time_seconds: 120
+    timeout_seconds: 15
+  pfsense:
+    name: "pfSense Edge 01"
+    host: "10.10.10.1"
+    scheme: "https"
+    verify_tls: false
+    timeout_seconds: 15
+    headers:
+      X-API-Key: "replace-me"
+      X-API-Secret: "replace-me"
+  endpoints:
+    - name: "system-status"
+      path: "/api/v2/status/system"
+      bucket_prefix: "aw-pfsense-health"
+      bucket_type: "aw.pfsense.health"
+    - name: "interfaces"
+      path: "/api/v2/interface"
+      bucket_prefix: "aw-pfsense-interfaces"
+      bucket_type: "aw.pfsense.interfaces"
+    - name: "gateways"
+      path: "/api/v2/status/gateways"
+      bucket_prefix: "aw-pfsense-gateways"
+      bucket_type: "aw.pfsense.gateways"

install-kit-awindows-20260427-211240/ansible/group_vars/proxmox-matrix.example.yml

@@ -0,0 +1,38 @@
+proxmox_ct_matrix:
+  - id: "203"
+    hostname: "activitywatch-user1"
+    storage: "local-lvm"
+    template: "local:vztmpl/debian-12-standard_12.7-1_amd64.tar.zst"
+    rootfs_size: "8G"
+    cores: "2"
+    memory: "2048"
+    swap: "512"
+    bridge: "vmbr10"
+    ip: "10.20.30.13/24"
+    gw: "10.20.30.1"
+    vlan: ""
+    nameserver: "1.1.1.1 8.8.8.8"
+    searchdomain: "example.internal"
+    password: "CHANGE_ME"
+    unprivileged: "1"
+    onboot: "1"
+    features: "nesting=1,keyctl=1"
+
+  - id: "204"
+    hostname: "activitywatch-user2"
+    storage: "local-lvm"
+    template: "local:vztmpl/debian-12-standard_12.7-1_amd64.tar.zst"
+    rootfs_size: "8G"
+    cores: "2"
+    memory: "2048"
+    swap: "512"
+    bridge: "vmbr10"
+    ip: "10.20.30.14/24"
+    gw: "10.20.30.1"
+    vlan: ""
+    nameserver: "1.1.1.1 8.8.8.8"
+    searchdomain: "example.internal"
+    password: "CHANGE_ME"
+    unprivileged: "1"
+    onboot: "1"
+    features: "nesting=1,keyctl=1"

install-kit-awindows-20260427-211240/ansible/group_vars/proxmox.example.yml

@@ -0,0 +1,18 @@
+proxmox_ct_id: "203"
+proxmox_ct_hostname: "activitywatch-server"
+proxmox_ct_storage: "local-lvm"
+proxmox_ct_template: "local:vztmpl/debian-12-standard_12.7-1_amd64.tar.zst"
+proxmox_ct_rootfs_size: "8G"
+proxmox_ct_cores: "2"
+proxmox_ct_memory: "2048"
+proxmox_ct_swap: "512"
+proxmox_ct_bridge: "vmbr10"
+proxmox_ct_ip: "10.20.30.13/24"
+proxmox_ct_gw: "10.20.30.1"
+proxmox_ct_vlan: ""
+proxmox_ct_nameserver: "1.1.1.1 8.8.8.8"
+proxmox_ct_searchdomain: "example.internal"
+proxmox_ct_password: "CHANGE_ME"
+proxmox_ct_unprivileged: "1"
+proxmox_ct_onboot: "1"
+proxmox_ct_features: "nesting=1,keyctl=1"

install-kit-awindows-20260427-211240/ansible/group_vars/windows.example.yml

@@ -0,0 +1,50 @@
+aw_windows_repo_root: "{{ playbook_dir | dirname }}"
+aw_windows_deploy_root: "C:\\Program Files\\AWatch-rus"
+aw_windows_server_scheme: "http"
+aw_windows_server_host: "10.10.10.13"
+aw_windows_server_port: 5600
+aw_windows_package_version: "v0.13.2"
+aw_windows_package_url: "https://github.com/ActivityWatch/activitywatch/releases/download/v0.13.2/activitywatch-v0.13.2-windows-x86_64.zip"
+aw_windows_package_zip_path: ""
+aw_windows_domain: "SHARKON2025"
+aw_windows_users:
+  - user1
+  - user2
+  - user3
+  - user4
+  - user5
+aw_windows_extra_users: []
+# Например:
+# aw_windows_extra_users:
+#   - Администратор
+
+# Единые Windows/RDP пути: те же, что использует InnoSetup.
+aw_windows_install_root: "C:\\Program Files\\AWatch-rus\\bin"
+aw_windows_state_root: "C:\\ProgramData\\AWatch-rus"
+aw_windows_afk_enabled: true
+aw_windows_window_enabled: true
+aw_windows_local_agent_logs_enabled: false
+aw_windows_incident_capture_enabled: true
+aw_windows_incident_screenshot_enabled: true
+aw_windows_incident_artifacts_root: "{{ aw_windows_state_root }}\\incident-artifacts"
+aw_windows_logon_marker_enabled: true
+aw_windows_skip_hardening: false
+
+aw_windows_rules_path: "{{ aw_windows_deploy_root }}\\windows\\web-category-rules.example.json"
+aw_windows_policy_path: "{{ aw_windows_deploy_root }}\\windows\\dlp-policy.example.json"
+
+aw_windows_validation_remote_path: "{{ aw_windows_state_root }}\\aw_validate_ansible.json"
+aw_windows_validation_local_dir: "/tmp/aw-rus-validation"
+aw_windows_fail_on_validation_error: true
+
+# Безопасная миграция текущего прода со старых путей в единый профиль AWatch-rus.
+aw_windows_migration_enabled: true
+aw_windows_legacy_install_root: "C:\\Program Files\\ActivityWatch-Phase2"
+aw_windows_legacy_state_root: "C:\\ProgramData\\ActivityWatch-Phase2"
+aw_windows_migration_report_remote_path: "{{ aw_windows_state_root }}\\aw_migration_ansible.json"
+
+# По умолчанию AFK bucket вычисляется как aw-watcher-afk_<COMPUTERNAME>.
+# Задайте явное значение только если watcher пишет в нестандартный bucket.
+aw_windows_api_smoke_check_enabled: true
+aw_windows_api_smoke_check_bucket: ""
+aw_windows_api_smoke_check_limit: 10

install-kit-awindows-20260427-211240/ansible/install_full_stack.yml

@@ -0,0 +1,16 @@
+---
+# Полный установщик AWatch-rus.
+# Выполняет развёртывание одной командой:
+# 1) создание Proxmox CT + bootstrap AW (если в inventory есть [proxmox])
+# 2) развёртывание AW server на хостах [aw_server]
+# 3) развёртывание Windows/RDP collector'ов на [aw_windows]
+# 4) развёртывание pfSense poller'а на [aw_pfsense_pollers]
+#
+# Примечания:
+# - Заполняйте только нужные группы inventory для своего окружения.
+# - Play без совпадающих host groups Ansible пропускает автоматически.
+
+- import_playbook: provision_proxmox_ct_and_deploy_aw.yml
+- import_playbook: deploy_aw_server.yml
+- import_playbook: deploy_aw_windows.yml
+- import_playbook: deploy_aw_pfsense_poller.yml

install-kit-awindows-20260427-211240/ansible/inventory.example.ini

@@ -0,0 +1,12 @@
+[proxmox]
+pve-main ansible_host=192.168.10.2 ansible_user=root ansible_port=22
+
+[aw_server]
+aw-ct ansible_host=10.20.30.13 ansible_user=root ansible_port=22
+
+[aw_windows]
+# Примечание: в русифицированных Windows часто нужен "Администратор", а не "Administrator".
+win-node1 ansible_host=192.168.100.21 ansible_user=Администратор ansible_password=CHANGE_ME ansible_connection=winrm ansible_winrm_transport=ntlm ansible_port=5985 ansible_winrm_server_cert_validation=ignore
+
+[aw_pfsense_pollers]
+# pfsense-poller1 ansible_host=192.168.100.30 ansible_user=root ansible_port=22

install-kit-awindows-20260427-211240/ansible/provision_proxmox_ct_and_deploy_aw.yml

@@ -0,0 +1,40 @@
+---
+- name: Создать один Proxmox CT и развернуть AWatch-rus
+  hosts: proxmox
+  gather_facts: false
+
+  vars:
+    proxmox_bootstrap_dir: "/tmp/aw-rus-bootstrap"
+    aw_bootstrap_files:
+      - install_aw_server.sh
+      - apply_webui_ru_patch.sh
+      - activitywatch-server.service
+      - aw-server.env.example
+      - aw-ru-patch.js
+      - aw-sw-cleanup.js
+      - aw-host-groups.json
+      - settings/classes-worktime.json
+      - settings/views-default.json
+
+  tasks:
+    - name: Выполнить workflow создания одного CT
+      ansible.builtin.include_tasks: tasks/provision_ct_and_deploy_aw.yml
+      vars:
+        ct_id: "{{ proxmox_ct_id }}"
+        ct_hostname: "{{ proxmox_ct_hostname }}"
+        ct_storage: "{{ proxmox_ct_storage }}"
+        ct_template: "{{ proxmox_ct_template }}"
+        ct_rootfs_size: "{{ proxmox_ct_rootfs_size }}"
+        ct_cores: "{{ proxmox_ct_cores }}"
+        ct_memory: "{{ proxmox_ct_memory }}"
+        ct_swap: "{{ proxmox_ct_swap }}"
+        ct_bridge: "{{ proxmox_ct_bridge }}"
+        ct_ip: "{{ proxmox_ct_ip }}"
+        ct_gw: "{{ proxmox_ct_gw }}"
+        ct_vlan: "{{ proxmox_ct_vlan | default('') }}"
+        ct_nameserver: "{{ proxmox_ct_nameserver | default('') }}"
+        ct_searchdomain: "{{ proxmox_ct_searchdomain | default('') }}"
+        ct_password: "{{ proxmox_ct_password }}"
+        ct_unprivileged: "{{ proxmox_ct_unprivileged }}"
+        ct_onboot: "{{ proxmox_ct_onboot }}"
+        ct_features: "{{ proxmox_ct_features }}"

install-kit-awindows-20260427-211240/ansible/provision_proxmox_ct_matrix_and_deploy_aw.yml

@@ -0,0 +1,50 @@
+---
+- name: Создать матрицу Proxmox CT и развернуть AWatch-rus с RU patch
+  hosts: proxmox
+  gather_facts: false
+
+  vars:
+    proxmox_bootstrap_dir: "/tmp/aw-rus-bootstrap"
+    aw_bootstrap_files:
+      - install_aw_server.sh
+      - apply_webui_ru_patch.sh
+      - activitywatch-server.service
+      - aw-server.env.example
+      - aw-ru-patch.js
+      - aw-sw-cleanup.js
+      - aw-host-groups.json
+      - settings/classes-worktime.json
+      - settings/views-default.json
+
+  tasks:
+    - name: Проверить, что матрица CT задана
+      ansible.builtin.assert:
+        that:
+          - proxmox_ct_matrix is defined
+          - proxmox_ct_matrix | length > 0
+        fail_msg: "Задайте proxmox_ct_matrix в group_vars/proxmox-matrix.yml"
+
+    - name: Выполнить workflow создания для каждого CT
+      ansible.builtin.include_tasks: tasks/provision_ct_and_deploy_aw.yml
+      vars:
+        ct_id: "{{ item.id }}"
+        ct_hostname: "{{ item.hostname }}"
+        ct_storage: "{{ item.storage }}"
+        ct_template: "{{ item.template }}"
+        ct_rootfs_size: "{{ item.rootfs_size }}"
+        ct_cores: "{{ item.cores }}"
+        ct_memory: "{{ item.memory }}"
+        ct_swap: "{{ item.swap }}"
+        ct_bridge: "{{ item.bridge }}"
+        ct_ip: "{{ item.ip }}"
+        ct_gw: "{{ item.gw }}"
+        ct_vlan: "{{ item.vlan | default('') }}"
+        ct_nameserver: "{{ item.nameserver | default('') }}"
+        ct_searchdomain: "{{ item.searchdomain | default('') }}"
+        ct_password: "{{ item.password }}"
+        ct_unprivileged: "{{ item.unprivileged }}"
+        ct_onboot: "{{ item.onboot }}"
+        ct_features: "{{ item.features }}"
+      loop: "{{ proxmox_ct_matrix }}"
+      loop_control:
+        label: "ct={{ item.id }} host={{ item.hostname }} ip={{ item.ip }}"

install-kit-awindows-20260427-211240/ansible/tasks/provision_ct_and_deploy_aw.yml

@@ -0,0 +1,227 @@
+---
+- name: Проверить обязательные переменные CT
+  ansible.builtin.assert:
+    that:
+      - ct_id is defined
+      - ct_hostname is defined
+      - ct_storage is defined
+      - ct_template is defined
+      - ct_rootfs_size is defined
+      - ct_cores is defined
+      - ct_memory is defined
+      - ct_swap is defined
+      - ct_bridge is defined
+      - ct_ip is defined
+      - ct_gw is defined
+      - ct_password is defined
+      - ct_unprivileged is defined
+      - ct_onboot is defined
+      - ct_features is defined
+      - aw_repo_root is defined
+      - aw_server_version is defined
+      - aw_server_download_url is defined
+      - aw_server_bind_host is defined
+      - aw_server_port is defined
+      - aw_server_webui_dir is defined
+      - aw_server_data_dir is defined
+      - aw_server_log_dir is defined
+      - aw_server_user is defined
+      - aw_server_group is defined
+    fail_msg: "Не заданы обязательные переменные для создания CT и развёртывания."
+
+- name: Сформировать сетевую строку CT
+  ansible.builtin.set_fact:
+    ct_net0: >-
+      name=eth0,bridge={{ ct_bridge }},ip={{ ct_ip }},gw={{ ct_gw }}{% if (ct_vlan | default('') | string | length) > 0 %},tag={{ ct_vlan }}{% endif %}
+
+- name: Проверить, существует ли CT
+  ansible.builtin.command:
+    argv:
+      - pct
+      - status
+      - "{{ ct_id }}"
+  register: ct_status_check
+  failed_when: false
+  changed_when: false
+
+- name: Создать CT, если он отсутствует
+  ansible.builtin.command:
+    argv:
+      - pct
+      - create
+      - "{{ ct_id }}"
+      - "{{ ct_template }}"
+      - --hostname
+      - "{{ ct_hostname }}"
+      - --cores
+      - "{{ ct_cores }}"
+      - --memory
+      - "{{ ct_memory }}"
+      - --swap
+      - "{{ ct_swap }}"
+      - --rootfs
+      - "{{ ct_storage }}:{{ ct_rootfs_size }}"
+      - --password
+      - "{{ ct_password }}"
+      - --unprivileged
+      - "{{ ct_unprivileged }}"
+      - --onboot
+      - "{{ ct_onboot }}"
+      - --features
+      - "{{ ct_features }}"
+      - --net0
+      - "{{ ct_net0 }}"
+      - --nameserver
+      - "{{ ct_nameserver | default('') }}"
+      - --searchdomain
+      - "{{ ct_searchdomain | default('') }}"
+      - --ostype
+      - debian
+  when: ct_status_check.rc != 0
+  no_log: true
+
+- name: Проверить текущее состояние CT
+  ansible.builtin.command:
+    argv:
+      - pct
+      - status
+      - "{{ ct_id }}"
+  register: ct_runtime_status
+  changed_when: false
+
+- name: Запустить CT, если он остановлен
+  ansible.builtin.command:
+    argv:
+      - pct
+      - start
+      - "{{ ct_id }}"
+  when: "'stopped' in ct_runtime_status.stdout"
+
+- name: Создать bootstrap каталог на Proxmox host
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    mode: "0700"
+  loop:
+    - "{{ proxmox_bootstrap_dir }}"
+    - "{{ proxmox_bootstrap_dir }}/settings"
+
+- name: Скопировать AW bootstrap файлы во временный каталог Proxmox host
+  ansible.builtin.copy:
+    src: "{{ aw_repo_root }}/aw-server/{{ item }}"
+    dest: "{{ proxmox_bootstrap_dir }}/{{ item }}"
+    mode: "0644"
+  loop: "{{ aw_bootstrap_files }}"
+
+- name: Установить базовые зависимости ОС внутри CT
+  ansible.builtin.command:
+    argv:
+      - pct
+      - exec
+      - "{{ ct_id }}"
+      - --
+      - bash
+      - -lc
+      - |
+        set -euo pipefail
+        export DEBIAN_FRONTEND=noninteractive
+        apt-get update
+        apt-get install -y curl ca-certificates bash unzip xz-utils jq rsync openssh-server python3
+        mkdir -p /root/bootstrap/settings /etc/activitywatch
+        systemctl enable ssh || true
+        systemctl restart ssh || true
+  register: ct_bootstrap_result
+  retries: 10
+  delay: 6
+  until: ct_bootstrap_result.rc == 0
+
+- name: Передать bootstrap файлы внутрь CT
+  ansible.builtin.command:
+    argv:
+      - pct
+      - push
+      - "{{ ct_id }}"
+      - "{{ proxmox_bootstrap_dir }}/{{ item }}"
+      - "/root/bootstrap/{{ item }}"
+  loop: "{{ aw_bootstrap_files }}"
+
+- name: Записать AW server env во временный каталог Proxmox host
+  ansible.builtin.copy:
+    dest: "{{ proxmox_bootstrap_dir }}/aw-server.env"
+    mode: "0600"
+    content: |
+      AW_SERVER_VERSION={{ aw_server_version }}
+      AW_SERVER_DOWNLOAD_URL={{ aw_server_download_url }}
+      AW_SERVER_BIND_HOST={{ aw_server_bind_host }}
+      AW_SERVER_PORT={{ aw_server_port }}
+      AW_SERVER_WEBUI_DIR={{ aw_server_webui_dir }}
+      AW_SERVER_DATA_DIR={{ aw_server_data_dir }}
+      AW_SERVER_LOG_DIR={{ aw_server_log_dir }}
+      AW_SERVER_USER={{ aw_server_user }}
+      AW_SERVER_GROUP={{ aw_server_group }}
+  no_log: true
+
+- name: Передать AW server env внутрь CT
+  ansible.builtin.command:
+    argv:
+      - pct
+      - push
+      - "{{ ct_id }}"
+      - "{{ proxmox_bootstrap_dir }}/aw-server.env"
+      - /etc/activitywatch/aw-server.env
+  no_log: true
+
+- name: Настроить права env файла внутри CT
+  ansible.builtin.command:
+    argv:
+      - pct
+      - exec
+      - "{{ ct_id }}"
+      - --
+      - chmod
+      - "0600"
+      - /etc/activitywatch/aw-server.env
+
+- name: Установить сервер и применить RU patch внутри CT
+  ansible.builtin.command:
+    argv:
+      - pct
+      - exec
+      - "{{ ct_id }}"
+      - --
+      - bash
+      - -lc
+      - |
+        set -euo pipefail
+        chmod +x /root/bootstrap/install_aw_server.sh /root/bootstrap/apply_webui_ru_patch.sh
+        bash /root/bootstrap/install_aw_server.sh
+        bash /root/bootstrap/apply_webui_ru_patch.sh
+        systemctl restart activitywatch-server.service
+
+- name: Проверить AW API изнутри CT
+  ansible.builtin.command:
+    argv:
+      - pct
+      - exec
+      - "{{ ct_id }}"
+      - --
+      - bash
+      - -lc
+      - "curl -fsS http://127.0.0.1:{{ aw_server_port }}/api/0/info >/dev/null"
+
+- name: Проверить hooks RU patch в index.html
+  ansible.builtin.command:
+    argv:
+      - pct
+      - exec
+      - "{{ ct_id }}"
+      - --
+      - bash
+      - -lc
+      - "grep -q 'ru-patch-v5.js' {{ aw_server_webui_dir }}/index.html && grep -q 'sw-cleanup.js' {{ aw_server_webui_dir }}/index.html"
+
+- name: Показать итоговый endpoint
+  ansible.builtin.debug:
+    msg:
+      - "CT {{ ct_id }} создан и настроен."
+      - "Endpoint ActivityWatch: http://{{ ct_ip | regex_replace('/[0-9]+$', '') }}:{{ aw_server_port }}"

install-kit-awindows-20260427-211240/aw-server/activitywatch-server.service

@@ -0,0 +1,24 @@
+[Unit]
+Description=ActivityWatch Server (Rust)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+EnvironmentFile=/etc/activitywatch/aw-server.env
+User=__AW_SERVER_USER__
+Group=__AW_SERVER_GROUP__
+WorkingDirectory=__AW_SERVER_DATA_DIR__
+ExecStart=/bin/sh -lc 'exec /opt/activitywatch/bin/aw-server-rust --host "$AW_SERVER_BIND_HOST" --port "$AW_SERVER_PORT"'
+Restart=on-failure
+RestartSec=5s
+StateDirectory=activitywatch
+LogsDirectory=activitywatch
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=full
+ProtectHome=true
+LimitNOFILE=65535
+
+[Install]
+WantedBy=multi-user.target

install-kit-awindows-20260427-211240/aw-server/apply_webui_ru_patch.sh

@@ -0,0 +1,111 @@
+#!/bin/bash
+set -euo pipefail
+
+ENV_FILE="/etc/activitywatch/aw-server.env"
+if [[ ! -f "$ENV_FILE" ]]; then
+  echo "missing env file: $ENV_FILE" >&2
+  exit 1
+fi
+
+source "$ENV_FILE"
+
+WEBUI_DIR="${AW_SERVER_WEBUI_DIR:-${AW_WEBUI_DIR:-/opt/activitywatch/webui-ru}}"
+PATCH_JS_SRC="/root/bootstrap/aw-ru-patch.js"
+SW_CLEANUP_SRC="/root/bootstrap/aw-sw-cleanup.js"
+HOST_GROUPS_SRC="/root/bootstrap/aw-host-groups.json"
+INDEX_HTML="$WEBUI_DIR/index.html"
+SERVICE_WORKER="$WEBUI_DIR/service-worker.js"
+TS=$(date +%Y%m%d%H%M%S)
+PATCH_TARGET="$WEBUI_DIR/js/ru-patch-v5.js"
+SW_TARGET="$WEBUI_DIR/js/sw-cleanup.js"
+HOST_GROUPS_TARGET="$WEBUI_DIR/js/aw-host-groups.json"
+TRENDS_NEEDLE='this.activityStore.query_category_time_by_period(r)'
+TRENDS_REPLACEMENT='this.activityStore.ensure_loaded(r)'
+TIMESPIRAL_NEEDLE='start:new Date("2022-08-08")'
+TIMESPIRAL_REPLACEMENT='start:new Date(Date.now()-12*36e5)'
+CATEGORY_HELPER_NEEDLE='hostname:t.hostnameChoices[0]'
+CATEGORY_HELPER_REPLACEMENT='hostname:t.hostnameChoices.filter((function(t){return"unknown"!==t}))[0]||t.hostnameChoices[0]'
+
+[[ -f "$PATCH_JS_SRC" ]] || { echo "missing $PATCH_JS_SRC" >&2; exit 1; }
+[[ -f "$SW_CLEANUP_SRC" ]] || { echo "missing $SW_CLEANUP_SRC" >&2; exit 1; }
+[[ -f "$HOST_GROUPS_SRC" ]] || { echo "missing $HOST_GROUPS_SRC" >&2; exit 1; }
+[[ -f "$INDEX_HTML" ]] || { echo "missing $INDEX_HTML" >&2; exit 1; }
+
+install -d "$WEBUI_DIR/js"
+install -m 0644 "$PATCH_JS_SRC" "$PATCH_TARGET"
+install -m 0644 "$SW_CLEANUP_SRC" "$SW_TARGET"
+install -m 0644 "$HOST_GROUPS_SRC" "$HOST_GROUPS_TARGET"
+cp "$INDEX_HTML" "$INDEX_HTML.bak.$TS"
+
+patch_hash="$(sha1sum "$PATCH_TARGET" | awk '{print substr($1,1,12)}')"
+sw_hash="$(sha1sum "$SW_TARGET" | awk '{print substr($1,1,12)}')"
+
+sed -i '/ru-patch-v5.js/d;/sw-cleanup.js/d;/aw-ru-patch.js/d;/aw-sw-cleanup.js/d' "$INDEX_HTML"
+sed -i "s#</head>#<script src=\"/js/sw-cleanup.js?v=$sw_hash\"></script></head>#" "$INDEX_HTML"
+sed -i "s#</body>#<script defer=\"defer\" src=\"/js/ru-patch-v5.js?v=$patch_hash\"></script></body>#" "$INDEX_HTML"
+cp "$SW_CLEANUP_SRC" "$SERVICE_WORKER"
+
+trends_chunk="$(grep -Rsl "$TRENDS_NEEDLE" "$WEBUI_DIR/js"/*.js 2>/dev/null | head -n 1 || true)"
+if [[ -n "$trends_chunk" ]]; then
+  cp "$trends_chunk" "$trends_chunk.bak.$TS"
+  python3 - "$trends_chunk" "$TRENDS_NEEDLE" "$TRENDS_REPLACEMENT" <<'PY'
+from pathlib import Path
+import sys
+
+path = Path(sys.argv[1])
+old = sys.argv[2]
+new = sys.argv[3]
+content = path.read_text()
+if old in content:
+    path.write_text(content.replace(old, new, 1))
+    print(f"Trends hotfix applied to {path}")
+else:
+    print(f"Trends hotfix already present in {path}")
+PY
+else
+  echo "Trends hotfix skipped: chunk not found"
+fi
+
+timespiral_chunk="$(grep -Rsl "$TIMESPIRAL_NEEDLE" "$WEBUI_DIR/js"/*.js 2>/dev/null | head -n 1 || true)"
+if [[ -n "$timespiral_chunk" ]]; then
+  cp "$timespiral_chunk" "$timespiral_chunk.bak.$TS"
+  python3 - "$timespiral_chunk" "$TIMESPIRAL_NEEDLE" "$TIMESPIRAL_REPLACEMENT" <<'PY'
+from pathlib import Path
+import sys
+
+path = Path(sys.argv[1])
+old = sys.argv[2]
+new = sys.argv[3]
+content = path.read_text()
+if old in content:
+    path.write_text(content.replace(old, new, 1))
+    print(f"Timespiral hotfix applied to {path}")
+else:
+    print(f"Timespiral hotfix already present in {path}")
+PY
+else
+  echo "Timespiral hotfix skipped: chunk not found"
+fi
+
+category_helper_chunk="$(grep -Rsl "$CATEGORY_HELPER_NEEDLE" "$WEBUI_DIR/js"/*.js 2>/dev/null | head -n 1 || true)"
+if [[ -n "$category_helper_chunk" ]]; then
+  cp "$category_helper_chunk" "$category_helper_chunk.bak.$TS"
+  python3 - "$category_helper_chunk" "$CATEGORY_HELPER_NEEDLE" "$CATEGORY_HELPER_REPLACEMENT" <<'PY'
+from pathlib import Path
+import sys
+
+path = Path(sys.argv[1])
+old = sys.argv[2]
+new = sys.argv[3]
+content = path.read_text()
+if old in content:
+    path.write_text(content.replace(old, new, 1))
+    print(f"Category helper host hotfix applied to {path}")
+else:
+    print(f"Category helper host hotfix already present in {path}")
+PY
+else
+  echo "Category helper host hotfix skipped: chunk not found"
+fi
+
+echo "RU patch applied to $WEBUI_DIR (ru-patch-v5.js?v=$patch_hash)"

install-kit-awindows-20260427-211240/aw-server/aw-host-groups.json

@@ -0,0 +1,47 @@
+{
+  "groups": [
+    {
+      "id": "pve-detmir",
+      "name": "pve-detmir",
+      "description": "Выделенный клиент DetMir в разделе Активность.",
+      "patterns": [
+        "^pve-detmir$"
+      ],
+      "links": [
+        { "label": "Активность", "type": "activity", "view": "pve_audit" },
+        { "label": "Web-admin аудит", "type": "bucket", "bucket_prefix": "aw-pve-webadmin-events_" },
+        { "label": "PVE tasks", "type": "bucket", "bucket_prefix": "aw-pve-task-events_" },
+        { "label": "SSH сессии", "type": "bucket", "bucket_prefix": "aw-ssh-sessions_" },
+        { "label": "Команды shell", "type": "bucket", "bucket_prefix": "aw-console-commands_" },
+        { "label": "Web категории", "type": "bucket", "bucket_prefix": "aw-detmir-web-category_" },
+        { "label": "Все бакеты", "type": "buckets" }
+      ]
+    },
+    {
+      "id": "windows-rdp",
+      "name": "Windows RDP",
+      "description": "Пользовательские Windows/RDP хосты с активностью, DLP и рабочим временем.",
+      "patterns": [
+        "^(SHARKON|WIN|RDP|TERM|TS-|WS-)"
+      ],
+      "links": [
+        { "label": "Активность", "type": "activity" },
+        { "label": "DLP", "type": "bucket", "bucket_prefix": "aw-dlp-endpoint-signals_" }
+      ]
+    },
+    {
+      "id": "virtual-infra",
+      "name": "Virtual servers + Proxmox",
+      "description": "Инфраструктурные VM и сетевые узлы. Здесь должны лежать Proxmox, pfSense, Debian и Ubuntu серверы.",
+      "patterns": [
+        "^(PFSENSE|PVE|PROXMOX|DEBIAN|UBUNTU|LINUX|VM-|SRV-|INFRA-)"
+      ],
+      "links": [
+        { "label": "pfSense health", "type": "bucket", "bucket_prefix": "aw-pfsense-health_" },
+        { "label": "pfSense gateways", "type": "bucket", "bucket_prefix": "aw-pfsense-gateways_" },
+        { "label": "Все бакеты", "type": "buckets" }
+      ]
+    }
+  ],
+  "ungrouped_name": "Прочие хосты"
+}

install-kit-awindows-20260427-211240/aw-server/aw-server.env.example

@@ -0,0 +1,11 @@
+# Copy to /etc/activitywatch/aw-server.env and fill with real values.
+
+AW_SERVER_VERSION=0.13.2
+AW_SERVER_DOWNLOAD_URL=https://github.com/ActivityWatch/aw-server-rust/releases/download/v0.13.2/aw-server-rust-linux-x86_64.zip
+AW_SERVER_BIND_HOST=0.0.0.0
+AW_SERVER_PORT=5600
+AW_SERVER_WEBUI_DIR=/opt/activitywatch/webui-ru
+AW_SERVER_DATA_DIR=/var/lib/activitywatch
+AW_SERVER_LOG_DIR=/var/log/activitywatch
+AW_SERVER_USER=activitywatch
+AW_SERVER_GROUP=activitywatch

install-kit-awindows-20260427-211240/aw-server/aw-sw-cleanup.js

@@ -0,0 +1,18 @@
+self.addEventListener("install", function (event) {
+  self.skipWaiting();
+  event.waitUntil((async function () {
+    const keys = await caches.keys();
+    await Promise.all(keys.map(function (key) { return caches.delete(key); }));
+  })());
+});
+
+self.addEventListener("activate", function (event) {
+  event.waitUntil((async function () {
+    const keys = await caches.keys();
+    await Promise.all(keys.map(function (key) { return caches.delete(key); }));
+    await self.clients.claim();
+    await self.registration.unregister();
+  })());
+});
+
+self.addEventListener("fetch", function () {});

install-kit-awindows-20260427-211240/aw-server/install_aw_server.sh

@@ -0,0 +1,117 @@
+#!/bin/bash
+set -euo pipefail
+
+ENV_FILE="/etc/activitywatch/aw-server.env"
+if [[ ! -f "$ENV_FILE" ]]; then
+  echo "missing env file: $ENV_FILE" >&2
+  exit 1
+fi
+
+source "$ENV_FILE"
+
+required_vars=(
+  AW_SERVER_VERSION
+  AW_SERVER_DOWNLOAD_URL
+  AW_SERVER_BIND_HOST
+  AW_SERVER_PORT
+  AW_SERVER_WEBUI_DIR
+  AW_SERVER_DATA_DIR
+  AW_SERVER_LOG_DIR
+  AW_SERVER_USER
+  AW_SERVER_GROUP
+)
+
+BOOTSTRAP_DIR="/root/bootstrap"
+VIEWS_JSON="$BOOTSTRAP_DIR/settings/views-default.json"
+CLASSES_JSON="$BOOTSTRAP_DIR/settings/classes-worktime.json"
+
+for var_name in "${required_vars[@]}"; do
+  if [[ -z "${!var_name:-}" ]]; then
+    echo "missing required variable: $var_name" >&2
+    exit 1
+  fi
+done
+
+export DEBIAN_FRONTEND=noninteractive
+apt-get update
+apt-get install -y curl ca-certificates unzip jq
+
+if ! getent group "$AW_SERVER_GROUP" >/dev/null; then
+  groupadd --system "$AW_SERVER_GROUP"
+fi
+
+if ! id "$AW_SERVER_USER" >/dev/null 2>&1; then
+  useradd --system --gid "$AW_SERVER_GROUP" --home-dir "$AW_SERVER_DATA_DIR" --shell /usr/sbin/nologin "$AW_SERVER_USER"
+fi
+
+install -d -o "$AW_SERVER_USER" -g "$AW_SERVER_GROUP" /opt/activitywatch/bin
+install -d -o "$AW_SERVER_USER" -g "$AW_SERVER_GROUP" /opt/activitywatch/releases
+install -d -o "$AW_SERVER_USER" -g "$AW_SERVER_GROUP" "$AW_SERVER_WEBUI_DIR"
+install -d -o "$AW_SERVER_USER" -g "$AW_SERVER_GROUP" "$AW_SERVER_DATA_DIR"
+install -d -o "$AW_SERVER_USER" -g "$AW_SERVER_GROUP" "$AW_SERVER_LOG_DIR"
+
+tmp_dir=$(mktemp -d)
+trap 'rm -rf "$tmp_dir"' EXIT
+
+curl -fL "$AW_SERVER_DOWNLOAD_URL" -o "$tmp_dir/aw-server.zip"
+unzip -q "$tmp_dir/aw-server.zip" -d "$tmp_dir/unpacked"
+
+server_bin=$(find "$tmp_dir/unpacked" -type f \( -name 'aw-server-rust' -o -name 'aw-server' \) | head -n 1)
+webui_dir=$(find "$tmp_dir/unpacked" -type d \( -name 'webui' -o -name 'aw-webui' \) | head -n 1 || true)
+
+if [[ -z "$server_bin" || ! -f "$server_bin" ]]; then
+  echo "aw-server binary not found in archive" >&2
+  exit 1
+fi
+
+release_dir="/opt/activitywatch/releases/aw-server-rust-v${AW_SERVER_VERSION}"
+rm -rf "$release_dir"
+install -d -o "$AW_SERVER_USER" -g "$AW_SERVER_GROUP" "$release_dir"
+install -m 0755 -o "$AW_SERVER_USER" -g "$AW_SERVER_GROUP" "$server_bin" "$release_dir/aw-server-rust"
+ln -sfn "$release_dir/aw-server-rust" /opt/activitywatch/bin/aw-server-rust
+
+if [[ -n "$webui_dir" && -d "$webui_dir" ]]; then
+  rm -rf "$AW_SERVER_WEBUI_DIR"
+  mkdir -p "$AW_SERVER_WEBUI_DIR"
+  cp -a "$webui_dir"/. "$AW_SERVER_WEBUI_DIR"/
+  chown -R "$AW_SERVER_USER:$AW_SERVER_GROUP" "$AW_SERVER_WEBUI_DIR"
+fi
+
+sed \
+  -e "s#__AW_SERVER_USER__#$AW_SERVER_USER#g" \
+  -e "s#__AW_SERVER_GROUP__#$AW_SERVER_GROUP#g" \
+  -e "s#__AW_SERVER_DATA_DIR__#$AW_SERVER_DATA_DIR#g" \
+  /root/bootstrap/activitywatch-server.service > /etc/systemd/system/activitywatch-server.service
+chmod 0644 /etc/systemd/system/activitywatch-server.service
+
+systemctl daemon-reload
+systemctl enable activitywatch-server.service
+systemctl restart activitywatch-server.service
+systemctl --no-pager --full status activitywatch-server.service || true
+
+for _ in $(seq 1 20); do
+  if curl -fsS "http://127.0.0.1:${AW_SERVER_PORT}/api/0/info" >/dev/null 2>&1; then
+    break
+  fi
+  sleep 2
+done
+
+if [[ -f "$CLASSES_JSON" ]]; then
+  curl -fsS -X POST \
+    -H 'Content-Type: application/json' \
+    --data-binary @"$CLASSES_JSON" \
+    "http://127.0.0.1:${AW_SERVER_PORT}/api/0/settings/classes" >/dev/null
+  echo "Applied worktime classes from $CLASSES_JSON"
+else
+  echo "Worktime classes bootstrap not found, skipped: $CLASSES_JSON"
+fi
+
+if [[ -f "$VIEWS_JSON" ]]; then
+  curl -fsS -X POST \
+    -H 'Content-Type: application/json' \
+    --data-binary @"$VIEWS_JSON" \
+    "http://127.0.0.1:${AW_SERVER_PORT}/api/0/settings/views" >/dev/null
+  echo "Applied baseline views from $VIEWS_JSON"
+else
+  echo "Views bootstrap not found, skipped: $VIEWS_JSON"
+fi

install-kit-awindows-20260427-211240/aw-server/settings/classes-worktime.json

@@ -0,0 +1,90 @@
+[
+  {
+    "id": 0,
+    "name": ["Работа"],
+    "rule": { "type": "none" },
+    "data": {}
+  },
+  {
+    "id": 1,
+    "name": ["Работа", "1С"],
+    "rule": {
+      "type": "regex",
+      "regex": "\\b(1cv8s?|1cv8c|1cestart)\\.exe\\b|1С:Предприятие|Запуск 1С:Предприятия|Загрузка конфигурационной информации|Доступ к информационной базе",
+      "ignore_case": true
+    },
+    "data": { "color": "#194D33" }
+  },
+  {
+    "id": 2,
+    "name": ["Работа", "Документы"],
+    "rule": {
+      "type": "regex",
+      "regex": "\\b(winword|excel|powerpnt|outlook|acrord32|acrord64)\\.exe\\b|Adobe Reader|Acrobat",
+      "ignore_case": true
+    },
+    "data": { "color": "#2E7D32" }
+  },
+  {
+    "id": 3,
+    "name": ["Работа", "Коммуникации"],
+    "rule": {
+      "type": "regex",
+      "regex": "\\b(teams|telegram|slack|thunderbird|zoom|skype|whatsapp|viber|discord)\\.exe\\b|Mattermost|Element|Riot",
+      "ignore_case": true
+    },
+    "data": { "color": "#1E88E5" }
+  },
+  {
+    "id": 4,
+    "name": ["Работа", "Администрирование"],
+    "rule": {
+      "type": "regex",
+      "regex": "\\b(mstsc|putty|kitty|winscp|anydesk|teamviewer|vncviewer|mmc|regedit|services|control|powershell|cmd)\\.exe\\b",
+      "ignore_case": true
+    },
+    "data": { "color": "#6D4C41" }
+  },
+  {
+    "id": 5,
+    "name": ["Интернет"],
+    "rule": { "type": "none" },
+    "data": {}
+  },
+  {
+    "id": 6,
+    "name": ["Интернет", "Браузер"],
+    "rule": {
+      "type": "regex",
+      "regex": "\\b(chrome|msedge|firefox|opera|brave|vivaldi|browser)\\.exe\\b",
+      "ignore_case": true
+    },
+    "data": { "color": "#00897B" }
+  },
+  {
+    "id": 7,
+    "name": ["Система"],
+    "rule": { "type": "none" },
+    "data": {}
+  },
+  {
+    "id": 8,
+    "name": ["Система", "Windows"],
+    "rule": {
+      "type": "regex",
+      "regex": "\\b(SearchHost|explorer|ShellExperienceHost|ApplicationFrameHost|RuntimeBroker|sihost|dwm|svchost|fontdrvhost|userinit)\\.exe\\b|\\\\Windows\\\\System32",
+      "ignore_case": true
+    },
+    "data": { "color": "#607D8B" }
+  },
+  {
+    "id": 9,
+    "name": ["ActivityWatch"],
+    "rule": {
+      "type": "regex",
+      "regex": "ActivityWatch|\\baw-(watcher|qt)\\.exe\\b",
+      "ignore_case": true
+    },
+    "data": {}
+  }
+]

install-kit-awindows-20260427-211240/aw-server/settings/views-default.json

@@ -0,0 +1,39 @@
+[
+  {
+    "id": "summary",
+    "name": "Summary",
+    "elements": [
+      { "type": "top_titles", "size": 3 },
+      { "type": "timeline_barchart", "size": 3 },
+      { "type": "top_categories", "size": 3 },
+      { "type": "category_tree", "size": 3 }
+    ]
+  },
+  {
+    "id": "window",
+    "name": "Window",
+    "elements": [
+      { "type": "top_apps", "size": 3, "props": {} }
+    ]
+  },
+  {
+    "id": "DLP",
+    "name": "DLP",
+    "elements": []
+  },
+  {
+    "id": "worktime",
+    "name": "Worktime",
+    "elements": [
+      { "type": "top_categories", "size": 3, "props": {} },
+      { "type": "timeline_barchart", "size": 3, "props": {} },
+      { "type": "category_tree", "size": 3, "props": {} },
+      { "type": "top_apps", "size": 3, "props": {} }
+    ]
+  },
+  {
+    "id": "pve_audit",
+    "name": "PVE Audit",
+    "elements": []
+  }
+]

install-kit-awindows-20260427-211240/server-configs-192.168.100.21/awatch-rus-admin.deployment-config.json

@@ -0,0 +1,57 @@
+{
+    "version":  1,
+    "generatedAtUtc":  "2026-04-27T01:14:21.9184268Z",
+    "server":  {
+                   "host":  "10.10.10.13",
+                   "port":  5600,
+                   "scheme":  "http"
+               },
+    "paths":  {
+                  "installRoot":  "C:\\Program Files\\AWatch-rus\\bin",
+                  "stateRoot":  "C:\\ProgramData\\AWatch-rus",
+                  "logsRoot":  "C:\\ProgramData\\AWatch-rus\\logs",
+                  "collectorScript":  "C:\\ProgramData\\AWatch-rus\\browser-domains-native-collector.ps1",
+                  "endpointCollectorScript":  "C:\\ProgramData\\AWatch-rus\\dlp-endpoint-signals-collector.ps1",
+                  "rulesPath":  "C:\\ProgramData\\AWatch-rus\\web-category-rules.json",
+                  "policyPath":  "C:\\ProgramData\\AWatch-rus\\dlp-policy.json",
+                  "launchScript":  "C:\\ProgramData\\AWatch-rus\\launch-watchers.ps1",
+                  "recoveryScript":  "C:\\ProgramData\\AWatch-rus\\recovery-loop.ps1"
+              },
+    "collector":  {
+                      "pollSeconds":  5,
+                      "pulseSeconds":  30
+                  },
+    "collectors":  {
+                       "afkEnabled":  true,
+                       "windowEnabled":  true
+                   },
+    "logging":  {
+                    "localAgentLogsEnabled":  false
+                },
+    "incidentCapture":  {
+                            "enabled":  true,
+                            "screenshotEnabled":  true,
+                            "artifactsRoot":  "C:\\ProgramData\\AWatch-rus\\incident-artifacts"
+                        },
+    "sessionEvents":  {
+                          "logonEnabled":  true,
+                          "bucketPrefix":  "aw-session-events"
+                      },
+    "recovery":  {
+                     "intervalSeconds":  180,
+                     "taskName":  "ActivityWatch Recovery"
+                 },
+    "dlp":  {
+                "incidentBucketPrefix":  "aw-dlp-incidents",
+                "enabled":  true
+            },
+    "package":  {
+                    "version":  "v0.13.2"
+                },
+    "userTasks":  [
+                      {
+                          "UserId":  "SHARKON2025\\Администратор",
+                          "LaunchTaskName":  "ActivityWatch Launch [SHARKON2025_РђРґРјРёРЅРёСЃС_СЂР_С_РѕСЂ]"
+                      }
+                  ]
+}

install-kit-awindows-20260427-211240/server-configs-192.168.100.21/awatch-rus-u2u5.deployment-config.json

@@ -0,0 +1,69 @@
+{
+    "version":  1,
+    "generatedAtUtc":  "2026-04-27T01:09:42.4193209Z",
+    "server":  {
+                   "host":  "10.10.10.13",
+                   "port":  5600,
+                   "scheme":  "http"
+               },
+    "paths":  {
+                  "installRoot":  "C:\\Program Files\\AWatch-rus\\bin",
+                  "stateRoot":  "C:\\ProgramData\\AWatch-rus",
+                  "logsRoot":  "C:\\ProgramData\\AWatch-rus\\logs",
+                  "collectorScript":  "C:\\ProgramData\\AWatch-rus\\browser-domains-native-collector.ps1",
+                  "endpointCollectorScript":  "C:\\ProgramData\\AWatch-rus\\dlp-endpoint-signals-collector.ps1",
+                  "rulesPath":  "C:\\ProgramData\\AWatch-rus\\web-category-rules.json",
+                  "policyPath":  "C:\\ProgramData\\AWatch-rus\\dlp-policy.json",
+                  "launchScript":  "C:\\ProgramData\\AWatch-rus\\launch-watchers.ps1",
+                  "recoveryScript":  "C:\\ProgramData\\AWatch-rus\\recovery-loop.ps1"
+              },
+    "collector":  {
+                      "pollSeconds":  5,
+                      "pulseSeconds":  30
+                  },
+    "collectors":  {
+                       "afkEnabled":  true,
+                       "windowEnabled":  true
+                   },
+    "logging":  {
+                    "localAgentLogsEnabled":  false
+                },
+    "incidentCapture":  {
+                            "enabled":  true,
+                            "screenshotEnabled":  true,
+                            "artifactsRoot":  "C:\\ProgramData\\AWatch-rus\\incident-artifacts"
+                        },
+    "sessionEvents":  {
+                          "logonEnabled":  true,
+                          "bucketPrefix":  "aw-session-events"
+                      },
+    "recovery":  {
+                     "intervalSeconds":  180,
+                     "taskName":  "ActivityWatch Recovery"
+                 },
+    "dlp":  {
+                "incidentBucketPrefix":  "aw-dlp-incidents",
+                "enabled":  true
+            },
+    "package":  {
+                    "version":  "v0.13.2"
+                },
+    "userTasks":  [
+                      {
+                          "UserId":  "SHARKON2025\\user2",
+                          "LaunchTaskName":  "ActivityWatch Launch [SHARKON2025_user2]"
+                      },
+                      {
+                          "UserId":  "SHARKON2025\\user3",
+                          "LaunchTaskName":  "ActivityWatch Launch [SHARKON2025_user3]"
+                      },
+                      {
+                          "UserId":  "SHARKON2025\\user4",
+                          "LaunchTaskName":  "ActivityWatch Launch [SHARKON2025_user4]"
+                      },
+                      {
+                          "UserId":  "SHARKON2025\\user5",
+                          "LaunchTaskName":  "ActivityWatch Launch [SHARKON2025_user5]"
+                      }
+                  ]
+}

install-kit-awindows-20260427-211240/server-configs-192.168.100.21/awatch-rus-user1.deployment-config.json

@@ -0,0 +1,57 @@
+{
+    "version":  1,
+    "generatedAtUtc":  "2026-04-27T01:09:38.9519788Z",
+    "server":  {
+                   "host":  "10.10.10.13",
+                   "port":  5600,
+                   "scheme":  "http"
+               },
+    "paths":  {
+                  "installRoot":  "C:\\Program Files\\AWatch-rus\\bin",
+                  "stateRoot":  "C:\\ProgramData\\AWatch-rus",
+                  "logsRoot":  "C:\\ProgramData\\AWatch-rus\\logs",
+                  "collectorScript":  "C:\\ProgramData\\AWatch-rus\\browser-domains-native-collector.ps1",
+                  "endpointCollectorScript":  "C:\\ProgramData\\AWatch-rus\\dlp-endpoint-signals-collector.ps1",
+                  "rulesPath":  "C:\\ProgramData\\AWatch-rus\\web-category-rules.json",
+                  "policyPath":  "C:\\ProgramData\\AWatch-rus\\dlp-policy.json",
+                  "launchScript":  "C:\\ProgramData\\AWatch-rus\\launch-watchers.ps1",
+                  "recoveryScript":  "C:\\ProgramData\\AWatch-rus\\recovery-loop.ps1"
+              },
+    "collector":  {
+                      "pollSeconds":  5,
+                      "pulseSeconds":  30
+                  },
+    "collectors":  {
+                       "afkEnabled":  true,
+                       "windowEnabled":  true
+                   },
+    "logging":  {
+                    "localAgentLogsEnabled":  false
+                },
+    "incidentCapture":  {
+                            "enabled":  true,
+                            "screenshotEnabled":  true,
+                            "artifactsRoot":  "C:\\ProgramData\\AWatch-rus\\incident-artifacts"
+                        },
+    "sessionEvents":  {
+                          "logonEnabled":  true,
+                          "bucketPrefix":  "aw-session-events"
+                      },
+    "recovery":  {
+                     "intervalSeconds":  180,
+                     "taskName":  "ActivityWatch Recovery"
+                 },
+    "dlp":  {
+                "incidentBucketPrefix":  "aw-dlp-incidents",
+                "enabled":  true
+            },
+    "package":  {
+                    "version":  "v0.13.2"
+                },
+    "userTasks":  [
+                      {
+                          "UserId":  "SHARKON2025\\user1",
+                          "LaunchTaskName":  "ActivityWatch Launch [SHARKON2025_user1]"
+                      }
+                  ]
+}

install-kit-awindows-20260427-211240/windows/ActivityWatch.Windows.Common.psd1

@@ -0,0 +1,25 @@
+@{
+    RootModule = 'ActivityWatch.Windows.Common.psm1'
+    ModuleVersion = '1.0.0'
+    GUID = '90b3fcf6-df9f-4f9b-9ee0-8a7de4dc0ee2'
+    Author = 'igor04091968'
+    CompanyName = 'Private'
+    Description = 'Common PowerShell functions for ActivityWatch Windows deployment, hardening and recovery.'
+    PowerShellVersion = '5.1'
+    FunctionsToExport = @(
+        '*-ActivityWatch*',
+        'Assert-Administrator',
+        'Normalize-ActivityWatchUsers',
+        'Get-ActivityWatchPackageUrl',
+        'Remove-LegacyActivityWatchEntries'
+    )
+    CmdletsToExport = @()
+    VariablesToExport = '*'
+    AliasesToExport = @()
+    PrivateData = @{
+        PSData = @{
+            Tags = @('ActivityWatch', 'Windows', 'Deployment', 'Recovery')
+            ProjectUri = 'https://github.com/igor04091968/AWatch-rus'
+        }
+    }
+}

install-kit-awindows-20260427-211240/windows/ActivityWatch.Windows.Common.psm1

@@ -0,0 +1,992 @@
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+function Assert-Administrator {
+    $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+    $principal = [Security.Principal.WindowsPrincipal]::new($identity)
+    if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
+        throw 'Запустите этот скрипт из PowerShell с правами администратора.'
+    }
+}
+
+function New-ActivityWatchDirectory {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Path
+    )
+
+    if (-not (Test-Path -LiteralPath $Path)) {
+        New-Item -Path $Path -ItemType Directory -Force | Out-Null
+    }
+}
+
+function Get-ActivityWatchPackageUrl {
+    param(
+        [string]$Version = 'v0.13.2'
+    )
+
+    return "https://github.com/ActivityWatch/activitywatch/releases/download/$Version/activitywatch-$Version-windows-x86_64.zip"
+}
+
+function Get-ActivityWatchArchive {
+    param(
+        [string]$PackageZipPath,
+        [string]$PackageUrl,
+        [string]$Version = 'v0.13.2',
+        [Parameter(Mandatory = $true)]
+        [string]$WorkingRoot
+    )
+
+    New-ActivityWatchDirectory -Path $WorkingRoot
+
+    if ($PackageZipPath) {
+        $resolved = Resolve-Path -LiteralPath $PackageZipPath -ErrorAction Stop
+        return $resolved.Path
+    }
+
+    if (-not $PackageUrl) {
+        $PackageUrl = Get-ActivityWatchPackageUrl -Version $Version
+    }
+
+    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+    $archivePath = Join-Path $WorkingRoot ("activitywatch-{0}.zip" -f $Version.TrimStart('v'))
+    Invoke-WebRequest -Uri $PackageUrl -OutFile $archivePath
+    return $archivePath
+}
+
+function Get-ActivityWatchPackageRoot {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$ExpandedRoot
+    )
+
+    $afkBinary = Get-ChildItem -Path $ExpandedRoot -Filter 'aw-watcher-afk.exe' -File -Recurse |
+        Select-Object -First 1
+
+    if (-not $afkBinary) {
+        throw "Не удалось найти aw-watcher-afk.exe в $ExpandedRoot."
+    }
+
+    return (Split-Path -Path (Split-Path -Path $afkBinary.FullName -Parent) -Parent)
+}
+
+function Install-ActivityWatchPackage {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$ArchivePath,
+        [Parameter(Mandatory = $true)]
+        [string]$InstallRoot,
+        [Parameter(Mandatory = $true)]
+        [string]$WorkingRoot,
+        [Parameter(Mandatory = $true)]
+        [string]$BackupRoot
+    )
+
+    New-ActivityWatchDirectory -Path $WorkingRoot
+    New-ActivityWatchDirectory -Path $BackupRoot
+
+    $extractRoot = Join-Path $WorkingRoot ('extract-' + [guid]::NewGuid().Guid)
+    if (Test-Path -LiteralPath $extractRoot) {
+        Remove-Item -LiteralPath $extractRoot -Recurse -Force
+    }
+    New-ActivityWatchDirectory -Path $extractRoot
+
+    Expand-Archive -Path $ArchivePath -DestinationPath $extractRoot -Force
+    $packageRoot = Get-ActivityWatchPackageRoot -ExpandedRoot $extractRoot
+
+    if (Test-Path -LiteralPath $InstallRoot) {
+        $existingItems = Get-ChildItem -LiteralPath $InstallRoot -Force -ErrorAction SilentlyContinue
+        if ($existingItems) {
+            $stamp = Get-Date -Format 'yyyyMMdd-HHmmss'
+            $backupPath = Join-Path $BackupRoot ("install-$stamp")
+            New-ActivityWatchDirectory -Path $backupPath
+            Copy-Item -Path (Join-Path $InstallRoot '*') -Destination $backupPath -Recurse -Force
+            Get-ChildItem -LiteralPath $InstallRoot -Force | Remove-Item -Recurse -Force
+        }
+    }
+    else {
+        New-ActivityWatchDirectory -Path $InstallRoot
+    }
+
+    Copy-Item -Path (Join-Path $packageRoot '*') -Destination $InstallRoot -Recurse -Force
+
+    return [pscustomobject]@{
+        PackageRoot = $packageRoot
+        ExtractRoot = $extractRoot
+        BackupRoot  = $BackupRoot
+    }
+}
+
+function Get-ActivityWatchExecutableMap {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$InstallRoot
+    )
+
+    $map = [ordered]@{
+        Afk    = Join-Path $InstallRoot 'aw-watcher-afk\aw-watcher-afk.exe'
+        Window = Join-Path $InstallRoot 'aw-watcher-window\aw-watcher-window.exe'
+    }
+
+    foreach ($entry in $map.GetEnumerator()) {
+        if (-not (Test-Path -LiteralPath $entry.Value)) {
+            throw "Не найден обязательный исполняемый файл ActivityWatch: $($entry.Value)"
+        }
+    }
+
+    return [pscustomobject]$map
+}
+
+function Normalize-ActivityWatchUsers {
+    param(
+        [string[]]$Users,
+        [string]$UserListPath,
+        [string]$Domain
+    )
+
+    $collected = New-Object System.Collections.Generic.List[string]
+
+    if ($Users) {
+        foreach ($user in $Users) {
+            if (-not [string]::IsNullOrWhiteSpace($user)) {
+                $collected.Add($user.Trim())
+            }
+        }
+    }
+
+    if ($UserListPath) {
+        $resolved = Resolve-Path -LiteralPath $UserListPath -ErrorAction Stop
+        $extension = [IO.Path]::GetExtension($resolved.Path)
+        if ($extension -ieq '.csv') {
+            $rows = Import-Csv -LiteralPath $resolved.Path
+            foreach ($row in $rows) {
+                foreach ($column in 'User', 'Username', 'SamAccountName', 'Login') {
+                    if ($row.PSObject.Properties.Name -contains $column) {
+                        $value = [string]$row.$column
+                        if (-not [string]::IsNullOrWhiteSpace($value)) {
+                            $collected.Add($value.Trim())
+                            break
+                        }
+                    }
+                }
+            }
+        }
+        else {
+            Get-Content -LiteralPath $resolved.Path | ForEach-Object {
+                $line = $_.Trim()
+                if ($line -and -not $line.StartsWith('#')) {
+                    $collected.Add($line)
+                }
+            }
+        }
+    }
+
+    $normalized = $collected |
+        Where-Object { -not [string]::IsNullOrWhiteSpace($_) } |
+        ForEach-Object {
+            if ($Domain -and ($_ -notmatch '[\\@]')) {
+                '{0}\{1}' -f $Domain, $_
+            }
+            else {
+                $_
+            }
+        } |
+        Sort-Object -Unique
+
+    if (-not $normalized -or $normalized.Count -eq 0) {
+        throw 'Не удалось определить целевых пользователей. Укажите -Users или -UserListPath.'
+    }
+
+    return @($normalized)
+}
+
+function Get-ActivityWatchTaskNameToken {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$UserId
+    )
+
+    $buffer = [Text.StringBuilder]::new()
+    foreach ($character in $UserId.ToCharArray()) {
+        if ([char]::IsLetterOrDigit($character)) {
+            [void]$buffer.Append($character)
+        }
+        else {
+            [void]$buffer.Append('_')
+        }
+    }
+
+    return $buffer.ToString().Trim('_')
+}
+
+function New-ActivityWatchUserTaskDefinitions {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string[]]$Users
+    )
+
+    $result = foreach ($user in $Users) {
+        $token = Get-ActivityWatchTaskNameToken -UserId $user
+        [pscustomobject]@{
+            UserId         = $user
+            LaunchTaskName = "ActivityWatch Launch [$token]"
+        }
+    }
+
+    return @($result)
+}
+
+function Copy-ActivityWatchCollectorAssets {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$CollectorScriptSource,
+        [Parameter(Mandatory = $true)]
+        [string]$EndpointCollectorScriptSource,
+        [Parameter(Mandatory = $true)]
+        [string]$SessionCollectorScriptSource,
+        [Parameter(Mandatory = $true)]
+        [string]$ExampleRulesSource,
+        [Parameter(Mandatory = $true)]
+        [string]$ExamplePolicySource,
+        [Parameter(Mandatory = $true)]
+        [string]$StateRoot,
+        [string]$CustomRulesSource,
+        [string]$CustomPolicySource
+    )
+
+    New-ActivityWatchDirectory -Path $StateRoot
+
+    $collectorTarget = Join-Path $StateRoot 'browser-domains-native-collector.ps1'
+    $endpointCollectorTarget = Join-Path $StateRoot 'dlp-endpoint-signals-collector.ps1'
+    $sessionCollectorTarget = Join-Path $StateRoot 'worktime-session-collector.ps1'
+    $exampleRulesTarget = Join-Path $StateRoot 'web-category-rules.example.json'
+    $rulesTarget = Join-Path $StateRoot 'web-category-rules.json'
+    $examplePolicyTarget = Join-Path $StateRoot 'dlp-policy.example.json'
+    $policyTarget = Join-Path $StateRoot 'dlp-policy.json'
+
+    Copy-Item -LiteralPath $CollectorScriptSource -Destination $collectorTarget -Force
+    Copy-Item -LiteralPath $EndpointCollectorScriptSource -Destination $endpointCollectorTarget -Force
+    Copy-Item -LiteralPath $SessionCollectorScriptSource -Destination $sessionCollectorTarget -Force
+    Copy-Item -LiteralPath $ExampleRulesSource -Destination $exampleRulesTarget -Force
+    Copy-Item -LiteralPath $ExamplePolicySource -Destination $examplePolicyTarget -Force
+
+    if ($CustomRulesSource) {
+        $resolvedRules = Resolve-Path -LiteralPath $CustomRulesSource -ErrorAction Stop
+        Copy-Item -LiteralPath $resolvedRules.Path -Destination $rulesTarget -Force
+    }
+
+    if ($CustomPolicySource) {
+        $resolvedPolicy = Resolve-Path -LiteralPath $CustomPolicySource -ErrorAction Stop
+        Copy-Item -LiteralPath $resolvedPolicy.Path -Destination $policyTarget -Force
+    }
+    else {
+        Copy-Item -LiteralPath $examplePolicyTarget -Destination $policyTarget -Force
+    }
+
+    return [pscustomobject]@{
+        CollectorScript         = $collectorTarget
+        EndpointCollectorScript = $endpointCollectorTarget
+        SessionCollectorScript  = $sessionCollectorTarget
+        ExampleRules            = $exampleRulesTarget
+        ActiveRules             = $rulesTarget
+        ExamplePolicy           = $examplePolicyTarget
+        ActivePolicy            = $policyTarget
+    }
+}
+
+function New-ActivityWatchDeploymentConfig {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$ServerHost,
+        [Parameter(Mandatory = $true)]
+        [int]$ServerPort,
+        [Parameter(Mandatory = $true)]
+        [string]$ServerScheme,
+        [Parameter(Mandatory = $true)]
+        [string]$InstallRoot,
+        [Parameter(Mandatory = $true)]
+        [string]$StateRoot,
+        [Parameter(Mandatory = $true)]
+        [string]$LogsRoot,
+        [Parameter(Mandatory = $true)]
+        [string]$CollectorScript,
+        [Parameter(Mandatory = $true)]
+        [string]$EndpointCollectorScript,
+        [Parameter(Mandatory = $true)]
+        [string]$SessionCollectorScript,
+        [Parameter(Mandatory = $true)]
+        [string]$RulesPath,
+        [Parameter(Mandatory = $true)]
+        [string]$PolicyPath,
+        [Parameter(Mandatory = $true)]
+        [int]$PollSeconds,
+        [Parameter(Mandatory = $true)]
+        [int]$PulseSeconds,
+        [Parameter(Mandatory = $true)]
+        [int]$RecoveryIntervalSeconds,
+        [bool]$AfkEnabled = $true,
+        [bool]$WindowEnabled = $true,
+        [bool]$LocalAgentLogsEnabled = $true,
+        [bool]$IncidentCaptureEnabled = $true,
+        [bool]$IncidentScreenshotEnabled = $true,
+        [string]$IncidentArtifactsRoot,
+        [bool]$LogonMarkerEnabled = $true,
+        [Parameter(Mandatory = $true)]
+        [string]$LaunchScriptPath,
+        [Parameter(Mandatory = $true)]
+        [string]$RecoveryScriptPath,
+        [Parameter(Mandatory = $true)]
+        [pscustomobject[]]$UserTasks,
+        [string]$PackageVersion = 'v0.13.2'
+    )
+
+    $effectiveIncidentArtifactsRoot = if ($IncidentArtifactsRoot) { $IncidentArtifactsRoot } else { Join-Path $StateRoot 'incident-artifacts' }
+
+    return [pscustomobject]@{
+        version  = 1
+        generatedAtUtc = (Get-Date).ToUniversalTime().ToString('o')
+        server   = [pscustomobject]@{
+            host   = $ServerHost
+            port   = $ServerPort
+            scheme = $ServerScheme
+        }
+        paths    = [pscustomobject]@{
+            installRoot    = $InstallRoot
+            stateRoot      = $StateRoot
+            logsRoot       = $LogsRoot
+            collectorScript = $CollectorScript
+            endpointCollectorScript = $EndpointCollectorScript
+            sessionCollectorScript = $SessionCollectorScript
+            rulesPath      = $RulesPath
+            policyPath     = $PolicyPath
+            launchScript   = $LaunchScriptPath
+            recoveryScript = $RecoveryScriptPath
+        }
+        collector = [pscustomobject]@{
+            pollSeconds  = $PollSeconds
+            pulseSeconds = $PulseSeconds
+        }
+        collectors = [pscustomobject]@{
+            afkEnabled   = $AfkEnabled
+            windowEnabled = $WindowEnabled
+        }
+        logging = [pscustomobject]@{
+            localAgentLogsEnabled = $LocalAgentLogsEnabled
+        }
+        incidentCapture = [pscustomobject]@{
+            enabled           = $IncidentCaptureEnabled
+            screenshotEnabled = $IncidentScreenshotEnabled
+            artifactsRoot     = $effectiveIncidentArtifactsRoot
+        }
+        sessionEvents = [pscustomobject]@{
+            logonEnabled = $LogonMarkerEnabled
+            bucketPrefix = 'aw-session-events'
+        }
+        recovery = [pscustomobject]@{
+            intervalSeconds = $RecoveryIntervalSeconds
+            taskName        = 'ActivityWatch Recovery'
+        }
+        dlp = [pscustomobject]@{
+            incidentBucketPrefix = 'aw-dlp-incidents'
+            enabled              = $true
+        }
+        package = [pscustomobject]@{
+            version = $PackageVersion
+        }
+        userTasks = @($UserTasks)
+    }
+}
+
+function Write-ActivityWatchDeploymentConfig {
+    param(
+        [Parameter(Mandatory = $true)]
+        [pscustomobject]$Config,
+        [Parameter(Mandatory = $true)]
+        [string]$Path
+    )
+
+    $directory = Split-Path -Path $Path -Parent
+    if ($directory) {
+        New-ActivityWatchDirectory -Path $directory
+    }
+
+    $json = $Config | ConvertTo-Json -Depth 8
+    Set-Content -LiteralPath $Path -Value $json -Encoding UTF8
+}
+
+function Read-ActivityWatchDeploymentConfig {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Path
+    )
+
+    if (-not (Test-Path -LiteralPath $Path)) {
+        throw "Конфигурация развёртывания не найдена: $Path"
+    }
+
+    return Get-Content -LiteralPath $Path -Raw | ConvertFrom-Json
+}
+
+function Write-ActivityWatchLaunchScript {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Path,
+        [Parameter(Mandatory = $true)]
+        [string]$ConfigPath
+    )
+
+    $content = @"
+param(
+    [string]`$ConfigPath = '$ConfigPath'
+)
+
+Set-StrictMode -Version Latest
+`$ErrorActionPreference = 'Stop'
+
+function Get-DeploymentConfig {
+    param([string]`$Path)
+    return Get-Content -LiteralPath `$Path -Raw | ConvertFrom-Json
+}
+
+function Test-ProcessInSession {
+    param(
+        [string]`$Name,
+        [int]`$SessionId
+    )
+
+    return [bool](Get-Process -Name `$Name -ErrorAction SilentlyContinue | Where-Object { `$_.SessionId -eq `$SessionId } | Select-Object -First 1)
+}
+
+function Test-CollectorRunning {
+    param(
+        [string]`$ScriptPath,
+        [int]`$SessionId
+    )
+
+    `$escapedCollector = [Regex]::Escape(`$ScriptPath)
+    `$processes = Get-CimInstance Win32_Process -ErrorAction SilentlyContinue |
+        Where-Object {
+            (`$_.Name -ieq 'powershell.exe' -or `$_.Name -ieq 'pwsh.exe') -and
+            `$_.SessionId -eq `$SessionId -and
+            `$_.CommandLine -match `$escapedCollector
+        }
+
+    return [bool](`$processes | Select-Object -First 1)
+}
+
+function Invoke-AwJsonPost {
+    param(
+        [Parameter(Mandatory = `$true)][string]`$Uri,
+        [Parameter(Mandatory = `$true)][string]`$Json
+    )
+
+    `$bytes = [Text.Encoding]::UTF8.GetBytes(`$Json)
+    Invoke-RestMethod -Method Post -Uri `$Uri -ContentType 'application/json; charset=utf-8' -Body `$bytes | Out-Null
+}
+
+function Ensure-Bucket {
+    param(
+        [string]`$BucketId,
+        [string]`$ClientName,
+        [string]`$BucketType
+    )
+
+    if (`$script:KnownBuckets.ContainsKey(`$BucketId)) {
+        return
+    }
+
+    try {
+        Invoke-RestMethod -Method Get -Uri "`$(`$script:ApiBase)/buckets/`$BucketId" | Out-Null
+        `$script:KnownBuckets[`$BucketId] = `$true
+        return
+    }
+    catch {
+    }
+
+    `$body = @{
+        client   = `$ClientName
+        type     = `$BucketType
+        hostname = `$script:Hostname
+    } | ConvertTo-Json -Compress
+
+    try {
+        Invoke-AwJsonPost -Uri "`$(`$script:ApiBase)/buckets/`$BucketId" -Json `$body
+    }
+    catch {
+        try {
+            Invoke-RestMethod -Method Get -Uri "`$(`$script:ApiBase)/buckets/`$BucketId" | Out-Null
+        }
+        catch {
+            return
+        }
+    }
+
+    `$script:KnownBuckets[`$BucketId] = `$true
+}
+
+function Send-LogonMarkerIfNeeded {
+    param(
+        [pscustomobject]`$Config,
+        [int]`$SessionId
+    )
+
+    `$sessionEvents = if (`$Config.PSObject.Properties.Name -contains 'sessionEvents') { `$Config.sessionEvents } else { `$null }
+    `$logging = if (`$Config.PSObject.Properties.Name -contains 'logging') { `$Config.logging } else { `$null }
+    `$logonEnabled = if (`$sessionEvents -and `$sessionEvents.PSObject.Properties.Name -contains 'logonEnabled') { [bool]`$sessionEvents.logonEnabled } else { `$false }
+    if (-not `$logonEnabled) {
+        return
+    }
+
+    `$bucketPrefix = if (`$sessionEvents -and `$sessionEvents.PSObject.Properties.Name -contains 'bucketPrefix' -and -not [string]::IsNullOrWhiteSpace([string]`$sessionEvents.bucketPrefix)) {
+        [string]`$sessionEvents.bucketPrefix
+    }
+    else {
+        'aw-session-events'
+    }
+
+    `$stateRoot = [string]`$Config.paths.stateRoot
+    `$markerRoots = New-Object System.Collections.Generic.List[string]
+    if (-not [string]::IsNullOrWhiteSpace(`$env:LOCALAPPDATA)) {
+        `$markerRoots.Add((Join-Path `$env:LOCALAPPDATA 'AWatch-rus\markers'))
+    }
+    if (-not [string]::IsNullOrWhiteSpace(`$stateRoot)) {
+        `$markerRoots.Add((Join-Path `$stateRoot 'markers'))
+    }
+
+    `$markerDir = `$null
+    foreach (`$candidate in `$markerRoots) {
+        try {
+            if (-not (Test-Path -LiteralPath `$candidate)) {
+                New-Item -Path `$candidate -ItemType Directory -Force | Out-Null
+            }
+
+            `$probePath = Join-Path `$candidate 'write-test.tmp'
+            Set-Content -LiteralPath `$probePath -Value 'ok' -Encoding ASCII
+            Remove-Item -LiteralPath `$probePath -Force -ErrorAction SilentlyContinue
+            `$markerDir = `$candidate
+            break
+        }
+        catch {
+        }
+    }
+
+    if (-not `$markerDir) {
+        return
+    }
+
+    `$markerFile = Join-Path `$markerDir ("logon-{0}-{1}.marker" -f `$env:USERNAME, `$SessionId)
+    if (Test-Path -LiteralPath `$markerFile) {
+        return
+    }
+
+    Set-Content -LiteralPath `$markerFile -Value ((Get-Date).ToUniversalTime().ToString('o')) -Encoding UTF8
+
+    `$bucketId = ('{0}_{1}' -f `$bucketPrefix, `$script:Hostname)
+    Ensure-Bucket -BucketId `$bucketId -ClientName 'aw-session-events' -BucketType 'aw.session.event'
+
+    `$payload = @{
+        timestamp = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss.fffZ')
+        duration  = 0
+        data      = @{
+            eventType = 'logon'
+            username  = `$env:USERNAME
+            userId    = "`$(`$env:USERDOMAIN)\`$(`$env:USERNAME)"
+            sessionId = `$SessionId
+            hostname  = `$script:Hostname
+            source    = 'launch-watchers-awatch-rus'
+        }
+    } | ConvertTo-Json -Depth 5 -Compress
+
+    try {
+        Invoke-AwJsonPost -Uri "`$(`$script:ApiBase)/buckets/`$bucketId/heartbeat?pulsetime=1" -Json `$payload
+    }
+    catch {
+        Remove-Item -LiteralPath `$markerFile -Force -ErrorAction SilentlyContinue
+        throw
+    }
+}
+
+function Start-CollectorScriptIfNeeded {
+    param(
+        [string]`$ScriptPath,
+        [string]`$ConfigPath,
+        [string]`$PowerShellExe,
+        [int]`$SessionId
+    )
+
+    if (-not (Test-Path -LiteralPath `$ScriptPath)) {
+        return
+    }
+
+    if (Test-CollectorRunning -ScriptPath `$ScriptPath -SessionId `$SessionId) {
+        return
+    }
+
+    Start-Process -FilePath `$PowerShellExe -ArgumentList @(
+        '-NoProfile',
+        '-WindowStyle', 'Hidden',
+        '-ExecutionPolicy', 'Bypass',
+        '-File', `$ScriptPath,
+        '-ConfigPath', `$ConfigPath
+    ) -WindowStyle Hidden
+}
+
+`$config = Get-DeploymentConfig -Path `$ConfigPath
+`$sessionId = (Get-Process -Id `$PID).SessionId
+`$installRoot = [string]`$config.paths.installRoot
+`$script:ApiBase = '{0}://{1}:{2}/api/0' -f [string]`$config.server.scheme, [string]`$config.server.host, [string]`$config.server.port
+`$script:Hostname = `$env:COMPUTERNAME
+`$script:KnownBuckets = @{}
+`$collectorScript = [string]`$config.paths.collectorScript
+`$endpointCollectorScript = if (`$config.paths.PSObject.Properties.Name -contains 'endpointCollectorScript') { [string]`$config.paths.endpointCollectorScript } else { '' }
+`$sessionCollectorScript = if (`$config.paths.PSObject.Properties.Name -contains 'sessionCollectorScript') { [string]`$config.paths.sessionCollectorScript } else { '' }
+`$afkExe = Join-Path `$installRoot 'aw-watcher-afk\aw-watcher-afk.exe'
+`$windowExe = Join-Path `$installRoot 'aw-watcher-window\aw-watcher-window.exe'
+`$serverArgs = @('--host', [string]`$config.server.host, '--port', [string]`$config.server.port)
+`$powershellExe = Join-Path `$env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
+`$afkEnabled = if (`$config.PSObject.Properties.Name -contains 'collectors' -and `$config.collectors.PSObject.Properties.Name -contains 'afkEnabled') { [bool]`$config.collectors.afkEnabled } else { `$true }
+`$windowEnabled = if (`$config.PSObject.Properties.Name -contains 'collectors' -and `$config.collectors.PSObject.Properties.Name -contains 'windowEnabled') { [bool]`$config.collectors.windowEnabled } else { `$true }
+
+if (`$afkEnabled -and -not (Test-Path -LiteralPath `$afkExe)) {
+    throw "Не найден aw-watcher-afk.exe: `$afkExe"
+}
+
+if (`$windowEnabled -and -not (Test-Path -LiteralPath `$windowExe)) {
+    throw "Не найден aw-watcher-window.exe: `$windowExe"
+}
+
+if (`$afkEnabled -and -not (Test-ProcessInSession -Name 'aw-watcher-afk' -SessionId `$sessionId)) {
+    Start-Process -FilePath `$afkExe -ArgumentList `$serverArgs -WindowStyle Hidden
+}
+
+if (`$windowEnabled -and -not (Test-ProcessInSession -Name 'aw-watcher-window' -SessionId `$sessionId)) {
+    Start-Process -FilePath `$windowExe -ArgumentList `$serverArgs -WindowStyle Hidden
+}
+
+try {
+    Send-LogonMarkerIfNeeded -Config `$config -SessionId `$sessionId
+}
+catch {
+}
+Start-CollectorScriptIfNeeded -ScriptPath `$collectorScript -ConfigPath `$ConfigPath -PowerShellExe `$powershellExe -SessionId `$sessionId
+Start-CollectorScriptIfNeeded -ScriptPath `$endpointCollectorScript -ConfigPath `$ConfigPath -PowerShellExe `$powershellExe -SessionId `$sessionId
+Start-CollectorScriptIfNeeded -ScriptPath `$sessionCollectorScript -ConfigPath `$ConfigPath -PowerShellExe `$powershellExe -SessionId `$sessionId
+"@
+
+    Set-Content -LiteralPath $Path -Value $content -Encoding UTF8
+}
+
+function Write-ActivityWatchRecoveryScript {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Path,
+        [Parameter(Mandatory = $true)]
+        [string]$ConfigPath
+    )
+
+    $content = @"
+param(
+    [string]`$ConfigPath = '$ConfigPath'
+)
+
+Set-StrictMode -Version Latest
+`$ErrorActionPreference = 'Continue'
+
+function Get-DeploymentConfig {
+    param([string]`$Path)
+    return Get-Content -LiteralPath `$Path -Raw | ConvertFrom-Json
+}
+
+function Get-RecoveryConfigPaths {
+    param([string]`$PrimaryConfigPath)
+
+    `$paths = New-Object System.Collections.Generic.List[string]
+    if (`$PrimaryConfigPath -and (Test-Path -LiteralPath `$PrimaryConfigPath)) {
+        `$paths.Add((Resolve-Path -LiteralPath `$PrimaryConfigPath).Path)
+    }
+
+    `$searchRoot = `$env:ProgramData
+    if (`$PrimaryConfigPath) {
+        `$stateRoot = Split-Path -Path `$PrimaryConfigPath -Parent
+        `$candidateRoot = Split-Path -Path `$stateRoot -Parent
+        if (`$candidateRoot -and (Test-Path -LiteralPath `$candidateRoot)) {
+            `$searchRoot = `$candidateRoot
+        }
+    }
+
+    if (Test-Path -LiteralPath `$searchRoot) {
+        Get-ChildItem -LiteralPath `$searchRoot -Directory -ErrorAction SilentlyContinue |
+            Where-Object { `$_.Name -like 'ActivityWatch*' } |
+            ForEach-Object {
+                `$candidate = Join-Path `$_.FullName 'deployment-config.json'
+                if (Test-Path -LiteralPath `$candidate) {
+                    `$paths.Add(`$candidate)
+                }
+            }
+    }
+
+    return @(`$paths | Sort-Object -Unique)
+}
+
+function Get-RecoveryTaskNames {
+    param([string[]]`$ConfigPaths)
+
+    `$taskNames = New-Object 'System.Collections.Generic.HashSet[string]' ([System.StringComparer]::OrdinalIgnoreCase)
+    foreach (`$candidatePath in @(`$ConfigPaths)) {
+        try {
+            `$config = Get-DeploymentConfig -Path `$candidatePath
+            foreach (`$task in @(`$config.userTasks)) {
+                `$taskName = [string]`$task.launchTaskName
+                if (-not [string]::IsNullOrWhiteSpace(`$taskName)) {
+                    [void]`$taskNames.Add(`$taskName)
+                }
+            }
+        }
+        catch {
+        }
+    }
+
+    return @(`$taskNames)
+}
+
+while (`$true) {
+    `$sleepSeconds = 180
+    try {
+        `$configPaths = Get-RecoveryConfigPaths -PrimaryConfigPath `$ConfigPath
+        foreach (`$taskName in Get-RecoveryTaskNames -ConfigPaths `$configPaths) {
+            Start-ScheduledTask -TaskName `$taskName -ErrorAction SilentlyContinue
+        }
+
+        `$config = Get-DeploymentConfig -Path `$ConfigPath
+        if (`$config -and `$config.recovery -and `$config.recovery.intervalSeconds) {
+            `$sleepSeconds = [Math]::Max([int]`$config.recovery.intervalSeconds, 30)
+        }
+    }
+    catch {
+    }
+
+    Start-Sleep -Seconds `$sleepSeconds
+}
+"@
+
+    Set-Content -LiteralPath $Path -Value $content -Encoding UTF8
+}
+
+function Get-ActivityWatchHiddenLauncherPath {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$ScriptPath
+    )
+
+    $directory = Split-Path -Path $ScriptPath -Parent
+    $baseName = [IO.Path]::GetFileNameWithoutExtension($ScriptPath)
+    return Join-Path $directory ("{0}-hidden.vbs" -f $baseName)
+}
+
+function Write-ActivityWatchHiddenPowerShellWrapper {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Path,
+        [Parameter(Mandatory = $true)]
+        [string]$ScriptPath,
+        [Parameter(Mandatory = $true)]
+        [string]$ConfigPath
+    )
+
+    $directory = Split-Path -Path $Path -Parent
+    if ($directory) {
+        New-ActivityWatchDirectory -Path $directory
+    }
+
+    $powershellExe = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
+    $escapedPowerShellExe = $powershellExe.Replace('"', '""')
+    $escapedScriptPath = $ScriptPath.Replace('"', '""')
+    $escapedConfigPath = $ConfigPath.Replace('"', '""')
+
+    $content = @"
+Set shell = CreateObject("WScript.Shell")
+shell.Run """$escapedPowerShellExe"" -NoProfile -ExecutionPolicy Bypass -File ""$escapedScriptPath"" -ConfigPath ""$escapedConfigPath""", 0, False
+"@
+
+    Set-Content -LiteralPath $Path -Value $content -Encoding ASCII
+}
+
+function Remove-LegacyActivityWatchEntries {
+    $legacyTaskNames = @(
+        'ActivityWatch Watchers',
+        'ActivityWatch Guard',
+        'ActivityWatch Heal'
+    )
+
+    foreach ($taskName in $legacyTaskNames) {
+        Unregister-ScheduledTask -TaskName $taskName -Confirm:$false -ErrorAction SilentlyContinue
+    }
+
+    $runKey = 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run'
+    foreach ($name in 'ActivityWatchAFK', 'ActivityWatchWindow', 'ActivityWatchBrowserCollector') {
+        Remove-ItemProperty -Path $runKey -Name $name -ErrorAction SilentlyContinue
+    }
+}
+
+function Remove-ActivityWatchScheduledTask {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TaskName
+    )
+
+    Unregister-ScheduledTask -TaskName $TaskName -Confirm:$false -ErrorAction SilentlyContinue
+    & cmd.exe /c "schtasks /Delete /TN `"$TaskName`" /F >nul 2>&1" | Out-Null
+
+    for ($attempt = 0; $attempt -lt 10; $attempt++) {
+        $task = Get-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue
+        if (-not $task) {
+            return
+        }
+
+        Start-Sleep -Milliseconds 300
+    }
+}
+
+function Set-ActivityWatchScheduledTaskAction {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TaskName,
+        [Parameter(Mandatory = $true)]
+        [string]$Execute,
+        [Parameter(Mandatory = $true)]
+        [string]$Arguments
+    )
+
+    $taskCommand = ('"{0}" {1}' -f $Execute, $Arguments)
+    & schtasks.exe /Change /TN $TaskName /TR $taskCommand | Out-Null
+    if ($LASTEXITCODE -ne 0) {
+        throw "schtasks.exe /Change завершился с ошибкой для $TaskName"
+    }
+}
+
+function Get-ActivityWatchScheduledTaskByCommand {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TaskName,
+        [string]$CommandMatch
+    )
+
+    $task = Get-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue
+    if ($task) {
+        return $task
+    }
+
+    if ([string]::IsNullOrWhiteSpace($CommandMatch)) {
+        return $null
+    }
+
+    foreach ($candidate in @(Get-ScheduledTask | Where-Object { $_.TaskName -like 'ActivityWatch Launch*' })) {
+        foreach ($action in @($candidate.Actions)) {
+            if ([string]$action.Arguments -like "*$CommandMatch*") {
+                return $candidate
+            }
+        }
+    }
+
+    return $null
+}
+
+function Register-ActivityWatchUserTasks {
+    param(
+        [Parameter(Mandatory = $true)]
+        [pscustomobject[]]$TaskDefinitions,
+        [Parameter(Mandatory = $true)]
+        [string]$LaunchScriptPath,
+        [Parameter(Mandatory = $true)]
+        [string]$ConfigPath
+    )
+
+    $wscriptExe = Join-Path $env:SystemRoot 'System32\wscript.exe'
+    $launcherPath = Get-ActivityWatchHiddenLauncherPath -ScriptPath $LaunchScriptPath
+    Write-ActivityWatchHiddenPowerShellWrapper -Path $launcherPath -ScriptPath $LaunchScriptPath -ConfigPath $ConfigPath
+
+    foreach ($definition in $TaskDefinitions) {
+        $action = New-ScheduledTaskAction -Execute $wscriptExe -Argument "//B //NoLogo `"$launcherPath`""
+        $trigger = New-ScheduledTaskTrigger -AtLogOn -User $definition.UserId
+        $principal = New-ScheduledTaskPrincipal -UserId $definition.UserId -LogonType Interactive -RunLevel Highest
+        $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -StartWhenAvailable -MultipleInstances IgnoreNew -ExecutionTimeLimit (New-TimeSpan -Hours 0)
+        $existingTask = Get-ActivityWatchScheduledTaskByCommand -TaskName $definition.LaunchTaskName -CommandMatch $ConfigPath
+
+        if ($existingTask) {
+            Set-ActivityWatchScheduledTaskAction -TaskName $existingTask.TaskName -Execute $wscriptExe -Arguments $action.Arguments
+            continue
+        }
+
+        Remove-ActivityWatchScheduledTask -TaskName $definition.LaunchTaskName
+        Register-ScheduledTask -TaskName $definition.LaunchTaskName -Action $action -Trigger $trigger -Principal $principal -Settings $settings | Out-Null
+    }
+}
+
+function Register-ActivityWatchRecoveryTask {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TaskName,
+        [Parameter(Mandatory = $true)]
+        [string]$RecoveryScriptPath,
+        [Parameter(Mandatory = $true)]
+        [string]$ConfigPath
+    )
+
+    Remove-ActivityWatchScheduledTask -TaskName $TaskName
+
+    $wscriptExe = Join-Path $env:SystemRoot 'System32\wscript.exe'
+    $launcherPath = Get-ActivityWatchHiddenLauncherPath -ScriptPath $RecoveryScriptPath
+    Write-ActivityWatchHiddenPowerShellWrapper -Path $launcherPath -ScriptPath $RecoveryScriptPath -ConfigPath $ConfigPath
+    $action = New-ScheduledTaskAction -Execute $wscriptExe -Argument "//B //NoLogo `"$launcherPath`""
+    $trigger = New-ScheduledTaskTrigger -AtStartup
+    $principal = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest
+    $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -StartWhenAvailable -Hidden -MultipleInstances IgnoreNew -ExecutionTimeLimit (New-TimeSpan -Hours 0)
+
+    Register-ScheduledTask -TaskName $TaskName -Action $action -Trigger $trigger -Principal $principal -Settings $settings | Out-Null
+}
+
+function Set-ActivityWatchAcl {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$InstallRoot,
+        [Parameter(Mandatory = $true)]
+        [string]$StateRoot,
+        [Parameter(Mandatory = $true)]
+        [string]$LogsRoot
+    )
+
+    foreach ($path in $InstallRoot, $StateRoot, $LogsRoot) {
+        New-ActivityWatchDirectory -Path $path
+    }
+
+    & icacls $InstallRoot /inheritance:r /grant:r '*S-1-5-18:(OI)(CI)(F)' '*S-1-5-32-544:(OI)(CI)(F)' '*S-1-5-32-545:(OI)(CI)(RX)' | Out-Null
+    if ($LASTEXITCODE -ne 0) {
+        throw "icacls завершился с ошибкой для $InstallRoot"
+    }
+
+    & icacls $StateRoot /inheritance:r /grant:r '*S-1-5-18:(OI)(CI)(F)' '*S-1-5-32-544:(OI)(CI)(F)' '*S-1-5-32-545:(OI)(CI)(RX)' | Out-Null
+    if ($LASTEXITCODE -ne 0) {
+        throw "icacls завершился с ошибкой для $StateRoot"
+    }
+
+    & icacls $LogsRoot /inheritance:r /grant:r '*S-1-5-18:(OI)(CI)(F)' '*S-1-5-32-544:(OI)(CI)(F)' '*S-1-5-32-545:(OI)(CI)(M)' | Out-Null
+    if ($LASTEXITCODE -ne 0) {
+        throw "icacls завершился с ошибкой для $LogsRoot"
+    }
+}
+
+function Start-ActivityWatchTasks {
+    param(
+        [Parameter(Mandatory = $true)]
+        [pscustomobject[]]$TaskDefinitions,
+        [string]$RecoveryTaskName = 'ActivityWatch Recovery'
+    )
+
+    foreach ($definition in $TaskDefinitions) {
+        Start-ScheduledTask -TaskName $definition.LaunchTaskName -ErrorAction SilentlyContinue
+    }
+
+    Start-ScheduledTask -TaskName $RecoveryTaskName -ErrorAction SilentlyContinue
+}
+
+Export-ModuleMember -Function *-ActivityWatch*, Assert-Administrator, Normalize-ActivityWatchUsers, Get-ActivityWatchPackageUrl, Remove-LegacyActivityWatchEntries

install-kit-awindows-20260427-211240/windows/browser-domains-native-collector.ps1

@@ -0,0 +1,822 @@
+[CmdletBinding()]
+param(
+    [string]$ConfigPath = 'C:\ProgramData\AWatch-rus\deployment-config.json',
+    [string]$ServerHost,
+    [int]$ServerPort,
+    [ValidateSet('http', 'https')]
+    [string]$ServerScheme,
+    [string]$RulesPath,
+    [string]$PolicyPath,
+    [string]$LogPath,
+    [string]$IncidentLogPath,
+    [int]$PollSeconds,
+    [int]$PulseSeconds
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+Add-Type -AssemblyName UIAutomationClient
+Add-Type -AssemblyName UIAutomationTypes
+
+Add-Type @"
+using System;
+using System.Runtime.InteropServices;
+using System.Text;
+
+public static class NativeAwMethods {
+    [DllImport("user32.dll")]
+    public static extern IntPtr GetForegroundWindow();
+
+    [DllImport("user32.dll")]
+    public static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint lpdwProcessId);
+
+    [DllImport("user32.dll", CharSet = CharSet.Unicode)]
+    public static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int nMaxCount);
+
+    [DllImport("user32.dll")]
+    public static extern int GetWindowTextLength(IntPtr hWnd);
+}
+"@
+
+function Get-DeploymentConfig {
+    param([string]$Path)
+    if ($Path -and (Test-Path -LiteralPath $Path)) {
+        return Get-Content -LiteralPath $Path -Raw | ConvertFrom-Json
+    }
+
+    return $null
+}
+
+$deploymentConfig = Get-DeploymentConfig -Path $ConfigPath
+$resolvedServerHost = if ($ServerHost) { $ServerHost } elseif ($deploymentConfig) { [string]$deploymentConfig.server.host } else { throw 'Укажите ServerHost или подготовьте deployment-config.json.' }
+$resolvedServerPort = if ($PSBoundParameters.ContainsKey('ServerPort')) { $ServerPort } elseif ($deploymentConfig) { [int]$deploymentConfig.server.port } else { 5600 }
+$resolvedServerScheme = if ($ServerScheme) { $ServerScheme } elseif ($deploymentConfig) { [string]$deploymentConfig.server.scheme } else { 'http' }
+$resolvedRulesPath = if ($RulesPath) { $RulesPath } elseif ($deploymentConfig) { [string]$deploymentConfig.paths.rulesPath } else { 'C:\ProgramData\AWatch-rus\web-category-rules.json' }
+$resolvedPolicyPath = if ($PolicyPath) { $PolicyPath } elseif ($deploymentConfig) { [string]$deploymentConfig.paths.policyPath } else { 'C:\ProgramData\AWatch-rus\dlp-policy.json' }
+$resolvedPollSeconds = if ($PSBoundParameters.ContainsKey('PollSeconds')) { $PollSeconds } elseif ($deploymentConfig) { [int]$deploymentConfig.collector.pollSeconds } else { 5 }
+$resolvedPulseSeconds = if ($PSBoundParameters.ContainsKey('PulseSeconds')) { $PulseSeconds } elseif ($deploymentConfig) { [int]$deploymentConfig.collector.pulseSeconds } else { 30 }
+$resolvedLogsRoot = if ($deploymentConfig) { [string]$deploymentConfig.paths.logsRoot } else { 'C:\ProgramData\AWatch-rus\logs' }
+$resolvedLogPath = if ($LogPath) { $LogPath } else { Join-Path $resolvedLogsRoot ("browser-domains-{0}.log" -f $env:USERNAME) }
+$resolvedIncidentLogPath = if ($IncidentLogPath) { $IncidentLogPath } else { Join-Path $resolvedLogsRoot ("dlp-incidents-{0}.log" -f $env:USERNAME) }
+$resolvedLocalAgentLogsEnabled = if ($deploymentConfig -and $deploymentConfig.PSObject.Properties.Name -contains 'logging' -and $deploymentConfig.logging.PSObject.Properties.Name -contains 'localAgentLogsEnabled') { [bool]$deploymentConfig.logging.localAgentLogsEnabled } else { $true }
+$resolvedIncidentArtifactsRoot = if ($deploymentConfig -and $deploymentConfig.PSObject.Properties.Name -contains 'incidentCapture' -and $deploymentConfig.incidentCapture.PSObject.Properties.Name -contains 'artifactsRoot') { [string]$deploymentConfig.incidentCapture.artifactsRoot } else { Join-Path $env:LOCALAPPDATA 'AWatch-rus\\incident-artifacts' }
+$resolvedIncidentScreenshotEnabled = if ($deploymentConfig -and $deploymentConfig.PSObject.Properties.Name -contains 'incidentCapture' -and $deploymentConfig.incidentCapture.PSObject.Properties.Name -contains 'screenshotEnabled') { [bool]$deploymentConfig.incidentCapture.screenshotEnabled } else { $true }
+
+if ($resolvedLocalAgentLogsEnabled -and -not (Test-Path -LiteralPath $resolvedLogsRoot)) {
+    New-Item -Path $resolvedLogsRoot -ItemType Directory -Force | Out-Null
+}
+
+$script:ApiBase = '{0}://{1}:{2}/api/0' -f $resolvedServerScheme, $resolvedServerHost, $resolvedServerPort
+$script:Hostname = $env:COMPUTERNAME
+$script:SessionId = (Get-Process -Id $PID).SessionId
+$script:KnownBuckets = @{}
+$script:LocalAgentLogsEnabled = $resolvedLocalAgentLogsEnabled
+$script:LogPath = $resolvedLogPath
+$script:IncidentLogPath = $resolvedIncidentLogPath
+$script:IncidentArtifactsRoot = $resolvedIncidentArtifactsRoot
+$script:IncidentScreenshotEnabled = $resolvedIncidentScreenshotEnabled
+$script:ScreenshotTypesLoaded = $false
+$script:IncidentState = @{}
+$script:DlpRules = @()
+$script:DlpDefaults = [ordered]@{
+    enabled = $false
+    cooldownSeconds = 300
+    action = 'log'
+    severity = 'low'
+}
+$script:BrowserMap = @{
+    msedge  = 'edge'
+    chrome  = 'chrome'
+    brave   = 'brave'
+    vivaldi = 'vivaldi'
+    opera   = 'opera'
+    firefox = 'firefox'
+}
+$script:CategoryRules = @(
+    @{ Name = 'work_business_systems'; Group = 'work'; Domains = @('bitrix24.ru', '1c.ru', 'sbis.ru', 'kontur.ru', 'diadoc.ru', 'nalog.gov.ru', 'gosuslugi.ru') }
+    @{ Name = 'work_docs_collab'; Group = 'work'; Domains = @('office.com', 'sharepoint.com', 'docs.google.com', 'drive.google.com', 'notion.so', 'miro.com') }
+    @{ Name = 'work_dev'; Group = 'work'; Domains = @('github.com', 'gitlab.com', 'bitbucket.org', 'youtrack.cloud', 'atlassian.net') }
+    @{ Name = 'work_communication'; Group = 'work'; Domains = @('teams.microsoft.com', 'outlook.office.com', 'web.telegram.org', 'slack.com', 'zoom.us') }
+    @{ Name = 'neutral_search_reference'; Group = 'neutral'; Domains = @('google.com', 'google.ru', 'yandex.ru', 'bing.com', 'duckduckgo.com', 'wikipedia.org') }
+    @{ Name = 'neutral_news'; Group = 'neutral'; Domains = @('rbc.ru', 'tass.ru', 'ria.ru', 'kommersant.ru', 'vedomosti.ru') }
+    @{ Name = 'personal_social'; Group = 'personal'; Domains = @('vk.com', 'ok.ru', 'facebook.com', 'instagram.com', 'tiktok.com', 'x.com', 'twitter.com') }
+    @{ Name = 'personal_video'; Group = 'personal'; Domains = @('youtube.com', 'youtu.be', 'rutube.ru', 'twitch.tv', 'kinopoisk.ru') }
+    @{ Name = 'personal_marketplace'; Group = 'personal'; Domains = @('ozon.ru', 'wildberries.ru', 'avito.ru', 'aliexpress.com', 'market.yandex.ru') }
+    @{ Name = 'personal_entertainment'; Group = 'personal'; Domains = @('dzen.ru', 'pikabu.ru', 'dtf.ru', 'playground.ru') }
+)
+
+function Write-CollectorLog {
+    param([string]$Message)
+
+    if (-not $script:LocalAgentLogsEnabled) {
+        return
+    }
+
+    try {
+        Add-Content -LiteralPath $script:LogPath -Value ('{0} {1}' -f (Get-Date -Format s), $Message)
+    }
+    catch {
+    }
+}
+
+function Write-DlpIncidentLog {
+    param([string]$Message)
+
+    if (-not $script:LocalAgentLogsEnabled) {
+        return
+    }
+
+    try {
+        Add-Content -LiteralPath $script:IncidentLogPath -Value ('{0} {1}' -f (Get-Date -Format s), $Message)
+    }
+    catch {
+    }
+}
+
+function Test-DomainMatch {
+    param(
+        [string]$DomainHost,
+        [string]$RuleDomain
+    )
+
+    if ([string]::IsNullOrWhiteSpace($DomainHost) -or [string]::IsNullOrWhiteSpace($RuleDomain)) {
+        return $false
+    }
+
+    $left = $DomainHost.ToLowerInvariant()
+    $right = $RuleDomain.ToLowerInvariant()
+    return $left -eq $right -or $left.EndsWith('.' + $right)
+}
+
+function Get-HostFromUrl {
+    param([string]$Url)
+
+    if ([string]::IsNullOrWhiteSpace($Url)) {
+        return $null
+    }
+
+    try {
+        $uri = [Uri]$Url
+        $uriHost = $uri.Host.ToLowerInvariant()
+        if ($uriHost.StartsWith('www.')) {
+            return $uriHost.Substring(4)
+        }
+
+        return $uriHost
+    }
+    catch {
+        return $null
+    }
+}
+
+function Get-RootDomain {
+    param([string]$DomainHost)
+
+    if ([string]::IsNullOrWhiteSpace($DomainHost)) {
+        return $null
+    }
+
+    $parts = $DomainHost.Split('.')
+    if ($parts.Count -le 2) {
+        return $DomainHost
+    }
+
+    $suffix = ('{0}.{1}' -f $parts[$parts.Count - 2], $parts[$parts.Count - 1]).ToLowerInvariant()
+    $compoundTlds = @('co.uk', 'com.au', 'co.jp', 'com.br', 'co.in', 'com.tr', 'com.cn')
+    if (($compoundTlds -contains $suffix) -and $parts.Count -ge 3) {
+        return ('{0}.{1}' -f $parts[$parts.Count - 3], $suffix).ToLowerInvariant()
+    }
+
+    return $suffix
+}
+
+function ConvertTo-NormalizedUrl {
+    param([AllowNull()][string]$Value)
+
+    if ([string]::IsNullOrWhiteSpace($Value)) {
+        return $null
+    }
+
+    $candidate = $Value.Trim()
+    if ($candidate.Length -lt 4) {
+        return $null
+    }
+
+    if ($candidate -match '^(?i)(search|find|address and search|search with|новая вкладка|new tab)') {
+        return $null
+    }
+
+    if ($candidate -match '^(?i)(https?|file|ftp|chrome|edge|about|view-source)://') {
+        return $candidate
+    }
+
+    if ($candidate -match '^(?i)localhost([/:]|$)') {
+        return "http://$candidate"
+    }
+
+    if ($candidate -match '^[a-z0-9.-]+\.[a-z]{2,}([/:?#].*)?$') {
+        return "https://$candidate"
+    }
+
+    return $null
+}
+
+function Load-CustomCategoryRules {
+    param([string]$Path)
+
+    if (-not $Path -or -not (Test-Path -LiteralPath $Path)) {
+        return
+    }
+
+    try {
+        $parsed = Get-Content -LiteralPath $Path -Raw | ConvertFrom-Json
+        $rules = @()
+
+        if ($parsed.rules) {
+            $sourceRules = @($parsed.rules)
+        }
+        elseif ($parsed -is [System.Collections.IEnumerable]) {
+            $sourceRules = @($parsed)
+        }
+        else {
+            $sourceRules = @()
+        }
+
+        foreach ($rule in $sourceRules) {
+            if (-not $rule) {
+                continue
+            }
+
+            $name = [string]$rule.name
+            $group = [string]$rule.group
+            $domains = @($rule.domains | ForEach-Object { ([string]$_).Trim().ToLowerInvariant() } | Where-Object { $_ })
+
+            if ($name -and $group -and $domains.Count -gt 0) {
+                $rules += @{
+                    Name    = $name
+                    Group   = $group
+                    Domains = $domains
+                }
+            }
+        }
+
+        if ($rules.Count -gt 0) {
+            $script:CategoryRules = @($rules) + @($script:CategoryRules)
+            Write-CollectorLog ("пользовательские правила загружены: {0}" -f $rules.Count)
+        }
+    }
+    catch {
+        Write-CollectorLog ("не удалось загрузить пользовательские правила: {0}" -f $_.Exception.Message)
+    }
+}
+
+function Get-WebCategory {
+    param([string]$DomainHost)
+
+    foreach ($rule in $script:CategoryRules) {
+        foreach ($domain in $rule.Domains) {
+            if (Test-DomainMatch -DomainHost $DomainHost -RuleDomain $domain) {
+                return [pscustomobject]@{
+                    Name  = [string]$rule.Name
+                    Group = [string]$rule.Group
+                    Rule  = [string]$domain
+                }
+            }
+        }
+    }
+
+    return [pscustomobject]@{
+        Name  = 'uncategorized'
+        Group = 'neutral'
+        Rule  = 'none'
+    }
+}
+
+function Test-DomainListMatch {
+    param(
+        [string]$DomainHost,
+        [string[]]$Domains
+    )
+
+    if (-not $Domains -or $Domains.Count -eq 0) {
+        return $false
+    }
+
+    foreach ($domain in $Domains) {
+        if (Test-DomainMatch -DomainHost $DomainHost -RuleDomain $domain) {
+            return $true
+        }
+    }
+
+    return $false
+}
+
+function Test-DlpRuleTimeWindow {
+    param(
+        [int]$CurrentHour,
+        [AllowNull()][int]$HourFrom,
+        [AllowNull()][int]$HourTo
+    )
+
+    if ($null -eq $HourFrom -or $null -eq $HourTo) {
+        return $true
+    }
+
+    if ($HourFrom -eq $HourTo) {
+        return $true
+    }
+
+    if ($HourFrom -lt $HourTo) {
+        return ($CurrentHour -ge $HourFrom -and $CurrentHour -lt $HourTo)
+    }
+
+    return ($CurrentHour -ge $HourFrom -or $CurrentHour -lt $HourTo)
+}
+
+function Load-DlpPolicy {
+    param([string]$Path)
+
+    if (-not $Path -or -not (Test-Path -LiteralPath $Path)) {
+        Write-CollectorLog ("DLP-политика не найдена, DLP отключен: {0}" -f $Path)
+        return
+    }
+
+    try {
+        $parsed = Get-Content -LiteralPath $Path -Raw | ConvertFrom-Json
+        $defaults = $parsed.defaults
+        if ($defaults) {
+            if ($defaults.PSObject.Properties.Name -contains 'enabled') {
+                $script:DlpDefaults.enabled = [bool]$defaults.enabled
+            }
+            if ($defaults.cooldownSeconds) {
+                $script:DlpDefaults.cooldownSeconds = [int]$defaults.cooldownSeconds
+            }
+            if ($defaults.action) {
+                $script:DlpDefaults.action = [string]$defaults.action
+            }
+            if ($defaults.severity) {
+                $script:DlpDefaults.severity = [string]$defaults.severity
+            }
+        }
+
+        $loaded = @()
+        foreach ($rule in @($parsed.rules)) {
+            if (-not $rule) { continue }
+            $when = $rule.when
+            if (-not $when) {
+                $when = [pscustomobject]@{}
+            }
+            $loaded += [pscustomobject]@{
+                id = [string]$rule.id
+                enabled = if ($rule.PSObject.Properties.Name -contains 'enabled') { [bool]$rule.enabled } else { $true }
+                action = if ($rule.action) { [string]$rule.action } else { [string]$script:DlpDefaults.action }
+                severity = if ($rule.severity) { [string]$rule.severity } else { [string]$script:DlpDefaults.severity }
+                message = if ($rule.message) { [string]$rule.message } else { "Сработало DLP-правило: $($rule.id)" }
+                cooldownSeconds = if ($rule.cooldownSeconds) { [int]$rule.cooldownSeconds } else { [int]$script:DlpDefaults.cooldownSeconds }
+                when = [pscustomobject]@{
+                    domains = if ($when.PSObject.Properties.Name -contains 'domains') { @($when.domains | ForEach-Object { ([string]$_).Trim().ToLowerInvariant() } | Where-Object { $_ }) } else { @() }
+                    categoryGroups = if ($when.PSObject.Properties.Name -contains 'categoryGroups') { @($when.categoryGroups | ForEach-Object { ([string]$_).Trim().ToLowerInvariant() } | Where-Object { $_ }) } else { @() }
+                    categories = if ($when.PSObject.Properties.Name -contains 'categories') { @($when.categories | ForEach-Object { ([string]$_).Trim().ToLowerInvariant() } | Where-Object { $_ }) } else { @() }
+                    browsers = if ($when.PSObject.Properties.Name -contains 'browsers') { @($when.browsers | ForEach-Object { ([string]$_).Trim().ToLowerInvariant() } | Where-Object { $_ }) } else { @() }
+                    urlRegex = if ($when.PSObject.Properties.Name -contains 'urlRegex' -and $when.urlRegex) { [string]$when.urlRegex } else { $null }
+                    titleRegex = if ($when.PSObject.Properties.Name -contains 'titleRegex' -and $when.titleRegex) { [string]$when.titleRegex } else { $null }
+                    hourFrom = if ($when.PSObject.Properties.Name -contains 'hourFrom') { [int]$when.hourFrom } else { $null }
+                    hourTo = if ($when.PSObject.Properties.Name -contains 'hourTo') { [int]$when.hourTo } else { $null }
+                }
+            }
+        }
+
+        $script:DlpRules = @($loaded)
+        Write-CollectorLog ("DLP-политика загружена: включена={0}, правил={1}" -f $script:DlpDefaults.enabled, $script:DlpRules.Count)
+    }
+    catch {
+        Write-CollectorLog ("не удалось разобрать DLP-политику: {0}" -f $_.Exception.Message)
+    }
+}
+
+function Test-DlpRuleMatch {
+    param(
+        [pscustomobject]$Rule,
+        [string]$Domain,
+        [string]$RootDomain,
+        [string]$Url,
+        [string]$Title,
+        [string]$BrowserKey,
+        [string]$Category,
+        [string]$CategoryGroup
+    )
+
+    if (-not $Rule.enabled) {
+        return $false
+    }
+
+    $when = $Rule.when
+    $currentHour = (Get-Date).Hour
+    if (-not (Test-DlpRuleTimeWindow -CurrentHour $currentHour -HourFrom $when.hourFrom -HourTo $when.hourTo)) {
+        return $false
+    }
+
+    if ($when.domains.Count -gt 0) {
+        $domainMatched = (Test-DomainListMatch -DomainHost $Domain -Domains $when.domains) -or (Test-DomainListMatch -DomainHost $RootDomain -Domains $when.domains)
+        if (-not $domainMatched) {
+            return $false
+        }
+    }
+
+    if ($when.categoryGroups.Count -gt 0 -and ($when.categoryGroups -notcontains $CategoryGroup.ToLowerInvariant())) {
+        return $false
+    }
+
+    if ($when.categories.Count -gt 0 -and ($when.categories -notcontains $Category.ToLowerInvariant())) {
+        return $false
+    }
+
+    if ($when.browsers.Count -gt 0 -and ($when.browsers -notcontains $BrowserKey.ToLowerInvariant())) {
+        return $false
+    }
+
+    if ($when.urlRegex) {
+        if (-not ($Url -match $when.urlRegex)) {
+            return $false
+        }
+    }
+
+    if ($when.titleRegex) {
+        if (-not ($Title -match $when.titleRegex)) {
+            return $false
+        }
+    }
+
+    return $true
+}
+
+function Get-DlpDecision {
+    param(
+        [string]$Domain,
+        [string]$RootDomain,
+        [string]$Url,
+        [string]$Title,
+        [string]$BrowserKey,
+        [string]$Category,
+        [string]$CategoryGroup
+    )
+
+    if (-not $script:DlpDefaults.enabled) {
+        return $null
+    }
+
+    foreach ($rule in $script:DlpRules) {
+        if (Test-DlpRuleMatch -Rule $rule -Domain $Domain -RootDomain $RootDomain -Url $Url -Title $Title -BrowserKey $BrowserKey -Category $Category -CategoryGroup $CategoryGroup) {
+            return $rule
+        }
+    }
+
+    return $null
+}
+
+function Should-EmitIncident {
+    param(
+        [string]$Fingerprint,
+        [int]$CooldownSeconds
+    )
+
+    $now = (Get-Date).ToUniversalTime()
+    if ($script:IncidentState.ContainsKey($Fingerprint)) {
+        $last = [datetime]$script:IncidentState[$Fingerprint]
+        if ((New-TimeSpan -Start $last -End $now).TotalSeconds -lt $CooldownSeconds) {
+            return $false
+        }
+    }
+
+    $script:IncidentState[$Fingerprint] = $now
+    return $true
+}
+
+function Send-DlpIncidentHeartbeat {
+    param(
+        [pscustomobject]$Decision,
+        [string]$Url,
+        [string]$Title,
+        [string]$BrowserKey,
+        [string]$ProcessName,
+        [string]$Domain,
+        [string]$RootDomain,
+        [string]$Category,
+        [string]$CategoryGroup
+    )
+
+    $bucketId = 'aw-dlp-incidents_' + $script:Hostname
+    Ensure-Bucket -BucketId $bucketId -ClientName 'aw-dlp-incidents' -BucketType 'aw.dlp.incident'
+
+    $captureData = @{}
+    if ($script:IncidentScreenshotEnabled) {
+        try {
+            $captureData = Capture-IncidentScreenshot -RuleId ([string]$Decision.id) -SignalType 'web'
+        }
+        catch {
+        }
+    }
+
+    $event = @{
+        timestamp = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss.fffZ')
+        duration  = 0
+        data      = @{
+            ruleId         = [string]$Decision.id
+            action         = [string]$Decision.action
+            severity       = [string]$Decision.severity
+            message        = [string]$Decision.message
+            url            = $Url
+            title          = $Title
+            browser        = $BrowserKey
+            app            = "$ProcessName.exe"
+            domain         = $Domain
+            rootDomain     = $RootDomain
+            category       = $Category
+            categoryGroup  = $CategoryGroup
+            username       = $env:USERNAME
+            hostname       = $script:Hostname
+            sessionId      = $script:SessionId
+            source         = 'uia-native-dlp'
+        } + $captureData
+    } | ConvertTo-Json -Depth 5 -Compress
+
+    Invoke-RestMethod -Method Post -Uri "$($script:ApiBase)/buckets/$bucketId/heartbeat?pulsetime=$resolvedPulseSeconds" -ContentType 'application/json' -Body $event | Out-Null
+}
+
+function Get-FileSha256Hex {
+    param([Parameter(Mandatory = $true)][string]$Path)
+    try {
+        $sha = [Security.Cryptography.SHA256]::Create()
+        $stream = [IO.File]::OpenRead($Path)
+        try {
+            ($sha.ComputeHash($stream) | ForEach-Object { $_.ToString('x2') }) -join ''
+        }
+        finally {
+            $stream.Dispose()
+            $sha.Dispose()
+        }
+    }
+    catch {
+        return $null
+    }
+}
+
+function Ensure-Directory {
+    param([Parameter(Mandatory = $true)][string]$Path)
+    if (-not (Test-Path -LiteralPath $Path)) {
+        New-Item -Path $Path -ItemType Directory -Force | Out-Null
+    }
+}
+
+function Get-IncidentScreenshotPath {
+    param(
+        [Parameter(Mandatory = $true)][string]$RuleId,
+        [Parameter(Mandatory = $true)][string]$SignalType
+    )
+
+    $safeUser = ($env:USERNAME -replace '[^A-Za-z0-9_.-]', '_')
+    $safeRule = ($RuleId -replace '[^A-Za-z0-9_.-]', '_')
+    $safeType = ($SignalType -replace '[^A-Za-z0-9_.-]', '_')
+    $stamp = (Get-Date).ToUniversalTime().ToString('yyyyMMdd_HHmmss_fff')
+    $file = '{0}_{1}_sid{2}_{3}_{4}.png' -f $script:Hostname, $safeUser, $script:SessionId, $safeType, $safeRule
+    $file = '{0}_{1}' -f $stamp, $file
+    return (Join-Path $script:IncidentArtifactsRoot $file)
+}
+
+function Ensure-ScreenshotTypesLoaded {
+    if ($script:ScreenshotTypesLoaded) {
+        return
+    }
+    Add-Type -AssemblyName System.Windows.Forms | Out-Null
+    Add-Type -AssemblyName System.Drawing | Out-Null
+    $script:ScreenshotTypesLoaded = $true
+}
+
+function Capture-IncidentScreenshot {
+    param(
+        [Parameter(Mandatory = $true)][string]$RuleId,
+        [Parameter(Mandatory = $true)][string]$SignalType
+    )
+
+    try {
+        Ensure-Directory -Path $script:IncidentArtifactsRoot
+        Ensure-ScreenshotTypesLoaded
+
+        $vs = [System.Windows.Forms.SystemInformation]::VirtualScreen
+        $bmp = New-Object System.Drawing.Bitmap ([int]$vs.Width), ([int]$vs.Height)
+        $gfx = [System.Drawing.Graphics]::FromImage($bmp)
+        try {
+            $gfx.CopyFromScreen([int]$vs.Left, [int]$vs.Top, 0, 0, $bmp.Size)
+            $path = Get-IncidentScreenshotPath -RuleId $RuleId -SignalType $SignalType
+            $bmp.Save($path, [System.Drawing.Imaging.ImageFormat]::Png)
+        }
+        finally {
+            $gfx.Dispose()
+            $bmp.Dispose()
+        }
+
+        return @{
+            screenshotPath   = $path
+            screenshotFormat = 'png'
+            screenshotWidth  = [int]$vs.Width
+            screenshotHeight = [int]$vs.Height
+            screenshotSha256 = (Get-FileSha256Hex -Path $path)
+        }
+    }
+    catch {
+        Write-CollectorLog ("не удалось сделать снимок инцидента: {0}" -f $_.Exception.Message)
+        return @{}
+    }
+}
+
+function Get-ForegroundWindowContext {
+    $handle = [NativeAwMethods]::GetForegroundWindow()
+    if ($handle -eq [IntPtr]::Zero) {
+        return $null
+    }
+
+    $processId = [uint32]0
+    [void][NativeAwMethods]::GetWindowThreadProcessId($handle, [ref]$processId)
+    if (-not $processId) {
+        return $null
+    }
+
+    $process = Get-Process -Id ([int]$processId) -ErrorAction SilentlyContinue
+    if (-not $process) {
+        return $null
+    }
+
+    $textLength = [NativeAwMethods]::GetWindowTextLength($handle)
+    $builder = [Text.StringBuilder]::new([Math]::Max($textLength + 1, 260))
+    [void][NativeAwMethods]::GetWindowText($handle, $builder, $builder.Capacity)
+
+    return [pscustomobject]@{
+        Handle      = $handle
+        ProcessName = $process.ProcessName.ToLowerInvariant()
+        Title       = $builder.ToString()
+    }
+}
+
+function Get-BrowserUrlFromWindow {
+    param([IntPtr]$Handle)
+
+    $root = [System.Windows.Automation.AutomationElement]::FromHandle($Handle)
+    if (-not $root) {
+        return $null
+    }
+
+    $editCondition = [System.Windows.Automation.PropertyCondition]::new(
+        [System.Windows.Automation.AutomationElement]::ControlTypeProperty,
+        [System.Windows.Automation.ControlType]::Edit
+    )
+
+    $edits = $root.FindAll([System.Windows.Automation.TreeScope]::Descendants, $editCondition)
+    foreach ($edit in $edits) {
+        $valuePattern = $null
+        if ($edit.TryGetCurrentPattern([System.Windows.Automation.ValuePattern]::Pattern, [ref]$valuePattern)) {
+            $candidate = ConvertTo-NormalizedUrl -Value $valuePattern.Current.Value
+            if ($candidate) {
+                return $candidate
+            }
+        }
+
+        $candidateFromName = ConvertTo-NormalizedUrl -Value $edit.Current.Name
+        if ($candidateFromName) {
+            return $candidateFromName
+        }
+    }
+
+    return $null
+}
+
+function Ensure-Bucket {
+    param(
+        [string]$BucketId,
+        [string]$ClientName,
+        [string]$BucketType = 'web.tab.current'
+    )
+
+    if ($script:KnownBuckets.ContainsKey($BucketId)) {
+        return
+    }
+
+    $body = @{
+        client   = $ClientName
+        type     = $BucketType
+        hostname = $script:Hostname
+    } | ConvertTo-Json -Compress
+
+    Invoke-RestMethod -Method Post -Uri "$($script:ApiBase)/buckets/$BucketId" -ContentType 'application/json' -Body $body | Out-Null
+    $script:KnownBuckets[$BucketId] = $true
+}
+
+function Send-Heartbeat {
+    param(
+        [string]$BucketId,
+        [string]$Url,
+        [string]$Title,
+        [string]$BrowserKey,
+        [string]$ProcessName
+    )
+
+    $event = @{
+        timestamp = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss.fffZ')
+        duration  = 0
+        data      = @{
+            url       = $Url
+            title     = $Title
+            browser   = $BrowserKey
+            app       = "$ProcessName.exe"
+            source    = 'uia-native'
+            sessionId = $script:SessionId
+        }
+    } | ConvertTo-Json -Depth 4 -Compress
+
+    Invoke-RestMethod -Method Post -Uri "$($script:ApiBase)/buckets/$BucketId/heartbeat?pulsetime=$resolvedPulseSeconds" -ContentType 'application/json' -Body $event | Out-Null
+}
+
+function Send-CategoryHeartbeat {
+    param(
+        [string]$Url,
+        [string]$Title,
+        [string]$BrowserKey,
+        [string]$ProcessName,
+        [string]$Domain,
+        [string]$RootDomain,
+        [string]$Category,
+        [string]$CategoryGroup,
+        [string]$CategoryRule
+    )
+
+    $bucketId = 'aw-detmir-web-category_' + $script:Hostname
+    Ensure-Bucket -BucketId $bucketId -ClientName 'aw-detmir-web-category' -BucketType 'aw.web.category'
+
+    $event = @{
+        timestamp = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss.fffZ')
+        duration  = 0
+        data      = @{
+            url           = $Url
+            title         = $Title
+            browser       = $BrowserKey
+            app           = "$ProcessName.exe"
+            domain        = $Domain
+            rootDomain    = $RootDomain
+            category      = $Category
+            categoryGroup = $CategoryGroup
+            categoryRule  = $CategoryRule
+            source        = 'uia-native'
+            sessionId     = $script:SessionId
+        }
+    } | ConvertTo-Json -Depth 4 -Compress
+
+    Invoke-RestMethod -Method Post -Uri "$($script:ApiBase)/buckets/$bucketId/heartbeat?pulsetime=$resolvedPulseSeconds" -ContentType 'application/json' -Body $event | Out-Null
+}
+
+Load-CustomCategoryRules -Path $resolvedRulesPath
+Load-DlpPolicy -Path $resolvedPolicyPath
+Write-CollectorLog ("коллектор запущен для {0}" -f $script:ApiBase)
+
+while ($true) {
+    try {
+        $context = Get-ForegroundWindowContext
+        if ($context -and $script:BrowserMap.ContainsKey($context.ProcessName)) {
+            $url = Get-BrowserUrlFromWindow -Handle $context.Handle
+            if ($url) {
+                $browserKey = $script:BrowserMap[$context.ProcessName]
+                $domain = Get-HostFromUrl -Url $url
+                if (-not $domain) {
+                    $domain = 'unknown'
+                }
+
+                $rootDomain = Get-RootDomain -DomainHost $domain
+                if (-not $rootDomain) {
+                    $rootDomain = $domain
+                }
+
+                $category = Get-WebCategory -DomainHost $domain
+                $bucketId = 'aw-watcher-web-{0}_{1}' -f $browserKey, $script:Hostname
+                Ensure-Bucket -BucketId $bucketId -ClientName ('aw-watcher-web-' + $browserKey)
+                Send-Heartbeat -BucketId $bucketId -Url $url -Title $context.Title -BrowserKey $browserKey -ProcessName $context.ProcessName
+                Send-CategoryHeartbeat -Url $url -Title $context.Title -BrowserKey $browserKey -ProcessName $context.ProcessName -Domain $domain -RootDomain $rootDomain -Category $category.Name -CategoryGroup $category.Group -CategoryRule $category.Rule
+
+                $decision = Get-DlpDecision -Domain $domain -RootDomain $rootDomain -Url $url -Title $context.Title -BrowserKey $browserKey -Category $category.Name -CategoryGroup $category.Group
+                if ($decision) {
+                    $fingerprint = '{0}|{1}|{2}|{3}' -f $decision.id, $browserKey, $rootDomain, $env:USERNAME
+                    $cooldown = [Math]::Max([int]$decision.cooldownSeconds, 30)
+                    if (Should-EmitIncident -Fingerprint $fingerprint -CooldownSeconds $cooldown) {
+                        Write-DlpIncidentLog ("{0} {1} {2} {3}" -f $decision.severity, $decision.action, $decision.id, $url)
+                        if (@('alert', 'block', 'quarantine') -contains ([string]$decision.action).ToLowerInvariant()) {
+                            Send-DlpIncidentHeartbeat -Decision $decision -Url $url -Title $context.Title -BrowserKey $browserKey -ProcessName $context.ProcessName -Domain $domain -RootDomain $rootDomain -Category $category.Name -CategoryGroup $category.Group
+                        }
+                    }
+                }
+            }
+        }
+    }
+    catch {
+        Write-CollectorLog ("ошибка коллектора: {0}" -f $_.Exception.Message)
+    }
+
+    Start-Sleep -Seconds $resolvedPollSeconds
+}

install-kit-awindows-20260427-211240/windows/deploy-domain-users.ps1

@@ -0,0 +1,110 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $true)]
+    [string]$ServerHost,
+    [string[]]$Users,
+    [string]$UserListPath,
+    [string]$Domain,
+    [int]$ServerPort = 5600,
+    [ValidateSet('http', 'https')]
+    [string]$ServerScheme = 'http',
+    [string]$Version = 'v0.13.2',
+    [string]$PackageUrl,
+    [string]$PackageZipPath,
+    [string]$InstallRoot = 'C:\Program Files\AWatch-rus\bin',
+    [string]$StateRoot = 'C:\ProgramData\AWatch-rus',
+    [int]$PollSeconds = 5,
+    [int]$PulseSeconds = 30,
+    [int]$RecoveryIntervalSeconds = 180,
+    [bool]$AfkEnabled = $true,
+    [bool]$WindowEnabled = $true,
+    [bool]$LocalAgentLogsEnabled = $false,
+    [bool]$IncidentCaptureEnabled = $true,
+    [bool]$IncidentScreenshotEnabled = $true,
+    [string]$IncidentArtifactsRoot,
+    [bool]$LogonMarkerEnabled = $true,
+    [string]$CustomRulesPath,
+    [string]$CustomPolicyPath
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+$modulePath = Join-Path $PSScriptRoot 'ActivityWatch.Windows.Common.psm1'
+Import-Module $modulePath -Force
+
+Assert-Administrator
+
+$targetUsers = Normalize-ActivityWatchUsers -Users $Users -UserListPath $UserListPath -Domain $Domain
+$workingRoot = Join-Path $env:TEMP 'activitywatch-windows-deploy'
+$backupRoot = Join-Path $StateRoot 'backups'
+$logsRoot = Join-Path $StateRoot 'logs'
+$configPath = Join-Path $StateRoot 'deployment-config.json'
+$launchScriptPath = Join-Path $StateRoot 'launch-watchers.ps1'
+$recoveryScriptPath = Join-Path $StateRoot 'recovery-loop.ps1'
+$collectorSource = Join-Path $PSScriptRoot 'browser-domains-native-collector.ps1'
+$endpointCollectorSource = Join-Path $PSScriptRoot 'dlp-endpoint-signals-collector.ps1'
+$sessionCollectorSource = Join-Path $PSScriptRoot 'worktime-session-collector.ps1'
+$exampleRulesSource = Join-Path $PSScriptRoot 'web-category-rules.example.json'
+$examplePolicySource = Join-Path $PSScriptRoot 'dlp-policy.example.json'
+
+New-ActivityWatchDirectory -Path $StateRoot
+New-ActivityWatchDirectory -Path $logsRoot
+
+$archivePath = Get-ActivityWatchArchive -PackageZipPath $PackageZipPath -PackageUrl $PackageUrl -Version $Version -WorkingRoot $workingRoot
+Install-ActivityWatchPackage -ArchivePath $archivePath -InstallRoot $InstallRoot -WorkingRoot $workingRoot -BackupRoot $backupRoot | Out-Null
+Get-ActivityWatchExecutableMap -InstallRoot $InstallRoot | Out-Null
+
+$assetResult = Copy-ActivityWatchCollectorAssets `
+    -CollectorScriptSource $collectorSource `
+    -EndpointCollectorScriptSource $endpointCollectorSource `
+    -SessionCollectorScriptSource $sessionCollectorSource `
+    -ExampleRulesSource $exampleRulesSource `
+    -ExamplePolicySource $examplePolicySource `
+    -StateRoot $StateRoot `
+    -CustomRulesSource $CustomRulesPath `
+    -CustomPolicySource $CustomPolicyPath
+$taskDefinitions = New-ActivityWatchUserTaskDefinitions -Users $targetUsers
+
+Write-ActivityWatchLaunchScript -Path $launchScriptPath -ConfigPath $configPath
+Write-ActivityWatchRecoveryScript -Path $recoveryScriptPath -ConfigPath $configPath
+
+$config = New-ActivityWatchDeploymentConfig `
+    -ServerHost $ServerHost `
+    -ServerPort $ServerPort `
+    -ServerScheme $ServerScheme `
+    -InstallRoot $InstallRoot `
+    -StateRoot $StateRoot `
+    -LogsRoot $logsRoot `
+    -CollectorScript $assetResult.CollectorScript `
+    -EndpointCollectorScript $assetResult.EndpointCollectorScript `
+    -SessionCollectorScript $assetResult.SessionCollectorScript `
+    -RulesPath $assetResult.ActiveRules `
+    -PolicyPath $assetResult.ActivePolicy `
+    -PollSeconds $PollSeconds `
+    -PulseSeconds $PulseSeconds `
+    -RecoveryIntervalSeconds $RecoveryIntervalSeconds `
+    -AfkEnabled $AfkEnabled `
+    -WindowEnabled $WindowEnabled `
+    -LocalAgentLogsEnabled $LocalAgentLogsEnabled `
+    -IncidentCaptureEnabled $IncidentCaptureEnabled `
+    -IncidentScreenshotEnabled $IncidentScreenshotEnabled `
+    -IncidentArtifactsRoot $IncidentArtifactsRoot `
+    -LogonMarkerEnabled $LogonMarkerEnabled `
+    -LaunchScriptPath $launchScriptPath `
+    -RecoveryScriptPath $recoveryScriptPath `
+    -UserTasks $taskDefinitions `
+    -PackageVersion $Version
+
+Write-ActivityWatchDeploymentConfig -Config $config -Path $configPath
+Remove-LegacyActivityWatchEntries
+Set-ActivityWatchAcl -InstallRoot $InstallRoot -StateRoot $StateRoot -LogsRoot $logsRoot
+Register-ActivityWatchUserTasks -TaskDefinitions $taskDefinitions -LaunchScriptPath $launchScriptPath -ConfigPath $configPath
+Register-ActivityWatchRecoveryTask -TaskName $config.recovery.taskName -RecoveryScriptPath $recoveryScriptPath -ConfigPath $configPath
+Start-ActivityWatchTasks -TaskDefinitions $taskDefinitions -RecoveryTaskName $config.recovery.taskName
+
+Write-Host 'ActivityWatch развёрнут для пользователей:'
+$targetUsers | ForEach-Object { Write-Host " - $_" }
+Write-Host "Сервер: ${ServerScheme}://$ServerHost`:$ServerPort"
+Write-Host "Каталог данных: $StateRoot"
+Write-Host "Файл DLP-политики: $($assetResult.ActivePolicy)"

install-kit-awindows-20260427-211240/windows/deploy-ensemble.ps1

@@ -0,0 +1,137 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $true)]
+    [string]$ServerHost,
+    [string[]]$Users,
+    [string]$UserListPath,
+    [string]$Domain,
+    [int]$ServerPort = 5600,
+    [ValidateSet('http', 'https')]
+    [string]$ServerScheme = 'http',
+    [string]$Version = 'v0.13.2',
+    [string]$PackageUrl,
+    [string]$PackageZipPath,
+    [string]$InstallRoot = 'C:\Program Files\AWatch-rus\bin',
+    [string]$StateRoot = 'C:\ProgramData\AWatch-rus',
+    [int]$PollSeconds = 5,
+    [int]$PulseSeconds = 30,
+    [int]$RecoveryIntervalSeconds = 180,
+    [bool]$AfkEnabled = $true,
+    [bool]$WindowEnabled = $true,
+    [bool]$LocalAgentLogsEnabled = $false,
+    [bool]$IncidentCaptureEnabled = $true,
+    [bool]$IncidentScreenshotEnabled = $true,
+    [string]$IncidentArtifactsRoot,
+    [bool]$LogonMarkerEnabled = $true,
+    [string]$CustomRulesPath,
+    [string]$CustomPolicyPath,
+    [string]$ReportPath,
+    [switch]$SkipHardening,
+    [switch]$ValidateAfterDeploy
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+$modulePath = Join-Path $PSScriptRoot 'ActivityWatch.Windows.Common.psm1'
+Import-Module $modulePath -Force
+
+Assert-Administrator
+
+$resolvedUsers = Normalize-ActivityWatchUsers -Users $Users -UserListPath $UserListPath -Domain $Domain
+$timestamp = Get-Date -Format 'yyyyMMdd-HHmmss'
+$effectiveReportPath = if ($ReportPath) { $ReportPath } else { Join-Path $StateRoot "ensemble-report-$timestamp.json" }
+$deployScript = Join-Path $PSScriptRoot 'deploy-domain-users.ps1'
+$hardeningScript = Join-Path $PSScriptRoot 'hardening-recovery.ps1'
+$validationScript = Join-Path $PSScriptRoot 'validate-deployment.ps1'
+
+if (-not (Test-Path -LiteralPath $deployScript)) {
+    throw "Не найден скрипт: $deployScript"
+}
+
+& $deployScript `
+    -ServerHost $ServerHost `
+    -Users $resolvedUsers `
+    -ServerPort $ServerPort `
+    -ServerScheme $ServerScheme `
+    -Version $Version `
+    -PackageUrl $PackageUrl `
+    -PackageZipPath $PackageZipPath `
+    -InstallRoot $InstallRoot `
+    -StateRoot $StateRoot `
+    -PollSeconds $PollSeconds `
+    -PulseSeconds $PulseSeconds `
+    -RecoveryIntervalSeconds $RecoveryIntervalSeconds `
+    -AfkEnabled $AfkEnabled `
+    -WindowEnabled $WindowEnabled `
+    -LocalAgentLogsEnabled $LocalAgentLogsEnabled `
+    -IncidentCaptureEnabled $IncidentCaptureEnabled `
+    -IncidentScreenshotEnabled $IncidentScreenshotEnabled `
+    -IncidentArtifactsRoot $IncidentArtifactsRoot `
+    -LogonMarkerEnabled $LogonMarkerEnabled `
+    -CustomRulesPath $CustomRulesPath `
+    -CustomPolicyPath $CustomPolicyPath
+
+if (-not $SkipHardening) {
+    & $hardeningScript `
+        -ConfigPath (Join-Path $StateRoot 'deployment-config.json') `
+        -ServerHost $ServerHost `
+        -ServerPort $ServerPort `
+        -ServerScheme $ServerScheme `
+        -Users $resolvedUsers `
+        -InstallRoot $InstallRoot `
+        -StateRoot $StateRoot `
+        -PollSeconds $PollSeconds `
+        -PulseSeconds $PulseSeconds `
+        -RecoveryIntervalSeconds $RecoveryIntervalSeconds `
+        -AfkEnabled $AfkEnabled `
+        -WindowEnabled $WindowEnabled `
+        -LocalAgentLogsEnabled $LocalAgentLogsEnabled `
+        -IncidentCaptureEnabled $IncidentCaptureEnabled `
+        -IncidentScreenshotEnabled $IncidentScreenshotEnabled `
+        -IncidentArtifactsRoot $IncidentArtifactsRoot `
+        -LogonMarkerEnabled $LogonMarkerEnabled `
+        -CustomRulesPath $CustomRulesPath `
+        -CustomPolicyPath $CustomPolicyPath
+}
+
+$report = [ordered]@{
+    generatedAtUtc = (Get-Date).ToUniversalTime().ToString('o')
+    server = [ordered]@{
+        host = $ServerHost
+        port = $ServerPort
+        scheme = $ServerScheme
+    }
+    packageVersion = $Version
+    users = @($resolvedUsers)
+    paths = [ordered]@{
+        installRoot = $InstallRoot
+        stateRoot = $StateRoot
+        configPath = Join-Path $StateRoot 'deployment-config.json'
+    }
+    collectors = [ordered]@{
+        afkEnabled = $AfkEnabled
+        windowEnabled = $WindowEnabled
+    }
+    hardeningApplied = (-not $SkipHardening)
+}
+
+if ($ValidateAfterDeploy) {
+    if (-not (Test-Path -LiteralPath $validationScript)) {
+        throw "Не найден скрипт: $validationScript"
+    }
+
+    $validation = & $validationScript -ConfigPath (Join-Path $StateRoot 'deployment-config.json')
+    $report.validation = $validation
+}
+
+$reportDirectory = Split-Path -Path $effectiveReportPath -Parent
+if ($reportDirectory) {
+    New-ActivityWatchDirectory -Path $reportDirectory
+}
+
+$report | ConvertTo-Json -Depth 12 | Set-Content -LiteralPath $effectiveReportPath -Encoding UTF8
+
+Write-Host 'Комплексное развёртывание ActivityWatch завершено.'
+Write-Host "Пользователи: $($resolvedUsers -join ', ')"
+Write-Host "Отчёт: $effectiveReportPath"

install-kit-awindows-20260427-211240/windows/deploy-single-user.ps1

@@ -0,0 +1,109 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $true)]
+    [string]$ServerHost,
+    [Parameter(Mandatory = $true)]
+    [string]$TargetUser,
+    [int]$ServerPort = 5600,
+    [ValidateSet('http', 'https')]
+    [string]$ServerScheme = 'http',
+    [string]$Version = 'v0.13.2',
+    [string]$PackageUrl,
+    [string]$PackageZipPath,
+    [string]$InstallRoot = 'C:\Program Files\AWatch-rus\bin',
+    [string]$StateRoot = 'C:\ProgramData\AWatch-rus',
+    [int]$PollSeconds = 5,
+    [int]$PulseSeconds = 30,
+    [int]$RecoveryIntervalSeconds = 180,
+    [bool]$AfkEnabled = $true,
+    [bool]$WindowEnabled = $true,
+    [bool]$LocalAgentLogsEnabled = $false,
+    [bool]$IncidentCaptureEnabled = $true,
+    [bool]$IncidentScreenshotEnabled = $true,
+    [string]$IncidentArtifactsRoot,
+    [bool]$LogonMarkerEnabled = $true,
+    [string]$CustomRulesPath,
+    [string]$CustomPolicyPath
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+$modulePath = Join-Path $PSScriptRoot 'ActivityWatch.Windows.Common.psm1'
+Import-Module $modulePath -Force
+
+Assert-Administrator
+
+$workingRoot = Join-Path $env:TEMP 'activitywatch-windows-deploy'
+$backupRoot = Join-Path $StateRoot 'backups'
+$logsRoot = Join-Path $StateRoot 'logs'
+$configPath = Join-Path $StateRoot 'deployment-config.json'
+$launchScriptPath = Join-Path $StateRoot 'launch-watchers.ps1'
+$recoveryScriptPath = Join-Path $StateRoot 'recovery-loop.ps1'
+$collectorSource = Join-Path $PSScriptRoot 'browser-domains-native-collector.ps1'
+$endpointCollectorSource = Join-Path $PSScriptRoot 'dlp-endpoint-signals-collector.ps1'
+$sessionCollectorSource = Join-Path $PSScriptRoot 'worktime-session-collector.ps1'
+$exampleRulesSource = Join-Path $PSScriptRoot 'web-category-rules.example.json'
+$examplePolicySource = Join-Path $PSScriptRoot 'dlp-policy.example.json'
+
+New-ActivityWatchDirectory -Path $StateRoot
+New-ActivityWatchDirectory -Path $logsRoot
+
+$archivePath = Get-ActivityWatchArchive -PackageZipPath $PackageZipPath -PackageUrl $PackageUrl -Version $Version -WorkingRoot $workingRoot
+Install-ActivityWatchPackage -ArchivePath $archivePath -InstallRoot $InstallRoot -WorkingRoot $workingRoot -BackupRoot $backupRoot | Out-Null
+Get-ActivityWatchExecutableMap -InstallRoot $InstallRoot | Out-Null
+
+$assetResult = Copy-ActivityWatchCollectorAssets `
+    -CollectorScriptSource $collectorSource `
+    -EndpointCollectorScriptSource $endpointCollectorSource `
+    -SessionCollectorScriptSource $sessionCollectorSource `
+    -ExampleRulesSource $exampleRulesSource `
+    -ExamplePolicySource $examplePolicySource `
+    -StateRoot $StateRoot `
+    -CustomRulesSource $CustomRulesPath `
+    -CustomPolicySource $CustomPolicyPath
+$taskDefinitions = New-ActivityWatchUserTaskDefinitions -Users @($TargetUser)
+
+Write-ActivityWatchLaunchScript -Path $launchScriptPath -ConfigPath $configPath
+Write-ActivityWatchRecoveryScript -Path $recoveryScriptPath -ConfigPath $configPath
+
+$config = New-ActivityWatchDeploymentConfig `
+    -ServerHost $ServerHost `
+    -ServerPort $ServerPort `
+    -ServerScheme $ServerScheme `
+    -InstallRoot $InstallRoot `
+    -StateRoot $StateRoot `
+    -LogsRoot $logsRoot `
+    -CollectorScript $assetResult.CollectorScript `
+    -EndpointCollectorScript $assetResult.EndpointCollectorScript `
+    -SessionCollectorScript $assetResult.SessionCollectorScript `
+    -RulesPath $assetResult.ActiveRules `
+    -PolicyPath $assetResult.ActivePolicy `
+    -PollSeconds $PollSeconds `
+    -PulseSeconds $PulseSeconds `
+    -RecoveryIntervalSeconds $RecoveryIntervalSeconds `
+    -AfkEnabled $AfkEnabled `
+    -WindowEnabled $WindowEnabled `
+    -LocalAgentLogsEnabled $LocalAgentLogsEnabled `
+    -IncidentCaptureEnabled $IncidentCaptureEnabled `
+    -IncidentScreenshotEnabled $IncidentScreenshotEnabled `
+    -IncidentArtifactsRoot $IncidentArtifactsRoot `
+    -LogonMarkerEnabled $LogonMarkerEnabled `
+    -LaunchScriptPath $launchScriptPath `
+    -RecoveryScriptPath $recoveryScriptPath `
+    -UserTasks $taskDefinitions `
+    -PackageVersion $Version
+
+Write-ActivityWatchDeploymentConfig -Config $config -Path $configPath
+Remove-LegacyActivityWatchEntries
+Set-ActivityWatchAcl -InstallRoot $InstallRoot -StateRoot $StateRoot -LogsRoot $logsRoot
+Register-ActivityWatchUserTasks -TaskDefinitions $taskDefinitions -LaunchScriptPath $launchScriptPath -ConfigPath $configPath
+Register-ActivityWatchRecoveryTask -TaskName $config.recovery.taskName -RecoveryScriptPath $recoveryScriptPath -ConfigPath $configPath
+Start-ActivityWatchTasks -TaskDefinitions $taskDefinitions -RecoveryTaskName $config.recovery.taskName
+
+Write-Host "ActivityWatch развёрнут для пользователя: $TargetUser"
+Write-Host "Сервер: ${ServerScheme}://$ServerHost`:$ServerPort"
+Write-Host "Каталог установки: $InstallRoot"
+Write-Host "Каталог данных: $StateRoot"
+Write-Host "Файл правил: $($assetResult.ActiveRules)"
+Write-Host "Файл DLP-политики: $($assetResult.ActivePolicy)"

install-kit-awindows-20260427-211240/windows/dlp-endpoint-signals-collector.ps1

@@ -0,0 +1,891 @@
+[CmdletBinding()]
+param(
+    [string]$ConfigPath = 'C:\ProgramData\AWatch-rus\deployment-config.json',
+    [string]$ServerHost,
+    [int]$ServerPort,
+    [ValidateSet('http', 'https')]
+    [string]$ServerScheme,
+    [string]$PolicyPath,
+    [string]$LogPath,
+    [int]$PollSeconds
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+function Get-DeploymentConfig {
+    param([string]$Path)
+    if ($Path -and (Test-Path -LiteralPath $Path)) {
+        return Get-Content -LiteralPath $Path -Raw | ConvertFrom-Json
+    }
+    return $null
+}
+
+function Write-EndpointLog {
+    param([string]$Message)
+    if (-not $script:LocalAgentLogsEnabled) {
+        return
+    }
+    try {
+        Add-Content -LiteralPath $script:LogPath -Value ('{0} {1}' -f (Get-Date -Format s), $Message)
+    }
+    catch {
+    }
+}
+
+function Invoke-AwJsonPost {
+    param(
+        [Parameter(Mandatory = $true)][string]$Uri,
+        [Parameter(Mandatory = $true)][string]$Json
+    )
+
+    $bytes = [Text.Encoding]::UTF8.GetBytes($Json)
+    Invoke-RestMethod -Method Post -Uri $Uri -ContentType 'application/json; charset=utf-8' -Body $bytes | Out-Null
+}
+
+function Ensure-Bucket {
+    param(
+        [string]$BucketId,
+        [string]$ClientName,
+        [string]$BucketType
+    )
+
+    if ($script:KnownBuckets.ContainsKey($BucketId)) {
+        return
+    }
+
+    $body = @{
+        client   = $ClientName
+        type     = $BucketType
+        hostname = $script:Hostname
+    } | ConvertTo-Json -Compress
+
+    Invoke-AwJsonPost -Uri "$($script:ApiBase)/buckets/$BucketId" -Json $body
+    $script:KnownBuckets[$BucketId] = $true
+}
+
+function Send-EndpointSignalHeartbeat {
+    param(
+        [string]$SignalType,
+        [hashtable]$Data
+    )
+
+    $bucketId = 'aw-dlp-endpoint-signals_' + $script:Hostname
+    Ensure-Bucket -BucketId $bucketId -ClientName 'aw-dlp-endpoint-signals' -BucketType 'aw.dlp.endpoint.signal'
+
+    $payload = @{
+        timestamp = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss.fffZ')
+        duration  = 0
+        data      = @{
+            signalType = $SignalType
+            username   = $env:USERNAME
+            sessionId  = $script:SessionId
+            hostname   = $script:Hostname
+            source     = 'endpoint-signals-awatch-rus'
+        } + $Data
+    } | ConvertTo-Json -Depth 6 -Compress
+
+    Invoke-AwJsonPost -Uri "$($script:ApiBase)/buckets/$bucketId/heartbeat?pulsetime=$script:PulseSeconds" -Json $payload
+}
+
+function Send-DlpIncidentHeartbeat {
+    param(
+        [string]$RuleId,
+        [string]$Action,
+        [string]$Severity,
+        [string]$Message,
+        [string]$SignalType,
+        [hashtable]$Data
+    )
+
+    $bucketId = 'aw-dlp-incidents_' + $script:Hostname
+    Ensure-Bucket -BucketId $bucketId -ClientName 'aw-dlp-incidents' -BucketType 'aw.dlp.incident'
+
+    $captureData = @{}
+    if ($script:IncidentScreenshotEnabled) {
+        try {
+            $captureData = Capture-IncidentScreenshot -RuleId $RuleId -SignalType $SignalType
+        }
+        catch {
+        }
+    }
+
+    $payload = @{
+        timestamp = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss.fffZ')
+        duration  = 0
+        data      = @{
+            ruleId    = $RuleId
+            action    = $Action
+            severity  = $Severity
+            message   = $Message
+            signalType = $SignalType
+            username  = $env:USERNAME
+            sessionId = $script:SessionId
+            hostname  = $script:Hostname
+            source    = 'endpoint-signals-awatch-rus'
+        } + $Data + $captureData
+    } | ConvertTo-Json -Depth 7 -Compress
+
+    Invoke-AwJsonPost -Uri "$($script:ApiBase)/buckets/$bucketId/heartbeat?pulsetime=$script:PulseSeconds" -Json $payload
+}
+
+function Get-FileSha256Hex {
+    param([Parameter(Mandatory = $true)][string]$Path)
+    try {
+        $sha = [Security.Cryptography.SHA256]::Create()
+        $stream = [IO.File]::OpenRead($Path)
+        try {
+            ($sha.ComputeHash($stream) | ForEach-Object { $_.ToString('x2') }) -join ''
+        }
+        finally {
+            $stream.Dispose()
+            $sha.Dispose()
+        }
+    }
+    catch {
+        return $null
+    }
+}
+
+function Ensure-Directory {
+    param([Parameter(Mandatory = $true)][string]$Path)
+    if (-not (Test-Path -LiteralPath $Path)) {
+        New-Item -Path $Path -ItemType Directory -Force | Out-Null
+    }
+}
+
+function Get-IncidentScreenshotPath {
+    param(
+        [Parameter(Mandatory = $true)][string]$RuleId,
+        [Parameter(Mandatory = $true)][string]$SignalType
+    )
+
+    $safeUser = ($env:USERNAME -replace '[^A-Za-z0-9_.-]', '_')
+    $safeRule = ($RuleId -replace '[^A-Za-z0-9_.-]', '_')
+    $safeType = ($SignalType -replace '[^A-Za-z0-9_.-]', '_')
+    $stamp = (Get-Date).ToUniversalTime().ToString('yyyyMMdd_HHmmss_fff')
+    $file = '{0}_{1}_sid{2}_{3}_{4}.png' -f $script:Hostname, $safeUser, $script:SessionId, $safeType, $safeRule
+    $file = '{0}_{1}' -f $stamp, $file
+    return (Join-Path $script:IncidentArtifactsRoot $file)
+}
+
+function Ensure-ScreenshotTypesLoaded {
+    if ($script:ScreenshotTypesLoaded) {
+        return
+    }
+    Add-Type -AssemblyName System.Windows.Forms | Out-Null
+    Add-Type -AssemblyName System.Drawing | Out-Null
+    $script:ScreenshotTypesLoaded = $true
+}
+
+function Capture-IncidentScreenshot {
+    param(
+        [Parameter(Mandatory = $true)][string]$RuleId,
+        [Parameter(Mandatory = $true)][string]$SignalType
+    )
+
+    try {
+        Ensure-Directory -Path $script:IncidentArtifactsRoot
+        Ensure-ScreenshotTypesLoaded
+
+        $vs = [System.Windows.Forms.SystemInformation]::VirtualScreen
+        $bmp = New-Object System.Drawing.Bitmap ([int]$vs.Width), ([int]$vs.Height)
+        $gfx = [System.Drawing.Graphics]::FromImage($bmp)
+        try {
+            $gfx.CopyFromScreen([int]$vs.Left, [int]$vs.Top, 0, 0, $bmp.Size)
+            $path = Get-IncidentScreenshotPath -RuleId $RuleId -SignalType $SignalType
+            $bmp.Save($path, [System.Drawing.Imaging.ImageFormat]::Png)
+        }
+        finally {
+            $gfx.Dispose()
+            $bmp.Dispose()
+        }
+
+        return @{
+            screenshotPath   = $path
+            screenshotFormat = 'png'
+            screenshotWidth  = [int]$vs.Width
+            screenshotHeight = [int]$vs.Height
+            screenshotSha256 = (Get-FileSha256Hex -Path $path)
+        }
+    }
+    catch {
+        Write-EndpointLog ("не удалось сделать снимок инцидента: {0}" -f $_.Exception.Message)
+        return @{}
+    }
+}
+
+function Get-StringHash {
+    param([AllowNull()][string]$Value)
+    if ($null -eq $Value) { return $null }
+    $bytes = [Text.Encoding]::UTF8.GetBytes($Value)
+    $sha = [Security.Cryptography.SHA256]::Create()
+    try {
+        ($sha.ComputeHash($bytes) | ForEach-Object { $_.ToString('x2') }) -join ''
+    }
+    finally {
+        $sha.Dispose()
+    }
+}
+
+function Load-DlpPolicy {
+    param([string]$Path)
+
+    $script:Policy = [ordered]@{
+        defaults = [ordered]@{
+            enabled = $true
+            cooldownSeconds = 300
+            action = 'alert'
+            severity = 'medium'
+        }
+        endpoint = [ordered]@{
+            clipboard = @()
+            usb = @()
+            print = @()
+        }
+    }
+
+    if (-not $Path -or -not (Test-Path -LiteralPath $Path)) {
+        Write-EndpointLog ("DLP-политика не найдена, используются значения по умолчанию: {0}" -f $Path)
+        return
+    }
+
+    try {
+        $raw = Get-Content -LiteralPath $Path -Raw | ConvertFrom-Json
+        if ($raw.defaults) {
+            if ($raw.defaults.PSObject.Properties.Name -contains 'enabled') { $script:Policy.defaults.enabled = [bool]$raw.defaults.enabled }
+            if ($raw.defaults.cooldownSeconds) { $script:Policy.defaults.cooldownSeconds = [int]$raw.defaults.cooldownSeconds }
+            if ($raw.defaults.action) { $script:Policy.defaults.action = [string]$raw.defaults.action }
+            if ($raw.defaults.severity) { $script:Policy.defaults.severity = [string]$raw.defaults.severity }
+        }
+
+        if ($raw.endpoint) {
+            if ($raw.endpoint.clipboard) { $script:Policy.endpoint.clipboard = @($raw.endpoint.clipboard) }
+            if ($raw.endpoint.usb) { $script:Policy.endpoint.usb = @($raw.endpoint.usb) }
+            if ($raw.endpoint.print) { $script:Policy.endpoint.print = @($raw.endpoint.print) }
+        }
+    }
+    catch {
+        Write-EndpointLog ("не удалось разобрать DLP-политику: {0}" -f $_.Exception.Message)
+    }
+}
+
+function Should-EmitByCooldown {
+    param(
+        [string]$Fingerprint,
+        [int]$CooldownSeconds
+    )
+
+    $now = (Get-Date).ToUniversalTime()
+    if ($script:Cooldown.ContainsKey($Fingerprint)) {
+        $last = [datetime]$script:Cooldown[$Fingerprint]
+        if ((New-TimeSpan -Start $last -End $now).TotalSeconds -lt $CooldownSeconds) {
+            return $false
+        }
+    }
+
+    $script:Cooldown[$Fingerprint] = $now
+    return $true
+}
+
+function Evaluate-ClipboardRules {
+    param(
+        [string]$ClipboardText,
+        [string]$ClipboardHash
+    )
+
+    foreach ($rule in @($script:Policy.endpoint.clipboard)) {
+        if (-not $rule) { continue }
+        if ($rule.PSObject.Properties.Name -contains 'enabled' -and -not [bool]$rule.enabled) { continue }
+        $ruleId = [string]$rule.id
+        if (-not $ruleId) { continue }
+        $minLength = if ($rule.minLength) { [int]$rule.minLength } else { 0 }
+        $regexPatterns = if ($rule.regexPatterns) { @($rule.regexPatterns) } else { @() }
+        if ($ClipboardText.Length -lt $minLength) { continue }
+
+        $matched = $false
+        foreach ($pattern in $regexPatterns) {
+            if ($ClipboardText -match [string]$pattern) {
+                $matched = $true
+                break
+            }
+        }
+
+        if (-not $matched) { continue }
+
+        $cooldown = if ($rule.cooldownSeconds) { [int]$rule.cooldownSeconds } else { [int]$script:Policy.defaults.cooldownSeconds }
+        $fingerprint = "clipboard|$ruleId|$ClipboardHash|$env:USERNAME"
+        if (-not (Should-EmitByCooldown -Fingerprint $fingerprint -CooldownSeconds ([Math]::Max($cooldown, 30)))) { continue }
+
+        $action = if ($rule.action) { [string]$rule.action } else { [string]$script:Policy.defaults.action }
+        $severity = if ($rule.severity) { [string]$rule.severity } else { [string]$script:Policy.defaults.severity }
+        $message = if ($rule.message) { [string]$rule.message } else { "Сработало правило буфера обмена: $ruleId" }
+
+        Send-DlpIncidentHeartbeat -RuleId $ruleId -Action $action -Severity $severity -Message $message -SignalType 'clipboard' -Data @{
+            clipboardHash = $ClipboardHash
+            clipboardLength = $ClipboardText.Length
+        }
+        Write-EndpointLog ("инцидент буфера обмена правило={0} действие={1} важность={2}" -f $ruleId, $action, $severity)
+    }
+}
+
+function Evaluate-UsbRules {
+    param(
+        [string]$DriveLetter,
+        [string]$VolumeName
+    )
+
+    foreach ($rule in @($script:Policy.endpoint.usb)) {
+        if (-not $rule) { continue }
+        if ($rule.PSObject.Properties.Name -contains 'enabled' -and -not [bool]$rule.enabled) { continue }
+        $ruleId = [string]$rule.id
+        if (-not $ruleId) { continue }
+
+        $cooldown = if ($rule.cooldownSeconds) { [int]$rule.cooldownSeconds } else { [int]$script:Policy.defaults.cooldownSeconds }
+        $fingerprint = "usb|$ruleId|$DriveLetter|$env:USERNAME"
+        if (-not (Should-EmitByCooldown -Fingerprint $fingerprint -CooldownSeconds ([Math]::Max($cooldown, 30)))) { continue }
+
+        $action = if ($rule.action) { [string]$rule.action } else { [string]$script:Policy.defaults.action }
+        $severity = if ($rule.severity) { [string]$rule.severity } else { [string]$script:Policy.defaults.severity }
+        $message = if ($rule.message) { [string]$rule.message } else { "Сработало правило USB-носителя: $ruleId" }
+
+        Send-DlpIncidentHeartbeat -RuleId $ruleId -Action $action -Severity $severity -Message $message -SignalType 'usb_insert' -Data @{
+            driveLetter = $DriveLetter
+            volumeName  = $VolumeName
+        }
+        Write-EndpointLog ("инцидент USB правило={0} действие={1} важность={2} диск={3}" -f $ruleId, $action, $severity, $DriveLetter)
+    }
+}
+
+function Evaluate-PrintRules {
+    param(
+        [string]$PrinterName,
+        [string]$DocumentName,
+        [string]$Owner
+    )
+
+    foreach ($rule in @($script:Policy.endpoint.print)) {
+        if (-not $rule) { continue }
+        if ($rule.PSObject.Properties.Name -contains 'enabled' -and -not [bool]$rule.enabled) { continue }
+        $ruleId = [string]$rule.id
+        if (-not $ruleId) { continue }
+
+        $match = $true
+        if ($rule.printerRegex) {
+            $match = $match -and ($PrinterName -match [string]$rule.printerRegex)
+        }
+        if ($rule.documentRegex) {
+            $match = $match -and ($DocumentName -match [string]$rule.documentRegex)
+        }
+        if (-not $match) { continue }
+
+        $cooldown = if ($rule.cooldownSeconds) { [int]$rule.cooldownSeconds } else { [int]$script:Policy.defaults.cooldownSeconds }
+        $fingerprint = "print|$ruleId|$PrinterName|$Owner|$env:USERNAME"
+        if (-not (Should-EmitByCooldown -Fingerprint $fingerprint -CooldownSeconds ([Math]::Max($cooldown, 30)))) { continue }
+
+        $action = if ($rule.action) { [string]$rule.action } else { [string]$script:Policy.defaults.action }
+        $severity = if ($rule.severity) { [string]$rule.severity } else { [string]$script:Policy.defaults.severity }
+        $message = if ($rule.message) { [string]$rule.message } else { "Сработало правило печати: $ruleId" }
+
+        Send-DlpIncidentHeartbeat -RuleId $ruleId -Action $action -Severity $severity -Message $message -SignalType 'print_job' -Data @{
+            printerName  = $PrinterName
+            documentName = $DocumentName
+            owner        = $Owner
+        }
+        Write-EndpointLog ("инцидент печати правило={0} действие={1} важность={2} принтер={3}" -f $ruleId, $action, $severity, $PrinterName)
+    }
+}
+
+function Test-LooksLikeMojibakeQuestionMarks {
+    param([AllowNull()][string]$Value)
+    if ([string]::IsNullOrWhiteSpace($Value)) { return $true }
+    return $Value -match '\?{2,}'
+}
+
+function Test-DocumentNameNeedsFallback {
+    param([AllowNull()][string]$Value)
+
+    if ([string]::IsNullOrWhiteSpace($Value)) { return $true }
+    $trimmed = $Value.Trim()
+    if (Test-LooksLikeMojibakeQuestionMarks -Value $trimmed) { return $true }
+    if ($trimmed -match '^[0-9]+$') { return $true }
+    if ($trimmed -match '^(?i)(print document|document|local downlevel document)$') { return $true }
+    return $false
+}
+
+function Get-EventXmlValue {
+    param(
+        [Parameter(Mandatory = $true)][xml]$EventXml,
+        [Parameter(Mandatory = $true)][string]$Name
+    )
+
+    $node = $EventXml.Event.UserData.DocumentPrinted.$Name
+    if ($null -ne $node) {
+        return [string]$node
+    }
+
+    return ''
+}
+
+function Get-PrintJobPrinterName {
+    param(
+        [AllowNull()][string]$JobName,
+        [AllowNull()][string]$FallbackPrinterName
+    )
+
+    if ([string]::IsNullOrWhiteSpace($JobName)) {
+        if (-not [string]::IsNullOrWhiteSpace($FallbackPrinterName)) {
+            return $FallbackPrinterName.Trim()
+        }
+        return ''
+    }
+
+    $parts = $JobName -split ',', 2
+    if ($parts.Count -gt 0 -and -not [string]::IsNullOrWhiteSpace($parts[0])) {
+        return $parts[0].Trim()
+    }
+
+    return $JobName.Trim()
+}
+
+function Normalize-OwnerForMatch {
+    param([AllowNull()][string]$Value)
+    if ([string]::IsNullOrWhiteSpace($Value)) { return '' }
+    $normalized = $Value.Trim().ToLowerInvariant()
+    if ($normalized -match '[\\/]') {
+        $parts = $normalized -split '[\\/]'
+        if ($parts.Count -gt 0) {
+            $normalized = [string]$parts[$parts.Count - 1]
+        }
+    }
+    if ($normalized -match '@') {
+        $parts = $normalized -split '@'
+        if ($parts.Count -gt 0) {
+            $normalized = [string]$parts[0]
+        }
+    }
+    return $normalized
+}
+
+function Test-OwnerLooseMatch {
+    param(
+        [string]$Expected,
+        [string]$Actual
+    )
+    $expectedNorm = Normalize-OwnerForMatch -Value $Expected
+    $actualNorm = Normalize-OwnerForMatch -Value $Actual
+    if ([string]::IsNullOrWhiteSpace($expectedNorm) -or [string]::IsNullOrWhiteSpace($actualNorm)) {
+        return $false
+    }
+    return ($actualNorm -eq $expectedNorm) -or $actualNorm.Contains($expectedNorm) -or $expectedNorm.Contains($actualNorm)
+}
+
+function Normalize-PrinterForMatch {
+    param([AllowNull()][string]$Value)
+    if ([string]::IsNullOrWhiteSpace($Value)) { return '' }
+    $normalized = $Value.Trim().ToLowerInvariant()
+    if ($normalized.Contains(',')) {
+        $normalized = ($normalized -split ',', 2)[0].Trim()
+    }
+    if ($normalized -match '\son\s') {
+        $normalized = ($normalized -split '\son\s', 2)[0].Trim()
+    }
+    return $normalized
+}
+
+function Test-PrinterLooseMatch {
+    param(
+        [string]$Expected,
+        [string]$Actual
+    )
+    $expectedNorm = Normalize-PrinterForMatch -Value $Expected
+    $actualNorm = Normalize-PrinterForMatch -Value $Actual
+    if ([string]::IsNullOrWhiteSpace($expectedNorm) -or [string]::IsNullOrWhiteSpace($actualNorm)) {
+        return $false
+    }
+    return ($actualNorm -eq $expectedNorm) -or $actualNorm.Contains($expectedNorm) -or $expectedNorm.Contains($actualNorm)
+}
+
+function Get-PrintServiceEventSummary {
+    param([Parameter(Mandatory = $true)]$Event)
+
+    $props = @($Event.Properties)
+    $propertyValues = @()
+    foreach ($prop in $props) {
+        $propertyValues += [string]$prop.Value
+    }
+
+    $xml = $null
+    try {
+        $xml = [xml]$Event.ToXml()
+    }
+    catch {
+    }
+
+    $jobId = ''
+    $documentName = ''
+    $owner = ''
+    $portName = ''
+    $printerName = ''
+    $sizeBytes = ''
+    $pageCount = ''
+
+    if ($xml) {
+        $jobId = Get-EventXmlValue -EventXml $xml -Name 'Param1'
+        $documentName = Get-EventXmlValue -EventXml $xml -Name 'Param2'
+        $owner = Get-EventXmlValue -EventXml $xml -Name 'Param3'
+        $portName = Get-EventXmlValue -EventXml $xml -Name 'Param4'
+        $printerName = Get-EventXmlValue -EventXml $xml -Name 'Param5'
+        $sizeBytes = Get-EventXmlValue -EventXml $xml -Name 'Param7'
+        $pageCount = Get-EventXmlValue -EventXml $xml -Name 'Param8'
+    }
+
+    if ([string]::IsNullOrWhiteSpace($jobId) -and $props.Count -ge 1) { $jobId = [string]$props[0].Value }
+    if ([string]::IsNullOrWhiteSpace($documentName) -and $props.Count -ge 2) { $documentName = [string]$props[1].Value }
+    if ([string]::IsNullOrWhiteSpace($owner) -and $props.Count -ge 3) { $owner = [string]$props[2].Value }
+    if ([string]::IsNullOrWhiteSpace($portName) -and $props.Count -ge 4) { $portName = [string]$props[3].Value }
+    if ([string]::IsNullOrWhiteSpace($printerName) -and $props.Count -ge 5) { $printerName = [string]$props[4].Value }
+    if ([string]::IsNullOrWhiteSpace($sizeBytes) -and $props.Count -ge 7) { $sizeBytes = [string]$props[6].Value }
+    if ([string]::IsNullOrWhiteSpace($pageCount) -and $props.Count -ge 8) { $pageCount = [string]$props[7].Value }
+
+    [pscustomobject]@{
+        RecordId      = [string]$Event.RecordId
+        TimeCreated   = if ($Event.TimeCreated) { $Event.TimeCreated.ToString('o') } else { '' }
+        PropertyCount  = $props.Count
+        JobId          = $jobId
+        DocumentName   = $documentName
+        Owner          = $owner
+        PortName       = $portName
+        PrinterName    = $printerName
+        SizeBytes      = $sizeBytes
+        PageCount      = $pageCount
+        PropertyValues = $propertyValues
+    }
+}
+
+function Get-PrintServiceDocumentFallback {
+    param(
+        [Parameter(Mandatory = $true)]$EventSummary,
+        [string]$Owner,
+        [string]$PrinterName
+    )
+
+    $preferred = [string]$EventSummary.DocumentName
+    if (-not (Test-DocumentNameNeedsFallback -Value $preferred)) {
+        return $preferred
+    }
+
+    $pathCandidates = New-Object System.Collections.Generic.List[string]
+    $textCandidates = New-Object System.Collections.Generic.List[string]
+
+    foreach ($value in @($EventSummary.PropertyValues)) {
+        $candidate = [string]$value
+        if ([string]::IsNullOrWhiteSpace($candidate)) { continue }
+        if ($candidate -eq $preferred) { continue }
+        if ($EventSummary.JobId -and $candidate -eq [string]$EventSummary.JobId) { continue }
+        if ($Owner -and $candidate -like "*$Owner*") { continue }
+        if ($PrinterName -and $candidate -like "*$PrinterName*") { continue }
+        if (Test-DocumentNameNeedsFallback -Value $candidate) { continue }
+
+        if ($candidate -match '[\\/:]' -and $candidate -match '\.[A-Za-z0-9]{1,8}$') {
+            $pathCandidates.Add($candidate)
+            continue
+        }
+
+        if ($candidate -match '^[0-9]+$') {
+            continue
+        }
+
+        $textCandidates.Add($candidate)
+    }
+
+    foreach ($candidate in @($pathCandidates)) {
+        $leaf = Split-Path -Path $candidate -Leaf
+        if (-not [string]::IsNullOrWhiteSpace($leaf)) {
+            return $leaf
+        }
+        return $candidate
+    }
+
+    foreach ($candidate in @($textCandidates)) {
+        return $candidate
+    }
+
+    return $null
+}
+
+function Write-PrintServiceEventTrace {
+    param(
+        [Parameter(Mandatory = $true)]$EventSummary,
+        [string]$Phase,
+        [string]$MatchReason,
+        [string]$ResolvedDocument
+    )
+
+    $properties = if ($EventSummary.PropertyValues) {
+        ($EventSummary.PropertyValues -join ' | ')
+    }
+    else {
+        ''
+    }
+
+    Write-EndpointLog (
+        'printservice-307 этап={0} recordId={1} время={2} владелец={3} принтер={4} документ={5} итоговыйДокумент={6} свойства=[{7}] причина={8}' -f
+        $Phase,
+        $EventSummary.RecordId,
+        $EventSummary.TimeCreated,
+        $EventSummary.Owner,
+        $EventSummary.PrinterName,
+        $EventSummary.DocumentName,
+        $ResolvedDocument,
+        $properties,
+        $MatchReason
+    )
+}
+
+function Get-BetterDocumentNameFromPrintServiceEvents {
+    param(
+        [string]$JobId,
+        [string]$Owner,
+        [string]$PrinterName
+    )
+
+    try {
+        $startTime = (Get-Date).AddMinutes(-15)
+        $events = Get-WinEvent -FilterHashtable @{
+            LogName   = 'Microsoft-Windows-PrintService/Operational'
+            Id        = 307
+            StartTime = $startTime
+        } -MaxEvents 200 -ErrorAction Stop
+
+        foreach ($pass in @('strict', 'relaxed')) {
+            foreach ($event in @($events)) {
+                $summary = Get-PrintServiceEventSummary -Event $event
+                $resolvedDocument = Get-PrintServiceDocumentFallback -EventSummary $summary -Owner $Owner -PrinterName $PrinterName
+
+                $jobMatches = if ($JobId) { [string]$summary.JobId -eq [string]$JobId } else { $true }
+                $ownerMatches = if ($Owner) { Test-OwnerLooseMatch -Expected $Owner -Actual $summary.Owner } else { $true }
+                $printerMatches = if ($PrinterName) { Test-PrinterLooseMatch -Expected $PrinterName -Actual $summary.PrinterName } else { $true }
+
+                if ($pass -eq 'strict') {
+                    if ($JobId -and -not $jobMatches) {
+                        Write-PrintServiceEventTrace -EventSummary $summary -Phase 'scan' -MatchReason 'несовпадение-jobid-strict' -ResolvedDocument $resolvedDocument
+                        continue
+                    }
+                    if ($Owner -and -not $ownerMatches) {
+                        Write-PrintServiceEventTrace -EventSummary $summary -Phase 'scan' -MatchReason 'несовпадение-владельца-strict' -ResolvedDocument $resolvedDocument
+                        continue
+                    }
+                    if ($PrinterName -and -not $printerMatches) {
+                        Write-PrintServiceEventTrace -EventSummary $summary -Phase 'scan' -MatchReason 'несовпадение-принтера-strict' -ResolvedDocument $resolvedDocument
+                        continue
+                    }
+                }
+                else {
+                    if ($JobId -and (-not $jobMatches) -and $Owner -and $PrinterName -and -not $ownerMatches -and -not $printerMatches) {
+                        Write-PrintServiceEventTrace -EventSummary $summary -Phase 'scan' -MatchReason 'несовпадение-владельца-и-принтера-relaxed' -ResolvedDocument $resolvedDocument
+                        continue
+                    }
+                    if ((-not $JobId) -and $Owner -and $PrinterName -and -not $ownerMatches -and -not $printerMatches) {
+                        Write-PrintServiceEventTrace -EventSummary $summary -Phase 'scan' -MatchReason 'несовпадение-владельца-и-принтера-relaxed' -ResolvedDocument $resolvedDocument
+                        continue
+                    }
+                }
+
+                if ([string]::IsNullOrWhiteSpace($resolvedDocument)) {
+                    Write-PrintServiceEventTrace -EventSummary $summary -Phase 'scan' -MatchReason ('нет-кандидата-документа-' + $pass) -ResolvedDocument ''
+                    continue
+                }
+
+                $matchReasonBase = if (Test-DocumentNameNeedsFallback -Value $summary.DocumentName) { 'использован-резервный-вариант' } else { 'напрямую' }
+                Write-PrintServiceEventTrace -EventSummary $summary -Phase 'selected' -MatchReason ($matchReasonBase + '-' + $pass) -ResolvedDocument $resolvedDocument
+                return $resolvedDocument
+            }
+        }
+    }
+    catch {
+    }
+
+    return $null
+}
+
+$deploymentConfig = Get-DeploymentConfig -Path $ConfigPath
+$resolvedServerHost = if ($ServerHost) { $ServerHost } elseif ($deploymentConfig) { [string]$deploymentConfig.server.host } else { throw 'Укажите ServerHost или подготовьте deployment-config.json.' }
+$resolvedServerPort = if ($PSBoundParameters.ContainsKey('ServerPort')) { $ServerPort } elseif ($deploymentConfig) { [int]$deploymentConfig.server.port } else { 5600 }
+$resolvedServerScheme = if ($ServerScheme) { $ServerScheme } elseif ($deploymentConfig) { [string]$deploymentConfig.server.scheme } else { 'http' }
+$resolvedPolicyPath = if ($PolicyPath) { $PolicyPath } elseif ($deploymentConfig -and $deploymentConfig.paths.PSObject.Properties.Name -contains 'policyPath') { [string]$deploymentConfig.paths.policyPath } else { 'C:\ProgramData\AWatch-rus\dlp-policy.json' }
+$resolvedPollSeconds = if ($PSBoundParameters.ContainsKey('PollSeconds')) { $PollSeconds } elseif ($deploymentConfig) { [int]$deploymentConfig.collector.pollSeconds } else { 5 }
+$resolvedLogsRoot = if ($deploymentConfig) { [string]$deploymentConfig.paths.logsRoot } else { 'C:\ProgramData\AWatch-rus\logs' }
+$resolvedLogPath = if ($LogPath) { $LogPath } else { Join-Path $resolvedLogsRoot ("endpoint-signals-{0}.log" -f $env:USERNAME) }
+$resolvedLocalAgentLogsEnabled = if ($deploymentConfig -and $deploymentConfig.PSObject.Properties.Name -contains 'logging' -and $deploymentConfig.logging.PSObject.Properties.Name -contains 'localAgentLogsEnabled') { [bool]$deploymentConfig.logging.localAgentLogsEnabled } else { $true }
+$resolvedIncidentArtifactsRoot = if ($deploymentConfig -and $deploymentConfig.PSObject.Properties.Name -contains 'incidentCapture' -and $deploymentConfig.incidentCapture.PSObject.Properties.Name -contains 'artifactsRoot') { [string]$deploymentConfig.incidentCapture.artifactsRoot } else { Join-Path $env:LOCALAPPDATA 'AWatch-rus\\incident-artifacts' }
+$resolvedIncidentScreenshotEnabled = if ($deploymentConfig -and $deploymentConfig.PSObject.Properties.Name -contains 'incidentCapture' -and $deploymentConfig.incidentCapture.PSObject.Properties.Name -contains 'screenshotEnabled') { [bool]$deploymentConfig.incidentCapture.screenshotEnabled } else { $true }
+
+if ($resolvedLocalAgentLogsEnabled -and -not (Test-Path -LiteralPath $resolvedLogsRoot)) {
+    New-Item -Path $resolvedLogsRoot -ItemType Directory -Force | Out-Null
+}
+
+$script:ApiBase = '{0}://{1}:{2}/api/0' -f $resolvedServerScheme, $resolvedServerHost, $resolvedServerPort
+$script:Hostname = $env:COMPUTERNAME
+$script:SessionId = (Get-Process -Id $PID).SessionId
+$script:KnownBuckets = @{}
+$script:Cooldown = @{}
+$script:SeenUsb = @{}
+$script:SeenPrintJob = @{}
+$script:SeenPrintEvent = @{}
+$script:LastClipboardHash = $null
+$script:PulseSeconds = [Math]::Max($resolvedPollSeconds * 3, 30)
+$script:LocalAgentLogsEnabled = $resolvedLocalAgentLogsEnabled
+$script:LogPath = $resolvedLogPath
+$script:IncidentArtifactsRoot = $resolvedIncidentArtifactsRoot
+$script:IncidentScreenshotEnabled = $resolvedIncidentScreenshotEnabled
+$script:ScreenshotTypesLoaded = $false
+
+Load-DlpPolicy -Path $resolvedPolicyPath
+Write-EndpointLog ("endpoint-коллектор запущен для {0}" -f $script:ApiBase)
+
+while ($true) {
+    try {
+        if (-not $script:Policy.defaults.enabled) {
+            Start-Sleep -Seconds $resolvedPollSeconds
+            continue
+        }
+
+        try {
+            $clipboardText = Get-Clipboard -Raw -ErrorAction SilentlyContinue
+            if ($clipboardText) {
+                $clipboardHash = Get-StringHash -Value $clipboardText
+                if ($clipboardHash -and $clipboardHash -ne $script:LastClipboardHash) {
+                    $script:LastClipboardHash = $clipboardHash
+                    Send-EndpointSignalHeartbeat -SignalType 'clipboard_change' -Data @{
+                        clipboardHash = $clipboardHash
+                        clipboardLength = $clipboardText.Length
+                    }
+                    Evaluate-ClipboardRules -ClipboardText $clipboardText -ClipboardHash $clipboardHash
+                }
+            }
+        }
+        catch {
+        }
+
+        try {
+            $usbDrives = Get-CimInstance Win32_LogicalDisk -Filter "DriveType=2" -ErrorAction SilentlyContinue
+            $currentUsb = @{}
+            foreach ($drive in @($usbDrives)) {
+                $deviceId = [string]$drive.DeviceID
+                if (-not $deviceId) { continue }
+                $currentUsb[$deviceId] = $true
+                if (-not $script:SeenUsb.ContainsKey($deviceId)) {
+                    $script:SeenUsb[$deviceId] = (Get-Date).ToUniversalTime()
+                    $volumeName = [string]$drive.VolumeName
+                    Send-EndpointSignalHeartbeat -SignalType 'usb_insert' -Data @{
+                        driveLetter = $deviceId
+                        volumeName  = $volumeName
+                    }
+                    Evaluate-UsbRules -DriveLetter $deviceId -VolumeName $volumeName
+                }
+            }
+
+            foreach ($known in @($script:SeenUsb.Keys)) {
+                if (-not $currentUsb.ContainsKey($known)) {
+                    $script:SeenUsb.Remove($known)
+                }
+            }
+        }
+        catch {
+        }
+
+        try {
+            $printJobs = Get-CimInstance Win32_PrintJob -ErrorAction SilentlyContinue
+            foreach ($job in @($printJobs)) {
+                $jobId = [string]$job.JobId
+                if (-not $jobId) { continue }
+                if ($script:SeenPrintJob.ContainsKey($jobId)) { continue }
+                $script:SeenPrintJob[$jobId] = (Get-Date).ToUniversalTime()
+
+                $printerName = Get-PrintJobPrinterName -JobName ([string]$job.Name) -FallbackPrinterName ([string]$job.DriverName)
+                $documentName = [string]$job.Document
+                $owner = [string]$job.Owner
+                $documentNameOriginal = $documentName
+
+                if (Test-DocumentNameNeedsFallback -Value $documentName) {
+                    $eventDocumentName = Get-BetterDocumentNameFromPrintServiceEvents -JobId $jobId -Owner $owner -PrinterName $printerName
+                    if ($eventDocumentName) {
+                        $documentName = $eventDocumentName
+                    }
+                }
+
+                Send-EndpointSignalHeartbeat -SignalType 'print_job' -Data @{
+                    printerName  = $printerName
+                    documentName = $documentName
+                    documentNameOriginal = $documentNameOriginal
+                    owner        = $owner
+                    printJobId   = $jobId
+                }
+                Evaluate-PrintRules -PrinterName $printerName -DocumentName $documentName -Owner $owner
+            }
+
+            $cleanupBefore = (Get-Date).ToUniversalTime().AddHours(-8)
+            foreach ($k in @($script:SeenPrintJob.Keys)) {
+                $ts = [datetime]$script:SeenPrintJob[$k]
+                if ($ts -lt $cleanupBefore) {
+                    $script:SeenPrintJob.Remove($k)
+                }
+            }
+        }
+        catch {
+        }
+
+        try {
+            $printEvents = Get-WinEvent -FilterHashtable @{
+                LogName = 'Microsoft-Windows-PrintService/Operational'
+                Id = 307
+                StartTime = (Get-Date).AddMinutes(-20)
+            } -MaxEvents 200 -ErrorAction SilentlyContinue
+
+            foreach ($event in @($printEvents)) {
+                $recordId = [string]$event.RecordId
+                if (-not $recordId) { continue }
+                if ($script:SeenPrintEvent.ContainsKey($recordId)) { continue }
+                $script:SeenPrintEvent[$recordId] = (Get-Date).ToUniversalTime()
+
+                $summary = Get-PrintServiceEventSummary -Event $event
+                $documentName = [string]$summary.DocumentName
+                $owner = [string]$summary.Owner
+                $printerName = [string]$summary.PrinterName
+                $resolvedDocument = Get-PrintServiceDocumentFallback -EventSummary $summary -Owner $owner -PrinterName $printerName
+
+                Write-PrintServiceEventTrace -EventSummary $summary -Phase 'emit' -MatchReason 'raw-scan' -ResolvedDocument $resolvedDocument
+
+                if (-not [string]::IsNullOrWhiteSpace($owner) -and $owner -notlike "*$env:USERNAME*") {
+                    continue
+                }
+
+                Send-EndpointSignalHeartbeat -SignalType 'print_job' -Data @{
+                    printerName  = $printerName
+                    documentName = if ($resolvedDocument) { $resolvedDocument } else { $documentName }
+                    documentNameOriginal = $documentName
+                    owner        = $owner
+                    eventRecordId = $recordId
+                    eventSource = 'printservice-307'
+                }
+                Evaluate-PrintRules -PrinterName $printerName -DocumentName (if ($resolvedDocument) { $resolvedDocument } else { $documentName }) -Owner $owner
+            }
+
+            $cleanupBeforeEvent = (Get-Date).ToUniversalTime().AddHours(-8)
+            foreach ($k in @($script:SeenPrintEvent.Keys)) {
+                $ts = [datetime]$script:SeenPrintEvent[$k]
+                if ($ts -lt $cleanupBeforeEvent) {
+                    $script:SeenPrintEvent.Remove($k)
+                }
+            }
+        }
+        catch {
+        }
+    }
+    catch {
+        Write-EndpointLog ("ошибка коллектора: {0}" -f $_.Exception.Message)
+    }
+
+    Start-Sleep -Seconds $resolvedPollSeconds
+}

install-kit-awindows-20260427-211240/windows/dlp-policy.example.json

@@ -0,0 +1,99 @@
+{
+  "version": 1,
+  "defaults": {
+    "enabled": true,
+    "cooldownSeconds": 300,
+    "action": "log",
+    "severity": "low"
+  },
+  "rules": [
+    {
+      "id": "personal-web-during-workhours",
+      "enabled": true,
+      "cooldownSeconds": 600,
+      "action": "alert",
+      "severity": "medium",
+      "message": "Личные ресурсы в рабочее время",
+      "when": {
+        "categoryGroups": ["personal"],
+        "hourFrom": 9,
+        "hourTo": 19
+      }
+    },
+    {
+      "id": "high-risk-cloud-storage",
+      "enabled": true,
+      "cooldownSeconds": 900,
+      "action": "alert",
+      "severity": "high",
+      "message": "Подозрительный доступ к облачному хранилищу",
+      "when": {
+        "domains": [
+          "dropbox.com",
+          "drive.google.com",
+          "mega.nz",
+          "onedrive.live.com",
+          "disk.yandex.ru"
+        ]
+      }
+    },
+    {
+      "id": "anonymizer-and-vpn-web",
+      "enabled": true,
+      "cooldownSeconds": 900,
+      "action": "alert",
+      "severity": "high",
+      "message": "Использование веб-анонимайзеров / VPN-сервисов",
+      "when": {
+        "domains": [
+          "hidemy.name",
+          "2ip.ru",
+          "whoer.net",
+          "protonvpn.com",
+          "nordvpn.com"
+        ]
+      }
+    }
+  ],
+  "endpoint": {
+    "clipboard": [
+      {
+        "id": "clipboard-sensitive-keywords",
+        "enabled": true,
+        "cooldownSeconds": 300,
+        "action": "alert",
+        "severity": "high",
+        "message": "В буфере обнаружены чувствительные ключевые слова",
+        "minLength": 20,
+        "regexPatterns": [
+          "(?i)парол(ь|и)",
+          "(?i)password",
+          "(?i)secret",
+          "(?i)cvv",
+          "(?i)паспорт"
+        ]
+      }
+    ],
+    "usb": [
+      {
+        "id": "usb-media-connected",
+        "enabled": true,
+        "cooldownSeconds": 300,
+        "action": "alert",
+        "severity": "medium",
+        "message": "Подключен съемный носитель"
+      }
+    ],
+    "print": [
+      {
+        "id": "print-sensitive-docs",
+        "enabled": true,
+        "cooldownSeconds": 300,
+        "action": "alert",
+        "severity": "high",
+        "message": "Печать документа с признаками чувствительных данных",
+        "documentRegex": "(?i)(salary|зарплат|passport|паспорт|договор|contract)"
+      }
+    ]
+  }
+}

install-kit-awindows-20260427-211240/windows/hardening-recovery.ps1

@@ -0,0 +1,146 @@
+[CmdletBinding()]
+param(
+    [string]$ConfigPath = 'C:\ProgramData\AWatch-rus\deployment-config.json',
+    [string]$ServerHost,
+    [int]$ServerPort,
+    [ValidateSet('http', 'https')]
+    [string]$ServerScheme,
+    [string[]]$Users,
+    [string]$UserListPath,
+    [string]$Domain,
+    [string]$InstallRoot,
+    [string]$StateRoot,
+    [int]$PollSeconds,
+    [int]$PulseSeconds,
+    [int]$RecoveryIntervalSeconds,
+    [bool]$AfkEnabled,
+    [bool]$WindowEnabled,
+    [bool]$LocalAgentLogsEnabled,
+    [bool]$IncidentCaptureEnabled,
+    [bool]$IncidentScreenshotEnabled,
+    [string]$IncidentArtifactsRoot,
+    [bool]$LogonMarkerEnabled,
+    [string]$CustomRulesPath,
+    [string]$CustomPolicyPath,
+    [switch]$RepairPackage,
+    [string]$Version,
+    [string]$PackageUrl,
+    [string]$PackageZipPath
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+$modulePath = Join-Path $PSScriptRoot 'ActivityWatch.Windows.Common.psm1'
+Import-Module $modulePath -Force
+
+Assert-Administrator
+
+$existingConfig = $null
+if (Test-Path -LiteralPath $ConfigPath) {
+    $existingConfig = Read-ActivityWatchDeploymentConfig -Path $ConfigPath
+}
+
+if (-not $existingConfig -and (-not $ServerHost)) {
+    throw 'deployment-config.json отсутствует. Укажите -ServerHost и параметры пользователей либо сначала выполните скрипт развёртывания.'
+}
+
+$effectiveStateRoot = if ($StateRoot) { $StateRoot } elseif ($existingConfig) { [string]$existingConfig.paths.stateRoot } else { 'C:\ProgramData\AWatch-rus' }
+$effectiveInstallRoot = if ($InstallRoot) { $InstallRoot } elseif ($existingConfig) { [string]$existingConfig.paths.installRoot } else { 'C:\Program Files\AWatch-rus\bin' }
+$effectiveLogsRoot = if ($existingConfig) { [string]$existingConfig.paths.logsRoot } else { Join-Path $effectiveStateRoot 'logs' }
+$effectiveConfigPath = if ($ConfigPath) { $ConfigPath } else { Join-Path $effectiveStateRoot 'deployment-config.json' }
+$effectiveLaunchScript = Join-Path $effectiveStateRoot 'launch-watchers.ps1'
+$effectiveRecoveryScript = Join-Path $effectiveStateRoot 'recovery-loop.ps1'
+$effectiveCollector = Join-Path $effectiveStateRoot 'browser-domains-native-collector.ps1'
+$effectiveEndpointCollector = if ($existingConfig -and $existingConfig.paths.PSObject.Properties.Name -contains 'endpointCollectorScript') { [string]$existingConfig.paths.endpointCollectorScript } else { Join-Path $effectiveStateRoot 'dlp-endpoint-signals-collector.ps1' }
+$effectiveRules = Join-Path $effectiveStateRoot 'web-category-rules.json'
+$effectivePolicy = if ($existingConfig -and $existingConfig.paths.PSObject.Properties.Name -contains 'policyPath') { [string]$existingConfig.paths.policyPath } else { Join-Path $effectiveStateRoot 'dlp-policy.json' }
+
+$effectiveServerHost = if ($ServerHost) { $ServerHost } elseif ($existingConfig) { [string]$existingConfig.server.host } else { $null }
+$effectiveServerPort = if ($PSBoundParameters.ContainsKey('ServerPort')) { $ServerPort } elseif ($existingConfig) { [int]$existingConfig.server.port } else { 5600 }
+$effectiveServerScheme = if ($ServerScheme) { $ServerScheme } elseif ($existingConfig) { [string]$existingConfig.server.scheme } else { 'http' }
+$effectivePollSeconds = if ($PSBoundParameters.ContainsKey('PollSeconds')) { $PollSeconds } elseif ($existingConfig) { [int]$existingConfig.collector.pollSeconds } else { 5 }
+$effectivePulseSeconds = if ($PSBoundParameters.ContainsKey('PulseSeconds')) { $PulseSeconds } elseif ($existingConfig) { [int]$existingConfig.collector.pulseSeconds } else { 30 }
+$effectiveRecoveryInterval = if ($PSBoundParameters.ContainsKey('RecoveryIntervalSeconds')) { $RecoveryIntervalSeconds } elseif ($existingConfig) { [int]$existingConfig.recovery.intervalSeconds } else { 180 }
+$effectiveAfkEnabled = if ($PSBoundParameters.ContainsKey('AfkEnabled')) { [bool]$AfkEnabled } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'collectors' -and $existingConfig.collectors.PSObject.Properties.Name -contains 'afkEnabled') { [bool]$existingConfig.collectors.afkEnabled } else { $true }
+$effectiveWindowEnabled = if ($PSBoundParameters.ContainsKey('WindowEnabled')) { [bool]$WindowEnabled } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'collectors' -and $existingConfig.collectors.PSObject.Properties.Name -contains 'windowEnabled') { [bool]$existingConfig.collectors.windowEnabled } else { $true }
+$effectiveLocalAgentLogsEnabled = if ($PSBoundParameters.ContainsKey('LocalAgentLogsEnabled')) { [bool]$LocalAgentLogsEnabled } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'logging' -and $existingConfig.logging.PSObject.Properties.Name -contains 'localAgentLogsEnabled') { [bool]$existingConfig.logging.localAgentLogsEnabled } else { $false }
+$effectiveIncidentCaptureEnabled = if ($PSBoundParameters.ContainsKey('IncidentCaptureEnabled')) { [bool]$IncidentCaptureEnabled } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'incidentCapture' -and $existingConfig.incidentCapture.PSObject.Properties.Name -contains 'enabled') { [bool]$existingConfig.incidentCapture.enabled } else { $true }
+$effectiveIncidentScreenshotEnabled = if ($PSBoundParameters.ContainsKey('IncidentScreenshotEnabled')) { [bool]$IncidentScreenshotEnabled } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'incidentCapture' -and $existingConfig.incidentCapture.PSObject.Properties.Name -contains 'screenshotEnabled') { [bool]$existingConfig.incidentCapture.screenshotEnabled } else { $true }
+$effectiveIncidentArtifactsRoot = if ($PSBoundParameters.ContainsKey('IncidentArtifactsRoot') -and $IncidentArtifactsRoot) { $IncidentArtifactsRoot } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'incidentCapture' -and $existingConfig.incidentCapture.PSObject.Properties.Name -contains 'artifactsRoot') { [string]$existingConfig.incidentCapture.artifactsRoot } else { Join-Path $effectiveStateRoot 'incident-artifacts' }
+$effectiveLogonMarkerEnabled = if ($PSBoundParameters.ContainsKey('LogonMarkerEnabled')) { [bool]$LogonMarkerEnabled } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'sessionEvents' -and $existingConfig.sessionEvents.PSObject.Properties.Name -contains 'logonEnabled') { [bool]$existingConfig.sessionEvents.logonEnabled } else { $true }
+$effectiveVersion = if ($Version) { $Version } elseif ($existingConfig) { [string]$existingConfig.package.version } else { 'v0.13.2' }
+
+$effectiveUsers = if ($Users -or $UserListPath) {
+    Normalize-ActivityWatchUsers -Users $Users -UserListPath $UserListPath -Domain $Domain
+}
+elseif ($existingConfig) {
+    @($existingConfig.userTasks | ForEach-Object { [string]$_.userId })
+}
+else {
+    throw 'Не указаны целевые пользователи.'
+}
+
+New-ActivityWatchDirectory -Path $effectiveStateRoot
+New-ActivityWatchDirectory -Path $effectiveLogsRoot
+
+if ($RepairPackage) {
+    $workingRoot = Join-Path $env:TEMP 'activitywatch-windows-deploy'
+    $backupRoot = Join-Path $effectiveStateRoot 'backups'
+    $archivePath = Get-ActivityWatchArchive -PackageZipPath $PackageZipPath -PackageUrl $PackageUrl -Version $effectiveVersion -WorkingRoot $workingRoot
+    Install-ActivityWatchPackage -ArchivePath $archivePath -InstallRoot $effectiveInstallRoot -WorkingRoot $workingRoot -BackupRoot $backupRoot | Out-Null
+}
+
+Get-ActivityWatchExecutableMap -InstallRoot $effectiveInstallRoot | Out-Null
+
+$assetResult = Copy-ActivityWatchCollectorAssets `
+    -CollectorScriptSource (Join-Path $PSScriptRoot 'browser-domains-native-collector.ps1') `
+    -EndpointCollectorScriptSource (Join-Path $PSScriptRoot 'dlp-endpoint-signals-collector.ps1') `
+    -SessionCollectorScriptSource (Join-Path $PSScriptRoot 'worktime-session-collector.ps1') `
+    -ExampleRulesSource (Join-Path $PSScriptRoot 'web-category-rules.example.json') `
+    -ExamplePolicySource (Join-Path $PSScriptRoot 'dlp-policy.example.json') `
+    -StateRoot $effectiveStateRoot `
+    -CustomRulesSource $CustomRulesPath `
+    -CustomPolicySource $CustomPolicyPath
+
+$taskDefinitions = New-ActivityWatchUserTaskDefinitions -Users $effectiveUsers
+Write-ActivityWatchLaunchScript -Path $effectiveLaunchScript -ConfigPath $effectiveConfigPath
+Write-ActivityWatchRecoveryScript -Path $effectiveRecoveryScript -ConfigPath $effectiveConfigPath
+
+$config = New-ActivityWatchDeploymentConfig `
+    -ServerHost $effectiveServerHost `
+    -ServerPort $effectiveServerPort `
+    -ServerScheme $effectiveServerScheme `
+    -InstallRoot $effectiveInstallRoot `
+    -StateRoot $effectiveStateRoot `
+    -LogsRoot $effectiveLogsRoot `
+    -CollectorScript $effectiveCollector `
+    -EndpointCollectorScript $effectiveEndpointCollector `
+    -SessionCollectorScript $effectiveSessionCollector `
+    -RulesPath $effectiveRules `
+    -PolicyPath $effectivePolicy `
+    -PollSeconds $effectivePollSeconds `
+    -PulseSeconds $effectivePulseSeconds `
+    -RecoveryIntervalSeconds $effectiveRecoveryInterval `
+    -AfkEnabled $effectiveAfkEnabled `
+    -WindowEnabled $effectiveWindowEnabled `
+    -LocalAgentLogsEnabled $effectiveLocalAgentLogsEnabled `
+    -IncidentCaptureEnabled $effectiveIncidentCaptureEnabled `
+    -IncidentScreenshotEnabled $effectiveIncidentScreenshotEnabled `
+    -IncidentArtifactsRoot $effectiveIncidentArtifactsRoot `
+    -LogonMarkerEnabled $effectiveLogonMarkerEnabled `
+    -LaunchScriptPath $effectiveLaunchScript `
+    -RecoveryScriptPath $effectiveRecoveryScript `
+    -UserTasks $taskDefinitions `
+    -PackageVersion $effectiveVersion
+
+Write-ActivityWatchDeploymentConfig -Config $config -Path $effectiveConfigPath
+Remove-LegacyActivityWatchEntries
+Set-ActivityWatchAcl -InstallRoot $effectiveInstallRoot -StateRoot $effectiveStateRoot -LogsRoot $effectiveLogsRoot
+Register-ActivityWatchUserTasks -TaskDefinitions $taskDefinitions -LaunchScriptPath $effectiveLaunchScript -ConfigPath $effectiveConfigPath
+Register-ActivityWatchRecoveryTask -TaskName $config.recovery.taskName -RecoveryScriptPath $effectiveRecoveryScript -ConfigPath $effectiveConfigPath
+Start-ActivityWatchTasks -TaskDefinitions $taskDefinitions -RecoveryTaskName $config.recovery.taskName
+
+Write-Host 'Укрепление и восстановление ActivityWatch завершены.'
+Write-Host "Конфигурация: $effectiveConfigPath"
+Write-Host "Пользователи восстановлены: $($effectiveUsers -join ', ')"

install-kit-awindows-20260427-211240/windows/migrate-awatch-rus-paths.ps1

@@ -0,0 +1,214 @@
+[CmdletBinding(SupportsShouldProcess = $true)]
+param(
+    [string]$OldInstallRoot = 'C:\Program Files\ActivityWatch-Phase2',
+    [string]$OldStateRoot = 'C:\ProgramData\ActivityWatch-Phase2',
+    [string]$NewInstallRoot = 'C:\Program Files\AWatch-rus\bin',
+    [string]$NewStateRoot = 'C:\ProgramData\AWatch-rus',
+    [string]$ToolkitRoot = 'C:\Program Files\AWatch-rus\windows',
+    [switch]$SkipValidation
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+$modulePath = Join-Path $PSScriptRoot 'ActivityWatch.Windows.Common.psm1'
+Import-Module $modulePath -Force
+
+Assert-Administrator
+
+function Copy-DirectoryContents {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Source,
+        [Parameter(Mandatory = $true)]
+        [string]$Destination
+    )
+
+    if (-not (Test-Path -LiteralPath $Source)) {
+        return
+    }
+
+    New-ActivityWatchDirectory -Path $Destination
+    Copy-Item -Path (Join-Path $Source '*') -Destination $Destination -Recurse -Force
+}
+
+function Copy-IfExists {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Source,
+        [Parameter(Mandatory = $true)]
+        [string]$Destination
+    )
+
+    if (Test-Path -LiteralPath $Source) {
+        Copy-Item -LiteralPath $Source -Destination $Destination -Force
+    }
+}
+
+function Convert-PathValue {
+    param(
+        [AllowNull()]
+        [string]$Value
+    )
+
+    if ([string]::IsNullOrWhiteSpace($Value)) {
+        return $Value
+    }
+
+    return $Value.Replace($OldInstallRoot, $NewInstallRoot).Replace($OldStateRoot, $NewStateRoot)
+}
+
+function Stop-AWatchTaskSet {
+    foreach ($task in @(Get-ScheduledTask | Where-Object { $_.TaskName -eq 'ActivityWatch Recovery' -or $_.TaskName -like 'ActivityWatch Launch *' })) {
+        Stop-ScheduledTask -TaskName $task.TaskName -ErrorAction SilentlyContinue
+    }
+}
+
+function Get-ExistingAWatchConfig {
+    $newConfigPath = Join-Path $NewStateRoot 'deployment-config.json'
+    $oldConfigPath = Join-Path $OldStateRoot 'deployment-config.json'
+
+    if (Test-Path -LiteralPath $oldConfigPath) {
+        return [pscustomobject]@{
+            Path   = $oldConfigPath
+            Config = Read-ActivityWatchDeploymentConfig -Path $oldConfigPath
+        }
+    }
+
+    if (Test-Path -LiteralPath $newConfigPath) {
+        return [pscustomobject]@{
+            Path   = $newConfigPath
+            Config = Read-ActivityWatchDeploymentConfig -Path $newConfigPath
+        }
+    }
+
+    throw "Не найден deployment-config.json ни в $OldStateRoot, ни в $NewStateRoot."
+}
+
+function Update-AWatchConfigPaths {
+    param(
+        [Parameter(Mandatory = $true)]
+        [pscustomobject]$Config
+    )
+
+    $logsRoot = Join-Path $NewStateRoot 'logs'
+    $Config.paths.installRoot = $NewInstallRoot
+    $Config.paths.stateRoot = $NewStateRoot
+    $Config.paths.logsRoot = $logsRoot
+    $Config.paths.collectorScript = Join-Path $NewStateRoot 'browser-domains-native-collector.ps1'
+    $Config.paths.endpointCollectorScript = Join-Path $NewStateRoot 'dlp-endpoint-signals-collector.ps1'
+    if ($Config.paths.PSObject.Properties.Name -contains 'sessionCollectorScript') {
+        $Config.paths.sessionCollectorScript = Join-Path $NewStateRoot 'worktime-session-collector.ps1'
+    }
+    $Config.paths.rulesPath = Join-Path $NewStateRoot 'web-category-rules.json'
+    if ($Config.paths.PSObject.Properties.Name -contains 'policyPath') {
+        $Config.paths.policyPath = Join-Path $NewStateRoot 'dlp-policy.json'
+    }
+    $Config.paths.launchScript = Join-Path $NewStateRoot 'launch-watchers.ps1'
+    $Config.paths.recoveryScript = Join-Path $NewStateRoot 'recovery-loop.ps1'
+
+    if ($Config.PSObject.Properties.Name -contains 'incidentCapture' -and $Config.incidentCapture.PSObject.Properties.Name -contains 'artifactsRoot') {
+        $Config.incidentCapture.artifactsRoot = Convert-PathValue -Value ([string]$Config.incidentCapture.artifactsRoot)
+    }
+
+    return $Config
+}
+
+$existing = Get-ExistingAWatchConfig
+$backupRoot = Join-Path $NewStateRoot ('migration-backups\' + (Get-Date -Format 'yyyyMMdd-HHmmss'))
+$newConfigPath = Join-Path $NewStateRoot 'deployment-config.json'
+$newLogsRoot = Join-Path $NewStateRoot 'logs'
+
+$summary = [ordered]@{
+    sourceConfig = $existing.Path
+    oldInstallRoot = $OldInstallRoot
+    oldStateRoot = $OldStateRoot
+    newInstallRoot = $NewInstallRoot
+    newStateRoot = $NewStateRoot
+    backupRoot = $backupRoot
+    actions = @(
+        'stop ActivityWatch scheduled tasks',
+        'backup old/new install and state directories',
+        'copy old install/state contents to AWatch-rus paths',
+        'rewrite deployment-config.json paths',
+        'regenerate launcher/recovery scripts',
+        're-register scheduled tasks',
+        'run validate-deployment.ps1'
+    )
+}
+
+if ($WhatIfPreference) {
+    return [pscustomobject]$summary
+}
+
+if ($PSCmdlet.ShouldProcess($env:COMPUTERNAME, 'Миграция ActivityWatch Windows/RDP путей в AWatch-rus')) {
+    New-ActivityWatchDirectory -Path $NewStateRoot
+    New-ActivityWatchDirectory -Path $backupRoot
+
+    Stop-AWatchTaskSet
+
+    foreach ($item in @(
+            @{ Source = $OldInstallRoot; Name = 'old-install' },
+            @{ Source = $OldStateRoot; Name = 'old-state' },
+            @{ Source = $NewInstallRoot; Name = 'new-install' },
+            @{ Source = $NewStateRoot; Name = 'new-state' }
+        )) {
+        if (Test-Path -LiteralPath $item.Source) {
+            Copy-Item -LiteralPath $item.Source -Destination (Join-Path $backupRoot $item.Name) -Recurse -Force
+        }
+    }
+
+    Copy-DirectoryContents -Source $OldInstallRoot -Destination $NewInstallRoot
+    Copy-DirectoryContents -Source $OldStateRoot -Destination $NewStateRoot
+    New-ActivityWatchDirectory -Path $newLogsRoot
+
+    foreach ($file in @(
+            'browser-domains-native-collector.ps1',
+            'dlp-endpoint-signals-collector.ps1',
+            'worktime-session-collector.ps1',
+            'web-category-rules.example.json',
+            'dlp-policy.example.json'
+        )) {
+        Copy-IfExists -Source (Join-Path $ToolkitRoot $file) -Destination (Join-Path $NewStateRoot $file)
+    }
+
+    Copy-IfExists -Source (Join-Path $OldStateRoot 'web-category-rules.json') -Destination (Join-Path $NewStateRoot 'web-category-rules.json')
+    Copy-IfExists -Source (Join-Path $OldStateRoot 'dlp-policy.json') -Destination (Join-Path $NewStateRoot 'dlp-policy.json')
+    if (-not (Test-Path -LiteralPath (Join-Path $NewStateRoot 'web-category-rules.json'))) {
+        Copy-IfExists -Source (Join-Path $NewStateRoot 'web-category-rules.example.json') -Destination (Join-Path $NewStateRoot 'web-category-rules.json')
+    }
+    if (-not (Test-Path -LiteralPath (Join-Path $NewStateRoot 'dlp-policy.json'))) {
+        Copy-IfExists -Source (Join-Path $NewStateRoot 'dlp-policy.example.json') -Destination (Join-Path $NewStateRoot 'dlp-policy.json')
+    }
+
+    $config = Update-AWatchConfigPaths -Config $existing.Config
+    Write-ActivityWatchDeploymentConfig -Config $config -Path $newConfigPath
+    Write-ActivityWatchLaunchScript -Path $config.paths.launchScript -ConfigPath $newConfigPath
+    Write-ActivityWatchRecoveryScript -Path $config.paths.recoveryScript -ConfigPath $newConfigPath
+
+    $taskDefinitions = @($config.userTasks)
+    Set-ActivityWatchAcl -InstallRoot $NewInstallRoot -StateRoot $NewStateRoot -LogsRoot $newLogsRoot
+    Register-ActivityWatchUserTasks -TaskDefinitions $taskDefinitions -LaunchScriptPath $config.paths.launchScript -ConfigPath $newConfigPath
+    Register-ActivityWatchRecoveryTask -TaskName $config.recovery.taskName -RecoveryScriptPath $config.paths.recoveryScript -ConfigPath $newConfigPath
+    Start-ActivityWatchTasks -TaskDefinitions $taskDefinitions -RecoveryTaskName $config.recovery.taskName
+    Start-Sleep -Seconds 5
+
+    if (-not $SkipValidation) {
+        $validateScript = Join-Path $ToolkitRoot 'validate-deployment.ps1'
+        if (-not (Test-Path -LiteralPath $validateScript)) {
+            $validateScript = Join-Path $PSScriptRoot 'validate-deployment.ps1'
+        }
+        $report = & $validateScript -ConfigPath $newConfigPath
+        if (-not [bool]$report.overallOk) {
+            throw "Миграция выполнена, но validation завершился ошибкой. Backup: $backupRoot"
+        }
+    }
+
+    [pscustomobject]@{
+        migrated = $true
+        backupRoot = $backupRoot
+        configPath = $newConfigPath
+        installRoot = $NewInstallRoot
+        stateRoot = $NewStateRoot
+    }
+}

install-kit-awindows-20260427-211240/windows/validate-deployment.ps1

@@ -0,0 +1,117 @@
+[CmdletBinding()]
+param(
+    [string]$ConfigPath = 'C:\ProgramData\AWatch-rus\deployment-config.json'
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+$modulePath = Join-Path $PSScriptRoot 'ActivityWatch.Windows.Common.psm1'
+Import-Module $modulePath -Force
+
+$config = Read-ActivityWatchDeploymentConfig -Path $ConfigPath
+$installRoot = [string]$config.paths.installRoot
+$stateRoot = [string]$config.paths.stateRoot
+$collectorScript = [string]$config.paths.collectorScript
+$endpointCollectorScript = if ($config.paths.PSObject.Properties.Name -contains 'endpointCollectorScript') { [string]$config.paths.endpointCollectorScript } else { Join-Path $stateRoot 'dlp-endpoint-signals-collector.ps1' }
+$sessionCollectorScript = if ($config.paths.PSObject.Properties.Name -contains 'sessionCollectorScript') { [string]$config.paths.sessionCollectorScript } else { Join-Path $stateRoot 'worktime-session-collector.ps1' }
+$rulesPath = [string]$config.paths.rulesPath
+$policyPath = if ($config.paths.PSObject.Properties.Name -contains 'policyPath') { [string]$config.paths.policyPath } else { Join-Path $stateRoot 'dlp-policy.json' }
+$launchScript = [string]$config.paths.launchScript
+$recoveryScript = [string]$config.paths.recoveryScript
+
+$afkExpected = if ($config.PSObject.Properties.Name -contains 'collectors' -and $config.collectors.PSObject.Properties.Name -contains 'afkEnabled') { [bool]$config.collectors.afkEnabled } else { $true }
+$windowExpected = if ($config.PSObject.Properties.Name -contains 'collectors' -and $config.collectors.PSObject.Properties.Name -contains 'windowEnabled') { [bool]$config.collectors.windowEnabled } else { $true }
+$requiredFiles = @(
+    $collectorScript,
+    $endpointCollectorScript,
+    $sessionCollectorScript,
+    $rulesPath,
+    $policyPath,
+    $launchScript,
+    $recoveryScript,
+    $ConfigPath
+)
+if ($afkExpected) {
+    $requiredFiles += (Join-Path $installRoot 'aw-watcher-afk\aw-watcher-afk.exe')
+}
+if ($windowExpected) {
+    $requiredFiles += (Join-Path $installRoot 'aw-watcher-window\aw-watcher-window.exe')
+}
+
+$missingFiles = @(
+    $requiredFiles | Where-Object { -not (Test-Path -LiteralPath $_) }
+)
+
+$processNames = @()
+if ($afkExpected) { $processNames += 'aw-watcher-afk' }
+if ($windowExpected) { $processNames += 'aw-watcher-window' }
+$runningProcesses = @()
+if ($processNames.Count -gt 0) {
+    $runningProcesses = Get-Process -Name $processNames -ErrorAction SilentlyContinue | Select-Object Name, Id, SessionId
+}
+$sessionCollectorProcesses = Get-CimInstance Win32_Process -ErrorAction SilentlyContinue |
+    Where-Object {
+        ($_.Name -ieq 'powershell.exe' -or $_.Name -ieq 'pwsh.exe') -and
+        $_.CommandLine -match [Regex]::Escape($sessionCollectorScript)
+    } |
+    Select-Object Name, ProcessId, SessionId, CommandLine
+
+$taskNames = @()
+if ($config.userTasks) {
+    $taskNames += @($config.userTasks | ForEach-Object { [string]$_.launchTaskName })
+}
+$taskNames += [string]$config.recovery.taskName
+$taskNames = $taskNames | Sort-Object -Unique
+
+$tasks = foreach ($taskName in $taskNames) {
+    $task = Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object { $_.TaskName -eq $taskName } | Select-Object -First 1
+    if ($task) {
+        [pscustomobject]@{
+            taskName = $task.TaskName
+            state = [string]$task.State
+            present = $true
+        }
+    }
+    else {
+        [pscustomobject]@{
+            taskName = $taskName
+            state = 'Отсутствует'
+            present = $false
+        }
+    }
+}
+
+$serverUrl = '{0}://{1}:{2}' -f [string]$config.server.scheme, [string]$config.server.host, [int]$config.server.port
+$result = [ordered]@{
+    generatedAtUtc = (Get-Date).ToUniversalTime().ToString('o')
+    configPath = $ConfigPath
+    serverUrl = $serverUrl
+    installRoot = $installRoot
+    stateRoot = $stateRoot
+    files = [ordered]@{
+        required = $requiredFiles
+        missing = $missingFiles
+        ok = ($missingFiles.Count -eq 0)
+    }
+    tasks = [ordered]@{
+        list = $tasks
+        ok = [bool]($tasks.Count -gt 0 -and -not ($tasks | Where-Object { -not $_.present }))
+    }
+    processes = [ordered]@{
+        expected = $processNames
+        list = @($runningProcesses)
+        sessionCollectors = @($sessionCollectorProcesses)
+        ok = [bool](
+            (
+                ($processNames.Count -eq 0) -or
+                (($runningProcesses | Select-Object -ExpandProperty Name -Unique).Count -ge $processNames.Count)
+            ) -and
+            ($sessionCollectorProcesses.Count -ge 1)
+        )
+    }
+}
+
+$result.overallOk = [bool]($result.files.ok -and $result.tasks.ok -and $result.processes.ok)
+
+$result

install-kit-awindows-20260427-211240/windows/web-category-rules.example.json

@@ -0,0 +1,37 @@
+{
+  "version": 1,
+  "description": "Override or extend built-in ActivityWatch web categorization rules.",
+  "rules": [
+    {
+      "name": "work_crm",
+      "group": "work",
+      "domains": [
+        "crm.example.com",
+        "portal.example.org"
+      ]
+    },
+    {
+      "name": "work_erp",
+      "group": "work",
+      "domains": [
+        "erp.example.com",
+        "bi.example.com"
+      ]
+    },
+    {
+      "name": "neutral_training",
+      "group": "neutral",
+      "domains": [
+        "wiki.example.net",
+        "kb.example.net"
+      ]
+    },
+    {
+      "name": "personal_social",
+      "group": "personal",
+      "domains": [
+        "social.example.net"
+      ]
+    }
+  ]
+}

install-kit-awindows-20260427-211240/windows/worktime-session-collector.ps1

@@ -0,0 +1,154 @@
+param(
+    [string]$ConfigPath = 'C:\ProgramData\AWatch-rus\deployment-config.json',
+    [string]$Hostname,
+    [int]$PollSeconds = 30
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+function Get-Config {
+    param([string]$Path)
+
+    if (-not (Test-Path -LiteralPath $Path)) {
+        throw "Конфигурация не найдена: $Path"
+    }
+
+    Get-Content -LiteralPath $Path -Raw | ConvertFrom-Json
+}
+
+function Invoke-AwJsonPost {
+    param(
+        [Parameter(Mandatory = $true)][string]$Uri,
+        [Parameter(Mandatory = $true)][string]$Json
+    )
+
+    $bytes = [Text.Encoding]::UTF8.GetBytes($Json)
+    Invoke-RestMethod -Method Post -Uri $Uri -ContentType 'application/json; charset=utf-8' -Body $bytes | Out-Null
+}
+
+function Ensure-Bucket {
+    param(
+        [Parameter(Mandatory = $true)][string]$ApiBase,
+        [Parameter(Mandatory = $true)][string]$BucketId,
+        [Parameter(Mandatory = $true)][string]$HostnameValue
+    )
+
+    try {
+        Invoke-RestMethod -Method Get -Uri "$ApiBase/buckets/$BucketId" | Out-Null
+        return
+    }
+    catch {
+    }
+
+    $body = @{
+        client   = 'aw-worktime-session-collector'
+        type     = 'aw.worktime.session'
+        hostname = $HostnameValue
+    } | ConvertTo-Json -Compress
+
+    Invoke-AwJsonPost -Uri "$ApiBase/buckets/$BucketId" -Json $body
+}
+
+function Get-SessionRecords {
+    $records = @()
+
+    try {
+        $lines = quser 2>$null
+        if (-not $lines) {
+            return @()
+        }
+
+        foreach ($line in ($lines | Select-Object -Skip 1)) {
+            $clean = ($line -replace '^\s*>?', '').Trim()
+            if (-not $clean) {
+                continue
+            }
+
+            $parts = $clean -split '\s+'
+            if ($parts.Count -lt 4) {
+                continue
+            }
+
+            $sessionName = ''
+            $sessionIdIndex = 2
+            if ($parts[1] -match '^\d+$') {
+                $sessionIdIndex = 1
+            }
+            else {
+                $sessionName = $parts[1]
+            }
+
+            $sessionId = 0
+            if ($parts[$sessionIdIndex] -match '^\d+$') {
+                $sessionId = [int]$parts[$sessionIdIndex]
+            }
+
+            $records += [pscustomobject]@{
+                username    = $parts[0]
+                sessionName = $sessionName
+                sessionId   = $sessionId
+                state       = $parts[$sessionIdIndex + 1]
+            }
+        }
+    }
+    catch {
+    }
+
+    return $records
+}
+
+$cfg = Get-Config -Path $ConfigPath
+$hostValue = if ($Hostname) { $Hostname } else { [string]$env:COMPUTERNAME }
+$apiBase = '{0}://{1}:{2}/api/0' -f [string]$cfg.server.scheme, [string]$cfg.server.host, [string]$cfg.server.port
+$bucketId = 'aw-worktime-sessions_' + $hostValue
+$pulse = 120
+$sleepSec = if ($PollSeconds -gt 0) {
+    $PollSeconds
+}
+elseif ($cfg.collector -and $cfg.collector.pollSeconds) {
+    [int]$cfg.collector.pollSeconds
+}
+else {
+    30
+}
+
+Ensure-Bucket -ApiBase $apiBase -BucketId $bucketId -HostnameValue $hostValue
+
+while ($true) {
+    $now = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss.fffZ')
+    $records = Get-SessionRecords
+    if (-not $records -or $records.Count -eq 0) {
+        $records = @([pscustomobject]@{
+            username    = $env:USERNAME
+            sessionName = ''
+            sessionId   = (Get-Process -Id $PID).SessionId
+            state       = 'Unknown'
+        })
+    }
+
+    foreach ($rec in $records) {
+        $payload = @{
+            timestamp = $now
+            duration  = 0
+            data      = @{
+                username    = [string]$rec.username
+                userId      = "$($env:USERDOMAIN)\$($rec.username)"
+                sessionId   = [int]$rec.sessionId
+                sessionName = [string]$rec.sessionName
+                state       = [string]$rec.state
+                active      = ($rec.state -match 'Active')
+                hostname    = $hostValue
+                source      = 'worktime-session-collector'
+            }
+        } | ConvertTo-Json -Depth 6 -Compress
+
+        try {
+            Invoke-AwJsonPost -Uri "$apiBase/buckets/$bucketId/heartbeat?pulsetime=$pulse" -Json $payload
+        }
+        catch {
+        }
+    }
+
+    Start-Sleep -Seconds $sleepSec
+}

patch.sh

@@ -0,0 +1,157 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+mkdir -p windows/installkit/innosetup
+mkdir -p docs/windows
+
+cat > windows/installkit/innosetup/innosetup-rdp-package-filelist.md <<'EOF'
+# Inno Setup: файл-лист для Windows RDP deployment
+
+Дата актуализации: 2026-05-02 (UTC).
+
+## Что это за документ
+
+Этот файл — **чеклист упаковки** для Inno Setup.
+
+- Он описывает, **что класть** в инсталлятор.
+- Он описывает, **что не класть** (генерируется уже на целевом хосте).
+- Он **не меняет** текущие deploy-скрипты и логику проекта.
+
+## Важное уточнение по единой Windows-директории
+
+Чтобы исключить путаницу:
+
+1. InnoSetup и Ansible используют один набор путей.
+2. Toolkit лежит в `{app}\windows` = `C:\Program Files\AWatch-rus\windows`.
+3. Бинарники ActivityWatch лежат в `C:\Program Files\AWatch-rus\bin`.
+4. Runtime-конфиг, collectors, логи и отчёты лежат в `C:\ProgramData\AWatch-rus`.
+
+## 1) Обязательные файлы для Inno Setup пакета
+
+### 1.1 PowerShell-модуль
+- `windows/ActivityWatch.Windows.Common.psd1`
+- `windows/ActivityWatch.Windows.Common.psm1`
+
+### 1.2 Скрипты деплоя и сопровождения
+- `windows/deploy-single-user.ps1`
+- `windows/deploy-domain-users.ps1`
+- `windows/deploy-ensemble.ps1`
+- `windows/hardening-recovery.ps1`
+- `windows/validate-deployment.ps1`
+- `windows/migrate-awatch-rus-paths.ps1`
+
+### 1.3 Коллекторы
+- `windows/worktime-session-collector.ps1` (RDP/session presence)
+- `windows/browser-domains-native-collector.ps1`
+- `windows/dlp-endpoint-signals-collector.ps1`
+
+### 1.4 Шаблоны конфигурации
+- `windows/web-category-rules.example.json`
+- `windows/dlp-policy.example.json`
+
+## 2) Бинарный payload ActivityWatch
+
+Нужен один из двух режимов:
+
+- **Online**: скрипты скачивают `activitywatch-<version>-windows-x86_64.zip` из GitHub Releases.
+- **Offline**: ZIP добавляется в пакет (например `payload\activitywatch-v0.13.2-windows-x86_64.zip`) и передаётся через `-PackageZipPath`.
+
+## 3) Что НЕ включать в installer как статические файлы
+
+Эти файлы/папки появляются на целевом Windows-хосте во время/после деплоя:
+
+- `C:\ProgramData\AWatch-rus\deployment-config.json`
+- `C:\ProgramData\AWatch-rus\web-category-rules.json`
+- `C:\ProgramData\AWatch-rus\dlp-policy.json`
+- `C:\ProgramData\AWatch-rus\logs\*`
+- `%LOCALAPPDATA%\AWatch-rus\incident-artifacts\*`
+
+## 4) Опционально приложить в операторский install-kit
+
+- `docs/windows/deployment.md`
+- `docs/windows/validation.md`
+- `docs/windows/troubleshooting.md`
+- `docs/windows/ensemble.md`
+
+## 5) Рекомендуемая структура внутри пакета
+
+- `windows\ActivityWatch.Windows.Common.psd1`
+- `windows\ActivityWatch.Windows.Common.psm1`
+- `windows\deploy-single-user.ps1`
+- `windows\deploy-domain-users.ps1`
+- `windows\deploy-ensemble.ps1`
+- `windows\hardening-recovery.ps1`
+- `windows\validate-deployment.ps1`
+- `windows\migrate-awatch-rus-paths.ps1`
+- `windows\worktime-session-collector.ps1`
+- `windows\browser-domains-native-collector.ps1`
+- `windows\dlp-endpoint-signals-collector.ps1`
+- `windows\web-category-rules.example.json`
+- `windows\dlp-policy.example.json`
+- `payload\activitywatch-v0.13.2-windows-x86_64.zip` (только для offline-режима)
+
+## 6) Контроль перед сборкой .iss
+
+1. Все файлы из раздела 1 присутствуют.
+2. Выбран режим payload: online или offline.
+3. Для offline-режима ZIP действительно лежит в `payload\`.
+4. В .iss есть запуск нужного deploy-сценария (`deploy-ensemble.ps1` или `deploy-domain-users.ps1`).
+5. После установки запускается `validate-deployment.ps1` с сохранением JSON-отчёта.
+EOF
+
+cat > docs/windows/innosetup-rdp-package-filelist.md <<'EOF'
+windows/installkit/innosetup/innosetup-rdp-package-filelist.md
+EOF
+
+cat > windows/installkit/innosetup/AWatch-rus-InnoSetup.iss <<'EOF'
+#define MyAppName "AWatch-rus InstallKit"
+#define MyAppVersion "1.0.0"
+#define MyAppPublisher "AWatch-rus"
+#define MyAppExeName "powershell.exe"
+
+[Setup]
+AppId={{6D6A1F74-0F4F-4A57-B5E3-1C2C2F56C0E9}
+AppName={#MyAppName}
+AppVersion={#MyAppVersion}
+AppPublisher={#MyAppPublisher}
+DefaultDirName={autopf}\AWatch-rus
+DefaultGroupName=AWatch-rus
+OutputDir=.
+OutputBaseFilename=AWatch-rus-InstallKit
+Compression=lzma
+SolidCompression=yes
+ArchitecturesInstallIn64BitMode=x64
+PrivilegesRequired=admin
+
+[Languages]
+Name: "russian"; MessagesFile: "compiler:Languages\Russian.isl"
+
+[Files]
+Source: "..\..\ActivityWatch.Windows.Common.psd1"; DestDir: "{app}\windows"; Flags: ignoreversion
+Source: "..\..\ActivityWatch.Windows.Common.psm1"; DestDir: "{app}\windows"; Flags: ignoreversion
+Source: "..\..\deploy-single-user.ps1"; DestDir: "{app}\windows"; Flags: ignoreversion
+Source: "..\..\deploy-domain-users.ps1"; DestDir: "{app}\windows"; Flags: ignoreversion
+Source: "..\..\deploy-ensemble.ps1"; DestDir: "{app}\windows"; Flags: ignoreversion
+Source: "..\..\hardening-recovery.ps1"; DestDir: "{app}\windows"; Flags: ignoreversion
+Source: "..\..\validate-deployment.ps1"; DestDir: "{app}\windows"; Flags: ignoreversion
+Source: "..\..\worktime-session-collector.ps1"; DestDir: "{app}\windows"; Flags: ignoreversion
+Source: "..\..\browser-domains-native-collector.ps1"; DestDir: "{app}\windows"; Flags: ignoreversion
+Source: "..\..\dlp-endpoint-signals-collector.ps1"; DestDir: "{app}\windows"; Flags: ignoreversion
+Source: "..\..\web-category-rules.example.json"; DestDir: "{app}\windows"; Flags: ignoreversion
+Source: "..\..\dlp-policy.example.json"; DestDir: "{app}\windows"; Flags: ignoreversion
+Source: "payload\activitywatch-v0.13.2-windows-x86_64.zip"; DestDir: "{app}\payload"; Flags: ignoreversion skipifsourcedoesntexist
+Source: "innosetup-rdp-package-filelist.md"; DestDir: "{app}\windows\installkit\innosetup"; Flags: ignoreversion
+
+[Run]
+Filename: "powershell.exe"; Parameters: "-NoProfile -ExecutionPolicy Bypass -File ""{app}\windows\deploy-ensemble.ps1"""; Flags: runhidden
+Filename: "powershell.exe"; Parameters: "-NoProfile -ExecutionPolicy Bypass -File ""{app}\windows\validate-deployment.ps1"""; Flags: runhidden
+EOF
+
+mkdir -p windows/installkit/innosetup/payload
+touch windows/installkit/innosetup/payload/.gitkeep
+
+echo "patched"
+echo "windows/installkit/innosetup/innosetup-rdp-package-filelist.md"
+echo "docs/windows/innosetup-rdp-package-filelist.md"
+echo "windows/installkit/innosetup/AWatch-rus-InnoSetup.iss"
+echo "windows/installkit/innosetup/payload/.gitkeep"

proxmox/push-aw-artifacts.sh

@@ -25,11 +25,16 @@ for file_name in \
   activitywatch-server.service \
   aw-server.env.example \
   aw-ru-patch.js \
-  aw-sw-cleanup.js
+  aw-sw-cleanup.js \
+  aw-host-groups.json
 do
   pct push "$CT_ID" "$PROJECT_ROOT/aw-server/$file_name" "/root/bootstrap/$file_name"
 done
 
+pct exec "$CT_ID" -- mkdir -p /root/bootstrap/settings
+pct push "$CT_ID" "$PROJECT_ROOT/aw-server/settings/classes-worktime.json" "/root/bootstrap/settings/classes-worktime.json"
+pct push "$CT_ID" "$PROJECT_ROOT/aw-server/settings/views-default.json" "/root/bootstrap/settings/views-default.json"
+
 if [ -n "${AW_SERVER_VERSION:-}" ] &&
    [ -n "${AW_SERVER_DOWNLOAD_URL:-}" ] &&
    [ -n "${AW_SERVER_BIND_HOST:-}" ] &&

scripts/install_aw_console_ssh_logger.sh

@@ -0,0 +1,375 @@
+#!/usr/bin/env sh
+set -eu
+
+SERVER_HOST="10.10.10.13"
+SERVER_PORT="5600"
+POLL_INTERVAL="5"
+INSTALL_ROOT="${HOME}/.local/opt/aw-console-ssh-logger"
+BIN_DIR="${HOME}/.local/bin"
+STATE_DIR="${HOME}/.local/state/aw-console-ssh-logger"
+LOG_DIR="${HOME}/.local/state/aw-console-ssh-logger/logs"
+SYSTEMD_USER_DIR="${HOME}/.config/systemd/user"
+BASHRC="${HOME}/.bashrc"
+BASH_PROFILE="${HOME}/.bash_profile"
+
+usage() {
+    cat <<'EOF'
+Usage: install_aw_console_ssh_logger.sh [options]
+
+Options:
+  --server-host HOST     AW server host (default: 10.10.10.13)
+  --server-port PORT     AW server port (default: 5600)
+  --poll-interval SEC    Poll interval for history/session tracking (default: 5)
+  -h, --help             Show this help
+EOF
+}
+
+while [ "$#" -gt 0 ]; do
+    case "$1" in
+        --server-host)
+            SERVER_HOST="$2"
+            shift 2
+            ;;
+        --server-port)
+            SERVER_PORT="$2"
+            shift 2
+            ;;
+        --poll-interval)
+            POLL_INTERVAL="$2"
+            shift 2
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        *)
+            echo "Unknown option: $1" >&2
+            usage >&2
+            exit 1
+            ;;
+    esac
+done
+
+mkdir -p "${INSTALL_ROOT}" "${BIN_DIR}" "${STATE_DIR}" "${LOG_DIR}" "${SYSTEMD_USER_DIR}"
+
+write_file() {
+    target="$1"
+    mkdir -p "$(dirname "${target}")"
+    cat > "${target}"
+}
+
+write_file "${INSTALL_ROOT}/config.json" <<EOF
+{
+  "server_host": "${SERVER_HOST}",
+  "server_port": ${SERVER_PORT},
+  "poll_interval_seconds": ${POLL_INTERVAL},
+  "history_file": "${HOME}/.bash_history",
+  "state_dir": "${STATE_DIR}",
+  "hostname": "$(hostname -s)",
+  "username": "$(id -un)"
+}
+EOF
+
+write_file "${INSTALL_ROOT}/collector.py" <<'EOF'
+#!/usr/bin/env python3
+import datetime as dt
+import json
+import os
+import pathlib
+import shutil
+import socket
+import subprocess
+import time
+import urllib.error
+import urllib.request
+
+
+def to_iso(ts: float) -> str:
+    return dt.datetime.fromtimestamp(ts, tz=dt.timezone.utc).isoformat(timespec="milliseconds").replace("+00:00", "Z")
+
+
+class Collector:
+    def __init__(self, cfg):
+        self.cfg = cfg
+        self.server = f"http://{cfg['server_host']}:{cfg['server_port']}/api/0"
+        self.host = cfg.get("hostname") or socket.gethostname().split(".")[0]
+        self.user = cfg.get("username") or os.environ.get("USER", "unknown")
+        self.history_bucket = f"aw-console-commands_{self.host}"
+        self.ssh_bucket = f"aw-ssh-sessions_{self.host}"
+        self.history_path = pathlib.Path(cfg["history_file"]).expanduser()
+        self.state_dir = pathlib.Path(cfg["state_dir"]).expanduser()
+        self.state_dir.mkdir(parents=True, exist_ok=True)
+        self.history_state_path = self.state_dir / "history_state.json"
+        self.ssh_state_path = self.state_dir / "ssh_state.json"
+        self.history_state = self._read_json(self.history_state_path, {"inode": None, "offset": 0})
+        self.ssh_state = self._read_json(self.ssh_state_path, {"active": {}})
+        self.poll_interval = max(1, int(cfg.get("poll_interval_seconds", 5)))
+        self.ensured_buckets = set()
+
+    def _read_json(self, path, default):
+        if not path.exists():
+            return default
+        try:
+            return json.loads(path.read_text(encoding="utf-8"))
+        except Exception:
+            return default
+
+    def _write_json(self, path, payload):
+        path.write_text(json.dumps(payload, ensure_ascii=True), encoding="utf-8")
+
+    def _heartbeat(self, bucket_id, payload):
+        self._ensure_bucket(bucket_id)
+        url = f"{self.server}/buckets/{bucket_id}/heartbeat?pulsetime=60"
+        body = json.dumps(payload, ensure_ascii=False).encode("utf-8")
+        req = urllib.request.Request(url, data=body, headers={"Content-Type": "application/json"}, method="POST")
+        try:
+            with urllib.request.urlopen(req, timeout=10):
+                return True
+        except urllib.error.URLError:
+            return False
+
+    def _ensure_bucket(self, bucket_id):
+        if bucket_id in self.ensured_buckets:
+            return True
+
+        if bucket_id == self.history_bucket:
+            bucket_type = "app.console.command"
+        elif bucket_id == self.ssh_bucket:
+            bucket_type = "app.ssh.session"
+        else:
+            bucket_type = "app.custom"
+
+        payload = {
+            "client": "aw-console-ssh-logger",
+            "type": bucket_type,
+            "hostname": self.host
+        }
+        url = f"{self.server}/buckets/{bucket_id}"
+        body = json.dumps(payload, ensure_ascii=False).encode("utf-8")
+        req = urllib.request.Request(url, data=body, headers={"Content-Type": "application/json"}, method="POST")
+        try:
+            with urllib.request.urlopen(req, timeout=10):
+                self.ensured_buckets.add(bucket_id)
+                return True
+        except urllib.error.URLError:
+            return False
+
+    def process_history(self):
+        if not self.history_path.exists():
+            return
+
+        st = self.history_path.stat()
+        inode = int(st.st_ino)
+        size = int(st.st_size)
+
+        if self.history_state.get("inode") != inode or int(self.history_state.get("offset", 0)) > size:
+            self.history_state = {"inode": inode, "offset": 0}
+
+        offset = int(self.history_state.get("offset", 0))
+        with self.history_path.open("r", encoding="utf-8", errors="replace") as f:
+            f.seek(offset)
+            lines = f.readlines()
+            new_offset = f.tell()
+
+        pending_ts = None
+        now_iso = to_iso(time.time())
+        for raw in lines:
+            line = raw.rstrip("\n")
+            if not line:
+                continue
+            if line.startswith("#") and line[1:].isdigit():
+                pending_ts = int(line[1:])
+                continue
+
+            ts = pending_ts if pending_ts is not None else time.time()
+            pending_ts = None
+            event = {
+                "timestamp": to_iso(ts),
+                "duration": 0,
+                "data": {
+                    "source": "bash_history",
+                    "user": self.user,
+                    "host": self.host,
+                    "command": line
+                }
+            }
+            self._heartbeat(self.history_bucket, event)
+
+        self.history_state["inode"] = inode
+        self.history_state["offset"] = new_offset
+        self._write_json(self.history_state_path, self.history_state)
+
+    def get_sessions(self):
+        who_bin = shutil.which("who") or "/usr/bin/who"
+        try:
+            out = subprocess.check_output([who_bin, "-u"], text=True, stderr=subprocess.DEVNULL)
+        except Exception:
+            return {}
+
+        sessions = {}
+        for row in out.splitlines():
+            parts = row.split()
+            if len(parts) < 2:
+                continue
+            user = parts[0]
+            tty = next((p for p in parts[1:] if p.startswith("pts/") or p.startswith("tty")), "")
+            if not tty.startswith("pts/"):
+                continue
+            sessions[tty] = {
+                "user": user,
+                "tty": tty,
+                "raw": row
+            }
+        return sessions
+
+    def process_ssh_sessions(self):
+        active_prev = dict(self.ssh_state.get("active", {}))
+        active_now = self.get_sessions()
+
+        for tty, meta in active_now.items():
+            if tty in active_prev:
+                continue
+            event = {
+                "timestamp": to_iso(time.time()),
+                "duration": 0,
+                "data": {
+                    "source": "who",
+                    "event": "login",
+                    "user": meta["user"],
+                    "tty": tty,
+                    "host": self.host,
+                    "raw": meta["raw"]
+                }
+            }
+            self._heartbeat(self.ssh_bucket, event)
+
+        for tty, meta in active_prev.items():
+            if tty in active_now:
+                continue
+            event = {
+                "timestamp": to_iso(time.time()),
+                "duration": 0,
+                "data": {
+                    "source": "who",
+                    "event": "logout",
+                    "user": meta.get("user", self.user),
+                    "tty": tty,
+                    "host": self.host,
+                    "raw": meta.get("raw", "")
+                }
+            }
+            self._heartbeat(self.ssh_bucket, event)
+
+        self.ssh_state["active"] = active_now
+        self._write_json(self.ssh_state_path, self.ssh_state)
+
+    def run(self):
+        while True:
+            self.process_history()
+            self.process_ssh_sessions()
+            time.sleep(self.poll_interval)
+
+
+def main():
+    config_path = pathlib.Path(os.environ.get("AW_CONSOLE_SSH_CONFIG", "~/.local/opt/aw-console-ssh-logger/config.json")).expanduser()
+    cfg = json.loads(config_path.read_text(encoding="utf-8"))
+    Collector(cfg).run()
+
+
+if __name__ == "__main__":
+    main()
+EOF
+chmod 0755 "${INSTALL_ROOT}/collector.py"
+
+write_file "${BIN_DIR}/aw-console-ssh-logger-start" <<EOF
+#!/usr/bin/env sh
+set -eu
+export AW_CONSOLE_SSH_CONFIG="${INSTALL_ROOT}/config.json"
+mkdir -p "${LOG_DIR}"
+if pgrep -u "$(id -u)" -f "collector.py" >/dev/null 2>&1; then
+    exit 0
+fi
+nohup "${INSTALL_ROOT}/collector.py" >> "${LOG_DIR}/collector.log" 2>&1 &
+EOF
+chmod 0755 "${BIN_DIR}/aw-console-ssh-logger-start"
+
+write_file "${BIN_DIR}/aw-console-ssh-logger-stop" <<'EOF'
+#!/usr/bin/env sh
+set -eu
+pkill -u "$(id -u)" -f "aw-console-ssh-logger/collector.py" || true
+EOF
+chmod 0755 "${BIN_DIR}/aw-console-ssh-logger-stop"
+
+write_file "${BIN_DIR}/aw-console-ssh-logger-status" <<'EOF'
+#!/usr/bin/env sh
+set -eu
+pgrep -a -u "$(id -u)" -f "aw-console-ssh-logger/collector.py" || true
+EOF
+chmod 0755 "${BIN_DIR}/aw-console-ssh-logger-status"
+
+write_file "${SYSTEMD_USER_DIR}/aw-console-ssh-logger.service" <<EOF
+[Unit]
+Description=AW console and SSH logger (user space)
+After=default.target
+
+[Service]
+Type=simple
+Environment=AW_CONSOLE_SSH_CONFIG=${INSTALL_ROOT}/config.json
+ExecStart=${INSTALL_ROOT}/collector.py
+Restart=always
+RestartSec=3
+
+[Install]
+WantedBy=default.target
+EOF
+
+HIST_BLOCK_START="# >>> AW_CONSOLE_SSH_HISTORY >>>"
+HIST_BLOCK_END="# <<< AW_CONSOLE_SSH_HISTORY <<<"
+if ! grep -qF "${HIST_BLOCK_START}" "${BASHRC}" 2>/dev/null; then
+    cat >> "${BASHRC}" <<EOF
+
+${HIST_BLOCK_START}
+export HISTSIZE=200000
+export HISTFILESIZE=200000
+export HISTTIMEFORMAT="%s "
+shopt -s histappend
+case "\${PROMPT_COMMAND-}" in
+  *"history -a; history -n;"*) ;;
+  "") PROMPT_COMMAND="history -a; history -n;" ;;
+  *) PROMPT_COMMAND="history -a; history -n; \${PROMPT_COMMAND}" ;;
+esac
+${HIST_BLOCK_END}
+EOF
+fi
+
+AUTO_BLOCK_START="# >>> AW_CONSOLE_SSH_AUTOSTART >>>"
+AUTO_BLOCK_END="# <<< AW_CONSOLE_SSH_AUTOSTART <<<"
+if ! grep -qF "${AUTO_BLOCK_START}" "${BASH_PROFILE}" 2>/dev/null; then
+    cat >> "${BASH_PROFILE}" <<EOF
+
+${AUTO_BLOCK_START}
+if [ -x "${BIN_DIR}/aw-console-ssh-logger-start" ]; then
+  "${BIN_DIR}/aw-console-ssh-logger-start" || true
+fi
+${AUTO_BLOCK_END}
+EOF
+fi
+
+started_with_systemd="0"
+if command -v systemctl >/dev/null 2>&1; then
+    systemctl --user daemon-reload >/dev/null 2>&1 || true
+    systemctl --user enable --now aw-console-ssh-logger.service >/dev/null 2>&1 || true
+    if systemctl --user is-active --quiet aw-console-ssh-logger.service >/dev/null 2>&1; then
+        started_with_systemd="1"
+    fi
+fi
+
+if [ "${started_with_systemd}" != "1" ]; then
+    "${BIN_DIR}/aw-console-ssh-logger-start"
+fi
+
+echo "Installed AW console/ssh logger"
+echo "Server target: ${SERVER_HOST}:${SERVER_PORT}"
+echo "Collector: ${INSTALL_ROOT}/collector.py"
+echo "State dir: ${STATE_DIR}"
+echo "Log file: ${LOG_DIR}/collector.log"

scripts/install_aw_linux_client.sh

@@ -0,0 +1,174 @@
+#!/usr/bin/env sh
+set -eu
+
+VERSION="0.13.2"
+SERVER_HOST="10.10.10.13"
+SERVER_PORT="5600"
+INSTALL_BASE="${HOME}/.local/opt/activitywatch"
+BIN_DIR="${HOME}/.local/bin"
+AUTOSTART_DIR="${HOME}/.config/autostart"
+CONFIG_ROOT="${XDG_CONFIG_HOME:-$HOME/.config}/activitywatch"
+FORCE="0"
+
+usage() {
+    cat <<'EOF'
+Usage: install_aw_linux_client.sh [options]
+
+Options:
+  --server-host HOST     Remote AW server host (default: 10.10.10.13)
+  --server-port PORT     Remote AW server port (default: 5600)
+  --version VERSION      ActivityWatch version (default: 0.13.2)
+  --install-base PATH    Install root (default: ~/.local/opt/activitywatch)
+  --force                Reinstall selected version even if it exists
+  -h, --help             Show this help
+EOF
+}
+
+while [ "$#" -gt 0 ]; do
+    case "$1" in
+        --server-host)
+            SERVER_HOST="$2"
+            shift 2
+            ;;
+        --server-port)
+            SERVER_PORT="$2"
+            shift 2
+            ;;
+        --version)
+            VERSION="$2"
+            shift 2
+            ;;
+        --install-base)
+            INSTALL_BASE="$2"
+            shift 2
+            ;;
+        --force)
+            FORCE="1"
+            shift
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        *)
+            echo "Unknown option: $1" >&2
+            usage >&2
+            exit 1
+            ;;
+    esac
+done
+
+ARCHIVE="activitywatch-v${VERSION}-linux-x86_64.zip"
+DOWNLOAD_URL="https://github.com/ActivityWatch/activitywatch/releases/download/v${VERSION}/${ARCHIVE}"
+VERSION_DIR="${INSTALL_BASE}/v${VERSION}"
+CURRENT_LINK="${INSTALL_BASE}/current"
+TMP_DIR="$(mktemp -d)"
+ARCHIVE_PATH="${TMP_DIR}/${ARCHIVE}"
+BUNDLE_DIR=""
+
+cleanup() {
+    rm -rf "${TMP_DIR}"
+}
+trap cleanup EXIT INT TERM
+
+download_archive() {
+    if command -v curl >/dev/null 2>&1; then
+        curl -fL "${DOWNLOAD_URL}" -o "${ARCHIVE_PATH}"
+        return
+    fi
+
+    if command -v wget >/dev/null 2>&1; then
+        wget -O "${ARCHIVE_PATH}" "${DOWNLOAD_URL}"
+        return
+    fi
+
+    echo "Neither curl nor wget is available" >&2
+    exit 1
+}
+
+extract_archive() {
+    mkdir -p "${VERSION_DIR}"
+
+    if command -v unzip >/dev/null 2>&1; then
+        unzip -q "${ARCHIVE_PATH}" -d "${VERSION_DIR}"
+        return
+    fi
+
+    python3 -m zipfile -e "${ARCHIVE_PATH}" "${VERSION_DIR}"
+}
+
+resolve_bundle_dir() {
+    if [ -x "${VERSION_DIR}/aw-qt" ]; then
+        BUNDLE_DIR="${VERSION_DIR}"
+        return
+    fi
+
+    if [ -x "${VERSION_DIR}/activitywatch/aw-qt" ]; then
+        BUNDLE_DIR="${VERSION_DIR}/activitywatch"
+        return
+    fi
+
+    echo "Cannot find aw-qt inside ${VERSION_DIR}" >&2
+    exit 1
+}
+
+write_file() {
+    target="$1"
+    mkdir -p "$(dirname "${target}")"
+    cat > "${target}"
+}
+
+if [ -d "${VERSION_DIR}" ] && [ "${FORCE}" != "1" ]; then
+    echo "Version directory already exists: ${VERSION_DIR}" >&2
+    echo "Use --force to reinstall the same version." >&2
+    exit 1
+fi
+
+rm -rf "${VERSION_DIR}"
+mkdir -p "${INSTALL_BASE}" "${BIN_DIR}" "${AUTOSTART_DIR}" "${CONFIG_ROOT}"
+
+download_archive
+extract_archive
+resolve_bundle_dir
+rm -f "${CURRENT_LINK}"
+ln -sfn "${BUNDLE_DIR}" "${CURRENT_LINK}"
+
+write_file "${CONFIG_ROOT}/aw-client/aw-client.toml" <<EOF
+[server]
+hostname = "${SERVER_HOST}"
+port = "${SERVER_PORT}"
+EOF
+
+write_file "${CONFIG_ROOT}/aw-qt/aw-qt.toml" <<'EOF'
+[aw-qt]
+autostart_modules = ["aw-watcher-afk", "aw-watcher-window"]
+EOF
+
+write_file "${BIN_DIR}/activitywatch-remote-aw" <<EOF
+#!/usr/bin/env sh
+set -eu
+AW_HOME="${CURRENT_LINK}"
+export NO_PROXY="\${NO_PROXY:+\${NO_PROXY},}127.0.0.1,localhost,${SERVER_HOST}"
+exec "\${AW_HOME}/aw-qt"
+EOF
+chmod 0755 "${BIN_DIR}/activitywatch-remote-aw"
+
+write_file "${AUTOSTART_DIR}/activitywatch-remote-aw.desktop" <<EOF
+[Desktop Entry]
+Type=Application
+Version=1.0
+Name=ActivityWatch Remote
+Comment=Start ActivityWatch watchers and report to ${SERVER_HOST}:${SERVER_PORT}
+Exec=${BIN_DIR}/activitywatch-remote-aw
+Terminal=false
+X-GNOME-Autostart-enabled=true
+EOF
+
+"${CURRENT_LINK}/aw-qt" --help >/dev/null 2>&1 || true
+"${CURRENT_LINK}/aw-watcher-afk/aw-watcher-afk" --help >/dev/null 2>&1 || true
+"${CURRENT_LINK}/aw-watcher-window/aw-watcher-window" --help >/dev/null 2>&1 || true
+
+echo "Installed ActivityWatch ${VERSION} into ${VERSION_DIR}"
+echo "Remote server target: ${SERVER_HOST}:${SERVER_PORT}"
+echo "Launcher: ${BIN_DIR}/activitywatch-remote-aw"
+echo "Autostart: ${AUTOSTART_DIR}/activitywatch-remote-aw.desktop"

scripts/install_aw_linux_remote_worker.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env sh
+set -eu
+
+SERVER_HOST="10.10.10.13"
+SERVER_PORT="5600"
+POLL_INTERVAL="5"
+AW_VERSION="0.13.2"
+
+usage() {
+    cat <<'EOF'
+Usage: install_aw_linux_remote_worker.sh [options]
+
+Options:
+  --server-host HOST     Remote AW server host (default: 10.10.10.13)
+  --server-port PORT     Remote AW server port (default: 5600)
+  --poll-interval SEC    Poll interval for Linux loggers (default: 5)
+  --version VERSION      ActivityWatch version for GUI watcher bundle (default: 0.13.2)
+  -h, --help             Show this help
+EOF
+}
+
+while [ "$#" -gt 0 ]; do
+    case "$1" in
+        --server-host)
+            SERVER_HOST="$2"
+            shift 2
+            ;;
+        --server-port)
+            SERVER_PORT="$2"
+            shift 2
+            ;;
+        --poll-interval)
+            POLL_INTERVAL="$2"
+            shift 2
+            ;;
+        --version)
+            AW_VERSION="$2"
+            shift 2
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        *)
+            echo "Unknown option: $1" >&2
+            usage >&2
+            exit 1
+            ;;
+    esac
+done
+
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+
+sh "${SCRIPT_DIR}/install_aw_linux_client.sh" \
+    --server-host "${SERVER_HOST}" \
+    --server-port "${SERVER_PORT}" \
+    --version "${AW_VERSION}"
+
+sh "${SCRIPT_DIR}/install_aw_console_ssh_logger.sh" \
+    --server-host "${SERVER_HOST}" \
+    --server-port "${SERVER_PORT}" \
+    --poll-interval "${POLL_INTERVAL}"
+
+sh "${SCRIPT_DIR}/install_aw_linux_web_category_logger.sh" \
+    --server-host "${SERVER_HOST}" \
+    --server-port "${SERVER_PORT}" \
+    --poll-interval "${POLL_INTERVAL}"
+
+echo "Linux remote worker full-stack install completed."
+echo "Expected buckets on AW server:"
+echo "  - aw-watcher-window_$(hostname -s)"
+echo "  - aw-watcher-afk_$(hostname -s)"
+echo "  - aw-console-commands_$(hostname -s)"
+echo "  - aw-ssh-sessions_$(hostname -s)"
+echo "  - aw-linux-web-context_$(hostname -s)"
+echo "  - aw-detmir-web-category_$(hostname -s)"

scripts/install_aw_linux_web_category_logger.sh

@@ -0,0 +1,367 @@
+#!/usr/bin/env sh
+set -eu
+
+SERVER_HOST="10.10.10.13"
+SERVER_PORT="5600"
+POLL_INTERVAL="5"
+INSTALL_ROOT="${HOME}/.local/opt/aw-linux-web-category"
+BIN_DIR="${HOME}/.local/bin"
+STATE_DIR="${HOME}/.local/state/aw-linux-web-category"
+LOG_DIR="${HOME}/.local/state/aw-linux-web-category/logs"
+CONFIG_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/aw-linux-web-category"
+SYSTEMD_USER_DIR="${HOME}/.config/systemd/user"
+
+usage() {
+    cat <<'EOF'
+Usage: install_aw_linux_web_category_logger.sh [options]
+
+Options:
+  --server-host HOST     AW server host (default: 10.10.10.13)
+  --server-port PORT     AW server port (default: 5600)
+  --poll-interval SEC    Poll interval in seconds (default: 5)
+  -h, --help             Show this help
+EOF
+}
+
+while [ "$#" -gt 0 ]; do
+    case "$1" in
+        --server-host)
+            SERVER_HOST="$2"
+            shift 2
+            ;;
+        --server-port)
+            SERVER_PORT="$2"
+            shift 2
+            ;;
+        --poll-interval)
+            POLL_INTERVAL="$2"
+            shift 2
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        *)
+            echo "Unknown option: $1" >&2
+            usage >&2
+            exit 1
+            ;;
+    esac
+done
+
+mkdir -p "${INSTALL_ROOT}" "${BIN_DIR}" "${STATE_DIR}" "${LOG_DIR}" "${CONFIG_DIR}" "${SYSTEMD_USER_DIR}"
+
+write_file() {
+    target="$1"
+    mkdir -p "$(dirname "${target}")"
+    cat > "${target}"
+}
+
+write_file "${CONFIG_DIR}/rules.json" <<'EOF'
+{
+  "rules": [
+    {
+      "id": "proxmox-webui",
+      "categoryGroup": "work",
+      "category": "Администрирование",
+      "service": "proxmox",
+      "interface": "https",
+      "port": 8006,
+      "rootDomain": "proxmox-webui",
+      "windowClassRegex": "(?i)(firefox|chromium|chrome|brave|vivaldi|opera)",
+      "titleRegex": "(?i)proxmox\\s+virtual\\s+environment|\\bproxmox\\b|\\bnode\\b.*\\bsummary\\b|\\bvirtual machine\\b"
+    },
+    {
+      "id": "pfsense-webui",
+      "categoryGroup": "work",
+      "category": "Администрирование",
+      "service": "pfsense",
+      "interface": "https",
+      "port": 443,
+      "rootDomain": "pfsense-webui",
+      "windowClassRegex": "(?i)(firefox|chromium|chrome|brave|vivaldi|opera)",
+      "titleRegex": "(?i)\\bpfsense\\b|\\bfirewall\\b"
+    },
+    {
+      "id": "grafana-webui",
+      "categoryGroup": "work",
+      "category": "Администрирование",
+      "service": "grafana",
+      "interface": "https",
+      "port": 3000,
+      "rootDomain": "grafana-webui",
+      "windowClassRegex": "(?i)(firefox|chromium|chrome|brave|vivaldi|opera)",
+      "titleRegex": "(?i)\\bgrafana\\b|dashboard"
+    }
+  ]
+}
+EOF
+
+write_file "${INSTALL_ROOT}/config.json" <<EOF
+{
+  "server_host": "${SERVER_HOST}",
+  "server_port": ${SERVER_PORT},
+  "poll_interval_seconds": ${POLL_INTERVAL},
+  "hostname": "$(hostname -s)",
+  "username": "$(id -un)",
+  "state_dir": "${STATE_DIR}",
+  "rules_path": "${CONFIG_DIR}/rules.json",
+  "raw_bucket": "aw-linux-web-context_$(hostname -s)",
+  "category_bucket": "aw-detmir-web-category_$(hostname -s)"
+}
+EOF
+
+write_file "${INSTALL_ROOT}/collector.py" <<'EOF'
+#!/usr/bin/env python3
+import datetime as dt
+import json
+import os
+import pathlib
+import re
+import socket
+import subprocess
+import time
+import urllib.error
+import urllib.request
+
+
+def iso_now():
+    return dt.datetime.now(tz=dt.timezone.utc).isoformat(timespec="milliseconds").replace("+00:00", "Z")
+
+
+class Collector:
+    def __init__(self, cfg):
+        self.cfg = cfg
+        self.server = f"http://{cfg['server_host']}:{cfg['server_port']}/api/0"
+        self.host = cfg.get("hostname") or socket.gethostname().split(".")[0]
+        self.user = cfg.get("username") or os.environ.get("USER", "unknown")
+        self.poll_interval = max(1, int(cfg.get("poll_interval_seconds", 5)))
+        self.state_dir = pathlib.Path(cfg["state_dir"]).expanduser()
+        self.state_dir.mkdir(parents=True, exist_ok=True)
+        self.raw_bucket = cfg.get("raw_bucket", f"aw-linux-web-context_{self.host}")
+        self.category_bucket = cfg.get("category_bucket", f"aw-detmir-web-category_{self.host}")
+        self.rules = self._load_rules(pathlib.Path(cfg["rules_path"]).expanduser())
+        self.ensured = set()
+        self.last_raw_key = None
+        self.last_category_key = None
+
+    def _load_rules(self, path):
+        if not path.exists():
+            return []
+        payload = json.loads(path.read_text(encoding="utf-8"))
+        rules = []
+        for item in payload.get("rules", []):
+            rules.append({
+                "id": item.get("id", "rule"),
+                "categoryGroup": item.get("categoryGroup", "work"),
+                "category": item.get("category", "Работа"),
+                "service": item.get("service", ""),
+                "interface": item.get("interface", "https"),
+                "port": item.get("port"),
+                "rootDomain": item.get("rootDomain", item.get("service", "web-ui")),
+                "windowClassRegex": re.compile(item.get("windowClassRegex", ".*")),
+                "titleRegex": re.compile(item.get("titleRegex", ".*"))
+            })
+        return rules
+
+    def _run(self, *cmd):
+        try:
+            return subprocess.check_output(cmd, text=True, stderr=subprocess.DEVNULL).strip()
+        except Exception:
+            return ""
+
+    def get_active_window(self):
+        win_id_line = self._run("xprop", "-root", "_NET_ACTIVE_WINDOW")
+        match = re.search(r"0x[0-9a-fA-F]+", win_id_line)
+        if not match:
+            return None
+        win_id = match.group(0)
+        title = self._run("xprop", "-id", win_id, "_NET_WM_NAME")
+        if not title:
+            title = self._run("xprop", "-id", win_id, "WM_NAME")
+        klass = self._run("xprop", "-id", win_id, "WM_CLASS")
+
+        title_match = re.search(r'=\s*"(?P<value>.*)"\s*$', title)
+        if title_match:
+            title = title_match.group("value")
+        else:
+            title = title.split("=", 1)[-1].strip().strip('"')
+
+        class_values = re.findall(r'"([^"]+)"', klass)
+        window_class = " ".join(class_values) if class_values else klass.split("=", 1)[-1].strip()
+
+        if not title and not window_class:
+            return None
+
+        return {
+            "windowId": win_id,
+            "title": title,
+            "windowClass": window_class
+        }
+
+    def ensure_bucket(self, bucket_id, bucket_type):
+        if bucket_id in self.ensured:
+            return True
+        payload = {"client": "aw-linux-web-category", "type": bucket_type, "hostname": self.host}
+        req = urllib.request.Request(
+            f"{self.server}/buckets/{bucket_id}",
+            data=json.dumps(payload).encode("utf-8"),
+            headers={"Content-Type": "application/json"},
+            method="POST",
+        )
+        try:
+            with urllib.request.urlopen(req, timeout=10):
+                self.ensured.add(bucket_id)
+                return True
+        except urllib.error.HTTPError as err:
+            if err.code in (304, 409):
+                self.ensured.add(bucket_id)
+                return True
+            return False
+        except urllib.error.URLError:
+            return False
+
+    def heartbeat(self, bucket_id, payload, bucket_type, pulse=60):
+        if not self.ensure_bucket(bucket_id, bucket_type):
+            return False
+        req = urllib.request.Request(
+            f"{self.server}/buckets/{bucket_id}/heartbeat?pulsetime={pulse}",
+            data=json.dumps(payload, ensure_ascii=False).encode("utf-8"),
+            headers={"Content-Type": "application/json"},
+            method="POST",
+        )
+        try:
+            with urllib.request.urlopen(req, timeout=10):
+                return True
+        except urllib.error.URLError:
+            return False
+
+    def match_rule(self, window):
+        title = window.get("title", "")
+        window_class = window.get("windowClass", "")
+        for rule in self.rules:
+            if rule["windowClassRegex"].search(window_class) and rule["titleRegex"].search(title):
+                return rule
+        return None
+
+    def run(self):
+        while True:
+            window = self.get_active_window()
+            if window:
+                raw_key = f"{window.get('windowClass','')}|{window.get('title','')}"
+                if raw_key != self.last_raw_key:
+                    raw_event = {
+                        "timestamp": iso_now(),
+                        "duration": 0,
+                        "data": {
+                            "source": "x11_active_window",
+                            "username": self.user,
+                            "host": self.host,
+                            "windowId": window.get("windowId", ""),
+                            "windowClass": window.get("windowClass", ""),
+                            "title": window.get("title", "")
+                        }
+                    }
+                    self.heartbeat(self.raw_bucket, raw_event, "aw.linux.web.context", pulse=20)
+                    self.last_raw_key = raw_key
+
+                rule = self.match_rule(window)
+                if rule:
+                    category_key = rule["id"] + "|" + window.get("title", "")
+                    if category_key != self.last_category_key:
+                        event = {
+                            "timestamp": iso_now(),
+                            "duration": 0,
+                            "data": {
+                                "source": "linux_window_title_rule",
+                                "username": self.user,
+                                "host": self.host,
+                                "windowClass": window.get("windowClass", ""),
+                                "title": window.get("title", ""),
+                                "categoryGroup": rule["categoryGroup"],
+                                "category": rule["category"],
+                                "categoryRule": rule["id"],
+                                "service": rule["service"],
+                                "interface": rule["interface"],
+                                "port": rule["port"],
+                                "rootDomain": rule["rootDomain"]
+                            }
+                        }
+                        self.heartbeat(self.category_bucket, event, "aw.web.category", pulse=30)
+                        self.last_category_key = category_key
+
+            time.sleep(self.poll_interval)
+
+
+def main():
+    config_path = pathlib.Path(os.environ.get("AW_LINUX_WEB_CATEGORY_CONFIG", "~/.local/opt/aw-linux-web-category/config.json")).expanduser()
+    cfg = json.loads(config_path.read_text(encoding="utf-8"))
+    Collector(cfg).run()
+
+
+if __name__ == "__main__":
+    main()
+EOF
+chmod 0755 "${INSTALL_ROOT}/collector.py"
+
+write_file "${BIN_DIR}/aw-linux-web-category-start" <<EOF
+#!/usr/bin/env sh
+set -eu
+export AW_LINUX_WEB_CATEGORY_CONFIG="${INSTALL_ROOT}/config.json"
+mkdir -p "${LOG_DIR}"
+if pgrep -u "$(id -u)" -f "aw-linux-web-category/collector.py" >/dev/null 2>&1; then
+    exit 0
+fi
+nohup "${INSTALL_ROOT}/collector.py" >> "${LOG_DIR}/collector.log" 2>&1 &
+EOF
+chmod 0755 "${BIN_DIR}/aw-linux-web-category-start"
+
+write_file "${BIN_DIR}/aw-linux-web-category-stop" <<'EOF'
+#!/usr/bin/env sh
+set -eu
+pkill -u "$(id -u)" -f "aw-linux-web-category/collector.py" || true
+EOF
+chmod 0755 "${BIN_DIR}/aw-linux-web-category-stop"
+
+write_file "${BIN_DIR}/aw-linux-web-category-status" <<'EOF'
+#!/usr/bin/env sh
+set -eu
+pgrep -a -u "$(id -u)" -f "aw-linux-web-category/collector.py" || true
+EOF
+chmod 0755 "${BIN_DIR}/aw-linux-web-category-status"
+
+write_file "${SYSTEMD_USER_DIR}/aw-linux-web-category.service" <<EOF
+[Unit]
+Description=AW Linux web-category logger (user space)
+After=default.target
+
+[Service]
+Type=simple
+Environment=AW_LINUX_WEB_CATEGORY_CONFIG=${INSTALL_ROOT}/config.json
+ExecStart=${INSTALL_ROOT}/collector.py
+Restart=always
+RestartSec=3
+
+[Install]
+WantedBy=default.target
+EOF
+
+started_with_systemd="0"
+if command -v systemctl >/dev/null 2>&1; then
+    systemctl --user daemon-reload >/dev/null 2>&1 || true
+    systemctl --user enable --now aw-linux-web-category.service >/dev/null 2>&1 || true
+    if systemctl --user is-active --quiet aw-linux-web-category.service >/dev/null 2>&1; then
+        started_with_systemd="1"
+    fi
+fi
+
+if [ "${started_with_systemd}" != "1" ]; then
+    "${BIN_DIR}/aw-linux-web-category-start"
+fi
+
+echo "Installed AW Linux web-category logger"
+echo "Server target: ${SERVER_HOST}:${SERVER_PORT}"
+echo "Raw bucket: aw-linux-web-context_$(hostname -s)"
+echo "Category bucket: aw-detmir-web-category_$(hostname -s)"
+echo "Rules: ${CONFIG_DIR}/rules.json"
+echo "Log file: ${LOG_DIR}/collector.log"

scripts/install_aw_pve_webadmin_logger.sh

@@ -0,0 +1,349 @@
+#!/usr/bin/env sh
+set -eu
+
+SERVER_HOST="10.10.10.13"
+SERVER_PORT="5600"
+POLL_INTERVAL="5"
+INSTALL_ROOT="/opt/aw-pve-webadmin-logger"
+STATE_DIR="/var/lib/aw-pve-webadmin-logger"
+LOG_DIR="/var/log/aw-pve-webadmin-logger"
+CONFIG_PATH="/etc/aw-pve-webadmin-logger/config.json"
+SERVICE_PATH="/etc/systemd/system/aw-pve-webadmin-logger.service"
+
+usage() {
+    cat <<'EOF'
+Usage: install_aw_pve_webadmin_logger.sh [options]
+
+Options:
+  --server-host HOST     AW server host (default: 10.10.10.13)
+  --server-port PORT     AW server port (default: 5600)
+  --poll-interval SEC    Poll interval in seconds (default: 5)
+  -h, --help             Show this help
+EOF
+}
+
+while [ "$#" -gt 0 ]; do
+    case "$1" in
+        --server-host)
+            SERVER_HOST="$2"
+            shift 2
+            ;;
+        --server-port)
+            SERVER_PORT="$2"
+            shift 2
+            ;;
+        --poll-interval)
+            POLL_INTERVAL="$2"
+            shift 2
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        *)
+            echo "Unknown option: $1" >&2
+            usage >&2
+            exit 1
+            ;;
+    esac
+done
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo "Run as root" >&2
+    exit 1
+fi
+
+mkdir -p "$INSTALL_ROOT" "$STATE_DIR" "$LOG_DIR" "$(dirname "$CONFIG_PATH")"
+
+HOST_SHORT="$(hostname -s)"
+
+cat > "$CONFIG_PATH" <<EOF
+{
+  "server_host": "${SERVER_HOST}",
+  "server_port": ${SERVER_PORT},
+  "poll_interval_seconds": ${POLL_INTERVAL},
+  "host": "${HOST_SHORT}",
+  "state_dir": "${STATE_DIR}",
+  "access_log": "/var/log/pveproxy/access.log",
+  "tasks_index": "/var/log/pve/tasks/index",
+  "web_bucket": "aw-pve-webadmin-events_${HOST_SHORT}",
+  "task_bucket": "aw-pve-task-events_${HOST_SHORT}",
+  "category_bucket": "aw-detmir-web-category_${HOST_SHORT}"
+}
+EOF
+
+cat > "${INSTALL_ROOT}/collector.py" <<'PY'
+#!/usr/bin/env python3
+import datetime as dt
+import json
+import pathlib
+import re
+import socket
+import time
+import urllib.error
+import urllib.request
+
+ACCESS_RE = re.compile(
+    r'^(?P<ip>\S+)\s+-\s+(?P<user>\S+)\s+\[(?P<ts>[^\]]+)\]\s+"(?P<method>\S+)\s+(?P<path>\S+)\s+(?P<proto>[^"]+)"\s+(?P<status>\d{3})\s+(?P<size>\S+)'
+)
+NOISE_GET_PATHS = [
+    re.compile(r"^/api2/json/version$"),
+    re.compile(r"^/api2/json/cluster/resources$"),
+    re.compile(r"^/api2/json/cluster/tasks$"),
+    re.compile(r"^/api2/json/nodes/[^/]+/(qemu|lxc)/\d+/status/current$"),
+    re.compile(r"^/api2/json/nodes/[^/]+/(qemu|lxc)/\d+/interfaces$"),
+    re.compile(r"^/api2/json/nodes/[^/]+/(qemu|lxc)/\d+/rrddata(\?.*)?$"),
+]
+
+TASK_RE = re.compile(
+    r'^UPID:(?P<node>[^:]+):(?P<pid>[^:]+):(?P<pstart>[^:]+):(?P<start>[^:]+):(?P<action>[^:]*):(?P<target>[^:]*):(?P<user>[^:]*):\s*(?P<msg>.*)$'
+)
+
+
+def iso_now():
+    return dt.datetime.now(tz=dt.timezone.utc).isoformat(timespec="milliseconds").replace("+00:00", "Z")
+
+
+def parse_access_ts(value: str) -> str:
+    try:
+        parsed = dt.datetime.strptime(value, "%d/%b/%Y:%H:%M:%S %z")
+        return parsed.astimezone(dt.timezone.utc).isoformat(timespec="milliseconds").replace("+00:00", "Z")
+    except Exception:
+        return iso_now()
+
+
+class TailState:
+    def __init__(self, path: pathlib.Path):
+        self.path = path
+        self.data = {"inode": None, "offset": 0}
+        if path.exists():
+            try:
+                self.data = json.loads(path.read_text(encoding="utf-8"))
+            except Exception:
+                self.data = {"inode": None, "offset": 0}
+
+    def save(self):
+        self.path.write_text(json.dumps(self.data, ensure_ascii=True), encoding="utf-8")
+
+
+class Collector:
+    def __init__(self, cfg):
+        self.cfg = cfg
+        self.server = f"http://{cfg['server_host']}:{cfg['server_port']}/api/0"
+        self.host = cfg.get("host") or socket.gethostname().split(".")[0]
+        self.poll = max(1, int(cfg.get("poll_interval_seconds", 5)))
+        self.web_bucket = cfg["web_bucket"]
+        self.task_bucket = cfg["task_bucket"]
+        self.category_bucket = cfg.get("category_bucket", f"aw-detmir-web-category_{self.host}")
+        self.access_log = pathlib.Path(cfg["access_log"])
+        self.tasks_index = pathlib.Path(cfg["tasks_index"])
+        self.state_dir = pathlib.Path(cfg["state_dir"])
+        self.state_dir.mkdir(parents=True, exist_ok=True)
+        self.access_state = TailState(self.state_dir / "access_state.json")
+        self.tasks_state = TailState(self.state_dir / "tasks_state.json")
+        self.ensured = set()
+        self.recent = {}
+
+    def ensure_bucket(self, bucket_id: str, bucket_type: str):
+        if bucket_id in self.ensured:
+            return True
+        payload = {"client": "aw-pve-webadmin-logger", "type": bucket_type, "hostname": self.host}
+        req = urllib.request.Request(
+            f"{self.server}/buckets/{bucket_id}",
+            data=json.dumps(payload).encode("utf-8"),
+            headers={"Content-Type": "application/json"},
+            method="POST",
+        )
+        try:
+            with urllib.request.urlopen(req, timeout=10):
+                self.ensured.add(bucket_id)
+                return True
+        except urllib.error.HTTPError as err:
+            if err.code in (304, 409):
+                self.ensured.add(bucket_id)
+                return True
+            return False
+        except urllib.error.URLError:
+            return False
+
+    def heartbeat(self, bucket_id: str, payload: dict, bucket_type: str):
+        if not self.ensure_bucket(bucket_id, bucket_type):
+            return False
+        req = urllib.request.Request(
+            f"{self.server}/buckets/{bucket_id}/heartbeat?pulsetime=60",
+            data=json.dumps(payload, ensure_ascii=False).encode("utf-8"),
+            headers={"Content-Type": "application/json"},
+            method="POST",
+        )
+        try:
+            with urllib.request.urlopen(req, timeout=10):
+                return True
+        except urllib.error.URLError:
+            return False
+
+    def read_new_lines(self, src: pathlib.Path, st: TailState):
+        if not src.exists():
+            return []
+        fs = src.stat()
+        inode = int(fs.st_ino)
+        size = int(fs.st_size)
+        prev_inode = st.data.get("inode")
+        prev_off = int(st.data.get("offset", 0))
+        if prev_inode != inode or prev_off > size:
+            prev_off = 0
+        with src.open("r", encoding="utf-8", errors="replace") as f:
+            f.seek(prev_off)
+            lines = f.readlines()
+            st.data = {"inode": inode, "offset": f.tell()}
+        st.save()
+        return [ln.rstrip("\n") for ln in lines if ln.strip()]
+
+    def process_access(self):
+        for line in self.read_new_lines(self.access_log, self.access_state):
+            m = ACCESS_RE.match(line)
+            if not m:
+                continue
+            user = m.group("user")
+            status = int(m.group("status"))
+            method = m.group("method")
+            path = m.group("path")
+            if path == "/api2/json/version":
+                continue
+            if user == "-" and status < 400:
+                continue
+            # Proxmox UI does high-frequency read polling. Keep real actions and auth failures.
+            if method == "GET" and status == 200 and any(rx.match(path) for rx in NOISE_GET_PATHS):
+                continue
+            event_kind = "auth_failed" if status in (401, 403) else "request"
+            dedup_key = f"{event_kind}|{user}|{m.group('ip')}|{method}|{path}|{status}"
+            now = time.time()
+            if now - float(self.recent.get(dedup_key, 0)) < 30:
+                continue
+            self.recent[dedup_key] = now
+            event = {
+                "timestamp": parse_access_ts(m.group("ts")),
+                "duration": 0,
+                "data": {
+                    "source": "pveproxy_access",
+                    "event_kind": event_kind,
+                    "host": self.host,
+                    "user": user,
+                    "remote_ip": m.group("ip"),
+                    "method": method,
+                    "path": path,
+                    "status": status,
+                    "protocol": m.group("proto"),
+                    "raw": line,
+                },
+            }
+            self.heartbeat(self.web_bucket, event, "app.pve.webadmin.event")
+            category_event = self.classify_access_event(event)
+            if category_event:
+                self.heartbeat(self.category_bucket, category_event, "web.tab.current")
+
+    def process_tasks(self):
+        for line in self.read_new_lines(self.tasks_index, self.tasks_state):
+            m = TASK_RE.match(line)
+            if not m:
+                continue
+            msg = m.group("msg")
+            event = {
+                "timestamp": iso_now(),
+                "duration": 0,
+                "data": {
+                    "source": "pve_tasks_index",
+                    "host": self.host,
+                    "node": m.group("node"),
+                    "upid_pid": m.group("pid"),
+                    "action": m.group("action"),
+                    "target": m.group("target"),
+                    "user": m.group("user"),
+                    "message": msg,
+                    "result": "ok" if " OK" in msg else ("error" if "error" in msg.lower() else "info"),
+                    "raw": line,
+                },
+            }
+            self.heartbeat(self.task_bucket, event, "app.pve.task.event")
+
+    def classify_access_event(self, source_event: dict):
+        data = source_event.get("data", {})
+        path = str(data.get("path") or "")
+        user = str(data.get("user") or "")
+        remote_ip = str(data.get("remote_ip") or "")
+        method = str(data.get("method") or "")
+        status = int(data.get("status") or 0)
+        # Keep only meaningful API/UI actions for worktime.
+        if not path.startswith("/api2/"):
+            return None
+        if method == "GET" and ("/cluster/resources" in path or "/status/current" in path):
+            return None
+        category = "Администрирование"
+        category_group = "work"
+        if status in (401, 403):
+            category = "Безопасность"
+        title = f"Proxmox API {method} {path}"
+        return {
+            "timestamp": source_event.get("timestamp") or iso_now(),
+            "duration": 0,
+            "data": {
+                "source": "pve-webadmin-bridge",
+                "service": "proxmox",
+                "host": self.host,
+                "app": "proxmox-webui",
+                "title": title[:512],
+                "url": f"https://{self.host}:8006{path}",
+                "domain": self.host,
+                "rootDomain": "proxmox-webui",
+                "categoryGroup": category_group,
+                "category": category,
+                "user": user,
+                "remote_ip": remote_ip,
+                "method": method,
+                "status": status,
+            },
+        }
+
+    def run(self):
+        while True:
+            self.process_access()
+            self.process_tasks()
+            time.sleep(self.poll)
+
+
+def main():
+    cfg = json.loads(pathlib.Path("/etc/aw-pve-webadmin-logger/config.json").read_text(encoding="utf-8"))
+    Collector(cfg).run()
+
+
+if __name__ == "__main__":
+    main()
+PY
+
+chmod 0755 "${INSTALL_ROOT}/collector.py"
+
+cat > "$SERVICE_PATH" <<EOF
+[Unit]
+Description=AW PVE web-admin activity logger
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=${INSTALL_ROOT}/collector.py
+Restart=always
+RestartSec=3
+WorkingDirectory=${INSTALL_ROOT}
+StandardOutput=append:${LOG_DIR}/collector.log
+StandardError=append:${LOG_DIR}/collector.log
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+systemctl daemon-reload
+systemctl enable --now aw-pve-webadmin-logger.service
+systemctl --no-pager --full status aw-pve-webadmin-logger.service || true
+
+echo "Installed aw-pve-webadmin-logger"
+echo "Config: ${CONFIG_PATH}"
+echo "Buckets: aw-pve-webadmin-events_${HOST_SHORT}, aw-pve-task-events_${HOST_SHORT}, aw-detmir-web-category_${HOST_SHORT}"

scripts/quality-gate.sh

@@ -9,7 +9,7 @@ find aw-server proxmox -type f -name "*.sh" -print0 | xargs -0 -r -n1 bash -n
 
 echo "[2/3] Shellcheck (if available)"
 if command -v shellcheck >/dev/null 2>&1; then
-  find aw-server proxmox -type f -name "*.sh" -print0 | xargs -0 -r shellcheck
+  find aw-server proxmox -type f -name "*.sh" -print0 | xargs -0 -r shellcheck -e SC1007,SC1090,SC2016
 else
   echo "shellcheck not found, skipping."
 fi

windows/ActivityWatch.Windows.Common.psm1

@@ -5,7 +5,7 @@ function Assert-Administrator {
     $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
     $principal = [Security.Principal.WindowsPrincipal]::new($identity)
     if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
-        throw 'Run this script from an elevated PowerShell session.'
+        throw 'Запустите этот скрипт из PowerShell с правами администратора.'
     }
 }
 
@@ -64,7 +64,7 @@ function Get-ActivityWatchPackageRoot {
         Select-Object -First 1
 
     if (-not $afkBinary) {
-        throw "Cannot find aw-watcher-afk.exe under $ExpandedRoot."
+        throw "Не удалось найти aw-watcher-afk.exe в $ExpandedRoot."
     }
 
     return (Split-Path -Path (Split-Path -Path $afkBinary.FullName -Parent) -Parent)
@@ -130,7 +130,7 @@ function Get-ActivityWatchExecutableMap {
 
     foreach ($entry in $map.GetEnumerator()) {
         if (-not (Test-Path -LiteralPath $entry.Value)) {
-            throw "Missing required ActivityWatch binary: $($entry.Value)"
+            throw "Не найден обязательный исполняемый файл ActivityWatch: $($entry.Value)"
         }
     }
 
@@ -194,7 +194,7 @@ function Normalize-ActivityWatchUsers {
         Sort-Object -Unique
 
     if (-not $normalized -or $normalized.Count -eq 0) {
-        throw 'No target users resolved. Provide -Users or -UserListPath.'
+        throw 'Не удалось определить целевых пользователей. Укажите -Users или -UserListPath.'
     }
 
     return @($normalized)
@@ -243,6 +243,8 @@ function Copy-ActivityWatchCollectorAssets {
         [Parameter(Mandatory = $true)]
         [string]$EndpointCollectorScriptSource,
         [Parameter(Mandatory = $true)]
+        [string]$SessionCollectorScriptSource,
+        [Parameter(Mandatory = $true)]
         [string]$ExampleRulesSource,
         [Parameter(Mandatory = $true)]
         [string]$ExamplePolicySource,
@@ -256,6 +258,7 @@ function Copy-ActivityWatchCollectorAssets {
 
     $collectorTarget = Join-Path $StateRoot 'browser-domains-native-collector.ps1'
     $endpointCollectorTarget = Join-Path $StateRoot 'dlp-endpoint-signals-collector.ps1'
+    $sessionCollectorTarget = Join-Path $StateRoot 'worktime-session-collector.ps1'
     $exampleRulesTarget = Join-Path $StateRoot 'web-category-rules.example.json'
     $rulesTarget = Join-Path $StateRoot 'web-category-rules.json'
     $examplePolicyTarget = Join-Path $StateRoot 'dlp-policy.example.json'
@@ -263,6 +266,7 @@ function Copy-ActivityWatchCollectorAssets {
 
     Copy-Item -LiteralPath $CollectorScriptSource -Destination $collectorTarget -Force
     Copy-Item -LiteralPath $EndpointCollectorScriptSource -Destination $endpointCollectorTarget -Force
+    Copy-Item -LiteralPath $SessionCollectorScriptSource -Destination $sessionCollectorTarget -Force
     Copy-Item -LiteralPath $ExampleRulesSource -Destination $exampleRulesTarget -Force
     Copy-Item -LiteralPath $ExamplePolicySource -Destination $examplePolicyTarget -Force
 
@@ -282,6 +286,7 @@ function Copy-ActivityWatchCollectorAssets {
     return [pscustomobject]@{
         CollectorScript         = $collectorTarget
         EndpointCollectorScript = $endpointCollectorTarget
+        SessionCollectorScript  = $sessionCollectorTarget
         ExampleRules            = $exampleRulesTarget
         ActiveRules             = $rulesTarget
         ExamplePolicy           = $examplePolicyTarget
@@ -308,6 +313,8 @@ function New-ActivityWatchDeploymentConfig {
         [Parameter(Mandatory = $true)]
         [string]$EndpointCollectorScript,
         [Parameter(Mandatory = $true)]
+        [string]$SessionCollectorScript,
+        [Parameter(Mandatory = $true)]
         [string]$RulesPath,
         [Parameter(Mandatory = $true)]
         [string]$PolicyPath,
@@ -349,6 +356,7 @@ function New-ActivityWatchDeploymentConfig {
             logsRoot       = $LogsRoot
             collectorScript = $CollectorScript
             endpointCollectorScript = $EndpointCollectorScript
+            sessionCollectorScript = $SessionCollectorScript
             rulesPath      = $RulesPath
             policyPath     = $PolicyPath
             launchScript   = $LaunchScriptPath
@@ -413,7 +421,7 @@ function Read-ActivityWatchDeploymentConfig {
     )
 
     if (-not (Test-Path -LiteralPath $Path)) {
-        throw "Deployment config not found: $Path"
+        throw "Конфигурация развёртывания не найдена: $Path"
     }
 
     return Get-Content -LiteralPath $Path -Raw | ConvertFrom-Json
@@ -539,7 +547,7 @@ function Send-LogonMarkerIfNeeded {
     `$stateRoot = [string]`$Config.paths.stateRoot
     `$markerRoots = New-Object System.Collections.Generic.List[string]
     if (-not [string]::IsNullOrWhiteSpace(`$env:LOCALAPPDATA)) {
-        `$markerRoots.Add((Join-Path `$env:LOCALAPPDATA 'ActivityWatch-Phase2\markers'))
+        `$markerRoots.Add((Join-Path `$env:LOCALAPPDATA 'AWatch-rus\markers'))
     }
     if (-not [string]::IsNullOrWhiteSpace(`$stateRoot)) {
         `$markerRoots.Add((Join-Path `$stateRoot 'markers'))
@@ -585,7 +593,7 @@ function Send-LogonMarkerIfNeeded {
             userId    = "`$(`$env:USERDOMAIN)\`$(`$env:USERNAME)"
             sessionId = `$SessionId
             hostname  = `$script:Hostname
-            source    = 'launch-watchers-phase2'
+            source    = 'launch-watchers-awatch-rus'
         }
     } | ConvertTo-Json -Depth 5 -Compress
 
@@ -631,6 +639,7 @@ function Start-CollectorScriptIfNeeded {
 `$script:KnownBuckets = @{}
 `$collectorScript = [string]`$config.paths.collectorScript
 `$endpointCollectorScript = if (`$config.paths.PSObject.Properties.Name -contains 'endpointCollectorScript') { [string]`$config.paths.endpointCollectorScript } else { '' }
+`$sessionCollectorScript = if (`$config.paths.PSObject.Properties.Name -contains 'sessionCollectorScript') { [string]`$config.paths.sessionCollectorScript } else { '' }
 `$afkExe = Join-Path `$installRoot 'aw-watcher-afk\aw-watcher-afk.exe'
 `$windowExe = Join-Path `$installRoot 'aw-watcher-window\aw-watcher-window.exe'
 `$serverArgs = @('--host', [string]`$config.server.host, '--port', [string]`$config.server.port)
@@ -639,11 +648,11 @@ function Start-CollectorScriptIfNeeded {
 `$windowEnabled = if (`$config.PSObject.Properties.Name -contains 'collectors' -and `$config.collectors.PSObject.Properties.Name -contains 'windowEnabled') { [bool]`$config.collectors.windowEnabled } else { `$true }
 
 if (`$afkEnabled -and -not (Test-Path -LiteralPath `$afkExe)) {
-    throw "Missing aw-watcher-afk.exe: `$afkExe"
+    throw "Не найден aw-watcher-afk.exe: `$afkExe"
 }
 
 if (`$windowEnabled -and -not (Test-Path -LiteralPath `$windowExe)) {
-    throw "Missing aw-watcher-window.exe: `$windowExe"
+    throw "Не найден aw-watcher-window.exe: `$windowExe"
 }
 
 if (`$afkEnabled -and -not (Test-ProcessInSession -Name 'aw-watcher-afk' -SessionId `$sessionId)) {
@@ -661,6 +670,7 @@ catch {
 }
 Start-CollectorScriptIfNeeded -ScriptPath `$collectorScript -ConfigPath `$ConfigPath -PowerShellExe `$powershellExe -SessionId `$sessionId
 Start-CollectorScriptIfNeeded -ScriptPath `$endpointCollectorScript -ConfigPath `$ConfigPath -PowerShellExe `$powershellExe -SessionId `$sessionId
+Start-CollectorScriptIfNeeded -ScriptPath `$sessionCollectorScript -ConfigPath `$ConfigPath -PowerShellExe `$powershellExe -SessionId `$sessionId
 "@
 
     Set-Content -LiteralPath $Path -Value $content -Encoding UTF8
@@ -850,7 +860,7 @@ function Set-ActivityWatchScheduledTaskAction {
     $taskCommand = ('"{0}" {1}' -f $Execute, $Arguments)
     & schtasks.exe /Change /TN $TaskName /TR $taskCommand | Out-Null
     if ($LASTEXITCODE -ne 0) {
-        throw "schtasks.exe /Change failed for $TaskName"
+        throw "schtasks.exe /Change завершился с ошибкой для $TaskName"
     }
 }
 
@@ -951,17 +961,17 @@ function Set-ActivityWatchAcl {
 
     & icacls $InstallRoot /inheritance:r /grant:r '*S-1-5-18:(OI)(CI)(F)' '*S-1-5-32-544:(OI)(CI)(F)' '*S-1-5-32-545:(OI)(CI)(RX)' | Out-Null
     if ($LASTEXITCODE -ne 0) {
-        throw "icacls failed for $InstallRoot"
+        throw "icacls завершился с ошибкой для $InstallRoot"
     }
 
     & icacls $StateRoot /inheritance:r /grant:r '*S-1-5-18:(OI)(CI)(F)' '*S-1-5-32-544:(OI)(CI)(F)' '*S-1-5-32-545:(OI)(CI)(RX)' | Out-Null
     if ($LASTEXITCODE -ne 0) {
-        throw "icacls failed for $StateRoot"
+        throw "icacls завершился с ошибкой для $StateRoot"
     }
 
     & icacls $LogsRoot /inheritance:r /grant:r '*S-1-5-18:(OI)(CI)(F)' '*S-1-5-32-544:(OI)(CI)(F)' '*S-1-5-32-545:(OI)(CI)(M)' | Out-Null
     if ($LASTEXITCODE -ne 0) {
-        throw "icacls failed for $LogsRoot"
+        throw "icacls завершился с ошибкой для $LogsRoot"
     }
 }
 

windows/ActivityWatch.Windows.I18n.psm1

@@ -1,403 +0,0 @@
-<#
-.SYNOPSIS
-    PowerShell i18n module with JSON-based localization and fallback mechanism.
-.DESCRIPTION
-    Provides internationalization support for PowerShell scripts with:
-    - JSON-based message catalogs
-    - Automatic fallback to default language
-    - Parameterized messages with format placeholders
-    - Auto-versioning support
-.EXAMPLE
-    Import-Module ./ActivityWatch.Windows.I18n.psm1
-    Initialize-Locale -Culture "ru-RU"
-    Get-LocalizedString -Key "errors.admin_required"
-#>
-
-Set-StrictMode -Version Latest
-$ErrorActionPreference = 'Stop'
-
-# Module state
-$Script:I18nState = @{
-    CurrentCulture = 'en-US'
-    FallbackCulture = 'en-US'
-    Messages = @{}
-    FallbackMessages = @{}
-    I18nRoot = $PSScriptRoot + '\..\i18n'
-}
-
-function Get-I18nFilePath {
-    param(
-        [Parameter(Mandatory = $true)]
-        [string]$Culture,
-        [string]$I18nRoot = $Script:I18nState.I18nRoot
-    )
-    
-    $fileName = "{0}.json" -f $Culture
-    return Join-Path -Path $I18nRoot -ChildPath $fileName
-}
-
-function Test-I18nFileExists {
-    param(
-        [Parameter(Mandatory = $true)]
-        [string]$Culture,
-        [string]$I18nRoot = $Script:I18nState.I18nRoot
-    )
-    
-    $filePath = Get-I18nFilePath -Culture $Culture -I18nRoot $I18nRoot
-    return Test-Path -LiteralPath $filePath
-}
-
-function Load-MessagesForCulture {
-    param(
-        [Parameter(Mandatory = $true)]
-        [string]$Culture,
-        [string]$I18nRoot = $Script:I18nState.I18nRoot
-    )
-    
-    $filePath = Get-I18nFilePath -Culture $Culture -I18nRoot $I18nRoot
-    
-    if (-not (Test-Path -LiteralPath $filePath)) {
-        throw "Localization file not found: $filePath"
-    }
-    
-    $content = Get-Content -LiteralPath $filePath -Raw -Encoding UTF8
-    $catalog = $content | ConvertFrom-Json
-    
-    return @{
-        Version = $catalog.version
-        Language = $catalog.language
-        Fallback = $catalog.fallback
-        Messages = $catalog.messages
-    }
-}
-
-function Initialize-Locale {
-    param(
-        [string]$Culture = 'ru-RU',
-        [string]$FallbackCulture = 'en-US',
-        [string]$I18nRoot = $Script:I18nState.I18nRoot,
-        [switch]$AutoDetect
-    )
-    
-    if ($AutoDetect) {
-        $Culture = (Get-Culture).Name
-        Write-Host "Auto-detected culture: $Culture" -ForegroundColor Cyan
-    }
-    
-    $Script:I18nState.CurrentCulture = $Culture
-    $Script:I18nState.FallbackCulture = $FallbackCulture
-    
-    try {
-        $primaryCatalog = Load-MessagesForCulture -Culture $Culture -I18nRoot $I18nRoot
-        $Script:I18nState.Messages = $primaryCatalog.Messages
-        
-        if ($primaryCatalog.Fallback) {
-            $fallbackCatalog = Load-MessagesForCulture -Culture $primaryCatalog.Fallback -I18nRoot $I18nRoot
-            $Script:I18nState.FallbackMessages = $fallbackCatalog.Messages
-        }
-        
-        Write-Host "Locale initialized: $Culture (fallback: $($primaryCatalog.Fallback ?? $FallbackCulture))" -ForegroundColor Green
-        return $true
-    }
-    catch {
-        Write-Warning "Failed to load primary locale '$Culture'. Attempting fallback..."
-        
-        try {
-            $fallbackCatalog = Load-MessagesForCulture -Culture $FallbackCulture -I18nRoot $I18nRoot
-            $Script:I18nState.Messages = @{}
-            $Script:I18nState.FallbackMessages = $fallbackCatalog.Messages
-            Write-Host "Using fallback locale only: $FallbackCulture" -ForegroundColor Yellow
-            return $true
-        }
-        catch {
-            Write-Error "Failed to load both primary and fallback locales."
-            return $false
-        }
-    }
-}
-
-function Get-LocalizedString {
-    param(
-        [Parameter(Mandatory = $true)]
-        [string]$Key,
-        [object[]]$FormatArgs = @(),
-        [string]$DefaultValue
-    )
-    
-    $message = $null
-    
-    if ($Script:I18nState.Messages.ContainsKey($Key)) {
-        $message = $Script:I18nState.Messages[$Key]
-    }
-    elseif ($Script:I18nState.FallbackMessages.ContainsKey($Key)) {
-        $message = $Script:I18nState.FallbackMessages[$Key]
-    }
-    elseif ($DefaultValue) {
-        $message = $DefaultValue
-    }
-    else {
-        $message = "[MISSING: $Key]"
-    }
-    
-    if ($FormatArgs -and $FormatArgs.Count -gt 0) {
-        try {
-            $message = [string]::Format($message, $FormatArgs)
-        }
-        catch {
-            Write-Warning "Failed to format message '$Key' with args: $($FormatArgs -join ', ')"
-        }
-    }
-    
-    return $message
-}
-
-function Get-LocalizedError {
-    param(
-        [Parameter(Mandatory = $true)]
-        [string]$Key,
-        [object[]]$FormatArgs = @()
-    )
-    
-    $message = Get-LocalizedString -Key "errors.$Key" -FormatArgs $FormatArgs
-    return New-Object System.Management.Automation.ErrorRecord(
-        (New-Object Exception($message)),
-        $Key,
-        [System.Management.Automation.ErrorCategory]::OperationStopped,
-        $null
-    )
-}
-
-function Get-LocalizedWarning {
-    param(
-        [Parameter(Mandatory = $true)]
-        [string]$Key,
-        [object[]]$FormatArgs = @()
-    )
-    
-    $message = Get-LocalizedString -Key "warnings.$Key" -FormatArgs $FormatArgs
-    Write-Warning -Message $message
-}
-
-function Get-LocalizedInfo {
-    param(
-        [Parameter(Mandatory = $true)]
-        [string]$Key,
-        [object[]]$FormatArgs = @(),
-        [ConsoleColor]$Color = 'Cyan'
-    )
-    
-    $message = Get-LocalizedString -Key "info.$Key" -FormatArgs $FormatArgs
-    Write-Host -Message $message -ForegroundColor $Color
-}
-
-function Get-LocalizedStatus {
-    param(
-        [Parameter(Mandatory = $true)]
-        [string]$Key,
-        [object[]]$FormatArgs = @()
-    )
-    
-    return Get-LocalizedString -Key "status.$Key" -FormatArgs $FormatArgs
-}
-
-function Get-LocalizedPrompt {
-    param(
-        [Parameter(Mandatory = $true)]
-        [string]$Key,
-        [object[]]$FormatArgs = @()
-    )
-    
-    return Get-LocalizedString -Key "prompts.$Key" -FormatArgs $FormatArgs
-}
-
-function Read-LocalizedChoice {
-    param(
-        [Parameter(Mandatory = $true)]
-        [string]$PromptKey,
-        [string[]]$Choices,
-        [object[]]$FormatArgs = @(),
-        [int]$DefaultChoice = 0
-    )
-    
-    $promptMessage = Get-LocalizedPrompt -Key $PromptKey -FormatArgs $FormatArgs
-    $choiceMessages = $Choices | ForEach-Object {
-        Get-LocalizedString -Key "choices.$_"
-    }
-    
-    $formattedChoices = for ($i = 0; $i -lt $Choices.Count; $i++) {
-        "[{0}] {1}" -f ($i + 1), $choiceMessages[$i]
-    }
-    
-    $fullPrompt = "{0}`n{1}" -f $promptMessage, ($formattedChoices -join "`n")
-    
-    $result = Read-Host -Prompt $fullPrompt
-    
-    if ([string]::IsNullOrWhiteSpace($result)) {
-        return $DefaultChoice
-    }
-    
-    $selectedIndex = 0
-    if ([int]::TryParse($result, [ref]$selectedIndex) -and $selectedIndex -gt 0 -and $selectedIndex -le $Choices.Count) {
-        return $selectedIndex - 1
-    }
-    
-    return $DefaultChoice
-}
-
-function Read-LocalizedConfirm {
-    param(
-        [Parameter(Mandatory = $true)]
-        [string]$PromptKey,
-        [object[]]$FormatArgs = @(),
-        [switch]$Force
-    )
-    
-    if ($Force) {
-        return $true
-    }
-    
-    $promptMessage = Get-LocalizedPrompt -Key $PromptKey -FormatArgs $FormatArgs
-    $yesMessage = Get-LocalizedString -Key "choices.yes" -DefaultValue "Yes"
-    $noMessage = Get-LocalizedString -Key "choices.no" -DefaultValue "No"
-    
-    $result = Read-Host -Prompt "$promptMessage ($yesMessage/$noMessage)"
-    
-    return $result -in @('y', 'Y', 'yes', 'Yes', $yesMessage)
-}
-
-function Get-AvailableLocales {
-    param(
-        [string]$I18nRoot = $Script:I18nState.I18nRoot
-    )
-    
-    if (-not (Test-Path -LiteralPath $I18nRoot)) {
-        return @()
-    }
-    
-    $locales = Get-ChildItem -Path $I18nRoot -Filter "*.json" -File | ForEach-Object {
-        $culture = $_.BaseName
-        try {
-            $catalog = Load-MessagesForCulture -Culture $culture -I18nRoot $I18nRoot
-            [PSCustomObject]@{
-                Culture = $culture
-                Language = $catalog.Language
-                Version = $catalog.Version
-                HasFallback = [bool]$catalog.Fallback
-            }
-        }
-        catch {
-            Write-Warning "Failed to load locale $culture : $_"
-        }
-    }
-    
-    return $locales
-}
-
-function Get-I18nVersion {
-    param(
-        [string]$Culture = $Script:I18nState.CurrentCulture,
-        [string]$I18nRoot = $Script:I18nState.I18nRoot
-    )
-    
-    try {
-        $catalog = Load-MessagesForCulture -Culture $Culture -I18nRoot $I18nRoot
-        return $catalog.Version
-    }
-    catch {
-        return $null
-    }
-}
-
-function Test-I18nUpdateAvailable {
-    param(
-        [string]$CurrentVersion,
-        [string]$Culture = $Script:I18nState.CurrentCulture,
-        [string]$I18nRoot = $Script:I18nState.I18nRoot
-    )
-    
-    $availableVersion = Get-I18nVersion -Culture $Culture -I18nRoot $I18nRoot
-    
-    if (-not $CurrentVersion -or -not $availableVersion) {
-        return $false
-    }
-    
-    try {
-        $current = [Version]$CurrentVersion
-        $available = [Version]$availableVersion
-        return $available -gt $current
-    }
-    catch {
-        return $false
-    }
-}
-
-function Export-LocaleTemplate {
-    param(
-        [Parameter(Mandatory = $true)]
-        [string]$OutputPath,
-        [string]$SourceCulture = 'en-US'
-    )
-    
-    $catalog = Load-MessagesForCulture -Culture $SourceCulture
-    
-    $template = [PSCustomObject]@{
-        version = "1.0.0"
-        language = $catalog.Language
-        fallback = $null
-        messages = $catalog.Messages
-    }
-    
-    $directory = Split-Path -Path $OutputPath -Parent
-    if ($directory -and -not (Test-Path -LiteralPath $directory)) {
-        New-Item -Path $directory -ItemType Directory -Force | Out-Null
-    }
-    
-    $template | ConvertTo-Json -Depth 4 | Set-Content -LiteralPath $OutputPath -Encoding UTF8
-    Write-Host "Locale template exported to: $OutputPath" -ForegroundColor Green
-}
-
-function Compare-Locales {
-    param(
-        [string]$Culture1 = 'en-US',
-        [string]$Culture2 = 'ru-RU',
-        [string]$I18nRoot = $Script:I18nState.I18nRoot
-    )
-    
-    $catalog1 = Load-MessagesForCulture -Culture $Culture1 -I18nRoot $I18nRoot
-    $catalog2 = Load-MessagesForCulture -Culture $Culture2 -I18nRoot $I18nRoot
-    
-    $keys1 = $catalog1.Messages.Keys
-    $keys2 = $catalog2.Messages.Keys
-    
-    $missing = $keys1 | Where-Object { $_ -notin $keys2 }
-    $extra = $keys2 | Where-Object { $_ -notin $keys1 }
-    
-    return [PSCustomObject]@{
-        Culture1 = $Culture1
-        Culture2 = $Culture2
-        KeysInCulture1 = $keys1.Count
-        KeysInCulture2 = $keys2.Count
-        MissingInCulture2 = @($missing)
-        ExtraInCulture2 = @($extra)
-        CoveragePercent = if ($keys1.Count -gt 0) { 
-            [math]::Round((($keys1.Count - $missing.Count) / $keys1.Count) * 100, 2) 
-        } else { 0 }
-    }
-}
-
-Export-ModuleMember -Function @(
-    'Initialize-Locale',
-    'Get-LocalizedString',
-    'Get-LocalizedError',
-    'Get-LocalizedWarning',
-    'Get-LocalizedInfo',
-    'Get-LocalizedStatus',
-    'Get-LocalizedPrompt',
-    'Read-LocalizedChoice',
-    'Read-LocalizedConfirm',
-    'Get-AvailableLocales',
-    'Get-I18nVersion',
-    'Test-I18nUpdateAvailable',
-    'Export-LocaleTemplate',
-    'Compare-Locales'
-)

windows/browser-domains-native-collector.ps1

@@ -1,6 +1,6 @@
 [CmdletBinding()]
 param(
-    [string]$ConfigPath = 'C:\ProgramData\ActivityWatch\deployment-config.json',
+    [string]$ConfigPath = 'C:\ProgramData\AWatch-rus\deployment-config.json',
     [string]$ServerHost,
     [int]$ServerPort,
     [ValidateSet('http', 'https')]
@@ -48,29 +48,19 @@ function Get-DeploymentConfig {
     return $null
 }
 
-function Invoke-AwJsonPost {
-    param(
-        [Parameter(Mandatory = $true)][string]$Uri,
-        [Parameter(Mandatory = $true)][string]$Json
-    )
-
-    $bytes = [Text.Encoding]::UTF8.GetBytes($Json)
-    Invoke-RestMethod -Method Post -Uri $Uri -ContentType 'application/json; charset=utf-8' -Body $bytes | Out-Null
-}
-
 $deploymentConfig = Get-DeploymentConfig -Path $ConfigPath
-$resolvedServerHost = if ($ServerHost) { $ServerHost } elseif ($deploymentConfig) { [string]$deploymentConfig.server.host } else { throw 'ServerHost is required.' }
+$resolvedServerHost = if ($ServerHost) { $ServerHost } elseif ($deploymentConfig) { [string]$deploymentConfig.server.host } else { throw 'Укажите ServerHost или подготовьте deployment-config.json.' }
 $resolvedServerPort = if ($PSBoundParameters.ContainsKey('ServerPort')) { $ServerPort } elseif ($deploymentConfig) { [int]$deploymentConfig.server.port } else { 5600 }
 $resolvedServerScheme = if ($ServerScheme) { $ServerScheme } elseif ($deploymentConfig) { [string]$deploymentConfig.server.scheme } else { 'http' }
-$resolvedRulesPath = if ($RulesPath) { $RulesPath } elseif ($deploymentConfig) { [string]$deploymentConfig.paths.rulesPath } else { 'C:\ProgramData\ActivityWatch\web-category-rules.json' }
-$resolvedPolicyPath = if ($PolicyPath) { $PolicyPath } elseif ($deploymentConfig) { [string]$deploymentConfig.paths.policyPath } else { 'C:\ProgramData\ActivityWatch\dlp-policy.json' }
+$resolvedRulesPath = if ($RulesPath) { $RulesPath } elseif ($deploymentConfig) { [string]$deploymentConfig.paths.rulesPath } else { 'C:\ProgramData\AWatch-rus\web-category-rules.json' }
+$resolvedPolicyPath = if ($PolicyPath) { $PolicyPath } elseif ($deploymentConfig) { [string]$deploymentConfig.paths.policyPath } else { 'C:\ProgramData\AWatch-rus\dlp-policy.json' }
 $resolvedPollSeconds = if ($PSBoundParameters.ContainsKey('PollSeconds')) { $PollSeconds } elseif ($deploymentConfig) { [int]$deploymentConfig.collector.pollSeconds } else { 5 }
 $resolvedPulseSeconds = if ($PSBoundParameters.ContainsKey('PulseSeconds')) { $PulseSeconds } elseif ($deploymentConfig) { [int]$deploymentConfig.collector.pulseSeconds } else { 30 }
-$resolvedLogsRoot = if ($deploymentConfig) { [string]$deploymentConfig.paths.logsRoot } else { 'C:\ProgramData\ActivityWatch\logs' }
+$resolvedLogsRoot = if ($deploymentConfig) { [string]$deploymentConfig.paths.logsRoot } else { 'C:\ProgramData\AWatch-rus\logs' }
 $resolvedLogPath = if ($LogPath) { $LogPath } else { Join-Path $resolvedLogsRoot ("browser-domains-{0}.log" -f $env:USERNAME) }
 $resolvedIncidentLogPath = if ($IncidentLogPath) { $IncidentLogPath } else { Join-Path $resolvedLogsRoot ("dlp-incidents-{0}.log" -f $env:USERNAME) }
 $resolvedLocalAgentLogsEnabled = if ($deploymentConfig -and $deploymentConfig.PSObject.Properties.Name -contains 'logging' -and $deploymentConfig.logging.PSObject.Properties.Name -contains 'localAgentLogsEnabled') { [bool]$deploymentConfig.logging.localAgentLogsEnabled } else { $true }
-$resolvedIncidentArtifactsRoot = if ($deploymentConfig -and $deploymentConfig.PSObject.Properties.Name -contains 'incidentCapture' -and $deploymentConfig.incidentCapture.PSObject.Properties.Name -contains 'artifactsRoot') { [string]$deploymentConfig.incidentCapture.artifactsRoot } else { Join-Path $env:LOCALAPPDATA 'ActivityWatch-Phase2\\incident-artifacts' }
+$resolvedIncidentArtifactsRoot = if ($deploymentConfig -and $deploymentConfig.PSObject.Properties.Name -contains 'incidentCapture' -and $deploymentConfig.incidentCapture.PSObject.Properties.Name -contains 'artifactsRoot') { [string]$deploymentConfig.incidentCapture.artifactsRoot } else { Join-Path $env:LOCALAPPDATA 'AWatch-rus\\incident-artifacts' }
 $resolvedIncidentScreenshotEnabled = if ($deploymentConfig -and $deploymentConfig.PSObject.Properties.Name -contains 'incidentCapture' -and $deploymentConfig.incidentCapture.PSObject.Properties.Name -contains 'screenshotEnabled') { [bool]$deploymentConfig.incidentCapture.screenshotEnabled } else { $true }
 
 if ($resolvedLocalAgentLogsEnabled -and -not (Test-Path -LiteralPath $resolvedLogsRoot)) {
@@ -168,12 +158,12 @@ function Get-HostFromUrl {
 
     try {
         $uri = [Uri]$Url
-        $host = $uri.Host.ToLowerInvariant()
-        if ($host.StartsWith('www.')) {
-            return $host.Substring(4)
+        $uriHost = $uri.Host.ToLowerInvariant()
+        if ($uriHost.StartsWith('www.')) {
+            return $uriHost.Substring(4)
         }
 
-        return $host
+        return $uriHost
     }
     catch {
         return $null
@@ -273,11 +263,11 @@ function Load-CustomCategoryRules {
 
         if ($rules.Count -gt 0) {
             $script:CategoryRules = @($rules) + @($script:CategoryRules)
-            Write-CollectorLog ("custom rules loaded: {0}" -f $rules.Count)
+            Write-CollectorLog ("пользовательские правила загружены: {0}" -f $rules.Count)
         }
     }
     catch {
-        Write-CollectorLog ("custom rules load failed: {0}" -f $_.Exception.Message)
+        Write-CollectorLog ("не удалось загрузить пользовательские правила: {0}" -f $_.Exception.Message)
     }
 }
 
@@ -348,7 +338,7 @@ function Load-DlpPolicy {
     param([string]$Path)
 
     if (-not $Path -or -not (Test-Path -LiteralPath $Path)) {
-        Write-CollectorLog ("dlp policy not found, disabled: {0}" -f $Path)
+        Write-CollectorLog ("DLP-политика не найдена, DLP отключен: {0}" -f $Path)
         return
     }
 
@@ -382,7 +372,7 @@ function Load-DlpPolicy {
                 enabled = if ($rule.PSObject.Properties.Name -contains 'enabled') { [bool]$rule.enabled } else { $true }
                 action = if ($rule.action) { [string]$rule.action } else { [string]$script:DlpDefaults.action }
                 severity = if ($rule.severity) { [string]$rule.severity } else { [string]$script:DlpDefaults.severity }
-                message = if ($rule.message) { [string]$rule.message } else { "DLP rule matched: $($rule.id)" }
+                message = if ($rule.message) { [string]$rule.message } else { "Сработало DLP-правило: $($rule.id)" }
                 cooldownSeconds = if ($rule.cooldownSeconds) { [int]$rule.cooldownSeconds } else { [int]$script:DlpDefaults.cooldownSeconds }
                 when = [pscustomobject]@{
                     domains = if ($when.PSObject.Properties.Name -contains 'domains') { @($when.domains | ForEach-Object { ([string]$_).Trim().ToLowerInvariant() } | Where-Object { $_ }) } else { @() }
@@ -398,10 +388,10 @@ function Load-DlpPolicy {
         }
 
         $script:DlpRules = @($loaded)
-        Write-CollectorLog ("dlp policy loaded: enabled={0}, rules={1}" -f $script:DlpDefaults.enabled, $script:DlpRules.Count)
+        Write-CollectorLog ("DLP-политика загружена: включена={0}, правил={1}" -f $script:DlpDefaults.enabled, $script:DlpRules.Count)
     }
     catch {
-        Write-CollectorLog ("dlp policy parse failed: {0}" -f $_.Exception.Message)
+        Write-CollectorLog ("не удалось разобрать DLP-политику: {0}" -f $_.Exception.Message)
     }
 }
 
@@ -551,7 +541,7 @@ function Send-DlpIncidentHeartbeat {
         } + $captureData
     } | ConvertTo-Json -Depth 5 -Compress
 
-    Invoke-AwJsonPost -Uri "$($script:ApiBase)/buckets/$bucketId/heartbeat?pulsetime=$resolvedPulseSeconds" -Json $event
+    Invoke-RestMethod -Method Post -Uri "$($script:ApiBase)/buckets/$bucketId/heartbeat?pulsetime=$resolvedPulseSeconds" -ContentType 'application/json' -Body $event | Out-Null
 }
 
 function Get-FileSha256Hex {
@@ -635,7 +625,7 @@ function Capture-IncidentScreenshot {
         }
     }
     catch {
-        Write-CollectorLog ("screenshot capture failed: {0}" -f $_.Exception.Message)
+        Write-CollectorLog ("не удалось сделать снимок инцидента: {0}" -f $_.Exception.Message)
         return @{}
     }
 }
@@ -717,7 +707,7 @@ function Ensure-Bucket {
         hostname = $script:Hostname
     } | ConvertTo-Json -Compress
 
-    Invoke-AwJsonPost -Uri "$($script:ApiBase)/buckets/$BucketId" -Json $body
+    Invoke-RestMethod -Method Post -Uri "$($script:ApiBase)/buckets/$BucketId" -ContentType 'application/json' -Body $body | Out-Null
     $script:KnownBuckets[$BucketId] = $true
 }
 
@@ -743,7 +733,7 @@ function Send-Heartbeat {
         }
     } | ConvertTo-Json -Depth 4 -Compress
 
-    Invoke-AwJsonPost -Uri "$($script:ApiBase)/buckets/$BucketId/heartbeat?pulsetime=$resolvedPulseSeconds" -Json $event
+    Invoke-RestMethod -Method Post -Uri "$($script:ApiBase)/buckets/$BucketId/heartbeat?pulsetime=$resolvedPulseSeconds" -ContentType 'application/json' -Body $event | Out-Null
 }
 
 function Send-CategoryHeartbeat {
@@ -780,12 +770,12 @@ function Send-CategoryHeartbeat {
         }
     } | ConvertTo-Json -Depth 4 -Compress
 
-    Invoke-AwJsonPost -Uri "$($script:ApiBase)/buckets/$bucketId/heartbeat?pulsetime=$resolvedPulseSeconds" -Json $event
+    Invoke-RestMethod -Method Post -Uri "$($script:ApiBase)/buckets/$bucketId/heartbeat?pulsetime=$resolvedPulseSeconds" -ContentType 'application/json' -Body $event | Out-Null
 }
 
 Load-CustomCategoryRules -Path $resolvedRulesPath
 Load-DlpPolicy -Path $resolvedPolicyPath
-Write-CollectorLog ("collector started against {0}" -f $script:ApiBase)
+Write-CollectorLog ("коллектор запущен для {0}" -f $script:ApiBase)
 
 while ($true) {
     try {
@@ -825,7 +815,7 @@ while ($true) {
         }
     }
     catch {
-        Write-CollectorLog ("collector error: {0}" -f $_.Exception.Message)
+        Write-CollectorLog ("ошибка коллектора: {0}" -f $_.Exception.Message)
     }
 
     Start-Sleep -Seconds $resolvedPollSeconds