@bli-cockpit/cli 0.2.48 → 0.2.50

package/dist/autostart-contract.js

@@ -0,0 +1,79 @@
+import { stat } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { DEFAULT_DASHBOARD_URL } from "./local-state.js";
+import { resolveStableNodeExecutable, } from "./autostart-node-path.js";
+/** launchd LaunchAgent label; matches docs/runbooks/cockpit-launchd-sync.md. */
+export const AUTOSTART_LABEL = "com.bli.cockpit.sync";
+/** The name Task Scheduler files the same job under on Windows. */
+export const WINDOWS_AUTOSTART_TASK_NAME = "BLI Cockpit Sync";
+export const DEFAULT_AUTOSTART_INTERVAL_SECONDS = 15 * 60;
+export const UNSUPPORTED_MESSAGE = "autostart is supported on macOS and Windows only";
+/** Where the LaunchAgent lives for a given home; also the `plist_path` every
+ * result carries, including the unsupported-platform one. */
+export function plistPathFor(homeDir) {
+    return path.join(homeDir, "Library", "LaunchAgents", `${AUTOSTART_LABEL}.plist`);
+}
+/** The one answer for a host neither host family covers — Linux, mostly CI. */
+export function unsupportedResult(homeDir) {
+    return {
+        status: "unsupported",
+        label: AUTOSTART_LABEL,
+        plist_path: plistPathFor(homeDir ?? os.homedir()),
+        message: UNSUPPORTED_MESSAGE,
+    };
+}
+/**
+ * The one place a caller's partial options become the full registration.
+ *
+ * Writer and read-back validator both start here, on both host families: if
+ * the two ever filled a default differently, every machine would read as
+ * needing repair forever, which is BLI-2541's failure mode. `platform` picks
+ * the path flavour — Windows resolves and dedupes case-insensitively, macOS
+ * keeps the case it was given.
+ */
+export function resolveAutostartSettings(options, platform) {
+    const resolvePath = platform === "win32" ? path.win32.resolve : path.resolve;
+    const requestedRoots = uniqueResolvedRoots(options.repoRoots, platform);
+    const workDir = resolvePath(options.repoRoot ?? requestedRoots[0] ?? process.cwd());
+    return {
+        work_dir: workDir,
+        work_dirs: requestedRoots.length > 0 ? requestedRoots : [workDir],
+        dashboard_url: options.dashboardUrl ?? DEFAULT_DASHBOARD_URL,
+        interval_seconds: options.intervalSeconds ?? DEFAULT_AUTOSTART_INTERVAL_SECONDS,
+        cli_entry_point: resolvePath(options.cliEntryPoint ?? process.argv[1] ?? ""),
+    };
+}
+/** Absolute roots in the order given, first occurrence wins. */
+function uniqueResolvedRoots(repoRoots, platform) {
+    if (!repoRoots)
+        return [];
+    const resolvePath = platform === "win32" ? path.win32.resolve : path.resolve;
+    const dedupeKey = (root) => platform === "win32" ? root.toLowerCase() : root;
+    const seen = new Set();
+    const roots = [];
+    for (const root of repoRoots) {
+        const resolved = resolvePath(root);
+        const key = dedupeKey(resolved);
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        roots.push(resolved);
+    }
+    return roots;
+}
+/**
+ * The node binary the scheduler should name. BOTH the writer and the read-back
+ * validator go through here — if only the writer pinned the stable alias, every
+ * machine would read "does not match the current Tower runtime" forever, which
+ * is BLI-2541 with a new coat of paint.
+ */
+export async function schedulerNodeExecutable(options, platform) {
+    const resolver = platform === "win32" ? path.win32.resolve : path.resolve;
+    const given = resolver(options.nodeExecutable ?? process.execPath);
+    return resolveStableNodeExecutable(given, { platform });
+}
+/** Presence only; a path we cannot stat counts as absent. */
+export async function fileExists(filePath) {
+    return stat(filePath).then(() => true, () => false);
+}

package/dist/autostart-darwin-plist.js

@@ -0,0 +1,265 @@
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths } from "./local-state.js";
+import { savedDiscoveryLimitArgs } from "./discovery-limits.js";
+import { DARWIN_LOGIN_SHELL } from "./autostart-node-path.js";
+import { AUTOSTART_LABEL, fileExists, plistPathFor, resolveAutostartSettings, schedulerNodeExecutable, } from "./autostart-contract.js";
+import { decodeXmlEntities, xmlEscape } from "./autostart-xml.js";
+/**
+ * What the LaunchAgent plist SAYS: render it, write it, and read it back to
+ * decide whether the file on disk still names the current roots and runtime.
+ *
+ * Registration with launchd is the sibling file's job (autostart-darwin.ts).
+ * Renderer and validator share this module deliberately — the validator
+ * compares against the renderer's own output, so a change to one is made in
+ * front of the other (BLI-2541).
+ */
+/**
+ * macOS rewrites this file on every network transition (join, leave, DNS
+ * change), so watching it retries spooled uploads the moment connectivity
+ * returns instead of waiting out the StartInterval — the lid-closed-mid-upload
+ * machine hopping cafés is where most historical upload failures came from
+ * (BLI-2604). The real file, not the /etc/resolv.conf symlink: launchd watches
+ * the path it is given, and the symlink itself never changes. Burst fires are
+ * cheap — the collection lock turns overlap into a named no-op.
+ */
+export const DARWIN_NETWORK_CHANGE_SIGNAL = "/private/var/run/resolv.conf";
+/**
+ * What the tick says to sync.err.log when neither the registered node binary
+ * nor a login-shell node exists. Named, actionable, path-free (BLI-3553).
+ */
+export const DARWIN_NODE_MISSING_MESSAGE = "[autostart] tick skipped: reason=node_binary_missing - the registered node binary is gone and no node is on the login PATH; run cockpit doctor to re-register";
+/**
+ * Renders and writes the LaunchAgent plist without touching launchd.
+ *
+ * Split out of `installAutostartAgent` for BLI-3553: the detached macOS healer
+ * (autostart-self-heal.ts) has to write the SAME plist this file writes and
+ * then re-register it with `bootout`/`bootstrap` rather than `unload`/`load`,
+ * and two renderers would be two chances to disagree. One writer, two
+ * registration verbs.
+ */
+export async function writeDarwinAutostartPlist(options) {
+    const homeDir = options.homeDir ?? os.homedir();
+    const settings = resolveAutostartSettings(options, "darwin");
+    const node = await schedulerNodeExecutable(options, "darwin");
+    const paths = getCollectorRuntimePaths(homeDir);
+    const plistPath = plistPathFor(homeDir);
+    const stdoutPath = path.join(paths.state_dir, "sync.log");
+    const stderrPath = path.join(paths.state_dir, "sync.err.log");
+    const watchPaths = await darwinWatchPaths(homeDir);
+    await mkdir(path.dirname(plistPath), { recursive: true });
+    await mkdir(paths.state_dir, { recursive: true });
+    await writeFile(plistPath, renderPlist({
+        discoveryArgs: await savedDiscoveryLimitArgs(homeDir),
+        workDir: settings.work_dir,
+        workDirs: settings.work_dirs,
+        dashboardUrl: settings.dashboard_url,
+        intervalSeconds: settings.interval_seconds,
+        nodeExecutable: node.path,
+        cliEntryPoint: settings.cli_entry_point,
+        stdoutPath,
+        stderrPath,
+        watchPaths,
+    }), "utf8");
+    return {
+        plist_path: plistPath,
+        work_dir: settings.work_dir,
+        work_dirs: settings.work_dirs,
+        dashboard_url: settings.dashboard_url,
+        interval_seconds: settings.interval_seconds,
+        node_executable: node.path,
+        node_path_reason: node.reason,
+        cli_entry_point: settings.cli_entry_point,
+        watch_path_count: watchPaths.length,
+    };
+}
+/**
+ * Named differences between the plist on disk and the one this build would
+ * write, or an empty list. The strings are what an operator reads in
+ * `cockpit autostart status`, so they stay path-free.
+ */
+export async function darwinAgentProblems(options, settings) {
+    const homeDir = options.homeDir ?? os.homedir();
+    const nodeExecutable = (await schedulerNodeExecutable(options, "darwin")).path;
+    const plist = await readFile(plistPathFor(homeDir), "utf8").catch(() => "");
+    return darwinAgentRegistrationProblems(plist, {
+        discoveryArgs: await savedDiscoveryLimitArgs(homeDir),
+        workDirs: settings.work_dirs,
+        dashboardUrl: settings.dashboard_url,
+        intervalSeconds: settings.interval_seconds,
+        nodeExecutable,
+        cliEntryPoint: settings.cli_entry_point,
+    });
+}
+/**
+ * What the plist says it will run, parsed out of the registration itself
+ * (BLI-3553) rather than rebuilt from `process.execPath`.
+ */
+export async function readRegisteredDarwinRuntimePaths(homeDir) {
+    const plist = await readFile(plistPathFor(homeDir), "utf8").catch(() => "");
+    const command = decodeXmlEntities(plist);
+    return {
+        node_executable: /node_bin='([^']*)'/u.exec(command)?.[1] ?? null,
+        cli_entry_point: /"\$node_bin" '([^']*)' sync /u.exec(command)?.[1] ?? null,
+    };
+}
+/**
+ * The transcript directories whose changes should re-trigger a sync, in the
+ * order they appear in WatchPaths. Resolved from the same homeDir as the plist
+ * and log paths so `--home` redirects them together.
+ */
+function watchPathCandidates(homeDir) {
+    return [
+        path.join(homeDir, ".claude", "projects"),
+        path.join(homeDir, ".codex", "sessions"),
+    ];
+}
+/**
+ * launchd will not reliably watch a path that does not exist at load time, so
+ * only feed it the transcript dirs that are present right now. A missing dir
+ * is fine — the StartInterval floor still covers it. The network signal is
+ * appended unconditionally: it always exists on the Macs this plist targets,
+ * and an existence filter would drop it when rendering on another host.
+ */
+async function darwinWatchPaths(homeDir) {
+    const candidates = watchPathCandidates(homeDir);
+    const present = await Promise.all(candidates.map((dir) => fileExists(dir)));
+    return [
+        ...candidates.filter((_, i) => present[i]),
+        DARWIN_NETWORK_CHANGE_SIGNAL,
+    ];
+}
+function renderPlist(options) {
+    const roots = options.workDirs.length > 0 ? options.workDirs : [options.workDir];
+    const command = renderDarwinSyncCommand({
+        workDirs: roots,
+        dashboardUrl: options.dashboardUrl,
+        nodeExecutable: options.nodeExecutable,
+        cliEntryPoint: options.cliEntryPoint,
+        discoveryArgs: options.discoveryArgs,
+    });
+    return [
+        '<?xml version="1.0" encoding="UTF-8"?>',
+        '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+        '<plist version="1.0">',
+        "<dict>",
+        "  <key>Label</key>",
+        `  <string>${xmlEscape(AUTOSTART_LABEL)}</string>`,
+        ...programArgumentsBlock(command),
+        "  <key>StartInterval</key>",
+        `  <integer>${options.intervalSeconds}</integer>`,
+        "  <key>RunAtLoad</key>",
+        "  <true/>",
+        // WatchPaths makes a transcript write fire `cockpit sync` within seconds, so
+        // captures land near-real-time; StartInterval above is the safety-net floor.
+        // It fires often, but launchd single-flights the job, sync holds its own
+        // lock, and growing-transcript re-upload is damped — so cost stays bounded
+        // and no extra debounce is needed.
+        ...watchPathsBlock(options.watchPaths),
+        "  <key>StandardOutPath</key>",
+        `  <string>${xmlEscape(options.stdoutPath)}</string>`,
+        "  <key>StandardErrorPath</key>",
+        `  <string>${xmlEscape(options.stderrPath)}</string>`,
+        "</dict>",
+        "</plist>",
+        "",
+    ].join("\n");
+}
+/**
+ * The `<key>ProgramArguments</key>` lines. The whole command is ONE zsh -c
+ * argument, which is what makes the read-back check a single-substring match
+ * against these exact lines.
+ */
+function programArgumentsBlock(command) {
+    return [
+        "  <key>ProgramArguments</key>",
+        "  <array>",
+        "    <string>/bin/zsh</string>",
+        "    <string>-c</string>",
+        `    <string>${xmlEscape(command)}</string>`,
+        "  </array>",
+    ];
+}
+/**
+ * Renders the `<key>WatchPaths</key><array>…</array>` lines, or nothing when no
+ * transcript dir exists yet (an empty array would tell launchd to watch
+ * everything-and-nothing; omitting the key leaves StartInterval as the floor).
+ */
+function watchPathsBlock(watchPaths) {
+    if (watchPaths.length === 0)
+        return [];
+    return [
+        "  <key>WatchPaths</key>",
+        "  <array>",
+        ...watchPaths.map((dir) => `    <string>${xmlEscape(dir)}</string>`),
+        "  </array>",
+    ];
+}
+function renderDarwinSyncCommand(options) {
+    const dashboardArg = options.dashboardUrl === DEFAULT_DASHBOARD_URL
+        ? ""
+        : ` --dashboard-url ${shellQuote(options.dashboardUrl)}`;
+    const discoveryArg = options.discoveryArgs.length > 0 ? ` ${options.discoveryArgs.join(" ")}` : "";
+    const commands = options.workDirs.map((root) => `"$node_bin" ${shellQuote(options.cliEntryPoint)} sync --workspace ${shellQuote(root)}${dashboardArg}${discoveryArg} --json || exit_code=1`);
+    return [
+        "exit_code=0",
+        ...darwinNodeResolutionPreamble(options.nodeExecutable),
+        ...commands,
+        'exit "$exit_code"',
+    ].join("; ");
+}
+/**
+ * The registered node path first, a login-shell PATH lookup second, a named
+ * failure third (BLI-3553).
+ *
+ * The hardcoded absolute path stays FIRST and stays the normal case — launchd
+ * hands the tick `PATH=/usr/bin:/bin:/usr/sbin:/sbin` and nothing this fleet
+ * runs lives there, which is the whole reason the plist names absolutes
+ * (scheduled-self-update.ts:55-62). The fallback only fires when that path is
+ * gone: `brew upgrade node` deleted the Cellar directory, `nvm uninstall`
+ * removed a version, someone moved a prefix. Before this, that state was a
+ * silent `exit 127` every 15 minutes forever, on every tick, with nothing in
+ * sync.err.log naming it.
+ *
+ * `/bin/zsh -lc` because a login shell is where Homebrew's `brew shellenv` and
+ * a machine's own PATH edits live; `command -v` because it is a builtin and
+ * cannot itself be missing. Recovering here is deliberately temporary: running
+ * under a node the plist does not name makes the next status read disagree,
+ * which is exactly what wakes the self-heal up to re-register the new path.
+ * A machine whose node is only on an INTERACTIVE shell's PATH (nvm sourced from
+ * .zshrc) still fails — but now it fails with a reason in the log instead of a
+ * bare 127.
+ */
+function darwinNodeResolutionPreamble(nodeExecutable) {
+    return [
+        `node_bin=${shellQuote(nodeExecutable)}`,
+        `[ -x "$node_bin" ] || node_bin="$(${DARWIN_LOGIN_SHELL} -lc 'command -v node' 2>/dev/null)"`,
+        `[ -x "$node_bin" ] || { echo ${shellQuote(DARWIN_NODE_MISSING_MESSAGE)} >&2; exit 127; }`,
+    ];
+}
+function darwinAgentRegistrationProblems(plist, expected) {
+    if (!plist)
+        return ["plist could not be read"];
+    const problems = [];
+    if (!plist.includes(`  <string>${xmlEscape(AUTOSTART_LABEL)}</string>`)) {
+        problems.push("label does not match");
+    }
+    if (!plist.includes(`  <integer>${expected.intervalSeconds}</integer>`)) {
+        problems.push(`cadence is not ${expected.intervalSeconds} seconds`);
+    }
+    const expectedCommand = renderDarwinSyncCommand({
+        discoveryArgs: expected.discoveryArgs,
+        workDirs: expected.workDirs,
+        dashboardUrl: expected.dashboardUrl,
+        nodeExecutable: expected.nodeExecutable,
+        cliEntryPoint: expected.cliEntryPoint,
+    });
+    if (!plist.includes(programArgumentsBlock(expectedCommand).join("\n"))) {
+        problems.push("command does not match the current roots, dashboard URL, or Tower runtime");
+    }
+    return problems;
+}
+function shellQuote(value) {
+    return `'${value.replace(/'/g, "'\\''")}'`;
+}

package/dist/autostart-darwin.js

@@ -0,0 +1,171 @@
+import os from "node:os";
+import { rm } from "node:fs/promises";
+import { redactedHealthDetail } from "./health-detail.js";
+import { AUTOSTART_LABEL, fileExists, plistPathFor, resolveAutostartSettings, } from "./autostart-contract.js";
+import { darwinAgentProblems, writeDarwinAutostartPlist, } from "./autostart-darwin-plist.js";
+/**
+ * Installs (or refreshes) the launchd LaunchAgent that keeps `cockpit sync`
+ * running at login and every `intervalSeconds`. Mirrors the plist in
+ * docs/runbooks/cockpit-launchd-sync.md exactly, but writes resolved absolute
+ * log paths (launchd does not expand `$HOME`). The unload before load makes the
+ * install idempotent — re-running picks up a changed repo/url/interval.
+ */
+export async function installDarwinAgent(options) {
+    const written = await writeDarwinAutostartPlist(options);
+    const load = await reloadLaunchAgent(options.exec, written.plist_path);
+    reportDarwinInstall(written, load);
+    return {
+        status: "installed",
+        label: AUTOSTART_LABEL,
+        plist_path: written.plist_path,
+        loaded: load.code === 0,
+        interval_seconds: written.interval_seconds,
+        work_dir: written.work_dir,
+        work_dirs: written.work_dirs,
+        dashboard_url: written.dashboard_url,
+        ...(load.code === 0
+            ? {}
+            : {
+                message: `launchctl load exited ${load.code}: ${launchctlDetail(load)}`,
+            }),
+    };
+}
+/**
+ * Removes the LaunchAgent. Reports `absent` when there was nothing to remove so
+ * the command is safe to run repeatedly.
+ */
+export async function uninstallDarwinAgent(options) {
+    const homeDir = options.homeDir ?? os.homedir();
+    const plistPath = plistPathFor(homeDir);
+    if (!(await fileExists(plistPath))) {
+        return { status: "absent", label: AUTOSTART_LABEL, plist_path: plistPath };
+    }
+    // Same reasoning as the install path above: an agent that was never loaded
+    // makes unload fail harmlessly, and the plist is removed either way, so the
+    // error is deliberately ignored (BLI-3238).
+    await options.exec("launchctl", ["unload", plistPath]).catch(() => undefined);
+    await rm(plistPath, { force: true });
+    return { status: "uninstalled", label: AUTOSTART_LABEL, plist_path: plistPath };
+}
+/**
+ * Reports whether the agent is installed, loaded, and still matches the
+ * configured roots, cadence, dashboard URL, and Cockpit runtime.
+ */
+export async function darwinAgentStatus(options) {
+    const homeDir = options.homeDir ?? os.homedir();
+    const plistPath = plistPathFor(homeDir);
+    if (!(await fileExists(plistPath))) {
+        return { status: "absent", label: AUTOSTART_LABEL, plist_path: plistPath };
+    }
+    const settings = resolveAutostartSettings(options, "darwin");
+    const problems = await darwinAgentProblems(options, settings);
+    const list = await options.exec("launchctl", ["list", AUTOSTART_LABEL]);
+    if (list.code !== 0)
+        problems.unshift("agent is not loaded");
+    return {
+        status: problems.length === 0 ? "loaded" : "not_loaded",
+        label: AUTOSTART_LABEL,
+        plist_path: plistPath,
+        interval_seconds: settings.interval_seconds,
+        work_dir: settings.work_dir,
+        work_dirs: settings.work_dirs,
+        dashboard_url: settings.dashboard_url,
+        ...(problems.length > 0
+            ? { message: `launchd agent needs repair: ${problems.join("; ")}` }
+            : {}),
+    };
+}
+/**
+ * Unload-then-load, the interactive install's registration verbs. Unload first
+ * so a changed plist is actually picked up; a not-yet-loaded agent makes unload
+ * fail harmlessly, so the error is ignored.
+ */
+async function reloadLaunchAgent(exec, plistPath) {
+    await exec("launchctl", ["unload", plistPath]).catch(() => undefined);
+    return exec("launchctl", ["load", plistPath]);
+}
+/**
+ * Both branches log, for the same reason the Windows path does: a line that
+ * only fires on failure cannot answer "did background collection get installed
+ * at all today?". Until BLI-3483 the macOS failure existed only in the returned
+ * `message`, which nothing on the sync path reads — a Mac could finish
+ * `cockpit onboard` with no scheduler and nothing in sync.err.log.
+ * Metadata only: launchctl's stderr can carry the state directory, so the exit
+ * code and the redacted first line travel, never the raw text.
+ */
+function reportDarwinInstall(written, load) {
+    if (load.code === 0) {
+        console.error("[autostart] launchd agent loaded", JSON.stringify({
+            label: AUTOSTART_LABEL,
+            interval_seconds: written.interval_seconds,
+            watch_path_count: written.watch_path_count,
+            node_path_reason: written.node_path_reason,
+        }));
+        return;
+    }
+    console.error("[autostart] launchctl load failed; this Mac has no background collection", JSON.stringify({
+        reason: "autostart_load_failed",
+        label: AUTOSTART_LABEL,
+        exit_code: load.code,
+        detail: launchctlDetail(load),
+    }));
+}
+/**
+ * What `launchctl` actually said, or an honest account of it saying nothing.
+ *
+ * "unknown error" was the old fallback, and it is the least useful string in
+ * the file: `launchctl load` exits nonzero with EMPTY stderr for the ordinary
+ * cases — the agent is already loaded, or the plist was rejected — so the
+ * message an operator saw named neither the exit code's meaning nor the
+ * silence itself (BLI-3483). Exit 1 with no output is a fact; say so, and say
+ * what to do next. stdout is consulted too because launchctl is inconsistent
+ * about which stream it uses across macOS versions.
+ */
+function launchctlDetail(result) {
+    const spoken = result.stderr.trim() || result.stdout.trim();
+    if (spoken)
+        return redactedHealthDetail(spoken);
+    return `no output on either stream (exit ${result.code}); the agent may already be loaded, or launchd rejected the plist — check \`launchctl print gui/$(id -u)/${AUTOSTART_LABEL}\``;
+}
+/** `gui/<uid>` — the per-user launchd domain the LaunchAgent lives in. */
+export function launchdUserDomain(uid = process.getuid?.() ?? 0) {
+    return `gui/${uid}`;
+}
+/**
+ * Re-registers the LaunchAgent with the modern verbs (BLI-3553).
+ *
+ * `unload`/`load` is what the interactive install path uses and it stays there;
+ * this exists for the DETACHED healer, where the difference matters:
+ * `bootstrap` reports a rejected plist with a real error, whereas `load` is
+ * documented-deprecated and exits nonzero with empty output for several
+ * unrelated states (see launchctlDetail). The healer gets one shot and has no
+ * human watching, so it uses the verb that says what went wrong.
+ *
+ * `bootout` on a service that is not loaded exits nonzero (`3: No such
+ * process`); that is the expected steady state after the job that spawned us
+ * exited, so it is not treated as a failure. Only `bootstrap` decides the
+ * outcome. If it fails, the agent is left unloaded — recoverable, because
+ * launchd bootstraps everything in ~/Library/LaunchAgents at the next login,
+ * and the plist file itself was already rewritten before this call.
+ */
+export async function reregisterDarwinAgent(options) {
+    const domain = launchdUserDomain(options.uid);
+    const bootout = await options
+        .exec("launchctl", ["bootout", `${domain}/${AUTOSTART_LABEL}`])
+        .catch(() => ({ code: 1, stdout: "", stderr: "" }));
+    const bootstrap = await options
+        .exec("launchctl", ["bootstrap", domain, options.plistPath])
+        .catch(() => ({ code: 1, stdout: "", stderr: "" }));
+    if (bootstrap.code === 0) {
+        return {
+            ok: true,
+            reason: "agent_rebootstrapped",
+            detail: `bootout exit ${bootout.code}`,
+        };
+    }
+    return {
+        ok: false,
+        reason: "bootstrap_failed",
+        detail: `launchctl bootstrap exited ${bootstrap.code}: ${launchctlDetail(bootstrap)}`,
+    };
+}