@homeflare/alchemy 0.6.0 → 0.8.0

package/src/launchd/sudo-lifecycle.test.ts

@@ -0,0 +1,172 @@
+/**
+ * The real LaunchdJob and HostFile lifecycles, driven through sudoRunner over the fake host: the
+ * deploying user is uid 501, and the only way anything root-owned changes is an allowlisted
+ * `sudo -n` call. No real sudo, launchctl or /Library write happens.
+ *
+ * ★ The assertions are on the PRIVILEGED SEQUENCE, because that list is the whole point: a plan
+ *   needs none, a create is install + bootstrap, a delete is bootout + rm.
+ */
+import { describe, expect, test } from 'bun:test';
+import { fakeSudoHost } from './fake-sudo.ts';
+import { deleteFile, reconcileFile } from './host-file-lifecycle.ts';
+import type { LaunchdJobAttributes, LaunchdJobProps } from './job-form.ts';
+import { deleteJob, diffJob, readJob, reconcileJob } from './job-lifecycle.ts';
+import { INSTALL, RM } from './sudo-allowlist.ts';
+
+const DAEMON = '/Library/LaunchDaemons/com.example.job.plist';
+const job: LaunchdJobProps = {
+  domain: 'system',
+  keepAlive: true,
+  label: 'com.example.job',
+  programArguments: ['/usr/local/bin/job'],
+};
+
+/** Each privileged call as its program and first operand, e.g. `launchctl bootout`. */
+const fail = (): never => {
+  throw new Error('the deployed plist is missing');
+};
+
+const verbs = (privileged: string[][]) =>
+  privileged.map(([program, first]) =>
+    program === INSTALL ? 'install' : program === RM ? 'rm' : `launchctl ${String(first)}`,
+  );
+
+describe('a system daemon, deployed as the operator', () => {
+  test('create is install then bootstrap; the plist lands root:wheel 0644', async () => {
+    const host = fakeSudoHost();
+    const attrs = await reconcileJob(host.runner, job, undefined);
+    expect(verbs(host.privileged())).toEqual(['install', 'launchctl bootstrap']);
+    expect(host.fake.files.get(DAEMON)).toMatchObject({ gid: 0, mode: 0o644, uid: 0 });
+    expect(attrs).toMatchObject({ loaded: true, plistPath: DAEMON });
+    expect(host.logs).toHaveLength(2);
+  });
+
+  test('a plan (read, diff) needs no sudo at all', async () => {
+    const host = fakeSudoHost();
+    const attrs = await reconcileJob(host.runner, job, undefined);
+    const before = host.sudoCalls.length;
+    expect(await readJob(host.runner, job)).toMatchObject({ loaded: true });
+    expect(await diffJob(host.runner, job, attrs)).toEqual({ action: 'noop' });
+    expect(await diffJob(host.runner, { ...job, runAtLoad: true }, attrs)).toEqual({
+      action: 'update',
+    });
+    expect(host.sudoCalls).toHaveLength(before);
+  });
+
+  test('update is install, bootout, bootstrap — in that order', async () => {
+    const host = fakeSudoHost();
+    const attrs = await reconcileJob(host.runner, job, undefined);
+    await reconcileJob(host.runner, { ...job, runAtLoad: true }, attrs);
+    expect(verbs(host.privileged())).toEqual([
+      'install',
+      'launchctl bootstrap',
+      'install',
+      'launchctl bootout',
+      'launchctl bootstrap',
+    ]);
+  });
+
+  test('delete is bootout then rm', async () => {
+    const host = fakeSudoHost();
+    const attrs = await reconcileJob(host.runner, job, undefined);
+    await deleteJob(host.runner, attrs);
+    expect(verbs(host.privileged()).slice(2)).toEqual(['launchctl bootout', 'rm']);
+    expect(host.fake.files.has(DAEMON)).toBe(false);
+    expect(host.fake.loaded.has('system/com.example.job')).toBe(false);
+  });
+
+  test('sudo wanting a password on an update leaves the old job running, untouched', async () => {
+    const host = fakeSudoHost();
+    const attrs = await reconcileJob(host.runner, job, undefined);
+    const pid = host.fake.loaded.get('system/com.example.job');
+    const before = host.fake.files.get(DAEMON)?.bytes;
+    host.state.sudo = 'password';
+    await expect(reconcileJob(host.runner, { ...job, runAtLoad: true }, attrs)).rejects.toThrow(
+      'a password is required',
+    );
+    expect(host.fake.loaded.get('system/com.example.job')).toBe(pid);
+    expect(host.fake.files.get(DAEMON)?.bytes).toBe(before);
+  });
+});
+
+test('without /Library/LaunchDaemons declared, a delete is refused before the bootout', async () => {
+  const deployed = fakeSudoHost();
+  const attrs = await reconcileJob(deployed.runner, job, undefined);
+  // The same host, now driven by a runner that declares only /opt/example.
+  const narrow = fakeSudoHost([20, 80], ['/opt/example']);
+  narrow.fake.files.set(DAEMON, deployed.fake.files.get(DAEMON) ?? fail());
+  narrow.fake.loaded.set('system/com.example.job', 4242);
+  await expect(deleteJob(narrow.runner, attrs)).rejects.toThrow('/Library/LaunchDaemons');
+  // ⚠️ Not half a delete: the job still runs and its plist is still there, both or neither.
+  expect(narrow.fake.loaded.get('system/com.example.job')).toBe(4242);
+  expect(narrow.fake.files.has(DAEMON)).toBe(true);
+  expect(narrow.sudoCalls).toEqual([]);
+});
+
+describe("another user's gui domain is not elevated", () => {
+  const theirs: LaunchdJobProps = { ...job, domain: 'gui/502' };
+
+  test('create is refused at the write, with nothing written or loaded', async () => {
+    const host = fakeSudoHost();
+    await expect(reconcileJob(host.runner, theirs, undefined)).rejects.toThrow(
+      'owner 502 needs root',
+    );
+    expect(host.fake.files.size).toBe(0);
+    expect(host.sudoCalls).toEqual([]);
+  });
+
+  test('delete is refused at the bootout, and their job keeps running', async () => {
+    const host = fakeSudoHost();
+    host.fake.loaded.set('gui/502/com.example.job', 4242);
+    const output: LaunchdJobAttributes = {
+      domain: 'gui/502',
+      label: 'com.example.job',
+      loaded: true,
+      plistPath: '/Users/other/Library/LaunchAgents/com.example.job.plist',
+      plistSha256: '',
+      serviceTarget: 'gui/502/com.example.job',
+    };
+    await expect(deleteJob(host.runner, output)).rejects.toThrow('elevates only the system domain');
+    expect(host.fake.loaded.get('gui/502/com.example.job')).toBe(4242);
+    expect(host.sudoCalls).toEqual([]);
+  });
+});
+
+describe('a root-owned HostFile under a declared prefix', () => {
+  const PATH = '/opt/example/app/exporter.yml';
+  const file = {
+    content: 'listen: 127.0.0.1:9100\n',
+    group: 80,
+    mode: 0o640,
+    owner: 0,
+    path: PATH,
+  };
+
+  test('is installed with its owner, group and mode, verified by the read-back', async () => {
+    const host = fakeSudoHost();
+    const attrs = await reconcileFile(host.runner, file);
+    expect(attrs).toMatchObject({ gid: 80, mode: 0o640, uid: 0 });
+    expect(host.privileged()[0]?.slice(0, 8)).toEqual([
+      INSTALL,
+      '-S',
+      '-m',
+      '0640',
+      '-o',
+      '0',
+      '-g',
+      '80',
+    ]);
+    await deleteFile(host.runner, attrs);
+    expect(verbs(host.privileged())).toEqual(['install', 'rm']);
+    expect(host.fake.files.has(PATH)).toBe(false);
+  });
+
+  test('a mode the operator could not read back is refused with nothing written', async () => {
+    const host = fakeSudoHost();
+    await expect(reconcileFile(host.runner, { ...file, group: 0, mode: 0o600 })).rejects.toThrow(
+      'Nothing was written',
+    );
+    expect(host.fake.files.has(PATH)).toBe(false);
+    expect(host.sudoCalls).toEqual([]);
+  });
+});

package/src/launchd/sudo-runner-files.test.ts

@@ -0,0 +1,240 @@
+/**
+ * sudoRunner's file writes and removes over the fake host (fake-sudo.ts): under a prefix they go
+ * through `install` / `rm` as root; everything a mistaken declaration could turn into a root write
+ * somewhere unintended is refused before anything is staged. No real sudo runs anywhere.
+ */
+import { describe, expect, test } from 'bun:test';
+import { OPERATOR, fakeSudoHost } from './fake-sudo.ts';
+import type { FileStat } from './runner.ts';
+import { INSTALL, RM, SudoRefusedError } from './sudo-allowlist.ts';
+
+const CONF = '/opt/example/app/a.conf';
+const bytes = (text: string) => new TextEncoder().encode(text);
+const plistBytes = bytes('<key>Label</key><string>com.example.a</string>');
+
+describe('writeFileAtomic', () => {
+  test('under a prefix: staged, installed with mode and owner from argv, staged file removed', async () => {
+    const host = fakeSudoHost();
+    await host.runner.writeFileAtomic(CONF, bytes('listen: 127.0.0.1:9100\n'), {
+      gid: 80,
+      mode: 0o640,
+      uid: 0,
+    });
+    const [install] = host.privileged();
+    expect(install).toEqual([
+      INSTALL,
+      '-S',
+      '-m',
+      '0640',
+      '-o',
+      '0',
+      '-g',
+      '80',
+      expect.any(String),
+      CONF,
+    ]);
+    expect(host.state.installedFrom.get(CONF)).toBe('listen: 127.0.0.1:9100\n');
+    expect(host.fake.files.get(CONF)).toMatchObject({ gid: 80, mode: 0o640, uid: 0 });
+    expect(host.staged.size).toBe(0);
+    // ⛔ The log carries the argv, never the content.
+    expect(host.logs.join('\n')).not.toContain('127.0.0.1');
+  });
+
+  test('a failed install throws and still removes the staged file', async () => {
+    const host = fakeSudoHost();
+    host.state.installFailure = { exitCode: 71, stderr: 'install: disk full', stdout: '' };
+    await expect(host.runner.writeFileAtomic(CONF, bytes('x'), { mode: 0o644 })).rejects.toThrow(
+      '-> 71: install: disk full',
+    );
+    expect(host.staged.size).toBe(0);
+    expect(host.fake.files.has(CONF)).toBe(false);
+  });
+
+  test("outside every prefix, the operator's own file is written by the operator", async () => {
+    const host = fakeSudoHost();
+    const path = '/Users/someone/Library/LaunchAgents/com.example.a.plist';
+    await host.runner.writeFileAtomic(path, plistBytes, { mode: 0o644, uid: OPERATOR });
+    expect(host.fake.files.get(path)).toMatchObject({ uid: OPERATOR });
+    expect(host.sudoCalls).toEqual([]);
+  });
+
+  test('outside every prefix, a foreign owner is refused and nothing is written', async () => {
+    const host = fakeSudoHost();
+    const path = '/Users/someone/Library/LaunchAgents/x.conf';
+    await expect(
+      host.runner.writeFileAtomic(path, bytes('x'), { mode: 0o644, uid: 502 }),
+    ).rejects.toThrow('owner 502 needs root');
+    expect(host.fake.files.has(path)).toBe(false);
+    expect(host.sudoCalls).toEqual([]);
+  });
+
+  test.each([
+    ['a directory at the path', '/opt/example/app', 'is a directory'],
+    ['a missing directory on the way', '/opt/example/none/a.conf', '/opt/example/none is missing'],
+  ])('%s is refused before anything is staged', async (_name, path, message) => {
+    const host = fakeSudoHost();
+    await expect(host.runner.writeFileAtomic(path, bytes('x'), { mode: 0o644 })).rejects.toThrow(
+      message,
+    );
+    expect(host.state.stagedCount).toBe(0);
+    expect(host.sudoCalls).toEqual([]);
+  });
+
+  test('a symlinked directory under the prefix is refused', async () => {
+    const host = fakeSudoHost();
+    host.fake.files.set('/opt/example/link', {
+      bytes: bytes(''),
+      gid: 0,
+      kind: 'symlink',
+      mode: 0o755,
+      uid: 0,
+    });
+    await expect(
+      host.runner.writeFileAtomic('/opt/example/link/a.conf', bytes('x'), { mode: 0o644 }),
+    ).rejects.toThrow('/opt/example/link is a symlink');
+    expect(host.sudoCalls).toEqual([]);
+  });
+
+  test('a file the operator could not read back is refused before staging', async () => {
+    const host = fakeSudoHost();
+    await expect(
+      host.runner.writeFileAtomic(CONF, bytes('x'), { gid: 0, mode: 0o600, uid: 0 }),
+    ).rejects.toThrow('would hide it from the deploying user');
+    expect(host.state.stagedCount).toBe(0);
+    // Group-readable through one of the operator's groups is fine; so are unknown groups.
+    await host.runner.writeFileAtomic(CONF, bytes('x'), { gid: 80, mode: 0o640, uid: 0 });
+    await fakeSudoHost('unknown').runner.writeFileAtomic(CONF, bytes('x'), {
+      gid: 99,
+      mode: 0o640,
+      uid: 0,
+    });
+  });
+
+  test('an omitted owner is root and an omitted group the directory’s, for the read-back check', async () => {
+    // ⚠️ Omitted owner: root, so 0600 is root-only and refused (not the operator's own 0600).
+    const host = fakeSudoHost();
+    await expect(host.runner.writeFileAtomic(CONF, bytes('x'), { mode: 0o600 })).rejects.toThrow(
+      'would hide it from the deploying user',
+    );
+    // Omitted group: the parent's (80, one of the operator's), so 0640 is readable and allowed.
+    host.fake.files.set('/opt/example/app', {
+      bytes: bytes(''),
+      gid: 80,
+      kind: 'directory',
+      mode: 0o755,
+      uid: 0,
+    });
+    await host.runner.writeFileAtomic(CONF, bytes('x'), { mode: 0o640 });
+    expect(host.fake.files.get(CONF)).toMatchObject({ gid: 80, mode: 0o640, uid: 0 });
+  });
+
+  test('a mode chmod cannot mean is a refusal, before anything is staged', async () => {
+    const host = fakeSudoHost();
+    await expect(
+      host.runner.writeFileAtomic(CONF, bytes('x'), { mode: 0o10000 }),
+    ).rejects.toBeInstanceOf(SudoRefusedError);
+    expect(host.state.stagedCount).toBe(0);
+  });
+
+  test('outside every prefix, EACCES names the missing prefix instead of a temp file', async () => {
+    const host = fakeSudoHost();
+    await expect(
+      host.runner.writeFileAtomic('/etc/example/a.conf', bytes('x'), { mode: 0o644 }),
+    ).rejects.toThrow('declare that directory as a prefix');
+    await expect(
+      host.runner.writeFileAtomic('/nowhere/a.conf', bytes('x'), { mode: 0o644 }),
+    ).rejects.toThrow('ENOENT');
+  });
+});
+
+describe('the declared prefix itself is checked at every call', () => {
+  type Host = ReturnType<typeof fakeSudoHost>;
+  const entry = (kind: FileStat['kind'], mode: number) => ({
+    bytes: bytes(''),
+    gid: 0,
+    kind,
+    mode,
+    uid: 0,
+  });
+  test.each([
+    // ⛔ `/opt/example` -> `/etc` would make root write /etc/a.conf, a path the log never names.
+    [
+      'a symlink',
+      (h: Host) => h.fake.files.set('/opt/example', entry('symlink', 0o755)),
+      'is a symlink',
+    ],
+    ['owned by the operator', (h: Host) => h.fake.dirs.set('/opt/example', OPERATOR), 'uid 501'],
+    [
+      'group-writable',
+      (h: Host) => h.fake.files.set('/opt/example', entry('directory', 0o775)),
+      '0775',
+    ],
+    [
+      'world-writable',
+      (h: Host) => h.fake.files.set('/opt/example', entry('directory', 0o757)),
+      '0757',
+    ],
+    ['missing', (h: Host) => h.fake.dirs.delete('/opt/example'), '/opt/example is missing'],
+  ])('%s is refused, before anything is staged or run', async (_name, setup, message) => {
+    const host = fakeSudoHost();
+    setup(host);
+    const write = host.runner.writeFileAtomic('/opt/example/a.conf', bytes('x'), { mode: 0o644 });
+    await expect(write).rejects.toBeInstanceOf(SudoRefusedError);
+    await expect(write).rejects.toThrow(message);
+    expect(host.state.stagedCount).toBe(0);
+    expect(host.sudoCalls).toEqual([]);
+  });
+
+  test('a remove under a group-writable prefix is refused too', async () => {
+    const host = fakeSudoHost();
+    host.fake.files.set('/opt/example', entry('directory', 0o775));
+    host.fake.files.set('/opt/example/a.conf', entry('file', 0o644));
+    await expect(host.runner.removeFile('/opt/example/a.conf')).rejects.toThrow('0775');
+    expect(host.sudoCalls).toEqual([]);
+  });
+});
+
+describe('removeFile', () => {
+  test('a directory on the way that is already gone: nothing is there, so success, no sudo', async () => {
+    const host = fakeSudoHost();
+    await host.runner.removeFile('/opt/example/gone/a.conf');
+    expect(host.sudoCalls).toEqual([]);
+    expect(host.logs).toEqual([]);
+  });
+
+  test('under a prefix: `rm -f --` through sudo', async () => {
+    const host = fakeSudoHost();
+    host.fake.files.set(CONF, { bytes: bytes('x'), gid: 0, kind: 'file', mode: 0o644, uid: 0 });
+    await host.runner.removeFile(CONF);
+    expect(host.privileged()).toEqual([[RM, '-f', '--', CONF]]);
+    expect(host.fake.files.has(CONF)).toBe(false);
+  });
+
+  test('nothing there is success with no privileged call and no log line', async () => {
+    const host = fakeSudoHost();
+    await host.runner.removeFile(CONF);
+    expect(host.sudoCalls).toEqual([]);
+    expect(host.logs).toEqual([]);
+  });
+
+  test('a directory is refused, not removed', async () => {
+    const host = fakeSudoHost();
+    await expect(host.runner.removeFile('/opt/example/app')).rejects.toThrow('is a directory');
+    expect(host.sudoCalls).toEqual([]);
+  });
+
+  test('outside every prefix it is the operator removing their own file', async () => {
+    const host = fakeSudoHost();
+    const path = '/Users/someone/Library/LaunchAgents/a.plist';
+    host.fake.files.set(path, {
+      bytes: bytes('x'),
+      gid: 20,
+      kind: 'file',
+      mode: 0o644,
+      uid: OPERATOR,
+    });
+    await host.runner.removeFile(path);
+    expect(host.fake.files.has(path)).toBe(false);
+    expect(host.sudoCalls).toEqual([]);
+  });
+});

package/src/launchd/sudo-runner.test.ts

@@ -0,0 +1,126 @@
+/**
+ * sudoRunner over the fake host (fake-sudo.ts): which calls reach sudo, in what exact argv, what
+ * is logged, and what is refused before sudo is ever asked. No real sudo runs anywhere.
+ * File writes and removes are in sudo-runner-files.test.ts.
+ */
+import { describe, expect, test } from 'bun:test';
+import { OPERATOR, PREFIXES, fakeSudoHost } from './fake-sudo.ts';
+import { LAUNCHCTL } from './launchctl.ts';
+import { RM, SUDO } from './sudo-allowlist.ts';
+import { SudoRefusedError, makeSudoRunner, sudoRunner } from './sudo-runner.ts';
+
+const PLIST = '/Library/LaunchDaemons/com.example.a.plist';
+const plistBytes = new TextEncoder().encode('<key>Label</key><string>com.example.a</string>');
+
+describe('what it claims', () => {
+  test('privileged, as the operator: it elevates calls, it is not root', () => {
+    const { runner } = fakeSudoHost();
+    expect(runner.privileged).toBe(true);
+    expect(runner.effectiveUid()).toBe(OPERATOR);
+  });
+
+  test('prefixes are required and checked when it is built', () => {
+    expect(() => sudoRunner({ prefixes: [] })).toThrow('no prefixes');
+    expect(() => sudoRunner({ prefixes: ['/'] })).toThrow('every path');
+  });
+});
+
+describe('exec', () => {
+  test('a system bootstrap runs as `sudo -n --`, logged once, argv only', async () => {
+    const host = fakeSudoHost();
+    host.fake.files.set(PLIST, { bytes: plistBytes, gid: 0, kind: 'file', mode: 0o644, uid: 0 });
+    const result = await host.runner.exec([LAUNCHCTL, 'bootstrap', 'system', PLIST]);
+    expect(result.exitCode).toBe(0);
+    expect(host.sudoCalls).toEqual([[SUDO, '-n', '--', LAUNCHCTL, 'bootstrap', 'system', PLIST]]);
+    expect(host.logs).toEqual([
+      `homeflare/launchd sudo -n ${JSON.stringify([LAUNCHCTL, 'bootstrap', 'system', PLIST])}`,
+    ]);
+  });
+
+  test('bootstrap of a plist that is not a plain file is refused before sudo', async () => {
+    const host = fakeSudoHost();
+    const missing = host.runner.exec([LAUNCHCTL, 'bootstrap', 'system', PLIST]);
+    // ★ The host checks throw the same class as the allowlist: nothing ran as root.
+    await expect(missing).rejects.toBeInstanceOf(SudoRefusedError);
+    await expect(missing).rejects.toThrow('is missing, not a file');
+    host.fake.files.set(PLIST, { bytes: plistBytes, gid: 0, kind: 'symlink', mode: 0o755, uid: 0 });
+    await expect(host.runner.exec([LAUNCHCTL, 'bootstrap', 'system', PLIST])).rejects.toThrow(
+      'is a symlink',
+    );
+    expect(host.sudoCalls).toEqual([]);
+    expect(host.logs).toEqual([]);
+  });
+
+  test('reads stay unelevated: no sudo, no log line', async () => {
+    const host = fakeSudoHost();
+    const result = await host.runner.exec([LAUNCHCTL, 'print', 'system/com.example.a']);
+    expect(result.exitCode).toBe(113);
+    await host.runner.exec([LAUNCHCTL, 'print-disabled', 'system']);
+    expect(host.sudoCalls).toEqual([]);
+    expect(host.logs).toEqual([]);
+  });
+
+  test.each([
+    ['a bare-domain bootout', [LAUNCHCTL, 'bootout', 'system']],
+    ["another user's gui domain", [LAUNCHCTL, 'bootout', 'gui/502/com.example.a']],
+    ['a sudo argv', [SUDO, '-n', RM, '-rf', '/']],
+  ])('%s is refused before sudo is asked', async (_name, argv) => {
+    const host = fakeSudoHost();
+    await expect(host.runner.exec(argv)).rejects.toBeInstanceOf(SudoRefusedError);
+    expect(host.sudoCalls).toEqual([]);
+    expect(host.logs).toEqual([]);
+  });
+
+  test('a password-required sudo fails at once, saying what to do', async () => {
+    const host = fakeSudoHost();
+    host.state.sudo = 'password';
+    const run = host.runner.exec([LAUNCHCTL, 'bootout', 'system/com.example.a']);
+    await expect(run).rejects.toBeInstanceOf(SudoRefusedError);
+    await expect(run).rejects.toThrow('a password is required');
+    await expect(run).rejects.toThrow('sudo -v');
+    expect(host.sudoCalls).toHaveLength(1);
+  });
+
+  test.each(['denied', 'not-in-sudoers', 'not-on-host'] as const)(
+    'a sudoers refusal (%s) is named as one',
+    async (refusal) => {
+      const host = fakeSudoHost();
+      host.state.sudo = refusal;
+      const run = host.runner.exec([LAUNCHCTL, 'bootout', 'system/com.example.a']);
+      await expect(run).rejects.toBeInstanceOf(SudoRefusedError);
+      await expect(run).rejects.toThrow('sudoers does not let');
+    },
+  );
+
+  test("launchctl's own failure comes back as a result, for the provider to judge", async () => {
+    const host = fakeSudoHost();
+    const result = await host.runner.exec([LAUNCHCTL, 'bootout', 'system/com.example.a']);
+    expect(result.exitCode).toBe(3);
+    expect(host.sudoCalls).toHaveLength(1);
+  });
+
+  test('a launchctl error that says "not allowed" is still launchctl\'s, not sudo\'s', async () => {
+    const host = fakeSudoHost();
+    host.fake.files.set(PLIST, { bytes: plistBytes, gid: 0, kind: 'file', mode: 0o644, uid: 0 });
+    // ⚠️ Exit 1 like sudo's own failures; only sudo's message forms may turn it into a refusal.
+    host.fake.state.bootstrapFailure = {
+      exitCode: 1,
+      stderr: 'Bootstrap failed: 1: service is not allowed to execute in this domain',
+      stdout: '',
+    };
+    const result = await host.runner.exec([LAUNCHCTL, 'bootstrap', 'system', PLIST]);
+    expect(result.exitCode).toBe(1);
+  });
+});
+
+test('makeSudoRunner validates prefixes too', () => {
+  const { fake } = fakeSudoHost();
+  const deps = {
+    base: fake.runner,
+    groups: async () => [],
+    log: () => undefined,
+    stage: async () => ({ dispose: async () => undefined, path: '' }),
+  };
+  expect(() => makeSudoRunner([], deps)).toThrow('no prefixes');
+  expect(() => makeSudoRunner(PREFIXES, deps)).not.toThrow();
+});