troxy-cli 1.29.6 → 1.29.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.29.6",
+  "version": "1.29.7",
   "description": "A secure control layer for AI agents: policies across payments, messages, logins, destructive actions, model usage, and secrets, all enforceable from the CLI",
   "homepage": "https://troxy.io",
   "bugs": {

package/src/init.js

@@ -9,6 +9,7 @@ import { INTERCEPTOR_PORT } from './daemon.js';
 import { ensureInterceptionCerts } from './tls-ca.js';
 import { enabledProviders, interceptHostsFor } from './providers.js';
 import { probePort } from './proxy.js';
+import { launchdUserDomain } from './launchd.js';
 
 // Re-point every consumer of the API key (MCP client configs, the background service /
 // systemd env file / launchd plist, OpenClaw) at `key`. Shared by runInit and rotate-key
@@ -467,8 +468,12 @@ WantedBy=multi-user.target
     // owner only. launchd runs as this same user and can still read it.
     fs.writeFileSync(plistPath, plist, { mode: 0o600 });
     fs.chmodSync(plistPath, 0o600);
-    try { execSync(`launchctl unload ${plistPath} 2>/dev/null`); } catch {}
-    execSync(`launchctl load ${plistPath}`);
+    // bootstrap/bootout with an explicit domain, not load/unload - see
+    // launchd.js's own docstring for why plain load/unload breaks when
+    // this whole process is running as root (e.g. `sudo troxy update`).
+    const domain = launchdUserDomain();
+    try { execSync(`launchctl bootout ${domain} ${plistPath} 2>/dev/null`); } catch {}
+    execSync(`launchctl bootstrap ${domain} ${plistPath}`);
 
   } else {
     throw new Error('Auto-start not supported on this platform. Start manually: troxy mcp &');

package/src/launchd.js

@@ -0,0 +1,44 @@
+// macOS launchd domain-target helper, shared by init.js's installService and
+// uninstall.js's removeService.
+//
+// Found live 2026-09-12: `sudo troxy update` - the CLI's own suggested
+// remedy for a permission-denied global npm install (see bin/troxy.js's
+// EACCES handling) - runs the whole re-provisioning flow, including the
+// LaunchAgent (re)install, as root. The old code called plain `launchctl
+// load <plist>` / `launchctl unload <plist>` regardless of who's actually
+// running it. launchctl's classic load/unload verbs infer the target
+// domain from the CALLING process's own identity - called as root, they
+// assume you mean a system-wide LaunchDaemon (/Library/LaunchDaemons), and
+// refuse a per-user LaunchAgent plist outright: "Expecting a LaunchDaemons
+// path since the command was run as root... Load failed: 5: Input/output
+// error". A LaunchAgent is inherently a per-user concept - there is no
+// version of this that's actually meant to run as root.
+//
+// The fix launchctl's own warning names is bootstrap/bootout, which take
+// an EXPLICIT target domain instead of inferring one from the caller's
+// identity - root can bootstrap a job into another user's domain by
+// design (this is the standard, supported way for a root-context script
+// to manage a per-user service), and a normal, unprivileged user can
+// bootstrap into their own domain the same way. Works correctly either
+// way, unlike load/unload.
+//
+// user/<uid>, not gui/<uid>: troxy's daemon needs no GUI/Aqua session, and
+// troxy explicitly targets "your laptop, a server, a VM" (see the CLI's
+// own README) - a server or VM may have no GUI login at all, where
+// gui/<uid> would fail outright. user/<uid> exists as soon as the user is
+// logged in at all, GUI or headless SSH-only alike.
+
+/**
+ * The launchd domain-target to bootstrap/bootout ai.troxy.mcp.plist into -
+ * correct whether or not the calling process itself is root.
+ *
+ * `env.SUDO_UID` is what `sudo` itself sets to the REAL invoking user, not
+ * the elevated one - `process.getuid()` is 0 (root) for the whole process
+ * once elevated, which is exactly the case this exists to handle. Falls
+ * back to `getuid()` for the normal, non-sudo case, where that call
+ * already returns the real, correct user.
+ */
+export function launchdUserDomain(env = process.env, getuid = () => process.getuid?.()) {
+  const uid = env.SUDO_UID || String(getuid() ?? '');
+  return `user/${uid}`;
+}

package/src/tests/install-service.test.js

@@ -59,11 +59,14 @@ describe('installService: launchd log capture (source inspection)', () => {
   });
 
   it('creates the ~/.troxy log directory before the plist is loaded', () => {
+    // 'launchctl bootstrap', not 'launchctl load' - see launchd.test.js for
+    // why the verb changed (bootstrap/bootout with an explicit domain,
+    // needed so this doesn't break under `sudo troxy update`).
     const darwinIdx = initSrc.indexOf("platform === 'darwin'");
     const troxyDirIdx = initSrc.indexOf('const troxyDir', darwinIdx);
     const mkdirIdx = initSrc.indexOf('fs.mkdirSync(troxyDir', darwinIdx);
-    const loadIdx = initSrc.indexOf('launchctl load', darwinIdx);
+    const loadIdx = initSrc.indexOf('launchctl bootstrap', darwinIdx);
     assert.ok(troxyDirIdx !== -1 && mkdirIdx !== -1 && loadIdx !== -1);
-    assert.ok(mkdirIdx < loadIdx, 'the log directory must be created before launchctl load runs');
+    assert.ok(mkdirIdx < loadIdx, 'the log directory must be created before launchctl bootstrap runs');
   });
 });

package/src/tests/launchd.test.js

@@ -0,0 +1,70 @@
+// Found live 2026-09-12: `sudo troxy update` (the CLI's own suggested
+// remedy for a permission-denied global npm install) runs the whole
+// re-provisioning flow as root, including the LaunchAgent (re)install.
+// launchctl's classic load/unload verbs infer their target domain from the
+// CALLING process's own identity - called as root, they assume a system
+// LaunchDaemon and refuse a per-user LaunchAgent outright ("Expecting a
+// LaunchDaemons path... Load failed: 5: Input/output error"). See
+// launchd.js's own docstring for the full reasoning and the fix
+// (bootstrap/bootout with an explicit domain instead).
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+import { launchdUserDomain } from '../launchd.js';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const initSrc = readFileSync(join(__dirname, '..', 'init.js'), 'utf8');
+const uninstallSrc = readFileSync(join(__dirname, '..', 'uninstall.js'), 'utf8');
+
+describe('launchdUserDomain', () => {
+  it('uses SUDO_UID when running under sudo, ignoring the elevated (root) uid', () => {
+    const domain = launchdUserDomain({ SUDO_UID: '501' }, () => 0);
+    assert.equal(domain, 'user/501');
+  });
+
+  it('falls back to the caller\'s own uid when not running under sudo', () => {
+    const domain = launchdUserDomain({}, () => 501);
+    assert.equal(domain, 'user/501');
+  });
+
+  it('prefers SUDO_UID even if somehow both are present', () => {
+    const domain = launchdUserDomain({ SUDO_UID: '501' }, () => 0);
+    assert.notEqual(domain, 'user/0');
+  });
+
+  it('never throws when getuid is unavailable (e.g. non-POSIX platform)', () => {
+    assert.doesNotThrow(() => launchdUserDomain({}, () => undefined));
+  });
+});
+
+describe('installService / removeService: bootstrap-not-load (source inspection)', () => {
+  it('init.js darwin branch uses bootstrap/bootout, not the old load/unload verbs', () => {
+    const darwinIdx = initSrc.indexOf("platform === 'darwin'");
+    assert.ok(darwinIdx !== -1, 'darwin branch not found');
+    const darwinBlock = initSrc.slice(darwinIdx, initSrc.indexOf('function mcpEntry'));
+    assert.match(darwinBlock, /launchctl bootstrap/);
+    assert.match(darwinBlock, /launchctl bootout/);
+    assert.doesNotMatch(darwinBlock, /launchctl load \$\{plistPath\}/);
+    assert.doesNotMatch(darwinBlock, /launchctl unload \$\{plistPath\}/);
+  });
+
+  it('init.js passes an explicit domain to both bootstrap and bootout', () => {
+    const darwinIdx = initSrc.indexOf("platform === 'darwin'");
+    const darwinBlock = initSrc.slice(darwinIdx, initSrc.indexOf('function mcpEntry'));
+    assert.match(darwinBlock, /launchdUserDomain\(\)/);
+    assert.match(darwinBlock, /launchctl bootstrap \$\{domain\}/);
+    assert.match(darwinBlock, /launchctl bootout \$\{domain\}/);
+  });
+
+  it('uninstall.js darwin branch uses bootout, not the old unload verb', () => {
+    const darwinIdx = uninstallSrc.indexOf("platform === 'darwin'");
+    assert.ok(darwinIdx !== -1, 'darwin branch not found in uninstall.js');
+    const darwinBlock = uninstallSrc.slice(darwinIdx, darwinIdx + 400);
+    assert.match(darwinBlock, /launchctl bootout \$\{launchdUserDomain\(\)\}/);
+    assert.doesNotMatch(darwinBlock, /launchctl unload \$\{plistPath\}/);
+  });
+});

package/src/uninstall.js

@@ -10,6 +10,7 @@ import {
   unpatchClaudeCodeConfig, unpatchClaudeCodeHooks,
   unpatchClaudeCodeProxy, unpatchClaudeCodeInterception,
 } from './init.js';
+import { launchdUserDomain } from './launchd.js';
 
 const MCP_CLIENTS = [
   {
@@ -57,7 +58,9 @@ function removeService() {
   } else if (platform === 'darwin') {
     const plistPath = path.join(os.homedir(), 'Library/LaunchAgents/ai.troxy.mcp.plist');
     if (fs.existsSync(plistPath)) {
-      try { execSync(`launchctl unload ${plistPath} 2>/dev/null`); } catch {}
+      // bootout with an explicit domain, not unload - see launchd.js's
+      // docstring for why plain unload breaks under `sudo troxy uninstall`.
+      try { execSync(`launchctl bootout ${launchdUserDomain()} ${plistPath} 2>/dev/null`); } catch {}
       fs.unlinkSync(plistPath);
     }
     return true;