troxy-cli 1.29.8 → 1.29.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.29.8",
+  "version": "1.29.9",
   "description": "A secure control layer for AI agents: policies across payments, messages, logins, destructive actions, model usage, and secrets, all enforceable from the CLI",
   "homepage": "https://troxy.io",
   "bugs": {

package/src/launchd.js

@@ -22,11 +22,21 @@
 // bootstrap into their own domain the same way. Works correctly either
 // way, unlike load/unload.
 //
-// user/<uid>, not gui/<uid>: troxy's daemon needs no GUI/Aqua session, and
-// troxy explicitly targets "your laptop, a server, a VM" (see the CLI's
-// own README) - a server or VM may have no GUI login at all, where
-// gui/<uid> would fail outright. user/<uid> exists as soon as the user is
-// logged in at all, GUI or headless SSH-only alike.
+// gui/<uid>, NOT user/<uid> - corrected 2026-09-12 after shipping user/<uid>
+// first and getting this wrong in practice: a real, normal (non-sudo)
+// `troxy update` run then failed with "Bootstrap failed: 5: Input/output
+// error" bootstrapping into user/501. `man launchctl` confirms why - gui
+// and user are DISCRETE domains with their own separate sets of services
+// (not two names for the same thing), and Apple's own canonical example in
+// that same man page loads a per-user service into gui/<uid>, not
+// user/<uid>. The original reasoning for user/<uid> (a server/VM might
+// have no GUI login) doesn't actually apply here: this whole branch is
+// darwin-only, and a Mac running Troxy for Claude Desktop already requires
+// an active GUI session for Claude Desktop itself to run at all - the
+// "headless Mac" case this was trying to additionally support isn't a
+// real configuration for this specific daemon. Lesson: this got shipped
+// on man-page reading plus reasoning about what SHOULD work, not on
+// checking a real bootstrap call - the second attempt fixed that.
 
 /**
  * The launchd domain-target to bootstrap/bootout ai.troxy.mcp.plist into -
@@ -40,5 +50,5 @@
  */
 export function launchdUserDomain(env = process.env, getuid = () => process.getuid?.()) {
   const uid = env.SUDO_UID || String(getuid() ?? '');
-  return `user/${uid}`;
+  return `gui/${uid}`;
 }

package/src/tests/launchd.test.js

@@ -23,17 +23,17 @@ const uninstallSrc = readFileSync(join(__dirname, '..', 'uninstall.js'), 'utf8')
 describe('launchdUserDomain', () => {
   it('uses SUDO_UID when running under sudo, ignoring the elevated (root) uid', () => {
     const domain = launchdUserDomain({ SUDO_UID: '501' }, () => 0);
-    assert.equal(domain, 'user/501');
+    assert.equal(domain, 'gui/501');
   });
 
   it('falls back to the caller\'s own uid when not running under sudo', () => {
     const domain = launchdUserDomain({}, () => 501);
-    assert.equal(domain, 'user/501');
+    assert.equal(domain, 'gui/501');
   });
 
   it('prefers SUDO_UID even if somehow both are present', () => {
     const domain = launchdUserDomain({ SUDO_UID: '501' }, () => 0);
-    assert.notEqual(domain, 'user/0');
+    assert.notEqual(domain, 'gui/0');
   });
 
   it('never throws when getuid is unavailable (e.g. non-POSIX platform)', () => {