macos-watchdog

Write a plist with Label, ProgramArguments (absolute paths), and StartInterval into ~/Library/LaunchAgents, then load it with launchctl bootstrap gui/$(id -u) <plist>. Always set StandardOutPath and StandardErrorPath so failures are visible, and validate the plist with plutil -lint.

Use launchctl bootout gui/$(id -u)/<label> to stop now, and launchctl disable user/$(id -u)/<label> to keep it stopped across logins. Never use launchctl unload — it is deprecated and on Ventura+ the job re-loads via RunAtLoad while the plist remains in place.

The open command with a URL scheme launches the target app when it is not running, and without -g it also steals foreground. Gate every such action with a pgrep process-alive check and pass -g, and make cleanup traps honor the same gate.

No. ThrottleInterval only rate-limits process respawn with a fixed delay and no backoff; a job that runs, spams, and exits 0 is outside its reach. Escalating cooldown must be implemented in the script itself using a state file and backoff tiers.

launchd jobs do not inherit your shell environment or PATH, so ProgramArguments must use absolute paths and explicit EnvironmentVariables. TCC or Full Disk Access must also be granted to the exact interpreter binary in ProgramArguments, not the one your shell resolves.

Notify only when the failure persists beyond the self-recovery window, the full remediation ladder has failed, and it is the first notification for that failure sequence. Everything else should be a log line; entering cooldown warrants exactly one message, then silence.