max / makenotwork

ops-exec: give the ops-agent LaunchAgent a PATH that finds tailscale launchd hands a job only /usr/bin:/bin:/usr/sbin:/sbin. The agent shells `tailscale whois` to authorize every caller, and the Tailscale CLI lives in Homebrew's prefix, so whois failed to spawn on a real install. The failure is quiet and easy to misread: whois erroring makes resolve_caller return Err, which health reports as empty capabilities by design (an unknown peer learns the agent is up and nothing more). So the agent looks healthy, listens, and denies every step. Observed on mbp: /health returned actuate=[] until PATH included /opt/homebrew/bin. Covers both Homebrew prefixes (Apple Silicon and Intel). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Max Johnson <me@maxj.phd> · 2026-07-16 14:37 UTC

Commit: 202af2d98f416543cd411ed5d3813932508fad0f

Parent: 7f9475a

1 file changed, +14 insertions, -0 deletions

M shared/ops-exec/deploy/work.makenot.ops-agent.plist +14

			@@ -38,6 +38,20 @@
38	38		<key>LimitLoadToSessionType</key>
39	39		<string>Aqua</string>
40	40
	41	+	<!--
	42	+	launchd gives a job only /usr/bin:/bin:/usr/sbin:/sbin. The agent shells
	43	+	`tailscale whois` to authorize every caller, and the Tailscale CLI lives in
	44	+	Homebrew's prefix (/opt/homebrew/bin on Apple Silicon, /usr/local/bin on
	45	+	Intel). Without these on PATH, whois fails, every caller resolves to no
	46	+	grant, and the agent answers /health with empty capabilities while denying
	47	+	every step -- it looks up but does nothing.
	48	+	-->
	49	+	<key>EnvironmentVariables</key>
	50	+	<dict>
	51	+	<key>PATH</key>
	52	+	<string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
	53	+	</dict>
	54	+
41	55		<key>StandardOutPath</key>
42	56		<string>/Users/max/Library/Logs/ops-agent.out.log</string>
43	57		<key>StandardErrorPath</key>