fix(server): keep provider CLIs available in the macOS service

[t3dotgg]

The macOS background service starts with launchd's limited PATH, so Codex, Claude, and other provider CLIs disappear if login-shell PATH recovery fails.

Save the installer's PATH in the LaunchAgent, and fall back to the Node directory plus standard macOS binary directories when PATH is missing. Focused tests cover installation, XML escaping, fallback paths, and existing service restarts.

Built by GPT-5.6 Sol in the Codex harness.

---

Note

Medium Risk
Changes macOS service install and health-check behavior for a critical background daemon; incorrect PATH could break provider CLIs or mask real plist drift via normalization.

Overview
The macOS LaunchAgent plist now sets PATH in EnvironmentVariables, built from the installer’s PATH (with non–XML-safe segments removed), plus the Node binary directory and standard macOS tool locations when entries are missing.

renderBootServicePlist and the launchd wiring take a new environmentPath argument. status.current compares plist content with the PATH value blanked out so a different shell PATH at check time does not force a reinstall.

Tests cover preserved installer paths, empty/minimal PATH fallbacks, XML escaping for PATH, invalid path segments, and unchanged “current” status when only process PATH differs.

^{Reviewed by Cursor Bugbot for commit e2e1de2. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add PATH environment variable to macOS LaunchAgent plist in bootService

• The macOS LaunchAgent plist now includes a PATH built from the installer's PATH, the host executable directory, and a fixed set of provider/system directories (/opt/homebrew/bin, /usr/local/bin, /usr/bin, /bin, /usr/sbin, /sbin)
• Invalid PATH segments containing disallowed XML control characters are dropped, and duplicate directories are de-duplicated
• renderBootServicePlist and launchdManager accept a new environmentPath option that flows through from make
• BootService.status now strips the PATH value from both on-disk and freshly rendered plists before comparing, so a changed PATH alone does not mark the installed unit as stale
• Behavioral Change: selectBootServiceManager and launchdManager now require environmentPath; callers that do not supply it will produce a plist without a PATH entry

^{Macroscope summarized e2e1de2.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a5b3eee7-5eb4-47c6-a3d1-84a6a25d4303

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	+30 B (+0.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+4 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+26 B (+0.4%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	55.6 KiB	+44 B (+0.1%)	66.4 KiB	✅
Codex	Live turn messages	10	11	+1 (+10.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−21 B (−0.2%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−23 B (−0.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.4 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	11	10	−1 (−9.1%)	21	✅

Baseline: afc8342 · PR result: e2e1de2 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Approved at e2e1de2

Macroscope's review found this PR approvable — The change is a narrowly scoped macOS service fix that preserves provider CLI lookup through a safely constructed LaunchAgent PATH, with focused coverage for fallbacks and status reconciliation. It does not alter Linux behavior, schemas, or unrelated runtime components.

^{You can add or adjust custom eligibility rules. Learn more.}