MacOS on Margrop Blog

Computers Rarely Break “Out of Nowhere”: Read Logs Like a Detective

Wed, 29 Jul 2026 20:30:00 +0800

The short conclusion

Computers rarely fail without leaving a trace. A disk gradually fills up. A service emits warnings before it exits. A DNS lookup fails before a browser reports a timeout. A process starts and stops several times before a user sees a broken page. The practical skill is not to reinstall everything after seeing a red error. It is to ask five detective questions: When did it happen? Which object was involved? How serious was it? What happened before and after it? Can the result be verified after the fix?

This article explains logs as a computer’s diary instead of presenting them as mysterious engineering jargon. It uses real collection output from Windows 11, Ubuntu 26.04, and macOS 26, provides three native read-only collectors, and shows how to give the same evidence-first workflow to an Agent. A child should understand most of the story; an engineer can still reuse the commands and the reasoning pattern.

Restart Is Not Magic: Why Turning a Computer Off and On Seems to Fix 99% of Its Problems

Wed, 29 Jul 2026 08:00:00 +0800

The short version A restart is not magic, and it does not repair every fault. It is closer to emptying a room that has been used for months without cleaning: borrowed items are collected, people take fresh queue numbers, temporary notes disappear, and doors and appliances are initialized again. The system returns to a cleaner and more predictable starting point. When “restart fixed it” is true, the fault is often in volatile state, not in permanently damaged hardware, a configuration that is always wrong, or an application whose root cause has disappeared.

Stop Installing Another PC Cleaner: What Desktop Software Can an AI Agent Actually Replace?

Sun, 19 Jul 2026 22:00:00 +0800

The short answer

An AI Agent can replace many desktop utilities whose main job is clicking the same buttons over and over. It does not turn every application into a chat box, and it is not a magical “computer doctor.” Its real advantage is orchestration: it can inspect the machine, understand the goal, combine built-in tools, execute a sequence, and explain the evidence.

Across five categories—file conversion, junk scanning, performance optimization, configuration changes, and computer repair—the replacement level is different. File conversion and reporting are highly automatable. Performance work and configuration changes are semi-automatic. Hardware repair remains a human job, with the Agent acting as a diagnostic assistant.

The safety rule for every script in this article is simple: read first, write second; back up first, change second; verify before claiming success. All three scripts are local-only and start in report mode. Destructive actions require an explicit flag and a second confirmation.

Stop Running rsync Blindly: Preview Differences Before a Safe Incremental Sync

Sat, 11 Jul 2026 13:30:00 +0800

The short answer

The best rsync habit is not memorizing more switches. It is separating every risky job into two stages: generate a dry-run plan first, review it, and only then perform the real incremental sync. Deletion should be a separate, explicit permission rather than a hidden default.

The common rsync -n -avz --delete --out-format="%n" pattern can list paths that may change, but %n only preserves the name. A safer machine-readable plan uses --itemize-changes together with %i, so each line identifies an addition, update, deletion, or metadata change.

Don't Let Your Mac mini Gather Dust: Run Agents 24/7 from Windows

Sat, 11 Jul 2026 04:00:00 +0800

The short answer

If Windows is your everyday platform but a low-power Mac mini stays on to run OpenClaw, HermesAgent, or macOS-only automation, you do not need to dedicate another monitor, keyboard, and mouse to it. Treat the Mac mini as a quiet Agent server. macOS already includes Screen Sharing, and RealVNC Viewer on Windows can take over the desktop whenever configuration, upgrades, or troubleshooting require a GUI.

This is especially useful in a Windows-first home or studio where the Mac mini runs continuously at relatively low power while the Windows machines remain the daily workstations. The installation is rarely the difficult part. Most failures come from Screen Sharing, user authorization, VNC credentials, network reachability, sleep behavior, or services that do not recover after a restart.

One rule matters more than every convenience tweak in this guide: do not expose TCP port 5900 directly to the public Internet. A same-LAN connection is the simplest starting point. For access across networks, first join a self-hosted VPN or another controlled private network, and only then connect to the Mac.

Take Back Your Remote Desktop: Deploying an All-in-One RustDesk Server Safely

Fri, 10 Jul 2026 22:00:00 +0800

The short version

RustDesk is an open-source remote desktop application designed with self-hosting in mind. When two clients can reach each other directly, screen and input traffic can use a peer-to-peer path. When that direct path fails, a relay server forwards the encrypted traffic. Hosting the server yourself does not eliminate servers; it puts device registration, relay routing, keys, accounts, and logs back under your control.

This guide uses the community-maintained lejianwen/rustdesk-server-s6 image to place the RustDesk OSS hbbs and hbbr services together with a community API and web administration layer in one container. It is a convenient option for homes, labs, and small teams, but it is not an official RustDesk all-in-one distribution. Evaluate the community image, pin a tested tag or digest, back up its persistent data, and rehearse upgrades and rollbacks before treating it as production infrastructure.

Every address in this article uses example.com. No real IP address, private domain, hostname, device ID, account, key, token, cookie, or private registry is shown. The screenshots come from public official or community project pages.

I Put Docker in a Control Room: Portainer CE 2.39.4 Deployment, Daily Use, and Real Traps

Fri, 10 Jul 2026 15:30:00 +0800

Bottom line first

Portainer does not replace Docker. It is a control room for a Docker host. Docker Engine remains the machinery; Portainer organizes containers, images, networks, volumes, and Compose stacks into a web dashboard.

I ran an isolated deployment of portainer/portainer-ce:2.39.4, initialized it, connected the local Docker environment, inspected the dashboard, filtered a disposable container, and created a demonstration stack. The installation is one docker run command. The important lessons are broader: persist /data, understand that /var/run/docker.sock is highly privileged, and never expose the management interface to an untrusted network without protection.

This article contains no complete IP address, real host name, private domain, administrator password, token, cookie, private registry address, or production container name. The screenshots use disposable names, and the container address is redacted.

Moving Bedtime Out of the Living Room: Letting macOS launchd Disable Your Kids' Synology Accounts at 22:00 and Quietly Re-enable Them at 08:00

Sun, 14 Jun 2026 08:20:00 +0800

Short version

Synology DSM has a “disable this account” checkbox in the Control Panel, but it does not run on a schedule. With macOS’s built-in launchd and a 50-line bash script, you can flip the expired flag on two local accounts at 22:00 every night and flip it back at 08:00. The script does a before-query, a change, an after-query, and exit 1 the moment the after state does not match expectations. launchd writes stdout and stderr to dedicated log files. The interesting part is that the word “parent” quietly leaves the conversation: you no longer have to remind anyone to go to bed, the machine does it for you, on time, every day.

This post is not a comprehensive “family NAS management” guide. It is about one specific thing: turning a manual button click that depends on human memory into a system-level event that just happens on time.

If you only want the picture, the overview diagram in Section 2 is the whole article in one frame.

VPN Connected, But Internal Hostnames Won't Resolve? A Complete macOS Routing Table Walkthrough

Mon, 01 Jun 2026 18:00:00 +0800

TL;DR:

When two VPNs run side-by-side on macOS (e.g. utun0 and utun15), an aggregate 10.0.0.0/8 route pushed by one of them can silently “swallow” every address in the 10.x.x.x range — including the one you actually wanted to reach on the other VPN. DNS resolves fine; TCP/ICMP just hangs. route -n get is the first knife you should reach for.

Your Mac App Is Not Broken: Gatekeeper May Just Distrust an Unsigned Tool

Mon, 01 Jun 2026 07:35:00 +0800

The short version

When a macOS utility refuses to launch after being downloaded, the first conclusion should not be “the app is broken.” A very common cause is a combination of two facts: the app still has the com.apple.quarantine extended attribute that marks it as downloaded from the internet, and the app bundle does not have a usable signature that Gatekeeper can trust. For first launch, “downloaded from the web + no usable signature” is enough for macOS to block it.

For a tool whose source you understand and trust, the smallest local repair is straightforward: inspect the quarantine attribute, verify the signing state, apply a local ad-hoc signature to that one app bundle, remove quarantine from that one app, and then verify the result. The point is not to turn off macOS security globally. The point is to fix one known local tool while keeping the safety boundary clear.

This post is based on a real local troubleshooting session, but all private details have been removed. There are no real internal addresses, usernames, tokens, private download locations, hostnames, or machine-specific paths. The examples use placeholders such as /Applications/<App>.app and <App>. The goal is to share a repeatable diagnostic method, not to expose an environment.

Mystery: Where Did That http_proxy Come From in My New Tmux Session?

Sat, 30 May 2026 16:00:00 +0800

Preface

Today I ran into a truly bizarre problem: in a freshly created tmux session, echo $http_proxy showed a valid proxy address. But I distinctly remember that my .zshrc only defines two aliases — proxy_on and proxy_off — both of which require manual invocation and don’t run automatically.

The weirdest part: my main shell shows http_proxy as empty, but as soon as I enter tmux, it’s there. I spent nearly an hour tracking this down, so I’m documenting it for posterity.

Python App in macOS LaunchAgent Can't Reach the Internet? Here's the httpx Proxy Trap You Need to Know

Sat, 30 May 2026 09:00:00 +0800

TL;DR:

When a Python application using httpx with trust_env=True runs inside a macOS LaunchAgent, it silently picks up the system proxy settings from scutil --proxy. But the LaunchAgent process may not be able to reach that proxy server at all — resulting in All connection attempts failed or No route to host errors.

The fix is one line: add NO_PROXY=* to the LaunchAgent’s plist EnvironmentVariables.

This article documents the full debugging journey: from discovering that my AI Agent’s WeChat Enterprise (WeCom) messages weren’t being replied to, through methodical proxy troubleshooting, to finally pinning down the root cause — macOS system proxy + LaunchAgent network isolation. We’ll dive deep into Python httpx source code, macOS proxy architecture, and the many gotchas of LaunchAgent runtime environments.

The Complete AI Agent Migration Guide: A Real-World Journey from Scratch with 9 Pitfalls and Fixes

Sat, 30 May 2026 08:00:00 +0800

TL;DR:

Migrating from one AI Agent platform to another sounds like a “copy and paste” job. In reality, it’s a systems engineering challenge involving data migration, channel integration, scheduled tasks, auto-start configuration, proxy settings, and module compatibility.

This article documents my complete migration journey: from installing the new platform, migrating memories and skills, configuring messaging channels, debugging mysterious failures, to achieving fully automated operation. 9 pitfalls encountered, 9 solutions found — all shared here.

Your MCP Config Was Fine. The Server Died Before the Handshake.

Sat, 23 May 2026 06:10:00 +0800

The short version

The misleading part of this incident was the surface error. Codex reported that an MCP client could not initialize and that the MCP server handshake failed. That naturally pushes you toward MCP configuration, JSON-RPC initialization, plugin settings, authentication, network transport, or stale tool caches. But the root cause was lower than the MCP protocol: one local MCP server binary was killed by the macOS dynamic linker before it could answer the initialize request. The client only saw a closed connection. The useful evidence was in the server stderr: dyld: Symbol not found, pointing at a missing Swift Concurrency runtime symbol.

In other words, MCP did not really get a chance to fail. The server process died first.

This article walks through a real troubleshooting pattern around Codex, MCP clients, and MCP servers. The failure looked like a protocol startup problem, but the root cause lived in a native macOS binary and its Swift runtime compatibility.

All private details have been removed. This article does not include real internal addresses, usernames, session IDs, full local paths, tokens, private repository names, or business system names. Paths use placeholders such as ~, <USER_HOME>, <PLUGIN_DIR>, and <PROJECT>. Log snippets keep only the technical fields needed to explain the diagnosis.

Stop Dragging Files Around: BaiduPCS-Go CLI and Agent Workflows for Baidu Netdisk

Sat, 16 May 2026 10:06:01 +0800

Bottom line first

If you only download one or two files from Baidu Netdisk once in a while, the web UI and official desktop client are fine. Once you start doing batch downloads, remote server pulls, archive uploads, directory audits, or Agent-assisted workflows with Codex, Claude, OpenClaw, HermesAgent, or similar tools, the graphical UI becomes friction. BaiduPCS-Go is useful not because it is a magic speed booster, but because it turns Baidu Netdisk into something scripts, terminals, and Agents can operate. This article walks through installation checks, BDUSS/STOKEN login, everyday commands, configuration, safety rules, and practical Agent integration.

All accounts, cookies, paths, tasks, and settings in this article are sanitized examples. They do not contain real BDUSS, STOKEN, cookies, private directories, internal addresses, or business information.

Stop Clicking Remote Desktop: Let AI Agents SSH into Windows Instead

Wed, 13 May 2026 08:10:00 +0800

The short version

An AI agent does not need Remote Desktop, VNC, or a proprietary remote-control tool to operate a Windows machine. For many workstations, lab machines, development PCs, and internal servers, the cleanest path is to enable the built-in OpenSSH Server on Windows and connect from Linux or macOS with a normal command: ssh <user>@<windows-host>.

There are only three things to get right. First, install and enable OpenSSH Server on Windows 10 or Windows 11. Second, generate an SSH key on Linux or macOS and place the public key on Windows. Third, if the target account belongs to the Windows Administrators group, put the public key in C:\ProgramData\ssh\administrators_authorized_keys and lock down the ACL with icacls. After that, an AI agent can run PowerShell, copy scripts, collect logs, install tools, and perform repeatable maintenance through the same SSH workflow it already uses for Linux.

All hostnames, addresses, usernames, screenshots, and commands in this article use generic placeholders. No real internal addresses, usernames, machine names, tokens, keys, or private paths are included. Replace placeholders such as <user>, <windows-host>, and <windows-ip> with values from your own environment.

Adding Proxy Support to Antigravity and Claude on macOS: Safely Wrapping Electron Apps Without Patching Them

Wed, 25 Mar 2026 10:00:00 +0800

Before You Start This post documents a pattern that has already been validated in a real macOS environment: do not patch the original application bundle, and do not publish your real proxy endpoint. Instead, place a tiny wrapper app in front of the original Electron application. That wrapper becomes the stable place where proxy settings, launch flags, and Node-side bootstrap logic live.

When people first hit this problem, the instinct is usually to edit /Applications/Claude.app or /Applications/Antigravity.app directly. That can work once, but it is a poor long-term operational choice for three reasons:

You may break code signing behavior and make future launches or permission prompts more fragile.
Auto-updates can overwrite your local modifications at any time.
If you hardcode a real proxy endpoint into the app bundle, screenshots, scripts, or a public post, you can leak private infrastructure details that never needed to be exposed.

The approach that proved much more stable was:

Leave the original Claude.app and Antigravity.app untouched.
Create Claude (Proxy).app and Antigravity (Proxy).app under ~/Applications.
Let each wrapper app do only three things: load a private proxy.env, export upper/lower-case proxy variables, and launch the original Electron binary with --proxy-server.
If the target app also uses Node/undici fetch, inject a very small NODE_OPTIONS=--require=... bootstrap so Node-side requests follow the same proxy path.

All proxy endpoints in this article are intentionally redacted and replaced with placeholders such as:

http://127.0.0.1:PORT

Replace that value with your own local proxy entrypoint. Do not publish real proxy hosts, internal IP addresses, usernames, passwords, tokens, or internal domains in a public article, repository, or screenshot.

Solutions for External 2K Display and Font Blurring/Aliasing on macOS Big Sur in 2021

Tue, 25 Jan 2022 21:45:33 +0800

1. Disable System SIP

https://zhuanlan.zhihu.com/p/343151907

Before executing the command, you need to disable SIP (System Integrity Protection). The specific steps are: Enter Recovery Mode (hold Command+R during startup), open the system terminal in the upper right corner, and enter the csrutil disable (disable) command. After enabling HiDPI, you can use the csrutil enable (enable) command again to re-enable it. For more details, refer to »传送门

On the Importance of Mac Computers and TimeMachine

Tue, 14 Sep 2021 16:55:10 +0800

Today is September 14, 2021. As of today, I have been using MacOS as my main system for about 2 years. I have to say that I am deeply in love with MacOS now. If I need to buy my next laptop, I will definitely buy the MacBookPro high-end configuration. #Main differences between MacOS and Windows 1. Shortcut keys Windows The well-known Ctrl + C and Ctrl + V below MacOS becomes Command(Win key) + C and Command(Win key) + V

Java Spring Boot JNI Native Library Loader

Sat, 27 Mar 2021 16:37:31 +0800

Because Java needs to stay cross-platform, I wrote a cross-platform JNI native library loader.

Simple Implementation

Determine whether the current system is Windows, Linux, or MacOS from the os.name environment property.
If it is Linux, further determine whether it is CentOS or Debian.
Read the library files inside the jar package.
Filter the matching platform library files by file suffix: dll, so, jnilib, and dylib.
Copy the current platform’s library file to the system temporary directory java.io.tmpdir.
Load the library using System.load.