plist always exits 150 on macOS Tahoe (`brew services` reports `error 150`)

[miguno]

Hi there, thanks for maintaining this project!

Here's a summary of a current bug on macOS Tahoe. I tried to summarize as best as I could, but the intricacies of homebrew and its services are still rather unfamiliar to me.

Problem description

After brew services start ssh-askpass (or restart), the service is reported as failed even when env vars are set correctly:

# Failure reported!
$ brew services | grep ssh-askpass
ssh-askpass   error  150  miguno ~/Library/LaunchAgents/homebrew.mxcl.ssh-askpass.plist

# But env vars were correctly set as expected.
$ launchctl getenv SSH_ASKPASS
/opt/homebrew/opt/ssh-askpass/bin/ssh-askpass

How to reproduce

$ brew install theseal/ssh-askpass/ssh-askpass
$ brew services start ssh-askpass

Then:

$ brew services | grep ssh-askpass
ssh-askpass   error  150      miguno ~/Library/LaunchAgents/homebrew.mxcl.ssh-askpass.plist

$ launchctl print gui/$UID/homebrew.mxcl.ssh-askpass | grep "last exit code"
        last exit code = 150

Root cause

The bundled ssh-askpass.plist runs four launchctl commands. But only the last one determines the script's exit status:

launchctl stop com.openssh.ssh-agent

com.openssh.ssh-agent is loaded from /System/Library/LaunchAgents/, and launchd refuses to let userspace signal services from there:

$ launchctl kill SIGTERM gui/$UID/com.openssh.ssh-agent
Not privileged to signal service.

$ launchctl stop com.openssh.ssh-agent; echo $?
150

The good news is that SSH_ASKPASS / SUDO_ASKPASS / DISPLAY are still set successfully (which you can check with launchctl print), so the service "works". But launchd records exit 150, and thus brew services marks it as errored. (And there's e.g. no KeepAlive, so the bad exit code just sits there forever.)

This problem also causes the initial brew services start ssh-askpass to fail:

$ brew services start ssh-askpass
Bootstrap failed: 5: Input/output error
Try re-running the command as root for richer errors.
Error: Failure while executing; `/bin/launchctl bootstrap gui/501 /Users/miguno/Library/LaunchAgents/homebrew.mxcl.ssh-askpass.plist` exited with 5.

A kind of workaround is to use brew services restart ssh-askpass, because (I think) it does bootout first. That is, my understanding is that brew services restart is idempotent against pre-existing state, whereas brew services start is not. Using restart doesn't fix the underlying exit-150 problem (the script will still run and exit 150 again, leaving a fresh failure record), but it does let the load step itself succeed instead of being blocked by stale state.

Possible fix

In ssh-askpass.plist, either:

1. Ignore the failure of the last command:

   launchctl stop com.openssh.ssh-agent || true
   

2. Or drop the line entirely. I think modern ssh-agent should pick up SSH_ASKPASS lazily on first prompt, so the explicit stop is no longer needed. But I am not entirely sure.

Environment

• macOS Tahoe 26.3.1
• Homebrew 5.1.7
• ssh-askpass 1.5.1 (latest version as of today)

[miguno]

Here's the workaround I currently use in my ~/.zshrc:

    brew services restart ssh-askpass >/dev/null 2>&1 || true
    readonly SSH_ASKPASS_EXPECTED="$HOMEBREW_PREFIX/opt/ssh-askpass/bin/ssh-askpass"
    if [[ "$(launchctl getenv SSH_ASKPASS)" != "$SSH_ASKPASS_EXPECTED" ]]; then
        echo "ERROR: ssh-askpass: SSH_ASKPASS not set in launchd session after restart"
        exit 1
    fi