gravitational/teleport · error

XPC connection invalid

Error message

XPC connection invalid

What it means

errXPCConnectionInvalid (lib/vnet/daemon/common_darwin.go:64) maps NSXPCConnectionInvalid from NSCocoaErrorDomain, typically 'No such process' — the XPC service endpoint does not (yet) exist. On first launch after the user enables the login item, SMAppService can report 'enabled' before launchd has finished submitting the job, so the very first connection attempt can fail with this error.

Source

Thrown at lib/vnet/daemon/common_darwin.go:64

	errorCodeMissingCodeSigningIdentifiers = int(C.VNEMissingCodeSigningIdentifiersError)
	errMissingCodeSigningIdentifiers       = errors.New("either identifier or team identifier is missing in code signing information; is the binary signed?")
)

var (
	// nsCocoaErrorDomain is a generic error domain used in a lot of Apple's Cocoa frameworks.
	nsCocoaErrorDomain = "NSCocoaErrorDomain"

	// https://developer.apple.com/documentation/foundation/nsxpcconnectioninterrupted-swift.var
	errorCodeNSXPCConnectionInterrupted = int(C.NSXPCConnectionInterrupted)
	errXPCConnectionInterrupted         = errors.New("XPC connection interrupted")

	// https://developer.apple.com/documentation/foundation/nsxpcconnectioncodesigningrequirementfailure-swift.var
	errorCodeNSXPCConnectionCodeSigningRequirementFailure = int(C.NSXPCConnectionCodeSigningRequirementFailure)
	errXPCConnectionCodeSigningRequirementFailure         = errors.New("code signing requirement failed")

	// https://developer.apple.com/documentation/foundation/nsxpcconnectioninvalid-swift.var
	errorCodeNSXPCConnectionInvalid = int(C.NSXPCConnectionInvalid)
	errXPCConnectionInvalid         = errors.New("XPC connection invalid")
)

func DaemonLabel() (string, error) {
	path, err := darwinbundle.Path()
	if err != nil {
		return "", trace.Wrap(err)
	}

	cPath := C.CString(path)
	defer C.free(unsafe.Pointer(cPath))

	cLabel := C.DaemonLabel(cPath)
	defer C.free(unsafe.Pointer(cLabel))

	label := C.GoString(cLabel)

	if label == "" {
		return "", trace.Errorf("could not get details for bundle under %s", path)

View on GitHub (pinned to 1283425b60)

Solutions

1. Retry after a short delay — the built-in retry (3 attempts, 500ms apart) usually resolves the launchd registration race.
2. Verify the daemon is registered: check SMAppService status / `launchctl print system/<label>` and re-register if not registered.
3. Confirm the app bundle path is correct and the daemon is enabled in Login Items; re-register with RegisterDaemon if needed.

Example fix

// before: single attempt
err := startByCalling(ctx, bundlePath, cfg)
// after: tolerate the launchd race like RegisterAndCall does
for retries := 0; errors.Is(err, errXPCConnectionInvalid) && retries < 3; retries++ {
    time.Sleep(500 * time.Millisecond)
    err = startByCalling(ctx, bundlePath, cfg)
}

// confirm the daemon job is registered before connecting
status, err := daemonStatus(bundlePath)
if err != nil || status != vnetdaemon.ServiceStatusEnabled {
    return errors.New("daemon not registered/enabled yet; register first")
}

func isXPCConnectionInvalid(err error) bool { return errors.Is(err, vnetdaemon.ErrXPCConnectionInvalid) }

err := startByCalling(ctx, bundlePath, cfg)
for retries := 0; errors.Is(err, vnetdaemon.ErrXPCConnectionInvalid) && retries < 3; retries++ {
    time.Sleep(500 * time.Millisecond)
    err = startByCalling(ctx, bundlePath, cfg)
}

When it happens

Trigger: RegisterAndCall -> startByCalling when the daemon XPC service is not registered/running yet: right after enabling the login item, if the daemon job was never launched, or after the daemon was unloaded/booted out. RegisterAndCall retries up to 3 times with 500ms delays when enablement was just performed.

Common situations: First run after approving the login item in System Settings (launchd race); daemon label never registered; launchd job disabled; bundle path changed so the old service is not found.

Related errors

• VNet is already running
• XPC connection interrupted
• code signing requirement failed
• could not connect to the VNet daemon within the timeout
• either identifier or team identifier is missing in code sign

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/fd76e1d211ce503f. Report an issue: GitHub.