Mac Multi User Agents

Use this skill when one Mac should support multiple dedicated OpenClaw agent users.

This skill is for the pattern you described on the MacBook Pro:

one strong Mac
several agent users
Fast User Switching
one shared /opt/homebrew toolchain
separate ~/.openclaw, SSH, browser, and session state per user

It does not try to hide the fact that macOS user management still requires admin access.

Use This Skill For

preparing a MacBook Pro to host 2-4 dedicated agent users
estimating a sane number of agent users from the Mac's CPU and RAM
keeping one shared Homebrew toolchain while isolating per-user OpenClaw state
rendering or executing repeatable user-create commands instead of clicking around in System Settings
checking whether a user has the required shell/tool paths
documenting and auditing per-user rollout

Do Not Use This Skill For

creating production macOS MDM policy
bypassing sudo or admin approval for user creation
pretending multiple agents should share one login
turning the Mac into a shared human workstation and agent host without boundaries

Requirements

admin access on the Mac
Homebrew installed at /opt/homebrew
OpenClaw installed in the shared toolchain
enough RAM, storage, and browser capacity for the planned agent count

Design Rules

one macOS user per agent
one ~/.openclaw per agent
one ~/.ssh per agent
one browser profile set per agent
shared /opt/homebrew only for binaries and formulae
no shared session files between agents

Workflow

1. Inspect The Host

Run:

scripts/detect-host.sh
scripts/recommend-layout.sh

This reports:

current user list
whether Homebrew/OpenClaw are on the shared path
current Fast User Switching state
current hostname and shell layout
a recommended range for additional agent users based on CPU/RAM

2. Render Or Execute User Creation

Do not improvise account creation from memory.

Render the commands first:

scripts/render-user-create.sh --user agent3 --full-name "Agent 3"
scripts/render-user-create.sh --user agent4 --full-name "Agent 4" --admin no

This prints a repeatable sysadminctl-based flow and the baseline directories to create afterward.

If you want the skill to actually create the user, use:

export AGENT_PASSWORD='set-a-real-password'
scripts/create-user.sh --user agent3 --full-name "Agent 3" --password-env AGENT_PASSWORD

Or dry-run first:

scripts/create-user.sh --user agent3 --full-name "Agent 3" --password-env AGENT_PASSWORD --dry-run

This keeps the process auditable and avoids hand-built user creation every time.

3. Keep The Toolchain Shared

Recommended shared toolchain:

/opt/homebrew/bin/brew
/opt/homebrew/bin/node
/opt/homebrew/bin/npm
/opt/homebrew/bin/openclaw

Read references/shared-homebrew.md before changing ownership or permissions under /opt/homebrew.

4. Bootstrap Per-User State

For each agent user, create or verify:

~/.ssh
~/.openclaw
shell PATH that includes /opt/homebrew/bin
authorized keys if cross-host or gateway SSH is required

Use:

scripts/verify-user-shell.sh --user agent3

to check the resulting shell/tool state.

5. Enable Fast User Switching

Read references/fast-user-switching.md.

The purpose is:

easy hop between agent users
no need to log out the whole Mac
clear separation of browser/session state

6. Leave Receipts

Use:

scripts/write-receipt.sh --action "create-user" --status ok --detail "Prepared agent3 on MacBook Pro"
scripts/write-receipt.sh --action "verify-user-shell" --status ok --detail "agent3 sees brew node openclaw"

Security Rules

do not give every agent user admin unless there is a real reason
keep /opt/homebrew shared, but keep ~/.openclaw private per user
do not share browser profiles between agent users
keep SSH keys per user, not one copied private key everywhere
if one user is removed, cleanup should not break the other users

Rollback

A single agent user should be removable without reinstalling the Mac.

Baseline rollback:

remove that user
remove that user’s ~/.openclaw
remove that user’s SSH keys and browser state
keep shared Homebrew intact

Files

scripts/detect-host.sh: inspect the Mac and shared toolchain state
scripts/recommend-layout.sh: suggest a sane agent-user count from hardware
scripts/render-user-create.sh: print repeatable user-creation commands
scripts/create-user.sh: actually create and bootstrap an agent user with sysadminctl
scripts/verify-user-shell.sh: verify a target user sees the expected toolchain
scripts/write-receipt.sh: append JSONL receipts for rollout work
references/fast-user-switching.md: practical guidance for multi-user Mac agent hosts
references/shared-homebrew.md: rules for one shared Homebrew toolchain across agent users