How to fix LaunchAgent scandir: [Errno 1] Operation not permitted error

Your problem here is that if launchd is going to listen on the VNC port, well, then it's going to get the traffic on the VNC port. The approved ways for a daemon program to deal with this are either to expect the network traffic on StdIn and StdOut or to collect a list of file descriptors from launchd and use one of those for the network communication. Otherwise the client is going to create a connection and then see the connection closed by launchd while it starts up the daemon.

I suggest you have launchd listen on another port and spawn a simple program that just pipes input to /dev/null while also launching the VM. So then to start the VM you telnet to this special port.

Or, you know, the easy thing to do is just always have the VM running. :-)

In my opinion the following should work - it does in my VM! - launched as /Library/LaunchDaemons/org.user.plist:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>org.user</string>
    <key>ProgramArguments</key>
    <array>
        <string>/usr/bin/touch</string>
        <string>-f</string>
        <string>/Users/Guest/Desktop/test.txt</string>
    </array>
    <key>UserName</key>
    <string>Guest</string>
    <key>GroupName</key>
    <string>_guest</string>
    <key>InitGroups</key>
    <true/>
    <key>WatchPaths</key>
    <array>
        <string>/Users/Guest/Library</string>
    </array>
</dict>
</plist>

As example task I use /usr/bin/touch -f /Users/Guest/Desktop/test.txt.

The trick here is that the complete content of the Guest folder is deleted after a log out. After a new Guest logs in the whole content is recreated from scratch. As soon as the folder /Users/Guest/Library is created, the example task (touch ...) is started due to the WatchPaths key.

Since the task/script/app has to be executed as guest you can't use launch agents because the path /Users/Guest/Library/LaunchAgents/ simply doesn't exist.

Use a launch daemon instead and run it as Guest/_guest. Your ruby script /usr/local/bin/notify-custom has to be world readable/executable? of course.

I also tried to run the task every 60 seconds - which works properly but throws some errors after the guest's log out. Probably it's better to implement the whole thing in the ruby script. Depending on your script your mileage may vary though.

If you have two different tasks to execute (e.g show a banner every 10 minutes with Ruby and a timer to force log out after 30 minutes) it's probably better to create two different launch daemons.