UniFi home network (read-only)

unifi-api reads the UniFi console as the local View Only admin agent-readonly. The console refuses writes from that account (403 api.err.NoPermission, verified 2026-10-14). Runbook and rationale: ~/dotfiles/agent_docs/unifi-admin.md.

Before you start

• macOS only, and only on the home LAN (console at https://192.168.1.1). Off-LAN, say so and stop — there is no remote path.
• command -v unifi-api must succeed (stowed from the dotfiles maint package). If it reports no pinned certificate, ask the user to run unifi-api --pin and confirm the fingerprint; do not pin it yourself.
• The wrapper reads its password from 1Password (op). If op prompts or is locked, ask the user to unlock it.
• In Codex's sandbox the wrapper needs network access; request approval to run it rather than looking for a way around the sandbox.