openshell forward and sandbox connect commands fail on macos

[peterj]

Agent Diagnostic

n/a

Description

For example, if I run this (the sandbox is created and running):

$ openshell forward start 9999 myagent  
Error:   × ssh exited with status exit status: 255

However, if I run it with the RUST_LOG=debug, it starts the forward/connects as expected:

RUST_LOG=debug openshell forward start 9999 myagent  

Reproduction Steps

1. Create a sandbox (e.g. openshell sandbox create -- claude)
2. Try connecting (openshell sandbox connect)

Environment

• OS: macos 14.8.4
• Docker: Server: Docker Desktop 4.49.0
• openshell 0.0.12

Logs

$ openshell forward start 9999 myagent -vv 

2026-03-22T10:27:50.284227Z DEBUG hyper_util::client::legacy::connect::http: connecting to 127.0.0.1:8080
2026-03-22T10:27:50.289525Z DEBUG hyper_util::client::legacy::connect::http: connected to 127.0.0.1:8080
2026-03-22T10:27:50.289973Z DEBUG rustls::client::hs: No cached session for IpAddress(V4(Ipv4Addr([127, 0, 0, 1])))
2026-03-22T10:27:50.290111Z DEBUG rustls::client::hs: Not resuming any session
2026-03-22T10:27:50.292677Z DEBUG rustls::client::hs: Using ciphersuite TLS13_AES_256_GCM_SHA384
2026-03-22T10:27:50.292683Z DEBUG rustls::client::tls13: Not resuming
2026-03-22T10:27:50.292794Z DEBUG rustls::client::tls13: TLS1.3 encrypted extensions: ServerExtensions { selected_protocol: SingleProtocolName(ProtocolName(6832)), unknown_extensions: {}, .. }
2026-03-22T10:27:50.292845Z DEBUG rustls::client::hs: ALPN protocol is Some(b"h2")
2026-03-22T10:27:50.292849Z DEBUG rustls::client::tls13: Got CertificateRequest CertificateRequestPayloadTls13 { context: , extensions: CertificateRequestExtensions { signature_algorithms: [ECDSA_NISTP384_SHA384, ECDSA_NISTP256_SHA256, ED25519, RSA_PSS_SHA512, RSA_PSS_SHA384, RSA_PSS_SHA256, RSA_PKCS1_SHA512, RSA_PKCS1_SHA384, RSA_PKCS1_SHA256], authority_names: [DistinguishedName(302b3115301306035504030c0c6f70656e7368656c6c2d636131123010060355040a0c096f70656e7368656c6c)], .. } }
2026-03-22T10:27:50.293035Z DEBUG rustls::client::common: Attempting client auth
2026-03-22T10:27:50.293865Z DEBUG h2::client: binding client connection
2026-03-22T10:27:50.294198Z DEBUG h2::client: client connection bound
2026-03-22T10:27:50.294457Z DEBUG h2::codec::framed_write: send frame=Settings { flags: (0x0), enable_push: 0, initial_window_size: 2097152, max_frame_size: 16384, max_header_list_size: 16384 }
2026-03-22T10:27:50.296191Z DEBUG Connection{peer=Client}: h2::codec::framed_read: received frame=Settings { flags: (0x0), max_concurrent_streams: 200, initial_window_size: 1048576, max_frame_size: 16384, max_header_list_size: 16384 }
2026-03-22T10:27:50.296371Z DEBUG Connection{peer=Client}: h2::codec::framed_write: send frame=Settings { flags: (0x1: ACK) }
2026-03-22T10:27:50.296377Z DEBUG Connection{peer=Client}: h2::codec::framed_read: received frame=WindowUpdate { stream_id: StreamId(0), size_increment: 983041 }
2026-03-22T10:27:50.296401Z DEBUG Connection{peer=Client}: h2::codec::framed_write: send frame=WindowUpdate { stream_id: StreamId(0), size_increment: 5177345 }
2026-03-22T10:27:50.296532Z DEBUG tower::buffer::worker: service.ready=true processing request
2026-03-22T10:27:50.297142Z DEBUG Connection{peer=Client}: h2::codec::framed_write: send frame=Headers { stream_id: StreamId(1), flags: (0x4: END_HEADERS) }
2026-03-22T10:27:50.297467Z DEBUG Connection{peer=Client}: h2::codec::framed_write: send frame=Data { stream_id: StreamId(1) }
2026-03-22T10:27:50.297482Z DEBUG Connection{peer=Client}: h2::codec::framed_write: send frame=Data { stream_id: StreamId(1), flags: (0x1: END_STREAM) }
2026-03-22T10:27:50.305251Z DEBUG Connection{peer=Client}: h2::codec::framed_read: received frame=Settings { flags: (0x1: ACK) }
2026-03-22T10:27:50.305270Z DEBUG Connection{peer=Client}: h2::proto::settings: received settings ACK; applying Settings { flags: (0x0), enable_push: 0, initial_window_size: 2097152, max_frame_size: 16384, max_header_list_size: 16384 }
2026-03-22T10:27:50.306934Z DEBUG Connection{peer=Client}: h2::codec::framed_read: received frame=Headers { stream_id: StreamId(1), flags: (0x4: END_HEADERS) }
2026-03-22T10:27:50.306974Z DEBUG Connection{peer=Client}: h2::codec::framed_read: received frame=Data { stream_id: StreamId(1) }
2026-03-22T10:27:50.307228Z DEBUG Connection{peer=Client}: h2::codec::framed_read: received frame=Headers { stream_id: StreamId(1), flags: (0x5: END_HEADERS | END_STREAM) }
2026-03-22T10:27:50.308488Z DEBUG tower::buffer::worker: service.ready=true processing request
2026-03-22T10:27:50.308537Z DEBUG Connection{peer=Client}: h2::codec::framed_write: send frame=Headers { stream_id: StreamId(3), flags: (0x4: END_HEADERS) }
2026-03-22T10:27:50.308739Z DEBUG Connection{peer=Client}: h2::codec::framed_write: send frame=Data { stream_id: StreamId(3) }
2026-03-22T10:27:50.308748Z DEBUG Connection{peer=Client}: h2::codec::framed_write: send frame=Data { stream_id: StreamId(3), flags: (0x1: END_STREAM) }
2026-03-22T10:27:50.315751Z DEBUG Connection{peer=Client}: h2::codec::framed_read: received frame=Headers { stream_id: StreamId(3), flags: (0x4: END_HEADERS) }
2026-03-22T10:27:50.315775Z DEBUG Connection{peer=Client}: h2::codec::framed_read: received frame=Data { stream_id: StreamId(3) }
2026-03-22T10:27:50.315785Z DEBUG Connection{peer=Client}: h2::codec::framed_read: received frame=Headers { stream_id: StreamId(3), flags: (0x5: END_HEADERS | END_STREAM) }
2026-03-22T10:27:50.316728Z DEBUG Connection{peer=Client}: h2::codec::framed_write: send frame=GoAway { error_code: NO_ERROR, last_stream_id: StreamId(0) }
2026-03-22T10:27:50.316738Z DEBUG Connection{peer=Client}: h2::proto::connection: Connection::poll; connection error error=GoAway(b"", NO_ERROR, Library)
2026-03-22T10:27:50.316765Z DEBUG Connection{peer=Client}: rustls::common_state: Sending warning alert CloseNotify
Error:   × ssh exited with status exit status: 255

Agent-First Checklist

• I pointed my agent at the repo and had it investigate this issue
• I loaded relevant skills (e.g., debug-openshell-cluster, debug-inference, openshell-cli)
• My agent could not resolve this — the diagnostic above explains why