bug(sandbox): SSH exec hardcodes /bin/bash and breaks BYOC images without Bash #2290

Agent Diagnostic

• Loaded the repository's debug-openshell-cluster, openshell-cli, and create-github-issue skills.
• Reproduced with OpenShell v0.0.82 using the Kubernetes driver and sidecar topology.
• Checked the latest release, v0.0.83. I did not replace the existing Kubernetes prototype to runtime-test the new release, but verified that both SSH execution paths remain unchanged in the v0.0.83 source:
  • PTY path: https://github.com/NVIDIA/OpenShell/blob/v0.0.83/crates/openshell-supervisor-process/src/ssh.rs#L792-L802
  • Non-PTY path: https://github.com/NVIDIA/OpenShell/blob/v0.0.83/crates/openshell-supervisor-process/src/ssh.rs#L945-L961
• Checked the current main branch and found the same implementation.
• Reviewed the v0.0.83 release notes and PR fix(k8s): respect template OPENSHELL_SANDBOX_COMMAND instead of overwriting #1326; neither changes the SSH command shell.
• Searched existing issues. The closest matches are:
  • feat: support custom sandbox entrypoint command #848 concerns configuring the sandbox startup command in the Kubernetes driver, not the SSH exec shell.
  • "No such file or directory" error on sandbox create from another container inside cluster #1849 reports an ENOENT from a containerized CLI while sandbox exec still works, so it is a different failure.
• The BYOC documentation requires a standard Linux image and a shell, but does not require Bash. It also states that no OpenShell-specific dependencies are required:
  https://github.com/NVIDIA/OpenShell/blob/v0.0.83/examples/bring-your-own-container/README.md#L54-L79
• The affected Alpine-based image contains BusyBox /bin/sh but no /bin/bash.
• The Sandbox reaches Ready, its Kubernetes Pod reaches 2/2 Running, and /bin/sh, Node.js, and the application work through direct kubectl exec.
• Both the initial command after sandbox create and later sandbox exec fail after the SSH channel opens.
• Source inspection shows that PTY and non-PTY paths both construct Command::new("/bin/bash"). Explicitly passing /bin/sh -lc ... does not help because it is still wrapped by the outer /bin/bash -lc.
• This remains unresolved without modifying the application image to install Bash or maintaining a custom supervisor.

Description

Actual behavior: BYOC images that provide /bin/sh but not /bin/bash can reach Sandbox Ready, but OpenShell cannot execute the initial command or subsequent sandbox exec commands. The client reports that the exec relay closed before an exit status was returned.

Expected behavior: SSH command execution should not impose an undocumented Bash dependency on otherwise supported standard Linux images. The shell should be configurable or fall back to /bin/sh. If Bash is intentionally mandatory, OpenShell should validate this prerequisite early and return an actionable error.

Reproduction Steps

1. Deploy OpenShell with the Kubernetes driver using sidecar topology.
2. Create a Sandbox from an Alpine-based application image that has /bin/sh and no /bin/bash.
3. Confirm that the Sandbox is Ready and that /bin/sh works through kubectl exec.
4. Run: openshell sandbox exec --name <sandbox> -- /bin/sh -lc 'echo OK'.
5. Observe that the SSH exec channel closes without reporting an exit status.
6. Add /bin/bash to the same image and repeat; the hard dependency is no longer encountered.

Environment

• OpenShell tested: v0.0.82
• Latest release checked: v0.0.83
• Compute driver: Kubernetes, sidecar topology
• Kubernetes: v1.36.2
• Agent Sandbox Controller: v0.5.1
• Nodes: Ubuntu 22.04, Linux 6.8, containerd 2.2.1, linux/amd64
• Application image: Alpine-based; BusyBox /bin/sh present, /bin/bash absent
• Possible duplicates checked: feat: support custom sandbox entrypoint command #848, "No such file or directory" error on sandbox create from another container inside cluster #1849, PR fix(k8s): respect template OPENSHELL_SANDBOX_COMMAND instead of overwriting #1326

Logs

$ kubectl exec <sandbox-pod> -c sandbox -- /bin/sh -lc 'echo OK'
OK

$ openshell sandbox exec --name <sandbox> -- /bin/sh -lc 'echo OK'
Error: exec relay closed before the command reported an exit status

Agent-First Checklist

• I pointed my agent at the repo and had it investigate this issue
• I loaded relevant skills (debug-openshell-cluster, openshell-cli, and create-github-issue)
• I checked the latest OpenShell release and explained why I did not replace the deployed prototype to runtime-test it
• I searched existing issues for possible duplicates
• My agent could not resolve this without modifying the image or supervisor