Repository navigation
msb: "has no ssh-agent --vsock route" warning fires when msb inspect fails, even though the route exists #516
Description
Problem
acq run can warn that an existing sandbox has no ssh-agent route when the route is present and forwarding works:
acq(msb): warning: host SSH_AUTH_SOCK is set, but existing sandbox 'gsa-agentic-coding' has no ssh-agent --vsock route. The route is create-time only, so SSH_AUTH_SOCK will not be set in the guest and git signing will fail.
_acq_msb_has_ssh_agent_vsock_route (acq.backends/msb.sh:4082) answers only yes or no. A failed msb inspect (|| return 1) and an empty result ([ -n "$json" ] || return 1) both return the same "no" as a genuinely missing route, and the caller (:4058) reports every "no" as a missing route. So a momentary inspect failure produces a confident, wrong warning that tells the user to recreate a working sandbox.
Reproduction
acq main@187aa57, msb 0.7.3, macOS, SSH_AUTH_SOCK set to the launchd agent. Sandbox created through acq with the route recorded.
- 1 of 3 consecutive
acq run <sandbox>printed the warning; the other two were clean. - Right after the warning, the route was present:
msb inspect <sandbox> --format jsonshows"vsock":{"routes":[{"host_socket":"/private/var/run/com.apple.launchd.…/Listeners","port":3552,"socket_type":"stream"}]}, and replaying the function's flatten + grep logic by hand passes both checks. - Forwarding worked in the guest:
acq exec <sandbox> -- ssh-add -llisted the host's keys via/home/agent/.acq/ssh-agent.sock.
The inspect error is discarded (2>/dev/null), so I couldn't capture why it failed on the bad run. That the failed inspect is the cause is inferred from the code path, not observed directly.
Suggested fix
Separate "couldn't check" from "missing":
- Return 2 when
msb inspectfails or returns nothing; 0 and 1 keep their meaning. - On 2, retry the inspect once or twice. If it still fails, warn that acq couldn't verify the route (and include inspect's stderr), rather than stating the route is missing.
- Keep the existing warning for a genuine 1: it's accurate there.
Related: #501 (re-deriving the route on restore), which touches the same route handling.
Activity
basiliskus commentedon Oct 21, 2026
Likely root cause, partly reproduced: acq runs under
set -euo pipefail, and_acq_msb_has_ssh_agent_vsock_routetests the flattened inspect JSON withprintf '%s\n' "$_flat" | grep -Eq ….grep -qexits on the first match; when the document is larger than the pipe buffer,printfcan still be writing and dies with SIGPIPE (141), andpipefailturns the successful match into a failure. On msb 0.7.8 a sandbox'smsb inspect --format jsonis ~175 KB (~71 KB flattened,vsock:about halfway through), so it's timing-dependent, matching the 1-in-3 rate above. Replaying the check withpipefailon that real document passed 6/6; on a 3× document it failed 3/3 with rc=141. Feeding grep from a here-string (grep -Eq … <<<"$_flat") or using acasematch avoids the pipe. The return-2 split suggested above is still worth having for real inspect failures.basiliskus commentedon Oct 21, 2026
The false "no route" has a bigger effect than the warning. On
acq start/restart,_acq_msb_ensure_ssh_agent_forwardreturns before setting_ACQ_MSB_SSH_AGENT_FORWARDING=1, so acq runs that start's agent-user kit commands withoutSSH_AUTH_SOCK(the-e SSH_AUTH_SOCK=…atmsb.sh~2180 is gated on that flag). A kit daemon started then keeps the empty env: the paseo kit's daemon came up withoutSSH_AUTH_SOCK, so every agent and terminal it spawns has no ssh-agent, and withcommit.gpgsignon, their commits fail ([git-ssh-sign] no SSH agent - cannot sign commits,fatal: failed to write commit object). The bridge itself is fine, and lateracq execsessions get the agent because their own route check passes. On msb 0.7.8 the warning printed on 3 of 3acq start/restartruns I saw, versus 1 of 3acq runs in the report above, so after a restart it's effectively always hit. The fix suggested above covers it. The Team Data kit setsSSH_AUTH_SOCK=/home/agent/.acq/ssh-agent.sockin its kit env as a stopgap until then.fix(msb): stop false "no ssh-agent route" warnings from grep sigpipe (#…