bug(vm): sandbox entered error phase while provisioning

[linusyong]

User Story

As an OpenShell users,
I want to be able to create a sandbox,
so that I can run my coding agents in the sandbox

Problem Statement

During creation of sandbox using openshell sandbox create, the following error encountered

❯ openshell sandbox create --name linus

Created sandbox: linus

✗ Error: ProcessExited: VM process exited with status 1
✓ Sandbox allocated (0s)
✓ Image pulled (3.4 GB) (6m 50s)
Error:   × sandbox entered error phase while provisioning: ProcessExited: VM process exited with status 1

Impact / Why This Matters

When this happens, user is not able to create a sandbox.
This result in user not able to use OpenShell with vm compute driver
This matters because OpenShell should be able to create sandbox with vm computer driver

Acceptance Criteria

• sandbox can be created

Reproduction Steps

1. Make sure that vm computer driver is used

   ❯ cat ~/.config/openshell/gateway.toml
   [openshell.gateway]
   compute_drivers = ["vm"]
   

2. Run openshell sandbox create

Environment

• OpenShell: v0.0.113
• OS: macOS Tahoe 26.6.2
• Runtime: vm
• gateway.toml

  [openshell.gateway]
  compute_drivers = ["vm"]
  

Logs

[1787707350.459] [gateway] [INFO ] [openshell_server::grpc::sandbox] minted sandbox JWT
[1787707350.463] [gateway] [INFO ] [openshell_server::grpc::sandbox] CreateSandbox request completed successfully
[1787707763.721] [gateway] [INFO ] [openshell_server::compute] Sandbox phase changed
[1787707763.721] [gateway] [WARN ] [openshell_server::compute] VM process exited with status 1

[linusyong]

According to my investigation with AI:

1. /opt/homebrew/opt/openshell/libexec/openshell-driver-vm does not have com.apple.security.hypervisor = true
2. This can be fixed with creating the following plist file

   # Create entitlements file
   cat > /tmp/vm-entitlements.plist << 'EOF'
   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
       <key>com.apple.security.hypervisor</key>
       <true/>
   </dict>
   </plist>
   EOF
   

3. codesign the openshell-driver-vm binary:

   codesign --force --sign - --entitlements /tmp/vm-entitlements.plist \
     /opt/homebrew/opt/openshell/libexec/openshell-driver-vm