bug: v0.0.115 aarch64-apple-darwin binaries link libiconv from /nix/store and fail to load on macOS

[waynesun09]

User Story

As an Apple Silicon user installing OpenShell v0.0.115 through the documented install.sh / Homebrew path, I want the released openshell, openshell-gateway, and openshell-driver-vm binaries to start on a machine without Nix, so that I can run a local gateway and CLI at the current release.

Problem Statement

All three v0.0.115 aarch64-apple-darwin release binaries are dynamically linked against a Nix store path for libiconv that exists only on the build host. On any other Mac they abort at load time with dyld: Library not loaded: /nix/store/…-libiconv-115.100.1/lib/libiconv.2.dylib. This affects the raw release tarballs as well as the Homebrew formula that unpacks them. The v0.0.113 and v0.0.111 macOS binaries link only against system frameworks and /usr/lib dylibs.

Impact / Why This Matters

• Every CLI command aborts before parsing arguments; openshell --version is enough to reproduce.
• The Homebrew formula's post-install fails at openshell-gateway generate-certs with the same error, so the gateway service cannot start. A user who runs brew reinstall from a working 0.0.83 ends up with neither a CLI nor a gateway.
• Downstream projects that pin OpenShell by version and document the upstream installer for macOS now direct Apple Silicon users at a release that does not run (tracked in docs: OpenShell 0.0.115 macOS release binaries are Nix-linked and do not start; install guide points Apple Silicon users at it fullsend-ai/fullsend#6707).
• Current workaround: re-point the libiconv install-name at the system library with install_name_tool and ad-hoc re-sign each binary, then restart the Homebrew service. That is not something the documented install path can expect users to do, and any later brew reinstall or brew postinstall reverts it.

Verified on macOS 26 (arm64) without Nix installed:

Release	openshell	openshell-gateway	openshell-driver-vm
v0.0.111	clean	—	—
v0.0.113	clean	—	—
v0.0.115	/nix/store/…/libiconv.2.dylib	same	same

(v0.0.114 was tagged but its release run did not publish assets, so v0.0.113 is the most recent published macOS release.)

Acceptance Criteria

• otool -L on the openshell, openshell-gateway, and openshell-driver-vm binaries from the aarch64-apple-darwin release tarballs reports no /nix/store path.
• Installing the fixed release on an Apple Silicon Mac without Nix via install.sh yields a working openshell --version and a running Homebrew gateway service.
• The release pipeline fails when a darwin artifact references /nix/store, so a binary that only runs on the build host cannot ship again.

Reproduction Steps

1. On an Apple Silicon Mac without Nix, download openshell-aarch64-apple-darwin.tar.gz from the v0.0.115 release and extract it (or install v0.0.115 via install.sh with OPENSHELL_VERSION=v0.0.115).
2. Run ./openshell --version.
3. Run otool -L ./openshell | grep nix.

Expected: openshell 0.0.115 and no /nix/store lines.
Actual: dyld Library not loaded abort; otool shows the Nix libiconv path.

Environment

• OpenShell: v0.0.115 (release assets published 2026-08-27 18:03 UTC; openshell --version cannot run — see Logs)
• OS: macOS 26 (Darwin 25.5.0), Apple Silicon (arm64)
• Runtime: Podman 5.8.4 with the Homebrew-managed local gateway (nvidia/openshell tap, installed via upstream install.sh)
• Deployment or integration: fullsend (pins OpenShell by version, documents install.sh for macOS)
• Nix: not installed

Logs

$ ./openshell --version
dyld[45268]: Library not loaded: /nix/store/x66vl94b37qshkwsbcwsa6izzl36467a-libiconv-115.100.1/lib/libiconv.2.dylib
  Referenced from: <81DF5B69-054A-3FA1-826C-47F734DF01D9> .../openshell
  Reason: tried: '/nix/store/x66vl94b37qshkwsbcwsa6izzl36467a-libiconv-115.100.1/lib/libiconv.2.dylib' (no such file), '/System/Volumes/Preboot/Cryptexes/OS/nix/store/x66vl94b37qshkwsbcwsa6izzl36467a-libiconv-115.100.1/lib/libiconv.2.dylib' (no such file), '/nix/store/x66vl94b37qshkwsbcwsa6izzl36467a-libiconv-115.100.1/lib/libiconv.2.dylib' (no such file)

$ otool -L openshell-gateway | grep nix
	/nix/store/x66vl94b37qshkwsbcwsa6izzl36467a-libiconv-115.100.1/lib/libiconv.2.dylib (compatibility version 7.0.0, current version 7.0.0)

$ brew reinstall nvidia/openshell/openshell
==> /opt/homebrew/Cellar/openshell/0.0.115/bin/openshell-gateway generate-certs --output-dir /opt/homebrew/var/openshell/tls --server-san host.openshell.internal
dyld[66310]: Library not loaded: /nix/store/x66vl94b37qshkwsbcwsa6izzl36467a-libiconv-115.100.1/lib/libiconv.2.dylib
Warning: The post-install step did not complete successfully

Investigation notes

Offered as verified observations for triage, not as the fix.

• ci: build release binaries with Nix #2977 (ci: build release binaries with Nix; commit 981606d2, the direct parent of the v0.0.115 tag commit f68867b8) builds every platform inside nix develop. In .github/actions/build-rust-binary/action.yml, the Normalize Linux dynamic binary step (patchelf --set-interpreter … --remove-rpath) is gated on -linux-gnu and Verify static linkage on -linux-musl; there is no equivalent step for -apple-darwin (build-gateway-binaries.yml passes interpreter: "" for that matrix entry), so the darwin binaries built in .#devShells.aarch64-darwin.default keep the Nix install-name for libiconv.
• The action's Verify <binary> step runs <binary> --version inside the same nix develop shell, where the store path exists on the runner, which is why the v0.0.115 release run (33100034661; darwin CLI job 98615739810, darwin gateway job 98615739891, darwin VM-driver job 98617279721) is green. package-release-binaries.yml tars the binary without inspecting it.
• The ci: build release binaries with Nix #2977 checklist leaves "Apple Silicon build matrix passes in GitHub Actions" unchecked.
• Confirmed the workaround: install_name_tool -change <nix libiconv> /usr/lib/libiconv.2.dylib plus codesign --force -s - on the CLI and gateway makes both run; the gateway then starts against Podman and sandbox create --detach -- sleep infinity / sandbox exec / sandbox delete work. /usr/lib/libiconv.2.dylib is not present as a file on recent macOS but resolves from the dyld shared cache.

[SDAChess]

Releasing a fix in v0.0.116. Thank you for your report.