"az ssh arc" command crashes with an utf-8 decoding error when ssh puts corrupted outputs

[k5342]

Describe the bug

az ssh arc command crashes without error message due to multi-byte string issue. The condition is limited, but this incurs the unexpected termination without appropriate error message.

UnicodeDecodeError: 'utf-8' codec can't decode byte 0xe3 in position 29: invalid continuation byte
To check existing issues, please visit: https://github.com/Azure/azure-cli/issues

• Configures SSH environment with an SSH agent (e.g., password managers)
• The SSH agent provides an SSH key with a name in multi-byte string (e.g., SSHキー; means SSH Key in Japanese)
  • This key name is a default value depending on the user's locale settings
• The SSH command outputs corrupted string in debug1: output such as debug1: Will attempt key: SSH�202\255�203 ED25519 SHA256:... agent

Related command

az ssh arc

Errors

The command failed with an unexpected error. Here is the traceback:
'utf-8' codec can't decode byte 0xe3 in position 29: invalid continuation byte
Traceback (most recent call last):
  File "/opt/homebrew/Cellar/azure-cli/2.83.0/libexec/lib/python3.13/site-packages/knack/cli.py", line 233, in invoke
    cmd_result = self.invocation.execute(args)
  File "/opt/homebrew/Cellar/azure-cli/2.83.0/libexec/lib/python3.13/site-packages/azure/cli/core/commands/__init__.py", line 669, in execute
    raise ex
  File "/opt/homebrew/Cellar/azure-cli/2.83.0/libexec/lib/python3.13/site-packages/azure/cli/core/commands/__init__.py", line 737, in _run_jobs_serially
    results.append(self._run_job(expanded_arg, cmd_copy))
                   ~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/homebrew/Cellar/azure-cli/2.83.0/libexec/lib/python3.13/site-packages/azure/cli/core/commands/__init__.py", line 706, in _run_job
    result = cmd_copy(params)
  File "/opt/homebrew/Cellar/azure-cli/2.83.0/libexec/lib/python3.13/site-packages/azure/cli/core/commands/__init__.py", line 336, in __call__
    return self.handler(*args, **kwargs)
           ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^
  File "/opt/homebrew/Cellar/azure-cli/2.83.0/libexec/lib/python3.13/site-packages/azure/cli/core/commands/command_operation.py", line 120, in handler
    return op(**command_args)
  File "/Users/ksugihara/.azure/cliextensions/ssh/azext_ssh/custom.py", line 150, in ssh_arc
    ssh_vm(cmd, resource_group_name, vm_name, None, public_key_file, private_key_file,
    ~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
           False, local_user, cert_file, port, ssh_client_folder, delete_credentials,
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
           resource_type, ssh_proxy_folder, winrdp, yes_without_prompt, ssh_args)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/ksugihara/.azure/cliextensions/ssh/azext_ssh/custom.py", line 65, in ssh_vm
    _do_ssh_op(cmd, ssh_session, op_call)
    ~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/ksugihara/.azure/cliextensions/ssh/azext_ssh/custom.py", line 204, in _do_ssh_op
    op_call(op_info, delete_keys, delete_cert)
    ~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/ksugihara/.azure/cliextensions/ssh/azext_ssh/ssh_utils.py", line 69, in start_ssh_connection
    service_config_delay_error_logs = _check_ssh_logs_for_common_errors(ssh_process, op_info,
                                                                        delete_cert, delete_keys)
  File "/Users/ksugihara/.azure/cliextensions/ssh/azext_ssh/ssh_utils.py", line 142, in _check_ssh_logs_for_common_errors
    next_line = ssh_sub.stderr.readline()
  File "<frozen codecs>", line 325, in decode
UnicodeDecodeError: 'utf-8' codec can't decode byte 0xe3 in position 29: invalid continuation byte
To check existing issues, please visit: https://github.com/Azure/azure-cli/issues

Issue script & Debug output

% az ssh arc --subscription "..." --resource-group "..." --name ...
The command failed with an unexpected error. Here is the traceback:
'utf-8' codec can't decode byte 0xe3 in position 29: invalid continuation byte
Traceback (most recent call last):
  File "/opt/homebrew/Cellar/azure-cli/2.83.0/libexec/lib/python3.13/site-packages/knack/cli.py", line 233, in invoke
    cmd_result = self.invocation.execute(args)
# ... same as the above ...
    next_line = ssh_sub.stderr.readline()
  File "<frozen codecs>", line 325, in decode
UnicodeDecodeError: 'utf-8' codec can't decode byte 0xe3 in position 29: invalid continuation byte

With SSH quiet mode by passing the -q option, this issue does not occur:

% az ssh arc --subscription ... --resource-group ... --name ... -- -q
Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 5.15.0-164-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro
New release '24.04.3 LTS' available.
Run 'do-release-upgrade' to upgrade to it.

Last login: Fri Feb  6 07:57:15 2026 from 127.0.0.1
# ... login is successful ...

Also, we could not reproduce this issue enabling with --debug mode on az command.

Expected behavior

az ssh arc command should not crash.

Environment Summary

% az --version
azure-cli                         2.83.0

core                              2.83.0
telemetry                          1.1.0

Extensions:
ssh                                2.0.6

Dependencies:
msal                            1.35.0b1
azure-mgmt-resource               23.3.0

Python location '/opt/homebrew/Cellar/azure-cli/2.83.0/libexec/bin/python'
Config directory '/Users/ksugihara/.azure'
Extensions directory '/Users/ksugihara/.azure/cliextensions'

Python (Darwin) 3.13.11 (main, Dec  5 2025, 16:06:33) [Clang 17.0.0 (clang-1700.6.3.2)]

Legal docs and information: aka.ms/AzureCliLegal


Your CLI is up-to-date.

Additional context

SSH command puts corrupted outputs already. az command expects that all characters must be decoded with utf-8.

% ssh-add -l
256 SHA256:... SSHキー (ED25519)
...

We can see the corrupted output in the debug message. This is a built-in SSH command in macOS Tahoe.

% ssh -V
OpenSSH_10.0p2, LibreSSL 3.3.6
% ssh ... -v
debug1: get_agent_identities: agent returned 4 keys
debug1: Will attempt key: SSH�202\255�203 ED25519 SHA256:... agent
...

I confirmed this issue by the following ssh command as well:

% /opt/homebrew/Cellar/openssh/10.2p1/bin/ssh -V
OpenSSH_10.2p1, OpenSSL 3.6.1 27 Jan 2026

[yonzhan]

Thank you for opening this issue, we will look into it.

[k5342]

Thank you for looking this issue. We also attach the following hexdump result from an excerpt of the ssh command output. This already includes 0xe3 in the rows as we saw the above error message.

%  ssh ... -v exit 2>&1 | grep "debug1: Will attempt key" | hexdump -C
00000000  64 65 62 75 67 31 3a 20  57 69 6c 6c 20 61 74 74  |debug1: Will att|
00000010  65 6d 70 74 20 6b 65 79  3a 20 53 53 48 e3 5c 32  |empt key: SSH.\2|
00000020  30 32 5c 32 35 35 e3 5c  32 30 33 bc 20 45 44 32  |02\255.\203. ED2|
00000030  35 35 31 39 20 53 48 41  32 35 36 3a 52 46 4f 59  |5519 SHA256:RFOY|
...

% ssh ... -v exit 2>&1 | grep "Offering public key" | hexdump -C
00000000  64 65 62 75 67 31 3a 20  4f 66 66 65 72 69 6e 67  |debug1: Offering|
00000010  20 70 75 62 6c 69 63 20  6b 65 79 3a 20 53 53 48  | public key: SSH|
00000020  e3 5c 32 30 32 5c 32 35  35 e3 5c 32 30 33 bc 20  |.\202\255.\203. |
00000030  45 44 32 35 35 31 39 20  53 48 41 32 35 36 3a 52  |ED25519 SHA256:R|
...

[vthiebaut10]

Thanks for reporting this issue! We will fix this in the next release. For now, you can use the --debug parameter as a workaround, as you identified. Thank you!