I disagree that this is an external bug.

fossil could/should execute the command as its command to execute on the remote side because fossil is requiring a particular shell, in this case, sh.

Or, if that's not possible, have it fire off an 'exec bin/sh' as its first command upon establishing an ssh connection. Something like (one of the two options should work - dry coded, unfortunately):

<verbatim>Index: src/http_transport.c
===================================================================
--- src/http_transport.c
+++ src/http_transport.c
@@ -147,17 +147,23 @@
     }else{
       zHost = mprintf("%s", g.urlName);
     }
     blob_append(&zCmd, " ", 1);
     shell_escape(&zCmd, zHost);
+    blob_append(&zCmd, " ", 1);
+    shell_escape(&zCmd,
     printf(" %s\n", zHost);  /* Show the conclusion of the SSH command */
     free(zHost);
     popen2(blob_str(&zCmd), &sshIn, &sshOut, &sshPid);
     if( sshPid==0 ){
       fossil_fatal("cannot start ssh tunnel using [%b]", &zCmd);
     }
     blob_reset(&zCmd);
+
+    /* Start sh(1) */
+    fprintf(sshOut, "exec
+    fflush(sshOut);

     /* Send an "echo" command to the other side to make sure that the
     ** connection is up and working.
     */
     fprintf(sshOut, "echo test\n");

</verbatim>