With a site-to-site peer up, show vpn debug peer <name> prints only an error:

vyos@prv5565-dut:~$ show vpn debug peer PRV5565-B
/bin/sh: line 1: /usr/sbin/ipsec: No such file or directory

show vpn debug (all peers) starts with /bin/sh: line 1: ipsec: command not found, then prints the remaining sections.

Likely cause (from package history, not bisected): T8099 (June 2026) moved rolling from strongSwan 5.9.11 to 6.0.x. Since Debian 6.0.0-1 the strongswan metapackage pulls in strongswan-swanctl instead of strongswan-starter, which ships the ipsec script, and vyos-1x does not depend on strongswan-starter. Circinus still pins 5.9.11.

Other callers of the script (code read, not tested):

• src/op_mode/vpn_ipsec.py debug_peer(): ipsec statusall
• op-mode-definitions/vpn-ipsec.xml.in: show vpn ipsec status runs /usr/sbin/ipsec status
• src/conf_mode/system_acceleration.py vpn_control(): ipsec start / ipsec <action> for QAT

Possible fix (untested): switch these calls to swanctl (--list-sas, --list-conns) and systemctl restart strongswan, or add strongswan-starter to the image.