fix: isolate SSH configs per editor

Author: EhabY

CHANGELOG.md

@@ -17,13 +17,14 @@
 
 ### Changed
 
-- Write workspace SSH hosts to `~/.ssh/coder/config` and include that file
-  from the top of your own SSH config, rather than writing the block into your
-  config directly. SSH uses the first value it obtains for each option, so a
-  catch-all like `Host *` used to override the connection's `ProxyCommand` and
-  abort it with an "Unexpected SSH Config Option" error; now the extension's
-  options win and that error is gone. Your config is only written once, to add
-  the include, and the block for a deployment moves out of it on next connect.
+- Write workspace SSH hosts to an editor-owned file in the extension's global
+  storage and include that file from the top of your SSH config, rather than
+  writing the block into your config directly. Each VS Code-based editor gets
+  its own include and SSH host prefix, so VS Code, Cursor, Windsurf, and other
+  clones no longer overwrite one another's machine-specific proxy settings.
+  Legacy `coder-vscode` authorities are migrated in other editors. SSH
+  uses the first value it obtains for each option, so a catch-all like `Host *`
+  can no longer override the connection's `ProxyCommand`.
 - Filter the Shared Workspaces view with the server-side `shared_with_user`
   query instead of filtering `shared:true` results on the client, so fewer
   workspaces are fetched and the view loads faster. Deployments too old to

CONTRIBUTING.md

@@ -14,39 +14,57 @@ The `ssh-remote` scheme is registered by Microsoft's Remote - SSH extension and
 indicates that it should connect to the provided host name using SSH.
 
 The host name takes the format
-`coder-vscode.<domain>--<username>--<workspace>`. This is parsed by the CLI
-(which is invoked via SSH's `ProxyCommand`) to route SSH to the right workspace.
+`coder-<editor>.<domain>--<username>--<workspace>`, where `<editor>` comes from
+that product's URI scheme, such as `vscode`, `cursor`, or `windsurf`. The CLI is
+invoked through SSH's `ProxyCommand` with this prefix so it can route SSH to the
+right workspace. A legacy `coder-vscode` authority opened in another editor is
+reopened once with that editor's prefix; legacy recent-folder entries remain
+compatible when opening the same workspace.
 
 The Coder Remote extension also registers for the
 `onResolveRemoteAuthority:ssh-remote` [extension activation
 event](https://code.visualstudio.com/api/references/activation-events) to hook
 into this process, running before the Remote - SSH extension actually connects.
 
-On activation of this event, we check if `vscode.workspace.workspaceFolders`
-contains the `coder-vscode` prefix, and if so we delay activation to:
+On activation of this event, we check whether the remote authority belongs to
+the current editor, and if so we delay activation to:
 
 1. Parse the host name to get the domain, username, and workspace.
 2. Ensure the workspace is running.
 3. Download the matching server binary to the client.
 4. Configure the binary with the URL and token, asking the user for them if they
    are missing. Each domain gets its own config directory.
-5. Add an entry to the user's SSH config for `coder-vscode.<domain>--*`.
+5. Write an entry for `coder-<editor>.<domain>--*` to `ssh-config` in the
+   extension's global storage directory.
+6. Add a per-editor `Include` block at the top of the user's SSH config.
 
 ```text
-Host coder-vscode.dev.coder.com--*
-	ProxyCommand "/tmp/coder" --global-config "/home/kyle/.config/Code/User/globalStorage/coder.coder-remote/dev.coder.com" ssh --stdio --network-info-dir "/home/kyle/.config/Code/User/globalStorage/coder.coder-remote/net" --ssh-host-prefix coder-vscode.dev.coder.com-- %h
+# --- START CODER cursor ---
+Include "/home/kyle/.config/Cursor/User/globalStorage/coder.coder-remote/ssh-config"
+# --- END CODER cursor ---
+
+# --- START CODER vscode ---
+Include "/home/kyle/.config/Code/User/globalStorage/coder.coder-remote/ssh-config"
+# --- END CODER vscode ---
+```
+
+Each included file contains only that editor's host entries:
+
+```text
+Host coder-cursor.dev.coder.com--*
+	ProxyCommand "/tmp/coder" --global-config "/home/kyle/.config/Cursor/User/globalStorage/coder.coder-remote/dev.coder.com" ssh --stdio --network-info-dir "/home/kyle/.config/Cursor/User/globalStorage/coder.coder-remote/net" --ssh-host-prefix coder-cursor.dev.coder.com-- %h
 	ConnectTimeout 0
 	StrictHostKeyChecking no
 	UserKnownHostsFile /dev/null
 	LogLevel ERROR
 ```
 
-Which file that entry goes in depends on the Remote - SSH extension. Microsoft's
-and Cursor's pass `remote.SSH.configFile` to ssh with `-F`, and VSCodium's parses
-the file itself instead of running ssh, so all three connect through it.
-Antigravity and Windsurf/Devin renamed the setting but spawn ssh without `-F`, so
-ssh reads `~/.ssh/config` regardless; we ignore it there rather than write the
-host where the connection never looks.
+Which main file gains the include depends on the Remote - SSH extension.
+Microsoft's and Cursor's pass `remote.SSH.configFile` to ssh with `-F`, and
+VSCodium's parses the file itself instead of running ssh, so all three connect
+through it. Antigravity and Windsurf/Devin renamed the setting but spawn ssh
+without `-F`, so ssh reads `~/.ssh/config` regardless; we ignore the renamed
+setting there rather than add the include where the connection never looks.
 
 If any step fails, we show an error message. Once the error message is closed
 we close the remote so the Remote - SSH connection does not continue to

src/commands.ts

@@ -50,7 +50,10 @@ import {
 	toRemoteLogGlobs,
 } from "./supportBundle/remoteServerDataPath";
 import { runExportTelemetryCommand } from "./telemetry/export/command";
-import { toRemoteAuthority } from "./util/authority";
+import {
+	isRemoteAuthorityCompatible,
+	toRemoteAuthority,
+} from "./util/authority";
 import { openInBrowser, toSafeHost } from "./util/uri";
 import { vscodeProposed } from "./vscodeProposed";
 import { parseNetcheckReport } from "./webviews/netcheck/types";
@@ -1443,12 +1446,11 @@ export class Commands {
 			const output: {
 				workspaces: Array<{ folderUri: vscode.Uri; remoteAuthority: string }>;
 			} = await vscode.commands.executeCommand("_workbench.getRecentlyOpened");
-			const opened = output.workspaces.filter(
-				// Remove recents that do not belong to this connection.  The remote
-				// authority maps to a workspace/agent combination (using the SSH host
-				// name).  There may also be some legacy connections that still may
-				// reference a workspace without an agent name, which will be missed.
-				(opened) => opened.folderUri?.authority === remoteAuthority,
+			const opened = output.workspaces.filter((opened) =>
+				isRemoteAuthorityCompatible(
+					opened.folderUri?.authority,
+					remoteAuthority,
+				),
 			);
 			// openRecent will always use the most recent.  Otherwise, if there are
 			// multiple we ask the user which to use.

src/core/pathResolver.ts

@@ -42,6 +42,10 @@ export class PathResolver {
 		return path.join(this.basePath, "net");
 	}
 
+	public getSshConfigPath(): string {
+		return path.join(this.basePath, "ssh-config");
+	}
+
 	/**
 	 * Return the directory where telemetry files are written.
 	 */

src/remote/remote.ts

@@ -39,9 +39,11 @@ import {
 import { getHeaderCommand } from "../settings/headers";
 import { escapeCommandArg, expandPath } from "../util";
 import {
-	AuthorityPrefix,
 	type AuthorityParts,
+	classifyRemoteAuthority,
 	parseRemoteAuthority,
+	retargetRemoteAuthority,
+	toCurrentAuthorityHostPrefix,
 } from "../util/authority";
 import { createStatusBarItem } from "../util/statusBar";
 import { vscodeProposed } from "../vscodeProposed";
@@ -77,13 +79,6 @@ import type { SecretsManager } from "../core/secretsManager";
 import type { Logger } from "../logging/logger";
 import type { LoginCoordinator } from "../login/loginCoordinator";
 
-/**
- * Our own config, included from the user's. Keep the tilde: relative includes
- * always resolve against ~/.ssh, and an absolute path would not survive a
- * config synced between machines.
- */
-const CODER_SSH_CONFIG_PATH = "~/.ssh/coder/config";
-
 export interface RemoteDetails extends vscode.Disposable {
 	safeHostname: string;
 	url: string;
@@ -160,6 +155,16 @@ export class Remote {
 			return;
 		}
 
+		switch (classifyRemoteAuthority(parts)) {
+			case "current":
+				break;
+			case "legacy":
+				await this.migrateLegacyAuthority(remoteAuthority, startupMode);
+				return;
+			case "foreign":
+				return;
+		}
+
 		this.logger.info("Setting up remote connection", {
 			remoteAuthority,
 			hostname: parts.safeHostname,
@@ -713,6 +718,46 @@ export class Remote {
 		return undefined;
 	}
 
+	private async migrateLegacyAuthority(
+		remoteAuthority: string,
+		startupMode: StartupMode,
+	): Promise<void> {
+		const migratedAuthority = retargetRemoteAuthority(remoteAuthority);
+		const workspaceFile = vscode.workspace.workspaceFile;
+		const workspaceFolders = vscode.workspace.workspaceFolders ?? [];
+		const savedWorkspaceFile =
+			workspaceFile?.scheme === "untitled" ? undefined : workspaceFile;
+		if (!savedWorkspaceFile && workspaceFolders.length > 1) {
+			throw new Error(
+				"Cannot migrate a multi-root workspace without a saved workspace file.",
+			);
+		}
+
+		await this.serviceContainer
+			.getMementoManager()
+			.setStartupMode(startupMode === "none" ? "start" : startupMode);
+		this.logger.info("Migrating legacy remote authority", {
+			from: remoteAuthority,
+			to: migratedAuthority,
+		});
+
+		const currentUri = savedWorkspaceFile ?? workspaceFolders[0]?.uri;
+		if (currentUri) {
+			await vscode.commands.executeCommand(
+				"vscode.openFolder",
+				currentUri.with({
+					authority: retargetRemoteAuthority(currentUri.authority),
+				}),
+				false,
+			);
+			return;
+		}
+		await vscode.commands.executeCommand("vscode.newWindow", {
+			remoteAuthority: migratedAuthority,
+			reuseWindow: true,
+		});
+	}
+
 	private async resolveRemoteBinary(workspaceClient: Api): Promise<string> {
 		if (
 			this.extensionContext.extensionMode === vscode.ExtensionMode.Production
@@ -967,10 +1012,8 @@ export class Remote {
 		// Our blocks live in our own file; the user's only gains the include.
 		const sshConfig = new SshConfig(this.getSshConfigPath(), this.logger);
 		await sshConfig.load();
-		const coderConfig = new SshConfig(
-			expandPath(CODER_SSH_CONFIG_PATH),
-			this.logger,
-		);
+		const coderConfigPath = this.pathResolver.getSshConfigPath();
+		const coderConfig = new SshConfig(coderConfigPath, this.logger);
 		await coderConfig.load();
 
 		// Merge SSH config from three sources (highest to lowest priority):
@@ -988,9 +1031,7 @@ export class Remote {
 			userConfig,
 		);
 
-		const hostPrefix = safeHostname
-			? `${AuthorityPrefix}.${safeHostname}--`
-			: `${AuthorityPrefix}--`;
+		const hostPrefix = toCurrentAuthorityHostPrefix(safeHostname);
 
 		const proxyCommand = await this.buildProxyCommand(
 			binaryPath,
@@ -1019,7 +1060,13 @@ export class Remote {
 
 		// Write our file before including it, so the include never dangles.
 		await coderConfig.update(safeHostname, sshValues, sshConfigOverrides);
-		await sshConfig.updateInclude(CODER_SSH_CONFIG_PATH, safeHostname);
+		await sshConfig.updateInclude(
+			{
+				id: vscode.env.uriScheme,
+				includePath: coderConfigPath,
+			},
+			safeHostname,
+		);
 
 		// Mirror SSH's parse order; RemoteCommand can come from the user's config.
 		return computeSshProperties(