Fix SSH remote agent host passphrase auth#318244
Merged
roblourens merged 3 commits intoMay 26, 2026
Merged
Conversation
Support IdentityAgent from resolved SSH config and prompt for encrypted private key passphrases when connecting SSH remote agent hosts. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR fixes SSH-based Remote Agent Host connections in the Agents window by honoring ssh -G resolved IdentityAgent settings and supporting encrypted private keys via a passphrase prompt, improving parity with OpenSSH behavior and unblocking common SSH setups (e.g. Pageant / custom agents and encrypted keys).
Changes:
- Propagate
IdentityAgentfromssh -Gthrough configured-host connect and reconnect flows, and resolve it to the correct agent endpoint (includingnone/SSH_AUTH_SOCK/ env refs). - Detect encrypted private keys (PEM + OpenSSH format) and prompt for a passphrase via the existing keyboard-interactive quick-input bridge before handing credentials to
ssh2. - Extend SSH config parsing and add focused unit coverage for IdentityAgent parsing, agent selection precedence, and passphrase handling.
Show a summary per file
| File | Description |
|---|---|
| src/vs/sessions/contrib/providers/remoteAgentHost/REMOTE_AGENT_HOST_SESSIONS_PROVIDER.md | Updates provider behavior notes to include IdentityAgent + encrypted key passphrase flow. |
| src/vs/sessions/contrib/providers/remoteAgentHost/browser/remoteAgentHostActions.ts | Passes resolved identityAgent through SSH config connect and manual fallback flows. |
| src/vs/platform/agentHost/common/sshRemoteAgentHost.ts | Extends SSH config and resolved config shapes to include identityAgent. |
| src/vs/platform/agentHost/common/sshConfigParsing.ts | Parses identityagent from ssh -G output. |
| src/vs/platform/agentHost/node/sshRemoteAgentHostService.ts | Implements IdentityAgent resolution, encrypted key detection, and passphrase prompting via auth handler. |
| src/vs/platform/agentHost/test/common/sshConfigParsing.test.ts | Adds coverage for identityagent parsing and updates expected resolved-config shape. |
| src/vs/platform/agentHost/test/node/sshRemoteAgentHostService.test.ts | Adds coverage for IdentityAgent precedence and encrypted key passphrase plumbing. |
| src/vs/platform/agentHost/test/electron-browser/sshRemoteAgentHostService.test.ts | Updates mock resolved-config shape to include identityAgent. |
Copilot's findings
- Files reviewed: 8/8 changed files
- Comments generated: 1
Comment on lines
+38
to
+39
| /** SSH agent endpoint resolved from IdentityAgent, or undefined to use the default agent. */ | ||
| readonly identityAgent?: string; |
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
When the configured agent has the identity loaded, auth should succeed before we ever read an encrypted IdentityFile from disk - otherwise the user gets a passphrase prompt for a key the agent already holds unlocked. Also fix _isDefaultKeyPath to normalize `~` paths so the absolute IdentityFile that `ssh -G` returns is correctly recognized as a default and not promoted to an explicit (encrypted) attempt that fires the passphrase prompt before the agent. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
DonJayamanne
approved these changes
May 26, 2026
roblourens
deleted the
agents/vsckb-implement-please-investigate-and-fix-https-6a10c92d
branch
anthonykim1
added a commit
that referenced
this pull request
May 26, 2026
Squashed cherry-pick of 10 commits from main that are included in the Insiders build (183159e) people are verifying: - agentHost: show fetched URL for web_fetch (#318240) - Fix SSH remote agent host passphrase auth (#318244) - agentHost: add setting to disable worktreeCreated task auto-dispatch (#318243) - Agent host: clearer worktree git timeout errors and 60s budget (#318242) - Normalize LF to CRLF in agent host terminal tool output (#318257) - sessions: restore X-button removal of SSH remote agent host entries (#318262) - chat: fix duplicate command registration for agent-host-copilotcli (#318273) - launch: build copilot in compile; wait for CDP in launch.sh (#318272) - Preserve unread state across remote host disconnect (#318267) - Add more codenotify for terminal (#318285)
dileepyavan
pushed a commit
that referenced
this pull request
May 27, 2026
Squashed cherry-pick of 10 commits from main that are included in the Insiders build (183159e) people are verifying: - agentHost: show fetched URL for web_fetch (#318240) - Fix SSH remote agent host passphrase auth (#318244) - agentHost: add setting to disable worktreeCreated task auto-dispatch (#318243) - Agent host: clearer worktree git timeout errors and 60s budget (#318242) - Normalize LF to CRLF in agent host terminal tool output (#318257) - sessions: restore X-button removal of SSH remote agent host entries (#318262) - chat: fix duplicate command registration for agent-host-copilotcli (#318273) - launch: build copilot in compile; wait for CDP in launch.sh (#318272) - Preserve unread state across remote host disconnect (#318267) - Add more codenotify for terminal (#318285)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #317549
This updates the Agents window SSH remote agent host auth path to honor resolved SSH config agent settings and encrypted private keys.
IdentityAgentfromssh -Gand pass it into ssh2 agent auth, includingIdentityAgent noneandIdentityAgent SSH_AUTH_SOCK.Validation:
npm run compile-check-ts-nativenpm run valid-layers-check./scripts/test.sh --run src/vs/platform/agentHost/test/common/sshConfigParsing.test.ts --run src/vs/platform/agentHost/test/node/sshRemoteAgentHostService.test.ts --timeout 10000npm run precommit