[Remote-SSH Bug]: askpass/local server socket path too long on macOS causes listen EINVAL and publickey failure

Type: Bug

Summary

After updating to VS Code 1.123.0 / Remote - SSH 0.123.0 on macOS, Remote-SSH fails to connect to hosts that require a passphrase-protected private key. Plain ssh <host> works, but Remote-SSH fails before the passphrase prompt can be completed.

The failure appears to be caused by Remote-SSH creating Unix domain sockets for askpass/local-server IPC under macOS's long per-user temp directory, e.g. /var/folders/.../T/vscode-ssh-askpass-<hash>.sock. That path is longer than the macOS Unix socket path limit and listen fails with EINVAL.

Environment

• VS Code: 1.123.0
• Remote - SSH: 0.123.0
• OS: macOS 15.7.7 (24G720), darwin arm64
• Local SSH: OpenSSH_9.9p2, LibreSSL 3.3.6
• Remote OS: Linux
• Remote auth: public key with passphrase-protected private key
• remote.SSH.useLocalServer = true
• remote.SSH.useExecServer = true

Steps to Reproduce

1. On macOS, configure a Remote-SSH host that uses a passphrase-protected private key.
2. Confirm plain terminal SSH works: ssh <host>.
3. In VS Code 1.123.0 with Remote - SSH 0.123.0, connect to the same host using Remote-SSH.

Actual Result

Remote-SSH fails with Permission denied (publickey). The detailed log shows that the actual failure is local askpass IPC socket creation:

[22:54:39.262] askpass server listening on /var/folders/.../T/vscode-ssh-askpass-0fae126bdca6cba28704cf6a312322dd28b614e2.sock
[22:54:39.262] Spawning local server with {"ipcHandlePath":"/var/folders/.../T/vscode-ssh-askpass-944f26aa3ac2c35c6cebdc6f954f2bac3c1d717d.sock", ...}
[22:54:39.321] stderr> local-server-1> listen EINVAL: invalid argument /var/folders/.../T/vscode-ssh-askpass-944f26aa3ac2c35c6cebdc6f954f2bac3c1d717d.sock
[22:54:39.674] stderr> Failed to get SSH credentials: Error in request: connect EINVAL /var/folders/.../T/vscode-ssh-askpass-0fae126bdca6cba28704cf6a312322dd28b614e2.sock - Local (undefined:undefined)
[22:54:39.679] stderr> <user>@<host>: Permission denied (publickey).

The resulting Permission denied is misleading because the private key is valid; Remote-SSH cannot obtain the passphrase because the local askpass IPC socket cannot be created/connected.

Expected Result

Remote-SSH should show the normal passphrase prompt and complete authentication, same as previous versions / terminal SSH.

Workaround Confirmed

I patched Remote-SSH's getIPCHandlePath implementation in out/extension.js so that non-Windows askpass IPC sockets are created under /tmp instead of macOS's long temp directory:

i.join("/tmp", `vscode-ssh-${e}-${t}.sock`)

After this change, the log shows:

askpass server listening on /tmp/vscode-ssh-askpass-....sock
Got askpass request: {"request":" Enter passphrase for key ..."}
Authenticated to <host> using "publickey".

This strongly suggests the regression is caused by askpass/local-server IPC socket path length on macOS.

Notes

This worked in previous VS Code / Remote-SSH versions. It appears to be a regression in how the askpass/local-server IPC socket path is chosen or handled on macOS.

Start in out/extension.js by locating the getIPCHandlePath implementation and tracing how askpass and local-server IPC socket paths are constructed on macOS. Reproduce the connection with a passphrase-protected key, then verify that the socket can be created and the normal passphrase prompt completes authentication without the listen EINVAL error.