Agents window: SSH fails with "no matching host key format" on hosts using OpenSSH host certificates
- Dominant language
- TypeScript
- Stars
- 193k
- Forks
- 42.4k
- PR merge metrics
- PR metrics pending
Description
Does this issue occur when all extensions are disabled?: Yes
- VS Code Version: 1.128.0
- OS Version: macOS Tahoe
The Agents window cannot open a Remote > SSH workspace on a host that presents an OpenSSH host certificate. It fails at host key negotiation with:
```
[SSHRemoteAgentHost] SSH connection error: Handshake failed: no matching host key format
```
The same host connects fine with the Remote-SSH extension, which uses the system `ssh` binary. The error text matches the Node `ssh2` library, which does not support `*-cert-v01@openssh.com` host keys, so it looks like the Agents window uses `ssh2` rather than system `ssh`.
Steps to Reproduce:
1. Configure sshd to present a host certificate. Minimal setup:
```
ssh-keygen -f ca -C ca
ssh-keygen -s ca -h -I host -n myhost /etc/ssh/ssh_host_ed25519_key.pub
# sshd_config:
# HostKey /etc/ssh/ssh_host_ed25519_key
# HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub
# HostKeyAlgorithms ssh-ed25519-cert-v01@openssh.com
echo "@cert-authority myhost $(cat ca.pub)" >> ~/.ssh/known_hosts
2. Confirm the Remote-SSH extension connection to the host.
3. Run "Chat: Open Agents Window", then New > Remote > SSH, and select the host.
Expected: connects like Remote-SSH does.
Actual: connection fails with the host key error above and never reaches the remote.
I could not find a setting to make the Agents window use system `ssh` (`remote.SSH.path` applies to the Remote-SSH extension).
Related but different root cause: #315870 (process startup), #324081 / #317549 (client auth).
Contributor guide
Research direction
Reproduce the failure using the provided sshd host-certificate setup, then trace the Agents window's Remote > SSH connection path and the Node ssh2 host-key handling implicated by the error. Compare it with the Remote-SSH extension's system ssh behavior. Done means the Agents window opens the remote workspace on a host presenting an OpenSSH certificate.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js, typescript
- Domain
- developer-experience, networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 50/100