Skip to content
Activity · 5m 9s
Thinking
Inspecting Extension Bundle Before Patching
Python
bash -lc ls -lah /mnt/data | sed -n '1,120p'
total 1.8M
drwxrwsr-x 5 oai  oai_shared 4.0K Aug 14 00:32 .
drwxr-xr-x 3 root root       4.0K Aug  3 18:26 ..
-rw-r--r-- 1 root oai_shared 207K Aug 14 00:32 Code 2026-08-14T00-13-36.649.png
-rw-r--r-- 1 root oai_shared 3.8K Aug 14 00:21 analyze_bundle_modules.js
-rw-r--r-- 1 root oai_shared  52K Aug 14 00:23 dependency_ops.txt
drwxr-sr-x 2 root oai_shared 4.0K Aug 14 00:19 jsdiff-tools
-rw-r--r-- 1 root oai_shared  32K Aug 14 00:21 module_summary.txt
-rw-r--r-- 1 root oai_shared 714K Aug 14 00:32 ms-vscode-remote.remote-ssh-0.124.0.zip
-rw-r--r-- 1 root oai_shared 718K Aug 14 00:32 ms-vscode-remote.remote-ssh-0.125.2026081318.zip
-rw-r--r-- 1 root oai_shared 4.9K Aug 14 00:32 remote-ssh-0.124.0-to-0.125.2026081318-analysis.md
drwxr-sr-x 3 root oai_shared 4.0K Aug 14 00:19 ssh124
drwxr-sr-x 3 root oai_shared 4.0K Aug 14 00:19 ssh125
-rw-r--r-- 1 root oai_shared  29K Aug 14 00:21 thirdparty.diff
Assessing retry behavior

I’m tracing where authentication fails and whether retrying the challenge alone is sufficient. The token may be stale or invalid, so a reliable loop might need to rebuild the tunnel or installation state rather than repeat the exact request.

Inspecting Resolver Retry Architecture
Python
bash -lc python3 - <<'PY'
from pathlib import Path
p=Path('/mnt/data/ssh125/ms-vscode-remote.remote-ssh-0.125.2026081318/out/extension.js')
s=p.read_text()
for needle in ['Resolver error:', 'Resolving exec server', 'resolveWithLocalServer', 'resolve(']:
    i=0
    print('\n###', needle)
    while True:
        i=s.find(needle,i)
        if i<0: break
        print('offset',i)
        print(s[max(0,i-3500):min(len(s),i+5500)])
        i+=len(needle)
        if needle!='resolve(' and i>0: break
PY
Searching github.com
github.com
Inspecting VS Code Remote SSH resolver error handling
Python
bash -lc sed -n '1,260p' /mnt/data/ssh125/ms-vscode-remote.remote-ssh-0.125.2026081318/vscode.proposed.resolvers.d.ts
/*---------------------------------------------------------------------------------------------
 *  Copyright (c) Microsoft Corporation. All rights reserved.
 *  Licensed under the MIT License. See License.txt in the project root for license information.
 *--------------------------------------------------------------------------------------------*/

declare module 'vscode' {

	//resolvers: @alexdima

	export interface MessageOptions {
		/**
		 * Do not render a native message box.
		 */
		useCustom?: boolean;
	}

	export interface RemoteAuthorityResolverContext {
		resolveAttempt: number;
		/**
		 * Exec server from a recursively-resolved remote authority. If the
		 * remote authority includes nested authorities delimited by `@`, it is
		 * resolved from outer to inner authorities with ExecServer passed down
		 * to each resolver in the chain.
		 */
		execServer?: ExecServer;
	}

	export class ResolvedAuthority {
		readonly host: string;
		readonly port: number;
		readonly connectionToken: string | undefined;

		constructor(host: string, port: number, connectionToken?: string);
	}

	export interface ManagedMessagePassing {
		readonly onDidReceiveMessage: Event<Uint8Array>;
		readonly onDidClose: Event<Error | undefined>;
		readonly onDidEnd: Event<void>;

		send: (data: Uint8Array) => void;
		end: () => void;
		drain?: () => Thenable<void>;
	}

	export class ManagedResolvedAuthority {
		readonly makeConnection: () => Thenable<ManagedMessagePassing>;
		readonly connectionToken: string | undefined;

		constructor(makeConnection: () => Thenable<ManagedMessagePassing>, connectionToken?: string);
	}

	export interface ResolvedOptions {
		extensionHostEnv?: { [key: string]: string | null };

		isTrusted?: boolean;

		/**
		 * When provided, remote server will be initialized with the extensions synced using the given user account.
		 */
		authenticationSessionForInitializingExtensions?: AuthenticationSession & { providerId: string };
	}

	export interface TunnelPrivacy {
		themeIcon: string;
		id: string;
		label: string;
	}

	export namespace env {
		/** Quality of the application. May be undefined if running from sources. */
		export const appQuality: string | undefined;
		/** Commit of the application. May be undefined if running from sources. */
		export const appCommit: string | undefined;
	}

	export interface TunnelOptions {
		remoteAddress: { port: number; host: string };
		// The desired local port. If this port can't be used, then another will be chosen.
		localAddressPort?: number;
		label?: string;
		/**
		 * @deprecated Use privacy instead
		 */
		public?: boolean;
		privacy?: string;
		protocol?: string;
	}

	export interface TunnelDescription {
		remoteAddress: { port: number; host: string };
		//The complete local address(ex. localhost:1234)
		localAddress: { port: number; host: string } | string;
		/**
		 * @deprecated Use privacy instead
		 */
		public?: boolean;
		privacy?: string;
		// If protocol is not provided it is assumed to be http, regardless of the localAddress.
		protocol?: string;
	}

	export interface Tunnel extends TunnelDescription {
		// Implementers of Tunnel should fire onDidDispose when dispose is called.
		readonly onDidDispose: Event<void>;
		dispose(): void | Thenable<void>;
	}

	/**
	 * Used as part of the ResolverResult if the extension has any candidate,
	 * published, or forwarded ports.
	 */
	export interface TunnelInformation {
		/**
		 * Tunnels that are detected by the extension. The remotePort is used for display purposes.
		 * The localAddress should be the complete local address (ex. localhost:1234) for connecting to the port. Tunnels provided through
		 * detected are read-only from the forwarded ports UI.
		 */
		environmentTunnels?: TunnelDescription[];

		tunnelFeatures?: {
			elevation: boolean;
			/**
			 * One of the options must have the ID "private".
			 */
			privacyOptions: TunnelPrivacy[];
			/**
			 * Defaults to true for backwards compatibility.
			 */
			protocol?: boolean;
		};
	}

	export interface TunnelCreationOptions {
		/**
		 * True when the local operating system will require elevation to use the requested local port.
		 */
		elevationRequired?: boolean;
	}

	export enum CandidatePortSource {
		None = 0,
		Process = 1,
		Output = 2,
		Hybrid = 3
	}

	export type ResolverResult = (ResolvedAuthority | ManagedResolvedAuthority) & ResolvedOptions & TunnelInformation;

	export class RemoteAuthorityResolverError extends Error {
		static NotAvailable(message?: string, handled?: boolean): RemoteAuthorityResolverError;
		static TemporarilyNotAvailable(message?: string): RemoteAuthorityResolverError;

		constructor(message?: string);
	}

	/**
	 * An ExecServer allows spawning processes on a remote machine. An ExecServer is provided by resolvers. It can be
	 * acquired by `workspace.getRemoteExecServer` or from the context when in a resolver (`RemoteAuthorityResolverContext.execServer`).
	 */
	export interface ExecServer {
		/**
		 * Spawns a given subprocess with the given command and arguments.
		 * @param command The command to execute.
		 * @param args The arguments to pass to the command.
		 * @param options Additional options for the spawned process.
		 * @returns A promise that gives access to the process' stdin, stdout and stderr streams, as well as the process' exit code.
		 */
		spawn(command: string, args: string[], options?: ExecServerSpawnOptions): Thenable<SpawnedCommand>;

		/**
		 * Spawns an connector that allows to start a remote server. It is assumed the command starts a Code CLI. Additional
		 * arguments will be passed to the connector.
		 * @param command The command to execute. It is assumed the command spawns a Code CLI executable.
		 * @param args The arguments to pass to the connector
		 * @param options Additional options for the spawned process.
		 * @returns A promise that gives access to the spawned {@link RemoteServerConnector}. It also provides a stream to which standard
		 * log messages are written.
		 */
		spawnRemoteServerConnector?(command: string, args: string[], options?: ExecServerSpawnOptions): Thenable<RemoteServerConnector>;

		/**
		 * Downloads the CLI executable of the desired platform and quality and pipes it to the
		 * provided process' stdin.
		 * @param buildTarget The CLI build target to download.
		 * @param command The command to execute. The downloaded bits will be piped to the command's stdin.
		 * @param args The arguments to pass to the command.
		 * @param options Additional options for the spawned process.
		 * @returns A promise that resolves when the process exits with a {@link ProcessExit} object.
		 */
		downloadCliExecutable?(buildTarget: CliBuild, command: string, args: string[], options?: ExecServerSpawnOptions): Thenable<ProcessExit>;

		/**
		 * Gets the environment where the exec server is running.
		 * @returns A promise that resolves to an {@link ExecEnvironment} object.
		 */
		env(): Thenable<ExecEnvironment>;

		/**
		 * Kills a process with the given ID.
		 *
		 * @param processId process ID to kill.
		 */
		kill(processId: number): Thenable<void>;

		/**
		 * Connects to the given TCP host/port on the remote.
		 *
		 * @param host The hostname or IP to connect to
		 * @param port The port number to connect to
		 * @returns a duplex stream, and a promise the resolves when both sides
		 * have closed.
		 */
		tcpConnect(
			host: string,
			port: number,
		): Thenable<{ stream: WriteStream & ReadStream; done: Thenable<void> }>;

		/**
		 * Access to the file system of the remote.
		 */
		readonly fs: RemoteFileSystem;
	}

	export type ProcessEnv = Record<string, string>;

	export interface ExecServerSpawnOptions {
		readonly env?: ProcessEnv;
		readonly cwd?: string;
	}

	export interface SpawnedCommand {
		readonly stdin: WriteStream;
		readonly stdout: ReadStream;
		readonly stderr: ReadStream;
		readonly onExit: Thenable<ProcessExit>;
	}

	export interface RemoteServerConnector {
		readonly logs: ReadStream;
		readonly onExit: Thenable<ProcessExit>;
		/**
		 * Connect to a new code server, returning a stream that can be used to communicate with it.
		 * @param params The parameters for the code server.
		 * @returns A promise that resolves to a {@link ManagedMessagePassing} object that can be used with a resolver
		 */
		connect(params: ServeParams): Thenable<ManagedMessagePassing>;
	}

	export interface ProcessExit {
		readonly status: number;
		readonly message?: string;
	}

	export interface ReadStream {
		readonly onDidReceiveMessage: Event<Uint8Array>;
		readonly onEnd: Thenable<void>;
	}

	export interface WriteStream {
Searching github.com
github.com
Inspecting module 4111 implementation
Python
bash -lc node /mnt/data/analyze_bundle_modules.js /mnt/data/ssh125/ms-vscode-remote.remote-ssh-0.125.2026081318/out/extension.js 2>/dev/null | grep -A2 -B2 '^MODULE 4111' || true
Searching github.com
github.com
Designing the patcher
I’m planning a Python patcher that recognizes the extension directory, bundled script, or archive, then injects bounded retry handling around authentication failures while preserving backups and supporting verification or reversion.
Inspecting tunnel creation module 1577
Python
bash -lc python3 - <<'PY'
from pathlib import Path
import re
s=Path('/mnt/data/ssh125/ms-vscode-remote.remote-ssh-0.125.2026081318/out/extension.js').read_text()
pat=re.compile(r'(?:(?<=\{)|(?<=\},))(\d+)\((e(?:,t(?:,n)?)?)\)\{')
ms=list(pat.finditer(s))
for target in ['1577']:
 for idx,m in enumerate(ms):
  if m.group(1)==target:
   start=m.start(1); end=ms[idx+1].start()-1
   out=s[start:end]
   print('len',len(out))
   print(out[:10000])
   break
PY
len 5247
1577(e,t,n){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.createTunnel=void 0;const r=n(9278),o=n(5861),i=n(1398),s=n(729),a=n(3411),l=n(712),c=n(8602),u=n(3070),d=n(8993),h=n(4847),f=n(4430),p=n(4417),m=n(221),g=n(5691),v=n(2593),y=n(1640),w=n(8214),S=n(2869);class b{constructor(e,t,n,r){this.host=e,this.remoteTarget=t,this.localTarget=n,this.name=r}close(){D(this)}}class _ extends b{constructor(e,t,n,r,o){super(e,t,n,r),this.tokenSource=o}set sshAuthSock(e){this._sshAuthSock=e}get sshAuthSock(){return this._sshAuthSock}dispose(){this.tokenSource.cancel()}}let C=[];function D(e){C=C.filter(t=>t!==e),e.dispose()}t.createTunnel=async function(e,{remoteListeningOn:t,platform:n,preferredLocalPortRange:c,name:b,socksPort:k}){try{let T;try{const e=await async function(e){if(e){let t=e.end-e.start+1,n=await g.findFreePortFrom(e.start,t,3e3);if(0===n)throw new Error(i.l10n.t("No free ports in specified range '{0}-{1}'.  Remove or update the 'Preferred Local Port Range' setting and try again.",e.start,e.end));return n}return await g.findAnyFreePort()}(c);T={port:e}}catch(e){throw l.SshResolverError.Create(S.UnifiedStatusCode.FindLocalPort,i.l10n.t("Failed to find a free local port: {0}",e.message))}const I=k&&"port"in t?await async function(e,t,n,s,a){const{logger:c}=e.deps;e.deps.progress.report({message:i.l10n.t("Setting up SSH tunnel")});const u=await(0,p.getConfigurationForHost)(c,e.host),d=u&&r.isIPv6(u.HostName)||"inet6"===u?.AddressFamily?"::1":"127.0.0.1",h=new i.CancellationTokenSource,f=new _(e.host,{port:s},t,a,h);C.push(f);const g=await async function(e,t,n,s,a){const c={proxy:{host:s,port:t,type:5},command:"connect",destination:{host:"127.0.0.1",port:n}};let u=0;return new Promise(s=>{a.debug(`Starting forwarding server. local ${l.ListenTarget.display(e)} -> socksPort ${t} -> remotePort ${n}`);const d=[],h=r.createServer(async t=>{try{u<10&&a.debug(`[Forwarding server ${l.ListenTarget.display(e)}] Got connection ${u++}`);const n=await o.SocksClient.createConnection(c);t.pipe(n.socket),n.socket.pipe(t),d.push({dispose(){t.end(),n.socket.end()}})}catch(e){a.error(`Failed to set up socket for dynamic port forward to remote port ${n}: ${e.message}. TCP port forwarding may be disabled, or the remote server may have crashed. See the VS Code Server log above for details.`),i.window.showErrorMessage('Failed to set up dynamic port forwarding connection over SSH to the VS Code Server. ([Show log](command:opensshremotes.showLog "Show log"))')}});l.ListenTarget.listen(h,e,()=>{a.debug("Forwarding server listening on "+l.ListenTarget.display(e)),s({dispose(){h.close(),(0,m.dispose)(d)}})})})}(t,n,s,d,e.deps.logger);return h.token.onCancellationRequested(()=>{(0,m.dispose)(g)}),f}(e,T,k,t.port,b):await async function(e,t,n,r,o){const c=e.deps;return(0,d.withShowDetailsEvent)(async p=>{let m;c.progress.report({message:`([details](command:${d.SHOW_DETAILS_COMMAND} "${i.l10n.t("Show details in terminal")}")) ${i.l10n.t("Setting up SSH tunnel")}`});const g=await async function(e,t,n,r){let o;o=t===u.Platform.Windows?`${(0,a.enableAgentForwarding)()?"echo $env:SSH_AUTH_SOCK; ":""}echo '${P}'; ${E}`:`${(0,a.enableAgentForwarding)()?"echo $SSH_AUTH_SOCK && ":""}echo -e '${P}' && while true; do sleep 180; echo -n ' '; done`;const i=e=>"port"in e?`127.0.0.1:${e.port}`:e.socketPath.startsWith("\\\\.\\pipe\\")?"/"+e.socketPath.slice(1):e.socketPath,s=`${i(r)}:${i(n)}`;return(0,h.generateMultiLineCommand)(e,t,o,{cmdSegment:["-L",s],allowPortForward:!0,quoteForShell:!0})}(e,t,n,r);c.logger.debug(`Spawning tunnel with: ${g}`);const w=new i.CancellationTokenSource;m=new _(e.host,n,r,o,w),C.push(m);const S=(0,s.getInteractorForMsg)(new RegExp(`(SSH_AUTH_SOCK=(.*)\\r?\\n)?${P}`));(0,f.runSshTerminalCommandWithLogin)(e,{systemInteractor:y.defaultSystemInteractor,command:g,nickname:"SSH Tunnel",interactor:S.interactor,revealTerminal:p,token:w.token}).then(()=>{c.logger.debug("SSH tunnel command completed unexpectedly")},e=>{c.logger.debug("SSH tunnel command completed unexpectedly with error: "+(e&&e.message))}).finally(()=>{D(m)});const b=await S.result,k=b&&b[2]&&(0,v.stripEscapeSequences)(b[2]);return m.sshAuthSock=k,c.logger.info(`Spawned SSH tunnel between local ${l.ListenTarget.display(r)} and remote target ${l.ListenTarget.display(n)}`),m})}(e,n,t,T,b);return e.deps.progress.report({message:i.l10n.t("Waiting for port forwarding to be ready")}),e.deps.logger.info("Waiting for ssh tunnel to be ready"),await async function(e,t=1e4){return async function(e,t){let n=0;for(;!await e();){if(n>t)throw new Error(i.l10n.t("Max wait time exhausted"));await(0,w.wait)(100),n+=100}}(async()=>!await g.isFreePort(e),t)}(T.port),e.deps.logger.info(`Tunneled ${l.ListenTarget.display(t)} to local ${l.ListenTarget.display(T)}`),{localTarget:I.localTarget,sshAuthSock:I.sshAuthSock}}catch(t){const n=t.message||t;throw e.deps.logger.error(`Error establishing tunnel (${n}).`),new Error(i.l10n.t("Error establishing tunnel ({0}).",`${n}`))}};const E=`\n${c.getSshdParentPid}\n\n$sshdPID = getSshdParentPid\n\nwhile ($True) {\n\tif (!(gps -Id $sshdPID)) {\n\t\t"sshd parent died, exit"\n\t\texit 0\n\t}\n\tsleep 30\n}\n`,P="Connected to SSH Host - Please do not close this terminal"}

Patching Remote-SSH Authentication Retry Mechanism
Python
bash -lc cat > /mnt/data/patch_remote_ssh_auth_retry.py <<'PY'
    original_mode = path.stat().st_mode
    fd, temporary_name = tempfile.mkstemp(prefix=f".{path.name}.", dir=path.parent)
    temporary_path = Path(temporary_name)
    try:
        with os.fdopen(fd, "w", encoding="utf-8", newline="") as stream:
            stream.write(text)
        os.chmod(temporary_path, original_mode)
        os.replace(temporary_path, path)
    finally:
        if temporary_path.exists():
            temporary_path.unlink()


def parse_package_json(text: str) -> dict[str, object]:
    """Decode extension metadata and verify that it is a JSON object.

    Args:
        text: Raw package.json contents.

    Returns:
        Parsed package metadata.
    """
    value = json.loads(text)
    if not isinstance(value, dict):
        raise PatchError("package.json is not a JSON object")
    return value


def is_remote_ssh_package(metadata: dict[str, object]) -> bool:
    """Determine whether package metadata describes Microsoft's Remote-SSH extension.

    Args:
        metadata: Parsed package.json object.

    Returns:
        True only for `ms-vscode-remote.remote-ssh`.
    """
    publisher = metadata.get("publisher")
    name      = metadata.get("name")
    return publisher == "ms-vscode-remote" and name == "remote-ssh"


def version_key(version: object) -> tuple[int, ...]:
    """Convert a dotted Remote-SSH version into a numerically sortable tuple.

    Args:
        version: package.json version value.

    Returns:
        Numeric version components; non-numeric suffixes are ignored.
    """
    text = str(version)
    parts = tuple(int(match) for match in re.findall(r"\d+", text))
    return parts or (0,)


def validate_retry_settings(settings: RetrySettings) -> None:
    """Reject retry settings which would create an invalid or abusive loop.

    Args:
        settings: User-selected retry limits and delay bounds.
    """
    if settings.max_retries < 0:
        raise PatchError("--max-retries must be >= 0")
    if settings.min_delay_ms < 0:
        raise PatchError("--min-delay-ms must be >= 0")
    if settings.max_delay_ms < settings.min_delay_ms:
        raise PatchError("--max-delay-ms must be >= --min-delay-ms")


def make_retry_expression(match: re.Match[str], settings: RetrySettings) -> str:
    """Build the minified JavaScript replacement for one resolver call.

    Args:
        match: Unique resolver-call match in the bundled extension JavaScript.
        settings: Retry limits and randomized backoff bounds to embed.

    Returns:
        JavaScript expression replacing the original one-shot resolve call.
    """
    result    = match.group("result")
    resolver  = match.group("resolver")
    options   = match.group("options")
    authority = match.group("authority")
    install   = match.group("install")
    max_retry = settings.max_retries
    min_delay = settings.min_delay_ms
    max_delay = settings.max_delay_ms
    assert result and resolver and options and authority and install
    return (
        f'{result}=await(async()=>{{let __rsar_count=0;for(;;){{try{{return await(0,{resolver}.resolve)'
        f'({options},{authority},this.extensionContext,this.disposables)}}catch(__rsar_error){{'
        f'const __rsar_message=String(__rsar_error?.message??__rsar_error);'
        f'if(!__rsar_message.includes("AuthChallengeBadToken"))throw __rsar_error;'
        f'__rsar_count++;if({max_retry}>0&&__rsar_count>{max_retry})throw __rsar_error;'
        f'const __rsar_cap=Math.min({max_delay},{min_delay}*Math.pow(2,Math.min(__rsar_count,5)));'
        f'const __rsar_delay={min_delay}+Math.floor(Math.random()*Math.max(1,__rsar_cap-{min_delay}+1));'
        f'this.logger.warn("{PATCH_MARKER} AuthChallengeBadToken for "+{authority}+"; retry "+__rsar_count+'
        f'" in "+__rsar_delay+"ms");await new Promise(__rsar_done=>setTimeout(__rsar_done,__rsar_delay))}}}}}})(),'
        f'{install}={result}.serverInstallationResult;'
usage: patch_remote_ssh_auth_retry.py [-h] [-o OUTPUT]
                                      [--max-retries MAX_RETRIES]
                                      [--min-delay-ms MIN_DELAY_MS]
                                      [--max-delay-ms MAX_DELAY_MS]
                                      [--no-log-race-fix] [--no-backup]
                                      [--check]
                                      [target]

Patch VS Code Remote-SSH to survive concurrent exec-server auth-token races.

The Remote-SSH 0.124.0 and 0.125.2026081318 Unix exec-server bootstrap uses
one shared log path, `.cli.${COMMIT_ID}.log`, for every concurrent connection.
Each bootstrap has a different auth token, so one window can read another
window's `Listening on ...` address and then authenticate to that server with
its own token, producing `CodeError(AuthChallengeBadToken)`.

This patcher:

1. Makes the Unix exec-server bootstrap log path process-specific, eliminating
   the observed shared-log race.
2. Wraps the top-level Remote-SSH resolve operation in a retry loop which catches
   only errors containing `AuthChallengeBadToken`. Each retry reruns the complete
   resolver/bootstrap path, which obtains a fresh matching server/token pair.

It accepts an installed extension directory, `out/extension.js`, a parent
extensions directory, or a .zip/.vsix archive. With no TARGET it discovers the
newest Remote-SSH installation in the usual VS Code extension directories.

positional arguments:
  target                extension directory, out/extension.js, parent
                        extensions directory, .zip, or .vsix; omit to auto-
                        discover

options:
  -h, --help            show this help message and exit
  -o, --output OUTPUT   output archive path; archives default to *.auth-retry-
                        patched.zip/.vsix
  --max-retries MAX_RETRIES
                        AuthChallengeBadToken retries after the first failure;
                        0 = unlimited (default: 0)
  --min-delay-ms MIN_DELAY_MS
                        minimum retry delay in milliseconds (default: 200)
  --max-delay-ms MAX_DELAY_MS
                        maximum retry backoff cap in milliseconds (default:
                        2000)
  --no-log-race-fix     inject only the retry loop; do not make the Unix exec-
                        server logfile process-specific
  --no-backup           for extracted installs, do not create adjacent .bak
                        files
  --check               validate and report what would change without writing
                        anything

Fixing the race
I’m identifying the shared Unix logfile as the likely cause: concurrent startups can pair one window’s token with another’s server. I’m preparing a newer-version-compatible patcher that prevents this mismatch rather than merely retrying failures.
Testing SSH authentication patcher script
Python
bash -lc set -e
ls -l /mnt/data/patch_remote_ssh_auth_retry.py
python3 -m py_compile /mnt/data/patch_remote_ssh_auth_retry.py
python3 /mnt/data/patch_remote_ssh_auth_retry.py --help | head -80
python3 /mnt/data/patch_remote_ssh_auth_retry.py /mnt/data/ms-vscode-remote.remote-ssh-0.125.2026081318.zip --check
Worked for 5m 9s
Done