fix(ssh): double-quote ProxyCommand values for open-remote-ssh

[EhabY]

Closes #1153

What's fixed

1.17.0 broke SSH connections from editors that use the open source Remote - SSH extension (open-remote-ssh), such as Positron and VSCodium. That extension splits the ProxyCommand itself instead of running it through a shell, so it parsed our line differently than OpenSSH does:

• Single quotes: --url and --global-config were single-quoted. Positron passed the quotes to the CLI literally ('https://…'), and the CLI exited ("Premature close").
• --token=: ssh-config@5 treats an unquoted = as a separator, so --token= --global-config reached the CLI as --token=--global-config.
• Header commands: coder.headerCommand never worked with open-remote-ssh because it was always single-quoted.
• Windows: a header command containing " was split into several arguments. escapeShellArg wrote " as "", but the Go CLI parses \".

How

• escapeProxyCommandArg uses double quotes unless the value contains $, a backtick, \, % or a line break, which aren't literal inside double quotes. Those values keep the 1.17.0 single quotes, so nothing becomes less literal. The deployment URL can never contain these characters (validateDeploymentUrl).
• escapeCommandArg quotes a leading, trailing or doubled =.
• On Windows, escapeShellArg writes \" and doubles the backslashes before it (the standard Windows argument rule).

Tests pin the exact quoting. One native test runs a real ProxyCommand through sh -c on Unix and the Windows argument parser on Windows, so CI checks each platform. I also checked lines by hand against real OpenSSH (sh/bash/dash), Positron's @jeanp413/ssh-config@4.3.1, and upstream's ssh-config@5.3.0 + splitProxyCommand.

Not fixed here (upstream)

• Windows paths: open-remote-ssh v0.4.0 (the current Open VSX release) strips every \ from Windows paths (C:UsersJohn Doe…). Already fixed upstream in fix(windows): skip backslash escape in ProxyCommand tokenizer on Windows jeanp413/open-remote-ssh#342, which ships in 0.4.1.
• Paths with spaces: the 0.4.1 betas run the split arguments through a shell, which breaks any path containing a space: Regression in 0.4.1-beta: ProxyCommand arguments are re-split by a shell (shell: true) jeanp413/open-remote-ssh#377.
• Header commands with special characters: a header command containing $, a backtick, \ or % still needs an extension that runs ssh (for example Microsoft Remote-SSH).

---

Generated by Coder Agents on behalf of @EhabY.

[linear-code]

VSC-36

[Lisa-Fiander]

👍