fix: specify --header-command when running coder start (#526)

Author: aslilac

CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+### Fixed
+
+- Use `--header-command` properly when starting a workspace.
+
 ## [v1.9.1](https://github.com/coder/vscode-coder/releases/tag/v1.9.1) 2025-05-27
 
 ### Fixed

src/api.ts

@@ -12,6 +12,7 @@ import * as vscode from "vscode";
 import * as ws from "ws";
 import { errToStr } from "./api-helper";
 import { CertificateError } from "./error";
+import { getHeaderArgs } from "./headers";
 import { getProxyForUrl } from "./proxy";
 import { Storage } from "./storage";
 import { expandPath } from "./util";
@@ -185,6 +186,7 @@ export async function startWorkspaceIfStoppedOrFailed(
     const startArgs = [
       "--global-config",
       globalConfigDir,
+      ...getHeaderArgs(vscode.workspace.getConfiguration()),
       "start",
       "--yes",
       workspace.owner_name + "/" + workspace.name,

src/headers.ts

@@ -1,7 +1,8 @@
 import * as cp from "child_process";
+import * as os from "os";
 import * as util from "util";
-
-import { WorkspaceConfiguration } from "vscode";
+import type { WorkspaceConfiguration } from "vscode";
+import { escapeCommandArg } from "./util";
 
 export interface Logger {
   writeToCoderOutputChannel(message: string): void;
@@ -28,6 +29,23 @@ export function getHeaderCommand(
   return cmd;
 }
 
+export function getHeaderArgs(config: WorkspaceConfiguration): string[] {
+  // Escape a command line to be executed by the Coder binary, so ssh doesn't substitute variables.
+  const escapeSubcommand: (str: string) => string =
+    os.platform() === "win32"
+      ? // On Windows variables are %VAR%, and we need to use double quotes.
+        (str) => escapeCommandArg(str).replace(/%/g, "%%")
+      : // On *nix we can use single quotes to escape $VARS.
+        // Note single quotes cannot be escaped inside single quotes.
+        (str) => `'${str.replace(/'/g, "'\\''")}'`;
+
+  const command = getHeaderCommand(config);
+  if (!command) {
+    return [];
+  }
+  return ["--header-command", escapeSubcommand(command)];
+}
+
 // TODO: getHeaders might make more sense to directly implement on Storage
 // but it is difficult to test Storage right now since we use vitest instead of
 // the standard extension testing framework which would give us access to vscode

src/remote.ts

@@ -20,13 +20,14 @@ import { extractAgents } from "./api-helper";
 import * as cli from "./cliManager";
 import { Commands } from "./commands";
 import { featureSetForVersion, FeatureSet } from "./featureSet";
-import { getHeaderCommand } from "./headers";
+import { getHeaderArgs } from "./headers";
 import { Inbox } from "./inbox";
 import { SSHConfig, SSHValues, mergeSSHConfigValues } from "./sshConfig";
 import { computeSSHProperties, sshSupportsSetEnv } from "./sshSupport";
 import { Storage } from "./storage";
 import {
   AuthorityPrefix,
+  escapeCommandArg,
   expandPath,
   findPort,
   parseRemoteAuthority,
@@ -758,34 +759,21 @@ export class Remote {
     const sshConfig = new SSHConfig(sshConfigFile);
     await sshConfig.load();
 
-    const escape = (str: string): string => `"${str.replace(/"/g, '\\"')}"`;
-    // Escape a command line to be executed by the Coder binary, so ssh doesn't substitute variables.
-    const escapeSubcommand: (str: string) => string =
-      os.platform() === "win32"
-        ? // On Windows variables are %VAR%, and we need to use double quotes.
-          (str) => escape(str).replace(/%/g, "%%")
-        : // On *nix we can use single quotes to escape $VARS.
-          // Note single quotes cannot be escaped inside single quotes.
-          (str) => `'${str.replace(/'/g, "'\\''")}'`;
-
-    // Add headers from the header command.
-    let headerArg = "";
-    const headerCommand = getHeaderCommand(vscode.workspace.getConfiguration());
-    if (typeof headerCommand === "string" && headerCommand.trim().length > 0) {
-      headerArg = ` --header-command ${escapeSubcommand(headerCommand)}`;
-    }
+    const headerArgs = getHeaderArgs(vscode.workspace.getConfiguration());
+    const headerArgList =
+      headerArgs.length > 0 ? ` ${headerArgs.join(" ")}` : "";
 
     const hostPrefix = label
       ? `${AuthorityPrefix}.${label}--`
       : `${AuthorityPrefix}--`;
 
     const proxyCommand = featureSet.wildcardSSH
-      ? `${escape(binaryPath)}${headerArg} --global-config ${escape(
+      ? `${escapeCommandArg(binaryPath)}${headerArgList} --global-config ${escapeCommandArg(
           path.dirname(this.storage.getSessionTokenPath(label)),
-        )} ssh --stdio --usage-app=vscode --disable-autostart --network-info-dir ${escape(this.storage.getNetworkInfoPath())}${await this.formatLogArg(logDir)} --ssh-host-prefix ${hostPrefix} %h`
-      : `${escape(binaryPath)}${headerArg} vscodessh --network-info-dir ${escape(
+        )} ssh --stdio --usage-app=vscode --disable-autostart --network-info-dir ${escapeCommandArg(this.storage.getNetworkInfoPath())}${await this.formatLogArg(logDir)} --ssh-host-prefix ${hostPrefix} %h`
+      : `${escapeCommandArg(binaryPath)}${headerArgList} vscodessh --network-info-dir ${escapeCommandArg(
           this.storage.getNetworkInfoPath(),
-        )}${await this.formatLogArg(logDir)} --session-token-file ${escape(this.storage.getSessionTokenPath(label))} --url-file ${escape(
+        )}${await this.formatLogArg(logDir)} --session-token-file ${escapeCommandArg(this.storage.getSessionTokenPath(label))} --url-file ${escapeCommandArg(
           this.storage.getUrlPath(label),
         )} %h`;
 

src/util.ts

@@ -143,3 +143,7 @@ export function countSubstring(needle: string, haystack: string): number {
   }
   return count;
 }
+
+export function escapeCommandArg(arg: string): string {
+  return `"${arg.replace(/"/g, '\\"')}"`;
+}