Fix Windows backslash paths being mangled when adding an SSH target

[sean-mcmanus]

Found and fixed using Copilot with Claude Opus 4.8 in VS Code.

Problem

When adding an SSH target via "C/C++: Add SSH Target" (or anywhere sshCommandToConfig runs), the user-entered SSH connection command is tokenized with shell-quote's parse(). On Windows, parse() treats \ as a POSIX escape character and strips it, so any backslash path in the command is corrupted:

Input:  ssh -i C:\Users\me\.ssh\id_rsa user@host
Tokens: ["ssh", "-i", "C:Usersme.sshid_rsa", "user@host"]

The resulting SSH config entry gets a broken IdentityFile (and the same corruption applies to any other path-bearing argument, e.g. a config file or control path). The connection then fails because the key file path no longer exists.

Root cause

shell-quote's parse() follows POSIX shell rules, where \ escapes the next character. Windows paths use \ as the directory separator, so C:\Users\me is read as the escape sequences \U, \m, etc., and the backslashes are consumed. parse() is the wrong tool for splitting an SSH command into arguments: it treats \ as an escape regardless of platform.

Fix

Replace shell-quote's parse() with a small, self-contained tokenizer (splitArgs in sshCommandToConfig.ts) that behaves consistently on every platform: single and double quotes group their contents and are stripped, and unquoted whitespace separates arguments. Outside of quotes, a backslash escapes only a following whitespace character (so a Unix path like /home/me/my\ key keeps its space), but before any other character it stays literal (so Windows paths like C:\Users\me\key are preserved). This keeps the cross-platform behavior the original parse()-based code had, minus the bug where every backslash was treated as an escape.

This replaces the entire parse(...) call:

const parts: string[] = splitArgs(command);

The unused shell-quote and isWindows imports were removed from sshCommandToConfig.ts. This was the last parse() consumer, and the only other consumer (quote() in settings.ts) was replaced with an equivalent string, so shell-quote is removed entirely: dropped from package.json, yarn.lock, and ThirdPartyNotices.txt.

Alternatives considered

Doubling every \ before calling parse() over-escapes backslashes inside single-quoted segments (which shell-quote preserves literally), turning 'C:\Users\me\key' into C:\\Users\\me\\key. Reusing the shared extractArgs helper does not work either: on Windows it implements cmd-style parsing where single quotes are literal, so ssh -i 'C:\Users\me\key' would keep the surrounding quotes in IdentityFile (and split on spaces inside single-quoted paths). A dedicated tokenizer avoids both problems.

Validation

Covered by new unit tests in test/unit/sshCommandToConfig.test.ts (splitArgs tokenization plus end-to-end sshCommandToConfig IdentityFile parsing):

• ssh -i C:\Users\me\key.pem user@host -> path preserved as C:\Users\me\key.pem
• ssh -i "C:\Program Files\me\key.pem" user@host -> quoted path with a space preserved
• ssh -i 'C:\Users\me\key' user@host -> single quotes stripped, path preserved
• ssh -i /home/me/key\ with\ spaces user@host -> backslash-escaped spaces kept
• "C:\Program Files\" next -> quoted trailing backslash stays literal, not joined to the next arg
• \\server\share -> UNC path keeps both leading backslashes
• ssh hello@microsoft.com -A -> unchanged (no paths)
• ssh -i /home/me/.ssh/id_rsa user@host -> unchanged (forward slashes)

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated no new comments.