This release fixes workspaces that appeared to lose their history after updating to v1.16.1: Cursor chats, window layout, and other per-workspace data seemed to vanish. It also fixes Cursor devcontainers failing to connect.

Get your chats and layout back

If a workspace lost its chats or layout after v1.16.1:

1. Update the extension to v1.16.2.
2. Open File > Open Recent. Your workspace appears twice.
3. Pick the entry that starts with coder-vscode. That is the old address, and it holds your chats and layout. Skip the entry that starts with coder-cursor.

This is a one-time step. From then on, the workspace stays on the old address and your history stays with it.

What changed

A workspace now keeps the SSH host it was last opened on, wherever you open it from: the Coder panel, a dashboard or devcontainer link, or File > Open Recent, and whether it opens as a folder or as a multi-root workspace. Only a workspace you have never opened gets your editor's own host. (#1092, fixes #1094)

Other fixes

• Cursor devcontainers connect again. Opening a devcontainer could fail to connect in v1.16.1. Devcontainers now open over the same host as the rest of the workspace. (#1092)
• No more duplicate entries in Open Recent. A workspace listed on both hosts was two identical lines in editors that hide the host name. The shared coder-vscode host is now marked (legacy), and the folder picker lists each folder once. (#1092)
• Support bundles look in the right place. A support bundle for a workspace you are not connected to now looks for remote logs under the host that workspace opens on, so a remote.SSH.serverInstallPath set for the shared host is no longer missed. (#1092)
• Each editor connects with its own CLI and login. With the same workspace open in two editors, v1.16.1 could silently connect one editor with the other's Coder CLI and credentials. (#1092)

Full changelog: v1.16.1...v1.16.2

This release moves workspace SSH hosts out of your SSH config and into generated files the extension fully owns, so your global SSH options and other editors can no longer interfere with how Coder connects. It also deprecates the Tasks panel, ties everything a session does to one searchable ID, and logs workspace and agent state changes as they happen.

Highlights

Fully Isolated SSH Configuration

Workspace SSH hosts are now written to generated files under your platform's data directory (coder.coder-remote/ssh) instead of into your SSH config. Your config carries only an include of that directory, which moves back to the top on every connection. Because ssh uses the first value it finds for each option, global options in your config, such as a catch-all Host *, no longer change how the extension connects. To override the generated options, set them in coder.sshConfig, which still takes precedence. (#1061)

The extension generates one file per editor and deployment, all behind the same include, so VS Code, Cursor, Windsurf, and other forks no longer overwrite one another's workspace hosts. Each fork keeps its own SSH host prefix, and legacy coder-vscode authorities are migrated by automatically reopening the window once.

The new layout also means:

• "Unexpected SSH Config Option" is gone. The include sits at the top of your config, so the generated options always take effect and there is nothing left to warn about. Validation of the options your deployment sends is unchanged.
• You can see exactly what was generated. The new Coder: Open Generated SSH Configuration File command opens this editor's generated workspace hosts file in a read-only editor. A connected window opens its own deployment's file; a local window asks which deployment to open when there are several.

Tasks Panel Deprecated

Improvements

• One ID ties a session together. Every line in the Coder output channel is prefixed with a per-session ID, and that same ID is sent to your deployment and to the coder CLI. Searching for it in the logs or a support bundle picks out everything one session did, even when several windows are connected at once. (#1073, #1074)
• Workspace state changes leave a trail. Workspace, agent, and lifecycle status changes are logged as they happen, including agents that disappear. A slow or failed connection now leaves a record of what the workspace and its agents were doing at the time, instead of only the error at the end. (#1075)

Bug Fixes

• The SSH config file setting is ignored on Antigravity and Windsurf/Devin. These editors launch ssh without pointing it at a config file, so it always reads ~/.ssh/config, and honoring the setting wrote the workspace host where the connection never looked. (#1061)
• Malformed responses are reported at the source. A malformed response from your deployment or proxy now raises an error naming the endpoint that sent it, instead of an unrelated crash later on. Waiting on a workspace build now fails on a bad response rather than hanging forever. (#1071)
• Stale download progress is cleaned up. Other windows waiting on the same CLI download no longer show stale progress. (#1082)

New Contributors

• @aqandrew made their first contribution with per-session ID logging (#1073)

Full changelog: v1.16.0...v1.16.1

This release fixes a critical security issue in how the extension writes SSH configuration and trusts vscode:// deep links, and we recommend everyone update. It also adds deployment announcements to the status bar, makes support bundles more complete and more transparent, speeds up the Shared Workspaces view, and tightens credential handling and log hygiene.

🔒 Security

SSH Config Hardening and Deep Link Trust

Fixes GHSA-5jhf-4v56-p5c8: a malicious Coder deployment, or a crafted vscode:// deep link pointing at one, could smuggle arbitrary directives such as ProxyCommand into the SSH config block the extension manages, which amounts to arbitrary code execution on your machine.

The extension now:

• Rejects dangerous SSH options from the deployment. Options that run code or change how Coder connects (ProxyCommand, LocalCommand, RemoteCommand, Include, ProxyJump, Match, and others) are denied, mirroring the server's own validation of --ssh-config-options. Malformed options with embedded newlines are rejected outright, and every key, value, and hostname is re-validated when the config is written, so no call path can skip the check. Options you set yourself, in the coder.sshConfig setting or via coder config-ssh --ssh-option, stay allowed because your value takes precedence over the deployment's.
• Verifies the written config the way OpenSSH reads it. The post-write safety check now treats option names case-insensitively and takes the first value, matching OpenSSH semantics, so a proxycommand or duplicate directive can no longer slip past it. All problems are reported in a single dialog stating the actual and expected values.
• Asks before trusting unknown deployments. A deep link to a deployment you never logged in to now shows a "Trust and Continue" confirmation naming the workspace it opens, and a token in a link only signs you in or switches accounts after an explicit confirmation naming the accounts involved. A link normally shows at most one prompt, and a link that signs the same user in to the same deployment stays silent.
• Keeps your session token at home. The stored session is only ever sent to the origin it was created for, so a lookalike origin sharing the hostname cannot receive it.

_{The trust prompt shown when a deep link points at a deployment you have not logged in to}

Highlights

Deployment Announcements

Active deployment announcements now show up in a megaphone status bar item, with a popup for announcements you haven't seen yet. Notifications respect coder.disableNotifications; when suppressed, the status bar item is highlighted instead. The new Coder: View Announcements command opens the full messages in a markdown preview. (#1018)

The popup shown when a deployment has announcements you haven't seen yet

The megaphone status bar item with the number of active announcements

Better Support Bundles

Coder: Create Support Bundle now collects the remote editor's server logs from the workspace alongside the local extension and SSH logs, so one bundle tells the whole story, including the half that used to require shelling into the workspace (requires a Coder 2.36.0+ deployment). And before anything is gathered, the extension asks for confirmation with a summary of exactly what the bundle will contain. (#1042, #1054)

Improvements

• Shared Workspaces loads faster. The view now filters with the server-side shared_with_user query instead of fetching shared:true results and filtering on the client, so fewer workspaces are fetched. Deployments too old to support the filter show a message explaining why instead of an empty list. (#1026)
• Logout you can trust. Logging out now revokes the OAuth tokens at the server and warns you when locally stored credentials could not be fully removed, instead of showing a success message regardless. (#1054)
• Cleaner logs. More sensitive data is redacted from HTTP logs: authorization and cookie headers regardless of casing, OAuth credential fields in request and response bodies, and any header produced by coder.headerCommand. Shell command output no longer appears in logs or error messages. (#1054)

Bug Fixes

• SSH config lands where your editor looks. Windsurf/Devin and Antigravity renamed the remote.SSH settings section, so a custom config file set as remote.devinSSH.configFile, remote.windsurfSSH.configFile, or remote.antigravitySSH.configFile was ignored and the workspace host was written to ~/.ssh/config, where those editors never looked. The extension now reads the active Remote-SSH extension's own settings section. (#1060)
• Hung requests time out. REST requests get a 60-second default timeout, so a request stuck on a half-open TCP connection no longer stalls pollers forever. (#1025)
• Settings stick in remote windows. coder.binarySource, coder.headerCommand, the TLS file settings, and other machine-only settings moved from machine to application scope, fixing values reverting to their defaults in a remote window while still keeping workspace/folder settings.json from overriding them. (#1034)
• Wrong-deployment logins are skipped. A saved login that points at a different deployment than the one it was saved for is no longer used, and migrating file-based credentials with such a mismatch warns instead of failing the connection. (#1059)
• Legacy credentials are cleaned up. File-based credentials are deleted after migration to secret storage, instead of leaving plaintext copies behind. (#1054)

Full changelog: v1.15.2...v1.16.0

Am I affected?

You're affected only if all of the following are true:

• http.proxySupport is set to off, and
• you set one or more of http.proxy, http.noProxy, or coder.proxyBypass, and
• you relied on those settings applying to Coder API requests.

How to keep your old behavior

Either set "http.proxySupport": "on" to keep using VS Code's settings, or move
the values into proxy environment variables:

export HTTP_PROXY="<http.proxy>" HTTPS_PROXY="<http.proxy>"
export NO_PROXY="<http.noProxy and/or coder.proxyBypass>"

🐛 Fixed

• Honor http.proxySupport: off when deriving proxy settings for SSH and API connections, so VS Code's proxy settings are ignored while inherited proxy environment variables still apply. (#1019)

Full Changelog: v1.15.1...v1.15.2

A patch release that adds a Network Check command for diagnosing connectivity straight from the command palette, lets the extension share login state with the terminal coder CLI, and routes file-based credentials through coder login/logout. Workspace opens now log more diagnostics, and VS Code's proxy settings finally reach the coder ssh ProxyCommand.

Highlights

Network Check Command

A new Coder: Network Check command runs coder netcheck from the command palette or the My Workspaces view menu. The report opens in a panel with an overall health banner, any warnings, a connectivity summary (UDP, IPv4/IPv6, NAT mapping, hairpinning, port mapping), per-region DERP/STUN results with latencies, and local interfaces. A View JSON action exposes the raw output. When a slow connection is detected, the network status bar tooltip also links to the network check alongside the latency test, for a deployment-wide view of the network path. (#1002)

Shared Login With the Terminal CLI

Set --global-config=<dir> in coder.globalFlags to share login with the terminal coder CLI: the extension reads file-based CLI credentials from that directory, so logging in once works in both places. Requires a deployment on 2.31.0+. (#1011)

Improvements

Credentials Through coder login/logout

File-based credentials are now written and cleared through coder login and coder logout rather than by the extension directly. The minimum supported Coder version is now v0.25.0. (#1011)

More Diagnostic Logging on Workspace Opens

Workspace opens and coder:// URI handling now log more diagnostics (target workspace, agent, and handoff) to make failed opens easier to trace. URI parameter values, including tokens, are never logged. (#1015)

Bug Fixes

• Proxy settings now reach SSH. VS Code's proxy settings (http.proxy, http.noProxy, and coder.proxyBypass) are propagated to the SSH environment as HTTP_PROXY/HTTPS_PROXY/NO_PROXY, so the coder ssh ProxyCommand connects through the configured proxy whether SSH runs as a child process or in a terminal. (#1012)

Full changelog: v1.15.0...v1.15.1

This release adds a Shared Workspaces view to the sidebar, introduces local-only telemetry that makes diagnosing extension issues dramatically easier (complete with an export command and beefed-up support bundles), and irons out the rough edges around workspace updates. There's also a new setting for deployments where the API and the web UI live on different URLs.

Highlights

Shared Workspaces View

A new Shared Workspaces view in the Coder sidebar lists workspaces other users have shared with you, alongside My Workspaces and All Workspaces. Search and refresh actions are built in, so finding and opening a teammate's workspace works just like opening your own. (#991)

Local Telemetry for Faster Diagnostics

The extension now records structured telemetry about its own operation: locally, on your machine, and nowhere else. Nothing is ever sent anywhere, payloads are bounded, and raw workspace names, paths, queries, and command output are never recorded. When something goes wrong, the data to explain it is already on disk. (#919, #934, #942, #943, #946, #962, #963, #993, #994, #995)

Coverage spans the full lifecycle: activation, command invocations, auth and deployment recovery, CLI download and verification, every phase of remote setup, SSH and WebSocket connection health, workspace state transitions, and per-route HTTP rollups. Every event, property, and measurement is documented in EVENTS.md.

• Configure via coder.telemetry.level (local by default, off to disable)
• Tune retention and limits via coder.telemetry.local

Export Telemetry Anywhere

The new Coder: Export Telemetry command writes recorded telemetry for a chosen date range to a file of your choice: either a plain JSON array for quick inspection, or an OTLP/JSON zip that drops straight into OpenTelemetry tooling (Collector pipelines, observability backends). Exports are globally time-sorted, and the OTLP zip includes a manifest.json summarizing the export. (#953, #960, #961, #990, #1003, #1004)

Support Bundles That Tell the Whole Story

Coder: Create Support Bundle now packs VS Code-side diagnostics into the bundle: a snapshot of your coder.* and remote.* settings (values that can hold secrets are masked), recent extension and SSH proxy logs across sessions, and the local telemetry files. One bundle is usually enough to diagnose an issue, with no back-and-forth asking for logs. (#971, #982)

Separate Web and API URLs

The new coder.alternativeWebUrl setting opens browser pages (dashboard, workspace pages, login) on a different URL than the one used for API, SSH, and CLI traffic. Useful when the API runs on a browser-restricted port (e.g. 7004) but the web UI is served on a standard one (e.g. 443). (#956)

Improvements

Direct CLI Spawning

The Coder CLI is now spawned directly instead of through a shell, so arguments reach the binary exactly as written. This eliminates an entire class of hand-rolled shell-escaping bugs (especially around cmd.exe on Windows) and closes a recurring command-injection risk when deployment-supplied values like workspace names or template parameters contained spaces, quotes, or shell metacharacters. (#949)

Variable Expansion in Path Settings

Path-like settings (coder.binaryDestination, the TLS file settings, coder.proxyLogDirectory) and items in coder.globalFlags now support ${env:VAR}, ${userHome}, and a leading ~. For --flag=value items in coder.globalFlags, expansion applies to the value half, so --cfg=~/coder works. (#949)

Bug Fixes

• Workspace updates no longer hang on required parameters. When a new template version requires parameters, the extension prompts for the missing values through VS Code input boxes and passes them to coder update so the CLI runs non-interactively. If the CLI still asks for input, the update fails fast and the workspace falls back to starting on its existing template version with a warning. (#945)
• Older CLIs get parameters too. Updating a workspace on a CLI older than 2.24 (which can't run coder update non-interactively) now passes newly-required template parameters into the REST API fallback build, instead of silently omitting them and letting the server reject the build. (#945)
• Stale parameter values are re-prompted. Updating a workspace now re-prompts for an option or multi-select parameter whose stored value is no longer offered by the new template version, instead of carrying the stale value forward and failing the build. Immutable parameters without a stored value are prompted as well, matching the web dashboard's behavior. (#967)
• IDN hostnames connect again. Workspaces on hostnames containing --, such as internationalized (IDN) domains with Punycode (xn--) labels, can now be opened from recent connections. The SSH authority parser previously split these names at the wrong separator and rejected the host as invalid. (#930, #944)

New Contributors

• @ibdafna made their first contribution with the coder.alternativeWebUrl setting (#956)
• @jakehwll made their first contribution with Storybook support for the extension's webviews (#932)

Full changelog: v1.14.6...v1.15.0

A patch release focused on security, compatibility, and auth resilience. Security-sensitive settings can no longer be overridden by a workspace's .vscode/settings.json, the extension installs on the latest Cursor stable again, and mTLS or coder.headerCommand users no longer have to log out and back in to recover from a misconfigured setting.

Highlights

Configuration Scope Hardening (SEC-200)

Security-sensitive settings are now marked so a malicious .vscode/settings.json cannot override them. VS Code itself drops workspace and folder values for these settings, closing a path where a workspace could redirect command execution, swap the CLI binary or its source, inject CLI/SSH flags, substitute TLS material, or override identity and credential-storage settings. (#965)

• "scope": "machine" (per-machine, never synced via Settings Sync) for path-, command-, and network-dependent settings: coder.binarySource, coder.binaryDestination, coder.headerCommand, coder.tlsCertFile, coder.tlsKeyFile, coder.tlsCaFile, coder.tlsAltHost, coder.tlsCertRefreshCommand, coder.proxyLogDirectory, coder.proxyBypass, coder.sshFlags, coder.globalFlags.
• "scope": "application" (synced across your machines but still not overridable per workspace) for user-wide preferences: coder.defaultUrl, coder.autologin, coder.useKeyring, coder.insecure, coder.disableSignatureVerification, coder.enableDownloads.

This follows VS Code's recommended scope semantics.

Cursor Compatibility Restored

Minimum supported VS Code is back down to 1.105 so the latest Cursor stable (which reports VS Code 1.105.1 to extensions) can install the extension again. engines.vscode is now ^1.105.0 and the CI integration matrix is pinned to 1.105.0. (#975)

mTLS & Header-Command Auth Now Self-Heals

A session suspended by an mTLS cert problem or a misbehaving coder.headerCommand used to stay suspended until you logged out and back in, even after you fixed the setting. That's gone. (#976)

• Suspended sessions auto-recover the moment auth settings become valid again. No logout/login round-trip needed.
• A 401 from a mid-flight settings change is retried silently under the new settings and a fresh header-command run, instead of escalating to an interactive prompt.
• Stale headers don't leak across retries. Keys from a previous header-command run are dropped before the retry.
• Config-change side-effects fire once after edits settle (200ms idle window), so saving the file character-by-character no longer triggers a burst of reload prompts and reconnects.

Several adjacent races also got tightened up:

• Logout, deployment switch, or extension dispose during an in-flight auth verify is no longer overwritten when the verify finishes, and no longer leaves stale deployment data in storage.
• Cross-window login keeps listening when the first token observed from another window is invalid, so a follow-up valid write still resolves the dialog.

Removed

Coder Chat (Experimental) Sidebar

The "Coder Chat (Experimental)" secondary sidebar and its agents experiment gate are gone. Deeplinks that still include chatId continue to open the workspace as before; the parameter is now silently ignored, so existing links keep working. (#975)

Full changelog: v1.14.5...v1.14.6

This release brings the CLI's diagnostics tools right into VS Code. Speed Test, Ping, and Support Bundle are now one click away. We've also added a heads-up when your network gets slow, made SSH connections way more resilient by default, and smoothed out the rough edges around workspace updates, build logs, and authentication.

Highlights

Coder Diagnostics: Speed Test, Ping & Support Bundle

Three new commands give you direct access to the CLI's diagnostics tools without ever leaving the editor. Pick a workspace from the command palette, or run them straight from the My Workspaces sidebar context menu on any running workspace.

• Coder: Speed Test Workspace runs coder speedtest and renders results in an interactive throughput chart with a real-time progress bar, hover tooltips, and a summary header. A View JSON action exposes the raw output. (#864, #875, #890)
• Coder: Ping Workspace runs coder ping in a dedicated terminal so you can watch live connectivity in real time. (#873)
• Coder: Create Support Bundle runs coder support bundle and saves a diagnostics zip ready to hand off to support. The bundle now also includes VS Code-side logs (Remote SSH extension, SSH proxy, and extension output channels), so triage is much faster. (#878, #916)

Speed Test	Ping

Proactive Network Slowness Warnings

Workspace latency is now a first-class signal in the status bar. When latency exceeds the configured threshold, the network indicator turns yellow and offers quick actions to run Coder: Ping Workspace or jump straight to the setting. Flaky connections will surface before they ruin your day. (#891)

• New coder.networkThreshold.latencyMs setting (default: 250ms)
• Set to 0 to disable the warning entirely

Status bar indicator	Hover for details

Smarter SSH Keepalives

Coder SSH connections now default to ServerAliveInterval=10 and ServerAliveCountMax=3. Sessions stay alive across NATs and firewalls, dead connections get noticed within about 30 seconds (instead of hanging silently for ages), and zombie SSH processes that used to linger on long-lived connections finally get cleaned up. (#885)

Multi-Window Workspace Handling

Trying to open a workspace that's already connected in another VS Code window? You now get a real choice. The extension prompts you to either Duplicate Window (which keeps your tabs and panels intact) or Open Without Folder. No more silently focusing the existing window with no way to view the same workspace twice. (#918)

Flexible Binary Destination

coder.binaryDestination now accepts a full file path (e.g. /usr/bin/coder) in addition to a directory. The extension checks the binary's version against the server and downloads a replacement when needed. When set to a directory, the simple name (coder / coder.exe) is tried as a fallback after the platform-specific name, so package-manager-installed CLIs just work without symlinking. (#879)

Improvements

More Reliable Workspace Updates

The Coder: Update Workspace flow now routes through the normal startup path for more consistent updates and restarts. Reconnecting to a stopped outdated workspace also offers a clear choice between Start or Update and Start. (#886)

Cleaner Build Logs

Workspace build logs now reliably appear in the Coder: Workspace Build output channel during startup. Reconnecting to an already-running workspace no longer creates the channel at all, so the Output panel doesn't pop open empty anymore. (#897, #920)

Smarter Outdated Notifications

Outdated workspace notifications now wait for setup to finish before appearing, so you won't get nagged about updating in the middle of an update. (#899)

Bug Fixes

• Speed Test, Ping, Create Support Bundle, and the app status terminal now refresh the stored credential file (or keyring on supported systems) before each invocation, so they no longer fail with a stale token after the session has been refreshed since the workspace was first opened. mTLS deployments continue to work with an empty token. (#926)
• CLI cancellation: Cancelling a long-running CLI command no longer surfaces as a misleading CLI failure. (#926)
• Safer binary cleanup: Cleanup of old or temp files in shared directories like /usr/bin is now scoped to the binary's own basename, so unrelated files in the same directory are left alone. (#879)

New Contributors

• @yazan-abu-obaideh made their first contribution with the initial implementation of the Speed Test command (#864)

Full changelog: v1.14.3...v1.14.5

Added

• coder.binaryDestination now accepts a full file path (e.g. /usr/bin/coder) in addition to a directory. The extension checks the binary's version against the server and downloads a replacement when needed. When set to a directory, the simple name (coder / coder.exe) is tried as a fallback after the platform-specific name, so package-manager-installed CLIs work without symlinking.
• New Coder: Speed Test Workspace command to run coder speedtest from the command palette or workspace sidebar. Choose a running workspace, optionally set the test duration, and open the JSON results directly in VS Code.
• New Coder: Ping Workspace command to run coder ping from the command palette or workspace sidebar, with live connectivity diagnostics in a terminal.
• New Coder: Create Support Bundle command to run coder support bundle from VS Code and save the resulting diagnostics zip for troubleshooting. Available when your deployment supports support bundles.
• Coder SSH connections now default to ServerAliveInterval=10 and ServerAliveCountMax=3, helping keep sessions alive through NATs and firewalls while detecting dead connections within about 30 seconds.
• New coder.networkThreshold.latencyMs setting (default: 250ms, set to 0 to disable) to warn when workspace latency stays high. The network status bar indicator turns yellow and offers quick actions to run Coder: Ping Workspace or open the setting.

Fixed

• Cleanup of old/temp files in shared directories like /usr/bin is now scoped to the binary's own basename, preventing accidental removal of unrelated files.
• The Coder: Update Workspace flow now goes through the normal startup path for more reliable updates and restarts, and reconnecting to a stopped outdated workspace now offers Start or Update and Start.
• Outdated workspace notifications are now deferred until setup completes, so they no longer appear during an in-progress update.
• Workspace build logs now reliably appear in the Coder: Workspace Build output channel during startup.