Address review comments

Author: EhabY

CHANGELOG.md

@@ -7,6 +7,8 @@
 - Proxy log directory now defaults to the extension's global storage when `coder.proxyLogDirectory`
   is not set, so SSH connection logs are always captured without manual configuration. Also respects
   the `CODER_SSH_LOG_DIR` environment variable as a fallback.
+- SSH options from `coder config-ssh --ssh-option` are now applied to VS Code connections,
+  with priority order: VS Code setting > `coder config-ssh` options > deployment config.
 
 ## [v1.14.0-pre](https://github.com/coder/vscode-coder/releases/tag/v1.14.0-pre) 2026-03-06
 

src/remote/remote.ts

@@ -832,17 +832,17 @@ export class Remote {
 		const sshConfig = new SSHConfig(sshConfigFile);
 		await sshConfig.load();
 
-		// Merge SSH config from three sources (lowest to highest priority):
-		// 1. coder config-ssh --ssh-option flags from the CLI block
-		// 2. Deployment SSH config from the coderd API
-		// 3. User's VS Code coder.sshConfig setting
+		// Merge SSH config from three sources (highest to lowest priority):
+		// 1. User's VS Code coder.sshConfig setting
+		// 2. coder config-ssh --ssh-option flags from the CLI block
+		// 3. Deployment SSH config from the coderd API
 		const configSshOptions = parseCoderSshOptions(sshConfig.getRaw());
 		const userConfigSsh = vscode.workspace
 			.getConfiguration("coder")
 			.get<string[]>("sshConfig", []);
 		const userConfig = parseSshConfig(userConfigSsh);
 		const sshConfigOverrides = mergeSshConfigValues(
-			mergeSshConfigValues(configSshOptions, deploymentSSHConfig),
+			mergeSshConfigValues(deploymentSSHConfig, configSshOptions),
 			userConfig,
 		);
 

src/remote/sshSupport.ts

@@ -1,5 +1,9 @@
 import * as childProcess from "child_process";
 
+// Matches the OpenSSH version number from `ssh -V` output.
+// [^,]* prevents greedy matching across comma-separated components
+const openSSHVersionRegex = /OpenSSH[^,]*_([\d.]+)/;
+
 /** Check if the local SSH installation supports the `SetEnv` directive. */
 export function sshSupportsSetEnv(): boolean {
 	try {
@@ -17,7 +21,7 @@ export function sshSupportsSetEnv(): boolean {
  * Requires OpenSSH 7.8 or later.
  */
 export function sshVersionSupportsSetEnv(sshVersionString: string): boolean {
-	const match = /OpenSSH.*_([\d.]+)[^,]*/.exec(sshVersionString);
+	const match = openSSHVersionRegex.exec(sshVersionString);
 	if (match?.[1]) {
 		const installedVersion = match[1];
 		const parts = installedVersion.split(".");

test/unit/remote/sshSupport.test.ts

@@ -10,6 +10,8 @@ const supports = {
 	"OpenSSH_8.9p1 Ubuntu-3ubuntu0.1, OpenSSL 3.0.2 15 Mar 2022": true,
 	"OpenSSH_for_Windows_8.1p1, LibreSSL 3.0.2": true,
 	"OpenSSH_9.0p1, LibreSSL 3.3.6": true,
+	// Version extracted from OpenSSH, not from LibreSSL after the comma
+	"OpenSSH_7.4p1, LibreSSL_8.1.0": false,
 	"OpenSSH_7.6p1 Ubuntu-4ubuntu0.7, OpenSSL 1.0.2n 7 Dec 2017": false,
 	"OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017": false,
 };