Can't list workspaces on Mac; ssh config file permission denied

[lucas-varela]

Environment

• macOS Tahoe 26.2 (25C56)
• Toolbox v3.6.2.85969, arm64
• Coder Plugin v0.9.1
• Passing a certificate file in "TLS CA path", all other settings at their default values

Summary

After enabling the plugin on a Mac and connecting to a Coder instance, toolbox correctly displays the instance, but the workspace list never loads. Logs show that there's a permission problem reading ~/.ssh/config. The plugin keeps trying to connect indefinitely, always crashing with the same error.

My SSH config file permissions are set to 400, which is correct and I believe changing this should not be an acceptable solution.

As a side note, I can connect to the same instance using a Windows PC just fine using the same plugin version and in the same network, so it's possibly a Mac/Linux problem. Running coder list in the terminal works fine too, so the problem is limited to the Toolbox plugin.

Stack trace

These lines are logged in a loop as long as the Toolbox app is open and the plugin is enabled.

3.6.2.85969 77885 2026-07-16 10:49:16.806 INFO  Dispatcher-worker-29 CoderRemoteProvider            Plugin com.coder.toolbox > Workspaces have changed, reconfiguring CLI: [CoderRemoteEnvironment(name='redacted')]
3.6.2.85969 77885 2026-07-16 10:49:16.847 INFO  Dispatcher-worker-29 CoderCLIManager                Plugin com.coder.toolbox > `/Users/redacted/Library/Application Support/coder-toolbox/coder.ursal.internal/coder-darwin-arm64 version --output json`: {
  "version": "v2.35.2+5c2838a",
  "build_time": "2026-07-14T07:10:48Z",
  "external_url": "https://github.com/coder/coder/commit/5c2838a7fb93874eed2d4ab8e6b6676ae4a237ce",
  "slim": true,
  "agpl": false,
  "boring_crypto": false
}

3.6.2.85969 77885 2026-07-16 10:49:16.848 INFO  Dispatcher-worker-29 CoderCLIManager                Plugin com.coder.toolbox > Configuring SSH config at /Users/redacted/.ssh/config
3.6.2.85969 77885 2026-07-16 10:49:16.848 INFO  Dispatcher-worker-29 CoderCLIManager                Plugin com.coder.toolbox > Appending config block
3.6.2.85969 77885 2026-07-16 10:49:16.849 ERROR Dispatcher-worker-29 CoderRemoteProvider            Plugin com.coder.toolbox > workspace polling error encountered: java.io.FileNotFoundException: /Users/redacted/.ssh/config (Permission denied)
	at java.base/java.io.IoOverNioFileSystem.convertNioToIoExceptionInStreams(Unknown Source)
	at java.base/java.io.IoOverNioFileSystem.initializeStreamsUsingNio0(Unknown Source)
	at java.base/java.io.IoOverNioFileSystem.initializeStreamUsingNio(Unknown Source)
	at java.base/java.io.FileOutputStream.<init>(Unknown Source)
	at java.base/java.io.FileOutputStream.<init>(Unknown Source)
	at kotlin.io.FilesKt__FileReadWriteKt.writeText(FileReadWrite.kt:145)
	at kotlin.io.FilesKt__FileReadWriteKt.writeText$default(FileReadWrite.kt:144)
	at com.coder.toolbox.cli.CoderCLIManager.writeSSHConfig(CoderCLIManager.kt:465)
	at com.coder.toolbox.cli.CoderCLIManager.configSsh(CoderCLIManager.kt:306)
	at com.coder.toolbox.cli.CoderCLIManager.configSsh$default(CoderCLIManager.kt:301)
	at com.coder.toolbox.CoderRemoteProvider$poll$1.invokeSuspend(CoderRemoteProvider.kt:143)
	at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:34)
	at kotlinx.coroutines.DispatchedTask.run(DispatchedTask.kt:100)
	at kotlinx.coroutines.scheduling.CoroutineScheduler.runSafely(CoroutineScheduler.kt:586)
	at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.executeTask(CoroutineScheduler.kt:829)
	at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.runWorker(CoroutineScheduler.kt:717)
	at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.run(CoroutineScheduler.kt:704)
Caused by: java.nio.file.AccessDeniedException: /Users/redacted/.ssh/config
	at java.base/sun.nio.fs.UnixException.translateToIOException(Unknown Source)
	at java.base/sun.nio.fs.UnixException.rethrowAsIOException(Unknown Source)
	at java.base/sun.nio.fs.UnixException.rethrowAsIOException(Unknown Source)
	at java.base/sun.nio.fs.UnixFileSystemProvider.newFileChannel(Unknown Source)
	... 16 more

[linear-code]

DEVEX-632

[fioan89]

Thanks for the report. The plugin needs to update the SSH configuration because Toolbox connects to Coder workspaces through SSH using a generated ProxyCommand block. Without that block, Toolbox cannot resolve the generated workspace hostname or establish the SSH connection.

Mode 0400 permits reading but prevents the plugin from adding or updating its Coder-managed block. At present, a writable SSH config is therefore required for establishing connections. This also explains why the issue is more visible on macOS/Linux: Unix file permissions are enforced directly, whereas Windows uses a different permissions model and typically does not impose the same restriction.

That said, this exposed a flaw in the plugin: regardless of whether the SSH config is writable, workspace discovery should continue. I’m working on a fix so a failed SSH-config update does not abort the polling loop or prevent workspaces from being listed. We should also surface a clear UI warning that SSH connections will remain unavailable until the configuration can be updated.

Alternatively—or additionally—we could add a setting to choose a separate SSH config file for the plugin to manage. This would let you keep ~/.ssh/config read-only while pointing the plugin to a writable Coder-specific config, which your main SSH config could include as needed.