@@ -61,6 +61,21 @@ before handoff run typecheck, lint, format check and the affected tests.
 - Add a `CHANGELOG.md` entry for changes users should know about.
 - Never disable a lint rule without user approval.
 
+## Running the Coder CLI
+
+Workspace, owner, and agent names, app commands, and URLs come from the
+deployment. Treat them as untrusted:
+
+- Run the CLI with `execFile`/`spawn` argv (or a terminal's `shellPath` and
+  `shellArgs`), never through a shell or `terminal.sendText`.
+- Put flags first, then `--`, then deployment-provided operands
+  (`coder ping -- owner/ws`) so a value like `--foo` is never read as a flag.
+- Validate names with `src/common/validation.ts` before they reach SSH hosts,
+  paths, or the CLI.
+- In SSH `ProxyCommand` (the one shell context), build flags with
+  `getGlobalShellFlags`, which validates the URL and quotes it with
+  `escapeShellArg`.
+
 ## Code style
 
 - Strict TypeScript: no `any`, `as unknown as`, or non-null assertions
 
@@ -24,6 +24,29 @@
   in with OAuth are asked to sign in again once.
 - Revoke OAuth tokens on logout even when their scopes are outdated.
 
+### Fixed
+
+- Run workspace app commands as arguments to `coder ssh` instead of typing them
+  into a local terminal. This requires Coder CLI v2.23.0 or later.
+- Validate workspace, owner, and agent names from the deployment before using
+  them in SSH hosts and paths, preserving legacy agents with underscores and
+  leading or trailing hyphens.
+- Reject deployment hostnames unsafe for directory names, with Windows-specific
+  restrictions applied only on Windows.
+- Show validation failures without rendering deployment-provided values in
+  notifications; diagnostic details are available in Coder Output.
+- Show the network tooltip's relay name as plain text instead of rendering
+  deployment-provided markdown.
+- Reject deployment URLs that contain shell metacharacters or `%` when building
+  SSH commands. If an earlier version stored such a URL, or a URL with a
+  non-ASCII hostname, you are asked to sign in again, and the URL is then
+  stored in its ASCII form.
+- Reject deployment URLs that include a username, password, query, or fragment
+  when you sign in. If a proxy in front of your deployment needs credentials,
+  send them with `coder.headerCommand`.
+- Keep the stored URL of a deployment you are signed in to when a link names
+  the same origin with a different path.
+
 ## [v1.16.4](https://github.com/coder/vscode-coder/releases/tag/v1.16.4) 2026-09-23
 
 ### Added
 
@@ -6,16 +6,18 @@ import {
 	type WorkspaceStatus,
 } from "coder/site/src/api/typesGenerated";
 
+import { validateIdentifier } from "../common/validation";
+
 /** True when the user holds the deployment-wide owner role. */
 export function isOwner(user: User | undefined): boolean {
 	return user?.roles.some((role) => role.name === "owner") ?? false;
 }
 
-/**
- * Create workspace owner/name identifier
- */
+/** Create the validated `owner/name` identifier used in CLI argv and URLs. */
 export function createWorkspaceIdentifier(workspace: Workspace): string {
-	return `${workspace.owner_name}/${workspace.name}`;
+	const owner = validateIdentifier(workspace.owner_name, "workspace owner");
+	const name = validateIdentifier(workspace.name, "workspace name");
+	return `${owner}/${name}`;
 }
 
 const WORKSPACE_STATUS_LABEL: Readonly<Record<WorkspaceStatus, string>> = {
 
@@ -78,6 +78,7 @@ function runCliCommand(ctx: CliContext, args: string[]): Promise<void> {
 		const fullArgs = [
 			...getGlobalFlags(vscode.workspace.getConfiguration(), ctx.auth),
 			...args,
+			"--",
 			createWorkspaceIdentifier(ctx.workspace),
 		];
 		const proc = spawn(ctx.binPath, fullArgs);
 
@@ -3,14 +3,11 @@ import { stat } from "node:fs/promises";
 import { promisify } from "node:util";
 import * as vscode from "vscode";
 
-import { escapeCommandArg } from "../common/strings";
+import { validateIdentifier } from "../common/validation";
 import { isAbortError } from "../error/abort";
 import { toError } from "../error/normalize";
-import {
-	type CliAuth,
-	getGlobalFlags,
-	getGlobalShellFlags,
-} from "../settings/cli";
+import { type CliFeatureSet } from "../featureSet";
+import { type CliAuth, getGlobalFlags } from "../settings/cli";
 
 /** Resolved CLI environment for invoking the coder binary. */
 export interface CliEnv {
@@ -83,10 +80,11 @@ export async function speedtest(
 	signal?: AbortSignal,
 ): Promise<string> {
 	const globalFlags = getGlobalFlags(env.configs, env.auth);
-	const args = [...globalFlags, "speedtest", workspaceName, "--output", "json"];
+	const args = [...globalFlags, "speedtest", "--output", "json"];
 	if (duration) {
 		args.push("-t", duration);
 	}
+	args.push("--", workspaceName);
 	try {
 		const result = await execFileAsync(env.binary, args, { signal });
 		return result.stdout;
@@ -134,12 +132,13 @@ export async function supportBundle(
 		...globalFlags,
 		"support",
 		"bundle",
-		workspaceName,
-		...(agentName ? [agentName] : []),
 		"--output-file",
 		outputPath,
 		"--yes",
 		...workspaceFiles.flatMap((file) => ["--workspace-file", file]),
+		"--",
+		workspaceName,
+		...(agentName ? [agentName] : []),
 	];
 	try {
 		await execFileAsync(env.binary, args, { signal });
@@ -156,30 +155,38 @@ export function ping(env: CliEnv, workspaceName: string): vscode.Terminal {
 	return spawnCliInTerminal({
 		name: `Coder Ping: ${workspaceName}`,
 		binary: env.binary,
-		args: [...globalFlags, "ping", workspaceName],
+		args: [...globalFlags, "ping", "--", workspaceName],
 		banner: ["Press Ctrl+C (^C) to stop.", "─".repeat(40)],
 	});
 }
 
 /**
- * SSH into a workspace and run a command via `terminal.sendText`.
+ * Open a terminal that runs `coder ssh <workspace> -- <command>` with no
+ * local shell in between. Older CLIs cannot take a command, and falling back
+ * to typing it into a local shell would let the deployment run local code.
  */
-export async function openAppStatusTerminal(
-	env: CliEnv,
-	app: {
-		name?: string;
-		command?: string;
-		workspace_name: string;
-	},
-): Promise<void> {
-	const globalFlags = getGlobalShellFlags(env.configs, env.auth);
-	const terminal = vscode.window.createTerminal({ name: app.name });
-	terminal.sendText(
-		`${escapeCommandArg(env.binary)} ${globalFlags.join(" ")} ssh ${escapeCommandArg(app.workspace_name)}`,
+export function openAppStatusTerminal(
+	env: CliEnv & { featureSet: CliFeatureSet },
+	app: { name?: string; command: string; workspace_name: string },
+): void {
+	if (!env.featureSet.sshCommand) {
+		throw new Error("Running app commands requires Coder CLI v2.23.0 or later");
+	}
+	const workspaceName = validateIdentifier(
+		app.workspace_name,
+		"workspace name",
 	);
-	await new Promise((resolve) => setTimeout(resolve, 5000));
-	terminal.sendText(app.command ?? "");
-	terminal.show(false);
+	const args = [
+		...getGlobalFlags(env.configs, env.auth),
+		"ssh",
+		...(env.featureSet.sshTty ? ["--tty"] : []),
+		workspaceName,
+		"--",
+		app.command,
+	];
+	vscode.window
+		.createTerminal({ name: app.name, shellPath: env.binary, shellArgs: args })
+		.show(false);
 }
 
 const execFileAsync = promisify(execFile);
 
@@ -1105,15 +1105,16 @@ export class Commands {
 		workspace_name: string;
 	}): Promise<void> {
 		// Launch and run command in terminal if command is provided
-		if (app.command) {
+		const command = app.command;
+		if (command) {
 			return withProgress(
 				{
 					location: vscode.ProgressLocation.Notification,
-					title: `Connecting to AI Agent...`,
+					title: `Preparing Coder CLI...`,
 				},
 				async () => {
 					const env = await this.resolveCliEnv(this.extensionClient);
-					await cliExec.openAppStatusTerminal(env, app);
+					cliExec.openAppStatusTerminal(env, { ...app, command });
 				},
 			);
 		}
 
@@ -28,6 +28,9 @@ export function escapeCommandArg(arg: string): string {
 /**
  * Cross-platform shell quoting that blocks variable expansion. Use for
  * values from outside the user's local settings (e.g. server-controlled).
+ * The win32 branch targets Windows OpenSSH, which runs `ProxyCommand`
+ * without a shell and turns `%%` back into `%`. A shell such as cmd.exe or
+ * Git Bash's `sh` still expands inside those quotes.
  */
 export function escapeShellArg(arg: string): string {
 	if (os.platform() === "win32") {
 
@@ -1,14 +1,16 @@
 import url from "node:url";
 import * as vscode from "vscode";
 
+import { parseDeploymentUrl, validateFilenameHostname } from "./validation";
+
 /**
  * Given a URL, return the host in a format that is safe to write.
  */
 export function toSafeHost(rawUrl: string): string {
-	const u = new URL(rawUrl);
+	const u = parseDeploymentUrl(rawUrl);
 	// If the host is invalid, an empty string is returned.  Although, `new URL`
 	// should already have thrown in that case.
-	return url.domainToASCII(u.hostname) || u.hostname;
+	return validateFilenameHostname(url.domainToASCII(u.hostname) || u.hostname);
 }
 
 export function removeTrailingSlashes(value: string): string {
 
@@ -0,0 +1,137 @@
+import { isIP } from "node:net";
+import os from "node:os";
+
+const OMITTED_URL =
+	"[URL omitted to protect credentials and other sensitive parameters]";
+
+/** A safe display message with a bounded diagnostic value for Coder Output. */
+export class InputValidationError extends Error {
+	readonly diagnosticValue: string;
+
+	constructor(message: string, value: string) {
+		super(message);
+		this.name = "InputValidationError";
+		this.diagnosticValue = JSON.stringify(value.slice(0, 512));
+	}
+}
+
+export function parseDeploymentUrl(value: string): URL {
+	try {
+		return new URL(value);
+	} catch {
+		throw new InputValidationError(
+			"Invalid URL: the deployment URL is not a valid address.",
+			OMITTED_URL,
+		);
+	}
+}
+
+/** User and workspace names, excluding the remote-authority separators. */
+export function isValidIdentifier(value: string): boolean {
+	return /^\w+(?:-\w+)*$/.test(value);
+}
+
+export function validateIdentifier(
+	value: string,
+	kind: "username" | "workspace owner" | "workspace name",
+): string {
+	if (!isValidIdentifier(value)) {
+		throw new InputValidationError(
+			`Cannot use this ${kind} in an SSH connection: it contains unsupported characters or separators.`,
+			value,
+		);
+	}
+	return value;
+}
+
+/** Legacy agent names may have leading/trailing hyphens and underscores. */
+export function validateAgentName(value: string): string {
+	if (!/^[\w-]+$/.test(value) || value.includes("--")) {
+		throw new InputValidationError(
+			"Cannot use this agent name in an SSH connection: it contains unsupported characters or separators.",
+			value,
+		);
+	}
+	return value;
+}
+
+/** Returns the hostname unchanged when it is safe as a filesystem component. */
+export function validateFilenameHostname(value: string): string {
+	if (
+		!value ||
+		/^\.+$/.test(value) ||
+		/[/\\]/.test(value) ||
+		/\p{Cc}/u.test(value)
+	) {
+		throw new InputValidationError(
+			"Cannot use this deployment hostname for local storage: it is empty or contains unsafe path characters.",
+			value,
+		);
+	}
+	if (
+		os.platform() === "win32" &&
+		(/[<>:"|?*]/.test(value) ||
+			/[. ]$/.test(value) ||
+			/^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(value))
+	) {
+		throw new InputValidationError(
+			"Cannot connect on Windows: this deployment hostname cannot be used as a local directory name.",
+			value,
+		);
+	}
+	return value;
+}
+
+/** Shell-safe, literal SSH host characters; IP structure uses Node's parser. */
+export function isShellSafeHostname(value: string): boolean {
+	return (
+		/^[\w.-]+$/.test(value) ||
+		(value.startsWith("[") &&
+			value.endsWith("]") &&
+			!value.includes("%") &&
+			isIP(value.slice(1, -1)) === 6)
+	);
+}
+
+export function validateShellSafeHostname(value: string): string {
+	if (!isShellSafeHostname(value)) {
+		throw new InputValidationError(
+			"Cannot use this deployment hostname in an SSH connection: it contains shell metacharacters or wildcard patterns.",
+			value,
+		);
+	}
+	return value;
+}
+
+/**
+ * Validates a deployment URL for sign-in, storage reads, and the SSH
+ * `ProxyCommand`, and returns it unchanged. Rejects credentials, which the SSH
+ * config would store in plain text; query parameters and fragments, which
+ * break API paths built on the URL; and characters that are not literal
+ * inside shell quotes, including OpenSSH's `%` tokens.
+ */
+export function validateDeploymentUrl(value: string): string {
+	const url = parseDeploymentUrl(value);
+	if (url.username || url.password || /[?#]/.test(url.href)) {
+		throw new InputValidationError(
+			"Invalid URL: the deployment URL cannot include a username, password, query, or fragment.",
+			OMITTED_URL,
+		);
+	}
+	if (!/^[\w\-.~:/[\]@!*+,=]+$/.test(value)) {
+		throw new InputValidationError(
+			"Invalid URL: the deployment URL cannot be safely used in an SSH connection because it contains unsupported or percent-encoded characters.",
+			OMITTED_URL,
+		);
+	}
+	return value;
+}
+
+export function isValidDeploymentUrl(value: string): boolean {
+	try {
+		validateDeploymentUrl(value);
+		return true;
+	} catch {
+		return false;
+	}
+}
@@ -147,7 +147,10 @@ export class ServiceContainer implements vscode.Disposable {
 			this.logger,
 		);
 
-		this.commandManager = new CommandManager(this.telemetryService);
+		this.commandManager = new CommandManager(
+			this.telemetryService,
+			this.logger,
+		);
 	}
 
 	getPathResolver(): PathResolver {