Suggested configuration block for SSH client doesn't work

[msusta]

Problem

If you want to use the toolkit integration to connect to SageMaker instance you get a notification to add a configuration block to .ssh/config that's supposed to simplify the connections to them.
However the supplied block is incorrect on latest OpenSSH version.

Steps to reproduce the issue

1. Make sure no generated configuration from Toolkit is in your .ssh/config
2. Use VScode with AWS Toolkit 3.77 (latest for me ATM)
3. Try connecting to SageMaker AI space
4. You're presented with dialog to add configuration to .ssh/config
5. Following code is put into there:

# Created by AWS Toolkit for VSCode. https://github.com/aws/aws-toolkit-vscode
Host sm_*
    ForwardAgent no
    #AddKeysToAgent yes
    StrictHostKeyChecking no
    ProxyCommand '/home/msusta/.config/Code/User/globalStorage/amazonwebservices.aws-toolkit-vscode/sagemaker_connect' '%n'
    User '%r'

6. First connection works for whatever reason
7. Next connection attempt fails on ssh -G sm_test with

vdollar_percent_expand: unknown key %r
percent_dollar_expand: failed

Expected behavior

OpenSSH doesn't allow usage of '%r' in User option. Not sure why that's passed in there.

Workaround

Set the option User to sagemaker-user when using the default SageMaker distribution.

System details (run AWS: About and/or Amazon Q: About)

• OS: Debian Linux 13.1 (Trixie)
• Visual Studio Code version: 1.104
• AWS Toolkit version: 3.77
• OpenSSH: 10

[edwardps]

Thank you for reporting this issue. We will cut internal ticket for tracking this.

[edwardps]

As as short-term workaround, can you try manually removing following line after its added by the AWS toolkit?

User '%r'

[msusta]

As as short-term workaround, can you try manually removing following line after its added by the AWS toolkit?

User '%r'

I'll try. As I wrote in the submission, it worked for me with the User sagemaker-user as it's the default value for SageMaker distribution.

[edwardps]

Root cause: OpenSSH v10 has stricter verification. Essentially, invalid token(%r) were silently passed through or ignored in unsupported directives.

# failed for OpenSSH_10.0p2, OpenSSL 3.5.3 16 Sep 2025
ssh -G sm_test
vdollar_percent_expand: unknown key %r
percent_dollar_expand: failed

# passed for OpenSSH_9.9p2, LibreSSL 3.3.6
ssh -G sm_test
----
host sm_test
user %r
hostname sm_test
port 22
addressfamily any
batchmode no

We will evaluate the fix to remove the User '%r' line or change it to User sagemaker-user in the .ssh/config file.