Windows: two ssh --proxy-mode bugs the open PRs do not cover

[Le-Anh-Duy]

Posting here rather than as PRs, per CONTRIBUTING.

While getting the CLI working on Windows 11 (Python 3.13, google-colab-cli==0.6.0) I ran into four separate failures. Two are already covered by open PRs; two are in commands/ssh.py and I could not find them addressed anywhere — none of the open Windows PRs (#70, #75, #84, #86) touch that file's --proxy-mode path.

Everything below was verified end to end against a live T4 runtime: interactive shell, remote command, and scp in both directions.

---

1. select.select() on a pipe kills ssh --proxy-mode, silently

_bridge_proxy_mode's stdin pump:

ready, _, _ = select.select([stdin_fd], [], [], None)
if not ready:
    continue
data = os.read(stdin_fd, 8192)

On Windows select() accepts sockets only, so this raises OSError: [WinError 10038]. The surrounding except (OSError, websocket.WebSocketException): pass swallows it, the thread dies, and the client → server direction is dead while server → client keeps working.

The symptom is confusing: the SSH banner arrives, then the connection drops before key exchange.

$ ssh -o "ProxyCommand=colab ssh --proxy-mode -s nb" root@colab
debug1: Authenticating to colab:22 as 'root'
Connection closed by UNKNOWN port 65535

Worth noting the call buys nothing on any platform: with a None timeout it only repeats what the blocking os.read underneath already does. Deleting it is a simplification that happens to fix Windows.

2. shlex.join quoting reaches CreateProcessW

_proxy_command builds the string with shlex.join, whose POSIX quoting wraps the backslashes in sys.executable:

'C:\Users\me\AppData\Local\Programs\Python\Python313\python.exe' -m colab_cli.cli ssh --proxy-mode -s gpu

Windows OpenSSH spawns a ProxyCommand through CreateProcessW with no shell in between, so it looks for a file whose name literally contains those quotes:

$ colab ssh -s gpu
CreateProcessW failed error:2
posix_spawnp: No such file or directory

subprocess.list2cmdline produces the quoting that parser expects.

One caveat for whoever fixes this: tests/test_ssh.py::test_proxy_command_round_trips_through_the_shell asserts the round trip with shlex.split, which is the POSIX parser. Loosening that assertion would drop a real security contract — a session name like $(touch /tmp/pwned) must arrive as one literal argument. Splitting with CommandLineToArgvW on Windows keeps the contract enforced on both platforms; reverting the fix then turns 14 of those cases red.

3 & 4. Already covered by open PRs

• Module-level import termios / import tty in console.py aborts every command on Windows (Windows: google-colab-cli v0.6.0 crashes on startup due to unconditional termios import #78; feat: Add native Windows support and lazy console imports #84, Add Windows support #75, feat: add Windows native support via platform terminal abstraction #70).
• signal.SIGHUP in _install_rm_signal_handlers (Add native Windows support #86 already uses getattr).

Mentioned only so the picture is complete.

---

Two things I found useful enough to build

Attaching to a runtime that already exists — which I have since found is already #49, where it is better placed; I have added the mechanism detail there and closed my duplicate issue.

Generating the ~/.ssh/config entries. --proxy-mode is only usable once a host block points at it, and writing that by hand is easy to get wrong: a shell wrapper in ProxyCommand dies on Windows for the reason in §2, and aiming UserKnownHostsFile at the real file fills it with warnings because every new runtime brings a new host key. A config-ssh command that rewrites only a marked region — the shape gcloud compute config-ssh uses — makes plain ssh, scp, rsync and -L forwards work.

Small related papercut: colab ssh lands you in /content but Colab exports LD_LIBRARY_PATH only into the kernel environment, so nvidia-smi in that shell fails with couldn't find libnvidia-ml.so on a GPU runtime. The interactive remote command already cds; exporting /usr/lib64-nvidia there costs one clause.

---

Working implementations of all of the above, with tests, are on my fork if they are of any use:
https://github.com/Le-Anh-Duy/google-colab-cli

• dev — the four Windows fixes plus attach
• feat/attach — attach alone, off main
• feat/config-ssh — adds config-ssh

Full suite on Windows goes from 21 failed / 303 passed on main to 17 / 332 there; the 17 that remain are pre-existing and all Windows-related (prompt_toolkit, and two ssh tests that hardcode SIGHUP).

Happy to open PRs if that ever becomes useful, or to leave it here.