fix(cli): respect empty --ssh-host-prefix/--hostname-suffix flags (#27084)

## Problem

`coder config-ssh --ssh-host-prefix=""` (or the matching env var,
`CODER_CONFIGSSH_SSH_HOST_PREFIX=`) was silently ignored, and the
deprecated `Host coder.*` block was written to the SSH config anyway.
The
merge logic that decides whether to fall back to the server's default
prefix checked `user.userHostPrefix == ""`, which is true both when the
flag was never passed and when it was explicitly set to empty, so there
was no way to distinguish the two. The same issue applied to
`--hostname-suffix`.

## How this affects users

Anyone who wants to opt out of the legacy prefix-based SSH aliases
(`ssh coder.myworkspace`) in favor of the newer suffix-based ones
(`ssh myworkspace.coder`) had no way to do so, the `Host coder.*`
wildcard
block kept reappearing on every `config-ssh` run regardless of the flag.
Because that wildcard matches any hostname starting with `coder.`, not
just Coder workspaces, it can silently intercept SSH connections to
unrelated hosts that happen to share that prefix.

It got worse on top of that: even after passing `--ssh-host-prefix=""`,
running `config-ssh --use-previous-options` in a later session, a normal
way to refresh local config without retyping every flag, would silently
bring the block back, because the empty choice was never persisted to
the
file in the first place.

## Solution

Track whether each option (`--ssh-host-prefix`, `--hostname-suffix`) was
explicitly set by the user, as opposed to left at its zero value, and
only
fall back to the server default (or skip persisting the option) when it
was genuinely never set.

## How it works

Two new fields on `sshConfigOptions`, `userHostPrefixExplicit` and
`hostnameSuffixExplicit`, carry this information:

- **Live invocation**: they're set from `userSetOption(inv, ...)`, which
  inspects serpent's `Option.ValueSource` for the flag, right after
  `header`/`headerCommand` are set in the `Handler`, before any
  `--use-previous-options`/prompt logic can replace the struct wholesale
  from a prior run's saved options.
- **Persistence**: `sshConfigWriteSectionHeader` now writes the
`# :ssh-host-prefix=` comment line even when the value is empty, as long
as it was explicit, and `sshConfigParseLastOptions` sets the field back
  to `true` whenever it parses that line on a later run, regardless of
  value.

`mergeSSHOptions`'s fallback condition changed from
`user.userHostPrefix == ""` to
`user.userHostPrefix == "" && !user.userHostPrefixExplicit` (and the
mirror for suffix). `equal()` and `asList()` were extended to include
the
two new fields so the `--dry-run` diff and "options differ, use new
ones?"
prompt stay accurate.

## Why implemented this way

- Reuses `userSetOption` (`cli/util.go`), an existing helper already
used
for this exact "distinguish zero value from unset" problem elsewhere in
  the CLI (`cli/templateedit.go`), instead of inventing new machinery.
- Storing the "explicit" bit as a plain field on `sshConfigOptions`,
rather
  than as extra parameters to `mergeSSHOptions`, keeps that function
  dependency-free (still plain data in, plain data out, no
`serpent.Invocation` coupling), while letting the same bit flow
naturally
through the SSH config's persisted-options comment, solving the
live-flag
  case and the `--use-previous-options` persistence case with one
  mechanism instead of two.
- A sentinel-value approach was considered and rejected: a self-tracking
  custom `serpent.Value` doesn't work because serpent applies a flag's
  default through the same `Value.Set()` call used for real input, so it
  can't tell the two apart; a plain sentinel string would work but leak
  into several other code paths (equality checks, diff/prompt text, the
  persisted comment) that would all need to filter it out.

Closes https://github.com/coder/internal/issues/1208

## Manual verification

Every step below was run against a local dev server
(`./scripts/develop.sh`
+ `./scripts/coder-dev.sh`), pointed at a throwaway `--ssh-config-file`,
never a real `~/.ssh/config`.

### 1. Baseline: unchanged behavior with no flags

```sh
./scripts/coder-dev.sh config-ssh --yes --ssh-config-file "$TEST_SSH_CONFIG"
cat "$TEST_SSH_CONFIG"
```

Both `Host coder.*` and `Host *.coder` are written, unchanged from
before this fix (both server defaults are non-empty out of the box).

<details>
<summary>Output</summary>

```text
Updated "/tmp/tmp.9Y7VIeuQoY"
You should now be able to ssh into your workspace.
For example, try running:

	$ ssh myworkspace.coder
# ------------START-CODER-----------
# This section is managed by coder. DO NOT EDIT.
#
# You should not hand-edit this section unless you are removing it, all
# changes will be lost when running "coder config-ssh".
#
Host coder.*
	ConnectTimeout=0
	StrictHostKeyChecking=no
	UserKnownHostsFile=/dev/null
	LogLevel ERROR
	ProxyCommand .../coder-slim ... ssh --stdio --ssh-host-prefix coder. %h

Host *.coder
	ConnectTimeout=0
	StrictHostKeyChecking=no
	UserKnownHostsFile=/dev/null
	LogLevel ERROR

Match host *.coder !exec ".../coder-slim connect exists %h"
	ProxyCommand .../coder-slim ... ssh --stdio --hostname-suffix coder %h
# ------------END-CODER------------
```

</details>

### 2. Explicit empty `--ssh-host-prefix` omits the legacy block (the
core fix)

```sh
./scripts/coder-dev.sh config-ssh --yes --ssh-config-file "$TEST_SSH_CONFIG" --ssh-host-prefix ""
cat "$TEST_SSH_CONFIG"
```

`Host coder.*` is gone, only `Host *.coder` remains. The choice is now
also persisted (`# :ssh-host-prefix=`).

<details>
<summary>Output</summary>

```text
Updated "/tmp/tmp.9Y7VIeuQoY"
You should now be able to ssh into your workspace.
For example, try running:

	$ ssh myworkspace.coder
# ------------START-CODER-----------
# This section is managed by coder. DO NOT EDIT.
#
# You should not hand-edit this section unless you are removing it, all
# changes will be lost when running "coder config-ssh".
#
# Last config-ssh options:
# :ssh-host-prefix=
#

Host *.coder
	ConnectTimeout=0
	StrictHostKeyChecking=no
	UserKnownHostsFile=/dev/null
	LogLevel ERROR

Match host *.coder !exec ".../coder-slim connect exists %h"
	ProxyCommand .../coder-slim ... ssh --stdio --hostname-suffix coder %h
# ------------END-CODER------------
```

</details>

### 3. Same, via the environment variable instead of the flag

```sh
CODER_CONFIGSSH_SSH_HOST_PREFIX="" ./scripts/coder-dev.sh config-ssh --yes --ssh-config-file "$TEST_SSH_CONFIG"
grep -c "Host coder" "$TEST_SSH_CONFIG"
```

Confirms the fix isn't flag-only, `userSetOption` checks `ValueSource`,
set the same way for `ValueSourceFlag` and `ValueSourceEnv`.

<details>
<summary>Output</summary>

```text
Updated "/tmp/tmp.9Y7VIeuQoY"
You should now be able to ssh into your workspace.
For example, try running:

	$ ssh myworkspace.coder
0
```

</details>

### 4. Explicit empty prefix combined with an explicit suffix

```sh
./scripts/coder-dev.sh config-ssh --yes --ssh-config-file "$TEST_SSH_CONFIG" --ssh-host-prefix "" --hostname-suffix mytest
cat "$TEST_SSH_CONFIG"
```

Only `Host *.mytest` is written. Both options are correctly recorded in
the persisted comment.

<details>
<summary>Output</summary>

```text
Updated "/tmp/tmp.9Y7VIeuQoY"
You should now be able to ssh into your workspace.
For example, try running:

	$ ssh myworkspace.mytest
# ------------START-CODER-----------
# This section is managed by coder. DO NOT EDIT.
#
# You should not hand-edit this section unless you are removing it, all
# changes will be lost when running "coder config-ssh".
#
# Last config-ssh options:
# :ssh-host-prefix=
# :hostname-suffix=mytest
#

Host *.mytest
	ConnectTimeout=0
	StrictHostKeyChecking=no
	UserKnownHostsFile=/dev/null
	LogLevel ERROR

Match host *.mytest !exec ".../coder-slim connect exists %h"
	ProxyCommand .../coder-slim ... ssh --stdio --hostname-suffix mytest %h
# ------------END-CODER------------
```

</details>

### 5. The explicitly-empty choice survives `--use-previous-options`
with no flag repeated

This is the persistence half of the fix: confirms the "omit this block"
choice, once persisted, doesn't get lost on a later run that reuses
previous options without repeating `--ssh-host-prefix`. Before this fix,
this exact sequence would bring `Host coder.*` back.

```sh
./scripts/coder-dev.sh config-ssh --yes --ssh-config-file "$TEST_SSH_CONFIG" --ssh-host-prefix ""
./scripts/coder-dev.sh config-ssh --yes --ssh-config-file "$TEST_SSH_CONFIG" --use-previous-options
cat "$TEST_SSH_CONFIG"
```

<details>
<summary>Output</summary>

```text
Updated "/tmp/tmp.9Y7VIeuQoY"
You should now be able to ssh into your workspace.
For example, try running:

	$ ssh myworkspace.coder
No changes to make.
# ------------START-CODER-----------
# This section is managed by coder. DO NOT EDIT.
#
# You should not hand-edit this section unless you are removing it, all
# changes will be lost when running "coder config-ssh".
#
# Last config-ssh options:
# :ssh-host-prefix=
#

Host *.coder
	ConnectTimeout=0
	StrictHostKeyChecking=no
	UserKnownHostsFile=/dev/null
	LogLevel ERROR

Match host *.coder !exec ".../coder-slim connect exists %h"
	ProxyCommand .../coder-slim ... ssh --stdio --hostname-suffix coder %h
# ------------END-CODER------------
```

</details>

The second command printed `No changes to make.`, and critically, `Host
coder.*` did **not** reappear even though that run passed no
`--ssh-host-prefix` flag at all, only `--use-previous-options`.

### 6. `--use-previous-options` still wins over this run's explicit
empty flag (unaffected by this fix)

Confirms this fix didn't change the pre-existing, intentional precedence
of `--use-previous-options`: a previously-saved *non-empty* value still
wins over an explicit empty flag passed on a later run.

```sh
./scripts/coder-dev.sh config-ssh --yes --ssh-config-file "$TEST_SSH_CONFIG" --ssh-host-prefix "custom-test."
./scripts/coder-dev.sh config-ssh --yes --ssh-config-file "$TEST_SSH_CONFIG" --use-previous-options --ssh-host-prefix ""
cat "$TEST_SSH_CONFIG"
```

<details>
<summary>Output</summary>

```text
Updated "/tmp/tmp.9Y7VIeuQoY"
You should now be able to ssh into your workspace.
For example, try running:

	$ ssh myworkspace.coder
No changes to make.
# ------------START-CODER-----------
# This section is managed by coder. DO NOT EDIT.
#
# You should not hand-edit this section unless you are removing it, all
# changes will be lost when running "coder config-ssh".
#
# Last config-ssh options:
# :ssh-host-prefix=custom-test.
#
Host custom-test.*
	ConnectTimeout=0
	StrictHostKeyChecking=no
	UserKnownHostsFile=/dev/null
	LogLevel ERROR
	ProxyCommand .../coder-slim ... ssh --stdio --ssh-host-prefix custom-test. %h

Host *.coder
	ConnectTimeout=0
	StrictHostKeyChecking=no
	UserKnownHostsFile=/dev/null
	LogLevel ERROR

Match host *.coder !exec ".../coder-slim connect exists %h"
	ProxyCommand .../coder-slim ... ssh --stdio --hostname-suffix coder %h
# ------------END-CODER------------
```

</details>

`Host custom-test.*` is preserved verbatim, `--use-previous-options`
correctly overrides the explicit empty flag when the saved value is
non-empty, the mirror image of step 5's explicit-empty saved value.

### 7. End-to-end sanity check with a real workspace

```sh
./scripts/coder-dev.sh config-ssh --yes --ssh-config-file "$TEST_SSH_CONFIG" --ssh-host-prefix "" --hostname-suffix mytest
ssh -F "$TEST_SSH_CONFIG" -o ConnectTimeout=15 myworkspace.mytest echo ok
```

<details>
<summary>Output</summary>

```text
Updated "/tmp/tmp.9Y7VIeuQoY"
You should now be able to ssh into your workspace.
For example, try running:

	$ ssh myworkspace.mytest
ok
```

</details>

`ok` came back from a real, running workspace, confirming the
ProxyCommand and Match/exec wiring generated by the suffix-only config
actually establishes a working SSH session end-to-end, not just a
text-generation check.

cli/configssh.go

@@ -47,18 +47,23 @@ const (
 type sshConfigOptions struct {
 	waitEnum string
 	// Deprecated: moving away from prefix to hostnameSuffix
-	userHostPrefix      string
-	hostnameSuffix      string
-	sshOptions          []string
-	disableAutostart    bool
-	noWildcard          bool
-	header              []string
-	headerCommand       string
-	removedKeys         map[string]bool
-	globalConfigPath    string
-	coderBinaryPath     string
-	skipProxyCommand    bool
-	forceUnixSeparators bool
+	userHostPrefix string
+	hostnameSuffix string
+	// userHostPrefixExplicit and hostnameSuffixExplicit distinguish an
+	// intentional empty value from "unset" (which falls back to the
+	// server default). Persisted across --use-previous-options runs.
+	userHostPrefixExplicit bool
+	hostnameSuffixExplicit bool
+	sshOptions             []string
+	disableAutostart       bool
+	noWildcard             bool
+	header                 []string
+	headerCommand          string
+	removedKeys            map[string]bool
+	globalConfigPath       string
+	coderBinaryPath        string
+	skipProxyCommand       bool
+	forceUnixSeparators    bool
 	// workspaceNames is populated when noWildcard is true. It holds the
 	// workspace names used to generate individual host entries. It is not
 	// persisted to the SSH config header.
@@ -110,9 +115,11 @@ func (o sshConfigOptions) equal(other sshConfigOptions) bool {
 	}
 	return o.waitEnum == other.waitEnum &&
 		o.userHostPrefix == other.userHostPrefix &&
+		o.userHostPrefixExplicit == other.userHostPrefixExplicit &&
 		o.disableAutostart == other.disableAutostart &&
 		o.headerCommand == other.headerCommand &&
 		o.hostnameSuffix == other.hostnameSuffix &&
+		o.hostnameSuffixExplicit == other.hostnameSuffixExplicit &&
 		o.noWildcard == other.noWildcard
 }
 
@@ -262,9 +269,13 @@ func (o sshConfigOptions) asList() (list []string) {
 	}
 	if o.userHostPrefix != "" {
 		list = append(list, fmt.Sprintf("ssh-host-prefix: %s", o.userHostPrefix))
+	} else if o.userHostPrefixExplicit {
+		list = append(list, "ssh-host-prefix: (explicitly empty)")
 	}
 	if o.hostnameSuffix != "" {
 		list = append(list, fmt.Sprintf("hostname-suffix: %s", o.hostnameSuffix))
+	} else if o.hostnameSuffixExplicit {
+		list = append(list, "hostname-suffix: (explicitly empty)")
 	}
 	if o.disableAutostart {
 		list = append(list, fmt.Sprintf("disable-autostart: %v", o.disableAutostart))
@@ -325,6 +336,13 @@ func (r *RootCmd) configSSH() *serpent.Command {
 			}
 			sshConfigOpts.header = r.header
 			sshConfigOpts.headerCommand = r.headerCommand
+			// Record whether the user explicitly set these this run, before
+			// any --use-previous-options/prompt logic below may replace
+			// sshConfigOpts wholesale with a prior run's saved options (which
+			// carry their own explicit bits, parsed back by
+			// sshConfigParseLastOptions).
+			sshConfigOpts.userHostPrefixExplicit = userSetOption(inv, "ssh-host-prefix")
+			sshConfigOpts.hostnameSuffixExplicit = userSetOption(inv, "hostname-suffix")
 
 			// Talk to the API early to prevent the version mismatch
 			// warning from being printed in the middle of a prompt.
@@ -692,11 +710,13 @@ func mergeSSHOptions(
 
 	configOptions.globalConfigPath = globalConfigPath
 	configOptions.coderBinaryPath = coderBinaryPath
-	// user config takes precedence
-	if user.userHostPrefix == "" {
+	// user config takes precedence, but only fall back to the server default
+	// when the user never set the option at all. An explicitly empty value
+	// (e.g. --ssh-host-prefix="") means the user wants that block omitted.
+	if user.userHostPrefix == "" && !user.userHostPrefixExplicit {
 		configOptions.userHostPrefix = coderd.HostnamePrefix
 	}
-	if user.hostnameSuffix == "" {
+	if user.hostnameSuffix == "" && !user.hostnameSuffixExplicit {
 		configOptions.hostnameSuffix = coderd.HostnameSuffix
 	}
 
@@ -740,10 +760,10 @@ func sshConfigWriteSectionHeader(w io.Writer, addNewline bool, o sshConfigOption
 	if o.waitEnum != "auto" {
 		_, _ = fmt.Fprintf(&ow, "# :%s=%s\n", "wait", o.waitEnum)
 	}
-	if o.userHostPrefix != "" {
+	if o.userHostPrefix != "" || o.userHostPrefixExplicit {
 		_, _ = fmt.Fprintf(&ow, "# :%s=%s\n", "ssh-host-prefix", o.userHostPrefix)
 	}
-	if o.hostnameSuffix != "" {
+	if o.hostnameSuffix != "" || o.hostnameSuffixExplicit {
 		_, _ = fmt.Fprintf(&ow, "# :%s=%s\n", "hostname-suffix", o.hostnameSuffix)
 	}
 	if o.disableAutostart {
@@ -788,8 +808,10 @@ func sshConfigParseLastOptions(r io.Reader) (o sshConfigOptions) {
 				o.waitEnum = parts[1]
 			case "ssh-host-prefix":
 				o.userHostPrefix = parts[1]
+				o.userHostPrefixExplicit = true
 			case "hostname-suffix":
 				o.hostnameSuffix = parts[1]
+				o.hostnameSuffixExplicit = true
 			case "ssh-option":
 				o.sshOptions = append(o.sshOptions, parts[1])
 			case "disable-autostart":

cli/configssh_internal_test.go

@@ -407,8 +407,10 @@ func Test_mergeSSHOptions_UserOptionsOverrideServerConfig(t *testing.T) {
 	t.Parallel()
 
 	user := sshConfigOptions{
-		userHostPrefix: "dev.",
-		hostnameSuffix: "local",
+		userHostPrefix:         "dev.",
+		hostnameSuffix:         "local",
+		userHostPrefixExplicit: true,
+		hostnameSuffixExplicit: true,
 	}
 	got, err := mergeSSHOptions(user, codersdk.SSHConfigResponse{
 		HostnamePrefix: "coder.",
@@ -419,6 +421,65 @@ func Test_mergeSSHOptions_UserOptionsOverrideServerConfig(t *testing.T) {
 	require.Equal(t, "local", got.hostnameSuffix)
 }
 
+func Test_mergeSSHOptions_ExplicitEmptyNotOverridden(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name               string
+		userHostPrefixSet  bool
+		hostnameSuffixSet  bool
+		wantUserHostPrefix string
+		wantHostnameSuffix string
+	}{
+		{
+			name:               "PrefixExplicitlyEmpty",
+			userHostPrefixSet:  true,
+			hostnameSuffixSet:  false,
+			wantUserHostPrefix: "",
+			wantHostnameSuffix: "coder",
+		},
+		{
+			name:               "SuffixExplicitlyEmpty",
+			userHostPrefixSet:  false,
+			hostnameSuffixSet:  true,
+			wantUserHostPrefix: "coder.",
+			wantHostnameSuffix: "",
+		},
+		{
+			name:               "BothExplicitlyEmpty",
+			userHostPrefixSet:  true,
+			hostnameSuffixSet:  true,
+			wantUserHostPrefix: "",
+			wantHostnameSuffix: "",
+		},
+		{
+			name:               "NeitherSet",
+			userHostPrefixSet:  false,
+			hostnameSuffixSet:  false,
+			wantUserHostPrefix: "coder.",
+			wantHostnameSuffix: "coder",
+		},
+	}
+
+	for _, tt := range testCases {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			user := sshConfigOptions{
+				userHostPrefixExplicit: tt.userHostPrefixSet,
+				hostnameSuffixExplicit: tt.hostnameSuffixSet,
+			}
+			got, err := mergeSSHOptions(user, codersdk.SSHConfigResponse{
+				HostnamePrefix: "coder.",
+				HostnameSuffix: "coder",
+			}, t.TempDir(), "/tmp/coder")
+			require.NoError(t, err)
+			require.Equal(t, tt.wantUserHostPrefix, got.userHostPrefix)
+			require.Equal(t, tt.wantHostnameSuffix, got.hostnameSuffix)
+		})
+	}
+}
+
 func Test_mergeSSHOptions_AllowsSafeServerConfig(t *testing.T) {
 	t.Parallel()
 

cli/configssh_test.go

@@ -291,6 +291,7 @@ func TestConfigSSH_FileWriteAndOptionsFlow(t *testing.T) {
 	}
 	type wantConfig struct {
 		ssh        []string
+		notWant    []string
 		regexMatch string
 	}
 	type match struct {
@@ -299,6 +300,7 @@ func TestConfigSSH_FileWriteAndOptionsFlow(t *testing.T) {
 	tests := []struct {
 		name        string
 		args        []string
+		env         map[string]string
 		matches     []match
 		writeConfig writeConfig
 		wantConfig  wantConfig
@@ -786,6 +788,117 @@ func TestConfigSSH_FileWriteAndOptionsFlow(t *testing.T) {
 				ssh: []string{"Host presto.*", "Match host *.testy !exec"},
 			},
 		},
+		{
+			// Regression test for https://github.com/coder/internal/issues/1208:
+			// an explicitly empty --ssh-host-prefix must not fall back to the
+			// server's default prefix.
+			name: "Explicit empty ssh-host-prefix omits legacy block",
+			args: []string{
+				"--yes",
+				"--ssh-host-prefix", "",
+			},
+			wantErr: false,
+			wantConfig: wantConfig{
+				ssh: []string{
+					headerStart,
+					"# Last config-ssh options:",
+					"# :ssh-host-prefix=\n",
+					headerEnd,
+				},
+				notWant: []string{"Host coder.*", "--ssh-host-prefix coder."},
+			},
+		},
+		{
+			// Same as above, but via the env var instead of the flag.
+			name: "Explicit empty ssh-host-prefix env var omits legacy block",
+			args: []string{"--yes"},
+			env: map[string]string{
+				"CODER_CONFIGSSH_SSH_HOST_PREFIX": "",
+			},
+			wantErr: false,
+			wantConfig: wantConfig{
+				ssh: []string{
+					headerStart,
+					"# Last config-ssh options:",
+					"# :ssh-host-prefix=\n",
+					headerEnd,
+				},
+				notWant: []string{"Host coder.*", "--ssh-host-prefix coder."},
+			},
+		},
+		{
+			// An explicit empty prefix alongside an explicit suffix should
+			// produce only the suffix block, not both.
+			name: "Explicit empty ssh-host-prefix with hostname-suffix set",
+			args: []string{
+				"--yes",
+				"--ssh-host-prefix", "",
+				"--hostname-suffix", "testy",
+			},
+			wantErr:  false,
+			hasAgent: true,
+			wantConfig: wantConfig{
+				ssh: []string{
+					"# :ssh-host-prefix=\n",
+					"# :hostname-suffix=testy\n",
+					"Host *.testy",
+				},
+				notWant: []string{"Host coder.*", "--ssh-host-prefix coder."},
+			},
+		},
+		{
+			// Regression test: the "omit this block" choice must survive a
+			// later --use-previous-options run that doesn't repeat the flag,
+			// not just the invocation where the flag was passed.
+			name: "use-previous-options preserves an explicitly empty prefix across runs",
+			writeConfig: writeConfig{
+				ssh: strings.Join([]string{
+					headerStart,
+					"# Last config-ssh options:",
+					"# :ssh-host-prefix=",
+					"#",
+					headerEnd,
+					"",
+				}, "\n"),
+			},
+			args: []string{
+				"--use-previous-options",
+				"--yes",
+			},
+			wantConfig: wantConfig{
+				ssh: []string{
+					"# :ssh-host-prefix=\n",
+				},
+				notWant: []string{"Host coder.*", "--ssh-host-prefix coder."},
+			},
+		},
+		{
+			// Regression test: --use-previous-options should still win over
+			// this run's explicit empty flag, since that's what "use previous
+			// options" means. The empty-prefix fix must not change this.
+			name: "use-previous-options keeps prior prefix despite this run's explicit empty flag",
+			writeConfig: writeConfig{
+				ssh: strings.Join([]string{
+					headerStart,
+					"# Last config-ssh options:",
+					"# :ssh-host-prefix=coder-test.",
+					"#",
+					headerEnd,
+					"",
+				}, "\n"),
+			},
+			args: []string{
+				"--use-previous-options",
+				"--yes",
+				"--ssh-host-prefix", "",
+			},
+			wantConfig: wantConfig{
+				ssh: []string{
+					"# :ssh-host-prefix=coder-test.",
+					"Host coder-test.*",
+				},
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -816,6 +929,9 @@ func TestConfigSSH_FileWriteAndOptionsFlow(t *testing.T) {
 			inv, root := clitest.New(t, args...)
 			//nolint:gocritic // This has always ran with the admin user.
 			clitest.SetupConfig(t, client, root)
+			for k, v := range tt.env {
+				inv.Environ.Set(k, v)
+			}
 
 			stdout := expecter.NewAttachedToInvocation(t, inv)
 			stdin := testutil.NewWriterAttachedToInvocation(t, logger.Named("stdin"), inv)
@@ -835,8 +951,9 @@ func TestConfigSSH_FileWriteAndOptionsFlow(t *testing.T) {
 
 			<-done
 
-			if len(tt.wantConfig.ssh) != 0 || tt.wantConfig.regexMatch != "" {
-				got := sshConfigFileRead(t, sshConfigName)
+			if len(tt.wantConfig.ssh) != 0 || tt.wantConfig.regexMatch != "" || len(tt.wantConfig.notWant) != 0 {
+				full := sshConfigFileRead(t, sshConfigName)
+				got := full
 				// Require that the generated config has the expected snippets in order.
 				for _, want := range tt.wantConfig.ssh {
 					idx := strings.Index(got, want)
@@ -848,6 +965,9 @@ func TestConfigSSH_FileWriteAndOptionsFlow(t *testing.T) {
 				if tt.wantConfig.regexMatch != "" {
 					assert.Regexp(t, tt.wantConfig.regexMatch, got, "regex match")
 				}
+				for _, notWant := range tt.wantConfig.notWant {
+					assert.NotContains(t, full, notWant, "unexpected snippet found")
+				}
 			}
 		})
 	}