[bug] Coder Connect on Windows: DNS publishing silently fails — workspace lookups return empty answers despite Connect being on

Resolve-DnsName を使用して fd60:627a:a42b::53 に対する失敗を再現し、その後 Coder Connect Windows service、Wintun adapter、NRPT rule、および CoderVpnService の動作を調査します。workspace.coder へのクエリが IP アドレスを返し、Coder Desktop service を再起動しても adapter、rule、service registration が保持されれば完了です。

Version: 0.8.3 (latest)
OS: Windows 11 Pro 10.0.26200

Symptom

Coder Desktop GUI reports Connect is ON, workspaces are listed, but no workspace hostname (<workspace>.coder) actually resolves via DNS. Apps that rely on Coder Connect for hostname routing (in our case, Claude Desktop's bundled SSH client which cannot use ~/.ssh/config ProxyCommand) time out at the SSH handshake step because no IP is returned.

What's set up correctly

• Wintun adapter "Coder" is Up with a fd60:627a:a42b::/64 IPv6 prefix
• Get-DnsClientNrptRule shows .coder → fd60:627a:a42b::53
• TCP/53 on the Coder DNS server is reachable
• coder users show me succeeds — CLI is authenticated to our deployment

What fails

Direct query to the embedded DNS:

> Resolve-DnsName -Name myworkspace.coder -Server fd60:627a:a42b::53
(empty answer — no IPAddress, no NXDOMAIN)

> ssh -F nul -o ConnectTimeout=15 coder@myworkspace.coder "echo OK"
ssh: Could not resolve hostname myworkspace.coder: No such host is known.

Queries succeed only when going via the ~/.ssh/config ProxyCommand (coder.exe ssh --stdio) — i.e., bypassing Coder Connect entirely. OpenSSH with verbose shows Authenticated to myworkspace.coder (via proxy).

Additional observation

Restarting the "Coder Desktop" Windows service while signed in deletes the Wintun adapter, the NRPT rule, and the CoderVpnService entry. Recovery requires toggling Connect OFF/ON in the tray app — the service restart alone leaves the system in a broken state.

Impact

Any third-party app that integrates with Coder via direct DNS + TCP (no ProxyCommand support) — e.g., Claude Desktop's "Add SSH connection" feature — cannot reach workspaces, even when the GUI says Connect is healthy.