fix(ssh): repair managed Windows SSH config permissions

Repair included fragments with built-in Windows tools and retain best-effort
SSH setup. Inject permission repair as a collaborator so the config writer
stays platform agnostic, skip files whose permissions already verify, and
drive the real Windows tools from the native tests.

Fixes #1108

Generated by Coder Agents.

Author: EhabY

.gitattributes

@@ -1 +1,3 @@
 * text=auto eol=lf
+pnpm-lock.yaml linguist-generated=true
+flake.lock linguist-generated=true

.github/workflows/ci.yaml

@@ -48,6 +48,11 @@ jobs:
               name: Windows,
               electron-version: "latest",
             }
+          - {
+              os: windows-11-arm,
+              name: Windows ARM64,
+              electron-version: "latest",
+            }
           - { os: macos-15, name: macOS, electron-version: "latest" }
 
     steps:
@@ -62,6 +67,7 @@ jobs:
         shell: bash
         env:
           CI: true
+          EXPECTED_ARCH: ${{ runner.arch }}
 
   test-integration:
     name: Integration Test (${{ matrix.name }}, VS Code ${{ matrix.vscode-version }})

.prettierrc.json

@@ -1,7 +1,7 @@
 {
 	"overrides": [
 		{
-			"files": "*.jsonc",
+			"files": ["*.jsonc", "assets/wsh/acl.js"],
 			"options": {
 				"trailingComma": "none"
 			}

.vscodeignore

@@ -5,6 +5,7 @@ coverage/**
 
 # Development files
 src/**
+assets/wsh/tsconfig.json
 test/**
 scripts/**
 **/*.ts

CHANGELOG.md

@@ -5,6 +5,16 @@
      from published versions since it shows up in the VS Code extension changelog
      tab and is confusing to users. Add it back between releases if needed. -->
 
+## Unreleased
+
+### Fixed
+
+- Repair permissions on Coder-managed Windows SSH config files, including other
+  deployments' files matched by the shared Include. This fixes connections blocked
+  by inherited permissions or stale account access in an unrelated config. The
+  main SSH config and directory permissions are left unchanged. If repair fails,
+  log a warning and still attempt the SSH connection.
+
 ## [v1.16.3](https://github.com/coder/vscode-coder/releases/tag/v1.16.3) 2026-09-14
 
 ### Changed

CONTRIBUTING.md

@@ -213,6 +213,26 @@ Alternatively:
 4. If your change is something users ought to be aware of, add an entry in the
    changelog.
 
+### Windows SSH config permissions
+
+Repair requires Windows Script Host, JScript, and ADSI to be allowed by policy.
+The extension does not request elevation or bypass policy. A standard user can
+repair files when they have access to read and change the DACL (`READ_CONTROL`
+and `WRITE_DAC`). If repair fails, it logs a warning and still attempts the SSH
+connection, which OpenSSH may then reject. Write and rename failures still stop
+setup. If the script fails after inheritance is disabled, copied grants remain
+until a successful retry; access is not reset to the parent's permissions.
+
+`assets/wsh/acl.js` ships as source in the universal VSIX and runs under Windows
+Script Host, so it uses ES3 syntax rather than Node.js. Its sibling
+`tsconfig.json` and `globals.d.ts` keep the WScript and ADSI types out of the
+extension's Node.js environment; `pnpm typecheck` covers both. Typechecking does
+not transpile the asset, so keep indexed loops: `for...of` fails the ES3 lint
+check. A typecheck is not a runtime compatibility check, so `acl.native.test.ts`
+drives the real `icacls.exe`, `cscript.exe`, and `ssh.exe` instead of mocks. It
+runs whenever the tests run on Windows, including x64 and ARM64 in CI, and needs
+the OpenSSH client installed.
+
 ## Node.js Version
 
 This extension targets the Node.js version bundled with VS Code's Electron:

assets/wsh/acl.js

@@ -0,0 +1,87 @@
+/** Windows Script Host runs this source directly using ES3-compatible JScript. */
+/**
+ * Treat the target as a filesystem path, not a registry key or share.
+ * @see https://learn.microsoft.com/en-us/windows/win32/api/iads/ne-iads-ads_pathtype_enum
+ */
+var ADS_PATH_FILE = 1;
+/**
+ * Use the ADSI descriptor object so its DACL can be replaced.
+ * @see https://learn.microsoft.com/en-us/windows/win32/api/iads/ne-iads-ads_sd_format_enum
+ */
+var ADS_SD_FORMAT_IID = 1;
+/**
+ * Read and write only the DACL, preserving ownership and audit settings.
+ * @see https://learn.microsoft.com/en-us/windows/win32/api/iads/ne-iads-ads_security_info_enum
+ */
+var ADS_SECURITY_INFO_DACL = 4;
+/**
+ * Revision 2 supports the ordinary, non-object ACEs used for this file.
+ * @see https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-acl
+ */
+var ACL_REVISION = 2;
+/**
+ * Grant full file access to the three permitted trustees.
+ * @see https://learn.microsoft.com/en-us/windows/win32/fileio/file-access-rights-constants
+ */
+var FILE_ALL_ACCESS = 0x1f01ff;
+/**
+ * Numeric SID syntax avoids localized account-name resolution.
+ * @see https://learn.microsoft.com/en-us/windows/win32/secauthz/sid-components
+ */
+var USER_SID_PATTERN = /^S-\d+(?:-\d+)+$/;
+
+try {
+	if (WScript.Arguments.length !== 2) {
+		throw new Error("Expected a file path and user SID");
+	}
+	var target = WScript.Arguments.Item(0);
+	var sid = WScript.Arguments.Item(1);
+	if (!USER_SID_PATTERN.test(sid)) {
+		throw new Error("Invalid Windows user SID");
+	}
+
+	// Replace the file DACL through built-in ADSI without changing its owner.
+	// https://learn.microsoft.com/en-us/windows/win32/api/iads/nn-iads-iadssecurityutility
+	var security = new ActiveXObject("ADsSecurityUtility");
+	security.SecurityMask = ADS_SECURITY_INFO_DACL;
+	var descriptor = security.GetSecurityDescriptor(
+		target,
+		ADS_PATH_FILE,
+		ADS_SD_FORMAT_IID
+	);
+	var dacl = new ActiveXObject("AccessControlList");
+	dacl.AclRevision = ACL_REVISION;
+	// Permit the current user, SYSTEM, and the local Administrators group.
+	// https://learn.microsoft.com/en-us/windows/win32/secauthz/well-known-sids
+	var trustees = [sid, "S-1-5-18", "S-1-5-32-544"];
+	// Keep indexed iteration: this source is not transpiled, and ES3 has no for...of.
+	for (var index = 0; index < trustees.length; index++) {
+		var ace = new ActiveXObject("AccessControlEntry");
+		ace.Trustee = trustees[index];
+		ace.AccessMask = FILE_ALL_ACCESS;
+		// An allow ACE with no inheritance flags applies only to this file.
+		// https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-ace_header
+		ace.AceType = 0;
+		ace.AceFlags = 0;
+		dacl.AddAce(ace);
+	}
+	descriptor.DiscretionaryAcl = dacl;
+	security.SetSecurityDescriptor(
+		target,
+		ADS_PATH_FILE,
+		descriptor,
+		ADS_SD_FORMAT_IID
+	);
+} catch (error) {
+	/**
+	 * Automation errors carry `description` rather than `message`.
+	 * @see https://learn.microsoft.com/en-us/openspecs/ie_standards/ms-es3ex/a4f75a6b-dda5-40e1-85d0-9f95afb24fba
+	 * @type {any}
+	 */
+	var thrown = error;
+	WScript.StdErr.WriteLine(
+		"Windows ACL repair failed: " +
+			((thrown && (thrown.message || thrown.description)) || thrown)
+	);
+	WScript.Quit(1);
+}

assets/wsh/globals.d.ts

@@ -0,0 +1,61 @@
+/** Globals provided by Windows Script Host, not by Node.js. */
+declare var WScript: WScriptHost;
+/** Construct only the ADSI Automation objects used by the ACL setter. */
+declare var ActiveXObject: ActiveXObjectConstructor;
+
+interface WScriptHost {
+	/** Positional command-line arguments after the script path. */
+	Arguments: {
+		length: number;
+		Item(index: number): string;
+	};
+	/** Diagnostic output captured by the extension. */
+	StdErr: {
+		WriteLine(message: string): void;
+	};
+	Quit(exitCode: number): void;
+}
+
+interface ActiveXObjectConstructor {
+	new (programId: "ADsSecurityUtility"): ADsSecurityUtility;
+	new (programId: "AccessControlList"): AccessControlList;
+	new (programId: "AccessControlEntry"): AccessControlEntry;
+}
+
+interface ADsSecurityUtility {
+	/** Select which security descriptor sections to read and write. */
+	SecurityMask: number;
+	GetSecurityDescriptor(
+		path: string,
+		pathType: number,
+		format: number,
+	): SecurityDescriptor;
+	/** Persist only the sections selected by SecurityMask. */
+	SetSecurityDescriptor(
+		path: string,
+		pathType: number,
+		securityDescriptor: SecurityDescriptor,
+		format: number,
+	): void;
+}
+
+interface SecurityDescriptor {
+	/** File access rules, separate from ownership and audit settings. */
+	DiscretionaryAcl: AccessControlList;
+}
+
+interface AccessControlList {
+	/** Set to 2 for ordinary file ACEs. */
+	AclRevision: number;
+	AddAce(accessControlEntry: AccessControlEntry): void;
+}
+
+interface AccessControlEntry {
+	/** SID or account name receiving this rule. */
+	Trustee: string;
+	AccessMask: number;
+	/** 0 is access allowed. */
+	AceType: number;
+	/** 0 limits the rule to this file. */
+	AceFlags: number;
+}

assets/wsh/tsconfig.json

@@ -0,0 +1,13 @@
+{
+	"compilerOptions": {
+		"allowJs": true,
+		"checkJs": true,
+		"noEmit": true,
+		"strict": true,
+		"ignoreDeprecations": "6.0",
+		"target": "ES5",
+		"lib": ["ES5"],
+		"types": []
+	},
+	"files": ["acl.js", "globals.d.ts"]
+}

eslint.config.mjs

@@ -179,6 +179,19 @@ export default defineConfig(
 		},
 	},
 
+	// Windows Script Host runs JScript with ES3 syntax and globals.
+	{
+		files: ["assets/wsh/acl.js"],
+		languageOptions: {
+			ecmaVersion: 3,
+			sourceType: "script",
+			globals: {
+				ActiveXObject: "readonly",
+				WScript: "readonly",
+			},
+		},
+	},
+
 	// Build config - ESM with Node globals
 	{
 		files: ["esbuild.mjs", "scripts/*.mjs", ".storybook/themes/*.{mjs,cjs}"],