fix(ssh): simplify Windows ACL repair with directory inheritance

Replace the WSH setter and runtime ACL parsing with checked icacls commands. Repair existing deployment fragments on upgrade, retain path and link guards, and consolidate ACL helpers and tests.

Author: EhabY

.github/workflows/ci.yaml

@@ -174,17 +174,6 @@ jobs:
       - name: Package extension
         run: pnpm vsce package --no-dependencies --out "${{ steps.setup.outputs.packageName }}"
 
-      # Repair degrades to a logged warning when the script is absent, so a
-      # dropped asset would not fail any other check.
-      - name: Verify the Windows ACL script shipped
-        env:
-          PACKAGE: ${{ steps.setup.outputs.packageName }}
-        run: |
-          if ! unzip -l "$PACKAGE" | grep -q "extension/assets/wsh/acl.js"; then
-            echo "::error::assets/wsh/acl.js is missing from the VSIX. Check .vscodeignore."
-            exit 1
-          fi
-
       - name: Upload artifact (PR)
         if: github.event_name == 'pull_request'
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

.prettierrc.json

@@ -1,7 +1,7 @@
 {
 	"overrides": [
 		{
-			"files": ["*.jsonc", "assets/wsh/acl.js"],
+			"files": "*.jsonc",
 			"options": {
 				"trailingComma": "none"
 			}

.vscodeignore

@@ -5,7 +5,6 @@ coverage/**
 
 # Development files
 src/**
-assets/wsh/tsconfig.json
 test/**
 scripts/**
 **/*.ts

CHANGELOG.md

@@ -21,11 +21,10 @@
   replay the buffered connection logs instead. Close codes never reached the
   reconnect logic, so these closes retried forever. Server-initiated normal
   closes (`1000`/`1001`) keep reconnecting.
-- Repair permissions on Coder-managed Windows SSH config files, including other
-  deployments' files matched by the shared Include. This fixes connections blocked
-  by inherited permissions or stale account access in an unrelated config. The
-  main SSH config and directory permissions are left unchanged. If repair fails,
-  log a warning and still attempt the SSH connection.
+- Repair permissions on the Windows SSH config files the extension generates,
+  so connections stop failing with "Bad owner or permissions". Only you,
+  SYSTEM, and Administrators keep access to them. The extension leaves your own
+  SSH config untouched and needs no admin rights.
 
 ## [v1.16.3](https://github.com/coder/vscode-coder/releases/tag/v1.16.3) 2026-09-14
 

CONTRIBUTING.md

@@ -89,23 +89,38 @@ file to display network information.
 
 ### Windows SSH config permissions
 
-Repair requires Windows Script Host, JScript, and ADSI to be allowed by policy.
-The extension does not request elevation or bypass policy. A standard user can
-repair files when they have access to read and change the DACL (`READ_CONTROL`
-and `WRITE_DAC`). If repair fails, it logs a warning and still attempts the SSH
-connection, which OpenSSH may then reject. Write and rename failures still stop
-setup. If the script fails after inheritance is disabled, copied grants remain
-until a successful retry; access is not reset to the parent's permissions.
-
-`assets/wsh/acl.js` ships as source in the universal VSIX and runs under Windows
-Script Host, so it uses ES3 syntax rather than Node.js. Its sibling
-`tsconfig.json` and `globals.d.ts` keep the WScript and ADSI types out of the
-extension's Node.js environment; `pnpm typecheck` covers both. Typechecking does
-not transpile the asset, so keep indexed loops: `for...of` fails the ES3 lint
-check. A typecheck is not a runtime compatibility check, so `acl.native.test.ts`
-drives the real `icacls.exe`, `cscript.exe`, and `ssh.exe` instead of mocks. It
-runs whenever the tests run on Windows, including x64 and ARM64 in CI, and needs
-the OpenSSH client installed.
+Windows files inherit their permissions from the directory they live in, so a
+config the extension generates under `%APPDATA%\coder.coder-remote\ssh` can end
+up readable by other accounts. OpenSSH rejects such a file with "Bad owner or
+permissions" and skips the whole `Include`, which blocks every Coder host, not
+just the one it came from.
+
+Before each managed write, `src/remote/windowsAcl.ts` locks the directory down
+and lets its files inherit from it:
+
+| Step                                                     | Command                                              |
+| -------------------------------------------------------- | ---------------------------------------------------- |
+| Read the current user's SID                              | `whoami.exe /user /fo csv /nh`                       |
+| Clear the directory's own grants                         | `icacls.exe <dir> /reset`                            |
+| Grant that user, SYSTEM, and Administrators full control | `icacls.exe <dir> /inheritance:r /grant:r <trustee>` |
+| Clear each `*.conf` file so it inherits the directory    | `icacls.exe <file> /reset`                           |
+
+Resetting every `*.conf` file, not only the one being written, also repairs
+files left behind by other deployments and editors.
+
+Worth knowing:
+
+- Like VS Code, the code checks exit codes but never reads ACLs back. It needs
+  no script, native module, ownership change, or elevation, and it leaves the
+  user's own SSH config alone.
+- Links and non-files are rejected before the repair, because inheritable
+  grants reach children even without `/T`. That stops mistakes, not an attacker
+  racing the check.
+- The repair is not atomic: a failure after `/reset` can leave the directory
+  with its parent's grants.
+
+`windowsAcl.native.test.ts` drives the real `icacls.exe`, `whoami.exe`, and
+OpenSSH. Run it unelevated as well as in CI to catch privilege assumptions.
 
 ## Other features
 

assets/wsh/acl.js

@@ -77,19 +77,6 @@ export default defineConfig(
 		},
 	},
 
-	// Windows Script Host runs JScript with ES3 syntax and globals.
-	{
-		files: ["assets/wsh/acl.js"],
-		languageOptions: {
-			ecmaVersion: 3,
-			sourceType: "script",
-			globals: {
-				ActiveXObject: "readonly",
-				WScript: "readonly",
-			},
-		},
-	},
-
 	// Package.json linting.
 	packageJson.configs.recommended,
 	{

assets/wsh/globals.d.ts

@@ -38,7 +38,7 @@
 		"test:extension": "cross-env ELECTRON_RUN_AS_NODE=1 electron node_modules/vitest/vitest.mjs --project extension",
 		"test:integration": "pnpm build:test && node esbuild.mjs && vscode-test",
 		"test:webview": "cross-env ELECTRON_RUN_AS_NODE=1 electron node_modules/vitest/vitest.mjs --project webview",
-		"typecheck": "concurrently -g -n extension,tests,packages,storybook,windows-acl \"tsc --noEmit\" \"tsc --noEmit -p test\" \"pnpm typecheck:packages\" \"tsc --noEmit -p .storybook\" \"tsc -p assets/wsh/tsconfig.json\"",
+		"typecheck": "concurrently -g -n extension,tests,packages,storybook \"tsc --noEmit\" \"tsc --noEmit -p test\" \"pnpm typecheck:packages\" \"tsc --noEmit -p .storybook\"",
 		"typecheck:packages": "pnpm -r --filter \"./packages/*\" --parallel typecheck",
 		"watch": "concurrently -g -n extension,webviews \"pnpm watch:extension\" \"pnpm watch:webviews\"",
 		"watch:extension": "node esbuild.mjs --watch",