fix(ssh): simplify Windows ACL repair with directory inheritance

Replace the WSH setter and runtime ACL parsing with checked icacls commands. Repair existing deployment fragments on upgrade, retain path and link guards, and consolidate ACL helpers and tests.

Generated by Coder Agents on behalf of @EhabY.

Author: EhabY

.github/workflows/ci.yaml

@@ -174,17 +174,6 @@ jobs:
       - name: Package extension
         run: pnpm vsce package --no-dependencies --out "${{ steps.setup.outputs.packageName }}"
 
-      # Repair degrades to a logged warning when the script is absent, so a
-      # dropped asset would not fail any other check.
-      - name: Verify the Windows ACL script shipped
-        env:
-          PACKAGE: ${{ steps.setup.outputs.packageName }}
-        run: |
-          if ! unzip -l "$PACKAGE" | grep -q "extension/assets/wsh/acl.js"; then
-            echo "::error::assets/wsh/acl.js is missing from the VSIX. Check .vscodeignore."
-            exit 1
-          fi
-
       - name: Upload artifact (PR)
         if: github.event_name == 'pull_request'
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

.prettierrc.json

@@ -1,7 +1,7 @@
 {
 	"overrides": [
 		{
-			"files": ["*.jsonc", "assets/wsh/acl.js"],
+			"files": "*.jsonc",
 			"options": {
 				"trailingComma": "none"
 			}

.vscodeignore

@@ -5,7 +5,6 @@ coverage/**
 
 # Development files
 src/**
-assets/wsh/tsconfig.json
 test/**
 scripts/**
 **/*.ts

CHANGELOG.md

@@ -9,11 +9,10 @@
 
 ### Fixed
 
-- Repair permissions on Coder-managed Windows SSH config files, including other
-  deployments' files matched by the shared Include. This fixes connections blocked
-  by inherited permissions or stale account access in an unrelated config. The
-  main SSH config and directory permissions are left unchanged. If repair fails,
-  log a warning and still attempt the SSH connection.
+- Windows: fixed connections failing with "Bad owner or permissions" on the
+  SSH config files the extension generates. The extension now repairs those
+  permissions on connect, so only you, SYSTEM, and Administrators can read
+  them. Your own SSH config is left untouched, and no admin rights are needed.
 
 ## [v1.16.3](https://github.com/coder/vscode-coder/releases/tag/v1.16.3) 2026-09-14
 

CONTRIBUTING.md

@@ -215,23 +215,24 @@ Alternatively:
 
 ### Windows SSH config permissions
 
-Repair requires Windows Script Host, JScript, and ADSI to be allowed by policy.
-The extension does not request elevation or bypass policy. A standard user can
-repair files when they have access to read and change the DACL (`READ_CONTROL`
-and `WRITE_DAC`). If repair fails, it logs a warning and still attempts the SSH
-connection, which OpenSSH may then reject. Write and rename failures still stop
-setup. If the script fails after inheritance is disabled, copied grants remain
-until a successful retry; access is not reset to the parent's permissions.
-
-`assets/wsh/acl.js` ships as source in the universal VSIX and runs under Windows
-Script Host, so it uses ES3 syntax rather than Node.js. Its sibling
-`tsconfig.json` and `globals.d.ts` keep the WScript and ADSI types out of the
-extension's Node.js environment; `pnpm typecheck` covers both. Typechecking does
-not transpile the asset, so keep indexed loops: `for...of` fails the ES3 lint
-check. A typecheck is not a runtime compatibility check, so `acl.native.test.ts`
-drives the real `icacls.exe`, `cscript.exe`, and `ssh.exe` instead of mocks. It
-runs whenever the tests run on Windows, including x64 and ARM64 in CI, and needs
-the OpenSSH client installed.
+On Windows, the extension writes generated deployment configs to
+`%APPDATA%\coder.coder-remote\ssh`, and OpenSSH refuses to read the whole
+include when any of them is too permissive. Before each managed write,
+`src/remote/windowsAcl.ts` runs `whoami.exe` to find the current user, then
+`icacls.exe /reset` and `/inheritance:r /grant:r` on the directory, so only that
+user, SYSTEM, and Administrators keep inheritable full control. Every `*.conf`
+file in the directory is then reset to inherit it, which also repairs other
+deployments and editors on the first connection after an upgrade.
+
+Like VS Code, the code checks command exit codes but never reads ACLs back. It
+needs no scripts, native addon, ownership change, or elevation, and it leaves
+the user's own SSH config alone. Links and non-files are rejected before the
+repair, because inheritable grants reach children even without `/T`. That stops
+mistakes, not an attacker racing the check. The repair is not atomic either: a
+failure after `/reset` can leave the directory with its parent's grants.
+
+`windowsAcl.native.test.ts` drives the real `icacls.exe`, `whoami.exe`, and OpenSSH.
+Run it unelevated as well as in CI to catch privilege assumptions.
 
 ## Node.js Version
 

assets/wsh/acl.js

@@ -179,19 +179,6 @@ export default defineConfig(
 		},
 	},
 
-	// Windows Script Host runs JScript with ES3 syntax and globals.
-	{
-		files: ["assets/wsh/acl.js"],
-		languageOptions: {
-			ecmaVersion: 3,
-			sourceType: "script",
-			globals: {
-				ActiveXObject: "readonly",
-				WScript: "readonly",
-			},
-		},
-	},
-
 	// Build config - ESM with Node globals
 	{
 		files: ["esbuild.mjs", "scripts/*.mjs", ".storybook/themes/*.{mjs,cjs}"],

assets/wsh/globals.d.ts

@@ -36,7 +36,7 @@
 		"test:extension": "cross-env ELECTRON_RUN_AS_NODE=1 electron node_modules/vitest/vitest.mjs --project extension",
 		"test:integration": "pnpm compile-tests:integration && node esbuild.mjs && vscode-test",
 		"test:webview": "cross-env ELECTRON_RUN_AS_NODE=1 electron node_modules/vitest/vitest.mjs --project webview",
-		"typecheck": "concurrently -g -n extension,tests,packages,storybook,windows-acl \"tsc --noEmit\" \"tsc --noEmit -p test\" \"pnpm typecheck:packages\" \"tsc --noEmit -p .storybook\" \"tsc -p assets/wsh/tsconfig.json\"",
+		"typecheck": "concurrently -g -n extension,tests,packages,storybook \"tsc --noEmit\" \"tsc --noEmit -p test\" \"pnpm typecheck:packages\" \"tsc --noEmit -p .storybook\"",
 		"typecheck:packages": "pnpm -r --filter \"./packages/*\" --parallel typecheck",
 		"watch": "concurrently -g -n extension,webviews \"pnpm watch:extension\" \"pnpm watch:webviews\"",
 		"watch:extension": "node esbuild.mjs --watch",