fix(ssh): repair managed Windows SSH config permissions

[EhabY]

Summary

Fixes #1108. Windows files inherit their permissions from the directory they live in, so a config the extension generates under %APPDATA%\coder.coder-remote\ssh can end up readable by other accounts. OpenSSH rejects such a file with Bad owner or permissions and skips the whole Include, so one bad file blocks every Coder host, not just the one it came from.

Before each managed write, the extension locks that directory down with built-in commands and lets its files inherit from it. No Windows Script Host, ADSI, native dependency, or elevation:

Step	Command
Read the current user's SID	whoami.exe /user /fo csv /nh
Clear the directory's own grants	icacls.exe <dir> /reset
Grant that user, SYSTEM, and Administrators full control	icacls.exe <dir> /inheritance:r /grant:r <trustee>
Clear each *.conf file so it inherits the directory	icacls.exe <file> /reset

• Resetting every direct *.conf match, not only the file being written, also repairs other deployments and editors on the first connection after an upgrade. The temporary file is reset before its rename.
• Check command exit codes. Never read ACLs back or parse SDDL.
• Reject links and non-files before the repair, and leave your own SSH config and anything outside the managed directory alone.

SshConfig takes an optional ManagedPermissions. Its absence is the marker for "not Coder-managed", which is why it has no no-op default: a default would make the extension enumerate ~/.ssh on every save on every platform. createManagedPermissions() returns undefined off Windows, so the whole repair path stays Windows-only.

What each file changes

File	What it does
src/remote/windowsAcl.ts	New. Exports WINDOWS_ACL, createManagedPermissions, and system32; everything else is private, ordered by first use.
src/remote/sshConfig.ts	Adds the ManagedPermissions interface, splits save() into getFileMode, repairIncludedFiles, writeTemp, repairPermissions, and replaceWithTemp, and makes the temp write exclusive (wx).
src/remote/remote.ts	Passes createManagedPermissions() to the per-deployment SshConfig.
Tests	23 cases over mocked icacls.exe and whoami.exe, 5 against the real tools and OpenSSH (skipped off Windows), 9 for the managed-permissions path in sshConfig, and a global setup that fails the run when process.arch does not match EXPECTED_ARCH.
CI	Adds the windows-11-arm unit test job and the two speedups below.
Docs	CONTRIBUTING.md for the approach and its limits, CHANGELOG.md for the user-facing fix.

.gitattributes and .vscodeignore pick up a generated-file marker and a trailing newline, unrelated to the fix. Total: 884 added, 20 removed across 15 files.

CI

The new ARM64 job took 11m15s against 3m10s for x64, all of it in dependency install, while the test run itself matched x64 to within four seconds.

Cold store	Before	After
pnpm install	8m06s	2m04s
Setup step	8m39s	2m31s
Job total	11m15s	5m14s

• Neither bufferutil nor utf-8-validate ships a win32-arm64 prebuild, so pnpm compiled both with node-gyp on every cold install, 4m25s of it. Both ship a JavaScript fallback, and the VSIX carries no .node file, so allowBuilds now denies their build scripts. Platforms with a prebuild are unaffected: node-gyp-build still finds the binary at require time, and its install script was already a no-op there.
• setup-node's pnpm cache restores on an exact lockfile hash, so a dependency bump refetched the whole store on every runner. pnpm/action-setup, already pinned here, caches the store under the same hash but falls back to the last store for the platform, so a bump fetches only what changed.

What remains is the runner image. ARM64 has no D: scratch disk, so the workspace and the pnpm store both sit on the network-backed OS disk: linking 856 packages costs about two minutes there against nine seconds on x64, warm or cold.

Simplification pass

The ACL commit reworks the first implementation rather than adding to it:

• Replaced the stateful WindowsAcl class with a WINDOWS_ACL const holding two functions. The old class tracked the last prepared directory so that secure() could refuse a file outside it, but SshConfig.save() is the only caller and already calls them in order. Removing that state removed three tests with it.
• Folded parseWhoamiUserSid into currentUserSid and stopped exporting isFullyQualifiedWindowsPath, which existed only so a test could assert on it. The same decision is reachable through WINDOWS_ACL.secure().
• Renamed FilePermissions to ManagedPermissions. It prepares a directory, so "File" was wrong, and the name now hints that absence means unmanaged.
• Flattened src/remote/windows/acl.ts to src/remote/windowsAcl.ts, since the directory held one file.
• Cut the test files from 721 to 592 lines with the same coverage. Rejection cases became it.each tables, command assertions became flat transcript strings instead of nested arrays, and the 60-second native test lost a duplicate fixture.
• Shortened the CONTRIBUTING.md section and rewrote the changelog entry around the error users see.

Validation

• pnpm test: 2,751 passed, 6 skipped, 187 files. The native Windows tests are among the skips on Linux.
• pnpm typecheck, pnpm lint, and pnpm format:check pass.
• Windows CI covers x64 and ARM64, both green on a cold pnpm store.
• Checked the *.conf directory case against OpenSSH 9.6p1 on Linux: glibc opens a directory successfully, so OpenSSH reads zero lines and ignores it unless it is group-writable or unreadable. The Windows CRT fails the open instead, which aborts the whole Include, so the extension reports that entry rather than trying to fix it with an ACL change.

Limits

A directory-preparation failure stops the write. A single file-reset failure logs a warning and still attempts the connection, so OpenSSH may reject a fragment the repair missed. The two directory commands are not atomic: a failure after /reset can leave the directory with its parent's grants. The path and link checks stop mistakes, not an attacker racing the check.

Generated by Coder Agents on behalf of @EhabY.

[phorcys420]

is there any reason you didn't use the icacls utility or PowerShell's Set-Acl all the way to set the permissions instead of depending on JScript (assets/wsh/acl.js)?

Scripts ran by the Windows Script Host are super sketchy patterns that AVs love to flag for no reason. Spawning PowerShell is similar but less so.

[EhabY]

Simplified this a lot more by removing the pre/post ACL checks that ran to make sure everything was applied correctly. We now apply this on all runs on Windows (which takes the same amount of time as the check anyway). The only windows specific logic is in windowsAcl.ts!