fix(ssh): repair managed Windows SSH config permissions - #1110

Summary

Fixes #1108. On Windows, OpenSSH refuses to read an Include when any file it matches is too permissive, so connections fail with Bad owner or permissions. This repairs the permissions of the extension's own SSH config directory using built-in commands, with no Windows Script Host, ADSI, native dependency, or elevation.

• Before each managed write, run whoami.exe to find the current user, then icacls.exe /reset and /inheritance:r /grant:r on %APPDATA%\coder.coder-remote\ssh. Only that user, SYSTEM, and Administrators keep inheritable full control.
• Reset every direct *.conf match to inherit the directory, which also repairs other deployments and editors on the first connection after an upgrade, plus the temporary file before its rename.
• Check command exit codes. Never read ACLs back or parse SDDL.
• Reject links and non-files before the repair, and leave your own SSH config and anything outside the managed directory alone.

SshConfig takes an optional ManagedPermissions. Its absence is the marker for "not Coder-managed", which is why it has no no-op default: a default would make the extension enumerate ~/.ssh on every save on every platform. createManagedPermissions() returns undefined off Windows, so the whole repair path stays Windows-only.

What each file changes

Total: 865 added, 16 removed across 13 files.

Simplification pass

The last commit reworks the first implementation rather than adding to it:

• Replaced the stateful WindowsAcl class with a WINDOWS_ACL const holding two functions. The old class tracked the last prepared directory so that secure() could refuse a file outside it, but SshConfig.save() is the only caller and already calls them in order. Removing that state removed three tests with it.
• Folded parseWhoamiUserSid into currentUserSid and stopped exporting isFullyQualifiedWindowsPath, which existed only so a test could assert on it. The same decision is reachable through WINDOWS_ACL.secure().
• Renamed FilePermissions to ManagedPermissions. It prepares a directory, so "File" was wrong, and the name now hints that absence means unmanaged.
• Flattened src/remote/windows/acl.ts to src/remote/windowsAcl.ts, since the directory held one file.
• Cut the test files from 721 to 592 lines with the same coverage. Rejection cases became it.each tables, command assertions became flat transcript strings instead of nested arrays, and the 60-second native test lost a duplicate fixture.
• Shortened the CONTRIBUTING.md section and rewrote the changelog entry around the error users see.

Validation

• pnpm test: 2,710 passed, 6 skipped, 181 files. The native Windows tests are among the skips on Linux.
• pnpm typecheck and pnpm lint pass.
• Windows CI covers x64 and ARM64.
• Checked the *.conf directory case against OpenSSH 9.6p1 on Linux: glibc opens a directory successfully, so OpenSSH reads zero lines and ignores it unless it is group-writable or unreadable. The Windows CRT fails the open instead, which aborts the whole Include, so the extension reports that entry rather than trying to fix it with an ACL change.

Limits

A directory-preparation failure stops the write. A single file-reset failure logs a warning and still attempts the connection, so OpenSSH may reject a fragment the repair missed. The two directory commands are not atomic: a failure after /reset can leave the directory with its parent's grants. The path and link checks stop mistakes, not an attacker racing the check.

Generated by Coder Agents on behalf of @EhabY.