feat(pam): add RDP CLI access and recording chunk batching by bernie-g · Pull Request #269 · Infisical/cli

bernie-g · 2026-06-19T00:46:07Z

Context

Adds CLI support for PAM RDP sessions and caps recording chunk size with batched live uploads.
https://linear.app/infisical/issue/PAM-263/add-windows-account-rdp-web-and-cli

Type

…y from Cloudsmith - Added a notice in the README about the migration to `artifacts-cli.infisical.com` and the impending shutdown of Cloudsmith. - Implemented a one-time daily notice in the CLI for users regarding the repository migration, including a link to the migration guide. - Introduced caching for the migration notice to prevent repeated prompts within a 24-hour period. - Added a manual test for the migration notice display functionality.

…ransition from Cloudsmith - Revised README to clarify the migration of the Infisical CLI Linux package repository to `artifacts-cli.infisical.com`, including the shutdown date for Cloudsmith. - Updated the migration guide URL in the code and added a new constant for the Cloudsmith sunset date. - Enhanced the CLI migration notice to provide clearer instructions for users on repointing their machines and the implications of the migration.

…ation notice code - Added an integrity check in the APK upload script to ensure that the number of APKs in the staging area matches the count in S3 before proceeding with the sync, preventing incomplete uploads. - Simplified comments in the migration notice display function to improve clarity and removed the manual test file for the migration notice.

…sage docs: update README and CLI to reflect migration of Linux package repositoy from Cloudsmith

…ublishing packages. This step ensures sufficient storage by removing unnecessary directories, improving the overall build process efficiency.

fix(release): Enhance release workflow by adding a step to free disk space before publish

…ds and CloudFront invalidation

fix(release): Set AWS_DEFAULT_REGION in release workflow for S3 uploads and CloudFront invalidation

infisical-review-police · 2026-06-19T00:46:10Z

💬 Discussion in Slack: #pr-review-cli-269-feat-pam-add-rdp-cli-access-and-recording-chunk-batching

Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel.

- Wire Windows/RDP case in StartPAMAccess to use RDPProxyServer - Use gateway disconnect detection so CLI exits on server-side session termination

greptile-apps · 2026-06-19T20:40:46Z

Greptile Summary

This PR activates RDP/Windows PAM sessions through the unified StartPAMAccess path and refactors RDPProxyServer.handleConnection to use the shared NewDisconnectChannels/WaitForDisconnect abstraction that distinguishes gateway-side drops from normal client disconnects.

access.go adds startRDPProxy, wiring Windows accounts into the existing switch-dispatch the same way database accounts are handled; the function is nearly identical to startDatabaseProxy but omits the auto-launch step present in StartRDPLocalProxy.
rdp-proxy.go replaces the old done chan struct{} (buffer 2, both goroutines shared one channel) with separate gatewayErrCh/clientErrCh channels — a meaningful semantic change, because receiving from gatewayErrCh now triggers a full proxy shutdown via HandleGatewayDisconnect, whereas the client-disconnect path just returns. A race exists between the buffered send to gatewayErrCh and the immediately-following defer connCancel(), which can cause the select to resolve on connCtx.Done() instead and silently skip shutdown.

Confidence Score: 3/5

The RDP proxy integration is straightforward, but the refactored disconnect logic in handleConnection has a real concurrency flaw that can leave the proxy alive after the gateway terminates a session.

The gateway-disconnect race in rdp-proxy.go is not theoretical: Go's asynchronous preemption means the scheduler can context-switch between gatewayErrCh <- err and defer connCancel(), making both select cases simultaneously ready. When that happens, Go randomly chooses between them, and if connCtx.Done() wins, the proxy stays running after an admin-forced termination instead of shutting down cleanly. The rest of the change is a faithful port of the database proxy pattern and looks correct.

packages/pam/local/rdp-proxy.go — specifically the select logic change in handleConnection and how WaitForDisconnect interacts with the deferred connCancel in the gateway goroutine.

Important Files Changed

Filename	Overview
packages/pam/local/access.go	Enables Windows/RDP accounts in StartPAMAccess via a new startRDPProxy function that closely mirrors startDatabaseProxy; auto-launch of the RDP client is absent compared to the existing StartRDPLocalProxy entry point
packages/pam/local/rdp-proxy.go	Refactors handleConnection to use NewDisconnectChannels/WaitForDisconnect, introducing a race where connCtx.Done() can be selected over gatewayErrCh and silently skip HandleGatewayDisconnect on a gateway-side drop

_{Reviews (1): Last reviewed commit: "fix(pam): write RDP session banner to st..." | Re-trigger Greptile}

veria-ai · 2026-06-19T20:41:53Z

PR overview

All previously flagged issues have been addressed. No open security concerns remain on this pull request.

Security review

No open security issues remain on this pull request.

Fixed/addressed: 1 · PR risk: 0/10

feat: add PKI HSM option

feat: new export output format for dotenv eval's

Victor Hugo dos Santos and others added 8 commits June 15, 2026 22:46

Merge pull request #265 from Infisical/chore/cloudsmith-migration-mes…

5a3408b

…sage docs: update README and CLI to reflect migration of Linux package repositoy from Cloudsmith

Enhance release workflow by adding a step to free disk space before p…

6682a63

…ublishing packages. This step ensures sufficient storage by removing unnecessary directories, improving the overall build process efficiency.

Merge pull request #267 from Infisical/fix/free-disk-before-publish

6220095

fix(release): Enhance release workflow by adding a step to free disk space before publish

fix(release): Set AWS_DEFAULT_REGION in release workflow for S3 uploa…

a6f37a2

…ds and CloudFront invalidation

Merge pull request #268 from Infisical/fix/add-missing-aws-region

d26ab11

fix(release): Set AWS_DEFAULT_REGION in release workflow for S3 uploads and CloudFront invalidation

carlosmonastyrski and others added 3 commits June 19, 2026 00:49

Add PKI HSM option

6227802

feat(pam): add RDP CLI access and fix session termination handling

b4c53df

- Wire Windows/RDP case in StartPAMAccess to use RDPProxyServer - Use gateway disconnect detection so CLI exits on server-side session termination

fix(pam): write RDP session banner to stderr instead of stdout

8ba7213

bernie-g changed the base branch from main to pam-revamp June 19, 2026 19:28

bernie-g marked this pull request as ready for review June 19, 2026 20:35

greptile-apps Bot reviewed Jun 19, 2026

View reviewed changes

Comment thread packages/pam/local/rdp-proxy.go

Comment thread packages/pam/local/access.go

veria-ai Bot reviewed Jun 19, 2026

View reviewed changes

Comment thread packages/pam/local/access.go

fix(pam): resolve gateway disconnect race in WaitForDisconnect

82425cd

bernie-g requested a review from x032205 June 19, 2026 20:46

carlosmonastyrski and others added 3 commits June 23, 2026 04:08

Address PR comments

6a79849

Address PR comments

815c79f

Merge pull request #270 from Infisical/feat/hsm-pkcs11-handler

6f0348f

feat: add PKI HSM option

x032205 approved these changes Jun 25, 2026

View reviewed changes

varonix0 and others added 5 commits June 25, 2026 18:28

feat: new export output format for dotenv eval's

f9a9f06

Merge pull request #281 from Infisical/daniel/new-export-output

40242cc

feat: new export output format for dotenv eval's

Merge branch 'main' into feat/pam-rdp-cli-access

2c2eb48

Merge branch 'main' into pam-revamp

9f62f9a

Merge branch 'pam-revamp' into feat/pam-rdp-cli-access

60abfbb

x032205 merged commit 3e75e41 into pam-revamp Jun 26, 2026
27 of 28 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(pam): add RDP CLI access and recording chunk batching#269

feat(pam): add RDP CLI access and recording chunk batching#269
x032205 merged 20 commits into
pam-revampfrom
feat/pam-rdp-cli-access

bernie-g commented Jun 19, 2026 •

edited

Loading

Uh oh!

infisical-review-police Bot commented Jun 19, 2026

Uh oh!

greptile-apps Bot commented Jun 19, 2026

Greptile Summary

Uh oh!

Uh oh!

Uh oh!

Uh oh!

veria-ai Bot commented Jun 19, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

bernie-g commented Jun 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Context

Type

Uh oh!

infisical-review-police Bot commented Jun 19, 2026

Uh oh!

greptile-apps Bot commented Jun 19, 2026

Greptile Summary

Confidence Score: 3/5

Important Files Changed

Uh oh!

Uh oh!

Uh oh!

Uh oh!

veria-ai Bot commented Jun 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR overview

Security review

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

bernie-g commented Jun 19, 2026 •

edited

Loading

veria-ai Bot commented Jun 19, 2026 •

edited

Loading