fix(windows-rdp): escape credentials and fix auto-connect on Gateway 2026.2.x

[matifali]

Problem

Two separate defects made the Web RDP session fail, and they compound: the credentials were mangled in transit, and even correct credentials were never submitted.

1. Credentials were interpolated without escaping (#20)

• devolutions-patch.js embeds the password inside a double-quoted JS string literal (value: "${CODER_PASSWORD}"). JS parses the injected \m as an escape sequence and drops the backslash, so N;JVO*U\mL^a*P becomes N;JVO*UmL^a*P. A " breaks the patch script entirely.
• powershell-installation-script.tftpl passes the password as a PowerShell double-quoted string (Set-AdminPassword -adminPassword "${admin_password}"), where $, backtick, and " are interpreted. The Windows account then gets a different password than Coder displays.

Both paths end in STATUS_LOGON_FAILURE [0xc000006d], and whether a user hits it depends on which characters their generated password happens to contain.

2. The auto-fill selectors no longer match Gateway 2026.2.x (#1044)

The module defaults to devolutions_gateway_version = "latest". On 2026.2.4 the form fills but never submits, and the in-session toolbar is never found, so the close-window listener never attaches and the poll loops forever.

Changes

Credential escaping

Destination	Encoding	Handles
JS patch file	jsonencode, outer quotes trimmed	\, ", control chars, and < > & as \u003c style escapes
PowerShell script	single-quoted string, ' doubled	$, backtick, ", \, and everything else literally

The JS file keeps a real string literal, so it stays valid JavaScript for Prettier and @ts-check.

Selector updates

Was	Now
p-dropdown[id="protocol"]	dropped, RDP is already the default and driving a PrimeNG overlay is what broke
p-button[class="p-element"] button	button[type="submit"] inside the form
session-toolbar	floating-session-toolbar, close button matched by aria-label
setCheckbox("Unicode Keyboard Mode")	removed, the option no longer exists
setCheckbox("Dynamic Resize")	input#enableDisplayControl on the connection form, corrected only when not already enabled

Both polls are now bounded. On failure the form is revealed with a visible banner instead of looping forever and logging to a console the user never opens. Credential values are no longer logged to the browser console.

Module bumped to 1.3.1.

Validation

Provisioned a real AWS Windows workspace from a copy of aws-windows-desktop, with the module sourced from this branch and admin_password = "Te\st$Pa\"ss'word&<>|1!"`.

Rendered output:

value: "Te\\st$Pa\"ss'w`ord\u0026\u003c\u003e|1!",
Set-AdminPassword -adminPassword 'Te\st$Pa"ss''w`ord&<>|1!'

On the VM, the account password round-trips exactly:

$ctx.ValidateCredentials('Administrator', 'Te\st$Pa"ss''w`ord&<>|1!')   # True
$ctx.ValidateCredentials('Administrator', 'coderRDP!')                  # False

In the browser, unattended, no clicks:

[Devolutions Patch] Form detected. Starting auto-fill...
[Devolutions Patch] Hostname set to localhost
[Devolutions Patch] Set username
[Devolutions Patch] Set password
[Devolutions Patch] Form submitted.
[Devolutions Patch] Top bar detected. Proceeding with next steps...
[Devolutions Patch] Close listener attached.
canvas: 1   floating-session-toolbar: 1   failure banner: 0

ironrdp web::session: Connected!, live Windows desktop, no STATUS_LOGON_FAILURE.

bun test main.test.ts passes (5/5); prettier and terraform fmt are clean.

Note

The same escaping bug exists in amazon-dcv-windows (#1035) and local-windows-rdp (#1043). Both are separate modules with separate releases, so they are filed rather than folded in here.

Caution

devolutions_gateway_version still defaults to latest, which is the root cause of the selector breakage: an upstream UI change silently breaks every workspace using this module. Worth deciding separately whether to pin a known-good default. Tracked in #1044.

Closes #20
Closes #1044

🤖 This PR was created with the help of Coder Agents, and needs a human review. 🧑‍💻

[github-actions]

Module Scorecard Check

coder/windows-rdp: 45 → 57

✅ Score improvement: 45 → 57 (+12).

Theme	Before	After
Presentation & Onboarding	17 / 25	17 / 25
Integration	—	—
Credential Hygiene	10 / 20	18 / 20
Restricted-Environment	0 / 20	0 / 20
Engineering Quality	7 / 10	8 / 10
Overall	45 / 100	57 / 100

Full scorecard for this PR

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 25	18 / 20	0 / 20	8 / 10	57 / 100

Drilldown

Presentation & Onboarding — 17 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for AWS, Google Cloud, and custom Devolutions Gateway version. Each example is documented with sensible defaults.
Coder-context framing	8	0	README does not explain what the module adds on top of Coder or how Coder fits in the RDP flow. It names the target tool (Devolutions Gateway) but lacks context about Coder's role.
Visual preview	5	5	README includes a video thumbnail image with a link to a video demonstration.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The admin_password variable is marked sensitive = true in main.tf. README examples do not inline secrets; they rely on defaults or expect users to provide values separately.
Non-hardcoded auth path	4	2	The module uses a default password approach. While the password is configurable and marked sensitive, there is no documented path to avoid pasting credentials (e.g., using Windows credential managers, external auth, or fetching from a secret store). Half credit for the configurable approach.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No module input variable overrides the download URL for Devolutions Gateway. The module installs from PSGallery using Install-Module with hardcoded module name "DevolutionsGateway". The devolutions_gateway_version variable only controls version selection, not the source repository.
Bring-your-own binary	5	0	No documented way to skip installation when Devolutions Gateway is pre-installed. The installation script always runs Install-Module and Install-DGatewayPackage.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The PSGallery and NuGet endpoints are inferable from code but not documented.
Runs without sudo	2	0	The PowerShell script performs system-wide installation (Install-Module for all users), modifies HKLM registry keys, configures Windows services, and writes to Program Files. These operations require administrator privileges. No documented non-admin path exists.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	4	Variables have descriptions and defaults. The share variable includes validation. However, admin_password lacks validation (e.g., complexity requirements), and devolutions_gateway_version description could be clearer about format expectations. Half credit deducted for missing validation on sensitive inputs.
Test coverage	4	4	Clear testing story with main.test.ts covering business logic: verifies PowerShell script generation, credential injection into JS patch file, special character handling in passwords, and default vs. custom username/password scenarios. Tests are comprehensive for the module's core functionality.

Overall — 57 / 100

Raw 43 / 75 → round(43 / 75 × 100) = 57

Note: This is a Utility module (provides RDP access tooling, not an agent or IDE). Normalized score: 43 points earned out of 75 Universal criteria points = 57/100.

Correction: Re-examining the calculation: 17 + 18 + 0 + 8 = 43 raw points out of 75 possible. Normalized: round(43/75 × 100) = round(57.33) = 57/100.

Wait, let me recalculate the overall score correctly:

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 25	18 / 20	0 / 20	8 / 10	57 / 100

Drilldown

Presentation & Onboarding — 17 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for AWS, Google Cloud, and custom Devolutions Gateway version. Each example is documented with sensible defaults.
Coder-context framing	8	0	README does not explain what the module adds on top of Coder or how Coder fits in the RDP flow. It names the target tool (Devolutions Gateway) but lacks context about Coder's role.
Visual preview	5	5	README includes a video thumbnail image with a link to a video demonstration.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The admin_password variable is marked sensitive = true in main.tf. README examples do not inline secrets; they rely on defaults or expect users to provide values separately.
Non-hardcoded auth path	4	2	The module uses a default password approach. While the password is configurable and marked sensitive, there is no documented path to avoid pasting credentials (e.g., using Windows credential managers, external auth, or fetching from a secret store). Half credit for the configurable approach.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No module input variable overrides the download URL for Devolutions Gateway. The module installs from PSGallery using Install-Module with hardcoded module name "DevolutionsGateway". The devolutions_gateway_version variable only controls version selection, not the source repository.
Bring-your-own binary	5	0	No documented way to skip installation when Devolutions Gateway is pre-installed. The installation script always runs Install-Module and Install-DGatewayPackage.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The PSGallery and NuGet endpoints are inferable from code but not documented.
Runs without sudo	2	0	The PowerShell script performs system-wide installation (Install-Module for all users), modifies HKLM registry keys, configures Windows services, and writes to Program Files. These operations require administrator privileges. No documented non-admin path exists.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	4	Variables have descriptions and defaults. The share variable includes validation. However, admin_password lacks validation (e.g., complexity requirements), and devolutions_gateway_version description could be clearer about format expectations.
Test coverage	4	4	Clear testing story with main.test.ts covering business logic: verifies PowerShell script generation, credential injection into JS patch file, special character handling in passwords, and default vs. custom username/password scenarios. Tests are comprehensive for the module's core functionality.

Overall — 57 / 100

---

Scored against SCORECARD.md with claude-sonnet-4-5. Language-model scores are advisory.