fix(windows-rdp): escape credentials and fix auto-connect on Gateway 2026.2.x

[matifali]

Problem

Two separate defects made the Web RDP session fail, and they compound: the credentials were mangled in transit, and even correct credentials were never submitted.

1. Credentials were interpolated without escaping (#20)

• devolutions-patch.js embeds the password inside a double-quoted JS string literal (value: "${CODER_PASSWORD}"). JS parses the injected \m as an escape sequence and drops the backslash, so N;JVO*U\mL^a*P becomes N;JVO*UmL^a*P. A " breaks the patch script entirely.
• powershell-installation-script.tftpl passes the password as a PowerShell double-quoted string (Set-AdminPassword -adminPassword "${admin_password}"), where $, backtick, and " are interpreted. The Windows account then gets a different password than Coder displays.

Both paths end in STATUS_LOGON_FAILURE [0xc000006d], and whether a user hits it depends on which characters their generated password happens to contain.

2. The auto-fill selectors no longer match Gateway 2026.2.x (#1044)

The module defaults to devolutions_gateway_version = "latest". On 2026.2.4 the form fills but never submits, and the in-session toolbar is never found, so the close-window listener never attaches and the poll loops forever.

Changes

Credential escaping

Destination	Encoding	Handles
JS patch file	jsonencode, outer quotes trimmed	\, ", control chars, and < > & as \u003c style escapes
PowerShell script	single-quoted string, ' doubled	$, backtick, ", \, and everything else literally

The JS file keeps a real string literal, so it stays valid JavaScript for Prettier and @ts-check.

Selector updates

Was	Now
p-dropdown[id="protocol"]	dropped, RDP is already the default and driving a PrimeNG overlay is what broke
p-button[class="p-element"] button	button[type="submit"] inside the form
session-toolbar	floating-session-toolbar, close button matched by aria-label
setCheckbox("Unicode Keyboard Mode")	removed, the option no longer exists
setCheckbox("Dynamic Resize")	input#enableDisplayControl on the connection form, corrected only when not already enabled

Both polls are now bounded. On failure the form is revealed with a visible banner instead of looping forever and logging to a console the user never opens. Credential values are no longer logged to the browser console.

Module bumped to 1.3.1.

Validation

Provisioned a real AWS Windows workspace from a copy of aws-windows-desktop, with the module sourced from this branch and admin_password = "Te\st$Pa\"ss'word&<>|1!"`.

Rendered output:

value: "Te\\st$Pa\"ss'w`ord\u0026\u003c\u003e|1!",
Set-AdminPassword -adminPassword 'Te\st$Pa"ss''w`ord&<>|1!'

On the VM, the account password round-trips exactly:

$ctx.ValidateCredentials('Administrator', 'Te\st$Pa"ss''w`ord&<>|1!')   # True
$ctx.ValidateCredentials('Administrator', 'coderRDP!')                  # False

In the browser, unattended, no clicks:

[Devolutions Patch] Form detected. Starting auto-fill...
[Devolutions Patch] Hostname set to localhost
[Devolutions Patch] Set username
[Devolutions Patch] Set password
[Devolutions Patch] Form submitted.
[Devolutions Patch] Top bar detected. Proceeding with next steps...
[Devolutions Patch] Close listener attached.
canvas: 1   floating-session-toolbar: 1   failure banner: 0

ironrdp web::session: Connected!, live Windows desktop, no STATUS_LOGON_FAILURE.

bun test main.test.ts passes (5/5); prettier and terraform fmt are clean.

Note

The same escaping bug exists in amazon-dcv-windows (#1035) and local-windows-rdp (#1043). Both are separate modules with separate releases, so they are filed rather than folded in here.

Caution

devolutions_gateway_version still defaults to latest, which is the root cause of the selector breakage: an upstream UI change silently breaks every workspace using this module. Worth deciding separately whether to pin a known-good default. Tracked in #1044.

Closes #20
Closes #1044

🤖 This PR was created with the help of Coder Agents, and needs a human review. 🧑‍💻

[github-actions]

Module Scorecard Check

coder/windows-rdp: 45 → 57

✅ Score improvement: 45 → 57 (+12).

Theme	Before	After
Presentation & Onboarding	17 / 25	17 / 25
Integration	—	—
Credential Hygiene	10 / 20	18 / 20
Restricted-Environment	0 / 20	0 / 20
Engineering Quality	7 / 10	8 / 10
Overall	45 / 100	57 / 100

Full scorecard for this PR

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 25	18 / 20	0 / 20	8 / 10	57 / 100

Drilldown

Presentation & Onboarding — 17 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple provider examples (AWS, Google Cloud) with sensible defaults. Custom version example shows configuration flexibility.
Coder-context framing	8	0	README does not explain what the module adds on top of Coder or how Coder fits in the RDP flow. It states what it enables but not the Coder-specific value proposition.
Visual preview	5	5	Video thumbnail image embedded with link to video demonstration.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	admin_password variable marked sensitive = true in main.tf. README examples do not inline secrets.
Non-hardcoded auth path	4	2	Module accepts admin credentials as variables but README does not document alternative authentication paths (e.g., Windows credential managers, SSO integration, or external auth mechanisms). Partial credit for parameterization.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No module variable overrides the PowerShell Gallery URL or Devolutions Gateway download source. The devolutions_gateway_version variable only controls version selection, not the artifact source URL.
Bring-your-own binary	5	0	No documented way to skip installation when Devolutions Gateway is pre-installed. The module always runs Install-Module and Install-DGatewayPackage.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. PSGallery and Devolutions sources are inferable from code but not documented for restricted environments.
Runs without sudo	2	0	PowerShell script performs system-wide installation (Install-Module for all users), modifies HKLM registry keys, configures Windows services, and writes to Program Files. All require administrator privileges with no documented non-privileged fallback.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Variables have clear descriptions and sensible defaults. share variable includes validation. admin_password properly marked sensitive.
Test coverage	4	2	TypeScript tests cover password injection and special character handling. No .tftest.hcl files present. Tests verify script generation but not end-to-end RDP functionality or Devolutions Gateway installation.

Overall — 57 / 100

Raw 43 / 75 → round(43 / 75 × 100) = 57

---

Scored against SCORECARD.md with claude-sonnet-4-5. Language-model scores are advisory.