v1.16.4

This release fixes SSH connections on Windows that failed with "Bad owner or permissions", and workspace updates that came back on the old template version. It also keeps recent logs in memory, so a connection failure leaves enough detail behind to diagnose it.

Highlights

Windows SSH config permissions

The SSH config files the extension generates on Windows could inherit permissions that let other accounts read them. OpenSSH rejects such a file and skips the whole Include, so one bad file broke every Coder host. (#1110, fixes #1108)

The extension now limits its SSH folder, %APPDATA%\coder.coder-remote\ssh, to you, SYSTEM, and Administrators, and resets the files in it to inherit those permissions. Files from other deployments and editors are fixed on your next connection. This uses the built-in icacls tool, needs no admin rights, and leaves your own SSH config alone.

If a file can't be fixed, the extension logs a warning and still tries to connect. If the folder itself can't be locked down, the connection stops with an error.

Connection logs captured on failure

Log entries below your log level used to be dropped. The extension now keeps the most recent ones in memory and writes them to the Coder output channel when a connection fails for good or when you collect a support bundle. Support can then see what led up to a failure without asking you to turn on debug logging and reproduce it. (#1100)

• Replayed entries are marked [buffered] and keep their original timestamp and level.
• Brief reconnects, a rejected token (401), and closing the connection yourself don't trigger a replay.
• To change how many entries it keeps, set coder.connectionLogBuffer.size (default 1000, maximum 10000). To turn it off, set it to 0.

Note

The buffer lives in memory, so it's lost if VS Code crashes or is force-quit. The CLI's proxy logs aren't buffered, because support bundles already collect them from coder.proxyLogDirectory.

Bug fixes

• Workspace updates land on the new version on Coder 2.36 and later. An update stops the workspace and then starts it. In between, the extension's own reconnect could start it first, on the old template version. On 2.36 and later, the update runs as a single build, so nothing can start the workspace in between. (#1115, fixes #1095)
• Failed updates ask before connecting. If an update fails, the extension asks whether to connect to the current version, instead of connecting with only a warning. (#1115)
• No Tasks panel on deployments before 2.29. These deployments don't serve /api/v2/tasks, so the panel returned a 404 on every poll. (#1115)
• Unrecoverable WebSocket closes stop retrying. Closes with 1002 and 1003 used to retry forever. They now stop and replay the buffered logs. Normal closes from the server (1000 and 1001) still reconnect. (#1100)
• No leftover CLI progress log. A late write could recreate the CLI download's progress log after cleanup. (#1122)

Full changelog: v1.16.3...v1.16.4