fix(windows-rdp): escape credentials and fix auto-connect on Gateway 2026.2.x

[matifali]

Problem

Two separate defects made the Web RDP session fail, and they compound: the credentials were mangled in transit, and even correct credentials were never submitted.

1. Credentials were interpolated without escaping (#20)

• devolutions-patch.js embeds the password inside a double-quoted JS string literal (value: "${CODER_PASSWORD}"). JS parses the injected \m as an escape sequence and drops the backslash, so N;JVO*U\mL^a*P becomes N;JVO*UmL^a*P. A " breaks the patch script entirely.
• powershell-installation-script.tftpl passes the password as a PowerShell double-quoted string (Set-AdminPassword -adminPassword "${admin_password}"), where $, backtick, and " are interpreted. The Windows account then gets a different password than Coder displays.

Both paths end in STATUS_LOGON_FAILURE [0xc000006d], and whether a user hits it depends on which characters their generated password happens to contain.

2. The auto-fill selectors no longer match Gateway 2026.2.x (#1044)

The module defaults to devolutions_gateway_version = "latest". On 2026.2.4 the form fills but never submits, and the in-session toolbar is never found, so the close-window listener never attaches and the poll loops forever.

Changes

Credential escaping

Destination	Encoding	Handles
JS patch file	jsonencode, outer quotes trimmed	\, ", control chars, and < > & as \u003c style escapes
PowerShell script	single-quoted string, ' doubled	$, backtick, ", \, and everything else literally

The JS file keeps a real string literal, so it stays valid JavaScript for Prettier and @ts-check.

Selector updates

Was	Now
p-dropdown[id="protocol"]	dropped, RDP is already the default and driving a PrimeNG overlay is what broke
p-button[class="p-element"] button	button[type="submit"] inside the form
session-toolbar	floating-session-toolbar, close button matched by aria-label
setCheckbox("Unicode Keyboard Mode")	removed, the option no longer exists
setCheckbox("Dynamic Resize")	input#enableDisplayControl on the connection form, corrected only when not already enabled

Both polls are now bounded. On failure the form is revealed with a visible banner instead of looping forever and logging to a console the user never opens. Credential values are no longer logged to the browser console.

Module bumped to 1.3.1.

Validation

Provisioned a real AWS Windows workspace from a copy of aws-windows-desktop, with the module sourced from this branch and admin_password = "Te\st$Pa\"ss'word&<>|1!"`.

Rendered output:

value: "Te\\st$Pa\"ss'w`ord\u0026\u003c\u003e|1!",
Set-AdminPassword -adminPassword 'Te\st$Pa"ss''w`ord&<>|1!'

On the VM, the account password round-trips exactly:

$ctx.ValidateCredentials('Administrator', 'Te\st$Pa"ss''w`ord&<>|1!')   # True
$ctx.ValidateCredentials('Administrator', 'coderRDP!')                  # False

In the browser, unattended, no clicks:

[Devolutions Patch] Form detected. Starting auto-fill...
[Devolutions Patch] Hostname set to localhost
[Devolutions Patch] Set username
[Devolutions Patch] Set password
[Devolutions Patch] Form submitted.
[Devolutions Patch] Top bar detected. Proceeding with next steps...
[Devolutions Patch] Close listener attached.
canvas: 1   floating-session-toolbar: 1   failure banner: 0

ironrdp web::session: Connected!, live Windows desktop, no STATUS_LOGON_FAILURE.

bun test main.test.ts passes (5/5); prettier and terraform fmt are clean.

Note

The same escaping bug exists in amazon-dcv-windows (#1035) and local-windows-rdp (#1043). Both are separate modules with separate releases, so they are filed rather than folded in here.

Caution

devolutions_gateway_version still defaults to latest, which is the root cause of the selector breakage: an upstream UI change silently breaks every workspace using this module. Worth deciding separately whether to pin a known-good default. Tracked in #1044.

Closes #20
Closes #1044

🤖 This PR was created with the help of Coder Agents, and needs a human review. 🧑‍💻

[github-actions]

Module Scorecard Check

coder/windows-rdp: 45 → 57

✅ Score improvement: 45 → 57 (+12).

Theme	Before	After
Presentation & Onboarding	17 / 25	17 / 25
Integration	—	—
Credential Hygiene	10 / 20	18 / 20
Restricted-Environment	0 / 20	0 / 20
Engineering Quality	7 / 10	8 / 10
Overall	45 / 100	57 / 100

Full scorecard for this PR

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 25	18 / 20	0 / 20	8 / 10	57 / 100

Drilldown

Presentation & Onboarding — 17 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple provider examples (AWS, Google Cloud) with sensible defaults. Custom version example shows configuration flexibility.
Coder-context framing	8	0	README does not explain what the module adds on top of Coder or how Coder fits in the RDP flow. It names the target tool (Devolutions Gateway) but lacks context about Coder's role.
Visual preview	5	5	Video thumbnail image embedded with link to video demonstration.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	admin_password variable marked sensitive = true. README examples do not inline secrets (use module defaults).
Non-hardcoded auth path	4	2	Module uses local Windows authentication with configurable username/password. No external auth mechanism documented, but credentials are parameterized rather than hardcoded. Partial credit for parameterization.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No module variable overrides the Devolutions Gateway download URL. The module installs from PSGallery via Install-Module with no URL override capability. Version can be pinned via devolutions_gateway_version but this is not a URL override.
Bring-your-own binary	5	0	No documented way to skip installation when Devolutions Gateway is pre-installed. The coder_script always runs the installation logic.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. PSGallery and Devolutions endpoints are implicit in code but not documented.
Runs without sudo	2	0	PowerShell script performs system-wide installation (Install-Module for all users), modifies HKLM registry keys, configures Windows services, and modifies Program Files. These operations require administrator privileges. No non-privileged fallback documented or implemented.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Variables have clear descriptions and sensible defaults. share variable includes validation. admin_password properly marked sensitive. devolutions_gateway_version has descriptive documentation.
Test coverage	4	2	TypeScript tests cover password injection and special character handling. Tests verify script generation but not end-to-end RDP functionality. No .tftest.hcl files present. Partial credit for existing test coverage.

Overall — 57 / 100

Raw 43 / 75 → round(43 / 75 × 100) = 57

---

Scored against SCORECARD.md with claude-sonnet-4-5. Language-model scores are advisory.

[35C4n0r]

The JS script works as expected, and the changes in main.tf + script LGTM.