Add AttachToConsoleSession option for Windows - #875
Open
Mitch Gaffigan (mgaffigan) wants to merge 1 commit into
Open
Mitch Gaffigan (mgaffigan) wants to merge 1 commit into
Mitch Gaffigan (mgaffigan) wants to merge 1 commit into
Conversation
Windows sshd runs every session in the service session, which has no access to the interactive desktop. A GUI application launched over SSH starts invisibly and cannot be seen or clicked, so tooling that expects to drive a desktop over SSH does not work. The motivating case is VS Code Remote SSH from a Mac into a Windows VM, such as one hosted by Parallels. Today, pressing F5 on a GUI project runs the app where nobody can see it. With this option enabled the app appears on the desktop already visible in the VM window and the debugger attaches to it, so remote debugging of GUI applications works the way it does locally. Add an opt-in sshd_config keyword that runs the post-auth session process inside the user's existing physical console session. The default is no, preserving current behavior. The process launch and authentication paths are otherwise unchanged. The console session's token is substituted for the authenticated one only when both carry the same user SID, and only for the post-auth spawn; the pre-auth child and AuthorizedKeysCommand share the same helper and continue to run in the service session.
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Copilot started reviewing on behalf of
Mitch Gaffigan (mgaffigan)
September 13, 2026 18:08
View session
Author
|
@microsoft-github-policy-service agree |
There was a problem hiding this comment.
🟡 Changes recommended
The desktop override must be gated, and Windows regression coverage is needed.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Adds the opt-in Windows AttachToConsoleSession option, allowing authenticated sessions to launch GUI applications in the user's physical console session while preserving the default behavior.
Changes:
- Adds configuration parsing, defaults,
Matchsupport, and documentation. - Implements console-session token selection, SID validation, and UAC handling.
- Integrates desktop selection, API proxies, and Visual Studio project updates.
File summaries
| File | Summary |
|---|---|
sshd-session.c |
Arms console attachment for post-auth spawning. |
sshd_config.5 |
Documents the new option. |
sshd_config.0 |
Updates generated documentation. |
servconf.h |
Adds the server option field. |
servconf.c |
Implements parsing, defaults, copying, and dumping. |
contrib/win32/win32compat/win32_session.c |
Implements console token selection and validation. Nit (2 votes): Add Windows regression coverage for attachment and fallback cases. |
contrib/win32/win32compat/w32fd.c |
Selects the target desktop. Moderate (2 votes): Gate the unconditional desktop override so it only affects the intended post-auth spawn. |
contrib/win32/win32compat/w32api_proxies.h |
Declares WTS API wrappers. |
contrib/win32/win32compat/w32api_proxies.c |
Dynamically loads WTS APIs. |
contrib/win32/win32compat/spawn-ext.c |
Uses the console token for post-auth sessions. |
contrib/win32/win32compat/misc_internal.h |
Declares session helpers and state. |
contrib/win32/openssh/win32iocompat.vcxproj.filters |
Adds the new source to project filters. |
contrib/win32/openssh/win32iocompat.vcxproj |
Adds the new source to the build. |
Review details
- Files reviewed: 13/13 changed files
- Comments generated: 2
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+1155
to
+1160
| if (GetTokenInformation(as_user, TokenSessionId, &token_session, sizeof(token_session), &info_len) && | ||
| ProcessIdToSessionId(GetCurrentProcessId(), &my_session) && | ||
| token_session != my_session) { | ||
| debug3("spawning into session %d (from session %d) on %ls", token_session, my_session, winsta0_default); | ||
| si.lpDesktop = winsta0_default; | ||
| } |
Comment on lines
+165
to
+167
| HANDLE | ||
| get_console_session_token(HANDLE authenticated_token) | ||
| { |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Windows sshd runs every session in the service session, which has no access to the interactive desktop. A GUI application launched over SSH starts invisibly and cannot be seen or clicked, so tooling that expects to drive a desktop over SSH does not work.
The motivating case is VS Code Remote SSH from a Mac into a Windows VM, such as one hosted by Parallels. Today, pressing F5 on a GUI project runs the app where nobody can see it. With this option enabled the app appears on the desktop already visible in the VM window and the debugger attaches to it, so remote debugging of GUI applications works the way it does locally.
Add an opt-in sshd_config keyword that runs the post-auth session process inside the user's existing physical console session. The default is no, preserving current behavior.
The process launch and authentication paths are otherwise unchanged. The console session's token is substituted for the authenticated one only when both carry the same user SID, and only for the post-auth spawn; the pre-auth child and AuthorizedKeysCommand share the same helper and continue to run in the service session.
Screen.Recording.2026-09-13.at.13.06.26.mov