fix(vscode): stop leaking PII in remotePlatform, cut remote memory/CPU overhead

.chezmoi.toml.tmpl

@@ -4,6 +4,7 @@
 {{- $gitName := promptStringOnce . "name" "Enter your full name for Git" -}}
 {{- $gitEmail := promptStringOnce . "email" "Enter your email for Git" -}}
 {{- $accessToken := promptStringOnce . "bwsAccessToken" "Enter your BWS Access Token" -}}
+{{- $coderUsername := promptStringOnce . "coderUsername" "Enter your Coder deployment username (used in the VS Code remote.SSH.remotePlatform host key)" -}}
 {{- $editor := or (env "EDITOR") "vim" -}}
 
 # Set values in the data section
@@ -12,6 +13,7 @@
     email = {{ $gitEmail | quote }}
     editor = {{ $editor | quote }}
     bwsAccessToken = {{ $accessToken | quote }}
+    coderUsername = {{ $coderUsername | quote }}
 
 [diff]
     command = "diff"

.github/workflows/full-apply-test.yaml

@@ -48,7 +48,9 @@ jobs:
       # prove real Bitwarden Secrets Manager resolution works, which requires a real
       # bwsAccessToken on a real machine (see DESIGN.md's "CI can't be the full story").
       run: |
-        grep -rl 'bitwardenSecrets' . --include='*.tmpl' --include='*.toml' | xargs -r sed -i 's|{{ (bitwardenSecrets "[^"]*" .bwsAccessToken).value }}|fake-test-value|g'
+        # -Z/-0: NUL-delimited, so paths with spaces (e.g. "private_Application Support")
+        # survive the grep -> xargs handoff intact instead of being word-split.
+        grep -rlZ 'bitwardenSecrets' . --include='*.tmpl' --include='*.toml' | xargs -0 -r sed -i 's|{{ (bitwardenSecrets "[^"]*" .bwsAccessToken).value }}|fake-test-value|g'
 
     - name: Install chezmoi
       run: |
@@ -64,6 +66,7 @@ jobs:
         name = "CI Test"
         email = "ci@example.com"
         bwsAccessToken = "unused-fake-token"
+        coderUsername = "ci-test"
         EOF
 
     - name: chezmoi init --apply (first-time bootstrap)

private_Library/private_Application Support/private_Code/User/settings.json → private_Library/private_Application Support/private_Code/User/settings.json.tmpl

@@ -38,18 +38,64 @@
   // Increase delay before showing code completion suggestions (default: 10ms)
   "editor.suggestDelay": 3000,
   "editor.suggest.preview": true,
-  // Prevent extensions from automatically updating in the background
-  "extensions.autoUpdate": true,
+  // Prevent extensions from automatically updating in the background.
+  // "off" (not boolean false) matches the current extensions.autoUpdate schema -- VS Code
+  // migrates a legacy boolean to "on"/"off" automatically, but writing the string directly
+  // avoids relying on that migration (and an in-place rewrite of this chezmoi-managed file).
+  "extensions.autoUpdate": "off",
+  "extensions.autoCheckUpdates": false,
   "files.autoSave": "afterDelay",
   "files.autoSaveDelay": 300,
-  // Exclude large directories from file watching to reduce I/O and CPU load
+  // Exclude large/generated directories from file watching to reduce I/O and CPU load.
+  // The remote (Coder workspace) home holds an 11 GB ~/.vscode-server tree that VS Code
+  // would otherwise watch recursively (including itself), plus a Homebrew symlink farm and
+  // every installed mise toolchain version -- none of these are ever hand-edited.
   "files.watcherExclude": {
     "**/.git/objects/**": true,
     "**/.git/subtree-cache/**": true,
     "**/node_modules/**": true,
     "**/dist/**": true,
-    "**/build/**": true
+    "**/build/**": true,
+    "**/.vscode-server/**": true,
+    "**/.linuxbrew/**": true,
+    "**/.local/share/mise/**": true,
+    "**/.terraform/**": true,
+    "**/.cache/**": true,
+    "**/.cargo/**": true,
+    "**/go/pkg/**": true,
+    "**/.claude/**": true,
+    "**/target/**": true,
+    "**/vendor/**": true,
+    "**/.venv/**": true
   },
+  // Same directories as files.watcherExclude -- keep full-text search from indexing them too.
+  "search.exclude": {
+    "**/.git/objects/**": true,
+    "**/.git/subtree-cache/**": true,
+    "**/node_modules/**": true,
+    "**/dist/**": true,
+    "**/build/**": true,
+    "**/.vscode-server/**": true,
+    "**/.linuxbrew/**": true,
+    "**/.local/share/mise/**": true,
+    "**/.terraform/**": true,
+    "**/.cache/**": true,
+    "**/.cargo/**": true,
+    "**/go/pkg/**": true,
+    "**/.claude/**": true,
+    "**/target/**": true,
+    "**/vendor/**": true,
+    "**/.venv/**": true
+  },
+  // Homebrew/mise symlink farms make plain (non-excluded) symlink traversal expensive.
+  "search.followSymlinks": false,
+  // Cap the TypeScript server's heap instead of leaving it unbounded.
+  "typescript.tsserver.maxTsServerMemory": 2048,
+  "typescript.disableAutomaticTypeAcquisition": true,
+  // Reduce the git extension's background repository scanning.
+  "git.autoRepositoryDetection": "openEditors",
+  "git.repositoryScanMaxDepth": 1,
+  "git.autofetch": false,
   "telemetry.telemetryLevel": "off",
   "window.restoreWindows": "preserve",
   "window.zoomLevel": 0,
@@ -59,9 +105,21 @@
   "workbench.list.smoothScrolling": false,
 
   "remote.SSH.connectTimeout": 1800,
+  // Host key matches the "coder-vscode.<deployment>--<username>--<workspace>.<agent>" format
+  // that the Coder VS Code extension's SSH authority parser actually produces (verified against
+  // coder/vscode-coder's src/util/authority.ts). A second, differently-shaped entry that used
+  // to live here (a "--<workspace>--<agent>" tail instead of ".<agent>") does not parse under
+  // that scheme -- it predates the current extension version and was dropped rather than
+  // templated (dotfiles#772).
   "remote.SSH.remotePlatform": {
-    "coder-vscode.coder.homelab.nikara.net--ppat--peter--main": "linux",
-    "coder-vscode.coder.homelab.nikara.net--peter--peter.main": "linux"
+    "coder-vscode.coder.{{ (bitwardenSecrets "288eeda0-d57f-4a91-8651-b2090163ecc0" .bwsAccessToken).value }}--{{ .coderUsername }}--{{ .coderUsername }}.main": "linux"
+  },
+  // APPLICATION/WINDOW-scoped in VS Code's own configuration registry (never MACHINE or
+  // MACHINE_OVERRIDABLE), so it must live in this file -- the remote Machine settings file
+  // parses only [MACHINE, MACHINE_OVERRIDABLE] scopes and silently drops anything else.
+  "remote.extensionKind": {
+    "vscode-icons-team.vscode-icons": ["ui"],
+    "bierner.markdown-mermaid": ["ui"]
   },
   "remote.SSH.defaultExtensions": [
     "bierner.markdown-mermaid",

private_dot_local/bash/limits.bash

@@ -0,0 +1,7 @@
+# The Coder workspace memory watchdog (coder repo: script-memory-watchdog.sh) stamps a soft
+# RLIMIT_DATA on the VS Code server tree via prlimit to keep it from re-approaching the
+# container's memory.max. Terminals forked from ptyHost inherit that soft limit. The watchdog
+# deliberately leaves the hard limit at "unlimited" specifically so a shell can restore itself --
+# do that here, every time an interactive shell starts, rather than requiring the operator to
+# notice and fix it by hand.
+ulimit -d unlimited 2>/dev/null || true