fix(web): use %USERPROFILE% (not $HOME) in generated Windows ssh commands

The wizard generated Windows ssh commands with a PowerShell-style $HOME in the
identity-file path (e.g. `ssh -i $HOME\.ssh\acfs_ed25519 ...`). In the Windows
Terminal profile `commandline` context (and cmd.exe), $HOME is not expanded
before ssh launches, so OpenSSH gets the literal path, can't find the key, and
falls back to password auth:

    Warning: Identity file $HOME\.ssh\acfs_ed25519 not accessible: ...

Switched to %USERPROFILE%, which Windows expands in these contexts (and which the
windows-terminal-setup page already uses for the starting directory). Fixed at
the shared source (commandBuilder SSH_KEY_PATH_WINDOWS) plus the per-page
hardcoded literals across the wizard and the troubleshooting snippets, and
updated the commandBuilder unit test.

Left the genuine PowerShell snippets in generate-ssh-key (Test-Path/New-Item/
ssh-keygen) on $HOME, where interactive PowerShell does expand it correctly.

Closes #302

Co-Authored-By: Claude <noreply@anthropic.com>

Author: Dicklesworthstone

apps/web/app/wizard/launch-onboarding/page.tsx

@@ -323,7 +323,7 @@ export default function LaunchOnboardingStep() {
               <h3 className="font-medium">Connect to your VPS</h3>
               <CommandCard
                 command={`ssh -i ~/.ssh/acfs_ed25519 ${userTarget}`}
-                windowsCommand={`ssh -i $HOME\\.ssh\\acfs_ed25519 ${userTarget}`}
+                windowsCommand={`ssh -i %USERPROFILE%\\.ssh\\acfs_ed25519 ${userTarget}`}
                 runLocation="local"
               />
               <p className="text-sm text-muted-foreground">Open your terminal and SSH in.</p>
@@ -608,7 +608,7 @@ export default function LaunchOnboardingStep() {
             <h3 className="font-medium">2. Connect to your VPS</h3>
             <CommandCard
               command={`ssh -i ~/.ssh/acfs_ed25519 ${userTarget}`}
-              windowsCommand={`ssh -i $HOME\\.ssh\\acfs_ed25519 ${userTarget}`}
+              windowsCommand={`ssh -i %USERPROFILE%\\.ssh\\acfs_ed25519 ${userTarget}`}
               runLocation="local"
             />
           </div>

apps/web/app/wizard/reconnect-ubuntu/page.tsx

@@ -69,7 +69,7 @@ export default function ReconnectUbuntuPage() {
   const userTarget = formatSshTarget(effectiveUsername, vpsIP);
   const userPrompt = `${effectiveUsername}@`;
   const sshCommand = `ssh -i ~/.ssh/acfs_ed25519 ${userTarget}`;
-  const sshCommandWindows = `ssh -i $HOME\\.ssh\\acfs_ed25519 ${userTarget}`;
+  const sshCommandWindows = `ssh -i %USERPROFILE%\\.ssh\\acfs_ed25519 ${userTarget}`;
   const userKeyRepairCommand = buildUserKeyRepairCommand(effectiveUsername, vpsIP);
   const rootKeyRepairCommand = buildRootKeyRepairCommand(effectiveUsername, vpsIP);
 
@@ -143,7 +143,7 @@ export default function ReconnectUbuntuPage() {
               </code>{" "}
               part — or on Windows{" "}
               <code className="rounded bg-muted px-1.5 py-0.5 font-mono text-xs">
-                -i $HOME\\.ssh\\acfs_ed25519
+                -i %USERPROFILE%\\.ssh\\acfs_ed25519
               </code>
               ) instead of a password. The installer set this up for you.
             </p>

apps/web/app/wizard/status-check/page.tsx

@@ -146,9 +146,9 @@ export default function StatusCheckPage() {
   const effectiveSSHUsername = sshUsername.trim() || "ubuntu";
   const reconnectTarget = formatSshTarget(effectiveSSHUsername, effectiveVpsIP);
   const reconnectCommand = `ssh -i ~/.ssh/acfs_ed25519 ${reconnectTarget}`;
-  const reconnectWindowsCommand = `ssh -i $HOME\\.ssh\\acfs_ed25519 ${reconnectTarget}`;
+  const reconnectWindowsCommand = `ssh -i %USERPROFILE%\\.ssh\\acfs_ed25519 ${reconnectTarget}`;
   const codexTunnelCommand = `ssh -i ~/.ssh/acfs_ed25519 -L 1455:localhost:1455 ${reconnectTarget}`;
-  const codexTunnelWindowsCommand = `ssh -i $HOME\\.ssh\\acfs_ed25519 -L 1455:localhost:1455 ${reconnectTarget}`;
+  const codexTunnelWindowsCommand = `ssh -i %USERPROFILE%\\.ssh\\acfs_ed25519 -L 1455:localhost:1455 ${reconnectTarget}`;
   const reinstallCommand = buildInstallCommand(
     installModeLoaded ? installMode : "vibe",
     acfsRefLoaded ? acfsRef : null,

apps/web/app/wizard/verify-key-connection/page.tsx

@@ -63,7 +63,7 @@ export default function VerifyKeyConnectionPage() {
   const userTarget = formatSshTarget(effectiveUsername, vpsIP);
   const userPrompt = `${effectiveUsername}@`;
   const sshKeyCommand = `ssh -i ~/.ssh/acfs_ed25519 ${userTarget}`;
-  const sshKeyCommandWindows = `ssh -i $HOME\\.ssh\\acfs_ed25519 ${userTarget}`;
+  const sshKeyCommandWindows = `ssh -i %USERPROFILE%\\.ssh\\acfs_ed25519 ${userTarget}`;
   const userKeyRepairCommand = buildUserKeyRepairCommand(effectiveUsername, vpsIP);
   const rootKeyRepairCommand = buildRootKeyRepairCommand(effectiveUsername, vpsIP);
 

apps/web/app/wizard/windows-terminal-setup/page.tsx

@@ -98,7 +98,11 @@ function WindowsTerminalSetupContent() {
   const displayIP = vpsIP || "YOUR_VPS_IP";
   const effectiveUsername = sshUsername.trim() || "ubuntu";
   const ubuntuTarget = formatSshTarget(effectiveUsername, displayIP);
-  const sshCommandLine = `ssh -i $HOME\\.ssh\\acfs_ed25519 ${ubuntuTarget}`;
+  // Use %USERPROFILE% (not $HOME): the Windows Terminal profile `commandline`
+  // context does not expand PowerShell's $HOME before launching ssh, so the key
+  // path would be passed literally and OpenSSH would fall back to password auth
+  // (#302). %USERPROFILE% is expanded by Windows in this context.
+  const sshCommandLine = `ssh -i %USERPROFILE%\\.ssh\\acfs_ed25519 ${ubuntuTarget}`;
 
   const handleCopy = useCallback(async () => {
     const copiedOk = await copyTextToClipboard(sshCommandLine);
@@ -332,7 +336,7 @@ function WindowsTerminalSetupContent() {
                 <p className="text-sm text-muted-foreground">
                   Make sure your SSH key file exists at{" "}
                   <code className="rounded bg-muted px-1 py-0.5 font-mono text-xs">
-                    $HOME\.ssh\acfs_ed25519
+                    %USERPROFILE%\.ssh\acfs_ed25519
                   </code>
                   . If you used a different key name, update the command line accordingly.
                 </p>
@@ -348,7 +352,7 @@ function WindowsTerminalSetupContent() {
                 <p className="text-sm text-muted-foreground">
                   This can happen if you rebuilt your VPS. You may need to remove the old key from{" "}
                   <code className="rounded bg-muted px-1 py-0.5 font-mono text-xs">
-                    $HOME\.ssh\known_hosts
+                    %USERPROFILE%\.ssh\known_hosts
                   </code>
                   .
                 </p>

apps/web/components/connection-check.tsx

@@ -39,7 +39,7 @@ export function ConnectionCheck({
     ? `ssh -i ~/.ssh/acfs_ed25519 ${sshTarget}`
     : `ssh ${sshTarget}`;
   const windowsSshCommand = useIdentityFile
-    ? `ssh -i $HOME\\.ssh\\acfs_ed25519 ${sshTarget}`
+    ? `ssh -i %USERPROFILE%\\.ssh\\acfs_ed25519 ${sshTarget}`
     : `ssh ${sshTarget}`;
 
   return (

apps/web/lib/commandBuilder.test.ts

@@ -182,7 +182,7 @@ describe("buildCommands", () => {
 
     expect(installer?.command).toContain('TARGET_USER="admin"');
     expect(sshUser?.command).toContain("admin@10.20.30.40");
-    expect(sshUser?.windowsCommand).toBe("ssh -i $HOME\\.ssh\\acfs_ed25519 admin@10.20.30.40");
+    expect(sshUser?.windowsCommand).toBe("ssh -i %USERPROFILE%\\.ssh\\acfs_ed25519 admin@10.20.30.40");
   });
 
   test("falls back to ubuntu when the username input is invalid", () => {

apps/web/lib/commandBuilder.ts

@@ -20,7 +20,11 @@ const INSTALL_SCRIPT_BASE_URL =
   "https://raw.githubusercontent.com/Dicklesworthstone/agentic_coding_flywheel_setup";
 const DEFAULT_INSTALL_REF = "main";
 const SSH_KEY_PATH_UNIX = "~/.ssh/acfs_ed25519";
-const SSH_KEY_PATH_WINDOWS = "$HOME\\.ssh\\acfs_ed25519";
+// Use %USERPROFILE% rather than PowerShell's $HOME: the Windows Terminal profile
+// `commandline` context (and cmd.exe) does not expand $HOME before launching ssh,
+// so the key path would be passed literally and OpenSSH would fall back to
+// password auth (#302). %USERPROFILE% is expanded by Windows in these contexts.
+const SSH_KEY_PATH_WINDOWS = "%USERPROFILE%\\.ssh\\acfs_ed25519";
 
 export interface CommandBuilderInputs {
   ip: string;