feat: add core AI MITM proxy daemon (#21296)

## Description

Adds the core AI Bridge MITM proxy daemon. This proxy intercepts HTTPS traffic, decrypts it using a configured CA certificate, and forwards requests to AIBridge for processing.

## Changes

* Added `aibridgeproxyd` package with the core proxy server implementation
* Added configuration options: `CODER_AIBRIDGE_PROXY_ENABLED`, `CODER_AIBRIDGE_PROXY_LISTEN_ADDR`, `CODER_AIBRIDGE_PROXY_CERT_FILE`, `CODER_AIBRIDGE_PROXY_KEY_FILE`
* Added tests for server initialization and MITM functionality

Closes https://github.com/coder/internal/issues/1180

enterprise/cli/aibridgeproxyd.go

@@ -0,0 +1,30 @@
+//go:build !slim
+
+package cli
+
+import (
+	"context"
+
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/enterprise/aibridgeproxyd"
+	"github.com/coder/coder/v2/enterprise/coderd"
+)
+
+func newAIBridgeProxyDaemon(coderAPI *coderd.API) (*aibridgeproxyd.Server, error) {
+	ctx := context.Background()
+	coderAPI.Logger.Debug(ctx, "starting in-memory aibridgeproxy daemon")
+
+	logger := coderAPI.Logger.Named("aibridgeproxyd")
+
+	srv, err := aibridgeproxyd.New(ctx, logger, aibridgeproxyd.Options{
+		ListenAddr: coderAPI.DeploymentValues.AI.BridgeProxyConfig.ListenAddr.String(),
+		CertFile:   coderAPI.DeploymentValues.AI.BridgeProxyConfig.CertFile.String(),
+		KeyFile:    coderAPI.DeploymentValues.AI.BridgeProxyConfig.KeyFile.String(),
+	})
+	if err != nil {
+		return nil, xerrors.Errorf("failed to start in-memory aibridgeproxy daemon: %w", err)
+	}
+
+	return srv, nil
+}

enterprise/cli/server.go

@@ -165,6 +165,16 @@ func (r *RootCmd) Server(_ func()) *serpent.Command {
 			closers.Add(aibridgeDaemon)
 		}
 
+		// In-memory AI Bridge Proxy daemon
+		if options.DeploymentValues.AI.BridgeProxyConfig.Enabled.Value() {
+			aiBridgeProxyServer, err := newAIBridgeProxyDaemon(api)
+			if err != nil {
+				_ = closers.Close()
+				return nil, nil, xerrors.Errorf("create aibridgeproxyd: %w", err)
+			}
+			closers.Add(aiBridgeProxyServer)
+		}
+
 		return api.AGPL, closers, nil
 	})
 

enterprise/cli/testdata/coder_server_--help.golden

@@ -140,6 +140,20 @@ AI BRIDGE OPTIONS:
           Maximum number of AI Bridge requests per second per replica. Set to 0
           to disable (unlimited).
 
+AI BRIDGE PROXY OPTIONS: 
+      --aibridge-proxy-cert-file string, $CODER_AIBRIDGE_PROXY_CERT_FILE
+          Path to the CA certificate file for AI Bridge Proxy.
+
+      --aibridge-proxy-enabled bool, $CODER_AIBRIDGE_PROXY_ENABLED (default: false)
+          Enable the AI Bridge MITM Proxy for intercepting and decrypting AI
+          provider requests.
+
+      --aibridge-proxy-key-file string, $CODER_AIBRIDGE_PROXY_KEY_FILE
+          Path to the CA private key file for AI Bridge Proxy.
+
+      --aibridge-proxy-listen-addr string, $CODER_AIBRIDGE_PROXY_LISTEN_ADDR (default: :8888)
+          The address the AI Bridge Proxy will listen on.
+
 CLIENT OPTIONS: 
 These options change the behavior of how clients interact with the Coder.
 Clients include the Coder CLI, Coder Desktop, IDE extensions, and the web UI.