fix: avoid an errant license warning banner on new deployments that d… (#26239)

Problem: CODER_AI_GATEWAY_ENABLED defaulted to true, which both started
the in-memory gateway and enabled the licensed FeatureAIBridge. As a
result, deployments that never configured AI Gateway saw a spurious "AI
Governance add-on is required" warning whenever they had an older
(non-add-on) Premium license, since the feature was enabled-and-entitled
by default.

Fix: Decouple "external AI Gateway API enabled" from "in-memory daemon
running," so the external/licensed surface is off by default while Coder
Agents retain access by default.

cli/server.go

@@ -1053,10 +1053,15 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
 			// dispatch LLM requests via the in-process transport without
 			// crossing the gated /api/v2/aibridge HTTP route. The HTTP route
 			// itself is registered (and license-gated) only by enterprise/coderd;
-			// in AGPL builds it does not exist at all. The daemon starts here
-			// unconditionally when the bridge feature is enabled by config so
-			// chatd can use it regardless of license entitlement.
-			if vals.AI.BridgeConfig.Enabled.Value() {
+			// in AGPL builds it does not exist at all.
+			//
+			// The daemon must run whenever either consumer needs it: the
+			// external/licensed AI Gateway HTTP API (CODER_AI_GATEWAY_ENABLED)
+			// or Coder Agents routing chat traffic through the in-process
+			// transport (CODER_CHAT_AI_GATEWAY_ROUTING_ENABLED). Agents get
+			// access regardless of license entitlement; the external HTTP
+			// route stays license-gated.
+			if vals.AI.BridgeConfig.Enabled.Value() || vals.AI.Chat.AIGatewayRoutingEnabled.Value() {
 				aibridgeReg := prometheus.WrapRegistererWithPrefix("coder_aibridged_", coderAPI.PrometheusRegistry)
 				aibridgeMetrics := aibridge.NewMetrics(aibridgeReg)
 				aibridgeProviders, _, err := BuildProviders(aibridgeInitCtx, options.Database, vals.AI.BridgeConfig, logger.Named("aibridge.providers"), aibridgeMetrics)

cli/testdata/coder_server_--help.golden

@@ -183,7 +183,7 @@ AI GATEWAY OPTIONS:
           Length of time to retain data such as interceptions and all related
           records (token, prompt, tool use).
 
-      --ai-gateway-enabled bool, $CODER_AI_GATEWAY_ENABLED (default: true)
+      --ai-gateway-enabled bool, $CODER_AI_GATEWAY_ENABLED (default: false)
           Whether to start an in-memory AI Gateway instance.
 
       --ai-gateway-max-concurrency int, $CODER_AI_GATEWAY_MAX_CONCURRENCY (default: 0)

cli/testdata/server-config.yaml.golden

@@ -779,8 +779,8 @@ chat:
 aibridge:
   # Deprecated: use --ai-gateway-enabled or CODER_AI_GATEWAY_ENABLED instead.
   # Whether to start an in-memory aibridged instance.
-  # (default: true, type: bool)
-  enabled: true
+  # (default: false, type: bool)
+  enabled: false
   # Deprecated: use --ai-gateway-openai-base-url or CODER_AI_GATEWAY_OPENAI_BASE_URL
   # instead. The base URL of the OpenAI API.
   # (default: https://api.openai.com/v1/, type: string)
@@ -878,8 +878,8 @@ aibridge:
   circuit_breaker_max_requests: 3
 ai_gateway:
   # Whether to start an in-memory AI Gateway instance.
-  # (default: true, type: bool)
-  enabled: true
+  # (default: false, type: bool)
+  enabled: false
   # Deprecated: manage AI Providers from the Coder UI or HTTP API. If set, this
   # option seeds provider configuration at startup only exactly once. It will not be
   # used in service runtime. The base URL of the OpenAI API.

coderd/coderd.go

@@ -811,8 +811,7 @@ func New(options *Options) *API {
 			providerAPIKeys = *options.ChatProviderAPIKeys
 		}
 
-		chatAIGatewayRoutingEnabled := options.DeploymentValues.AI.BridgeConfig.Enabled.Value() &&
-			options.DeploymentValues.AI.Chat.AIGatewayRoutingEnabled.Value()
+		chatAIGatewayRoutingEnabled := options.DeploymentValues.AI.Chat.AIGatewayRoutingEnabled.Value()
 
 		api.chatDaemon = chatd.New(chatd.Config{
 			Logger:                         options.Logger.Named("chatd"),

codersdk/deployment.go

@@ -1805,7 +1805,7 @@ func (c *DeploymentValues) Options() serpent.OptionSet {
 		Flag:        "ai-gateway-enabled",
 		Env:         "CODER_AI_GATEWAY_ENABLED",
 		Value:       &c.AI.BridgeConfig.Enabled,
-		Default:     "true",
+		Default:     "false",
 		Group:       &deploymentGroupAIGateway,
 		YAML:        "enabled",
 	}
@@ -4191,7 +4191,7 @@ Write out the current server config as YAML to stdout.`,
 			Flag:        "aibridge-enabled",
 			Env:         "CODER_AIBRIDGE_ENABLED",
 			Value:       &c.AI.BridgeConfig.Enabled,
-			Default:     "true",
+			Default:     "false",
 			Group:       &deploymentGroupAIBridge,
 			YAML:        "enabled",
 			Hidden:      true,

docs/reference/cli/server.md

@@ -1730,7 +1730,7 @@ Force chat debug logging on for every chat, bypassing the runtime admin and user
 | Type        | <code>bool</code>                      |
 | Environment | <code>$CODER_AI_GATEWAY_ENABLED</code> |
 | YAML        | <code>ai_gateway.enabled</code>        |
-| Default     | <code>true</code>                      |
+| Default     | <code>false</code>                     |
 
 Whether to start an in-memory AI Gateway instance.
 

enterprise/cli/testdata/coder_server_--help.golden

@@ -184,7 +184,7 @@ AI GATEWAY OPTIONS:
           Length of time to retain data such as interceptions and all related
           records (token, prompt, tool use).
 
-      --ai-gateway-enabled bool, $CODER_AI_GATEWAY_ENABLED (default: true)
+      --ai-gateway-enabled bool, $CODER_AI_GATEWAY_ENABLED (default: false)
           Whether to start an in-memory AI Gateway instance.
 
       --ai-gateway-max-concurrency int, $CODER_AI_GATEWAY_MAX_CONCURRENCY (default: 0)