mirror of
https://github.com/coder/coder.git
synced 2026-09-24 15:04:27 +08:00
245ce911996f50a91a58ca30dae40a5af74976cf
13170
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Jaayden Halko
|
245ce91199 |
feat: add bar charts for premium and AI governance add-on license usage (#23442)
Implemented with the help of Cursor agents using Figma MCP Figma design: https://www.figma.com/design/klGTlHSPQwI4KBvAMdebrx/Customer-Usage-Controls-for-AI-Governance-Add-On?node-id=448-7658&m=dev <img width="1143" height="639" alt="Screenshot 2026-03-23 at 20 10 05" src="https://github.com/user-attachments/assets/300d4d5d-aad2-49a9-bfdd-a329312e5fa8" /> |
||
|
Danielle Maywood
|
5d0734e005 | fix(site): diff viewer virtualizer buffer fix and styling polish (#23462) | ||
|
Danny Kopping
|
43a1af3cd6 |
feat: session list API (#23202)
<!-- If you have used AI to produce some or all of this PR, please ensure you have read our [AI Contribution guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING) before submitting. --> _Disclaimer:_ _initially_ _produced_ _by_ _Claude_ _Opus_ _4\.6,_ _heavily_ _modified_ _and_ _reviewed_ _by_ _me._ Closes https://github.com/coder/internal/issues/1360 Adds a new `/api/v2/aibridge/sessions` API which returns "sessions". Sessions, as defined in the [RFC](https://www.notion.so/coderhq/AI-Bridge-Sessions-Threads-2ccd579be59280f28021d3baf7472fbe?source=copy_link), are a set of interceptions logically grouped by a session key issued by the client. The API design for this endpoint was done in [this doc](https://github.com/coder/internal/issues/1360). If the client has not provided a session ID, we will revert to the thread root ID, and if that's not present we use the interception's own ID (i.e. a session of a single interception - which is effectively what we show currently in our `/api/v2/aibridge/interceptions` API). The SQL query looks gnarly but it's relatively simple, and seems to perform well (~200ms) even when I import dogfood's `aibridge_*` tables into my workspace. If we need to improve performance on this later we can investigate materialized views, perhaps, but for now I don't think it's warranted. --- _The PR looks large but it's got a lot of generated code; the actual changes aren't huge._ |
||
|
Jaayden Halko
|
3d5d58ec2b |
fix: make LicenseCard stories use deterministic dates (#23437)
## Summary - replace dynamic dayjs() date generation in LicenseCard stories with fixed deterministic timestamps - preserve story behavior while preventing day-over-day visual drift in Chromatic - use shared constants for expired and future date scenarios |
||
|
dependabot[bot]
|
37d937554e |
ci: bump dorny/paths-filter from 3.0.2 to 4.0.1 in the github-actions group (#23435)
Bumps the github-actions group with 1 update: [dorny/paths-filter](https://github.com/dorny/paths-filter). Updates `dorny/paths-filter` from 3.0.2 to 4.0.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/dorny/paths-filter/releases">dorny/paths-filter's releases</a>.</em></p> <blockquote> <h2>v4.0.1</h2> <h2>What's Changed</h2> <ul> <li>Support merge queue by <a href="https://github.com/masaru-iritani"><code>@masaru-iritani</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/255">dorny/paths-filter#255</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/masaru-iritani"><code>@masaru-iritani</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/255">dorny/paths-filter#255</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/dorny/paths-filter/compare/v4.0.0...v4.0.1">https://github.com/dorny/paths-filter/compare/v4.0.0...v4.0.1</a></p> <h2>v4.0.0</h2> <h2>What's Changed</h2> <ul> <li>feat: update action runtime to node24 by <a href="https://github.com/saschabratton"><code>@saschabratton</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/294">dorny/paths-filter#294</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/saschabratton"><code>@saschabratton</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/294">dorny/paths-filter#294</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/dorny/paths-filter/compare/v3.0.3...v4.0.0">https://github.com/dorny/paths-filter/compare/v3.0.3...v4.0.0</a></p> <h2>v3.0.3</h2> <h2>What's Changed</h2> <ul> <li>Add missing predicate-quantifier by <a href="https://github.com/wardpeet"><code>@wardpeet</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/279">dorny/paths-filter#279</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/wardpeet"><code>@wardpeet</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/279">dorny/paths-filter#279</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/dorny/paths-filter/compare/v3...v3.0.3">https://github.com/dorny/paths-filter/compare/v3...v3.0.3</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md">dorny/paths-filter's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v4.0.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/294">Update action runtime to node24</a></li> </ul> <h2>v3.0.3</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/279">Add missing predicate-quantifier</a></li> </ul> <h2>v3.0.2</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/224">Add config parameter for predicate quantifier</a></li> </ul> <h2>v3.0.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/133">Compare base and ref when token is empty</a></li> </ul> <h2>v3.0.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/210">Update to Node.js 20</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/215">Update all dependencies</a></li> </ul> <h2>v2.11.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/167">Update <code>@actions/core</code> to v1.10.0 - Fixes warning about deprecated set-output</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/168">Document need for pull-requests: read permission</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/164">Updating to actions/checkout@v3</a></li> </ul> <h2>v2.11.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/157">Set list-files input parameter as not required</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/161">Update Node.js</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/162">Fix incorrect handling of Unicode characters in exec()</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/163">Use Octokit pagination</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/160">Updates real world links</a></li> </ul> <h2>v2.10.2</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/91">Fix getLocalRef() returns wrong ref</a></li> </ul> <h2>v2.10.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/85">Improve robustness of change detection</a></li> </ul> <h2>v2.10.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/82">Add ref input parameter</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/83">Fix change detection in PR when pullRequest.changed_files is incorrect</a></li> </ul> <h2>v2.9.3</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/78">Fix change detection when base is a tag</a></li> </ul> <h2>v2.9.2</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/75">Fix fetching git history</a></li> </ul> <h2>v2.9.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/74">Fix fetching git history + fallback to unshallow repo</a></li> </ul> <h2>v2.9.0</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/dorny/paths-filter/commit/fbd0ab8f3e69293af611ebaee6363fc25e6d187d"><code>fbd0ab8</code></a> feat: add merge_group event support</li> <li><a href="https://github.com/dorny/paths-filter/commit/efb1da7ce8d89bbc261191e5a2dc1453c3837339"><code>efb1da7</code></a> feat: add dist/ freshness check to PR workflow</li> <li><a href="https://github.com/dorny/paths-filter/commit/d8f7b061b24c30a325ff314b76c37adb05b041ce"><code>d8f7b06</code></a> Merge pull request <a href="https://redirect.github.com/dorny/paths-filter/issues/302">#302</a> from dorny/issue-299</li> <li><a href="https://github.com/dorny/paths-filter/commit/addbc147a95845176e1bc013a012fbf1d366389a"><code>addbc14</code></a> Update README for v4</li> <li><a href="https://github.com/dorny/paths-filter/commit/9d7afb8d214ad99e78fbd4247752c4caed2b6e4c"><code>9d7afb8</code></a> Update CHANGELOG for v4.0.0</li> <li><a href="https://github.com/dorny/paths-filter/commit/782470c5d953cae2693d643172b14e01bacb71f3"><code>782470c</code></a> Merge branch 'releases/v3'</li> <li><a href="https://github.com/dorny/paths-filter/commit/d1c1ffe0248fe513906c8e24db8ea791d46f8590"><code>d1c1ffe</code></a> Update CHANGELOG for v3.0.3</li> <li><a href="https://github.com/dorny/paths-filter/commit/ce10459c8b92cd8901166c0a222fbb033ef39365"><code>ce10459</code></a> Merge pull request <a href="https://redirect.github.com/dorny/paths-filter/issues/294">#294</a> from saschabratton/master</li> <li><a href="https://github.com/dorny/paths-filter/commit/5f40380c5482e806c81cec080f5192e7234d8fe9"><code>5f40380</code></a> feat: update action runtime to node24</li> <li><a href="https://github.com/dorny/paths-filter/commit/668c092af3649c4b664c54e4b704aa46782f6f7c"><code>668c092</code></a> Merge pull request <a href="https://redirect.github.com/dorny/paths-filter/issues/279">#279</a> from wardpeet/patch-1</li> <li>Additional commits viewable in <a href="https://github.com/dorny/paths-filter/compare/de90cc6fb38fc0963ad72b210f1f284cd68cea36...fbd0ab8f3e69293af611ebaee6363fc25e6d187d">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
796190d435 |
chore: bump github.com/gohugoio/hugo from 0.157.0 to 0.158.0 (#23432)
Bumps [github.com/gohugoio/hugo](https://github.com/gohugoio/hugo) from 0.157.0 to 0.158.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/gohugoio/hugo/releases">github.com/gohugoio/hugo's releases</a>.</em></p> <blockquote> <h2>v0.158.0</h2> <p>This release adds <a href="https://gohugo.io/functions/css/build/">css.Build</a>, native and very fast bundling/transformation/minifying of CSS resources. Also see the new <a href="https://gohugo.io/functions/strings/replacepairs/">strings.ReplacePairs</a>, a very fast option if you need to do many string replacements.</p> <h2>Notes</h2> <ul> <li>Upgrade to to Go 1.26.1 (<a href="https://redirect.github.com/gohugoio/hugo/issues/14597">#14597</a>) (note) 1f578f16 <a href="https://github.com/bep"><code>@bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14595">#14595</a>. This fixes a security issue in Go's template package used by Hugo: <a href="https://www.cve.org/CVERecord?id=CVE-2026-27142">https://www.cve.org/CVERecord?id=CVE-2026-27142</a></li> </ul> <h2>Deprecations</h2> <p>The methods and config options are deprecated and will be removed in a future Hugo release.</p> <p>Also see <a href="https://discourse.gohugo.io/t/deprecations-in-v0-158-0/56869">this article</a></p> <h3>Language configuration</h3> <ul> <li><code>languageCode</code> → Use <code>locale</code> instead.</li> <li><code>languages.<lang>.languageCode</code> → Use <code>languages.<lang>.locale</code> instead.</li> <li><code>languages.<lang>.languageName</code> → Use <code>languages.<lang>.label</code> instead.</li> <li><code>languages.<lang>.languageDirection</code> → Use <code>languages.<lang>.direction</code> instead.</li> </ul> <h3>Language methods</h3> <ul> <li><code>.Site.LanguageCode</code> → Use <code>.Site.Language.Locale</code> instead.</li> <li><code>.Language.LanguageCode</code> → Use <code>.Language.Locale</code> instead.</li> <li><code>.Language.LanguageName</code> → Use <code>.Language.Label</code> instead.</li> <li><code>.Language.LanguageDirection</code> → Use <code>.Language.Direction</code> instead.</li> </ul> <h2>Bug fixes</h2> <ul> <li>tpl/css: Fix external source maps e431f90b <a href="https://github.com/bep"><code>@bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14620">#14620</a></li> <li>hugolib: Fix server no watch 59e0446f <a href="https://github.com/jmooring"><code>@jmooring</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14615">#14615</a></li> <li>resources: Fix context canceled on GetRemote with per-request timeout 842d8f10 <a href="https://github.com/bep"><code>@bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14611">#14611</a></li> <li>tpl/tplimpl: Prefer early suffixes when media type matches 4eafd9eb <a href="https://github.com/bep"><code>@bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/13877">#13877</a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14601">#14601</a></li> <li>all: Run go fix ./... e3108225 <a href="https://github.com/bep"><code>@bep</code></a></li> <li>internal/warpc: Fix SIGSEGV in Close() when dispatcher fails to start c9b88e4d <a href="https://github.com/bep"><code>@bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14536">#14536</a></li> <li>Fix index out of range panic in fileEventsContentPaths f797f849 <a href="https://github.com/bep"><code>@bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14573">#14573</a></li> </ul> <h2>Improvements</h2> <ul> <li>resources: Re-publish on transformation cache hit 3c980c07 <a href="https://github.com/bep"><code>@bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14629">#14629</a></li> <li>create/skeletons: Use css.Build in theme skeleton 404ac000 <a href="https://github.com/jmooring"><code>@jmooring</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14626">#14626</a></li> <li>tpl/css: Add a test case for rebuilds on CSS options changes 06fcb724 <a href="https://github.com/bep"><code>@bep</code></a></li> <li>hugolib: Allow regular pages to cascade to self 9b5f1d49 <a href="https://github.com/jmooring"><code>@jmooring</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14627">#14627</a></li> <li>tpl/css: Allow the user to override single loader entries 623722bb <a href="https://github.com/bep"><code>@bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14623">#14623</a></li> <li>tpl/css: Make default loader resolution for CSS <a href="https://github.com/import"><code>@import</code></a> and url() always behave the same a7cbcf15 <a href="https://github.com/bep"><code>@bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14619">#14619</a></li> <li>internal/js: Add default mainFields for CSS builds 36cdb2c7 <a href="https://github.com/jmooring"><code>@jmooring</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14614">#14614</a></li> <li>Add css.Build 3e3b849c <a href="https://github.com/bep"><code>@bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14609">#14609</a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14613">#14613</a></li> <li>resources: Use full path for Exif etc. decoding error/warning messages c47ec233 <a href="https://github.com/bep"><code>@bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/12693">#12693</a></li> <li>Move to new locales library and upgrade CLDR from v36.1 to v48.1 4652ae4a <a href="https://github.com/bep"><code>@bep</code></a></li> <li>tpl/strings: Add strings.ReplacePairs function 13a95b9c <a href="https://github.com/jmooring"><code>@jmooring</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14594">#14594</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/gohugoio/hugo/commit/f41be7959a44108641f1e081adf5c4be7fc1bb63"><code>f41be79</code></a> releaser: Bump versions for release of 0.158.0</li> <li><a href="https://github.com/gohugoio/hugo/commit/0e46a97e8a0d5b7ad1dbea1a39dace7a3ee29fcf"><code>0e46a97</code></a> deps: Upgrade github.com/evanw/esbuild v0.27.3 => v0.27.4</li> <li><a href="https://github.com/gohugoio/hugo/commit/c27d9e8fcfa5aad6cfedd0552add2a6c8ec74525"><code>c27d9e8</code></a> build(deps): bump github.com/getkin/kin-openapi from 0.133.0 to 0.134.0</li> <li><a href="https://github.com/gohugoio/hugo/commit/098eac59a9d4f4567acb16018453c0d389677690"><code>098eac5</code></a> build(deps): bump golang.org/x/tools from 0.42.0 to 0.43.0</li> <li><a href="https://github.com/gohugoio/hugo/commit/3c980c072ee6a9c37a1c6028a7d328696f745836"><code>3c980c0</code></a> resources: Re-publish on transformation cache hit</li> <li><a href="https://github.com/gohugoio/hugo/commit/404ac00001de49c0ccbff4131be40fa2651e4a06"><code>404ac00</code></a> create/skeletons: Use css.Build in theme skeleton</li> <li><a href="https://github.com/gohugoio/hugo/commit/06fcb724219eecdc20367e86e1a8134d3d7e0e5b"><code>06fcb72</code></a> tpl/css: Add a test case for rebuilds on CSS options changes</li> <li><a href="https://github.com/gohugoio/hugo/commit/9b5f1d491d2b7cde198dd2fd858de92e9e97700f"><code>9b5f1d4</code></a> hugolib: Allow regular pages to cascade to self</li> <li><a href="https://github.com/gohugoio/hugo/commit/87f8de8c7ab10516614180080f97490645bbfdec"><code>87f8de8</code></a> build(deps): bump gocloud.dev from 0.44.0 to 0.45.0</li> <li><a href="https://github.com/gohugoio/hugo/commit/67ef6c68deb031f2dcff926b0cc236a07dcca334"><code>67ef6c6</code></a> build(deps): bump golang.org/x/sync from 0.19.0 to 0.20.0</li> <li>Additional commits viewable in <a href="https://github.com/gohugoio/hugo/compare/v0.157.0...v0.158.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Ethan
|
c1474c7ee2 |
fix(coderd/httpmw): return 500 for internal auth errors (#23352)
## Issue context On `dev.coder.com`, users could successfully log in, briefly see the web UI, and then get redirected back to `/login`. We traced the most reliable repro to viewing Tracy's workspaces on the `/workspaces` page. That page eagerly issues authenticated per-row requests such as: - `POST /api/v2/authcheck` - `GET /api/v2/workspacebuilds/:workspacebuild/parameters` One confirmed failing request was for Tracy's workspace `nav-scroll-fix-1f6b`: - route: `GET /api/v2/workspacebuilds/f2104ae6-7d53-457c-a8df-de831bee76db/parameters` - build owner/workspace: `tracy/nav-scroll-fix-1f6b` The failing response body was: - message: `An internal error occurred. Please try again or contact the system administrator.` - detail: `Internal error fetching API key by id. fetch object: pq: password authentication failed for user "coder"` That showed the request was not actually unauthorized. The server hit an internal database/authentication problem while resolving the session API key. The underlying issue was that DB password rotation had been enabled, it has since been disabled. However, the logout cascade happened because: 1. `APIKeyFromRequest()` returned `ok=false` for both genuine auth failures and internal backend failures. 2. `ValidateAPIKey()` wrapped every `!ok` result as `401 Unauthorized`. 3. `RequireAuth.tsx` signs the user out on any `401` response. So a transient backend/database failure was being misreported as an auth failure, which made the client forcibly log the user out. A useful extra clue was that the installed PWA did not repro. The PWA starts on `/agents`, which avoids the `/workspaces` request fan-out. That helped narrow the problem to the eager authenticated requests on the workspace list rather than to cookies or the login flow itself. ## What changed This PR now fixes the bug without changing the exported `APIKeyFromRequest()` surface: - `ValidateAPIKey()` now uses a new internal helper that returns a typed `ValidateAPIKeyError` - the exported `APIKeyFromRequest()` helper remains compatible for existing callers like `userauth.go` - internal API-key lookup failures are classified as `500 Internal Server Error` plus `Hard: true` - internal `UserRBACSubject()` failures now return `500 Internal Server Error` instead of `401 Unauthorized` - a focused regression test verifies that an internal `GetAPIKeyByID` failure surfaces as `500` This removes the brittle message-based classification and makes the internal-auth-failure path robust for all API-key lookup failures handled by auth middleware. |
||
|
Danielle Maywood
|
a8e7cc10b6 | fix(site): isolate draft prompts per conversation (#23469) | ||
|
Michael Suchacz
|
82f965a0ae |
feat: per-user per-model chat compaction threshold overrides (#23412)
## What
Adds per-user per-model auto-compaction threshold overrides. Users can
now customize the percentage of context window usage that triggers chat
compaction, independently for each enabled model.
## Why
The compaction threshold was previously only configurable at the
deployment level (`chat_model_configs.compression_threshold`). Different
users have different preferences — some want aggressive compaction to
keep costs low, others prefer higher thresholds to retain more context.
This gives users control without requiring admin intervention.
## Architecture
**Storage:** Reuses the existing `user_configs` table (no migration
needed). Overrides are stored as key/value pairs with keys shaped
`chat_compaction_threshold:<modelConfigID>` and integer percent values.
**API:** Three new experimental endpoints under
`/api/experimental/chats/config/`:
- `GET /user-compaction-thresholds` — list all overrides for the current
user
- `PUT /user-compaction-thresholds/{modelConfig}` — upsert an override
(validates model exists and is enabled, validates 0–100 range)
- `DELETE /user-compaction-thresholds/{modelConfig}` — clear an override
(idempotent)
**Runtime resolution:** In `coderd/chatd/chatd.go`, a new
`resolveUserCompactionThreshold()` helper runs at the start of each chat
turn (inside `runChat()`), after the model config is resolved but before
`CompactionOptions` is built. If a valid override exists, it replaces
`modelConfig.CompressionThreshold`. The threshold source
(`user_override` vs `model_default`) is logged with each compaction
event.
**Precedence:** `effectiveThreshold = userOverride ??
modelConfig.CompressionThreshold`
**UI:** New "Context Compaction" subsection in the Agents → Settings →
Behavior tab, placed after Personal Instructions. Shows one row per
enabled model with the system default, a number input for the override,
and Save/Reset controls.
## Testing
- 9 API subtests covering CRUD, validation (boundary values 0/100,
out-of-range rejection), upsert behavior, idempotent delete, user
isolation, and non-existent model config
- 4 dbauthz tests (16 scenarios) verifying `ActionReadPersonal` /
`ActionUpdatePersonal` on all query methods
- 4 Storybook stories with play functions (Default, WithOverrides,
Loading, Error)
<details>
<summary>Implementation plan</summary>
### Phase 1 — Tests
- Backend API tests in `coderd/chats_test.go` (9 subtests)
- Database auth wrapper tests in
`coderd/database/dbauthz/dbauthz_test.go` (4 methods)
- Frontend stories in `UserCompactionThresholdSettings.stories.tsx` (4
stories)
### Phase 2 — Backend preference surface
- 4 SQL queries in `coderd/database/queries/users.sql` (list, get,
upsert, delete)
- `make gen` to propagate into generated artifacts
- Auth/metrics wrappers in dbauthz and dbmetrics
- SDK types and client methods in `codersdk/chats.go`
- HTTP handlers and routes in `coderd/chats.go` and `coderd/coderd.go`
- Key prefix constant shared between handlers and runtime
### Phase 3 — Runtime override
- `resolveUserCompactionThreshold()` helper in `coderd/chatd/chatd.go`
- Override injection in `runChat()` before building `CompactionOptions`
- `threshold_source` field added to compaction log
### Phase 4 — Settings UI
- API client methods and React Query hooks in `site/src/api/`
- `UserCompactionThresholdSettings` component extracted from
`SettingsPageContent`
- Per-model mutation tracking (only the active row disables during save)
- 100% warning, "System default" label, helpful empty state copy
### Phase 5 — Refactor and review fixes
- Consolidated key prefix constant in `codersdk`
- Explicit PUT range validation (not just struct tags)
- GET handler gracefully skips malformed rows instead of 500
- Boundary value, upsert, and non-existent model config tests
- UX improvements: per-model mutation state, aria-live on errors
</details>
|
||
|
Kyle Carberry
|
acbfb90c30 |
feat: auto-discover OAuth2 config for MCP servers via RFC 7591 DCR (#23406)
## Problem When adding an external MCP server with `auth_type=oauth2`, admins currently must manually provide: - `oauth2_client_id` - `oauth2_client_secret` - `oauth2_auth_url` - `oauth2_token_url` This requires the admin to manually register an OAuth2 client with the external MCP server's authorization server first — a friction-heavy process that contradicts the MCP spec's vision of plug-and-play discovery. ## Solution When an admin creates an MCP server config with `auth_type=oauth2` and omits the OAuth2 fields, Coder now automatically discovers and registers credentials following the MCP authorization spec: 1. **Protected Resource Metadata (RFC 9728)** — Fetches `/.well-known/oauth-protected-resource` from the MCP server to discover its authorization server. Falls back to probing the server URL for a `WWW-Authenticate` header with a `resource_metadata` parameter. 2. **Authorization Server Metadata (RFC 8414)** — Fetches `/.well-known/oauth-authorization-server` from the discovered auth server to find all endpoints. 3. **Dynamic Client Registration (RFC 7591)** — Registers Coder as an OAuth2 client at the auth server's registration endpoint, obtaining a `client_id` and `client_secret` automatically. The discovered/generated credentials are stored in the MCP server config, and the existing per-user OAuth2 connect flow works unchanged. ### Backward compatibility - **Manual config still works**: If all three fields (`oauth2_client_id`, `oauth2_auth_url`, `oauth2_token_url`) are provided, the existing behavior is unchanged. - **Partial config is rejected**: Providing some but not all fields returns a clear error explaining the two options. - **Discovery failure is clear**: If auto-discovery fails, the error message explains what went wrong and suggests manual configuration. ## Changes - **New package `coderd/mcpauth`** — Self-contained discovery and DCR logic with no `codersdk` dependency - **Modified `coderd/mcp.go`** — `createMCPServerConfig` handler now attempts auto-discovery when OAuth2 fields are omitted - **Tests** — Unit tests for discovery (happy path, WWW-Authenticate fallback, no registration endpoint, registration failure) and `parseResourceMetadataParam` helper |
||
|
Danielle Maywood
|
c344d7c00e | fix(site): improve mobile layout for settings and analytics (#23460) | ||
|
david-fraley
|
53350377b3 | docs: add Agents Getting Started enablement page (#23244) | ||
|
Mathias Fredriksson
|
147df5c971 |
refactor: replace sort.Strings with slices.Sort (#23457)
The slices package provides type-safe generic replacements for the old typed sort convenience functions. The codebase already uses slices.Sort in 43 call sites; this finishes the migration for the remaining 29. - sort.Strings(x) -> slices.Sort(x) - sort.Float64s(x) -> slices.Sort(x) - sort.StringsAreSorted(x) -> slices.IsSorted(x) |
||
|
Cian Johnston
|
9e4c283370 |
test: share coderdtest instances in OAuth2 validation tests (#23455)
Consolidates invocations of `coderdtest.New` to a single shared instance per parent for the following tests: - `TestOAuth2ClientMetadataValidation` - `TestOAuth2ClientNameValidation` - `TestOAuth2ClientScopeValidation` - `TestOAuth2ClientMetadataEdgeCases` > 🤖 This PR was created with the help of Coder Agents, and was reviewed by my human. 🧑💻 |
||
|
Mathias Fredriksson
|
145817e8d3 |
fix(Makefile): install playwright browsers before storybook tests (#23456)
The test-storybook target uses @vitest/browser-playwright with Chromium but never installs the browser binaries. pnpm install only fetches the npm package; the actual browser must be downloaded separately via playwright install. This mirrors what test-e2e already does. |
||
|
Cian Johnston
|
956f6b2473 |
test: share coderdtest instances to stop paying the startup tax 22 times (#23454)
Consolidates 6 tests that spun up separate coderdtest instances per sub-test into a single shared instance per parent. > 🤖 This PR was created with the help of Coder Agents, and has been reviewed by my human. 🧑💻 |
||
|
Kayla はな
|
d2afda8191 | feat: allow restricting sharing to service accounts (#23327) | ||
|
Michael Suchacz
|
c389c2bc5c |
fix(coderd/x/chatd): stabilize auto-promotion flake (#23448)
TestInterruptAutoPromotionIgnoresLaterUsageLimitIncrease still relied on wall-clock polling after the acquire loop moved to a mock clock, so it could assert before chatd finished its asynchronous cleanup and auto-promotion work. Wait on explicit request-start signals and on the server's in-flight chat work before asserting the intermediate and final database state. This keeps the test synchronized with the actual processor lifecycle instead of scheduler timing. Closes https://github.com/coder/internal/issues/1406 |
||
|
Kayla はな
|
4c9e37b659 | feat: add page for editing users (#23328) | ||
|
Cian Johnston
|
3b268c95d3 |
chore(dogfood): evict 22 freeloading tools from the Dockerfile (#23378)
Removes unused tools from dogfood Dockerfile: - Go tools `moq`, `go-swagger`, `goreleaser`, `goveralls`, `kind`, `helm-docs`, `gcr-cleaner-cli` - curl-installed `cloud_sql_proxy`, `dive`, `docker-credential-gcr`, `grype`, `kube-linter`, `stripe` CLI, `terragrunt`, `yq` v3, GoLand 2021.2 , ANTLR v4 jar - apt packages `cmake`, `google-cloud-sdk-datastore-emulator`, `graphviz`, `packer` > 🤖 This PR was created with the help of Coder Agents, and was reviewed by my human. 🧑💻 |
||
|
Mathias Fredriksson
|
138bc41563 |
fix: improve process tool descriptions to prefer foreground execution (#23395)
The tool descriptions pushed agents toward backgrounding anything over 5 seconds, including builds, tests, and installs where you actually want to wait for the result. This led to unnecessary process_output round-trips and missed the foreground timeout-to-reattach workflow entirely. Reframe background mode as the exception (persistent processes with no natural exit) and foreground with an appropriate timeout as the default. Replace "background process" with "tracked process" in process_output, process_list, and process_signal since they work on all tracked processes regardless of how they were started. |
||
|
Cian Johnston
|
80a172f932 |
chore: move chatd and related packages to /x/ subpackage (#23445)
- Moves `coderd/chatd/`, `coderd/gitsync/`, `enterprise/coderd/chatd/` under `x/` parent directories to signal instability - Adds `Experimental:` glue code comments in `coderd/coderd.go` > 🤖 This PR was created with the help of Coder Agents, and was reviewed by my human. 🧑💻 |
||
|
Danielle Maywood
|
86d8b6daee | fix(site/src/pages/AgentsPage): add collapse button to settings sidebar panel (#23438) | ||
|
Danielle Maywood
|
470e6c7217 | feat(site): enable intra-file virtualization in DiffViewer (#23363) | ||
|
Danielle Maywood
|
ed19a3a08e | refactor(site): move experimental endpoints to ExperimentalApiMethods (#23449) | ||
|
Danielle Maywood
|
975373704f | fix(site): unify diff header styling between conversation and panel viewers (#23422) | ||
|
Danielle Maywood
|
522288c9d5 | fix(site): add chat input skeleton to prevent layout shift on agent detail (#23439) | ||
|
Danielle Maywood
|
edd13482a0 | fix(site): focus chat input after submitting diff comment (#23440) | ||
|
Cian Johnston
|
ef14654078 |
chore: move chat methods to ExperimentalClient (#23441)
- Changes all 41 chat method receivers in `codersdk/chats.go` from `*Client` to `*ExperimentalClient` to ensure that callers are aware that these reference potentially unstable `/api/experimental` endpoints. > 🤖 This PR was created with the help of Coder Agents, and has been reviewed by my human. 🧑💻 |
||
|
Thomas Kosiewski
|
ea37f1ff86 |
feat: pass session token as query param on agent chat WebSockets (#23405)
## Problem When the Coder chat UI is embedded in a VS Code webview, the session token is set via the Coder-Session-Token header for HTTP requests. However, browsers cannot attach custom headers to WebSocket connections, and VS Code Electron webview environment does not support cookies set via Set-Cookie from iframe origins. This causes all chat WebSocket connections to fail with authorization errors. ## Solution Pass the session token as a coder_session_token query parameter on all chat-related WebSocket connections. The backend already accepts this parameter (see APITokenFromRequest in coderd/httpmw/apikey.go). The token is only included when API.getSessionToken() returns a value, which only happens in the embed bootstrap flow. Normal browser sessions use cookies and are unaffected. > Built with [Coder Agents](https://coder.com/agents) |
||
|
Mathias Fredriksson
|
c49170b6b3 |
fix(scaletest): handle ignored io.ReadAll error in bridge runner (#22850)
Surface the io.ReadAll error in the error message when an HTTP request fails with a non-200 status, instead of silently discarding it. |
||
|
Danielle Maywood
|
ee9b46fe08 | fix(site/src/pages/AgentsPage): replace navigating buttons with anchor tags (#23426) | ||
|
Mathias Fredriksson
|
1ad3c898a0 |
fix(coderd/chatd): preserve identifiers in chat title generation (#23436)
The prompt told the model to "describe the primary intent" and gave only generic examples, so it stripped PR numbers, repo names, and other distinguishing details. Added explicit GOOD/BAD examples to steer away from generic titles like "Review pull request changes". Also removed "no special characters" which prevented # and / in identifiers. |
||
|
Jakub Domeracki
|
b8e09d09b0 |
chore: remove trivy GHA job (#23415)
Action taken In response to an ongoing incident: https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/ > We've not been compromised due to a combination of pinning [GitHub Actions by commit SHA](https://github.com/coder/coder/blob/c8e58575e0ee44fad37b5f2ffe1ef0f220c3cf23/.github/workflows/security.yaml#L149) coupled with a [dependabot cooldown period](https://github.com/coder/coder/pull/21079) |
||
|
dependabot[bot]
|
0900a44ff3 |
chore: bump github.com/fatih/color from 1.18.0 to 1.19.0 (#23431)
Bumps [github.com/fatih/color](https://github.com/fatih/color) from 1.18.0 to 1.19.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/fatih/color/releases">github.com/fatih/color's releases</a>.</em></p> <blockquote> <h2>v1.19.0</h2> <h2>What's Changed</h2> <ul> <li>Bump golang.org/x/sys from 0.25.0 to 0.28.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/fatih/color/pull/246">fatih/color#246</a></li> <li>Fix for issue <a href="https://redirect.github.com/fatih/color/issues/230">#230</a> set/unsetwriter symmetric wrt color support detection by <a href="https://github.com/ataypamart"><code>@ataypamart</code></a> in <a href="https://redirect.github.com/fatih/color/pull/243">fatih/color#243</a></li> <li>chore: go mod cleanup by <a href="https://github.com/sashamelentyev"><code>@sashamelentyev</code></a> in <a href="https://redirect.github.com/fatih/color/pull/244">fatih/color#244</a></li> <li>Bump golang.org/x/sys from 0.28.0 to 0.30.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/fatih/color/pull/249">fatih/color#249</a></li> <li>Bump github.com/mattn/go-colorable from 0.1.13 to 0.1.14 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/fatih/color/pull/248">fatih/color#248</a></li> <li>Update CI and go deps by <a href="https://github.com/fatih"><code>@fatih</code></a> in <a href="https://redirect.github.com/fatih/color/pull/254">fatih/color#254</a></li> <li>Bump golang.org/x/sys from 0.31.0 to 0.37.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/fatih/color/pull/268">fatih/color#268</a></li> <li>fix: include escape codes in byte counts from <code>Fprint</code>, <code>Fprintf</code> by <a href="https://github.com/qualidafial"><code>@qualidafial</code></a> in <a href="https://redirect.github.com/fatih/color/pull/282">fatih/color#282</a></li> <li>Bump golang.org/x/sys from 0.37.0 to 0.40.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/fatih/color/pull/277">fatih/color#277</a></li> <li>fix: add nil check for os.Stdout to prevent panic on Windows services by <a href="https://github.com/majiayu000"><code>@majiayu000</code></a> in <a href="https://redirect.github.com/fatih/color/pull/275">fatih/color#275</a></li> <li>Bump dominikh/staticcheck-action from 1.3.1 to 1.4.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/fatih/color/pull/259">fatih/color#259</a></li> <li>Bump actions/checkout from 4 to 6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/fatih/color/pull/273">fatih/color#273</a></li> <li>Optimize Color.Equals performance (O(n²) → O(n)) by <a href="https://github.com/UnSubble"><code>@UnSubble</code></a> in <a href="https://redirect.github.com/fatih/color/pull/269">fatih/color#269</a></li> <li>Bump actions/setup-go from 5 to 6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/fatih/color/pull/266">fatih/color#266</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ataypamart"><code>@ataypamart</code></a> made their first contribution in <a href="https://redirect.github.com/fatih/color/pull/243">fatih/color#243</a></li> <li><a href="https://github.com/sashamelentyev"><code>@sashamelentyev</code></a> made their first contribution in <a href="https://redirect.github.com/fatih/color/pull/244">fatih/color#244</a></li> <li><a href="https://github.com/qualidafial"><code>@qualidafial</code></a> made their first contribution in <a href="https://redirect.github.com/fatih/color/pull/282">fatih/color#282</a></li> <li><a href="https://github.com/majiayu000"><code>@majiayu000</code></a> made their first contribution in <a href="https://redirect.github.com/fatih/color/pull/275">fatih/color#275</a></li> <li><a href="https://github.com/UnSubble"><code>@UnSubble</code></a> made their first contribution in <a href="https://redirect.github.com/fatih/color/pull/269">fatih/color#269</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/fatih/color/compare/v1.18.0...v1.19.0">https://github.com/fatih/color/compare/v1.18.0...v1.19.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/fatih/color/commit/ca25f6e17f118a5a259f3c2c0d395949d1103a5a"><code>ca25f6e</code></a> Merge pull request <a href="https://redirect.github.com/fatih/color/issues/266">#266</a> from fatih/dependabot/github_actions/actions/setup-go-6</li> <li><a href="https://github.com/fatih/color/commit/120598440a16510564204450092d1e7925fad9ae"><code>1205984</code></a> Bump actions/setup-go from 5 to 6</li> <li><a href="https://github.com/fatih/color/commit/5715c20323d8c79f60d4944831fcfa3b76cd5734"><code>5715c20</code></a> Merge pull request <a href="https://redirect.github.com/fatih/color/issues/269">#269</a> from UnSubble/main</li> <li><a href="https://github.com/fatih/color/commit/2f6e2003760028129f34c4ad5c3728b904811d3c"><code>2f6e200</code></a> Merge branch 'main' into main</li> <li><a href="https://github.com/fatih/color/commit/f72ec947d0c34504dfd08b0db68d89f37503fc90"><code>f72ec94</code></a> Merge pull request <a href="https://redirect.github.com/fatih/color/issues/273">#273</a> from fatih/dependabot/github_actions/actions/checkout-6</li> <li><a href="https://github.com/fatih/color/commit/848e6330af5690fa24bb038d5330839a33f1f0e5"><code>848e633</code></a> Merge branch 'main' into main</li> <li><a href="https://github.com/fatih/color/commit/4c2cd3443934693bd8892fc0f7bb5bbec8e3788a"><code>4c2cd34</code></a> Add tests</li> <li><a href="https://github.com/fatih/color/commit/7f812f029c41eddd3ac7fbbdf6cc78e4b175944b"><code>7f812f0</code></a> Bump actions/checkout from 4 to 6</li> <li><a href="https://github.com/fatih/color/commit/b7fc9f9557629556aff702751b5268cefcbafa15"><code>b7fc9f9</code></a> Merge pull request <a href="https://redirect.github.com/fatih/color/issues/259">#259</a> from fatih/dependabot/github_actions/dominikh/staticc...</li> <li><a href="https://github.com/fatih/color/commit/239a88f715e8e35f40492da7a1e08f7173e78e05"><code>239a88f</code></a> Bump dominikh/staticcheck-action from 1.3.1 to 1.4.0</li> <li>Additional commits viewable in <a href="https://github.com/fatih/color/compare/v1.18.0...v1.19.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
4537413315 |
chore: bump google.golang.org/api from 0.271.0 to 0.272.0 (#23430)
Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.271.0 to 0.272.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p> <blockquote> <h2>v0.272.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.271.0...v0.272.0">0.272.0</a> (2026-03-16)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3534">#3534</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/b4d37a1279665d52b8b4672a6a91732ae8eb3cf6">b4d37a1</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3536">#3536</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/549ef3e69575edbe4fee27bc485a093dc88b90b3">549ef3e</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3537">#3537</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/6def284013185ab4ac2fa389594ee6013086d5d0">6def284</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3538">#3538</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/319b5abcbc42b77f6acc861e45365b65695e8096">319b5ab</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3539">#3539</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/73bcfcf9b2fd8def3aec1cdff10e6d4ee646af41">73bcfcf</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3541">#3541</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/6374c496fde577aa9f5b32470e45676ff4f69dde">6374c49</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.271.0...v0.272.0">0.272.0</a> (2026-03-16)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3534">#3534</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/b4d37a1279665d52b8b4672a6a91732ae8eb3cf6">b4d37a1</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3536">#3536</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/549ef3e69575edbe4fee27bc485a093dc88b90b3">549ef3e</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3537">#3537</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/6def284013185ab4ac2fa389594ee6013086d5d0">6def284</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3538">#3538</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/319b5abcbc42b77f6acc861e45365b65695e8096">319b5ab</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3539">#3539</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/73bcfcf9b2fd8def3aec1cdff10e6d4ee646af41">73bcfcf</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3541">#3541</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/6374c496fde577aa9f5b32470e45676ff4f69dde">6374c49</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/google-api-go-client/commit/e7df9fe0b92461f87b6d267a600e6825d1221e75"><code>e7df9fe</code></a> chore(main): release 0.272.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3535">#3535</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/5d8b2662ac4cd19ac978d9f08bedb59dc41c8247"><code>5d8b266</code></a> chore(all): update all (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3540">#3540</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/6374c496fde577aa9f5b32470e45676ff4f69dde"><code>6374c49</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3541">#3541</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/73bcfcf9b2fd8def3aec1cdff10e6d4ee646af41"><code>73bcfcf</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3539">#3539</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/319b5abcbc42b77f6acc861e45365b65695e8096"><code>319b5ab</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3538">#3538</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/6def284013185ab4ac2fa389594ee6013086d5d0"><code>6def284</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3537">#3537</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/549ef3e69575edbe4fee27bc485a093dc88b90b3"><code>549ef3e</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3536">#3536</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/b4d37a1279665d52b8b4672a6a91732ae8eb3cf6"><code>b4d37a1</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3534">#3534</a>)</li> <li>See full diff in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.271.0...v0.272.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Cian Johnston
|
ab86ed0df8 |
fix(site): stop hijacking navigation after archive-and-delete settles (#23372)
- Guard both `onSettled` callbacks in
`archiveAndDeleteMutation.mutate()` with `shouldNavigateAfterArchive()`,
which checks whether the user is still viewing the archived chat (or a
sub-agent of it) before calling `navigate("/agents")`
- Extract `shouldNavigateAfterArchive` into `agentWorkspaceUtils.ts`
with 6 unit test cases covering: direct match, different chat, no active
chat, sub-agent of archived parent, sub-agent of different parent, and
cache-cleared fallback
- Look up the active chat's `root_chat_id` from the per-chat query cache
(stable across WebSocket eviction of sub-agents) to handle the sub-agent
case
> 🤖 This PR was created with the help of Coder Agents, and has been
reviewed by my human. 🧑💻
|
||
|
dependabot[bot]
|
f2b9d5f8f7 |
chore: bump github.com/fergusstrange/embedded-postgres from 1.32.0 to 1.34.0 (#23428)
Bumps [github.com/fergusstrange/embedded-postgres](https://github.com/fergusstrange/embedded-postgres) from 1.32.0 to 1.34.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/fergusstrange/embedded-postgres/releases">github.com/fergusstrange/embedded-postgres's releases</a>.</em></p> <blockquote> <h2>v1.34.0</h2> <h2>What's Changed</h2> <ul> <li>Bump V18 from 18.0.0 to 18.3.0 to fix darwin/arm64 by <a href="https://github.com/nzoschke"><code>@nzoschke</code></a> in <a href="https://redirect.github.com/fergusstrange/embedded-postgres/pull/166">fergusstrange/embedded-postgres#166</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/nzoschke"><code>@nzoschke</code></a> made their first contribution in <a href="https://redirect.github.com/fergusstrange/embedded-postgres/pull/166">fergusstrange/embedded-postgres#166</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/fergusstrange/embedded-postgres/compare/v1.33.0...v1.34.0">https://github.com/fergusstrange/embedded-postgres/compare/v1.33.0...v1.34.0</a></p> <h2>v1.33.0</h2> <h2>What's Changed</h2> <ul> <li>Add support for Postgres 18 and update default version by <a href="https://github.com/otakakot"><code>@otakakot</code></a> in <a href="https://redirect.github.com/fergusstrange/embedded-postgres/pull/162">fergusstrange/embedded-postgres#162</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/otakakot"><code>@otakakot</code></a> made their first contribution in <a href="https://redirect.github.com/fergusstrange/embedded-postgres/pull/162">fergusstrange/embedded-postgres#162</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/fergusstrange/embedded-postgres/compare/v1.32.0...v1.33.0">https://github.com/fergusstrange/embedded-postgres/compare/v1.32.0...v1.33.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/fergusstrange/embedded-postgres/commit/490777eebf4d3fe8615496cd4fc8430f5b93379d"><code>490777e</code></a> Bump V18 from 18.0.0 to 18.3.0 to fix darwin/arm64 (<a href="https://redirect.github.com/fergusstrange/embedded-postgres/issues/166">#166</a>)</li> <li><a href="https://github.com/fergusstrange/embedded-postgres/commit/f351010461d7666dff82b7bf88986d1e4d5824af"><code>f351010</code></a> Update README.md</li> <li><a href="https://github.com/fergusstrange/embedded-postgres/commit/cf5b3570ca7fc727fae6e4874ec08b4818b705b1"><code>cf5b357</code></a> Update CircleCI config: add Rosetta installation step for macOS executor</li> <li><a href="https://github.com/fergusstrange/embedded-postgres/commit/a2782271984af1c658bc68ec5ead130968be4071"><code>a278227</code></a> Update CircleCI config: specify Go version 1.18 for macOS executor</li> <li><a href="https://github.com/fergusstrange/embedded-postgres/commit/e96b8985a6cf932ee40a412ab8403dc13073420e"><code>e96b898</code></a> Update CircleCI config: change Apple executor from m2 to m4</li> <li><a href="https://github.com/fergusstrange/embedded-postgres/commit/10719368a4343cc494f84db42b1a8a3199b6cc4f"><code>1071936</code></a> Update CircleCI config: rename cache steps for Go modules</li> <li><a href="https://github.com/fergusstrange/embedded-postgres/commit/2bb06046c7b832f9bd54034f2a665b01f6f037b5"><code>2bb0604</code></a> Update CircleCI config: modify macOS executor, upgrade xcode and go orb</li> <li><a href="https://github.com/fergusstrange/embedded-postgres/commit/8b9ced41d43db993baf672c7a3ac308c9822d99c"><code>8b9ced4</code></a> Add OSSI_TOKEN and OSSI_USERNAME to Nancy action environment</li> <li><a href="https://github.com/fergusstrange/embedded-postgres/commit/482d9032341eeede28e7f69637d3c0856721aae7"><code>482d903</code></a> Bump Nancy Vulnerability Checker to v1.0.52</li> <li><a href="https://github.com/fergusstrange/embedded-postgres/commit/3578d6e73071963906311f846e6cf51470203bdc"><code>3578d6e</code></a> Add support for Postgres 18 and update default version (<a href="https://redirect.github.com/fergusstrange/embedded-postgres/issues/162">#162</a>)</li> <li>See full diff in <a href="https://github.com/fergusstrange/embedded-postgres/compare/v1.32.0...v1.34.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
b73983e309 |
chore: bump ubuntu from 3ba65aa to ce4a593 in /dogfood/coder (#23434)
Bumps ubuntu from `3ba65aa` to `ce4a593`. [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
c11cc0ba30 |
chore: bump rust from 7d37016 to f7bf1c2 in /dogfood/coder (#23433)
Bumps rust from `7d37016` to `f7bf1c2`. [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Hugo Dutka
|
3163e74b77 |
fix: bump agents desktop resolution to 1920x1080 (#23425)
This PR changes agents desktop resolution from 1366x768 to 1920x1080. Anthropic requires the that the resolution of desktop screenshots fits in 1,150,000 total pixels, so we downscale screenshots to 1280x720 before sending them to the LLM provider. Resolution scaling was already implemented, but our code didn't exercise it. The resolution bump showed that there were some bugs in the scaling logic - this PR fixes these bugs too. |
||
|
Danielle Maywood
|
eca2257c26 | fix(site): enable word-level inline diff highlighting in DiffViewer (#23423) | ||
|
Mathias Fredriksson
|
75f5b60eb6 |
fix: return 409 Conflict instead of 502 when task agent is busy (#23424)
The "Task app is not ready to accept input" error occurs when the agent responds successfully but its status is not "stable" (e.g. "running"). This is a state conflict, not a gateway error. 502 was semantically wrong because the gateway communication succeeded. 409 Conflict is correct because the request conflicts with the agent's current state. This is consistent with how authAndDoWithTaskAppClient already returns 409 for pending, initializing, and paused agent states. |
||
|
Ethan
|
69d430f51b |
fix(site): fix flaky UsageUserDrillIn story assertion (#23416)
## Problem The `UsageUserDrillIn` play function in `AgentSettingsPageView.stories.tsx` flakes in Chromatic (noticed in #23282). After clicking a user row to drill into the detail view, sync assertions fire before React finishes the state transition — element not found. <img width="1110" height="649" alt="image" src="https://github.com/user-attachments/assets/8b5c36c2-09c4-4dd6-a280-ab6379c1464e" /> ### Root cause The play function clicks "Alice Liddell" and then waits with `findByText("Alice Liddell")` before asserting on detail-view content. But "Alice Liddell" appears in **both** the list row and the detail header, so `findByText` resolves immediately against the stale list-row text that is still in the DOM. The same is true for `"@alice"` — `UserRow` renders `@${user.username}` as a subtitle in the list, and `AvatarData` renders it again in the detail view. ### Fix Gate on `"User ID: ..."` instead — text that **only** renders in the detail panel. Once it is in the DOM, the detail view is fully mounted and all sync assertions are safe. Applied to both `UsageUserDrillIn` and `UsageUserDrillInAndBack`, which had the same issue. |
||
|
Ethan
|
0f3d40b97f |
fix(site): stabilize date params to break infinite query loop on agents/analytics (#23414)
## Problem `/agents/analytics` showed an infinite loading spinner. The browser devtools revealed repeated requests to the chat cost summary endpoint with `start_date` and `end_date` shifting by a few milliseconds on each request. `AgentAnalyticsPage` called `createDateRange(now)` on every render. When `now` is not passed (production), `createDateRange` falls through to `dayjs()`, which produces a new millisecond-precision timestamp each time. Those timestamps became part of the React Query key via `chatCostSummary()`, so every render created a new query identity, fired a new fetch, state-updated, re-rendered, and the cycle repeated. The page never left the loading branch because no query result was ever observed for the `current` key before it changed. The same pattern existed in `InsightsContent`, where `timeRangeToDates()` called `dayjs()` on every render and fed the result into `prInsights()`. Storybook didn't catch this because stories pass a fixed `now` prop, keeping the date range stable. ## Fix Anchor the date window once using `useState`'s lazy initializer, then derive `start_date`/`end_date` from the stable anchor during render — no `useEffect`, no memoization for correctness, just stable input → stable query key. - **`AgentAnalyticsPage`**: `const [anchor] = useState<Dayjs>(() => dayjs())`, then `createDateRange(now ?? anchor)`. The `now` prop still takes priority so Storybook snapshots remain deterministic. - **`InsightsContent`**: Collapses `timeRange` and its anchor into a single `TimeRangeSelection` state object. A fresh anchor is captured only when the user changes the selected range (event handler), not on render. Clicking the already-selected range is a no-op. |
||
|
dependabot[bot]
|
3729ff46fb |
chore: bump the coder-modules group across 2 directories with 1 update (#23413)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Danielle Maywood
|
b87171086c | refactor(site): restructure agents routing and directory layout (#23408) | ||
|
Kerem Kacel
|
b763b72b53 |
feat: add user:read scope (#23348)
Enables [23270](https://github.com/coder/coder/discussions/23270). Makes it possible for admin users to create API tokens scoped for reading users' data. |
||
|
Danielle Maywood
|
a08b6848f2 | fix(site): fix desktop reconnect loop by moving connection lifecycle into hook (#23404) | ||
|
Danielle Maywood
|
bf702cc3b9 | chore(site): update streamdown from 2.2.0 to 2.5.0 (#23407) |