opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity
15,280 Commits 479 Branches 388 Tags
27ed052d86b5c8a630ccaff45ca39632da2c419c
Commit Graph
15280 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
TJ 2be540e469 feat(site/src/pages/AISettingsPage/ModelsPage): add search and provider filter to models list (#26683) 
Adds a search input and provider filter dropdown above the Models table
on `/ai/settings/models`, and moves the `Default` badge to sit beside
the model name.

## Changes

- **Search**: text input matches against model display name, model
identifier, and provider label (case-insensitive).
- **Provider filter**: select dropdown listing every configured
provider, plus an `All providers` default.
- Filters apply before pagination and reset to page one when changed.
- New empty state when filters return no matches.
- Pagination footer now shows the filtered total, with `(filtered from
N)` when filters are active.
- `Default` badge moved from the Status column to inline next to the
model name.
- Stories cover the new search, provider filter, and no-match empty
state.

## Screenshots

Please see the Storybook stories under
`pages/AISettingsPage/ModelsPage/ModelsPageView` for `Default`,
`SearchByName`, `FilterByProvider`, and `NoMatchingModels`.

## Verification

- `pnpm --dir site exec biome check
src/pages/AISettingsPage/ModelsPage/`
- `pnpm --dir site exec tsc -p . --noEmit`
- `pnpm --dir site test:storybook -- --project=chromium
src/pages/AISettingsPage/ModelsPage/` (8/8 ModelsPageView stories pass;
the unrelated `MCP Tool Completed` failure under
`AgentsPage/components/ChatElements` reproduces on `main`)

---

> [!NOTE]
> Opened by Coder Agents on behalf of @tracyjohnsonux.
 2026-06-30 11:34:14 -07:00
Paweł Banaszewski 377c1309b7 chore: hide AI Gateway key management UI/CLI/API (#26879) 
Hides UI, CLI and API related to AI Gateway key management +
`/api/v2/ai-gateway/serve` endpoint.
API endpoints and CLI commands are still working they are just not
visible.
 2026-06-30 17:32:38 +00:00
Ehab Younes 22d9eaa4e4 fix(cli): increase agent log backups (#26863) 
The agent log rotation kept only about 55 MiB on disk, which could fall
short of the 24h support bundle lookback during high-volume debug
logging.

Increase the retained `coder-agent.log` rotations from 10 to 19 so the
active log plus rotations align with the existing 100 MiB debug logs
response cap.

Closes #26737
 2026-06-30 20:24:51 +03:00
Ehab Younes 6b297912a5 feat(site): add AI spend to user dropdown (#26698) 
Adds the current user's AI spend progress to the top navbar avatar
dropdown when /api/v2/users/me/ai/spend reports a configured spend
limit. The shared dropdown content accepts an optional profileExtra
slot so the Agents sidebar can opt in later without changing the
default sidebar UI.

Introduces a temporary site API type and a React Query helper for
AIGOV-473 that refetches each time the dropdown opens, plus shared
budget progress helpers used by both the new dropdown bar and the
existing Agents usage indicator. The shared AIBudgetUsage component
moves to site/src/components so the dropdown and group budget UI
format spend identically, including the unlimited case. The avatar
border polls the spend endpoint and is colored by severity while the
dropdown is closed.

Closes AIGOV-473
 2026-06-30 19:59:13 +03:00
Danielle Maywood 496c0576ca fix(site): rename model action to Set as Coder Agents default model (#26872) 2026-06-30 17:22:57 +01:00
Danielle Maywood 7234b5667b fix(site): autosave personal model overrides toggle (#26871) 2026-06-30 17:22:28 +01:00
Jeremy Ruppel a153b77fa5 feat(site/src/pages/TemplateBuilder): add alternatives box to base template step (#26878) 
Adds an "Alternatives to create a template" section below the navigation
controls on the base infrastructure selection step of the Template
Builder wizard. The box is only shown on the first step and contains
four outline buttons linking to other template creation paths:

- **Start from scratch** -> Coder docs tutorial (external)
- **Upload an existing template** -> `/starter-templates` (internal)
- **Browse community templates** -> Registry templates (external)
- **Use template agent skill** -> Registry skills (external)

External links open in a new tab with an external-link icon.

Closes [DEVEX-564](https://linear.app/codercom/issue/DEVEX-564)

> [!NOTE]
> This PR was authored by Coder Agents on behalf of @jeremyruppel.

<details>
<summary>Implementation plan</summary>

### 1. `TemplateAlternatives.tsx` (new)
- Presentational component rendering a bordered container with label and
four `Button` components (variant `outline`, size `sm`)
- External links use `ExternalLinkIcon` from lucide-react and open in
`_blank`
- Internal link uses React Router `Link`

### 2. `TemplateBuilderPageView.tsx` (modified)
- Import and render `<TemplateAlternatives />` below navigation
controls, conditionally when `currentStep.id === "base-infra"`

### 3. `TemplateAlternatives.stories.tsx` (new)
- Default Storybook story for the component

</details>
 2026-06-30 16:02:06 +00:00
Mathias Fredriksson 2fd5ae4323 fix: stop Agents dead-ending on unsupported providers (#26841) 
Configuring only a GitHub Copilot provider left the Agents page stuck on
"set up a provider then add a model", even with a provider and models
configured. The catalog dropped any provider type that NormalizeProvider
did not recognize, so a Copilot-only deployment looked identical to an
empty one and never unlocked the page.

The Agents harness cannot use Copilot: it needs a per-request token only
an official Copilot client can mint, and the harness is not one. Instead
of dropping such providers, the catalog now reports them as unsupported
so the UI can explain the dead end and point elsewhere, rather than ask
for setup that already happened. The providers stay usable through the
AI Gateway proxy.

Support is derived from the provider type, not stored, so there is no
migration. codersdk.IsAgentsUnsupportedProviderType is the single source
of truth, consulted by the chatd catalog and, through the generated
AgentsUnsupportedProviderTypes list, the frontend.

The diff also carries unrelated modernization of nearby db2sdk and
chatprovider helpers (slices.SortFunc, strings.Cut, range-over-int).

Closes CODAGT-627
Refs CODAGT-256
Refs CODAGT-682
 2026-06-30 18:49:50 +03:00
Jake Howell a79fcd34af feat: implement <WorkspaceDeletedBanner /> on <WorkspaceBuildPage /> (#25664) 
Closes #24731 

This pull-request attempts to pull the workspace when it has been
deleted, as to not show a generic error on the `<WorkspaceBuildPage />`.
This secondary query for the workspace is only initiated if we get an
error from the build itself, this is to ascertain if there actually was
a workspace here previously or if we are actually 404ing.

Future improvements might be to `410 Gone` these workspaces/builds.
 2026-06-30 15:29:28 +00:00
Bobby Ho 608bc6e837 fix(scripts/oauth2): fix test-mcp-oauth2.sh for macOS and OAuth 2.1 compliance (#26825) 
The `test-mcp-oauth2.sh` script had three bugs that caused tests 2, 3,
and 4 to fail when run on macOS.

`grep -oP` uses PCRE lookbehind (`\K`), which is not supported by BSD
grep on macOS. Replaced with `grep -oE … | sed 's/code=//'` which works
on both platforms.

The token exchange requests in tests 2, 3, and 4 omitted `redirect_uri`,
which is required by RFC 6749 §4.1.3 whenever `redirect_uri` was
included in the authorization request. The server correctly rejects
these with `invalid_grant`, masking the actual PKCE validation.

Test 4's resource parameter flow was missing PKCE parameters entirely.
The server enforces PKCE on all authorization code flows per OAuth 2.1,
so the authorization request returned 400 and the script exited silently
due to `set -euo pipefail`.
 2026-06-30 08:02:55 -07:00
Ethan d219f96ba5 fix(cli): join MCP reporter and watcher goroutines before exit (#26847) 
## Problem

`TestExpMcpReporter/Reconnect` flakes under the race detector with a
data race on the shared `*serpent.Invocation`'s `inv.Stderr` field.

The MCP server's reporter and watcher goroutines write status warnings
via `cliui.Warnf(inv.Stderr, ...)`, but they were launched
fire-and-forget with nothing tying their lifetime to the command
handler. On shutdown, `startServer`'s deferred restore of
`inv.Stdin/Stdout/Stderr` could run concurrently with a still-running
goroutine reading `inv.Stderr`, which the race detector flags. The
reporter's error suppression only swallows `context.Canceled`, so a
shutdown error from an in-flight `UpdateAppStatus` RPC (a drpc "closed"
error, not `context.Canceled`) reaches the `Warnf` call and races the
restore.

## Fix

Track the reporter and watcher goroutines on a `sync.WaitGroup`. After
`startServer` returns, cancel the context, close the queue and socket
client, then `wg.Wait()` for the goroutines to exit before returning.
All three unblocks are needed: cancel stops the watcher retry loop and a
reporter blocked on `Pop`, `queue.Close` also unblocks `Pop`, and
`socketClient.Close` unblocks a reporter parked in an in-flight RPC.

This also removes the stdin/stdout/stderr save/restore in `startServer`,
which only ever wrote back identical values and was the racing write.

This mirrors the existing precedent in `cli/ssh.go`, where a
`sync.WaitGroup` guards against "logging while closing the log file in a
defer."

Verified with `go test ./cli -run 'TestExpMcpReporter/Reconnect' -race
-count=50` (the reproducer from the issue) plus a 240-execution parallel
stress run of the full `TestExpMcp` suite under `-race`, all green.

Closes CODAGT-710
Closes https://github.com/coder/internal/issues/1610
 2026-07-01 00:16:25 +10:00
Sas Swart d179266cc7 feat: capture, persist, and strip Agent Firewall correlation headers in AI Bridge (#26529) 
Wire the Agent Firewall correlation headers
(`X-Coder-Agent-Firewall-Session-Id` and
`X-Coder-Agent-Firewall-Sequence-Number`) through the AI Bridge
interception processor so that each interception is linked to its
originating firewall session.

Closes https://linear.app/codercom/issue/AIGOV-259

> Generated by Coder Agents on behalf of @SasSwart

**Data flow:**
`request header` → `bridge.go` reads + strips → `InterceptionRecord` →
`translator.go` → proto `RecordInterceptionRequest` →
`aibridgedserver.go` → DB
 2026-06-30 14:01:27 +02:00
dependabot[bot] 681d77154b chore: bump github.com/valyala/fasthttp from 1.71.0 to 1.72.0 (#26859) 
Bumps [github.com/valyala/fasthttp](https://github.com/valyala/fasthttp)
from 1.71.0 to 1.72.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/valyala/fasthttp/releases">github.com/valyala/fasthttp's
releases</a>.</em></p>
<blockquote>
<h2>v1.72.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update to go1.25 as minimal version by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2205">valyala/fasthttp#2205</a></li>
<li>client: add aggregate connection count metrics by <a
href="https://github.com/z9z"><code>@​z9z</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2201">valyala/fasthttp#2201</a></li>
<li>fix(server): return ErrMissingFile when MultipartForm.File is nil by
<a href="https://github.com/u5surf"><code>@​u5surf</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2260">valyala/fasthttp#2260</a></li>
<li>bug: FS cache cleaner goroutine leaks when CleanStop is nil
(default) (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2218">#2218</a>),
<a
href="https://redirect.github.com/valyala/fasthttp/issues/2247">#2247</a>
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2271">valyala/fasthttp#2271</a></li>
<li>bug: data race on pipeline client c.chR during worker drain (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2220">#2220</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2272">valyala/fasthttp#2272</a></li>
<li>bug: TCPDialer.tcpAddrsClean() goroutine leaks — no shutdown
mechanism (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2222">#2222</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2273">valyala/fasthttp#2273</a></li>
<li>bug: double concurrency counter increment in ServeConn causes
counter leak (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2238">#2238</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2275">valyala/fasthttp#2275</a></li>
<li>bug: body stream leak in compression methods when response is
discarded (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2244">#2244</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2276">valyala/fasthttp#2276</a></li>
<li>bug: InMemoryListener deadlock under high concurrency (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2245">#2245</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2277">valyala/fasthttp#2277</a></li>
<li>bug: fasthttpadaptor writer leak, data race, and crash on handler
panic (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2246">#2246</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2278">valyala/fasthttp#2278</a></li>
<li>bug: fasthttpproxy dialers return nil DialFunc on error, causing
panic (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2248">#2248</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2279">valyala/fasthttp#2279</a></li>
<li>bug: closeIdleConns TOCTOU race with serveConn idle timestamp (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2250">#2250</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2280">valyala/fasthttp#2280</a></li>
<li>bug: AppendCert/AppendCertEmbed not thread-safe (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2251">#2251</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2281">valyala/fasthttp#2281</a></li>
<li>bug: SetBodySizePoolLimit data race — plain int written without
synchronization (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2252">#2252</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2282">valyala/fasthttp#2282</a></li>
<li>bug: file descriptor leak in prefork parent process (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2253">#2253</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2283">valyala/fasthttp#2283</a></li>
<li>security: SO_REUSEADDR on Windows enables port hijacking (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2254">#2254</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2284">valyala/fasthttp#2284</a></li>
<li>bug: file descriptor leak on z/OS s390x when FcntlInt fails (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2255">#2255</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2285">valyala/fasthttp#2285</a></li>
<li>bug: filesLockMap grows unboundedly, leaking memory (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2256">#2256</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2286">valyala/fasthttp#2286</a></li>
<li>security: TLS verification silently disabled for malformed addresses
(<a
href="https://redirect.github.com/valyala/fasthttp/issues/2236">#2236</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2274">valyala/fasthttp#2274</a></li>
<li>fix(fs): remove temporary file when compression fails by <a
href="https://github.com/u5surf"><code>@​u5surf</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2264">valyala/fasthttp#2264</a></li>
<li>fix double release of streamed client response body by <a
href="https://github.com/Mereng"><code>@​Mereng</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2211">valyala/fasthttp#2211</a></li>
<li>fix(client): switch to GET on 303 redirect per RFC 9110 by <a
href="https://github.com/u5surf"><code>@​u5surf</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2265">valyala/fasthttp#2265</a></li>
<li>ci: re-enable gocritic deferInLoop check for non-test code by <a
href="https://github.com/u5surf"><code>@​u5surf</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2288">valyala/fasthttp#2288</a></li>
<li>Fix flaky race tests by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2292">valyala/fasthttp#2292</a></li>
<li>fix(lbclient): prevent deadlock when all clients are removed by <a
href="https://github.com/u5surf"><code>@​u5surf</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2287">valyala/fasthttp#2287</a></li>
<li>reject duplicate Content-Length in response header parser by <a
href="https://github.com/alhudz"><code>@​alhudz</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2294">valyala/fasthttp#2294</a></li>
<li>strip cr/lf from header keys in normalizeHeaderKey by <a
href="https://github.com/alhudz"><code>@​alhudz</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2295">valyala/fasthttp#2295</a></li>
<li>fix(client): guard nil waiter in decConnsCount by <a
href="https://github.com/SAY-5"><code>@​SAY-5</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2266">valyala/fasthttp#2266</a></li>
<li>strip semicolons from cookie setters to block attribute injection by
<a href="https://github.com/alhudz"><code>@​alhudz</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2298">valyala/fasthttp#2298</a></li>
<li>feat(prefork): graceful shutdown, leak fixes, hook robustness
(re-open of <a
href="https://redirect.github.com/valyala/fasthttp/issues/2180">#2180</a>
follow-up) by <a
href="https://github.com/ReneWerner87"><code>@​ReneWerner87</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2199">valyala/fasthttp#2199</a></li>
<li>fix: prevent data race on FSCompressedFileSuffixes map by <a
href="https://github.com/xbrxr03"><code>@​xbrxr03</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2300">valyala/fasthttp#2300</a></li>
<li>reject duplicate Transfer-Encoding in request header parser by <a
href="https://github.com/alhudz"><code>@​alhudz</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2303">valyala/fasthttp#2303</a></li>
<li>preserve duplicate request headers in ConvertRequest by <a
href="https://github.com/alhudz"><code>@​alhudz</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2305">valyala/fasthttp#2305</a></li>
<li>fix(server): close listener on serve error in ListenAndServe helpers
by <a href="https://github.com/fereidani"><code>@​fereidani</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2304">valyala/fasthttp#2304</a></li>
<li>validate trailer values in parseTrailer by <a
href="https://github.com/alhudz"><code>@​alhudz</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2301">valyala/fasthttp#2301</a></li>
<li>Avoid default content type for empty requests by <a
href="https://github.com/nkgotcode"><code>@​nkgotcode</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2296">valyala/fasthttp#2296</a></li>
<li>chore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2210">valyala/fasthttp#2210</a></li>
<li>chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2209">valyala/fasthttp#2209</a></li>
<li>chore(deps): bump golang.org/x/sys from 0.44.0 to 0.45.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2208">valyala/fasthttp#2208</a></li>
<li>chore(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2207">valyala/fasthttp#2207</a></li>
<li>chore(deps): bump securego/gosec from 2.26.1 to 2.27.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2261">valyala/fasthttp#2261</a></li>
<li>chore(deps): bump securego/gosec from 2.27.0 to 2.27.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2267">valyala/fasthttp#2267</a></li>
<li>chore(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2289">valyala/fasthttp#2289</a></li>
<li>chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2290">valyala/fasthttp#2290</a></li>
<li>chore(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2291">valyala/fasthttp#2291</a></li>
<li>chore(deps): bump actions/checkout from 6 to 7 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2297">valyala/fasthttp#2297</a></li>
</ul>
<h2>New Contributors</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/valyala/fasthttp/commit/37a31d78c5d221b24b9cb6652481b5acd4dd674f"><code>37a31d7</code></a>
Avoid default content type for empty requests (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2296">#2296</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/d93cb94af2c31641d00025140785609ddd746eb3"><code>d93cb94</code></a>
validate trailer values in parseTrailer (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2301">#2301</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/9d21d3546ab1d8422b0b5b2801e46aef568619ce"><code>9d21d35</code></a>
Remove unused uint322ip, inline ip2uint32</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/eb82c9a13addbe488f69cbf530444bb2561fd083"><code>eb82c9a</code></a>
Reject invalid cookie values during parsing</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/598e2e06218dbcaf4da6b3723477effd9d7b6233"><code>598e2e0</code></a>
fix(server): close listener on serve error in ListenAndServe helpers (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2304">#2304</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/134a8fedab6eb02fda4b8d96c48d2a72082d2e0c"><code>134a8fe</code></a>
preserve duplicate request headers in ConvertRequest (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2305">#2305</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/7bca504536636cf77726f3018365626a8b975b5f"><code>7bca504</code></a>
reject duplicate Transfer-Encoding in request header parser (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2303">#2303</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/9ee3c15997f8ab21519c2728017e9fbff03fe142"><code>9ee3c15</code></a>
docs: document FSCompressedFileSuffixes is not safe for concurrent
modificati...</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/2c1590038fa5d0e04896c8b0aafc138ce286bfa7"><code>2c15900</code></a>
feat(prefork): graceful shutdown, leak fixes, hook robustness (re-open
of <a
href="https://redirect.github.com/valyala/fasthttp/issues/21">#21</a>...</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/ec58c6e67ee8f608a673cc01f07f045d04fa17b5"><code>ec58c6e</code></a>
strip semicolons from cookie setters to block attribute injection (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2298">#2298</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/valyala/fasthttp/compare/v1.71.0...v1.72.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/valyala/fasthttp&package-manager=go_modules&previous-version=1.71.0&new-version=1.72.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-30 11:18:33 +00:00
Cian Johnston e5b7e74847 test: migrate chatd tests to AI Gateway routing (#26658) 
Refs CODAGT-681

Migrates all chatd tests from `AIGatewayRoutingEnabled = false` (direct
routing) to AI Gateway routing using the test helpers extracted in
#26639.

- `coderd/x/chatd/chatd_test.go` — 6 full-server tests migrated to
`NewWithAPI` + daemon, `directChatRoutingDeploymentValues` helper
deleted, 3 bare-chatd tests renamed
- `coderd/x/chatd/context_integration_test.go` — 2 tests migrated
- `coderd/exp_chats_test.go` — `chatDeploymentValues` helper deleted,
all 5 helper functions now use `NewWithAPI` + daemon internally (no call
site changes)
- `coderd/exp_chats_acl_test.go` — stale `chatDeploymentValues`
reference replaced
- `enterprise/coderd/exp_chats_test.go` — 9 sites across 5
`TestChatStreamRelay` subtests migrated
- `cli/exp_scaletest_chat_test.go` — 1 test migrated
- `coderd/x/chatd/model_routing_internal_test.go` — 1 direct-only test
removed
- `coderd/x/chatd/chatd_internal_test.go` — 1 direct-only test removed

> 🤖
 2026-06-30 12:17:42 +01:00
dependabot[bot] 33780758c1 chore: bump github.com/open-policy-agent/opa from 1.17.0 to 1.18.1 (#26858) 
Bumps
[github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa)
from 1.17.0 to 1.18.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-policy-agent/opa/releases">github.com/open-policy-agent/opa's
releases</a>.</em></p>
<blockquote>
<h2>v1.18.1</h2>
<p>This release fixes a memory leak introduced in OPA v1.17.0. It is
advised to update if you notice excess memory usage when running OPA
server.</p>
<h3>Fixes</h3>
<ul>
<li>ast: fix AnnotationSet memory leak via runtime.AddCleanup cycle (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8817">#8817</a>)
authored by <a
href="https://github.com/srenatus"><code>@​srenatus</code></a> reported
by <a href="https://github.com/keydon"><code>@​keydon</code></a> and <a
href="https://github.com/gorsr01"><code>@​gorsr01</code></a></li>
</ul>
<h2>v1.18.0</h2>
<p>This release contains a mix of bugfixes and small features.
Notably:</p>
<ul>
<li>A breaking fix to the outbound <code>User-Agent</code> header so it
conforms to RFC 9110 (see below)</li>
<li>Container-aware resource limits: automatic <code>GOMAXPROCS</code>
is restored and automatic <code>GOMEMLIMIT</code> is now supported</li>
<li>Several <code>opa fmt</code> correctness fixes</li>
<li>Improvements to <code>opa test --coverage</code> (ranges in report,
inline rule head tracking, conjunction-expression coverage)</li>
</ul>
<h3>Breaking: Fix User-Agent according to RFC9110 (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8792">#8792</a>)</h3>
<p>OPA's outbound HTTP requests (bundle, discovery, decision log,
status, <code>http.send</code>, AWS KMS/ECR)
previously sent <code>User-Agent: Open Policy Agent/&lt;version&gt;
(&lt;os&gt;, &lt;arch&gt;)</code>, which is not a valid
RFC 9110 <code>User-Agent</code> value because the <code>product</code>
token cannot contain spaces. The header is now
<code>Open-Policy-Agent/&lt;version&gt; (&lt;os&gt;,
&lt;arch&gt;)</code>. Server-side log filters or WAF rules that
exact-match the old string will need to be updated.</p>
<p>Authored by <a
href="https://github.com/sspaink"><code>@​sspaink</code></a>, reported
by <a href="https://github.com/SpecLad"><code>@​SpecLad</code></a></p>
<h3>Runtime, SDK, Tooling</h3>
<ul>
<li>bundle: fix per-module rego version lookup (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8797">#8797</a>)
authored by <a
href="https://github.com/sspaink"><code>@​sspaink</code></a>, reported
by <a
href="https://github.com/xubinzheng"><code>@​xubinzheng</code></a></li>
<li>bundle: improve determinism of <code>file_rego_versions</code>
patterns with overlap (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8733">#8733</a>)
authored by <a
href="https://github.com/philipaconrad"><code>@​philipaconrad</code></a></li>
<li>cover: Track inline rule head in post trace walk (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/6531">#6531</a>)
authored by <a
href="https://github.com/charlieegan3"><code>@​charlieegan3</code></a>,
reported by <a
href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li>
<li>cover: Update report to include ranges (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8748">#8748</a>)
reported and authored by <a
href="https://github.com/charlieegan3"><code>@​charlieegan3</code></a></li>
<li>cover: Add support for coverage of conjunction exprs (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8809">#8809</a>)
authored by <a
href="https://github.com/charlieegan3"><code>@​charlieegan3</code></a></li>
<li>download/oci: Set Accept headers (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8720">#8720</a>)
authored by <a
href="https://github.com/charlieegan3"><code>@​charlieegan3</code></a></li>
<li>fmt: preserve the multiline but single entry iterables (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8557">#8557</a>)
authored by <a
href="https://github.com/unichronic"><code>@​unichronic</code></a>,
reported by <a
href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li>
<li>format: Fix dropped with-clause after comment in object value (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8765">#8765</a>)
authored by <a
href="https://github.com/sspaink"><code>@​sspaink</code></a>, reported
by <a
href="https://github.com/srabraham"><code>@​srabraham</code></a></li>
<li>format: keep lone <code>with</code> on the closing-bracket line of
multi-line expressions (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8804">#8804</a>)
authored by <a
href="https://github.com/anneheartrecord"><code>@​anneheartrecord</code></a>,
reported by <a
href="https://github.com/burnster"><code>@​burnster</code></a></li>
<li>oracle: Fix find-definition on expressions inside
<code>ast.Not</code> nodes (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8731">#8731</a>)
authored by <a
href="https://github.com/johanfylling"><code>@​johanfylling</code></a></li>
<li>runtime: Restore goautomaxprocs, add automemlimit (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8784">#8784</a>)
authored by <a
href="https://github.com/charlieegan3"><code>@​charlieegan3</code></a></li>
</ul>
<h3>Compiler, Topdown and Rego</h3>
<ul>
<li>ast: Apply location to inner <code>ast.Not</code> expressions (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8717">#8717</a>)
authored by <a
href="https://github.com/johanfylling"><code>@​johanfylling</code></a>,
reported by <a
href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li>
<li>ast: Clean up code for value comparisons (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8737">#8737</a>)
authored by <a
href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li>
<li>ast: Fix PE regression for <code>future.keywords.not</code> negation
inside <code>every</code> (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8781">#8781</a>)
authored by <a
href="https://github.com/johanfylling"><code>@​johanfylling</code></a></li>
<li>internal/edittree: Add recursive tree node recycling (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8693">#8693</a>)
authored by <a
href="https://github.com/philipaconrad"><code>@​philipaconrad</code></a></li>
<li>internal: compile,planner: improve determinism of
<code>plan</code>/<code>wasm</code> bundle builds (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8732">#8732</a>)
authored by <a
href="https://github.com/philipaconrad"><code>@​philipaconrad</code></a></li>
<li>perf: avoid allocations in <code>object.get</code> (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8729">#8729</a>)
authored by <a
href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li>
<li>topdown: Fix PE not namespacing vars in comprehensions nested inside
<code>every</code> (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8816">#8816</a>)
authored by <a
href="https://github.com/johanfylling"><code>@​johanfylling</code></a></li>
<li>topdown: remove <code>dst.Compare(src)</code> shortcut (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8739">#8739</a>)
authored by <a
href="https://github.com/srenatus"><code>@​srenatus</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md">github.com/open-policy-agent/opa's
changelog</a>.</em></p>
<blockquote>
<h1>Change Log</h1>
<p>All notable changes to this project will be documented in this file.
This
project adheres to <a href="http://semver.org/">Semantic
Versioning</a>.</p>
<h2>Unreleased</h2>
<h2>1.18.0</h2>
<p>This release contains a mix of bugfixes and small features.
Notably:</p>
<ul>
<li>A breaking fix to the outbound <code>User-Agent</code> header so it
conforms to RFC 9110 (see below)</li>
<li>Container-aware resource limits: automatic <code>GOMAXPROCS</code>
is restored and automatic <code>GOMEMLIMIT</code> is now supported</li>
<li>Several <code>opa fmt</code> correctness fixes</li>
<li>Improvements to <code>opa test --coverage</code> (ranges in report,
inline rule head tracking, conjunction-expression coverage)</li>
</ul>
<h3>Breaking: Fix User-Agent according to RFC9110 (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8792">#8792</a>)</h3>
<p>OPA's outbound HTTP requests (bundle, discovery, decision log,
status, <code>http.send</code>, AWS KMS/ECR)
previously sent <code>User-Agent: Open Policy Agent/&lt;version&gt;
(&lt;os&gt;, &lt;arch&gt;)</code>, which is not a valid
RFC 9110 <code>User-Agent</code> value because the <code>product</code>
token cannot contain spaces. The header is now
<code>Open-Policy-Agent/&lt;version&gt; (&lt;os&gt;,
&lt;arch&gt;)</code>. Server-side log filters or WAF rules that
exact-match the old string will need to be updated.</p>
<p>Authored by <a
href="https://github.com/sspaink"><code>@​sspaink</code></a>, reported
by <a href="https://github.com/SpecLad"><code>@​SpecLad</code></a></p>
<h3>Runtime, SDK, Tooling</h3>
<ul>
<li>bundle: fix per-module rego version lookup (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8797">#8797</a>)
authored by <a
href="https://github.com/sspaink"><code>@​sspaink</code></a>, reported
by <a
href="https://github.com/xubinzheng"><code>@​xubinzheng</code></a></li>
<li>bundle: improve determinism of <code>file_rego_versions</code>
patterns with overlap (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8733">#8733</a>)
authored by <a
href="https://github.com/philipaconrad"><code>@​philipaconrad</code></a></li>
<li>cover: Track inline rule head in post trace walk (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/6531">#6531</a>)
authored by <a
href="https://github.com/charlieegan3"><code>@​charlieegan3</code></a>,
reported by <a
href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li>
<li>cover: Update report to include ranges (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8748">#8748</a>)
reported and authored by <a
href="https://github.com/charlieegan3"><code>@​charlieegan3</code></a></li>
<li>cover: Add support for coverage of conjunction exprs (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8809">#8809</a>)
authored by <a
href="https://github.com/charlieegan3"><code>@​charlieegan3</code></a></li>
<li>download/oci: Set Accept headers (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8720">#8720</a>)
authored by <a
href="https://github.com/charlieegan3"><code>@​charlieegan3</code></a></li>
<li>fmt: preserve the multiline but single entry iterables (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8557">#8557</a>)
authored by <a
href="https://github.com/unichronic"><code>@​unichronic</code></a>,
reported by <a
href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li>
<li>format: Fix dropped with-clause after comment in object value (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8765">#8765</a>)
authored by <a
href="https://github.com/sspaink"><code>@​sspaink</code></a>, reported
by <a
href="https://github.com/srabraham"><code>@​srabraham</code></a></li>
<li>format: keep lone <code>with</code> on the closing-bracket line of
multi-line expressions (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8804">#8804</a>)
authored by <a
href="https://github.com/anneheartrecord"><code>@​anneheartrecord</code></a>,
reported by <a
href="https://github.com/burnster"><code>@​burnster</code></a></li>
<li>oracle: Fix find-definition on expressions inside
<code>ast.Not</code> nodes (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8731">#8731</a>)
authored by <a
href="https://github.com/johanfylling"><code>@​johanfylling</code></a></li>
<li>runtime: Restore goautomaxprocs, add automemlimit (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8784">#8784</a>)
authored by <a
href="https://github.com/charlieegan3"><code>@​charlieegan3</code></a></li>
</ul>
<h3>Compiler, Topdown and Rego</h3>
<ul>
<li>ast: Apply location to inner <code>ast.Not</code> expressions (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8717">#8717</a>)
authored by <a
href="https://github.com/johanfylling"><code>@​johanfylling</code></a>,
reported by <a
href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li>
<li>ast: Clean up code for value comparisons (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8737">#8737</a>)
authored by <a
href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li>
<li>ast: Fix PE regression for <code>future.keywords.not</code> negation
inside <code>every</code> (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8781">#8781</a>)
authored by <a
href="https://github.com/johanfylling"><code>@​johanfylling</code></a></li>
<li>internal/edittree: Add recursive tree node recycling (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8693">#8693</a>)
authored by <a
href="https://github.com/philipaconrad"><code>@​philipaconrad</code></a></li>
<li>internal: compile,planner: improve determinism of
<code>plan</code>/<code>wasm</code> bundle builds (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8732">#8732</a>)
authored by <a
href="https://github.com/philipaconrad"><code>@​philipaconrad</code></a></li>
<li>perf: avoid allocations in <code>object.get</code> (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8729">#8729</a>)
authored by <a
href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li>
<li>topdown: Fix PE not namespacing vars in comprehensions nested inside
<code>every</code> (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8816">#8816</a>)
authored by <a
href="https://github.com/johanfylling"><code>@​johanfylling</code></a></li>
<li>topdown: remove <code>dst.Compare(src)</code> shortcut (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8739">#8739</a>)
authored by <a
href="https://github.com/srenatus"><code>@​srenatus</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/open-policy-agent/opa/commit/acc8bf9f88bbef57c500dbdd7231509e48ade525"><code>acc8bf9</code></a>
Release v1.18.1</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/713dc6a42757e4b175ec8f74d58e341f89004467"><code>713dc6a</code></a>
ast: fix AnnotationSet memory leak via runtime.AddCleanup cycle</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/cc2c5c60a4c486f15a5e8de457e96ed0fefaf5fe"><code>cc2c5c6</code></a>
Prepare v1.18 release (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8820">#8820</a>)</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/e72a98fb10b43cfc4067568de8909c669e8a1b79"><code>e72a98f</code></a>
format: keep lone <code>with</code> on the closing-bracket line of
multi-line expression...</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/03646dde18924c2c74a13526e4cea408dcbb4481"><code>03646dd</code></a>
topdown: Fix PE not namespacing vars in comprehensions nested inside
<code>every</code> ...</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/bf2bb5261cf84958c295dd74e763837e2c021fd8"><code>bf2bb52</code></a>
benchmarks: split off script, emit markdown table</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/02ce276093b85d101172045f0307d53f5f9cc89d"><code>02ce276</code></a>
version: fix ill-formed User-Agent header (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8796">#8796</a>)</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/1fdbb77dd6b7aaf65dffd8c23563df72a59639a3"><code>1fdbb77</code></a>
build(deps): bump the dependencies group across 2 directories with 6
updates</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/954196aaa43841958547b1a0ba564e591d342a67"><code>954196a</code></a>
cover: Add support for coverage of conjunction exprs (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8809">#8809</a>)</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/dec8333b32aed9189721220f3e8101460ebb170f"><code>dec8333</code></a>
deduplicate change-detection output in pr CI checks (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8808">#8808</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-policy-agent/opa/compare/v1.17.0...v1.18.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/open-policy-agent/opa&package-manager=go_modules&previous-version=1.17.0&new-version=1.18.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-30 11:17:30 +00:00
dependabot[bot] d440e71109 chore: bump golang.org/x/tools from 0.46.0 to 0.47.0 in the x group (#26857) 
Bumps the x group with 1 update:
[golang.org/x/tools](https://github.com/golang/tools).

Updates `golang.org/x/tools` from 0.46.0 to 0.47.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/tools/commit/fbf9f2e2c8124fbe1877f5ed2857111038d9fe12"><code>fbf9f2e</code></a>
gopls/internal/cmd: add tests of 'gopls help'</li>
<li><a
href="https://github.com/golang/tools/commit/e891f79e03c0d60a806f959113eb8a748a3dd3fe"><code>e891f79</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/tools/commit/0602b30930e307645a5b43697b316a5599dea9a1"><code>0602b30</code></a>
gopls: revert CLI usability revamp to stabilize release</li>
<li><a
href="https://github.com/golang/tools/commit/60c2434eca161a47c4697fdf65718dc259c1cf5b"><code>60c2434</code></a>
gopls/internal/cmd: fix regression in initialization</li>
<li><a
href="https://github.com/golang/tools/commit/29e158310c709074e3cc2f7f1cd5ab9af11eb13b"><code>29e1583</code></a>
gopls/internal/mcp: go_diagnostics: use idiomatic iterators</li>
<li><a
href="https://github.com/golang/tools/commit/0772d6a918b878bf9983d765a65af011d84483b4"><code>0772d6a</code></a>
go/ssa: add test for fix of <a
href="https://redirect.github.com/golang/go/issues/73871">golang/go#73871</a>
in go/types@go1.25</li>
<li><a
href="https://github.com/golang/tools/commit/0fdde844aba91691351f38a7f1da04354170017e"><code>0fdde84</code></a>
gopls/internal/tool: rename Application to Command and embed in
SubCommand</li>
<li><a
href="https://github.com/golang/tools/commit/bd9e76d9f0ec7faf1dc77d440463c182ac9c348c"><code>bd9e76d</code></a>
go/callgraph/vta: document ssa.InstantiateGenerics requirement</li>
<li><a
href="https://github.com/golang/tools/commit/d711ac7849d4f5456228745090323144c4c2d190"><code>d711ac7</code></a>
go/ssa: remove incorrect hasTypeParams check</li>
<li><a
href="https://github.com/golang/tools/commit/439decda73f3e6449050bcb3a0241ed96d5e74e1"><code>439decd</code></a>
gopls/internal/cache/xrefs: avoid materializing Inspector</li>
<li>Additional commits viewable in <a
href="https://github.com/golang/tools/compare/v0.46.0...v0.47.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/tools&package-manager=go_modules&previous-version=0.46.0&new-version=0.47.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-30 11:15:40 +00:00
Cian Johnston cb6a75717c fix(coderd/x/chatd): bind goInflight contexts to server lifetime (#26811) 
fix(coderd/x/chatd): bind goInflight contexts to server lifetime
- Add Server.inflightContext: WithoutCancel(reqCtx) bound to p.ctx via
  context.AfterFunc, so Close cancels in-flight work instead of blocking
  on the caller's timeout while a provider is unreachable.
- Apply at GenerateChatTitleAsync, finalizeSuccessfulTurnStatusLabelWithAfterFunc,
  setLastTurnSummaryAsync, clearLastTurnSummaryAsync, and scheduleDebugCleanup.
- Honor cleanupCtx in the debug retry-delay timer so cancellation lands
  promptly between attempts.

> 🤖
 2026-06-30 10:51:59 +01:00
Jon Ayers 7179be24fa feat: skip autostop reminder for active workspaces (#26772) 2026-06-30 00:24:29 -05:00
dependabot[bot] 64eb60d464 chore: bump the coder-modules group across 2 directories with 1 update (#26845) 
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-30 00:27:19 +00:00
dependabot[bot] 2f14d41fa8 chore: bump coder-labs/codex/coder from 5.2.0 to 5.3.0 in /dogfood/coder (#26846) 
[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=coder-labs/codex/coder&package-manager=terraform&previous-version=5.2.0&new-version=5.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-30 00:27:05 +00:00
Jon Ayers 538eddb731 feat: add dashboard fields for configuring autostop reminder (#26762) 2026-06-29 18:28:23 -05:00
Jeremy Ruppel 1a07bd65d4 feat(site): wire template builder entrypoint from templates list page (#26756) 
The templates list page "New template" button and the empty-state "View
all starter templates" button now link to `/templates/new/builder` when
the template builder is enabled in the deployment config, falling back
to `/starter-templates` when disabled.

The `TemplateBuilderPage` now checks `createTemplates` permission and
redirects to `/templates` if the user lacks access. The
`templateBuilderBases` query is also gated on `enabled` to avoid a 404
when the feature is disabled.

<details>
<summary>Implementation details</summary>

- `TemplatesPage` fetches `deploymentConfig()` (only when user has
`createTemplates` permission) and computes `templateBuilderEnabled`
using `=== false` to default safely while loading.
- `templateBuilderEnabled` is threaded through `TemplatesPageView` and
`EmptyTemplates` to conditionally set link targets.
- `TemplateBuilderPage` uses `useAuthenticated()` to check
`permissions.createTemplates` before rendering.
- Added Storybook story variants for the builder-enabled state.

</details>

> Generated by Coder Agents on behalf of @jeremyruppel
 2026-06-29 19:03:33 -04:00
Jeremy Ruppel a073273a3f feat(site/src/pages/TemplateBuilder): add loading animation for template creation (#26830) 2026-06-29 18:50:29 -04:00
Jeremy Ruppel 431219a5e7 feat(site): add official badge to TemplateCard and ModuleCard (#26806) 
Adds an `official` prop to both `TemplateCard` and `ModuleCard` in the
TemplateBuilder. When true (the default), a `BadgeCheckIcon` from
lucide-react is rendered inline next to the card name.

- `official` defaults to `true` since all current templates/modules are
official
- Pass `official={false}` for community entries to hide the badge
- Added `Community` and `CommunitySelected` stories for both components

> Generated by Coder Agents on behalf of @jeremyruppel

<img width="678" height="262" alt="Screenshot 2026-06-29 at 9 38 44 AM"
src="https://github.com/user-attachments/assets/51d1ddad-2bae-4ec3-a1bb-e518c86fa50c"
/>
 2026-06-29 18:25:03 -04:00
Jeremy Ruppel 7daf3123cb feat: import new modules and refactor codegen script (#26838) 2026-06-29 17:47:06 -04:00
Atif Ali e58806cb75 docs: add GitLab read_api scope change to ESR upgrade guide (#26829) 
## Problem

The 2.34.0 release changed the default GitLab external auth scopes from
`write_repository` to `write_repository` plus `read_api`. This was not
mentioned in the upgrade guide or the release notes, which caused
breakage for users upgrading from 2.29 to 2.34.

## Fix

- Add the GitLab scope change to the "Changes to be Aware of" table,
placed next to the related PKCE default change.
- Update the "Validate external authentication" bullet in the upgrade
checklist to explicitly call out adding `read_api` to GitLab OAuth
applications.

Closes DOCS-498

> 🤖 This PR was created with the help of Coder Agents, and needs a human
review. 🧑💻
 2026-06-30 02:32:45 +05:00
Jeremy Ruppel 9f7caa04f9 feat(site/src/pages/TemplateBuilder): prioritize template builder module display order (#26835) 
Adds a curated priority ordering for modules in the template builder
module picker. Modules in the priority list appear first in the
specified order; unlisted modules appear after in their original order.

## Changes

- Added `MODULE_PRIORITY` constant in `ModuleSelectStep.tsx` with the
preferred display order
- Added `sortByPriority()` helper to sort modules against the priority
list
- Not-yet-imported module IDs (`codex`, `antigravity`, `kasmvnc`) are
included but commented out
- Both the module grid and category tabs respect the new ordering
- Search results still use fuzzy relevance ordering

> Generated by Coder Agents on behalf of @jeremyruppel
 2026-06-29 17:04:26 -04:00
Jeremy Ruppel 48e8f70e09 fix: remove Goose module from catalog (#26833) 
Removes the Goose AI agent module from the template builder backend
catalog.

## Changes

- Deleted `coderd/templatebuilder/modules/goose/` (Terraform template
and module metadata)
- Removed the `"goose"` entry from
`scripts/templatebuildermodulegen/main.go`

Frontend assets (`goose.svg`, `icons.json`) are intentionally left in
place as other parts of the app still reference them.

> Generated by Coder Agents on behalf of @jeremyruppel
 2026-06-29 16:52:41 -04:00
Nick Vigilante 89b0a66079 docs: add top-level Get started section and move the Quickstart (#26821) 
Add a top-level "Get started" docs section to the nav and move the Quickstart to /docs/get-started, with inbound link updates and the install page TIP pointing to the Quickstart.

Filed via Coder Agents on Nick's behalf.
 2026-06-29 16:07:10 -04:00
Ben Potter c35f3d51eb fix: regenerate listenerset golden files (#26831) 
The golden files from #24993 were generated against a stale fork that
predated the `CODER_CLUSTER_HOST` env var addition. This regenerates
them against current main.

All 4 files just need the missing env var block:
```yaml
- name: CODER_CLUSTER_HOST
  valueFrom:
    fieldRef:
      fieldPath: status.podIP
```

Fixes the `gen` / `TestRenderChart` failures tracked in
https://github.com/coder/internal/issues/1611#issuecomment-4835998513.

---
*PR created by [Coder Agents](https://coder.com/docs/ai-coder) on behalf
of @bpmct*
 2026-06-29 13:40:20 -06:00
Andrew Aquino 1c09c3fca6 fix(site): reduce prerequisites markdown font size (#26776) 
closes DEVEX-517
alternative to #26759

This PR is mainly about the type style overrides I added to
`MemoizedMarkdown` in BaseTemplateParametersStep.tsx‎.

I did also shoehorn some other misc styling updates into this PR, but
they're only scoped to template builder so I'll keep it as 1 PR instead
of making a Graphite stack:

- 1b98ac374f: adjusted `StepDivider`'s
left margin which I missed during #26757
- f1eb921048: refactored
templates/modules' avatars to use an `AvatarData` component, so that the
text appears to the right of the avatar instead of below it
 2026-06-29 14:38:56 -04:00
Oliver MeyerBen PotterRowan Smith
 		d0f68cb9b0 feat: add listenerset (#24993) 
Adds support for [Gateway API
ListenerSet](https://gateway-api.sigs.k8s.io/reference/spec/#listenerset).

This PR was validated using `kgateway-v2.3.0-main` using the following
values:

```yaml
coder:
  image:
    tag: v2.31.11
  listenerset:
    enable: true
    annotations:
      cert-manager.io/cluster-issuer: my-cluster-issuer
      cert-manager.io/private-key-algorithm: ECDSA
      cert-manager.io/private-key-size: "384"
    parentRef:
      name: shared-internal-gateway
      namespace: kgateway-system
    listeners:
    - name: http
      hostname: "chart-example.local"
      port: 80
      protocol: HTTP
    - name: http-wildcard
      hostname: "*.chart-example.local"
      port: 80
      protocol: HTTP
    - name: https
      hostname: "*.chart-example.local"
      port: 443
      protocol: HTTPS
      tls:
        mode: Terminate
        certificateRefs:
          - name: chart-example-tls
    - name: https-wildcard
      hostname: "chart-example.local"
      port: 443
      protocol: HTTPS
      tls:
        mode: Terminate
        certificateRefs:
          - name: chart-example-tls
  httproute:
    enable: true
    parentRefs:
    - kind: ListenerSet
      name: coder
      port: 443
    host: "chart-example.local"
    wildcardHost: "*.chart-example.local"
    httpsRedirect:
      enable: true
      parentRefs:
      - kind: ListenerSet
        name: coder
        port: 80
```

Validate:

```bash
$ GW_ADDR=$(kubectl get svc -n kgateway-system shared-internal-gateway -o=jsonpath="{.status.loadBalancer.ingress[0]['hostname','ip']}")

$ curl -so /dev/null -w "%{http_code}" --resolve chart-example.local:80:${GW_ADDR} http://chart-example.local
308

$ curl -L --resolve chart-example.local:80:${GW_ADDR} http://chart-example.local/api/v2/buildinfo
{"external_url":"https://github.com/coder/coder/commit/49be5f31d35ff8beac0c0f489bdcf7a2e4d24872","version":"v2.31.11+49be5f3","dashboard_url":"http://coder.dev-ome.svc.cluster.local","telemetry":true,"workspace_proxy":false,"agent_api_version":"1.0","provisioner_api_version":"1.15","upgrade_message":"","deployment_id":"8e5917d5-7fea-4658-b7d9-0f3b3e99b861"}

$ curl --resolve chart-example.local:443:${GW_ADDR} https://chart-example.local/api/v2/buildinfo
{"external_url":"https://github.com/coder/coder/commit/49be5f31d35ff8beac0c0f489bdcf7a2e4d24872","version":"v2.31.11+49be5f3","dashboard_url":"http://coder.dev-ome.svc.cluster.local","telemetry":true,"workspace_proxy":false,"agent_api_version":"1.0","provisioner_api_version":"1.15","upgrade_message":"","deployment_id":"8e5917d5-7fea-4658-b7d9-0f3b3e99b861"}
```

---------

Co-authored-by: Ben Potter <me@bpmct.net>
Co-authored-by: Rowan Smith <rowan@coder.com>
 2026-06-29 13:26:37 -05:00
Nick Vigilante 14a61041d9 docs: fix broken links in weekly-docs link check (#26813) 
Fix four broken links that caused the weekly-docs link-check CI job to
fail.

**Changes:**

- `docs/install/rancher.md`: Remove `#readme` anchor from
`../../helm#readme` — linkspector splits on `#`, finds a directory, and
errors with EISDIR.
- `docs/install/kubernetes.md`: Same fix for `../../helm/coder#readme`.
- `docs/install/cloud/compute-engine.md`: Point both `gcp-linux` links
to `README.md` explicitly
(`../../../examples/templates/gcp-linux/README.md` and
`../../../examples/templates/gcp-linux/README.md#authentication`) so
linkspector can resolve the file and anchor.
- `.github/.linkspector.yml`: Add `merriam-webster.com` to
`ignorePatterns` (returns 403 from GitHub runner IPs).

<details>
<summary>Linear issue and CI context</summary>

**Linear issue:**
https://linear.app/codercom/issue/DOCS-494/fix-broken-links-in-weekly-docs-link-check

**Failing CI run:**
https://github.com/coder/coder/actions/runs/28366176335/job/84032582533

The workflow is `.github/workflows/weekly-docs.yaml`, job `check-docs`,
step `Check Markdown links` (umbrelladocs/action-linkspector).

Root causes confirmed per investigation:
- `#readme` anchors on directory paths trigger EISDIR in linkspector's
local resolver.
- The `gcp-linux` directory links needed explicit `README.md` targets;
linkspector cannot resolve bare directory references.
- `merriam-webster.com` blocks GitHub runner IPs with 403.

`ignorePatterns` is reserved for external links only, not internal or
GitHub file links.

</details>

---
*Generated by Coder Agents on behalf of @nickvigilante*
 2026-06-29 13:12:19 -04:00
Ben Potter 84f995e019 fix(examples): remove vscode-desktop module from quickstart to avoid duplicate VS Code Desktop (#26789) 
The Quickstart template offered a "VS Code Desktop" editor option backed
by the `vscode-desktop` module, which produced two "VS Code Desktop"
buttons in the workspace view.

Coder already enables the VS Code Desktop display app for every
workspace by default via [`DefaultDisplayApps()` in
`provisionersdk/agent.go`](https://github.com/coder/coder/blob/c782cbce77b08c0d031a7131a05f5babd762519f/provisionersdk/agent.go#L58-L65)
(`Vscode: true`), so the module was redundant and is the source of the
duplicate.

This removes the `vscode-desktop` module and its editor option, and
updates the README to note that VS Code Desktop is available by default.
The browser-based `code-server`, Cursor, JetBrains, Zed, and Windsurf
options are unchanged. `examples.gen.json` is regenerated.

Closes #26788

---

*Generated by Coder Agents on behalf of @bpmct.*
 2026-06-29 11:34:06 -05:00
McKayla はな a78982c238 test: convert chromatic sentinels to pixel equivalents (#26778) 2026-06-29 08:57:57 -06:00
McKayla はな 1302e78283 ci: remove chromatic (#26777) 2026-06-29 08:57:07 -06:00
J. Scott Miller 1dea00dd04 fix: deflake TestWorkspaceTagsTerraform with context-aware build waits (#26315) 
`TestWorkspaceTagsTerraform` runs a real terraform provisioner but
waited on builds with `coderdtest` helpers whose deadlines are sized for
the echo provisioner used by most tests, which replays canned responses
and completes in well under a second. On Windows runners, where
terraform providers are not cached and every `terraform init` downloads
from the registry, template imports exceeded the 25s budget in
`AwaitTemplateVersionJobCompleted` and workspace builds exceeded the 10s
context in `AwaitWorkspaceBuildJobCompleted`, even though the test
intends a 120s budget.

Add `AwaitTemplateVersionJobCompletedWithTimeout` and
`AwaitWorkspaceBuildJobCompletedWithTimeout`, which take a
caller-provided wait bound, and use them in the test with
`2*testutil.WaitSuperLong` (120s). Also fix
`AwaitWorkspaceBuildJobCompleted` creating a `WaitShort` (10s) context
while polling for `WaitMedium` (15s), which guaranteed `context deadline
exceeded` errors for the final five seconds of polling.

`TestWorkspaceTemplateParamsChange` has the same shape (real terraform
provisioner, 120s test context, plain await helpers) and the same latent
bug, so it gets the same fix.

Closes https://github.com/coder/internal/issues/1470 (Linear: PLAT-176)

<details>
<summary>Root cause analysis</summary>

Two CI failures, same mechanism:

- 2026-04-16 (run 24493089585, windows-2022):
`overrides_with_dynamic_option_from_var/dynamic` failed at
`coderdtest.AwaitTemplateVersionJobCompleted` with `Condition never
satisfied ... make sure you set IncludeProvisionerDaemon!`. The template
import job (real terraform init/plan, with network provider download)
did not complete within `WaitLong` (25s).
- 2026-05-27 (run 26492817796, windows-2022): `tag_param/dynamic` failed
at `coderdtest.AwaitWorkspaceBuildJobCompleted` with `failed to get
workspace build ...: context deadline exceeded`. The helper's internal
context was `WaitShort` (10s) while its polling window was `WaitMedium`
(15s), so after 10s every poll could only fail. The logged `terraform
apply: exit status 1` and the `TempDir RemoveAll ... Access is denied`
cleanup error are consequences of test teardown canceling the in-flight
job while the provider exe was still file-locked.

The test declares a 120s budget (`2*testutil.WaitSuperLong`, commented
"This can take a while"), but the await helpers ignored it and applied
their own 10-25s budgets. `testutil.CacheTFProviders` is a no-op on
Windows, so real builds are much slower there.

This change raises the ceiling for the tests rather than making
terraform faster; both observed failure signatures are eliminated. The
default helper budgets are unchanged for the ~880 existing call sites.
One small behavior change: `AwaitTemplateVersionJobCompleted` previously
marked the test failed on any transient poll error via `assert.NoError`;
it now logs and keeps polling, matching the workspace build helper, and
still fails on timeout.

`TestWorkspaceTemplateParamsChange` is the sibling real-terraform test
in the same file (also covered by the original provider-caching work in
#20603). It runs three sequential real builds with the plain await
helpers under a 120s context, so it is exposed to the same Windows
slowness even though it has not produced its own issue yet. Its context
is raised to `6*testutil.WaitSuperLong` to outlast three sequential
await budgets.

API note: a context-taking variant was considered first, but a
`time.Duration` parameter avoids an implicit "context must have a
deadline" contract and matches how the existing helpers manage their own
wait budgets.

</details>

---

🤖 This PR was generated by Coder Agents on behalf of @jscottmiller.
 2026-06-29 09:56:42 -05:00
TJ 5f42bbcdbf feat(site/src): nest agent pages under a Coder Agents subsection in AI nav (#26667) 
Groups the agent-related AI settings pages under a new **Coder Agents**
parent in the sidebar, with a continuous left rule connecting the
children and an active-segment indicator that lights up the rule where
the current sub-item sits.

The new nav order:

- AI Governance
- AI Gateway keys
- Providers
- Coder Agents
  - Models
  - MCP servers
  - Templates
  - Spend
  - Instructions
  - Lifecycle

All target pages already exist on main (Danielle's recent migrations of
Models, MCP servers, Templates, Instructions, Lifecycle, Spend, and
Coder Agents into AI Settings). This PR only changes the sidebar visual
structure: the children move into an indented group with a `border-l
border-l-border` rule, and the active child paints a
`border-l-content-primary` segment over that rule via `-ml-px` so the
rule and indicator share a column instead of stacking.

<details>
<summary>Design notes</summary>

Concept 1 from the earlier exploration: always-expanded with indents,
the parent is its own page. Chosen because it adds no expand/collapse
state, no "which child is the default" question, and no animation work;
the parent reuses the existing nav-item, and the children sit in a
wrapper `div` with a left rule. The site bundle ships without Tailwind's
preflight, so the wrapper and sub-item borders are paired with
`border-solid` to actually paint, matching the pattern already in
`Sidebar.tsx`.

</details>

---

_This PR was prepared by Coder Agents on behalf of @tracyjohnsonux._
 2026-06-29 13:46:09 +00:00
Susana Ferreira 56373a09fc chore: rename user-facing AI Bridge strings to AI Gateway (#26700) 
Rename user-facing "AI Bridge" strings to "AI Gateway" in deployment
config, RBAC display names, log messages, error strings, docs style
guide, and Grafana dashboard README.

Deprecated option names and descriptions (the `--aibridge-*` block) are
intentionally kept as "AI Bridge". The `Name` field cannot be renamed
because `serpent` uses it as a unique key during JSON serialization;
duplicating names causes `UnmarshalJSON` failures (e.g. in the support
bundle). Descriptions also stay as "AI Bridge" to avoid confusion
between the deprecated and primary options.

Refs https://linear.app/codercom/issue/AIGOV-226

> Generated with the assistance of Coder Agents (@ssncferreira)
 2026-06-29 14:33:22 +01:00
Danielle Maywood b4a7b25290 feat(site): move Coder Agents settings to AI settings (#26692) 2026-06-29 12:28:36 +00:00
Danielle Maywood cf1c29b651 feat(site): move spend page to AI settings (#26800) 2026-06-29 12:49:38 +01:00
Danielle Maywood 60a56cf343 fix(site): use large avatar on provider table (#26804) 2026-06-29 11:49:25 +00:00
Danny Kopping ce94d42e19 feat: fetch providers over DRPC (#26650) 
Closes [AIGOV-455](https://linear.app/codercom/issue/AIGOV-455/extend-drpc-with-buildproviders).

## Why

The AI Gateway (`aibridged`) is being split into a standalone process that must not touch the database. `coderd` stays the source of truth and seeds the `ai_providers` / `ai_provider_keys` tables from the environment. This PR adds a DRPC call so the gateway fetches provider config from `coderd` instead of reading the DB, for both the embedded and standalone daemons.

## What

- **Proto:** new `ProviderConfigurator` service with a unary `GetAIProviders` RPC, plus `AIProvider` / `AIProviderBedrock` messages. `CurrentMinor` bumped to 1 (additive).
- **Server (`coderd/aibridgedserver`):** `GetAIProviders` runs a read-only `InTx` under `LockIDAIProvidersEnvSeed` so it never returns a mid-seed snapshot, reads providers (incl. disabled) plus keys for enabled ones, and maps to proto under `dbauthz.AsAIBridged`. Unmappable rows are skipped and logged; plaintext keys and Bedrock secrets are never logged.
- **Client:** `DRPCProviderConfiguratorClient` wired into the client union, `dialer.go`, and `CreateInMemoryAIBridgeServer`.
- **cli:** `BuildProvidersFromProto` maps the response through the existing DB-neutral `buildProvider`. A shared `poolRPCReloader` does the fetch/build/replace for both daemons: the embedded daemon reloads on every `ai_providers` change and fails startup if it cannot subscribe; the standalone gateway drives the same reloader once at startup, retrying until success and staying interruptible.
- **Dead code removed:** `BuildProvidersFromConfig`, `ProvidersFromConfig`, `AIProviderFromConfig`, and the DB-read `BuildProviders` path.
 2026-06-29 13:34:58 +02:00
Cian Johnston 74b8f10d4e fix(coderd/x/chatd): drop foreign provider-executed tools on model switch (#26555) 
Drops provider-executed tool history (calls and results) from
assistant rows whose producing provider ID differs from the target turn's
provider ID, before the prompt is built. Same-provider history is left
untouched, so normal `web_search` replay is unaffected.

- When a model config has an `AIProviderID`, use this as identity so two
providers of the same type (e.g. two `openai-compat` providers at
different base URLs) are correctly distinguished. Falls back to
the normalized provider type name. 
- Sanitization runs at the `database.ChatMessage` row level in
`prepareGeneration`. The `chatloop`
pre-request and reload paths are untouched.
- Foreign provider-executed results are dropped and not converted
  to text.
- Unknown origin (unresolvable `ModelConfigID`) fails closed (strip).
- Adds tests for the pure `stripForeignProviderExecutedToolRows`.
- Adds unit tests for `modelConfigProviderIdentity`.

_This pull request was created by Coder Agents on behalf of @johnstcn._
 2026-06-29 11:49:10 +01:00
Danielle Maywood 3d1e41c616 feat(site): add paginated query options (#26802) 2026-06-29 11:45:28 +01:00
Cian Johnston 5942cec329 fix: synchronize bridge and pool shutdown with in-flight requests (#26743) 
When adding chatd tests to route through a real in-process `aibridged`
daemon (#26658), found two races:

- **Pool:** `CachedBridgePool.Shutdown` calls `cache.Close()` while an
in-flight `Acquire` runs `cache.Wait()`. ristretto closes the channel
`Wait` sends on.
- **Bridge:** `RequestBridge.ServeHTTP` does `inflightWG.Add(1)` after
the `b.closed` check, racing `Shutdown`'s `inflightWG.Wait()`.

## Fix

- `RequestBridge`: adds `admitMu` RWMutex to order `inflightWG.Add`
(ServeHTTP, read) before `close(b.closed)` (Shutdown, write).
- `CachedBridgePool`: adds `opsMu` + `opsWG` so `Shutdown` drains
in-flight `Acquire`/`ReplaceProviders` before `cache.Close()`
- Adds tests `TestRequestBridgeShutdownAdmissionRace` and
`TestPoolShutdownReplaceProviders` for above. (Note:
`TestRequestBridgeShutdownAdmissionRace` leverages a `serve_admission`
quartz trap added to `RequestBridge`).

---

> 🤖 Created by Coder Agents on behalf of @johnstcn.
 2026-06-29 11:33:21 +01:00
Cian Johnston 86a7bc9fb0 fix: resolve model config provider via ai_provider_id (#26660) 
-  `site/src/pages/AISettingsPage/ProvidersPage/components/providerFormApiMap.ts`):
`providerFormValuesToCreate` returns `type: "bedrock"` when the form
type is `bedrock`, instead of `type: "anthropic"` with Bedrock settings.
- Updated `providerFormApiMap.test.ts` to expect `type:
"bedrock"` and `MockAIProviderBedrock` fixture in `entities.ts` to
`type: "bedrock"`. Added Bedrock fixtures to `ModelsPageView` stories
asserting the AWS Bedrock icon renders correctly.

Refs: [CODAGT-549](https://linear.app/codercom/issue/CODAGT-549/bedrock-models-use-anthropic-styling-and-icons)

> 🤖
 2026-06-29 11:04:58 +01:00
Danielle Maywood 72980d3e65 refactor(site): share confirm delete dialog (#26799) 2026-06-29 11:00:49 +01:00
Ethan 4820cbf7b1 test: migrate CreateUserPage tests to Storybook play stories (#26794) 
Migrates the CreateUserPage tests from vitest to Storybook play-function
stories.

The old `CreateUserPage.test.tsx` rendered the full page through
`renderWithAuth` and MSW, which is slow and contributes to `test-js`
timeout flakes. The new stories seed the react-query cache directly and
assert the same behavior in `play` functions, so they run in the
Storybook test lane instead of the vitest `unit` project.

Coverage is preserved: a success story asserts the success toast after
creating a user, and an error story asserts that an API failure surfaces
in the form's error alert.

Relates to CODAGT-686
Relates to https://github.com/coder/internal/issues/1598
 2026-06-29 18:24:23 +10:00
Ehab Younes c782cbce77 feat(site/src/pages/GroupsPage): update group AI budget UI (#26659) 
Update the group AI budget settings UI to match the unlimited,
no-budget, and finite-budget states. The field now uses a USD input
suffix, the label reads "Monthly limit per member", and unlimited or $0
budgets show explanatory helper text with an info alert.
 2026-06-29 00:52:47 +03:00