opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-10-31 02:43:21 +08:00
Code Issues Packages Projects Releases Wiki Activity
16,051 Commits 479 Branches 417 Tags
29995c9ef845877d718bf0121ff579c7ea5c42f5
Commit Graph
16051 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
McKayla はな 29995c9ef8 feat: add a per-template workspace rename setting (#27558) 2026-08-25 11:05:42 -06:00
Nick Vigilante 827c11f43a docs: update Coder Agents admin navigation to AI Settings (#28572) 
## Summary

Fixes stale admin navigation on the three Coder Agents platform-controls
pages not covered by #28482: the retention pages pointed at tabs that do
not exist ("Behavior", the old Agents settings "Lifecycle" tab), and
template optimization pointed at the removed **Agents** > **Settings** >
**Manage Agents** navigation.

Breadcrumbs follow the **Admin settings** > **AI** > **Coder Agents**
convention established by #28482.

## Changes

- `docs/ai-coder/agents/platform-controls/chat-retention.md`: replace
the nonexistent **Behavior** tab with **Admin settings** > **AI** >
**Coder Agents** > **Lifecycle**.
- `docs/ai-coder/agents/platform-controls/chat-debug-retention.md`: same
page, same convention, aligned with chat-retention.md.
- `docs/ai-coder/agents/platform-controls/template-optimization.md`:
replace **Agents** > **Settings** > **Manage Agents** > **Templates**
with **Admin settings** > **AI** > **Coder Agents** > **Templates**.

## Scope note

The first revision also fixed `models.md`, `advisor.md`,
`chat-debug-logging.md`, and `platform-controls/index.md`. Those pages
are covered by #28482 with the same corrections, so this PR reverted
them to avoid conflicting edits and adopted that PR's breadcrumb
convention instead.

Linear: DOCS-715 https://linear.app/codercom/issue/DOCS-715

<details><summary>Analysis evidence</summary>

- `site/src/router.tsx` (~735-780):
`/ai/settings/{lifecycle,templates,coder-agents}` are the live routes;
`/agents/settings/{admin pages}` (~833-890) are `Navigate`-only
redirects.
- No "Behavior" tab exists in any router revision;
`RetentionPeriodSettings` and `DebugRetentionSettings` both render in
`LifecyclePageView.tsx`.
- Breadcrumb convention **Admin settings** > **AI** verified against
`AdminSettings.tsx` / `AISettingsSidebarView.tsx` in #28482.

</details>

Generated by Coder Agents on behalf of @nickvigilante.
 2026-08-25 12:49:27 -04:00
Marcin Tojek 31a976b288 chore(docs): update release docs for v2.35.6 (#28577) 
Automated docs update for v2.35.6 release.

Created by `releasetui`.
 2026-08-25 18:33:58 +02:00
Ethan 409049d1d8 docs: document org-scoped admin configuration for agents (#28482) 
## Summary

Documents the organization scoping of Coder Agents admin configuration,
and corrects the navigation paths, access wording, and default-model
instructions that no longer matched the product. Documentation only, no
product code changes.

Follows #28473, which moved the organization model overrides into an
**Organization settings** section on **Admin settings > AI > Coder
Agents**. #28473 is merged, so this targets `main`.

Closes CODAGT-715

## Changes

- **New page**
`docs/ai-coder/agents/platform-controls/organizations.md`, registered in
`docs/manifest.json`. Covers the deployment/organization scope split,
what an upgrade changes, how an organization without models or MCP
servers behaves, who configures each scope, and how model and MCP server
sharing works.
- **`models.md`**: models are organization-scoped while providers and
their credentials stay deployment-wide. Each organization has one
default model, and the first model added becomes it. Documents the
**Default** badge and the **Set as Coder Agents default model** form
option in place of the star action that no longer exists, and points
model overrides at **Organization settings**.
- **`getting-started.md`**: replaces the Owner-only claim with the
actual access model, adds an organization selection step, and uses the
**Add model** label.
- **`platform-controls/index.md`**: separates deployment-wide controls
from organization-scoped controls, documents personal model overrides
alongside the model configuration section rather than as an enforcement
caveat, and adds `--agents-allowed` plus the `agents-allowed:` search
filter.
- **`platform-controls/advisor.md`** and
**`platform-controls/virtual-desktop.md`**: the Advisor and Virtual
desktop settings are cards in the **Deployment settings** section of the
**Coder Agents** page, not sidebar entries. **Providers** is a sidebar
item, not a tab.
- **`platform-controls/mcp-servers.md`**: slug uniqueness is per
organization, the **Add server** label is correct, and the page is no
longer described as admin-only.
- **`architecture.md`**, **`index.md`**,
**`tasks-to-chats-migration.md`**: organization scope corrections and
organization-scoped model routes.
- Breadcrumbs standardized to **Admin settings > AI > ...**, verified
against `AdminSettings.tsx` and `AISettingsSidebarView.tsx`.

<details>
<summary>Review follow-ups</summary>

The first revision leaked implementation detail into user-facing pages
and contained several claims that did not match the UI. The follow-up
commit removed and corrected the following.

Removed as implementation detail:

- The `chat_model_config` RBAC resource, its actions, and the token
scopes.
- The `available`, `unavailable_reason`, and `unsupported_providers`
response fields, along with the `missing_api_key`, `fetch_failed`, and
`user_api_key_required` values.
- Role and permission tables, ACL storage mechanics, audit internals,
and JSON error bodies on the new organizations page.
- Migration mechanics with no effect on what a user does.

Corrected against the product:

- The star action does not exist. The list shows a **Default** badge and
the add/edit form offers **Set as Coder Agents default model**
(`ModelRow.tsx`, `ModelFormFields.tsx`).
- The first model added to an organization becomes its default
automatically (`coderd/exp_chats.go`). An organization without a stored
default does not fail every chat, so that claim is gone.
- Advisor and Virtual desktop are cards under **Deployment settings**
(`CoderAgentsPageView.tsx`).
- The MCP servers page does not require deployment configuration edit
permission (`AISettingsSidebarView.tsx`).
- Button labels: **Add model** and **Add server**.
- The organization query parameter is `org`, confirmed by
`modelOrganizationSearchParam`.

Left alone deliberately: pre-existing defects outside the introduced
text, including the `/api/v2/chats` route prefixes, create-chat examples
missing `organization_id`, and the pre-existing MCP permissions table.

</details>

## Testing

- `pnpm run format-docs` and `pnpm run lint-docs` pass.
- `make lint/emdash` passes. No emdash or endash added.
- `grep -rn "Defaults & overrides" docs/` returns nothing.
- Every navigation path, button label, and access claim checked against
the corresponding file under `site/src/pages/AISettingsPage/` and
`site/src/modules/management/`.

---

This pull request was generated by Coder Agents on behalf of
@ethanndickson.
 2026-08-25 17:24:39 +01:00
Ethan 816f6fbeef fix(site): clarify chat model permission labels (#28579) 
Renames chat model sharing controls to permissions terminology so the UI
reflects that administrators are managing model access.

Uses “Use” as the user-facing role while preserving the backend `read`
ACL value, and updates the Storybook interactions for the new labels.
 2026-08-25 17:23:08 +01:00
TJ c07bde80c4 fix: use medium badges and shorter shared key label on agent API keys page (#28557) 
On `/agents/settings/api-keys`, bumps the provider key status badge and
the enabled model badges from `sm`/`xs` to the medium (`md`) size, and
shortens the status label "Using shared key" to "Shared key". Updates
the matching Storybook assertion and the status indicator name in
`docs/ai-coder/agents/models.md`.

Verified with `tsc` and the page's Storybook tests (15 passing).

---

*Created by Coder Agents on behalf of @tracyjohnsonux.*
 2026-08-25 16:16:59 +00:00
TJ 94f312dfbd refactor(site): use robot icon for subagent toggle in chat kebab menu (#28561) 
Replaces the rotated `GitForkIcon` on the "Show/Hide subagents" item in
the chat kebab menu with lucide's `BotIcon`, matching the robot icon
already used for subagents in the chat stream (`SubagentTool`,
`ToolIcon`).

---

*This PR was generated by Coder Agents on behalf of @tracyjohnsonux.*
 2026-08-25 16:34:29 +01:00
Bobby Ho 9e8075db0f fix: prevent markdown injection in notifications (#28340) 
First of two PRs.

Notification title and body templates are Markdown authored by Coder,
but the label values interpolated into them are user-controlled and were
substituted through `text/template`, which does no escaping. Those
values arrive from user profile fields and from OIDC/GitHub name claims.

This PR:

- Neutralizes Markdown structure in label, data, and `UserName` values
before they reach the template. Applied in `notifier.prepare`, so
already-queued messages are covered and the stored payload keeps its
original values for webhook consumers. Nested `.Data` map keys are
escaped too: one shipped template prints a key, and those keys are
Terraform resource addresses.
- Narrows the notification Markdown grammar to what templates actually
use. `CommonExtensions` enabled Tables, DefinitionLists and MathJax,
each openable from a value and used by no template. Autolink stays off
so a URL in a value cannot become an anchor.
- Enables `html.Safelink`, restricting generated hrefs to safe schemes,
and guards the panic it exposes: `parser.IsSafeURL` slices a destination
before bounds-checking it, so `[docs]()` crashed both renderers.
- Folds line breaks out of the `Subject:` header and encodes it, fixing
a pre-existing RFC 2047 violation for non-ASCII subjects, a forged
encoded-word that let a value choose the displayed subject, and headers
running past RFC 5322's 998-octet line limit.

Escaping is narrow on purpose, split by where each character carries
meaning:

- `` \[]()!<` `` everywhere. Backtick is in this group because a fenced
block's info string is an HTML sink: gomarkdown writes it into
`class="language-..."` unescaped, and `SkipHTML` does not apply to a
`CodeBlock` node, so a value that closes the attribute and the tag
injects live markup.
- `#-+.>|` only in leading position, so values like `bobby-workspace`
and `1.5` are untouched.
- `=`, `~` and `:` are not escapable by both renderers, so the preceding
line break is folded instead. `:` opens a definition list and a GFM
table delimiter row that escaping `|` cannot reach. A value's *first*
line has no preceding break to fold, so a real tilde fence or `===`
underline is escaped there instead, accepting a visible backslash: an
unterminated `~~~` at the start of a title otherwise renders the
Subject, `<title>` and heading empty.
- Leading indentation is truncated to three spaces. Four open an
indented code block and a space has no escape.
- Emphasis characters are left alone. Escaping `_` corrupts label values
such as `user_override` that body templates compare with `eq`, which
silently drops content from the rendered email.

One golden file changes: the resource replacements `body_markdown` now
reads `docker_container\[0\]`, from the map-key escaping above. Every
other golden is byte-identical.

**One known residual**, pinned by a test that fails if it closes:
CommonMark does not process escapes inside a code span, so where a
template wraps a value in one, as the workspace out-of-disk body does,
the escaper's own backslashes reach the reader. That depends on where
the value lands rather than what it contains, which a pre-render escaper
cannot see. This narrows the class rather than closing it.

**#28397 completes the fix and is stacked on this branch. This PR should
not merge without it.**

Escaping here cannot reach the SMTP HTML template's sinks, by design
rather than by oversight: the subject is produced by
`PlaintextFromMarkdown`, which strips exactly the backslashes added
here, and `html.gotmpl` then interpolated the result through
`text/template`. On this branch alone, a label value still reaches the
Subject, `<title>` and `<h1>` as live markup. #28397 escapes at those
sinks with `| html`, which is the only place the information needed to
escape correctly exists.
 2026-08-25 08:12:00 -07:00
Jakub Domeracki be9f8592eb ci: use dedicated release App token to publish releases (#28553) 
## Problem

The `Publish release` step fails with `HTTP 403: Resource not accessible
by integration` because the default `GITHUB_TOKEN` cannot create the
release tag under the active tag-create protection ruleset.

## Change

Use a dedicated GitHub App token for the `Publish release` step:

- Add a `Generate release App token` step using `secrets.RELEASE_APP_ID`
/ `secrets.RELEASE_APP_PRIVATE_KEY`.
- Switch only that step's `GITHUB_TOKEN` to the minted App token.

## Required before merge (admin)

1. Create the release GitHub App (least privilege) and install it on
`coder/coder`.
2. Configure `RELEASE_APP_ID` / `RELEASE_APP_PRIVATE_KEY`.
3. Add the App to the tag-create protection ruleset bypass list.

Refs coder/security-automation#297.
 2026-08-25 16:32:01 +02:00
Garrett Delfosse 7fc9a6e449 fix: revert update on chat messages table (#28552) 
Reverts commit a2459f8dda from #28319
("fix(coderd/database): stamp existing vectors simple and match config
explicitly").

Note: #28319 was squash-merged, so this reverts only that commit's diff,
not the entire PR.

This directly edits a migration on main due to issues with the
previously merged migration taking too long on large tables.
 2026-08-25 10:14:41 -04:00
Matt Vollmer 79856ebd15 docs: reference Coder Agents instead of Coder Tasks in style guide (#28539) 
## Summary

Updates the Caitlin the Citizen Developer persona in the style guide to
reference Coder Agents instead of the deprecated Coder Tasks product.

### Changes

* `docs/.style/style-guide/audience-and-scope.md`: replaced both "Coder
Tasks" mentions with "Coder Agents" in the Caitlin persona description
and Coder surface list.

<details><summary>Context</summary>

Coder Tasks is deprecated as of v2.34 and replaced by Coder Agents. This
change keeps the internal style guide's persona reference aligned with
current product naming.

</details>

---

This PR was drafted by a Coder Agent on behalf of Matt.
 2026-08-25 10:03:25 -04:00
Garrett Delfosse 7cf24b1a37 docs(docs/ai-coder/agents): document the chat search: full-text filter (#28474) 
Documents the `search:` full-text filter in
`docs/ai-coder/agents/chat-search-syntax.md` and drafts the release
notes copy for chat history search.

Describes `main` plus #28319, which must merge first: stemming and
stopword removal apply to message content only; titles and PR titles
keep `simple` whole-word matching. All claims verified against the
implementation. Two statements in CODAGT-727 were inaccurate and are
documented as the code behaves:

- A value that tokenizes to no searchable words returns an **empty
list**, not HTTP 400
(`TestListChats_Search/NoSearchableWordsReturnsEmpty`). HTTP 400 covers
only an empty `search:` value, unsupported keys, bare terms, or
combining `search:` with `title:`, `pr_title:`, or `pr:`
(`coderd/searchquery/search.go`).
- Results are **paginated** with the standard chat list cursor (default
50), not a bounded non-paginated set (`GetChats`, `listChats`). Ordering
is pinned first, then most recently updated.

Also verified: message bodies are indexed by the dbpurge sweep
(10-minute tick, up to 5 x 10,000 rows, newest first) while titles and
PR titles are searchable immediately; numeric values match exact PR
numbers; `title:`, `pr_title:`, and `repo:` retain `ILIKE` semantics.

`pnpm run format-docs` and `pnpm run lint-docs` pass.

Closes
[CODAGT-727](https://linear.app/codercom/issue/CODAGT-727/chat-search-documentation-and-release-notes)

<details>
<summary>Release notes draft</summary>

### Chat history search

You can now search your chat history by what was said, not just by
title. The chat list `q` parameter accepts a new `search:` filter that
performs full-text search across chat titles, pull request titles, PR
numbers, and message content, for example `?q=search:"kubernetes
restart"`. Matching is case-insensitive and supports quoted phrases,
`OR`, and `-` negation. Message content additionally matches English
word stems (`refactor` finds a message containing `refactoring`).
`search:` cannot be combined with the `title:`, `pr_title:`, or `pr:`
filters; the existing substring filters are unchanged.

**Upgrading with existing chat history:** the message search index is
populated by a background job (every 10 minutes, up to 50,000 messages
per run, newest first). Upgrades are not blocked, and chat reads and
writes are unaffected while the index fills. Older messages appear in
search results progressively; messages indexed before the stemming
upgrade match exact word forms until re-indexed. Titles and PR titles
are searchable immediately.

</details>

---

🤖 This PR was generated by Coder Agents on behalf of @f0ssel.
 2026-08-25 09:09:10 -04:00
Garrett Delfosse 378ac91b49 fix: stem chat search terms with the english text search config (#28319) 
Chat message search used the `simple` text search config, which folds
case but does no stemming, so `refactor` did not match messages
containing `refactoring`. Message bodies now index and query with the
`english` config, which stems both sides. Titles, PR titles, and all
other filters are unchanged.

Migration `000585` adds a `chat_messages.search_tsv_config` enum column
recording which config produced each stored vector and stamps existing
vectors `'simple'` (a column-only update; vectors and indexes are
untouched, since rewriting `search_tsv` would block message writes on
large tables). The dbpurge sweep gains a bounded
`ReindexStaleChatMessagesSearchTsv` pass that rewrites stale vectors
newest first and stops for the process lifetime once drained. Until a
row is rewritten, `GetChats` matches it with the config that produced
it, so pre-migration exact-form searches keep working during the drain.
Vectors written by old binaries mid rolling upgrade cannot stamp the
config, stay pending, and self-heal on the next upgraded sweep.
Steady-state DB load is unchanged.

The down migration resets `english` vectors to `NULL` so the parent
version's existing sweep rewrites them with `simple`.

Closes
[CODAGT-867](https://linear.app/codercom/issue/CODAGT-867/backend-search-improvements-to-handle-partial-matches)

<details>
<summary>Decision log</summary>

- **`english` stemming over prefix matching.** On a 300k-row corpus a
stemmed lookup is a single GIN entry-tree probe, while `term:*` prefix
matching unions posting lists of every lexeme sharing the prefix (up to
a full scan for short prefixes), is asymmetric, and loses the
`websearch_to_tsquery` phrase/OR/negation UX. `pg_trgm` rejected as a
heavier index with different semantics.
- **Scope to message bodies only** (review). Titles and PR titles keep
their `simple` FTS expressions and indexes, identical to main.
- **Config-versioned queue over migration-time reset** (review). An
unqualified `UPDATE ... SET search_tsv = NULL` rewrites every indexed
row in the migration transaction, and an old replica could backfill
reset rows with `simple` vectors that permanently leave the `search_tsv
IS NULL` queue. The config column makes staleness explicit and both
problems disappear.
- **Enum over `text`** (review) for the config column.
- **Trade-offs.** English stopwords are dropped from message search
(stopword-only queries match no messages); stemming is English-specific;
titles do not stem; prefix matching remains out of scope.

</details>

---

🤖 This PR was generated by Coder Agents on behalf of @f0ssel.
 2026-08-25 09:08:52 -04:00
Ethan 6284964b5f test(coderd): remove flaky audit transaction case (#28468) 
The `TransactionAfterNoChange` case in
`TestChatRetentionDays_AuditInfrastructureFailureRejectsWrite` was flaky
in [Flake Check run
32717900411](https://github.com/coder/coder/actions/runs/32717900411).
Its generic `InTx` wrapper armed a shared fail-next flag, so an
unrelated background transaction could consume the failure and let the
target PUT return 204 instead of the expected 500.

Remove the shared transaction wrapper and replace the endpoint-level
case with deterministic unit coverage of
`auditedChatOperationalSettingWrite`. The mock transaction executes the
no-op callback successfully and then returns an error, preserving
coverage that audit suppression happens only after the transaction
succeeds without involving API background transactions.
 2026-08-25 12:59:19 +01:00
Ethan 16e0c4dba7 fix(site/src/pages/AgentsPage): remove redundant model warning (#28484) 
The empty chat form showed a generic no-model warning directly above the
existing provider and model setup notice, repeating the same
unavailable-state information.

Remove the redundant warning and update the affected stories to assert
the remaining actionable setup notice.
 2026-08-25 12:30:24 +01:00
dependabot[bot] 31fba3fce6 ci: bump the github-actions group with 6 updates (#28545) 
Bumps the github-actions group with 6 updates:

| Package | From | To |
| --- | --- | --- |
|
[step-security/harden-runner](https://github.com/step-security/harden-runner)
| `2.20.1` | `2.21.0` |
|
[docker/setup-buildx-action](https://github.com/docker/setup-buildx-action)
| `4.2.0` | `4.3.0` |
|
[toshimaru/auto-author-assign](https://github.com/toshimaru/auto-author-assign)
| `3.0.3` | `3.1.0` |
|
[github/codeql-action/upload-sarif](https://github.com/github/codeql-action)
| `4.37.6` | `4.37.7` |
| [github/codeql-action/init](https://github.com/github/codeql-action) |
`4.37.6` | `4.37.7` |
|
[github/codeql-action/analyze](https://github.com/github/codeql-action)
| `4.37.6` | `4.37.7` |

Updates `step-security/harden-runner` from 2.20.1 to 2.21.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/step-security/harden-runner/releases">step-security/harden-runner's
releases</a>.</em></p>
<blockquote>
<h2>v2.21.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Support for denied endpoints in block mode. This is included in the
enterprise tier. Customers can deny outbound calls, for example, to
public package registries.</li>
<li>Improved Support for AWS CodeBuild GitHub Actions Runners.</li>
<li>Bug fixes.</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/step-security/harden-runner/compare/v2.20.1...v2.21.0">https://github.com/step-security/harden-runner/compare/v2.20.1...v2.21.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/step-security/harden-runner/commit/05e31511f85b41b11d1cf0ef85d0992719546e2c"><code>05e3151</code></a>
Merge pull request <a
href="https://redirect.github.com/step-security/harden-runner/issues/684">#684</a>
from step-security/rc-42</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/0f37afa338f57c61ee3dfc274daca8834963d83e"><code>0f37afa</code></a>
fix: ignore denied-endpoints on non-enterprise tier</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/93b58ee491c5b6cf3a5324966fca2908f8d447f3"><code>93b58ee</code></a>
fix: resolve cache host read-first and never downgrade egress
policy</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/e7399dd3e93d6c159d314af54b4704bc48abf6bc"><code>e7399dd</code></a>
fix: align deny-list mode detection with agent and log when both
endpoint inp...</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/c16689f716a10cdfd9cfe22e63938b8c6c0657de"><code>c16689f</code></a>
test: add denied_endpoints to Configuration fixtures and cover deny-list
merge</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/40b99cf0c7161e4dcdc6c5508927188b65028df9"><code>40b99cf</code></a>
Merge pull request <a
href="https://redirect.github.com/step-security/harden-runner/issues/682">#682</a>
from rohan-stepsecurity/rp/feat/codebuild-self-v2</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/fedec027a205365a7d64001a81931e4c36a1af6e"><code>fedec02</code></a>
Merge branch 'rc-42' into rp/feat/codebuild-self-v2</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/5361fb178b926b2be6df52e11ee257823821567b"><code>5361fb1</code></a>
feat: add build artifacts</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/286474fffe0b8fe7c9db855f132d04a9b48ab564"><code>286474f</code></a>
feat: Support Bravo agent install on CodeBuild runners</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/051ec05283d064bd82f41279db4f70f0717bf778"><code>051ec05</code></a>
Merge pull request <a
href="https://redirect.github.com/step-security/harden-runner/issues/683">#683</a>
from h0x0er/jatin/deny-list</li>
<li>Additional commits viewable in <a
href="https://github.com/step-security/harden-runner/compare/b09bb98e06d4d774595224525879c09bc6e98c40...05e31511f85b41b11d1cf0ef85d0992719546e2c">compare
view</a></li>
</ul>
</details>
<br />

Updates `docker/setup-buildx-action` from 4.2.0 to 4.3.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/setup-buildx-action/releases">docker/setup-buildx-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.3.0</h2>
<ul>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.92.0 to 0.95.0 in
<a
href="https://redirect.github.com/docker/setup-buildx-action/pull/595">docker/setup-buildx-action#595</a></li>
<li>Bump brace-expansion from 1.1.13 to 1.1.18 in <a
href="https://redirect.github.com/docker/setup-buildx-action/pull/600">docker/setup-buildx-action#600</a></li>
<li>Bump js-yaml from 5.2.0 to 5.3.0 in <a
href="https://redirect.github.com/docker/setup-buildx-action/pull/585">docker/setup-buildx-action#585</a></li>
<li>Bump postcss from 8.5.10 to 8.5.25 in <a
href="https://redirect.github.com/docker/setup-buildx-action/pull/598">docker/setup-buildx-action#598</a></li>
<li>Bump undici from 6.27.0 to 6.28.0 in <a
href="https://redirect.github.com/docker/setup-buildx-action/pull/601">docker/setup-buildx-action#601</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/setup-buildx-action/compare/v4.2.0...v4.3.0">https://github.com/docker/setup-buildx-action/compare/v4.2.0...v4.3.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/setup-buildx-action/commit/37fe631027851001ddb9b187196cc803df7f5f0e"><code>37fe631</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/setup-buildx-action/issues/595">#595</a>
from docker/dependabot/npm_and_yarn/docker/actions-to...</li>
<li><a
href="https://github.com/docker/setup-buildx-action/commit/b5c4f91922681cc7c58d15ab7838986951f09d19"><code>b5c4f91</code></a>
[dependabot skip] chore: update generated content</li>
<li><a
href="https://github.com/docker/setup-buildx-action/commit/3e93b637c6430ba8fa896fad44d3aa6821899d63"><code>3e93b63</code></a>
build(deps): bump <code>@​docker/actions-toolkit</code> from 0.92.0 to
0.95.0</li>
<li><a
href="https://github.com/docker/setup-buildx-action/commit/e527031b32c86649307d5d492506855f90470604"><code>e527031</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/setup-buildx-action/issues/600">#600</a>
from docker/dependabot/npm_and_yarn/brace-expansion-1...</li>
<li><a
href="https://github.com/docker/setup-buildx-action/commit/c68814b33cb66f1f7538e546190d410ae557a640"><code>c68814b</code></a>
[dependabot skip] chore: update generated content</li>
<li><a
href="https://github.com/docker/setup-buildx-action/commit/3f891b01bd5012a434f582800366972569aa1886"><code>3f891b0</code></a>
build(deps): bump brace-expansion from 1.1.13 to 1.1.18</li>
<li><a
href="https://github.com/docker/setup-buildx-action/commit/787db26fcde8ddcabd49a81472318028f7113962"><code>787db26</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/setup-buildx-action/issues/585">#585</a>
from docker/dependabot/npm_and_yarn/js-yaml-5.2.1</li>
<li><a
href="https://github.com/docker/setup-buildx-action/commit/f7793687c711790ca336bd4934f1b1bf5f778e17"><code>f779368</code></a>
[dependabot skip] chore: update generated content</li>
<li><a
href="https://github.com/docker/setup-buildx-action/commit/7d5e60413489a33d28077e11d71c668580cfaf8d"><code>7d5e604</code></a>
build(deps): bump js-yaml from 5.2.0 to 5.3.0</li>
<li><a
href="https://github.com/docker/setup-buildx-action/commit/292c2fb3837a12d3ac2d1e47bbc5c00712bad939"><code>292c2fb</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/setup-buildx-action/issues/590">#590</a>
from docker/dependabot/github_actions/actions/setup-n...</li>
<li>Additional commits viewable in <a
href="https://github.com/docker/setup-buildx-action/compare/bb05f3f5519dd87d3ba754cc423b652a5edd6d2c...37fe631027851001ddb9b187196cc803df7f5f0e">compare
view</a></li>
</ul>
</details>
<br />

Updates `toshimaru/auto-author-assign` from 3.0.3 to 3.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/toshimaru/auto-author-assign/releases">toshimaru/auto-author-assign's
releases</a>.</em></p>
<blockquote>
<h2>v3.1.0</h2>
<h2><a
href="https://github.com/toshimaru/auto-author-assign/compare/v3.0.3...v3.1.0">3.1.0</a>
(2026-08-12)</h2>
<h2>What's Changed</h2>
<h3>Features</h3>
<ul>
<li>Add support to <code>skip-users</code> (see <a
href="https://redirect.github.com/toshimaru/auto-author-assign/issues/185">#185</a>
and <a
href="https://redirect.github.com/toshimaru/auto-author-assign/issues/191">#191</a>)
(<a
href="https://github.com/toshimaru/auto-author-assign/commit/c323db629e2e295b2c8ebe87d47bb2c961ef87ae">c323db6</a>)
<ul>
<li>Add skip-users input by <a
href="https://github.com/IsabelParedes"><code>@​IsabelParedes</code></a>
in <a
href="https://redirect.github.com/toshimaru/auto-author-assign/pull/185">toshimaru/auto-author-assign#185</a></li>
<li>feat: Parse <code>skip-users</code> as comma or newline-separated
list by <a
href="https://github.com/toshimaru"><code>@​toshimaru</code></a> in <a
href="https://redirect.github.com/toshimaru/auto-author-assign/pull/191">toshimaru/auto-author-assign#191</a></li>
</ul>
</li>
</ul>
<h3>Security</h3>
<ul>
<li>Configure Dependabot cooldown windows for npm and GitHub Actions by
<a href="https://github.com/toshimaru"><code>@​toshimaru</code></a> with
<a href="https://github.com/Copilot"><code>@​Copilot</code></a> in <a
href="https://redirect.github.com/toshimaru/auto-author-assign/pull/182">toshimaru/auto-author-assign#182</a></li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>build(deps-dev): bump rollup from 4.62.0 to 4.62.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/toshimaru/auto-author-assign/pull/180">toshimaru/auto-author-assign#180</a></li>
<li>build(deps): bump actions/checkout from 6 to 7 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/toshimaru/auto-author-assign/pull/178">toshimaru/auto-author-assign#178</a></li>
<li>build(deps-dev): bump rollup from 4.62.2 to 4.62.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/toshimaru/auto-author-assign/pull/186">toshimaru/auto-author-assign#186</a></li>
<li>build(deps): bump actions/setup-node from 6 to 7 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/toshimaru/auto-author-assign/pull/183">toshimaru/auto-author-assign#183</a></li>
<li>build(deps): bump undici from 6.25.0 to 6.28.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/toshimaru/auto-author-assign/pull/188">toshimaru/auto-author-assign#188</a></li>
<li>build(deps-dev): bump rollup from 4.62.3 to 4.62.4 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/toshimaru/auto-author-assign/pull/189">toshimaru/auto-author-assign#189</a></li>
</ul>
<h3>Others</h3>
<ul>
<li>chore(main): release 3.1.0 by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/toshimaru/auto-author-assign/pull/192">toshimaru/auto-author-assign#192</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/IsabelParedes"><code>@​IsabelParedes</code></a>
made their first contribution in <a
href="https://redirect.github.com/toshimaru/auto-author-assign/pull/185">toshimaru/auto-author-assign#185</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/toshimaru/auto-author-assign/compare/v3.0.3...v3.1.0">https://github.com/toshimaru/auto-author-assign/compare/v3.0.3...v3.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/toshimaru/auto-author-assign/blob/main/CHANGELOG.md">toshimaru/auto-author-assign's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2><a
href="https://github.com/toshimaru/auto-author-assign/compare/v3.0.3...v3.1.0">3.1.0</a>
(2026-08-12)</h2>
<h3>Features</h3>
<ul>
<li>add support to skip users (see <a
href="https://redirect.github.com/toshimaru/auto-author-assign/issues/185">#185</a>
and <a
href="https://redirect.github.com/toshimaru/auto-author-assign/issues/191">#191</a>)
(<a
href="https://github.com/toshimaru/auto-author-assign/commit/c323db629e2e295b2c8ebe87d47bb2c961ef87ae">c323db6</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>parse skip-users as comma or newline-separated list (<a
href="https://github.com/toshimaru/auto-author-assign/commit/9db2a78bf35000232ae3b800c3dd021300887393">9db2a78</a>)</li>
</ul>
<h2><a
href="https://github.com/toshimaru/auto-author-assign/compare/v3.0.2...v3.0.3">3.0.3</a>
(2026-06-15)</h2>
<h3>Miscellaneous Chores</h3>
<ul>
<li>release 3.0.3 (<a
href="https://github.com/toshimaru/auto-author-assign/commit/8f813140fc4dbdfcc4a43f89d97033b5988e3773">8f81314</a>)</li>
</ul>
<h2><a
href="https://github.com/toshimaru/auto-author-assign/compare/v3.0.1...v3.0.2">3.0.2</a>
(2026-04-27)</h2>
<h3>Miscellaneous Chores</h3>
<ul>
<li>release 3.0.2 (<a
href="https://github.com/toshimaru/auto-author-assign/commit/658b95bf703955e926268fcaca1124037270bea8">658b95b</a>)</li>
<li>release 3.0.2 (<a
href="https://github.com/toshimaru/auto-author-assign/commit/ca59fc3261247bab40337927fac848bf2a60863f">ca59fc3</a>)</li>
</ul>
<h2><a
href="https://github.com/toshimaru/auto-author-assign/compare/v3.0.0...v3.0.1">3.0.1</a>
(2025-12-25)</h2>
<h3>Miscellaneous Chores</h3>
<ul>
<li>release 3.0.1 (<a
href="https://github.com/toshimaru/auto-author-assign/commit/718d4ed5349747d47952ae841ae03fcbdd74ebea">718d4ed</a>)</li>
</ul>
<h2><a
href="https://github.com/toshimaru/auto-author-assign/compare/v2.1.2...v3.0.0">3.0.0</a>
(2025-12-21)</h2>
<h3>Features</h3>
<ul>
<li>Add <code>npm run package</code> instead of <code>build</code> (<a
href="https://redirect.github.com/toshimaru/auto-author-assign/issues/130">#130</a>)
(<a
href="https://github.com/toshimaru/auto-author-assign/commit/972720f0403d2873e807f16e350c5b0b1be4dda3">972720f</a>)</li>
</ul>
<h3>Miscellaneous Chores</h3>
<ul>
<li>release 3.0.0 (<a
href="https://github.com/toshimaru/auto-author-assign/commit/d100ceff34d1e9cd2c4ea5b8055922f1409f3068">d100cef</a>)</li>
</ul>
<h3><a
href="https://github.com/toshimaru/auto-author-assign/compare/v2.1.1...v2.1.2">2.1.2</a>
(2025-12-16)</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/toshimaru/auto-author-assign/commit/a78a94b219445cece8ccf0d45fec60af449f212a"><code>a78a94b</code></a>
chore(main): release 3.1.0 (<a
href="https://redirect.github.com/toshimaru/auto-author-assign/issues/192">#192</a>)</li>
<li><a
href="https://github.com/toshimaru/auto-author-assign/commit/c323db629e2e295b2c8ebe87d47bb2c961ef87ae"><code>c323db6</code></a>
feat: add support to skip users (see <a
href="https://redirect.github.com/toshimaru/auto-author-assign/issues/185">#185</a>
and <a
href="https://redirect.github.com/toshimaru/auto-author-assign/issues/191">#191</a>)</li>
<li><a
href="https://github.com/toshimaru/auto-author-assign/commit/eae6cfd3b5c7e2cce508a78f856f8827f76cafb3"><code>eae6cfd</code></a>
build(deps-dev): bump rollup from 4.62.3 to 4.62.4 (<a
href="https://redirect.github.com/toshimaru/auto-author-assign/issues/189">#189</a>)</li>
<li><a
href="https://github.com/toshimaru/auto-author-assign/commit/3d6ff397d755c64759c1b416535523166e518e8f"><code>3d6ff39</code></a>
build(deps): bump undici from 6.25.0 to 6.28.0 (<a
href="https://redirect.github.com/toshimaru/auto-author-assign/issues/188">#188</a>)</li>
<li><a
href="https://github.com/toshimaru/auto-author-assign/commit/6c3a1f760361388c2c9f0ae0930d922cab507b48"><code>6c3a1f7</code></a>
docs: use consistent terminology for machine-user accounts</li>
<li><a
href="https://github.com/toshimaru/auto-author-assign/commit/19ec32b7d5b8e5e25add98f708540b51e4c3e8b3"><code>19ec32b</code></a>
docs: note that bot check does not cover machine-user accounts</li>
<li><a
href="https://github.com/toshimaru/auto-author-assign/commit/737b10ed8b9df5741368b9c584436685ef07612d"><code>737b10e</code></a>
build: rebuild dist for skip-users separator fix</li>
<li><a
href="https://github.com/toshimaru/auto-author-assign/commit/9db2a78bf35000232ae3b800c3dd021300887393"><code>9db2a78</code></a>
fix: parse skip-users as comma or newline-separated list</li>
<li><a
href="https://github.com/toshimaru/auto-author-assign/commit/2498de00249093fbd9c9f74f91248c110cb2ecde"><code>2498de0</code></a>
Update README</li>
<li><a
href="https://github.com/toshimaru/auto-author-assign/commit/0bb32246e068f1d145e989a9c6fc7d4753c28eb6"><code>0bb3224</code></a>
Add skip-user input</li>
<li>Additional commits viewable in <a
href="https://github.com/toshimaru/auto-author-assign/compare/3e19bfc990cb1cf0589dce95e9f75289bb1e22de...a78a94b219445cece8ccf0d45fec60af449f212a">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/upload-sarif` from 4.37.6 to 4.37.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/upload-sarif's
releases</a>.</em></p>
<blockquote>
<h2>v4.37.7</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/upload-sarif's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.37.8 - 21 Aug 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.7 - 13 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
<h2>4.37.6 - 04 Aug 2026</h2>
<ul>
<li>Changed the default filepath for the new remote file address format
that was introduced in CodeQL Action 4.37.0 / 3.37.0 to
<code>.github/codeql-config.yml</code> to align it with the suggested
path that is used elsewhere. <a
href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li>
</ul>
<h2>4.37.5 - 03 Aug 2026</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of
the CodeQL bundle could terminate the <code>init</code> Action instead
of falling back to downloading the bundle before extracting it. <a
href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
<h2>4.37.4 - 29 Jul 2026</h2>
<ul>
<li>This version of the CodeQL Action adds support for the
<code>tools</code> input for the <code>codeql-action/init</code> step to
be specified using a <code>github-codeql-tools</code> <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository
property</a>. This feature will gradually be rolled out following the
release of this version. Once rolled out, this allows for the CodeQL CLI
version that is used in GitHub-managed workflows, such as Default Setup,
to be set to a custom value. For example, customers who run into issues
with rate limits when a new CodeQL CLI version is released can set the
value to <code>toolcache</code> to always use the CodeQL CLI version
that is available in the runner toolcache. For Advanced Setup workflows,
the value provided for <code>tools</code> in the workflow definition
always takes precedence unless the value of the repository property
starts with <code>!</code>. <a
href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
<h2>4.37.3 - 22 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.2 - 21 Jul 2026</h2>
<ul>
<li>The new address format for the <code>config-file</code> input that
was introduced in CodeQL Action 4.37.0 is now enabled by default. In
addition to the format described there, the <code>remote=</code> prefix
can now be used to explicitly indicate that the input refers to a remote
file. All previous input formats continue to be accepted as well. <a
href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li>
<li>The CodeQL Action can now make use of <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured
private registries</a> in Default Setup to retrieve CodeQL configuration
files from remote repositories that require authentication. This will
allow customers to store their CodeQL configuration in a single
repository that can then be referenced by Default Setup workflows in
other repositories. We expect to roll this and other, related changes
out to everyone in July. <a
href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li>
</ul>
<h2>4.37.1 - 16 Jul 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.20.6 and earlier. These versions of
CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise
Server 3.16, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
<h2>4.37.0 - 08 Jul 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
<h2>4.36.3 - 01 Jul 2026</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd"><code>ff2f1c6</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4093">#4093</a>
from github/update-v4.37.7-be7a3dbb8</li>
<li><a
href="https://github.com/github/codeql-action/commit/951a133f96aa2114dd747e9e437305335d0bde16"><code>951a133</code></a>
Update changelog for v4.37.7</li>
<li><a
href="https://github.com/github/codeql-action/commit/be7a3dbb8147b82cd6d27e0707105b36aa190fc1"><code>be7a3db</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4087">#4087</a>
from github/dependabot/npm_and_yarn/npm-minor-0aa561...</li>
<li><a
href="https://github.com/github/codeql-action/commit/9310334b11405b305d9444edfa56cd86e2f1e4fe"><code>9310334</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4086">#4086</a>
from github/mbg/thread-action-state-to-codeql</li>
<li><a
href="https://github.com/github/codeql-action/commit/b4d8a54218a8792de9af2f6f32e33af899ca5212"><code>b4d8a54</code></a>
Rebuild</li>
<li><a
href="https://github.com/github/codeql-action/commit/ab5db2519c3344f2fa61c711fa2d6ad135829200"><code>ab5db25</code></a>
Bump the npm-minor group across 1 directory with 8 updates</li>
<li><a
href="https://github.com/github/codeql-action/commit/38055a3c3cf3979323eaf70fc6c73a8690250bde"><code>38055a3</code></a>
Drop <code>logger</code> from <code>databaseInitCluster</code> in
interface</li>
<li><a
href="https://github.com/github/codeql-action/commit/1f87aed5e66849f0c43ae147377cc77f2d98ac99"><code>1f87aed</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4085">#4085</a>
from github/update-bundle/codeql-bundle-v2.26.3</li>
<li><a
href="https://github.com/github/codeql-action/commit/dc1b98ad1c2f13ccf9fc33fb82f32fc76f944253"><code>dc1b98a</code></a>
Make <code>logger</code> available to <code>getCodeQLForCmd</code></li>
<li><a
href="https://github.com/github/codeql-action/commit/6f0220ee37121218af472efbde25f06907a4da4f"><code>6f0220e</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4084">#4084</a>
from github/navntoft/bump-undici</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/init` from 4.37.6 to 4.37.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/init's
releases</a>.</em></p>
<blockquote>
<h2>v4.37.7</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.37.8 - 21 Aug 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.7 - 13 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
<h2>4.37.6 - 04 Aug 2026</h2>
<ul>
<li>Changed the default filepath for the new remote file address format
that was introduced in CodeQL Action 4.37.0 / 3.37.0 to
<code>.github/codeql-config.yml</code> to align it with the suggested
path that is used elsewhere. <a
href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li>
</ul>
<h2>4.37.5 - 03 Aug 2026</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of
the CodeQL bundle could terminate the <code>init</code> Action instead
of falling back to downloading the bundle before extracting it. <a
href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
<h2>4.37.4 - 29 Jul 2026</h2>
<ul>
<li>This version of the CodeQL Action adds support for the
<code>tools</code> input for the <code>codeql-action/init</code> step to
be specified using a <code>github-codeql-tools</code> <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository
property</a>. This feature will gradually be rolled out following the
release of this version. Once rolled out, this allows for the CodeQL CLI
version that is used in GitHub-managed workflows, such as Default Setup,
to be set to a custom value. For example, customers who run into issues
with rate limits when a new CodeQL CLI version is released can set the
value to <code>toolcache</code> to always use the CodeQL CLI version
that is available in the runner toolcache. For Advanced Setup workflows,
the value provided for <code>tools</code> in the workflow definition
always takes precedence unless the value of the repository property
starts with <code>!</code>. <a
href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
<h2>4.37.3 - 22 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.2 - 21 Jul 2026</h2>
<ul>
<li>The new address format for the <code>config-file</code> input that
was introduced in CodeQL Action 4.37.0 is now enabled by default. In
addition to the format described there, the <code>remote=</code> prefix
can now be used to explicitly indicate that the input refers to a remote
file. All previous input formats continue to be accepted as well. <a
href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li>
<li>The CodeQL Action can now make use of <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured
private registries</a> in Default Setup to retrieve CodeQL configuration
files from remote repositories that require authentication. This will
allow customers to store their CodeQL configuration in a single
repository that can then be referenced by Default Setup workflows in
other repositories. We expect to roll this and other, related changes
out to everyone in July. <a
href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li>
</ul>
<h2>4.37.1 - 16 Jul 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.20.6 and earlier. These versions of
CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise
Server 3.16, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
<h2>4.37.0 - 08 Jul 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
<h2>4.36.3 - 01 Jul 2026</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd"><code>ff2f1c6</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4093">#4093</a>
from github/update-v4.37.7-be7a3dbb8</li>
<li><a
href="https://github.com/github/codeql-action/commit/951a133f96aa2114dd747e9e437305335d0bde16"><code>951a133</code></a>
Update changelog for v4.37.7</li>
<li><a
href="https://github.com/github/codeql-action/commit/be7a3dbb8147b82cd6d27e0707105b36aa190fc1"><code>be7a3db</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4087">#4087</a>
from github/dependabot/npm_and_yarn/npm-minor-0aa561...</li>
<li><a
href="https://github.com/github/codeql-action/commit/9310334b11405b305d9444edfa56cd86e2f1e4fe"><code>9310334</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4086">#4086</a>
from github/mbg/thread-action-state-to-codeql</li>
<li><a
href="https://github.com/github/codeql-action/commit/b4d8a54218a8792de9af2f6f32e33af899ca5212"><code>b4d8a54</code></a>
Rebuild</li>
<li><a
href="https://github.com/github/codeql-action/commit/ab5db2519c3344f2fa61c711fa2d6ad135829200"><code>ab5db25</code></a>
Bump the npm-minor group across 1 directory with 8 updates</li>
<li><a
href="https://github.com/github/codeql-action/commit/38055a3c3cf3979323eaf70fc6c73a8690250bde"><code>38055a3</code></a>
Drop <code>logger</code> from <code>databaseInitCluster</code> in
interface</li>
<li><a
href="https://github.com/github/codeql-action/commit/1f87aed5e66849f0c43ae147377cc77f2d98ac99"><code>1f87aed</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4085">#4085</a>
from github/update-bundle/codeql-bundle-v2.26.3</li>
<li><a
href="https://github.com/github/codeql-action/commit/dc1b98ad1c2f13ccf9fc33fb82f32fc76f944253"><code>dc1b98a</code></a>
Make <code>logger</code> available to <code>getCodeQLForCmd</code></li>
<li><a
href="https://github.com/github/codeql-action/commit/6f0220ee37121218af472efbde25f06907a4da4f"><code>6f0220e</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4084">#4084</a>
from github/navntoft/bump-undici</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/analyze` from 4.37.6 to 4.37.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's
releases</a>.</em></p>
<blockquote>
<h2>v4.37.7</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.37.8 - 21 Aug 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.7 - 13 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
<h2>4.37.6 - 04 Aug 2026</h2>
<ul>
<li>Changed the default filepath for the new remote file address format
that was introduced in CodeQL Action 4.37.0 / 3.37.0 to
<code>.github/codeql-config.yml</code> to align it with the suggested
path that is used elsewhere. <a
href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li>
</ul>
<h2>4.37.5 - 03 Aug 2026</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of
the CodeQL bundle could terminate the <code>init</code> Action instead
of falling back to downloading the bundle before extracting it. <a
href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
<h2>4.37.4 - 29 Jul 2026</h2>
<ul>
<li>This version of the CodeQL Action adds support for the
<code>tools</code> input for the <code>codeql-action/init</code> step to
be specified using a <code>github-codeql-tools</code> <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository
property</a>. This feature will gradually be rolled out following the
release of this version. Once rolled out, this allows for the CodeQL CLI
version that is used in GitHub-managed workflows, such as Default Setup,
to be set to a custom value. For example, customers who run into issues
with rate limits when a new CodeQL CLI version is released can set the
value to <code>toolcache</code> to always use the CodeQL CLI version
that is available in the runner toolcache. For Advanced Setup workflows,
the value provided for <code>tools</code> in the workflow definition
always takes precedence unless the value of the repository property
starts with <code>!</code>. <a
href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
<h2>4.37.3 - 22 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.2 - 21 Jul 2026</h2>
<ul>
<li>The new address format for the <code>config-file</code> input that
was introduced in CodeQL Action 4.37.0 is now enabled by default. In
addition to the format described there, the <code>remote=</code> prefix
can now be used to explicitly indicate that the input refers to a remote
file. All previous input formats continue to be accepted as well. <a
href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li>
<li>The CodeQL Action can now make use of <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured
private registries</a> in Default Setup to retrieve CodeQL configuration
files from remote repositories that require authentication. This will
allow customers to store their CodeQL configuration in a single
repository that can then be referenced by Default Setup workflows in
other repositories. We expect to roll this and other, related changes
out to everyone in July. <a
href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li>
</ul>
<h2>4.37.1 - 16 Jul 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.20.6 and earlier. These versions of
CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise
Server 3.16, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
<h2>4.37.0 - 08 Jul 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
<h2>4.36.3 - 01 Jul 2026</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd"><code>ff2f1c6</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4093">#4093</a>
from github/update-v4.37.7-be7a3dbb8</li>
<li><a
href="https://github.com/github/codeql-action/commit/951a133f96aa2114dd747e9e437305335d0bde16"><code>951a133</code></a>
Update changelog for v4.37.7</li>
<li><a
href="https://github.com/github/codeql-action/commit/be7a3dbb8147b82cd6d27e0707105b36aa190fc1"><code>be7a3db</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4087">#4087</a>
from github/dependabot/npm_and_yarn/npm-minor-0aa561...</li>
<li><a
href="https://github.com/github/codeql-action/commit/9310334b11405b305d9444edfa56cd86e2f1e4fe"><code>9310334</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4086">#4086</a>
from github/mbg/thread-action-state-to-codeql</li>
<li><a
href="https://github.com/github/codeql-action/commit/b4d8a54218a8792de9af2f6f32e33af899ca5212"><code>b4d8a54</code></a>
Rebuild</li>
<li><a
href="https://github.com/github/codeql-action/commit/ab5db2519c3344f2fa61c711fa2d6ad135829200"><code>ab5db25</code></a>
Bump the npm-minor group across 1 directory with 8 updates</li>
<li><a
href="https://github.com/github/codeql-action/commit/38055a3c3cf3979323eaf70fc6c73a8690250bde"><code>38055a3</code></a>
Drop <code>logger</code> from <code>databaseInitCluster</code> in
interface</li>
<li><a
href="https://github.com/github/codeql-action/commit/1f87aed5e66849f0c43ae147377cc77f2d98ac99"><code>1f87aed</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4085">#4085</a>
from github/update-bundle/codeql-bundle-v2.26.3</li>
<li><a
href="https://github.com/github/codeql-action/commit/dc1b98ad1c2f13ccf9fc33fb82f32fc76f944253"><code>dc1b98a</code></a>
Make <code>logger</code> available to <code>getCodeQLForCmd</code></li>
<li><a
href="https://github.com/github/codeql-action/commit/6f0220ee37121218af472efbde25f06907a4da4f"><code>6f0220e</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4084">#4084</a>
from github/navntoft/bump-undici</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-25 11:23:58 +00:00
dependabot[bot] 7638779c24 chore: bump github.com/brianvoe/gofakeit/v7 from 7.15.0 to 7.16.0 (#28544) 
Bumps
[github.com/brianvoe/gofakeit/v7](https://github.com/brianvoe/gofakeit)
from 7.15.0 to 7.16.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/aab05dbcca39c4cb8a52f64e5b98a8823b425008"><code>aab05db</code></a>
tests - updated to fix flux test failure issue</li>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/517a58640892de2d43d5b03b8a47d329eebd0db7"><code>517a586</code></a>
slogan - updated some strings</li>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/ff1305bd1bcb2ae5edffdb4c8ec51e2ad73acfa9"><code>ff1305b</code></a>
github workflow - updated to fix macos-latest</li>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/3bdc6890f3bbf9ac7899b2df33efd3f3fc79f618"><code>3bdc689</code></a>
Merge pull request <a
href="https://redirect.github.com/brianvoe/gofakeit/issues/395">#395</a>
from ChrisJr404/slogan-mad-libs-templates</li>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/66cc15902391e928c3e24004ccbd53f6e5d36a71"><code>66cc159</code></a>
Add more slogan templates and fix slogan casing</li>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/d14309718f553b12b4a9693a4bc9c359ac7eef40"><code>d143097</code></a>
slogan - build slogans from mad-libs templates via Generate</li>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/f0b548a543358d5eee6c5858a0a6738344fd3ce2"><code>f0b548a</code></a>
fuzz - added initial fuzzing to functions that maybe best for</li>
<li>See full diff in <a
href="https://github.com/brianvoe/gofakeit/compare/v7.15.0...v7.16.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/brianvoe/gofakeit/v7&package-manager=go_modules&previous-version=7.15.0&new-version=7.16.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-25 11:18:42 +00:00
Garrett Delfosse eedc0ece47 fix: avoid 500 when generating chat title from rename dialog and remove unused endpoint (#28306) 2026-08-25 06:52:45 -04:00
Jaayden Halko 511dcc0293 feat(coderd/x/chatd): bill interrupted tool batches on cancellation rows (#28362) 
**Stack**: #28359 → #28360 → #28361 → **#28362 (this PR)**

## Summary

Interrupted local tool batches now bill the partial window they actually
executed, recorded on the same dedicated usage record completed batches
use. Completes the runtime billing work in this stack: completed batches
bill via #28360, interrupted batches via this PR.

Last of a four-PR stack splitting #28211. Stacked on #28361. Closes
CODAGT-928
(https://linear.app/codercom/issue/CODAGT-928/track-local-tool-execution-for-agent-runtime).

## Problem

Interrupting a batch previously billed only the model window; work the
tools already performed was lost.

## Fix

Just before closing the buffer episode, the interrupt task reads the
live tool stamps (`ToolCompletions`) alongside `ModelInvokedAt`. The
interruption commit appends the shared `batchUsageMessage` record (same
shape as #28360: model-only tool-role row with a
`billed_ms`/`billed_calls` audit payload) billing the union of the
started, billable calls' partial execution intervals: completed calls
end at their recorded completion, running calls at the interrupt
instant. Synthesized cancellation rows stay free of batch-level runtime.
Unstarted calls, rejected calls, and sub-agent orchestration tools bill
nothing and append no record. Batches with no live attempt (crash
recovery, state promotion) bill nothing, consistent with generation
losing in-flight runtime on a crash.

Usage-record billing reuses the same interrupt instant as the model
window instead of taking a second clock reading inside the transaction,
so database delay cannot inflate a running call's window.

An earlier revision carried a retry-stable episode snapshot so an
interrupt retry after buffer eviction (a >15s stall) would not lose
billing; it was dropped as not worth the complexity
(https://github.com/coder/coder/pull/28211#discussion_r3812778418). Such
a retry now bills the batch at zero, matching the existing
crash-recovery precedent.

Known gaps left out of scope: retry backoff and errored-attempt time
stay unbilled (no persistence home for error turns), and the advisor
tool's nested model call now bills as tool time by design.
 2026-08-25 17:29:57 +07:00
Ethan d667d68e3c fix(site): harden organization-scoped model loading (#28495) 
Previously, the new agent form treated the dashboard organization as a
usable resource scope while permission filtering was still pending. This
could request a provisional empty model catalog, briefly show the
no-model setup notice, and lose the selected organization when the form
remounted. A malformed organization models response could also crash the
Models settings page.

Wait for authoritative permitted organizations before enabling
organization-scoped resources, persist valid organization selections
across remounts, and reject malformed model responses while retaining a
defensive rendering guard.

## UAT

An adversarial [Coder Agents UAT
run](https://dev.coder.com/agents/980a5a6d-e91b-47f0-902e-25d12ac46935)
validated this commit on a licensed local deployment with two
organizations, a real Anthropic model, and a non-admin user. Under
throttled and artificially delayed authorization, no organization-scoped
request fired before permissions settled and the false setup notice
never appeared, while an authorized zero-model organization still showed
the genuine notice. Persistence across reloads, tampered or stale
localStorage IDs, membership revocation, attachment-preserving
organization switches, single-organization deployments, and induced
malformed or failed model responses on the Models settings page all
behaved correctly. Verdict: PASS.
 2026-08-25 10:25:16 +00:00
Jaayden HalkoandHugo Dutka 64d2d8a108 feat(coderd/x/chatd): record live tool execution stamps in the message part buffer (#28361) 
**Stack**: #28359 → #28360 → **#28361 (this PR)** → #28362

During local tool execution, buffer episodes now record when each
tool-call occurrence actually starts and finishes, via
`RecordToolStart`/`RecordToolCompletion`/`ToolCompletions` on the
message part buffer. Occurrences are keyed by unresolved-call position,
so gaps left by rejected calls and duplicate tool-call IDs stay
distinct: `partitionAmbiguousToolCalls` additionally returns the allowed
calls' input positions, and generation's `chatloop.ToolBillingRecorder`
implementation translates dispatch-order stamps back through them.

Mechanism only: nothing reads the stamps yet. The final PR in the stack
uses them to bill interrupted tool batches on a dedicated usage record
committed alongside their synthesized cancellation rows.

Third of a four-PR stack splitting #28211. Stacked on #28360. Refs
CODAGT-928
(https://linear.app/codercom/issue/CODAGT-928/track-local-tool-execution-for-agent-runtime).

---------

Co-authored-by: Hugo Dutka <hugo@coder.com>
 2026-08-25 16:57:27 +07:00
Michael Suchacz cc958b73be fix(coderd/x/chatd/mcpclient): enforce MCP connect budget and unblock session cleanup (#28400) 
## Problem

During the Aug 19 dev.coder.com incident, chats stalled for up to ~15
minutes per turn. chatd reconnects to every configured MCP server on
every generation step, and one configured server
(`registry.coder.com/mcp`) was black-holing requests from the
deployment's egress IPs: TCP/requests were silently dropped, and each
connect attempt hung until the kernel gave up (~125s), far past the
nominal 10s connect budget.

The budget does not hold because go-sdk v1.7.0 detaches the context
inside `StreamableClientTransport.Connect`, and its error paths block on
HTTP work bound to that detached context. Reproduced in a test: a bare
`Connect` with a 2s deadline against a black-holed server returns after
**12s**. Step-end session cleanup (`session.Close()`) runs synchronously
in the generation loop and blocks on the same detached requests, so a
server that wedges mid-turn stalls every step boundary too.

## Changes

- **Enforce the connect budget externally** (`connectOne`): run
`Connect` + `ListTools` in a goroutine and select on the budget context.
On timeout, abandon the goroutine and leave a reaper that drains its
late result and closes any session that still materialized, so nothing
leaks and the caller returns within the budget.
- **Stop using bare `http.DefaultTransport`**: MCP traffic now rides a
cloned transport with a 5s dial timeout (converts SYN black-holes into
fast errors) and a 60s `ResponseHeaderTimeout`. `http.Client.Timeout`
stays unset so long-lived SSE streams are unaffected.
- **Close sessions in detached goroutines during cleanup**
(`ConnectAll`'s cleanup func): the sessions are discarded regardless,
and a wedged `Close` (DELETE bound to the SDK's detached context) must
not stall the generation loop at step boundaries.

One deliberate deviation from the incident plan: `ResponseHeaderTimeout`
is 60s (matching `toolCallTimeout`) instead of ~10s. The same HTTP
client serves tool-call POSTs, and a JSON-response MCP server sends no
headers until the tool finishes, so a 10s bound would falsely kill
legitimate 10-60s tools that fit today's tool-call budget. The real 10s
connect budget is enforced by the external select, not the transport.

## Tests

- Acceptance: with a black-holed server plus a healthy one configured,
`ConnectAll` returns within the budget and the healthy server's tools
are present; closing the black-holed connections makes the reaper exit
(red without the fix: 1s budget took 11s).
- A slow-but-alive server (300ms/request) still connects.
- A server that only responds after the budget: `ConnectAll` returns
promptly, the late result is reaped.
- Cleanup returns promptly while the session-teardown DELETE is wedged
server-side, and the teardown still happens in the background (red
without the fix: cleanup blocked 60s).
- Transport guard test pinning the dial/response-header bounds.

`go test ./coderd/x/chatd/...` passes (including goleak in `chatd`).

Part of the MCP connect-stall incident follow-up; observability (connect
durations in logs/debug runs) comes in a stacked follow-up PR.

> 🤖 Mux authored this PR on Mike's behalf.

<!-- mux-attribution: model=anthropic:claude-opus-4-6 thinking=high -->
 2026-08-25 09:43:55 +00:00
Jaayden Halko b428c8feb6 feat(coderd): bill completed local tool batches in agent runtime (#28360) 
**Stack**: #28359 → **#28360 (this PR)** → #28361 → #28362

## Summary

Completed local tool batches now count toward Coder Agent runtime
(`chat_messages.runtime_ms`, the source of truth for
`hb_agent_runtime_v1`), excluding sub-agent orchestration tools to avoid
double counting, and without multiplying runtime for parallel tool
calls.

Second of a four-PR stack splitting #28211. Stacked on #28359. Refs
CODAGT-928
(https://linear.app/codercom/issue/CODAGT-928/track-local-tool-execution-for-agent-runtime).

## Problem

Agent runtime previously measured only model invocation wall clock
(stream open to fully consumed). Time spent executing local tools
between steps, including file operations, terminal commands, workspace
provisioning, and MCP tools, was deliberately excluded, which
undercounts the product definition of "actively processing a task".

Naive inclusion has two hazards: a batch of parallel tool calls would
bill N windows for one wall-clock wait, and `wait_agent` would re-bill
child agents that already bill their own model and tool time.

## Fix

Each completed local tool batch bills one window: the union of the
billed tools' execution intervals, persisted as `runtime_ms` on a
dedicated usage record appended after the batch's tool-result rows. The
record is a tool-role message with `visibility='model'`, so it never
reaches the API, SSE, or clients, and prompt replay drops it because its
single internal `tool-batch-usage` part converts to no provider content.
Its content carries an audit payload (`billed_ms`, `billed_calls`) so
the billed window is inspectable after the fact; real tool-result rows
never carry batch-level runtime. Concurrent calls all start at batch
start, so 5 parallel 10s reads bill 10s, not 50s; serial calls
(`SerialToolCalls`) count only from their own launch, so unbilled waits
before them do not count.

Sub-agent orchestration tools (`spawn_agent`, `wait_agent`,
`message_agent`, `interrupt_agent`, `list_agents`,
`list_subagent_models`, plus the deprecated `close_agent` alias) never
extend the window: every chat, including children, applies the same
rules to its own runtime, so a parent's `wait_agent` window would double
count. A lone `wait_agent` bills 0 and appends no usage record;
`execute` 10s in parallel with `wait_agent` 60s bills 10s. A test pins
the unbilled set to the registered sub-agent tool catalog so they cannot
drift.

`GetTotalChatMessageRuntimeMsInRange` already sums `runtime_ms`
role-agnostically, so the usage record is picked up with no schema,
query, or cron changes.

Client-executed dynamic tools, external agents, parked/idle time, and
retry backoff remain unbilled. Interrupted batches still bill only the
model window; the rest of the stack adds partial-window billing via the
same usage record.

`ExecuteLocalToolsOptions` also gains an optional `ToolBillingRecorder`
(`RecordStart`/`RecordComplete`) observing per-occurrence dispatch-order
execution stamps. This PR wires no recorder; the next PR in the stack
connects it to the message part buffer for interrupt billing.

**NOTE**: Reported agent runtime (`hb_agent_runtime_v1`) increases from
deploy forward. There is no backfill and no feature flag.
 2026-08-25 16:40:41 +07:00
Michael Suchacz e244cac9c1 feat(coderd/x/chatd/chattool): improve find_tools relevance and model guidance (#28476) 
Broad `find_tools` queries such as "linear issues" saturated the hard
20-match cap on every call: a large server's name token-matches every
one of its tools (+8 name, +1 server), so ranking was decided by a term
carrying no discriminating information and the model got 20 activations
per search regardless of intent.

Three changes, mirroring what makes xum's `tool_catalog_search` behave
well:

- **Lower default with a `limit` argument.** Keyword matches default to
10 per call; the new optional `limit` raises that up to the existing
hard cap of 20 (non-positive values fall back to the default). Exact
`names` are explicit activation requests and bypass the limit up to the
hard cap, so naming 15 tools still activates all 15.
- **Coverage-first ranking.** Keyword matches sort by distinct query
terms matched before raw score, so a query like "linear issues" ranks
tools matching both terms above the dozens matching only the server
name.
- **Model guidance.** `queries` and `names` now carry schema
descriptions (capability keywords and what they are matched against;
exact-name activation), and the tool description opens by explaining
what deferral means, that matches become callable on the next step, and
that a `"server: terms"` prefix scopes a query to one server.

An earlier revision also inferred a server scope from unprefixed query
words ("linear issues" behaving like "linear: issues"). Review kept
surfacing edge cases in that inference, and coverage-first ranking
already resolves the original saturation complaint, so it was dropped in
favor of the explicit prefix.

The hard cap stays at 20 so the persisted result keeps fitting under the
generic tool-result truncation budget that protects activation-recovery
JSON. Budget and reservation accounting are unchanged; the frontend
renderer ignores unknown argument fields, so no `site/` change is
needed.

> [!NOTE]
> Xum acted on @ibetitsmike's behalf in this pull request.
<!-- xum-attribution: model=claude-opus-4-6 thinking=high -->
 2026-08-25 11:39:43 +02:00
Hugo Dutka 01c935ab6b test(coderd/x/chatd): avoid advancing unrelated retry timers (#28537) 
`TestActiveServer_RetryStatePersistedDuringBackoff` advanced whichever
mock-clock timer was next while waiting for the retried provider call.
If the provider goroutine had not incremented its call count yet, the
test could advance the unrelated 15-minute task timeout and trigger an
extra whole-task retry.

Trap and release only the named generation-retry timer, then wait for
the provider call without advancing the clock again.

Refs
https://linear.app/codercom/issue/CODAGT-967/flake-testactiveserver-retrystatepersistedduringbackoff

<sub>Generated by Coder Agents.</sub>
 2026-08-25 11:35:53 +02:00
Jaayden Halko d44aae37de refactor(coderd/x/chatd): return PersistedStep directly from ExecuteLocalTools (#28359) 
**Stack**: **#28359 (this PR)** → #28360 → #28361 → #28362

`chatloop.ToolExecutionOutcome` only wrapped a `PersistedStep`, so
callers had to reach through `outcome.Step` for every field.
`ExecuteLocalTools` now returns the `PersistedStep` directly and the
wrapper type is deleted. No behavior change.

First of a four-PR stack that makes local tool execution count toward
Coder Agent runtime (splitting #28211). This refactor keeps the rename
noise out of the feature PRs.

Refs CODAGT-928
(https://linear.app/codercom/issue/CODAGT-928/track-local-tool-execution-for-agent-runtime).
 2026-08-25 16:31:06 +07:00
TJ e98e2b9b2e fix(site/src/pages/AIBridgePage): align token badges with neighboring badge sizing (#28477) 
The in/out token pills on the AI Gateway sessions pages looked out of
place next to the provider/client/model badges: they used `Badge
size="sm"` while their neighbors use the default `md`, and their arrow
icons were `size-icon-lg` (24px) — taller than the badge itself,
inflating the pill height.

> [!NOTE]
> The underlying font-size problem (`Badge sm` = 10px `text-2xs`) is
fixed globally in #28517. This PR handles what that one doesn't: the
token pills' size variant, icon sizing, and API cleanup.

## Changes

- Token pills use Badge's default `md` size, matching the
provider/client/model badges next to them.
- Arrow icons drop from `size-icon-lg` (24px) to `size-icon-xs` (14px),
the same icon size the neighboring badges use, with `gap-0.5` between
icon and count.
- Removed the unused `size` prop from `TokenBadges` — no call site ever
passed one — and dropped the now-meaningless `SizeXs`/`SizeMd` stories.

Affects every `TokenBadges` consumer: the sessions list, the session
summary card, and the timeline prompt/tool-call tables.

> 🤖 Generated by Coder Agents on behalf of @tracyjohnsonux
 2026-08-25 00:21:53 -07:00
TJ 0452ff7ec4 refactor(site/src/pages/AIBridgePage): move AI Sessions docs link inline into subtitle (#28481) 
Replaces the "Read the docs" header button on the AI Sessions page with
an inline "View docs" link at the end of the subtitle sentence, matching
the pattern used on the Providers and Provisioner Jobs pages.

---

_Created by a Coder Agent on behalf of the PR author._
 2026-08-25 00:21:12 -07:00
david-fraley 0f41ccd664 fix(site/src/pages/AgentsPage): rename "This Week" group to "Past 7 days" (#28504) 2026-08-25 10:14:59 +03:00
Jake Howell 303935a2dc revert(site/e2e): disable externalAuth suite (#28536) 
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.

Reverts 18b37e64f5 because the external
authentication end-to-end suite is still failing in CI.

This restores the suite's previous skipped state while the remaining
failure is investigated.

Refs https://linear.app/codercom/issue/DEVEX-413
 2026-08-25 14:13:22 +07:00
Jake Howell bef6b4c30b revert(site): remove built-in emoji avatar inset (#28533) 
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.

Reverts `75400428ad2b84c707f60fc5e6b378f46f565ef9` (`fix(site/src): give
built-in emoji avatars a consistent inset`).

The global built-in emoji detection and inline padding are causing
regressions. Revert this behavior so a replacement can be developed
separately.

## Changes

- Remove automatic `/emojis/` source detection from `Avatar`.
- Restore caller-controlled avatar variants and styles.
- Remove the built-in emoji inset stories.

## Verification

- Confirmed the resulting patch is the inverse of the target commit.
 2026-08-25 07:07:52 +00:00
TJ 607a1d0666 refactor(site/src): delete DateTimeRangeFilter and unify on the picker's time range type (#28427) 
Completes the deduplication agreed in #28392 (review): now that
`DateTimeRangePicker` has replaced the text-expression
`DateTimeRangeFilter` on the AI Gateway sessions page, the old component
and its `TimeRange` type are deleted, leaving a single time-range value
shape.

- Deletes `site/src/components/DateTimeRangeFilter/` (component,
stories, `timeRange.ts` helpers, tests); nothing imported it except the
sessions page type alias.
- The sessions page helpers in `ListSessionsPage/timeRange.ts` now use
neutral `{start, end}` naming derived from the picker's
`DateTimeRangeValue` (`type TimeRange = Pick<DateTimeRangeValue, "start"
| "end">`), removing the `startedAfter`/`startedBefore` field mapping
the page previously did by hand.

No behavior changes: the query-string serialization
(`started_after`/`started_before` RFC 3339 params) is untouched, and all
existing unit tests pass with only field renames.

---

Generated by Coder Agents on behalf of @tracyjohnsonux.
 2026-08-24 22:58:51 -07:00
TJandJake Howell 75400428ad fix(site/src): give built-in emoji avatars a consistent inset (#28492) 
Built-in emoji avatars (`/emojis/*.png`) rendered inconsistently: edge
to edge on user avatars (users table, organization members, group member
lists, exposed by the avatar `IconField` from #26652), and with the
tighter icon padding on pages that pass `variant="icon"` such as
workspace proxies.

`Avatar` gains an `emoji` variant with a proportional inset of 20% per
side, expressed as `calc(var(--avatar-*) * 0.2)` so it tracks the avatar
size tokens. Built-in emoji sources, detected by the shared
`isBuiltInEmojiUrl` helper (`site/src/utils/emojis.ts`, which also
generates the URLs for `IconField`), always resolve to it, including at
call sites that pass `variant="icon"` for data-dependent sources; the
override is documented on `AvatarProps`. Non-emoji icon avatars are
unchanged. Added `BuiltInEmoji{Lg,Md,Sm}Size` stories.

<details>
<summary>Investigation notes</summary>

- Suspected MUI-removal regression, but the demui Avatar change (#24527)
was style-mechanics only (`css` prop to `style`, `CSSObject` to
`CSSProperties`).
- Insets have always been opt-in via `variant="icon"` (compound variants
in `avatarVariants`). Group rows/headers and workspace proxies pass it;
user avatar call sites (`UsersTable`, `OrganizationMembersTable`,
`GroupMembersPage`, `GroupsPageView` member column) do not.
- Emoji user avatars only became reachable with #26652, which reuses the
group/template emoji picker that produces `/emojis/<unified>.png` URLs,
exposing the missing inset.
- The icon variant's padding is proportionally tighter at `md`/`sm`
(12.5%) than `lg` (20%), which made default-size emojis look oversized,
so emojis get their own size-keyed inset instead of reusing the icon
variant.
- Fixed in the shared component rather than at each call site so all
current and future emoji avatars are consistent.

</details>

---

🤖 Generated by Coder Agents on behalf of @tracyjohnsonux

---------

Co-authored-by: Jake Howell <jake@hwll.me>
 2026-08-25 05:54:19 +00:00
Jake Howell 95fb22c82a test(coderd): fix flaky TestExpireAPIKey timing assertions (#28455) 
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.

Closes
[DEVEX-730](https://linear.app/codercom/issue/DEVEX-730/flake-testexpireapikey-multiple-variants).

## Problem

`TestExpireAPIKey` flakes on Windows CI (`test-go-pg (windows-2022)`),
failing `AdminCanExpireOtherUsersToken`, `DeletingExpiredTokenSucceeds`,
and the parent test.

The subtests asserted:

```go
require.True(t, key.ExpiresAt.Before(dbtime.Now()))
```

The `expireAPIKey` handler sets `ExpiresAt: dbtime.Now()`, and
`dbtime.Now()` rounds to microsecond precision. On platforms with coarse
clock resolution (Windows, ~1–15ms), the handler's timestamp and the
test's later `dbtime.Now()` can round to the *same* value, so `Before()`
is `false` (equal is not before) and the assertion fails. On Linux the
nanosecond-resolution clock makes the two reads differ, which is why it
never reproduces there.

## Fix

Use the timing-safe assertion already used by the sibling
`ExpiringAlreadyExpiredTokenSucceeds` subtest:

```go
require.LessOrEqual(t, key.ExpiresAt, dbtime.Now(), "key should be expired")
```

Applied to all three occurrences of the flaky pattern
(`OwnerCanExpireOwnToken`, `AdminCanExpireOtherUsersToken`,
`DeletingExpiredTokenSucceeds`).

## Prior art

This is the established fix for this class of flake in this repo;
`require.LessOrEqual(x, now)` is equivalent to
`require.False(x.After(now))` (both allow equality, which is the point):

- **[#22685](https://github.com/coder/coder/pull/22685)** — *use
dbtime.Now() instead of time.Now() in test assertions against DB
timestamps*. States the principle: `time.Now()` is nanosecond precision
while Postgres timestamps are microsecond, so `Before`/`After`
comparisons carry non-zero flake risk. That sweep **edited this same
file** (`coderd/apikey_test.go`, 11 `ExpiresAt` comparisons) plus 10
others; these three assertions pre-dated it.
- **[#22684](https://github.com/coder/coder/pull/22684)** — *fix
TestTokens harder*. The direct predecessor ("Follows from #22684"),
fixing the identical token-expiry flake with the equality-tolerant
`require.False(t, token.ExpiresAt.After(dbtime.Now()))`.
- **[#21783](https://github.com/coder/coder/pull/21783)** — introduced
the sibling `ExpiringAlreadyExpiredTokenSucceeds` subtest in this file,
which already uses `require.LessOrEqual(t, key.ExpiresAt, dbtime.Now(),
"key should be expired")`. This PR just makes the other three subtests
consistent with it.

## Verification

- Ran the original `TestExpireAPIKey` 100× against Postgres on Linux:
100/100 passed (as expected, the flake is Windows-specific).
- Confirmed the root cause by reading the handler and `dbtime.Now()`
(microsecond rounding).
- Re-ran the test after the fix; passes.

<details>
<summary>Investigation notes</summary>

- CI reference: https://github.com/coder/coder/actions/runs/29892773275
(job `test-go-pg (windows-2022)`).
- Error snippet showed `key.ExpiresAt.Before(dbtime.Now())` expected
true but observed false (token appeared unexpired).
- Handler: `coderd/apikey.go` `expireAPIKey` sets `ExpiresAt:
dbtime.Now()`.
- `dbtime.Now()` returns `time.Now().UTC()` rounded to
`time.Microsecond`.
- The equal-timestamp collision only manifests where the OS clock
resolution is coarse (Windows), which matches the CI-only reproduction.
</details>
 2026-08-25 11:55:56 +07:00
Jon Ayers 26de6140fb feat: add flag to disable workspace agent context sync (#28522) 2026-08-24 19:58:30 -05:00
dependabot[bot] d014d4c372 chore: bump the coder-modules group across 2 directories with 2 updates (#28523) 
Bumps the coder-modules group with 2 updates in the /dogfood/coder
directory: coder/vscode-web/coder and coder/windsurf/coder.
Bumps the coder-modules group with 2 updates in the
/dogfood/vscode-coder directory: coder/vscode-web/coder and
coder/windsurf/coder.

Updates `coder/vscode-web/coder` from 1.6.1 to 1.6.2

Updates `coder/windsurf/coder` from 1.3.1 to 1.3.2

Updates `coder/vscode-web/coder` from 1.6.1 to 1.6.2

Updates `coder/windsurf/coder` from 1.3.1 to 1.3.2


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-25 00:27:37 +00:00
Kyle Carberry 8cd7f9ad4e fix(agent/agentcontext): preserve skill source precedence (#28443) 
Duplicate workspace skills were sorted by source path before chat
hydration, so alphabetical paths could override the order configured in
`CODER_AGENT_EXP_SKILLS_DIRS`.

Resolve duplicate valid skill names before deterministic sorting and
persistence, with user-declared sources evaluated in configured order
ahead of built-in and working-directory discovery. This PR was generated
by Coder Agents.
 2026-08-24 15:36:49 -07:00
Kyle Carberry cf97b56479 fix(coderd/x/chatd): refresh context after workspace restart (#28441) 
Workspace lifecycle tools clear a chat's agent binding while retaining
its pinned workspace context. When the chat binds to the replacement
agent, the missing previous agent ID caused chatd to skip re-pinning and
continue using stale instructions, skills, and MCP definitions.

Re-pin when an unbound chat still carries pinned context, while
preserving the existing first-time hydration path for new chats without
a pin. Adds regression coverage for the stop/start binding sequence.

### CI note

All required checks pass. The external `Pixel / Review` status reports
the same 3 pre-existing failures on this PR's merge base
(`610f321d52c16d43e73c489aa672ef60a92c20ea`) and recent `main` commits.
This backend-only change does not touch `site/` or Storybook snapshots.

---

Generated by Coder Agents on behalf of @kylecarbs.
 2026-08-24 15:36:32 -07:00
Hank Hwang 2f50b2d740 fix(coderd): reject agent requests from suspended owners (#28513) 
## What

`ExtractWorkspaceAgentAndLatestBuild` computed the workspace owner's
RBAC subject via `UserRBACSubject`, but discarded the returned user
status. As a result, workspace agent requests were still authorized even
when the owner's account was suspended.

This change captures `userStatus` and rejects the request with `401
Unauthorized` when the owner is not `Active`, returning a clear message
directing the user to contact an admin to reactivate the account.

## Changes

- `coderd/httpmw/workspaceagent.go`: stop discarding the owner status
from `UserRBACSubject`; return `401` when the owner is not active.
- `coderd/httpmw/workspaceagent_test.go`: add an `InactiveUser` test
that suspends the owner and asserts a `401` with the expected message.

## Testing

- New `TestWorkspaceAgent/InactiveUser` unit test covers the
suspended-owner path.

---

> This PR was created by Coder Agents on behalf of @hwang251.
 2026-08-24 15:25:21 -07:00
Bobby HoandMcKayla はな c029869a04 fix(coderd): deflake TestHealthSettings dismissal subtests (#28501) 
Fixes
https://linear.app/codercom/issue/PLAT-514/flake-testhealthsettingsdismisssection

Both TestHealthSettings dismissal subtests built their server with
coderdtest.New(t, nil), so GET /api/v2/debug/health ran the real
healthcheck, DERP probe included, only to assert that dismissed sections
come back as dismissed.

- Raising the timeout would not fix it. The healthcheck runs on a
context detached from the request (30s HealthcheckTimeout), and
derphealth's 10s per-node cap is skipped whenever a deadline already
exists, which is always true from that call site. Both subtests share
one 10s WaitShort across setup and four round trips, so the server may
spend 3x the test's entire lifetime on one request.
- Fix: inject a stub HealthcheckFunc in both subtests, as the six
TestDebugHealth subtests already do.
- The stub reports nothing dismissed, so the assertions still prove the
flags are applied per request in formatHealthcheck rather than read from
the cached report, which is what 38ed816207 fixed.
- Endpoint drops from ~55ms to ~2ms, and three real DERP connections per
health call are gone.

Out of scope: all four TestHealthSettings subtests, including the two
that never call /debug/health, still budget server construction from the
same 10s WaitShort. That is a separate exposure from the one PLAT-514
reported.

---------

Co-authored-by: McKayla はな <mckayla@hey.com>
 2026-08-24 12:06:56 -07:00
Michael Suchacz 3c3240836e refactor: consolidate viewport hooks and remove defineProperty matchMedia stub (#28460) 
Follow-up to review feedback on #28387.

That PR added three hooks for one feature (`useIsBelowLgViewport`,
`useIsBelowMdViewport`, and the local single-use
`useRightPanelNarrowSuppression`) and stubbed `window.matchMedia` in
tests with `Object.defineProperty`.

- Replace the two single-purpose viewport hooks with one generic
`useMediaQuery(query)`. Callers pass the shared Tailwind-aligned query
constants from `utils/mobile.ts`. The one new hook replaces the two
deleted ones (net -1).
- Inline `useRightPanelNarrowSuppression` into `AgentChatPage`, its only
consumer, and drop its `renderHook` unit suite. The behavior stays
covered by the narrow-viewport stories; the widening-restore case moved
into the `NarrowingSuppressesExpandedPanel` play function.
- Rework `testHelpers/matchMedia.ts` to install the stub with `spyOn`
from `storybook/test` instead of `Object.defineProperty`. The helper is
story-only now (stories run in real Chromium; jsdom has no
`matchMedia`), so any future unit test needing a stub should use
`vi.stubGlobal` directly.
- Encode the feedback in the canonical FE contract so it gets caught
during development: `.claude/docs/FRONTEND_PATTERNS.md` now bans new
React hooks when an existing hook, a plain function, or component state
suffices (FE3) and bans replacing browser globals with
`Object.defineProperty` in tests or stories (FE9: `vi.stubGlobal` /
`spyOn`), and notes that `renderHook` suites for stateful UI hooks
belong in the consuming component's story (FE1). The `frontend-review`
skill checklist flags all three. `site/AGENTS.md` is unchanged since it
already defers to the patterns doc.

Validation: `pnpm check`, `pnpm format:check`, `pnpm lint` (biome,
types, knip, circular deps, compiler check), `AgentChatPage.test.ts` (70
passed), story runs for `AgentChatPage.stories.tsx` and
`WorkspacePill.stories.tsx` (49 passed in Chromium).

> Xum acted on Mike's behalf (@ibetitsmike).

<!-- xum-attribution: model=claude-opus-4-6 thinking=high -->
 2026-08-24 16:52:54 +00:00
Jake Howell 614b5e2d22 chore(site): remove outdated featured empty-state images (#28454) 
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.

## What

The images in `site/static/featured` were outdated and no longer
resembled the current UI, so this removes them along with the code that
referenced them:

- `workspaces.webp` — was the faded background image in the Workspaces
empty state (`WorkspacesEmpty.tsx`).
- `templates.webp` — was only referenced by a Storybook story
(`TableEmpty.stories.tsx`).
- `scheduling.webp` — had no references anywhere in the codebase.

### Cleanup alongside the removal

- Dropped the `image={defaultImage}` prop (and the now-dead
`defaultImage`) from all three `WorkspacesEmpty` states.
- Removed the `className="pb-0"` / `paddingBottom: 0` overrides that
only existed to seat the image flush against the bottom, restoring
balanced padding.
- Renamed the `TableEmpty` story `WithImageAndCta` → `WithCta` since it
no longer has an image.

## Old | New

| Surface | Old | New |
|---|---|---|
| Workspaces empty state | <img width="2306" height="1376"
alt="main-tableempty"
src="https://github.com/user-attachments/assets/1d3a5201-66ce-4f80-a2ea-5638221f95d0"
/> | <img width="2306" height="1376" alt="pr-tableempty"
src="https://github.com/user-attachments/assets/5a8fcc1d-b676-46e6-be54-12ff7f3489fd"
/> |
| Table empty state (templates) | <img width="2306" height="1376"
alt="main-workspaces-empty"
src="https://github.com/user-attachments/assets/7618ee1f-09d4-4398-8a1c-19362f63c80d"
/> | <img width="2306" height="1376" alt="pr-workspaces-empty"
src="https://github.com/user-attachments/assets/8a9c98a9-24b7-4c90-9959-f85dbc2daa9f"
/> |
| `scheduling.webp` | Unused | Deleted 🙂  |
<details>
<summary>Implementation notes / decision log</summary>

- Verified references with a repo-wide search for `/featured/` and each
`*.webp` filename. Only `WorkspacesEmpty.tsx` (real usage) and
`TableEmpty.stories.tsx` (Storybook-only) referenced them;
`scheduling.webp` was fully unused.
- `EmptyState`'s `image` prop is optional, so removing usages required
no component changes.
- Delete-only (per request): no replacement images committed. The empty
states now render as clean text/CTA layouts.
- "New" screenshots were captured from Storybook (a temporary
`WorkspacesEmpty` story was used only to render the states and was
**not** committed).
- Verified with `tsc --noEmit` (0 errors) and `biome check` (clean) on
the changed files.

</details>
 2026-08-24 23:46:51 +07:00
Ethan eab5e28695 fix: move organization model overrides from Models to Coder Agents settings (#28473) 
## Summary

Relocates the organization-scoped Coder Agents model override controls
from the **Defaults & overrides** tab under **AI Settings > Models**
into an **Organization settings** section on **AI Settings > Coder
Agents**. Models remains the home for reusable model definitions,
provider availability, default designation, and ACLs; Coder Agents now
owns all agent-specific model/reasoning override controls. The backend
organization scoping from #28442 is unchanged.

## Changes

- **Coder Agents page** is split into two sections:
- **Organization settings**: General subagent, Explore subagent, title
generation, compaction, and Advisor (behind the `chat-advisor`
experiment) model/reasoning overrides, with an organization picker when
more than one accessible organization exists.
- **Deployment settings**: personal override policy, virtual desktop
provider (behind its experiment), and Advisor usage limits, visible only
with `editDeploymentConfig`.
- **Permissions**: the page and its sidebar entry are accessible with
either `editDeploymentConfig` or organization chat model access.
Organization mutations require `editChatModelConfigs` on the selected
organization; otherwise controls render read-only. Organization
discovery, selected-organization permissions, and deployment queries
fail independently.
- **Models page** drops the Defaults & overrides tab and the
now-single-item tab UI. The old `DefaultsPage` components move to
`CoderAgentsPage/OrganizationAgentSettings*`.
- **Compatibility**: `/ai/settings/models/defaults` redirects to
`/ai/settings/coder-agents`, preserving `org` and other query
parameters.
- **Docs**: intentionally not updated here; a follow-up PR will update
`docs/ai-coder/agents/models.md` and
`docs/ai-coder/agents/platform-controls/advisor.md`.

## Testing

- Targeted unit tests (`ModelDefaultsRedirect`, `organizationModels`): 9
passing.
- Affected Storybook interaction tests (Coder Agents page/view,
organization agent settings, Models layout, AI settings sidebar): 41
passing.
- `pnpm check`, full `pnpm lint` (Biome, tsc, circular deps, React
compiler, knip), `pnpm format`.
 2026-08-24 17:43:12 +01:00
Jake Howell d12cc2da21 fix(site): measure virtualized log row heights (#28251) 
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.

Fixes coder/coder#25692. Closes coder/coder#25692. Supersedes
coder/coder#28250.

## Problem

`AgentLogs` virtualizes rows with a **fixed** `itemSize` (20px), so
react-window sets the total scroll height to `itemCount * 20`. Log
entries that contain newlines render taller than 20px, so the estimate
falls short: tall rows overlap the rows below them and the true bottom
sits past where `scrollToItem(..., "end")` can reach. The last lines
become unreachable.

## Fix

Switch to `VariableSizeList` and measure each row with a
`ResizeObserver`, feeding the real height back via `resetAfterIndex`.
The total scroll height now tracks the real content, so the bottom is
always reachable. `AgentRow` and `TaskPage` only change the ref type;
their existing autoscroll now lands correctly.

## Before / After

Dogfooded on a local instance with a workspace whose agent logs include
multi-line entries (241 entries, every 30th a 6-line block, plus a final
bottom-marker line). Same workspace, same scroll interaction, `main` vs
this branch:

<!-- linear:table-colwidths:266,266,266 -->
| | Before (`main`, `FixedSizeList`) | After (this PR,
`VariableSizeList`) |
| -- | -- | -- |
| **A multi-line entry** | Painted into a 20px slot, so it collides with
the rows above and below (text on top of text). | Rendered at full
height in its own space, neighbours no longer overlap. |
| | ![Before: multi-line entry overlapping neighbouring
rows](https://raw.githubusercontent.com/jakehwll/coder/devex-407-evidence/evidence/old-multiline.png)
| ![After: multi-line entry at full height, no
overlap](https://raw.githubusercontent.com/jakehwll/coder/devex-407-evidence/evidence/new-multiline.png)
|
| **Scrolled to the bottom** | Total height is short, so normal
scrolling stops early: the final marker line is clipped and unreachable.
| Height tracks real content: the final marker line is fully visible and
reachable. |
| | ![Before: bottom marker clipped and
unreachable](https://raw.githubusercontent.com/jakehwll/coder/devex-407-evidence/evidence/old-bottom.png)
| ![After: bottom marker fully
visible](https://raw.githubusercontent.com/jakehwll/coder/devex-407-evidence/evidence/new-bottom.png)
|

## Validation

The new `AgentLogs.test.tsx` renders rows measured taller (40px) than
the estimate and asserts the scroll area is sized from measured heights.
Run against the `main` implementation it fails, against this branch it
passes:

```
# main (FixedSizeList): scroll area = 5 rows * 20px
- Expected  200
+ Received  100      → FAIL

# this branch (VariableSizeList): scroll area = 5 rows * measured 40px
✓ AgentLogs.test.tsx (1 test)   → PASS
```

Also green: `tsc`, `biome check`, and the AgentRow (25) + TaskPage (46)
+ AgentLogs (3) Storybook interaction tests.

<details><summary>Dogfood details and decision log</summary>

**Dogfood setup** (SHA `1228dcfe8d`, `./scripts/develop.sh`): template
`lognl2` (a `coder_agent` on a `null_resource` so the agent
authenticates against a real build), workspace `lognl-demo2`. Posted 241
log entries via `PATCH /api/v2/workspaceagents/me/logs`, every 30th a
6-line `\n` entry plus a bottom marker; confirmed the 8 multi-line
entries persisted with embedded newlines. On the fixed build, at maximum
scroll the DevTools console reported `scrollTop 5204`, `scrollHeight
5460`, `clientHeight 256`, `remaining 0`, marker clipped `0px`; height
is self-consistent (`innerHeight 5428` + 16px top + 16px bottom padding
= `5460`).

**Decision log**

* coder/coder#28250 treated this as an autoscroll problem. Wrong: the
height calculation is the bug, so no scroll target can reach a bottom
placed out of range. Reverted.
* Only embedded newlines make a row exceed 20px; long lines do not wrap
(they overflow horizontally). A fixed constant can't cover a variable
line count, so measuring is the robust fix.
* `resetAfterIndex` can't run from a row's first-mount measurement
effect because the list ref is assigned after child rows commit; the
lowest changed index is recorded and flushed from a parent layout
effect.

</details>

Evidence images are hosted on the `devex-407-evidence` branch of the
author's fork (`jakehwll/coder`) to keep this repo's diff clean.
 2026-08-24 23:25:57 +07:00
Jake Howell 18b37e64f5 chore(site/e2e): re-enable externalAuth suite (#26648) 
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.

Stack:
1. #26575 `fix(site/e2e): close mock external-auth servers in teardown`
2. #26793 `fix(site/e2e): accept 404 from external auth reset hook`
3. #26795 `fix(site/src): refresh provider state after device-flow
exchange`
4. #26798 `fix(site/e2e): reset both providers in external auth hook`
5. #26648 `chore(site/e2e): re-enable externalAuth suite` ← this PR

Removes the `test.describe.skip` introduced in #17235 so the
externalAuth suite runs in CI again.

Splitting the five commits keeps the bisection signal clean if CI
behaviour changes after the un-skip.

Local verification of the full stack: `pnpm playwright:test
e2e/tests/externalAuth.spec.ts --repeat-each=20 --workers=1` → 61/61
passing in 4m48s.

Large whitespace churn in the diff is biome reformatting the body to its
natural indentation after the single-line `test.describe(...)` opener.
The only semantic change is removing `.skip`.

Refs https://linear.app/codercom/issue/DEVEX-413
Refs https://github.com/coder/internal/issues/356
 2026-08-24 23:24:13 +07:00
Jake Howell cfc66b5de3 fix: reset both providers in external auth hook (#26798) 
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.

Stack:
1. #26575 `fix(site/e2e): close mock external-auth servers in teardown`
2. #26793 `fix(site/e2e): accept 404 from external auth reset hook`
3. #26795 `fix(site/src): refresh provider state after device-flow
exchange`
4. #26798 `fix(site/e2e): reset both providers in external auth hook` ←
this PR
5. #26648 `chore(site/e2e): re-enable externalAuth suite`

Surfaced by stress-testing the leaf state of the stack locally with
`--repeat-each=N`. The suite passes on iter 1, then deterministically
fails the device test on every subsequent iteration:

| iter | device | web | workspace |
|---|---|---|---|
| 1 | ✓ 2.8s | ✓ 2.5s | ✓ 6.2s |
| 2 | **✘ 30.1s** | ✓ 2.6s | ✓ 6.2s |
| 3 | **✘ 30.1s** | ✓ ~2.5s | ✓ ~6s |
| … | … | … | … |

`resetExternalAuthKey` in `site/e2e/hooks.ts` only deletes the link for
`gitAuth.webProvider`, never `gitAuth.deviceProvider`. So:

```ts
path: `/api/v2/external-auth/${gitAuth.webProvider}?coder_session_token=${sessionCookie?.value}`,
```

Iter 1 of the device test creates a link for the `device` provider
against the test user. The cleanup hook between tests resets `web` but
not `device`. On iter 2 the page hits `/external-auth/device`,
`externalAuthProviderQuery.data.authenticated` is already `true`, the
page renders the authorized state immediately, and the test's
`sentPending.wait()` hangs forever because the mock token endpoint is
never polled. The whole test times out at 30s.

Fix: reset every provider the suite exercises. Refactored the per-link
delete into a Promise-returning helper so errors actually propagate; the
previous `throw` inside the response and `error` callbacks crashed the
worker rather than rejecting the call.

Doesn't affect CI (single run per PR, fresh `--ephemeral` coderd), but
it makes the suite robust to local stress testing and to anyone
re-running it in the same coderd process. Filed before the un-skip lands
so the un-skipped suite is repeatable from day one.

Local verification: `pnpm playwright:test e2e/tests/externalAuth.spec.ts
--repeat-each=20 --workers=1` → 61/61 passing in 4m48s. Same command
before this fix → 1 pass, then deterministic device-test timeouts.

Refs https://linear.app/codercom/issue/DEVEX-413

<details>
<summary>Why a separate PR</summary>

This is the fourth distinct root cause that piled up while the suite was
skipped, and it's orthogonal to the other three. #26575 fixes the
listener leak, #26793 fixes the 404 hook contract drift, #26795 fixes
the dropped invalidation, and this PR fixes the per-test cleanup so the
suite is actually repeatable. #26648 then just flips `.skip`.

</details>
 2026-08-24 23:12:52 +07:00
Michael Suchacz b6d7653231 fix: apply MCP server selection when editing a chat message (#28471) 
## Problem

Editing a user message in an Agent chat silently dropped the MCP server
selection. The composer renders the MCP picker in edit mode and toggles
update local client state, so the picker displayed the new selection,
but the edit request omitted `mcp_server_ids` at every layer (frontend
request builder, `codersdk.EditChatMessageRequest`, the `PATCH
/chats/{chat}/messages/{message}` handler, and `chatd.EditMessage`). The
chat's persisted selection never changed and the regenerated turn ran
without the newly enabled MCP tools. Two dogfood users hit this within
hours; there is no error anywhere and the UI shows the opposite of the
server state.

## Changes

- `codersdk`: add `MCPServerIDs *[]uuid.UUID` to
`EditChatMessageRequest`, mirroring `CreateChatMessageRequest` (nil
preserves the current selection).
- `chatd`: extract the send path's MCP update block into one shared
`applyRequestedMCPServerIDs` helper (explore-subagent snapshot
immutability guard plus Force On enforcement, Cure53 CDM-02-010) and
call it from both `SendMessage` and `EditMessage`, so enforcement cannot
drift between the two paths.
- `coderd`: extract the send handler's request validation (dedupe,
enabled-in-organization check, persisted-ID exemption) into
`normalizeRequestedChatMCPServerIDs` and wire it into the edit handler,
which now threads the selection into `EditMessageOptions`.
- Frontend: the edit request now includes `mcp_server_ids:
[...effectiveMCPServerIds]`, exactly like the send path, making the
picker's displayed state real.
- `make gen` artifacts (swagger, API docs, `typesGenerated.ts`).

## Tests

Each layer is covered and was proven with independent red toggles
(removing one layer's wiring fails only that layer's tests):

- chatd (`TestEditMessage_MCPServerIDs`): edit applies a provided
selection, nil preserves it, an emptied list cannot remove a `force_on`
server, and explore subagent chats keep the spawn-time snapshot.
- API (`TestPatchChatMessage/MCPServerIDsApplied`,
`MCPServerIDsInvalidRejected`): persistence via the endpoint, omission
preserves, unknown IDs get the same 400 as the send path.
- Storybook (`EditAppliesMCPServerSelection`): toggling a server on
during an edit puts it in the edit request payload.

Note: the `AgentChatPage.stories.tsx` story "Queued For Capacity After
Polling" fails locally on current main as well (verified against the
main baseline with this branch's changes reverted); it is unrelated to
this diff.

Remote dogfood UAT ran on the exact head and passed, including proof
that the regenerated turn actually gains the newly enabled MCP server's
tools.

> 🤖 Xum acted on Mike's (@ibetitsmike) behalf. • Model:
`anthropic:claude-fable-5`
<!-- xum-attribution: model=anthropic:claude-fable-5 -->
 2026-08-24 17:39:52 +02:00
Michael Suchacz a48aedd924 fix(coderd/x): surface Gemini malformed-function-call stream deaths as retryable errors (#28470) 
## Problem

When Gemini's OpenAI-compatible endpoint rejects a model-generated
function call server-side, it ends the SSE stream cleanly with the
nonstandard finish reason `function_call_filter:
MALFORMED_FUNCTION_CALL` after streaming only thought summaries; the
rejected call never reaches the wire. chatd treated this as a normal
completion: fantasy maps the unrecognized finish reason to `unknown`,
the reasoning block never closes (the only non-thought delta is the
`</thought>` marker, which the transport seam strips to an empty string,
and the openaicompat hook only ends reasoning on a non-empty content
delta), so the step accumulates no content and the generation loop
finishes the turn as complete. The user sees the model think for ~40
seconds and then nothing: no assistant message, no `last_error`, chat
status `waiting`. Observed twice in a row in production on
gemini-3.7-flash, with "Resume" reproducing it identically.

## Fix

Two independent layers:

- `coderd/x/googleopenai`: the stream rewrite now converts any chunk
whose `finish_reason` starts with `function_call_filter` into an
OpenAI-style SSE `{"error": ...}` event embedding the raw reason.
openai-go turns error-bearing events into stream errors, so the failure
rides the existing stream-error path instead of ending the stream
cleanly.
- `coderd/x/chatd/chaterror`: classifies that injected error as
retryable (kind `generic`, provider `google`) with a clear user-facing
message, so the existing generation retry machinery re-runs the step and
persists a `last_error` if retries exhaust.
- `coderd/x/chatd/chatloop`: provider-agnostic guard: a step that
produced no user-visible content and no tool calls under a finish reason
of `unknown`, `error`, `other`, or `tool-calls` (a tool-calls finish
that delivered zero calls) now returns a retryable error instead of
silently completing the turn. `stop` and `length` finishes keep their
existing semantics.

Tests cover the seam rewrite (live-capture SSE shape plus standard
finish reason passthrough), the new classification, and the chatloop
guard (error cases plus preserved stop, length, text, and tool-call
behavior). Each layer was red-green verified independently.

Remote dogfood UAT ran against this exact commit: normal reasoning and
tool-call chats on a real model complete cleanly with no spurious guard
errors and no retry loops. The Google-side failure itself is not
deterministically triggerable against live Gemini and is owned by the
unit tests.

> Xum acted on Mike's (@ibetitsmike) behalf.

<!-- xum-attribution: model=claude-opus, thinking=enabled -->
 2026-08-24 17:09:00 +02:00
J. Scott Miller 76962273d8 feat: add coder organizations edit for default member roles (#28227) 
`default_org_member_roles` was only settable through Terraform or a raw
`PATCH /api/v2/organizations/{organization}`. This adds a CLI
equivalent.

```console
coder organizations edit --org acme --default-org-member-roles organization-workspace-access,organization-template-admin
coder organizations edit --org acme --default-org-member-roles ""   # grant no roles
```

- The flag replaces the organization's current list rather than adding
to it. It accepts a comma-separated list, may be repeated, and
de-duplicates. An empty value removes every role.
- Removing a role prompts for confirmation, listing the roles being
removed, unless `-y` is passed. Adding roles applies without a prompt.
- The resulting set is printed, so no follow-up command is needed to
confirm what was applied.
- The organization is chosen with `-O/--org` or `$CODER_ORGANIZATION`,
and is implicit when the caller belongs to exactly one organization.

The org update endpoint is behind `FeatureMultipleOrganizations`, so the
command is enterprise/premium only. Non-built-in roles are rejected by
the server, and `dbauthz` already prevents a caller from setting a
default they could not assign to a member individually.

<details>
<summary>Implementation notes</summary>

## Shape

`codersdk.UpdateOrganizationRequest.DefaultOrgMemberRoles *[]string` and
the enterprise `patchOrganization` handler already existed; only the CLI
was missing, and nothing in `cli/` called `UpdateOrganization` at all.
No server or SDK changes are needed.

`organizations edit` follows the partial-update pattern of `coder groups
edit`: check `ParsedFlags().Changed(...)`, populate only the fields the
user set, and leave the rest nil so the handler preserves them. Passing
no flags is an error.

Two earlier shapes were tried and dropped:

- **A `default-org-member-roles` entry in the `organizations settings`
registry.** Every sibling entry unmarshals an SDK type that maps 1:1 to
a dedicated endpoint; this field has no such endpoint. Reusing
`UpdateOrganizationRequest` for the piped JSON meant a stray `name`
field could rename the org, and the documented `show > file`, edit, `set
< file` workflow failed on the default organization, whose name is
reserved.
- **A `--default-org-member-roles` flag on `organizations create`.**
`create` cannot set display name, description, or icon either, so a
roles-only flag there is asymmetric. It would also require
`CreateOrganizationRequest` to grow the field plus server-side
validation.

## Known sharp edge

`serpent.StringArray` resets its slice when any flag value is empty, so
`--default-org-member-roles a --default-org-member-roles ""` clears the
list rather than keeping `a`. This is pinned by a test and called out in
a code comment. The confirmation prompt catches it interactively; a
script passing `-y` would not. A custom flag value that ignores empty
occurrences was prototyped and reverted as more machinery than the
behavior warranted.

## Validation

Manually verified against a local dev deployment with a premium license:
setting, adding, clearing, prompt accepted and declined, duplicate and
whitespace handling, invalid role rejection, and a plain member being
denied. Confirmed with `/authcheck` that a member loses workspace-create
access when the roles are cleared and regains it when restored, and that
the change is recorded in the audit log.

## Follow-ups worth considering

- `--name`, `--display-name`, `--description`, and `--icon` on
`organizations edit`; all already exist on `UpdateOrganizationRequest`.
Rename deserves its own discussion.
- Setting the defaults to `organization-admin` makes every member an org
admin, including the ability to edit the org further, and those users
still render as plain members in member listings. Reachable today via
the API, UI, and Terraform; a warning on privileged roles would help.
- `dbauthz.InsertOrganization` has no `canAssignRoles` check, unlike
`UpdateOrganization`. Harmless while the only caller passes the
deployment default constant.
- `docs/admin/users/organizations.md` still points users at the
dashboard or a raw `PATCH`.
</details>

---

Created by Coder Agents on behalf of @jscottmiller.
 2026-08-24 09:41:21 -05:00
Spike Curtis 6a58d50f1d feat(coderd): add queue-position-free provisioner job query (#28367) 
Follow-up to #28302 ([GRU-82](https://linear.app/codercom/issue/GRU-82), [RFC](https://app.notion.com/p/coderhq/Lite-Workspace-API-Requests-3aad579be5928060b5e7cc65c539717f)). That PR added related-data selection but noted that selecting `latest_build.job` still ran the expensive `GetProvisionerJobsByIDsWithQueuePosition` query, which computes queue position and size with window functions over pending jobs and provisioner daemons and is consistently the top resource consumer in scale tests.

This PR adds a cheaper `GetProvisionerJobsByIDs` query that fetches jobs by ID without the queue-position computation, and selects between the two based on whether `latest_build.job.queue_position` is requested. When the queue position is not selected, `QueuePosition` and `QueueSize` are left zero and the rest of the response is unchanged.

Both paths go through a single `provisionerJobsByIDs` API method that takes the `jobRelated` selection, switches on it, and reshapes the cheaper query's rows into `GetProvisionerJobsByIDsWithQueuePositionRow` so downstream conversion is uniform.

The new query has the same dbauthz properties as the queue-position variant (system-level pass-through pending the proper provisioner-job RBAC check tracked in #16160), with a matching authorization test.

No behavior change for existing callers: they select `queue_position` (via `allLatestBuildRelated`), so they continue to use the queue-position query.


---

*Generated by Coder Agents on behalf of @spikecurtis.*
 2026-08-24 16:17:55 +02:00