Migrate chat endpoint response decoding to `ReadBodyAsJSON` and
consolidate `ReadBodyAsError` construction through `newResponseError`,
so empty-body and non-JSON errors consistently include the request
method and URL.
Stacked on #27857, with the lint rule following in #27859. Refs #27044.
Reviewed and updated by Coder Agents on behalf of @dylanhuff-at-coder.
This PR migrates 224 typed JSON response sites across 46 files to
`codersdk.ReadBodyAsJSON`, so invalid 2xx bodies return structured
errors while preserving URL credential redaction.
It intentionally excludes agent-direct HTTP, Azure IMDS, `UseNumber`,
and chat paths; stacked on coder/coder#27804, with chat and lint
follow-ups in coder/coder#27858 and coder/coder#27859. Refs
coder/coder#27044.
Reviewed and updated by Coder Agents on behalf of @dylanhuff-at-coder.
`coder whoami` and `coder list` can surface low-level JSON decode errors
when a reverse proxy, SSO portal, or incorrect Coder URL returns HTML
with a successful HTTP status.
Add a shared SDK JSON response decoder and use it for the user and
workspace list endpoints so these commands return a structured,
actionable API response error instead. Refs #27044
Reviewed and updated by Coder Agents on behalf of @dylanhuff-at-coder.
The environment-variable and secret-injection tests reused one
long-lived SSH shell, so a closed channel caused later checks to fail
with `EOF` and could allow scan-based assertions to pass without finding
a value. They now share only the SSH client and use a fresh,
deadline-bound session for each variable, isolating failures while
preserving environment-precedence coverage.
Closes https://linear.app/codercom/issue/PLAT-310.
Reviewed and updated by Coder Agents on behalf of @dylanhuff-at-coder.
Two gaps in the user secrets guide, both independent of any pending
secrets work.
## Changes
**Target uniqueness (`Update a secret`, `File secrets`).** The guide
teaches `coder secret update api-key --file ""` but never states that
env names and file paths are unique per user, so the conflict you get
when setting a target back has no explanation in the docs. The `File
secrets` paragraph also read as though duplicate file paths are
tolerated with a warning; an identical path is rejected outright, while
two *different* paths resolving to the same location are both accepted
and produce the agent warning. Both indexes are partial (`WHERE env_name
!= ''` / `WHERE file_path != ''`), so a cleared target really is
released for another secret to claim — now stated.
**Delivery boundary (`How your secrets reach a workspace`).** Coder
controls where a secret is delivered, not whether it is still valid.
Nothing done in Coder revokes a credential a workspace already received,
so an exposed credential is rotated at its source. This applies to
deletion as much as to clearing a target.
No new headings, no changes to the existing tables or callouts.
> This PR was generated by Coder Agents on behalf of
@dylanhuff-at-coder.
---------
Co-authored-by: Nick Vigilante <nickvigilante@users.noreply.github.com>
Adds a file dropzone to the create branch of the Add secret dialog
(final PR in the PLAT-240 stack, after #26723 and #26724). The browser
reads the file, derives the format from the extension
(`.env`/`.json`/`.yaml`/`.yml`), and imports via `POST /secrets/batch`;
per-entry backend errors surface in an alert and the success toast flags
secrets imported without an env name. Storybook play stories and vitests
cover the flow.
Also documents the upload flow in `docs/user-guides/user-secrets.md`.
Closes https://linear.app/codercom/issue/PLAT-240
> Reviewed and updated by Coder Agents on behalf of @dylanhuff-at-coder.
Adds `coder secret import <file>` to bulk-import dotenv, JSON, or YAML
secrets through the existing batch API. The command infers the format
from the extension or accepts `--input-format`, supports non-interactive
stdin, validates files locally before upload, and warns when imported
keys cannot be injected as environment variables.
Reviewed and updated by Coder Agents on behalf of @dylanhuff-at-coder.
Adds `POST /api/v2/users/{user}/secrets/batch` and
`codersdk.Client.ImportUserSecrets` to import env, JSON, or YAML secrets
atomically. The endpoint validates each entry, rolls back the full batch
on conflicts or limits, omits secret values from responses and audit
logs, and imports keys that cannot be injected as environment variables
with an empty `env_name`.
Part of the [PLAT-240 bulk secret import
stack](https://linear.app/codercom/issue/PLAT-240). Reviewed and updated
by Coder Agents on behalf of @dylanhuff-at-coder.
Part of the **PLAT-240** bulk secret import stack: this PR adds the
`codersdk` parser and shared create-secret validator used by the
follow-up batch endpoint and UI PRs.
`ParseSecretsFile` parses `.env`, `.json`, and `.yaml` files into
`CreateUserSecretRequest` entries in source order, with size, count,
duplicate-key, structure, and malformed-input checks.
`ValidateCreateUserSecretRequest` now backs the single-create handler
too, so create validation has one SDK-level implementation.
Part of https://linear.app/codercom/issue/PLAT-240
> This PR was generated by Coder Agents on behalf of
@dylanhuff-at-coder.
Tasks created through the API now enforce required external auth:
`tasksCreate` rejects an owner who is missing a required (non-optional)
provider with a 403 before generating a task name or inserting any rows,
matching the gate `createWorkspace` already applies to workspaces. Adds
`TestCreateTaskExternalAuth` covering the required and optional-provider
cases.
Fixes PLAT-298.
_Coder Agents generated._
Required external auth (`optional = false`) was only enforced by
client-side preflight checks, so creating a workspace via the REST API
succeeded even when the owner had never authenticated, producing a
broken workspace.
`createWorkspace` now validates the workspace owner's external auth
server-side and returns 403 before any row is inserted or prebuild is
claimed. The owner (not the initiator) is checked because build-time
token injection uses their links, so this also covers admin-on-behalf-of
creates and prebuild claims. Use `optional = true` to allow
pre-provisioning for unauthenticated users.
Fixes PLAT-241.
> This PR was generated by Coder Agents on behalf of
@dylanhuff-at-coder.
Fixes a race where concurrent notification dispatch goroutines could
overwrite `coderd_notifications_pending_updates` with an older
buffer-length snapshot. Pending update snapshots now serialize count
evaluation with the gauge write, and inhibited dispatch results refresh
the metric when buffered.
Adds the account settings UI for managing user secrets, including the
table, add/edit/delete dialog, Storybook coverage, and route/sidebar
entry.
Also updates the shared `FeatureStageBadge` beta variant with
dedicated beta styling, sizing, and label casing for the Secrets
page.
Stacked on #25370.
_This PR was generated by Coder Agents._
Add frontend API methods, mocks, and form helpers for user secrets CRUD. The new client methods cover list, get, create, update, and delete requests, including URL encoding for secret names used in route paths.
Add user secret form utilities for create and update payload construction, required create field checks, and structured API validation error mapping back to form fields. User secret name validation now lives in codersdk with tests, and coderd returns field-level validation errors for create, update, and uniqueness conflicts so the frontend can show backend-owned validation results consistently.
Adds structured `secret_requirements` to dynamic parameter responses and
enforces missing required secrets during workspace start.
Stop, delete, and tag rendering paths skip secret requirement
enforcement so unmet secrets do not prevent cleanup. The SDK, generated
API docs/types, and backend render/resolver/wsbuilder tests are updated
for the new contract.
Adds a coder secret command group for managing user secrets from the
CLI, with create, update, list, and delete subcommands backed by the
existing user secret API.
This branch adds CLI test coverage and refreshes the generated help
output and CLI reference docs for the new command group.
Workspace agent logs could still fail after the earlier invalid UTF-8
fix because NUL bytes are valid Go/protobuf strings but are rejected by
Postgres text columns. The legacy HTTP log upload path also bypassed the
old sanitization entirely, and both server insert paths computed
logs_length from the unsanitized input.
Add a shared log-output sanitizer in agentsdk, use it in the protobuf
conversion path and both server-side insert paths, and compute
OutputLength from the sanitized string so overflow accounting matches
what is actually stored. This keeps the old invalid UTF-8 behavior while
also handling embedded NUL bytes consistently across DRPC and HTTP log
ingestion.
Refs [#23292 ](https://github.com/coder/coder/issues/23292)
Refs [#13433 ](https://github.com/coder/coder/issues/13433)
`isContextLimitKey` had a fallback heuristic that matched any key starting with `"max"` containing `"context"`, causing false positives on keys like `"max_context_version"`. A provider returning such metadata would have the value parsed as a context limit.
Replace substring matching on the separator-stripped key with word-level matching. A new `metadataKeyWords` function tokenizes keys by splitting on separators and camelCase boundaries, then the fallback requires
`"context"` paired with a limit-related word (`"limit"`, `"window"` + qualifier, `"length"` + qualifier, or `"tokens"` + qualifier). Known exact forms like `"context_window"` remain in the fast-path switch.
Closes https://github.com/coder/coder/issues/23332
dylanhuff-at-coder