opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-22 13:10:21 +08:00
Code Issues Packages Projects Releases Wiki Activity
15,683 Commits 479 Branches 387 Tags
632eecc09030e4eaff11481a71ea99fc71fe934f
Commit Graph
15683 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Danielle Maywood 632eecc090 feat(site/src): reintroduce chat search cache invalidation (#27892) 
Stacked on `feat/chat-cache-semantic-ops`.

## Bug

Chat search results (`chatSearch` queries) were never invalidated, so
the search dialog served stale results after archives, renames,
deletions, new chats, message edits, and watch-driven status changes.

## Fix

Reintroduces `invalidateChatSearches`, a prefix invalidation over the
module-private `chatSearchFamilyKey`, and wires it into:

- `chats.ts`: `archiveChat.onSettled`, `unarchiveChat.onSettled`,
`updateChatTitle.onSettled`, `editChatMessage.onSettled`,
`createChat.onSuccess`
- `useChatStore.ts`: `upsertCacheMessages` (unconditional; assistant
message bodies are indexed too) and `replaceCacheMessages`
- `AgentsPageLayout.tsx`: the `deleted` and root `created` watch
branches, the merge watch branch (gated by a new exported
`shouldInvalidateChatSearches` helper), the `has_unread` clearing
effect, the `onOpen` reconnect convergence, and
`archiveAndDeleteMutation.onSuccess`

The merge-branch gate only invalidates for search-affecting event kinds
(`title_change`, `status_change`, `diff_status_change`,
`action_required`). `summary_change`, `chat_summary_change`, and
`context_dirty` are excluded: stale `last_turn_summary` subtitles are
accepted until reconciliation lands.

## Backend constraint

Message bodies only enter full-text search via the dbpurge backfill
(`search_tsv` starts NULL and is populated every 10 minutes). Frontend
invalidation fixes removals, ordering, and rendered fields immediately,
but a chat that newly matches on message body will not appear until the
next backfill. This is a server-side eventual-consistency limit we
accept.

## Scope decisions (confirmed)

- No invalidation in `createChatMessage.onSuccess`: the send path
already routes through `useChatStore.upsertCacheMessages`; adding both
would double-invalidate every send.
- No invalidation for `pinChat`/`unpinChat`/`reorderPinnedChat`
(ordering-only, self-heals).
- ACL mutations out of scope.
- No coalescing/debouncing; that belongs to a later reconciler PR.

## Tests

- Prefix invalidation: multiple distinct `q` params invalidated,
bystanders (list, by-workspace, entity, messages, cost tree) untouched.
- Mutation wiring: settlement of `archiveChat`, `unarchiveChat`,
`updateChatTitle`, `editChatMessage`, and `createChat` invalidates a
seeded search key; `createChatMessage` asserted NOT to.
- `shouldInvalidateChatSearches` unit-tested over all
`ChatWatchEventKind` values.

PR generated by Coder Agents.
 2026-08-06 10:25:36 +01:00
Jaayden HalkoClaude Fable 5Hugo Dutka
 		4b7494be72 feat: harden chat generation runtime instrumentation for billing (#27451) 
Closes CODAGT-835

## Summary

`chat_messages.runtime_ms` becomes the billing source of truth for Coder
Agents runtime (summed hourly by #27312), but it was built for
debugging: the June refactor (#26270) silently stopped recording
tool-step runtime, compaction was never measured, and interrupted turns
lost their partial runtime entirely. This PR defines the billable
metric, closes the paths that dropped it, and documents the definition
where the data lives.

## The billable definition

**`runtime_ms` is the wall-clock duration of the model invocation that
produced the persisted message content**, measured from just before the
provider stream opens until it is fully consumed.

What counts:

- Assistant generation steps, in top-level and sub-agent chats
(sub-agents are ordinary chats on the same generation path).
- Compaction summarization calls, persisted on the compaction assistant
message (**new**).
- Interrupted attempts: the message-part episode's lifetime is persisted
on the partial assistant message committed by `FinishInterruption`, so
partial generation time survives interruption (**new**; measured via a
new `Buffer.EpisodeDuration`, which works even though the generation
goroutine and the interrupt task are different tasks).

What deliberately does not count (each is documented in code and docs):

- **Local tool execution.** Tool wall time includes idle waits, most
importantly `wait_agent` polling a sub-agent chat that already bills its
own model invocations; billing the batch would double count, and
excluding one tool from a concurrent batch's wall time is ill-defined.
Pre-refactor instrumentation did include tool time; this makes the
exclusion an explicit product definition instead of a silent regression.
- **Failed model calls whose output is discarded** (retried attempts,
terminal errors, content-filter refusals). They persist no content, so
they bill nothing; billing errs toward undercounting. Notably a
stream-silence timeout can burn 10 idle minutes before a retry, which
should not be billable "active generation". If product later wants
failed attempts billed, that needs a place to persist runtime on error
turns (`FinishError` inserts no rows today) and is a deliberate
follow-up, not instrumentation drift.
- **Ancillary calls that produce no chat messages** (title generation,
advisor, turn summaries) and all idle/parked time (`requires_action`,
queueing).

The definition is documented as `COMMENT ON COLUMN
chat_messages.runtime_ms` (migration 000551, surfacing as a Go doc
comment on `ChatMessage.RuntimeMs`), on
`chatloop.PersistedStep.Runtime`, in the chatd architecture doc, and in
the Spend Management docs page.

## Index for the hourly scan

None needed: `GetTotalChatMessageRuntimeMsInRange` (#27312) filters an
hour-wide `created_at` range, which the existing
`idx_chat_messages_created_at` b-tree already serves; the residual
`runtime_ms IS NOT NULL` filter applies to one hour of rows. A partial
index would add permanent write amplification for a query that runs once
an hour.

> [!NOTE]
> Migration 000551 is also claimed by #27312; whichever merges second
renumbers via `fix_migration_numbers.sh`.

## Tests

- End-to-end: the existing full-server generation test now asserts
`RuntimeMs.Valid` on the committed assistant row (it previously read
`.Int64` without checking `.Valid`, so it passed on NULL).
- Interrupted turn: full task-level test (real DB, mock clock) asserting
the partial assistant message persists the attempt's runtime.
- Errored stream: asserts a failed invocation yields no step and no
runtime.
- Tool-using turn: asserts runtime lands on the assistant row only and
tool rows stay NULL.
- Compaction: asserts the summarization call duration is recorded and
lands on the compaction assistant message only.
- `messagepartbuffer.EpisodeDuration` unit coverage.

Blocks: CODAGT-843 (B3), CODAGT-838 (D8).

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Hugo Dutka <hugo@coder.com>
 2026-08-06 16:09:38 +07:00
Danielle Maywood f96671d588 refactor(site/src): centralize chat cache operations in semantic cache functions (#27869) 2026-08-06 08:29:10 +01:00
Jake Howell 3e0b943333 docs: note bulk stop confirmation (#27908) 
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.

## What

Restores the docs change that was reverted out of #27631. The bulk
**Stop** action now shows a confirmation dialog (shipped in #27631), so
the workspace management docs should reflect that stop, alongside update
and delete, prompts for confirmation.

## How

Updates the Bulk operations section of
`docs/user-guides/workspace-management.md` to note that stop is now
included in the actions that prompt for confirmation before running.

<details>
<summary>Reverted change being restored</summary>

Before:

> For update and delete, the user will be prompted for confirmation
before any action is taken.

After:

> For update, delete, and stop, the user is prompted for confirmation
before any action is taken.

This content was originally added in #27631 (commit `e6a0aff`) and
reverted in commit `2378960` before merge.

</details>
 2026-08-06 16:40:18 +10:00
dependabot[bot] abd330702b chore: bump the vite group across 1 directory with 4 updates (#27735) 
Bumps the vite group with 4 updates in the /site directory:
[@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react),
[vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite),
[vite-plugin-checker](https://github.com/fi3ework/vite-plugin-checker)
and
[vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest).

Updates `@vitejs/plugin-react` from 6.0.1 to 6.0.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite-plugin-react/releases">@​vitejs/plugin-react's
releases</a>.</em></p>
<blockquote>
<h2>plugin-react@6.0.4</h2>
<h3>Fixed <code>$RefreshSig$ is not defined</code> error when running
<code>vite dev</code> with <code>NODE_ENV=production</code></h3>
<p>When running <code>vite dev</code> with
<code>NODE_ENV=production</code>, the app errored with
<code>$RefreshSig$ is not defined</code>.
This error is now fixed.</p>
<h2>plugin-react@6.0.3</h2>
<p>No release notes provided.</p>
<h2>plugin-react@6.0.2</h2>
<h3>Allow all options in reactCompilerPreset (<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1189">#1189</a>)</h3>
<p>This is a type only change. Only <code>compilationMode</code> and
<code>target</code> options were available for
<code>reactCompilerPreset</code>.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md">@​vitejs/plugin-react's
changelog</a>.</em></p>
<blockquote>
<h2>6.0.4 (2026-07-22)</h2>
<h3>Fixed <code>$RefreshSig$ is not defined</code> error when running
<code>vite dev</code> with <code>NODE_ENV=production</code></h3>
<p>When running <code>vite dev</code> with
<code>NODE_ENV=production</code>, the app errored with
<code>$RefreshSig$ is not defined</code>.
This error is now fixed.</p>
<h2>6.0.3 (2026-06-23)</h2>
<h3>Improve the react compiler preset filter to reduce false-positives
(<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1138">#1138</a>)</h3>
<p>Improved the filter in the react compiler babel preset to reduce the
false-positives so that less modules are processed by the react
compiler.</p>
<h2>6.0.2 (2026-05-14)</h2>
<h3>Allow all options in reactCompilerPreset (<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1189">#1189</a>)</h3>
<p>This is a type only change. Only <code>compilationMode</code> and
<code>target</code> options were available for
<code>reactCompilerPreset</code>.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitejs/vite-plugin-react/commit/f4b549822ec239799d746c030abb0b9a7d8f0a04"><code>f4b5498</code></a>
release: plugin-react@6.0.4</li>
<li><a
href="https://github.com/vitejs/vite-plugin-react/commit/7a4065906e07e616aee23c4fcc76a76b74a7d694"><code>7a40659</code></a>
fix(react): <code>$RefreshSig$ is not defined</code> with
NODE_ENV=production vite dev ...</li>
<li><a
href="https://github.com/vitejs/vite-plugin-react/commit/98b32d47a3f2517d52e8a51d8e28ff2ed13678a2"><code>98b32d4</code></a>
fix(deps): update react 19.2.8 (<a
href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1298">#1298</a>)</li>
<li><a
href="https://github.com/vitejs/vite-plugin-react/commit/8ae5449be23079dd17fdefc64064a3d94be6fc39"><code>8ae5449</code></a>
fix: babel-plugin-react-compiler cannot be imported when used in a
framework ...</li>
<li><a
href="https://github.com/vitejs/vite-plugin-react/commit/f09ea01b0b66a4900c3e42cef2aa0147e78b097c"><code>f09ea01</code></a>
fix(deps): update all non-major dependencies (<a
href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1282">#1282</a>)</li>
<li><a
href="https://github.com/vitejs/vite-plugin-react/commit/640fd358a0e82393acfce4e92e19a6ac6e1641a7"><code>640fd35</code></a>
release: plugin-react@6.0.3</li>
<li><a
href="https://github.com/vitejs/vite-plugin-react/commit/889efb02cdc4ec978a5e177a37e0213cfded38a4"><code>889efb0</code></a>
fix(deps): update all non-major dependencies (<a
href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1249">#1249</a>)</li>
<li><a
href="https://github.com/vitejs/vite-plugin-react/commit/6c57dd4c5d71075b48039df2532804e72880da21"><code>6c57dd4</code></a>
fix(plugin-react): use '/' base in bundledDev preamble to fix non-root
base p...</li>
<li><a
href="https://github.com/vitejs/vite-plugin-react/commit/3cc33a703636b558a1c1c99e787ddc6bd64aab2d"><code>3cc33a7</code></a>
fix(deps): update react-related dependencies (<a
href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1245">#1245</a>)</li>
<li><a
href="https://github.com/vitejs/vite-plugin-react/commit/c0f7c7ff709dc9d88bc1f29f1b27c1b3e2bfcfca"><code>c0f7c7f</code></a>
docs: mention the Biome rule in the &quot;Consistent components
exports&quot; section (...</li>
<li>Additional commits viewable in <a
href="https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.4/packages/plugin-react">compare
view</a></li>
</ul>
</details>
<br />

Updates `vite` from 8.0.10 to 8.1.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/releases">vite's
releases</a>.</em></p>
<blockquote>
<h2>v8.1.5</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.1.5/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.1.4</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.1.4/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.1.3</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.1.3/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.1.2</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.1.2/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.1.1</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.1.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>create-vite@8.1.0</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/create-vite@8.1.0/packages/create-vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>plugin-legacy@8.1.0</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/plugin-legacy@8.1.0/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.1.0</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.1.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>plugin-legacy@8.1.0-beta.0</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/plugin-legacy@8.1.0-beta.0/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.1.0-beta.0</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.1.0-beta.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.16</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.16/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.15</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.15/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.14</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.14/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.13</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.13/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.12</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.12/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.11</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.11/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md">vite's
changelog</a>.</em></p>
<blockquote>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v8.1.4...v8.1.5">8.1.5</a>
(2026-07-16)<!-- raw HTML omitted --></h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>bundled-dev:</strong> avoid duplicated <code>buildEnd</code>
(<a
href="https://redirect.github.com/vitejs/vite/issues/22931">#22931</a>)
(<a
href="https://github.com/vitejs/vite/commit/810032097079be1a7da0e2b09ec9d92dd07ec13f">8100320</a>)</li>
<li><strong>client:</strong> overlay error message format align rolldown
(<a
href="https://redirect.github.com/vitejs/vite/issues/22869">#22869</a>)
(<a
href="https://github.com/vitejs/vite/commit/5a72b8780705b575026617e86b0b92dea63a56a5">5a72b87</a>)</li>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/22921">#22921</a>)
(<a
href="https://github.com/vitejs/vite/commit/fef682d3f067d534a559faf6fd9baedda2e9f8f1">fef682d</a>)</li>
<li><strong>deps:</strong> update rolldown-related dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/22922">#22922</a>)
(<a
href="https://github.com/vitejs/vite/commit/3c345e475a5546a1cc6374682af89caebfe9c593">3c345e4</a>)</li>
<li><strong>module-runner:</strong> don't crash stack-trace source
mapping when globalThis.Buffer is absent (<a
href="https://redirect.github.com/vitejs/vite/issues/22945">#22945</a>)
(<a
href="https://github.com/vitejs/vite/commit/f8b38e316bcefbf29f762f90ee49c88cd52c43b5">f8b38e3</a>)</li>
<li><strong>optimizer:</strong> respect importer module format for
dynamic import interop with CJS deps (<a
href="https://redirect.github.com/vitejs/vite/issues/22951">#22951</a>)
(<a
href="https://github.com/vitejs/vite/commit/6c08c39ac4fb5868d080a51ff976a44693fc56ab">6c08c39</a>)</li>
<li><strong>ssr:</strong> scope switch-case declarations to the switch,
not the function (<a
href="https://redirect.github.com/vitejs/vite/issues/22893">#22893</a>)
(<a
href="https://github.com/vitejs/vite/commit/b59a73f76f5557492d83d097bb33b3dd02f27d51">b59a73f</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li><strong>build:</strong> fix incorrect <code>@default</code> for
build.cssMinify (<a
href="https://redirect.github.com/vitejs/vite/issues/22948">#22948</a>)
(<a
href="https://github.com/vitejs/vite/commit/c88c236186d8e2384653e382dd0960ca1ff5b24c">c88c236</a>)</li>
<li><strong>build:</strong> fix incorrect <code>@default</code> for
build.lib.formats (<a
href="https://redirect.github.com/vitejs/vite/issues/22911">#22911</a>)
(<a
href="https://github.com/vitejs/vite/commit/369ed609a4aace3aee4e4194a54990694aa4e7ac">369ed60</a>)</li>
</ul>
<h3>Tests</h3>
<ul>
<li>avoid scanner scanning all files under <code>__tests__</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/22912">#22912</a>)
(<a
href="https://github.com/vitejs/vite/commit/c961cae2868cc1521457ec60583867f0440e6949">c961cae</a>)</li>
</ul>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v8.1.3...v8.1.4">8.1.4</a>
(2026-07-09)<!-- raw HTML omitted --></h2>
<h3>Features</h3>
<ul>
<li><strong>legacy:</strong> prefer oxc as minifier (fix <a
href="https://redirect.github.com/vitejs/vite/issues/21973">#21973</a>)
(<a
href="https://redirect.github.com/vitejs/vite/issues/22468">#22468</a>)
(<a
href="https://github.com/vitejs/vite/commit/ab5dafa8e66296ef201f615489fb57954bb740ce">ab5dafa</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>build:</strong> add workaround for building on stackblitz
(<a
href="https://redirect.github.com/vitejs/vite/issues/22840">#22840</a>)
(<a
href="https://github.com/vitejs/vite/commit/575c32c29925c554f4ef4068738ab89c6878f615">575c32c</a>)</li>
<li><strong>build:</strong> keep <code>import.meta.url</code> in preload
function as-is (<a
href="https://redirect.github.com/vitejs/vite/issues/22839">#22839</a>)
(<a
href="https://github.com/vitejs/vite/commit/f1f90ed4742b3cf453428c7e581a6016a4d47321">f1f90ed</a>)</li>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/22865">#22865</a>)
(<a
href="https://github.com/vitejs/vite/commit/d4295a9ffce428c0e51892373e00c07fccc0498a">d4295a9</a>)</li>
<li><strong>deps:</strong> update rolldown-related dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/22866">#22866</a>)
(<a
href="https://github.com/vitejs/vite/commit/7cf07e4c5f7a6af276012e0c2ec06e08499e951e">7cf07e4</a>)</li>
<li><strong>html:</strong> avoid backtracking in import-only check (<a
href="https://redirect.github.com/vitejs/vite/issues/22848">#22848</a>)
(<a
href="https://github.com/vitejs/vite/commit/b5868c01a124d345664450aaebd677bfba964c05">b5868c0</a>)</li>
<li><strong>optimizer:</strong> avoid optimizer run for transform
request before init (<a
href="https://redirect.github.com/vitejs/vite/issues/22852">#22852</a>)
(<a
href="https://github.com/vitejs/vite/commit/72a5e2192506f51a5efd09c059815a5c43a9eacb">72a5e21</a>)</li>
<li><strong>ssr:</strong> align named export function call stacktrace
column with Node (<a
href="https://redirect.github.com/vitejs/vite/issues/22829">#22829</a>)
(<a
href="https://github.com/vitejs/vite/commit/173a1b648c321e0f836e5a94fc47c4fa9b081bfc">173a1b6</a>)</li>
<li>strip pure CSS chunk imports when chunkImportMap is enabled (<a
href="https://redirect.github.com/vitejs/vite/issues/22841">#22841</a>)
(<a
href="https://github.com/vitejs/vite/commit/648bd04933093d0aac9565f21a49811437776886">648bd04</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>fix incorrect <code>@default</code> for <code>server.cors</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/22859">#22859</a>)
(<a
href="https://github.com/vitejs/vite/commit/70435b2551ee4fe3a0d55c8a3bb61b96f44d2763">70435b2</a>)</li>
</ul>
<h3>Miscellaneous Chores</h3>
<ul>
<li><strong>deps:</strong> update dependency postcss-modules to v9 (<a
href="https://redirect.github.com/vitejs/vite/issues/22867">#22867</a>)
(<a
href="https://github.com/vitejs/vite/commit/a9539d69efc7a4ccf988bbf5da31c2b416ba990e">a9539d6</a>)</li>
</ul>
<h3>Code Refactoring</h3>
<ul>
<li>eliminate ineffectiveDynamicImport warn (<a
href="https://redirect.github.com/vitejs/vite/issues/22876">#22876</a>)
(<a
href="https://github.com/vitejs/vite/commit/ea22fb352aad9a42c0a9d08f39d8a0bae8c111a5">ea22fb3</a>)</li>
</ul>
<h3>Tests</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitejs/vite/commit/5e7fe129a4dde4f41934083b25e490059985f4e6"><code>5e7fe12</code></a>
release: v8.1.5</li>
<li><a
href="https://github.com/vitejs/vite/commit/6c08c39ac4fb5868d080a51ff976a44693fc56ab"><code>6c08c39</code></a>
fix(optimizer): respect importer module format for dynamic import
interop wit...</li>
<li><a
href="https://github.com/vitejs/vite/commit/5a72b8780705b575026617e86b0b92dea63a56a5"><code>5a72b87</code></a>
fix(client): overlay error message format align rolldown (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22869">#22869</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/f8b38e316bcefbf29f762f90ee49c88cd52c43b5"><code>f8b38e3</code></a>
fix(module-runner): don't crash stack-trace source mapping when
globalThis.Bu...</li>
<li><a
href="https://github.com/vitejs/vite/commit/810032097079be1a7da0e2b09ec9d92dd07ec13f"><code>8100320</code></a>
fix(bundled-dev): avoid duplicated <code>buildEnd</code> (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22931">#22931</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/c88c236186d8e2384653e382dd0960ca1ff5b24c"><code>c88c236</code></a>
docs(build): fix incorrect <code>@default</code> for build.cssMinify (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22948">#22948</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/b59a73f76f5557492d83d097bb33b3dd02f27d51"><code>b59a73f</code></a>
fix(ssr): scope switch-case declarations to the switch, not the function
(<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22">#22</a>...</li>
<li><a
href="https://github.com/vitejs/vite/commit/fef682d3f067d534a559faf6fd9baedda2e9f8f1"><code>fef682d</code></a>
fix(deps): update all non-major dependencies (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22921">#22921</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/3c345e475a5546a1cc6374682af89caebfe9c593"><code>3c345e4</code></a>
fix(deps): update rolldown-related dependencies (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22922">#22922</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/369ed609a4aace3aee4e4194a54990694aa4e7ac"><code>369ed60</code></a>
docs(build): fix incorrect <code>@default</code> for build.lib.formats
(<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22911">#22911</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vitejs/vite/commits/v8.1.5/packages/vite">compare
view</a></li>
</ul>
</details>
<br />

Updates `vite-plugin-checker` from 0.13.0 to 0.14.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/fi3ework/vite-plugin-checker/releases">vite-plugin-checker's
releases</a>.</em></p>
<blockquote>
<h2>vite-plugin-checker@0.14.1</h2>
<h3>   🚨 Breaking Changes</h3>
<ul>
<li>Remove support for vue2/vls  -  by <a
href="https://github.com/danielroe"><code>@​danielroe</code></a> in <a
href="https://redirect.github.com/fi3ework/vite-plugin-checker/issues/708">fi3ework/vite-plugin-checker#708</a>
<a
href="https://github.com/fi3ework/vite-plugin-checker/commit/bbf2aa3"><!--
raw HTML omitted -->(bbf2a)<!-- raw HTML omitted --></a></li>
<li><strong>deps</strong>: Update dependency chokidar to v5  -  in <a
href="https://redirect.github.com/fi3ework/vite-plugin-checker/issues/688">fi3ework/vite-plugin-checker#688</a>
<a
href="https://github.com/fi3ework/vite-plugin-checker/commit/814f22b"><!--
raw HTML omitted -->(814f2)<!-- raw HTML omitted --></a></li>
</ul>
<h3>   🐞 Bug Fixes</h3>
<ul>
<li><strong>deps</strong>:
<ul>
<li>Update dependency tinyglobby to ^0.2.16  -  in <a
href="https://redirect.github.com/fi3ework/vite-plugin-checker/issues/693">fi3ework/vite-plugin-checker#693</a>
<a
href="https://github.com/fi3ework/vite-plugin-checker/commit/198d23c"><!--
raw HTML omitted -->(198d2)<!-- raw HTML omitted --></a></li>
<li>Update react monorepo  -  in <a
href="https://redirect.github.com/fi3ework/vite-plugin-checker/issues/703">fi3ework/vite-plugin-checker#703</a>
<a
href="https://github.com/fi3ework/vite-plugin-checker/commit/af01fd7"><!--
raw HTML omitted -->(af01f)<!-- raw HTML omitted --></a></li>
<li>Update dependency <code>@​babel/code-frame</code> to ^7.29.0  -  in
<a
href="https://redirect.github.com/fi3ework/vite-plugin-checker/issues/702">fi3ework/vite-plugin-checker#702</a>
<a
href="https://github.com/fi3ework/vite-plugin-checker/commit/9b0b81a"><!--
raw HTML omitted -->(9b0b8)<!-- raw HTML omitted --></a></li>
<li>Update dependency vue to ^3.5.32  -  in <a
href="https://redirect.github.com/fi3ework/vite-plugin-checker/issues/694">fi3ework/vite-plugin-checker#694</a>
<a
href="https://github.com/fi3ework/vite-plugin-checker/commit/f673a4f"><!--
raw HTML omitted -->(f673a)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>eslint</strong>:
<ul>
<li>Lazily import eslint  -  by <a
href="https://github.com/danielroe"><code>@​danielroe</code></a> in <a
href="https://redirect.github.com/fi3ework/vite-plugin-checker/issues/709">fi3ework/vite-plugin-checker#709</a>
<a
href="https://github.com/fi3ework/vite-plugin-checker/commit/83adffe"><!--
raw HTML omitted -->(83adf)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>oxlint</strong>:
<ul>
<li>File format not being found  -  by <a
href="https://github.com/H4ad"><code>@​H4ad</code></a> in <a
href="https://redirect.github.com/fi3ework/vite-plugin-checker/issues/714">fi3ework/vite-plugin-checker#714</a>
<a
href="https://github.com/fi3ework/vite-plugin-checker/commit/3e4ab68"><!--
raw HTML omitted -->(3e4ab)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>tsc</strong>:
<ul>
<li>Force <code>noEmit</code> when <code>tsconfig.json</code> can't be
parsed  -  by <a
href="https://github.com/danielroe"><code>@​danielroe</code></a> in <a
href="https://redirect.github.com/fi3ework/vite-plugin-checker/issues/721">fi3ework/vite-plugin-checker#721</a>
<a
href="https://github.com/fi3ework/vite-plugin-checker/commit/590dcf5"><!--
raw HTML omitted -->(590dc)<!-- raw HTML omitted --></a></li>
</ul>
</li>
</ul>
<h5>    <a
href="https://github.com/fi3ework/vite-plugin-checker/compare/vite-plugin-checker@0.13.0...vite-plugin-checker@0.14.1">View
changes on GitHub</a></h5>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/fi3ework/vite-plugin-checker/commit/5ab7cbb167453d35360ff24ddad718b827eec3f1"><code>5ab7cbb</code></a>
v0.14.5</li>
<li><a
href="https://github.com/fi3ework/vite-plugin-checker/commit/bdd5c4d3b2333e98c259cca8c9656a15ddae811f"><code>bdd5c4d</code></a>
feat(eslint,stylelint,biome,oxlint): schedule lint runs across checkers
(<a
href="https://redirect.github.com/fi3ework/vite-plugin-checker/issues/707">#707</a>)</li>
<li><a
href="https://github.com/fi3ework/vite-plugin-checker/commit/4ebec51d0e7583d1e0a1e2b00c58278207ee23a2"><code>4ebec51</code></a>
fix(typescript): import absolute typescriptPath via file URL on
Windows</li>
<li><a
href="https://github.com/fi3ework/vite-plugin-checker/commit/d33d281f134228c00ffc6c93e22ae39fdce3c2f2"><code>d33d281</code></a>
feat(typescript): add experimental support for TypeScript 7 (<a
href="https://redirect.github.com/fi3ework/vite-plugin-checker/issues/779">#779</a>)</li>
<li><a
href="https://github.com/fi3ework/vite-plugin-checker/commit/7026910c9766e38bd53f37f3e4471df1608814d5"><code>7026910</code></a>
fix(oxlint): guard <code>runOxlint</code> against spawn errors (<a
href="https://redirect.github.com/fi3ework/vite-plugin-checker/issues/730">#730</a>)</li>
<li><a
href="https://github.com/fi3ework/vite-plugin-checker/commit/e31fb72859d291464c8b2b83e2bc72324f68fd05"><code>e31fb72</code></a>
fix(eslint): fix path resolution for changed files (<a
href="https://redirect.github.com/fi3ework/vite-plugin-checker/issues/778">#778</a>)</li>
<li><a
href="https://github.com/fi3ework/vite-plugin-checker/commit/15960c4e921de49615224572390e1767c26cc00a"><code>15960c4</code></a>
fix(checker): don't crash when a watched file is removed mid-lint (<a
href="https://redirect.github.com/fi3ework/vite-plugin-checker/issues/773">#773</a>)</li>
<li><a
href="https://github.com/fi3ework/vite-plugin-checker/commit/132b9bdc98d1295777f4f5b762f5442066e15336"><code>132b9bd</code></a>
fix: emit un-based runtime specifier for virtual entry with custom base
(<a
href="https://redirect.github.com/fi3ework/vite-plugin-checker/issues/782">#782</a>)</li>
<li><a
href="https://github.com/fi3ework/vite-plugin-checker/commit/9ec07682ddaf9e5b684b3452f1d76da57942c2c3"><code>9ec0768</code></a>
chore(deps): update dependency lint-staged to v17.1.0 (<a
href="https://redirect.github.com/fi3ework/vite-plugin-checker/issues/772">#772</a>)</li>
<li><a
href="https://github.com/fi3ework/vite-plugin-checker/commit/5253f482323c2cb2ccf31a63a13eccc84a37206c"><code>5253f48</code></a>
chore(deps): update actions/cache digest to caa2961 (<a
href="https://redirect.github.com/fi3ework/vite-plugin-checker/issues/775">#775</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/fi3ework/vite-plugin-checker/compare/vite-plugin-checker@0.13.0...v0.14.5">compare
view</a></li>
</ul>
</details>
<br />

Updates `vitest` from 4.1.5 to 4.1.10
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitest-dev/vitest/releases">vitest's
releases</a>.</em></p>
<blockquote>
<h2>v4.1.10</h2>
<h3>   🐞 Bug Fixes</h3>
<ul>
<li><strong>browser</strong>: Check fs access in builtin commands
[backport to v4]  -  by <a
href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a>,
<strong>Hiroshi Ogawa</strong> and <strong>OpenCode
(claude-opus-4-8)</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10680">vitest-dev/vitest#10680</a>
<a href="https://github.com/vitest-dev/vitest/commit/5c18dd267"><!-- raw
HTML omitted -->(5c18d)<!-- raw HTML omitted --></a></li>
<li><strong>vm</strong>: Fix external module resolve error with deps
optimizer query for encoded URI [backport to v4]  -  by <a
href="https://github.com/SveLil"><code>@​SveLil</code></a> and <a
href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10661">vitest-dev/vitest#10661</a>
<a href="https://github.com/vitest-dev/vitest/commit/bae52b511"><!-- raw
HTML omitted -->(bae52)<!-- raw HTML omitted --></a></li>
</ul>
<h5>    <a
href="https://github.com/vitest-dev/vitest/compare/v4.1.9...v4.1.10">View
changes on GitHub</a></h5>
<h2>v4.1.9</h2>
<h3>🐞 Bug Fixes</h3>
<ul>
<li>Fix <code>importOriginal</code> with optimizer and query import
[backport to v4] - by <strong>Hiroshi Ogawa</strong>, <strong>David
Harris</strong>, <strong>Codex</strong>and <strong>Vladimir</strong> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/10546">vitest-dev/vitest#10546</a>
<a href="https://github.com/vitest-dev/vitest/commit/a5180190c"><!-- raw
HTML omitted -->(a5180)<!-- raw HTML omitted --></a></li>
<li><strong>browser</strong>:
<ul>
<li>Wait for orchestrator readiness before resolving browser sessions
[backport to v4] - by <strong>Vladimir</strong> and <strong>Séamus
O'Connor</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10555">vitest-dev/vitest#10555</a>
<a href="https://github.com/vitest-dev/vitest/commit/7fb29651a"><!-- raw
HTML omitted -->(7fb29)<!-- raw HTML omitted --></a></li>
<li>Wait for iframe tester readiness before preparing [backport to v4] -
by <strong>Vladimir</strong> and <strong>Séamus O'Connor</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10497">vitest-dev/vitest#10497</a>
and <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10556">vitest-dev/vitest#10556</a>
<a href="https://github.com/vitest-dev/vitest/commit/fbc626c40"><!-- raw
HTML omitted -->(fbc62)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>mocker</strong>:
<ul>
<li>Hoist vi.mock() for vite-plus/test imports [backport to v4] - by
<strong>Hiroshi Ogawa</strong>, <strong>LongYinan</strong>,
<strong>Claude Opus 4.8</strong> and <strong>Vladimir</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10548">vitest-dev/vitest#10548</a>
<a href="https://github.com/vitest-dev/vitest/commit/2c9559c02"><!-- raw
HTML omitted -->(2c955)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>pool</strong>:
<ul>
<li>Prevent test run hang on worker crash [backport to v4] - by
<strong>Ari Perkkiö</strong> and <strong>Jattioui Ismail</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10543">vitest-dev/vitest#10543</a>
and <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10564">vitest-dev/vitest#10564</a>
<a href="https://github.com/vitest-dev/vitest/commit/934b0f587"><!-- raw
HTML omitted -->(934b0)<!-- raw HTML omitted --></a></li>
</ul>
</li>
</ul>
<h5><a
href="https://github.com/vitest-dev/vitest/compare/v4.1.8...v4.1.9">View
changes on GitHub</a></h5>
<h2>v4.1.8</h2>
<h3>   🐞 Bug Fixes</h3>
<ul>
<li><strong>browser</strong>:
<ul>
<li>Disable client <code>cdp</code> API when <code>allowWrite/allowExec:
false</code> [backport to v4]  -  by <a
href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> and
<strong>Codex</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10450">vitest-dev/vitest#10450</a>
<a href="https://github.com/vitest-dev/vitest/commit/e4067b3b1"><!-- raw
HTML omitted -->(e4067)<!-- raw HTML omitted --></a></li>
<li>Remove orphaned Playwright route when same module is mocked via
multiple ids [backport to v4]  -  by <a
href="https://github.com/toxik"><code>@​toxik</code></a> and <a
href="https://github.com/Zelys-DFKH"><code>@​Zelys-DFKH</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10474">vitest-dev/vitest#10474</a>
<a href="https://github.com/vitest-dev/vitest/commit/675b4343f"><!-- raw
HTML omitted -->(675b4)<!-- raw HTML omitted --></a></li>
</ul>
</li>
</ul>
<h5>    <a
href="https://github.com/vitest-dev/vitest/compare/v4.1.7...v4.1.8">View
changes on GitHub</a></h5>
<h2>v4.1.7</h2>
<h3>   🐞 Bug Fixes</h3>
<ul>
<li><strong>runner</strong>: Limit concurrency per task branch in
addition to per leaf callbacks (backport)  -  by <a
href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10384">vitest-dev/vitest#10384</a>
<a href="https://github.com/vitest-dev/vitest/commit/4f0f2a1ee"><!-- raw
HTML omitted -->(4f0f2)<!-- raw HTML omitted --></a></li>
</ul>
<h5>    <a
href="https://github.com/vitest-dev/vitest/compare/v4.1.6...v4.1.7">View
changes on GitHub</a></h5>
<h2>v4.1.6</h2>
<h3>   🐞 Bug Fixes</h3>
<ul>
<li><strong>browser</strong>: Provide project reference in
<code>ToMatchScreenshotResolvePath</code>  -  by <a
href="https://github.com/macarie"><code>@​macarie</code></a> and <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/10138">vitest-dev/vitest#10138</a>
<a href="https://github.com/vitest-dev/vitest/commit/31882607c"><!-- raw
HTML omitted -->(31882)<!-- raw HTML omitted --></a></li>
<li>Global <code>sequence.concurrent: true</code> with top-level
<code>test(..., { concurrent: false })</code> + depreacte
<code>sequential</code> test API and options  -  by <a
href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a>,
<strong>Codex</strong> and <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/10196">vitest-dev/vitest#10196</a>
<a href="https://github.com/vitest-dev/vitest/commit/2847dfa2a"><!-- raw
HTML omitted -->(2847d)<!-- raw HTML omitted --></a></li>
<li><strong>browser</strong>: Simplify orchestrator otel carrier  -  by
<a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10285">vitest-dev/vitest#10285</a>
<a href="https://github.com/vitest-dev/vitest/commit/18af98cee"><!-- raw
HTML omitted -->(18af9)<!-- raw HTML omitted --></a></li>
</ul>
<h3>   🏎 Performance</h3>
<ul>
<li>Stringify diff objects only once  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/10276">vitest-dev/vitest#10276</a>
<a href="https://github.com/vitest-dev/vitest/commit/9f7b1528c"><!-- raw
HTML omitted -->(9f7b1)<!-- raw HTML omitted --></a></li>
</ul>
<h5>    <a
href="https://github.com/vitest-dev/vitest/compare/v4.1.5...v4.1.6">View
changes on GitHub</a></h5>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitest-dev/vitest/commit/db616d227b6e0cb07a94f5d1bba262ee95db7e46"><code>db616d2</code></a>
chore: release v4.1.10 (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/10718">#10718</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/bae52b5112a6fd8200101b88bf8af9685d077295"><code>bae52b5</code></a>
fix(vm): fix external module resolve error with deps optimizer query for
enco...</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/a7a61e78c7d0718f00173cff6800a91a344457d4"><code>a7a61e7</code></a>
chore: release v4.1.9 (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/10598">#10598</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/934b0f587cb61d8338d83f525295322692a2db40"><code>934b0f5</code></a>
fix(pool): prevent test run hang on worker crash (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/10543">#10543</a>)
[backport to v4] (#...</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/7fb29651afbae2a9b0cefe6c031a9308f168ac60"><code>7fb2965</code></a>
fix(browser): wait for orchestrator readiness before resolving browser
sessio...</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/a5180190c1be7089e3705e3dd9e84fea118d09d3"><code>a518019</code></a>
fix: fix <code>importOriginal</code> with optimizer and query import
[backport to v4] (#...</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/e61f2dd2a0ba0a266c1c5e0334aad3799fee527f"><code>e61f2dd</code></a>
chore: release v4.1.8</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/e4067b3b150005fd42cf75f994300119245806b9"><code>e4067b3</code></a>
fix(browser): disable client <code>cdp</code> API when
<code>allowWrite/allowExec: false</code> [ba...</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/a09d47236e19fd3151351080c667036ca6164dc4"><code>a09d472</code></a>
chore: release v4.1.7</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/a8fd24c1cad2320b19fcc651413c7d928423bdc1"><code>a8fd24c</code></a>
chore: release v4.1.6</li>
<li>Additional commits viewable in <a
href="https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-06 04:57:44 +00:00
dependabot[bot] 8ebdc50b77 chore: bump @vitest/browser-playwright from 4.1.7 to 4.1.10 in /site (#27743) 
Bumps
[@vitest/browser-playwright](https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser-playwright)
from 4.1.7 to 4.1.10.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitest-dev/vitest/releases">@​vitest/browser-playwright's
releases</a>.</em></p>
<blockquote>
<h2>v4.1.10</h2>
<h3>   🐞 Bug Fixes</h3>
<ul>
<li><strong>browser</strong>: Check fs access in builtin commands
[backport to v4]  -  by <a
href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a>,
<strong>Hiroshi Ogawa</strong> and <strong>OpenCode
(claude-opus-4-8)</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10680">vitest-dev/vitest#10680</a>
<a href="https://github.com/vitest-dev/vitest/commit/5c18dd267"><!-- raw
HTML omitted -->(5c18d)<!-- raw HTML omitted --></a></li>
<li><strong>vm</strong>: Fix external module resolve error with deps
optimizer query for encoded URI [backport to v4]  -  by <a
href="https://github.com/SveLil"><code>@​SveLil</code></a> and <a
href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10661">vitest-dev/vitest#10661</a>
<a href="https://github.com/vitest-dev/vitest/commit/bae52b511"><!-- raw
HTML omitted -->(bae52)<!-- raw HTML omitted --></a></li>
</ul>
<h5>    <a
href="https://github.com/vitest-dev/vitest/compare/v4.1.9...v4.1.10">View
changes on GitHub</a></h5>
<h2>v4.1.9</h2>
<h3>🐞 Bug Fixes</h3>
<ul>
<li>Fix <code>importOriginal</code> with optimizer and query import
[backport to v4] - by <strong>Hiroshi Ogawa</strong>, <strong>David
Harris</strong>, <strong>Codex</strong>and <strong>Vladimir</strong> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/10546">vitest-dev/vitest#10546</a>
<a href="https://github.com/vitest-dev/vitest/commit/a5180190c"><!-- raw
HTML omitted -->(a5180)<!-- raw HTML omitted --></a></li>
<li><strong>browser</strong>:
<ul>
<li>Wait for orchestrator readiness before resolving browser sessions
[backport to v4] - by <strong>Vladimir</strong> and <strong>Séamus
O'Connor</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10555">vitest-dev/vitest#10555</a>
<a href="https://github.com/vitest-dev/vitest/commit/7fb29651a"><!-- raw
HTML omitted -->(7fb29)<!-- raw HTML omitted --></a></li>
<li>Wait for iframe tester readiness before preparing [backport to v4] -
by <strong>Vladimir</strong> and <strong>Séamus O'Connor</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10497">vitest-dev/vitest#10497</a>
and <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10556">vitest-dev/vitest#10556</a>
<a href="https://github.com/vitest-dev/vitest/commit/fbc626c40"><!-- raw
HTML omitted -->(fbc62)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>mocker</strong>:
<ul>
<li>Hoist vi.mock() for vite-plus/test imports [backport to v4] - by
<strong>Hiroshi Ogawa</strong>, <strong>LongYinan</strong>,
<strong>Claude Opus 4.8</strong> and <strong>Vladimir</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10548">vitest-dev/vitest#10548</a>
<a href="https://github.com/vitest-dev/vitest/commit/2c9559c02"><!-- raw
HTML omitted -->(2c955)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>pool</strong>:
<ul>
<li>Prevent test run hang on worker crash [backport to v4] - by
<strong>Ari Perkkiö</strong> and <strong>Jattioui Ismail</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10543">vitest-dev/vitest#10543</a>
and <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10564">vitest-dev/vitest#10564</a>
<a href="https://github.com/vitest-dev/vitest/commit/934b0f587"><!-- raw
HTML omitted -->(934b0)<!-- raw HTML omitted --></a></li>
</ul>
</li>
</ul>
<h5><a
href="https://github.com/vitest-dev/vitest/compare/v4.1.8...v4.1.9">View
changes on GitHub</a></h5>
<h2>v4.1.8</h2>
<h3>   🐞 Bug Fixes</h3>
<ul>
<li><strong>browser</strong>:
<ul>
<li>Disable client <code>cdp</code> API when <code>allowWrite/allowExec:
false</code> [backport to v4]  -  by <a
href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> and
<strong>Codex</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10450">vitest-dev/vitest#10450</a>
<a href="https://github.com/vitest-dev/vitest/commit/e4067b3b1"><!-- raw
HTML omitted -->(e4067)<!-- raw HTML omitted --></a></li>
<li>Remove orphaned Playwright route when same module is mocked via
multiple ids [backport to v4]  -  by <a
href="https://github.com/toxik"><code>@​toxik</code></a> and <a
href="https://github.com/Zelys-DFKH"><code>@​Zelys-DFKH</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10474">vitest-dev/vitest#10474</a>
<a href="https://github.com/vitest-dev/vitest/commit/675b4343f"><!-- raw
HTML omitted -->(675b4)<!-- raw HTML omitted --></a></li>
</ul>
</li>
</ul>
<h5>    <a
href="https://github.com/vitest-dev/vitest/compare/v4.1.7...v4.1.8">View
changes on GitHub</a></h5>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitest-dev/vitest/commit/db616d227b6e0cb07a94f5d1bba262ee95db7e46"><code>db616d2</code></a>
chore: release v4.1.10 (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser-playwright/issues/10718">#10718</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/5c18dd267ff7f47f24cab2f615a16b37d90feb7f"><code>5c18dd2</code></a>
fix(browser): check fs access in builtin commands [backport to v4] (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser-playwright/issues/10680">#10680</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/a7a61e78c7d0718f00173cff6800a91a344457d4"><code>a7a61e7</code></a>
chore: release v4.1.9 (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser-playwright/issues/10598">#10598</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/e61f2dd2a0ba0a266c1c5e0334aad3799fee527f"><code>e61f2dd</code></a>
chore: release v4.1.8</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/675b4343fd82e094f0bed9c2b28489ce815f9c28"><code>675b434</code></a>
fix(browser): remove orphaned Playwright route when same module is
mocked via...</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/e4067b3b150005fd42cf75f994300119245806b9"><code>e4067b3</code></a>
fix(browser): disable client <code>cdp</code> API when
<code>allowWrite/allowExec: false</code> [ba...</li>
<li>See full diff in <a
href="https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/browser-playwright">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-06 04:46:36 +00:00
Ethan 78b5a0f5a2 feat(cli): add --agents-allowed to template commands (#27517) 
Relates to CODAGT-713

Depends on #27515

This adds `--agents-allowed` to `coder templates create` and `coder templates edit`. Template creation defaults the option to true, matching the per-template API and database default, while template editing only changes the value when the flag is explicitly supplied so unrelated edits preserve the existing setting.

The generated CLI help and reference documentation include the new option. #27518 updates the Coder Agents platform controls documentation to describe the completed per-template model.
 2026-08-06 14:45:38 +10:00
Jake Howell 6c8a8647f6 fix(site): name template versions in promote/archive dialogs and toasts (#27633) 
> [!NOTE]
> These were previously returning as typed values in the `api.ts`,
however, they were not actually typed in this way and updating them
wouldn't have worked for the `promotion` as it would fall back to
needing to validate against the template.

Archive toasts showed `"undefined"` because the API does not return a
`TemplateVersion`. Toast/dialog copy now comes from the selected
version.

- Hold the full `TemplateVersion` for promote/archive confirms (global
pattern elsewhere)
- Name the version in confirm dialogs and success/error toasts
- Type archive/unarchive API helpers as `Promise<void>`

<img width="772" height="152" alt="image"
src="https://github.com/user-attachments/assets/0063ebdc-09a3-4041-bfa0-d4c70b57159b"
/>
 2026-08-06 04:41:46 +00:00
dependabot[bot] 2484f4b047 chore: bump @tailwindcss/typography from 0.5.19 to 0.5.20 in /site (#27754) 
Bumps
[@tailwindcss/typography](https://github.com/tailwindlabs/tailwindcss-typography)
from 0.5.19 to 0.5.20.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tailwindlabs/tailwindcss-typography/releases">@​tailwindcss/typography's
releases</a>.</em></p>
<blockquote>
<h2>v0.5.20</h2>
<h3>Fixed</h3>
<ul>
<li>Support installing with stable versions of Tailwind CSS v4 (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss-typography/pull/424">#424</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/tailwindlabs/tailwindcss-typography/blob/main/CHANGELOG.md">@​tailwindcss/typography's
changelog</a>.</em></p>
<blockquote>
<h2>[0.5.20] - 2026-06-08</h2>
<h3>Fixed</h3>
<ul>
<li>Support installing with stable versions of Tailwind CSS v4 (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss-typography/pull/424">#424</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/tailwindlabs/tailwindcss-typography/commit/e3714a3fe55551ce9d51eec4721183ed6b1d5cd1"><code>e3714a3</code></a>
0.5.20</li>
<li><a
href="https://github.com/tailwindlabs/tailwindcss-typography/commit/f34283d2961e18dd0dc2a849702e0dfd45fc80cb"><code>f34283d</code></a>
Update tailwindcss peer dependency version (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss-typography/issues/424">#424</a>)</li>
<li><a
href="https://github.com/tailwindlabs/tailwindcss-typography/commit/543de4274390e90c4aab5d216729b46a3ba5541b"><code>543de42</code></a>
bump Node.js</li>
<li><a
href="https://github.com/tailwindlabs/tailwindcss-typography/commit/881b0488df9fd05e5361276b66a9ee8e7f39a3a7"><code>881b048</code></a>
Setup OIDC (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss-typography/issues/423">#423</a>)</li>
<li><a
href="https://github.com/tailwindlabs/tailwindcss-typography/commit/74a3da779bb43e4e68f446395224c768704c1fb6"><code>74a3da7</code></a>
Fix typo in README.md (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss-typography/issues/413">#413</a>)</li>
<li><a
href="https://github.com/tailwindlabs/tailwindcss-typography/commit/3963dfede4845f46451db1863fd5321f4cdea03b"><code>3963dfe</code></a>
Bump js-yaml from 3.14.1 to 3.14.2 (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss-typography/issues/410">#410</a>)</li>
<li><a
href="https://github.com/tailwindlabs/tailwindcss-typography/commit/abf85cc6e1b4f9b914b0f66453e5a97a9899a15c"><code>abf85cc</code></a>
className instead of classname (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss-typography/issues/406">#406</a>)</li>
<li>See full diff in <a
href="https://github.com/tailwindlabs/tailwindcss-typography/compare/v0.5.19...v0.5.20">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for <code>@​tailwindcss/typography</code> since your current
version.</p>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-06 04:35:59 +00:00
Ethan d2f9280138 chore: remove legacy chat template allowlist (#27515) 
Relates to CODAGT-713

Depends on #27514

Removes the legacy deployment-wide allowlist now that the API and frontend use per-template `agents_allowed`: the experimental `/template-allowlist` routes, SDK methods and generated types, site config queries, frontend bindings, and the now-unused `xjson` utility.

Migration `000563` deletes the obsolete `agents_template_allowlist` value. It's irreversible for deployments that configured an allowlist, which I think is fine, since `000562` already drops `agents_allowed` on the way down, and this release ships `000548` and `000555` with the same property.

Two side effects of the model change worth writing down, both from #27514 rather than here. The value used to need `ActionRead` on `ResourceDeploymentConfig` to read and deployment config update to write. `AgentsAllowed` is now a plain field on the template response, readable by anyone who can read the template, and it's set with a template update, so org admins manage it themselves. That's the delegation we wanted, and it's tracked in the audit log.

The rest of the stack adds `--agents-allowed` to the CLI and updates the platform controls docs.
 2026-08-06 14:35:37 +10:00
dependabot[bot] ac6c9ae45c chore: bump @storybook/addon-mcp from 0.6.0 to 0.7.0 in /site (#27745) 
Bumps
[@storybook/addon-mcp](https://github.com/storybookjs/mcp/tree/HEAD/packages/addon-mcp)
from 0.6.0 to 0.7.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/storybookjs/mcp/blob/main/packages/addon-mcp/CHANGELOG.md">@​storybook/addon-mcp's
changelog</a>.</em></p>
<blockquote>
<h2>0.7.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/storybookjs/mcp/pull/357">#357</a> <a
href="https://github.com/storybookjs/mcp/commit/4a1915199892b3f733728844113a6b918ff70be9"><code>4a19151</code></a>
Thanks <a
href="https://github.com/kasperpeulen"><code>@​kasperpeulen</code></a>!
- Added the <code>display-review</code> tool. The agent pushes a curated
review of current changes and returns the review-page URL. Pairs with
the <code>@storybook/addon-review</code> Storybook addon.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/storybookjs/mcp/pull/357">#357</a> <a
href="https://github.com/storybookjs/mcp/commit/4a1915199892b3f733728844113a6b918ff70be9"><code>4a19151</code></a>
Thanks <a
href="https://github.com/kasperpeulen"><code>@​kasperpeulen</code></a>!
- Add the <code>get-stories-by-component</code> tool. Maps component
source files to the stories that render them via Storybook's live
reverse dependency graph, returning grounded story IDs ranked by import
distance. Also hardens change detection:
<code>get-changed-stories</code> now surfaces working-tree files that
are unreachable from any story, and story-index resolution and
reverse-graph lookups are normalized for cross-platform (Windows) path
handling.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/storybookjs/mcp/pull/357">#357</a> <a
href="https://github.com/storybookjs/mcp/commit/4a1915199892b3f733728844113a6b918ff70be9"><code>4a19151</code></a>
Thanks <a
href="https://github.com/kasperpeulen"><code>@​kasperpeulen</code></a>!
- Introduced the <code>get-changed-stories</code> tool to retrieve
metadata for stories marked as new, modified, or affected.
Updated <code>dev-instructions.md</code> and
<code>storybook-story-instructions.md</code> to reflect the new workflow
for calling <code>get-changed-stories</code> before
<code>preview-stories</code>.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/storybookjs/mcp/pull/357">#357</a> <a
href="https://github.com/storybookjs/mcp/commit/4a1915199892b3f733728844113a6b918ff70be9"><code>4a19151</code></a>
Thanks <a
href="https://github.com/kasperpeulen"><code>@​kasperpeulen</code></a>!
- Enabled the review workflow by default for the <code>storybook
ai</code> CLI channel (the Claude/Codex plugins). Requests carrying the
trusted local-client header get <code>display-review</code> and the
review instructions without setting <code>experimentalReview</code>;
direct MCP clients keep the opt-in flag, and <code>experimentalReview:
false</code> turns review off for both channels.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/storybookjs/mcp/pull/357">#357</a> <a
href="https://github.com/storybookjs/mcp/commit/4a1915199892b3f733728844113a6b918ff70be9"><code>4a19151</code></a>
Thanks <a
href="https://github.com/kasperpeulen"><code>@​kasperpeulen</code></a>!
- Add an optional MCP endpoint setting for the addon dev server.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/storybookjs/mcp/pull/357">#357</a> <a
href="https://github.com/storybookjs/mcp/commit/4a1915199892b3f733728844113a6b918ff70be9"><code>4a19151</code></a>
Thanks <a
href="https://github.com/kasperpeulen"><code>@​kasperpeulen</code></a>!
- Make the review tooling opt-in via the new
<code>experimentalReview</code> feature flag. Previously
<code>display-review</code> (and the review-mode behavior of
<code>preview-stories</code> / <code>get-changed-stories</code>) was
enabled whenever the <code>changeDetection</code> feature flag was on —
which is Storybook's default. Now review requires explicitly enabling
<code>features.experimentalReview</code> in
<code>.storybook/main.ts</code> (on top of
<code>changeDetection</code>), so change detection stays on by default
while review ships disabled by default.</p>
<p>With the flag off, the server instructions are byte-identical to the
previous release; the review-flavored instructions are only served with
the flag on.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/storybookjs/mcp/pull/357">#357</a> <a
href="https://github.com/storybookjs/mcp/commit/4a1915199892b3f733728844113a6b918ff70be9"><code>4a19151</code></a>
Thanks <a
href="https://github.com/kasperpeulen"><code>@​kasperpeulen</code></a>!
- Expose serverless Storybook AI metadata from addon-mcp presets. The
new preset returns MCP-shaped instructions and tool descriptors, plus a
local <code>get-storybook-story-instructions</code> runner that shares
the same builders as the live MCP server.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/storybookjs/mcp/pull/357">#357</a> <a
href="https://github.com/storybookjs/mcp/commit/4a1915199892b3f733728844113a6b918ff70be9"><code>4a19151</code></a>
Thanks <a
href="https://github.com/kasperpeulen"><code>@​kasperpeulen</code></a>!
- Support v0 (inline) and v1 (split/ref) Storybook manifest formats.
<code>@storybook/mcp</code> follows <code>$ref</code> pointers into
sibling <code>services/</code> payloads for static and remote sources;
<code>@storybook/addon-mcp</code> adds an in-process manifest provider
for <code>experimentalDocgenServer</code> dev mode and fixes composition
so local docgen-server and remote v0/v1 composed sources all work.</p>
</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/storybookjs/mcp/pull/359">#359</a> <a
href="https://github.com/storybookjs/mcp/commit/4eb4a2eff337fc9fa04ce3c30d07d0f7f255b68f"><code>4eb4a2e</code></a>
Thanks <a
href="https://github.com/huang-julien"><code>@​huang-julien</code></a>!
- Add a schema description to the <code>collections</code> argument of
the <code>display-review</code> tool. The field now documents that
collections are groups of stories to show in the review, ordered
most-relevant-first, with a preferred 2-5 range. Previously it carried
no description, so MCP clients and the <code>storybook ai
display-review</code> help had no guidance on the argument's shape or
intent.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/storybookjs/mcp/pull/357">#357</a> <a
href="https://github.com/storybookjs/mcp/commit/4a1915199892b3f733728844113a6b918ff70be9"><code>4a19151</code></a>
Thanks <a
href="https://github.com/kasperpeulen"><code>@​kasperpeulen</code></a>!
- Make display-review the single ending for visual work: the
after-change instruction step now feeds story discovery into the review
instead of ending at preview URLs, preview-stories is framed as a
mid-loop tool, the &quot;or you skipped it&quot; escape is removed
(non-visual changes say so plainly instead of listing links), and
get-changed-stories results append a &quot;publish the review now&quot;
next-step hint when review is enabled. Fixes agents completing visual
changes but handing back preview links instead of the review.</p>
<p>The preview-stories tool also closes the review exit ramp: when
review is enabled its description states display-review's availability
as fact instead of hedging with &quot;when available&quot; (which let an
agent that wrongly believed the tool was missing treat raw links as a
sanctioned fallback), and its results append a recovery nudge pointing
finished visual work and browse requests back to display-review. When
review is disabled, the description no longer mentions display-review at
all — the tool is not registered in those sessions.</p>
<p>The get-storybook-story-instructions story-linking workflow gets the
same review-aware rewrite: with review enabled it now routes discovered
story IDs into display-review and forbids constructing IDs from file
names or memory, instead of framing get-changed-stories as a
preview-stories helper. The <code>storybook ai --help</code> output
embeds the same server instructions, so on the CLI/plugin path the two
channels contradicted each other — this tool, billed as the source of
truth for story work, still pointed discovery at previews, and agents
were observed resolving the conflict by publishing reviews with
hand-derived story IDs and zero discovery calls.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/storybookjs/mcp/pull/357">#357</a> <a
href="https://github.com/storybookjs/mcp/commit/4a1915199892b3f733728844113a6b918ff70be9"><code>4a19151</code></a>
Thanks <a
href="https://github.com/kasperpeulen"><code>@​kasperpeulen</code></a>!
- Refine the review/preview workflow so agents reuse the running
Storybook and present a single set of links:</p>
<ul>
<li><strong>Reuse the running Storybook.</strong> A successful tool call
proves Storybook is already running, so the agent is instructed never to
start another instance (no <code>storybook dev</code>, launcher, or new
port) just to view a review — a busy port is the instance to reuse, not
a conflict to route around.</li>
<li><strong><code>display-review</code> triggers on insight requests
too.</strong> Beyond post-change reviews, it now fires when the user
wants to browse stories/components (e.g. &quot;show me all badge
components&quot;), rendering exactly those stories with no diff
(<code>changedFiles</code> omitted).</li>
<li><strong>One set of links in the final response.</strong> When
<code>display-review</code> is available, the response links only the
curated review page (&quot;You can see a curated summary of stories in
the Storybook review page&quot;); otherwise it lists the individual
preview URLs — never both.</li>
</ul>
</li>
<li>
<p><a
href="https://redirect.github.com/storybookjs/mcp/pull/357">#357</a> <a
href="https://github.com/storybookjs/mcp/commit/4a1915199892b3f733728844113a6b918ff70be9"><code>4a19151</code></a>
Thanks <a
href="https://github.com/kasperpeulen"><code>@​kasperpeulen</code></a>!
- Show private composed Storybooks as own-MCP guidance when accessed
through the local MCP proxy.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/storybookjs/mcp/pull/357">#357</a> <a
href="https://github.com/storybookjs/mcp/commit/4a1915199892b3f733728844113a6b918ff70be9"><code>4a19151</code></a>
Thanks <a
href="https://github.com/kasperpeulen"><code>@​kasperpeulen</code></a>!
- Add Storybook 10.5 prerelease packages to the supported peer
dependency range.</p>
<p>The <code>display-review</code> tool schema now requires
<code>changedFiles</code>: pass the paths of
the files you changed (most central first), or an empty array
<code>[]</code> for browse
requests where no code changed. Payloads that previously omitted the
field will
fail validation.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/storybookjs/mcp/pull/357">#357</a> <a
href="https://github.com/storybookjs/mcp/commit/4a1915199892b3f733728844113a6b918ff70be9"><code>4a19151</code></a>
Thanks <a
href="https://github.com/kasperpeulen"><code>@​kasperpeulen</code></a>!
- Gate the <code>display-review</code> tool solely on the
<code>changeDetection</code> feature flag. The previous
<code>@storybook/addon-review</code> package-presence check is removed,
since review is now built into Storybook core.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/storybookjs/mcp/commit/de73c2c6371946bb9c048e7987c1b7fd3df76e92"><code>de73c2c</code></a>
Version Packages</li>
<li><a
href="https://github.com/storybookjs/mcp/commit/54e08b69049ff75682d65cf92c6f065af9f3276a"><code>54e08b6</code></a>
chore: reduce description</li>
<li><a
href="https://github.com/storybookjs/mcp/commit/f50fbf611be165c9b81340b1c820bc9f67ccf172"><code>f50fbf6</code></a>
fix(addon-mcp): add display-review escription</li>
<li><a
href="https://github.com/storybookjs/mcp/commit/01d6be2edc66e21516a9378efc5a8bb890123054"><code>01d6be2</code></a>
Merge branch 'main' into docs--fix-link</li>
<li><a
href="https://github.com/storybookjs/mcp/commit/d365aa5994b141f4f0ba65b7ec7ab077ae583473"><code>d365aa5</code></a>
docs(addon-mcp): correct documentation link</li>
<li><a
href="https://github.com/storybookjs/mcp/commit/fcc5504ce786d21fc9dad654155126fd1c7b980a"><code>fcc5504</code></a>
Enable review by default for the plugin (storybook ai CLI channel) (<a
href="https://github.com/storybookjs/mcp/tree/HEAD/packages/addon-mcp/issues/341">#341</a>)</li>
<li><a
href="https://github.com/storybookjs/mcp/commit/32bb8546b48712f27745e1b9d715ae1d6b0e2c52"><code>32bb854</code></a>
Bump Storybook catalog to 10.5.0-beta.0</li>
<li><a
href="https://github.com/storybookjs/mcp/commit/e72917564346e30d0a550eab240d911af0ae3b27"><code>e729175</code></a>
Add tools-api doc generator script</li>
<li><a
href="https://github.com/storybookjs/mcp/commit/d18712bd82977fe33d068ee0cfae29009a2eae16"><code>d18712b</code></a>
Bump Storybook catalog to 10.5.0-alpha.11</li>
<li><a
href="https://github.com/storybookjs/mcp/commit/45d268af2de8c07be118ce2909007f3329562090"><code>45d268a</code></a>
Extend the story-instructions trigger list to shared UI files</li>
<li>Additional commits viewable in <a
href="https://github.com/storybookjs/mcp/commits/@storybook/addon-mcp@0.7.0/packages/addon-mcp">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-06 04:35:17 +00:00
Ethan 01c00ce1bf feat(site): add per-template Coder Agents controls (#27514) 
Relates to CODAGT-713

Depends on #27285

This replaces the deployment-wide template allowlist UI with per-template Coder Agents controls. Each template's General Settings page exposes `agents_allowed` to organisation and template administrators through the existing template-update permission, whilst AI Settings > Templates gives deployment administrators a bulk management page. The bulk page requires both deployment-config and template-update permissions, reuses the same URL-backed server-side filter as `/templates`, tracks pending updates independently for each template, and surfaces failures through template-specific toasts. The copy refers to new workspace creation because disabling a template does not revoke an existing Coder Agent workspace.

This completes the frontend migration away from the experimental `/template-allowlist` API. #27515 removes the now-unused legacy storage, routes, SDK methods, generated types, and JSON utility. Later PRs add CLI flags and update the platform controls documentation. The stack is intended to merge as a unit.
 2026-08-06 14:23:36 +10:00
Ethan 0ac23e3ee1 feat: add per-template Coder Agents access control (#27285) 
Relates to CODAGT-713

Depends on #27284

This makes the per-template `agents_allowed` field authoritative in the API and chatd. It adds optional create and metadata update fields with the intended default and omission semantics, supports `agents-allowed:` template search, includes the value in telemetry, and makes `list_templates`, `read_template`, and `create_workspace` read the template row directly. Existing-workspace retries remain idempotent, and blocked same-organisation templates return an actionable message.

The experimental `/template-allowlist` routes remain temporarily because the shipped AI Settings page still calls them, but they no longer control chatd enforcement. #27514 moves that page to per-template metadata, #27515 removes the legacy storage, routes, SDK types, and utility, #27517 adds the CLI flags, and #27518 updates the platform controls documentation for the per-template model, directly addressing CRF-5 and CRF-6. The stack is intended to merge as a unit.
 2026-08-06 14:14:37 +10:00
Ethan b3485d9b3a chore: add agents_allowed to templates (#27284) 
Relates to CODAGT-713

This adds `templates.agents_allowed` as a default-true, auditable template attribute, along with nullable database filtering. Migration `000562` translates the effective legacy `agents_template_allowlist` state for existing templates: a valid nonempty list allows matching templates and blocks the rest, missing or empty values leave templates allowed, whilst corrupt values fail closed by blocking all existing templates. As per the linear issue, new templates deliberately default to allowed under the per-template model.

This is the database-only first PR in the stack. #27285 makes the field authoritative in the API and chatd whilst temporarily retaining the compatibility routes needed by the shipped frontend. Later PRs migrate the UI, remove the legacy storage, routes, SDK types, and utility, then add CLI flags.
 2026-08-06 14:04:23 +10:00
Jake Howell c98d6bb535 refactor(site/src): migrate shared Pill to Badge (#27638) 
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.

## Summary

Deletes the shared `Pill` component (`site/src/components/Pill/`) and
migrates every consumer to `Badge`. Accepts the intentional visual shift
(`rounded-full` → `rounded-md`, slightly different color tokens). No
`ThemeRole` variants were added to `Badge`.

### Key changes
- Added `site/src/components/Badge/themeRoleToBadgeVariant.ts`, a small
mapper used at call sites that receive a `ThemeRole` (e.g.
`StatusBadge`, `TemplateVersionStatusBadge`).
- Exported `BadgeProps` from `Badge.tsx` so the mapper and status
helpers can reference the variant type.
- Replaced `PillSpinner` with `<Spinner loading />`.
- Renamed `StatusPill` → `StatusBadge` (folder, file, and export) and
updated the audit log and connection log imports.
- Extended `Badge.stories.tsx` with a status + spinner icon pattern
(rather than porting the full Pill story).

### Variant mapping applied
| Pill `type` | Badge `variant` |
|---|---|
| `success` | `green` |
| `error` | `destructive` |
| `warning`, `danger` | `warning` |
| `active`, `notice` | `info` |
| `inactive`, `muted`, `info` | `default` |
| `preview` | `purple` |

### Out of scope
The local Health-page `Pill` in `site/src/pages/HealthPage/Content.tsx`
is a separate component with no shared import; it will be migrated in a
follow-up.

## Validation
- `pnpm check` (biome) passes
- `pnpm lint` (biome + tsc + circular-deps + compiler + knip) passes
- `pnpm test:storybook` for Badge, TemplatePageHeader, and AuditLogRow
stories: 30/30 pass
- Grep for `components/Pill` and `PillSpinner` in `site/src` returns
nothing

<details>
<summary>Implementation plan</summary>

# Migrate Pill to Badge

## Goal

Delete `site/src/components/Pill/Pill.tsx` and migrate every shared-Pill
consumer to `site/src/components/Badge/Badge.tsx`. Accept the visual
shift (`rounded-full` → `rounded-md`, slightly different color tokens).
Do not add ThemeRole variants to Badge.

**Out of scope:** the local Health-page `Pill` in
`site/src/pages/HealthPage/Content.tsx` (separate component, no shared
import). Rename/migrate that in a follow-up.

## Variant mapping

Use this fixed mapping at every call site (Pill `type` → Badge
`variant`):

| Pill `type` | Badge `variant` | Notes |
|---|---|---|
| `success` | `green` | |
| `error` | `destructive` | |
| `warning`, `danger` | `warning` | Pill treats danger like orange
warning |
| `active`, `notice` | `info` | sky / pending |
| `inactive`, `muted`, `info` | `default` | Pill `info` is neutral grey;
Badge `info` is sky, so map Pill `info` to `default` |
| `preview` | `purple` | |

Other remaps:

- `icon={node}` → put `node` as the first child of `Badge`
- `size="lg"` → `size="md"` (closest); add a local `className` only if a
specific layout breaks
- `PillSpinner` → `<Spinner loading />` from
`site/src/components/Spinner/Spinner.tsx`
- Prefer existing wrappers when they already exist (e.g.
`DeprecatedBadge` on the template header)

For ThemeRole-driven helpers (`httpStatusColor`, status getters), add a
tiny shared mapper next to Badge
(`site/src/components/Badge/themeRoleToBadgeVariant.ts`). Use it in
`StatusPill` and any site that still receives `ThemeRole` rather than
hardcoding variants twice.

## Call-site work (ordered easy → hard)

1. **Trivial label chips** (import swap + variant map):
TemplatePageHeader (use `DeprecatedBadge`), VersionRow,
ChangeWorkspaceVersionDialog, PermissionPillsList, IdpPillList,
OrganizationPills
2. **Icon-as-child chips**: Provisioner, ProvisionerTag (local
`BooleanPill` becomes a Badge wrapper), TemplateExampleCard (keep
clickable styles via `className`)
3. **Status + spinner**: TemplateVersionStatusBadge (Badge + children
icons; `PillSpinner` → `Spinner`), utils/workspace.tsx (replace
`PillSpinner` imports only)
4. **Wrappers that own ThemeRole**: StatusPill (switch to Badge +
`themeRoleToBadgeVariant(httpStatusColor(...))`; rename to
`StatusBadge`), Notifications (Badge with severity `className`
overrides)
5. **Delete shared Pill**: remove `Pill.tsx`, `Pill.stories.tsx`, and
the `components/Pill` folder; extend `Badge.stories.tsx` only if a
migrated pattern is missing (icon + spinner status)

## Non-goals / constraints

- Do not change Badge's default shape or add `rounded-full`
- Do not broaden Badge's public API with `type` / `icon` props (that
recreates Pill)
- Do not rename IDP/permission "PillsList" filenames unless needed for
imports
- Modify Badge itself only for the new mapper helper (or stories)

## Validation

- `pnpm check` / `pnpm lint` under `site/`
- Storybook smoke on Badge + affected pages
- Grep for `components/Pill` and `PillSpinner` must be empty in
`site/src`

</details>
 2026-08-06 12:36:05 +10:00
Jake Howell a79031a3f5 refactor(site): migrate WorkspacesButton to Combobox (#27723) 
Migrates the New workspace template picker off MUI Link, Emotion `css`,
and the custom Popover/MenuSearch stack onto the shared Combobox used by
filters.

Selecting a template still navigates to create a workspace. The list
max-height uses the popover's available height so the footer stays
visible and scrolling works on short viewports.
 2026-08-06 01:28:25 +00:00
Jake Howell db4b6dc556 refactor(site): de-MUI custom role create/edit form (#27820) 
Migrate the organization custom role create/edit form off MUI onto
shared site components.

- Replace `TextField` with `FormField` for name and display name
- Replace permission checkboxes with the shared shadcn `Checkbox`
(including indeterminate)
- Replace the “show advanced permissions” control with a `Switch` +
`Label`
- Update the toggle story to query by accessible checkbox role/name
 2026-08-06 11:14:30 +10:00
david-fraley 0d0c6e53ba fix(coderd): document HTTP 201 for workspace and build creation (#27903) 2026-08-05 22:17:59 +00:00
dylanhuff-at-coder ed10064748 refactor(codersdk): use shared error helpers in chat endpoints (#27858) 
Migrate chat endpoint response decoding to `ReadBodyAsJSON` and
consolidate `ReadBodyAsError` construction through `newResponseError`,
so empty-body and non-JSON errors consistently include the request
method and URL.

Stacked on #27857, with the lint rule following in #27859. Refs #27044.

Reviewed and updated by Coder Agents on behalf of @dylanhuff-at-coder.
 2026-08-05 14:41:18 -07:00
Michael Suchacz 4b9880afa6 feat: add --chat-hook-allow-insecure to allow plain HTTP chat hook URLs (#27896) 
Adds a hidden `--chat-hook-allow-insecure` /
`CODER_CHAT_HOOK_ALLOW_INSECURE` deployment option (default `false`)
that allows the chat lifecycle hook URL to use plain HTTP for any host.

The HTTPS requirement is enforced at two points, and the flag relaxes
both: `DeploymentValues.Validate()` rejects `http` hook URLs at startup,
and the hook dispatcher's `validateHookURL` allows `http` only for
loopback hosts. With the flag set, any-host `http` is accepted; the
host, fragment/userinfo, secret, and timeout checks are unchanged, and
non-http(s) schemes still fail. This removes the need for an HTTPS
reverse proxy when testing a hook consumer on a trusted network.

Following security review feedback, the flag description and docs state
that plain HTTP lets an on-path attacker forge hook responses (which
control agent execution), and `coder server` logs a startup warning
(with a redacted hook URL) when hooks run over plain HTTP.

Docs, generated API types, and the server config golden are updated
accordingly.

> Mux acted on Mike's behalf to create this PR.
 2026-08-05 22:41:17 +02:00
Andrew Aquino 3e2a8bd421 fix(site/src): show tooltip in AppLink + WorkspacesTable when coder_app URL is invalid (#27556) 
fixes DEVEX-70

## Summary

Fixes #22350.

`getAppHref()` in `site/src/modules/apps/apps.ts` called `new
URL(app.url)` unguarded for external apps. When a template author
configures a `coder_app` with an unparseable `url` (e.g. a bare string
like `"my-repo"` with no scheme), `new URL()` threw `TypeError: Failed
to construct 'URL': Invalid URL` during render. Because `getAppHref`
runs inside `useAppLink` (used by both `AppLink` and the workspaces
table `IconAppLink`), the exception crashed the entire Workspace List
and Workspace detail pages, not just the affected app button.

## Changes

- `getAppHref()` no longer throws: the external-app protocol parse is
wrapped in `try/catch`, so an unparseable URL falls back to the raw
value instead of crashing.
- Added `isExternalAppUrlInvalid(app)`, a pure predicate used by
consumers to decide whether the app can be launched.
- `AppLink` renders a disabled button with a warning icon and an
explanatory tooltip when the URL is invalid, mirroring the existing
"admin has not configured subdomain application access" pattern. The
tooltip points the user at the responsible configuration:
> This app has an invalid URL and can't be opened. Ask your template
administrator to fix the app's `url` in the template's `coder_app`
configuration.
- `IconAppLink` (workspaces table) renders a non-navigating icon with an
equivalent label for invalid URLs.

## Testing

- Unit tests in `apps.test.ts`: `getAppHref` no longer throws for
invalid URLs, plus coverage of `isExternalAppUrlInvalid`.
- New `InvalidExternalAppUrl` Storybook story with a `play` function
asserting the button is disabled and the tooltip explains the invalid
URL.
- `pnpm exec vitest run` (unit + storybook), `pnpm exec tsc --noEmit`,
and `biome check` all pass.

<details>
<summary>Implementation plan</summary>

# Plan: Handle invalid `coder_app` URLs gracefully (issue #22350)

## Problem

`getAppHref()` in `site/src/modules/apps/apps.ts` calls `new
URL(app.url)`
unguarded for external apps. When a template author sets an external app
with
an unparseable `url` (e.g. a bare string like `"my-repo"` with no
scheme),
`new URL()` throws during render. Because `getAppHref` runs inside
`useAppLink` (called during render of `AppLink` and `IconAppLink`), the
exception propagates and crashes the entire Workspace List and Workspace
detail pages, not just the single app button.

## Goal

Never throw from `getAppHref`. Detect the invalid-URL case and let the
UI
render a disabled button with an explanatory tooltip, mirroring the
existing
`isAppBlockedByMissingWildcard` pattern.

## Approach

1. Make `getAppHref` non-throwing (defensive), so no render path can
crash.
2. Add a pure predicate `isExternalAppUrlInvalid(app)` used by button
   components to decide whether to disable and what tooltip to show.
3. Wire the predicate into `AppLink` and `IconAppLink`.

## Changes

- `apps.ts`: wrap the external protocol parse in `try/catch`; add
  `isExternalAppUrlInvalid`.
- `AppLink.tsx`: disabled state with `text-content-warning` icon and a
`ReactNode` (React Fragment) tooltip with `url` and `coder_app` wrapped
in
  inline `<code>` elements.
- `WorkspacesTable.tsx` (`IconAppLink`): render a non-navigating icon
when
  the URL is invalid.

## Tests

- `apps.test.ts`: `getAppHref` does not throw for invalid URLs;
predicate
  coverage.
- `AppLink.stories.tsx`: `InvalidExternalAppUrl` story with a `play`
function
  asserting disabled button and tooltip.

## Out of scope

Backend/template-side validation of `coder_app.url` would prevent the
misconfiguration at its source; tracked by the parent epic (#22349 /
DEVEX-60).

</details>

---

*Opened by Coder Agents on behalf of @aqandrew.*
 2026-08-05 13:37:40 -07:00
dylanhuff-at-coder 76ae64391a refactor(codersdk): use ReadBodyAsJSON in typed endpoints (#27857) 
This PR migrates 224 typed JSON response sites across 46 files to
`codersdk.ReadBodyAsJSON`, so invalid 2xx bodies return structured
errors while preserving URL credential redaction.

It intentionally excludes agent-direct HTTP, Azure IMDS, `UseNumber`,
and chat paths; stacked on coder/coder#27804, with chat and lint
follow-ups in coder/coder#27858 and coder/coder#27859. Refs
coder/coder#27044.

Reviewed and updated by Coder Agents on behalf of @dylanhuff-at-coder.
 2026-08-05 13:22:23 -07:00
Danielle Maywood 0c88c2accc refactor(site): migrate chats query keys to collections/entities taxonomy (#27841) 2026-08-05 21:19:41 +01:00
Bobby Ho 97c4031526 feat!: resolve agent external auth by template, not config order (#27854) 
## TL;DR

**Problem.** A template can declare which external auth provider it
wants via `data "coder_external_auth" { id = "..." }`, and that
declaration is honored at every stage of the build. It was ignored at
runtime. Any git operation going through `GIT_ASKPASS` supplies only a
hostname, never a provider ID, and the handler scanned *every* provider
configured on the deployment and returned whichever matched the hostname
**last in config order**, with no reference to what the requesting
workspace's own template declared. Reordering
`CODER_EXTERNAL_AUTH_<N>_*` silently redirected a plain `git clone` from
one OAuth client's token to a completely different one.

**Fix.** For hostname-only requests, resolve the calling agent's
workspace and build *before* selecting a provider, then narrow
candidates to the providers declared by that build's template version.
Exactly one match wins regardless of config order. No matching declared
provider falls back to today's deployment-wide scan, so a template that
declares only a GitHub provider can still clone an unrelated host. Two
or more matching declared providers return `409` naming them, rather
than picking one arbitrarily: `external_auth_providers` is stored sorted
by ID, so HCL declaration order is already unavailable and no principled
tie-break exists.

Requests supplying an explicit provider ID are untouched. Server-side
only: no wire protocol, proto, manifest, or database schema change, so
already-running agents get the corrected behavior on their next askpass
call with no restart.

Refs #23718

<details>
<summary><b>Call flow</b></summary>

```mermaid
flowchart TD
    subgraph Push["1. Template import: coder templates push"]
        A1["Terraform extracts coder_external_auth id/optional attrs"]
        A2["CompleteJob(TemplateImport) validates each id<br/>against deployment config"]
        A4["template_versions.external_auth_providers persisted"]
        A1 --> A2 --> A4
    end

    subgraph PreBuild["2. Pre-build and workspace build (unaffected)"]
        B1["User authenticates declared provider(s), exact-ID lookup"]
        B2["Build resolves token by exact ID<br/>(provisionerdserver.go)"]
        A4 --> B1 --> B2
    end

    subgraph Runtime["3. Workspace running: a credential is needed"]
        B2 --> C0{"Caller supplies id or match?"}
        C0 -->|"id (explicit)"| D1["Exact-ID match<br/>UNCHANGED, already deterministic<br/>(coder external-auth access-token)"]
        C0 -->|"match only (GIT_ASKPASS)"| C1["git needs credentials for a hostname<br/>GIT_ASKPASS invoked, unchanged"]
        C1 --> C2["coder gitaskpass sends ExternalAuthRequest{Match: host}<br/>unchanged (cli/gitaskpass.go)"]
        C2 --> C3["workspaceAgentsExternalAuth<br/>(coderd/workspaceagents.go)"]
        C3 --> C4["CHANGED:<br/>1. resolve workspace/build BEFORE matching<br/>2. read that build's declared provider IDs<br/>3. filter: declared AND regex matches host"]
        C4 --> C5{"how many candidates?"}
        C5 -->|"exactly 1"| C6["use it, regardless of config order"]
        C5 -->|"0"| C7["fall back to deployment-wide scan<br/>(unchanged legacy behavior)"]
        C5 -->|"2 or more"| C8["409 naming every matching ID"]
    end

    D1 --> E1["Token returned"]
    C6 --> E1
    C7 --> E1

    style C4 fill:#1f4d2e,stroke:#4caf50,color:#fff
    style C6 fill:#1f4d2e,stroke:#4caf50,color:#fff
    style C8 fill:#1f4d2e,stroke:#4caf50,color:#fff
    style D1 fill:#333,stroke:#888,color:#fff
```

</details>

## Verification

Two test functions were added in `coderd/workspaceagents_test.go`, and
the behavior no unit test can reach was verified against a local dev
cluster with two real GitHub OAuth Apps whose regexes both match
`github.com`.

| Behavior | Unit | Manual |
|---|---|---|
| Declared provider wins over a colliding one | yes | yes |
| Outcome independent of deployment config order | yes | yes |
| No declared match falls back to the full scan | yes | yes |
| Host the template never declared still resolves | yes | via fallback |
| Two declared providers matching one host return `409` | yes | not run
|
| Declared but unauthenticated provider returns its auth URL | yes | not
run |
| Two templates resolve independently and concurrently | yes | no |
| Explicit-ID path unaffected | no | yes |
| Running agent corrected with no restart | **no** | **yes** |
| Declared ID since removed from config falls back | **no** | **yes** |
| Recomputed per build after a template update | **no** | **yes** |

The last three are properties a unit test cannot express: they involve
swapping the server binary underneath a live agent, removing deployment
configuration, and rebuilding a workspace against a new template
version.

<details>
<summary><b>Unit test detail</b></summary>

`TestWorkspaceAgentsExternalAuthTemplateScoped` builds a deployment with
two providers sharing a regex, a template declaring one of them, and a
seeded token for **every** provider, so a mis-selection returns a valid
token with the wrong identity rather than an error. Subtests:

- `DeclaredProviderLast` / `DeclaredProviderFirst`: the declared
provider wins in both config orders. Only the `First` arm is
discriminating, since the pre-change loop had no `break` and returned
the last regex match, which the `Last` arm happens to agree with.
- `NoDeclaredProvidersFallsBackToFullScan`: a template declaring nothing
keeps today's behavior exactly, pinning the legacy last-match rule.
- `UnrelatedHostStillResolvesViaFallback`: a template declaring only a
GitHub provider still resolves a GitLab host.
- `AmbiguousDeclaredSetReturnsError`: `409` whose message names both
colliding provider IDs.
- `OptionalUnauthenticatedDeclaredProviderReturnsAuthURL`: returns the
auth URL for the *declared* provider, not for an unrelated one the user
happens to hold a token for.

`TestWorkspaceAgentsExternalAuthMultipleTemplates` runs two workspaces
from two templates, each declaring a different provider, issuing
requests concurrently. Each resolves to its own template's provider.

</details>

<details>
<summary><b>Manual verification detail</b></summary>

Local dev cluster, two GitHub OAuth Apps both defaulting to
`^(https?://)?github\.com(/.*)?$`, both authorized by the workspace
owner so a wrong selection yields a usable token rather than an error.
Workspace built from a template declaring only `github-dotfiles`. Tokens
redacted.

**Order independence.** Same workspace, never rebuilt, config order
reversed between runs:

| Deployment config order | Token returned |
|---|---|
| `[github-broad, github-dotfiles]` | `gho_<dotfiles>` |
| `[github-dotfiles, github-broad]` | `gho_<dotfiles>` |

**A/B against the pre-fix binary.** Everything held constant except the
coderd build, with `/api/v2/buildinfo` checked on both sides so the
comparison rests on verified binary identity. The workspace was never
stopped, rebuilt, or re-authorized:

| coderd | buildinfo | Token | Honors declaration |
|---|---|---|---|
| pre-fix | `v2.35.3-devel+11e03cfb3a` | `gho_<broad>` | no |
| this branch | `v2.35.3-devel+e8b87d0333` | `gho_<dotfiles>` | yes |

This doubles as the demonstration that a coderd-only upgrade corrects
behavior on a live agent's next askpass call.

**Declared provider removed from config.** `github-dotfiles` deleted
from deployment configuration while the workspace's template still
declared it. Result: `HTTP/2 200` with `gho_<broad>` via the fallback.
No `500`, no fail-closed `404`. The orphaned `external_auth_link` row
remained in the database throughout and correctly had no effect.

**Recomputation after a template update.**

| Workspace state | Build's declared provider | Token returned |
|---|---|---|
| new version pushed, workspace not updated | `github-dotfiles` |
`gho_<dotfiles>` |
| after `coder update` | `github-broad` | `gho_<broad>` |

The pair is what makes it conclusive: the first rules out following the
template's newest version, the second rules out a cached value.

**Explicit-ID path.** `coder external-auth access-token github-broad`
returned that provider's result even though the template declared only
`github-dotfiles`, and did not substitute the declared provider's
already-valid token.

Raw traces were captured with `GIT_CURL_VERBOSE=1 git -c
credential.helper="" ls-remote <private repo>`, reading the unredacted
`== Info: Server auth using Basic with user '<token>'` line. A private
repo is required, since a public one never triggers a `401` and
therefore never invokes `GIT_ASKPASS`.

</details>
 2026-08-05 13:08:41 -07:00
Andrew Aquino 0a79610f7b refactor(site): show TableLoader in loading tables (#27870) 
This PR mainly replaces manually written table loader markup with our
`TableLoader` component, inspired by #27583.

## other changes

- adds some stories for some loading render paths previously untested in
Storybook:
    - loading `OrganizationMembersPageView`
    - loading `OrganizationProvisionerKeysPageView`
- `OrganizationMembersPageView`'s `NoMembers` story showed nothing (not
even an empty state) + erroneously displayed "Showing 1 to 2 of 2
members" below the table. Adds an empty state to
`OrganizationMembersTableBody` ("No members in this organization") +
updates the `membersQuery` arg in the `NoMembers` story to give an
accurate 0-member count

### before

<img width="1840" height="1191" alt="image"
src="https://github.com/user-attachments/assets/7dc310c8-286e-48a8-a18e-e4ae29afdd8b"
/>

### after

<img width="1840" height="1191" alt="image"
src="https://github.com/user-attachments/assets/206b2952-2758-4626-ba42-4c366d7902a6"
/>
 2026-08-05 13:00:52 -07:00
blinkagent[bot]andblink-so[bot] 4b6104229c chore: regenerate configuration-reference.md for bedrock placeholder (#27898) 
## What

Regenerates `docs/admin/setup/configuration-reference.md` to include the
backtick-wrapped `<region>` placeholder that was introduced at the
source in #27399.

## Why

Commit
[`9dcb75cd`](https://github.com/coder/coder/commit/9dcb75cd567ab910d3fc07f22af4108a435de00e)
(#27399) changed the Bedrock region description in
`codersdk/deployment.go` to wrap the placeholder in backticks and added
the `docshtmlcheck` linter that requires it. The sibling generated file
`docs/reference/cli/server.md` was regenerated correctly in that commit,
but `docs/admin/setup/configuration-reference.md` was missed.

As a result, subsequent CI runs on `main` fail with:

- `gen`: `check_unstaged.sh` reports a one-line diff after `make gen`:
  ```
  -...in the form of 'https://bedrock-runtime.<region>.amazonaws.com'.
  +...in the form of `https://bedrock-runtime.<region>.amazonaws.com`.
  ```
- `lint`: `docshtmlcheck` fails at `configuration-reference.md:358` with
`unknown-element: <region>`.

Example failing run:
https://github.com/coder/coder/actions/runs/31036417075

## Change

Ran `make gen`. Only `docs/admin/setup/configuration-reference.md`
changed (1 insertion, 1 deletion). No source changes.

## Verification

- `make gen` produces no further diff.
- `make lint/docs-html` exits 0.

## Linear

-
https://linear.app/codercom/issue/DOCS-551/backtick-placeholder-syntax-in-generated-reference-docs-cli-help

Created on behalf of @ibetitsmike.

Co-authored-by: blink-so[bot] <211532188+blink-so[bot]@users.noreply.github.com>
 2026-08-05 19:53:46 +00:00
david-fraley d458fe4941 fix(coderd/database): match group name case-insensitively in search (#27894) 2026-08-05 14:21:49 -05:00
Yevhenii Shcherbina dae41eb711 fix: detect out-of-range AI Gateway costs instead of wrapping silently (#27602) 
Implements:
https://linear.app/codercom/issue/AIGOV-448/use-decimal-for-cost-computation
Follow-up to https://github.com/coder/coder/pull/26229

Follow-up to the AI Gateway cost-control work. Cost is computed per
token category as `tokens × price / 1_000_000` in `int64`, then summed.
This change makes an unrepresentable result a defined outcome instead of
an accident of integer wrap-around.

## Motivation

The intermediate `tokens × price` can exceed `int64`. Real usage cannot
get there: at a $75/M model the product overflows at roughly 123 billion
tokens in a single response, about six orders of magnitude above a
maxed-out Opus request, so this is not a live incident. The problem is
what happens if it ever does, because the sign of the wrapped value
silently selects between two different failure modes, neither of which
was chosen:

1. **Wraps positive.** A plausible-looking cost is stored, incremented
into the user's daily spend, and enforced against their AI budget. No
error, no signal, wrong number.
2. **Wraps negative.** The value violates `CHECK (cost_micros >= 0)`,
the insert fails, the surrounding transaction rolls back, and
`RecordTokenUsage` returns a Postgres constraint error that says nothing
about overflow. The token usage record is lost entirely, along with its
token counts.

So the same class of bad input either corrupts budget accounting or
discards an audit record, depending on arithmetic that nobody reasoned
about. That is the undefined behaviour.

## Decision

**An unrepresentable cost is treated as bad input, not a large bill.**
Since real usage cannot produce one, it can only mean a wrong price row
or implausible provider-reported token counts. In both cases the true
cost is unknowable, so no number is stored.

**Detect rather than avoid.** `computeCost` now evaluates in `decimal`,
so nothing wraps, and range-checks the total against `[0, MaxInt64]`
before converting back. Out of range returns `errCostOutOfRange`.
Rejecting negatives in the same check also keeps them away from the
non-negative column constraint, which would otherwise discard the
record.

**Log, do not block.** The error is swallowed at the call site: the
record is written with token counts intact and `cost_micros` NULL, the
spend update is skipped, and the condition is logged at ERROR.

**Per-category truncation is unchanged.** Each category is still
truncated independently rather than the total being rounded once, so a
per-category breakdown recomputed from the snapshotted price columns
sums exactly to the stored total. Every existing `computeCost` test case
passes unmodified.
 2026-08-05 14:47:40 -04:00
Nick Vigilante 9dcb75cd56 chore: add docs inline-HTML linter and backtick generated placeholders (#27399) 
## What

Adds CI enforcement that fails when docs Markdown contains invalid
inline HTML
the docs site silently drops or mangles, and fixes the remaining
generated-doc
placeholders at their source.

This is the tooling half of the docs-HTML audit. The hand-written fixes
it
guards landed in #27298 (kept small and separate so it reviewed fast);
this PR
carries everything that touches code, CI, or generated output.

## Changes

**Linter (`scripts/docshtmlcheck`), wired into `make lint` via
`lint/docs-html`.**
Markdown-aware: parses each file with goldmark and inspects only
raw-HTML nodes,
so angle brackets in fenced code blocks, inline code, HTML comments, and
`<https://…>` / `<user@host>` autolinks are ignored. Flags swallowed
placeholders (`<region>`), void-element end tags (`</br>`), unregistered
or
incorrectly capitalized component tags (`<Image>`), and unclosed
container tags (a
`<div class="tabs">` that leaks its wrapper). The one intentional
renderer
component, `<children>`, is allowed but still balance-checked.

**Generator-source placeholder fixes (regenerated via `make gen`).**
- `codersdk/chats.go`: backtick `<server>__` in the
`ChatContextTool.Name` doc
  comment (it becomes the Swagger description, so it was swallowed in
  `reference/api/{chats,schemas}.md`).
- `codersdk/deployment.go`: backtick `<region>` in the AWS Bedrock
region flag
help (swallowed in `reference/cli/server.md`); also updates `coder
server
  --help` output and the golden files.

**Temporary allowlist.** `docs/reference/cli/agent-firewall.md`'s
`<host>` /
`<glob>` come from the external `github.com/coder/boundary` CLI help
(still
`v0.10.0` on `main`), so they are suppressed on that one file. The
suppression
is self-clearing: if an allowlisted tag stops appearing on a scanned
file, the
linter reports `stale-allowlist-entry` and fails until the dead entry is
removed, so a dead entry cannot silently mask a later regression of that
tag on
that page. (An entry whose file is deleted outright is never rescanned,
but a
missing file yields no findings, so nothing hides behind it either.)

## Review feedback addressed

This tool + generator work was reviewed by Coder Agents Review while it
was
bundled into #27298. Addressed here:

- **P1:** tokenize each raw-HTML node as a whole instead of per source
line, so
a tag whose attributes wrap across lines is no longer torn in half. This
fixes
both the missed multi-line unclosed `<div>` (a leaked wrapper that
passed with
exit 0) and the spurious `stray-end-tag` on valid multi-line tags. Each
token
  maps back to its own source line.
- Normalize allowlist lookup/report paths to a canonical repo-relative
form, so
the escape hatch no longer silently misses under absolute / `./` paths.
- Route generated-page findings to the generator source.
- Add `<search>` to the allowed set; reword the unknown-element message
to note
  that a real element can be added to `allowedElements`.
- Self-clearing allowlist guard (above); rename `optionalEndTag(s)` and
`kindUnclosed(Tag)`; adopt `slices`/`maps` idioms; move the lint banner
to the
  Makefile recipe; stop aliasing the input slice in `filterAllowed`.
- New tests: multi-line tokenization (both classes), interleaved
nesting, a
  pinned line number, `collectMarkdown`, and the stale-allowlist guard.

### Round 2 (Coder Agents Review on this PR)

A second `/coder-agents-review` pass on this PR raised 16 findings;
addressed in
`fix(docshtmlcheck): catch self-closing containers and capitalized
tags`:

- **P2:** self-closing container tags (`<div class="tabs"/>`) were
ignored by
the HTML5 parser and leaked their wrapper like the open spelling; the
balance
  check now tracks self-closing tokens too (CRF-1).
- **P2:** a capitalized component tag whose lowercase name is a real
element
(`<Table>`, `<Section>`) slipped through on the `allowedElements`
lookup. The
tokenizer lowercases tag names, so the check now reads the raw token and
  reports any capitalized name as a component reference (CRF-2).
- Narrowed the `:` / `@` autolink skip to a real URI scheme or a dotted
`local@domain`, so `<region:id>` and `<user@host>` stay checked (CRF-3).
- Stale-allowlist findings now report against the linter source with no
line,
and count separately from invalid-HTML issues in the footer (CRF-7,
CRF-11).
- Comment / README / Makefile wording synced to the honest
capitalized-tag
  behavior; added the deleted-file allowlist caveat and a note that
`allowedElements` is hand-maintained against the renderer (CRF-14,
CRF-17,
  CRF-9).
- Internal cleanups (`pop` -> `matchEndTag`, extracted
`unclosedFinding`) and
new tests: self-closing, capitalized open/close, colon/at placeholders,
a
non-first-token line assertion, `isGeneratedDoc`, and the stale message
  (CRF-12, CRF-13, CRF-1/2/3/4/5/16).

Two findings resolved without a code change:

- **CRF-8** (also wire `lint/docs-html` into `lint-light`): declined.
  `lint-light` is the Go-free fast path; `lint/docs-html` needs the Go
toolchain, so it stays in the full `make lint`, which CI runs. Adding it
would
  pull Go into the light path for no coverage gain.
- **CRF-9** (`allowedElements` <-> renderer coupling): documented with a
maintenance note in the `allowedElements` comment and tracked in
DOCS-597 for
  a cross-repo sync/check decision.

Deferred (note, no current trigger): raw-text element interiors
(`<script>` / `<style>`) are not scanned for nested tags. No docs page
relies
on this today; noted for follow-up.

## Merge order

#27298 (the hand-written fixes this PR guards) has merged, and this
branch is
rebased on `main`, so `make lint/docs-html` now reports 0 findings and
the
`lint` check passes. The two PRs are independent (disjoint files, no
stacking).

## Verification

- `go test ./scripts/docshtmlcheck/`, `go vet`, `gofmt -l`,
`golangci-lint run`: clean.
- `make lint/docs-html` (branch rebased on `main`): 0 findings.

## Linear

- DOCS-584:
https://linear.app/codercom/issue/DOCS-584/add-ci-check-that-fails-on-invalid-inline-html-in-docs
- DOCS-551:
https://linear.app/codercom/issue/DOCS-551/backtick-placeholder-syntax-in-generated-reference-docs-cli-help
- DOCS-597 (follow-up, from CRF-9):
https://linear.app/codercom/issue/DOCS-597/track-docshtmlcheck-allowedelements-drift-vs-docs-renderer-component

> This PR was created with AI assistance (Coder Agents).
 2026-08-05 14:45:45 -04:00
dylanhuff-at-coder db68c6c9fe fix: add codersdk JSON response decoder for typed API endpoints (#27804) 
`coder whoami` and `coder list` can surface low-level JSON decode errors
when a reverse proxy, SSO portal, or incorrect Coder URL returns HTML
with a successful HTTP status.

Add a shared SDK JSON response decoder and use it for the user and
workspace list endpoints so these commands return a structured,
actionable API response error instead. Refs #27044

Reviewed and updated by Coder Agents on behalf of @dylanhuff-at-coder.
 2026-08-05 10:42:13 -07:00
Bobby HoandClaude Sonnet 5 d814dfad88 feat(coderd): support public OAuth2 client tokens at the schema layer (#27712) 
Layer 1 of a multi-PR split of #27195 (public/secretless PKCE-only
OAuth2 clients), broken up for easier review: **database schema (this
PR)** → oauth2provider handler logic → API/e2e integration tests.

## Goal

Coder's OAuth2 provider only works correctly for confidential clients
today. Public clients — native apps that can't safely hold a shared
secret, such as the CLI's browser-based login flow, IDE plugins (VS
Code, JetBrains), desktop apps, and MCP clients — cannot complete a real
OAuth2 flow against Coder, even though OAuth 2.1 §2.1 explicitly defines
this client type and RFC 8252 §8.5 requires PKCE alone to be sufficient
authentication for it. Every MCP client, CLI login flow, and IDE plugin
is a public client by construction, and none of them can complete a
secretless flow against Coder today: dynamic registration always
classifies a client as confidential regardless of what it asks for, the
token endpoint unconditionally requires a `client_secret`, and discovery
metadata never advertises `"none"` as a supported auth method.

Full write-up:
[ENG-3029](https://linear.app/codercom/issue/ENG-3029/oauth2-support-public-client)

### Overall design (end state across the full PR stack)

`[PR2]` marks handler-layer changes landing in the next PR in this
stack. The green box is what this PR implements.

```mermaid
sequenceDiagram
    autonumber
    participant C as Public Client (CLI/MCP/IDE plugin)
    participant S as coderd (chi router)
    participant H as oauth2provider handlers
    participant DB as PostgreSQL

    Note over C,S: Discovery
    C->>S: GET /.well-known/oauth-authorization-server
    S->>H: GetAuthorizationServerMetadata()
    Note over H: [PR2] add "none" to<br/>the returned auth methods list
    H-->>C: [PR2] 200 { token_endpoint_auth_methods_supported:<br/>[..., "none"] }

    Note over C,S: Dynamic Client Registration
    C->>S: POST /oauth2/register<br/>{redirect_uris, token_endpoint_auth_method: "none"}
    S->>H: CreateDynamicClientRegistration()
    Note over H: [PR2] client type now reads<br/>the request -> "public"
    Note over H: [PR2] skip secret generation<br/>for public clients
    H->>DB: [PR2] INSERT app row<br/>(client_type = 'public')
    DB-->>H: app row
    Note over H: [PR2] skip secret insert entirely
    H-->>C: [PR2] 201 { client_id }<br/>(no client_secret field)

    Note over C,S: Authorization Code + PKCE flow
    C->>S: GET /oauth2/authorize?client_id=...&code_challenge=...
    C->>S: POST /oauth2/tokens (grant_type=authorization_code)<br/>no client_secret
    S->>H: extractTokenRequest()
    Note over H: [PR2] client_secret no longer required<br/>for public clients
    H->>H: authorizationCodeGrant()
    Note over H: [PR2] skip secret lookup for public clients
    Note over H: PKCE verification — already mandatory, unchanged
    rect rgb(198, 239, 206)
    Note over H,DB: [THIS PR] oauth2_provider_app_tokens.app_id<br/>column added (NOT NULL, populated at insert<br/>time from app.ID) and app_secret_id loosened<br/>to nullable. Revocation now checks app_id<br/>directly. Confidential-client behavior is<br/>unchanged — no public client can be created yet.
    H->>DB: [PR2] INSERT refresh token row<br/>(no secret reference, for public clients)
    end
    DB-->>H: token row
    H-->>C: 200 { access_token, refresh_token }
```

## This PR: database schema

A public client has no `client_secret`, so it has nothing to put in
`oauth2_provider_app_tokens.app_secret_id`, which was `NOT NULL`. This
PR makes that column nullable and instead attributes a token to its
owning app through a new, always-populated `app_id` column — so
ownership checks (e.g. revocation) work identically for public and
confidential clients without joining through a secret that may not
exist.

| Column | Before | After (this PR) |
|---|---|---|
| `app_secret_id` | `uuid NOT NULL` | **nullable** |
| `app_id` | — | **new**: `uuid NOT NULL`, `FOREIGN KEY →
oauth2_provider_apps(id) ON DELETE CASCADE`, backfilled for every
existing row and populated on every new insert from that point on |

This is a single, complete migration — not staged across multiple PRs.
An earlier version of this branch deferred `app_secret_id`'s nullability
and the insert-time population of `app_id` to a later PR, keeping this
PR's diff limited to `coderd/database`. [Automated
review](https://github.com/coder/coder/pull/27712#discussion_r3686851911)
correctly flagged that as unsafe: the migration would backfill existing
rows once, but nothing would populate `app_id` for rows written
afterward, so the moment this PR merged, new tokens would start
accumulating a permanently `NULL` app_id — and if a release happened to
be cut before the follow-up PR landed, that gap could ship to customers
and would need a second, later backfill to close. Doing the full
migration now avoids that: `app_id` is correct from the first row
written, and the promised `NOT NULL` constraint requires no data repair
because it's already enforced.

Closing that gap requires a few mechanical, non-branching touches
outside `coderd/database`:
- `revoke.go`'s two ownership checks now compare `dbToken.AppID`
directly instead of looking up the app through `app_secret_id` — a
genuine simplification (and slightly less code), not a temporary shim.
- `tokens.go`'s two `InsertOAuth2ProviderAppToken` call sites supply the
new `app_id` column and wrap `app_secret_id` as a `NullUUID`.
- `oauth2_test.go`'s one direct-insert test fixture does the same.

None of these introduce client-type branching or new capability — every
client today is still confidential-only, still always presents a secret,
and behavior is unchanged. The full repo builds, vets, and all existing
tests pass unmodified in behavior.

## Coming next

- **PR2 (handler layer)**: `codersdk`'s `DetermineClientType()` reading
the requested `token_endpoint_auth_method`; `registration.go` skipping
secret generation for public clients (and wrapping the app+secret insert
in a single transaction, fixing a pre-existing
orphan-row/visibility-race gap); `tokens.go` making the secret check
conditional so PKCE alone authenticates a public client; `metadata.go`
advertising `"none"` in discovery. No further migration is needed — the
schema this PR ships is already final.
- **PR3 (API/e2e layer)**: integration tests through the real HTTP API
(`coderd/oauth2_test.go`), the MCP OAuth2 e2e flow
(`coderd/mcp/mcp_e2e_test.go`), and the manual test script
(`scripts/oauth2/test-mcp-oauth2.sh`).

Depends on: #27195 (original combined PR, being superseded by this
stack)

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
 2026-08-05 10:41:06 -07:00
Jake Howell 120ec1f318 chore(site): use <TableEmpty /> for table empty states (#27583) 
## Summary
Standardize table empty and error rows on shared `TableEmpty` so they
share the same large empty treatment instead of one-off markup or manual
`EmptyState` wrappers.

- Replace hand-rolled `text-center` empties (External Auth, OAuth2
apps/secrets/authorized apps, Tasks)
- Swap `TableRow`/`TableCell` + `EmptyState` wrappers to `TableEmpty`
across audit/connection logs, groups, roles, IdP sync, provisioners,
users, versions, permissions, banners, and workspace sharing
- Drop redundant padding wrappers on Users and Versions tables
- Add an Empty story for External Auth settings
 2026-08-05 14:28:53 +00:00
Danielle Maywood 5ed73f06ad fix(site/src/pages/AgentsPage): show error state with retry when chat fetch fails (#27887) 2026-08-05 14:50:17 +01:00
Cian Johnston c62079c053 refactor(coderd): optimize chatdebug (#27129) 
Adds a bund of optimizations to chatdebug:

In `coderd/x/chatd/chatdebug`:
- Adds a benchmark (excluding LLM and database stuff)
- Replaces string concatenation with strings.Builder when accumulating
stream parts (~105,000ns -> ~50,00ns)
- Removes double JSON encode in RecordingTransport (114,000ns ->
64,000ns)

In `coderd/util/strings`:
- Adds a benchmark for Truncate
- Removes unnecessary allocations in Truncate (~110,000ns -> 1,550ns in
truncation case, 1 alloc -> 0 allocs in no truncation case)

> 🤖 Claude helped with this.
 2026-08-05 11:59:37 +01:00
Jake HowellandDanielle Maywood 05baba1e63 test(site): fix failing Storybook play functions (#27874) 
Fixes several Storybook play function failures that show up in Pixel
(and some that fail under `vitest --project=storybook`).

### Component / behavior
- **DurationField**: restore digit-only filtering so non-numeric input
is stripped again. A demui pass had stopped filtering and relied on
`pattern`, which does not prevent typing.

### Pixel viewport mismatches
Pixel ignores Storybook viewport params. Shared helpers
`pixelWithDesktop` / `pixelWithPhone` live in `testHelpers/pixel.ts`.
- **NavbarView**: admin dropdown stories are desktop-only. Pixel tablet
is 744px, below Tailwind `md` (768px), so Admin settings is hidden and
the play click fails. `MobileMenu` already covers the collapsed navbar.
- **AgentPageHeader**: mobile meatball menu story is phone-only. At
laptop width `sm:hidden` keeps "More options" out of the a11y tree even
when `matchMedia` is mocked as mobile.

### Story assertion fixes
- **WorkspaceSettingsPageView**: Formik passes helpers as a second
`onSubmit` argument; the assertion now allows that.
- **AgentChatPageView**: sidebar tab persistence stories use Git instead
of Terminal. Clicking Terminal mounts xterm, which throws an unhandled
`dimensions` error and fails the run even when tab assertions pass.
- **NetworkCallsTable / Blocked Badge**: badge copy is split across an
`sr-only` span and the count; assertion matches combined `textContent`.
- **CreateOAuth2AppPageView / Default**: wait for Formik
validate-on-mount before asserting the submit button is disabled.
- **NotificationEvents / Change Method** (+ Error): combobox accessible
name is now `Notification method for ${template}`; match with a regex.
- **DynamicClientRegistrationSetting / Keeps Focus While Updating**:
wait for the Enable label after the harness finishes the request.

Pixel logs play failures but still exits 0, so these can stay green in
CI while failing in the Pixel report.

---------

Co-authored-by: Danielle Maywood <danielle@themaywoods.com>
 2026-08-05 10:06:34 +00:00
Jake Howell 7a4ae2649e refactor(site): replace MUI Stack, TextField, and Link with shared components (#27817) 
> 🤖 This PR was modified by Coder Agents on behalf of Jake Howell.

Continue the MUI → Tailwind/shadcn migration across a few auth and
settings surfaces.

- Create token form: MUI `TextField`/`MenuItem` → `FormField`, `Select`,
and `Input` (drops Emotion for section min-width)
- Create organization form: `TextField` → `FormField` / `Textarea`,
matching the organization info form
- SSO security section and external auth: MUI `Link`/`TextField` →
shared `Link`, `Input`, and `Label`
- Permission and IdP pill lists: MUI `Stack` → `flex flex-row gap-2`
- Minor link layout polish on Git device auth / external auth pages

---

_Also removes the now-unused `@emotion/css` dependency from
`site/package.json` (and the lockfile), which was the last usage of it.
This fixes the `knip` CI lint failure ("Unused dependencies:
@emotion/css")._
 2026-08-05 14:07:04 +10:00
Ethan 1702bbb816 test(coderd/x/chatd): accept query cancellation in subagent wait (#27818) 
Closes CODAGT-877
Closes https://github.com/coder/internal/issues/1437

The linked flake happens because the context deadline can be observed as
`context.DeadlineExceeded`, or as a PostgreSQL query cancellation when a
database call is in flight. The fix is just to assert that the deadline
expired and the returned error is a recognised query cancellation,
rather than depending on which layer notices it first.
 2026-08-05 11:40:00 +10:00
Ethan cb992b35fd test(site): isolate httptest server clients (#27769) 
Closes ENG-3094
Closes https://github.com/coder/internal/issues/582

The flake was caused by `TestServingBin` using `&http.Client{}`, which
shares `http.DefaultTransport` with every parallel test in the binary.
When another `httptest.Server` closed, it called `CloseIdleConnections`
on the shared transport and could break our request. I couldn't
replicate this locally, but the error comes directly from that cleanup
path.

The fix is just to use each test server's `Client()`, which has its own
transport. I've also updated `TestServingFiles`, as it had the same
setup.
 2026-08-05 11:39:45 +10:00
Ben Potter 79723db2d2 docs: replace enterprise-base image references with example-base (#27025) 
Follow-up to #27018, sweeping the remaining
`codercom/enterprise-base:ubuntu` references to
`codercom/example-base:ubuntu` and `coder/enterprise-images` links to
[coder/images](https://github.com/coder/images). The `example-` prefix
is the recommended one for new deployments per the coder/images README.

Covers the 11 docs pages flagged by doc-check on #27018 plus the
embedded `examples/templates/docker` and `examples/templates/kubernetes`
starter templates (image string only; the `image` variable lives in the
coder/registry templates, see coder/registry#943).

OpenShift imagestream names in `docs/install/openshift.md` keep the
`enterprise-base` local name; only the upstream image reference changed.

Part of DEVREL-201.

🤖 Generated with Coder Agents using Claude, on behalf of @bpmct
 2026-08-04 13:47:55 -07:00
Andrew Aquino ca3de3c8c5 fix(site): allow only template admins/owners to navigate to template version pages by clicking VersionRow (#27550) 
fixes DEVEX-486

From `TemplateVersionsPage`
(/templates/:organization/:template/versions), users navigate to
individual template version pages (`TemplateVersionPage`, i.e.,
/templates/:organization/:template/versions/:version) by clicking
`VersionRow`.

This PR makes this click-to-navigate behavior on `VersionRow` available
to admin/owner users only, per @matifali's suggestion
 2026-08-04 13:27:00 -07:00
Michael Suchacz d40c4f77b9 feat(dogfood/coder): add agent-browser live preview app (#27838) 
Gives dogfood workspaces a live view of what the coding agent's browser
is doing, using the
[agent-browser](https://github.com/vercel-labs/agent-browser) dashboard
embedded as a regular workspace app. This is the dogfood-only POC phase
to validate the approach; no product code changes.

- `install-deps` installs a pinned agent-browser, seeds the
version-matched skill into `~/.claude/skills` and `~/.agents/skills`,
and starts the dashboard (self-daemonizing, idempotent) on
`127.0.0.1:4848`.
- New `agent-browser` coder_app embeds the dashboard: it auto-appears as
a tab on the Tasks page and can be added as a workspace_app tab in the
Agents right panel.

Notes for review:

- The version is pinned to 0.33.2. I verified that release's dashboard
sends no `X-Frame-Options`/CSP headers (embeddability is not a
documented upstream contract, so it must be re-verified on bumps).
- The slug is deliberately not `preview`; Tasks special-cases that slug
for the app-under-development toolbar (`WorkspaceAppFrame.tsx`).
- The dashboard itself is unauthenticated, so exposure is controlled
entirely by the app share level (`owner`).
- Example-template and docs changes were dropped from this PR on
purpose; they can follow once the approach is validated on dogfood.

Validation: `terraform fmt`/`validate` on the template and a local
frameability check of the pinned dashboard release.

> Mux worked on this on Mike's behalf.

<!-- mux-attribution: model=claude-sonnet-4-x thinking=high -->
 2026-08-04 21:58:57 +02:00
Matt Vollmer 1c993c7c5c refactor: remove introductory access banner from /agents page (#27865) 
## Summary

Removes the "Introductory access to Coder Agents through September 2026"
text and its now-unused `docs` import from the `/agents` page
(`AgentCreateForm.tsx`).

## Changes

- Removed the `<p>` element containing the introductory access link and
text below the chat input
- Removed the now-unused `docs` import (it was only referenced by that
link)

## Testing

No stories or tests referenced the removed text, so no test updates are
needed.

---

PR generated with Coder Agents
 2026-08-04 19:39:12 +00:00
Yevhenii Shcherbina 11427066a1 fix: require bedrock model fields for the invoke-model protocol (#27846) 
Implements:
https://linear.app/codercom/issue/AIGOV-564/aibridge-bedrock-provider-skipped-404-on-all-routes-when-settings-omit

Improves validation when creating and updating AI providers: a Bedrock
provider using the `invoke-model` protocol now requires `model` and
`small_fast_model`.

This brings API validation in sync with the UI, which already required
both fields.
 2026-08-04 15:21:23 -04:00
Nick Vigilante 10b366cb7c docs(docs/.style/style-guide): fix self-violating examples (#27849) 
Two internal-consistency fixes in the prose style guide, found while
auditing it against ASD-STE100 (Simplified Technical English).

The directional-language section in `accessibility-and-inclusion.md`
used "See the [Latin abbreviations rule]" as a **Do** example and
recommended "see the following section" in its replacements table. Both
violate the navigational-"see" ban that `word-choice.md` applies to all
docs, so the examples now use "refer to".

The one-sentence-per-line **Do** and **Don't** examples in
`formatting.md` were byte-identical single source lines, so the
**Don't** examples demonstrated no violation. Blockquotes re-join lines
when rendered, which is why the broken examples went unnoticed. The
examples are now fenced `md` blocks that show the actual source line
breaks (clause breaks and fixed-column wrap).

---

🤖 Built with AI assistance.
 2026-08-04 15:07:05 -04:00
dylanhuff-at-coder 87494c4f88 test(agent): de-flake TestAgent_Session_EnvironmentVariables (#27803) 
The environment-variable and secret-injection tests reused one
long-lived SSH shell, so a closed channel caused later checks to fail
with `EOF` and could allow scan-based assertions to pass without finding
a value. They now share only the SSH client and use a fresh,
deadline-bound session for each variable, isolating failures while
preserving environment-precedence coverage.

Closes https://linear.app/codercom/issue/PLAT-310.

Reviewed and updated by Coder Agents on behalf of @dylanhuff-at-coder.
 2026-08-04 11:50:57 -07:00
TJ 5f3b8755ac feat(site): tighten base infra step grid and card typography (#27797) 
Updates the base infrastructure step, base parameters step, and module
screens in the template builder for typography consistency.

**Base infra step**
- Grid gains a `xl:grid-cols-4` tier while keeping `lg:grid-cols-3`, so
no width band gets looser than before.
- Card title: `text-sm font-bold`.
- Card description and `View details` link: `text-xs font-normal`.

**Base parameters step**
- Body copy in the README markdown unified to `text-xs`.
- List item text and `::marker` inherit `text-content-secondary` so
bullets match paragraph color.
- Inline `<code>` inherits body size instead of hardcoded `text-sm`.
- `ConfigurationField` description slots (`SelectField`, `RadioField`,
`SwitchField`, `SwitchGroupField`) now use `text-xs`. The `TextField`
path already rendered `text-xs` via `FormField` and is unchanged.
- Headings unchanged.

**Module screens (for consistency)**
- `ModuleSelectStep`: same additive `xl:grid-cols-4` tier; empty-state
copy moves to `text-xs`.
- `ModuleCard`: matches `TemplateCard` (title `text-sm font-bold`,
description and link `text-xs font-normal`).
- `ModuleConfiguration`: 'No configuration required' notice moves to
`text-xs`.
- `ModuleSettingsStep`: sensitive-variable notice moves to `text-xs`.
- `TemplateCustomizationsStep` `BaseTemplateCard` heading matches card
title style (`text-sm font-bold`).

---
_This PR was generated on behalf of @tracyjohnsonux by the Coder agent._
 2026-08-04 16:29:02 +00:00
Jake Howell 3640b69533 refactor(site): demui AgentRow and AgentStatus (#27789) 
Migrate agent row log expand/collapse and agent status troubleshooting
link off MUI onto shared Collapsible and Link primitives.

Replaces `Collapse` in `AgentRow` with `Collapsible` /
`CollapsibleTrigger` / `CollapsibleContent`, and swaps the MUI `Link` in
`AgentStatus` for the shared `Link` component.
 2026-08-05 02:11:55 +10:00
Jake Howell df1700916e refactor(site): demui create template gallery and form (#27788) 
Migrate the create template gallery page and create template form off
MUI and Emotion onto Tailwind and shared form/link primitives
(`FormField`, `Textarea`, `Link`).
 2026-08-05 02:11:44 +10:00
Bobby Ho 8a510314df fix(enterprise/coderd): deflake TestPrebuildsAutobuild prebuild waits (#27601) 
## Summary

Each of the five `TestPrebuildsAutobuild` subtests spent about 30
seconds of its 60 second context budget waiting for a prebuilt workspace
whose build job had already been created and queued. On a quiet machine
the remaining budget is enough and the test passes; under
`test-go-race-pg` it is not, and the subtest fails at `found 0 running
prebuilds so far, want 1`.

Worth being precise about the shape, because it changes the fix: this is
not a data race. The 30 second stall is deterministic and every run pays
it in full. Only the *failure* is intermittent, because it depends on
whether the leftover budget covers the rest of the test.

Refs: https://github.com/coder/internal/issues/1578

## Problem

`StoreReconciler` publishes `provisioner_job_posted` to pubsub so that
provisionerd wakes up and acquires a newly created job. That publish
does not happen inline. `publishProvisionerJob` performs a non-blocking
send onto an internal buffered channel, and the goroutine that drains
that channel and calls `provisionerjobs.PostJob` is created inside
`StoreReconciler.Run`:

```go
// enterprise/coderd/prebuilds/reconcile.go, inside Run()
wg.Add(1)
go func() {
	defer wg.Done()
	for {
		select {
		case <-ctx.Done():
			return
		case job := <-c.provisionNotifyCh:
			err := provisionerjobs.PostJob(c.pubsub, job)
			...
		}
	}
}()
```

These tests drive the reconciler directly through `SnapshotState` /
`CalculateActions` / `ReconcilePreset` and never start `Run`. The
notification therefore lands in a cap-10 channel with no reader, the
non-blocking send succeeds silently, and provisionerd does not learn
about the job until the Acquirer's 30 second backup poll fires.

Laid out as a relay across goroutines, the hand-off is severed at the
first hop:

```mermaid
flowchart LR
    subgraph G1["goroutine: test body"]
        T1["ReconcilePreset()"]
        T2["testutil.Eventually<br/>1s poll of the DB"]
    end

    subgraph G2["goroutine: Run() drain worker"]
        D["case job := &lt;-provisionNotifyCh:<br/>PostJob(pubsub, job)"]
    end

    subgraph G3["goroutine: pubsub listener"]
        H["Acquirer.jobPosted<br/>-> clearOrPend(domain)"]
    end

    subgraph G4["goroutine: domain.poll"]
        P["ticker 30s, REAL clock<br/>-> clearOrPend(domain)"]
    end

    subgraph G5["goroutine: provisionerd AcquireJob"]
        A["select { &lt;-ctx.Done() ; &lt;-clearance }"]
    end

    CH1[["provisionNotifyCh<br/>chan ProvisionerJob, cap 10"]]
    CH2[["clearance<br/>chan struct{}, cap 1"]]
    DB[("Postgres")]

    T1 -- "non-blocking send" --> CH1
    CH1 -. "NO READER:<br/>Run() never started" .-> D
    D -. "never reached" .-> H
    H -. "never fires" .-> CH2
    P -- "every 30s:<br/>the only live writer" --> CH2
    CH2 --> A
    A -- "AcquireProvisionerJob" --> DB
    T2 -- "GetRunningPrebuiltWorkspaces" --> DB

    style G2 fill:#f2f2f2,stroke-dasharray: 5 5
    style CH1 fill:#ffe5e5,stroke:#cc0000,stroke-width:2px
```

Two properties turn this into a quiet latency bug rather than an obvious
failure:

- The channel is **buffered**, so a send with no reader succeeds instead
of blocking or panicking. The writer never learns that nobody is
listening.
- `domain.poll` ticks on the **real** clock, so the test's mock clock
cannot skip it. That is the entire 30 seconds.

From the CI job that filed the ticket, every job created through the
HTTP API is picked up in about a millisecond, and only the
reconciler-created prebuild job is not:

```text
19:11:40.760  pubsub: publish  event=provisioner_job_posted      <- template import job
19:11:40.761  acquirer: got job posting                          <- picked up in 1ms
...
19:11:40.903  prebuild job scheduled  job_id=ac196e6e-...
              (no "pubsub: publish", no "acquirer: got job posting")
19:11:41 .. 19:12:10   30 x "found 0 running prebuilds so far, want 1"
19:12:10.803  acquirer: successfully acquired job  ac196e6e-...   <- 29.899s later, via backup poll
```

Corroboration from the existing test suite: `FailureTTLOnlyAfterClaimed`
had already run into this. It builds its Acquirer on a mock clock and
calls `acquirerClock.Advance(30 * time.Second)` right after reconciling,
with a comment about the backup-poll ticker. A previous author found the
same dependency and worked around it by making the poll fire instantly
rather than by restoring the notification.

### Where that lands in the test

Each subtest is three helpers called in order. They never call each
other; they communicate through Postgres plus one returned value.
`runReconciliationLoop` performs no writes itself, they all happen
inside `ReconcilePreset`, whose transaction has committed by the time it
returns.

```mermaid
sequenceDiagram
    autonumber
    participant T as test body
    participant H1 as runReconciliationLoop
    participant H2 as getRunningPrebuilds
    participant H3 as claimPrebuild
    participant R as StoreReconciler
    participant DB as Postgres
    participant PD as provisionerd

    T->>H1: (t, ctx, db, reconciler, presets)
    H1->>R: ReconcilePreset
    R->>DB: InsertWorkspace(owner=prebuilds)
    R->>DB: builder.Build -> build(start) + job(pending)
    R->>DB: COMMIT
    R->>R: publishProvisionerJob -> provisionNotifyCh<br/>non-blocking send, no reader, DROPPED
    R-->>H1: nil
    Note over H1,PD: nothing publishes provisioner_job_posted
    H1-->>T: void

    T->>H2: (t, ctx, db, want=1)
    loop 30 polls, 1s apart
        H2->>DB: GetRunningPrebuiltWorkspaces
        DB-->>H2: 0 rows (job still pending)
    end
    PD->>DB: acquire, via the 30s backup poll
    PD->>DB: CompleteJob, IsPrebuild so deadline stays zero
    H2->>DB: GetRunningPrebuiltWorkspaces
    DB-->>H2: 1 row (succeeded)
    H2->>DB: UPDATE agents SET lifecycle_state='ready'
    H2-->>T: rows, test captures prebuild.ID

    T->>H3: (client, userClient, user, version, presetID)
    H3->>DB: CreateUserWorkspace(presetID)<br/>-> ClaimPrebuiltWorkspace, requires ready
    DB-->>H3: same workspace, new owner
    H3-->>T: workspace
    Note over T: require.Equal(prebuild.ID, workspace.ID)<br/>~30s of the 60s budget already gone
```

The defect is in `runReconciliationLoop`, but the waiting, and therefore
the failing log line, is in `getRunningPrebuilds`. Note also that
`claimPrebuild` was never affected: it builds through the HTTP API,
which publishes on the normal `wsbuilder` path, so its job was always
acquired in about a millisecond. The bug was never "prebuild jobs are
slow", it was "jobs created by the reconciler, driven directly, are
never announced".

## Fix

Publish the pending provisioner jobs on the reconciler's behalf, in the
test helper, immediately after reconciling. No production code changes.

```mermaid
flowchart LR
    subgraph G1["goroutine: test body"]
        T1["ReconcilePreset()"]
        T3["NEW: post pending jobs<br/>provisionerjobs.PostJob(pb, job)"]
    end

    subgraph G3["goroutine: pubsub listener"]
        H["Acquirer.jobPosted<br/>-> clearOrPend(domain)"]
    end

    subgraph G5["goroutine: provisionerd AcquireJob"]
        A["unblocks on &lt;-clearance"]
    end

    CH2[["clearance<br/>chan struct{}, cap 1"]]
    DB[("Postgres")]

    T1 --> T3
    T3 -- "publish provisioner_job_posted" --> H
    H -- "send" --> CH2
    CH2 --> A
    A -- "AcquireProvisionerJob, ~1ms" --> DB

    style T3 fill:#e5ffe5,stroke:#007700,stroke-width:2px
```

This works because provisionerd is already subscribed and already parked
in `select { <-ctx.Done(); <-clearance }`. It needs exactly one write to
`clearance`, and today the only live writer is the 30 second poll
ticker. Publishing to pubsub gives `jobPosted` a reason to fire, and
`clearOrPendLocked` performs that write immediately.

Posting every still-`pending` job, rather than trying to identify the
one just created, keeps the helper idempotent and avoids coupling to
whichever clock stamped `created_at`. Re-posting a job that was already
acquired is harmless: the Acquirer re-queries and finds nothing.

The same three helpers after the change. `getRunningPrebuilds` collapses
to a single poll, and nothing else about the test moves:

```mermaid
sequenceDiagram
    autonumber
    participant T as test body
    participant H1 as runReconciliationLoop
    participant H2 as getRunningPrebuilds
    participant H3 as claimPrebuild
    participant R as StoreReconciler
    participant PS as Pubsub
    participant DB as Postgres
    participant PD as provisionerd

    T->>H1: (t, ctx, db, pb, reconciler, presets)
    H1->>R: ReconcilePreset
    R->>DB: InsertWorkspace + build(start) + job(pending), COMMIT
    R->>R: publishProvisionerJob still dropped<br/>(production path, unchanged)
    R-->>H1: nil
    Note over H1,DB: job row is committed and visible,<br/>which is why the query below finds it
    H1->>DB: GetProvisionerJobsCreatedAfter(zero time)
    DB-->>H1: all jobs, filtered in Go to status=pending
    H1->>PS: PostJob -> provisioner_job_posted
    PS->>PD: acquirer wakes, clearance write
    H1-->>T: void
    PD->>DB: acquire in ~1ms, then CompleteJob

    T->>H2: (t, ctx, db, want=1)
    H2->>DB: GetRunningPrebuiltWorkspaces
    DB-->>H2: 1 row (succeeded), queued_for ~3ms
    H2->>DB: UPDATE agents SET lifecycle_state='ready'
    H2-->>T: rows, test captures prebuild.ID

    T->>H3: (client, userClient, user, version, presetID)
    H3->>DB: CreateUserWorkspace(presetID) -> claim
    DB-->>H3: same workspace, new owner
    H3-->>T: workspace
    Note over T: same assertions, ~55s of budget still unspent
```

`getRunningPrebuilds` still polls, still forces agents ready,
`claimPrebuild` still claims, and every assertion is unchanged. Its
floor is now one `testutil.IntervalSlow` tick, about a second, because
`testutil.Eventually` fires on a ticker rather than checking
immediately.

Note that `publishProvisionerJob` at `reconcile.go:940` is still
dropped. That call site is correct; it simply has no drain worker behind
it when `Run` is not started. The `PostJob` added here is a manual redo
of what it already intended.

Starting `reconciler.Run(ctx)` instead would be closer to production,
but `Run` also starts a reconciliation ticker on the **mock** clock, and
these tests jump that clock by hours. Each jump would fire an
unscheduled `ReconcileAll` that rebuilds a replacement prebuild
mid-assertion, which is the opposite of what a deflake should introduce.

## Measurements

Single subtest with `-race` against Postgres, the closest local
approximation of `test-go-race-pg`, three iterations:

| Run | before | after  |
|-----|--------|--------|
| 1   | 58.85s | 30.68s |
| 2   | 55.42s | 35.64s |
| 3   | 57.47s | 31.30s |

The baseline passed all three, at 1.1s to 4.6s of margin against the 60
second context. That is the flake caught in the act: locally green, one
scheduling hiccup from red. After the change the margin is 24s to 29s.

All five subtests against real Postgres go from roughly 35s each to
6.76s each, and `queued_for` on the prebuild job drops from 29.975s to
single-digit milliseconds.

## Also in this change

Two smaller items in the same helper, both aimed at the next person to
see this symptom.

Diagnostics while waiting for prebuilds: poll count, elapsed time, and
`queued_for` (`started_at - created_at` on the provisioner job), plus a
warning naming this defect if the wait exceeds 10 seconds. `queued_for`
is the field that discriminates: about 0 means the notification arrived
and any slowness is elsewhere, about 30 seconds means it was lost and
the backup poll took over.

There is deliberately no duration computed against `completed_at`. A
single `provisioner_jobs` row mixes time bases in these tests:
`created_at` and `started_at` come from the real clock, while
`completed_at` is stamped by `CompleteJob` from the injected mock clock.
My first version of the logging did subtract them and printed
`ran_for=-22543h3m21s`.

`getRunningPrebuilds` also now resets its accumulator each poll. It
appended rows on every iteration without clearing, so an iteration that
appended and then returned early on a transient error would double count
and leave the expected count permanently unreachable, producing this
same `found N running prebuilds` symptom for an unrelated reason.
 2026-08-04 08:26:10 -07:00
Cian Johnston b169066773 chore: add more known model prices to ChatModelAdminPanel (#27839) 
Depends on https://github.com/coder/coder/pull/27837

Expand `curation.json` to include more known models.
Also marked `knownModelsGenerated.json` as generated.
 2026-08-04 16:13:06 +01:00