Previously we only showed an error when the startup script failed. Now:
- Add a warning icon to each failed script.
- Sort the failed script tabs first.
- Modify agent health messages to pull the errors notices from the new
location instead of from the single agent lifecycle enum. This means
errors are shown for each script and the count is accurate.
This was already done for the workspace creation page, but not the edit
page, as it does not share the base form, so all I did was copy that fix
into the edit page.
The username suffix could put the name past the 32 character limit,
causing the test to flake. Instead of using a suffix, match on the
expected ID instead.
Once a user has touched a field, it is better to leave it alone and display explicit validation errors over silently overwriting their inputs. Same for auto-filled values (whether from query parameters or a previous build).
This is required to prevent the agent from becoming unhealthy.
Since we are stopping the workspace now, also add a confirmation dialog.
Also add stories to test the new behavior and make a tweak to the
permissions query in support of that.
Continuation of https://github.com/coder/coder/pull/23067
Add filtering to the paginated org member endpoint (pretty much the same
as what I did in the previous PR with group members, except there I also
had to add pagination since it was missing).
Partially addresses #21813 (still need to make changes to the "add user"
button to be complete)
Since there are a lot of user tests already, I moved them into
`coderdtest` to be shared.
This was accomplished by switching from the comboxbox (which has
deselection logic) to a select (which does not).
As a side effect, the dropdowns are wider now, which seems to match
better with other inputs anyway. And, it seems it uses the `combobox`
role instead of `button` which also seems to make more sense. Lastly,
they lose some bolding.
This makes it so we can test it directly without having to go through
Tailnet, which appears to be causing flakes in CI where the requests
time out and never make it to the agent.
Takes inspiration from the container-related API endpoints.
Would probably make sense to refactor the ls tests to also go through
the API (rather than be internal tests like they are currently) but I
left those alone for now to keep the diff minimal.
Because this affects more than just the template insights
page (specifically it also affects the deployment stats endpoint which
is shown on bottom bar and Prometheus), the group is being renamed
generically to just "stats collection". In the future if we need to
affect the other stats we can put those options here.
Then, because this change only affects a portion of stats, specifically
usage stats like connection and application time, bytes sent, etc, add a
new sub-group called "usage stats".
Then finally add back the "enable" flag. This also gives us a place to
one day place an "anonymize" flag if we need to go that route.
Closes#20399
To summarize the original commit messages:
- Do not log stats to the database.
- Return errors on the insight endpoints.
- Update the frontend to show those errors.
- Also fixes an issue with getting the user status count via codersdk,
since I added a test to ensure it was not disabled by this flag and it
was sending the wrong payload.
Closes#19984
As part of this, I refactored the error template to take in a slice of
actions rather than using individual booleans and strings to control the
behavior.
We decided a link resolves the issue for now so that is what I added,
although we may want to consider a way to start the workspace and follow
the logs dynamically on that page and then show the app when finished
(similar to the tasks page), or at least make the link automatically
start the workspace instead of only taking you to the dashboard where
you have to then start the workspace.
This is to debug context timeouts on API requests to the agent.
Because rbac and database cannot be imported in slim, split the logger
middleware into slim and non-slim versions and break out the recovery
middleware.
With `%w` it prints an address instead of the error, like `<op> <url>
0xc001329370` instead of `<op> <url>: some error`, honestly idk why you
even can log with `%w` it seems like it makes no sense to use `%w`
outside of `fmt.Errorf`.
This is to help debug https://github.com/coder/internal/issues/1010.
I have been experimenting (via blink) and these seem to have made the
LLM behave more intelligently and consistently when it comes to creating
workspaces and manipulating files.
Partially addresses https://github.com/coder/internal/issues/1047
Hopefully fixes https://github.com/coder/internal/issues/993
```
file path must be absolute: "/test/some/path"
```
Not sure if this is the right fix though, since I am not sure how this
only flakes rather than always failing. It looks like starting with `/`
should not be considered absolute in Windows, but then how did it ever
pass at all?
Follows similarly to the bash tool (and some code to connect to an agent
was extracted from it).
There are two main parts: a new agent endpoint, and then a new MCP tool
that consumes that endpoint.
We were discarding all "working" updates from the screen watcher because
we cannot tell the difference between the agent or user changing the
screen, but it makes sense to accept it as the very first update,
because the agent could be working but neglected to report that fact, so
you would never get an initial "working" update (it would just
eventually go straight to "idle").
Also messages can start at zero, so I made a fix for that as well,
although the first message will be from the LLM and we ignore
those anyway, so this probably has no actual effect, but seems more
technically correct.
And it seems I forgot to actually update the last message ID, which
also does not actually matter for user messages (since I think the
SSE endpoint will not re-emit a user message it has already emitted),
but seems more technically correct to check.
Lastly, if we have the screen watcher, ignore the agent's self-reported
state and always use "working" since it is unreliable. The idle state will
eventually be caught by the watcher.
"Idle" is more accurate than "complete" since:
1. AgentAPI only knows if the screen is active; it has no way of knowing
if the task is complete.
2. The LLM might be done with its current prompt, but that does not mean
the task is complete either (it likely needs refinement).
The "complete" state will be reserved for future definition.
Additionally, in the case where the screen goes idle but the LLM never
reported a status update, we can get an idle icon without a message, and
it looks kinda janky in the UI so if there is no message I display the
state text.
Closes https://github.com/coder/internal/issues/699
Add a home and "open in new tab" button. Other controls are not
possible due to cross-origin restrictions.
Closes#18178
---------
Co-authored-by: BrunoQuaresma <bruno_nonato_quaresma@hotmail.com>
I modified the proxy host cache we already had and were using for
websocket csp headers to also include the wildcard app host, then used
those for frame-src policies.
I did not add frame-ancestors, since if I understand correctly, those
would go on the app, and this middleware does not come into play there.
Maybe we will want to add it on workspace apps like we do with cors, if
we find apps are setting it to `none` or something.
Closes https://github.com/coder/internal/issues/684
This is meant to complement the existing task reporter since the LLM
does not call it reliably.
It also includes refactoring to use the common agent flags/env vars.
It seems we do not validate external auth in the backend currently, so I
opted to do this in the frontend to match the create workspace page.
This adds a new section underneath the task prompt for external auth
that only shows when there is non-optional missing auth.
Closes#18166
Before, if a file was not found we would serve the app.
This would cause either the login page or the workspace
page to load (and consequently error because `assets` is
likely not a valid user).
The issue is that if you add a user and then immediately go to give them
permissions, you can add them but they will not show up in the UI. They
also do not show up in the audit log entry.
This is accomplished by using the members endpoint instead of the users
endpoint, and to that end the UserAutocomplete component has been
reworked to support either endpoint as separate components with a shared
base.
* Add Storybook for groups page
This ensures it is using the right endpoint for the add member dropdown.
* Add ability to mock react-query errors
This can happen if you can edit the members, for example, but not the
organization settings. In this case you will see a new summary page
instead of the edit form.
* fix: only check flag for organization settings
I added checks against the license but actually what we want is for
these views to become the default even when not licensed (once the
experimental flag is removed).
* Move deployment settings header to components
This will let us use it in the org settings pages, for a consistent
look.
* Add premium badge
* Use settings header on org pages
* Add license badges to create org page
I am not sure if there is maybe a better place for this, but maybe this
is good enough.
* Change create org form description text
It says "change", but there is nothing to change yet since this is a new
organization.
* Consistently capitalize org menu items and headings
Also, remove the "organizations" prefix since it seems redundant.
* chore: remove per-org audit links
For now at least, we will have the one audit page at /audit which lets
you filter by organization.
This also removes the need to do per-org audit permission checks.
* Filter audit org dropdown by auditable orgs
Previously all orgs you can list would appear, but you might not be
able to audit all of them.
* s/readAllUsers/viewAllUsers
Other frontend variables use the `view` syntax. Arguably we should
use `read` to match the backend, but `view` does seem more UI-like.
* Check license for organizations
All the checks now require both the experiment and license.
I also renamed the variable canViewOrganizations everywhere for
consistency.
* Allow any auditor to view the audit log
* Use fine-grained permissions on settings page
Since in addition to deployment settings this page now also includes
users, audit logs, groups, and orgs.
Since you might not be able to fetch deployment values, move all the
loaders to the individual pages instead of in the wrapping layout.
* Add stories for organization members page
Needed to break it out into a separate view to do this.
* Add stories for multi-org sidebar
* Remove multi-org check from management settings layout
We only use this layout when multi-org is enabled, so no need to run the
check a second time.
* Add more stories for deployment dropdown
* Move audit page to /deployment/audit
The existing link remains but will redirect to the new URL.
If multi-org is not enabled, nothing changes.
* Redirect organization audit page to site-wide audit page
* Always wrap audit log filters when in deployment settings
Otherwise the input is teeny tiny and barely fits a few characters.
Normally we only wrap when the screen shrinks. Again, no change
if multi-org is not enabled.
This also makes the filter menus take up available space when
wrapping (*does* apply to non-multi-org setups as well).
* Show audit log details in a tooltip
If multi-org is not enabled, details continue to be shown inline.
* Ignore organization ID in member and role audit logs
Since the organization will never change in any resources,
and the org is already on the top-level of the response.
* Add organization details and filter to audit table
These only display if the multi-org experiment is enabled.
This also includes a modification to customize the width
of the filters since with four things get a bit squishy.
* Add more audit mocks
To test different org names and no org.
* Allow creating test audits with nil org
Not all audit entries have organization IDs, so this will allow us to
test those cases.
* Add organization details to audit log queries
* Add organization to audit log response
This replaces the old ID. This is a breaking change but organizations
were not being used before.
* fix: move oauth2 routes
From /login/oauth2/* to /oauth2/*.
/login/oauth2 causes /login to no longer get served by the frontend,
even if nothing is actually served on /login itself.
* Add forgotten comment on delete
These will show up when configuring the application along with the
client ID and everything else. Should make it easier to configure the
application, otherwise you will have to go look up the URLs in the
docs (which are not yet written).
Co-authored-by: Steven Masley <stevenmasley@gmail.com>
Rather than passing all the deployment values. This is to make it
easier to generate API keys as part of the oauth flow.
I also added and fixed a test for when the lifetime is set and the
default and expiration are unset.
Co-authored-by: Steven Masley <stevenmasley@gmail.com>
Otherwise if for example you try to run `yarn storybook` it complains
that the version of Node is wrong.
`pnpm storybook` works fine and that is probably what we should
actually use, but as long as we are installing Yarn and not restricting
its use we might as well make it use the right version of Node.
It looks like we updated mockgen to use Uber's fork, but the flake still
pointed to a nixos-unstable commit containing the old mockgen resulting
in an error like:
missing go.sum entry for module providing package github.com/golang/mock/mockgen/model
* Add database tables for OAuth2 applications
These are applications that will be able to use OAuth2 to get an API key
from Coder.
* Add endpoints for managing OAuth2 applications
These let you add, update, and remove OAuth2 applications.
* Add frontend for managing OAuth2 applications
* Fit once during creation
This does not fix any bugs (that I know of) but we only need to fit once
when the terminal is created, not every time we reconnect. Granted,
currently we do not support reconnecting without refreshing anyway so it
does not really matter, but this just seems more correct.
Plus now we will not have to pass the fit addon around.
* Pass size when connecting web socket URL
I think this will solve an issue where screen does does not correctly
handle an immediate resize. It seems to ignore the resize, but even if
you send it again nothing changes, seemingly thinking it is already at
that size?
* Use new struct for decoding reconnecting pty requests
Decoding a JSON message does not touch omitted (or null) fields so once
a message with a resize comes in, every single message from that point
will cause a resize.
I am not sure if this is an actual problem in practice but at the very
least it seems unintentional.
* Remove terminalXService
This is a prelude to the change I actually want to make, which is to
send the size of the terminal on the web socket URL after we do a fit.
I have found xstate so confusing that it was easier to just rewrite it.
* Fix hanging tests
I am not really sure what ws.connected is doing but it seems to somehow
block updates. Something to do with `act()` maybe?
Basically, the useEffect creating the terminal never updates once the
config query finishes, so the web socket is never created, and the test
hangs forever.
It might have been working before only because the web socket was
created using xstate rather than useEffect and once it connected it
would unblock and React could update again but this is just a guess.
* Ignore other config changes
The terminal only cares about the renderer specifically, no need to
recreate the terminal if something else changes.
* Break out port forward URL open to util
Felt like this could be broken out to reduce the component size. Also
trying to figure out why it is causing the terminal to create multiple
times.
* Prevent handleWebLink change from recreating terminal
Depending on the timing, handleWebLink was causing the terminal to get
recreated. We only need to create the terminal once unless the render
type changes.
Recreating the terminal was also recreating the web socket pointlessly.
* Listen to web terminal keydown on capture
Instead of bubbling. I think maybe what happens here is that xterm is
capturing key presses and preventing the event from bubbling? So
setting the listener on the capture phase instead works around this.
Probably would also work to dipsose the terminal.
* Prevent issuing terminal reload when already reloading
I am not sure this actually causes any issues, but might as well.
* Ignore modifier keys for reconnecting terminal
It looks like it is possible for screen to use control sequences instead
of literal newlines which fails the tests.
This reuses the existing readUntil function used in other pty tests.
I forgot that waiting on the cond releases the lock so it was possible
to get pty output after writing the buffer but before adding the pty to
the map. To fix, add the pty to the map while under the same lock where
we read from the buffer.
The rest does not need to be behind the lock so I moved it out of
doAttach, and that also means we no longer need
waitForStateOrContextLocked.
Also, this can hit a logger error saying the attach failed which fails
the tests however it is not that the attach failed, just that the
process already ran and exited, so when the process exits do not
set an error, instead for now assume this is an expected close.
This allows specifying a command to run that can output headers for
cases where users require dynamic headers (like to authenticate to their
VPN).
The primary use case is to add this flag in SSH configs created by the
VS Code plugin, although maybe config-ssh should do the same.
* Add screen backend for reconnecting ptys
The screen portion is a port from wsep. There is an interface that lets
you choose between screen and the previous method. By default it will
choose screen if it is installed but this can be overidden (mostly for
tests).
The tests use a scanner instead of a reader now because the reader will
loop infinitely at the end of a stream.
Replace /bin/bash with bash since bash is not always in /bin.
* Remove connection_id from reconnecting PTY logger
This serves multiple connections so it makes no sense to scope it to a
single connection.
Also lets us use "connection_id" when logging write errors instead of
"other_conn_id".
* Use PATH to test buffered reconnecting pty
* Standardize on function to get workspace channel name
There were two, now there is one.
* Add some missing workspace updates
There are some failure cases where we do not set the type as a workspace
build which causes the workspace update to never be published.
* Make build failures warnings
Otherwise the associated test fails due to the logger fataling on
error messages.
Asher