mirror of
https://github.com/coder/coder.git
synced 2026-10-31 02:43:21 +08:00
79856ebd15d2b28caf90c8ddfba9ad91e6c309af
16041
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Matt Vollmer
|
79856ebd15 |
docs: reference Coder Agents instead of Coder Tasks in style guide (#28539)
## Summary Updates the Caitlin the Citizen Developer persona in the style guide to reference Coder Agents instead of the deprecated Coder Tasks product. ### Changes * `docs/.style/style-guide/audience-and-scope.md`: replaced both "Coder Tasks" mentions with "Coder Agents" in the Caitlin persona description and Coder surface list. <details><summary>Context</summary> Coder Tasks is deprecated as of v2.34 and replaced by Coder Agents. This change keeps the internal style guide's persona reference aligned with current product naming. </details> --- This PR was drafted by a Coder Agent on behalf of Matt. |
||
|
Garrett Delfosse
|
7cf24b1a37 |
docs(docs/ai-coder/agents): document the chat search: full-text filter (#28474)
Documents the `search:` full-text filter in `docs/ai-coder/agents/chat-search-syntax.md` and drafts the release notes copy for chat history search. Describes `main` plus #28319, which must merge first: stemming and stopword removal apply to message content only; titles and PR titles keep `simple` whole-word matching. All claims verified against the implementation. Two statements in CODAGT-727 were inaccurate and are documented as the code behaves: - A value that tokenizes to no searchable words returns an **empty list**, not HTTP 400 (`TestListChats_Search/NoSearchableWordsReturnsEmpty`). HTTP 400 covers only an empty `search:` value, unsupported keys, bare terms, or combining `search:` with `title:`, `pr_title:`, or `pr:` (`coderd/searchquery/search.go`). - Results are **paginated** with the standard chat list cursor (default 50), not a bounded non-paginated set (`GetChats`, `listChats`). Ordering is pinned first, then most recently updated. Also verified: message bodies are indexed by the dbpurge sweep (10-minute tick, up to 5 x 10,000 rows, newest first) while titles and PR titles are searchable immediately; numeric values match exact PR numbers; `title:`, `pr_title:`, and `repo:` retain `ILIKE` semantics. `pnpm run format-docs` and `pnpm run lint-docs` pass. Closes [CODAGT-727](https://linear.app/codercom/issue/CODAGT-727/chat-search-documentation-and-release-notes) <details> <summary>Release notes draft</summary> ### Chat history search You can now search your chat history by what was said, not just by title. The chat list `q` parameter accepts a new `search:` filter that performs full-text search across chat titles, pull request titles, PR numbers, and message content, for example `?q=search:"kubernetes restart"`. Matching is case-insensitive and supports quoted phrases, `OR`, and `-` negation. Message content additionally matches English word stems (`refactor` finds a message containing `refactoring`). `search:` cannot be combined with the `title:`, `pr_title:`, or `pr:` filters; the existing substring filters are unchanged. **Upgrading with existing chat history:** the message search index is populated by a background job (every 10 minutes, up to 50,000 messages per run, newest first). Upgrades are not blocked, and chat reads and writes are unaffected while the index fills. Older messages appear in search results progressively; messages indexed before the stemming upgrade match exact word forms until re-indexed. Titles and PR titles are searchable immediately. </details> --- 🤖 This PR was generated by Coder Agents on behalf of @f0ssel. |
||
|
Garrett Delfosse
|
378ac91b49 |
fix: stem chat search terms with the english text search config (#28319)
Chat message search used the `simple` text search config, which folds case but does no stemming, so `refactor` did not match messages containing `refactoring`. Message bodies now index and query with the `english` config, which stems both sides. Titles, PR titles, and all other filters are unchanged. Migration `000585` adds a `chat_messages.search_tsv_config` enum column recording which config produced each stored vector and stamps existing vectors `'simple'` (a column-only update; vectors and indexes are untouched, since rewriting `search_tsv` would block message writes on large tables). The dbpurge sweep gains a bounded `ReindexStaleChatMessagesSearchTsv` pass that rewrites stale vectors newest first and stops for the process lifetime once drained. Until a row is rewritten, `GetChats` matches it with the config that produced it, so pre-migration exact-form searches keep working during the drain. Vectors written by old binaries mid rolling upgrade cannot stamp the config, stay pending, and self-heal on the next upgraded sweep. Steady-state DB load is unchanged. The down migration resets `english` vectors to `NULL` so the parent version's existing sweep rewrites them with `simple`. Closes [CODAGT-867](https://linear.app/codercom/issue/CODAGT-867/backend-search-improvements-to-handle-partial-matches) <details> <summary>Decision log</summary> - **`english` stemming over prefix matching.** On a 300k-row corpus a stemmed lookup is a single GIN entry-tree probe, while `term:*` prefix matching unions posting lists of every lexeme sharing the prefix (up to a full scan for short prefixes), is asymmetric, and loses the `websearch_to_tsquery` phrase/OR/negation UX. `pg_trgm` rejected as a heavier index with different semantics. - **Scope to message bodies only** (review). Titles and PR titles keep their `simple` FTS expressions and indexes, identical to main. - **Config-versioned queue over migration-time reset** (review). An unqualified `UPDATE ... SET search_tsv = NULL` rewrites every indexed row in the migration transaction, and an old replica could backfill reset rows with `simple` vectors that permanently leave the `search_tsv IS NULL` queue. The config column makes staleness explicit and both problems disappear. - **Enum over `text`** (review) for the config column. - **Trade-offs.** English stopwords are dropped from message search (stopword-only queries match no messages); stemming is English-specific; titles do not stem; prefix matching remains out of scope. </details> --- 🤖 This PR was generated by Coder Agents on behalf of @f0ssel. |
||
|
Ethan
|
6284964b5f |
test(coderd): remove flaky audit transaction case (#28468)
The `TransactionAfterNoChange` case in `TestChatRetentionDays_AuditInfrastructureFailureRejectsWrite` was flaky in [Flake Check run 32717900411](https://github.com/coder/coder/actions/runs/32717900411). Its generic `InTx` wrapper armed a shared fail-next flag, so an unrelated background transaction could consume the failure and let the target PUT return 204 instead of the expected 500. Remove the shared transaction wrapper and replace the endpoint-level case with deterministic unit coverage of `auditedChatOperationalSettingWrite`. The mock transaction executes the no-op callback successfully and then returns an error, preserving coverage that audit suppression happens only after the transaction succeeds without involving API background transactions. |
||
|
Ethan
|
16e0c4dba7 |
fix(site/src/pages/AgentsPage): remove redundant model warning (#28484)
The empty chat form showed a generic no-model warning directly above the existing provider and model setup notice, repeating the same unavailable-state information. Remove the redundant warning and update the affected stories to assert the remaining actionable setup notice. |
||
|
dependabot[bot]
|
31fba3fce6 |
ci: bump the github-actions group with 6 updates (#28545)
Bumps the github-actions group with 6 updates: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.20.1` | `2.21.0` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.2.0` | `4.3.0` | | [toshimaru/auto-author-assign](https://github.com/toshimaru/auto-author-assign) | `3.0.3` | `3.1.0` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.6` | `4.37.7` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.6` | `4.37.7` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.6` | `4.37.7` | Updates `step-security/harden-runner` from 2.20.1 to 2.21.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/step-security/harden-runner/releases">step-security/harden-runner's releases</a>.</em></p> <blockquote> <h2>v2.21.0</h2> <h2>What's Changed</h2> <ul> <li>Support for denied endpoints in block mode. This is included in the enterprise tier. Customers can deny outbound calls, for example, to public package registries.</li> <li>Improved Support for AWS CodeBuild GitHub Actions Runners.</li> <li>Bug fixes.</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2.20.1...v2.21.0">https://github.com/step-security/harden-runner/compare/v2.20.1...v2.21.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/step-security/harden-runner/commit/05e31511f85b41b11d1cf0ef85d0992719546e2c"><code>05e3151</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/684">#684</a> from step-security/rc-42</li> <li><a href="https://github.com/step-security/harden-runner/commit/0f37afa338f57c61ee3dfc274daca8834963d83e"><code>0f37afa</code></a> fix: ignore denied-endpoints on non-enterprise tier</li> <li><a href="https://github.com/step-security/harden-runner/commit/93b58ee491c5b6cf3a5324966fca2908f8d447f3"><code>93b58ee</code></a> fix: resolve cache host read-first and never downgrade egress policy</li> <li><a href="https://github.com/step-security/harden-runner/commit/e7399dd3e93d6c159d314af54b4704bc48abf6bc"><code>e7399dd</code></a> fix: align deny-list mode detection with agent and log when both endpoint inp...</li> <li><a href="https://github.com/step-security/harden-runner/commit/c16689f716a10cdfd9cfe22e63938b8c6c0657de"><code>c16689f</code></a> test: add denied_endpoints to Configuration fixtures and cover deny-list merge</li> <li><a href="https://github.com/step-security/harden-runner/commit/40b99cf0c7161e4dcdc6c5508927188b65028df9"><code>40b99cf</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/682">#682</a> from rohan-stepsecurity/rp/feat/codebuild-self-v2</li> <li><a href="https://github.com/step-security/harden-runner/commit/fedec027a205365a7d64001a81931e4c36a1af6e"><code>fedec02</code></a> Merge branch 'rc-42' into rp/feat/codebuild-self-v2</li> <li><a href="https://github.com/step-security/harden-runner/commit/5361fb178b926b2be6df52e11ee257823821567b"><code>5361fb1</code></a> feat: add build artifacts</li> <li><a href="https://github.com/step-security/harden-runner/commit/286474fffe0b8fe7c9db855f132d04a9b48ab564"><code>286474f</code></a> feat: Support Bravo agent install on CodeBuild runners</li> <li><a href="https://github.com/step-security/harden-runner/commit/051ec05283d064bd82f41279db4f70f0717bf778"><code>051ec05</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/683">#683</a> from h0x0er/jatin/deny-list</li> <li>Additional commits viewable in <a href="https://github.com/step-security/harden-runner/compare/b09bb98e06d4d774595224525879c09bc6e98c40...05e31511f85b41b11d1cf0ef85d0992719546e2c">compare view</a></li> </ul> </details> <br /> Updates `docker/setup-buildx-action` from 4.2.0 to 4.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/setup-buildx-action/releases">docker/setup-buildx-action's releases</a>.</em></p> <blockquote> <h2>v4.3.0</h2> <ul> <li>Bump <code>@docker/actions-toolkit</code> from 0.92.0 to 0.95.0 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/595">docker/setup-buildx-action#595</a></li> <li>Bump brace-expansion from 1.1.13 to 1.1.18 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/600">docker/setup-buildx-action#600</a></li> <li>Bump js-yaml from 5.2.0 to 5.3.0 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/585">docker/setup-buildx-action#585</a></li> <li>Bump postcss from 8.5.10 to 8.5.25 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/598">docker/setup-buildx-action#598</a></li> <li>Bump undici from 6.27.0 to 6.28.0 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/601">docker/setup-buildx-action#601</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/setup-buildx-action/compare/v4.2.0...v4.3.0">https://github.com/docker/setup-buildx-action/compare/v4.2.0...v4.3.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/docker/setup-buildx-action/commit/37fe631027851001ddb9b187196cc803df7f5f0e"><code>37fe631</code></a> Merge pull request <a href="https://redirect.github.com/docker/setup-buildx-action/issues/595">#595</a> from docker/dependabot/npm_and_yarn/docker/actions-to...</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/b5c4f91922681cc7c58d15ab7838986951f09d19"><code>b5c4f91</code></a> [dependabot skip] chore: update generated content</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/3e93b637c6430ba8fa896fad44d3aa6821899d63"><code>3e93b63</code></a> build(deps): bump <code>@docker/actions-toolkit</code> from 0.92.0 to 0.95.0</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/e527031b32c86649307d5d492506855f90470604"><code>e527031</code></a> Merge pull request <a href="https://redirect.github.com/docker/setup-buildx-action/issues/600">#600</a> from docker/dependabot/npm_and_yarn/brace-expansion-1...</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/c68814b33cb66f1f7538e546190d410ae557a640"><code>c68814b</code></a> [dependabot skip] chore: update generated content</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/3f891b01bd5012a434f582800366972569aa1886"><code>3f891b0</code></a> build(deps): bump brace-expansion from 1.1.13 to 1.1.18</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/787db26fcde8ddcabd49a81472318028f7113962"><code>787db26</code></a> Merge pull request <a href="https://redirect.github.com/docker/setup-buildx-action/issues/585">#585</a> from docker/dependabot/npm_and_yarn/js-yaml-5.2.1</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/f7793687c711790ca336bd4934f1b1bf5f778e17"><code>f779368</code></a> [dependabot skip] chore: update generated content</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/7d5e60413489a33d28077e11d71c668580cfaf8d"><code>7d5e604</code></a> build(deps): bump js-yaml from 5.2.0 to 5.3.0</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/292c2fb3837a12d3ac2d1e47bbc5c00712bad939"><code>292c2fb</code></a> Merge pull request <a href="https://redirect.github.com/docker/setup-buildx-action/issues/590">#590</a> from docker/dependabot/github_actions/actions/setup-n...</li> <li>Additional commits viewable in <a href="https://github.com/docker/setup-buildx-action/compare/bb05f3f5519dd87d3ba754cc423b652a5edd6d2c...37fe631027851001ddb9b187196cc803df7f5f0e">compare view</a></li> </ul> </details> <br /> Updates `toshimaru/auto-author-assign` from 3.0.3 to 3.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/toshimaru/auto-author-assign/releases">toshimaru/auto-author-assign's releases</a>.</em></p> <blockquote> <h2>v3.1.0</h2> <h2><a href="https://github.com/toshimaru/auto-author-assign/compare/v3.0.3...v3.1.0">3.1.0</a> (2026-08-12)</h2> <h2>What's Changed</h2> <h3>Features</h3> <ul> <li>Add support to <code>skip-users</code> (see <a href="https://redirect.github.com/toshimaru/auto-author-assign/issues/185">#185</a> and <a href="https://redirect.github.com/toshimaru/auto-author-assign/issues/191">#191</a>) (<a href="https://github.com/toshimaru/auto-author-assign/commit/c323db629e2e295b2c8ebe87d47bb2c961ef87ae">c323db6</a>) <ul> <li>Add skip-users input by <a href="https://github.com/IsabelParedes"><code>@IsabelParedes</code></a> in <a href="https://redirect.github.com/toshimaru/auto-author-assign/pull/185">toshimaru/auto-author-assign#185</a></li> <li>feat: Parse <code>skip-users</code> as comma or newline-separated list by <a href="https://github.com/toshimaru"><code>@toshimaru</code></a> in <a href="https://redirect.github.com/toshimaru/auto-author-assign/pull/191">toshimaru/auto-author-assign#191</a></li> </ul> </li> </ul> <h3>Security</h3> <ul> <li>Configure Dependabot cooldown windows for npm and GitHub Actions by <a href="https://github.com/toshimaru"><code>@toshimaru</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/toshimaru/auto-author-assign/pull/182">toshimaru/auto-author-assign#182</a></li> </ul> <h3>Dependencies</h3> <ul> <li>build(deps-dev): bump rollup from 4.62.0 to 4.62.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/toshimaru/auto-author-assign/pull/180">toshimaru/auto-author-assign#180</a></li> <li>build(deps): bump actions/checkout from 6 to 7 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/toshimaru/auto-author-assign/pull/178">toshimaru/auto-author-assign#178</a></li> <li>build(deps-dev): bump rollup from 4.62.2 to 4.62.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/toshimaru/auto-author-assign/pull/186">toshimaru/auto-author-assign#186</a></li> <li>build(deps): bump actions/setup-node from 6 to 7 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/toshimaru/auto-author-assign/pull/183">toshimaru/auto-author-assign#183</a></li> <li>build(deps): bump undici from 6.25.0 to 6.28.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/toshimaru/auto-author-assign/pull/188">toshimaru/auto-author-assign#188</a></li> <li>build(deps-dev): bump rollup from 4.62.3 to 4.62.4 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/toshimaru/auto-author-assign/pull/189">toshimaru/auto-author-assign#189</a></li> </ul> <h3>Others</h3> <ul> <li>chore(main): release 3.1.0 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/toshimaru/auto-author-assign/pull/192">toshimaru/auto-author-assign#192</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/IsabelParedes"><code>@IsabelParedes</code></a> made their first contribution in <a href="https://redirect.github.com/toshimaru/auto-author-assign/pull/185">toshimaru/auto-author-assign#185</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/toshimaru/auto-author-assign/compare/v3.0.3...v3.1.0">https://github.com/toshimaru/auto-author-assign/compare/v3.0.3...v3.1.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/toshimaru/auto-author-assign/blob/main/CHANGELOG.md">toshimaru/auto-author-assign's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2><a href="https://github.com/toshimaru/auto-author-assign/compare/v3.0.3...v3.1.0">3.1.0</a> (2026-08-12)</h2> <h3>Features</h3> <ul> <li>add support to skip users (see <a href="https://redirect.github.com/toshimaru/auto-author-assign/issues/185">#185</a> and <a href="https://redirect.github.com/toshimaru/auto-author-assign/issues/191">#191</a>) (<a href="https://github.com/toshimaru/auto-author-assign/commit/c323db629e2e295b2c8ebe87d47bb2c961ef87ae">c323db6</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>parse skip-users as comma or newline-separated list (<a href="https://github.com/toshimaru/auto-author-assign/commit/9db2a78bf35000232ae3b800c3dd021300887393">9db2a78</a>)</li> </ul> <h2><a href="https://github.com/toshimaru/auto-author-assign/compare/v3.0.2...v3.0.3">3.0.3</a> (2026-06-15)</h2> <h3>Miscellaneous Chores</h3> <ul> <li>release 3.0.3 (<a href="https://github.com/toshimaru/auto-author-assign/commit/8f813140fc4dbdfcc4a43f89d97033b5988e3773">8f81314</a>)</li> </ul> <h2><a href="https://github.com/toshimaru/auto-author-assign/compare/v3.0.1...v3.0.2">3.0.2</a> (2026-04-27)</h2> <h3>Miscellaneous Chores</h3> <ul> <li>release 3.0.2 (<a href="https://github.com/toshimaru/auto-author-assign/commit/658b95bf703955e926268fcaca1124037270bea8">658b95b</a>)</li> <li>release 3.0.2 (<a href="https://github.com/toshimaru/auto-author-assign/commit/ca59fc3261247bab40337927fac848bf2a60863f">ca59fc3</a>)</li> </ul> <h2><a href="https://github.com/toshimaru/auto-author-assign/compare/v3.0.0...v3.0.1">3.0.1</a> (2025-12-25)</h2> <h3>Miscellaneous Chores</h3> <ul> <li>release 3.0.1 (<a href="https://github.com/toshimaru/auto-author-assign/commit/718d4ed5349747d47952ae841ae03fcbdd74ebea">718d4ed</a>)</li> </ul> <h2><a href="https://github.com/toshimaru/auto-author-assign/compare/v2.1.2...v3.0.0">3.0.0</a> (2025-12-21)</h2> <h3>Features</h3> <ul> <li>Add <code>npm run package</code> instead of <code>build</code> (<a href="https://redirect.github.com/toshimaru/auto-author-assign/issues/130">#130</a>) (<a href="https://github.com/toshimaru/auto-author-assign/commit/972720f0403d2873e807f16e350c5b0b1be4dda3">972720f</a>)</li> </ul> <h3>Miscellaneous Chores</h3> <ul> <li>release 3.0.0 (<a href="https://github.com/toshimaru/auto-author-assign/commit/d100ceff34d1e9cd2c4ea5b8055922f1409f3068">d100cef</a>)</li> </ul> <h3><a href="https://github.com/toshimaru/auto-author-assign/compare/v2.1.1...v2.1.2">2.1.2</a> (2025-12-16)</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/toshimaru/auto-author-assign/commit/a78a94b219445cece8ccf0d45fec60af449f212a"><code>a78a94b</code></a> chore(main): release 3.1.0 (<a href="https://redirect.github.com/toshimaru/auto-author-assign/issues/192">#192</a>)</li> <li><a href="https://github.com/toshimaru/auto-author-assign/commit/c323db629e2e295b2c8ebe87d47bb2c961ef87ae"><code>c323db6</code></a> feat: add support to skip users (see <a href="https://redirect.github.com/toshimaru/auto-author-assign/issues/185">#185</a> and <a href="https://redirect.github.com/toshimaru/auto-author-assign/issues/191">#191</a>)</li> <li><a href="https://github.com/toshimaru/auto-author-assign/commit/eae6cfd3b5c7e2cce508a78f856f8827f76cafb3"><code>eae6cfd</code></a> build(deps-dev): bump rollup from 4.62.3 to 4.62.4 (<a href="https://redirect.github.com/toshimaru/auto-author-assign/issues/189">#189</a>)</li> <li><a href="https://github.com/toshimaru/auto-author-assign/commit/3d6ff397d755c64759c1b416535523166e518e8f"><code>3d6ff39</code></a> build(deps): bump undici from 6.25.0 to 6.28.0 (<a href="https://redirect.github.com/toshimaru/auto-author-assign/issues/188">#188</a>)</li> <li><a href="https://github.com/toshimaru/auto-author-assign/commit/6c3a1f760361388c2c9f0ae0930d922cab507b48"><code>6c3a1f7</code></a> docs: use consistent terminology for machine-user accounts</li> <li><a href="https://github.com/toshimaru/auto-author-assign/commit/19ec32b7d5b8e5e25add98f708540b51e4c3e8b3"><code>19ec32b</code></a> docs: note that bot check does not cover machine-user accounts</li> <li><a href="https://github.com/toshimaru/auto-author-assign/commit/737b10ed8b9df5741368b9c584436685ef07612d"><code>737b10e</code></a> build: rebuild dist for skip-users separator fix</li> <li><a href="https://github.com/toshimaru/auto-author-assign/commit/9db2a78bf35000232ae3b800c3dd021300887393"><code>9db2a78</code></a> fix: parse skip-users as comma or newline-separated list</li> <li><a href="https://github.com/toshimaru/auto-author-assign/commit/2498de00249093fbd9c9f74f91248c110cb2ecde"><code>2498de0</code></a> Update README</li> <li><a href="https://github.com/toshimaru/auto-author-assign/commit/0bb32246e068f1d145e989a9c6fc7d4753c28eb6"><code>0bb3224</code></a> Add skip-user input</li> <li>Additional commits viewable in <a href="https://github.com/toshimaru/auto-author-assign/compare/3e19bfc990cb1cf0589dce95e9f75289bb1e22de...a78a94b219445cece8ccf0d45fec60af449f212a">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/upload-sarif` from 4.37.6 to 4.37.7 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/upload-sarif's releases</a>.</em></p> <blockquote> <h2>v4.37.7</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/upload-sarif's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd"><code>ff2f1c6</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4093">#4093</a> from github/update-v4.37.7-be7a3dbb8</li> <li><a href="https://github.com/github/codeql-action/commit/951a133f96aa2114dd747e9e437305335d0bde16"><code>951a133</code></a> Update changelog for v4.37.7</li> <li><a href="https://github.com/github/codeql-action/commit/be7a3dbb8147b82cd6d27e0707105b36aa190fc1"><code>be7a3db</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4087">#4087</a> from github/dependabot/npm_and_yarn/npm-minor-0aa561...</li> <li><a href="https://github.com/github/codeql-action/commit/9310334b11405b305d9444edfa56cd86e2f1e4fe"><code>9310334</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4086">#4086</a> from github/mbg/thread-action-state-to-codeql</li> <li><a href="https://github.com/github/codeql-action/commit/b4d8a54218a8792de9af2f6f32e33af899ca5212"><code>b4d8a54</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/ab5db2519c3344f2fa61c711fa2d6ad135829200"><code>ab5db25</code></a> Bump the npm-minor group across 1 directory with 8 updates</li> <li><a href="https://github.com/github/codeql-action/commit/38055a3c3cf3979323eaf70fc6c73a8690250bde"><code>38055a3</code></a> Drop <code>logger</code> from <code>databaseInitCluster</code> in interface</li> <li><a href="https://github.com/github/codeql-action/commit/1f87aed5e66849f0c43ae147377cc77f2d98ac99"><code>1f87aed</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4085">#4085</a> from github/update-bundle/codeql-bundle-v2.26.3</li> <li><a href="https://github.com/github/codeql-action/commit/dc1b98ad1c2f13ccf9fc33fb82f32fc76f944253"><code>dc1b98a</code></a> Make <code>logger</code> available to <code>getCodeQLForCmd</code></li> <li><a href="https://github.com/github/codeql-action/commit/6f0220ee37121218af472efbde25f06907a4da4f"><code>6f0220e</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4084">#4084</a> from github/navntoft/bump-undici</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/init` from 4.37.6 to 4.37.7 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/init's releases</a>.</em></p> <blockquote> <h2>v4.37.7</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd"><code>ff2f1c6</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4093">#4093</a> from github/update-v4.37.7-be7a3dbb8</li> <li><a href="https://github.com/github/codeql-action/commit/951a133f96aa2114dd747e9e437305335d0bde16"><code>951a133</code></a> Update changelog for v4.37.7</li> <li><a href="https://github.com/github/codeql-action/commit/be7a3dbb8147b82cd6d27e0707105b36aa190fc1"><code>be7a3db</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4087">#4087</a> from github/dependabot/npm_and_yarn/npm-minor-0aa561...</li> <li><a href="https://github.com/github/codeql-action/commit/9310334b11405b305d9444edfa56cd86e2f1e4fe"><code>9310334</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4086">#4086</a> from github/mbg/thread-action-state-to-codeql</li> <li><a href="https://github.com/github/codeql-action/commit/b4d8a54218a8792de9af2f6f32e33af899ca5212"><code>b4d8a54</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/ab5db2519c3344f2fa61c711fa2d6ad135829200"><code>ab5db25</code></a> Bump the npm-minor group across 1 directory with 8 updates</li> <li><a href="https://github.com/github/codeql-action/commit/38055a3c3cf3979323eaf70fc6c73a8690250bde"><code>38055a3</code></a> Drop <code>logger</code> from <code>databaseInitCluster</code> in interface</li> <li><a href="https://github.com/github/codeql-action/commit/1f87aed5e66849f0c43ae147377cc77f2d98ac99"><code>1f87aed</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4085">#4085</a> from github/update-bundle/codeql-bundle-v2.26.3</li> <li><a href="https://github.com/github/codeql-action/commit/dc1b98ad1c2f13ccf9fc33fb82f32fc76f944253"><code>dc1b98a</code></a> Make <code>logger</code> available to <code>getCodeQLForCmd</code></li> <li><a href="https://github.com/github/codeql-action/commit/6f0220ee37121218af472efbde25f06907a4da4f"><code>6f0220e</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4084">#4084</a> from github/navntoft/bump-undici</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/analyze` from 4.37.6 to 4.37.7 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's releases</a>.</em></p> <blockquote> <h2>v4.37.7</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd"><code>ff2f1c6</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4093">#4093</a> from github/update-v4.37.7-be7a3dbb8</li> <li><a href="https://github.com/github/codeql-action/commit/951a133f96aa2114dd747e9e437305335d0bde16"><code>951a133</code></a> Update changelog for v4.37.7</li> <li><a href="https://github.com/github/codeql-action/commit/be7a3dbb8147b82cd6d27e0707105b36aa190fc1"><code>be7a3db</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4087">#4087</a> from github/dependabot/npm_and_yarn/npm-minor-0aa561...</li> <li><a href="https://github.com/github/codeql-action/commit/9310334b11405b305d9444edfa56cd86e2f1e4fe"><code>9310334</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4086">#4086</a> from github/mbg/thread-action-state-to-codeql</li> <li><a href="https://github.com/github/codeql-action/commit/b4d8a54218a8792de9af2f6f32e33af899ca5212"><code>b4d8a54</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/ab5db2519c3344f2fa61c711fa2d6ad135829200"><code>ab5db25</code></a> Bump the npm-minor group across 1 directory with 8 updates</li> <li><a href="https://github.com/github/codeql-action/commit/38055a3c3cf3979323eaf70fc6c73a8690250bde"><code>38055a3</code></a> Drop <code>logger</code> from <code>databaseInitCluster</code> in interface</li> <li><a href="https://github.com/github/codeql-action/commit/1f87aed5e66849f0c43ae147377cc77f2d98ac99"><code>1f87aed</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4085">#4085</a> from github/update-bundle/codeql-bundle-v2.26.3</li> <li><a href="https://github.com/github/codeql-action/commit/dc1b98ad1c2f13ccf9fc33fb82f32fc76f944253"><code>dc1b98a</code></a> Make <code>logger</code> available to <code>getCodeQLForCmd</code></li> <li><a href="https://github.com/github/codeql-action/commit/6f0220ee37121218af472efbde25f06907a4da4f"><code>6f0220e</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4084">#4084</a> from github/navntoft/bump-undici</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
7638779c24 |
chore: bump github.com/brianvoe/gofakeit/v7 from 7.15.0 to 7.16.0 (#28544)
Bumps [github.com/brianvoe/gofakeit/v7](https://github.com/brianvoe/gofakeit) from 7.15.0 to 7.16.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/brianvoe/gofakeit/commit/aab05dbcca39c4cb8a52f64e5b98a8823b425008"><code>aab05db</code></a> tests - updated to fix flux test failure issue</li> <li><a href="https://github.com/brianvoe/gofakeit/commit/517a58640892de2d43d5b03b8a47d329eebd0db7"><code>517a586</code></a> slogan - updated some strings</li> <li><a href="https://github.com/brianvoe/gofakeit/commit/ff1305bd1bcb2ae5edffdb4c8ec51e2ad73acfa9"><code>ff1305b</code></a> github workflow - updated to fix macos-latest</li> <li><a href="https://github.com/brianvoe/gofakeit/commit/3bdc6890f3bbf9ac7899b2df33efd3f3fc79f618"><code>3bdc689</code></a> Merge pull request <a href="https://redirect.github.com/brianvoe/gofakeit/issues/395">#395</a> from ChrisJr404/slogan-mad-libs-templates</li> <li><a href="https://github.com/brianvoe/gofakeit/commit/66cc15902391e928c3e24004ccbd53f6e5d36a71"><code>66cc159</code></a> Add more slogan templates and fix slogan casing</li> <li><a href="https://github.com/brianvoe/gofakeit/commit/d14309718f553b12b4a9693a4bc9c359ac7eef40"><code>d143097</code></a> slogan - build slogans from mad-libs templates via Generate</li> <li><a href="https://github.com/brianvoe/gofakeit/commit/f0b548a543358d5eee6c5858a0a6738344fd3ce2"><code>f0b548a</code></a> fuzz - added initial fuzzing to functions that maybe best for</li> <li>See full diff in <a href="https://github.com/brianvoe/gofakeit/compare/v7.15.0...v7.16.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Garrett Delfosse
|
eedc0ece47 | fix: avoid 500 when generating chat title from rename dialog and remove unused endpoint (#28306) | ||
|
Jaayden Halko
|
511dcc0293 |
feat(coderd/x/chatd): bill interrupted tool batches on cancellation rows (#28362)
**Stack**: #28359 → #28360 → #28361 → **#28362 (this PR)** ## Summary Interrupted local tool batches now bill the partial window they actually executed, recorded on the same dedicated usage record completed batches use. Completes the runtime billing work in this stack: completed batches bill via #28360, interrupted batches via this PR. Last of a four-PR stack splitting #28211. Stacked on #28361. Closes CODAGT-928 (https://linear.app/codercom/issue/CODAGT-928/track-local-tool-execution-for-agent-runtime). ## Problem Interrupting a batch previously billed only the model window; work the tools already performed was lost. ## Fix Just before closing the buffer episode, the interrupt task reads the live tool stamps (`ToolCompletions`) alongside `ModelInvokedAt`. The interruption commit appends the shared `batchUsageMessage` record (same shape as #28360: model-only tool-role row with a `billed_ms`/`billed_calls` audit payload) billing the union of the started, billable calls' partial execution intervals: completed calls end at their recorded completion, running calls at the interrupt instant. Synthesized cancellation rows stay free of batch-level runtime. Unstarted calls, rejected calls, and sub-agent orchestration tools bill nothing and append no record. Batches with no live attempt (crash recovery, state promotion) bill nothing, consistent with generation losing in-flight runtime on a crash. Usage-record billing reuses the same interrupt instant as the model window instead of taking a second clock reading inside the transaction, so database delay cannot inflate a running call's window. An earlier revision carried a retry-stable episode snapshot so an interrupt retry after buffer eviction (a >15s stall) would not lose billing; it was dropped as not worth the complexity (https://github.com/coder/coder/pull/28211#discussion_r3812778418). Such a retry now bills the batch at zero, matching the existing crash-recovery precedent. Known gaps left out of scope: retry backoff and errored-attempt time stay unbilled (no persistence home for error turns), and the advisor tool's nested model call now bills as tool time by design. |
||
|
Ethan
|
d667d68e3c |
fix(site): harden organization-scoped model loading (#28495)
Previously, the new agent form treated the dashboard organization as a usable resource scope while permission filtering was still pending. This could request a provisional empty model catalog, briefly show the no-model setup notice, and lose the selected organization when the form remounted. A malformed organization models response could also crash the Models settings page. Wait for authoritative permitted organizations before enabling organization-scoped resources, persist valid organization selections across remounts, and reject malformed model responses while retaining a defensive rendering guard. ## UAT An adversarial [Coder Agents UAT run](https://dev.coder.com/agents/980a5a6d-e91b-47f0-902e-25d12ac46935) validated this commit on a licensed local deployment with two organizations, a real Anthropic model, and a non-admin user. Under throttled and artificially delayed authorization, no organization-scoped request fired before permissions settled and the false setup notice never appeared, while an authorized zero-model organization still showed the genuine notice. Persistence across reloads, tampered or stale localStorage IDs, membership revocation, attachment-preserving organization switches, single-organization deployments, and induced malformed or failed model responses on the Models settings page all behaved correctly. Verdict: PASS. |
||
|
Jaayden HalkoandHugo Dutka
|
64d2d8a108 |
feat(coderd/x/chatd): record live tool execution stamps in the message part buffer (#28361)
**Stack**: #28359 → #28360 → **#28361 (this PR)** → #28362 During local tool execution, buffer episodes now record when each tool-call occurrence actually starts and finishes, via `RecordToolStart`/`RecordToolCompletion`/`ToolCompletions` on the message part buffer. Occurrences are keyed by unresolved-call position, so gaps left by rejected calls and duplicate tool-call IDs stay distinct: `partitionAmbiguousToolCalls` additionally returns the allowed calls' input positions, and generation's `chatloop.ToolBillingRecorder` implementation translates dispatch-order stamps back through them. Mechanism only: nothing reads the stamps yet. The final PR in the stack uses them to bill interrupted tool batches on a dedicated usage record committed alongside their synthesized cancellation rows. Third of a four-PR stack splitting #28211. Stacked on #28360. Refs CODAGT-928 (https://linear.app/codercom/issue/CODAGT-928/track-local-tool-execution-for-agent-runtime). --------- Co-authored-by: Hugo Dutka <hugo@coder.com> |
||
|
Michael Suchacz
|
cc958b73be |
fix(coderd/x/chatd/mcpclient): enforce MCP connect budget and unblock session cleanup (#28400)
## Problem
During the Aug 19 dev.coder.com incident, chats stalled for up to ~15
minutes per turn. chatd reconnects to every configured MCP server on
every generation step, and one configured server
(`registry.coder.com/mcp`) was black-holing requests from the
deployment's egress IPs: TCP/requests were silently dropped, and each
connect attempt hung until the kernel gave up (~125s), far past the
nominal 10s connect budget.
The budget does not hold because go-sdk v1.7.0 detaches the context
inside `StreamableClientTransport.Connect`, and its error paths block on
HTTP work bound to that detached context. Reproduced in a test: a bare
`Connect` with a 2s deadline against a black-holed server returns after
**12s**. Step-end session cleanup (`session.Close()`) runs synchronously
in the generation loop and blocks on the same detached requests, so a
server that wedges mid-turn stalls every step boundary too.
## Changes
- **Enforce the connect budget externally** (`connectOne`): run
`Connect` + `ListTools` in a goroutine and select on the budget context.
On timeout, abandon the goroutine and leave a reaper that drains its
late result and closes any session that still materialized, so nothing
leaks and the caller returns within the budget.
- **Stop using bare `http.DefaultTransport`**: MCP traffic now rides a
cloned transport with a 5s dial timeout (converts SYN black-holes into
fast errors) and a 60s `ResponseHeaderTimeout`. `http.Client.Timeout`
stays unset so long-lived SSE streams are unaffected.
- **Close sessions in detached goroutines during cleanup**
(`ConnectAll`'s cleanup func): the sessions are discarded regardless,
and a wedged `Close` (DELETE bound to the SDK's detached context) must
not stall the generation loop at step boundaries.
One deliberate deviation from the incident plan: `ResponseHeaderTimeout`
is 60s (matching `toolCallTimeout`) instead of ~10s. The same HTTP
client serves tool-call POSTs, and a JSON-response MCP server sends no
headers until the tool finishes, so a 10s bound would falsely kill
legitimate 10-60s tools that fit today's tool-call budget. The real 10s
connect budget is enforced by the external select, not the transport.
## Tests
- Acceptance: with a black-holed server plus a healthy one configured,
`ConnectAll` returns within the budget and the healthy server's tools
are present; closing the black-holed connections makes the reaper exit
(red without the fix: 1s budget took 11s).
- A slow-but-alive server (300ms/request) still connects.
- A server that only responds after the budget: `ConnectAll` returns
promptly, the late result is reaped.
- Cleanup returns promptly while the session-teardown DELETE is wedged
server-side, and the teardown still happens in the background (red
without the fix: cleanup blocked 60s).
- Transport guard test pinning the dial/response-header bounds.
`go test ./coderd/x/chatd/...` passes (including goleak in `chatd`).
Part of the MCP connect-stall incident follow-up; observability (connect
durations in logs/debug runs) comes in a stacked follow-up PR.
> 🤖 Mux authored this PR on Mike's behalf.
<!-- mux-attribution: model=anthropic:claude-opus-4-6 thinking=high -->
|
||
|
Jaayden Halko
|
b428c8feb6 |
feat(coderd): bill completed local tool batches in agent runtime (#28360)
**Stack**: #28359 → **#28360 (this PR)** → #28361 → #28362 ## Summary Completed local tool batches now count toward Coder Agent runtime (`chat_messages.runtime_ms`, the source of truth for `hb_agent_runtime_v1`), excluding sub-agent orchestration tools to avoid double counting, and without multiplying runtime for parallel tool calls. Second of a four-PR stack splitting #28211. Stacked on #28359. Refs CODAGT-928 (https://linear.app/codercom/issue/CODAGT-928/track-local-tool-execution-for-agent-runtime). ## Problem Agent runtime previously measured only model invocation wall clock (stream open to fully consumed). Time spent executing local tools between steps, including file operations, terminal commands, workspace provisioning, and MCP tools, was deliberately excluded, which undercounts the product definition of "actively processing a task". Naive inclusion has two hazards: a batch of parallel tool calls would bill N windows for one wall-clock wait, and `wait_agent` would re-bill child agents that already bill their own model and tool time. ## Fix Each completed local tool batch bills one window: the union of the billed tools' execution intervals, persisted as `runtime_ms` on a dedicated usage record appended after the batch's tool-result rows. The record is a tool-role message with `visibility='model'`, so it never reaches the API, SSE, or clients, and prompt replay drops it because its single internal `tool-batch-usage` part converts to no provider content. Its content carries an audit payload (`billed_ms`, `billed_calls`) so the billed window is inspectable after the fact; real tool-result rows never carry batch-level runtime. Concurrent calls all start at batch start, so 5 parallel 10s reads bill 10s, not 50s; serial calls (`SerialToolCalls`) count only from their own launch, so unbilled waits before them do not count. Sub-agent orchestration tools (`spawn_agent`, `wait_agent`, `message_agent`, `interrupt_agent`, `list_agents`, `list_subagent_models`, plus the deprecated `close_agent` alias) never extend the window: every chat, including children, applies the same rules to its own runtime, so a parent's `wait_agent` window would double count. A lone `wait_agent` bills 0 and appends no usage record; `execute` 10s in parallel with `wait_agent` 60s bills 10s. A test pins the unbilled set to the registered sub-agent tool catalog so they cannot drift. `GetTotalChatMessageRuntimeMsInRange` already sums `runtime_ms` role-agnostically, so the usage record is picked up with no schema, query, or cron changes. Client-executed dynamic tools, external agents, parked/idle time, and retry backoff remain unbilled. Interrupted batches still bill only the model window; the rest of the stack adds partial-window billing via the same usage record. `ExecuteLocalToolsOptions` also gains an optional `ToolBillingRecorder` (`RecordStart`/`RecordComplete`) observing per-occurrence dispatch-order execution stamps. This PR wires no recorder; the next PR in the stack connects it to the message part buffer for interrupt billing. **NOTE**: Reported agent runtime (`hb_agent_runtime_v1`) increases from deploy forward. There is no backfill and no feature flag. |
||
|
Michael Suchacz
|
e244cac9c1 |
feat(coderd/x/chatd/chattool): improve find_tools relevance and model guidance (#28476)
Broad `find_tools` queries such as "linear issues" saturated the hard
20-match cap on every call: a large server's name token-matches every
one of its tools (+8 name, +1 server), so ranking was decided by a term
carrying no discriminating information and the model got 20 activations
per search regardless of intent.
Three changes, mirroring what makes xum's `tool_catalog_search` behave
well:
- **Lower default with a `limit` argument.** Keyword matches default to
10 per call; the new optional `limit` raises that up to the existing
hard cap of 20 (non-positive values fall back to the default). Exact
`names` are explicit activation requests and bypass the limit up to the
hard cap, so naming 15 tools still activates all 15.
- **Coverage-first ranking.** Keyword matches sort by distinct query
terms matched before raw score, so a query like "linear issues" ranks
tools matching both terms above the dozens matching only the server
name.
- **Model guidance.** `queries` and `names` now carry schema
descriptions (capability keywords and what they are matched against;
exact-name activation), and the tool description opens by explaining
what deferral means, that matches become callable on the next step, and
that a `"server: terms"` prefix scopes a query to one server.
An earlier revision also inferred a server scope from unprefixed query
words ("linear issues" behaving like "linear: issues"). Review kept
surfacing edge cases in that inference, and coverage-first ranking
already resolves the original saturation complaint, so it was dropped in
favor of the explicit prefix.
The hard cap stays at 20 so the persisted result keeps fitting under the
generic tool-result truncation budget that protects activation-recovery
JSON. Budget and reservation accounting are unchanged; the frontend
renderer ignores unknown argument fields, so no `site/` change is
needed.
> [!NOTE]
> Xum acted on @ibetitsmike's behalf in this pull request.
<!-- xum-attribution: model=claude-opus-4-6 thinking=high -->
|
||
|
Hugo Dutka
|
01c935ab6b |
test(coderd/x/chatd): avoid advancing unrelated retry timers (#28537)
`TestActiveServer_RetryStatePersistedDuringBackoff` advanced whichever mock-clock timer was next while waiting for the retried provider call. If the provider goroutine had not incremented its call count yet, the test could advance the unrelated 15-minute task timeout and trigger an extra whole-task retry. Trap and release only the named generation-retry timer, then wait for the provider call without advancing the clock again. Refs https://linear.app/codercom/issue/CODAGT-967/flake-testactiveserver-retrystatepersistedduringbackoff <sub>Generated by Coder Agents.</sub> |
||
|
Jaayden Halko
|
d44aae37de |
refactor(coderd/x/chatd): return PersistedStep directly from ExecuteLocalTools (#28359)
**Stack**: **#28359 (this PR)** → #28360 → #28361 → #28362 `chatloop.ToolExecutionOutcome` only wrapped a `PersistedStep`, so callers had to reach through `outcome.Step` for every field. `ExecuteLocalTools` now returns the `PersistedStep` directly and the wrapper type is deleted. No behavior change. First of a four-PR stack that makes local tool execution count toward Coder Agent runtime (splitting #28211). This refactor keeps the rename noise out of the feature PRs. Refs CODAGT-928 (https://linear.app/codercom/issue/CODAGT-928/track-local-tool-execution-for-agent-runtime). |
||
|
TJ
|
e98e2b9b2e |
fix(site/src/pages/AIBridgePage): align token badges with neighboring badge sizing (#28477)
The in/out token pills on the AI Gateway sessions pages looked out of place next to the provider/client/model badges: they used `Badge size="sm"` while their neighbors use the default `md`, and their arrow icons were `size-icon-lg` (24px) — taller than the badge itself, inflating the pill height. > [!NOTE] > The underlying font-size problem (`Badge sm` = 10px `text-2xs`) is fixed globally in #28517. This PR handles what that one doesn't: the token pills' size variant, icon sizing, and API cleanup. ## Changes - Token pills use Badge's default `md` size, matching the provider/client/model badges next to them. - Arrow icons drop from `size-icon-lg` (24px) to `size-icon-xs` (14px), the same icon size the neighboring badges use, with `gap-0.5` between icon and count. - Removed the unused `size` prop from `TokenBadges` — no call site ever passed one — and dropped the now-meaningless `SizeXs`/`SizeMd` stories. Affects every `TokenBadges` consumer: the sessions list, the session summary card, and the timeline prompt/tool-call tables. > 🤖 Generated by Coder Agents on behalf of @tracyjohnsonux |
||
|
TJ
|
0452ff7ec4 |
refactor(site/src/pages/AIBridgePage): move AI Sessions docs link inline into subtitle (#28481)
Replaces the "Read the docs" header button on the AI Sessions page with an inline "View docs" link at the end of the subtitle sentence, matching the pattern used on the Providers and Provisioner Jobs pages. --- _Created by a Coder Agent on behalf of the PR author._ |
||
|
david-fraley
|
0f41ccd664 | fix(site/src/pages/AgentsPage): rename "This Week" group to "Past 7 days" (#28504) | ||
|
Jake Howell
|
303935a2dc |
revert(site/e2e): disable externalAuth suite (#28536)
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.
Reverts
|
||
|
Jake Howell
|
bef6b4c30b |
revert(site): remove built-in emoji avatar inset (#28533)
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.
Reverts `75400428ad2b84c707f60fc5e6b378f46f565ef9` (`fix(site/src): give
built-in emoji avatars a consistent inset`).
The global built-in emoji detection and inline padding are causing
regressions. Revert this behavior so a replacement can be developed
separately.
## Changes
- Remove automatic `/emojis/` source detection from `Avatar`.
- Restore caller-controlled avatar variants and styles.
- Remove the built-in emoji inset stories.
## Verification
- Confirmed the resulting patch is the inverse of the target commit.
|
||
|
TJ
|
607a1d0666 |
refactor(site/src): delete DateTimeRangeFilter and unify on the picker's time range type (#28427)
Completes the deduplication agreed in #28392 (review): now that `DateTimeRangePicker` has replaced the text-expression `DateTimeRangeFilter` on the AI Gateway sessions page, the old component and its `TimeRange` type are deleted, leaving a single time-range value shape. - Deletes `site/src/components/DateTimeRangeFilter/` (component, stories, `timeRange.ts` helpers, tests); nothing imported it except the sessions page type alias. - The sessions page helpers in `ListSessionsPage/timeRange.ts` now use neutral `{start, end}` naming derived from the picker's `DateTimeRangeValue` (`type TimeRange = Pick<DateTimeRangeValue, "start" | "end">`), removing the `startedAfter`/`startedBefore` field mapping the page previously did by hand. No behavior changes: the query-string serialization (`started_after`/`started_before` RFC 3339 params) is untouched, and all existing unit tests pass with only field renames. --- Generated by Coder Agents on behalf of @tracyjohnsonux. |
||
|
TJandJake Howell
|
75400428ad |
fix(site/src): give built-in emoji avatars a consistent inset (#28492)
Built-in emoji avatars (`/emojis/*.png`) rendered inconsistently: edge to edge on user avatars (users table, organization members, group member lists, exposed by the avatar `IconField` from #26652), and with the tighter icon padding on pages that pass `variant="icon"` such as workspace proxies. `Avatar` gains an `emoji` variant with a proportional inset of 20% per side, expressed as `calc(var(--avatar-*) * 0.2)` so it tracks the avatar size tokens. Built-in emoji sources, detected by the shared `isBuiltInEmojiUrl` helper (`site/src/utils/emojis.ts`, which also generates the URLs for `IconField`), always resolve to it, including at call sites that pass `variant="icon"` for data-dependent sources; the override is documented on `AvatarProps`. Non-emoji icon avatars are unchanged. Added `BuiltInEmoji{Lg,Md,Sm}Size` stories. <details> <summary>Investigation notes</summary> - Suspected MUI-removal regression, but the demui Avatar change (#24527) was style-mechanics only (`css` prop to `style`, `CSSObject` to `CSSProperties`). - Insets have always been opt-in via `variant="icon"` (compound variants in `avatarVariants`). Group rows/headers and workspace proxies pass it; user avatar call sites (`UsersTable`, `OrganizationMembersTable`, `GroupMembersPage`, `GroupsPageView` member column) do not. - Emoji user avatars only became reachable with #26652, which reuses the group/template emoji picker that produces `/emojis/<unified>.png` URLs, exposing the missing inset. - The icon variant's padding is proportionally tighter at `md`/`sm` (12.5%) than `lg` (20%), which made default-size emojis look oversized, so emojis get their own size-keyed inset instead of reusing the icon variant. - Fixed in the shared component rather than at each call site so all current and future emoji avatars are consistent. </details> --- 🤖 Generated by Coder Agents on behalf of @tracyjohnsonux --------- Co-authored-by: Jake Howell <jake@hwll.me> |
||
|
Jake Howell
|
95fb22c82a |
test(coderd): fix flaky TestExpireAPIKey timing assertions (#28455)
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell. Closes [DEVEX-730](https://linear.app/codercom/issue/DEVEX-730/flake-testexpireapikey-multiple-variants). ## Problem `TestExpireAPIKey` flakes on Windows CI (`test-go-pg (windows-2022)`), failing `AdminCanExpireOtherUsersToken`, `DeletingExpiredTokenSucceeds`, and the parent test. The subtests asserted: ```go require.True(t, key.ExpiresAt.Before(dbtime.Now())) ``` The `expireAPIKey` handler sets `ExpiresAt: dbtime.Now()`, and `dbtime.Now()` rounds to microsecond precision. On platforms with coarse clock resolution (Windows, ~1–15ms), the handler's timestamp and the test's later `dbtime.Now()` can round to the *same* value, so `Before()` is `false` (equal is not before) and the assertion fails. On Linux the nanosecond-resolution clock makes the two reads differ, which is why it never reproduces there. ## Fix Use the timing-safe assertion already used by the sibling `ExpiringAlreadyExpiredTokenSucceeds` subtest: ```go require.LessOrEqual(t, key.ExpiresAt, dbtime.Now(), "key should be expired") ``` Applied to all three occurrences of the flaky pattern (`OwnerCanExpireOwnToken`, `AdminCanExpireOtherUsersToken`, `DeletingExpiredTokenSucceeds`). ## Prior art This is the established fix for this class of flake in this repo; `require.LessOrEqual(x, now)` is equivalent to `require.False(x.After(now))` (both allow equality, which is the point): - **[#22685](https://github.com/coder/coder/pull/22685)** — *use dbtime.Now() instead of time.Now() in test assertions against DB timestamps*. States the principle: `time.Now()` is nanosecond precision while Postgres timestamps are microsecond, so `Before`/`After` comparisons carry non-zero flake risk. That sweep **edited this same file** (`coderd/apikey_test.go`, 11 `ExpiresAt` comparisons) plus 10 others; these three assertions pre-dated it. - **[#22684](https://github.com/coder/coder/pull/22684)** — *fix TestTokens harder*. The direct predecessor ("Follows from #22684"), fixing the identical token-expiry flake with the equality-tolerant `require.False(t, token.ExpiresAt.After(dbtime.Now()))`. - **[#21783](https://github.com/coder/coder/pull/21783)** — introduced the sibling `ExpiringAlreadyExpiredTokenSucceeds` subtest in this file, which already uses `require.LessOrEqual(t, key.ExpiresAt, dbtime.Now(), "key should be expired")`. This PR just makes the other three subtests consistent with it. ## Verification - Ran the original `TestExpireAPIKey` 100× against Postgres on Linux: 100/100 passed (as expected, the flake is Windows-specific). - Confirmed the root cause by reading the handler and `dbtime.Now()` (microsecond rounding). - Re-ran the test after the fix; passes. <details> <summary>Investigation notes</summary> - CI reference: https://github.com/coder/coder/actions/runs/29892773275 (job `test-go-pg (windows-2022)`). - Error snippet showed `key.ExpiresAt.Before(dbtime.Now())` expected true but observed false (token appeared unexpired). - Handler: `coderd/apikey.go` `expireAPIKey` sets `ExpiresAt: dbtime.Now()`. - `dbtime.Now()` returns `time.Now().UTC()` rounded to `time.Microsecond`. - The equal-timestamp collision only manifests where the OS clock resolution is coarse (Windows), which matches the CI-only reproduction. </details> |
||
|
Jon Ayers
|
26de6140fb | feat: add flag to disable workspace agent context sync (#28522) | ||
|
dependabot[bot]
|
d014d4c372 |
chore: bump the coder-modules group across 2 directories with 2 updates (#28523)
Bumps the coder-modules group with 2 updates in the /dogfood/coder directory: coder/vscode-web/coder and coder/windsurf/coder. Bumps the coder-modules group with 2 updates in the /dogfood/vscode-coder directory: coder/vscode-web/coder and coder/windsurf/coder. Updates `coder/vscode-web/coder` from 1.6.1 to 1.6.2 Updates `coder/windsurf/coder` from 1.3.1 to 1.3.2 Updates `coder/vscode-web/coder` from 1.6.1 to 1.6.2 Updates `coder/windsurf/coder` from 1.3.1 to 1.3.2 Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Kyle Carberry
|
8cd7f9ad4e |
fix(agent/agentcontext): preserve skill source precedence (#28443)
Duplicate workspace skills were sorted by source path before chat hydration, so alphabetical paths could override the order configured in `CODER_AGENT_EXP_SKILLS_DIRS`. Resolve duplicate valid skill names before deterministic sorting and persistence, with user-declared sources evaluated in configured order ahead of built-in and working-directory discovery. This PR was generated by Coder Agents. |
||
|
Kyle Carberry
|
cf97b56479 |
fix(coderd/x/chatd): refresh context after workspace restart (#28441)
Workspace lifecycle tools clear a chat's agent binding while retaining its pinned workspace context. When the chat binds to the replacement agent, the missing previous agent ID caused chatd to skip re-pinning and continue using stale instructions, skills, and MCP definitions. Re-pin when an unbound chat still carries pinned context, while preserving the existing first-time hydration path for new chats without a pin. Adds regression coverage for the stop/start binding sequence. ### CI note All required checks pass. The external `Pixel / Review` status reports the same 3 pre-existing failures on this PR's merge base (`610f321d52c16d43e73c489aa672ef60a92c20ea`) and recent `main` commits. This backend-only change does not touch `site/` or Storybook snapshots. --- Generated by Coder Agents on behalf of @kylecarbs. |
||
|
Hank Hwang
|
2f50b2d740 |
fix(coderd): reject agent requests from suspended owners (#28513)
## What `ExtractWorkspaceAgentAndLatestBuild` computed the workspace owner's RBAC subject via `UserRBACSubject`, but discarded the returned user status. As a result, workspace agent requests were still authorized even when the owner's account was suspended. This change captures `userStatus` and rejects the request with `401 Unauthorized` when the owner is not `Active`, returning a clear message directing the user to contact an admin to reactivate the account. ## Changes - `coderd/httpmw/workspaceagent.go`: stop discarding the owner status from `UserRBACSubject`; return `401` when the owner is not active. - `coderd/httpmw/workspaceagent_test.go`: add an `InactiveUser` test that suspends the owner and asserts a `401` with the expected message. ## Testing - New `TestWorkspaceAgent/InactiveUser` unit test covers the suspended-owner path. --- > This PR was created by Coder Agents on behalf of @hwang251. |
||
|
Bobby HoandMcKayla はな
|
c029869a04 |
fix(coderd): deflake TestHealthSettings dismissal subtests (#28501)
Fixes
https://linear.app/codercom/issue/PLAT-514/flake-testhealthsettingsdismisssection
Both TestHealthSettings dismissal subtests built their server with
coderdtest.New(t, nil), so GET /api/v2/debug/health ran the real
healthcheck, DERP probe included, only to assert that dismissed sections
come back as dismissed.
- Raising the timeout would not fix it. The healthcheck runs on a
context detached from the request (30s HealthcheckTimeout), and
derphealth's 10s per-node cap is skipped whenever a deadline already
exists, which is always true from that call site. Both subtests share
one 10s WaitShort across setup and four round trips, so the server may
spend 3x the test's entire lifetime on one request.
- Fix: inject a stub HealthcheckFunc in both subtests, as the six
TestDebugHealth subtests already do.
- The stub reports nothing dismissed, so the assertions still prove the
flags are applied per request in formatHealthcheck rather than read from
the cached report, which is what
|
||
|
Michael Suchacz
|
3c3240836e |
refactor: consolidate viewport hooks and remove defineProperty matchMedia stub (#28460)
Follow-up to review feedback on #28387. That PR added three hooks for one feature (`useIsBelowLgViewport`, `useIsBelowMdViewport`, and the local single-use `useRightPanelNarrowSuppression`) and stubbed `window.matchMedia` in tests with `Object.defineProperty`. - Replace the two single-purpose viewport hooks with one generic `useMediaQuery(query)`. Callers pass the shared Tailwind-aligned query constants from `utils/mobile.ts`. The one new hook replaces the two deleted ones (net -1). - Inline `useRightPanelNarrowSuppression` into `AgentChatPage`, its only consumer, and drop its `renderHook` unit suite. The behavior stays covered by the narrow-viewport stories; the widening-restore case moved into the `NarrowingSuppressesExpandedPanel` play function. - Rework `testHelpers/matchMedia.ts` to install the stub with `spyOn` from `storybook/test` instead of `Object.defineProperty`. The helper is story-only now (stories run in real Chromium; jsdom has no `matchMedia`), so any future unit test needing a stub should use `vi.stubGlobal` directly. - Encode the feedback in the canonical FE contract so it gets caught during development: `.claude/docs/FRONTEND_PATTERNS.md` now bans new React hooks when an existing hook, a plain function, or component state suffices (FE3) and bans replacing browser globals with `Object.defineProperty` in tests or stories (FE9: `vi.stubGlobal` / `spyOn`), and notes that `renderHook` suites for stateful UI hooks belong in the consuming component's story (FE1). The `frontend-review` skill checklist flags all three. `site/AGENTS.md` is unchanged since it already defers to the patterns doc. Validation: `pnpm check`, `pnpm format:check`, `pnpm lint` (biome, types, knip, circular deps, compiler check), `AgentChatPage.test.ts` (70 passed), story runs for `AgentChatPage.stories.tsx` and `WorkspacePill.stories.tsx` (49 passed in Chromium). > Xum acted on Mike's behalf (@ibetitsmike). <!-- xum-attribution: model=claude-opus-4-6 thinking=high --> |
||
|
Jake Howell
|
614b5e2d22 |
chore(site): remove outdated featured empty-state images (#28454)
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell. ## What The images in `site/static/featured` were outdated and no longer resembled the current UI, so this removes them along with the code that referenced them: - `workspaces.webp` — was the faded background image in the Workspaces empty state (`WorkspacesEmpty.tsx`). - `templates.webp` — was only referenced by a Storybook story (`TableEmpty.stories.tsx`). - `scheduling.webp` — had no references anywhere in the codebase. ### Cleanup alongside the removal - Dropped the `image={defaultImage}` prop (and the now-dead `defaultImage`) from all three `WorkspacesEmpty` states. - Removed the `className="pb-0"` / `paddingBottom: 0` overrides that only existed to seat the image flush against the bottom, restoring balanced padding. - Renamed the `TableEmpty` story `WithImageAndCta` → `WithCta` since it no longer has an image. ## Old | New | Surface | Old | New | |---|---|---| | Workspaces empty state | <img width="2306" height="1376" alt="main-tableempty" src="https://github.com/user-attachments/assets/1d3a5201-66ce-4f80-a2ea-5638221f95d0" /> | <img width="2306" height="1376" alt="pr-tableempty" src="https://github.com/user-attachments/assets/5a8fcc1d-b676-46e6-be54-12ff7f3489fd" /> | | Table empty state (templates) | <img width="2306" height="1376" alt="main-workspaces-empty" src="https://github.com/user-attachments/assets/7618ee1f-09d4-4398-8a1c-19362f63c80d" /> | <img width="2306" height="1376" alt="pr-workspaces-empty" src="https://github.com/user-attachments/assets/8a9c98a9-24b7-4c90-9959-f85dbc2daa9f" /> | | `scheduling.webp` | Unused | Deleted 🙂 | <details> <summary>Implementation notes / decision log</summary> - Verified references with a repo-wide search for `/featured/` and each `*.webp` filename. Only `WorkspacesEmpty.tsx` (real usage) and `TableEmpty.stories.tsx` (Storybook-only) referenced them; `scheduling.webp` was fully unused. - `EmptyState`'s `image` prop is optional, so removing usages required no component changes. - Delete-only (per request): no replacement images committed. The empty states now render as clean text/CTA layouts. - "New" screenshots were captured from Storybook (a temporary `WorkspacesEmpty` story was used only to render the states and was **not** committed). - Verified with `tsc --noEmit` (0 errors) and `biome check` (clean) on the changed files. </details> |
||
|
Ethan
|
eab5e28695 |
fix: move organization model overrides from Models to Coder Agents settings (#28473)
## Summary Relocates the organization-scoped Coder Agents model override controls from the **Defaults & overrides** tab under **AI Settings > Models** into an **Organization settings** section on **AI Settings > Coder Agents**. Models remains the home for reusable model definitions, provider availability, default designation, and ACLs; Coder Agents now owns all agent-specific model/reasoning override controls. The backend organization scoping from #28442 is unchanged. ## Changes - **Coder Agents page** is split into two sections: - **Organization settings**: General subagent, Explore subagent, title generation, compaction, and Advisor (behind the `chat-advisor` experiment) model/reasoning overrides, with an organization picker when more than one accessible organization exists. - **Deployment settings**: personal override policy, virtual desktop provider (behind its experiment), and Advisor usage limits, visible only with `editDeploymentConfig`. - **Permissions**: the page and its sidebar entry are accessible with either `editDeploymentConfig` or organization chat model access. Organization mutations require `editChatModelConfigs` on the selected organization; otherwise controls render read-only. Organization discovery, selected-organization permissions, and deployment queries fail independently. - **Models page** drops the Defaults & overrides tab and the now-single-item tab UI. The old `DefaultsPage` components move to `CoderAgentsPage/OrganizationAgentSettings*`. - **Compatibility**: `/ai/settings/models/defaults` redirects to `/ai/settings/coder-agents`, preserving `org` and other query parameters. - **Docs**: intentionally not updated here; a follow-up PR will update `docs/ai-coder/agents/models.md` and `docs/ai-coder/agents/platform-controls/advisor.md`. ## Testing - Targeted unit tests (`ModelDefaultsRedirect`, `organizationModels`): 9 passing. - Affected Storybook interaction tests (Coder Agents page/view, organization agent settings, Models layout, AI settings sidebar): 41 passing. - `pnpm check`, full `pnpm lint` (Biome, tsc, circular deps, React compiler, knip), `pnpm format`. |
||
|
Jake Howell
|
d12cc2da21 |
fix(site): measure virtualized log row heights (#28251)
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell. Fixes coder/coder#25692. Closes coder/coder#25692. Supersedes coder/coder#28250. ## Problem `AgentLogs` virtualizes rows with a **fixed** `itemSize` (20px), so react-window sets the total scroll height to `itemCount * 20`. Log entries that contain newlines render taller than 20px, so the estimate falls short: tall rows overlap the rows below them and the true bottom sits past where `scrollToItem(..., "end")` can reach. The last lines become unreachable. ## Fix Switch to `VariableSizeList` and measure each row with a `ResizeObserver`, feeding the real height back via `resetAfterIndex`. The total scroll height now tracks the real content, so the bottom is always reachable. `AgentRow` and `TaskPage` only change the ref type; their existing autoscroll now lands correctly. ## Before / After Dogfooded on a local instance with a workspace whose agent logs include multi-line entries (241 entries, every 30th a 6-line block, plus a final bottom-marker line). Same workspace, same scroll interaction, `main` vs this branch: <!-- linear:table-colwidths:266,266,266 --> | | Before (`main`, `FixedSizeList`) | After (this PR, `VariableSizeList`) | | -- | -- | -- | | **A multi-line entry** | Painted into a 20px slot, so it collides with the rows above and below (text on top of text). | Rendered at full height in its own space, neighbours no longer overlap. | | |  |  | | **Scrolled to the bottom** | Total height is short, so normal scrolling stops early: the final marker line is clipped and unreachable. | Height tracks real content: the final marker line is fully visible and reachable. | | |  |  | ## Validation The new `AgentLogs.test.tsx` renders rows measured taller (40px) than the estimate and asserts the scroll area is sized from measured heights. Run against the `main` implementation it fails, against this branch it passes: ``` # main (FixedSizeList): scroll area = 5 rows * 20px - Expected 200 + Received 100 → FAIL # this branch (VariableSizeList): scroll area = 5 rows * measured 40px ✓ AgentLogs.test.tsx (1 test) → PASS ``` Also green: `tsc`, `biome check`, and the AgentRow (25) + TaskPage (46) + AgentLogs (3) Storybook interaction tests. <details><summary>Dogfood details and decision log</summary> **Dogfood setup** (SHA `1228dcfe8d`, `./scripts/develop.sh`): template `lognl2` (a `coder_agent` on a `null_resource` so the agent authenticates against a real build), workspace `lognl-demo2`. Posted 241 log entries via `PATCH /api/v2/workspaceagents/me/logs`, every 30th a 6-line `\n` entry plus a bottom marker; confirmed the 8 multi-line entries persisted with embedded newlines. On the fixed build, at maximum scroll the DevTools console reported `scrollTop 5204`, `scrollHeight 5460`, `clientHeight 256`, `remaining 0`, marker clipped `0px`; height is self-consistent (`innerHeight 5428` + 16px top + 16px bottom padding = `5460`). **Decision log** * coder/coder#28250 treated this as an autoscroll problem. Wrong: the height calculation is the bug, so no scroll target can reach a bottom placed out of range. Reverted. * Only embedded newlines make a row exceed 20px; long lines do not wrap (they overflow horizontally). A fixed constant can't cover a variable line count, so measuring is the robust fix. * `resetAfterIndex` can't run from a row's first-mount measurement effect because the list ref is assigned after child rows commit; the lowest changed index is recorded and flushed from a parent layout effect. </details> Evidence images are hosted on the `devex-407-evidence` branch of the author's fork (`jakehwll/coder`) to keep this repo's diff clean. |
||
|
Jake Howell
|
18b37e64f5 |
chore(site/e2e): re-enable externalAuth suite (#26648)
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell. Stack: 1. #26575 `fix(site/e2e): close mock external-auth servers in teardown` 2. #26793 `fix(site/e2e): accept 404 from external auth reset hook` 3. #26795 `fix(site/src): refresh provider state after device-flow exchange` 4. #26798 `fix(site/e2e): reset both providers in external auth hook` 5. #26648 `chore(site/e2e): re-enable externalAuth suite` ← this PR Removes the `test.describe.skip` introduced in #17235 so the externalAuth suite runs in CI again. Splitting the five commits keeps the bisection signal clean if CI behaviour changes after the un-skip. Local verification of the full stack: `pnpm playwright:test e2e/tests/externalAuth.spec.ts --repeat-each=20 --workers=1` → 61/61 passing in 4m48s. Large whitespace churn in the diff is biome reformatting the body to its natural indentation after the single-line `test.describe(...)` opener. The only semantic change is removing `.skip`. Refs https://linear.app/codercom/issue/DEVEX-413 Refs https://github.com/coder/internal/issues/356 |
||
|
Jake Howell
|
cfc66b5de3 |
fix: reset both providers in external auth hook (#26798)
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell. Stack: 1. #26575 `fix(site/e2e): close mock external-auth servers in teardown` 2. #26793 `fix(site/e2e): accept 404 from external auth reset hook` 3. #26795 `fix(site/src): refresh provider state after device-flow exchange` 4. #26798 `fix(site/e2e): reset both providers in external auth hook` ← this PR 5. #26648 `chore(site/e2e): re-enable externalAuth suite` Surfaced by stress-testing the leaf state of the stack locally with `--repeat-each=N`. The suite passes on iter 1, then deterministically fails the device test on every subsequent iteration: | iter | device | web | workspace | |---|---|---|---| | 1 | ✓ 2.8s | ✓ 2.5s | ✓ 6.2s | | 2 | **✘ 30.1s** | ✓ 2.6s | ✓ 6.2s | | 3 | **✘ 30.1s** | ✓ ~2.5s | ✓ ~6s | | … | … | … | … | `resetExternalAuthKey` in `site/e2e/hooks.ts` only deletes the link for `gitAuth.webProvider`, never `gitAuth.deviceProvider`. So: ```ts path: `/api/v2/external-auth/${gitAuth.webProvider}?coder_session_token=${sessionCookie?.value}`, ``` Iter 1 of the device test creates a link for the `device` provider against the test user. The cleanup hook between tests resets `web` but not `device`. On iter 2 the page hits `/external-auth/device`, `externalAuthProviderQuery.data.authenticated` is already `true`, the page renders the authorized state immediately, and the test's `sentPending.wait()` hangs forever because the mock token endpoint is never polled. The whole test times out at 30s. Fix: reset every provider the suite exercises. Refactored the per-link delete into a Promise-returning helper so errors actually propagate; the previous `throw` inside the response and `error` callbacks crashed the worker rather than rejecting the call. Doesn't affect CI (single run per PR, fresh `--ephemeral` coderd), but it makes the suite robust to local stress testing and to anyone re-running it in the same coderd process. Filed before the un-skip lands so the un-skipped suite is repeatable from day one. Local verification: `pnpm playwright:test e2e/tests/externalAuth.spec.ts --repeat-each=20 --workers=1` → 61/61 passing in 4m48s. Same command before this fix → 1 pass, then deterministic device-test timeouts. Refs https://linear.app/codercom/issue/DEVEX-413 <details> <summary>Why a separate PR</summary> This is the fourth distinct root cause that piled up while the suite was skipped, and it's orthogonal to the other three. #26575 fixes the listener leak, #26793 fixes the 404 hook contract drift, #26795 fixes the dropped invalidation, and this PR fixes the per-test cleanup so the suite is actually repeatable. #26648 then just flips `.skip`. </details> |
||
|
Michael Suchacz
|
b6d7653231 |
fix: apply MCP server selection when editing a chat message (#28471)
## Problem
Editing a user message in an Agent chat silently dropped the MCP server
selection. The composer renders the MCP picker in edit mode and toggles
update local client state, so the picker displayed the new selection,
but the edit request omitted `mcp_server_ids` at every layer (frontend
request builder, `codersdk.EditChatMessageRequest`, the `PATCH
/chats/{chat}/messages/{message}` handler, and `chatd.EditMessage`). The
chat's persisted selection never changed and the regenerated turn ran
without the newly enabled MCP tools. Two dogfood users hit this within
hours; there is no error anywhere and the UI shows the opposite of the
server state.
## Changes
- `codersdk`: add `MCPServerIDs *[]uuid.UUID` to
`EditChatMessageRequest`, mirroring `CreateChatMessageRequest` (nil
preserves the current selection).
- `chatd`: extract the send path's MCP update block into one shared
`applyRequestedMCPServerIDs` helper (explore-subagent snapshot
immutability guard plus Force On enforcement, Cure53 CDM-02-010) and
call it from both `SendMessage` and `EditMessage`, so enforcement cannot
drift between the two paths.
- `coderd`: extract the send handler's request validation (dedupe,
enabled-in-organization check, persisted-ID exemption) into
`normalizeRequestedChatMCPServerIDs` and wire it into the edit handler,
which now threads the selection into `EditMessageOptions`.
- Frontend: the edit request now includes `mcp_server_ids:
[...effectiveMCPServerIds]`, exactly like the send path, making the
picker's displayed state real.
- `make gen` artifacts (swagger, API docs, `typesGenerated.ts`).
## Tests
Each layer is covered and was proven with independent red toggles
(removing one layer's wiring fails only that layer's tests):
- chatd (`TestEditMessage_MCPServerIDs`): edit applies a provided
selection, nil preserves it, an emptied list cannot remove a `force_on`
server, and explore subagent chats keep the spawn-time snapshot.
- API (`TestPatchChatMessage/MCPServerIDsApplied`,
`MCPServerIDsInvalidRejected`): persistence via the endpoint, omission
preserves, unknown IDs get the same 400 as the send path.
- Storybook (`EditAppliesMCPServerSelection`): toggling a server on
during an edit puts it in the edit request payload.
Note: the `AgentChatPage.stories.tsx` story "Queued For Capacity After
Polling" fails locally on current main as well (verified against the
main baseline with this branch's changes reverted); it is unrelated to
this diff.
Remote dogfood UAT ran on the exact head and passed, including proof
that the regenerated turn actually gains the newly enabled MCP server's
tools.
> 🤖 Xum acted on Mike's (@ibetitsmike) behalf. • Model:
`anthropic:claude-fable-5`
<!-- xum-attribution: model=anthropic:claude-fable-5 -->
|
||
|
Michael Suchacz
|
a48aedd924 |
fix(coderd/x): surface Gemini malformed-function-call stream deaths as retryable errors (#28470)
## Problem
When Gemini's OpenAI-compatible endpoint rejects a model-generated
function call server-side, it ends the SSE stream cleanly with the
nonstandard finish reason `function_call_filter:
MALFORMED_FUNCTION_CALL` after streaming only thought summaries; the
rejected call never reaches the wire. chatd treated this as a normal
completion: fantasy maps the unrecognized finish reason to `unknown`,
the reasoning block never closes (the only non-thought delta is the
`</thought>` marker, which the transport seam strips to an empty string,
and the openaicompat hook only ends reasoning on a non-empty content
delta), so the step accumulates no content and the generation loop
finishes the turn as complete. The user sees the model think for ~40
seconds and then nothing: no assistant message, no `last_error`, chat
status `waiting`. Observed twice in a row in production on
gemini-3.7-flash, with "Resume" reproducing it identically.
## Fix
Two independent layers:
- `coderd/x/googleopenai`: the stream rewrite now converts any chunk
whose `finish_reason` starts with `function_call_filter` into an
OpenAI-style SSE `{"error": ...}` event embedding the raw reason.
openai-go turns error-bearing events into stream errors, so the failure
rides the existing stream-error path instead of ending the stream
cleanly.
- `coderd/x/chatd/chaterror`: classifies that injected error as
retryable (kind `generic`, provider `google`) with a clear user-facing
message, so the existing generation retry machinery re-runs the step and
persists a `last_error` if retries exhaust.
- `coderd/x/chatd/chatloop`: provider-agnostic guard: a step that
produced no user-visible content and no tool calls under a finish reason
of `unknown`, `error`, `other`, or `tool-calls` (a tool-calls finish
that delivered zero calls) now returns a retryable error instead of
silently completing the turn. `stop` and `length` finishes keep their
existing semantics.
Tests cover the seam rewrite (live-capture SSE shape plus standard
finish reason passthrough), the new classification, and the chatloop
guard (error cases plus preserved stop, length, text, and tool-call
behavior). Each layer was red-green verified independently.
Remote dogfood UAT ran against this exact commit: normal reasoning and
tool-call chats on a real model complete cleanly with no spurious guard
errors and no retry loops. The Google-side failure itself is not
deterministically triggerable against live Gemini and is owned by the
unit tests.
> Xum acted on Mike's (@ibetitsmike) behalf.
<!-- xum-attribution: model=claude-opus, thinking=enabled -->
|
||
|
J. Scott Miller
|
76962273d8 |
feat: add coder organizations edit for default member roles (#28227)
`default_org_member_roles` was only settable through Terraform or a raw
`PATCH /api/v2/organizations/{organization}`. This adds a CLI
equivalent.
```console
coder organizations edit --org acme --default-org-member-roles organization-workspace-access,organization-template-admin
coder organizations edit --org acme --default-org-member-roles "" # grant no roles
```
- The flag replaces the organization's current list rather than adding
to it. It accepts a comma-separated list, may be repeated, and
de-duplicates. An empty value removes every role.
- Removing a role prompts for confirmation, listing the roles being
removed, unless `-y` is passed. Adding roles applies without a prompt.
- The resulting set is printed, so no follow-up command is needed to
confirm what was applied.
- The organization is chosen with `-O/--org` or `$CODER_ORGANIZATION`,
and is implicit when the caller belongs to exactly one organization.
The org update endpoint is behind `FeatureMultipleOrganizations`, so the
command is enterprise/premium only. Non-built-in roles are rejected by
the server, and `dbauthz` already prevents a caller from setting a
default they could not assign to a member individually.
<details>
<summary>Implementation notes</summary>
## Shape
`codersdk.UpdateOrganizationRequest.DefaultOrgMemberRoles *[]string` and
the enterprise `patchOrganization` handler already existed; only the CLI
was missing, and nothing in `cli/` called `UpdateOrganization` at all.
No server or SDK changes are needed.
`organizations edit` follows the partial-update pattern of `coder groups
edit`: check `ParsedFlags().Changed(...)`, populate only the fields the
user set, and leave the rest nil so the handler preserves them. Passing
no flags is an error.
Two earlier shapes were tried and dropped:
- **A `default-org-member-roles` entry in the `organizations settings`
registry.** Every sibling entry unmarshals an SDK type that maps 1:1 to
a dedicated endpoint; this field has no such endpoint. Reusing
`UpdateOrganizationRequest` for the piped JSON meant a stray `name`
field could rename the org, and the documented `show > file`, edit, `set
< file` workflow failed on the default organization, whose name is
reserved.
- **A `--default-org-member-roles` flag on `organizations create`.**
`create` cannot set display name, description, or icon either, so a
roles-only flag there is asymmetric. It would also require
`CreateOrganizationRequest` to grow the field plus server-side
validation.
## Known sharp edge
`serpent.StringArray` resets its slice when any flag value is empty, so
`--default-org-member-roles a --default-org-member-roles ""` clears the
list rather than keeping `a`. This is pinned by a test and called out in
a code comment. The confirmation prompt catches it interactively; a
script passing `-y` would not. A custom flag value that ignores empty
occurrences was prototyped and reverted as more machinery than the
behavior warranted.
## Validation
Manually verified against a local dev deployment with a premium license:
setting, adding, clearing, prompt accepted and declined, duplicate and
whitespace handling, invalid role rejection, and a plain member being
denied. Confirmed with `/authcheck` that a member loses workspace-create
access when the roles are cleared and regains it when restored, and that
the change is recorded in the audit log.
## Follow-ups worth considering
- `--name`, `--display-name`, `--description`, and `--icon` on
`organizations edit`; all already exist on `UpdateOrganizationRequest`.
Rename deserves its own discussion.
- Setting the defaults to `organization-admin` makes every member an org
admin, including the ability to edit the org further, and those users
still render as plain members in member listings. Reachable today via
the API, UI, and Terraform; a warning on privileged roles would help.
- `dbauthz.InsertOrganization` has no `canAssignRoles` check, unlike
`UpdateOrganization`. Harmless while the only caller passes the
deployment default constant.
- `docs/admin/users/organizations.md` still points users at the
dashboard or a raw `PATCH`.
</details>
---
Created by Coder Agents on behalf of @jscottmiller.
|
||
|
Spike Curtis
|
6a58d50f1d |
feat(coderd): add queue-position-free provisioner job query (#28367)
Follow-up to #28302 ([GRU-82](https://linear.app/codercom/issue/GRU-82), [RFC](https://app.notion.com/p/coderhq/Lite-Workspace-API-Requests-3aad579be5928060b5e7cc65c539717f)). That PR added related-data selection but noted that selecting `latest_build.job` still ran the expensive `GetProvisionerJobsByIDsWithQueuePosition` query, which computes queue position and size with window functions over pending jobs and provisioner daemons and is consistently the top resource consumer in scale tests. This PR adds a cheaper `GetProvisionerJobsByIDs` query that fetches jobs by ID without the queue-position computation, and selects between the two based on whether `latest_build.job.queue_position` is requested. When the queue position is not selected, `QueuePosition` and `QueueSize` are left zero and the rest of the response is unchanged. Both paths go through a single `provisionerJobsByIDs` API method that takes the `jobRelated` selection, switches on it, and reshapes the cheaper query's rows into `GetProvisionerJobsByIDsWithQueuePositionRow` so downstream conversion is uniform. The new query has the same dbauthz properties as the queue-position variant (system-level pass-through pending the proper provisioner-job RBAC check tracked in #16160), with a matching authorization test. No behavior change for existing callers: they select `queue_position` (via `allLatestBuildRelated`), so they continue to use the queue-position query. --- *Generated by Coder Agents on behalf of @spikecurtis.* |
||
|
Jake Howell
|
990a7c64f3 | fix(site): show "Never" for unused tokens (#28453) | ||
|
Ben PotterandNick Vigilante
|
3bdd395faa |
docs(docs/admin/templates/extending-templates): clarify coder_env merge_strategy does not include host environment (#28466)
`merge_strategy` on `coder_env` only combines values across `coder_env` resources targeting the same name. It does not know about the value already set by the workspace's image or host, such as the base `PATH`. A user hit this in #27501: appending to `PATH` with three `coder_env` resources replaced the host's `PATH` entirely, since none of them referenced the existing value. Clarify this in the docs, and update the `PATH` example to show referencing `$PATH` in one of the resources so the host's original value is kept. Refs #27501 <details> <summary>Investigation notes</summary> - `coderd/provisionerdserver/provisionerdserver.go` builds the merged env starting from an empty map (`MergeExtraEnvs`), only combining `coder_env` resources with each other. - `agent/agent.go`'s `updateCommandEnv` applies the result with `os.ExpandEnv(v)`, which expands `$VARNAME` against the agent's real process environment. - Confirmed with a standalone repro that `value = "$PATH:/usr/local/cuda/bin"` preserves the host's real `PATH` and appends the extra directory, and that this composes correctly across multiple `coder_env` resources with `merge_strategy = "append"` as long as one of them references `$PATH`. - A companion PR updates the `terraform-provider-coder` schema description and example that feed the registry docs: https://github.com/coder/terraform-provider-coder (branch `bpmct/docs-env-merge-host`). </details> --- *Opened by Coder Agents on behalf of @bpmct.* --------- Co-authored-by: Nick Vigilante <nickvigilante@users.noreply.github.com> |
||
|
Jeremy Ruppel
|
3c89b09734 | fix(site/src/pages/TemplateBuilder): validate customizations form before submit (#28081) | ||
|
Ethan
|
9b5f47eeb7 |
fix(site/src): repair failing Storybook stories (#28462)
## Summary Repair the Storybook interaction and Pixel failures currently present on `main`. The failures came from organization-scoped model changes leaving stories with incomplete providers and query fixtures, product copy and route changes leaving stale assertions, and several interaction tests depending on implementation details or teardown timing. ## Broken stories and fixes ### Organization-scoped chat models PR #27960 introduced organization-scoped chat models and the following regressions: - `OrganizationModelsLayout / Switch Organization Preserves Auxiliary Parameters`, `Invalid Requested Organization Falls Back To Default`, `Invalid Requested Organization Denies Add`, `Duplicate Display Names Are Disambiguated`, and `No Readable Organization Is Not Found`: the stories only populated permission query keys for individual organizations, while the accessible-organization lookup requests authorization for all visible organization IDs together. The unmatched `/api/v2/authcheck` request returned a Storybook proxy 502, so the layout rendered an error instead of the intended picker, fallback, denied, disambiguation, or not-found state. Add fixtures for the combined organization-permission keys, preserve the intentionally denied permission map, and return an explicit empty authorization result for the no-readable-organization case. - `ModelFormProviderConfig / Provider Config Open AI`, `Provider Config Anthropic`, and `Provider Config Open AI Web Search`: `ModelForm` began consuming `OrganizationModelsContext`, but these stories were not wrapped in its provider and rendered the router error boundary. Add the same organization-model context decorator used by the sibling model form stories. - `AgentChatPage / Queued For Capacity After Polling`: the story retained a manually assembled chat-and-messages fixture after the page gained organization-model, provider, workspace, prompt, diff, chat-list, and authorization dependencies. Those missing queries prevented the polling request from being reached. Replace the partial fixture list with the shared `buildQueries()` setup. - `DashboardLayout / Custom Organization Role Can Open Models`, `DashboardLayout / ACL Readable Member Can Open Models`, and `NavbarView / For Member With Model Access`: these stories also landed in #27960 and inherited Pixel's tablet-and-desktop matrix, but their play functions exercise the desktop `Models` link. Pixel's 744px tablet viewport renders that link inside the closed mobile menu, so the desktop query always failed there. Restrict these authorization-to-navigation stories to the desktop matrix; mobile Models navigation remains covered by the dedicated `MobileMenu` story. ### Premium copy and navigation - `DeploymentSidebarView / Premium Tab Visible` and `Premium Tab Hidden`: PR #28226 renamed the production navigation item from `Premium` to `Trial Upgrade`, but added stories that still queried the old name. Update both the positive and negative assertions so the hidden-state story cannot pass while the real CTA is present. - `PremiumPageView / No License`: PR #28226 changed the production heading to `Start an unlimited 30-day Coder trial` while the story asserted the previous Premium wording. Update the accessible heading assertion to the rendered copy. - `AgentChatPageView / Queued For Capacity Community Admin`: PR #28437 intentionally moved the trial CTA from `https://coder.com/trial` to the internal `/deployment/premium` route, leaving the story's href assertion stale. Update the expected route while retaining the link-name and callout checks. ### MCP server refetch behavior - `AgentCreateForm / MCP Servers Error Shows Alert And Disables Send` and `MCP Servers Refetch Error Keeps Send Enabled`: the MCP coverage was introduced in #27942. PR #28442 later added a second unconditional MCP `ErrorAlert`, so a background refetch error appeared even when cached MCP data remained usable. The refetch story also called `refetchQueries()` without a key, which began refetching unrelated active model queries as the form's query surface expanded and produced unmatched API failures. Remove the duplicate unconditional alert, refetch only the organization's MCP query, and use semantic alert and heading assertions. Initial-load failures still disable Send, while background failures with cached data keep Send enabled without replacing the form with an error. ### Interaction and teardown stability - `IconField / Open Picker`: PR #27674 changed this story to wait for the `em-emoji-picker` custom element. That implementation-specific query races the lazy-loaded picker chunk and violates the component's observable contract. Keep the button state assertion and wait for the visible dialog instead. - `AgentChatPage / Slash Compact Command Submits` and `Slash Compact Yields To Personal Skill`: the command story added in #27081 waited on cmdk's `Commands` group heading, which is accessibility-hidden, while the skill variant queried raw implementation text. Menu placement and visibility are asynchronous, especially after the positioning changes in #28411. Wait for the visible selectable options by role before pressing Enter. - `AgentChatPageView / Terminal Focus On Tab Switch`: the focus coverage added in #24677 exposed an xterm teardown race rather than a product navigation regression. xterm queues its initial viewport synchronization, but Storybook could synchronously dispose the terminal first, leaving the queued callback to read a cleared renderer and report an unhandled error. Clear React state immediately, defer xterm disposal by one timer turn, query the labeled terminal textbox semantically, and remove the unnecessary empty WebSocket message fixture. |
||
|
Cian Johnston
|
042421694f |
fix: surface duplicate AI provider hostname as warning, not error (#28208)
Two live `ai_providers` rows can share the same `base_url` hostname.
This is an intended configuration (AIGOV-97): the direct routing path
(`/api/v2/ai-gateway/{name}/...`) routes by provider name and fully
supports it. Only the MITM proxy path (`aibridgeproxyd`) cannot
disambiguate, because its `nameByHost` map is 1:1.
`classifyProviderRow` marked the second provider as
`ProviderStatusError`, which surfaced as a misleading log warning and a
`status=error` Prometheus label. The provider is not actually broken; it
is fully routable via the direct path. The error was only visible in
server logs and Prometheus, not in the API or UI.
This change:
- Extracts `BaseURLHostname` into `coderd/aibridged` and eliminates
three duplicate implementations (proxy classifier, chatprovider, and the
API layer now uses it for status checks).
- Downgrades the proxy classifier from `ProviderStatusError` to a new
`ProviderStatusProxyExcluded` status. The provider is not broken; it is
just not reachable via the MITM proxy path.
- Adds `Status *AIProviderStatus` to `codersdk.AIProvider` with
`Warnings []string`, matching the `WorkspaceProxy` precedent.
- Populates warnings on create, update, GET, and list when a provider's
hostname collides with another enabled provider.
- Adds an integration test proving that a duplicate provider is routable
via the direct path but not via the proxy path.
Refs AIGOV-596
Generated by Coder Agents
https://github.com/user-attachments/assets/bf323837-5121-4d1b-ab19-593f1d32374e
|
||
|
earapo13andNick Vigilante
|
defd5d48a1 |
docs: clarify that Coder server should run on a separate machine (#27468)
Closes [DOCS-600](https://linear.app/codercom/issue/DOCS-600/make-it-clear-in-the-quickstart-that-you-should-install-the-coder). The Quickstart guide has readers install and run `coder server` on the same machine they're working from, without calling out that this is only for a quick trial. Coder's actual value comes from remote development, so hosting the Coder server on a separate machine has a lot more power than running it locally. This adds two notes to `docs/get-started/index.md`: - In **Prerequisites**, explaining that this quickstart runs the server locally for convenience, but a real deployment should host it on a separate machine, and linking to the [Install](https://coder.com/docs/install) page. - In **Step 2: Install and start Coder**, a shorter reminder right before the install commands. ---- Created using Coder Agents 🤖 --------- Co-authored-by: Nick Vigilante <nickvigilante@users.noreply.github.com> |
||
|
|
df6a33ad37 |
docs: fix broken extending-templates examples (dynamic-parameters, docker-in-workspaces) (#28100)
## Summary Fixes broken examples on the `extending-templates` pages surfaced by the DOCS-637 runtime drift sweep, and completes the dangling `external-auth` reference. Verified against `main` and the CLI source (`coder templates init --id`, `coder templates push`). ## Changes | Page | Fix | |------|-----| | `dynamic-parameters.md` | The **Dynamic Validation** snippet referenced an undefined `show_cpu_cores` through a stray `count = data.coder_parameter.show_cpu_cores.value ? 1 : 0` line copied from the earlier Hide/Show Options example. Standalone copy failed `terraform validate`. Removed the `count` line (and its misleading "Only show this parameter" comment) so the snippet is self-contained. The valid occurrence in the Hide/Show example (where `show_cpu_cores` is defined) is untouched. | | `docker-in-workspaces.md` | The rootless Podman step used `echo "kubernetes-with-podman" \| coder templates init`, but `kubernetes-with-podman` isn't a built-in starter id, so the command scaffolds nothing. Step 4 now starts from the built-in `kubernetes` starter (`coder templates init --id kubernetes`) and shows the minimal Podman delta inline: the maintained `codercom/example-podman:ubuntu` base image, the `container.apparmor.security.beta.kubernetes.io/dev = unconfined` pod annotation, and a `github.com/fuse` device limit. The starter already runs as UID/GID 1000 with `run_as_non_root`, which rootless Podman needs. Also switches the deprecated `coder templates create` to `coder templates push`. Follow-up from review: swapped `ghcr.io/coder/podman` for the maintained `codercom/example-podman:ubuntu` image and linked its source, added a note that the AppArmor annotation is deprecated on Kubernetes 1.30+ (`securityContext.appArmorProfile`), and added an EKS Auto Mode caveat to the Bottlerocket section. | | `external-auth.md` | The **External Auth Providers** sentence dead-ended at "...in the Coder Control Plane. See" with no link. Completed it with a link to the admin External Authentication page (`../../external-auth/index.md`), the target chosen in review. | ## Dependency The `docker-in-workspaces.md` example now references `codercom/example-podman:ubuntu`, published by coder/images#339. That PR is approved but should merge (and publish the image to Docker Hub) before this PR merges, so the docs don't point at an image that doesn't exist yet. Linear: https://linear.app/codercom/issue/DOCS-645 > This PR was created with AI assistance (Coder Agents). --------- Co-authored-by: Ben Potter <me@bpmct.net> Co-authored-by: Ben Potter <ben@coder.com> |
||
|
Atif Ali
|
54d4ae9aca | fix: detect Xum client in aibridge after Mux rename (#28448) | ||
|
Ethan
|
c275327fb7 |
feat: audit operational agent settings (#28369)
Depends on #28394. Audit changes to seven operational agent settings through a typed `chat_operational_settings` resource. Each handler serializes baseline capture and mutation with a per-setting advisory lock, keeps both operations in one transaction, and records field-specific diffs. Effective no-op requests now skip both the database upsert and the success audit, including absent rows whose effective value is already the default. The change also retains the allowlisted raw `site_configs` query, updates generated audit and API surfaces, adds failure and concurrency coverage, and reuses the existing AuditPage resource-filter story pattern. Relates to CODAGT-720. |
||
|
Ethan
|
2aba2685ad |
fix: require audit capture for chat settings (#28394)
Existing chat instruction setting handlers could complete a mutation without an audit event when advisory locking or old-state capture failed. Make system prompt and plan mode instruction updates fail closed: baseline capture and mutation stay in one transaction, audit infrastructure failures reject the request without changing the setting, and focused tests cover lock, read, transaction, and write failures. |
