Ethan 68808c015e fix: allow agents to attach any file type (#26560) ...

Agents can now attach any file type as a downloadable chat artifact,
where previously the stored-file allowlist rejected types like `.zip`.

The reason arbitrary types were blocked is that a single media-type list
(`codersdk.AllChatAttachmentMediaTypes`) was doing three different jobs
at once: gating what users may upload as prompt input, deciding what is
safe to render inline in the browser, and admitting what the agent's
`attach_file` could store. Because the agent storage path reused that
same list as an admission gate, any artifact outside it was rejected
even though agent artifacts are only ever downloaded by the user and are
never forwarded to the model, so the prompt-input and inline-render
constraints did not actually apply to them.

This splits those concerns. `PrepareStoredFile` now only normalizes the
name and classifies the bytes, and the prompt-input allowlist is
enforced inline at `postChatFile` instead, which is the correct layer
for user-provided input.

User uploads are unchanged and still limited to the allowed prompt-input
media types, and unsafe or unknown types remain download-only because
`IsInlineRenderableStoredMediaType` still refuses to render them inline.

Model replay is also unchanged: assistant and tool attachments are never
forwarded to the LLM.

Closes CODAGT-654

2026-06-25 00:51:13 +10:00

..

agentapi

feat: GET /api/v2/agent-firewall/sessions/{id} (#24814)

2026-06-18 20:50:17 +02:00

agentmetrics

…

aibridge

feat: add /api/v2/ai-gateway API route aliases (#26475)

2026-06-23 12:15:10 +01:00

aibridged

feat: add /api/v2/ai-gateway API route aliases (#26475)

2026-06-23 12:15:10 +01:00

aibridgedserver

feat: record cost on aibridge token usages (#26229)

2026-06-16 20:09:00 +00:00

aiseats

refactor: rename Ai* database identifiers to AI* (AIGOV-369) (#26327)

2026-06-16 09:01:43 +00:00

apidoc

feat: plumb time_til_autostop_notify template field (#26439)

2026-06-23 17:32:47 -05:00

apikey

fix: initialize API key LastUsed to Unix epoch instead of zero time (#22327)

2026-03-02 16:02:01 +01:00

appearance

…

audit

refactor: rename Ai* database identifiers to AI* (AIGOV-369) (#26327)

2026-06-16 09:01:43 +00:00

authlink

chore: add --force-reset-all flag to oidc link repair cli (#26534)

2026-06-23 11:37:33 -05:00

autobuild

fix(coderd): show correct deletion time in dormancy notification (#26488)

2026-06-18 20:17:37 +00:00

awsidentity

…

azureidentity

chore: skip failing azureidentity test while under investigation (#26545)

2026-06-19 12:49:49 +01:00

boundaryusage

fix: make boundary usage telemetry collection atomic (#21907)

2026-02-06 09:52:17 -07:00

cachecompress

fix(site): avoid duplicating bin download headers (#22981)

2026-03-13 00:22:55 +11:00

coderdtest

feat: add /api/v2/ai-gateway API route aliases (#26475)

2026-06-23 12:15:10 +01:00

connectionlog

feat: batch connection logs to avoid DB lock contention (#23727)

2026-04-03 15:47:26 -05:00

cryptokeys

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

database

feat: plumb time_til_autostop_notify template field (#26439)

2026-06-23 17:32:47 -05:00

devtunnel

chore: remove unnecessary loop variable captures (#22180)

2026-02-19 09:02:19 +00:00

dynamicparameters

chore: remove coder_secret Terraform integration (#25512)

2026-05-21 09:19:29 -06:00

entitlements

feat: add Prometheus metrics for license warnings and errors (#21749)

2026-01-29 13:50:15 +01:00

externalauth

fix(coderd/externalauth): support disabling token refresh retries (#26231)

2026-06-11 15:33:20 -05:00

files

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

gitsshkey

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

healthcheck

fix(coderd/healthcheck/derphealth): avoid data races in DERP report (#24795)

2026-04-28 13:06:45 -07:00

httpapi

chore(coderd/httpapi): deflake TestWSWatcher (#26495)

2026-06-18 10:08:29 +01:00

httpmw

fix(coderd/httpmw): honor fixed lifetime for CLI API tokens (#26376)

2026-06-15 18:46:25 +02:00

idpsync

chore(coderd/idpsync): remove stale TODO (#26198)

2026-06-10 10:20:18 -06:00

jobreaper

refactor: extract test helpers in coderd/jobreaper to reduce duplication (#23001)

2026-03-19 21:51:26 +00:00

jwtutils

…

mcp

fix: isolate MCP HTTP transports from DefaultTransport in tests (#25821)

2026-06-01 16:17:29 +03:00

metricscache

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

notifications

feat: add workspace autostop reminder template (#26429)

2026-06-23 10:16:17 -05:00

oauth2provider

chore: standardize on *_internal_test.go for white-box tests (#25601)

2026-05-22 20:24:38 +10:00

oauthpki

fix(coderd): support string type for oidc response's expires_in json property (#20152)

2025-10-15 17:37:37 +00:00

portsharing

…

pproflabel

chore: add tallyman events for ai seat tracking (#22689)

2026-03-18 09:30:22 -05:00

prebuilds

fix: make prebuild claiming durable and idempotent (#23108)

2026-04-02 23:51:02 +02:00

prometheusmetrics

chore: export AI Gateway metrics under new branding + keep old as alias (#26413)

2026-06-17 13:10:53 +02:00

promoauth

fix!: remove deprecated prometheus metrics (#21788)

2026-01-30 13:30:06 +01:00

provisionerdserver

fix(coderd): prevent cross-tenant workspace app rebinding (#26103)

2026-06-11 15:02:41 -04:00

provisionerkey

chore!: ensure consistent secret token generation and hashing (#20388)

2025-10-23 15:38:49 -05:00

proxyhealth

…

pubsub

fix: chatd refactor (#26270)

2026-06-12 13:33:12 +02:00

rbac

fix(coderd/rbac): guard builtInRoles with atomic.Pointer (#26384)

2026-06-15 18:11:37 +00:00

render

feat: surface template README to agent template tools (#26334)

2026-06-24 12:32:46 +01:00

runtimeconfig

…

schedule

feat: plumb time_til_autostop_notify template field (#26439)

2026-06-23 17:32:47 -05:00

searchquery

feat: support "me" with shared_with_user filter (#26494)

2026-06-17 13:35:53 -08:00

taskname

fix(coderd/taskname): parse task name JSON with trailing text (#25005)

2026-05-07 17:10:50 +01:00

telemetry

fix: wipe user secrets when user is soft-deleted (#24985)

2026-05-11 09:07:30 -06:00

templatebuilder

feat: show template prerequisites in builder UI (#26523)

2026-06-23 11:36:07 -04:00

testdata

chore: remove coder_secret Terraform integration (#25512)

2026-05-21 09:19:29 -06:00

tracing

test: use typed atomics in test files (#25071)

2026-05-11 08:41:17 -06:00

updatecheck

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

usage

chore: add tallyman events for ai seat tracking (#22689)

2026-03-18 09:30:22 -05:00

userpassword

fix: use a random value for a simulated hash for built-in users (#26205)

2026-06-10 02:18:44 -05:00

util

fix: normalize command paths to base names in shellparse (#25599)

2026-05-22 13:36:53 +03:00

webpush

test: use httptest server.Client() to isolate transport (#26409)

2026-06-17 00:22:41 +10:00

workspaceapps

fix!: only trust x-forwarded-host from configured trusted proxies (#26204)

2026-06-11 10:55:00 -07:00

workspaceconnwatcher

test: include per-org default roles in rbac user subjects (#26003)

2026-06-05 15:01:45 -05:00

workspacestats

feat: add nats experiment (#25703)

2026-06-03 15:37:19 -05:00

wsbuilder

chore: remove coder_secret Terraform integration (#25512)

2026-05-21 09:19:29 -06:00

wspubsub

feat: add WatchAllWorkspaceBuilds endpoint for autostart scaletests (#22057)

2026-03-13 20:37:41 -07:00

x

fix: allow agents to attach any file type (#26560)

2026-06-25 00:51:13 +10:00

activitybump_test.go

test: add testutil.WaitBuffer and replace time.Sleep in tests (#22922)

2026-03-12 18:07:52 +02:00

ai_providers_backfill_test.go

refactor: rename Ai* database identifiers to AI* (AIGOV-369) (#26327)

2026-06-16 09:01:43 +00:00

ai_providers_backfill.go

refactor: rename Ai* database identifiers to AI* (AIGOV-369) (#26327)

2026-06-16 09:01:43 +00:00

ai_providers_migrate_test.go

refactor: rename Ai* database identifiers to AI* (AIGOV-369) (#26327)

2026-06-16 09:01:43 +00:00

ai_providers_migrate.go

refactor: rename Ai* database identifiers to AI* (AIGOV-369) (#26327)

2026-06-16 09:01:43 +00:00

ai_providers_pubsub_test.go

feat: hot-reload aibridged and aibridgeproxyd providers on DB changes (#25673)

2026-05-27 11:58:43 +02:00

ai_providers_test.go

fix: preserve AI provider preset types (#25925)

2026-06-03 09:24:08 +02:00

ai_providers.go

refactor: rename Ai* database identifiers to AI* (AIGOV-369) (#26327)

2026-06-16 09:01:43 +00:00

aibridge_test.go

refactor: route TransportFor by provider name (#25650)

2026-05-25 18:04:12 +02:00

aibridged.go

feat: add /api/v2/ai-gateway API route aliases (#26475)

2026-06-23 12:15:10 +01:00

aitasks_internal_test.go

fix: set codersdk.Task current_state during task initialization (#20692)

2025-11-17 13:24:12 +00:00

aitasks_test.go

fix: return 409 Conflict instead of 502 when task agent is busy (#23424)

2026-03-23 09:52:34 +00:00

aitasks.go

fix: pin workspace agent API client to intended agent (#26600)

2026-06-23 23:06:44 +10:00

apikey_scopes_validation_test.go

feat: add multi-scope support to API keys (#19917)

2025-09-26 11:56:34 +02:00

apikey_test.go

fix: persist session cookie to disk to prevent PWA logout (#23746)

2026-04-01 09:54:59 -04:00

apikey.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

apiroot.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

audit_internal_test.go

fix: improve chat audit log descriptions and diff rendering (#25728)

2026-05-28 18:37:57 +01:00

audit_test.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

audit.go

refactor: rename Ai* database identifiers to AI* (AIGOV-369) (#26327)

2026-06-16 09:01:43 +00:00

authorize_test.go

feat: add an organization member permission level (#19953)

2025-10-27 17:14:16 -06:00

authorize.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

chat_testhooks.go

test(coderd): centralize chat test harness and stabilize flakes (#25171)

2026-05-12 22:13:55 +10:00

client_test.go

…

coderd_internal_test.go

…

coderd_test.go

feat: add coderd_api_websocket_probes_total metric (#25012)

2026-06-03 10:46:07 +01:00

coderd.go

feat: add /api/v2/ai-gateway API route aliases (#26475)

2026-06-23 12:15:10 +01:00

csp.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

debug_test.go

feat(coderd): add consolidated /debug/profile endpoint for pprof collection (#22892)

2026-03-13 14:09:39 +00:00

debug.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

deployment_test.go

…

deployment.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

deprecated.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

exp_chats_acl_test.go

fix: scope combined chat source filters (#26137)

2026-06-08 15:05:27 +01:00

exp_chats_acl.go

feat: add chat sharing API (#24968)

2026-05-20 10:46:35 +01:00

exp_chats_chatstate_test.go

fix(coderd): disable chat worker in tests asserting transient states (#26333)

2026-06-12 13:03:45 +00:00

exp_chats_internal_test.go

refactor: rename Ai* database identifiers to AI* (AIGOV-369) (#26327)

2026-06-16 09:01:43 +00:00

exp_chats_test.go

fix: allow agents to attach any file type (#26560)

2026-06-25 00:51:13 +10:00

exp_chats.go

fix: allow agents to attach any file type (#26560)

2026-06-25 00:51:13 +10:00

experiments_test.go

…

experiments.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

export_test.go

refactor: remove legacy live-read and injected-history chat context paths (#26585)

2026-06-22 19:26:34 -06:00

externalauth_test.go

feat(coderd/rbac): make organization-member a per-org system custom role (#21359)

2026-01-12 18:19:19 -08:00

externalauth.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

files_test.go

fix: reject oversized and invalid zip uploads (#25877)

2026-06-02 10:11:49 -07:00

files.go

fix: reject oversized and invalid zip uploads (#25877)

2026-06-02 10:11:49 -07:00

gitsshkey_test.go

chore: distinct operations for provisioner's 'parse', 'init', 'plan', 'apply', 'graph' (#21064)

2025-12-15 11:26:41 -06:00

gitsshkey.go

feat: encrypt gitsshkeys.private_key at rest via dbcrypt (#25872)

2026-06-02 08:36:01 -06:00

inboxnotifications_internal_test.go

…

inboxnotifications_test.go

…

inboxnotifications.go

feat: add workspace autostop reminder template (#26429)

2026-06-23 10:16:17 -05:00

initscript_test.go

test: share coderdtest instances to stop paying the startup tax 22 times (#23454)

2026-03-23 19:54:43 +00:00

initscript.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

insights_internal_test.go

…

insights_test.go

fix(coderd): fix flaky TestGetUserStatusCounts timezone boundary (#22639)

2026-03-04 18:01:56 -08:00

insights.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

latencycheck.go

…

mcp_http.go

fix(coderd): enforce ActionSSH in MCP HTTP agent connection path (#24607)

2026-04-22 12:34:17 +02:00

mcp_internal_test.go

feat: add user_oidc auth type for MCP servers (#24793)

2026-05-03 11:31:48 -04:00

mcp_test.go

fix: strip deleted MCP IDs from chats on delete (#25763)

2026-05-29 16:49:25 +10:00

mcp.go

feat: add opt-in Coder identity headers for MCP servers (#25153)

2026-05-12 08:54:53 -04:00

members_test.go

feat: make service accounts a Premium feature (#24020)

2026-04-07 12:25:32 -06:00

members.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

notifications_test.go

chore: return 404, not 400 if missing or authz deny (#22069)

2026-02-13 08:19:07 -06:00

notifications.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

oauth2_error_compliance_test.go

test: reduce number of coderdtest instances (#23463)

2026-03-25 09:53:06 +00:00

oauth2_metadata_test.go

refactor: add RFC-compliant enum types and use SDK as source of truth (#21468)

2026-01-15 12:41:28 +03:00

oauth2_metadata_validation_test.go

test: share coderdtest instances in OAuth2 validation tests (#23455)

2026-03-23 21:03:34 +00:00

oauth2_security_test.go

test: reduce number of coderdtest instances (#23463)

2026-03-25 09:53:06 +00:00

oauth2_test.go

fix(coderd): use dbtime.Now() instead of time.Now() in test assertions against DB timestamps (#22685)

2026-03-06 09:14:11 +00:00

oauth2.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

organizations_test.go

…

organizations.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

pagination_test.go

…

pagination.go

…

parameters_test.go

chore: remove coder_secret Terraform integration (#25512)

2026-05-21 09:19:29 -06:00

parameters.go

feat: add coderd_api_websocket_probes_total metric (#25012)

2026-06-03 10:46:07 +01:00

presets_test.go

chore: remove unnecessary loop variable captures (#22180)

2026-02-19 09:02:19 +00:00

presets.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

provisionerdaemons_test.go

feat: add filtering options to provisioners list (#19378)

2025-08-21 16:03:34 -04:00

provisionerdaemons.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

provisionerjobs_internal_test.go

feat: add coderd_api_websocket_probes_total metric (#25012)

2026-06-03 10:46:07 +01:00

provisionerjobs_test.go

feat: add workspace build transition to provisioner job list (#24131)

2026-04-10 09:50:11 -05:00

provisionerjobs.go

feat: add coderd_api_websocket_probes_total metric (#25012)

2026-06-03 10:46:07 +01:00

roles_test.go

…

roles.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

scopes_catalog_api_test.go

feat: add external API key scopes (#19916)

2025-09-26 11:43:32 +02:00

scopes_catalog.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

swagger_request_interceptor.js

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

tailnet_test.go

test: use typed atomics in test files (#25071)

2026-05-11 08:41:17 -06:00

tailnet.go

fix: pin workspace agent API client to intended agent (#26600)

2026-06-23 23:06:44 +10:00

templatebuilder_compose_test.go

feat: add POST /api/v2/templatebuilder/compose endpoint (#26351)

2026-06-15 11:07:16 -04:00

templatebuilder_handler_test.go

feat: add base template variables to API (#26425)

2026-06-17 12:22:35 -04:00

templatebuilder_handler.go

feat: show template prerequisites in builder UI (#26523)

2026-06-23 11:36:07 -04:00

templates_meta_update_internal_test.go

feat: plumb time_til_autostop_notify template field (#26439)

2026-06-23 17:32:47 -05:00

templates_meta_update.go

feat: plumb time_til_autostop_notify template field (#26439)

2026-06-23 17:32:47 -05:00

templates_test.go

feat: plumb time_til_autostop_notify template field (#26439)

2026-06-23 17:32:47 -05:00

templates.go

feat: plumb time_til_autostop_notify template field (#26439)

2026-06-23 17:32:47 -05:00

templateversions_test.go

chore!: remove api.ts unnecessary calls (#22168)

2026-04-23 06:20:35 +10:00

templateversions.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

updatecheck_test.go

…

updatecheck.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

userauth_internal_test.go

fix!: reject OIDC login when email_verified claim is non-bool or absent (#25713)

2026-06-04 14:37:19 -04:00

userauth_test.go

fix(coderd): reject suspended user during OIDC and GitHub OAuth login (#24996)

2026-06-11 14:39:21 +01:00

userauth.go

fix(coderd): reject suspended user during OIDC and GitHub OAuth login (#24996)

2026-06-11 14:39:21 +01:00

users_test.go

fix: use a random value for a simulated hash for built-in users (#26205)

2026-06-10 02:18:44 -05:00

users.go

fix(coderd): prevent user-admin from resetting owner password (#25709)

2026-06-04 14:36:25 -04:00

usersecrets_audit_test.go

feat: audit user secret create, update, and delete (#24756)

2026-04-29 12:57:47 -06:00

usersecrets_test.go

feat: enforce per-user limits on user_secrets (#25588)

2026-05-26 14:42:31 -06:00

usersecrets.go

feat: enforce per-user limits on user_secrets (#25588)

2026-05-26 14:42:31 -06:00

userskills_test.go

feat: support personal skills in chats (#25366)

2026-05-20 19:50:50 +02:00

userskills.go

feat: add personal skill storage, API, and SDK (#25363)

2026-05-20 00:09:09 +02:00

webpush_internal_test.go

fix(coderd): validate webpush subscription endpoints (#24347)

2026-04-15 11:31:43 +02:00

webpush_test.go

fix: recover web push subscriptions after PWA reinstall (#24720)

2026-04-26 14:49:10 -07:00

webpush.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

workspaceagentportshare_test.go

feat(coderd/rbac): make organization-member a per-org system custom role (#21359)

2026-01-12 18:19:19 -08:00

workspaceagentportshare.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

workspaceagents_active_chat_internal_test.go

refactor: remove legacy live-read and injected-history chat context paths (#26585)

2026-06-22 19:26:34 -06:00

workspaceagents_internal_test.go

feat: add coderd_api_websocket_probes_total metric (#25012)

2026-06-03 10:46:07 +01:00

workspaceagents_test.go

fix(coderd): only send prebuild claim reinit for the claim build (#26548)

2026-06-23 13:22:06 +02:00

workspaceagents.go

fix(coderd): only send prebuild claim reinit for the claim build (#26548)

2026-06-23 13:22:06 +02:00

workspaceagentsrpc_internal_test.go

feat: event driven agent connection metric (#24355)

2026-05-11 14:27:40 -05:00

workspaceagentsrpc_test.go

test: add testutil.WaitBuffer and replace time.Sleep in tests (#22922)

2026-03-12 18:07:52 +02:00

workspaceagentsrpc.go

feat: integrate agent context snapshots into chats (#26389)

2026-06-16 17:46:47 +00:00

workspaceapps_test.go

…

workspaceapps.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

workspacebuilds_test.go

fix(coderd): deflake TestWorkspaceBuildStatus audit log assertion (#26232)

2026-06-11 15:33:02 -05:00

workspacebuilds.go

chore: remove coder_secret Terraform integration (#25512)

2026-05-21 09:19:29 -06:00

workspaceproxies_test.go

…

workspaceproxies.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

workspaceresourceauth_test.go

fix: soft-delete stale workspace agents on new build (#25207)

2026-05-18 08:33:29 -04:00

workspaceresourceauth.go

fix: verify PKCS7 signature on Azure instance identity tokens (#25286)

2026-05-13 14:14:07 +00:00

workspaces_scoped_test.go

fix: isolate test HTTP clients (#25038)

2026-05-11 11:03:38 +02:00

workspaces_test.go

fix(coderd): let admins change their own workspace sharing role (#26559)

2026-06-22 12:27:16 -06:00

workspaces.go

fix: only return group member count for workspace acl (#26206)

2026-06-23 11:58:00 -05:00

workspaceupdates_test.go

…

workspaceupdates.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00