Zach 7caef4987f feat: add input validation for user secret env names and file paths (#24103) ...

Adds backend validation for user secret environment variable names and file paths.

Env name validation enforces POSIX naming rules and blocks a deliberately aggressive denylist of reserved names and prefixes. The denylist errs on the side of blocking too much since it's easier to remove entries later than to add them after users have created conflicting secrets.

File path validation requires paths to start with ~/ or /.

2026-04-08 17:02:33 -06:00

..

agentsdk

fix: make prebuild claiming durable and idempotent (#23108)

2026-04-02 23:51:02 +02:00

drpcsdk

chore: apply the 4mb max limit on drpc protocol message size (#17771)

2025-05-13 11:24:51 -05:00

healthsdk

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

testdata

feat(coderd): refactors github pr sync functionality (#22715)

2026-03-10 18:46:01 +00:00

toolsdk

feat: expose MCP tool annotations for tool grouping (#23195)

2026-03-18 10:21:45 +00:00

workspacesdk

feat: agent reads context files and discovers skills locally (#23935)

2026-04-04 12:45:46 -04:00

wsjson

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

aibridge.go

feat: add columns for cached tokens from aibridge (#23832)

2026-04-03 16:27:31 +02:00

aitasks_internal_test.go

feat(coderd): use task data model for list (#20394)

2025-10-23 20:22:51 +03:00

aitasks.go

fix: register task pause/resume routes under /api/v2 (#22544)

2026-03-03 16:34:33 +03:00

allowlist_test.go

feat: add allow_list to resource-scoped API tokens (#19964)

2025-10-09 14:53:08 +02:00

allowlist.go

feat: add allow_list to resource-scoped API tokens (#19964)

2025-10-09 14:53:08 +02:00

apikey_scopes_gen.go

feat: add user:read scope (#23348)

2026-03-22 09:06:03 -05:00

apikey.go

feat(coderd): filter expired API tokens server-side (#22263)

2026-02-24 15:27:03 +00:00

audit.go

perf: cap count queries and emit native UUID comparisons for audit/connection logs (#23835)

2026-04-07 07:24:53 -07:00

authorization.go

chore: authz 'any_org' to return if at least 1 org has perms (#14009)

2024-07-29 19:58:48 -05:00

chats_test.go

feat: add CreatedAt to tool-call and tool-result ChatMessageParts (#24101)

2026-04-08 12:42:03 -04:00

chats.go

feat: add CreatedAt to tool-call and tool-result ChatMessageParts (#24101)

2026-04-08 12:42:03 -04:00

client_experimental.go

feat: add the /aitasks/prompts endpoint (#18464)

2025-06-24 13:06:02 +02:00

client_internal_test.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

client.go

fix(codersdk): propagate HTTPClient to websocket.Dial for TLS relay (#22642)

2026-03-04 21:57:23 -05:00

connectionlog.go

perf: cap count queries and emit native UUID comparisons for audit/connection logs (#23835)

2026-04-07 07:24:53 -07:00

cors_behavior.go

feat: allow bypassing current CORS magic based on template config (#18706)

2025-07-30 13:42:39 -07:00

countries.go

chore: generate countries.tsx from Go code (#15274)

2024-11-15 12:05:21 -06:00

credentials.go

chore: refactor codersdk to use SessionTokenProvider (#19565)

2025-08-29 10:41:32 +02:00

database.go

fix: reduce excessive logging when database is unreachable (#17363)

2025-04-15 10:55:30 +02:00

debug.go

feat(coderd): add consolidated /debug/profile endpoint for pprof collection (#22892)

2026-03-13 14:09:39 +00:00

deployment_internal_test.go

fix: stop amputating RC suffixes from docs URLs (#23903)

2026-04-01 13:05:14 +00:00

deployment_test.go

chore: optionally prefix authentication related cookies (#22148)

2026-02-20 09:01:00 -06:00

deployment.go

feat: make service accounts a Premium feature (#24020)

2026-04-07 12:25:32 -06:00

externalauth.go

feat!: support PKCE in the oauth2 client's auth/exchange flow (#21215)

2025-12-15 17:41:47 +00:00

files.go

feat: support template bundles as zip archives (#11839)

2024-01-31 14:49:55 +01:00

gitsshkey.go

docs: update ssh key description (#16602)

2025-02-18 13:06:19 +01:00

groups.go

feat: add new group members endpoint with filtering and pagination (#23067)

2026-03-20 12:43:03 -08:00

idpsync.go

feat: add additional patch routes for group and role idp sync (#16351)

2025-01-31 12:14:24 -07:00

inboxnotification.go

feat: set icons for each type of notification (#17115)

2025-03-31 09:40:24 -03:00

initscript.go

feat(coderd): add support for external agents to API's and provisioner (#19286)

2025-08-19 10:41:33 +02:00

insights.go

fix: user status change chart accommodates DST (#22191)

2026-03-04 12:54:39 +02:00

licenses.go

feat: add AI Governance seat capacity banners (#23411)

2026-03-27 05:51:51 +00:00

mcp.go

feat: add model_intent option to MCP server configs (#23717)

2026-03-27 14:23:25 +00:00

name_test.go

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

name.go

fix: replace moby/moby namesgenerator with internal implementation (#21377)

2026-01-09 15:40:26 -07:00

notifications.go

feat(chatd): add tag-based dedup to push notifications (#22669)

2026-03-06 10:48:58 +00:00

oauth2_validation.go

refactor: add RFC-compliant enum types and use SDK as source of truth (#21468)

2026-01-15 12:41:28 +03:00

oauth2.go

fix(coderd): harden OAuth2 provider security (#22194)

2026-02-23 12:18:44 +01:00

organizations.go

feat: display the AI add-on column in the UI on the Users and Organization Members tables (#23291)

2026-03-26 10:36:40 +00:00

pagination_test.go

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

pagination.go

feat: Validate swagger definitions (#5694)

2023-01-13 12:27:21 +01:00

parameters.go

fix: use dynamic parameter resolution in the cli (#21734)

2026-02-03 14:10:49 -06:00

prebuilds.go

feat: allow users to pause prebuilt workspace reconciliation (#18700)

2025-07-02 15:05:42 +00:00

presets.go

feat: support icon and description in preset (#18977)

2025-07-28 15:02:26 +01:00

provisionerdaemons.go

fix(codersdk): use header auth for non-browser websocket dials (#22461)

2026-03-02 19:32:36 +11:00

rbacresources_gen.go

feat: add experimental agents support (#22290)

2026-02-27 16:50:56 +00:00

rbacroles.go

feat: add chat-access site-wide role to gate chat creation (#23724)

2026-03-31 10:07:21 +01:00

replicas.go

chore: move agent functions from codersdk into agentsdk (#5903)

2023-01-29 15:47:24 -06:00

richparameters_internal_test.go

chore: add form_type parameter argument to db (#17920)

2025-05-29 08:55:19 -05:00

richparameters_test.go

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

richparameters.go

fix: use dynamic parameter resolution in the cli (#21734)

2026-02-03 14:10:49 -06:00

roles.go

feat: add an organization member permission level (#19953)

2025-10-27 17:14:16 -06:00

scopes_catalog.go

feat: add external API key scopes (#19916)

2025-09-26 11:43:32 +02:00

serversentevents.go

Revert "feat: add activity status and autostop reason to workspace overview (#11987)" (#12144)

2024-02-14 17:14:49 +00:00

templates.go

fix: hide "Create Workspace" button for deleted templates (#22092)

2026-02-13 19:44:50 -05:00

templatevariables_test.go

feat(codersdk): export template variable parser (#13984)

2024-07-24 14:11:29 +10:00

templatevariables.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

templateversions.go

feat(coderd): add support for external agents to API's and provisioner (#19286)

2025-08-19 10:41:33 +02:00

time_test.go

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

time.go

feat: Add codersdk.NullTime, change workspace build deadline (#3552)

2022-08-25 19:10:42 +03:00

updatecheck.go

chore: move agent functions from codersdk into agentsdk (#5903)

2023-01-29 15:47:24 -06:00

users_test.go

fix: remove coderdtest dependency from codersdk (#14633)

2024-09-10 20:55:50 +10:00

users.go

fix: remove work/personal onboarding telemetry (#24021)

2026-04-03 14:26:35 -04:00

usersecrets.go

feat: add user secrets SDK types and db2sdk converters (#24102)

2026-04-08 16:48:41 -06:00

usersecretvalidation_test.go

feat: add input validation for user secret env names and file paths (#24103)

2026-04-08 17:02:33 -06:00

usersecretvalidation.go

feat: add input validation for user secret env names and file paths (#24103)

2026-04-08 17:02:33 -06:00

websocket_test.go

chore: migrate to coder/websocket 1.8.12 (#15898)

2024-12-19 00:51:30 +04:00

websocket.go

chore: migrate to coder/websocket 1.8.12 (#15898)

2024-12-19 00:51:30 +04:00

workspaceagentportshare.go

feat: add organization scope for shared ports (#18314)

2025-06-16 16:15:59 -06:00

workspaceagents_test.go

feat(agent): populate subagent ID for terraform-defined devcontainers (#21942)

2026-02-06 15:52:54 +00:00

workspaceagents.go

feat: agents git watch backend (#22565)

2026-03-06 10:47:55 +01:00

workspaceapps.go

feat: add tooltip field to workspace app that renders as markdown (#19651)

2025-09-10 11:01:54 -05:00

workspacebuilds.go

chore: add Tunneler FSM and partial impl (#23691)

2026-03-27 08:52:13 -04:00

workspacedisplaystatus_internal_test.go

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

workspacedisplaystatus.go

fix: Remove action from build cancelation names (#4930)

2022-11-08 17:12:06 +00:00

workspaceproxy.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

workspaces.go

feat: add WatchAllWorkspaceBuilds endpoint for autostart scaletests (#22057)

2026-03-13 20:37:41 -07:00

workspacesharing.go

feat: allow restricting sharing to service accounts (#23327)

2026-03-23 13:18:49 -06:00