Michael Suchacz 1031da9738 feat: add agent chat spend limiting (backend) (#23071) ...

Introduces deployment-scoped spend limiting for Coder Agents, enabling
administrators to control LLM costs at global, group, and individual
user levels.

## Changes

- **Database migration (000437)**: `chat_usage_limit_config`
(singleton), `chat_usage_limit_overrides` (per-user),
`chat_usage_limit_group_overrides` (per-group)
- **Single-query limit resolution**: individual override > min(group) >
global default via `ResolveUserChatSpendLimit`
- **Fail-open enforcement** in chatd with documented TOCTOU trade-off
- **Experimental API** under `/api/experimental/chats/usage-limits` for
CRUD on limits
- **`AsChatd` RBAC subject** for narrowly-scoped daemon access (replaces
`AsSystemRestricted`)
- **Generated TypeScript types** for the frontend SDK

## Hierarchy

1. Individual user override (highest)
2. Minimum of group limits
3. Global default
4. Disabled / unlimited

Currency stored as micro-dollars (`1,000,000` = $1.00).

Frontend PR: #23072

2026-03-17 01:24:03 +01:00

..

agentsdk

chore: mark PatchAppStatus as deprecated in agentsdk (#22355)

2026-03-04 21:52:22 +04:00

drpcsdk

chore: apply the 4mb max limit on drpc protocol message size (#17771)

2025-05-13 11:24:51 -05:00

healthsdk

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

testdata

feat(coderd): refactors github pr sync functionality (#22715)

2026-03-10 18:46:01 +00:00

toolsdk

fix: error on ambiguous matches in edit_files tool (#23125)

2026-03-16 16:17:33 +00:00

workspacesdk

fix: error on ambiguous matches in edit_files tool (#23125)

2026-03-16 16:17:33 +00:00

wsjson

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

aibridge.go

feat: add client column to aibridge_interceptions table (#21839)

2026-02-17 15:43:02 +01:00

aitasks_internal_test.go

feat(coderd): use task data model for list (#20394)

2025-10-23 20:22:51 +03:00

aitasks.go

fix: register task pause/resume routes under /api/v2 (#22544)

2026-03-03 16:34:33 +03:00

allowlist_test.go

feat: add allow_list to resource-scoped API tokens (#19964)

2025-10-09 14:53:08 +02:00

allowlist.go

feat: add allow_list to resource-scoped API tokens (#19964)

2025-10-09 14:53:08 +02:00

apikey_scopes_gen.go

feat: add experimental agents support (#22290)

2026-02-27 16:50:56 +00:00

apikey.go

feat(coderd): filter expired API tokens server-side (#22263)

2026-02-24 15:27:03 +00:00

audit.go

chore: add audit log entry when ai seat is consumed (#22683)

2026-03-16 15:30:25 -05:00

authorization.go

chore: authz 'any_org' to return if at least 1 org has perms (#14009)

2024-07-29 19:58:48 -05:00

chats_test.go

feat: add agent chat spend limiting (backend) (#23071)

2026-03-17 01:24:03 +01:00

chats.go

feat: add agent chat spend limiting (backend) (#23071)

2026-03-17 01:24:03 +01:00

client_experimental.go

feat: add the /aitasks/prompts endpoint (#18464)

2025-06-24 13:06:02 +02:00

client_internal_test.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

client.go

fix(codersdk): propagate HTTPClient to websocket.Dial for TLS relay (#22642)

2026-03-04 21:57:23 -05:00

connectionlog.go

fix!: use client ip when creating connection logs for workspace proxied app accesses (#19788)

2025-09-15 12:30:17 +10:00

cors_behavior.go

feat: allow bypassing current CORS magic based on template config (#18706)

2025-07-30 13:42:39 -07:00

countries.go

chore: generate countries.tsx from Go code (#15274)

2024-11-15 12:05:21 -06:00

credentials.go

chore: refactor codersdk to use SessionTokenProvider (#19565)

2025-08-29 10:41:32 +02:00

database.go

fix: reduce excessive logging when database is unreachable (#17363)

2025-04-15 10:55:30 +02:00

debug.go

feat(coderd): add consolidated /debug/profile endpoint for pprof collection (#22892)

2026-03-13 14:09:39 +00:00

deployment_internal_test.go

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

deployment_test.go

chore: optionally prefix authentication related cookies (#22148)

2026-02-20 09:01:00 -06:00

deployment.go

feat: add WatchAllWorkspaceBuilds endpoint for autostart scaletests (#22057)

2026-03-13 20:37:41 -07:00

externalauth.go

feat!: support PKCE in the oauth2 client's auth/exchange flow (#21215)

2025-12-15 17:41:47 +00:00

files.go

feat: support template bundles as zip archives (#11839)

2024-01-31 14:49:55 +01:00

gitsshkey.go

docs: update ssh key description (#16602)

2025-02-18 13:06:19 +01:00

groups.go

chore: fix some small groups and acl typos (#18732)

2025-07-07 11:01:17 -06:00

idpsync.go

feat: add additional patch routes for group and role idp sync (#16351)

2025-01-31 12:14:24 -07:00

inboxnotification.go

feat: set icons for each type of notification (#17115)

2025-03-31 09:40:24 -03:00

initscript.go

feat(coderd): add support for external agents to API's and provisioner (#19286)

2025-08-19 10:41:33 +02:00

insights.go

fix: user status change chart accommodates DST (#22191)

2026-03-04 12:54:39 +02:00

licenses.go

feat: remove agent workspaces limit (#21998)

2026-02-20 12:56:00 +11:00

name_test.go

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

name.go

fix: replace moby/moby namesgenerator with internal implementation (#21377)

2026-01-09 15:40:26 -07:00

notifications.go

feat(chatd): add tag-based dedup to push notifications (#22669)

2026-03-06 10:48:58 +00:00

oauth2_validation.go

refactor: add RFC-compliant enum types and use SDK as source of truth (#21468)

2026-01-15 12:41:28 +03:00

oauth2.go

fix(coderd): harden OAuth2 provider security (#22194)

2026-02-23 12:18:44 +01:00

organizations.go

chore: fix api param name (#20172)

2025-10-06 13:58:37 +02:00

pagination_test.go

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

pagination.go

feat: Validate swagger definitions (#5694)

2023-01-13 12:27:21 +01:00

parameters.go

fix: use dynamic parameter resolution in the cli (#21734)

2026-02-03 14:10:49 -06:00

prebuilds.go

feat: allow users to pause prebuilt workspace reconciliation (#18700)

2025-07-02 15:05:42 +00:00

presets.go

feat: support icon and description in preset (#18977)

2025-07-28 15:02:26 +01:00

provisionerdaemons.go

fix(codersdk): use header auth for non-browser websocket dials (#22461)

2026-03-02 19:32:36 +11:00

rbacresources_gen.go

feat: add experimental agents support (#22290)

2026-02-27 16:50:56 +00:00

rbacroles.go

feat: implement WorkspaceCreationBan org role (#16686)

2025-02-27 06:23:18 -05:00

replicas.go

chore: move agent functions from codersdk into agentsdk (#5903)

2023-01-29 15:47:24 -06:00

richparameters_internal_test.go

chore: add form_type parameter argument to db (#17920)

2025-05-29 08:55:19 -05:00

richparameters_test.go

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

richparameters.go

fix: use dynamic parameter resolution in the cli (#21734)

2026-02-03 14:10:49 -06:00

roles.go

feat: add an organization member permission level (#19953)

2025-10-27 17:14:16 -06:00

scopes_catalog.go

feat: add external API key scopes (#19916)

2025-09-26 11:43:32 +02:00

serversentevents.go

Revert "feat: add activity status and autostop reason to workspace overview (#11987)" (#12144)

2024-02-14 17:14:49 +00:00

templates.go

fix: hide "Create Workspace" button for deleted templates (#22092)

2026-02-13 19:44:50 -05:00

templatevariables_test.go

feat(codersdk): export template variable parser (#13984)

2024-07-24 14:11:29 +10:00

templatevariables.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

templateversions.go

feat(coderd): add support for external agents to API's and provisioner (#19286)

2025-08-19 10:41:33 +02:00

time_test.go

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

time.go

feat: Add codersdk.NullTime, change workspace build deadline (#3552)

2022-08-25 19:10:42 +03:00

updatecheck.go

chore: move agent functions from codersdk into agentsdk (#5903)

2023-01-29 15:47:24 -06:00

users_test.go

fix: remove coderdtest dependency from codersdk (#14633)

2024-09-10 20:55:50 +10:00

users.go

feat: backend support for creating and storing service accounts (#22698)

2026-03-11 10:19:08 -07:00

websocket_test.go

chore: migrate to coder/websocket 1.8.12 (#15898)

2024-12-19 00:51:30 +04:00

websocket.go

chore: migrate to coder/websocket 1.8.12 (#15898)

2024-12-19 00:51:30 +04:00

workspaceagentportshare.go

feat: add organization scope for shared ports (#18314)

2025-06-16 16:15:59 -06:00

workspaceagents_test.go

feat(agent): populate subagent ID for terraform-defined devcontainers (#21942)

2026-02-06 15:52:54 +00:00

workspaceagents.go

feat: agents git watch backend (#22565)

2026-03-06 10:47:55 +01:00

workspaceapps.go

feat: add tooltip field to workspace app that renders as markdown (#19651)

2025-09-10 11:01:54 -05:00

workspacebuilds.go

fix(coderd): use BuildReasonTaskAutoPause for task workspaces (#22126)

2026-02-17 15:11:04 +00:00

workspacedisplaystatus_internal_test.go

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

workspacedisplaystatus.go

fix: Remove action from build cancelation names (#4930)

2022-11-08 17:12:06 +00:00

workspaceproxy.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

workspaces.go

feat: add WatchAllWorkspaceBuilds endpoint for autostart scaletests (#22057)

2026-03-13 20:37:41 -07:00

workspacesharing.go

fix: show a notice when workspace sharing is disabled globally in organization settings (#22580)

2026-03-04 11:14:52 -07:00