Michael Suchacz 4b9880afa6 feat: add --chat-hook-allow-insecure to allow plain HTTP chat hook URLs (#27896) ...

Adds a hidden `--chat-hook-allow-insecure` /
`CODER_CHAT_HOOK_ALLOW_INSECURE` deployment option (default `false`)
that allows the chat lifecycle hook URL to use plain HTTP for any host.

The HTTPS requirement is enforced at two points, and the flag relaxes
both: `DeploymentValues.Validate()` rejects `http` hook URLs at startup,
and the hook dispatcher's `validateHookURL` allows `http` only for
loopback hosts. With the flag set, any-host `http` is accepted; the
host, fragment/userinfo, secret, and timeout checks are unchanged, and
non-http(s) schemes still fail. This removes the need for an HTTPS
reverse proxy when testing a hook consumer on a trusted network.

Following security review feedback, the flag description and docs state
that plain HTTP lets an on-path attacker forge hook responses (which
control agent execution), and `coder server` logs a startup warning
(with a redacted hook URL) when hooks run over plain HTTP.

Docs, generated API types, and the server config golden are updated
accordingly.

> Mux acted on Mike's behalf to create this PR.

2026-08-05 22:41:17 +02:00

..

agentselect

fix: use backend-selected chat agent for desktop, git, terminal (#26959)

2026-07-14 13:50:25 +01:00

chatadvisor

fix(coderd/x/chatd/chatadvisor): textualize advisor prompt tool exchanges (#27059)

2026-07-21 13:38:20 +02:00

chatdebug

refactor(coderd): optimize chatdebug (#27129)

2026-08-05 11:59:37 +01:00

chaterror

feat: remove native chat usage limits in favor of AI Gateway budgets (#27329)

2026-08-04 11:36:49 +02:00

chathooks

feat: add --chat-hook-allow-insecure to allow plain HTTP chat hook URLs (#27896)

2026-08-05 22:41:17 +02:00

chatloop

feat: wire chat lifecycle hooks into chatd (#27429)

2026-07-29 11:39:12 +00:00

chatopenai

refactor(coderd/x/chatd): read the OpenAI transport from the model (#27704)

2026-08-04 08:00:19 +00:00

chatprompt

feat: wire chat lifecycle hooks into chatd (#27429)

2026-07-29 11:39:12 +00:00

chatprovider

refactor(coderd/x/chatd): own provider option construction in one function (#27705)

2026-08-04 08:13:00 +00:00

chatretry

fix: enable goleak in chatd tests (#26335)

2026-06-16 12:35:40 +00:00

chatsanitize

fix: enable goleak in chatd tests (#26335)

2026-06-16 12:35:40 +00:00

chatstate

feat: remove native chat cost tracking in favor of AI Gateway cost data (#27330)

2026-08-04 12:27:38 +02:00

chattest

feat: wire chat lifecycle hooks into chatd (#27429)

2026-07-29 11:39:12 +00:00

chattool

feat: wire chat lifecycle hooks into chatd (#27429)

2026-07-29 11:39:12 +00:00

chatutil

refactor(coderd/x/chatd): remove dead model-routing dispatch shim (#26942)

2026-07-02 11:22:56 +01:00

mcpclient

feat: revoke MCP server OAuth grants at the provider on disconnect (#27300)

2026-07-20 00:14:03 +02:00

messagepartbuffer

chore(coderd/x/chatd): clean up the message part buffer comments and implementation (#26508)

2026-06-18 22:45:01 +02:00

toolschema

feat: wire chat lifecycle hooks into chatd (#27429)

2026-07-29 11:39:12 +00:00

active_turn_debug_internal_test.go

fix: chatd refactor (#26270)

2026-06-12 13:33:12 +02:00

active_turn_debug.go

fix: chatd refactor (#26270)

2026-06-12 13:33:12 +02:00

advisor_internal_test.go

refactor(coderd/x/chatd): carry the resolved OpenAI transport on a model wrapper (#27703)

2026-08-04 07:46:32 +00:00

ARCHITECTURE.md

refactor(coderd/x/chatd): own provider option construction in one function (#27705)

2026-08-04 08:13:00 +00:00

attachments_internal_test.go

chore: standardize on *_internal_test.go for white-box tests (#25601)

2026-05-22 20:24:38 +10:00

attachments.go

feat: record created_at/completed_at on reasoning ChatMessageParts (#24789)

2026-05-18 12:30:30 -04:00

attempt.go

feat: add manual chat compaction via /compact (#27081)

2026-07-21 10:58:08 +02:00

auto_archive_internal_test.go

chore(coderd/x/chatd): address generation review items (#26517)

2026-07-06 16:37:45 +00:00

auto_archive.go

chore(coderd/x/chatd): address generation review items (#26517)

2026-07-06 16:37:45 +00:00

chatd_debug.go

refactor(coderd/x/chatd): carry the resolved OpenAI transport on a model wrapper (#27703)

2026-08-04 07:46:32 +00:00

chatd_helpers_test.go

feat: add synthetic gateway keys (#27170)

2026-07-18 20:45:13 +02:00

chatd_internal_test.go

refactor(coderd/x/chatd): carry the resolved OpenAI transport on a model wrapper (#27703)

2026-08-04 07:46:32 +00:00

chatd_retry_test.go

feat: remove chat chain mode (#26980)

2026-07-06 11:57:12 +01:00

chatd_test.go

feat: remove native chat usage limits in favor of AI Gateway budgets (#27329)

2026-08-04 11:36:49 +02:00

chatd.go

feat: remove native chat cost tracking in favor of AI Gateway cost data (#27330)

2026-08-04 12:27:38 +02:00

chatfile_internal_test.go

feat: resize chat image attachments client-side for provider budgets (#24533)

2026-05-08 02:07:33 +10:00

chatstate_bridge.go

refactor(coderd): stop storing chat gateway key IDs and drop the columns (#27171)

2026-07-20 19:49:19 +02:00

compaction_hooks_test.go

feat: wire chat lifecycle hooks into chatd (#27429)

2026-07-29 11:39:12 +00:00

compaction_override_internal_test.go

refactor(coderd/x/chatd): read the OpenAI transport from the model (#27704)

2026-08-04 08:00:19 +00:00

compaction_override.go

refactor(coderd/x/chatd): own provider option construction in one function (#27705)

2026-08-04 08:13:00 +00:00

compaction_sanitize_internal_test.go

refactor(coderd/x/chatd): read the OpenAI transport from the model (#27704)

2026-08-04 08:00:19 +00:00

compaction_sanitize.go

refactor(coderd/x/chatd): read the OpenAI transport from the model (#27704)

2026-08-04 08:00:19 +00:00

computer_use.go

refactor(coderd/x/chatd): carry the resolved OpenAI transport on a model wrapper (#27703)

2026-08-04 07:46:32 +00:00

configcache_internal_test.go

fix(coderd): invalidate chatd provider cache on AI provider changes (#26987)

2026-07-07 00:20:54 +10:00

configcache.go

feat: remove legacy chat provider tables (#25416)

2026-05-22 09:50:01 +02:00

context_hydration_internal_test.go

feat: add workspace skills to agent chat slash menu (#25600)

2026-07-18 21:52:02 +02:00

context_hydration.go

feat: add workspace skills to agent chat slash menu (#25600)

2026-07-18 21:52:02 +02:00

context_integration_test.go

test: migrate chatd tests to AI Gateway routing (#26658)

2026-06-30 12:17:42 +01:00

context_prompt_internal_test.go

feat: add workspace skills to agent chat slash menu (#25600)

2026-07-18 21:52:02 +02:00

context_prompt.go

feat: remove chat chain mode (#26980)

2026-07-06 11:57:12 +01:00

context_rebind_internal_test.go

feat: add workspace skills to agent chat slash menu (#25600)

2026-07-18 21:52:02 +02:00

create_hooks_test.go

feat: wire chat lifecycle hooks into chatd (#27429)

2026-07-29 11:39:12 +00:00

dialvalidation_internal_test.go

fix(coderd/x/chatd): stabilize dial timeout recovery test (#26153)

2026-06-11 16:08:32 +10:00

dialvalidation.go

fix(coderd/x/chatd): stabilize dial timeout recovery test (#26153)

2026-06-11 16:08:32 +10:00

docs.go

docs(coderd/x/chatd): define AI provider glossary (#25411)

2026-05-20 01:37:38 +02:00

dynamictool_internal_test.go

feat: add dynamic tools support for chat API (#24036)

2026-04-08 11:54:44 -04:00

dynamictool.go

feat: add dynamic tools support for chat API (#24036)

2026-04-08 11:54:44 -04:00

generation_internal_test.go

feat: wire chat lifecycle hooks into chatd (#27429)

2026-07-29 11:39:12 +00:00

generation_preparer_internal_test.go

refactor(coderd/x/chatd): carry the resolved OpenAI transport on a model wrapper (#27703)

2026-08-04 07:46:32 +00:00

generation_preparer.go

refactor(coderd/x/chatd): own provider option construction in one function (#27705)

2026-08-04 08:13:00 +00:00

generation_retry_internal_test.go

fix(coderd/x/chatd): log retry errors and add a task timeout (#26412)

2026-06-17 10:20:47 +00:00

generation.go

feat: remove native chat cost tracking in favor of AI Gateway cost data (#27330)

2026-08-04 12:27:38 +02:00

helpers_test.go

refactor(coderd): stop storing chat gateway key IDs and drop the columns (#27171)

2026-07-20 19:49:19 +02:00

hook_server.go

feat: wire chat lifecycle hooks into chatd (#27429)

2026-07-29 11:39:12 +00:00

hooks_internal_test.go

feat: add --chat-hook-allow-insecure to allow plain HTTP chat hook URLs (#27896)

2026-08-05 22:41:17 +02:00

hooks_test.go

feat: add --chat-hook-allow-insecure to allow plain HTTP chat hook URLs (#27896)

2026-08-05 22:41:17 +02:00

instruction_internal_test.go

feat: improve sub-agent orchestration tools (#26673)

2026-06-26 13:41:43 +03:00

instruction.go

refactor: remove legacy live-read and injected-history chat context paths (#26585)

2026-06-22 19:26:34 -06:00

integration_responses_test.go

feat: add synthetic gateway keys (#27170)

2026-07-18 20:45:13 +02:00

integration_test.go

feat: remove unused chat statuses pending, paused, and completed (#27064)

2026-07-13 20:28:28 +02:00

main_test.go

fix: enable goleak in chatd tests (#26335)

2026-06-16 12:35:40 +00:00

mcp_refresh_internal_test.go

feat: revoke MCP server OAuth grants at the provider on disconnect (#27300)

2026-07-20 00:14:03 +02:00

message_conversion_test.go

feat: remove native chat cost tracking in favor of AI Gateway cost data (#27330)

2026-08-04 12:27:38 +02:00

message_conversion.go

feat: remove native chat cost tracking in favor of AI Gateway cost data (#27330)

2026-08-04 12:27:38 +02:00

model_routing_aibridge.go

refactor(coderd/x/chatd): read the OpenAI transport from the model (#27704)

2026-08-04 08:00:19 +00:00

model_routing_internal_test.go

refactor(coderd/x/chatd): read the OpenAI transport from the model (#27704)

2026-08-04 08:00:19 +00:00

model_routing.go

refactor(coderd/x/chatd): read the OpenAI transport from the model (#27704)

2026-08-04 08:00:19 +00:00

options.go

feat: wire chat lifecycle hooks into chatd (#27429)

2026-07-29 11:39:12 +00:00

personal_model_override_test.go

feat: add configurable reasoning effort to Coder agents (#26974)

2026-07-09 23:35:12 +01:00

personal_model_override.go

feat: add configurable reasoning effort to Coder agents (#26974)

2026-07-09 23:35:12 +01:00

post_tool_use_test.go

feat: wire chat lifecycle hooks into chatd (#27429)

2026-07-29 11:39:12 +00:00

pre_tool_use_test.go

feat: wire chat lifecycle hooks into chatd (#27429)

2026-07-29 11:39:12 +00:00

prompt.go

feat: improve sub-agent orchestration tools (#26673)

2026-06-26 13:41:43 +03:00

provider_switch_sanitize_internal_test.go

fix(coderd/x/chatd): drop foreign provider-executed tools on model switch (#26555)

2026-06-29 11:49:10 +01:00

provider_switch_sanitize.go

fix(coderd/x/chatd): drop foreign provider-executed tools on model switch (#26555)

2026-06-29 11:49:10 +01:00

quickgen_internal_test.go

refactor(coderd/x/chatd): carry the resolved OpenAI transport on a model wrapper (#27703)

2026-08-04 07:46:32 +00:00

quickgen.go

refactor(coderd/x/chatd): own provider option construction in one function (#27705)

2026-08-04 08:13:00 +00:00

recording_internal_test.go

feat: remove unused chat statuses pending, paused, and completed (#27064)

2026-07-13 20:28:28 +02:00

recording.go

feat(site): display file attachments in chat UI (#24281)

2026-04-22 20:11:53 +10:00

runner_manager.go

fix: chatd refactor (#26270)

2026-06-12 13:33:12 +02:00

runner_test.go

feat: wire chat lifecycle hooks into chatd (#27429)

2026-07-29 11:39:12 +00:00

runner.go

feat: wire chat lifecycle hooks into chatd (#27429)

2026-07-29 11:39:12 +00:00

sanitize_test.go

fix: strip invisible Unicode from prompt content (#23525)

2026-03-25 14:09:24 +00:00

sanitize.go

fix: strip invisible Unicode from prompt content (#23525)

2026-03-25 14:09:24 +00:00

stop_test.go

feat: wire chat lifecycle hooks into chatd (#27429)

2026-07-29 11:39:12 +00:00

store_chat_attachment_internal_test.go

fix: allow agents to attach any file type (#26560)

2026-06-25 00:51:13 +10:00

store_chat_attachment.go

feat(site): display file attachments in chat UI (#24281)

2026-04-22 20:11:53 +10:00

stream_loop_internal_test.go

fix: chatd refactor (#26270)

2026-06-12 13:33:12 +02:00

stream_loop.go

fix: chatd refactor (#26270)

2026-06-12 13:33:12 +02:00

stream_parts_dialer.go

fix: chatd refactor (#26270)

2026-06-12 13:33:12 +02:00

stream_parts_internal_test.go

fix: enable goleak in chatd tests (#26335)

2026-06-16 12:35:40 +00:00

stream_parts_transport.go

fix(coderd/x/chatd): deflake TestStreamPartsDialerDialsPartsEndpoint (#26504)

2026-06-18 08:28:17 +00:00

stream_parts.go

fix: chatd refactor (#26270)

2026-06-12 13:33:12 +02:00

stream_relay_internal_test.go

fix: chatd refactor (#26270)

2026-06-12 13:33:12 +02:00

stream_relay.go

fix: chatd refactor (#26270)

2026-06-12 13:33:12 +02:00

stream_subscribe.go

fix: chatd refactor (#26270)

2026-06-12 13:33:12 +02:00

stream_sync_poller.go

fix: chatd refactor (#26270)

2026-06-12 13:33:12 +02:00

stream_types.go

fix: chatd refactor (#26270)

2026-06-12 13:33:12 +02:00

subagent_catalog.go

feat: allow spawn_agent model and reasoning effort override (#27385)

2026-07-22 18:43:22 +02:00

subagent_context_internal_test.go

feat: add synthetic gateway keys (#27170)

2026-07-18 20:45:13 +02:00

subagent_internal_test.go

feat: add --chat-hook-allow-insecure to allow plain HTTP chat hook URLs (#27896)

2026-08-05 22:41:17 +02:00

subagent_test.go

feat: add synthetic gateway keys (#27170)

2026-07-18 20:45:13 +02:00

subagent.go

feat: remove native chat usage limits in favor of AI Gateway budgets (#27329)

2026-08-04 11:36:49 +02:00

summarygen_internal_test.go

feat: add chat summary tab in the right sidebar and per-chat cost endpoint (#26649)

2026-07-27 10:05:05 +01:00

synthetickey_internal_test.go

refactor(coderd): stop storing chat gateway key IDs and drop the columns (#27171)

2026-07-20 19:49:19 +02:00

synthetickey.go

feat: add synthetic gateway keys (#27170)

2026-07-18 20:45:13 +02:00

tasks_test.go

refactor(coderd): stop storing chat gateway key IDs and drop the columns (#27171)

2026-07-20 19:49:19 +02:00

tasks.go

chore(coderd/x/chatd): address generation review items (#26517)

2026-07-06 16:37:45 +00:00

testhooks.go

fix(coderd/x/chatd): resolve inflight race (#26460)

2026-06-17 18:29:43 +02:00

title_override_internal_test.go

refactor(coderd/x/chatd): carry the resolved OpenAI transport on a model wrapper (#27703)

2026-08-04 07:46:32 +00:00

title_override.go

refactor(coderd/x/chatd): carry the resolved OpenAI transport on a model wrapper (#27703)

2026-08-04 07:46:32 +00:00

toolinput_internal_test.go

feat: wire chat lifecycle hooks into chatd (#27429)

2026-07-29 11:39:12 +00:00

toolinput.go

feat: wire chat lifecycle hooks into chatd (#27429)

2026-07-29 11:39:12 +00:00

turn_summary_internal_test.go

feat: add chat summary tab in the right sidebar and per-chat cost endpoint (#26649)

2026-07-27 10:05:05 +01:00

worker_internal_test.go

chore(coderd/x/chatd): address generation review items (#26517)

2026-07-06 16:37:45 +00:00

worker.go

chore(coderd/x/chatd): address generation review items (#26517)

2026-07-06 16:37:45 +00:00