Files
coder/docs/ai-coder/agents/platform-controls/chat-debug-logging.md
T
Ethan 409049d1d8 docs: document org-scoped admin configuration for agents (#28482)
## Summary

Documents the organization scoping of Coder Agents admin configuration,
and corrects the navigation paths, access wording, and default-model
instructions that no longer matched the product. Documentation only, no
product code changes.

Follows #28473, which moved the organization model overrides into an
**Organization settings** section on **Admin settings > AI > Coder
Agents**. #28473 is merged, so this targets `main`.

Closes CODAGT-715

## Changes

- **New page**
`docs/ai-coder/agents/platform-controls/organizations.md`, registered in
`docs/manifest.json`. Covers the deployment/organization scope split,
what an upgrade changes, how an organization without models or MCP
servers behaves, who configures each scope, and how model and MCP server
sharing works.
- **`models.md`**: models are organization-scoped while providers and
their credentials stay deployment-wide. Each organization has one
default model, and the first model added becomes it. Documents the
**Default** badge and the **Set as Coder Agents default model** form
option in place of the star action that no longer exists, and points
model overrides at **Organization settings**.
- **`getting-started.md`**: replaces the Owner-only claim with the
actual access model, adds an organization selection step, and uses the
**Add model** label.
- **`platform-controls/index.md`**: separates deployment-wide controls
from organization-scoped controls, documents personal model overrides
alongside the model configuration section rather than as an enforcement
caveat, and adds `--agents-allowed` plus the `agents-allowed:` search
filter.
- **`platform-controls/advisor.md`** and
**`platform-controls/virtual-desktop.md`**: the Advisor and Virtual
desktop settings are cards in the **Deployment settings** section of the
**Coder Agents** page, not sidebar entries. **Providers** is a sidebar
item, not a tab.
- **`platform-controls/mcp-servers.md`**: slug uniqueness is per
organization, the **Add server** label is correct, and the page is no
longer described as admin-only.
- **`architecture.md`**, **`index.md`**,
**`tasks-to-chats-migration.md`**: organization scope corrections and
organization-scoped model routes.
- Breadcrumbs standardized to **Admin settings > AI > ...**, verified
against `AdminSettings.tsx` and `AISettingsSidebarView.tsx`.

<details>
<summary>Review follow-ups</summary>

The first revision leaked implementation detail into user-facing pages
and contained several claims that did not match the UI. The follow-up
commit removed and corrected the following.

Removed as implementation detail:

- The `chat_model_config` RBAC resource, its actions, and the token
scopes.
- The `available`, `unavailable_reason`, and `unsupported_providers`
response fields, along with the `missing_api_key`, `fetch_failed`, and
`user_api_key_required` values.
- Role and permission tables, ACL storage mechanics, audit internals,
and JSON error bodies on the new organizations page.
- Migration mechanics with no effect on what a user does.

Corrected against the product:

- The star action does not exist. The list shows a **Default** badge and
the add/edit form offers **Set as Coder Agents default model**
(`ModelRow.tsx`, `ModelFormFields.tsx`).
- The first model added to an organization becomes its default
automatically (`coderd/exp_chats.go`). An organization without a stored
default does not fail every chat, so that claim is gone.
- Advisor and Virtual desktop are cards under **Deployment settings**
(`CoderAgentsPageView.tsx`).
- The MCP servers page does not require deployment configuration edit
permission (`AISettingsSidebarView.tsx`).
- Button labels: **Add model** and **Add server**.
- The organization query parameter is `org`, confirmed by
`modelOrganizationSearchParam`.

Left alone deliberately: pre-existing defects outside the introduced
text, including the `/api/v2/chats` route prefixes, create-chat examples
missing `organization_id`, and the pre-existing MCP permissions table.

</details>

## Testing

- `pnpm run format-docs` and `pnpm run lint-docs` pass.
- `make lint/emdash` passes. No emdash or endash added.
- `grep -rn "Defaults & overrides" docs/` returns nothing.
- Every navigation path, button label, and access claim checked against
the corresponding file under `site/src/pages/AISettingsPage/` and
`site/src/modules/management/`.

---

This pull request was generated by Coder Agents on behalf of
@ethanndickson.
2026-08-25 17:24:39 +01:00

4.2 KiB

Chat debug logging

Records a detailed trace of each chat turn for troubleshooting: the normalized request sent to the LLM provider, the full response, token usage, retry attempts, and errors.

Off by default. Three layers control whether it runs for a given chat:

  1. Deployment override. Setting CODER_CHAT_DEBUG_LOGGING_ENABLED=true (or --chat-debug-logging-enabled at server start) forces debug logging on for every chat. The runtime admin and user toggles become read-only.
  2. Runtime admin gate. With the deployment override unset, the Let users record chat debug logs toggle decides whether users can opt in. Configure it under Admin settings > AI > Coder Agents > Lifecycle, or at GET/PUT /api/v2/chats/config/debug-logging.
  3. Per-user toggle. Users with the admin gate enabled can turn debug logging on for their own chats from Agents > Settings > General under Record debug logs for my chats. The endpoint PUT /api/v2/chats/config/user-debug-logging returns 409 Conflict if the deployment override is active and 403 Forbidden if the admin has not enabled user opt-in.

Important

Debug logs may contain sensitive content from prompts, responses, tool calls, and errors. Treat them with the same care as conversation history. Only the chat owner (or a user with read access to the chat) can fetch a chat's debug runs through the API. Administrators do not get blanket access to all users' debug data.

When debug logging is active for a chat, a Debug tab appears in the right panel of the Agents page (alongside Git, Terminal, and Desktop) for that chat's owner. The tab lists recent debug runs and lets you expand a run into its per-step request, response, token usage, retry attempts, errors, and policy metadata.

Export debug logs

You can export the same captured debug data from the UI:

  1. Navigate to Agents.
  2. Open a chat with debug logging enabled.
  3. Open the Debug tab in the right panel.
  4. Click Export debug logs to download the chat's recent debug runs as JSON, or expand a run and click Export this run to download one run.

The chat-level export includes the full run detail for the runs returned by the debug run list endpoint. The current list endpoint returns up to 100 of the newest runs.

API access

The same data is available through the API:

  • GET /api/v2/chats/{chat}/debug/runs lists the most recent runs for a chat (up to 100, newest first).
  • GET /api/v2/chats/{chat}/debug/runs/{debugRun} returns a single run with all of its steps, including normalized request and response bodies.

Fetch a single run and save it as JSON:

export CODER_URL="https://coder.example.com"
export CODER_SESSION_TOKEN="$(coder login token)"
export CHAT_ID="00000000-0000-0000-0000-000000000000"
export RUN_ID="11111111-1111-1111-1111-111111111111"

curl -fsS \
  -H "Coder-Session-Token: $CODER_SESSION_TOKEN" \
  "$CODER_URL/api/v2/chats/$CHAT_ID/debug/runs/$RUN_ID" \
  | jq . > "coder-agents-debug-run-$RUN_ID.json"

Fetch every run returned by the list endpoint and save a chat-level export. Using the same CODER_URL, CODER_SESSION_TOKEN, and CHAT_ID variables from above:

RUN_IDS=$(curl -fsS \
  -H "Coder-Session-Token: $CODER_SESSION_TOKEN" \
  "$CODER_URL/api/v2/chats/$CHAT_ID/debug/runs" \
  | jq -r '.[].id') || {
  echo "Failed to list debug runs" >&2
  exit 1
}

RUN_EXPORTS=$(mktemp)
trap 'rm -f "$RUN_EXPORTS"' EXIT

for RUN_ID in $RUN_IDS; do
  curl -fsS \
    -H "Coder-Session-Token: $CODER_SESSION_TOKEN" \
    "$CODER_URL/api/v2/chats/$CHAT_ID/debug/runs/$RUN_ID" \
    >> "$RUN_EXPORTS" || {
      echo "Failed to fetch debug run $RUN_ID" >&2
      exit 1
    }
  echo >> "$RUN_EXPORTS"
done

jq -s \
  --arg chat_id "$CHAT_ID" \
  --arg exported_at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
  '{
    version: 1,
    scope: "chat",
    exported_at: $exported_at,
    chat_id: $chat_id,
    run_count: length,
    limited_to_most_recent: 100,
    runs: .
  }' "$RUN_EXPORTS" > "coder-agents-debug-chat-$CHAT_ID.json"

Debug runs are stored alongside the chat and are removed when the parent conversation is deleted (manually, by retention, or by chat purge). See Data Retention for the conversation retention controls.