mirror of
https://github.com/coder/coder.git
synced 2026-10-31 11:02:50 +08:00
Ethan
d667d68e3c
Previously, the new agent form treated the dashboard organization as a usable resource scope while permission filtering was still pending. This could request a provisional empty model catalog, briefly show the no-model setup notice, and lose the selected organization when the form remounted. A malformed organization models response could also crash the Models settings page. Wait for authoritative permitted organizations before enabling organization-scoped resources, persist valid organization selections across remounts, and reject malformed model responses while retaining a defensive rendering guard. ## UAT An adversarial [Coder Agents UAT run](https://dev.coder.com/agents/980a5a6d-e91b-47f0-902e-25d12ac46935) validated this commit on a licensed local deployment with two organizations, a real Anthropic model, and a non-admin user. Under throttled and artificially delayed authorization, no organization-scoped request fired before permissions settled and the false setup notice never appeared, while an authorized zero-model organization still showed the genuine notice. Persistence across reloads, tampered or stale localStorage IDs, membership revocation, attachment-preserving organization switches, single-organization deployments, and induced malformed or failed model responses on the Models settings page all behaved correctly. Verdict: PASS.