## Summary Documents the organization scoping of Coder Agents admin configuration, and corrects the navigation paths, access wording, and default-model instructions that no longer matched the product. Documentation only, no product code changes. Follows #28473, which moved the organization model overrides into an **Organization settings** section on **Admin settings > AI > Coder Agents**. #28473 is merged, so this targets `main`. Closes CODAGT-715 ## Changes - **New page** `docs/ai-coder/agents/platform-controls/organizations.md`, registered in `docs/manifest.json`. Covers the deployment/organization scope split, what an upgrade changes, how an organization without models or MCP servers behaves, who configures each scope, and how model and MCP server sharing works. - **`models.md`**: models are organization-scoped while providers and their credentials stay deployment-wide. Each organization has one default model, and the first model added becomes it. Documents the **Default** badge and the **Set as Coder Agents default model** form option in place of the star action that no longer exists, and points model overrides at **Organization settings**. - **`getting-started.md`**: replaces the Owner-only claim with the actual access model, adds an organization selection step, and uses the **Add model** label. - **`platform-controls/index.md`**: separates deployment-wide controls from organization-scoped controls, documents personal model overrides alongside the model configuration section rather than as an enforcement caveat, and adds `--agents-allowed` plus the `agents-allowed:` search filter. - **`platform-controls/advisor.md`** and **`platform-controls/virtual-desktop.md`**: the Advisor and Virtual desktop settings are cards in the **Deployment settings** section of the **Coder Agents** page, not sidebar entries. **Providers** is a sidebar item, not a tab. - **`platform-controls/mcp-servers.md`**: slug uniqueness is per organization, the **Add server** label is correct, and the page is no longer described as admin-only. - **`architecture.md`**, **`index.md`**, **`tasks-to-chats-migration.md`**: organization scope corrections and organization-scoped model routes. - Breadcrumbs standardized to **Admin settings > AI > ...**, verified against `AdminSettings.tsx` and `AISettingsSidebarView.tsx`. <details> <summary>Review follow-ups</summary> The first revision leaked implementation detail into user-facing pages and contained several claims that did not match the UI. The follow-up commit removed and corrected the following. Removed as implementation detail: - The `chat_model_config` RBAC resource, its actions, and the token scopes. - The `available`, `unavailable_reason`, and `unsupported_providers` response fields, along with the `missing_api_key`, `fetch_failed`, and `user_api_key_required` values. - Role and permission tables, ACL storage mechanics, audit internals, and JSON error bodies on the new organizations page. - Migration mechanics with no effect on what a user does. Corrected against the product: - The star action does not exist. The list shows a **Default** badge and the add/edit form offers **Set as Coder Agents default model** (`ModelRow.tsx`, `ModelFormFields.tsx`). - The first model added to an organization becomes its default automatically (`coderd/exp_chats.go`). An organization without a stored default does not fail every chat, so that claim is gone. - Advisor and Virtual desktop are cards under **Deployment settings** (`CoderAgentsPageView.tsx`). - The MCP servers page does not require deployment configuration edit permission (`AISettingsSidebarView.tsx`). - Button labels: **Add model** and **Add server**. - The organization query parameter is `org`, confirmed by `modelOrganizationSearchParam`. Left alone deliberately: pre-existing defects outside the introduced text, including the `/api/v2/chats` route prefixes, create-chat examples missing `organization_id`, and the pre-existing MCP permissions table. </details> ## Testing - `pnpm run format-docs` and `pnpm run lint-docs` pass. - `make lint/emdash` passes. No emdash or endash added. - `grep -rn "Defaults & overrides" docs/` returns nothing. - Every navigation path, button label, and access claim checked against the corresponding file under `site/src/pages/AISettingsPage/` and `site/src/modules/management/`. --- This pull request was generated by Coder Agents on behalf of @ethanndickson.
4.2 KiB
Chat debug logging
Records a detailed trace of each chat turn for troubleshooting: the normalized request sent to the LLM provider, the full response, token usage, retry attempts, and errors.
Off by default. Three layers control whether it runs for a given chat:
- Deployment override. Setting
CODER_CHAT_DEBUG_LOGGING_ENABLED=true(or--chat-debug-logging-enabledat server start) forces debug logging on for every chat. The runtime admin and user toggles become read-only. - Runtime admin gate. With the deployment override unset, the
Let users record chat debug logs toggle decides whether users can opt
in. Configure it under Admin settings > AI > Coder Agents > Lifecycle, or at
GET/PUT /api/v2/chats/config/debug-logging. - Per-user toggle. Users with the admin gate enabled can turn debug
logging on for their own chats from Agents > Settings > General
under Record debug logs for my chats. The endpoint
PUT /api/v2/chats/config/user-debug-loggingreturns409 Conflictif the deployment override is active and403 Forbiddenif the admin has not enabled user opt-in.
Important
Debug logs may contain sensitive content from prompts, responses, tool calls, and errors. Treat them with the same care as conversation history. Only the chat owner (or a user with read access to the chat) can fetch a chat's debug runs through the API. Administrators do not get blanket access to all users' debug data.
When debug logging is active for a chat, a Debug tab appears in the right panel of the Agents page (alongside Git, Terminal, and Desktop) for that chat's owner. The tab lists recent debug runs and lets you expand a run into its per-step request, response, token usage, retry attempts, errors, and policy metadata.
Export debug logs
You can export the same captured debug data from the UI:
- Navigate to Agents.
- Open a chat with debug logging enabled.
- Open the Debug tab in the right panel.
- Click Export debug logs to download the chat's recent debug runs as JSON, or expand a run and click Export this run to download one run.
The chat-level export includes the full run detail for the runs returned by the debug run list endpoint. The current list endpoint returns up to 100 of the newest runs.
API access
The same data is available through the API:
GET /api/v2/chats/{chat}/debug/runslists the most recent runs for a chat (up to 100, newest first).GET /api/v2/chats/{chat}/debug/runs/{debugRun}returns a single run with all of its steps, including normalized request and response bodies.
Fetch a single run and save it as JSON:
export CODER_URL="https://coder.example.com"
export CODER_SESSION_TOKEN="$(coder login token)"
export CHAT_ID="00000000-0000-0000-0000-000000000000"
export RUN_ID="11111111-1111-1111-1111-111111111111"
curl -fsS \
-H "Coder-Session-Token: $CODER_SESSION_TOKEN" \
"$CODER_URL/api/v2/chats/$CHAT_ID/debug/runs/$RUN_ID" \
| jq . > "coder-agents-debug-run-$RUN_ID.json"
Fetch every run returned by the list endpoint and save a chat-level export.
Using the same CODER_URL, CODER_SESSION_TOKEN, and CHAT_ID variables
from above:
RUN_IDS=$(curl -fsS \
-H "Coder-Session-Token: $CODER_SESSION_TOKEN" \
"$CODER_URL/api/v2/chats/$CHAT_ID/debug/runs" \
| jq -r '.[].id') || {
echo "Failed to list debug runs" >&2
exit 1
}
RUN_EXPORTS=$(mktemp)
trap 'rm -f "$RUN_EXPORTS"' EXIT
for RUN_ID in $RUN_IDS; do
curl -fsS \
-H "Coder-Session-Token: $CODER_SESSION_TOKEN" \
"$CODER_URL/api/v2/chats/$CHAT_ID/debug/runs/$RUN_ID" \
>> "$RUN_EXPORTS" || {
echo "Failed to fetch debug run $RUN_ID" >&2
exit 1
}
echo >> "$RUN_EXPORTS"
done
jq -s \
--arg chat_id "$CHAT_ID" \
--arg exported_at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
'{
version: 1,
scope: "chat",
exported_at: $exported_at,
chat_id: $chat_id,
run_count: length,
limited_to_most_recent: 100,
runs: .
}' "$RUN_EXPORTS" > "coder-agents-debug-chat-$CHAT_ID.json"
Debug runs are stored alongside the chat and are removed when the parent conversation is deleted (manually, by retention, or by chat purge). See Data Retention for the conversation retention controls.