Field	Tracked
active_version_id	true
activity_bump	true
allow_user_autostart	true
allow_user_autostop	true
allow_user_cancel_workspace_jobs	true
autostart_block_days_of_week	true
autostop_requirement_days_of_week	true
autostop_requirement_weeks	true
cors_behavior	true
created_at	false
created_by	true
created_by_avatar_url	false
created_by_name	false
created_by_username	false
default_ttl	true
deleted	false
deprecated	true
description	true
disable_module_cache	true
display_name	true
failure_ttl	true
group_acl	true
icon	true
id	true
max_port_sharing_level	true
name	true
organization_display_name	false
organization_icon	false
organization_id	false
organization_name	false
provisioner	true
require_active_version	true
time_til_autostop_notify	true
time_til_dormant	true
time_til_dormant_autodelete	true
updated_at	false
use_classic_parameter_flow	true
user_acl	true

Field	Tracked
archived	true
created_at	false
created_by	true
created_by_avatar_url	false
created_by_name	false
created_by_username	false
external_auth_providers	false
has_ai_task	false
has_external_agent	false
id	true
job_id	false
message	false
name	true
organization_id	false
readme	true
source_example_id	false
template_id	true
updated_at	false

Field	Tracked
avatar_url	false
chat_spend_limit_micros	true
created_at	false
deleted	true
email	true
github_com_user_id	false
hashed_one_time_passcode	false
hashed_password	true
id	true
is_service_account	true
is_system	true
last_seen_at	false
login_type	true
name	true
one_time_passcode_expires_at	true
quiet_hours_schedule	true
rbac_roles	true
status	true
updated_at	false
username	true

Field	Tracked
created_at	false
description	true
env_name	true
file_path	true
id	true
name	true
updated_at	false
user_id	true
value	true
value_key_id	false

Field	Tracked
created_at	false
description	true
enabled	true
env_name	true
file_path	true
id	true
name	true
updated_at	false
user_id	true
value	true
value_key_id	false

Field	Tracked
content	true
created_at	false
description	true
id	true
name	true
updated_at	false
user_id	true

Field	Tracked
build_number	false
created_at	false
daily_cost	false
deadline	false
has_ai_task	false
has_external_agent	false
id	false
initiator_by_avatar_url	false
initiator_by_name	false
initiator_by_username	false
initiator_id	false
job_id	false
max_deadline	false
notified_autostop_deadline	false
reason	false
template_version_id	true
template_version_preset_id	false
transition	false
updated_at	false
workspace_id	false

Field	Tracked
created_at	true
deleted	false
derp_enabled	true
derp_only	true
display_name	true
icon	true
id	true
name	true
region_id	true
token_hashed_secret	true
updated_at	false
url	true
version	true
wildcard_hostname	true

- = ({ } disabled={clearValueRequested} className={cn( - "placeholder:text-content-disabled sm:flex-1", + "placeholder:text-content-disabled sm:flex-1 font-mono", displayField.error && "border-border-destructive", - maskTypedValue && "[-webkit-text-security:circle]", + maskTypedValue && "[-webkit-text-security:disc]", )} onFocus={(event) => { if (isShowingSavedValue) { diff --git a/site/src/pages/UserSettingsPage/SecretsPage/SecretsPageView.stories.tsx b/site/src/pages/UserSettingsPage/SecretsPage/SecretsPageView.stories.tsx index 91a632afb54..2668ca7e621 100644 --- a/site/src/pages/UserSettingsPage/SecretsPage/SecretsPageView.stories.tsx +++ b/site/src/pages/UserSettingsPage/SecretsPage/SecretsPageView.stories.tsx @@ -418,9 +418,11 @@ export const EditSecretClearValue: Story = { await user.click(dialog.getByRole("button", { name: "Clear" })); await expect(valueField).toHaveValue(""); await expect(valueField).toBeDisabled(); - await expect( - dialog.getByText("Saved value will be cleared when you update."), - ).toBeVisible(); + await waitFor(() => + expect( + dialog.getByText("Saved value will be cleared when you update."), + ).toBeVisible(), + ); await expect(updateButton).toBeEnabled(); await user.click(dialog.getByRole("button", { name: "Undo" })); From a33140de0a34531cd8eae88464de9da17b15e465 Mon Sep 17 00:00:00 2001 From: Sas Swart Date: Tue, 4 Aug 2026 09:02:09 +0200 Subject: [PATCH 27/69] chore: backport AI session network calls to 2.36 (#27417, #27418, #27425, #27426) (#27823) Backports the AI session network calls stack to `release/2.36`. Backport of #27417, #27418, #27425, #27426 --------- Co-authored-by: Claude Opus 4.8 (1M context) Co-authored-by: Cian Johnston Co-authored-by: Marcin Tojek --- coderd/apidoc/docs.go | 38 +- coderd/apidoc/swagger.json | 38 +- coderd/database/db2sdk/db2sdk.go | 79 ++++- coderd/database/dbauthz/dbauthz.go | 14 + coderd/database/dbauthz/dbauthz_test.go | 12 + coderd/database/dbmetrics/querymetrics.go | 16 + coderd/database/dbmock/dbmock.go | 30 ++ coderd/database/querier.go | 41 +++ coderd/database/queries.sql.go | 185 +++++++++- coderd/database/queries/aibridge.sql | 110 +++++- codersdk/aibridge.go | 27 +- docs/ai-coder/ai-gateway/audit.md | 24 +- docs/reference/api/aigateway.md | 25 ++ docs/reference/api/schemas.md | 107 ++++-- enterprise/coderd/agentfirewall.go | 27 +- enterprise/coderd/aibridge.go | 41 ++- enterprise/coderd/aibridge_test.go | 328 ++++++++++++++++++ site/src/api/typesGenerated.ts | 34 +- .../ListSessionsPage/ListSessionsPageView.tsx | 2 +- .../NetworkCallBadges.stories.tsx | 4 +- .../pages/AIBridgePage/NetworkCallBadges.tsx | 24 +- .../AIBridgePage/NetworkRequestStates.tsx | 17 + .../SessionSummaryTable.stories.tsx | 81 +++++ .../SessionSummaryTable.tsx | 82 ++++- .../SessionThreadsPageView.tsx | 13 + .../NetworkCallsTable.stories.tsx | 127 +++++++ .../SessionTimeline/NetworkCallsTable.tsx | 189 ++++++++++ .../SessionTimeline.stories.tsx | 23 +- .../SessionTimeline/SessionTimeline.tsx | 19 + site/src/testHelpers/entities.ts | 48 +++ 30 files changed, 1701 insertions(+), 104 deletions(-) create mode 100644 site/src/pages/AIBridgePage/NetworkRequestStates.tsx create mode 100644 site/src/pages/AIBridgePage/SessionThreadsPage/SessionTimeline/NetworkCallsTable.stories.tsx create mode 100644 site/src/pages/AIBridgePage/SessionThreadsPage/SessionTimeline/NetworkCallsTable.tsx diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go index 961f8d36391..3021e5b0fd8 100644 --- a/coderd/apidoc/docs.go +++ b/coderd/apidoc/docs.go @@ -15499,7 +15499,7 @@ const docTemplate = `{ } }, "network_calls": { - "description": "NetworkCalls summarizes the Agent Firewall network calls made during the\nsession. A nil value means the session did not pass through Agent\nFirewall, so network call monitoring was not active, which the UI\nsurfaces as \"Disabled\".", + "description": "NetworkCalls summarizes the Agent Firewall network requests made during the\nsession. A nil value means the session did not pass through Agent\nFirewall, so network call monitoring was not active, which the UI\nsurfaces as \"Disabled\".", "allOf": [ { "$ref": "#/definitions/codersdk.AIBridgeSessionNetworkCallSummary" @@ -15535,6 +15535,17 @@ const docTemplate = `{ } } }, + "codersdk.AIBridgeSessionNetworkDomain": { + "type": "object", + "properties": { + "count": { + "type": "integer" + }, + "domain": { + "type": "string" + } + } + }, "codersdk.AIBridgeSessionThreadsResponse": { "type": "object", "properties": { @@ -15561,6 +15572,31 @@ const docTemplate = `{ "type": "string" } }, + "network_call_logs": { + "description": "NetworkCallLogs is the chronological list of individual network calls made\nduring the session, holding the earliest calls up to a server-side cap.\nNetworkCalls remains authoritative for whole-session totals, so a shorter\nlist than NetworkCalls.Total means the list was truncated. Empty when the\nsession did not pass through Agent Firewall.", + "type": "array", + "items": { + "$ref": "#/definitions/codersdk.AgentFirewallLog" + } + }, + "network_calls": { + "description": "NetworkCalls summarizes the Agent Firewall network calls made during the\nsession. A nil value means the session did not pass through Agent\nFirewall, so network call monitoring was not active, which the UI\nsurfaces as \"Disabled\".", + "allOf": [ + { + "$ref": "#/definitions/codersdk.AIBridgeSessionNetworkCallSummary" + } + ] + }, + "network_domain_count": { + "type": "integer" + }, + "network_top_domains": { + "description": "NetworkTopDomains lists the most contacted destination hosts, ordered by\ncall count descending. NetworkDomainCount is the total number of distinct\ndomains, used to render a \"+N more\" overflow beyond the listed domains.", + "type": "array", + "items": { + "$ref": "#/definitions/codersdk.AIBridgeSessionNetworkDomain" + } + }, "page_ended_at": { "type": "string", "format": "date-time" diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json index 7c8a4950e7b..5a9dd02720f 100644 --- a/coderd/apidoc/swagger.json +++ b/coderd/apidoc/swagger.json @@ -13803,7 +13803,7 @@ } }, "network_calls": { - "description": "NetworkCalls summarizes the Agent Firewall network calls made during the\nsession. A nil value means the session did not pass through Agent\nFirewall, so network call monitoring was not active, which the UI\nsurfaces as \"Disabled\".", + "description": "NetworkCalls summarizes the Agent Firewall network requests made during the\nsession. A nil value means the session did not pass through Agent\nFirewall, so network call monitoring was not active, which the UI\nsurfaces as \"Disabled\".", "allOf": [ { "$ref": "#/definitions/codersdk.AIBridgeSessionNetworkCallSummary" @@ -13839,6 +13839,17 @@ } } }, + "codersdk.AIBridgeSessionNetworkDomain": { + "type": "object", + "properties": { + "count": { + "type": "integer" + }, + "domain": { + "type": "string" + } + } + }, "codersdk.AIBridgeSessionThreadsResponse": { "type": "object", "properties": { @@ -13865,6 +13876,31 @@ "type": "string" } }, + "network_call_logs": { + "description": "NetworkCallLogs is the chronological list of individual network calls made\nduring the session, holding the earliest calls up to a server-side cap.\nNetworkCalls remains authoritative for whole-session totals, so a shorter\nlist than NetworkCalls.Total means the list was truncated. Empty when the\nsession did not pass through Agent Firewall.", + "type": "array", + "items": { + "$ref": "#/definitions/codersdk.AgentFirewallLog" + } + }, + "network_calls": { + "description": "NetworkCalls summarizes the Agent Firewall network calls made during the\nsession. A nil value means the session did not pass through Agent\nFirewall, so network call monitoring was not active, which the UI\nsurfaces as \"Disabled\".", + "allOf": [ + { + "$ref": "#/definitions/codersdk.AIBridgeSessionNetworkCallSummary" + } + ] + }, + "network_domain_count": { + "type": "integer" + }, + "network_top_domains": { + "description": "NetworkTopDomains lists the most contacted destination hosts, ordered by\ncall count descending. NetworkDomainCount is the total number of distinct\ndomains, used to render a \"+N more\" overflow beyond the listed domains.", + "type": "array", + "items": { + "$ref": "#/definitions/codersdk.AIBridgeSessionNetworkDomain" + } + }, "page_ended_at": { "type": "string", "format": "date-time" diff --git a/coderd/database/db2sdk/db2sdk.go b/coderd/database/db2sdk/db2sdk.go index 874db0e5258..b966afd71c4 100644 --- a/coderd/database/db2sdk/db2sdk.go +++ b/coderd/database/db2sdk/db2sdk.go @@ -1142,33 +1142,43 @@ func AIBridgeSession(row database.ListAIBridgeSessionsRow) codersdk.AIBridgeSess return session } +// AIBridgeSessionThreadsParams groups the session row and its subresources for +// AIBridgeSessionThreads. Named fields avoid transposing the several adjacent +// slice arguments (notably TopDomains and NetworkCalls) at the call site. +type AIBridgeSessionThreadsParams struct { + Session database.ListAIBridgeSessionsRow + Interceptions []database.ListAIBridgeSessionThreadsRow + TokenUsages []database.AIBridgeTokenUsage + ToolUsages []database.AIBridgeToolUsage + UserPrompts []database.AIBridgeUserPrompt + ModelThoughts []database.AIBridgeModelThought + TopDomains []database.GetAIBridgeSessionTopDomainsRow + NetworkCalls []database.BoundaryLog +} + // AIBridgeSessionThreads converts session metadata and thread interceptions // into the threads response. It groups interceptions into threads, builds // agentic actions from tool usages and model thoughts, and aggregates // token usage with metadata. -func AIBridgeSessionThreads( - session database.ListAIBridgeSessionsRow, - interceptions []database.ListAIBridgeSessionThreadsRow, - tokenUsages []database.AIBridgeTokenUsage, - toolUsages []database.AIBridgeToolUsage, - userPrompts []database.AIBridgeUserPrompt, - modelThoughts []database.AIBridgeModelThought, -) codersdk.AIBridgeSessionThreadsResponse { +func AIBridgeSessionThreads(p AIBridgeSessionThreadsParams) codersdk.AIBridgeSessionThreadsResponse { + session := p.Session + interceptions := p.Interceptions + // Index subresources by interception ID. tokensByInterception := make(map[uuid.UUID][]database.AIBridgeTokenUsage, len(interceptions)) - for _, tu := range tokenUsages { + for _, tu := range p.TokenUsages { tokensByInterception[tu.InterceptionID] = append(tokensByInterception[tu.InterceptionID], tu) } toolsByInterception := make(map[uuid.UUID][]database.AIBridgeToolUsage, len(interceptions)) - for _, tu := range toolUsages { + for _, tu := range p.ToolUsages { toolsByInterception[tu.InterceptionID] = append(toolsByInterception[tu.InterceptionID], tu) } promptsByInterception := make(map[uuid.UUID][]database.AIBridgeUserPrompt, len(interceptions)) - for _, up := range userPrompts { + for _, up := range p.UserPrompts { promptsByInterception[up.InterceptionID] = append(promptsByInterception[up.InterceptionID], up) } thoughtsByInterception := make(map[uuid.UUID][]database.AIBridgeModelThought, len(interceptions)) - for _, mt := range modelThoughts { + for _, mt := range p.ModelThoughts { thoughtsByInterception[mt.InterceptionID] = append(thoughtsByInterception[mt.InterceptionID], mt) } @@ -1206,7 +1216,7 @@ func AIBridgeSessionThreads( // Aggregate session-level token usage metadata from all token // usages in the session (not just the page). - sessionTokenMeta := aggregateTokenMetadata(tokenUsages) + sessionTokenMeta := aggregateTokenMetadata(p.TokenUsages) resp := codersdk.AIBridgeSessionThreadsResponse{ ID: session.SessionID, @@ -1243,9 +1253,52 @@ func AIBridgeSessionThreads( if !session.EndedAt.IsZero() { resp.EndedAt = &session.EndedAt } + // NetworkCalls is only meaningful when the session passed through Agent + // Firewall. When it did not, leave it nil so the UI renders "Disabled" + // rather than a misleading zero count. + if session.FirewallActive { + resp.NetworkCalls = &codersdk.AIBridgeSessionNetworkCallSummary{ + Total: session.NetworkCallsTotal, + Blocked: session.NetworkCallsBlocked, + } + } + for _, d := range p.TopDomains { + resp.NetworkTopDomains = append(resp.NetworkTopDomains, codersdk.AIBridgeSessionNetworkDomain{ + Domain: d.Domain, + Count: d.Count, + }) + // TotalDomains is the same on every row (a window aggregate); take it + // from the last row processed. + resp.NetworkDomainCount = d.TotalDomains + } + resp.NetworkCallLogs = AgentFirewallLogs(p.NetworkCalls) return resp } +// AgentFirewallLogs converts boundary logs to their SDK representation. +// Allowed is derived from MatchedRule being non-NULL. +func AgentFirewallLogs(logs []database.BoundaryLog) []codersdk.AgentFirewallLog { + results := make([]codersdk.AgentFirewallLog, 0, len(logs)) + for _, l := range logs { + bl := codersdk.AgentFirewallLog{ + ID: l.ID, + SessionID: l.SessionID, + SequenceNumber: l.SequenceNumber, + Allowed: l.MatchedRule.Valid, + CreatedAt: l.CreatedAt, + Proto: l.Proto, + Method: l.Method, + Detail: l.Detail, + CapturedAt: &l.CapturedAt, + } + if l.MatchedRule.Valid { + bl.MatchedRule = &l.MatchedRule.String + } + results = append(results, bl) + } + return results +} + func buildAIBridgeThread( threadID uuid.UUID, interceptions []database.AIBridgeInterception, diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go index 5b8036958c5..32333c7bfd8 100644 --- a/coderd/database/dbauthz/dbauthz.go +++ b/coderd/database/dbauthz/dbauthz.go @@ -2806,6 +2806,13 @@ func (q *querier) GetAIBridgeInterceptions(ctx context.Context) ([]database.AIBr return fetchWithPostFilter(q.auth, policy.ActionRead, fetch)(ctx, nil) } +func (q *querier) GetAIBridgeSessionTopDomains(ctx context.Context, arg database.GetAIBridgeSessionTopDomainsParams) ([]database.GetAIBridgeSessionTopDomainsRow, error) { + if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceAibridgeInterception); err != nil { + return nil, err + } + return q.db.GetAIBridgeSessionTopDomains(ctx, arg) +} + func (q *querier) GetAIBridgeTokenUsagesByInterceptionID(ctx context.Context, interceptionID uuid.UUID) ([]database.AIBridgeTokenUsage, error) { // All aibridge_token_usages records belong to the initiator of their associated interception. if err := q.authorizeAIBridgeInterceptionAction(ctx, policy.ActionRead, interceptionID); err != nil { @@ -6797,6 +6804,13 @@ func (q *querier) ListAIBridgeModels(ctx context.Context, arg database.ListAIBri return q.db.ListAuthorizedAIBridgeModels(ctx, arg, prep) } +func (q *querier) ListAIBridgeSessionNetworkCalls(ctx context.Context, arg database.ListAIBridgeSessionNetworkCallsParams) ([]database.BoundaryLog, error) { + if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceAibridgeInterception); err != nil { + return nil, err + } + return q.db.ListAIBridgeSessionNetworkCalls(ctx, arg) +} + func (q *querier) ListAIBridgeSessionThreads(ctx context.Context, arg database.ListAIBridgeSessionThreadsParams) ([]database.ListAIBridgeSessionThreadsRow, error) { prep, err := prepareSQLFilter(ctx, q.auth, policy.ActionRead, rbac.ResourceAibridgeInterception.Type) if err != nil { diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go index ef0e45eaeb0..a652c37c232 100644 --- a/coderd/database/dbauthz/dbauthz_test.go +++ b/coderd/database/dbauthz/dbauthz_test.go @@ -6897,6 +6897,18 @@ func (s *MethodTestSuite) TestAIBridge() { check.Args(params, emptyPreparedAuthorized{}).Asserts() })) + s.Run("GetAIBridgeSessionTopDomains", s.Mocked(func(db *dbmock.MockStore, faker *gofakeit.Faker, check *expects) { + params := database.GetAIBridgeSessionTopDomainsParams{SessionID: "sess", Limit: 5} + db.EXPECT().GetAIBridgeSessionTopDomains(gomock.Any(), params).Return([]database.GetAIBridgeSessionTopDomainsRow{}, nil).AnyTimes() + check.Args(params).Asserts(rbac.ResourceAibridgeInterception, policy.ActionRead).Returns([]database.GetAIBridgeSessionTopDomainsRow{}) + })) + + s.Run("ListAIBridgeSessionNetworkCalls", s.Mocked(func(db *dbmock.MockStore, faker *gofakeit.Faker, check *expects) { + params := database.ListAIBridgeSessionNetworkCallsParams{SessionID: "sess", Limit: 1000} + db.EXPECT().ListAIBridgeSessionNetworkCalls(gomock.Any(), params).Return([]database.BoundaryLog{}, nil).AnyTimes() + check.Args(params).Asserts(rbac.ResourceAibridgeInterception, policy.ActionRead).Returns([]database.BoundaryLog{}) + })) + s.Run("ListAIBridgeTokenUsagesByInterceptionIDs", s.Mocked(func(db *dbmock.MockStore, faker *gofakeit.Faker, check *expects) { ids := []uuid.UUID{{1}} db.EXPECT().ListAIBridgeTokenUsagesByInterceptionIDs(gomock.Any(), ids).Return([]database.AIBridgeTokenUsage{}, nil).AnyTimes() diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go index db91a9772b7..b4944e1647a 100644 --- a/coderd/database/dbmetrics/querymetrics.go +++ b/coderd/database/dbmetrics/querymetrics.go @@ -1105,6 +1105,14 @@ func (m queryMetricsStore) GetAIBridgeInterceptions(ctx context.Context) ([]data return r0, r1 } +func (m queryMetricsStore) GetAIBridgeSessionTopDomains(ctx context.Context, arg database.GetAIBridgeSessionTopDomainsParams) ([]database.GetAIBridgeSessionTopDomainsRow, error) { + start := time.Now() + r0, r1 := m.s.GetAIBridgeSessionTopDomains(ctx, arg) + m.queryLatencies.WithLabelValues("GetAIBridgeSessionTopDomains").Observe(time.Since(start).Seconds()) + m.queryCounts.WithLabelValues(httpmw.ExtractHTTPRoute(ctx), httpmw.ExtractHTTPMethod(ctx), "GetAIBridgeSessionTopDomains").Inc() + return r0, r1 +} + func (m queryMetricsStore) GetAIBridgeTokenUsagesByInterceptionID(ctx context.Context, interceptionID uuid.UUID) ([]database.AIBridgeTokenUsage, error) { start := time.Now() r0, r1 := m.s.GetAIBridgeTokenUsagesByInterceptionID(ctx, interceptionID) @@ -4745,6 +4753,14 @@ func (m queryMetricsStore) ListAIBridgeModels(ctx context.Context, arg database. return r0, r1 } +func (m queryMetricsStore) ListAIBridgeSessionNetworkCalls(ctx context.Context, arg database.ListAIBridgeSessionNetworkCallsParams) ([]database.BoundaryLog, error) { + start := time.Now() + r0, r1 := m.s.ListAIBridgeSessionNetworkCalls(ctx, arg) + m.queryLatencies.WithLabelValues("ListAIBridgeSessionNetworkCalls").Observe(time.Since(start).Seconds()) + m.queryCounts.WithLabelValues(httpmw.ExtractHTTPRoute(ctx), httpmw.ExtractHTTPMethod(ctx), "ListAIBridgeSessionNetworkCalls").Inc() + return r0, r1 +} + func (m queryMetricsStore) ListAIBridgeSessionThreads(ctx context.Context, arg database.ListAIBridgeSessionThreadsParams) ([]database.ListAIBridgeSessionThreadsRow, error) { start := time.Now() r0, r1 := m.s.ListAIBridgeSessionThreads(ctx, arg) diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go index a038a74957f..cb0ead8a046 100644 --- a/coderd/database/dbmock/dbmock.go +++ b/coderd/database/dbmock/dbmock.go @@ -1903,6 +1903,21 @@ func (mr *MockStoreMockRecorder) GetAIBridgeInterceptions(ctx any) *gomock.Call return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAIBridgeInterceptions", reflect.TypeOf((*MockStore)(nil).GetAIBridgeInterceptions), ctx) } +// GetAIBridgeSessionTopDomains mocks base method. +func (m *MockStore) GetAIBridgeSessionTopDomains(ctx context.Context, arg database.GetAIBridgeSessionTopDomainsParams) ([]database.GetAIBridgeSessionTopDomainsRow, error) { + m.ctrl.T.Helper() + ret := m.ctrl.Call(m, "GetAIBridgeSessionTopDomains", ctx, arg) + ret0, _ := ret[0].([]database.GetAIBridgeSessionTopDomainsRow) + ret1, _ := ret[1].(error) + return ret0, ret1 +} + +// GetAIBridgeSessionTopDomains indicates an expected call of GetAIBridgeSessionTopDomains. +func (mr *MockStoreMockRecorder) GetAIBridgeSessionTopDomains(ctx, arg any) *gomock.Call { + mr.mock.ctrl.T.Helper() + return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAIBridgeSessionTopDomains", reflect.TypeOf((*MockStore)(nil).GetAIBridgeSessionTopDomains), ctx, arg) +} + // GetAIBridgeTokenUsagesByInterceptionID mocks base method. func (m *MockStore) GetAIBridgeTokenUsagesByInterceptionID(ctx context.Context, interceptionID uuid.UUID) ([]database.AIBridgeTokenUsage, error) { m.ctrl.T.Helper() @@ -8876,6 +8891,21 @@ func (mr *MockStoreMockRecorder) ListAIBridgeModels(ctx, arg any) *gomock.Call { return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListAIBridgeModels", reflect.TypeOf((*MockStore)(nil).ListAIBridgeModels), ctx, arg) } +// ListAIBridgeSessionNetworkCalls mocks base method. +func (m *MockStore) ListAIBridgeSessionNetworkCalls(ctx context.Context, arg database.ListAIBridgeSessionNetworkCallsParams) ([]database.BoundaryLog, error) { + m.ctrl.T.Helper() + ret := m.ctrl.Call(m, "ListAIBridgeSessionNetworkCalls", ctx, arg) + ret0, _ := ret[0].([]database.BoundaryLog) + ret1, _ := ret[1].(error) + return ret0, ret1 +} + +// ListAIBridgeSessionNetworkCalls indicates an expected call of ListAIBridgeSessionNetworkCalls. +func (mr *MockStoreMockRecorder) ListAIBridgeSessionNetworkCalls(ctx, arg any) *gomock.Call { + mr.mock.ctrl.T.Helper() + return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListAIBridgeSessionNetworkCalls", reflect.TypeOf((*MockStore)(nil).ListAIBridgeSessionNetworkCalls), ctx, arg) +} + // ListAIBridgeSessionThreads mocks base method. func (m *MockStore) ListAIBridgeSessionThreads(ctx context.Context, arg database.ListAIBridgeSessionThreadsParams) ([]database.ListAIBridgeSessionThreadsRow, error) { m.ctrl.T.Helper() diff --git a/coderd/database/querier.go b/coderd/database/querier.go index e3030339624..bcb6b722fd2 100644 --- a/coderd/database/querier.go +++ b/coderd/database/querier.go @@ -302,6 +302,21 @@ type sqlcQuerier interface { // the root), we return its own ID as the root. GetAIBridgeInterceptionLineageByToolCallID(ctx context.Context, toolCallID string) (GetAIBridgeInterceptionLineageByToolCallIDRow, error) GetAIBridgeInterceptions(ctx context.Context) ([]AIBridgeInterception, error) + // Returns the most contacted destination hosts for an AI session, ordered by + // call count descending and limited to the top @limit_ rows. total_domains is + // the number of distinct domains across the whole session, used to render a + // "+N more" overflow beyond the returned rows. Only HTTP egress is considered; + // dns/git/fs boundary logs do not carry a domain in the same shape. + // + // Windowing mirrors the network_calls aggregation in ListAIBridgeSessions: + // each interception's boundary logs fall in the open interval (this seq, next + // interception's seq) within the same firewall session. The exclusive lower + // bound drops the interception's own LLM-provider call. next_seq considers all + // interceptions in the firewall session so windows never bleed across AI + // sessions that share one firewall session, and falls back to the maximum + // sequence_number for the last interception so the window stays an + // index-satisfiable range. + GetAIBridgeSessionTopDomains(ctx context.Context, arg GetAIBridgeSessionTopDomainsParams) ([]GetAIBridgeSessionTopDomainsRow, error) GetAIBridgeTokenUsagesByInterceptionID(ctx context.Context, interceptionID uuid.UUID) ([]AIBridgeTokenUsage, error) GetAIBridgeToolUsagesByInterceptionID(ctx context.Context, interceptionID uuid.UUID) ([]AIBridgeToolUsage, error) GetAIBridgeUserPromptsByInterceptionID(ctx context.Context, interceptionID uuid.UUID) ([]AIBridgeUserPrompt, error) @@ -1218,6 +1233,26 @@ type sqlcQuerier interface { ListAIBridgeInterceptionsTelemetrySummaries(ctx context.Context, arg ListAIBridgeInterceptionsTelemetrySummariesParams) ([]ListAIBridgeInterceptionsTelemetrySummariesRow, error) ListAIBridgeModelThoughtsByInterceptionIDs(ctx context.Context, interceptionIds []uuid.UUID) ([]AIBridgeModelThought, error) ListAIBridgeModels(ctx context.Context, arg ListAIBridgeModelsParams) ([]string, error) + // Returns the individual Agent Firewall network calls made during an AI + // session, ordered chronologically. All protocols are included, unlike + // GetAIBridgeSessionTopDomains which considers only HTTP egress, so the list + // covers the same events the network_calls summary in ListAIBridgeSessions + // counts. The list is capped at @limit_ rows, so its length equals the summary + // total only for sessions at or below the cap. The summary stays authoritative + // for whole-session totals. + // + // Windowing mirrors that summary and GetAIBridgeSessionTopDomains: each + // interception's boundary logs fall in the open interval (this seq, next + // interception's seq) within the same firewall session. The exclusive lower + // bound drops the interception's own LLM-provider call. next_seq considers all + // interceptions in the firewall session so windows never bleed across AI + // sessions that share one firewall session, and falls back to the maximum + // sequence_number for the last interception so the window stays an + // index-satisfiable range. + // created_at leads because a session can span several firewall sessions, whose + // sequence numbers are independent streams. id breaks remaining ties so the row + // that lands on the limit boundary is stable across identical requests. + ListAIBridgeSessionNetworkCalls(ctx context.Context, arg ListAIBridgeSessionNetworkCallsParams) ([]BoundaryLog, error) // Returns all interceptions belonging to paginated threads within a session. // Threads are paginated by (started_at, thread_id) cursor. ListAIBridgeSessionThreads(ctx context.Context, arg ListAIBridgeSessionThreadsParams) ([]ListAIBridgeSessionThreadsRow, error) @@ -1228,6 +1263,12 @@ type sqlcQuerier interface { // Pagination-first strategy: identify the page of sessions cheaply via a // single GROUP BY scan, then do expensive lateral joins (tokens, prompts, // first-interception metadata) only for the ~page-size result set. + // The last interception in a session has no next row, so next_seq uses + // the largest sequence_number instead of NULL. The lookup stays a plain + // range, so the (session_id, sequence_number) index answers it alone. + // With NULL and an OR check, the index cannot bound the range: each + // interception reads every log to the end of the session and throws + // most of them away. ListAIBridgeSessions(ctx context.Context, arg ListAIBridgeSessionsParams) ([]ListAIBridgeSessionsRow, error) ListAIBridgeTokenUsagesByInterceptionIDs(ctx context.Context, interceptionIds []uuid.UUID) ([]AIBridgeTokenUsage, error) ListAIBridgeToolUsagesByInterceptionIDs(ctx context.Context, interceptionIds []uuid.UUID) ([]AIBridgeToolUsage, error) diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go index 8eafb9cbf8c..72f3812d4a3 100644 --- a/coderd/database/queries.sql.go +++ b/coderd/database/queries.sql.go @@ -1272,6 +1272,101 @@ func (q *sqlQuerier) GetAIBridgeInterceptions(ctx context.Context) ([]AIBridgeIn return items, nil } +const getAIBridgeSessionTopDomains = `-- name: GetAIBridgeSessionTopDomains :many +WITH session_boundary_logs AS ( + SELECT bl.detail + FROM aibridge_interceptions afi + LEFT JOIN LATERAL ( + SELECT COALESCE(MIN(nxt.agent_firewall_sequence_number), 2147483647) AS next_seq + FROM aibridge_interceptions nxt + WHERE nxt.agent_firewall_session_id = afi.agent_firewall_session_id + AND nxt.agent_firewall_sequence_number > afi.agent_firewall_sequence_number + ) w ON true + JOIN boundary_logs bl + ON bl.session_id = afi.agent_firewall_session_id + AND bl.sequence_number > afi.agent_firewall_sequence_number + AND bl.sequence_number < w.next_seq + WHERE afi.session_id = $2::text + AND afi.ended_at IS NOT NULL + AND afi.agent_firewall_session_id IS NOT NULL + AND afi.agent_firewall_sequence_number IS NOT NULL + AND bl.proto = 'http' +), +extracted AS ( + -- Strip an optional scheme, then keep the host up to the first port, path, + -- query, or fragment delimiter. This assumes HTTP egress detail is a plain + -- scheme+host(+port) URL: it does not handle userinfo (user@host, which + -- would be captured into the host) or IPv6 literal hosts ([::1], where the + -- leading '[' is captured and the ':' terminates early). Boundary HTTP logs + -- do not currently emit those forms; revisit this extraction if they do. + SELECT substring(detail from '^(?:[A-Za-z][A-Za-z0-9+.-]*://)?([^/:?#]+)') AS domain + FROM session_boundary_logs +), +domains AS ( + SELECT domain, COUNT(*)::bigint AS count + FROM extracted + WHERE domain IS NOT NULL AND domain != '' + GROUP BY domain +) +SELECT + -- COALESCE keeps sqlc from typing the grouped column as nullable; the + -- domains CTE already filters out NULL/empty hosts. + COALESCE(domain, '')::text AS domain, + count, + COUNT(*) OVER ()::bigint AS total_domains +FROM domains +ORDER BY count DESC, domain ASC +LIMIT COALESCE(NULLIF($1::integer, 0), 5) +` + +type GetAIBridgeSessionTopDomainsParams struct { + Limit int32 `db:"limit_" json:"limit_"` + SessionID string `db:"session_id" json:"session_id"` +} + +type GetAIBridgeSessionTopDomainsRow struct { + Domain string `db:"domain" json:"domain"` + Count int64 `db:"count" json:"count"` + TotalDomains int64 `db:"total_domains" json:"total_domains"` +} + +// Returns the most contacted destination hosts for an AI session, ordered by +// call count descending and limited to the top @limit_ rows. total_domains is +// the number of distinct domains across the whole session, used to render a +// "+N more" overflow beyond the returned rows. Only HTTP egress is considered; +// dns/git/fs boundary logs do not carry a domain in the same shape. +// +// Windowing mirrors the network_calls aggregation in ListAIBridgeSessions: +// each interception's boundary logs fall in the open interval (this seq, next +// interception's seq) within the same firewall session. The exclusive lower +// bound drops the interception's own LLM-provider call. next_seq considers all +// interceptions in the firewall session so windows never bleed across AI +// sessions that share one firewall session, and falls back to the maximum +// sequence_number for the last interception so the window stays an +// index-satisfiable range. +func (q *sqlQuerier) GetAIBridgeSessionTopDomains(ctx context.Context, arg GetAIBridgeSessionTopDomainsParams) ([]GetAIBridgeSessionTopDomainsRow, error) { + rows, err := q.db.QueryContext(ctx, getAIBridgeSessionTopDomains, arg.Limit, arg.SessionID) + if err != nil { + return nil, err + } + defer rows.Close() + var items []GetAIBridgeSessionTopDomainsRow + for rows.Next() { + var i GetAIBridgeSessionTopDomainsRow + if err := rows.Scan(&i.Domain, &i.Count, &i.TotalDomains); err != nil { + return nil, err + } + items = append(items, i) + } + if err := rows.Close(); err != nil { + return nil, err + } + if err := rows.Err(); err != nil { + return nil, err + } + return items, nil +} + const getAIBridgeTokenUsagesByInterceptionID = `-- name: GetAIBridgeTokenUsagesByInterceptionID :many SELECT id, interception_id, provider_response_id, input_tokens, output_tokens, metadata, created_at, cache_read_input_tokens, cache_write_input_tokens, effective_group_id, input_price_micros, output_price_micros, cache_read_price_micros, cache_write_price_micros, cost_micros @@ -1876,6 +1971,85 @@ func (q *sqlQuerier) ListAIBridgeModels(ctx context.Context, arg ListAIBridgeMod return items, nil } +const listAIBridgeSessionNetworkCalls = `-- name: ListAIBridgeSessionNetworkCalls :many +SELECT bl.id, bl.session_id, bl.sequence_number, bl.captured_at, bl.created_at, bl.proto, bl.method, bl.detail, bl.matched_rule, bl.owner_id +FROM aibridge_interceptions afi +LEFT JOIN LATERAL ( + SELECT COALESCE(MIN(nxt.agent_firewall_sequence_number), 2147483647) AS next_seq + FROM aibridge_interceptions nxt + WHERE nxt.agent_firewall_session_id = afi.agent_firewall_session_id + AND nxt.agent_firewall_sequence_number > afi.agent_firewall_sequence_number +) w ON true +JOIN boundary_logs bl + ON bl.session_id = afi.agent_firewall_session_id + AND bl.sequence_number > afi.agent_firewall_sequence_number + AND bl.sequence_number < w.next_seq +WHERE afi.session_id = $1::text + AND afi.ended_at IS NOT NULL + AND afi.agent_firewall_session_id IS NOT NULL + AND afi.agent_firewall_sequence_number IS NOT NULL +ORDER BY bl.created_at ASC, bl.sequence_number ASC, bl.id ASC +LIMIT COALESCE(NULLIF($2::integer, 0), 1000) +` + +type ListAIBridgeSessionNetworkCallsParams struct { + SessionID string `db:"session_id" json:"session_id"` + Limit int32 `db:"limit_" json:"limit_"` +} + +// Returns the individual Agent Firewall network calls made during an AI +// session, ordered chronologically. All protocols are included, unlike +// GetAIBridgeSessionTopDomains which considers only HTTP egress, so the list +// covers the same events the network_calls summary in ListAIBridgeSessions +// counts. The list is capped at @limit_ rows, so its length equals the summary +// total only for sessions at or below the cap. The summary stays authoritative +// for whole-session totals. +// +// Windowing mirrors that summary and GetAIBridgeSessionTopDomains: each +// interception's boundary logs fall in the open interval (this seq, next +// interception's seq) within the same firewall session. The exclusive lower +// bound drops the interception's own LLM-provider call. next_seq considers all +// interceptions in the firewall session so windows never bleed across AI +// sessions that share one firewall session, and falls back to the maximum +// sequence_number for the last interception so the window stays an +// index-satisfiable range. +// created_at leads because a session can span several firewall sessions, whose +// sequence numbers are independent streams. id breaks remaining ties so the row +// that lands on the limit boundary is stable across identical requests. +func (q *sqlQuerier) ListAIBridgeSessionNetworkCalls(ctx context.Context, arg ListAIBridgeSessionNetworkCallsParams) ([]BoundaryLog, error) { + rows, err := q.db.QueryContext(ctx, listAIBridgeSessionNetworkCalls, arg.SessionID, arg.Limit) + if err != nil { + return nil, err + } + defer rows.Close() + var items []BoundaryLog + for rows.Next() { + var i BoundaryLog + if err := rows.Scan( + &i.ID, + &i.SessionID, + &i.SequenceNumber, + &i.CapturedAt, + &i.CreatedAt, + &i.Proto, + &i.Method, + &i.Detail, + &i.MatchedRule, + &i.OwnerID, + ); err != nil { + return nil, err + } + items = append(items, i) + } + if err := rows.Close(); err != nil { + return nil, err + } + if err := rows.Err(); err != nil { + return nil, err + } + return items, nil +} + const listAIBridgeSessionThreads = `-- name: ListAIBridgeSessionThreads :many WITH paginated_threads AS ( SELECT @@ -2164,12 +2338,13 @@ LEFT JOIN LATERAL ( -- (logged at exactly its sequence number), leaving the agent's other -- egress. next_seq considers all interceptions in the firewall session so -- windows never bleed across AI sessions that share one firewall session. + -- SELECT COUNT(*)::bigint AS total, COUNT(*) FILTER (WHERE bl.matched_rule IS NULL)::bigint AS blocked FROM aibridge_interceptions afi LEFT JOIN LATERAL ( - SELECT MIN(nxt.agent_firewall_sequence_number) AS next_seq + SELECT COALESCE(MIN(nxt.agent_firewall_sequence_number), 2147483647) AS next_seq FROM aibridge_interceptions nxt WHERE nxt.agent_firewall_session_id = afi.agent_firewall_session_id AND nxt.agent_firewall_sequence_number > afi.agent_firewall_sequence_number @@ -2177,7 +2352,7 @@ LEFT JOIN LATERAL ( JOIN boundary_logs bl ON bl.session_id = afi.agent_firewall_session_id AND bl.sequence_number > afi.agent_firewall_sequence_number - AND (w.next_seq IS NULL OR bl.sequence_number < w.next_seq) + AND bl.sequence_number < w.next_seq WHERE afi.id = ANY(sr.interception_ids) AND afi.agent_firewall_session_id IS NOT NULL AND afi.agent_firewall_sequence_number IS NOT NULL @@ -2232,6 +2407,12 @@ type ListAIBridgeSessionsRow struct { // Pagination-first strategy: identify the page of sessions cheaply via a // single GROUP BY scan, then do expensive lateral joins (tokens, prompts, // first-interception metadata) only for the ~page-size result set. +// The last interception in a session has no next row, so next_seq uses +// the largest sequence_number instead of NULL. The lookup stays a plain +// range, so the (session_id, sequence_number) index answers it alone. +// With NULL and an OR check, the index cannot bound the range: each +// interception reads every log to the end of the session and throws +// most of them away. func (q *sqlQuerier) ListAIBridgeSessions(ctx context.Context, arg ListAIBridgeSessionsParams) ([]ListAIBridgeSessionsRow, error) { rows, err := q.db.QueryContext(ctx, listAIBridgeSessions, arg.AfterSessionID, diff --git a/coderd/database/queries/aibridge.sql b/coderd/database/queries/aibridge.sql index 63635b6ae22..f3610aa31a6 100644 --- a/coderd/database/queries/aibridge.sql +++ b/coderd/database/queries/aibridge.sql @@ -528,12 +528,19 @@ LEFT JOIN LATERAL ( -- (logged at exactly its sequence number), leaving the agent's other -- egress. next_seq considers all interceptions in the firewall session so -- windows never bleed across AI sessions that share one firewall session. + -- +-- The last interception in a session has no next row, so next_seq uses +-- the largest sequence_number instead of NULL. The lookup stays a plain +-- range, so the (session_id, sequence_number) index answers it alone. +-- With NULL and an OR check, the index cannot bound the range: each +-- interception reads every log to the end of the session and throws +-- most of them away. SELECT COUNT(*)::bigint AS total, COUNT(*) FILTER (WHERE bl.matched_rule IS NULL)::bigint AS blocked FROM aibridge_interceptions afi LEFT JOIN LATERAL ( - SELECT MIN(nxt.agent_firewall_sequence_number) AS next_seq + SELECT COALESCE(MIN(nxt.agent_firewall_sequence_number), 2147483647) AS next_seq FROM aibridge_interceptions nxt WHERE nxt.agent_firewall_session_id = afi.agent_firewall_session_id AND nxt.agent_firewall_sequence_number > afi.agent_firewall_sequence_number @@ -541,7 +548,7 @@ LEFT JOIN LATERAL ( JOIN boundary_logs bl ON bl.session_id = afi.agent_firewall_session_id AND bl.sequence_number > afi.agent_firewall_sequence_number - AND (w.next_seq IS NULL OR bl.sequence_number < w.next_seq) + AND bl.sequence_number < w.next_seq WHERE afi.id = ANY(sr.interception_ids) AND afi.agent_firewall_session_id IS NOT NULL AND afi.agent_firewall_sequence_number IS NOT NULL @@ -551,6 +558,105 @@ ORDER BY sp.session_id DESC ; +-- name: GetAIBridgeSessionTopDomains :many +-- Returns the most contacted destination hosts for an AI session, ordered by +-- call count descending and limited to the top @limit_ rows. total_domains is +-- the number of distinct domains across the whole session, used to render a +-- "+N more" overflow beyond the returned rows. Only HTTP egress is considered; +-- dns/git/fs boundary logs do not carry a domain in the same shape. +-- +-- Windowing mirrors the network_calls aggregation in ListAIBridgeSessions: +-- each interception's boundary logs fall in the open interval (this seq, next +-- interception's seq) within the same firewall session. The exclusive lower +-- bound drops the interception's own LLM-provider call. next_seq considers all +-- interceptions in the firewall session so windows never bleed across AI +-- sessions that share one firewall session, and falls back to the maximum +-- sequence_number for the last interception so the window stays an +-- index-satisfiable range. +WITH session_boundary_logs AS ( + SELECT bl.detail + FROM aibridge_interceptions afi + LEFT JOIN LATERAL ( + SELECT COALESCE(MIN(nxt.agent_firewall_sequence_number), 2147483647) AS next_seq + FROM aibridge_interceptions nxt + WHERE nxt.agent_firewall_session_id = afi.agent_firewall_session_id + AND nxt.agent_firewall_sequence_number > afi.agent_firewall_sequence_number + ) w ON true + JOIN boundary_logs bl + ON bl.session_id = afi.agent_firewall_session_id + AND bl.sequence_number > afi.agent_firewall_sequence_number + AND bl.sequence_number < w.next_seq + WHERE afi.session_id = @session_id::text + AND afi.ended_at IS NOT NULL + AND afi.agent_firewall_session_id IS NOT NULL + AND afi.agent_firewall_sequence_number IS NOT NULL + AND bl.proto = 'http' +), +extracted AS ( + -- Strip an optional scheme, then keep the host up to the first port, path, + -- query, or fragment delimiter. This assumes HTTP egress detail is a plain + -- scheme+host(+port) URL: it does not handle userinfo (user@host, which + -- would be captured into the host) or IPv6 literal hosts ([::1], where the + -- leading '[' is captured and the ':' terminates early). Boundary HTTP logs + -- do not currently emit those forms; revisit this extraction if they do. + SELECT substring(detail from '^(?:[A-Za-z][A-Za-z0-9+.-]*://)?([^/:?#]+)') AS domain + FROM session_boundary_logs +), +domains AS ( + SELECT domain, COUNT(*)::bigint AS count + FROM extracted + WHERE domain IS NOT NULL AND domain != '' + GROUP BY domain +) +SELECT + -- COALESCE keeps sqlc from typing the grouped column as nullable; the + -- domains CTE already filters out NULL/empty hosts. + COALESCE(domain, '')::text AS domain, + count, + COUNT(*) OVER ()::bigint AS total_domains +FROM domains +ORDER BY count DESC, domain ASC +LIMIT COALESCE(NULLIF(@limit_::integer, 0), 5); + +-- name: ListAIBridgeSessionNetworkCalls :many +-- Returns the individual Agent Firewall network calls made during an AI +-- session, ordered chronologically. All protocols are included, unlike +-- GetAIBridgeSessionTopDomains which considers only HTTP egress, so the list +-- covers the same events the network_calls summary in ListAIBridgeSessions +-- counts. The list is capped at @limit_ rows, so its length equals the summary +-- total only for sessions at or below the cap. The summary stays authoritative +-- for whole-session totals. +-- +-- Windowing mirrors that summary and GetAIBridgeSessionTopDomains: each +-- interception's boundary logs fall in the open interval (this seq, next +-- interception's seq) within the same firewall session. The exclusive lower +-- bound drops the interception's own LLM-provider call. next_seq considers all +-- interceptions in the firewall session so windows never bleed across AI +-- sessions that share one firewall session, and falls back to the maximum +-- sequence_number for the last interception so the window stays an +-- index-satisfiable range. +SELECT bl.* +FROM aibridge_interceptions afi +LEFT JOIN LATERAL ( + SELECT COALESCE(MIN(nxt.agent_firewall_sequence_number), 2147483647) AS next_seq + FROM aibridge_interceptions nxt + WHERE nxt.agent_firewall_session_id = afi.agent_firewall_session_id + AND nxt.agent_firewall_sequence_number > afi.agent_firewall_sequence_number +) w ON true +JOIN boundary_logs bl + ON bl.session_id = afi.agent_firewall_session_id + AND bl.sequence_number > afi.agent_firewall_sequence_number + AND bl.sequence_number < w.next_seq +WHERE afi.session_id = @session_id::text + AND afi.ended_at IS NOT NULL + AND afi.agent_firewall_session_id IS NOT NULL + AND afi.agent_firewall_sequence_number IS NOT NULL +-- created_at leads because a session can span several firewall sessions, whose +-- sequence numbers are independent streams. id breaks remaining ties so the row +-- that lands on the limit boundary is stable across identical requests. +ORDER BY bl.created_at ASC, bl.sequence_number ASC, bl.id ASC +LIMIT COALESCE(NULLIF(@limit_::integer, 0), 1000); + -- name: ListAIBridgeSessionThreads :many -- Returns all interceptions belonging to paginated threads within a session. -- Threads are paginated by (started_at, thread_id) cursor. diff --git a/codersdk/aibridge.go b/codersdk/aibridge.go index 66f754bae61..04b54744ca4 100644 --- a/codersdk/aibridge.go +++ b/codersdk/aibridge.go @@ -141,7 +141,7 @@ type AIBridgeSession struct { EndedAt *time.Time `json:"ended_at,omitempty" format:"date-time"` Threads int64 `json:"threads"` TokenUsageSummary AIBridgeSessionTokenUsageSummary `json:"token_usage_summary"` - // NetworkCalls summarizes the Agent Firewall network calls made during the + // NetworkCalls summarizes the Agent Firewall network requests made during the // session. A nil value means the session did not pass through Agent // Firewall, so network call monitoring was not active, which the UI // surfaces as "Disabled". @@ -165,6 +165,13 @@ type AIBridgeSessionNetworkCallSummary struct { Blocked int64 `json:"blocked"` } +// AIBridgeSessionNetworkDomain is one destination host contacted during a +// session, with the number of network calls made to it. +type AIBridgeSessionNetworkDomain struct { + Domain string `json:"domain"` + Count int64 `json:"count"` +} + type AIBridgeListSessionsResponse struct { Count int64 `json:"count"` Sessions []AIBridgeSession `json:"sessions"` @@ -185,7 +192,23 @@ type AIBridgeSessionThreadsResponse struct { StartedAt time.Time `json:"started_at" format:"date-time"` EndedAt *time.Time `json:"ended_at,omitempty" format:"date-time"` TokenUsageSummary AIBridgeSessionThreadsTokenUsage `json:"token_usage_summary"` - Threads []AIBridgeThread `json:"threads"` + // NetworkCalls summarizes the Agent Firewall network calls made during the + // session. A nil value means the session did not pass through Agent + // Firewall, so network call monitoring was not active, which the UI + // surfaces as "Disabled". + NetworkCalls *AIBridgeSessionNetworkCallSummary `json:"network_calls,omitempty"` + // NetworkTopDomains lists the most contacted destination hosts, ordered by + // call count descending. NetworkDomainCount is the total number of distinct + // domains, used to render a "+N more" overflow beyond the listed domains. + NetworkTopDomains []AIBridgeSessionNetworkDomain `json:"network_top_domains,omitempty"` + NetworkDomainCount int64 `json:"network_domain_count,omitempty"` + // NetworkCallLogs is the chronological list of individual network calls made + // during the session, holding the earliest calls up to a server-side cap. + // NetworkCalls remains authoritative for whole-session totals, so a shorter + // list than NetworkCalls.Total means the list was truncated. Empty when the + // session did not pass through Agent Firewall. + NetworkCallLogs []AgentFirewallLog `json:"network_call_logs,omitempty"` + Threads []AIBridgeThread `json:"threads"` } // AIBridgeSessionThreadsTokenUsage represents aggregated token usage diff --git a/docs/ai-coder/ai-gateway/audit.md b/docs/ai-coder/ai-gateway/audit.md index 9be227b6597..63c1161c732 100644 --- a/docs/ai-coder/ai-gateway/audit.md +++ b/docs/ai-coder/ai-gateway/audit.md @@ -49,12 +49,12 @@ not just what was called. The sessions page (`http:///ai-gateway/sessions`) lists all sessions in reverse-chronological order. Each row shows the last prompt, initiator, provider, -client, token usage, network calls, thread count, and timestamp. +client, token usage, network requests, thread count, and timestamp. -The network calls column reports the total and blocked -[Agent Firewall](../agent-firewall/index.md) calls for the session. It shows -`No activity` when the session made no calls, and `Disabled` when the session -did not pass through Agent Firewall, so no network calls were monitored. +The **Network Requests** column reports the total and blocked +[Agent Firewall](../agent-firewall/index.md) requests for the session. It shows +`No activity` when the session made no requests, and `Disabled` when the session +did not pass through Agent Firewall, so no network requests were monitored. Select one to view its full details. @@ -67,6 +67,20 @@ Click into a session to see a chronological causal chain of events. Within a thread, each step shows token usage, tool call details (including arguments and MCP server URLs), duration, and any errors or warnings. +The **Session summary** card beside the timeline reports the session's +[Agent Firewall](../agent-firewall/index.md) activity: + +- **Network requests** is the total number of requests the session made. It + shows `Disabled` when the session did not pass through Agent Firewall, so + monitoring was not active, and `No activity` when the session made no + requests. +- **Blocked network requests** is the subset of those requests that the + allow-list denied. This row appears only when the session made at least one + request, and is highlighted when any were blocked. +- **Top domains** names the destination host the session contacted most, and + appears whenever at least one domain was recorded. When the session contacted + more than one distinct domain, a `+N more` count follows. + ![Session detail](../../images/aibridge/session_detail.png) ## Conducting a forensic audit diff --git a/docs/reference/api/aigateway.md b/docs/reference/api/aigateway.md index 3d8ed690729..18d1f862e38 100644 --- a/docs/reference/api/aigateway.md +++ b/docs/reference/api/aigateway.md @@ -195,6 +195,31 @@ Alias: also available at /api/v2/aibridge/sessions/{session_id} for backward com "models": [ "string" ], + "network_call_logs": [ + { + "allowed": true, + "captured_at": "2019-08-24T14:15:22Z", + "created_at": "2019-08-24T14:15:22Z", + "detail": "string", + "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", + "matched_rule": "string", + "method": "string", + "proto": "string", + "sequence_number": 0, + "session_id": "1ffd059c-17ea-40a8-8aef-70fd0307db82" + } + ], + "network_calls": { + "blocked": 0, + "total": 0 + }, + "network_domain_count": 0, + "network_top_domains": [ + { + "count": 0, + "domain": "string" + } + ], "page_ended_at": "2019-08-24T14:15:22Z", "page_started_at": "2019-08-24T14:15:22Z", "providers": [ diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md index c4e7ad35ce1..aefacff8a52 100644 --- a/docs/reference/api/schemas.md +++ b/docs/reference/api/schemas.md @@ -622,22 +622,22 @@ ### Properties -| Name | Type | Required | Restrictions | Description | -|-----------------------|------------------------------------------------------------------------------------------|----------|--------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `client` | string | false | | | -| `ended_at` | string | false | | | -| `id` | string | false | | | -| `initiator` | [codersdk.MinimalUser](#codersdkminimaluser) | false | | | -| `last_active_at` | string | false | | | -| `last_prompt` | string | false | | | -| `metadata` | object | false | | | -| » `[any property]` | any | false | | | -| `models` | array of string | false | | | -| `network_calls` | [codersdk.AIBridgeSessionNetworkCallSummary](#codersdkaibridgesessionnetworkcallsummary) | false | | Network calls summarizes the Agent Firewall network calls made during the session. A nil value means the session did not pass through Agent Firewall, so network call monitoring was not active, which the UI surfaces as "Disabled". | -| `providers` | array of string | false | | | -| `started_at` | string | false | | | -| `threads` | integer | false | | | -| `token_usage_summary` | [codersdk.AIBridgeSessionTokenUsageSummary](#codersdkaibridgesessiontokenusagesummary) | false | | | +| Name | Type | Required | Restrictions | Description | +|-----------------------|------------------------------------------------------------------------------------------|----------|--------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `client` | string | false | | | +| `ended_at` | string | false | | | +| `id` | string | false | | | +| `initiator` | [codersdk.MinimalUser](#codersdkminimaluser) | false | | | +| `last_active_at` | string | false | | | +| `last_prompt` | string | false | | | +| `metadata` | object | false | | | +| » `[any property]` | any | false | | | +| `models` | array of string | false | | | +| `network_calls` | [codersdk.AIBridgeSessionNetworkCallSummary](#codersdkaibridgesessionnetworkcallsummary) | false | | Network calls summarizes the Agent Firewall network requests made during the session. A nil value means the session did not pass through Agent Firewall, so network call monitoring was not active, which the UI surfaces as "Disabled". | +| `providers` | array of string | false | | | +| `started_at` | string | false | | | +| `threads` | integer | false | | | +| `token_usage_summary` | [codersdk.AIBridgeSessionTokenUsageSummary](#codersdkaibridgesessiontokenusagesummary) | false | | | ## codersdk.AIBridgeSessionNetworkCallSummary @@ -655,6 +655,22 @@ | `blocked` | integer | false | | | | `total` | integer | false | | | +## codersdk.AIBridgeSessionNetworkDomain + +```json +{ + "count": 0, + "domain": "string" +} +``` + +### Properties + +| Name | Type | Required | Restrictions | Description | +|----------|---------|----------|--------------|-------------| +| `count` | integer | false | | | +| `domain` | string | false | | | + ## codersdk.AIBridgeSessionThreadsResponse ```json @@ -675,6 +691,31 @@ "models": [ "string" ], + "network_call_logs": [ + { + "allowed": true, + "captured_at": "2019-08-24T14:15:22Z", + "created_at": "2019-08-24T14:15:22Z", + "detail": "string", + "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", + "matched_rule": "string", + "method": "string", + "proto": "string", + "sequence_number": 0, + "session_id": "1ffd059c-17ea-40a8-8aef-70fd0307db82" + } + ], + "network_calls": { + "blocked": 0, + "total": 0 + }, + "network_domain_count": 0, + "network_top_domains": [ + { + "count": 0, + "domain": "string" + } + ], "page_ended_at": "2019-08-24T14:15:22Z", "page_started_at": "2019-08-24T14:15:22Z", "providers": [ @@ -758,21 +799,25 @@ ### Properties -| Name | Type | Required | Restrictions | Description | -|-----------------------|----------------------------------------------------------------------------------------|----------|--------------|-------------| -| `client` | string | false | | | -| `ended_at` | string | false | | | -| `id` | string | false | | | -| `initiator` | [codersdk.MinimalUser](#codersdkminimaluser) | false | | | -| `metadata` | object | false | | | -| » `[any property]` | any | false | | | -| `models` | array of string | false | | | -| `page_ended_at` | string | false | | | -| `page_started_at` | string | false | | | -| `providers` | array of string | false | | | -| `started_at` | string | false | | | -| `threads` | array of [codersdk.AIBridgeThread](#codersdkaibridgethread) | false | | | -| `token_usage_summary` | [codersdk.AIBridgeSessionThreadsTokenUsage](#codersdkaibridgesessionthreadstokenusage) | false | | | +| Name | Type | Required | Restrictions | Description | +|------------------------|------------------------------------------------------------------------------------------|----------|--------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `client` | string | false | | | +| `ended_at` | string | false | | | +| `id` | string | false | | | +| `initiator` | [codersdk.MinimalUser](#codersdkminimaluser) | false | | | +| `metadata` | object | false | | | +| » `[any property]` | any | false | | | +| `models` | array of string | false | | | +| `network_call_logs` | array of [codersdk.AgentFirewallLog](#codersdkagentfirewalllog) | false | | Network call logs is the chronological list of individual network calls made during the session, holding the earliest calls up to a server-side cap. NetworkCalls remains authoritative for whole-session totals, so a shorter list than NetworkCalls.Total means the list was truncated. Empty when the session did not pass through Agent Firewall. | +| `network_calls` | [codersdk.AIBridgeSessionNetworkCallSummary](#codersdkaibridgesessionnetworkcallsummary) | false | | Network calls summarizes the Agent Firewall network calls made during the session. A nil value means the session did not pass through Agent Firewall, so network call monitoring was not active, which the UI surfaces as "Disabled". | +| `network_domain_count` | integer | false | | | +| `network_top_domains` | array of [codersdk.AIBridgeSessionNetworkDomain](#codersdkaibridgesessionnetworkdomain) | false | | Network top domains lists the most contacted destination hosts, ordered by call count descending. NetworkDomainCount is the total number of distinct domains, used to render a "+N more" overflow beyond the listed domains. | +| `page_ended_at` | string | false | | | +| `page_started_at` | string | false | | | +| `providers` | array of string | false | | | +| `started_at` | string | false | | | +| `threads` | array of [codersdk.AIBridgeThread](#codersdkaibridgethread) | false | | | +| `token_usage_summary` | [codersdk.AIBridgeSessionThreadsTokenUsage](#codersdkaibridgesessionthreadstokenusage) | false | | | ## codersdk.AIBridgeSessionThreadsTokenUsage diff --git a/enterprise/coderd/agentfirewall.go b/enterprise/coderd/agentfirewall.go index 928a99e0d99..2773031f25c 100644 --- a/enterprise/coderd/agentfirewall.go +++ b/enterprise/coderd/agentfirewall.go @@ -5,6 +5,7 @@ import ( "net/http" "github.com/coder/coder/v2/coderd/database" + "github.com/coder/coder/v2/coderd/database/db2sdk" "github.com/coder/coder/v2/coderd/httpapi" "github.com/coder/coder/v2/coderd/httpmw" "github.com/coder/coder/v2/coderd/rbac" @@ -109,30 +110,6 @@ func (api *API) agentFirewallSessionLogs(rw http.ResponseWriter, r *http.Request } httpapi.Write(ctx, rw, http.StatusOK, codersdk.AgentFirewallSessionLogsResponse{ - Results: agentFirewallLogsFromDB(dbLogs), + Results: db2sdk.AgentFirewallLogs(dbLogs), }) } - -// agentFirewallLogsFromDB converts database boundary logs to SDK -// representation. Allowed is derived from MatchedRule being non-NULL. -func agentFirewallLogsFromDB(dbLogs []database.BoundaryLog) []codersdk.AgentFirewallLog { - results := make([]codersdk.AgentFirewallLog, 0, len(dbLogs)) - for _, l := range dbLogs { - bl := codersdk.AgentFirewallLog{ - ID: l.ID, - SessionID: l.SessionID, - SequenceNumber: l.SequenceNumber, - Allowed: l.MatchedRule.Valid, - CreatedAt: l.CreatedAt, - Proto: l.Proto, - Method: l.Method, - Detail: l.Detail, - CapturedAt: &l.CapturedAt, - } - if l.MatchedRule.Valid { - bl.MatchedRule = &l.MatchedRule.String - } - results = append(results, bl) - } - return results -} diff --git a/enterprise/coderd/aibridge.go b/enterprise/coderd/aibridge.go index 884bd23afdb..06e305b7fec 100644 --- a/enterprise/coderd/aibridge.go +++ b/enterprise/coderd/aibridge.go @@ -47,6 +47,11 @@ const ( // maxAISpendExportPeriod bounds an explicit AI spend export window to at // most 31 days, matching the maximum length of the monthly default period. maxAISpendExportPeriod = 31 * 24 * time.Hour + // aiBridgeSessionNetworkCallsLimit caps the per-session network call list + // returned with session threads. The header count still reflects the full + // summary total, so the UI surfaces truncation when a session exceeds this. + // Sessions past the cap need pagination to see the remainder. + aiBridgeSessionNetworkCallsLimit = 1000 ) // errInvalidCursor is returned when a pagination cursor does not @@ -369,6 +374,8 @@ func (api *API) aiBridgeGetSessionThreads(rw http.ResponseWriter, r *http.Reques toolUsages []database.AIBridgeToolUsage userPrompts []database.AIBridgeUserPrompt modelThoughts []database.AIBridgeModelThought + topDomains []database.GetAIBridgeSessionTopDomainsRow + networkCalls []database.BoundaryLog ) err = api.Database.InTx(func(db database.Store) error { // Validate cursor IDs before querying threads. The SQL @@ -435,6 +442,29 @@ func (api *API) aiBridgeGetSessionThreads(rw http.ResponseWriter, r *http.Reques return xerrors.Errorf("list model thoughts: %w", err) } + // Aggregate the session's top network destination. Scoped by session + // ID (not the page) so the summary reflects the whole session. The + // summary card renders only the single most-contacted domain plus a + // "+N more" count derived from NetworkDomainCount, so we fetch one row. + topDomains, err = db.GetAIBridgeSessionTopDomains(ctx, database.GetAIBridgeSessionTopDomainsParams{ + SessionID: sessionIDParam, + Limit: 1, + }) + if err != nil { + return xerrors.Errorf("get session top domains: %w", err) + } + + // List the session's individual network calls. Scoped by session ID + // (not the page) so the list reflects the whole session, consistent + // with the network call summary. + networkCalls, err = db.ListAIBridgeSessionNetworkCalls(ctx, database.ListAIBridgeSessionNetworkCallsParams{ + SessionID: sessionIDParam, + Limit: aiBridgeSessionNetworkCallsLimit, + }) + if err != nil { + return xerrors.Errorf("list session network calls: %w", err) + } + return nil }, &database.TxOptions{ Isolation: sql.LevelRepeatableRead, @@ -456,7 +486,16 @@ func (api *API) aiBridgeGetSessionThreads(rw http.ResponseWriter, r *http.Reques return } - resp := db2sdk.AIBridgeSessionThreads(session, threadRows, tokenUsages, toolUsages, userPrompts, modelThoughts) + resp := db2sdk.AIBridgeSessionThreads(db2sdk.AIBridgeSessionThreadsParams{ + Session: session, + Interceptions: threadRows, + TokenUsages: tokenUsages, + ToolUsages: toolUsages, + UserPrompts: userPrompts, + ModelThoughts: modelThoughts, + TopDomains: topDomains, + NetworkCalls: networkCalls, + }) httpapi.Write(ctx, rw, http.StatusOK, resp) } diff --git a/enterprise/coderd/aibridge_test.go b/enterprise/coderd/aibridge_test.go index 00c7b4dde7a..cba71e26178 100644 --- a/enterprise/coderd/aibridge_test.go +++ b/enterprise/coderd/aibridge_test.go @@ -1562,6 +1562,39 @@ func TestAIBridgeConcurrencyLimiting(t *testing.T) { } } +type boundaryLogSeed struct { + seq int32 + proto string + detail string + allowed bool +} + +// seedBoundaryLogs writes boundary logs for a firewall session via the raw +// store. A non-empty matched_rule marks a call allowed; a blocked call stores a +// NULL rule. No RBAC role grants boundary_log:create, so tests seed directly. +func seedBoundaryLogs(t *testing.T, db database.Store, fw, ownerID uuid.UUID, at time.Time, seeds []boundaryLogSeed) { + t.Helper() + logs := make([]database.BoundaryLog, 0, len(seeds)) + for _, s := range seeds { + rule := "" + if s.allowed { + rule = "allow " + s.detail + } + logs = append(logs, database.BoundaryLog{ + SessionID: fw, + OwnerID: uuid.NullUUID{UUID: ownerID, Valid: true}, + SequenceNumber: s.seq, + CapturedAt: at, + CreatedAt: at, + Proto: s.proto, + Method: "GET", + Detail: s.detail, + MatchedRule: sql.NullString{String: rule, Valid: rule != ""}, + }) + } + dbgen.BoundaryLogs(t, db, logs) +} + func TestAIBridgeGetSessionThreads(t *testing.T) { t.Parallel() @@ -1672,6 +1705,301 @@ func TestAIBridgeGetSessionThreads(t *testing.T) { require.Nil(t, res.Threads[1].AgentFirewallSequenceNumber) }) + t.Run("NetworkSummary", func(t *testing.T) { + t.Parallel() + // Use the raw store so boundary logs can be seeded directly. No RBAC + // role grants boundary_log:create; they are written by the agent path. + db, ps := dbtestutil.NewDB(t) + opts := aibridgeOpts(t) + opts.Options.Database = db + opts.Options.Pubsub = ps + client, _, firstUser := coderdenttest.NewWithDatabase(t, opts) + ctx := testutil.Context(t, testutil.WaitLong) + + now := dbtime.Now() + fw := uuid.New() + + // One interception marked at firewall seq 0, so its window is (0, +inf) + // and the LLM-provider call logged at seq 0 is excluded. + endedAt := now.Add(time.Minute) + dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{ + InitiatorID: firstUser.UserID, + Provider: "anthropic", + Model: "claude-sonnet-4-20250514", + StartedAt: now, + ClientSessionID: sql.NullString{String: "net-session", Valid: true}, + AgentFirewallSessionID: uuid.NullUUID{UUID: fw, Valid: true}, + AgentFirewallSequenceNumber: sql.NullInt32{Int32: 0, Valid: true}, + }, &endedAt) + + seedBoundaryLogs(t, db, fw, firstUser.UserID, now, []boundaryLogSeed{ + {0, "http", "https://api.github.com/llm", true}, // LLM call, excluded + {1, "http", "https://api.github.com/repos/coder", true}, // github egress + {2, "http", "https://api.github.com/repos/other", true}, // github egress + {3, "http", "https://registry.npmjs.org/lodash", false}, // npm egress, blocked + {4, "http", "https://api.github.com/repos/more", true}, // github egress + {5, "dns", "example.com", true}, // non-http, ignored by top domains + {6, "http", "https://api.github.com:8080/repos", true}, // port-suffixed; host stripped to api.github.com + }) + + res, err := client.AIBridgeGetSessionThreads(ctx, "net-session", uuid.Nil, uuid.Nil, 0) + require.NoError(t, err) + + // total counts seq 1-6 (LLM call at seq 0 excluded); one blocked. + require.NotNil(t, res.NetworkCalls) + require.EqualValues(t, 6, res.NetworkCalls.Total) + require.EqualValues(t, 1, res.NetworkCalls.Blocked) + + // Top domains covers HTTP egress only and is capped at one row (the + // summary card renders a single domain). github wins with 4 HTTP calls: + // seqs 1, 2, 4, and the port-suffixed seq 6 whose host strips to + // api.github.com (proving the port is not treated as a separate host). + // The dns log (seq 5) is excluded from domains. NetworkDomainCount is a + // window aggregate independent of the row cap, so it still reports the + // two distinct HTTP domains (github, npm). + require.Len(t, res.NetworkTopDomains, 1) + require.Equal(t, "api.github.com", res.NetworkTopDomains[0].Domain) + require.EqualValues(t, 4, res.NetworkTopDomains[0].Count) + require.EqualValues(t, 2, res.NetworkDomainCount) + + // The per-call list spans the same window as the summary (all protos, + // seq 0 LLM call excluded), ordered chronologically. Its length and + // blocked count agree with the summary counts. + gotSeqs := make([]int32, len(res.NetworkCallLogs)) + blocked := 0 + for i, c := range res.NetworkCallLogs { + gotSeqs[i] = c.SequenceNumber + if !c.Allowed { + blocked++ + } + } + require.Equal(t, []int32{1, 2, 3, 4, 5, 6}, gotSeqs) + require.EqualValues(t, res.NetworkCalls.Total, len(res.NetworkCallLogs)) + require.EqualValues(t, res.NetworkCalls.Blocked, blocked) + + // The blocked npm call (seq 3, index 2) has no matched rule; allowed + // calls do. + npm := res.NetworkCallLogs[2] + require.Equal(t, int32(3), npm.SequenceNumber) + require.Equal(t, "https://registry.npmjs.org/lodash", npm.Detail) + require.False(t, npm.Allowed) + require.Nil(t, npm.MatchedRule) + require.True(t, res.NetworkCallLogs[0].Allowed) + require.NotNil(t, res.NetworkCallLogs[0].MatchedRule) + + // Non-http protocols appear in the list (unlike top domains): seq 5 dns. + require.Equal(t, "dns", res.NetworkCallLogs[4].Proto) + }) + + t.Run("NetworkMultipleInterceptions", func(t *testing.T) { + t.Parallel() + // Two interceptions in the same firewall session must produce two + // consecutive, non-overlapping windows: (0, 5) for the first and + // (5, +inf) for the second. Each interception's own LLM call (logged at + // its own sequence) is excluded by the exclusive lower bound. + db, ps := dbtestutil.NewDB(t) + opts := aibridgeOpts(t) + opts.Options.Database = db + opts.Options.Pubsub = ps + client, _, firstUser := coderdenttest.NewWithDatabase(t, opts) + ctx := testutil.Context(t, testutil.WaitLong) + + now := dbtime.Now() + fw := uuid.New() + + for _, seq := range []int32{0, 5} { + endedAt := now.Add(time.Minute) + dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{ + InitiatorID: firstUser.UserID, + Provider: "anthropic", + Model: "claude-sonnet-4-20250514", + StartedAt: now, + ClientSessionID: sql.NullString{String: "multi-net", Valid: true}, + AgentFirewallSessionID: uuid.NullUUID{UUID: fw, Valid: true}, + AgentFirewallSequenceNumber: sql.NullInt32{Int32: seq, Valid: true}, + }, &endedAt) + } + + seedBoundaryLogs(t, db, fw, firstUser.UserID, now, []boundaryLogSeed{ + {0, "http", "https://api.github.com/llm", true}, // interception 1 LLM call, excluded + {1, "http", "https://api.github.com/a", true}, // window (0,5) + {2, "http", "https://api.github.com/b", true}, // window (0,5) + {3, "http", "https://registry.npmjs.org/x", false}, // window (0,5), blocked + {5, "http", "https://api.github.com/llm2", true}, // interception 2 LLM call, excluded + {6, "http", "https://api.github.com/c", true}, // window (5,+inf) + {7, "http", "https://registry.npmjs.org/y", false}, // window (5,+inf), blocked + }) + + res, err := client.AIBridgeGetSessionThreads(ctx, "multi-net", uuid.Nil, uuid.Nil, 0) + require.NoError(t, err) + + // Both windows contribute: seqs 1,2,3,6,7. The two LLM calls (0, 5) are + // excluded. Blocked = seqs 3 and 7. + require.NotNil(t, res.NetworkCalls) + require.EqualValues(t, 5, res.NetworkCalls.Total) + require.EqualValues(t, 2, res.NetworkCalls.Blocked) + // github: seqs 1,2,6 = 3; npm: seqs 3,7 = 2. Two distinct domains. + require.Len(t, res.NetworkTopDomains, 1) + require.Equal(t, "api.github.com", res.NetworkTopDomains[0].Domain) + require.EqualValues(t, 3, res.NetworkTopDomains[0].Count) + require.EqualValues(t, 2, res.NetworkDomainCount) + + // The per-call list spans both windows in chronological order, and its + // length and blocked count agree with the summary (three-way agreement + // across summary, top domains, and list). + gotSeqs := make([]int32, len(res.NetworkCallLogs)) + blocked := 0 + for i, c := range res.NetworkCallLogs { + gotSeqs[i] = c.SequenceNumber + if !c.Allowed { + blocked++ + } + } + require.Equal(t, []int32{1, 2, 3, 6, 7}, gotSeqs) + require.EqualValues(t, res.NetworkCalls.Total, len(res.NetworkCallLogs)) + require.EqualValues(t, res.NetworkCalls.Blocked, blocked) + }) + + t.Run("NetworkSharedFirewallSessionNoBleed", func(t *testing.T) { + t.Parallel() + // Two AI sessions share one firewall session. next_seq considers every + // interception in the firewall session, so session A's window is bounded + // by session B's interception and B's calls never bleed into A's counts. + db, ps := dbtestutil.NewDB(t) + opts := aibridgeOpts(t) + opts.Options.Database = db + opts.Options.Pubsub = ps + client, _, firstUser := coderdenttest.NewWithDatabase(t, opts) + ctx := testutil.Context(t, testutil.WaitLong) + + now := dbtime.Now() + fw := uuid.New() + + // Session A anchored at firewall seq 0; session B at seq 10. + for _, s := range []struct { + session string + seq int32 + }{{"sess-a", 0}, {"sess-b", 10}} { + endedAt := now.Add(time.Minute) + dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{ + InitiatorID: firstUser.UserID, + Provider: "anthropic", + Model: "claude-sonnet-4-20250514", + StartedAt: now, + ClientSessionID: sql.NullString{String: s.session, Valid: true}, + AgentFirewallSessionID: uuid.NullUUID{UUID: fw, Valid: true}, + AgentFirewallSequenceNumber: sql.NullInt32{Int32: s.seq, Valid: true}, + }, &endedAt) + } + + seedBoundaryLogs(t, db, fw, firstUser.UserID, now, []boundaryLogSeed{ + {0, "http", "https://api.github.com/llm-a", true}, // A's LLM call, excluded + {1, "http", "https://api.github.com/a1", true}, // A's window (0,10) + {2, "http", "https://registry.npmjs.org/a2", false}, // A's window (0,10), blocked + {10, "http", "https://api.github.com/llm-b", true}, // B's LLM call, excluded + {11, "http", "https://api.github.com/b1", true}, // B's window (10,+inf) + {12, "http", "https://api.github.com/b2", true}, // B's window (10,+inf) + {13, "http", "https://registry.npmjs.org/b3", false}, // B's window (10,+inf), blocked + }) + + // Session A sees only its own two calls (seqs 1, 2), not B's, in both + // the summary and the per-call list. + resA, err := client.AIBridgeGetSessionThreads(ctx, "sess-a", uuid.Nil, uuid.Nil, 0) + require.NoError(t, err) + require.NotNil(t, resA.NetworkCalls) + require.EqualValues(t, 2, resA.NetworkCalls.Total) + require.EqualValues(t, 1, resA.NetworkCalls.Blocked) + seqsA := make([]int32, len(resA.NetworkCallLogs)) + for i, c := range resA.NetworkCallLogs { + seqsA[i] = c.SequenceNumber + } + require.Equal(t, []int32{1, 2}, seqsA) + + // Session B sees only its own three calls (seqs 11, 12, 13), not A's. + resB, err := client.AIBridgeGetSessionThreads(ctx, "sess-b", uuid.Nil, uuid.Nil, 0) + require.NoError(t, err) + require.NotNil(t, resB.NetworkCalls) + require.EqualValues(t, 3, resB.NetworkCalls.Total) + require.EqualValues(t, 1, resB.NetworkCalls.Blocked) + seqsB := make([]int32, len(resB.NetworkCallLogs)) + for i, c := range resB.NetworkCallLogs { + seqsB[i] = c.SequenceNumber + } + require.Equal(t, []int32{11, 12, 13}, seqsB) + }) + + t.Run("NetworkCallsTruncated", func(t *testing.T) { + t.Parallel() + // The per-call list is capped server-side while the summary total + // reflects the whole session. When a session exceeds the cap the list is + // truncated but the summary total stays authoritative. + db, ps := dbtestutil.NewDB(t) + opts := aibridgeOpts(t) + opts.Options.Database = db + opts.Options.Pubsub = ps + client, _, firstUser := coderdenttest.NewWithDatabase(t, opts) + ctx := testutil.Context(t, testutil.WaitLong) + + now := dbtime.Now() + fw := uuid.New() + + endedAt := now.Add(time.Minute) + dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{ + InitiatorID: firstUser.UserID, + Provider: "anthropic", + Model: "claude-sonnet-4-20250514", + StartedAt: now, + ClientSessionID: sql.NullString{String: "trunc-net", Valid: true}, + AgentFirewallSessionID: uuid.NullUUID{UUID: fw, Valid: true}, + AgentFirewallSequenceNumber: sql.NullInt32{Int32: 0, Valid: true}, + }, &endedAt) + + // Allowed HTTP calls at seqs 1..total, all in the interception's + // window (0, +inf), seeded past the server-side cap. + const listCap = 1000 + const total = listCap + 5 + seeds := make([]boundaryLogSeed, 0, total) + for seq := int32(1); seq <= total; seq++ { + seeds = append(seeds, boundaryLogSeed{seq, "http", "https://api.github.com/x", true}) + } + seedBoundaryLogs(t, db, fw, firstUser.UserID, now, seeds) + + res, err := client.AIBridgeGetSessionThreads(ctx, "trunc-net", uuid.Nil, uuid.Nil, 0) + require.NoError(t, err) + + // The summary reflects every call; the list stops at the cap. + require.NotNil(t, res.NetworkCalls) + require.EqualValues(t, total, res.NetworkCalls.Total) + require.Len(t, res.NetworkCallLogs, listCap) + // The cap keeps the earliest calls in chronological order. + require.EqualValues(t, 1, res.NetworkCallLogs[0].SequenceNumber) + require.EqualValues(t, listCap, res.NetworkCallLogs[listCap-1].SequenceNumber) + }) + + t.Run("NetworkSummaryDisabled", func(t *testing.T) { + t.Parallel() + client, db, firstUser := coderdenttest.NewWithDatabase(t, aibridgeOpts(t)) + ctx := testutil.Context(t, testutil.WaitLong) + + now := dbtime.Now() + endedAt := now.Add(time.Minute) + // No firewall correlation: network monitoring was not active. + dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{ + InitiatorID: firstUser.UserID, + Provider: "anthropic", + Model: "claude-sonnet-4-20250514", + StartedAt: now, + ClientSessionID: sql.NullString{String: "no-fw-session", Valid: true}, + }, &endedAt) + + res, err := client.AIBridgeGetSessionThreads(ctx, "no-fw-session", uuid.Nil, uuid.Nil, 0) + require.NoError(t, err) + require.Nil(t, res.NetworkCalls) + require.Empty(t, res.NetworkTopDomains) + require.EqualValues(t, 0, res.NetworkDomainCount) + require.Empty(t, res.NetworkCallLogs) + }) + t.Run("ThreadsWithAgenticActions", func(t *testing.T) { t.Parallel() client, db, firstUser := coderdenttest.NewWithDatabase(t, aibridgeOpts(t)) diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts index 759c0a8cb10..551a358a6db 100644 --- a/site/src/api/typesGenerated.ts +++ b/site/src/api/typesGenerated.ts @@ -141,7 +141,7 @@ export interface AIBridgeSession { readonly threads: number; readonly token_usage_summary: AIBridgeSessionTokenUsageSummary; /** - * NetworkCalls summarizes the Agent Firewall network calls made during the + * NetworkCalls summarizes the Agent Firewall network requests made during the * session. A nil value means the session did not pass through Agent * Firewall, so network call monitoring was not active, which the UI * surfaces as "Disabled". @@ -162,6 +162,16 @@ export interface AIBridgeSessionNetworkCallSummary { readonly blocked: number; } +// From codersdk/aibridge.go +/** + * AIBridgeSessionNetworkDomain is one destination host contacted during a + * session, with the number of network calls made to it. + */ +export interface AIBridgeSessionNetworkDomain { + readonly domain: string; + readonly count: number; +} + // From codersdk/aibridge.go /** * AIBridgeSessionThreadsResponse is the response for GET @@ -181,6 +191,28 @@ export interface AIBridgeSessionThreadsResponse { readonly started_at: string; readonly ended_at?: string; readonly token_usage_summary: AIBridgeSessionThreadsTokenUsage; + /** + * NetworkCalls summarizes the Agent Firewall network calls made during the + * session. A nil value means the session did not pass through Agent + * Firewall, so network call monitoring was not active, which the UI + * surfaces as "Disabled". + */ + readonly network_calls?: AIBridgeSessionNetworkCallSummary; + /** + * NetworkTopDomains lists the most contacted destination hosts, ordered by + * call count descending. NetworkDomainCount is the total number of distinct + * domains, used to render a "+N more" overflow beyond the listed domains. + */ + readonly network_top_domains?: readonly AIBridgeSessionNetworkDomain[]; + readonly network_domain_count?: number; + /** + * NetworkCallLogs is the chronological list of individual network calls made + * during the session, holding the earliest calls up to a server-side cap. + * NetworkCalls remains authoritative for whole-session totals, so a shorter + * list than NetworkCalls.Total means the list was truncated. Empty when the + * session did not pass through Agent Firewall. + */ + readonly network_call_logs?: readonly AgentFirewallLog[]; readonly threads: readonly AIBridgeThread[]; } diff --git a/site/src/pages/AIBridgePage/ListSessionsPage/ListSessionsPageView.tsx b/site/src/pages/AIBridgePage/ListSessionsPage/ListSessionsPageView.tsx index bdc65d47e89..21299d54c36 100644 --- a/site/src/pages/AIBridgePage/ListSessionsPage/ListSessionsPageView.tsx +++ b/site/src/pages/AIBridgePage/ListSessionsPage/ListSessionsPageView.tsx @@ -86,7 +86,7 @@ export const ListSessionsPageView: FC = ({ Provider Client In/Out Tokens - Network Calls + Network Requests Threads diff --git a/site/src/pages/AIBridgePage/NetworkCallBadges.stories.tsx b/site/src/pages/AIBridgePage/NetworkCallBadges.stories.tsx index 62d9af8f4a8..f391d020428 100644 --- a/site/src/pages/AIBridgePage/NetworkCallBadges.stories.tsx +++ b/site/src/pages/AIBridgePage/NetworkCallBadges.stories.tsx @@ -49,7 +49,7 @@ export const TotalAndBlockedKeyboard: Story = { await userEvent.tab(); await waitFor(() => { const tooltip = screen.getByRole("tooltip"); - expect(tooltip).toHaveTextContent("Total calls"); + expect(tooltip).toHaveTextContent("Total requests"); expect(tooltip).toHaveTextContent("Blocked"); }); }, @@ -66,7 +66,7 @@ export const DisabledKeyboard: Story = { await userEvent.keyboard("{Enter}"); await waitFor(() => expect(screen.getByRole("dialog")).toHaveTextContent( - "Network call monitoring was not active for this session.", + "Network request monitoring was not active for this session.", ), ); }, diff --git a/site/src/pages/AIBridgePage/NetworkCallBadges.tsx b/site/src/pages/AIBridgePage/NetworkCallBadges.tsx index a4e621a94d0..2da53ba97cd 100644 --- a/site/src/pages/AIBridgePage/NetworkCallBadges.tsx +++ b/site/src/pages/AIBridgePage/NetworkCallBadges.tsx @@ -2,36 +2,30 @@ import { BanIcon } from "lucide-react"; import type { FC } from "react"; import type { AIBridgeSessionNetworkCallSummary } from "#/api/typesGenerated"; import { Badge } from "#/components/Badge/Badge"; -import { InfoTooltip } from "#/components/InfoTooltip/InfoTooltip"; import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger, } from "#/components/Tooltip/Tooltip"; +import { + NetworkMonitoringDisabled, + NetworkNoActivity, +} from "./NetworkRequestStates"; interface NetworkCallBadgesProps { - // summary is undefined when network call monitoring was not active for the - // session, which renders as "Disabled". + // summary is undefined when network request monitoring was not active for + // the session, which renders as "Disabled". summary: AIBridgeSessionNetworkCallSummary | undefined; } export const NetworkCallBadges: FC = ({ summary }) => { if (!summary) { - return ( - - Disabled - - - ); + return ; } if (summary.total === 0) { - return ( - - No activity - - ); + return ; } return ( @@ -63,7 +57,7 @@ export const NetworkCallBadges: FC = ({ summary }) => { >

- Total calls + Total requests {summary.total.toLocaleString("en-US")}

diff --git a/site/src/pages/AIBridgePage/NetworkRequestStates.tsx b/site/src/pages/AIBridgePage/NetworkRequestStates.tsx new file mode 100644 index 00000000000..2e436003e82 --- /dev/null +++ b/site/src/pages/AIBridgePage/NetworkRequestStates.tsx @@ -0,0 +1,17 @@ +import type { FC } from "react"; +import { InfoTooltip } from "#/components/InfoTooltip/InfoTooltip"; + +// Shared by the sessions list badges and the session detail summary card, which +// render the same two non-numeric states for a session's network requests but +// differ in how they present a live count. + +export const NetworkMonitoringDisabled: FC = () => ( + + Disabled + + +); + +export const NetworkNoActivity: FC = () => ( + No activity +); diff --git a/site/src/pages/AIBridgePage/SessionThreadsPage/SessionSummaryTable.stories.tsx b/site/src/pages/AIBridgePage/SessionThreadsPage/SessionSummaryTable.stories.tsx index 10bc86d21b3..b3e851ee4d3 100644 --- a/site/src/pages/AIBridgePage/SessionThreadsPage/SessionSummaryTable.stories.tsx +++ b/site/src/pages/AIBridgePage/SessionThreadsPage/SessionSummaryTable.stories.tsx @@ -1,4 +1,5 @@ import type { Meta, StoryObj } from "@storybook/react-vite"; +import { expect, screen, userEvent, waitFor } from "storybook/test"; import { MockSession } from "#/testHelpers/entities"; import { SessionSummaryTable } from "./SessionSummaryTable"; @@ -56,3 +57,83 @@ export const LargeTokenCounts: Story = { outputTokens: 32_000, }, }; + +// Session did not pass through Agent Firewall: monitoring was not active. +export const NetworkDisabled: Story = { + args: { + ...Default.args, + networkCalls: undefined, + }, + play: async ({ canvas }) => { + await expect(canvas.getByText("Disabled")).toBeInTheDocument(); + await expect(canvas.queryByText("Blocked network requests")).toBeNull(); + await expect(canvas.queryByText("Top domains")).toBeNull(); + }, +}; + +// Tabbing to the disabled indicator's info button and pressing Enter reveals +// the reason without a mouse. +export const NetworkDisabledKeyboard: Story = { + args: { + ...Default.args, + networkCalls: undefined, + }, + play: async () => { + await userEvent.tab(); + await userEvent.keyboard("{Enter}"); + await waitFor(() => + expect(screen.getByRole("dialog")).toHaveTextContent( + "Network request monitoring was not active for this session.", + ), + ); + }, +}; + +// Firewall active but no egress recorded. +export const NetworkNoActivity: Story = { + args: { + ...Default.args, + networkCalls: { total: 0, blocked: 0 }, + }, + play: async ({ canvas }) => { + await expect(canvas.getByText("No activity")).toBeInTheDocument(); + await expect(canvas.queryByText("Blocked network requests")).toBeNull(); + }, +}; + +// Egress recorded, some blocked, across several domains. +export const NetworkActivity: Story = { + args: { + ...Default.args, + networkCalls: { total: 7, blocked: 2 }, + networkDomains: { + topDomain: { domain: "api.github.com", count: 4 }, + totalCount: 14, + }, + }, + play: async ({ canvas }) => { + await expect(canvas.getByText("Network requests")).toBeInTheDocument(); + await expect(canvas.getByText("7")).toBeInTheDocument(); + await expect( + canvas.getByText("Blocked network requests"), + ).toBeInTheDocument(); + await expect(canvas.getByText("api.github.com")).toBeInTheDocument(); + await expect(canvas.getByText("+13 more")).toBeInTheDocument(); + }, +}; + +// A single domain contacted: no "+N more" overflow. +export const NetworkSingleDomain: Story = { + args: { + ...Default.args, + networkCalls: { total: 3, blocked: 0 }, + networkDomains: { + topDomain: { domain: "api.github.com", count: 3 }, + totalCount: 1, + }, + }, + play: async ({ canvas }) => { + await expect(canvas.getByText("api.github.com")).toBeInTheDocument(); + await expect(canvas.queryByText(/more$/)).toBeNull(); + }, +}; diff --git a/site/src/pages/AIBridgePage/SessionThreadsPage/SessionSummaryTable.tsx b/site/src/pages/AIBridgePage/SessionThreadsPage/SessionSummaryTable.tsx index 7d6feaf93dc..389afad00c1 100644 --- a/site/src/pages/AIBridgePage/SessionThreadsPage/SessionSummaryTable.tsx +++ b/site/src/pages/AIBridgePage/SessionThreadsPage/SessionSummaryTable.tsx @@ -1,9 +1,19 @@ -import type { MinimalUser } from "#/api/typesGenerated"; +import { BanIcon } from "lucide-react"; +import type { ReactNode } from "react"; +import type { + AIBridgeSessionNetworkCallSummary, + AIBridgeSessionNetworkDomain, + MinimalUser, +} from "#/api/typesGenerated"; import { Avatar } from "#/components/Avatar/Avatar"; import { Badge } from "#/components/Badge/Badge"; import { AIBridgeClientIcon } from "#/pages/AIBridgePage/icons/AIBridgeClientIcon"; import { AIBridgeProviderIcon } from "#/pages/AIBridgePage/icons/AIBridgeProviderIcon"; import { formatDateTime } from "#/utils/time"; +import { + NetworkMonitoringDisabled, + NetworkNoActivity, +} from "../NetworkRequestStates"; import { TokenBadges } from "../TokenBadges"; import { getProviderDisplayName } from "../utils"; @@ -21,6 +31,16 @@ interface SessionSummaryTableProps { threadCount: number; toolCallCount: number; tokenUsageMetadata?: Record; + // networkCalls is undefined when the session did not pass through Agent + // Firewall, which renders as "Disabled". + networkCalls?: AIBridgeSessionNetworkCallSummary; + // networkDomains is undefined when the session contacted no destination + // hosts. totalCount is the number of distinct domains contacted, which + // renders as a "+N more" overflow beyond topDomain. + networkDomains?: { + readonly topDomain: AIBridgeSessionNetworkDomain; + readonly totalCount: number; + }; } export const SessionSummaryTable = ({ @@ -35,12 +55,25 @@ export const SessionSummaryTable = ({ threadCount, toolCallCount, tokenUsageMetadata, + networkCalls, + networkDomains, }: SessionSummaryTableProps) => { const durationInMs = endTime !== undefined ? new Date(endTime).getTime() - new Date(startTime).getTime() : undefined; + let networkCallsValue: ReactNode; + if (networkCalls === undefined) { + networkCallsValue = ; + } else if (networkCalls.total === 0) { + networkCallsValue = ; + } else { + networkCallsValue = ( + {networkCalls.total.toLocaleString("en-US")} + ); + } + return (

+ Network requests +: + {networkCallsValue} +
+ Blocked network requests +: + {networkCalls.blocked > 0 ? ( + + + {networkCalls.blocked.toLocaleString("en-US")} + + ) : ( + {networkCalls.blocked.toLocaleString("en-US")} + )} +
+ Top domains +: +
+ {networkDomains.topDomain.domain} +
+ {networkDomains.totalCount > 1 && ( +
+ +{(networkDomains.totalCount - 1).toLocaleString("en-US")} more +
+ )} +

); }; diff --git a/site/src/pages/AIBridgePage/SessionThreadsPage/SessionThreadsPageView.tsx b/site/src/pages/AIBridgePage/SessionThreadsPage/SessionThreadsPageView.tsx index 4157c12d887..ba12f4eca13 100644 --- a/site/src/pages/AIBridgePage/SessionThreadsPage/SessionThreadsPageView.tsx +++ b/site/src/pages/AIBridgePage/SessionThreadsPage/SessionThreadsPageView.tsx @@ -75,6 +75,10 @@ export const SessionThreadsPageView: FC = ({ 0, ); + // The API returns only the single most contacted host, alongside the total + // distinct domain count that drives the "+N more" overflow. + const topDomain = session?.network_top_domains?.[0]; + return ( <>

@@ -115,6 +119,13 @@ export const SessionThreadsPageView: FC = ({ threadCount={threads.length} toolCallCount={toolCallCount} tokenUsageMetadata={session.token_usage_summary.metadata} + networkCalls={session.network_calls} + networkDomains={ + topDomain && { + topDomain, + totalCount: session.network_domain_count ?? 1, + } + } /> )} @@ -123,6 +134,8 @@ export const SessionThreadsPageView: FC = ({ = { + title: "pages/AIBridgePage/NetworkCallsTable", + component: NetworkCallsTable, + args: { + summary: { total: 4, blocked: 2 }, + calls: MockAIBridgeSessionNetworkCalls, + }, +}; + +export default meta; +type Story = StoryObj; + +export const Default: Story = { + play: async ({ canvas }) => { + await canvas.findByText("Network calls (4)"); + await expect(canvas.getAllByText("Allowed")).toHaveLength(2); + await expect(canvas.getAllByText("Blocked")).toHaveLength(2); + await expect( + canvas.getByText("https://registry.npmjs.org/lodash"), + ).toBeInTheDocument(); + }, +}; + +// The header badge counts every blocked call in the session, so it can exceed +// the number of blocked rows on screen once the list is capped. +export const BlockedBadge: Story = { + args: { + summary: { total: 4, blocked: 9 }, + }, + play: async ({ canvas }) => { + await expect( + canvas.getByText("Blocked network calls: 9"), + ).toBeInTheDocument(); + await expect(canvas.getAllByText("Blocked")).toHaveLength(2); + }, +}; + +export const NoBlockedCalls: Story = { + args: { + summary: { total: 1, blocked: 0 }, + calls: [MockAIBridgeSessionNetworkCalls[0]], + }, + play: async ({ canvas }) => { + await canvas.findByText("Network calls (1)"); + await expect(canvas.queryByText("Blocked")).not.toBeInTheDocument(); + }, +}; + +export const ExpandRow: Story = { + play: async ({ canvas }) => { + await expect(canvas.queryByText("Protocol")).not.toBeInTheDocument(); + + await userEvent.click( + canvas.getByRole("button", { + name: /https:\/\/api\.github\.com\/repos\/coder\/coder/, + }), + ); + + await expect(canvas.getByText("Protocol")).toBeInTheDocument(); + await expect(canvas.getByText("Matched rule")).toBeInTheDocument(); + }, +}; + +export const CollapsePanel: Story = { + play: async ({ canvas }) => { + await expect( + canvas.getByText("https://api.github.com/repos/coder/coder"), + ).toBeVisible(); + + await userEvent.click(canvas.getByText("Network calls (4)")); + + await expect( + canvas.queryByText("https://api.github.com/repos/coder/coder"), + ).not.toBeInTheDocument(); + }, +}; + +export const Empty: Story = { + args: { + summary: { total: 0, blocked: 0 }, + calls: [], + }, + play: async ({ canvas }) => { + await canvas.findByText("Network calls (0)"); + await expect( + canvas.getByText("No network calls were recorded for this session."), + ).toBeInTheDocument(); + }, +}; + +// A summary total with no rows to show is not a state the server produces. The +// panel still shows a single message rather than claiming both that nothing was +// recorded and that the list was capped. +export const EmptyListWithSummaryTotal: Story = { + args: { + summary: { total: 4, blocked: 2 }, + calls: [], + }, + play: async ({ canvas }) => { + await expect( + canvas.getByText("No network calls were recorded for this session."), + ).toBeInTheDocument(); + await expect( + canvas.queryByText(/Showing the first/), + ).not.toBeInTheDocument(); + }, +}; + +// When the session has more calls than the server returns, the panel notes +// how many are shown. +export const Truncated: Story = { + args: { + summary: { total: 150, blocked: 2 }, + calls: MockAIBridgeSessionNetworkCalls, + }, + play: async ({ canvas }) => { + await canvas.findByText("Network calls (150)"); + await expect( + canvas.getByText(/Showing the first 4 of 150 network calls\./), + ).toBeInTheDocument(); + }, +}; diff --git a/site/src/pages/AIBridgePage/SessionThreadsPage/SessionTimeline/NetworkCallsTable.tsx b/site/src/pages/AIBridgePage/SessionThreadsPage/SessionTimeline/NetworkCallsTable.tsx new file mode 100644 index 00000000000..d6a9cdc38b0 --- /dev/null +++ b/site/src/pages/AIBridgePage/SessionThreadsPage/SessionTimeline/NetworkCallsTable.tsx @@ -0,0 +1,189 @@ +import { BanIcon, CheckIcon, ChevronRightIcon } from "lucide-react"; +import type { FC, ReactNode } from "react"; +import type { + AgentFirewallLog, + AIBridgeSessionNetworkCallSummary, +} from "#/api/typesGenerated"; +import { Badge } from "#/components/Badge/Badge"; +import { + Collapsible, + CollapsibleContent, + CollapsibleTrigger, +} from "#/components/Collapsible/Collapsible"; +import { CopyButton } from "#/components/CopyButton/CopyButton"; +import { formatDateTime } from "#/utils/time"; + +interface NetworkCallsTableProps { + /** + * Drives the header count and blocked badge. Reflects the whole session, so + * its total can exceed the number of rows in `calls`, which is capped + * server-side. + */ + summary: AIBridgeSessionNetworkCallSummary; + calls: readonly AgentFirewallLog[]; +} + +export const NetworkCallsTable: FC = ({ + summary, + calls, +}) => ( + +

+ + + + {summary.blocked > 0 && ( + + + Blocked network calls: + {summary.blocked.toLocaleString("en-US")} + + )} +

+ + + + + +); + +const NetworkCallsList: FC = ({ summary, calls }) => { + if (calls.length === 0) { + return ( +

+ No network calls were recorded for this session. +

+ ); + } + + const hiddenCount = summary.total - calls.length; + + return ( + <> +

+ ))} +

+ {hiddenCount > 0 && ( +

+ Showing the first {calls.length.toLocaleString("en-US")} of{" "} + {summary.total.toLocaleString("en-US")} network calls. +

+ )} + + ); +}; + +interface NetworkCallRowProps { + call: AgentFirewallLog; +} + +const NetworkCallRow: FC = ({ call }) => { + const timestamp = formatDateTime(new Date(call.created_at)); + + return ( +

+ + + + + + +

+ + + {call.detail || "N/A"} + + {call.detail && ( + + )} + + + + {call.proto || "N/A"} + + + + + {call.matched_rule ?? "None"} + + + + + {timestamp} + + + + + +

+ ); +}; + +const NetworkCallStatusBadge: FC<{ allowed: boolean }> = ({ allowed }) => + allowed ? ( + + + Allowed + + ) : ( + + + Blocked + + ); + +interface NetworkCallDetailRowProps { + label: string; + children: ReactNode; +} + +const NetworkCallDetailRow: FC = ({ + label, + children, +}) => ( +

{label}

{children}

+); diff --git a/site/src/pages/AIBridgePage/SessionThreadsPage/SessionTimeline/SessionTimeline.stories.tsx b/site/src/pages/AIBridgePage/SessionThreadsPage/SessionTimeline/SessionTimeline.stories.tsx index 7beb04b4c67..8b6a6836a10 100644 --- a/site/src/pages/AIBridgePage/SessionThreadsPage/SessionTimeline/SessionTimeline.stories.tsx +++ b/site/src/pages/AIBridgePage/SessionThreadsPage/SessionTimeline/SessionTimeline.stories.tsx @@ -1,6 +1,10 @@ import type { Meta, StoryObj } from "@storybook/react-vite"; +import { expect } from "storybook/test"; import type { AIBridgeThread } from "#/api/typesGenerated"; -import { MockSession } from "#/testHelpers/entities"; +import { + MockAIBridgeSessionNetworkCalls, + MockSession, +} from "#/testHelpers/entities"; import { SessionTimeline } from "./SessionTimeline"; // A thread with one thinking block and one tool call. @@ -124,6 +128,7 @@ const meta: Meta = { args: { initiator: MockSession.initiator, threads: [mockThread], + networkCalls: [], hasNextPage: false, isFetchingNextPage: false, onFetchNextPage: noop, @@ -135,6 +140,22 @@ type Story = StoryObj; export const OneThread: Story = {}; +// A summary is present only for sessions that passed through Agent Firewall. +// The panel sits above the threads because its counts are session-scoped +// rather than tied to any one thread. +export const WithNetworkCalls: Story = { + args: { + networkCallSummary: { total: 4, blocked: 2 }, + networkCalls: MockAIBridgeSessionNetworkCalls, + }, + play: async ({ canvas }) => { + await expect(canvas.getByText("Network calls (4)")).toBeInTheDocument(); + await expect( + canvas.getByText("https://api.github.com/repos/coder/coder"), + ).toBeInTheDocument(); + }, +}; + export const MultipleThreads: Story = { args: { threads: [mockThread, mockThreadLong] }, }; diff --git a/site/src/pages/AIBridgePage/SessionThreadsPage/SessionTimeline/SessionTimeline.tsx b/site/src/pages/AIBridgePage/SessionThreadsPage/SessionTimeline/SessionTimeline.tsx index 7154e1ca7a5..b1214fc84e4 100644 --- a/site/src/pages/AIBridgePage/SessionThreadsPage/SessionTimeline/SessionTimeline.tsx +++ b/site/src/pages/AIBridgePage/SessionThreadsPage/SessionTimeline/SessionTimeline.tsx @@ -1,7 +1,9 @@ import { ChevronRightIcon, InfoIcon, LoaderIcon } from "lucide-react"; import { type FC, useEffect, useRef, useState } from "react"; import type { + AgentFirewallLog, AIBridgeAgenticAction, + AIBridgeSessionNetworkCallSummary, AIBridgeThread, MinimalUser, } from "#/api/typesGenerated"; @@ -21,6 +23,7 @@ import { cn } from "#/utils/cn"; import { docs } from "#/utils/docs"; import { JsonPrettyPrinter } from "../../JsonPrettyPrinter"; import { AgenticLoopTable } from "./AgenticLoopTable"; +import { NetworkCallsTable } from "./NetworkCallsTable"; import { PromptTable } from "./PromptTable"; import { ToolCallTable } from "./ToolCallTable"; @@ -408,6 +411,12 @@ const ThreadItem: FC = ({ thread, initiator }) => { interface SessionTimelineProps { initiator: MinimalUser; threads: readonly AIBridgeThread[]; + /** + * Undefined when the session did not pass through Agent Firewall, in which + * case the network calls panel is not rendered. + */ + networkCallSummary?: AIBridgeSessionNetworkCallSummary; + networkCalls: readonly AgentFirewallLog[]; hasNextPage: boolean; isFetchingNextPage: boolean; onFetchNextPage: () => void; @@ -416,6 +425,8 @@ interface SessionTimelineProps { export const SessionTimeline: FC = ({ initiator, threads, + networkCallSummary, + networkCalls, hasNextPage, isFetchingNextPage, onFetchNextPage, @@ -524,6 +535,14 @@ export const SessionTimeline: FC = ({ {/* left vertical line */}

+ {networkCallSummary && ( +

+ +

+ )} {/* threads */}

{threads.map((thread) => ( diff --git a/site/src/testHelpers/entities.ts b/site/src/testHelpers/entities.ts index 38cf409ccd3..2c543dee09e 100644 --- a/site/src/testHelpers/entities.ts +++ b/site/src/testHelpers/entities.ts @@ -5556,6 +5556,54 @@ export const MockSession: TypesGen.AIBridgeSession = { last_active_at: "2026-03-09T10:28:15.03152Z", }; +export const MockAIBridgeSessionNetworkCalls: readonly TypesGen.AgentFirewallLog[] = + [ + { + id: "netcall-1", + session_id: "firewall-session-1", + sequence_number: 1, + proto: "http", + method: "POST", + detail: "https://api.github.com/repos/coder/coder", + allowed: true, + matched_rule: "allow api.github.com", + created_at: "2026-03-09T09:28:16.000Z", + }, + { + id: "netcall-2", + session_id: "firewall-session-1", + sequence_number: 2, + proto: "http", + method: "GET", + detail: "https://registry.npmjs.org/lodash", + allowed: false, + matched_rule: null, + created_at: "2026-03-09T09:28:17.000Z", + }, + { + id: "netcall-3", + session_id: "firewall-session-1", + sequence_number: 3, + proto: "http", + method: "POST", + detail: "https://hooks.slack.com/services/T01", + allowed: false, + matched_rule: null, + created_at: "2026-03-09T09:28:18.000Z", + }, + { + id: "netcall-4", + session_id: "firewall-session-1", + sequence_number: 4, + proto: "dns", + method: "A", + detail: "api.github.com", + allowed: true, + matched_rule: "allow api.github.com", + created_at: "2026-03-09T09:28:19.000Z", + }, + ]; + export const MockAIProviderOpenAI: TypesGen.AIProvider = { id: "7a5d6b6a-5f02-4a9c-9c4e-2b3e2a3d2f01", type: "openai", From 503124b83acaeb2dc105e6b341b4d13bbf442e1d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pawe=C5=82=20Banaszewski?= Date: Tue, 4 Aug 2026 09:21:07 +0200 Subject: [PATCH 28/69] docs: add standalone AI Gateway docs (#27794) > Cherry pick of 18128b7b52038084425c53b7de75e51f9bc3ec18 Documents standalone AI Gateway deployment, Gateway key authentication, monitoring, and the updated embedded vs standalone topology in the AI Gateway docs. Co-authored-by: Cian Johnston Co-authored-by: Marcin Tojek --- docs/admin/infrastructure/architecture.md | 10 +- .../validated-architectures/index.md | 10 + docs/admin/integrations/prometheus.md | 11 +- docs/admin/users/sessions-tokens.md | 2 + .../ai-gateway/ai-gateway-proxy/setup.md | 3 +- docs/ai-coder/ai-gateway/auth.md | 163 ++++++--- docs/ai-coder/ai-gateway/clients/index.md | 5 + docs/ai-coder/ai-gateway/index.md | 4 +- docs/ai-coder/ai-gateway/mcp.md | 4 +- docs/ai-coder/ai-gateway/monitoring.md | 237 +++++++++---- docs/ai-coder/ai-gateway/providers.md | 10 +- docs/ai-coder/ai-gateway/reference.md | 90 ++++- docs/ai-coder/ai-gateway/setup.md | 21 +- docs/ai-coder/ai-gateway/standalone.md | 319 ++++++++++++++++++ docs/install/kubernetes.md | 8 + docs/manifest.json | 10 +- helm/ai-gateway/README.md | 2 +- scripts/metricsdocgen/metrics | 2 +- 18 files changed, 774 insertions(+), 137 deletions(-) create mode 100644 docs/ai-coder/ai-gateway/standalone.md diff --git a/docs/admin/infrastructure/architecture.md b/docs/admin/infrastructure/architecture.md index 4d3c85dc21e..79b709a6e91 100644 --- a/docs/admin/infrastructure/architecture.md +++ b/docs/admin/infrastructure/architecture.md @@ -138,7 +138,15 @@ as OpenAI and Anthropic. Users authenticate through Coder instead of managing se provider API keys. All prompts, token usage, and tool invocations are recorded for compliance and cost tracking. -Learn more: [AI Gateway](../../ai-coder/ai-gateway/index.md) +AI Gateway supports 2 deployment topologies: + +- **Embedded:** `coderd` runs the AI Gateway data plane in the same process. +- **Standalone:** AI Gateway runs outside `coderd`, as replicas that serve AI traffic and send requests directly to upstream providers. + +Standalone replicas hold no durable state. `coderd` is the source of truth and the only component that writes AI Gateway state to the database. +Each replica maintains a control connection to `coderd` for Coder API key validation, provider configuration, and AI session recording, and becomes unready when that connection is unavailable. + +Refer to [AI Gateway](../../ai-coder/ai-gateway/index.md) and [standalone deployment](../../ai-coder/ai-gateway/standalone.md) for configuration and operational guidance. ### Agent Firewall diff --git a/docs/admin/infrastructure/validated-architectures/index.md b/docs/admin/infrastructure/validated-architectures/index.md index 9fa4968bf85..8c037a64337 100644 --- a/docs/admin/infrastructure/validated-architectures/index.md +++ b/docs/admin/infrastructure/validated-architectures/index.md @@ -123,6 +123,16 @@ or helper scripts. Please note that the Registry is a hosted service and isn't available for offline use. +### AI Gateway + +[AI Gateway](../../../ai-coder/ai-gateway/index.md) proxies AI provider traffic +and records each AI session. It runs inside `coderd` by default, and can also +run as a [standalone deployment](../../../ai-coder/ai-gateway/standalone.md) +that scales independently of the control plane. Size replicas from your own AI +request volume and `CODER_AI_GATEWAY_MAX_CONCURRENCY`. For the chart's resource +requests and autoscaling defaults, refer to the +[AI Gateway Helm chart README](https://github.com/coder/coder/blob/main/helm/ai-gateway/README.md). + ## Kubernetes Infrastructure Kubernetes is the recommended, and supported platform for deploying Coder in the diff --git a/docs/admin/integrations/prometheus.md b/docs/admin/integrations/prometheus.md index 26c16449caa..9364583cbe8 100644 --- a/docs/admin/integrations/prometheus.md +++ b/docs/admin/integrations/prometheus.md @@ -72,6 +72,13 @@ scrape_configs: apps: "coder" ``` +If you run a [standalone AI Gateway](../../ai-coder/ai-gateway/standalone.md), +each replica exports its own metrics on its own listener. Its Helm chart uses the +same `0.0.0.0:2112` default as the `coder` chart, but sets up no scrape +discovery. Refer to +[AI Gateway monitoring](../../ai-coder/ai-gateway/monitoring.md#kubernetes-discovery) +for more details. + To use the Kubernetes Prometheus operator to scrape metrics, you will need to create a `ServiceMonitor` in your Coder deployment namespace. The following is an example `ServiceMonitor`. @@ -102,6 +109,8 @@ You must first enable `coderd_agentstats_*` with the flag `CODER_PROMETHEUS_COLLECT_AGENT_STATS` before they can be retrieved from the deployment. They will always be available from the agent. +The `coder_ai_gateway_cost_control_*` metrics are exported only by `coderd`. + | Name | Type | Description | Labels | @@ -124,7 +133,7 @@ deployment. They will always be available from the agent. | `coder_ai_gateway_key_pool_exhaustions_total` | counter | The number of times the key pool was exhausted with no usable key (outcome: rate_limited, auth_failed). | `outcome` `provider` | | `coder_ai_gateway_key_pool_failover_attempts` | histogram | The number of keys attempted before success or exhaustion, per interception for bridged requests and per request for passthrough requests. | `provider` | | `coder_ai_gateway_key_pool_state` | gauge | The number of keys currently in each state (state: valid, temporary, permanent). | `provider` `state` | -| `coder_ai_gateway_key_pool_state_transitions_total` | counter | The number of API key state transitions during failover (reason: rate_limited, unauthorized, forbidden). | `provider` `reason` | +| `coder_ai_gateway_key_pool_state_transitions_total` | counter | The number of API key state transitions during failover (reason: rate_limited, unauthorized). | `provider` `reason` | | `coder_ai_gateway_non_injected_tool_selections_total` | counter | The number of times an AI model selected a tool to be invoked by the client. | `model` `name` `provider` | | `coder_ai_gateway_passthrough_total` | counter | The count of requests which were not intercepted but passed through to the upstream. | `method` `provider` `route` | | `coder_ai_gateway_prompts_total` | counter | The number of prompts issued by users (initiators). | `client` `initiator_id` `model` `provider` | diff --git a/docs/admin/users/sessions-tokens.md b/docs/admin/users/sessions-tokens.md index 8d314266948..f07e4e44746 100644 --- a/docs/admin/users/sessions-tokens.md +++ b/docs/admin/users/sessions-tokens.md @@ -119,6 +119,8 @@ To hard-delete a token, use the `--delete` flag: coder tokens remove --delete ``` +Deleting the user that owns a token revokes every token that user holds at the same time. + ## API Key Scopes API key scopes allow you to limit the permissions of a token to specific operations. By default, tokens are created with the `all` scope, granting full access to all actions the user can perform. For improved security, you can create tokens with limited scopes that restrict access to only the operations needed. diff --git a/docs/ai-coder/ai-gateway/ai-gateway-proxy/setup.md b/docs/ai-coder/ai-gateway/ai-gateway-proxy/setup.md index d0f735b7227..560bd2c0e93 100644 --- a/docs/ai-coder/ai-gateway/ai-gateway-proxy/setup.md +++ b/docs/ai-coder/ai-gateway/ai-gateway-proxy/setup.md @@ -54,7 +54,8 @@ All other traffic is tunneled through without decryption. Intercepted requests are forwarded to the AI Gateway, configured via [`CODER_AI_GATEWAY_PROXY_TARGET`](../../../reference/cli/server.md#--ai-gateway-proxy-target). By default, this is the embedded AI Gateway at `/api/v2/ai-gateway`, and no configuration is needed. -To forward intercepted requests to an AI Gateway that is not embedded in this Coder deployment, set: +AI Gateway Proxy remains part of the `coder server` process when you [deploy AI Gateway as a standalone service](../standalone.md). +To forward intercepted requests to the standalone Gateway, set: ```sh CODER_AI_GATEWAY_PROXY_TARGET=https://ai-gateway.example.com/ diff --git a/docs/ai-coder/ai-gateway/auth.md b/docs/ai-coder/ai-gateway/auth.md index 0b2f907a5bf..3f2b9e076aa 100644 --- a/docs/ai-coder/ai-gateway/auth.md +++ b/docs/ai-coder/ai-gateway/auth.md @@ -3,25 +3,33 @@ > [!NOTE] > AI Gateway requires the [AI Governance Add-On](../ai-governance.md). +AI Gateway uses different credentials for different kinds of connections: + +- AI clients use a Coder API token to authenticate with AI Gateway as a user. +- Standalone Gateway replicas use AI Gateway keys to connect to the Coder control plane. +- AI Gateway uses provider credentials configured by an administrator to authenticate to upstream AI providers. +- In Bring Your Own Key (BYOK) mode, a user also supplies a personal provider credential or subscription token. + +These credentials are not interchangeable. +A Gateway key does not authenticate an AI client, and a Coder API token does not authenticate a standalone replica. + +## Authenticate AI clients + AI Gateway authenticates clients with the same Coder API token -that a user already uses against the rest of the Coder API. -No separate AI Gateway login or credential is required. +that a user uses for the rest of the Coder API. +No separate AI Gateway login is required for client traffic. +For token creation, expiration, and revocation, refer to [Sessions and API tokens](../../admin/users/sessions-tokens.md). -Authenticating with a Coder token avoids distributing provider-specific API keys -(such as OpenAI or Anthropic keys) to individual users. +Authenticating with a Coder token avoids distributing centralized provider API keys, +such as OpenAI or Anthropic keys, to individual users. AI Gateway handles upstream credentials centrally and forwards each request to the configured provider on the user's behalf. -> [!NOTE] -> Only Coder-issued tokens can authenticate users to AI Gateway. -> AI Gateway will use provider-specific API keys to -> [authenticate against upstream AI services](./setup.md#configure-providers). - -The exact environment variable or setting naming may differ from tool to tool. -Refer to the list of [supported clients](./clients/index.md), -and consult your tool's documentation for details. +The exact environment variable or setting name differs between tools. +Refer to the list of [supported clients](./clients/index.md) and +your tool's documentation for details. -## Create a Coder API token +### Create a Coder API token You can generate a token from the Coder dashboard or the CLI. @@ -43,22 +51,17 @@ coder tokens create --lifetime 30d -n my-ai-token Use short lifetimes for automation and CI to limit the blast radius if a token leaks. -## Retrieve your session token +### Retrieve your session token -If you're logged in with the Coder CLI, you can retrieve your current session token -by using [`coder login token`](../../reference/cli/login_token.md): +If you're logged in with the Coder CLI, retrieve your current session token +with [`coder login token`](../../reference/cli/login_token.md): ```sh export ANTHROPIC_API_KEY=$(coder login token) export ANTHROPIC_BASE_URL="https://coder.example.com/api/v2/ai-gateway/anthropic" ``` -Alternatively, you can [generate a long-lived API token](../../admin/users/sessions-tokens.md#generate-a-long-lived-api-token-on-behalf-of-yourself) -from the Coder dashboard. - -For headless or service-account use, refer to [Headless authentication](../../admin/users/headless-auth.md). - -## AI Gateway Proxy authentication +### AI Gateway Proxy authentication For tools that don't support a configurable base URL, [AI Gateway Proxy](./ai-gateway-proxy/index.md) intercepts traffic and forwards it to AI Gateway. @@ -71,25 +74,98 @@ export HTTPS_PROXY="https://coder:$(coder login token)@:8888" The client machine also needs to trust the proxy's CA certificate. For full setup, refer to [AI Gateway Proxy setup](./ai-gateway-proxy/setup.md). +## Authenticate standalone Gateway replicas + +AI Gateway keys are scoped to the Coder deployment. +A [standalone AI Gateway](./standalone.md) uses one of these keys to connect to `coderd`. +Only the built-in Owner role can create, list, and delete these keys. +Coder custom roles are organization-scoped and cannot grant the site-level `ai_gateway_key` permissions. + +Create a key with a descriptive name: + +```sh +coder ai-gateway keys create standalone-production +``` + +The command displays the plaintext key once. +Save it immediately in your secret manager because Coder cannot retrieve it later. +Coder stores only a short prefix of the key for display and a SHA-256 hash for authentication, never the full secret. + +Names must be unique, 64 characters or fewer, and use only lowercase letters, numbers, and hyphens. +A name cannot start or end with a hyphen or contain consecutive hyphens. +Gateway keys do not expire and cannot be scoped or restricted. + +Configure the standalone process with either of the following options, but not both: + +- `CODER_AI_GATEWAY_KEY` or `--key` supplies the key directly. +- `CODER_AI_GATEWAY_KEY_FILE` or `--key-file` reads the key from a file. + +A user login and `CODER_SESSION_TOKEN` are not used by `coder ai-gateway start`. +The same Gateway key can authenticate multiple replicas. +Separate keys make it easier to rotate or revoke each deployment independently. + +List keys and the most recent heartbeat for each: + +```sh +coder ai-gateway keys list +``` + +A replica records a heartbeat when its control connection is established, then refreshes it every 60 seconds while that connection is active. +The heartbeat reports control-connection liveness rather than client request volume. +Coder stores one timestamp per key, so replicas that share a key cannot be distinguished. + +For usage and flags, refer to the generated CLI reference for [creating](../../reference/cli/ai-gateway_keys_create.md), [listing](../../reference/cli/ai-gateway_keys_list.md), and [deleting](../../reference/cli/ai-gateway_keys_delete.md) Gateway keys. + +### Rotate a Gateway key + +Rotate a key with a rolling restart. +Run more than 1 replica behind a load balancer so client traffic continues during the rollout: + +1. Create a new Gateway key. +1. Update the Kubernetes Secret, environment variable, or key file used by every replica. +1. Restart or roll out the standalone deployment so every replica uses the new key. +1. Verify readiness and confirm that the new key has a recent heartbeat. +1. Delete the old key. + +Delete a key by name or ID: + +```sh +coder ai-gateway keys delete standalone-production +``` + +Add `--yes` to skip the confirmation prompt in automation. + +Deleting a key rejects new connections immediately. +An established session closes when its next heartbeat detects the deletion, within 60 seconds. +The replica then tries to reconnect, receives HTTP 401, and treats that as fatal: the process exits non-zero rather than retrying. +Stop or update every replica before deleting its key for an orderly rotation. + +## Authenticate to upstream providers + +Administrators configure provider credentials in the Coder dashboard or with the [AI Providers API](../../reference/api/aiproviders.md). +Standalone replicas fetch this provider configuration from `coderd`, so do not copy centralized provider credentials into each standalone deployment. + +For provider setup and credential failover, refer to [Provider configuration](./providers.md). + ## Bring Your Own Key (BYOK) -In addition to centralized key management, AI Gateway supports **Bring Your Own Key** (BYOK) mode. -Users can provide their own LLM API keys or use provider subscriptions -(such as Claude Pro/Max or ChatGPT Plus/Pro), +In addition to centralized key management, AI Gateway supports Bring Your Own Key (BYOK) mode. +Users can provide their own LLM API keys or provider subscriptions, +such as Claude Pro or Max and ChatGPT Plus or Pro, while AI Gateway continues to provide observability and governance. ![BYOK authentication flow](../../images/aibridge/clients/byok_auth_flow.png) In BYOK mode, users need two credentials: -- A **Coder API token** to authenticate with AI Gateway. -- Their **own LLM credential** (personal API key or subscription token) +- A Coder API token to authenticate with AI Gateway. +- Their own LLM credential, such as a personal API key or subscription token, which AI Gateway forwards to the upstream provider. BYOK and centralized modes can be used together. When a user provides their own credential, AI Gateway forwards it directly. -When no user credential is present, AI Gateway uses the admin-configured provider key. -This approach offers centralized keys as a default, +When no user credential is present, AI Gateway uses the administrator-configured provider key. +This approach offers centralized keys as a default while allowing individual users to bring their own key. > [!NOTE] @@ -97,11 +173,11 @@ while allowing individual users to bring their own key. > is skipped. Coder Agents requests routed through AI Gateway are in-process control plane -requests, not external client requests that send their own AI Gateway bearer -token. Coder Agents use this same global BYOK setting. When BYOK is enabled, -users can save personal API keys for any enabled AI provider from the Agents -settings page. See -[Agents credential selection](../agents/models.md#credential-selection) +requests, not external client requests that send their own AI Gateway bearer token. +Coder Agents use the same global BYOK setting. +When BYOK is enabled, users can save personal API keys for any enabled AI provider +from the Agents settings page. +Refer to [Agents credential selection](../agents/models.md#credential-selection) for the Agents-specific behavior. Visit individual [client pages](./clients/index.md) for configuration details. @@ -109,21 +185,18 @@ Visit individual [client pages](./clients/index.md) for configuration details. ### Enable or disable BYOK BYOK is enabled by default. -Administrators can disable it using `--ai-gateway-allow-byok=false` or `CODER_AI_GATEWAY_ALLOW_BYOK=false`: +Administrators can disable it for the embedded Gateway with `--ai-gateway-allow-byok=false` or `CODER_AI_GATEWAY_ALLOW_BYOK=false`: ```sh coder server --ai-gateway-allow-byok=false ``` -When disabled, BYOK requests are rejected with a `403 Forbidden` response and only centralized key authentication is permitted. - -## Rotate or revoke a token - -To rotate a token without downtime: +For a standalone Gateway, set the option on each replica: -1. Create a new token with `coder tokens create`. -2. Update the client's configuration to use the new token. -3. Delete the old token from the dashboard or with `coder tokens rm `. +```sh +CODER_AI_GATEWAY_ALLOW_BYOK=false coder ai-gateway start +``` -Deleting a token immediately revokes access. -Deleting the user that owns a token revokes every token that user holds at the same time. +Each replica enforces its own local value, which governs only the traffic that replica handles. +The standalone process does not receive the `coderd` value, so set the option on every replica that should reject BYOK requests. +When disabled, BYOK requests are rejected with a `403 Forbidden` response, and only centralized provider credentials are permitted. diff --git a/docs/ai-coder/ai-gateway/clients/index.md b/docs/ai-coder/ai-gateway/clients/index.md index e3e5513721c..ab1b66d7397 100644 --- a/docs/ai-coder/ai-gateway/clients/index.md +++ b/docs/ai-coder/ai-gateway/clients/index.md @@ -27,6 +27,11 @@ The exact configuration method varies by client, some use environment variables, Replace `coder.example.com` with your actual Coder deployment URL. +If you run a [standalone AI Gateway](../standalone.md), point clients at the +Gateway endpoint and drop the `/api/v2/ai-gateway` prefix, for example +`https://ai-gateway.example.com/openai/v1` or +`https://ai-gateway.example.com/anthropic`. + ## Authentication For information about authenticating with AI Gateway, visit [AI Gateway Authentication](../auth.md). diff --git a/docs/ai-coder/ai-gateway/index.md b/docs/ai-coder/ai-gateway/index.md index 3fcbaf15f2c..c9755102d69 100644 --- a/docs/ai-coder/ai-gateway/index.md +++ b/docs/ai-coder/ai-gateway/index.md @@ -6,11 +6,12 @@ AI Gateway is a smart gateway for AI. It acts as an intermediary between your us and providers like OpenAI and Anthropic. By intercepting all the AI traffic between these clients and the upstream APIs, AI Gateway can record user prompts, token usage, and tool invocations. AI Gateway supports clients running inside or outside Coder workspaces. +You can run the Gateway inside the Coder control plane (`coderd`) or as a [standalone service](./standalone.md). AI Gateway solves 3 key problems: 1. **Centralized authn/z management**: no more issuing & managing API tokens for OpenAI/Anthropic usage. - Users use their Coder session or API tokens to authenticate with `coderd` (Coder control plane), and + Users use their Coder session or API tokens to authenticate with `coderd`, and `coderd` securely communicates with the upstream APIs on their behalf. 1. **Auditing and attribution**: all interactions with AI services, whether autonomous or human-initiated, will be audited and attributed back to a user. @@ -41,6 +42,7 @@ AI Gateway is best suited for organizations facing these centralized management ## Next steps - [Set up AI Gateway](./setup.md) on your Coder deployment +- Optionally, [deploy AI Gateway as a standalone service](./standalone.md) - [Configure AI clients](./clients/index.md) to use AI Gateway - [Configure MCP servers](./mcp.md) for tool access - [Audit AI sessions](./audit.md) diff --git a/docs/ai-coder/ai-gateway/mcp.md b/docs/ai-coder/ai-gateway/mcp.md index d78bcb21a74..2e446aa4811 100644 --- a/docs/ai-coder/ai-gateway/mcp.md +++ b/docs/ai-coder/ai-gateway/mcp.md @@ -34,7 +34,7 @@ CODER_EXTERNAL_AUTH_0_CLIENT_SECRET=... CODER_EXTERNAL_AUTH_0_MCP_URL=https://api.githubcopilot.com/mcp/ ``` -See the diagram in [Implementation Details](./reference.md#implementation-details) for more information. +Refer to the diagram in [Embedded Gateway](./reference.md#embedded-gateway) for more information. You can also control which tools are injected by using an allow and/or a deny regular expression on the tool names: @@ -64,7 +64,7 @@ AI Gateway marks automatically injected tools with a prefix `bmcp_` ("bridged MC ## Tool Injection -If a model decides to invoke a tool and it has a `bmcp_` prefix and AI Gateway has a connection with the related MCP server, it will invoke the tool. The tool result will be passed back to the upstream AI provider, and this will loop until the model has all of its required data. These inner loops are not relayed back to the client; all it sees is the result of this loop. See [Implementation Details](./reference.md#implementation-details). +If a model decides to invoke a tool and it has a `bmcp_` prefix and AI Gateway has a connection with the related MCP server, it will invoke the tool. The tool result will be passed back to the upstream AI provider, and this will loop until the model has all of its required data. These inner loops are not relayed back to the client. The client only sees the result of this loop. Refer to [Deployment topologies](./reference.md#deployment-topologies). In contrast, tools which are defined by the client (i.e. the [`Bash` tool](https://docs.claude.com/en/docs/claude-code/settings#tools-available-to-claude) defined by _Claude Code_) cannot be invoked by AI Gateway, and the tool call from the model will be relayed to the client, after which it will invoke the tool. diff --git a/docs/ai-coder/ai-gateway/monitoring.md b/docs/ai-coder/ai-gateway/monitoring.md index a9b2b72f452..df648ef8ec9 100644 --- a/docs/ai-coder/ai-gateway/monitoring.md +++ b/docs/ai-coder/ai-gateway/monitoring.md @@ -11,44 +11,83 @@ AI Gateway records the last `user` prompt, token usage, model reasoning, and eve ![User Leaderboard](../../images/aibridge/grafana_user_leaderboard.png) -We provide an example Grafana dashboard that you can import as a starting point for your metrics. See [the Grafana dashboard README](../../../examples/monitoring/dashboards/grafana/aibridge/README.md). +Coder provides an example Grafana dashboard that you can import as a starting point for your metrics. +Refer to the [Grafana dashboard README](../../../examples/monitoring/dashboards/grafana/aibridge/README.md). These logs and metrics can be used to determine usage patterns, track costs, and evaluate tooling adoption. -## Provider metrics - -AI Gateway (the in-process daemon) and AI Gateway Proxy (the external -proxy) each export Prometheus metrics describing the configured -provider pool and its reload loop. See -[Provider Configuration](./providers.md) for the lifecycle these -metrics describe. - -| Metric | Type | Labels | Purpose | -|--------------------------------------------------------------------------|---------|--------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------| -| `coder_ai_gateway_provider_info` | gauge | `provider_name`, `provider_type`, `status` | One series per configured provider. Value is always `1`; the `status` label (`enabled`, `disabled`, `error`) carries the alertable signal. | -| `coder_ai_gateway_providers_last_reload_timestamp_seconds` | gauge | | Unix timestamp of the last reload attempt, success or failure. | -| `coder_ai_gateway_providers_last_reload_success_timestamp_seconds` | gauge | | Unix timestamp of the last reload that successfully refreshed the pool. | -| `coder_ai_gateway_proxy_provider_info` | gauge | `provider_name`, `provider_type`, `status` | Same shape as `coder_ai_gateway_provider_info` but reported by the external proxy. | -| `coder_ai_gateway_proxy_providers_last_reload_timestamp_seconds` | gauge | | Last reload attempt timestamp in the external proxy. | -| `coder_ai_gateway_proxy_providers_last_reload_success_timestamp_seconds` | gauge | | Last successful reload timestamp in the external proxy. | -| `coder_ai_gateway_proxy_connect_sessions_total` | counter | `type` (`mitm`, `tunneled`) | CONNECT sessions established by the proxy. | -| `coder_ai_gateway_proxy_mitm_requests_total` | counter | `provider` | MITM requests handled. | -| `coder_ai_gateway_proxy_inflight_mitm_requests` | gauge | `provider` | In-flight MITM requests. | -| `coder_ai_gateway_proxy_mitm_responses_total` | counter | `code`, `provider` | MITM responses by HTTP status code. | +## Prometheus metrics + +The embedded Gateway and [standalone Gateway](./standalone.md) export the same AI Gateway request metrics. +Each process exports metrics for the traffic that it handles: + +- The Coder control plane (`coderd`) Prometheus listener exports metrics for the embedded Gateway. +- Each standalone Gateway replica exports metrics from its own Prometheus listener. + +Refer to [provider configuration](./providers.md) for the provider reload lifecycle these metrics describe. + +| Metric | Type | Labels | Purpose | +|--------------------------------------------------------------------|-----------|----------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------| +| `coder_ai_gateway_interceptions_total` | counter | `client`, `initiator_id`, `method`, `model`, `provider`, `route`, `status` | Intercepted requests. | +| `coder_ai_gateway_interceptions_inflight` | gauge | `model`, `provider`, `route` | Intercepted requests currently being processed. | +| `coder_ai_gateway_interceptions_duration_seconds` | histogram | `model`, `provider` | Total intercepted request duration, including upstream processing. | +| `coder_ai_gateway_passthrough_total` | counter | `method`, `provider`, `route` | Requests passed through to an upstream provider without interception. | +| `coder_ai_gateway_prompts_total` | counter | `client`, `initiator_id`, `model`, `provider` | Prompts issued by users. | +| `coder_ai_gateway_tokens_total` | counter | `client`, `initiator_id`, `model`, `provider`, `type` | Tokens used by intercepted requests. | +| `coder_ai_gateway_injected_tool_invocations_total` | counter | `model`, `name`, `provider`, `server` | Invocations of MCP tools injected by AI Gateway. | +| `coder_ai_gateway_non_injected_tool_selections_total` | counter | `model`, `name`, `provider` | Tools selected by a model for the client to invoke. | +| `coder_ai_gateway_circuit_breaker_state` | gauge | `endpoint`, `model`, `provider` | Current circuit-breaker state: `0` for closed, `0.5` for half-open, and `1` for open. | +| `coder_ai_gateway_circuit_breaker_trips_total` | counter | `endpoint`, `model`, `provider` | Times a circuit breaker transitioned to the open state. | +| `coder_ai_gateway_circuit_breaker_rejects_total` | counter | `endpoint`, `model`, `provider` | Requests rejected because a circuit breaker was open. | +| `coder_ai_gateway_key_pool_state` | gauge | `provider`, `state` | Provider keys in each state: `valid`, `temporary`, or `permanent`. | +| `coder_ai_gateway_key_pool_state_transitions_total` | counter | `provider`, `reason` | Provider key state transitions during failover. | +| `coder_ai_gateway_key_pool_exhaustions_total` | counter | `outcome`, `provider` | Times a provider key pool had no usable key. | +| `coder_ai_gateway_key_pool_failover_attempts` | histogram | `provider` | Keys attempted before a request succeeded or exhausted the provider key pool. | +| `coder_ai_gateway_provider_info` | gauge | `provider_name`, `provider_type`, `status` | Build status of each configured provider, including disabled and errored ones. Value is always `1`; `status` is `enabled`, `disabled`, or `error`. | +| `coder_ai_gateway_providers_last_reload_timestamp_seconds` | gauge | | Unix timestamp of the last attempt to rebuild the Gateway provider pool. | +| `coder_ai_gateway_providers_last_reload_success_timestamp_seconds` | gauge | | Unix timestamp of the last successful rebuild of the Gateway provider pool. | + +Histograms also emit the standard `_bucket`, `_sum`, and `_count` series. + +### Cost control metrics + +Budget enforcement runs in `coderd`. +Cost control metrics are exported only from the `coderd` Prometheus listener. +Standalone replicas do not export them. + +| Metric | Type | Labels | Purpose | +|--------------------------------------------------------------------|-----------|---------------------|------------------------------------------------------------------------------------------| +| `coder_ai_gateway_cost_control_blocked_requests_total` | counter | `group_id` | AI requests blocked because the initiator's budget was exceeded. | +| `coder_ai_gateway_cost_control_blocked_users` | gauge | `group_id` | Users currently over their AI budget. | +| `coder_ai_gateway_cost_control_enforcement_duration_seconds` | histogram | `outcome` | Duration of AI budget enforcement checks. `outcome` is `allowed`, `blocked`, or `error`. | +| `coder_ai_gateway_cost_control_unpriced_token_usage_records_total` | counter | `model`, `provider` | Recorded token-usage records for which no model price was found. | + +### AI Gateway Proxy metrics + +AI Gateway Proxy exports metrics from the `coderd` Prometheus listener. + +| Metric | Type | Labels | Purpose | +|--------------------------------------------------------------------------|---------|--------------------------------------------|-----------------------------------------------------------------------------------------------------------------| +| `coder_ai_gateway_proxy_connect_sessions_total` | counter | `type` | CONNECT sessions established, classified as `mitm` or `tunneled`. | +| `coder_ai_gateway_proxy_mitm_requests_total` | counter | `provider` | MITM requests handled by AI Gateway Proxy. | +| `coder_ai_gateway_proxy_inflight_mitm_requests` | gauge | `provider` | MITM requests currently being processed. | +| `coder_ai_gateway_proxy_mitm_responses_total` | counter | `code`, `provider` | MITM responses by HTTP status code. | +| `coder_ai_gateway_proxy_provider_info` | gauge | `provider_name`, `provider_type`, `status` | Routing status of each configured provider. Value is always `1`; `status` is `enabled`, `disabled`, or `error`. | +| `coder_ai_gateway_proxy_providers_last_reload_timestamp_seconds` | gauge | | Unix timestamp of the last attempt to rebuild the proxy routing snapshot. | +| `coder_ai_gateway_proxy_providers_last_reload_success_timestamp_seconds` | gauge | | Unix timestamp of the last successful rebuild of the proxy routing snapshot. | + +Refer to the [Prometheus reference](../../admin/integrations/prometheus.md) for these metrics alongside the other metrics that Coder components export. + +### Metric name migration > [!IMPORTANT] -> The AI Gateway metric prefixes were renamed: `coder_aibridged_*` became -> `coder_ai_gateway_*` and `coder_aibridgeproxyd_*` became -> `coder_ai_gateway_proxy_*`. This rename covers every AI Gateway metric, -> including the interception, token, prompt, tool, and circuit-breaker counters -> listed in the [Prometheus reference](../../admin/integrations/prometheus.md). -> The legacy `coder_aibridged_*` and `coder_aibridgeproxyd_*` names are still -> emitted with identical values during the v2.35 and v2.36 deprecation window. -> They are planned for removal in v2.37. Migrate dashboards and alerts to the new -> names now. Do not relabel new names back to old names while legacy names are -> still emitted, because that creates duplicate legacy series in the same scrape. -> After legacy names are removed, use `metric_relabel_configs` only if you need a -> temporary compatibility bridge for dashboards that still use the old names: +> The embedded Gateway metric prefix changed from `coder_aibridged_*` to `coder_ai_gateway_*`, and the proxy prefix changed from `coder_aibridgeproxyd_*` to `coder_ai_gateway_proxy_*`. +> The embedded Gateway and AI Gateway Proxy emit the legacy names with identical values during the v2.35 and v2.36 deprecation window, and the legacy names are planned for removal in v2.37. +> The cost control metrics were added after the rename and have no legacy alias. +> The standalone Gateway emits only the current `coder_ai_gateway_*` names. +> Migrate dashboards and alerts to the new names. +> Do not relabel new names back to old names while both are emitted because this creates duplicate legacy series in the same scrape. +> After the legacy names are removed, use `metric_relabel_configs` only if you need a temporary compatibility bridge: > > ```yaml > metric_relabel_configs: @@ -68,28 +107,80 @@ metrics describe. Alert on any provider entering a non-`enabled` status: ```promql -sum by (provider_name, status) (coder_ai_gateway_provider_info{status!="enabled"}) > 0 +sum by (instance, provider_name, status) ( + coder_ai_gateway_provider_info{status!="enabled"} +) > 0 ``` -Alert when the reload loop is firing but failing to refresh the pool -for longer than a few minutes: +Alert when the provider reload loop is firing but failing to refresh the pool for longer than a few minutes: ```promql (coder_ai_gateway_providers_last_reload_timestamp_seconds - coder_ai_gateway_providers_last_reload_success_timestamp_seconds) > 300 ``` -Repeat the same query against `coder_ai_gateway_proxy_*` if you run the -external proxy. +Use the `coder_ai_gateway_proxy_*` metrics when you alert on AI Gateway Proxy. -## Structured Logging +## Standalone Gateway monitoring -AI Gateway can emit structured logs for every interception event to your -existing log pipeline. This is useful for exporting data to external SIEM or -observability platforms. See [Structured Logging](./setup.md#structured-logging) -in the setup guide for configuration and a full list of record types. +### Metrics listener -## Exporting Data +Enable the standalone metrics listener with `CODER_PROMETHEUS_ENABLE=true` or `--prometheus-enable`, and set its bind address with `CODER_PROMETHEUS_ADDRESS` or `--prometheus-address`. +The command default is `127.0.0.1:2112`. +The listener is unauthenticated, so expose it only to your monitoring network. + +In addition to the common `coder_ai_gateway_*` metrics, the standalone listener exports standard unprefixed `go_*`, `process_*`, and `promhttp_*` metrics for the standalone process and its metrics handler. + +### Kubernetes discovery + +The [AI Gateway Helm chart](../../../helm/ai-gateway/README.md#metrics) enables metrics and binds the listener to `0.0.0.0:2112` by default. +The chart exposes a named `metrics` container port, but it does not include this port in the data-plane Service or create monitoring discovery resources. +For Prometheus pod-based discovery, add scrape annotations to each Gateway pod: + +```yaml +coder: + podAnnotations: + prometheus.io/scrape: "true" + prometheus.io/port: "2112" +``` + +You can also configure a `PodMonitor` to select the chart's `app.kubernetes.io/name` and `app.kubernetes.io/instance` pod labels, or add dedicated selector labels with `coder.podLabels`. +Manage the `PodMonitor` separately or include it in the Helm release with `extraTemplates`. +To use a `ServiceMonitor`, create a separate Service that exposes the `metrics` container port because the chart's data-plane Service exposes only the HTTP traffic port. +Refer to the [Helm chart metrics configuration](../../../helm/ai-gateway/README.md#metrics) for the available chart settings. + +### Health and readiness + +A standalone AI Gateway exposes health endpoints on its data-plane listener: + +| Endpoint | Success condition | +|------------|-----------------------------------------------------------------------------------------------| +| `/healthz` | The HTTP listener is serving. | +| `/readyz` | The control connection to `coderd` is active and provider configuration has been initialized. | + +`/readyz` returns HTTP 503 until provider configuration is initialized and whenever the control connection to `coderd` is unavailable. +A `200 OK` response from `/healthz` only means the HTTP listener is accepting connections. It returns `200 OK` even when the control connection is down. +Both endpoints are unauthenticated, bypass the concurrency, rate limiting, and BYOK middleware, and do not create trace spans. + +The standalone Helm chart enables a `/healthz` liveness probe and a `/readyz` readiness probe by default. +The startup probe is disabled by default. + +## Logs + +### Standalone operational logs + +Standalone replicas use the standard Coder logging options. +Configure them on every replica or through `coder.env` in the AI Gateway Helm chart. +Refer to the [`coder ai-gateway start` logging options](../../reference/cli/ai-gateway_start.md#-l---log-filter) for configuration details. + +### Structured interception logs + +AI Gateway can emit a structured log for every interception record to an external SIEM or observability platform. +The `CODER_AI_GATEWAY_STRUCTURED_LOGGING` setting belongs to `coderd`, standalone Gateway does not consume it. +Standalone replicas send interception records to `coderd`, which writes the structured logs to the Coder server log output. +Refer to [structured logging](./setup.md#structured-logging) for configuration and record types. + +## Export data AI Gateway interception data can be exported for external analysis, compliance reporting, or integration with log aggregation systems. @@ -131,42 +222,48 @@ Available query filters: - `started_after` - Filter sessions after a timestamp - `started_before` - Filter sessions before a timestamp -See the [API documentation](../../reference/api/aigateway.md) for full details. +Refer to the [API documentation](../../reference/api/aigateway.md) for full details. -## Data Retention +## Data retention AI Gateway data is retained for **60 days by default**. Configure the retention period to balance storage costs with your organization's compliance and analysis needs. -For configuration options and details, see [Data Retention](./setup.md#data-retention) +For configuration options and details, refer to [Data Retention](./setup.md#data-retention) in the AI Gateway setup guide. ## Tracing -AI Gateway supports tracing via [OpenTelemetry](https://opentelemetry.io/), -providing visibility into request processing, upstream API calls, and MCP server -interactions. +AI Gateway supports tracing through [OpenTelemetry](https://opentelemetry.io/) for request processing, upstream API calls, and MCP server interactions. +Embedded Gateway spans are emitted by the `coder server` process. +Standalone spans are emitted independently by every replica with the service name `coder-ai-gateway`. + +### Enable tracing -### Enabling Tracing +AI Gateway exports spans over OTLP/gRPC when you set `CODER_TRACE_ENABLE`, honoring `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT`. +The exporter always dials without TLS, so an `https://` endpoint is still contacted over plaintext gRPC. +`CODER_TRACE_HONEYCOMB_API_KEY` adds a Honeycomb exporter and works with or without `CODER_TRACE_ENABLE`. +Set only the Honeycomb key to export to Honeycomb alone, or set both to export to Honeycomb and an OTLP collector. -AI Gateway tracing is enabled when tracing is enabled for the Coder server. -To enable tracing set `CODER_TRACE_ENABLE` environment variable or -[--trace](https://coder.com/docs/reference/cli/server#--trace) CLI flag: +The embedded and standalone Gateways share the same tracing options. +Refer to the [`coder server` tracing options](../../reference/cli/server.md#--trace) for the embedded Gateway and the [`coder ai-gateway start` tracing options](../../reference/cli/ai-gateway_start.md#--trace) for standalone replicas. +Configure tracing on every standalone process or through `coder.env` in the AI Gateway Helm chart. + +The following minimal configuration enables tracing and exports spans over OTLP/gRPC: ```sh export CODER_TRACE_ENABLE=true +export OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=http://otel-collector:4317 ``` -```sh -coder server --trace -``` +In both deployment modes, each request to the Gateway's LLM API endpoint creates an HTTP request span, including requests that are passed through or rejected instead of intercepted. -### What is Traced +### Traced operations AI Gateway creates spans for the following operations: -| Span Name | Description | +| Span name | Description | |---------------------------------------------|------------------------------------------------------| | `CachedBridgePool.Acquire` | Acquiring a request bridge instance from the pool | | `Intercept` | Top-level span for processing an intercepted request | @@ -174,33 +271,33 @@ AI Gateway creates spans for the following operations: | `Intercept.ProcessRequest` | Processing the request through the bridge | | `Intercept.ProcessRequest.Upstream` | Forwarding the request to the upstream AI provider | | `Intercept.ProcessRequest.ToolCall` | Executing a tool call requested by the AI model | -| `Intercept.RecordInterception` | Recording creating interception record | -| `Intercept.RecordPromptUsage` | Recording prompt/message data | +| `Intercept.RecordInterception` | Creating the interception record | +| `Intercept.RecordPromptUsage` | Recording prompt and message data | | `Intercept.RecordTokenUsage` | Recording token consumption | -| `Intercept.RecordToolUsage` | Recording tool/function calls | +| `Intercept.RecordToolUsage` | Recording tool and function calls | +| `Intercept.RecordModelThought` | Recording model reasoning | | `Intercept.RecordInterceptionEnded` | Recording the interception as completed | +| `Passthrough` | Forwarding a non-intercepted provider request | | `ServerProxyManager.Init` | Initializing MCP server proxy connections | | `StreamableHTTPServerProxy.Init` | Setting up HTTP-based MCP server proxies | | `StreamableHTTPServerProxy.Init.fetchTools` | Fetching available tools from MCP servers | -Example trace of an interception using Jaeger backend: +Example trace of an interception using a Jaeger backend: ![Trace of interception](../../images/aibridge/jaeger_interception_trace.png) -### Capturing Logs in Traces +### Capture logs in traces > [!NOTE] > Enabling log capture may generate a large volume of trace events. -To include log messages as trace events, enable trace log capture -by setting `CODER_TRACE_LOGS` environment variable or using -[--trace-logs](https://coder.com/docs/reference/cli/server#--trace-logs) flag: +Set `CODER_TRACE_LOGS=true` to include log messages as trace events: ```sh export CODER_TRACE_ENABLE=true export CODER_TRACE_LOGS=true ``` -```sh -coder server --trace --trace-logs -``` +Log capture only applies to recording spans, so it requires tracing to be enabled through `CODER_TRACE_ENABLE` or a backend-specific exporter such as `CODER_TRACE_HONEYCOMB_API_KEY`. +Leave `CODER_TRACE_LOGS` unset to trace without capturing logs. +For standalone replicas, set both options on every process that should capture logs. diff --git a/docs/ai-coder/ai-gateway/providers.md b/docs/ai-coder/ai-gateway/providers.md index 889689fd3c5..3e4abe7ad80 100644 --- a/docs/ai-coder/ai-gateway/providers.md +++ b/docs/ai-coder/ai-gateway/providers.md @@ -37,6 +37,10 @@ After seeding, manage providers through the dashboard or API. A provider that has been edited or removed there is not recreated or overwritten from the environment on the next restart. +Seeding is a `coderd` operation. A [standalone Gateway](./standalone.md) +ignores the deprecated provider variables and fetches provider +configuration from `coderd`. + ## Provider types AI Gateway speaks two upstream API formats: the **OpenAI** format @@ -276,7 +280,7 @@ an API key. ## Provider lifecycle Every provider carries an explicit status, surfaced through the -[`provider_info`](./monitoring.md#provider-metrics) metric and the API: +[`provider_info`](./monitoring.md#prometheus-metrics) metric and the API: | Status | Meaning | Effect on requests | |------------|-------------------------------------------------------------------------------|--------------------------------------------------| @@ -298,11 +302,13 @@ attempt and each successful reload, exposed as Prometheus metrics: If you run the [external proxy](./ai-gateway-proxy/index.md), it exposes the same pair under the `coder_ai_gateway_proxy_` prefix. +Each [standalone Gateway](./standalone.md) replica reloads providers +independently. A growing gap between the attempt and success timestamps means reloads are firing but failing to apply. Alert on that gap rather than on a single failure, which may resolve on the next change. See -[Monitoring](./monitoring.md#provider-metrics) for the full metric list +[Monitoring](./monitoring.md#prometheus-metrics) for the full metric list and sample alert queries. ## Key failover diff --git a/docs/ai-coder/ai-gateway/reference.md b/docs/ai-coder/ai-gateway/reference.md index 7714f4ec2ef..88dc6392984 100644 --- a/docs/ai-coder/ai-gateway/reference.md +++ b/docs/ai-coder/ai-gateway/reference.md @@ -5,23 +5,75 @@ > As of Coder v2.32, deployments without the add-on will not be able to > access AI Gateway. -## Implementation Details +## Deployment topologies -`coderd` runs an in-memory instance of `aibridged`, whose logic is mostly contained in ../../../aibridge. In future releases we will support running external instances for higher throughput and complete memory isolation from `coderd`. +AI Gateway can run inside `coderd` or as a standalone data-plane service. +Both topologies run the same Gateway request handling and keep `coderd` as the source of truth for Coder API key validation, provider configuration, and AI session records. +They differ in how requests are routed to the Gateway. + +### Embedded Gateway + +By default, `coder server` runs an in-memory Gateway instance in the `coderd` process. +AI clients send requests to `/api/v2/ai-gateway//`. +The embedded Gateway uses the same control RPC as a standalone deployment, over an in-process transport rather than a network connection. +It does not use a Gateway key and does not negotiate an API version. + +The following diagram shows the embedded topology: ![AI Gateway implementation details](../../images/aibridge/aibridge-implementation-details.png) +### Standalone Gateway + +A [standalone deployment](./standalone.md) runs the AI traffic data plane outside the `coderd` process. +Each replica accepts client traffic, sends AI requests directly to upstream providers, and maintains a control connection to `coderd` using a [Gateway key](./standalone.md#create-a-gateway-key). + +The control connection carries: + +- Coder API key validation, which resolves each request to an active Coder user. +- AI budget checks, which reject requests from users over their spend limit. +- Provider configuration, plus a change signal when the provider set changes. +- AI session records. +- **Deprecated**: the configuration and access tokens used by [injected MCP](./mcp.md). + +Standalone replicas do not own authoritative database state. +They keep ephemeral provider snapshots, request caches, provider key pools, and metrics in memory, and emit their own logs and traces. +Each replica writes its own [API dumps](./setup.md#api-dumps) to its own local disk when dumps are enabled. + +`coderd` remains required for standalone operation. +A replica becomes unready when its control connection is unavailable, even if its HTTP listener remains healthy. +AI Gateway Proxy remains part of `coder server` and can forward its intercepted traffic to either the embedded Gateway or a standalone endpoint. + +## Version compatibility + +The control connection between a standalone replica and `coderd` is versioned. +The current version is defined in [`coderd/aibridged/proto/version.go`](https://github.com/coder/coder/blob/main/coderd/aibridged/proto/version.go). + +`coderd` validates the version that a standalone replica advertises before it accepts the control connection. +Compatibility follows these rules: + +- The Gateway and `coderd` major versions must match. +- The Gateway minor version must be less than or equal to the `coderd` minor version. +- `coderd` rejects a standalone Gateway that advertises a newer minor version. + +A rejected replica receives an HTTP 400 response that reports the `client_api_version` and `server_api_version` values. +Coder build versions are not the compatibility criterion. + +For upgrade and rollback ordering, refer to [Version compatibility](./standalone.md#version-compatibility) in the standalone deployment guide. + ## Supported APIs -API support is broken down into two categories: +API support is divided into two categories: -- **Intercepted**: requests are intercepted, audited, and augmented - full AI Gateway functionality -- **Passthrough**: requests are proxied directly to the upstream, no auditing or augmentation takes place +- **Intercepted**: Requests are intercepted, audited, and augmented. +- **Passthrough**: Requests are proxied directly to the upstream provider without auditing or augmentation. Where relevant, both streaming and non-streaming requests are supported. +Paths are relative to the provider's base URL, such as `https://ai-gateway.example.com/openai/v1` or `https://ai-gateway.example.com/anthropic`. ### OpenAI +The OpenAI provider also serves the Azure OpenAI, Google, OpenRouter, Vercel, and OpenAI-compatible provider types. + #### Intercepted - [`/v1/chat/completions`](https://platform.openai.com/docs/api-reference/chat/create) @@ -29,18 +81,44 @@ Where relevant, both streaming and non-streaming requests are supported. #### Passthrough +- [`/v1/conversations(/*)`](https://platform.openai.com/docs/api-reference/conversations) - [`/v1/models(/*)`](https://platform.openai.com/docs/api-reference/models/list) +- [`/v1/responses/*`](https://platform.openai.com/docs/api-reference/responses/get) + +The legacy [`/v1/completions`](https://platform.openai.com/docs/api-reference/completions) API is deprecated and is not passed through. ### Anthropic +The Anthropic provider also serves the AWS Bedrock provider type. + #### Intercepted - [`/v1/messages`](https://docs.claude.com/en/api/messages) #### Passthrough +- [`/v1/messages/count_tokens`](https://docs.claude.com/en/api/messages-count-tokens) - [`/v1/models(/*)`](https://docs.claude.com/en/api/models-list) +- `/api/event_logging/*` + +### GitHub Copilot + +#### Intercepted + +- `/chat/completions` +- `/responses` +- `/v1/messages` + +#### Passthrough + +- `/models(/*)` +- `/agents/*` +- `/mcp/*` +- `/.well-known/*` + +Any route that is not listed above returns `404`. ## Troubleshooting -To report a bug, file a feature request, or view a list of known issues, please visit our [GitHub repository](https://github.com/coder/coder/issues). If you encounter issues with AI Gateway, please reach out to us via [Discord](https://discord.gg/coder). +To report a bug, file a feature request, or review known issues, visit the [Coder GitHub repository](https://github.com/coder/coder/issues). +For help with AI Gateway, visit the [Coder Discord](https://discord.gg/coder). diff --git a/docs/ai-coder/ai-gateway/setup.md b/docs/ai-coder/ai-gateway/setup.md index ebcb6f6cd77..91f48c120ed 100644 --- a/docs/ai-coder/ai-gateway/setup.md +++ b/docs/ai-coder/ai-gateway/setup.md @@ -1,6 +1,9 @@ # Setup -AI Gateway runs inside the Coder control plane (`coderd`), requiring no separate compute to deploy or scale. Once enabled, `coderd` runs the `aibridged` in-memory and brokers traffic to your configured AI providers on behalf of authenticated users. +By default, AI Gateway runs inside the Coder control plane (`coderd`) and requires no separate compute. +In embedded mode, `coderd` runs the Gateway in memory and brokers traffic to your configured AI providers on behalf of authenticated users. + +If AI traffic needs dedicated compute, independent scaling, or a separate network endpoint, you can [deploy AI Gateway as a standalone service](./standalone.md). > [!NOTE] > Since v2.34, provider environment variables and flags are deprecated. @@ -11,8 +14,10 @@ AI Gateway runs inside the Coder control plane (`coderd`), requiring no separate ## Activation -AI Gateway must be enabled in deployment config before users can authenticate -to it. +The AI Gateway feature must be enabled in the Coder deployment configuration before +embedded or standalone Gateway instances can serve authenticated traffic. + +_AI Gateway is enabled by default as of v2.34._ ```sh export CODER_AI_GATEWAY_ENABLED=true @@ -21,7 +26,9 @@ coder server coder server --ai-gateway-enabled=true ``` -_AI Gateway is enabled by default as of v2.34._ +A standalone process does not read `CODER_AI_GATEWAY_ENABLED` from its own environment. +However, this setting must remain enabled on `coderd`. +It is required for Gateway key management endpoints to work and for standalone replicas to connect to the control plane. ## Configure Providers @@ -84,6 +91,9 @@ with `/var/lib/coder/ai-gateway-dumps` configured writes to Sensitive headers are redacted before dumps are written. Leave the value empty to disable dumping. +Each [standalone Gateway](./standalone.md) replica accepts the same API dump +settings and writes dumps to its own local disk. + > [!WARNING] > API dumps are intended for short diagnostic sessions only. Dump files contain > raw request and response data, which may include proprietary or sensitive @@ -138,6 +148,9 @@ stderr) or [`--log-json`](../../reference/cli/server.md#--log-json). For machine ingestion, set `--log-json` to a file path or `/dev/stderr` so that records are emitted as JSON. +This setting belongs to `coderd`. +A [standalone Gateway](./standalone.md) does not consume it. + Filter for AI Gateway records in your logging pipeline by matching on the `"interception log"` message. Each log line includes a `record_type` field that indicates the kind of event captured: diff --git a/docs/ai-coder/ai-gateway/standalone.md b/docs/ai-coder/ai-gateway/standalone.md new file mode 100644 index 00000000000..08fe70c4e60 --- /dev/null +++ b/docs/ai-coder/ai-gateway/standalone.md @@ -0,0 +1,319 @@ +# Deploy AI Gateway as a standalone service + +> [!NOTE] +> AI Gateway requires the [AI Governance Add-On](../ai-governance.md). +> As of Coder v2.32, deployments without the add-on will not be able to +> access AI Gateway. + +When AI traffic needs dedicated compute, independent scaling, or a separate network endpoint, you can deploy AI Gateway separately from the Coder control plane (`coderd`). + +A standalone AI Gateway serves client traffic on its own listener and maintains a control connection to `coderd`. +`coderd` continues to manage authentication, authorization, provider configuration, and AI session records. + +## Before you begin + +Standalone AI Gateway requires: + +- Coder v2.36.0 or later. +- A Coder license with the [AI Governance Add-On](../ai-governance.md). +- AI Gateway enabled on the Coder control plane with `CODER_AI_GATEWAY_ENABLED=true` or `--ai-gateway-enabled=true`. +- The full Coder image or a Coder binary that includes the `coder ai-gateway start` command. + +`coder ai-gateway start` does not read `CODER_AI_GATEWAY_ENABLED` from the standalone process. +However, this setting must remain enabled on `coderd` for Gateway key management and standalone control connections. + +## Create a Gateway key + +Each standalone replica uses a Gateway key to authenticate and establish its control connection to `coderd`. +Gateway key management requires site-level `ai_gateway_key` permissions, which only the built-in Owner role includes. +Coder custom roles are organization-scoped and cannot grant site-level permissions. + +Log in to the Coder CLI as an Owner or another user with these permissions, then create a dedicated key for the standalone deployment: + +```sh +coder login https://coder.example.com +coder ai-gateway keys create standalone-production +``` + +Save the key from the command output immediately because Coder does not display the plaintext value again. + +A single key can authenticate multiple replicas in the same deployment. +For independent rotation and revocation, use a separate key for each standalone deployment or environment. + +## Start a standalone process + +Set the Coder URL, Gateway key, and listener address, then start the Gateway: + +```sh +export CODER_URL=https://coder.example.com +export CODER_AI_GATEWAY_KEY='' +export CODER_AI_GATEWAY_HTTP_ADDRESS=0.0.0.0:4001 +coder ai-gateway start +``` + +Use `CODER_AI_GATEWAY_KEY_FILE` instead of `CODER_AI_GATEWAY_KEY` to read the key from a file. +The standalone process does not require a user login or `CODER_SESSION_TOKEN` after you provide the Gateway key. + +The listener defaults to `127.0.0.1:4001`, which accepts connections only from the local host. +Set `CODER_AI_GATEWAY_HTTP_ADDRESS` to a routable address, as shown above, before other hosts or pods can reach the Gateway. + +The standalone Gateway fetches provider configuration from `coderd`. +Configure at least one [AI provider](./providers.md) in Coder before sending provider traffic through the Gateway. +The standalone Gateway does not use the deprecated [provider seed variables](./providers.md#database-management-of-providers). + +The listener uses HTTP by default. +Set both `CODER_AI_GATEWAY_TLS_CERT_FILE` and `CODER_AI_GATEWAY_TLS_KEY_FILE` to terminate TLS in the process. +For all command options, refer to [`coder ai-gateway start`](../../reference/cli/ai-gateway_start.md). + +## Run AI Gateway in Kubernetes + +To run the standalone Gateway as a Kubernetes workload, provide the same environment variables and network access to the Coder URL. +You can manage the workload with your own Kubernetes manifests or use the provided Helm chart. +The chart configures the Deployment, probes, and Service, plus an optional Ingress or `HTTPRoute`. + +To use the Kubernetes examples, install `kubectl` and configure access to the cluster where AI Gateway will run. +Install Helm if you use the chart. + +Create a namespace and store the Gateway key in a Kubernetes Secret: + +```sh +kubectl create namespace coder-ai-gateway +kubectl create secret generic coder-ai-gateway-key \ + --namespace coder-ai-gateway \ + --from-literal=key='' +``` + +### Configure the Helm chart + +Create `ai-gateway-values.yaml` with at least the Coder URL and key Secret: + +```yaml +coder: + env: + - name: CODER_URL + value: https://coder.example.com + +aigateway: + keySecret: + name: coder-ai-gateway-key +``` + +The Gateway must be able to reach the Coder URL from every replica. +For an HTTPS URL signed by a private CA, set `aigateway.coderTLS.caSecret.name` to the Secret holding the CA bundle. +If Coder requires client mTLS, also set `aigateway.coderTLS.clientSecret.name`. + +The chart defaults to one replica, a `ClusterIP` Service, and a data-plane listener on port 4001. +It also enables a separate Prometheus listener on port 2112. +Ingress and `HTTPRoute` are disabled by default. + +For the complete chart configuration, including private CAs, mTLS, Ingress, Kubernetes Gateway API, and additional manifests, refer to the [AI Gateway Helm chart README](../../../helm/ai-gateway/README.md). + +### Install the Helm chart + +Install the chart version that matches the Coder control plane from GitHub Container Registry: + +```sh +helm install ai-gateway \ + oci://ghcr.io/coder/chart/coder-ai-gateway \ + --namespace coder-ai-gateway \ + --values ai-gateway-values.yaml \ + --version '' +``` + +Chart versions omit the leading `v`, so use `2.36.0` rather than `v2.36.0`. + +When you install the chart directly from a Git checkout, set `coder.image.tag` explicitly and install `./helm/ai-gateway`. +Released chart packages select the matching Coder image by default. +If you need to run different `coderd` and Gateway versions, refer to [Version compatibility](#version-compatibility). + +### Validate the Helm deployment + +Wait for the Deployment to become available: + +```sh +kubectl rollout status deployment/coder-ai-gateway \ + --namespace coder-ai-gateway \ + --timeout=5m +``` + +The chart configures the following probes by default: + +- The liveness probe requests `/healthz` and verifies that the HTTP listener is serving. +- The readiness probe requests `/readyz` and verifies that the Gateway is connected to `coderd` and has completed its initial provider load. +- The startup probe is disabled by default. + +`/healthz` can return HTTP 200 while `/readyz` returns HTTP 503. +This occurs while the initial connection to `coderd` is being established, before the initial provider load, and whenever the control connection drops. +A replica can only become ready after its initial provider load succeeds, and it returns to ready whenever the control connection recovers. +Kubernetes removes an unready replica from the Service, so clients normally stop reaching it. +A request that still arrives waits for the control connection instead of failing. + +Port-forward the Service to inspect both endpoints: + +```sh +kubectl port-forward \ + --namespace coder-ai-gateway \ + service/coder-ai-gateway \ + 4001:80 +``` + +In another terminal, run: + +```sh +curl --fail http://127.0.0.1:4001/healthz +curl --fail http://127.0.0.1:4001/readyz +``` + +Both endpoints return HTTP 200 with an empty body when the replica is serving and ready. + +List Gateway keys and verify that the key has a recent heartbeat: + +```sh +coder ai-gateway keys list +``` + +The `LAST HEARTBEAT AT` column holds the timestamp. +The first heartbeat is recorded when the replica connects. +An active control connection updates the timestamp every 60 seconds. +Coder stores one timestamp per key, so a recent heartbeat on a shared key does not confirm that every replica is connected. +Check `/readyz` on each replica to verify individual health. + +## Route traffic to the standalone Gateway + +The standalone deployment does not move traffic automatically. +Configure AI Gateway Proxy and direct AI clients to send requests to the standalone endpoint. + +### AI Gateway Proxy + +[AI Gateway Proxy](./ai-gateway-proxy/index.md) remains part of the `coder server` process. +Configure its target to use the standalone Service, Ingress, `HTTPRoute`, or load balancer. + +If you installed the Helm chart, get the exact in-cluster Service URL from the chart notes: + +```sh +helm get notes ai-gateway --namespace coder-ai-gateway +``` + +If you use your own Kubernetes manifests, use the URL of the Service you created. +Set the Service URL on the Coder control plane, for example: + +```sh +CODER_AI_GATEWAY_PROXY_TARGET=http://coder-ai-gateway.coder-ai-gateway.svc.cluster.local:80 +``` + +Restart or upgrade the Coder deployment after changing this setting. +The proxy appends the provider name and request path to the target, so do not include query parameters. + +### Direct AI clients + +Clients that use `/api/v2/ai-gateway//` continue to reach the embedded Gateway. +To route these clients to the standalone Gateway, replace the Coder access URL and embedded route prefix with the standalone endpoint while keeping the provider path. + +For example, if the Gateway is reachable at `https://ai-gateway.example.com` and the providers are configured, configure Claude Code with: + +```sh +ANTHROPIC_BASE_URL=https://ai-gateway.example.com/anthropic +``` + +Configure an OpenAI-compatible client with: + +```sh +OPENAI_BASE_URL=https://ai-gateway.example.com/openai/v1 +``` + +The standalone listener also accepts the equivalent `/api/v2/ai-gateway//` paths for compatibility. +For full per-client configuration examples, refer to [Client Configuration](./clients/index.md). + +### Expose the standalone AI Gateway + +If clients cannot access the in-cluster Service, expose the Gateway through an Ingress, an `HTTPRoute`, or a load balancer Service. +In the provided Helm chart, set: + +```yaml +service: + type: LoadBalancer +``` + +Use TLS to protect credentials and AI traffic whenever they cross an untrusted network. +Prefer TLS termination at the Ingress or Kubernetes Gateway when your platform already manages certificates there. +To terminate TLS in the AI Gateway process, set `aigateway.listenerTLS.name` to an existing TLS Secret. + +If `CODER_AI_GATEWAY_PROXY_TARGET` uses HTTPS with a private CA, add that CA to the trust store of the `coderd` pods before changing the proxy target. +For the Coder Helm chart, you can mount a CA bundle with `coder.certs.secrets`. +This trust configuration is separate from `aigateway.coderTLS.caSecret`, which configures the connection from the standalone Gateway to `coderd`. + +## Scale replicas + +Run multiple replicas behind a Service or load balancer. +In the provided Helm chart, set: + +```yaml +coder: + replicaCount: 3 +``` + +The Service balances requests across ready replicas. +Each replica maintains its own control connection, local caches, concurrency limits, request metrics, logs, and traces. +All replicas fetch provider configuration from the same Coder deployment and write AI session records through `coderd`. +Cost control metrics are registered only on `coderd`, so `coder_ai_gateway_cost_control_*` series never appear on a replica's Prometheus listener. +Budget enforcement also runs in `coderd` over the control connection rather than per replica. +Sticky load balancing can improve cache efficiency, but it is not required for correctness. + +When you enable [API dumps](./setup.md#api-dumps), each replica writes dumps to its own local disk. +Use persistent storage if you need those files to survive pod replacement. + +The chart requests 1 CPU and 1 GiB of memory per replica and does not set resource limits. +Measure production traffic before changing requests, limits, or `CODER_AI_GATEWAY_MAX_CONCURRENCY`. +The chart does not create a Horizontal Pod Autoscaler or PodDisruptionBudget. + +## Migrate from the embedded Gateway + +Use a gradual cutover so that you can validate the standalone data plane before moving production traffic: + +1. Upgrade `coderd` to the target Coder version. +1. Keep `CODER_AI_GATEWAY_ENABLED=true` on `coderd`. +1. Create a dedicated Gateway key. +1. Deploy one standalone replica without changing client or proxy routing. +1. Verify `/readyz`, the key heartbeat, metrics, logs, and traces. +1. Send a test request directly to the standalone Gateway and confirm that the AI session appears in Coder. +1. Set `CODER_AI_GATEWAY_PROXY_TARGET` to the standalone endpoint. +1. Update direct client base URLs that should use the standalone endpoint. +1. Scale the standalone deployment after the canary path is stable. + +Keep `CODER_AI_GATEWAY_ENABLED=true` on `coderd` after the cutover. +The setting is required for standalone control connections and Coder features that use the in-process Gateway. + +## Roll back to the embedded Gateway + +To return traffic to the embedded Gateway: + +1. Remove `CODER_AI_GATEWAY_PROXY_TARGET`, or set it to `/api/v2/ai-gateway`. +1. Restart or upgrade `coderd` so the proxy target change takes effect. +1. Restore direct client base URLs to `/api/v2/ai-gateway//`. +1. Verify requests and AI session records through the embedded route. +1. Scale down or uninstall the standalone deployment. +1. Delete the standalone Gateway key after all replicas have stopped. + +Delete the key with: + +```sh +coder ai-gateway keys delete standalone-production +``` + +Deleting a key prevents new connections immediately. +An established connection closes when its next heartbeat detects the deletion, within 60 seconds. +The replica then tries to reconnect, receives HTTP 401, and treats that as fatal: the process exits non-zero rather than retrying. +Stop the deployment before deleting its key. + +## Version compatibility + +The standalone Gateway image does not need to match the `coderd` image version exactly. +The components can connect when their AI Gateway API versions are compatible, and `coderd` checks compatibility whenever a Gateway replica connects. + +A replica may run at the same API version as `coderd` or an earlier minor version of the same major version, but never a newer one. +Sequence changes that move both components: + +- To upgrade, upgrade `coderd` first, then roll out the standalone Gateway release. +- To roll back, roll back the standalone Gateway first, then roll back `coderd`. + +Running the same Coder release on `coderd` and every standalone replica is the simplest way to stay compatible, but it is not required. diff --git a/docs/install/kubernetes.md b/docs/install/kubernetes.md index 8954a2b131a..80a6fa6cd91 100644 --- a/docs/install/kubernetes.md +++ b/docs/install/kubernetes.md @@ -197,6 +197,14 @@ helm upgrade coder coder-v2/coder \ -f values.yaml ``` +## Standalone AI Gateway Chart + +Coder also publishes a chart, `oci://ghcr.io/coder/chart/coder-ai-gateway`, +that runs [AI Gateway](../ai-coder/ai-gateway/index.md) as its own Deployment +alongside the control plane. Use it when you want to scale AI traffic +independently of `coderd`. For installation and configuration, visit +[Standalone AI Gateway](../ai-coder/ai-gateway/standalone.md). + ## Coder Observability Chart Use the [Observability Helm chart](https://github.com/coder/observability) for a diff --git a/docs/manifest.json b/docs/manifest.json index 7423ce1d4a7..b7f38de4a83 100644 --- a/docs/manifest.json +++ b/docs/manifest.json @@ -1194,7 +1194,7 @@ }, { "title": "AI Gateway", - "description": "Govern and observe AI coding traffic with AI Gateway, an LLM proxy built into the Coder control plane.", + "description": "Govern and observe AI coding traffic with AI Gateway.", "path": "./ai-coder/ai-gateway/index.md", "icon_path": "./images/icons/api.svg", "state": ["ai governance add-on"], @@ -1205,6 +1205,12 @@ "path": "./ai-coder/ai-gateway/setup.md", "state": ["ai governance add-on"] }, + { + "title": "Standalone Deployment", + "description": "Deploy and operate AI Gateway as a standalone service", + "path": "./ai-coder/ai-gateway/standalone.md", + "state": ["ai governance add-on"] + }, { "title": "Authentication", "description": "Authenticate AI coding tools against AI Gateway using your Coder API token.", @@ -1330,7 +1336,7 @@ }, { "title": "Reference", - "description": "Technical reference for AI Gateway, including the aibridged component that runs inside coderd.", + "description": "Technical reference for AI Gateway, including deployment topologies, version compatibility, and supported APIs.", "path": "./ai-coder/ai-gateway/reference.md", "state": ["ai governance add-on"] }, diff --git a/helm/ai-gateway/README.md b/helm/ai-gateway/README.md index 40a5643f9c1..a1bce8edcbe 100644 --- a/helm/ai-gateway/README.md +++ b/helm/ai-gateway/README.md @@ -3,7 +3,7 @@ This chart deploys the Coder AI Gateway as a standalone Kubernetes Deployment. The Gateway connects to Coder using `CODER_URL` and an AI Gateway key. To forward proxied AI traffic to the standalone Gateway, configure the Coder AI Gateway -Proxy (`aibridgeproxyd`) after installing the chart. +Proxy after installing the chart. The chart does not create credentials or TLS Secrets. diff --git a/scripts/metricsdocgen/metrics b/scripts/metricsdocgen/metrics index 70ae90436c6..6464f6ff94b 100644 --- a/scripts/metricsdocgen/metrics +++ b/scripts/metricsdocgen/metrics @@ -195,7 +195,7 @@ coder_ai_gateway_interceptions_total{client="Codex",initiator_id="95f6752b-08cc- coder_ai_gateway_key_pool_state{provider="openai",state="valid"} 2 coder_ai_gateway_key_pool_state{provider="openai",state="temporary"} 0 coder_ai_gateway_key_pool_state{provider="openai",state="permanent"} 0 -# HELP coder_ai_gateway_key_pool_state_transitions_total The number of API key state transitions during failover (reason: rate_limited, unauthorized, forbidden). +# HELP coder_ai_gateway_key_pool_state_transitions_total The number of API key state transitions during failover (reason: rate_limited, unauthorized). # TYPE coder_ai_gateway_key_pool_state_transitions_total counter coder_ai_gateway_key_pool_state_transitions_total{provider="openai",reason="rate_limited"} 1 # HELP coder_ai_gateway_key_pool_exhaustions_total The number of times the key pool was exhausted with no usable key (outcome: rate_limited, auth_failed). From 46dd810fd2fd5c423f3b275bdb3f18e9bfd1472c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pawe=C5=82=20Banaszewski?= Date: Tue, 4 Aug 2026 09:21:42 +0200 Subject: [PATCH 29/69] fix(helm/ai-gateway): render service nodePort with an explicit if guard (#27795) > Cherry picks e819dd4af6a0c220f418128f86dc6f1eeaee3622 6df24634fd17b4a1ef9a66253a42ba1361a14c10 Adds explicit if guard to service in AI Gateway helm chart around `nodePort`. --------- Co-authored-by: Marcin Tojek --- helm/ai-gateway/templates/service.yaml | 4 +- helm/ai-gateway/tests/chart_test.go | 87 +++++++++++++++++++ .../tests/testdata/default_values.golden | 51 +++++++++++ .../tests/testdata/default_values.yaml | 10 +++ helm/ai-gateway/values.schema.json | 2 +- 5 files changed, 151 insertions(+), 3 deletions(-) diff --git a/helm/ai-gateway/templates/service.yaml b/helm/ai-gateway/templates/service.yaml index e32cac88de5..4e17d53e739 100644 --- a/helm/ai-gateway/templates/service.yaml +++ b/helm/ai-gateway/templates/service.yaml @@ -29,7 +29,7 @@ spec: port: {{ .Values.service.port }} targetPort: http protocol: TCP - {{- with .Values.service.nodePort }} - nodePort: {{ . }} + {{- if .Values.service.nodePort }} + nodePort: {{ .Values.service.nodePort }} {{- end }} {{- end }} diff --git a/helm/ai-gateway/tests/chart_test.go b/helm/ai-gateway/tests/chart_test.go index 835a22fa51a..363f55d5de6 100644 --- a/helm/ai-gateway/tests/chart_test.go +++ b/helm/ai-gateway/tests/chart_test.go @@ -22,21 +22,85 @@ var testCases = []testCase{ { name: "default_values", fixture: "default_values", + // The fixture enables every optional resource, so this case covers + // rendering of all templates with the minimum required values. + apiVersions: []string{"gateway.networking.k8s.io/v1/HTTPRoute"}, + mustNotContain: []string{ + // Service fields that only render when their value is set. + "nodePort:", + "loadBalancerClass:", + "loadBalancerIP:", + // externalTrafficPolicy only applies to NodePort and LoadBalancer. + "externalTrafficPolicy:", + // Ingress and HTTPRoute render with required fields only. + "ingressClassName:", + "hostnames:", + // No secret is configured, so nothing mounts a Secret or switches + // the probes and listener to TLS. + "secretName:", + "CODER_AI_GATEWAY_KEY_FILE", + "CODER_AI_GATEWAY_TLS_CERT_FILE", + "CODER_CLIENT_TLS_CA_FILE", + "CODER_CLIENT_TLS_CERT_FILE", + "scheme: HTTPS", + // Opt-in workload settings. + "startupProbe:", + "envFrom:", + "imagePullSecrets:", + "priorityClassName:", + "kind: ConfigMap", + }, }, { name: "networking", fixture: "networking", namespace: "ai-gateway-test", apiVersions: []string{"gateway.networking.k8s.io/v1/HTTPRoute"}, + mustNotContain: []string{ + // The Service is a LoadBalancer without an explicit nodePort, so + // Kubernetes allocates the port. + "nodePort:", + "loadBalancerIP:", + // Only the Gateway key Secret is configured. + "ai-gateway-listener", + "coder-client-ca", + "coder-client-tls", + "scheme: HTTPS", + "startupProbe:", + "envFrom:", + }, }, { name: "custom", fixture: "custom", namespace: "ai-gateway-test", + mustNotContain: []string{ + // coder.serviceAccount.disableCreate is true, so the chart uses the + // existing account instead of creating one. + "kind: ServiceAccount", + // Only the default ClusterIP Service renders. + "kind: Ingress", + "kind: HTTPRoute", + "nodePort:", + "loadBalancerClass:", + "loadBalancerIP:", + "externalTrafficPolicy:", + }, }, { name: "nodeport", fixture: "nodeport", + mustNotContain: []string{ + // LoadBalancer-only fields stay absent for a NodePort Service. + "loadBalancerClass:", + "loadBalancerIP:", + "kind: Ingress", + "kind: HTTPRoute", + "ai-gateway-listener", + "coder-client-ca", + "coder-client-tls", + "scheme: HTTPS", + }, }, { name: "missing_key_field", @@ -54,6 +118,20 @@ var testCases = []testCase{ { name: "listener_tls_with_ingress", fixture: "listener_tls_with_ingress", + mustNotContain: []string{ + // Listener TLS does not imply client TLS to coderd. + "coder-client-ca", + "coder-client-tls", + "CODER_CLIENT_TLS_CA_FILE", + "CODER_CLIENT_TLS_CERT_FILE", + // The Ingress renders with required fields only. + "ingressClassName:", + "kind: HTTPRoute", + "nodePort:", + "loadBalancerClass:", + "loadBalancerIP:", + "externalTrafficPolicy:", + }, }, { name: "partial_client_tls", @@ -104,6 +182,12 @@ type testCase struct { namespace string expectedError string apiVersions []string + // mustNotContain holds substrings that must be absent from the rendered + // output. Golden files are rewritten wholesale by TestUpdateGoldenFiles, + // so absence assertions live here to keep an unintended field from being + // baked into the golden file. Each entry names an optional field or + // resource that the fixture leaves unset. + mustNotContain []string } func (tc testCase) valuesFilePath() string { @@ -143,6 +227,9 @@ func TestRenderChart(t *testing.T) { return } require.NoError(t, err, output) + for _, absent := range tc.mustNotContain { + require.NotContains(t, output, absent) + } golden, err := os.ReadFile(tc.goldenFilePath()) require.NoError(t, err) golden = bytes.ReplaceAll(golden, []byte("\r"), nil) diff --git a/helm/ai-gateway/tests/testdata/default_values.golden b/helm/ai-gateway/tests/testdata/default_values.golden index 66be5cd0566..78c3938bfcb 100644 --- a/helm/ai-gateway/tests/testdata/default_values.golden +++ b/helm/ai-gateway/tests/testdata/default_values.golden @@ -137,3 +137,54 @@ spec: serviceAccountName: coder-ai-gateway terminationGracePeriodSeconds: 330 volumes: [] +--- +# Source: coder-ai-gateway/templates/ingress.yaml +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: coder-ai-gateway + namespace: default + labels: + helm.sh/chart: coder-ai-gateway-0.1.0 + app.kubernetes.io/name: coder-ai-gateway + app.kubernetes.io/instance: ai-gateway + app.kubernetes.io/part-of: coder-ai-gateway + app.kubernetes.io/version: "0.1.0" + app.kubernetes.io/managed-by: Helm +spec: + rules: + - host: "ai.example.com" + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: coder-ai-gateway + port: + number: 80 +--- +# Source: coder-ai-gateway/templates/httproute.yaml +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: coder-ai-gateway + namespace: default + labels: + helm.sh/chart: coder-ai-gateway-0.1.0 + app.kubernetes.io/name: coder-ai-gateway + app.kubernetes.io/instance: ai-gateway + app.kubernetes.io/part-of: coder-ai-gateway + app.kubernetes.io/version: "0.1.0" + app.kubernetes.io/managed-by: Helm +spec: + parentRefs: + - name: shared-gateway + rules: + - matches: + - path: + type: PathPrefix + value: / + backendRefs: + - name: coder-ai-gateway + port: 80 diff --git a/helm/ai-gateway/tests/testdata/default_values.yaml b/helm/ai-gateway/tests/testdata/default_values.yaml index 5eb707ca0cd..46be6740cde 100644 --- a/helm/ai-gateway/tests/testdata/default_values.yaml +++ b/helm/ai-gateway/tests/testdata/default_values.yaml @@ -11,3 +11,13 @@ coder: name: ai-gateway-key key: key aigateway: {} +# Enable every optional resource with only the values each one requires, so +# the golden file covers rendering of all templates without opting into +# non-default settings such as service.nodePort. +ingress: + enable: true + host: ai.example.com +httproute: + enable: true + parentRefs: + - name: shared-gateway diff --git a/helm/ai-gateway/values.schema.json b/helm/ai-gateway/values.schema.json index bb41786cfab..efb0cb25940 100644 --- a/helm/ai-gateway/values.schema.json +++ b/helm/ai-gateway/values.schema.json @@ -92,7 +92,7 @@ }, "service": { "type": "object", "additionalProperties": false, - "required": ["enable", "type", "port", "annotations", "sessionAffinity", "externalTrafficPolicy", "loadBalancerClass", "loadBalancerIP", "nodePort"], + "required": ["enable", "type", "port", "annotations", "sessionAffinity", "externalTrafficPolicy", "loadBalancerClass", "loadBalancerIP"], "properties": { "enable": {"type": "boolean"}, "type": {"enum": ["ClusterIP", "NodePort", "LoadBalancer"]}, From 17773d3cc59c78d5578eac24ab1dd8494c3a896c Mon Sep 17 00:00:00 2001 From: Michael Suchacz <203725896+ibetitsmike@users.noreply.github.com> Date: Tue, 4 Aug 2026 09:55:07 +0200 Subject: [PATCH 30/69] fix: remove native usage-limit controls from 2.36 (#27825) Removes the release 2.36 frontend controls for native chat usage limits and keeps the Spend page focused on usage reporting. The Agents UI now uses AI Gateway spend status, and native-limit errors no longer link to the removed controls. Updates the documentation to clarify that existing native values remain stored and enforced on release 2.36, are not migrated, and that new AI Gateway budgets are configured through group settings or the generated group budget API reference. The backend behavior and database are intentionally unchanged, with no migration. > Mux prepared this PR on Mike's behalf. --- .../agents/platform-controls/index.md | 11 +- .../platform-controls/usage-insights.md | 111 ++--- docs/ai-coder/ai-gateway/cost-controls.md | 40 +- docs/manifest.json | 2 +- site/src/api/api.ts | 65 --- site/src/api/queries/chats.ts | 85 ---- .../AISettingsPage/SpendPage/SpendPage.tsx | 100 +---- .../SpendPage/SpendPageView.stories.tsx | 196 +-------- .../SpendPage/SpendPageView.tsx | 391 +----------------- .../components/ChatCostSummaryView.tsx | 118 +----- .../LimitsTab/DefaultLimitController.tsx | 65 --- .../LimitsTab/DefaultLimitSection.tsx | 137 ------ .../components/LimitsTab/GroupLimitDialog.tsx | 183 -------- .../LimitsTab/GroupLimitsSection.stories.tsx | 182 -------- .../LimitsTab/GroupLimitsSection.tsx | 189 --------- .../components/LimitsTab/GroupLimitsTable.tsx | 167 -------- .../LimitsTab/GroupOverrideController.tsx | 141 ------- .../LimitsTab/UserOverrideController.tsx | 131 ------ .../LimitsTab/UserOverrideDialog.tsx | 157 ------- .../UserOverridesSection.stories.tsx | 155 ------- .../LimitsTab/UserOverridesSection.tsx | 170 -------- .../LimitsTab/UserOverridesTable.tsx | 144 ------- .../LimitsTab/limitsFormLogic.test.ts | 10 - .../components/LimitsTab/limitsFormLogic.ts | 14 - .../components/UsageTab/UsageTab.tsx | 57 +-- .../AgentsPage/AgentsPageLayout.stories.tsx | 8 - .../components/AgentCreateForm.stories.tsx | 9 + .../AgentsPage/components/AgentCreateForm.tsx | 11 +- .../LiveStreamTail.stories.tsx | 13 +- .../ChatConversation/LiveStreamTail.tsx | 11 +- .../components/UsageIndicator.stories.tsx | 136 ++++-- .../AgentsPage/components/UsageIndicator.tsx | 57 +-- site/src/pages/GroupsPage/AIBudgetPeriod.tsx | 8 +- .../pages/GroupsPage/GroupPage.stories.tsx | 3 +- site/src/utils/budget.test.ts | 15 + site/src/utils/budget.ts | 18 + 36 files changed, 258 insertions(+), 3052 deletions(-) delete mode 100644 site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/DefaultLimitController.tsx delete mode 100644 site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/DefaultLimitSection.tsx delete mode 100644 site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/GroupLimitDialog.tsx delete mode 100644 site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/GroupLimitsSection.stories.tsx delete mode 100644 site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/GroupLimitsSection.tsx delete mode 100644 site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/GroupLimitsTable.tsx delete mode 100644 site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/GroupOverrideController.tsx delete mode 100644 site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/UserOverrideController.tsx delete mode 100644 site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/UserOverrideDialog.tsx delete mode 100644 site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/UserOverridesSection.stories.tsx delete mode 100644 site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/UserOverridesSection.tsx delete mode 100644 site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/UserOverridesTable.tsx delete mode 100644 site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/limitsFormLogic.test.ts delete mode 100644 site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/limitsFormLogic.ts diff --git a/docs/ai-coder/agents/platform-controls/index.md b/docs/ai-coder/agents/platform-controls/index.md index d8b7469c47b..53bc04d0a4d 100644 --- a/docs/ai-coder/agents/platform-controls/index.md +++ b/docs/ai-coder/agents/platform-controls/index.md @@ -116,12 +116,13 @@ none, if the template does not define any). ### Spend management -Administrators can set spend limits to cap LLM usage per user within a rolling -time period, with per-user and per-group overrides. The cost tracking dashboard -provides visibility into per-user spending, token consumption, and per-model -breakdowns. +The Spend page provides usage-only reporting for Coder Agents chats. The native +usage-limit configuration UI has been removed from release 2.36, but values +configured before upgrading remain stored and enforced. Existing native values +are not migrated to AI Gateway budgets. -See [Spend Management](./usage-insights.md) for details. +Configure new AI Gateway budgets from group settings or through the generated +group budget API. See [Spend Management](./usage-insights.md) for details. ### Git providers diff --git a/docs/ai-coder/agents/platform-controls/usage-insights.md b/docs/ai-coder/agents/platform-controls/usage-insights.md index b6b2d1e5db1..3ffca0273ec 100644 --- a/docs/ai-coder/agents/platform-controls/usage-insights.md +++ b/docs/ai-coder/agents/platform-controls/usage-insights.md @@ -1,90 +1,51 @@ # Spend Management -Coder provides admin-only controls for monitoring and controlling agent -spend: usage limits and cost tracking. +Coder provides usage reporting for Coder Agents and two independent ways to +limit spend on release 2.36: existing native chat usage limits and AI Gateway +budgets. -## Usage limits +## Native chat usage limits -Navigate to **Agents** > **Settings** > **Manage Agents** > **Spend**. +The native usage-limit configuration UI has been removed from release 2.36. +Values configured before upgrading remain stored and enforced. Coder checks the +user's current spend before processing each chat message and returns a **409 +Conflict** response when the applicable limit is reached. -Usage limits cap how much each user can spend on LLM usage within a rolling -time period. When enabled, the system checks the user's current spend before -processing each chat message. +Existing native values are not migrated to AI Gateway budgets. To change spend +controls after upgrading, configure new AI Gateway budgets. Native limits remain +in effect until they are changed through the existing experimental API or +removed in a later release. -### Configuration +## AI Gateway budgets -- **Enable/disable toggle** — master on/off for the entire limit system. -- **Period** — `day`, `week`, or `month`. Periods are UTC-aligned: midnight - UTC for daily, Monday start for weekly, first of the month for monthly. -- **Default limit** — deployment-wide default in dollars. Applies to all - users who do not have a more specific override. Leave unset for no limit. -- **Per-user overrides** — set a custom dollar limit for an individual user. - Takes highest priority. -- **Per-group overrides** — set a limit for a group. When a user belongs to - multiple groups, the lowest group limit applies. +AI Gateway budgets cap each user's AI Gateway spend, including Coder Agents +chats, over a monthly period. -### Priority hierarchy +- Set a group budget from the group's settings page. +- When a user belongs to several budgeted groups, the deployment budget policy + selects the applicable group. The default policy selects the highest budget. +- A per-user override takes priority over group budgets. -The system resolves a user's effective limit in this order: +Budget controls require a license that includes AI Gateway. Existing native +usage-limit values and recorded spend are not migrated when you configure a +budget. -1. Individual user override (highest priority) -1. Minimum group limit across all of the user's groups -1. Global default limit -1. No limit (if limits are disabled or no value is configured) +The API reference documents how to +[get](../../../reference/api/enterprise.md#get-group-ai-budget), +[upsert](../../../reference/api/enterprise.md#upsert-group-ai-budget), and +[delete](../../../reference/api/enterprise.md#delete-group-ai-budget) a group +budget. -### Enforcement +The Agents page shows the signed-in user's current AI Gateway spend and budget +when AI Gateway is available. -- Checked before each chat message is processed. -- When current spend meets or exceeds the limit, the chat returns a - **409 Conflict** response and the message is blocked. -- Fail-open: if the limit query itself fails, the message is allowed - through. -- Brief overage is possible when concurrent messages are in flight, because - cost is determined only after the LLM returns. +## Spend visibility -### User-facing status +Navigate to **Agents** > **Settings** > **Manage Agents** > **Spend** to view +usage-only reporting for deployment-wide Coder Agents chat costs. -Users can view their own spend status, including whether a limit is active, -their effective limit, current spend, and when the current period resets. +The top-level table includes total cost, message and chat counts, and token usage +for each user. It supports date range filtering, search, and pagination. -> [!NOTE] -> The admin configuration page shows the count of models without pricing -> data. Models missing pricing cannot be tracked accurately against limits. - -## Cost tracking - -Navigate to **Agents** > **Settings** > **Manage Agents** > **Spend**. - -This view shows deployment-wide LLM chat costs with per-user drill-down. - -### Top-level view - -A per-user rollup table with the following columns: - -| Column | Description | -|--------------------|-------------------------------------| -| Total cost | Aggregate dollar spend for the user | -| Messages | Number of chat messages sent | -| Chats | Number of distinct chat sessions | -| Input tokens | Total input tokens consumed | -| Output tokens | Total output tokens consumed | -| Cache read tokens | Tokens served from cache | -| Cache write tokens | Tokens written to cache | - -The table supports date range filtering (default: last 30 days), search by -name or username, and pagination. - -### Per-user detail view - -Select a user to see: - -- **Summary cards** — total cost, token breakdowns, and message counts. -- **Usage limit progress** — if a limit is active, a color-coded progress - bar shows current spend relative to the limit. -- **Per-model breakdown** — table of costs and token usage by model. -- **Per-chat breakdown** — table of costs and token usage by chat session. - -> [!NOTE] -> Automatic title generation uses lightweight models, such as Claude Haiku or GPT-4o -> Mini. Its token usage is not counted towards usage limits or shown in usage -> summaries. +Select a user to view summary cards and per-model and per-chat breakdowns. The +Spend page does not configure native usage limits or AI Gateway budgets. diff --git a/docs/ai-coder/ai-gateway/cost-controls.md b/docs/ai-coder/ai-gateway/cost-controls.md index 52c4fa13c44..e6bec820274 100644 --- a/docs/ai-coder/ai-gateway/cost-controls.md +++ b/docs/ai-coder/ai-gateway/cost-controls.md @@ -270,35 +270,31 @@ see [Prometheus metrics](../../admin/integrations/prometheus.md). ## Migrate from Coder Agents Cost Control -In v2.36, AI Governance Cost Control replaces Coder Agents Cost Control. The -legacy Coder Agents Spend page remains available until v2.37. +In release 2.36, the native Coder Agents usage-limit configuration UI is no +longer available. Existing native values remain stored and enforced, and are not +migrated to AI Gateway budgets. -> [!WARNING] -> Spend limits configured under **Admin settings** > **AI** > **Spend** are no -> longer enforced by Coder Agents. To enforce spend, set an AI Governance budget. - -To migrate existing limits: - -1. Record the limits currently set under **Admin settings** > **AI** > - **Spend**, including the default limit and any group or user overrides. -1. Recreate group limits as [group budgets](#group-budget). -1. Recreate per-user limits as [user overrides](#user-override). +Configure new AI Gateway budgets from the group settings page or use the API to +[get](../../reference/api/enterprise.md#get-group-ai-budget), +[upsert](../../reference/api/enterprise.md#upsert-group-ai-budget), or +[delete](../../reference/api/enterprise.md#delete-group-ai-budget) a group +budget. Expect the following differences: -- No deployment-wide default exists. Each group that needs a limit requires its - own budget. -- The UTC calendar month is the only period. Daily and weekly periods are not - currently supported. -- Users in several budgeted groups receive the highest budget. Coder Agents Cost - Control applied the lowest. +- Native limits and AI Gateway budgets are independent. A user can be subject to + both until native limits are removed in a later release. +- AI Gateway has no deployment-wide default budget. Each group that needs a + limit requires its own budget. +- The UTC calendar month is the only budget period. Daily and weekly periods are + not currently supported. +- Users in several budgeted groups receive the highest budget by default. Native + Coder Agents usage limits apply the lowest group limit. - Budgets cover priced AI Gateway traffic. Chat, IDE extensions, and CLI agents draw on the same budget when their provider and model are priced. See [How spend is estimated](#how-spend-is-estimated). -- Recorded spend does not carry over. Every user starts the first period at - $0 USD. -- Coder Agents users who exceed their budget see a usage limit error in chat. - The error details include the AI Governance budget limit. +- Recorded spend and native limit values do not carry over to AI Gateway + budgets. ## Next steps diff --git a/docs/manifest.json b/docs/manifest.json index b7f38de4a83..99d5cdab331 100644 --- a/docs/manifest.json +++ b/docs/manifest.json @@ -1079,7 +1079,7 @@ }, { "title": "Spend Management", - "description": "Set spend limits and track AI costs for Coder Agents with admin-only controls.", + "description": "Track Coder Agents usage and configure new spend controls with AI Gateway budgets.", "path": "./ai-coder/agents/platform-controls/usage-insights.md", "state": ["beta"] }, diff --git a/site/src/api/api.ts b/site/src/api/api.ts index b87d08a9f2b..46248aceea1 100644 --- a/site/src/api/api.ts +++ b/site/src/api/api.ts @@ -3948,71 +3948,6 @@ class ExperimentalApiMethods { const response = await this.axios.get(url); return response.data; }; - - getChatUsageLimitConfig = - async (): Promise => { - const response = - await this.axios.get( - "/api/experimental/chats/usage-limits", - ); - return response.data; - }; - - getChatUsageLimitStatus = - async (): Promise => { - const response = await this.axios.get( - "/api/experimental/chats/usage-limits/status", - ); - return response.data; - }; - - updateChatUsageLimitConfig = async ( - req: TypesGen.ChatUsageLimitConfig, - ): Promise => { - const response = await this.axios.put( - "/api/experimental/chats/usage-limits", - req, - ); - return response.data; - }; - - upsertChatUsageLimitOverride = async ( - userID: string, - req: TypesGen.UpsertChatUsageLimitOverrideRequest, - ): Promise => { - const response = await this.axios.put( - `/api/experimental/chats/usage-limits/overrides/${encodeURIComponent(userID)}`, - req, - ); - return response.data; - }; - - deleteChatUsageLimitOverride = async (userID: string): Promise => { - const response = await this.axios.delete( - `/api/experimental/chats/usage-limits/overrides/${encodeURIComponent(userID)}`, - ); - return response.data; - }; - - upsertChatUsageLimitGroupOverride = async ( - groupID: string, - req: TypesGen.UpsertChatUsageLimitGroupOverrideRequest, - ): Promise => { - const response = await this.axios.put( - `/api/experimental/chats/usage-limits/group-overrides/${encodeURIComponent(groupID)}`, - req, - ); - return response.data; - }; - - deleteChatUsageLimitGroupOverride = async ( - groupID: string, - ): Promise => { - const response = await this.axios.delete( - `/api/experimental/chats/usage-limits/group-overrides/${encodeURIComponent(groupID)}`, - ); - return response.data; - }; } // This is a hard coded CSRF token/cookie pair for local development. In prod, diff --git a/site/src/api/queries/chats.ts b/site/src/api/queries/chats.ts index a23e7efd7d3..751696b414a 100644 --- a/site/src/api/queries/chats.ts +++ b/site/src/api/queries/chats.ts @@ -1994,91 +1994,6 @@ export function paginatedChatCostUsers( }; } -export const chatUsageLimitStatusKey = [ - ...chatsKey, - "usageLimitStatus", -] as const; - -export const chatUsageLimitStatus = () => ({ - queryKey: chatUsageLimitStatusKey, - queryFn: () => API.experimental.getChatUsageLimitStatus(), - refetchInterval: 60_000, -}); - -const chatUsageLimitConfigKey = [...chatsKey, "usageLimitConfig"] as const; - -export const chatUsageLimitConfig = () => ({ - queryKey: chatUsageLimitConfigKey, - queryFn: () => API.experimental.getChatUsageLimitConfig(), -}); - -export const updateChatUsageLimitConfig = (queryClient: QueryClient) => ({ - mutationFn: (req: TypesGen.ChatUsageLimitConfig) => - API.experimental.updateChatUsageLimitConfig(req), - onSuccess: async () => { - await queryClient.invalidateQueries({ - queryKey: chatUsageLimitConfigKey, - }); - }, -}); - -type UpsertChatUsageLimitOverrideMutationArgs = { - userID: string; - req: TypesGen.UpsertChatUsageLimitOverrideRequest; -}; - -export const upsertChatUsageLimitOverride = (queryClient: QueryClient) => ({ - mutationFn: ({ userID, req }: UpsertChatUsageLimitOverrideMutationArgs) => - API.experimental.upsertChatUsageLimitOverride(userID, req), - onSuccess: async () => { - await queryClient.invalidateQueries({ - queryKey: chatUsageLimitConfigKey, - }); - }, -}); - -export const deleteChatUsageLimitOverride = (queryClient: QueryClient) => ({ - mutationFn: (userID: string) => - API.experimental.deleteChatUsageLimitOverride(userID), - onSuccess: async () => { - await queryClient.invalidateQueries({ - queryKey: chatUsageLimitConfigKey, - }); - }, -}); - -type UpsertChatUsageLimitGroupOverrideMutationArgs = { - groupID: string; - req: TypesGen.UpsertChatUsageLimitGroupOverrideRequest; -}; - -export const upsertChatUsageLimitGroupOverride = ( - queryClient: QueryClient, -) => ({ - mutationFn: ({ - groupID, - req, - }: UpsertChatUsageLimitGroupOverrideMutationArgs) => - API.experimental.upsertChatUsageLimitGroupOverride(groupID, req), - onSuccess: async () => { - await queryClient.invalidateQueries({ - queryKey: chatUsageLimitConfigKey, - }); - }, -}); - -export const deleteChatUsageLimitGroupOverride = ( - queryClient: QueryClient, -) => ({ - mutationFn: (groupID: string) => - API.experimental.deleteChatUsageLimitGroupOverride(groupID), - onSuccess: async () => { - await queryClient.invalidateQueries({ - queryKey: chatUsageLimitConfigKey, - }); - }, -}); - // ── MCP Server Configs ─────────────────────────────────────── export const mcpServerConfigsKey = ["mcp-server-configs"] as const; diff --git a/site/src/pages/AISettingsPage/SpendPage/SpendPage.tsx b/site/src/pages/AISettingsPage/SpendPage/SpendPage.tsx index 19306a7cc98..1acc4dade0f 100644 --- a/site/src/pages/AISettingsPage/SpendPage/SpendPage.tsx +++ b/site/src/pages/AISettingsPage/SpendPage/SpendPage.tsx @@ -1,18 +1,8 @@ import dayjs from "dayjs"; import { type FC, useState } from "react"; -import { useMutation, useQuery, useQueryClient } from "react-query"; +import { useQuery } from "react-query"; import { useSearchParams } from "react-router"; -import { - chatCostSummary, - chatUsageLimitConfig, - deleteChatUsageLimitGroupOverride, - deleteChatUsageLimitOverride, - paginatedChatCostUsers, - updateChatUsageLimitConfig, - upsertChatUsageLimitGroupOverride, - upsertChatUsageLimitOverride, -} from "#/api/queries/chats"; -import { groups } from "#/api/queries/groups"; +import { chatCostSummary, paginatedChatCostUsers } from "#/api/queries/chats"; import { user } from "#/api/queries/users"; import type { ChatCostUserRollup } from "#/api/typesGenerated"; import type { DateRangeValue } from "#/components/DateRangePicker/DateRangePicker"; @@ -25,7 +15,6 @@ import { toExclusiveEndOfDayDateRange } from "./utils/dateRange"; const startDateSearchParam = "startDate"; const endDateSearchParam = "endDate"; -const tabSearchParam = "tab"; const DEFAULT_DATE_RANGE_DAYS = 30; const SEARCH_DEBOUNCE_MS = 300; const USAGE_USERS_PAGE_SIZE = 10; @@ -44,33 +33,10 @@ interface SpendPageProps { const SpendPage: FC = ({ now }) => { const { permissions } = useAuthenticated(); - const queryClient = useQueryClient(); - - const configQuery = useQuery(chatUsageLimitConfig()); - const groupsQuery = useQuery(groups()); - - const updateConfigMutation = useMutation( - updateChatUsageLimitConfig(queryClient), - ); - const upsertOverrideMutation = useMutation( - upsertChatUsageLimitOverride(queryClient), - ); - const deleteOverrideMutation = useMutation( - deleteChatUsageLimitOverride(queryClient), - ); - const upsertGroupOverrideMutation = useMutation( - upsertChatUsageLimitGroupOverride(queryClient), - ); - const deleteGroupOverrideMutation = useMutation( - deleteChatUsageLimitGroupOverride(queryClient), - ); - const [searchParams, setSearchParams] = useSearchParams(); const searchFilter = searchParams.get("search") ?? ""; const debouncedSearch = useDebouncedValue(searchFilter, SEARCH_DEBOUNCE_MS); - const tabParam = searchParams.get(tabSearchParam); - const activeTab = tabParam === "usage" ? "usage" : "limits"; const setSearchFilter = (value: string) => { setSearchParams( @@ -117,21 +83,6 @@ const SpendPage: FC = ({ now }) => { end_date: dateRange.endDate.toISOString(), }; - const onActiveTabChange = (tab: "limits" | "usage") => { - setSearchParams( - (prev) => { - const next = new URLSearchParams(prev); - if (tab === "usage") { - next.set(tabSearchParam, tab); - } else { - next.delete(tabSearchParam); - } - return next; - }, - { replace: true }, - ); - }; - const onDateRangeChange = (value: DateRangeValue) => { const nextDateRange = toExclusiveEndOfDayDateRange(value); @@ -170,51 +121,6 @@ const SpendPage: FC = ({ now }) => { return ( void configQuery.refetch()} - groupsData={groupsQuery.data} - isLoadingGroups={groupsQuery.isLoading} - groupsError={groupsQuery.isError ? groupsQuery.error : null} - onUpdateConfig={(req, options) => { - updateConfigMutation.mutate(req, { - onSuccess: options?.onSuccess, - }); - }} - isUpdatingConfig={updateConfigMutation.isPending} - updateConfigError={ - updateConfigMutation.isError ? updateConfigMutation.error : null - } - resetUpdateConfig={updateConfigMutation.reset} - onUpsertOverride={({ userID, req, onSuccess }) => - upsertOverrideMutation.mutate({ userID, req }, { onSuccess }) - } - isUpsertingOverride={upsertOverrideMutation.isPending} - upsertOverrideError={ - upsertOverrideMutation.isError ? upsertOverrideMutation.error : null - } - onDeleteOverride={deleteOverrideMutation.mutate} - isDeletingOverride={deleteOverrideMutation.isPending} - deleteOverrideError={ - deleteOverrideMutation.isError ? deleteOverrideMutation.error : null - } - onUpsertGroupOverride={({ groupID, req, onSuccess }) => - upsertGroupOverrideMutation.mutate({ groupID, req }, { onSuccess }) - } - isUpsertingGroupOverride={upsertGroupOverrideMutation.isPending} - upsertGroupOverrideError={ - upsertGroupOverrideMutation.isError - ? upsertGroupOverrideMutation.error - : null - } - onDeleteGroupOverride={deleteGroupOverrideMutation.mutate} - isDeletingGroupOverride={deleteGroupOverrideMutation.isPending} - deleteGroupOverrideError={ - deleteGroupOverrideMutation.isError - ? deleteGroupOverrideMutation.error - : null - } dateRange={dateRange} endDateIsExclusive={endDateIsExclusive} onDateRangeChange={onDateRangeChange} @@ -245,8 +151,6 @@ const SpendPage: FC = ({ now }) => { isSummaryLoading={summaryQuery.isLoading} summaryError={summaryQuery.error} onSummaryRetry={() => void summaryQuery.refetch()} - activeTab={activeTab} - onActiveTabChange={onActiveTabChange} /> ); diff --git a/site/src/pages/AISettingsPage/SpendPage/SpendPageView.stories.tsx b/site/src/pages/AISettingsPage/SpendPage/SpendPageView.stories.tsx index 91e63fb29bd..83345076a61 100644 --- a/site/src/pages/AISettingsPage/SpendPage/SpendPageView.stories.tsx +++ b/site/src/pages/AISettingsPage/SpendPage/SpendPageView.stories.tsx @@ -1,5 +1,4 @@ import type { Meta, StoryObj } from "@storybook/react-vite"; -import { useState } from "react"; import { expect, fn, userEvent, within } from "storybook/test"; import type * as TypesGen from "#/api/typesGenerated"; import type { PaginationResult } from "#/components/PaginationWidget/PaginationContainer"; @@ -100,68 +99,6 @@ const mockCostSummary = { ], } as TypesGen.ChatCostSummary; -const mockConfigData = { - spend_limit_micros: 50_000_000, - period: "month", - updated_at: "2026-03-01T00:00:00Z", - unpriced_model_count: 0, - overrides: [ - { - user_id: "user-3", - username: "dave", - name: "Dave Grohl", - avatar_url: "", - spend_limit_micros: 100_000_000, - }, - { - user_id: "user-4", - username: "charlie", - name: "Charlie Chaplin", - avatar_url: "", - spend_limit_micros: 25_000_000, - }, - ], - group_overrides: [ - { - group_id: "group-1", - group_name: "engineering", - group_display_name: "Engineering", - group_avatar_url: "", - member_count: 12, - spend_limit_micros: 75_000_000, - }, - ], -} as TypesGen.ChatUsageLimitConfigResponse; - -const mockGroups = [ - { - id: "group-1", - name: "engineering", - display_name: "Engineering", - organization_id: "org-1", - members: [], - total_member_count: 12, - avatar_url: "", - quota_allowance: 0, - source: "user", - organization_name: "default", - organization_display_name: "Default", - }, - { - id: "group-2", - name: "design", - display_name: "Design", - organization_id: "org-1", - members: [], - total_member_count: 5, - avatar_url: "", - quota_allowance: 0, - source: "user", - organization_name: "default", - organization_display_name: "Default", - }, -] as TypesGen.Group[]; - const defaultDateRange = { startDate: new Date("2026-02-10T00:00:00Z"), endDate: new Date("2026-03-12T00:00:00Z"), @@ -219,22 +156,6 @@ function mockUsersQuery( } const baseProps = { - configData: undefined as TypesGen.ChatUsageLimitConfigResponse | undefined, - isLoadingConfig: false, - configError: null as Error | null, - groupsData: undefined as TypesGen.Group[] | undefined, - isLoadingGroups: false, - groupsError: null as Error | null, - isUpdatingConfig: false, - updateConfigError: null as Error | null, - isUpsertingOverride: false, - upsertOverrideError: null as Error | null, - isDeletingOverride: false, - deleteOverrideError: null as Error | null, - isUpsertingGroupOverride: false, - upsertGroupOverrideError: null as Error | null, - isDeletingGroupOverride: false, - deleteGroupOverrideError: null as Error | null, dateRange: defaultDateRange, endDateIsExclusive: false, searchFilter: "", @@ -254,84 +175,22 @@ const meta = { component: SpendPageView, // TODO: Stories in this file fail when pixel runs their play functions. Fix them and remove the exclude. parameters: { pixel: { exclude: true } }, - render: (args) => { - const [activeTab, setActiveTab] = useState(args.activeTab); - return ( - { - setActiveTab(tab); - args.onActiveTabChange(tab); - }} - /> - ); - }, args: { ...baseProps, - refetchConfig: fn(), - onUpdateConfig: fn(), - resetUpdateConfig: fn(), - onUpsertOverride: fn(), - onDeleteOverride: fn(), - onUpsertGroupOverride: fn(), - onDeleteGroupOverride: fn(), onDateRangeChange: fn(), onSearchFilterChange: fn(), onDrillInUserRetry: fn(), onClearSelectedUser: fn(), onSelectUser: fn(), onSummaryRetry: fn(), - activeTab: "limits", - onActiveTabChange: fn(), }, } satisfies Meta; export default meta; type Story = StoryObj; -export const SpendWithLimitsAndUsers: Story = { - args: { - configData: mockConfigData, - groupsData: mockGroups, - usersQuery: mockUsersQuery({ data: mockUsersResponse }), - }, - play: async ({ canvasElement }) => { - const canvas = within(canvasElement); - - await canvas.findByText("Spend limits and usage"); - await expect( - canvas.getByText( - /Cost controls features will move to AI Governance in v2\.36\./, - ), - ).toBeInTheDocument(); - await expect( - canvas.getByRole("link", { name: /Read more here/ }), - ).toHaveAttribute( - "href", - expect.stringContaining("/ai-coder/ai-gateway/cost-controls"), - ); - await expect( - canvas.getByRole("switch", { name: "Spend limit" }), - ).toBeInTheDocument(); - await expect(canvas.getByText("Group limits")).toBeInTheDocument(); - await expect(canvas.getByText("Usage")).toBeInTheDocument(); - - await userEvent.click(canvas.getByRole("tab", { name: "Usage" })); - - await expect(await canvas.findByText("Alice Liddell")).toBeInTheDocument(); - await expect(canvas.getByText("Bob Builder")).toBeInTheDocument(); - - await expect( - canvas.getByPlaceholderText("Search by name or username"), - ).toBeInTheDocument(); - }, -}; - export const SpendUsersEmpty: Story = { args: { - configData: mockConfigData, - groupsData: mockGroups, usersQuery: mockUsersQuery({ data: { start_date: "2026-02-10T00:00:00Z", @@ -344,8 +203,7 @@ export const SpendUsersEmpty: Story = { play: async ({ canvasElement }) => { const canvas = within(canvasElement); - await canvas.findByText("Spend limits and usage"); - await userEvent.click(canvas.getByRole("tab", { name: "Usage" })); + await canvas.findByText("AI spend usage"); await expect( await canvas.findByText("No usage data for this period."), ).toBeInTheDocument(); @@ -354,8 +212,6 @@ export const SpendUsersEmpty: Story = { export const SpendUserDrillIn: Story = { args: { - configData: mockConfigData, - groupsData: mockGroups, drillInUserId: "user-1", drillInUser: mockUserProfile, summaryData: mockCostSummary, @@ -373,8 +229,6 @@ export const SpendUserDrillIn: Story = { export const SpendUserDrillInAndBack: Story = { args: { - configData: mockConfigData, - groupsData: mockGroups, drillInUserId: "user-1", drillInUser: mockUserProfile, summaryData: mockCostSummary, @@ -392,8 +246,6 @@ export const SpendUserDrillInAndBack: Story = { export const SpendDrillInLoading: Story = { args: { - configData: mockConfigData, - groupsData: mockGroups, drillInUserId: "user-1", drillInUser: null, isDrillInUserLoading: true, @@ -408,8 +260,6 @@ export const SpendDrillInLoading: Story = { export const SpendDrillInError: Story = { args: { - configData: mockConfigData, - groupsData: mockGroups, drillInUserId: "user-1", drillInUser: null, isDrillInUserError: true, @@ -424,8 +274,6 @@ export const SpendDrillInError: Story = { export const SpendRefetchOverlay: Story = { args: { - configData: mockConfigData, - groupsData: mockGroups, usersQuery: mockUsersQuery({ data: mockUsersResponse, isFetching: true, @@ -434,8 +282,6 @@ export const SpendRefetchOverlay: Story = { play: async ({ canvasElement }) => { const canvas = within(canvasElement); - await userEvent.click(canvas.getByRole("tab", { name: "Usage" })); - await canvas.findByText("Alice Liddell"); await expect( @@ -444,43 +290,13 @@ export const SpendRefetchOverlay: Story = { }, }; -export const SpendConfigLoading: Story = { - args: { - isLoadingConfig: true, - }, -}; - -export const SpendConfigError: Story = { - args: { - configError: new Error("Network error: failed to fetch config"), - usersQuery: mockUsersQuery({ data: mockUsersResponse }), - }, - play: async ({ canvasElement }) => { - const canvas = within(canvasElement); - - await canvas.findByText("Network error: failed to fetch config"); - await expect(canvas.getByText("Retry")).toBeInTheDocument(); - - await userEvent.click(canvas.getByRole("tab", { name: "Usage" })); - - await expect(canvas.getByText("Alice Liddell")).toBeInTheDocument(); - await expect(canvas.getByText("Bob Builder")).toBeInTheDocument(); - }, -}; - export const SpendUsersLoading: Story = { args: { - configData: mockConfigData, - groupsData: mockGroups, usersQuery: mockUsersQuery({ isLoading: true }), }, play: async ({ canvasElement }) => { const canvas = within(canvasElement); - await canvas.findByRole("switch", { name: "Spend limit" }); - - await userEvent.click(canvas.getByRole("tab", { name: "Usage" })); - await expect( await canvas.findByRole("status", { name: "Loading usage" }), ).toBeInTheDocument(); @@ -489,8 +305,6 @@ export const SpendUsersLoading: Story = { export const SpendUsersError: Story = { args: { - configData: mockConfigData, - groupsData: mockGroups, usersQuery: mockUsersQuery({ error: new Error("Failed to load usage data"), }), @@ -498,10 +312,6 @@ export const SpendUsersError: Story = { play: async ({ canvasElement }) => { const canvas = within(canvasElement); - await canvas.findByRole("switch", { name: "Spend limit" }); - - await userEvent.click(canvas.getByRole("tab", { name: "Usage" })); - await expect( canvas.getByText("Failed to load usage data"), ).toBeInTheDocument(); @@ -511,15 +321,11 @@ export const SpendUsersError: Story = { export const SpendUserClickToDrillIn: Story = { args: { - configData: mockConfigData, - groupsData: mockGroups, usersQuery: mockUsersQuery({ data: mockUsersResponse }), }, play: async ({ canvasElement, args }) => { const canvas = within(canvasElement); - await userEvent.click(canvas.getByRole("tab", { name: "Usage" })); - const row = await canvas.findByRole("button", { name: /^View details for Alice Liddell/, }); diff --git a/site/src/pages/AISettingsPage/SpendPage/SpendPageView.tsx b/site/src/pages/AISettingsPage/SpendPage/SpendPageView.tsx index 3cf1aec74d3..773af71f2c5 100644 --- a/site/src/pages/AISettingsPage/SpendPage/SpendPageView.tsx +++ b/site/src/pages/AISettingsPage/SpendPage/SpendPageView.tsx @@ -1,80 +1,17 @@ import type { FC } from "react"; -import { getErrorMessage } from "#/api/errors"; import type * as TypesGen from "#/api/typesGenerated"; -import { Alert, AlertDescription } from "#/components/Alert/Alert"; -import { ErrorAlert } from "#/components/Alert/ErrorAlert"; -import { Button } from "#/components/Button/Button"; import type { DateRangeValue } from "#/components/DateRangePicker/DateRangePicker"; -import { Link } from "#/components/Link/Link"; import type { PaginationResult } from "#/components/PaginationWidget/PaginationContainer"; import { SettingsHeader, SettingsHeaderDescription, SettingsHeaderTitle, } from "#/components/SettingsHeader/SettingsHeader"; -import { Spinner } from "#/components/Spinner/Spinner"; -import { - Tabs, - TabsContent, - TabsList, - TabsTrigger, -} from "#/components/Tabs/Tabs"; -import { - TemporarySavedState, - useTemporarySavedState, -} from "#/components/TemporarySavedState/TemporarySavedState"; -import { dollarsToMicros, microsToDollars } from "#/utils/currency"; -import { docs } from "#/utils/docs"; -import { - DefaultLimitController, - type DefaultLimitFormValues, -} from "./components/LimitsTab/DefaultLimitController"; -import { DefaultLimitSection } from "./components/LimitsTab/DefaultLimitSection"; -import { GroupLimitsSection } from "./components/LimitsTab/GroupLimitsSection"; -import { GroupOverrideController } from "./components/LimitsTab/GroupOverrideController"; -import { normalizeChatUsageLimitPeriod } from "./components/LimitsTab/limitsFormLogic"; -import { UserOverrideController } from "./components/LimitsTab/UserOverrideController"; -import { UserOverridesSection } from "./components/LimitsTab/UserOverridesSection"; import { SpendDrillInView } from "./components/SpendDrillInView"; -import { SpendSectionHeader } from "./components/SpendSectionHeader"; import { UsageTab } from "./components/UsageTab/UsageTab"; import { formatUsageDateRange, toInclusiveDateRange } from "./utils/dateRange"; interface SpendPageViewProps { - configData: TypesGen.ChatUsageLimitConfigResponse | undefined; - isLoadingConfig: boolean; - configError: Error | null; - refetchConfig: () => void; - groupsData: TypesGen.Group[] | undefined; - isLoadingGroups: boolean; - groupsError: Error | null; - onUpdateConfig: ( - req: TypesGen.ChatUsageLimitConfig, - options?: { onSuccess?: () => void }, - ) => void; - isUpdatingConfig: boolean; - updateConfigError: Error | null; - resetUpdateConfig: () => void; - onUpsertOverride: (args: { - userID: string; - req: TypesGen.UpsertChatUsageLimitOverrideRequest; - onSuccess: () => void; - }) => void; - isUpsertingOverride: boolean; - upsertOverrideError: Error | null; - onDeleteOverride: (userID: string) => void; - isDeletingOverride: boolean; - deleteOverrideError: Error | null; - onUpsertGroupOverride: (args: { - groupID: string; - req: TypesGen.UpsertChatUsageLimitGroupOverrideRequest; - onSuccess: () => void; - }) => void; - isUpsertingGroupOverride: boolean; - upsertGroupOverrideError: Error | null; - onDeleteGroupOverride: (groupID: string) => void; - isDeletingGroupOverride: boolean; - deleteGroupOverrideError: Error | null; dateRange: DateRangeValue; endDateIsExclusive: boolean; onDateRangeChange: (value: DateRangeValue) => void; @@ -99,34 +36,9 @@ interface SpendPageViewProps { isSummaryLoading: boolean; summaryError: unknown; onSummaryRetry: () => void; - activeTab: "limits" | "usage"; - onActiveTabChange: (tab: "limits" | "usage") => void; } export const SpendPageView: FC = ({ - configData, - isLoadingConfig, - configError, - refetchConfig, - groupsData, - isLoadingGroups, - groupsError, - onUpdateConfig, - isUpdatingConfig, - updateConfigError, - resetUpdateConfig, - onUpsertOverride, - isUpsertingOverride, - upsertOverrideError, - onDeleteOverride, - isDeletingOverride, - deleteOverrideError, - onUpsertGroupOverride, - isUpsertingGroupOverride, - upsertGroupOverrideError, - onDeleteGroupOverride, - isDeletingGroupOverride, - deleteGroupOverrideError, dateRange, endDateIsExclusive, onDateRangeChange, @@ -145,63 +57,12 @@ export const SpendPageView: FC = ({ isSummaryLoading, summaryError, onSummaryRetry, - activeTab, - onActiveTabChange, }) => { - const defaultLimitValues: DefaultLimitFormValues = (() => { - const spendLimitMicros = configData?.spend_limit_micros; - const enabled = spendLimitMicros !== null && spendLimitMicros !== undefined; - - return { - enabled, - period: normalizeChatUsageLimitPeriod(configData?.period), - amountDollars: enabled - ? microsToDollars(spendLimitMicros).toString() - : "", - }; - })(); - const defaultLimitKey = JSON.stringify({ - spend_limit_micros: configData?.spend_limit_micros ?? null, - period: defaultLimitValues.period, - }); - const displayDateRange = toInclusiveDateRange(dateRange, endDateIsExclusive); const dateRangeLabel = formatUsageDateRange(dateRange, { endDateIsExclusive, }); - const handleResetUpdateConfig = () => { - if (!isUpdatingConfig) { - resetUpdateConfig(); - } - }; - - const handleSaveDefault = ({ - enabled, - period, - amountDollars, - }: DefaultLimitFormValues) => { - const spendLimitMicros = enabled ? dollarsToMicros(amountDollars) : null; - onUpdateConfig( - { - spend_limit_micros: spendLimitMicros, - period, - updated_at: new Date().toISOString(), - }, - { onSuccess: showSavedState }, - ); - }; - - const groupOverrides = configData?.group_overrides ?? []; - const overrides = configData?.overrides ?? []; - const unpricedModelCount = configData?.unpriced_model_count ?? 0; - const groupOrganizationNames = - groupsData?.reduce>((acc, group) => { - acc[group.id] = group.organization_name; - return acc; - }, {}) ?? {}; - const { isSavedVisible, showSavedState } = useTemporarySavedState(); - if (drillInUserId) { return ( = ({ /> ); } - return ( - - {(groupCtrl) => ( - - {(userCtrl) => ( -

- - - As of v2.36, AI Governance Cost Control replaces Coder Agents - Cost Control. The limits on this page are no longer enforced - and do not carry over. Recreate each limit as an AI Governance - budget to restore enforcement.{" "} - - Read more here - - - - - - - Spend limits and usage - - - Configure spend limits and monitor AI usage across your - deployment. - - - - { - if (tab === "limits" || tab === "usage") { - onActiveTabChange(tab); - } - }} - > - - Spend limits - Usage - - - -

- {isLoadingConfig ? ( -

- -

- ) : configError ? ( -

- - -

- ) : ( - <> - - {({ - enabled, - onEnabledChange, - period, - onPeriodChange, - amountDollars, - onAmountDollarsChange, - isAmountValid, - isDirty, - saveDefault, - }) => ( - { - handleResetUpdateConfig(); - onEnabledChange(v); - }} - period={period} - onPeriodChange={(v) => { - handleResetUpdateConfig(); - onPeriodChange(v); - }} - amountDollars={amountDollars} - onAmountDollarsChange={(v) => { - handleResetUpdateConfig(); - onAmountDollarsChange(v); - }} - unpricedModelCount={unpricedModelCount} - isSaving={isUpdatingConfig} - isSavedVisible={isSavedVisible} - saveDisabled={ - isUpdatingConfig || !isAmountValid || !isDirty - } - onSave={isDirty ? saveDefault : undefined} - saveStatus={ - isSavedVisible ? ( - - ) : updateConfigError ? ( - getErrorMessage( - updateConfigError, - "Failed to save the default spend limit.", - ) - ) : null - } - /> - )} - -

- - { - userCtrl.handleShowUserFormChange(false); - groupCtrl.handleEditGroupOverride(override); - }} - onAddGroupOverride={ - groupCtrl.handleAddGroupOverride - } - onDeleteGroupOverride={onDeleteGroupOverride} - upsertPending={isUpsertingGroupOverride} - upsertError={upsertGroupOverrideError} - deletePending={isDeletingGroupOverride} - deleteError={deleteGroupOverrideError} - groupsError={groupsError} - /> -

- -

- - { - groupCtrl.handleShowGroupFormChange(false); - userCtrl.handleEditUserOverride(override); - }} - onAddOverride={userCtrl.handleAddOverride} - onDeleteOverride={onDeleteOverride} - upsertPending={isUpsertingOverride} - upsertError={upsertOverrideError} - deletePending={isDeletingOverride} - deleteError={deleteOverrideError} - /> -

- - )} -

- + return ( +

+ + AI spend usage + + Monitor AI usage across your deployment. + + - - { - groupCtrl.handleShowGroupFormChange(false); - userCtrl.handleEditUserOverride(override); - }} - /> - - -

- )} - - )} - + +

); }; diff --git a/site/src/pages/AISettingsPage/SpendPage/components/ChatCostSummaryView.tsx b/site/src/pages/AISettingsPage/SpendPage/components/ChatCostSummaryView.tsx index 4f1e954f550..622cf1eec25 100644 --- a/site/src/pages/AISettingsPage/SpendPage/components/ChatCostSummaryView.tsx +++ b/site/src/pages/AISettingsPage/SpendPage/components/ChatCostSummaryView.tsx @@ -1,5 +1,4 @@ -import dayjs from "dayjs"; -import { InfoIcon, TriangleAlertIcon } from "lucide-react"; +import { TriangleAlertIcon } from "lucide-react"; import { type FC, useState } from "react"; import { getErrorMessage } from "#/api/errors"; import type * as TypesGen from "#/api/typesGenerated"; @@ -32,25 +31,6 @@ interface ChatCostSummaryViewProps { emptyMessage: string; } -export const getUsageLimitPeriodLabel = ( - period: TypesGen.ChatUsageLimitPeriod | undefined, -): string => { - if (!period) { - return ""; - } - - switch (period) { - case "day": - return "Daily"; - case "week": - return "Weekly"; - case "month": - return "Monthly"; - default: - return ""; - } -}; - export const ChatCostSummaryView: FC = ({ summary, isLoading, @@ -110,41 +90,6 @@ export const ChatCostSummaryView: FC = ({ hasNextPage: hasChatNext, } = paginateItems(summary.by_chat, chatPageSize, chatPage); - const usageLimit = summary.usage_limit; - const showUsageLimitCard = usageLimit?.is_limited === true; - const usageLimitCurrentSpend = usageLimit?.current_spend ?? 0; - const usageLimitSpendMicros = usageLimit?.spend_limit_micros ?? 0; - const usageLimitPeriodLabel = usageLimit - ? getUsageLimitPeriodLabel(usageLimit.period) - : ""; - const usageProgressPercentage = - showUsageLimitCard && usageLimitSpendMicros > 0 - ? Math.min((usageLimitCurrentSpend / usageLimitSpendMicros) * 100, 100) - : 0; - const usageProgressBarClass = - usageProgressPercentage > 90 - ? "bg-content-destructive" - : usageProgressPercentage >= 75 - ? "bg-content-warning" - : "bg-content-success"; - const usageLimitExceeded = - showUsageLimitCard && usageLimitCurrentSpend >= usageLimitSpendMicros; - const usageLimitStatusText = usageLimitExceeded - ? "Limit exceeded" - : `${formatCostMicros( - Math.max(usageLimitSpendMicros - usageLimitCurrentSpend, 0), - )} remaining`; - const usageLimitCurrentPeriod = - showUsageLimitCard && usageLimit?.period_start && usageLimit?.period_end - ? `Current period: ${dayjs(usageLimit.period_start).format("MMM D")} to ${dayjs( - usageLimit.period_end, - ).format("MMM D")}` - : ""; - const usageLimitResetAt = - showUsageLimitCard && usageLimit?.period_end - ? dayjs(usageLimit.period_end).format("MMM D, YYYY h:mm A") - : ""; - return (

@@ -201,59 +146,6 @@ export const ChatCostSummaryView: FC = ({

- {showUsageLimitCard && usageLimit && ( -

- {usageLimitPeriodLabel} spend limit -

- {usageLimitCurrentPeriod && ( -

- {usageLimitCurrentPeriod} -

- )} -

- {formatCostMicros(usageLimitCurrentSpend)} /{" "} - {formatCostMicros(usageLimitSpendMicros)} -

- {Math.round(usageProgressPercentage)}% used -

- {usageLimitStatusText} -

- Resets {usageLimitResetAt} -

- )} - {summary.unpriced_messages_having_usage_count > 0 && (

@@ -266,14 +158,6 @@ export const ChatCostSummaryView: FC = ({

)} -

- - - Automatic title generation uses lightweight models and is not counted - towards usage limits. - -

- {summary.by_model.length === 0 && summary.by_chat.length === 0 ? (

{emptyMessage} diff --git a/site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/DefaultLimitController.tsx b/site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/DefaultLimitController.tsx deleted file mode 100644 index 855a25e0dac..00000000000 --- a/site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/DefaultLimitController.tsx +++ /dev/null @@ -1,65 +0,0 @@ -import { type FC, type ReactNode, useState } from "react"; - -import type { ChatUsageLimitPeriod } from "#/api/typesGenerated"; -import { isPositiveFiniteDollarAmount } from "#/utils/currency"; - -export interface DefaultLimitFormValues { - enabled: boolean; - period: ChatUsageLimitPeriod; - amountDollars: string; -} - -interface DefaultLimitControllerProps { - initialValues: DefaultLimitFormValues; - onSave: (values: DefaultLimitFormValues) => void; - children: (props: { - enabled: boolean; - onEnabledChange: (enabled: boolean) => void; - period: ChatUsageLimitPeriod; - onPeriodChange: (period: ChatUsageLimitPeriod) => void; - amountDollars: string; - onAmountDollarsChange: (amount: string) => void; - isAmountValid: boolean; - isDirty: boolean; - saveDefault: () => void; - }) => ReactNode; -} - -export const DefaultLimitController: FC = ({ - initialValues, - onSave, - children, -}) => { - const [enabled, setEnabled] = useState(initialValues.enabled); - const [period, setPeriod] = useState( - initialValues.period, - ); - const [amountDollars, setAmountDollars] = useState( - initialValues.amountDollars, - ); - const isAmountValid = !enabled || isPositiveFiniteDollarAmount(amountDollars); - const isDirty = - enabled !== initialValues.enabled || - period !== initialValues.period || - amountDollars !== initialValues.amountDollars; - - const handleSave = () => { - if (enabled && !isPositiveFiniteDollarAmount(amountDollars)) { - return; - } - - onSave({ enabled, period, amountDollars }); - }; - - return children({ - enabled, - onEnabledChange: setEnabled, - period, - onPeriodChange: setPeriod, - amountDollars, - onAmountDollarsChange: setAmountDollars, - isAmountValid, - isDirty, - saveDefault: handleSave, - }); -}; diff --git a/site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/DefaultLimitSection.tsx b/site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/DefaultLimitSection.tsx deleted file mode 100644 index 3e837469e9d..00000000000 --- a/site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/DefaultLimitSection.tsx +++ /dev/null @@ -1,137 +0,0 @@ -import { TriangleAlertIcon } from "lucide-react"; -import type { FC, ReactNode } from "react"; -import type { ChatUsageLimitPeriod } from "#/api/typesGenerated"; -import { Button } from "#/components/Button/Button"; -import { - InputGroup, - InputGroupAddon, - InputGroupInput, -} from "#/components/InputGroup/InputGroup"; -import { - Select, - SelectContent, - SelectItem, - SelectTrigger, - SelectValue, -} from "#/components/Select/Select"; -import { Spinner } from "#/components/Spinner/Spinner"; -import { Switch } from "#/components/Switch/Switch"; - -interface DefaultLimitSectionProps { - enabled: boolean; - onEnabledChange: (enabled: boolean) => void; - period: ChatUsageLimitPeriod; - onPeriodChange: (period: ChatUsageLimitPeriod) => void; - amountDollars: string; - onAmountDollarsChange: (amount: string) => void; - unpricedModelCount: number; - isSaving?: boolean; - isSavedVisible?: boolean; - saveDisabled?: boolean; - onSave?: () => void; - saveStatus?: ReactNode; -} - -export const DefaultLimitSection: FC = ({ - enabled, - onEnabledChange, - period, - onPeriodChange, - amountDollars, - onAmountDollarsChange, - unpricedModelCount, - isSaving = false, - isSavedVisible = false, - saveDisabled = false, - onSave, - saveStatus, -}) => { - return ( -

- -

- Spend limit -

- Set a deployment-wide spend cap that applies to all users by - default. When disabled, users have unlimited spending. -

- - $ - onAmountDollarsChange(event.target.value)} - placeholder="0.00" - aria-label="Spend limit amount in dollars" - disabled={!enabled} - /> - - -

- {(onSave || isSavedVisible || isSaving) && - (isSavedVisible ? ( - saveStatus - ) : ( - - ))} -

- {saveStatus && !isSavedVisible && ( -

{saveStatus}

- )} -

- - {enabled && unpricedModelCount > 0 && ( -

- -

- {unpricedModelCount === 1 - ? "1 enabled model does not have pricing configured." - : `${unpricedModelCount} enabled models do not have pricing configured.`}{" "} - Usage of unpriced models cannot be tracked against the spend limit. -

- )} -

- ); -}; diff --git a/site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/GroupLimitDialog.tsx b/site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/GroupLimitDialog.tsx deleted file mode 100644 index b3c8e555219..00000000000 --- a/site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/GroupLimitDialog.tsx +++ /dev/null @@ -1,183 +0,0 @@ -import { CheckIcon } from "lucide-react"; -import type { FC } from "react"; -import { getErrorMessage } from "#/api/errors"; -import type { Group } from "#/api/typesGenerated"; -import { Autocomplete } from "#/components/Autocomplete/Autocomplete"; -import { AvatarData } from "#/components/Avatar/AvatarData"; -import { Button } from "#/components/Button/Button"; -import { - Dialog, - DialogContent, - DialogDescription, - DialogFooter, - DialogHeader, - DialogTitle, -} from "#/components/Dialog/Dialog"; -import { Input } from "#/components/Input/Input"; -import { Label } from "#/components/Label/Label"; -import { Spinner } from "#/components/Spinner/Spinner"; -import { getGroupSubtitle } from "#/modules/groups"; -import { isPositiveFiniteDollarAmount } from "#/utils/currency"; -import type { GroupLimitOverrideGroup } from "./GroupLimitsSection"; - -interface GroupLimitDialogProps { - open: boolean; - onOpenChange: (open: boolean) => void; - selectedGroup: Group | null; - onSelectedGroupChange: (group: Group | null) => void; - groupAmount: string; - onGroupAmountChange: (amount: string) => void; - availableGroups: Group[]; - groupAutocompleteNoOptionsText: string; - groupsLoading: boolean; - editingGroupOverride: GroupLimitOverrideGroup | null; - upsertPending: boolean; - upsertError: Error | null; - onSave: () => void; - groupAutocompleteId: string; - groupAmountId: string; -} - -export const GroupLimitDialog: FC = ({ - open, - onOpenChange, - selectedGroup, - onSelectedGroupChange, - groupAmount, - onGroupAmountChange, - availableGroups, - groupAutocompleteNoOptionsText, - groupsLoading, - editingGroupOverride, - upsertPending, - upsertError, - onSave, - groupAutocompleteId, - groupAmountId, -}) => { - const isEditing = editingGroupOverride !== null; - const saveDisabled = isEditing - ? upsertPending || !isPositiveFiniteDollarAmount(groupAmount) - : upsertPending || - selectedGroup === null || - !isPositiveFiniteDollarAmount(groupAmount); - - return ( - - ); -}; diff --git a/site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/GroupLimitsSection.stories.tsx b/site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/GroupLimitsSection.stories.tsx deleted file mode 100644 index eb1963020ac..00000000000 --- a/site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/GroupLimitsSection.stories.tsx +++ /dev/null @@ -1,182 +0,0 @@ -import type { Meta, StoryObj } from "@storybook/react-vite"; -import { expect, fn, userEvent, waitFor, within } from "storybook/test"; -import type { Group } from "#/api/typesGenerated"; -import { GroupLimitsSection } from "./GroupLimitsSection"; - -const mockGroupOverrides = [ - { - group_id: "group-1", - group_display_name: "Engineering", - group_name: "engineering", - group_avatar_url: "", - member_count: 15, - spend_limit_micros: 10_000_000, - }, - { - group_id: "group-2", - group_display_name: "Design", - group_name: "design", - group_avatar_url: "", - member_count: 8, - spend_limit_micros: 5_000_000, - }, - { - group_id: "group-4", - group_display_name: "Support", - group_name: "support", - group_avatar_url: "", - member_count: 11, - spend_limit_micros: null, - }, -]; - -const mockAvailableGroups: Group[] = [ - { - id: "group-3", - name: "marketing", - display_name: "Marketing", - avatar_url: "", - organization_id: "org-1", - organization_name: "Acme", - organization_display_name: "Acme", - members: [], - quota_allowance: 0, - source: "user", - total_member_count: 5, - }, - { - id: "group-5", - name: "sales", - display_name: "Sales", - avatar_url: "", - organization_id: "org-1", - organization_name: "Acme", - organization_display_name: "Acme", - members: [], - quota_allowance: 0, - source: "user", - total_member_count: 12, - }, -]; - -const editingGroupOverride = { - group_id: mockGroupOverrides[0].group_id, - group_display_name: mockGroupOverrides[0].group_display_name, - group_name: mockGroupOverrides[0].group_name, - group_avatar_url: mockGroupOverrides[0].group_avatar_url, - member_count: mockGroupOverrides[0].member_count, -}; - -const meta: Meta = { - title: "pages/AISettingsPage/SpendPage/LimitsTab/GroupLimitsSection", - component: GroupLimitsSection, - args: { - groupOverrides: mockGroupOverrides, - groupOrganizationNames: { - "group-1": "Acme", - "group-2": "Acme", - }, - showGroupForm: false, - onShowGroupFormChange: fn(), - selectedGroup: null, - onSelectedGroupChange: fn(), - groupAmount: "", - onGroupAmountChange: fn(), - availableGroups: [], - groupAutocompleteNoOptionsText: "No groups available", - groupsLoading: false, - editingGroupOverride: null, - onEditGroupOverride: fn(), - onAddGroupOverride: fn(), - onDeleteGroupOverride: fn(), - upsertPending: false, - upsertError: null, - deletePending: false, - deleteError: null, - groupsError: null, - }, -}; - -export default meta; -type Story = StoryObj; - -export const Default: Story = {}; - -export const EmptyState: Story = { - args: { - groupOverrides: [], - }, -}; - -export const AddForm: Story = { - args: { - showGroupForm: true, - availableGroups: mockAvailableGroups, - }, -}; - -export const EditForm: Story = { - args: { - showGroupForm: true, - editingGroupOverride, - groupAmount: "10.00", - }, - play: async ({ canvasElement }) => { - const body = within(canvasElement.ownerDocument.body); - // Update budget button confirms edit mode is active. - await expect( - body.getByRole("button", { name: /update budget/i }), - ).toBeInTheDocument(); - // The editing group name appears in both the table row and the - // read-only edit form identity, confirming it was populated. - const nameElements = body.getAllByText( - editingGroupOverride.group_display_name, - ); - expect(nameElements.length).toBeGreaterThanOrEqual(2); - }, -}; - -export const DeleteGroupOverride: Story = { - play: async ({ canvasElement }) => { - const body = within(canvasElement.ownerDocument.body); - - const actionButtons = await body.findAllByRole("button", { - name: /actions for/i, - }); - await userEvent.click(actionButtons[0]); - await userEvent.click( - await body.findByRole("menuitem", { name: /remove group limit/i }), - ); - - // The confirmation dialog should appear. - const dialog = await body.findByRole("dialog"); - await expect(dialog).toBeInTheDocument(); - await expect( - body.getByText(/Are you sure you want to delete this group override/i), - ).toBeInTheDocument(); - }, -}; - -export const DeleteGroupOverrideCancelled: Story = { - play: async ({ canvasElement, args }) => { - const body = within(canvasElement.ownerDocument.body); - - const actionButtons = await body.findAllByRole("button", { - name: /actions for/i, - }); - await userEvent.click(actionButtons[0]); - await userEvent.click( - await body.findByRole("menuitem", { name: /remove group limit/i }), - ); - - // Cancel the dialog. - await body.findByRole("dialog"); - await userEvent.click(body.getByRole("button", { name: "Cancel" })); - - // The dialog should be closed and the callback should not have been called. - await waitFor(() => { - expect(body.queryByRole("dialog")).not.toBeInTheDocument(); - }); - expect(args.onDeleteGroupOverride).not.toHaveBeenCalled(); - }, -}; diff --git a/site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/GroupLimitsSection.tsx b/site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/GroupLimitsSection.tsx deleted file mode 100644 index b0914b6e6bf..00000000000 --- a/site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/GroupLimitsSection.tsx +++ /dev/null @@ -1,189 +0,0 @@ -import { PlusIcon } from "lucide-react"; -import { type FC, useId, useState } from "react"; -import { getErrorMessage } from "#/api/errors"; -import type { ChatUsageLimitGroupOverride, Group } from "#/api/typesGenerated"; -import { Button } from "#/components/Button/Button"; -import { ConfirmDeleteDialog } from "#/components/Dialogs/ConfirmDeleteDialog/ConfirmDeleteDialog"; -import { SearchField } from "#/components/SearchField/SearchField"; -import { paginateItems } from "#/utils/paginateItems"; -import { SpendSectionHeader } from "../SpendSectionHeader"; -import { GroupLimitDialog } from "./GroupLimitDialog"; -import { GROUP_LIMITS_PAGE_SIZE, GroupLimitsTable } from "./GroupLimitsTable"; - -export interface GroupLimitOverrideGroup { - group_id: string; - group_display_name: string; - group_name: string; - group_avatar_url: string; - member_count: number; -} - -export type GroupLimitOverride = ChatUsageLimitGroupOverride; - -interface GroupLimitsSectionProps { - hideHeader?: boolean; - groupOverrides: readonly GroupLimitOverride[]; - groupOrganizationNames?: Record; - showGroupForm: boolean; - onShowGroupFormChange: (show: boolean) => void; - selectedGroup: Group | null; - onSelectedGroupChange: (group: Group | null) => void; - groupAmount: string; - onGroupAmountChange: (amount: string) => void; - availableGroups: Group[]; - groupAutocompleteNoOptionsText: string; - groupsLoading: boolean; - editingGroupOverride: GroupLimitOverrideGroup | null; - onEditGroupOverride: (override: GroupLimitOverride) => void; - onAddGroupOverride: () => void; - onDeleteGroupOverride: (groupID: string) => void; - upsertPending: boolean; - upsertError: Error | null; - deletePending: boolean; - deleteError: Error | null; - groupsError: Error | null; -} - -export const GroupLimitsSection: FC = ({ - hideHeader, - groupOverrides, - groupOrganizationNames, - showGroupForm, - onShowGroupFormChange, - selectedGroup, - onSelectedGroupChange, - groupAmount, - onGroupAmountChange, - availableGroups, - groupAutocompleteNoOptionsText, - groupsLoading, - editingGroupOverride, - onEditGroupOverride, - onAddGroupOverride, - onDeleteGroupOverride, - upsertPending, - upsertError, - deletePending, - deleteError, - groupsError, -}) => { - const groupAutocompleteId = useId(); - const groupAmountId = useId(); - const isEditing = editingGroupOverride !== null; - const [pendingDeleteGroupId, setPendingDeleteGroupId] = useState< - string | null - >(null); - const [page, setPage] = useState(1); - const [searchQuery, setSearchQuery] = useState(""); - const normalizedSearchQuery = searchQuery.trim().toLowerCase(); - const filteredGroupOverrides = normalizedSearchQuery - ? groupOverrides.filter((override) => - [override.group_display_name, override.group_name].some((value) => - value.toLowerCase().includes(normalizedSearchQuery), - ), - ) - : groupOverrides; - const { pagedItems, clampedPage, hasPreviousPage, hasNextPage } = - paginateItems(filteredGroupOverrides, GROUP_LIMITS_PAGE_SIZE, page); - - return ( -

- {!hideHeader && ( - - )} -

- { - setSearchQuery(value); - setPage(1); - }} - placeholder="Search groups..." - aria-label="Search group limits" - className="w-full sm:max-w-md" - /> - -

- - - - {deleteError && ( -

- {getErrorMessage(deleteError, "Failed to delete group override.")} -

- )} - - - {groupsError && ( -

- {getErrorMessage(groupsError, "Failed to load groups.")} -

- )} -

- {pendingDeleteGroupId && ( - { - void onDeleteGroupOverride(pendingDeleteGroupId); - setPendingDeleteGroupId(null); - }} - isPending={deletePending} - open - onOpenChange={(open) => !open && setPendingDeleteGroupId(null)} - /> - )} -

- ); -}; diff --git a/site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/GroupLimitsTable.tsx b/site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/GroupLimitsTable.tsx deleted file mode 100644 index 56ff6084346..00000000000 --- a/site/src/pages/AISettingsPage/SpendPage/components/LimitsTab/GroupLimitsTable.tsx +++ /dev/null @@ -1,167 +0,0 @@ -import { EllipsisVerticalIcon, TrashIcon } from "lucide-react"; -import type { FC } from "react"; -import { Link } from "react-router"; -import { AvatarData } from "#/components/Avatar/AvatarData"; -import { Button } from "#/components/Button/Button"; -import { - DropdownMenu, - DropdownMenuContent, - DropdownMenuItem, - DropdownMenuTrigger, -} from "#/components/DropdownMenu/DropdownMenu"; -import { PaginationAmount } from "#/components/PaginationWidget/PaginationAmount"; -import { PaginationWidgetBase } from "#/components/PaginationWidget/PaginationWidgetBase"; -import { - Table, - TableBody, - TableCell, - TableHead, - TableHeader, - TableRow, -} from "#/components/Table/Table"; -import { formatCostMicros } from "#/utils/currency"; -import type { GroupLimitOverride } from "./GroupLimitsSection"; - -export const GROUP_LIMITS_PAGE_SIZE = 10; - -interface GroupLimitsTableProps { - pagedOverrides: readonly GroupLimitOverride[]; - totalOverrides: number; - clampedPage: number; - hasPreviousPage: boolean; - hasNextPage: boolean; - onPageChange: (page: number) => void; - onEditGroupOverride: (override: GroupLimitOverride) => void; - onRequestDelete: (groupID: string) => void; - groupOrganizationNames?: Record; - deletePending: boolean; - upsertPending: boolean; - isEditing: boolean; - emptyMessage: string; -} - -export const GroupLimitsTable: FC = ({ - pagedOverrides, - totalOverrides, - clampedPage, - hasPreviousPage, - hasNextPage, - onPageChange, - onEditGroupOverride, - onRequestDelete, - groupOrganizationNames, - deletePending, - upsertPending, - isEditing, - emptyMessage, -}) => { - if (totalOverrides === 0) { - return ( -

- {emptyMessage} -

- ); - } - - return ( - <> -

@@ -146,7 +127,6 @@ export const UsageTab: FC = ({ Output Cache Read Cache Write - Actions @@ -155,18 +135,6 @@ export const UsageTab: FC = ({ key={user.user_id} user={user} onSelect={onSelectUser} - onEditBudget={(selectedUser) => { - const override = overrides.find( - (o) => o.user_id === selectedUser.user_id, - ) ?? { - user_id: selectedUser.user_id, - name: selectedUser.name, - username: selectedUser.username, - avatar_url: selectedUser.avatar_url, - spend_limit_micros: null, - }; - onEditBudget(override); - }} /> ))} @@ -183,8 +151,7 @@ export const UsageTab: FC = ({ const UserRow: FC<{ user: TypesGen.ChatCostUserRollup; onSelect: (user: TypesGen.ChatCostUserRollup) => void; - onEditBudget: (user: TypesGen.ChatCostUserRollup) => void; -}> = ({ user, onSelect, onEditBudget }) => { +}> = ({ user, onSelect }) => { const clickableRowProps = useClickableTableRow({ onClick: () => onSelect(user), }); @@ -237,28 +204,6 @@ const UserRow: FC<{ {formatTokenCount(user.total_cache_creation_tokens)} - event.stopPropagation()}> - - - - - - onEditBudget(user)}> - Update budget - - onSelect(user)}> - View spend details - - - - ); }; diff --git a/site/src/pages/AgentsPage/AgentsPageLayout.stories.tsx b/site/src/pages/AgentsPage/AgentsPageLayout.stories.tsx index b95f88258cd..8bb6602fff9 100644 --- a/site/src/pages/AgentsPage/AgentsPageLayout.stories.tsx +++ b/site/src/pages/AgentsPage/AgentsPageLayout.stories.tsx @@ -500,14 +500,6 @@ const meta: Meta = { retention_days: 30, }); spyOn(API.experimental, "updateChatRetentionDays").mockResolvedValue(); - spyOn(API.experimental, "getChatUsageLimitConfig").mockResolvedValue({ - spend_limit_micros: null, - period: "month", - updated_at: "2026-02-18T00:00:00.000Z", - unpriced_model_count: 0, - overrides: [], - group_overrides: [], - }); spyOn(API, "getGroups").mockResolvedValue([]); spyOn(API.experimental, "getChatCostUsers").mockResolvedValue({ start_date: "2026-02-10T00:00:00Z", diff --git a/site/src/pages/AgentsPage/components/AgentCreateForm.stories.tsx b/site/src/pages/AgentsPage/components/AgentCreateForm.stories.tsx index 5e72778eb50..e38c344494d 100644 --- a/site/src/pages/AgentsPage/components/AgentCreateForm.stories.tsx +++ b/site/src/pages/AgentsPage/components/AgentCreateForm.stories.tsx @@ -814,6 +814,15 @@ export const UsageLimitExceeded: Story = { }, ), }, + play: async ({ canvasElement }) => { + const canvas = within(canvasElement); + await expect( + canvas.getByText(/^You've used \$0\.90 of your \$0\.50 limit\./), + ).toBeVisible(); + await expect( + canvas.queryByRole("link", { name: /view usage/i }), + ).not.toBeInTheDocument(); + }, }; export const ForbiddenErrorWithRole: Story = { diff --git a/site/src/pages/AgentsPage/components/AgentCreateForm.tsx b/site/src/pages/AgentsPage/components/AgentCreateForm.tsx index 358a1d70b3c..0a494c01dcf 100644 --- a/site/src/pages/AgentsPage/components/AgentCreateForm.tsx +++ b/site/src/pages/AgentsPage/components/AgentCreateForm.tsx @@ -1,6 +1,5 @@ import { type FC, useEffect, useEffectEvent, useRef, useState } from "react"; import { useQuery } from "react-query"; -import { Link } from "react-router"; import { toast } from "sonner"; import { isApiError } from "#/api/errors"; import { permittedOrganizations } from "#/api/queries/organizations"; @@ -8,7 +7,6 @@ import type * as TypesGen from "#/api/typesGenerated"; import type { AgentChatSendShortcut } from "#/api/typesGenerated"; import { Alert, AlertDescription } from "#/components/Alert/Alert"; import { ErrorAlert } from "#/components/Alert/ErrorAlert"; -import { Button } from "#/components/Button/Button"; import { ConfirmDialog } from "#/components/Dialogs/ConfirmDialog/ConfirmDialog"; import { useDashboard } from "#/modules/dashboard/useDashboard"; import { docs } from "#/utils/docs"; @@ -515,14 +513,7 @@ export const AgentCreateForm: FC = ({ isApiError(createError) && createError.response?.status === 409 && isChatUsageLimitExceededResponse(createError.response.data) ? ( - - View usage - - } - > + {formatUsageLimitMessage(createError.response.data)} diff --git a/site/src/pages/AgentsPage/components/ChatConversation/LiveStreamTail.stories.tsx b/site/src/pages/AgentsPage/components/ChatConversation/LiveStreamTail.stories.tsx index 0cf96976d4a..748f650fb91 100644 --- a/site/src/pages/AgentsPage/components/ChatConversation/LiveStreamTail.stories.tsx +++ b/site/src/pages/AgentsPage/components/ChatConversation/LiveStreamTail.stories.tsx @@ -40,7 +40,6 @@ export const EmptyConversationPrompt: Story = { }, }; -/** Usage-limit failures replace the idle prompt with the analytics CTA. */ export const UsageLimitExceeded: Story = { args: { ...defaultArgs, @@ -55,17 +54,12 @@ export const UsageLimitExceeded: Story = { play: async ({ canvasElement }) => { const canvas = within(canvasElement); expect(canvas.getByText(/spend limit/i)).toBeVisible(); - const link = canvas.getByRole("link", { name: /view usage/i }); - expect(link).toBeVisible(); - expect(link).toHaveAttribute("href", "/agents/analytics"); + expect( + canvas.queryByRole("link", { name: /view usage/i }), + ).not.toBeInTheDocument(); }, }; -/** - * Provider quota errors use the standard ChatStatusCallout instead of the - * "View usage" CTA (which links to Coder's analytics, not the provider's - * billing page). - */ export const ProviderQuotaExceeded: Story = { args: { ...defaultArgs, @@ -87,7 +81,6 @@ export const ProviderQuotaExceeded: Story = { expect( canvas.queryByRole("link", { name: /view usage/i }), ).not.toBeInTheDocument(); - // Should render ChatStatusCallout instead. expect( canvas.getByRole("heading", { name: /usage limit reached/i }), ).toBeVisible(); diff --git a/site/src/pages/AgentsPage/components/ChatConversation/LiveStreamTail.tsx b/site/src/pages/AgentsPage/components/ChatConversation/LiveStreamTail.tsx index b4b732a21b9..48efbbd58ee 100644 --- a/site/src/pages/AgentsPage/components/ChatConversation/LiveStreamTail.tsx +++ b/site/src/pages/AgentsPage/components/ChatConversation/LiveStreamTail.tsx @@ -1,8 +1,6 @@ -import { Link } from "react-router"; import type { UrlTransform } from "streamdown"; import type * as TypesGen from "#/api/typesGenerated"; import { Alert, AlertDescription } from "#/components/Alert/Alert"; -import { Button } from "#/components/Button/Button"; import type { ChatDetailError } from "../../utils/usageLimitMessage"; import type { SubagentVariant } from "../ChatElements/tools/subagentDescriptor"; import { ChatStatusCallout } from "./ChatStatusCallout"; @@ -94,14 +92,7 @@ export const LiveStreamTailContent = ({ /> )} {usageLimitStatus && !usageLimitStatus.provider ? ( - - View usage - - } - > + {usageLimitStatus.message} ) : terminalStatus ? ( diff --git a/site/src/pages/AgentsPage/components/UsageIndicator.stories.tsx b/site/src/pages/AgentsPage/components/UsageIndicator.stories.tsx index 1d177bfbb27..09a671e0641 100644 --- a/site/src/pages/AgentsPage/components/UsageIndicator.stories.tsx +++ b/site/src/pages/AgentsPage/components/UsageIndicator.stories.tsx @@ -1,12 +1,12 @@ import type { Decorator, Meta, StoryObj } from "@storybook/react-vite"; import type { FC } from "react"; import { useQueryClient } from "react-query"; -import { expect, userEvent, within } from "storybook/test"; -import { chatUsageLimitStatusKey } from "#/api/queries/chats"; +import { expect, userEvent, waitFor, within } from "storybook/test"; +import { meAISpendKey } from "#/api/queries/users"; import { getWorkspaceQuotaQueryKey } from "#/api/queries/workspaceQuota"; import { workspacesKey } from "#/api/queries/workspaces"; import type { - ChatUsageLimitStatus, + UserAISpendStatus, WorkspaceQuota, WorkspacesResponse, } from "#/api/typesGenerated"; @@ -21,9 +21,9 @@ import { } from "#/testHelpers/storybook"; import { UsageIndicator } from "./UsageIndicator"; -const withUsageLimitStatus = (status: ChatUsageLimitStatus) => (Story: FC) => { +const withAISpend = (status: UserAISpendStatus) => (Story: FC) => { const queryClient = useQueryClient(); - queryClient.setQueryData(chatUsageLimitStatusKey, status); + queryClient.setQueryData(meAISpendKey, status); return ; }; @@ -79,22 +79,23 @@ const openUsageMenu = async (canvasElement: HTMLElement) => { await userEvent.click(canvas.getByRole("button")); }; -const limitedUsageStatus = ( - overrides: Partial = {}, -): ChatUsageLimitStatus => ({ - is_limited: true, - period: "month", - spend_limit_micros: 50_000_000, - current_spend: 12_500_000, - period_start: "2026-02-10T00:00:00Z", - period_end: "2026-03-12T00:00:00Z", +const aiSpendStatus = ( + overrides: Partial = {}, +): UserAISpendStatus => ({ + user_id: MockUserOwner.id, + effective_group_id: "group-1", + effective_budget: { spend_limit_micros: 50_000_000, limit_source: "group" }, + current_spend_micros: 12_500_000, + period_start: "2026-07-01T00:00:00Z", + period_end: "2026-08-01T00:00:00Z", ...overrides, }); -const unlimitedUsageStatus = { - is_limited: false, - current_spend: 0, -} satisfies ChatUsageLimitStatus; +const noBudgetStatus = aiSpendStatus({ + effective_group_id: null, + effective_budget: null, + current_spend_micros: 0, +}); const userWorkspacesRequest = { q: `owner:me organization:${MockDefaultOrganization.name}`, @@ -120,6 +121,7 @@ const meta: Meta = { parameters: { user: MockUserOwner, permissions: MockPermissions, + features: ["aibridge"], }, }; @@ -128,18 +130,20 @@ type Story = StoryObj; export const LowUsage: Story = { decorators: [ - withUsageLimitStatus(limitedUsageStatus()), + withAISpend(aiSpendStatus()), withWorkspaceQuota(noWorkspaceQuota), ], }; export const MediumUsage: Story = { decorators: [ - withUsageLimitStatus( - limitedUsageStatus({ - period: "week", - spend_limit_micros: 20_000_000, - current_spend: 16_000_000, + withAISpend( + aiSpendStatus({ + effective_budget: { + spend_limit_micros: 20_000_000, + limit_source: "group", + }, + current_spend_micros: 16_000_000, }), ), withWorkspaceQuota(noWorkspaceQuota), @@ -148,11 +152,13 @@ export const MediumUsage: Story = { export const HighUsage: Story = { decorators: [ - withUsageLimitStatus( - limitedUsageStatus({ - period: "day", - spend_limit_micros: 10_000_000, - current_spend: 9_500_000, + withAISpend( + aiSpendStatus({ + effective_budget: { + spend_limit_micros: 10_000_000, + limit_source: "group", + }, + current_spend_micros: 9_500_000, }), ), withWorkspaceQuota(noWorkspaceQuota), @@ -161,10 +167,13 @@ export const HighUsage: Story = { export const LimitExceeded: Story = { decorators: [ - withUsageLimitStatus( - limitedUsageStatus({ - spend_limit_micros: 30_000_000, - current_spend: 32_000_000, + withAISpend( + aiSpendStatus({ + effective_budget: { + spend_limit_micros: 30_000_000, + limit_source: "group", + }, + current_spend_micros: 32_000_000, }), ), withWorkspaceQuota(noWorkspaceQuota), @@ -173,7 +182,7 @@ export const LimitExceeded: Story = { export const WorkspaceQuotaOnly: Story = { decorators: [ - withUsageLimitStatus(unlimitedUsageStatus), + withAISpend(noBudgetStatus), withWorkspaceQuota(defaultWorkspaceQuota), withWorkspaceCount(3), ], @@ -189,7 +198,7 @@ export const WorkspaceQuotaOnly: Story = { export const UsageAndWorkspaceQuota: Story = { decorators: [ - withUsageLimitStatus(limitedUsageStatus()), + withAISpend(aiSpendStatus()), withWorkspaceQuota(defaultWorkspaceQuota), withWorkspaceCount(3), ], @@ -199,18 +208,23 @@ export const UsageAndWorkspaceQuota: Story = { expect(canvas.getByRole("button", { name: "Usage" })).toBeVisible(); expect(progressBars.map((bar) => bar.getAttribute("aria-label"))).toEqual([ - "Monthly spend usage", + "AI spend usage", "Workspace quota usage", ]); await openUsageMenu(canvasElement); + const menu = within(await within(document.body).findByRole("menu")); + await waitFor(() => { + expect(menu.getByText("$12.50 of $50.00 used")).toBeVisible(); + expect(menu.getByText("July 1 - August 1, 2026")).toBeVisible(); + }); }, }; export const TriggerTiny: Story = { decorators: [ withUsageIndicatorFrame("w-[240px]", "usage-indicator-frame"), - withUsageLimitStatus(limitedUsageStatus()), + withAISpend(aiSpendStatus()), withWorkspaceQuota(defaultWorkspaceQuota), withWorkspaceCount(3), ], @@ -218,7 +232,7 @@ export const TriggerTiny: Story = { export const WorkspaceQuotaUnused: Story = { decorators: [ - withUsageLimitStatus(unlimitedUsageStatus), + withAISpend(noBudgetStatus), withWorkspaceQuota({ credits_consumed: 0, budget: 100, @@ -233,7 +247,7 @@ export const WorkspaceQuotaUnused: Story = { export const WorkspaceQuotaWithoutBudget: Story = { decorators: [ - withUsageLimitStatus(unlimitedUsageStatus), + withAISpend(noBudgetStatus), withWorkspaceQuota({ credits_consumed: 20, budget: 0, @@ -258,7 +272,7 @@ export const WorkspaceQuotaWithoutBudget: Story = { export const WorkspaceQuotaExceeded: Story = { decorators: [ - withUsageLimitStatus(unlimitedUsageStatus), + withAISpend(noBudgetStatus), withWorkspaceQuota({ credits_consumed: 125, budget: 100, @@ -272,7 +286,7 @@ export const WorkspaceQuotaExceeded: Story = { export const WorkspaceQuotaWithoutWorkspaceCount: Story = { decorators: [ - withUsageLimitStatus(unlimitedUsageStatus), + withAISpend(noBudgetStatus), withWorkspaceQuota(defaultWorkspaceQuota), withUnavailableWorkspaceCount, ], @@ -283,7 +297,45 @@ export const WorkspaceQuotaWithoutWorkspaceCount: Story = { export const NotLimited: Story = { decorators: [ - withUsageLimitStatus(unlimitedUsageStatus), + withAISpend(noBudgetStatus), withWorkspaceQuota(noWorkspaceQuota), ], }; + +export const ZeroBudget: Story = { + decorators: [ + withAISpend( + aiSpendStatus({ + effective_budget: { spend_limit_micros: 0, limit_source: "group" }, + current_spend_micros: 0, + }), + ), + withWorkspaceQuota(noWorkspaceQuota), + ], + play: async ({ canvasElement }) => { + const canvas = within(canvasElement); + const trigger = await canvas.findByRole("button"); + await userEvent.click(trigger); + const body = within(canvasElement.ownerDocument.body); + await body.findByText(/limit exceeded/); + }, +}; + +export const GatewayUnavailable: Story = { + parameters: { features: [], experiments: [] }, + decorators: [ + withAISpend(aiSpendStatus()), + withWorkspaceQuota(defaultWorkspaceQuota), + withWorkspaceCount(3), + ], + play: async ({ canvasElement }) => { + await openUsageMenu(canvasElement); + const progressBars = within(canvasElement.ownerDocument.body).getAllByRole( + "progressbar", + ); + + expect(progressBars.map((bar) => bar.getAttribute("aria-label"))).toEqual([ + "Workspace quota usage", + ]); + }, +}; diff --git a/site/src/pages/AgentsPage/components/UsageIndicator.tsx b/site/src/pages/AgentsPage/components/UsageIndicator.tsx index 3e582864daf..872e20b76a1 100644 --- a/site/src/pages/AgentsPage/components/UsageIndicator.tsx +++ b/site/src/pages/AgentsPage/components/UsageIndicator.tsx @@ -1,15 +1,12 @@ -import dayjs from "dayjs"; import { CoinsIcon, InfoIcon, ServerIcon } from "lucide-react"; import { type FC, Fragment, type ReactNode } from "react"; import { useQuery } from "react-query"; -import { Link } from "react-router"; -import { chatUsageLimitStatus } from "#/api/queries/chats"; +import { meAISpend } from "#/api/queries/users"; import { workspaceQuota } from "#/api/queries/workspaceQuota"; import { workspaces } from "#/api/queries/workspaces"; import { DropdownMenu, DropdownMenuContent, - DropdownMenuItem, DropdownMenuSeparator, DropdownMenuTrigger, } from "#/components/DropdownMenu/DropdownMenu"; @@ -25,9 +22,10 @@ import { getDefaultOrganizationName, useDashboard, } from "#/modules/dashboard/useDashboard"; -import { getUsageLimitPeriodLabel } from "#/pages/AISettingsPage/SpendPage/components/ChatCostSummaryView"; +import { useFeatureVisibility } from "#/modules/dashboard/useFeatureVisibility"; import { clampPercentage, + formatSpendPeriodLabel, getSeverity, type UsageSeverity, usageProgressPercentage, @@ -52,11 +50,13 @@ type UsageSectionData = { const numberFormatter = new Intl.NumberFormat("en-US"); export const UsageIndicator: FC = () => { - const { data: chatUsage, isError: isChatUsageError } = useQuery( - chatUsageLimitStatus(), - ); const { user } = useAuthenticated(); const { organizations } = useDashboard(); + const aiSpendAvailable = Boolean(useFeatureVisibility().aibridge); + const { data: aiSpend, isError: isAISpendError } = useQuery({ + ...meAISpend(), + enabled: aiSpendAvailable, + }); const organizationName = getDefaultOrganizationName(organizations); const username = user.username; const { data: quota, isError: isQuotaError } = useQuery({ @@ -75,18 +75,26 @@ export const UsageIndicator: FC = () => { }); const sections: UsageSectionData[] = []; - if (!isChatUsageError && chatUsage?.is_limited) { - const spendLimit = chatUsage.spend_limit_micros ?? 0; - const currentSpend = chatUsage.current_spend; - const periodLabel = getUsageLimitPeriodLabel(chatUsage.period); - const exceeded = spendLimit > 0 && currentSpend >= spendLimit; + if ( + aiSpendAvailable && + !isAISpendError && + aiSpend && + aiSpend.effective_budget !== null + ) { + const spendLimit = aiSpend.effective_budget.spend_limit_micros; + const currentSpend = aiSpend.current_spend_micros; + // The gateway blocks once spend >= limit, so a zero budget is + // always exhausted. + const exceeded = currentSpend >= spendLimit; sections.push({ - id: "ai-usage", - title: `${periodLabel} usage`, - progressLabel: `${periodLabel} spend usage`, - percent: usageProgressPercentage(currentSpend, spendLimit), - severity: getSeverity(currentSpend, spendLimit), + id: "ai-spend", + title: "AI spend", + progressLabel: "AI spend usage", + percent: exceeded + ? 100 + : usageProgressPercentage(currentSpend, spendLimit), + severity: exceeded ? "exceeded" : getSeverity(currentSpend, spendLimit), icon: , hoverLabel: `Spend ${formatCostMicros(currentSpend)}`, detail: ( @@ -100,9 +108,10 @@ export const UsageIndicator: FC = () => { )} ), - secondaryDetail: chatUsage.period_end - ? `Resets ${dayjs(chatUsage.period_end).format("MMM D, YYYY")}` - : undefined, + secondaryDetail: formatSpendPeriodLabel( + aiSpend.period_start, + aiSpend.period_end, + ), }); } @@ -167,12 +176,6 @@ const UsageMenu: FC<{ sections: readonly UsageSectionData[] }> = ({ ))} - - - - - View usage - ); diff --git a/site/src/pages/GroupsPage/AIBudgetPeriod.tsx b/site/src/pages/GroupsPage/AIBudgetPeriod.tsx index b716da63136..3ab592efa35 100644 --- a/site/src/pages/GroupsPage/AIBudgetPeriod.tsx +++ b/site/src/pages/GroupsPage/AIBudgetPeriod.tsx @@ -1,8 +1,8 @@ -import dayjs from "dayjs"; import type { FC } from "react"; import { useQuery } from "react-query"; import { meAISpend } from "#/api/queries/users"; import { useFeatureVisibility } from "#/modules/dashboard/useFeatureVisibility"; +import { formatSpendPeriodLabel } from "#/utils/budget"; /** The current AI budget window, e.g. "June 1 - July 1, 2026". */ export const AIBudgetPeriod: FC = () => { @@ -13,12 +13,10 @@ export const AIBudgetPeriod: FC = () => { return null; } - // Local time and raw exclusive period_end, matching the spend page. - const start = dayjs(aiSpend.period_start).format("MMMM D"); - const end = dayjs(aiSpend.period_end).format("MMMM D, YYYY"); return ( - AI budget period: {start} - {end} + AI budget period:{" "} + {formatSpendPeriodLabel(aiSpend.period_start, aiSpend.period_end)} ); }; diff --git a/site/src/pages/GroupsPage/GroupPage.stories.tsx b/site/src/pages/GroupsPage/GroupPage.stories.tsx index e51514515b5..3556d507d75 100644 --- a/site/src/pages/GroupsPage/GroupPage.stories.tsx +++ b/site/src/pages/GroupsPage/GroupPage.stories.tsx @@ -348,9 +348,8 @@ export const WithMemberAIBudget: Story = { const canvas = within(canvasElement); await expect(await canvas.findByText("AI budget")).toBeInTheDocument(); await expect(await canvas.findByText("Budget group")).toBeInTheDocument(); - // Dates depend on the runner's timezone; match loosely. await expect( - await canvas.findByText(/^AI budget period: \w+ \d+ - \w+ \d+, 2026$/), + await canvas.findByText("AI budget period: June 1 - July 1, 2026"), ).toBeInTheDocument(); await expect( diff --git a/site/src/utils/budget.test.ts b/site/src/utils/budget.test.ts index 7ee182c8fa8..a475eaa6159 100644 --- a/site/src/utils/budget.test.ts +++ b/site/src/utils/budget.test.ts @@ -1,10 +1,25 @@ import { describe, expect, it } from "vitest"; import { clampPercentage, + formatSpendPeriodLabel, getSeverity, usageProgressPercentage, } from "./budget"; +describe("formatSpendPeriodLabel", () => { + it("renders API timestamps in UTC with the year on the exclusive end", () => { + expect( + formatSpendPeriodLabel("2026-06-01T00:00:00Z", "2026-07-01T00:00:00Z"), + ).toBe("June 1 - July 1, 2026"); + }); + + it("uses the end year when the window crosses into the next year", () => { + expect( + formatSpendPeriodLabel("2026-12-01T00:00:00Z", "2027-01-01T00:00:00Z"), + ).toBe("December 1 - January 1, 2027"); + }); +}); + describe("getSeverity", () => { it("returns normal below the warning threshold", () => { expect(getSeverity(0, 50)).toBe("normal"); diff --git a/site/src/utils/budget.ts b/site/src/utils/budget.ts index 6b14b76970f..78d537a2445 100644 --- a/site/src/utils/budget.ts +++ b/site/src/utils/budget.ts @@ -1,5 +1,23 @@ +import dayjs from "dayjs"; +import utc from "dayjs/plugin/utc"; + +dayjs.extend(utc); + export type UsageSeverity = "normal" | "warning" | "exceeded"; +/** + * Formats an AI budget window in UTC, e.g. "June 1 - July 1, 2026". Renders + * the exclusive period_end as-is. + */ +export function formatSpendPeriodLabel( + periodStart: string, + periodEnd: string, +): string { + const start = dayjs.utc(periodStart).format("MMMM D"); + const end = dayjs.utc(periodEnd).format("MMMM D, YYYY"); + return `${start} - ${end}`; +} + /** * Classifies usage against a budget. Returns "warning" once usage reaches 85% * of the budget and "exceeded" once it meets or passes the budget. A budget of From a300a06a0da0dced695ef8df8404c7c4dffd337e Mon Sep 17 00:00:00 2001 From: Michael Suchacz <203725896+ibetitsmike@users.noreply.github.com> Date: Tue, 4 Aug 2026 12:11:09 +0200 Subject: [PATCH 31/69] fix: correct native usage-limit docs and spend UI details for 2.36 (#27827) Follow-up to #27825. Native chat usage-limit enforcement was already removed from `release/2.36` by #27599 (`checkUsageLimit` is a no-op), but the docs added in #27825 claimed stored native values are still enforced per message with a 409 response. This corrects the docs and folds in small spend UI fixes found during UAT. ## Docs - State that native limits are no longer configurable or enforced as of release 2.36, stored values are inert and not migrated, and AI Gateway budgets are the only enforcement mechanism (`usage-insights.md`, `platform-controls/index.md`, `cost-controls.md`). - Restore the warning that spend limits previously configured under Admin settings > AI > Spend are no longer enforced. - Drop the migration bullet claiming users can be subject to both native limits and budgets. - Restore the note that automatic title generation is not included in usage reporting. ## Frontend - Render the group members page AI spend reset date in UTC via a shared `formatSpendResetLabel` helper, matching the budget period formatting elsewhere. Non-UTC viewers previously saw two different dates for one period. - Pin a non-UTC timezone in `budget.test.ts` so CI fails if formatting falls back to local time (verified red under the old implementation). - Restore the title-generation note on the cost summary, reworded for usage reporting. > Mux prepared this PR on Mike's behalf. --- .../agents/platform-controls/index.md | 9 ++++---- .../platform-controls/usage-insights.md | 23 ++++++++++--------- docs/ai-coder/ai-gateway/cost-controls.md | 13 +++++++---- .../components/ChatCostSummaryView.tsx | 10 +++++++- .../src/pages/GroupsPage/GroupMembersPage.tsx | 6 ++--- site/src/utils/budget.test.ts | 11 +++++++++ site/src/utils/budget.ts | 8 +++++++ 7 files changed, 55 insertions(+), 25 deletions(-) diff --git a/docs/ai-coder/agents/platform-controls/index.md b/docs/ai-coder/agents/platform-controls/index.md index 53bc04d0a4d..2465624963e 100644 --- a/docs/ai-coder/agents/platform-controls/index.md +++ b/docs/ai-coder/agents/platform-controls/index.md @@ -116,10 +116,11 @@ none, if the template does not define any). ### Spend management -The Spend page provides usage-only reporting for Coder Agents chats. The native -usage-limit configuration UI has been removed from release 2.36, but values -configured before upgrading remain stored and enforced. Existing native values -are not migrated to AI Gateway budgets. +The Spend page provides usage-only reporting for Coder Agents chats. As of +release 2.36, native chat usage limits are no longer configurable or enforced. +Values configured before upgrading remain stored, have no effect, and are not +migrated to AI Gateway budgets. AI Gateway budgets are the only way to limit +spend. Configure new AI Gateway budgets from group settings or through the generated group budget API. See [Spend Management](./usage-insights.md) for details. diff --git a/docs/ai-coder/agents/platform-controls/usage-insights.md b/docs/ai-coder/agents/platform-controls/usage-insights.md index 3ffca0273ec..a8549e144c6 100644 --- a/docs/ai-coder/agents/platform-controls/usage-insights.md +++ b/docs/ai-coder/agents/platform-controls/usage-insights.md @@ -1,20 +1,17 @@ # Spend Management -Coder provides usage reporting for Coder Agents and two independent ways to -limit spend on release 2.36: existing native chat usage limits and AI Gateway -budgets. +Coder provides usage reporting for Coder Agents and enforces spend through AI +Gateway budgets on release 2.36. ## Native chat usage limits -The native usage-limit configuration UI has been removed from release 2.36. -Values configured before upgrading remain stored and enforced. Coder checks the -user's current spend before processing each chat message and returns a **409 -Conflict** response when the applicable limit is reached. +As of release 2.36, native chat usage limits are no longer configurable or +enforced. Coder does not check previously configured values when processing +chat messages. Values configured before upgrading remain stored, have no +effect, and are not migrated to AI Gateway budgets. -Existing native values are not migrated to AI Gateway budgets. To change spend -controls after upgrading, configure new AI Gateway budgets. Native limits remain -in effect until they are changed through the existing experimental API or -removed in a later release. +To limit spend, configure AI Gateway budgets. They are the only enforcement +mechanism. ## AI Gateway budgets @@ -49,3 +46,7 @@ for each user. It supports date range filtering, search, and pagination. Select a user to view summary cards and per-model and per-chat breakdowns. The Spend page does not configure native usage limits or AI Gateway budgets. + +> [!NOTE] +> Automatic title generation uses lightweight models. Its token usage is not +> included in usage reporting. diff --git a/docs/ai-coder/ai-gateway/cost-controls.md b/docs/ai-coder/ai-gateway/cost-controls.md index e6bec820274..6b8b81be116 100644 --- a/docs/ai-coder/ai-gateway/cost-controls.md +++ b/docs/ai-coder/ai-gateway/cost-controls.md @@ -270,10 +270,15 @@ see [Prometheus metrics](../../admin/integrations/prometheus.md). ## Migrate from Coder Agents Cost Control -In release 2.36, the native Coder Agents usage-limit configuration UI is no -longer available. Existing native values remain stored and enforced, and are not +In release 2.36, native Coder Agents usage limits are no longer configurable +or enforced. Existing native values remain stored, have no effect, and are not migrated to AI Gateway budgets. +> [!WARNING] +> Spend limits previously configured under **Admin settings** > **AI** > +> **Spend** are no longer enforced by Coder Agents. To enforce spend, set an +> AI Gateway budget. + Configure new AI Gateway budgets from the group settings page or use the API to [get](../../reference/api/enterprise.md#get-group-ai-budget), [upsert](../../reference/api/enterprise.md#upsert-group-ai-budget), or @@ -282,14 +287,12 @@ budget. Expect the following differences: -- Native limits and AI Gateway budgets are independent. A user can be subject to - both until native limits are removed in a later release. - AI Gateway has no deployment-wide default budget. Each group that needs a limit requires its own budget. - The UTC calendar month is the only budget period. Daily and weekly periods are not currently supported. - Users in several budgeted groups receive the highest budget by default. Native - Coder Agents usage limits apply the lowest group limit. + Coder Agents usage limits applied the lowest group limit. - Budgets cover priced AI Gateway traffic. Chat, IDE extensions, and CLI agents draw on the same budget when their provider and model are priced. See [How spend is estimated](#how-spend-is-estimated). diff --git a/site/src/pages/AISettingsPage/SpendPage/components/ChatCostSummaryView.tsx b/site/src/pages/AISettingsPage/SpendPage/components/ChatCostSummaryView.tsx index 622cf1eec25..bc1e60ecf0b 100644 --- a/site/src/pages/AISettingsPage/SpendPage/components/ChatCostSummaryView.tsx +++ b/site/src/pages/AISettingsPage/SpendPage/components/ChatCostSummaryView.tsx @@ -1,4 +1,4 @@ -import { TriangleAlertIcon } from "lucide-react"; +import { InfoIcon, TriangleAlertIcon } from "lucide-react"; import { type FC, useState } from "react"; import { getErrorMessage } from "#/api/errors"; import type * as TypesGen from "#/api/typesGenerated"; @@ -158,6 +158,14 @@ export const ChatCostSummaryView: FC = ({ )} +

+ + + Automatic title generation uses lightweight models and is not included + in usage reporting. + +

+ {summary.by_model.length === 0 && summary.by_chat.length === 0 ? (

{emptyMessage} diff --git a/site/src/pages/GroupsPage/GroupMembersPage.tsx b/site/src/pages/GroupsPage/GroupMembersPage.tsx index fa8c1d7808b..36ae58b6e86 100644 --- a/site/src/pages/GroupsPage/GroupMembersPage.tsx +++ b/site/src/pages/GroupsPage/GroupMembersPage.tsx @@ -1,4 +1,3 @@ -import dayjs from "dayjs"; import { EllipsisVerticalIcon, UserPlusIcon } from "lucide-react"; import { type FC, useEffect, useState } from "react"; import { useMutation, useQuery, useQueryClient } from "react-query"; @@ -50,6 +49,7 @@ import { import { useAuthenticated } from "#/hooks/useAuthenticated"; import { useFeatureVisibility } from "#/modules/dashboard/useFeatureVisibility"; import { isEveryoneGroup } from "#/modules/groups"; +import { formatSpendResetLabel } from "#/utils/budget"; import { cn } from "#/utils/cn"; import { formatBudgetUSD } from "#/utils/currency"; import { SpendEstimateDocsLink } from "./AICostControl"; @@ -114,9 +114,7 @@ const GroupMembersPage: FC = () => { ); const aiBudgetNote = [ "Estimated monthly AI spend for this user.", - // Spend resets at period_end, rendered in the viewer's local time. - aiSpend && - `Resets ${dayjs(aiSpend.period_end).format("MMM D, YYYY h:mm A")}.`, + aiSpend && `Resets ${formatSpendResetLabel(aiSpend.period_end)}.`, // A $0 default still shows: it means no spending allowance. groupBudget && `The group's default limit is ${formatBudgetUSD(groupBudget.spend_limit_micros)} per member.`, diff --git a/site/src/utils/budget.test.ts b/site/src/utils/budget.test.ts index a475eaa6159..923cd15448c 100644 --- a/site/src/utils/budget.test.ts +++ b/site/src/utils/budget.test.ts @@ -2,10 +2,15 @@ import { describe, expect, it } from "vitest"; import { clampPercentage, formatSpendPeriodLabel, + formatSpendResetLabel, getSeverity, usageProgressPercentage, } from "./budget"; +// Pin a non-UTC zone so the UTC assertions fail if formatting falls back +// to local time. Under UTC runners both implementations agree. +process.env.TZ = "America/Los_Angeles"; + describe("formatSpendPeriodLabel", () => { it("renders API timestamps in UTC with the year on the exclusive end", () => { expect( @@ -20,6 +25,12 @@ describe("formatSpendPeriodLabel", () => { }); }); +describe("formatSpendResetLabel", () => { + it("renders the exclusive period_end in UTC", () => { + expect(formatSpendResetLabel("2026-08-01T00:00:00Z")).toBe("Aug 1, 2026"); + }); +}); + describe("getSeverity", () => { it("returns normal below the warning threshold", () => { expect(getSeverity(0, 50)).toBe("normal"); diff --git a/site/src/utils/budget.ts b/site/src/utils/budget.ts index 78d537a2445..e3fbff4af7a 100644 --- a/site/src/utils/budget.ts +++ b/site/src/utils/budget.ts @@ -18,6 +18,14 @@ export function formatSpendPeriodLabel( return `${start} - ${end}`; } +/** + * Formats an AI budget window's exclusive period_end in UTC, e.g. + * "Aug 1, 2026", matching formatSpendPeriodLabel's convention. + */ +export function formatSpendResetLabel(periodEnd: string): string { + return dayjs.utc(periodEnd).format("MMM D, YYYY"); +} + /** * Classifies usage against a budget. Returns "warning" once usage reaches 85% * of the budget and "exceeded" once it meets or passes the budget. A budget of From a7f2917cd8cffb8cb5dde824dce006dc34783a07 Mon Sep 17 00:00:00 2001 From: Marcin Tojek Date: Tue, 11 Aug 2026 10:05:33 +0200 Subject: [PATCH 32/69] docs(docs/install/releases): backport release calendar to release/2.36 (#28011) Backport the current release calendar from `main` to `release/2.36` so the versioned `v2.36` docs page shows the correct schedule instead of the stale one frozen when the branch was cut. _Opened as a draft by Coder Agents on behalf of @mtojek._ --- docs/install/releases/index.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/install/releases/index.md b/docs/install/releases/index.md index d89a7d4f190..e3d41a67f63 100644 --- a/docs/install/releases/index.md +++ b/docs/install/releases/index.md @@ -80,13 +80,13 @@ pages. | Release name | Release Date | Status | Latest Release | |--------------------------------------------------|-------------------|--------------------------|------------------------------------------------------------------| | [2.29](https://coder.com/changelog/coder-2-29) | December 02, 2025 | Extended Support Release | [v2.29.19](https://github.com/coder/coder/releases/tag/v2.29.19) | -| [2.30](https://coder.com/changelog/coder-2-30) | February 03, 2026 | Not Supported | [v2.30.9](https://github.com/coder/coder/releases/tag/v2.30.9) | | [2.31](https://coder.com/changelog/coder-2-31) | February 23, 2026 | Not Supported | [v2.31.14](https://github.com/coder/coder/releases/tag/v2.31.14) | | [2.32](https://coder.com/changelog/coder-2-32) | April 14, 2026 | Not Supported | [v2.32.10](https://github.com/coder/coder/releases/tag/v2.32.10) | -| [2.33](https://coder.com/changelog/coder-2-33) | May 05, 2026 | Security Support | [v2.33.11](https://github.com/coder/coder/releases/tag/v2.33.11) | -| [2.34](https://coder.com/changelog/coder-2-34) | June 02, 2026 | Stable (ESR) | [v2.34.6](https://github.com/coder/coder/releases/tag/v2.34.6) | -| [2.35](https://coder.com/changelog/coder-2-35-1) | July 07, 2026 | Mainline | [v2.35.2](https://github.com/coder/coder/releases/tag/v2.35.2) | -| 2.36 | | Not Released | N/A | +| [2.33](https://coder.com/changelog/coder-2-33) | May 05, 2026 | Not Supported | [v2.33.11](https://github.com/coder/coder/releases/tag/v2.33.11) | +| [2.34](https://coder.com/changelog/coder-2-34) | June 02, 2026 | Security Support | [v2.34.8](https://github.com/coder/coder/releases/tag/v2.34.8) | +| [2.35](https://coder.com/changelog/coder-2-35-1) | July 07, 2026 | Stable | [v2.35.4](https://github.com/coder/coder/releases/tag/v2.35.4) | +| [2.36](https://coder.com/changelog/coder-2-36) | August 04, 2026 | Mainline | [v2.36.0](https://github.com/coder/coder/releases/tag/v2.36.0) | +| 2.37 | | Not Released | N/A | > [!TIP] From eca838de839f7f5394136b2d62dc3f2652cdfed2 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 14 Aug 2026 12:50:38 -0400 Subject: [PATCH 33/69] docs: fix P2/P3 typos and syntax errors from drift sweep (#28101) (#28156) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Backport of https://github.com/coder/coder/pull/28101 Original PR: #28101 — docs: fix P2/P3 typos and syntax errors from drift sweep Merge commit: 1d189cc204f935cac6ce16de162fd7b897652452 Requested by: @nickvigilante Co-authored-by: Nick Vigilante --- docs/about/contributing/modules.md | 2 +- docs/admin/networking/port-forwarding.md | 2 +- docs/admin/templates/extending-templates/variables.md | 2 +- docs/admin/users/idp-sync.md | 4 ++-- docs/ai-coder/tasks-migration.md | 6 +++--- docs/user-guides/workspace-access/index.md | 2 +- 6 files changed, 9 insertions(+), 9 deletions(-) diff --git a/docs/about/contributing/modules.md b/docs/about/contributing/modules.md index 4c91a04da12..d04616d02ed 100644 --- a/docs/about/contributing/modules.md +++ b/docs/about/contributing/modules.md @@ -342,7 +342,7 @@ Use the version bump script to update versions: ```sh git add . - git commit -m "feat(git-clone):add git-clone module" + git commit -m "feat(git-clone): add git-clone module" ``` 4. **Open a pull request**: diff --git a/docs/admin/networking/port-forwarding.md b/docs/admin/networking/port-forwarding.md index a20439b1e46..5c7d5204d71 100644 --- a/docs/admin/networking/port-forwarding.md +++ b/docs/admin/networking/port-forwarding.md @@ -78,7 +78,7 @@ where each segment of hostnames must not exceed 63 characters. If your app name, agent name, workspace name and username exceed 63 characters in the hostname, port forwarding via the dashboard will not work. -### From an coder_app resource +### From a coder_app resource One way to port forward is to configure a `coder_app` resource in the workspace's template. This approach shows a visual application icon in the diff --git a/docs/admin/templates/extending-templates/variables.md b/docs/admin/templates/extending-templates/variables.md index 4fa89d40aeb..13a9793279e 100644 --- a/docs/admin/templates/extending-templates/variables.md +++ b/docs/admin/templates/extending-templates/variables.md @@ -51,7 +51,7 @@ and predictability. If you encounter a situation where you need to override template settings for variables, you can employ a straightforward solution: -1. Create a `terraform.tfvars` file in in the template directory: +1. Create a `terraform.tfvars` file in the template directory: ```tf coder_image = newimage:tag diff --git a/docs/admin/users/idp-sync.md b/docs/admin/users/idp-sync.md index a5fe3da3169..5f653ad95f6 100644 --- a/docs/admin/users/idp-sync.md +++ b/docs/admin/users/idp-sync.md @@ -241,7 +241,7 @@ role sync at the organization level. 1. Confirm you have the [Coder CLI](../../install/index.md) installed and are logged in with a user who is an Owner or has an Organization Admin role. -1. To fetch the current group sync settings for an organization, run the +1. To fetch the current role sync settings for an organization, run the following: ```sh @@ -388,7 +388,7 @@ settings, a user's memberships will update when they log out and log back in. "cbdcf774-4123-4118-8cd9-b3f502c84dfb" ], "sales": [ - "d79144d9-b30a-555a-9af8-7dac83b2q4ec", + "d79144d9-b30a-555a-9af8-7dac83b2q4ec" ] }, "organization_assign_default": true diff --git a/docs/ai-coder/tasks-migration.md b/docs/ai-coder/tasks-migration.md index 7fe2a01e266..e279317fe25 100644 --- a/docs/ai-coder/tasks-migration.md +++ b/docs/ai-coder/tasks-migration.md @@ -76,7 +76,7 @@ Below is a minimal illustrative example of a Coder Tasks template pre-2.28.0. terraform { required_providers { coder = { - source = "coder/coder + source = "coder/coder" } } } @@ -132,8 +132,8 @@ Example (**not** a full template): terraform { required_providers { coder = { - source = "coder/coder - version = ">= 2.13.0 + source = "coder/coder" + version = ">= 2.13.0" } } } diff --git a/docs/user-guides/workspace-access/index.md b/docs/user-guides/workspace-access/index.md index 722094ce2f6..b7dcd27081e 100644 --- a/docs/user-guides/workspace-access/index.md +++ b/docs/user-guides/workspace-access/index.md @@ -26,7 +26,7 @@ customization options, keyboard shortcuts, and troubleshooting guides. ## SSH -### Through with the CLI +### Through the CLI Coder will use the optimal path for an SSH connection (determined by your deployment's [networking configuration](../../admin/infrastructure/index.md)) From 81f0dce9097869dd1e150d134e86f4e87bd28bb6 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 14 Aug 2026 12:52:56 -0400 Subject: [PATCH 34/69] docs: correct broken CLI commands and flags from drift sweep (#28098) (#28165) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Backport of https://github.com/coder/coder/pull/28098 Original PR: #28098 — docs: correct broken CLI commands and flags from drift sweep Merge commit: 58de9ab8f87e7fede0a2d83afa2644bd56a16422 Requested by: @nickvigilante Co-authored-by: Nick Vigilante --- docs/admin/infrastructure/scale-utility.md | 2 +- docs/admin/integrations/dx-data-cloud.md | 5 +++-- docs/admin/users/index.md | 5 +++-- docs/ai-coder/github-to-tasks.md | 5 +---- docs/user-guides/workspace-access/index.md | 2 +- 5 files changed, 9 insertions(+), 10 deletions(-) diff --git a/docs/admin/infrastructure/scale-utility.md b/docs/admin/infrastructure/scale-utility.md index 5da9b0f0b13..075b199f1ab 100644 --- a/docs/admin/infrastructure/scale-utility.md +++ b/docs/admin/infrastructure/scale-utility.md @@ -130,7 +130,7 @@ wish to clean up all workspaces, you can run the following command: ```sh coder exp scaletest cleanup \ --cleanup-job-timeout 2h \ - --cleanup-timeout 15min + --cleanup-timeout 15m ``` This will delete all workspaces and users with the prefix `scaletest-`. diff --git a/docs/admin/integrations/dx-data-cloud.md b/docs/admin/integrations/dx-data-cloud.md index ee4f486a6ca..0f602ea5568 100644 --- a/docs/admin/integrations/dx-data-cloud.md +++ b/docs/admin/integrations/dx-data-cloud.md @@ -30,10 +30,11 @@ If your organization already uses the Coder-DX integration, you can find a list ### CLI -Use `users list` to export the list of users to a CSV file: +Use `users list` with `jq` to export the list of users to a CSV file: ```sh -coder users list > users.csv +coder users list --output json | \ + jq -r '["username","email","created_at","status"], (.[] | [.username, .email, .created_at, .status]) | @csv' > users.csv ``` Visit the [users list](../../reference/cli/users_list.md) documentation for more options. diff --git a/docs/admin/users/index.md b/docs/admin/users/index.md index 0a38fa8710a..a5bd35a0586 100644 --- a/docs/admin/users/index.md +++ b/docs/admin/users/index.md @@ -230,10 +230,11 @@ You can use the Coder CLI or API to retrieve your list of users. ### CLI -Use `users list` to export the list of users to a CSV file: +Use `users list` with `jq` to export the list of users to a CSV file: ```sh -coder users list > users.csv +coder users list --output json | \ + jq -r '["username","email","created_at","status"], (.[] | [.username, .email, .created_at, .status]) | @csv' > users.csv ``` Visit the [users list](../../reference/cli/users_list.md) documentation for more options. diff --git a/docs/ai-coder/github-to-tasks.md b/docs/ai-coder/github-to-tasks.md index f75dbe85030..a3462596b3f 100644 --- a/docs/ai-coder/github-to-tasks.md +++ b/docs/ai-coder/github-to-tasks.md @@ -99,9 +99,6 @@ You must also set `coder-template-name` as part of this. The GHA example has thi ```sh # List all templates in your organization coder templates list - -# List templates in a specific organization -coder templates list --org your-org-name ``` You can also choose to modify the other [input parameters](https://github.com/coder/create-task-action?tab=readme-ov-file#inputs) to better fit your desired workflow. @@ -229,7 +226,7 @@ Generate a new token with these permissions at `https:///deploym **Solution:** -1. Verify the template name using: `coder templates list --org your-org-name` +1. Verify the template name using: `coder templates list` 1. Update the `coder-template-name` input in your workflow file to match exactly, or input secret or variable saved in GitHub 1. Ensure the template exists in the organization specified by `coder-organization` diff --git a/docs/user-guides/workspace-access/index.md b/docs/user-guides/workspace-access/index.md index b7dcd27081e..e6a437035a7 100644 --- a/docs/user-guides/workspace-access/index.md +++ b/docs/user-guides/workspace-access/index.md @@ -228,7 +228,7 @@ services or preview environments. You can also [share ports](./port-forwarding.md#sharing-ports) with other users, or [port-forward](./port-forwarding.md#the-coder-port-forward-command) through -the CLI with `coder port forward`. Read more in the +the CLI with `coder port-forward`. Read more in the [docs on workspace ports](./port-forwarding.md). ![Open Ports window](../../images/networking/listeningports.png) From 2d47088b30a5190feeca985b39a1c5770c98a8c0 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 14 Aug 2026 12:54:36 -0400 Subject: [PATCH 35/69] docs: fix prometheus metric name and slack webhook backtick (#28085) (#28161) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Backport of https://github.com/coder/coder/pull/28085 Original PR: #28085 — docs: fix prometheus metric name and slack webhook backtick Merge commit: 3145cc8386f9b3a6d2e43a78556a1717e2869f79 Requested by: @nickvigilante Co-authored-by: Nick Vigilante --- docs/admin/integrations/prometheus.md | 2 +- docs/admin/monitoring/notifications/slack.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/admin/integrations/prometheus.md b/docs/admin/integrations/prometheus.md index 9364583cbe8..6c409ef04b2 100644 --- a/docs/admin/integrations/prometheus.md +++ b/docs/admin/integrations/prometheus.md @@ -358,7 +358,7 @@ The following metrics support native histograms: * `coderd_workspace_creation_duration_seconds` * `coderd_prebuilt_workspace_claim_duration_seconds` -* `coderd_template_coderd_template_workspace_build_duration_seconds` +* `coderd_template_workspace_build_duration_seconds` Native histograms are an **experimental** Prometheus feature that removes the need to predefine bucket boundaries and allows higher-resolution buckets that adapt to deployment characteristics. Whether a metric is exposed as classic or native depends entirely on the Prometheus server configuration (see [Prometheus docs](https://prometheus.io/docs/specs/native_histograms/) for details): diff --git a/docs/admin/monitoring/notifications/slack.md b/docs/admin/monitoring/notifications/slack.md index 7509c1fbad2..4d6330b66f8 100644 --- a/docs/admin/monitoring/notifications/slack.md +++ b/docs/admin/monitoring/notifications/slack.md @@ -196,7 +196,7 @@ To enable webhook integration in Coder, define the POST webhook endpoint matching the deployed Slack bot: ```sh -export CODER_NOTIFICATIONS_WEBHOOK_ENDPOINT=http://localhost:6000/v1/webhook` +export CODER_NOTIFICATIONS_WEBHOOK_ENDPOINT=http://localhost:6000/v1/webhook ``` Finally, go to the **Notification Settings** in Coder and switch the notifier to From 73d95e9f4ea22b85fcd3107168eaf1f4da223e7d Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 14 Aug 2026 12:55:51 -0400 Subject: [PATCH 36/69] docs: remove invalid `--yes` flag from `coder template version promote` (#28084) (#28158) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Backport of https://github.com/coder/coder/pull/28084 Original PR: #28084 — docs: remove invalid `--yes` flag from `coder template version promote` Merge commit: f3fd4c4a77f2bd15624310c49d0bcd1e6fad8ed6 Requested by: @nickvigilante Co-authored-by: Nick Vigilante --- docs/tutorials/testing-templates.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/tutorials/testing-templates.md b/docs/tutorials/testing-templates.md index 00e5b29e94e..b18214b1ba0 100644 --- a/docs/tutorials/testing-templates.md +++ b/docs/tutorials/testing-templates.md @@ -131,5 +131,5 @@ jobs: - name: Promote template version if: success() run: | - coder template version promote --template=$TEMPLATE_NAME --template-version=${{ steps.name.outputs.version_name }} --yes + coder template version promote --template=$TEMPLATE_NAME --template-version=${{ steps.name.outputs.version_name }} ``` From e499c18437f6b0ad3f6a6b58f2e2b7ede02de632 Mon Sep 17 00:00:00 2001 From: Cian Johnston Date: Mon, 17 Aug 2026 08:22:24 +0100 Subject: [PATCH 37/69] chore: ship prices for all AI Governance proivder types (#28102) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Includes the two below commits: - **chore: update model prices to include more providers (#27837)** - **chore: add more known model prices to ChatModelAdminPanel (#27839)** Note that this also requires db88ec3 (#27836) and 5efa7ab (#27923) ℹ️ Note for reviewers: this PR may look horrible, but most of it is just JSON. You don't have to review that. --------- Co-authored-by: Susana Ferreira --- .gitattributes | 4 + coderd/aibridge/prices/data/prices.json | 6718 ++++++++++++++++- scripts/aibridgepricesgen/curation.json | 209 +- scripts/aibridgepricesgen/main.go | 11 +- scripts/aibridgepricesgen/overrides.jq | 15 + .../knownModels/index.test.ts | 2 +- .../knownModels/knownModelsGenerated.json | 595 +- 7 files changed, 7398 insertions(+), 156 deletions(-) diff --git a/.gitattributes b/.gitattributes index 39e1717ed68..58a1bceb877 100644 --- a/.gitattributes +++ b/.gitattributes @@ -36,3 +36,7 @@ site/e2e/provisionerGenerated.ts linguist-generated=true site/src/api/countriesGenerated.tsx linguist-generated=true site/src/api/rbacresourcesGenerated.tsx linguist-generated=true site/src/api/typesGenerated.ts linguist-generated=true + +# AI Gateway prices +coderd/aibridge/prices/data/prices.json linguist-generated=true +site/src/pages/AgentsPage/components/ChatModelAdminPanel/knownModels/knownModelsGenerated.json linguist-generated=true diff --git a/coderd/aibridge/prices/data/prices.json b/coderd/aibridge/prices/data/prices.json index d6aabb9abfb..7570561b618 100644 --- a/coderd/aibridge/prices/data/prices.json +++ b/coderd/aibridge/prices/data/prices.json @@ -128,23 +128,199 @@ "cache_write_price": 2500000 }, { - "provider": "openai", - "model": "gpt-3.5-turbo", + "provider": "azure", + "model": "claude-fable-5", + "input_price": 10000000, + "output_price": 50000000, + "cache_read_price": 1000000, + "cache_write_price": 12500000 + }, + { + "provider": "azure", + "model": "claude-haiku-4-5", + "input_price": 1000000, + "output_price": 5000000, + "cache_read_price": 100000, + "cache_write_price": 1250000 + }, + { + "provider": "azure", + "model": "claude-opus-4-1", + "input_price": 15000000, + "output_price": 75000000, + "cache_read_price": 1500000, + "cache_write_price": 18750000 + }, + { + "provider": "azure", + "model": "claude-opus-4-5", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "azure", + "model": "claude-opus-4-6", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "azure", + "model": "claude-opus-4-8", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "azure", + "model": "claude-opus-5", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "azure", + "model": "claude-sonnet-4-5", + "input_price": 3000000, + "output_price": 15000000, + "cache_read_price": 300000, + "cache_write_price": 3750000 + }, + { + "provider": "azure", + "model": "claude-sonnet-4-6", + "input_price": 3000000, + "output_price": 15000000, + "cache_read_price": 300000, + "cache_write_price": 3750000 + }, + { + "provider": "azure", + "model": "claude-sonnet-5", + "input_price": 2000000, + "output_price": 10000000, + "cache_read_price": 200000, + "cache_write_price": 2500000 + }, + { + "provider": "azure", + "model": "codestral-2501", + "input_price": 300000, + "output_price": 900000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "azure", + "model": "codex-mini", + "input_price": 1500000, + "output_price": 6000000, + "cache_read_price": 375000, + "cache_write_price": null + }, + { + "provider": "azure", + "model": "cohere-command-a", + "input_price": 2500000, + "output_price": 10000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "azure", + "model": "cohere-embed-v-4-0", + "input_price": 120000, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "azure", + "model": "cohere-embed-v3-english", + "input_price": 100000, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "azure", + "model": "cohere-embed-v3-multilingual", + "input_price": 100000, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "azure", + "model": "deepseek-r1", + "input_price": 1350000, + "output_price": 5400000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "azure", + "model": "deepseek-v3.2", + "input_price": 580000, + "output_price": 1680000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "azure", + "model": "deepseek-v3.2-speciale", + "input_price": 580000, + "output_price": 1680000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "azure", + "model": "deepseek-v4-flash", + "input_price": 190000, + "output_price": 510000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "azure", + "model": "deepseek-v4-pro", + "input_price": 1740000, + "output_price": 3480000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "azure", + "model": "gpt-3.5-turbo-0125", "input_price": 500000, "output_price": 1500000, - "cache_read_price": 0, + "cache_read_price": null, "cache_write_price": null }, { - "provider": "openai", - "model": "gpt-4", - "input_price": 30000000, - "output_price": 60000000, + "provider": "azure", + "model": "gpt-3.5-turbo-1106", + "input_price": 1000000, + "output_price": 2000000, "cache_read_price": null, "cache_write_price": null }, { - "provider": "openai", + "provider": "azure", + "model": "gpt-3.5-turbo-instruct", + "input_price": 1500000, + "output_price": 2000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "azure", "model": "gpt-4-turbo", "input_price": 10000000, "output_price": 30000000, @@ -152,7 +328,15 @@ "cache_write_price": null }, { - "provider": "openai", + "provider": "azure", + "model": "gpt-4-turbo-vision", + "input_price": 10000000, + "output_price": 30000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "azure", "model": "gpt-4.1", "input_price": 2000000, "output_price": 8000000, @@ -160,7 +344,7 @@ "cache_write_price": null }, { - "provider": "openai", + "provider": "azure", "model": "gpt-4.1-mini", "input_price": 400000, "output_price": 1600000, @@ -168,7 +352,7 @@ "cache_write_price": null }, { - "provider": "openai", + "provider": "azure", "model": "gpt-4.1-nano", "input_price": 100000, "output_price": 400000, @@ -176,7 +360,7 @@ "cache_write_price": null }, { - "provider": "openai", + "provider": "azure", "model": "gpt-4o", "input_price": 2500000, "output_price": 10000000, @@ -184,31 +368,7 @@ "cache_write_price": null }, { - "provider": "openai", - "model": "gpt-4o-2024-05-13", - "input_price": 5000000, - "output_price": 15000000, - "cache_read_price": null, - "cache_write_price": null - }, - { - "provider": "openai", - "model": "gpt-4o-2024-08-06", - "input_price": 2500000, - "output_price": 10000000, - "cache_read_price": 1250000, - "cache_write_price": null - }, - { - "provider": "openai", - "model": "gpt-4o-2024-11-20", - "input_price": 2500000, - "output_price": 10000000, - "cache_read_price": 1250000, - "cache_write_price": null - }, - { - "provider": "openai", + "provider": "azure", "model": "gpt-4o-mini", "input_price": 150000, "output_price": 600000, @@ -216,31 +376,39 @@ "cache_write_price": null }, { - "provider": "openai", + "provider": "azure", "model": "gpt-5", "input_price": 1250000, "output_price": 10000000, - "cache_read_price": 125000, + "cache_read_price": 130000, "cache_write_price": null }, { - "provider": "openai", + "provider": "azure", + "model": "gpt-5-codex", + "input_price": 1250000, + "output_price": 10000000, + "cache_read_price": 130000, + "cache_write_price": null + }, + { + "provider": "azure", "model": "gpt-5-mini", "input_price": 250000, "output_price": 2000000, - "cache_read_price": 25000, + "cache_read_price": 30000, "cache_write_price": null }, { - "provider": "openai", + "provider": "azure", "model": "gpt-5-nano", "input_price": 50000, "output_price": 400000, - "cache_read_price": 5000, + "cache_read_price": 10000, "cache_write_price": null }, { - "provider": "openai", + "provider": "azure", "model": "gpt-5-pro", "input_price": 15000000, "output_price": 120000000, @@ -248,7 +416,7 @@ "cache_write_price": null }, { - "provider": "openai", + "provider": "azure", "model": "gpt-5.1", "input_price": 1250000, "output_price": 10000000, @@ -256,55 +424,55 @@ "cache_write_price": null }, { - "provider": "openai", - "model": "gpt-5.2", - "input_price": 1750000, - "output_price": 14000000, - "cache_read_price": 175000, + "provider": "azure", + "model": "gpt-5.1-codex", + "input_price": 1250000, + "output_price": 10000000, + "cache_read_price": 125000, "cache_write_price": null }, { - "provider": "openai", - "model": "gpt-5.2-chat-latest", - "input_price": 1750000, - "output_price": 14000000, - "cache_read_price": 175000, + "provider": "azure", + "model": "gpt-5.1-codex-max", + "input_price": 1250000, + "output_price": 10000000, + "cache_read_price": 125000, "cache_write_price": null }, { - "provider": "openai", - "model": "gpt-5.2-pro", - "input_price": 21000000, - "output_price": 168000000, - "cache_read_price": null, + "provider": "azure", + "model": "gpt-5.1-codex-mini", + "input_price": 250000, + "output_price": 2000000, + "cache_read_price": 25000, "cache_write_price": null }, { - "provider": "openai", - "model": "gpt-5.3-chat-latest", + "provider": "azure", + "model": "gpt-5.2", "input_price": 1750000, "output_price": 14000000, - "cache_read_price": 175000, + "cache_read_price": 125000, "cache_write_price": null }, { - "provider": "openai", - "model": "gpt-5.3-codex", + "provider": "azure", + "model": "gpt-5.2-codex", "input_price": 1750000, "output_price": 14000000, "cache_read_price": 175000, "cache_write_price": null }, { - "provider": "openai", - "model": "gpt-5.3-codex-spark", + "provider": "azure", + "model": "gpt-5.3-codex", "input_price": 1750000, "output_price": 14000000, "cache_read_price": 175000, "cache_write_price": null }, { - "provider": "openai", + "provider": "azure", "model": "gpt-5.4", "input_price": 2500000, "output_price": 15000000, @@ -312,7 +480,7 @@ "cache_write_price": null }, { - "provider": "openai", + "provider": "azure", "model": "gpt-5.4-mini", "input_price": 750000, "output_price": 4500000, @@ -320,7 +488,7 @@ "cache_write_price": null }, { - "provider": "openai", + "provider": "azure", "model": "gpt-5.4-nano", "input_price": 200000, "output_price": 1250000, @@ -328,7 +496,7 @@ "cache_write_price": null }, { - "provider": "openai", + "provider": "azure", "model": "gpt-5.4-pro", "input_price": 30000000, "output_price": 180000000, @@ -336,7 +504,7 @@ "cache_write_price": null }, { - "provider": "openai", + "provider": "azure", "model": "gpt-5.5", "input_price": 5000000, "output_price": 30000000, @@ -344,23 +512,7 @@ "cache_write_price": null }, { - "provider": "openai", - "model": "gpt-5.5-pro", - "input_price": 30000000, - "output_price": 180000000, - "cache_read_price": null, - "cache_write_price": null - }, - { - "provider": "openai", - "model": "gpt-5.6", - "input_price": 5000000, - "output_price": 30000000, - "cache_read_price": 500000, - "cache_write_price": 6250000 - }, - { - "provider": "openai", + "provider": "azure", "model": "gpt-5.6-luna", "input_price": 1000000, "output_price": 6000000, @@ -368,15 +520,15 @@ "cache_write_price": 1250000 }, { - "provider": "openai", + "provider": "azure", "model": "gpt-5.6-sol", "input_price": 5000000, "output_price": 30000000, "cache_read_price": 500000, - "cache_write_price": 6250000 + "cache_write_price": null }, { - "provider": "openai", + "provider": "azure", "model": "gpt-5.6-terra", "input_price": 2500000, "output_price": 15000000, @@ -384,39 +536,151 @@ "cache_write_price": 3125000 }, { - "provider": "openai", - "model": "gpt-image-2", + "provider": "azure", + "model": "gpt-chat-latest", "input_price": 5000000, "output_price": 30000000, - "cache_read_price": 1250000, + "cache_read_price": 500000, "cache_write_price": null }, { - "provider": "openai", - "model": "gpt-realtime-2.1", - "input_price": 4000000, - "output_price": 24000000, - "cache_read_price": 400000, + "provider": "azure", + "model": "gpt-image-1", + "input_price": 5000000, + "output_price": 40000000, + "cache_read_price": 1250000, "cache_write_price": null }, { - "provider": "openai", - "model": "o1", - "input_price": 15000000, - "output_price": 60000000, - "cache_read_price": 7500000, + "provider": "azure", + "model": "gpt-image-1.5", + "input_price": 5000000, + "output_price": 32000000, + "cache_read_price": 1250000, "cache_write_price": null }, { - "provider": "openai", - "model": "o1-pro", - "input_price": 150000000, - "output_price": 600000000, + "provider": "azure", + "model": "gpt-image-2", + "input_price": 5000000, + "output_price": 30000000, + "cache_read_price": 1250000, + "cache_write_price": null + }, + { + "provider": "azure", + "model": "grok-4-1-fast-non-reasoning", + "input_price": 200000, + "output_price": 500000, + "cache_read_price": 50000, + "cache_write_price": null + }, + { + "provider": "azure", + "model": "grok-4-1-fast-reasoning", + "input_price": 200000, + "output_price": 500000, + "cache_read_price": 50000, + "cache_write_price": null + }, + { + "provider": "azure", + "model": "grok-4-20-non-reasoning", + "input_price": 2000000, + "output_price": 6000000, "cache_read_price": null, "cache_write_price": null }, { - "provider": "openai", + "provider": "azure", + "model": "grok-4-20-reasoning", + "input_price": 2000000, + "output_price": 6000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "azure", + "model": "kimi-k2.5", + "input_price": 600000, + "output_price": 3000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "azure", + "model": "kimi-k2.6", + "input_price": 950000, + "output_price": 4000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "azure", + "model": "llama-3.3-70b-instruct", + "input_price": 710000, + "output_price": 710000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "azure", + "model": "llama-4-maverick-17b-128e-instruct-fp8", + "input_price": 250000, + "output_price": 1000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "azure", + "model": "llama-4-scout-17b-16e-instruct", + "input_price": 200000, + "output_price": 780000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "azure", + "model": "ministral-3b", + "input_price": 40000, + "output_price": 40000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "azure", + "model": "mistral-medium-2505", + "input_price": 400000, + "output_price": 2000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "azure", + "model": "mistral-small-2503", + "input_price": 100000, + "output_price": 300000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "azure", + "model": "model-router", + "input_price": 140000, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "azure", + "model": "o1", + "input_price": 15000000, + "output_price": 60000000, + "cache_read_price": 7500000, + "cache_write_price": null + }, + { + "provider": "azure", "model": "o3", "input_price": 2000000, "output_price": 8000000, @@ -424,7 +688,7 @@ "cache_write_price": null }, { - "provider": "openai", + "provider": "azure", "model": "o3-mini", "input_price": 1100000, "output_price": 4400000, @@ -432,15 +696,7 @@ "cache_write_price": null }, { - "provider": "openai", - "model": "o3-pro", - "input_price": 20000000, - "output_price": 80000000, - "cache_read_price": null, - "cache_write_price": null - }, - { - "provider": "openai", + "provider": "azure", "model": "o4-mini", "input_price": 1100000, "output_price": 4400000, @@ -448,7 +704,55 @@ "cache_write_price": null }, { - "provider": "openai", + "provider": "azure", + "model": "phi-4", + "input_price": 125000, + "output_price": 500000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "azure", + "model": "phi-4-mini", + "input_price": 75000, + "output_price": 300000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "azure", + "model": "phi-4-mini-reasoning", + "input_price": 75000, + "output_price": 300000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "azure", + "model": "phi-4-multimodal", + "input_price": 80000, + "output_price": 320000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "azure", + "model": "phi-4-reasoning", + "input_price": 125000, + "output_price": 500000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "azure", + "model": "phi-4-reasoning-plus", + "input_price": 125000, + "output_price": 500000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "azure", "model": "text-embedding-3-large", "input_price": 130000, "output_price": 0, @@ -456,7 +760,7 @@ "cache_write_price": null }, { - "provider": "openai", + "provider": "azure", "model": "text-embedding-3-small", "input_price": 20000, "output_price": 0, @@ -464,11 +768,6179 @@ "cache_write_price": null }, { - "provider": "openai", + "provider": "azure", "model": "text-embedding-ada-002", "input_price": 100000, "output_price": 0, "cache_read_price": null, "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "amazon.nova-2-lite-v1:0", + "input_price": 330000, + "output_price": 2750000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "amazon.nova-lite-v1:0", + "input_price": 60000, + "output_price": 240000, + "cache_read_price": 15000, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "amazon.nova-micro-v1:0", + "input_price": 35000, + "output_price": 140000, + "cache_read_price": 8750, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "amazon.nova-pro-v1:0", + "input_price": 800000, + "output_price": 3200000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "anthropic.claude-fable-5", + "input_price": 10000000, + "output_price": 50000000, + "cache_read_price": 1000000, + "cache_write_price": 12500000 + }, + { + "provider": "bedrock", + "model": "anthropic.claude-haiku-4-5-20251001-v1:0", + "input_price": 1000000, + "output_price": 5000000, + "cache_read_price": 100000, + "cache_write_price": 1250000 + }, + { + "provider": "bedrock", + "model": "anthropic.claude-opus-4-1-20250805-v1:0", + "input_price": 15000000, + "output_price": 75000000, + "cache_read_price": 1500000, + "cache_write_price": 18750000 + }, + { + "provider": "bedrock", + "model": "anthropic.claude-opus-4-5-20251101-v1:0", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "bedrock", + "model": "anthropic.claude-opus-4-6-v1", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "bedrock", + "model": "anthropic.claude-opus-4-7", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "bedrock", + "model": "anthropic.claude-opus-4-8", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "bedrock", + "model": "anthropic.claude-opus-5", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "bedrock", + "model": "anthropic.claude-sonnet-4-5-20250929-v1:0", + "input_price": 3000000, + "output_price": 15000000, + "cache_read_price": 300000, + "cache_write_price": 3750000 + }, + { + "provider": "bedrock", + "model": "anthropic.claude-sonnet-4-6", + "input_price": 3000000, + "output_price": 15000000, + "cache_read_price": 300000, + "cache_write_price": 3750000 + }, + { + "provider": "bedrock", + "model": "anthropic.claude-sonnet-5", + "input_price": 2000000, + "output_price": 10000000, + "cache_read_price": 200000, + "cache_write_price": 2500000 + }, + { + "provider": "bedrock", + "model": "au.anthropic.claude-haiku-4-5-20251001-v1:0", + "input_price": 1000000, + "output_price": 5000000, + "cache_read_price": 100000, + "cache_write_price": 1250000 + }, + { + "provider": "bedrock", + "model": "au.anthropic.claude-opus-4-6-v1", + "input_price": 16500000, + "output_price": 82500000, + "cache_read_price": 1650000, + "cache_write_price": 20625000 + }, + { + "provider": "bedrock", + "model": "au.anthropic.claude-opus-4-8", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "bedrock", + "model": "au.anthropic.claude-opus-5", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "bedrock", + "model": "au.anthropic.claude-sonnet-4-5-20250929-v1:0", + "input_price": 3000000, + "output_price": 15000000, + "cache_read_price": 300000, + "cache_write_price": 3750000 + }, + { + "provider": "bedrock", + "model": "au.anthropic.claude-sonnet-4-6", + "input_price": 3300000, + "output_price": 16500000, + "cache_read_price": 330000, + "cache_write_price": 4125000 + }, + { + "provider": "bedrock", + "model": "au.anthropic.claude-sonnet-5", + "input_price": 2000000, + "output_price": 10000000, + "cache_read_price": 200000, + "cache_write_price": 2500000 + }, + { + "provider": "bedrock", + "model": "deepseek.r1-v1:0", + "input_price": 1350000, + "output_price": 5400000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "deepseek.v3-v1:0", + "input_price": 580000, + "output_price": 1680000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "deepseek.v3.2", + "input_price": 620000, + "output_price": 1850000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "eu.anthropic.claude-fable-5", + "input_price": 11000000, + "output_price": 55000000, + "cache_read_price": 1100000, + "cache_write_price": 13750000 + }, + { + "provider": "bedrock", + "model": "eu.anthropic.claude-haiku-4-5-20251001-v1:0", + "input_price": 1100000, + "output_price": 5500000, + "cache_read_price": 110000, + "cache_write_price": 1375000 + }, + { + "provider": "bedrock", + "model": "eu.anthropic.claude-opus-4-5-20251101-v1:0", + "input_price": 5500000, + "output_price": 27500000, + "cache_read_price": 550000, + "cache_write_price": 6875000 + }, + { + "provider": "bedrock", + "model": "eu.anthropic.claude-opus-4-6-v1", + "input_price": 5500000, + "output_price": 27500000, + "cache_read_price": 550000, + "cache_write_price": 6875000 + }, + { + "provider": "bedrock", + "model": "eu.anthropic.claude-opus-4-7", + "input_price": 5500000, + "output_price": 27500000, + "cache_read_price": 550000, + "cache_write_price": 6875000 + }, + { + "provider": "bedrock", + "model": "eu.anthropic.claude-opus-4-8", + "input_price": 5500000, + "output_price": 27500000, + "cache_read_price": 550000, + "cache_write_price": 6875000 + }, + { + "provider": "bedrock", + "model": "eu.anthropic.claude-opus-5", + "input_price": 5500000, + "output_price": 27500000, + "cache_read_price": 550000, + "cache_write_price": 6875000 + }, + { + "provider": "bedrock", + "model": "eu.anthropic.claude-sonnet-4-5-20250929-v1:0", + "input_price": 3300000, + "output_price": 16500000, + "cache_read_price": 330000, + "cache_write_price": 4125000 + }, + { + "provider": "bedrock", + "model": "eu.anthropic.claude-sonnet-4-6", + "input_price": 3300000, + "output_price": 16500000, + "cache_read_price": 330000, + "cache_write_price": 4125000 + }, + { + "provider": "bedrock", + "model": "eu.anthropic.claude-sonnet-5", + "input_price": 2200000, + "output_price": 11000000, + "cache_read_price": 220000, + "cache_write_price": 2750000 + }, + { + "provider": "bedrock", + "model": "global.anthropic.claude-fable-5", + "input_price": 10000000, + "output_price": 50000000, + "cache_read_price": 1000000, + "cache_write_price": 12500000 + }, + { + "provider": "bedrock", + "model": "global.anthropic.claude-haiku-4-5-20251001-v1:0", + "input_price": 1000000, + "output_price": 5000000, + "cache_read_price": 100000, + "cache_write_price": 1250000 + }, + { + "provider": "bedrock", + "model": "global.anthropic.claude-opus-4-5-20251101-v1:0", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "bedrock", + "model": "global.anthropic.claude-opus-4-6-v1", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "bedrock", + "model": "global.anthropic.claude-opus-4-7", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "bedrock", + "model": "global.anthropic.claude-opus-4-8", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "bedrock", + "model": "global.anthropic.claude-opus-5", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "bedrock", + "model": "global.anthropic.claude-sonnet-4-5-20250929-v1:0", + "input_price": 3000000, + "output_price": 15000000, + "cache_read_price": 300000, + "cache_write_price": 3750000 + }, + { + "provider": "bedrock", + "model": "global.anthropic.claude-sonnet-4-6", + "input_price": 3000000, + "output_price": 15000000, + "cache_read_price": 300000, + "cache_write_price": 3750000 + }, + { + "provider": "bedrock", + "model": "global.anthropic.claude-sonnet-5", + "input_price": 2000000, + "output_price": 10000000, + "cache_read_price": 200000, + "cache_write_price": 2500000 + }, + { + "provider": "bedrock", + "model": "google.gemma-3-12b-it", + "input_price": 50000, + "output_price": 100000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "google.gemma-3-27b-it", + "input_price": 120000, + "output_price": 200000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "google.gemma-3-4b-it", + "input_price": 40000, + "output_price": 80000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "jp.anthropic.claude-haiku-4-5-20251001-v1:0", + "input_price": 1000000, + "output_price": 5000000, + "cache_read_price": 100000, + "cache_write_price": 1250000 + }, + { + "provider": "bedrock", + "model": "jp.anthropic.claude-opus-4-7", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "bedrock", + "model": "jp.anthropic.claude-opus-4-8", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "bedrock", + "model": "jp.anthropic.claude-opus-5", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "bedrock", + "model": "jp.anthropic.claude-sonnet-4-5-20250929-v1:0", + "input_price": 3000000, + "output_price": 15000000, + "cache_read_price": 300000, + "cache_write_price": 3750000 + }, + { + "provider": "bedrock", + "model": "jp.anthropic.claude-sonnet-4-6", + "input_price": 3000000, + "output_price": 15000000, + "cache_read_price": 300000, + "cache_write_price": 3750000 + }, + { + "provider": "bedrock", + "model": "jp.anthropic.claude-sonnet-5", + "input_price": 2000000, + "output_price": 10000000, + "cache_read_price": 200000, + "cache_write_price": 2500000 + }, + { + "provider": "bedrock", + "model": "meta.llama3-1-70b-instruct-v1:0", + "input_price": 720000, + "output_price": 720000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "meta.llama3-1-8b-instruct-v1:0", + "input_price": 220000, + "output_price": 220000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "meta.llama3-3-70b-instruct-v1:0", + "input_price": 720000, + "output_price": 720000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "meta.llama4-maverick-17b-instruct-v1:0", + "input_price": 240000, + "output_price": 970000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "meta.llama4-scout-17b-instruct-v1:0", + "input_price": 170000, + "output_price": 660000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "minimax.minimax-m2", + "input_price": 300000, + "output_price": 1200000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "minimax.minimax-m2.1", + "input_price": 300000, + "output_price": 1200000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "minimax.minimax-m2.5", + "input_price": 300000, + "output_price": 1200000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "mistral.devstral-2-123b", + "input_price": 400000, + "output_price": 2000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "mistral.magistral-small-2509", + "input_price": 500000, + "output_price": 1500000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "mistral.ministral-3-14b-instruct", + "input_price": 200000, + "output_price": 200000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "mistral.ministral-3-3b-instruct", + "input_price": 100000, + "output_price": 100000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "mistral.ministral-3-8b-instruct", + "input_price": 150000, + "output_price": 150000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "mistral.mistral-large-3-675b-instruct", + "input_price": 500000, + "output_price": 1500000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "mistral.pixtral-large-2502-v1:0", + "input_price": 2000000, + "output_price": 6000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "mistral.voxtral-mini-3b-2507", + "input_price": 40000, + "output_price": 40000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "mistral.voxtral-small-24b-2507", + "input_price": 150000, + "output_price": 350000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "moonshot.kimi-k2-thinking", + "input_price": 600000, + "output_price": 2500000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "moonshotai.kimi-k2.5", + "input_price": 600000, + "output_price": 3000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "nvidia.nemotron-nano-12b-v2", + "input_price": 200000, + "output_price": 600000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "nvidia.nemotron-nano-3-30b", + "input_price": 60000, + "output_price": 240000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "nvidia.nemotron-nano-9b-v2", + "input_price": 60000, + "output_price": 230000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "nvidia.nemotron-super-3-120b", + "input_price": 150000, + "output_price": 650000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "openai.gpt-5.4", + "input_price": 2750000, + "output_price": 16500000, + "cache_read_price": 275000, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "openai.gpt-5.5", + "input_price": 5500000, + "output_price": 33000000, + "cache_read_price": 550000, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "openai.gpt-5.6-luna", + "input_price": 220000, + "output_price": 1320000, + "cache_read_price": 22000, + "cache_write_price": 275000 + }, + { + "provider": "bedrock", + "model": "openai.gpt-5.6-sol", + "input_price": 5500000, + "output_price": 33000000, + "cache_read_price": 550000, + "cache_write_price": 6880000 + }, + { + "provider": "bedrock", + "model": "openai.gpt-5.6-terra", + "input_price": 2200000, + "output_price": 13200000, + "cache_read_price": 220000, + "cache_write_price": 2750000 + }, + { + "provider": "bedrock", + "model": "openai.gpt-oss-120b", + "input_price": 150000, + "output_price": 600000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "openai.gpt-oss-120b-1:0", + "input_price": 150000, + "output_price": 600000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "openai.gpt-oss-20b", + "input_price": 70000, + "output_price": 300000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "openai.gpt-oss-20b-1:0", + "input_price": 70000, + "output_price": 300000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "openai.gpt-oss-safeguard-120b", + "input_price": 150000, + "output_price": 600000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "openai.gpt-oss-safeguard-20b", + "input_price": 70000, + "output_price": 200000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "qwen.qwen3-235b-a22b-2507-v1:0", + "input_price": 220000, + "output_price": 880000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "qwen.qwen3-32b-v1:0", + "input_price": 150000, + "output_price": 600000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "qwen.qwen3-coder-30b-a3b-v1:0", + "input_price": 150000, + "output_price": 600000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "qwen.qwen3-coder-480b-a35b-v1:0", + "input_price": 220000, + "output_price": 1800000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "qwen.qwen3-coder-next", + "input_price": 220000, + "output_price": 1800000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "qwen.qwen3-next-80b-a3b", + "input_price": 140000, + "output_price": 1400000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "qwen.qwen3-vl-235b-a22b", + "input_price": 300000, + "output_price": 1500000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "us.anthropic.claude-fable-5", + "input_price": 10000000, + "output_price": 50000000, + "cache_read_price": 1000000, + "cache_write_price": 12500000 + }, + { + "provider": "bedrock", + "model": "us.anthropic.claude-haiku-4-5-20251001-v1:0", + "input_price": 1000000, + "output_price": 5000000, + "cache_read_price": 100000, + "cache_write_price": 1250000 + }, + { + "provider": "bedrock", + "model": "us.anthropic.claude-opus-4-1-20250805-v1:0", + "input_price": 15000000, + "output_price": 75000000, + "cache_read_price": 1500000, + "cache_write_price": 18750000 + }, + { + "provider": "bedrock", + "model": "us.anthropic.claude-opus-4-5-20251101-v1:0", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "bedrock", + "model": "us.anthropic.claude-opus-4-6-v1", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "bedrock", + "model": "us.anthropic.claude-opus-4-7", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "bedrock", + "model": "us.anthropic.claude-opus-4-8", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "bedrock", + "model": "us.anthropic.claude-opus-5", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "bedrock", + "model": "us.anthropic.claude-sonnet-4-5-20250929-v1:0", + "input_price": 3000000, + "output_price": 15000000, + "cache_read_price": 300000, + "cache_write_price": 3750000 + }, + { + "provider": "bedrock", + "model": "us.anthropic.claude-sonnet-4-6", + "input_price": 3000000, + "output_price": 15000000, + "cache_read_price": 300000, + "cache_write_price": 3750000 + }, + { + "provider": "bedrock", + "model": "us.anthropic.claude-sonnet-5", + "input_price": 2000000, + "output_price": 10000000, + "cache_read_price": 200000, + "cache_write_price": 2500000 + }, + { + "provider": "bedrock", + "model": "us.deepseek.r1-v1:0", + "input_price": 1350000, + "output_price": 5400000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "us.meta.llama4-maverick-17b-instruct-v1:0", + "input_price": 240000, + "output_price": 970000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "us.meta.llama4-scout-17b-instruct-v1:0", + "input_price": 170000, + "output_price": 660000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "writer.palmyra-x4-v1:0", + "input_price": 2500000, + "output_price": 10000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "writer.palmyra-x5-v1:0", + "input_price": 600000, + "output_price": 6000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "xai.grok-4.3", + "input_price": 1250000, + "output_price": 2500000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "zai.glm-4.7", + "input_price": 600000, + "output_price": 2200000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "zai.glm-4.7-flash", + "input_price": 70000, + "output_price": 400000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "bedrock", + "model": "zai.glm-5", + "input_price": 1000000, + "output_price": 3200000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "copilot", + "model": "claude-fable-5", + "input_price": 10000000, + "output_price": 50000000, + "cache_read_price": 1000000, + "cache_write_price": 12500000 + }, + { + "provider": "copilot", + "model": "claude-haiku-4.5", + "input_price": 1000000, + "output_price": 5000000, + "cache_read_price": 100000, + "cache_write_price": 1250000 + }, + { + "provider": "copilot", + "model": "claude-opus-4.5", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "copilot", + "model": "claude-opus-4.6", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "copilot", + "model": "claude-opus-4.7", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "copilot", + "model": "claude-opus-4.8", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "copilot", + "model": "claude-opus-5", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "copilot", + "model": "claude-sonnet-4", + "input_price": 3000000, + "output_price": 15000000, + "cache_read_price": 300000, + "cache_write_price": 3750000 + }, + { + "provider": "copilot", + "model": "claude-sonnet-4.5", + "input_price": 3000000, + "output_price": 15000000, + "cache_read_price": 300000, + "cache_write_price": 3750000 + }, + { + "provider": "copilot", + "model": "claude-sonnet-4.6", + "input_price": 3000000, + "output_price": 15000000, + "cache_read_price": 300000, + "cache_write_price": 3750000 + }, + { + "provider": "copilot", + "model": "claude-sonnet-5", + "input_price": 2000000, + "output_price": 10000000, + "cache_read_price": 200000, + "cache_write_price": 2500000 + }, + { + "provider": "copilot", + "model": "gemini-3.1-pro-preview", + "input_price": 2000000, + "output_price": 12000000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "copilot", + "model": "gemini-3.5-flash", + "input_price": 1500000, + "output_price": 9000000, + "cache_read_price": 150000, + "cache_write_price": null + }, + { + "provider": "copilot", + "model": "gemini-3.6-flash", + "input_price": 1500000, + "output_price": 7500000, + "cache_read_price": 150000, + "cache_write_price": null + }, + { + "provider": "copilot", + "model": "gpt-4.1", + "input_price": 2000000, + "output_price": 8000000, + "cache_read_price": 500000, + "cache_write_price": null + }, + { + "provider": "copilot", + "model": "gpt-5-mini", + "input_price": 250000, + "output_price": 2000000, + "cache_read_price": 25000, + "cache_write_price": null + }, + { + "provider": "copilot", + "model": "gpt-5.2", + "input_price": 1750000, + "output_price": 14000000, + "cache_read_price": 175000, + "cache_write_price": null + }, + { + "provider": "copilot", + "model": "gpt-5.2-codex", + "input_price": 1750000, + "output_price": 14000000, + "cache_read_price": 175000, + "cache_write_price": null + }, + { + "provider": "copilot", + "model": "gpt-5.3-codex", + "input_price": 1750000, + "output_price": 14000000, + "cache_read_price": 175000, + "cache_write_price": null + }, + { + "provider": "copilot", + "model": "gpt-5.4", + "input_price": 2500000, + "output_price": 15000000, + "cache_read_price": 250000, + "cache_write_price": null + }, + { + "provider": "copilot", + "model": "gpt-5.4-mini", + "input_price": 750000, + "output_price": 4500000, + "cache_read_price": 75000, + "cache_write_price": null + }, + { + "provider": "copilot", + "model": "gpt-5.4-nano", + "input_price": 200000, + "output_price": 1250000, + "cache_read_price": 20000, + "cache_write_price": null + }, + { + "provider": "copilot", + "model": "gpt-5.5", + "input_price": 5000000, + "output_price": 30000000, + "cache_read_price": 500000, + "cache_write_price": null + }, + { + "provider": "copilot", + "model": "gpt-5.6-luna", + "input_price": 200000, + "output_price": 1200000, + "cache_read_price": 20000, + "cache_write_price": null + }, + { + "provider": "copilot", + "model": "gpt-5.6-sol", + "input_price": 5000000, + "output_price": 30000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "copilot", + "model": "gpt-5.6-terra", + "input_price": 2000000, + "output_price": 12000000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "copilot", + "model": "grok-4.5", + "input_price": 2000000, + "output_price": 6000000, + "cache_read_price": 500000, + "cache_write_price": null + }, + { + "provider": "copilot", + "model": "kimi-k2.7-code", + "input_price": 950000, + "output_price": 4000000, + "cache_read_price": 190000, + "cache_write_price": null + }, + { + "provider": "copilot", + "model": "mai-code-1-flash-picker", + "input_price": 750000, + "output_price": 4500000, + "cache_read_price": 75000, + "cache_write_price": null + }, + { + "provider": "google", + "model": "deep-research-max-preview-04-2026", + "input_price": 2000000, + "output_price": 12000000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "google", + "model": "deep-research-preview-04-2026", + "input_price": 2000000, + "output_price": 12000000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-2.0-flash", + "input_price": 100000, + "output_price": 400000, + "cache_read_price": 25000, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-2.0-flash-lite", + "input_price": 75000, + "output_price": 300000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-2.5-computer-use-preview-10-2025", + "input_price": 1250000, + "output_price": 10000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-2.5-flash", + "input_price": 300000, + "output_price": 2500000, + "cache_read_price": 30000, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-2.5-flash-image", + "input_price": 300000, + "output_price": 30000000, + "cache_read_price": 75000, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-2.5-flash-lite", + "input_price": 100000, + "output_price": 400000, + "cache_read_price": 10000, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-2.5-flash-preview-tts", + "input_price": 500000, + "output_price": 10000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-2.5-pro", + "input_price": 1250000, + "output_price": 10000000, + "cache_read_price": 125000, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-2.5-pro-preview-tts", + "input_price": 1000000, + "output_price": 20000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-3-flash-preview", + "input_price": 500000, + "output_price": 3000000, + "cache_read_price": 50000, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-3-pro-image", + "input_price": 2000000, + "output_price": 120000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-3-pro-image-preview", + "input_price": 2000000, + "output_price": 120000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-3-pro-preview", + "input_price": 2000000, + "output_price": 12000000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-3.1-flash-image", + "input_price": 500000, + "output_price": 60000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-3.1-flash-image-preview", + "input_price": 500000, + "output_price": 60000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-3.1-flash-lite", + "input_price": 250000, + "output_price": 1500000, + "cache_read_price": 25000, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-3.1-flash-lite-image", + "input_price": 250000, + "output_price": 30000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-3.1-flash-lite-preview", + "input_price": 250000, + "output_price": 1500000, + "cache_read_price": 25000, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-3.1-flash-live-preview", + "input_price": 750000, + "output_price": 4500000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-3.1-flash-tts-preview", + "input_price": 1000000, + "output_price": 20000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-3.1-pro-preview", + "input_price": 2000000, + "output_price": 12000000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-3.1-pro-preview-customtools", + "input_price": 2000000, + "output_price": 12000000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-3.5-flash", + "input_price": 1500000, + "output_price": 9000000, + "cache_read_price": 150000, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-3.5-flash-lite", + "input_price": 300000, + "output_price": 2500000, + "cache_read_price": 30000, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-3.5-live-translate-preview", + "input_price": 3500000, + "output_price": 21000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-3.6-flash", + "input_price": 1500000, + "output_price": 7500000, + "cache_read_price": 150000, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-embedding-001", + "input_price": 150000, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-embedding-2", + "input_price": 200000, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-flash-latest", + "input_price": 1500000, + "output_price": 9000000, + "cache_read_price": 150000, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-flash-lite-latest", + "input_price": 250000, + "output_price": 1500000, + "cache_read_price": 25000, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-omni-flash-preview", + "input_price": 1500000, + "output_price": 17500000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "google", + "model": "gemini-robotics-er-1.6-preview", + "input_price": 1000000, + "output_price": 5000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "google", + "model": "lyria-3-clip-preview", + "input_price": 0, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "google", + "model": "lyria-3-pro-preview", + "input_price": 0, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "gpt-3.5-turbo", + "input_price": 500000, + "output_price": 1500000, + "cache_read_price": 0, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "gpt-4", + "input_price": 30000000, + "output_price": 60000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "gpt-4-turbo", + "input_price": 10000000, + "output_price": 30000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "gpt-4.1", + "input_price": 2000000, + "output_price": 8000000, + "cache_read_price": 500000, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "gpt-4.1-mini", + "input_price": 400000, + "output_price": 1600000, + "cache_read_price": 100000, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "gpt-4.1-nano", + "input_price": 100000, + "output_price": 400000, + "cache_read_price": 25000, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "gpt-4o", + "input_price": 2500000, + "output_price": 10000000, + "cache_read_price": 1250000, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "gpt-4o-2024-05-13", + "input_price": 5000000, + "output_price": 15000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "gpt-4o-2024-08-06", + "input_price": 2500000, + "output_price": 10000000, + "cache_read_price": 1250000, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "gpt-4o-2024-11-20", + "input_price": 2500000, + "output_price": 10000000, + "cache_read_price": 1250000, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "gpt-4o-mini", + "input_price": 150000, + "output_price": 600000, + "cache_read_price": 75000, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "gpt-5", + "input_price": 1250000, + "output_price": 10000000, + "cache_read_price": 125000, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "gpt-5-mini", + "input_price": 250000, + "output_price": 2000000, + "cache_read_price": 25000, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "gpt-5-nano", + "input_price": 50000, + "output_price": 400000, + "cache_read_price": 5000, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "gpt-5-pro", + "input_price": 15000000, + "output_price": 120000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "gpt-5.1", + "input_price": 1250000, + "output_price": 10000000, + "cache_read_price": 125000, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "gpt-5.2", + "input_price": 1750000, + "output_price": 14000000, + "cache_read_price": 175000, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "gpt-5.2-chat-latest", + "input_price": 1750000, + "output_price": 14000000, + "cache_read_price": 175000, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "gpt-5.2-pro", + "input_price": 21000000, + "output_price": 168000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "gpt-5.3-chat-latest", + "input_price": 1750000, + "output_price": 14000000, + "cache_read_price": 175000, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "gpt-5.3-codex", + "input_price": 1750000, + "output_price": 14000000, + "cache_read_price": 175000, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "gpt-5.3-codex-spark", + "input_price": 1750000, + "output_price": 14000000, + "cache_read_price": 175000, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "gpt-5.4", + "input_price": 2500000, + "output_price": 15000000, + "cache_read_price": 250000, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "gpt-5.4-mini", + "input_price": 750000, + "output_price": 4500000, + "cache_read_price": 75000, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "gpt-5.4-nano", + "input_price": 200000, + "output_price": 1250000, + "cache_read_price": 20000, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "gpt-5.4-pro", + "input_price": 30000000, + "output_price": 180000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "gpt-5.5", + "input_price": 5000000, + "output_price": 30000000, + "cache_read_price": 500000, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "gpt-5.5-pro", + "input_price": 30000000, + "output_price": 180000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "gpt-5.6", + "input_price": 5000000, + "output_price": 30000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "openai", + "model": "gpt-5.6-luna", + "input_price": 200000, + "output_price": 1200000, + "cache_read_price": 20000, + "cache_write_price": 250000 + }, + { + "provider": "openai", + "model": "gpt-5.6-sol", + "input_price": 5000000, + "output_price": 30000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "openai", + "model": "gpt-5.6-terra", + "input_price": 2000000, + "output_price": 12000000, + "cache_read_price": 200000, + "cache_write_price": 2500000 + }, + { + "provider": "openai", + "model": "gpt-image-2", + "input_price": 5000000, + "output_price": 30000000, + "cache_read_price": 1250000, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "gpt-realtime-2.1", + "input_price": 4000000, + "output_price": 24000000, + "cache_read_price": 400000, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "o1", + "input_price": 15000000, + "output_price": 60000000, + "cache_read_price": 7500000, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "o1-pro", + "input_price": 150000000, + "output_price": 600000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "o3", + "input_price": 2000000, + "output_price": 8000000, + "cache_read_price": 500000, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "o3-mini", + "input_price": 1100000, + "output_price": 4400000, + "cache_read_price": 550000, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "o3-pro", + "input_price": 20000000, + "output_price": 80000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "o4-mini", + "input_price": 1100000, + "output_price": 4400000, + "cache_read_price": 275000, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "text-embedding-3-large", + "input_price": 130000, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "text-embedding-3-small", + "input_price": 20000, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openai", + "model": "text-embedding-ada-002", + "input_price": 100000, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "ai21/jamba-large-1.7", + "input_price": 2000000, + "output_price": 8000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "aion-labs/aion-2.0", + "input_price": 800000, + "output_price": 1600000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "aion-labs/aion-3.0", + "input_price": 3000000, + "output_price": 6000000, + "cache_read_price": 750000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "aion-labs/aion-3.0-mini", + "input_price": 700000, + "output_price": 1400000, + "cache_read_price": 180000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "aion-labs/aion-rp-llama-3.1-8b", + "input_price": 800000, + "output_price": 1600000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "allenai/olmo-3-32b-think", + "input_price": 150000, + "output_price": 500000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "amazon/nova-2-lite-v1", + "input_price": 300000, + "output_price": 2500000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "amazon/nova-lite-v1", + "input_price": 60000, + "output_price": 240000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "amazon/nova-micro-v1", + "input_price": 35000, + "output_price": 140000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "amazon/nova-premier-v1", + "input_price": 2500000, + "output_price": 12500000, + "cache_read_price": 625000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "amazon/nova-pro-v1", + "input_price": 800000, + "output_price": 3200000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "anthracite-org/magnum-v4-72b", + "input_price": 3000000, + "output_price": 5000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "anthropic/claude-3-haiku", + "input_price": 250000, + "output_price": 1250000, + "cache_read_price": 30000, + "cache_write_price": 300000 + }, + { + "provider": "openrouter", + "model": "anthropic/claude-fable-5", + "input_price": 10000000, + "output_price": 50000000, + "cache_read_price": 1000000, + "cache_write_price": 12500000 + }, + { + "provider": "openrouter", + "model": "anthropic/claude-haiku-4.5", + "input_price": 1000000, + "output_price": 5000000, + "cache_read_price": 100000, + "cache_write_price": 1250000 + }, + { + "provider": "openrouter", + "model": "anthropic/claude-opus-4", + "input_price": 15000000, + "output_price": 75000000, + "cache_read_price": 1500000, + "cache_write_price": 18750000 + }, + { + "provider": "openrouter", + "model": "anthropic/claude-opus-4.1", + "input_price": 15000000, + "output_price": 75000000, + "cache_read_price": 1500000, + "cache_write_price": 18750000 + }, + { + "provider": "openrouter", + "model": "anthropic/claude-opus-4.5", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "openrouter", + "model": "anthropic/claude-opus-4.6", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "openrouter", + "model": "anthropic/claude-opus-4.7", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "openrouter", + "model": "anthropic/claude-opus-4.7-fast", + "input_price": 30000000, + "output_price": 150000000, + "cache_read_price": 3000000, + "cache_write_price": 37500000 + }, + { + "provider": "openrouter", + "model": "anthropic/claude-opus-4.8", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "openrouter", + "model": "anthropic/claude-opus-4.8-fast", + "input_price": 10000000, + "output_price": 50000000, + "cache_read_price": 1000000, + "cache_write_price": 12500000 + }, + { + "provider": "openrouter", + "model": "anthropic/claude-opus-5", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "openrouter", + "model": "anthropic/claude-opus-5-fast", + "input_price": 10000000, + "output_price": 50000000, + "cache_read_price": 1000000, + "cache_write_price": 12500000 + }, + { + "provider": "openrouter", + "model": "anthropic/claude-sonnet-4", + "input_price": 3000000, + "output_price": 15000000, + "cache_read_price": 300000, + "cache_write_price": 3750000 + }, + { + "provider": "openrouter", + "model": "anthropic/claude-sonnet-4.5", + "input_price": 3000000, + "output_price": 15000000, + "cache_read_price": 300000, + "cache_write_price": 3750000 + }, + { + "provider": "openrouter", + "model": "anthropic/claude-sonnet-4.6", + "input_price": 3000000, + "output_price": 15000000, + "cache_read_price": 300000, + "cache_write_price": 3750000 + }, + { + "provider": "openrouter", + "model": "anthropic/claude-sonnet-5", + "input_price": 2000000, + "output_price": 10000000, + "cache_read_price": 200000, + "cache_write_price": 2500000 + }, + { + "provider": "openrouter", + "model": "arcee-ai/trinity-large-thinking", + "input_price": 220000, + "output_price": 850000, + "cache_read_price": 60000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "arcee-ai/virtuoso-large", + "input_price": 750000, + "output_price": 1200000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "baidu/ernie-4.5-vl-424b-a47b", + "input_price": 420000, + "output_price": 1250000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "bytedance-seed/seed-1.6", + "input_price": 250000, + "output_price": 2000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "bytedance-seed/seed-1.6-flash", + "input_price": 75000, + "output_price": 300000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "bytedance-seed/seed-2.0-lite", + "input_price": 250000, + "output_price": 2000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "bytedance-seed/seed-2.0-mini", + "input_price": 100000, + "output_price": 400000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "bytedance/ui-tars-1.5-7b", + "input_price": 100000, + "output_price": 200000, + "cache_read_price": 100000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "cognitivecomputations/dolphin-mistral-24b-venice-edition", + "input_price": 200000, + "output_price": 900000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "cohere/command-a", + "input_price": 2500000, + "output_price": 10000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "cohere/command-r-08-2024", + "input_price": 150000, + "output_price": 600000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "cohere/command-r-plus-08-2024", + "input_price": 2500000, + "output_price": 10000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "cohere/command-r7b-12-2024", + "input_price": 37500, + "output_price": 150000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "cohere/north-mini-code:free", + "input_price": 0, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "deepcogito/cogito-v2.1-671b", + "input_price": 1250000, + "output_price": 1250000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "deepseek/deepseek-chat", + "input_price": 257400, + "output_price": 1028700, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "deepseek/deepseek-chat-v3-0324", + "input_price": 270000, + "output_price": 1120000, + "cache_read_price": 135000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "deepseek/deepseek-chat-v3.1", + "input_price": 250000, + "output_price": 950000, + "cache_read_price": 130000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "deepseek/deepseek-r1", + "input_price": 700000, + "output_price": 2500000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "deepseek/deepseek-r1-0528", + "input_price": 500000, + "output_price": 2150000, + "cache_read_price": 350000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "deepseek/deepseek-r1-distill-llama-70b", + "input_price": 800000, + "output_price": 800000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "deepseek/deepseek-v3.1-terminus", + "input_price": 270000, + "output_price": 1000000, + "cache_read_price": 135000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "deepseek/deepseek-v3.2", + "input_price": 269000, + "output_price": 400000, + "cache_read_price": 134500, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "deepseek/deepseek-v3.2-exp", + "input_price": 270000, + "output_price": 410000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "deepseek/deepseek-v4-flash", + "input_price": 140000, + "output_price": 280000, + "cache_read_price": 28000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "deepseek/deepseek-v4-flash-0731", + "input_price": 90000, + "output_price": 180000, + "cache_read_price": 18000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "deepseek/deepseek-v4-pro", + "input_price": 435000, + "output_price": 870000, + "cache_read_price": 3625, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "google/gemini-2.5-flash", + "input_price": 300000, + "output_price": 2500000, + "cache_read_price": 30000, + "cache_write_price": 83333 + }, + { + "provider": "openrouter", + "model": "google/gemini-2.5-flash-image", + "input_price": 300000, + "output_price": 2500000, + "cache_read_price": 30000, + "cache_write_price": 83333 + }, + { + "provider": "openrouter", + "model": "google/gemini-2.5-flash-lite", + "input_price": 100000, + "output_price": 400000, + "cache_read_price": 10000, + "cache_write_price": 83333 + }, + { + "provider": "openrouter", + "model": "google/gemini-2.5-pro", + "input_price": 1250000, + "output_price": 10000000, + "cache_read_price": 125000, + "cache_write_price": 375000 + }, + { + "provider": "openrouter", + "model": "google/gemini-2.5-pro-preview", + "input_price": 1250000, + "output_price": 10000000, + "cache_read_price": 125000, + "cache_write_price": 375000 + }, + { + "provider": "openrouter", + "model": "google/gemini-2.5-pro-preview-05-06", + "input_price": 1250000, + "output_price": 10000000, + "cache_read_price": 125000, + "cache_write_price": 375000 + }, + { + "provider": "openrouter", + "model": "google/gemini-3-flash-preview", + "input_price": 500000, + "output_price": 3000000, + "cache_read_price": 50000, + "cache_write_price": 83333 + }, + { + "provider": "openrouter", + "model": "google/gemini-3-pro-image", + "input_price": 2000000, + "output_price": 12000000, + "cache_read_price": 200000, + "cache_write_price": 375000 + }, + { + "provider": "openrouter", + "model": "google/gemini-3-pro-image-preview", + "input_price": 2000000, + "output_price": 12000000, + "cache_read_price": 200000, + "cache_write_price": 375000 + }, + { + "provider": "openrouter", + "model": "google/gemini-3.1-flash-image", + "input_price": 500000, + "output_price": 3000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "google/gemini-3.1-flash-image-preview", + "input_price": 500000, + "output_price": 3000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "google/gemini-3.1-flash-lite", + "input_price": 250000, + "output_price": 1500000, + "cache_read_price": 25000, + "cache_write_price": 83333 + }, + { + "provider": "openrouter", + "model": "google/gemini-3.1-flash-lite-image", + "input_price": 250000, + "output_price": 1500000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "google/gemini-3.1-flash-lite-preview", + "input_price": 250000, + "output_price": 1500000, + "cache_read_price": 25000, + "cache_write_price": 83333 + }, + { + "provider": "openrouter", + "model": "google/gemini-3.1-pro-preview", + "input_price": 2000000, + "output_price": 12000000, + "cache_read_price": 200000, + "cache_write_price": 375000 + }, + { + "provider": "openrouter", + "model": "google/gemini-3.1-pro-preview-customtools", + "input_price": 2000000, + "output_price": 12000000, + "cache_read_price": 200000, + "cache_write_price": 375000 + }, + { + "provider": "openrouter", + "model": "google/gemini-3.5-flash", + "input_price": 1500000, + "output_price": 9000000, + "cache_read_price": 150000, + "cache_write_price": 83333 + }, + { + "provider": "openrouter", + "model": "google/gemini-3.5-flash-lite", + "input_price": 300000, + "output_price": 2500000, + "cache_read_price": 30000, + "cache_write_price": 83333 + }, + { + "provider": "openrouter", + "model": "google/gemini-3.6-flash", + "input_price": 1500000, + "output_price": 7500000, + "cache_read_price": 150000, + "cache_write_price": 83333 + }, + { + "provider": "openrouter", + "model": "google/gemma-2-27b-it", + "input_price": 650000, + "output_price": 650000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "google/gemma-3-12b-it", + "input_price": 50000, + "output_price": 150000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "google/gemma-3-27b-it", + "input_price": 80000, + "output_price": 450000, + "cache_read_price": 40000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "google/gemma-3-4b-it", + "input_price": 50000, + "output_price": 100000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "google/gemma-3n-e4b-it", + "input_price": 60000, + "output_price": 120000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "google/gemma-4-26b-a4b-it", + "input_price": 70000, + "output_price": 340000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "google/gemma-4-26b-a4b-it:free", + "input_price": 0, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "google/gemma-4-31b-it", + "input_price": 100000, + "output_price": 340000, + "cache_read_price": 100000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "google/gemma-4-31b-it:free", + "input_price": 0, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "google/lyria-3-clip-preview", + "input_price": 0, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "google/lyria-3-pro-preview", + "input_price": 0, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "gryphe/mythomax-l2-13b", + "input_price": 80000, + "output_price": 110000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "ibm-granite/granite-4.0-h-micro", + "input_price": 17000, + "output_price": 112000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "ibm-granite/granite-4.1-8b", + "input_price": 50000, + "output_price": 100000, + "cache_read_price": 50000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "inception/mercury-2", + "input_price": 250000, + "output_price": 750000, + "cache_read_price": 25000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "inclusionai/ling-2.6-1t", + "input_price": 75000, + "output_price": 625000, + "cache_read_price": 15000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "inclusionai/ling-2.6-flash", + "input_price": 10000, + "output_price": 30000, + "cache_read_price": 2000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "inclusionai/ling-3.0-flash:free", + "input_price": 0, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "inclusionai/ring-2.6-1t", + "input_price": 75000, + "output_price": 625000, + "cache_read_price": 15000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "kwaipilot/kat-coder-air-v2.5", + "input_price": 150000, + "output_price": 600000, + "cache_read_price": 30000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "kwaipilot/kat-coder-pro-v2", + "input_price": 300000, + "output_price": 1200000, + "cache_read_price": 60000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "kwaipilot/kat-coder-pro-v2.5", + "input_price": 740000, + "output_price": 2960000, + "cache_read_price": 150000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "mancer/weaver", + "input_price": 500000, + "output_price": 750000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "meituan/longcat-2.0", + "input_price": 300000, + "output_price": 1200000, + "cache_read_price": 6000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "meta-llama/llama-3.1-70b-instruct", + "input_price": 400000, + "output_price": 400000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "meta-llama/llama-3.1-8b-instruct", + "input_price": 50000, + "output_price": 80000, + "cache_read_price": 25000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "meta-llama/llama-3.2-1b-instruct", + "input_price": 27000, + "output_price": 201000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "meta-llama/llama-3.2-3b-instruct", + "input_price": 50000, + "output_price": 330000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "meta-llama/llama-3.3-70b-instruct", + "input_price": 100000, + "output_price": 320000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "meta-llama/llama-4-maverick", + "input_price": 200000, + "output_price": 800000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "meta-llama/llama-4-scout", + "input_price": 100000, + "output_price": 300000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "meta-llama/llama-guard-4-12b", + "input_price": 180000, + "output_price": 180000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "meta/muse-spark-1.1", + "input_price": 1250000, + "output_price": 4250000, + "cache_read_price": 150000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "microsoft/phi-4", + "input_price": 70000, + "output_price": 140000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "microsoft/wizardlm-2-8x22b", + "input_price": 620000, + "output_price": 620000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "minimax/minimax-01", + "input_price": 200000, + "output_price": 1100000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "minimax/minimax-m1", + "input_price": 550000, + "output_price": 2200000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "minimax/minimax-m2", + "input_price": 255000, + "output_price": 1020000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "minimax/minimax-m2-her", + "input_price": 300000, + "output_price": 1200000, + "cache_read_price": 30000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "minimax/minimax-m2.1", + "input_price": 300000, + "output_price": 1200000, + "cache_read_price": 30000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "minimax/minimax-m2.5", + "input_price": 150000, + "output_price": 900000, + "cache_read_price": 50000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "minimax/minimax-m2.7", + "input_price": 250000, + "output_price": 1000000, + "cache_read_price": 50000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "minimax/minimax-m3", + "input_price": 300000, + "output_price": 1200000, + "cache_read_price": 60000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "mistralai/codestral-2508", + "input_price": 300000, + "output_price": 900000, + "cache_read_price": 30000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "mistralai/ministral-14b-2512", + "input_price": 200000, + "output_price": 200000, + "cache_read_price": 20000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "mistralai/ministral-3b-2512", + "input_price": 100000, + "output_price": 100000, + "cache_read_price": 10000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "mistralai/ministral-8b-2512", + "input_price": 150000, + "output_price": 150000, + "cache_read_price": 15000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "mistralai/mistral-large", + "input_price": 2000000, + "output_price": 6000000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "mistralai/mistral-large-2407", + "input_price": 2000000, + "output_price": 6000000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "mistralai/mistral-large-2512", + "input_price": 500000, + "output_price": 1500000, + "cache_read_price": 50000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "mistralai/mistral-medium-3", + "input_price": 400000, + "output_price": 2000000, + "cache_read_price": 40000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "mistralai/mistral-medium-3-5", + "input_price": 1500000, + "output_price": 7500000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "mistralai/mistral-medium-3.1", + "input_price": 400000, + "output_price": 2000000, + "cache_read_price": 40000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "mistralai/mistral-nemo", + "input_price": 19000, + "output_price": 30000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "mistralai/mistral-saba", + "input_price": 200000, + "output_price": 600000, + "cache_read_price": 20000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "mistralai/mistral-small-24b-instruct-2501", + "input_price": 50000, + "output_price": 80000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "mistralai/mistral-small-2603", + "input_price": 150000, + "output_price": 600000, + "cache_read_price": 15000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "mistralai/mistral-small-3.1-24b-instruct", + "input_price": 351000, + "output_price": 555000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "mistralai/mistral-small-3.2-24b-instruct", + "input_price": 75000, + "output_price": 200000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "mistralai/mixtral-8x22b-instruct", + "input_price": 2000000, + "output_price": 6000000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "mistralai/voxtral-small-24b-2507", + "input_price": 100000, + "output_price": 300000, + "cache_read_price": 10000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "moonshotai/kimi-k2", + "input_price": 570000, + "output_price": 2300000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "moonshotai/kimi-k2-0905", + "input_price": 600000, + "output_price": 2500000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "moonshotai/kimi-k2-thinking", + "input_price": 600000, + "output_price": 2500000, + "cache_read_price": 150000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "moonshotai/kimi-k2.5", + "input_price": 570000, + "output_price": 2850000, + "cache_read_price": 95000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "moonshotai/kimi-k2.6", + "input_price": 589000, + "output_price": 2480000, + "cache_read_price": 99200, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "moonshotai/kimi-k2.7-code", + "input_price": 730000, + "output_price": 3500000, + "cache_read_price": 150000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "moonshotai/kimi-k3", + "input_price": 3000000, + "output_price": 15000000, + "cache_read_price": 300000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "morph/morph-v3-fast", + "input_price": 800000, + "output_price": 1200000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "morph/morph-v3-large", + "input_price": 900000, + "output_price": 1900000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "nex-agi/nex-n2-mini", + "input_price": 25000, + "output_price": 100000, + "cache_read_price": 2500, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "nex-agi/nex-n2-pro", + "input_price": 250000, + "output_price": 1000000, + "cache_read_price": 25000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "nousresearch/hermes-3-llama-3.1-405b", + "input_price": 1000000, + "output_price": 1000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "nousresearch/hermes-3-llama-3.1-70b", + "input_price": 700000, + "output_price": 700000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "nousresearch/hermes-4-405b", + "input_price": 1000000, + "output_price": 3000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "nousresearch/hermes-4-70b", + "input_price": 130000, + "output_price": 400000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "nvidia/nemotron-3-nano-30b-a3b", + "input_price": 50000, + "output_price": 200000, + "cache_read_price": 30000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "nvidia/nemotron-3-nano-30b-a3b:free", + "input_price": 0, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "nvidia/nemotron-3-nano-omni-30b-a3b-reasoning:free", + "input_price": 0, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "nvidia/nemotron-3-super-120b-a12b", + "input_price": 85000, + "output_price": 400000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "nvidia/nemotron-3-super-120b-a12b:free", + "input_price": 0, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "nvidia/nemotron-3-ultra-550b-a55b", + "input_price": 600000, + "output_price": 3600000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "nvidia/nemotron-3-ultra-550b-a55b:free", + "input_price": 0, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "nvidia/nemotron-3.5-content-safety:free", + "input_price": 0, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "nvidia/nemotron-nano-12b-v2-vl:free", + "input_price": 0, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "nvidia/nemotron-nano-9b-v2:free", + "input_price": 0, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-3.5-turbo", + "input_price": 500000, + "output_price": 1500000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-3.5-turbo-0613", + "input_price": 1000000, + "output_price": 2000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-3.5-turbo-16k", + "input_price": 3000000, + "output_price": 4000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-3.5-turbo-instruct", + "input_price": 1500000, + "output_price": 2000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-4", + "input_price": 30000000, + "output_price": 60000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-4-turbo", + "input_price": 10000000, + "output_price": 30000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-4-turbo-preview", + "input_price": 10000000, + "output_price": 30000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-4.1", + "input_price": 2000000, + "output_price": 8000000, + "cache_read_price": 500000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-4.1-mini", + "input_price": 400000, + "output_price": 1600000, + "cache_read_price": 100000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-4.1-nano", + "input_price": 100000, + "output_price": 400000, + "cache_read_price": 25000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-4o", + "input_price": 2500000, + "output_price": 10000000, + "cache_read_price": 1250000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-4o-2024-05-13", + "input_price": 5000000, + "output_price": 15000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-4o-2024-08-06", + "input_price": 2500000, + "output_price": 10000000, + "cache_read_price": 1250000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-4o-2024-11-20", + "input_price": 2500000, + "output_price": 10000000, + "cache_read_price": 1250000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-4o-mini", + "input_price": 150000, + "output_price": 600000, + "cache_read_price": 75000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-4o-mini-2024-07-18", + "input_price": 150000, + "output_price": 600000, + "cache_read_price": 75000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-5", + "input_price": 1250000, + "output_price": 10000000, + "cache_read_price": 125000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-5-image", + "input_price": 10000000, + "output_price": 10000000, + "cache_read_price": 1250000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-5-image-mini", + "input_price": 2500000, + "output_price": 2000000, + "cache_read_price": 250000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-5-mini", + "input_price": 250000, + "output_price": 2000000, + "cache_read_price": 25000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-5-nano", + "input_price": 50000, + "output_price": 400000, + "cache_read_price": 5000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-5-pro", + "input_price": 15000000, + "output_price": 120000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-5.1", + "input_price": 1250000, + "output_price": 10000000, + "cache_read_price": 125000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-5.1-codex", + "input_price": 1250000, + "output_price": 10000000, + "cache_read_price": 130000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-5.1-codex-max", + "input_price": 1250000, + "output_price": 10000000, + "cache_read_price": 125000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-5.1-codex-mini", + "input_price": 250000, + "output_price": 2000000, + "cache_read_price": 30000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-5.2", + "input_price": 1750000, + "output_price": 14000000, + "cache_read_price": 175000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-5.2-chat", + "input_price": 1750000, + "output_price": 14000000, + "cache_read_price": 175000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-5.2-codex", + "input_price": 1750000, + "output_price": 14000000, + "cache_read_price": 175000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-5.2-pro", + "input_price": 21000000, + "output_price": 168000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-5.3-chat", + "input_price": 1750000, + "output_price": 14000000, + "cache_read_price": 175000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-5.3-codex", + "input_price": 1750000, + "output_price": 14000000, + "cache_read_price": 175000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-5.4", + "input_price": 2500000, + "output_price": 15000000, + "cache_read_price": 250000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-5.4-image-2", + "input_price": 8000000, + "output_price": 15000000, + "cache_read_price": 2000000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-5.4-mini", + "input_price": 750000, + "output_price": 4500000, + "cache_read_price": 75000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-5.4-nano", + "input_price": 200000, + "output_price": 1250000, + "cache_read_price": 20000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-5.4-pro", + "input_price": 30000000, + "output_price": 180000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-5.5", + "input_price": 5000000, + "output_price": 30000000, + "cache_read_price": 500000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-5.5-pro", + "input_price": 30000000, + "output_price": 180000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-5.6-luna", + "input_price": 100000, + "output_price": 600000, + "cache_read_price": 10000, + "cache_write_price": 125000 + }, + { + "provider": "openrouter", + "model": "openai/gpt-5.6-luna-pro", + "input_price": 100000, + "output_price": 600000, + "cache_read_price": 10000, + "cache_write_price": 125000 + }, + { + "provider": "openrouter", + "model": "openai/gpt-5.6-sol", + "input_price": 5000000, + "output_price": 30000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "openrouter", + "model": "openai/gpt-5.6-sol-pro", + "input_price": 5000000, + "output_price": 30000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "openrouter", + "model": "openai/gpt-5.6-terra", + "input_price": 1000000, + "output_price": 6000000, + "cache_read_price": 100000, + "cache_write_price": 1250000 + }, + { + "provider": "openrouter", + "model": "openai/gpt-5.6-terra-pro", + "input_price": 1000000, + "output_price": 6000000, + "cache_read_price": 100000, + "cache_write_price": 1250000 + }, + { + "provider": "openrouter", + "model": "openai/gpt-audio", + "input_price": 2500000, + "output_price": 10000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-audio-mini", + "input_price": 600000, + "output_price": 2400000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-chat-latest", + "input_price": 5000000, + "output_price": 30000000, + "cache_read_price": 500000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-oss-120b", + "input_price": 37000, + "output_price": 170000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-oss-20b", + "input_price": 30000, + "output_price": 130000, + "cache_read_price": 30000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-oss-20b:free", + "input_price": 0, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/gpt-oss-safeguard-20b", + "input_price": 75000, + "output_price": 300000, + "cache_read_price": 37500, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/o1", + "input_price": 15000000, + "output_price": 60000000, + "cache_read_price": 7500000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/o1-pro", + "input_price": 150000000, + "output_price": 600000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/o3", + "input_price": 2000000, + "output_price": 8000000, + "cache_read_price": 500000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/o3-mini", + "input_price": 1100000, + "output_price": 4400000, + "cache_read_price": 550000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/o3-mini-high", + "input_price": 1100000, + "output_price": 4400000, + "cache_read_price": 550000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/o3-pro", + "input_price": 20000000, + "output_price": 80000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/o4-mini", + "input_price": 1100000, + "output_price": 4400000, + "cache_read_price": 275000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openai/o4-mini-high", + "input_price": 1100000, + "output_price": 4400000, + "cache_read_price": 275000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "openrouter/free", + "input_price": 0, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "perceptron/perceptron-mk1", + "input_price": 150000, + "output_price": 1500000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "perplexity/sonar", + "input_price": 1000000, + "output_price": 1000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "perplexity/sonar-deep-research", + "input_price": 2000000, + "output_price": 8000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "perplexity/sonar-pro", + "input_price": 3000000, + "output_price": 15000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "perplexity/sonar-pro-search", + "input_price": 3000000, + "output_price": 15000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "perplexity/sonar-reasoning-pro", + "input_price": 2000000, + "output_price": 8000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "poolside/laguna-s-2.1", + "input_price": 90000, + "output_price": 180000, + "cache_read_price": 9000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "poolside/laguna-s-2.1:free", + "input_price": 0, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "poolside/laguna-xs-2.1", + "input_price": 60000, + "output_price": 120000, + "cache_read_price": 30000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "poolside/laguna-xs-2.1:free", + "input_price": 0, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen-2.5-72b-instruct", + "input_price": 360000, + "output_price": 400000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen-2.5-7b-instruct", + "input_price": 100000, + "output_price": 200000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen-2.5-coder-32b-instruct", + "input_price": 660000, + "output_price": 1000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen-plus", + "input_price": 260000, + "output_price": 780000, + "cache_read_price": 52000, + "cache_write_price": 325000 + }, + { + "provider": "openrouter", + "model": "qwen/qwen-plus-2025-07-28", + "input_price": 260000, + "output_price": 780000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen-plus-2025-07-28:thinking", + "input_price": 400000, + "output_price": 1200000, + "cache_read_price": null, + "cache_write_price": 500000 + }, + { + "provider": "openrouter", + "model": "qwen/qwen2.5-vl-72b-instruct", + "input_price": 250000, + "output_price": 750000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3-14b", + "input_price": 227500, + "output_price": 910000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3-235b-a22b", + "input_price": 455000, + "output_price": 1820000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3-235b-a22b-2507", + "input_price": 149500, + "output_price": 598000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3-235b-a22b-thinking-2507", + "input_price": 230000, + "output_price": 2300000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3-30b-a3b", + "input_price": 120000, + "output_price": 500000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3-30b-a3b-instruct-2507", + "input_price": 48150, + "output_price": 193050, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3-30b-a3b-thinking-2507", + "input_price": 200000, + "output_price": 2400000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3-32b", + "input_price": 80000, + "output_price": 280000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3-8b", + "input_price": 117000, + "output_price": 455000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3-coder", + "input_price": 300000, + "output_price": 1000000, + "cache_read_price": 100000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3-coder-30b-a3b-instruct", + "input_price": 70000, + "output_price": 270000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3-coder-flash", + "input_price": 195000, + "output_price": 975000, + "cache_read_price": 39000, + "cache_write_price": 243750 + }, + { + "provider": "openrouter", + "model": "qwen/qwen3-coder-next", + "input_price": 120000, + "output_price": 800000, + "cache_read_price": 70000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3-coder-plus", + "input_price": 650000, + "output_price": 3250000, + "cache_read_price": 130000, + "cache_write_price": 812500 + }, + { + "provider": "openrouter", + "model": "qwen/qwen3-max", + "input_price": 780000, + "output_price": 3900000, + "cache_read_price": 156000, + "cache_write_price": 975000 + }, + { + "provider": "openrouter", + "model": "qwen/qwen3-max-thinking", + "input_price": 780000, + "output_price": 3900000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3-next-80b-a3b-instruct", + "input_price": 90000, + "output_price": 1100000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3-next-80b-a3b-thinking", + "input_price": 150000, + "output_price": 1200000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3-vl-235b-a22b-instruct", + "input_price": 210000, + "output_price": 1900000, + "cache_read_price": 100000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3-vl-235b-a22b-thinking", + "input_price": 980000, + "output_price": 3950000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3-vl-30b-a3b-instruct", + "input_price": 150000, + "output_price": 600000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3-vl-30b-a3b-thinking", + "input_price": 200000, + "output_price": 2400000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3-vl-32b-instruct", + "input_price": 104000, + "output_price": 416000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3-vl-8b-instruct", + "input_price": 117000, + "output_price": 455000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3-vl-8b-thinking", + "input_price": 180000, + "output_price": 2100000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3.5-122b-a10b", + "input_price": 260000, + "output_price": 2080000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3.5-27b", + "input_price": 195000, + "output_price": 1560000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3.5-35b-a3b", + "input_price": 140000, + "output_price": 1000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3.5-397b-a17b", + "input_price": 390000, + "output_price": 2340000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3.5-9b", + "input_price": 100000, + "output_price": 150000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3.5-flash-02-23", + "input_price": 65000, + "output_price": 260000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3.5-plus-02-15", + "input_price": 260000, + "output_price": 1560000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3.5-plus-20260420", + "input_price": 300000, + "output_price": 1800000, + "cache_read_price": null, + "cache_write_price": 375000 + }, + { + "provider": "openrouter", + "model": "qwen/qwen3.6-27b", + "input_price": 289000, + "output_price": 2400000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3.6-35b-a3b", + "input_price": 140000, + "output_price": 1000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "qwen/qwen3.6-flash", + "input_price": 187500, + "output_price": 1125000, + "cache_read_price": null, + "cache_write_price": 234375 + }, + { + "provider": "openrouter", + "model": "qwen/qwen3.6-max-preview", + "input_price": 1027000, + "output_price": 6162000, + "cache_read_price": null, + "cache_write_price": 1283750 + }, + { + "provider": "openrouter", + "model": "qwen/qwen3.6-plus", + "input_price": 325000, + "output_price": 1950000, + "cache_read_price": null, + "cache_write_price": 406250 + }, + { + "provider": "openrouter", + "model": "qwen/qwen3.7-flash", + "input_price": 30000, + "output_price": 130000, + "cache_read_price": 6000, + "cache_write_price": 38000 + }, + { + "provider": "openrouter", + "model": "qwen/qwen3.7-max", + "input_price": 1475000, + "output_price": 4425000, + "cache_read_price": 295000, + "cache_write_price": 1843750 + }, + { + "provider": "openrouter", + "model": "qwen/qwen3.7-plus", + "input_price": 320000, + "output_price": 1280000, + "cache_read_price": 64000, + "cache_write_price": 400000 + }, + { + "provider": "openrouter", + "model": "qwen/qwen3.8-max", + "input_price": 2000000, + "output_price": 6000000, + "cache_read_price": 250000, + "cache_write_price": 2500000 + }, + { + "provider": "openrouter", + "model": "rekaai/reka-edge", + "input_price": 100000, + "output_price": 100000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "rekaai/reka-flash-3", + "input_price": 100000, + "output_price": 200000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "relace/relace-apply-3", + "input_price": 850000, + "output_price": 1250000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "relace/relace-search", + "input_price": 1000000, + "output_price": 3000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "sakana/fugu-ultra", + "input_price": 5000000, + "output_price": 30000000, + "cache_read_price": 500000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "sao10k/l3-lunaris-8b", + "input_price": 40000, + "output_price": 50000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "sao10k/l3.1-euryale-70b", + "input_price": 850000, + "output_price": 850000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "sao10k/l3.3-euryale-70b", + "input_price": 650000, + "output_price": 750000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "stepfun/step-3.5-flash", + "input_price": 100000, + "output_price": 300000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "stepfun/step-3.7-flash", + "input_price": 200000, + "output_price": 1150000, + "cache_read_price": 40000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "tencent/hunyuan-a13b-instruct", + "input_price": 140000, + "output_price": 570000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "tencent/hy3", + "input_price": 132000, + "output_price": 528000, + "cache_read_price": 33000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "tencent/hy3-preview", + "input_price": 63000, + "output_price": 210000, + "cache_read_price": 21000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "thedrummer/cydonia-24b-v4.1", + "input_price": 300000, + "output_price": 500000, + "cache_read_price": 150000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "thedrummer/rocinante-12b", + "input_price": 250000, + "output_price": 500000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "thedrummer/skyfall-36b-v2", + "input_price": 550000, + "output_price": 800000, + "cache_read_price": 250000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "thedrummer/unslopnemo-12b", + "input_price": 400000, + "output_price": 400000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "thinkingmachines/inkling", + "input_price": 1000000, + "output_price": 4050000, + "cache_read_price": 170000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "thinkingmachines/inkling-small", + "input_price": 500000, + "output_price": 1200000, + "cache_read_price": 100000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "undi95/remm-slerp-l2-13b", + "input_price": 450000, + "output_price": 650000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "upstage/solar-pro-3", + "input_price": 150000, + "output_price": 600000, + "cache_read_price": 15000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "writer/palmyra-x5", + "input_price": 600000, + "output_price": 6000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "x-ai/grok-4.20", + "input_price": 1250000, + "output_price": 2500000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "x-ai/grok-4.20-multi-agent", + "input_price": 1250000, + "output_price": 2500000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "x-ai/grok-4.3", + "input_price": 1250000, + "output_price": 2500000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "x-ai/grok-4.5", + "input_price": 2000000, + "output_price": 6000000, + "cache_read_price": 300000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "x-ai/grok-build-0.1", + "input_price": 1000000, + "output_price": 2000000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "xiaomi/mimo-v2.5", + "input_price": 140000, + "output_price": 280000, + "cache_read_price": 2800, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "xiaomi/mimo-v2.5-pro", + "input_price": 435000, + "output_price": 870000, + "cache_read_price": 3600, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "z-ai/glm-4.5", + "input_price": 600000, + "output_price": 2200000, + "cache_read_price": 110000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "z-ai/glm-4.5-air", + "input_price": 130000, + "output_price": 850000, + "cache_read_price": 25000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "z-ai/glm-4.5v", + "input_price": 600000, + "output_price": 1800000, + "cache_read_price": 110000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "z-ai/glm-4.6", + "input_price": 500000, + "output_price": 2000000, + "cache_read_price": 100000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "z-ai/glm-4.6v", + "input_price": 300000, + "output_price": 900000, + "cache_read_price": 55000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "z-ai/glm-4.7", + "input_price": 400000, + "output_price": 1750000, + "cache_read_price": 80000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "z-ai/glm-4.7-flash", + "input_price": 60000, + "output_price": 400000, + "cache_read_price": 10000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "z-ai/glm-5", + "input_price": 950000, + "output_price": 2550000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "z-ai/glm-5-turbo", + "input_price": 1200000, + "output_price": 4000000, + "cache_read_price": 240000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "z-ai/glm-5.1", + "input_price": 966000, + "output_price": 3036000, + "cache_read_price": 179400, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "z-ai/glm-5.2", + "input_price": 760000, + "output_price": 2420000, + "cache_read_price": 140000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "z-ai/glm-5v-turbo", + "input_price": 1200000, + "output_price": 4000000, + "cache_read_price": 240000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "~anthropic/claude-fable-latest", + "input_price": 10000000, + "output_price": 50000000, + "cache_read_price": 1000000, + "cache_write_price": 12500000 + }, + { + "provider": "openrouter", + "model": "~anthropic/claude-haiku-latest", + "input_price": 1000000, + "output_price": 5000000, + "cache_read_price": 100000, + "cache_write_price": 1250000 + }, + { + "provider": "openrouter", + "model": "~anthropic/claude-opus-latest", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "openrouter", + "model": "~anthropic/claude-sonnet-latest", + "input_price": 2000000, + "output_price": 10000000, + "cache_read_price": 200000, + "cache_write_price": 2500000 + }, + { + "provider": "openrouter", + "model": "~deepseek/deepseek-v4-flash-latest", + "input_price": 90000, + "output_price": 180000, + "cache_read_price": 18000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "~google/gemini-flash-latest", + "input_price": 1500000, + "output_price": 7500000, + "cache_read_price": 150000, + "cache_write_price": 83333 + }, + { + "provider": "openrouter", + "model": "~google/gemini-pro-latest", + "input_price": 2000000, + "output_price": 12000000, + "cache_read_price": 200000, + "cache_write_price": 375000 + }, + { + "provider": "openrouter", + "model": "~moonshotai/kimi-latest", + "input_price": 2900000, + "output_price": 14000000, + "cache_read_price": 290000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "~openai/gpt-latest", + "input_price": 5000000, + "output_price": 30000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "openrouter", + "model": "~openai/gpt-mini-latest", + "input_price": 750000, + "output_price": 4500000, + "cache_read_price": 75000, + "cache_write_price": null + }, + { + "provider": "openrouter", + "model": "~x-ai/grok-latest", + "input_price": 2000000, + "output_price": 6000000, + "cache_read_price": 300000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "alibaba/qwen-3-14b", + "input_price": 120000, + "output_price": 240000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "alibaba/qwen-3-235b", + "input_price": 220000, + "output_price": 880000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "alibaba/qwen-3-30b", + "input_price": 120000, + "output_price": 500000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "alibaba/qwen-3-32b", + "input_price": 160000, + "output_price": 640000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "alibaba/qwen-3.6-max-preview", + "input_price": 1300000, + "output_price": 7800000, + "cache_read_price": 260000, + "cache_write_price": 1625000 + }, + { + "provider": "vercel", + "model": "alibaba/qwen3-235b-a22b-thinking", + "input_price": 400000, + "output_price": 4000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "alibaba/qwen3-coder", + "input_price": 1500000, + "output_price": 7500000, + "cache_read_price": 300000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "alibaba/qwen3-coder-30b-a3b", + "input_price": 150000, + "output_price": 600000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "alibaba/qwen3-coder-next", + "input_price": 500000, + "output_price": 1200000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "alibaba/qwen3-coder-plus", + "input_price": 1000000, + "output_price": 5000000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "alibaba/qwen3-max", + "input_price": 1200000, + "output_price": 6000000, + "cache_read_price": 240000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "alibaba/qwen3-max-preview", + "input_price": 1200000, + "output_price": 6000000, + "cache_read_price": 240000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "alibaba/qwen3-max-thinking", + "input_price": 1200000, + "output_price": 6000000, + "cache_read_price": 240000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "alibaba/qwen3-next-80b-a3b-instruct", + "input_price": 150000, + "output_price": 1200000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "alibaba/qwen3-next-80b-a3b-thinking", + "input_price": 150000, + "output_price": 1200000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "alibaba/qwen3-vl-235b-a22b-instruct", + "input_price": 400000, + "output_price": 1600000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "alibaba/qwen3-vl-instruct", + "input_price": 400000, + "output_price": 1600000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "alibaba/qwen3-vl-thinking", + "input_price": 400000, + "output_price": 4000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "alibaba/qwen3.5-flash", + "input_price": 100000, + "output_price": 400000, + "cache_read_price": 1000, + "cache_write_price": 125000 + }, + { + "provider": "vercel", + "model": "alibaba/qwen3.5-plus", + "input_price": 400000, + "output_price": 2400000, + "cache_read_price": 40000, + "cache_write_price": 500000 + }, + { + "provider": "vercel", + "model": "alibaba/qwen3.6-27b", + "input_price": 600000, + "output_price": 3600000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "alibaba/qwen3.6-plus", + "input_price": 500000, + "output_price": 3000000, + "cache_read_price": 100000, + "cache_write_price": 625000 + }, + { + "provider": "vercel", + "model": "alibaba/qwen3.7-flash", + "input_price": 30000, + "output_price": 130000, + "cache_read_price": 6000, + "cache_write_price": 38000 + }, + { + "provider": "vercel", + "model": "alibaba/qwen3.7-max", + "input_price": 2500000, + "output_price": 7500000, + "cache_read_price": 500000, + "cache_write_price": 3125000 + }, + { + "provider": "vercel", + "model": "alibaba/qwen3.7-plus", + "input_price": 400000, + "output_price": 1600000, + "cache_read_price": 80000, + "cache_write_price": 500000 + }, + { + "provider": "vercel", + "model": "alibaba/qwen3.8-max", + "input_price": 2000000, + "output_price": 6000000, + "cache_read_price": 250000, + "cache_write_price": 2500000 + }, + { + "provider": "vercel", + "model": "amazon/nova-2-lite", + "input_price": 300000, + "output_price": 2500000, + "cache_read_price": 75000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "amazon/nova-lite", + "input_price": 60000, + "output_price": 240000, + "cache_read_price": 15000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "amazon/nova-micro", + "input_price": 35000, + "output_price": 140000, + "cache_read_price": 8750, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "amazon/nova-pro", + "input_price": 800000, + "output_price": 3200000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "anthropic/claude-3-haiku", + "input_price": 250000, + "output_price": 1250000, + "cache_read_price": 30000, + "cache_write_price": 300000 + }, + { + "provider": "vercel", + "model": "anthropic/claude-fable-5", + "input_price": 10000000, + "output_price": 50000000, + "cache_read_price": 1000000, + "cache_write_price": 12500000 + }, + { + "provider": "vercel", + "model": "anthropic/claude-haiku-4.5", + "input_price": 1000000, + "output_price": 5000000, + "cache_read_price": 100000, + "cache_write_price": 1250000 + }, + { + "provider": "vercel", + "model": "anthropic/claude-opus-4", + "input_price": 15000000, + "output_price": 75000000, + "cache_read_price": 1500000, + "cache_write_price": 18750000 + }, + { + "provider": "vercel", + "model": "anthropic/claude-opus-4.1", + "input_price": 15000000, + "output_price": 75000000, + "cache_read_price": 1500000, + "cache_write_price": 18750000 + }, + { + "provider": "vercel", + "model": "anthropic/claude-opus-4.5", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "vercel", + "model": "anthropic/claude-opus-4.6", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "vercel", + "model": "anthropic/claude-opus-4.7", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "vercel", + "model": "anthropic/claude-opus-4.8", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "vercel", + "model": "anthropic/claude-opus-4.8-fast", + "input_price": 10000000, + "output_price": 50000000, + "cache_read_price": 1000000, + "cache_write_price": 12500000 + }, + { + "provider": "vercel", + "model": "anthropic/claude-opus-5", + "input_price": 5000000, + "output_price": 25000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "vercel", + "model": "anthropic/claude-opus-5-fast", + "input_price": 10000000, + "output_price": 50000000, + "cache_read_price": 1000000, + "cache_write_price": 12500000 + }, + { + "provider": "vercel", + "model": "anthropic/claude-sonnet-4", + "input_price": 3000000, + "output_price": 15000000, + "cache_read_price": 300000, + "cache_write_price": 3750000 + }, + { + "provider": "vercel", + "model": "anthropic/claude-sonnet-4.5", + "input_price": 3000000, + "output_price": 15000000, + "cache_read_price": 300000, + "cache_write_price": 3750000 + }, + { + "provider": "vercel", + "model": "anthropic/claude-sonnet-4.6", + "input_price": 3000000, + "output_price": 15000000, + "cache_read_price": 300000, + "cache_write_price": 3750000 + }, + { + "provider": "vercel", + "model": "anthropic/claude-sonnet-5", + "input_price": 2000000, + "output_price": 10000000, + "cache_read_price": 200000, + "cache_write_price": 2500000 + }, + { + "provider": "vercel", + "model": "arcee-ai/trinity-large-thinking", + "input_price": 250000, + "output_price": 900000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "arcee-ai/trinity-mini", + "input_price": 45000, + "output_price": 150000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "bytedance/seed-1.6", + "input_price": 250000, + "output_price": 2000000, + "cache_read_price": 50000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "bytedance/seed-1.8", + "input_price": 250000, + "output_price": 2000000, + "cache_read_price": 50000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "cohere/command-a", + "input_price": 2500000, + "output_price": 10000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "deepseek/deepseek-r1", + "input_price": 1350000, + "output_price": 5400000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "deepseek/deepseek-v3", + "input_price": 270000, + "output_price": 1120000, + "cache_read_price": 135000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "deepseek/deepseek-v3.1", + "input_price": 250000, + "output_price": 950000, + "cache_read_price": 130000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "deepseek/deepseek-v3.1-terminus", + "input_price": 270000, + "output_price": 1000000, + "cache_read_price": 135000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "deepseek/deepseek-v3.2", + "input_price": 280000, + "output_price": 420000, + "cache_read_price": 28000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "deepseek/deepseek-v3.2-thinking", + "input_price": 620000, + "output_price": 1850000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "deepseek/deepseek-v4-flash", + "input_price": 200000, + "output_price": 400000, + "cache_read_price": 40000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "deepseek/deepseek-v4-flash-0731", + "input_price": 130000, + "output_price": 260000, + "cache_read_price": 28000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "deepseek/deepseek-v4-pro", + "input_price": 435000, + "output_price": 870000, + "cache_read_price": 3600, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "google/gemini-2.5-flash", + "input_price": 300000, + "output_price": 2500000, + "cache_read_price": 30000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "google/gemini-2.5-flash-image", + "input_price": 300000, + "output_price": 2500000, + "cache_read_price": 30000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "google/gemini-2.5-flash-lite", + "input_price": 100000, + "output_price": 400000, + "cache_read_price": 10000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "google/gemini-2.5-pro", + "input_price": 1250000, + "output_price": 10000000, + "cache_read_price": 125000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "google/gemini-3-flash", + "input_price": 500000, + "output_price": 3000000, + "cache_read_price": 50000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "google/gemini-3-pro-image", + "input_price": 2000000, + "output_price": 12000000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "google/gemini-3.1-flash-image", + "input_price": 500000, + "output_price": 3000000, + "cache_read_price": 50000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "google/gemini-3.1-flash-image-preview", + "input_price": 500000, + "output_price": 3000000, + "cache_read_price": 50000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "google/gemini-3.1-flash-lite", + "input_price": 250000, + "output_price": 1500000, + "cache_read_price": 30000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "google/gemini-3.1-flash-lite-image", + "input_price": 250000, + "output_price": 1500000, + "cache_read_price": 30000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "google/gemini-3.1-pro-preview", + "input_price": 2000000, + "output_price": 12000000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "google/gemini-3.5-flash", + "input_price": 1500000, + "output_price": 9000000, + "cache_read_price": 150000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "google/gemini-3.5-flash-lite", + "input_price": 300000, + "output_price": 2500000, + "cache_read_price": 30000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "google/gemini-3.6-flash", + "input_price": 1500000, + "output_price": 7500000, + "cache_read_price": 150000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "google/gemini-omni-flash-preview", + "input_price": 1500000, + "output_price": 9000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "google/gemma-4-26b-a4b-it", + "input_price": 150000, + "output_price": 600000, + "cache_read_price": 15000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "google/gemma-4-31b-it", + "input_price": 140000, + "output_price": 400000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "inception/mercury-2", + "input_price": 250000, + "output_price": 750000, + "cache_read_price": 25000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "inception/mercury-coder-small", + "input_price": 250000, + "output_price": 1000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "inclusionai/ling-3.0-flash-free", + "input_price": 0, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "interfaze/interfaze-beta", + "input_price": 1500000, + "output_price": 3500000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "kwaipilot/kat-coder-air-v2.5", + "input_price": 150000, + "output_price": 600000, + "cache_read_price": 30000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "kwaipilot/kat-coder-pro-v1", + "input_price": 300000, + "output_price": 1200000, + "cache_read_price": 60000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "kwaipilot/kat-coder-pro-v2", + "input_price": 300000, + "output_price": 1200000, + "cache_read_price": 60000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "kwaipilot/kat-coder-pro-v2.5", + "input_price": 740000, + "output_price": 2960000, + "cache_read_price": 150000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "meta/llama-3.1-70b", + "input_price": 720000, + "output_price": 720000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "meta/llama-3.1-8b", + "input_price": 220000, + "output_price": 220000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "meta/llama-3.3-70b", + "input_price": 0, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "meta/llama-4-maverick", + "input_price": 0, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "meta/llama-4-scout", + "input_price": 0, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "meta/muse-spark-1.1", + "input_price": 1250000, + "output_price": 4250000, + "cache_read_price": 150000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "minimax/minimax-m2", + "input_price": 300000, + "output_price": 1200000, + "cache_read_price": 30000, + "cache_write_price": 375000 + }, + { + "provider": "vercel", + "model": "minimax/minimax-m2.1", + "input_price": 300000, + "output_price": 1200000, + "cache_read_price": 30000, + "cache_write_price": 375000 + }, + { + "provider": "vercel", + "model": "minimax/minimax-m2.1-lightning", + "input_price": 300000, + "output_price": 2400000, + "cache_read_price": 30000, + "cache_write_price": 375000 + }, + { + "provider": "vercel", + "model": "minimax/minimax-m2.5", + "input_price": 300000, + "output_price": 1200000, + "cache_read_price": 30000, + "cache_write_price": 375000 + }, + { + "provider": "vercel", + "model": "minimax/minimax-m2.5-highspeed", + "input_price": 600000, + "output_price": 2400000, + "cache_read_price": 30000, + "cache_write_price": 375000 + }, + { + "provider": "vercel", + "model": "minimax/minimax-m2.7", + "input_price": 300000, + "output_price": 1200000, + "cache_read_price": 60000, + "cache_write_price": 375000 + }, + { + "provider": "vercel", + "model": "minimax/minimax-m2.7-highspeed", + "input_price": 600000, + "output_price": 2400000, + "cache_read_price": 60000, + "cache_write_price": 375000 + }, + { + "provider": "vercel", + "model": "minimax/minimax-m3", + "input_price": 300000, + "output_price": 1200000, + "cache_read_price": 60000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "mistral/codestral", + "input_price": 300000, + "output_price": 900000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "mistral/devstral-2", + "input_price": 400000, + "output_price": 2000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "mistral/devstral-small-2", + "input_price": 100000, + "output_price": 300000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "mistral/magistral-medium", + "input_price": 2000000, + "output_price": 5000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "mistral/magistral-small", + "input_price": 500000, + "output_price": 1500000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "mistral/ministral-14b", + "input_price": 200000, + "output_price": 200000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "mistral/ministral-3b", + "input_price": 40000, + "output_price": 40000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "mistral/ministral-8b", + "input_price": 100000, + "output_price": 100000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "mistral/mistral-large-3", + "input_price": 500000, + "output_price": 1500000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "mistral/mistral-medium", + "input_price": 400000, + "output_price": 2000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "mistral/mistral-medium-3.5", + "input_price": 1500000, + "output_price": 7500000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "mistral/mistral-nemo", + "input_price": 150000, + "output_price": 150000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "mistral/mistral-small", + "input_price": 100000, + "output_price": 300000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "mistral/pixtral-12b", + "input_price": 150000, + "output_price": 150000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "moonshotai/kimi-k2", + "input_price": 570000, + "output_price": 2300000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "moonshotai/kimi-k2-thinking", + "input_price": 470000, + "output_price": 2000000, + "cache_read_price": 141000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "moonshotai/kimi-k2.5", + "input_price": 600000, + "output_price": 3000000, + "cache_read_price": 100000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "moonshotai/kimi-k2.6", + "input_price": 950000, + "output_price": 4000000, + "cache_read_price": 160000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "moonshotai/kimi-k2.7-code", + "input_price": 950000, + "output_price": 4000000, + "cache_read_price": 190000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "moonshotai/kimi-k2.7-code-highspeed", + "input_price": 1900000, + "output_price": 8000000, + "cache_read_price": 380000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "moonshotai/kimi-k3", + "input_price": 3000000, + "output_price": 15000000, + "cache_read_price": 300000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "moonshotai/kimi-k3-fast", + "input_price": 4500000, + "output_price": 22500000, + "cache_read_price": 450000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "morph/morph-v3-fast", + "input_price": 800000, + "output_price": 1200000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "morph/morph-v3-large", + "input_price": 900000, + "output_price": 1900000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "nvidia/nemotron-3-nano-30b-a3b", + "input_price": 50000, + "output_price": 240000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "nvidia/nemotron-3-super-120b-a12b", + "input_price": 150000, + "output_price": 650000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "nvidia/nemotron-3-ultra-550b-a55b", + "input_price": 600000, + "output_price": 2400000, + "cache_read_price": 120000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "nvidia/nemotron-nano-12b-v2-vl", + "input_price": 200000, + "output_price": 600000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "nvidia/nemotron-nano-9b-v2", + "input_price": 60000, + "output_price": 230000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-3.5-turbo", + "input_price": 500000, + "output_price": 1500000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-4-turbo", + "input_price": 10000000, + "output_price": 30000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-4.1", + "input_price": 2000000, + "output_price": 8000000, + "cache_read_price": 500000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-4.1-mini", + "input_price": 400000, + "output_price": 1600000, + "cache_read_price": 100000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-4.1-nano", + "input_price": 100000, + "output_price": 400000, + "cache_read_price": 25000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-4o", + "input_price": 2500000, + "output_price": 10000000, + "cache_read_price": 1250000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-4o-mini", + "input_price": 150000, + "output_price": 600000, + "cache_read_price": 75000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-4o-mini-search-preview", + "input_price": 150000, + "output_price": 600000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-4o-mini-transcribe", + "input_price": 1250000, + "output_price": 5000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-4o-transcribe", + "input_price": 2500000, + "output_price": 10000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-5", + "input_price": 1250000, + "output_price": 10000000, + "cache_read_price": 125000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-5-codex", + "input_price": 1250000, + "output_price": 10000000, + "cache_read_price": 130000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-5-mini", + "input_price": 250000, + "output_price": 2000000, + "cache_read_price": 25000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-5-nano", + "input_price": 50000, + "output_price": 400000, + "cache_read_price": 5000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-5-pro", + "input_price": 15000000, + "output_price": 120000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-5.1-codex", + "input_price": 1250000, + "output_price": 10000000, + "cache_read_price": 130000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-5.1-codex-max", + "input_price": 1250000, + "output_price": 10000000, + "cache_read_price": 125000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-5.1-codex-mini", + "input_price": 250000, + "output_price": 2000000, + "cache_read_price": 30000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-5.1-instant", + "input_price": 1250000, + "output_price": 10000000, + "cache_read_price": 130000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-5.1-thinking", + "input_price": 1250000, + "output_price": 10000000, + "cache_read_price": 125000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-5.2", + "input_price": 1750000, + "output_price": 14000000, + "cache_read_price": 175000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-5.2-codex", + "input_price": 1750000, + "output_price": 14000000, + "cache_read_price": 175000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-5.2-pro", + "input_price": 21000000, + "output_price": 168000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-5.3-chat", + "input_price": 1750000, + "output_price": 14000000, + "cache_read_price": 175000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-5.3-codex", + "input_price": 1750000, + "output_price": 14000000, + "cache_read_price": 175000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-5.4", + "input_price": 2500000, + "output_price": 15000000, + "cache_read_price": 250000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-5.4-mini", + "input_price": 750000, + "output_price": 4500000, + "cache_read_price": 75000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-5.4-nano", + "input_price": 200000, + "output_price": 1250000, + "cache_read_price": 20000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-5.4-pro", + "input_price": 30000000, + "output_price": 180000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-5.5", + "input_price": 5000000, + "output_price": 30000000, + "cache_read_price": 500000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-5.5-pro", + "input_price": 30000000, + "output_price": 180000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-5.6-luna", + "input_price": 200000, + "output_price": 1200000, + "cache_read_price": 20000, + "cache_write_price": 250000 + }, + { + "provider": "vercel", + "model": "openai/gpt-5.6-sol", + "input_price": 5000000, + "output_price": 30000000, + "cache_read_price": 500000, + "cache_write_price": 6250000 + }, + { + "provider": "vercel", + "model": "openai/gpt-5.6-terra", + "input_price": 2000000, + "output_price": 12000000, + "cache_read_price": 200000, + "cache_write_price": 2500000 + }, + { + "provider": "vercel", + "model": "openai/gpt-image-1", + "input_price": 5000000, + "output_price": 40000000, + "cache_read_price": 1250000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-image-1-mini", + "input_price": 2000000, + "output_price": 8000000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-image-1.5", + "input_price": 5000000, + "output_price": 32000000, + "cache_read_price": 1250000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-image-2", + "input_price": 5000000, + "output_price": 30000000, + "cache_read_price": 1250000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-oss-120b", + "input_price": 100000, + "output_price": 500000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-oss-20b", + "input_price": 50000, + "output_price": 200000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-oss-safeguard-20b", + "input_price": 75000, + "output_price": 300000, + "cache_read_price": 37000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-realtime-1.5", + "input_price": 4000000, + "output_price": 16000000, + "cache_read_price": 400000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-realtime-2", + "input_price": 4000000, + "output_price": 24000000, + "cache_read_price": 400000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-realtime-2.1", + "input_price": 4000000, + "output_price": 24000000, + "cache_read_price": 400000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/gpt-realtime-mini", + "input_price": 600000, + "output_price": 2400000, + "cache_read_price": 60000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/o1", + "input_price": 15000000, + "output_price": 60000000, + "cache_read_price": 7500000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/o3", + "input_price": 2000000, + "output_price": 8000000, + "cache_read_price": 500000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/o3-deep-research", + "input_price": 10000000, + "output_price": 40000000, + "cache_read_price": 2500000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/o3-mini", + "input_price": 1100000, + "output_price": 4400000, + "cache_read_price": 550000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/o3-pro", + "input_price": 20000000, + "output_price": 80000000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "openai/o4-mini", + "input_price": 1100000, + "output_price": 4400000, + "cache_read_price": 275000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "poolside/laguna-s-2.1", + "input_price": 100000, + "output_price": 200000, + "cache_read_price": 10000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "poolside/laguna-s-2.1-free", + "input_price": 0, + "output_price": 0, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "sakana/fugu-ultra", + "input_price": 5000000, + "output_price": 30000000, + "cache_read_price": 500000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "stepfun/step-3.5-flash", + "input_price": 90000, + "output_price": 300000, + "cache_read_price": 20000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "stepfun/step-3.7-flash", + "input_price": 200000, + "output_price": 1150000, + "cache_read_price": 40000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "tencent/hy3", + "input_price": 140000, + "output_price": 580000, + "cache_read_price": 35000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "thinkingmachines/inkling", + "input_price": 1000000, + "output_price": 4050000, + "cache_read_price": 170000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "thinkingmachines/inkling-small", + "input_price": 500000, + "output_price": 1200000, + "cache_read_price": 100000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "xai/grok-4.1-fast-non-reasoning", + "input_price": 200000, + "output_price": 500000, + "cache_read_price": 50000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "xai/grok-4.1-fast-reasoning", + "input_price": 200000, + "output_price": 500000, + "cache_read_price": 50000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "xai/grok-4.20-multi-agent", + "input_price": 1250000, + "output_price": 2500000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "xai/grok-4.20-multi-agent-beta", + "input_price": 1250000, + "output_price": 2500000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "xai/grok-4.20-non-reasoning", + "input_price": 1250000, + "output_price": 2500000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "xai/grok-4.20-non-reasoning-beta", + "input_price": 1250000, + "output_price": 2500000, + "cache_read_price": 400000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "xai/grok-4.20-reasoning", + "input_price": 1250000, + "output_price": 2500000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "xai/grok-4.20-reasoning-beta", + "input_price": 1250000, + "output_price": 2500000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "xai/grok-4.3", + "input_price": 1250000, + "output_price": 2500000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "xai/grok-4.5", + "input_price": 2000000, + "output_price": 6000000, + "cache_read_price": 300000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "xai/grok-build-0.1", + "input_price": 1000000, + "output_price": 2000000, + "cache_read_price": 200000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "xiaomi/mimo-v2.5", + "input_price": 140000, + "output_price": 280000, + "cache_read_price": 2800, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "xiaomi/mimo-v2.5-pro", + "input_price": 435000, + "output_price": 870000, + "cache_read_price": 3600, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "zai/glm-4.5", + "input_price": 600000, + "output_price": 2200000, + "cache_read_price": 110000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "zai/glm-4.5-air", + "input_price": 200000, + "output_price": 1100000, + "cache_read_price": 30000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "zai/glm-4.5v", + "input_price": 600000, + "output_price": 1800000, + "cache_read_price": 110000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "zai/glm-4.6", + "input_price": 600000, + "output_price": 2200000, + "cache_read_price": 110000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "zai/glm-4.6v", + "input_price": 300000, + "output_price": 900000, + "cache_read_price": 50000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "zai/glm-4.7", + "input_price": 600000, + "output_price": 2200000, + "cache_read_price": 120000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "zai/glm-4.7-flash", + "input_price": 70000, + "output_price": 400000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "zai/glm-4.7-flashx", + "input_price": 60000, + "output_price": 400000, + "cache_read_price": 10000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "zai/glm-5", + "input_price": 1000000, + "output_price": 3200000, + "cache_read_price": null, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "zai/glm-5-turbo", + "input_price": 1200000, + "output_price": 4000000, + "cache_read_price": 240000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "zai/glm-5.1", + "input_price": 1400000, + "output_price": 4400000, + "cache_read_price": 260000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "zai/glm-5.2", + "input_price": 1100000, + "output_price": 3851000, + "cache_read_price": 275000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "zai/glm-5.2-fast", + "input_price": 2100000, + "output_price": 6600000, + "cache_read_price": 210000, + "cache_write_price": null + }, + { + "provider": "vercel", + "model": "zai/glm-5v-turbo", + "input_price": 1200000, + "output_price": 4000000, + "cache_read_price": 240000, + "cache_write_price": null } ] diff --git a/scripts/aibridgepricesgen/curation.json b/scripts/aibridgepricesgen/curation.json index b528c8d0d33..be22f21e86a 100644 --- a/scripts/aibridgepricesgen/curation.json +++ b/scripts/aibridgepricesgen/curation.json @@ -1,4 +1,115 @@ { + "anthropic": [ + { + "modelIdentifier": "claude-fable-5", + "reasoningEffort": "high" + }, + { + "modelIdentifier": "claude-mythos-5", + "reasoningEffort": "high" + }, + { + "modelIdentifier": "claude-opus-4-8", + "reasoningEffort": "high" + }, + { + "modelIdentifier": "claude-opus-4-7", + "reasoningEffort": "high" + }, + { + "modelIdentifier": "claude-opus-4-6", + "reasoningEffort": "high" + }, + { + "modelIdentifier": "claude-sonnet-5", + "reasoningEffort": "high" + }, + { + "modelIdentifier": "claude-sonnet-4-6", + "reasoningEffort": "medium" + }, + { + "modelIdentifier": "claude-haiku-4-5", + "aliases": ["claude-haiku-4-5-20251001"], + "displayName": "Claude Haiku 4.5", + "thinkingBudgetTokens": 8192 + }, + { + "modelIdentifier": "claude-sonnet-4-5", + "aliases": ["claude-sonnet-4-5-20250929"], + "displayName": "Claude Sonnet 4.5", + "thinkingBudgetTokens": 8192 + } + ], + "azure": [ + { + "modelIdentifier": "claude-fable-5" + }, + { + "modelIdentifier": "claude-opus-5" + }, + { + "modelIdentifier": "claude-sonnet-5" + }, + { + "modelIdentifier": "claude-opus-4-8" + }, + { + "modelIdentifier": "claude-sonnet-4-6" + }, + { + "modelIdentifier": "claude-haiku-4-5" + }, + { + "modelIdentifier": "gpt-5.6-sol" + }, + { + "modelIdentifier": "gpt-5.6-terra" + }, + { + "modelIdentifier": "gpt-5.6-luna" + }, + { + "modelIdentifier": "gpt-5.5" + }, + { + "modelIdentifier": "deepseek-v4-flash" + } + ], + "bedrock": [ + { + "modelIdentifier": "anthropic.claude-haiku-4-5-20251001-v1:0", + "aliases": ["global.anthropic.claude-haiku-4-5-20251001-v1:0"] + }, + { + "modelIdentifier": "anthropic.claude-sonnet-5", + "aliases": ["global.anthropic.claude-sonnet-5"] + }, + { + "modelIdentifier": "anthropic.claude-opus-5", + "aliases": ["global.anthropic.claude-opus-5"] + }, + { + "modelIdentifier": "anthropic.claude-fable-5", + "aliases": ["global.anthropic.claude-fable-5"] + }, + { + "modelIdentifier": "anthropic.claude-sonnet-4-6", + "aliases": ["global.anthropic.claude-sonnet-4-6"] + }, + { + "modelIdentifier": "anthropic.claude-opus-4-8", + "aliases": ["global.anthropic.claude-opus-4-8"] + } + ], + "google": [ + { + "modelIdentifier": "gemini-flash-latest" + }, + { + "modelIdentifier": "gemini-3.6-flash" + } + ], "openai": [ { "modelIdentifier": "gpt-5.6-sol", @@ -36,46 +147,98 @@ "reasoningEffort": "medium" } ], - "anthropic": [ + "openrouter": [ { - "modelIdentifier": "claude-fable-5", - "reasoningEffort": "high" + "modelIdentifier": "openai/gpt-5.6-sol" }, { - "modelIdentifier": "claude-mythos-5", - "reasoningEffort": "high" + "modelIdentifier": "openai/gpt-5.6-terra" }, { - "modelIdentifier": "claude-opus-4-8", - "reasoningEffort": "high" + "modelIdentifier": "openai/gpt-5.6-luna" }, { - "modelIdentifier": "claude-opus-4-7", - "reasoningEffort": "high" + "modelIdentifier": "openai/gpt-oss-120b" }, { - "modelIdentifier": "claude-opus-4-6", - "reasoningEffort": "high" + "modelIdentifier": "moonshotai/kimi-k3" }, { - "modelIdentifier": "claude-sonnet-5", - "reasoningEffort": "high" + "modelIdentifier": "z-ai/glm-5.2" }, { - "modelIdentifier": "claude-sonnet-4-6", - "reasoningEffort": "medium" + "modelIdentifier": "anthropic/claude-fable-5" }, { - "modelIdentifier": "claude-haiku-4-5", - "aliases": ["claude-haiku-4-5-20251001"], - "displayName": "Claude Haiku 4.5", - "thinkingBudgetTokens": 8192 + "modelIdentifier": "anthropic/claude-opus-5" }, { - "modelIdentifier": "claude-sonnet-4-5", - "aliases": ["claude-sonnet-4-5-20250929"], - "displayName": "Claude Sonnet 4.5", - "thinkingBudgetTokens": 8192 + "modelIdentifier": "anthropic/claude-sonnet-5" + }, + { + "modelIdentifier": "anthropic/claude-opus-4.8" + }, + { + "modelIdentifier": "anthropic/claude-sonnet-4.6" + }, + { + "modelIdentifier": "anthropic/claude-haiku-4.5" + }, + { + "modelIdentifier": "deepseek/deepseek-v4-flash" + }, + { + "modelIdentifier": "deepseek/deepseek-v4-pro" + }, + { + "modelIdentifier": "qwen/qwen3.8-max" + }, + { + "modelIdentifier": "qwen/qwen3-coder-next" + } + ], + "vercel": [ + { + "modelIdentifier": "openai/gpt-5.6-sol" + }, + { + "modelIdentifier": "openai/gpt-5.6-terra" + }, + { + "modelIdentifier": "openai/gpt-5.6-luna" + }, + { + "modelIdentifier": "openai/gpt-oss-120b" + }, + { + "modelIdentifier": "moonshotai/kimi-k3" + }, + { + "modelIdentifier": "zai/glm-5.2" + }, + { + "modelIdentifier": "anthropic/claude-fable-5" + }, + { + "modelIdentifier": "anthropic/claude-opus-5" + }, + { + "modelIdentifier": "anthropic/claude-sonnet-5" + }, + { + "modelIdentifier": "anthropic/claude-opus-4.8" + }, + { + "modelIdentifier": "anthropic/claude-sonnet-4.6" + }, + { + "modelIdentifier": "anthropic/claude-haiku-4.5" + }, + { + "modelIdentifier": "deepseek/deepseek-v4-flash" + }, + { + "modelIdentifier": "deepseek/deepseek-v4-pro" } ] } diff --git a/scripts/aibridgepricesgen/main.go b/scripts/aibridgepricesgen/main.go index 19778c357f3..51ad5bb8bda 100644 --- a/scripts/aibridgepricesgen/main.go +++ b/scripts/aibridgepricesgen/main.go @@ -27,7 +27,16 @@ import ( // supportedProviders lists the providers we ship prices for. Adding a // provider here is enough to include it on the next regeneration. -var supportedProviders = []string{"anthropic", "openai"} +var supportedProviders = []string{ + "anthropic", + "azure", + "bedrock", + "copilot", + "google", + "openai", + "openrouter", + "vercel", +} // upstreamProvider is the subset of a models.dev per-provider entry we read. type upstreamProvider struct { diff --git a/scripts/aibridgepricesgen/overrides.jq b/scripts/aibridgepricesgen/overrides.jq index cc1b424a1f8..12c3985654e 100644 --- a/scripts/aibridgepricesgen/overrides.jq +++ b/scripts/aibridgepricesgen/overrides.jq @@ -30,3 +30,18 @@ end | .name = "Claude Mythos 5" ) end + +# Mapping of provider names on models.dev to our own names +# Ref. table definition for ai_provider_type +# amazon-bedrock -> bedrock +# github-copilot -> copilot +| if (has("amazon-bedrock") | not) then + error("overrides.jq: amazon-bedrock not present upstream; drop or update the rename") +else + .bedrock = ."amazon-bedrock" | del(."amazon-bedrock") +end +| if (has("github-copilot") | not) then + error("overrides.jq: github-copilot not present upstream; drop or update the rename") +else + .copilot = ."github-copilot" | del(."github-copilot") +end diff --git a/site/src/pages/AgentsPage/components/ChatModelAdminPanel/knownModels/index.test.ts b/site/src/pages/AgentsPage/components/ChatModelAdminPanel/knownModels/index.test.ts index 53c9fa3a3b9..80a7ecc47a8 100644 --- a/site/src/pages/AgentsPage/components/ChatModelAdminPanel/knownModels/index.test.ts +++ b/site/src/pages/AgentsPage/components/ChatModelAdminPanel/knownModels/index.test.ts @@ -50,7 +50,7 @@ describe("formatContextBadge", () => { describe("getKnownModelsForProvider", () => { it("returns unsupported provider as an empty list", () => { - expect(getKnownModelsForProvider("azure")).toEqual([]); + expect(getKnownModelsForProvider("openai-compat")).toEqual([]); }); it("returns empty provider as an empty list", () => { diff --git a/site/src/pages/AgentsPage/components/ChatModelAdminPanel/knownModels/knownModelsGenerated.json b/site/src/pages/AgentsPage/components/ChatModelAdminPanel/knownModels/knownModelsGenerated.json index bfcb8c0a23a..5ae75467a28 100644 --- a/site/src/pages/AgentsPage/components/ChatModelAdminPanel/knownModels/knownModelsGenerated.json +++ b/site/src/pages/AgentsPage/components/ChatModelAdminPanel/knownModels/knownModelsGenerated.json @@ -118,6 +118,234 @@ "cacheWriteCost": 3.75 } ], + "azure": [ + { + "provider": "azure", + "modelIdentifier": "claude-fable-5", + "displayName": "Claude Fable 5", + "aliases": [], + "contextLimit": 1000000, + "maxOutputTokens": 128000, + "inputCost": 10, + "outputCost": 50, + "cacheReadCost": 1, + "cacheWriteCost": 12.5 + }, + { + "provider": "azure", + "modelIdentifier": "claude-opus-5", + "displayName": "Claude Opus 5", + "aliases": [], + "contextLimit": 1000000, + "maxOutputTokens": 128000, + "inputCost": 5, + "outputCost": 25, + "cacheReadCost": 0.5, + "cacheWriteCost": 6.25 + }, + { + "provider": "azure", + "modelIdentifier": "claude-sonnet-5", + "displayName": "Claude Sonnet 5", + "aliases": [], + "contextLimit": 1000000, + "maxOutputTokens": 128000, + "inputCost": 2, + "outputCost": 10, + "cacheReadCost": 0.2, + "cacheWriteCost": 2.5 + }, + { + "provider": "azure", + "modelIdentifier": "claude-opus-4-8", + "displayName": "Claude Opus 4.8", + "aliases": [], + "contextLimit": 1000000, + "maxOutputTokens": 128000, + "inputCost": 5, + "outputCost": 25, + "cacheReadCost": 0.5, + "cacheWriteCost": 6.25 + }, + { + "provider": "azure", + "modelIdentifier": "claude-sonnet-4-6", + "displayName": "Claude Sonnet 4.6", + "aliases": [], + "contextLimit": 1000000, + "maxOutputTokens": 64000, + "inputCost": 3, + "outputCost": 15, + "cacheReadCost": 0.3, + "cacheWriteCost": 3.75 + }, + { + "provider": "azure", + "modelIdentifier": "claude-haiku-4-5", + "displayName": "Claude Haiku 4.5", + "aliases": [], + "contextLimit": 200000, + "maxOutputTokens": 64000, + "inputCost": 1, + "outputCost": 5, + "cacheReadCost": 0.1, + "cacheWriteCost": 1.25 + }, + { + "provider": "azure", + "modelIdentifier": "gpt-5.6-sol", + "displayName": "GPT-5.6 Sol", + "aliases": [], + "contextLimit": 1050000, + "maxOutputTokens": 128000, + "inputCost": 5, + "outputCost": 30, + "cacheReadCost": 0.5 + }, + { + "provider": "azure", + "modelIdentifier": "gpt-5.6-terra", + "displayName": "GPT-5.6 Terra", + "aliases": [], + "contextLimit": 1050000, + "maxOutputTokens": 128000, + "inputCost": 2.5, + "outputCost": 15, + "cacheReadCost": 0.25, + "cacheWriteCost": 3.125 + }, + { + "provider": "azure", + "modelIdentifier": "gpt-5.6-luna", + "displayName": "GPT-5.6 Luna", + "aliases": [], + "contextLimit": 1050000, + "maxOutputTokens": 128000, + "inputCost": 1, + "outputCost": 6, + "cacheReadCost": 0.1, + "cacheWriteCost": 1.25 + }, + { + "provider": "azure", + "modelIdentifier": "gpt-5.5", + "displayName": "GPT-5.5", + "aliases": [], + "contextLimit": 1050000, + "maxOutputTokens": 128000, + "inputCost": 5, + "outputCost": 30, + "cacheReadCost": 0.5 + }, + { + "provider": "azure", + "modelIdentifier": "deepseek-v4-flash", + "displayName": "DeepSeek-V4-Flash", + "aliases": [], + "contextLimit": 1000000, + "maxOutputTokens": 384000, + "inputCost": 0.19, + "outputCost": 0.51 + } + ], + "bedrock": [ + { + "provider": "bedrock", + "modelIdentifier": "anthropic.claude-haiku-4-5-20251001-v1:0", + "displayName": "Claude Haiku 4.5", + "aliases": ["global.anthropic.claude-haiku-4-5-20251001-v1:0"], + "contextLimit": 200000, + "maxOutputTokens": 64000, + "inputCost": 1, + "outputCost": 5, + "cacheReadCost": 0.1, + "cacheWriteCost": 1.25 + }, + { + "provider": "bedrock", + "modelIdentifier": "anthropic.claude-sonnet-5", + "displayName": "Claude Sonnet 5", + "aliases": ["global.anthropic.claude-sonnet-5"], + "contextLimit": 1000000, + "maxOutputTokens": 128000, + "inputCost": 2, + "outputCost": 10, + "cacheReadCost": 0.2, + "cacheWriteCost": 2.5 + }, + { + "provider": "bedrock", + "modelIdentifier": "anthropic.claude-opus-5", + "displayName": "Claude Opus 5", + "aliases": ["global.anthropic.claude-opus-5"], + "contextLimit": 1000000, + "maxOutputTokens": 128000, + "inputCost": 5, + "outputCost": 25, + "cacheReadCost": 0.5, + "cacheWriteCost": 6.25 + }, + { + "provider": "bedrock", + "modelIdentifier": "anthropic.claude-fable-5", + "displayName": "Claude Fable 5", + "aliases": ["global.anthropic.claude-fable-5"], + "contextLimit": 1000000, + "maxOutputTokens": 128000, + "inputCost": 10, + "outputCost": 50, + "cacheReadCost": 1, + "cacheWriteCost": 12.5 + }, + { + "provider": "bedrock", + "modelIdentifier": "anthropic.claude-sonnet-4-6", + "displayName": "Claude Sonnet 4.6", + "aliases": ["global.anthropic.claude-sonnet-4-6"], + "contextLimit": 1000000, + "maxOutputTokens": 64000, + "inputCost": 3, + "outputCost": 15, + "cacheReadCost": 0.3, + "cacheWriteCost": 3.75 + }, + { + "provider": "bedrock", + "modelIdentifier": "anthropic.claude-opus-4-8", + "displayName": "Claude Opus 4.8", + "aliases": ["global.anthropic.claude-opus-4-8"], + "contextLimit": 1000000, + "maxOutputTokens": 128000, + "inputCost": 5, + "outputCost": 25, + "cacheReadCost": 0.5, + "cacheWriteCost": 6.25 + } + ], + "google": [ + { + "provider": "google", + "modelIdentifier": "gemini-flash-latest", + "displayName": "Gemini Flash Latest", + "aliases": [], + "contextLimit": 1048576, + "maxOutputTokens": 65536, + "inputCost": 1.5, + "outputCost": 9, + "cacheReadCost": 0.15 + }, + { + "provider": "google", + "modelIdentifier": "gemini-3.6-flash", + "displayName": "Gemini 3.6 Flash", + "aliases": [], + "contextLimit": 1048576, + "maxOutputTokens": 65536, + "inputCost": 1.5, + "outputCost": 7.5, + "cacheReadCost": 0.15 + } + ], "openai": [ { "provider": "openai", @@ -140,10 +368,10 @@ "contextLimit": 1050000, "maxOutputTokens": 128000, "reasoningEffort": "medium", - "inputCost": 2.5, - "outputCost": 15, - "cacheReadCost": 0.25, - "cacheWriteCost": 3.125 + "inputCost": 2, + "outputCost": 12, + "cacheReadCost": 0.2, + "cacheWriteCost": 2.5 }, { "provider": "openai", @@ -153,10 +381,10 @@ "contextLimit": 1050000, "maxOutputTokens": 128000, "reasoningEffort": "medium", - "inputCost": 1, - "outputCost": 6, - "cacheReadCost": 0.1, - "cacheWriteCost": 1.25 + "inputCost": 0.2, + "outputCost": 1.2, + "cacheReadCost": 0.02, + "cacheWriteCost": 0.25 }, { "provider": "openai", @@ -227,5 +455,356 @@ "outputCost": 14, "cacheReadCost": 0.175 } + ], + "openrouter": [ + { + "provider": "openrouter", + "modelIdentifier": "openai/gpt-5.6-sol", + "displayName": "GPT-5.6 Sol", + "aliases": [], + "contextLimit": 1050000, + "maxOutputTokens": 128000, + "inputCost": 5, + "outputCost": 30, + "cacheReadCost": 0.5, + "cacheWriteCost": 6.25 + }, + { + "provider": "openrouter", + "modelIdentifier": "openai/gpt-5.6-terra", + "displayName": "GPT-5.6 Terra", + "aliases": [], + "contextLimit": 1050000, + "maxOutputTokens": 128000, + "inputCost": 1, + "outputCost": 6, + "cacheReadCost": 0.1, + "cacheWriteCost": 1.25 + }, + { + "provider": "openrouter", + "modelIdentifier": "openai/gpt-5.6-luna", + "displayName": "GPT-5.6 Luna", + "aliases": [], + "contextLimit": 1050000, + "maxOutputTokens": 128000, + "inputCost": 0.1, + "outputCost": 0.6, + "cacheReadCost": 0.01, + "cacheWriteCost": 0.125 + }, + { + "provider": "openrouter", + "modelIdentifier": "openai/gpt-oss-120b", + "displayName": "GPT OSS 120B", + "aliases": [], + "contextLimit": 131072, + "maxOutputTokens": 131072, + "inputCost": 0.037, + "outputCost": 0.17 + }, + { + "provider": "openrouter", + "modelIdentifier": "moonshotai/kimi-k3", + "displayName": "Kimi K3", + "aliases": [], + "contextLimit": 1048576, + "maxOutputTokens": 1048576, + "inputCost": 3, + "outputCost": 15, + "cacheReadCost": 0.3 + }, + { + "provider": "openrouter", + "modelIdentifier": "z-ai/glm-5.2", + "displayName": "GLM-5.2", + "aliases": [], + "contextLimit": 1048576, + "maxOutputTokens": 262144, + "inputCost": 0.76, + "outputCost": 2.42, + "cacheReadCost": 0.14 + }, + { + "provider": "openrouter", + "modelIdentifier": "anthropic/claude-fable-5", + "displayName": "Claude Fable 5", + "aliases": [], + "contextLimit": 1000000, + "maxOutputTokens": 128000, + "inputCost": 10, + "outputCost": 50, + "cacheReadCost": 1, + "cacheWriteCost": 12.5 + }, + { + "provider": "openrouter", + "modelIdentifier": "anthropic/claude-opus-5", + "displayName": "Claude Opus 5", + "aliases": [], + "contextLimit": 1000000, + "maxOutputTokens": 128000, + "inputCost": 5, + "outputCost": 25, + "cacheReadCost": 0.5, + "cacheWriteCost": 6.25 + }, + { + "provider": "openrouter", + "modelIdentifier": "anthropic/claude-sonnet-5", + "displayName": "Claude Sonnet 5", + "aliases": [], + "contextLimit": 1000000, + "maxOutputTokens": 128000, + "inputCost": 2, + "outputCost": 10, + "cacheReadCost": 0.2, + "cacheWriteCost": 2.5 + }, + { + "provider": "openrouter", + "modelIdentifier": "anthropic/claude-opus-4.8", + "displayName": "Claude Opus 4.8", + "aliases": [], + "contextLimit": 1000000, + "maxOutputTokens": 128000, + "inputCost": 5, + "outputCost": 25, + "cacheReadCost": 0.5, + "cacheWriteCost": 6.25 + }, + { + "provider": "openrouter", + "modelIdentifier": "anthropic/claude-sonnet-4.6", + "displayName": "Claude Sonnet 4.6", + "aliases": [], + "contextLimit": 1000000, + "maxOutputTokens": 128000, + "inputCost": 3, + "outputCost": 15, + "cacheReadCost": 0.3, + "cacheWriteCost": 3.75 + }, + { + "provider": "openrouter", + "modelIdentifier": "anthropic/claude-haiku-4.5", + "displayName": "Claude Haiku 4.5 (latest)", + "aliases": [], + "contextLimit": 200000, + "maxOutputTokens": 64000, + "inputCost": 1, + "outputCost": 5, + "cacheReadCost": 0.1, + "cacheWriteCost": 1.25 + }, + { + "provider": "openrouter", + "modelIdentifier": "deepseek/deepseek-v4-flash", + "displayName": "DeepSeek V4 Flash", + "aliases": [], + "contextLimit": 1048576, + "maxOutputTokens": 393216, + "inputCost": 0.14, + "outputCost": 0.28, + "cacheReadCost": 0.028 + }, + { + "provider": "openrouter", + "modelIdentifier": "deepseek/deepseek-v4-pro", + "displayName": "DeepSeek V4 Pro", + "aliases": [], + "contextLimit": 1048576, + "maxOutputTokens": 384000, + "inputCost": 0.435, + "outputCost": 0.87, + "cacheReadCost": 0.003625 + }, + { + "provider": "openrouter", + "modelIdentifier": "qwen/qwen3.8-max", + "displayName": "Qwen3.8 Max", + "aliases": [], + "contextLimit": 1000000, + "maxOutputTokens": 131072, + "inputCost": 2, + "outputCost": 6, + "cacheReadCost": 0.25, + "cacheWriteCost": 2.5 + }, + { + "provider": "openrouter", + "modelIdentifier": "qwen/qwen3-coder-next", + "displayName": "Qwen3 Coder Next", + "aliases": [], + "contextLimit": 262144, + "maxOutputTokens": 262144, + "inputCost": 0.12, + "outputCost": 0.8, + "cacheReadCost": 0.07 + } + ], + "vercel": [ + { + "provider": "vercel", + "modelIdentifier": "openai/gpt-5.6-sol", + "displayName": "GPT 5.6 Sol", + "aliases": [], + "contextLimit": 1050000, + "maxOutputTokens": 128000, + "inputCost": 5, + "outputCost": 30, + "cacheReadCost": 0.5, + "cacheWriteCost": 6.25 + }, + { + "provider": "vercel", + "modelIdentifier": "openai/gpt-5.6-terra", + "displayName": "GPT 5.6 Terra", + "aliases": [], + "contextLimit": 1050000, + "maxOutputTokens": 128000, + "inputCost": 2, + "outputCost": 12, + "cacheReadCost": 0.2, + "cacheWriteCost": 2.5 + }, + { + "provider": "vercel", + "modelIdentifier": "openai/gpt-5.6-luna", + "displayName": "GPT 5.6 Luna", + "aliases": [], + "contextLimit": 1050000, + "maxOutputTokens": 128000, + "inputCost": 0.2, + "outputCost": 1.2, + "cacheReadCost": 0.02, + "cacheWriteCost": 0.25 + }, + { + "provider": "vercel", + "modelIdentifier": "openai/gpt-oss-120b", + "displayName": "GPT OSS 120B", + "aliases": [], + "contextLimit": 131072, + "maxOutputTokens": 131072, + "inputCost": 0.1, + "outputCost": 0.5 + }, + { + "provider": "vercel", + "modelIdentifier": "moonshotai/kimi-k3", + "displayName": "Kimi K3", + "aliases": [], + "contextLimit": 1000000, + "maxOutputTokens": 131072, + "inputCost": 3, + "outputCost": 15, + "cacheReadCost": 0.3 + }, + { + "provider": "vercel", + "modelIdentifier": "zai/glm-5.2", + "displayName": "GLM 5.2", + "aliases": [], + "contextLimit": 1000000, + "maxOutputTokens": 128000, + "inputCost": 1.1, + "outputCost": 3.851, + "cacheReadCost": 0.275 + }, + { + "provider": "vercel", + "modelIdentifier": "anthropic/claude-fable-5", + "displayName": "Claude Fable 5", + "aliases": [], + "contextLimit": 1000000, + "maxOutputTokens": 128000, + "inputCost": 10, + "outputCost": 50, + "cacheReadCost": 1, + "cacheWriteCost": 12.5 + }, + { + "provider": "vercel", + "modelIdentifier": "anthropic/claude-opus-5", + "displayName": "Claude Opus 5", + "aliases": [], + "contextLimit": 1000000, + "maxOutputTokens": 128000, + "inputCost": 5, + "outputCost": 25, + "cacheReadCost": 0.5, + "cacheWriteCost": 6.25 + }, + { + "provider": "vercel", + "modelIdentifier": "anthropic/claude-sonnet-5", + "displayName": "Claude Sonnet 5", + "aliases": [], + "contextLimit": 1000000, + "maxOutputTokens": 128000, + "inputCost": 2, + "outputCost": 10, + "cacheReadCost": 0.2, + "cacheWriteCost": 2.5 + }, + { + "provider": "vercel", + "modelIdentifier": "anthropic/claude-opus-4.8", + "displayName": "Claude Opus 4.8", + "aliases": [], + "contextLimit": 1000000, + "maxOutputTokens": 128000, + "inputCost": 5, + "outputCost": 25, + "cacheReadCost": 0.5, + "cacheWriteCost": 6.25 + }, + { + "provider": "vercel", + "modelIdentifier": "anthropic/claude-sonnet-4.6", + "displayName": "Claude Sonnet 4.6", + "aliases": [], + "contextLimit": 1000000, + "maxOutputTokens": 128000, + "inputCost": 3, + "outputCost": 15, + "cacheReadCost": 0.3, + "cacheWriteCost": 3.75 + }, + { + "provider": "vercel", + "modelIdentifier": "anthropic/claude-haiku-4.5", + "displayName": "Claude Haiku 4.5", + "aliases": [], + "contextLimit": 200000, + "maxOutputTokens": 64000, + "inputCost": 1, + "outputCost": 5, + "cacheReadCost": 0.1, + "cacheWriteCost": 1.25 + }, + { + "provider": "vercel", + "modelIdentifier": "deepseek/deepseek-v4-flash", + "displayName": "DeepSeek V4 Flash", + "aliases": [], + "contextLimit": 1000000, + "maxOutputTokens": 384000, + "inputCost": 0.2, + "outputCost": 0.4, + "cacheReadCost": 0.04 + }, + { + "provider": "vercel", + "modelIdentifier": "deepseek/deepseek-v4-pro", + "displayName": "DeepSeek V4 Pro", + "aliases": [], + "contextLimit": 1000000, + "maxOutputTokens": 384000, + "inputCost": 0.435, + "outputCost": 0.87, + "cacheReadCost": 0.0036 + } ] } From 2934aa079ad54ded6f8d0c3c568db20915dd8bbb Mon Sep 17 00:00:00 2001 From: Susana Ferreira Date: Mon, 17 Aug 2026 08:23:15 +0100 Subject: [PATCH 38/69] fix: price AI usage by configured provider type (#27836) (#28104) Backport of https://github.com/coder/coder/pull/27836 Original PR: #27836 - fix: price AI usage by configured provider type Merge commit: db88ec3f6ad564c7029e22a2d515b7a031c17ebc Requested by: @ssncferreira --- coderd/aibridgedserver/aibridgedserver.go | 1 + .../aibridgedserver/aibridgedserver_test.go | 338 +++++++++++++++++- coderd/aibridgedserver/cost.go | 33 +- coderd/aibridgedserver/metrics.go | 5 +- docs/admin/integrations/prometheus.md | 2 +- scripts/metricsdocgen/metrics | 2 +- 6 files changed, 357 insertions(+), 24 deletions(-) diff --git a/coderd/aibridgedserver/aibridgedserver.go b/coderd/aibridgedserver/aibridgedserver.go index c9906bd35aa..038286555f7 100644 --- a/coderd/aibridgedserver/aibridgedserver.go +++ b/coderd/aibridgedserver/aibridgedserver.go @@ -78,6 +78,7 @@ type store interface { // Cost-attribution queries, used to snapshot price and effective group on // each token usage record. GetAIBridgeInterceptionByID(ctx context.Context, id uuid.UUID) (database.AIBridgeInterception, error) + GetAIProviderByName(ctx context.Context, name string) (database.AIProvider, error) GetAIModelPriceByProviderModel(ctx context.Context, arg database.GetAIModelPriceByProviderModelParams) (database.AIModelPrice, error) GetUserAIBudgetOverride(ctx context.Context, userID uuid.UUID) (database.UserAIBudgetOverride, error) GetHighestGroupAIBudgetByUser(ctx context.Context, userID uuid.UUID) (database.GetHighestGroupAIBudgetByUserRow, error) diff --git a/coderd/aibridgedserver/aibridgedserver_test.go b/coderd/aibridgedserver/aibridgedserver_test.go index f5641a0531c..8fa4776fb92 100644 --- a/coderd/aibridgedserver/aibridgedserver_test.go +++ b/coderd/aibridgedserver/aibridgedserver_test.go @@ -1684,6 +1684,17 @@ func TestRecordTokenUsage(t *testing.T) { now = time.Date(2026, 6, 25, 14, 30, 0, 0, time.UTC) ) + // Budget resolution falls through to the Everyone group, for cases that vary + // only provider resolution. + expectBudgetLookups := func(db *dbmock.MockStore, intc database.AIBridgeInterception) { + db.EXPECT().GetAIBridgeInterceptionByID(gomock.Any(), intc.ID).Return(intc, nil) + db.EXPECT().GetUserAIBudgetOverride(gomock.Any(), intc.InitiatorID). + Return(database.UserAIBudgetOverride{}, sql.ErrNoRows) + db.EXPECT().GetHighestGroupAIBudgetByUser(gomock.Any(), intc.InitiatorID). + Return(database.GetHighestGroupAIBudgetByUserRow{}, sql.ErrNoRows) + db.EXPECT().GetUserEveryoneFallbackGroup(gomock.Any(), intc.InitiatorID).Return(uuid.New(), nil) + } + testRecordMethod(t, func(srv *aibridgedserver.Server, ctx context.Context, req *proto.RecordTokenUsageRequest) (*proto.RecordTokenUsageResponse, error) { return srv.RecordTokenUsage(ctx, req) @@ -2131,6 +2142,123 @@ func TestRecordTokenUsage(t *testing.T) { db.EXPECT().IncrementUserAIDailySpend(gomock.Any(), gomock.Any()).Times(0) }, }, + { + // An azure provider has the openai upstream wire format but bills at + // its own rates. + name: "openai wire format priced as azure", + request: &proto.RecordTokenUsageRequest{ + InterceptionId: uuid.NewString(), + MsgId: "msg_123", + InputTokens: 100, + CreatedAt: timestamppb.Now(), + }, + setupMocks: func(t *testing.T, db *dbmock.MockStore, req *proto.RecordTokenUsageRequest) { + interceptionID, err := uuid.Parse(req.GetInterceptionId()) + assert.NoError(t, err, "parse interception UUID") + + intc := newTestInterception(interceptionID) + intc.Provider = "openai" + intc.ProviderName = "azure-prod" + intc.Model = "gpt-5-mini" + expectBudgetLookups(db, intc) + + db.EXPECT().GetAIProviderByName(gomock.Any(), intc.ProviderName). + Return(database.AIProvider{Name: intc.ProviderName, Type: database.AIProviderTypeAzure}, nil) + db.EXPECT().GetAIModelPriceByProviderModel(gomock.Any(), database.GetAIModelPriceByProviderModelParams{ + Provider: string(database.AIProviderTypeAzure), + Model: intc.Model, + }).Return(database.AIModelPrice{ + Provider: string(database.AIProviderTypeAzure), + Model: intc.Model, + InputPrice: sql.NullInt64{Int64: 3_000_000, Valid: true}, + }, nil) + + db.EXPECT().InTx(gomock.Any(), nil).DoAndReturn( + func(fn func(database.Store) error, _ *database.TxOptions) error { return fn(db) }, + ) + db.EXPECT().InsertAIBridgeTokenUsage(gomock.Any(), gomock.Cond(func(p database.InsertAIBridgeTokenUsageParams) bool { + return assert.Equal(t, sql.NullInt64{Int64: 3_000_000, Valid: true}, p.InputPriceMicros, "input price") && + assert.Equal(t, sql.NullInt64{Int64: 300, Valid: true}, p.CostMicros, "cost") + })).Return(database.AIBridgeTokenUsage{ID: uuid.New(), InterceptionID: interceptionID}, nil) + db.EXPECT().IncrementUserAIDailySpend(gomock.Any(), gomock.Any()). + Return(database.AIUserDailySpend{}, nil) + }, + }, + { + // A bedrock provider has the anthropic upstream wire format but bills + // at its own rates. + name: "anthropic wire format priced as bedrock", + request: &proto.RecordTokenUsageRequest{ + InterceptionId: uuid.NewString(), + MsgId: "msg_123", + InputTokens: 100, + CreatedAt: timestamppb.Now(), + }, + setupMocks: func(t *testing.T, db *dbmock.MockStore, req *proto.RecordTokenUsageRequest) { + interceptionID, err := uuid.Parse(req.GetInterceptionId()) + assert.NoError(t, err, "parse interception UUID") + + intc := newTestInterception(interceptionID) + intc.ProviderName = "bedrock-eu" + expectBudgetLookups(db, intc) + + db.EXPECT().GetAIProviderByName(gomock.Any(), intc.ProviderName). + Return(database.AIProvider{Name: intc.ProviderName, Type: database.AIProviderTypeBedrock}, nil) + db.EXPECT().GetAIModelPriceByProviderModel(gomock.Any(), database.GetAIModelPriceByProviderModelParams{ + Provider: string(database.AIProviderTypeBedrock), + Model: intc.Model, + }).Return(database.AIModelPrice{ + Provider: string(database.AIProviderTypeBedrock), + Model: intc.Model, + InputPrice: sql.NullInt64{Int64: 3_000_000, Valid: true}, + }, nil) + + db.EXPECT().InTx(gomock.Any(), nil).DoAndReturn( + func(fn func(database.Store) error, _ *database.TxOptions) error { return fn(db) }, + ) + db.EXPECT().InsertAIBridgeTokenUsage(gomock.Any(), gomock.Cond(func(p database.InsertAIBridgeTokenUsageParams) bool { + return assert.Equal(t, sql.NullInt64{Int64: 3_000_000, Valid: true}, p.InputPriceMicros, "input price") && + assert.Equal(t, sql.NullInt64{Int64: 300, Valid: true}, p.CostMicros, "cost") + })).Return(database.AIBridgeTokenUsage{ID: uuid.New(), InterceptionID: interceptionID}, nil) + db.EXPECT().IncrementUserAIDailySpend(gomock.Any(), gomock.Any()). + Return(database.AIUserDailySpend{}, nil) + }, + }, + { + name: "unresolved provider is unpriced", + request: &proto.RecordTokenUsageRequest{ + InterceptionId: uuid.NewString(), + MsgId: "msg_123", + InputTokens: 100, + CreatedAt: timestamppb.Now(), + }, + setupMocks: func(t *testing.T, db *dbmock.MockStore, req *proto.RecordTokenUsageRequest) { + interceptionID, err := uuid.Parse(req.GetInterceptionId()) + assert.NoError(t, err, "parse interception UUID") + + intc := newTestInterception(interceptionID) + expectBudgetLookups(db, intc) + + db.EXPECT().GetAIProviderByName(gomock.Any(), intc.ProviderName). + Return(database.AIProvider{}, sql.ErrNoRows) + // Without a provider there is nothing to key the price on. + db.EXPECT().GetAIModelPriceByProviderModel(gomock.Any(), gomock.Any()).Times(0) + + db.EXPECT().InTx(gomock.Any(), nil).DoAndReturn( + func(fn func(database.Store) error, _ *database.TxOptions) error { return fn(db) }, + ) + db.EXPECT().InsertAIBridgeTokenUsage(gomock.Any(), gomock.Cond(func(p database.InsertAIBridgeTokenUsageParams) bool { + return assert.False(t, p.InputPriceMicros.Valid, "input price null") && + assert.False(t, p.CostMicros.Valid, "cost null") + })).Return(database.AIBridgeTokenUsage{ID: uuid.New(), InterceptionID: interceptionID}, nil) + db.EXPECT().IncrementUserAIDailySpend(gomock.Any(), gomock.Any()).Times(0) + }, + // The metric names the provider that failed to resolve. + assertMetrics: func(t *testing.T, reg *prometheus.Registry) { + require.Equal(t, 1, promhelp.CounterValue(t, reg, "cost_control_unpriced_token_usage_records_total", + prometheus.Labels{"provider": "anthropic-eu", "model": "claude-sonnet-4-6"})) + }, + }, { name: "invalid interception ID", request: &proto.RecordTokenUsageRequest{ @@ -2162,6 +2290,27 @@ func TestRecordTokenUsage(t *testing.T) { }, expectedErr: "get interception", }, + { + name: "provider lookup error", + request: &proto.RecordTokenUsageRequest{ + InterceptionId: uuid.NewString(), + MsgId: "msg_123", + InputTokens: 100, + CreatedAt: timestamppb.Now(), + }, + setupMocks: func(t *testing.T, db *dbmock.MockStore, req *proto.RecordTokenUsageRequest) { + interceptionID, err := uuid.Parse(req.GetInterceptionId()) + assert.NoError(t, err, "parse interception UUID") + + // An unexpected provider lookup error (not sql.ErrNoRows) fails + // the record. + intc := newTestInterception(interceptionID) + expectBudgetLookups(db, intc) + db.EXPECT().GetAIProviderByName(gomock.Any(), intc.ProviderName). + Return(database.AIProvider{}, sql.ErrConnDone) + }, + expectedErr: "get configured provider", + }, { name: "price lookup error", request: &proto.RecordTokenUsageRequest{ @@ -2185,6 +2334,8 @@ func TestRecordTokenUsage(t *testing.T) { Return(database.GetHighestGroupAIBudgetByUserRow{}, sql.ErrNoRows) db.EXPECT().GetUserEveryoneFallbackGroup(gomock.Any(), intc.InitiatorID). Return(uuid.New(), nil) + db.EXPECT().GetAIProviderByName(gomock.Any(), intc.ProviderName). + Return(database.AIProvider{Name: intc.ProviderName, Type: database.AIProviderTypeAnthropic}, nil) db.EXPECT().GetAIModelPriceByProviderModel(gomock.Any(), gomock.Any()). Return(database.AIModelPrice{}, sql.ErrConnDone) }, @@ -2287,10 +2438,18 @@ func TestRecordTokenUsageAuthorized(t *testing.T) { require.NoError(t, err) require.NoError(t, rawDB.UpsertAIModelPrices(ctx, priceSeed), "seed model prices") + // The interception's provider name resolves to this provider, whose type keys + // the price lookup. + aiProvider := dbgen.AIProvider(t, rawDB, database.AIProvider{ + Name: "anthropic-eu", + Type: database.AIProviderTypeAnthropic, + }) + intc := dbgen.AIBridgeInterception(t, rawDB, database.InsertAIBridgeInterceptionParams{ - InitiatorID: user.ID, - Provider: provider, - Model: model, + InitiatorID: user.ID, + Provider: provider, + ProviderName: aiProvider.Name, + Model: model, }, nil) // Use fixed dates to keep the test deterministic. @@ -2348,6 +2507,152 @@ func TestRecordTokenUsageAuthorized(t *testing.T) { require.Equal(t, wantCost, spend.SpendMicros, "spend micros") } +// TestRecordTokenUsageProviderResolution covers provider resolution against a real +// database through dbauthz, where the live-row filter and name reuse apply. +func TestRecordTokenUsageProviderResolution(t *testing.T) { + t.Parallel() + + const claudeModel, gptModel = "claude-sonnet-4-6", "gpt-5-mini" + const anthropicInputPrice, bedrockInputPrice, openaiInputPrice, azureInputPrice int64 = 2_000_000, 3_000_000, 4_000_000, 5_000_000 + + setupCtx := testutil.Context(t, testutil.WaitLong) + logger := testutil.Logger(t) + + rawDB, _ := dbtestutil.NewDB(t) + authzDB := dbauthz.New(rawDB, rbac.NewStrictAuthorizer(prometheus.NewRegistry()), logger, coderdtest.AccessControlStorePointer()) + + user := dbgen.User(t, rawDB, database.User{}) + + // Prices differ per provider type so the asserted cost identifies which type resolved. + priceSeed, err := json.Marshal([]map[string]any{ + {"provider": string(database.AIProviderTypeAnthropic), "model": claudeModel, "input_price": anthropicInputPrice}, + {"provider": string(database.AIProviderTypeBedrock), "model": claudeModel, "input_price": bedrockInputPrice}, + {"provider": string(database.AIProviderTypeOpenai), "model": gptModel, "input_price": openaiInputPrice}, + {"provider": string(database.AIProviderTypeAzure), "model": gptModel, "input_price": azureInputPrice}, + }) + require.NoError(t, err) + require.NoError(t, rawDB.UpsertAIModelPrices(setupCtx, priceSeed), "seed model prices") + + srv, err := aibridgedserver.NewServer(setupCtx, aibridgedserver.Options{ + Store: authzDB, + AISeatTracker: agplaiseats.Noop{}, + AccessURL: "/", + GatewayCfg: codersdk.AIBridgeConfig{}, + Experiments: requiredExperiments, + Logger: logger, + Clock: quartz.NewReal(), + }) + require.NoError(t, err) + + cases := []struct { + name string + // wireProvider is the upstream wire format recorded on the interception. + wireProvider string + // providerName is the provider instance name recorded on the interception. + providerName string + // providerType is the configured provider type of the live provider. + providerType database.AIProviderType + model string + // setupProvider creates and deletes the case's providers. + setupProvider func(t *testing.T, ctx context.Context, providerName string, providerType database.AIProviderType) + wantInputPrice sql.NullInt64 + wantCost sql.NullInt64 + }{ + { + // The common configuration, where the configured provider type matches + // the upstream wire format. + name: "provider named after its type", + wireProvider: "anthropic", + providerName: "anthropic", + providerType: database.AIProviderTypeAnthropic, + model: claudeModel, + // One live anthropic provider. + setupProvider: func(t *testing.T, _ context.Context, providerName string, providerType database.AIProviderType) { + dbgen.AIProvider(t, rawDB, database.AIProvider{Name: providerName, Type: providerType}) + }, + wantInputPrice: sql.NullInt64{Int64: anthropicInputPrice, Valid: true}, + // 100 input tokens at the anthropic input price: $0.0002. + wantCost: sql.NullInt64{Int64: 200, Valid: true}, + }, + { + name: "priced by configured provider type", + wireProvider: "anthropic", + providerName: "bedrock-eu", + providerType: database.AIProviderTypeBedrock, + model: claudeModel, + // One live bedrock provider. + setupProvider: func(t *testing.T, _ context.Context, providerName string, providerType database.AIProviderType) { + dbgen.AIProvider(t, rawDB, database.AIProvider{Name: providerName, Type: providerType}) + }, + wantInputPrice: sql.NullInt64{Int64: bedrockInputPrice, Valid: true}, + // 100 input tokens at the bedrock input price: $0.0003. + wantCost: sql.NullInt64{Int64: 300, Valid: true}, + }, + { + name: "deleted provider is unpriced", + wireProvider: "anthropic", + providerName: "bedrock-deleted", + providerType: database.AIProviderTypeBedrock, + model: claudeModel, + // One bedrock provider, deleted before the usage is recorded. + setupProvider: func(t *testing.T, ctx context.Context, providerName string, providerType database.AIProviderType) { + provider := dbgen.AIProvider(t, rawDB, database.AIProvider{Name: providerName, Type: providerType}) + require.NoError(t, rawDB.DeleteAIProviderByID(ctx, provider.ID), "delete provider") + }, + wantInputPrice: sql.NullInt64{Valid: false}, + wantCost: sql.NullInt64{Valid: false}, + }, + { + // Names are unique only among live providers, so a deleted name can be + // reused by a provider of a different configured provider type. + name: "reused name resolves to the live provider", + wireProvider: "openai", + providerName: "reused-name", + providerType: database.AIProviderTypeAzure, + model: gptModel, + // A deleted openai provider and a live azure provider sharing the name. + setupProvider: func(t *testing.T, ctx context.Context, providerName string, providerType database.AIProviderType) { + deleted := dbgen.AIProvider(t, rawDB, database.AIProvider{Name: providerName, Type: database.AIProviderTypeOpenai}) + require.NoError(t, rawDB.DeleteAIProviderByID(ctx, deleted.ID), "delete provider") + dbgen.AIProvider(t, rawDB, database.AIProvider{Name: providerName, Type: providerType}) + }, + wantInputPrice: sql.NullInt64{Int64: azureInputPrice, Valid: true}, + // 100 input tokens at the azure input price: $0.0005. + wantCost: sql.NullInt64{Int64: 500, Valid: true}, + }, + } + + for _, tc := range cases { + t.Run(tc.name, func(t *testing.T) { + t.Parallel() + + ctx := testutil.Context(t, testutil.WaitLong) + tc.setupProvider(t, ctx, tc.providerName, tc.providerType) + + intc := dbgen.AIBridgeInterception(t, rawDB, database.InsertAIBridgeInterceptionParams{ + InitiatorID: user.ID, + Provider: tc.wireProvider, + ProviderName: tc.providerName, + Model: tc.model, + }, nil) + + _, err := srv.RecordTokenUsage(ctx, &proto.RecordTokenUsageRequest{ + InterceptionId: intc.ID.String(), + MsgId: "msg_e2e", + InputTokens: 100, + CreatedAt: timestamppb.Now(), + }) + require.NoError(t, err, "record token usage") + + tokenUsages, err := rawDB.GetAIBridgeTokenUsagesByInterceptionID(ctx, intc.ID) + require.NoError(t, err) + require.Len(t, tokenUsages, 1) + require.Equal(t, tc.wantInputPrice, tokenUsages[0].InputPriceMicros, "input price") + require.Equal(t, tc.wantCost, tokenUsages[0].CostMicros, "cost") + }) + } +} + // TestRecordTokenUsageBudgetNotifications verifies that recording token usage // enqueues the right budget notifications: the warning template when spend // crosses the warning threshold, the limit-reached template at 100%, both when @@ -2900,21 +3205,25 @@ func TestRecordTokenUsageBudgetAdminNotification(t *testing.T) { } // newTestInterception returns an interception with a fixed initiator, provider, -// and model for cost-attribution test setup. +// and model for cost-attribution test setup. The provider name intentionally +// differs from the upstream wire format. func newTestInterception(id uuid.UUID) database.AIBridgeInterception { return database.AIBridgeInterception{ - ID: id, - InitiatorID: uuid.New(), - Provider: "anthropic", - Model: "claude-sonnet-4-6", + ID: id, + InitiatorID: uuid.New(), + Provider: "anthropic", + ProviderName: "anthropic-eu", + Model: "claude-sonnet-4-6", } } // expectTokenUsageCostLookups mocks the store lookups made by resolveTokenUsageCost -// (budget resolution and the price lookup). A nil override, group, everyoneGroupID, or -// price makes that lookup return sql.ErrNoRows. Budget resolution mirrors production code: -// a non-nil override wins and skips the group lookup, and the Everyone fallback is consulted -// only when both override and group are nil. +// (budget resolution, provider resolution, and the price lookup). A nil override, group, +// everyoneGroupID, or price makes that lookup return sql.ErrNoRows. Budget resolution +// mirrors production code: a non-nil override wins and skips the group lookup, and the +// Everyone fallback is consulted only when both override and group are nil. The provider +// name resolves to a provider whose configured provider type equals the interception's +// upstream wire format. func expectTokenUsageCostLookups( db *dbmock.MockStore, intc database.AIBridgeInterception, @@ -2945,6 +3254,11 @@ func expectTokenUsageCostLookups( } } + db.EXPECT().GetAIProviderByName(gomock.Any(), intc.ProviderName).Return(database.AIProvider{ + Name: intc.ProviderName, + Type: database.AIProviderType(intc.Provider), + }, nil) + if price != nil { db.EXPECT().GetAIModelPriceByProviderModel(gomock.Any(), database.GetAIModelPriceByProviderModelParams{ Provider: intc.Provider, diff --git a/coderd/aibridgedserver/cost.go b/coderd/aibridgedserver/cost.go index ab1c13472ae..ba56412a455 100644 --- a/coderd/aibridgedserver/cost.go +++ b/coderd/aibridgedserver/cost.go @@ -34,10 +34,11 @@ type tokenUsageCost struct { } // resolveTokenUsageCost resolves the effective group and per-token prices for an -// interception and computes its cost. Two independent conditions yield a NULL +// interception and computes its cost. Three independent conditions yield a NULL // column rather than an error: an unresolved effective group (the user has no -// org membership), and a model absent from the price table leaves prices and -// cost NULL (a NULL cost unambiguously means "model not priced"). +// org membership), an interception whose provider name matches no configured +// provider, and a model absent from the price table. The latter two leave prices +// and cost NULL (a NULL cost unambiguously means "model not priced"). // Any other error is returned. func (s *Server) resolveTokenUsageCost(ctx context.Context, intc database.AIBridgeInterception, in *proto.RecordTokenUsageRequest) (tokenUsageCost, error) { var result tokenUsageCost @@ -63,22 +64,40 @@ func (s *Server) resolveTokenUsageCost(ctx context.Context, intc database.AIBrid } } + // The interception records one of three upstream wire formats. Prices are + // keyed on the configured provider type, the provider actually serving the + // request, resolved by provider name. Names are unique among live providers. + provider, err := s.store.GetAIProviderByName(ctx, intc.ProviderName) + switch { + case errors.Is(err, sql.ErrNoRows): + // Only reachable if the provider was deleted mid-request. + s.logger.Info(ctx, "no configured provider found for interception, recording token usage with NULL cost", + slog.F("provider_name", intc.ProviderName), slog.F("model", intc.Model)) + if s.metrics != nil { + s.metrics.UnpricedTokenUsageRecords.WithLabelValues(intc.ProviderName, intc.Model).Inc() + } + return result, nil + case err != nil: + return tokenUsageCost{}, xerrors.Errorf("get configured provider %q: %w", intc.ProviderName, err) + } + configuredType := string(provider.Type) + // Snapshot the price for this (provider, model) and compute cost. price, err := s.store.GetAIModelPriceByProviderModel(ctx, database.GetAIModelPriceByProviderModelParams{ - Provider: intc.Provider, + Provider: configuredType, Model: intc.Model, }) switch { case errors.Is(err, sql.ErrNoRows): // Model not in the price table: record tokens but leave cost NULL. s.logger.Info(ctx, "no price found for model, recording token usage with NULL cost", - slog.F("provider", intc.Provider), slog.F("model", intc.Model)) + slog.F("provider", configuredType), slog.F("model", intc.Model)) if s.metrics != nil { - s.metrics.UnpricedTokenUsageRecords.WithLabelValues(intc.Provider, intc.Model).Inc() + s.metrics.UnpricedTokenUsageRecords.WithLabelValues(configuredType, intc.Model).Inc() } return result, nil case err != nil: - return tokenUsageCost{}, xerrors.Errorf("look up model price for %s/%s: %w", intc.Provider, intc.Model, err) + return tokenUsageCost{}, xerrors.Errorf("look up model price for %s/%s: %w", configuredType, intc.Model, err) } result.inputPriceMicros = price.InputPrice diff --git a/coderd/aibridgedserver/metrics.go b/coderd/aibridgedserver/metrics.go index dfd3cfdf8bc..b88b8789a6f 100644 --- a/coderd/aibridgedserver/metrics.go +++ b/coderd/aibridgedserver/metrics.go @@ -50,12 +50,11 @@ func NewMetrics(reg prometheus.Registerer) *Metrics { Name: "blocked_users", Help: "The number of users currently over their AI budget.", }, []string{"group_id"}), - // Pessimistic cardinality: 3 providers, 5 models = up to 15. + // Pessimistic cardinality: one series per configured provider and model. UnpricedTokenUsageRecords: promauto.With(reg).NewCounterVec(prometheus.CounterOpts{ Subsystem: "cost_control", Name: "unpriced_token_usage_records_total", - Help: "The number of recorded AI token-usage records for which no model price was found " + - "(provider: anthropic, openai, copilot).", + Help: "The number of recorded AI token-usage records for which no (provider, model) price was found.", }, []string{"provider", "model"}), // Pessimistic cardinality: 3 outcomes, 8 buckets + 3 extra series // (count, sum, +Inf) = up to 33. diff --git a/docs/admin/integrations/prometheus.md b/docs/admin/integrations/prometheus.md index 6c409ef04b2..408e87882b2 100644 --- a/docs/admin/integrations/prometheus.md +++ b/docs/admin/integrations/prometheus.md @@ -125,7 +125,7 @@ The `coder_ai_gateway_cost_control_*` metrics are exported only by `coderd`. | `coder_ai_gateway_cost_control_blocked_requests_total` | counter | The number of AI requests blocked because the initiator's budget was exceeded. | `group_id` | | `coder_ai_gateway_cost_control_blocked_users` | gauge | The number of users currently over their AI budget. | `group_id` | | `coder_ai_gateway_cost_control_enforcement_duration_seconds` | histogram | The duration of AI budget enforcement checks, in seconds (outcome: allowed, blocked, error). | `outcome` | -| `coder_ai_gateway_cost_control_unpriced_token_usage_records_total` | counter | The number of recorded AI token-usage records for which no model price was found (provider: anthropic, openai, copilot). | `model` `provider` | +| `coder_ai_gateway_cost_control_unpriced_token_usage_records_total` | counter | The number of recorded AI token-usage records for which no (provider, model) price was found. | `model` `provider` | | `coder_ai_gateway_injected_tool_invocations_total` | counter | The number of times an injected MCP tool was invoked by AI Gateway. | `model` `name` `provider` `server` | | `coder_ai_gateway_interceptions_duration_seconds` | histogram | The total duration of intercepted requests, in seconds. The majority of this time will be the upstream processing of the request. AI Gateway has no control over upstream processing time, so it's just an illustrative metric. | `model` `provider` | | `coder_ai_gateway_interceptions_inflight` | gauge | The number of intercepted requests which are being processed. | `model` `provider` `route` | diff --git a/scripts/metricsdocgen/metrics b/scripts/metricsdocgen/metrics index 6464f6ff94b..755068744c8 100644 --- a/scripts/metricsdocgen/metrics +++ b/scripts/metricsdocgen/metrics @@ -166,7 +166,7 @@ coder_ai_gateway_cost_control_enforcement_duration_seconds_bucket{outcome="allow coder_ai_gateway_cost_control_enforcement_duration_seconds_bucket{outcome="allowed",le="+Inf"} 0 coder_ai_gateway_cost_control_enforcement_duration_seconds_sum{outcome="allowed"} 0 coder_ai_gateway_cost_control_enforcement_duration_seconds_count{outcome="allowed"} 0 -# HELP coder_ai_gateway_cost_control_unpriced_token_usage_records_total The number of recorded AI token-usage records for which no model price was found (provider: anthropic, openai, copilot). +# HELP coder_ai_gateway_cost_control_unpriced_token_usage_records_total The number of recorded AI token-usage records for which no (provider, model) price was found. # TYPE coder_ai_gateway_cost_control_unpriced_token_usage_records_total counter coder_ai_gateway_cost_control_unpriced_token_usage_records_total{model="gpt-5-nano",provider="openai"} 0 # HELP coder_ai_gateway_injected_tool_invocations_total The number of times an injected MCP tool was invoked by AI Gateway. From d295caf5eaf14c562ff3c1534f225bf84761bae8 Mon Sep 17 00:00:00 2001 From: Susana Ferreira Date: Mon, 17 Aug 2026 08:23:48 +0100 Subject: [PATCH 39/69] fix: only write AI model prices that changed (#27923) (#28105) Backport of https://github.com/coder/coder/pull/27923 Original PR: #27923 - only write AI model prices that changed Merge commit: 5efa7abe7d8f0cbf0c853a234c972357fce1a752 Requested by: @ssncferreira --- coderd/aibridge/prices/prices_test.go | 107 +++++++++++++++++++++- coderd/database/querier.go | 3 + coderd/database/queries.sql.go | 14 +++ coderd/database/queries/aicostcontrol.sql | 16 +++- 4 files changed, 137 insertions(+), 3 deletions(-) diff --git a/coderd/aibridge/prices/prices_test.go b/coderd/aibridge/prices/prices_test.go index 1ce642e2084..ae30b7e449e 100644 --- a/coderd/aibridge/prices/prices_test.go +++ b/coderd/aibridge/prices/prices_test.go @@ -1,6 +1,7 @@ package prices_test import ( + "fmt" "testing" "github.com/prometheus/client_golang/prometheus" @@ -58,6 +59,7 @@ func TestSeedFromBytes(t *testing.T) { require.Equal(t, int64(25_000_000), opus.OutputPrice.Int64) require.Equal(t, int64(500_000), opus.CacheReadPrice.Int64) require.Equal(t, int64(6_250_000), opus.CacheWritePrice.Int64) + require.Equal(t, opus.CreatedAt, opus.UpdatedAt) // Spot-check a row where the seed has a NULL price (OpenAI does not // publish a cache_write_price). The column should land as SQL NULL. @@ -90,11 +92,11 @@ func TestSeedFromBytes(t *testing.T) { }) require.NoError(t, err) - // Prices must be identical across runs and CreatedAt must be - // preserved (only updated_at moves on a no-op upsert). + // A re-seed that changes nothing must not touch the row at all. require.Equal(t, first.InputPrice, second.InputPrice) require.Equal(t, first.OutputPrice, second.OutputPrice) require.Equal(t, first.CreatedAt, second.CreatedAt) + require.Equal(t, first.UpdatedAt, second.UpdatedAt) }) t.Run("OverwritesExistingPrices", func(t *testing.T) { @@ -114,6 +116,10 @@ func TestSeedFromBytes(t *testing.T) { "cache_read_price": 3, "cache_write_price": 4 }]`))) + before, err := db.GetAIModelPriceByProviderModel(ctx, database.GetAIModelPriceByProviderModelParams{ + Provider: "openai", Model: "gpt-4o", + }) + require.NoError(t, err) require.NoError(t, prices.SeedFromBytes(ctx, db, []byte(testSeedJSON))) @@ -126,6 +132,8 @@ func TestSeedFromBytes(t *testing.T) { require.Equal(t, int64(1_250_000), got.CacheReadPrice.Int64) require.False(t, got.CacheWritePrice.Valid) require.Zero(t, got.CacheWritePrice.Int64) + require.Equal(t, before.CreatedAt, got.CreatedAt) + require.True(t, got.UpdatedAt.After(before.UpdatedAt)) }) t.Run("LeavesOrphanRowsUntouched", func(t *testing.T) { @@ -174,6 +182,101 @@ func TestSeedFromBytes(t *testing.T) { require.True(t, got.InputPrice.Valid) require.Equal(t, int64(2_500_000), got.InputPrice.Int64) }) + + // Every price column counts toward the comparison, and a NULL on either + // side counts as a difference. + t.Run("UpdatedAtTracksPriceChanges", func(t *testing.T) { + t.Parallel() + + key := database.GetAIModelPriceByProviderModelParams{Provider: "openai", Model: "gpt-4o"} + seed := func(priceFields string) []byte { + return fmt.Appendf(nil, `[{"provider": %q, "model": %q, %s}]`, key.Provider, key.Model, priceFields) + } + + tests := []struct { + name string + initial, updated string + }{ + { + name: "InputPriceChanged", + initial: `"input_price": 100, "output_price": 200, "cache_read_price": 300, "cache_write_price": 400`, + updated: `"input_price": 111, "output_price": 200, "cache_read_price": 300, "cache_write_price": 400`, + }, + { + name: "InputPriceSetFromNull", + initial: `"input_price": null, "output_price": 200, "cache_read_price": 300, "cache_write_price": 400`, + updated: `"input_price": 100, "output_price": 200, "cache_read_price": 300, "cache_write_price": 400`, + }, + { + name: "InputPriceClearedToNull", + initial: `"input_price": 100, "output_price": 200, "cache_read_price": 300, "cache_write_price": 400`, + updated: `"input_price": null, "output_price": 200, "cache_read_price": 300, "cache_write_price": 400`, + }, + { + name: "OutputPriceChanged", + initial: `"input_price": 100, "output_price": 200, "cache_read_price": 300, "cache_write_price": 400`, + updated: `"input_price": 100, "output_price": 222, "cache_read_price": 300, "cache_write_price": 400`, + }, + { + name: "OutputPriceSetFromNull", + initial: `"input_price": 100, "output_price": null, "cache_read_price": 300, "cache_write_price": 400`, + updated: `"input_price": 100, "output_price": 200, "cache_read_price": 300, "cache_write_price": 400`, + }, + { + name: "OutputPriceClearedToNull", + initial: `"input_price": 100, "output_price": 200, "cache_read_price": 300, "cache_write_price": 400`, + updated: `"input_price": 100, "output_price": null, "cache_read_price": 300, "cache_write_price": 400`, + }, + { + name: "CacheReadPriceChanged", + initial: `"input_price": 100, "output_price": 200, "cache_read_price": 300, "cache_write_price": 400`, + updated: `"input_price": 100, "output_price": 200, "cache_read_price": 333, "cache_write_price": 400`, + }, + { + name: "CacheReadPriceSetFromNull", + initial: `"input_price": 100, "output_price": 200, "cache_read_price": null, "cache_write_price": 400`, + updated: `"input_price": 100, "output_price": 200, "cache_read_price": 300, "cache_write_price": 400`, + }, + { + name: "CacheReadPriceClearedToNull", + initial: `"input_price": 100, "output_price": 200, "cache_read_price": 300, "cache_write_price": 400`, + updated: `"input_price": 100, "output_price": 200, "cache_read_price": null, "cache_write_price": 400`, + }, + { + name: "CacheWritePriceChanged", + initial: `"input_price": 100, "output_price": 200, "cache_read_price": 300, "cache_write_price": 400`, + updated: `"input_price": 100, "output_price": 200, "cache_read_price": 300, "cache_write_price": 444`, + }, + { + name: "CacheWritePriceSetFromNull", + initial: `"input_price": 100, "output_price": 200, "cache_read_price": 300, "cache_write_price": null`, + updated: `"input_price": 100, "output_price": 200, "cache_read_price": 300, "cache_write_price": 400`, + }, + { + name: "CacheWritePriceClearedToNull", + initial: `"input_price": 100, "output_price": 200, "cache_read_price": 300, "cache_write_price": 400`, + updated: `"input_price": 100, "output_price": 200, "cache_read_price": 300, "cache_write_price": null`, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitShort) + db, _ := dbtestutil.NewDB(t) + + require.NoError(t, prices.SeedFromBytes(ctx, db, seed(tt.initial))) + before, err := db.GetAIModelPriceByProviderModel(ctx, key) + require.NoError(t, err) + + require.NoError(t, prices.SeedFromBytes(ctx, db, seed(tt.updated))) + after, err := db.GetAIModelPriceByProviderModel(ctx, key) + require.NoError(t, err) + + require.True(t, after.UpdatedAt.After(before.UpdatedAt), "updated_at should advance when a price changes") + }) + } + }) } // TestSeed exercises the real embedded prices.json so we catch a corrupted, diff --git a/coderd/database/querier.go b/coderd/database/querier.go index bcb6b722fd2..527168ba4a4 100644 --- a/coderd/database/querier.go +++ b/coderd/database/querier.go @@ -1635,6 +1635,9 @@ type sqlcQuerier interface { // Upsert a batch of (provider, model) rows from a JSON array. Each element // must have provider, model, and the four price fields; null prices are // written as SQL NULL. + // A conflicting row is only rewritten when a price differs, so updated_at + // records when a price last changed. Prices are nullable and a NULL on + // either side counts as a difference. UpsertAIModelPrices(ctx context.Context, seed json.RawMessage) error // Returns true if a new rows was inserted, false otherwise. UpsertAISeatState(ctx context.Context, arg UpsertAISeatStateParams) (bool, error) diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go index 72f3812d4a3..07ccd2b813a 100644 --- a/coderd/database/queries.sql.go +++ b/coderd/database/queries.sql.go @@ -3406,11 +3406,25 @@ ON CONFLICT (provider, model) DO UPDATE SET cache_read_price = EXCLUDED.cache_read_price, cache_write_price = EXCLUDED.cache_write_price, updated_at = NOW() +WHERE ( + ai_model_prices.input_price, + ai_model_prices.output_price, + ai_model_prices.cache_read_price, + ai_model_prices.cache_write_price +) IS DISTINCT FROM ( + EXCLUDED.input_price, + EXCLUDED.output_price, + EXCLUDED.cache_read_price, + EXCLUDED.cache_write_price +) ` // Upsert a batch of (provider, model) rows from a JSON array. Each element // must have provider, model, and the four price fields; null prices are // written as SQL NULL. +// A conflicting row is only rewritten when a price differs, so updated_at +// records when a price last changed. Prices are nullable and a NULL on +// either side counts as a difference. func (q *sqlQuerier) UpsertAIModelPrices(ctx context.Context, seed json.RawMessage) error { _, err := q.db.ExecContext(ctx, upsertAIModelPrices, seed) return err diff --git a/coderd/database/queries/aicostcontrol.sql b/coderd/database/queries/aicostcontrol.sql index 43c5970fe2d..5552e8c7af4 100644 --- a/coderd/database/queries/aicostcontrol.sql +++ b/coderd/database/queries/aicostcontrol.sql @@ -2,6 +2,9 @@ -- Upsert a batch of (provider, model) rows from a JSON array. Each element -- must have provider, model, and the four price fields; null prices are -- written as SQL NULL. +-- A conflicting row is only rewritten when a price differs, so updated_at +-- records when a price last changed. Prices are nullable and a NULL on +-- either side counts as a difference. INSERT INTO ai_model_prices ( provider, model, input_price, output_price, cache_read_price, cache_write_price ) @@ -18,7 +21,18 @@ ON CONFLICT (provider, model) DO UPDATE SET output_price = EXCLUDED.output_price, cache_read_price = EXCLUDED.cache_read_price, cache_write_price = EXCLUDED.cache_write_price, - updated_at = NOW(); + updated_at = NOW() +WHERE ( + ai_model_prices.input_price, + ai_model_prices.output_price, + ai_model_prices.cache_read_price, + ai_model_prices.cache_write_price +) IS DISTINCT FROM ( + EXCLUDED.input_price, + EXCLUDED.output_price, + EXCLUDED.cache_read_price, + EXCLUDED.cache_write_price +); -- name: GetAIModelPriceByProviderModel :one SELECT * From 83f642383e43bfa61190575fc7d22c0a7c0be169 Mon Sep 17 00:00:00 2001 From: Susana Ferreira Date: Mon, 17 Aug 2026 14:39:27 +0100 Subject: [PATCH 40/69] fix: label unpriced token usage metric by provider name and type (#28210) (#28212) Backport of https://github.com/coder/coder/pull/28210 Original PR: #28210 - fix: label unpriced token usage metric by provider name and type Merge commit: 95328f1ead6bdf275664678a92033a771c8a8db1 Requested by: @ssncferreira --- coderd/aibridgedserver/aibridgedserver_test.go | 8 ++++---- coderd/aibridgedserver/cost.go | 10 +++++++--- coderd/aibridgedserver/metrics.go | 5 +++-- docs/admin/integrations/prometheus.md | 2 +- docs/ai-coder/ai-gateway/cost-controls.md | 7 ++++--- docs/ai-coder/ai-gateway/monitoring.md | 12 ++++++------ scripts/metricsdocgen/metrics | 4 ++-- 7 files changed, 27 insertions(+), 21 deletions(-) diff --git a/coderd/aibridgedserver/aibridgedserver_test.go b/coderd/aibridgedserver/aibridgedserver_test.go index 8fa4776fb92..9b63d66b64d 100644 --- a/coderd/aibridgedserver/aibridgedserver_test.go +++ b/coderd/aibridgedserver/aibridgedserver_test.go @@ -1762,7 +1762,7 @@ func TestRecordTokenUsage(t *testing.T) { // A priced model does not increment unpriced_token_usage_records_total. assertMetrics: func(t *testing.T, reg *prometheus.Registry) { require.Nil(t, promhelp.MetricValue(t, reg, "cost_control_unpriced_token_usage_records_total", - prometheus.Labels{"provider": "anthropic", "model": "claude-sonnet-4-6"})) + prometheus.Labels{"provider": "anthropic-eu", "provider_type": "anthropic", "model": "claude-sonnet-4-6"})) }, }, { @@ -1909,7 +1909,7 @@ func TestRecordTokenUsage(t *testing.T) { // A missing price row increments unpriced_token_usage_records_total. assertMetrics: func(t *testing.T, reg *prometheus.Registry) { require.Equal(t, 1, promhelp.CounterValue(t, reg, "cost_control_unpriced_token_usage_records_total", - prometheus.Labels{"provider": "anthropic", "model": "claude-sonnet-4-6"})) + prometheus.Labels{"provider": "anthropic-eu", "provider_type": "anthropic", "model": "claude-sonnet-4-6"})) }, }, { @@ -2089,7 +2089,7 @@ func TestRecordTokenUsage(t *testing.T) { // A missing price row increments unpriced_token_usage_records_total. assertMetrics: func(t *testing.T, reg *prometheus.Registry) { require.Equal(t, 1, promhelp.CounterValue(t, reg, "cost_control_unpriced_token_usage_records_total", - prometheus.Labels{"provider": "anthropic", "model": "claude-sonnet-4-6"})) + prometheus.Labels{"provider": "anthropic-eu", "provider_type": "anthropic", "model": "claude-sonnet-4-6"})) }, }, { @@ -2256,7 +2256,7 @@ func TestRecordTokenUsage(t *testing.T) { // The metric names the provider that failed to resolve. assertMetrics: func(t *testing.T, reg *prometheus.Registry) { require.Equal(t, 1, promhelp.CounterValue(t, reg, "cost_control_unpriced_token_usage_records_total", - prometheus.Labels{"provider": "anthropic-eu", "model": "claude-sonnet-4-6"})) + prometheus.Labels{"provider": "anthropic-eu", "provider_type": "unknown", "model": "claude-sonnet-4-6"})) }, }, { diff --git a/coderd/aibridgedserver/cost.go b/coderd/aibridgedserver/cost.go index ba56412a455..0470e66b09a 100644 --- a/coderd/aibridgedserver/cost.go +++ b/coderd/aibridgedserver/cost.go @@ -19,6 +19,10 @@ import ( // tokens. const tokensPerMillion = 1_000_000 +// unknownProviderType labels a metric whose provider did not resolve to a +// configured type. +const unknownProviderType = "unknown" + // tokenUsageCost holds the cost-attribution columns snapshotted onto a token // usage record. A field left unset (Valid == false) is recorded as SQL NULL; a // price or cost of 0 is recorded as 0, which is distinct from NULL. @@ -71,10 +75,10 @@ func (s *Server) resolveTokenUsageCost(ctx context.Context, intc database.AIBrid switch { case errors.Is(err, sql.ErrNoRows): // Only reachable if the provider was deleted mid-request. - s.logger.Info(ctx, "no configured provider found for interception, recording token usage with NULL cost", + s.logger.Warn(ctx, "no configured provider found for interception, recording token usage with NULL cost", slog.F("provider_name", intc.ProviderName), slog.F("model", intc.Model)) if s.metrics != nil { - s.metrics.UnpricedTokenUsageRecords.WithLabelValues(intc.ProviderName, intc.Model).Inc() + s.metrics.UnpricedTokenUsageRecords.WithLabelValues(intc.ProviderName, unknownProviderType, intc.Model).Inc() } return result, nil case err != nil: @@ -93,7 +97,7 @@ func (s *Server) resolveTokenUsageCost(ctx context.Context, intc database.AIBrid s.logger.Info(ctx, "no price found for model, recording token usage with NULL cost", slog.F("provider", configuredType), slog.F("model", intc.Model)) if s.metrics != nil { - s.metrics.UnpricedTokenUsageRecords.WithLabelValues(configuredType, intc.Model).Inc() + s.metrics.UnpricedTokenUsageRecords.WithLabelValues(intc.ProviderName, configuredType, intc.Model).Inc() } return result, nil case err != nil: diff --git a/coderd/aibridgedserver/metrics.go b/coderd/aibridgedserver/metrics.go index b88b8789a6f..c613b2f2f3e 100644 --- a/coderd/aibridgedserver/metrics.go +++ b/coderd/aibridgedserver/metrics.go @@ -54,8 +54,9 @@ func NewMetrics(reg prometheus.Registerer) *Metrics { UnpricedTokenUsageRecords: promauto.With(reg).NewCounterVec(prometheus.CounterOpts{ Subsystem: "cost_control", Name: "unpriced_token_usage_records_total", - Help: "The number of recorded AI token-usage records for which no (provider, model) price was found.", - }, []string{"provider", "model"}), + Help: "The number of recorded AI token-usage records for which no (provider_type, model) price was found. " + + "provider is the provider instance name, and provider_type is its configured type.", + }, []string{"provider", "provider_type", "model"}), // Pessimistic cardinality: 3 outcomes, 8 buckets + 3 extra series // (count, sum, +Inf) = up to 33. EnforcementDuration: promauto.With(reg).NewHistogramVec(prometheus.HistogramOpts{ diff --git a/docs/admin/integrations/prometheus.md b/docs/admin/integrations/prometheus.md index 408e87882b2..b67cfb7e5ad 100644 --- a/docs/admin/integrations/prometheus.md +++ b/docs/admin/integrations/prometheus.md @@ -125,7 +125,7 @@ The `coder_ai_gateway_cost_control_*` metrics are exported only by `coderd`. | `coder_ai_gateway_cost_control_blocked_requests_total` | counter | The number of AI requests blocked because the initiator's budget was exceeded. | `group_id` | | `coder_ai_gateway_cost_control_blocked_users` | gauge | The number of users currently over their AI budget. | `group_id` | | `coder_ai_gateway_cost_control_enforcement_duration_seconds` | histogram | The duration of AI budget enforcement checks, in seconds (outcome: allowed, blocked, error). | `outcome` | -| `coder_ai_gateway_cost_control_unpriced_token_usage_records_total` | counter | The number of recorded AI token-usage records for which no (provider, model) price was found. | `model` `provider` | +| `coder_ai_gateway_cost_control_unpriced_token_usage_records_total` | counter | The number of recorded AI token-usage records for which no (provider_type, model) price was found. provider is the provider instance name, and provider_type is its configured type. | `model` `provider_type` `provider` | | `coder_ai_gateway_injected_tool_invocations_total` | counter | The number of times an injected MCP tool was invoked by AI Gateway. | `model` `name` `provider` `server` | | `coder_ai_gateway_interceptions_duration_seconds` | histogram | The total duration of intercepted requests, in seconds. The majority of this time will be the upstream processing of the request. AI Gateway has no control over upstream processing time, so it's just an illustrative metric. | `model` `provider` | | `coder_ai_gateway_interceptions_inflight` | gauge | The number of intercepted requests which are being processed. | `model` `provider` `route` | diff --git a/docs/ai-coder/ai-gateway/cost-controls.md b/docs/ai-coder/ai-gateway/cost-controls.md index 6b8b81be116..0b563cc3b26 100644 --- a/docs/ai-coder/ai-gateway/cost-controls.md +++ b/docs/ai-coder/ai-gateway/cost-controls.md @@ -210,9 +210,10 @@ Replace `` with your Coder minor version, for example `2.36`. > effectively unlimited. Monitor `coder_ai_gateway_cost_control_unpriced_token_usage_records_total`, -labeled by `provider` and `model`, to detect unpriced usage. Any non-zero value -means spend is under-counted. Because the price book ships with the release, a -newly launched model can remain unpriced until you upgrade Coder. +labeled by `provider`, `provider_type`, and `model`, to detect unpriced usage. +The `(provider_type, model)` tuple identifies the missing price. Any non-zero +value means spend is under-counted. Because the price book ships with the +release, a newly launched model can remain unpriced until you upgrade Coder. ## Monitor spend diff --git a/docs/ai-coder/ai-gateway/monitoring.md b/docs/ai-coder/ai-gateway/monitoring.md index df648ef8ec9..b56a6d8fbec 100644 --- a/docs/ai-coder/ai-gateway/monitoring.md +++ b/docs/ai-coder/ai-gateway/monitoring.md @@ -55,12 +55,12 @@ Budget enforcement runs in `coderd`. Cost control metrics are exported only from the `coderd` Prometheus listener. Standalone replicas do not export them. -| Metric | Type | Labels | Purpose | -|--------------------------------------------------------------------|-----------|---------------------|------------------------------------------------------------------------------------------| -| `coder_ai_gateway_cost_control_blocked_requests_total` | counter | `group_id` | AI requests blocked because the initiator's budget was exceeded. | -| `coder_ai_gateway_cost_control_blocked_users` | gauge | `group_id` | Users currently over their AI budget. | -| `coder_ai_gateway_cost_control_enforcement_duration_seconds` | histogram | `outcome` | Duration of AI budget enforcement checks. `outcome` is `allowed`, `blocked`, or `error`. | -| `coder_ai_gateway_cost_control_unpriced_token_usage_records_total` | counter | `model`, `provider` | Recorded token-usage records for which no model price was found. | +| Metric | Type | Labels | Purpose | +|--------------------------------------------------------------------|-----------|--------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `coder_ai_gateway_cost_control_blocked_requests_total` | counter | `group_id` | AI requests blocked because the initiator's budget was exceeded. | +| `coder_ai_gateway_cost_control_blocked_users` | gauge | `group_id` | Users currently over their AI budget. | +| `coder_ai_gateway_cost_control_enforcement_duration_seconds` | histogram | `outcome` | Duration of AI budget enforcement checks. `outcome` is `allowed`, `blocked`, or `error`. | +| `coder_ai_gateway_cost_control_unpriced_token_usage_records_total` | counter | `model`, `provider`, `provider_type` | Recorded token-usage records for which no model price was found. `provider` is the provider instance name, and `provider_type` is the configured type the price is keyed on, or `unknown` when the provider could not be resolved. | ### AI Gateway Proxy metrics diff --git a/scripts/metricsdocgen/metrics b/scripts/metricsdocgen/metrics index 755068744c8..ccce769144d 100644 --- a/scripts/metricsdocgen/metrics +++ b/scripts/metricsdocgen/metrics @@ -166,9 +166,9 @@ coder_ai_gateway_cost_control_enforcement_duration_seconds_bucket{outcome="allow coder_ai_gateway_cost_control_enforcement_duration_seconds_bucket{outcome="allowed",le="+Inf"} 0 coder_ai_gateway_cost_control_enforcement_duration_seconds_sum{outcome="allowed"} 0 coder_ai_gateway_cost_control_enforcement_duration_seconds_count{outcome="allowed"} 0 -# HELP coder_ai_gateway_cost_control_unpriced_token_usage_records_total The number of recorded AI token-usage records for which no (provider, model) price was found. +# HELP coder_ai_gateway_cost_control_unpriced_token_usage_records_total The number of recorded AI token-usage records for which no (provider_type, model) price was found. provider is the provider instance name, and provider_type is its configured type. # TYPE coder_ai_gateway_cost_control_unpriced_token_usage_records_total counter -coder_ai_gateway_cost_control_unpriced_token_usage_records_total{model="gpt-5-nano",provider="openai"} 0 +coder_ai_gateway_cost_control_unpriced_token_usage_records_total{model="gpt-5-nano",provider="openai",provider_type="openai"} 0 # HELP coder_ai_gateway_injected_tool_invocations_total The number of times an injected MCP tool was invoked by AI Gateway. # TYPE coder_ai_gateway_injected_tool_invocations_total counter coder_ai_gateway_injected_tool_invocations_total{model="gpt-5-nano",name="coder_list_templates",provider="openai",server="https://xxx.pit-1.try.coder.app/api/experimental/mcp/http"} 1 From 10e6321619114db490b380a703514cab62f38246 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 17 Aug 2026 21:35:54 +0200 Subject: [PATCH 41/69] fix(site): include owner context in Agents org picker permission check (#28076) (#28132) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Backport of https://github.com/coder/coder/pull/28076 Original PR: #28076 — fix(site): include owner context in Agents org picker permission check Merge commit: d509e1e6a03ff7d88996cb637acc0ef5c131e950 Requested by: @ibetitsmike Co-authored-by: Michael Suchacz <203725896+ibetitsmike@users.noreply.github.com> --- site/src/api/queries/organizations.ts | 8 ++- .../components/AgentCreateForm.stories.tsx | 57 +++++++++++++++++-- .../AgentsPage/components/AgentCreateForm.tsx | 2 +- 3 files changed, 59 insertions(+), 8 deletions(-) diff --git a/site/src/api/queries/organizations.ts b/site/src/api/queries/organizations.ts index 1dcaac36596..6caf0d6f958 100644 --- a/site/src/api/queries/organizations.ts +++ b/site/src/api/queries/organizations.ts @@ -294,6 +294,12 @@ export const provisionerJobs = ( }; }; +export const permittedOrganizationsKey = (check: AuthorizationCheck) => [ + "organizations", + "permitted", + check, +]; + /** * Fetch organizations the current user is permitted to use for a given * action. Fetches all organizations, runs a per-org authorization @@ -301,7 +307,7 @@ export const provisionerJobs = ( */ export const permittedOrganizations = (check: AuthorizationCheck) => { return { - queryKey: ["organizations", "permitted", check], + queryKey: permittedOrganizationsKey(check), queryFn: async (): Promise => { const orgs = await API.getOrganizations(); const checks = Object.fromEntries( diff --git a/site/src/pages/AgentsPage/components/AgentCreateForm.stories.tsx b/site/src/pages/AgentsPage/components/AgentCreateForm.stories.tsx index e38c344494d..46fb4784803 100644 --- a/site/src/pages/AgentsPage/components/AgentCreateForm.stories.tsx +++ b/site/src/pages/AgentsPage/components/AgentCreateForm.stories.tsx @@ -9,6 +9,7 @@ import { within, } from "storybook/test"; import { API } from "#/api/api"; +import { permittedOrganizationsKey } from "#/api/queries/organizations"; import type * as TypesGen from "#/api/typesGenerated"; import { ConfirmDialog } from "#/components/Dialogs/ConfirmDialog/ConfirmDialog"; import { MockChatModelConfig } from "#/testHelpers/chatModels"; @@ -24,12 +25,10 @@ import { } from "../utils/reasoningEffort"; import { AgentCreateForm } from "./AgentCreateForm"; -// Query key used by permittedOrganizations() in the form. -const permittedOrgsKey = [ - "organizations", - "permitted", - { object: { resource_type: "chat" }, action: "create" }, -]; +const permittedOrgsKey = permittedOrganizationsKey({ + object: { resource_type: "chat", owner_id: "me" }, + action: "create", +}); const modelConfigID = "model-config-1"; const claudeModelConfigID = "model-config-claude"; @@ -1061,3 +1060,49 @@ export const PermittedOrgsResolvesToSubset: Story = { expect(options.organizationId).toBe(MockOrganization2.id); }, }; + +/** + * Member-scoped roles like agents-access grant chat:create only on + * chats the user owns, so the per-org check must carry owner context + * for the picker to render. + */ +export const MemberScopedPermissionsShowOrgPicker: Story = { + parameters: { + showOrganizations: true, + organizations: [MockDefaultOrganization, MockOrganization2], + }, + beforeEach: () => { + spyOn(API, "getOrganizations").mockResolvedValue([ + MockDefaultOrganization, + MockOrganization2, + ]); + spyOn(API, "checkAuthorization").mockImplementation(async ({ checks }) => + Object.fromEntries( + Object.entries(checks).map(([id, check]) => [ + id, + check.object.owner_id === "me", + ]), + ), + ); + }, + play: async ({ canvasElement }) => { + const canvas = within(canvasElement); + const picker = await canvas.findByRole( + "button", + { name: /^Organization:/ }, + { timeout: 3000 }, + ); + await userEvent.click(picker); + await screen.findByRole("option", { + name: MockDefaultOrganization.display_name, + }); + await userEvent.click( + screen.getByRole("option", { name: MockOrganization2.display_name }), + ); + expect( + canvas.getByRole("button", { + name: `Organization: ${MockOrganization2.display_name}`, + }), + ).toBeInTheDocument(); + }, +}; diff --git a/site/src/pages/AgentsPage/components/AgentCreateForm.tsx b/site/src/pages/AgentsPage/components/AgentCreateForm.tsx index 0a494c01dcf..22165f04b54 100644 --- a/site/src/pages/AgentsPage/components/AgentCreateForm.tsx +++ b/site/src/pages/AgentsPage/components/AgentCreateForm.tsx @@ -461,7 +461,7 @@ export const AgentCreateForm: FC = ({ const permittedOrgsQuery = useQuery({ ...permittedOrganizations({ - object: { resource_type: "chat" }, + object: { resource_type: "chat", owner_id: "me" }, action: "create", }), enabled: showOrganizations, From 7fe2ec471353a64e3e4314253645169a1b1b445b Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 17 Aug 2026 21:43:09 +0200 Subject: [PATCH 42/69] fix(coderd): send assigned chat model IDs verbatim (#28144) (#28216) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Backport of https://github.com/coder/coder/pull/28144 Original PR: #28144 — fix(coderd): send assigned chat model IDs verbatim Merge commit: 93c6faf1de78b9cbe930295d61abbffd8db6971c Requested by: @ibetitsmike Co-authored-by: Michael Suchacz <203725896+ibetitsmike@users.noreply.github.com> Co-authored-by: Marcin Tojek --- coderd/exp_chats.go | 2 +- coderd/x/chatd/chatprovider/chatprovider.go | 30 ++------------- .../x/chatd/chatprovider/chatprovider_test.go | 38 ++++++++++++++++--- coderd/x/chatd/model_routing_aibridge.go | 5 +-- 4 files changed, 40 insertions(+), 35 deletions(-) diff --git a/coderd/exp_chats.go b/coderd/exp_chats.go index 35ca899bac4..1fd901255cc 100644 --- a/coderd/exp_chats.go +++ b/coderd/exp_chats.go @@ -7304,7 +7304,7 @@ func validateChatModelConfigProviderModel(aiProvider database.AIProvider, model return &chatModelConfigProviderModelError{ Response: codersdk.Response{ Message: "OpenRouter-like provider configured as type openai does not support slash-namespaced models.", - Detail: "Change the AI provider type to openrouter or openai-compat. The openai type strips the vendor prefix from slash-namespaced model IDs, routing to the wrong upstream provider.", + Detail: "Change the AI provider type to openrouter or openai-compat. Slash-namespaced model IDs on OpenRouter-like gateways require one of those provider types.", }, } } diff --git a/coderd/x/chatd/chatprovider/chatprovider.go b/coderd/x/chatd/chatprovider/chatprovider.go index ad450d6a542..5edae77da57 100644 --- a/coderd/x/chatd/chatprovider/chatprovider.go +++ b/coderd/x/chatd/chatprovider/chatprovider.go @@ -687,21 +687,6 @@ func orderProviders(providerSet map[string]struct{}) []string { return ordered } -// isGatewayProvider reports whether the provider routes requests to -// multiple upstream model providers using a "/" model -// identifier, where the slash is part of the upstream model ID rather -// than a hint. -func isGatewayProvider(provider string) bool { - switch provider { - case fantasyvercel.Name, - fantasyopenrouter.Name, - fantasyopenaicompat.Name: - return true - default: - return false - } -} - // NormalizeProvider canonicalizes a provider name. func NormalizeProvider(provider string) string { switch strings.ToLower(strings.TrimSpace(provider)) { @@ -732,23 +717,16 @@ func ResolveModelWithProviderHint(modelName, providerHint string) (provider stri return "", "", xerrors.New("model is required") } - // Gateway providers (vercel, openrouter, openai-compat) treat the - // "/" slash as part of the upstream model ID, so - // parseCanonicalModelRef would incorrectly strip the prefix and - // route to the embedded provider name instead. Honor an explicit - // gateway hint before attempting canonical-ref parsing. - if normalized := NormalizeProvider(providerHint); normalized != "" && isGatewayProvider(normalized) { - return normalized, modelName, nil + // A valid provider hint is authoritative, so preserve the model ID + // instead of interpreting its namespace as a different provider. + if provider := NormalizeProvider(providerHint); provider != "" { + return provider, modelName, nil } if provider, modelID, ok := parseCanonicalModelRef(modelName); ok { return provider, modelID, nil } - if provider := NormalizeProvider(providerHint); provider != "" { - return provider, modelName, nil - } - normalized := strings.ToLower(modelName) switch normalized { case "claude-opus-4-6": diff --git a/coderd/x/chatd/chatprovider/chatprovider_test.go b/coderd/x/chatd/chatprovider/chatprovider_test.go index b1b2a37a885..4245f139b01 100644 --- a/coderd/x/chatd/chatprovider/chatprovider_test.go +++ b/coderd/x/chatd/chatprovider/chatprovider_test.go @@ -1719,11 +1719,11 @@ func TestResolveModelWithProviderHint(t *testing.T) { wantModel: "anthropic/claude-opus-4.6", }, { - name: "OpenAIHintStripsCanonicalPrefix", + name: "OpenAIHintPreservesCanonicalPrefix", modelName: "anthropic/claude-opus-4.6", providerHint: fantasyopenai.Name, - wantProvider: fantasyanthropic.Name, - wantModel: "claude-opus-4.6", + wantProvider: fantasyopenai.Name, + wantModel: "anthropic/claude-opus-4.6", }, { name: "OpenAIHintPreservesUnknownSlashNamespace", @@ -1733,11 +1733,39 @@ func TestResolveModelWithProviderHint(t *testing.T) { wantModel: "meta-llama/llama-3-70b", }, { - name: "AnthropicHintStripsCanonicalPrefix", + name: "AnthropicHintPreservesCanonicalPrefix", modelName: "anthropic/claude-4-5-sonnet", providerHint: fantasyanthropic.Name, wantProvider: fantasyanthropic.Name, - wantModel: "claude-4-5-sonnet", + wantModel: "anthropic/claude-4-5-sonnet", + }, + { + name: "AnthropicHintPreservesBedrockNamespace", + modelName: "bedrock/claude-opus-4-8", + providerHint: fantasyanthropic.Name, + wantProvider: fantasyanthropic.Name, + wantModel: "bedrock/claude-opus-4-8", + }, + { + name: "AnthropicHintPreservesDoubleBedrockNamespace", + modelName: "bedrock/bedrock/claude-opus-4-8", + providerHint: fantasyanthropic.Name, + wantProvider: fantasyanthropic.Name, + wantModel: "bedrock/bedrock/claude-opus-4-8", + }, + { + name: "AnthropicHintPreservesColonCanonicalRef", + modelName: "openai:gpt-5.2", + providerHint: fantasyanthropic.Name, + wantProvider: fantasyanthropic.Name, + wantModel: "openai:gpt-5.2", + }, + { + name: "BedrockHintWithBareModel", + modelName: "claude-opus-4-6", + providerHint: fantasybedrock.Name, + wantProvider: fantasybedrock.Name, + wantModel: "claude-opus-4-6", }, { name: "NoHintUsesCanonicalRef", diff --git a/coderd/x/chatd/model_routing_aibridge.go b/coderd/x/chatd/model_routing_aibridge.go index 2bd724869ae..a156481a002 100644 --- a/coderd/x/chatd/model_routing_aibridge.go +++ b/coderd/x/chatd/model_routing_aibridge.go @@ -85,9 +85,8 @@ func (t *aiGatewayRoundTripper) RoundTrip(req *http.Request) (*http.Response, er return t.base.RoundTrip(cloned) } -// ValidateAIGatewayProviderModel rejects slash-namespaced models on -// OpenRouter-like providers typed as openai, where the provider type -// strips the vendor prefix. +// ValidateAIGatewayProviderModel rejects slash-namespaced models when an +// OpenRouter-like gateway is configured with the OpenAI provider type. func ValidateAIGatewayProviderModel(provider database.AIProvider, model string) error { if provider.Type != database.AIProviderTypeOpenai { return nil From 9548f239a8bdfe74d0f62eafc41c97b2d7adca91 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 17 Aug 2026 21:46:36 +0200 Subject: [PATCH 43/69] fix(site): prefer permitted organization for chat creation (#28078) (#28133) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Backport of https://github.com/coder/coder/pull/28078 Original PR: #28078 — fix(site): prefer permitted organization for chat creation Merge commit: bca5d72c1c58b0efcf131c401db9481555d1645b Requested by: @ibetitsmike The original automatic cherry-pick had conflicts; `release/2.36` has since moved and the merge commit was re-cherry-picked cleanly (`git cherry-pick -x -m1 bca5d72c`) and pushed by Coder Agents on behalf of @ibetitsmike. Co-authored-by: Michael Suchacz <203725896+ibetitsmike@users.noreply.github.com> Co-authored-by: Marcin Tojek --- .../components/AgentCreateForm.stories.tsx | 562 ++++++++++++++++-- .../AgentsPage/components/AgentCreateForm.tsx | 250 ++++---- .../hooks/useFileAttachments.test.tsx | 216 +++++++ .../AgentsPage/hooks/useFileAttachments.ts | 118 ++-- 4 files changed, 962 insertions(+), 184 deletions(-) create mode 100644 site/src/pages/AgentsPage/hooks/useFileAttachments.test.tsx diff --git a/site/src/pages/AgentsPage/components/AgentCreateForm.stories.tsx b/site/src/pages/AgentsPage/components/AgentCreateForm.stories.tsx index 46fb4784803..cbbe9acd016 100644 --- a/site/src/pages/AgentsPage/components/AgentCreateForm.stories.tsx +++ b/site/src/pages/AgentsPage/components/AgentCreateForm.stories.tsx @@ -1,4 +1,7 @@ -import type { Meta, StoryObj } from "@storybook/react-vite"; +import type { Decorator, Meta, StoryObj } from "@storybook/react-vite"; +import { delay } from "msw"; +import { useState } from "react"; +import { QueryClient, QueryClientProvider } from "react-query"; import { expect, fn, @@ -19,11 +22,12 @@ import { MockWorkspace, } from "#/testHelpers/entities"; import { withDashboardProvider } from "#/testHelpers/storybook"; +import { persistedAttachmentsStorageKey } from "../hooks/useFileAttachments"; import { getReasoningEffortForModel, saveReasoningEffortForModel, } from "../utils/reasoningEffort"; -import { AgentCreateForm } from "./AgentCreateForm"; +import { AgentCreateForm, emptyInputStorageKey } from "./AgentCreateForm"; const permittedOrgsKey = permittedOrganizationsKey({ object: { resource_type: "chat", owner_id: "me" }, @@ -131,19 +135,27 @@ type Story = StoryObj; const defaultArgs = meta.args; -const mockPermittedOrganizations = (permissions: Record) => { +const mockPermittedOrganizations = ( + permissions: Record, + delayMs = 0, +) => { spyOn(API, "getOrganizations").mockResolvedValue([ MockDefaultOrganization, MockOrganization2, ]); - spyOn(API, "checkAuthorization").mockResolvedValue(permissions); + spyOn(API, "checkAuthorization").mockImplementation(async () => { + if (delayMs > 0) { + await delay(delayMs); + } + return permissions; + }); }; export const Default: Story = {}; const submitMessage = async (canvasElement: HTMLElement, message: string) => { const canvas = within(canvasElement); - const input = canvas.getByTestId("chat-message-input"); + const input = canvas.getByRole("textbox", { name: "Chat message" }); await userEvent.click(input); await userEvent.keyboard(message); await userEvent.click(canvas.getByRole("button", { name: "Send" })); @@ -852,24 +864,496 @@ export const WithOrganizationPicker: Story = { queries: [ { key: permittedOrgsKey, - data: [MockDefaultOrganization, MockOrganization2], + data: [MockOrganization2, MockDefaultOrganization], }, ], }, play: async ({ canvasElement }) => { const canvas = within(canvasElement); - // Verify the org picker rendered (component didn't crash). - await waitFor(() => { - expect(canvas.getByTestId("compact-org-selector")).toBeInTheDocument(); + const organizationPicker = canvas.getByRole("button", { + name: "Organization: My Organization", }); - // Type into the chat input to trigger re-renders. If the - // permittedOrgs fallback is referentially unstable, this - // causes a render cascade that hits React's update limit. - const input = canvas.getByTestId("chat-message-input"); + await expect(organizationPicker).toBeVisible(); + + const input = canvas.getByRole("textbox", { name: "Chat message" }); await userEvent.click(input); await userEvent.keyboard("hello world"); - // The org picker should still be present after typing. - expect(canvas.getByTestId("compact-org-selector")).toBeInTheDocument(); + await expect( + canvas.getByRole("button", { + name: "Organization: My Organization", + }), + ).toBeVisible(); + }, +}; + +export const RestrictedMultiOrganizationUser: Story = { + parameters: { + showOrganizations: true, + organizations: [MockDefaultOrganization, MockOrganization2], + }, + beforeEach: () => { + spyOn(API, "getOrganizations").mockResolvedValue([ + MockDefaultOrganization, + MockOrganization2, + ]); + // Model agents-access: "me" supplies the owner for member-scoped chat:create. + spyOn(API, "checkAuthorization").mockImplementation(async ({ checks }) => + Object.fromEntries( + Object.entries(checks).map(([id, check]) => [ + id, + check.object.owner_id === "me" && + check.object.organization_id === MockOrganization2.id, + ]), + ), + ); + }, + args: { + ...defaultArgs, + onCreateChat: fn().mockResolvedValue(undefined), + }, + play: async ({ canvasElement, args }) => { + await submitMessage(canvasElement, "test message"); + await waitFor(() => { + expect(args.onCreateChat).toHaveBeenCalledWith( + expect.objectContaining({ + organizationId: MockOrganization2.id, + }), + ); + }); + }, +}; + +export const RestrictedUserKeepsPersistedWorkspace: Story = { + parameters: { + showOrganizations: true, + organizations: [MockDefaultOrganization, MockOrganization2], + }, + args: { + ...defaultArgs, + onCreateChat: fn().mockResolvedValue(undefined), + workspaceOptions: [ + { + ...MockWorkspace, + id: "ws-permitted-org", + name: "permitted-workspace", + organization_id: MockOrganization2.id, + }, + ], + workspaceCount: 1, + }, + beforeEach: () => { + localStorage.setItem("agents.selected-workspace-id", "ws-permitted-org"); + mockPermittedOrganizations({ + [MockDefaultOrganization.id]: false, + [MockOrganization2.id]: true, + }); + }, + play: async ({ canvasElement, args }) => { + await submitMessage(canvasElement, "test message"); + await waitFor(() => { + expect(args.onCreateChat).toHaveBeenCalledWith( + expect.objectContaining({ + organizationId: MockOrganization2.id, + workspaceId: "ws-permitted-org", + }), + ); + }); + }, +}; + +export const RestrictedUserKeepsPersistedAttachments: Story = { + parameters: { + showOrganizations: true, + organizations: [MockDefaultOrganization, MockOrganization2], + }, + beforeEach: () => { + localStorage.clear(); + localStorage.setItem( + "agents.persisted-attachments", + JSON.stringify([ + { + fileId: "file-permitted-org", + fileName: "notes.txt", + fileType: "text/plain", + lastModified: 1700000000000, + organizationId: MockOrganization2.id, + }, + ]), + ); + mockPermittedOrganizations({ + [MockDefaultOrganization.id]: false, + [MockOrganization2.id]: true, + }); + }, + play: async ({ canvasElement }) => { + const canvas = within(canvasElement); + await waitFor(() => { + expect(canvas.getByLabelText("Remove notes.txt")).toBeInTheDocument(); + }); + const stored = localStorage.getItem("agents.persisted-attachments"); + expect(stored).toContain("file-permitted-org"); + }, +}; + +export const OrganizationAuthorizationFailure: Story = { + parameters: { + showOrganizations: true, + organizations: [MockDefaultOrganization, MockOrganization2], + }, + beforeEach: () => { + localStorage.clear(); + localStorage.setItem(emptyInputStorageKey, "draft message"); + spyOn(API, "getOrganizations").mockResolvedValue([ + MockDefaultOrganization, + MockOrganization2, + ]); + spyOn(API, "checkAuthorization").mockRejectedValue( + new Error("authorization check failed"), + ); + }, + play: async ({ canvasElement }) => { + const canvas = within(canvasElement); + await canvas.findAllByText(/authorization check failed/i); + expect(canvas.getByRole("button", { name: "Send" })).toBeDisabled(); + }, +}; + +export const LoadingWorkspacesBlocksSendUntilValidated: Story = { + parameters: { + showOrganizations: true, + organizations: [MockDefaultOrganization, MockOrganization2], + }, + args: { + ...defaultArgs, + workspaceOptions: [], + isWorkspacesLoading: true, + }, + beforeEach: () => { + localStorage.setItem(emptyInputStorageKey, "draft message"); + localStorage.setItem("agents.selected-workspace-id", "ws-default-org"); + mockPermittedOrganizations({ + [MockDefaultOrganization.id]: true, + [MockOrganization2.id]: true, + }); + }, + play: async ({ canvasElement }) => { + const canvas = within(canvasElement); + // Wait for permissions to settle before checking workspace validation. + await canvas.findByRole("button", { + name: "Organization: My Organization", + }); + await expect(canvas.getByRole("button", { name: "Send" })).toBeDisabled(); + }, +}; + +export const DelayedOrganizationAuthorization: Story = { + parameters: { + showOrganizations: true, + organizations: [MockDefaultOrganization, MockOrganization2], + }, + beforeEach: () => { + localStorage.setItem(emptyInputStorageKey, "draft message"); + mockPermittedOrganizations( + { + [MockDefaultOrganization.id]: true, + [MockOrganization2.id]: true, + }, + 1_500, + ); + }, + args: { + ...defaultArgs, + workspaceOptions: [ + { + ...MockWorkspace, + id: "ws-provisional", + name: "provisional-workspace", + organization_id: MockDefaultOrganization.id, + }, + ], + }, + play: async ({ canvasElement }) => { + const canvas = within(canvasElement); + const sendButton = canvas.getByRole("button", { name: "Send" }); + await expect(sendButton).toBeDisabled(); + await expect( + canvas.getByRole("button", { name: "More options" }), + ).toBeDisabled(); + // dispatchEvent returns false when a handler accepted the drop + // via preventDefault, giving a race-free accepted/ignored signal. + const dropFile = (name: string): boolean => { + const dataTransfer = new DataTransfer(); + dataTransfer.items.add(new File(["hello"], name, { type: "text/plain" })); + return canvas.getByTestId("chat-composer").dispatchEvent( + new DragEvent("drop", { + bubbles: true, + cancelable: true, + dataTransfer, + }), + ); + }; + // Pending authorization leaves attachments without a valid org, so drops + // must be ignored. + expect(dropFile("drop.txt")).toBe(true); + expect(canvas.queryByLabelText("Remove drop.txt")).not.toBeInTheDocument(); + // The pending option list is unfiltered, so the picker must stay hidden. + expect( + canvas.queryByRole("button", { name: /organization/i }), + ).not.toBeInTheDocument(); + await waitFor(() => expect(sendButton).toBeEnabled(), { timeout: 3_000 }); + await canvas.findByRole("button", { name: /organization/i }); + // Positive control: once settled the same drop is accepted and + // attaches, so the pending-state assertions exercised a real path. + expect(dropFile("after.txt")).toBe(false); + await waitFor(() => + expect(canvas.getByLabelText("Remove after.txt")).toBeInTheDocument(), + ); + }, +}; + +// Mutable permissions let play functions change authorization across refetches. +// The story-local QueryClient exposes those refetches; the preview client's +// instance is inaccessible and uses infinite stale time. +const revocablePermissions: Record = {}; +let revocableQueryClient: QueryClient | undefined; + +const withRevocableQueryClient: Decorator = (Story) => { + const [queryClient] = useState( + () => + new QueryClient({ + defaultOptions: { + queries: { + staleTime: Number.POSITIVE_INFINITY, + retry: false, + }, + }, + }), + ); + revocableQueryClient = queryClient; + return ( + + + + ); +}; + +const mockRevocablePermissions = (permissions: Record) => { + for (const key of Object.keys(revocablePermissions)) { + delete revocablePermissions[key]; + } + Object.assign(revocablePermissions, permissions); + spyOn(API, "getOrganizations").mockResolvedValue([ + MockDefaultOrganization, + MockOrganization2, + ]); + spyOn(API, "checkAuthorization").mockImplementation(async () => ({ + ...revocablePermissions, + })); +}; + +const revocableStoryContext = { + parameters: { + showOrganizations: true, + organizations: [MockDefaultOrganization, MockOrganization2], + }, + decorators: [withRevocableQueryClient], +}; + +const allOrganizationsPermitted = { + [MockDefaultOrganization.id]: true, + [MockOrganization2.id]: true, +}; + +export const RevokedSelectionDoesNotResurrect: Story = { + ...revocableStoryContext, + beforeEach: () => { + mockRevocablePermissions(allOrganizationsPermitted); + }, + play: async ({ canvasElement }) => { + const canvas = within(canvasElement); + const trigger = await canvas.findByRole("button", { + name: "Organization: My Organization", + }); + await userEvent.click(trigger); + await userEvent.click( + await screen.findByRole("option", { name: /My Organization 2/ }), + ); + await canvas.findByRole("button", { + name: "Organization: My Organization 2", + }); + + revocablePermissions[MockOrganization2.id] = false; + await revocableQueryClient?.invalidateQueries(); + await waitFor(() => + expect( + canvas.queryByRole("button", { name: /organization/i }), + ).not.toBeInTheDocument(), + ); + + revocablePermissions[MockOrganization2.id] = true; + await revocableQueryClient?.invalidateQueries(); + await canvas.findByRole("button", { + name: "Organization: My Organization", + }); + }, +}; + +export const RevokedOrgChangeClearsStoredWorkspace: Story = { + ...revocableStoryContext, + args: { + ...defaultArgs, + workspaceOptions: [ + { + ...MockWorkspace, + id: "ws-default-org", + name: "default-workspace", + organization_id: MockDefaultOrganization.id, + }, + ], + workspaceCount: 1, + }, + beforeEach: () => { + localStorage.setItem("agents.selected-workspace-id", "ws-default-org"); + mockRevocablePermissions(allOrganizationsPermitted); + }, + play: async ({ canvasElement }) => { + const canvas = within(canvasElement); + await waitFor(() => + expect( + canvas.getByLabelText("Remove workspace default-workspace"), + ).toBeInTheDocument(), + ); + + revocablePermissions[MockDefaultOrganization.id] = false; + await revocableQueryClient?.invalidateQueries(); + await waitFor(() => + expect( + canvas.queryByLabelText("Remove workspace default-workspace"), + ).not.toBeInTheDocument(), + ); + + revocablePermissions[MockDefaultOrganization.id] = true; + await revocableQueryClient?.invalidateQueries(); + await canvas.findByRole("button", { + name: "Organization: My Organization 2", + }); + expect( + canvas.queryByLabelText("Remove workspace default-workspace"), + ).not.toBeInTheDocument(); + expect(localStorage.getItem("agents.selected-workspace-id")).toBeNull(); + }, +}; + +export const EmptyPermittedSetPreservesStoredWorkspace: Story = { + ...revocableStoryContext, + args: { + ...defaultArgs, + workspaceOptions: [ + { + ...MockWorkspace, + id: "ws-org-2", + name: "org2-workspace", + organization_id: MockOrganization2.id, + }, + ], + }, + beforeEach: () => { + localStorage.setItem("agents.selected-workspace-id", "ws-org-2"); + mockRevocablePermissions({ + [MockDefaultOrganization.id]: false, + [MockOrganization2.id]: true, + }); + }, + play: async ({ canvasElement }) => { + const canvas = within(canvasElement); + await canvas.findByLabelText("Remove workspace org2-workspace"); + + revocablePermissions[MockOrganization2.id] = false; + await revocableQueryClient?.invalidateQueries(); + await canvas.findByText(/don't have permission/i); + + revocablePermissions[MockOrganization2.id] = true; + await revocableQueryClient?.invalidateQueries(); + await canvas.findByLabelText("Remove workspace org2-workspace"); + expect(localStorage.getItem("agents.selected-workspace-id")).toBe( + "ws-org-2", + ); + }, +}; + +export const SingleOrgIgnoresStalePermittedCache: Story = { + parameters: { + showOrganizations: false, + organizations: [MockDefaultOrganization], + queries: [ + { + key: permittedOrgsKey, + data: [MockOrganization2], + }, + ], + }, + args: { + ...defaultArgs, + onCreateChat: fn().mockResolvedValue(undefined), + }, + play: async ({ canvasElement, args }) => { + await submitMessage(canvasElement, "test message"); + await waitFor(() => { + expect(args.onCreateChat).toHaveBeenCalledWith( + expect.objectContaining({ + organizationId: MockDefaultOrganization.id, + }), + ); + }); + }, +}; + +export const RevokedPendingOrgClosesConfirmDialog: Story = { + ...revocableStoryContext, + beforeEach: () => { + localStorage.clear(); + localStorage.setItem( + persistedAttachmentsStorageKey, + JSON.stringify([ + { + fileId: "file-default-org", + fileName: "notes.txt", + fileType: "text/plain", + lastModified: 1700000000000, + organizationId: MockDefaultOrganization.id, + }, + ]), + ); + mockRevocablePermissions(allOrganizationsPermitted); + }, + play: async ({ canvasElement }) => { + const canvas = within(canvasElement); + const body = within(canvasElement.ownerDocument.body); + await waitFor(() => + expect(canvas.getByLabelText("Remove notes.txt")).toBeInTheDocument(), + ); + await userEvent.click( + await canvas.findByRole("button", { + name: "Organization: My Organization", + }), + ); + await userEvent.click( + await screen.findByRole("option", { name: /My Organization 2/ }), + ); + await body.findByText( + "Changing organization will remove your current attachments.", + ); + + revocablePermissions[MockOrganization2.id] = false; + await revocableQueryClient?.invalidateQueries(); + await waitFor(() => + expect( + body.queryByText( + "Changing organization will remove your current attachments.", + ), + ).not.toBeInTheDocument(), + ); + expect(canvas.getByLabelText("Remove notes.txt")).toBeInTheDocument(); }, }; @@ -965,14 +1449,27 @@ export const PermittedOrgsResolvesToEmpty: Story = { parameters: { showOrganizations: true, organizations: [MockDefaultOrganization, MockOrganization2], - // Deliberately do not pre-seed permittedOrgsKey. Let the - // mocked API calls drive the async permission resolution. }, args: { ...defaultArgs, onCreateChat: fn().mockResolvedValue(undefined), }, beforeEach: () => { + localStorage.clear(); + // Another org's persisted attachment must survive a visit while + // the user has no chat permission anywhere. + localStorage.setItem( + persistedAttachmentsStorageKey, + JSON.stringify([ + { + fileId: "file-other-org", + fileName: "keep.txt", + fileType: "text/plain", + lastModified: 1000, + organizationId: MockOrganization2.id, + }, + ]), + ); mockPermittedOrganizations({ [MockDefaultOrganization.id]: false, [MockOrganization2.id]: false, @@ -980,36 +1477,17 @@ export const PermittedOrgsResolvesToEmpty: Story = { }, play: async ({ canvasElement, args }) => { const canvas = within(canvasElement); - - // Wait for the permitted orgs query to resolve. The org picker - // should disappear since no org is permitted. await waitFor( () => { - expect( - canvas.queryByTestId("compact-org-selector"), - ).not.toBeInTheDocument(); + expect(canvas.getByText(/don't have permission/i)).toBeInTheDocument(); }, { timeout: 3000 }, ); - - // Type a message and submit the form. - const input = canvas.getByTestId("chat-message-input"); - await userEvent.click(input); - await userEvent.keyboard("test message"); - await userEvent.click(canvas.getByRole("button", { name: "Send" })); - - // Verify onCreateChat was called with a non-empty organizationId. - await waitFor(() => { - expect(args.onCreateChat).toHaveBeenCalled(); - }); - const options = (args.onCreateChat as ReturnType).mock - .calls[0]?.[0] as { organizationId: string } | undefined; - if (!options) { - throw new Error("Expected onCreateChat to receive options"); - } - expect(options.organizationId).not.toBe(""); - // It should fall back to the default org from the dashboard. - expect(options.organizationId).toBe(MockDefaultOrganization.id); + expect(canvas.getByRole("button", { name: "Send" })).toBeDisabled(); + expect(args.onCreateChat).not.toHaveBeenCalled(); + expect( + localStorage.getItem(persistedAttachmentsStorageKey) ?? "", + ).toContain("file-other-org"); }, }; diff --git a/site/src/pages/AgentsPage/components/AgentCreateForm.tsx b/site/src/pages/AgentsPage/components/AgentCreateForm.tsx index 22165f04b54..b81dbe083eb 100644 --- a/site/src/pages/AgentsPage/components/AgentCreateForm.tsx +++ b/site/src/pages/AgentsPage/components/AgentCreateForm.tsx @@ -1,4 +1,4 @@ -import { type FC, useEffect, useEffectEvent, useRef, useState } from "react"; +import { type FC, useEffect, useRef, useState } from "react"; import { useQuery } from "react-query"; import { toast } from "sonner"; import { isApiError } from "#/api/errors"; @@ -271,42 +271,96 @@ export const AgentCreateForm: FC = ({ : undefined; const initialOrg = organizations.find((o) => o.is_default) ?? organizations[0]; + // effectiveWorkspaceId nulls a stored selection outside the effective org's + // filtered workspace list without deleting it. Preserve the stored value + // because the permitted-organizations query may resolve after mount and + // change the effective org. const [selectedWorkspaceId, setSelectedWorkspaceId] = useState( - () => { - const stored = localStorage.getItem(selectedWorkspaceIdStorageKey); - if (!stored) return null; - - // The stored value is kept optimistically until workspaces - // load. effectiveWorkspaceId (computed after render) drops - // it if it doesn't match the current org's workspaces. - if (workspaceOptions.length === 0) return stored; - - // Validate the stored workspace still exists and belongs - // to the initial org. Without this, a workspace from a - // previously selected org persists across sessions and - // gets submitted even though it's hidden from the picker. - const workspace = workspaceOptions.find((ws) => ws.id === stored); - if (!workspace) { - localStorage.removeItem(selectedWorkspaceIdStorageKey); - return null; - } - if ( - showOrganizations && - initialOrg && - workspace.organization_id !== initialOrg.id - ) { - localStorage.removeItem(selectedWorkspaceIdStorageKey); - return null; - } - return stored; - }, + () => localStorage.getItem(selectedWorkspaceIdStorageKey), ); const [selectedOrg, setSelectedOrg] = useState( - initialOrg ?? null, + null, ); const [pendingOrgChange, setPendingOrgChange] = useState(null); - const organizationId = selectedOrg?.id ?? ""; + const permittedOrgsQuery = useQuery({ + ...permittedOrganizations({ + // agents-access grants chat:create only at member scope. "me" is + // replaced with the caller ID so that permission can match. + object: { resource_type: "chat", owner_id: "me" }, + action: "create", + }), + enabled: showOrganizations, + }); + // Disabled queries retain cached data. When the dashboard hides organization + // selection, its organization list is authoritative so a removed org cannot + // remain selected for submission. + const permittedOrgs = showOrganizations + ? (permittedOrgsQuery.data ?? organizations) + : organizations; + // Treat the dashboard org as provisional until permissions resolve so + // sends and persisted attachments cannot use an unpermitted org. + const orgSelectionSettled = + !showOrganizations || permittedOrgsQuery.data !== undefined; + // Prevent effectiveOrg's dashboard fallback from bypassing an empty + // permitted set. + const noPermittedOrgs = + showOrganizations && permittedOrgsQuery.data?.length === 0; + const selectedOrgIsPermitted = + selectedOrg !== null && + permittedOrgs.some((org) => org.id === selectedOrg.id); + // Clear invalid selections during render so re-permission cannot silently + // restore them and switch attachment state. effectiveOrg already ignores + // the invalid selection in this render. + if (selectedOrg && orgSelectionSettled && !selectedOrgIsPermitted) { + setSelectedOrg(null); + } + // Same rule for a pending change awaiting confirmation: closing the + // dialog prevents confirming into an org that was just revoked. + if ( + pendingOrgChange && + orgSelectionSettled && + !permittedOrgs.some((org) => org.id === pendingOrgChange.id) + ) { + setPendingOrgChange(null); + } + const effectiveOrg = + selectedOrg && selectedOrgIsPermitted + ? selectedOrg + : (permittedOrgs.find((org) => org.is_default) ?? + permittedOrgs[0] ?? + initialOrg ?? + null); + const organizationId = effectiveOrg?.id ?? ""; + // Adopt a permitted fallback so later refetches cannot switch the form to a + // re-permitted default. The permission guard also avoids a render loop. + if ( + orgSelectionSettled && + !selectedOrg && + effectiveOrg && + permittedOrgs.some((org) => org.id === effectiveOrg.id) + ) { + setSelectedOrg(effectiveOrg); + } + // Clear a workspace after a settled org change, before its localStorage value + // is cleared post-commit. An empty permission set has no selectable org, so + // preserve the workspace until its org is re-permitted. + const [lastSettledOrgId, setLastSettledOrgId] = useState(null); + if ( + orgSelectionSettled && + !noPermittedOrgs && + organizationId !== lastSettledOrgId + ) { + setLastSettledOrgId(organizationId); + if (lastSettledOrgId !== null) { + setSelectedWorkspaceId(null); + } + } + useEffect(() => { + if (selectedWorkspaceId === null) { + localStorage.removeItem(selectedWorkspaceIdStorageKey); + } + }, [selectedWorkspaceId]); const [planModeEnabled, setPlanModeEnabled] = useState(false); const hasModelOptions = modelOptions.length > 0; const hasConfiguredModels = hasConfiguredModelsInCatalog(modelCatalog); @@ -377,7 +431,7 @@ export const AgentCreateForm: FC = ({ saveReasoningEffortForModel(selectedModel, value); }; - const isForbidden = !canCreateChat; + const isForbidden = !canCreateChat || noPermittedOrgs; // Filter workspaces by the selected organization. We use // client-side filtering of the full "owner:me" fetch rather @@ -388,8 +442,8 @@ export const AgentCreateForm: FC = ({ // enough to warrant pagination, this should switch to a // server-side organization: query filter. const filteredWorkspaces = - showOrganizations && selectedOrg - ? workspaceOptions.filter((ws) => ws.organization_id === selectedOrg.id) + showOrganizations && effectiveOrg + ? workspaceOptions.filter((ws) => ws.organization_id === effectiveOrg.id) : workspaceOptions; const effectiveWorkspaceId = @@ -398,6 +452,11 @@ export const AgentCreateForm: FC = ({ filteredWorkspaces.some((ws) => ws.id === selectedWorkspaceId)) ? selectedWorkspaceId : null; + // A stored workspace cannot be validated against the effective org + // until the list loads; sending then would silently drop the + // association, so Send stays disabled instead. + const workspaceValidationPending = + selectedWorkspaceId !== null && isWorkspacesLoading; const handleSend = async (message: string, fileIDs?: string[]) => { submitDraft(); @@ -420,6 +479,7 @@ export const AgentCreateForm: FC = ({ }; const { + organizationAdopted, attachments, textContents, uploadStates, @@ -427,10 +487,17 @@ export const AgentCreateForm: FC = ({ handleAttach, handleRemoveAttachment, resetAttachments, - } = useFileAttachments(organizationId || undefined, { - persist: true, - provider: getProviderForModelOption(modelOptions, selectedModel), - }); + } = useFileAttachments( + // Avoid restoring against effectiveOrg's fallback when no org is permitted; + // that would prune attachments persisted for other orgs. + orgSelectionSettled && !noPermittedOrgs + ? organizationId || undefined + : undefined, + { + persist: true, + provider: getProviderForModelOption(modelOptions, selectedModel), + }, + ); const handleSendWithAttachments = async (message: string) => { const fileIds: string[] = []; @@ -459,50 +526,6 @@ export const AgentCreateForm: FC = ({ } }; - const permittedOrgsQuery = useQuery({ - ...permittedOrganizations({ - object: { resource_type: "chat", owner_id: "me" }, - action: "create", - }), - enabled: showOrganizations, - }); - const permittedOrgs = permittedOrgsQuery.data ?? organizations; - - // Reconcile selectedOrg when permission filtering removes it. - // Only pure state setters run during render; side effects - // (localStorage, blob URL cleanup) run in the effect below. - const [prevPermittedOrgs, setPrevPermittedOrgs] = useState(permittedOrgs); - const [orgWasAdjusted, setOrgWasAdjusted] = useState(false); - if (permittedOrgs !== prevPermittedOrgs) { - setPrevPermittedOrgs(permittedOrgs); - if (selectedOrg && !permittedOrgs.some((o) => o.id === selectedOrg.id)) { - // Fall back through: first permitted org, then the - // dashboard default. Never null out selectedOrg. - // organizationId must always be a valid UUID for the - // create-chat request. - const nextOrg = permittedOrgs[0] ?? initialOrg ?? null; - setSelectedOrg(nextOrg); - if (nextOrg?.id !== selectedOrg.id) { - setOrgWasAdjusted(true); - } - } - } - - // Clean up workspace and attachment state after a programmatic - // org change from permission filtering. These calls have side - // effects (localStorage, blob URL revocation) that must not - // run during render. - const onOrgAdjusted = useEffectEvent(() => { - handleWorkspaceChange(null); - resetAttachments(); - }); - useEffect(() => { - if (orgWasAdjusted) { - setOrgWasAdjusted(false); - onOrgAdjusted(); - } - }, [orgWasAdjusted]); - return ( <>

@@ -526,23 +549,27 @@ export const AgentCreateForm: FC = ({ {permittedOrgsQuery.error != null && ( )} - {showOrganizations && permittedOrgs.length > 1 && ( - { - const orgChanged = newOrg.id !== selectedOrg?.id; - if (orgChanged && attachments.length > 0) { - setPendingOrgChange(newOrg); - return; - } - if (orgChanged) { - handleWorkspaceChange(null); - } - setSelectedOrg(newOrg); - }} - /> - )} + {/* The pre-settlement list is the unfiltered dashboard fallback; + selecting from it could destroy existing workspace state. */} + {showOrganizations && + orgSelectionSettled && + permittedOrgs.length > 1 && ( + { + const orgChanged = newOrg.id !== effectiveOrg?.id; + if (orgChanged && attachments.length > 0) { + setPendingOrgChange(newOrg); + return; + } + if (orgChanged) { + handleWorkspaceChange(null); + } + setSelectedOrg(newOrg); + }} + /> + )} = ({ isDisabled={ isCreating || isForbidden || + !orgSelectionSettled || + // Sending before adoption would omit persisted files not yet restored. + !organizationAdopted || + workspaceValidationPending || isPersonalModelOverridesLoading || !hasModelOptions || Boolean(aiGatewayDisabled) @@ -569,7 +600,9 @@ export const AgentCreateForm: FC = ({ planModeEnabled={planModeEnabled} onPlanModeToggle={setPlanModeEnabled} attachments={attachments} - onAttach={handleAttach} + // Files attached before org adoption cannot upload and would be discarded + // when restoration completes. + onAttach={organizationAdopted ? handleAttach : undefined} onRemoveAttachment={handleRemoveAttachment} uploadStates={uploadStates} previewUrls={previewUrls} @@ -583,7 +616,12 @@ export const AgentCreateForm: FC = ({ onMCPAuthComplete={onMCPAuthComplete} workspaceOptions={filteredWorkspaces} selectedWorkspaceId={effectiveWorkspaceId} - onWorkspaceChange={handleWorkspaceChange} + // Do not persist a workspace until its organization is authorized. + onWorkspaceChange={ + orgSelectionSettled && !noPermittedOrgs + ? handleWorkspaceChange + : undefined + } isWorkspaceLoading={isWorkspacesLoading} canConfigureAgentSetup={canConfigureAgentSetup} providerCount={providerCount} @@ -617,10 +655,18 @@ export const AgentCreateForm: FC = ({ hideCancel={false} confirmText="Continue" onConfirm={() => { + if (!pendingOrgChange) { + return; + } + setPendingOrgChange(null); + // Recheck authorization because a refetch may revoke the pending org + // after this render created the closure. + if (!permittedOrgs.some((org) => org.id === pendingOrgChange.id)) { + return; + } resetAttachments(); handleWorkspaceChange(null); setSelectedOrg(pendingOrgChange); - setPendingOrgChange(null); }} onClose={() => setPendingOrgChange(null)} /> diff --git a/site/src/pages/AgentsPage/hooks/useFileAttachments.test.tsx b/site/src/pages/AgentsPage/hooks/useFileAttachments.test.tsx new file mode 100644 index 00000000000..38d82886b33 --- /dev/null +++ b/site/src/pages/AgentsPage/hooks/useFileAttachments.test.tsx @@ -0,0 +1,216 @@ +import { act, render, renderHook, waitFor } from "@testing-library/react"; +import { type FC, Suspense } from "react"; +import { beforeEach, describe, expect, it, vi } from "vitest"; +import { API } from "#/api/api"; +import { createDeferred } from "#/testHelpers/deferred"; +import { + persistedAttachmentsStorageKey, + useFileAttachments, +} from "./useFileAttachments"; + +const persistEntry = (fileId: string, fileName: string, orgId: string) => ({ + fileId, + fileName, + fileType: "text/plain", + lastModified: 1000, + organizationId: orgId, +}); + +const uploadedFileIds = ( + result: ReturnType, +): string[] => + [...result.uploadStates.values()].flatMap((state) => + state.status === "uploaded" && state.fileId ? [state.fileId] : [], + ); + +const renderAttachments = (initialProps: { orgId: string | undefined }) => + renderHook( + ({ orgId }: { orgId: string | undefined }) => + useFileAttachments(orgId, { persist: true }), + { initialProps }, + ); + +const mockDeferredUpload = (): ((value: { id: string }) => void) => { + const deferred = createDeferred<{ id: string }>(); + vi.spyOn(API.experimental, "uploadChatFile").mockReturnValue( + deferred.promise, + ); + return deferred.resolve; +}; + +describe("useFileAttachments org scoping", () => { + beforeEach(() => { + localStorage.clear(); + }); + + it("defers restoration until the org is known", () => { + localStorage.setItem( + persistedAttachmentsStorageKey, + JSON.stringify([persistEntry("file-b", "b.txt", "org-b")]), + ); + const { result, rerender } = renderAttachments({ orgId: undefined }); + + expect(result.current.attachments).toHaveLength(0); + expect(localStorage.getItem(persistedAttachmentsStorageKey)).toContain( + "file-b", + ); + + rerender({ orgId: "org-b" }); + expect(uploadedFileIds(result.current)).toStrictEqual(["file-b"]); + }); + + it("drops another org's attachments when the org changes", async () => { + localStorage.setItem( + persistedAttachmentsStorageKey, + JSON.stringify([persistEntry("file-a", "a.txt", "org-a")]), + ); + const { result, rerender } = renderAttachments({ orgId: "org-a" }); + expect(uploadedFileIds(result.current)).toStrictEqual(["file-a"]); + rerender({ orgId: "org-b" }); + await waitFor(() => { + expect(uploadedFileIds(result.current)).toStrictEqual([]); + }); + expect( + localStorage.getItem(persistedAttachmentsStorageKey) ?? "", + ).not.toContain("file-a"); + }); + + it("never exposes the previous org's file IDs in any render", async () => { + localStorage.setItem( + persistedAttachmentsStorageKey, + JSON.stringify([persistEntry("file-a", "a.txt", "org-a")]), + ); + // Log the hook output of every render, including the + // intermediate commit between the org changing and the + // adoption effect running; that window must expose nothing. + const renderLog: { orgId: string; fileIds: string[] }[] = []; + const Probe: FC<{ orgId: string }> = ({ orgId }) => { + const result = useFileAttachments(orgId, { persist: true }); + renderLog.push({ orgId, fileIds: uploadedFileIds(result) }); + return null; + }; + const { rerender } = render(); + expect(renderLog.at(-1)).toStrictEqual({ + orgId: "org-a", + fileIds: ["file-a"], + }); + + rerender(); + await waitFor(() => { + expect(renderLog.at(-1)?.fileIds).toStrictEqual([]); + }); + const leaked = renderLog.filter( + (entry) => entry.orgId === "org-b" && entry.fileIds.includes("file-a"), + ); + expect(leaked).toStrictEqual([]); + }); + + it("reports adoption only after the post-commit effect", () => { + localStorage.setItem( + persistedAttachmentsStorageKey, + JSON.stringify([persistEntry("file-a", "a.txt", "org-a")]), + ); + const log: { adopted: boolean; fileIds: string[] }[] = []; + const Probe: FC<{ orgId: string }> = ({ orgId }) => { + const result = useFileAttachments(orgId, { persist: true }); + log.push({ + adopted: result.organizationAdopted, + fileIds: uploadedFileIds(result), + }); + return null; + }; + render(); + expect(log[0]).toStrictEqual({ adopted: false, fileIds: [] }); + expect(log.at(-1)).toStrictEqual({ adopted: true, fileIds: ["file-a"] }); + }); + + it("discards an upload that completes after another org was adopted", async () => { + const resolveUpload = mockDeferredUpload(); + const { result, rerender } = renderAttachments({ orgId: "org-a" }); + act(() => { + result.current.startUpload(new File(["x"], "x.txt")); + }); + + rerender({ orgId: "org-b" }); + await waitFor(() => { + expect(result.current.organizationAdopted).toBe(true); + }); + await act(async () => { + resolveUpload({ id: "file-x" }); + }); + + expect(uploadedFileIds(result.current)).toStrictEqual([]); + expect( + localStorage.getItem(persistedAttachmentsStorageKey) ?? "", + ).not.toContain("file-x"); + }); + + it("discards an upload that spans an org round trip", async () => { + const resolveUpload = mockDeferredUpload(); + const { result, rerender } = renderAttachments({ orgId: "org-a" }); + act(() => { + result.current.startUpload(new File(["x"], "x.txt")); + }); + + // After A -> B -> A, only the adoption epoch distinguishes the stale upload. + rerender({ orgId: "org-b" }); + await waitFor(() => { + expect(result.current.organizationAdopted).toBe(true); + }); + rerender({ orgId: "org-a" }); + await waitFor(() => { + expect(result.current.organizationAdopted).toBe(true); + }); + await act(async () => { + resolveUpload({ id: "file-x" }); + }); + + expect(uploadedFileIds(result.current)).toStrictEqual([]); + expect( + localStorage.getItem(persistedAttachmentsStorageKey) ?? "", + ).not.toContain("file-x"); + }); + + it("hides attachments when authorization leaves no org", async () => { + localStorage.setItem( + persistedAttachmentsStorageKey, + JSON.stringify([persistEntry("file-a", "a.txt", "org-a")]), + ); + const { result, rerender } = renderAttachments({ orgId: "org-a" }); + await waitFor(() => { + expect(uploadedFileIds(result.current)).toStrictEqual(["file-a"]); + }); + + rerender({ orgId: undefined }); + expect(result.current.attachments).toStrictEqual([]); + expect(uploadedFileIds(result.current)).toStrictEqual([]); + expect(localStorage.getItem(persistedAttachmentsStorageKey)).toContain( + "file-a", + ); + + rerender({ orgId: "org-a" }); + await waitFor(() => { + expect(uploadedFileIds(result.current)).toStrictEqual(["file-a"]); + }); + }); + + it("does not prune storage during a render that never commits", () => { + localStorage.setItem( + persistedAttachmentsStorageKey, + JSON.stringify([persistEntry("file-a", "a.txt", "org-a")]), + ); + // Suspending after the hook runs simulates a render React abandons before commit. + const Suspender: FC<{ orgId: string }> = ({ orgId }) => { + useFileAttachments(orgId, { persist: true }); + throw new Promise(() => {}); + }; + render( + + + , + ); + expect(localStorage.getItem(persistedAttachmentsStorageKey)).toContain( + "file-a", + ); + }); +}); diff --git a/site/src/pages/AgentsPage/hooks/useFileAttachments.ts b/site/src/pages/AgentsPage/hooks/useFileAttachments.ts index eb6098c6312..b4b9193fb88 100644 --- a/site/src/pages/AgentsPage/hooks/useFileAttachments.ts +++ b/site/src/pages/AgentsPage/hooks/useFileAttachments.ts @@ -52,9 +52,7 @@ function restorePersistedAttachments(currentOrgId: string): { uploadStates: Map; previewUrls: Map; } { - // Skip when org ID isn't loaded yet so we don't prune valid - // entries. The initializer runs once, so callers must wait for - // the org ID before mounting. + // An unknown org must not prune entries persisted for the eventual org. if (!currentOrgId) { return { attachments: [], @@ -164,6 +162,11 @@ function clearPersistedAttachments() { } interface UseFileAttachmentsReturn { + /** + * True after the post-commit effect assigns in-memory attachment state to + * the supplied organization. Keep attach and send controls disabled until then. + */ + organizationAdopted: boolean; attachments: File[]; textContents: Map; uploadStates: Map; @@ -192,19 +195,14 @@ export function useFileAttachments( providerRef.current = provider; }, [provider]); - const [restored] = useState(() => - persist - ? restorePersistedAttachments(organizationId ?? "") - : { - attachments: [] as File[], - uploadStates: new Map(), - previewUrls: new Map(), - }, + const [attachments, setAttachments] = useState([]); + const [uploadStates, setUploadStates] = useState( + () => new Map(), ); - - const [attachments, setAttachments] = useState(restored.attachments); - const [uploadStates, setUploadStates] = useState(restored.uploadStates); - const [previewUrls, setPreviewUrls] = useState(restored.previewUrls); + const [previewUrls, setPreviewUrls] = useState(() => new Map()); + // Persisted state remains unowned until post-commit org adoption; restoring + // against a provisional org would prune entries for the eventual org. + const [stateOrgId, setStateOrgId] = useState(null); const [textContents, setTextContents] = useState( () => new Map(), ); @@ -220,6 +218,27 @@ export function useFileAttachments( return () => revokePreviewUrls(); }, []); + // Every adoption invalidates older upload completions, including A-to-B-to-A + // round trips where stateOrgId matches again. Otherwise a stale completion + // could persist and later restore an abandoned upload. + const adoptionEpochRef = useRef(0); + const commitUploadOutcome = useEffectEvent( + ( + file: File, + uploadOrgId: string, + uploadEpoch: number, + state: UploadState, + ) => { + if (persist && adoptionEpochRef.current !== uploadEpoch) { + return; + } + setUploadStates((prev) => new Map(prev).set(file, state)); + if (persist && state.status === "uploaded" && state.fileId) { + addPersistedAttachment(file, state.fileId, uploadOrgId); + } + }, + ); + const startUpload = (file: File) => { if (!organizationId) { setUploadStates((prev) => @@ -231,25 +250,18 @@ export function useFileAttachments( return; } - const shouldPersist = persist && Boolean(organizationId); + const uploadOrgId = organizationId; + const uploadEpoch = adoptionEpochRef.current; const isImage = file.type.startsWith("image/"); setUploadStates((prev) => new Map(prev).set(file, { status: "uploading" })); void (async () => { try { - const result = await API.experimental.uploadChatFile( - file, - organizationId, - ); - setUploadStates((prev) => - new Map(prev).set(file, { - status: "uploaded", - fileId: result.id, - }), - ); - if (shouldPersist) { - addPersistedAttachment(file, result.id, organizationId!); - } + const result = await API.experimental.uploadChatFile(file, uploadOrgId); + commitUploadOutcome(file, uploadOrgId, uploadEpoch, { + status: "uploaded", + fileId: result.id, + }); if (isImage) { // Pre-warm the HTTP cache so the timeline can // render the image instantly after send. Text @@ -257,13 +269,10 @@ export function useFileAttachments( void fetch(getChatFileURL(result.id)); } } catch (err: unknown) { - const errorMessage = formatAgentAttachmentUploadError(err); - setUploadStates((prev) => - new Map(prev).set(file, { - status: "error", - error: errorMessage, - }), - ); + commitUploadOutcome(file, uploadOrgId, uploadEpoch, { + status: "error", + error: formatAgentAttachmentUploadError(err), + }); } })(); }; @@ -273,6 +282,28 @@ export function useFileAttachments( // file can't be resurrected. WeakSet lets entries get GC'd. const abandonedResizesRef = useRef>(new WeakSet()); + // Permission refetches can change the org without user action. Replace state + // after commit so stale file IDs cannot cross orgs and an abandoned render + // cannot prune localStorage through restorePersistedAttachments. + const adoptOrganization = useEffectEvent((orgId: string) => { + adoptionEpochRef.current += 1; + for (const file of attachments) { + abandonedResizesRef.current.add(file); + } + revokePreviewUrls(); + setTextContents(new Map()); + setStateOrgId(orgId); + const restored = restorePersistedAttachments(orgId); + setAttachments(restored.attachments); + setUploadStates(restored.uploadStates); + setPreviewUrls(restored.previewUrls); + }); + useEffect(() => { + if (persist && organizationId && stateOrgId !== organizationId) { + adoptOrganization(organizationId); + } + }, [persist, stateOrgId, organizationId]); + type AttachItem = { file: File; needsResize: boolean }; const processResizes = async ( @@ -508,11 +539,18 @@ export function useFileAttachments( } }; + // Hide state that belongs to another organization. Exposing it could send + // stale file IDs or remove persisted attachments from the previous org. + const orgMismatch = + persist && stateOrgId !== null && stateOrgId !== organizationId; + return { - attachments, - textContents, - uploadStates, - previewUrls, + organizationAdopted: + !persist || (Boolean(organizationId) && stateOrgId === organizationId), + attachments: orgMismatch ? [] : attachments, + textContents: orgMismatch ? new Map() : textContents, + uploadStates: orgMismatch ? new Map() : uploadStates, + previewUrls: orgMismatch ? new Map() : previewUrls, handleAttach, handleRemoveAttachment, startUpload, From f1f331b210371dd04ec52c926d8d33a6d9522559 Mon Sep 17 00:00:00 2001 From: Jon Ayers Date: Tue, 25 Aug 2026 01:34:10 -0500 Subject: [PATCH 44/69] fix: add flag to disable workspace agent context sync (cherry-pick #28522) (#28524) Clean cherry-pick of #28522 (`26de6140fb`) onto `release/2.36`. Adds `CODER_DISABLE_WORKSPACE_AGENT_CONTEXT_SYNC` / `--disable-workspace-agent-context-sync`. When set, `PushContextState` rejects agent context pushes with a dRPC `Unimplemented` code before any validation or database work; deployed agents translate that into `ErrPushUnimplemented` and stop their push loop for the life of the connection. This gives large deployments a server-only kill switch for context sync database write load, with no agent updates or workspace restarts required. Validated on this branch: `go build`, `TestPushContextState` (unit), `TestWorkspaceAgentPushContextState*` (end-to-end over real dRPC), CLI and enterprise golden-file tests. --- cli/testdata/coder_server_--help.golden | 7 +++ cli/testdata/server-config.yaml.golden | 7 +++ coderd/agentapi/api.go | 6 ++- coderd/agentapi/context.go | 16 ++++++ coderd/agentapi/context_test.go | 22 +++++++++ coderd/apidoc/docs.go | 3 ++ coderd/apidoc/swagger.json | 3 ++ coderd/workspaceagents_test.go | 49 +++++++++++++++++++ coderd/workspaceagentsrpc.go | 1 + codersdk/deployment.go | 10 ++++ docs/admin/setup/configuration-reference.md | 8 +++ docs/reference/api/general.md | 1 + docs/reference/api/schemas.md | 3 ++ docs/reference/cli/server.md | 10 ++++ .../cli/testdata/coder_server_--help.golden | 7 +++ site/src/api/typesGenerated.ts | 1 + 16 files changed, 153 insertions(+), 1 deletion(-) diff --git a/cli/testdata/coder_server_--help.golden b/cli/testdata/coder_server_--help.golden index 8abc40867e2..54a17275244 100644 --- a/cli/testdata/coder_server_--help.golden +++ b/cli/testdata/coder_server_--help.golden @@ -55,6 +55,13 @@ OPTIONS: the workspace serves malicious JavaScript. This is recommended for security purposes if a --wildcard-access-url is configured. + --disable-workspace-agent-context-sync bool, $CODER_DISABLE_WORKSPACE_AGENT_CONTEXT_SYNC + Stop persisting workspace agent context snapshots (instructions, + skills, and MCP state used for pinned chat context). When set, coderd + rejects agent context pushes as unimplemented and agents stop sending + them; chats cannot pin workspace context. Use this to shed the + database write load of context sync on large deployments. + --disable-workspace-sharing bool, $CODER_DISABLE_WORKSPACE_SHARING Disable workspace sharing. Workspace ACL checking is disabled and only owners can have ssh, apps and terminal access to workspaces. Access diff --git a/cli/testdata/server-config.yaml.golden b/cli/testdata/server-config.yaml.golden index a8f3d90eb32..393150a0034 100644 --- a/cli/testdata/server-config.yaml.golden +++ b/cli/testdata/server-config.yaml.golden @@ -566,6 +566,13 @@ disableWorkspaceSharing: false # their chats. # (default: , type: bool) disableChatSharing: false +# Stop persisting workspace agent context snapshots (instructions, skills, and MCP +# state used for pinned chat context). When set, coderd rejects agent context +# pushes as unimplemented and agents stop sending them; chats cannot pin workspace +# context. Use this to shed the database write load of context sync on large +# deployments. +# (default: , type: bool) +disableWorkspaceAgentContextSync: false # These options change the behavior of how clients interact with the Coder. # Clients include the Coder CLI, Coder Desktop, IDE extensions, and the web UI. client: diff --git a/coderd/agentapi/api.go b/coderd/agentapi/api.go index ce697bc4826..c6a77362dec 100644 --- a/coderd/agentapi/api.go +++ b/coderd/agentapi/api.go @@ -83,7 +83,10 @@ type Options struct { Pubsub pubsub.Pubsub // ContextDirtyMarker is the chatd-backed hydrate/dirty fan-out invoked // from PushContextState. Nil when chatd is disabled. - ContextDirtyMarker ContextDirtyMarker + ContextDirtyMarker ContextDirtyMarker + // ContextSyncDisabled makes PushContextState reject pushes with a dRPC + // Unimplemented code so agents stop sending context snapshots. + ContextSyncDisabled bool ConnectionLogger *atomic.Pointer[connectionlog.ConnectionLogger] DerpMapFn func() *tailcfg.DERPMap TailnetCoordinator *atomic.Pointer[tailnet.Coordinator] @@ -257,6 +260,7 @@ func New(opts Options, workspace database.Workspace, agent database.WorkspaceAge Clock: opts.Clock, Database: opts.Database, DirtyMarker: opts.ContextDirtyMarker, + Disabled: opts.ContextSyncDisabled, } // Start background cache refresh loop to handle workspace changes diff --git a/coderd/agentapi/context.go b/coderd/agentapi/context.go index f6dd69e4e38..09766bca87c 100644 --- a/coderd/agentapi/context.go +++ b/coderd/agentapi/context.go @@ -12,6 +12,7 @@ import ( "golang.org/x/xerrors" "google.golang.org/protobuf/encoding/protojson" "google.golang.org/protobuf/proto" + "storj.io/drpc/drpcerr" "cdr.dev/slog/v3" agentproto "github.com/coder/coder/v2/agent/proto" @@ -67,6 +68,13 @@ type ContextAPI struct { // snapshot persisted by a push. It is nil when chatd is not running, // in which case PushContextState stays a pure write path. DirtyMarker ContextDirtyMarker + // Disabled rejects every push with a dRPC Unimplemented code. The + // agent's DRPCPusher translates that code into ErrPushUnimplemented, + // which terminates its RunPush loop for the life of the connection, + // exactly as if coderd predated the v2.10 Agent API. This is the + // deployment-wide kill switch for context sync write load + // (CODER_DISABLE_WORKSPACE_AGENT_CONTEXT_SYNC). + Disabled bool } // ContextDirtyMarker hydrates chats from, and marks chats dirty against, a @@ -103,6 +111,14 @@ type ContextDirtyMarker interface { // authorizes the actor (the agent's token subject) against the // workspace that owns the agent. func (a *ContextAPI) PushContextState(ctx context.Context, req *agentproto.PushContextStateRequest) (*agentproto.PushContextStateResponse, error) { + if a.Disabled { + // The Unimplemented code (not a plain error) is what tells the + // agent to stop pushing instead of retrying with backoff. + return nil, drpcerr.WithCode( + xerrors.New("agentapi: workspace agent context sync is disabled on this deployment"), + drpcerr.Unimplemented, + ) + } if req == nil { return nil, xerrors.New("agentapi: PushContextState request is nil") } diff --git a/coderd/agentapi/context_test.go b/coderd/agentapi/context_test.go index 5c724b93560..f190d0dfb02 100644 --- a/coderd/agentapi/context_test.go +++ b/coderd/agentapi/context_test.go @@ -13,6 +13,7 @@ import ( "github.com/lib/pq" "github.com/stretchr/testify/require" "go.uber.org/mock/gomock" + "storj.io/drpc/drpcerr" "cdr.dev/slog/v3" "cdr.dev/slog/v3/sloggers/slogtest" @@ -58,6 +59,27 @@ func TestPushContextState(t *testing.T) { ) } + t.Run("DisabledReturnsUnimplemented", func(t *testing.T) { + t.Parallel() + + // No InTx or query expectations: a disabled push must return + // before touching the store. The Unimplemented dRPC code is + // load-bearing; the agent's DRPCPusher translates it into + // ErrPushUnimplemented, which stops its RunPush loop instead + // of retrying with backoff. + api, _ := makeAPI(t) + api.Disabled = true + + resp, err := api.PushContextState(context.Background(), &agentproto.PushContextStateRequest{ + Version: 1, + AggregateHash: []byte{0x01, 0x02}, + Initial: true, + }) + require.Error(t, err) + require.Nil(t, resp) + require.EqualValues(t, drpcerr.Unimplemented, drpcerr.Code(err)) + }) + t.Run("AcceptsInitialPush", func(t *testing.T) { t.Parallel() diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go index 3021e5b0fd8..df3743c7334 100644 --- a/coderd/apidoc/docs.go +++ b/coderd/apidoc/docs.go @@ -19876,6 +19876,9 @@ const docTemplate = `{ "disable_path_apps": { "type": "boolean" }, + "disable_workspace_agent_context_sync": { + "type": "boolean" + }, "disable_workspace_sharing": { "type": "boolean" }, diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json index 5a9dd02720f..556ababc495 100644 --- a/coderd/apidoc/swagger.json +++ b/coderd/apidoc/swagger.json @@ -18027,6 +18027,9 @@ "disable_path_apps": { "type": "boolean" }, + "disable_workspace_agent_context_sync": { + "type": "boolean" + }, "disable_workspace_sharing": { "type": "boolean" }, diff --git a/coderd/workspaceagents_test.go b/coderd/workspaceagents_test.go index f41921c7bb5..50c829349d9 100644 --- a/coderd/workspaceagents_test.go +++ b/coderd/workspaceagents_test.go @@ -38,6 +38,7 @@ import ( "github.com/coder/coder/v2/agent/agentcontainers" "github.com/coder/coder/v2/agent/agentcontainers/acmock" "github.com/coder/coder/v2/agent/agentcontainers/watcher" + "github.com/coder/coder/v2/agent/agentcontext" "github.com/coder/coder/v2/agent/agenttest" agentproto "github.com/coder/coder/v2/agent/proto" "github.com/coder/coder/v2/coderd/agentapi/metadatabatcher" @@ -3243,6 +3244,54 @@ func TestWorkspaceAgentPushContextState(t *testing.T) { require.False(t, resp.GetAccepted()) } +// TestWorkspaceAgentPushContextStateDisabled verifies the +// --disable-workspace-agent-context-sync kill switch end to end over a +// real dRPC connection: the handler's Unimplemented code must survive +// the transport and be translated by the agent's DRPCPusher into +// ErrPushUnimplemented, which is what terminates the agent's RunPush +// loop instead of retrying with backoff. Nothing may be persisted. +func TestWorkspaceAgentPushContextStateDisabled(t *testing.T) { + t.Parallel() + + dv := coderdtest.DeploymentValues(t) + dv.DisableWorkspaceAgentContextSync = true + client, db := coderdtest.NewWithDatabase(t, &coderdtest.Options{ + DeploymentValues: dv, + }) + user := coderdtest.CreateFirstUser(t, client) + r := dbfake.WorkspaceBuild(t, db, database.WorkspaceTable{ + OrganizationID: user.OrganizationID, + OwnerID: user.UserID, + }).WithAgent().Do() + require.Len(t, r.Agents, 1) + agentID := r.Agents[0].ID + + ctx := testutil.Context(t, testutil.WaitLong) + + agentClient := agentsdk.New(client.URL, agentsdk.WithFixedToken(r.AgentToken)) + aAPI, _, err := agentClient.ConnectRPC210(ctx) + require.NoError(t, err) + defer func() { + cErr := aAPI.DRPCConn().Close() + require.NoError(t, cErr) + }() + + // Push through the same adapter the agent's RunPush loop uses so + // the test breaks if either side of the Unimplemented contract + // changes. + pusher := agentcontext.NewDRPCPusher(aAPI) + resp, err := pusher.PushContextState(ctx, &agentcontext.PushRequest{ + Version: 1, + Initial: true, + }) + require.ErrorIs(t, err, agentcontext.ErrPushUnimplemented) + require.Nil(t, resp) + + // The rejected push must not have persisted anything. + _, err = db.GetLatestWorkspaceAgentContextSnapshot(dbauthz.AsSystemRestricted(ctx), agentID) //nolint:gocritic // Test assertions read agent-pushed rows directly from the store. + require.ErrorIs(t, err, sql.ErrNoRows) +} + func requireGetManifest(ctx context.Context, t testing.TB, aAPI agentproto.DRPCAgentClient) agentsdk.Manifest { mp, err := aAPI.GetManifest(ctx, &agentproto.GetManifestRequest{}) require.NoError(t, err) diff --git a/coderd/workspaceagentsrpc.go b/coderd/workspaceagentsrpc.go index 1c4e14c3552..9e7de438e31 100644 --- a/coderd/workspaceagentsrpc.go +++ b/coderd/workspaceagentsrpc.go @@ -192,6 +192,7 @@ func (api *API) workspaceAgentRPC(rw http.ResponseWriter, r *http.Request) { // Optional: UpdateAgentMetricsFn: api.UpdateAgentMetrics, ContextDirtyMarker: contextDirtyMarker, + ContextSyncDisabled: api.DeploymentValues.DisableWorkspaceAgentContextSync.Value(), }, workspace, workspaceAgent) streamID := tailnet.StreamID{ diff --git a/codersdk/deployment.go b/codersdk/deployment.go index c95d910a0ed..514fa20db95 100644 --- a/codersdk/deployment.go +++ b/codersdk/deployment.go @@ -695,6 +695,7 @@ type DeploymentValues struct { DisableOwnerWorkspaceExec serpent.Bool `json:"disable_owner_workspace_exec,omitempty" typescript:",notnull"` DisableWorkspaceSharing serpent.Bool `json:"disable_workspace_sharing,omitempty" typescript:",notnull"` DisableChatSharing serpent.Bool `json:"disable_chat_sharing,omitempty" typescript:",notnull"` + DisableWorkspaceAgentContextSync serpent.Bool `json:"disable_workspace_agent_context_sync,omitempty" typescript:",notnull"` ProxyHealthStatusInterval serpent.Duration `json:"proxy_health_status_interval,omitempty" typescript:",notnull"` EnableTerraformDebugMode serpent.Bool `json:"enable_terraform_debug_mode,omitempty" typescript:",notnull"` UserQuietHoursSchedule UserQuietHoursScheduleConfig `json:"user_quiet_hours_schedule,omitempty" typescript:",notnull"` @@ -3739,6 +3740,15 @@ communicating directly.`, Value: &c.DisableChatSharing, YAML: "disableChatSharing", }, + { + Name: "Disable Workspace Agent Context Sync", + Description: "Stop persisting workspace agent context snapshots (instructions, skills, and MCP state used for pinned chat context). When set, coderd rejects agent context pushes as unimplemented and agents stop sending them; chats cannot pin workspace context. Use this to shed the database write load of context sync on large deployments.", + Flag: "disable-workspace-agent-context-sync", + Env: "CODER_DISABLE_WORKSPACE_AGENT_CONTEXT_SYNC", + + Value: &c.DisableWorkspaceAgentContextSync, + YAML: "disableWorkspaceAgentContextSync", + }, { Name: "Session Duration", Description: "The token expiry duration for browser sessions. Sessions may last longer if they are actively making requests, but this functionality can be disabled via --disable-session-expiry-refresh.", diff --git a/docs/admin/setup/configuration-reference.md b/docs/admin/setup/configuration-reference.md index 3636d7cc1ed..0790666d701 100644 --- a/docs/admin/setup/configuration-reference.md +++ b/docs/admin/setup/configuration-reference.md @@ -82,6 +82,14 @@ Disable workspace apps that are not served from subdomains. Path-based apps can - CLI flag: [`--disable-path-apps`](../../reference/cli/server.md#--disable-path-apps) - YAML key: `disablePathApps` +### Disable workspace agent context sync + +Stop persisting workspace agent context snapshots (instructions, skills, and MCP state used for pinned chat context). When set, coderd rejects agent context pushes as unimplemented and agents stop sending them; chats cannot pin workspace context. Use this to shed the database write load of context sync on large deployments. + +- Environment variable: `CODER_DISABLE_WORKSPACE_AGENT_CONTEXT_SYNC` +- CLI flag: [`--disable-workspace-agent-context-sync`](../../reference/cli/server.md#--disable-workspace-agent-context-sync) +- YAML key: `disableWorkspaceAgentContextSync` + ### Disable workspace sharing Disable workspace sharing. Workspace ACL checking is disabled and only owners can have ssh, apps and terminal access to workspaces. Access based on the 'owner' role is also allowed unless disabled via --disable-owner-workspace-access. diff --git a/docs/reference/api/general.md b/docs/reference/api/general.md index 4715ff82458..9ca81e264d1 100644 --- a/docs/reference/api/general.md +++ b/docs/reference/api/general.md @@ -289,6 +289,7 @@ curl -X GET http://coder-server:8080/api/v2/deployment/config \ "disable_owner_workspace_exec": true, "disable_password_auth": true, "disable_path_apps": true, + "disable_workspace_agent_context_sync": true, "disable_workspace_sharing": true, "docs_url": { "forceQuery": true, diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md index aefacff8a52..2d5da928e1d 100644 --- a/docs/reference/api/schemas.md +++ b/docs/reference/api/schemas.md @@ -5857,6 +5857,7 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o "disable_owner_workspace_exec": true, "disable_password_auth": true, "disable_path_apps": true, + "disable_workspace_agent_context_sync": true, "disable_workspace_sharing": true, "docs_url": { "forceQuery": true, @@ -6467,6 +6468,7 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o "disable_owner_workspace_exec": true, "disable_password_auth": true, "disable_path_apps": true, + "disable_workspace_agent_context_sync": true, "disable_workspace_sharing": true, "docs_url": { "forceQuery": true, @@ -6861,6 +6863,7 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o | `disable_owner_workspace_exec` | boolean | false | | | | `disable_password_auth` | boolean | false | | | | `disable_path_apps` | boolean | false | | | +| `disable_workspace_agent_context_sync` | boolean | false | | | | `disable_workspace_sharing` | boolean | false | | | | `docs_url` | [serpent.URL](#serpenturl) | false | | | | `enable_authz_recording` | boolean | false | | | diff --git a/docs/reference/cli/server.md b/docs/reference/cli/server.md index f4ae058d878..61e353573c8 100644 --- a/docs/reference/cli/server.md +++ b/docs/reference/cli/server.md @@ -1201,6 +1201,16 @@ Disable workspace sharing. Workspace ACL checking is disabled and only owners ca Disable chat sharing. Chat ACL checking is disabled and only owners can access their chats. +### --disable-workspace-agent-context-sync + +| | | +|-------------|----------------------------------------------------------| +| Type | bool | +| Environment | $CODER_DISABLE_WORKSPACE_AGENT_CONTEXT_SYNC | +| YAML | disableWorkspaceAgentContextSync | + +Stop persisting workspace agent context snapshots (instructions, skills, and MCP state used for pinned chat context). When set, coderd rejects agent context pushes as unimplemented and agents stop sending them; chats cannot pin workspace context. Use this to shed the database write load of context sync on large deployments. + ### --session-duration | | | diff --git a/enterprise/cli/testdata/coder_server_--help.golden b/enterprise/cli/testdata/coder_server_--help.golden index 369b2fe72c8..3fab5d4176a 100644 --- a/enterprise/cli/testdata/coder_server_--help.golden +++ b/enterprise/cli/testdata/coder_server_--help.golden @@ -56,6 +56,13 @@ OPTIONS: the workspace serves malicious JavaScript. This is recommended for security purposes if a --wildcard-access-url is configured. + --disable-workspace-agent-context-sync bool, $CODER_DISABLE_WORKSPACE_AGENT_CONTEXT_SYNC + Stop persisting workspace agent context snapshots (instructions, + skills, and MCP state used for pinned chat context). When set, coderd + rejects agent context pushes as unimplemented and agents stop sending + them; chats cannot pin workspace context. Use this to shed the + database write load of context sync on large deployments. + --disable-workspace-sharing bool, $CODER_DISABLE_WORKSPACE_SHARING Disable workspace sharing. Workspace ACL checking is disabled and only owners can have ssh, apps and terminal access to workspaces. Access diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts index 551a358a6db..d283df627e4 100644 --- a/site/src/api/typesGenerated.ts +++ b/site/src/api/typesGenerated.ts @@ -4641,6 +4641,7 @@ export interface DeploymentValues { readonly disable_owner_workspace_exec?: boolean; readonly disable_workspace_sharing?: boolean; readonly disable_chat_sharing?: boolean; + readonly disable_workspace_agent_context_sync?: boolean; readonly proxy_health_status_interval?: number; readonly enable_terraform_debug_mode?: boolean; readonly user_quiet_hours_schedule?: UserQuietHoursScheduleConfig; From 281d487abf1ae51d1ea6c3e2a55f07df913dfabf Mon Sep 17 00:00:00 2001 From: Jake Howell Date: Tue, 25 Aug 2026 14:49:02 +0700 Subject: [PATCH 45/69] fix(site): render change-version picker in place so it clears the dialog (#28490) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit > 🤖 This PR was written by Coder Agents on behalf of Jake Howell. Backports the [DEVEX-780](https://linear.app/codercom/issue/DEVEX-780/change-version-dialog-picker-is-inaccessible) fix to `release/2.36`. `main` is already fine, this is for shipped 2.36.x. ## Problem In the Change version dialog, the version picker options are unclickable, painted behind the dialog surface. The picker uses the shared Radix `Popover`, which portals to `document.body` at `z-50` (see #23374). On `release/2.36` the dialog is still an `@mui/material/Dialog` at `z-index: 1300`. Two body-level portals, `50` loses to `1300`, so the options render behind the dialog. `main` is unaffected because #27506 moved every dialog onto Radix, but that landed **after** the 2.36 branch cut, so 2.36.x shipped broken.

@@ -11,23 +11,23 @@ ${{ app_name | html }} Logo$

- {{ .Labels._subject }} + {{ .Labels._subject | html }}

Hi {{ .UserName }},

Hi {{ .UserName | html }},

{{ range $action := .Actions }} - - {{ $action.Label }} + + {{ $action.Label | html }} {{ end }}

Click here to manage your notification settings

Stop receiving emails like this

Click here to manage your notification settings

Stop receiving emails like this

diff --git a/coderd/notifications/dispatch/smtp_internal_test.go b/coderd/notifications/dispatch/smtp_internal_test.go index 1284cb070e1..187191d7c87 100644 --- a/coderd/notifications/dispatch/smtp_internal_test.go +++ b/coderd/notifications/dispatch/smtp_internal_test.go @@ -10,8 +10,100 @@ import ( "github.com/coder/coder/v2/coderd/notifications/render" "github.com/coder/coder/v2/coderd/notifications/types" + markdown "github.com/coder/coder/v2/coderd/render" ) +// Benign values, so a test measures only what its own payload injected. +func templateHelpers() map[string]any { + return map[string]any{ + "base_url": func() string { return "https://coder.example.com" }, + "current_year": func() string { return "2026" }, + "logo_url": func() string { return "https://coder.example.com/logo.png" }, + "app_name": func() string { return "Coder" }, + } +} + +func TestSMTPHTMLTemplateEscapesUntrustedValues(t *testing.T) { + t.Parallel() + + for _, tc := range []struct { + name string + title string + userName string + actions []types.TemplateAction + injected string + }{ + { + name: "EntityEncodedAnchorInSubject", + title: `Template "<a href="https://attacker.example/login">Re-authenticate now</a>" deleted`, + userName: "Bobby", + injected: `Re-authenticate now`, + }, + { + name: "EntityEncodedImageInSubject", + title: `Workspace "<img src=x onerror="alert(1)">" marked dormant`, + userName: "Bobby", + injected: `

`, + }, + { + name: "RawHTMLInUserName", + title: "Account suspended", + userName: `Bobby

`, + injected: `

`, + }, + { + name: "RawHTMLInActionLabel", + title: "Account suspended", + userName: "Bobby", + actions: []types.TemplateAction{ + {Label: `

`, URL: "https://coder.example.com/"}, + }, + injected: `

`, + }, + { + name: "RawHTMLInActionURL", + title: "Account suspended", + userName: "Bobby", + actions: []types.TemplateAction{ + {Label: "Open Coder", URL: `https://coder.example.com/?x=`}, + }, + injected: ``, + }, + } { + t.Run(tc.name, func(t *testing.T) { + t.Parallel() + + // Decodes the entities, so the title arrives as live markup. + subject, err := markdown.PlaintextFromMarkdown(tc.title) + require.NoError(t, err) + + // Actions are set as the template sees them. The enqueuer renders + // them into JSON first, which rejects a `"` of its own accord. + payload := types.MessagePayload{ + NotificationTemplateID: "00000000-0000-0000-0000-000000000000", + UserName: tc.userName, + Actions: tc.actions, + Labels: map[string]string{ + "_subject": subject, + "_body": "

Test body

", + }, + } + + got, err := render.GoTemplate(htmlTemplate, payload, templateHelpers()) + require.NoError(t, err) + + escaped := html.EscapeString(tc.injected) + require.NotEqual(t, tc.injected, escaped, + "case carries no HTML to escape, so it guards nothing") + + require.NotContains(t, got, tc.injected, + "untrusted markup reached the rendered email: %s", got) + require.Contains(t, got, escaped, + "the value must still be displayed, entity encoded: %s", got) + }) + } +} + func TestSMTPHTMLTemplateEscapesAppearanceHelpers(t *testing.T) { t.Parallel() @@ -28,12 +120,9 @@ func TestSMTPHTMLTemplateEscapesAppearanceHelpers(t *testing.T) { "_body": "

Test body

", }, } - helpers := map[string]any{ - "base_url": func() string { return "https://coder.example.com" }, - "current_year": func() string { return "2026" }, - "logo_url": func() string { return logoURL }, - "app_name": func() string { return appName }, - } + helpers := templateHelpers() + helpers["logo_url"] = func() string { return logoURL } + helpers["app_name"] = func() string { return appName } got, err := render.GoTemplate(htmlTemplate, payload, helpers) require.NoError(t, err) @@ -44,6 +133,65 @@ func TestSMTPHTMLTemplateEscapesAppearanceHelpers(t *testing.T) { require.False(t, strings.Contains(got, logoURL), "raw logo URL must not be rendered") } +// The template escapes every value it interpolates except _body, which is +// trusted rendered Markdown. The three values here cannot carry markup in +// production, so this test is the only thing that fails if their escaping is +// removed. +func TestSMTPHTMLTemplateEscapesTrustedValues(t *testing.T) { + t.Parallel() + + const injected = `a"onclick=alert(1)` + + for _, tc := range []struct { + name string + apply func(*types.MessagePayload, map[string]any) + }{ + { + // net/url preserves a quote in the query and --access-url is + // validated for its scheme only, so an operator can land this. + name: "BaseURL", + apply: func(_ *types.MessagePayload, h map[string]any) { + h["base_url"] = func() string { return "https://coder.example.com/?q=" + injected } + }, + }, + { + name: "CurrentYear", + apply: func(_ *types.MessagePayload, h map[string]any) { + h["current_year"] = func() string { return injected } + }, + }, + { + name: "NotificationTemplateID", + apply: func(p *types.MessagePayload, _ map[string]any) { + p.NotificationTemplateID = injected + }, + }, + } { + t.Run(tc.name, func(t *testing.T) { + t.Parallel() + + payload := types.MessagePayload{ + NotificationTemplateID: "00000000-0000-0000-0000-000000000000", + UserName: "Test User", + Labels: map[string]string{ + "_subject": "Test notification", + "_body": "

Test body

", + }, + } + helpers := templateHelpers() + tc.apply(&payload, helpers) + + got, err := render.GoTemplate(htmlTemplate, payload, helpers) + require.NoError(t, err) + + require.NotContains(t, got, injected, + "raw value reached the rendered email: %s", got) + require.Contains(t, got, html.EscapeString(injected), + "the value must still be displayed, entity encoded: %s", got) + }) + } +} + func TestValidateFromAddr(t *testing.T) { t.Parallel() diff --git a/coderd/notifications/notifier.go b/coderd/notifications/notifier.go index 19533c04942..e17243e3b6e 100644 --- a/coderd/notifications/notifier.go +++ b/coderd/notifications/notifier.go @@ -253,7 +253,9 @@ func (n *notifier) prepare(ctx context.Context, msg database.AcquireNotification // Label and data values are user-controlled while the templates around them // are not, so Markdown structure in a value is neutralized before it reaches // the template. The dispatcher still receives the unescaped payload, because - // the webhook contract surfaces enqueued values verbatim. + // the webhook contract surfaces enqueued values verbatim. smtp/html.gotmpl + // escapes at its own sinks, which it must: PlaintextFromMarkdown strips this + // escaping back out of _subject. escaped := payload.EscapedForMarkdown() var title, body string diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateAIBudgetLimitReachedUser.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateAIBudgetLimitReachedUser.html.golden index 37db6f733cc..94d00686923 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateAIBudgetLimitReachedUser.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateAIBudgetLimitReachedUser.html.golden @@ -30,7 +30,7 @@ Content-Type: text/html; charset=UTF-8 - You've reached your monthly AI budget limit + You've reached your monthly AI budget limit

- You've reached your monthly AI budget limit + You've reached your monthly AI budget limit

Hi Bobby,

diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateAIBudgetWarningUser.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateAIBudgetWarningUser.html.golden index 3927ab28e31..4d5ffdf4744 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateAIBudgetWarningUser.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateAIBudgetWarningUser.html.golden @@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8 - You're approaching your monthly AI budget limit + You're approaching your monthly AI budget limit

- You're approaching your monthly AI budget limit + You're approaching your monthly AI budget limit

Hi Bobby,

diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskCompleted.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskCompleted.html.golden index 769d5595dbc..b4a2d53763c 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskCompleted.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskCompleted.html.golden @@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8 - Task 'my-workspace' completed + Task 'my-workspace' completed

- Task 'my-workspace' completed + Task 'my-workspace' completed

Hi Bobby,

diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskFailed.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskFailed.html.golden index 5d0879bc82d..1a17d690186 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskFailed.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskFailed.html.golden @@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8 - Task 'my-workspace' failed + Task 'my-workspace' failed

- Task 'my-workspace' failed + Task 'my-workspace' failed

Hi Bobby,

diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskIdle.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskIdle.html.golden index 578e39e91a2..0c4fea1cf9d 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskIdle.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskIdle.html.golden @@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8 - Task 'my-workspace' is idle + Task 'my-workspace' is idle

- Task 'my-workspace' is idle + Task 'my-workspace' is idle

Hi Bobby,

diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskPaused.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskPaused.html.golden index 58a1f098f77..f22fc19c5b6 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskPaused.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskPaused.html.golden @@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8 - Task 'my-task' is paused + Task 'my-task' is paused

- Task 'my-task' is paused + Task 'my-task' is paused

Hi Bobby,

diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskResumed.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskResumed.html.golden index 81d2498b579..4d71d3c8ec9 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskResumed.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskResumed.html.golden @@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8 - Task 'my-task' has resumed + Task 'my-task' has resumed

- Task 'my-task' has resumed + Task 'my-task' has resumed

Hi Bobby,

diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskWorking.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskWorking.html.golden index 21356601f62..b0cc318c350 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskWorking.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskWorking.html.golden @@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8 - Task 'my-workspace' is working + Task 'my-workspace' is working

- Task 'my-workspace' is working + Task 'my-workspace' is working

Hi Bobby,

diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeleted.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeleted.html.golden index 75af5a264e6..3103a58b97a 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeleted.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeleted.html.golden @@ -27,7 +27,7 @@ Content-Type: text/html; charset=UTF-8 - Template "Bobby's Template" deleted + Template "Bobby's Template" deleted

- Template "Bobby's Template" deleted + Template "Bobby's Template" deleted

Hi Bobby,

diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeprecated.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeprecated.html.golden index 70c27eed186..6eea0d7a8db 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeprecated.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeprecated.html.golden @@ -35,7 +35,7 @@ Content-Type: text/html; charset=UTF-8 - Template 'alpha' has been deprecated + Template 'alpha' has been deprecated

- Template 'alpha' has been deprecated + Template 'alpha' has been deprecated

Hi Bobby,

diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountActivated.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountActivated.html.golden index 011ef84ebfb..ff4ee4976af 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountActivated.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountActivated.html.golden @@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8 - User account "bobby" activated + User account "bobby" activated

- User account "bobby" activated + User account "bobby" activated

Hi Bobby,

diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountCreated.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountCreated.html.golden index 6fc619e4129..fa16f497bb9 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountCreated.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountCreated.html.golden @@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8 - User account "bobby" created + User account "bobby" created

- User account "bobby" created + User account "bobby" created

Hi Bobby,

diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountDeleted.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountDeleted.html.golden index cfcb22beec1..e52d1b71ab8 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountDeleted.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountDeleted.html.golden @@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8 - User account "bobby" deleted + User account "bobby" deleted

- User account "bobby" deleted + User account "bobby" deleted

Hi Bobby,

diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountSuspended.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountSuspended.html.golden index 9664bc88924..99cddd3593b 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountSuspended.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountSuspended.html.golden @@ -30,7 +30,7 @@ Content-Type: text/html; charset=UTF-8 - User account "bobby" suspended + User account "bobby" suspended

- User account "bobby" suspended + User account "bobby" suspended

Hi Bobby,

diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserRequestedOneTimePasscode.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserRequestedOneTimePasscode.html.golden index 12e29c47ed0..819fc0d0e85 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserRequestedOneTimePasscode.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserRequestedOneTimePasscode.html.golden @@ -56,10 +56,10 @@ argin: 8px 0 32px; line-height: 1.5;">

=20 +2-4cdb-87f1-0486f1bea415&email=3Dbobby%2Fdrop-table%2Buser%40coder.com"= + style=3D"display: inline-block; padding: 13px 24px; background-color: #020= +617; color: #f8fafc; text-decoration: none; border-radius: 8px; margin: 0 4= +px;"> Reset password =20 diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceAutoUpdated.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceAutoUpdated.html.golden index 2304fbf01bd..378f13e534d 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceAutoUpdated.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceAutoUpdated.html.golden @@ -30,7 +30,8 @@ Content-Type: text/html; charset=UTF-8 - Workspace "bobby-workspace" updated automatically + Workspace "bobby-workspace" updated automatically</title= +> </head> <body style=3D"margin: 0; padding: 0; font-family: -apple-system, system-= ui, BlinkMacSystemFont, 'Segoe UI', 'Roboto', 'Oxygen', 'Ubuntu', 'Cantarel= @@ -45,7 +46,7 @@ er Logo" style=3D"height: 40px;" /> </div> <h1 style=3D"text-align: center; font-size: 24px; font-weight: 400; m= argin: 8px 0 32px; line-height: 1.5;"> - Workspace "bobby-workspace" updated automatically + Workspace "bobby-workspace" updated automatically </h1> <div style=3D"line-height: 1.5;"> <p>Hi Bobby,</p> diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceAutobuildFailed.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceAutobuildFailed.html.golden index c132ffb47d9..7cb61a67011 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceAutobuildFailed.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceAutobuildFailed.html.golden @@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8 <meta charset=3D"UTF-8" /> <meta name=3D"viewport" content=3D"width=3Ddevice-width, initial-scale= =3D1.0" /> - <title>Workspace "bobby-workspace" autobuild failed + Workspace "bobby-workspace" autobuild failed

- Workspace "bobby-workspace" autobuild failed + Workspace "bobby-workspace" autobuild failed

Hi Bobby,

diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceAutostopReminder.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceAutostopReminder.html.golden index 350896eb0eb..175cf87ece9 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceAutostopReminder.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceAutostopReminder.html.golden @@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8 - Your workspace "bobby-workspace" will stop soon + Your workspace "bobby-workspace" will stop soon

- Your workspace "bobby-workspace" will stop soon + Your workspace "bobby-workspace" will stop soon

Hi Bobby,

diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceCreated.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceCreated.html.golden index 9fccba0b1f2..97f6e720a28 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceCreated.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceCreated.html.golden @@ -28,7 +28,7 @@ Content-Type: text/html; charset=UTF-8 - Workspace 'bobby-workspace' has been created + Workspace 'bobby-workspace' has been created

- Workspace 'bobby-workspace' has been created + Workspace 'bobby-workspace' has been created

Hi Bobby,

diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted.html.golden index fcc9b57f17b..46ebe956cb2 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted.html.golden @@ -31,7 +31,7 @@ Content-Type: text/html; charset=UTF-8 - Workspace "bobby-workspace" deleted + Workspace "bobby-workspace" deleted

- Workspace "bobby-workspace" deleted + Workspace "bobby-workspace" deleted

Hi Bobby,

diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted_CustomAppearance.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted_CustomAppearance.html.golden index 7c1f7192b1f..cf1e96a2eda 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted_CustomAppearance.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted_CustomAppearance.html.golden @@ -31,7 +31,7 @@ Content-Type: text/html; charset=UTF-8 - Workspace "bobby-workspace" deleted + Workspace "bobby-workspace" deleted

- Workspace "bobby-workspace" deleted + Workspace "bobby-workspace" deleted

Hi Bobby,

diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant.html.golden index ea9e1b69795..a6ee986bd9d 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant.html.golden @@ -34,7 +34,7 @@ Content-Type: text/html; charset=UTF-8 - Workspace "bobby-workspace" marked as dormant + Workspace "bobby-workspace" marked as dormant

- Workspace "bobby-workspace" marked as dormant + Workspace "bobby-workspace" marked as dormant

Hi Bobby,

diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant_NoAutoDelete.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant_NoAutoDelete.html.golden index e41eeb19fee..97c4d95bdf8 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant_NoAutoDelete.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant_NoAutoDelete.html.golden @@ -31,7 +31,7 @@ Content-Type: text/html; charset=UTF-8 - Workspace "bobby-workspace" marked as dormant + Workspace "bobby-workspace" marked as dormant

- Workspace "bobby-workspace" marked as dormant + Workspace "bobby-workspace" marked as dormant

Hi Bobby,

diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManualBuildFailed.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManualBuildFailed.html.golden index 2f7bb2771c8..f1b67ebc39c 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManualBuildFailed.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManualBuildFailed.html.golden @@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8 - Workspace "bobby-workspace" manual build failed + Workspace "bobby-workspace" manual build failed

- Workspace "bobby-workspace" manual build failed + Workspace "bobby-workspace" manual build failed

Hi Bobby,

diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManuallyUpdated.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManuallyUpdated.html.golden index 0e70293b090..d971cd94c15 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManuallyUpdated.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManuallyUpdated.html.golden @@ -31,7 +31,8 @@ Content-Type: text/html; charset=UTF-8 - Workspace 'bobby-workspace' has been manually updated + Workspace 'bobby-workspace' has been manually updated</t= +itle> </head> <body style=3D"margin: 0; padding: 0; font-family: -apple-system, system-= ui, BlinkMacSystemFont, 'Segoe UI', 'Roboto', 'Oxygen', 'Ubuntu', 'Cantarel= @@ -46,7 +47,7 @@ er Logo" style=3D"height: 40px;" /> </div> <h1 style=3D"text-align: center; font-size: 24px; font-weight: 400; m= argin: 8px 0 32px; line-height: 1.5;"> - Workspace 'bobby-workspace' has been manually updated + Workspace 'bobby-workspace' has been manually updated </h1> <div style=3D"line-height: 1.5;"> <p>Hi Bobby,</p> diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceMarkedForDeletion.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceMarkedForDeletion.html.golden index 3937a96cd93..a3fa8366514 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceMarkedForDeletion.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceMarkedForDeletion.html.golden @@ -31,7 +31,7 @@ Content-Type: text/html; charset=UTF-8 <meta charset=3D"UTF-8" /> <meta name=3D"viewport" content=3D"width=3Ddevice-width, initial-scale= =3D1.0" /> - <title>Workspace "bobby-workspace" marked for deletion + Workspace "bobby-workspace" marked for deletion

- Workspace "bobby-workspace" marked for deletion + Workspace "bobby-workspace" marked for deletion

Hi Bobby,

diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceOutOfDisk.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceOutOfDisk.html.golden index 1e65a1eab12..15bffe4a810 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceOutOfDisk.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceOutOfDisk.html.golden @@ -27,7 +27,8 @@ Content-Type: text/html; charset=UTF-8 - Your workspace "bobby-workspace" is low on volume space + Your workspace "bobby-workspace" is low on volume space<= +/title> </head> <body style=3D"margin: 0; padding: 0; font-family: -apple-system, system-= ui, BlinkMacSystemFont, 'Segoe UI', 'Roboto', 'Oxygen', 'Ubuntu', 'Cantarel= @@ -42,7 +43,7 @@ er Logo" style=3D"height: 40px;" /> </div> <h1 style=3D"text-align: center; font-size: 24px; font-weight: 400; m= argin: 8px 0 32px; line-height: 1.5;"> - Your workspace "bobby-workspace" is low on volume space + Your workspace "bobby-workspace" is low on volume space </h1> <div style=3D"line-height: 1.5;"> <p>Hi Bobby,</p> diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceOutOfDisk_MultipleVolumes.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceOutOfDisk_MultipleVolumes.html.golden index aad0c2190c2..1f134cb0739 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceOutOfDisk_MultipleVolumes.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceOutOfDisk_MultipleVolumes.html.golden @@ -31,7 +31,8 @@ Content-Type: text/html; charset=UTF-8 <meta charset=3D"UTF-8" /> <meta name=3D"viewport" content=3D"width=3Ddevice-width, initial-scale= =3D1.0" /> - <title>Your workspace "bobby-workspace" is low on volume space + Your workspace "bobby-workspace" is low on volume space<= +/title> </head> <body style=3D"margin: 0; padding: 0; font-family: -apple-system, system-= ui, BlinkMacSystemFont, 'Segoe UI', 'Roboto', 'Oxygen', 'Ubuntu', 'Cantarel= @@ -46,7 +47,7 @@ er Logo" style=3D"height: 40px;" /> </div> <h1 style=3D"text-align: center; font-size: 24px; font-weight: 400; m= argin: 8px 0 32px; line-height: 1.5;"> - Your workspace "bobby-workspace" is low on volume space + Your workspace "bobby-workspace" is low on volume space </h1> <div style=3D"line-height: 1.5;"> <p>Hi Bobby,</p> diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceOutOfMemory.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceOutOfMemory.html.golden index b75c2032003..44a0e92b249 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceOutOfMemory.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceOutOfMemory.html.golden @@ -28,7 +28,8 @@ Content-Type: text/html; charset=UTF-8 <meta charset=3D"UTF-8" /> <meta name=3D"viewport" content=3D"width=3Ddevice-width, initial-scale= =3D1.0" /> - <title>Your workspace "bobby-workspace" is low on memory + Your workspace "bobby-workspace" is low on memory</title= +> </head> <body style=3D"margin: 0; padding: 0; font-family: -apple-system, system-= ui, BlinkMacSystemFont, 'Segoe UI', 'Roboto', 'Oxygen', 'Ubuntu', 'Cantarel= @@ -43,7 +44,7 @@ er Logo" style=3D"height: 40px;" /> </div> <h1 style=3D"text-align: center; font-size: 24px; font-weight: 400; m= argin: 8px 0 32px; line-height: 1.5;"> - Your workspace "bobby-workspace" is low on memory + Your workspace "bobby-workspace" is low on memory </h1> <div style=3D"line-height: 1.5;"> <p>Hi Bobby,</p> diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateYourAccountActivated.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateYourAccountActivated.html.golden index b86fd4bf639..b2c0fb7c1af 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateYourAccountActivated.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateYourAccountActivated.html.golden @@ -27,7 +27,7 @@ Content-Type: text/html; charset=UTF-8 <meta charset=3D"UTF-8" /> <meta name=3D"viewport" content=3D"width=3Ddevice-width, initial-scale= =3D1.0" /> - <title>Your account "bobby" has been activated + Your account "bobby" has been activated

- Your account "bobby" has been activated + Your account "bobby" has been activated

Hi Bobby,

diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateYourAccountSuspended.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateYourAccountSuspended.html.golden index 277195a2bd4..74dee947796 100644 --- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateYourAccountSuspended.html.golden +++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateYourAccountSuspended.html.golden @@ -25,7 +25,7 @@ Content-Type: text/html; charset=UTF-8 - Your account "bobby" has been suspended + Your account "bobby" has been suspended

- Your account "bobby" has been suspended + Your account "bobby" has been suspended

Hi Bobby,

From c257214a6745f03881eb80f3a49ee919a58f50f2 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 26 Aug 2026 21:35:27 +0200 Subject: [PATCH 49/69] fix(coderd): reject agent requests from suspended owners (#28513) (#28648) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Backport of https://github.com/coder/coder/pull/28513 Original PR: #28513 — fix(coderd): reject agent requests from suspended owners Merge commit: 2f50b2d7408dff4275f81d18c32e2a517a16c897 Requested by: @hwang251 Co-authored-by: Hank Hwang Co-authored-by: Marcin Tojek --- coderd/httpmw/workspaceagent.go | 8 ++++++- coderd/httpmw/workspaceagent_test.go | 35 ++++++++++++++++++++++++++++ 2 files changed, 42 insertions(+), 1 deletion(-) diff --git a/coderd/httpmw/workspaceagent.go b/coderd/httpmw/workspaceagent.go index 47867e17b2c..7c7a28c07f3 100644 --- a/coderd/httpmw/workspaceagent.go +++ b/coderd/httpmw/workspaceagent.go @@ -109,7 +109,7 @@ func ExtractWorkspaceAgentAndLatestBuild(opts ExtractWorkspaceAgentAndLatestBuil return } - subject, _, err := UserRBACSubject( + subject, userStatus, err := UserRBACSubject( ctx, opts.DB, row.WorkspaceTable.OwnerID, @@ -129,6 +129,12 @@ func ExtractWorkspaceAgentAndLatestBuild(opts ExtractWorkspaceAgentAndLatestBuil }) return } + if userStatus != database.UserStatusActive { + httpapi.Write(ctx, rw, http.StatusUnauthorized, codersdk.Response{ + Message: fmt.Sprintf("User is not active (status = %q). Contact an admin to reactivate your account.", userStatus), + }) + return + } ctx = context.WithValue(ctx, workspaceAgentContextKey{}, row.WorkspaceAgent) ctx = context.WithValue(ctx, latestBuildContextKey{}, row.WorkspaceBuild) diff --git a/coderd/httpmw/workspaceagent_test.go b/coderd/httpmw/workspaceagent_test.go index 378d75927cc..c18e7aab91d 100644 --- a/coderd/httpmw/workspaceagent_test.go +++ b/coderd/httpmw/workspaceagent_test.go @@ -1,7 +1,10 @@ package httpmw_test import ( + "context" "database/sql" + "encoding/json" + "io" "net/http" "net/http/httptest" "testing" @@ -61,6 +64,38 @@ func TestWorkspaceAgent(t *testing.T) { require.Equal(t, http.StatusOK, res.StatusCode) }) + t.Run("InactiveUser", func(t *testing.T) { + t.Parallel() + db, _ := dbtestutil.NewDB(t) + authToken := uuid.New() + req, rtr, workspace, _ := setup(t, db, authToken, httpmw.ExtractWorkspaceAgentAndLatestBuild( + httpmw.ExtractWorkspaceAgentAndLatestBuildConfig{ + DB: db, + Optional: false, + }), + ) + + _, err := db.UpdateUserStatus(context.Background(), database.UpdateUserStatusParams{ + ID: workspace.OwnerID, + Status: database.UserStatusSuspended, + UpdatedAt: dbtime.Now(), + }) + require.NoError(t, err) + + rw := httptest.NewRecorder() + req.Header.Set(codersdk.SessionTokenHeader, authToken.String()) + rtr.ServeHTTP(rw, req) + + res := rw.Result() + defer res.Body.Close() + require.Equal(t, http.StatusUnauthorized, res.StatusCode) + body, err := io.ReadAll(res.Body) + require.NoError(t, err) + var response codersdk.Response + require.NoError(t, json.Unmarshal(body, &response)) + require.Contains(t, response.Message, `User is not active (status = "suspended")`) + }) + t.Run("Latest", func(t *testing.T) { t.Parallel() db, _ := dbtestutil.NewDB(t) From 3076b0c48f4752156a8bd711f7b209936eec3461 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 27 Aug 2026 18:18:50 +0200 Subject: [PATCH 50/69] fix: enable Copilot HTTP transport fallback (#28494) (#28715) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Backport of https://github.com/coder/coder/pull/28494 Original PR: #28494 — fix: enable Copilot HTTP transport fallback Merge commit: 849543d8de4cfb629fc6ca826673c3454b43ac4e Requested by: @ssncferreira Co-authored-by: Susana Ferreira --- aibridge/bridge.go | 20 ++ aibridge/bridge_internal_test.go | 30 +++ aibridge/bridge_test.go | 63 +++++- aibridge/provider/copilot.go | 2 + enterprise/aibridgeproxyd/aibridgeproxyd.go | 71 ++++--- .../aibridgeproxyd/aibridgeproxyd_test.go | 184 +++++++++++++++--- enterprise/aibridgeproxyd/reload.go | 11 +- .../aibridgeproxyd/reload_internal_test.go | 24 +-- 8 files changed, 335 insertions(+), 70 deletions(-) diff --git a/aibridge/bridge.go b/aibridge/bridge.go index 5f3a5fbce92..dff41ba117f 100644 --- a/aibridge/bridge.go +++ b/aibridge/bridge.go @@ -18,6 +18,7 @@ import ( "github.com/sony/gobreaker/v2" "go.opentelemetry.io/otel/codes" "go.opentelemetry.io/otel/trace" + "golang.org/x/net/http/httpguts" "golang.org/x/xerrors" "cdr.dev/slog/v3" @@ -248,6 +249,18 @@ func newInterceptionProcessor(p provider.Provider, cbs *circuitbreaker.ProviderC client := GuessClient(r) sessionID := GuessSessionID(client, r) + if isWebSocketUpgrade(r) { + route := strings.TrimPrefix(r.URL.Path, fmt.Sprintf("/%s", p.Name())) + logger.Debug(ctx, "rejecting unsupported WebSocket upgrade", + slog.F("provider", p.Name()), + slog.F("route", route), + slog.F("client", string(client)), + slog.F("client_session_id", sessionID), + ) + http.Error(w, "WebSocket transport is not supported, use HTTP", http.StatusNotImplemented) + return + } + // Read and validate Agent Firewall correlation headers. The // values are captured here and recorded below; the headers // themselves are stripped from the upstream request by @@ -381,6 +394,13 @@ func newInterceptionProcessor(p provider.Provider, cbs *circuitbreaker.ProviderC } } +// isWebSocketUpgrade reports whether r is a WebSocket opening handshake. +func isWebSocketUpgrade(r *http.Request) bool { + return r.Method == http.MethodGet && + httpguts.HeaderValuesContainsToken(r.Header.Values("Connection"), "upgrade") && + httpguts.HeaderValuesContainsToken(r.Header.Values("Upgrade"), "websocket") +} + // writeRequestBodyTooLarge writes a human-readable 413 response indicating that // the request body exceeded maxRequestBodyBytes. func writeRequestBodyTooLarge(w http.ResponseWriter) { diff --git a/aibridge/bridge_internal_test.go b/aibridge/bridge_internal_test.go index 561f758de12..e92d554ec59 100644 --- a/aibridge/bridge_internal_test.go +++ b/aibridge/bridge_internal_test.go @@ -10,6 +10,36 @@ import ( agplaibridge "github.com/coder/coder/v2/coderd/aibridge" ) +func TestIsWebSocketUpgrade(t *testing.T) { + t.Parallel() + + tests := []struct { + name string + method string + connection string + upgrade string + want bool + }{ + {name: "websocket upgrade", method: http.MethodGet, connection: "keep-alive, Upgrade", upgrade: "WebSocket", want: true}, + {name: "non-GET request", method: http.MethodPost, connection: "Upgrade", upgrade: "websocket", want: false}, + {name: "missing connection upgrade", method: http.MethodGet, connection: "keep-alive", upgrade: "websocket", want: false}, + {name: "different upgrade protocol", method: http.MethodGet, connection: "Upgrade", upgrade: "h2c", want: false}, + } + + for _, tc := range tests { + t.Run(tc.name, func(t *testing.T) { + t.Parallel() + + req, err := http.NewRequestWithContext(t.Context(), tc.method, "/", nil) + require.NoError(t, err) + req.Header.Set("Connection", tc.connection) + req.Header.Set("Upgrade", tc.upgrade) + + assert.Equal(t, tc.want, isWebSocketUpgrade(req)) + }) + } +} + func TestExtractAgentFirewallHeaders(t *testing.T) { t.Parallel() diff --git a/aibridge/bridge_test.go b/aibridge/bridge_test.go index d8e9103a7cb..c82ca422534 100644 --- a/aibridge/bridge_test.go +++ b/aibridge/bridge_test.go @@ -13,11 +13,13 @@ import ( "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" "go.opentelemetry.io/otel" + "go.opentelemetry.io/otel/trace" "cdr.dev/slog/v3/sloggers/slogtest" "github.com/coder/coder/v2/aibridge" "github.com/coder/coder/v2/aibridge/aibridgetest" "github.com/coder/coder/v2/aibridge/config" + "github.com/coder/coder/v2/aibridge/intercept" "github.com/coder/coder/v2/aibridge/internal/testutil" "github.com/coder/coder/v2/aibridge/provider" codertestutil "github.com/coder/coder/v2/testutil" @@ -186,11 +188,12 @@ func TestPassthroughRoutesForProviders(t *testing.T) { upstreamRespBody := "upstream response" tests := []struct { - name string - baseURLPath string - requestPath string - provider func(*testing.T, string) provider.Provider - expectPath string + name string + baseURLPath string + requestMethod string + requestPath string + provider func(*testing.T, string) provider.Provider + expectPath string }{ { name: "openAI_no_base_path", @@ -243,6 +246,23 @@ func TestPassthroughRoutesForProviders(t *testing.T) { }, expectPath: "/v1/models", }, + { + name: "copilot_ping", + requestPath: "/copilot/_ping", + provider: func(_ *testing.T, baseURL string) provider.Provider { + return aibridge.NewCopilotProvider(config.Copilot{BaseURL: baseURL}) + }, + expectPath: "/_ping", + }, + { + name: "copilot_auto", + requestMethod: http.MethodPost, + requestPath: "/copilot/auto", + provider: func(_ *testing.T, baseURL string) provider.Provider { + return aibridge.NewCopilotProvider(config.Copilot{BaseURL: baseURL}) + }, + expectPath: "/auto", + }, } for _, tc := range tests { @@ -263,7 +283,7 @@ func TestPassthroughRoutesForProviders(t *testing.T) { bridge, err := aibridge.NewRequestBridge(t.Context(), []provider.Provider{prov}, &rec, nil, logger, nil, bridgeTestTracer) require.NoError(t, err) - req := httptest.NewRequest("", tc.requestPath, nil) + req := httptest.NewRequest(tc.requestMethod, tc.requestPath, nil) resp := httptest.NewRecorder() bridge.ServeHTTP(resp, req) @@ -273,6 +293,37 @@ func TestPassthroughRoutesForProviders(t *testing.T) { } } +func TestWebSocketUpgradeRejected(t *testing.T) { + t.Parallel() + + interceptorCalled := false + prov := &testutil.MockProvider{ + NameStr: "test", + Bridged: []string{"/responses"}, + InterceptorFunc: func(http.ResponseWriter, *http.Request, trace.Tracer) (intercept.Interceptor, error) { + interceptorCalled = true + return nil, nil //nolint:nilnil // The interceptor must not be reached. + }, + } + bridge, err := aibridge.NewRequestBridge( + t.Context(), + []provider.Provider{prov}, + nil, nil, slogtest.Make(t, nil), nil, bridgeTestTracer, + ) + require.NoError(t, err) + + req := httptest.NewRequest(http.MethodGet, "/test/responses", nil) + req.Header.Set("Connection", "keep-alive, Upgrade") + req.Header.Set("Upgrade", "WebSocket") + resp := httptest.NewRecorder() + + bridge.ServeHTTP(resp, req) + + assert.Equal(t, http.StatusNotImplemented, resp.Code) + assert.Contains(t, resp.Body.String(), "WebSocket transport is not supported, use HTTP") + assert.False(t, interceptorCalled) +} + func TestRequestBodySizeLimit(t *testing.T) { t.Parallel() diff --git a/aibridge/provider/copilot.go b/aibridge/provider/copilot.go index 79dc37ae4be..10d634c7bdf 100644 --- a/aibridge/provider/copilot.go +++ b/aibridge/provider/copilot.go @@ -91,6 +91,8 @@ func (*Copilot) BridgedRoutes() []string { func (*Copilot) PassthroughRoutes() []string { return []string{ + "/_ping", + "/auto", "/models", "/models/", "/agents/", diff --git a/enterprise/aibridgeproxyd/aibridgeproxyd.go b/enterprise/aibridgeproxyd/aibridgeproxyd.go index 0941c2da4b5..fb7506b1d80 100644 --- a/enterprise/aibridgeproxyd/aibridgeproxyd.go +++ b/enterprise/aibridgeproxyd/aibridgeproxyd.go @@ -28,6 +28,7 @@ import ( "golang.org/x/xerrors" "cdr.dev/slog/v3" + aibridgeconfig "github.com/coder/coder/v2/aibridge/config" agplaibridge "github.com/coder/coder/v2/coderd/aibridge" ) @@ -132,7 +133,7 @@ type Server struct { // refreshProviders fetches the live provider snapshot on Reload. // Nil disables hot-reload. refreshProviders RefreshProvidersFunc - // providerRouter holds the live (mitmHosts, nameByHost) pair. + // providerRouter holds the live routing snapshot. providerRouter atomic.Pointer[providerRouter] // allowedPorts is the port allowlist for CONNECT requests. Fixed at // construction; not reloadable. @@ -149,19 +150,26 @@ type Server struct { metrics *Metrics } +type routedProvider struct { + name string + providerType string +} + // providerRouter keeps CONNECT matching and provider lookup in sync. type providerRouter struct { - mitmHosts []string // host:port set the goproxy condition matches against. - nameByHost map[string]string // lowercase hostname -> provider name. + mitmHosts []string // host:port set the goproxy condition matches against. + providerByHost map[string]routedProvider // lowercase hostname -> provider. } // emptyProviderRouter is used before the first Reload (or when the // operator deconfigures every provider) so handlers can safely call // loadProviderRouter without a nil check. -var emptyProviderRouter = &providerRouter{nameByHost: map[string]string{}} +var emptyProviderRouter = &providerRouter{ + providerByHost: map[string]routedProvider{}, +} -func (r *providerRouter) providerFromHost(host string) string { - return r.nameByHost[strings.ToLower(host)] +func (r *providerRouter) providerFromHost(host string) routedProvider { + return r.providerByHost[strings.ToLower(host)] } // requestContext holds metadata propagated through the proxy request/response chain. @@ -655,13 +663,13 @@ func (s *Server) authMiddleware(host string, ctx *goproxy.ProxyCtx) (*goproxy.Co provider := s.loadProviderRouter().providerFromHost(ctx.Req.URL.Hostname()) // A concurrent Reload can swap the router between CONNECT matching // and provider lookup, so treat a missing mapping as a runtime miss. - if provider == "" { + if provider.name == "" { logger.Warn(s.ctx, "rejecting CONNECT request with no provider mapping") return goproxy.RejectConnect, host } logger = logger.With( - slog.F("provider", provider), + slog.F("provider", provider.name), ) proxyAuth := ctx.Req.Header.Get("Proxy-Authorization") @@ -685,7 +693,7 @@ func (s *Server) authMiddleware(host string, ctx *goproxy.ProxyCtx) (*goproxy.Co ctx.UserData = &requestContext{ ConnectSessionID: connectSessionID, CoderToken: coderToken, - Provider: provider, + Provider: provider.name, } logger.Debug(s.ctx, "request CONNECT authenticated") @@ -936,14 +944,14 @@ func (s *Server) handleRequest(req *http.Request, ctx *goproxy.ProxyCtx) (*http. } } liveProvider := s.loadProviderRouter().providerFromHost(host) - if liveProvider == "" || liveProvider != reqCtx.Provider { + if liveProvider.name == "" || liveProvider.name != reqCtx.Provider { s.logger.Warn(s.ctx, "provider mapping changed or removed since CONNECT, passing through", slog.F("connect_id", reqCtx.ConnectSessionID.String()), slog.F("host", req.Host), slog.F("method", req.Method), slog.F("path", originalPath), slog.F("connect_provider", reqCtx.Provider), - slog.F("live_provider", liveProvider), + slog.F("live_provider", liveProvider.name), ) return req, nil } @@ -992,7 +1000,8 @@ func (s *Server) handleRequest(req *http.Request, ctx *goproxy.ProxyCtx) (*http. req.URL = parsedGatewayTargetURL req.Host = parsedGatewayTargetURL.Host - injectBYOKHeaderIfNeeded(req.Header, reqCtx.CoderToken) + // Prepare Coder authentication for centralized and BYOK requests. + prepareAIGatewayAuth(req.Header, reqCtx.CoderToken, liveProvider.providerType) // Set request ID header to correlate requests between aibridgeproxyd and aibridged. req.Header.Set(agplaibridge.HeaderCoderRequestID, reqCtx.RequestID.String()) @@ -1019,24 +1028,34 @@ func (s *Server) handleRequest(req *http.Request, ctx *goproxy.ProxyCtx) (*http. return req, nil } -// injectBYOKHeaderIfNeeded sets HeaderCoderToken when the -// Authorization header carries a bearer token that differs from the -// Coder token, indicating the client is using its own LLM -// credentials. Clients that can set custom headers -// do this themselves; this handles clients that cannot. -// -// In centralized mode, Authorization carries the Coder token -// itself, so aibridged discovers it via ExtractAuthToken -// without any extra header. -func injectBYOKHeaderIfNeeded(header http.Header, coderToken string) { - // Don’t overwrite the header if it’s already set. - if header.Get(agplaibridge.HeaderCoderToken) != "" { +// prepareAIGatewayAuth prepares the Coder authentication headers for AI +// Gateway. Copilot is always BYOK, while other providers may use centralized +// or BYOK authentication. +func prepareAIGatewayAuth(headers http.Header, coderToken, providerType string) { + // Copilot is always BYOK, even when a route does not include a provider + // credential (e.g., /_ping). Prevent the Coder token from being forwarded + // to Copilot as a provider credential. + if providerType == aibridgeconfig.ProviderCopilot { + headers.Set(agplaibridge.HeaderCoderToken, coderToken) + + if extractCoderTokenFromBearerAuth(headers.Get("Authorization")) == coderToken { + headers.Del("Authorization") + } + if strings.TrimSpace(headers.Get("X-Api-Key")) == coderToken { + headers.Del("X-Api-Key") + } + return + } + + // For other providers, only add the Coder token when a separate provider + // credential indicates BYOK. + if headers.Get(agplaibridge.HeaderCoderToken) != "" { return } - bearer := extractCoderTokenFromBearerAuth(header.Get("Authorization")) + bearer := extractCoderTokenFromBearerAuth(headers.Get("Authorization")) if bearer != "" && bearer != coderToken { - header.Set(agplaibridge.HeaderCoderToken, coderToken) + headers.Set(agplaibridge.HeaderCoderToken, coderToken) } } diff --git a/enterprise/aibridgeproxyd/aibridgeproxyd_test.go b/enterprise/aibridgeproxyd/aibridgeproxyd_test.go index 580b020ce15..99fc40bfce1 100644 --- a/enterprise/aibridgeproxyd/aibridgeproxyd_test.go +++ b/enterprise/aibridgeproxyd/aibridgeproxyd_test.go @@ -193,26 +193,21 @@ func withProviders(providers ...aibridgeproxyd.ReloadedProvider) testProxyOption } // withProviderHosts is a convenience that builds enabled -// ReloadedProvider entries from each host, looking up the well-known -// provider name via testProviderFromHost and falling back to -// "test-provider" for hosts without a well-known mapping. Equivalent -// to passing each entry individually to withProviders. +// ReloadedProvider entries from each host, looking up well-known providers +// via testProviderFromHost. Unknown hosts use a generic name and OpenAI type. func withProviderHosts(hosts ...string) testProxyOption { return func(cfg *testProxyConfig) { providers := make([]aibridgeproxyd.ReloadedProvider, 0, len(hosts)) for _, h := range hosts { - name := testProviderFromHost(h) - if name == "" { - name = "test-provider" - } + provider := testProviderFromHost(h) host, _, splitErr := net.SplitHostPort(h) if splitErr != nil { host = h } providers = append(providers, aibridgeproxyd.ReloadedProvider{ ProviderOutcome: aibridged.ProviderOutcome{ - Name: name, - Type: "openai", + Name: provider.name, + Type: provider.providerType, Status: aibridged.ProviderStatusEnabled, }, Host: strings.ToLower(host), @@ -222,24 +217,29 @@ func withProviderHosts(hosts ...string) testProxyOption { } } -// testProviderFromHost maps well-known AI provider hostnames to -// provider names for test use. Unknown hosts return "". -func testProviderFromHost(host string) string { +type testProvider struct { + name string + providerType string +} + +// testProviderFromHost maps well-known AI provider hostnames to providers for +// test use. Unknown hosts use a generic name and OpenAI type. +func testProviderFromHost(host string) testProvider { switch strings.ToLower(host) { case aibridgeproxyd.HostAnthropic: - return aibridge.ProviderAnthropic + return testProvider{name: aibridge.ProviderAnthropic, providerType: aibridge.ProviderAnthropic} case aibridgeproxyd.HostOpenAI: - return aibridge.ProviderOpenAI + return testProvider{name: aibridge.ProviderOpenAI, providerType: aibridge.ProviderOpenAI} case aibridgeproxyd.HostCopilot: - return aibridge.ProviderCopilot + return testProvider{name: aibridge.ProviderCopilot, providerType: aibridge.ProviderCopilot} case agplaibridge.HostCopilotBusiness: - return agplaibridge.ProviderCopilotBusiness + return testProvider{name: agplaibridge.ProviderCopilotBusiness, providerType: aibridge.ProviderCopilot} case agplaibridge.HostCopilotEnterprise: - return agplaibridge.ProviderCopilotEnterprise + return testProvider{name: agplaibridge.ProviderCopilotEnterprise, providerType: aibridge.ProviderCopilot} case agplaibridge.HostChatGPT: - return agplaibridge.ProviderChatGPT + return testProvider{name: agplaibridge.ProviderChatGPT, providerType: aibridge.ProviderOpenAI} default: - return "" + return testProvider{name: "test-provider", providerType: aibridge.ProviderOpenAI} } } @@ -1613,13 +1613,13 @@ func TestProxy_MITM_BYOKInjection(t *testing.T) { srv := newTestProxy(t, withGatewayURL(aibridgedServer.URL), - withProviderHosts(aibridgeproxyd.HostCopilot), + withProviderHosts(aibridgeproxyd.HostOpenAI), ) certPool := getProxyCertPool(t) client := newProxyClient(t, srv, makeProxyAuthHeader(coderToken), certPool, false) - req, err := http.NewRequestWithContext(t.Context(), http.MethodPost, "https://"+aibridgeproxyd.HostCopilot+"/chat/completions", strings.NewReader(`{}`)) + req, err := http.NewRequestWithContext(t.Context(), http.MethodPost, "https://"+aibridgeproxyd.HostOpenAI+"/chat/completions", strings.NewReader(`{}`)) require.NoError(t, err) req.Header.Set("Content-Type", "application/json") req.Header.Set("Authorization", tt.authzHeader) @@ -1643,6 +1643,146 @@ func TestProxy_MITM_BYOKInjection(t *testing.T) { } } +func TestProxy_MITM_CopilotAuth(t *testing.T) { + t.Parallel() + + const coderToken = "coder-token" + stringPtr := func(value string) *string { return &value } + tests := []struct { + name string + host string + providerType string + authorization string + apiKey string + coderToken string + expectCoderToken *string + expectAuthorization *string + expectAPIKey *string + }{ + { + name: "NoProviderCredential", + host: aibridgeproxyd.HostCopilot, + expectCoderToken: stringPtr(coderToken), + expectAuthorization: nil, + expectAPIKey: nil, + }, + { + name: "StripCoderBearer", + host: aibridgeproxyd.HostCopilot, + authorization: "Bearer " + coderToken, + expectCoderToken: stringPtr(coderToken), + expectAuthorization: nil, + expectAPIKey: nil, + }, + { + name: "StripCoderAPIKey", + host: aibridgeproxyd.HostCopilot, + apiKey: coderToken, + expectCoderToken: stringPtr(coderToken), + expectAuthorization: nil, + expectAPIKey: nil, + }, + { + name: "PreserveProviderBearer", + host: aibridgeproxyd.HostCopilot, + authorization: "Bearer copilot-token", + expectCoderToken: stringPtr(coderToken), + expectAuthorization: stringPtr("Bearer copilot-token"), + expectAPIKey: nil, + }, + { + name: "ReplaceClientCoderToken", + host: aibridgeproxyd.HostCopilot, + coderToken: "other-coder-token", + expectCoderToken: stringPtr(coderToken), + expectAuthorization: nil, + expectAPIKey: nil, + }, + { + name: "CustomCopilotProvider", + host: "copilot.example.com", + providerType: aibridge.ProviderCopilot, + expectCoderToken: stringPtr(coderToken), + expectAuthorization: nil, + expectAPIKey: nil, + }, + { + name: "NonCopilotProvider", + host: aibridgeproxyd.HostCopilot, + providerType: aibridge.ProviderOpenAI, + expectCoderToken: nil, + expectAuthorization: nil, + expectAPIKey: nil, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + t.Parallel() + + var receivedCoderToken, receivedAuthorization, receivedAPIKey string + aibridgedServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + receivedCoderToken = r.Header.Get(agplaibridge.HeaderCoderToken) + receivedAuthorization = r.Header.Get("Authorization") + receivedAPIKey = r.Header.Get("X-Api-Key") + w.WriteHeader(http.StatusOK) + })) + t.Cleanup(aibridgedServer.Close) + + provider := testProviderFromHost(tt.host) + if tt.providerType != "" { + provider.providerType = tt.providerType + } + srv := newTestProxy(t, + withGatewayURL(aibridgedServer.URL), + withProviders(aibridgeproxyd.ReloadedProvider{ + ProviderOutcome: aibridged.ProviderOutcome{ + Name: provider.name, + Type: provider.providerType, + Status: aibridged.ProviderStatusEnabled, + }, + Host: tt.host, + }), + ) + + certPool := getProxyCertPool(t) + client := newProxyClient(t, srv, makeProxyAuthHeader(coderToken), certPool, false) + + req, err := http.NewRequestWithContext(t.Context(), http.MethodGet, "https://"+tt.host, nil) + require.NoError(t, err) + if tt.authorization != "" { + req.Header.Set("Authorization", tt.authorization) + } + if tt.apiKey != "" { + req.Header.Set("X-Api-Key", tt.apiKey) + } + if tt.coderToken != "" { + req.Header.Set(agplaibridge.HeaderCoderToken, tt.coderToken) + } + resp, err := client.Do(req) + require.NoError(t, err) + defer resp.Body.Close() + + require.Equal(t, http.StatusOK, resp.StatusCode) + if tt.expectAuthorization == nil { + require.Empty(t, receivedAuthorization) + } else { + require.Equal(t, *tt.expectAuthorization, receivedAuthorization) + } + if tt.expectAPIKey == nil { + require.Empty(t, receivedAPIKey) + } else { + require.Equal(t, *tt.expectAPIKey, receivedAPIKey) + } + if tt.expectCoderToken == nil { + require.Empty(t, receivedCoderToken) + } else { + require.Equal(t, *tt.expectCoderToken, receivedCoderToken) + } + }) + } +} + // TestListenerTLS verifies that the proxy works correctly when its listener is wrapped in TLS. // It tests both tunneled and MITM'd requests through an HTTPS proxy listener. func TestListenerTLS(t *testing.T) { diff --git a/enterprise/aibridgeproxyd/reload.go b/enterprise/aibridgeproxyd/reload.go index 04b1f5438b0..9dc54c5fff6 100644 --- a/enterprise/aibridgeproxyd/reload.go +++ b/enterprise/aibridgeproxyd/reload.go @@ -119,7 +119,7 @@ func (s *Server) mitmHostsCondition() goproxy.ReqConditionFunc { // defense-in-depth measure even though the refresh function should // mark duplicates as errors. func buildProviderRouter(reload ProviderReload, allowedPorts []string) (*providerRouter, error) { - nameByHost := make(map[string]string, len(reload.Providers)) + providerByHost := make(map[string]routedProvider, len(reload.Providers)) domains := make([]string, 0, len(reload.Providers)) for _, p := range reload.Providers { if p.Status != aibridged.ProviderStatusEnabled { @@ -129,15 +129,18 @@ func buildProviderRouter(reload ProviderReload, allowedPorts []string) (*provide if host == "" { continue } - if _, exists := nameByHost[host]; exists { + if _, exists := providerByHost[host]; exists { continue } - nameByHost[host] = p.Name + providerByHost[host] = routedProvider{name: p.Name, providerType: p.Type} domains = append(domains, host) } mitmHosts, err := convertDomainsToHosts(domains, allowedPorts) if err != nil { return nil, err } - return &providerRouter{mitmHosts: mitmHosts, nameByHost: nameByHost}, nil + return &providerRouter{ + mitmHosts: mitmHosts, + providerByHost: providerByHost, + }, nil } diff --git a/enterprise/aibridgeproxyd/reload_internal_test.go b/enterprise/aibridgeproxyd/reload_internal_test.go index 5ccba37ec7b..537392fc447 100644 --- a/enterprise/aibridgeproxyd/reload_internal_test.go +++ b/enterprise/aibridgeproxyd/reload_internal_test.go @@ -40,7 +40,7 @@ func TestServerReloadSwapsProviderRouter(t *testing.T) { srv.providerRouter.Store(emptyProviderRouter) require.NoError(t, srv.Reload(ctx)) - assert.Equal(t, "old", srv.loadProviderRouter().providerFromHost("old.example.com")) + assert.Equal(t, routedProvider{name: "old", providerType: "openai"}, srv.loadProviderRouter().providerFromHost("old.example.com")) assert.Empty(t, srv.loadProviderRouter().providerFromHost("new.example.com")) reload = ProviderReload{Providers: []ReloadedProvider{enabledProvider("new", "new.example.com")}} @@ -48,7 +48,7 @@ func TestServerReloadSwapsProviderRouter(t *testing.T) { router := srv.loadProviderRouter() assert.Empty(t, router.providerFromHost("old.example.com")) - assert.Equal(t, "new", router.providerFromHost("new.example.com")) + assert.Equal(t, routedProvider{name: "new", providerType: "openai"}, router.providerFromHost("new.example.com")) assert.Equal(t, []string{"new.example.com:443"}, router.mitmHosts) } @@ -74,14 +74,14 @@ func TestServerReloadPreservesProviderRouterOnRefreshError(t *testing.T) { require.NoError(t, srv.Reload(ctx)) before := srv.loadProviderRouter() - assert.Equal(t, "old", before.providerFromHost("old.example.com")) + assert.Equal(t, routedProvider{name: "old", providerType: "openai"}, before.providerFromHost("old.example.com")) failRefresh = true require.ErrorIs(t, srv.Reload(ctx), refreshErr) after := srv.loadProviderRouter() assert.Same(t, before, after) - assert.Equal(t, "old", after.providerFromHost("old.example.com")) + assert.Equal(t, routedProvider{name: "old", providerType: "openai"}, after.providerFromHost("old.example.com")) assert.Equal(t, []string{"old.example.com:443"}, after.mitmHosts) } @@ -95,7 +95,7 @@ func TestBuildProviderRouter(t *testing.T) { reload := ProviderReload{Providers: []ReloadedProvider{ enabledProvider("openai", "api.openai.com"), - enabledProvider("anthropic", "api.anthropic.com"), + {ProviderOutcome: aibridged.ProviderOutcome{Name: "anthropic", Type: "anthropic", Status: aibridged.ProviderStatusEnabled}, Host: "api.anthropic.com"}, enabledProvider("custom", "custom-llm.example.com"), // Host is populated on the non-enabled rows so the Status // guard, not the empty-host guard, is what excludes them. @@ -106,9 +106,9 @@ func TestBuildProviderRouter(t *testing.T) { router, err := buildProviderRouter(reload, []string{"443"}) require.NoError(t, err) - assert.Equal(t, "openai", router.providerFromHost("api.openai.com")) - assert.Equal(t, "anthropic", router.providerFromHost("api.anthropic.com")) - assert.Equal(t, "custom", router.providerFromHost("custom-llm.example.com")) + assert.Equal(t, routedProvider{name: "openai", providerType: "openai"}, router.providerFromHost("api.openai.com")) + assert.Equal(t, routedProvider{name: "anthropic", providerType: "anthropic"}, router.providerFromHost("api.anthropic.com")) + assert.Equal(t, routedProvider{name: "custom", providerType: "openai"}, router.providerFromHost("custom-llm.example.com")) assert.Empty(t, router.providerFromHost("unknown.com")) assert.Empty(t, router.providerFromHost("disabled.example.com"), "disabled provider must not be routable even with a populated Host") @@ -130,8 +130,8 @@ func TestBuildProviderRouter(t *testing.T) { router, err := buildProviderRouter(reload, []string{"443"}) require.NoError(t, err) - assert.Equal(t, "provider", router.providerFromHost("API.Example.COM")) - assert.Equal(t, "provider", router.providerFromHost("api.example.com")) + assert.Equal(t, routedProvider{name: "provider", providerType: "openai"}, router.providerFromHost("API.Example.COM")) + assert.Equal(t, routedProvider{name: "provider", providerType: "openai"}, router.providerFromHost("api.example.com")) }) t.Run("DefensiveDeduplicatesSameHost", func(t *testing.T) { @@ -148,7 +148,7 @@ func TestBuildProviderRouter(t *testing.T) { router, err := buildProviderRouter(reload, []string{"443"}) require.NoError(t, err) - assert.Equal(t, "first", router.providerFromHost("api.example.com")) + assert.Equal(t, routedProvider{name: "first", providerType: "openai"}, router.providerFromHost("api.example.com")) }) t.Run("SkipsRowsWithEmptyHost", func(t *testing.T) { @@ -162,7 +162,7 @@ func TestBuildProviderRouter(t *testing.T) { router, err := buildProviderRouter(reload, []string{"443"}) require.NoError(t, err) - assert.Equal(t, "good", router.providerFromHost("api.good.example.com")) + assert.Equal(t, routedProvider{name: "good", providerType: "openai"}, router.providerFromHost("api.good.example.com")) assert.Equal(t, []string{"api.good.example.com:443"}, router.mitmHosts) }) } From ca8ef6c811c162377034e9bfafac632f08e21b7a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pawe=C5=82=20Banaszewski?= Date: Thu, 27 Aug 2026 18:19:47 +0200 Subject: [PATCH 51/69] fix: add cache write accounting to OpenAI interceptors (#28716) Cherry-picks: * ad100452d4554545e8f7dc1606a102f3713c9bd1 fixes token accumulation logic for chat completions PR https://github.com/coder/coder/pull/27967 * 3ca2ba485e548bc51d79bfae274b46ca0bb4d512 adds cache write tokens accounting to OpenAI interceptors, PR https://github.com/coder/coder/pull/28567 Compatibility fix: * ae737dbf15e06b251739a98f5e92113eea08eaa5 bumps OpenAI SDK + minimal changes, bump required by cherry picks, based on https://github.com/coder/coder/commit/c97f4da3ac --------- Co-authored-by: Michael Suchacz <203725896+ibetitsmike@users.noreply.github.com> --- aibridge/fixtures/fixtures.go | 3 + .../openai/chatcompletions/simple.txtar | 3 +- .../single_injected_tool.txtar | 32 ++-- ...aming_cumulative_usage_injected_tool.txtar | 30 ++++ .../blocking/cached_input_tokens.txtar | 3 +- .../blocking/single_injected_tool.txtar | 6 +- .../blocking/single_injected_tool_error.txtar | 6 +- .../streaming/cached_input_tokens.txtar | 2 +- .../streaming/single_injected_tool.txtar | 4 +- .../single_injected_tool_error.txtar | 4 +- aibridge/intercept/chatcompletions/base.go | 32 ++-- .../chatcompletions/base_internal_test.go | 86 ++++++++-- .../intercept/chatcompletions/streaming.go | 45 +++-- .../streaming_internal_test.go | 131 ++++++++++++++ aibridge/intercept/responses/base.go | 51 ++++-- .../intercept/responses/base_internal_test.go | 80 +++++++-- aibridge/intercept/responses/blocking.go | 50 +++++- .../integrationtest/bridge_internal_test.go | 153 +++++++++++++++-- .../integrationtest/metrics_internal_test.go | 8 +- .../responses_internal_test.go | 160 +++++++++++------- go.mod | 38 ++--- go.sum | 80 ++++----- 22 files changed, 753 insertions(+), 254 deletions(-) create mode 100644 aibridge/fixtures/openai/chatcompletions/streaming_cumulative_usage_injected_tool.txtar diff --git a/aibridge/fixtures/fixtures.go b/aibridge/fixtures/fixtures.go index 7a30ccbd631..9b2e8ad7f68 100644 --- a/aibridge/fixtures/fixtures.go +++ b/aibridge/fixtures/fixtures.go @@ -67,6 +67,9 @@ var ( //go:embed openai/chatcompletions/streaming_injected_tool_nonzero_index.txtar OaiChatStreamingInjectedToolNonzeroIndex []byte + + //go:embed openai/chatcompletions/streaming_cumulative_usage_injected_tool.txtar + OaiChatStreamingCumulativeUsageInjectedTool []byte ) var ( diff --git a/aibridge/fixtures/openai/chatcompletions/simple.txtar b/aibridge/fixtures/openai/chatcompletions/simple.txtar index 8f07d0c8ffa..2f458c3af98 100644 --- a/aibridge/fixtures/openai/chatcompletions/simple.txtar +++ b/aibridge/fixtures/openai/chatcompletions/simple.txtar @@ -492,7 +492,7 @@ data: {"id":"chatcmpl-BwoiPTGRbKkY5rncfaM0s9KtWrq5N","object":"chat.completion.c data: {"id":"chatcmpl-BwoiPTGRbKkY5rncfaM0s9KtWrq5N","object":"chat.completion.chunk","created":1753357673,"model":"gpt-4.1-2025-04-14","service_tier":"default","system_fingerprint":"fp_51e1070cf2","choices":[{"index":0,"delta":{},"logprobs":null,"finish_reason":"stop"}],"usage":null} -data: {"id":"chatcmpl-BwoiPTGRbKkY5rncfaM0s9KtWrq5N","object":"chat.completion.chunk","created":1753357673,"model":"gpt-4.1-2025-04-14","service_tier":"default","system_fingerprint":"fp_51e1070cf2","choices":[],"usage":{"prompt_tokens":19,"completion_tokens":238,"total_tokens":257,"prompt_tokens_details":{"cached_tokens":0,"audio_tokens":0},"completion_tokens_details":{"reasoning_tokens":0,"audio_tokens":0,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}}} +data: {"id":"chatcmpl-BwoiPTGRbKkY5rncfaM0s9KtWrq5N","object":"chat.completion.chunk","created":1753357673,"model":"gpt-4.1-2025-04-14","service_tier":"default","system_fingerprint":"fp_51e1070cf2","choices":[],"usage":{"prompt_tokens":19,"completion_tokens":238,"total_tokens":257,"prompt_tokens_details":{"cached_tokens":0,"cache_write_tokens":5,"audio_tokens":0},"completion_tokens_details":{"reasoning_tokens":0,"audio_tokens":0,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}}} data: [DONE] @@ -521,6 +521,7 @@ data: [DONE] "total_tokens": 219, "prompt_tokens_details": { "cached_tokens": 0, + "cache_write_tokens": 5, "audio_tokens": 0 }, "completion_tokens_details": { diff --git a/aibridge/fixtures/openai/chatcompletions/single_injected_tool.txtar b/aibridge/fixtures/openai/chatcompletions/single_injected_tool.txtar index b89aac648a1..61b4c1c3212 100644 --- a/aibridge/fixtures/openai/chatcompletions/single_injected_tool.txtar +++ b/aibridge/fixtures/openai/chatcompletions/single_injected_tool.txtar @@ -72,7 +72,7 @@ data: {"id":"chatcmpl-C1WTooFaxeQgtyLB1kg53t41aB0NV","object":"chat.completion.c data: {"id":"chatcmpl-C1WTooFaxeQgtyLB1kg53t41aB0NV","object":"chat.completion.chunk","created":1754479216,"model":"gpt-4.1-2025-04-14","service_tier":"default","system_fingerprint":"fp_799e4ca3f1","choices":[{"index":0,"delta":{},"logprobs":null,"finish_reason":"tool_calls"}],"usage":null,"obfuscation":"sDj"} -data: {"id":"chatcmpl-C1WTooFaxeQgtyLB1kg53t41aB0NV","object":"chat.completion.chunk","created":1754479216,"model":"gpt-4.1-2025-04-14","service_tier":"default","system_fingerprint":"fp_799e4ca3f1","choices":[],"usage":{"prompt_tokens":4862,"completion_tokens":45,"total_tokens":4907,"prompt_tokens_details":{"cached_tokens":0,"audio_tokens":0},"completion_tokens_details":{"reasoning_tokens":0,"audio_tokens":0,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"obfuscation":"8sIWE1chOW"} +data: {"id":"chatcmpl-C1WTooFaxeQgtyLB1kg53t41aB0NV","object":"chat.completion.chunk","created":1754479216,"model":"gpt-4.1-2025-04-14","service_tier":"default","system_fingerprint":"fp_799e4ca3f1","choices":[],"usage":{"prompt_tokens":4862,"completion_tokens":45,"total_tokens":4907,"prompt_tokens_details":{"cached_tokens":100,"cache_write_tokens":20,"audio_tokens":3},"completion_tokens_details":{"reasoning_tokens":4,"audio_tokens":5,"accepted_prediction_tokens":6,"rejected_prediction_tokens":7}},"obfuscation":"8sIWE1chOW"} data: [DONE] @@ -200,7 +200,7 @@ data: {"id":"chatcmpl-C1WTqhYgK7bV01bW98Lww3zqaf8ZF","object":"chat.completion.c data: {"id":"chatcmpl-C1WTqhYgK7bV01bW98Lww3zqaf8ZF","object":"chat.completion.chunk","created":1754479218,"model":"gpt-4.1-2025-04-14","service_tier":"default","system_fingerprint":"fp_799e4ca3f1","choices":[{"index":0,"delta":{},"logprobs":null,"finish_reason":"stop"}],"usage":null,"obfuscation":"EFeFvdS8m"} -data: {"id":"chatcmpl-C1WTqhYgK7bV01bW98Lww3zqaf8ZF","object":"chat.completion.chunk","created":1754479218,"model":"gpt-4.1-2025-04-14","service_tier":"default","system_fingerprint":"fp_799e4ca3f1","choices":[],"usage":{"prompt_tokens":5049,"completion_tokens":60,"total_tokens":5109,"prompt_tokens_details":{"cached_tokens":4864,"audio_tokens":0},"completion_tokens_details":{"reasoning_tokens":0,"audio_tokens":0,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"obfuscation":"0JQt7Fw"} +data: {"id":"chatcmpl-C1WTqhYgK7bV01bW98Lww3zqaf8ZF","object":"chat.completion.chunk","created":1754479218,"model":"gpt-4.1-2025-04-14","service_tier":"default","system_fingerprint":"fp_799e4ca3f1","choices":[],"usage":{"prompt_tokens":5049,"completion_tokens":60,"total_tokens":5109,"prompt_tokens_details":{"cached_tokens":4864,"cache_write_tokens":10,"audio_tokens":9},"completion_tokens_details":{"reasoning_tokens":10,"audio_tokens":11,"accepted_prediction_tokens":12,"rejected_prediction_tokens":13}},"obfuscation":"0JQt7Fw"} data: [DONE] @@ -237,16 +237,17 @@ data: [DONE] "usage": { "prompt_tokens": 4862, "completion_tokens": 45, - "total_tokens": 4914, + "total_tokens": 4907, "prompt_tokens_details": { - "cached_tokens": 0, - "audio_tokens": 0 + "cached_tokens": 100, + "cache_write_tokens": 20, + "audio_tokens": 3 }, "completion_tokens_details": { - "reasoning_tokens": 0, - "audio_tokens": 0, - "accepted_prediction_tokens": 0, - "rejected_prediction_tokens": 0 + "reasoning_tokens": 4, + "audio_tokens": 5, + "accepted_prediction_tokens": 6, + "rejected_prediction_tokens": 7 } }, "service_tier": "default", @@ -276,16 +277,17 @@ data: [DONE] "usage": { "prompt_tokens": 5049, "completion_tokens": 60, - "total_tokens": 5119, + "total_tokens": 5109, "prompt_tokens_details": { "cached_tokens": 4864, - "audio_tokens": 0 + "cache_write_tokens": 10, + "audio_tokens": 9 }, "completion_tokens_details": { - "reasoning_tokens": 0, - "audio_tokens": 0, - "accepted_prediction_tokens": 0, - "rejected_prediction_tokens": 0 + "reasoning_tokens": 10, + "audio_tokens": 11, + "accepted_prediction_tokens": 12, + "rejected_prediction_tokens": 13 } }, "service_tier": "default", diff --git a/aibridge/fixtures/openai/chatcompletions/streaming_cumulative_usage_injected_tool.txtar b/aibridge/fixtures/openai/chatcompletions/streaming_cumulative_usage_injected_tool.txtar new file mode 100644 index 00000000000..5474c4ac975 --- /dev/null +++ b/aibridge/fixtures/openai/chatcompletions/streaming_cumulative_usage_injected_tool.txtar @@ -0,0 +1,30 @@ +Streaming response with cumulative usage on every JSON chunk and an injected tool call. + +-- request -- +{ + "model": "gpt-4.1", + "messages": [ + { + "role": "user", + "content": "list my coder workspaces" + } + ] +} + +-- streaming -- +data: {"id":"chatcmpl-cumulative-tool","object":"chat.completion.chunk","created":1754479216,"model":"gpt-4.1","choices":[{"index":0,"delta":{"content":"Calling"}}],"usage":{"prompt_tokens":6000,"completion_tokens":10,"total_tokens":6010,"prompt_tokens_details":{"cached_tokens":100,"cache_write_tokens":10,"audio_tokens":1},"completion_tokens_details":{"reasoning_tokens":1,"audio_tokens":1,"accepted_prediction_tokens":1,"rejected_prediction_tokens":1}}} + +data: {"id":"chatcmpl-cumulative-tool","object":"chat.completion.chunk","created":1754479216,"model":"gpt-4.1","choices":[{"index":0,"delta":{"tool_calls":[{"index":0,"id":"call-cumulative","type":"function","function":{"name":"bmcp_coder_coder_list_workspaces","arguments":"{}"}}]}}],"usage":{"prompt_tokens":6000,"completion_tokens":20,"total_tokens":6020,"prompt_tokens_details":{"cached_tokens":100,"cache_write_tokens":10,"audio_tokens":2},"completion_tokens_details":{"reasoning_tokens":2,"audio_tokens":2,"accepted_prediction_tokens":2,"rejected_prediction_tokens":2}}} + +data: {"id":"chatcmpl-cumulative-tool","object":"chat.completion.chunk","created":1754479216,"model":"gpt-4.1","choices":[{"index":0,"delta":{},"finish_reason":"tool_calls"}],"usage":{"prompt_tokens":6000,"completion_tokens":30,"total_tokens":6030,"prompt_tokens_details":{"cached_tokens":100,"cache_write_tokens":10,"audio_tokens":3},"completion_tokens_details":{"reasoning_tokens":4,"audio_tokens":5,"accepted_prediction_tokens":6,"rejected_prediction_tokens":7}}} + +data: [DONE] + +-- streaming/tool-call -- +data: {"id":"chatcmpl-cumulative-final","object":"chat.completion.chunk","created":1754479217,"model":"gpt-4.1","choices":[{"index":0,"delta":{"content":"Done"}}],"usage":{"prompt_tokens":6000,"completion_tokens":10,"total_tokens":6010,"prompt_tokens_details":{"cached_tokens":200,"cache_write_tokens":20,"audio_tokens":7},"completion_tokens_details":{"reasoning_tokens":8,"audio_tokens":9,"accepted_prediction_tokens":10,"rejected_prediction_tokens":11}}} + +data: {"id":"chatcmpl-cumulative-final","object":"chat.completion.chunk","created":1754479217,"model":"gpt-4.1","choices":[{"index":0,"delta":{"content":"."}}],"usage":{"prompt_tokens":6000,"completion_tokens":20,"total_tokens":6020,"prompt_tokens_details":{"cached_tokens":200,"cache_write_tokens":20,"audio_tokens":8},"completion_tokens_details":{"reasoning_tokens":9,"audio_tokens":10,"accepted_prediction_tokens":11,"rejected_prediction_tokens":12}}} + +data: {"id":"chatcmpl-cumulative-final","object":"chat.completion.chunk","created":1754479217,"model":"gpt-4.1","choices":[{"index":0,"delta":{},"finish_reason":"stop"}],"usage":{"prompt_tokens":6000,"completion_tokens":30,"total_tokens":6030,"prompt_tokens_details":{"cached_tokens":200,"cache_write_tokens":20,"audio_tokens":9},"completion_tokens_details":{"reasoning_tokens":10,"audio_tokens":11,"accepted_prediction_tokens":12,"rejected_prediction_tokens":13}}} + +data: [DONE] diff --git a/aibridge/fixtures/openai/responses/blocking/cached_input_tokens.txtar b/aibridge/fixtures/openai/responses/blocking/cached_input_tokens.txtar index 41a6d7ca7e3..66689d6a483 100644 --- a/aibridge/fixtures/openai/responses/blocking/cached_input_tokens.txtar +++ b/aibridge/fixtures/openai/responses/blocking/cached_input_tokens.txtar @@ -68,7 +68,8 @@ "usage": { "input_tokens": 12033, "input_tokens_details": { - "cached_tokens": 11904 + "cached_tokens": 11904, + "cache_write_tokens": 15 }, "output_tokens": 44, "output_tokens_details": { diff --git a/aibridge/fixtures/openai/responses/blocking/single_injected_tool.txtar b/aibridge/fixtures/openai/responses/blocking/single_injected_tool.txtar index 028377dcaa9..ce46145d78d 100644 --- a/aibridge/fixtures/openai/responses/blocking/single_injected_tool.txtar +++ b/aibridge/fixtures/openai/responses/blocking/single_injected_tool.txtar @@ -749,7 +749,8 @@ Coder MCP tools automatically injected. "usage": { "input_tokens": 6371, "input_tokens_details": { - "cached_tokens": 6144 + "cached_tokens": 6144, + "cache_write_tokens": 7 }, "output_tokens": 75, "output_tokens_details": { @@ -1509,7 +1510,8 @@ Coder MCP tools automatically injected. "usage": { "input_tokens": 6756, "input_tokens_details": { - "cached_tokens": 6144 + "cached_tokens": 6144, + "cache_write_tokens": 11 }, "output_tokens": 231, "output_tokens_details": { diff --git a/aibridge/fixtures/openai/responses/blocking/single_injected_tool_error.txtar b/aibridge/fixtures/openai/responses/blocking/single_injected_tool_error.txtar index 9e4c2716f20..17c180d7dc5 100644 --- a/aibridge/fixtures/openai/responses/blocking/single_injected_tool_error.txtar +++ b/aibridge/fixtures/openai/responses/blocking/single_injected_tool_error.txtar @@ -749,7 +749,8 @@ Coder MCP tools automatically injected, and errors invoking them are recorded. "usage": { "input_tokens": 6377, "input_tokens_details": { - "cached_tokens": 6144 + "cached_tokens": 6144, + "cache_write_tokens": 5 }, "output_tokens": 119, "output_tokens_details": { @@ -1509,7 +1510,8 @@ Coder MCP tools automatically injected, and errors invoking them are recorded. "usage": { "input_tokens": 6539, "input_tokens_details": { - "cached_tokens": 6144 + "cached_tokens": 6144, + "cache_write_tokens": 9 }, "output_tokens": 144, "output_tokens_details": { diff --git a/aibridge/fixtures/openai/responses/streaming/cached_input_tokens.txtar b/aibridge/fixtures/openai/responses/streaming/cached_input_tokens.txtar index cc908d5abdf..8dffa4eabe9 100644 --- a/aibridge/fixtures/openai/responses/streaming/cached_input_tokens.txtar +++ b/aibridge/fixtures/openai/responses/streaming/cached_input_tokens.txtar @@ -43,5 +43,5 @@ event: response.output_item.done data: {"type":"response.output_item.done","item":{"id":"msg_05080461b406f3f501696a140a70d88195a2ce4c1a4eb39696","type":"message","status":"completed","content":[{"type":"output_text","annotations":[],"text":"Test response with cached tokens."}],"role":"assistant"},"output_index":0,"sequence_number":11} event: response.completed -data: {"type":"response.completed","response":{"id":"resp_05080461b406f3f501696a1409d34c8195a40ff4b092145c35","object":"response","created_at":1768559625,"status":"completed","background":false,"completed_at":1768559627,"error":null,"instructions":null,"max_output_tokens":null,"max_tool_calls":null,"model":"gpt-5.2-codex","output":[{"id":"msg_05080461b406f3f501696a140a70d88195a2ce4c1a4eb39696","type":"message","status":"completed","content":[{"type":"output_text","annotations":[],"text":"Test response with cached tokens."}],"role":"assistant"}],"parallel_tool_calls":true,"previous_response_id":null,"prompt_cache_key":"019bc657-f77b-7292-b5f4-2e8d6c2b0945","prompt_cache_retention":null,"reasoning":{"effort":"medium","summary":"detailed"},"service_tier":"default","store":false,"temperature":1.0,"tool_choice":"auto","tools":[],"truncation":"disabled","usage":{"input_tokens":16909,"input_tokens_details":{"cached_tokens":15744},"output_tokens":54,"output_tokens_details":{"reasoning_tokens":0},"total_tokens":16963},"user":null,"metadata":{}},"sequence_number":12} +data: {"type":"response.completed","response":{"id":"resp_05080461b406f3f501696a1409d34c8195a40ff4b092145c35","object":"response","created_at":1768559625,"status":"completed","background":false,"completed_at":1768559627,"error":null,"instructions":null,"max_output_tokens":null,"max_tool_calls":null,"model":"gpt-5.2-codex","output":[{"id":"msg_05080461b406f3f501696a140a70d88195a2ce4c1a4eb39696","type":"message","status":"completed","content":[{"type":"output_text","annotations":[],"text":"Test response with cached tokens."}],"role":"assistant"}],"parallel_tool_calls":true,"previous_response_id":null,"prompt_cache_key":"019bc657-f77b-7292-b5f4-2e8d6c2b0945","prompt_cache_retention":null,"reasoning":{"effort":"medium","summary":"detailed"},"service_tier":"default","store":false,"temperature":1.0,"tool_choice":"auto","tools":[],"truncation":"disabled","usage":{"input_tokens":16909,"input_tokens_details":{"cached_tokens":15744,"cache_write_tokens":30},"output_tokens":54,"output_tokens_details":{"reasoning_tokens":0},"total_tokens":16963},"user":null,"metadata":{}},"sequence_number":12} diff --git a/aibridge/fixtures/openai/responses/streaming/single_injected_tool.txtar b/aibridge/fixtures/openai/responses/streaming/single_injected_tool.txtar index 0e079d1e7a4..7df2ec235b4 100644 --- a/aibridge/fixtures/openai/responses/streaming/single_injected_tool.txtar +++ b/aibridge/fixtures/openai/responses/streaming/single_injected_tool.txtar @@ -25,7 +25,7 @@ event: response.output_item.done data: {"type":"response.output_item.done","item":{"id":"fc_016595fe42aa62ca006972441b4d0081a0bbf6b65aa91022df","type":"function_call","status":"completed","arguments":"{}","call_id":"call_GuuoyhUrVJQbWfHHz0xaX3n9","name":"bmcp_coder_coder_list_templates"},"output_index":0,"sequence_number":5} event: response.completed -data: {"type":"response.completed","response":{"id":"resp_016595fe42aa62ca0069724419c52081a0b7eb479c6bc8109f","object":"response","created_at":1769096217,"status":"completed","background":false,"completed_at":1769096219,"error":null,"frequency_penalty":0.0,"incomplete_details":null,"instructions":null,"max_output_tokens":null,"max_tool_calls":null,"model":"gpt-4.1-mini-2025-04-14","output":[{"id":"fc_016595fe42aa62ca006972441b4d0081a0bbf6b65aa91022df","type":"function_call","status":"completed","arguments":"{}","call_id":"call_GuuoyhUrVJQbWfHHz0xaX3n9","name":"bmcp_coder_coder_list_templates"}],"parallel_tool_calls":false,"presence_penalty":0.0,"previous_response_id":null,"prompt_cache_key":null,"prompt_cache_retention":null,"reasoning":{"effort":null,"summary":null},"safety_identifier":null,"service_tier":"default","store":true,"temperature":1.0,"text":{"format":{"type":"text"},"verbosity":"medium"},"tool_choice":"auto","tools":[{"type":"function","description":"Create a task.","name":"bmcp_coder_coder_create_task","parameters":{"properties":{"input":{"description":"Input/prompt for the task.","type":"string"},"template_version_id":{"description":"ID of the template version to create the task from.","type":"string"},"template_version_preset_id":{"description":"Optional ID of the template version preset to create the task from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a task. Omit or use the `me` keyword to create a task for the authenticated user.","type":"string"}},"required":["input","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template in Coder. First, you must create a template version.","name":"bmcp_coder_coder_create_template","parameters":{"properties":{"description":{"type":"string"},"display_name":{"type":"string"},"icon":{"description":"A URL to an icon to use.","type":"string"},"name":{"type":"string"},"version_id":{"description":"The ID of the version to use.","type":"string"}},"required":["name","display_name","description","version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template version. This is a precursor to creating a template, or you can update an existing template.\n\nTemplates are Terraform defining a development environment. The provisioned infrastructure must run\nan Agent that connects to the Coder Control Plane to provide a rich experience.\n\nHere are some strict rules for creating a template version:\n- YOU MUST NOT use \"variable\" or \"output\" blocks in the Terraform code.\n- YOU MUST ALWAYS check template version logs after creation to ensure the template was imported successfully.\n\nWhen a template version is created, a Terraform Plan occurs that ensures the infrastructure\n_could_ be provisioned, but actual provisioning occurs when a workspace is created.\n\n\nThe Coder Terraform Provider can be imported like:\n\n```hcl\nterraform {\n required_providers {\n coder = {\n source = \"coder/coder\"\n }\n }\n}\n```\n\nA destroy does not occur when a user stops a workspace, but rather the transition changes:\n\n```hcl\ndata \"coder_workspace\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace.\n- name: The name of the workspace.\n- transition: Either \"start\" or \"stop\".\n- start_count: A computed count based on the transition field. If \"start\", this will be 1.\n\nAccess workspace owner information with:\n\n```hcl\ndata \"coder_workspace_owner\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace owner.\n- name: The name of the workspace owner.\n- full_name: The full name of the workspace owner.\n- email: The email of the workspace owner.\n- session_token: A token that can be used to authenticate the workspace owner. It is regenerated every time the workspace is started.\n- oidc_access_token: A valid OpenID Connect access token of the workspace owner. This is only available if the workspace owner authenticated with OpenID Connect. If a valid token cannot be obtained, this value will be an empty string.\n\nParameters are defined in the template version. They are rendered in the UI on the workspace creation page:\n\n```hcl\nresource \"coder_parameter\" \"region\" {\n name = \"region\"\n type = \"string\"\n default = \"us-east-1\"\n}\n```\n\nThis resource accepts the following properties:\n- name: The name of the parameter.\n- default: The default value of the parameter.\n- type: The type of the parameter. Must be one of: \"string\", \"number\", \"bool\", or \"list(string)\".\n- display_name: The displayed name of the parameter as it will appear in the UI.\n- description: The description of the parameter as it will appear in the UI.\n- ephemeral: The value of an ephemeral parameter will not be preserved between consecutive workspace builds.\n- form_type: The type of this parameter. Must be one of: [radio, slider, input, dropdown, checkbox, switch, multi-select, tag-select, textarea, error].\n- icon: A URL to an icon to display in the UI.\n- mutable: Whether this value can be changed after workspace creation. This can be destructive for values like region, so use with caution!\n- option: Each option block defines a value for a user to select from. (see below for nested schema)\n Required:\n - name: The name of the option.\n - value: The value of the option.\n Optional:\n - description: The description of the option as it will appear in the UI.\n - icon: A URL to an icon to display in the UI.\n\nA Workspace Agent runs on provisioned infrastructure to provide access to the workspace:\n\n```hcl\nresource \"coder_agent\" \"dev\" {\n arch = \"amd64\"\n os = \"linux\"\n}\n```\n\nThis resource accepts the following properties:\n- arch: The architecture of the agent. Must be one of: \"amd64\", \"arm64\", or \"armv7\".\n- os: The operating system of the agent. Must be one of: \"linux\", \"windows\", or \"darwin\".\n- auth: The authentication method for the agent. Must be one of: \"token\", \"google-instance-identity\", \"aws-instance-identity\", or \"azure-instance-identity\". It is insecure to pass the agent token via exposed variables to Virtual Machines. Instance Identity enables provisioned VMs to authenticate by instance ID on start.\n- dir: The starting directory when a user creates a shell session. Defaults to \"$HOME\".\n- env: A map of environment variables to set for the agent.\n- startup_script: A script to run after the agent starts. This script MUST exit eventually to signal that startup has completed. Use \"&\" or \"screen\" to run processes in the background.\n\nThis resource provides the following fields:\n- id: The UUID of the agent.\n- init_script: The script to run on provisioned infrastructure to fetch and start the agent.\n- token: Set the environment variable CODER_AGENT_TOKEN to this value to authenticate the agent.\n\nThe agent MUST be installed and started using the init_script. A utility like curl or wget to fetch the agent binary must exist in the provisioned infrastructure.\n\nExpose terminal or HTTP applications running in a workspace with:\n\n```hcl\nresource \"coder_app\" \"dev\" {\n agent_id = coder_agent.dev.id\n slug = \"my-app-name\"\n display_name = \"My App\"\n icon = \"https://my-app.com/icon.svg\"\n url = \"http://127.0.0.1:3000\"\n}\n```\n\nThis resource accepts the following properties:\n- agent_id: The ID of the agent to attach the app to.\n- slug: The slug of the app.\n- display_name: The displayed name of the app as it will appear in the UI.\n- icon: A URL to an icon to display in the UI.\n- url: An external url if external=true or a URL to be proxied to from inside the workspace. This should be of the form http://localhost:PORT[/SUBPATH]. Either command or url may be specified, but not both.\n- command: A command to run in a terminal opening this app. In the web, this will open in a new tab. In the CLI, this will SSH and execute the command. Either command or url may be specified, but not both.\n- external: Whether this app is an external app. If true, the url will be opened in a new tab.\n\n\nThe Coder Server may not be authenticated with the infrastructure provider a user requests. In this scenario,\nthe user will need to provide credentials to the Coder Server before the workspace can be provisioned.\n\nHere are examples of provisioning the Coder Agent on specific infrastructure providers:\n\n\n// The agent is configured with \"aws-instance-identity\" auth.\nterraform {\n required_providers {\n cloudinit = {\n source = \"hashicorp/cloudinit\"\n }\n aws = {\n source = \"hashicorp/aws\"\n }\n }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n gzip = false\n base64_encode = false\n boundary = \"//\"\n part {\n filename = \"cloud-config.yaml\"\n content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t// - [scripts-user, always]\n\t// hostname: ${hostname}\n\t// users:\n\t// - name: ${linux_user}\n\t// sudo: ALL=(ALL) NOPASSWD:ALL\n\t// shell: /bin/bash\n content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n hostname = local.hostname\n linux_user = local.linux_user\n })\n }\n\n part {\n filename = \"userdata.sh\"\n content_type = \"text/x-shellscript\"\n\n\t// Here is the content of the userdata.sh.tftpl file:\n\t// #!/bin/bash\n\t// sudo -u '${linux_user}' sh -c '${init_script}'\n content = templatefile(\"${path.module}/cloud-init/userdata.sh.tftpl\", {\n linux_user = local.linux_user\n\n init_script = try(coder_agent.dev[0].init_script, \"\")\n })\n }\n}\n\nresource \"aws_instance\" \"dev\" {\n ami = data.aws_ami.ubuntu.id\n availability_zone = \"${data.coder_parameter.region.value}a\"\n instance_type = data.coder_parameter.instance_type.value\n\n user_data = data.cloudinit_config.user_data.rendered\n tags = {\n Name = \"coder-${data.coder_workspace_owner.me.name}-${data.coder_workspace.me.name}\"\n }\n lifecycle {\n ignore_changes = [ami]\n }\n}\n\n\n\n// The agent is configured with \"google-instance-identity\" auth.\nterraform {\n required_providers {\n google = {\n source = \"hashicorp/google\"\n }\n }\n}\n\nresource \"google_compute_instance\" \"dev\" {\n zone = module.gcp_region.value\n count = data.coder_workspace.me.start_count\n name = \"coder-${lower(data.coder_workspace_owner.me.name)}-${lower(data.coder_workspace.me.name)}-root\"\n machine_type = \"e2-medium\"\n network_interface {\n network = \"default\"\n access_config {\n // Ephemeral public IP\n }\n }\n boot_disk {\n auto_delete = false\n source = google_compute_disk.root.name\n }\n // In order to use google-instance-identity, a service account *must* be provided.\n service_account {\n email = data.google_compute_default_service_account.default.email\n scopes = [\"cloud-platform\"]\n }\n # ONLY FOR WINDOWS:\n # metadata = {\n # windows-startup-script-ps1 = coder_agent.main.init_script\n # }\n # The startup script runs as root with no $HOME environment set up, so instead of directly\n # running the agent init script, create a user (with a homedir, default shell and sudo\n # permissions) and execute the init script as that user.\n #\n # The agent MUST be started in here.\n metadata_startup_script = </dev/null 2>&1; then\n useradd -m -s /bin/bash \"${local.linux_user}\"\n echo \"${local.linux_user} ALL=(ALL) NOPASSWD:ALL\" > /etc/sudoers.d/coder-user\nfi\n\nexec sudo -u \"${local.linux_user}\" sh -c '${coder_agent.main.init_script}'\nEOMETA\n}\n\n\n\n// The agent is configured with \"azure-instance-identity\" auth.\nterraform {\n required_providers {\n azurerm = {\n source = \"hashicorp/azurerm\"\n }\n cloudinit = {\n source = \"hashicorp/cloudinit\"\n }\n }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n gzip = false\n base64_encode = true\n\n boundary = \"//\"\n\n part {\n filename = \"cloud-config.yaml\"\n content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t// - [scripts-user, always]\n\t// bootcmd:\n\t// # work around https://github.com/hashicorp/terraform-provider-azurerm/issues/6117\n\t// - until [ -e /dev/disk/azure/scsi1/lun10 ]; do sleep 1; done\n\t// device_aliases:\n\t// homedir: /dev/disk/azure/scsi1/lun10\n\t// disk_setup:\n\t// homedir:\n\t// table_type: gpt\n\t// layout: true\n\t// fs_setup:\n\t// - label: coder_home\n\t// filesystem: ext4\n\t// device: homedir.1\n\t// mounts:\n\t// - [\"LABEL=coder_home\", \"/home/${username}\"]\n\t// hostname: ${hostname}\n\t// users:\n\t// - name: ${username}\n\t// sudo: [\"ALL=(ALL) NOPASSWD:ALL\"]\n\t// groups: sudo\n\t// shell: /bin/bash\n\t// packages:\n\t// - git\n\t// write_files:\n\t// - path: /opt/coder/init\n\t// permissions: \"0755\"\n\t// encoding: b64\n\t// content: ${init_script}\n\t// - path: /etc/systemd/system/coder-agent.service\n\t// permissions: \"0644\"\n\t// content: |\n\t// [Unit]\n\t// Description=Coder Agent\n\t// After=network-online.target\n\t// Wants=network-online.target\n\n\t// [Service]\n\t// User=${username}\n\t// ExecStart=/opt/coder/init\n\t// Restart=always\n\t// RestartSec=10\n\t// TimeoutStopSec=90\n\t// KillMode=process\n\n\t// OOMScoreAdjust=-900\n\t// SyslogIdentifier=coder-agent\n\n\t// [Install]\n\t// WantedBy=multi-user.target\n\t// runcmd:\n\t// - chown ${username}:${username} /home/${username}\n\t// - systemctl enable coder-agent\n\t// - systemctl start coder-agent\n content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n username = \"coder\" # Ensure this user/group does not exist in your VM image\n init_script = base64encode(coder_agent.main.init_script)\n hostname = lower(data.coder_workspace.me.name)\n })\n }\n}\n\nresource \"azurerm_linux_virtual_machine\" \"main\" {\n count = data.coder_workspace.me.start_count\n name = \"vm\"\n resource_group_name = azurerm_resource_group.main.name\n location = azurerm_resource_group.main.location\n size = data.coder_parameter.instance_type.value\n // cloud-init overwrites this, so the value here doesn't matter\n admin_username = \"adminuser\"\n admin_ssh_key {\n public_key = tls_private_key.dummy.public_key_openssh\n username = \"adminuser\"\n }\n\n network_interface_ids = [\n azurerm_network_interface.main.id,\n ]\n computer_name = lower(data.coder_workspace.me.name)\n os_disk {\n caching = \"ReadWrite\"\n storage_account_type = \"Standard_LRS\"\n }\n source_image_reference {\n publisher = \"Canonical\"\n offer = \"0001-com-ubuntu-server-focal\"\n sku = \"20_04-lts-gen2\"\n version = \"latest\"\n }\n user_data = data.cloudinit_config.user_data.rendered\n}\n\n\n\nterraform {\n required_providers {\n coder = {\n source = \"kreuzwerker/docker\"\n }\n }\n}\n\n// The agent is configured with \"token\" auth.\n\nresource \"docker_container\" \"workspace\" {\n count = data.coder_workspace.me.start_count\n image = \"codercom/enterprise-base:ubuntu\"\n # Uses lower() to avoid Docker restriction on container names.\n name = \"coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}\"\n # Hostname makes the shell more user friendly: coder@my-workspace:~$\n hostname = data.coder_workspace.me.name\n # Use the docker gateway if the access URL is 127.0.0.1.\n entrypoint = [\"sh\", \"-c\", replace(coder_agent.main.init_script, \"/localhost|127\\\\.0\\\\.0\\\\.1/\", \"host.docker.internal\")]\n env = [\"CODER_AGENT_TOKEN=${coder_agent.main.token}\"]\n host {\n host = \"host.docker.internal\"\n ip = \"host-gateway\"\n }\n volumes {\n container_path = \"/home/coder\"\n volume_name = docker_volume.home_volume.name\n read_only = false\n }\n}\n\n\n\n// The agent is configured with \"token\" auth.\n\nresource \"kubernetes_deployment\" \"main\" {\n count = data.coder_workspace.me.start_count\n depends_on = [\n kubernetes_persistent_volume_claim.home\n ]\n wait_for_rollout = false\n metadata {\n name = \"coder-${data.coder_workspace.me.id}\"\n }\n\n spec {\n replicas = 1\n strategy {\n type = \"Recreate\"\n }\n\n template {\n spec {\n security_context {\n run_as_user = 1000\n fs_group = 1000\n run_as_non_root = true\n }\n\n container {\n name = \"dev\"\n image = \"codercom/enterprise-base:ubuntu\"\n image_pull_policy = \"Always\"\n command = [\"sh\", \"-c\", coder_agent.main.init_script]\n security_context {\n run_as_user = \"1000\"\n }\n env {\n name = \"CODER_AGENT_TOKEN\"\n value = coder_agent.main.token\n }\n }\n }\n }\n }\n}\n\n\nThe file_id provided is a reference to a tar file you have uploaded containing the Terraform.\n","name":"bmcp_coder_coder_create_template_version","parameters":{"properties":{"file_id":{"type":"string"},"template_id":{"type":"string"}},"required":["file_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace in Coder.\n\nIf a user is asking to \"test a template\", they are typically referring\nto creating a workspace from a template to ensure the infrastructure\nis provisioned correctly and the agent can connect to the control plane.\n\nBefore creating a workspace, always confirm the template choice with the user by:\n\n\t1. Listing the available templates that match their request.\n\t2. Recommending the most relevant option.\n\t2. Asking the user to confirm which template to use.\n\nIt is important to not create a workspace without confirming the template\nchoice with the user.\n\nAfter creating a workspace, watch the build logs and wait for the workspace to\nbe ready before trying to use or connect to the workspace.\n","name":"bmcp_coder_coder_create_workspace","parameters":{"properties":{"name":{"description":"Name of the workspace to create.","type":"string"},"rich_parameters":{"description":"Key/value pairs of rich parameters to pass to the template version to create the workspace.","type":"object"},"template_version_id":{"description":"ID of the template version to create the workspace from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a workspace. Omit or use the `me` keyword to create a workspace for the authenticated user.","type":"string"}},"required":["user","template_version_id","name","rich_parameters"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace build for an existing workspace. Use this to start, stop, or delete.\n\nAfter creating a workspace build, watch the build logs and wait for the\nworkspace build to complete before trying to start another build or use or\nconnect to the workspace.\n","name":"bmcp_coder_coder_create_workspace_build","parameters":{"properties":{"template_version_id":{"description":"(Optional) The template version ID to use for the workspace build. If not provided, the previously built version will be used.","type":"string"},"transition":{"description":"The transition to perform. Must be one of: start, stop, delete","enum":["start","stop","delete"],"type":"string"},"workspace_id":{"type":"string"}},"required":["workspace_id","transition"],"type":"object"},"strict":false},{"type":"function","description":"Delete a task.","name":"bmcp_coder_coder_delete_task","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to delete. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Delete a template. This is irreversible.","name":"bmcp_coder_coder_delete_template","parameters":{"properties":{"template_id":{"type":"string"}},"required":["template_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the currently authenticated user, similar to the `whoami` command.","name":"bmcp_coder_coder_get_authenticated_user","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a task.","name":"bmcp_coder_coder_get_task_logs","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to query. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the status of a task.","name":"bmcp_coder_coder_get_task_status","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to get. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a template version. This is useful to check whether a template version successfully imports or not.","name":"bmcp_coder_coder_get_template_version_logs","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Get a workspace by name or ID.\n\nThis returns more data than list_workspaces to reduce token usage.","name":"bmcp_coder_coder_get_workspace","parameters":{"properties":{"workspace_id":{"description":"The workspace ID or name in the format [owner/]workspace. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace agent.\n\n\t\tMore logs may appear after this call. It does not wait for the agent to finish.","name":"bmcp_coder_coder_get_workspace_agent_logs","parameters":{"properties":{"workspace_agent_id":{"type":"string"}},"required":["workspace_agent_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace build.\n\n\t\tUseful for checking whether a workspace builds successfully or not.","name":"bmcp_coder_coder_get_workspace_build_logs","parameters":{"properties":{"workspace_build_id":{"type":"string"}},"required":["workspace_build_id"],"type":"object"},"strict":false},{"type":"function","description":"List tasks.","name":"bmcp_coder_coder_list_tasks","parameters":{"properties":{"status":{"description":"Optional filter by task status.","type":"string"},"user":{"description":"Username or ID of the user for which to list tasks. Omit or use the `me` keyword to list tasks for the authenticated user.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Lists templates for the authenticated user.","name":"bmcp_coder_coder_list_templates","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Lists workspaces for the authenticated user.","name":"bmcp_coder_coder_list_workspaces","parameters":{"properties":{"owner":{"description":"The owner of the workspaces to list. Use \"me\" to list workspaces for the authenticated user. If you do not specify an owner, \"me\" will be assumed by default.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Send input to a running task.","name":"bmcp_coder_coder_send_task_input","parameters":{"properties":{"input":{"description":"The input to send to the task.","type":"string"},"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to prompt. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id","input"],"type":"object"},"strict":false},{"type":"function","description":"Get the parameters for a template version. You can refer to these as workspace parameters to the user, as they are typically important for creating a workspace.","name":"bmcp_coder_coder_template_version_parameters","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Update the active version of a template. This is helpful when iterating on templates.","name":"bmcp_coder_coder_update_template_active_version","parameters":{"properties":{"template_id":{"type":"string"},"template_version_id":{"type":"string"}},"required":["template_id","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create and upload a tar file by key/value mapping of file names to file contents. Use this to create template versions. Reference the tool description of \"create_template_version\" to understand template requirements.","name":"bmcp_coder_coder_upload_tar_file","parameters":{"properties":{"files":{"description":"A map of file names to file contents.","type":"object"}},"required":["files"],"type":"object"},"strict":false},{"type":"function","description":"Execute a bash command in a Coder workspace.\n\nThis tool provides the same functionality as the 'coder ssh ' CLI command.\nIt automatically starts the workspace if it's stopped and waits for the agent to be ready.\nThe output is trimmed of leading and trailing whitespace.\n\nThe workspace parameter supports various formats:\n- workspace (uses current user)\n- owner/workspace\n- owner--workspace\n- workspace.agent (specific agent)\n- owner/workspace.agent\n\nThe timeout_ms parameter specifies the command timeout in milliseconds (defaults to 60000ms, maximum of 300000ms).\nIf the command times out, all output captured up to that point is returned with a cancellation message.\n\nFor background commands (background: true), output is captured until the timeout is reached, then the command\ncontinues running in the background. The captured output is returned as the result.\n\nFor file operations (list, write, edit), always prefer the dedicated file tools.\nDo not use bash commands (ls, cat, echo, heredoc, etc.) to list, write, or read\nfiles when the file tools are available. The bash tool should be used for:\n\n\t- Running commands and scripts\n\t- Installing packages\n\t- Starting services\n\t- Executing programs\n\nExamples:\n- workspace: \"john/dev-env\", command: \"git status\", timeout_ms: 30000\n- workspace: \"my-workspace\", command: \"npm run dev\", background: true, timeout_ms: 10000\n- workspace: \"my-workspace.main\", command: \"docker ps\"","name":"bmcp_coder_coder_workspace_bash","parameters":{"properties":{"background":{"description":"Whether to run the command in the background. Output is captured until timeout, then the command continues running in the background.","type":"boolean"},"command":{"description":"The bash command to execute in the workspace.","type":"string"},"timeout_ms":{"default":60000,"description":"Command timeout in milliseconds. Defaults to 60000ms (60 seconds) if not specified.","minimum":1,"type":"integer"},"workspace":{"description":"The workspace name in format [owner/]workspace[.agent]. If owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","command"],"type":"object"},"strict":false},{"type":"function","description":"Edit a file in a workspace.","name":"bmcp_coder_coder_workspace_edit_file","parameters":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","edits"],"type":"object"},"strict":false},{"type":"function","description":"Edit one or more files in a workspace.","name":"bmcp_coder_coder_workspace_edit_files","parameters":{"properties":{"files":{"description":"An array of files to edit.","items":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"}},"required":["path","edits"],"type":"object"},"type":"array"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","files"],"type":"object"},"strict":false},{"type":"function","description":"List the URLs of Coder apps running in a workspace for a single agent.","name":"bmcp_coder_coder_workspace_list_apps","parameters":{"properties":{"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace"],"type":"object"},"strict":false},{"type":"function","description":"List directories in a workspace.","name":"bmcp_coder_coder_workspace_ls","parameters":{"properties":{"path":{"description":"The absolute path of the directory in the workspace to list.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Fetch URLs that forward to the specified port.","name":"bmcp_coder_coder_workspace_port_forward","parameters":{"properties":{"port":{"description":"The port to forward.","type":"number"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","port"],"type":"object"},"strict":false},{"type":"function","description":"Read from a file in a workspace.","name":"bmcp_coder_coder_workspace_read_file","parameters":{"properties":{"limit":{"description":"The number of bytes to read. Cannot exceed 1 MiB. Defaults to the full size of the file or 1 MiB, whichever is lower.","type":"integer"},"offset":{"description":"A byte offset indicating where in the file to start reading. Defaults to zero. An empty string indicates the end of the file has been reached.","type":"integer"},"path":{"description":"The absolute path of the file to read in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Write a file in a workspace.\n\nIf a file write fails due to syntax errors or encoding issues, do NOT switch\nto using bash commands as a workaround. Instead:\n\n\t1. Read the error message carefully to identify the issue\n\t2. Fix the content encoding/syntax\n\t3. Retry with this tool\n\nThe content parameter expects base64-encoded bytes. Ensure your source content\nis correct before encoding it. If you encounter errors, decode and verify the\ncontent you are trying to write, then re-encode it properly.\n","name":"bmcp_coder_coder_workspace_write_file","parameters":{"properties":{"content":{"description":"The base64-encoded bytes to write to the file.","type":"string"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","content"],"type":"object"},"strict":false}],"top_logprobs":0,"top_p":1.0,"truncation":"disabled","usage":{"input_tokens":6269,"input_tokens_details":{"cached_tokens":0},"output_tokens":18,"output_tokens_details":{"reasoning_tokens":0},"total_tokens":6287},"user":null,"metadata":{}},"sequence_number":6} +data: {"type":"response.completed","response":{"id":"resp_016595fe42aa62ca0069724419c52081a0b7eb479c6bc8109f","object":"response","created_at":1769096217,"status":"completed","background":false,"completed_at":1769096219,"error":null,"frequency_penalty":0.0,"incomplete_details":null,"instructions":null,"max_output_tokens":null,"max_tool_calls":null,"model":"gpt-4.1-mini-2025-04-14","output":[{"id":"fc_016595fe42aa62ca006972441b4d0081a0bbf6b65aa91022df","type":"function_call","status":"completed","arguments":"{}","call_id":"call_GuuoyhUrVJQbWfHHz0xaX3n9","name":"bmcp_coder_coder_list_templates"}],"parallel_tool_calls":false,"presence_penalty":0.0,"previous_response_id":null,"prompt_cache_key":null,"prompt_cache_retention":null,"reasoning":{"effort":null,"summary":null},"safety_identifier":null,"service_tier":"default","store":true,"temperature":1.0,"text":{"format":{"type":"text"},"verbosity":"medium"},"tool_choice":"auto","tools":[{"type":"function","description":"Create a task.","name":"bmcp_coder_coder_create_task","parameters":{"properties":{"input":{"description":"Input/prompt for the task.","type":"string"},"template_version_id":{"description":"ID of the template version to create the task from.","type":"string"},"template_version_preset_id":{"description":"Optional ID of the template version preset to create the task from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a task. Omit or use the `me` keyword to create a task for the authenticated user.","type":"string"}},"required":["input","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template in Coder. First, you must create a template version.","name":"bmcp_coder_coder_create_template","parameters":{"properties":{"description":{"type":"string"},"display_name":{"type":"string"},"icon":{"description":"A URL to an icon to use.","type":"string"},"name":{"type":"string"},"version_id":{"description":"The ID of the version to use.","type":"string"}},"required":["name","display_name","description","version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template version. This is a precursor to creating a template, or you can update an existing template.\n\nTemplates are Terraform defining a development environment. The provisioned infrastructure must run\nan Agent that connects to the Coder Control Plane to provide a rich experience.\n\nHere are some strict rules for creating a template version:\n- YOU MUST NOT use \"variable\" or \"output\" blocks in the Terraform code.\n- YOU MUST ALWAYS check template version logs after creation to ensure the template was imported successfully.\n\nWhen a template version is created, a Terraform Plan occurs that ensures the infrastructure\n_could_ be provisioned, but actual provisioning occurs when a workspace is created.\n\n\nThe Coder Terraform Provider can be imported like:\n\n```hcl\nterraform {\n required_providers {\n coder = {\n source = \"coder/coder\"\n }\n }\n}\n```\n\nA destroy does not occur when a user stops a workspace, but rather the transition changes:\n\n```hcl\ndata \"coder_workspace\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace.\n- name: The name of the workspace.\n- transition: Either \"start\" or \"stop\".\n- start_count: A computed count based on the transition field. If \"start\", this will be 1.\n\nAccess workspace owner information with:\n\n```hcl\ndata \"coder_workspace_owner\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace owner.\n- name: The name of the workspace owner.\n- full_name: The full name of the workspace owner.\n- email: The email of the workspace owner.\n- session_token: A token that can be used to authenticate the workspace owner. It is regenerated every time the workspace is started.\n- oidc_access_token: A valid OpenID Connect access token of the workspace owner. This is only available if the workspace owner authenticated with OpenID Connect. If a valid token cannot be obtained, this value will be an empty string.\n\nParameters are defined in the template version. They are rendered in the UI on the workspace creation page:\n\n```hcl\nresource \"coder_parameter\" \"region\" {\n name = \"region\"\n type = \"string\"\n default = \"us-east-1\"\n}\n```\n\nThis resource accepts the following properties:\n- name: The name of the parameter.\n- default: The default value of the parameter.\n- type: The type of the parameter. Must be one of: \"string\", \"number\", \"bool\", or \"list(string)\".\n- display_name: The displayed name of the parameter as it will appear in the UI.\n- description: The description of the parameter as it will appear in the UI.\n- ephemeral: The value of an ephemeral parameter will not be preserved between consecutive workspace builds.\n- form_type: The type of this parameter. Must be one of: [radio, slider, input, dropdown, checkbox, switch, multi-select, tag-select, textarea, error].\n- icon: A URL to an icon to display in the UI.\n- mutable: Whether this value can be changed after workspace creation. This can be destructive for values like region, so use with caution!\n- option: Each option block defines a value for a user to select from. (see below for nested schema)\n Required:\n - name: The name of the option.\n - value: The value of the option.\n Optional:\n - description: The description of the option as it will appear in the UI.\n - icon: A URL to an icon to display in the UI.\n\nA Workspace Agent runs on provisioned infrastructure to provide access to the workspace:\n\n```hcl\nresource \"coder_agent\" \"dev\" {\n arch = \"amd64\"\n os = \"linux\"\n}\n```\n\nThis resource accepts the following properties:\n- arch: The architecture of the agent. Must be one of: \"amd64\", \"arm64\", or \"armv7\".\n- os: The operating system of the agent. Must be one of: \"linux\", \"windows\", or \"darwin\".\n- auth: The authentication method for the agent. Must be one of: \"token\", \"google-instance-identity\", \"aws-instance-identity\", or \"azure-instance-identity\". It is insecure to pass the agent token via exposed variables to Virtual Machines. Instance Identity enables provisioned VMs to authenticate by instance ID on start.\n- dir: The starting directory when a user creates a shell session. Defaults to \"$HOME\".\n- env: A map of environment variables to set for the agent.\n- startup_script: A script to run after the agent starts. This script MUST exit eventually to signal that startup has completed. Use \"&\" or \"screen\" to run processes in the background.\n\nThis resource provides the following fields:\n- id: The UUID of the agent.\n- init_script: The script to run on provisioned infrastructure to fetch and start the agent.\n- token: Set the environment variable CODER_AGENT_TOKEN to this value to authenticate the agent.\n\nThe agent MUST be installed and started using the init_script. A utility like curl or wget to fetch the agent binary must exist in the provisioned infrastructure.\n\nExpose terminal or HTTP applications running in a workspace with:\n\n```hcl\nresource \"coder_app\" \"dev\" {\n agent_id = coder_agent.dev.id\n slug = \"my-app-name\"\n display_name = \"My App\"\n icon = \"https://my-app.com/icon.svg\"\n url = \"http://127.0.0.1:3000\"\n}\n```\n\nThis resource accepts the following properties:\n- agent_id: The ID of the agent to attach the app to.\n- slug: The slug of the app.\n- display_name: The displayed name of the app as it will appear in the UI.\n- icon: A URL to an icon to display in the UI.\n- url: An external url if external=true or a URL to be proxied to from inside the workspace. This should be of the form http://localhost:PORT[/SUBPATH]. Either command or url may be specified, but not both.\n- command: A command to run in a terminal opening this app. In the web, this will open in a new tab. In the CLI, this will SSH and execute the command. Either command or url may be specified, but not both.\n- external: Whether this app is an external app. If true, the url will be opened in a new tab.\n\n\nThe Coder Server may not be authenticated with the infrastructure provider a user requests. In this scenario,\nthe user will need to provide credentials to the Coder Server before the workspace can be provisioned.\n\nHere are examples of provisioning the Coder Agent on specific infrastructure providers:\n\n\n// The agent is configured with \"aws-instance-identity\" auth.\nterraform {\n required_providers {\n cloudinit = {\n source = \"hashicorp/cloudinit\"\n }\n aws = {\n source = \"hashicorp/aws\"\n }\n }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n gzip = false\n base64_encode = false\n boundary = \"//\"\n part {\n filename = \"cloud-config.yaml\"\n content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t// - [scripts-user, always]\n\t// hostname: ${hostname}\n\t// users:\n\t// - name: ${linux_user}\n\t// sudo: ALL=(ALL) NOPASSWD:ALL\n\t// shell: /bin/bash\n content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n hostname = local.hostname\n linux_user = local.linux_user\n })\n }\n\n part {\n filename = \"userdata.sh\"\n content_type = \"text/x-shellscript\"\n\n\t// Here is the content of the userdata.sh.tftpl file:\n\t// #!/bin/bash\n\t// sudo -u '${linux_user}' sh -c '${init_script}'\n content = templatefile(\"${path.module}/cloud-init/userdata.sh.tftpl\", {\n linux_user = local.linux_user\n\n init_script = try(coder_agent.dev[0].init_script, \"\")\n })\n }\n}\n\nresource \"aws_instance\" \"dev\" {\n ami = data.aws_ami.ubuntu.id\n availability_zone = \"${data.coder_parameter.region.value}a\"\n instance_type = data.coder_parameter.instance_type.value\n\n user_data = data.cloudinit_config.user_data.rendered\n tags = {\n Name = \"coder-${data.coder_workspace_owner.me.name}-${data.coder_workspace.me.name}\"\n }\n lifecycle {\n ignore_changes = [ami]\n }\n}\n\n\n\n// The agent is configured with \"google-instance-identity\" auth.\nterraform {\n required_providers {\n google = {\n source = \"hashicorp/google\"\n }\n }\n}\n\nresource \"google_compute_instance\" \"dev\" {\n zone = module.gcp_region.value\n count = data.coder_workspace.me.start_count\n name = \"coder-${lower(data.coder_workspace_owner.me.name)}-${lower(data.coder_workspace.me.name)}-root\"\n machine_type = \"e2-medium\"\n network_interface {\n network = \"default\"\n access_config {\n // Ephemeral public IP\n }\n }\n boot_disk {\n auto_delete = false\n source = google_compute_disk.root.name\n }\n // In order to use google-instance-identity, a service account *must* be provided.\n service_account {\n email = data.google_compute_default_service_account.default.email\n scopes = [\"cloud-platform\"]\n }\n # ONLY FOR WINDOWS:\n # metadata = {\n # windows-startup-script-ps1 = coder_agent.main.init_script\n # }\n # The startup script runs as root with no $HOME environment set up, so instead of directly\n # running the agent init script, create a user (with a homedir, default shell and sudo\n # permissions) and execute the init script as that user.\n #\n # The agent MUST be started in here.\n metadata_startup_script = </dev/null 2>&1; then\n useradd -m -s /bin/bash \"${local.linux_user}\"\n echo \"${local.linux_user} ALL=(ALL) NOPASSWD:ALL\" > /etc/sudoers.d/coder-user\nfi\n\nexec sudo -u \"${local.linux_user}\" sh -c '${coder_agent.main.init_script}'\nEOMETA\n}\n\n\n\n// The agent is configured with \"azure-instance-identity\" auth.\nterraform {\n required_providers {\n azurerm = {\n source = \"hashicorp/azurerm\"\n }\n cloudinit = {\n source = \"hashicorp/cloudinit\"\n }\n }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n gzip = false\n base64_encode = true\n\n boundary = \"//\"\n\n part {\n filename = \"cloud-config.yaml\"\n content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t// - [scripts-user, always]\n\t// bootcmd:\n\t// # work around https://github.com/hashicorp/terraform-provider-azurerm/issues/6117\n\t// - until [ -e /dev/disk/azure/scsi1/lun10 ]; do sleep 1; done\n\t// device_aliases:\n\t// homedir: /dev/disk/azure/scsi1/lun10\n\t// disk_setup:\n\t// homedir:\n\t// table_type: gpt\n\t// layout: true\n\t// fs_setup:\n\t// - label: coder_home\n\t// filesystem: ext4\n\t// device: homedir.1\n\t// mounts:\n\t// - [\"LABEL=coder_home\", \"/home/${username}\"]\n\t// hostname: ${hostname}\n\t// users:\n\t// - name: ${username}\n\t// sudo: [\"ALL=(ALL) NOPASSWD:ALL\"]\n\t// groups: sudo\n\t// shell: /bin/bash\n\t// packages:\n\t// - git\n\t// write_files:\n\t// - path: /opt/coder/init\n\t// permissions: \"0755\"\n\t// encoding: b64\n\t// content: ${init_script}\n\t// - path: /etc/systemd/system/coder-agent.service\n\t// permissions: \"0644\"\n\t// content: |\n\t// [Unit]\n\t// Description=Coder Agent\n\t// After=network-online.target\n\t// Wants=network-online.target\n\n\t// [Service]\n\t// User=${username}\n\t// ExecStart=/opt/coder/init\n\t// Restart=always\n\t// RestartSec=10\n\t// TimeoutStopSec=90\n\t// KillMode=process\n\n\t// OOMScoreAdjust=-900\n\t// SyslogIdentifier=coder-agent\n\n\t// [Install]\n\t// WantedBy=multi-user.target\n\t// runcmd:\n\t// - chown ${username}:${username} /home/${username}\n\t// - systemctl enable coder-agent\n\t// - systemctl start coder-agent\n content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n username = \"coder\" # Ensure this user/group does not exist in your VM image\n init_script = base64encode(coder_agent.main.init_script)\n hostname = lower(data.coder_workspace.me.name)\n })\n }\n}\n\nresource \"azurerm_linux_virtual_machine\" \"main\" {\n count = data.coder_workspace.me.start_count\n name = \"vm\"\n resource_group_name = azurerm_resource_group.main.name\n location = azurerm_resource_group.main.location\n size = data.coder_parameter.instance_type.value\n // cloud-init overwrites this, so the value here doesn't matter\n admin_username = \"adminuser\"\n admin_ssh_key {\n public_key = tls_private_key.dummy.public_key_openssh\n username = \"adminuser\"\n }\n\n network_interface_ids = [\n azurerm_network_interface.main.id,\n ]\n computer_name = lower(data.coder_workspace.me.name)\n os_disk {\n caching = \"ReadWrite\"\n storage_account_type = \"Standard_LRS\"\n }\n source_image_reference {\n publisher = \"Canonical\"\n offer = \"0001-com-ubuntu-server-focal\"\n sku = \"20_04-lts-gen2\"\n version = \"latest\"\n }\n user_data = data.cloudinit_config.user_data.rendered\n}\n\n\n\nterraform {\n required_providers {\n coder = {\n source = \"kreuzwerker/docker\"\n }\n }\n}\n\n// The agent is configured with \"token\" auth.\n\nresource \"docker_container\" \"workspace\" {\n count = data.coder_workspace.me.start_count\n image = \"codercom/enterprise-base:ubuntu\"\n # Uses lower() to avoid Docker restriction on container names.\n name = \"coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}\"\n # Hostname makes the shell more user friendly: coder@my-workspace:~$\n hostname = data.coder_workspace.me.name\n # Use the docker gateway if the access URL is 127.0.0.1.\n entrypoint = [\"sh\", \"-c\", replace(coder_agent.main.init_script, \"/localhost|127\\\\.0\\\\.0\\\\.1/\", \"host.docker.internal\")]\n env = [\"CODER_AGENT_TOKEN=${coder_agent.main.token}\"]\n host {\n host = \"host.docker.internal\"\n ip = \"host-gateway\"\n }\n volumes {\n container_path = \"/home/coder\"\n volume_name = docker_volume.home_volume.name\n read_only = false\n }\n}\n\n\n\n// The agent is configured with \"token\" auth.\n\nresource \"kubernetes_deployment\" \"main\" {\n count = data.coder_workspace.me.start_count\n depends_on = [\n kubernetes_persistent_volume_claim.home\n ]\n wait_for_rollout = false\n metadata {\n name = \"coder-${data.coder_workspace.me.id}\"\n }\n\n spec {\n replicas = 1\n strategy {\n type = \"Recreate\"\n }\n\n template {\n spec {\n security_context {\n run_as_user = 1000\n fs_group = 1000\n run_as_non_root = true\n }\n\n container {\n name = \"dev\"\n image = \"codercom/enterprise-base:ubuntu\"\n image_pull_policy = \"Always\"\n command = [\"sh\", \"-c\", coder_agent.main.init_script]\n security_context {\n run_as_user = \"1000\"\n }\n env {\n name = \"CODER_AGENT_TOKEN\"\n value = coder_agent.main.token\n }\n }\n }\n }\n }\n}\n\n\nThe file_id provided is a reference to a tar file you have uploaded containing the Terraform.\n","name":"bmcp_coder_coder_create_template_version","parameters":{"properties":{"file_id":{"type":"string"},"template_id":{"type":"string"}},"required":["file_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace in Coder.\n\nIf a user is asking to \"test a template\", they are typically referring\nto creating a workspace from a template to ensure the infrastructure\nis provisioned correctly and the agent can connect to the control plane.\n\nBefore creating a workspace, always confirm the template choice with the user by:\n\n\t1. Listing the available templates that match their request.\n\t2. Recommending the most relevant option.\n\t2. Asking the user to confirm which template to use.\n\nIt is important to not create a workspace without confirming the template\nchoice with the user.\n\nAfter creating a workspace, watch the build logs and wait for the workspace to\nbe ready before trying to use or connect to the workspace.\n","name":"bmcp_coder_coder_create_workspace","parameters":{"properties":{"name":{"description":"Name of the workspace to create.","type":"string"},"rich_parameters":{"description":"Key/value pairs of rich parameters to pass to the template version to create the workspace.","type":"object"},"template_version_id":{"description":"ID of the template version to create the workspace from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a workspace. Omit or use the `me` keyword to create a workspace for the authenticated user.","type":"string"}},"required":["user","template_version_id","name","rich_parameters"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace build for an existing workspace. Use this to start, stop, or delete.\n\nAfter creating a workspace build, watch the build logs and wait for the\nworkspace build to complete before trying to start another build or use or\nconnect to the workspace.\n","name":"bmcp_coder_coder_create_workspace_build","parameters":{"properties":{"template_version_id":{"description":"(Optional) The template version ID to use for the workspace build. If not provided, the previously built version will be used.","type":"string"},"transition":{"description":"The transition to perform. Must be one of: start, stop, delete","enum":["start","stop","delete"],"type":"string"},"workspace_id":{"type":"string"}},"required":["workspace_id","transition"],"type":"object"},"strict":false},{"type":"function","description":"Delete a task.","name":"bmcp_coder_coder_delete_task","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to delete. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Delete a template. This is irreversible.","name":"bmcp_coder_coder_delete_template","parameters":{"properties":{"template_id":{"type":"string"}},"required":["template_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the currently authenticated user, similar to the `whoami` command.","name":"bmcp_coder_coder_get_authenticated_user","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a task.","name":"bmcp_coder_coder_get_task_logs","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to query. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the status of a task.","name":"bmcp_coder_coder_get_task_status","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to get. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a template version. This is useful to check whether a template version successfully imports or not.","name":"bmcp_coder_coder_get_template_version_logs","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Get a workspace by name or ID.\n\nThis returns more data than list_workspaces to reduce token usage.","name":"bmcp_coder_coder_get_workspace","parameters":{"properties":{"workspace_id":{"description":"The workspace ID or name in the format [owner/]workspace. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace agent.\n\n\t\tMore logs may appear after this call. It does not wait for the agent to finish.","name":"bmcp_coder_coder_get_workspace_agent_logs","parameters":{"properties":{"workspace_agent_id":{"type":"string"}},"required":["workspace_agent_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace build.\n\n\t\tUseful for checking whether a workspace builds successfully or not.","name":"bmcp_coder_coder_get_workspace_build_logs","parameters":{"properties":{"workspace_build_id":{"type":"string"}},"required":["workspace_build_id"],"type":"object"},"strict":false},{"type":"function","description":"List tasks.","name":"bmcp_coder_coder_list_tasks","parameters":{"properties":{"status":{"description":"Optional filter by task status.","type":"string"},"user":{"description":"Username or ID of the user for which to list tasks. Omit or use the `me` keyword to list tasks for the authenticated user.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Lists templates for the authenticated user.","name":"bmcp_coder_coder_list_templates","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Lists workspaces for the authenticated user.","name":"bmcp_coder_coder_list_workspaces","parameters":{"properties":{"owner":{"description":"The owner of the workspaces to list. Use \"me\" to list workspaces for the authenticated user. If you do not specify an owner, \"me\" will be assumed by default.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Send input to a running task.","name":"bmcp_coder_coder_send_task_input","parameters":{"properties":{"input":{"description":"The input to send to the task.","type":"string"},"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to prompt. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id","input"],"type":"object"},"strict":false},{"type":"function","description":"Get the parameters for a template version. You can refer to these as workspace parameters to the user, as they are typically important for creating a workspace.","name":"bmcp_coder_coder_template_version_parameters","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Update the active version of a template. This is helpful when iterating on templates.","name":"bmcp_coder_coder_update_template_active_version","parameters":{"properties":{"template_id":{"type":"string"},"template_version_id":{"type":"string"}},"required":["template_id","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create and upload a tar file by key/value mapping of file names to file contents. Use this to create template versions. Reference the tool description of \"create_template_version\" to understand template requirements.","name":"bmcp_coder_coder_upload_tar_file","parameters":{"properties":{"files":{"description":"A map of file names to file contents.","type":"object"}},"required":["files"],"type":"object"},"strict":false},{"type":"function","description":"Execute a bash command in a Coder workspace.\n\nThis tool provides the same functionality as the 'coder ssh ' CLI command.\nIt automatically starts the workspace if it's stopped and waits for the agent to be ready.\nThe output is trimmed of leading and trailing whitespace.\n\nThe workspace parameter supports various formats:\n- workspace (uses current user)\n- owner/workspace\n- owner--workspace\n- workspace.agent (specific agent)\n- owner/workspace.agent\n\nThe timeout_ms parameter specifies the command timeout in milliseconds (defaults to 60000ms, maximum of 300000ms).\nIf the command times out, all output captured up to that point is returned with a cancellation message.\n\nFor background commands (background: true), output is captured until the timeout is reached, then the command\ncontinues running in the background. The captured output is returned as the result.\n\nFor file operations (list, write, edit), always prefer the dedicated file tools.\nDo not use bash commands (ls, cat, echo, heredoc, etc.) to list, write, or read\nfiles when the file tools are available. The bash tool should be used for:\n\n\t- Running commands and scripts\n\t- Installing packages\n\t- Starting services\n\t- Executing programs\n\nExamples:\n- workspace: \"john/dev-env\", command: \"git status\", timeout_ms: 30000\n- workspace: \"my-workspace\", command: \"npm run dev\", background: true, timeout_ms: 10000\n- workspace: \"my-workspace.main\", command: \"docker ps\"","name":"bmcp_coder_coder_workspace_bash","parameters":{"properties":{"background":{"description":"Whether to run the command in the background. Output is captured until timeout, then the command continues running in the background.","type":"boolean"},"command":{"description":"The bash command to execute in the workspace.","type":"string"},"timeout_ms":{"default":60000,"description":"Command timeout in milliseconds. Defaults to 60000ms (60 seconds) if not specified.","minimum":1,"type":"integer"},"workspace":{"description":"The workspace name in format [owner/]workspace[.agent]. If owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","command"],"type":"object"},"strict":false},{"type":"function","description":"Edit a file in a workspace.","name":"bmcp_coder_coder_workspace_edit_file","parameters":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","edits"],"type":"object"},"strict":false},{"type":"function","description":"Edit one or more files in a workspace.","name":"bmcp_coder_coder_workspace_edit_files","parameters":{"properties":{"files":{"description":"An array of files to edit.","items":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"}},"required":["path","edits"],"type":"object"},"type":"array"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","files"],"type":"object"},"strict":false},{"type":"function","description":"List the URLs of Coder apps running in a workspace for a single agent.","name":"bmcp_coder_coder_workspace_list_apps","parameters":{"properties":{"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace"],"type":"object"},"strict":false},{"type":"function","description":"List directories in a workspace.","name":"bmcp_coder_coder_workspace_ls","parameters":{"properties":{"path":{"description":"The absolute path of the directory in the workspace to list.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Fetch URLs that forward to the specified port.","name":"bmcp_coder_coder_workspace_port_forward","parameters":{"properties":{"port":{"description":"The port to forward.","type":"number"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","port"],"type":"object"},"strict":false},{"type":"function","description":"Read from a file in a workspace.","name":"bmcp_coder_coder_workspace_read_file","parameters":{"properties":{"limit":{"description":"The number of bytes to read. Cannot exceed 1 MiB. Defaults to the full size of the file or 1 MiB, whichever is lower.","type":"integer"},"offset":{"description":"A byte offset indicating where in the file to start reading. Defaults to zero. An empty string indicates the end of the file has been reached.","type":"integer"},"path":{"description":"The absolute path of the file to read in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Write a file in a workspace.\n\nIf a file write fails due to syntax errors or encoding issues, do NOT switch\nto using bash commands as a workaround. Instead:\n\n\t1. Read the error message carefully to identify the issue\n\t2. Fix the content encoding/syntax\n\t3. Retry with this tool\n\nThe content parameter expects base64-encoded bytes. Ensure your source content\nis correct before encoding it. If you encounter errors, decode and verify the\ncontent you are trying to write, then re-encode it properly.\n","name":"bmcp_coder_coder_workspace_write_file","parameters":{"properties":{"content":{"description":"The base64-encoded bytes to write to the file.","type":"string"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","content"],"type":"object"},"strict":false}],"top_logprobs":0,"top_p":1.0,"truncation":"disabled","usage":{"input_tokens":6269,"input_tokens_details":{"cached_tokens":100,"cache_write_tokens":7},"output_tokens":18,"output_tokens_details":{"reasoning_tokens":3},"total_tokens":6287},"user":null,"metadata":{}},"sequence_number":6} -- streaming/tool-call -- @@ -591,5 +591,5 @@ event: response.output_item.done data: {"type":"response.output_item.done","item":{"id":"msg_0bc5f54fce6df69a0069724421feb88194acb48ce194f3ee14","type":"message","status":"completed","content":[{"type":"output_text","annotations":[],"logprobs":[],"text":"You have two Coder templates:\n\n1. Template Name: codex-test\n - Template ID: d85cac35-15a1-4bde-97d9-1f3e4b851246\n - Active Version ID: 22a3face-0c93-4b88-a63a-1ec1651e0199\n - Active User Count: 1\n\n2. Template Name: docker\n - Template ID: 7e799e56-6591-4c44-b575-3c72b55b7217\n - Active Version ID: 8057a565-1c12-489e-a563-8e8bb162c867\n - Active User Count: 1\n\nLet me know if you want more details or want to perform any actions with these templates."}],"role":"assistant"},"output_index":0,"sequence_number":186} event: response.completed -data: {"type":"response.completed","response":{"id":"resp_0bc5f54fce6df69a006972442175908194bb81d31f576e6ca6","object":"response","created_at":1769096225,"status":"completed","background":false,"completed_at":1769096230,"error":null,"frequency_penalty":0.0,"incomplete_details":null,"instructions":null,"max_output_tokens":null,"max_tool_calls":null,"model":"gpt-4.1-mini-2025-04-14","output":[{"id":"msg_0bc5f54fce6df69a0069724421feb88194acb48ce194f3ee14","type":"message","status":"completed","content":[{"type":"output_text","annotations":[],"logprobs":[],"text":"You have two Coder templates:\n\n1. Template Name: codex-test\n - Template ID: d85cac35-15a1-4bde-97d9-1f3e4b851246\n - Active Version ID: 22a3face-0c93-4b88-a63a-1ec1651e0199\n - Active User Count: 1\n\n2. Template Name: docker\n - Template ID: 7e799e56-6591-4c44-b575-3c72b55b7217\n - Active Version ID: 8057a565-1c12-489e-a563-8e8bb162c867\n - Active User Count: 1\n\nLet me know if you want more details or want to perform any actions with these templates."}],"role":"assistant"}],"parallel_tool_calls":false,"presence_penalty":0.0,"previous_response_id":null,"prompt_cache_key":null,"prompt_cache_retention":null,"reasoning":{"effort":null,"summary":null},"safety_identifier":null,"service_tier":"default","store":true,"temperature":1.0,"text":{"format":{"type":"text"},"verbosity":"medium"},"tool_choice":"auto","tools":[{"type":"function","description":"Create a task.","name":"bmcp_coder_coder_create_task","parameters":{"properties":{"input":{"description":"Input/prompt for the task.","type":"string"},"template_version_id":{"description":"ID of the template version to create the task from.","type":"string"},"template_version_preset_id":{"description":"Optional ID of the template version preset to create the task from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a task. Omit or use the `me` keyword to create a task for the authenticated user.","type":"string"}},"required":["input","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template in Coder. First, you must create a template version.","name":"bmcp_coder_coder_create_template","parameters":{"properties":{"description":{"type":"string"},"display_name":{"type":"string"},"icon":{"description":"A URL to an icon to use.","type":"string"},"name":{"type":"string"},"version_id":{"description":"The ID of the version to use.","type":"string"}},"required":["name","display_name","description","version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template version. This is a precursor to creating a template, or you can update an existing template.\n\nTemplates are Terraform defining a development environment. The provisioned infrastructure must run\nan Agent that connects to the Coder Control Plane to provide a rich experience.\n\nHere are some strict rules for creating a template version:\n- YOU MUST NOT use \"variable\" or \"output\" blocks in the Terraform code.\n- YOU MUST ALWAYS check template version logs after creation to ensure the template was imported successfully.\n\nWhen a template version is created, a Terraform Plan occurs that ensures the infrastructure\n_could_ be provisioned, but actual provisioning occurs when a workspace is created.\n\n\nThe Coder Terraform Provider can be imported like:\n\n```hcl\nterraform {\n required_providers {\n coder = {\n source = \"coder/coder\"\n }\n }\n}\n```\n\nA destroy does not occur when a user stops a workspace, but rather the transition changes:\n\n```hcl\ndata \"coder_workspace\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace.\n- name: The name of the workspace.\n- transition: Either \"start\" or \"stop\".\n- start_count: A computed count based on the transition field. If \"start\", this will be 1.\n\nAccess workspace owner information with:\n\n```hcl\ndata \"coder_workspace_owner\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace owner.\n- name: The name of the workspace owner.\n- full_name: The full name of the workspace owner.\n- email: The email of the workspace owner.\n- session_token: A token that can be used to authenticate the workspace owner. It is regenerated every time the workspace is started.\n- oidc_access_token: A valid OpenID Connect access token of the workspace owner. This is only available if the workspace owner authenticated with OpenID Connect. If a valid token cannot be obtained, this value will be an empty string.\n\nParameters are defined in the template version. They are rendered in the UI on the workspace creation page:\n\n```hcl\nresource \"coder_parameter\" \"region\" {\n name = \"region\"\n type = \"string\"\n default = \"us-east-1\"\n}\n```\n\nThis resource accepts the following properties:\n- name: The name of the parameter.\n- default: The default value of the parameter.\n- type: The type of the parameter. Must be one of: \"string\", \"number\", \"bool\", or \"list(string)\".\n- display_name: The displayed name of the parameter as it will appear in the UI.\n- description: The description of the parameter as it will appear in the UI.\n- ephemeral: The value of an ephemeral parameter will not be preserved between consecutive workspace builds.\n- form_type: The type of this parameter. Must be one of: [radio, slider, input, dropdown, checkbox, switch, multi-select, tag-select, textarea, error].\n- icon: A URL to an icon to display in the UI.\n- mutable: Whether this value can be changed after workspace creation. This can be destructive for values like region, so use with caution!\n- option: Each option block defines a value for a user to select from. (see below for nested schema)\n Required:\n - name: The name of the option.\n - value: The value of the option.\n Optional:\n - description: The description of the option as it will appear in the UI.\n - icon: A URL to an icon to display in the UI.\n\nA Workspace Agent runs on provisioned infrastructure to provide access to the workspace:\n\n```hcl\nresource \"coder_agent\" \"dev\" {\n arch = \"amd64\"\n os = \"linux\"\n}\n```\n\nThis resource accepts the following properties:\n- arch: The architecture of the agent. Must be one of: \"amd64\", \"arm64\", or \"armv7\".\n- os: The operating system of the agent. Must be one of: \"linux\", \"windows\", or \"darwin\".\n- auth: The authentication method for the agent. Must be one of: \"token\", \"google-instance-identity\", \"aws-instance-identity\", or \"azure-instance-identity\". It is insecure to pass the agent token via exposed variables to Virtual Machines. Instance Identity enables provisioned VMs to authenticate by instance ID on start.\n- dir: The starting directory when a user creates a shell session. Defaults to \"$HOME\".\n- env: A map of environment variables to set for the agent.\n- startup_script: A script to run after the agent starts. This script MUST exit eventually to signal that startup has completed. Use \"&\" or \"screen\" to run processes in the background.\n\nThis resource provides the following fields:\n- id: The UUID of the agent.\n- init_script: The script to run on provisioned infrastructure to fetch and start the agent.\n- token: Set the environment variable CODER_AGENT_TOKEN to this value to authenticate the agent.\n\nThe agent MUST be installed and started using the init_script. A utility like curl or wget to fetch the agent binary must exist in the provisioned infrastructure.\n\nExpose terminal or HTTP applications running in a workspace with:\n\n```hcl\nresource \"coder_app\" \"dev\" {\n agent_id = coder_agent.dev.id\n slug = \"my-app-name\"\n display_name = \"My App\"\n icon = \"https://my-app.com/icon.svg\"\n url = \"http://127.0.0.1:3000\"\n}\n```\n\nThis resource accepts the following properties:\n- agent_id: The ID of the agent to attach the app to.\n- slug: The slug of the app.\n- display_name: The displayed name of the app as it will appear in the UI.\n- icon: A URL to an icon to display in the UI.\n- url: An external url if external=true or a URL to be proxied to from inside the workspace. This should be of the form http://localhost:PORT[/SUBPATH]. Either command or url may be specified, but not both.\n- command: A command to run in a terminal opening this app. In the web, this will open in a new tab. In the CLI, this will SSH and execute the command. Either command or url may be specified, but not both.\n- external: Whether this app is an external app. If true, the url will be opened in a new tab.\n\n\nThe Coder Server may not be authenticated with the infrastructure provider a user requests. In this scenario,\nthe user will need to provide credentials to the Coder Server before the workspace can be provisioned.\n\nHere are examples of provisioning the Coder Agent on specific infrastructure providers:\n\n\n// The agent is configured with \"aws-instance-identity\" auth.\nterraform {\n required_providers {\n cloudinit = {\n source = \"hashicorp/cloudinit\"\n }\n aws = {\n source = \"hashicorp/aws\"\n }\n }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n gzip = false\n base64_encode = false\n boundary = \"//\"\n part {\n filename = \"cloud-config.yaml\"\n content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t// - [scripts-user, always]\n\t// hostname: ${hostname}\n\t// users:\n\t// - name: ${linux_user}\n\t// sudo: ALL=(ALL) NOPASSWD:ALL\n\t// shell: /bin/bash\n content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n hostname = local.hostname\n linux_user = local.linux_user\n })\n }\n\n part {\n filename = \"userdata.sh\"\n content_type = \"text/x-shellscript\"\n\n\t// Here is the content of the userdata.sh.tftpl file:\n\t// #!/bin/bash\n\t// sudo -u '${linux_user}' sh -c '${init_script}'\n content = templatefile(\"${path.module}/cloud-init/userdata.sh.tftpl\", {\n linux_user = local.linux_user\n\n init_script = try(coder_agent.dev[0].init_script, \"\")\n })\n }\n}\n\nresource \"aws_instance\" \"dev\" {\n ami = data.aws_ami.ubuntu.id\n availability_zone = \"${data.coder_parameter.region.value}a\"\n instance_type = data.coder_parameter.instance_type.value\n\n user_data = data.cloudinit_config.user_data.rendered\n tags = {\n Name = \"coder-${data.coder_workspace_owner.me.name}-${data.coder_workspace.me.name}\"\n }\n lifecycle {\n ignore_changes = [ami]\n }\n}\n\n\n\n// The agent is configured with \"google-instance-identity\" auth.\nterraform {\n required_providers {\n google = {\n source = \"hashicorp/google\"\n }\n }\n}\n\nresource \"google_compute_instance\" \"dev\" {\n zone = module.gcp_region.value\n count = data.coder_workspace.me.start_count\n name = \"coder-${lower(data.coder_workspace_owner.me.name)}-${lower(data.coder_workspace.me.name)}-root\"\n machine_type = \"e2-medium\"\n network_interface {\n network = \"default\"\n access_config {\n // Ephemeral public IP\n }\n }\n boot_disk {\n auto_delete = false\n source = google_compute_disk.root.name\n }\n // In order to use google-instance-identity, a service account *must* be provided.\n service_account {\n email = data.google_compute_default_service_account.default.email\n scopes = [\"cloud-platform\"]\n }\n # ONLY FOR WINDOWS:\n # metadata = {\n # windows-startup-script-ps1 = coder_agent.main.init_script\n # }\n # The startup script runs as root with no $HOME environment set up, so instead of directly\n # running the agent init script, create a user (with a homedir, default shell and sudo\n # permissions) and execute the init script as that user.\n #\n # The agent MUST be started in here.\n metadata_startup_script = </dev/null 2>&1; then\n useradd -m -s /bin/bash \"${local.linux_user}\"\n echo \"${local.linux_user} ALL=(ALL) NOPASSWD:ALL\" > /etc/sudoers.d/coder-user\nfi\n\nexec sudo -u \"${local.linux_user}\" sh -c '${coder_agent.main.init_script}'\nEOMETA\n}\n\n\n\n// The agent is configured with \"azure-instance-identity\" auth.\nterraform {\n required_providers {\n azurerm = {\n source = \"hashicorp/azurerm\"\n }\n cloudinit = {\n source = \"hashicorp/cloudinit\"\n }\n }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n gzip = false\n base64_encode = true\n\n boundary = \"//\"\n\n part {\n filename = \"cloud-config.yaml\"\n content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t// - [scripts-user, always]\n\t// bootcmd:\n\t// # work around https://github.com/hashicorp/terraform-provider-azurerm/issues/6117\n\t// - until [ -e /dev/disk/azure/scsi1/lun10 ]; do sleep 1; done\n\t// device_aliases:\n\t// homedir: /dev/disk/azure/scsi1/lun10\n\t// disk_setup:\n\t// homedir:\n\t// table_type: gpt\n\t// layout: true\n\t// fs_setup:\n\t// - label: coder_home\n\t// filesystem: ext4\n\t// device: homedir.1\n\t// mounts:\n\t// - [\"LABEL=coder_home\", \"/home/${username}\"]\n\t// hostname: ${hostname}\n\t// users:\n\t// - name: ${username}\n\t// sudo: [\"ALL=(ALL) NOPASSWD:ALL\"]\n\t// groups: sudo\n\t// shell: /bin/bash\n\t// packages:\n\t// - git\n\t// write_files:\n\t// - path: /opt/coder/init\n\t// permissions: \"0755\"\n\t// encoding: b64\n\t// content: ${init_script}\n\t// - path: /etc/systemd/system/coder-agent.service\n\t// permissions: \"0644\"\n\t// content: |\n\t// [Unit]\n\t// Description=Coder Agent\n\t// After=network-online.target\n\t// Wants=network-online.target\n\n\t// [Service]\n\t// User=${username}\n\t// ExecStart=/opt/coder/init\n\t// Restart=always\n\t// RestartSec=10\n\t// TimeoutStopSec=90\n\t// KillMode=process\n\n\t// OOMScoreAdjust=-900\n\t// SyslogIdentifier=coder-agent\n\n\t// [Install]\n\t// WantedBy=multi-user.target\n\t// runcmd:\n\t// - chown ${username}:${username} /home/${username}\n\t// - systemctl enable coder-agent\n\t// - systemctl start coder-agent\n content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n username = \"coder\" # Ensure this user/group does not exist in your VM image\n init_script = base64encode(coder_agent.main.init_script)\n hostname = lower(data.coder_workspace.me.name)\n })\n }\n}\n\nresource \"azurerm_linux_virtual_machine\" \"main\" {\n count = data.coder_workspace.me.start_count\n name = \"vm\"\n resource_group_name = azurerm_resource_group.main.name\n location = azurerm_resource_group.main.location\n size = data.coder_parameter.instance_type.value\n // cloud-init overwrites this, so the value here doesn't matter\n admin_username = \"adminuser\"\n admin_ssh_key {\n public_key = tls_private_key.dummy.public_key_openssh\n username = \"adminuser\"\n }\n\n network_interface_ids = [\n azurerm_network_interface.main.id,\n ]\n computer_name = lower(data.coder_workspace.me.name)\n os_disk {\n caching = \"ReadWrite\"\n storage_account_type = \"Standard_LRS\"\n }\n source_image_reference {\n publisher = \"Canonical\"\n offer = \"0001-com-ubuntu-server-focal\"\n sku = \"20_04-lts-gen2\"\n version = \"latest\"\n }\n user_data = data.cloudinit_config.user_data.rendered\n}\n\n\n\nterraform {\n required_providers {\n coder = {\n source = \"kreuzwerker/docker\"\n }\n }\n}\n\n// The agent is configured with \"token\" auth.\n\nresource \"docker_container\" \"workspace\" {\n count = data.coder_workspace.me.start_count\n image = \"codercom/enterprise-base:ubuntu\"\n # Uses lower() to avoid Docker restriction on container names.\n name = \"coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}\"\n # Hostname makes the shell more user friendly: coder@my-workspace:~$\n hostname = data.coder_workspace.me.name\n # Use the docker gateway if the access URL is 127.0.0.1.\n entrypoint = [\"sh\", \"-c\", replace(coder_agent.main.init_script, \"/localhost|127\\\\.0\\\\.0\\\\.1/\", \"host.docker.internal\")]\n env = [\"CODER_AGENT_TOKEN=${coder_agent.main.token}\"]\n host {\n host = \"host.docker.internal\"\n ip = \"host-gateway\"\n }\n volumes {\n container_path = \"/home/coder\"\n volume_name = docker_volume.home_volume.name\n read_only = false\n }\n}\n\n\n\n// The agent is configured with \"token\" auth.\n\nresource \"kubernetes_deployment\" \"main\" {\n count = data.coder_workspace.me.start_count\n depends_on = [\n kubernetes_persistent_volume_claim.home\n ]\n wait_for_rollout = false\n metadata {\n name = \"coder-${data.coder_workspace.me.id}\"\n }\n\n spec {\n replicas = 1\n strategy {\n type = \"Recreate\"\n }\n\n template {\n spec {\n security_context {\n run_as_user = 1000\n fs_group = 1000\n run_as_non_root = true\n }\n\n container {\n name = \"dev\"\n image = \"codercom/enterprise-base:ubuntu\"\n image_pull_policy = \"Always\"\n command = [\"sh\", \"-c\", coder_agent.main.init_script]\n security_context {\n run_as_user = \"1000\"\n }\n env {\n name = \"CODER_AGENT_TOKEN\"\n value = coder_agent.main.token\n }\n }\n }\n }\n }\n}\n\n\nThe file_id provided is a reference to a tar file you have uploaded containing the Terraform.\n","name":"bmcp_coder_coder_create_template_version","parameters":{"properties":{"file_id":{"type":"string"},"template_id":{"type":"string"}},"required":["file_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace in Coder.\n\nIf a user is asking to \"test a template\", they are typically referring\nto creating a workspace from a template to ensure the infrastructure\nis provisioned correctly and the agent can connect to the control plane.\n\nBefore creating a workspace, always confirm the template choice with the user by:\n\n\t1. Listing the available templates that match their request.\n\t2. Recommending the most relevant option.\n\t2. Asking the user to confirm which template to use.\n\nIt is important to not create a workspace without confirming the template\nchoice with the user.\n\nAfter creating a workspace, watch the build logs and wait for the workspace to\nbe ready before trying to use or connect to the workspace.\n","name":"bmcp_coder_coder_create_workspace","parameters":{"properties":{"name":{"description":"Name of the workspace to create.","type":"string"},"rich_parameters":{"description":"Key/value pairs of rich parameters to pass to the template version to create the workspace.","type":"object"},"template_version_id":{"description":"ID of the template version to create the workspace from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a workspace. Omit or use the `me` keyword to create a workspace for the authenticated user.","type":"string"}},"required":["user","template_version_id","name","rich_parameters"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace build for an existing workspace. Use this to start, stop, or delete.\n\nAfter creating a workspace build, watch the build logs and wait for the\nworkspace build to complete before trying to start another build or use or\nconnect to the workspace.\n","name":"bmcp_coder_coder_create_workspace_build","parameters":{"properties":{"template_version_id":{"description":"(Optional) The template version ID to use for the workspace build. If not provided, the previously built version will be used.","type":"string"},"transition":{"description":"The transition to perform. Must be one of: start, stop, delete","enum":["start","stop","delete"],"type":"string"},"workspace_id":{"type":"string"}},"required":["workspace_id","transition"],"type":"object"},"strict":false},{"type":"function","description":"Delete a task.","name":"bmcp_coder_coder_delete_task","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to delete. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Delete a template. This is irreversible.","name":"bmcp_coder_coder_delete_template","parameters":{"properties":{"template_id":{"type":"string"}},"required":["template_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the currently authenticated user, similar to the `whoami` command.","name":"bmcp_coder_coder_get_authenticated_user","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a task.","name":"bmcp_coder_coder_get_task_logs","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to query. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the status of a task.","name":"bmcp_coder_coder_get_task_status","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to get. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a template version. This is useful to check whether a template version successfully imports or not.","name":"bmcp_coder_coder_get_template_version_logs","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Get a workspace by name or ID.\n\nThis returns more data than list_workspaces to reduce token usage.","name":"bmcp_coder_coder_get_workspace","parameters":{"properties":{"workspace_id":{"description":"The workspace ID or name in the format [owner/]workspace. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace agent.\n\n\t\tMore logs may appear after this call. It does not wait for the agent to finish.","name":"bmcp_coder_coder_get_workspace_agent_logs","parameters":{"properties":{"workspace_agent_id":{"type":"string"}},"required":["workspace_agent_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace build.\n\n\t\tUseful for checking whether a workspace builds successfully or not.","name":"bmcp_coder_coder_get_workspace_build_logs","parameters":{"properties":{"workspace_build_id":{"type":"string"}},"required":["workspace_build_id"],"type":"object"},"strict":false},{"type":"function","description":"List tasks.","name":"bmcp_coder_coder_list_tasks","parameters":{"properties":{"status":{"description":"Optional filter by task status.","type":"string"},"user":{"description":"Username or ID of the user for which to list tasks. Omit or use the `me` keyword to list tasks for the authenticated user.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Lists templates for the authenticated user.","name":"bmcp_coder_coder_list_templates","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Lists workspaces for the authenticated user.","name":"bmcp_coder_coder_list_workspaces","parameters":{"properties":{"owner":{"description":"The owner of the workspaces to list. Use \"me\" to list workspaces for the authenticated user. If you do not specify an owner, \"me\" will be assumed by default.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Send input to a running task.","name":"bmcp_coder_coder_send_task_input","parameters":{"properties":{"input":{"description":"The input to send to the task.","type":"string"},"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to prompt. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id","input"],"type":"object"},"strict":false},{"type":"function","description":"Get the parameters for a template version. You can refer to these as workspace parameters to the user, as they are typically important for creating a workspace.","name":"bmcp_coder_coder_template_version_parameters","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Update the active version of a template. This is helpful when iterating on templates.","name":"bmcp_coder_coder_update_template_active_version","parameters":{"properties":{"template_id":{"type":"string"},"template_version_id":{"type":"string"}},"required":["template_id","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create and upload a tar file by key/value mapping of file names to file contents. Use this to create template versions. Reference the tool description of \"create_template_version\" to understand template requirements.","name":"bmcp_coder_coder_upload_tar_file","parameters":{"properties":{"files":{"description":"A map of file names to file contents.","type":"object"}},"required":["files"],"type":"object"},"strict":false},{"type":"function","description":"Execute a bash command in a Coder workspace.\n\nThis tool provides the same functionality as the 'coder ssh ' CLI command.\nIt automatically starts the workspace if it's stopped and waits for the agent to be ready.\nThe output is trimmed of leading and trailing whitespace.\n\nThe workspace parameter supports various formats:\n- workspace (uses current user)\n- owner/workspace\n- owner--workspace\n- workspace.agent (specific agent)\n- owner/workspace.agent\n\nThe timeout_ms parameter specifies the command timeout in milliseconds (defaults to 60000ms, maximum of 300000ms).\nIf the command times out, all output captured up to that point is returned with a cancellation message.\n\nFor background commands (background: true), output is captured until the timeout is reached, then the command\ncontinues running in the background. The captured output is returned as the result.\n\nFor file operations (list, write, edit), always prefer the dedicated file tools.\nDo not use bash commands (ls, cat, echo, heredoc, etc.) to list, write, or read\nfiles when the file tools are available. The bash tool should be used for:\n\n\t- Running commands and scripts\n\t- Installing packages\n\t- Starting services\n\t- Executing programs\n\nExamples:\n- workspace: \"john/dev-env\", command: \"git status\", timeout_ms: 30000\n- workspace: \"my-workspace\", command: \"npm run dev\", background: true, timeout_ms: 10000\n- workspace: \"my-workspace.main\", command: \"docker ps\"","name":"bmcp_coder_coder_workspace_bash","parameters":{"properties":{"background":{"description":"Whether to run the command in the background. Output is captured until timeout, then the command continues running in the background.","type":"boolean"},"command":{"description":"The bash command to execute in the workspace.","type":"string"},"timeout_ms":{"default":60000,"description":"Command timeout in milliseconds. Defaults to 60000ms (60 seconds) if not specified.","minimum":1,"type":"integer"},"workspace":{"description":"The workspace name in format [owner/]workspace[.agent]. If owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","command"],"type":"object"},"strict":false},{"type":"function","description":"Edit a file in a workspace.","name":"bmcp_coder_coder_workspace_edit_file","parameters":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","edits"],"type":"object"},"strict":false},{"type":"function","description":"Edit one or more files in a workspace.","name":"bmcp_coder_coder_workspace_edit_files","parameters":{"properties":{"files":{"description":"An array of files to edit.","items":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"}},"required":["path","edits"],"type":"object"},"type":"array"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","files"],"type":"object"},"strict":false},{"type":"function","description":"List the URLs of Coder apps running in a workspace for a single agent.","name":"bmcp_coder_coder_workspace_list_apps","parameters":{"properties":{"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace"],"type":"object"},"strict":false},{"type":"function","description":"List directories in a workspace.","name":"bmcp_coder_coder_workspace_ls","parameters":{"properties":{"path":{"description":"The absolute path of the directory in the workspace to list.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Fetch URLs that forward to the specified port.","name":"bmcp_coder_coder_workspace_port_forward","parameters":{"properties":{"port":{"description":"The port to forward.","type":"number"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","port"],"type":"object"},"strict":false},{"type":"function","description":"Read from a file in a workspace.","name":"bmcp_coder_coder_workspace_read_file","parameters":{"properties":{"limit":{"description":"The number of bytes to read. Cannot exceed 1 MiB. Defaults to the full size of the file or 1 MiB, whichever is lower.","type":"integer"},"offset":{"description":"A byte offset indicating where in the file to start reading. Defaults to zero. An empty string indicates the end of the file has been reached.","type":"integer"},"path":{"description":"The absolute path of the file to read in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Write a file in a workspace.\n\nIf a file write fails due to syntax errors or encoding issues, do NOT switch\nto using bash commands as a workaround. Instead:\n\n\t1. Read the error message carefully to identify the issue\n\t2. Fix the content encoding/syntax\n\t3. Retry with this tool\n\nThe content parameter expects base64-encoded bytes. Ensure your source content\nis correct before encoding it. If you encounter errors, decode and verify the\ncontent you are trying to write, then re-encode it properly.\n","name":"bmcp_coder_coder_workspace_write_file","parameters":{"properties":{"content":{"description":"The base64-encoded bytes to write to the file.","type":"string"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","content"],"type":"object"},"strict":false}],"top_logprobs":0,"top_p":1.0,"truncation":"disabled","usage":{"input_tokens":6463,"input_tokens_details":{"cached_tokens":6144},"output_tokens":182,"output_tokens_details":{"reasoning_tokens":0},"total_tokens":6645},"user":null,"metadata":{}},"sequence_number":187} +data: {"type":"response.completed","response":{"id":"resp_0bc5f54fce6df69a006972442175908194bb81d31f576e6ca6","object":"response","created_at":1769096225,"status":"completed","background":false,"completed_at":1769096230,"error":null,"frequency_penalty":0.0,"incomplete_details":null,"instructions":null,"max_output_tokens":null,"max_tool_calls":null,"model":"gpt-4.1-mini-2025-04-14","output":[{"id":"msg_0bc5f54fce6df69a0069724421feb88194acb48ce194f3ee14","type":"message","status":"completed","content":[{"type":"output_text","annotations":[],"logprobs":[],"text":"You have two Coder templates:\n\n1. Template Name: codex-test\n - Template ID: d85cac35-15a1-4bde-97d9-1f3e4b851246\n - Active Version ID: 22a3face-0c93-4b88-a63a-1ec1651e0199\n - Active User Count: 1\n\n2. Template Name: docker\n - Template ID: 7e799e56-6591-4c44-b575-3c72b55b7217\n - Active Version ID: 8057a565-1c12-489e-a563-8e8bb162c867\n - Active User Count: 1\n\nLet me know if you want more details or want to perform any actions with these templates."}],"role":"assistant"}],"parallel_tool_calls":false,"presence_penalty":0.0,"previous_response_id":null,"prompt_cache_key":null,"prompt_cache_retention":null,"reasoning":{"effort":null,"summary":null},"safety_identifier":null,"service_tier":"default","store":true,"temperature":1.0,"text":{"format":{"type":"text"},"verbosity":"medium"},"tool_choice":"auto","tools":[{"type":"function","description":"Create a task.","name":"bmcp_coder_coder_create_task","parameters":{"properties":{"input":{"description":"Input/prompt for the task.","type":"string"},"template_version_id":{"description":"ID of the template version to create the task from.","type":"string"},"template_version_preset_id":{"description":"Optional ID of the template version preset to create the task from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a task. Omit or use the `me` keyword to create a task for the authenticated user.","type":"string"}},"required":["input","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template in Coder. First, you must create a template version.","name":"bmcp_coder_coder_create_template","parameters":{"properties":{"description":{"type":"string"},"display_name":{"type":"string"},"icon":{"description":"A URL to an icon to use.","type":"string"},"name":{"type":"string"},"version_id":{"description":"The ID of the version to use.","type":"string"}},"required":["name","display_name","description","version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template version. This is a precursor to creating a template, or you can update an existing template.\n\nTemplates are Terraform defining a development environment. The provisioned infrastructure must run\nan Agent that connects to the Coder Control Plane to provide a rich experience.\n\nHere are some strict rules for creating a template version:\n- YOU MUST NOT use \"variable\" or \"output\" blocks in the Terraform code.\n- YOU MUST ALWAYS check template version logs after creation to ensure the template was imported successfully.\n\nWhen a template version is created, a Terraform Plan occurs that ensures the infrastructure\n_could_ be provisioned, but actual provisioning occurs when a workspace is created.\n\n\nThe Coder Terraform Provider can be imported like:\n\n```hcl\nterraform {\n required_providers {\n coder = {\n source = \"coder/coder\"\n }\n }\n}\n```\n\nA destroy does not occur when a user stops a workspace, but rather the transition changes:\n\n```hcl\ndata \"coder_workspace\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace.\n- name: The name of the workspace.\n- transition: Either \"start\" or \"stop\".\n- start_count: A computed count based on the transition field. If \"start\", this will be 1.\n\nAccess workspace owner information with:\n\n```hcl\ndata \"coder_workspace_owner\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace owner.\n- name: The name of the workspace owner.\n- full_name: The full name of the workspace owner.\n- email: The email of the workspace owner.\n- session_token: A token that can be used to authenticate the workspace owner. It is regenerated every time the workspace is started.\n- oidc_access_token: A valid OpenID Connect access token of the workspace owner. This is only available if the workspace owner authenticated with OpenID Connect. If a valid token cannot be obtained, this value will be an empty string.\n\nParameters are defined in the template version. They are rendered in the UI on the workspace creation page:\n\n```hcl\nresource \"coder_parameter\" \"region\" {\n name = \"region\"\n type = \"string\"\n default = \"us-east-1\"\n}\n```\n\nThis resource accepts the following properties:\n- name: The name of the parameter.\n- default: The default value of the parameter.\n- type: The type of the parameter. Must be one of: \"string\", \"number\", \"bool\", or \"list(string)\".\n- display_name: The displayed name of the parameter as it will appear in the UI.\n- description: The description of the parameter as it will appear in the UI.\n- ephemeral: The value of an ephemeral parameter will not be preserved between consecutive workspace builds.\n- form_type: The type of this parameter. Must be one of: [radio, slider, input, dropdown, checkbox, switch, multi-select, tag-select, textarea, error].\n- icon: A URL to an icon to display in the UI.\n- mutable: Whether this value can be changed after workspace creation. This can be destructive for values like region, so use with caution!\n- option: Each option block defines a value for a user to select from. (see below for nested schema)\n Required:\n - name: The name of the option.\n - value: The value of the option.\n Optional:\n - description: The description of the option as it will appear in the UI.\n - icon: A URL to an icon to display in the UI.\n\nA Workspace Agent runs on provisioned infrastructure to provide access to the workspace:\n\n```hcl\nresource \"coder_agent\" \"dev\" {\n arch = \"amd64\"\n os = \"linux\"\n}\n```\n\nThis resource accepts the following properties:\n- arch: The architecture of the agent. Must be one of: \"amd64\", \"arm64\", or \"armv7\".\n- os: The operating system of the agent. Must be one of: \"linux\", \"windows\", or \"darwin\".\n- auth: The authentication method for the agent. Must be one of: \"token\", \"google-instance-identity\", \"aws-instance-identity\", or \"azure-instance-identity\". It is insecure to pass the agent token via exposed variables to Virtual Machines. Instance Identity enables provisioned VMs to authenticate by instance ID on start.\n- dir: The starting directory when a user creates a shell session. Defaults to \"$HOME\".\n- env: A map of environment variables to set for the agent.\n- startup_script: A script to run after the agent starts. This script MUST exit eventually to signal that startup has completed. Use \"&\" or \"screen\" to run processes in the background.\n\nThis resource provides the following fields:\n- id: The UUID of the agent.\n- init_script: The script to run on provisioned infrastructure to fetch and start the agent.\n- token: Set the environment variable CODER_AGENT_TOKEN to this value to authenticate the agent.\n\nThe agent MUST be installed and started using the init_script. A utility like curl or wget to fetch the agent binary must exist in the provisioned infrastructure.\n\nExpose terminal or HTTP applications running in a workspace with:\n\n```hcl\nresource \"coder_app\" \"dev\" {\n agent_id = coder_agent.dev.id\n slug = \"my-app-name\"\n display_name = \"My App\"\n icon = \"https://my-app.com/icon.svg\"\n url = \"http://127.0.0.1:3000\"\n}\n```\n\nThis resource accepts the following properties:\n- agent_id: The ID of the agent to attach the app to.\n- slug: The slug of the app.\n- display_name: The displayed name of the app as it will appear in the UI.\n- icon: A URL to an icon to display in the UI.\n- url: An external url if external=true or a URL to be proxied to from inside the workspace. This should be of the form http://localhost:PORT[/SUBPATH]. Either command or url may be specified, but not both.\n- command: A command to run in a terminal opening this app. In the web, this will open in a new tab. In the CLI, this will SSH and execute the command. Either command or url may be specified, but not both.\n- external: Whether this app is an external app. If true, the url will be opened in a new tab.\n\n\nThe Coder Server may not be authenticated with the infrastructure provider a user requests. In this scenario,\nthe user will need to provide credentials to the Coder Server before the workspace can be provisioned.\n\nHere are examples of provisioning the Coder Agent on specific infrastructure providers:\n\n\n// The agent is configured with \"aws-instance-identity\" auth.\nterraform {\n required_providers {\n cloudinit = {\n source = \"hashicorp/cloudinit\"\n }\n aws = {\n source = \"hashicorp/aws\"\n }\n }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n gzip = false\n base64_encode = false\n boundary = \"//\"\n part {\n filename = \"cloud-config.yaml\"\n content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t// - [scripts-user, always]\n\t// hostname: ${hostname}\n\t// users:\n\t// - name: ${linux_user}\n\t// sudo: ALL=(ALL) NOPASSWD:ALL\n\t// shell: /bin/bash\n content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n hostname = local.hostname\n linux_user = local.linux_user\n })\n }\n\n part {\n filename = \"userdata.sh\"\n content_type = \"text/x-shellscript\"\n\n\t// Here is the content of the userdata.sh.tftpl file:\n\t// #!/bin/bash\n\t// sudo -u '${linux_user}' sh -c '${init_script}'\n content = templatefile(\"${path.module}/cloud-init/userdata.sh.tftpl\", {\n linux_user = local.linux_user\n\n init_script = try(coder_agent.dev[0].init_script, \"\")\n })\n }\n}\n\nresource \"aws_instance\" \"dev\" {\n ami = data.aws_ami.ubuntu.id\n availability_zone = \"${data.coder_parameter.region.value}a\"\n instance_type = data.coder_parameter.instance_type.value\n\n user_data = data.cloudinit_config.user_data.rendered\n tags = {\n Name = \"coder-${data.coder_workspace_owner.me.name}-${data.coder_workspace.me.name}\"\n }\n lifecycle {\n ignore_changes = [ami]\n }\n}\n\n\n\n// The agent is configured with \"google-instance-identity\" auth.\nterraform {\n required_providers {\n google = {\n source = \"hashicorp/google\"\n }\n }\n}\n\nresource \"google_compute_instance\" \"dev\" {\n zone = module.gcp_region.value\n count = data.coder_workspace.me.start_count\n name = \"coder-${lower(data.coder_workspace_owner.me.name)}-${lower(data.coder_workspace.me.name)}-root\"\n machine_type = \"e2-medium\"\n network_interface {\n network = \"default\"\n access_config {\n // Ephemeral public IP\n }\n }\n boot_disk {\n auto_delete = false\n source = google_compute_disk.root.name\n }\n // In order to use google-instance-identity, a service account *must* be provided.\n service_account {\n email = data.google_compute_default_service_account.default.email\n scopes = [\"cloud-platform\"]\n }\n # ONLY FOR WINDOWS:\n # metadata = {\n # windows-startup-script-ps1 = coder_agent.main.init_script\n # }\n # The startup script runs as root with no $HOME environment set up, so instead of directly\n # running the agent init script, create a user (with a homedir, default shell and sudo\n # permissions) and execute the init script as that user.\n #\n # The agent MUST be started in here.\n metadata_startup_script = </dev/null 2>&1; then\n useradd -m -s /bin/bash \"${local.linux_user}\"\n echo \"${local.linux_user} ALL=(ALL) NOPASSWD:ALL\" > /etc/sudoers.d/coder-user\nfi\n\nexec sudo -u \"${local.linux_user}\" sh -c '${coder_agent.main.init_script}'\nEOMETA\n}\n\n\n\n// The agent is configured with \"azure-instance-identity\" auth.\nterraform {\n required_providers {\n azurerm = {\n source = \"hashicorp/azurerm\"\n }\n cloudinit = {\n source = \"hashicorp/cloudinit\"\n }\n }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n gzip = false\n base64_encode = true\n\n boundary = \"//\"\n\n part {\n filename = \"cloud-config.yaml\"\n content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t// - [scripts-user, always]\n\t// bootcmd:\n\t// # work around https://github.com/hashicorp/terraform-provider-azurerm/issues/6117\n\t// - until [ -e /dev/disk/azure/scsi1/lun10 ]; do sleep 1; done\n\t// device_aliases:\n\t// homedir: /dev/disk/azure/scsi1/lun10\n\t// disk_setup:\n\t// homedir:\n\t// table_type: gpt\n\t// layout: true\n\t// fs_setup:\n\t// - label: coder_home\n\t// filesystem: ext4\n\t// device: homedir.1\n\t// mounts:\n\t// - [\"LABEL=coder_home\", \"/home/${username}\"]\n\t// hostname: ${hostname}\n\t// users:\n\t// - name: ${username}\n\t// sudo: [\"ALL=(ALL) NOPASSWD:ALL\"]\n\t// groups: sudo\n\t// shell: /bin/bash\n\t// packages:\n\t// - git\n\t// write_files:\n\t// - path: /opt/coder/init\n\t// permissions: \"0755\"\n\t// encoding: b64\n\t// content: ${init_script}\n\t// - path: /etc/systemd/system/coder-agent.service\n\t// permissions: \"0644\"\n\t// content: |\n\t// [Unit]\n\t// Description=Coder Agent\n\t// After=network-online.target\n\t// Wants=network-online.target\n\n\t// [Service]\n\t// User=${username}\n\t// ExecStart=/opt/coder/init\n\t// Restart=always\n\t// RestartSec=10\n\t// TimeoutStopSec=90\n\t// KillMode=process\n\n\t// OOMScoreAdjust=-900\n\t// SyslogIdentifier=coder-agent\n\n\t// [Install]\n\t// WantedBy=multi-user.target\n\t// runcmd:\n\t// - chown ${username}:${username} /home/${username}\n\t// - systemctl enable coder-agent\n\t// - systemctl start coder-agent\n content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n username = \"coder\" # Ensure this user/group does not exist in your VM image\n init_script = base64encode(coder_agent.main.init_script)\n hostname = lower(data.coder_workspace.me.name)\n })\n }\n}\n\nresource \"azurerm_linux_virtual_machine\" \"main\" {\n count = data.coder_workspace.me.start_count\n name = \"vm\"\n resource_group_name = azurerm_resource_group.main.name\n location = azurerm_resource_group.main.location\n size = data.coder_parameter.instance_type.value\n // cloud-init overwrites this, so the value here doesn't matter\n admin_username = \"adminuser\"\n admin_ssh_key {\n public_key = tls_private_key.dummy.public_key_openssh\n username = \"adminuser\"\n }\n\n network_interface_ids = [\n azurerm_network_interface.main.id,\n ]\n computer_name = lower(data.coder_workspace.me.name)\n os_disk {\n caching = \"ReadWrite\"\n storage_account_type = \"Standard_LRS\"\n }\n source_image_reference {\n publisher = \"Canonical\"\n offer = \"0001-com-ubuntu-server-focal\"\n sku = \"20_04-lts-gen2\"\n version = \"latest\"\n }\n user_data = data.cloudinit_config.user_data.rendered\n}\n\n\n\nterraform {\n required_providers {\n coder = {\n source = \"kreuzwerker/docker\"\n }\n }\n}\n\n// The agent is configured with \"token\" auth.\n\nresource \"docker_container\" \"workspace\" {\n count = data.coder_workspace.me.start_count\n image = \"codercom/enterprise-base:ubuntu\"\n # Uses lower() to avoid Docker restriction on container names.\n name = \"coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}\"\n # Hostname makes the shell more user friendly: coder@my-workspace:~$\n hostname = data.coder_workspace.me.name\n # Use the docker gateway if the access URL is 127.0.0.1.\n entrypoint = [\"sh\", \"-c\", replace(coder_agent.main.init_script, \"/localhost|127\\\\.0\\\\.0\\\\.1/\", \"host.docker.internal\")]\n env = [\"CODER_AGENT_TOKEN=${coder_agent.main.token}\"]\n host {\n host = \"host.docker.internal\"\n ip = \"host-gateway\"\n }\n volumes {\n container_path = \"/home/coder\"\n volume_name = docker_volume.home_volume.name\n read_only = false\n }\n}\n\n\n\n// The agent is configured with \"token\" auth.\n\nresource \"kubernetes_deployment\" \"main\" {\n count = data.coder_workspace.me.start_count\n depends_on = [\n kubernetes_persistent_volume_claim.home\n ]\n wait_for_rollout = false\n metadata {\n name = \"coder-${data.coder_workspace.me.id}\"\n }\n\n spec {\n replicas = 1\n strategy {\n type = \"Recreate\"\n }\n\n template {\n spec {\n security_context {\n run_as_user = 1000\n fs_group = 1000\n run_as_non_root = true\n }\n\n container {\n name = \"dev\"\n image = \"codercom/enterprise-base:ubuntu\"\n image_pull_policy = \"Always\"\n command = [\"sh\", \"-c\", coder_agent.main.init_script]\n security_context {\n run_as_user = \"1000\"\n }\n env {\n name = \"CODER_AGENT_TOKEN\"\n value = coder_agent.main.token\n }\n }\n }\n }\n }\n}\n\n\nThe file_id provided is a reference to a tar file you have uploaded containing the Terraform.\n","name":"bmcp_coder_coder_create_template_version","parameters":{"properties":{"file_id":{"type":"string"},"template_id":{"type":"string"}},"required":["file_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace in Coder.\n\nIf a user is asking to \"test a template\", they are typically referring\nto creating a workspace from a template to ensure the infrastructure\nis provisioned correctly and the agent can connect to the control plane.\n\nBefore creating a workspace, always confirm the template choice with the user by:\n\n\t1. Listing the available templates that match their request.\n\t2. Recommending the most relevant option.\n\t2. Asking the user to confirm which template to use.\n\nIt is important to not create a workspace without confirming the template\nchoice with the user.\n\nAfter creating a workspace, watch the build logs and wait for the workspace to\nbe ready before trying to use or connect to the workspace.\n","name":"bmcp_coder_coder_create_workspace","parameters":{"properties":{"name":{"description":"Name of the workspace to create.","type":"string"},"rich_parameters":{"description":"Key/value pairs of rich parameters to pass to the template version to create the workspace.","type":"object"},"template_version_id":{"description":"ID of the template version to create the workspace from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a workspace. Omit or use the `me` keyword to create a workspace for the authenticated user.","type":"string"}},"required":["user","template_version_id","name","rich_parameters"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace build for an existing workspace. Use this to start, stop, or delete.\n\nAfter creating a workspace build, watch the build logs and wait for the\nworkspace build to complete before trying to start another build or use or\nconnect to the workspace.\n","name":"bmcp_coder_coder_create_workspace_build","parameters":{"properties":{"template_version_id":{"description":"(Optional) The template version ID to use for the workspace build. If not provided, the previously built version will be used.","type":"string"},"transition":{"description":"The transition to perform. Must be one of: start, stop, delete","enum":["start","stop","delete"],"type":"string"},"workspace_id":{"type":"string"}},"required":["workspace_id","transition"],"type":"object"},"strict":false},{"type":"function","description":"Delete a task.","name":"bmcp_coder_coder_delete_task","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to delete. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Delete a template. This is irreversible.","name":"bmcp_coder_coder_delete_template","parameters":{"properties":{"template_id":{"type":"string"}},"required":["template_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the currently authenticated user, similar to the `whoami` command.","name":"bmcp_coder_coder_get_authenticated_user","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a task.","name":"bmcp_coder_coder_get_task_logs","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to query. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the status of a task.","name":"bmcp_coder_coder_get_task_status","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to get. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a template version. This is useful to check whether a template version successfully imports or not.","name":"bmcp_coder_coder_get_template_version_logs","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Get a workspace by name or ID.\n\nThis returns more data than list_workspaces to reduce token usage.","name":"bmcp_coder_coder_get_workspace","parameters":{"properties":{"workspace_id":{"description":"The workspace ID or name in the format [owner/]workspace. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace agent.\n\n\t\tMore logs may appear after this call. It does not wait for the agent to finish.","name":"bmcp_coder_coder_get_workspace_agent_logs","parameters":{"properties":{"workspace_agent_id":{"type":"string"}},"required":["workspace_agent_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace build.\n\n\t\tUseful for checking whether a workspace builds successfully or not.","name":"bmcp_coder_coder_get_workspace_build_logs","parameters":{"properties":{"workspace_build_id":{"type":"string"}},"required":["workspace_build_id"],"type":"object"},"strict":false},{"type":"function","description":"List tasks.","name":"bmcp_coder_coder_list_tasks","parameters":{"properties":{"status":{"description":"Optional filter by task status.","type":"string"},"user":{"description":"Username or ID of the user for which to list tasks. Omit or use the `me` keyword to list tasks for the authenticated user.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Lists templates for the authenticated user.","name":"bmcp_coder_coder_list_templates","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Lists workspaces for the authenticated user.","name":"bmcp_coder_coder_list_workspaces","parameters":{"properties":{"owner":{"description":"The owner of the workspaces to list. Use \"me\" to list workspaces for the authenticated user. If you do not specify an owner, \"me\" will be assumed by default.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Send input to a running task.","name":"bmcp_coder_coder_send_task_input","parameters":{"properties":{"input":{"description":"The input to send to the task.","type":"string"},"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to prompt. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id","input"],"type":"object"},"strict":false},{"type":"function","description":"Get the parameters for a template version. You can refer to these as workspace parameters to the user, as they are typically important for creating a workspace.","name":"bmcp_coder_coder_template_version_parameters","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Update the active version of a template. This is helpful when iterating on templates.","name":"bmcp_coder_coder_update_template_active_version","parameters":{"properties":{"template_id":{"type":"string"},"template_version_id":{"type":"string"}},"required":["template_id","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create and upload a tar file by key/value mapping of file names to file contents. Use this to create template versions. Reference the tool description of \"create_template_version\" to understand template requirements.","name":"bmcp_coder_coder_upload_tar_file","parameters":{"properties":{"files":{"description":"A map of file names to file contents.","type":"object"}},"required":["files"],"type":"object"},"strict":false},{"type":"function","description":"Execute a bash command in a Coder workspace.\n\nThis tool provides the same functionality as the 'coder ssh ' CLI command.\nIt automatically starts the workspace if it's stopped and waits for the agent to be ready.\nThe output is trimmed of leading and trailing whitespace.\n\nThe workspace parameter supports various formats:\n- workspace (uses current user)\n- owner/workspace\n- owner--workspace\n- workspace.agent (specific agent)\n- owner/workspace.agent\n\nThe timeout_ms parameter specifies the command timeout in milliseconds (defaults to 60000ms, maximum of 300000ms).\nIf the command times out, all output captured up to that point is returned with a cancellation message.\n\nFor background commands (background: true), output is captured until the timeout is reached, then the command\ncontinues running in the background. The captured output is returned as the result.\n\nFor file operations (list, write, edit), always prefer the dedicated file tools.\nDo not use bash commands (ls, cat, echo, heredoc, etc.) to list, write, or read\nfiles when the file tools are available. The bash tool should be used for:\n\n\t- Running commands and scripts\n\t- Installing packages\n\t- Starting services\n\t- Executing programs\n\nExamples:\n- workspace: \"john/dev-env\", command: \"git status\", timeout_ms: 30000\n- workspace: \"my-workspace\", command: \"npm run dev\", background: true, timeout_ms: 10000\n- workspace: \"my-workspace.main\", command: \"docker ps\"","name":"bmcp_coder_coder_workspace_bash","parameters":{"properties":{"background":{"description":"Whether to run the command in the background. Output is captured until timeout, then the command continues running in the background.","type":"boolean"},"command":{"description":"The bash command to execute in the workspace.","type":"string"},"timeout_ms":{"default":60000,"description":"Command timeout in milliseconds. Defaults to 60000ms (60 seconds) if not specified.","minimum":1,"type":"integer"},"workspace":{"description":"The workspace name in format [owner/]workspace[.agent]. If owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","command"],"type":"object"},"strict":false},{"type":"function","description":"Edit a file in a workspace.","name":"bmcp_coder_coder_workspace_edit_file","parameters":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","edits"],"type":"object"},"strict":false},{"type":"function","description":"Edit one or more files in a workspace.","name":"bmcp_coder_coder_workspace_edit_files","parameters":{"properties":{"files":{"description":"An array of files to edit.","items":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"}},"required":["path","edits"],"type":"object"},"type":"array"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","files"],"type":"object"},"strict":false},{"type":"function","description":"List the URLs of Coder apps running in a workspace for a single agent.","name":"bmcp_coder_coder_workspace_list_apps","parameters":{"properties":{"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace"],"type":"object"},"strict":false},{"type":"function","description":"List directories in a workspace.","name":"bmcp_coder_coder_workspace_ls","parameters":{"properties":{"path":{"description":"The absolute path of the directory in the workspace to list.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Fetch URLs that forward to the specified port.","name":"bmcp_coder_coder_workspace_port_forward","parameters":{"properties":{"port":{"description":"The port to forward.","type":"number"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","port"],"type":"object"},"strict":false},{"type":"function","description":"Read from a file in a workspace.","name":"bmcp_coder_coder_workspace_read_file","parameters":{"properties":{"limit":{"description":"The number of bytes to read. Cannot exceed 1 MiB. Defaults to the full size of the file or 1 MiB, whichever is lower.","type":"integer"},"offset":{"description":"A byte offset indicating where in the file to start reading. Defaults to zero. An empty string indicates the end of the file has been reached.","type":"integer"},"path":{"description":"The absolute path of the file to read in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Write a file in a workspace.\n\nIf a file write fails due to syntax errors or encoding issues, do NOT switch\nto using bash commands as a workaround. Instead:\n\n\t1. Read the error message carefully to identify the issue\n\t2. Fix the content encoding/syntax\n\t3. Retry with this tool\n\nThe content parameter expects base64-encoded bytes. Ensure your source content\nis correct before encoding it. If you encounter errors, decode and verify the\ncontent you are trying to write, then re-encode it properly.\n","name":"bmcp_coder_coder_workspace_write_file","parameters":{"properties":{"content":{"description":"The base64-encoded bytes to write to the file.","type":"string"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","content"],"type":"object"},"strict":false}],"top_logprobs":0,"top_p":1.0,"truncation":"disabled","usage":{"input_tokens":6463,"input_tokens_details":{"cached_tokens":6144,"cache_write_tokens":11},"output_tokens":182,"output_tokens_details":{"reasoning_tokens":5},"total_tokens":6645},"user":null,"metadata":{}},"sequence_number":187} diff --git a/aibridge/fixtures/openai/responses/streaming/single_injected_tool_error.txtar b/aibridge/fixtures/openai/responses/streaming/single_injected_tool_error.txtar index 95dd43e5433..a6ea96c8c3e 100644 --- a/aibridge/fixtures/openai/responses/streaming/single_injected_tool_error.txtar +++ b/aibridge/fixtures/openai/responses/streaming/single_injected_tool_error.txtar @@ -58,7 +58,7 @@ event: response.output_item.done data: {"type":"response.output_item.done","item":{"id":"fc_0dfed48e1052ad7f0069725ca2cbac8193a79ff3716ec63dda","type":"function_call","status":"completed","arguments":"{\"transition\":\"start\",\"workspace_id\":\"non_existing_id\"}","call_id":"call_1wHAlwmnxtbUzowDJkmlcpJ4","name":"bmcp_coder_coder_create_workspace_build"},"output_index":0,"sequence_number":16} event: response.completed -data: {"type":"response.completed","response":{"id":"resp_0dfed48e1052ad7f0069725ca129f88193b97d6deff1760524","object":"response","created_at":1769102497,"status":"completed","background":false,"completed_at":1769102499,"error":null,"frequency_penalty":0.0,"incomplete_details":null,"instructions":null,"max_output_tokens":null,"max_tool_calls":null,"model":"gpt-4.1-2025-04-14","output":[{"id":"fc_0dfed48e1052ad7f0069725ca2cbac8193a79ff3716ec63dda","type":"function_call","status":"completed","arguments":"{\"transition\":\"start\",\"workspace_id\":\"non_existing_id\"}","call_id":"call_1wHAlwmnxtbUzowDJkmlcpJ4","name":"bmcp_coder_coder_create_workspace_build"}],"parallel_tool_calls":false,"presence_penalty":0.0,"previous_response_id":null,"prompt_cache_key":null,"prompt_cache_retention":null,"reasoning":{"effort":null,"summary":null},"safety_identifier":null,"service_tier":"default","store":true,"temperature":1.0,"text":{"format":{"type":"text"},"verbosity":"medium"},"tool_choice":"auto","tools":[{"type":"function","description":"Create a task.","name":"bmcp_coder_coder_create_task","parameters":{"properties":{"input":{"description":"Input/prompt for the task.","type":"string"},"template_version_id":{"description":"ID of the template version to create the task from.","type":"string"},"template_version_preset_id":{"description":"Optional ID of the template version preset to create the task from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a task. Omit or use the `me` keyword to create a task for the authenticated user.","type":"string"}},"required":["input","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template in Coder. First, you must create a template version.","name":"bmcp_coder_coder_create_template","parameters":{"properties":{"description":{"type":"string"},"display_name":{"type":"string"},"icon":{"description":"A URL to an icon to use.","type":"string"},"name":{"type":"string"},"version_id":{"description":"The ID of the version to use.","type":"string"}},"required":["name","display_name","description","version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template version. This is a precursor to creating a template, or you can update an existing template.\n\nTemplates are Terraform defining a development environment. The provisioned infrastructure must run\nan Agent that connects to the Coder Control Plane to provide a rich experience.\n\nHere are some strict rules for creating a template version:\n- YOU MUST NOT use \"variable\" or \"output\" blocks in the Terraform code.\n- YOU MUST ALWAYS check template version logs after creation to ensure the template was imported successfully.\n\nWhen a template version is created, a Terraform Plan occurs that ensures the infrastructure\n_could_ be provisioned, but actual provisioning occurs when a workspace is created.\n\n\nThe Coder Terraform Provider can be imported like:\n\n```hcl\nterraform {\n required_providers {\n coder = {\n source = \"coder/coder\"\n }\n }\n}\n```\n\nA destroy does not occur when a user stops a workspace, but rather the transition changes:\n\n```hcl\ndata \"coder_workspace\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace.\n- name: The name of the workspace.\n- transition: Either \"start\" or \"stop\".\n- start_count: A computed count based on the transition field. If \"start\", this will be 1.\n\nAccess workspace owner information with:\n\n```hcl\ndata \"coder_workspace_owner\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace owner.\n- name: The name of the workspace owner.\n- full_name: The full name of the workspace owner.\n- email: The email of the workspace owner.\n- session_token: A token that can be used to authenticate the workspace owner. It is regenerated every time the workspace is started.\n- oidc_access_token: A valid OpenID Connect access token of the workspace owner. This is only available if the workspace owner authenticated with OpenID Connect. If a valid token cannot be obtained, this value will be an empty string.\n\nParameters are defined in the template version. They are rendered in the UI on the workspace creation page:\n\n```hcl\nresource \"coder_parameter\" \"region\" {\n name = \"region\"\n type = \"string\"\n default = \"us-east-1\"\n}\n```\n\nThis resource accepts the following properties:\n- name: The name of the parameter.\n- default: The default value of the parameter.\n- type: The type of the parameter. Must be one of: \"string\", \"number\", \"bool\", or \"list(string)\".\n- display_name: The displayed name of the parameter as it will appear in the UI.\n- description: The description of the parameter as it will appear in the UI.\n- ephemeral: The value of an ephemeral parameter will not be preserved between consecutive workspace builds.\n- form_type: The type of this parameter. Must be one of: [radio, slider, input, dropdown, checkbox, switch, multi-select, tag-select, textarea, error].\n- icon: A URL to an icon to display in the UI.\n- mutable: Whether this value can be changed after workspace creation. This can be destructive for values like region, so use with caution!\n- option: Each option block defines a value for a user to select from. (see below for nested schema)\n Required:\n - name: The name of the option.\n - value: The value of the option.\n Optional:\n - description: The description of the option as it will appear in the UI.\n - icon: A URL to an icon to display in the UI.\n\nA Workspace Agent runs on provisioned infrastructure to provide access to the workspace:\n\n```hcl\nresource \"coder_agent\" \"dev\" {\n arch = \"amd64\"\n os = \"linux\"\n}\n```\n\nThis resource accepts the following properties:\n- arch: The architecture of the agent. Must be one of: \"amd64\", \"arm64\", or \"armv7\".\n- os: The operating system of the agent. Must be one of: \"linux\", \"windows\", or \"darwin\".\n- auth: The authentication method for the agent. Must be one of: \"token\", \"google-instance-identity\", \"aws-instance-identity\", or \"azure-instance-identity\". It is insecure to pass the agent token via exposed variables to Virtual Machines. Instance Identity enables provisioned VMs to authenticate by instance ID on start.\n- dir: The starting directory when a user creates a shell session. Defaults to \"$HOME\".\n- env: A map of environment variables to set for the agent.\n- startup_script: A script to run after the agent starts. This script MUST exit eventually to signal that startup has completed. Use \"&\" or \"screen\" to run processes in the background.\n\nThis resource provides the following fields:\n- id: The UUID of the agent.\n- init_script: The script to run on provisioned infrastructure to fetch and start the agent.\n- token: Set the environment variable CODER_AGENT_TOKEN to this value to authenticate the agent.\n\nThe agent MUST be installed and started using the init_script. A utility like curl or wget to fetch the agent binary must exist in the provisioned infrastructure.\n\nExpose terminal or HTTP applications running in a workspace with:\n\n```hcl\nresource \"coder_app\" \"dev\" {\n agent_id = coder_agent.dev.id\n slug = \"my-app-name\"\n display_name = \"My App\"\n icon = \"https://my-app.com/icon.svg\"\n url = \"http://127.0.0.1:3000\"\n}\n```\n\nThis resource accepts the following properties:\n- agent_id: The ID of the agent to attach the app to.\n- slug: The slug of the app.\n- display_name: The displayed name of the app as it will appear in the UI.\n- icon: A URL to an icon to display in the UI.\n- url: An external url if external=true or a URL to be proxied to from inside the workspace. This should be of the form http://localhost:PORT[/SUBPATH]. Either command or url may be specified, but not both.\n- command: A command to run in a terminal opening this app. In the web, this will open in a new tab. In the CLI, this will SSH and execute the command. Either command or url may be specified, but not both.\n- external: Whether this app is an external app. If true, the url will be opened in a new tab.\n\n\nThe Coder Server may not be authenticated with the infrastructure provider a user requests. In this scenario,\nthe user will need to provide credentials to the Coder Server before the workspace can be provisioned.\n\nHere are examples of provisioning the Coder Agent on specific infrastructure providers:\n\n\n// The agent is configured with \"aws-instance-identity\" auth.\nterraform {\n required_providers {\n cloudinit = {\n source = \"hashicorp/cloudinit\"\n }\n aws = {\n source = \"hashicorp/aws\"\n }\n }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n gzip = false\n base64_encode = false\n boundary = \"//\"\n part {\n filename = \"cloud-config.yaml\"\n content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t// - [scripts-user, always]\n\t// hostname: ${hostname}\n\t// users:\n\t// - name: ${linux_user}\n\t// sudo: ALL=(ALL) NOPASSWD:ALL\n\t// shell: /bin/bash\n content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n hostname = local.hostname\n linux_user = local.linux_user\n })\n }\n\n part {\n filename = \"userdata.sh\"\n content_type = \"text/x-shellscript\"\n\n\t// Here is the content of the userdata.sh.tftpl file:\n\t// #!/bin/bash\n\t// sudo -u '${linux_user}' sh -c '${init_script}'\n content = templatefile(\"${path.module}/cloud-init/userdata.sh.tftpl\", {\n linux_user = local.linux_user\n\n init_script = try(coder_agent.dev[0].init_script, \"\")\n })\n }\n}\n\nresource \"aws_instance\" \"dev\" {\n ami = data.aws_ami.ubuntu.id\n availability_zone = \"${data.coder_parameter.region.value}a\"\n instance_type = data.coder_parameter.instance_type.value\n\n user_data = data.cloudinit_config.user_data.rendered\n tags = {\n Name = \"coder-${data.coder_workspace_owner.me.name}-${data.coder_workspace.me.name}\"\n }\n lifecycle {\n ignore_changes = [ami]\n }\n}\n\n\n\n// The agent is configured with \"google-instance-identity\" auth.\nterraform {\n required_providers {\n google = {\n source = \"hashicorp/google\"\n }\n }\n}\n\nresource \"google_compute_instance\" \"dev\" {\n zone = module.gcp_region.value\n count = data.coder_workspace.me.start_count\n name = \"coder-${lower(data.coder_workspace_owner.me.name)}-${lower(data.coder_workspace.me.name)}-root\"\n machine_type = \"e2-medium\"\n network_interface {\n network = \"default\"\n access_config {\n // Ephemeral public IP\n }\n }\n boot_disk {\n auto_delete = false\n source = google_compute_disk.root.name\n }\n // In order to use google-instance-identity, a service account *must* be provided.\n service_account {\n email = data.google_compute_default_service_account.default.email\n scopes = [\"cloud-platform\"]\n }\n # ONLY FOR WINDOWS:\n # metadata = {\n # windows-startup-script-ps1 = coder_agent.main.init_script\n # }\n # The startup script runs as root with no $HOME environment set up, so instead of directly\n # running the agent init script, create a user (with a homedir, default shell and sudo\n # permissions) and execute the init script as that user.\n #\n # The agent MUST be started in here.\n metadata_startup_script = </dev/null 2>&1; then\n useradd -m -s /bin/bash \"${local.linux_user}\"\n echo \"${local.linux_user} ALL=(ALL) NOPASSWD:ALL\" > /etc/sudoers.d/coder-user\nfi\n\nexec sudo -u \"${local.linux_user}\" sh -c '${coder_agent.main.init_script}'\nEOMETA\n}\n\n\n\n// The agent is configured with \"azure-instance-identity\" auth.\nterraform {\n required_providers {\n azurerm = {\n source = \"hashicorp/azurerm\"\n }\n cloudinit = {\n source = \"hashicorp/cloudinit\"\n }\n }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n gzip = false\n base64_encode = true\n\n boundary = \"//\"\n\n part {\n filename = \"cloud-config.yaml\"\n content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t// - [scripts-user, always]\n\t// bootcmd:\n\t// # work around https://github.com/hashicorp/terraform-provider-azurerm/issues/6117\n\t// - until [ -e /dev/disk/azure/scsi1/lun10 ]; do sleep 1; done\n\t// device_aliases:\n\t// homedir: /dev/disk/azure/scsi1/lun10\n\t// disk_setup:\n\t// homedir:\n\t// table_type: gpt\n\t// layout: true\n\t// fs_setup:\n\t// - label: coder_home\n\t// filesystem: ext4\n\t// device: homedir.1\n\t// mounts:\n\t// - [\"LABEL=coder_home\", \"/home/${username}\"]\n\t// hostname: ${hostname}\n\t// users:\n\t// - name: ${username}\n\t// sudo: [\"ALL=(ALL) NOPASSWD:ALL\"]\n\t// groups: sudo\n\t// shell: /bin/bash\n\t// packages:\n\t// - git\n\t// write_files:\n\t// - path: /opt/coder/init\n\t// permissions: \"0755\"\n\t// encoding: b64\n\t// content: ${init_script}\n\t// - path: /etc/systemd/system/coder-agent.service\n\t// permissions: \"0644\"\n\t// content: |\n\t// [Unit]\n\t// Description=Coder Agent\n\t// After=network-online.target\n\t// Wants=network-online.target\n\n\t// [Service]\n\t// User=${username}\n\t// ExecStart=/opt/coder/init\n\t// Restart=always\n\t// RestartSec=10\n\t// TimeoutStopSec=90\n\t// KillMode=process\n\n\t// OOMScoreAdjust=-900\n\t// SyslogIdentifier=coder-agent\n\n\t// [Install]\n\t// WantedBy=multi-user.target\n\t// runcmd:\n\t// - chown ${username}:${username} /home/${username}\n\t// - systemctl enable coder-agent\n\t// - systemctl start coder-agent\n content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n username = \"coder\" # Ensure this user/group does not exist in your VM image\n init_script = base64encode(coder_agent.main.init_script)\n hostname = lower(data.coder_workspace.me.name)\n })\n }\n}\n\nresource \"azurerm_linux_virtual_machine\" \"main\" {\n count = data.coder_workspace.me.start_count\n name = \"vm\"\n resource_group_name = azurerm_resource_group.main.name\n location = azurerm_resource_group.main.location\n size = data.coder_parameter.instance_type.value\n // cloud-init overwrites this, so the value here doesn't matter\n admin_username = \"adminuser\"\n admin_ssh_key {\n public_key = tls_private_key.dummy.public_key_openssh\n username = \"adminuser\"\n }\n\n network_interface_ids = [\n azurerm_network_interface.main.id,\n ]\n computer_name = lower(data.coder_workspace.me.name)\n os_disk {\n caching = \"ReadWrite\"\n storage_account_type = \"Standard_LRS\"\n }\n source_image_reference {\n publisher = \"Canonical\"\n offer = \"0001-com-ubuntu-server-focal\"\n sku = \"20_04-lts-gen2\"\n version = \"latest\"\n }\n user_data = data.cloudinit_config.user_data.rendered\n}\n\n\n\nterraform {\n required_providers {\n coder = {\n source = \"kreuzwerker/docker\"\n }\n }\n}\n\n// The agent is configured with \"token\" auth.\n\nresource \"docker_container\" \"workspace\" {\n count = data.coder_workspace.me.start_count\n image = \"codercom/enterprise-base:ubuntu\"\n # Uses lower() to avoid Docker restriction on container names.\n name = \"coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}\"\n # Hostname makes the shell more user friendly: coder@my-workspace:~$\n hostname = data.coder_workspace.me.name\n # Use the docker gateway if the access URL is 127.0.0.1.\n entrypoint = [\"sh\", \"-c\", replace(coder_agent.main.init_script, \"/localhost|127\\\\.0\\\\.0\\\\.1/\", \"host.docker.internal\")]\n env = [\"CODER_AGENT_TOKEN=${coder_agent.main.token}\"]\n host {\n host = \"host.docker.internal\"\n ip = \"host-gateway\"\n }\n volumes {\n container_path = \"/home/coder\"\n volume_name = docker_volume.home_volume.name\n read_only = false\n }\n}\n\n\n\n// The agent is configured with \"token\" auth.\n\nresource \"kubernetes_deployment\" \"main\" {\n count = data.coder_workspace.me.start_count\n depends_on = [\n kubernetes_persistent_volume_claim.home\n ]\n wait_for_rollout = false\n metadata {\n name = \"coder-${data.coder_workspace.me.id}\"\n }\n\n spec {\n replicas = 1\n strategy {\n type = \"Recreate\"\n }\n\n template {\n spec {\n security_context {\n run_as_user = 1000\n fs_group = 1000\n run_as_non_root = true\n }\n\n container {\n name = \"dev\"\n image = \"codercom/enterprise-base:ubuntu\"\n image_pull_policy = \"Always\"\n command = [\"sh\", \"-c\", coder_agent.main.init_script]\n security_context {\n run_as_user = \"1000\"\n }\n env {\n name = \"CODER_AGENT_TOKEN\"\n value = coder_agent.main.token\n }\n }\n }\n }\n }\n}\n\n\nThe file_id provided is a reference to a tar file you have uploaded containing the Terraform.\n","name":"bmcp_coder_coder_create_template_version","parameters":{"properties":{"file_id":{"type":"string"},"template_id":{"type":"string"}},"required":["file_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace in Coder.\n\nIf a user is asking to \"test a template\", they are typically referring\nto creating a workspace from a template to ensure the infrastructure\nis provisioned correctly and the agent can connect to the control plane.\n\nBefore creating a workspace, always confirm the template choice with the user by:\n\n\t1. Listing the available templates that match their request.\n\t2. Recommending the most relevant option.\n\t2. Asking the user to confirm which template to use.\n\nIt is important to not create a workspace without confirming the template\nchoice with the user.\n\nAfter creating a workspace, watch the build logs and wait for the workspace to\nbe ready before trying to use or connect to the workspace.\n","name":"bmcp_coder_coder_create_workspace","parameters":{"properties":{"name":{"description":"Name of the workspace to create.","type":"string"},"rich_parameters":{"description":"Key/value pairs of rich parameters to pass to the template version to create the workspace.","type":"object"},"template_version_id":{"description":"ID of the template version to create the workspace from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a workspace. Omit or use the `me` keyword to create a workspace for the authenticated user.","type":"string"}},"required":["user","template_version_id","name","rich_parameters"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace build for an existing workspace. Use this to start, stop, or delete.\n\nAfter creating a workspace build, watch the build logs and wait for the\nworkspace build to complete before trying to start another build or use or\nconnect to the workspace.\n","name":"bmcp_coder_coder_create_workspace_build","parameters":{"properties":{"template_version_id":{"description":"(Optional) The template version ID to use for the workspace build. If not provided, the previously built version will be used.","type":"string"},"transition":{"description":"The transition to perform. Must be one of: start, stop, delete","enum":["start","stop","delete"],"type":"string"},"workspace_id":{"type":"string"}},"required":["workspace_id","transition"],"type":"object"},"strict":false},{"type":"function","description":"Delete a task.","name":"bmcp_coder_coder_delete_task","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to delete. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Delete a template. This is irreversible.","name":"bmcp_coder_coder_delete_template","parameters":{"properties":{"template_id":{"type":"string"}},"required":["template_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the currently authenticated user, similar to the `whoami` command.","name":"bmcp_coder_coder_get_authenticated_user","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a task.","name":"bmcp_coder_coder_get_task_logs","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to query. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the status of a task.","name":"bmcp_coder_coder_get_task_status","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to get. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a template version. This is useful to check whether a template version successfully imports or not.","name":"bmcp_coder_coder_get_template_version_logs","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Get a workspace by name or ID.\n\nThis returns more data than list_workspaces to reduce token usage.","name":"bmcp_coder_coder_get_workspace","parameters":{"properties":{"workspace_id":{"description":"The workspace ID or name in the format [owner/]workspace. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace agent.\n\n\t\tMore logs may appear after this call. It does not wait for the agent to finish.","name":"bmcp_coder_coder_get_workspace_agent_logs","parameters":{"properties":{"workspace_agent_id":{"type":"string"}},"required":["workspace_agent_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace build.\n\n\t\tUseful for checking whether a workspace builds successfully or not.","name":"bmcp_coder_coder_get_workspace_build_logs","parameters":{"properties":{"workspace_build_id":{"type":"string"}},"required":["workspace_build_id"],"type":"object"},"strict":false},{"type":"function","description":"List tasks.","name":"bmcp_coder_coder_list_tasks","parameters":{"properties":{"status":{"description":"Optional filter by task status.","type":"string"},"user":{"description":"Username or ID of the user for which to list tasks. Omit or use the `me` keyword to list tasks for the authenticated user.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Lists templates for the authenticated user.","name":"bmcp_coder_coder_list_templates","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Lists workspaces for the authenticated user.","name":"bmcp_coder_coder_list_workspaces","parameters":{"properties":{"owner":{"description":"The owner of the workspaces to list. Use \"me\" to list workspaces for the authenticated user. If you do not specify an owner, \"me\" will be assumed by default.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Send input to a running task.","name":"bmcp_coder_coder_send_task_input","parameters":{"properties":{"input":{"description":"The input to send to the task.","type":"string"},"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to prompt. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id","input"],"type":"object"},"strict":false},{"type":"function","description":"Get the parameters for a template version. You can refer to these as workspace parameters to the user, as they are typically important for creating a workspace.","name":"bmcp_coder_coder_template_version_parameters","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Update the active version of a template. This is helpful when iterating on templates.","name":"bmcp_coder_coder_update_template_active_version","parameters":{"properties":{"template_id":{"type":"string"},"template_version_id":{"type":"string"}},"required":["template_id","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create and upload a tar file by key/value mapping of file names to file contents. Use this to create template versions. Reference the tool description of \"create_template_version\" to understand template requirements.","name":"bmcp_coder_coder_upload_tar_file","parameters":{"properties":{"files":{"description":"A map of file names to file contents.","type":"object"}},"required":["files"],"type":"object"},"strict":false},{"type":"function","description":"Execute a bash command in a Coder workspace.\n\nThis tool provides the same functionality as the 'coder ssh ' CLI command.\nIt automatically starts the workspace if it's stopped and waits for the agent to be ready.\nThe output is trimmed of leading and trailing whitespace.\n\nThe workspace parameter supports various formats:\n- workspace (uses current user)\n- owner/workspace\n- owner--workspace\n- workspace.agent (specific agent)\n- owner/workspace.agent\n\nThe timeout_ms parameter specifies the command timeout in milliseconds (defaults to 60000ms, maximum of 300000ms).\nIf the command times out, all output captured up to that point is returned with a cancellation message.\n\nFor background commands (background: true), output is captured until the timeout is reached, then the command\ncontinues running in the background. The captured output is returned as the result.\n\nFor file operations (list, write, edit), always prefer the dedicated file tools.\nDo not use bash commands (ls, cat, echo, heredoc, etc.) to list, write, or read\nfiles when the file tools are available. The bash tool should be used for:\n\n\t- Running commands and scripts\n\t- Installing packages\n\t- Starting services\n\t- Executing programs\n\nExamples:\n- workspace: \"john/dev-env\", command: \"git status\", timeout_ms: 30000\n- workspace: \"my-workspace\", command: \"npm run dev\", background: true, timeout_ms: 10000\n- workspace: \"my-workspace.main\", command: \"docker ps\"","name":"bmcp_coder_coder_workspace_bash","parameters":{"properties":{"background":{"description":"Whether to run the command in the background. Output is captured until timeout, then the command continues running in the background.","type":"boolean"},"command":{"description":"The bash command to execute in the workspace.","type":"string"},"timeout_ms":{"default":60000,"description":"Command timeout in milliseconds. Defaults to 60000ms (60 seconds) if not specified.","minimum":1,"type":"integer"},"workspace":{"description":"The workspace name in format [owner/]workspace[.agent]. If owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","command"],"type":"object"},"strict":false},{"type":"function","description":"Edit a file in a workspace.","name":"bmcp_coder_coder_workspace_edit_file","parameters":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","edits"],"type":"object"},"strict":false},{"type":"function","description":"Edit one or more files in a workspace.","name":"bmcp_coder_coder_workspace_edit_files","parameters":{"properties":{"files":{"description":"An array of files to edit.","items":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"}},"required":["path","edits"],"type":"object"},"type":"array"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","files"],"type":"object"},"strict":false},{"type":"function","description":"List the URLs of Coder apps running in a workspace for a single agent.","name":"bmcp_coder_coder_workspace_list_apps","parameters":{"properties":{"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace"],"type":"object"},"strict":false},{"type":"function","description":"List directories in a workspace.","name":"bmcp_coder_coder_workspace_ls","parameters":{"properties":{"path":{"description":"The absolute path of the directory in the workspace to list.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Fetch URLs that forward to the specified port.","name":"bmcp_coder_coder_workspace_port_forward","parameters":{"properties":{"port":{"description":"The port to forward.","type":"number"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","port"],"type":"object"},"strict":false},{"type":"function","description":"Read from a file in a workspace.","name":"bmcp_coder_coder_workspace_read_file","parameters":{"properties":{"limit":{"description":"The number of bytes to read. Cannot exceed 1 MiB. Defaults to the full size of the file or 1 MiB, whichever is lower.","type":"integer"},"offset":{"description":"A byte offset indicating where in the file to start reading. Defaults to zero. An empty string indicates the end of the file has been reached.","type":"integer"},"path":{"description":"The absolute path of the file to read in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Write a file in a workspace.\n\nIf a file write fails due to syntax errors or encoding issues, do NOT switch\nto using bash commands as a workaround. Instead:\n\n\t1. Read the error message carefully to identify the issue\n\t2. Fix the content encoding/syntax\n\t3. Retry with this tool\n\nThe content parameter expects base64-encoded bytes. Ensure your source content\nis correct before encoding it. If you encounter errors, decode and verify the\ncontent you are trying to write, then re-encode it properly.\n","name":"bmcp_coder_coder_workspace_write_file","parameters":{"properties":{"content":{"description":"The base64-encoded bytes to write to the file.","type":"string"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","content"],"type":"object"},"strict":false}],"top_logprobs":0,"top_p":1.0,"truncation":"disabled","usage":{"input_tokens":6280,"input_tokens_details":{"cached_tokens":0},"output_tokens":30,"output_tokens_details":{"reasoning_tokens":0},"total_tokens":6310},"user":null,"metadata":{}},"sequence_number":17} +data: {"type":"response.completed","response":{"id":"resp_0dfed48e1052ad7f0069725ca129f88193b97d6deff1760524","object":"response","created_at":1769102497,"status":"completed","background":false,"completed_at":1769102499,"error":null,"frequency_penalty":0.0,"incomplete_details":null,"instructions":null,"max_output_tokens":null,"max_tool_calls":null,"model":"gpt-4.1-2025-04-14","output":[{"id":"fc_0dfed48e1052ad7f0069725ca2cbac8193a79ff3716ec63dda","type":"function_call","status":"completed","arguments":"{\"transition\":\"start\",\"workspace_id\":\"non_existing_id\"}","call_id":"call_1wHAlwmnxtbUzowDJkmlcpJ4","name":"bmcp_coder_coder_create_workspace_build"}],"parallel_tool_calls":false,"presence_penalty":0.0,"previous_response_id":null,"prompt_cache_key":null,"prompt_cache_retention":null,"reasoning":{"effort":null,"summary":null},"safety_identifier":null,"service_tier":"default","store":true,"temperature":1.0,"text":{"format":{"type":"text"},"verbosity":"medium"},"tool_choice":"auto","tools":[{"type":"function","description":"Create a task.","name":"bmcp_coder_coder_create_task","parameters":{"properties":{"input":{"description":"Input/prompt for the task.","type":"string"},"template_version_id":{"description":"ID of the template version to create the task from.","type":"string"},"template_version_preset_id":{"description":"Optional ID of the template version preset to create the task from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a task. Omit or use the `me` keyword to create a task for the authenticated user.","type":"string"}},"required":["input","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template in Coder. First, you must create a template version.","name":"bmcp_coder_coder_create_template","parameters":{"properties":{"description":{"type":"string"},"display_name":{"type":"string"},"icon":{"description":"A URL to an icon to use.","type":"string"},"name":{"type":"string"},"version_id":{"description":"The ID of the version to use.","type":"string"}},"required":["name","display_name","description","version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template version. This is a precursor to creating a template, or you can update an existing template.\n\nTemplates are Terraform defining a development environment. The provisioned infrastructure must run\nan Agent that connects to the Coder Control Plane to provide a rich experience.\n\nHere are some strict rules for creating a template version:\n- YOU MUST NOT use \"variable\" or \"output\" blocks in the Terraform code.\n- YOU MUST ALWAYS check template version logs after creation to ensure the template was imported successfully.\n\nWhen a template version is created, a Terraform Plan occurs that ensures the infrastructure\n_could_ be provisioned, but actual provisioning occurs when a workspace is created.\n\n\nThe Coder Terraform Provider can be imported like:\n\n```hcl\nterraform {\n required_providers {\n coder = {\n source = \"coder/coder\"\n }\n }\n}\n```\n\nA destroy does not occur when a user stops a workspace, but rather the transition changes:\n\n```hcl\ndata \"coder_workspace\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace.\n- name: The name of the workspace.\n- transition: Either \"start\" or \"stop\".\n- start_count: A computed count based on the transition field. If \"start\", this will be 1.\n\nAccess workspace owner information with:\n\n```hcl\ndata \"coder_workspace_owner\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace owner.\n- name: The name of the workspace owner.\n- full_name: The full name of the workspace owner.\n- email: The email of the workspace owner.\n- session_token: A token that can be used to authenticate the workspace owner. It is regenerated every time the workspace is started.\n- oidc_access_token: A valid OpenID Connect access token of the workspace owner. This is only available if the workspace owner authenticated with OpenID Connect. If a valid token cannot be obtained, this value will be an empty string.\n\nParameters are defined in the template version. They are rendered in the UI on the workspace creation page:\n\n```hcl\nresource \"coder_parameter\" \"region\" {\n name = \"region\"\n type = \"string\"\n default = \"us-east-1\"\n}\n```\n\nThis resource accepts the following properties:\n- name: The name of the parameter.\n- default: The default value of the parameter.\n- type: The type of the parameter. Must be one of: \"string\", \"number\", \"bool\", or \"list(string)\".\n- display_name: The displayed name of the parameter as it will appear in the UI.\n- description: The description of the parameter as it will appear in the UI.\n- ephemeral: The value of an ephemeral parameter will not be preserved between consecutive workspace builds.\n- form_type: The type of this parameter. Must be one of: [radio, slider, input, dropdown, checkbox, switch, multi-select, tag-select, textarea, error].\n- icon: A URL to an icon to display in the UI.\n- mutable: Whether this value can be changed after workspace creation. This can be destructive for values like region, so use with caution!\n- option: Each option block defines a value for a user to select from. (see below for nested schema)\n Required:\n - name: The name of the option.\n - value: The value of the option.\n Optional:\n - description: The description of the option as it will appear in the UI.\n - icon: A URL to an icon to display in the UI.\n\nA Workspace Agent runs on provisioned infrastructure to provide access to the workspace:\n\n```hcl\nresource \"coder_agent\" \"dev\" {\n arch = \"amd64\"\n os = \"linux\"\n}\n```\n\nThis resource accepts the following properties:\n- arch: The architecture of the agent. Must be one of: \"amd64\", \"arm64\", or \"armv7\".\n- os: The operating system of the agent. Must be one of: \"linux\", \"windows\", or \"darwin\".\n- auth: The authentication method for the agent. Must be one of: \"token\", \"google-instance-identity\", \"aws-instance-identity\", or \"azure-instance-identity\". It is insecure to pass the agent token via exposed variables to Virtual Machines. Instance Identity enables provisioned VMs to authenticate by instance ID on start.\n- dir: The starting directory when a user creates a shell session. Defaults to \"$HOME\".\n- env: A map of environment variables to set for the agent.\n- startup_script: A script to run after the agent starts. This script MUST exit eventually to signal that startup has completed. Use \"&\" or \"screen\" to run processes in the background.\n\nThis resource provides the following fields:\n- id: The UUID of the agent.\n- init_script: The script to run on provisioned infrastructure to fetch and start the agent.\n- token: Set the environment variable CODER_AGENT_TOKEN to this value to authenticate the agent.\n\nThe agent MUST be installed and started using the init_script. A utility like curl or wget to fetch the agent binary must exist in the provisioned infrastructure.\n\nExpose terminal or HTTP applications running in a workspace with:\n\n```hcl\nresource \"coder_app\" \"dev\" {\n agent_id = coder_agent.dev.id\n slug = \"my-app-name\"\n display_name = \"My App\"\n icon = \"https://my-app.com/icon.svg\"\n url = \"http://127.0.0.1:3000\"\n}\n```\n\nThis resource accepts the following properties:\n- agent_id: The ID of the agent to attach the app to.\n- slug: The slug of the app.\n- display_name: The displayed name of the app as it will appear in the UI.\n- icon: A URL to an icon to display in the UI.\n- url: An external url if external=true or a URL to be proxied to from inside the workspace. This should be of the form http://localhost:PORT[/SUBPATH]. Either command or url may be specified, but not both.\n- command: A command to run in a terminal opening this app. In the web, this will open in a new tab. In the CLI, this will SSH and execute the command. Either command or url may be specified, but not both.\n- external: Whether this app is an external app. If true, the url will be opened in a new tab.\n\n\nThe Coder Server may not be authenticated with the infrastructure provider a user requests. In this scenario,\nthe user will need to provide credentials to the Coder Server before the workspace can be provisioned.\n\nHere are examples of provisioning the Coder Agent on specific infrastructure providers:\n\n\n// The agent is configured with \"aws-instance-identity\" auth.\nterraform {\n required_providers {\n cloudinit = {\n source = \"hashicorp/cloudinit\"\n }\n aws = {\n source = \"hashicorp/aws\"\n }\n }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n gzip = false\n base64_encode = false\n boundary = \"//\"\n part {\n filename = \"cloud-config.yaml\"\n content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t// - [scripts-user, always]\n\t// hostname: ${hostname}\n\t// users:\n\t// - name: ${linux_user}\n\t// sudo: ALL=(ALL) NOPASSWD:ALL\n\t// shell: /bin/bash\n content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n hostname = local.hostname\n linux_user = local.linux_user\n })\n }\n\n part {\n filename = \"userdata.sh\"\n content_type = \"text/x-shellscript\"\n\n\t// Here is the content of the userdata.sh.tftpl file:\n\t// #!/bin/bash\n\t// sudo -u '${linux_user}' sh -c '${init_script}'\n content = templatefile(\"${path.module}/cloud-init/userdata.sh.tftpl\", {\n linux_user = local.linux_user\n\n init_script = try(coder_agent.dev[0].init_script, \"\")\n })\n }\n}\n\nresource \"aws_instance\" \"dev\" {\n ami = data.aws_ami.ubuntu.id\n availability_zone = \"${data.coder_parameter.region.value}a\"\n instance_type = data.coder_parameter.instance_type.value\n\n user_data = data.cloudinit_config.user_data.rendered\n tags = {\n Name = \"coder-${data.coder_workspace_owner.me.name}-${data.coder_workspace.me.name}\"\n }\n lifecycle {\n ignore_changes = [ami]\n }\n}\n\n\n\n// The agent is configured with \"google-instance-identity\" auth.\nterraform {\n required_providers {\n google = {\n source = \"hashicorp/google\"\n }\n }\n}\n\nresource \"google_compute_instance\" \"dev\" {\n zone = module.gcp_region.value\n count = data.coder_workspace.me.start_count\n name = \"coder-${lower(data.coder_workspace_owner.me.name)}-${lower(data.coder_workspace.me.name)}-root\"\n machine_type = \"e2-medium\"\n network_interface {\n network = \"default\"\n access_config {\n // Ephemeral public IP\n }\n }\n boot_disk {\n auto_delete = false\n source = google_compute_disk.root.name\n }\n // In order to use google-instance-identity, a service account *must* be provided.\n service_account {\n email = data.google_compute_default_service_account.default.email\n scopes = [\"cloud-platform\"]\n }\n # ONLY FOR WINDOWS:\n # metadata = {\n # windows-startup-script-ps1 = coder_agent.main.init_script\n # }\n # The startup script runs as root with no $HOME environment set up, so instead of directly\n # running the agent init script, create a user (with a homedir, default shell and sudo\n # permissions) and execute the init script as that user.\n #\n # The agent MUST be started in here.\n metadata_startup_script = </dev/null 2>&1; then\n useradd -m -s /bin/bash \"${local.linux_user}\"\n echo \"${local.linux_user} ALL=(ALL) NOPASSWD:ALL\" > /etc/sudoers.d/coder-user\nfi\n\nexec sudo -u \"${local.linux_user}\" sh -c '${coder_agent.main.init_script}'\nEOMETA\n}\n\n\n\n// The agent is configured with \"azure-instance-identity\" auth.\nterraform {\n required_providers {\n azurerm = {\n source = \"hashicorp/azurerm\"\n }\n cloudinit = {\n source = \"hashicorp/cloudinit\"\n }\n }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n gzip = false\n base64_encode = true\n\n boundary = \"//\"\n\n part {\n filename = \"cloud-config.yaml\"\n content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t// - [scripts-user, always]\n\t// bootcmd:\n\t// # work around https://github.com/hashicorp/terraform-provider-azurerm/issues/6117\n\t// - until [ -e /dev/disk/azure/scsi1/lun10 ]; do sleep 1; done\n\t// device_aliases:\n\t// homedir: /dev/disk/azure/scsi1/lun10\n\t// disk_setup:\n\t// homedir:\n\t// table_type: gpt\n\t// layout: true\n\t// fs_setup:\n\t// - label: coder_home\n\t// filesystem: ext4\n\t// device: homedir.1\n\t// mounts:\n\t// - [\"LABEL=coder_home\", \"/home/${username}\"]\n\t// hostname: ${hostname}\n\t// users:\n\t// - name: ${username}\n\t// sudo: [\"ALL=(ALL) NOPASSWD:ALL\"]\n\t// groups: sudo\n\t// shell: /bin/bash\n\t// packages:\n\t// - git\n\t// write_files:\n\t// - path: /opt/coder/init\n\t// permissions: \"0755\"\n\t// encoding: b64\n\t// content: ${init_script}\n\t// - path: /etc/systemd/system/coder-agent.service\n\t// permissions: \"0644\"\n\t// content: |\n\t// [Unit]\n\t// Description=Coder Agent\n\t// After=network-online.target\n\t// Wants=network-online.target\n\n\t// [Service]\n\t// User=${username}\n\t// ExecStart=/opt/coder/init\n\t// Restart=always\n\t// RestartSec=10\n\t// TimeoutStopSec=90\n\t// KillMode=process\n\n\t// OOMScoreAdjust=-900\n\t// SyslogIdentifier=coder-agent\n\n\t// [Install]\n\t// WantedBy=multi-user.target\n\t// runcmd:\n\t// - chown ${username}:${username} /home/${username}\n\t// - systemctl enable coder-agent\n\t// - systemctl start coder-agent\n content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n username = \"coder\" # Ensure this user/group does not exist in your VM image\n init_script = base64encode(coder_agent.main.init_script)\n hostname = lower(data.coder_workspace.me.name)\n })\n }\n}\n\nresource \"azurerm_linux_virtual_machine\" \"main\" {\n count = data.coder_workspace.me.start_count\n name = \"vm\"\n resource_group_name = azurerm_resource_group.main.name\n location = azurerm_resource_group.main.location\n size = data.coder_parameter.instance_type.value\n // cloud-init overwrites this, so the value here doesn't matter\n admin_username = \"adminuser\"\n admin_ssh_key {\n public_key = tls_private_key.dummy.public_key_openssh\n username = \"adminuser\"\n }\n\n network_interface_ids = [\n azurerm_network_interface.main.id,\n ]\n computer_name = lower(data.coder_workspace.me.name)\n os_disk {\n caching = \"ReadWrite\"\n storage_account_type = \"Standard_LRS\"\n }\n source_image_reference {\n publisher = \"Canonical\"\n offer = \"0001-com-ubuntu-server-focal\"\n sku = \"20_04-lts-gen2\"\n version = \"latest\"\n }\n user_data = data.cloudinit_config.user_data.rendered\n}\n\n\n\nterraform {\n required_providers {\n coder = {\n source = \"kreuzwerker/docker\"\n }\n }\n}\n\n// The agent is configured with \"token\" auth.\n\nresource \"docker_container\" \"workspace\" {\n count = data.coder_workspace.me.start_count\n image = \"codercom/enterprise-base:ubuntu\"\n # Uses lower() to avoid Docker restriction on container names.\n name = \"coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}\"\n # Hostname makes the shell more user friendly: coder@my-workspace:~$\n hostname = data.coder_workspace.me.name\n # Use the docker gateway if the access URL is 127.0.0.1.\n entrypoint = [\"sh\", \"-c\", replace(coder_agent.main.init_script, \"/localhost|127\\\\.0\\\\.0\\\\.1/\", \"host.docker.internal\")]\n env = [\"CODER_AGENT_TOKEN=${coder_agent.main.token}\"]\n host {\n host = \"host.docker.internal\"\n ip = \"host-gateway\"\n }\n volumes {\n container_path = \"/home/coder\"\n volume_name = docker_volume.home_volume.name\n read_only = false\n }\n}\n\n\n\n// The agent is configured with \"token\" auth.\n\nresource \"kubernetes_deployment\" \"main\" {\n count = data.coder_workspace.me.start_count\n depends_on = [\n kubernetes_persistent_volume_claim.home\n ]\n wait_for_rollout = false\n metadata {\n name = \"coder-${data.coder_workspace.me.id}\"\n }\n\n spec {\n replicas = 1\n strategy {\n type = \"Recreate\"\n }\n\n template {\n spec {\n security_context {\n run_as_user = 1000\n fs_group = 1000\n run_as_non_root = true\n }\n\n container {\n name = \"dev\"\n image = \"codercom/enterprise-base:ubuntu\"\n image_pull_policy = \"Always\"\n command = [\"sh\", \"-c\", coder_agent.main.init_script]\n security_context {\n run_as_user = \"1000\"\n }\n env {\n name = \"CODER_AGENT_TOKEN\"\n value = coder_agent.main.token\n }\n }\n }\n }\n }\n}\n\n\nThe file_id provided is a reference to a tar file you have uploaded containing the Terraform.\n","name":"bmcp_coder_coder_create_template_version","parameters":{"properties":{"file_id":{"type":"string"},"template_id":{"type":"string"}},"required":["file_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace in Coder.\n\nIf a user is asking to \"test a template\", they are typically referring\nto creating a workspace from a template to ensure the infrastructure\nis provisioned correctly and the agent can connect to the control plane.\n\nBefore creating a workspace, always confirm the template choice with the user by:\n\n\t1. Listing the available templates that match their request.\n\t2. Recommending the most relevant option.\n\t2. Asking the user to confirm which template to use.\n\nIt is important to not create a workspace without confirming the template\nchoice with the user.\n\nAfter creating a workspace, watch the build logs and wait for the workspace to\nbe ready before trying to use or connect to the workspace.\n","name":"bmcp_coder_coder_create_workspace","parameters":{"properties":{"name":{"description":"Name of the workspace to create.","type":"string"},"rich_parameters":{"description":"Key/value pairs of rich parameters to pass to the template version to create the workspace.","type":"object"},"template_version_id":{"description":"ID of the template version to create the workspace from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a workspace. Omit or use the `me` keyword to create a workspace for the authenticated user.","type":"string"}},"required":["user","template_version_id","name","rich_parameters"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace build for an existing workspace. Use this to start, stop, or delete.\n\nAfter creating a workspace build, watch the build logs and wait for the\nworkspace build to complete before trying to start another build or use or\nconnect to the workspace.\n","name":"bmcp_coder_coder_create_workspace_build","parameters":{"properties":{"template_version_id":{"description":"(Optional) The template version ID to use for the workspace build. If not provided, the previously built version will be used.","type":"string"},"transition":{"description":"The transition to perform. Must be one of: start, stop, delete","enum":["start","stop","delete"],"type":"string"},"workspace_id":{"type":"string"}},"required":["workspace_id","transition"],"type":"object"},"strict":false},{"type":"function","description":"Delete a task.","name":"bmcp_coder_coder_delete_task","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to delete. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Delete a template. This is irreversible.","name":"bmcp_coder_coder_delete_template","parameters":{"properties":{"template_id":{"type":"string"}},"required":["template_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the currently authenticated user, similar to the `whoami` command.","name":"bmcp_coder_coder_get_authenticated_user","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a task.","name":"bmcp_coder_coder_get_task_logs","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to query. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the status of a task.","name":"bmcp_coder_coder_get_task_status","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to get. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a template version. This is useful to check whether a template version successfully imports or not.","name":"bmcp_coder_coder_get_template_version_logs","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Get a workspace by name or ID.\n\nThis returns more data than list_workspaces to reduce token usage.","name":"bmcp_coder_coder_get_workspace","parameters":{"properties":{"workspace_id":{"description":"The workspace ID or name in the format [owner/]workspace. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace agent.\n\n\t\tMore logs may appear after this call. It does not wait for the agent to finish.","name":"bmcp_coder_coder_get_workspace_agent_logs","parameters":{"properties":{"workspace_agent_id":{"type":"string"}},"required":["workspace_agent_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace build.\n\n\t\tUseful for checking whether a workspace builds successfully or not.","name":"bmcp_coder_coder_get_workspace_build_logs","parameters":{"properties":{"workspace_build_id":{"type":"string"}},"required":["workspace_build_id"],"type":"object"},"strict":false},{"type":"function","description":"List tasks.","name":"bmcp_coder_coder_list_tasks","parameters":{"properties":{"status":{"description":"Optional filter by task status.","type":"string"},"user":{"description":"Username or ID of the user for which to list tasks. Omit or use the `me` keyword to list tasks for the authenticated user.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Lists templates for the authenticated user.","name":"bmcp_coder_coder_list_templates","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Lists workspaces for the authenticated user.","name":"bmcp_coder_coder_list_workspaces","parameters":{"properties":{"owner":{"description":"The owner of the workspaces to list. Use \"me\" to list workspaces for the authenticated user. If you do not specify an owner, \"me\" will be assumed by default.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Send input to a running task.","name":"bmcp_coder_coder_send_task_input","parameters":{"properties":{"input":{"description":"The input to send to the task.","type":"string"},"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to prompt. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id","input"],"type":"object"},"strict":false},{"type":"function","description":"Get the parameters for a template version. You can refer to these as workspace parameters to the user, as they are typically important for creating a workspace.","name":"bmcp_coder_coder_template_version_parameters","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Update the active version of a template. This is helpful when iterating on templates.","name":"bmcp_coder_coder_update_template_active_version","parameters":{"properties":{"template_id":{"type":"string"},"template_version_id":{"type":"string"}},"required":["template_id","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create and upload a tar file by key/value mapping of file names to file contents. Use this to create template versions. Reference the tool description of \"create_template_version\" to understand template requirements.","name":"bmcp_coder_coder_upload_tar_file","parameters":{"properties":{"files":{"description":"A map of file names to file contents.","type":"object"}},"required":["files"],"type":"object"},"strict":false},{"type":"function","description":"Execute a bash command in a Coder workspace.\n\nThis tool provides the same functionality as the 'coder ssh ' CLI command.\nIt automatically starts the workspace if it's stopped and waits for the agent to be ready.\nThe output is trimmed of leading and trailing whitespace.\n\nThe workspace parameter supports various formats:\n- workspace (uses current user)\n- owner/workspace\n- owner--workspace\n- workspace.agent (specific agent)\n- owner/workspace.agent\n\nThe timeout_ms parameter specifies the command timeout in milliseconds (defaults to 60000ms, maximum of 300000ms).\nIf the command times out, all output captured up to that point is returned with a cancellation message.\n\nFor background commands (background: true), output is captured until the timeout is reached, then the command\ncontinues running in the background. The captured output is returned as the result.\n\nFor file operations (list, write, edit), always prefer the dedicated file tools.\nDo not use bash commands (ls, cat, echo, heredoc, etc.) to list, write, or read\nfiles when the file tools are available. The bash tool should be used for:\n\n\t- Running commands and scripts\n\t- Installing packages\n\t- Starting services\n\t- Executing programs\n\nExamples:\n- workspace: \"john/dev-env\", command: \"git status\", timeout_ms: 30000\n- workspace: \"my-workspace\", command: \"npm run dev\", background: true, timeout_ms: 10000\n- workspace: \"my-workspace.main\", command: \"docker ps\"","name":"bmcp_coder_coder_workspace_bash","parameters":{"properties":{"background":{"description":"Whether to run the command in the background. Output is captured until timeout, then the command continues running in the background.","type":"boolean"},"command":{"description":"The bash command to execute in the workspace.","type":"string"},"timeout_ms":{"default":60000,"description":"Command timeout in milliseconds. Defaults to 60000ms (60 seconds) if not specified.","minimum":1,"type":"integer"},"workspace":{"description":"The workspace name in format [owner/]workspace[.agent]. If owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","command"],"type":"object"},"strict":false},{"type":"function","description":"Edit a file in a workspace.","name":"bmcp_coder_coder_workspace_edit_file","parameters":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","edits"],"type":"object"},"strict":false},{"type":"function","description":"Edit one or more files in a workspace.","name":"bmcp_coder_coder_workspace_edit_files","parameters":{"properties":{"files":{"description":"An array of files to edit.","items":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"}},"required":["path","edits"],"type":"object"},"type":"array"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","files"],"type":"object"},"strict":false},{"type":"function","description":"List the URLs of Coder apps running in a workspace for a single agent.","name":"bmcp_coder_coder_workspace_list_apps","parameters":{"properties":{"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace"],"type":"object"},"strict":false},{"type":"function","description":"List directories in a workspace.","name":"bmcp_coder_coder_workspace_ls","parameters":{"properties":{"path":{"description":"The absolute path of the directory in the workspace to list.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Fetch URLs that forward to the specified port.","name":"bmcp_coder_coder_workspace_port_forward","parameters":{"properties":{"port":{"description":"The port to forward.","type":"number"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","port"],"type":"object"},"strict":false},{"type":"function","description":"Read from a file in a workspace.","name":"bmcp_coder_coder_workspace_read_file","parameters":{"properties":{"limit":{"description":"The number of bytes to read. Cannot exceed 1 MiB. Defaults to the full size of the file or 1 MiB, whichever is lower.","type":"integer"},"offset":{"description":"A byte offset indicating where in the file to start reading. Defaults to zero. An empty string indicates the end of the file has been reached.","type":"integer"},"path":{"description":"The absolute path of the file to read in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Write a file in a workspace.\n\nIf a file write fails due to syntax errors or encoding issues, do NOT switch\nto using bash commands as a workaround. Instead:\n\n\t1. Read the error message carefully to identify the issue\n\t2. Fix the content encoding/syntax\n\t3. Retry with this tool\n\nThe content parameter expects base64-encoded bytes. Ensure your source content\nis correct before encoding it. If you encounter errors, decode and verify the\ncontent you are trying to write, then re-encode it properly.\n","name":"bmcp_coder_coder_workspace_write_file","parameters":{"properties":{"content":{"description":"The base64-encoded bytes to write to the file.","type":"string"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","content"],"type":"object"},"strict":false}],"top_logprobs":0,"top_p":1.0,"truncation":"disabled","usage":{"input_tokens":6280,"input_tokens_details":{"cached_tokens":100,"cache_write_tokens":5},"output_tokens":30,"output_tokens_details":{"reasoning_tokens":3},"total_tokens":6310},"user":null,"metadata":{}},"sequence_number":17} -- streaming/tool-call -- @@ -246,5 +246,5 @@ event: response.output_item.done data: {"type":"response.output_item.done","item":{"id":"msg_0dfed48e1052ad7f0069725ca4c2488193a652eba330c51e5b","type":"message","status":"completed","content":[{"type":"output_text","annotations":[],"logprobs":[],"text":"The workspace ID you provided ('non_existing_id') is not valid. Workspace IDs must be valid UUIDs (typically 36 characters long). Please provide a valid workspace ID to create a new workspace build. If you need help finding your workspace ID, let me know!"}],"role":"assistant"},"output_index":0,"sequence_number":60} event: response.completed -data: {"type":"response.completed","response":{"id":"resp_0dfed48e1052ad7f0069725ca39880819390fcc5b2eb8cf8c6","object":"response","created_at":1769102499,"status":"completed","background":false,"completed_at":1769102501,"error":null,"frequency_penalty":0.0,"incomplete_details":null,"instructions":null,"max_output_tokens":null,"max_tool_calls":null,"model":"gpt-4.1-2025-04-14","output":[{"id":"msg_0dfed48e1052ad7f0069725ca4c2488193a652eba330c51e5b","type":"message","status":"completed","content":[{"type":"output_text","annotations":[],"logprobs":[],"text":"The workspace ID you provided ('non_existing_id') is not valid. Workspace IDs must be valid UUIDs (typically 36 characters long). Please provide a valid workspace ID to create a new workspace build. If you need help finding your workspace ID, let me know!"}],"role":"assistant"}],"parallel_tool_calls":false,"presence_penalty":0.0,"previous_response_id":null,"prompt_cache_key":null,"prompt_cache_retention":null,"reasoning":{"effort":null,"summary":null},"safety_identifier":null,"service_tier":"default","store":true,"temperature":1.0,"text":{"format":{"type":"text"},"verbosity":"medium"},"tool_choice":"auto","tools":[{"type":"function","description":"Create a task.","name":"bmcp_coder_coder_create_task","parameters":{"properties":{"input":{"description":"Input/prompt for the task.","type":"string"},"template_version_id":{"description":"ID of the template version to create the task from.","type":"string"},"template_version_preset_id":{"description":"Optional ID of the template version preset to create the task from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a task. Omit or use the `me` keyword to create a task for the authenticated user.","type":"string"}},"required":["input","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template in Coder. First, you must create a template version.","name":"bmcp_coder_coder_create_template","parameters":{"properties":{"description":{"type":"string"},"display_name":{"type":"string"},"icon":{"description":"A URL to an icon to use.","type":"string"},"name":{"type":"string"},"version_id":{"description":"The ID of the version to use.","type":"string"}},"required":["name","display_name","description","version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template version. This is a precursor to creating a template, or you can update an existing template.\n\nTemplates are Terraform defining a development environment. The provisioned infrastructure must run\nan Agent that connects to the Coder Control Plane to provide a rich experience.\n\nHere are some strict rules for creating a template version:\n- YOU MUST NOT use \"variable\" or \"output\" blocks in the Terraform code.\n- YOU MUST ALWAYS check template version logs after creation to ensure the template was imported successfully.\n\nWhen a template version is created, a Terraform Plan occurs that ensures the infrastructure\n_could_ be provisioned, but actual provisioning occurs when a workspace is created.\n\n\nThe Coder Terraform Provider can be imported like:\n\n```hcl\nterraform {\n required_providers {\n coder = {\n source = \"coder/coder\"\n }\n }\n}\n```\n\nA destroy does not occur when a user stops a workspace, but rather the transition changes:\n\n```hcl\ndata \"coder_workspace\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace.\n- name: The name of the workspace.\n- transition: Either \"start\" or \"stop\".\n- start_count: A computed count based on the transition field. If \"start\", this will be 1.\n\nAccess workspace owner information with:\n\n```hcl\ndata \"coder_workspace_owner\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace owner.\n- name: The name of the workspace owner.\n- full_name: The full name of the workspace owner.\n- email: The email of the workspace owner.\n- session_token: A token that can be used to authenticate the workspace owner. It is regenerated every time the workspace is started.\n- oidc_access_token: A valid OpenID Connect access token of the workspace owner. This is only available if the workspace owner authenticated with OpenID Connect. If a valid token cannot be obtained, this value will be an empty string.\n\nParameters are defined in the template version. They are rendered in the UI on the workspace creation page:\n\n```hcl\nresource \"coder_parameter\" \"region\" {\n name = \"region\"\n type = \"string\"\n default = \"us-east-1\"\n}\n```\n\nThis resource accepts the following properties:\n- name: The name of the parameter.\n- default: The default value of the parameter.\n- type: The type of the parameter. Must be one of: \"string\", \"number\", \"bool\", or \"list(string)\".\n- display_name: The displayed name of the parameter as it will appear in the UI.\n- description: The description of the parameter as it will appear in the UI.\n- ephemeral: The value of an ephemeral parameter will not be preserved between consecutive workspace builds.\n- form_type: The type of this parameter. Must be one of: [radio, slider, input, dropdown, checkbox, switch, multi-select, tag-select, textarea, error].\n- icon: A URL to an icon to display in the UI.\n- mutable: Whether this value can be changed after workspace creation. This can be destructive for values like region, so use with caution!\n- option: Each option block defines a value for a user to select from. (see below for nested schema)\n Required:\n - name: The name of the option.\n - value: The value of the option.\n Optional:\n - description: The description of the option as it will appear in the UI.\n - icon: A URL to an icon to display in the UI.\n\nA Workspace Agent runs on provisioned infrastructure to provide access to the workspace:\n\n```hcl\nresource \"coder_agent\" \"dev\" {\n arch = \"amd64\"\n os = \"linux\"\n}\n```\n\nThis resource accepts the following properties:\n- arch: The architecture of the agent. Must be one of: \"amd64\", \"arm64\", or \"armv7\".\n- os: The operating system of the agent. Must be one of: \"linux\", \"windows\", or \"darwin\".\n- auth: The authentication method for the agent. Must be one of: \"token\", \"google-instance-identity\", \"aws-instance-identity\", or \"azure-instance-identity\". It is insecure to pass the agent token via exposed variables to Virtual Machines. Instance Identity enables provisioned VMs to authenticate by instance ID on start.\n- dir: The starting directory when a user creates a shell session. Defaults to \"$HOME\".\n- env: A map of environment variables to set for the agent.\n- startup_script: A script to run after the agent starts. This script MUST exit eventually to signal that startup has completed. Use \"&\" or \"screen\" to run processes in the background.\n\nThis resource provides the following fields:\n- id: The UUID of the agent.\n- init_script: The script to run on provisioned infrastructure to fetch and start the agent.\n- token: Set the environment variable CODER_AGENT_TOKEN to this value to authenticate the agent.\n\nThe agent MUST be installed and started using the init_script. A utility like curl or wget to fetch the agent binary must exist in the provisioned infrastructure.\n\nExpose terminal or HTTP applications running in a workspace with:\n\n```hcl\nresource \"coder_app\" \"dev\" {\n agent_id = coder_agent.dev.id\n slug = \"my-app-name\"\n display_name = \"My App\"\n icon = \"https://my-app.com/icon.svg\"\n url = \"http://127.0.0.1:3000\"\n}\n```\n\nThis resource accepts the following properties:\n- agent_id: The ID of the agent to attach the app to.\n- slug: The slug of the app.\n- display_name: The displayed name of the app as it will appear in the UI.\n- icon: A URL to an icon to display in the UI.\n- url: An external url if external=true or a URL to be proxied to from inside the workspace. This should be of the form http://localhost:PORT[/SUBPATH]. Either command or url may be specified, but not both.\n- command: A command to run in a terminal opening this app. In the web, this will open in a new tab. In the CLI, this will SSH and execute the command. Either command or url may be specified, but not both.\n- external: Whether this app is an external app. If true, the url will be opened in a new tab.\n\n\nThe Coder Server may not be authenticated with the infrastructure provider a user requests. In this scenario,\nthe user will need to provide credentials to the Coder Server before the workspace can be provisioned.\n\nHere are examples of provisioning the Coder Agent on specific infrastructure providers:\n\n\n// The agent is configured with \"aws-instance-identity\" auth.\nterraform {\n required_providers {\n cloudinit = {\n source = \"hashicorp/cloudinit\"\n }\n aws = {\n source = \"hashicorp/aws\"\n }\n }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n gzip = false\n base64_encode = false\n boundary = \"//\"\n part {\n filename = \"cloud-config.yaml\"\n content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t// - [scripts-user, always]\n\t// hostname: ${hostname}\n\t// users:\n\t// - name: ${linux_user}\n\t// sudo: ALL=(ALL) NOPASSWD:ALL\n\t// shell: /bin/bash\n content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n hostname = local.hostname\n linux_user = local.linux_user\n })\n }\n\n part {\n filename = \"userdata.sh\"\n content_type = \"text/x-shellscript\"\n\n\t// Here is the content of the userdata.sh.tftpl file:\n\t// #!/bin/bash\n\t// sudo -u '${linux_user}' sh -c '${init_script}'\n content = templatefile(\"${path.module}/cloud-init/userdata.sh.tftpl\", {\n linux_user = local.linux_user\n\n init_script = try(coder_agent.dev[0].init_script, \"\")\n })\n }\n}\n\nresource \"aws_instance\" \"dev\" {\n ami = data.aws_ami.ubuntu.id\n availability_zone = \"${data.coder_parameter.region.value}a\"\n instance_type = data.coder_parameter.instance_type.value\n\n user_data = data.cloudinit_config.user_data.rendered\n tags = {\n Name = \"coder-${data.coder_workspace_owner.me.name}-${data.coder_workspace.me.name}\"\n }\n lifecycle {\n ignore_changes = [ami]\n }\n}\n\n\n\n// The agent is configured with \"google-instance-identity\" auth.\nterraform {\n required_providers {\n google = {\n source = \"hashicorp/google\"\n }\n }\n}\n\nresource \"google_compute_instance\" \"dev\" {\n zone = module.gcp_region.value\n count = data.coder_workspace.me.start_count\n name = \"coder-${lower(data.coder_workspace_owner.me.name)}-${lower(data.coder_workspace.me.name)}-root\"\n machine_type = \"e2-medium\"\n network_interface {\n network = \"default\"\n access_config {\n // Ephemeral public IP\n }\n }\n boot_disk {\n auto_delete = false\n source = google_compute_disk.root.name\n }\n // In order to use google-instance-identity, a service account *must* be provided.\n service_account {\n email = data.google_compute_default_service_account.default.email\n scopes = [\"cloud-platform\"]\n }\n # ONLY FOR WINDOWS:\n # metadata = {\n # windows-startup-script-ps1 = coder_agent.main.init_script\n # }\n # The startup script runs as root with no $HOME environment set up, so instead of directly\n # running the agent init script, create a user (with a homedir, default shell and sudo\n # permissions) and execute the init script as that user.\n #\n # The agent MUST be started in here.\n metadata_startup_script = </dev/null 2>&1; then\n useradd -m -s /bin/bash \"${local.linux_user}\"\n echo \"${local.linux_user} ALL=(ALL) NOPASSWD:ALL\" > /etc/sudoers.d/coder-user\nfi\n\nexec sudo -u \"${local.linux_user}\" sh -c '${coder_agent.main.init_script}'\nEOMETA\n}\n\n\n\n// The agent is configured with \"azure-instance-identity\" auth.\nterraform {\n required_providers {\n azurerm = {\n source = \"hashicorp/azurerm\"\n }\n cloudinit = {\n source = \"hashicorp/cloudinit\"\n }\n }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n gzip = false\n base64_encode = true\n\n boundary = \"//\"\n\n part {\n filename = \"cloud-config.yaml\"\n content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t// - [scripts-user, always]\n\t// bootcmd:\n\t// # work around https://github.com/hashicorp/terraform-provider-azurerm/issues/6117\n\t// - until [ -e /dev/disk/azure/scsi1/lun10 ]; do sleep 1; done\n\t// device_aliases:\n\t// homedir: /dev/disk/azure/scsi1/lun10\n\t// disk_setup:\n\t// homedir:\n\t// table_type: gpt\n\t// layout: true\n\t// fs_setup:\n\t// - label: coder_home\n\t// filesystem: ext4\n\t// device: homedir.1\n\t// mounts:\n\t// - [\"LABEL=coder_home\", \"/home/${username}\"]\n\t// hostname: ${hostname}\n\t// users:\n\t// - name: ${username}\n\t// sudo: [\"ALL=(ALL) NOPASSWD:ALL\"]\n\t// groups: sudo\n\t// shell: /bin/bash\n\t// packages:\n\t// - git\n\t// write_files:\n\t// - path: /opt/coder/init\n\t// permissions: \"0755\"\n\t// encoding: b64\n\t// content: ${init_script}\n\t// - path: /etc/systemd/system/coder-agent.service\n\t// permissions: \"0644\"\n\t// content: |\n\t// [Unit]\n\t// Description=Coder Agent\n\t// After=network-online.target\n\t// Wants=network-online.target\n\n\t// [Service]\n\t// User=${username}\n\t// ExecStart=/opt/coder/init\n\t// Restart=always\n\t// RestartSec=10\n\t// TimeoutStopSec=90\n\t// KillMode=process\n\n\t// OOMScoreAdjust=-900\n\t// SyslogIdentifier=coder-agent\n\n\t// [Install]\n\t// WantedBy=multi-user.target\n\t// runcmd:\n\t// - chown ${username}:${username} /home/${username}\n\t// - systemctl enable coder-agent\n\t// - systemctl start coder-agent\n content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n username = \"coder\" # Ensure this user/group does not exist in your VM image\n init_script = base64encode(coder_agent.main.init_script)\n hostname = lower(data.coder_workspace.me.name)\n })\n }\n}\n\nresource \"azurerm_linux_virtual_machine\" \"main\" {\n count = data.coder_workspace.me.start_count\n name = \"vm\"\n resource_group_name = azurerm_resource_group.main.name\n location = azurerm_resource_group.main.location\n size = data.coder_parameter.instance_type.value\n // cloud-init overwrites this, so the value here doesn't matter\n admin_username = \"adminuser\"\n admin_ssh_key {\n public_key = tls_private_key.dummy.public_key_openssh\n username = \"adminuser\"\n }\n\n network_interface_ids = [\n azurerm_network_interface.main.id,\n ]\n computer_name = lower(data.coder_workspace.me.name)\n os_disk {\n caching = \"ReadWrite\"\n storage_account_type = \"Standard_LRS\"\n }\n source_image_reference {\n publisher = \"Canonical\"\n offer = \"0001-com-ubuntu-server-focal\"\n sku = \"20_04-lts-gen2\"\n version = \"latest\"\n }\n user_data = data.cloudinit_config.user_data.rendered\n}\n\n\n\nterraform {\n required_providers {\n coder = {\n source = \"kreuzwerker/docker\"\n }\n }\n}\n\n// The agent is configured with \"token\" auth.\n\nresource \"docker_container\" \"workspace\" {\n count = data.coder_workspace.me.start_count\n image = \"codercom/enterprise-base:ubuntu\"\n # Uses lower() to avoid Docker restriction on container names.\n name = \"coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}\"\n # Hostname makes the shell more user friendly: coder@my-workspace:~$\n hostname = data.coder_workspace.me.name\n # Use the docker gateway if the access URL is 127.0.0.1.\n entrypoint = [\"sh\", \"-c\", replace(coder_agent.main.init_script, \"/localhost|127\\\\.0\\\\.0\\\\.1/\", \"host.docker.internal\")]\n env = [\"CODER_AGENT_TOKEN=${coder_agent.main.token}\"]\n host {\n host = \"host.docker.internal\"\n ip = \"host-gateway\"\n }\n volumes {\n container_path = \"/home/coder\"\n volume_name = docker_volume.home_volume.name\n read_only = false\n }\n}\n\n\n\n// The agent is configured with \"token\" auth.\n\nresource \"kubernetes_deployment\" \"main\" {\n count = data.coder_workspace.me.start_count\n depends_on = [\n kubernetes_persistent_volume_claim.home\n ]\n wait_for_rollout = false\n metadata {\n name = \"coder-${data.coder_workspace.me.id}\"\n }\n\n spec {\n replicas = 1\n strategy {\n type = \"Recreate\"\n }\n\n template {\n spec {\n security_context {\n run_as_user = 1000\n fs_group = 1000\n run_as_non_root = true\n }\n\n container {\n name = \"dev\"\n image = \"codercom/enterprise-base:ubuntu\"\n image_pull_policy = \"Always\"\n command = [\"sh\", \"-c\", coder_agent.main.init_script]\n security_context {\n run_as_user = \"1000\"\n }\n env {\n name = \"CODER_AGENT_TOKEN\"\n value = coder_agent.main.token\n }\n }\n }\n }\n }\n}\n\n\nThe file_id provided is a reference to a tar file you have uploaded containing the Terraform.\n","name":"bmcp_coder_coder_create_template_version","parameters":{"properties":{"file_id":{"type":"string"},"template_id":{"type":"string"}},"required":["file_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace in Coder.\n\nIf a user is asking to \"test a template\", they are typically referring\nto creating a workspace from a template to ensure the infrastructure\nis provisioned correctly and the agent can connect to the control plane.\n\nBefore creating a workspace, always confirm the template choice with the user by:\n\n\t1. Listing the available templates that match their request.\n\t2. Recommending the most relevant option.\n\t2. Asking the user to confirm which template to use.\n\nIt is important to not create a workspace without confirming the template\nchoice with the user.\n\nAfter creating a workspace, watch the build logs and wait for the workspace to\nbe ready before trying to use or connect to the workspace.\n","name":"bmcp_coder_coder_create_workspace","parameters":{"properties":{"name":{"description":"Name of the workspace to create.","type":"string"},"rich_parameters":{"description":"Key/value pairs of rich parameters to pass to the template version to create the workspace.","type":"object"},"template_version_id":{"description":"ID of the template version to create the workspace from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a workspace. Omit or use the `me` keyword to create a workspace for the authenticated user.","type":"string"}},"required":["user","template_version_id","name","rich_parameters"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace build for an existing workspace. Use this to start, stop, or delete.\n\nAfter creating a workspace build, watch the build logs and wait for the\nworkspace build to complete before trying to start another build or use or\nconnect to the workspace.\n","name":"bmcp_coder_coder_create_workspace_build","parameters":{"properties":{"template_version_id":{"description":"(Optional) The template version ID to use for the workspace build. If not provided, the previously built version will be used.","type":"string"},"transition":{"description":"The transition to perform. Must be one of: start, stop, delete","enum":["start","stop","delete"],"type":"string"},"workspace_id":{"type":"string"}},"required":["workspace_id","transition"],"type":"object"},"strict":false},{"type":"function","description":"Delete a task.","name":"bmcp_coder_coder_delete_task","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to delete. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Delete a template. This is irreversible.","name":"bmcp_coder_coder_delete_template","parameters":{"properties":{"template_id":{"type":"string"}},"required":["template_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the currently authenticated user, similar to the `whoami` command.","name":"bmcp_coder_coder_get_authenticated_user","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a task.","name":"bmcp_coder_coder_get_task_logs","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to query. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the status of a task.","name":"bmcp_coder_coder_get_task_status","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to get. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a template version. This is useful to check whether a template version successfully imports or not.","name":"bmcp_coder_coder_get_template_version_logs","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Get a workspace by name or ID.\n\nThis returns more data than list_workspaces to reduce token usage.","name":"bmcp_coder_coder_get_workspace","parameters":{"properties":{"workspace_id":{"description":"The workspace ID or name in the format [owner/]workspace. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace agent.\n\n\t\tMore logs may appear after this call. It does not wait for the agent to finish.","name":"bmcp_coder_coder_get_workspace_agent_logs","parameters":{"properties":{"workspace_agent_id":{"type":"string"}},"required":["workspace_agent_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace build.\n\n\t\tUseful for checking whether a workspace builds successfully or not.","name":"bmcp_coder_coder_get_workspace_build_logs","parameters":{"properties":{"workspace_build_id":{"type":"string"}},"required":["workspace_build_id"],"type":"object"},"strict":false},{"type":"function","description":"List tasks.","name":"bmcp_coder_coder_list_tasks","parameters":{"properties":{"status":{"description":"Optional filter by task status.","type":"string"},"user":{"description":"Username or ID of the user for which to list tasks. Omit or use the `me` keyword to list tasks for the authenticated user.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Lists templates for the authenticated user.","name":"bmcp_coder_coder_list_templates","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Lists workspaces for the authenticated user.","name":"bmcp_coder_coder_list_workspaces","parameters":{"properties":{"owner":{"description":"The owner of the workspaces to list. Use \"me\" to list workspaces for the authenticated user. If you do not specify an owner, \"me\" will be assumed by default.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Send input to a running task.","name":"bmcp_coder_coder_send_task_input","parameters":{"properties":{"input":{"description":"The input to send to the task.","type":"string"},"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to prompt. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id","input"],"type":"object"},"strict":false},{"type":"function","description":"Get the parameters for a template version. You can refer to these as workspace parameters to the user, as they are typically important for creating a workspace.","name":"bmcp_coder_coder_template_version_parameters","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Update the active version of a template. This is helpful when iterating on templates.","name":"bmcp_coder_coder_update_template_active_version","parameters":{"properties":{"template_id":{"type":"string"},"template_version_id":{"type":"string"}},"required":["template_id","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create and upload a tar file by key/value mapping of file names to file contents. Use this to create template versions. Reference the tool description of \"create_template_version\" to understand template requirements.","name":"bmcp_coder_coder_upload_tar_file","parameters":{"properties":{"files":{"description":"A map of file names to file contents.","type":"object"}},"required":["files"],"type":"object"},"strict":false},{"type":"function","description":"Execute a bash command in a Coder workspace.\n\nThis tool provides the same functionality as the 'coder ssh ' CLI command.\nIt automatically starts the workspace if it's stopped and waits for the agent to be ready.\nThe output is trimmed of leading and trailing whitespace.\n\nThe workspace parameter supports various formats:\n- workspace (uses current user)\n- owner/workspace\n- owner--workspace\n- workspace.agent (specific agent)\n- owner/workspace.agent\n\nThe timeout_ms parameter specifies the command timeout in milliseconds (defaults to 60000ms, maximum of 300000ms).\nIf the command times out, all output captured up to that point is returned with a cancellation message.\n\nFor background commands (background: true), output is captured until the timeout is reached, then the command\ncontinues running in the background. The captured output is returned as the result.\n\nFor file operations (list, write, edit), always prefer the dedicated file tools.\nDo not use bash commands (ls, cat, echo, heredoc, etc.) to list, write, or read\nfiles when the file tools are available. The bash tool should be used for:\n\n\t- Running commands and scripts\n\t- Installing packages\n\t- Starting services\n\t- Executing programs\n\nExamples:\n- workspace: \"john/dev-env\", command: \"git status\", timeout_ms: 30000\n- workspace: \"my-workspace\", command: \"npm run dev\", background: true, timeout_ms: 10000\n- workspace: \"my-workspace.main\", command: \"docker ps\"","name":"bmcp_coder_coder_workspace_bash","parameters":{"properties":{"background":{"description":"Whether to run the command in the background. Output is captured until timeout, then the command continues running in the background.","type":"boolean"},"command":{"description":"The bash command to execute in the workspace.","type":"string"},"timeout_ms":{"default":60000,"description":"Command timeout in milliseconds. Defaults to 60000ms (60 seconds) if not specified.","minimum":1,"type":"integer"},"workspace":{"description":"The workspace name in format [owner/]workspace[.agent]. If owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","command"],"type":"object"},"strict":false},{"type":"function","description":"Edit a file in a workspace.","name":"bmcp_coder_coder_workspace_edit_file","parameters":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","edits"],"type":"object"},"strict":false},{"type":"function","description":"Edit one or more files in a workspace.","name":"bmcp_coder_coder_workspace_edit_files","parameters":{"properties":{"files":{"description":"An array of files to edit.","items":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"}},"required":["path","edits"],"type":"object"},"type":"array"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","files"],"type":"object"},"strict":false},{"type":"function","description":"List the URLs of Coder apps running in a workspace for a single agent.","name":"bmcp_coder_coder_workspace_list_apps","parameters":{"properties":{"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace"],"type":"object"},"strict":false},{"type":"function","description":"List directories in a workspace.","name":"bmcp_coder_coder_workspace_ls","parameters":{"properties":{"path":{"description":"The absolute path of the directory in the workspace to list.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Fetch URLs that forward to the specified port.","name":"bmcp_coder_coder_workspace_port_forward","parameters":{"properties":{"port":{"description":"The port to forward.","type":"number"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","port"],"type":"object"},"strict":false},{"type":"function","description":"Read from a file in a workspace.","name":"bmcp_coder_coder_workspace_read_file","parameters":{"properties":{"limit":{"description":"The number of bytes to read. Cannot exceed 1 MiB. Defaults to the full size of the file or 1 MiB, whichever is lower.","type":"integer"},"offset":{"description":"A byte offset indicating where in the file to start reading. Defaults to zero. An empty string indicates the end of the file has been reached.","type":"integer"},"path":{"description":"The absolute path of the file to read in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Write a file in a workspace.\n\nIf a file write fails due to syntax errors or encoding issues, do NOT switch\nto using bash commands as a workaround. Instead:\n\n\t1. Read the error message carefully to identify the issue\n\t2. Fix the content encoding/syntax\n\t3. Retry with this tool\n\nThe content parameter expects base64-encoded bytes. Ensure your source content\nis correct before encoding it. If you encounter errors, decode and verify the\ncontent you are trying to write, then re-encode it properly.\n","name":"bmcp_coder_coder_workspace_write_file","parameters":{"properties":{"content":{"description":"The base64-encoded bytes to write to the file.","type":"string"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","content"],"type":"object"},"strict":false}],"top_logprobs":0,"top_p":1.0,"truncation":"disabled","usage":{"input_tokens":6346,"input_tokens_details":{"cached_tokens":0},"output_tokens":56,"output_tokens_details":{"reasoning_tokens":0},"total_tokens":6402},"user":null,"metadata":{}},"sequence_number":61} +data: {"type":"response.completed","response":{"id":"resp_0dfed48e1052ad7f0069725ca39880819390fcc5b2eb8cf8c6","object":"response","created_at":1769102499,"status":"completed","background":false,"completed_at":1769102501,"error":null,"frequency_penalty":0.0,"incomplete_details":null,"instructions":null,"max_output_tokens":null,"max_tool_calls":null,"model":"gpt-4.1-2025-04-14","output":[{"id":"msg_0dfed48e1052ad7f0069725ca4c2488193a652eba330c51e5b","type":"message","status":"completed","content":[{"type":"output_text","annotations":[],"logprobs":[],"text":"The workspace ID you provided ('non_existing_id') is not valid. Workspace IDs must be valid UUIDs (typically 36 characters long). Please provide a valid workspace ID to create a new workspace build. If you need help finding your workspace ID, let me know!"}],"role":"assistant"}],"parallel_tool_calls":false,"presence_penalty":0.0,"previous_response_id":null,"prompt_cache_key":null,"prompt_cache_retention":null,"reasoning":{"effort":null,"summary":null},"safety_identifier":null,"service_tier":"default","store":true,"temperature":1.0,"text":{"format":{"type":"text"},"verbosity":"medium"},"tool_choice":"auto","tools":[{"type":"function","description":"Create a task.","name":"bmcp_coder_coder_create_task","parameters":{"properties":{"input":{"description":"Input/prompt for the task.","type":"string"},"template_version_id":{"description":"ID of the template version to create the task from.","type":"string"},"template_version_preset_id":{"description":"Optional ID of the template version preset to create the task from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a task. Omit or use the `me` keyword to create a task for the authenticated user.","type":"string"}},"required":["input","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template in Coder. First, you must create a template version.","name":"bmcp_coder_coder_create_template","parameters":{"properties":{"description":{"type":"string"},"display_name":{"type":"string"},"icon":{"description":"A URL to an icon to use.","type":"string"},"name":{"type":"string"},"version_id":{"description":"The ID of the version to use.","type":"string"}},"required":["name","display_name","description","version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template version. This is a precursor to creating a template, or you can update an existing template.\n\nTemplates are Terraform defining a development environment. The provisioned infrastructure must run\nan Agent that connects to the Coder Control Plane to provide a rich experience.\n\nHere are some strict rules for creating a template version:\n- YOU MUST NOT use \"variable\" or \"output\" blocks in the Terraform code.\n- YOU MUST ALWAYS check template version logs after creation to ensure the template was imported successfully.\n\nWhen a template version is created, a Terraform Plan occurs that ensures the infrastructure\n_could_ be provisioned, but actual provisioning occurs when a workspace is created.\n\n\nThe Coder Terraform Provider can be imported like:\n\n```hcl\nterraform {\n required_providers {\n coder = {\n source = \"coder/coder\"\n }\n }\n}\n```\n\nA destroy does not occur when a user stops a workspace, but rather the transition changes:\n\n```hcl\ndata \"coder_workspace\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace.\n- name: The name of the workspace.\n- transition: Either \"start\" or \"stop\".\n- start_count: A computed count based on the transition field. If \"start\", this will be 1.\n\nAccess workspace owner information with:\n\n```hcl\ndata \"coder_workspace_owner\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace owner.\n- name: The name of the workspace owner.\n- full_name: The full name of the workspace owner.\n- email: The email of the workspace owner.\n- session_token: A token that can be used to authenticate the workspace owner. It is regenerated every time the workspace is started.\n- oidc_access_token: A valid OpenID Connect access token of the workspace owner. This is only available if the workspace owner authenticated with OpenID Connect. If a valid token cannot be obtained, this value will be an empty string.\n\nParameters are defined in the template version. They are rendered in the UI on the workspace creation page:\n\n```hcl\nresource \"coder_parameter\" \"region\" {\n name = \"region\"\n type = \"string\"\n default = \"us-east-1\"\n}\n```\n\nThis resource accepts the following properties:\n- name: The name of the parameter.\n- default: The default value of the parameter.\n- type: The type of the parameter. Must be one of: \"string\", \"number\", \"bool\", or \"list(string)\".\n- display_name: The displayed name of the parameter as it will appear in the UI.\n- description: The description of the parameter as it will appear in the UI.\n- ephemeral: The value of an ephemeral parameter will not be preserved between consecutive workspace builds.\n- form_type: The type of this parameter. Must be one of: [radio, slider, input, dropdown, checkbox, switch, multi-select, tag-select, textarea, error].\n- icon: A URL to an icon to display in the UI.\n- mutable: Whether this value can be changed after workspace creation. This can be destructive for values like region, so use with caution!\n- option: Each option block defines a value for a user to select from. (see below for nested schema)\n Required:\n - name: The name of the option.\n - value: The value of the option.\n Optional:\n - description: The description of the option as it will appear in the UI.\n - icon: A URL to an icon to display in the UI.\n\nA Workspace Agent runs on provisioned infrastructure to provide access to the workspace:\n\n```hcl\nresource \"coder_agent\" \"dev\" {\n arch = \"amd64\"\n os = \"linux\"\n}\n```\n\nThis resource accepts the following properties:\n- arch: The architecture of the agent. Must be one of: \"amd64\", \"arm64\", or \"armv7\".\n- os: The operating system of the agent. Must be one of: \"linux\", \"windows\", or \"darwin\".\n- auth: The authentication method for the agent. Must be one of: \"token\", \"google-instance-identity\", \"aws-instance-identity\", or \"azure-instance-identity\". It is insecure to pass the agent token via exposed variables to Virtual Machines. Instance Identity enables provisioned VMs to authenticate by instance ID on start.\n- dir: The starting directory when a user creates a shell session. Defaults to \"$HOME\".\n- env: A map of environment variables to set for the agent.\n- startup_script: A script to run after the agent starts. This script MUST exit eventually to signal that startup has completed. Use \"&\" or \"screen\" to run processes in the background.\n\nThis resource provides the following fields:\n- id: The UUID of the agent.\n- init_script: The script to run on provisioned infrastructure to fetch and start the agent.\n- token: Set the environment variable CODER_AGENT_TOKEN to this value to authenticate the agent.\n\nThe agent MUST be installed and started using the init_script. A utility like curl or wget to fetch the agent binary must exist in the provisioned infrastructure.\n\nExpose terminal or HTTP applications running in a workspace with:\n\n```hcl\nresource \"coder_app\" \"dev\" {\n agent_id = coder_agent.dev.id\n slug = \"my-app-name\"\n display_name = \"My App\"\n icon = \"https://my-app.com/icon.svg\"\n url = \"http://127.0.0.1:3000\"\n}\n```\n\nThis resource accepts the following properties:\n- agent_id: The ID of the agent to attach the app to.\n- slug: The slug of the app.\n- display_name: The displayed name of the app as it will appear in the UI.\n- icon: A URL to an icon to display in the UI.\n- url: An external url if external=true or a URL to be proxied to from inside the workspace. This should be of the form http://localhost:PORT[/SUBPATH]. Either command or url may be specified, but not both.\n- command: A command to run in a terminal opening this app. In the web, this will open in a new tab. In the CLI, this will SSH and execute the command. Either command or url may be specified, but not both.\n- external: Whether this app is an external app. If true, the url will be opened in a new tab.\n\n\nThe Coder Server may not be authenticated with the infrastructure provider a user requests. In this scenario,\nthe user will need to provide credentials to the Coder Server before the workspace can be provisioned.\n\nHere are examples of provisioning the Coder Agent on specific infrastructure providers:\n\n\n// The agent is configured with \"aws-instance-identity\" auth.\nterraform {\n required_providers {\n cloudinit = {\n source = \"hashicorp/cloudinit\"\n }\n aws = {\n source = \"hashicorp/aws\"\n }\n }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n gzip = false\n base64_encode = false\n boundary = \"//\"\n part {\n filename = \"cloud-config.yaml\"\n content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t// - [scripts-user, always]\n\t// hostname: ${hostname}\n\t// users:\n\t// - name: ${linux_user}\n\t// sudo: ALL=(ALL) NOPASSWD:ALL\n\t// shell: /bin/bash\n content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n hostname = local.hostname\n linux_user = local.linux_user\n })\n }\n\n part {\n filename = \"userdata.sh\"\n content_type = \"text/x-shellscript\"\n\n\t// Here is the content of the userdata.sh.tftpl file:\n\t// #!/bin/bash\n\t// sudo -u '${linux_user}' sh -c '${init_script}'\n content = templatefile(\"${path.module}/cloud-init/userdata.sh.tftpl\", {\n linux_user = local.linux_user\n\n init_script = try(coder_agent.dev[0].init_script, \"\")\n })\n }\n}\n\nresource \"aws_instance\" \"dev\" {\n ami = data.aws_ami.ubuntu.id\n availability_zone = \"${data.coder_parameter.region.value}a\"\n instance_type = data.coder_parameter.instance_type.value\n\n user_data = data.cloudinit_config.user_data.rendered\n tags = {\n Name = \"coder-${data.coder_workspace_owner.me.name}-${data.coder_workspace.me.name}\"\n }\n lifecycle {\n ignore_changes = [ami]\n }\n}\n\n\n\n// The agent is configured with \"google-instance-identity\" auth.\nterraform {\n required_providers {\n google = {\n source = \"hashicorp/google\"\n }\n }\n}\n\nresource \"google_compute_instance\" \"dev\" {\n zone = module.gcp_region.value\n count = data.coder_workspace.me.start_count\n name = \"coder-${lower(data.coder_workspace_owner.me.name)}-${lower(data.coder_workspace.me.name)}-root\"\n machine_type = \"e2-medium\"\n network_interface {\n network = \"default\"\n access_config {\n // Ephemeral public IP\n }\n }\n boot_disk {\n auto_delete = false\n source = google_compute_disk.root.name\n }\n // In order to use google-instance-identity, a service account *must* be provided.\n service_account {\n email = data.google_compute_default_service_account.default.email\n scopes = [\"cloud-platform\"]\n }\n # ONLY FOR WINDOWS:\n # metadata = {\n # windows-startup-script-ps1 = coder_agent.main.init_script\n # }\n # The startup script runs as root with no $HOME environment set up, so instead of directly\n # running the agent init script, create a user (with a homedir, default shell and sudo\n # permissions) and execute the init script as that user.\n #\n # The agent MUST be started in here.\n metadata_startup_script = </dev/null 2>&1; then\n useradd -m -s /bin/bash \"${local.linux_user}\"\n echo \"${local.linux_user} ALL=(ALL) NOPASSWD:ALL\" > /etc/sudoers.d/coder-user\nfi\n\nexec sudo -u \"${local.linux_user}\" sh -c '${coder_agent.main.init_script}'\nEOMETA\n}\n\n\n\n// The agent is configured with \"azure-instance-identity\" auth.\nterraform {\n required_providers {\n azurerm = {\n source = \"hashicorp/azurerm\"\n }\n cloudinit = {\n source = \"hashicorp/cloudinit\"\n }\n }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n gzip = false\n base64_encode = true\n\n boundary = \"//\"\n\n part {\n filename = \"cloud-config.yaml\"\n content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t// - [scripts-user, always]\n\t// bootcmd:\n\t// # work around https://github.com/hashicorp/terraform-provider-azurerm/issues/6117\n\t// - until [ -e /dev/disk/azure/scsi1/lun10 ]; do sleep 1; done\n\t// device_aliases:\n\t// homedir: /dev/disk/azure/scsi1/lun10\n\t// disk_setup:\n\t// homedir:\n\t// table_type: gpt\n\t// layout: true\n\t// fs_setup:\n\t// - label: coder_home\n\t// filesystem: ext4\n\t// device: homedir.1\n\t// mounts:\n\t// - [\"LABEL=coder_home\", \"/home/${username}\"]\n\t// hostname: ${hostname}\n\t// users:\n\t// - name: ${username}\n\t// sudo: [\"ALL=(ALL) NOPASSWD:ALL\"]\n\t// groups: sudo\n\t// shell: /bin/bash\n\t// packages:\n\t// - git\n\t// write_files:\n\t// - path: /opt/coder/init\n\t// permissions: \"0755\"\n\t// encoding: b64\n\t// content: ${init_script}\n\t// - path: /etc/systemd/system/coder-agent.service\n\t// permissions: \"0644\"\n\t// content: |\n\t// [Unit]\n\t// Description=Coder Agent\n\t// After=network-online.target\n\t// Wants=network-online.target\n\n\t// [Service]\n\t// User=${username}\n\t// ExecStart=/opt/coder/init\n\t// Restart=always\n\t// RestartSec=10\n\t// TimeoutStopSec=90\n\t// KillMode=process\n\n\t// OOMScoreAdjust=-900\n\t// SyslogIdentifier=coder-agent\n\n\t// [Install]\n\t// WantedBy=multi-user.target\n\t// runcmd:\n\t// - chown ${username}:${username} /home/${username}\n\t// - systemctl enable coder-agent\n\t// - systemctl start coder-agent\n content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n username = \"coder\" # Ensure this user/group does not exist in your VM image\n init_script = base64encode(coder_agent.main.init_script)\n hostname = lower(data.coder_workspace.me.name)\n })\n }\n}\n\nresource \"azurerm_linux_virtual_machine\" \"main\" {\n count = data.coder_workspace.me.start_count\n name = \"vm\"\n resource_group_name = azurerm_resource_group.main.name\n location = azurerm_resource_group.main.location\n size = data.coder_parameter.instance_type.value\n // cloud-init overwrites this, so the value here doesn't matter\n admin_username = \"adminuser\"\n admin_ssh_key {\n public_key = tls_private_key.dummy.public_key_openssh\n username = \"adminuser\"\n }\n\n network_interface_ids = [\n azurerm_network_interface.main.id,\n ]\n computer_name = lower(data.coder_workspace.me.name)\n os_disk {\n caching = \"ReadWrite\"\n storage_account_type = \"Standard_LRS\"\n }\n source_image_reference {\n publisher = \"Canonical\"\n offer = \"0001-com-ubuntu-server-focal\"\n sku = \"20_04-lts-gen2\"\n version = \"latest\"\n }\n user_data = data.cloudinit_config.user_data.rendered\n}\n\n\n\nterraform {\n required_providers {\n coder = {\n source = \"kreuzwerker/docker\"\n }\n }\n}\n\n// The agent is configured with \"token\" auth.\n\nresource \"docker_container\" \"workspace\" {\n count = data.coder_workspace.me.start_count\n image = \"codercom/enterprise-base:ubuntu\"\n # Uses lower() to avoid Docker restriction on container names.\n name = \"coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}\"\n # Hostname makes the shell more user friendly: coder@my-workspace:~$\n hostname = data.coder_workspace.me.name\n # Use the docker gateway if the access URL is 127.0.0.1.\n entrypoint = [\"sh\", \"-c\", replace(coder_agent.main.init_script, \"/localhost|127\\\\.0\\\\.0\\\\.1/\", \"host.docker.internal\")]\n env = [\"CODER_AGENT_TOKEN=${coder_agent.main.token}\"]\n host {\n host = \"host.docker.internal\"\n ip = \"host-gateway\"\n }\n volumes {\n container_path = \"/home/coder\"\n volume_name = docker_volume.home_volume.name\n read_only = false\n }\n}\n\n\n\n// The agent is configured with \"token\" auth.\n\nresource \"kubernetes_deployment\" \"main\" {\n count = data.coder_workspace.me.start_count\n depends_on = [\n kubernetes_persistent_volume_claim.home\n ]\n wait_for_rollout = false\n metadata {\n name = \"coder-${data.coder_workspace.me.id}\"\n }\n\n spec {\n replicas = 1\n strategy {\n type = \"Recreate\"\n }\n\n template {\n spec {\n security_context {\n run_as_user = 1000\n fs_group = 1000\n run_as_non_root = true\n }\n\n container {\n name = \"dev\"\n image = \"codercom/enterprise-base:ubuntu\"\n image_pull_policy = \"Always\"\n command = [\"sh\", \"-c\", coder_agent.main.init_script]\n security_context {\n run_as_user = \"1000\"\n }\n env {\n name = \"CODER_AGENT_TOKEN\"\n value = coder_agent.main.token\n }\n }\n }\n }\n }\n}\n\n\nThe file_id provided is a reference to a tar file you have uploaded containing the Terraform.\n","name":"bmcp_coder_coder_create_template_version","parameters":{"properties":{"file_id":{"type":"string"},"template_id":{"type":"string"}},"required":["file_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace in Coder.\n\nIf a user is asking to \"test a template\", they are typically referring\nto creating a workspace from a template to ensure the infrastructure\nis provisioned correctly and the agent can connect to the control plane.\n\nBefore creating a workspace, always confirm the template choice with the user by:\n\n\t1. Listing the available templates that match their request.\n\t2. Recommending the most relevant option.\n\t2. Asking the user to confirm which template to use.\n\nIt is important to not create a workspace without confirming the template\nchoice with the user.\n\nAfter creating a workspace, watch the build logs and wait for the workspace to\nbe ready before trying to use or connect to the workspace.\n","name":"bmcp_coder_coder_create_workspace","parameters":{"properties":{"name":{"description":"Name of the workspace to create.","type":"string"},"rich_parameters":{"description":"Key/value pairs of rich parameters to pass to the template version to create the workspace.","type":"object"},"template_version_id":{"description":"ID of the template version to create the workspace from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a workspace. Omit or use the `me` keyword to create a workspace for the authenticated user.","type":"string"}},"required":["user","template_version_id","name","rich_parameters"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace build for an existing workspace. Use this to start, stop, or delete.\n\nAfter creating a workspace build, watch the build logs and wait for the\nworkspace build to complete before trying to start another build or use or\nconnect to the workspace.\n","name":"bmcp_coder_coder_create_workspace_build","parameters":{"properties":{"template_version_id":{"description":"(Optional) The template version ID to use for the workspace build. If not provided, the previously built version will be used.","type":"string"},"transition":{"description":"The transition to perform. Must be one of: start, stop, delete","enum":["start","stop","delete"],"type":"string"},"workspace_id":{"type":"string"}},"required":["workspace_id","transition"],"type":"object"},"strict":false},{"type":"function","description":"Delete a task.","name":"bmcp_coder_coder_delete_task","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to delete. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Delete a template. This is irreversible.","name":"bmcp_coder_coder_delete_template","parameters":{"properties":{"template_id":{"type":"string"}},"required":["template_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the currently authenticated user, similar to the `whoami` command.","name":"bmcp_coder_coder_get_authenticated_user","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a task.","name":"bmcp_coder_coder_get_task_logs","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to query. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the status of a task.","name":"bmcp_coder_coder_get_task_status","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to get. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a template version. This is useful to check whether a template version successfully imports or not.","name":"bmcp_coder_coder_get_template_version_logs","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Get a workspace by name or ID.\n\nThis returns more data than list_workspaces to reduce token usage.","name":"bmcp_coder_coder_get_workspace","parameters":{"properties":{"workspace_id":{"description":"The workspace ID or name in the format [owner/]workspace. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace agent.\n\n\t\tMore logs may appear after this call. It does not wait for the agent to finish.","name":"bmcp_coder_coder_get_workspace_agent_logs","parameters":{"properties":{"workspace_agent_id":{"type":"string"}},"required":["workspace_agent_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace build.\n\n\t\tUseful for checking whether a workspace builds successfully or not.","name":"bmcp_coder_coder_get_workspace_build_logs","parameters":{"properties":{"workspace_build_id":{"type":"string"}},"required":["workspace_build_id"],"type":"object"},"strict":false},{"type":"function","description":"List tasks.","name":"bmcp_coder_coder_list_tasks","parameters":{"properties":{"status":{"description":"Optional filter by task status.","type":"string"},"user":{"description":"Username or ID of the user for which to list tasks. Omit or use the `me` keyword to list tasks for the authenticated user.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Lists templates for the authenticated user.","name":"bmcp_coder_coder_list_templates","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Lists workspaces for the authenticated user.","name":"bmcp_coder_coder_list_workspaces","parameters":{"properties":{"owner":{"description":"The owner of the workspaces to list. Use \"me\" to list workspaces for the authenticated user. If you do not specify an owner, \"me\" will be assumed by default.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Send input to a running task.","name":"bmcp_coder_coder_send_task_input","parameters":{"properties":{"input":{"description":"The input to send to the task.","type":"string"},"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to prompt. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id","input"],"type":"object"},"strict":false},{"type":"function","description":"Get the parameters for a template version. You can refer to these as workspace parameters to the user, as they are typically important for creating a workspace.","name":"bmcp_coder_coder_template_version_parameters","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Update the active version of a template. This is helpful when iterating on templates.","name":"bmcp_coder_coder_update_template_active_version","parameters":{"properties":{"template_id":{"type":"string"},"template_version_id":{"type":"string"}},"required":["template_id","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create and upload a tar file by key/value mapping of file names to file contents. Use this to create template versions. Reference the tool description of \"create_template_version\" to understand template requirements.","name":"bmcp_coder_coder_upload_tar_file","parameters":{"properties":{"files":{"description":"A map of file names to file contents.","type":"object"}},"required":["files"],"type":"object"},"strict":false},{"type":"function","description":"Execute a bash command in a Coder workspace.\n\nThis tool provides the same functionality as the 'coder ssh ' CLI command.\nIt automatically starts the workspace if it's stopped and waits for the agent to be ready.\nThe output is trimmed of leading and trailing whitespace.\n\nThe workspace parameter supports various formats:\n- workspace (uses current user)\n- owner/workspace\n- owner--workspace\n- workspace.agent (specific agent)\n- owner/workspace.agent\n\nThe timeout_ms parameter specifies the command timeout in milliseconds (defaults to 60000ms, maximum of 300000ms).\nIf the command times out, all output captured up to that point is returned with a cancellation message.\n\nFor background commands (background: true), output is captured until the timeout is reached, then the command\ncontinues running in the background. The captured output is returned as the result.\n\nFor file operations (list, write, edit), always prefer the dedicated file tools.\nDo not use bash commands (ls, cat, echo, heredoc, etc.) to list, write, or read\nfiles when the file tools are available. The bash tool should be used for:\n\n\t- Running commands and scripts\n\t- Installing packages\n\t- Starting services\n\t- Executing programs\n\nExamples:\n- workspace: \"john/dev-env\", command: \"git status\", timeout_ms: 30000\n- workspace: \"my-workspace\", command: \"npm run dev\", background: true, timeout_ms: 10000\n- workspace: \"my-workspace.main\", command: \"docker ps\"","name":"bmcp_coder_coder_workspace_bash","parameters":{"properties":{"background":{"description":"Whether to run the command in the background. Output is captured until timeout, then the command continues running in the background.","type":"boolean"},"command":{"description":"The bash command to execute in the workspace.","type":"string"},"timeout_ms":{"default":60000,"description":"Command timeout in milliseconds. Defaults to 60000ms (60 seconds) if not specified.","minimum":1,"type":"integer"},"workspace":{"description":"The workspace name in format [owner/]workspace[.agent]. If owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","command"],"type":"object"},"strict":false},{"type":"function","description":"Edit a file in a workspace.","name":"bmcp_coder_coder_workspace_edit_file","parameters":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","edits"],"type":"object"},"strict":false},{"type":"function","description":"Edit one or more files in a workspace.","name":"bmcp_coder_coder_workspace_edit_files","parameters":{"properties":{"files":{"description":"An array of files to edit.","items":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"}},"required":["path","edits"],"type":"object"},"type":"array"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","files"],"type":"object"},"strict":false},{"type":"function","description":"List the URLs of Coder apps running in a workspace for a single agent.","name":"bmcp_coder_coder_workspace_list_apps","parameters":{"properties":{"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace"],"type":"object"},"strict":false},{"type":"function","description":"List directories in a workspace.","name":"bmcp_coder_coder_workspace_ls","parameters":{"properties":{"path":{"description":"The absolute path of the directory in the workspace to list.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Fetch URLs that forward to the specified port.","name":"bmcp_coder_coder_workspace_port_forward","parameters":{"properties":{"port":{"description":"The port to forward.","type":"number"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","port"],"type":"object"},"strict":false},{"type":"function","description":"Read from a file in a workspace.","name":"bmcp_coder_coder_workspace_read_file","parameters":{"properties":{"limit":{"description":"The number of bytes to read. Cannot exceed 1 MiB. Defaults to the full size of the file or 1 MiB, whichever is lower.","type":"integer"},"offset":{"description":"A byte offset indicating where in the file to start reading. Defaults to zero. An empty string indicates the end of the file has been reached.","type":"integer"},"path":{"description":"The absolute path of the file to read in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Write a file in a workspace.\n\nIf a file write fails due to syntax errors or encoding issues, do NOT switch\nto using bash commands as a workaround. Instead:\n\n\t1. Read the error message carefully to identify the issue\n\t2. Fix the content encoding/syntax\n\t3. Retry with this tool\n\nThe content parameter expects base64-encoded bytes. Ensure your source content\nis correct before encoding it. If you encounter errors, decode and verify the\ncontent you are trying to write, then re-encode it properly.\n","name":"bmcp_coder_coder_workspace_write_file","parameters":{"properties":{"content":{"description":"The base64-encoded bytes to write to the file.","type":"string"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","content"],"type":"object"},"strict":false}],"top_logprobs":0,"top_p":1.0,"truncation":"disabled","usage":{"input_tokens":6346,"input_tokens_details":{"cached_tokens":100,"cache_write_tokens":9},"output_tokens":56,"output_tokens_details":{"reasoning_tokens":5},"total_tokens":6402},"user":null,"metadata":{}},"sequence_number":61} diff --git a/aibridge/intercept/chatcompletions/base.go b/aibridge/intercept/chatcompletions/base.go index 4e6db3abe60..415b4d46bc3 100644 --- a/aibridge/intercept/chatcompletions/base.go +++ b/aibridge/intercept/chatcompletions/base.go @@ -227,14 +227,15 @@ func (i *interceptionBase) hasInjectableTools() bool { } // recordTokenUsage records the token usage for a single completion, accounting -// for cached tokens included in the prompt token count. +// for cache read and write tokens included in the prompt token count. func (i *interceptionBase) recordTokenUsage(ctx context.Context, msgID string, usage openai.CompletionUsage) { _ = i.recorder.RecordTokenUsage(ctx, &recorder.TokenUsageRecord{ - InterceptionID: i.ID().String(), - MsgID: msgID, - Input: calculateActualInputTokenUsage(usage), - Output: usage.CompletionTokens, - CacheReadInputTokens: usage.PromptTokensDetails.CachedTokens, + InterceptionID: i.ID().String(), + MsgID: msgID, + Input: calculateActualInputTokenUsage(usage), + Output: usage.CompletionTokens, + CacheReadInputTokens: usage.PromptTokensDetails.CachedTokens, + CacheWriteInputTokens: usage.PromptTokensDetails.CacheWriteTokens, ExtraTokenTypes: map[string]int64{ "prompt_audio": usage.PromptTokensDetails.AudioTokens, "completion_accepted_prediction": usage.CompletionTokensDetails.AcceptedPredictionTokens, @@ -245,7 +246,7 @@ func (i *interceptionBase) recordTokenUsage(ctx context.Context, msgID string, u }) } -func sumUsage(ref, in openai.CompletionUsage) openai.CompletionUsage { +func sumUsage(ref openai.CompletionUsage, in openai.CompletionUsage) openai.CompletionUsage { return openai.CompletionUsage{ CompletionTokens: ref.CompletionTokens + in.CompletionTokens, PromptTokens: ref.PromptTokens + in.PromptTokens, @@ -257,17 +258,18 @@ func sumUsage(ref, in openai.CompletionUsage) openai.CompletionUsage { RejectedPredictionTokens: ref.CompletionTokensDetails.RejectedPredictionTokens + in.CompletionTokensDetails.RejectedPredictionTokens, }, PromptTokensDetails: openai.CompletionUsagePromptTokensDetails{ - AudioTokens: ref.PromptTokensDetails.AudioTokens + in.PromptTokensDetails.AudioTokens, - CachedTokens: ref.PromptTokensDetails.CachedTokens + in.PromptTokensDetails.CachedTokens, + AudioTokens: ref.PromptTokensDetails.AudioTokens + in.PromptTokensDetails.AudioTokens, + CachedTokens: ref.PromptTokensDetails.CachedTokens + in.PromptTokensDetails.CachedTokens, + CacheWriteTokens: ref.PromptTokensDetails.CacheWriteTokens + in.PromptTokensDetails.CacheWriteTokens, }, } } -// calculateActualInputTokenUsage accounts for cached tokens which are included in [openai.CompletionUsage].PromptTokens. +// calculateActualInputTokenUsage calculates ordinary input tokens. +// in.PromptTokens contains sum of all prompt tokens including +// cache read and write tokens which are priced differently. func calculateActualInputTokenUsage(in openai.CompletionUsage) int64 { - // Input *includes* the cached tokens, so we subtract them here to reflect actual input token usage. - // The original value can be reconstructed by adding CachedTokens back to Input. - // See https://platform.openai.com/docs/api-reference/usage/completions_object#usage/completions_object-input_tokens. - return max(0, in.PromptTokens /* The aggregated number of text input tokens used, including cached tokens. */ - - in.PromptTokensDetails.CachedTokens /* The aggregated number of text input tokens that has been cached from previous requests. */) + return max(0, in.PromptTokens- + in.PromptTokensDetails.CachedTokens- + in.PromptTokensDetails.CacheWriteTokens) } diff --git a/aibridge/intercept/chatcompletions/base_internal_test.go b/aibridge/intercept/chatcompletions/base_internal_test.go index 8d9151fce6e..2eab3b0b45c 100644 --- a/aibridge/intercept/chatcompletions/base_internal_test.go +++ b/aibridge/intercept/chatcompletions/base_internal_test.go @@ -42,8 +42,9 @@ func TestRecordTokenUsage(t *testing.T) { CompletionTokens: 50, TotalTokens: 150, PromptTokensDetails: openai.CompletionUsagePromptTokensDetails{ - CachedTokens: 40, - AudioTokens: 3, + CachedTokens: 40, + CacheWriteTokens: 25, + AudioTokens: 3, }, CompletionTokensDetails: openai.CompletionUsageCompletionTokensDetails{ AcceptedPredictionTokens: 7, @@ -53,11 +54,12 @@ func TestRecordTokenUsage(t *testing.T) { }, }, expected: &recorder.TokenUsageRecord{ - InterceptionID: id.String(), - MsgID: "cmpl_full", - Input: 60, // 100 prompt - 40 cached - Output: 50, - CacheReadInputTokens: 40, + InterceptionID: id.String(), + MsgID: "cmpl_full", + Input: 35, // 100 prompt - 40 cache read - 25 cache write + Output: 50, + CacheReadInputTokens: 40, + CacheWriteInputTokens: 25, ExtraTokenTypes: map[string]int64{ "prompt_audio": 3, "completion_accepted_prediction": 7, @@ -97,20 +99,22 @@ func TestRecordTokenUsage(t *testing.T) { // CachedTokens. Input must clamp to 0 so it never panics a // Prometheus counter when used as an increment. name: "cached_tokens_exceed_prompt_tokens_clamps_to_zero", - msgID: "cmpl_clamp", + msgID: "cmpl_cached_exceed", usage: openai.CompletionUsage{ PromptTokens: 40, CompletionTokens: 20, PromptTokensDetails: openai.CompletionUsagePromptTokensDetails{ - CachedTokens: 100, + CachedTokens: 30, + CacheWriteTokens: 30, }, }, expected: &recorder.TokenUsageRecord{ - InterceptionID: id.String(), - MsgID: "cmpl_clamp", - Input: 0, // max(0, 40 prompt - 100 cached) - Output: 20, - CacheReadInputTokens: 100, + InterceptionID: id.String(), + MsgID: "cmpl_cached_exceed", + Input: 0, // max(0, 40 prompt - 60 cached) + Output: 20, + CacheReadInputTokens: 30, + CacheWriteInputTokens: 30, ExtraTokenTypes: map[string]int64{ "prompt_audio": 0, "completion_accepted_prediction": 0, @@ -145,6 +149,60 @@ func TestRecordTokenUsage(t *testing.T) { } } +func TestSumUsage(t *testing.T) { + t.Parallel() + + first := openai.CompletionUsage{ + PromptTokens: 100, + CompletionTokens: 50, + TotalTokens: 150, + PromptTokensDetails: openai.CompletionUsagePromptTokensDetails{ + CachedTokens: 10, + CacheWriteTokens: 20, + AudioTokens: 30, + }, + CompletionTokensDetails: openai.CompletionUsageCompletionTokensDetails{ + AcceptedPredictionTokens: 40, + RejectedPredictionTokens: 50, + AudioTokens: 60, + ReasoningTokens: 70, + }, + } + second := openai.CompletionUsage{ + PromptTokens: 200, + CompletionTokens: 100, + TotalTokens: 300, + PromptTokensDetails: openai.CompletionUsagePromptTokensDetails{ + CachedTokens: 1, + CacheWriteTokens: 2, + AudioTokens: 3, + }, + CompletionTokensDetails: openai.CompletionUsageCompletionTokensDetails{ + AcceptedPredictionTokens: 4, + RejectedPredictionTokens: 5, + AudioTokens: 6, + ReasoningTokens: 7, + }, + } + + require.Equal(t, openai.CompletionUsage{ + PromptTokens: 300, + CompletionTokens: 150, + TotalTokens: 450, + PromptTokensDetails: openai.CompletionUsagePromptTokensDetails{ + CachedTokens: 11, + CacheWriteTokens: 22, + AudioTokens: 33, + }, + CompletionTokensDetails: openai.CompletionUsageCompletionTokensDetails{ + AcceptedPredictionTokens: 44, + RejectedPredictionTokens: 55, + AudioTokens: 66, + ReasoningTokens: 77, + }, + }, sumUsage(first, second)) +} + func TestScanForCorrelatingToolCallID(t *testing.T) { t.Parallel() diff --git a/aibridge/intercept/chatcompletions/streaming.go b/aibridge/intercept/chatcompletions/streaming.go index ccbe1d96ab7..44003e36d17 100644 --- a/aibridge/intercept/chatcompletions/streaming.go +++ b/aibridge/intercept/chatcompletions/streaming.go @@ -121,6 +121,10 @@ func (i *StreamingInterception) ProcessRequest(w http.ResponseWriter, r *http.Re stream *ssestream.Stream[openai.ChatCompletionChunk] lastErr error interceptionErr error + + // Cumulative token usage across all previous iterations. + // Added to the usage of chunk before relaying to the client. + cumulativeUsage openai.CompletionUsage ) // Sum the key attempts across all iterations and record once when the @@ -224,7 +228,7 @@ func (i *StreamingInterception) ProcessRequest(w http.ResponseWriter, r *http.Re } // Marshal and relay chunk to client. - payload, err := i.marshalChunk(&chunk, i.ID(), processor) + payload, err := i.marshalChunk(&chunk, i.ID(), processor, cumulativeUsage) if err != nil { logger.Warn(ctx, "failed to marshal chunk", slog.Error(err), slog.F("chunk", chunk.RawJSON())) lastErr = xerrors.Errorf("marshal chunk: %w", err) @@ -270,10 +274,10 @@ func (i *StreamingInterception) ProcessRequest(w http.ResponseWriter, r *http.Re prompt = nil } - if lastUsage := processor.getLastUsage(); lastUsage.CompletionTokens > 0 { - // If the usage information is set, track it. - // The API will send usage information when the response terminates, which will happen if a tool call is invoked. + if processor.hasUsage { + lastUsage := processor.lastUsage i.recordTokenUsage(streamCtx, processor.getMsgID(), lastUsage) + cumulativeUsage = sumUsage(cumulativeUsage, lastUsage) } if iterationStarted { @@ -412,24 +416,19 @@ func (i *StreamingInterception) getInjectedToolByName(name string) *mcp.Tool { return i.mcpProxy.GetTool(name) } -// Mashals received stream chunk. -// Overrides id (since proxy obscures injected tool call invocations). -// If usage field was set in original chunk overrides it to culminative usage. -// // sjson is used instead of normal struct marshaling so forwarded data // is as close to the original as possible. Structs from openai library lack // `omitzero/omitempty` annotations which adds additional empty fields // when marshaling structs. Those additional empty fields can break Codex client. -func (i *StreamingInterception) marshalChunk(chunk *openai.ChatCompletionChunk, id uuid.UUID, prc *streamProcessor) ([]byte, error) { +func (i *StreamingInterception) marshalChunk(chunk *openai.ChatCompletionChunk, id uuid.UUID, prc *streamProcessor, previousUsage openai.CompletionUsage) ([]byte, error) { + // Normalize the response ID because injected tool calls span multiple upstream invocations. sj, err := sjson.Set(chunk.RawJSON(), "id", id.String()) if err != nil { return nil, xerrors.Errorf("marshal chunk id failed: %w", err) } - // If usage information is available, relay the cumulative usage once all tool invocations have completed. if chunk.JSON.Usage.Valid() { - u := prc.getCumulativeUsage() - sj, err = sjson.Set(sj, "usage", u) + sj, err = sjson.Set(sj, "usage", sumUsage(previousUsage, prc.lastUsage)) if err != nil { return nil, xerrors.Errorf("marshal chunk usage failed: %w", err) } @@ -503,9 +502,8 @@ type streamProcessor struct { pendingToolCall bool getInjectedToolFunc func(string) *mcp.Tool - // Token handling. - lastUsage openai.CompletionUsage - cumulativeUsage openai.CompletionUsage + lastUsage openai.CompletionUsage + hasUsage bool } func newStreamProcessor(ctx context.Context, logger slog.Logger, isToolInjectedFunc func(string) *mcp.Tool) *streamProcessor { @@ -525,9 +523,12 @@ func (s *streamProcessor) process(chunk openai.ChatCompletionChunk) bool { // Potentially not fatal, move along in best effort... } - // Accumulate token usage. - s.lastUsage = chunk.Usage - s.cumulativeUsage = sumUsage(s.cumulativeUsage, chunk.Usage) + // Some providers emit cumulative usage snapshots on every chunk, so the + // latest valid usage is authoritative. Never sum across chunks. + if chunk.JSON.Usage.Valid() { + s.lastUsage = chunk.Usage + s.hasUsage = true + } // If the stream has reached a terminal state (i.e. call a tool), and this tool is injected, // then it must not be relayed. @@ -616,14 +617,6 @@ func (s *streamProcessor) getLastCompletion() *openai.ChatCompletionMessage { return &s.acc.Choices[0].Message } -func (s *streamProcessor) getLastUsage() openai.CompletionUsage { - return s.lastUsage -} - -func (s *streamProcessor) getCumulativeUsage() openai.CompletionUsage { - return s.cumulativeUsage -} - // compactToolCalls removes nil/empty tool call entries (without an ID). func compactToolCalls(msg *openai.ChatCompletionMessage) { if msg == nil || len(msg.ToolCalls) == 0 { diff --git a/aibridge/intercept/chatcompletions/streaming_internal_test.go b/aibridge/intercept/chatcompletions/streaming_internal_test.go index 1f6e4195550..b6f36173af1 100644 --- a/aibridge/intercept/chatcompletions/streaming_internal_test.go +++ b/aibridge/intercept/chatcompletions/streaming_internal_test.go @@ -1,6 +1,8 @@ package chatcompletions import ( + "bytes" + "encoding/json" "net/http" "net/http/httptest" "testing" @@ -15,8 +17,137 @@ import ( "cdr.dev/slog/v3/sloggers/slogtest" "github.com/coder/coder/v2/aibridge/intercept" "github.com/coder/coder/v2/aibridge/internal/testutil" + "github.com/coder/coder/v2/aibridge/recorder" ) +func TestStreamProcessorUsage(t *testing.T) { + t.Parallel() + + tests := []struct { + name string + chunks []string + wantPromptTokens int64 + wantCompletionTokens int64 + wantTotalTokens int64 + }{ + { + name: "cumulative snapshots with trailing usage-less chunk", + chunks: []string{ + `{"id":"chatcmpl-cumulative","choices":[{"index":0,"delta":{"content":"one"}}],"usage":{"prompt_tokens":6000,"completion_tokens":10,"total_tokens":6010}}`, + `{"id":"chatcmpl-cumulative","choices":[{"index":0,"delta":{"content":" two"}}],"usage":{"prompt_tokens":6000,"completion_tokens":20,"total_tokens":6020}}`, + `{"id":"chatcmpl-cumulative","choices":[{"index":0,"delta":{},"finish_reason":"stop"}],"usage":{"prompt_tokens":6000,"completion_tokens":30,"total_tokens":6030}}`, + `{"id":"chatcmpl-cumulative","choices":[]}`, + }, + wantPromptTokens: 6000, + wantCompletionTokens: 30, + wantTotalTokens: 6030, + }, + { + name: "usage only on final chunk", + chunks: []string{ + `{"id":"chatcmpl-final","choices":[{"index":0,"delta":{"content":"one"}}]}`, + `{"id":"chatcmpl-final","choices":[{"index":0,"delta":{"content":" two"}}]}`, + `{"id":"chatcmpl-final","choices":[{"index":0,"delta":{},"finish_reason":"stop"}],"usage":{"prompt_tokens":6000,"completion_tokens":30,"total_tokens":6030}}`, + }, + wantPromptTokens: 6000, + wantCompletionTokens: 30, + wantTotalTokens: 6030, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + t.Parallel() + + logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: false}).Leveled(slog.LevelDebug) + interceptor := NewStreamingInterceptor(uuid.New(), nil, intercept.Config{}, nil, nil, otel.Tracer("test")) + processor := newStreamProcessor(t.Context(), logger, nil) + + var relayed []byte + for _, rawChunk := range tt.chunks { + var chunk openai.ChatCompletionChunk + require.NoError(t, json.Unmarshal([]byte(rawChunk), &chunk)) + require.True(t, processor.process(chunk)) + if chunk.JSON.Usage.Valid() { + var err error + relayed, err = interceptor.marshalChunk(&chunk, interceptor.ID(), processor, openai.CompletionUsage{}) + require.NoError(t, err) + } + } + + var payload struct { + Usage openai.CompletionUsage `json:"usage"` + } + relayed = bytes.TrimSuffix(bytes.TrimPrefix(relayed, []byte("data: ")), []byte("\n\n")) + require.NoError(t, json.Unmarshal(relayed, &payload)) + assert.Equal(t, tt.wantPromptTokens, payload.Usage.PromptTokens) + assert.Equal(t, tt.wantCompletionTokens, payload.Usage.CompletionTokens) + assert.Equal(t, tt.wantTotalTokens, payload.Usage.TotalTokens) + + usage := processor.lastUsage + assert.Equal(t, tt.wantPromptTokens, usage.PromptTokens) + assert.Equal(t, tt.wantCompletionTokens, usage.CompletionTokens) + assert.Equal(t, tt.wantTotalTokens, usage.TotalTokens) + }) + } +} + +func TestStreamingInterceptionRecordsLatestUsageWithZeroCompletionTokens(t *testing.T) { + t.Parallel() + + upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { + w.Header().Set("Content-Type", "text/event-stream") + _, _ = w.Write([]byte("data: {\"id\":\"chatcmpl-zero-completion\",\"object\":\"chat.completion.chunk\",\"choices\":[{\"index\":0,\"delta\":{\"content\":\"one\"}}],\"usage\":{\"prompt_tokens\":40,\"completion_tokens\":0,\"total_tokens\":40,\"prompt_tokens_details\":{\"cached_tokens\":5,\"cache_write_tokens\":3}}}\n\n")) + _, _ = w.Write([]byte("data: {\"id\":\"chatcmpl-zero-completion\",\"object\":\"chat.completion.chunk\",\"choices\":[{\"index\":0,\"delta\":{},\"finish_reason\":\"stop\"}],\"usage\":{\"prompt_tokens\":50,\"completion_tokens\":0,\"total_tokens\":50,\"prompt_tokens_details\":{\"cached_tokens\":10,\"cache_write_tokens\":5}}}\n\n")) + _, _ = w.Write([]byte("data: [DONE]\n\n")) + })) + t.Cleanup(upstream.Close) + + req := &ChatCompletionNewParamsWrapper{ + ChatCompletionNewParams: openai.ChatCompletionNewParams{ + Model: "gpt-4", + Messages: []openai.ChatCompletionMessageParamUnion{ + openai.UserMessage("hello"), + }, + }, + Stream: true, + } + httpReq := httptest.NewRequest(http.MethodPost, "/chat/completions", nil) + interceptor := NewStreamingInterceptor( + uuid.New(), + req, + intercept.Config{BaseURL: upstream.URL}, + intercept.BYOK{Secret: "test-key", Header: intercept.AuthHeaderAuthorization}, + httpReq.Header, + otel.Tracer("test"), + ) + logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: false}).Leveled(slog.LevelDebug) + rec := &testutil.MockRecorder{} + interceptor.Setup(logger, rec, nil) + + w := httptest.NewRecorder() + require.NoError(t, interceptor.ProcessRequest(w, httpReq)) + + usages := rec.RecordedTokenUsages() + require.Len(t, usages, 1) + require.Equal(t, &recorder.TokenUsageRecord{ + InterceptionID: interceptor.ID().String(), + MsgID: "chatcmpl-zero-completion", + Input: 35, + Output: 0, + CacheReadInputTokens: 10, + CacheWriteInputTokens: 5, + CreatedAt: usages[0].CreatedAt, + ExtraTokenTypes: map[string]int64{ + "prompt_audio": 0, + "completion_accepted_prediction": 0, + "completion_rejected_prediction": 0, + "completion_audio": 0, + "completion_reasoning": 0, + }, + }, usages[0]) +} + // Test that when the upstream provider returns an error before streaming starts, // the error status code and body are correctly relayed to the client. func TestStreamingInterception_RelaysUpstreamErrorToClient(t *testing.T) { diff --git a/aibridge/intercept/responses/base.go b/aibridge/intercept/responses/base.go index 6513636fedb..ec6e128cf0b 100644 --- a/aibridge/intercept/responses/base.go +++ b/aibridge/intercept/responses/base.go @@ -57,6 +57,21 @@ type responsesInterceptionBase struct { mcpProxy mcp.ServerProxier } +func sumUsage(ref responses.ResponseUsage, in responses.ResponseUsage) responses.ResponseUsage { + return responses.ResponseUsage{ + InputTokens: ref.InputTokens + in.InputTokens, + OutputTokens: ref.OutputTokens + in.OutputTokens, + TotalTokens: ref.TotalTokens + in.TotalTokens, + InputTokensDetails: responses.ResponseUsageInputTokensDetails{ + CachedTokens: ref.InputTokensDetails.CachedTokens + in.InputTokensDetails.CachedTokens, + CacheWriteTokens: ref.InputTokensDetails.CacheWriteTokens + in.InputTokensDetails.CacheWriteTokens, + }, + OutputTokensDetails: responses.ResponseUsageOutputTokensDetails{ + ReasoningTokens: ref.OutputTokensDetails.ReasoningTokens + in.OutputTokensDetails.ReasoningTokens, + }, + } +} + // newResponsesService builds the SDK service used for upstream calls. func (i *responsesInterceptionBase) newResponsesService(ctx context.Context) responses.ResponseService { var opts []option.RequestOption @@ -264,7 +279,9 @@ func (i *responsesInterceptionBase) recordNonInjectedToolUsage(ctx context.Conte // have no uniform argument representation. switch item.Type { case string(constant.ValueOf[constant.FunctionCall]()): - args = i.parseFunctionCallJSONArgs(ctx, item.Arguments) + // Arguments is a union since openai-go v3.50; function_call + // arguments are always the JSON string variant. + args = i.parseFunctionCallJSONArgs(ctx, item.Arguments.OfString) case string(constant.ValueOf[constant.CustomToolCall]()): args = item.Input case string(constant.ValueOf[constant.WebSearchCall]()), @@ -325,16 +342,19 @@ func (i *responsesInterceptionBase) recordTokenUsage(ctx context.Context, respon usage := response.Usage - // Keeping logic consistent with chat completions - // Input *includes* the cached tokens, so we subtract them here to reflect actual input token usage. - inputNonCacheTokens := max(0, usage.InputTokens-usage.InputTokensDetails.CachedTokens) + // InputTokens include cache read and write tokens, see OpenAI spending controller cookbook for reference: + // https://github.com/openai/openai-cookbook/blob/51c769595490f7513d4bd7c6e7700a7ab8dedbd4/articles/per_run_spending_controller_responses_api.md?plain=1#L197 + inputNonCacheTokens := max(0, usage.InputTokens- + usage.InputTokensDetails.CachedTokens- + usage.InputTokensDetails.CacheWriteTokens) if err := i.recorder.RecordTokenUsage(ctx, &recorder.TokenUsageRecord{ - InterceptionID: i.ID().String(), - MsgID: response.ID, - Input: inputNonCacheTokens, - Output: usage.OutputTokens, - CacheReadInputTokens: usage.InputTokensDetails.CachedTokens, + InterceptionID: i.ID().String(), + MsgID: response.ID, + Input: inputNonCacheTokens, + Output: usage.OutputTokens, + CacheReadInputTokens: usage.InputTokensDetails.CachedTokens, + CacheWriteInputTokens: usage.InputTokensDetails.CacheWriteTokens, ExtraTokenTypes: map[string]int64{ "output_reasoning": usage.OutputTokensDetails.ReasoningTokens, "total_tokens": usage.TotalTokens, @@ -446,6 +466,14 @@ func (r *responseCopier) readAll() ([]byte, error) { // forwardResp writes whole response as received to ResponseWriter func (r *responseCopier) forwardResp(w http.ResponseWriter) error { + b, err := r.readAll() + if err != nil { + return xerrors.Errorf("failed to read response body: %w", err) + } + return r.forwardBytes(w, b) +} + +func (r *responseCopier) forwardBytes(w http.ResponseWriter, b []byte) error { // no response was received, nothing to forward if !r.responseReceived.Load() { return nil @@ -459,11 +487,6 @@ func (r *responseCopier) forwardResp(w http.ResponseWriter) error { } w.WriteHeader(r.responseStatus) - b, err := r.readAll() - if err != nil { - return xerrors.Errorf("failed to read response body: %w", err) - } - if _, err := w.Write(b); err != nil { return xerrors.Errorf("failed to write response body: %w", err) } diff --git a/aibridge/intercept/responses/base_internal_test.go b/aibridge/intercept/responses/base_internal_test.go index 60253bc0d1a..dcc8e107e91 100644 --- a/aibridge/intercept/responses/base_internal_test.go +++ b/aibridge/intercept/responses/base_internal_test.go @@ -114,7 +114,7 @@ func TestRecordToolUsage(t *testing.T) { Type: "function_call", CallID: "call_abc", Name: "get_weather", - Arguments: "", + Arguments: oairesponses.ResponseOutputItemUnionArguments{OfString: ""}, }, }, }, @@ -138,13 +138,13 @@ func TestRecordToolUsage(t *testing.T) { Type: "function_call", CallID: "call_1", Name: "get_weather", - Arguments: `{"location": "NYC"}`, + Arguments: oairesponses.ResponseOutputItemUnionArguments{OfString: `{"location": "NYC"}`}, }, { Type: "function_call", CallID: "call_2", Name: "bad_json_args", - Arguments: `{"bad": args`, + Arguments: oairesponses.ResponseOutputItemUnionArguments{OfString: `{"bad": args`}, }, { Type: "message", @@ -161,7 +161,7 @@ func TestRecordToolUsage(t *testing.T) { Type: "function_call", CallID: "call_4", Name: "calculate", - Arguments: `{"a": 1, "b": 2}`, + Arguments: oairesponses.ResponseOutputItemUnionArguments{OfString: `{"a": 1, "b": 2}`}, }, }, }, @@ -211,7 +211,7 @@ func TestRecordToolUsage(t *testing.T) { ID: "fc_item_1", CallID: "call_both", Name: "get_weather", - Arguments: `{"location": "NYC"}`, + Arguments: oairesponses.ResponseOutputItemUnionArguments{OfString: `{"location": "NYC"}`}, }, }, }, @@ -358,6 +358,48 @@ func TestParseJSONArgs(t *testing.T) { } } +func TestSumUsage(t *testing.T) { + t.Parallel() + + first := oairesponses.ResponseUsage{ + InputTokens: 100, + OutputTokens: 50, + TotalTokens: 150, + InputTokensDetails: oairesponses.ResponseUsageInputTokensDetails{ + CachedTokens: 10, + CacheWriteTokens: 20, + }, + OutputTokensDetails: oairesponses.ResponseUsageOutputTokensDetails{ + ReasoningTokens: 30, + }, + } + second := oairesponses.ResponseUsage{ + InputTokens: 200, + OutputTokens: 100, + TotalTokens: 300, + InputTokensDetails: oairesponses.ResponseUsageInputTokensDetails{ + CachedTokens: 1, + CacheWriteTokens: 2, + }, + OutputTokensDetails: oairesponses.ResponseUsageOutputTokensDetails{ + ReasoningTokens: 3, + }, + } + + require.Equal(t, oairesponses.ResponseUsage{ + InputTokens: 300, + OutputTokens: 150, + TotalTokens: 450, + InputTokensDetails: oairesponses.ResponseUsageInputTokensDetails{ + CachedTokens: 11, + CacheWriteTokens: 22, + }, + OutputTokensDetails: oairesponses.ResponseUsageOutputTokensDetails{ + ReasoningTokens: 33, + }, + }, sumUsage(first, second)) +} + func TestRecordTokenUsage(t *testing.T) { t.Parallel() @@ -382,7 +424,8 @@ func TestRecordTokenUsage(t *testing.T) { OutputTokens: 20, TotalTokens: 30, InputTokensDetails: oairesponses.ResponseUsageInputTokensDetails{ - CachedTokens: 5, + CachedTokens: 5, + CacheWriteTokens: 3, }, OutputTokensDetails: oairesponses.ResponseUsageOutputTokensDetails{ ReasoningTokens: 5, @@ -390,11 +433,12 @@ func TestRecordTokenUsage(t *testing.T) { }, }, expected: &recorder.TokenUsageRecord{ - InterceptionID: id.String(), - MsgID: "resp_full", - Input: 5, // 10 input - 5 cached - Output: 20, - CacheReadInputTokens: 5, + InterceptionID: id.String(), + MsgID: "resp_full", + Input: 2, // 10 input - 5 cache read - 3 cache write + Output: 20, + CacheReadInputTokens: 5, + CacheWriteInputTokens: 3, ExtraTokenTypes: map[string]int64{ "output_reasoning": 5, "total_tokens": 30, @@ -413,16 +457,18 @@ func TestRecordTokenUsage(t *testing.T) { OutputTokens: 20, TotalTokens: 30, InputTokensDetails: oairesponses.ResponseUsageInputTokensDetails{ - CachedTokens: 40, + CachedTokens: 20, + CacheWriteTokens: 20, }, }, }, expected: &recorder.TokenUsageRecord{ - InterceptionID: id.String(), - MsgID: "resp_clamp", - Input: 0, // max(0, 10 input - 40 cached) - Output: 20, - CacheReadInputTokens: 40, + InterceptionID: id.String(), + MsgID: "resp_clamp", + Input: 0, // max(0, 10 input - 20 cache read - 20 cache write) + Output: 20, + CacheReadInputTokens: 20, + CacheWriteInputTokens: 20, ExtraTokenTypes: map[string]int64{ "output_reasoning": 0, "total_tokens": 30, diff --git a/aibridge/intercept/responses/blocking.go b/aibridge/intercept/responses/blocking.go index 6038e2e1e6b..fd696a1d562 100644 --- a/aibridge/intercept/responses/blocking.go +++ b/aibridge/intercept/responses/blocking.go @@ -9,6 +9,7 @@ import ( "github.com/google/uuid" "github.com/openai/openai-go/v3/option" "github.com/openai/openai-go/v3/responses" + "github.com/tidwall/sjson" "go.opentelemetry.io/otel/attribute" "go.opentelemetry.io/otel/trace" "golang.org/x/xerrors" @@ -69,10 +70,13 @@ func (i *BlockingResponsesInterceptor) ProcessRequest(w http.ResponseWriter, r * i.injectTools() var ( - response *responses.Response - upstreamErr error - respCopy responseCopier - firstResponseID string + response *responses.Response + upstreamErr error + innerLoopErr error + respCopy responseCopier + firstResponseID string + cumulativeUsage responses.ResponseUsage + innerLoopIterations int ) prompt, promptFound, err := i.reqPayload.lastUserPrompt(ctx, i.logger) @@ -126,13 +130,15 @@ func (i *BlockingResponsesInterceptor) ProcessRequest(w http.ResponseWriter, r * } i.recordTokenUsage(ctx, response) + cumulativeUsage = sumUsage(cumulativeUsage, response.Usage) + innerLoopIterations++ i.recordModelThoughts(ctx, response) // Check if there any injected tools to invoke. pending := i.getPendingInjectedToolCalls(response) - shouldLoop, err = i.handleInnerAgenticLoop(ctx, pending, response) - if err != nil { - i.sendCustomErr(ctx, w, http.StatusInternalServerError, err) + shouldLoop, innerLoopErr = i.handleInnerAgenticLoop(ctx, pending, response) + if innerLoopErr != nil { + i.sendCustomErr(ctx, w, http.StatusInternalServerError, innerLoopErr) shouldLoop = false } } @@ -142,16 +148,44 @@ func (i *BlockingResponsesInterceptor) ProcessRequest(w http.ResponseWriter, r * } i.recordNonInjectedToolUsage(ctx, response) + // The inner-loop error was already sent to the client. Do not append the + // buffered upstream response to it. + if innerLoopErr != nil { + return innerLoopErr + } + if upstreamErr != nil && !respCopy.responseReceived.Load() { // no response received from upstream, return custom error i.sendCustomErr(ctx, w, http.StatusInternalServerError, upstreamErr) return xerrors.Errorf("failed to connect to upstream: %w", upstreamErr) } - err = respCopy.forwardResp(w) + if innerLoopIterations > 1 && upstreamErr == nil && response != nil { + b, readErr := respCopy.readAll() + if readErr != nil { + forwardErr := respCopy.forwardBytes(w, b) + return errors.Join(xerrors.Errorf("failed to read response body: %w", readErr), forwardErr) + } + updated, setErr := i.setUsage(b, cumulativeUsage) + if setErr != nil { + forwardErr := respCopy.forwardBytes(w, b) + return errors.Join(setErr, forwardErr) + } + err = respCopy.forwardBytes(w, updated) + } else { + err = respCopy.forwardResp(w) + } return errors.Join(upstreamErr, err) } +func (*BlockingResponsesInterceptor) setUsage(raw []byte, usage responses.ResponseUsage) ([]byte, error) { + raw, err := sjson.SetBytes(raw, "usage", usage) + if err != nil { + return nil, xerrors.Errorf("set response usage: %w", err) + } + return raw, nil +} + // newResponse routes by credential type, returning the upstream response, the // number of key attempts made for this call, and any error. A centralized key // pool fails over across keys, while BYOK authenticates with a single, fixed diff --git a/aibridge/internal/integrationtest/bridge_internal_test.go b/aibridge/internal/integrationtest/bridge_internal_test.go index 0b2389d3390..ae15b5aae3e 100644 --- a/aibridge/internal/integrationtest/bridge_internal_test.go +++ b/aibridge/internal/integrationtest/bridge_internal_test.go @@ -837,6 +837,87 @@ func TestOpenAIChatCompletions(t *testing.T) { } }) + t.Run("streaming cumulative usage with injected tool", func(t *testing.T) { + t.Parallel() + + bridgeServer, mockMCP, resp := setupInjectedToolTest( + t, + fixtures.OaiChatStreamingCumulativeUsageInjectedTool, + true, + defaultTracer, + pathOpenAIChatCompletions, + nil, + ) + defer resp.Body.Close() + + sp := aibridge.NewSSEParser() + require.NoError(t, sp.Parse(resp.Body)) + + var finalUsage gjson.Result + events := sp.MessageEvents() + for i := len(events) - 1; i >= 0; i-- { + if usage := gjson.Get(events[i].Data, "usage"); usage.Exists() { + finalUsage = usage + break + } + } + + require.True(t, finalUsage.Exists()) + require.EqualValues(t, 12000, finalUsage.Get("prompt_tokens").Int()) + require.EqualValues(t, 60, finalUsage.Get("completion_tokens").Int()) + require.EqualValues(t, 12060, finalUsage.Get("total_tokens").Int()) + require.EqualValues(t, 300, finalUsage.Get("prompt_tokens_details.cached_tokens").Int()) + require.EqualValues(t, 30, finalUsage.Get("prompt_tokens_details.cache_write_tokens").Int()) + require.EqualValues(t, 12, finalUsage.Get("prompt_tokens_details.audio_tokens").Int()) + require.EqualValues(t, 14, finalUsage.Get("completion_tokens_details.reasoning_tokens").Int()) + require.EqualValues(t, 16, finalUsage.Get("completion_tokens_details.audio_tokens").Int()) + require.EqualValues(t, 18, finalUsage.Get("completion_tokens_details.accepted_prediction_tokens").Int()) + require.EqualValues(t, 20, finalUsage.Get("completion_tokens_details.rejected_prediction_tokens").Int()) + + tokenUsages := bridgeServer.Recorder.RecordedTokenUsages() + for i := range tokenUsages { + tokenUsages[i].InterceptionID = "" + tokenUsages[i].CreatedAt = time.Time{} + } + + // Each upstream stream reports cumulative snapshots on every chunk. The + // recorded iteration usage must use only its latest snapshot, while the + // client response above sums those two latest snapshots across iterations. + expectedTokenUsages := []*recorder.TokenUsageRecord{ + { + MsgID: "chatcmpl-cumulative-tool", + Input: 5890, + Output: 30, + CacheReadInputTokens: 100, + CacheWriteInputTokens: 10, + ExtraTokenTypes: map[string]int64{ + "prompt_audio": 3, + "completion_reasoning": 4, + "completion_audio": 5, + "completion_accepted_prediction": 6, + "completion_rejected_prediction": 7, + }, + }, + { + MsgID: "chatcmpl-cumulative-final", + Input: 5780, + Output: 30, + CacheReadInputTokens: 200, + CacheWriteInputTokens: 20, + ExtraTokenTypes: map[string]int64{ + "prompt_audio": 9, + "completion_reasoning": 10, + "completion_audio": 11, + "completion_accepted_prediction": 12, + "completion_rejected_prediction": 13, + }, + }, + } + require.ElementsMatch(t, expectedTokenUsages, tokenUsages) + require.Len(t, mockMCP.getCallsByTool(mockToolName), 1) + bridgeServer.Recorder.VerifyAllInterceptionsEnded(t) + }) + t.Run("streaming injected tool call edge cases", func(t *testing.T) { t.Parallel() @@ -1411,8 +1492,9 @@ func TestOpenAIInjectedTools(t *testing.T) { require.EqualValues(t, expected, actual) var ( - content *openai.ChatCompletionChoice - message openai.ChatCompletion + content *openai.ChatCompletionChoice + message openai.ChatCompletion + clientUsage openai.CompletionUsage ) if streaming { // Parse the response stream. @@ -1423,6 +1505,9 @@ func TestOpenAIInjectedTools(t *testing.T) { for stream.Next() { chunk := stream.Current() acc.AddChunk(chunk) + if chunk.JSON.Usage.Valid() { + clientUsage = chunk.Usage + } if len(chunk.Choices) == 0 { continue @@ -1453,6 +1538,7 @@ func TestOpenAIInjectedTools(t *testing.T) { body, err := io.ReadAll(resp.Body) require.NoError(t, err, "read response body") require.NoError(t, json.Unmarshal(body, &message), "unmarshal response") + clientUsage = message.Usage // Verify that no injected tools were sent to the client. require.GreaterOrEqual(t, len(message.Choices), 1) @@ -1466,15 +1552,60 @@ func TestOpenAIInjectedTools(t *testing.T) { require.NotNil(t, content) require.Contains(t, content.Message.Content, "dd711d5c-83c6-4c08-a0af-b73055906e8c") // The ID of the workspace to be returned. - // Check the token usage from the client's perspective. - // This *should* work but the openai SDK doesn't accumulate the prompt token details :(. - // See https://github.com/openai/openai-go/blob/v2.7.0/streamaccumulator.go#L145-L147. - // assert.EqualValues(t, 5047, message.Usage.PromptTokens-message.Usage.PromptTokensDetails.CachedTokens) - assert.EqualValues(t, 105, message.Usage.CompletionTokens) - - // Ensure tokens used during injected tool invocation are accounted for. - require.EqualValues(t, 5047, bridgeServer.Recorder.TotalInputTokens()) - require.EqualValues(t, 105, bridgeServer.Recorder.TotalOutputTokens()) + // Check the cumulative token usage from the client's perspective. + require.EqualValues(t, 9911, clientUsage.PromptTokens) + require.EqualValues(t, 105, clientUsage.CompletionTokens) + require.EqualValues(t, 10016, clientUsage.TotalTokens) + require.EqualValues(t, 4964, clientUsage.PromptTokensDetails.CachedTokens) + require.EqualValues(t, 30, clientUsage.PromptTokensDetails.CacheWriteTokens) + require.EqualValues(t, 12, clientUsage.PromptTokensDetails.AudioTokens) + require.EqualValues(t, 14, clientUsage.CompletionTokensDetails.ReasoningTokens) + require.EqualValues(t, 16, clientUsage.CompletionTokensDetails.AudioTokens) + require.EqualValues(t, 18, clientUsage.CompletionTokensDetails.AcceptedPredictionTokens) + require.EqualValues(t, 20, clientUsage.CompletionTokensDetails.RejectedPredictionTokens) + + // Ensure both upstream iterations were recorded exactly. + tokenUsages := bridgeServer.Recorder.RecordedTokenUsages() + for _, usage := range tokenUsages { + usage.InterceptionID = "" + usage.CreatedAt = time.Time{} + } + firstMsgID := "chatcmpl-C1XAKDTVYnmWS7tgvg7vPje00PIiy" + secondMsgID := "chatcmpl-C1XANLwdflVxAjKOjbMP3LJxSlXsS" + if streaming { + firstMsgID = "chatcmpl-C1WTooFaxeQgtyLB1kg53t41aB0NV" + secondMsgID = "chatcmpl-C1WTqhYgK7bV01bW98Lww3zqaf8ZF" + } + require.ElementsMatch(t, []*recorder.TokenUsageRecord{ + { + MsgID: firstMsgID, + Input: 4742, + Output: 45, + CacheReadInputTokens: 100, + CacheWriteInputTokens: 20, + ExtraTokenTypes: map[string]int64{ + "prompt_audio": 3, + "completion_accepted_prediction": 6, + "completion_rejected_prediction": 7, + "completion_audio": 5, + "completion_reasoning": 4, + }, + }, + { + MsgID: secondMsgID, + Input: 175, + Output: 60, + CacheReadInputTokens: 4864, + CacheWriteInputTokens: 10, + ExtraTokenTypes: map[string]int64{ + "prompt_audio": 9, + "completion_accepted_prediction": 12, + "completion_rejected_prediction": 13, + "completion_audio": 11, + "completion_reasoning": 10, + }, + }, + }, tokenUsages) // Ensure we received exactly one prompt. promptUsages := bridgeServer.Recorder.RecordedPromptUsages() diff --git a/aibridge/internal/integrationtest/metrics_internal_test.go b/aibridge/internal/integrationtest/metrics_internal_test.go index 314c2d97c4a..a9bcf93e477 100644 --- a/aibridge/internal/integrationtest/metrics_internal_test.go +++ b/aibridge/internal/integrationtest/metrics_internal_test.go @@ -294,10 +294,10 @@ func TestMetrics_TokenUseCount(t *testing.T) { expectProvider: config.ProviderOpenAI, expectModel: "gpt-4.1", expectedLabels: map[string]float64{ - "input": 129, // 12033 - 11904 cached + "input": 114, // 12033 - 11904 cached - 15 cache write "output": 44, "cache_read_input_tokens": 11904, - "cache_write_input_tokens": 0, + "cache_write_input_tokens": 15, "output_reasoning": 0, "total_tokens": 12077, }, @@ -323,10 +323,10 @@ func TestMetrics_TokenUseCount(t *testing.T) { expectProvider: config.ProviderOpenAI, expectModel: "gpt-4.1", expectedLabels: map[string]float64{ - "input": 19, + "input": 14, // 19 prompt - 5 cache write "output": 200, "cache_read_input_tokens": 0, - "cache_write_input_tokens": 0, + "cache_write_input_tokens": 5, "completion_reasoning": 0, "completion_accepted_prediction": 0, "completion_rejected_prediction": 0, diff --git a/aibridge/internal/integrationtest/responses_internal_test.go b/aibridge/internal/integrationtest/responses_internal_test.go index 73fccad6398..2a6edfcbb10 100644 --- a/aibridge/internal/integrationtest/responses_internal_test.go +++ b/aibridge/internal/integrationtest/responses_internal_test.go @@ -1,6 +1,7 @@ package integrationtest import ( + "bufio" "context" "encoding/json" "fmt" @@ -94,10 +95,11 @@ func TestResponsesOutputMatchesUpstream(t *testing.T) { expectModel: "gpt-4.1", expectPromptRecorded: "This was a large input...", expectTokenUsage: &recorder.TokenUsageRecord{ - MsgID: "resp_0cd5d6b8310055d600696a1776b42c81a199fbb02248a8bfa0", - Input: 129, // 12033 input - 11904 cached - Output: 44, - CacheReadInputTokens: 11904, + MsgID: "resp_0cd5d6b8310055d600696a1776b42c81a199fbb02248a8bfa0", + Input: 114, // 12033 input - 11904 cached - 15 cache write + Output: 44, + CacheReadInputTokens: 11904, + CacheWriteInputTokens: 15, ExtraTokenTypes: map[string]int64{ "output_reasoning": 0, "total_tokens": 12077, @@ -256,10 +258,11 @@ func TestResponsesOutputMatchesUpstream(t *testing.T) { expectModel: "gpt-5.2-codex", expectPromptRecorded: "Test cached input tokens.", expectTokenUsage: &recorder.TokenUsageRecord{ - MsgID: "resp_05080461b406f3f501696a1409d34c8195a40ff4b092145c35", - Input: 1165, // 16909 input - 15744 cached - Output: 54, - CacheReadInputTokens: 15744, + MsgID: "resp_05080461b406f3f501696a1409d34c8195a40ff4b092145c35", + Input: 1135, // 16909 input - 15744 cached - 30 cache write + Output: 54, + CacheReadInputTokens: 15744, + CacheWriteInputTokens: 30, ExtraTokenTypes: map[string]int64{ "output_reasoning": 0, "total_tokens": 16963, @@ -803,7 +806,8 @@ func TestResponsesInjectedTool(t *testing.T) { expectToolArgs map[string]any expectToolError string // If non-empty, MCP tool returns this error. expectPrompt string - expectTokenUsages []recorder.TokenUsageRecord + expectTokenUsages []*recorder.TokenUsageRecord + expectClientUsage responses.ResponseUsage }{ { name: "blocking_success", @@ -813,28 +817,42 @@ func TestResponsesInjectedTool(t *testing.T) { "template_version_id": "aa4e30e4-a086-4df6-a364-1343f1458104", }, expectPrompt: "list the template params for version aa4e30e4-a086-4df6-a364-1343f1458104", - expectTokenUsages: []recorder.TokenUsageRecord{ + expectTokenUsages: []*recorder.TokenUsageRecord{ { - MsgID: "resp_012db006225b0ec700696b5de8a01481a28182ea6885448f93", - Input: 227, // 6371 input - 6144 cached - Output: 75, - CacheReadInputTokens: 6144, + MsgID: "resp_012db006225b0ec700696b5de8a01481a28182ea6885448f93", + Input: 220, // 6371 input - 6144 cached - 7 cache write + Output: 75, + CacheReadInputTokens: 6144, + CacheWriteInputTokens: 7, ExtraTokenTypes: map[string]int64{ "output_reasoning": 25, "total_tokens": 6446, }, }, { - MsgID: "resp_012db006225b0ec700696b5dec1d4c81a2a6a416e31af39b90", - Input: 612, // 6756 input - 6144 cached - Output: 231, - CacheReadInputTokens: 6144, + MsgID: "resp_012db006225b0ec700696b5dec1d4c81a2a6a416e31af39b90", + Input: 601, // 6756 input - 6144 cached - 11 cache write + Output: 231, + CacheReadInputTokens: 6144, + CacheWriteInputTokens: 11, ExtraTokenTypes: map[string]int64{ "output_reasoning": 43, "total_tokens": 6987, }, }, }, + expectClientUsage: responses.ResponseUsage{ + InputTokens: 13127, + OutputTokens: 306, + TotalTokens: 13433, + InputTokensDetails: responses.ResponseUsageInputTokensDetails{ + CachedTokens: 12288, + CacheWriteTokens: 18, + }, + OutputTokensDetails: responses.ResponseUsageOutputTokensDetails{ + ReasoningTokens: 68, + }, + }, }, { name: "blocking_tool_error", @@ -845,28 +863,42 @@ func TestResponsesInjectedTool(t *testing.T) { }, expectPrompt: "delete the template with ID 03cb4fdd-8109-4a22-8e22-bb4975171395, don't ask for confirmation", expectToolError: "500 Internal error deleting template: unauthorized: rbac: forbidden", - expectTokenUsages: []recorder.TokenUsageRecord{ + expectTokenUsages: []*recorder.TokenUsageRecord{ { - MsgID: "resp_06e2afba24b6b2ad00696b774d1df0819eaf1ec802bc8a2ca9", - Input: 233, // 6377 input - 6144 cached - Output: 119, - CacheReadInputTokens: 6144, + MsgID: "resp_06e2afba24b6b2ad00696b774d1df0819eaf1ec802bc8a2ca9", + Input: 228, // 6377 input - 6144 cached - 5 cache write + Output: 119, + CacheReadInputTokens: 6144, + CacheWriteInputTokens: 5, ExtraTokenTypes: map[string]int64{ "output_reasoning": 70, "total_tokens": 6496, }, }, { - MsgID: "resp_06e2afba24b6b2ad00696b775044e8819ea14840698ef966e2", - Input: 395, // 6539 input - 6144 cached - Output: 144, - CacheReadInputTokens: 6144, + MsgID: "resp_06e2afba24b6b2ad00696b775044e8819ea14840698ef966e2", + Input: 386, // 6539 input - 6144 cached - 9 cache write + Output: 144, + CacheReadInputTokens: 6144, + CacheWriteInputTokens: 9, ExtraTokenTypes: map[string]int64{ "output_reasoning": 28, "total_tokens": 6683, }, }, }, + expectClientUsage: responses.ResponseUsage{ + InputTokens: 12916, + OutputTokens: 263, + TotalTokens: 13179, + InputTokensDetails: responses.ResponseUsageInputTokensDetails{ + CachedTokens: 12288, + CacheWriteTokens: 14, + }, + OutputTokensDetails: responses.ResponseUsageOutputTokensDetails{ + ReasoningTokens: 98, + }, + }, }, { name: "streaming_success", @@ -875,23 +907,26 @@ func TestResponsesInjectedTool(t *testing.T) { mcpToolName: "coder_list_templates", expectToolArgs: map[string]any{}, expectPrompt: "List my coder templates.", - expectTokenUsages: []recorder.TokenUsageRecord{ + expectTokenUsages: []*recorder.TokenUsageRecord{ { - MsgID: "resp_016595fe42aa62ca0069724419c52081a0b7eb479c6bc8109f", - Input: 6269, // 6269 input - 0 cached - Output: 18, + MsgID: "resp_016595fe42aa62ca0069724419c52081a0b7eb479c6bc8109f", + Input: 6162, // 6269 input - 100 cached - 7 cache write + Output: 18, + CacheReadInputTokens: 100, + CacheWriteInputTokens: 7, ExtraTokenTypes: map[string]int64{ - "output_reasoning": 0, + "output_reasoning": 3, "total_tokens": 6287, }, }, { - MsgID: "resp_0bc5f54fce6df69a006972442175908194bb81d31f576e6ca6", - Input: 319, // 6463 input - 6144 cached - Output: 182, - CacheReadInputTokens: 6144, + MsgID: "resp_0bc5f54fce6df69a006972442175908194bb81d31f576e6ca6", + Input: 308, // 6463 input - 6144 cached - 11 cache write + Output: 182, + CacheReadInputTokens: 6144, + CacheWriteInputTokens: 11, ExtraTokenTypes: map[string]int64{ - "output_reasoning": 0, + "output_reasoning": 5, "total_tokens": 6645, }, }, @@ -908,22 +943,26 @@ func TestResponsesInjectedTool(t *testing.T) { }, expectPrompt: "Create a new workspace build for an workspace with id: 'non_existing_id'", expectToolError: "workspace_id must be a valid UUID: invalid UUID length: 15", - expectTokenUsages: []recorder.TokenUsageRecord{ + expectTokenUsages: []*recorder.TokenUsageRecord{ { - MsgID: "resp_0dfed48e1052ad7f0069725ca129f88193b97d6deff1760524", - Input: 6280, // 6280 input - 0 cached - Output: 30, + MsgID: "resp_0dfed48e1052ad7f0069725ca129f88193b97d6deff1760524", + Input: 6175, // 6280 input - 100 cached - 5 cache write + Output: 30, + CacheReadInputTokens: 100, + CacheWriteInputTokens: 5, ExtraTokenTypes: map[string]int64{ - "output_reasoning": 0, + "output_reasoning": 3, "total_tokens": 6310, }, }, { - MsgID: "resp_0dfed48e1052ad7f0069725ca39880819390fcc5b2eb8cf8c6", - Input: 6346, // 6346 input - 0 cached - Output: 56, + MsgID: "resp_0dfed48e1052ad7f0069725ca39880819390fcc5b2eb8cf8c6", + Input: 6237, // 6346 input - 100 cached - 9 cache write + Output: 56, + CacheReadInputTokens: 100, + CacheWriteInputTokens: 9, ExtraTokenTypes: map[string]int64{ - "output_reasoning": 0, + "output_reasoning": 5, "total_tokens": 6402, }, }, @@ -983,24 +1022,23 @@ func TestResponsesInjectedTool(t *testing.T) { require.Len(t, prompts, 1) require.Equal(t, tc.expectPrompt, prompts[0].Prompt) + // Verify both upstream iterations were recorded exactly. Match by + // content because AsyncRecorder does not guarantee record ordering. tokenUsages := bridgeServer.Recorder.RecordedTokenUsages() - require.Len(t, tokenUsages, len(tc.expectTokenUsages)) for i := range tokenUsages { - tokenUsages[i].InterceptionID = "" // ignore interception ID and time creation when comparing + tokenUsages[i].InterceptionID = "" tokenUsages[i].CreatedAt = time.Time{} } + require.ElementsMatch(t, tc.expectTokenUsages, tokenUsages) - // Match by content, not position, AsyncRecorder may flake. - // See https://github.com/coder/internal/issues/1544. - for _, expected := range tc.expectTokenUsages { - require.Contains(t, tokenUsages, &expected) - } - - // Verify the response is the final tool response (after agentic loop). + // Streaming forwards the final upstream response unchanged. Blocking + // rewrites its usage with the sum from both agentic-loop iterations. if tc.streaming { require.Equal(t, string(fix.StreamingToolCall()), string(body)) } else { - require.Equal(t, string(fix.NonStreamingToolCall()), string(body)) + expectedBody, err := sjson.SetBytes(fix.NonStreamingToolCall(), "usage", tc.expectClientUsage) + require.NoError(t, err) + require.JSONEq(t, string(expectedBody), string(body)) } }) } @@ -1158,10 +1196,12 @@ func startRejectingListener(t *testing.T) (addr string) { return } - // Read at least 1 byte so the client has started writing - // before we RST, ensuring a consistent "connection reset by peer". - buf := make([]byte, 1) - _, _ = c.Read(buf) + // Drain the request before the RST so the client observes a + // read-side reset rather than a racy body-write failure. + if req, err := http.ReadRequest(bufio.NewReader(c)); err == nil { + _, _ = io.Copy(io.Discard, req.Body) + _ = req.Body.Close() + } if tc, ok := c.(*net.TCPConn); ok { _ = tc.SetLinger(0) } diff --git a/go.mod b/go.mod index 06189f1f7c1..bb7fef16db4 100644 --- a/go.mod +++ b/go.mod @@ -131,7 +131,7 @@ replace github.com/anthropics/anthropic-sdk-go v1.19.0 => github.com/dannykoppin // `coder/pinned` is the branch we track. // // To update, run: `go mod edit -replace github.com/openai/openai-go/v3=github.com/coder/openai-go/v3@coder/pinned; go mod tidy` -replace github.com/openai/openai-go/v3 => github.com/coder/openai-go/v3 v3.0.0-20260708125056-3633b71968f7 +replace github.com/openai/openai-go/v3 => github.com/coder/openai-go/v3 v3.0.0-20260810175933-92b5addb22d2 require ( cdr.dev/slog/v3 v3.1.0 @@ -145,7 +145,7 @@ require ( github.com/aquasecurity/trivy-iac v0.8.0 github.com/armon/circbuf v0.0.0-20190214190532-5111143e8da2 github.com/awalterschulze/gographviz v2.0.3+incompatible - github.com/aws/smithy-go v1.27.3 + github.com/aws/smithy-go v1.27.5 github.com/bramvdbogaerde/go-scp v1.6.0 github.com/briandowns/spinner v1.23.0 github.com/cakturk/go-netstat v0.0.0-20200220111822-e5b49efee7a5 @@ -239,7 +239,7 @@ require ( github.com/stretchr/testify v1.11.1 github.com/swaggo/http-swagger/v2 v2.0.1 github.com/swaggo/swag v1.16.6 - github.com/tidwall/gjson v1.18.0 + github.com/tidwall/gjson v1.19.0 github.com/u-root/u-root v0.14.0 github.com/unrolled/secure v1.17.0 github.com/valyala/fasthttp v1.72.0 @@ -309,19 +309,19 @@ require ( github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect github.com/armon/go-radix v1.0.1-0.20221118154546-54df44f2176c // indirect github.com/atotto/clipboard v0.1.4 // indirect - github.com/aws/aws-sdk-go-v2 v1.42.1 - github.com/aws/aws-sdk-go-v2/config v1.32.25 - github.com/aws/aws-sdk-go-v2/credentials v1.19.24 - github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.29 // indirect + github.com/aws/aws-sdk-go-v2 v1.43.2 + github.com/aws/aws-sdk-go-v2/config v1.32.33 + github.com/aws/aws-sdk-go-v2/credentials v1.19.32 + github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.33 // indirect github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.6.14 - github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30 // indirect - github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30 // indirect - github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13 // indirect - github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.30 // indirect + github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.33 // indirect + github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.33 // indirect + github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.14 // indirect + github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.33 // indirect github.com/aws/aws-sdk-go-v2/service/ssm v1.67.4 // indirect - github.com/aws/aws-sdk-go-v2/service/sso v1.31.3 // indirect - github.com/aws/aws-sdk-go-v2/service/ssooidc v1.36.6 // indirect - github.com/aws/aws-sdk-go-v2/service/sts v1.44.0 + github.com/aws/aws-sdk-go-v2/service/sso v1.33.2 // indirect + github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.2 // indirect + github.com/aws/aws-sdk-go-v2/service/sts v1.45.2 github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect github.com/aymerick/douceur v0.2.0 // indirect github.com/beorn7/perks v1.0.1 // indirect @@ -518,7 +518,7 @@ require ( github.com/DataDog/datadog-agent/pkg/trace/traceutil v0.77.0 // indirect github.com/DataDog/go-libddwaf/v4 v4.9.0 // indirect github.com/apparentlymart/go-textseg/v17 v17.0.1 // indirect - github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.31 // indirect + github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.34 // indirect github.com/charmbracelet/colorprofile v0.4.1 // indirect github.com/charmbracelet/x/cellbuf v0.0.15 // indirect github.com/charmbracelet/x/exp/strings v0.1.0 // indirect @@ -553,7 +553,7 @@ require ( github.com/mark3labs/mcp-go v0.38.0 github.com/nats-io/nats-server/v2 v2.14.2 github.com/nats-io/nats.go v1.52.0 - github.com/openai/openai-go/v3 v3.28.0 + github.com/openai/openai-go/v3 v3.50.0 github.com/scim2/filter-parser/v2 v2.3.1 github.com/shopspring/decimal v1.4.0 github.com/smallstep/pkcs7 v0.2.1 @@ -574,8 +574,8 @@ require ( cloud.google.com/go/monitoring v1.29.0 // indirect cloud.google.com/go/storage v1.62.3 // indirect git.sr.ht/~jackmordaunt/go-toast v1.1.2 // indirect - github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 // indirect - github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect + github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 // indirect + github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 // indirect github.com/DataDog/datadog-agent/comp/core/tagger/origindetection v0.77.0 // indirect github.com/DataDog/datadog-agent/pkg/version v0.77.0 // indirect github.com/DataDog/dd-trace-go/v2 v2.8.1 // indirect @@ -592,7 +592,7 @@ require ( github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.22 // indirect github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.29 // indirect github.com/aws/aws-sdk-go-v2/service/s3 v1.103.3 // indirect - github.com/aws/aws-sdk-go-v2/service/signin v1.2.0 // indirect + github.com/aws/aws-sdk-go-v2/service/signin v1.5.2 // indirect github.com/bahlo/generic-list-go v0.2.0 // indirect github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect github.com/bits-and-blooms/bitset v1.24.5 // indirect diff --git a/go.sum b/go.sum index 9761644f7ba..5592a9d1043 100644 --- a/go.sum +++ b/go.sum @@ -31,16 +31,16 @@ filippo.io/mkcert v1.4.4 h1:8eVbbwfVlaqUM7OwuftKc2nuYOoTDQWqsoXmzoXZdbc= filippo.io/mkcert v1.4.4/go.mod h1:VyvOchVuAye3BoUsPUOOofKygVwLV2KQMVFJNRq+1dA= git.sr.ht/~jackmordaunt/go-toast v1.1.2 h1:/yrfI55LRt1M7H1vkaw+NaH1+L1CDxrqDltwm5euVuE= git.sr.ht/~jackmordaunt/go-toast v1.1.2/go.mod h1:jA4OqHKTQ4AFBdwrSnwnskUIIS3HYzlJSgdzCKqfavo= -github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 h1:JXg2dwJUmPB9JmtVmdEB16APJ7jurfbY5jnfXpJoRMc= -github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0/go.mod h1:YD5h/ldMsG0XiIw7PdyNhLxaM317eFh5yNLccNfGdyw= -github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 h1:Hk5QBxZQC1jb2Fwj6mpzme37xbCDdNTxU7O9eb5+LB4= -github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1/go.mod h1:IYus9qsFobWIc2YVwe/WPjcnyCkPKtnHAqUYeebc8z0= -github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 h1:9iefClla7iYpfYWdzPCRDozdmndjTm8DXdpCzPajMgA= -github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2/go.mod h1:XtLgD3ZD34DAaVIIAyG3objl5DynM3CQ/vMcbBNJZGI= +github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 h1:aokoqcHvaGjiM3VpjKDfMMnF/8epJ+Q1HLJ7CudztqE= +github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0/go.mod h1:/WYEx9pcM9Y+Dd/APJaNlSvVSvzl54rrMdZT5+Oi2LM= +github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 h1:CU4+EJeJi3TKYWEcYuSdWsjzw0nVsK/H0MSQOiPcymU= +github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0/go.mod h1:q0+UTSRvShwUCrR/s5HtyInYphN7Wvxb7snFM3u+SLA= +github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 h1:fhqpLE3UEXi9lPaBRpQ6XuRW0nU7hgg4zlmZZa+a9q4= +github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0/go.mod h1:7dCRMLwisfRH3dBupKeNCioWYUZ4SS09Z14H+7i8ZoY= github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg= github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E= -github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 h1:XRzhVemXdgvJqCH0sFfrBUTnUJSBrBf7++ypk+twtRs= -github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk= +github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 h1:RHK7bS+HQMslb1sZpAokUt+zTVmue0hKSs2C791hhzU= +github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk= github.com/BurntSushi/locker v0.0.0-20171006230638-a6e239ea1c69 h1:+tu3HOoMXB7RXEINRVIpxJCT+KdYiI7LAEAUrOw3dIU= github.com/BurntSushi/locker v0.0.0-20171006230638-a6e239ea1c69/go.mod h1:L1AbZdiDllfyYH5l5OkAaZtk7VkWe89bPJFmnDBNHxg= github.com/DATA-DOG/go-sqlmock v1.5.2 h1:OcvFkGmslmlZibjAjaHm3L//6LiuBgolP7OputlJIzU= @@ -170,46 +170,46 @@ github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z github.com/atotto/clipboard v0.1.4/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI= github.com/awalterschulze/gographviz v2.0.3+incompatible h1:9sVEXJBJLwGX7EQVhLm2elIKCm7P2YHFC8v6096G09E= github.com/awalterschulze/gographviz v2.0.3+incompatible/go.mod h1:GEV5wmg4YquNw7v1kkyoX9etIk8yVmXj+AkDHuuETHs= -github.com/aws/aws-sdk-go-v2 v1.42.1 h1:9eOTgu1z/dVtYpNZ3/8/XbbaX0x/BqE3HUzAzs6K0ek= -github.com/aws/aws-sdk-go-v2 v1.42.1/go.mod h1:5pKeft2eJj+gElQ38Jqg4ibCqh+/AK33/0X3hip7IjM= +github.com/aws/aws-sdk-go-v2 v1.43.2 h1:cl+IXwWb3qazClUcm08tGSsB6OiuV83JVJO9B0jQcPc= +github.com/aws/aws-sdk-go-v2 v1.43.2/go.mod h1:WEzLKBh/mEjXvx1FtQMWgSxMSTVqxQzjkRtk5fa3wkg= github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.13 h1:p1BBrg/Hhp6uK7zpejeI8QFXHJeC/mynzi04Sl03k9g= github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.13/go.mod h1:8cIfkE9MDhkRZGpQ22aV6/lkYeYSozpz16Smrs5x4Ls= -github.com/aws/aws-sdk-go-v2/config v1.32.25 h1:ACCejvStYoilgwrfegSt5ZntCbPrk52qfwyNcnl3omM= -github.com/aws/aws-sdk-go-v2/config v1.32.25/go.mod h1:LJyU8sDRbXUxFn8xMJIGP+v9QYYwveNLI8a/giAOiAs= -github.com/aws/aws-sdk-go-v2/credentials v1.19.24 h1:2hQqYCV9yqyePQ9o6dCrZc/zO8U3TwPr9mIKlZnPu/I= -github.com/aws/aws-sdk-go-v2/credentials v1.19.24/go.mod h1:IDwpACtwqHLISdzfwUUNq4P9DsB/h5BLg4FwJPNfqFY= -github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.29 h1:r6qZHbT+wxgWO/e9vYNUEtg7lv5+UN3pRqKhLXvnArg= -github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.29/go.mod h1:QRnaRcTVGKPGRy8w78HMQtKUGRYcnMZAANATkeVA6Mo= +github.com/aws/aws-sdk-go-v2/config v1.32.33 h1:M1m/Q6f0OKDEDGwhiNOqx1OjTdrewe3v+GDbHmKczWk= +github.com/aws/aws-sdk-go-v2/config v1.32.33/go.mod h1:fGj1iQj2QpIZzp7jE4aQQ+71TE8cd4z9K4+xCd6EqmE= +github.com/aws/aws-sdk-go-v2/credentials v1.19.32 h1:eNE0JnIblBo1NCvd3tqEYuZz9XDefn69R74CHd3nT7U= +github.com/aws/aws-sdk-go-v2/credentials v1.19.32/go.mod h1:yYJu+6tqKUYZuJSYcpSGjz/6sV/SUaAaKIufnWKx2OU= +github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.33 h1:MobhiR6KIerWxmO74Zit5I3379+mSc2DOdZ3DeRFB9w= +github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.33/go.mod h1:xu02847OdZfNr/jAfZpHtyRk0b3v4d0kaoxNHxZGG/w= github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.6.14 h1:gKXU53GYsPuYgkdTdMHh6vNdcbIgoxFQLQGjg+iRG+k= github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.6.14/go.mod h1:jyoemRAktfCyZR9bTb5gT3kn/Vj2KwYDm0Pev5TsmEQ= -github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30 h1:xM/Is9cKMHa8Jj8zkvWhvrFkZsXJV9E+BB4g0HW0duQ= -github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30/go.mod h1:WueJeNDZvK1fMYEWJIkcivBfEzUkTpBhzlrUKKY8EuA= -github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30 h1:jn46zC9LdsVR/ZpMIJqMqb8hHv31BlLx3ulVqNspUOk= -github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30/go.mod h1:1hTMsAgbdS/AtUi4bw8+gUuh1pceo+eXRLfpSuSQj3M= -github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.31 h1:3GUprIsfmGcC5SACIyB0e7E0BM1O1b3Erl5CePYIAeQ= -github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.31/go.mod h1:7PuV1yl5e2xnUbm+RqvVg5i2iBM8EyijZNoI9wsOoOc= -github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13 h1:mbRIur/BiHK6SKPjoBIXSE/hJ6g6JGRLuxQy1jGjlN4= -github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13/go.mod h1:ITg9em2KbJx1s0y4aqRX5OYWG6HBZ5TVR//OdpEZ2CQ= +github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.33 h1:HAp1wLFZzch054uh3FK7rcVYg4v7J2FxVf3h3IGNZas= +github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.33/go.mod h1:mJk5fmqnF+WUlMdPG37pR2Fh3oh6r8F6ZGUgPKvzu0c= +github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.33 h1:0YA0aCKgsJyno6xkFfaIgjE3/wK08+Qxo9nQfe1UrWM= +github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.33/go.mod h1:UZqj4WIdTH+ga8Y/DgpAuy/8cGjM3h7gDCliJYGg2SE= +github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.34 h1:HQYnjFnXpX8EbPW5M1QT8mXzesRPwly0HEPTcFlS02Y= +github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.34/go.mod h1:tGzj56niKYZBbDIRhwPGDqrULzmWv5b6uBQGqyNaFZw= +github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.14 h1:SA43nfaY7+1jjMNIc2ywu99JLJLButtIdLP6j+bT870= +github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.14/go.mod h1:Du3llKcwbQvHsTXSLzTOGQz0DTDBMEzdg7DAGu7inrY= github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.22 h1:V51LGlOq/1VsDsHUdoklAQi7rMmx4qQubvFYAlP2254= github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.22/go.mod h1:4Pzhyz8hJOm2bepgl+NjvRx8vlUFAIIvJnZ/MkcNPpU= -github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.30 h1:/Z5jmNrKsSD7EmDjzAPsm/3L9IuOkzaynklJZ1qX7S4= -github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.30/go.mod h1:lEzEZnOosE7zi8Z6royW1cFJTD9fpab4Ul1SBrllewk= +github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.33 h1:mqI7OrxN/DUH85F5OqVn3cIfuZ3+HVcebUm2N8mLlgQ= +github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.33/go.mod h1:eZ5jdEpvaaOU8nWWE4cTAJETSEA5FZoWxvNRao4piHY= github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.29 h1:hiME6pBzC7OTl9LMtlyTWBuEl1f4QBcUmFDKC7MLXtc= github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.29/go.mod h1:G7RP+uhagpKtKhd1BM9N6JQqjCcGEU47K5lBVZQyRQw= github.com/aws/aws-sdk-go-v2/service/s3 v1.103.3 h1:JRseEu/vIDMaWis4bSw0QbXL+cvIGc1XnX076H5ZXLE= github.com/aws/aws-sdk-go-v2/service/s3 v1.103.3/go.mod h1:77ZAgynvx1txMvDG8gGWoWkO1augYDxkp9JElWFgjQU= -github.com/aws/aws-sdk-go-v2/service/signin v1.2.0 h1:3nXpRcFwRCW8n7HgO2QGy0Dc20eQNfBuUemGQhpF8m8= -github.com/aws/aws-sdk-go-v2/service/signin v1.2.0/go.mod h1:LxYujSTLPRlp2vTtcUO/+1ilrew8ytt6SvQyOgejzFQ= +github.com/aws/aws-sdk-go-v2/service/signin v1.5.2 h1:EjI1CZzDcBxPkTa3j1BdtIrUDbqnOGssFMeyUS+6W0I= +github.com/aws/aws-sdk-go-v2/service/signin v1.5.2/go.mod h1:vN3eb5H8MEAZ4dx0F5Wc9LT8eb3eW7bZZ5BjGJdbw9k= github.com/aws/aws-sdk-go-v2/service/ssm v1.67.4 h1:pOwUUY5FzKUsxtxGR6qsczZP7MuZMVlMbAOPQOcmJlo= github.com/aws/aws-sdk-go-v2/service/ssm v1.67.4/go.mod h1:+nlWvcgDPQ56mChEBzTC0puAMck+4onOFaHg5cE+Lgg= -github.com/aws/aws-sdk-go-v2/service/sso v1.31.3 h1:ey1XLTYXb9PcLt4535632o5kCGXNXEhNb620Dqwuylo= -github.com/aws/aws-sdk-go-v2/service/sso v1.31.3/go.mod h1:Lk7PlmoTYryQmyBG0EXqj5BcUbj3whXdU2s3yGI3EAc= -github.com/aws/aws-sdk-go-v2/service/ssooidc v1.36.6 h1:yLr03zQE/5Eu5l3QU0Si+xMbLMbSDF2YXsigqXngs6g= -github.com/aws/aws-sdk-go-v2/service/ssooidc v1.36.6/go.mod h1:Q5N6icH+KJZDLh+ESNwzdv6cZ6vLFF/egy3IOxWhmz4= -github.com/aws/aws-sdk-go-v2/service/sts v1.44.0 h1:bLZ0PolJ8J+HkJHztcXORUpHXBye2U8298lCEMi6ZCU= -github.com/aws/aws-sdk-go-v2/service/sts v1.44.0/go.mod h1:9gdl4RrflIdpDb2TlXshWgR1F9TeCkvqDx77Vpr4Z/Q= -github.com/aws/smithy-go v1.27.3 h1:F3Zb497UhhskkfpJmfkXswyo+t0sh9OTBnIHjogWbVY= -github.com/aws/smithy-go v1.27.3/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc= +github.com/aws/aws-sdk-go-v2/service/sso v1.33.2 h1:zMP1FDFE08L7sM5f1QqkH/ZgKKg8Uc0Dz7KhSSYqWkw= +github.com/aws/aws-sdk-go-v2/service/sso v1.33.2/go.mod h1:0LoIZSUKjdo2BleHfT1hv/jlD33LQS00IrBlzoUsoUQ= +github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.2 h1:9eTqUYl+SyVmaRPMyBXSO9wwqC6TRwZB82pKENK2hdQ= +github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.2/go.mod h1:DThweuz22kiLc7lGHop5vQ9c3bx5W6Azs/YqSHa2fu8= +github.com/aws/aws-sdk-go-v2/service/sts v1.45.2 h1:EJd8vZO3E8SE6nmPqxuxlQ1NeSb8as50sf6eGdV4Saw= +github.com/aws/aws-sdk-go-v2/service/sts v1.45.2/go.mod h1:OgpPvKzsO2Ranjpli/20djMkg6UrV5mw4W3pZpq1Mqo= +github.com/aws/smithy-go v1.27.5 h1:d1ro7KpYOYwP6m73YFa+Kc/A130VsAdX68SpsJwARMM= +github.com/aws/smithy-go v1.27.5/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc= github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k= github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8= github.com/aymanbagabas/go-udiff v0.4.1 h1:OEIrQ8maEeDBXQDoGCbbTTXYJMYRCRO1fnodZ12Gv5o= @@ -345,8 +345,8 @@ github.com/coder/guts v1.7.0 h1:TaZ/PR9wgN8dlbcckaWV1MxkkuEFZRwSRwBBEm8dYXs= github.com/coder/guts v1.7.0/go.mod h1:30SShdvpmsauNlsNjECRB5AppScjYk08rf2ZVpH3MFg= github.com/coder/gvisor v0.0.0-20260313164934-7a658db7b714 h1:j7tyq3rv0ZXkbyy/BE5K3lYiIqEsV8sDTiTjpLLxjiw= github.com/coder/gvisor v0.0.0-20260313164934-7a658db7b714/go.mod h1:sxc3Uvk/vHcd3tj7/DHVBoR5wvWT/MmRq2pj7HRJnwU= -github.com/coder/openai-go/v3 v3.0.0-20260708125056-3633b71968f7 h1:YEThquYyw8RkFRojQdrGIYUQ4juXvsUNFfx1ZN9II+U= -github.com/coder/openai-go/v3 v3.0.0-20260708125056-3633b71968f7/go.mod h1:cdufnVK14cWcT9qA1rRtrXx4FTRsgbDPW7Ia7SS5cZo= +github.com/coder/openai-go/v3 v3.0.0-20260810175933-92b5addb22d2 h1:84CQp2XsKlhthzgSmAJXJCYqOu3eHS/CWPSDTNFdY24= +github.com/coder/openai-go/v3 v3.0.0-20260810175933-92b5addb22d2/go.mod h1:Ogjo0gDct+Jm7yCqaCjLGQGygeV8xNfNHV1/yKvCji0= github.com/coder/pq v1.10.5-0.20250807075151-6ad9b0a25151 h1:YAxwg3lraGNRwoQ18H7R7n+wsCqNve7Brdvj0F1rDnU= github.com/coder/pq v1.10.5-0.20250807075151-6ad9b0a25151/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o= github.com/coder/pretty v0.0.0-20230908205945-e89ba86370e0 h1:3A0ES21Ke+FxEM8CXx9n47SZOKOpgSE1bbJzlE4qPVs= @@ -1188,8 +1188,8 @@ github.com/testcontainers/testcontainers-go/modules/localstack v0.40.0/go.mod h1 github.com/tetratelabs/wazero v1.12.0 h1:DuWcpNu/FzgEXgGBDp8J1Spc+CWOvvtvVyjKlaZopYU= github.com/tetratelabs/wazero v1.12.0/go.mod h1:LvKtzl2RqO4gyF27BiXU+nKAjcV8f38U+kP/q2vgxh0= github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk= -github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY= -github.com/tidwall/gjson v1.18.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk= +github.com/tidwall/gjson v1.19.0 h1:xwxm7n691Uf3u5OFjzngavjGTh55KX5q/9w9xHW88JU= +github.com/tidwall/gjson v1.19.0/go.mod h1:V37/opeE/JbLUOfH0QTXiNez2l0RUjYUhpT4szFQAfc= github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM= github.com/tidwall/match v1.2.0 h1:0pt8FlkOwjN2fPt4bIl4BoNxb98gGHN2ObFEDkrfZnM= github.com/tidwall/match v1.2.0/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM= From 10fd510ada0e3a7c222511dbd9916f83afd1acf0 Mon Sep 17 00:00:00 2001 From: Steven Masley Date: Mon, 31 Aug 2026 20:37:18 -0500 Subject: [PATCH 52/69] chore: purge identified terraform modules via dbpurge (#28802) (#28816) Cherry-pick of [#28802](https://github.com/coder/coder/pull/28802) (`e2a856d42b`), matching [#28810](https://github.com/coder/coder/pull/28810) for `release/2.37`. Deletes cached Terraform module archives ingested during the identified window and clears the template version references to them. Runs from `dbpurge` rather than a migration, because migrations cannot be backported: the version table records a single high-water mark, so a migration cherry-picked here would cause later upgrades to skip every migration in between. ## Conflict resolution The commit did not apply cleanly. This branch predates the chat search work on `main`, so the incoming hunks carried unrelated context that was dropped: - `dbpurge.go`: took only the module cache block, the `ranModuleCachePurge` latch, the window constants, the `identified_module_files` log field and metric, and the `identifiedModuleCachePurged` instance field. This branch has the `chat_messages.search_tsv` backfill but not the stale reindex added in #28585, so the reindex loop, `staleDrained`, and `chatSearchStaleDrained` were dropped. - `dbpurge_test.go`: took `TestDeleteIdentifiedModuleCacheFiles`. In the two `TestMetrics` mock setups, added only the `DeleteCachedModuleFilesCreatedBetween` expectation, dropping `ReindexStaleChatMessagesSearchTsv`. - Generated files (`querier.go`, `queries.sql.go`, `dbmetrics`, `dbmock`, and the `dbauthz` stub) were reset to the branch state and regenerated from `queries/files.sql`, rather than taking the diff from `main`. Taking `main`'s versions would have introduced methods for queries that do not exist on this branch. ## Testing `coderd/database/dbpurge` and `TestMethodTestSuite` in `coderd/database/dbauthz` pass against Postgres. `make gen` is clean. Pre-commit hooks were skipped on the final commit at the author's request after the checks above had already been run; `make gen`, build, and lint were verified separately during conflict resolution. --- Opened by Coder Agents on behalf of @Emyrk. --- coderd/database/dbauthz/dbauthz.go | 7 + coderd/database/dbauthz/dbauthz_test.go | 5 + coderd/database/dbmetrics/querymetrics.go | 8 ++ coderd/database/dbmock/dbmock.go | 15 +++ coderd/database/dbpurge/dbpurge.go | 43 ++++++ .../database/dbpurge/dbpurge_internal_test.go | 14 ++ coderd/database/dbpurge/dbpurge_test.go | 126 ++++++++++++++++++ coderd/database/querier.go | 6 + coderd/database/queries.sql.go | 52 ++++++++ coderd/database/queries/files.sql | 38 ++++++ 10 files changed, 314 insertions(+) diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go index 32333c7bfd8..50db6bd4374 100644 --- a/coderd/database/dbauthz/dbauthz.go +++ b/coderd/database/dbauthz/dbauthz.go @@ -2138,6 +2138,13 @@ func (q *querier) DeleteApplicationConnectAPIKeysByUserID(ctx context.Context, u return q.db.DeleteApplicationConnectAPIKeysByUserID(ctx, userID) } +func (q *querier) DeleteCachedModuleFilesCreatedBetween(ctx context.Context, arg database.DeleteCachedModuleFilesCreatedBetweenParams) (int64, error) { + if err := q.authorizeContext(ctx, policy.ActionDelete, rbac.ResourceSystem); err != nil { + return 0, err + } + return q.db.DeleteCachedModuleFilesCreatedBetween(ctx, arg) +} + func (q *querier) DeleteChatContextResourcesByChatID(ctx context.Context, chatID uuid.UUID) error { chat, err := q.db.GetChatByID(ctx, chatID) if err != nil { diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go index a652c37c232..893999a21fb 100644 --- a/coderd/database/dbauthz/dbauthz_test.go +++ b/coderd/database/dbauthz/dbauthz_test.go @@ -5364,6 +5364,11 @@ func (s *MethodTestSuite) TestSystemFunctions() { dbm.EXPECT().DeleteOldWorkspaceAgentLogs(gomock.Any(), t).Return(int64(0), nil).AnyTimes() check.Args(t).Asserts(rbac.ResourceSystem, policy.ActionDelete) })) + s.Run("DeleteCachedModuleFilesCreatedBetween", s.Mocked(func(dbm *dbmock.MockStore, _ *gofakeit.Faker, check *expects) { + arg := database.DeleteCachedModuleFilesCreatedBetweenParams{} + dbm.EXPECT().DeleteCachedModuleFilesCreatedBetween(gomock.Any(), arg).Return(int64(0), nil).AnyTimes() + check.Args(arg).Asserts(rbac.ResourceSystem, policy.ActionDelete) + })) s.Run("InsertWorkspaceAgentStats", s.Mocked(func(dbm *dbmock.MockStore, _ *gofakeit.Faker, check *expects) { arg := database.InsertWorkspaceAgentStatsParams{} dbm.EXPECT().InsertWorkspaceAgentStats(gomock.Any(), arg).Return(xerrors.New("any error")).AnyTimes() diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go index b4944e1647a..ac28d72628b 100644 --- a/coderd/database/dbmetrics/querymetrics.go +++ b/coderd/database/dbmetrics/querymetrics.go @@ -489,6 +489,14 @@ func (m queryMetricsStore) DeleteApplicationConnectAPIKeysByUserID(ctx context.C return r0 } +func (m queryMetricsStore) DeleteCachedModuleFilesCreatedBetween(ctx context.Context, arg database.DeleteCachedModuleFilesCreatedBetweenParams) (int64, error) { + start := time.Now() + r0, r1 := m.s.DeleteCachedModuleFilesCreatedBetween(ctx, arg) + m.queryLatencies.WithLabelValues("DeleteCachedModuleFilesCreatedBetween").Observe(time.Since(start).Seconds()) + m.queryCounts.WithLabelValues(httpmw.ExtractHTTPRoute(ctx), httpmw.ExtractHTTPMethod(ctx), "DeleteCachedModuleFilesCreatedBetween").Inc() + return r0, r1 +} + func (m queryMetricsStore) DeleteChatContextResourcesByChatID(ctx context.Context, chatID uuid.UUID) error { start := time.Now() r0 := m.s.DeleteChatContextResourcesByChatID(ctx, chatID) diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go index cb0ead8a046..be424a0d85d 100644 --- a/coderd/database/dbmock/dbmock.go +++ b/coderd/database/dbmock/dbmock.go @@ -790,6 +790,21 @@ func (mr *MockStoreMockRecorder) DeleteApplicationConnectAPIKeysByUserID(ctx, us return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteApplicationConnectAPIKeysByUserID", reflect.TypeOf((*MockStore)(nil).DeleteApplicationConnectAPIKeysByUserID), ctx, userID) } +// DeleteCachedModuleFilesCreatedBetween mocks base method. +func (m *MockStore) DeleteCachedModuleFilesCreatedBetween(ctx context.Context, arg database.DeleteCachedModuleFilesCreatedBetweenParams) (int64, error) { + m.ctrl.T.Helper() + ret := m.ctrl.Call(m, "DeleteCachedModuleFilesCreatedBetween", ctx, arg) + ret0, _ := ret[0].(int64) + ret1, _ := ret[1].(error) + return ret0, ret1 +} + +// DeleteCachedModuleFilesCreatedBetween indicates an expected call of DeleteCachedModuleFilesCreatedBetween. +func (mr *MockStoreMockRecorder) DeleteCachedModuleFilesCreatedBetween(ctx, arg any) *gomock.Call { + mr.mock.ctrl.T.Helper() + return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteCachedModuleFilesCreatedBetween", reflect.TypeOf((*MockStore)(nil).DeleteCachedModuleFilesCreatedBetween), ctx, arg) +} + // DeleteChatContextResourcesByChatID mocks base method. func (m *MockStore) DeleteChatContextResourcesByChatID(ctx context.Context, chatID uuid.UUID) error { m.ctrl.T.Helper() diff --git a/coderd/database/dbpurge/dbpurge.go b/coderd/database/dbpurge/dbpurge.go index 7c284339d0e..f84372cde6b 100644 --- a/coderd/database/dbpurge/dbpurge.go +++ b/coderd/database/dbpurge/dbpurge.go @@ -59,6 +59,20 @@ const ( chatSearchBackfillMaxBatches = 5 ) +// Terraform module archives ingested during this window may contain the +// identified upstream module. +// +// This is a one-off cleanup, not a recurring purge. It runs once per coderd +// process because the window is fixed in the past: after a successful pass +// there is nothing left to match. It lives here rather than in a migration +// because migrations cannot be backported. The version table records a single +// high-water mark, so a migration cherry-picked onto a release branch would +// cause later upgrades to skip every migration in between. +var ( + identifiedModuleCacheStart = time.Date(2026, 8, 31, 8, 0, 0, 0, time.UTC) + identifiedModuleCacheEnd = time.Date(2026, 8, 31, 22, 0, 0, 0, time.UTC) +) + type Option func(*instance) // WithClock overrides the clock used by the purger. Defaults to @@ -181,6 +195,10 @@ func (i *instance) purgeTick(ctx context.Context, db database.Store, start time. chatConfigErr := errors.Join(chatRetentionErr, chatDebugRetentionErr) + // Latched after a successful commit so the one-off module cache cleanup + // is attempted again if the transaction rolls back. + ranModuleCachePurge := false + // Start a transaction to grab advisory lock, we don't want to run // multiple purges at the same time (multiple replicas). err := db.InTx(func(tx database.Store) error { @@ -354,6 +372,20 @@ func (i *instance) purgeTick(ctx context.Context, db database.Store, start time. } } + // One-off cleanup of the identified Terraform module cache. Skipped + // once this process has completed a pass. + var purgedIdentifiedModuleFiles int64 + if !i.identifiedModuleCachePurged { + purgedIdentifiedModuleFiles, err = tx.DeleteCachedModuleFilesCreatedBetween(ctx, database.DeleteCachedModuleFilesCreatedBetweenParams{ + CreatedAtAfter: identifiedModuleCacheStart, + CreatedAtBefore: identifiedModuleCacheEnd, + }) + if err != nil { + return xerrors.Errorf("failed to delete identified module cache files: %w", err) + } + ranModuleCachePurge = true + } + i.logger.Debug(ctx, "purged old database entries", slog.F("workspace_agent_logs", purgedWorkspaceAgentLogs), slog.F("expired_api_keys", expiredAPIKeys), @@ -367,6 +399,7 @@ func (i *instance) purgeTick(ctx context.Context, db database.Store, start time. slog.F("chat_files", purgedChatFiles), slog.F("chat_debug_runs", purgedChatDebugRuns), slog.F("chat_search_rows_backfilled", backfilledChatSearchRows), + slog.F("identified_module_files", purgedIdentifiedModuleFiles), slog.F("duration", i.clk.Since(start)), ) @@ -382,6 +415,7 @@ func (i *instance) purgeTick(ctx context.Context, db database.Store, start time. i.recordsPurged.WithLabelValues("chats").Add(float64(purgedChats)) i.recordsPurged.WithLabelValues("chat_debug_runs").Add(float64(purgedChatDebugRuns)) i.recordsPurged.WithLabelValues("chat_files").Add(float64(purgedChatFiles)) + i.recordsPurged.WithLabelValues("identified_module_files").Add(float64(purgedIdentifiedModuleFiles)) } if i.chatSearchRowsBackfilled != nil { i.chatSearchRowsBackfilled.Add(float64(backfilledChatSearchRows)) @@ -400,6 +434,10 @@ func (i *instance) purgeTick(ctx context.Context, db database.Store, start time. return err } + if ranModuleCachePurge { + i.identifiedModuleCachePurged = true + } + // Surface the deferred chat-config error so doTick records // the failed iteration metric. if chatConfigErr != nil { @@ -420,6 +458,11 @@ type instance struct { chatSearchRowsBackfilled prometheus.Counter chatSearchBackfillBatchSize int32 chatSearchBackfillMaxBatches int + + // identifiedModuleCachePurged latches once this process has completed a + // pass of the one-off module cache cleanup. The window is fixed in the + // past, so a completed pass leaves nothing to match on later ticks. + identifiedModuleCachePurged bool } func (i *instance) Close() error { diff --git a/coderd/database/dbpurge/dbpurge_internal_test.go b/coderd/database/dbpurge/dbpurge_internal_test.go index f49426e9560..a7fe08d1ebd 100644 --- a/coderd/database/dbpurge/dbpurge_internal_test.go +++ b/coderd/database/dbpurge/dbpurge_internal_test.go @@ -43,3 +43,17 @@ func TestDBPurgeAuthorization(t *testing.T) { err := inst.purgeTick(ctx, db, now) require.NoError(t, err) } + +// The behavior of the one-off module cache cleanup is covered by +// TestDeleteIdentifiedModuleCacheFiles, which supplies its own window. This +// guards the production constants themselves, which that test no longer reads. +func TestIdentifiedModuleCacheWindow(t *testing.T) { + t.Parallel() + + require.True(t, identifiedModuleCacheStart.Before(identifiedModuleCacheEnd), + "window start must precede window end") + require.Equal(t, time.UTC, identifiedModuleCacheStart.Location(), + "window bounds must be UTC so they do not shift with the host timezone") + require.Equal(t, time.UTC, identifiedModuleCacheEnd.Location(), + "window bounds must be UTC so they do not shift with the host timezone") +} diff --git a/coderd/database/dbpurge/dbpurge_test.go b/coderd/database/dbpurge/dbpurge_test.go index 25e780ec3d2..ce25f7aa63d 100644 --- a/coderd/database/dbpurge/dbpurge_test.go +++ b/coderd/database/dbpurge/dbpurge_test.go @@ -4,6 +4,7 @@ import ( "bufio" "bytes" "context" + "crypto/sha256" "database/sql" "encoding/json" "fmt" @@ -256,6 +257,7 @@ func TestMetrics(t *testing.T) { mDB.EXPECT().DeleteOldWorkspaceBuildOrchestrations(gomock.Any(), gomock.Any()).Return(int64(0), nil).AnyTimes() mDB.EXPECT().DeleteOldAuditLogConnectionEvents(gomock.Any(), gomock.Any()).Return(nil).AnyTimes() mDB.EXPECT().BackfillChatMessagesSearchTsv(gomock.Any(), gomock.Any()).Return(int64(0), nil).AnyTimes() + mDB.EXPECT().DeleteCachedModuleFilesCreatedBetween(gomock.Any(), gomock.AssignableToTypeOf(database.DeleteCachedModuleFilesCreatedBetweenParams{})).Return(int64(0), nil).AnyTimes() mDB.EXPECT().DeleteOldChatDebugRuns(gomock.Any(), gomock.AssignableToTypeOf(database.DeleteOldChatDebugRunsParams{})).Return(int64(0), nil).MinTimes(1) mDB.EXPECT().InTx(gomock.Any(), database.DefaultTXOptions().WithID("db_purge")). DoAndReturn(func(f func(database.Store) error, _ *database.TxOptions) error { @@ -308,6 +310,7 @@ func TestMetrics(t *testing.T) { mDB.EXPECT().DeleteOldWorkspaceBuildOrchestrations(gomock.Any(), gomock.Any()).Return(int64(0), nil).AnyTimes() mDB.EXPECT().DeleteOldAuditLogConnectionEvents(gomock.Any(), gomock.Any()).Return(nil).AnyTimes() mDB.EXPECT().BackfillChatMessagesSearchTsv(gomock.Any(), gomock.Any()).Return(int64(0), nil).AnyTimes() + mDB.EXPECT().DeleteCachedModuleFilesCreatedBetween(gomock.Any(), gomock.AssignableToTypeOf(database.DeleteCachedModuleFilesCreatedBetweenParams{})).Return(int64(0), nil).AnyTimes() mDB.EXPECT().DeleteOldChats(gomock.Any(), gomock.AssignableToTypeOf(database.DeleteOldChatsParams{})).Return(int64(0), nil).MinTimes(1) mDB.EXPECT().DeleteOldChatFiles(gomock.Any(), gomock.AssignableToTypeOf(database.DeleteOldChatFilesParams{})).Return(int64(0), nil).MinTimes(1) mDB.EXPECT().InTx(gomock.Any(), database.DefaultTXOptions().WithID("db_purge")). @@ -3236,3 +3239,126 @@ func TestBackfillChatMessagesSearchTsv(t *testing.T) { testutil.TryReceive(ctx, t, done) }) } + +//nolint:paralleltest // It uses LockIDDBPurge. +func TestDeleteIdentifiedModuleCacheFiles(t *testing.T) { + ctx := testutil.Context(t, testutil.WaitShort) + clk := quartz.NewMock(t) + clk.Set(dbtime.Now()).MustWait(ctx) + + // The window under test is supplied explicitly rather than copied from the + // production constants, so revising the incident timestamps cannot silently + // invalidate these boundary assertions. + windowStart := time.Date(2026, 8, 31, 8, 0, 0, 0, time.UTC) + windowEnd := time.Date(2026, 8, 31, 22, 0, 0, 0, time.UTC) + inWindow := windowStart.Add(time.Minute) + + db, _ := dbtestutil.NewDB(t, dbtestutil.WithDumpOnFailure()) + org := dbgen.Organization(t, db, database.Organization{}) + user := dbgen.User(t, db, database.User{}) + _ = dbgen.OrganizationMember(t, db, database.OrganizationMember{UserID: user.ID, OrganizationID: org.ID}) + + logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}) + + mkFile := func(name string, createdBy uuid.UUID, mimetype string, createdAt time.Time) database.File { + file, err := db.InsertFile(ctx, database.InsertFileParams{ + ID: uuid.New(), + Hash: fmt.Sprintf("%x", sha256.Sum256([]byte(name))), + CreatedBy: createdBy, + CreatedAt: createdAt, + Mimetype: mimetype, + Data: []byte{}, + }) + require.NoError(t, err, "insert file %q", name) + return file + } + + // mkVersion creates a template version whose cached module files point at a + // file with the given properties. InsertFile is used directly because + // dbgen.File treats uuid.Nil as unset and substitutes a random creator, + // while uuid.Nil is exactly what identifies a provisionerd module archive. + mkVersion := func(name string, createdBy uuid.UUID, mimetype string, createdAt time.Time) (database.File, database.TemplateVersion) { + file := mkFile(name, createdBy, mimetype, createdAt) + tv := dbgen.TemplateVersion(t, db, database.TemplateVersion{ + Name: name, + OrganizationID: org.ID, + CreatedBy: user.ID, + }) + _ = dbgen.TemplateVersionTerraformValues(t, db, database.TemplateVersionTerraformValue{ + TemplateVersionID: tv.ID, + CachedModuleFiles: uuid.NullUUID{UUID: file.ID, Valid: true}, + }) + return file, tv + } + + // Identified: a provisionerd module archive cached inside the window. + identified, identifiedTV := mkVersion("identified", uuid.Nil, "application/x-tar", inWindow) + // The lower bound is inclusive. + atStart, atStartTV := mkVersion("at-start", uuid.Nil, "application/x-tar", windowStart) + // The upper bound is exclusive, so this archive is known good. + atEnd, atEndTV := mkVersion("at-end", uuid.Nil, "application/x-tar", windowEnd) + // Cached before and after the window. + before, beforeTV := mkVersion("before", uuid.Nil, "application/x-tar", windowStart.Add(-time.Hour)) + after, afterTV := mkVersion("after", uuid.Nil, "application/x-tar", windowEnd.Add(time.Hour)) + // A user-uploaded template tarball shares the mimetype but has a real + // creator, so it must survive even though it is inside the window. + userUpload, userUploadTV := mkVersion("user-upload", user.ID, "application/x-tar", inWindow) + + // An unreferenced archive inside the window. Only archives referenced by a + // template version are in scope. + orphan := mkFile("orphan", uuid.Nil, "application/x-tar", inWindow) + + // when dbpurge runs + tick := awaitDoTicks(ctx, t, clk, 2) + closer := dbpurge.New(ctx, logger, db, &codersdk.DeploymentValues{}, prometheus.NewRegistry(), dbpurge.WithClock(clk)) + defer closer.Close() + tick() // doTick() has now run. + + assertFileDeleted := func(id uuid.UUID, name string) { + t.Helper() + _, err := db.GetFileByID(ctx, id) + require.ErrorIs(t, err, sql.ErrNoRows, "%s should be deleted", name) + } + assertFileExists := func(id uuid.UUID, name string) { + t.Helper() + _, err := db.GetFileByID(ctx, id) + require.NoError(t, err, "%s should be retained", name) + } + // assertCacheRef checks the template version still exists and that its + // module cache reference was cleared only when the file was deleted. + assertCacheRef := func(tv database.TemplateVersion, wantFile uuid.UUID, wantValid bool, name string) { + t.Helper() + values, err := db.GetTemplateVersionTerraformValues(ctx, tv.ID) + require.NoError(t, err, "%s: terraform values row must be retained", name) + require.Equal(t, wantValid, values.CachedModuleFiles.Valid, "%s: cache reference validity", name) + if wantValid { + require.Equal(t, wantFile, values.CachedModuleFiles.UUID, "%s: cache reference target", name) + } + } + + // then the identified archives are deleted and their references cleared + assertFileDeleted(identified.ID, "archive inside the window") + assertCacheRef(identifiedTV, uuid.Nil, false, "archive inside the window") + assertFileDeleted(atStart.ID, "archive at the inclusive lower bound") + assertCacheRef(atStartTV, uuid.Nil, false, "archive at the inclusive lower bound") + + // and everything else is untouched + assertFileExists(atEnd.ID, "archive at the exclusive upper bound") + assertCacheRef(atEndTV, atEnd.ID, true, "archive at the exclusive upper bound") + assertFileExists(before.ID, "archive cached before the window") + assertCacheRef(beforeTV, before.ID, true, "archive cached before the window") + assertFileExists(after.ID, "archive cached after the window") + assertCacheRef(afterTV, after.ID, true, "archive cached after the window") + assertFileExists(userUpload.ID, "user-uploaded tarball") + assertCacheRef(userUploadTV, userUpload.ID, true, "user-uploaded tarball") + assertFileExists(orphan.ID, "unreferenced archive") + + // The cleanup is one-off, not a recurring purge. A second tick must not + // repeat it, so an archive inserted into the window after the first pass + // survives. This documents the latch: the window is fixed in the past and + // nothing can legitimately land in it again. + late, lateTV := mkVersion("late", uuid.Nil, "application/x-tar", inWindow) + tick() + assertFileExists(late.ID, "archive inserted after the one-off pass") + assertCacheRef(lateTV, late.ID, true, "archive inserted after the one-off pass") +} diff --git a/coderd/database/querier.go b/coderd/database/querier.go index 527168ba4a4..fb5434ff014 100644 --- a/coderd/database/querier.go +++ b/coderd/database/querier.go @@ -133,6 +133,12 @@ type sqlcQuerier interface { // be recreated. DeleteAllWebpushSubscriptions(ctx context.Context) error DeleteApplicationConnectAPIKeysByUserID(ctx context.Context, userID uuid.UUID) error + // Deletes cached Terraform module archives ingested in the given time range and + // clears the template version references to them. created_by and mimetype + // identify a provisionerd-written module archive, matching the checks in + // provisionerdserver, so user-uploaded template tarballs are never removed. + // Only archives referenced by a template version are considered. + DeleteCachedModuleFilesCreatedBetween(ctx context.Context, arg DeleteCachedModuleFilesCreatedBetweenParams) (int64, error) // Clears a chat's pinned context resources. Used as the first half of a // clear-then-copy re-pin, and on its own when the chat's current agent // has no snapshot. diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go index 07ccd2b813a..a0c4ca93f13 100644 --- a/coderd/database/queries.sql.go +++ b/coderd/database/queries.sql.go @@ -14878,6 +14878,58 @@ func (q *sqlQuerier) UpdateExternalAuthLinkRefreshToken(ctx context.Context, arg return err } +const deleteCachedModuleFilesCreatedBetween = `-- name: DeleteCachedModuleFilesCreatedBetween :execrows +WITH doomed AS ( + SELECT + files.id + FROM + files + INNER JOIN + template_version_terraform_values + ON template_version_terraform_values.cached_module_files = files.id + WHERE + files.created_by = '00000000-0000-0000-0000-000000000000' + AND files.mimetype = 'application/x-tar' + AND files.created_at >= $1 + AND files.created_at < $2 +), cleared AS ( + -- The foreign key is NO ACTION, so references must be cleared before the + -- files rows can be deleted. Data-modifying CTEs always run to completion, + -- and the constraint is checked at the end of the statement. + UPDATE + template_version_terraform_values + SET + cached_module_files = NULL + WHERE + cached_module_files IN (SELECT id FROM doomed) + RETURNING 1 +) +DELETE FROM + files +USING + doomed +WHERE + files.id = doomed.id +` + +type DeleteCachedModuleFilesCreatedBetweenParams struct { + CreatedAtAfter time.Time `db:"created_at_after" json:"created_at_after"` + CreatedAtBefore time.Time `db:"created_at_before" json:"created_at_before"` +} + +// Deletes cached Terraform module archives ingested in the given time range and +// clears the template version references to them. created_by and mimetype +// identify a provisionerd-written module archive, matching the checks in +// provisionerdserver, so user-uploaded template tarballs are never removed. +// Only archives referenced by a template version are considered. +func (q *sqlQuerier) DeleteCachedModuleFilesCreatedBetween(ctx context.Context, arg DeleteCachedModuleFilesCreatedBetweenParams) (int64, error) { + result, err := q.db.ExecContext(ctx, deleteCachedModuleFilesCreatedBetween, arg.CreatedAtAfter, arg.CreatedAtBefore) + if err != nil { + return 0, err + } + return result.RowsAffected() +} + const getFileByHashAndCreator = `-- name: GetFileByHashAndCreator :one SELECT hash, created_at, created_by, mimetype, data, id diff --git a/coderd/database/queries/files.sql b/coderd/database/queries/files.sql index cdf6e37ce08..cefc3a2d02b 100644 --- a/coderd/database/queries/files.sql +++ b/coderd/database/queries/files.sql @@ -55,3 +55,41 @@ WHERE AND provisioner_jobs.type = 'template_version_import' AND file_id = @file_id ; + +-- name: DeleteCachedModuleFilesCreatedBetween :execrows +-- Deletes cached Terraform module archives ingested in the given time range and +-- clears the template version references to them. created_by and mimetype +-- identify a provisionerd-written module archive, matching the checks in +-- provisionerdserver, so user-uploaded template tarballs are never removed. +-- Only archives referenced by a template version are considered. +WITH doomed AS ( + SELECT + files.id + FROM + files + INNER JOIN + template_version_terraform_values + ON template_version_terraform_values.cached_module_files = files.id + WHERE + files.created_by = '00000000-0000-0000-0000-000000000000' + AND files.mimetype = 'application/x-tar' + AND files.created_at >= @created_at_after + AND files.created_at < @created_at_before +), cleared AS ( + -- The foreign key is NO ACTION, so references must be cleared before the + -- files rows can be deleted. Data-modifying CTEs always run to completion, + -- and the constraint is checked at the end of the statement. + UPDATE + template_version_terraform_values + SET + cached_module_files = NULL + WHERE + cached_module_files IN (SELECT id FROM doomed) + RETURNING 1 +) +DELETE FROM + files +USING + doomed +WHERE + files.id = doomed.id; From 0d7cd269f9a9c075304e18ebcc5df724a0800a91 Mon Sep 17 00:00:00 2001 From: Jake Howell Date: Tue, 1 Sep 2026 15:00:58 +0700 Subject: [PATCH 53/69] fix(site): dispose Monaco diff models on unmount (#28503) (#28808) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit > 🤖 This PR was written by Coder Agents on behalf of Jake Howell. Backport of #28503 to `release/2.36`. Refs [DEVEX-736](https://linear.app/codercom/issue/DEVEX-736/template-editor-crashes-becomes-unusable-when-opening-versions). This carries the Monaco diff-model lifecycle cleanup and Storybook regression coverage into 2.36, preventing template-version navigation from retaining models until the editor becomes unusable. The cherry-pick conflict was limited to theme imports. This keeps the release branch's existing `@emotion/react` integration while applying the original functional fix. Co-authored-by: Marcin Tojek --- .../SyntaxHighlighter.stories.tsx | 111 +++++++++++++ .../SyntaxHighlighter/SyntaxHighlighter.tsx | 146 ++++++++++++------ 2 files changed, 211 insertions(+), 46 deletions(-) create mode 100644 site/src/components/SyntaxHighlighter/SyntaxHighlighter.stories.tsx diff --git a/site/src/components/SyntaxHighlighter/SyntaxHighlighter.stories.tsx b/site/src/components/SyntaxHighlighter/SyntaxHighlighter.stories.tsx new file mode 100644 index 00000000000..8740b3af492 --- /dev/null +++ b/site/src/components/SyntaxHighlighter/SyntaxHighlighter.stories.tsx @@ -0,0 +1,111 @@ +import type { Meta, StoryObj } from "@storybook/react-vite"; +import type * as Monaco from "monaco-editor"; +import * as monaco from "monaco-editor"; +import { useState } from "react"; +import { expect, userEvent, waitFor } from "storybook/test"; +import { withDashboardProvider } from "#/testHelpers/storybook"; +import { SyntaxHighlighter } from "./SyntaxHighlighter"; + +const original = `resource "coder_agent" "main" { + os = "linux" + arch = "amd64" +} +`; + +const modified = `resource "coder_agent" "main" { + os = "linux" + arch = "arm64" +} +`; + +// The diff editor's gutter menu and occurrence highlighter register delayed +// disposables whose teardown throws when editors unmount in Storybook tests. +// They are irrelevant to model disposal, so we turn them off in stories to keep +// the test runner clean without changing production behavior. +const stableTeardownOptions: Monaco.editor.IStandaloneDiffEditorConstructionOptions = + { + minimap: { enabled: false }, + renderSideBySide: true, + readOnly: true, + renderGutterMenu: false, + occurrencesHighlight: "off", + }; + +const meta: Meta = { + title: "components/SyntaxHighlighter", + component: SyntaxHighlighter, + decorators: [withDashboardProvider], + args: { + language: "hcl", + editorProps: { options: stableTeardownOptions }, + }, +}; + +export default meta; +type Story = StoryObj; + +export const Plain: Story = { + args: { + value: original, + }, +}; + +export const Diff: Story = { + args: { + value: modified, + compareWith: original, + }, +}; + +// Reproduces the leak from DEVEX-736: a single SyntaxHighlighter instance that +// stays mounted while a file switches between diff and plain across template +// versions. Each diff editor owns two Monaco models, and they must be disposed +// when the diff goes away. Before the fix the models were only disposed on full +// unmount, so toggling diff -> plain -> diff leaked two models per cycle. +const DiffToggle = () => { + const [showDiff, setShowDiff] = useState(true); + return ( +

+ + +

+ ); +}; + +export const DisposesModelsOnDiffToggle: Story = { + render: () => , + play: async ({ canvas }) => { + const toggle = canvas.getByRole("button", { name: "Toggle diff" }); + + // Wait for the diff editor to mount its original + modified models, then + // record the total as a baseline. Every full toggle cycle must return to + // this number; growth would mean abandoned models are being retained. + let baseline = 0; + await waitFor(() => { + baseline = monaco.editor.getModels().length; + expect(baseline).toBeGreaterThanOrEqual(2); + }); + + for (let cycle = 0; cycle < 3; cycle++) { + // Switch to plain: the diff editor unmounts and must dispose its models. + await userEvent.click(toggle); + await waitFor(() => + expect(monaco.editor.getModels().length).toBeLessThan(baseline), + ); + + // Switch back to diff: a new diff editor mounts and the total must land + // back on the baseline rather than climbing. + await userEvent.click(toggle); + await waitFor(() => + expect(monaco.editor.getModels().length).toBe(baseline), + ); + } + }, +}; diff --git a/site/src/components/SyntaxHighlighter/SyntaxHighlighter.tsx b/site/src/components/SyntaxHighlighter/SyntaxHighlighter.tsx index 68d9e140ce5..37e76006575 100644 --- a/site/src/components/SyntaxHighlighter/SyntaxHighlighter.tsx +++ b/site/src/components/SyntaxHighlighter/SyntaxHighlighter.tsx @@ -2,7 +2,13 @@ import { useTheme } from "@emotion/react"; import Editor, { DiffEditor, loader } from "@monaco-editor/react"; import type * as Monaco from "monaco-editor"; import * as monaco from "monaco-editor"; -import { type ComponentProps, type FC, useCallback } from "react"; +import { + type ComponentProps, + type FC, + useCallback, + useEffect, + useRef, +} from "react"; import { useCoderTheme } from "./coderTheme"; loader.config({ monaco }); @@ -38,40 +44,6 @@ export const SyntaxHighlighter: FC = ({ const theme = useTheme(); const coderTheme = useCoderTheme(); - // Auto-scroll to first diff when the diff editor mounts and diffs are computed. - const handleDiffEditorMount = useCallback( - ( - editor: Monaco.editor.IStandaloneDiffEditor, - monacoInstance: typeof Monaco, - ) => { - // Call any existing onMount handler from editorProps. - editorProps?.onMount?.(editor, monacoInstance); - - // Diffs may already be computed by the time onMount fires, - // so check immediately first. If not ready yet, fall back - // to waiting for the onDidUpdateDiff event. - const scrollToFirstDiff = () => { - editor.goToDiff("next"); - }; - - const changes = editor.getLineChanges(); - if (changes && changes.length > 0) { - scrollToFirstDiff(); - return; - } - - const disposable = editor.onDidUpdateDiff(() => { - const updatedChanges = editor.getLineChanges(); - if (!updatedChanges || updatedChanges.length === 0) { - return; - } - disposable.dispose(); - scrollToFirstDiff(); - }); - }, - [editorProps], - ); - const commonProps = { language, theme: coderTheme.name, @@ -99,20 +71,102 @@ export const SyntaxHighlighter: FC = ({ }} > {hasDiff ? ( - + ) : ( )}

); }; + +type DiffFileProps = CommonEditorProps & { + original: string; + modified: string; +}; + +// Renders the diff editor and owns its model cleanup. Scoping this to its own +// component means the cleanup effect runs whenever the diff editor unmounts, +// including when SyntaxHighlighter stays mounted but switches diff -> plain for +// a file that stopped changing between versions. +// +// keepCurrent{Original,Modified}Model stops @monaco-editor/react from disposing +// the models mid-teardown (which throws), so we dispose them ourselves after +// React has torn the editor down. Without this the models accumulate unbounded +// as users open template versions until the tab runs out of memory. +const DiffFile: FC = ({ + original, + modified, + onMount, + ...editorProps +}) => { + const diffModelsRef = useRef<{ + original: Monaco.editor.ITextModel; + modified: Monaco.editor.ITextModel; + } | null>(null); + + const handleMount = useCallback( + ( + editor: Monaco.editor.IStandaloneDiffEditor, + monacoInstance: typeof Monaco, + ) => { + onMount?.(editor, monacoInstance); + + const diffModel = editor.getModel(); + diffModelsRef.current = diffModel + ? { original: diffModel.original, modified: diffModel.modified } + : null; + + // Auto-scroll to the first diff. Diffs may already be computed by the + // time onMount fires, so check immediately and otherwise wait for the + // onDidUpdateDiff event. + const scrollToFirstDiff = () => { + editor.goToDiff("next"); + }; + + const changes = editor.getLineChanges(); + if (changes && changes.length > 0) { + scrollToFirstDiff(); + return; + } + + const disposable = editor.onDidUpdateDiff(() => { + const updatedChanges = editor.getLineChanges(); + if (!updatedChanges || updatedChanges.length === 0) { + return; + } + disposable.dispose(); + scrollToFirstDiff(); + }); + }, + [onMount], + ); + + useEffect(() => { + return () => { + const models = diffModelsRef.current; + if (!models) { + return; + } + diffModelsRef.current = null; + // Defer disposal until after React's commit finishes. @monaco-editor/ + // react disposes the diff widget in its own unmount cleanup; freeing + // the models in the same synchronous teardown makes the widget throw + // "TextModel got disposed before DiffEditorWidget model got reset". + queueMicrotask(() => { + models.original.dispose(); + models.modified.dispose(); + }); + }; + }, []); + + return ( + + ); +}; From e81dac82ad136c1b40d90db22defa2c168189822 Mon Sep 17 00:00:00 2001 From: Jay Date: Tue, 1 Sep 2026 19:08:23 +0530 Subject: [PATCH 54/69] fix(site): allow Antigravity IDE token substitution (#28784) (#28840) --- site/src/modules/apps/apps.test.ts | 18 ++++++++++++++++++ site/src/modules/apps/apps.ts | 1 + 2 files changed, 19 insertions(+) diff --git a/site/src/modules/apps/apps.test.ts b/site/src/modules/apps/apps.test.ts index d9ac821cc8d..418efd9660d 100644 --- a/site/src/modules/apps/apps.test.ts +++ b/site/src/modules/apps/apps.test.ts @@ -96,6 +96,24 @@ describe("getAppHref", () => { expect(href).toBe("vscode://example.com?token=user-session-token"); }); + it("replaces the session token for Antigravity IDE URLs", () => { + const externalApp = { + ...MockWorkspaceApp, + external: true, + url: `antigravity-ide://coder.coder-remote/open?token=${SESSION_TOKEN_PLACEHOLDER}`, + }; + const href = getAppHref(externalApp, { + host: "*.apps-host.tld", + path: "/path-base", + agent: MockWorkspaceAgent, + workspace: MockWorkspace, + token: "user-session-token", + }); + expect(href).toBe( + "antigravity-ide://coder.coder-remote/open?token=user-session-token", + ); + }); + it("doesn't return the URL with the session token replaced when using the HTTP protocol", () => { const externalApp = { ...MockWorkspaceApp, diff --git a/site/src/modules/apps/apps.ts b/site/src/modules/apps/apps.ts index f987a992cda..86dd2b30ff4 100644 --- a/site/src/modules/apps/apps.ts +++ b/site/src/modules/apps/apps.ts @@ -26,6 +26,7 @@ const ALLOWED_EXTERNAL_APP_PROTOCOLS = [ "kiro:", "positron:", "antigravity:", + "antigravity-ide:", ]; type GetVSCodeHrefParams = { From 5627dae63cb058e4c0b4f3eb2019437ad3c268ce Mon Sep 17 00:00:00 2001 From: Ethan <39577870+ethanndickson@users.noreply.github.com> Date: Fri, 4 Sep 2026 10:38:46 +0200 Subject: [PATCH 55/69] fix(coderd/x/chatd): avoid closing poller hint channels (#28746) (#28978) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Backport of https://github.com/coder/coder/pull/28746 Original PR: #28746 — fix(coderd/x/chatd): avoid closing poller hint channels Merge commit: ced03dc30baecc9a08cef57996374dc358fcb824 Requested by: @ethanndickson --- coderd/x/chatd/stream_sync_poller.go | 1 - 1 file changed, 1 deletion(-) diff --git a/coderd/x/chatd/stream_sync_poller.go b/coderd/x/chatd/stream_sync_poller.go index 11e9171687e..2a87a9af121 100644 --- a/coderd/x/chatd/stream_sync_poller.go +++ b/coderd/x/chatd/stream_sync_poller.go @@ -101,7 +101,6 @@ func (p *streamSyncPoller) unregister(subscriber *streamSyncPollerSubscriber) { if len(chatSubscribers) == 0 { delete(p.subscribers, subscriber.chatID) } - close(subscriber.hints) } func (p *streamSyncPoller) loop() { From 28c4c8375c05bf96a9c79a5cb3cae6046b736c23 Mon Sep 17 00:00:00 2001 From: George K Date: Fri, 4 Sep 2026 08:46:29 -0700 Subject: [PATCH 56/69] fix: prevent coderd crashes from unsupported Tailnet RPCs (#28429) (#28961) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Backport of https://github.com/coder/coder/pull/28429 Original PR: #28429 — fix: prevent coderd crashes from unsupported Tailnet RPCs Merge commit: 156c8b6e41249e35af5dfdc93e867cdcd6579c33 PR created manually because the backport CI job is timing out. --- agent/agentsocket/server.go | 2 +- agent/agenttest/client.go | 1 + coderd/agentapi/api.go | 32 +++++++- coderd/aibridged.go | 2 +- coderd/coderd.go | 2 +- coderd/workspaceagentsrpc_test.go | 44 +++++++++++ codersdk/drpcsdk/server.go | 39 ++++++++++ codersdk/drpcsdk/server_internal_test.go | 85 +++++++++++++++++++++ codersdk/drpcsdk/server_test.go | 94 ++++++++++++++++++++++++ enterprise/coderd/aibridgeserve.go | 2 +- enterprise/coderd/provisionerdaemons.go | 2 +- provisionersdk/serve.go | 2 +- tailnet/service.go | 17 ++++- tailnet/service_test.go | 22 ++++++ 14 files changed, 335 insertions(+), 11 deletions(-) create mode 100644 codersdk/drpcsdk/server.go create mode 100644 codersdk/drpcsdk/server_internal_test.go create mode 100644 codersdk/drpcsdk/server_test.go diff --git a/agent/agentsocket/server.go b/agent/agentsocket/server.go index 605feeec05a..aee3a685a0a 100644 --- a/agent/agentsocket/server.go +++ b/agent/agentsocket/server.go @@ -56,7 +56,7 @@ func NewServer(logger slog.Logger, opts ...Option) (*Server, error) { return nil, xerrors.Errorf("failed to register drpc service: %w", err) } - server.drpcServer = drpcserver.NewWithOptions(mux, drpcserver.Options{ + server.drpcServer = drpcsdk.NewServer(logger, mux, drpcserver.Options{ Manager: drpcsdk.DefaultDRPCOptions(nil), Log: func(err error) { if errors.Is(err, context.Canceled) || diff --git a/agent/agenttest/client.go b/agent/agenttest/client.go index 0f5d83a98f9..457da28ebc5 100644 --- a/agent/agenttest/client.go +++ b/agent/agenttest/client.go @@ -78,6 +78,7 @@ func NewClientWithSecrets(t testing.TB, fakeAAPI := NewFakeAgentAPI(t, logger, mp, statsChan) err = agentproto.DRPCRegisterAgent(mux, fakeAAPI) require.NoError(t, err) + // Keep panics unrecovered in this test server so they fail tests loudly. server := drpcserver.NewWithOptions(mux, drpcserver.Options{ Manager: drpcsdk.DefaultDRPCOptions(nil), Log: func(err error) { diff --git a/coderd/agentapi/api.go b/coderd/agentapi/api.go index c6a77362dec..369aeede04d 100644 --- a/coderd/agentapi/api.go +++ b/coderd/agentapi/api.go @@ -59,7 +59,7 @@ type API struct { *SubAgentAPI *BoundaryLogsAPI *ContextAPI - *tailnet.DRPCService + tailnetService *tailnet.DRPCService cachedWorkspaceFields *CachedWorkspaceFields @@ -68,6 +68,28 @@ type API struct { var _ agentproto.DRPCAgentServer = &API{} +// agentTailnetService exposes only Tailnet RPCs intended for workspace agents. +// Other current and future RPCs remain unavailable until explicitly forwarded. +type agentTailnetService struct { + tailnetproto.DRPCTailnetUnimplementedServer + + service *tailnet.DRPCService +} + +func (s *agentTailnetService) PostTelemetry(ctx context.Context, req *tailnetproto.TelemetryRequest) (*tailnetproto.TelemetryResponse, error) { + return s.service.PostTelemetry(ctx, req) +} + +func (s *agentTailnetService) StreamDERPMaps(req *tailnetproto.StreamDERPMapsRequest, stream tailnetproto.DRPCTailnet_StreamDERPMapsStream) error { + return s.service.StreamDERPMaps(req, stream) +} + +func (s *agentTailnetService) Coordinate(stream tailnetproto.DRPCTailnet_CoordinateStream) error { + return s.service.Coordinate(stream) +} + +var _ tailnetproto.DRPCTailnetServer = (*agentTailnetService)(nil) + type Options struct { AgentID uuid.UUID OwnerID uuid.UUID @@ -224,7 +246,7 @@ func New(opts Options, workspace database.Workspace, agent database.WorkspaceAge Log: opts.Log, } - api.DRPCService = &tailnet.DRPCService{ + api.tailnetService = &tailnet.DRPCService{ CoordPtr: opts.TailnetCoordinator, Logger: opts.Log, DerpMapUpdateFrequency: opts.DerpMapUpdateFrequency, @@ -277,12 +299,14 @@ func (a *API) Server(ctx context.Context) (*drpcserver.Server, error) { return nil, xerrors.Errorf("register agent API protocol in DRPC mux: %w", err) } - err = tailnetproto.DRPCRegisterTailnet(mux, a) + err = tailnetproto.DRPCRegisterTailnet(mux, &agentTailnetService{ + service: a.tailnetService, + }) if err != nil { return nil, xerrors.Errorf("register tailnet API protocol in DRPC mux: %w", err) } - return drpcserver.NewWithOptions(&tracing.DRPCHandler{Handler: mux}, + return drpcsdk.NewServer(a.opts.Log, &tracing.DRPCHandler{Handler: mux}, drpcserver.Options{ Manager: drpcsdk.DefaultDRPCOptions(nil), Log: func(err error) { diff --git a/coderd/aibridged.go b/coderd/aibridged.go index e7c8295fed0..0ea322e455a 100644 --- a/coderd/aibridged.go +++ b/coderd/aibridged.go @@ -84,7 +84,7 @@ func (api *API) CreateInMemoryAIBridgeServer(dialCtx context.Context) (client ai if err := aibridgedserver.Register(mux, srv); err != nil { return nil, err } - server := drpcserver.NewWithOptions(&tracing.DRPCHandler{Handler: mux}, + server := drpcsdk.NewServer(api.Logger, &tracing.DRPCHandler{Handler: mux}, drpcserver.Options{ Manager: drpcsdk.DefaultDRPCOptions(nil), Log: func(err error) { diff --git a/coderd/coderd.go b/coderd/coderd.go index b01efaf9cd2..d6cd586ec2e 100644 --- a/coderd/coderd.go +++ b/coderd/coderd.go @@ -2622,7 +2622,7 @@ func (api *API) CreateInMemoryTaggedProvisionerDaemon(dialCtx context.Context, n if err != nil { return nil, err } - server := drpcserver.NewWithOptions(&tracing.DRPCHandler{Handler: mux}, + server := drpcsdk.NewServer(logger, &tracing.DRPCHandler{Handler: mux}, drpcserver.Options{ Manager: drpcsdk.DefaultDRPCOptions(nil), Log: func(err error) { diff --git a/coderd/workspaceagentsrpc_test.go b/coderd/workspaceagentsrpc_test.go index 1595462d191..5d083c131f9 100644 --- a/coderd/workspaceagentsrpc_test.go +++ b/coderd/workspaceagentsrpc_test.go @@ -7,6 +7,7 @@ import ( "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" + "storj.io/drpc/drpcerr" agentproto "github.com/coder/coder/v2/agent/proto" "github.com/coder/coder/v2/coderd/coderdtest" @@ -17,6 +18,8 @@ import ( "github.com/coder/coder/v2/coderd/rbac" "github.com/coder/coder/v2/codersdk/agentsdk" "github.com/coder/coder/v2/provisionersdk/proto" + "github.com/coder/coder/v2/tailnet" + tailnetproto "github.com/coder/coder/v2/tailnet/proto" "github.com/coder/coder/v2/testutil" ) @@ -109,6 +112,47 @@ func TestWorkspaceAgentReportStats(t *testing.T) { } } +func TestWorkspaceAgentRPC_TailnetMethods(t *testing.T) { + t.Parallel() + + ctx := testutil.Context(t, testutil.WaitLong) + client, db := coderdtest.NewWithDatabase(t, nil) + user := coderdtest.CreateFirstUser(t, client) + workspace := dbfake.WorkspaceBuild(t, db, database.WorkspaceTable{ + OrganizationID: user.OrganizationID, + OwnerID: user.UserID, + }).WithAgent().Do() + + agentClient := agentsdk.New(client.URL, agentsdk.WithFixedToken(workspace.AgentToken)) + conn, err := agentClient.ConnectRPC(ctx) + require.NoError(t, err) + t.Cleanup(func() { + _ = conn.Close() + }) + + tailnetClient := tailnetproto.NewDRPCTailnetClient(conn) + _, err = tailnetClient.RefreshResumeToken(ctx, &tailnetproto.RefreshResumeTokenRequest{}) + require.Error(t, err) + require.EqualValues(t, drpcerr.Unimplemented, drpcerr.Code(err)) + + updates, err := tailnetClient.WorkspaceUpdates(ctx, &tailnetproto.WorkspaceUpdatesRequest{ + WorkspaceOwnerId: tailnet.UUIDToByteSlice(user.UserID), + }) + if err == nil { + _, err = updates.Recv() + } + require.Error(t, err) + require.EqualValues(t, drpcerr.Unimplemented, drpcerr.Code(err)) + + telemetry, err := tailnetClient.PostTelemetry(ctx, &tailnetproto.TelemetryRequest{}) + require.NoError(t, err) + require.NotNil(t, telemetry) + + agentAPI := agentproto.NewDRPCAgentClient(conn) + _, err = agentAPI.GetManifest(ctx, &agentproto.GetManifestRequest{}) + require.NoError(t, err) +} + func TestAgentAPI_LargeManifest(t *testing.T) { t.Parallel() diff --git a/codersdk/drpcsdk/server.go b/codersdk/drpcsdk/server.go new file mode 100644 index 00000000000..6fc9a505d93 --- /dev/null +++ b/codersdk/drpcsdk/server.go @@ -0,0 +1,39 @@ +package drpcsdk + +import ( + "runtime/debug" + + "storj.io/drpc" + "storj.io/drpc/drpcserver" + + "cdr.dev/slog/v3" +) + +// NewServer constructs a dRPC server that recovers panics from RPC handlers. +func NewServer(logger slog.Logger, handler drpc.Handler, options drpcserver.Options) *drpcserver.Server { + return drpcserver.NewWithOptions(&recoverHandler{ + logger: logger, + handler: handler, + }, options) +} + +type recoverHandler struct { + logger slog.Logger + handler drpc.Handler +} + +func (h *recoverHandler) HandleRPC(stream drpc.Stream, rpc string) (err error) { + defer func() { + if r := recover(); r != nil { + h.logger.Error(stream.Context(), + "panic serving dRPC request (recovered)", + slog.F("rpc", rpc), + slog.F("panic", r), + slog.F("stack", string(debug.Stack())), + ) + err = drpc.InternalError.New("panic serving dRPC request") + } + }() + + return h.handler.HandleRPC(stream, rpc) +} diff --git a/codersdk/drpcsdk/server_internal_test.go b/codersdk/drpcsdk/server_internal_test.go new file mode 100644 index 00000000000..66298af68f5 --- /dev/null +++ b/codersdk/drpcsdk/server_internal_test.go @@ -0,0 +1,85 @@ +package drpcsdk + +import ( + "context" + "testing" + + "github.com/stretchr/testify/require" + "golang.org/x/xerrors" + "storj.io/drpc" + + "cdr.dev/slog/v3" + "github.com/coder/coder/v2/testutil" +) + +func TestRecoverHandler(t *testing.T) { + t.Parallel() + + t.Run("Panic", func(t *testing.T) { + t.Parallel() + + const panicValue = "sensitive panic details" + sink := testutil.NewFakeSink(t) + handler := &recoverHandler{ + logger: sink.Logger(), + handler: handlerFunc(func(drpc.Stream, string) error { + panic(panicValue) + }), + } + + err := handler.HandleRPC(contextStream{ctx: t.Context()}, "/test.Service/Panic") + require.Error(t, err) + require.True(t, drpc.InternalError.Has(err)) + require.NotContains(t, err.Error(), panicValue) + + entries := sink.Entries() + require.Len(t, entries, 1) + require.Equal(t, slog.LevelError, entries[0].Level) + require.Equal(t, "panic serving dRPC request (recovered)", entries[0].Message) + require.Equal(t, "/test.Service/Panic", fieldValue(entries[0].Fields, "rpc")) + require.Equal(t, panicValue, fieldValue(entries[0].Fields, "panic")) + stackValue := fieldValue(entries[0].Fields, "stack") + stack, ok := stackValue.(string) + require.True(t, ok, "stack field must be a string, got %T", stackValue) + require.Contains(t, stack, "goroutine ") + }) + + t.Run("Error", func(t *testing.T) { + t.Parallel() + + expected := xerrors.New("handler error") + handler := &recoverHandler{ + handler: handlerFunc(func(drpc.Stream, string) error { + return expected + }), + } + + err := handler.HandleRPC(contextStream{ctx: t.Context()}, "/test.Service/Error") + require.ErrorIs(t, err, expected) + }) +} + +type handlerFunc func(drpc.Stream, string) error + +func (f handlerFunc) HandleRPC(stream drpc.Stream, rpc string) error { + return f(stream, rpc) +} + +type contextStream struct { + ctx context.Context +} + +func (s contextStream) Context() context.Context { return s.ctx } +func (contextStream) MsgSend(drpc.Message, drpc.Encoding) error { return nil } +func (contextStream) MsgRecv(drpc.Message, drpc.Encoding) error { return nil } +func (contextStream) CloseSend() error { return nil } +func (contextStream) Close() error { return nil } + +func fieldValue(fields slog.Map, name string) any { + for _, field := range fields { + if field.Name == name { + return field.Value + } + } + return nil +} diff --git a/codersdk/drpcsdk/server_test.go b/codersdk/drpcsdk/server_test.go new file mode 100644 index 00000000000..e906daa82e0 --- /dev/null +++ b/codersdk/drpcsdk/server_test.go @@ -0,0 +1,94 @@ +package drpcsdk_test + +import ( + "context" + "testing" + + "github.com/stretchr/testify/require" + "golang.org/x/xerrors" + "storj.io/drpc" + "storj.io/drpc/drpcserver" + + "github.com/coder/coder/v2/codersdk/drpcsdk" + "github.com/coder/coder/v2/testutil" +) + +func TestNewServerRecoversPanics(t *testing.T) { + t.Parallel() + + const ( + panicRPC = "/test.Service/Panic" + echoRPC = "/test.Service/Echo" + panicValue = "sensitive panic details" + ) + + ctx := testutil.Context(t, testutil.WaitShort) + serverCtx, cancel := context.WithCancel(ctx) + defer cancel() + + client, listener := drpcsdk.MemTransportPipe() + defer func() { + _ = client.Close() + _ = listener.Close() + }() + + handler := testHandlerFunc(func(stream drpc.Stream, rpc string) error { + switch rpc { + case panicRPC: + panic(panicValue) + case echoRPC: + var message string + if err := stream.MsgRecv(&message, stringEncoding{}); err != nil { + return err + } + return stream.MsgSend(&message, stringEncoding{}) + default: + return xerrors.Errorf("unexpected RPC %q", rpc) + } + }) + server := drpcsdk.NewServer(testutil.NewFakeSink(t).Logger(), handler, drpcserver.Options{ + Manager: drpcsdk.DefaultDRPCOptions(nil), + }) + serverDone := make(chan error, 1) + go func() { + serverDone <- server.Serve(serverCtx, listener) + }() + + request, response := "request", "" + err := client.Invoke(ctx, panicRPC, stringEncoding{}, &request, &response) + require.EqualError(t, err, "internal error: panic serving dRPC request") + require.NotContains(t, err.Error(), panicValue) + + request, response = "healthy", "" + err = client.Invoke(ctx, echoRPC, stringEncoding{}, &request, &response) + require.NoError(t, err) + require.Equal(t, request, response) + + cancel() + require.NoError(t, testutil.RequireReceive(ctx, t, serverDone)) +} + +type testHandlerFunc func(drpc.Stream, string) error + +func (f testHandlerFunc) HandleRPC(stream drpc.Stream, rpc string) error { + return f(stream, rpc) +} + +type stringEncoding struct{} + +func (stringEncoding) Marshal(message drpc.Message) ([]byte, error) { + value, ok := message.(*string) + if !ok { + return nil, xerrors.Errorf("marshal %T: expected *string", message) + } + return []byte(*value), nil +} + +func (stringEncoding) Unmarshal(data []byte, message drpc.Message) error { + value, ok := message.(*string) + if !ok { + return xerrors.Errorf("unmarshal %T: expected *string", message) + } + *value = string(data) + return nil +} diff --git a/enterprise/coderd/aibridgeserve.go b/enterprise/coderd/aibridgeserve.go index 09c48086a6d..44cd4dd16af 100644 --- a/enterprise/coderd/aibridgeserve.go +++ b/enterprise/coderd/aibridgeserve.go @@ -159,7 +159,7 @@ func (api *API) aiGatewayServe(rw http.ResponseWriter, r *http.Request) { return } - server := drpcserver.NewWithOptions(&tracing.DRPCHandler{Handler: mux}, + server := drpcsdk.NewServer(logger, &tracing.DRPCHandler{Handler: mux}, drpcserver.Options{ Manager: drpcsdk.DefaultDRPCOptions(nil), Log: func(err error) { diff --git a/enterprise/coderd/provisionerdaemons.go b/enterprise/coderd/provisionerdaemons.go index c2ba568b969..110ff2e13c8 100644 --- a/enterprise/coderd/provisionerdaemons.go +++ b/enterprise/coderd/provisionerdaemons.go @@ -374,7 +374,7 @@ func (api *API) provisionerDaemonServe(rw http.ResponseWriter, r *http.Request) _ = conn.Close(websocket.StatusInternalError, httpapi.WebsocketCloseSprintf("drpc register provisioner daemon: %s", err)) return } - server := drpcserver.NewWithOptions(mux, drpcserver.Options{ + server := drpcsdk.NewServer(logger, mux, drpcserver.Options{ Manager: drpcsdk.DefaultDRPCOptions(nil), Log: func(err error) { if xerrors.Is(err, io.EOF) { diff --git a/provisionersdk/serve.go b/provisionersdk/serve.go index 4afcee96269..013626b22a4 100644 --- a/provisionersdk/serve.go +++ b/provisionersdk/serve.go @@ -92,7 +92,7 @@ func Serve(ctx context.Context, server Server, options *ServeOptions) error { if err != nil { return xerrors.Errorf("register provisioner: %w", err) } - srv := drpcserver.NewWithOptions(&tracing.DRPCHandler{Handler: mux}, drpcserver.Options{ + srv := drpcsdk.NewServer(options.Logger, &tracing.DRPCHandler{Handler: mux}, drpcserver.Options{ Manager: drpcsdk.DefaultDRPCOptions(nil), }) diff --git a/tailnet/service.go b/tailnet/service.go index 6ae02876a4d..9773530c76f 100644 --- a/tailnet/service.go +++ b/tailnet/service.go @@ -11,6 +11,7 @@ import ( "github.com/google/uuid" "github.com/hashicorp/yamux" "golang.org/x/xerrors" + "storj.io/drpc/drpcerr" "storj.io/drpc/drpcmux" "storj.io/drpc/drpcserver" "tailscale.com/tailcfg" @@ -92,7 +93,7 @@ func NewClientService(options ClientServiceOptions) ( if err != nil { return nil, xerrors.Errorf("register DRPC service: %w", err) } - server := drpcserver.NewWithOptions(mux, drpcserver.Options{ + server := drpcsdk.NewServer(options.Logger, mux, drpcserver.Options{ Manager: drpcsdk.DefaultDRPCOptions(nil), Log: func(err error) { if xerrors.Is(err, io.EOF) || @@ -185,6 +186,13 @@ func (s *DRPCService) StreamDERPMaps(_ *proto.StreamDERPMapsRequest, stream prot } func (s *DRPCService) RefreshResumeToken(ctx context.Context, _ *proto.RefreshResumeTokenRequest) (*proto.RefreshResumeTokenResponse, error) { + if s.ResumeTokenProvider == nil { + return nil, drpcerr.WithCode( + xerrors.New("resume tokens not supported on this connection"), + drpcerr.Unimplemented, + ) + } + streamID, ok := ctx.Value(streamIDContextKey{}).(StreamID) if !ok { return nil, xerrors.New("no Stream ID") @@ -219,6 +227,13 @@ func (s *DRPCService) Coordinate(stream proto.DRPCTailnet_CoordinateStream) erro } func (s *DRPCService) WorkspaceUpdates(req *proto.WorkspaceUpdatesRequest, stream proto.DRPCTailnet_WorkspaceUpdatesStream) error { + if s.WorkspaceUpdatesProvider == nil { + return drpcerr.WithCode( + xerrors.New("workspace updates not supported on this connection"), + drpcerr.Unimplemented, + ) + } + defer stream.Close() ctx := stream.Context() diff --git a/tailnet/service_test.go b/tailnet/service_test.go index 0c268b05edb..21a290ef358 100644 --- a/tailnet/service_test.go +++ b/tailnet/service_test.go @@ -13,6 +13,7 @@ import ( "github.com/stretchr/testify/require" "go.uber.org/mock/gomock" "golang.org/x/xerrors" + "storj.io/drpc/drpcerr" "tailscale.com/tailcfg" "github.com/coder/coder/v2/tailnet" @@ -178,6 +179,27 @@ func TestClientService_ServeClient_V1(t *testing.T) { require.ErrorIs(t, err, tailnet.ErrUnsupportedVersion) } +func TestClientService_UnsupportedProviders(t *testing.T) { + t.Parallel() + + ctx := testutil.Context(t, testutil.WaitShort) + clientID := uuid.New() + _, client := createUpdateService(t, ctx, clientID, nil) + + _, err := client.RefreshResumeToken(ctx, &proto.RefreshResumeTokenRequest{}) + require.ErrorContains(t, err, "resume tokens not supported on this connection") + require.EqualValues(t, drpcerr.Unimplemented, drpcerr.Code(err)) + + updates, err := client.WorkspaceUpdates(ctx, &proto.WorkspaceUpdatesRequest{ + WorkspaceOwnerId: tailnet.UUIDToByteSlice(clientID), + }) + if err == nil { + _, err = updates.Recv() + } + require.ErrorContains(t, err, "workspace updates not supported on this connection") + require.EqualValues(t, drpcerr.Unimplemented, drpcerr.Code(err)) +} + func TestNetworkTelemetryBatcher(t *testing.T) { t.Parallel() From a682c9dadde17998cab7804167454c4d5138eb00 Mon Sep 17 00:00:00 2001 From: dylanhuff-at-coder Date: Wed, 16 Sep 2026 12:38:30 -0400 Subject: [PATCH 57/69] fix(coderd/agentapi): reject missing RPC messages (#29150) (#29368) Backport of #29150 to `release/2.36`. Reject missing lifecycle, startup, and metadata sub-messages with `InvalidArgument` instead of panicking. Validate the entire metadata batch before modifying or queuing values.

Backport context

Cherry-picks `9c58283d8e7a036a45820f76da7f05ffcf81d611` without changes. The automatic backport failed while pushing the branch.

Generated by Coder Agents on behalf of @dylanhuff-at-coder. --- coderd/agentapi/lifecycle.go | 10 ++++ coderd/agentapi/metadata.go | 12 ++++ coderd/agentapi/validation_test.go | 90 ++++++++++++++++++++++++++++++ 3 files changed, 112 insertions(+) create mode 100644 coderd/agentapi/validation_test.go diff --git a/coderd/agentapi/lifecycle.go b/coderd/agentapi/lifecycle.go index 5003a16f04d..d9b1aa296a1 100644 --- a/coderd/agentapi/lifecycle.go +++ b/coderd/agentapi/lifecycle.go @@ -10,7 +10,9 @@ import ( "github.com/google/uuid" "golang.org/x/mod/semver" "golang.org/x/xerrors" + "google.golang.org/grpc/codes" "google.golang.org/protobuf/types/known/timestamppb" + "storj.io/drpc/drpcerr" "cdr.dev/slog/v3" agentproto "github.com/coder/coder/v2/agent/proto" @@ -45,6 +47,10 @@ func (a *LifecycleAPI) now() time.Time { } func (a *LifecycleAPI) UpdateLifecycle(ctx context.Context, req *agentproto.UpdateLifecycleRequest) (*agentproto.Lifecycle, error) { + if req.GetLifecycle() == nil { + return nil, drpcerr.WithCode(xerrors.New("lifecycle is required"), uint64(codes.InvalidArgument)) + } + workspaceAgent, err := a.AgentFn(ctx) if err != nil { return nil, err @@ -146,6 +152,10 @@ func (a *LifecycleAPI) UpdateLifecycle(ctx context.Context, req *agentproto.Upda } func (a *LifecycleAPI) UpdateStartup(ctx context.Context, req *agentproto.UpdateStartupRequest) (*agentproto.Startup, error) { + if req.GetStartup() == nil { + return nil, drpcerr.WithCode(xerrors.New("startup is required"), uint64(codes.InvalidArgument)) + } + apiVersion, ok := ctx.Value(contextKeyAPIVersion{}).(string) if !ok { return nil, xerrors.Errorf("internal error; api version unspecified") diff --git a/coderd/agentapi/metadata.go b/coderd/agentapi/metadata.go index 12efe362abb..8baee8eb3f2 100644 --- a/coderd/agentapi/metadata.go +++ b/coderd/agentapi/metadata.go @@ -8,6 +8,8 @@ import ( "github.com/google/uuid" "golang.org/x/xerrors" + "google.golang.org/grpc/codes" + "storj.io/drpc/drpcerr" "cdr.dev/slog/v3" agentproto "github.com/coder/coder/v2/agent/proto" @@ -34,6 +36,16 @@ func (a *MetadataAPI) now() time.Time { } func (a *MetadataAPI) BatchUpdateMetadata(ctx context.Context, req *agentproto.BatchUpdateMetadataRequest) (*agentproto.BatchUpdateMetadataResponse, error) { + if req == nil { + return nil, drpcerr.WithCode(xerrors.New("metadata request is required"), uint64(codes.InvalidArgument)) + } + // Validate the entire batch before trimming values or discarding excess keys. + for i, md := range req.Metadata { + if md.GetResult() == nil { + return nil, drpcerr.WithCode(xerrors.Errorf("metadata result at index %d is required", i), uint64(codes.InvalidArgument)) + } + } + const ( // maxAllKeysLen is the maximum length of all metadata keys. This is // 6144 to stay below the Postgres NOTIFY limit of 8000 bytes, with some diff --git a/coderd/agentapi/validation_test.go b/coderd/agentapi/validation_test.go new file mode 100644 index 00000000000..2a32556b219 --- /dev/null +++ b/coderd/agentapi/validation_test.go @@ -0,0 +1,90 @@ +package agentapi_test + +import ( + "context" + "testing" + + "github.com/stretchr/testify/require" + "google.golang.org/grpc/codes" + "storj.io/drpc/drpcerr" + + agentproto "github.com/coder/coder/v2/agent/proto" + "github.com/coder/coder/v2/coderd/agentapi" + "github.com/coder/coder/v2/codersdk/drpcsdk" + "github.com/coder/coder/v2/testutil" +) + +func TestUpdateLifecycleMissingMessage(t *testing.T) { + t.Parallel() + + resp, err := (&agentapi.LifecycleAPI{}).UpdateLifecycle(context.Background(), &agentproto.UpdateLifecycleRequest{}) + require.ErrorContains(t, err, "lifecycle is required") + require.EqualValues(t, codes.InvalidArgument, drpcerr.Code(err)) + require.Nil(t, resp) +} + +func TestUpdateStartupMissingMessage(t *testing.T) { + t.Parallel() + + resp, err := (&agentapi.LifecycleAPI{}).UpdateStartup(context.Background(), &agentproto.UpdateStartupRequest{}) + require.ErrorContains(t, err, "startup is required") + require.EqualValues(t, codes.InvalidArgument, drpcerr.Code(err)) + require.Nil(t, resp) +} + +func TestBatchUpdateMetadataMissingMessage(t *testing.T) { + t.Parallel() + + for _, tt := range []struct { + name string + req *agentproto.BatchUpdateMetadataRequest + }{ + {name: "NilRequest"}, + {name: "MixedBatch", req: &agentproto.BatchUpdateMetadataRequest{Metadata: []*agentproto.Metadata{ + {Key: "valid", Result: &agentproto.WorkspaceAgentMetadata_Result{Value: "value"}}, + {Key: "invalid"}, + }}}, + } { + t.Run(tt.name, func(t *testing.T) { + t.Parallel() + + resp, err := (&agentapi.MetadataAPI{}).BatchUpdateMetadata(context.Background(), tt.req) + require.Error(t, err) + require.EqualValues(t, codes.InvalidArgument, drpcerr.Code(err)) + require.Nil(t, resp) + }) + } +} + +func TestAgentRPCMissingMessage(t *testing.T) { + t.Parallel() + + ctx := testutil.Context(t, testutil.WaitShort) + serverCtx, cancel := context.WithCancel(agentapi.WithAPIVersion(ctx, "2.0")) + defer cancel() + conn, listener := drpcsdk.MemTransportPipe() + defer conn.Close() + defer listener.Close() + + api := &agentapi.API{ + LifecycleAPI: &agentapi.LifecycleAPI{}, + StatsAPI: &agentapi.StatsAPI{}, + } + server, err := api.Server(serverCtx) + require.NoError(t, err) + done := make(chan error, 1) + go func() { + done <- server.Serve(serverCtx, listener) + }() + client := agentproto.NewDRPCAgentClient(conn) + + _, err = client.UpdateLifecycle(ctx, &agentproto.UpdateLifecycleRequest{}) + require.ErrorContains(t, err, "lifecycle is required") + require.EqualValues(t, codes.InvalidArgument, drpcerr.Code(err)) + stats, err := client.UpdateStats(ctx, &agentproto.UpdateStatsRequest{}) + require.NoError(t, err) + require.NotNil(t, stats.ReportInterval) + + cancel() + require.NoError(t, testutil.RequireReceive(ctx, t, done)) +} From 165de21fdd913a0ae9f742de732f21dcc26b75b2 Mon Sep 17 00:00:00 2001 From: "J. Scott Miller" Date: Wed, 16 Sep 2026 11:39:47 -0500 Subject: [PATCH 58/69] perf(coderd): build the workspace build fan-out maps once per batch (#28074) (#29371) Backport of https://github.com/coder/coder/pull/28074 Original PR: #28074 - perf(coderd): build the workspace build fan-out maps once per batch Merge commit: 62f4afbb6067ec14ee27768f3b97c84327ecdf08 Requested by: @jscottmiller Opened manually because the backport workflow's push was rejected by GitHub's workflow-scope check (run 34996286869). Cherry-pick applied cleanly; `go build ./coderd/...` and `go test ./coderd -run TestConvertWorkspaceBuild` pass on this branch. Addresses PLAT-386 / #27205. --- Created with Coder Agents on behalf of @jscottmiller. --- coderd/workspacebuilds.go | 204 +++++++++------- coderd/workspacebuilds_internal_test.go | 299 ++++++++++++++++++++++++ coderd/workspaces.go | 9 +- 3 files changed, 415 insertions(+), 97 deletions(-) create mode 100644 coderd/workspacebuilds_internal_test.go diff --git a/coderd/workspacebuilds.go b/coderd/workspacebuilds.go index 9678defee55..73a8d8241cb 100644 --- a/coderd/workspacebuilds.go +++ b/coderd/workspacebuilds.go @@ -1,6 +1,7 @@ package coderd import ( + "cmp" "context" "database/sql" "encoding/json" @@ -81,15 +82,17 @@ func (api *API) workspaceBuild(rw http.ResponseWriter, r *http.Request) { workspaceBuild, workspace, data.jobs[0], - data.resources, - data.metadata, - data.agents, - data.apps, - data.appStatuses, - data.scripts, - data.logSources, + newWorkspaceBuildIndex( + data.resources, + data.metadata, + data.agents, + data.apps, + data.appStatuses, + data.scripts, + data.logSources, + nil, + ), data.templateVersions[0], - nil, ) if err != nil { httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{ @@ -291,15 +294,17 @@ func (api *API) workspaceBuildByBuildNumber(rw http.ResponseWriter, r *http.Requ workspaceBuild, workspace, data.jobs[0], - data.resources, - data.metadata, - data.agents, - data.apps, - data.appStatuses, - data.scripts, - data.logSources, + newWorkspaceBuildIndex( + data.resources, + data.metadata, + data.agents, + data.apps, + data.appStatuses, + data.scripts, + data.logSources, + data.provisionerDaemons, + ), data.templateVersions[0], - data.provisionerDaemons, ) if err != nil { httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{ @@ -616,15 +621,8 @@ func (api *API) postWorkspaceBuildsInternal( *workspaceBuild, workspace, queuePos, - []database.WorkspaceResource{}, - []database.WorkspaceResourceMetadatum{}, - []database.WorkspaceAgent{}, - []database.WorkspaceApp{}, - []database.WorkspaceAppStatus{}, - []database.GetWorkspaceAgentScriptsByAgentIDsRow{}, - []database.WorkspaceAgentLogSource{}, + newWorkspaceBuildIndex(nil, nil, nil, nil, nil, nil, nil, provisionerDaemons), database.TemplateVersion{}, - provisionerDaemons, ) if err != nil { return codersdk.WorkspaceBuild{}, httperror.NewResponseError( @@ -1245,6 +1243,78 @@ func (api *API) workspaceBuildsData(ctx context.Context, workspaceBuilds []datab }, nil } +// workspaceBuildIndex groups build rows by the ID they are looked up with. +// Conversion reorders rows within a bucket in place, so an index must be read +// by a single goroutine. +type workspaceBuildIndex struct { + resourcesByJobID map[uuid.UUID][]database.WorkspaceResource + metadataByResourceID map[uuid.UUID][]database.WorkspaceResourceMetadatum + agentsByResourceID map[uuid.UUID][]database.WorkspaceAgent + appsByAgentID map[uuid.UUID][]database.WorkspaceApp + statusesByAgentID map[uuid.UUID][]database.WorkspaceAppStatus + scriptsByAgentID map[uuid.UUID][]database.GetWorkspaceAgentScriptsByAgentIDsRow + logSourcesByAgentID map[uuid.UUID][]database.WorkspaceAgentLogSource + daemonsByJobID map[uuid.UUID][]database.ProvisionerDaemon +} + +// newWorkspaceBuildIndex makes one pass over each slice, copying rows into +// per-ID buckets. The input slices are neither modified nor aliased. +func newWorkspaceBuildIndex( + workspaceResources []database.WorkspaceResource, + resourceMetadata []database.WorkspaceResourceMetadatum, + resourceAgents []database.WorkspaceAgent, + agentApps []database.WorkspaceApp, + agentAppStatuses []database.WorkspaceAppStatus, + agentScripts []database.GetWorkspaceAgentScriptsByAgentIDsRow, + agentLogSources []database.WorkspaceAgentLogSource, + provisionerDaemons []database.GetEligibleProvisionerDaemonsByProvisionerJobIDsRow, +) *workspaceBuildIndex { + index := &workspaceBuildIndex{ + resourcesByJobID: make(map[uuid.UUID][]database.WorkspaceResource), + metadataByResourceID: make(map[uuid.UUID][]database.WorkspaceResourceMetadatum), + agentsByResourceID: make(map[uuid.UUID][]database.WorkspaceAgent), + appsByAgentID: make(map[uuid.UUID][]database.WorkspaceApp), + statusesByAgentID: make(map[uuid.UUID][]database.WorkspaceAppStatus), + scriptsByAgentID: make(map[uuid.UUID][]database.GetWorkspaceAgentScriptsByAgentIDsRow), + logSourcesByAgentID: make(map[uuid.UUID][]database.WorkspaceAgentLogSource), + daemonsByJobID: make(map[uuid.UUID][]database.ProvisionerDaemon), + } + for _, resource := range workspaceResources { + index.resourcesByJobID[resource.JobID] = append(index.resourcesByJobID[resource.JobID], resource) + } + for _, metadata := range resourceMetadata { + index.metadataByResourceID[metadata.WorkspaceResourceID] = append(index.metadataByResourceID[metadata.WorkspaceResourceID], metadata) + } + for _, agent := range resourceAgents { + index.agentsByResourceID[agent.ResourceID] = append(index.agentsByResourceID[agent.ResourceID], agent) + } + for _, app := range agentApps { + index.appsByAgentID[app.AgentID] = append(index.appsByAgentID[app.AgentID], app) + } + for _, status := range agentAppStatuses { + index.statusesByAgentID[status.AgentID] = append(index.statusesByAgentID[status.AgentID], status) + } + for _, script := range agentScripts { + index.scriptsByAgentID[script.WorkspaceAgentID] = append(index.scriptsByAgentID[script.WorkspaceAgentID], script) + } + for _, logSource := range agentLogSources { + index.logSourcesByAgentID[logSource.WorkspaceAgentID] = append(index.logSourcesByAgentID[logSource.WorkspaceAgentID], logSource) + } + for _, daemon := range provisionerDaemons { + index.daemonsByJobID[daemon.JobID] = append(index.daemonsByJobID[daemon.JobID], daemon.ProvisionerDaemon) + } + // Agents within a resource are ordered by display order, then name. + for _, agents := range index.agentsByResourceID { + slices.SortFunc(agents, func(a, b database.WorkspaceAgent) int { + return cmp.Or( + cmp.Compare(a.DisplayOrder, b.DisplayOrder), + cmp.Compare(a.Name, b.Name), + ) + }) + } + return index +} + func (api *API) convertWorkspaceBuilds( workspaceBuilds []database.WorkspaceBuild, workspaces []database.Workspace, @@ -1272,6 +1342,17 @@ func (api *API) convertWorkspaceBuilds( templateVersionByID[templateVersion.ID] = templateVersion } + index := newWorkspaceBuildIndex( + workspaceResources, + resourceMetadata, + resourceAgents, + agentApps, + agentAppStatuses, + agentScripts, + agentLogSources, + provisionerDaemons, + ) + // Should never be nil for API consistency apiBuilds := []codersdk.WorkspaceBuild{} for _, build := range workspaceBuilds { @@ -1292,15 +1373,8 @@ func (api *API) convertWorkspaceBuilds( build, workspace, job, - workspaceResources, - resourceMetadata, - resourceAgents, - agentApps, - agentAppStatuses, - agentScripts, - agentLogSources, + index, templateVersion, - provisionerDaemons, ) if err != nil { return nil, xerrors.Errorf("converting workspace build: %w", err) @@ -1316,64 +1390,16 @@ func (api *API) convertWorkspaceBuild( build database.WorkspaceBuild, workspace database.Workspace, job database.GetProvisionerJobsByIDsWithQueuePositionRow, - workspaceResources []database.WorkspaceResource, - resourceMetadata []database.WorkspaceResourceMetadatum, - resourceAgents []database.WorkspaceAgent, - agentApps []database.WorkspaceApp, - agentAppStatuses []database.WorkspaceAppStatus, - agentScripts []database.GetWorkspaceAgentScriptsByAgentIDsRow, - agentLogSources []database.WorkspaceAgentLogSource, + index *workspaceBuildIndex, templateVersion database.TemplateVersion, - provisionerDaemons []database.GetEligibleProvisionerDaemonsByProvisionerJobIDsRow, ) (codersdk.WorkspaceBuild, error) { - resourcesByJobID := map[uuid.UUID][]database.WorkspaceResource{} - for _, resource := range workspaceResources { - resourcesByJobID[resource.JobID] = append(resourcesByJobID[resource.JobID], resource) - } - metadataByResourceID := map[uuid.UUID][]database.WorkspaceResourceMetadatum{} - for _, metadata := range resourceMetadata { - metadataByResourceID[metadata.WorkspaceResourceID] = append(metadataByResourceID[metadata.WorkspaceResourceID], metadata) - } - agentsByResourceID := map[uuid.UUID][]database.WorkspaceAgent{} - for _, agent := range resourceAgents { - agentsByResourceID[agent.ResourceID] = append(agentsByResourceID[agent.ResourceID], agent) - } - appsByAgentID := map[uuid.UUID][]database.WorkspaceApp{} - for _, app := range agentApps { - appsByAgentID[app.AgentID] = append(appsByAgentID[app.AgentID], app) - } - scriptsByAgentID := map[uuid.UUID][]database.GetWorkspaceAgentScriptsByAgentIDsRow{} - for _, script := range agentScripts { - scriptsByAgentID[script.WorkspaceAgentID] = append(scriptsByAgentID[script.WorkspaceAgentID], script) - } - logSourcesByAgentID := map[uuid.UUID][]database.WorkspaceAgentLogSource{} - for _, logSource := range agentLogSources { - logSourcesByAgentID[logSource.WorkspaceAgentID] = append(logSourcesByAgentID[logSource.WorkspaceAgentID], logSource) - } - provisionerDaemonsForThisWorkspaceBuild := []database.ProvisionerDaemon{} - for _, provisionerDaemon := range provisionerDaemons { - if provisionerDaemon.JobID != job.ProvisionerJob.ID { - continue - } - provisionerDaemonsForThisWorkspaceBuild = append(provisionerDaemonsForThisWorkspaceBuild, provisionerDaemon.ProvisionerDaemon) - } - matchedProvisioners := db2sdk.MatchedProvisioners(provisionerDaemonsForThisWorkspaceBuild, job.ProvisionerJob.CreatedAt, provisionerdserver.StaleInterval) - statusesByAgentID := map[uuid.UUID][]database.WorkspaceAppStatus{} - for _, status := range agentAppStatuses { - statusesByAgentID[status.AgentID] = append(statusesByAgentID[status.AgentID], status) - } + matchedProvisioners := db2sdk.MatchedProvisioners(index.daemonsByJobID[job.ProvisionerJob.ID], job.ProvisionerJob.CreatedAt, provisionerdserver.StaleInterval) - resources := resourcesByJobID[job.ProvisionerJob.ID] + resources := index.resourcesByJobID[job.ProvisionerJob.ID] apiResources := make([]codersdk.WorkspaceResource, 0) resourceAgentsMinOrder := map[uuid.UUID]int32{} // map[resource.ID]minOrder for _, resource := range resources { - agents := agentsByResourceID[resource.ID] - sort.Slice(agents, func(i, j int) bool { - if agents[i].DisplayOrder != agents[j].DisplayOrder { - return agents[i].DisplayOrder < agents[j].DisplayOrder - } - return agents[i].Name < agents[j].Name - }) + agents := index.agentsByResourceID[resource.ID] apiAgents := make([]codersdk.WorkspaceAgent, 0) resourceAgentsMinOrder[resource.ID] = math.MaxInt32 @@ -1381,10 +1407,10 @@ func (api *API) convertWorkspaceBuild( for _, agent := range agents { resourceAgentsMinOrder[resource.ID] = min(resourceAgentsMinOrder[resource.ID], agent.DisplayOrder) - apps := appsByAgentID[agent.ID] - scripts := scriptsByAgentID[agent.ID] - statuses := statusesByAgentID[agent.ID] - logSources := logSourcesByAgentID[agent.ID] + apps := index.appsByAgentID[agent.ID] + scripts := index.scriptsByAgentID[agent.ID] + statuses := index.statusesByAgentID[agent.ID] + logSources := index.logSourcesByAgentID[agent.ID] apiAgent, err := db2sdk.WorkspaceAgent( api.DERPMap(), *api.TailnetCoordinator.Load(), agent, db2sdk.Apps(apps, statuses, agent, workspace.OwnerUsername, workspace.WorkspaceTable()), convertScripts(scripts), convertLogSources(logSources), api.AgentInactiveDisconnectTimeout, api.DeploymentValues.AgentFallbackTroubleshootingURL.String(), @@ -1394,7 +1420,7 @@ func (api *API) convertWorkspaceBuild( } apiAgents = append(apiAgents, apiAgent) } - metadata := append(make([]database.WorkspaceResourceMetadatum, 0), metadataByResourceID[resource.ID]...) + metadata := append(make([]database.WorkspaceResourceMetadatum, 0), index.metadataByResourceID[resource.ID]...) apiResources = append(apiResources, convertWorkspaceResource(resource, apiAgents, metadata)) } sort.Slice(apiResources, func(i, j int) bool { diff --git a/coderd/workspacebuilds_internal_test.go b/coderd/workspacebuilds_internal_test.go new file mode 100644 index 00000000000..f7e9e55c04d --- /dev/null +++ b/coderd/workspacebuilds_internal_test.go @@ -0,0 +1,299 @@ +package coderd + +import ( + "database/sql" + "fmt" + "strings" + "testing" + "time" + + "github.com/google/uuid" + "github.com/stretchr/testify/require" + + "cdr.dev/slog/v3" + "github.com/coder/coder/v2/coderd/database" + "github.com/coder/coder/v2/codersdk" + "github.com/coder/coder/v2/tailnet" +) + +// buildFixture holds one batch of rows shaped like the output of +// workspaceBuildsData: a set of builds plus the flat resource, agent, app, +// script, log source, status, and daemon rows for all of them. +type buildFixture struct { + builds []database.WorkspaceBuild + workspaces []database.Workspace + jobs []database.GetProvisionerJobsByIDsWithQueuePositionRow + templateVersions []database.TemplateVersion + resources []database.WorkspaceResource + metadata []database.WorkspaceResourceMetadatum + agents []database.WorkspaceAgent + apps []database.WorkspaceApp + statuses []database.WorkspaceAppStatus + scripts []database.GetWorkspaceAgentScriptsByAgentIDsRow + logSources []database.WorkspaceAgentLogSource + daemons []database.GetEligibleProvisionerDaemonsByProvisionerJobIDsRow +} + +func newBuildFixture(builds, resourcesPerBuild int, agentsPerResource int32, appsPerAgent int) buildFixture { + now := time.Date(2026, 8, 11, 0, 0, 0, 0, time.UTC) + f := buildFixture{} + for b := range builds { + workspaceID := uuid.New() + jobID := uuid.New() + templateVersionID := uuid.New() + + f.workspaces = append(f.workspaces, database.Workspace{ + ID: workspaceID, + OwnerID: uuid.New(), + OwnerUsername: fmt.Sprintf("owner-%d", b), + Name: fmt.Sprintf("workspace-%d", b), + }) + f.jobs = append(f.jobs, database.GetProvisionerJobsByIDsWithQueuePositionRow{ + ProvisionerJob: database.ProvisionerJob{ + ID: jobID, + CreatedAt: now, + StartedAt: sql.NullTime{Time: now, Valid: true}, + }, + }) + f.templateVersions = append(f.templateVersions, database.TemplateVersion{ + ID: templateVersionID, + Name: fmt.Sprintf("version-%d", b), + }) + f.builds = append(f.builds, database.WorkspaceBuild{ + ID: uuid.New(), + WorkspaceID: workspaceID, + JobID: jobID, + TemplateVersionID: templateVersionID, + BuildNumber: 1, + Transition: database.WorkspaceTransitionStart, + }) + f.daemons = append(f.daemons, database.GetEligibleProvisionerDaemonsByProvisionerJobIDsRow{ + JobID: jobID, + ProvisionerDaemon: database.ProvisionerDaemon{ + ID: uuid.New(), + Name: fmt.Sprintf("daemon-%d", b), + LastSeenAt: sql.NullTime{Time: now, Valid: true}, + Provisioners: []database.ProvisionerType{database.ProvisionerTypeEcho}, + }, + }) + + for r := range resourcesPerBuild { + resourceID := uuid.New() + f.resources = append(f.resources, database.WorkspaceResource{ + ID: resourceID, + JobID: jobID, + Transition: database.WorkspaceTransitionStart, + Type: "example", + Name: fmt.Sprintf("resource-%d-%d", b, r), + }) + f.metadata = append(f.metadata, database.WorkspaceResourceMetadatum{ + WorkspaceResourceID: resourceID, + Key: "key", + Value: sql.NullString{String: "value", Valid: true}, + }) + + for a := range agentsPerResource { + agentID := uuid.New() + f.agents = append(f.agents, database.WorkspaceAgent{ + ID: agentID, + ResourceID: resourceID, + Name: fmt.Sprintf("agent-%d-%d-%d", b, r, a), + DisplayOrder: agentsPerResource - a, + APIKeyScope: database.AgentKeyScopeEnumAll, + }) + f.scripts = append(f.scripts, database.GetWorkspaceAgentScriptsByAgentIDsRow{ + WorkspaceAgentID: agentID, + Script: "echo hello", + }) + f.logSources = append(f.logSources, database.WorkspaceAgentLogSource{ + WorkspaceAgentID: agentID, + DisplayName: "startup", + }) + + for p := range appsPerAgent { + appID := uuid.New() + f.apps = append(f.apps, database.WorkspaceApp{ + ID: appID, + AgentID: agentID, + Slug: fmt.Sprintf("app-%d-%d-%d-%d", b, r, a, p), + DisplayName: "App", + Health: database.WorkspaceAppHealthHealthy, + SharingLevel: database.AppSharingLevelOwner, + OpenIn: database.WorkspaceAppOpenInSlimWindow, + }) + f.statuses = append(f.statuses, database.WorkspaceAppStatus{ + ID: uuid.New(), + AgentID: agentID, + AppID: appID, + State: database.WorkspaceAppStatusStateComplete, + }) + } + } + } + } + return f +} + +func newConvertAPI() *API { + api := &API{ + Options: &Options{ + AgentInactiveDisconnectTimeout: time.Minute, + DeploymentValues: &codersdk.DeploymentValues{}, + }, + } + coordinator := tailnet.NewCoordinator(slog.Logger{}) + api.TailnetCoordinator.Store(&coordinator) + return api +} + +func (f buildFixture) convert(api *API) ([]codersdk.WorkspaceBuild, error) { + return api.convertWorkspaceBuilds( + f.builds, + f.workspaces, + f.jobs, + f.resources, + f.metadata, + f.agents, + f.apps, + f.statuses, + f.scripts, + f.logSources, + f.templateVersions, + f.daemons, + ) +} + +// TestConvertWorkspaceBuildsAgentOrder covers the ordering that the shared +// index is responsible for: agents come back sorted by display order. The +// fixture assigns display order in reverse of agent name, so the expected +// result is names in descending order. +func TestConvertWorkspaceBuildsAgentOrder(t *testing.T) { + t.Parallel() + + api := newConvertAPI() + fixture := newBuildFixture(3, 2, 3, 1) + + builds, err := fixture.convert(api) + require.NoError(t, err) + require.Len(t, builds, 3) + + for _, build := range builds { + require.NotEmpty(t, build.Resources) + for _, resource := range build.Resources { + require.Len(t, resource.Agents, 3) + for i := 1; i < len(resource.Agents); i++ { + require.Greater(t, resource.Agents[i-1].Name, resource.Agents[i].Name) + } + } + } +} + +// TestConvertWorkspaceBuildsAgentNameTiebreak covers the second half of the +// agent comparison: agents sharing a display order are ordered by name. +func TestConvertWorkspaceBuildsAgentNameTiebreak(t *testing.T) { + t.Parallel() + + api := newConvertAPI() + fixture := newBuildFixture(1, 1, 3, 1) + for i := range fixture.agents { + fixture.agents[i].DisplayOrder = 0 + } + + builds, err := fixture.convert(api) + require.NoError(t, err) + require.Len(t, builds, 1) + require.Len(t, builds[0].Resources, 1) + + agents := builds[0].Resources[0].Agents + require.Len(t, agents, 3) + for i := 1; i < len(agents); i++ { + require.Less(t, agents[i-1].Name, agents[i].Name) + } +} + +// TestConvertWorkspaceBuildsRowsPerBuild asserts that a build receives only the +// rows keyed to its own job and agents. The fixture encodes the build index in +// app slugs, so apps read from another build are detectable by slug. +func TestConvertWorkspaceBuildsRowsPerBuild(t *testing.T) { + t.Parallel() + + const ( + buildCount = 3 + resourcesPerJob = 2 + agentsPerRes = 2 + appsPerAgent = 2 + ) + + api := newConvertAPI() + fixture := newBuildFixture(buildCount, resourcesPerJob, agentsPerRes, appsPerAgent) + + builds, err := fixture.convert(api) + require.NoError(t, err) + require.Len(t, builds, buildCount) + + for b, build := range builds { + require.Len(t, build.Resources, resourcesPerJob) + + for _, resource := range build.Resources { + require.Equal(t, fixture.jobs[b].ProvisionerJob.ID, resource.JobID) + require.Len(t, resource.Metadata, 1) + require.Len(t, resource.Agents, agentsPerRes) + + for _, agent := range resource.Agents { + require.Len(t, agent.Scripts, 1) + require.Len(t, agent.LogSources, 1) + require.Len(t, agent.Apps, appsPerAgent) + + for _, app := range agent.Apps { + require.True(t, strings.HasPrefix(app.Slug, fmt.Sprintf("app-%d-", b)), app.Slug) + require.Len(t, app.Statuses, 1) + } + } + } + } +} + +// TestConvertWorkspaceBuildsMatchedProvisioners asserts that eligible daemons +// are matched to the build whose job they were fetched for. The last build in +// the batch has no daemon rows, so it reports zero counts while the others +// report one. +func TestConvertWorkspaceBuildsMatchedProvisioners(t *testing.T) { + t.Parallel() + + api := newConvertAPI() + fixture := newBuildFixture(3, 1, 1, 1) + fixture.daemons = fixture.daemons[:len(fixture.daemons)-1] + + builds, err := fixture.convert(api) + require.NoError(t, err) + require.Len(t, builds, 3) + + for _, build := range builds[:2] { + require.NotNil(t, build.MatchedProvisioners) + require.Equal(t, 1, build.MatchedProvisioners.Count) + require.Equal(t, 1, build.MatchedProvisioners.Available) + require.True(t, build.MatchedProvisioners.MostRecentlySeen.Valid) + } + + last := builds[2] + require.NotNil(t, last.MatchedProvisioners) + require.Equal(t, 0, last.MatchedProvisioners.Count) + require.Equal(t, 0, last.MatchedProvisioners.Available) + require.False(t, last.MatchedProvisioners.MostRecentlySeen.Valid) +} + +func BenchmarkConvertWorkspaceBuilds(b *testing.B) { + for _, builds := range []int{1, 25, 100} { + b.Run(fmt.Sprintf("Builds%d", builds), func(b *testing.B) { + api := newConvertAPI() + fixture := newBuildFixture(builds, 5, 2, 4) + + b.ReportAllocs() + for b.Loop() { + if _, err := fixture.convert(api); err != nil { + b.Fatal(err) + } + } + }) + } +} diff --git a/coderd/workspaces.go b/coderd/workspaces.go index eb89dc723cf..da8339c9ab8 100644 --- a/coderd/workspaces.go +++ b/coderd/workspaces.go @@ -830,15 +830,8 @@ func createWorkspace( ProvisionerJob: *provisionerJob, QueuePosition: 0, }, - []database.WorkspaceResource{}, - []database.WorkspaceResourceMetadatum{}, - []database.WorkspaceAgent{}, - []database.WorkspaceApp{}, - []database.WorkspaceAppStatus{}, - []database.GetWorkspaceAgentScriptsByAgentIDsRow{}, - []database.WorkspaceAgentLogSource{}, + newWorkspaceBuildIndex(nil, nil, nil, nil, nil, nil, nil, provisionerDaemons), database.TemplateVersion{}, - provisionerDaemons, ) if err != nil { return codersdk.Workspace{}, httperror.NewResponseError(http.StatusInternalServerError, codersdk.Response{ From c3bc41ff139eb63473cca0db5196596f633a996d Mon Sep 17 00:00:00 2001 From: Garrett Delfosse Date: Thu, 17 Sep 2026 23:17:45 -0400 Subject: [PATCH 59/69] fix(scripts/releaser): scope breaking-change check to commits since previous release (#29487) (#29496) Backport of #29487 to `release/2.36`. The patch-release breaking-change check listed every merged PR labeled `release/breaking` against the branch with no range filter, so breaking changes from earlier patches were reported on every subsequent patch release. Detection is now scoped to `prevVersion..HEAD` for both the `!` title marker and the label.

Backport context

Cherry-picks `86a050de439cb04dca9bed546ce0c0a0b208fd7b` without changes. This branch already has the GPG prompt removal (#27422).

Generated by Coder Agents on behalf of @f0ssel. --- scripts/releaser/commit.go | 15 +++++++ scripts/releaser/commit_test.go | 70 +++++++++++++++++++++++++++++++++ scripts/releaser/github.go | 51 +++++++++++------------- scripts/releaser/release.go | 52 ++++++------------------ 4 files changed, 118 insertions(+), 70 deletions(-) create mode 100644 scripts/releaser/commit_test.go diff --git a/scripts/releaser/commit.go b/scripts/releaser/commit.go index 37bdfcb7b5c..e182e25d2ee 100644 --- a/scripts/releaser/commit.go +++ b/scripts/releaser/commit.go @@ -186,6 +186,21 @@ func humanizeTitle(title string) string { // breakingCommitRe matches conventional commit "!:" breaking changes. var breakingCommitRe = regexp.MustCompile(`^[a-zA-Z]+($.+$)?!:`) +// findBreakingCommits returns the commits categorized as breaking, +// either by a "!" title marker or a release/breaking label on the +// source PR. Only the given commits are considered, so callers control +// the range (e.g. prevVersion..HEAD). +func findBreakingCommits(commits []commitEntry, prMeta *prMetadataMaps) []commitEntry { + var breaking []commitEntry + for _, c := range commits { + meta := prMeta.lookupCommit(c.FullSHA, c.PRCount) + if categorizeCommit(c.Title, meta.Labels) == "breaking" { + breaking = append(breaking, c) + } + } + return breaking +} + // categorizeCommit determines the release note section for a commit. // The priority order matches the bash script: breaking title first, // then labels (breaking, security, experimental), then prefix. diff --git a/scripts/releaser/commit_test.go b/scripts/releaser/commit_test.go new file mode 100644 index 00000000000..ff1771b3796 --- /dev/null +++ b/scripts/releaser/commit_test.go @@ -0,0 +1,70 @@ +package main //nolint:testpackage // Tests unexported release helpers. + +import ( + "testing" +) + +func TestFindBreakingCommits(t *testing.T) { + t.Parallel() + + // Metadata for PRs that were labeled release/breaking. #10 is + // keyed by merge-commit SHA (direct merge), #20 only by PR + // number (cherry-picked, so the SHA on the release branch + // differs from the merge commit on main). #99 is labeled but + // deliberately absent from the commit list, simulating a + // breaking PR that shipped in an earlier release on the branch. + prMeta := &prMetadataMaps{ + bySHA: map[string]prMetadata{ + "aaa": {Labels: []string{"release/breaking"}}, + }, + byNumber: map[int]prMetadata{ + 10: {Labels: []string{"release/breaking"}}, + 20: {Labels: []string{"release/breaking"}}, + 99: {Labels: []string{"release/breaking"}}, + }, + } + + commits := []commitEntry{ + {SHA: "aaa", FullSHA: "aaa", Title: "feat: labeled via sha (#10)", PRCount: 10}, + {SHA: "bbb", FullSHA: "bbb", Title: "fix: labeled via pr number (#20)", PRCount: 20}, + {SHA: "ccc", FullSHA: "ccc", Title: "feat(cli)!: bang title (#30)", PRCount: 30}, + {SHA: "ddd", FullSHA: "ddd", Title: "fix: ordinary change (#40)", PRCount: 40}, + {SHA: "eee", FullSHA: "eee", Title: "chore: no pr number"}, + } + + got := findBreakingCommits(commits, prMeta) + + want := []string{"aaa", "bbb", "ccc"} + if len(got) != len(want) { + t.Fatalf("got %d breaking commits, want %d: %+v", len(got), len(want), got) + } + for i, c := range got { + if c.SHA != want[i] { + t.Fatalf("breaking[%d] = %s, want %s", i, c.SHA, want[i]) + } + } +} + +func TestFindBreakingCommitsWithoutMetadata(t *testing.T) { + t.Parallel() + + // With no PR metadata (gh unavailable), only "!" titles are + // detected. + prMeta := &prMetadataMaps{ + bySHA: map[string]prMetadata{}, + byNumber: map[int]prMetadata{}, + } + commits := []commitEntry{ + {SHA: "aaa", FullSHA: "aaa", Title: "feat!: bang (#1)", PRCount: 1}, + {SHA: "bbb", FullSHA: "bbb", Title: "feat: plain (#2)", PRCount: 2}, + } + + got := findBreakingCommits(commits, prMeta) + if len(got) != 1 || got[0].SHA != "aaa" { + t.Fatalf("got %+v, want only aaa", got) + } + + if got := findBreakingCommits(nil, prMeta); got != nil { + t.Fatalf("got %+v for no commits, want nil", got) + } +} diff --git a/scripts/releaser/github.go b/scripts/releaser/github.go index 75df80960f0..e63fec5a8eb 100644 --- a/scripts/releaser/github.go +++ b/scripts/releaser/github.go @@ -2,6 +2,7 @@ package main import ( "errors" + "io" "os/exec" "slices" "strconv" @@ -73,35 +74,6 @@ func ghListOpenPRs(branch string) ([]ghPR, error) { return prs, nil } -// ghListPRsWithLabel returns merged PRs targeting the given branch -// that have a specific label. -func ghListPRsWithLabel(branch, label string) ([]ghPR, error) { - out, err := ghOutput("pr", "list", - "--repo", owner+"/"+repo, - "--base", branch, - "--state", "merged", - "--label", label, - "--json", "number,title", - "--jq", `.[] | "\(.number)\t\(.title)"`, - ) - if err != nil { - return nil, err - } - if out == "" { - return nil, nil - } - var prs []ghPR - for _, line := range strings.Split(out, "\n") { - parts := strings.SplitN(line, "\t", 2) - if len(parts) < 2 { - continue - } - num, _ := strconv.Atoi(parts[0]) - prs = append(prs, ghPR{Number: num, Title: parts[1]}) - } - return prs, nil -} - // prMetadata holds labels and author for a merged PR. type prMetadata struct { Labels []string @@ -129,6 +101,27 @@ func (m *prMetadataMaps) lookupCommit(fullSHA string, prNumber int) prMetadata { return prMetadata{} } +// loadPRMetadata fetches PR metadata for the given commits via the gh +// CLI. It never fails: when gh is unavailable or the query errors, a +// warning is written and empty maps are returned so callers degrade to +// title-only categorization. +// +//nolint:revive // ghAvailable gates the gh CLI call; matches Run(dryRun). +func loadPRMetadata(w io.Writer, ghAvailable bool, commits []commitEntry) *prMetadataMaps { + if ghAvailable { + prMeta, err := ghBuildPRMetadataMap(commits) + if err != nil { + warnf(w, "Failed to fetch PR metadata: %v", err) + } else if prMeta != nil { + return prMeta + } + } + return &prMetadataMaps{ + bySHA: make(map[string]prMetadata), + byNumber: make(map[int]prMetadata), + } +} + // ghBuildPRMetadataMap returns PR metadata indexed by both // merge-commit SHA and PR number for merged PRs targeting main. // This matches the bash script's approach of querying --base main diff --git a/scripts/releaser/release.go b/scripts/releaser/release.go index 4af28da1033..dd0988ea0c4 100644 --- a/scripts/releaser/release.go +++ b/scripts/releaser/release.go @@ -451,43 +451,26 @@ func runRelease(ctx context.Context, inv *serpent.Invocation, executor ReleaseEx if newVersion.Major == prevVersion.Major && newVersion.Minor == prevVersion.Minor && newVersion.Patch > prevVersion.Patch { infof(w, "Checking for breaking changes in patch release...") + // Both the "!" title marker and the release/breaking PR + // label are evaluated over prevVersion..HEAD only, so + // breaking changes shipped in earlier releases on this + // branch are not reported again. commitRange := prevVersion.String() + "..HEAD" commits, err := commitLog(commitRange) if err != nil { return xerrors.Errorf("reading commit log: %w", err) } - var breakingCommits []commitEntry - for _, c := range commits { - if breakingCommitRe.MatchString(c.Title) { - breakingCommits = append(breakingCommits, c) - } - } + prMeta := loadPRMetadata(w, ghAvailable, commits) + breakingCommits := findBreakingCommits(commits, prMeta) - // Check PR labels for release/breaking. - var breakingPRLabeled []ghPR - if ghAvailable { - breakingPRLabeled, err = ghListPRsWithLabel(currentBranch, "release/breaking") - if err != nil { - warnf(w, "Failed to check PR labels: %v", err) - } - } - - if len(breakingCommits) > 0 || len(breakingPRLabeled) > 0 { + if len(breakingCommits) > 0 { fmt.Fprintln(w) warnf(w, "BREAKING CHANGES detected in a PATCH release — this violates semver!") fmt.Fprintln(w) - if len(breakingCommits) > 0 { - fmt.Fprintln(w, " Breaking commits (by conventional commit prefix):") - for _, c := range breakingCommits { - fmt.Fprintf(w, " - %s %s\n", c.SHA, c.Title) - } - } - if len(breakingPRLabeled) > 0 { - fmt.Fprintln(w, " PRs labeled release/breaking:") - for _, pr := range breakingPRLabeled { - fmt.Fprintf(w, " - #%d %s\n", pr.Number, pr.Title) - } + fmt.Fprintf(w, " Breaking changes since %s:\n", prevVersion) + for _, c := range breakingCommits { + fmt.Fprintf(w, " - %s %s\n", c.SHA, c.Title) } fmt.Fprintln(w) if err := confirmWithDefault(inv, "Continue with patch release despite breaking changes?", cliui.ConfirmNo); err != nil { @@ -576,20 +559,7 @@ func runRelease(ctx context.Context, inv *serpent.Invocation, executor ReleaseEx return xerrors.Errorf("reading commit log: %w", err) } - // Build PR metadata maps (by SHA and PR number) via gh CLI. - var prMeta *prMetadataMaps - if ghAvailable { - prMeta, err = ghBuildPRMetadataMap(commits) - if err != nil { - warnf(w, "Failed to fetch PR metadata: %v", err) - } - } - if prMeta == nil { - prMeta = &prMetadataMaps{ - bySHA: make(map[string]prMetadata), - byNumber: make(map[int]prMetadata), - } - } + prMeta := loadPRMetadata(w, ghAvailable, commits) type section struct { Key string From 5caa200d5d8d6998e549a56cb032e53e5a808094 Mon Sep 17 00:00:00 2001 From: dylanhuff-at-coder Date: Tue, 22 Sep 2026 17:40:12 -0400 Subject: [PATCH 60/69] fix: prevent tailnet coordination panics (#29300) (#29745) Backport #29300 to `release/2.36` for [PLAT-595](https://linear.app/codercom/issue/PLAT-595). This includes the full tailnet request validation, panic recovery, peer cleanup fixes, and regression tests. --- enterprise/tailnet/connio.go | 16 ++ enterprise/tailnet/connio_internal_test.go | 89 +++++++++ enterprise/tailnet/mapper_internal_test.go | 55 ++++++ enterprise/tailnet/pgcoord.go | 11 ++ enterprise/tailnet/requests_test.go | 33 ++++ tailnet/coordinator.go | 29 +++ tailnet/coordinator_internal_test.go | 212 +++++++++++++++++++++ tailnet/peer.go | 12 +- tailnet/peer_internal_test.go | 119 ++++++++++++ tailnet/requests.go | 31 +++ tailnet/requests_test.go | 100 ++++++++++ tailnet/test/peer.go | 9 + tailnet/test/requests.go | 116 +++++++++++ tailnet/tunnel.go | 6 + 14 files changed, 837 insertions(+), 1 deletion(-) create mode 100644 enterprise/tailnet/connio_internal_test.go create mode 100644 enterprise/tailnet/mapper_internal_test.go create mode 100644 enterprise/tailnet/requests_test.go create mode 100644 tailnet/peer_internal_test.go create mode 100644 tailnet/requests.go create mode 100644 tailnet/requests_test.go create mode 100644 tailnet/test/requests.go diff --git a/enterprise/tailnet/connio.go b/enterprise/tailnet/connio.go index 7c186dc1a04..0803aa79f5f 100644 --- a/enterprise/tailnet/connio.go +++ b/enterprise/tailnet/connio.go @@ -3,6 +3,7 @@ package tailnet import ( "context" "fmt" + "runtime/debug" "slices" "sync" @@ -100,6 +101,17 @@ func (c *connIO) recvLoop() { } }() defer c.Close() + // This must be deferred after Close so it runs first: Enqueue needs the + // response channel open to deliver CloseErrInternal to the peer. + defer func() { + if recovered := recover(); recovered != nil { + c.logger.Error(c.peerCtx, "panic handling peer request (recovered)", + slog.F("panic", recovered), + slog.F("stack", string(debug.Stack())), + ) + _ = c.Enqueue(&proto.CoordinateResponse{Error: agpl.CloseErrInternal}) + } + }() for { select { case <-c.coordCtx.Done(): @@ -128,6 +140,10 @@ var errDisconnect = xerrors.New("graceful disconnect") func (c *connIO) handleRequest(req *proto.CoordinateRequest) error { c.logger.Debug(c.peerCtx, "got request") + if err := agpl.ValidateCoordinateRequest(req); err != nil { + c.logger.Warn(c.peerCtx, "invalid coordinate request", slog.Error(err)) + return err + } err := c.auth.Authorize(c.peerCtx, req) if err != nil { c.logger.Warn(c.peerCtx, "unauthorized request", slog.Error(err)) diff --git a/enterprise/tailnet/connio_internal_test.go b/enterprise/tailnet/connio_internal_test.go new file mode 100644 index 00000000000..77649c2ed83 --- /dev/null +++ b/enterprise/tailnet/connio_internal_test.go @@ -0,0 +1,89 @@ +package tailnet + +import ( + "context" + "strings" + "testing" + + "github.com/google/uuid" + "github.com/stretchr/testify/require" + + "cdr.dev/slog/v3/sloggers/sloghuman" + "cdr.dev/slog/v3/sloggers/slogtest" + agpl "github.com/coder/coder/v2/tailnet" + "github.com/coder/coder/v2/tailnet/proto" + agpltest "github.com/coder/coder/v2/tailnet/test" + "github.com/coder/coder/v2/testutil" +) + +func TestConnIOHandleRequestRejectsBeforeMutation(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitShort) + bindings := make(chan binding, 1) + var logbuf strings.Builder + c := &connIO{ + id: uuid.New(), + coordCtx: ctx, + peerCtx: ctx, + logger: slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).AppendSinks(sloghuman.Sink(&logbuf)), + bindings: bindings, + auth: agpl.SingleTailnetCoordinateeAuth{}, + } + + err := c.handleRequest(&proto.CoordinateRequest{ + UpdateSelf: &proto.CoordinateRequest_UpdateSelf{Node: &proto.Node{ + PreferredDerp: 31002, + }}, + ReadyForHandshake: []*proto.CoordinateRequest_ReadyForHandshake{nil}, + }) + require.EqualError(t, err, "ready_for_handshake entries must not be nil") + require.Contains(t, logbuf.String(), "invalid coordinate request") + select { + case binding := <-bindings: + t.Fatalf("unexpected binding: %+v", binding) + default: + } +} + +func TestConnIORecvLoopPanicAfterAuthorization(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitShort) + logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}) + bindings := make(chan binding, 1) + requests := make(chan *proto.CoordinateRequest, 1) + responses := make(chan *proto.CoordinateResponse, 1) + rfhs := make(chan readyForHandshake) + close(rfhs) + authorized := make(chan struct{}, 1) + peerID := uuid.New() + destinationID := uuid.New() + c := newConnIO(ctx, ctx, logger, bindings, make(chan tunnel, 1), rfhs, + requests, responses, peerID, t.Name(), agpltest.CoordinateeAuthFunc(func(context.Context, *proto.CoordinateRequest) error { + authorized <- struct{}{} + return nil + })) + t.Cleanup(func() { require.NoError(t, c.Close()) }) + c.setLatestMapping([]mapping{{peer: destinationID}}) + + testutil.RequireSend(ctx, t, requests, &proto.CoordinateRequest{ + ReadyForHandshake: []*proto.CoordinateRequest_ReadyForHandshake{{Id: agpl.UUIDToByteSlice(destinationID)}}, + }) + testutil.RequireReceive(ctx, t, authorized) + response := testutil.RequireReceive(ctx, t, responses) + require.Equal(t, agpl.CloseErrInternal, response.Error) + require.NotContains(t, response.Error, "send on closed channel") + select { + case _, ok := <-responses: + require.False(t, ok) + case <-ctx.Done(): + t.Fatal("response channel did not close") + } + select { + case <-c.Done(): + case <-ctx.Done(): + t.Fatal("connection did not close") + } + withdrawn := testutil.RequireReceive(ctx, t, bindings) + require.Equal(t, bKey(peerID), withdrawn.bKey) + require.Equal(t, proto.CoordinateResponse_PeerUpdate_LOST, withdrawn.kind) +} diff --git a/enterprise/tailnet/mapper_internal_test.go b/enterprise/tailnet/mapper_internal_test.go new file mode 100644 index 00000000000..f5c2c70f564 --- /dev/null +++ b/enterprise/tailnet/mapper_internal_test.go @@ -0,0 +1,55 @@ +package tailnet + +import ( + "testing" + + "github.com/google/uuid" + "github.com/stretchr/testify/require" + + "cdr.dev/slog/v3/sloggers/slogtest" + agpl "github.com/coder/coder/v2/tailnet" + "github.com/coder/coder/v2/tailnet/proto" + "github.com/coder/coder/v2/testutil" +) + +func TestMapperPanic(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}) + bindings := make(chan binding, 1) + responses := make(chan *proto.CoordinateResponse, 2) + c := newConnIO(ctx, ctx, logger, bindings, make(chan tunnel, 1), nil, + make(chan *proto.CoordinateRequest), responses, uuid.New(), t.Name(), agpl.SingleTailnetCoordinateeAuth{}) + t.Cleanup(func() { require.NoError(t, c.Close()) }) + coordinatorID := uuid.New() + m := &mapper{ + ctx: c.peerCtx, + logger: logger, + c: c, + mappings: make(chan []mapping), + heartbeats: &heartbeats{self: coordinatorID}, + // A nil sent map forces a panic after the mapping has been selected. + sent: nil, + } + go m.run() + require.NoError(t, agpl.SendCtx(ctx, m.mappings, []mapping{{ + peer: uuid.New(), coordinator: coordinatorID, + node: &proto.Node{}, kind: proto.CoordinateResponse_PeerUpdate_NODE, + }})) + response := testutil.RequireReceive(ctx, t, responses) + require.Equal(t, agpl.CloseErrInternal, response.Error) + select { + case _, ok := <-responses: + require.False(t, ok) + case <-ctx.Done(): + t.Fatal("response channel did not close") + } + select { + case <-c.Done(): + case <-ctx.Done(): + t.Fatal("connection did not close") + } + withdrawn := testutil.RequireReceive(ctx, t, bindings) + require.Equal(t, bKey(c.id), withdrawn.bKey) + require.Equal(t, proto.CoordinateResponse_PeerUpdate_LOST, withdrawn.kind) +} diff --git a/enterprise/tailnet/pgcoord.go b/enterprise/tailnet/pgcoord.go index 08325e567fc..4018b8aabf7 100644 --- a/enterprise/tailnet/pgcoord.go +++ b/enterprise/tailnet/pgcoord.go @@ -4,6 +4,7 @@ import ( "context" "database/sql" "math" + "runtime/debug" "slices" "strings" "sync" @@ -742,6 +743,16 @@ func newMapper(c *connIO, logger slog.Logger, h *heartbeats) *mapper { } func (m *mapper) run() { + defer func() { + if recovered := recover(); recovered != nil { + m.logger.Error(m.ctx, "panic processing peer mappings (recovered)", + slog.F("panic", recovered), + slog.F("stack", string(debug.Stack())), + ) + _ = m.c.Enqueue(&proto.CoordinateResponse{Error: agpl.CloseErrInternal}) + _ = m.c.Close() + } + }() for { var best map[uuid.UUID]mapping select { diff --git a/enterprise/tailnet/requests_test.go b/enterprise/tailnet/requests_test.go new file mode 100644 index 00000000000..32ebeeb2ada --- /dev/null +++ b/enterprise/tailnet/requests_test.go @@ -0,0 +1,33 @@ +package tailnet_test + +import ( + "testing" + + "github.com/stretchr/testify/require" + + "cdr.dev/slog/v3/sloggers/slogtest" + "github.com/coder/coder/v2/coderd/database/dbtestutil" + "github.com/coder/coder/v2/enterprise/tailnet" + "github.com/coder/coder/v2/tailnet/test" + "github.com/coder/coder/v2/testutil" +) + +func TestPGCoordinator_InvalidRequests(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + store, ps := dbtestutil.NewDB(t) + coordinator, err := tailnet.NewPGCoord(ctx, slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}), ps, store) + require.NoError(t, err) + t.Cleanup(func() { _ = coordinator.Close() }) + test.InvalidCoordinateRequestTest(ctx, t, coordinator) +} + +func TestPGCoordinator_RequestPanic(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + store, ps := dbtestutil.NewDB(t) + coordinator, err := tailnet.NewPGCoord(ctx, slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}), ps, store) + require.NoError(t, err) + t.Cleanup(func() { _ = coordinator.Close() }) + test.CoordinateRequestPanicTest(ctx, t, coordinator) +} diff --git a/tailnet/coordinator.go b/tailnet/coordinator.go index c3df906b4d8..79db8ca0a22 100644 --- a/tailnet/coordinator.go +++ b/tailnet/coordinator.go @@ -7,6 +7,7 @@ import ( "io" "net/http" "net/netip" + runtimedebug "runtime/debug" "sync" "time" @@ -27,6 +28,7 @@ const ( RequestBufferSize = 32 CloseErrOverwritten = "peer ID overwritten by new connection" CloseErrCoordinatorClose = "coordinator closed" + CloseErrInternal = "internal coordinator error" ReadyForHandshakeError = "ready for handshake error" ) @@ -176,6 +178,15 @@ func (c *coordinator) Coordinate( c.wg.Add(1) go func() { defer c.wg.Done() + // Peer cleanup can also panic, outside reqLoop's recovery boundary. + defer func() { + if recovered := recover(); recovered != nil { + logger.Error(ctx, "panic coordinating peer (recovered)", + slog.F("panic", recovered), + slog.F("stack", string(runtimedebug.Stack())), + ) + } + }() loopErr := p.reqLoop(ctx, logger, c.core.handleRequest) closeErrStr := "" if loopErr != nil { @@ -235,6 +246,9 @@ func (c *core) node(id uuid.UUID) *Node { } func (c *core) handleRequest(ctx context.Context, p *peer, req *proto.CoordinateRequest) error { + if err := ValidateCoordinateRequest(req); err != nil { + return err + } c.mutex.Lock() defer c.mutex.Unlock() if c.closed { @@ -290,6 +304,10 @@ func (c *core) handleRequest(ctx context.Context, p *peer, req *proto.Coordinate } if req.Disconnect != nil { c.removePeerLocked(p.id, proto.CoordinateResponse_PeerUpdate_DISCONNECTED, "graceful disconnect", "") + // The peer and its response channel are gone, so nothing else in this + // request can be delivered. Matches the enterprise coordinator, which + // stops processing a request once it sees Disconnect. + return nil } if rfhs := req.ReadyForHandshake; rfhs != nil { err := c.handleReadyForHandshakeLocked(pr, rfhs) @@ -349,6 +367,10 @@ func (c *core) nodeUpdateLocked(p *peer, node *proto.Node) (err error) { p.node = node c.updateTunnelPeersLocked(p.id, node, proto.CoordinateResponse_PeerUpdate_NODE, "node update") + // Fan-out can recursively remove this peer if its response buffer is full. + if c.peers[p.id] != p { + return ErrAlreadyRemoved + } return nil } @@ -480,6 +502,13 @@ func (c *core) removePeerLocked(id uuid.UUID, kind proto.CoordinateResponse_Peer return } c.updateTunnelPeersLocked(id, nil, kind, reason) + if _, ok := c.peers[id]; !ok { + // A tunnel peer with a full response buffer gets removed during the + // fan-out above, and removing it fans out to us in turn. When that + // nested call already closed and deleted this peer, p is stale and + // closing p.resps again would panic. Nothing is left to do. + return + } c.tunnels.removeAll(id) if closeErr != "" { select { diff --git a/tailnet/coordinator_internal_test.go b/tailnet/coordinator_internal_test.go index 9f5ac7c6a46..654bf28015e 100644 --- a/tailnet/coordinator_internal_test.go +++ b/tailnet/coordinator_internal_test.go @@ -2,6 +2,7 @@ package tailnet import ( "bytes" + "context" "flag" "os" "path/filepath" @@ -11,6 +12,11 @@ import ( "github.com/google/uuid" "github.com/stretchr/testify/require" + + "cdr.dev/slog/v3" + "cdr.dev/slog/v3/sloggers/slogtest" + "github.com/coder/coder/v2/tailnet/proto" + "github.com/coder/coder/v2/testutil" ) // UpdateGoldenFiles indicates golden files should be updated. @@ -72,3 +78,209 @@ func TestDebugTemplate(t *testing.T) { goldenPath, ) } + +// TestCoreDisconnectIgnoresReadyForHandshake sends Disconnect and +// ReadyForHandshake in one request. Disconnect closes the peer's response +// channel, so the handler must stop there instead of trying to answer the +// handshake on a closed channel. Other peers still see DISCONNECTED. +func TestCoreDisconnectIgnoresReadyForHandshake(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitShort) + logger := testutil.Logger(t) + c := newCore(logger) + t.Cleanup(func() { require.NoError(t, c.close()) }) + + type testPeer struct { + *peer + resps chan *proto.CoordinateResponse + } + newPeer := func(name string, id uuid.UUID, auth CoordinateeAuth) testPeer { + resps := make(chan *proto.CoordinateResponse, ResponseBufferSize) + p := &peer{ + logger: logger.With(slog.F("peer_name", name)), + id: id, + name: name, + resps: resps, + reqs: make(chan *proto.CoordinateRequest, RequestBufferSize), + auth: auth, + sent: make(map[uuid.UUID]*proto.Node), + } + require.NoError(t, c.initPeer(p)) + return testPeer{peer: p, resps: resps} + } + observer := newPeer("observer", uuid.New(), SingleTailnetCoordinateeAuth{}) + leaverID := uuid.New() + leaver := newPeer("leaver", leaverID, AgentCoordinateeAuth{ID: leaverID}) + + require.NoError(t, c.handleRequest(ctx, observer.peer, &proto.CoordinateRequest{ + AddTunnel: &proto.CoordinateRequest_Tunnel{Id: leaver.id[:]}, + })) + require.NoError(t, c.handleRequest(ctx, leaver.peer, &proto.CoordinateRequest{ + UpdateSelf: &proto.CoordinateRequest_UpdateSelf{Node: &proto.Node{PreferredDerp: 1}}, + })) + nodeUpdate := testutil.RequireReceive(ctx, t, observer.resps) + require.Len(t, nodeUpdate.PeerUpdates, 1) + require.Equal(t, proto.CoordinateResponse_PeerUpdate_NODE, nodeUpdate.PeerUpdates[0].Kind) + + stranger := uuid.New() + var err error + require.NotPanics(t, func() { + err = c.handleRequest(ctx, leaver.peer, &proto.CoordinateRequest{ + Disconnect: &proto.CoordinateRequest_Disconnect{}, + ReadyForHandshake: []*proto.CoordinateRequest_ReadyForHandshake{{Id: stranger[:]}}, + }) + }) + require.NoError(t, err) + + // The leaver's channel closes without an error response. + for closed := false; !closed; { + select { + case resp, ok := <-leaver.resps: + if !ok { + closed = true + continue + } + require.Empty(t, resp.Error) + case <-ctx.Done(): + t.Fatal("leaver response channel was not closed") + } + } + c.mutex.RLock() + _, stillPresent := c.peers[leaver.id] + c.mutex.RUnlock() + require.False(t, stillPresent) + + disconnected := testutil.RequireReceive(ctx, t, observer.resps) + require.Len(t, disconnected.PeerUpdates, 1) + gotID, err := uuid.FromBytes(disconnected.PeerUpdates[0].Id) + require.NoError(t, err) + require.Equal(t, leaver.id, gotID) + require.Equal(t, proto.CoordinateResponse_PeerUpdate_DISCONNECTED, disconnected.PeerUpdates[0].Kind) +} + +// TestCoreRemovePeerNestedRemoval sets up two tunneled peers whose response +// buffers are both full, then removes one of them. Notifying the other peer +// fails with ErrWouldBlock, which removes that peer too, and notifying back +// removes the first peer inside the nested call. The outer removePeerLocked +// must notice its peer is already gone instead of closing the channel again. +// Both request handling and lostPeer cleanup must finish without relying on +// panic recovery. +func TestCoreRemovePeerNestedRemoval(t *testing.T) { + t.Parallel() + + type fullPeers struct { + core *core + a, b *peer + aResps chan *proto.CoordinateResponse + bResps chan *proto.CoordinateResponse + } + // setup returns a core with peers a and b sharing a tunnel, where each + // peer's single-slot response buffer already holds the other's node. + setup := func(t *testing.T) fullPeers { + // The full buffers make updateTunnelPeersLocked log "failed to update + // mapping" at Error, which is the expected trigger. Anything else at + // Error or Critical, such as "removed non-existent peer", still fails + // the test. + logger := slogtest.Make(t, &slogtest.Options{ + IgnoreErrorFn: func(ent slog.SinkEntry) bool { + return ent.Message == "failed to update mapping" + }, + }).Leveled(slog.LevelDebug) + c := newCore(logger) + t.Cleanup(func() { require.NoError(t, c.close()) }) + newPeer := func(name string) (*peer, chan *proto.CoordinateResponse) { + resps := make(chan *proto.CoordinateResponse, 1) + p := &peer{ + logger: logger.With(slog.F("peer_name", name)), + id: uuid.New(), + name: name, + resps: resps, + reqs: make(chan *proto.CoordinateRequest, RequestBufferSize), + auth: SingleTailnetCoordinateeAuth{}, + sent: make(map[uuid.UUID]*proto.Node), + } + require.NoError(t, c.initPeer(p)) + return p, resps + } + a, aResps := newPeer("a") + b, bResps := newPeer("b") + + c.mutex.Lock() + defer c.mutex.Unlock() + // No tunnel yet, so these updates are not sent anywhere. + require.NoError(t, c.nodeUpdateLocked(a, &proto.Node{PreferredDerp: 1})) + require.NoError(t, c.nodeUpdateLocked(b, &proto.Node{PreferredDerp: 2})) + // Adding the tunnel sends each node to the other peer, which fills + // both buffers. + require.NoError(t, c.addTunnelLocked(a, b.id)) + require.Len(t, aResps, 1) + require.Len(t, bResps, 1) + require.Contains(t, a.sent, b.id) + require.Contains(t, b.sent, a.id) + return fullPeers{core: c, a: a, b: b, aResps: aResps, bResps: bResps} + } + + requireClosed := func(ctx context.Context, t *testing.T, ch chan *proto.CoordinateResponse) { + for { + select { + case _, ok := <-ch: + if !ok { + return + } + case <-ctx.Done(): + t.Fatal("response channel was not closed") + } + } + } + + requireBothRemoved := func(ctx context.Context, t *testing.T, fp fullPeers) { + fp.core.mutex.RLock() + _, aPresent := fp.core.peers[fp.a.id] + _, bPresent := fp.core.peers[fp.b.id] + aTunnels := fp.core.tunnels.findTunnelPeers(fp.a.id) + bTunnels := fp.core.tunnels.findTunnelPeers(fp.b.id) + fp.core.mutex.RUnlock() + require.False(t, aPresent) + require.False(t, bPresent) + require.Empty(t, aTunnels) + require.Empty(t, bTunnels) + requireClosed(ctx, t, fp.aResps) + requireClosed(ctx, t, fp.bResps) + } + + for _, name := range []string{"UpdateSelf", "UpdateSelfAddTunnel", "UpdateSelfReadyForHandshake"} { + t.Run(name, func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitShort) + fp := setup(t) + req := &proto.CoordinateRequest{ + UpdateSelf: &proto.CoordinateRequest_UpdateSelf{Node: &proto.Node{PreferredDerp: 3}}, + } + dstID := uuid.New() + switch name { + case "UpdateSelfAddTunnel": + req.AddTunnel = &proto.CoordinateRequest_Tunnel{Id: dstID[:]} + case "UpdateSelfReadyForHandshake": + req.ReadyForHandshake = []*proto.CoordinateRequest_ReadyForHandshake{{Id: dstID[:]}} + } + var err error + require.NotPanics(t, func() { + err = fp.core.handleRequest(ctx, fp.a, req) + }) + require.NoError(t, err) + requireBothRemoved(ctx, t, fp) + }) + } + + t.Run("LostPeer", func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitShort) + fp := setup(t) + var err error + require.NotPanics(t, func() { + err = fp.core.lostPeer(fp.a, "") + }) + require.NoError(t, err) + requireBothRemoved(ctx, t, fp) + }) +} diff --git a/tailnet/peer.go b/tailnet/peer.go index 1954534a1d1..8631c24e62d 100644 --- a/tailnet/peer.go +++ b/tailnet/peer.go @@ -2,6 +2,7 @@ package tailnet import ( "context" + "runtime/debug" "time" "github.com/google/uuid" @@ -121,7 +122,16 @@ func (p *peer) storeMappingLocked( }, nil } -func (p *peer) reqLoop(ctx context.Context, logger slog.Logger, handler func(context.Context, *peer, *proto.CoordinateRequest) error) error { +func (p *peer) reqLoop(ctx context.Context, logger slog.Logger, handler func(context.Context, *peer, *proto.CoordinateRequest) error) (err error) { + defer func() { + if recovered := recover(); recovered != nil { + logger.Error(ctx, "peerReadLoop panic handling request (recovered)", + slog.F("panic", recovered), + slog.F("stack", string(debug.Stack())), + ) + err = xerrors.New(CloseErrInternal) + } + }() for { select { case <-ctx.Done(): diff --git a/tailnet/peer_internal_test.go b/tailnet/peer_internal_test.go new file mode 100644 index 00000000000..1dd2083e82f --- /dev/null +++ b/tailnet/peer_internal_test.go @@ -0,0 +1,119 @@ +package tailnet + +import ( + "context" + "testing" + + "github.com/google/uuid" + "github.com/stretchr/testify/require" + + "cdr.dev/slog/v3" + "cdr.dev/slog/v3/sloggers/slogtest" + "github.com/coder/coder/v2/tailnet/proto" + "github.com/coder/coder/v2/testutil" +) + +func TestPeerReqLoopPanic(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitShort) + logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}) + requests := make(chan *proto.CoordinateRequest, 1) + responses := make(chan *proto.CoordinateResponse, 1) + p := &peer{ + logger: logger, + id: uuid.New(), + resps: responses, + reqs: requests, + sent: make(map[uuid.UUID]*proto.Node), + } + core := newCore(logger) + require.NoError(t, core.initPeer(p)) + t.Cleanup(func() { require.NoError(t, core.close()) }) + + testutil.RequireSend(ctx, t, requests, &proto.CoordinateRequest{}) + err := p.reqLoop(ctx, logger, func(context.Context, *peer, *proto.CoordinateRequest) error { + panic("private handler panic") + }) + require.EqualError(t, err, CloseErrInternal) + require.NoError(t, core.lostPeer(p, err.Error())) + + response := testutil.RequireReceive(ctx, t, responses) + require.Equal(t, CloseErrInternal, response.Error) + require.NotContains(t, response.Error, "private handler panic") + _, ok := <-responses + require.False(t, ok) + core.mutex.RLock() + _, ok = core.peers[p.id] + core.mutex.RUnlock() + require.False(t, ok) +} + +func TestPeerCleanupPanic(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + id := uuid.New() + sink := &peerCleanupPanicSink{ + FakeSink: testutil.NewFakeSink(t), + peerID: id, + } + logger := slog.Make(sink).Leveled(slog.LevelDebug) + c := NewCoordinator(logger).(*coordinator) + t.Cleanup(func() { require.NoError(t, c.Close()) }) + + requests, responses := c.Coordinate(ctx, id, t.Name(), SingleTailnetCoordinateeAuth{}) + close(requests) + done := make(chan struct{}) + go func() { + c.wg.Wait() + close(done) + }() + testutil.TryReceive(ctx, t, done) + + entries := sink.Entries(func(entry slog.SinkEntry) bool { + return entry.Level == slog.LevelError + }) + require.Len(t, entries, 1) + require.Equal(t, "panic coordinating peer (recovered)", entries[0].Message) + fields := make(map[string]any) + for _, field := range entries[0].Fields { + fields[field.Name] = field.Value + } + require.Equal(t, id, fields["peer_id"]) + require.Equal(t, "private cleanup panic", fields["panic"]) + require.Contains(t, fields["stack"], "(*core).lostPeer") + + // Recovery must leave the core unlocked and the coordinator usable. + healthyID := uuid.New() + healthyRequests, healthyResponses := c.Coordinate(ctx, healthyID, t.Name(), SingleTailnetCoordinateeAuth{}) + close(healthyRequests) + require.Nil(t, testutil.TryReceive(ctx, t, healthyResponses)) + + // Shutdown must still remove the peer whose cleanup was interrupted. + closed := make(chan error, 1) + go func() { closed <- c.Close() }() + require.NoError(t, testutil.RequireReceive(ctx, t, closed)) + response := testutil.RequireReceive(ctx, t, responses) + require.Equal(t, CloseErrCoordinatorClose, response.Error) + require.NotContains(t, response.Error, "private cleanup panic") + require.Nil(t, testutil.TryReceive(ctx, t, responses)) + c.core.mutex.RLock() + _, present := c.core.peers[id] + c.core.mutex.RUnlock() + require.False(t, present) +} + +type peerCleanupPanicSink struct { + *testutil.FakeSink + peerID uuid.UUID +} + +func (s *peerCleanupPanicSink) LogEntry(ctx context.Context, entry slog.SinkEntry) { + if entry.Message == "lostPeer" { + for _, field := range entry.Fields { + if field.Name == "peer_id" && field.Value == s.peerID { + panic("private cleanup panic") + } + } + } + s.FakeSink.LogEntry(ctx, entry) +} diff --git a/tailnet/requests.go b/tailnet/requests.go new file mode 100644 index 00000000000..94cebe151ef --- /dev/null +++ b/tailnet/requests.go @@ -0,0 +1,31 @@ +package tailnet + +import ( + "slices" + + "golang.org/x/xerrors" + + "github.com/coder/coder/v2/tailnet/proto" +) + +// ValidateCoordinateRequest checks the structural invariants required by the +// coordinator before authorization or state updates. +func ValidateCoordinateRequest(req *proto.CoordinateRequest) error { + if req == nil { + return xerrors.New("coordinate request is required") + } + if err := validateUpdateSelf(req); err != nil { + return err + } + if slices.Contains(req.ReadyForHandshake, nil) { + return xerrors.New("ready_for_handshake entries must not be nil") + } + return nil +} + +func validateUpdateSelf(req *proto.CoordinateRequest) error { + if upd := req.GetUpdateSelf(); upd != nil && upd.GetNode() == nil { + return xerrors.New("update_self node is required") + } + return nil +} diff --git a/tailnet/requests_test.go b/tailnet/requests_test.go new file mode 100644 index 00000000000..8d50a507719 --- /dev/null +++ b/tailnet/requests_test.go @@ -0,0 +1,100 @@ +package tailnet_test + +import ( + "testing" + + "github.com/google/uuid" + "github.com/stretchr/testify/require" + + "cdr.dev/slog/v3/sloggers/slogtest" + "github.com/coder/coder/v2/tailnet" + "github.com/coder/coder/v2/tailnet/proto" + "github.com/coder/coder/v2/tailnet/test" + "github.com/coder/coder/v2/testutil" +) + +func TestCoordinateeAuthNilNode(t *testing.T) { + t.Parallel() + for name, auth := range map[string]tailnet.CoordinateeAuth{ + "Agent": tailnet.AgentCoordinateeAuth{ID: uuid.New()}, + "Client": tailnet.ClientCoordinateeAuth{AgentID: uuid.New()}, + "ClientUser": tailnet.ClientUserCoordinateeAuth{}, + } { + t.Run(name, func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitShort) + require.NotPanics(t, func() { + require.EqualError(t, auth.Authorize(ctx, &proto.CoordinateRequest{ + UpdateSelf: &proto.CoordinateRequest_UpdateSelf{}, + }), "update_self node is required") + }) + }) + } +} + +func TestCoordinator_InvalidRequests(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + coordinator := tailnet.NewCoordinator(slogtest.Make(t, &slogtest.Options{IgnoreErrors: true})) + t.Cleanup(func() { require.NoError(t, coordinator.Close()) }) + test.InvalidCoordinateRequestTest(ctx, t, coordinator) +} + +func TestCoordinator_RequestPanic(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + coordinator := tailnet.NewCoordinator(slogtest.Make(t, &slogtest.Options{IgnoreErrors: true})) + t.Cleanup(func() { require.NoError(t, coordinator.Close()) }) + test.CoordinateRequestPanicTest(ctx, t, coordinator) +} + +func TestValidateCoordinateRequest(t *testing.T) { + t.Parallel() + validRFH := &proto.CoordinateRequest_ReadyForHandshake{Id: tailnet.UUIDToByteSlice(uuid.New())} + for _, tc := range []struct { + name string + req *proto.CoordinateRequest + err string // empty means the request is accepted + }{ + {name: "NilRequest", err: "coordinate request is required"}, + {name: "EmptyRequest", req: &proto.CoordinateRequest{}}, + { + name: "NilNode", + req: &proto.CoordinateRequest{UpdateSelf: &proto.CoordinateRequest_UpdateSelf{}}, + err: "update_self node is required", + }, + { + name: "EmptyNode", + req: &proto.CoordinateRequest{UpdateSelf: &proto.CoordinateRequest_UpdateSelf{Node: &proto.Node{}}}, + }, + {name: "NilReadyForHandshake", req: &proto.CoordinateRequest{ReadyForHandshake: nil}}, + { + name: "EmptyReadyForHandshake", + req: &proto.CoordinateRequest{ReadyForHandshake: []*proto.CoordinateRequest_ReadyForHandshake{}}, + }, + { + name: "ValidReadyForHandshake", + req: &proto.CoordinateRequest{ReadyForHandshake: []*proto.CoordinateRequest_ReadyForHandshake{validRFH}}, + }, + { + name: "NilReadyForHandshakeEntry", + req: &proto.CoordinateRequest{ReadyForHandshake: []*proto.CoordinateRequest_ReadyForHandshake{nil}}, + err: "ready_for_handshake entries must not be nil", + }, + { + name: "NilReadyForHandshakeAfterValid", + req: &proto.CoordinateRequest{ReadyForHandshake: []*proto.CoordinateRequest_ReadyForHandshake{validRFH, nil}}, + err: "ready_for_handshake entries must not be nil", + }, + } { + t.Run(tc.name, func(t *testing.T) { + t.Parallel() + err := tailnet.ValidateCoordinateRequest(tc.req) + if tc.err == "" { + require.NoError(t, err) + return + } + require.EqualError(t, err, tc.err) + }) + } +} diff --git a/tailnet/test/peer.go b/tailnet/test/peer.go index 601dc748d42..9dc44f431ed 100644 --- a/tailnet/test/peer.go +++ b/tailnet/test/peer.go @@ -407,3 +407,12 @@ func (f FakeCoordinateeAuth) Authorize(ctx context.Context, _ *proto.CoordinateR } var _ tailnet.CoordinateeAuth = (*FakeCoordinateeAuth)(nil) + +// CoordinateeAuthFunc adapts a plain function to tailnet.CoordinateeAuth so a +// test can return a specific error or panic on a chosen request without +// declaring a new type. +type CoordinateeAuthFunc func(context.Context, *proto.CoordinateRequest) error + +func (f CoordinateeAuthFunc) Authorize(ctx context.Context, req *proto.CoordinateRequest) error { + return f(ctx, req) +} diff --git a/tailnet/test/requests.go b/tailnet/test/requests.go new file mode 100644 index 00000000000..da84432604e --- /dev/null +++ b/tailnet/test/requests.go @@ -0,0 +1,116 @@ +package test + +import ( + "context" + "testing" + + "github.com/stretchr/testify/require" + + "github.com/coder/coder/v2/tailnet" + "github.com/coder/coder/v2/tailnet/proto" +) + +// InvalidCoordinateRequestTest checks that malformed requests are rejected +// before authorization and that a valid node bundled with a malformed entry +// is not published to tunnel peers. +func InvalidCoordinateRequestTest(ctx context.Context, t *testing.T, coordinator tailnet.CoordinatorV2) { + const ( + baselineDERP = 31001 + malformedDERP = 31002 + ) + for _, tc := range []struct { + name string + req *proto.CoordinateRequest + err string + verifyNoMutation bool + }{ + {name: "NilRequest", err: "coordinate request is required"}, + { + name: "NilNode", + req: &proto.CoordinateRequest{UpdateSelf: &proto.CoordinateRequest_UpdateSelf{}}, + err: "update_self node is required", + }, + { + name: "NilReadyForHandshake", + req: &proto.CoordinateRequest{ReadyForHandshake: []*proto.CoordinateRequest_ReadyForHandshake{nil}}, + err: "ready_for_handshake entries must not be nil", + }, + { + name: "NodeAndNilReadyForHandshake", + req: &proto.CoordinateRequest{ + UpdateSelf: &proto.CoordinateRequest_UpdateSelf{Node: &proto.Node{ + PreferredDerp: malformedDERP, + }}, + ReadyForHandshake: []*proto.CoordinateRequest_ReadyForHandshake{nil}, + }, + err: "ready_for_handshake entries must not be nil", + verifyNoMutation: true, + }, + } { + // The cases share the caller's ctx and coordinator, so they run + // sequentially. Parallel subtests would pause until the caller + // returns and, under -parallel=1, could resume after that ctx has + // already expired. + t.Run(tc.name, func(t *testing.T) { + var auth tailnet.CoordinateeAuth = CoordinateeAuthFunc(func(context.Context, *proto.CoordinateRequest) error { + panic("authorization must not see malformed requests") + }) + if tc.verifyNoMutation { + auth = tailnet.SingleTailnetCoordinateeAuth{} + } + peer := NewPeer(ctx, t, coordinator, tc.name, WithAuth(auth)) + defer peer.Close(ctx) + var observer *Peer + if tc.verifyNoMutation { + observer = NewPeer(ctx, t, coordinator, tc.name+"Observer") + defer observer.Close(ctx) + observer.AddTunnel(peer.ID) + peer.UpdateDERP(baselineDERP) + observer.AssertEventuallyHasDERP(peer.ID, baselineDERP) + } + require.NoError(t, tailnet.SendCtx(ctx, peer.reqs, tc.req)) + peer.AssertEventuallyResponsesClosed(tc.err) + if tc.verifyNoMutation { + observer.AssertEventuallyLost(peer.ID) + for _, update := range observer.peerUpdates[peer.ID] { + require.NotEqual(t, int32(malformedDERP), update.GetNode().GetPreferredDerp()) + } + } + }) + } +} + +// CoordinateRequestPanicTest checks that a failed connection is withdrawn while +// other connections continue exchanging updates. +func CoordinateRequestPanicTest(ctx context.Context, t *testing.T, coordinator tailnet.CoordinatorV2) { + broken := NewPeer(ctx, t, coordinator, "broken", WithAuth(CoordinateeAuthFunc(func(_ context.Context, req *proto.CoordinateRequest) error { + if req.Disconnect != nil { + panic("private panic detail") + } + return nil + }))) + defer broken.Close(ctx) + healthy := NewPeer(ctx, t, coordinator, "healthy") + defer healthy.Close(ctx) + other := NewPeer(ctx, t, coordinator, "other") + defer other.Close(ctx) + healthy.AddTunnel(broken.ID) + healthy.AddTunnel(other.ID) + broken.UpdateDERP(1) + healthy.UpdateDERP(2) + other.UpdateDERP(3) + healthy.AssertEventuallyHasDERP(broken.ID, 1) + healthy.AssertEventuallyHasDERP(other.ID, 3) + + broken.Disconnect() + broken.AssertEventuallyResponsesClosed(tailnet.CloseErrInternal) + healthy.AssertEventuallyLost(broken.ID) + + // Empty messages are valid no-ops, and an empty Node is still a Node. + require.NoError(t, tailnet.SendCtx(ctx, other.reqs, &proto.CoordinateRequest{})) + require.NoError(t, tailnet.SendCtx(ctx, other.reqs, &proto.CoordinateRequest{ + UpdateSelf: &proto.CoordinateRequest_UpdateSelf{Node: &proto.Node{}}, + })) + other.UpdateDERP(4) + healthy.AssertEventuallyHasDERP(other.ID, 4) +} diff --git a/tailnet/tunnel.go b/tailnet/tunnel.go index c575d0b986e..86b4a846afa 100644 --- a/tailnet/tunnel.go +++ b/tailnet/tunnel.go @@ -66,6 +66,9 @@ type AgentCoordinateeAuth struct { } func (a AgentCoordinateeAuth) Authorize(_ context.Context, req *proto.CoordinateRequest) error { + if err := validateUpdateSelf(req); err != nil { + return err + } if tun := req.GetAddTunnel(); tun != nil { return xerrors.New("agents cannot open tunnels") } @@ -130,6 +133,9 @@ func (a ClientUserCoordinateeAuth) Authorize(ctx context.Context, req *proto.Coo // handleClientNodeRequests validates GetUpdateSelf requests and declines ReadyForHandshake requests func handleClientNodeRequests(req *proto.CoordinateRequest) error { + if err := validateUpdateSelf(req); err != nil { + return err + } if upd := req.GetUpdateSelf(); upd != nil { for _, addrStr := range upd.Node.Addresses { pre, err := netip.ParsePrefix(addrStr) From 52ce649d80765916c3123a5b7007ec5a7f615c97 Mon Sep 17 00:00:00 2001 From: Nick Vigilante Date: Fri, 25 Sep 2026 14:11:54 -0400 Subject: [PATCH 61/69] docs(docs): document RPM install on RHEL-family Linux (#29295) (#29937) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Backport of https://github.com/coder/coder/pull/29295 Original PR: #29295 — docs(docs): document RPM install on RHEL-family Linux Merge commit: 9afdea48085b35883c2ac3f6ebad0a81dbed2494 Requested by: @nickvigilante The automatic cherry-pick conflicted because `release/2.36` still uses the flat `docs/install/` layout (the install spine restructure that introduced `docs/install/server/` on `main` hasn't been backported here). Resolved manually: - New page at `docs/install/rpm.md` (flat, sibling of `docker.md`, `kubernetes.md`, `openshift.md`, `rancher.md`) instead of `docs/install/server/rpm.md`. - Internal links repointed at this branch's existing paths (e.g. `./kubernetes.md`, `../admin/infrastructure/validated-architectures/index.md`, `../reference/cli/server.md`). - Manifest entry added under "OpenShift" in this branch's flat `docs/install/` list. - Pointer added to `docs/install/cli.md` at `./rpm.md`. All internal links verified to resolve on this branch. Markdown lint, table formatting, and full pre-commit checks pass. --- _This PR and its conflict resolution were created/completed by a Coder Agent on Nick's behalf._ --- docs/install/cli.md | 2 + docs/install/rpm.md | 139 ++++++++++++++++++++++++++++++++++++++++++++ docs/manifest.json | 6 ++ 3 files changed, 147 insertions(+) create mode 100644 docs/install/rpm.md diff --git a/docs/install/cli.md b/docs/install/cli.md index a8e5429143c..66f24a99c9a 100644 --- a/docs/install/cli.md +++ b/docs/install/cli.md @@ -20,6 +20,8 @@ curl -L https://coder.com/install.sh | sh Refer to [GitHub releases](https://github.com/coder/coder/releases) for alternate installation methods (e.g. standalone binaries, system packages). +To run the Coder control plane on a Red Hat Enterprise Linux host or another RHEL-family distribution, refer to [Install Coder on RHEL-family Linux](./rpm.md). + ## Windows If you plan to use the built-in PostgreSQL database, ensure that the diff --git a/docs/install/rpm.md b/docs/install/rpm.md new file mode 100644 index 00000000000..947fb02c983 --- /dev/null +++ b/docs/install/rpm.md @@ -0,0 +1,139 @@ +--- +title: Install Coder on RHEL-family Linux +--- + +This guide is for a Coder deployment administrator who runs the Coder control plane on a single Red Hat Enterprise Linux host or another RHEL-family distribution. +Coder publishes an RPM with every release, and `systemd` manages the server like any other service. +For a multi-replica deployment, refer to [Kubernetes](./kubernetes.md) or [OpenShift](./openshift.md) instead. +To install the CLI on a client machine that connects to an existing deployment, refer to [Install the Coder CLI](./cli.md). + +## Supported distributions + +Coder builds one RPM per release and architecture. +The install script reads `/etc/os-release` and selects the RPM when `ID` or `ID_LIKE` names a Fedora-family or openSUSE-family distribution. + +| Distribution | Versions | `ID` | +|--------------------------|------------------|----------------------------------------| +| Red Hat Enterprise Linux | 8, 9, 10 | `rhel` | +| Rocky Linux | 8, 9, 10 | `rocky` | +| AlmaLinux | 8, 9, 10 | `almalinux` | +| CentOS Stream | 9, 10 | `centos` | +| Amazon Linux | 2, 2023 | `amzn` | +| Fedora | Current releases | `fedora` | +| openSUSE | Leap, Tumbleweed | `opensuse-leap`, `opensuse-tumbleweed` | + +Every RHEL-family distribution in the table lists `fedora` in `ID_LIKE`, and both openSUSE variants list `opensuse`. +A derivative that isn't listed here takes the same path when its `ID_LIKE` includes `fedora`. +Each release publishes RPMs for `amd64`, `arm64`, and `armv7`. + +## Requirements + +- A host running one of the distributions above. +- 2 CPU cores and 4 GB of memory to evaluate Coder. + For production sizing, refer to the [Coder Validated Architecture](../admin/infrastructure/validated-architectures/index.md). +- `root` or `sudo` access. +- An external PostgreSQL database for anything beyond a proof of concept. + Refer to [Using an external database](../tutorials/external-database.md). + +## Install the package + +The install script detects the distribution and installs the matching RPM. +Install the package directly with `dnf` or `rpm` when the host can't run a piped shell script, or when you stage packages yourself. + +

+ +### Install script + +```sh +curl -fsSL https://coder.com/install.sh | sh +``` + +The script installs the latest mainline release. +Pass `--stable` for the latest stable release, or `--version X.Y.Z` for a specific version. +Pass `--dry-run` to print the commands without running them. + +### dnf + +1. Download the RPM for your version and architecture from [GitHub releases](https://github.com/coder/coder/releases). +2. Install the package. + + ```sh + sudo dnf install ./coder__linux_amd64.rpm + ``` + +On hosts that use `yum`, run `sudo yum install` instead. + +### rpm + +Install or upgrade the package in place. +This is the command the install script runs. + +```sh +sudo rpm -U coder__linux_amd64.rpm +``` + +

+ +The package installs the `coder` binary to `/usr/bin/coder`, the configuration file to `/etc/coder.d/coder.env`, and two `systemd` units: `coder.service` for the control plane and `coder-workspace-proxy.service` for an optional [workspace proxy](../admin/networking/workspace-proxies.md). +It also creates the unprivileged `coder` user that the service runs as. + +To stage the RPM on a host with no internet access, refer to [Air-gapped deployments](./airgap.md). + +## Configure the server + +`coder.service` doesn't start while `/etc/coder.d/coder.env` is empty. +Set your configuration before you start the service. + +1. Open the configuration file. + + ```sh + sudo vi /etc/coder.d/coder.env + ``` + +2. Set `CODER_ACCESS_URL` to the external URL that users and workspaces connect to. +3. Set `CODER_PG_CONNECTION_URL` to your PostgreSQL connection string. +4. Save the file. + +The file ships with the TLS and HTTP address variables commented in place. +For every server option, refer to the [`coder server`](../reference/cli/server.md) command reference. + +## Start the service + +1. Start Coder now and on every boot. + + ```sh + sudo systemctl enable --now coder + ``` + +2. Confirm that the service is running. + + ```console + $ systemctl is-active coder + active + ``` + +3. Read the startup logs. + + ```sh + journalctl -u coder.service -b + ``` + +To test a configuration change without the service manager, run `coder server` in the foreground. + +## SELinux and container runtimes in workspaces + +SELinux affects workspaces that run their own container runtime. +If your templates run Docker or Podman inside a workspace on a RHEL-family node, refer to [Docker in workspaces](../admin/templates/extending-templates/docker-in-workspaces.md) for the runtime requirements. + +## Hardened base images + +Coder publishes a container image built on Red Hat's UBI9-minimal base through [Iron Bank](https://ironbank.dso.mil/), the Department of Defense hardened container registry. +Choose that image when your compliance program requires an accredited base image. +The Iron Bank image is a container image, so deploy it with [Kubernetes](./kubernetes.md) or [OpenShift](./openshift.md) rather than through the RPM. + +## Next steps + +- [Set up your control plane](../admin/setup/index.md) +- [Create your first template](../tutorials/template-from-scratch.md) +- [Upgrade Coder](./upgrade.md) +- [Uninstall Coder](./uninstall.md) diff --git a/docs/manifest.json b/docs/manifest.json index 99d5cdab331..7c0e564c001 100644 --- a/docs/manifest.json +++ b/docs/manifest.json @@ -155,6 +155,12 @@ "path": "./install/openshift.md", "icon_path": "./images/icons/openshift.svg" }, + { + "title": "RPM (RHEL family)", + "description": "Install the Coder control plane from an RPM package on Red Hat Enterprise Linux and other RHEL-family distributions.", + "path": "./install/rpm.md", + "icon_path": "./images/icons/system.svg" + }, { "title": "Cloud Providers", "description": "Install guides and example templates for deploying Coder on AWS, Google Cloud, and Azure.", From 5aec9d328b31ebea88737da049f76afcec157e50 Mon Sep 17 00:00:00 2001 From: "coder-backporter-app[bot]" <335582564+coder-backporter-app[bot]@users.noreply.github.com> Date: Wed, 30 Sep 2026 21:00:51 +0200 Subject: [PATCH 62/69] fix(coderd): validate GCP instance token audience (#29765) (#30192) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Backport of https://github.com/coder/coder/pull/29765 Original PR: #29765 — fix(coderd): validate GCP instance token audience Merge commit: b5ce79b9e0f8e394322d0987531dcb5ffa9e7489 Requested by: @Lisa-Fiander Co-authored-by: dylanhuff-at-coder --- coderd/coderdtest/coderdtest.go | 3 ++- coderd/coderdtest/coderdtest_test.go | 2 +- coderd/workspaceresourceauth.go | 3 +-- coderd/workspaceresourceauth_test.go | 31 +++++++++++++++++++++++----- 4 files changed, 30 insertions(+), 9 deletions(-) diff --git a/coderd/coderdtest/coderdtest.go b/coderd/coderdtest/coderdtest.go index 7ab7ca8fcc8..cf96de00b08 100644 --- a/coderd/coderdtest/coderdtest.go +++ b/coderd/coderdtest/coderdtest.go @@ -1598,10 +1598,11 @@ func RequestExternalAuthCallback(t testing.TB, providerID string, client *coders // NewGoogleInstanceIdentity returns a metadata client and ID token validator for faking // instance authentication for Google Cloud. // nolint:revive -func NewGoogleInstanceIdentity(t testing.TB, instanceID string, expired bool) (*idtoken.Validator, *metadata.Client) { +func NewGoogleInstanceIdentity(t testing.TB, instanceID string, expired bool, audience string) (*idtoken.Validator, *metadata.Client) { keyID, err := cryptorand.String(12) require.NoError(t, err) claims := jwt.MapClaims{ + "aud": audience, "google": map[string]interface{}{ "compute_engine": map[string]string{ "instance_id": instanceID, diff --git a/coderd/coderdtest/coderdtest_test.go b/coderd/coderdtest/coderdtest_test.go index e245898de6c..aa776b84fea 100644 --- a/coderd/coderdtest/coderdtest_test.go +++ b/coderd/coderdtest/coderdtest_test.go @@ -28,7 +28,7 @@ func TestNew(t *testing.T) { workspace := coderdtest.CreateWorkspace(t, client, template.ID) coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID) coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID) - _, _ = coderdtest.NewGoogleInstanceIdentity(t, "example", false) + _, _ = coderdtest.NewGoogleInstanceIdentity(t, "example", false, "coder") _, _ = coderdtest.NewAWSInstanceIdentity(t, "an-instance") } diff --git a/coderd/workspaceresourceauth.go b/coderd/workspaceresourceauth.go index 5a2c36f7ef9..674bb60956f 100644 --- a/coderd/workspaceresourceauth.go +++ b/coderd/workspaceresourceauth.go @@ -104,8 +104,7 @@ func (api *API) postWorkspaceAuthGoogleInstanceIdentity(rw http.ResponseWriter, return } - // We leave the audience blank. It's not important we validate who made the token. - payload, err := api.GoogleTokenValidator.Validate(ctx, req.JSONWebToken, "") + payload, err := api.GoogleTokenValidator.Validate(ctx, req.JSONWebToken, "coder") if err != nil { httpapi.Write(ctx, rw, http.StatusUnauthorized, codersdk.Response{ Message: "Invalid GCP identity.", diff --git a/coderd/workspaceresourceauth_test.go b/coderd/workspaceresourceauth_test.go index b327c120bc3..74a146a2d2a 100644 --- a/coderd/workspaceresourceauth_test.go +++ b/coderd/workspaceresourceauth_test.go @@ -291,7 +291,7 @@ func TestPostWorkspaceAuthGoogleInstanceIdentity(t *testing.T) { t.Parallel() instanceID := newTestInstanceID(t) - validator, metadata := coderdtest.NewGoogleInstanceIdentity(t, instanceID, true) + validator, metadata := coderdtest.NewGoogleInstanceIdentity(t, instanceID, true, "coder") client := coderdtest.New(t, &coderdtest.Options{ GoogleTokenValidator: validator, }) @@ -310,7 +310,7 @@ func TestPostWorkspaceAuthGoogleInstanceIdentity(t *testing.T) { t.Parallel() instanceID := newTestInstanceID(t) - validator, metadata := coderdtest.NewGoogleInstanceIdentity(t, instanceID, false) + validator, metadata := coderdtest.NewGoogleInstanceIdentity(t, instanceID, false, "coder") client := coderdtest.New(t, &coderdtest.Options{ GoogleTokenValidator: validator, }) @@ -329,10 +329,11 @@ func TestPostWorkspaceAuthGoogleInstanceIdentity(t *testing.T) { t.Parallel() instanceID := newTestInstanceID(t) - validator, metadata := coderdtest.NewGoogleInstanceIdentity(t, instanceID, false) - client, _ := setupInstanceIDWorkspace(t, &coderdtest.Options{ + validator, metadata := coderdtest.NewGoogleInstanceIdentity(t, instanceID, false, "coder") + client, store := setupInstanceIDWorkspace(t, &coderdtest.Options{ GoogleTokenValidator: validator, }, workspaceAgentsForInstanceID(instanceID, "dev")) + expectedAgent := requireWorkspaceAgentByInstanceIDAndName(t, store, instanceID, "dev") ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong) defer cancel() @@ -340,13 +341,33 @@ func TestPostWorkspaceAuthGoogleInstanceIdentity(t *testing.T) { agentClient := agentsdk.New(client.URL, agentsdk.WithGoogleInstanceIdentity("", metadata)) err := agentClient.RefreshToken(ctx) require.NoError(t, err) + require.Equal(t, expectedAgent.AuthToken.String(), agentClient.SDK.SessionToken()) + }) + + t.Run("ForeignAudience", func(t *testing.T) { + t.Parallel() + + instanceID := newTestInstanceID(t) + validator, metadata := coderdtest.NewGoogleInstanceIdentity(t, instanceID, false, "other-service") + client, _ := setupInstanceIDWorkspace(t, &coderdtest.Options{ + GoogleTokenValidator: validator, + }, workspaceAgentsForInstanceID(instanceID, "dev")) + + ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong) + defer cancel() + + agentClient := agentsdk.New(client.URL, agentsdk.WithGoogleInstanceIdentity("", metadata)) + err := agentClient.RefreshToken(ctx) + var apiErr *codersdk.Error + require.ErrorAs(t, err, &apiErr) + require.Equal(t, http.StatusUnauthorized, apiErr.StatusCode()) }) t.Run("Ambiguous/GoogleWithSelector", func(t *testing.T) { t.Parallel() instanceID := newTestInstanceID(t) - validator, metadata := coderdtest.NewGoogleInstanceIdentity(t, instanceID, false) + validator, metadata := coderdtest.NewGoogleInstanceIdentity(t, instanceID, false, "coder") client, store := setupInstanceIDWorkspace(t, &coderdtest.Options{ GoogleTokenValidator: validator, }, workspaceAgentsForInstanceID(instanceID, "alpha", "beta")) From 2fd403b65eef45e3c11feb7d25e73e3a7fc9313c Mon Sep 17 00:00:00 2001 From: Sas Swart Date: Thu, 15 Oct 2026 11:02:52 +0200 Subject: [PATCH 63/69] fix: reject encoded path traversal in ai gateway before forwarding upstream (#30178) (#30416) Backport of https://github.com/coder/coder/pull/30178 to `release/2.36`. Original PR: #30178, fix: reject encoded path traversal in ai gateway before forwarding upstream Merge commit: bf3db74b83e0553127eee8ea5b1552aa0819f6a1 Cherry-pick with conflict adjustments: - `aibridge/x/proxy` does not exist on this branch, so its changes are dropped. - `NewRequestBridge` has no inflight middleware wrapping the mux here, so the `xurl.ContainsEncodedPath` check runs in `RequestBridge.ServeHTTP` after request admission and before the body limit and mux. This is the same position as on `main`. - `coderd/util/xurl`, `aibridge/routing/path.go`, and `TestPassthroughRejectsEncodedPathTraversal` are identical to `main`. Verified: `go test` for `coderd/util/xurl`, `aibridge`, `aibridge/routing`; `go vet` and `gofmt` clean. --- _Generated by Coder Agents on behalf of @SasSwart._ --- aibridge/bridge.go | 7 +++ aibridge/bridge_test.go | 85 +++++++++++++++++++++++++++++++++++ aibridge/routing/path.go | 24 ++++++++++ aibridge/routing/path_test.go | 32 +++++++++++++ coderd/util/xurl/xurl.go | 51 +++++++++++++++++++++ coderd/util/xurl/xurl_test.go | 57 +++++++++++++++++++++++ 6 files changed, 256 insertions(+) create mode 100644 aibridge/routing/path.go create mode 100644 aibridge/routing/path_test.go create mode 100644 coderd/util/xurl/xurl.go create mode 100644 coderd/util/xurl/xurl_test.go diff --git a/aibridge/bridge.go b/aibridge/bridge.go index dff41ba117f..2275304a889 100644 --- a/aibridge/bridge.go +++ b/aibridge/bridge.go @@ -29,8 +29,10 @@ import ( "github.com/coder/coder/v2/aibridge/metrics" "github.com/coder/coder/v2/aibridge/provider" "github.com/coder/coder/v2/aibridge/recorder" + "github.com/coder/coder/v2/aibridge/routing" "github.com/coder/coder/v2/aibridge/tracing" agplaibridge "github.com/coder/coder/v2/coderd/aibridge" + "github.com/coder/coder/v2/coderd/util/xurl" "github.com/coder/quartz" ) @@ -438,6 +440,11 @@ func (b *RequestBridge) ServeHTTP(rw http.ResponseWriter, r *http.Request) { // request. ctx := mergeContexts(r.Context(), b.inflightCtx) + if xurl.ContainsEncodedPath(r.URL) { + http.Error(rw, routing.InvalidPathMessage, http.StatusBadRequest) + return + } + // Enforce the request body size limit. MaxBytesReader counts bytes as // they are read from the connection and fails when the limit is exceeded. r.Body = http.MaxBytesReader(rw, r.Body, maxRequestBodyBytes) diff --git a/aibridge/bridge_test.go b/aibridge/bridge_test.go index c82ca422534..cc42c9fb0a2 100644 --- a/aibridge/bridge_test.go +++ b/aibridge/bridge_test.go @@ -8,6 +8,7 @@ import ( "net/http" "net/http/httptest" "strings" + "sync" "testing" "github.com/stretchr/testify/assert" @@ -21,6 +22,7 @@ import ( "github.com/coder/coder/v2/aibridge/config" "github.com/coder/coder/v2/aibridge/intercept" "github.com/coder/coder/v2/aibridge/internal/testutil" + "github.com/coder/coder/v2/aibridge/keypool" "github.com/coder/coder/v2/aibridge/provider" codertestutil "github.com/coder/coder/v2/testutil" "github.com/coder/quartz" @@ -293,6 +295,89 @@ func TestPassthroughRoutesForProviders(t *testing.T) { } } +// TestPassthroughRejectsEncodedPathTraversal verifies that encoded dot +// segments, which upstreams decode and resolve outside the allowlisted route, +// are rejected before an upstream request is made with a centralized key. +func TestPassthroughRejectsEncodedPathTraversal(t *testing.T) { + t.Parallel() + + providers := []struct { + name string + prefix string + provider func(*testing.T, string, *keypool.Pool) provider.Provider + }{ + { + name: "openai", + prefix: "/openai/v1/models/", + provider: func(_ *testing.T, baseURL string, pool *keypool.Pool) provider.Provider { + return aibridge.NewOpenAIProvider(config.OpenAI{BaseURL: baseURL, KeyPool: pool}) + }, + }, + { + name: "anthropic", + prefix: "/anthropic/v1/models/", + provider: func(t *testing.T, baseURL string, pool *keypool.Pool) provider.Provider { + return aibridgetest.NewAnthropicProvider(t, config.Anthropic{BaseURL: baseURL, KeyPool: pool}, nil) + }, + }, + { + name: "copilot", + prefix: "/copilot/models/", + provider: func(_ *testing.T, baseURL string, _ *keypool.Pool) provider.Provider { + return aibridge.NewCopilotProvider(config.Copilot{BaseURL: baseURL}) + }, + }, + } + + for _, p := range providers { + t.Run(p.name, func(t *testing.T) { + t.Parallel() + + var upstreamPaths []string + var mu sync.Mutex + upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + mu.Lock() + upstreamPaths = append(upstreamPaths, r.URL.EscapedPath()) + mu.Unlock() + w.WriteHeader(http.StatusOK) + })) + t.Cleanup(upstream.Close) + + pool, err := keypool.New(p.name, []string{"centralized-key"}, quartz.NewReal(), nil) + require.NoError(t, err) + logger := slogtest.Make(t, nil) + rec := testutil.MockRecorder{} + bridge, err := aibridge.NewRequestBridge(t.Context(), []provider.Provider{p.provider(t, upstream.URL+"/v1", pool)}, &rec, nil, logger, nil, bridgeTestTracer) + require.NoError(t, err) + + for _, suffix := range []string{ + "%2e%2e/files", + "%2E%2E/%2E%2E/admin", + "..%2F..%2Fadmin", + "%252e%252e/files", + "../files", + } { + resp := httptest.NewRecorder() + bridge.ServeHTTP(resp, httptest.NewRequest(http.MethodGet, p.prefix+suffix, nil)) + assert.Equal(t, http.StatusBadRequest, resp.Code, suffix) + assert.Contains(t, resp.Body.String(), "invalid request path", suffix) + } + mu.Lock() + require.Empty(t, upstreamPaths, "rejected requests must not reach the upstream") + mu.Unlock() + + // Escaped separators in ordinary segments keep their escaping. + resp := httptest.NewRecorder() + bridge.ServeHTTP(resp, httptest.NewRequest(http.MethodGet, p.prefix+"org%2Fmodel", nil)) + require.Equal(t, http.StatusOK, resp.Code) + mu.Lock() + defer mu.Unlock() + require.Len(t, upstreamPaths, 1) + assert.True(t, strings.HasSuffix(upstreamPaths[0], "/models/org%2Fmodel"), upstreamPaths[0]) + }) + } +} + func TestWebSocketUpgradeRejected(t *testing.T) { t.Parallel() diff --git a/aibridge/routing/path.go b/aibridge/routing/path.go new file mode 100644 index 00000000000..bdd3a82baf4 --- /dev/null +++ b/aibridge/routing/path.go @@ -0,0 +1,24 @@ +package routing + +import ( + "net/http" + + "github.com/coder/coder/v2/coderd/util/xurl" +) + +// InvalidPathMessage is the response body for requests rejected by +// [RejectInvalidForwardPath]. +const InvalidPathMessage = "invalid request path" + +// RejectInvalidForwardPath wraps next and responds with 400 to requests whose +// path is unsafe to forward upstream, as reported by +// [xurl.ContainsEncodedPath], before any routing or upstream request. +func RejectInvalidForwardPath(next http.Handler) http.Handler { + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if xurl.ContainsEncodedPath(r.URL) { + http.Error(w, InvalidPathMessage, http.StatusBadRequest) + return + } + next.ServeHTTP(w, r) + }) +} diff --git a/aibridge/routing/path_test.go b/aibridge/routing/path_test.go new file mode 100644 index 00000000000..7268babb37f --- /dev/null +++ b/aibridge/routing/path_test.go @@ -0,0 +1,32 @@ +package routing_test + +import ( + "net/http" + "net/http/httptest" + "testing" + + "github.com/stretchr/testify/assert" + + "github.com/coder/coder/v2/aibridge/routing" +) + +func TestRejectInvalidForwardPath(t *testing.T) { + t.Parallel() + + var called bool + handler := routing.RejectInvalidForwardPath(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { + called = true + w.WriteHeader(http.StatusOK) + })) + + rec := httptest.NewRecorder() + handler.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/openai/v1/models/%2e%2e/files", nil)) + assert.Equal(t, http.StatusBadRequest, rec.Code) + assert.Contains(t, rec.Body.String(), routing.InvalidPathMessage) + assert.False(t, called) + + rec = httptest.NewRecorder() + handler.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/openai/v1/models/org%2Fmodel", nil)) + assert.Equal(t, http.StatusOK, rec.Code) + assert.True(t, called) +} diff --git a/coderd/util/xurl/xurl.go b/coderd/util/xurl/xurl.go new file mode 100644 index 00000000000..2db01ec82e3 --- /dev/null +++ b/coderd/util/xurl/xurl.go @@ -0,0 +1,51 @@ +// Package xurl contains small helpers extending the standard net/url +// package. +package xurl + +import ( + "net/url" + "strings" + "unicode" +) + +// ContainsEncodedPath reports whether u's path is unsafe to forward to +// another server with its escaping intact, because that server could resolve +// it to a different path than the one it was matched on. +// +// [net/http.ServeMux] matches routes on the escaped path and only cleans +// literal dot segments, while upstreams decode percent-encoded unreserved +// characters (RFC 3986 section 6.2.2.2) and then remove dot segments. A path +// such as /v1/models/%2e%2e/files therefore matches a /v1/models/ route +// locally but is served as /v1/files upstream. +// +// Each escaped segment is decoded exactly once. It returns true if a segment +// fails to decode, or if a decoded segment: +// - contains a "." or ".." element, also when split on an escaped "/" or "\" +// for components that decode reserved characters, +// - still contains "%", which only arises from multiple encoding and would +// let a component that decodes twice produce a dot segment, +// - contains control characters. +// +// Escaped separators in ordinary segments, such as /models/org%2Fmodel, are +// allowed. +func ContainsEncodedPath(u *url.URL) bool { + for _, seg := range strings.Split(u.EscapedPath(), "/") { + decoded, err := url.PathUnescape(seg) + if err != nil { + return true + } + if strings.ContainsRune(decoded, '%') || strings.ContainsFunc(decoded, unicode.IsControl) { + return true + } + for _, part := range strings.FieldsFunc(decoded, isPathSeparator) { + if part == "." || part == ".." { + return true + } + } + } + return false +} + +func isPathSeparator(r rune) bool { + return r == '/' || r == '\\' +} diff --git a/coderd/util/xurl/xurl_test.go b/coderd/util/xurl/xurl_test.go new file mode 100644 index 00000000000..7c81661ff0f --- /dev/null +++ b/coderd/util/xurl/xurl_test.go @@ -0,0 +1,57 @@ +package xurl_test + +import ( + "net/url" + "testing" + + "github.com/stretchr/testify/require" + + "github.com/coder/coder/v2/coderd/util/xurl" +) + +func TestContainsEncodedPath(t *testing.T) { + t.Parallel() + + for _, tc := range []struct { + name string + path string + want bool + }{ + {name: "Plain", path: "/v1/models"}, + {name: "ModelID", path: "/v1/models/gpt-4.1"}, + {name: "ResourceID", path: "/v1/responses/resp_abc123"}, + {name: "TrailingSlash", path: "/v1/models/"}, + {name: "EscapedSeparator", path: "/v1/models/org%2Fmodel"}, + {name: "EscapedSpace", path: "/v1/models/a%20b"}, + {name: "DotsInName", path: "/v1/models/..model"}, + {name: "LiteralDotDot", path: "/v1/models/../files", want: true}, + {name: "LiteralDot", path: "/v1/./models", want: true}, + {name: "EncodedDotDot", path: "/v1/models/%2e%2e/files", want: true}, + {name: "EncodedDotDotUpper", path: "/v1/models/%2E%2E/files", want: true}, + {name: "MixedDotDot", path: "/v1/models/.%2e/files", want: true}, + {name: "EncodedDot", path: "/v1/%2e/models", want: true}, + {name: "DotDotEscapedSlash", path: "/v1/models/..%2F..%2Ffiles", want: true}, + {name: "DotDotInsideSegment", path: "/v1/models/a%2F..%2Fb", want: true}, + {name: "DotDotEscapedBackslash", path: "/v1/models/..%5Cfiles", want: true}, + {name: "DoubleEncodedDotDot", path: "/v1/models/%252e%252e/files", want: true}, + {name: "TripleEncodedDotDot", path: "/v1/models/%25252e%25252e/files", want: true}, + {name: "EncodedNUL", path: "/v1/models/a%00b", want: true}, + {name: "EncodedNewline", path: "/v1/models/a%0Ab", want: true}, + {name: "InvalidEscape", path: "/v1/models/%zz", want: true}, + } { + t.Run(tc.name, func(t *testing.T) { + t.Parallel() + + // Build the URL the way the server does for an incoming + // request line, preserving the client's escaping. + u, err := url.ParseRequestURI(tc.path) + if err != nil { + // Paths the server itself refuses to parse never reach + // the handler. + require.True(t, tc.want, "unexpected parse error: %v", err) + return + } + require.Equal(t, tc.want, xurl.ContainsEncodedPath(u)) + }) + } +} From fbafb7feb67c810c49632965df6aa9307055ad53 Mon Sep 17 00:00:00 2001 From: "coder[bot]" <137810501+coder[bot]@users.noreply.github.com> Date: Thu, 15 Oct 2026 10:58:52 -0700 Subject: [PATCH 64/69] ci: bump agents-chat-action to v0.5.1 in doc-check (backport 2.36) (#30848) Bumps the pinned `coder/agents-chat-action` in `.github/workflows/doc-check.yaml` on `release/2.36` from v0.3.0 to v0.5.1 (`9b3ac42`). Same change as #29732 on `main`. ## Why The `Analyze PR for Documentation Updates Needed` job fails on every PR into `release/2.36` (e.g. #30810) with `Coder API error: Not Found`. The pinned version calls `/api/experimental/chats`, which #29548 removed after the chat API moved to `/api/v2` (#28496). v0.5.1 calls `/api/v2/chats`. v0.5.1 accepts every input this workflow passes (its inputs are a superset of v0.3.0's), so no other workflow changes are needed. The doc-check run on this PR is the end-to-end test. ## Changes - `.github/workflows/doc-check.yaml`: one `uses:` line. Related: [ENT-210](https://linear.app/codercom/issue/ENT-210/ironbank-critical-bump-go-to-1269-fix-by-2026-10-29) (surfaced on the Go 1.26.9 backports). Opened by Superblink on behalf of @droopy4096. Co-authored-by: Dmytro Makovey --- .github/workflows/doc-check.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/doc-check.yaml b/.github/workflows/doc-check.yaml index c692b7e2a8b..935bd77647f 100644 --- a/.github/workflows/doc-check.yaml +++ b/.github/workflows/doc-check.yaml @@ -213,7 +213,7 @@ jobs: - name: Run doc-check via Coder Agent Chat if: steps.check-secrets.outputs.skip != 'true' - uses: coder/agents-chat-action@b3fc81d7dae5006dd124e98ef6fada1a36cdd86e # v0.3.0 + uses: coder/agents-chat-action@9b3ac42d568e9206f9cd51a97789820d6935cc8d # v0.5.1 with: coder-url: ${{ secrets.DOC_CHECK_CODER_URL }} coder-token: ${{ secrets.DOC_CHECK_CODER_SESSION_TOKEN }} From 7b527b4abaaa5500a976a946de7440fb177fdfee Mon Sep 17 00:00:00 2001 From: "coder[bot]" <137810501+coder[bot]@users.noreply.github.com> Date: Thu, 15 Oct 2026 12:06:54 -0700 Subject: [PATCH 65/69] fix: bump bundled terraform to 1.16.6 for 2.36 (#30553) Backport of #30516 to `release/2.36`. Bumps the bundled Terraform binary to 1.16.6 (latest stable, [released 2026-10-14](https://github.com/hashicorp/terraform/releases/tag/v1.16.6)) so all supported branches ship the same version. Previous pins were out of sync: the shipped binary (`install.sh`, `scripts/Dockerfile.base`, `mise`, `flake.nix`, `testdata/version.txt`) was 1.15.5, while `TerraformVersion` in `provisioner/terraform/install.go` was still 1.14.5. All are now 1.16.6. This is a minor version jump, so `maxTerraformVersion` is raised to 1.16.9. Checksums and Nix SRI hashes come from HashiCorp's `terraform_1.16.6_SHA256SUMS`. Verified with `go test ./provisioner/terraform/...` on this branch. Opened by Superblink on behalf of @droopy4096. _Updated from 1.16.5 to 1.16.6 (adds an HTTP/2 resource-exhaustion fix). Branch name still says 1.16.5. Tests not re-run locally for 1.16.6, relying on CI._ --------- Co-authored-by: coder[bot] <137810501+coder[bot]@users.noreply.github.com> Co-authored-by: Dmitry Makovey --- docs/install/airgap.md | 2 +- flake.nix | 12 +++--- install.sh | 2 +- mise.lock | 46 +++++++++++----------- mise.toml | 2 +- provisioner/terraform/install.go | 4 +- provisioner/terraform/testdata/version.txt | 2 +- scripts/Dockerfile.base | 2 +- 8 files changed, 36 insertions(+), 36 deletions(-) diff --git a/docs/install/airgap.md b/docs/install/airgap.md index 06e99571c37..4f3c32e4896 100644 --- a/docs/install/airgap.md +++ b/docs/install/airgap.md @@ -55,7 +55,7 @@ RUN mkdir -p /opt/terraform # The below step is optional if you wish to keep the existing version. # See ../../provisioner/terraform/install.go#L23-L24 # for supported Terraform versions. -ARG TERRAFORM_VERSION=1.11.0 +ARG TERRAFORM_VERSION=1.16.6 RUN apk update && \ curl -LOs https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip \ && unzip -o terraform_${TERRAFORM_VERSION}_linux_amd64.zip \ diff --git a/flake.nix b/flake.nix index 3057b32d2eb..504e03ef68a 100644 --- a/flake.nix +++ b/flake.nix @@ -196,28 +196,28 @@ releases = { x86_64-linux = { platform = "linux_amd64"; - hash = "sha256-cCshNq9nKMj/A3+EPdLbzit62IeGtzgdHXKu+iUPYBw="; + hash = "sha256-OANLONAwljmaehJkoUVhqAKbK0lv0fFpRSZW5Tlo8bc="; }; aarch64-linux = { platform = "linux_arm64"; - hash = "sha256-Bue0jegmFGxtkzG6NbE9oSMy2Dkr4w0d1reJukcT//A="; + hash = "sha256-p1C1oRA48WWEayZYxAyIzXBwqmemG6tDGhS6J5KOqeo="; }; aarch64-darwin = { platform = "darwin_arm64"; - hash = "sha256-ARN2YFEABbkYu6ghVIZvvqxDkxY9gnfCq+hh37WELDw="; + hash = "sha256-heG8eKtFvcX4KnusOSnjfQcoNKWE0iWDokmNxnu2JM0="; }; x86_64-darwin = { platform = "darwin_amd64"; - hash = "sha256-NofQfANLPn3u1bByzYris0g1vLE5uuw/xPX9U02r9e0="; + hash = "sha256-eUo2w/fr9sWPIInCJgaKU50XBbo1ilZ5tRZxyNx+vHs="; }; }; target = releases.${system} or null; in if target != null then - pkgs.runCommand "terraform-1.15.5" { + pkgs.runCommand "terraform-1.16.6" { nativeBuildInputs = [ pkgs.unzip ]; src = pkgs.fetchurl { - url = "https://releases.hashicorp.com/terraform/1.15.5/terraform_1.15.5_${target.platform}.zip"; + url = "https://releases.hashicorp.com/terraform/1.16.6/terraform_1.16.6_${target.platform}.zip"; hash = target.hash; }; } '' diff --git a/install.sh b/install.sh index daf4f598369..51350857a76 100755 --- a/install.sh +++ b/install.sh @@ -276,7 +276,7 @@ EOF main() { MAINLINE=1 STABLE=0 - TERRAFORM_VERSION="1.15.5" + TERRAFORM_VERSION="1.16.6" if [ "${TRACE-}" ]; then set -x diff --git a/mise.lock b/mise.lock index b96d6b9ae62..f14c3e5fa91 100644 --- a/mise.lock +++ b/mise.lock @@ -990,52 +990,52 @@ checksum = "sha256:7af7acb9f81bdddbc343855cb3a42e1d38ae9a1b044bfcd9b975a118d1078 url = "https://github.com/anchore/syft/releases/download/v1.26.1/syft_1.26.1_windows_amd64.zip" [[tools.terraform]] -version = "1.15.5" +version = "1.16.6" backend = "aqua:hashicorp/terraform" [tools.terraform."platforms.linux-arm64"] -checksum = "sha256:06e7b48de826146c6d9331ba35b13da12332d8392be30d1dd6b789ba4713fff0" -url = "https://releases.hashicorp.com/terraform/1.15.5/terraform_1.15.5_linux_arm64.zip" +checksum = "sha256:a750b5a11038f165846b2658c40c88cd7070aa67a61bab431a14ba27928ea9ea" +url = "https://releases.hashicorp.com/terraform/1.16.6/terraform_1.16.6_linux_arm64.zip" [tools.terraform."platforms.linux-arm64-musl"] -checksum = "sha256:06e7b48de826146c6d9331ba35b13da12332d8392be30d1dd6b789ba4713fff0" -url = "https://releases.hashicorp.com/terraform/1.15.5/terraform_1.15.5_linux_arm64.zip" +checksum = "sha256:a750b5a11038f165846b2658c40c88cd7070aa67a61bab431a14ba27928ea9ea" +url = "https://releases.hashicorp.com/terraform/1.16.6/terraform_1.16.6_linux_arm64.zip" [tools.terraform."platforms.linux-x64"] -checksum = "sha256:702b2136af6728c8ff037f843dd2dbce2b7ad88786b7381d1d72aefa250f601c" -url = "https://releases.hashicorp.com/terraform/1.15.5/terraform_1.15.5_linux_amd64.zip" +checksum = "sha256:38034b38d03096399a7a1264a14561a8029b2b496fd1f169452656e53968f1b7" +url = "https://releases.hashicorp.com/terraform/1.16.6/terraform_1.16.6_linux_amd64.zip" [tools.terraform."platforms.linux-x64-baseline"] -checksum = "sha256:702b2136af6728c8ff037f843dd2dbce2b7ad88786b7381d1d72aefa250f601c" -url = "https://releases.hashicorp.com/terraform/1.15.5/terraform_1.15.5_linux_amd64.zip" +checksum = "sha256:38034b38d03096399a7a1264a14561a8029b2b496fd1f169452656e53968f1b7" +url = "https://releases.hashicorp.com/terraform/1.16.6/terraform_1.16.6_linux_amd64.zip" [tools.terraform."platforms.linux-x64-musl"] -checksum = "sha256:702b2136af6728c8ff037f843dd2dbce2b7ad88786b7381d1d72aefa250f601c" -url = "https://releases.hashicorp.com/terraform/1.15.5/terraform_1.15.5_linux_amd64.zip" +checksum = "sha256:38034b38d03096399a7a1264a14561a8029b2b496fd1f169452656e53968f1b7" +url = "https://releases.hashicorp.com/terraform/1.16.6/terraform_1.16.6_linux_amd64.zip" [tools.terraform."platforms.linux-x64-musl-baseline"] -checksum = "sha256:702b2136af6728c8ff037f843dd2dbce2b7ad88786b7381d1d72aefa250f601c" -url = "https://releases.hashicorp.com/terraform/1.15.5/terraform_1.15.5_linux_amd64.zip" +checksum = "sha256:38034b38d03096399a7a1264a14561a8029b2b496fd1f169452656e53968f1b7" +url = "https://releases.hashicorp.com/terraform/1.16.6/terraform_1.16.6_linux_amd64.zip" [tools.terraform."platforms.macos-arm64"] -checksum = "sha256:01137660510005b918bba82154866fbeac4393163d8277c2abe861dfb5842c3c" -url = "https://releases.hashicorp.com/terraform/1.15.5/terraform_1.15.5_darwin_arm64.zip" +checksum = "sha256:85e1bc78ab45bdc5f82a7bac3929e37d072834a584d22583a2498dc67bb624cd" +url = "https://releases.hashicorp.com/terraform/1.16.6/terraform_1.16.6_darwin_arm64.zip" [tools.terraform."platforms.macos-x64"] -checksum = "sha256:3687d07c034b3e7deed5b072cd8ae2b34835bcb139baec3fc4f5fd534dabf5ed" -url = "https://releases.hashicorp.com/terraform/1.15.5/terraform_1.15.5_darwin_amd64.zip" +checksum = "sha256:794a36c3f7ebf6c58f2089c226068a539d1705ba358a5679b51671c8dc7ebc7b" +url = "https://releases.hashicorp.com/terraform/1.16.6/terraform_1.16.6_darwin_amd64.zip" [tools.terraform."platforms.macos-x64-baseline"] -checksum = "sha256:3687d07c034b3e7deed5b072cd8ae2b34835bcb139baec3fc4f5fd534dabf5ed" -url = "https://releases.hashicorp.com/terraform/1.15.5/terraform_1.15.5_darwin_amd64.zip" +checksum = "sha256:794a36c3f7ebf6c58f2089c226068a539d1705ba358a5679b51671c8dc7ebc7b" +url = "https://releases.hashicorp.com/terraform/1.16.6/terraform_1.16.6_darwin_amd64.zip" [tools.terraform."platforms.windows-x64"] -checksum = "sha256:2f652dd854af7b7fbb51301afc55b5ef1d3f6e287be7889d4cc3818df891cd38" -url = "https://releases.hashicorp.com/terraform/1.15.5/terraform_1.15.5_windows_amd64.zip" +checksum = "sha256:6ea2c186e0e76a113af30fbcdcf7a4b4c70756317994a04929e5c90b9e94b1df" +url = "https://releases.hashicorp.com/terraform/1.16.6/terraform_1.16.6_windows_amd64.zip" [tools.terraform."platforms.windows-x64-baseline"] -checksum = "sha256:2f652dd854af7b7fbb51301afc55b5ef1d3f6e287be7889d4cc3818df891cd38" -url = "https://releases.hashicorp.com/terraform/1.15.5/terraform_1.15.5_windows_amd64.zip" +checksum = "sha256:6ea2c186e0e76a113af30fbcdcf7a4b4c70756317994a04929e5c90b9e94b1df" +url = "https://releases.hashicorp.com/terraform/1.16.6/terraform_1.16.6_windows_amd64.zip" [[tools.vercel]] version = "54.14.0" diff --git a/mise.toml b/mise.toml index db02df3a168..2c5f164a64c 100644 --- a/mise.toml +++ b/mise.toml @@ -50,7 +50,7 @@ crane = "0.21.6" helm = "3.21.0" kubectx = "0.9.4" syft = "1.26.1" -terraform = "1.15.5" +terraform = "1.16.6" zizmor = "1.11.0" # Developer-environment niceties for the dogfood image. Non-dogfood diff --git a/provisioner/terraform/install.go b/provisioner/terraform/install.go index 2137e99cb92..f4b229ce56e 100644 --- a/provisioner/terraform/install.go +++ b/provisioner/terraform/install.go @@ -22,10 +22,10 @@ var ( // when Terraform is not available on the system. // NOTE: Keep this in sync with the version in scripts/Dockerfile.base. // NOTE: Keep this in sync with the version in install.sh. - TerraformVersion = version.Must(version.NewVersion("1.14.5")) + TerraformVersion = version.Must(version.NewVersion("1.16.6")) minTerraformVersion = version.Must(version.NewVersion("1.1.0")) - maxTerraformVersion = version.Must(version.NewVersion("1.14.9")) // use .9 to automatically allow patch releases + maxTerraformVersion = version.Must(version.NewVersion("1.16.9")) // use .9 to automatically allow patch releases errTerraformMinorVersionMismatch = xerrors.New("Terraform binary minor version mismatch.") ) diff --git a/provisioner/terraform/testdata/version.txt b/provisioner/terraform/testdata/version.txt index d32434904bc..de646d2fc11 100644 --- a/provisioner/terraform/testdata/version.txt +++ b/provisioner/terraform/testdata/version.txt @@ -1 +1 @@ -1.15.5 +1.16.6 diff --git a/scripts/Dockerfile.base b/scripts/Dockerfile.base index 7ed3b76276c..93146ce7226 100644 --- a/scripts/Dockerfile.base +++ b/scripts/Dockerfile.base @@ -27,7 +27,7 @@ RUN apk add --no-cache \ # Terraform was disabled in the edge repo due to a build issue. # https://gitlab.alpinelinux.org/alpine/aports/-/commit/f3e263d94cfac02d594bef83790c280e045eba35 # Using wget for now. Note that busybox unzip doesn't support streaming. -RUN ARCH="$(arch)"; if [ "${ARCH}" == "x86_64" ]; then ARCH="amd64"; elif [ "${ARCH}" == "aarch64" ]; then ARCH="arm64"; elif [ "${ARCH}" == "armv7l" ]; then ARCH="arm"; fi; wget -O /tmp/terraform.zip "https://releases.hashicorp.com/terraform/1.15.5/terraform_1.15.5_linux_${ARCH}.zip" && \ +RUN ARCH="$(arch)"; if [ "${ARCH}" == "x86_64" ]; then ARCH="amd64"; elif [ "${ARCH}" == "aarch64" ]; then ARCH="arm64"; elif [ "${ARCH}" == "armv7l" ]; then ARCH="arm"; fi; wget -O /tmp/terraform.zip "https://releases.hashicorp.com/terraform/1.16.6/terraform_1.16.6_linux_${ARCH}.zip" && \ busybox unzip /tmp/terraform.zip -d /usr/local/bin && \ rm -f /tmp/terraform.zip && \ chmod +x /usr/local/bin/terraform && \ From 523009b3528579c7da7082c685faa38cbb58ff33 Mon Sep 17 00:00:00 2001 From: Dmitry Makovey Date: Thu, 15 Oct 2026 12:09:38 -0700 Subject: [PATCH 66/69] fix: bump golang.org/x/net to v0.60.0 (backport 2.36) (#30816) Backport of the `golang.org/x/net` v0.60.0 bump (#30772) to `release/2.36`, as a minimal `go.mod` / `go.sum` change. Tracked in Linear: [ENT-211](https://linear.app/codercom/issue/ENT-211/ironbank-critical-bump-golangorgxnet-to-v0600-on-release-branches-fix) (Iron Bank fix-by date 2026-10-29 for the Critical finding). It complements the Go bump in [ENT-210](https://linear.app/codercom/issue/ENT-210/ironbank-critical-bump-go-to-1269-fix-by-2026-10-29): the Go bump alone does not clear GO-2026-6612 (Critical), -6603, -6610, -6611 and -6617, which are fixed in x/net v0.60.0. `golang.org/x/net` is v0.57.0 here; this moves it to v0.60.0. Only `golang.org/x/*` modules change. The extra bumps are the minimum Go's version selection requires and cannot be held back: x/net v0.60.0 requires x/crypto v0.57.0, x/sys v0.48.0, x/term v0.46.0 and x/text v0.42.0, and x/text v0.42.0 in turn requires x/tools v0.49.0, x/mod v0.41.0 and x/sync v0.23.0. Also moved: golang.org/x/crypto v0.57.0, golang.org/x/mod v0.41.0, golang.org/x/sync v0.23.0, golang.org/x/sys v0.48.0, golang.org/x/term v0.46.0, golang.org/x/text v0.42.0, golang.org/x/tools v0.49.0, golang.org/x/telemetry v0.0.0-20260811182544-a038080d80e5. No non-`x` module changes. Not built locally; CI will build it. Opened by Superblink on behalf of @droopy4096. --- go.mod | 18 +++++++++--------- go.sum | 36 ++++++++++++++++++------------------ 2 files changed, 27 insertions(+), 27 deletions(-) diff --git a/go.mod b/go.mod index bb7fef16db4..ce9f5c238b7 100644 --- a/go.mod +++ b/go.mod @@ -255,16 +255,16 @@ require ( go.uber.org/goleak v1.3.1-0.20240429205332-517bace7cc29 go.uber.org/mock v0.6.0 go4.org/netipx v0.0.0-20230728180743-ad4cb58a6516 - golang.org/x/crypto v0.54.0 + golang.org/x/crypto v0.57.0 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f - golang.org/x/mod v0.38.0 - golang.org/x/net v0.57.0 + golang.org/x/mod v0.41.0 + golang.org/x/net v0.60.0 golang.org/x/oauth2 v0.36.0 - golang.org/x/sync v0.22.0 - golang.org/x/sys v0.47.0 - golang.org/x/term v0.45.0 - golang.org/x/text v0.40.0 - golang.org/x/tools v0.48.0 + golang.org/x/sync v0.23.0 + golang.org/x/sys v0.48.0 + golang.org/x/term v0.46.0 + golang.org/x/text v0.42.0 + golang.org/x/tools v0.49.0 golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da google.golang.org/api v0.289.0 google.golang.org/grpc v1.82.1 @@ -684,7 +684,7 @@ require ( go.yaml.in/yaml/v2 v2.4.4 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect go.yaml.in/yaml/v4 v4.0.0-rc.3 // indirect - golang.org/x/telemetry v0.0.0-20260708182218-49f421fb7959 // indirect + golang.org/x/telemetry v0.0.0-20260811182544-a038080d80e5 // indirect google.golang.org/genai v1.60.0 // indirect gopkg.in/warnings.v0 v0.1.2 // indirect k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d // indirect diff --git a/go.sum b/go.sum index 5592a9d1043..4160f34b705 100644 --- a/go.sum +++ b/go.sum @@ -1413,8 +1413,8 @@ golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDf golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8= golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk= golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M= -golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw= -golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk= +golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= +golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM= golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80= golang.org/x/image v0.43.0 h1:FLxcP4ec2350nTfOC8ysKtqYSIFbk/QGjw1ZHNP4tsY= @@ -1425,8 +1425,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= -golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk= -golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40= +golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= +golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= @@ -1439,8 +1439,8 @@ golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI= golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk= golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44= golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM= -golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= -golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -1453,8 +1453,8 @@ golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= -golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= -golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= +golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -1493,11 +1493,11 @@ golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= -golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= +golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE= -golang.org/x/telemetry v0.0.0-20260708182218-49f421fb7959 h1:RJhm5l6Fo4rmEIcndxDllNhhf/fAx8qIm4t6A7vpm2A= -golang.org/x/telemetry v0.0.0-20260708182218-49f421fb7959/go.mod h1:LV7u5Oco+Z/g6XI7PqN+EUUUGGkEcmB1uj2ceI0fOVg= +golang.org/x/telemetry v0.0.0-20260811182544-a038080d80e5 h1:ZUSxONxc981v7AW7QUg+I9WwZzSTTJ019ENBYr5pV/Q= +golang.org/x/telemetry v0.0.0-20260811182544-a038080d80e5/go.mod h1:LVehoXe41cL5SCVQilsV7Gg6BNG+Js6P9PhSbYTIUkQ= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= @@ -1510,8 +1510,8 @@ golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk= golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY= golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM= golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s= -golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= -golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= +golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE= +golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= @@ -1525,8 +1525,8 @@ golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ= golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY= -golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= -golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= +golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI= +golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= @@ -1536,8 +1536,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58= golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk= -golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE= -golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk= +golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI= +golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= From 676a147faa669ed9eab99b3c64610f8683aebb2f Mon Sep 17 00:00:00 2001 From: Dmitry Makovey Date: Thu, 15 Oct 2026 12:34:03 -0700 Subject: [PATCH 67/69] fix: bump Go version from 1.26.5 to 1.26.9 (backport 2.36) (#30810) Backport of #30807 to `release/2.36`. Bumps the Go toolchain from 1.26.5 to 1.26.9. Tracked in Linear: [ENT-210](https://linear.app/codercom/issue/ENT-210/ironbank-critical-bump-go-to-1269-fix-by-2026-10-29) (Iron Bank fix-by date 2026-10-29 for the Critical finding). Same approach as the Terraform 1.16.5 backports (#30516 and its backports). Files changed: `go.mod`, `mise.toml`, `mise.lock` (toolchain pin plus the per-platform archive URLs and SHA-256 checksums from the official `go.dev/dl` list). Not built or scanned locally; CI will build it. **Companion PR:** the module side of GO-2026-6612 (Critical), -6603, -6610, -6611 and -6617 is fixed by `golang.org/x/net` v0.60.0, backported in https://github.com/coder/coder/pull/30816 ([ENT-211](https://linear.app/codercom/issue/ENT-211/ironbank-critical-bump-golangorgxnet-to-v0600-on-release-branches-fix)). This PR alone does not clear them; both are needed. Opened by Superblink on behalf of @droopy4096. --- go.mod | 2 +- mise.lock | 46 +++++++++++++++++++++++----------------------- mise.toml | 2 +- 3 files changed, 25 insertions(+), 25 deletions(-) diff --git a/go.mod b/go.mod index ce9f5c238b7..30081da81cb 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/coder/coder/v2 -go 1.26.5 +go 1.26.9 // Required until a v3 of chroma is created to lazily initialize all XML files. // None of our dependencies seem to use the registries anyways, so this diff --git a/mise.lock b/mise.lock index f14c3e5fa91..d98f7d51d3e 100644 --- a/mise.lock +++ b/mise.lock @@ -481,52 +481,52 @@ checksum = "sha256:e1245a0a760a45b236e7a25bf118c1defc8447734bdeb4260ea3ec15d1797 url = "https://github.com/digitalocean/doctl/releases/download/v1.158.0/doctl-1.158.0-windows-amd64.zip" [[tools.go]] -version = "1.26.5" +version = "1.26.9" backend = "core:go" [tools.go."platforms.linux-arm64"] -checksum = "sha256:fe4789e92b1f33358680864bbe8704289e7bb5fc207d80623c308935bd696d49" -url = "https://dl.google.com/go/go1.26.5.linux-arm64.tar.gz" +checksum = "sha256:4a97373d49fcacdcf3694fea368a500b00ee3e963974f3e7514132717632f052" +url = "https://dl.google.com/go/go1.26.9.linux-arm64.tar.gz" [tools.go."platforms.linux-arm64-musl"] -checksum = "sha256:fe4789e92b1f33358680864bbe8704289e7bb5fc207d80623c308935bd696d49" -url = "https://dl.google.com/go/go1.26.5.linux-arm64.tar.gz" +checksum = "sha256:4a97373d49fcacdcf3694fea368a500b00ee3e963974f3e7514132717632f052" +url = "https://dl.google.com/go/go1.26.9.linux-arm64.tar.gz" [tools.go."platforms.linux-x64"] -checksum = "sha256:5c2c3b16caefa1d968a94c1daca04a7ca301a496d9b086e17ad77bb81393f053" -url = "https://dl.google.com/go/go1.26.5.linux-amd64.tar.gz" +checksum = "sha256:42d158b4d8f7b61ac0a830567c940a86098fb7aac52e467a5ebec03ef5cc2f8d" +url = "https://dl.google.com/go/go1.26.9.linux-amd64.tar.gz" [tools.go."platforms.linux-x64-baseline"] -checksum = "sha256:5c2c3b16caefa1d968a94c1daca04a7ca301a496d9b086e17ad77bb81393f053" -url = "https://dl.google.com/go/go1.26.5.linux-amd64.tar.gz" +checksum = "sha256:42d158b4d8f7b61ac0a830567c940a86098fb7aac52e467a5ebec03ef5cc2f8d" +url = "https://dl.google.com/go/go1.26.9.linux-amd64.tar.gz" [tools.go."platforms.linux-x64-musl"] -checksum = "sha256:5c2c3b16caefa1d968a94c1daca04a7ca301a496d9b086e17ad77bb81393f053" -url = "https://dl.google.com/go/go1.26.5.linux-amd64.tar.gz" +checksum = "sha256:42d158b4d8f7b61ac0a830567c940a86098fb7aac52e467a5ebec03ef5cc2f8d" +url = "https://dl.google.com/go/go1.26.9.linux-amd64.tar.gz" [tools.go."platforms.linux-x64-musl-baseline"] -checksum = "sha256:5c2c3b16caefa1d968a94c1daca04a7ca301a496d9b086e17ad77bb81393f053" -url = "https://dl.google.com/go/go1.26.5.linux-amd64.tar.gz" +checksum = "sha256:42d158b4d8f7b61ac0a830567c940a86098fb7aac52e467a5ebec03ef5cc2f8d" +url = "https://dl.google.com/go/go1.26.9.linux-amd64.tar.gz" [tools.go."platforms.macos-arm64"] -checksum = "sha256:efb87ff28af9a188d0536ef5d42e63dd52ba8263cd7344a993cc48dd11dedb6a" -url = "https://dl.google.com/go/go1.26.5.darwin-arm64.tar.gz" +checksum = "sha256:f9bb7c0a02506c5d9bf0d1eb1f7ee6c7684f844ae49558308a0427b830e022cc" +url = "https://dl.google.com/go/go1.26.9.darwin-arm64.tar.gz" [tools.go."platforms.macos-x64"] -checksum = "sha256:6231d8d3b8f5552ec6cbf6d685bdd5482e1e703214b120e89b3bf0d7bf1ef725" -url = "https://dl.google.com/go/go1.26.5.darwin-amd64.tar.gz" +checksum = "sha256:00c29e3d4c8562f547410daa18d2959b641bd691ab00c4a525ea817a0253d4bd" +url = "https://dl.google.com/go/go1.26.9.darwin-amd64.tar.gz" [tools.go."platforms.macos-x64-baseline"] -checksum = "sha256:6231d8d3b8f5552ec6cbf6d685bdd5482e1e703214b120e89b3bf0d7bf1ef725" -url = "https://dl.google.com/go/go1.26.5.darwin-amd64.tar.gz" +checksum = "sha256:00c29e3d4c8562f547410daa18d2959b641bd691ab00c4a525ea817a0253d4bd" +url = "https://dl.google.com/go/go1.26.9.darwin-amd64.tar.gz" [tools.go."platforms.windows-x64"] -checksum = "sha256:97e6b2a833b6d89f9ff17d25419ac0a7e3b482a044e9ab18cdef834bd834fd38" -url = "https://dl.google.com/go/go1.26.5.windows-amd64.zip" +checksum = "sha256:d722201a9c0c086d1610e111c48203009af690892ed708072bd5ae20160e7a59" +url = "https://dl.google.com/go/go1.26.9.windows-amd64.zip" [tools.go."platforms.windows-x64-baseline"] -checksum = "sha256:97e6b2a833b6d89f9ff17d25419ac0a7e3b482a044e9ab18cdef834bd834fd38" -url = "https://dl.google.com/go/go1.26.5.windows-amd64.zip" +checksum = "sha256:d722201a9c0c086d1610e111c48203009af690892ed708072bd5ae20160e7a59" +url = "https://dl.google.com/go/go1.26.9.windows-amd64.zip" [[tools."go:github.com/coder/paralleltestctx/cmd/paralleltestctx"]] version = "0.0.2" diff --git a/mise.toml b/mise.toml index 2c5f164a64c..6005fe2f040 100644 --- a/mise.toml +++ b/mise.toml @@ -9,7 +9,7 @@ lockfile = true [tools] # Languages and runtimes. bun = "1.2.15" -go = "1.26.5" +go = "1.26.9" node = "22.19.0" pnpm = "10.33.2" From d3ab3fe6b96d07a1fc6b71cff60a06f120ee96f5 Mon Sep 17 00:00:00 2001 From: "coder-backporter-app[bot]" <335582564+coder-backporter-app[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2026 12:04:02 +0200 Subject: [PATCH 68/69] fix(aibridge/intercept/messages): treat Bedrock Opus 5, Haiku 5.5, Fable 5, and Mythos 5 as adaptive-only (#30692) (#30748) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Backport of https://github.com/coder/coder/pull/30692 Original PR: #30692 — fix(aibridge/intercept/messages): treat Bedrock Opus 5, Haiku 5.5, Fable 5, and Mythos 5 as adaptive-only Merge commit: e6d24ff30aa04597220754a1b55aa5219778461c Requested by: @dannykoppingConflicts resolved manually. They came from #29762 (Opus 5.5) never being backported to this branch: the `anthropic.claude-opus-5-5` line and its test cases weren't present. Took the #30692 allowlist as-is (the `anthropic.claude-opus-5` prefix also covers Opus 5.5) and kept only the 8 test cases #30692 added. `go test ./aibridge/intercept/messages/` passes. Co-authored-by: Danny Kopping --- aibridge/intercept/messages/base.go | 10 +++- .../intercept/messages/base_internal_test.go | 56 +++++++++++++++++++ 2 files changed, 64 insertions(+), 2 deletions(-) diff --git a/aibridge/intercept/messages/base.go b/aibridge/intercept/messages/base.go index f8143b63d80..f3b70c55a62 100644 --- a/aibridge/intercept/messages/base.go +++ b/aibridge/intercept/messages/base.go @@ -507,13 +507,19 @@ func bedrockModelSupportsAdaptiveThinking(model string) bool { // bedrockModelRequiresAdaptiveThinking returns true if the given Bedrock model // ID only supports the "adaptive" thinking type and rejects the legacy -// "enabled" + budget_tokens shape with a 400. +// "enabled" + budget_tokens shape with a 400. The Opus 5, Sonnet 5, Fable 5, +// and Mythos 5 prefixes also match their point releases. // // See https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-anthropic-claude-opus-4-7.html +// and https://docs.aws.amazon.com/bedrock/latest/userguide/claude-messages-adaptive-thinking.html func bedrockModelRequiresAdaptiveThinking(model string) bool { return strings.Contains(model, "anthropic.claude-opus-4-7") || strings.Contains(model, "anthropic.claude-opus-4-8") || - strings.Contains(model, "anthropic.claude-sonnet-5") + strings.Contains(model, "anthropic.claude-opus-5") || + strings.Contains(model, "anthropic.claude-sonnet-5") || + strings.Contains(model, "anthropic.claude-haiku-5-5") || + strings.Contains(model, "anthropic.claude-fable-5") || + strings.Contains(model, "anthropic.claude-mythos-5") } // filterBedrockBetaFlags removes unsupported beta flags from the Anthropic-Beta diff --git a/aibridge/intercept/messages/base_internal_test.go b/aibridge/intercept/messages/base_internal_test.go index d70d2fa8795..e82fa5d6fab 100644 --- a/aibridge/intercept/messages/base_internal_test.go +++ b/aibridge/intercept/messages/base_internal_test.go @@ -780,6 +780,62 @@ func TestAugmentRequestForBedrock_AdaptiveThinking(t *testing.T) { expectKeptFields: []string{"output_config", "output_config.effort"}, expectRemovedFields: []string{"output_config.format"}, }, + { + name: "opus_5_model_with_enabled_thinking_is_converted_to_adaptive_and_drops_budget", + bedrockModel: "anthropic.claude-opus-5", + requestBody: `{"max_tokens":10000,"thinking":{"type":"enabled","budget_tokens":5000}}`, + expectThinkingType: "adaptive", + }, + { + name: "global_opus_5_model_keeps_adaptive_thinking_and_output_config_effort", + bedrockModel: "global.anthropic.claude-opus-5", + requestBody: `{"max_tokens":10000,"thinking":{"type":"adaptive"},"output_config":{"effort":"medium"}}`, + expectThinkingType: "adaptive", + expectEffort: "medium", + expectKeptFields: []string{"output_config"}, + }, + { + name: "haiku_5_5_model_with_enabled_thinking_is_converted_to_adaptive_and_drops_budget", + bedrockModel: "anthropic.claude-haiku-5-5", + requestBody: `{"max_tokens":10000,"thinking":{"type":"enabled","budget_tokens":5000}}`, + expectThinkingType: "adaptive", + }, + { + name: "regional_haiku_5_5_model_keeps_adaptive_thinking_and_output_config_effort", + bedrockModel: "us.anthropic.claude-haiku-5-5", + requestBody: `{"max_tokens":10000,"thinking":{"type":"adaptive"},"output_config":{"effort":"low"}}`, + expectThinkingType: "adaptive", + expectEffort: "low", + expectKeptFields: []string{"output_config"}, + }, + { + name: "fable_5_model_with_enabled_thinking_is_converted_to_adaptive_and_drops_budget", + bedrockModel: "anthropic.claude-fable-5", + requestBody: `{"max_tokens":10000,"thinking":{"type":"enabled","budget_tokens":5000}}`, + expectThinkingType: "adaptive", + }, + { + name: "global_fable_5_1_model_keeps_adaptive_thinking_and_output_config_effort", + bedrockModel: "global.anthropic.claude-fable-5-1", + requestBody: `{"max_tokens":10000,"thinking":{"type":"adaptive"},"output_config":{"effort":"high"}}`, + expectThinkingType: "adaptive", + expectEffort: "high", + expectKeptFields: []string{"output_config"}, + }, + { + name: "mythos_5_model_with_enabled_thinking_is_converted_to_adaptive_and_drops_budget", + bedrockModel: "anthropic.claude-mythos-5", + requestBody: `{"max_tokens":10000,"thinking":{"type":"enabled","budget_tokens":5000}}`, + expectThinkingType: "adaptive", + }, + { + name: "global_mythos_5_1_model_keeps_adaptive_thinking_and_output_config_effort", + bedrockModel: "global.anthropic.claude-mythos-5-1", + requestBody: `{"max_tokens":10000,"thinking":{"type":"adaptive"},"output_config":{"effort":"high"}}`, + expectThinkingType: "adaptive", + expectEffort: "high", + expectKeptFields: []string{"output_config"}, + }, { // Opus 4.7 on Bedrock rejects output_config.format (structured // outputs) with a 400 even though it accepts output_config.effort. From c2380036596eb2d79477b9eb60eb3c0d1f441a51 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?McKayla=20=E3=81=AF=E3=81=AA?= Date: Fri, 16 Oct 2026 15:11:14 -0600 Subject: [PATCH 69/69] ci: add coder-backporter-app[bot] to CLA allowlist (#30801) --- .github/workflows/contrib.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/contrib.yaml b/.github/workflows/contrib.yaml index 2292246988e..4d76882c5c1 100644 --- a/.github/workflows/contrib.yaml +++ b/.github/workflows/contrib.yaml @@ -116,7 +116,7 @@ jobs: # branch should not be protected branch: "main" # Some users have signed a corporate CLA with Coder so are exempt from signing our community one. - allowlist: "coryb,aaronlehmann,dependabot*,blink-so*,blinkagent*" + allowlist: "coryb,aaronlehmann,dependabot*,blink-so*,blinkagent*,coder-backporter-app[bot]" title: runs-on: ubuntu-latest