May 15, 2025 · Apr 30, 2025 · May 1, 2025 · May 6, 2025 · Apr 30, 2025 · May 1, 2025
diff --git a/cli/server.go b/cli/server.go
 _ = sqlDB.Close()
 }()

 if options.DeploymentValues.Prometheus.Enable {
 // At this stage we don't think the database name serves much purpose in these metrics.
 // It requires parsing the DSN to determine it, which requires pulling in another dependency
 // (i.e. https://github.com/jackc/pgx), but it's rather heavy.
 // The conn string (https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING) can
 // take different forms, which make parsing non-trivial.
 options.PrometheusRegistry.MustRegister(collectors.NewDBStatsCollector(sqlDB, ""))
 }

 options.Database = database.New(sqlDB)
 ps, err := pubsub.New(ctx, logger.Named("pubsub"), sqlDB, dbURL)
 if err != nil {
diff --git a/cli/ssh.go b/cli/ssh.go
 "fmt"
 "io"
 "log"
 "net"
 "net/http"
 "net/url"
 "os"
 stdio               bool
 hostPrefix          string
 hostnameSuffix      string
 forceNewTunnel      bool
 forwardAgent        bool
 forwardGPG          bool
 identityAgent       string
 containerUser string
 )
 client := new(codersdk.Client)
 wsClient := workspacesdk.New(client)
 cmd := &serpent.Command{
 Annotations: workspaceCommand,
 Use:         "ssh <workspace>",
 parsedEnv = append(parsedEnv, [2]string{k, v})
 }

 deploymentSSHConfig := codersdk.SSHConfigResponse{
 cliConfig := codersdk.SSHConfigResponse{
 HostnamePrefix: hostPrefix,
 HostnameSuffix: hostnameSuffix,
 }

 workspace, workspaceAgent, err := findWorkspaceAndAgentByHostname(
 ctx, inv, client,
 inv.Args[0],deploymentSSHConfig, disableAutostart)
 inv.Args[0],cliConfig, disableAutostart)
 if err != nil {
 return err
 }
 return err
 }

 // If we're in stdio mode, check to see if we can use Coder Connect.
 // We don't support Coder Connect over non-stdio coder ssh yet.
 if stdio && !forceNewTunnel {
 connInfo, err := wsClient.AgentConnectionInfoGeneric(ctx)
 if err != nil {
 return xerrors.Errorf("get agent connection info: %w", err)
 }
 coderConnectHost := fmt.Sprintf("%s.%s.%s.%s",
 workspaceAgent.Name, workspace.Name, workspace.OwnerName, connInfo.HostnameSuffix)
 exists, _ := workspacesdk.ExistsViaCoderConnect(ctx, coderConnectHost)
 if exists {
 defer cancel()

 if networkInfoDir != "" {
 if err := writeCoderConnectNetInfo(ctx, networkInfoDir); err != nil {
 logger.Error(ctx, "failed to write coder connect net info file", slog.Error(err))
 }
 }

 stopPolling := tryPollWorkspaceAutostop(ctx, client, workspace)
 defer stopPolling()

 usageAppName := getUsageAppName(usageApp)
 if usageAppName != "" {
 closeUsage := client.UpdateWorkspaceUsageWithBodyContext(ctx, workspace.ID, codersdk.PostWorkspaceUsageRequest{
 AgentID: workspaceAgent.ID,
 AppName: usageAppName,
 })
 defer closeUsage()
 }
 return runCoderConnectStdio(ctx, fmt.Sprintf("%s:22", coderConnectHost), stdioReader, stdioWriter, stack)
 }
 }

 if r.disableDirect {
 _, _ = fmt.Fprintln(inv.Stderr, "Direct connections disabled.")
 }
 conn, err :=workspacesdk.New(client).
 conn, err :=wsClient.
 DialAgent(ctx, workspaceAgent.ID, &workspacesdk.DialAgentOptions{
 Logger:          logger,
 BlockEndpoints:  r.disableDirect,
 Value:       serpent.StringOf(&containerUser),
 Hidden:      true, // Hidden until this features is at least in beta.
 },
 {
 Flag:        "force-new-tunnel",
 Description: "Force the creation of a new tunnel to the workspace, even if the Coder Connect tunnel is available.",
 Value:       serpent.BoolOf(&forceNewTunnel),
 Hidden:      true,
 },
 sshDisableAutostartOption(serpent.BoolOf(&disableAutostart)),
 }
 return cmd
 }

 type sshNetworkStats struct {
 P2P              bool               `json:"p2p"`
 Latency          float64            `json:"latency"`
 PreferredDERP    string             `json:"preferred_derp"`
 DERPLatency      map[string]float64 `json:"derp_latency"`
 UploadBytesSec   int64              `json:"upload_bytes_sec"`
 DownloadBytesSec int64              `json:"download_bytes_sec"`
 P2P               bool               `json:"p2p"`
 Latency           float64            `json:"latency"`
 PreferredDERP     string             `json:"preferred_derp"`
 DERPLatency       map[string]float64 `json:"derp_latency"`
 UploadBytesSec    int64              `json:"upload_bytes_sec"`
 DownloadBytesSec  int64              `json:"download_bytes_sec"`
 UsingCoderConnect bool               `json:"using_coder_connect"`
 }

 func collectNetworkStats(ctx context.Context, agentConn *workspacesdk.AgentConn, start, end time.Time, counts map[netlogtype.Connection]netlogtype.Counts) (*sshNetworkStats, error) {
 }, nil
 }

 type coderConnectDialerContextKey struct{}

 type coderConnectDialer interface {
 DialContext(ctx context.Context, network, addr string) (net.Conn, error)
 }

 func WithTestOnlyCoderConnectDialer(ctx context.Context, dialer coderConnectDialer) context.Context {
 return context.WithValue(ctx, coderConnectDialerContextKey{}, dialer)
 }

 func testOrDefaultDialer(ctx context.Context) coderConnectDialer {
 dialer, ok := ctx.Value(coderConnectDialerContextKey{}).(coderConnectDialer)
 if !ok || dialer == nil {
 return &net.Dialer{}
 }
 return dialer
 }

 func runCoderConnectStdio(ctx context.Context, addr string, stdin io.Reader, stdout io.Writer, stack *closerStack) error {
 dialer := testOrDefaultDialer(ctx)
 conn, err := dialer.DialContext(ctx, "tcp", addr)
 if err != nil {
 return xerrors.Errorf("dial coder connect host: %w", err)
 }
 if err := stack.push("tcp conn", conn); err != nil {
 return err
 }

 agentssh.Bicopy(ctx, conn, &StdioRwc{
 Reader: stdin,
 Writer: stdout,
 })

 return nil
 }

 type StdioRwc struct {
 io.Reader
 io.Writer
 }

 func (*StdioRwc) Close() error {
 return nil
 }

 func writeCoderConnectNetInfo(ctx context.Context, networkInfoDir string) error {
 fs, ok := ctx.Value("fs").(afero.Fs)
 if !ok {
 fs = afero.NewOsFs()
 }
 if err := fs.MkdirAll(networkInfoDir, 0o700); err != nil {
 return xerrors.Errorf("mkdir: %w", err)
 }

 // The VS Code extension obtains the PID of the SSH process to
 // find the log file associated with a SSH session.
 //
 // We get the parent PID because it's assumed `ssh` is calling this
 // command via the ProxyCommand SSH option.
 networkInfoFilePath := filepath.Join(networkInfoDir, fmt.Sprintf("%d.json", os.Getppid()))
 stats := &sshNetworkStats{
 UsingCoderConnect: true,
 }
 rawStats, err := json.Marshal(stats)
 if err != nil {
 return xerrors.Errorf("marshal network stats: %w", err)
 }
 err = afero.WriteFile(fs, networkInfoFilePath, rawStats, 0o600)
 if err != nil {
 return xerrors.Errorf("write network stats: %w", err)
 }
 return nil
 }

 // Converts workspace name input to owner/workspace.agent format
 // Possible valid input formats:
 // workspace
diff --git a/cli/ssh_internal_test.go b/cli/ssh_internal_test.go
 import (
 "context"
 "fmt"
 "io"
 "net"
 "net/url"
 "sync"
 "testing"
 "time"

 gliderssh "github.com/gliderlabs/ssh"
 "github.com/stretchr/testify/assert"
 "github.com/stretchr/testify/require"
 "golang.org/x/crypto/ssh"
 "golang.org/x/xerrors"

 "cdr.dev/slog"
 testutil.TryReceive(ctx, t, closed)
 }

 func TestCoderConnectStdio(t *testing.T) {
 t.Parallel()

 ctx := testutil.Context(t, testutil.WaitShort)
 logger := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
 stack := newCloserStack(ctx, logger, quartz.NewMock(t))

 clientOutput, clientInput := io.Pipe()
 serverOutput, serverInput := io.Pipe()
 defer func() {
 for _, c := range []io.Closer{clientOutput, clientInput, serverOutput, serverInput} {
 _ = c.Close()
 }
 }()

 server := newSSHServer("127.0.0.1:0")
 ln, err := net.Listen("tcp", server.server.Addr)
 require.NoError(t, err)

 go func() {
 _ = server.Serve(ln)
 }()
 t.Cleanup(func() {
 _ = server.Close()
 })

 stdioDone := make(chan struct{})
 go func() {
 err = runCoderConnectStdio(ctx, ln.Addr().String(), clientOutput, serverInput, stack)
 assert.NoError(t, err)
 close(stdioDone)
 }()

 conn, channels, requests, err := ssh.NewClientConn(&testutil.ReaderWriterConn{
 Reader: serverOutput,
 Writer: clientInput,
 }, "", &ssh.ClientConfig{
 // #nosec
 HostKeyCallback: ssh.InsecureIgnoreHostKey(),
 })
 require.NoError(t, err)
 defer conn.Close()

 sshClient := ssh.NewClient(conn, channels, requests)
 session, err := sshClient.NewSession()
 require.NoError(t, err)
 defer session.Close()

 // We're not connected to a real shell
 err = session.Run("")
 require.NoError(t, err)
 err = sshClient.Close()
 require.NoError(t, err)
 _ = clientOutput.Close()

 <-stdioDone
 }

 type sshServer struct {
 server *gliderssh.Server
 }

 func newSSHServer(addr string) *sshServer {
 return &sshServer{
 server: &gliderssh.Server{
 Addr: addr,
 Handler: func(s gliderssh.Session) {
 _, _ = io.WriteString(s.Stderr(), "Connected!")
 },
 },
 }
 }

 func (s *sshServer) Serve(ln net.Listener) error {
 return s.server.Serve(ln)
 }

 func (s *sshServer) Close() error {
 return s.server.Close()
 }

 type fakeCloser struct {
 closes *[]*fakeCloser
 err    error
Original file line number	Diff line number	Diff line change
Expand Up		@@ -739,6 +739,15 @@ func (r RootCmd) Server(newAPI func(context.Context, coderd.Options) (*coderd.
		_ = sqlDB.Close()
		}()

		if options.DeploymentValues.Prometheus.Enable {
		// At this stage we don't think the database name serves much purpose in these metrics.
		// It requires parsing the DSN to determine it, which requires pulling in another dependency
		// (i.e. https://github.com/jackc/pgx), but it's rather heavy.
		// The conn string (https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING) can
		// take different forms, which make parsing non-trivial.
		options.PrometheusRegistry.MustRegister(collectors.NewDBStatsCollector(sqlDB, ""))
		}

		options.Database = database.New(sqlDB)
		ps, err := pubsub.New(ctx, logger.Named("pubsub"), sqlDB, dbURL)
		if err != nil {
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -8,6 +8,7 @@ import (
		"fmt"
		"io"
		"log"
		"net"
		"net/http"
		"net/url"
		"os"
Expand DownExpand Up		@@ -66,6 +67,7 @@ func (r RootCmd) ssh() serpent.Command {
		stdio bool
		hostPrefix string
		hostnameSuffix string
		forceNewTunnel bool
		forwardAgent bool
		forwardGPG bool
		identityAgent string
Expand All		@@ -85,6 +87,7 @@ func (r RootCmd) ssh() serpent.Command {
		containerUser string
		)
		client := new(codersdk.Client)
		wsClient := workspacesdk.New(client)
		cmd := &serpent.Command{
		Annotations: workspaceCommand,
		Use: "ssh <workspace>",
Expand DownExpand Up		@@ -203,14 +206,14 @@ func (r RootCmd) ssh() serpent.Command {
		parsedEnv = append(parsedEnv, [2]string{k, v})
		}

		deploymentSSHConfig := codersdk.SSHConfigResponse{
		cliConfig := codersdk.SSHConfigResponse{
		HostnamePrefix: hostPrefix,
		HostnameSuffix: hostnameSuffix,
		}

		workspace, workspaceAgent, err := findWorkspaceAndAgentByHostname(
		ctx, inv, client,
		inv.Args[0],deploymentSSHConfig, disableAutostart)
		inv.Args[0],cliConfig, disableAutostart)
		if err != nil {
		return err
		}
Expand DownExpand Up		@@ -275,10 +278,44 @@ func (r RootCmd) ssh() serpent.Command {
		return err
		}

		// If we're in stdio mode, check to see if we can use Coder Connect.
		// We don't support Coder Connect over non-stdio coder ssh yet.
		if stdio && !forceNewTunnel {
		connInfo, err := wsClient.AgentConnectionInfoGeneric(ctx)
		if err != nil {
		return xerrors.Errorf("get agent connection info: %w", err)
		}
		coderConnectHost := fmt.Sprintf("%s.%s.%s.%s",
		workspaceAgent.Name, workspace.Name, workspace.OwnerName, connInfo.HostnameSuffix)
		exists, _ := workspacesdk.ExistsViaCoderConnect(ctx, coderConnectHost)
		if exists {
		defer cancel()

		if networkInfoDir != "" {
		if err := writeCoderConnectNetInfo(ctx, networkInfoDir); err != nil {
		logger.Error(ctx, "failed to write coder connect net info file", slog.Error(err))
		}
		}

		stopPolling := tryPollWorkspaceAutostop(ctx, client, workspace)
		defer stopPolling()

		usageAppName := getUsageAppName(usageApp)
		if usageAppName != "" {
		closeUsage := client.UpdateWorkspaceUsageWithBodyContext(ctx, workspace.ID, codersdk.PostWorkspaceUsageRequest{
		AgentID: workspaceAgent.ID,
		AppName: usageAppName,
		})
		defer closeUsage()
		}
		return runCoderConnectStdio(ctx, fmt.Sprintf("%s:22", coderConnectHost), stdioReader, stdioWriter, stack)
		}
		}

		if r.disableDirect {
		_, _ = fmt.Fprintln(inv.Stderr, "Direct connections disabled.")
		}
		conn, err :=workspacesdk.New(client).
		conn, err :=wsClient.
		DialAgent(ctx, workspaceAgent.ID, &workspacesdk.DialAgentOptions{
		Logger: logger,
		BlockEndpoints: r.disableDirect,
Expand DownExpand Up		@@ -660,6 +697,12 @@ func (r RootCmd) ssh() serpent.Command {
		Value: serpent.StringOf(&containerUser),
		Hidden: true, // Hidden until this features is at least in beta.
		},
		{
		Flag: "force-new-tunnel",
		Description: "Force the creation of a new tunnel to the workspace, even if the Coder Connect tunnel is available.",
		Value: serpent.BoolOf(&forceNewTunnel),
		Hidden: true,
		},
		sshDisableAutostartOption(serpent.BoolOf(&disableAutostart)),
		}
		return cmd
Expand DownExpand Up		@@ -1372,12 +1415,13 @@ func setStatsCallback(
		}

		type sshNetworkStats struct {
		P2P bool `json:"p2p"`
		Latency float64 `json:"latency"`
		PreferredDERP string `json:"preferred_derp"`
		DERPLatency map[string]float64 `json:"derp_latency"`
		UploadBytesSec int64 `json:"upload_bytes_sec"`
		DownloadBytesSec int64 `json:"download_bytes_sec"`
		P2P bool `json:"p2p"`
		Latency float64 `json:"latency"`
		PreferredDERP string `json:"preferred_derp"`
		DERPLatency map[string]float64 `json:"derp_latency"`
		UploadBytesSec int64 `json:"upload_bytes_sec"`
		DownloadBytesSec int64 `json:"download_bytes_sec"`
		UsingCoderConnect bool `json:"using_coder_connect"`
		}

		func collectNetworkStats(ctx context.Context, agentConn workspacesdk.AgentConn, start, end time.Time, counts map[netlogtype.Connection]netlogtype.Counts) (sshNetworkStats, error) {
Expand DownExpand Up		@@ -1448,6 +1492,80 @@ func collectNetworkStats(ctx context.Context, agentConn *workspacesdk.AgentConn,
		}, nil
		}

		type coderConnectDialerContextKey struct{}

		type coderConnectDialer interface {
		DialContext(ctx context.Context, network, addr string) (net.Conn, error)
		}

		func WithTestOnlyCoderConnectDialer(ctx context.Context, dialer coderConnectDialer) context.Context {
		return context.WithValue(ctx, coderConnectDialerContextKey{}, dialer)
		}

		func testOrDefaultDialer(ctx context.Context) coderConnectDialer {
		dialer, ok := ctx.Value(coderConnectDialerContextKey{}).(coderConnectDialer)
		if !ok \|\| dialer == nil {
		return &net.Dialer{}
		}
		return dialer
		}

		func runCoderConnectStdio(ctx context.Context, addr string, stdin io.Reader, stdout io.Writer, stack *closerStack) error {
		dialer := testOrDefaultDialer(ctx)
		conn, err := dialer.DialContext(ctx, "tcp", addr)
		if err != nil {
		return xerrors.Errorf("dial coder connect host: %w", err)
		}
		if err := stack.push("tcp conn", conn); err != nil {
		return err
		}

		agentssh.Bicopy(ctx, conn, &StdioRwc{
		Reader: stdin,
		Writer: stdout,
		})

		return nil
		}

		type StdioRwc struct {
		io.Reader
		io.Writer
		}

		func (*StdioRwc) Close() error {
		return nil
		}

		func writeCoderConnectNetInfo(ctx context.Context, networkInfoDir string) error {
		fs, ok := ctx.Value("fs").(afero.Fs)
		if !ok {
		fs = afero.NewOsFs()
		}
		if err := fs.MkdirAll(networkInfoDir, 0o700); err != nil {
		return xerrors.Errorf("mkdir: %w", err)
		}

		// The VS Code extension obtains the PID of the SSH process to
		// find the log file associated with a SSH session.
		//
		// We get the parent PID because it's assumed `ssh` is calling this
		// command via the ProxyCommand SSH option.
		networkInfoFilePath := filepath.Join(networkInfoDir, fmt.Sprintf("%d.json", os.Getppid()))
		stats := &sshNetworkStats{
		UsingCoderConnect: true,
		}
		rawStats, err := json.Marshal(stats)
		if err != nil {
		return xerrors.Errorf("marshal network stats: %w", err)
		}
		err = afero.WriteFile(fs, networkInfoFilePath, rawStats, 0o600)
		if err != nil {
		return xerrors.Errorf("write network stats: %w", err)
		}
		return nil
		}

		// Converts workspace name input to owner/workspace.agent format
		// Possible valid input formats:
		// workspace
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -3,13 +3,17 @@ package cli
		import (
		"context"
		"fmt"
		"io"
		"net"
		"net/url"
		"sync"
		"testing"
		"time"

		gliderssh "github.com/gliderlabs/ssh"
		"github.com/stretchr/testify/assert"
		"github.com/stretchr/testify/require"
		"golang.org/x/crypto/ssh"
		"golang.org/x/xerrors"

		"cdr.dev/slog"
Expand DownExpand Up		@@ -220,6 +224,87 @@ func TestCloserStack_Timeout(t *testing.T) {
		testutil.TryReceive(ctx, t, closed)
		}

		func TestCoderConnectStdio(t *testing.T) {
		t.Parallel()

		ctx := testutil.Context(t, testutil.WaitShort)
		logger := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
		stack := newCloserStack(ctx, logger, quartz.NewMock(t))

		clientOutput, clientInput := io.Pipe()
		serverOutput, serverInput := io.Pipe()
		defer func() {
		for _, c := range []io.Closer{clientOutput, clientInput, serverOutput, serverInput} {
		_ = c.Close()
		}
		}()

		server := newSSHServer("127.0.0.1:0")
		ln, err := net.Listen("tcp", server.server.Addr)
		require.NoError(t, err)

		go func() {
		_ = server.Serve(ln)
		}()
		t.Cleanup(func() {
		_ = server.Close()
		})

		stdioDone := make(chan struct{})
		go func() {
		err = runCoderConnectStdio(ctx, ln.Addr().String(), clientOutput, serverInput, stack)
		assert.NoError(t, err)
		close(stdioDone)
		}()

		conn, channels, requests, err := ssh.NewClientConn(&testutil.ReaderWriterConn{
		Reader: serverOutput,
		Writer: clientInput,
		}, "", &ssh.ClientConfig{
		// #nosec
		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
		})
		require.NoError(t, err)
		defer conn.Close()

		sshClient := ssh.NewClient(conn, channels, requests)
		session, err := sshClient.NewSession()
		require.NoError(t, err)
		defer session.Close()

		// We're not connected to a real shell
		err = session.Run("")
		require.NoError(t, err)
		err = sshClient.Close()
		require.NoError(t, err)
		_ = clientOutput.Close()

		<-stdioDone
		}

		type sshServer struct {
		server *gliderssh.Server
		}

		func newSSHServer(addr string) *sshServer {
		return &sshServer{
		server: &gliderssh.Server{
		Addr: addr,
		Handler: func(s gliderssh.Session) {
		_, _ = io.WriteString(s.Stderr(), "Connected!")
		},
		},
		}
		}

		func (s *sshServer) Serve(ln net.Listener) error {
		return s.server.Serve(ln)
		}

		func (s *sshServer) Close() error {
		return s.server.Close()
		}

		type fakeCloser struct {
		closes []fakeCloser
		err error
Expand Down