May 20, 2025 · May 20, 2025 · May 20, 2025 · May 20, 2025 · May 20, 2025 · May 20, 2025
diff --git a/.cursorrules b/.cursorrules

 Coder provides a platform for creating, managing, and using remote development environments (also known as Cloud Development Environments or CDEs). It leverages Terraform to define and provision these environments, which are referred to as "workspaces" within the project. The system is designed to be extensible, secure, and provide developers with a seamless remote development experience.

 # Core Architecture
 ## Core Architecture

 The heart of Coder is a control plane that orchestrates the creation and management of workspaces. This control plane interacts with separate Provisioner processes over gRPC to handle workspace builds. The Provisioners consume workspace definitions and use Terraform to create the actual infrastructure.

 The CLI package serves dual purposes - it can be used to launch the control plane itself and also provides client functionality for users to interact with an existing control plane instance. All user-facing frontend code is developed in TypeScript using React and lives in the `site/` directory.

 The database layer uses PostgreSQL with SQLC for generating type-safe database code. Database migrations are carefully managed to ensure both forward and backward compatibility through paired `.up.sql` and `.down.sql` files.

 # API Design
 ## API Design

 Coder's API architecture combines REST and gRPC approaches. The REST API is defined in `coderd/coderd.go` and uses Chi for HTTP routing. This provides the primary interface for the frontend and external integrations.

 Internal communication with Provisioners occurs over gRPC, with service definitions maintained in `.proto` files. This separation allows for efficient binary communication with the components responsible for infrastructure management while providing a standard REST interface for human-facing applications.

 # Network Architecture
 ## Network Architecture

 Coder implements a secure networking layer based on Tailscale's Wireguard implementation. The `tailnet` package provides connectivity between workspace agents and clients through DERP (Designated Encrypted Relay for Packets) servers when direct connections aren't possible. This creates a secure overlay network allowing access to workspaces regardless of network topology, firewalls, or NAT configurations.

 ## Tailnet and DERP System
 ### Tailnet and DERP System

 The networking system has three key components:


 3. **Direct Connections**: When possible, the system establishes peer-to-peer connections between clients and workspaces using STUN for NAT traversal. This requires both endpoints to send UDP traffic on ephemeral ports.

 ## Workspace Proxies
 ### Workspace Proxies

 Workspace proxies (in the Enterprise edition) provide regional relay points for browser-based connections, reducing latency for geo-distributed teams. Key characteristics:

 - Managed through the `coder wsproxy` commands
 - Implemented primarily in the `enterprise/wsproxy/` package

 # Agent System
 ## Agent System

 The workspace agent runs within each provisioned workspace and provides core functionality including:

 - SSH access to workspaces via the `agentssh` package
 - Port forwarding
 - Terminal connectivity via the `pty` package for pseudo-terminal support

 Agents communicate with the control plane using the tailnet system and authenticate using secure tokens.

 # Workspace Applications
 ## Workspace Applications

 Workspace applications (or "apps") provide browser-based access to services running within workspaces. The system supports:


 The implementation is primarily in the `coderd/workspaceapps/` directory with components for URL generation, proxying connections, and managing application state.

 # Implementation Details
 ## Implementation Details

 The project structure separates frontend and backend concerns. React components and pages are organized in the `site/src/` directory, with Jest used for testing. The backend is primarily written in Go, with a strong emphasis on error handling patterns and test coverage.

 Database interactions are carefully managed through migrations in `coderd/database/migrations/` and queries in `coderd/database/queries/`. All new queries require proper database authorization (dbauthz) implementation to ensure that only users with appropriate permissions can access specific resources.

 # Authorization System
 ## Authorization System

 The database authorization (dbauthz) system enforces fine-grained access control across all database operations. It uses role-based access control (RBAC) to validate user permissions before executing database operations. The `dbauthz` package wraps the database store and performs authorization checks before returning data. All database operations must pass through this layer to ensure security.

 # Testing Framework
 ## Testing Framework

 The codebase has a comprehensive testing approach with several key components:


 4. **Enterprise Testing**: Enterprise features have dedicated test utilities in the `coderdenttest` package.

 # Open Source and Enterprise Components
 ## Open Source and Enterprise Components

 The repository contains both open source and enterprise components:

 - The boundary between open source and enterprise is managed through a licensing system
 - The same core codebase supports both editions, with enterprise features conditionally enabled

 # Development Philosophy
 ## Development Philosophy

 Coder emphasizes clear error handling, with specific patterns required:

 - Concise error messages that avoid phrases like "failed to"
 - Wrapping errors with `%w` to maintain error chains
 - Using sentinel errors with the "err" prefix (e.g., `errNotFound`)

 Git contributions follow a standard format with commit messages structured as `type: <message>`, where type is one of `feat`, `fix`, or `chore`.

 # Development Workflow
 ## Development Workflow

 Development can be initiated using `scripts/develop.sh` to start the application after making changes. Database schema updates should be performed through the migration system using `create_migration.sh <name>` to generate migration files, with each `.up.sql` migration paired with a corresponding `.down.sql` that properly reverts all changes.

diff --git a/CLAUDE.md b/CLAUDE.md
 # Coder Development Guidelines

 Read [cursor rules](.cursorrules).

 ## Build/Test/Lint Commands

 ### Main Commands

 - `make build` or `make build-fat` - Build all "fat" binaries (includes "server" functionality)
 - `make build-slim` - Build "slim" binaries
 - `make test` - Run Go tests
 - `make test RUN=TestFunctionName` or `go test -v ./path/to/package -run TestFunctionName` - Test single
 - `make test-postgres` - Run tests with Postgres database
 - `make test-race` - Run tests with Go race detector
 - `make test-e2e` - Run end-to-end tests
 - `make lint` - Run all linters
 - `make fmt` - Format all code
 - `make gen` - Generates mocks, database queries and other auto-generated files

 ### Frontend Commands (site directory)

 - `pnpm build` - Build frontend
 - `pnpm dev` - Run development server
 - `pnpm check` - Run code checks
 - `pnpm format` - Format frontend code
 - `pnpm lint` - Lint frontend code
 - `pnpm test` - Run frontend tests

 ## Code Style Guidelines

 ### Go

 - Follow [Effective Go](https://go.dev/doc/effective_go) and [Go's Code Review Comments](https://github.com/golang/go/wiki/CodeReviewComments)
 - Use `gofumpt` for formatting
 - Create packages when used during implementation
 - Validate abstractions against implementations

 ### Error Handling

 - Use descriptive error messages
 - Wrap errors with context
 - Propagate errors appropriately
 - Use proper error types
 - (`xerrors.Errorf("failed to X: %w", err)`)

 ### Naming

 - Use clear, descriptive names
 - Abbreviate only when obvious
 - Follow Go and TypeScript naming conventions

 ### Comments

 - Document exported functions, types, and non-obvious logic
 - Follow JSDoc format for TypeScript
 - Use godoc format for Go code

 ## Commit Style

 - Follow [Conventional Commits 1.0.0](https://www.conventionalcommits.org/en/v1.0.0/)
 - Format: `type(scope): message`
 - Types: `feat`, `fix`, `docs`, `style`, `refactor`, `test`, `chore`
 - Keep message titles concise (~70 characters)
 - Use imperative, present tense in commit titles

 ## Database queries

 - MUST DO! Any changes to database - adding queries, modifying queries should be done in the  `coderd\database\queries\*.sql` files. Use `make gen` to generate necessary changes after.
 - MUST DO! Queries are grouped in files relating to context - e.g. `prebuilds.sql`, `users.sql`, `provisionerjobs.sql`.
 - After making changes to any `coderd\database\queries\*.sql` files you must run `make gen` to generate respective ORM changes.

 ## Architecture

 ### Core Components

 - **coderd**: Main API service connecting workspaces, provisioners, and users
 - **provisionerd**: Execution context for infrastructure-modifying providers
 - **Agents**: Services in remote workspaces providing features like SSH and port forwarding
 - **Workspaces**: Cloud resources defined by Terraform

 ## Sub-modules

 ### Template System

 - Templates define infrastructure for workspaces using Terraform
 - Environment variables pass context between Coder and templates
 - Official modules extend development environments

 ### RBAC System

 - Permissions defined at site, organization, and user levels
 - Object-Action model protects resources
 - Built-in roles: owner, member, auditor, templateAdmin
 - Permission format: `<sign>?<level>.<object>.<id>.<action>`

 ### Database

 - PostgreSQL 13+ recommended for production
 - Migrations managed with `migrate`
 - Database authorization through `dbauthz` package

 ## Frontend

 For building Frontend refer to [this document](docs/contributing/frontend.md)
diff --git a/cli/testdata/server-config.yaml.golden b/cli/testdata/server-config.yaml.golden
  # backoff.
  # (default: 1h0m0s, type: duration)
  reconciliation_backoff_lookback_period: 1h0m0s
  # Maximum number of consecutive failed prebuilds before a preset hits the hard
  # limit; disabled when set to zero.
  # (default: 3, type: int)
  failure_hard_limit: 3
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
Original file line number	Diff line number	Diff line change
Expand Up		@@ -4,25 +4,25 @@ This project is called "Coder" - an application for managing remote development

		Coder provides a platform for creating, managing, and using remote development environments (also known as Cloud Development Environments or CDEs). It leverages Terraform to define and provision these environments, which are referred to as "workspaces" within the project. The system is designed to be extensible, secure, and provide developers with a seamless remote development experience.

		# Core Architecture
		## Core Architecture

		The heart of Coder is a control plane that orchestrates the creation and management of workspaces. This control plane interacts with separate Provisioner processes over gRPC to handle workspace builds. The Provisioners consume workspace definitions and use Terraform to create the actual infrastructure.

		The CLI package serves dual purposes - it can be used to launch the control plane itself and also provides client functionality for users to interact with an existing control plane instance. All user-facing frontend code is developed in TypeScript using React and lives in the `site/` directory.

		The database layer uses PostgreSQL with SQLC for generating type-safe database code. Database migrations are carefully managed to ensure both forward and backward compatibility through paired `.up.sql` and `.down.sql` files.

		# API Design
		## API Design

		Coder's API architecture combines REST and gRPC approaches. The REST API is defined in `coderd/coderd.go` and uses Chi for HTTP routing. This provides the primary interface for the frontend and external integrations.

		Internal communication with Provisioners occurs over gRPC, with service definitions maintained in `.proto` files. This separation allows for efficient binary communication with the components responsible for infrastructure management while providing a standard REST interface for human-facing applications.

		# Network Architecture
		## Network Architecture

		Coder implements a secure networking layer based on Tailscale's Wireguard implementation. The `tailnet` package provides connectivity between workspace agents and clients through DERP (Designated Encrypted Relay for Packets) servers when direct connections aren't possible. This creates a secure overlay network allowing access to workspaces regardless of network topology, firewalls, or NAT configurations.

		## Tailnet and DERP System
		### Tailnet and DERP System

		The networking system has three key components:

Expand All		@@ -35,7 +35,7 @@ The networking system has three key components:

		3. Direct Connections: When possible, the system establishes peer-to-peer connections between clients and workspaces using STUN for NAT traversal. This requires both endpoints to send UDP traffic on ephemeral ports.

		## Workspace Proxies
		### Workspace Proxies

		Workspace proxies (in the Enterprise edition) provide regional relay points for browser-based connections, reducing latency for geo-distributed teams. Key characteristics:

Expand All		@@ -45,9 +45,10 @@ Workspace proxies (in the Enterprise edition) provide regional relay points for
		- Managed through the `coder wsproxy` commands
		- Implemented primarily in the `enterprise/wsproxy/` package

		# Agent System
		## Agent System

		The workspace agent runs within each provisioned workspace and provides core functionality including:

		- SSH access to workspaces via the `agentssh` package
		- Port forwarding
		- Terminal connectivity via the `pty` package for pseudo-terminal support
Expand All		@@ -57,7 +58,7 @@ The workspace agent runs within each provisioned workspace and provides core fun

		Agents communicate with the control plane using the tailnet system and authenticate using secure tokens.

		# Workspace Applications
		## Workspace Applications

		Workspace applications (or "apps") provide browser-based access to services running within workspaces. The system supports:

Expand All		@@ -69,17 +70,17 @@ Workspace applications (or "apps") provide browser-based access to services runn

		The implementation is primarily in the `coderd/workspaceapps/` directory with components for URL generation, proxying connections, and managing application state.

		# Implementation Details
		## Implementation Details

		The project structure separates frontend and backend concerns. React components and pages are organized in the `site/src/` directory, with Jest used for testing. The backend is primarily written in Go, with a strong emphasis on error handling patterns and test coverage.

		Database interactions are carefully managed through migrations in `coderd/database/migrations/` and queries in `coderd/database/queries/`. All new queries require proper database authorization (dbauthz) implementation to ensure that only users with appropriate permissions can access specific resources.

		# Authorization System
		## Authorization System

		The database authorization (dbauthz) system enforces fine-grained access control across all database operations. It uses role-based access control (RBAC) to validate user permissions before executing database operations. The `dbauthz` package wraps the database store and performs authorization checks before returning data. All database operations must pass through this layer to ensure security.

		# Testing Framework
		## Testing Framework

		The codebase has a comprehensive testing approach with several key components:

Expand All		@@ -91,7 +92,7 @@ The codebase has a comprehensive testing approach with several key components:

		4. Enterprise Testing: Enterprise features have dedicated test utilities in the `coderdenttest` package.

		# Open Source and Enterprise Components
		## Open Source and Enterprise Components

		The repository contains both open source and enterprise components:

Expand All		@@ -100,9 +101,10 @@ The repository contains both open source and enterprise components:
		- The boundary between open source and enterprise is managed through a licensing system
		- The same core codebase supports both editions, with enterprise features conditionally enabled

		# Development Philosophy
		## Development Philosophy

		Coder emphasizes clear error handling, with specific patterns required:

		- Concise error messages that avoid phrases like "failed to"
		- Wrapping errors with `%w` to maintain error chains
		- Using sentinel errors with the "err" prefix (e.g., `errNotFound`)
Expand All		@@ -111,7 +113,7 @@ All tests should run in parallel using `t.Parallel()` to ensure efficient testin

		Git contributions follow a standard format with commit messages structured as `type: <message>`, where type is one of `feat`, `fix`, or `chore`.

		# Development Workflow
		## Development Workflow

		Development can be initiated using `scripts/develop.sh` to start the application after making changes. Database schema updates should be performed through the migration system using `create_migration.sh <name>` to generate migration files, with each `.up.sql` migration paired with a corresponding `.down.sql` that properly reverts all changes.

Expand Down
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,104 @@
		# Coder Development Guidelines

		Read [cursor rules](.cursorrules).

		## Build/Test/Lint Commands

		### Main Commands

		- `make build` or `make build-fat` - Build all "fat" binaries (includes "server" functionality)
		- `make build-slim` - Build "slim" binaries
		- `make test` - Run Go tests
		- `make test RUN=TestFunctionName` or `go test -v ./path/to/package -run TestFunctionName` - Test single
		- `make test-postgres` - Run tests with Postgres database
		- `make test-race` - Run tests with Go race detector
		- `make test-e2e` - Run end-to-end tests
		- `make lint` - Run all linters
		- `make fmt` - Format all code
		- `make gen` - Generates mocks, database queries and other auto-generated files

		### Frontend Commands (site directory)

		- `pnpm build` - Build frontend
		- `pnpm dev` - Run development server
		- `pnpm check` - Run code checks
		- `pnpm format` - Format frontend code
		- `pnpm lint` - Lint frontend code
		- `pnpm test` - Run frontend tests

		## Code Style Guidelines

		### Go

		- Follow [Effective Go](https://go.dev/doc/effective_go) and [Go's Code Review Comments](https://github.com/golang/go/wiki/CodeReviewComments)
		- Use `gofumpt` for formatting
		- Create packages when used during implementation
		- Validate abstractions against implementations

		### Error Handling

		- Use descriptive error messages
		- Wrap errors with context
		- Propagate errors appropriately
		- Use proper error types
		- (`xerrors.Errorf("failed to X: %w", err)`)

		### Naming

		- Use clear, descriptive names
		- Abbreviate only when obvious
		- Follow Go and TypeScript naming conventions

		### Comments

		- Document exported functions, types, and non-obvious logic
		- Follow JSDoc format for TypeScript
		- Use godoc format for Go code

		## Commit Style

		- Follow [Conventional Commits 1.0.0](https://www.conventionalcommits.org/en/v1.0.0/)
		- Format: `type(scope): message`
		- Types: `feat`, `fix`, `docs`, `style`, `refactor`, `test`, `chore`
		- Keep message titles concise (~70 characters)
		- Use imperative, present tense in commit titles

		## Database queries

		- MUST DO! Any changes to database - adding queries, modifying queries should be done in the `coderd\database\queries\*.sql` files. Use `make gen` to generate necessary changes after.
		- MUST DO! Queries are grouped in files relating to context - e.g. `prebuilds.sql`, `users.sql`, `provisionerjobs.sql`.
		- After making changes to any `coderd\database\queries\*.sql` files you must run `make gen` to generate respective ORM changes.

		## Architecture

		### Core Components

		- coderd: Main API service connecting workspaces, provisioners, and users
		- provisionerd: Execution context for infrastructure-modifying providers
		- Agents: Services in remote workspaces providing features like SSH and port forwarding
		- Workspaces: Cloud resources defined by Terraform

		## Sub-modules

		### Template System

		- Templates define infrastructure for workspaces using Terraform
		- Environment variables pass context between Coder and templates
		- Official modules extend development environments

		### RBAC System

		- Permissions defined at site, organization, and user levels
		- Object-Action model protects resources
		- Built-in roles: owner, member, auditor, templateAdmin
		- Permission format: `<sign>?<level>.<object>.<id>.<action>`

		### Database

		- PostgreSQL 13+ recommended for production
		- Migrations managed with `migrate`
		- Database authorization through `dbauthz` package

		## Frontend

		For building Frontend refer to [this document](docs/contributing/frontend.md)
Original file line number	Diff line number	Diff line change
Expand Up		@@ -704,3 +704,7 @@ workspace_prebuilds:
		# backoff.
		# (default: 1h0m0s, type: duration)
		reconciliation_backoff_lookback_period: 1h0m0s
		# Maximum number of consecutive failed prebuilds before a preset hits the hard
		# limit; disabled when set to zero.
		# (default: 3, type: int)
		failure_hard_limit: 3