Jun 24, 2025 · Jun 23, 2025 · Jun 23, 2025
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/coderd.go b/coderd/coderd.go
 // Add CSP headers to all static assets and pages. CSP headers only affect
 // browsers, so these don't make sense on api routes.
 cspMW:=httpmw.CSPHeaders(
 api.Experiments,
 options.Telemetry.Enabled(),func() []*proxyhealth.ProxyHost {
 ifapi.DeploymentValues.Dangerous.AllowAllCors {
 // In this mode, allow all external requests.
diff --git a/coderd/httpmw/csp.go b/coderd/httpmw/csp.go
 "strings"

 "github.com/coder/coder/v2/coderd/proxyhealth"
 "github.com/coder/coder/v2/codersdk"
 )

 // cspDirectives is a map of all csp fetch directives to their values.
 //     Example: https://github.com/coder/coder/issues/15118
 //
 //nolint:revive
 func CSPHeaders(experiments codersdk.Experiments,telemetry bool, proxyHosts func() []*proxyhealth.ProxyHost, staticAdditions map[CSPFetchDirective][]string) func(next http.Handler) http.Handler {
 func CSPHeaders(telemetry bool, proxyHosts func() []*proxyhealth.ProxyHost, staticAdditions map[CSPFetchDirective][]string) func(next http.Handler) http.Handler {
 return func(next http.Handler) http.Handler {
 return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 // Content-Security-Policy disables loading certain content types and can prevent XSS injections.
 if len(extraConnect) > 0 {
 for _, extraHost := range extraConnect {
 // Allow embedding the app host.
 if experiments.Enabled(codersdk.ExperimentAITasks) {
 cspSrcs.Append(CSPDirectiveFrameSrc, extraHost.AppHost)
 }
 cspSrcs.Append(CSPDirectiveFrameSrc, extraHost.AppHost)
 if extraHost.Host == "*" {
 // '*' means all
 cspSrcs.Append(CSPDirectiveConnectSrc, "*")
diff --git a/coderd/httpmw/csp_test.go b/coderd/httpmw/csp_test.go

 "github.com/coder/coder/v2/coderd/httpmw"
 "github.com/coder/coder/v2/coderd/proxyhealth"
 "github.com/coder/coder/v2/codersdk"
 )

 func TestCSP(t *testing.T) {
 r := httptest.NewRequest(http.MethodGet, "/", nil)
 rw := httptest.NewRecorder()

 httpmw.CSPHeaders(codersdk.Experiments{
 codersdk.ExperimentAITasks,
 }, false, func() []*proxyhealth.ProxyHost {
 httpmw.CSPHeaders(false, func() []*proxyhealth.ProxyHost {
 return proxyHosts
 }, map[httpmw.CSPFetchDirective][]string{
 httpmw.CSPDirectiveMediaSrc: expectedMedia,
diff --git a/codersdk/deployment.go b/codersdk/deployment.go
 ExperimentWebPushExperiment="web-push"// Enables web push notifications through the browser.
 ExperimentWorkspacePrebuildsExperiment="workspace-prebuilds"// Enables the new workspace prebuilds feature.
 ExperimentAgenticChatExperiment="agentic-chat"// Enables the new agentic AI chat feature.
 ExperimentAITasksExperiment="ai-tasks"// Enables the new AI tasks feature.
 )

 // ExperimentsSafe should include all experiments that are safe for
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
diff --git a/site/src/modules/dashboard/Navbar/NavbarView.tsx b/site/src/modules/dashboard/Navbar/NavbarView.tsx
 import{API}from"api/api";
 import{experiments}from"api/queries/experiments";
 importtype*asTypesGenfrom"api/typesGenerated";
 import{Button}from"components/Button/Button";
 import{ExternalImage}from"components/ExternalImage/ExternalImage";
 import{useEmbeddedMetadata}from"hooks/useEmbeddedMetadata";
 import{NotificationsInbox}from"modules/notifications/NotificationsInbox/NotificationsInbox";
 importtype{FC}from"react";
 import{useQuery}from"react-query";
 import{NavLink,useLocation}from"react-router-dom";
 import{cn}from"utils/cn";
 import{DeploymentDropdown}from"./DeploymentDropdown";
 constlocation=useLocation();
 constagenticChat=useAgenticChat();
 const{ metadata}=useEmbeddedMetadata();
 constexperimentsQuery=useQuery(experiments(metadata.experiments));

 return(
 <navclassName={cn("flex items-center gap-4 h-full",className)}>
 Chat
 </NavLink>
 )}
 {experimentsQuery.data?.includes("ai-tasks")&&(
 {metadata.tasksTabVisible.value&&(
 <NavLink
 className={({ isActive})=>{
 returncn(linkStyles.default,isActive ?linkStyles.active :"");
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1536,7 +1536,6 @@ func New(options Options) API {
		// Add CSP headers to all static assets and pages. CSP headers only affect
		// browsers, so these don't make sense on api routes.
		cspMW:=httpmw.CSPHeaders(
		api.Experiments,
		options.Telemetry.Enabled(),func() []*proxyhealth.ProxyHost {
		ifapi.DeploymentValues.Dangerous.AllowAllCors {
		// In this mode, allow all external requests.
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -6,7 +6,6 @@ import (
		"strings"

		"github.com/coder/coder/v2/coderd/proxyhealth"
		"github.com/coder/coder/v2/codersdk"
		)

		// cspDirectives is a map of all csp fetch directives to their values.
Expand DownExpand Up		@@ -59,7 +58,7 @@ const (
		// Example: https://github.com/coder/coder/issues/15118
		//
		//nolint:revive
		func CSPHeaders(experiments codersdk.Experiments,telemetry bool, proxyHosts func() []*proxyhealth.ProxyHost, staticAdditions map[CSPFetchDirective][]string) func(next http.Handler) http.Handler {
		func CSPHeaders(telemetry bool, proxyHosts func() []*proxyhealth.ProxyHost, staticAdditions map[CSPFetchDirective][]string) func(next http.Handler) http.Handler {
		return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		// Content-Security-Policy disables loading certain content types and can prevent XSS injections.
Expand DownExpand Up		@@ -124,9 +123,7 @@ func CSPHeaders(experiments codersdk.Experiments, telemetry bool, proxyHosts fun
		if len(extraConnect) > 0 {
		for _, extraHost := range extraConnect {
		// Allow embedding the app host.
		if experiments.Enabled(codersdk.ExperimentAITasks) {
		cspSrcs.Append(CSPDirectiveFrameSrc, extraHost.AppHost)
		}
		cspSrcs.Append(CSPDirectiveFrameSrc, extraHost.AppHost)
		if extraHost.Host == "*" {
		// '*' means all
		cspSrcs.Append(CSPDirectiveConnectSrc, "*")
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -10,7 +10,6 @@ import (

		"github.com/coder/coder/v2/coderd/httpmw"
		"github.com/coder/coder/v2/coderd/proxyhealth"
		"github.com/coder/coder/v2/codersdk"
		)

		func TestCSP(t *testing.T) {
Expand DownExpand Up		@@ -50,9 +49,7 @@ func TestCSP(t *testing.T) {
		r := httptest.NewRequest(http.MethodGet, "/", nil)
		rw := httptest.NewRecorder()

		httpmw.CSPHeaders(codersdk.Experiments{
		codersdk.ExperimentAITasks,
		}, false, func() []*proxyhealth.ProxyHost {
		httpmw.CSPHeaders(false, func() []*proxyhealth.ProxyHost {
		return proxyHosts
		}, map[httpmw.CSPFetchDirective][]string{
		httpmw.CSPDirectiveMediaSrc: expectedMedia,
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -3369,7 +3369,6 @@ const (
		ExperimentWebPushExperiment="web-push"// Enables web push notifications through the browser.
		ExperimentWorkspacePrebuildsExperiment="workspace-prebuilds"// Enables the new workspace prebuilds feature.
		ExperimentAgenticChatExperiment="agentic-chat"// Enables the new agentic AI chat feature.
		ExperimentAITasksExperiment="ai-tasks"// Enables the new AI tasks feature.
		)

		// ExperimentsSafe should include all experiments that are safe for
Expand Down
Original file line number	Diff line number	Diff line change
		@@ -1,5 +1,4 @@
		import{API}from"api/api";
		import{experiments}from"api/queries/experiments";
		importtype*asTypesGenfrom"api/typesGenerated";
		import{Button}from"components/Button/Button";
		import{ExternalImage}from"components/ExternalImage/ExternalImage";
Expand All		@@ -10,7 +9,6 @@ import { useWebpushNotifications } from "contexts/useWebpushNotifications";
		import{useEmbeddedMetadata}from"hooks/useEmbeddedMetadata";
		import{NotificationsInbox}from"modules/notifications/NotificationsInbox/NotificationsInbox";
		importtype{FC}from"react";
		import{useQuery}from"react-query";
		import{NavLink,useLocation}from"react-router-dom";
		import{cn}from"utils/cn";
		import{DeploymentDropdown}from"./DeploymentDropdown";
Expand DownExpand Up		@@ -145,7 +143,6 @@ const NavItems: FC<NavItemsProps> = ({ className }) => {
		constlocation=useLocation();
		constagenticChat=useAgenticChat();
		const{ metadata}=useEmbeddedMetadata();
		constexperimentsQuery=useQuery(experiments(metadata.experiments));

		return(
		<navclassName={cn("flex items-center gap-4 h-full",className)}>
Expand DownExpand Up		@@ -178,7 +175,7 @@ const NavItems: FC<NavItemsProps> = ({ className }) => {
		Chat
		</NavLink>
		)}
		{experimentsQuery.data?.includes("ai-tasks")&&(
		{metadata.tasksTabVisible.value&&(
		<NavLink
		className={({ isActive})=>{
		returncn(linkStyles.default,isActive ?linkStyles.active :"");
Expand Down