Oct 23, 2025 · Oct 15, 2025 · Oct 22, 2025
diff --git a/cli/exp_task_delete_test.go b/cli/exp_task_delete_test.go
 func TestExpTaskDelete(t *testing.T) {
 t.Parallel()

 t.Skip("TODO(mafredri): Remove, fixed down-stack!")

 type testCounters struct {
 deleteCalls  atomic.Int64
 nameResolves atomic.Int64
diff --git a/coderd/aitasks.go b/coderd/aitasks.go
 // @Security CoderSessionToken
 // @Tags Experimental
 // @Param user path string true "Username, user ID, or 'me' for the authenticated user"
 // @Paramid path string true "Task ID" format(uuid)
 // @Paramtask path string true "Task ID" format(uuid)
 // @Success 200 {object} codersdk.Task
 // @Router /api/experimental/tasks/{user}/{id} [get]
 // @Router /api/experimental/tasks/{user}/{task} [get]
 //
 // EXPERIMENTAL: This endpoint is experimental and not guaranteed to be stable.
 // taskGet is an experimental endpoint to fetch a single AI task by ID
 ctx := r.Context()
 apiKey := httpmw.APIKey(r)

 idStr := chi.URLParam(r, "id")
 idStr := chi.URLParam(r, "task")
 taskID, err := uuid.Parse(idStr)
 if err != nil {
 httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
 // @Security CoderSessionToken
 // @Tags Experimental
 // @Param user path string true "Username, user ID, or 'me' for the authenticated user"
 // @Paramid path string true "Task ID" format(uuid)
 // @Paramtask path string true "Task ID" format(uuid)
 // @Success 202 "Task deletion initiated"
 // @Router /api/experimental/tasks/{user}/{id} [delete]
 // @Router /api/experimental/tasks/{user}/{task} [delete]
 //
 // EXPERIMENTAL: This endpoint is experimental and not guaranteed to be stable.
 // taskDelete is an experimental endpoint to delete a task by ID (workspace ID).
 // taskDelete is an experimental endpoint to delete a task by ID.
 // It creates a delete workspace build and returns 202 Accepted if the build was
 // created.
 func (api *API) taskDelete(rw http.ResponseWriter, r *http.Request) {
 ctx := r.Context()
 apiKey := httpmw.APIKey(r)
 task := httpmw.TaskParam(r)

 idStr := chi.URLParam(r, "id")
 taskID, err := uuid.Parse(idStr)
 if err != nil {
 httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
 Message: fmt.Sprintf("Invalid UUID %q for task ID.", idStr),
 })
 return
 }
 now := api.Clock.Now()

 // For now, taskID = workspaceID, once we have a task data model in
 // the DB, we can change this lookup.
 workspaceID := taskID
 workspace, err := api.Database.GetWorkspaceByID(ctx, workspaceID)
 if httpapi.Is404Error(err) {
 httpapi.ResourceNotFound(rw)
 return
 }
 if err != nil {
 httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
 Message: "Internal error fetching workspace.",
 Detail:  err.Error(),
 })
 return
 if task.WorkspaceID.Valid {
 workspace, err := api.Database.GetWorkspaceByID(ctx, task.WorkspaceID.UUID)
 if err != nil {
 if httpapi.Is404Error(err) {
 httpapi.ResourceNotFound(rw)
 return
 }
 httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
 Message: "Internal error fetching task workspace before deleting task.",
 Detail:  err.Error(),
 })
 return
 }

 // Construct a request to the workspace build creation handler to
 // initiate deletion.
 buildReq := codersdk.CreateWorkspaceBuildRequest{
 Transition: codersdk.WorkspaceTransitionDelete,
 Reason:     "Deleted via tasks API",
 }

 _, err = api.postWorkspaceBuildsInternal(
 ctx,
 apiKey,
 workspace,
 buildReq,
 func(action policy.Action, object rbac.Objecter) bool {
 return api.Authorize(r, action, object)
 },
 audit.WorkspaceBuildBaggageFromRequest(r),
 )
 if err != nil {
 httperror.WriteWorkspaceBuildError(ctx, rw, err)
 return
 }
 }

 data, err := api.workspaceData(ctx, []database.Workspace{workspace})
 _, err := api.Database.DeleteTask(ctx, database.DeleteTaskParams{
 ID:        task.ID,
 DeletedAt: dbtime.Time(now),
 })
 if err != nil {
 httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
 Message: "Internal error fetching workspace resources.",
 Message: "Failed to delete task",
 Detail:  err.Error(),
 })
 return
 }
 if len(data.builds) == 0 || len(data.templates) == 0 {
 httpapi.ResourceNotFound(rw)
 return
 }
 if data.builds[0].HasAITask == nil || !*data.builds[0].HasAITask {
 httpapi.ResourceNotFound(rw)
 return
 }

 // Construct a request to the workspace build creation handler to
 // initiate deletion.
 buildReq := codersdk.CreateWorkspaceBuildRequest{
 Transition: codersdk.WorkspaceTransitionDelete,
 Reason:     "Deleted via tasks API",
 }

 _, err = api.postWorkspaceBuildsInternal(
 ctx,
 apiKey,
 workspace,
 buildReq,
 func(action policy.Action, object rbac.Objecter) bool {
 return api.Authorize(r, action, object)
 },
 audit.WorkspaceBuildBaggageFromRequest(r),
 )
 if err != nil {
 httperror.WriteWorkspaceBuildError(ctx, rw, err)
 return
 }

 //Delete build created successfully.
 //Task deleted and delete build created successfully.
 rw.WriteHeader(http.StatusAccepted)
 }

 // @Security CoderSessionToken
 // @Tags Experimental
 // @Param user path string true "Username, user ID, or 'me' for the authenticated user"
 // @Paramid path string true "Task ID" format(uuid)
 // @Paramtask path string true "Task ID" format(uuid)
 // @Param request body codersdk.TaskSendRequest true "Task input request"
 // @Success 204 "Input sent successfully"
 // @Router /api/experimental/tasks/{user}/{id}/send [post]
 // @Router /api/experimental/tasks/{user}/{task}/send [post]
 //
 // EXPERIMENTAL: This endpoint is experimental and not guaranteed to be stable.
 // taskSend submits task input to the tasks sidebar app by dialing the agent
 func (api *API) taskSend(rw http.ResponseWriter, r *http.Request) {
 ctx := r.Context()

 idStr := chi.URLParam(r, "id")
 idStr := chi.URLParam(r, "task")
 taskID, err := uuid.Parse(idStr)
 if err != nil {
 httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
 // @Security CoderSessionToken
 // @Tags Experimental
 // @Param user path string true "Username, user ID, or 'me' for the authenticated user"
 // @Paramid path string true "Task ID" format(uuid)
 // @Paramtask path string true "Task ID" format(uuid)
 // @Success 200 {object} codersdk.TaskLogsResponse
 // @Router /api/experimental/tasks/{user}/{id}/logs [get]
 // @Router /api/experimental/tasks/{user}/{task}/logs [get]
 //
 // EXPERIMENTAL: This endpoint is experimental and not guaranteed to be stable.
 // taskLogs reads task output by dialing the agent directly over the tailnet.
 // We enforce ApplicationConnect RBAC on the workspace and validate the sidebar app health.
 func (api *API) taskLogs(rw http.ResponseWriter, r *http.Request) {
 ctx := r.Context()

 idStr := chi.URLParam(r, "id")
 idStr := chi.URLParam(r, "task")
 taskID, err := uuid.Parse(idStr)
 if err != nil {
 httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
diff --git a/coderd/aitasks_test.go b/coderd/aitasks_test.go
 t.Run("Delete", func(t *testing.T) {
 t.Parallel()

 t.Skip("TODO(mafredri): Remove, fixed down-stack!")

 t.Run("OK", func(t *testing.T) {
 t.Parallel()

diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/coderd.go b/coderd/coderd.go

 r.Route("/{user}", func(r chi.Router) {
 r.Use(httpmw.ExtractOrganizationMembersParam(options.Database, api.HTTPAuth.Authorize))
 r.Get("/{id}", api.taskGet)
 r.Delete("/{id}", api.taskDelete)
 r.Post("/{id}/send", api.taskSend)
 r.Get("/{id}/logs", api.taskLogs)
 r.Post("/", api.tasksCreate)

 r.Route("/{task}", func(r chi.Router) {
 r.Use(httpmw.ExtractTaskParam(options.Database))
 r.Get("/", api.taskGet)
 r.Delete("/", api.taskDelete)
 r.Post("/send", api.taskSend)
 r.Get("/logs", api.taskLogs)
 })
 })
 })
 r.Route("/mcp", func(r chi.Router) {
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
 return q.db.DeleteTailnetTunnel(ctx, arg)
 }

 func (q *querier) DeleteTask(ctx context.Context, arg database.DeleteTaskParams) (database.TaskTable, error) {
 task, err := q.db.GetTaskByID(ctx, arg.ID)
 if err != nil {
 return database.TaskTable{}, err
 }

 if err := q.authorizeContext(ctx, policy.ActionDelete, task.RBACObject()); err != nil {
 return database.TaskTable{}, err
 }

 return q.db.DeleteTask(ctx, arg)
 }

 func (q *querier) DeleteUserSecret(ctx context.Context, id uuid.UUID) error {
 // First get the secret to check ownership
 secret, err := q.GetUserSecret(ctx, id)
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
 dbm.EXPECT().GetTaskByID(gomock.Any(), task.ID).Return(task, nil).AnyTimes()
 check.Args(task.ID).Asserts(task, policy.ActionRead).Returns(task)
 }))
 s.Run("DeleteTask", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
 task := testutil.Fake(s.T(), faker, database.Task{})
 arg := database.DeleteTaskParams{
 ID:        task.ID,
 DeletedAt: dbtime.Now(),
 }
 dbm.EXPECT().GetTaskByID(gomock.Any(), task.ID).Return(task, nil).AnyTimes()
 dbm.EXPECT().DeleteTask(gomock.Any(), arg).Return(database.TaskTable{}, nil).AnyTimes()
 check.Args(arg).Asserts(task, policy.ActionDelete).Returns(database.TaskTable{})
 }))
 s.Run("InsertTask", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
 tpl := testutil.Fake(s.T(), faker, database.Template{})
 tv := testutil.Fake(s.T(), faker, database.TemplateVersion{
Original file line number	Diff line number	Diff line change
Expand Up		@@ -22,8 +22,6 @@ import (
		func TestExpTaskDelete(t *testing.T) {
		t.Parallel()

		t.Skip("TODO(mafredri): Remove, fixed down-stack!")

		type testCounters struct {
		deleteCalls atomic.Int64
		nameResolves atomic.Int64
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -593,9 +593,9 @@ func (api API) tasksList(rw http.ResponseWriter, r http.Request) {
		// @Security CoderSessionToken
		// @Tags Experimental
		// @Param user path string true "Username, user ID, or 'me' for the authenticated user"
		// @Paramid path string true "Task ID" format(uuid)
		// @Paramtask path string true "Task ID" format(uuid)
		// @Success 200 {object} codersdk.Task
		// @Router /api/experimental/tasks/{user}/{id} [get]
		// @Router /api/experimental/tasks/{user}/{task} [get]
		//
		// EXPERIMENTAL: This endpoint is experimental and not guaranteed to be stable.
		// taskGet is an experimental endpoint to fetch a single AI task by ID
Expand All		@@ -605,7 +605,7 @@ func (api API) taskGet(rw http.ResponseWriter, r http.Request) {
		ctx := r.Context()
		apiKey := httpmw.APIKey(r)

		idStr := chi.URLParam(r, "id")
		idStr := chi.URLParam(r, "task")
		taskID, err := uuid.Parse(idStr)
		if err != nil {
		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
Expand DownExpand Up		@@ -710,83 +710,71 @@ func (api API) taskGet(rw http.ResponseWriter, r http.Request) {
		// @Security CoderSessionToken
		// @Tags Experimental
		// @Param user path string true "Username, user ID, or 'me' for the authenticated user"
		// @Paramid path string true "Task ID" format(uuid)
		// @Paramtask path string true "Task ID" format(uuid)
		// @Success 202 "Task deletion initiated"
		// @Router /api/experimental/tasks/{user}/{id} [delete]
		// @Router /api/experimental/tasks/{user}/{task} [delete]
		//
		// EXPERIMENTAL: This endpoint is experimental and not guaranteed to be stable.
		// taskDelete is an experimental endpoint to delete a task by ID (workspace ID).
		// taskDelete is an experimental endpoint to delete a task by ID.
		// It creates a delete workspace build and returns 202 Accepted if the build was
		// created.
		func (api API) taskDelete(rw http.ResponseWriter, r http.Request) {
		ctx := r.Context()
		apiKey := httpmw.APIKey(r)
		task := httpmw.TaskParam(r)

		idStr := chi.URLParam(r, "id")
		taskID, err := uuid.Parse(idStr)
		if err != nil {
		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
		Message: fmt.Sprintf("Invalid UUID %q for task ID.", idStr),
		})
		return
		}
		now := api.Clock.Now()

		// For now, taskID = workspaceID, once we have a task data model in
		// the DB, we can change this lookup.
		workspaceID := taskID
		workspace, err := api.Database.GetWorkspaceByID(ctx, workspaceID)
		if httpapi.Is404Error(err) {
		httpapi.ResourceNotFound(rw)
		return
		}
		if err != nil {
		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
		Message: "Internal error fetching workspace.",
		Detail: err.Error(),
		})
		return
		if task.WorkspaceID.Valid {
		workspace, err := api.Database.GetWorkspaceByID(ctx, task.WorkspaceID.UUID)
		if err != nil {
		if httpapi.Is404Error(err) {
		httpapi.ResourceNotFound(rw)
		return
		}
		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
		Message: "Internal error fetching task workspace before deleting task.",
		Detail: err.Error(),
		})
		return
		}

		// Construct a request to the workspace build creation handler to
		// initiate deletion.
		buildReq := codersdk.CreateWorkspaceBuildRequest{
		Transition: codersdk.WorkspaceTransitionDelete,
		Reason: "Deleted via tasks API",
		}

		_, err = api.postWorkspaceBuildsInternal(
		ctx,
		apiKey,
		workspace,
		buildReq,
		func(action policy.Action, object rbac.Objecter) bool {
		return api.Authorize(r, action, object)
		},
		audit.WorkspaceBuildBaggageFromRequest(r),
		)
		if err != nil {
		httperror.WriteWorkspaceBuildError(ctx, rw, err)
		return
		}
		}

		data, err := api.workspaceData(ctx, []database.Workspace{workspace})
		_, err := api.Database.DeleteTask(ctx, database.DeleteTaskParams{
		ID: task.ID,
		DeletedAt: dbtime.Time(now),
		})
		if err != nil {
		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
		Message: "Internal error fetching workspace resources.",
		Message: "Failed to delete task",
		Detail: err.Error(),
		})
		return
		}
		if len(data.builds) == 0 \|\| len(data.templates) == 0 {
		httpapi.ResourceNotFound(rw)
		return
		}
		if data.builds[0].HasAITask == nil \|\| !*data.builds[0].HasAITask {
		httpapi.ResourceNotFound(rw)
		return
		}

		// Construct a request to the workspace build creation handler to
		// initiate deletion.
		buildReq := codersdk.CreateWorkspaceBuildRequest{
		Transition: codersdk.WorkspaceTransitionDelete,
		Reason: "Deleted via tasks API",
		}

		_, err = api.postWorkspaceBuildsInternal(
		ctx,
		apiKey,
		workspace,
		buildReq,
		func(action policy.Action, object rbac.Objecter) bool {
		return api.Authorize(r, action, object)
		},
		audit.WorkspaceBuildBaggageFromRequest(r),
		)
		if err != nil {
		httperror.WriteWorkspaceBuildError(ctx, rw, err)
		return
		}

		//Delete build created successfully.
		//Task deleted and delete build created successfully.
		rw.WriteHeader(http.StatusAccepted)
		}

Expand All		@@ -796,10 +784,10 @@ func (api API) taskDelete(rw http.ResponseWriter, r http.Request) {
		// @Security CoderSessionToken
		// @Tags Experimental
		// @Param user path string true "Username, user ID, or 'me' for the authenticated user"
		// @Paramid path string true "Task ID" format(uuid)
		// @Paramtask path string true "Task ID" format(uuid)
		// @Param request body codersdk.TaskSendRequest true "Task input request"
		// @Success 204 "Input sent successfully"
		// @Router /api/experimental/tasks/{user}/{id}/send [post]
		// @Router /api/experimental/tasks/{user}/{task}/send [post]
		//
		// EXPERIMENTAL: This endpoint is experimental and not guaranteed to be stable.
		// taskSend submits task input to the tasks sidebar app by dialing the agent
Expand All		@@ -808,7 +796,7 @@ func (api API) taskDelete(rw http.ResponseWriter, r http.Request) {
		func (api API) taskSend(rw http.ResponseWriter, r http.Request) {
		ctx := r.Context()

		idStr := chi.URLParam(r, "id")
		idStr := chi.URLParam(r, "task")
		taskID, err := uuid.Parse(idStr)
		if err != nil {
		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
Expand DownExpand Up		@@ -878,17 +866,17 @@ func (api API) taskSend(rw http.ResponseWriter, r http.Request) {
		// @Security CoderSessionToken
		// @Tags Experimental
		// @Param user path string true "Username, user ID, or 'me' for the authenticated user"
		// @Paramid path string true "Task ID" format(uuid)
		// @Paramtask path string true "Task ID" format(uuid)
		// @Success 200 {object} codersdk.TaskLogsResponse
		// @Router /api/experimental/tasks/{user}/{id}/logs [get]
		// @Router /api/experimental/tasks/{user}/{task}/logs [get]
		//
		// EXPERIMENTAL: This endpoint is experimental and not guaranteed to be stable.
		// taskLogs reads task output by dialing the agent directly over the tailnet.
		// We enforce ApplicationConnect RBAC on the workspace and validate the sidebar app health.
		func (api API) taskLogs(rw http.ResponseWriter, r http.Request) {
		ctx := r.Context()

		idStr := chi.URLParam(r, "id")
		idStr := chi.URLParam(r, "task")
		taskID, err := uuid.Parse(idStr)
		if err != nil {
		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -343,8 +343,6 @@ func TestTasks(t *testing.T) {
		t.Run("Delete", func(t *testing.T) {
		t.Parallel()

		t.Skip("TODO(mafredri): Remove, fixed down-stack!")

		t.Run("OK", func(t *testing.T) {
		t.Parallel()

Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1032,11 +1032,15 @@ func New(options Options) API {

		r.Route("/{user}", func(r chi.Router) {
		r.Use(httpmw.ExtractOrganizationMembersParam(options.Database, api.HTTPAuth.Authorize))
		r.Get("/{id}", api.taskGet)
		r.Delete("/{id}", api.taskDelete)
		r.Post("/{id}/send", api.taskSend)
		r.Get("/{id}/logs", api.taskLogs)
		r.Post("/", api.tasksCreate)

		r.Route("/{task}", func(r chi.Router) {
		r.Use(httpmw.ExtractTaskParam(options.Database))
		r.Get("/", api.taskGet)
		r.Delete("/", api.taskDelete)
		r.Post("/send", api.taskSend)
		r.Get("/logs", api.taskLogs)
		})
		})
		})
		r.Route("/mcp", func(r chi.Router) {
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1798,6 +1798,19 @@ func (q *querier) DeleteTailnetTunnel(ctx context.Context, arg database.DeleteTa
		return q.db.DeleteTailnetTunnel(ctx, arg)
		}

		func (q *querier) DeleteTask(ctx context.Context, arg database.DeleteTaskParams) (database.TaskTable, error) {
		task, err := q.db.GetTaskByID(ctx, arg.ID)
		if err != nil {
		return database.TaskTable{}, err
		}

		if err := q.authorizeContext(ctx, policy.ActionDelete, task.RBACObject()); err != nil {
		return database.TaskTable{}, err
		}

		return q.db.DeleteTask(ctx, arg)
		}

		func (q *querier) DeleteUserSecret(ctx context.Context, id uuid.UUID) error {
		// First get the secret to check ownership
		secret, err := q.GetUserSecret(ctx, id)
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -2362,6 +2362,16 @@ func (s *MethodTestSuite) TestTasks() {
		dbm.EXPECT().GetTaskByID(gomock.Any(), task.ID).Return(task, nil).AnyTimes()
		check.Args(task.ID).Asserts(task, policy.ActionRead).Returns(task)
		}))
		s.Run("DeleteTask", s.Mocked(func(dbm dbmock.MockStore, faker gofakeit.Faker, check *expects) {
		task := testutil.Fake(s.T(), faker, database.Task{})
		arg := database.DeleteTaskParams{
		ID: task.ID,
		DeletedAt: dbtime.Now(),
		}
		dbm.EXPECT().GetTaskByID(gomock.Any(), task.ID).Return(task, nil).AnyTimes()
		dbm.EXPECT().DeleteTask(gomock.Any(), arg).Return(database.TaskTable{}, nil).AnyTimes()
		check.Args(arg).Asserts(task, policy.ActionDelete).Returns(database.TaskTable{})
		}))
		s.Run("InsertTask", s.Mocked(func(dbm dbmock.MockStore, faker gofakeit.Faker, check *expects) {
		tpl := testutil.Fake(s.T(), faker, database.Template{})
		tv := testutil.Fake(s.T(), faker, database.TemplateVersion{
Expand Down