Garrett Delfosse 7fc8a0829a fix(coderd): skip stale agents from prior builds in instance-identity auth (#25443) ...

Fixes the HTTP 409 ambiguity errors that occur during instance-identity
auth when stale workspace agents from prior builds accumulate with the
same `auth_instance_id`.

## Problem

#24325 changed the instance-identity auth path from a `:one` lookup
(which silently picked the newest agent) to a `:many` lookup with
ambiguity rejection. This caused HTTP 409 errors for workspaces whose
EC2/Azure/GCP instances had been through multiple builds, because old
agents from prior builds (sharing the same instance ID) were still
returned by the query.

## Solution

Inside the existing per-candidate loop in `handleAuthInstanceID` (which
already does per-candidate DB calls for resource and job lookups), add a
latest-build check: parse the provisioner job input to get the workspace
build, compare against the latest build for that workspace, and
`continue` past candidates whose build is not current.

1 file changed, no SQL/migration/schema changes.

> Generated by Coder Agents on behalf of @f0ssel

2026-05-18 12:23:47 -04:00

..

agentapi

feat: runtime user secrets injection into workspaces (#24313)

2026-04-17 16:55:24 -06:00

agentmetrics

…

aibridge

feat: add chatgpt support for aibridge proxy (#23826)

2026-03-31 12:54:38 -04:00

aiseats

feat: track ai seat usage (#22682)

2026-03-16 12:36:26 -05:00

apidoc

fix: backport 11 Coder Agents docs PRs to release/2.33 (#25047)

2026-05-07 12:54:47 -05:00

apikey

fix: initialize API key LastUsed to Unix epoch instead of zero time (#22327)

2026-03-02 16:02:01 +01:00

appearance

…

audit

feat: audit user secret create, update, and delete (#24756) (#24849)

2026-04-30 21:01:27 +01:00

autobuild

fix: use "idle timeout" as task auto-pause reason (#22287)

2026-02-24 16:45:56 +00:00

awsidentity

…

azureidentity

fix(coderd/azureidentity): add Azure IMDS G2 chain certificates (#25243) (#25345)

2026-05-14 13:00:33 -07:00

boundaryusage

fix: make boundary usage telemetry collection atomic (#21907)

2026-02-06 09:52:17 -07:00

cachecompress

fix(site): avoid duplicating bin download headers (#22981)

2026-03-13 00:22:55 +11:00

coderdtest

fix: verify PKCS7 signature on Azure instance identity tokens (2.33 cherry-pick) (#25302)

2026-05-13 13:45:37 -04:00

connectionlog

feat: batch connection logs to avoid DB lock contention (#23727)

2026-04-03 15:47:26 -05:00

cryptokeys

…

database

fix(coderd): cut DB fan-out on agent instance-identity auth (backport #24973) (#24982)

2026-05-05 21:54:04 +02:00

devtunnel

chore: remove unnecessary loop variable captures (#22180)

2026-02-19 09:02:19 +00:00

dynamicparameters

refactor: replace sort.Strings with slices.Sort (#23457)

2026-03-23 23:19:23 +02:00

entitlements

feat: add Prometheus metrics for license warnings and errors (#21749)

2026-01-29 13:50:15 +01:00

externalauth

fix(coderd/externalauth): detect concurrent refresh race to prevent cache poisoning (#24228) (#24938)

2026-05-04 14:03:39 -04:00

files

…

gitsshkey

…

healthcheck

fix(coderd/healthcheck/derphealth): avoid data races in DERP report (#24795)

2026-04-28 13:06:45 -07:00

httpapi

fix: prioritize context cancellation in WebSocket sendEvent (#23756)

2026-03-29 20:11:30 -04:00

httpmw

fix(coderd): omit frame-ancestors CSP for embed routes (#24529)

2026-04-20 15:38:52 +02:00

idpsync

test: remove unnecessary dbauthz.AsSystemRestricted calls in tests (#22663)

2026-03-05 20:29:49 +00:00

jobreaper

refactor: extract test helpers in coderd/jobreaper to reduce duplication (#23001)

2026-03-19 21:51:26 +00:00

jwtutils

…

mcp

fix(coderd): enforce ActionSSH in MCP HTTP agent connection path (#24607)

2026-04-22 12:34:17 +02:00

metricscache

…

notifications

feat: chat auto-archive owner digest notifications (#24643)

2026-04-28 08:56:36 +01:00

oauth2provider

fix: redirect OAuth2 authorization page to dashboard (#24499)

2026-04-27 23:26:17 +03:00

oauthpki

…

portsharing

…

pproflabel

chore: add tallyman events for ai seat tracking (#22689)

2026-03-18 09:30:22 -05:00

prebuilds

fix: make prebuild claiming durable and idempotent (#23108)

2026-04-02 23:51:02 +02:00

prometheusmetrics

feat: add coder_build_info metric (#24365)

2026-04-15 12:48:38 +00:00

promoauth

fix!: remove deprecated prometheus metrics (#21788)

2026-01-30 13:30:06 +01:00

provisionerdserver

feat: plumb user secrets through provisioner chain to terraform (#24542)

2026-04-27 08:26:07 -06:00

provisionerkey

…

proxyhealth

…

pubsub

refactor: send raw typed payloads over chat WebSockets (#24148)

2026-04-10 10:47:30 +01:00

rbac

chore: include pgcoordinator schema changes in 2.33 (#24931)

2026-05-04 15:42:34 -05:00

render

…

runtimeconfig

…

schedule

chore: remove unnecessary loop variable captures (#22180)

2026-02-19 09:02:19 +00:00

searchquery

perf: cap count queries and emit native UUID comparisons for audit/connection logs (#23835)

2026-04-07 07:24:53 -07:00

taskname

fix(coderd): strip markdown code fences from Anthropic task name responses (#23024)

2026-03-13 17:35:26 +00:00

telemetry

feat(coderd): add PR status summary to telemetry snapshots (#24379)

2026-04-17 21:56:11 +10:00

testdata

…

tracing

fix: StatusWriter Unwrap and process output error recovery (#23383)

2026-03-20 20:00:55 +00:00

updatecheck

…

usage

chore: add tallyman events for ai seat tracking (#22689)

2026-03-18 09:30:22 -05:00

userpassword

…

util

fix(coderd): actually wire the chat template allowlist into tools (#23626)

2026-03-25 22:15:27 +00:00

webpush

fix: recover web push subscriptions after PWA reinstall (#24720)

2026-04-26 14:49:10 -07:00

workspaceapps

perf(coderd): cheaper chatd org membership checks (#24361)

2026-04-16 00:12:54 +10:00

workspacestats

feat: add Prometheus metrics for chatd subsystem (#24371)

2026-04-15 19:53:10 +01:00

wsbuilder

fix(coderd): auto-update workspace to active template version on chat start (#24424)

2026-04-17 00:16:37 +10:00

wspubsub

feat: add WatchAllWorkspaceBuilds endpoint for autostart scaletests (#22057)

2026-03-13 20:37:41 -07:00

x

chore: remove agents experiment flag and mark feature as beta (#24432) (#25003)

2026-05-07 03:30:35 +10:00

activitybump_test.go

test: add testutil.WaitBuffer and replace time.Sleep in tests (#22922)

2026-03-12 18:07:52 +02:00

aitasks_internal_test.go

…

aitasks_test.go

fix: return 409 Conflict instead of 502 when task agent is busy (#23424)

2026-03-23 09:52:34 +00:00

aitasks.go

fix: return 409 Conflict instead of 502 when task agent is busy (#23424)

2026-03-23 09:52:34 +00:00

apikey_scopes_validation_test.go

…

apikey_test.go

fix: persist session cookie to disk to prevent PWA logout (#23746)

2026-04-01 09:54:59 -04:00

apikey.go

fix: persist session cookie to disk to prevent PWA logout (#23746)

2026-04-01 09:54:59 -04:00

apiroot.go

…

audit_internal_test.go

feat: make database.Chat auditable (#24485)

2026-04-21 11:11:56 +01:00

audit_test.go

…

audit.go

feat: audit user secret create, update, and delete (#24756) (#24849)

2026-04-30 21:01:27 +01:00

authorize_test.go

…

authorize.go

feat: show friendly alert for missing agents-access role (#23831)

2026-03-31 17:26:58 +01:00

client_test.go

…

coderd_internal_test.go

…

coderd_test.go

chore: switch agent gone response from 502 to 404 (#23090)

2026-03-25 09:57:28 -04:00

coderd.go

fix: verify PKCS7 signature on Azure instance identity tokens (2.33 cherry-pick) (#25302)

2026-05-13 13:45:37 -04:00

csp.go

…

debug_test.go

feat(coderd): add consolidated /debug/profile endpoint for pprof collection (#22892)

2026-03-13 14:09:39 +00:00

debug.go

feat(coderd): add consolidated /debug/profile endpoint for pprof collection (#22892)

2026-03-13 14:09:39 +00:00

deployment_test.go

…

deployment.go

…

deprecated.go

…

exp_chats_internal_test.go

feat(coderd): accept parameters in start_workspace tool (#24434)

2026-04-21 11:36:20 +10:00

exp_chats_test.go

chore: remove agents experiment flag and mark feature as beta (#24432) (#25003)

2026-05-07 03:30:35 +10:00

exp_chats.go

fix: backport 11 Coder Agents docs PRs to release/2.33 (#25047)

2026-05-07 12:54:47 -05:00

experiments_test.go

…

experiments.go

…

export_test.go

fix: add preset support to MCP tools (#24694) (#24889)

2026-05-01 16:26:47 +01:00

externalauth_test.go

…

externalauth.go

…

files_test.go

test: share coderdtest instances to stop paying the startup tax 22 times (#23454)

2026-03-23 19:54:43 +00:00

files.go

…

gitsshkey_test.go

…

gitsshkey.go

…

inboxnotifications_internal_test.go

…

inboxnotifications_test.go

…

inboxnotifications.go

feat: chat auto-archive owner digest notifications (#24643)

2026-04-28 08:56:36 +01:00

initscript_test.go

test: share coderdtest instances to stop paying the startup tax 22 times (#23454)

2026-03-23 19:54:43 +00:00

initscript.go

…

insights_internal_test.go

…

insights_test.go

fix(coderd): fix flaky TestGetUserStatusCounts timezone boundary (#22639)

2026-03-04 18:01:56 -08:00

insights.go

fix: user status change chart accommodates DST (#22191)

2026-03-04 12:54:39 +02:00

latencycheck.go

…

mcp_http.go

fix(coderd): enforce ActionSSH in MCP HTTP agent connection path (#24607)

2026-04-22 12:34:17 +02:00

mcp_test.go

chore: remove agents experiment flag and mark feature as beta (#24432) (#25003)

2026-05-07 03:30:35 +10:00

mcp.go

feat: allow approved external MCP tools in root plan mode (#24509)

2026-04-21 12:26:12 +02:00

members_test.go

feat: make service accounts a Premium feature (#24020)

2026-04-07 12:25:32 -06:00

members.go

feat: display the AI add-on column in the UI on the Users and Organization Members tables (#23291)

2026-03-26 10:36:40 +00:00

notifications_test.go

chore: return 404, not 400 if missing or authz deny (#22069)

2026-02-13 08:19:07 -06:00

notifications.go

…

oauth2_error_compliance_test.go

test: reduce number of coderdtest instances (#23463)

2026-03-25 09:53:06 +00:00

oauth2_metadata_test.go

…

oauth2_metadata_validation_test.go

test: share coderdtest instances in OAuth2 validation tests (#23455)

2026-03-23 21:03:34 +00:00

oauth2_security_test.go

test: reduce number of coderdtest instances (#23463)

2026-03-25 09:53:06 +00:00

oauth2_test.go

fix(coderd): use dbtime.Now() instead of time.Now() in test assertions against DB timestamps (#22685)

2026-03-06 09:14:11 +00:00

oauth2.go

…

organizations_test.go

…

organizations.go

chore(coderd/database): remove deprecated db2sdk.List(Lazy)? methods (#21902)

2026-02-03 17:52:07 +00:00

pagination_test.go

…

pagination.go

…

parameters_test.go

feat: archive modules in size order until limit is hit (#21773)

2026-02-02 09:03:18 -06:00

parameters.go

chore(coderd/database): remove deprecated db2sdk.List(Lazy)? methods (#21902)

2026-02-03 17:52:07 +00:00

presets_test.go

chore: remove unnecessary loop variable captures (#22180)

2026-02-19 09:02:19 +00:00

presets.go

…

provisionerdaemons_test.go

…

provisionerdaemons.go

chore(coderd/database): remove deprecated db2sdk.List(Lazy)? methods (#21902)

2026-02-03 17:52:07 +00:00

provisionerjobs_internal_test.go

…

provisionerjobs_test.go

feat: add workspace build transition to provisioner job list (#24131)

2026-04-10 09:50:11 -05:00

provisionerjobs.go

feat: add workspace build transition to provisioner job list (#24131)

2026-04-10 09:50:11 -05:00

roles_test.go

…

roles.go

feat: migrate agents-access to org-scoped system role for proper chat RBAC (#24438)

2026-04-23 17:59:42 +01:00

scopes_catalog_api_test.go

…

scopes_catalog.go

…

tailnet_test.go

…

tailnet.go

…

templates_test.go

fix(coderd): allow template deletion when only prebuild workspaces remain (#23417)

2026-03-25 09:43:06 +02:00

templates.go

fix(coderd): allow template deletion when only prebuild workspaces remain (#23417)

2026-03-25 09:43:06 +02:00

templateversions_test.go

chore!: remove api.ts unnecessary calls (#22168)

2026-04-23 06:20:35 +10:00

templateversions.go

chore!: remove api.ts unnecessary calls (#22168)

2026-04-23 06:20:35 +10:00

updatecheck_test.go

…

updatecheck.go

…

userauth_test.go

test: reduce number of coderdtest instances (#23463)

2026-03-25 09:53:06 +00:00

userauth.go

refactor: replace sort.Strings with slices.Sort (#23457)

2026-03-23 23:19:23 +02:00

users_test.go

feat: add collapsible thinking blocks with configurable display mode (#24635)

2026-04-24 11:29:08 +00:00

users.go

feat: add collapsible thinking blocks with configurable display mode (#24635)

2026-04-24 11:29:08 +00:00

usersecrets_audit_test.go

feat: audit user secret create, update, and delete (#24756) (#24849)

2026-04-30 21:01:27 +01:00

usersecrets_test.go

feat: add secret value and file path validation (#24269)

2026-04-13 07:24:34 -06:00

usersecrets.go

feat: audit user secret create, update, and delete (#24756) (#24849)

2026-04-30 21:01:27 +01:00

webpush_internal_test.go

fix(coderd): validate webpush subscription endpoints (#24347)

2026-04-15 11:31:43 +02:00

webpush_test.go

fix: recover web push subscriptions after PWA reinstall (#24720)

2026-04-26 14:49:10 -07:00

webpush.go

fix(coderd): validate webpush subscription endpoints (#24347)

2026-04-15 11:31:43 +02:00

workspaceagentportshare_test.go

…

workspaceagentportshare.go

…

workspaceagents_active_chat_internal_test.go

chore: add client_type field to chats and telemetry (#24342)

2026-04-16 23:57:05 +10:00

workspaceagents_chat_context_internal_test.go

feat: add CLI commands for managing chat context from workspaces (#24105)

2026-04-09 16:33:00 +02:00

workspaceagents_chat_context_test.go

chore: add client_type field to chats and telemetry (#24342)

2026-04-16 23:57:05 +10:00

workspaceagents_internal_test.go

fix(coderd): enforce workspace authz on watchChatGit (#24477)

2026-04-20 21:33:35 +10:00

workspaceagents_test.go

fix: mark connecting agents as unhealthy instead of healthy (#24044)

2026-04-09 13:21:28 +05:00

workspaceagents.go

fix: exclude subagent chats from sidebar pagination (#24404)

2026-04-20 13:19:59 +03:00

workspaceagentsrpc_internal_test.go

…

workspaceagentsrpc_test.go

test: add testutil.WaitBuffer and replace time.Sleep in tests (#22922)

2026-03-12 18:07:52 +02:00

workspaceagentsrpc.go

fix: limit calls to GetWorkspaceAgentByID in agentapi (#23015)

2026-03-20 15:42:05 -05:00

workspaceapps_test.go

…

workspaceapps.go

…

workspacebuilds_test.go

feat: add link for viewing raw build logs in workspace and template build jobs (#21727)

2026-02-03 09:45:23 +00:00

workspacebuilds.go

feat: add WatchAllWorkspaceBuilds endpoint for autostart scaletests (#22057)

2026-03-13 20:37:41 -07:00

workspaceproxies_test.go

…

workspaceproxies.go

feat: add MCP server configuration backend for chats (#23227)

2026-03-19 14:07:36 +00:00

workspaceresourceauth_test.go

feat: support multiple agents with shared instance-identity auth (#24325)

2026-04-16 13:59:09 +02:00

workspaceresourceauth.go

fix(coderd): skip stale agents from prior builds in instance-identity auth (#25443)

2026-05-18 12:23:47 -04:00

workspaces_scoped_test.go

chore: add permissions to coder:workspace.* scopes for functionality (#23515)

2026-03-25 13:46:58 -05:00

workspaces_test.go

fix: mark connecting agents as unhealthy instead of healthy (#24044)

2026-04-09 13:21:28 +05:00

workspaces.go

fix: limit calls to GetWorkspaceAgentByID in agentapi (#23015)

2026-03-20 15:42:05 -05:00

workspaceupdates_test.go

…

workspaceupdates.go

…