Kyle Carberry f4a7fa5b95 fix(chatd): block subagents from spawning workspaces (#22603) ...

## Summary

Subagent (child) chats were previously given access to workspace
provisioning tools (`list_templates`, `read_template`,
`create_workspace`), which could lead to uncontrolled resource
consumption. This PR moves those tools behind the same
`!chat.ParentChatID.Valid` gate that already protects the subagent tools
(`spawn_agent`, `wait_agent`, etc.).

## Changes

- **`coderd/chatd/chatd.go`**: Moved `list_templates`, `read_template`,
and `create_workspace` tool registration into the root-chat-only block
alongside subagent tools.
- **`coderd/chatd/chatd_test.go`**: Added
`TestSubagentChatExcludesWorkspaceProvisioningTools` — an E2E test that
spawns a subagent via a root chat and verifies the subagent's LLM call
does not include workspace provisioning or subagent tools.
- **`coderd/chatd/chattest/openai.go`**: Added `Tools` field to
`OpenAIRequest` and supporting `OpenAITool`/`OpenAIToolFunction` types
so tests can inspect which tools are sent to the model.

2026-03-04 15:49:14 +00:00

..

agentapi

feat: add UpdateAppStatus to the workspace agent API (#22219)

2026-02-24 13:26:55 +04:00

agentmetrics

…

aibridge

feat: use coder specific header for aibridge authentication from AI proxy (#21590)

2026-01-21 19:06:19 +00:00

apidoc

fix: user status change chart accommodates DST (#22191)

2026-03-04 12:54:39 +02:00

apikey

fix: initialize API key LastUsed to Unix epoch instead of zero time (#22327)

2026-03-02 16:02:01 +01:00

appearance

…

audit

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

autobuild

fix: use "idle timeout" as task auto-pause reason (#22287)

2026-02-24 16:45:56 +00:00

awsidentity

…

azureidentity

chore: update azure certs (#21265)

2025-12-15 13:44:44 -09:00

boundaryusage

fix: make boundary usage telemetry collection atomic (#21907)

2026-02-06 09:52:17 -07:00

cachecompress

feat: add cachecompress package to compress static files for HTTP (#21915)

2026-02-06 10:12:58 +04:00

chatd

fix(chatd): block subagents from spawning workspaces (#22603)

2026-03-04 15:49:14 +00:00

coderdtest

test: reduce Await* polling interval from 250ms to 25ms (#22536)

2026-03-03 13:48:58 +00:00

connectionlog

fix: avoid connection logging crashes in agent (#20307)

2025-10-16 01:56:43 +11:00

cryptokeys

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

database

fix: user status change chart accommodates DST (#22191)

2026-03-04 12:54:39 +02:00

devtunnel

chore: remove unnecessary loop variable captures (#22180)

2026-02-19 09:02:19 +00:00

dynamicparameters

chore(coderd/database): remove deprecated db2sdk.List(Lazy)? methods (#21902)

2026-02-03 17:52:07 +00:00

entitlements

feat: add Prometheus metrics for license warnings and errors (#21749)

2026-01-29 13:50:15 +01:00

externalauth

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

files

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

gitsshkey

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

healthcheck

chore: improve healthcheck timeout message (#21520)

2026-01-15 16:37:05 +00:00

httpapi

fix(coderd): harden OAuth2 provider security (#22194)

2026-02-23 12:18:44 +01:00

httpmw

chore(db): remove workspace_agent_id from chats table (#22442)

2026-02-28 16:46:51 -05:00

idpsync

chore(coderd/database): remove deprecated db2sdk.List(Lazy)? methods (#21902)

2026-02-03 17:52:07 +00:00

jobreaper

fix: exclude provisioner_state from workspace_build_with_user view (#22159)

2026-02-23 22:46:17 -06:00

jwtutils

…

mcp

fix(coderd): harden OAuth2 provider security (#22194)

2026-02-23 12:18:44 +01:00

metricscache

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

notifications

feat: notify on task auto pause, manual pause and manual resume (#22050)

2026-02-18 16:30:16 +00:00

oauth2provider

fix(coderd): harden OAuth2 provider security (#22194)

2026-02-23 12:18:44 +01:00

oauthpki

fix(coderd): support string type for oidc response's expires_in json property (#20152)

2025-10-15 17:37:37 +00:00

portsharing

…

pproflabel

…

prebuilds

chore: remove unnecessary loop variable captures (#22180)

2026-02-19 09:02:19 +00:00

prometheusmetrics

fix(coderd): add organization_name label to insights Prometheus metrics (#22296)

2026-02-25 08:58:50 +00:00

promoauth

fix!: remove deprecated prometheus metrics (#21788)

2026-01-30 13:30:06 +01:00

provisionerdserver

chore: prematurely refresh oidc token near expiry during workspace build (#22502)

2026-03-03 18:13:00 +00:00

provisionerkey

chore!: ensure consistent secret token generation and hashing (#20388)

2025-10-23 15:38:49 -05:00

proxyhealth

…

pubsub

feat: add diff_status_change event to /chats/watch pubsub stream (#22419)

2026-02-27 18:06:54 -05:00

rbac

test(coderd/rbac): parallelize TestRolePermissions subtests (#22259)

2026-03-04 12:47:39 +00:00

render

…

runtimeconfig

…

schedule

chore: remove unnecessary loop variable captures (#22180)

2026-02-19 09:02:19 +00:00

searchquery

feat: add AI Bridge request logs model filter (#22230)

2026-02-26 02:40:45 +11:00

taskname

fix(stringutil): operate on runes instead of bytes in Truncate (#22388)

2026-02-27 17:46:37 +00:00

telemetry

feat: add telemetry for task lifecycle events (#21922)

2026-02-24 17:04:42 +00:00

testdata

feat: add flag to disable template insights (#20940)

2025-12-14 03:00:03 +00:00

tracing

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

updatecheck

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

usage

chore: add unknown usage event type error (#19436)

2025-08-22 16:32:35 +10:00

userpassword

…

util

fix(stringutil): operate on runes instead of bytes in Truncate (#22388)

2026-02-27 17:46:37 +00:00

webpush

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

workspaceapps

fix: allow sharing ports >9999 (#22273)

2026-02-24 23:46:43 -06:00

workspacestats

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

wsbuilder

fix: mark presets as validation_failed to prevent endless prebuild retries (#22085)

2026-02-27 14:26:48 +00:00

wspubsub

…

activitybump_test.go

chore: distinct operations for provisioner's 'parse', 'init', 'plan', 'apply', 'graph' (#21064)

2025-12-15 11:26:41 -06:00

aitasks_internal_test.go

fix: set codersdk.Task current_state during task initialization (#20692)

2025-11-17 13:24:12 +00:00

aitasks_test.go

test(coderd): remove provisioner daemon from SendToNonActiveStates test (#22298)

2026-02-25 13:14:32 +02:00

aitasks.go

fix: register task pause/resume routes under /api/v2 (#22544)

2026-03-03 16:34:33 +03:00

apikey_scopes_validation_test.go

feat: add multi-scope support to API keys (#19917)

2025-09-26 11:56:34 +02:00

apikey_test.go

feat(coderd): filter expired API tokens server-side (#22263)

2026-02-24 15:27:03 +00:00

apikey.go

feat(coderd): filter expired API tokens server-side (#22263)

2026-02-24 15:27:03 +00:00

apiroot.go

…

audit_internal_test.go

…

audit_test.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

audit.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

authorize_test.go

feat: add an organization member permission level (#19953)

2025-10-27 17:14:16 -06:00

authorize.go

feat: add experimental agents support (#22290)

2026-02-27 16:50:56 +00:00

chats_test.go

feat(agents): add unarchive agent support (#22579)

2026-03-04 14:08:12 +00:00

chats.go

fix: add archived query parameter to chat list endpoint (#22562)

2026-03-03 20:39:19 +00:00

client_test.go

…

coderd_internal_test.go

…

coderd_test.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

coderd.go

fix: register task pause/resume routes under /api/v2 (#22544)

2026-03-03 16:34:33 +03:00

csp.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

debug_test.go

chore: improve healthcheck timeout message (#21520)

2026-01-15 16:37:05 +00:00

debug.go

chore: improve healthcheck timeout message (#21520)

2026-01-15 16:37:05 +00:00

deployment_test.go

…

deployment.go

…

deprecated.go

…

experiments_test.go

…

experiments.go

…

externalauth_test.go

feat(coderd/rbac): make organization-member a per-org system custom role (#21359)

2026-01-12 18:19:19 -08:00

externalauth.go

feat!: support PKCE in the oauth2 client's auth/exchange flow (#21215)

2025-12-15 17:41:47 +00:00

files_test.go

ci: improve 'tfail in goroutine' ruleguard rule (#19682)

2025-09-04 14:28:29 +10:00

files.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

gitsshkey_test.go

chore: distinct operations for provisioner's 'parse', 'init', 'plan', 'apply', 'graph' (#21064)

2025-12-15 11:26:41 -06:00

gitsshkey.go

…

inboxnotifications_internal_test.go

…

inboxnotifications_test.go

…

inboxnotifications.go

fix(coderd): ensure inbox WebSocket is closed when client disconnects (#21652)

2026-01-26 09:24:45 +00:00

initscript_test.go

…

initscript.go

…

insights_internal_test.go

…

insights_test.go

fix: user status change chart accommodates DST (#22191)

2026-03-04 12:54:39 +02:00

insights.go

fix: user status change chart accommodates DST (#22191)

2026-03-04 12:54:39 +02:00

latencycheck.go

…

mcp_http.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

members_test.go

feat: add endpoint to fetch singular org member (#21732)

2026-02-03 12:48:25 -06:00

members.go

feat: add endpoint to fetch singular org member (#21732)

2026-02-03 12:48:25 -06:00

notifications_test.go

chore: return 404, not 400 if missing or authz deny (#22069)

2026-02-13 08:19:07 -06:00

notifications.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

oauth2_error_compliance_test.go

refactor: add RFC-compliant enum types and use SDK as source of truth (#21468)

2026-01-15 12:41:28 +03:00

oauth2_metadata_test.go

refactor: add RFC-compliant enum types and use SDK as source of truth (#21468)

2026-01-15 12:41:28 +03:00

oauth2_metadata_validation_test.go

refactor: add RFC-compliant enum types and use SDK as source of truth (#21468)

2026-01-15 12:41:28 +03:00

oauth2_security_test.go

…

oauth2_test.go

fix(coderd): harden OAuth2 provider security (#22194)

2026-02-23 12:18:44 +01:00

oauth2.go

feat: implement oauth2 RFC 7009 token revocation endpoint (#20362)

2025-10-22 15:18:42 -05:00

organizations_test.go

…

organizations.go

chore(coderd/database): remove deprecated db2sdk.List(Lazy)? methods (#21902)

2026-02-03 17:52:07 +00:00

pagination_test.go

…

pagination.go

…

parameters_test.go

feat: archive modules in size order until limit is hit (#21773)

2026-02-02 09:03:18 -06:00

parameters.go

chore(coderd/database): remove deprecated db2sdk.List(Lazy)? methods (#21902)

2026-02-03 17:52:07 +00:00

presets_test.go

chore: remove unnecessary loop variable captures (#22180)

2026-02-19 09:02:19 +00:00

presets.go

…

provisionerdaemons_test.go

feat: add filtering options to provisioners list (#19378)

2025-08-21 16:03:34 -04:00

provisionerdaemons.go

chore(coderd/database): remove deprecated db2sdk.List(Lazy)? methods (#21902)

2026-02-03 17:52:07 +00:00

provisionerjobs_internal_test.go

…

provisionerjobs_test.go

test: reduce unnecessary sleep durations in tests (#22552)

2026-03-03 10:19:00 -05:00

provisionerjobs.go

chore(coderd/database): remove deprecated db2sdk.List(Lazy)? methods (#21902)

2026-02-03 17:52:07 +00:00

roles_test.go

…

roles.go

feat(coderd/rbac): make organization-member a per-org system custom role (#21359)

2026-01-12 18:19:19 -08:00

scopes_catalog_api_test.go

feat: add external API key scopes (#19916)

2025-09-26 11:43:32 +02:00

scopes_catalog.go

feat: add external API key scopes (#19916)

2025-09-26 11:43:32 +02:00

tailnet_test.go

…

tailnet.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

templates_test.go

fix: hide "Create Workspace" button for deleted templates (#22092)

2026-02-13 19:44:50 -05:00

templates.go

fix: hide "Create Workspace" button for deleted templates (#22092)

2026-02-13 19:44:50 -05:00

templateversions_test.go

feat: validate prebuild presets using dynamic parameter validation (#21858)

2026-03-03 16:50:18 +00:00

templateversions.go

feat: validate prebuild presets using dynamic parameter validation (#21858)

2026-03-03 16:50:18 +00:00

updatecheck_test.go

…

updatecheck.go

…

userauth_test.go

chore: optionally prefix authentication related cookies (#22148)

2026-02-20 09:01:00 -06:00

userauth.go

chore: optionally prefix authentication related cookies (#22148)

2026-02-20 09:01:00 -06:00

users_test.go

chore: return 404, not 400 if missing or authz deny (#22069)

2026-02-13 08:19:07 -06:00

users.go

chore(coderd/database): remove deprecated db2sdk.List(Lazy)? methods (#21902)

2026-02-03 17:52:07 +00:00

webpush_test.go

refactor(webpush): use RequireExperimentWithDevBypass middleware (#22525)

2026-03-03 09:49:04 +00:00

webpush.go

refactor(webpush): use RequireExperimentWithDevBypass middleware (#22525)

2026-03-03 09:49:04 +00:00

workspaceagentportshare_test.go

feat(coderd/rbac): make organization-member a per-org system custom role (#21359)

2026-01-12 18:19:19 -08:00

workspaceagentportshare.go

…

workspaceagents_internal_test.go

perf: reduce number of queries made by /api/v2/workspaceagents/{id} (#21522)

2026-01-19 12:36:33 +00:00

workspaceagents_test.go

fix: use time.Equal() for external auth token expiry comparison (#22295)

2026-02-25 08:45:00 -07:00

workspaceagents.go

fix: scope git askpass diff status updates to initiating chat (#22534)

2026-03-02 22:52:39 -05:00

workspaceagentsrpc_internal_test.go

test: use not before in TestAgentConnectionMonitor_* (#21332)

2025-12-22 10:21:39 +04:00

workspaceagentsrpc_test.go

fix(coderd): add role param to agent RPC to prevent false connectivity (#22052)

2026-02-18 09:44:06 +01:00

workspaceagentsrpc.go

fix(coderd): add role param to agent RPC to prevent false connectivity (#22052)

2026-02-18 09:44:06 +01:00

workspaceapps_test.go

…

workspaceapps.go

feat: add multi-scope support to API keys (#19917)

2025-09-26 11:56:34 +02:00

workspacebuilds_test.go

feat: add link for viewing raw build logs in workspace and template build jobs (#21727)

2026-02-03 09:45:23 +00:00

workspacebuilds.go

fix: exclude provisioner_state from workspace_build_with_user view (#22159)

2026-02-23 22:46:17 -06:00

workspaceproxies_test.go

…

workspaceproxies.go

…

workspaceresourceauth_test.go

chore: distinct operations for provisioner's 'parse', 'init', 'plan', 'apply', 'graph' (#21064)

2025-12-15 11:26:41 -06:00

workspaceresourceauth.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

workspaces_test.go

fix: disable sharing ui when sharing is unavailable (#22390)

2026-03-03 02:04:55 +00:00

workspaces.go

feat: add experimental agents support (#22290)

2026-02-27 16:50:56 +00:00

workspaceupdates_test.go

…

workspaceupdates.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00