feat(claude-code): add boundary log socket configuration

- Add CODER_AGENT_BOUNDARY_LOG_SOCKET env var for agent
- Add boundary_log_socket_path variable (default: /tmp/coder-boundary-audit.sock)
- Update start.sh to pass --audit-socket to boundary when env var is set

This enables boundary audit log forwarding to coderd when boundary is enabled.

registry/coder/modules/agentapi/test-util.ts

@@ -4,35 +4,11 @@ import {
   removeContainer,
   runContainer,
   runTerraformApply,
-  TerraformState,
   writeFileContainer,
 } from "~test";
 import path from "path";
 import { expect } from "bun:test";
 
-/**
- * Extracts all coder_env resources from Terraform state and returns them as
- * a Record of environment variable names to values.
- */
-export const extractCoderEnvVars = (
-  state: TerraformState,
-): Record<string, string> => {
-  const envVars: Record<string, string> = {};
-
-  for (const resource of state.resources) {
-    if (resource.type === "coder_env" && resource.instances.length > 0) {
-      const instance = resource.instances[0].attributes;
-      const name = instance.name as string;
-      const value = instance.value as string;
-      if (name && value) {
-        envVars[name] = value;
-      }
-    }
-  }
-
-  return envVars;
-};
-
 export const setupContainer = async ({
   moduleDir,
   image,
@@ -47,12 +23,10 @@ export const setupContainer = async ({
     ...vars,
   });
   const coderScript = findResourceInstance(state, "coder_script");
-  const coderEnvVars = extractCoderEnvVars(state);
   const id = await runContainer(image ?? "codercom/enterprise-node:latest");
   return {
     id,
     coderScript,
-    coderEnvVars,
     cleanup: async () => {
       if (
         process.env["DEBUG"] === "true" ||
@@ -105,11 +79,9 @@ interface SetupProps {
   agentapiMockScript?: string;
 }
 
-export const setup = async (
-  props: SetupProps,
-): Promise<{ id: string; coderEnvVars: Record<string, string> }> => {
+export const setup = async (props: SetupProps): Promise<{ id: string }> => {
   const projectDir = props.projectDir ?? "/home/coder/project";
-  const { id, coderScript, coderEnvVars, cleanup } = await setupContainer({
+  const { id, coderScript, cleanup } = await setupContainer({
     moduleDir: props.moduleDir,
     vars: props.moduleVariables,
   });
@@ -129,7 +101,7 @@ export const setup = async (
     filePath: "/home/coder/script.sh",
     content: coderScript.script,
   });
-  return { id, coderEnvVars };
+  return { id };
 };
 
 export const expectAgentAPIStarted = async (
@@ -153,16 +125,18 @@ export const execModuleScript = async (
   id: string,
   env?: Record<string, string>,
 ) => {
-  const envArgs = env
-    ? Object.entries(env)
-        .map(([key, value]) => `export ${key}="${value.replace(/"/g, '\\"')}"`)
-        .join(" && ") + " && "
-    : "";
-  const resp = await execContainer(id, [
-    "bash",
-    "-c",
-    `${envArgs}set -o errexit; set -o pipefail; cd /home/coder && ./script.sh 2>&1 | tee /home/coder/script.log`,
-  ]);
+  const envArgs = Object.entries(env ?? {})
+    .map(([key, value]) => ["--env", `${key}=${value}`])
+    .flat();
+  const resp = await execContainer(
+    id,
+    [
+      "bash",
+      "-c",
+      `set -o errexit; set -o pipefail; cd /home/coder && ./script.sh 2>&1 | tee /home/coder/script.log`,
+    ],
+    envArgs,
+  );
   if (resp.exitCode !== 0) {
     console.log(resp.stdout);
     console.log(resp.stderr);

registry/coder/modules/claude-code/main.tf

@@ -252,6 +252,12 @@ variable "compile_boundary_from_source" {
   default     = false
 }
 
+variable "boundary_log_socket_path" {
+  type        = string
+  description = "Path to the Unix socket for boundary audit logs. Both the agent and boundary use this path."
+  default     = "/tmp/coder-boundary-audit.sock"
+}
+
 resource "coder_env" "claude_code_md_path" {
   count = var.claude_md_path == "" ? 0 : 1
 
@@ -288,6 +294,14 @@ resource "coder_env" "disable_autoupdater" {
   value    = "1"
 }
 
+resource "coder_env" "boundary_log_socket" {
+  count = var.enable_boundary ? 1 : 0
+
+  agent_id = var.agent_id
+  name     = "CODER_BOUNDARY_LOG_SOCKET"
+  value    = var.boundary_log_socket_path
+}
+
 locals {
   # we have to trim the slash because otherwise coder exp mcp will
   # set up an invalid claude config

registry/coder/modules/claude-code/scripts/start.sh

@@ -249,6 +249,11 @@ function start_agentapi() {
     # Set HTTP Proxy port used by Boundary
     BOUNDARY_ARGS+=(--proxy-port "$ARG_BOUNDARY_PROXY_PORT")
 
+    # Pass audit socket path if CODER_AGENT_BOUNDARY_LOG_SOCKET is set
+    if [ -n "$CODER_AGENT_BOUNDARY_LOG_SOCKET" ]; then
+      BOUNDARY_ARGS+=(--audit-socket "$CODER_AGENT_BOUNDARY_LOG_SOCKET")
+    fi
+
     # Set log level for boundary
     BOUNDARY_ARGS+=(--log-level "$ARG_BOUNDARY_LOG_LEVEL")
 

registry/coder/modules/git-clone/README.md

@@ -14,7 +14,7 @@ This module allows you to automatically clone a repository by URL and skip if it
 module "git-clone" {
   count    = data.coder_workspace.me.start_count
   source   = "registry.coder.com/coder/git-clone/coder"
-  version  = "1.2.3"
+  version  = "1.2.2"
   agent_id = coder_agent.example.id
   url      = "https://github.com/coder/coder"
 }
@@ -28,7 +28,7 @@ module "git-clone" {
 module "git-clone" {
   count    = data.coder_workspace.me.start_count
   source   = "registry.coder.com/coder/git-clone/coder"
-  version  = "1.2.3"
+  version  = "1.2.2"
   agent_id = coder_agent.example.id
   url      = "https://github.com/coder/coder"
   base_dir = "~/projects/coder"
@@ -43,12 +43,11 @@ To use with [Git Authentication](https://coder.com/docs/v2/latest/admin/git-prov
 module "git-clone" {
   count    = data.coder_workspace.me.start_count
   source   = "registry.coder.com/coder/git-clone/coder"
-  version  = "1.2.3"
+  version  = "1.2.2"
   agent_id = coder_agent.example.id
   url      = "https://github.com/coder/coder"
 }
 
-
 data "coder_external_auth" "github" {
   id = "github"
 }
@@ -70,12 +69,11 @@ data "coder_parameter" "git_repo" {
 module "git_clone" {
   count    = data.coder_workspace.me.start_count
   source   = "registry.coder.com/coder/git-clone/coder"
-  version  = "1.2.3"
+  version  = "1.2.2"
   agent_id = coder_agent.example.id
   url      = data.coder_parameter.git_repo.value
 }
 
-
 # Create a code-server instance for the cloned repository
 module "code-server" {
   count    = data.coder_workspace.me.start_count
@@ -105,14 +103,13 @@ Configuring `git-clone` for a self-hosted GitHub Enterprise Server running at `g
 module "git-clone" {
   count    = data.coder_workspace.me.start_count
   source   = "registry.coder.com/coder/git-clone/coder"
-  version  = "1.2.3"
+  version  = "1.2.2"
   agent_id = coder_agent.example.id
   url      = "https://github.example.com/coder/coder/tree/feat/example"
   git_providers = {
     "https://github.example.com/" = {
       provider = "github"
     }
-
   }
 }
 ```
@@ -125,7 +122,7 @@ To GitLab clone with a specific branch like `feat/example`
 module "git-clone" {
   count    = data.coder_workspace.me.start_count
   source   = "registry.coder.com/coder/git-clone/coder"
-  version  = "1.2.3"
+  version  = "1.2.2"
   agent_id = coder_agent.example.id
   url      = "https://gitlab.com/coder/coder/-/tree/feat/example"
 }
@@ -137,14 +134,13 @@ Configuring `git-clone` for a self-hosted GitLab running at `gitlab.example.com`
 module "git-clone" {
   count    = data.coder_workspace.me.start_count
   source   = "registry.coder.com/coder/git-clone/coder"
-  version  = "1.2.3"
+  version  = "1.2.2"
   agent_id = coder_agent.example.id
   url      = "https://gitlab.example.com/coder/coder/-/tree/feat/example"
   git_providers = {
     "https://gitlab.example.com/" = {
       provider = "gitlab"
     }
-
   }
 }
 ```
@@ -159,7 +155,7 @@ For example, to clone the `feat/example` branch:
 module "git-clone" {
   count       = data.coder_workspace.me.start_count
   source      = "registry.coder.com/coder/git-clone/coder"
-  version     = "1.2.3"
+  version     = "1.2.2"
   agent_id    = coder_agent.example.id
   url         = "https://github.com/coder/coder"
   branch_name = "feat/example"
@@ -177,7 +173,7 @@ For example, this will clone into the `~/projects/coder/coder-dev` folder:
 module "git-clone" {
   count       = data.coder_workspace.me.start_count
   source      = "registry.coder.com/coder/git-clone/coder"
-  version     = "1.2.3"
+  version     = "1.2.2"
   agent_id    = coder_agent.example.id
   url         = "https://github.com/coder/coder"
   folder_name = "coder-dev"
@@ -195,8 +191,8 @@ If not defined, the default, `0`, performs a full clone.
 ```tf
 module "git-clone" {
   count    = data.coder_workspace.me.start_count
-  source   = "registry.coder.com/coder/git-clone/coder"
-  version  = "1.2.3"
+  source   = "registry.coder.com/modules/git-clone/coder"
+  version  = "1.2.2"
   agent_id = coder_agent.example.id
   url      = "https://github.com/coder/coder"
   depth    = 1
@@ -212,7 +208,7 @@ This is useful for running initialization tasks like installing dependencies or
 module "git-clone" {
   count             = data.coder_workspace.me.start_count
   source            = "registry.coder.com/coder/git-clone/coder"
-  version           = "1.2.3"
+  version           = "1.2.2"
   agent_id          = coder_agent.example.id
   url               = "https://github.com/coder/coder"
   post_clone_script = <<-EOT

registry/coder/modules/git-clone/run.sh

@@ -58,10 +58,9 @@ fi
 # Run post-clone script if provided
 if [ -n "$POST_CLONE_SCRIPT" ]; then
   echo "Running post-clone script..."
-  POST_CLONE_TMP=$(mktemp)
-  echo "$POST_CLONE_SCRIPT" | base64 -d > "$POST_CLONE_TMP"
-  chmod +x "$POST_CLONE_TMP"
+  echo "$POST_CLONE_SCRIPT" | base64 -d > /tmp/post_clone.sh
+  chmod +x /tmp/post_clone.sh
   cd "$CLONE_PATH" || exit
-  $POST_CLONE_TMP
-  rm "$POST_CLONE_TMP"
+  /tmp/post_clone.sh
+  rm /tmp/post_clone.sh
 fi

registry/coder/modules/zed/README.md

@@ -19,7 +19,7 @@ Zed is a high-performance, multiplayer code editor from the creators of Atom and
 module "zed" {
   count    = data.coder_workspace.me.start_count
   source   = "registry.coder.com/coder/zed/coder"
-  version  = "1.1.3"
+  version  = "1.1.2"
   agent_id = coder_agent.main.id
 }
 ```
@@ -32,7 +32,7 @@ module "zed" {
 module "zed" {
   count    = data.coder_workspace.me.start_count
   source   = "registry.coder.com/coder/zed/coder"
-  version  = "1.1.3"
+  version  = "1.1.2"
   agent_id = coder_agent.main.id
   folder   = "/home/coder/project"
 }
@@ -44,7 +44,7 @@ module "zed" {
 module "zed" {
   count        = data.coder_workspace.me.start_count
   source       = "registry.coder.com/coder/zed/coder"
-  version      = "1.1.3"
+  version      = "1.1.2"
   agent_id     = coder_agent.main.id
   display_name = "Zed Editor"
   order        = 1
@@ -57,7 +57,7 @@ module "zed" {
 module "zed" {
   count      = data.coder_workspace.me.start_count
   source     = "registry.coder.com/coder/zed/coder"
-  version    = "1.1.3"
+  version    = "1.1.2"
   agent_id   = coder_agent.main.id
   agent_name = coder_agent.example.name
 }
@@ -73,7 +73,7 @@ You can declaratively set/merge settings with the `settings` input. Provide a JS
 module "zed" {
   count    = data.coder_workspace.me.start_count
   source   = "registry.coder.com/coder/zed/coder"
-  version  = "1.1.3"
+  version  = "1.1.2"
   agent_id = coder_agent.main.id
 
   settings = jsonencode({

registry/coder/modules/zed/main.tf

@@ -73,7 +73,7 @@ resource "coder_script" "zed_settings" {
   icon         = "/icon/zed.svg"
   run_on_start = true
   script       = <<-EOT
-    #!/usr/bin/env bash
+    #!/bin/sh
     set -eu
     SETTINGS_JSON='${replace(var.settings, "\"", "\\\"")}'
     if [ -z "$${SETTINGS_JSON}" ] || [ "$${SETTINGS_JSON}" = "{}" ]; then