helm/coder-v2/coder 2.39.0

v2.39.0

on Artifact Hub

Changelog

BREAKING CHANGES

• chore!: remove the chat automations experiment (#30412, f923f4a) (@ThomasK33)
• chore!: remove the coder_report_task MCP tool (#30742, 69fab7d) (@app/coder)
• chore!: remove the deprecated advisor config request fields (#30982, 71cd5e6) (@ibetitsmike)
• feat!: confirm role changes in coder users edit-roles (#30140, cf60604) (@nickvigilante)
• feat!: confirm before coder update restarts a running workspace (#30150, b6aab35) (@nickvigilante)
• feat!: add output formats to coder schedule start, stop, and extend (#30136, a8303a8) (@nickvigilante)
• feat!: report template insights session usage per app (#29796, f4cd0de) (@EhabY)
• feat!: label the VS Code family and report built-in app usage per app (#29906, 2819221) (@EhabY)
• fix(cli)!: match the exact workspace in coder schedule show (#30153, 41e698e) (@nickvigilante)
• fix(coderd/x/chatd/chattool)!: fail closed when the plan path cannot be resolved (#30983, 70b1e47) (@ibetitsmike)
• fix!: make --yes skip the rename confirmation prompt (#30151, 237616a) (@nickvigilante)
• fix!: remove the unused --yes flag from coder autoupdate (#30149, 98bcc3a) (@nickvigilante)
• fix!: validate workspace app URLs on the server (#31262, 8b0c0cc) (@EhabY)
• refactor!: drop edit_files search/replace wire compat (#29221, cc76b62) (@mafredri)

SECURITY

• Server: Group sync may only add users to groups of the syncing org (#30706, 296da93) (@eric-hughes-coder)

Features

• Add Claude Sonnet 5.5 and GPT-6.1 Sol to Agents and AI Gateway (#30159, 1e9dd0a) (@ibetitsmike)
• Run chat tool calls once per tool call ID on the agent (#29946, 1ba09d2) (@mafredri)
• Send tool call IDs and cancel unresolved calls on interrupt (#29954, fa5bac6) (@mafredri)
• Provisioner: Build script order graphs (#29925, 2caa212) (@geokat)
• Add JSON output to coder licenses add and delete (#30137, fd41ca6) (@nickvigilante)
• Add JSON output to coder server create-admin-user (#30138, 302edff) (@nickvigilante)
• Add --yes to coder users suspend and activate (#30155, dde500a) (@nickvigilante)
• Add --column to coder users show (#30143, e6774c2) (@nickvigilante)
• Show coder workspace-proxy in CLI help and reference docs (#30146, 3baeace) (@nickvigilante)
• Add chatd lifecycle stage tracer (#29769, 7a94420) (@jscottmiller)
• Open a chat_turn span per prompt (#29771, fc0af7f)
• Trace chatd provider stages and count only output parts as first token (#29770, e988ddb)
• Show coder sharing in CLI help and reference docs (#30141, 0d12256) (@nickvigilante)
• Server: Key chat diff statuses by ref (#29081, 63a95d8) (@DanielleMaywood)
• Add chat projects API (#29242, 7cd1b20) (@f0ssel)
• Validate documented experiment keys (DOCS-139) (#29316, 149366a) (@nickvigilante)
• Add generated API key scopes reference (DOCS-135) (#29307, 4a184ca) (@nickvigilante)
• Dashboard: Add Pi coding agent icon (#29687, b5b5887) (@nickvigilante)
• Add type and secret status to the configuration reference (DOCS-896) (#29310, 2e0f97e) (@nickvigilante)
• Dashboard: Upload personal skill files (#30170, c94a98a) (@jakehwll)
• Preserve user-supplied chat titles (#29486, ff158c0) (@mafredri)
• Report port-forward sessions as app usage (#30156, 1ad46e4) (@nickvigilante)
• Add chat automations schema, RBAC resource, and audit entries (#30085, f55aa6c) (@ThomasK33)
• Add chat automations management API behind chat-automations (#30112, 9316d67)
• Server: Add chatd automation admission seam and queue promotion guard (#30096, eaca229)
• Disable, re-enable, and rotate chat automations with schedule preview (#30117, 5c1662e)
• Server: Create a chat for each webhook event of a new_chat automation (#30134, 1e1e884)
• Deliver webhook events to existing chats through chat automations (#30127, b517db4)
• Add Run now for schedule chat automations (#30166, b25f885)
• Server: Run chat automation schedules (#30160, 8620361)
• Add the Agents automations list page and chat-list automation filter (#30171, a3fbd23)
• Label automation messages in agent chats (#30167, b96f1b9)
• Add webhook automations to the automation editor (#30207, a0ef149)
• Dashboard: Add the schedule automation editor (#30187, adcee75)
• Server: Add manage_automations write actions (#30217, 20ff7f1)
• Add the manage_automations chat tool switch and read actions (#30214, fb0951b)
• Add the manage automations toggle, tool rendering and CODAGT-1217 tests (#30219, a3b6881)
• Add client_session_id to ssh connections (#29701, cc0c868) (@code-asher)
• Dashboard: Preview thinking text in header when no heading exists (#30253, 5c9d9db) (@ibetitsmike)
• Align MCP workspace tools with Coder Agents and add execute tools (#30275, 98332c7) (@kylecarbs)
• Add shared project memory API for chats in a project (#29301, a08ba6a) (@f0ssel)
• Wire AI Gateway proxy routing and recorder dependencies (#29725, 7cfc38d) (@pawbana)
• Helm: add singleStackIPv6 to accomodate IPv6 only clusters (#27405, fd33879) (@rowansmithau)
• Expose per-ref diff statuses (#29082, 49b1a2c) (@DanielleMaywood)
• Add organization-scoped Coder Agents instructions (#30272, 7993c73) (@ibetitsmike)
• Dashboard: Fetch and merge diff statuses per ref (#29543, 8f1fc53) (@DanielleMaywood)
• Dashboard: Add the chat projects data layer and project dialog (#30377, 10986ad) (@f0ssel)
• Lock the new-chat form to a project's organization (#30378, 145bf77) (@f0ssel)
• Dashboard: Add the chat project page (#30379, 036e080) (@f0ssel)
• Add chat project folders to the sidebar (#29583, ee63db3) (@f0ssel)
• Dashboard: Choose an organization when creating a project (#30181, c28dc3c) (@jaaydenh)
• Dashboard: Keep project chat list caches in sync (#30292, f32d0b1) (@jaaydenh)
• Dashboard: Redesign the project page header (#30293, 8d50b9d) (@jaaydenh)
• Match PR number prefixes in chat search (#30404, e468234) (@ibetitsmike)
• Remove model_intent from the execute, process_output, and advisor tools (#30397, 67a781c) (@ibetitsmike)
• Dashboard: Add a copy submenu to agent chat menus (#30016, 0829748) (@jakehwll)
• Dashboard: List project chats on the project page (#30294, a531ba3) (@jaaydenh)
• Dashboard: Group assistant steps into working blocks (#29417, 1910ae4) (@ibetitsmike)
• Dashboard: Add the working block disclosure (#29418, 682d4fd) (@ibetitsmike)
• Dashboard: Fold assistant steps in the conversation timeline (#29419, 045cdc9) (@ibetitsmike)
• Dashboard: Add the collapse assistant steps chat preference (#29115, a26d5c1) (@ibetitsmike)
• Server: Evaluate read_template parameters for the chat owner (#29561, 28fe61f) (@ibetitsmike)
• feat(.agents/skills/deploy-ephemeral): add deploy-ephemeral skill (#30440, 431f8c9) (@ibetitsmike)
• Validate AI Gateway actor and credentials in proxy mode (#30225, f08bfdd) (@pawbana)
• Allow template version selection for workspace builds (#30199, b4d5101) (@dylanhuff-at-coder)
• Agent: Support outcome-aware dependencies (#30390, c430310) (@BobbyHo)
• Add script resource address and dependencies to Script (#30451, a115896) (@BobbyHo)
• Dashboard: Share org in personal agent model settings (#29122, 29e876d) (@jakehwll)
• Dashboard: Use the app's icon and name on the terminal page opened via ?app= (#30448, 38e9325) (@costajohnt)
• CLI: Add TextFormatFunc and OutputFormatter.WriteLine helpers (#30508, 0efb574) (@nickvigilante)
• Provisioner: Carry script addresses and prepare dependency attachment (#30491, b27e158) (@BobbyHo)
• Dashboard: List every PR in the top bar (#29831, 051eb58)
• Dashboard: Per-ref views in the git panel (#29544, 86013c2) (@DanielleMaywood)
• Dashboard: Count every PR in the chats sidebar (#29832, ff3fa22)
• Load whole chat turns per history page (#30524, 782fb30) (@ibetitsmike)
• Dashboard: Quieter read-only view for other users' chats (#30483, 8697b91) (@tracyjohnsonux)
• Provisioner: Index Terraform graphs (#30277, a2686cd) (@geokat)
• Provisioner: Query Terraform graphs (#30334, 652ae95) (@geokat)
• Trigger compaction independently for the chat and compaction models (#28568, c28ae0d) (@ibetitsmike)
• Separate connection log methods from app names (#30466, 5b060be) (@EhabY)
• Persist script resource addresses and dependencies (#30625, dae7967) (@BobbyHo)
• Dashboard: Show provider type in model form and model list icon tooltip (#30353, 1320c01) (@SasSwart)
• Server: Add chat project instructions storage and prompt injection (#30367, ad85646) (@jaaydenh)
• Add chat project instructions API (#30368, 97c5260) (@jaaydenh)
• Add the organization skills data model (#30609, b67587c) (@ibetitsmike)
• Add organization skill API routes (#30610, db7f5a7) (@ibetitsmike)
• Add organization skill sharing ACL routes (#30611, 2c432a1) (@ibetitsmike)
• Dashboard: Add organization skill settings with a shared skills UI (#30612, 6498c57) (@ibetitsmike)
• Load organization skills in chats (#30613, adcce66) (@ibetitsmike)
• Send RFC 8707 resource parameter on MCP server OAuth2 flows (#30651, fa7cd62) (@ibetitsmike)
• Provisioner: Resolve applied script orders (#30669, 31dd054) (@geokat)
• Provisioner: Integrate script ordering into graph conversion (#30670, 99afdc3) (@geokat)
• Dashboard: Add the project instructions editor dialog (#30369, a46d514) (@jaaydenh)
• Dashboard: Show project instructions in the project page details panel (#30370, 8763780) (@jaaydenh)
• Dashboard: Design improvements for projects page (#30740, 40c0adc) (@jaaydenh)
• Report agent connection methods and app identities (#30467, f573ec3) (@EhabY)
• Dashboard: Move View PR into the git panel toolbar (#30751, 05fa806) (@ibetitsmike)
• Dashboard: Add a project picker to the new chat composer (#30455, 85783e4) (@jaaydenh)
• Add chat project sharing database layer (#30479, 2b9fad8) (@f0ssel)
• Accept template version IDs in --template-version (#30563, c856d5f) (@dylanhuff-at-coder)
• Attach script order dependencies during conversion (#30556, fb09983) (@BobbyHo)
• Send script resource addresses and dependencies in the agent manifest (#30627, ee5e3a4) (@BobbyHo)
• Add Gemini 4 Argon to Agents and AI Gateway (#30780, e7c2fd5) (@ibetitsmike)
• Add ServerTailnet logs and metrics for unreachable agents (#30133, 603dd42) (@BobbyHo)
• Add workspace secrets table, queries, and RBAC (#30248, 7aef110) (@Emyrk)
• Database: Encrypt workspace secrets (#30249, 58a71f6) (@Emyrk)
• Set workspace secrets on workspace builds (#30250, f25b629) (@Emyrk)
• Deliver workspace secrets in the agent manifest (#30251, 7d75210) (@Emyrk)
• Order lifecycle scripts by their dependencies (#30765, 4d1f95e) (@BobbyHo)
• List a workspace build's secrets in coder secret list (#30388, 03cba25) (@Emyrk)
• Add script ordering adoption telemetry (#30860, 6d34557) (@geokat)
• Server: List workspace secrets on workspace build audit entries (#30459, 357e81b) (@Emyrk)
• Dashboard: Add Projects empty state and persist section collapse (#30741, c5bf97b) (@jaaydenh)
• Add byte tracking to ssh and pty connections (#30389, 899d25a) (@code-asher)
• Expose skipped and canceled script outcomes in coderd and the Build Timeline (#30875, 764e67b) (@BobbyHo)
• Report skipped and canceled script outcomes from the agent (#30888, 54274c1) (@BobbyHo)
• Add JSON output to coder ai-gateway keys create (#30139, 93205d9) (@nickvigilante)
• Add project skill queries and authorization (#30826, a379c84) (@jaaydenh)
• Add project skill API routes (#30827, e289c6f) (@jaaydenh)
• Add chat project sharing API (#30439, 6ebefb8) (@f0ssel)
• Move a chat family between projects in chatd (#30893, 0968f97) (@ibetitsmike)
• Move chats between projects through the chat update API (#30894, dfdd6a5) (@ibetitsmike)
• Dashboard: Move chats between projects from the chat menu (#30895, 2cade24) (@ibetitsmike)
• Dashboard: Drag chats onto project folders in the sidebar (#30795, 71435e1) (@ibetitsmike)
• Dashboard: Keep agent attachments in working blocks and list them under Attachments (#30788, 8e76aec) (@ibetitsmike)
• Tidy AI Gateway sessions list columns and tooltips (#30733, afe7472) (@tracyjohnsonux)
• Database: Add organization AI model config table (#30717, d14631d) (@SasSwart)
• Load project skills in chats (#30838, 3216580) (@jaaydenh)
• Retry failed MCP servers on context resync (#30489, 281b838) (@jeremyruppel)
• Dashboard: Add the project skills dialog (#30855, cbc53b4) (@jaaydenh)
• Discover ACP harnesses configured in the workspace (#30557, bf5dda3) (@hugodutka)
• Agent: Publish ACP harnesses in context snapshots (#31060, 58276d2)
• Probe ACP harness capabilities (#31057, fbf7eb3)
• Show available ACP harnesses in chat context (#31059, c61d842)
• Manage project skills from the project page (#30856, 7253bd1) (@jaaydenh)
• Send skill invocations as structured message parts (#30861, ffd2486) (@jaaydenh)
• Dashboard: Add an xs Avatar size (#31151, 64b9549) (@tracyjohnsonux)
• Dashboard: Insert skills as chips in the composer (#30880, e88de21) (@jaaydenh)
• Render skill invocations in the transcript and edit flow (#30881, 3c83820) (@jaaydenh)
• Server: Add queries for organization AI model prices (#30718, da78c88) (@SasSwart)
• Server: Price token usage with organization prices (#30719, 837c2e1) (@SasSwart)
• Serve internal MCP servers to chats in process (#29828, 15a160a)
• Add skill action and automatic-use settings (#30882, c4d76a4) (@jaaydenh)
• Show project skill actions above project chat composers (#30884, 63f3bde) (@jaaydenh)
• Enable Coder.AcronymPeriods Vale rule (#31180, c1bec1b) (@app/coder)
• Enable Coder.LGBTQ Vale rule (#31181, f2edbea) (@app/coder)
• Enable Coder.AmbiguousWords Vale rule (#31182, b59fea2) (@app/coder)
• Enable Coder.InclusiveLanguage Vale rule (#31183, ffc2a3f) (@app/coder)
• Documentation: Enable Coder.ImperativeNegation Vale rule (#31184, 635a1a8) (@app/coder)
• Documentation: Enable Coder.CheckOut Vale rule (#31185, 78aa570) (@app/coder)
• Make doc-check review docs quality, not only missing docs (#31193, c242029) (@nickvigilante)
• Enable Coder.Please Vale rule (#30789, 58d19d7) (@nickvigilante)
• Enable Coder.USSpelling Vale rule (#30790, 9edb2e3) (@nickvigilante)
• Enable Coder.LatinAbbreviations Vale rule (#30794, 7eacfe9) (@nickvigilante)
• Resolve orgs from workspace session tokens in AI Gateway requests (#30902, 946c2f0) (@SasSwart)
• Show cache tokens on AI Gateway session page (#30511, 9efe7a3)
• Add cost to AI Gateway session threads API (#30509, 15a5844) (@ssncferreira)
• Show cost and model prices on AI Gateway session page (#30512, 5bd641a)
• Send include_related from WorkspaceByOwnerAndName options (#29908, 9fe5282) (@spikecurtis)
• Dashboard: Add Agents label to the Coder Agents PWA icon (#31277, 6cf18f4) (@mafredri)
• Add ACP session runtime and transcripts (#30835, 43ec0ba)
• Watch and subscribe to ACP session updates (#30903, d2c32e6)
• Add agent-local ACP session interaction (#30831, 4b9b987)
• Restore and recover agent-local ACP sessions (#30857, e3068bb)
• Dashboard: Support ACP subagents on the frontend (#30561, b644b19)
• Add ACP subagent waiting and transcript streaming (#30560, e75885a)
• Add tools to start, message, and interrupt ACP agents (#31022, 8fd94eb)
• Add JSON output to coder ping (#30148, d469763) (@nickvigilante)
• SDK: Accept options on ResolveWorkspace (#29913, e17851d) (@spikecurtis)
• Honor disable-model-invocation in skill frontmatter (#31147, 514f239) (@ibetitsmike)
• Enable Coder.StepLength Vale rule (#30791, 81c4057) (@nickvigilante)
• List every chat attachment in the Summary panel (#31140, 3f055e7) (@ibetitsmike)
• Show web searches and the pages they found in chats (#29861, 2cb10b5) (@mafredri)
• Expose connection duration and client session ID in connection logs (#30759, 0d1cba2) (@EhabY)
• Add approximate cost note to AI Gateway session summary (#31259, 926742b) (@ssncferreira)
• Dashboard: Add NixOS rainbow and trans icons (#31325, 191d268) (@phorcys420)
• SDK: Mark the chat-projects experiment as safe (#31313, f348cd6) (@f0ssel)
• Run one doc-check verifier per group of findings (#31243, 9666549) (@nickvigilante)
• Enable Coder.Semicolons Vale rule (#30787, 21471da) (@nickvigilante)
• Dashboard: Add community Codernaut variant and WASD controls to the Codernauts game (#30837, 5e0b0c0) (@bartekgatzcoder)
• Dashboard: Replace the Coder Agents PWA icon with the stacked-agents mark (#31368, d6ea984) (@ibetitsmike)
• Add start and message jitter to chat scaletest (#30264, 4b6f2c1) (@cstyan)
• Graduate chat projects out of the chat-projects experiment (#31354, b54f7de) (@f0ssel)
• Server: Store the organization on AI Gateway interceptions (#31118, 161b723) (@SasSwart)
• Add Harbor-based A/B eval for Coder Agents against main (#30686, dbd7db6) (@f0ssel)

Bug fixes

• Server: Tell the model when output hit the token limit mid tool call (#30120, 5a997c4) (@ibetitsmike)
• Return token usage for every thread in AI Gateway session detail (#30087, 1e7a300) (@SasSwart)
• Dashboard: Align context usage ring with its glyph in Safari (#28986, 0b17b85) (@tracyjohnsonux)
• fix(aibridge): relay streams when accumulation fails (#30119, d203439) (@ibetitsmike)
• Swap description and command in coder organizations show examples (#30154, c9813d9) (@nickvigilante)
• CLI: Offer a None option in the coder create preset prompt (#30068, 04b2af2) (@nickvigilante)
• Stop escaping ampersands in docs manifest titles (#30161, 0ce91ff) (@nickvigilante)
• Hide the unused --yes flag on coder organizations create (#30144, 46265fc) (@nickvigilante)
• Server: Accept ambient-credential providers in model overrides (#30205, 8e323e4) (@jscottmiller)
• Documentation: Regenerate CLI manifest for coder sharing (#30216, 1e15109) (@BobbyHo)
• Dashboard: Stop the flyout overlapping the main menu (#30196, ad924a3) (@tracyjohnsonux)
• Dashboard: Keep personal skills table rows on one line (#30169, d9c13dc) (@jakehwll)
• Require and clarify API key auth fields for MCP servers (#30197, decf1dd) (@mafredri)
• fix(scripts/aibridgepricesgen): drop claude-sonnet-5-5 bare ID injection (#30229, 35abc22) (@ssncferreira)
• Server: Stop announcing stale chat retries and fence retried attempts (#30241, 9ac4628) (@ThomasK33)
• Server: Refuse to create a child chat under an archived root (#30240, 303b822) (@ThomasK33)
• Drain proxy requests before closing DRPC (#29724, 7e64b46) (@pawbana)
• Dashboard: Keep card content still when colored and shade uncolored group headers (#30231, cc73f32) (@mafredri)
• Server: Recheck auto-archive candidates under the family lock (#30242, cdc87ee) (@ThomasK33)
• Server: Enforce chatd concurrent-agent capacity on every path into running (#30243, d11809f) (@ThomasK33)
• Update Playwright for Ubuntu 26.04 support (#30228, 4691192) (@matifali)
• Server: Keep user chat renames made during title generation (#30254, 7b40aa7) (@ThomasK33)
• Database: Fix duplicate chat projects migration and stale chat title query (#30257, a328bee) (@f0ssel)
• Prevent Prometheus metrics reference drift (#29314, 72e31ff) (@nickvigilante)
• Server: Return queued chat messages in promotion order (#30255, bb31a19) (@ThomasK33)
• Server: Finish interruption inline for unowned interrupting chats (#30259, 15382eb) (@ThomasK33)
• Dashboard: Keep other users' pinned chats out of the sortable Pinned section (#29697, dc07908) (@jakehwll)
• Dashboard: Improve AI budget USD label contrast on groups pages (#30234, e4215a2) (@chrifro)
• Dashboard: Raise option source flag contrast (#30232, f488086) (@chrifro)
• Server: Drop late preview parts after a chat error (#30279, e3446c9) (@ThomasK33)
• Dashboard: Evaluate the completion chime only on status_change events (#29570, 49ceba4) (@mafredri)
• Database: Lock chat tables before 000609 alters them (#30297, 122757d) (@ThomasK33)
• Server: Cancel tool calls in messages deleted on edit (#30194, 0f78361) (@mafredri)
• Dashboard: Wrap note links inline and float note actions (#30332, 2e07a54) (@mafredri)
• Apply Anthropic prompt caching through OpenRouter and OpenAI-compatible gateways (#29563, bb9f31d) (@ibetitsmike)
• Server: Never dial the embedded DERP region over the network (#30221, 939d05b) (@ethanndickson)
• Dashboard: Raise emoji picker placeholder contrast (#30227, 5325b25) (@chrifro)
• Reject encoded path traversal in ai gateway before forwarding upstream (#30178, bf3db74) (@SasSwart)
• Dashboard: Use singular labels for one-second build durations (#30358, 6f3aa61) (@jakehwll)
• Dashboard: Format group membership counts (#30345, b7b5ff1) (@jakehwll)
• Dashboard: Prevent upload folder icon from shrinking (#30359, 37a8751) (@jakehwll)
• Dashboard: Start the iOS home-screen app below the status bar (#30357, c143365) (@ibetitsmike)
• Dashboard: Prevent SSH copy tooltip from opening automatically (#30315, 86063e6) (@jakehwll)
• Dashboard: Show zero duration for completed sub-second builds (#30366, 8cc0d88) (@jakehwll)
• Accept 128-character template descriptions on creation (#30348, 3f444d9) (@jakehwll)
• Dashboard: Make health page refresh spinner visible in dark mode (#30204, 66af976) (@app/blinkagent)
• Dashboard: Make extra roles keyboard accessible (#30342, 5169248) (@jakehwll)
• Dashboard: Use info alert for implied member role in role selector (#30284, b2c0fc3) (@chrifro)
• Dashboard: Raise light destructive token contrast and align error role to tokens (#30282, ae7c466) (@chrifro)
• Dashboard: Pass chatRecordUpdatedAt in chat store test (#30393, 0ba8079) (@DanielleMaywood)
• Dashboard: Raise contrast of upcoming steps in template builder selection summary (#30281, 8d97f24) (@chrifro)
• Let scoped tokens list and mark inbox notifications read (#30176, f0e2fce) (@EhabY)
• Dashboard: Expose organization picker as a combobox (#30402, 9d8de75) (@chrifro)
• Dashboard: Avoid double-encoding user picker searches (#30385, 3c5de0a) (@jakehwll)
• Dashboard: Align Premium paywall corner radii (#30304, 515bda9) (@jakehwll)
• Dashboard: Position filter flyouts with Radix so they stay on screen (#30081, d5f75aa) (@tracyjohnsonux)
• Dashboard: Support token lifetime limits below one day (#30386, 89d1025) (@jakehwll)
• Networking: Replace peer node instead of mutating KeepAlive (#30296, 05eac08) (@aqandrew)
• fix(scripts/metricsdocgen/scanner): normalize package keys to slash paths (#30360, d031680) (@nickvigilante)
• Explicitly close ssh upgrade listener (#30442, 0081663) (@code-asher)
• Dashboard: Match group form name limits to the API (#30347, 0243445) (@jakehwll)
• Dashboard: Move session avatar above timestamp (#30310, a6a1884) (@jakehwll)
• Dashboard: Update project chat rows to the current menu API (#30452, d266327) (@jakehwll)
• Dashboard: Replace undeclared default border color tokens (#30099, b38240a) (@jaaydenh)
• Keep new API keys within the caller's scopes and allow list (#30256, fc01bee) (@EhabY)
• Dashboard: Resolve codernauts appearancesettings padding (#30450, 5552152) (@jakehwll)
• Networking: Wait for DERP controller to exit on cancel (#30458, 01aee8d) (@EhabY)
• CLI: Close coderd on server startup errors (#30280, 7c39819) (@ibetitsmike)
• Dashboard: Wait for the revoked picker to unmount (#29637, 514eb7f) (@ibetitsmike)
• Dashboard: Keep streaming text alive inside expanded working blocks (#29420, ec27e23) (@ibetitsmike)
• Dashboard: Preserve Unicode avatar fallback characters (#30344, 5ca77e2) (@jakehwll)
• Dashboard: Stop counting reasoning tokens twice in the context meter (#30336, f9cee5a) (@mafredri)
• Dashboard: Keep long base URLs from overflowing the providers table (#30095, 6db5a36) (@tracyjohnsonux)
• Dashboard: Persist disabled template autostop settings (#30477, 1c6b121) (@jakehwll)
• Dashboard: Keep multi-select parameters in sync (#30475, cd4a0a9) (@jakehwll)
• Dashboard: Show page numbers when the widget has room (#30488, 861bcbb) (@tracyjohnsonux)
• Coalesce AI session metadata in list query (#30351, ef590af) (@SasSwart)
• Dashboard: Use solid colors for help icon contrast (#30463, 36d68ed) (@chrifro)
• Dashboard: Adjust working block content alignment (#30495, c84b9eb) (@jakehwll)
• Dashboard: Allow archiving and deleting multiple agent workspaces at once (#30276, 593829a) (@jakehwll)
• Dashboard: Show a visible indicator on highlighted dropdown options (#30472, 95f5c4a) (@chrifro)
• Dashboard: Own chat archive mutations per surface (#30299, c85d07e) (@jakehwll)
• Dashboard: Own chat pin mutations per surface (#30300, 8a30ce8) (@jakehwll)
• Dashboard: Own manual chat read mutations per row (#30301, b5bd01c) (@jakehwll)
• Dashboard: Prevent clipboard timers after unmount (#30506, 8801f29) (@jakehwll)
• fix(scripts/docsgenfiltercheck): accept CRLF line endings in banner check (#30476, bcedc5d) (@nickvigilante)
• Examples: Match whole language entries in the install script (#30373, d23280a) (@nickvigilante)
• Support path-aware OAuth discovery for remote MCP (#30168, 261269a) (@matifali)
• Dashboard: Honor workspace sharing permission (#30510, f766be7) (@jakehwll)
• Dashboard: Fall back to canonical template organization names (#30520, 276683b) (@jakehwll)
• Dashboard: Add copy button to chat code blocks (#29447, af8fb59) (@bpmct)
• Dashboard: Raise scrollbar thumb contrast (#30461, cc4b0de) (@chrifro)
• Dashboard: Make text-only tooltip triggers keyboard focusable (#30403, 5b51a27) (@chrifro)
• Dashboard: Raise contrast of selected resources sidebar item (#30464, eb73068) (@chrifro)
• Move organization instructions to the Instructions page (#30428, 6bae268) (@ibetitsmike)
• Dashboard: Keep the live working timer width stable (#30485, 2b5c0f3) (@tracyjohnsonux)
• Dashboard: Add missing effect dependencies (#30568, 697d738)
• Dashboard: Correct useMemo dependencies (#30567, 8797ca5)
• Dashboard: Exclude disabled workspaces from bulk selection (#30517, 3364368) (@jakehwll)
• Dashboard: Abort chat history requests when the query is cancelled (#30542, 2d96e88) (@ibetitsmike)
• Server: Return database errors at chat create and subagent spawn (#30449, 807878c) (@ethanndickson)
• Server: Return database errors from turn preparation (#30492, 4afd834)
• Dashboard: Keep agent chat scroll on tool toggles and log streams (#29354, c735c1d) (@DanielleMaywood)
• Server: Attach subagent git refs to the root chat (#30647, cf6ab87) (@DanielleMaywood)
• Dashboard: Use page count in usePaginatedQuery overshoot fallback (#30572, 1c805b0) (@jeremyruppel)
• Dashboard: Keep path separator in terminal websocket URL (#30573, abc2fae)
• Dashboard: Align collapsible section chevron with title (#30654, ca7d7af) (@tracyjohnsonux)
• Agent: Disable standalone SSE for HTTP MCP servers (#30484, c4fabe9) (@jeremyruppel)
• Fold web searches, answer reasoning, and OpenAI narration into working blocks (#30529, 41f5caa) (@ibetitsmike)
• Deduplicate template insights family metrics (#30497, 2f2169e) (@EhabY)
• Dashboard: Raise breadcrumb and topbar separator contrast (#30546, bc445de) (@chrifro)
• Keep error toasts visible until dismissed (#30420, d68b2c8) (@chrifro)
• Anchor golangci .git exclusion and fix hidden findings (#30621, e8dcf9a) (@ibetitsmike)
• Dashboard: Raise theme swatch ring contrast to 3:1 (#30539, 4e4603e) (@chrifro)
• Dashboard: Show a loader instead of the error page during stale chunk reload (#30658, 454a2fc) (@DanielleMaywood)
• fix(aibridge): correlate Codex custom tool results to their AI Gateway thread (#30667, 71e8e52) (@dannykopping)
• Replay stateless OpenAI reasoning across chat turns (#30298, b2c8798) (@ibetitsmike)
• Dashboard: Keep paragraph breaks in streamed chat text (#30551, e7b7687) (@mafredri)
• Database: Renumber MCP OAuth2 resource migration to 000622 (#30722, 0ea3f16) (@BobbyHo)
• Allow fixing stale parameters when the active version is required (#30660, 893461a) (@aslilac)
• Dashboard: Put context usage popover ARIA on the button (#30708, 0e9edc1) (@tracyjohnsonux)
• Dashboard: Announce new tab on version link (#30715, 5d5f867) (@tracyjohnsonux)
• Run chat interrupt messages before earlier queued messages (#30729, 60c6c09) (@ethanndickson)
• Dashboard: Use singular pagination labels for one result (#30519, a4c100e) (@jakehwll)
• Dashboard: Raise checkbox and radio border contrast to 3:1 (#30462, 01f78b3) (@chrifro)
• fix(aibridge/intercept/messages): treat Bedrock Opus 5, Haiku 5.5, Fable 5, and Mythos 5 as adaptive-only (#30692, e6d24ff) (@dannykopping)
• fix(scripts/release): promote stable on immutable releases (#30745, 200cffc) (@denisra)
• Agent: Track the default working directory for chat processes (#30674, 2b844aa) (@DanielleMaywood)
• Dashboard: Refetch the open chat when the chat watch reconnects (#30677, dad010f)
• Dashboard: Replace git state on reconnect (#30676, 63eef9e)
• Agent: Re-resolve chat paths on refresh (#30675, e981ff4)
• Dashboard: Make git panel refresh match a page reload (#30678, b8c9195)
• Server: Guard quickstart C/C++ install on every tool it installs (#30374, 6afd151) (@nickvigilante)
• Dashboard: Use a radio group for module category filters (#30523, 4f7bddb) (@aqandrew)
• Give buttons accessible names (#30796, 1d57682) (@aqandrew)
• Server: Only retry without drop_block when it's rejected (#30821, aef7f15) (@ethanndickson)
• Make workspace create denials on behalf of another user actionable (#30537, c85ebc1) (@matifali)
• fix(scripts/dogfood): pass GO_LINT_NEW_CODE_BASE to the image lint run (#30851, 17ec945) (@app/coder)
• Bump Go version from 1.26.5 to 1.26.9 (#30807, d36c153) (@droopy4096)
• Dashboard: Replace role="application" on recharts charts (#30375, 5261723) (@aqandrew)
• Dashboard: Preserve personal instructions drafts (#30626, 3b283eb) (@jakehwll)
• Dashboard: Increase Switch off-state contrast to meet WCAG 1.4.11 (#30547, bef7ba8) (@chrifro)
• Dashboard: Use shared radio for theme cards (#30833, 4dfec5c) (@chrifro)
• Dashboard: Add surface-scrollbar token for scrollbar thumbs (#30744, e58424a) (@chrifro)
• fix(flake): update Linux Chrome download (#30899, 5bde0ea) (@phorcys420)
• Match chart accessible name in story (#30907, e637c92) (@aslilac)
• Server: Reset stream history only if after_id is deleted (#29808, 939146b) (@jscottmiller)
• Server: Return agent and subagent lookup database errors (#30661, aedd998) (@ethanndickson)
• Server: Return database errors from workspace tools (#30822, e254086)
• Server: Commit chat workspace bindings with dependent state (#30663, e09407c)
• Server: Return MCP OAuth token database errors (#30662, 096db5d)
• Log workspace shutdown reasons for SSH connections (#30515, 1a65385) (@fioan89)
• Dashboard: Stop iPadOS blurring the top of the home-screen app (#31027, 3f1874c) (@ibetitsmike)
• Server: Make compaction fit an overflowing context (#30766, 8245457) (@ibetitsmike)
• Server: Keep the chat output cap on compaction summaries (#31042, 3576e04) (@ibetitsmike)
• Server: Drop blocked tools from Explore sub-agent turns (#30911, e53cfef) (@ibetitsmike)
• fix(scripts/releaser): use the v-prefixed image tag in release notes (#31032, 7b8d480) (@denisra)
• Dashboard: Raise session timeline border contrast to 3:1 (#30839, 2f74894) (@chrifro)
• Dashboard: Remove borders from grey badges (#31043, 0187b96) (@chrifro)
• Dashboard: Enlarge undersized Autocomplete clear and HelpPopover icon targets to 24px (#30890, 76ae9bf) (@chrifro)
• Server: Bound push response body read and add client timeout (#31129, cc66f30) (@BobbyHo)
• Set project chat row text color to content-secondary (#31158, 9d840ae) (@jaaydenh)
• Server: Ignore retired OAuth2 scopes such as task:* (#31117, f69b98a) (@ethanndickson)
• Server: Allow evicted bridges ten minutes to drain (#30830, 30499fd) (@dannykopping)
• Dashboard: Show refreshed diff content in the Git panel (#31166, 3102462) (@DanielleMaywood)
• Exempt service accounts from user dormancy (#30824, 9b8d880)
• Dashboard: Speed up overlay and tooltip motion (#29823, face989) (@jakehwll)
• Dashboard: Consolidate Badge into sm and md sizes (#31149, 9704d85) (@tracyjohnsonux)
• Dashboard: Use sm Badge size for project skill labels (#31194, 7d7ab24) (@jaaydenh)
• Only inject session tokens into trusted app links (#31208, 43ecc7c) (@EhabY)
• Server: Coalesce deltas when persisting interrupted turns (#29661, 3c36790) (@mafredri)
• Dashboard: Open a transcript mounted after its scroller at the end (#30608, b9e76bd) (@mafredri)
• Dashboard: Open model settings filtered to the selected provider (#30392, b97d048) (@tracyjohnsonux)
• Show configured provider icons and names in AI settings (#31033, 4e4a56b) (@tracyjohnsonux)
• Server: Traverse schema branches (#31128, 457d777) (@hugodutka)
• Documentation: Regenerate ping docs with table headers (#31292, 1893b80) (@nickvigilante)
• Retry workspace quota commits with jittered backoff (#31207, 1e0a481) (@dylanhuff-at-coder)
• Dashboard: Stop browsers refilling provider credentials (#30391, cdfdaed) (@tracyjohnsonux)
• Bump Go to 1.26.10, terraform to 1.16.7, alpine to 3.24.3 (CVE-2026-111943) (#31301, 688c4a3) (@sreya)
• Harden chat workspace file upload input validation (#30184, 34ef30e) (@ibetitsmike)
• Server: Restrict chat workspace rebinding to the chat owner (#30185, 27db7ac) (@ibetitsmike)
• Hide pricing warning for prompts without usage (#31265, 5e427bf) (@ssncferreira)
• Dashboard: Make the PWA title bar follow the active theme (#31297, 0f3e1aa) (@mafredri)
• Link AI spend tooltip to how spend is calculated (#31258, e676f6d) (@ssncferreira)
• Server: Store chat ACL keys as canonical UUIDs (#31037, 9551fa3) (@ibetitsmike)
• Show each OpenAI reasoning summary title on its own line (#31349, 9f7a5d5) (@mafredri)
• Agent: Compare fake harness directory identity (#31161, 28effca) (@hugodutka)
• CLI: Scope keyring credentials to the deployment origin (#29764, bc65edc) (@RyanL2)
• Server: Reject overflowing chat workspace TTL values (#31036, 2116682) (@ibetitsmike)
• Dashboard: Show a list tree icon on working blocks (#31364, 05505d0) (@mafredri)
• Keep ACP harness context synchronized (#31351, 1a9d5b2)
• Agent: Probe ACP harnesses before workspace readiness (#31350, 38e621a) (@hugodutka)
• Database: Close listener before waiting on latency probe (#31317, 7283fff) (@ibetitsmike)
• Server: Replace interrupted ACP tool output (#31362, a3fb196) (@hugodutka)
• Dashboard: Keep related connections link from stretching (#31369, decd769) (@EhabY)
• Server: Reject overflowing workspace TTL values (#31329, 36bccbf) (@ibetitsmike)
• Dashboard: Split live Working blocks at assistant text and scroll to their end on expand (#30656, 083670a) (@ibetitsmike)
• Bump coder/tailscale to bound DERP dup client sendHistory (#31248, f1f57d9) (@dylanhuff-at-coder)
• Dashboard: Show success toasts after copying chat ID and branch (#31402, cd55565) (@app/coder)
• Dashboard: Call chats chats in sidebar empty states (#31401, f85e0ce) (@app/coder)
• Dashboard: Give each user settings page a descriptive title (#31186, 23ee3e7) (@chrifro)
• Dashboard: Outline the inactive switch state (#31165, c440977) (@chrifro)
• Require SSH permission to fetch external agent credentials (#31388, a736d65) (@dylanhuff-at-coder)
• Wait for full completion before asserting in tests (#30885, bb8912d) (@eric-hughes-coder)
• Confine read_skill_file reads to the skill directory (#31462, 5f58fb2) (@ibetitsmike)
• Database: Lock the workspaces row when claiming a prebuild (#31518, 289138d) (@dylanhuff-at-coder)
• Bump bundled terraform to 1.17.1 (backport 2.39) (#31458, 48cd3a2)
• Bump gomarkdown/markdown to fix GHSA-cv23-7vc5-jfh7 (backport 2.39) (#31457, fcdd867)
• Dashboard: Show pinned and unloaded chats in project sidebar folders (#31343, e22dce1) (@jaaydenh)
• Server: Anchor CSRF exemption patterns (#31125, 8d89735) (@BobbyHo)

Documentation

• Remove feature states from page titles (#30109, c2d2438) (@nickvigilante)
• Add YAML front matter to remaining pages (#30115, 4a62b0f) (@nickvigilante)
• Flatten lone index pages to single files (#30129, 1fd383e) (@nickvigilante)
• Remove AI Governance usage row from air-gapped comparison (#30202, eae031d) (@mattvollmer)
• Document cherry-pick and backport label flows (#30102, f73b65a) (@f0ssel)
• Document support bundle collection across CLI and IDEs (#30118, 191a9f3) (@matifali)
• Author the sidebar in per-section YAML compiled to manifest.json (#30165, f1ed84f) (@nickvigilante)
• Drop task-list checkboxes from the Chats migration guide (#29856, 1bb77bb) (@nickvigilante)
• Add redirects.json and rebuild the docs site when it changes (#30208, 14bb1f2) (@nickvigilante)
• Add chat automations documentation (#30220, 7f3d353)
• Turn the Quickstart's next steps into goal-based paths (#29800, c30b44a) (@nickvigilante)
• Render audit log resources as one table per resource (#29797, fcbf45c) (@nickvigilante)
• Add playback controls and descriptions to autoplaying videos (#30263, 3f40882) (@nickvigilante)
• Shorten the add-a-language install script copy and note apt reinstalls (#30376, 44af8a1) (@nickvigilante)
• Documentation: Reformat to one sentence per line (#30438, 21c1abe) (@ianjevans)
• Documentation: Clarify VS Code support bundle requirements and limits (#30430, d56cc3a) (@EhabY)
• Correct the CODER_AGENT_BLOCK_FILE_TRANSFER block list (#29705, c9680e4) (@app/blinkagent)
• Clarify that disable-password-auth also applies to owners (#30362, b4fb790) (@jdomeracki-coder)
• Document dropping capabilities for restricted Pod Security (#30271, 020b437) (@andrewdunndev)
• Note the pubsub cluster port between HA replicas (#30290, c11d60a) (@andrewdunndev)
• Mention chat reasoning_tokens is part of output_tokens (#30500, befda9b) (@mafredri)
• Document VS Code SSH keepalive and reconnection settings (#30501, f8e053e) (@app/coder)
• Remove references to unsupported SAML authentication (#30507, dfa72df) (@nickvigilante)
• Point the 2.29 ESR row at v2.29.21 (#30538, d7bf081) (@denisra)
• Note coder_agent dir un-deprecation in 2.29-2.34 ESR upgrade guide (#30533, 8674e85) (@app/coder)
• Documentation: Fix broken vscode-coder demo GIF links (#30655, f2ddf21) (@nickvigilante)
• Add Claude Desktop as a supported client (#30653, 8a063ef) (@matifali)
• Update release calendar for v2.38 (#30757, 2254965) (@Lisa-Fiander)
• Delete unlisted pages and their screenshots (#30758, 935e076) (@nickvigilante)
• Documentation: Reformat to one sentence per line (#30705, ed6a844) (@nickvigilante)
• Documentation: Reformat setup and integrations docs to one sentence per line (#30704, 1872b18) (@nickvigilante)
• Documentation: Reformat to one sentence per line (#30701, c647260) (@nickvigilante)
• Documentation: Reformat to one sentence per line (#30703, c58ac71) (@nickvigilante)
• Documentation: Reformat AI Gateway client and Agent Firewall docs to one sentence per line (#30702, 1f61a29) (@nickvigilante)
• Documentation: Add compliance-claims wording rule to the style guide (DOCS-1256) (#30778, 0dc3678) (@nickvigilante)
• Documentation: Fix tab block class typo on the remote desktops page (#30862, 4ae1b7b) (@nickvigilante)
• Replace references to the retired Enterprise license tier (#30853, c6a47c4) (@nickvigilante)
• Documentation: Reformat to one sentence per line (#30700, 9eba637) (@nickvigilante)
• Documentation: Document workspace secrets (#30252, fa926fc) (@Emyrk)
• Documentation: Fix 404 OpenShift build config link (#30900, ff58693) (@nickvigilante)
• Add missing rules from the docs style guide project (#30782, c4cfe8a) (@nickvigilante)
• Add Pethost to community install methods (#30901, b477ada) (@sadfun)
• Documentation: Reformat to one sentence per line (#30699, c4d9834) (@nickvigilante)
• Documentation: Reformat to one sentence per line (#30697, 07f3d95) (@nickvigilante)
• Documentation: Reformat networking docs to one sentence per line (#30695, 1765868) (@nickvigilante)
• Documentation: Reformat monitoring and security docs to one sentence per line (#30694, acd03e4) (@nickvigilante)
• Reformat reference, start, and install docs to one sentence per line (#30696, f5909d2) (@nickvigilante)
• Documentation: Reformat to one sentence per line (#30693, 644519e) (@nickvigilante)
• Server: Resolve ARCHITECTURE.md TODOs for idle chats and workspace files (#30039, ea287da) (@ibetitsmike)
• Refresh release calendar and install versions for the 2026-10-19 patches (#31034, 8afae4d) (@denisra)
• Add an Agent Firewall example policy page (#29468, 7777bf3) (@jdomeracki-coder)
• Fold dynamic parameters into a Parameters section (#30912, e5c5779) (@app/coder)
• End every page description with a period and lint for it (#30863, d187dea) (@nickvigilante)
• Attribute unlimited agent concurrency to AI Premium (#31088, 54f77d2) (@app/coder)
• Give screenshots their own alt text and fill empty table headers (#30873, fda1ed5) (@nickvigilante)
• Point the ESR paragraph at v2.34.13 (#31070, 360e2ff) (@denisra)
• Give every table header cell text and fail lint on empty ones (#30879, 6e51c66) (@nickvigilante)
• Remove beta label from JetBrains Toolbox (#31164, b1f5f0b) (@matifali)
• Documentation: Clarify who confirms bulk workspace actions (#31178, 6205471) (@app/coder)
• Documentation: Call the languages parameter a multi-select (#31179, bf0c7a5) (@app/coder)
• Documentation: Document Toolbox support bundle requirements (#31289, e4e62d9) (@fioan89)
• Document declarative script ordering (#31227, aa9b0a9) (@geokat)
• docs(.claude/skills/frontend-deep-review): keep JSDoc on exports in CD5 fix (#31318, de56247) (@ibetitsmike)
• Promote usage of Nix(OS) and discourage use of envbuilder (#31141, 3ed2dfd) (@phorcys420)
• Add guide for tracing workspace connections (#31342, 131d4fc) (@matifali)
• List VS Code session ID sources and View related connections (#31371, deb76fa) (@EhabY)
• Documentation: Add Coder Agents projects page (#30684, cfe6303) (@f0ssel)
• Document ACP subagents (#31430, 823decd) (@hugodutka)

Code refactoring

• refactor(aibridge): expose provider credentials and invocation models (#29886, fc86197) (@johnstcn)
• CLI: Replace deprecated GroupsByOrganization in groups list (#30142, 1f7aa2d) (@nickvigilante)
• Provisioner: Extract Terraform addresses (#30261, 3f95f43) (@geokat)
• Add agent connection reporter (#30069, c7da54c) (@code-asher)
• Dashboard: Replace the banner color picker (#30308, 70bc2e5) (@jakehwll)
• Dashboard: Align compaction settings table (#30274, 8dca7c9) (@jakehwll)
• Use typed AI Gateway actor identity (#30258, ffc7dad) (@pawbana)
• refactor(aibridge): export passthrough handler (#30283, 63d9b6b) (@pawbana)
• Move coderd/x/nats to coderd/nats (1561672) (@cstyan)
• Dashboard: Require always-passed right panel props (#29893, 21212e4) (@DanielleMaywood)
• Dashboard: Require chat IDs in chat store helpers (#29888, deff49f) (@DanielleMaywood)
• Dashboard: Require always-passed chat input props (#29890, 82629f2) (@DanielleMaywood)
• Dashboard: Require org, MCP servers and URL transform in timeline (#29894, f2e995f)
• Dashboard: Require always-passed settings and misc props (#29892, 33b69ff) (@DanielleMaywood)
• Dashboard: Require always-passed timeline and tool props (#29891, 0e81c4b) (@DanielleMaywood)
• Dashboard: Move the composer layout out of AgentCreateForm (#30291, 7d1191c) (@jaaydenh)
• Dashboard: Avoid per-render fallback arrays in hook deps (#30566, dfeea82)
• Dashboard: Read latest callbacks in effects with useEffectEvent (#30565, 7439225)
• Dashboard: Depend on stable Formik setters in effects (#30564, 71f468b) (@jeremyruppel)
• Dashboard: Use NANO_DAY instead of multiplying NANO_HOUR by 24 (#30575, 89d9492) (@aqandrew)
• Move ssh upgrade listener to the corresponding serve (#30532, 7829b8f) (@code-asher)
• Provisioner: Extract script ordering (#30337, e2abd0f) (@geokat)
• Provisioner: Stage script order resolution (#30481, 50c785c) (@geokat)
• Dashboard: Add ToolCall.Scrollable (#30648, ff5edf2) (@DanielleMaywood)
• Server: Move chat mutations into chat_mutations.go (#28756, b7d6312) (@ibetitsmike)
• Server: Remove the no-op allowedBehaviorToolNames filter (#30864, 5ccbef0) (@ibetitsmike)
• Rename prepareGeneration to buildTurnEnvironment (#30866, a41e5ae) (@ibetitsmike)
• Server: Name the Server receiver p in turn_environment.go (#30869, 8065f84) (@ibetitsmike)
• Server: Move turn preparation helpers into turn_environment.go (#30870, 54ba766) (@ibetitsmike)
• Server: Share chat creation with in-process callers (#30027, de42c37) (@ethanndickson)
• Server: Extract AI model price body decoding and validation (#30716, 41e5b2d) (@SasSwart)
• Server: Replace executeTools and executeSingleTool with toolBatch (#30938, 3df3c03) (@ibetitsmike)
• Server: Delete the CompactionOptions and compactionOutcome mirrors (#30984, 63c116f) (@ibetitsmike)
• Server: Resolve tool name aliases in one toolBatch method (#30939, a86012f) (@ibetitsmike)
• Server: Delete the chat debug run and step heartbeats (#30988, 2397f39) (@ibetitsmike)
• Delete chatdebug FinalizeStale and the stale threshold (#30989, 3673588) (@ibetitsmike)
• Delete the FinalizeStaleChatDebugRows query (#30995, 8b6f209) (@ibetitsmike)
• Server: Create and finalize debug runs through one helper (#30934, e8882b6) (@ibetitsmike)
• Server: Share one finalize-once lifecycle between the stream wrappers (#30981, 95e6a73) (@ibetitsmike)
• Server: Number chat debug steps in the database (#31007, eea839c) (@ibetitsmike)
• Server: Share one outstanding tool-call scan (#30883, 8228846) (@ibetitsmike)
• Server: Replace run-summary Postgres subtests with literal rows (#30972, 5c9815b) (@ibetitsmike)
• Dashboard: Extract SkillEditorForm and shared skill helpers (#30854, c1d4907) (@jaaydenh)
• Dashboard: Organize agent pages into route folders (#31142, 1f8353a) (@jakehwll)
• Server: Delete the process-global step counters (#31008, e365738) (@ibetitsmike)
• Server: Drop the unused runnerCtx from the runner debug turn (#31010, 39c4bd6) (@ibetitsmike)
• Server: Share chat updates with in-process callers (#30731, 9d5f0cd)
• Server: Share chat sends and interrupts with in-process callers (#30730, d8a78b2) (@ethanndickson)
• Server: Drop the direct Bedrock client (#30928, 766a0eb) (@ibetitsmike)
• Server: Drop the remaining direct provider clients (#30929, cdc9141) (@ibetitsmike)
• Server: Drop provider options only direct clients read (#30958, 17c7fe9) (@ibetitsmike)
• Server: Drop transport branches only direct clients used (#30966, 231537d) (@ibetitsmike)
• Server: Derive the BYOK auth header from the AI Gateway client choice (#30979, 9f2389a) (@ibetitsmike)
• Share the session app fold rule and method derivation (#31028, 7e9735c) (@EhabY)
• Server: Create the compaction debug run through StartRun (#31087, a33af01) (@ibetitsmike)
• Server: Remove the relay dialer's DialerFn bypass (#30920, 8b6f2c6) (@ibetitsmike)
• Server: Delete the write-only generatedChatTitle (#30926, aef1917) (@ibetitsmike)
• Server: Delete the runner's unreachable task index (#30936, 509f142) (@ibetitsmike)
• Server: Delete the test-only advisor runtime getters (#30952, 16486f7) (@ibetitsmike)
• Delete the ChatProviderAPIKeys test seam (#30927, c7f1f4b) (@ibetitsmike)
• Server: Drop Anthropic guard escalation passes (#30970, 85f02df) (@ibetitsmike)
• Server: Remove unused Worker.RefreshChat (#30944, c9204a5) (@ibetitsmike)
• Server: Share the deployment chat setting PUT handler (#31018, 4630e2e) (@ibetitsmike)
• Server: Share the chat model config write error mapping (#31019, 44149fb) (@ibetitsmike)
• Server: Share the chat prompt length check (#31020, 67d586b) (@ibetitsmike)
• Server: Drop pass-through chat message conversion wrappers (#31023, 0b8d913) (@ibetitsmike)
• Server: Extract the recording boundary parser and table its tests (#30953, 9ede7ce) (@ibetitsmike)
• Server: Extract the recording multipart parser and table its tests (#30954, ae6013f) (@ibetitsmike)
• Server: Drop write-only fake state and share the shape check (#30950, 50b7c04) (@ibetitsmike)

Performance improvements

• Server: Make chat stream reads lock-free (#30266, 1a96da2) (@cstyan)
• Database: Index chat message pagination (#30562, d28a433) (@ibetitsmike)
• Server: Bound the initial chat stream snapshot to the client cursor (#29761, 200fa7d) (@ibetitsmike)
• Provisioner: Optimize selectors and tune graph limits (#31177, a3876a3) (@geokat)

Tests

• Dashboard: Wait for the cleared spend request (#30132, 95c9dca) (@tracyjohnsonux)
• test(scripts/docgenenv): match missing include by fs.ErrNotExist (#30285, 12caf88) (@nickvigilante)
• Server: Check tool call cancels through the agent API (#30346, f85f194) (@mafredri)
• Server: Reduce chat test fixture and timer waits (#29523, 9cfe270) (@ibetitsmike)
• Enterprise: Avoid fixture and provisioning timer waits (#29527, dd0346c) (@ibetitsmike)
• Skip agent tool call tests until netstack TIME_WAIT fix (#30465, 788a8bc) (@mafredri)
• Make Responses streaming test handle CRLF SSE boundaries (#30352, a4b68ac) (@SasSwart)
• Eliminate a race for http.DefaultClient (#30454, 54ee377) (@SasSwart)
• Server: Cover the turn tool policy at buildTurnEnvironment (#30867, c42c9af) (@ibetitsmike)
• Server: Remove end-to-end tool policy tests (#30868, 752da8d) (@ibetitsmike)
• Server: Renew the expired TLS test certificate (#30922, 1213938) (@ibetitsmike)
• Database: Use subtest context in TestProjectSkillQueries (#31011, 452654d) (@jaaydenh)
• Server: Cover provider tool runners in ExecuteLocalTools (#30937, f004c72) (@ibetitsmike)
• Provisioner: Add script-order conversion fixtures (#31038, 709fb5d) (@geokat)
• Server: Use a random cluster port in TestPubsub/CloseIdempotent (#31056, 90a8d51) (@ibetitsmike)
• Agent: Stop asserting the exit code of SSH sessions closed by agent shutdown (#31058, aae5602) (@ibetitsmike)
• Server: Pin the debug runs that turns, titles and status labels record (#30933, a1556f8) (@ibetitsmike)
• Server: Table the stream wrapper tests and cover their status rules (#30980, 01ee348) (@ibetitsmike)
• Server: Check the run-summary query boundary (#30973, ffc6aac) (@ibetitsmike)
• Server: Cover BYOK header choice for Bedrock and OpenAI-compatible routes (#30978, 707d373) (@ibetitsmike)
• Server: Replace the plan-mode lock counterexample test (#30921, cc51592) (@ibetitsmike)
• Server: Table the chatstate queue and invalid-state endpoint tests (#30941, 83cdc8e) (@ibetitsmike)
• Server: Share one server across the chat message pagination tests (#30965, 5a1a059) (@ibetitsmike)
• Server: Run the TestPostChats model and org rejections on one server (#30975, cfddedb) (@ibetitsmike)
• Server: Cover advisor eligibility in the tool policy table (#30990, 300f73b) (@ibetitsmike)
• Server: Share one server across the chat child archive tests (#30956, f34aaeb) (@ibetitsmike)
• Server: Run the TestPostChats workspace, input, and MCP rejections on one server (#30976, 56fe6ec) (@ibetitsmike)
• Server: Remove the end-to-end advisor gating tests (#30991, ac62f2e) (@ibetitsmike)
• Server: Remove end-to-end root and child tool list tests (#30992, c78cecc) (@ibetitsmike)
• Server: Fold the duplicate advisor scenarios (#30993, 9cda919) (@ibetitsmike)
• Agent: Cover session runtime and transcripts (#30841, 9add27f)
• Server: Move the Anthropic guard unit test into its own file (#30968, 94b4c9d) (@ibetitsmike)
• Server: Make the chatd idle wait fail on timeout (#30967, b9e1302) (@ibetitsmike)
• Server: Move the Anthropic guard unit test into chatsanitize (#30969, 0647a09) (@ibetitsmike)
• Server: Fold the effort clamp fixture into the pending-user test (#30942, 453e21a) (@ibetitsmike)
• Server: Merge the computer-use child CreateChat tests (#30943, bcaf21b) (@ibetitsmike)
• Server: Assert the compaction debug run finishes (#31328, c8ed6f6) (@ibetitsmike)
• Server: Reuse recordingPubsub in the task test fixture (#30923, f0b6bf1) (@ibetitsmike)
• Server: Table the text and error tool result rows in memory (#30945, fa7ed93) (@ibetitsmike)
• Server: Table the OpenAI fake positive tests and fail on error streams (#30948, 8bafa8d) (@ibetitsmike)
• Server: Fold taskTestFixture into workerTestFixture (#30924, 7dee434) (@ibetitsmike)
• Server: Table the media codec matrix in memory (#30946, b32aff6) (@ibetitsmike)
• Server: Pin the fake response-shape errors (#30949, 3cc2861) (@ibetitsmike)
• Server: Run the advisor config tests on one server (#30986, 9848c41) (@ibetitsmike)

Continuous integration

• Validate docs/redirects.json (#30209, bb58916) (@nickvigilante)
• Skip the gen job for docs-only PRs that cannot change its output (#30164, b9c0853) (@nickvigilante)
• Start the heaviest test packages first (#29491, 5da4462) (@ibetitsmike)
• ci(scripts/docsredirectscheck): reject redirects an earlier rule swallows (#30383, 35b3052) (@nickvigilante)
• Add coder[bot] to CLA allowlist (#30502, 2810038) (@matifali)
• Keep coder-preview images for 30 days instead of 7 (#30635, 594bc82) (@denisra)
• Fail the test process with a heap profile when memory passes a per-runner limit (#30487, 11f1ee7) (@BobbyHo)
• Add coder-backporter-app[bot] to CLA allowlist (#30798, 34e8125) (@aslilac)
• ci(.github): time out stalled Go module downloads (#30889, 7298a29) (@ethanndickson)
• Bump paralleltestctx to detect timeout contexts used through closures (#31039, 86ea5d4) (@ethanndickson)
• Raise the Linux Go temp dir tmpfs to 16g (#31115, 14f66c0) (@ethanndickson)
• Install site dependencies before formatting generated JSON (#31170, d8a4d30) (@jscottmiller)
• ci(.github/workflows): run setup-go-paths in nightly-gauntlet (#31382, 542e5b6) (@ethanndickson)
• ci(.github/workflows): add doc-check kill switch and auth-failure stop (#31242, 44285af) (@nickvigilante)

Chores

• Update CODEOWNERS (#30174, 2a81d59) (@ssncferreira)
• Mark nested CLI reference pages as generated (#30162, f0a68f5) (@nickvigilante)
• Refresh AI model price book (#30233, b530f01) (@cdrci)
• Extract recorder construction (#30224, f96d269) (@pawbana)
• Mark generated configuration and API key scope docs as linguist-generated (#30365, cdbfcbf) (@nickvigilante)
• Enable no-fallthrough oxlint rule (#29947, 0fcc897) (@jeremyruppel)
• Enable no-danger oxlint rule (#29950, 08c54ab)
• Enable click-events-have-key-events oxlint rule (#29948, e778641)
• Disable Biome rules noInferrableTypes, useConsistentCurlyBraces, and noEmptyInterface (#29959, bd1f21f) (@aqandrew)
• Update references to the relocated install docs paths (#30380, 28cf704) (@nickvigilante)
• Remove the Coder Agents chat board prototype (#30394, 02a12fe) (@mafredri)
• Add code owners for docs/ and the docs CI (#30114, 9ce4f2f) (@nickvigilante)
• Improve code vpn-daemon run help text (#30331, dad9f73) (@aslilac)
• Refresh AI model price book (#30498, 315789c) (@cdrci)
• Update cost control codeowners (#30505, 483d889) (@ssncferreira)
• Enable no-console oxlint rule (#30521, ac33ffa) (@jeremyruppel)
• Adjust security policy to explicitly exclude volumetric DDoS (#30548, 4276b93) (@Lisa-Fiander)
• Enable exhaustive-deps oxlint rule (#30569, 408cc8e)
• Remove unused autofill-parameters endpoint and experiment (#30525, 86ebc72) (@aslilac)
• Add golangci new-code quality gates (#30622, 7517301)
• Add frontend-deep-review agent skill (#30182, 0702372) (@ibetitsmike)
• Refresh AI model price book (#30828, 7e69cd0) (@cdrci)
• Johnstcn -> mafredri as code owner for protobufs (#30852, 5cd67a4) (@spikecurtis)
• Bump bundled terraform to 1.16.6 (#30516, 1166601) (@app/coder)
• Server: Log workspace agent lookup errors in turn preparation (#30865, 2088618) (@ibetitsmike)
• Check out text files with LF line endings on every OS (#31041, 8ec252f) (@ethanndickson)
• Remove accidentally committed releaser binary (#31062, 45e392b) (@f0ssel)
• Documentation: Update release docs for v2.38.1 (#31063, ce3cd6f) (@brittany-coder)
• Add ssncferreira and SasSwart as code owners of AI query files (#31116, 409cdf6) (@SasSwart)
• Remove shadow from badge component (#31124, bd1b106) (@jaaydenh)
• Enable no-noninteractive-tabindex oxlint rule (#31146, 2dd492e) (@aqandrew)
• Dashboard: Enable oxlint correctness category (#31127, 4fd773a) (@jeremyruppel)
• Database: Drop the chat debug stale-sweep indexes (#31009, 98104d1) (@ibetitsmike)
• Refresh AI model price book (#31162, 04d7d4d) (@cdrci)
• Dashboard: Stop emitting hidden source maps in production builds (#31232, 8315d74) (@kylecarbs)
• chore(Makefile): group embedded slim binaries by architecture (#31233, e7b8033) (@kylecarbs)
• Bump Node.js to 22.23.4 (#31263, 8cf19bd) (@Lisa-Fiander)
• Bump github.com/andybalholm/brotli to v1.2.7 (#31231, 10e7b3f) (@Shelnutt2)
• Dashboard: Upgrade storybook and addons to 10.6.2 (#30688, 26aa086) (@jeremyruppel)
• Documentation: Update release docs for v2.38.2 (#31218, 9bf68b8) (@brittany-coder)
• Use go test cache for test-go-pg-17 and test-go-race-pg (#31295, b2e6f89) (@sreya)
• Skip Storybook on PRs without site changes (#31298, 578b527) (@sreya)
• Dashboard: Enable no-useless-fallback-in-spread oxlint rule (#31229, 46c0cfd)
• Dashboard: Enable no-conditional-tests oxlint rule (#31228, 19ad8f3)
• Dashboard: Enable static-components oxlint rule (#31224, bcafbe2) (@jeremyruppel)
• Dashboard: Enable preserve-manual-memoization oxlint rule (#31240, fc13808)
• Dashboard: Enable control-has-associated-label oxlint rule (#31239, 8987768)
• Dashboard: Enable no-noninteractive-element-interactions oxlint rule (#31238, 711f64b)
• Dashboard: Enable no-useless-spread oxlint rule (#31241, 9b34c5a)
• Sync fantasy with upstream v0.45.5 (#31288, 1aff810) (@mafredri)
• Documentation: Update release docs for v2.29.23 (#31320, 255850f) (@f0ssel)
• Documentation: Update release docs for v2.38.3 (#31314, 94d209b) (@brittany-coder)
• Comment out docs directory owner in CODEOWNERS (#31361, ba738b6) (@nickvigilante)
• Bump coder/preview and coder/trivy to converge random_* values passed into modules (#31357, 76d9452) (@BobbyHo)

Compare: 4a67ac3306657da8290c426903e09bee2eb95057...v2.39.0

Container image

• docker pull ghcr.io/coder/coder:v2.39.0

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.