Coder Files

Changelog

[!NOTE] This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

BREAKING CHANGES

• Use client IP when creating connection logs for workspace proxied app accesses (#19788, 6a9b896f5) (@ethanndickson)

  The presence of the ip field on codersdk.ConnectionLog cannot be guaranteed, and so the field has been made optional. It may be omitted on API responses.

• Server: Only show task status for current build (#19966, eb55f0ab1) (@johnstcn)

  Renames the TaskStateCompleted constant to TaskStateComplete to align with the tense used in WorkspaceAppStatusStateComplete, requiring any code referencing the constant to be updated.

• Rename prompt field to input for task creation (#19982, eb7473283) (@DanielleMaywood)

  Renames the CreateTaskRequest.Prompt to CreateTaskRequest.Input to align with language used in our CLI and elsewhere in the codebase.

Features

AI Bridge

AI Bridge, the self-hosted LLM proxy for auditing LLM tools and adoption is now in Early access, get started with our setup guide.

• Add aibridgedserver pkg (#19902, 615585d5d) (@dannykopping)
• Add aibridged package (#19797, fc9bff710) (@dannykopping)
• Initialize aibridged & mount API handler (#19798, 0a7981705) (@dannykopping)
• Add endpoint to list aibridge interceptions (#19929, 0a6ba5d51) (@pawbana)

MCP Server

New tools added to the Coder MCP Server in Beta.

• Add coder_workspace_read_file MCP tool (#19562, 4bf63b406) (@code-asher)
• Add tooltip field to workspace app that renders as markdown (#19651, e53bc247e) (@rafrdz)
• Add coder_workspace_write_file MCP tool (#19591, d5a02d570) (@code-asher)
• Add configs for external auth MCP usage + tool allow/denylist (#19794, 348a2e028) (@dannykopping)
• Add coder_workspace_edit_file MCP tool (#19629, 30330abae) (@code-asher)
• Add coder_workspace_ls MCP tool (#19652, be7aa5807) (@code-asher)
• Add coder_workspace_port_forward MCP tool (#19863, 7f5621277) (@code-asher)
• Aibridged mcp handling (#19911, 6971f612b) (@dannykopping)

Tasks

v2.27.0 introduces the Tasks API (in beta) for integrating background agents into your ecosystem. Read more in our documentation and blog posts.

• Don't redirect to task page when it is created (#19919, 6d0943a53) (@BrunoQuaresma)
• Add sidebar to task page (#19944, 2df9c5b6b) (@BrunoQuaresma)
• Redesign tasks page to match AI tools (#19962, 89339f6e5) (@BrunoQuaresma)
• Add notification for task status (#19965, fdb0267e5) (@ssncferreira)
• Delete task from sidebar (#20023, e96d69ba9) (@BrunoQuaresma)
• Minor prompt redesign (#20045, f009ebd66) (@BrunoQuaresma)
• CLI: Add coder exp task delete (#19644, 3470632db) (@mafredri)
• CLI: Add quiet flag to task create (#19701, f94abfc83) (@DanielleMaywood)
• CLI: Add optional --name arg to 'exp task create' (#19939, 78b1ec969) (@johnstcn)
• CLI: Add exp task send (#19922, 252f430eb) (@DanielleMaywood)
• CLI: Add formatting options to coder whoami (#19970, 930bbaf03) (@johnstcn)
• CLI: Improve exp task status --watch (#19969, 82bebc7cc) (@johnstcn)
• CLI: Add exp task logs (#19915, b7e0b2a73) (@DanielleMaywood)
• CLI: Add more information to coder whoami (#19971, 0a840e48f) (@johnstcn)
• CLI: Add ability to create tasks for other users (#20012, abdea7213) (@johnstcn)
• CLI: Add workspace-updates scaletest command (#19905, 0be922170) (@ethanndickson)

Workspace sharing

Shared workspaces are in the early stages of development and not ready for public testing; we're looking forward to sharing the work when it's available. If you have requests for shared workspaces, please leave feedback in our Github Discussions.

• Add sharing add command to the CLI (#19576, 909acbc83) (@brettkolodny)
• Add sharing show command to the CLI (#19707, 065c7c3d5) (@brettkolodny)
• Add sharing remove command to the CLI (#19767, 8d5c566a9) (@brettkolodny)
• Add --shared-with-me flag to coder list command (#19948, 647101b42) (@brettkolodny)

Core

• Add user filter to templates page to filter by template author (#19561, 95dccf342) (@rafrdz)
• Add default workspace name to Template Embed form (#19688, 5c1a708c7) (@mtojek)
• Add workspaces/acl [delete] endpoint (#19772, 854f3c018) (@brettkolodny)
• Add helm var to support RBAC for deploying workspaces in extra namespaces (#19517, 623893708) (@rowansmithau)
• Add shared_with_group: and shared_with_user: filters to /workspaces endpoint (#19875, 38ca98745) (@brettkolodny)
• Show warning in AppLink if hostname is long enough to break port forwarding (#19506, 6c01a772e) (@aqandrew)
• Add prebuild timing metrics to Prometheus (#19503, 0ab345ca8) (@ssncferreira)
• Replace the jetbrains-gateway module with the jetbrains toolbox (#19583, b61a5d7c3) (@app/blink-so)
• Support custom notifications (#19751, eec6c8c12) (@ssncferreira)
• Ensure OAuth2 refresh tokens outlive access tokens (#19769, 088d14933) (@ThomasK33)
• Scope allow_list to include resource_type (#19748, 679179f40) (@Emyrk)
• Add best effort attempt to revoke oauth access token in external auth provider (#19775, 439b04178) (@pawbana)
• Implement API key scopes database migration (#19861, fb0ce389a) (@ThomasK33)
• Add lint check for API key scope enum completeness (#19862, acc0890dc) (@ThomasK33)
• Generate RBAC scope name constants (#19896, adb752106) (@ThomasK33)
• Add scaletest Runner for dynamicparameters load gen (#19890, 289f0217c) (@spikecurtis)
• Add public RBAC scope catalog for user-requestable permissions (#19913, 47c92ad1d) (@ThomasK33)
• Add external API key scopes (#19916, 4bda39585) (@ThomasK33)
• Add multi-scope support to API keys (#19917, d0db9ec88) (@ThomasK33)
• Publish RBAC scopes in OAuth2 metadata endpoints (#19942, 05537c189) (@ThomasK33)
• Remove agent name from app URLs (#19750, d29a52462) (@rafrdz)
• Implement composite API key scopes for workspaces and templates (#19945, 79126ab6c) (@ThomasK33)
• Server: Add tasks delete endpoint (#19638, e5ac640e5) (@mafredri)
• Server: Allow specifying a name for a task (#19745, f3b152bb0) (@DanielleMaywood)
• Server: Add experimental tasks send endpoint (#19941, 5317d309d) (@mafredri)
• Server: Add experimental tasks logs endpoint (#19958, 0bac5a4d5) (@mafredri)
• Server: Add ability to search org members by user_id, is_system, github_user_id (#20048, ff930ad4f) (@johnstcn)
• Dashboard: Display warning messages when wildcard is not configured (#19660, 7c8f8f449) (@kacpersaw)
• Dashboard: Display warnings in tasks page when wildcard is not configured (#19780, 0601cc8fa) (@kacpersaw)
• Dashboard: Allow starting task workspace from task page (#19790, b71d6713d) (@DanielleMaywood)
• Dashboard: Add custom notification settings (#19938, da467bad2) (@ssncferreira)
• Dashboard: Add task notifications to user settings (#20006, 7bddd80d6) (@ssncferreira)
• Enterprise: Allow system users to be added to groups (#19518, 4e9ee8088) (@SasSwart)

Bug fixes

• Don't show prebuild workspaces as tasks (#19572, abc946c5b) (@BrunoQuaresma)
• Suppress license expiry warning if a new license covers the gap (#19601, 605dad8b1) (@deansheather)
• Limit the scope of the template average build time query to the last 100 (#19648, 4fab14b40) (@cstyan)
• Expire token for prebuilds user when regenerating session token (#19667, 06cbb2890) (@johnstcn)
• Show popup on successful template build (#19674, d415964b9) (@mtojek)
• Change enqueue error to debug log level (#19686, 04dfda8a0) (@spikecurtis)
• Pin pg_dump version when generating schema (#19696, 1b4ce0909) (@ethanndickson)
• Prevent new workspace page from scrolling past the bottom of the screen (#19705, a78d65c8b) (@brettkolodny)
• Support path parameters in OAuth2 metadata endpoints (#19729, 2701d5588) (@ThomasK33)
• Add xmlns attribute to amazon-q.svg for proper rendering (#19738, d7d69d1ce) (@app/blink-so)
• Add support for spaces in search & enable searching by display name in templates (#19552, 1677a30a1) (@rafrdz)
• Prevent unruly stacking contexts from breaking scrolling (#19785, 8e79dbb16) (@aslilac)
• Trim whitespace from API tokens (#19814, d238480c7) (@ThomasK33)
• Scroll item list into view when opening MultiSelectCombobox (#19806, 8ff4ba0c7) (@aslilac)
• Correct MCP tools' input schemas (#19825, 18b0acab4) (@dannykopping)
• Use filepath to construct mcp test write path (#19808, c31768dfe) (@code-asher)
• Fix TestCloserStack_Timeout to wait for all asyncClosers (#19837, 4fc009338) (@spikecurtis)
• Update bitnami to use legacy image (#19891, 738dbc6d4) (@david-fraley)
• Update bitnami image (#19892, 40ffb7905) (@david-fraley)
• Add retry logic to OAuth2 metadata tests to avoid race conditions (#19813, 6fb4cc6b8) (@ThomasK33)
• Make app tabs scrollable (#19881, e7d648fb2) (@BrunoQuaresma)
• Use unique cookies for workspace proxies (#19930, 42dd544d9) (@deansheather)
• Force task to be created with latest version (#19923, 5ff503b8f) (@BrunoQuaresma)
• Handle chat app not found for Tasks (#19947, c2d514356) (@BrunoQuaresma)
• Fix for template dormancy hour/day toggle (#19884, aaa50715e) (@rowansmithau)
• Add tasks link to sidebar logo (#20038, b8370c25f) (@BrunoQuaresma)
• CLI: Enhance error handling for multiple agents in SSH command (#19943, c8742badb) (@kacpersaw)
• CLI: Only implicitly read from stdin if the directory flag is unset (#19681, f867a9d48) (@ethanndickson)
• Server: Filter out non-task workspaces in api.tasksList (#19559, dbc6c980b) (@johnstcn)
• Server: Ignore sub agents when converting a task to workspace (#19624, 75b38f12d) (@DanielleMaywood)
• Server: Fix logic for reporting prebuilt workspace duration metric (#19641, 353f5dedc) (@ssncferreira)
• Server: Ensure a newly created task can be fetched (#19670, 12bce1295) (@DanielleMaywood)
• Server: Add audit log on creating a new session key (#19672, bd6e91eea) (@johnstcn)
• Server: Ensure agent WebSocket conn is cleaned up (#19711, e12b621ff) (@DanielleMaywood)
• Server: Add blocking GetProvisionerJobByIDWithLock for workspace build cancellation (#19737, 776231d02) (@kacpersaw)
• Server: Fix parsing of response format in tasks send (#19960, 653101e5f) (@mafredri)
• Server: Increase task notification dedupe bypass timestamp to 1 minute (#20043, 6e4d903a8) (@johnstcn)
• Server: Workaround lack of coder_ai_task resource on stop transition (#19560, bd139f3a4) (@johnstcn)
• Server: Ensure generated name is within 32 byte limit (#19612, 347ab5b34) (@DanielleMaywood)
• Documentation: Add missing div to fix formatting (#20047, fe189b9cc) (@david-fraley)
• Dashboard: Show available logs consistently on template creation page (#19832, f5fac293d) (@aslilac)
• Dashboard: Update useAgentLogs to make it more testable and add more tests (#19126, 759746cbf) (@Parkreiner)
• Dashboard: Revamp UI for batch-updating workspaces (#18895, 8a6852f09) (@Parkreiner)
• Dashboard: Resolve circular dependency between WorkspacesPage components (#19895, d46436010) (@BrunoQuaresma)

Documentation

• Replace offline deployments terminology to air-gapped (#19625, 02ecf32af) (@app/blink-so)
• Update Tailscale DERP fleet usage phrasing (#19653, 20309074d) (@hugodutka)
• Reorganize Coder Desktop docs (#18871, 8f72538ab) (@matifali)
• Add guidelines about PR size (#19700, d25ff6c48) (@spikecurtis)
• Fix typo in Coder Desktop Guide (#19742, f402ec99e) (@david-fraley)
• Update Get Started Page to Include Tasks (#19752, 1e2b66fb2) (@david-fraley)
• Remove beta references from dynamic parameters (#19714, c9a877a38) (@app/blink-so)
• Fix formatting issues (#19831, cda859363) (@david-fraley)
• Update Tasks Template Code (#19770, ea718084f) (@david-fraley)
• Clarify offline CLI installation instructions (#19914, d2da8357c) (@matifali)
• Add next steps to coder desktop guide (#19975, 659f23773) (@ethanndickson)
• Add Tasks Core Principles Page (#19878, 95aa16df1) (@david-fraley)
• Orient install page towards enterprise and community members (#20041, 7481ada29) (@david-fraley)
• update Claude Code version in docs (#20049, bf2cfddac) (@david-fraley)
• Document automatic task naming (#19614, 8d6a32234) (@johnstcn)
• Add docs for external workspaces (#19437, 33509f2c2) (@kacpersaw)
• Add wildcard access url documentation page (#19713, f9f0ebb47) (@kacpersaw)

Performance improvements

• Reduce impact of GetPrebuildMetrics on database (#19694, 0ec9df390) (@cstyan)
• Database: Optimize GetAPIKeysLastUsedAfter (#19725, 21402c7aa) (@mafredri)
• Enterprise: Remove expensive GetWorkspaces query from entitlements (#19747, 307454732) (@kacpersaw)

Chores

• Pin dependencies in Dockerfiles (#19587, 252f7d461) (@sreya)
• Pin devcontainer-cli for .devcontainer config (#19594, 0f1fc88d5) (@sreya)
• Set more explicit guards for serving bin files (#19597, be40b8ca3) (@sreya)
• Upgrade our tailscale fork to address CVE (#19634, 71ea919c2) (@spikecurtis)
• Update coder/preview to v1.0.4 (#19640, f57173071) (@Emyrk)
• Refactor instance identity to be a SessionTokenProvider (#19566, 1354d84eb) (@spikecurtis)
• Refactor CLI agent auth tests as unit tests (#19609, 18945a794) (@spikecurtis)
• Update rego policy to respect user and organisation scopes (#19741, d527f91f4) (@Emyrk)
• Add backed reader, writer and pipe implementation (#19147, 4c98decfb) (@ibetitsmike)
• Add aibridge configs & experiment (#19793, 848721654) (@dannykopping)
• Add aibridge database resources & define RBAC policies (#19796, 422bba44d) (@dannykopping)
• Upgrade to react 19 (#19829, 8db82d25b) (@aslilac)
• Upgrade Node.js from 20.19.4 to 22.19.0 and update dependencies (#19870, 4d8dc221b) (@ThomasK33)
• Add tasks sidebar component (#19926, 7baaa16ac) (@BrunoQuaresma)
• Add CLI command to list aibridge interceptions (#19935, 65f2895c0) (@pawbana)
• CLI: Re-order CLI create command (#19658, a2a758d5a) (@DanielleMaywood)
• Dashboard: Add rustdesk icon (#19888, f39cf3091) (@BenraouaneSoufiane)

Compare: v2.26.1...v2.27.0

Container image

• docker pull ghcr.io/coder/coder:v2.27.0

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.