coder · ethanndickson · Aug 24, 2026 · Aug 20, 2026 · Aug 20, 2026 · Aug 20, 2026
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/audit/diff.go b/coderd/audit/diff.go
@@ -45,7 +45,8 @@ type Auditable interface {
 		database.AuditableUserAIBudgetOverride |
 		database.UserSecret |
 		database.UserSkill |
-		database.ChatInstructionSettings
+		database.ChatInstructionSettings |
+		database.ChatOperationalSettings
 }
 
 // Map is a map of changed fields in an audited resource. It maps field names to

diff --git a/coderd/audit/request.go b/coderd/audit/request.go
@@ -167,6 +167,8 @@ func ResourceTarget[T Auditable](tgt T) string {
 		return typed.Name
 	case database.ChatInstructionSettings:
 		return typed.Name
+	case database.ChatOperationalSettings:
+		return ""
 	default:
 		panic(fmt.Sprintf("unknown resource %T for ResourceTarget", tgt))
 	}
@@ -275,6 +277,8 @@ func ResourceID[T Auditable](tgt T) uuid.UUID {
 	case database.ChatInstructionSettings:
 		// Fixed ID per setting; see ChatInstructionSettings IDs.
 		return typed.ID
+	case database.ChatOperationalSettings:
+		return typed.ID
 	default:
 		panic(fmt.Sprintf("unknown resource %T for ResourceID", tgt))
 	}
@@ -356,6 +360,8 @@ func ResourceType[T Auditable](tgt T) database.ResourceType {
 		return database.ResourceTypeUserSkill
 	case database.ChatInstructionSettings:
 		return database.ResourceTypeChatInstructionSettings
+	case database.ChatOperationalSettings:
+		return database.ResourceTypeChatOperationalSettings
 	default:
 		panic(fmt.Sprintf("unknown resource %T for ResourceType", typed))
 	}
@@ -454,6 +460,8 @@ func ResourceRequiresOrgID[T Auditable]() bool {
 	case database.ChatInstructionSettings:
 		// Deployment settings, not scoped to any organization.
 		return false
+	case database.ChatOperationalSettings:
+		return false
 	default:
 		panic(fmt.Sprintf("unknown resource %T for ResourceRequiresOrgID", tgt))
 	}

diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
@@ -3647,6 +3647,13 @@ func (q *querier) GetChatRetentionDays(ctx context.Context) (int32, error) {
 	return q.db.GetChatRetentionDays(ctx)
 }
 
+func (q *querier) GetChatSiteConfigValue(ctx context.Context, configKey string) (database.GetChatSiteConfigValueRow, error) {
+	if err := q.authorizeContext(ctx, policy.ActionUpdate, rbac.ResourceDeploymentConfig); err != nil {
+		return database.GetChatSiteConfigValueRow{}, err
+	}
+	return q.db.GetChatSiteConfigValue(ctx, configKey)
+}
+
 func (q *querier) GetChatStreamSyncRows(ctx context.Context, ids []uuid.UUID) ([]database.GetChatStreamSyncRowsRow, error) {
 	if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceChat); err != nil {
 		return nil, err

diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
@@ -1358,6 +1358,11 @@ func (s *MethodTestSuite) TestChats() {
 		check.Args(orgID).Asserts(objectA, policy.ActionRead, objectB, policy.ActionRead).Returns([]database.GetEnabledChatModelConfigsByOrganizationRow{rowA, rowB})
 	}))
 
+	s.Run("GetChatSiteConfigValue", s.Mocked(func(dbm *dbmock.MockStore, _ *gofakeit.Faker, check *expects) {
+		row := database.GetChatSiteConfigValueRow{Value: "30", Exists: true}
+		dbm.EXPECT().GetChatSiteConfigValue(gomock.Any(), "agents_chat_retention_days").Return(row, nil).AnyTimes()
+		check.Args("agents_chat_retention_days").Asserts(rbac.ResourceDeploymentConfig, policy.ActionUpdate).Returns(row)
+	}))
 	s.Run("GetStaleChats", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
 		threshold := dbtime.Now()
 		chats := []database.Chat{testutil.Fake(s.T(), faker, database.Chat{})}

diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
diff --git a/coderd/database/migrations/000584_audit_chat_operational_settings.down.sql b/coderd/database/migrations/000584_audit_chat_operational_settings.down.sql
@@ -0,0 +1 @@
+-- PostgreSQL does not support removing enum values.
diff --git a/coderd/database/migrations/000584_audit_chat_operational_settings.up.sql b/coderd/database/migrations/000584_audit_chat_operational_settings.up.sql
@@ -0,0 +1 @@
+ALTER TYPE resource_type ADD VALUE IF NOT EXISTS 'chat_operational_settings';
diff --git a/coderd/database/models.go b/coderd/database/models.go
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
diff --git a/coderd/database/querier_test.go b/coderd/database/querier_test.go
@@ -19517,3 +19517,35 @@ func TestGetAIModelPrices(t *testing.T) {
 		})
 	}
 }
+
+func TestGetChatSiteConfigValue(t *testing.T) {
+	t.Parallel()
+
+	ctx := testutil.Context(t, testutil.WaitShort)
+	db, _ := dbtestutil.NewDB(t)
+
+	require.NoError(t, db.UpsertRuntimeConfig(ctx, database.UpsertRuntimeConfigParams{
+		Key:   "agents_chat_retention_days",
+		Value: "30",
+	}))
+	require.NoError(t, db.UpsertRuntimeConfig(ctx, database.UpsertRuntimeConfigParams{
+		Key:   "agents_unset",
+		Value: "not a chat setting",
+	}))
+	require.NoError(t, db.UpsertRuntimeConfig(ctx, database.UpsertRuntimeConfigParams{
+		Key:   "derp_mesh_key",
+		Value: "secret",
+	}))
+
+	value, err := db.GetChatSiteConfigValue(ctx, "agents_chat_retention_days")
+	require.NoError(t, err)
+	require.Equal(t, database.GetChatSiteConfigValueRow{Value: "30", Exists: true}, value)
+
+	value, err = db.GetChatSiteConfigValue(ctx, "agents_unset")
+	require.NoError(t, err)
+	require.Equal(t, database.GetChatSiteConfigValueRow{}, value)
+
+	value, err = db.GetChatSiteConfigValue(ctx, "derp_mesh_key")
+	require.NoError(t, err)
+	require.Equal(t, database.GetChatSiteConfigValueRow{}, value)
+}
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
diff --git a/coderd/database/queries/siteconfig.sql b/coderd/database/queries/siteconfig.sql
@@ -378,3 +378,20 @@ INSERT INTO site_configs (key, value)
 VALUES ('agents_chat_auto_archive_days', CAST(@auto_archive_days AS integer)::text)
 ON CONFLICT (key) DO UPDATE SET value = CAST(@auto_archive_days AS integer)::text
 WHERE site_configs.key = 'agents_chat_auto_archive_days';
+
+-- GetChatSiteConfigValue returns raw text and row presence for an audited chat site configuration.
+-- name: GetChatSiteConfigValue :one
+SELECT
+    COALESCE(MAX(site_configs.value), '')::text AS value,
+    COUNT(*) > 0 AS exists
+FROM site_configs
+WHERE site_configs.key = sqlc.arg(config_key)
+    AND site_configs.key IN (
+        'agents_chat_retention_days',
+        'agents_chat_debug_retention_days',
+        'agents_chat_auto_archive_days',
+        'agents_workspace_ttl',
+        'agents_computer_use_provider',
+        'agents_chat_debug_logging_allow_users',
+        'agents_chat_personal_model_overrides_enabled'
+    );
diff --git a/coderd/database/types.go b/coderd/database/types.go
@@ -70,6 +70,18 @@ type ChatInstructionSettings struct {
 	PlanModeInstructions          string `db:"plan_mode_instructions" json:"plan_mode_instructions"`
 }
 
+// ChatOperationalSettings contains deployment-wide chat settings for audit logging.
+type ChatOperationalSettings struct {
+	ID                            uuid.UUID `db:"id" json:"id"`
+	ChatRetentionDays             string    `db:"chat_retention_days" json:"chat_retention_days"`
+	ChatDebugRetentionDays        string    `db:"chat_debug_retention_days" json:"chat_debug_retention_days"`
+	ChatAutoArchiveDays           string    `db:"chat_auto_archive_days" json:"chat_auto_archive_days"`
+	WorkspaceTTL                  string    `db:"workspace_ttl" json:"workspace_ttl"`
+	ComputerUseProvider           string    `db:"computer_use_provider" json:"computer_use_provider"`
+	DebugLoggingAllowUsers        string    `db:"debug_logging_allow_users" json:"debug_logging_allow_users"`
+	PersonalModelOverridesEnabled string    `db:"personal_model_overrides_enabled" json:"personal_model_overrides_enabled"`
+}
+
 type Actions []policy.Action
 
 func (a *Actions) Scan(src interface{}) error {
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		-- PostgreSQL does not support removing enum values.
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		ALTER TYPE resource_type ADD VALUE IF NOT EXISTS 'chat_operational_settings';