diff --git a/aibridge/fixtures/fixtures.go b/aibridge/fixtures/fixtures.go
index 7a30ccbd631a1..9b2e8ad7f6870 100644
--- a/aibridge/fixtures/fixtures.go
+++ b/aibridge/fixtures/fixtures.go
@@ -67,6 +67,9 @@ var (
 
 	//go:embed openai/chatcompletions/streaming_injected_tool_nonzero_index.txtar
 	OaiChatStreamingInjectedToolNonzeroIndex []byte
+
+	//go:embed openai/chatcompletions/streaming_cumulative_usage_injected_tool.txtar
+	OaiChatStreamingCumulativeUsageInjectedTool []byte
 )
 
 var (
diff --git a/aibridge/fixtures/openai/chatcompletions/simple.txtar b/aibridge/fixtures/openai/chatcompletions/simple.txtar
index 8f07d0c8ffae2..2f458c3af9854 100644
--- a/aibridge/fixtures/openai/chatcompletions/simple.txtar
+++ b/aibridge/fixtures/openai/chatcompletions/simple.txtar
@@ -492,7 +492,7 @@ data: {"id":"chatcmpl-BwoiPTGRbKkY5rncfaM0s9KtWrq5N","object":"chat.completion.c
 
 data: {"id":"chatcmpl-BwoiPTGRbKkY5rncfaM0s9KtWrq5N","object":"chat.completion.chunk","created":1753357673,"model":"gpt-4.1-2025-04-14","service_tier":"default","system_fingerprint":"fp_51e1070cf2","choices":[{"index":0,"delta":{},"logprobs":null,"finish_reason":"stop"}],"usage":null}
 
-data: {"id":"chatcmpl-BwoiPTGRbKkY5rncfaM0s9KtWrq5N","object":"chat.completion.chunk","created":1753357673,"model":"gpt-4.1-2025-04-14","service_tier":"default","system_fingerprint":"fp_51e1070cf2","choices":[],"usage":{"prompt_tokens":19,"completion_tokens":238,"total_tokens":257,"prompt_tokens_details":{"cached_tokens":0,"audio_tokens":0},"completion_tokens_details":{"reasoning_tokens":0,"audio_tokens":0,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}}}
+data: {"id":"chatcmpl-BwoiPTGRbKkY5rncfaM0s9KtWrq5N","object":"chat.completion.chunk","created":1753357673,"model":"gpt-4.1-2025-04-14","service_tier":"default","system_fingerprint":"fp_51e1070cf2","choices":[],"usage":{"prompt_tokens":19,"completion_tokens":238,"total_tokens":257,"prompt_tokens_details":{"cached_tokens":0,"cache_write_tokens":5,"audio_tokens":0},"completion_tokens_details":{"reasoning_tokens":0,"audio_tokens":0,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}}}
 
 data: [DONE]
 
@@ -521,6 +521,7 @@ data: [DONE]
     "total_tokens": 219,
     "prompt_tokens_details": {
       "cached_tokens": 0,
+      "cache_write_tokens": 5,
       "audio_tokens": 0
     },
     "completion_tokens_details": {
diff --git a/aibridge/fixtures/openai/chatcompletions/single_injected_tool.txtar b/aibridge/fixtures/openai/chatcompletions/single_injected_tool.txtar
index b89aac648a13b..61b4c1c321209 100644
--- a/aibridge/fixtures/openai/chatcompletions/single_injected_tool.txtar
+++ b/aibridge/fixtures/openai/chatcompletions/single_injected_tool.txtar
@@ -72,7 +72,7 @@ data: {"id":"chatcmpl-C1WTooFaxeQgtyLB1kg53t41aB0NV","object":"chat.completion.c
 
 data: {"id":"chatcmpl-C1WTooFaxeQgtyLB1kg53t41aB0NV","object":"chat.completion.chunk","created":1754479216,"model":"gpt-4.1-2025-04-14","service_tier":"default","system_fingerprint":"fp_799e4ca3f1","choices":[{"index":0,"delta":{},"logprobs":null,"finish_reason":"tool_calls"}],"usage":null,"obfuscation":"sDj"}
 
-data: {"id":"chatcmpl-C1WTooFaxeQgtyLB1kg53t41aB0NV","object":"chat.completion.chunk","created":1754479216,"model":"gpt-4.1-2025-04-14","service_tier":"default","system_fingerprint":"fp_799e4ca3f1","choices":[],"usage":{"prompt_tokens":4862,"completion_tokens":45,"total_tokens":4907,"prompt_tokens_details":{"cached_tokens":0,"audio_tokens":0},"completion_tokens_details":{"reasoning_tokens":0,"audio_tokens":0,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"obfuscation":"8sIWE1chOW"}
+data: {"id":"chatcmpl-C1WTooFaxeQgtyLB1kg53t41aB0NV","object":"chat.completion.chunk","created":1754479216,"model":"gpt-4.1-2025-04-14","service_tier":"default","system_fingerprint":"fp_799e4ca3f1","choices":[],"usage":{"prompt_tokens":4862,"completion_tokens":45,"total_tokens":4907,"prompt_tokens_details":{"cached_tokens":100,"cache_write_tokens":20,"audio_tokens":3},"completion_tokens_details":{"reasoning_tokens":4,"audio_tokens":5,"accepted_prediction_tokens":6,"rejected_prediction_tokens":7}},"obfuscation":"8sIWE1chOW"}
 
 data: [DONE]
 
@@ -200,7 +200,7 @@ data: {"id":"chatcmpl-C1WTqhYgK7bV01bW98Lww3zqaf8ZF","object":"chat.completion.c
 
 data: {"id":"chatcmpl-C1WTqhYgK7bV01bW98Lww3zqaf8ZF","object":"chat.completion.chunk","created":1754479218,"model":"gpt-4.1-2025-04-14","service_tier":"default","system_fingerprint":"fp_799e4ca3f1","choices":[{"index":0,"delta":{},"logprobs":null,"finish_reason":"stop"}],"usage":null,"obfuscation":"EFeFvdS8m"}
 
-data: {"id":"chatcmpl-C1WTqhYgK7bV01bW98Lww3zqaf8ZF","object":"chat.completion.chunk","created":1754479218,"model":"gpt-4.1-2025-04-14","service_tier":"default","system_fingerprint":"fp_799e4ca3f1","choices":[],"usage":{"prompt_tokens":5049,"completion_tokens":60,"total_tokens":5109,"prompt_tokens_details":{"cached_tokens":4864,"audio_tokens":0},"completion_tokens_details":{"reasoning_tokens":0,"audio_tokens":0,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"obfuscation":"0JQt7Fw"}
+data: {"id":"chatcmpl-C1WTqhYgK7bV01bW98Lww3zqaf8ZF","object":"chat.completion.chunk","created":1754479218,"model":"gpt-4.1-2025-04-14","service_tier":"default","system_fingerprint":"fp_799e4ca3f1","choices":[],"usage":{"prompt_tokens":5049,"completion_tokens":60,"total_tokens":5109,"prompt_tokens_details":{"cached_tokens":4864,"cache_write_tokens":10,"audio_tokens":9},"completion_tokens_details":{"reasoning_tokens":10,"audio_tokens":11,"accepted_prediction_tokens":12,"rejected_prediction_tokens":13}},"obfuscation":"0JQt7Fw"}
 
 data: [DONE]
 
@@ -237,16 +237,17 @@ data: [DONE]
   "usage": {
     "prompt_tokens": 4862,
     "completion_tokens": 45,
-    "total_tokens": 4914,
+    "total_tokens": 4907,
     "prompt_tokens_details": {
-      "cached_tokens": 0,
-      "audio_tokens": 0
+      "cached_tokens": 100,
+      "cache_write_tokens": 20,
+      "audio_tokens": 3
     },
     "completion_tokens_details": {
-      "reasoning_tokens": 0,
-      "audio_tokens": 0,
-      "accepted_prediction_tokens": 0,
-      "rejected_prediction_tokens": 0
+      "reasoning_tokens": 4,
+      "audio_tokens": 5,
+      "accepted_prediction_tokens": 6,
+      "rejected_prediction_tokens": 7
     }
   },
   "service_tier": "default",
@@ -276,16 +277,17 @@ data: [DONE]
   "usage": {
     "prompt_tokens": 5049,
     "completion_tokens": 60,
-    "total_tokens": 5119,
+    "total_tokens": 5109,
     "prompt_tokens_details": {
       "cached_tokens": 4864,
-      "audio_tokens": 0
+      "cache_write_tokens": 10,
+      "audio_tokens": 9
     },
     "completion_tokens_details": {
-      "reasoning_tokens": 0,
-      "audio_tokens": 0,
-      "accepted_prediction_tokens": 0,
-      "rejected_prediction_tokens": 0
+      "reasoning_tokens": 10,
+      "audio_tokens": 11,
+      "accepted_prediction_tokens": 12,
+      "rejected_prediction_tokens": 13
     }
   },
   "service_tier": "default",
diff --git a/aibridge/fixtures/openai/chatcompletions/streaming_cumulative_usage_injected_tool.txtar b/aibridge/fixtures/openai/chatcompletions/streaming_cumulative_usage_injected_tool.txtar
new file mode 100644
index 0000000000000..5474c4ac97599
--- /dev/null
+++ b/aibridge/fixtures/openai/chatcompletions/streaming_cumulative_usage_injected_tool.txtar
@@ -0,0 +1,30 @@
+Streaming response with cumulative usage on every JSON chunk and an injected tool call.
+
+-- request --
+{
+  "model": "gpt-4.1",
+  "messages": [
+    {
+      "role": "user",
+      "content": "list my coder workspaces"
+    }
+  ]
+}
+
+-- streaming --
+data: {"id":"chatcmpl-cumulative-tool","object":"chat.completion.chunk","created":1754479216,"model":"gpt-4.1","choices":[{"index":0,"delta":{"content":"Calling"}}],"usage":{"prompt_tokens":6000,"completion_tokens":10,"total_tokens":6010,"prompt_tokens_details":{"cached_tokens":100,"cache_write_tokens":10,"audio_tokens":1},"completion_tokens_details":{"reasoning_tokens":1,"audio_tokens":1,"accepted_prediction_tokens":1,"rejected_prediction_tokens":1}}}
+
+data: {"id":"chatcmpl-cumulative-tool","object":"chat.completion.chunk","created":1754479216,"model":"gpt-4.1","choices":[{"index":0,"delta":{"tool_calls":[{"index":0,"id":"call-cumulative","type":"function","function":{"name":"bmcp_coder_coder_list_workspaces","arguments":"{}"}}]}}],"usage":{"prompt_tokens":6000,"completion_tokens":20,"total_tokens":6020,"prompt_tokens_details":{"cached_tokens":100,"cache_write_tokens":10,"audio_tokens":2},"completion_tokens_details":{"reasoning_tokens":2,"audio_tokens":2,"accepted_prediction_tokens":2,"rejected_prediction_tokens":2}}}
+
+data: {"id":"chatcmpl-cumulative-tool","object":"chat.completion.chunk","created":1754479216,"model":"gpt-4.1","choices":[{"index":0,"delta":{},"finish_reason":"tool_calls"}],"usage":{"prompt_tokens":6000,"completion_tokens":30,"total_tokens":6030,"prompt_tokens_details":{"cached_tokens":100,"cache_write_tokens":10,"audio_tokens":3},"completion_tokens_details":{"reasoning_tokens":4,"audio_tokens":5,"accepted_prediction_tokens":6,"rejected_prediction_tokens":7}}}
+
+data: [DONE]
+
+-- streaming/tool-call --
+data: {"id":"chatcmpl-cumulative-final","object":"chat.completion.chunk","created":1754479217,"model":"gpt-4.1","choices":[{"index":0,"delta":{"content":"Done"}}],"usage":{"prompt_tokens":6000,"completion_tokens":10,"total_tokens":6010,"prompt_tokens_details":{"cached_tokens":200,"cache_write_tokens":20,"audio_tokens":7},"completion_tokens_details":{"reasoning_tokens":8,"audio_tokens":9,"accepted_prediction_tokens":10,"rejected_prediction_tokens":11}}}
+
+data: {"id":"chatcmpl-cumulative-final","object":"chat.completion.chunk","created":1754479217,"model":"gpt-4.1","choices":[{"index":0,"delta":{"content":"."}}],"usage":{"prompt_tokens":6000,"completion_tokens":20,"total_tokens":6020,"prompt_tokens_details":{"cached_tokens":200,"cache_write_tokens":20,"audio_tokens":8},"completion_tokens_details":{"reasoning_tokens":9,"audio_tokens":10,"accepted_prediction_tokens":11,"rejected_prediction_tokens":12}}}
+
+data: {"id":"chatcmpl-cumulative-final","object":"chat.completion.chunk","created":1754479217,"model":"gpt-4.1","choices":[{"index":0,"delta":{},"finish_reason":"stop"}],"usage":{"prompt_tokens":6000,"completion_tokens":30,"total_tokens":6030,"prompt_tokens_details":{"cached_tokens":200,"cache_write_tokens":20,"audio_tokens":9},"completion_tokens_details":{"reasoning_tokens":10,"audio_tokens":11,"accepted_prediction_tokens":12,"rejected_prediction_tokens":13}}}
+
+data: [DONE]
diff --git a/aibridge/fixtures/openai/responses/blocking/cached_input_tokens.txtar b/aibridge/fixtures/openai/responses/blocking/cached_input_tokens.txtar
index 41a6d7ca7e36b..66689d6a48378 100644
--- a/aibridge/fixtures/openai/responses/blocking/cached_input_tokens.txtar
+++ b/aibridge/fixtures/openai/responses/blocking/cached_input_tokens.txtar
@@ -68,7 +68,8 @@
   "usage": {
     "input_tokens": 12033,
     "input_tokens_details": {
-      "cached_tokens": 11904
+      "cached_tokens": 11904,
+      "cache_write_tokens": 15
     },
     "output_tokens": 44,
     "output_tokens_details": {
diff --git a/aibridge/fixtures/openai/responses/blocking/single_injected_tool.txtar b/aibridge/fixtures/openai/responses/blocking/single_injected_tool.txtar
index 028377dcaa9f5..ce46145d78d6f 100644
--- a/aibridge/fixtures/openai/responses/blocking/single_injected_tool.txtar
+++ b/aibridge/fixtures/openai/responses/blocking/single_injected_tool.txtar
@@ -749,7 +749,8 @@ Coder MCP tools automatically injected.
   "usage": {
     "input_tokens": 6371,
     "input_tokens_details": {
-      "cached_tokens": 6144
+      "cached_tokens": 6144,
+      "cache_write_tokens": 7
     },
     "output_tokens": 75,
     "output_tokens_details": {
@@ -1509,7 +1510,8 @@ Coder MCP tools automatically injected.
   "usage": {
     "input_tokens": 6756,
     "input_tokens_details": {
-      "cached_tokens": 6144
+      "cached_tokens": 6144,
+      "cache_write_tokens": 11
     },
     "output_tokens": 231,
     "output_tokens_details": {
diff --git a/aibridge/fixtures/openai/responses/blocking/single_injected_tool_error.txtar b/aibridge/fixtures/openai/responses/blocking/single_injected_tool_error.txtar
index 9e4c2716f20f1..17c180d7dc509 100644
--- a/aibridge/fixtures/openai/responses/blocking/single_injected_tool_error.txtar
+++ b/aibridge/fixtures/openai/responses/blocking/single_injected_tool_error.txtar
@@ -749,7 +749,8 @@ Coder MCP tools automatically injected, and errors invoking them are recorded.
   "usage": {
     "input_tokens": 6377,
     "input_tokens_details": {
-      "cached_tokens": 6144
+      "cached_tokens": 6144,
+      "cache_write_tokens": 5
     },
     "output_tokens": 119,
     "output_tokens_details": {
@@ -1509,7 +1510,8 @@ Coder MCP tools automatically injected, and errors invoking them are recorded.
   "usage": {
     "input_tokens": 6539,
     "input_tokens_details": {
-      "cached_tokens": 6144
+      "cached_tokens": 6144,
+      "cache_write_tokens": 9
     },
     "output_tokens": 144,
     "output_tokens_details": {
diff --git a/aibridge/fixtures/openai/responses/streaming/cached_input_tokens.txtar b/aibridge/fixtures/openai/responses/streaming/cached_input_tokens.txtar
index cc908d5abdf5a..8dffa4eabe994 100644
--- a/aibridge/fixtures/openai/responses/streaming/cached_input_tokens.txtar
+++ b/aibridge/fixtures/openai/responses/streaming/cached_input_tokens.txtar
@@ -43,5 +43,5 @@ event: response.output_item.done
 data: {"type":"response.output_item.done","item":{"id":"msg_05080461b406f3f501696a140a70d88195a2ce4c1a4eb39696","type":"message","status":"completed","content":[{"type":"output_text","annotations":[],"text":"Test response with cached tokens."}],"role":"assistant"},"output_index":0,"sequence_number":11}
 
 event: response.completed
-data: {"type":"response.completed","response":{"id":"resp_05080461b406f3f501696a1409d34c8195a40ff4b092145c35","object":"response","created_at":1768559625,"status":"completed","background":false,"completed_at":1768559627,"error":null,"instructions":null,"max_output_tokens":null,"max_tool_calls":null,"model":"gpt-5.2-codex","output":[{"id":"msg_05080461b406f3f501696a140a70d88195a2ce4c1a4eb39696","type":"message","status":"completed","content":[{"type":"output_text","annotations":[],"text":"Test response with cached tokens."}],"role":"assistant"}],"parallel_tool_calls":true,"previous_response_id":null,"prompt_cache_key":"019bc657-f77b-7292-b5f4-2e8d6c2b0945","prompt_cache_retention":null,"reasoning":{"effort":"medium","summary":"detailed"},"service_tier":"default","store":false,"temperature":1.0,"tool_choice":"auto","tools":[],"truncation":"disabled","usage":{"input_tokens":16909,"input_tokens_details":{"cached_tokens":15744},"output_tokens":54,"output_tokens_details":{"reasoning_tokens":0},"total_tokens":16963},"user":null,"metadata":{}},"sequence_number":12}
+data: {"type":"response.completed","response":{"id":"resp_05080461b406f3f501696a1409d34c8195a40ff4b092145c35","object":"response","created_at":1768559625,"status":"completed","background":false,"completed_at":1768559627,"error":null,"instructions":null,"max_output_tokens":null,"max_tool_calls":null,"model":"gpt-5.2-codex","output":[{"id":"msg_05080461b406f3f501696a140a70d88195a2ce4c1a4eb39696","type":"message","status":"completed","content":[{"type":"output_text","annotations":[],"text":"Test response with cached tokens."}],"role":"assistant"}],"parallel_tool_calls":true,"previous_response_id":null,"prompt_cache_key":"019bc657-f77b-7292-b5f4-2e8d6c2b0945","prompt_cache_retention":null,"reasoning":{"effort":"medium","summary":"detailed"},"service_tier":"default","store":false,"temperature":1.0,"tool_choice":"auto","tools":[],"truncation":"disabled","usage":{"input_tokens":16909,"input_tokens_details":{"cached_tokens":15744,"cache_write_tokens":30},"output_tokens":54,"output_tokens_details":{"reasoning_tokens":0},"total_tokens":16963},"user":null,"metadata":{}},"sequence_number":12}
 
diff --git a/aibridge/fixtures/openai/responses/streaming/single_injected_tool.txtar b/aibridge/fixtures/openai/responses/streaming/single_injected_tool.txtar
index 0e079d1e7a443..7df2ec235b483 100644
--- a/aibridge/fixtures/openai/responses/streaming/single_injected_tool.txtar
+++ b/aibridge/fixtures/openai/responses/streaming/single_injected_tool.txtar
@@ -25,7 +25,7 @@ event: response.output_item.done
 data: {"type":"response.output_item.done","item":{"id":"fc_016595fe42aa62ca006972441b4d0081a0bbf6b65aa91022df","type":"function_call","status":"completed","arguments":"{}","call_id":"call_GuuoyhUrVJQbWfHHz0xaX3n9","name":"bmcp_coder_coder_list_templates"},"output_index":0,"sequence_number":5}
 
 event: response.completed
-data: {"type":"response.completed","response":{"id":"resp_016595fe42aa62ca0069724419c52081a0b7eb479c6bc8109f","object":"response","created_at":1769096217,"status":"completed","background":false,"completed_at":1769096219,"error":null,"frequency_penalty":0.0,"incomplete_details":null,"instructions":null,"max_output_tokens":null,"max_tool_calls":null,"model":"gpt-4.1-mini-2025-04-14","output":[{"id":"fc_016595fe42aa62ca006972441b4d0081a0bbf6b65aa91022df","type":"function_call","status":"completed","arguments":"{}","call_id":"call_GuuoyhUrVJQbWfHHz0xaX3n9","name":"bmcp_coder_coder_list_templates"}],"parallel_tool_calls":false,"presence_penalty":0.0,"previous_response_id":null,"prompt_cache_key":null,"prompt_cache_retention":null,"reasoning":{"effort":null,"summary":null},"safety_identifier":null,"service_tier":"default","store":true,"temperature":1.0,"text":{"format":{"type":"text"},"verbosity":"medium"},"tool_choice":"auto","tools":[{"type":"function","description":"Create a task.","name":"bmcp_coder_coder_create_task","parameters":{"properties":{"input":{"description":"Input/prompt for the task.","type":"string"},"template_version_id":{"description":"ID of the template version to create the task from.","type":"string"},"template_version_preset_id":{"description":"Optional ID of the template version preset to create the task from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a task. Omit or use the `me` keyword to create a task for the authenticated user.","type":"string"}},"required":["input","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template in Coder. First, you must create a template version.","name":"bmcp_coder_coder_create_template","parameters":{"properties":{"description":{"type":"string"},"display_name":{"type":"string"},"icon":{"description":"A URL to an icon to use.","type":"string"},"name":{"type":"string"},"version_id":{"description":"The ID of the version to use.","type":"string"}},"required":["name","display_name","description","version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template version. This is a precursor to creating a template, or you can update an existing template.\n\nTemplates are Terraform defining a development environment. The provisioned infrastructure must run\nan Agent that connects to the Coder Control Plane to provide a rich experience.\n\nHere are some strict rules for creating a template version:\n- YOU MUST NOT use \"variable\" or \"output\" blocks in the Terraform code.\n- YOU MUST ALWAYS check template version logs after creation to ensure the template was imported successfully.\n\nWhen a template version is created, a Terraform Plan occurs that ensures the infrastructure\n_could_ be provisioned, but actual provisioning occurs when a workspace is created.\n\n<terraform-spec>\nThe Coder Terraform Provider can be imported like:\n\n```hcl\nterraform {\n  required_providers {\n    coder = {\n      source = \"coder/coder\"\n    }\n  }\n}\n```\n\nA destroy does not occur when a user stops a workspace, but rather the transition changes:\n\n```hcl\ndata \"coder_workspace\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace.\n- name: The name of the workspace.\n- transition: Either \"start\" or \"stop\".\n- start_count: A computed count based on the transition field. If \"start\", this will be 1.\n\nAccess workspace owner information with:\n\n```hcl\ndata \"coder_workspace_owner\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace owner.\n- name: The name of the workspace owner.\n- full_name: The full name of the workspace owner.\n- email: The email of the workspace owner.\n- session_token: A token that can be used to authenticate the workspace owner. It is regenerated every time the workspace is started.\n- oidc_access_token: A valid OpenID Connect access token of the workspace owner. This is only available if the workspace owner authenticated with OpenID Connect. If a valid token cannot be obtained, this value will be an empty string.\n\nParameters are defined in the template version. They are rendered in the UI on the workspace creation page:\n\n```hcl\nresource \"coder_parameter\" \"region\" {\n  name = \"region\"\n  type = \"string\"\n  default = \"us-east-1\"\n}\n```\n\nThis resource accepts the following properties:\n- name: The name of the parameter.\n- default: The default value of the parameter.\n- type: The type of the parameter. Must be one of: \"string\", \"number\", \"bool\", or \"list(string)\".\n- display_name: The displayed name of the parameter as it will appear in the UI.\n- description: The description of the parameter as it will appear in the UI.\n- ephemeral: The value of an ephemeral parameter will not be preserved between consecutive workspace builds.\n- form_type: The type of this parameter. Must be one of: [radio, slider, input, dropdown, checkbox, switch, multi-select, tag-select, textarea, error].\n- icon: A URL to an icon to display in the UI.\n- mutable: Whether this value can be changed after workspace creation. This can be destructive for values like region, so use with caution!\n- option: Each option block defines a value for a user to select from. (see below for nested schema)\n  Required:\n  - name: The name of the option.\n  - value: The value of the option.\n  Optional:\n  - description: The description of the option as it will appear in the UI.\n  - icon: A URL to an icon to display in the UI.\n\nA Workspace Agent runs on provisioned infrastructure to provide access to the workspace:\n\n```hcl\nresource \"coder_agent\" \"dev\" {\n  arch = \"amd64\"\n  os = \"linux\"\n}\n```\n\nThis resource accepts the following properties:\n- arch: The architecture of the agent. Must be one of: \"amd64\", \"arm64\", or \"armv7\".\n- os: The operating system of the agent. Must be one of: \"linux\", \"windows\", or \"darwin\".\n- auth: The authentication method for the agent. Must be one of: \"token\", \"google-instance-identity\", \"aws-instance-identity\", or \"azure-instance-identity\". It is insecure to pass the agent token via exposed variables to Virtual Machines. Instance Identity enables provisioned VMs to authenticate by instance ID on start.\n- dir: The starting directory when a user creates a shell session. Defaults to \"$HOME\".\n- env: A map of environment variables to set for the agent.\n- startup_script: A script to run after the agent starts. This script MUST exit eventually to signal that startup has completed. Use \"&\" or \"screen\" to run processes in the background.\n\nThis resource provides the following fields:\n- id: The UUID of the agent.\n- init_script: The script to run on provisioned infrastructure to fetch and start the agent.\n- token: Set the environment variable CODER_AGENT_TOKEN to this value to authenticate the agent.\n\nThe agent MUST be installed and started using the init_script. A utility like curl or wget to fetch the agent binary must exist in the provisioned infrastructure.\n\nExpose terminal or HTTP applications running in a workspace with:\n\n```hcl\nresource \"coder_app\" \"dev\" {\n  agent_id = coder_agent.dev.id\n  slug = \"my-app-name\"\n  display_name = \"My App\"\n  icon = \"https://my-app.com/icon.svg\"\n  url = \"http://127.0.0.1:3000\"\n}\n```\n\nThis resource accepts the following properties:\n- agent_id: The ID of the agent to attach the app to.\n- slug: The slug of the app.\n- display_name: The displayed name of the app as it will appear in the UI.\n- icon: A URL to an icon to display in the UI.\n- url: An external url if external=true or a URL to be proxied to from inside the workspace. This should be of the form http://localhost:PORT[/SUBPATH]. Either command or url may be specified, but not both.\n- command: A command to run in a terminal opening this app. In the web, this will open in a new tab. In the CLI, this will SSH and execute the command. Either command or url may be specified, but not both.\n- external: Whether this app is an external app. If true, the url will be opened in a new tab.\n</terraform-spec>\n\nThe Coder Server may not be authenticated with the infrastructure provider a user requests. In this scenario,\nthe user will need to provide credentials to the Coder Server before the workspace can be provisioned.\n\nHere are examples of provisioning the Coder Agent on specific infrastructure providers:\n\n<aws-ec2-instance>\n// The agent is configured with \"aws-instance-identity\" auth.\nterraform {\n  required_providers {\n    cloudinit = {\n      source = \"hashicorp/cloudinit\"\n    }\n    aws = {\n      source = \"hashicorp/aws\"\n    }\n  }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n  gzip          = false\n  base64_encode = false\n  boundary = \"//\"\n  part {\n    filename     = \"cloud-config.yaml\"\n    content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t//   - [scripts-user, always]\n\t// hostname: ${hostname}\n\t// users:\n\t//   - name: ${linux_user}\n\t//     sudo: ALL=(ALL) NOPASSWD:ALL\n\t//     shell: /bin/bash\n    content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n      hostname   = local.hostname\n      linux_user = local.linux_user\n    })\n  }\n\n  part {\n    filename     = \"userdata.sh\"\n    content_type = \"text/x-shellscript\"\n\n\t// Here is the content of the userdata.sh.tftpl file:\n\t// #!/bin/bash\n\t// sudo -u '${linux_user}' sh -c '${init_script}'\n    content = templatefile(\"${path.module}/cloud-init/userdata.sh.tftpl\", {\n      linux_user = local.linux_user\n\n      init_script = try(coder_agent.dev[0].init_script, \"\")\n    })\n  }\n}\n\nresource \"aws_instance\" \"dev\" {\n  ami               = data.aws_ami.ubuntu.id\n  availability_zone = \"${data.coder_parameter.region.value}a\"\n  instance_type     = data.coder_parameter.instance_type.value\n\n  user_data = data.cloudinit_config.user_data.rendered\n  tags = {\n    Name = \"coder-${data.coder_workspace_owner.me.name}-${data.coder_workspace.me.name}\"\n  }\n  lifecycle {\n    ignore_changes = [ami]\n  }\n}\n</aws-ec2-instance>\n\n<gcp-vm-instance>\n// The agent is configured with \"google-instance-identity\" auth.\nterraform {\n  required_providers {\n    google = {\n      source = \"hashicorp/google\"\n    }\n  }\n}\n\nresource \"google_compute_instance\" \"dev\" {\n  zone         = module.gcp_region.value\n  count        = data.coder_workspace.me.start_count\n  name         = \"coder-${lower(data.coder_workspace_owner.me.name)}-${lower(data.coder_workspace.me.name)}-root\"\n  machine_type = \"e2-medium\"\n  network_interface {\n    network = \"default\"\n    access_config {\n      // Ephemeral public IP\n    }\n  }\n  boot_disk {\n    auto_delete = false\n    source      = google_compute_disk.root.name\n  }\n  // In order to use google-instance-identity, a service account *must* be provided.\n  service_account {\n    email  = data.google_compute_default_service_account.default.email\n    scopes = [\"cloud-platform\"]\n  }\n  # ONLY FOR WINDOWS:\n  # metadata = {\n  #   windows-startup-script-ps1 = coder_agent.main.init_script\n  # }\n  # The startup script runs as root with no $HOME environment set up, so instead of directly\n  # running the agent init script, create a user (with a homedir, default shell and sudo\n  # permissions) and execute the init script as that user.\n  #\n  # The agent MUST be started in here.\n  metadata_startup_script = <<EOMETA\n#!/usr/bin/env sh\nset -eux\n\n# If user does not exist, create it and set up passwordless sudo\nif ! id -u \"${local.linux_user}\" >/dev/null 2>&1; then\n  useradd -m -s /bin/bash \"${local.linux_user}\"\n  echo \"${local.linux_user} ALL=(ALL) NOPASSWD:ALL\" > /etc/sudoers.d/coder-user\nfi\n\nexec sudo -u \"${local.linux_user}\" sh -c '${coder_agent.main.init_script}'\nEOMETA\n}\n</gcp-vm-instance>\n\n<azure-vm-instance>\n// The agent is configured with \"azure-instance-identity\" auth.\nterraform {\n  required_providers {\n    azurerm = {\n      source = \"hashicorp/azurerm\"\n    }\n    cloudinit = {\n      source = \"hashicorp/cloudinit\"\n    }\n  }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n  gzip          = false\n  base64_encode = true\n\n  boundary = \"//\"\n\n  part {\n    filename     = \"cloud-config.yaml\"\n    content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t// - [scripts-user, always]\n\t// bootcmd:\n\t//   # work around https://github.com/hashicorp/terraform-provider-azurerm/issues/6117\n\t//   - until [ -e /dev/disk/azure/scsi1/lun10 ]; do sleep 1; done\n\t// device_aliases:\n\t//   homedir: /dev/disk/azure/scsi1/lun10\n\t// disk_setup:\n\t//   homedir:\n\t//     table_type: gpt\n\t//     layout: true\n\t// fs_setup:\n\t//   - label: coder_home\n\t//     filesystem: ext4\n\t//     device: homedir.1\n\t// mounts:\n\t//   - [\"LABEL=coder_home\", \"/home/${username}\"]\n\t// hostname: ${hostname}\n\t// users:\n\t//   - name: ${username}\n\t//     sudo: [\"ALL=(ALL) NOPASSWD:ALL\"]\n\t//     groups: sudo\n\t//     shell: /bin/bash\n\t// packages:\n\t//   - git\n\t// write_files:\n\t//   - path: /opt/coder/init\n\t//     permissions: \"0755\"\n\t//     encoding: b64\n\t//     content: ${init_script}\n\t//   - path: /etc/systemd/system/coder-agent.service\n\t//     permissions: \"0644\"\n\t//     content: |\n\t//       [Unit]\n\t//       Description=Coder Agent\n\t//       After=network-online.target\n\t//       Wants=network-online.target\n\n\t//       [Service]\n\t//       User=${username}\n\t//       ExecStart=/opt/coder/init\n\t//       Restart=always\n\t//       RestartSec=10\n\t//       TimeoutStopSec=90\n\t//       KillMode=process\n\n\t//       OOMScoreAdjust=-900\n\t//       SyslogIdentifier=coder-agent\n\n\t//       [Install]\n\t//       WantedBy=multi-user.target\n\t// runcmd:\n\t//   - chown ${username}:${username} /home/${username}\n\t//   - systemctl enable coder-agent\n\t//   - systemctl start coder-agent\n    content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n      username    = \"coder\" # Ensure this user/group does not exist in your VM image\n      init_script = base64encode(coder_agent.main.init_script)\n      hostname    = lower(data.coder_workspace.me.name)\n    })\n  }\n}\n\nresource \"azurerm_linux_virtual_machine\" \"main\" {\n  count               = data.coder_workspace.me.start_count\n  name                = \"vm\"\n  resource_group_name = azurerm_resource_group.main.name\n  location            = azurerm_resource_group.main.location\n  size                = data.coder_parameter.instance_type.value\n  // cloud-init overwrites this, so the value here doesn't matter\n  admin_username = \"adminuser\"\n  admin_ssh_key {\n    public_key = tls_private_key.dummy.public_key_openssh\n    username   = \"adminuser\"\n  }\n\n  network_interface_ids = [\n    azurerm_network_interface.main.id,\n  ]\n  computer_name = lower(data.coder_workspace.me.name)\n  os_disk {\n    caching              = \"ReadWrite\"\n    storage_account_type = \"Standard_LRS\"\n  }\n  source_image_reference {\n    publisher = \"Canonical\"\n    offer     = \"0001-com-ubuntu-server-focal\"\n    sku       = \"20_04-lts-gen2\"\n    version   = \"latest\"\n  }\n  user_data = data.cloudinit_config.user_data.rendered\n}\n</azure-vm-instance>\n\n<docker-container>\nterraform {\n  required_providers {\n    coder = {\n      source = \"kreuzwerker/docker\"\n    }\n  }\n}\n\n// The agent is configured with \"token\" auth.\n\nresource \"docker_container\" \"workspace\" {\n  count = data.coder_workspace.me.start_count\n  image = \"codercom/enterprise-base:ubuntu\"\n  # Uses lower() to avoid Docker restriction on container names.\n  name = \"coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}\"\n  # Hostname makes the shell more user friendly: coder@my-workspace:~$\n  hostname = data.coder_workspace.me.name\n  # Use the docker gateway if the access URL is 127.0.0.1.\n  entrypoint = [\"sh\", \"-c\", replace(coder_agent.main.init_script, \"/localhost|127\\\\.0\\\\.0\\\\.1/\", \"host.docker.internal\")]\n  env        = [\"CODER_AGENT_TOKEN=${coder_agent.main.token}\"]\n  host {\n    host = \"host.docker.internal\"\n    ip   = \"host-gateway\"\n  }\n  volumes {\n    container_path = \"/home/coder\"\n    volume_name    = docker_volume.home_volume.name\n    read_only      = false\n  }\n}\n</docker-container>\n\n<kubernetes-pod>\n// The agent is configured with \"token\" auth.\n\nresource \"kubernetes_deployment\" \"main\" {\n  count = data.coder_workspace.me.start_count\n  depends_on = [\n    kubernetes_persistent_volume_claim.home\n  ]\n  wait_for_rollout = false\n  metadata {\n    name      = \"coder-${data.coder_workspace.me.id}\"\n  }\n\n  spec {\n    replicas = 1\n    strategy {\n      type = \"Recreate\"\n    }\n\n    template {\n      spec {\n        security_context {\n          run_as_user     = 1000\n          fs_group        = 1000\n          run_as_non_root = true\n        }\n\n        container {\n          name              = \"dev\"\n          image             = \"codercom/enterprise-base:ubuntu\"\n          image_pull_policy = \"Always\"\n          command           = [\"sh\", \"-c\", coder_agent.main.init_script]\n          security_context {\n            run_as_user = \"1000\"\n          }\n          env {\n            name  = \"CODER_AGENT_TOKEN\"\n            value = coder_agent.main.token\n          }\n        }\n      }\n    }\n  }\n}\n</kubernetes-pod>\n\nThe file_id provided is a reference to a tar file you have uploaded containing the Terraform.\n","name":"bmcp_coder_coder_create_template_version","parameters":{"properties":{"file_id":{"type":"string"},"template_id":{"type":"string"}},"required":["file_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace in Coder.\n\nIf a user is asking to \"test a template\", they are typically referring\nto creating a workspace from a template to ensure the infrastructure\nis provisioned correctly and the agent can connect to the control plane.\n\nBefore creating a workspace, always confirm the template choice with the user by:\n\n\t1. Listing the available templates that match their request.\n\t2. Recommending the most relevant option.\n\t2. Asking the user to confirm which template to use.\n\nIt is important to not create a workspace without confirming the template\nchoice with the user.\n\nAfter creating a workspace, watch the build logs and wait for the workspace to\nbe ready before trying to use or connect to the workspace.\n","name":"bmcp_coder_coder_create_workspace","parameters":{"properties":{"name":{"description":"Name of the workspace to create.","type":"string"},"rich_parameters":{"description":"Key/value pairs of rich parameters to pass to the template version to create the workspace.","type":"object"},"template_version_id":{"description":"ID of the template version to create the workspace from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a workspace. Omit or use the `me` keyword to create a workspace for the authenticated user.","type":"string"}},"required":["user","template_version_id","name","rich_parameters"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace build for an existing workspace. Use this to start, stop, or delete.\n\nAfter creating a workspace build, watch the build logs and wait for the\nworkspace build to complete before trying to start another build or use or\nconnect to the workspace.\n","name":"bmcp_coder_coder_create_workspace_build","parameters":{"properties":{"template_version_id":{"description":"(Optional) The template version ID to use for the workspace build. If not provided, the previously built version will be used.","type":"string"},"transition":{"description":"The transition to perform. Must be one of: start, stop, delete","enum":["start","stop","delete"],"type":"string"},"workspace_id":{"type":"string"}},"required":["workspace_id","transition"],"type":"object"},"strict":false},{"type":"function","description":"Delete a task.","name":"bmcp_coder_coder_delete_task","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to delete. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Delete a template. This is irreversible.","name":"bmcp_coder_coder_delete_template","parameters":{"properties":{"template_id":{"type":"string"}},"required":["template_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the currently authenticated user, similar to the `whoami` command.","name":"bmcp_coder_coder_get_authenticated_user","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a task.","name":"bmcp_coder_coder_get_task_logs","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to query. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the status of a task.","name":"bmcp_coder_coder_get_task_status","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to get. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a template version. This is useful to check whether a template version successfully imports or not.","name":"bmcp_coder_coder_get_template_version_logs","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Get a workspace by name or ID.\n\nThis returns more data than list_workspaces to reduce token usage.","name":"bmcp_coder_coder_get_workspace","parameters":{"properties":{"workspace_id":{"description":"The workspace ID or name in the format [owner/]workspace. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace agent.\n\n\t\tMore logs may appear after this call. It does not wait for the agent to finish.","name":"bmcp_coder_coder_get_workspace_agent_logs","parameters":{"properties":{"workspace_agent_id":{"type":"string"}},"required":["workspace_agent_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace build.\n\n\t\tUseful for checking whether a workspace builds successfully or not.","name":"bmcp_coder_coder_get_workspace_build_logs","parameters":{"properties":{"workspace_build_id":{"type":"string"}},"required":["workspace_build_id"],"type":"object"},"strict":false},{"type":"function","description":"List tasks.","name":"bmcp_coder_coder_list_tasks","parameters":{"properties":{"status":{"description":"Optional filter by task status.","type":"string"},"user":{"description":"Username or ID of the user for which to list tasks. Omit or use the `me` keyword to list tasks for the authenticated user.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Lists templates for the authenticated user.","name":"bmcp_coder_coder_list_templates","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Lists workspaces for the authenticated user.","name":"bmcp_coder_coder_list_workspaces","parameters":{"properties":{"owner":{"description":"The owner of the workspaces to list. Use \"me\" to list workspaces for the authenticated user. If you do not specify an owner, \"me\" will be assumed by default.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Send input to a running task.","name":"bmcp_coder_coder_send_task_input","parameters":{"properties":{"input":{"description":"The input to send to the task.","type":"string"},"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to prompt. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id","input"],"type":"object"},"strict":false},{"type":"function","description":"Get the parameters for a template version. You can refer to these as workspace parameters to the user, as they are typically important for creating a workspace.","name":"bmcp_coder_coder_template_version_parameters","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Update the active version of a template. This is helpful when iterating on templates.","name":"bmcp_coder_coder_update_template_active_version","parameters":{"properties":{"template_id":{"type":"string"},"template_version_id":{"type":"string"}},"required":["template_id","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create and upload a tar file by key/value mapping of file names to file contents. Use this to create template versions. Reference the tool description of \"create_template_version\" to understand template requirements.","name":"bmcp_coder_coder_upload_tar_file","parameters":{"properties":{"files":{"description":"A map of file names to file contents.","type":"object"}},"required":["files"],"type":"object"},"strict":false},{"type":"function","description":"Execute a bash command in a Coder workspace.\n\nThis tool provides the same functionality as the 'coder ssh <workspace> <command>' CLI command.\nIt automatically starts the workspace if it's stopped and waits for the agent to be ready.\nThe output is trimmed of leading and trailing whitespace.\n\nThe workspace parameter supports various formats:\n- workspace (uses current user)\n- owner/workspace\n- owner--workspace\n- workspace.agent (specific agent)\n- owner/workspace.agent\n\nThe timeout_ms parameter specifies the command timeout in milliseconds (defaults to 60000ms, maximum of 300000ms).\nIf the command times out, all output captured up to that point is returned with a cancellation message.\n\nFor background commands (background: true), output is captured until the timeout is reached, then the command\ncontinues running in the background. The captured output is returned as the result.\n\nFor file operations (list, write, edit), always prefer the dedicated file tools.\nDo not use bash commands (ls, cat, echo, heredoc, etc.) to list, write, or read\nfiles when the file tools are available. The bash tool should be used for:\n\n\t- Running commands and scripts\n\t- Installing packages\n\t- Starting services\n\t- Executing programs\n\nExamples:\n- workspace: \"john/dev-env\", command: \"git status\", timeout_ms: 30000\n- workspace: \"my-workspace\", command: \"npm run dev\", background: true, timeout_ms: 10000\n- workspace: \"my-workspace.main\", command: \"docker ps\"","name":"bmcp_coder_coder_workspace_bash","parameters":{"properties":{"background":{"description":"Whether to run the command in the background. Output is captured until timeout, then the command continues running in the background.","type":"boolean"},"command":{"description":"The bash command to execute in the workspace.","type":"string"},"timeout_ms":{"default":60000,"description":"Command timeout in milliseconds. Defaults to 60000ms (60 seconds) if not specified.","minimum":1,"type":"integer"},"workspace":{"description":"The workspace name in format [owner/]workspace[.agent]. If owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","command"],"type":"object"},"strict":false},{"type":"function","description":"Edit a file in a workspace.","name":"bmcp_coder_coder_workspace_edit_file","parameters":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","edits"],"type":"object"},"strict":false},{"type":"function","description":"Edit one or more files in a workspace.","name":"bmcp_coder_coder_workspace_edit_files","parameters":{"properties":{"files":{"description":"An array of files to edit.","items":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"}},"required":["path","edits"],"type":"object"},"type":"array"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","files"],"type":"object"},"strict":false},{"type":"function","description":"List the URLs of Coder apps running in a workspace for a single agent.","name":"bmcp_coder_coder_workspace_list_apps","parameters":{"properties":{"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace"],"type":"object"},"strict":false},{"type":"function","description":"List directories in a workspace.","name":"bmcp_coder_coder_workspace_ls","parameters":{"properties":{"path":{"description":"The absolute path of the directory in the workspace to list.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Fetch URLs that forward to the specified port.","name":"bmcp_coder_coder_workspace_port_forward","parameters":{"properties":{"port":{"description":"The port to forward.","type":"number"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","port"],"type":"object"},"strict":false},{"type":"function","description":"Read from a file in a workspace.","name":"bmcp_coder_coder_workspace_read_file","parameters":{"properties":{"limit":{"description":"The number of bytes to read. Cannot exceed 1 MiB. Defaults to the full size of the file or 1 MiB, whichever is lower.","type":"integer"},"offset":{"description":"A byte offset indicating where in the file to start reading. Defaults to zero. An empty string indicates the end of the file has been reached.","type":"integer"},"path":{"description":"The absolute path of the file to read in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Write a file in a workspace.\n\nIf a file write fails due to syntax errors or encoding issues, do NOT switch\nto using bash commands as a workaround. Instead:\n\n\t1. Read the error message carefully to identify the issue\n\t2. Fix the content encoding/syntax\n\t3. Retry with this tool\n\nThe content parameter expects base64-encoded bytes. Ensure your source content\nis correct before encoding it. If you encounter errors, decode and verify the\ncontent you are trying to write, then re-encode it properly.\n","name":"bmcp_coder_coder_workspace_write_file","parameters":{"properties":{"content":{"description":"The base64-encoded bytes to write to the file.","type":"string"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","content"],"type":"object"},"strict":false}],"top_logprobs":0,"top_p":1.0,"truncation":"disabled","usage":{"input_tokens":6269,"input_tokens_details":{"cached_tokens":0},"output_tokens":18,"output_tokens_details":{"reasoning_tokens":0},"total_tokens":6287},"user":null,"metadata":{}},"sequence_number":6}
+data: {"type":"response.completed","response":{"id":"resp_016595fe42aa62ca0069724419c52081a0b7eb479c6bc8109f","object":"response","created_at":1769096217,"status":"completed","background":false,"completed_at":1769096219,"error":null,"frequency_penalty":0.0,"incomplete_details":null,"instructions":null,"max_output_tokens":null,"max_tool_calls":null,"model":"gpt-4.1-mini-2025-04-14","output":[{"id":"fc_016595fe42aa62ca006972441b4d0081a0bbf6b65aa91022df","type":"function_call","status":"completed","arguments":"{}","call_id":"call_GuuoyhUrVJQbWfHHz0xaX3n9","name":"bmcp_coder_coder_list_templates"}],"parallel_tool_calls":false,"presence_penalty":0.0,"previous_response_id":null,"prompt_cache_key":null,"prompt_cache_retention":null,"reasoning":{"effort":null,"summary":null},"safety_identifier":null,"service_tier":"default","store":true,"temperature":1.0,"text":{"format":{"type":"text"},"verbosity":"medium"},"tool_choice":"auto","tools":[{"type":"function","description":"Create a task.","name":"bmcp_coder_coder_create_task","parameters":{"properties":{"input":{"description":"Input/prompt for the task.","type":"string"},"template_version_id":{"description":"ID of the template version to create the task from.","type":"string"},"template_version_preset_id":{"description":"Optional ID of the template version preset to create the task from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a task. Omit or use the `me` keyword to create a task for the authenticated user.","type":"string"}},"required":["input","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template in Coder. First, you must create a template version.","name":"bmcp_coder_coder_create_template","parameters":{"properties":{"description":{"type":"string"},"display_name":{"type":"string"},"icon":{"description":"A URL to an icon to use.","type":"string"},"name":{"type":"string"},"version_id":{"description":"The ID of the version to use.","type":"string"}},"required":["name","display_name","description","version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template version. This is a precursor to creating a template, or you can update an existing template.\n\nTemplates are Terraform defining a development environment. The provisioned infrastructure must run\nan Agent that connects to the Coder Control Plane to provide a rich experience.\n\nHere are some strict rules for creating a template version:\n- YOU MUST NOT use \"variable\" or \"output\" blocks in the Terraform code.\n- YOU MUST ALWAYS check template version logs after creation to ensure the template was imported successfully.\n\nWhen a template version is created, a Terraform Plan occurs that ensures the infrastructure\n_could_ be provisioned, but actual provisioning occurs when a workspace is created.\n\n<terraform-spec>\nThe Coder Terraform Provider can be imported like:\n\n```hcl\nterraform {\n  required_providers {\n    coder = {\n      source = \"coder/coder\"\n    }\n  }\n}\n```\n\nA destroy does not occur when a user stops a workspace, but rather the transition changes:\n\n```hcl\ndata \"coder_workspace\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace.\n- name: The name of the workspace.\n- transition: Either \"start\" or \"stop\".\n- start_count: A computed count based on the transition field. If \"start\", this will be 1.\n\nAccess workspace owner information with:\n\n```hcl\ndata \"coder_workspace_owner\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace owner.\n- name: The name of the workspace owner.\n- full_name: The full name of the workspace owner.\n- email: The email of the workspace owner.\n- session_token: A token that can be used to authenticate the workspace owner. It is regenerated every time the workspace is started.\n- oidc_access_token: A valid OpenID Connect access token of the workspace owner. This is only available if the workspace owner authenticated with OpenID Connect. If a valid token cannot be obtained, this value will be an empty string.\n\nParameters are defined in the template version. They are rendered in the UI on the workspace creation page:\n\n```hcl\nresource \"coder_parameter\" \"region\" {\n  name = \"region\"\n  type = \"string\"\n  default = \"us-east-1\"\n}\n```\n\nThis resource accepts the following properties:\n- name: The name of the parameter.\n- default: The default value of the parameter.\n- type: The type of the parameter. Must be one of: \"string\", \"number\", \"bool\", or \"list(string)\".\n- display_name: The displayed name of the parameter as it will appear in the UI.\n- description: The description of the parameter as it will appear in the UI.\n- ephemeral: The value of an ephemeral parameter will not be preserved between consecutive workspace builds.\n- form_type: The type of this parameter. Must be one of: [radio, slider, input, dropdown, checkbox, switch, multi-select, tag-select, textarea, error].\n- icon: A URL to an icon to display in the UI.\n- mutable: Whether this value can be changed after workspace creation. This can be destructive for values like region, so use with caution!\n- option: Each option block defines a value for a user to select from. (see below for nested schema)\n  Required:\n  - name: The name of the option.\n  - value: The value of the option.\n  Optional:\n  - description: The description of the option as it will appear in the UI.\n  - icon: A URL to an icon to display in the UI.\n\nA Workspace Agent runs on provisioned infrastructure to provide access to the workspace:\n\n```hcl\nresource \"coder_agent\" \"dev\" {\n  arch = \"amd64\"\n  os = \"linux\"\n}\n```\n\nThis resource accepts the following properties:\n- arch: The architecture of the agent. Must be one of: \"amd64\", \"arm64\", or \"armv7\".\n- os: The operating system of the agent. Must be one of: \"linux\", \"windows\", or \"darwin\".\n- auth: The authentication method for the agent. Must be one of: \"token\", \"google-instance-identity\", \"aws-instance-identity\", or \"azure-instance-identity\". It is insecure to pass the agent token via exposed variables to Virtual Machines. Instance Identity enables provisioned VMs to authenticate by instance ID on start.\n- dir: The starting directory when a user creates a shell session. Defaults to \"$HOME\".\n- env: A map of environment variables to set for the agent.\n- startup_script: A script to run after the agent starts. This script MUST exit eventually to signal that startup has completed. Use \"&\" or \"screen\" to run processes in the background.\n\nThis resource provides the following fields:\n- id: The UUID of the agent.\n- init_script: The script to run on provisioned infrastructure to fetch and start the agent.\n- token: Set the environment variable CODER_AGENT_TOKEN to this value to authenticate the agent.\n\nThe agent MUST be installed and started using the init_script. A utility like curl or wget to fetch the agent binary must exist in the provisioned infrastructure.\n\nExpose terminal or HTTP applications running in a workspace with:\n\n```hcl\nresource \"coder_app\" \"dev\" {\n  agent_id = coder_agent.dev.id\n  slug = \"my-app-name\"\n  display_name = \"My App\"\n  icon = \"https://my-app.com/icon.svg\"\n  url = \"http://127.0.0.1:3000\"\n}\n```\n\nThis resource accepts the following properties:\n- agent_id: The ID of the agent to attach the app to.\n- slug: The slug of the app.\n- display_name: The displayed name of the app as it will appear in the UI.\n- icon: A URL to an icon to display in the UI.\n- url: An external url if external=true or a URL to be proxied to from inside the workspace. This should be of the form http://localhost:PORT[/SUBPATH]. Either command or url may be specified, but not both.\n- command: A command to run in a terminal opening this app. In the web, this will open in a new tab. In the CLI, this will SSH and execute the command. Either command or url may be specified, but not both.\n- external: Whether this app is an external app. If true, the url will be opened in a new tab.\n</terraform-spec>\n\nThe Coder Server may not be authenticated with the infrastructure provider a user requests. In this scenario,\nthe user will need to provide credentials to the Coder Server before the workspace can be provisioned.\n\nHere are examples of provisioning the Coder Agent on specific infrastructure providers:\n\n<aws-ec2-instance>\n// The agent is configured with \"aws-instance-identity\" auth.\nterraform {\n  required_providers {\n    cloudinit = {\n      source = \"hashicorp/cloudinit\"\n    }\n    aws = {\n      source = \"hashicorp/aws\"\n    }\n  }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n  gzip          = false\n  base64_encode = false\n  boundary = \"//\"\n  part {\n    filename     = \"cloud-config.yaml\"\n    content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t//   - [scripts-user, always]\n\t// hostname: ${hostname}\n\t// users:\n\t//   - name: ${linux_user}\n\t//     sudo: ALL=(ALL) NOPASSWD:ALL\n\t//     shell: /bin/bash\n    content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n      hostname   = local.hostname\n      linux_user = local.linux_user\n    })\n  }\n\n  part {\n    filename     = \"userdata.sh\"\n    content_type = \"text/x-shellscript\"\n\n\t// Here is the content of the userdata.sh.tftpl file:\n\t// #!/bin/bash\n\t// sudo -u '${linux_user}' sh -c '${init_script}'\n    content = templatefile(\"${path.module}/cloud-init/userdata.sh.tftpl\", {\n      linux_user = local.linux_user\n\n      init_script = try(coder_agent.dev[0].init_script, \"\")\n    })\n  }\n}\n\nresource \"aws_instance\" \"dev\" {\n  ami               = data.aws_ami.ubuntu.id\n  availability_zone = \"${data.coder_parameter.region.value}a\"\n  instance_type     = data.coder_parameter.instance_type.value\n\n  user_data = data.cloudinit_config.user_data.rendered\n  tags = {\n    Name = \"coder-${data.coder_workspace_owner.me.name}-${data.coder_workspace.me.name}\"\n  }\n  lifecycle {\n    ignore_changes = [ami]\n  }\n}\n</aws-ec2-instance>\n\n<gcp-vm-instance>\n// The agent is configured with \"google-instance-identity\" auth.\nterraform {\n  required_providers {\n    google = {\n      source = \"hashicorp/google\"\n    }\n  }\n}\n\nresource \"google_compute_instance\" \"dev\" {\n  zone         = module.gcp_region.value\n  count        = data.coder_workspace.me.start_count\n  name         = \"coder-${lower(data.coder_workspace_owner.me.name)}-${lower(data.coder_workspace.me.name)}-root\"\n  machine_type = \"e2-medium\"\n  network_interface {\n    network = \"default\"\n    access_config {\n      // Ephemeral public IP\n    }\n  }\n  boot_disk {\n    auto_delete = false\n    source      = google_compute_disk.root.name\n  }\n  // In order to use google-instance-identity, a service account *must* be provided.\n  service_account {\n    email  = data.google_compute_default_service_account.default.email\n    scopes = [\"cloud-platform\"]\n  }\n  # ONLY FOR WINDOWS:\n  # metadata = {\n  #   windows-startup-script-ps1 = coder_agent.main.init_script\n  # }\n  # The startup script runs as root with no $HOME environment set up, so instead of directly\n  # running the agent init script, create a user (with a homedir, default shell and sudo\n  # permissions) and execute the init script as that user.\n  #\n  # The agent MUST be started in here.\n  metadata_startup_script = <<EOMETA\n#!/usr/bin/env sh\nset -eux\n\n# If user does not exist, create it and set up passwordless sudo\nif ! id -u \"${local.linux_user}\" >/dev/null 2>&1; then\n  useradd -m -s /bin/bash \"${local.linux_user}\"\n  echo \"${local.linux_user} ALL=(ALL) NOPASSWD:ALL\" > /etc/sudoers.d/coder-user\nfi\n\nexec sudo -u \"${local.linux_user}\" sh -c '${coder_agent.main.init_script}'\nEOMETA\n}\n</gcp-vm-instance>\n\n<azure-vm-instance>\n// The agent is configured with \"azure-instance-identity\" auth.\nterraform {\n  required_providers {\n    azurerm = {\n      source = \"hashicorp/azurerm\"\n    }\n    cloudinit = {\n      source = \"hashicorp/cloudinit\"\n    }\n  }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n  gzip          = false\n  base64_encode = true\n\n  boundary = \"//\"\n\n  part {\n    filename     = \"cloud-config.yaml\"\n    content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t// - [scripts-user, always]\n\t// bootcmd:\n\t//   # work around https://github.com/hashicorp/terraform-provider-azurerm/issues/6117\n\t//   - until [ -e /dev/disk/azure/scsi1/lun10 ]; do sleep 1; done\n\t// device_aliases:\n\t//   homedir: /dev/disk/azure/scsi1/lun10\n\t// disk_setup:\n\t//   homedir:\n\t//     table_type: gpt\n\t//     layout: true\n\t// fs_setup:\n\t//   - label: coder_home\n\t//     filesystem: ext4\n\t//     device: homedir.1\n\t// mounts:\n\t//   - [\"LABEL=coder_home\", \"/home/${username}\"]\n\t// hostname: ${hostname}\n\t// users:\n\t//   - name: ${username}\n\t//     sudo: [\"ALL=(ALL) NOPASSWD:ALL\"]\n\t//     groups: sudo\n\t//     shell: /bin/bash\n\t// packages:\n\t//   - git\n\t// write_files:\n\t//   - path: /opt/coder/init\n\t//     permissions: \"0755\"\n\t//     encoding: b64\n\t//     content: ${init_script}\n\t//   - path: /etc/systemd/system/coder-agent.service\n\t//     permissions: \"0644\"\n\t//     content: |\n\t//       [Unit]\n\t//       Description=Coder Agent\n\t//       After=network-online.target\n\t//       Wants=network-online.target\n\n\t//       [Service]\n\t//       User=${username}\n\t//       ExecStart=/opt/coder/init\n\t//       Restart=always\n\t//       RestartSec=10\n\t//       TimeoutStopSec=90\n\t//       KillMode=process\n\n\t//       OOMScoreAdjust=-900\n\t//       SyslogIdentifier=coder-agent\n\n\t//       [Install]\n\t//       WantedBy=multi-user.target\n\t// runcmd:\n\t//   - chown ${username}:${username} /home/${username}\n\t//   - systemctl enable coder-agent\n\t//   - systemctl start coder-agent\n    content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n      username    = \"coder\" # Ensure this user/group does not exist in your VM image\n      init_script = base64encode(coder_agent.main.init_script)\n      hostname    = lower(data.coder_workspace.me.name)\n    })\n  }\n}\n\nresource \"azurerm_linux_virtual_machine\" \"main\" {\n  count               = data.coder_workspace.me.start_count\n  name                = \"vm\"\n  resource_group_name = azurerm_resource_group.main.name\n  location            = azurerm_resource_group.main.location\n  size                = data.coder_parameter.instance_type.value\n  // cloud-init overwrites this, so the value here doesn't matter\n  admin_username = \"adminuser\"\n  admin_ssh_key {\n    public_key = tls_private_key.dummy.public_key_openssh\n    username   = \"adminuser\"\n  }\n\n  network_interface_ids = [\n    azurerm_network_interface.main.id,\n  ]\n  computer_name = lower(data.coder_workspace.me.name)\n  os_disk {\n    caching              = \"ReadWrite\"\n    storage_account_type = \"Standard_LRS\"\n  }\n  source_image_reference {\n    publisher = \"Canonical\"\n    offer     = \"0001-com-ubuntu-server-focal\"\n    sku       = \"20_04-lts-gen2\"\n    version   = \"latest\"\n  }\n  user_data = data.cloudinit_config.user_data.rendered\n}\n</azure-vm-instance>\n\n<docker-container>\nterraform {\n  required_providers {\n    coder = {\n      source = \"kreuzwerker/docker\"\n    }\n  }\n}\n\n// The agent is configured with \"token\" auth.\n\nresource \"docker_container\" \"workspace\" {\n  count = data.coder_workspace.me.start_count\n  image = \"codercom/enterprise-base:ubuntu\"\n  # Uses lower() to avoid Docker restriction on container names.\n  name = \"coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}\"\n  # Hostname makes the shell more user friendly: coder@my-workspace:~$\n  hostname = data.coder_workspace.me.name\n  # Use the docker gateway if the access URL is 127.0.0.1.\n  entrypoint = [\"sh\", \"-c\", replace(coder_agent.main.init_script, \"/localhost|127\\\\.0\\\\.0\\\\.1/\", \"host.docker.internal\")]\n  env        = [\"CODER_AGENT_TOKEN=${coder_agent.main.token}\"]\n  host {\n    host = \"host.docker.internal\"\n    ip   = \"host-gateway\"\n  }\n  volumes {\n    container_path = \"/home/coder\"\n    volume_name    = docker_volume.home_volume.name\n    read_only      = false\n  }\n}\n</docker-container>\n\n<kubernetes-pod>\n// The agent is configured with \"token\" auth.\n\nresource \"kubernetes_deployment\" \"main\" {\n  count = data.coder_workspace.me.start_count\n  depends_on = [\n    kubernetes_persistent_volume_claim.home\n  ]\n  wait_for_rollout = false\n  metadata {\n    name      = \"coder-${data.coder_workspace.me.id}\"\n  }\n\n  spec {\n    replicas = 1\n    strategy {\n      type = \"Recreate\"\n    }\n\n    template {\n      spec {\n        security_context {\n          run_as_user     = 1000\n          fs_group        = 1000\n          run_as_non_root = true\n        }\n\n        container {\n          name              = \"dev\"\n          image             = \"codercom/enterprise-base:ubuntu\"\n          image_pull_policy = \"Always\"\n          command           = [\"sh\", \"-c\", coder_agent.main.init_script]\n          security_context {\n            run_as_user = \"1000\"\n          }\n          env {\n            name  = \"CODER_AGENT_TOKEN\"\n            value = coder_agent.main.token\n          }\n        }\n      }\n    }\n  }\n}\n</kubernetes-pod>\n\nThe file_id provided is a reference to a tar file you have uploaded containing the Terraform.\n","name":"bmcp_coder_coder_create_template_version","parameters":{"properties":{"file_id":{"type":"string"},"template_id":{"type":"string"}},"required":["file_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace in Coder.\n\nIf a user is asking to \"test a template\", they are typically referring\nto creating a workspace from a template to ensure the infrastructure\nis provisioned correctly and the agent can connect to the control plane.\n\nBefore creating a workspace, always confirm the template choice with the user by:\n\n\t1. Listing the available templates that match their request.\n\t2. Recommending the most relevant option.\n\t2. Asking the user to confirm which template to use.\n\nIt is important to not create a workspace without confirming the template\nchoice with the user.\n\nAfter creating a workspace, watch the build logs and wait for the workspace to\nbe ready before trying to use or connect to the workspace.\n","name":"bmcp_coder_coder_create_workspace","parameters":{"properties":{"name":{"description":"Name of the workspace to create.","type":"string"},"rich_parameters":{"description":"Key/value pairs of rich parameters to pass to the template version to create the workspace.","type":"object"},"template_version_id":{"description":"ID of the template version to create the workspace from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a workspace. Omit or use the `me` keyword to create a workspace for the authenticated user.","type":"string"}},"required":["user","template_version_id","name","rich_parameters"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace build for an existing workspace. Use this to start, stop, or delete.\n\nAfter creating a workspace build, watch the build logs and wait for the\nworkspace build to complete before trying to start another build or use or\nconnect to the workspace.\n","name":"bmcp_coder_coder_create_workspace_build","parameters":{"properties":{"template_version_id":{"description":"(Optional) The template version ID to use for the workspace build. If not provided, the previously built version will be used.","type":"string"},"transition":{"description":"The transition to perform. Must be one of: start, stop, delete","enum":["start","stop","delete"],"type":"string"},"workspace_id":{"type":"string"}},"required":["workspace_id","transition"],"type":"object"},"strict":false},{"type":"function","description":"Delete a task.","name":"bmcp_coder_coder_delete_task","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to delete. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Delete a template. This is irreversible.","name":"bmcp_coder_coder_delete_template","parameters":{"properties":{"template_id":{"type":"string"}},"required":["template_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the currently authenticated user, similar to the `whoami` command.","name":"bmcp_coder_coder_get_authenticated_user","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a task.","name":"bmcp_coder_coder_get_task_logs","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to query. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the status of a task.","name":"bmcp_coder_coder_get_task_status","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to get. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a template version. This is useful to check whether a template version successfully imports or not.","name":"bmcp_coder_coder_get_template_version_logs","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Get a workspace by name or ID.\n\nThis returns more data than list_workspaces to reduce token usage.","name":"bmcp_coder_coder_get_workspace","parameters":{"properties":{"workspace_id":{"description":"The workspace ID or name in the format [owner/]workspace. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace agent.\n\n\t\tMore logs may appear after this call. It does not wait for the agent to finish.","name":"bmcp_coder_coder_get_workspace_agent_logs","parameters":{"properties":{"workspace_agent_id":{"type":"string"}},"required":["workspace_agent_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace build.\n\n\t\tUseful for checking whether a workspace builds successfully or not.","name":"bmcp_coder_coder_get_workspace_build_logs","parameters":{"properties":{"workspace_build_id":{"type":"string"}},"required":["workspace_build_id"],"type":"object"},"strict":false},{"type":"function","description":"List tasks.","name":"bmcp_coder_coder_list_tasks","parameters":{"properties":{"status":{"description":"Optional filter by task status.","type":"string"},"user":{"description":"Username or ID of the user for which to list tasks. Omit or use the `me` keyword to list tasks for the authenticated user.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Lists templates for the authenticated user.","name":"bmcp_coder_coder_list_templates","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Lists workspaces for the authenticated user.","name":"bmcp_coder_coder_list_workspaces","parameters":{"properties":{"owner":{"description":"The owner of the workspaces to list. Use \"me\" to list workspaces for the authenticated user. If you do not specify an owner, \"me\" will be assumed by default.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Send input to a running task.","name":"bmcp_coder_coder_send_task_input","parameters":{"properties":{"input":{"description":"The input to send to the task.","type":"string"},"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to prompt. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id","input"],"type":"object"},"strict":false},{"type":"function","description":"Get the parameters for a template version. You can refer to these as workspace parameters to the user, as they are typically important for creating a workspace.","name":"bmcp_coder_coder_template_version_parameters","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Update the active version of a template. This is helpful when iterating on templates.","name":"bmcp_coder_coder_update_template_active_version","parameters":{"properties":{"template_id":{"type":"string"},"template_version_id":{"type":"string"}},"required":["template_id","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create and upload a tar file by key/value mapping of file names to file contents. Use this to create template versions. Reference the tool description of \"create_template_version\" to understand template requirements.","name":"bmcp_coder_coder_upload_tar_file","parameters":{"properties":{"files":{"description":"A map of file names to file contents.","type":"object"}},"required":["files"],"type":"object"},"strict":false},{"type":"function","description":"Execute a bash command in a Coder workspace.\n\nThis tool provides the same functionality as the 'coder ssh <workspace> <command>' CLI command.\nIt automatically starts the workspace if it's stopped and waits for the agent to be ready.\nThe output is trimmed of leading and trailing whitespace.\n\nThe workspace parameter supports various formats:\n- workspace (uses current user)\n- owner/workspace\n- owner--workspace\n- workspace.agent (specific agent)\n- owner/workspace.agent\n\nThe timeout_ms parameter specifies the command timeout in milliseconds (defaults to 60000ms, maximum of 300000ms).\nIf the command times out, all output captured up to that point is returned with a cancellation message.\n\nFor background commands (background: true), output is captured until the timeout is reached, then the command\ncontinues running in the background. The captured output is returned as the result.\n\nFor file operations (list, write, edit), always prefer the dedicated file tools.\nDo not use bash commands (ls, cat, echo, heredoc, etc.) to list, write, or read\nfiles when the file tools are available. The bash tool should be used for:\n\n\t- Running commands and scripts\n\t- Installing packages\n\t- Starting services\n\t- Executing programs\n\nExamples:\n- workspace: \"john/dev-env\", command: \"git status\", timeout_ms: 30000\n- workspace: \"my-workspace\", command: \"npm run dev\", background: true, timeout_ms: 10000\n- workspace: \"my-workspace.main\", command: \"docker ps\"","name":"bmcp_coder_coder_workspace_bash","parameters":{"properties":{"background":{"description":"Whether to run the command in the background. Output is captured until timeout, then the command continues running in the background.","type":"boolean"},"command":{"description":"The bash command to execute in the workspace.","type":"string"},"timeout_ms":{"default":60000,"description":"Command timeout in milliseconds. Defaults to 60000ms (60 seconds) if not specified.","minimum":1,"type":"integer"},"workspace":{"description":"The workspace name in format [owner/]workspace[.agent]. If owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","command"],"type":"object"},"strict":false},{"type":"function","description":"Edit a file in a workspace.","name":"bmcp_coder_coder_workspace_edit_file","parameters":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","edits"],"type":"object"},"strict":false},{"type":"function","description":"Edit one or more files in a workspace.","name":"bmcp_coder_coder_workspace_edit_files","parameters":{"properties":{"files":{"description":"An array of files to edit.","items":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"}},"required":["path","edits"],"type":"object"},"type":"array"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","files"],"type":"object"},"strict":false},{"type":"function","description":"List the URLs of Coder apps running in a workspace for a single agent.","name":"bmcp_coder_coder_workspace_list_apps","parameters":{"properties":{"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace"],"type":"object"},"strict":false},{"type":"function","description":"List directories in a workspace.","name":"bmcp_coder_coder_workspace_ls","parameters":{"properties":{"path":{"description":"The absolute path of the directory in the workspace to list.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Fetch URLs that forward to the specified port.","name":"bmcp_coder_coder_workspace_port_forward","parameters":{"properties":{"port":{"description":"The port to forward.","type":"number"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","port"],"type":"object"},"strict":false},{"type":"function","description":"Read from a file in a workspace.","name":"bmcp_coder_coder_workspace_read_file","parameters":{"properties":{"limit":{"description":"The number of bytes to read. Cannot exceed 1 MiB. Defaults to the full size of the file or 1 MiB, whichever is lower.","type":"integer"},"offset":{"description":"A byte offset indicating where in the file to start reading. Defaults to zero. An empty string indicates the end of the file has been reached.","type":"integer"},"path":{"description":"The absolute path of the file to read in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Write a file in a workspace.\n\nIf a file write fails due to syntax errors or encoding issues, do NOT switch\nto using bash commands as a workaround. Instead:\n\n\t1. Read the error message carefully to identify the issue\n\t2. Fix the content encoding/syntax\n\t3. Retry with this tool\n\nThe content parameter expects base64-encoded bytes. Ensure your source content\nis correct before encoding it. If you encounter errors, decode and verify the\ncontent you are trying to write, then re-encode it properly.\n","name":"bmcp_coder_coder_workspace_write_file","parameters":{"properties":{"content":{"description":"The base64-encoded bytes to write to the file.","type":"string"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","content"],"type":"object"},"strict":false}],"top_logprobs":0,"top_p":1.0,"truncation":"disabled","usage":{"input_tokens":6269,"input_tokens_details":{"cached_tokens":100,"cache_write_tokens":7},"output_tokens":18,"output_tokens_details":{"reasoning_tokens":3},"total_tokens":6287},"user":null,"metadata":{}},"sequence_number":6}
 
 
 -- streaming/tool-call --
@@ -591,5 +591,5 @@ event: response.output_item.done
 data: {"type":"response.output_item.done","item":{"id":"msg_0bc5f54fce6df69a0069724421feb88194acb48ce194f3ee14","type":"message","status":"completed","content":[{"type":"output_text","annotations":[],"logprobs":[],"text":"You have two Coder templates:\n\n1. Template Name: codex-test\n   - Template ID: d85cac35-15a1-4bde-97d9-1f3e4b851246\n   - Active Version ID: 22a3face-0c93-4b88-a63a-1ec1651e0199\n   - Active User Count: 1\n\n2. Template Name: docker\n   - Template ID: 7e799e56-6591-4c44-b575-3c72b55b7217\n   - Active Version ID: 8057a565-1c12-489e-a563-8e8bb162c867\n   - Active User Count: 1\n\nLet me know if you want more details or want to perform any actions with these templates."}],"role":"assistant"},"output_index":0,"sequence_number":186}
 
 event: response.completed
-data: {"type":"response.completed","response":{"id":"resp_0bc5f54fce6df69a006972442175908194bb81d31f576e6ca6","object":"response","created_at":1769096225,"status":"completed","background":false,"completed_at":1769096230,"error":null,"frequency_penalty":0.0,"incomplete_details":null,"instructions":null,"max_output_tokens":null,"max_tool_calls":null,"model":"gpt-4.1-mini-2025-04-14","output":[{"id":"msg_0bc5f54fce6df69a0069724421feb88194acb48ce194f3ee14","type":"message","status":"completed","content":[{"type":"output_text","annotations":[],"logprobs":[],"text":"You have two Coder templates:\n\n1. Template Name: codex-test\n   - Template ID: d85cac35-15a1-4bde-97d9-1f3e4b851246\n   - Active Version ID: 22a3face-0c93-4b88-a63a-1ec1651e0199\n   - Active User Count: 1\n\n2. Template Name: docker\n   - Template ID: 7e799e56-6591-4c44-b575-3c72b55b7217\n   - Active Version ID: 8057a565-1c12-489e-a563-8e8bb162c867\n   - Active User Count: 1\n\nLet me know if you want more details or want to perform any actions with these templates."}],"role":"assistant"}],"parallel_tool_calls":false,"presence_penalty":0.0,"previous_response_id":null,"prompt_cache_key":null,"prompt_cache_retention":null,"reasoning":{"effort":null,"summary":null},"safety_identifier":null,"service_tier":"default","store":true,"temperature":1.0,"text":{"format":{"type":"text"},"verbosity":"medium"},"tool_choice":"auto","tools":[{"type":"function","description":"Create a task.","name":"bmcp_coder_coder_create_task","parameters":{"properties":{"input":{"description":"Input/prompt for the task.","type":"string"},"template_version_id":{"description":"ID of the template version to create the task from.","type":"string"},"template_version_preset_id":{"description":"Optional ID of the template version preset to create the task from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a task. Omit or use the `me` keyword to create a task for the authenticated user.","type":"string"}},"required":["input","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template in Coder. First, you must create a template version.","name":"bmcp_coder_coder_create_template","parameters":{"properties":{"description":{"type":"string"},"display_name":{"type":"string"},"icon":{"description":"A URL to an icon to use.","type":"string"},"name":{"type":"string"},"version_id":{"description":"The ID of the version to use.","type":"string"}},"required":["name","display_name","description","version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template version. This is a precursor to creating a template, or you can update an existing template.\n\nTemplates are Terraform defining a development environment. The provisioned infrastructure must run\nan Agent that connects to the Coder Control Plane to provide a rich experience.\n\nHere are some strict rules for creating a template version:\n- YOU MUST NOT use \"variable\" or \"output\" blocks in the Terraform code.\n- YOU MUST ALWAYS check template version logs after creation to ensure the template was imported successfully.\n\nWhen a template version is created, a Terraform Plan occurs that ensures the infrastructure\n_could_ be provisioned, but actual provisioning occurs when a workspace is created.\n\n<terraform-spec>\nThe Coder Terraform Provider can be imported like:\n\n```hcl\nterraform {\n  required_providers {\n    coder = {\n      source = \"coder/coder\"\n    }\n  }\n}\n```\n\nA destroy does not occur when a user stops a workspace, but rather the transition changes:\n\n```hcl\ndata \"coder_workspace\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace.\n- name: The name of the workspace.\n- transition: Either \"start\" or \"stop\".\n- start_count: A computed count based on the transition field. If \"start\", this will be 1.\n\nAccess workspace owner information with:\n\n```hcl\ndata \"coder_workspace_owner\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace owner.\n- name: The name of the workspace owner.\n- full_name: The full name of the workspace owner.\n- email: The email of the workspace owner.\n- session_token: A token that can be used to authenticate the workspace owner. It is regenerated every time the workspace is started.\n- oidc_access_token: A valid OpenID Connect access token of the workspace owner. This is only available if the workspace owner authenticated with OpenID Connect. If a valid token cannot be obtained, this value will be an empty string.\n\nParameters are defined in the template version. They are rendered in the UI on the workspace creation page:\n\n```hcl\nresource \"coder_parameter\" \"region\" {\n  name = \"region\"\n  type = \"string\"\n  default = \"us-east-1\"\n}\n```\n\nThis resource accepts the following properties:\n- name: The name of the parameter.\n- default: The default value of the parameter.\n- type: The type of the parameter. Must be one of: \"string\", \"number\", \"bool\", or \"list(string)\".\n- display_name: The displayed name of the parameter as it will appear in the UI.\n- description: The description of the parameter as it will appear in the UI.\n- ephemeral: The value of an ephemeral parameter will not be preserved between consecutive workspace builds.\n- form_type: The type of this parameter. Must be one of: [radio, slider, input, dropdown, checkbox, switch, multi-select, tag-select, textarea, error].\n- icon: A URL to an icon to display in the UI.\n- mutable: Whether this value can be changed after workspace creation. This can be destructive for values like region, so use with caution!\n- option: Each option block defines a value for a user to select from. (see below for nested schema)\n  Required:\n  - name: The name of the option.\n  - value: The value of the option.\n  Optional:\n  - description: The description of the option as it will appear in the UI.\n  - icon: A URL to an icon to display in the UI.\n\nA Workspace Agent runs on provisioned infrastructure to provide access to the workspace:\n\n```hcl\nresource \"coder_agent\" \"dev\" {\n  arch = \"amd64\"\n  os = \"linux\"\n}\n```\n\nThis resource accepts the following properties:\n- arch: The architecture of the agent. Must be one of: \"amd64\", \"arm64\", or \"armv7\".\n- os: The operating system of the agent. Must be one of: \"linux\", \"windows\", or \"darwin\".\n- auth: The authentication method for the agent. Must be one of: \"token\", \"google-instance-identity\", \"aws-instance-identity\", or \"azure-instance-identity\". It is insecure to pass the agent token via exposed variables to Virtual Machines. Instance Identity enables provisioned VMs to authenticate by instance ID on start.\n- dir: The starting directory when a user creates a shell session. Defaults to \"$HOME\".\n- env: A map of environment variables to set for the agent.\n- startup_script: A script to run after the agent starts. This script MUST exit eventually to signal that startup has completed. Use \"&\" or \"screen\" to run processes in the background.\n\nThis resource provides the following fields:\n- id: The UUID of the agent.\n- init_script: The script to run on provisioned infrastructure to fetch and start the agent.\n- token: Set the environment variable CODER_AGENT_TOKEN to this value to authenticate the agent.\n\nThe agent MUST be installed and started using the init_script. A utility like curl or wget to fetch the agent binary must exist in the provisioned infrastructure.\n\nExpose terminal or HTTP applications running in a workspace with:\n\n```hcl\nresource \"coder_app\" \"dev\" {\n  agent_id = coder_agent.dev.id\n  slug = \"my-app-name\"\n  display_name = \"My App\"\n  icon = \"https://my-app.com/icon.svg\"\n  url = \"http://127.0.0.1:3000\"\n}\n```\n\nThis resource accepts the following properties:\n- agent_id: The ID of the agent to attach the app to.\n- slug: The slug of the app.\n- display_name: The displayed name of the app as it will appear in the UI.\n- icon: A URL to an icon to display in the UI.\n- url: An external url if external=true or a URL to be proxied to from inside the workspace. This should be of the form http://localhost:PORT[/SUBPATH]. Either command or url may be specified, but not both.\n- command: A command to run in a terminal opening this app. In the web, this will open in a new tab. In the CLI, this will SSH and execute the command. Either command or url may be specified, but not both.\n- external: Whether this app is an external app. If true, the url will be opened in a new tab.\n</terraform-spec>\n\nThe Coder Server may not be authenticated with the infrastructure provider a user requests. In this scenario,\nthe user will need to provide credentials to the Coder Server before the workspace can be provisioned.\n\nHere are examples of provisioning the Coder Agent on specific infrastructure providers:\n\n<aws-ec2-instance>\n// The agent is configured with \"aws-instance-identity\" auth.\nterraform {\n  required_providers {\n    cloudinit = {\n      source = \"hashicorp/cloudinit\"\n    }\n    aws = {\n      source = \"hashicorp/aws\"\n    }\n  }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n  gzip          = false\n  base64_encode = false\n  boundary = \"//\"\n  part {\n    filename     = \"cloud-config.yaml\"\n    content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t//   - [scripts-user, always]\n\t// hostname: ${hostname}\n\t// users:\n\t//   - name: ${linux_user}\n\t//     sudo: ALL=(ALL) NOPASSWD:ALL\n\t//     shell: /bin/bash\n    content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n      hostname   = local.hostname\n      linux_user = local.linux_user\n    })\n  }\n\n  part {\n    filename     = \"userdata.sh\"\n    content_type = \"text/x-shellscript\"\n\n\t// Here is the content of the userdata.sh.tftpl file:\n\t// #!/bin/bash\n\t// sudo -u '${linux_user}' sh -c '${init_script}'\n    content = templatefile(\"${path.module}/cloud-init/userdata.sh.tftpl\", {\n      linux_user = local.linux_user\n\n      init_script = try(coder_agent.dev[0].init_script, \"\")\n    })\n  }\n}\n\nresource \"aws_instance\" \"dev\" {\n  ami               = data.aws_ami.ubuntu.id\n  availability_zone = \"${data.coder_parameter.region.value}a\"\n  instance_type     = data.coder_parameter.instance_type.value\n\n  user_data = data.cloudinit_config.user_data.rendered\n  tags = {\n    Name = \"coder-${data.coder_workspace_owner.me.name}-${data.coder_workspace.me.name}\"\n  }\n  lifecycle {\n    ignore_changes = [ami]\n  }\n}\n</aws-ec2-instance>\n\n<gcp-vm-instance>\n// The agent is configured with \"google-instance-identity\" auth.\nterraform {\n  required_providers {\n    google = {\n      source = \"hashicorp/google\"\n    }\n  }\n}\n\nresource \"google_compute_instance\" \"dev\" {\n  zone         = module.gcp_region.value\n  count        = data.coder_workspace.me.start_count\n  name         = \"coder-${lower(data.coder_workspace_owner.me.name)}-${lower(data.coder_workspace.me.name)}-root\"\n  machine_type = \"e2-medium\"\n  network_interface {\n    network = \"default\"\n    access_config {\n      // Ephemeral public IP\n    }\n  }\n  boot_disk {\n    auto_delete = false\n    source      = google_compute_disk.root.name\n  }\n  // In order to use google-instance-identity, a service account *must* be provided.\n  service_account {\n    email  = data.google_compute_default_service_account.default.email\n    scopes = [\"cloud-platform\"]\n  }\n  # ONLY FOR WINDOWS:\n  # metadata = {\n  #   windows-startup-script-ps1 = coder_agent.main.init_script\n  # }\n  # The startup script runs as root with no $HOME environment set up, so instead of directly\n  # running the agent init script, create a user (with a homedir, default shell and sudo\n  # permissions) and execute the init script as that user.\n  #\n  # The agent MUST be started in here.\n  metadata_startup_script = <<EOMETA\n#!/usr/bin/env sh\nset -eux\n\n# If user does not exist, create it and set up passwordless sudo\nif ! id -u \"${local.linux_user}\" >/dev/null 2>&1; then\n  useradd -m -s /bin/bash \"${local.linux_user}\"\n  echo \"${local.linux_user} ALL=(ALL) NOPASSWD:ALL\" > /etc/sudoers.d/coder-user\nfi\n\nexec sudo -u \"${local.linux_user}\" sh -c '${coder_agent.main.init_script}'\nEOMETA\n}\n</gcp-vm-instance>\n\n<azure-vm-instance>\n// The agent is configured with \"azure-instance-identity\" auth.\nterraform {\n  required_providers {\n    azurerm = {\n      source = \"hashicorp/azurerm\"\n    }\n    cloudinit = {\n      source = \"hashicorp/cloudinit\"\n    }\n  }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n  gzip          = false\n  base64_encode = true\n\n  boundary = \"//\"\n\n  part {\n    filename     = \"cloud-config.yaml\"\n    content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t// - [scripts-user, always]\n\t// bootcmd:\n\t//   # work around https://github.com/hashicorp/terraform-provider-azurerm/issues/6117\n\t//   - until [ -e /dev/disk/azure/scsi1/lun10 ]; do sleep 1; done\n\t// device_aliases:\n\t//   homedir: /dev/disk/azure/scsi1/lun10\n\t// disk_setup:\n\t//   homedir:\n\t//     table_type: gpt\n\t//     layout: true\n\t// fs_setup:\n\t//   - label: coder_home\n\t//     filesystem: ext4\n\t//     device: homedir.1\n\t// mounts:\n\t//   - [\"LABEL=coder_home\", \"/home/${username}\"]\n\t// hostname: ${hostname}\n\t// users:\n\t//   - name: ${username}\n\t//     sudo: [\"ALL=(ALL) NOPASSWD:ALL\"]\n\t//     groups: sudo\n\t//     shell: /bin/bash\n\t// packages:\n\t//   - git\n\t// write_files:\n\t//   - path: /opt/coder/init\n\t//     permissions: \"0755\"\n\t//     encoding: b64\n\t//     content: ${init_script}\n\t//   - path: /etc/systemd/system/coder-agent.service\n\t//     permissions: \"0644\"\n\t//     content: |\n\t//       [Unit]\n\t//       Description=Coder Agent\n\t//       After=network-online.target\n\t//       Wants=network-online.target\n\n\t//       [Service]\n\t//       User=${username}\n\t//       ExecStart=/opt/coder/init\n\t//       Restart=always\n\t//       RestartSec=10\n\t//       TimeoutStopSec=90\n\t//       KillMode=process\n\n\t//       OOMScoreAdjust=-900\n\t//       SyslogIdentifier=coder-agent\n\n\t//       [Install]\n\t//       WantedBy=multi-user.target\n\t// runcmd:\n\t//   - chown ${username}:${username} /home/${username}\n\t//   - systemctl enable coder-agent\n\t//   - systemctl start coder-agent\n    content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n      username    = \"coder\" # Ensure this user/group does not exist in your VM image\n      init_script = base64encode(coder_agent.main.init_script)\n      hostname    = lower(data.coder_workspace.me.name)\n    })\n  }\n}\n\nresource \"azurerm_linux_virtual_machine\" \"main\" {\n  count               = data.coder_workspace.me.start_count\n  name                = \"vm\"\n  resource_group_name = azurerm_resource_group.main.name\n  location            = azurerm_resource_group.main.location\n  size                = data.coder_parameter.instance_type.value\n  // cloud-init overwrites this, so the value here doesn't matter\n  admin_username = \"adminuser\"\n  admin_ssh_key {\n    public_key = tls_private_key.dummy.public_key_openssh\n    username   = \"adminuser\"\n  }\n\n  network_interface_ids = [\n    azurerm_network_interface.main.id,\n  ]\n  computer_name = lower(data.coder_workspace.me.name)\n  os_disk {\n    caching              = \"ReadWrite\"\n    storage_account_type = \"Standard_LRS\"\n  }\n  source_image_reference {\n    publisher = \"Canonical\"\n    offer     = \"0001-com-ubuntu-server-focal\"\n    sku       = \"20_04-lts-gen2\"\n    version   = \"latest\"\n  }\n  user_data = data.cloudinit_config.user_data.rendered\n}\n</azure-vm-instance>\n\n<docker-container>\nterraform {\n  required_providers {\n    coder = {\n      source = \"kreuzwerker/docker\"\n    }\n  }\n}\n\n// The agent is configured with \"token\" auth.\n\nresource \"docker_container\" \"workspace\" {\n  count = data.coder_workspace.me.start_count\n  image = \"codercom/enterprise-base:ubuntu\"\n  # Uses lower() to avoid Docker restriction on container names.\n  name = \"coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}\"\n  # Hostname makes the shell more user friendly: coder@my-workspace:~$\n  hostname = data.coder_workspace.me.name\n  # Use the docker gateway if the access URL is 127.0.0.1.\n  entrypoint = [\"sh\", \"-c\", replace(coder_agent.main.init_script, \"/localhost|127\\\\.0\\\\.0\\\\.1/\", \"host.docker.internal\")]\n  env        = [\"CODER_AGENT_TOKEN=${coder_agent.main.token}\"]\n  host {\n    host = \"host.docker.internal\"\n    ip   = \"host-gateway\"\n  }\n  volumes {\n    container_path = \"/home/coder\"\n    volume_name    = docker_volume.home_volume.name\n    read_only      = false\n  }\n}\n</docker-container>\n\n<kubernetes-pod>\n// The agent is configured with \"token\" auth.\n\nresource \"kubernetes_deployment\" \"main\" {\n  count = data.coder_workspace.me.start_count\n  depends_on = [\n    kubernetes_persistent_volume_claim.home\n  ]\n  wait_for_rollout = false\n  metadata {\n    name      = \"coder-${data.coder_workspace.me.id}\"\n  }\n\n  spec {\n    replicas = 1\n    strategy {\n      type = \"Recreate\"\n    }\n\n    template {\n      spec {\n        security_context {\n          run_as_user     = 1000\n          fs_group        = 1000\n          run_as_non_root = true\n        }\n\n        container {\n          name              = \"dev\"\n          image             = \"codercom/enterprise-base:ubuntu\"\n          image_pull_policy = \"Always\"\n          command           = [\"sh\", \"-c\", coder_agent.main.init_script]\n          security_context {\n            run_as_user = \"1000\"\n          }\n          env {\n            name  = \"CODER_AGENT_TOKEN\"\n            value = coder_agent.main.token\n          }\n        }\n      }\n    }\n  }\n}\n</kubernetes-pod>\n\nThe file_id provided is a reference to a tar file you have uploaded containing the Terraform.\n","name":"bmcp_coder_coder_create_template_version","parameters":{"properties":{"file_id":{"type":"string"},"template_id":{"type":"string"}},"required":["file_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace in Coder.\n\nIf a user is asking to \"test a template\", they are typically referring\nto creating a workspace from a template to ensure the infrastructure\nis provisioned correctly and the agent can connect to the control plane.\n\nBefore creating a workspace, always confirm the template choice with the user by:\n\n\t1. Listing the available templates that match their request.\n\t2. Recommending the most relevant option.\n\t2. Asking the user to confirm which template to use.\n\nIt is important to not create a workspace without confirming the template\nchoice with the user.\n\nAfter creating a workspace, watch the build logs and wait for the workspace to\nbe ready before trying to use or connect to the workspace.\n","name":"bmcp_coder_coder_create_workspace","parameters":{"properties":{"name":{"description":"Name of the workspace to create.","type":"string"},"rich_parameters":{"description":"Key/value pairs of rich parameters to pass to the template version to create the workspace.","type":"object"},"template_version_id":{"description":"ID of the template version to create the workspace from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a workspace. Omit or use the `me` keyword to create a workspace for the authenticated user.","type":"string"}},"required":["user","template_version_id","name","rich_parameters"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace build for an existing workspace. Use this to start, stop, or delete.\n\nAfter creating a workspace build, watch the build logs and wait for the\nworkspace build to complete before trying to start another build or use or\nconnect to the workspace.\n","name":"bmcp_coder_coder_create_workspace_build","parameters":{"properties":{"template_version_id":{"description":"(Optional) The template version ID to use for the workspace build. If not provided, the previously built version will be used.","type":"string"},"transition":{"description":"The transition to perform. Must be one of: start, stop, delete","enum":["start","stop","delete"],"type":"string"},"workspace_id":{"type":"string"}},"required":["workspace_id","transition"],"type":"object"},"strict":false},{"type":"function","description":"Delete a task.","name":"bmcp_coder_coder_delete_task","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to delete. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Delete a template. This is irreversible.","name":"bmcp_coder_coder_delete_template","parameters":{"properties":{"template_id":{"type":"string"}},"required":["template_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the currently authenticated user, similar to the `whoami` command.","name":"bmcp_coder_coder_get_authenticated_user","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a task.","name":"bmcp_coder_coder_get_task_logs","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to query. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the status of a task.","name":"bmcp_coder_coder_get_task_status","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to get. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a template version. This is useful to check whether a template version successfully imports or not.","name":"bmcp_coder_coder_get_template_version_logs","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Get a workspace by name or ID.\n\nThis returns more data than list_workspaces to reduce token usage.","name":"bmcp_coder_coder_get_workspace","parameters":{"properties":{"workspace_id":{"description":"The workspace ID or name in the format [owner/]workspace. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace agent.\n\n\t\tMore logs may appear after this call. It does not wait for the agent to finish.","name":"bmcp_coder_coder_get_workspace_agent_logs","parameters":{"properties":{"workspace_agent_id":{"type":"string"}},"required":["workspace_agent_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace build.\n\n\t\tUseful for checking whether a workspace builds successfully or not.","name":"bmcp_coder_coder_get_workspace_build_logs","parameters":{"properties":{"workspace_build_id":{"type":"string"}},"required":["workspace_build_id"],"type":"object"},"strict":false},{"type":"function","description":"List tasks.","name":"bmcp_coder_coder_list_tasks","parameters":{"properties":{"status":{"description":"Optional filter by task status.","type":"string"},"user":{"description":"Username or ID of the user for which to list tasks. Omit or use the `me` keyword to list tasks for the authenticated user.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Lists templates for the authenticated user.","name":"bmcp_coder_coder_list_templates","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Lists workspaces for the authenticated user.","name":"bmcp_coder_coder_list_workspaces","parameters":{"properties":{"owner":{"description":"The owner of the workspaces to list. Use \"me\" to list workspaces for the authenticated user. If you do not specify an owner, \"me\" will be assumed by default.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Send input to a running task.","name":"bmcp_coder_coder_send_task_input","parameters":{"properties":{"input":{"description":"The input to send to the task.","type":"string"},"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to prompt. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id","input"],"type":"object"},"strict":false},{"type":"function","description":"Get the parameters for a template version. You can refer to these as workspace parameters to the user, as they are typically important for creating a workspace.","name":"bmcp_coder_coder_template_version_parameters","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Update the active version of a template. This is helpful when iterating on templates.","name":"bmcp_coder_coder_update_template_active_version","parameters":{"properties":{"template_id":{"type":"string"},"template_version_id":{"type":"string"}},"required":["template_id","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create and upload a tar file by key/value mapping of file names to file contents. Use this to create template versions. Reference the tool description of \"create_template_version\" to understand template requirements.","name":"bmcp_coder_coder_upload_tar_file","parameters":{"properties":{"files":{"description":"A map of file names to file contents.","type":"object"}},"required":["files"],"type":"object"},"strict":false},{"type":"function","description":"Execute a bash command in a Coder workspace.\n\nThis tool provides the same functionality as the 'coder ssh <workspace> <command>' CLI command.\nIt automatically starts the workspace if it's stopped and waits for the agent to be ready.\nThe output is trimmed of leading and trailing whitespace.\n\nThe workspace parameter supports various formats:\n- workspace (uses current user)\n- owner/workspace\n- owner--workspace\n- workspace.agent (specific agent)\n- owner/workspace.agent\n\nThe timeout_ms parameter specifies the command timeout in milliseconds (defaults to 60000ms, maximum of 300000ms).\nIf the command times out, all output captured up to that point is returned with a cancellation message.\n\nFor background commands (background: true), output is captured until the timeout is reached, then the command\ncontinues running in the background. The captured output is returned as the result.\n\nFor file operations (list, write, edit), always prefer the dedicated file tools.\nDo not use bash commands (ls, cat, echo, heredoc, etc.) to list, write, or read\nfiles when the file tools are available. The bash tool should be used for:\n\n\t- Running commands and scripts\n\t- Installing packages\n\t- Starting services\n\t- Executing programs\n\nExamples:\n- workspace: \"john/dev-env\", command: \"git status\", timeout_ms: 30000\n- workspace: \"my-workspace\", command: \"npm run dev\", background: true, timeout_ms: 10000\n- workspace: \"my-workspace.main\", command: \"docker ps\"","name":"bmcp_coder_coder_workspace_bash","parameters":{"properties":{"background":{"description":"Whether to run the command in the background. Output is captured until timeout, then the command continues running in the background.","type":"boolean"},"command":{"description":"The bash command to execute in the workspace.","type":"string"},"timeout_ms":{"default":60000,"description":"Command timeout in milliseconds. Defaults to 60000ms (60 seconds) if not specified.","minimum":1,"type":"integer"},"workspace":{"description":"The workspace name in format [owner/]workspace[.agent]. If owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","command"],"type":"object"},"strict":false},{"type":"function","description":"Edit a file in a workspace.","name":"bmcp_coder_coder_workspace_edit_file","parameters":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","edits"],"type":"object"},"strict":false},{"type":"function","description":"Edit one or more files in a workspace.","name":"bmcp_coder_coder_workspace_edit_files","parameters":{"properties":{"files":{"description":"An array of files to edit.","items":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"}},"required":["path","edits"],"type":"object"},"type":"array"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","files"],"type":"object"},"strict":false},{"type":"function","description":"List the URLs of Coder apps running in a workspace for a single agent.","name":"bmcp_coder_coder_workspace_list_apps","parameters":{"properties":{"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace"],"type":"object"},"strict":false},{"type":"function","description":"List directories in a workspace.","name":"bmcp_coder_coder_workspace_ls","parameters":{"properties":{"path":{"description":"The absolute path of the directory in the workspace to list.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Fetch URLs that forward to the specified port.","name":"bmcp_coder_coder_workspace_port_forward","parameters":{"properties":{"port":{"description":"The port to forward.","type":"number"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","port"],"type":"object"},"strict":false},{"type":"function","description":"Read from a file in a workspace.","name":"bmcp_coder_coder_workspace_read_file","parameters":{"properties":{"limit":{"description":"The number of bytes to read. Cannot exceed 1 MiB. Defaults to the full size of the file or 1 MiB, whichever is lower.","type":"integer"},"offset":{"description":"A byte offset indicating where in the file to start reading. Defaults to zero. An empty string indicates the end of the file has been reached.","type":"integer"},"path":{"description":"The absolute path of the file to read in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Write a file in a workspace.\n\nIf a file write fails due to syntax errors or encoding issues, do NOT switch\nto using bash commands as a workaround. Instead:\n\n\t1. Read the error message carefully to identify the issue\n\t2. Fix the content encoding/syntax\n\t3. Retry with this tool\n\nThe content parameter expects base64-encoded bytes. Ensure your source content\nis correct before encoding it. If you encounter errors, decode and verify the\ncontent you are trying to write, then re-encode it properly.\n","name":"bmcp_coder_coder_workspace_write_file","parameters":{"properties":{"content":{"description":"The base64-encoded bytes to write to the file.","type":"string"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","content"],"type":"object"},"strict":false}],"top_logprobs":0,"top_p":1.0,"truncation":"disabled","usage":{"input_tokens":6463,"input_tokens_details":{"cached_tokens":6144},"output_tokens":182,"output_tokens_details":{"reasoning_tokens":0},"total_tokens":6645},"user":null,"metadata":{}},"sequence_number":187}
+data: {"type":"response.completed","response":{"id":"resp_0bc5f54fce6df69a006972442175908194bb81d31f576e6ca6","object":"response","created_at":1769096225,"status":"completed","background":false,"completed_at":1769096230,"error":null,"frequency_penalty":0.0,"incomplete_details":null,"instructions":null,"max_output_tokens":null,"max_tool_calls":null,"model":"gpt-4.1-mini-2025-04-14","output":[{"id":"msg_0bc5f54fce6df69a0069724421feb88194acb48ce194f3ee14","type":"message","status":"completed","content":[{"type":"output_text","annotations":[],"logprobs":[],"text":"You have two Coder templates:\n\n1. Template Name: codex-test\n   - Template ID: d85cac35-15a1-4bde-97d9-1f3e4b851246\n   - Active Version ID: 22a3face-0c93-4b88-a63a-1ec1651e0199\n   - Active User Count: 1\n\n2. Template Name: docker\n   - Template ID: 7e799e56-6591-4c44-b575-3c72b55b7217\n   - Active Version ID: 8057a565-1c12-489e-a563-8e8bb162c867\n   - Active User Count: 1\n\nLet me know if you want more details or want to perform any actions with these templates."}],"role":"assistant"}],"parallel_tool_calls":false,"presence_penalty":0.0,"previous_response_id":null,"prompt_cache_key":null,"prompt_cache_retention":null,"reasoning":{"effort":null,"summary":null},"safety_identifier":null,"service_tier":"default","store":true,"temperature":1.0,"text":{"format":{"type":"text"},"verbosity":"medium"},"tool_choice":"auto","tools":[{"type":"function","description":"Create a task.","name":"bmcp_coder_coder_create_task","parameters":{"properties":{"input":{"description":"Input/prompt for the task.","type":"string"},"template_version_id":{"description":"ID of the template version to create the task from.","type":"string"},"template_version_preset_id":{"description":"Optional ID of the template version preset to create the task from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a task. Omit or use the `me` keyword to create a task for the authenticated user.","type":"string"}},"required":["input","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template in Coder. First, you must create a template version.","name":"bmcp_coder_coder_create_template","parameters":{"properties":{"description":{"type":"string"},"display_name":{"type":"string"},"icon":{"description":"A URL to an icon to use.","type":"string"},"name":{"type":"string"},"version_id":{"description":"The ID of the version to use.","type":"string"}},"required":["name","display_name","description","version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template version. This is a precursor to creating a template, or you can update an existing template.\n\nTemplates are Terraform defining a development environment. The provisioned infrastructure must run\nan Agent that connects to the Coder Control Plane to provide a rich experience.\n\nHere are some strict rules for creating a template version:\n- YOU MUST NOT use \"variable\" or \"output\" blocks in the Terraform code.\n- YOU MUST ALWAYS check template version logs after creation to ensure the template was imported successfully.\n\nWhen a template version is created, a Terraform Plan occurs that ensures the infrastructure\n_could_ be provisioned, but actual provisioning occurs when a workspace is created.\n\n<terraform-spec>\nThe Coder Terraform Provider can be imported like:\n\n```hcl\nterraform {\n  required_providers {\n    coder = {\n      source = \"coder/coder\"\n    }\n  }\n}\n```\n\nA destroy does not occur when a user stops a workspace, but rather the transition changes:\n\n```hcl\ndata \"coder_workspace\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace.\n- name: The name of the workspace.\n- transition: Either \"start\" or \"stop\".\n- start_count: A computed count based on the transition field. If \"start\", this will be 1.\n\nAccess workspace owner information with:\n\n```hcl\ndata \"coder_workspace_owner\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace owner.\n- name: The name of the workspace owner.\n- full_name: The full name of the workspace owner.\n- email: The email of the workspace owner.\n- session_token: A token that can be used to authenticate the workspace owner. It is regenerated every time the workspace is started.\n- oidc_access_token: A valid OpenID Connect access token of the workspace owner. This is only available if the workspace owner authenticated with OpenID Connect. If a valid token cannot be obtained, this value will be an empty string.\n\nParameters are defined in the template version. They are rendered in the UI on the workspace creation page:\n\n```hcl\nresource \"coder_parameter\" \"region\" {\n  name = \"region\"\n  type = \"string\"\n  default = \"us-east-1\"\n}\n```\n\nThis resource accepts the following properties:\n- name: The name of the parameter.\n- default: The default value of the parameter.\n- type: The type of the parameter. Must be one of: \"string\", \"number\", \"bool\", or \"list(string)\".\n- display_name: The displayed name of the parameter as it will appear in the UI.\n- description: The description of the parameter as it will appear in the UI.\n- ephemeral: The value of an ephemeral parameter will not be preserved between consecutive workspace builds.\n- form_type: The type of this parameter. Must be one of: [radio, slider, input, dropdown, checkbox, switch, multi-select, tag-select, textarea, error].\n- icon: A URL to an icon to display in the UI.\n- mutable: Whether this value can be changed after workspace creation. This can be destructive for values like region, so use with caution!\n- option: Each option block defines a value for a user to select from. (see below for nested schema)\n  Required:\n  - name: The name of the option.\n  - value: The value of the option.\n  Optional:\n  - description: The description of the option as it will appear in the UI.\n  - icon: A URL to an icon to display in the UI.\n\nA Workspace Agent runs on provisioned infrastructure to provide access to the workspace:\n\n```hcl\nresource \"coder_agent\" \"dev\" {\n  arch = \"amd64\"\n  os = \"linux\"\n}\n```\n\nThis resource accepts the following properties:\n- arch: The architecture of the agent. Must be one of: \"amd64\", \"arm64\", or \"armv7\".\n- os: The operating system of the agent. Must be one of: \"linux\", \"windows\", or \"darwin\".\n- auth: The authentication method for the agent. Must be one of: \"token\", \"google-instance-identity\", \"aws-instance-identity\", or \"azure-instance-identity\". It is insecure to pass the agent token via exposed variables to Virtual Machines. Instance Identity enables provisioned VMs to authenticate by instance ID on start.\n- dir: The starting directory when a user creates a shell session. Defaults to \"$HOME\".\n- env: A map of environment variables to set for the agent.\n- startup_script: A script to run after the agent starts. This script MUST exit eventually to signal that startup has completed. Use \"&\" or \"screen\" to run processes in the background.\n\nThis resource provides the following fields:\n- id: The UUID of the agent.\n- init_script: The script to run on provisioned infrastructure to fetch and start the agent.\n- token: Set the environment variable CODER_AGENT_TOKEN to this value to authenticate the agent.\n\nThe agent MUST be installed and started using the init_script. A utility like curl or wget to fetch the agent binary must exist in the provisioned infrastructure.\n\nExpose terminal or HTTP applications running in a workspace with:\n\n```hcl\nresource \"coder_app\" \"dev\" {\n  agent_id = coder_agent.dev.id\n  slug = \"my-app-name\"\n  display_name = \"My App\"\n  icon = \"https://my-app.com/icon.svg\"\n  url = \"http://127.0.0.1:3000\"\n}\n```\n\nThis resource accepts the following properties:\n- agent_id: The ID of the agent to attach the app to.\n- slug: The slug of the app.\n- display_name: The displayed name of the app as it will appear in the UI.\n- icon: A URL to an icon to display in the UI.\n- url: An external url if external=true or a URL to be proxied to from inside the workspace. This should be of the form http://localhost:PORT[/SUBPATH]. Either command or url may be specified, but not both.\n- command: A command to run in a terminal opening this app. In the web, this will open in a new tab. In the CLI, this will SSH and execute the command. Either command or url may be specified, but not both.\n- external: Whether this app is an external app. If true, the url will be opened in a new tab.\n</terraform-spec>\n\nThe Coder Server may not be authenticated with the infrastructure provider a user requests. In this scenario,\nthe user will need to provide credentials to the Coder Server before the workspace can be provisioned.\n\nHere are examples of provisioning the Coder Agent on specific infrastructure providers:\n\n<aws-ec2-instance>\n// The agent is configured with \"aws-instance-identity\" auth.\nterraform {\n  required_providers {\n    cloudinit = {\n      source = \"hashicorp/cloudinit\"\n    }\n    aws = {\n      source = \"hashicorp/aws\"\n    }\n  }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n  gzip          = false\n  base64_encode = false\n  boundary = \"//\"\n  part {\n    filename     = \"cloud-config.yaml\"\n    content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t//   - [scripts-user, always]\n\t// hostname: ${hostname}\n\t// users:\n\t//   - name: ${linux_user}\n\t//     sudo: ALL=(ALL) NOPASSWD:ALL\n\t//     shell: /bin/bash\n    content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n      hostname   = local.hostname\n      linux_user = local.linux_user\n    })\n  }\n\n  part {\n    filename     = \"userdata.sh\"\n    content_type = \"text/x-shellscript\"\n\n\t// Here is the content of the userdata.sh.tftpl file:\n\t// #!/bin/bash\n\t// sudo -u '${linux_user}' sh -c '${init_script}'\n    content = templatefile(\"${path.module}/cloud-init/userdata.sh.tftpl\", {\n      linux_user = local.linux_user\n\n      init_script = try(coder_agent.dev[0].init_script, \"\")\n    })\n  }\n}\n\nresource \"aws_instance\" \"dev\" {\n  ami               = data.aws_ami.ubuntu.id\n  availability_zone = \"${data.coder_parameter.region.value}a\"\n  instance_type     = data.coder_parameter.instance_type.value\n\n  user_data = data.cloudinit_config.user_data.rendered\n  tags = {\n    Name = \"coder-${data.coder_workspace_owner.me.name}-${data.coder_workspace.me.name}\"\n  }\n  lifecycle {\n    ignore_changes = [ami]\n  }\n}\n</aws-ec2-instance>\n\n<gcp-vm-instance>\n// The agent is configured with \"google-instance-identity\" auth.\nterraform {\n  required_providers {\n    google = {\n      source = \"hashicorp/google\"\n    }\n  }\n}\n\nresource \"google_compute_instance\" \"dev\" {\n  zone         = module.gcp_region.value\n  count        = data.coder_workspace.me.start_count\n  name         = \"coder-${lower(data.coder_workspace_owner.me.name)}-${lower(data.coder_workspace.me.name)}-root\"\n  machine_type = \"e2-medium\"\n  network_interface {\n    network = \"default\"\n    access_config {\n      // Ephemeral public IP\n    }\n  }\n  boot_disk {\n    auto_delete = false\n    source      = google_compute_disk.root.name\n  }\n  // In order to use google-instance-identity, a service account *must* be provided.\n  service_account {\n    email  = data.google_compute_default_service_account.default.email\n    scopes = [\"cloud-platform\"]\n  }\n  # ONLY FOR WINDOWS:\n  # metadata = {\n  #   windows-startup-script-ps1 = coder_agent.main.init_script\n  # }\n  # The startup script runs as root with no $HOME environment set up, so instead of directly\n  # running the agent init script, create a user (with a homedir, default shell and sudo\n  # permissions) and execute the init script as that user.\n  #\n  # The agent MUST be started in here.\n  metadata_startup_script = <<EOMETA\n#!/usr/bin/env sh\nset -eux\n\n# If user does not exist, create it and set up passwordless sudo\nif ! id -u \"${local.linux_user}\" >/dev/null 2>&1; then\n  useradd -m -s /bin/bash \"${local.linux_user}\"\n  echo \"${local.linux_user} ALL=(ALL) NOPASSWD:ALL\" > /etc/sudoers.d/coder-user\nfi\n\nexec sudo -u \"${local.linux_user}\" sh -c '${coder_agent.main.init_script}'\nEOMETA\n}\n</gcp-vm-instance>\n\n<azure-vm-instance>\n// The agent is configured with \"azure-instance-identity\" auth.\nterraform {\n  required_providers {\n    azurerm = {\n      source = \"hashicorp/azurerm\"\n    }\n    cloudinit = {\n      source = \"hashicorp/cloudinit\"\n    }\n  }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n  gzip          = false\n  base64_encode = true\n\n  boundary = \"//\"\n\n  part {\n    filename     = \"cloud-config.yaml\"\n    content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t// - [scripts-user, always]\n\t// bootcmd:\n\t//   # work around https://github.com/hashicorp/terraform-provider-azurerm/issues/6117\n\t//   - until [ -e /dev/disk/azure/scsi1/lun10 ]; do sleep 1; done\n\t// device_aliases:\n\t//   homedir: /dev/disk/azure/scsi1/lun10\n\t// disk_setup:\n\t//   homedir:\n\t//     table_type: gpt\n\t//     layout: true\n\t// fs_setup:\n\t//   - label: coder_home\n\t//     filesystem: ext4\n\t//     device: homedir.1\n\t// mounts:\n\t//   - [\"LABEL=coder_home\", \"/home/${username}\"]\n\t// hostname: ${hostname}\n\t// users:\n\t//   - name: ${username}\n\t//     sudo: [\"ALL=(ALL) NOPASSWD:ALL\"]\n\t//     groups: sudo\n\t//     shell: /bin/bash\n\t// packages:\n\t//   - git\n\t// write_files:\n\t//   - path: /opt/coder/init\n\t//     permissions: \"0755\"\n\t//     encoding: b64\n\t//     content: ${init_script}\n\t//   - path: /etc/systemd/system/coder-agent.service\n\t//     permissions: \"0644\"\n\t//     content: |\n\t//       [Unit]\n\t//       Description=Coder Agent\n\t//       After=network-online.target\n\t//       Wants=network-online.target\n\n\t//       [Service]\n\t//       User=${username}\n\t//       ExecStart=/opt/coder/init\n\t//       Restart=always\n\t//       RestartSec=10\n\t//       TimeoutStopSec=90\n\t//       KillMode=process\n\n\t//       OOMScoreAdjust=-900\n\t//       SyslogIdentifier=coder-agent\n\n\t//       [Install]\n\t//       WantedBy=multi-user.target\n\t// runcmd:\n\t//   - chown ${username}:${username} /home/${username}\n\t//   - systemctl enable coder-agent\n\t//   - systemctl start coder-agent\n    content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n      username    = \"coder\" # Ensure this user/group does not exist in your VM image\n      init_script = base64encode(coder_agent.main.init_script)\n      hostname    = lower(data.coder_workspace.me.name)\n    })\n  }\n}\n\nresource \"azurerm_linux_virtual_machine\" \"main\" {\n  count               = data.coder_workspace.me.start_count\n  name                = \"vm\"\n  resource_group_name = azurerm_resource_group.main.name\n  location            = azurerm_resource_group.main.location\n  size                = data.coder_parameter.instance_type.value\n  // cloud-init overwrites this, so the value here doesn't matter\n  admin_username = \"adminuser\"\n  admin_ssh_key {\n    public_key = tls_private_key.dummy.public_key_openssh\n    username   = \"adminuser\"\n  }\n\n  network_interface_ids = [\n    azurerm_network_interface.main.id,\n  ]\n  computer_name = lower(data.coder_workspace.me.name)\n  os_disk {\n    caching              = \"ReadWrite\"\n    storage_account_type = \"Standard_LRS\"\n  }\n  source_image_reference {\n    publisher = \"Canonical\"\n    offer     = \"0001-com-ubuntu-server-focal\"\n    sku       = \"20_04-lts-gen2\"\n    version   = \"latest\"\n  }\n  user_data = data.cloudinit_config.user_data.rendered\n}\n</azure-vm-instance>\n\n<docker-container>\nterraform {\n  required_providers {\n    coder = {\n      source = \"kreuzwerker/docker\"\n    }\n  }\n}\n\n// The agent is configured with \"token\" auth.\n\nresource \"docker_container\" \"workspace\" {\n  count = data.coder_workspace.me.start_count\n  image = \"codercom/enterprise-base:ubuntu\"\n  # Uses lower() to avoid Docker restriction on container names.\n  name = \"coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}\"\n  # Hostname makes the shell more user friendly: coder@my-workspace:~$\n  hostname = data.coder_workspace.me.name\n  # Use the docker gateway if the access URL is 127.0.0.1.\n  entrypoint = [\"sh\", \"-c\", replace(coder_agent.main.init_script, \"/localhost|127\\\\.0\\\\.0\\\\.1/\", \"host.docker.internal\")]\n  env        = [\"CODER_AGENT_TOKEN=${coder_agent.main.token}\"]\n  host {\n    host = \"host.docker.internal\"\n    ip   = \"host-gateway\"\n  }\n  volumes {\n    container_path = \"/home/coder\"\n    volume_name    = docker_volume.home_volume.name\n    read_only      = false\n  }\n}\n</docker-container>\n\n<kubernetes-pod>\n// The agent is configured with \"token\" auth.\n\nresource \"kubernetes_deployment\" \"main\" {\n  count = data.coder_workspace.me.start_count\n  depends_on = [\n    kubernetes_persistent_volume_claim.home\n  ]\n  wait_for_rollout = false\n  metadata {\n    name      = \"coder-${data.coder_workspace.me.id}\"\n  }\n\n  spec {\n    replicas = 1\n    strategy {\n      type = \"Recreate\"\n    }\n\n    template {\n      spec {\n        security_context {\n          run_as_user     = 1000\n          fs_group        = 1000\n          run_as_non_root = true\n        }\n\n        container {\n          name              = \"dev\"\n          image             = \"codercom/enterprise-base:ubuntu\"\n          image_pull_policy = \"Always\"\n          command           = [\"sh\", \"-c\", coder_agent.main.init_script]\n          security_context {\n            run_as_user = \"1000\"\n          }\n          env {\n            name  = \"CODER_AGENT_TOKEN\"\n            value = coder_agent.main.token\n          }\n        }\n      }\n    }\n  }\n}\n</kubernetes-pod>\n\nThe file_id provided is a reference to a tar file you have uploaded containing the Terraform.\n","name":"bmcp_coder_coder_create_template_version","parameters":{"properties":{"file_id":{"type":"string"},"template_id":{"type":"string"}},"required":["file_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace in Coder.\n\nIf a user is asking to \"test a template\", they are typically referring\nto creating a workspace from a template to ensure the infrastructure\nis provisioned correctly and the agent can connect to the control plane.\n\nBefore creating a workspace, always confirm the template choice with the user by:\n\n\t1. Listing the available templates that match their request.\n\t2. Recommending the most relevant option.\n\t2. Asking the user to confirm which template to use.\n\nIt is important to not create a workspace without confirming the template\nchoice with the user.\n\nAfter creating a workspace, watch the build logs and wait for the workspace to\nbe ready before trying to use or connect to the workspace.\n","name":"bmcp_coder_coder_create_workspace","parameters":{"properties":{"name":{"description":"Name of the workspace to create.","type":"string"},"rich_parameters":{"description":"Key/value pairs of rich parameters to pass to the template version to create the workspace.","type":"object"},"template_version_id":{"description":"ID of the template version to create the workspace from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a workspace. Omit or use the `me` keyword to create a workspace for the authenticated user.","type":"string"}},"required":["user","template_version_id","name","rich_parameters"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace build for an existing workspace. Use this to start, stop, or delete.\n\nAfter creating a workspace build, watch the build logs and wait for the\nworkspace build to complete before trying to start another build or use or\nconnect to the workspace.\n","name":"bmcp_coder_coder_create_workspace_build","parameters":{"properties":{"template_version_id":{"description":"(Optional) The template version ID to use for the workspace build. If not provided, the previously built version will be used.","type":"string"},"transition":{"description":"The transition to perform. Must be one of: start, stop, delete","enum":["start","stop","delete"],"type":"string"},"workspace_id":{"type":"string"}},"required":["workspace_id","transition"],"type":"object"},"strict":false},{"type":"function","description":"Delete a task.","name":"bmcp_coder_coder_delete_task","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to delete. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Delete a template. This is irreversible.","name":"bmcp_coder_coder_delete_template","parameters":{"properties":{"template_id":{"type":"string"}},"required":["template_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the currently authenticated user, similar to the `whoami` command.","name":"bmcp_coder_coder_get_authenticated_user","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a task.","name":"bmcp_coder_coder_get_task_logs","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to query. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the status of a task.","name":"bmcp_coder_coder_get_task_status","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to get. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a template version. This is useful to check whether a template version successfully imports or not.","name":"bmcp_coder_coder_get_template_version_logs","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Get a workspace by name or ID.\n\nThis returns more data than list_workspaces to reduce token usage.","name":"bmcp_coder_coder_get_workspace","parameters":{"properties":{"workspace_id":{"description":"The workspace ID or name in the format [owner/]workspace. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace agent.\n\n\t\tMore logs may appear after this call. It does not wait for the agent to finish.","name":"bmcp_coder_coder_get_workspace_agent_logs","parameters":{"properties":{"workspace_agent_id":{"type":"string"}},"required":["workspace_agent_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace build.\n\n\t\tUseful for checking whether a workspace builds successfully or not.","name":"bmcp_coder_coder_get_workspace_build_logs","parameters":{"properties":{"workspace_build_id":{"type":"string"}},"required":["workspace_build_id"],"type":"object"},"strict":false},{"type":"function","description":"List tasks.","name":"bmcp_coder_coder_list_tasks","parameters":{"properties":{"status":{"description":"Optional filter by task status.","type":"string"},"user":{"description":"Username or ID of the user for which to list tasks. Omit or use the `me` keyword to list tasks for the authenticated user.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Lists templates for the authenticated user.","name":"bmcp_coder_coder_list_templates","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Lists workspaces for the authenticated user.","name":"bmcp_coder_coder_list_workspaces","parameters":{"properties":{"owner":{"description":"The owner of the workspaces to list. Use \"me\" to list workspaces for the authenticated user. If you do not specify an owner, \"me\" will be assumed by default.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Send input to a running task.","name":"bmcp_coder_coder_send_task_input","parameters":{"properties":{"input":{"description":"The input to send to the task.","type":"string"},"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to prompt. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id","input"],"type":"object"},"strict":false},{"type":"function","description":"Get the parameters for a template version. You can refer to these as workspace parameters to the user, as they are typically important for creating a workspace.","name":"bmcp_coder_coder_template_version_parameters","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Update the active version of a template. This is helpful when iterating on templates.","name":"bmcp_coder_coder_update_template_active_version","parameters":{"properties":{"template_id":{"type":"string"},"template_version_id":{"type":"string"}},"required":["template_id","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create and upload a tar file by key/value mapping of file names to file contents. Use this to create template versions. Reference the tool description of \"create_template_version\" to understand template requirements.","name":"bmcp_coder_coder_upload_tar_file","parameters":{"properties":{"files":{"description":"A map of file names to file contents.","type":"object"}},"required":["files"],"type":"object"},"strict":false},{"type":"function","description":"Execute a bash command in a Coder workspace.\n\nThis tool provides the same functionality as the 'coder ssh <workspace> <command>' CLI command.\nIt automatically starts the workspace if it's stopped and waits for the agent to be ready.\nThe output is trimmed of leading and trailing whitespace.\n\nThe workspace parameter supports various formats:\n- workspace (uses current user)\n- owner/workspace\n- owner--workspace\n- workspace.agent (specific agent)\n- owner/workspace.agent\n\nThe timeout_ms parameter specifies the command timeout in milliseconds (defaults to 60000ms, maximum of 300000ms).\nIf the command times out, all output captured up to that point is returned with a cancellation message.\n\nFor background commands (background: true), output is captured until the timeout is reached, then the command\ncontinues running in the background. The captured output is returned as the result.\n\nFor file operations (list, write, edit), always prefer the dedicated file tools.\nDo not use bash commands (ls, cat, echo, heredoc, etc.) to list, write, or read\nfiles when the file tools are available. The bash tool should be used for:\n\n\t- Running commands and scripts\n\t- Installing packages\n\t- Starting services\n\t- Executing programs\n\nExamples:\n- workspace: \"john/dev-env\", command: \"git status\", timeout_ms: 30000\n- workspace: \"my-workspace\", command: \"npm run dev\", background: true, timeout_ms: 10000\n- workspace: \"my-workspace.main\", command: \"docker ps\"","name":"bmcp_coder_coder_workspace_bash","parameters":{"properties":{"background":{"description":"Whether to run the command in the background. Output is captured until timeout, then the command continues running in the background.","type":"boolean"},"command":{"description":"The bash command to execute in the workspace.","type":"string"},"timeout_ms":{"default":60000,"description":"Command timeout in milliseconds. Defaults to 60000ms (60 seconds) if not specified.","minimum":1,"type":"integer"},"workspace":{"description":"The workspace name in format [owner/]workspace[.agent]. If owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","command"],"type":"object"},"strict":false},{"type":"function","description":"Edit a file in a workspace.","name":"bmcp_coder_coder_workspace_edit_file","parameters":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","edits"],"type":"object"},"strict":false},{"type":"function","description":"Edit one or more files in a workspace.","name":"bmcp_coder_coder_workspace_edit_files","parameters":{"properties":{"files":{"description":"An array of files to edit.","items":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"}},"required":["path","edits"],"type":"object"},"type":"array"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","files"],"type":"object"},"strict":false},{"type":"function","description":"List the URLs of Coder apps running in a workspace for a single agent.","name":"bmcp_coder_coder_workspace_list_apps","parameters":{"properties":{"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace"],"type":"object"},"strict":false},{"type":"function","description":"List directories in a workspace.","name":"bmcp_coder_coder_workspace_ls","parameters":{"properties":{"path":{"description":"The absolute path of the directory in the workspace to list.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Fetch URLs that forward to the specified port.","name":"bmcp_coder_coder_workspace_port_forward","parameters":{"properties":{"port":{"description":"The port to forward.","type":"number"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","port"],"type":"object"},"strict":false},{"type":"function","description":"Read from a file in a workspace.","name":"bmcp_coder_coder_workspace_read_file","parameters":{"properties":{"limit":{"description":"The number of bytes to read. Cannot exceed 1 MiB. Defaults to the full size of the file or 1 MiB, whichever is lower.","type":"integer"},"offset":{"description":"A byte offset indicating where in the file to start reading. Defaults to zero. An empty string indicates the end of the file has been reached.","type":"integer"},"path":{"description":"The absolute path of the file to read in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Write a file in a workspace.\n\nIf a file write fails due to syntax errors or encoding issues, do NOT switch\nto using bash commands as a workaround. Instead:\n\n\t1. Read the error message carefully to identify the issue\n\t2. Fix the content encoding/syntax\n\t3. Retry with this tool\n\nThe content parameter expects base64-encoded bytes. Ensure your source content\nis correct before encoding it. If you encounter errors, decode and verify the\ncontent you are trying to write, then re-encode it properly.\n","name":"bmcp_coder_coder_workspace_write_file","parameters":{"properties":{"content":{"description":"The base64-encoded bytes to write to the file.","type":"string"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","content"],"type":"object"},"strict":false}],"top_logprobs":0,"top_p":1.0,"truncation":"disabled","usage":{"input_tokens":6463,"input_tokens_details":{"cached_tokens":6144,"cache_write_tokens":11},"output_tokens":182,"output_tokens_details":{"reasoning_tokens":5},"total_tokens":6645},"user":null,"metadata":{}},"sequence_number":187}
 
diff --git a/aibridge/fixtures/openai/responses/streaming/single_injected_tool_error.txtar b/aibridge/fixtures/openai/responses/streaming/single_injected_tool_error.txtar
index 95dd43e543307..a6ea96c8c3e0e 100644
--- a/aibridge/fixtures/openai/responses/streaming/single_injected_tool_error.txtar
+++ b/aibridge/fixtures/openai/responses/streaming/single_injected_tool_error.txtar
@@ -58,7 +58,7 @@ event: response.output_item.done
 data: {"type":"response.output_item.done","item":{"id":"fc_0dfed48e1052ad7f0069725ca2cbac8193a79ff3716ec63dda","type":"function_call","status":"completed","arguments":"{\"transition\":\"start\",\"workspace_id\":\"non_existing_id\"}","call_id":"call_1wHAlwmnxtbUzowDJkmlcpJ4","name":"bmcp_coder_coder_create_workspace_build"},"output_index":0,"sequence_number":16}
 
 event: response.completed
-data: {"type":"response.completed","response":{"id":"resp_0dfed48e1052ad7f0069725ca129f88193b97d6deff1760524","object":"response","created_at":1769102497,"status":"completed","background":false,"completed_at":1769102499,"error":null,"frequency_penalty":0.0,"incomplete_details":null,"instructions":null,"max_output_tokens":null,"max_tool_calls":null,"model":"gpt-4.1-2025-04-14","output":[{"id":"fc_0dfed48e1052ad7f0069725ca2cbac8193a79ff3716ec63dda","type":"function_call","status":"completed","arguments":"{\"transition\":\"start\",\"workspace_id\":\"non_existing_id\"}","call_id":"call_1wHAlwmnxtbUzowDJkmlcpJ4","name":"bmcp_coder_coder_create_workspace_build"}],"parallel_tool_calls":false,"presence_penalty":0.0,"previous_response_id":null,"prompt_cache_key":null,"prompt_cache_retention":null,"reasoning":{"effort":null,"summary":null},"safety_identifier":null,"service_tier":"default","store":true,"temperature":1.0,"text":{"format":{"type":"text"},"verbosity":"medium"},"tool_choice":"auto","tools":[{"type":"function","description":"Create a task.","name":"bmcp_coder_coder_create_task","parameters":{"properties":{"input":{"description":"Input/prompt for the task.","type":"string"},"template_version_id":{"description":"ID of the template version to create the task from.","type":"string"},"template_version_preset_id":{"description":"Optional ID of the template version preset to create the task from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a task. Omit or use the `me` keyword to create a task for the authenticated user.","type":"string"}},"required":["input","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template in Coder. First, you must create a template version.","name":"bmcp_coder_coder_create_template","parameters":{"properties":{"description":{"type":"string"},"display_name":{"type":"string"},"icon":{"description":"A URL to an icon to use.","type":"string"},"name":{"type":"string"},"version_id":{"description":"The ID of the version to use.","type":"string"}},"required":["name","display_name","description","version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template version. This is a precursor to creating a template, or you can update an existing template.\n\nTemplates are Terraform defining a development environment. The provisioned infrastructure must run\nan Agent that connects to the Coder Control Plane to provide a rich experience.\n\nHere are some strict rules for creating a template version:\n- YOU MUST NOT use \"variable\" or \"output\" blocks in the Terraform code.\n- YOU MUST ALWAYS check template version logs after creation to ensure the template was imported successfully.\n\nWhen a template version is created, a Terraform Plan occurs that ensures the infrastructure\n_could_ be provisioned, but actual provisioning occurs when a workspace is created.\n\n<terraform-spec>\nThe Coder Terraform Provider can be imported like:\n\n```hcl\nterraform {\n  required_providers {\n    coder = {\n      source = \"coder/coder\"\n    }\n  }\n}\n```\n\nA destroy does not occur when a user stops a workspace, but rather the transition changes:\n\n```hcl\ndata \"coder_workspace\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace.\n- name: The name of the workspace.\n- transition: Either \"start\" or \"stop\".\n- start_count: A computed count based on the transition field. If \"start\", this will be 1.\n\nAccess workspace owner information with:\n\n```hcl\ndata \"coder_workspace_owner\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace owner.\n- name: The name of the workspace owner.\n- full_name: The full name of the workspace owner.\n- email: The email of the workspace owner.\n- session_token: A token that can be used to authenticate the workspace owner. It is regenerated every time the workspace is started.\n- oidc_access_token: A valid OpenID Connect access token of the workspace owner. This is only available if the workspace owner authenticated with OpenID Connect. If a valid token cannot be obtained, this value will be an empty string.\n\nParameters are defined in the template version. They are rendered in the UI on the workspace creation page:\n\n```hcl\nresource \"coder_parameter\" \"region\" {\n  name = \"region\"\n  type = \"string\"\n  default = \"us-east-1\"\n}\n```\n\nThis resource accepts the following properties:\n- name: The name of the parameter.\n- default: The default value of the parameter.\n- type: The type of the parameter. Must be one of: \"string\", \"number\", \"bool\", or \"list(string)\".\n- display_name: The displayed name of the parameter as it will appear in the UI.\n- description: The description of the parameter as it will appear in the UI.\n- ephemeral: The value of an ephemeral parameter will not be preserved between consecutive workspace builds.\n- form_type: The type of this parameter. Must be one of: [radio, slider, input, dropdown, checkbox, switch, multi-select, tag-select, textarea, error].\n- icon: A URL to an icon to display in the UI.\n- mutable: Whether this value can be changed after workspace creation. This can be destructive for values like region, so use with caution!\n- option: Each option block defines a value for a user to select from. (see below for nested schema)\n  Required:\n  - name: The name of the option.\n  - value: The value of the option.\n  Optional:\n  - description: The description of the option as it will appear in the UI.\n  - icon: A URL to an icon to display in the UI.\n\nA Workspace Agent runs on provisioned infrastructure to provide access to the workspace:\n\n```hcl\nresource \"coder_agent\" \"dev\" {\n  arch = \"amd64\"\n  os = \"linux\"\n}\n```\n\nThis resource accepts the following properties:\n- arch: The architecture of the agent. Must be one of: \"amd64\", \"arm64\", or \"armv7\".\n- os: The operating system of the agent. Must be one of: \"linux\", \"windows\", or \"darwin\".\n- auth: The authentication method for the agent. Must be one of: \"token\", \"google-instance-identity\", \"aws-instance-identity\", or \"azure-instance-identity\". It is insecure to pass the agent token via exposed variables to Virtual Machines. Instance Identity enables provisioned VMs to authenticate by instance ID on start.\n- dir: The starting directory when a user creates a shell session. Defaults to \"$HOME\".\n- env: A map of environment variables to set for the agent.\n- startup_script: A script to run after the agent starts. This script MUST exit eventually to signal that startup has completed. Use \"&\" or \"screen\" to run processes in the background.\n\nThis resource provides the following fields:\n- id: The UUID of the agent.\n- init_script: The script to run on provisioned infrastructure to fetch and start the agent.\n- token: Set the environment variable CODER_AGENT_TOKEN to this value to authenticate the agent.\n\nThe agent MUST be installed and started using the init_script. A utility like curl or wget to fetch the agent binary must exist in the provisioned infrastructure.\n\nExpose terminal or HTTP applications running in a workspace with:\n\n```hcl\nresource \"coder_app\" \"dev\" {\n  agent_id = coder_agent.dev.id\n  slug = \"my-app-name\"\n  display_name = \"My App\"\n  icon = \"https://my-app.com/icon.svg\"\n  url = \"http://127.0.0.1:3000\"\n}\n```\n\nThis resource accepts the following properties:\n- agent_id: The ID of the agent to attach the app to.\n- slug: The slug of the app.\n- display_name: The displayed name of the app as it will appear in the UI.\n- icon: A URL to an icon to display in the UI.\n- url: An external url if external=true or a URL to be proxied to from inside the workspace. This should be of the form http://localhost:PORT[/SUBPATH]. Either command or url may be specified, but not both.\n- command: A command to run in a terminal opening this app. In the web, this will open in a new tab. In the CLI, this will SSH and execute the command. Either command or url may be specified, but not both.\n- external: Whether this app is an external app. If true, the url will be opened in a new tab.\n</terraform-spec>\n\nThe Coder Server may not be authenticated with the infrastructure provider a user requests. In this scenario,\nthe user will need to provide credentials to the Coder Server before the workspace can be provisioned.\n\nHere are examples of provisioning the Coder Agent on specific infrastructure providers:\n\n<aws-ec2-instance>\n// The agent is configured with \"aws-instance-identity\" auth.\nterraform {\n  required_providers {\n    cloudinit = {\n      source = \"hashicorp/cloudinit\"\n    }\n    aws = {\n      source = \"hashicorp/aws\"\n    }\n  }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n  gzip          = false\n  base64_encode = false\n  boundary = \"//\"\n  part {\n    filename     = \"cloud-config.yaml\"\n    content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t//   - [scripts-user, always]\n\t// hostname: ${hostname}\n\t// users:\n\t//   - name: ${linux_user}\n\t//     sudo: ALL=(ALL) NOPASSWD:ALL\n\t//     shell: /bin/bash\n    content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n      hostname   = local.hostname\n      linux_user = local.linux_user\n    })\n  }\n\n  part {\n    filename     = \"userdata.sh\"\n    content_type = \"text/x-shellscript\"\n\n\t// Here is the content of the userdata.sh.tftpl file:\n\t// #!/bin/bash\n\t// sudo -u '${linux_user}' sh -c '${init_script}'\n    content = templatefile(\"${path.module}/cloud-init/userdata.sh.tftpl\", {\n      linux_user = local.linux_user\n\n      init_script = try(coder_agent.dev[0].init_script, \"\")\n    })\n  }\n}\n\nresource \"aws_instance\" \"dev\" {\n  ami               = data.aws_ami.ubuntu.id\n  availability_zone = \"${data.coder_parameter.region.value}a\"\n  instance_type     = data.coder_parameter.instance_type.value\n\n  user_data = data.cloudinit_config.user_data.rendered\n  tags = {\n    Name = \"coder-${data.coder_workspace_owner.me.name}-${data.coder_workspace.me.name}\"\n  }\n  lifecycle {\n    ignore_changes = [ami]\n  }\n}\n</aws-ec2-instance>\n\n<gcp-vm-instance>\n// The agent is configured with \"google-instance-identity\" auth.\nterraform {\n  required_providers {\n    google = {\n      source = \"hashicorp/google\"\n    }\n  }\n}\n\nresource \"google_compute_instance\" \"dev\" {\n  zone         = module.gcp_region.value\n  count        = data.coder_workspace.me.start_count\n  name         = \"coder-${lower(data.coder_workspace_owner.me.name)}-${lower(data.coder_workspace.me.name)}-root\"\n  machine_type = \"e2-medium\"\n  network_interface {\n    network = \"default\"\n    access_config {\n      // Ephemeral public IP\n    }\n  }\n  boot_disk {\n    auto_delete = false\n    source      = google_compute_disk.root.name\n  }\n  // In order to use google-instance-identity, a service account *must* be provided.\n  service_account {\n    email  = data.google_compute_default_service_account.default.email\n    scopes = [\"cloud-platform\"]\n  }\n  # ONLY FOR WINDOWS:\n  # metadata = {\n  #   windows-startup-script-ps1 = coder_agent.main.init_script\n  # }\n  # The startup script runs as root with no $HOME environment set up, so instead of directly\n  # running the agent init script, create a user (with a homedir, default shell and sudo\n  # permissions) and execute the init script as that user.\n  #\n  # The agent MUST be started in here.\n  metadata_startup_script = <<EOMETA\n#!/usr/bin/env sh\nset -eux\n\n# If user does not exist, create it and set up passwordless sudo\nif ! id -u \"${local.linux_user}\" >/dev/null 2>&1; then\n  useradd -m -s /bin/bash \"${local.linux_user}\"\n  echo \"${local.linux_user} ALL=(ALL) NOPASSWD:ALL\" > /etc/sudoers.d/coder-user\nfi\n\nexec sudo -u \"${local.linux_user}\" sh -c '${coder_agent.main.init_script}'\nEOMETA\n}\n</gcp-vm-instance>\n\n<azure-vm-instance>\n// The agent is configured with \"azure-instance-identity\" auth.\nterraform {\n  required_providers {\n    azurerm = {\n      source = \"hashicorp/azurerm\"\n    }\n    cloudinit = {\n      source = \"hashicorp/cloudinit\"\n    }\n  }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n  gzip          = false\n  base64_encode = true\n\n  boundary = \"//\"\n\n  part {\n    filename     = \"cloud-config.yaml\"\n    content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t// - [scripts-user, always]\n\t// bootcmd:\n\t//   # work around https://github.com/hashicorp/terraform-provider-azurerm/issues/6117\n\t//   - until [ -e /dev/disk/azure/scsi1/lun10 ]; do sleep 1; done\n\t// device_aliases:\n\t//   homedir: /dev/disk/azure/scsi1/lun10\n\t// disk_setup:\n\t//   homedir:\n\t//     table_type: gpt\n\t//     layout: true\n\t// fs_setup:\n\t//   - label: coder_home\n\t//     filesystem: ext4\n\t//     device: homedir.1\n\t// mounts:\n\t//   - [\"LABEL=coder_home\", \"/home/${username}\"]\n\t// hostname: ${hostname}\n\t// users:\n\t//   - name: ${username}\n\t//     sudo: [\"ALL=(ALL) NOPASSWD:ALL\"]\n\t//     groups: sudo\n\t//     shell: /bin/bash\n\t// packages:\n\t//   - git\n\t// write_files:\n\t//   - path: /opt/coder/init\n\t//     permissions: \"0755\"\n\t//     encoding: b64\n\t//     content: ${init_script}\n\t//   - path: /etc/systemd/system/coder-agent.service\n\t//     permissions: \"0644\"\n\t//     content: |\n\t//       [Unit]\n\t//       Description=Coder Agent\n\t//       After=network-online.target\n\t//       Wants=network-online.target\n\n\t//       [Service]\n\t//       User=${username}\n\t//       ExecStart=/opt/coder/init\n\t//       Restart=always\n\t//       RestartSec=10\n\t//       TimeoutStopSec=90\n\t//       KillMode=process\n\n\t//       OOMScoreAdjust=-900\n\t//       SyslogIdentifier=coder-agent\n\n\t//       [Install]\n\t//       WantedBy=multi-user.target\n\t// runcmd:\n\t//   - chown ${username}:${username} /home/${username}\n\t//   - systemctl enable coder-agent\n\t//   - systemctl start coder-agent\n    content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n      username    = \"coder\" # Ensure this user/group does not exist in your VM image\n      init_script = base64encode(coder_agent.main.init_script)\n      hostname    = lower(data.coder_workspace.me.name)\n    })\n  }\n}\n\nresource \"azurerm_linux_virtual_machine\" \"main\" {\n  count               = data.coder_workspace.me.start_count\n  name                = \"vm\"\n  resource_group_name = azurerm_resource_group.main.name\n  location            = azurerm_resource_group.main.location\n  size                = data.coder_parameter.instance_type.value\n  // cloud-init overwrites this, so the value here doesn't matter\n  admin_username = \"adminuser\"\n  admin_ssh_key {\n    public_key = tls_private_key.dummy.public_key_openssh\n    username   = \"adminuser\"\n  }\n\n  network_interface_ids = [\n    azurerm_network_interface.main.id,\n  ]\n  computer_name = lower(data.coder_workspace.me.name)\n  os_disk {\n    caching              = \"ReadWrite\"\n    storage_account_type = \"Standard_LRS\"\n  }\n  source_image_reference {\n    publisher = \"Canonical\"\n    offer     = \"0001-com-ubuntu-server-focal\"\n    sku       = \"20_04-lts-gen2\"\n    version   = \"latest\"\n  }\n  user_data = data.cloudinit_config.user_data.rendered\n}\n</azure-vm-instance>\n\n<docker-container>\nterraform {\n  required_providers {\n    coder = {\n      source = \"kreuzwerker/docker\"\n    }\n  }\n}\n\n// The agent is configured with \"token\" auth.\n\nresource \"docker_container\" \"workspace\" {\n  count = data.coder_workspace.me.start_count\n  image = \"codercom/enterprise-base:ubuntu\"\n  # Uses lower() to avoid Docker restriction on container names.\n  name = \"coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}\"\n  # Hostname makes the shell more user friendly: coder@my-workspace:~$\n  hostname = data.coder_workspace.me.name\n  # Use the docker gateway if the access URL is 127.0.0.1.\n  entrypoint = [\"sh\", \"-c\", replace(coder_agent.main.init_script, \"/localhost|127\\\\.0\\\\.0\\\\.1/\", \"host.docker.internal\")]\n  env        = [\"CODER_AGENT_TOKEN=${coder_agent.main.token}\"]\n  host {\n    host = \"host.docker.internal\"\n    ip   = \"host-gateway\"\n  }\n  volumes {\n    container_path = \"/home/coder\"\n    volume_name    = docker_volume.home_volume.name\n    read_only      = false\n  }\n}\n</docker-container>\n\n<kubernetes-pod>\n// The agent is configured with \"token\" auth.\n\nresource \"kubernetes_deployment\" \"main\" {\n  count = data.coder_workspace.me.start_count\n  depends_on = [\n    kubernetes_persistent_volume_claim.home\n  ]\n  wait_for_rollout = false\n  metadata {\n    name      = \"coder-${data.coder_workspace.me.id}\"\n  }\n\n  spec {\n    replicas = 1\n    strategy {\n      type = \"Recreate\"\n    }\n\n    template {\n      spec {\n        security_context {\n          run_as_user     = 1000\n          fs_group        = 1000\n          run_as_non_root = true\n        }\n\n        container {\n          name              = \"dev\"\n          image             = \"codercom/enterprise-base:ubuntu\"\n          image_pull_policy = \"Always\"\n          command           = [\"sh\", \"-c\", coder_agent.main.init_script]\n          security_context {\n            run_as_user = \"1000\"\n          }\n          env {\n            name  = \"CODER_AGENT_TOKEN\"\n            value = coder_agent.main.token\n          }\n        }\n      }\n    }\n  }\n}\n</kubernetes-pod>\n\nThe file_id provided is a reference to a tar file you have uploaded containing the Terraform.\n","name":"bmcp_coder_coder_create_template_version","parameters":{"properties":{"file_id":{"type":"string"},"template_id":{"type":"string"}},"required":["file_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace in Coder.\n\nIf a user is asking to \"test a template\", they are typically referring\nto creating a workspace from a template to ensure the infrastructure\nis provisioned correctly and the agent can connect to the control plane.\n\nBefore creating a workspace, always confirm the template choice with the user by:\n\n\t1. Listing the available templates that match their request.\n\t2. Recommending the most relevant option.\n\t2. Asking the user to confirm which template to use.\n\nIt is important to not create a workspace without confirming the template\nchoice with the user.\n\nAfter creating a workspace, watch the build logs and wait for the workspace to\nbe ready before trying to use or connect to the workspace.\n","name":"bmcp_coder_coder_create_workspace","parameters":{"properties":{"name":{"description":"Name of the workspace to create.","type":"string"},"rich_parameters":{"description":"Key/value pairs of rich parameters to pass to the template version to create the workspace.","type":"object"},"template_version_id":{"description":"ID of the template version to create the workspace from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a workspace. Omit or use the `me` keyword to create a workspace for the authenticated user.","type":"string"}},"required":["user","template_version_id","name","rich_parameters"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace build for an existing workspace. Use this to start, stop, or delete.\n\nAfter creating a workspace build, watch the build logs and wait for the\nworkspace build to complete before trying to start another build or use or\nconnect to the workspace.\n","name":"bmcp_coder_coder_create_workspace_build","parameters":{"properties":{"template_version_id":{"description":"(Optional) The template version ID to use for the workspace build. If not provided, the previously built version will be used.","type":"string"},"transition":{"description":"The transition to perform. Must be one of: start, stop, delete","enum":["start","stop","delete"],"type":"string"},"workspace_id":{"type":"string"}},"required":["workspace_id","transition"],"type":"object"},"strict":false},{"type":"function","description":"Delete a task.","name":"bmcp_coder_coder_delete_task","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to delete. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Delete a template. This is irreversible.","name":"bmcp_coder_coder_delete_template","parameters":{"properties":{"template_id":{"type":"string"}},"required":["template_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the currently authenticated user, similar to the `whoami` command.","name":"bmcp_coder_coder_get_authenticated_user","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a task.","name":"bmcp_coder_coder_get_task_logs","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to query. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the status of a task.","name":"bmcp_coder_coder_get_task_status","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to get. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a template version. This is useful to check whether a template version successfully imports or not.","name":"bmcp_coder_coder_get_template_version_logs","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Get a workspace by name or ID.\n\nThis returns more data than list_workspaces to reduce token usage.","name":"bmcp_coder_coder_get_workspace","parameters":{"properties":{"workspace_id":{"description":"The workspace ID or name in the format [owner/]workspace. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace agent.\n\n\t\tMore logs may appear after this call. It does not wait for the agent to finish.","name":"bmcp_coder_coder_get_workspace_agent_logs","parameters":{"properties":{"workspace_agent_id":{"type":"string"}},"required":["workspace_agent_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace build.\n\n\t\tUseful for checking whether a workspace builds successfully or not.","name":"bmcp_coder_coder_get_workspace_build_logs","parameters":{"properties":{"workspace_build_id":{"type":"string"}},"required":["workspace_build_id"],"type":"object"},"strict":false},{"type":"function","description":"List tasks.","name":"bmcp_coder_coder_list_tasks","parameters":{"properties":{"status":{"description":"Optional filter by task status.","type":"string"},"user":{"description":"Username or ID of the user for which to list tasks. Omit or use the `me` keyword to list tasks for the authenticated user.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Lists templates for the authenticated user.","name":"bmcp_coder_coder_list_templates","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Lists workspaces for the authenticated user.","name":"bmcp_coder_coder_list_workspaces","parameters":{"properties":{"owner":{"description":"The owner of the workspaces to list. Use \"me\" to list workspaces for the authenticated user. If you do not specify an owner, \"me\" will be assumed by default.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Send input to a running task.","name":"bmcp_coder_coder_send_task_input","parameters":{"properties":{"input":{"description":"The input to send to the task.","type":"string"},"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to prompt. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id","input"],"type":"object"},"strict":false},{"type":"function","description":"Get the parameters for a template version. You can refer to these as workspace parameters to the user, as they are typically important for creating a workspace.","name":"bmcp_coder_coder_template_version_parameters","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Update the active version of a template. This is helpful when iterating on templates.","name":"bmcp_coder_coder_update_template_active_version","parameters":{"properties":{"template_id":{"type":"string"},"template_version_id":{"type":"string"}},"required":["template_id","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create and upload a tar file by key/value mapping of file names to file contents. Use this to create template versions. Reference the tool description of \"create_template_version\" to understand template requirements.","name":"bmcp_coder_coder_upload_tar_file","parameters":{"properties":{"files":{"description":"A map of file names to file contents.","type":"object"}},"required":["files"],"type":"object"},"strict":false},{"type":"function","description":"Execute a bash command in a Coder workspace.\n\nThis tool provides the same functionality as the 'coder ssh <workspace> <command>' CLI command.\nIt automatically starts the workspace if it's stopped and waits for the agent to be ready.\nThe output is trimmed of leading and trailing whitespace.\n\nThe workspace parameter supports various formats:\n- workspace (uses current user)\n- owner/workspace\n- owner--workspace\n- workspace.agent (specific agent)\n- owner/workspace.agent\n\nThe timeout_ms parameter specifies the command timeout in milliseconds (defaults to 60000ms, maximum of 300000ms).\nIf the command times out, all output captured up to that point is returned with a cancellation message.\n\nFor background commands (background: true), output is captured until the timeout is reached, then the command\ncontinues running in the background. The captured output is returned as the result.\n\nFor file operations (list, write, edit), always prefer the dedicated file tools.\nDo not use bash commands (ls, cat, echo, heredoc, etc.) to list, write, or read\nfiles when the file tools are available. The bash tool should be used for:\n\n\t- Running commands and scripts\n\t- Installing packages\n\t- Starting services\n\t- Executing programs\n\nExamples:\n- workspace: \"john/dev-env\", command: \"git status\", timeout_ms: 30000\n- workspace: \"my-workspace\", command: \"npm run dev\", background: true, timeout_ms: 10000\n- workspace: \"my-workspace.main\", command: \"docker ps\"","name":"bmcp_coder_coder_workspace_bash","parameters":{"properties":{"background":{"description":"Whether to run the command in the background. Output is captured until timeout, then the command continues running in the background.","type":"boolean"},"command":{"description":"The bash command to execute in the workspace.","type":"string"},"timeout_ms":{"default":60000,"description":"Command timeout in milliseconds. Defaults to 60000ms (60 seconds) if not specified.","minimum":1,"type":"integer"},"workspace":{"description":"The workspace name in format [owner/]workspace[.agent]. If owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","command"],"type":"object"},"strict":false},{"type":"function","description":"Edit a file in a workspace.","name":"bmcp_coder_coder_workspace_edit_file","parameters":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","edits"],"type":"object"},"strict":false},{"type":"function","description":"Edit one or more files in a workspace.","name":"bmcp_coder_coder_workspace_edit_files","parameters":{"properties":{"files":{"description":"An array of files to edit.","items":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"}},"required":["path","edits"],"type":"object"},"type":"array"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","files"],"type":"object"},"strict":false},{"type":"function","description":"List the URLs of Coder apps running in a workspace for a single agent.","name":"bmcp_coder_coder_workspace_list_apps","parameters":{"properties":{"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace"],"type":"object"},"strict":false},{"type":"function","description":"List directories in a workspace.","name":"bmcp_coder_coder_workspace_ls","parameters":{"properties":{"path":{"description":"The absolute path of the directory in the workspace to list.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Fetch URLs that forward to the specified port.","name":"bmcp_coder_coder_workspace_port_forward","parameters":{"properties":{"port":{"description":"The port to forward.","type":"number"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","port"],"type":"object"},"strict":false},{"type":"function","description":"Read from a file in a workspace.","name":"bmcp_coder_coder_workspace_read_file","parameters":{"properties":{"limit":{"description":"The number of bytes to read. Cannot exceed 1 MiB. Defaults to the full size of the file or 1 MiB, whichever is lower.","type":"integer"},"offset":{"description":"A byte offset indicating where in the file to start reading. Defaults to zero. An empty string indicates the end of the file has been reached.","type":"integer"},"path":{"description":"The absolute path of the file to read in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Write a file in a workspace.\n\nIf a file write fails due to syntax errors or encoding issues, do NOT switch\nto using bash commands as a workaround. Instead:\n\n\t1. Read the error message carefully to identify the issue\n\t2. Fix the content encoding/syntax\n\t3. Retry with this tool\n\nThe content parameter expects base64-encoded bytes. Ensure your source content\nis correct before encoding it. If you encounter errors, decode and verify the\ncontent you are trying to write, then re-encode it properly.\n","name":"bmcp_coder_coder_workspace_write_file","parameters":{"properties":{"content":{"description":"The base64-encoded bytes to write to the file.","type":"string"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","content"],"type":"object"},"strict":false}],"top_logprobs":0,"top_p":1.0,"truncation":"disabled","usage":{"input_tokens":6280,"input_tokens_details":{"cached_tokens":0},"output_tokens":30,"output_tokens_details":{"reasoning_tokens":0},"total_tokens":6310},"user":null,"metadata":{}},"sequence_number":17}
+data: {"type":"response.completed","response":{"id":"resp_0dfed48e1052ad7f0069725ca129f88193b97d6deff1760524","object":"response","created_at":1769102497,"status":"completed","background":false,"completed_at":1769102499,"error":null,"frequency_penalty":0.0,"incomplete_details":null,"instructions":null,"max_output_tokens":null,"max_tool_calls":null,"model":"gpt-4.1-2025-04-14","output":[{"id":"fc_0dfed48e1052ad7f0069725ca2cbac8193a79ff3716ec63dda","type":"function_call","status":"completed","arguments":"{\"transition\":\"start\",\"workspace_id\":\"non_existing_id\"}","call_id":"call_1wHAlwmnxtbUzowDJkmlcpJ4","name":"bmcp_coder_coder_create_workspace_build"}],"parallel_tool_calls":false,"presence_penalty":0.0,"previous_response_id":null,"prompt_cache_key":null,"prompt_cache_retention":null,"reasoning":{"effort":null,"summary":null},"safety_identifier":null,"service_tier":"default","store":true,"temperature":1.0,"text":{"format":{"type":"text"},"verbosity":"medium"},"tool_choice":"auto","tools":[{"type":"function","description":"Create a task.","name":"bmcp_coder_coder_create_task","parameters":{"properties":{"input":{"description":"Input/prompt for the task.","type":"string"},"template_version_id":{"description":"ID of the template version to create the task from.","type":"string"},"template_version_preset_id":{"description":"Optional ID of the template version preset to create the task from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a task. Omit or use the `me` keyword to create a task for the authenticated user.","type":"string"}},"required":["input","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template in Coder. First, you must create a template version.","name":"bmcp_coder_coder_create_template","parameters":{"properties":{"description":{"type":"string"},"display_name":{"type":"string"},"icon":{"description":"A URL to an icon to use.","type":"string"},"name":{"type":"string"},"version_id":{"description":"The ID of the version to use.","type":"string"}},"required":["name","display_name","description","version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template version. This is a precursor to creating a template, or you can update an existing template.\n\nTemplates are Terraform defining a development environment. The provisioned infrastructure must run\nan Agent that connects to the Coder Control Plane to provide a rich experience.\n\nHere are some strict rules for creating a template version:\n- YOU MUST NOT use \"variable\" or \"output\" blocks in the Terraform code.\n- YOU MUST ALWAYS check template version logs after creation to ensure the template was imported successfully.\n\nWhen a template version is created, a Terraform Plan occurs that ensures the infrastructure\n_could_ be provisioned, but actual provisioning occurs when a workspace is created.\n\n<terraform-spec>\nThe Coder Terraform Provider can be imported like:\n\n```hcl\nterraform {\n  required_providers {\n    coder = {\n      source = \"coder/coder\"\n    }\n  }\n}\n```\n\nA destroy does not occur when a user stops a workspace, but rather the transition changes:\n\n```hcl\ndata \"coder_workspace\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace.\n- name: The name of the workspace.\n- transition: Either \"start\" or \"stop\".\n- start_count: A computed count based on the transition field. If \"start\", this will be 1.\n\nAccess workspace owner information with:\n\n```hcl\ndata \"coder_workspace_owner\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace owner.\n- name: The name of the workspace owner.\n- full_name: The full name of the workspace owner.\n- email: The email of the workspace owner.\n- session_token: A token that can be used to authenticate the workspace owner. It is regenerated every time the workspace is started.\n- oidc_access_token: A valid OpenID Connect access token of the workspace owner. This is only available if the workspace owner authenticated with OpenID Connect. If a valid token cannot be obtained, this value will be an empty string.\n\nParameters are defined in the template version. They are rendered in the UI on the workspace creation page:\n\n```hcl\nresource \"coder_parameter\" \"region\" {\n  name = \"region\"\n  type = \"string\"\n  default = \"us-east-1\"\n}\n```\n\nThis resource accepts the following properties:\n- name: The name of the parameter.\n- default: The default value of the parameter.\n- type: The type of the parameter. Must be one of: \"string\", \"number\", \"bool\", or \"list(string)\".\n- display_name: The displayed name of the parameter as it will appear in the UI.\n- description: The description of the parameter as it will appear in the UI.\n- ephemeral: The value of an ephemeral parameter will not be preserved between consecutive workspace builds.\n- form_type: The type of this parameter. Must be one of: [radio, slider, input, dropdown, checkbox, switch, multi-select, tag-select, textarea, error].\n- icon: A URL to an icon to display in the UI.\n- mutable: Whether this value can be changed after workspace creation. This can be destructive for values like region, so use with caution!\n- option: Each option block defines a value for a user to select from. (see below for nested schema)\n  Required:\n  - name: The name of the option.\n  - value: The value of the option.\n  Optional:\n  - description: The description of the option as it will appear in the UI.\n  - icon: A URL to an icon to display in the UI.\n\nA Workspace Agent runs on provisioned infrastructure to provide access to the workspace:\n\n```hcl\nresource \"coder_agent\" \"dev\" {\n  arch = \"amd64\"\n  os = \"linux\"\n}\n```\n\nThis resource accepts the following properties:\n- arch: The architecture of the agent. Must be one of: \"amd64\", \"arm64\", or \"armv7\".\n- os: The operating system of the agent. Must be one of: \"linux\", \"windows\", or \"darwin\".\n- auth: The authentication method for the agent. Must be one of: \"token\", \"google-instance-identity\", \"aws-instance-identity\", or \"azure-instance-identity\". It is insecure to pass the agent token via exposed variables to Virtual Machines. Instance Identity enables provisioned VMs to authenticate by instance ID on start.\n- dir: The starting directory when a user creates a shell session. Defaults to \"$HOME\".\n- env: A map of environment variables to set for the agent.\n- startup_script: A script to run after the agent starts. This script MUST exit eventually to signal that startup has completed. Use \"&\" or \"screen\" to run processes in the background.\n\nThis resource provides the following fields:\n- id: The UUID of the agent.\n- init_script: The script to run on provisioned infrastructure to fetch and start the agent.\n- token: Set the environment variable CODER_AGENT_TOKEN to this value to authenticate the agent.\n\nThe agent MUST be installed and started using the init_script. A utility like curl or wget to fetch the agent binary must exist in the provisioned infrastructure.\n\nExpose terminal or HTTP applications running in a workspace with:\n\n```hcl\nresource \"coder_app\" \"dev\" {\n  agent_id = coder_agent.dev.id\n  slug = \"my-app-name\"\n  display_name = \"My App\"\n  icon = \"https://my-app.com/icon.svg\"\n  url = \"http://127.0.0.1:3000\"\n}\n```\n\nThis resource accepts the following properties:\n- agent_id: The ID of the agent to attach the app to.\n- slug: The slug of the app.\n- display_name: The displayed name of the app as it will appear in the UI.\n- icon: A URL to an icon to display in the UI.\n- url: An external url if external=true or a URL to be proxied to from inside the workspace. This should be of the form http://localhost:PORT[/SUBPATH]. Either command or url may be specified, but not both.\n- command: A command to run in a terminal opening this app. In the web, this will open in a new tab. In the CLI, this will SSH and execute the command. Either command or url may be specified, but not both.\n- external: Whether this app is an external app. If true, the url will be opened in a new tab.\n</terraform-spec>\n\nThe Coder Server may not be authenticated with the infrastructure provider a user requests. In this scenario,\nthe user will need to provide credentials to the Coder Server before the workspace can be provisioned.\n\nHere are examples of provisioning the Coder Agent on specific infrastructure providers:\n\n<aws-ec2-instance>\n// The agent is configured with \"aws-instance-identity\" auth.\nterraform {\n  required_providers {\n    cloudinit = {\n      source = \"hashicorp/cloudinit\"\n    }\n    aws = {\n      source = \"hashicorp/aws\"\n    }\n  }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n  gzip          = false\n  base64_encode = false\n  boundary = \"//\"\n  part {\n    filename     = \"cloud-config.yaml\"\n    content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t//   - [scripts-user, always]\n\t// hostname: ${hostname}\n\t// users:\n\t//   - name: ${linux_user}\n\t//     sudo: ALL=(ALL) NOPASSWD:ALL\n\t//     shell: /bin/bash\n    content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n      hostname   = local.hostname\n      linux_user = local.linux_user\n    })\n  }\n\n  part {\n    filename     = \"userdata.sh\"\n    content_type = \"text/x-shellscript\"\n\n\t// Here is the content of the userdata.sh.tftpl file:\n\t// #!/bin/bash\n\t// sudo -u '${linux_user}' sh -c '${init_script}'\n    content = templatefile(\"${path.module}/cloud-init/userdata.sh.tftpl\", {\n      linux_user = local.linux_user\n\n      init_script = try(coder_agent.dev[0].init_script, \"\")\n    })\n  }\n}\n\nresource \"aws_instance\" \"dev\" {\n  ami               = data.aws_ami.ubuntu.id\n  availability_zone = \"${data.coder_parameter.region.value}a\"\n  instance_type     = data.coder_parameter.instance_type.value\n\n  user_data = data.cloudinit_config.user_data.rendered\n  tags = {\n    Name = \"coder-${data.coder_workspace_owner.me.name}-${data.coder_workspace.me.name}\"\n  }\n  lifecycle {\n    ignore_changes = [ami]\n  }\n}\n</aws-ec2-instance>\n\n<gcp-vm-instance>\n// The agent is configured with \"google-instance-identity\" auth.\nterraform {\n  required_providers {\n    google = {\n      source = \"hashicorp/google\"\n    }\n  }\n}\n\nresource \"google_compute_instance\" \"dev\" {\n  zone         = module.gcp_region.value\n  count        = data.coder_workspace.me.start_count\n  name         = \"coder-${lower(data.coder_workspace_owner.me.name)}-${lower(data.coder_workspace.me.name)}-root\"\n  machine_type = \"e2-medium\"\n  network_interface {\n    network = \"default\"\n    access_config {\n      // Ephemeral public IP\n    }\n  }\n  boot_disk {\n    auto_delete = false\n    source      = google_compute_disk.root.name\n  }\n  // In order to use google-instance-identity, a service account *must* be provided.\n  service_account {\n    email  = data.google_compute_default_service_account.default.email\n    scopes = [\"cloud-platform\"]\n  }\n  # ONLY FOR WINDOWS:\n  # metadata = {\n  #   windows-startup-script-ps1 = coder_agent.main.init_script\n  # }\n  # The startup script runs as root with no $HOME environment set up, so instead of directly\n  # running the agent init script, create a user (with a homedir, default shell and sudo\n  # permissions) and execute the init script as that user.\n  #\n  # The agent MUST be started in here.\n  metadata_startup_script = <<EOMETA\n#!/usr/bin/env sh\nset -eux\n\n# If user does not exist, create it and set up passwordless sudo\nif ! id -u \"${local.linux_user}\" >/dev/null 2>&1; then\n  useradd -m -s /bin/bash \"${local.linux_user}\"\n  echo \"${local.linux_user} ALL=(ALL) NOPASSWD:ALL\" > /etc/sudoers.d/coder-user\nfi\n\nexec sudo -u \"${local.linux_user}\" sh -c '${coder_agent.main.init_script}'\nEOMETA\n}\n</gcp-vm-instance>\n\n<azure-vm-instance>\n// The agent is configured with \"azure-instance-identity\" auth.\nterraform {\n  required_providers {\n    azurerm = {\n      source = \"hashicorp/azurerm\"\n    }\n    cloudinit = {\n      source = \"hashicorp/cloudinit\"\n    }\n  }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n  gzip          = false\n  base64_encode = true\n\n  boundary = \"//\"\n\n  part {\n    filename     = \"cloud-config.yaml\"\n    content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t// - [scripts-user, always]\n\t// bootcmd:\n\t//   # work around https://github.com/hashicorp/terraform-provider-azurerm/issues/6117\n\t//   - until [ -e /dev/disk/azure/scsi1/lun10 ]; do sleep 1; done\n\t// device_aliases:\n\t//   homedir: /dev/disk/azure/scsi1/lun10\n\t// disk_setup:\n\t//   homedir:\n\t//     table_type: gpt\n\t//     layout: true\n\t// fs_setup:\n\t//   - label: coder_home\n\t//     filesystem: ext4\n\t//     device: homedir.1\n\t// mounts:\n\t//   - [\"LABEL=coder_home\", \"/home/${username}\"]\n\t// hostname: ${hostname}\n\t// users:\n\t//   - name: ${username}\n\t//     sudo: [\"ALL=(ALL) NOPASSWD:ALL\"]\n\t//     groups: sudo\n\t//     shell: /bin/bash\n\t// packages:\n\t//   - git\n\t// write_files:\n\t//   - path: /opt/coder/init\n\t//     permissions: \"0755\"\n\t//     encoding: b64\n\t//     content: ${init_script}\n\t//   - path: /etc/systemd/system/coder-agent.service\n\t//     permissions: \"0644\"\n\t//     content: |\n\t//       [Unit]\n\t//       Description=Coder Agent\n\t//       After=network-online.target\n\t//       Wants=network-online.target\n\n\t//       [Service]\n\t//       User=${username}\n\t//       ExecStart=/opt/coder/init\n\t//       Restart=always\n\t//       RestartSec=10\n\t//       TimeoutStopSec=90\n\t//       KillMode=process\n\n\t//       OOMScoreAdjust=-900\n\t//       SyslogIdentifier=coder-agent\n\n\t//       [Install]\n\t//       WantedBy=multi-user.target\n\t// runcmd:\n\t//   - chown ${username}:${username} /home/${username}\n\t//   - systemctl enable coder-agent\n\t//   - systemctl start coder-agent\n    content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n      username    = \"coder\" # Ensure this user/group does not exist in your VM image\n      init_script = base64encode(coder_agent.main.init_script)\n      hostname    = lower(data.coder_workspace.me.name)\n    })\n  }\n}\n\nresource \"azurerm_linux_virtual_machine\" \"main\" {\n  count               = data.coder_workspace.me.start_count\n  name                = \"vm\"\n  resource_group_name = azurerm_resource_group.main.name\n  location            = azurerm_resource_group.main.location\n  size                = data.coder_parameter.instance_type.value\n  // cloud-init overwrites this, so the value here doesn't matter\n  admin_username = \"adminuser\"\n  admin_ssh_key {\n    public_key = tls_private_key.dummy.public_key_openssh\n    username   = \"adminuser\"\n  }\n\n  network_interface_ids = [\n    azurerm_network_interface.main.id,\n  ]\n  computer_name = lower(data.coder_workspace.me.name)\n  os_disk {\n    caching              = \"ReadWrite\"\n    storage_account_type = \"Standard_LRS\"\n  }\n  source_image_reference {\n    publisher = \"Canonical\"\n    offer     = \"0001-com-ubuntu-server-focal\"\n    sku       = \"20_04-lts-gen2\"\n    version   = \"latest\"\n  }\n  user_data = data.cloudinit_config.user_data.rendered\n}\n</azure-vm-instance>\n\n<docker-container>\nterraform {\n  required_providers {\n    coder = {\n      source = \"kreuzwerker/docker\"\n    }\n  }\n}\n\n// The agent is configured with \"token\" auth.\n\nresource \"docker_container\" \"workspace\" {\n  count = data.coder_workspace.me.start_count\n  image = \"codercom/enterprise-base:ubuntu\"\n  # Uses lower() to avoid Docker restriction on container names.\n  name = \"coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}\"\n  # Hostname makes the shell more user friendly: coder@my-workspace:~$\n  hostname = data.coder_workspace.me.name\n  # Use the docker gateway if the access URL is 127.0.0.1.\n  entrypoint = [\"sh\", \"-c\", replace(coder_agent.main.init_script, \"/localhost|127\\\\.0\\\\.0\\\\.1/\", \"host.docker.internal\")]\n  env        = [\"CODER_AGENT_TOKEN=${coder_agent.main.token}\"]\n  host {\n    host = \"host.docker.internal\"\n    ip   = \"host-gateway\"\n  }\n  volumes {\n    container_path = \"/home/coder\"\n    volume_name    = docker_volume.home_volume.name\n    read_only      = false\n  }\n}\n</docker-container>\n\n<kubernetes-pod>\n// The agent is configured with \"token\" auth.\n\nresource \"kubernetes_deployment\" \"main\" {\n  count = data.coder_workspace.me.start_count\n  depends_on = [\n    kubernetes_persistent_volume_claim.home\n  ]\n  wait_for_rollout = false\n  metadata {\n    name      = \"coder-${data.coder_workspace.me.id}\"\n  }\n\n  spec {\n    replicas = 1\n    strategy {\n      type = \"Recreate\"\n    }\n\n    template {\n      spec {\n        security_context {\n          run_as_user     = 1000\n          fs_group        = 1000\n          run_as_non_root = true\n        }\n\n        container {\n          name              = \"dev\"\n          image             = \"codercom/enterprise-base:ubuntu\"\n          image_pull_policy = \"Always\"\n          command           = [\"sh\", \"-c\", coder_agent.main.init_script]\n          security_context {\n            run_as_user = \"1000\"\n          }\n          env {\n            name  = \"CODER_AGENT_TOKEN\"\n            value = coder_agent.main.token\n          }\n        }\n      }\n    }\n  }\n}\n</kubernetes-pod>\n\nThe file_id provided is a reference to a tar file you have uploaded containing the Terraform.\n","name":"bmcp_coder_coder_create_template_version","parameters":{"properties":{"file_id":{"type":"string"},"template_id":{"type":"string"}},"required":["file_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace in Coder.\n\nIf a user is asking to \"test a template\", they are typically referring\nto creating a workspace from a template to ensure the infrastructure\nis provisioned correctly and the agent can connect to the control plane.\n\nBefore creating a workspace, always confirm the template choice with the user by:\n\n\t1. Listing the available templates that match their request.\n\t2. Recommending the most relevant option.\n\t2. Asking the user to confirm which template to use.\n\nIt is important to not create a workspace without confirming the template\nchoice with the user.\n\nAfter creating a workspace, watch the build logs and wait for the workspace to\nbe ready before trying to use or connect to the workspace.\n","name":"bmcp_coder_coder_create_workspace","parameters":{"properties":{"name":{"description":"Name of the workspace to create.","type":"string"},"rich_parameters":{"description":"Key/value pairs of rich parameters to pass to the template version to create the workspace.","type":"object"},"template_version_id":{"description":"ID of the template version to create the workspace from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a workspace. Omit or use the `me` keyword to create a workspace for the authenticated user.","type":"string"}},"required":["user","template_version_id","name","rich_parameters"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace build for an existing workspace. Use this to start, stop, or delete.\n\nAfter creating a workspace build, watch the build logs and wait for the\nworkspace build to complete before trying to start another build or use or\nconnect to the workspace.\n","name":"bmcp_coder_coder_create_workspace_build","parameters":{"properties":{"template_version_id":{"description":"(Optional) The template version ID to use for the workspace build. If not provided, the previously built version will be used.","type":"string"},"transition":{"description":"The transition to perform. Must be one of: start, stop, delete","enum":["start","stop","delete"],"type":"string"},"workspace_id":{"type":"string"}},"required":["workspace_id","transition"],"type":"object"},"strict":false},{"type":"function","description":"Delete a task.","name":"bmcp_coder_coder_delete_task","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to delete. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Delete a template. This is irreversible.","name":"bmcp_coder_coder_delete_template","parameters":{"properties":{"template_id":{"type":"string"}},"required":["template_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the currently authenticated user, similar to the `whoami` command.","name":"bmcp_coder_coder_get_authenticated_user","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a task.","name":"bmcp_coder_coder_get_task_logs","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to query. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the status of a task.","name":"bmcp_coder_coder_get_task_status","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to get. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a template version. This is useful to check whether a template version successfully imports or not.","name":"bmcp_coder_coder_get_template_version_logs","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Get a workspace by name or ID.\n\nThis returns more data than list_workspaces to reduce token usage.","name":"bmcp_coder_coder_get_workspace","parameters":{"properties":{"workspace_id":{"description":"The workspace ID or name in the format [owner/]workspace. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace agent.\n\n\t\tMore logs may appear after this call. It does not wait for the agent to finish.","name":"bmcp_coder_coder_get_workspace_agent_logs","parameters":{"properties":{"workspace_agent_id":{"type":"string"}},"required":["workspace_agent_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace build.\n\n\t\tUseful for checking whether a workspace builds successfully or not.","name":"bmcp_coder_coder_get_workspace_build_logs","parameters":{"properties":{"workspace_build_id":{"type":"string"}},"required":["workspace_build_id"],"type":"object"},"strict":false},{"type":"function","description":"List tasks.","name":"bmcp_coder_coder_list_tasks","parameters":{"properties":{"status":{"description":"Optional filter by task status.","type":"string"},"user":{"description":"Username or ID of the user for which to list tasks. Omit or use the `me` keyword to list tasks for the authenticated user.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Lists templates for the authenticated user.","name":"bmcp_coder_coder_list_templates","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Lists workspaces for the authenticated user.","name":"bmcp_coder_coder_list_workspaces","parameters":{"properties":{"owner":{"description":"The owner of the workspaces to list. Use \"me\" to list workspaces for the authenticated user. If you do not specify an owner, \"me\" will be assumed by default.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Send input to a running task.","name":"bmcp_coder_coder_send_task_input","parameters":{"properties":{"input":{"description":"The input to send to the task.","type":"string"},"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to prompt. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id","input"],"type":"object"},"strict":false},{"type":"function","description":"Get the parameters for a template version. You can refer to these as workspace parameters to the user, as they are typically important for creating a workspace.","name":"bmcp_coder_coder_template_version_parameters","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Update the active version of a template. This is helpful when iterating on templates.","name":"bmcp_coder_coder_update_template_active_version","parameters":{"properties":{"template_id":{"type":"string"},"template_version_id":{"type":"string"}},"required":["template_id","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create and upload a tar file by key/value mapping of file names to file contents. Use this to create template versions. Reference the tool description of \"create_template_version\" to understand template requirements.","name":"bmcp_coder_coder_upload_tar_file","parameters":{"properties":{"files":{"description":"A map of file names to file contents.","type":"object"}},"required":["files"],"type":"object"},"strict":false},{"type":"function","description":"Execute a bash command in a Coder workspace.\n\nThis tool provides the same functionality as the 'coder ssh <workspace> <command>' CLI command.\nIt automatically starts the workspace if it's stopped and waits for the agent to be ready.\nThe output is trimmed of leading and trailing whitespace.\n\nThe workspace parameter supports various formats:\n- workspace (uses current user)\n- owner/workspace\n- owner--workspace\n- workspace.agent (specific agent)\n- owner/workspace.agent\n\nThe timeout_ms parameter specifies the command timeout in milliseconds (defaults to 60000ms, maximum of 300000ms).\nIf the command times out, all output captured up to that point is returned with a cancellation message.\n\nFor background commands (background: true), output is captured until the timeout is reached, then the command\ncontinues running in the background. The captured output is returned as the result.\n\nFor file operations (list, write, edit), always prefer the dedicated file tools.\nDo not use bash commands (ls, cat, echo, heredoc, etc.) to list, write, or read\nfiles when the file tools are available. The bash tool should be used for:\n\n\t- Running commands and scripts\n\t- Installing packages\n\t- Starting services\n\t- Executing programs\n\nExamples:\n- workspace: \"john/dev-env\", command: \"git status\", timeout_ms: 30000\n- workspace: \"my-workspace\", command: \"npm run dev\", background: true, timeout_ms: 10000\n- workspace: \"my-workspace.main\", command: \"docker ps\"","name":"bmcp_coder_coder_workspace_bash","parameters":{"properties":{"background":{"description":"Whether to run the command in the background. Output is captured until timeout, then the command continues running in the background.","type":"boolean"},"command":{"description":"The bash command to execute in the workspace.","type":"string"},"timeout_ms":{"default":60000,"description":"Command timeout in milliseconds. Defaults to 60000ms (60 seconds) if not specified.","minimum":1,"type":"integer"},"workspace":{"description":"The workspace name in format [owner/]workspace[.agent]. If owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","command"],"type":"object"},"strict":false},{"type":"function","description":"Edit a file in a workspace.","name":"bmcp_coder_coder_workspace_edit_file","parameters":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","edits"],"type":"object"},"strict":false},{"type":"function","description":"Edit one or more files in a workspace.","name":"bmcp_coder_coder_workspace_edit_files","parameters":{"properties":{"files":{"description":"An array of files to edit.","items":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"}},"required":["path","edits"],"type":"object"},"type":"array"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","files"],"type":"object"},"strict":false},{"type":"function","description":"List the URLs of Coder apps running in a workspace for a single agent.","name":"bmcp_coder_coder_workspace_list_apps","parameters":{"properties":{"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace"],"type":"object"},"strict":false},{"type":"function","description":"List directories in a workspace.","name":"bmcp_coder_coder_workspace_ls","parameters":{"properties":{"path":{"description":"The absolute path of the directory in the workspace to list.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Fetch URLs that forward to the specified port.","name":"bmcp_coder_coder_workspace_port_forward","parameters":{"properties":{"port":{"description":"The port to forward.","type":"number"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","port"],"type":"object"},"strict":false},{"type":"function","description":"Read from a file in a workspace.","name":"bmcp_coder_coder_workspace_read_file","parameters":{"properties":{"limit":{"description":"The number of bytes to read. Cannot exceed 1 MiB. Defaults to the full size of the file or 1 MiB, whichever is lower.","type":"integer"},"offset":{"description":"A byte offset indicating where in the file to start reading. Defaults to zero. An empty string indicates the end of the file has been reached.","type":"integer"},"path":{"description":"The absolute path of the file to read in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Write a file in a workspace.\n\nIf a file write fails due to syntax errors or encoding issues, do NOT switch\nto using bash commands as a workaround. Instead:\n\n\t1. Read the error message carefully to identify the issue\n\t2. Fix the content encoding/syntax\n\t3. Retry with this tool\n\nThe content parameter expects base64-encoded bytes. Ensure your source content\nis correct before encoding it. If you encounter errors, decode and verify the\ncontent you are trying to write, then re-encode it properly.\n","name":"bmcp_coder_coder_workspace_write_file","parameters":{"properties":{"content":{"description":"The base64-encoded bytes to write to the file.","type":"string"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","content"],"type":"object"},"strict":false}],"top_logprobs":0,"top_p":1.0,"truncation":"disabled","usage":{"input_tokens":6280,"input_tokens_details":{"cached_tokens":100,"cache_write_tokens":5},"output_tokens":30,"output_tokens_details":{"reasoning_tokens":3},"total_tokens":6310},"user":null,"metadata":{}},"sequence_number":17}
 
 
 -- streaming/tool-call --
@@ -246,5 +246,5 @@ event: response.output_item.done
 data: {"type":"response.output_item.done","item":{"id":"msg_0dfed48e1052ad7f0069725ca4c2488193a652eba330c51e5b","type":"message","status":"completed","content":[{"type":"output_text","annotations":[],"logprobs":[],"text":"The workspace ID you provided ('non_existing_id') is not valid. Workspace IDs must be valid UUIDs (typically 36 characters long). Please provide a valid workspace ID to create a new workspace build. If you need help finding your workspace ID, let me know!"}],"role":"assistant"},"output_index":0,"sequence_number":60}
 
 event: response.completed
-data: {"type":"response.completed","response":{"id":"resp_0dfed48e1052ad7f0069725ca39880819390fcc5b2eb8cf8c6","object":"response","created_at":1769102499,"status":"completed","background":false,"completed_at":1769102501,"error":null,"frequency_penalty":0.0,"incomplete_details":null,"instructions":null,"max_output_tokens":null,"max_tool_calls":null,"model":"gpt-4.1-2025-04-14","output":[{"id":"msg_0dfed48e1052ad7f0069725ca4c2488193a652eba330c51e5b","type":"message","status":"completed","content":[{"type":"output_text","annotations":[],"logprobs":[],"text":"The workspace ID you provided ('non_existing_id') is not valid. Workspace IDs must be valid UUIDs (typically 36 characters long). Please provide a valid workspace ID to create a new workspace build. If you need help finding your workspace ID, let me know!"}],"role":"assistant"}],"parallel_tool_calls":false,"presence_penalty":0.0,"previous_response_id":null,"prompt_cache_key":null,"prompt_cache_retention":null,"reasoning":{"effort":null,"summary":null},"safety_identifier":null,"service_tier":"default","store":true,"temperature":1.0,"text":{"format":{"type":"text"},"verbosity":"medium"},"tool_choice":"auto","tools":[{"type":"function","description":"Create a task.","name":"bmcp_coder_coder_create_task","parameters":{"properties":{"input":{"description":"Input/prompt for the task.","type":"string"},"template_version_id":{"description":"ID of the template version to create the task from.","type":"string"},"template_version_preset_id":{"description":"Optional ID of the template version preset to create the task from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a task. Omit or use the `me` keyword to create a task for the authenticated user.","type":"string"}},"required":["input","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template in Coder. First, you must create a template version.","name":"bmcp_coder_coder_create_template","parameters":{"properties":{"description":{"type":"string"},"display_name":{"type":"string"},"icon":{"description":"A URL to an icon to use.","type":"string"},"name":{"type":"string"},"version_id":{"description":"The ID of the version to use.","type":"string"}},"required":["name","display_name","description","version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template version. This is a precursor to creating a template, or you can update an existing template.\n\nTemplates are Terraform defining a development environment. The provisioned infrastructure must run\nan Agent that connects to the Coder Control Plane to provide a rich experience.\n\nHere are some strict rules for creating a template version:\n- YOU MUST NOT use \"variable\" or \"output\" blocks in the Terraform code.\n- YOU MUST ALWAYS check template version logs after creation to ensure the template was imported successfully.\n\nWhen a template version is created, a Terraform Plan occurs that ensures the infrastructure\n_could_ be provisioned, but actual provisioning occurs when a workspace is created.\n\n<terraform-spec>\nThe Coder Terraform Provider can be imported like:\n\n```hcl\nterraform {\n  required_providers {\n    coder = {\n      source = \"coder/coder\"\n    }\n  }\n}\n```\n\nA destroy does not occur when a user stops a workspace, but rather the transition changes:\n\n```hcl\ndata \"coder_workspace\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace.\n- name: The name of the workspace.\n- transition: Either \"start\" or \"stop\".\n- start_count: A computed count based on the transition field. If \"start\", this will be 1.\n\nAccess workspace owner information with:\n\n```hcl\ndata \"coder_workspace_owner\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace owner.\n- name: The name of the workspace owner.\n- full_name: The full name of the workspace owner.\n- email: The email of the workspace owner.\n- session_token: A token that can be used to authenticate the workspace owner. It is regenerated every time the workspace is started.\n- oidc_access_token: A valid OpenID Connect access token of the workspace owner. This is only available if the workspace owner authenticated with OpenID Connect. If a valid token cannot be obtained, this value will be an empty string.\n\nParameters are defined in the template version. They are rendered in the UI on the workspace creation page:\n\n```hcl\nresource \"coder_parameter\" \"region\" {\n  name = \"region\"\n  type = \"string\"\n  default = \"us-east-1\"\n}\n```\n\nThis resource accepts the following properties:\n- name: The name of the parameter.\n- default: The default value of the parameter.\n- type: The type of the parameter. Must be one of: \"string\", \"number\", \"bool\", or \"list(string)\".\n- display_name: The displayed name of the parameter as it will appear in the UI.\n- description: The description of the parameter as it will appear in the UI.\n- ephemeral: The value of an ephemeral parameter will not be preserved between consecutive workspace builds.\n- form_type: The type of this parameter. Must be one of: [radio, slider, input, dropdown, checkbox, switch, multi-select, tag-select, textarea, error].\n- icon: A URL to an icon to display in the UI.\n- mutable: Whether this value can be changed after workspace creation. This can be destructive for values like region, so use with caution!\n- option: Each option block defines a value for a user to select from. (see below for nested schema)\n  Required:\n  - name: The name of the option.\n  - value: The value of the option.\n  Optional:\n  - description: The description of the option as it will appear in the UI.\n  - icon: A URL to an icon to display in the UI.\n\nA Workspace Agent runs on provisioned infrastructure to provide access to the workspace:\n\n```hcl\nresource \"coder_agent\" \"dev\" {\n  arch = \"amd64\"\n  os = \"linux\"\n}\n```\n\nThis resource accepts the following properties:\n- arch: The architecture of the agent. Must be one of: \"amd64\", \"arm64\", or \"armv7\".\n- os: The operating system of the agent. Must be one of: \"linux\", \"windows\", or \"darwin\".\n- auth: The authentication method for the agent. Must be one of: \"token\", \"google-instance-identity\", \"aws-instance-identity\", or \"azure-instance-identity\". It is insecure to pass the agent token via exposed variables to Virtual Machines. Instance Identity enables provisioned VMs to authenticate by instance ID on start.\n- dir: The starting directory when a user creates a shell session. Defaults to \"$HOME\".\n- env: A map of environment variables to set for the agent.\n- startup_script: A script to run after the agent starts. This script MUST exit eventually to signal that startup has completed. Use \"&\" or \"screen\" to run processes in the background.\n\nThis resource provides the following fields:\n- id: The UUID of the agent.\n- init_script: The script to run on provisioned infrastructure to fetch and start the agent.\n- token: Set the environment variable CODER_AGENT_TOKEN to this value to authenticate the agent.\n\nThe agent MUST be installed and started using the init_script. A utility like curl or wget to fetch the agent binary must exist in the provisioned infrastructure.\n\nExpose terminal or HTTP applications running in a workspace with:\n\n```hcl\nresource \"coder_app\" \"dev\" {\n  agent_id = coder_agent.dev.id\n  slug = \"my-app-name\"\n  display_name = \"My App\"\n  icon = \"https://my-app.com/icon.svg\"\n  url = \"http://127.0.0.1:3000\"\n}\n```\n\nThis resource accepts the following properties:\n- agent_id: The ID of the agent to attach the app to.\n- slug: The slug of the app.\n- display_name: The displayed name of the app as it will appear in the UI.\n- icon: A URL to an icon to display in the UI.\n- url: An external url if external=true or a URL to be proxied to from inside the workspace. This should be of the form http://localhost:PORT[/SUBPATH]. Either command or url may be specified, but not both.\n- command: A command to run in a terminal opening this app. In the web, this will open in a new tab. In the CLI, this will SSH and execute the command. Either command or url may be specified, but not both.\n- external: Whether this app is an external app. If true, the url will be opened in a new tab.\n</terraform-spec>\n\nThe Coder Server may not be authenticated with the infrastructure provider a user requests. In this scenario,\nthe user will need to provide credentials to the Coder Server before the workspace can be provisioned.\n\nHere are examples of provisioning the Coder Agent on specific infrastructure providers:\n\n<aws-ec2-instance>\n// The agent is configured with \"aws-instance-identity\" auth.\nterraform {\n  required_providers {\n    cloudinit = {\n      source = \"hashicorp/cloudinit\"\n    }\n    aws = {\n      source = \"hashicorp/aws\"\n    }\n  }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n  gzip          = false\n  base64_encode = false\n  boundary = \"//\"\n  part {\n    filename     = \"cloud-config.yaml\"\n    content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t//   - [scripts-user, always]\n\t// hostname: ${hostname}\n\t// users:\n\t//   - name: ${linux_user}\n\t//     sudo: ALL=(ALL) NOPASSWD:ALL\n\t//     shell: /bin/bash\n    content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n      hostname   = local.hostname\n      linux_user = local.linux_user\n    })\n  }\n\n  part {\n    filename     = \"userdata.sh\"\n    content_type = \"text/x-shellscript\"\n\n\t// Here is the content of the userdata.sh.tftpl file:\n\t// #!/bin/bash\n\t// sudo -u '${linux_user}' sh -c '${init_script}'\n    content = templatefile(\"${path.module}/cloud-init/userdata.sh.tftpl\", {\n      linux_user = local.linux_user\n\n      init_script = try(coder_agent.dev[0].init_script, \"\")\n    })\n  }\n}\n\nresource \"aws_instance\" \"dev\" {\n  ami               = data.aws_ami.ubuntu.id\n  availability_zone = \"${data.coder_parameter.region.value}a\"\n  instance_type     = data.coder_parameter.instance_type.value\n\n  user_data = data.cloudinit_config.user_data.rendered\n  tags = {\n    Name = \"coder-${data.coder_workspace_owner.me.name}-${data.coder_workspace.me.name}\"\n  }\n  lifecycle {\n    ignore_changes = [ami]\n  }\n}\n</aws-ec2-instance>\n\n<gcp-vm-instance>\n// The agent is configured with \"google-instance-identity\" auth.\nterraform {\n  required_providers {\n    google = {\n      source = \"hashicorp/google\"\n    }\n  }\n}\n\nresource \"google_compute_instance\" \"dev\" {\n  zone         = module.gcp_region.value\n  count        = data.coder_workspace.me.start_count\n  name         = \"coder-${lower(data.coder_workspace_owner.me.name)}-${lower(data.coder_workspace.me.name)}-root\"\n  machine_type = \"e2-medium\"\n  network_interface {\n    network = \"default\"\n    access_config {\n      // Ephemeral public IP\n    }\n  }\n  boot_disk {\n    auto_delete = false\n    source      = google_compute_disk.root.name\n  }\n  // In order to use google-instance-identity, a service account *must* be provided.\n  service_account {\n    email  = data.google_compute_default_service_account.default.email\n    scopes = [\"cloud-platform\"]\n  }\n  # ONLY FOR WINDOWS:\n  # metadata = {\n  #   windows-startup-script-ps1 = coder_agent.main.init_script\n  # }\n  # The startup script runs as root with no $HOME environment set up, so instead of directly\n  # running the agent init script, create a user (with a homedir, default shell and sudo\n  # permissions) and execute the init script as that user.\n  #\n  # The agent MUST be started in here.\n  metadata_startup_script = <<EOMETA\n#!/usr/bin/env sh\nset -eux\n\n# If user does not exist, create it and set up passwordless sudo\nif ! id -u \"${local.linux_user}\" >/dev/null 2>&1; then\n  useradd -m -s /bin/bash \"${local.linux_user}\"\n  echo \"${local.linux_user} ALL=(ALL) NOPASSWD:ALL\" > /etc/sudoers.d/coder-user\nfi\n\nexec sudo -u \"${local.linux_user}\" sh -c '${coder_agent.main.init_script}'\nEOMETA\n}\n</gcp-vm-instance>\n\n<azure-vm-instance>\n// The agent is configured with \"azure-instance-identity\" auth.\nterraform {\n  required_providers {\n    azurerm = {\n      source = \"hashicorp/azurerm\"\n    }\n    cloudinit = {\n      source = \"hashicorp/cloudinit\"\n    }\n  }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n  gzip          = false\n  base64_encode = true\n\n  boundary = \"//\"\n\n  part {\n    filename     = \"cloud-config.yaml\"\n    content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t// - [scripts-user, always]\n\t// bootcmd:\n\t//   # work around https://github.com/hashicorp/terraform-provider-azurerm/issues/6117\n\t//   - until [ -e /dev/disk/azure/scsi1/lun10 ]; do sleep 1; done\n\t// device_aliases:\n\t//   homedir: /dev/disk/azure/scsi1/lun10\n\t// disk_setup:\n\t//   homedir:\n\t//     table_type: gpt\n\t//     layout: true\n\t// fs_setup:\n\t//   - label: coder_home\n\t//     filesystem: ext4\n\t//     device: homedir.1\n\t// mounts:\n\t//   - [\"LABEL=coder_home\", \"/home/${username}\"]\n\t// hostname: ${hostname}\n\t// users:\n\t//   - name: ${username}\n\t//     sudo: [\"ALL=(ALL) NOPASSWD:ALL\"]\n\t//     groups: sudo\n\t//     shell: /bin/bash\n\t// packages:\n\t//   - git\n\t// write_files:\n\t//   - path: /opt/coder/init\n\t//     permissions: \"0755\"\n\t//     encoding: b64\n\t//     content: ${init_script}\n\t//   - path: /etc/systemd/system/coder-agent.service\n\t//     permissions: \"0644\"\n\t//     content: |\n\t//       [Unit]\n\t//       Description=Coder Agent\n\t//       After=network-online.target\n\t//       Wants=network-online.target\n\n\t//       [Service]\n\t//       User=${username}\n\t//       ExecStart=/opt/coder/init\n\t//       Restart=always\n\t//       RestartSec=10\n\t//       TimeoutStopSec=90\n\t//       KillMode=process\n\n\t//       OOMScoreAdjust=-900\n\t//       SyslogIdentifier=coder-agent\n\n\t//       [Install]\n\t//       WantedBy=multi-user.target\n\t// runcmd:\n\t//   - chown ${username}:${username} /home/${username}\n\t//   - systemctl enable coder-agent\n\t//   - systemctl start coder-agent\n    content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n      username    = \"coder\" # Ensure this user/group does not exist in your VM image\n      init_script = base64encode(coder_agent.main.init_script)\n      hostname    = lower(data.coder_workspace.me.name)\n    })\n  }\n}\n\nresource \"azurerm_linux_virtual_machine\" \"main\" {\n  count               = data.coder_workspace.me.start_count\n  name                = \"vm\"\n  resource_group_name = azurerm_resource_group.main.name\n  location            = azurerm_resource_group.main.location\n  size                = data.coder_parameter.instance_type.value\n  // cloud-init overwrites this, so the value here doesn't matter\n  admin_username = \"adminuser\"\n  admin_ssh_key {\n    public_key = tls_private_key.dummy.public_key_openssh\n    username   = \"adminuser\"\n  }\n\n  network_interface_ids = [\n    azurerm_network_interface.main.id,\n  ]\n  computer_name = lower(data.coder_workspace.me.name)\n  os_disk {\n    caching              = \"ReadWrite\"\n    storage_account_type = \"Standard_LRS\"\n  }\n  source_image_reference {\n    publisher = \"Canonical\"\n    offer     = \"0001-com-ubuntu-server-focal\"\n    sku       = \"20_04-lts-gen2\"\n    version   = \"latest\"\n  }\n  user_data = data.cloudinit_config.user_data.rendered\n}\n</azure-vm-instance>\n\n<docker-container>\nterraform {\n  required_providers {\n    coder = {\n      source = \"kreuzwerker/docker\"\n    }\n  }\n}\n\n// The agent is configured with \"token\" auth.\n\nresource \"docker_container\" \"workspace\" {\n  count = data.coder_workspace.me.start_count\n  image = \"codercom/enterprise-base:ubuntu\"\n  # Uses lower() to avoid Docker restriction on container names.\n  name = \"coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}\"\n  # Hostname makes the shell more user friendly: coder@my-workspace:~$\n  hostname = data.coder_workspace.me.name\n  # Use the docker gateway if the access URL is 127.0.0.1.\n  entrypoint = [\"sh\", \"-c\", replace(coder_agent.main.init_script, \"/localhost|127\\\\.0\\\\.0\\\\.1/\", \"host.docker.internal\")]\n  env        = [\"CODER_AGENT_TOKEN=${coder_agent.main.token}\"]\n  host {\n    host = \"host.docker.internal\"\n    ip   = \"host-gateway\"\n  }\n  volumes {\n    container_path = \"/home/coder\"\n    volume_name    = docker_volume.home_volume.name\n    read_only      = false\n  }\n}\n</docker-container>\n\n<kubernetes-pod>\n// The agent is configured with \"token\" auth.\n\nresource \"kubernetes_deployment\" \"main\" {\n  count = data.coder_workspace.me.start_count\n  depends_on = [\n    kubernetes_persistent_volume_claim.home\n  ]\n  wait_for_rollout = false\n  metadata {\n    name      = \"coder-${data.coder_workspace.me.id}\"\n  }\n\n  spec {\n    replicas = 1\n    strategy {\n      type = \"Recreate\"\n    }\n\n    template {\n      spec {\n        security_context {\n          run_as_user     = 1000\n          fs_group        = 1000\n          run_as_non_root = true\n        }\n\n        container {\n          name              = \"dev\"\n          image             = \"codercom/enterprise-base:ubuntu\"\n          image_pull_policy = \"Always\"\n          command           = [\"sh\", \"-c\", coder_agent.main.init_script]\n          security_context {\n            run_as_user = \"1000\"\n          }\n          env {\n            name  = \"CODER_AGENT_TOKEN\"\n            value = coder_agent.main.token\n          }\n        }\n      }\n    }\n  }\n}\n</kubernetes-pod>\n\nThe file_id provided is a reference to a tar file you have uploaded containing the Terraform.\n","name":"bmcp_coder_coder_create_template_version","parameters":{"properties":{"file_id":{"type":"string"},"template_id":{"type":"string"}},"required":["file_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace in Coder.\n\nIf a user is asking to \"test a template\", they are typically referring\nto creating a workspace from a template to ensure the infrastructure\nis provisioned correctly and the agent can connect to the control plane.\n\nBefore creating a workspace, always confirm the template choice with the user by:\n\n\t1. Listing the available templates that match their request.\n\t2. Recommending the most relevant option.\n\t2. Asking the user to confirm which template to use.\n\nIt is important to not create a workspace without confirming the template\nchoice with the user.\n\nAfter creating a workspace, watch the build logs and wait for the workspace to\nbe ready before trying to use or connect to the workspace.\n","name":"bmcp_coder_coder_create_workspace","parameters":{"properties":{"name":{"description":"Name of the workspace to create.","type":"string"},"rich_parameters":{"description":"Key/value pairs of rich parameters to pass to the template version to create the workspace.","type":"object"},"template_version_id":{"description":"ID of the template version to create the workspace from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a workspace. Omit or use the `me` keyword to create a workspace for the authenticated user.","type":"string"}},"required":["user","template_version_id","name","rich_parameters"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace build for an existing workspace. Use this to start, stop, or delete.\n\nAfter creating a workspace build, watch the build logs and wait for the\nworkspace build to complete before trying to start another build or use or\nconnect to the workspace.\n","name":"bmcp_coder_coder_create_workspace_build","parameters":{"properties":{"template_version_id":{"description":"(Optional) The template version ID to use for the workspace build. If not provided, the previously built version will be used.","type":"string"},"transition":{"description":"The transition to perform. Must be one of: start, stop, delete","enum":["start","stop","delete"],"type":"string"},"workspace_id":{"type":"string"}},"required":["workspace_id","transition"],"type":"object"},"strict":false},{"type":"function","description":"Delete a task.","name":"bmcp_coder_coder_delete_task","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to delete. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Delete a template. This is irreversible.","name":"bmcp_coder_coder_delete_template","parameters":{"properties":{"template_id":{"type":"string"}},"required":["template_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the currently authenticated user, similar to the `whoami` command.","name":"bmcp_coder_coder_get_authenticated_user","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a task.","name":"bmcp_coder_coder_get_task_logs","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to query. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the status of a task.","name":"bmcp_coder_coder_get_task_status","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to get. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a template version. This is useful to check whether a template version successfully imports or not.","name":"bmcp_coder_coder_get_template_version_logs","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Get a workspace by name or ID.\n\nThis returns more data than list_workspaces to reduce token usage.","name":"bmcp_coder_coder_get_workspace","parameters":{"properties":{"workspace_id":{"description":"The workspace ID or name in the format [owner/]workspace. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace agent.\n\n\t\tMore logs may appear after this call. It does not wait for the agent to finish.","name":"bmcp_coder_coder_get_workspace_agent_logs","parameters":{"properties":{"workspace_agent_id":{"type":"string"}},"required":["workspace_agent_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace build.\n\n\t\tUseful for checking whether a workspace builds successfully or not.","name":"bmcp_coder_coder_get_workspace_build_logs","parameters":{"properties":{"workspace_build_id":{"type":"string"}},"required":["workspace_build_id"],"type":"object"},"strict":false},{"type":"function","description":"List tasks.","name":"bmcp_coder_coder_list_tasks","parameters":{"properties":{"status":{"description":"Optional filter by task status.","type":"string"},"user":{"description":"Username or ID of the user for which to list tasks. Omit or use the `me` keyword to list tasks for the authenticated user.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Lists templates for the authenticated user.","name":"bmcp_coder_coder_list_templates","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Lists workspaces for the authenticated user.","name":"bmcp_coder_coder_list_workspaces","parameters":{"properties":{"owner":{"description":"The owner of the workspaces to list. Use \"me\" to list workspaces for the authenticated user. If you do not specify an owner, \"me\" will be assumed by default.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Send input to a running task.","name":"bmcp_coder_coder_send_task_input","parameters":{"properties":{"input":{"description":"The input to send to the task.","type":"string"},"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to prompt. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id","input"],"type":"object"},"strict":false},{"type":"function","description":"Get the parameters for a template version. You can refer to these as workspace parameters to the user, as they are typically important for creating a workspace.","name":"bmcp_coder_coder_template_version_parameters","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Update the active version of a template. This is helpful when iterating on templates.","name":"bmcp_coder_coder_update_template_active_version","parameters":{"properties":{"template_id":{"type":"string"},"template_version_id":{"type":"string"}},"required":["template_id","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create and upload a tar file by key/value mapping of file names to file contents. Use this to create template versions. Reference the tool description of \"create_template_version\" to understand template requirements.","name":"bmcp_coder_coder_upload_tar_file","parameters":{"properties":{"files":{"description":"A map of file names to file contents.","type":"object"}},"required":["files"],"type":"object"},"strict":false},{"type":"function","description":"Execute a bash command in a Coder workspace.\n\nThis tool provides the same functionality as the 'coder ssh <workspace> <command>' CLI command.\nIt automatically starts the workspace if it's stopped and waits for the agent to be ready.\nThe output is trimmed of leading and trailing whitespace.\n\nThe workspace parameter supports various formats:\n- workspace (uses current user)\n- owner/workspace\n- owner--workspace\n- workspace.agent (specific agent)\n- owner/workspace.agent\n\nThe timeout_ms parameter specifies the command timeout in milliseconds (defaults to 60000ms, maximum of 300000ms).\nIf the command times out, all output captured up to that point is returned with a cancellation message.\n\nFor background commands (background: true), output is captured until the timeout is reached, then the command\ncontinues running in the background. The captured output is returned as the result.\n\nFor file operations (list, write, edit), always prefer the dedicated file tools.\nDo not use bash commands (ls, cat, echo, heredoc, etc.) to list, write, or read\nfiles when the file tools are available. The bash tool should be used for:\n\n\t- Running commands and scripts\n\t- Installing packages\n\t- Starting services\n\t- Executing programs\n\nExamples:\n- workspace: \"john/dev-env\", command: \"git status\", timeout_ms: 30000\n- workspace: \"my-workspace\", command: \"npm run dev\", background: true, timeout_ms: 10000\n- workspace: \"my-workspace.main\", command: \"docker ps\"","name":"bmcp_coder_coder_workspace_bash","parameters":{"properties":{"background":{"description":"Whether to run the command in the background. Output is captured until timeout, then the command continues running in the background.","type":"boolean"},"command":{"description":"The bash command to execute in the workspace.","type":"string"},"timeout_ms":{"default":60000,"description":"Command timeout in milliseconds. Defaults to 60000ms (60 seconds) if not specified.","minimum":1,"type":"integer"},"workspace":{"description":"The workspace name in format [owner/]workspace[.agent]. If owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","command"],"type":"object"},"strict":false},{"type":"function","description":"Edit a file in a workspace.","name":"bmcp_coder_coder_workspace_edit_file","parameters":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","edits"],"type":"object"},"strict":false},{"type":"function","description":"Edit one or more files in a workspace.","name":"bmcp_coder_coder_workspace_edit_files","parameters":{"properties":{"files":{"description":"An array of files to edit.","items":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"}},"required":["path","edits"],"type":"object"},"type":"array"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","files"],"type":"object"},"strict":false},{"type":"function","description":"List the URLs of Coder apps running in a workspace for a single agent.","name":"bmcp_coder_coder_workspace_list_apps","parameters":{"properties":{"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace"],"type":"object"},"strict":false},{"type":"function","description":"List directories in a workspace.","name":"bmcp_coder_coder_workspace_ls","parameters":{"properties":{"path":{"description":"The absolute path of the directory in the workspace to list.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Fetch URLs that forward to the specified port.","name":"bmcp_coder_coder_workspace_port_forward","parameters":{"properties":{"port":{"description":"The port to forward.","type":"number"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","port"],"type":"object"},"strict":false},{"type":"function","description":"Read from a file in a workspace.","name":"bmcp_coder_coder_workspace_read_file","parameters":{"properties":{"limit":{"description":"The number of bytes to read. Cannot exceed 1 MiB. Defaults to the full size of the file or 1 MiB, whichever is lower.","type":"integer"},"offset":{"description":"A byte offset indicating where in the file to start reading. Defaults to zero. An empty string indicates the end of the file has been reached.","type":"integer"},"path":{"description":"The absolute path of the file to read in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Write a file in a workspace.\n\nIf a file write fails due to syntax errors or encoding issues, do NOT switch\nto using bash commands as a workaround. Instead:\n\n\t1. Read the error message carefully to identify the issue\n\t2. Fix the content encoding/syntax\n\t3. Retry with this tool\n\nThe content parameter expects base64-encoded bytes. Ensure your source content\nis correct before encoding it. If you encounter errors, decode and verify the\ncontent you are trying to write, then re-encode it properly.\n","name":"bmcp_coder_coder_workspace_write_file","parameters":{"properties":{"content":{"description":"The base64-encoded bytes to write to the file.","type":"string"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","content"],"type":"object"},"strict":false}],"top_logprobs":0,"top_p":1.0,"truncation":"disabled","usage":{"input_tokens":6346,"input_tokens_details":{"cached_tokens":0},"output_tokens":56,"output_tokens_details":{"reasoning_tokens":0},"total_tokens":6402},"user":null,"metadata":{}},"sequence_number":61}
+data: {"type":"response.completed","response":{"id":"resp_0dfed48e1052ad7f0069725ca39880819390fcc5b2eb8cf8c6","object":"response","created_at":1769102499,"status":"completed","background":false,"completed_at":1769102501,"error":null,"frequency_penalty":0.0,"incomplete_details":null,"instructions":null,"max_output_tokens":null,"max_tool_calls":null,"model":"gpt-4.1-2025-04-14","output":[{"id":"msg_0dfed48e1052ad7f0069725ca4c2488193a652eba330c51e5b","type":"message","status":"completed","content":[{"type":"output_text","annotations":[],"logprobs":[],"text":"The workspace ID you provided ('non_existing_id') is not valid. Workspace IDs must be valid UUIDs (typically 36 characters long). Please provide a valid workspace ID to create a new workspace build. If you need help finding your workspace ID, let me know!"}],"role":"assistant"}],"parallel_tool_calls":false,"presence_penalty":0.0,"previous_response_id":null,"prompt_cache_key":null,"prompt_cache_retention":null,"reasoning":{"effort":null,"summary":null},"safety_identifier":null,"service_tier":"default","store":true,"temperature":1.0,"text":{"format":{"type":"text"},"verbosity":"medium"},"tool_choice":"auto","tools":[{"type":"function","description":"Create a task.","name":"bmcp_coder_coder_create_task","parameters":{"properties":{"input":{"description":"Input/prompt for the task.","type":"string"},"template_version_id":{"description":"ID of the template version to create the task from.","type":"string"},"template_version_preset_id":{"description":"Optional ID of the template version preset to create the task from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a task. Omit or use the `me` keyword to create a task for the authenticated user.","type":"string"}},"required":["input","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template in Coder. First, you must create a template version.","name":"bmcp_coder_coder_create_template","parameters":{"properties":{"description":{"type":"string"},"display_name":{"type":"string"},"icon":{"description":"A URL to an icon to use.","type":"string"},"name":{"type":"string"},"version_id":{"description":"The ID of the version to use.","type":"string"}},"required":["name","display_name","description","version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new template version. This is a precursor to creating a template, or you can update an existing template.\n\nTemplates are Terraform defining a development environment. The provisioned infrastructure must run\nan Agent that connects to the Coder Control Plane to provide a rich experience.\n\nHere are some strict rules for creating a template version:\n- YOU MUST NOT use \"variable\" or \"output\" blocks in the Terraform code.\n- YOU MUST ALWAYS check template version logs after creation to ensure the template was imported successfully.\n\nWhen a template version is created, a Terraform Plan occurs that ensures the infrastructure\n_could_ be provisioned, but actual provisioning occurs when a workspace is created.\n\n<terraform-spec>\nThe Coder Terraform Provider can be imported like:\n\n```hcl\nterraform {\n  required_providers {\n    coder = {\n      source = \"coder/coder\"\n    }\n  }\n}\n```\n\nA destroy does not occur when a user stops a workspace, but rather the transition changes:\n\n```hcl\ndata \"coder_workspace\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace.\n- name: The name of the workspace.\n- transition: Either \"start\" or \"stop\".\n- start_count: A computed count based on the transition field. If \"start\", this will be 1.\n\nAccess workspace owner information with:\n\n```hcl\ndata \"coder_workspace_owner\" \"me\" {}\n```\n\nThis data source provides the following fields:\n- id: The UUID of the workspace owner.\n- name: The name of the workspace owner.\n- full_name: The full name of the workspace owner.\n- email: The email of the workspace owner.\n- session_token: A token that can be used to authenticate the workspace owner. It is regenerated every time the workspace is started.\n- oidc_access_token: A valid OpenID Connect access token of the workspace owner. This is only available if the workspace owner authenticated with OpenID Connect. If a valid token cannot be obtained, this value will be an empty string.\n\nParameters are defined in the template version. They are rendered in the UI on the workspace creation page:\n\n```hcl\nresource \"coder_parameter\" \"region\" {\n  name = \"region\"\n  type = \"string\"\n  default = \"us-east-1\"\n}\n```\n\nThis resource accepts the following properties:\n- name: The name of the parameter.\n- default: The default value of the parameter.\n- type: The type of the parameter. Must be one of: \"string\", \"number\", \"bool\", or \"list(string)\".\n- display_name: The displayed name of the parameter as it will appear in the UI.\n- description: The description of the parameter as it will appear in the UI.\n- ephemeral: The value of an ephemeral parameter will not be preserved between consecutive workspace builds.\n- form_type: The type of this parameter. Must be one of: [radio, slider, input, dropdown, checkbox, switch, multi-select, tag-select, textarea, error].\n- icon: A URL to an icon to display in the UI.\n- mutable: Whether this value can be changed after workspace creation. This can be destructive for values like region, so use with caution!\n- option: Each option block defines a value for a user to select from. (see below for nested schema)\n  Required:\n  - name: The name of the option.\n  - value: The value of the option.\n  Optional:\n  - description: The description of the option as it will appear in the UI.\n  - icon: A URL to an icon to display in the UI.\n\nA Workspace Agent runs on provisioned infrastructure to provide access to the workspace:\n\n```hcl\nresource \"coder_agent\" \"dev\" {\n  arch = \"amd64\"\n  os = \"linux\"\n}\n```\n\nThis resource accepts the following properties:\n- arch: The architecture of the agent. Must be one of: \"amd64\", \"arm64\", or \"armv7\".\n- os: The operating system of the agent. Must be one of: \"linux\", \"windows\", or \"darwin\".\n- auth: The authentication method for the agent. Must be one of: \"token\", \"google-instance-identity\", \"aws-instance-identity\", or \"azure-instance-identity\". It is insecure to pass the agent token via exposed variables to Virtual Machines. Instance Identity enables provisioned VMs to authenticate by instance ID on start.\n- dir: The starting directory when a user creates a shell session. Defaults to \"$HOME\".\n- env: A map of environment variables to set for the agent.\n- startup_script: A script to run after the agent starts. This script MUST exit eventually to signal that startup has completed. Use \"&\" or \"screen\" to run processes in the background.\n\nThis resource provides the following fields:\n- id: The UUID of the agent.\n- init_script: The script to run on provisioned infrastructure to fetch and start the agent.\n- token: Set the environment variable CODER_AGENT_TOKEN to this value to authenticate the agent.\n\nThe agent MUST be installed and started using the init_script. A utility like curl or wget to fetch the agent binary must exist in the provisioned infrastructure.\n\nExpose terminal or HTTP applications running in a workspace with:\n\n```hcl\nresource \"coder_app\" \"dev\" {\n  agent_id = coder_agent.dev.id\n  slug = \"my-app-name\"\n  display_name = \"My App\"\n  icon = \"https://my-app.com/icon.svg\"\n  url = \"http://127.0.0.1:3000\"\n}\n```\n\nThis resource accepts the following properties:\n- agent_id: The ID of the agent to attach the app to.\n- slug: The slug of the app.\n- display_name: The displayed name of the app as it will appear in the UI.\n- icon: A URL to an icon to display in the UI.\n- url: An external url if external=true or a URL to be proxied to from inside the workspace. This should be of the form http://localhost:PORT[/SUBPATH]. Either command or url may be specified, but not both.\n- command: A command to run in a terminal opening this app. In the web, this will open in a new tab. In the CLI, this will SSH and execute the command. Either command or url may be specified, but not both.\n- external: Whether this app is an external app. If true, the url will be opened in a new tab.\n</terraform-spec>\n\nThe Coder Server may not be authenticated with the infrastructure provider a user requests. In this scenario,\nthe user will need to provide credentials to the Coder Server before the workspace can be provisioned.\n\nHere are examples of provisioning the Coder Agent on specific infrastructure providers:\n\n<aws-ec2-instance>\n// The agent is configured with \"aws-instance-identity\" auth.\nterraform {\n  required_providers {\n    cloudinit = {\n      source = \"hashicorp/cloudinit\"\n    }\n    aws = {\n      source = \"hashicorp/aws\"\n    }\n  }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n  gzip          = false\n  base64_encode = false\n  boundary = \"//\"\n  part {\n    filename     = \"cloud-config.yaml\"\n    content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t//   - [scripts-user, always]\n\t// hostname: ${hostname}\n\t// users:\n\t//   - name: ${linux_user}\n\t//     sudo: ALL=(ALL) NOPASSWD:ALL\n\t//     shell: /bin/bash\n    content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n      hostname   = local.hostname\n      linux_user = local.linux_user\n    })\n  }\n\n  part {\n    filename     = \"userdata.sh\"\n    content_type = \"text/x-shellscript\"\n\n\t// Here is the content of the userdata.sh.tftpl file:\n\t// #!/bin/bash\n\t// sudo -u '${linux_user}' sh -c '${init_script}'\n    content = templatefile(\"${path.module}/cloud-init/userdata.sh.tftpl\", {\n      linux_user = local.linux_user\n\n      init_script = try(coder_agent.dev[0].init_script, \"\")\n    })\n  }\n}\n\nresource \"aws_instance\" \"dev\" {\n  ami               = data.aws_ami.ubuntu.id\n  availability_zone = \"${data.coder_parameter.region.value}a\"\n  instance_type     = data.coder_parameter.instance_type.value\n\n  user_data = data.cloudinit_config.user_data.rendered\n  tags = {\n    Name = \"coder-${data.coder_workspace_owner.me.name}-${data.coder_workspace.me.name}\"\n  }\n  lifecycle {\n    ignore_changes = [ami]\n  }\n}\n</aws-ec2-instance>\n\n<gcp-vm-instance>\n// The agent is configured with \"google-instance-identity\" auth.\nterraform {\n  required_providers {\n    google = {\n      source = \"hashicorp/google\"\n    }\n  }\n}\n\nresource \"google_compute_instance\" \"dev\" {\n  zone         = module.gcp_region.value\n  count        = data.coder_workspace.me.start_count\n  name         = \"coder-${lower(data.coder_workspace_owner.me.name)}-${lower(data.coder_workspace.me.name)}-root\"\n  machine_type = \"e2-medium\"\n  network_interface {\n    network = \"default\"\n    access_config {\n      // Ephemeral public IP\n    }\n  }\n  boot_disk {\n    auto_delete = false\n    source      = google_compute_disk.root.name\n  }\n  // In order to use google-instance-identity, a service account *must* be provided.\n  service_account {\n    email  = data.google_compute_default_service_account.default.email\n    scopes = [\"cloud-platform\"]\n  }\n  # ONLY FOR WINDOWS:\n  # metadata = {\n  #   windows-startup-script-ps1 = coder_agent.main.init_script\n  # }\n  # The startup script runs as root with no $HOME environment set up, so instead of directly\n  # running the agent init script, create a user (with a homedir, default shell and sudo\n  # permissions) and execute the init script as that user.\n  #\n  # The agent MUST be started in here.\n  metadata_startup_script = <<EOMETA\n#!/usr/bin/env sh\nset -eux\n\n# If user does not exist, create it and set up passwordless sudo\nif ! id -u \"${local.linux_user}\" >/dev/null 2>&1; then\n  useradd -m -s /bin/bash \"${local.linux_user}\"\n  echo \"${local.linux_user} ALL=(ALL) NOPASSWD:ALL\" > /etc/sudoers.d/coder-user\nfi\n\nexec sudo -u \"${local.linux_user}\" sh -c '${coder_agent.main.init_script}'\nEOMETA\n}\n</gcp-vm-instance>\n\n<azure-vm-instance>\n// The agent is configured with \"azure-instance-identity\" auth.\nterraform {\n  required_providers {\n    azurerm = {\n      source = \"hashicorp/azurerm\"\n    }\n    cloudinit = {\n      source = \"hashicorp/cloudinit\"\n    }\n  }\n}\n\ndata \"cloudinit_config\" \"user_data\" {\n  gzip          = false\n  base64_encode = true\n\n  boundary = \"//\"\n\n  part {\n    filename     = \"cloud-config.yaml\"\n    content_type = \"text/cloud-config\"\n\n\t// Here is the content of the cloud-config.yaml.tftpl file:\n\t// #cloud-config\n\t// cloud_final_modules:\n\t// - [scripts-user, always]\n\t// bootcmd:\n\t//   # work around https://github.com/hashicorp/terraform-provider-azurerm/issues/6117\n\t//   - until [ -e /dev/disk/azure/scsi1/lun10 ]; do sleep 1; done\n\t// device_aliases:\n\t//   homedir: /dev/disk/azure/scsi1/lun10\n\t// disk_setup:\n\t//   homedir:\n\t//     table_type: gpt\n\t//     layout: true\n\t// fs_setup:\n\t//   - label: coder_home\n\t//     filesystem: ext4\n\t//     device: homedir.1\n\t// mounts:\n\t//   - [\"LABEL=coder_home\", \"/home/${username}\"]\n\t// hostname: ${hostname}\n\t// users:\n\t//   - name: ${username}\n\t//     sudo: [\"ALL=(ALL) NOPASSWD:ALL\"]\n\t//     groups: sudo\n\t//     shell: /bin/bash\n\t// packages:\n\t//   - git\n\t// write_files:\n\t//   - path: /opt/coder/init\n\t//     permissions: \"0755\"\n\t//     encoding: b64\n\t//     content: ${init_script}\n\t//   - path: /etc/systemd/system/coder-agent.service\n\t//     permissions: \"0644\"\n\t//     content: |\n\t//       [Unit]\n\t//       Description=Coder Agent\n\t//       After=network-online.target\n\t//       Wants=network-online.target\n\n\t//       [Service]\n\t//       User=${username}\n\t//       ExecStart=/opt/coder/init\n\t//       Restart=always\n\t//       RestartSec=10\n\t//       TimeoutStopSec=90\n\t//       KillMode=process\n\n\t//       OOMScoreAdjust=-900\n\t//       SyslogIdentifier=coder-agent\n\n\t//       [Install]\n\t//       WantedBy=multi-user.target\n\t// runcmd:\n\t//   - chown ${username}:${username} /home/${username}\n\t//   - systemctl enable coder-agent\n\t//   - systemctl start coder-agent\n    content = templatefile(\"${path.module}/cloud-init/cloud-config.yaml.tftpl\", {\n      username    = \"coder\" # Ensure this user/group does not exist in your VM image\n      init_script = base64encode(coder_agent.main.init_script)\n      hostname    = lower(data.coder_workspace.me.name)\n    })\n  }\n}\n\nresource \"azurerm_linux_virtual_machine\" \"main\" {\n  count               = data.coder_workspace.me.start_count\n  name                = \"vm\"\n  resource_group_name = azurerm_resource_group.main.name\n  location            = azurerm_resource_group.main.location\n  size                = data.coder_parameter.instance_type.value\n  // cloud-init overwrites this, so the value here doesn't matter\n  admin_username = \"adminuser\"\n  admin_ssh_key {\n    public_key = tls_private_key.dummy.public_key_openssh\n    username   = \"adminuser\"\n  }\n\n  network_interface_ids = [\n    azurerm_network_interface.main.id,\n  ]\n  computer_name = lower(data.coder_workspace.me.name)\n  os_disk {\n    caching              = \"ReadWrite\"\n    storage_account_type = \"Standard_LRS\"\n  }\n  source_image_reference {\n    publisher = \"Canonical\"\n    offer     = \"0001-com-ubuntu-server-focal\"\n    sku       = \"20_04-lts-gen2\"\n    version   = \"latest\"\n  }\n  user_data = data.cloudinit_config.user_data.rendered\n}\n</azure-vm-instance>\n\n<docker-container>\nterraform {\n  required_providers {\n    coder = {\n      source = \"kreuzwerker/docker\"\n    }\n  }\n}\n\n// The agent is configured with \"token\" auth.\n\nresource \"docker_container\" \"workspace\" {\n  count = data.coder_workspace.me.start_count\n  image = \"codercom/enterprise-base:ubuntu\"\n  # Uses lower() to avoid Docker restriction on container names.\n  name = \"coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}\"\n  # Hostname makes the shell more user friendly: coder@my-workspace:~$\n  hostname = data.coder_workspace.me.name\n  # Use the docker gateway if the access URL is 127.0.0.1.\n  entrypoint = [\"sh\", \"-c\", replace(coder_agent.main.init_script, \"/localhost|127\\\\.0\\\\.0\\\\.1/\", \"host.docker.internal\")]\n  env        = [\"CODER_AGENT_TOKEN=${coder_agent.main.token}\"]\n  host {\n    host = \"host.docker.internal\"\n    ip   = \"host-gateway\"\n  }\n  volumes {\n    container_path = \"/home/coder\"\n    volume_name    = docker_volume.home_volume.name\n    read_only      = false\n  }\n}\n</docker-container>\n\n<kubernetes-pod>\n// The agent is configured with \"token\" auth.\n\nresource \"kubernetes_deployment\" \"main\" {\n  count = data.coder_workspace.me.start_count\n  depends_on = [\n    kubernetes_persistent_volume_claim.home\n  ]\n  wait_for_rollout = false\n  metadata {\n    name      = \"coder-${data.coder_workspace.me.id}\"\n  }\n\n  spec {\n    replicas = 1\n    strategy {\n      type = \"Recreate\"\n    }\n\n    template {\n      spec {\n        security_context {\n          run_as_user     = 1000\n          fs_group        = 1000\n          run_as_non_root = true\n        }\n\n        container {\n          name              = \"dev\"\n          image             = \"codercom/enterprise-base:ubuntu\"\n          image_pull_policy = \"Always\"\n          command           = [\"sh\", \"-c\", coder_agent.main.init_script]\n          security_context {\n            run_as_user = \"1000\"\n          }\n          env {\n            name  = \"CODER_AGENT_TOKEN\"\n            value = coder_agent.main.token\n          }\n        }\n      }\n    }\n  }\n}\n</kubernetes-pod>\n\nThe file_id provided is a reference to a tar file you have uploaded containing the Terraform.\n","name":"bmcp_coder_coder_create_template_version","parameters":{"properties":{"file_id":{"type":"string"},"template_id":{"type":"string"}},"required":["file_id"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace in Coder.\n\nIf a user is asking to \"test a template\", they are typically referring\nto creating a workspace from a template to ensure the infrastructure\nis provisioned correctly and the agent can connect to the control plane.\n\nBefore creating a workspace, always confirm the template choice with the user by:\n\n\t1. Listing the available templates that match their request.\n\t2. Recommending the most relevant option.\n\t2. Asking the user to confirm which template to use.\n\nIt is important to not create a workspace without confirming the template\nchoice with the user.\n\nAfter creating a workspace, watch the build logs and wait for the workspace to\nbe ready before trying to use or connect to the workspace.\n","name":"bmcp_coder_coder_create_workspace","parameters":{"properties":{"name":{"description":"Name of the workspace to create.","type":"string"},"rich_parameters":{"description":"Key/value pairs of rich parameters to pass to the template version to create the workspace.","type":"object"},"template_version_id":{"description":"ID of the template version to create the workspace from.","type":"string"},"user":{"description":"Username or ID of the user for which to create a workspace. Omit or use the `me` keyword to create a workspace for the authenticated user.","type":"string"}},"required":["user","template_version_id","name","rich_parameters"],"type":"object"},"strict":false},{"type":"function","description":"Create a new workspace build for an existing workspace. Use this to start, stop, or delete.\n\nAfter creating a workspace build, watch the build logs and wait for the\nworkspace build to complete before trying to start another build or use or\nconnect to the workspace.\n","name":"bmcp_coder_coder_create_workspace_build","parameters":{"properties":{"template_version_id":{"description":"(Optional) The template version ID to use for the workspace build. If not provided, the previously built version will be used.","type":"string"},"transition":{"description":"The transition to perform. Must be one of: start, stop, delete","enum":["start","stop","delete"],"type":"string"},"workspace_id":{"type":"string"}},"required":["workspace_id","transition"],"type":"object"},"strict":false},{"type":"function","description":"Delete a task.","name":"bmcp_coder_coder_delete_task","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to delete. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Delete a template. This is irreversible.","name":"bmcp_coder_coder_delete_template","parameters":{"properties":{"template_id":{"type":"string"}},"required":["template_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the currently authenticated user, similar to the `whoami` command.","name":"bmcp_coder_coder_get_authenticated_user","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a task.","name":"bmcp_coder_coder_get_task_logs","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to query. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the status of a task.","name":"bmcp_coder_coder_get_task_status","parameters":{"properties":{"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to get. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a template version. This is useful to check whether a template version successfully imports or not.","name":"bmcp_coder_coder_get_template_version_logs","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Get a workspace by name or ID.\n\nThis returns more data than list_workspaces to reduce token usage.","name":"bmcp_coder_coder_get_workspace","parameters":{"properties":{"workspace_id":{"description":"The workspace ID or name in the format [owner/]workspace. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace agent.\n\n\t\tMore logs may appear after this call. It does not wait for the agent to finish.","name":"bmcp_coder_coder_get_workspace_agent_logs","parameters":{"properties":{"workspace_agent_id":{"type":"string"}},"required":["workspace_agent_id"],"type":"object"},"strict":false},{"type":"function","description":"Get the logs of a workspace build.\n\n\t\tUseful for checking whether a workspace builds successfully or not.","name":"bmcp_coder_coder_get_workspace_build_logs","parameters":{"properties":{"workspace_build_id":{"type":"string"}},"required":["workspace_build_id"],"type":"object"},"strict":false},{"type":"function","description":"List tasks.","name":"bmcp_coder_coder_list_tasks","parameters":{"properties":{"status":{"description":"Optional filter by task status.","type":"string"},"user":{"description":"Username or ID of the user for which to list tasks. Omit or use the `me` keyword to list tasks for the authenticated user.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Lists templates for the authenticated user.","name":"bmcp_coder_coder_list_templates","parameters":{"properties":{},"type":"object"},"strict":false},{"type":"function","description":"Lists workspaces for the authenticated user.","name":"bmcp_coder_coder_list_workspaces","parameters":{"properties":{"owner":{"description":"The owner of the workspaces to list. Use \"me\" to list workspaces for the authenticated user. If you do not specify an owner, \"me\" will be assumed by default.","type":"string"}},"type":"object"},"strict":false},{"type":"function","description":"Send input to a running task.","name":"bmcp_coder_coder_send_task_input","parameters":{"properties":{"input":{"description":"The input to send to the task.","type":"string"},"task_id":{"description":"ID or workspace identifier in the format [owner/]workspace[.agent] for the task to prompt. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["task_id","input"],"type":"object"},"strict":false},{"type":"function","description":"Get the parameters for a template version. You can refer to these as workspace parameters to the user, as they are typically important for creating a workspace.","name":"bmcp_coder_coder_template_version_parameters","parameters":{"properties":{"template_version_id":{"type":"string"}},"required":["template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Update the active version of a template. This is helpful when iterating on templates.","name":"bmcp_coder_coder_update_template_active_version","parameters":{"properties":{"template_id":{"type":"string"},"template_version_id":{"type":"string"}},"required":["template_id","template_version_id"],"type":"object"},"strict":false},{"type":"function","description":"Create and upload a tar file by key/value mapping of file names to file contents. Use this to create template versions. Reference the tool description of \"create_template_version\" to understand template requirements.","name":"bmcp_coder_coder_upload_tar_file","parameters":{"properties":{"files":{"description":"A map of file names to file contents.","type":"object"}},"required":["files"],"type":"object"},"strict":false},{"type":"function","description":"Execute a bash command in a Coder workspace.\n\nThis tool provides the same functionality as the 'coder ssh <workspace> <command>' CLI command.\nIt automatically starts the workspace if it's stopped and waits for the agent to be ready.\nThe output is trimmed of leading and trailing whitespace.\n\nThe workspace parameter supports various formats:\n- workspace (uses current user)\n- owner/workspace\n- owner--workspace\n- workspace.agent (specific agent)\n- owner/workspace.agent\n\nThe timeout_ms parameter specifies the command timeout in milliseconds (defaults to 60000ms, maximum of 300000ms).\nIf the command times out, all output captured up to that point is returned with a cancellation message.\n\nFor background commands (background: true), output is captured until the timeout is reached, then the command\ncontinues running in the background. The captured output is returned as the result.\n\nFor file operations (list, write, edit), always prefer the dedicated file tools.\nDo not use bash commands (ls, cat, echo, heredoc, etc.) to list, write, or read\nfiles when the file tools are available. The bash tool should be used for:\n\n\t- Running commands and scripts\n\t- Installing packages\n\t- Starting services\n\t- Executing programs\n\nExamples:\n- workspace: \"john/dev-env\", command: \"git status\", timeout_ms: 30000\n- workspace: \"my-workspace\", command: \"npm run dev\", background: true, timeout_ms: 10000\n- workspace: \"my-workspace.main\", command: \"docker ps\"","name":"bmcp_coder_coder_workspace_bash","parameters":{"properties":{"background":{"description":"Whether to run the command in the background. Output is captured until timeout, then the command continues running in the background.","type":"boolean"},"command":{"description":"The bash command to execute in the workspace.","type":"string"},"timeout_ms":{"default":60000,"description":"Command timeout in milliseconds. Defaults to 60000ms (60 seconds) if not specified.","minimum":1,"type":"integer"},"workspace":{"description":"The workspace name in format [owner/]workspace[.agent]. If owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","command"],"type":"object"},"strict":false},{"type":"function","description":"Edit a file in a workspace.","name":"bmcp_coder_coder_workspace_edit_file","parameters":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","edits"],"type":"object"},"strict":false},{"type":"function","description":"Edit one or more files in a workspace.","name":"bmcp_coder_coder_workspace_edit_files","parameters":{"properties":{"files":{"description":"An array of files to edit.","items":{"properties":{"edits":{"description":"An array of edit operations.","items":{"properties":{"replace":{"description":"The new string that replaces the old string.","type":"string"},"search":{"description":"The old string to replace.","type":"string"}},"required":["search","replace"],"type":"object"},"type":"array"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"}},"required":["path","edits"],"type":"object"},"type":"array"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","files"],"type":"object"},"strict":false},{"type":"function","description":"List the URLs of Coder apps running in a workspace for a single agent.","name":"bmcp_coder_coder_workspace_list_apps","parameters":{"properties":{"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace"],"type":"object"},"strict":false},{"type":"function","description":"List directories in a workspace.","name":"bmcp_coder_coder_workspace_ls","parameters":{"properties":{"path":{"description":"The absolute path of the directory in the workspace to list.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Fetch URLs that forward to the specified port.","name":"bmcp_coder_coder_workspace_port_forward","parameters":{"properties":{"port":{"description":"The port to forward.","type":"number"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["workspace","port"],"type":"object"},"strict":false},{"type":"function","description":"Read from a file in a workspace.","name":"bmcp_coder_coder_workspace_read_file","parameters":{"properties":{"limit":{"description":"The number of bytes to read. Cannot exceed 1 MiB. Defaults to the full size of the file or 1 MiB, whichever is lower.","type":"integer"},"offset":{"description":"A byte offset indicating where in the file to start reading. Defaults to zero. An empty string indicates the end of the file has been reached.","type":"integer"},"path":{"description":"The absolute path of the file to read in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace"],"type":"object"},"strict":false},{"type":"function","description":"Write a file in a workspace.\n\nIf a file write fails due to syntax errors or encoding issues, do NOT switch\nto using bash commands as a workaround. Instead:\n\n\t1. Read the error message carefully to identify the issue\n\t2. Fix the content encoding/syntax\n\t3. Retry with this tool\n\nThe content parameter expects base64-encoded bytes. Ensure your source content\nis correct before encoding it. If you encounter errors, decode and verify the\ncontent you are trying to write, then re-encode it properly.\n","name":"bmcp_coder_coder_workspace_write_file","parameters":{"properties":{"content":{"description":"The base64-encoded bytes to write to the file.","type":"string"},"path":{"description":"The absolute path of the file to write in the workspace.","type":"string"},"workspace":{"description":"The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used.","type":"string"}},"required":["path","workspace","content"],"type":"object"},"strict":false}],"top_logprobs":0,"top_p":1.0,"truncation":"disabled","usage":{"input_tokens":6346,"input_tokens_details":{"cached_tokens":100,"cache_write_tokens":9},"output_tokens":56,"output_tokens_details":{"reasoning_tokens":5},"total_tokens":6402},"user":null,"metadata":{}},"sequence_number":61}
 
diff --git a/aibridge/intercept/chatcompletions/base.go b/aibridge/intercept/chatcompletions/base.go
index 4e6db3abe601e..415b4d46bc327 100644
--- a/aibridge/intercept/chatcompletions/base.go
+++ b/aibridge/intercept/chatcompletions/base.go
@@ -227,14 +227,15 @@ func (i *interceptionBase) hasInjectableTools() bool {
 }
 
 // recordTokenUsage records the token usage for a single completion, accounting
-// for cached tokens included in the prompt token count.
+// for cache read and write tokens included in the prompt token count.
 func (i *interceptionBase) recordTokenUsage(ctx context.Context, msgID string, usage openai.CompletionUsage) {
 	_ = i.recorder.RecordTokenUsage(ctx, &recorder.TokenUsageRecord{
-		InterceptionID:       i.ID().String(),
-		MsgID:                msgID,
-		Input:                calculateActualInputTokenUsage(usage),
-		Output:               usage.CompletionTokens,
-		CacheReadInputTokens: usage.PromptTokensDetails.CachedTokens,
+		InterceptionID:        i.ID().String(),
+		MsgID:                 msgID,
+		Input:                 calculateActualInputTokenUsage(usage),
+		Output:                usage.CompletionTokens,
+		CacheReadInputTokens:  usage.PromptTokensDetails.CachedTokens,
+		CacheWriteInputTokens: usage.PromptTokensDetails.CacheWriteTokens,
 		ExtraTokenTypes: map[string]int64{
 			"prompt_audio":                   usage.PromptTokensDetails.AudioTokens,
 			"completion_accepted_prediction": usage.CompletionTokensDetails.AcceptedPredictionTokens,
@@ -245,7 +246,7 @@ func (i *interceptionBase) recordTokenUsage(ctx context.Context, msgID string, u
 	})
 }
 
-func sumUsage(ref, in openai.CompletionUsage) openai.CompletionUsage {
+func sumUsage(ref openai.CompletionUsage, in openai.CompletionUsage) openai.CompletionUsage {
 	return openai.CompletionUsage{
 		CompletionTokens: ref.CompletionTokens + in.CompletionTokens,
 		PromptTokens:     ref.PromptTokens + in.PromptTokens,
@@ -257,17 +258,18 @@ func sumUsage(ref, in openai.CompletionUsage) openai.CompletionUsage {
 			RejectedPredictionTokens: ref.CompletionTokensDetails.RejectedPredictionTokens + in.CompletionTokensDetails.RejectedPredictionTokens,
 		},
 		PromptTokensDetails: openai.CompletionUsagePromptTokensDetails{
-			AudioTokens:  ref.PromptTokensDetails.AudioTokens + in.PromptTokensDetails.AudioTokens,
-			CachedTokens: ref.PromptTokensDetails.CachedTokens + in.PromptTokensDetails.CachedTokens,
+			AudioTokens:      ref.PromptTokensDetails.AudioTokens + in.PromptTokensDetails.AudioTokens,
+			CachedTokens:     ref.PromptTokensDetails.CachedTokens + in.PromptTokensDetails.CachedTokens,
+			CacheWriteTokens: ref.PromptTokensDetails.CacheWriteTokens + in.PromptTokensDetails.CacheWriteTokens,
 		},
 	}
 }
 
-// calculateActualInputTokenUsage accounts for cached tokens which are included in [openai.CompletionUsage].PromptTokens.
+// calculateActualInputTokenUsage calculates ordinary input tokens.
+// in.PromptTokens contains sum of all prompt tokens including
+// cache read and write tokens which are priced differently.
 func calculateActualInputTokenUsage(in openai.CompletionUsage) int64 {
-	// Input *includes* the cached tokens, so we subtract them here to reflect actual input token usage.
-	// The original value can be reconstructed by adding CachedTokens back to Input.
-	// See https://platform.openai.com/docs/api-reference/usage/completions_object#usage/completions_object-input_tokens.
-	return max(0, in.PromptTokens /* The aggregated number of text input tokens used, including cached tokens. */ -
-		in.PromptTokensDetails.CachedTokens /* The aggregated number of text input tokens that has been cached from previous requests. */)
+	return max(0, in.PromptTokens-
+		in.PromptTokensDetails.CachedTokens-
+		in.PromptTokensDetails.CacheWriteTokens)
 }
diff --git a/aibridge/intercept/chatcompletions/base_internal_test.go b/aibridge/intercept/chatcompletions/base_internal_test.go
index 8d9151fce6e23..2eab3b0b45cda 100644
--- a/aibridge/intercept/chatcompletions/base_internal_test.go
+++ b/aibridge/intercept/chatcompletions/base_internal_test.go
@@ -42,8 +42,9 @@ func TestRecordTokenUsage(t *testing.T) {
 				CompletionTokens: 50,
 				TotalTokens:      150,
 				PromptTokensDetails: openai.CompletionUsagePromptTokensDetails{
-					CachedTokens: 40,
-					AudioTokens:  3,
+					CachedTokens:     40,
+					CacheWriteTokens: 25,
+					AudioTokens:      3,
 				},
 				CompletionTokensDetails: openai.CompletionUsageCompletionTokensDetails{
 					AcceptedPredictionTokens: 7,
@@ -53,11 +54,12 @@ func TestRecordTokenUsage(t *testing.T) {
 				},
 			},
 			expected: &recorder.TokenUsageRecord{
-				InterceptionID:       id.String(),
-				MsgID:                "cmpl_full",
-				Input:                60, // 100 prompt - 40 cached
-				Output:               50,
-				CacheReadInputTokens: 40,
+				InterceptionID:        id.String(),
+				MsgID:                 "cmpl_full",
+				Input:                 35, // 100 prompt - 40 cache read - 25 cache write
+				Output:                50,
+				CacheReadInputTokens:  40,
+				CacheWriteInputTokens: 25,
 				ExtraTokenTypes: map[string]int64{
 					"prompt_audio":                   3,
 					"completion_accepted_prediction": 7,
@@ -97,20 +99,22 @@ func TestRecordTokenUsage(t *testing.T) {
 			// CachedTokens. Input must clamp to 0 so it never panics a
 			// Prometheus counter when used as an increment.
 			name:  "cached_tokens_exceed_prompt_tokens_clamps_to_zero",
-			msgID: "cmpl_clamp",
+			msgID: "cmpl_cached_exceed",
 			usage: openai.CompletionUsage{
 				PromptTokens:     40,
 				CompletionTokens: 20,
 				PromptTokensDetails: openai.CompletionUsagePromptTokensDetails{
-					CachedTokens: 100,
+					CachedTokens:     30,
+					CacheWriteTokens: 30,
 				},
 			},
 			expected: &recorder.TokenUsageRecord{
-				InterceptionID:       id.String(),
-				MsgID:                "cmpl_clamp",
-				Input:                0, // max(0, 40 prompt - 100 cached)
-				Output:               20,
-				CacheReadInputTokens: 100,
+				InterceptionID:        id.String(),
+				MsgID:                 "cmpl_cached_exceed",
+				Input:                 0, // max(0, 40 prompt - 60 cached)
+				Output:                20,
+				CacheReadInputTokens:  30,
+				CacheWriteInputTokens: 30,
 				ExtraTokenTypes: map[string]int64{
 					"prompt_audio":                   0,
 					"completion_accepted_prediction": 0,
@@ -145,6 +149,60 @@ func TestRecordTokenUsage(t *testing.T) {
 	}
 }
 
+func TestSumUsage(t *testing.T) {
+	t.Parallel()
+
+	first := openai.CompletionUsage{
+		PromptTokens:     100,
+		CompletionTokens: 50,
+		TotalTokens:      150,
+		PromptTokensDetails: openai.CompletionUsagePromptTokensDetails{
+			CachedTokens:     10,
+			CacheWriteTokens: 20,
+			AudioTokens:      30,
+		},
+		CompletionTokensDetails: openai.CompletionUsageCompletionTokensDetails{
+			AcceptedPredictionTokens: 40,
+			RejectedPredictionTokens: 50,
+			AudioTokens:              60,
+			ReasoningTokens:          70,
+		},
+	}
+	second := openai.CompletionUsage{
+		PromptTokens:     200,
+		CompletionTokens: 100,
+		TotalTokens:      300,
+		PromptTokensDetails: openai.CompletionUsagePromptTokensDetails{
+			CachedTokens:     1,
+			CacheWriteTokens: 2,
+			AudioTokens:      3,
+		},
+		CompletionTokensDetails: openai.CompletionUsageCompletionTokensDetails{
+			AcceptedPredictionTokens: 4,
+			RejectedPredictionTokens: 5,
+			AudioTokens:              6,
+			ReasoningTokens:          7,
+		},
+	}
+
+	require.Equal(t, openai.CompletionUsage{
+		PromptTokens:     300,
+		CompletionTokens: 150,
+		TotalTokens:      450,
+		PromptTokensDetails: openai.CompletionUsagePromptTokensDetails{
+			CachedTokens:     11,
+			CacheWriteTokens: 22,
+			AudioTokens:      33,
+		},
+		CompletionTokensDetails: openai.CompletionUsageCompletionTokensDetails{
+			AcceptedPredictionTokens: 44,
+			RejectedPredictionTokens: 55,
+			AudioTokens:              66,
+			ReasoningTokens:          77,
+		},
+	}, sumUsage(first, second))
+}
+
 func TestScanForCorrelatingToolCallID(t *testing.T) {
 	t.Parallel()
 
diff --git a/aibridge/intercept/chatcompletions/streaming.go b/aibridge/intercept/chatcompletions/streaming.go
index ccbe1d96ab734..44003e36d17c1 100644
--- a/aibridge/intercept/chatcompletions/streaming.go
+++ b/aibridge/intercept/chatcompletions/streaming.go
@@ -121,6 +121,10 @@ func (i *StreamingInterception) ProcessRequest(w http.ResponseWriter, r *http.Re
 		stream          *ssestream.Stream[openai.ChatCompletionChunk]
 		lastErr         error
 		interceptionErr error
+
+		// Cumulative token usage across all previous iterations.
+		// Added to the usage of chunk before relaying to the client.
+		cumulativeUsage openai.CompletionUsage
 	)
 
 	// Sum the key attempts across all iterations and record once when the
@@ -224,7 +228,7 @@ func (i *StreamingInterception) ProcessRequest(w http.ResponseWriter, r *http.Re
 			}
 
 			// Marshal and relay chunk to client.
-			payload, err := i.marshalChunk(&chunk, i.ID(), processor)
+			payload, err := i.marshalChunk(&chunk, i.ID(), processor, cumulativeUsage)
 			if err != nil {
 				logger.Warn(ctx, "failed to marshal chunk", slog.Error(err), slog.F("chunk", chunk.RawJSON()))
 				lastErr = xerrors.Errorf("marshal chunk: %w", err)
@@ -270,10 +274,10 @@ func (i *StreamingInterception) ProcessRequest(w http.ResponseWriter, r *http.Re
 			prompt = nil
 		}
 
-		if lastUsage := processor.getLastUsage(); lastUsage.CompletionTokens > 0 {
-			// If the usage information is set, track it.
-			// The API will send usage information when the response terminates, which will happen if a tool call is invoked.
+		if processor.hasUsage {
+			lastUsage := processor.lastUsage
 			i.recordTokenUsage(streamCtx, processor.getMsgID(), lastUsage)
+			cumulativeUsage = sumUsage(cumulativeUsage, lastUsage)
 		}
 
 		if iterationStarted {
@@ -412,24 +416,19 @@ func (i *StreamingInterception) getInjectedToolByName(name string) *mcp.Tool {
 	return i.mcpProxy.GetTool(name)
 }
 
-// Mashals received stream chunk.
-// Overrides id (since proxy obscures injected tool call invocations).
-// If usage field was set in original chunk overrides it to culminative usage.
-//
 // sjson is used instead of normal struct marshaling so forwarded data
 // is as close to the original as possible. Structs from openai library lack
 // `omitzero/omitempty` annotations which adds additional empty fields
 // when marshaling structs. Those additional empty fields can break Codex client.
-func (i *StreamingInterception) marshalChunk(chunk *openai.ChatCompletionChunk, id uuid.UUID, prc *streamProcessor) ([]byte, error) {
+func (i *StreamingInterception) marshalChunk(chunk *openai.ChatCompletionChunk, id uuid.UUID, prc *streamProcessor, previousUsage openai.CompletionUsage) ([]byte, error) {
+	// Normalize the response ID because injected tool calls span multiple upstream invocations.
 	sj, err := sjson.Set(chunk.RawJSON(), "id", id.String())
 	if err != nil {
 		return nil, xerrors.Errorf("marshal chunk id failed: %w", err)
 	}
 
-	// If usage information is available, relay the cumulative usage once all tool invocations have completed.
 	if chunk.JSON.Usage.Valid() {
-		u := prc.getCumulativeUsage()
-		sj, err = sjson.Set(sj, "usage", u)
+		sj, err = sjson.Set(sj, "usage", sumUsage(previousUsage, prc.lastUsage))
 		if err != nil {
 			return nil, xerrors.Errorf("marshal chunk usage failed: %w", err)
 		}
@@ -503,9 +502,8 @@ type streamProcessor struct {
 	pendingToolCall     bool
 	getInjectedToolFunc func(string) *mcp.Tool
 
-	// Token handling.
-	lastUsage       openai.CompletionUsage
-	cumulativeUsage openai.CompletionUsage
+	lastUsage openai.CompletionUsage
+	hasUsage  bool
 }
 
 func newStreamProcessor(ctx context.Context, logger slog.Logger, isToolInjectedFunc func(string) *mcp.Tool) *streamProcessor {
@@ -525,9 +523,12 @@ func (s *streamProcessor) process(chunk openai.ChatCompletionChunk) bool {
 		// Potentially not fatal, move along in best effort...
 	}
 
-	// Accumulate token usage.
-	s.lastUsage = chunk.Usage
-	s.cumulativeUsage = sumUsage(s.cumulativeUsage, chunk.Usage)
+	// Some providers emit cumulative usage snapshots on every chunk, so the
+	// latest valid usage is authoritative. Never sum across chunks.
+	if chunk.JSON.Usage.Valid() {
+		s.lastUsage = chunk.Usage
+		s.hasUsage = true
+	}
 
 	// If the stream has reached a terminal state (i.e. call a tool), and this tool is injected,
 	// then it must not be relayed.
@@ -616,14 +617,6 @@ func (s *streamProcessor) getLastCompletion() *openai.ChatCompletionMessage {
 	return &s.acc.Choices[0].Message
 }
 
-func (s *streamProcessor) getLastUsage() openai.CompletionUsage {
-	return s.lastUsage
-}
-
-func (s *streamProcessor) getCumulativeUsage() openai.CompletionUsage {
-	return s.cumulativeUsage
-}
-
 // compactToolCalls removes nil/empty tool call entries (without an ID).
 func compactToolCalls(msg *openai.ChatCompletionMessage) {
 	if msg == nil || len(msg.ToolCalls) == 0 {
diff --git a/aibridge/intercept/chatcompletions/streaming_internal_test.go b/aibridge/intercept/chatcompletions/streaming_internal_test.go
index 1f6e419555016..b6f36173af112 100644
--- a/aibridge/intercept/chatcompletions/streaming_internal_test.go
+++ b/aibridge/intercept/chatcompletions/streaming_internal_test.go
@@ -1,6 +1,8 @@
 package chatcompletions
 
 import (
+	"bytes"
+	"encoding/json"
 	"net/http"
 	"net/http/httptest"
 	"testing"
@@ -15,8 +17,137 @@ import (
 	"cdr.dev/slog/v3/sloggers/slogtest"
 	"github.com/coder/coder/v2/aibridge/intercept"
 	"github.com/coder/coder/v2/aibridge/internal/testutil"
+	"github.com/coder/coder/v2/aibridge/recorder"
 )
 
+func TestStreamProcessorUsage(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name                 string
+		chunks               []string
+		wantPromptTokens     int64
+		wantCompletionTokens int64
+		wantTotalTokens      int64
+	}{
+		{
+			name: "cumulative snapshots with trailing usage-less chunk",
+			chunks: []string{
+				`{"id":"chatcmpl-cumulative","choices":[{"index":0,"delta":{"content":"one"}}],"usage":{"prompt_tokens":6000,"completion_tokens":10,"total_tokens":6010}}`,
+				`{"id":"chatcmpl-cumulative","choices":[{"index":0,"delta":{"content":" two"}}],"usage":{"prompt_tokens":6000,"completion_tokens":20,"total_tokens":6020}}`,
+				`{"id":"chatcmpl-cumulative","choices":[{"index":0,"delta":{},"finish_reason":"stop"}],"usage":{"prompt_tokens":6000,"completion_tokens":30,"total_tokens":6030}}`,
+				`{"id":"chatcmpl-cumulative","choices":[]}`,
+			},
+			wantPromptTokens:     6000,
+			wantCompletionTokens: 30,
+			wantTotalTokens:      6030,
+		},
+		{
+			name: "usage only on final chunk",
+			chunks: []string{
+				`{"id":"chatcmpl-final","choices":[{"index":0,"delta":{"content":"one"}}]}`,
+				`{"id":"chatcmpl-final","choices":[{"index":0,"delta":{"content":" two"}}]}`,
+				`{"id":"chatcmpl-final","choices":[{"index":0,"delta":{},"finish_reason":"stop"}],"usage":{"prompt_tokens":6000,"completion_tokens":30,"total_tokens":6030}}`,
+			},
+			wantPromptTokens:     6000,
+			wantCompletionTokens: 30,
+			wantTotalTokens:      6030,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: false}).Leveled(slog.LevelDebug)
+			interceptor := NewStreamingInterceptor(uuid.New(), nil, intercept.Config{}, nil, nil, otel.Tracer("test"))
+			processor := newStreamProcessor(t.Context(), logger, nil)
+
+			var relayed []byte
+			for _, rawChunk := range tt.chunks {
+				var chunk openai.ChatCompletionChunk
+				require.NoError(t, json.Unmarshal([]byte(rawChunk), &chunk))
+				require.True(t, processor.process(chunk))
+				if chunk.JSON.Usage.Valid() {
+					var err error
+					relayed, err = interceptor.marshalChunk(&chunk, interceptor.ID(), processor, openai.CompletionUsage{})
+					require.NoError(t, err)
+				}
+			}
+
+			var payload struct {
+				Usage openai.CompletionUsage `json:"usage"`
+			}
+			relayed = bytes.TrimSuffix(bytes.TrimPrefix(relayed, []byte("data: ")), []byte("\n\n"))
+			require.NoError(t, json.Unmarshal(relayed, &payload))
+			assert.Equal(t, tt.wantPromptTokens, payload.Usage.PromptTokens)
+			assert.Equal(t, tt.wantCompletionTokens, payload.Usage.CompletionTokens)
+			assert.Equal(t, tt.wantTotalTokens, payload.Usage.TotalTokens)
+
+			usage := processor.lastUsage
+			assert.Equal(t, tt.wantPromptTokens, usage.PromptTokens)
+			assert.Equal(t, tt.wantCompletionTokens, usage.CompletionTokens)
+			assert.Equal(t, tt.wantTotalTokens, usage.TotalTokens)
+		})
+	}
+}
+
+func TestStreamingInterceptionRecordsLatestUsageWithZeroCompletionTokens(t *testing.T) {
+	t.Parallel()
+
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "text/event-stream")
+		_, _ = w.Write([]byte("data: {\"id\":\"chatcmpl-zero-completion\",\"object\":\"chat.completion.chunk\",\"choices\":[{\"index\":0,\"delta\":{\"content\":\"one\"}}],\"usage\":{\"prompt_tokens\":40,\"completion_tokens\":0,\"total_tokens\":40,\"prompt_tokens_details\":{\"cached_tokens\":5,\"cache_write_tokens\":3}}}\n\n"))
+		_, _ = w.Write([]byte("data: {\"id\":\"chatcmpl-zero-completion\",\"object\":\"chat.completion.chunk\",\"choices\":[{\"index\":0,\"delta\":{},\"finish_reason\":\"stop\"}],\"usage\":{\"prompt_tokens\":50,\"completion_tokens\":0,\"total_tokens\":50,\"prompt_tokens_details\":{\"cached_tokens\":10,\"cache_write_tokens\":5}}}\n\n"))
+		_, _ = w.Write([]byte("data: [DONE]\n\n"))
+	}))
+	t.Cleanup(upstream.Close)
+
+	req := &ChatCompletionNewParamsWrapper{
+		ChatCompletionNewParams: openai.ChatCompletionNewParams{
+			Model: "gpt-4",
+			Messages: []openai.ChatCompletionMessageParamUnion{
+				openai.UserMessage("hello"),
+			},
+		},
+		Stream: true,
+	}
+	httpReq := httptest.NewRequest(http.MethodPost, "/chat/completions", nil)
+	interceptor := NewStreamingInterceptor(
+		uuid.New(),
+		req,
+		intercept.Config{BaseURL: upstream.URL},
+		intercept.BYOK{Secret: "test-key", Header: intercept.AuthHeaderAuthorization},
+		httpReq.Header,
+		otel.Tracer("test"),
+	)
+	logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: false}).Leveled(slog.LevelDebug)
+	rec := &testutil.MockRecorder{}
+	interceptor.Setup(logger, rec, nil)
+
+	w := httptest.NewRecorder()
+	require.NoError(t, interceptor.ProcessRequest(w, httpReq))
+
+	usages := rec.RecordedTokenUsages()
+	require.Len(t, usages, 1)
+	require.Equal(t, &recorder.TokenUsageRecord{
+		InterceptionID:        interceptor.ID().String(),
+		MsgID:                 "chatcmpl-zero-completion",
+		Input:                 35,
+		Output:                0,
+		CacheReadInputTokens:  10,
+		CacheWriteInputTokens: 5,
+		CreatedAt:             usages[0].CreatedAt,
+		ExtraTokenTypes: map[string]int64{
+			"prompt_audio":                   0,
+			"completion_accepted_prediction": 0,
+			"completion_rejected_prediction": 0,
+			"completion_audio":               0,
+			"completion_reasoning":           0,
+		},
+	}, usages[0])
+}
+
 // Test that when the upstream provider returns an error before streaming starts,
 // the error status code and body are correctly relayed to the client.
 func TestStreamingInterception_RelaysUpstreamErrorToClient(t *testing.T) {
diff --git a/aibridge/intercept/responses/base.go b/aibridge/intercept/responses/base.go
index 6513636fedb89..ec6e128cf0b6d 100644
--- a/aibridge/intercept/responses/base.go
+++ b/aibridge/intercept/responses/base.go
@@ -57,6 +57,21 @@ type responsesInterceptionBase struct {
 	mcpProxy mcp.ServerProxier
 }
 
+func sumUsage(ref responses.ResponseUsage, in responses.ResponseUsage) responses.ResponseUsage {
+	return responses.ResponseUsage{
+		InputTokens:  ref.InputTokens + in.InputTokens,
+		OutputTokens: ref.OutputTokens + in.OutputTokens,
+		TotalTokens:  ref.TotalTokens + in.TotalTokens,
+		InputTokensDetails: responses.ResponseUsageInputTokensDetails{
+			CachedTokens:     ref.InputTokensDetails.CachedTokens + in.InputTokensDetails.CachedTokens,
+			CacheWriteTokens: ref.InputTokensDetails.CacheWriteTokens + in.InputTokensDetails.CacheWriteTokens,
+		},
+		OutputTokensDetails: responses.ResponseUsageOutputTokensDetails{
+			ReasoningTokens: ref.OutputTokensDetails.ReasoningTokens + in.OutputTokensDetails.ReasoningTokens,
+		},
+	}
+}
+
 // newResponsesService builds the SDK service used for upstream calls.
 func (i *responsesInterceptionBase) newResponsesService(ctx context.Context) responses.ResponseService {
 	var opts []option.RequestOption
@@ -264,7 +279,9 @@ func (i *responsesInterceptionBase) recordNonInjectedToolUsage(ctx context.Conte
 		// have no uniform argument representation.
 		switch item.Type {
 		case string(constant.ValueOf[constant.FunctionCall]()):
-			args = i.parseFunctionCallJSONArgs(ctx, item.Arguments)
+			// Arguments is a union since openai-go v3.50; function_call
+			// arguments are always the JSON string variant.
+			args = i.parseFunctionCallJSONArgs(ctx, item.Arguments.OfString)
 		case string(constant.ValueOf[constant.CustomToolCall]()):
 			args = item.Input
 		case string(constant.ValueOf[constant.WebSearchCall]()),
@@ -325,16 +342,19 @@ func (i *responsesInterceptionBase) recordTokenUsage(ctx context.Context, respon
 
 	usage := response.Usage
 
-	// Keeping logic consistent with chat completions
-	// Input *includes* the cached tokens, so we subtract them here to reflect actual input token usage.
-	inputNonCacheTokens := max(0, usage.InputTokens-usage.InputTokensDetails.CachedTokens)
+	// InputTokens include cache read and write tokens, see OpenAI spending controller cookbook for reference:
+	// https://github.com/openai/openai-cookbook/blob/51c769595490f7513d4bd7c6e7700a7ab8dedbd4/articles/per_run_spending_controller_responses_api.md?plain=1#L197
+	inputNonCacheTokens := max(0, usage.InputTokens-
+		usage.InputTokensDetails.CachedTokens-
+		usage.InputTokensDetails.CacheWriteTokens)
 
 	if err := i.recorder.RecordTokenUsage(ctx, &recorder.TokenUsageRecord{
-		InterceptionID:       i.ID().String(),
-		MsgID:                response.ID,
-		Input:                inputNonCacheTokens,
-		Output:               usage.OutputTokens,
-		CacheReadInputTokens: usage.InputTokensDetails.CachedTokens,
+		InterceptionID:        i.ID().String(),
+		MsgID:                 response.ID,
+		Input:                 inputNonCacheTokens,
+		Output:                usage.OutputTokens,
+		CacheReadInputTokens:  usage.InputTokensDetails.CachedTokens,
+		CacheWriteInputTokens: usage.InputTokensDetails.CacheWriteTokens,
 		ExtraTokenTypes: map[string]int64{
 			"output_reasoning": usage.OutputTokensDetails.ReasoningTokens,
 			"total_tokens":     usage.TotalTokens,
@@ -446,6 +466,14 @@ func (r *responseCopier) readAll() ([]byte, error) {
 
 // forwardResp writes whole response as received to ResponseWriter
 func (r *responseCopier) forwardResp(w http.ResponseWriter) error {
+	b, err := r.readAll()
+	if err != nil {
+		return xerrors.Errorf("failed to read response body: %w", err)
+	}
+	return r.forwardBytes(w, b)
+}
+
+func (r *responseCopier) forwardBytes(w http.ResponseWriter, b []byte) error {
 	// no response was received, nothing to forward
 	if !r.responseReceived.Load() {
 		return nil
@@ -459,11 +487,6 @@ func (r *responseCopier) forwardResp(w http.ResponseWriter) error {
 	}
 	w.WriteHeader(r.responseStatus)
 
-	b, err := r.readAll()
-	if err != nil {
-		return xerrors.Errorf("failed to read response body: %w", err)
-	}
-
 	if _, err := w.Write(b); err != nil {
 		return xerrors.Errorf("failed to write response body: %w", err)
 	}
diff --git a/aibridge/intercept/responses/base_internal_test.go b/aibridge/intercept/responses/base_internal_test.go
index 60253bc0d1a46..dcc8e107e912f 100644
--- a/aibridge/intercept/responses/base_internal_test.go
+++ b/aibridge/intercept/responses/base_internal_test.go
@@ -114,7 +114,7 @@ func TestRecordToolUsage(t *testing.T) {
 						Type:      "function_call",
 						CallID:    "call_abc",
 						Name:      "get_weather",
-						Arguments: "",
+						Arguments: oairesponses.ResponseOutputItemUnionArguments{OfString: ""},
 					},
 				},
 			},
@@ -138,13 +138,13 @@ func TestRecordToolUsage(t *testing.T) {
 						Type:      "function_call",
 						CallID:    "call_1",
 						Name:      "get_weather",
-						Arguments: `{"location": "NYC"}`,
+						Arguments: oairesponses.ResponseOutputItemUnionArguments{OfString: `{"location": "NYC"}`},
 					},
 					{
 						Type:      "function_call",
 						CallID:    "call_2",
 						Name:      "bad_json_args",
-						Arguments: `{"bad": args`,
+						Arguments: oairesponses.ResponseOutputItemUnionArguments{OfString: `{"bad": args`},
 					},
 					{
 						Type: "message",
@@ -161,7 +161,7 @@ func TestRecordToolUsage(t *testing.T) {
 						Type:      "function_call",
 						CallID:    "call_4",
 						Name:      "calculate",
-						Arguments: `{"a": 1, "b": 2}`,
+						Arguments: oairesponses.ResponseOutputItemUnionArguments{OfString: `{"a": 1, "b": 2}`},
 					},
 				},
 			},
@@ -211,7 +211,7 @@ func TestRecordToolUsage(t *testing.T) {
 						ID:        "fc_item_1",
 						CallID:    "call_both",
 						Name:      "get_weather",
-						Arguments: `{"location": "NYC"}`,
+						Arguments: oairesponses.ResponseOutputItemUnionArguments{OfString: `{"location": "NYC"}`},
 					},
 				},
 			},
@@ -358,6 +358,48 @@ func TestParseJSONArgs(t *testing.T) {
 	}
 }
 
+func TestSumUsage(t *testing.T) {
+	t.Parallel()
+
+	first := oairesponses.ResponseUsage{
+		InputTokens:  100,
+		OutputTokens: 50,
+		TotalTokens:  150,
+		InputTokensDetails: oairesponses.ResponseUsageInputTokensDetails{
+			CachedTokens:     10,
+			CacheWriteTokens: 20,
+		},
+		OutputTokensDetails: oairesponses.ResponseUsageOutputTokensDetails{
+			ReasoningTokens: 30,
+		},
+	}
+	second := oairesponses.ResponseUsage{
+		InputTokens:  200,
+		OutputTokens: 100,
+		TotalTokens:  300,
+		InputTokensDetails: oairesponses.ResponseUsageInputTokensDetails{
+			CachedTokens:     1,
+			CacheWriteTokens: 2,
+		},
+		OutputTokensDetails: oairesponses.ResponseUsageOutputTokensDetails{
+			ReasoningTokens: 3,
+		},
+	}
+
+	require.Equal(t, oairesponses.ResponseUsage{
+		InputTokens:  300,
+		OutputTokens: 150,
+		TotalTokens:  450,
+		InputTokensDetails: oairesponses.ResponseUsageInputTokensDetails{
+			CachedTokens:     11,
+			CacheWriteTokens: 22,
+		},
+		OutputTokensDetails: oairesponses.ResponseUsageOutputTokensDetails{
+			ReasoningTokens: 33,
+		},
+	}, sumUsage(first, second))
+}
+
 func TestRecordTokenUsage(t *testing.T) {
 	t.Parallel()
 
@@ -382,7 +424,8 @@ func TestRecordTokenUsage(t *testing.T) {
 					OutputTokens: 20,
 					TotalTokens:  30,
 					InputTokensDetails: oairesponses.ResponseUsageInputTokensDetails{
-						CachedTokens: 5,
+						CachedTokens:     5,
+						CacheWriteTokens: 3,
 					},
 					OutputTokensDetails: oairesponses.ResponseUsageOutputTokensDetails{
 						ReasoningTokens: 5,
@@ -390,11 +433,12 @@ func TestRecordTokenUsage(t *testing.T) {
 				},
 			},
 			expected: &recorder.TokenUsageRecord{
-				InterceptionID:       id.String(),
-				MsgID:                "resp_full",
-				Input:                5, // 10 input - 5 cached
-				Output:               20,
-				CacheReadInputTokens: 5,
+				InterceptionID:        id.String(),
+				MsgID:                 "resp_full",
+				Input:                 2, // 10 input - 5 cache read - 3 cache write
+				Output:                20,
+				CacheReadInputTokens:  5,
+				CacheWriteInputTokens: 3,
 				ExtraTokenTypes: map[string]int64{
 					"output_reasoning": 5,
 					"total_tokens":     30,
@@ -413,16 +457,18 @@ func TestRecordTokenUsage(t *testing.T) {
 					OutputTokens: 20,
 					TotalTokens:  30,
 					InputTokensDetails: oairesponses.ResponseUsageInputTokensDetails{
-						CachedTokens: 40,
+						CachedTokens:     20,
+						CacheWriteTokens: 20,
 					},
 				},
 			},
 			expected: &recorder.TokenUsageRecord{
-				InterceptionID:       id.String(),
-				MsgID:                "resp_clamp",
-				Input:                0, // max(0, 10 input - 40 cached)
-				Output:               20,
-				CacheReadInputTokens: 40,
+				InterceptionID:        id.String(),
+				MsgID:                 "resp_clamp",
+				Input:                 0, // max(0, 10 input - 20 cache read - 20 cache write)
+				Output:                20,
+				CacheReadInputTokens:  20,
+				CacheWriteInputTokens: 20,
 				ExtraTokenTypes: map[string]int64{
 					"output_reasoning": 0,
 					"total_tokens":     30,
diff --git a/aibridge/intercept/responses/blocking.go b/aibridge/intercept/responses/blocking.go
index 6038e2e1e6bb3..fd696a1d562f4 100644
--- a/aibridge/intercept/responses/blocking.go
+++ b/aibridge/intercept/responses/blocking.go
@@ -9,6 +9,7 @@ import (
 	"github.com/google/uuid"
 	"github.com/openai/openai-go/v3/option"
 	"github.com/openai/openai-go/v3/responses"
+	"github.com/tidwall/sjson"
 	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/trace"
 	"golang.org/x/xerrors"
@@ -69,10 +70,13 @@ func (i *BlockingResponsesInterceptor) ProcessRequest(w http.ResponseWriter, r *
 	i.injectTools()
 
 	var (
-		response        *responses.Response
-		upstreamErr     error
-		respCopy        responseCopier
-		firstResponseID string
+		response            *responses.Response
+		upstreamErr         error
+		innerLoopErr        error
+		respCopy            responseCopier
+		firstResponseID     string
+		cumulativeUsage     responses.ResponseUsage
+		innerLoopIterations int
 	)
 
 	prompt, promptFound, err := i.reqPayload.lastUserPrompt(ctx, i.logger)
@@ -126,13 +130,15 @@ func (i *BlockingResponsesInterceptor) ProcessRequest(w http.ResponseWriter, r *
 		}
 
 		i.recordTokenUsage(ctx, response)
+		cumulativeUsage = sumUsage(cumulativeUsage, response.Usage)
+		innerLoopIterations++
 		i.recordModelThoughts(ctx, response)
 
 		// Check if there any injected tools to invoke.
 		pending := i.getPendingInjectedToolCalls(response)
-		shouldLoop, err = i.handleInnerAgenticLoop(ctx, pending, response)
-		if err != nil {
-			i.sendCustomErr(ctx, w, http.StatusInternalServerError, err)
+		shouldLoop, innerLoopErr = i.handleInnerAgenticLoop(ctx, pending, response)
+		if innerLoopErr != nil {
+			i.sendCustomErr(ctx, w, http.StatusInternalServerError, innerLoopErr)
 			shouldLoop = false
 		}
 	}
@@ -142,16 +148,44 @@ func (i *BlockingResponsesInterceptor) ProcessRequest(w http.ResponseWriter, r *
 	}
 	i.recordNonInjectedToolUsage(ctx, response)
 
+	// The inner-loop error was already sent to the client. Do not append the
+	// buffered upstream response to it.
+	if innerLoopErr != nil {
+		return innerLoopErr
+	}
+
 	if upstreamErr != nil && !respCopy.responseReceived.Load() {
 		// no response received from upstream, return custom error
 		i.sendCustomErr(ctx, w, http.StatusInternalServerError, upstreamErr)
 		return xerrors.Errorf("failed to connect to upstream: %w", upstreamErr)
 	}
 
-	err = respCopy.forwardResp(w)
+	if innerLoopIterations > 1 && upstreamErr == nil && response != nil {
+		b, readErr := respCopy.readAll()
+		if readErr != nil {
+			forwardErr := respCopy.forwardBytes(w, b)
+			return errors.Join(xerrors.Errorf("failed to read response body: %w", readErr), forwardErr)
+		}
+		updated, setErr := i.setUsage(b, cumulativeUsage)
+		if setErr != nil {
+			forwardErr := respCopy.forwardBytes(w, b)
+			return errors.Join(setErr, forwardErr)
+		}
+		err = respCopy.forwardBytes(w, updated)
+	} else {
+		err = respCopy.forwardResp(w)
+	}
 	return errors.Join(upstreamErr, err)
 }
 
+func (*BlockingResponsesInterceptor) setUsage(raw []byte, usage responses.ResponseUsage) ([]byte, error) {
+	raw, err := sjson.SetBytes(raw, "usage", usage)
+	if err != nil {
+		return nil, xerrors.Errorf("set response usage: %w", err)
+	}
+	return raw, nil
+}
+
 // newResponse routes by credential type, returning the upstream response, the
 // number of key attempts made for this call, and any error. A centralized key
 // pool fails over across keys, while BYOK authenticates with a single, fixed
diff --git a/aibridge/internal/integrationtest/bridge_internal_test.go b/aibridge/internal/integrationtest/bridge_internal_test.go
index 0b2389d3390a9..ae15b5aae3e6a 100644
--- a/aibridge/internal/integrationtest/bridge_internal_test.go
+++ b/aibridge/internal/integrationtest/bridge_internal_test.go
@@ -837,6 +837,87 @@ func TestOpenAIChatCompletions(t *testing.T) {
 		}
 	})
 
+	t.Run("streaming cumulative usage with injected tool", func(t *testing.T) {
+		t.Parallel()
+
+		bridgeServer, mockMCP, resp := setupInjectedToolTest(
+			t,
+			fixtures.OaiChatStreamingCumulativeUsageInjectedTool,
+			true,
+			defaultTracer,
+			pathOpenAIChatCompletions,
+			nil,
+		)
+		defer resp.Body.Close()
+
+		sp := aibridge.NewSSEParser()
+		require.NoError(t, sp.Parse(resp.Body))
+
+		var finalUsage gjson.Result
+		events := sp.MessageEvents()
+		for i := len(events) - 1; i >= 0; i-- {
+			if usage := gjson.Get(events[i].Data, "usage"); usage.Exists() {
+				finalUsage = usage
+				break
+			}
+		}
+
+		require.True(t, finalUsage.Exists())
+		require.EqualValues(t, 12000, finalUsage.Get("prompt_tokens").Int())
+		require.EqualValues(t, 60, finalUsage.Get("completion_tokens").Int())
+		require.EqualValues(t, 12060, finalUsage.Get("total_tokens").Int())
+		require.EqualValues(t, 300, finalUsage.Get("prompt_tokens_details.cached_tokens").Int())
+		require.EqualValues(t, 30, finalUsage.Get("prompt_tokens_details.cache_write_tokens").Int())
+		require.EqualValues(t, 12, finalUsage.Get("prompt_tokens_details.audio_tokens").Int())
+		require.EqualValues(t, 14, finalUsage.Get("completion_tokens_details.reasoning_tokens").Int())
+		require.EqualValues(t, 16, finalUsage.Get("completion_tokens_details.audio_tokens").Int())
+		require.EqualValues(t, 18, finalUsage.Get("completion_tokens_details.accepted_prediction_tokens").Int())
+		require.EqualValues(t, 20, finalUsage.Get("completion_tokens_details.rejected_prediction_tokens").Int())
+
+		tokenUsages := bridgeServer.Recorder.RecordedTokenUsages()
+		for i := range tokenUsages {
+			tokenUsages[i].InterceptionID = ""
+			tokenUsages[i].CreatedAt = time.Time{}
+		}
+
+		// Each upstream stream reports cumulative snapshots on every chunk. The
+		// recorded iteration usage must use only its latest snapshot, while the
+		// client response above sums those two latest snapshots across iterations.
+		expectedTokenUsages := []*recorder.TokenUsageRecord{
+			{
+				MsgID:                 "chatcmpl-cumulative-tool",
+				Input:                 5890,
+				Output:                30,
+				CacheReadInputTokens:  100,
+				CacheWriteInputTokens: 10,
+				ExtraTokenTypes: map[string]int64{
+					"prompt_audio":                   3,
+					"completion_reasoning":           4,
+					"completion_audio":               5,
+					"completion_accepted_prediction": 6,
+					"completion_rejected_prediction": 7,
+				},
+			},
+			{
+				MsgID:                 "chatcmpl-cumulative-final",
+				Input:                 5780,
+				Output:                30,
+				CacheReadInputTokens:  200,
+				CacheWriteInputTokens: 20,
+				ExtraTokenTypes: map[string]int64{
+					"prompt_audio":                   9,
+					"completion_reasoning":           10,
+					"completion_audio":               11,
+					"completion_accepted_prediction": 12,
+					"completion_rejected_prediction": 13,
+				},
+			},
+		}
+		require.ElementsMatch(t, expectedTokenUsages, tokenUsages)
+		require.Len(t, mockMCP.getCallsByTool(mockToolName), 1)
+		bridgeServer.Recorder.VerifyAllInterceptionsEnded(t)
+	})
+
 	t.Run("streaming injected tool call edge cases", func(t *testing.T) {
 		t.Parallel()
 
@@ -1411,8 +1492,9 @@ func TestOpenAIInjectedTools(t *testing.T) {
 			require.EqualValues(t, expected, actual)
 
 			var (
-				content *openai.ChatCompletionChoice
-				message openai.ChatCompletion
+				content     *openai.ChatCompletionChoice
+				message     openai.ChatCompletion
+				clientUsage openai.CompletionUsage
 			)
 			if streaming {
 				// Parse the response stream.
@@ -1423,6 +1505,9 @@ func TestOpenAIInjectedTools(t *testing.T) {
 				for stream.Next() {
 					chunk := stream.Current()
 					acc.AddChunk(chunk)
+					if chunk.JSON.Usage.Valid() {
+						clientUsage = chunk.Usage
+					}
 
 					if len(chunk.Choices) == 0 {
 						continue
@@ -1453,6 +1538,7 @@ func TestOpenAIInjectedTools(t *testing.T) {
 				body, err := io.ReadAll(resp.Body)
 				require.NoError(t, err, "read response body")
 				require.NoError(t, json.Unmarshal(body, &message), "unmarshal response")
+				clientUsage = message.Usage
 
 				// Verify that no injected tools were sent to the client.
 				require.GreaterOrEqual(t, len(message.Choices), 1)
@@ -1466,15 +1552,60 @@ func TestOpenAIInjectedTools(t *testing.T) {
 			require.NotNil(t, content)
 			require.Contains(t, content.Message.Content, "dd711d5c-83c6-4c08-a0af-b73055906e8c") // The ID of the workspace to be returned.
 
-			// Check the token usage from the client's perspective.
-			// This *should* work but the openai SDK doesn't accumulate the prompt token details :(.
-			// See https://github.com/openai/openai-go/blob/v2.7.0/streamaccumulator.go#L145-L147.
-			// assert.EqualValues(t, 5047, message.Usage.PromptTokens-message.Usage.PromptTokensDetails.CachedTokens)
-			assert.EqualValues(t, 105, message.Usage.CompletionTokens)
-
-			// Ensure tokens used during injected tool invocation are accounted for.
-			require.EqualValues(t, 5047, bridgeServer.Recorder.TotalInputTokens())
-			require.EqualValues(t, 105, bridgeServer.Recorder.TotalOutputTokens())
+			// Check the cumulative token usage from the client's perspective.
+			require.EqualValues(t, 9911, clientUsage.PromptTokens)
+			require.EqualValues(t, 105, clientUsage.CompletionTokens)
+			require.EqualValues(t, 10016, clientUsage.TotalTokens)
+			require.EqualValues(t, 4964, clientUsage.PromptTokensDetails.CachedTokens)
+			require.EqualValues(t, 30, clientUsage.PromptTokensDetails.CacheWriteTokens)
+			require.EqualValues(t, 12, clientUsage.PromptTokensDetails.AudioTokens)
+			require.EqualValues(t, 14, clientUsage.CompletionTokensDetails.ReasoningTokens)
+			require.EqualValues(t, 16, clientUsage.CompletionTokensDetails.AudioTokens)
+			require.EqualValues(t, 18, clientUsage.CompletionTokensDetails.AcceptedPredictionTokens)
+			require.EqualValues(t, 20, clientUsage.CompletionTokensDetails.RejectedPredictionTokens)
+
+			// Ensure both upstream iterations were recorded exactly.
+			tokenUsages := bridgeServer.Recorder.RecordedTokenUsages()
+			for _, usage := range tokenUsages {
+				usage.InterceptionID = ""
+				usage.CreatedAt = time.Time{}
+			}
+			firstMsgID := "chatcmpl-C1XAKDTVYnmWS7tgvg7vPje00PIiy"
+			secondMsgID := "chatcmpl-C1XANLwdflVxAjKOjbMP3LJxSlXsS"
+			if streaming {
+				firstMsgID = "chatcmpl-C1WTooFaxeQgtyLB1kg53t41aB0NV"
+				secondMsgID = "chatcmpl-C1WTqhYgK7bV01bW98Lww3zqaf8ZF"
+			}
+			require.ElementsMatch(t, []*recorder.TokenUsageRecord{
+				{
+					MsgID:                 firstMsgID,
+					Input:                 4742,
+					Output:                45,
+					CacheReadInputTokens:  100,
+					CacheWriteInputTokens: 20,
+					ExtraTokenTypes: map[string]int64{
+						"prompt_audio":                   3,
+						"completion_accepted_prediction": 6,
+						"completion_rejected_prediction": 7,
+						"completion_audio":               5,
+						"completion_reasoning":           4,
+					},
+				},
+				{
+					MsgID:                 secondMsgID,
+					Input:                 175,
+					Output:                60,
+					CacheReadInputTokens:  4864,
+					CacheWriteInputTokens: 10,
+					ExtraTokenTypes: map[string]int64{
+						"prompt_audio":                   9,
+						"completion_accepted_prediction": 12,
+						"completion_rejected_prediction": 13,
+						"completion_audio":               11,
+						"completion_reasoning":           10,
+					},
+				},
+			}, tokenUsages)
 
 			// Ensure we received exactly one prompt.
 			promptUsages := bridgeServer.Recorder.RecordedPromptUsages()
diff --git a/aibridge/internal/integrationtest/metrics_internal_test.go b/aibridge/internal/integrationtest/metrics_internal_test.go
index 314c2d97c4a4b..a9bcf93e477b4 100644
--- a/aibridge/internal/integrationtest/metrics_internal_test.go
+++ b/aibridge/internal/integrationtest/metrics_internal_test.go
@@ -294,10 +294,10 @@ func TestMetrics_TokenUseCount(t *testing.T) {
 			expectProvider: config.ProviderOpenAI,
 			expectModel:    "gpt-4.1",
 			expectedLabels: map[string]float64{
-				"input":                    129, // 12033 - 11904 cached
+				"input":                    114, // 12033 - 11904 cached - 15 cache write
 				"output":                   44,
 				"cache_read_input_tokens":  11904,
-				"cache_write_input_tokens": 0,
+				"cache_write_input_tokens": 15,
 				"output_reasoning":         0,
 				"total_tokens":             12077,
 			},
@@ -323,10 +323,10 @@ func TestMetrics_TokenUseCount(t *testing.T) {
 			expectProvider: config.ProviderOpenAI,
 			expectModel:    "gpt-4.1",
 			expectedLabels: map[string]float64{
-				"input":                          19,
+				"input":                          14, // 19 prompt - 5 cache write
 				"output":                         200,
 				"cache_read_input_tokens":        0,
-				"cache_write_input_tokens":       0,
+				"cache_write_input_tokens":       5,
 				"completion_reasoning":           0,
 				"completion_accepted_prediction": 0,
 				"completion_rejected_prediction": 0,
diff --git a/aibridge/internal/integrationtest/responses_internal_test.go b/aibridge/internal/integrationtest/responses_internal_test.go
index 73fccad6398a7..2a6edfcbb1051 100644
--- a/aibridge/internal/integrationtest/responses_internal_test.go
+++ b/aibridge/internal/integrationtest/responses_internal_test.go
@@ -1,6 +1,7 @@
 package integrationtest
 
 import (
+	"bufio"
 	"context"
 	"encoding/json"
 	"fmt"
@@ -94,10 +95,11 @@ func TestResponsesOutputMatchesUpstream(t *testing.T) {
 			expectModel:          "gpt-4.1",
 			expectPromptRecorded: "This was a large input...",
 			expectTokenUsage: &recorder.TokenUsageRecord{
-				MsgID:                "resp_0cd5d6b8310055d600696a1776b42c81a199fbb02248a8bfa0",
-				Input:                129, // 12033 input - 11904 cached
-				Output:               44,
-				CacheReadInputTokens: 11904,
+				MsgID:                 "resp_0cd5d6b8310055d600696a1776b42c81a199fbb02248a8bfa0",
+				Input:                 114, // 12033 input - 11904 cached - 15 cache write
+				Output:                44,
+				CacheReadInputTokens:  11904,
+				CacheWriteInputTokens: 15,
 				ExtraTokenTypes: map[string]int64{
 					"output_reasoning": 0,
 					"total_tokens":     12077,
@@ -256,10 +258,11 @@ func TestResponsesOutputMatchesUpstream(t *testing.T) {
 			expectModel:          "gpt-5.2-codex",
 			expectPromptRecorded: "Test cached input tokens.",
 			expectTokenUsage: &recorder.TokenUsageRecord{
-				MsgID:                "resp_05080461b406f3f501696a1409d34c8195a40ff4b092145c35",
-				Input:                1165, // 16909 input - 15744 cached
-				Output:               54,
-				CacheReadInputTokens: 15744,
+				MsgID:                 "resp_05080461b406f3f501696a1409d34c8195a40ff4b092145c35",
+				Input:                 1135, // 16909 input - 15744 cached - 30 cache write
+				Output:                54,
+				CacheReadInputTokens:  15744,
+				CacheWriteInputTokens: 30,
 				ExtraTokenTypes: map[string]int64{
 					"output_reasoning": 0,
 					"total_tokens":     16963,
@@ -803,7 +806,8 @@ func TestResponsesInjectedTool(t *testing.T) {
 		expectToolArgs    map[string]any
 		expectToolError   string // If non-empty, MCP tool returns this error.
 		expectPrompt      string
-		expectTokenUsages []recorder.TokenUsageRecord
+		expectTokenUsages []*recorder.TokenUsageRecord
+		expectClientUsage responses.ResponseUsage
 	}{
 		{
 			name:        "blocking_success",
@@ -813,28 +817,42 @@ func TestResponsesInjectedTool(t *testing.T) {
 				"template_version_id": "aa4e30e4-a086-4df6-a364-1343f1458104",
 			},
 			expectPrompt: "list the template params for version aa4e30e4-a086-4df6-a364-1343f1458104",
-			expectTokenUsages: []recorder.TokenUsageRecord{
+			expectTokenUsages: []*recorder.TokenUsageRecord{
 				{
-					MsgID:                "resp_012db006225b0ec700696b5de8a01481a28182ea6885448f93",
-					Input:                227, // 6371 input - 6144 cached
-					Output:               75,
-					CacheReadInputTokens: 6144,
+					MsgID:                 "resp_012db006225b0ec700696b5de8a01481a28182ea6885448f93",
+					Input:                 220, // 6371 input - 6144 cached - 7 cache write
+					Output:                75,
+					CacheReadInputTokens:  6144,
+					CacheWriteInputTokens: 7,
 					ExtraTokenTypes: map[string]int64{
 						"output_reasoning": 25,
 						"total_tokens":     6446,
 					},
 				},
 				{
-					MsgID:                "resp_012db006225b0ec700696b5dec1d4c81a2a6a416e31af39b90",
-					Input:                612, // 6756 input - 6144 cached
-					Output:               231,
-					CacheReadInputTokens: 6144,
+					MsgID:                 "resp_012db006225b0ec700696b5dec1d4c81a2a6a416e31af39b90",
+					Input:                 601, // 6756 input - 6144 cached - 11 cache write
+					Output:                231,
+					CacheReadInputTokens:  6144,
+					CacheWriteInputTokens: 11,
 					ExtraTokenTypes: map[string]int64{
 						"output_reasoning": 43,
 						"total_tokens":     6987,
 					},
 				},
 			},
+			expectClientUsage: responses.ResponseUsage{
+				InputTokens:  13127,
+				OutputTokens: 306,
+				TotalTokens:  13433,
+				InputTokensDetails: responses.ResponseUsageInputTokensDetails{
+					CachedTokens:     12288,
+					CacheWriteTokens: 18,
+				},
+				OutputTokensDetails: responses.ResponseUsageOutputTokensDetails{
+					ReasoningTokens: 68,
+				},
+			},
 		},
 		{
 			name:        "blocking_tool_error",
@@ -845,28 +863,42 @@ func TestResponsesInjectedTool(t *testing.T) {
 			},
 			expectPrompt:    "delete the template with ID 03cb4fdd-8109-4a22-8e22-bb4975171395, don't ask for confirmation",
 			expectToolError: "500 Internal error deleting template: unauthorized: rbac: forbidden",
-			expectTokenUsages: []recorder.TokenUsageRecord{
+			expectTokenUsages: []*recorder.TokenUsageRecord{
 				{
-					MsgID:                "resp_06e2afba24b6b2ad00696b774d1df0819eaf1ec802bc8a2ca9",
-					Input:                233, // 6377 input - 6144 cached
-					Output:               119,
-					CacheReadInputTokens: 6144,
+					MsgID:                 "resp_06e2afba24b6b2ad00696b774d1df0819eaf1ec802bc8a2ca9",
+					Input:                 228, // 6377 input - 6144 cached - 5 cache write
+					Output:                119,
+					CacheReadInputTokens:  6144,
+					CacheWriteInputTokens: 5,
 					ExtraTokenTypes: map[string]int64{
 						"output_reasoning": 70,
 						"total_tokens":     6496,
 					},
 				},
 				{
-					MsgID:                "resp_06e2afba24b6b2ad00696b775044e8819ea14840698ef966e2",
-					Input:                395, // 6539 input - 6144 cached
-					Output:               144,
-					CacheReadInputTokens: 6144,
+					MsgID:                 "resp_06e2afba24b6b2ad00696b775044e8819ea14840698ef966e2",
+					Input:                 386, // 6539 input - 6144 cached - 9 cache write
+					Output:                144,
+					CacheReadInputTokens:  6144,
+					CacheWriteInputTokens: 9,
 					ExtraTokenTypes: map[string]int64{
 						"output_reasoning": 28,
 						"total_tokens":     6683,
 					},
 				},
 			},
+			expectClientUsage: responses.ResponseUsage{
+				InputTokens:  12916,
+				OutputTokens: 263,
+				TotalTokens:  13179,
+				InputTokensDetails: responses.ResponseUsageInputTokensDetails{
+					CachedTokens:     12288,
+					CacheWriteTokens: 14,
+				},
+				OutputTokensDetails: responses.ResponseUsageOutputTokensDetails{
+					ReasoningTokens: 98,
+				},
+			},
 		},
 		{
 			name:           "streaming_success",
@@ -875,23 +907,26 @@ func TestResponsesInjectedTool(t *testing.T) {
 			mcpToolName:    "coder_list_templates",
 			expectToolArgs: map[string]any{},
 			expectPrompt:   "List my coder templates.",
-			expectTokenUsages: []recorder.TokenUsageRecord{
+			expectTokenUsages: []*recorder.TokenUsageRecord{
 				{
-					MsgID:  "resp_016595fe42aa62ca0069724419c52081a0b7eb479c6bc8109f",
-					Input:  6269, // 6269 input - 0 cached
-					Output: 18,
+					MsgID:                 "resp_016595fe42aa62ca0069724419c52081a0b7eb479c6bc8109f",
+					Input:                 6162, // 6269 input - 100 cached - 7 cache write
+					Output:                18,
+					CacheReadInputTokens:  100,
+					CacheWriteInputTokens: 7,
 					ExtraTokenTypes: map[string]int64{
-						"output_reasoning": 0,
+						"output_reasoning": 3,
 						"total_tokens":     6287,
 					},
 				},
 				{
-					MsgID:                "resp_0bc5f54fce6df69a006972442175908194bb81d31f576e6ca6",
-					Input:                319, // 6463 input - 6144 cached
-					Output:               182,
-					CacheReadInputTokens: 6144,
+					MsgID:                 "resp_0bc5f54fce6df69a006972442175908194bb81d31f576e6ca6",
+					Input:                 308, // 6463 input - 6144 cached - 11 cache write
+					Output:                182,
+					CacheReadInputTokens:  6144,
+					CacheWriteInputTokens: 11,
 					ExtraTokenTypes: map[string]int64{
-						"output_reasoning": 0,
+						"output_reasoning": 5,
 						"total_tokens":     6645,
 					},
 				},
@@ -908,22 +943,26 @@ func TestResponsesInjectedTool(t *testing.T) {
 			},
 			expectPrompt:    "Create a new workspace build for an workspace with id: 'non_existing_id'",
 			expectToolError: "workspace_id must be a valid UUID: invalid UUID length: 15",
-			expectTokenUsages: []recorder.TokenUsageRecord{
+			expectTokenUsages: []*recorder.TokenUsageRecord{
 				{
-					MsgID:  "resp_0dfed48e1052ad7f0069725ca129f88193b97d6deff1760524",
-					Input:  6280, // 6280 input - 0 cached
-					Output: 30,
+					MsgID:                 "resp_0dfed48e1052ad7f0069725ca129f88193b97d6deff1760524",
+					Input:                 6175, // 6280 input - 100 cached - 5 cache write
+					Output:                30,
+					CacheReadInputTokens:  100,
+					CacheWriteInputTokens: 5,
 					ExtraTokenTypes: map[string]int64{
-						"output_reasoning": 0,
+						"output_reasoning": 3,
 						"total_tokens":     6310,
 					},
 				},
 				{
-					MsgID:  "resp_0dfed48e1052ad7f0069725ca39880819390fcc5b2eb8cf8c6",
-					Input:  6346, // 6346 input - 0 cached
-					Output: 56,
+					MsgID:                 "resp_0dfed48e1052ad7f0069725ca39880819390fcc5b2eb8cf8c6",
+					Input:                 6237, // 6346 input - 100 cached - 9 cache write
+					Output:                56,
+					CacheReadInputTokens:  100,
+					CacheWriteInputTokens: 9,
 					ExtraTokenTypes: map[string]int64{
-						"output_reasoning": 0,
+						"output_reasoning": 5,
 						"total_tokens":     6402,
 					},
 				},
@@ -983,24 +1022,23 @@ func TestResponsesInjectedTool(t *testing.T) {
 			require.Len(t, prompts, 1)
 			require.Equal(t, tc.expectPrompt, prompts[0].Prompt)
 
+			// Verify both upstream iterations were recorded exactly. Match by
+			// content because AsyncRecorder does not guarantee record ordering.
 			tokenUsages := bridgeServer.Recorder.RecordedTokenUsages()
-			require.Len(t, tokenUsages, len(tc.expectTokenUsages))
 			for i := range tokenUsages {
-				tokenUsages[i].InterceptionID = "" // ignore interception ID and time creation when comparing
+				tokenUsages[i].InterceptionID = ""
 				tokenUsages[i].CreatedAt = time.Time{}
 			}
+			require.ElementsMatch(t, tc.expectTokenUsages, tokenUsages)
 
-			// Match by content, not position, AsyncRecorder may flake.
-			// See https://github.com/coder/internal/issues/1544.
-			for _, expected := range tc.expectTokenUsages {
-				require.Contains(t, tokenUsages, &expected)
-			}
-
-			// Verify the response is the final tool response (after agentic loop).
+			// Streaming forwards the final upstream response unchanged. Blocking
+			// rewrites its usage with the sum from both agentic-loop iterations.
 			if tc.streaming {
 				require.Equal(t, string(fix.StreamingToolCall()), string(body))
 			} else {
-				require.Equal(t, string(fix.NonStreamingToolCall()), string(body))
+				expectedBody, err := sjson.SetBytes(fix.NonStreamingToolCall(), "usage", tc.expectClientUsage)
+				require.NoError(t, err)
+				require.JSONEq(t, string(expectedBody), string(body))
 			}
 		})
 	}
@@ -1158,10 +1196,12 @@ func startRejectingListener(t *testing.T) (addr string) {
 				return
 			}
 
-			// Read at least 1 byte so the client has started writing
-			// before we RST, ensuring a consistent "connection reset by peer".
-			buf := make([]byte, 1)
-			_, _ = c.Read(buf)
+			// Drain the request before the RST so the client observes a
+			// read-side reset rather than a racy body-write failure.
+			if req, err := http.ReadRequest(bufio.NewReader(c)); err == nil {
+				_, _ = io.Copy(io.Discard, req.Body)
+				_ = req.Body.Close()
+			}
 			if tc, ok := c.(*net.TCPConn); ok {
 				_ = tc.SetLinger(0)
 			}
diff --git a/go.mod b/go.mod
index 06189f1f7c1f7..bb7fef16db489 100644
--- a/go.mod
+++ b/go.mod
@@ -131,7 +131,7 @@ replace github.com/anthropics/anthropic-sdk-go v1.19.0 => github.com/dannykoppin
 // `coder/pinned` is the branch we track.
 //
 // To update, run: `go mod edit -replace github.com/openai/openai-go/v3=github.com/coder/openai-go/v3@coder/pinned; go mod tidy`
-replace github.com/openai/openai-go/v3 => github.com/coder/openai-go/v3 v3.0.0-20260708125056-3633b71968f7
+replace github.com/openai/openai-go/v3 => github.com/coder/openai-go/v3 v3.0.0-20260810175933-92b5addb22d2
 
 require (
 	cdr.dev/slog/v3 v3.1.0
@@ -145,7 +145,7 @@ require (
 	github.com/aquasecurity/trivy-iac v0.8.0
 	github.com/armon/circbuf v0.0.0-20190214190532-5111143e8da2
 	github.com/awalterschulze/gographviz v2.0.3+incompatible
-	github.com/aws/smithy-go v1.27.3
+	github.com/aws/smithy-go v1.27.5
 	github.com/bramvdbogaerde/go-scp v1.6.0
 	github.com/briandowns/spinner v1.23.0
 	github.com/cakturk/go-netstat v0.0.0-20200220111822-e5b49efee7a5
@@ -239,7 +239,7 @@ require (
 	github.com/stretchr/testify v1.11.1
 	github.com/swaggo/http-swagger/v2 v2.0.1
 	github.com/swaggo/swag v1.16.6
-	github.com/tidwall/gjson v1.18.0
+	github.com/tidwall/gjson v1.19.0
 	github.com/u-root/u-root v0.14.0
 	github.com/unrolled/secure v1.17.0
 	github.com/valyala/fasthttp v1.72.0
@@ -309,19 +309,19 @@ require (
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
 	github.com/armon/go-radix v1.0.1-0.20221118154546-54df44f2176c // indirect
 	github.com/atotto/clipboard v0.1.4 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.42.1
-	github.com/aws/aws-sdk-go-v2/config v1.32.25
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.24
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.29 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.43.2
+	github.com/aws/aws-sdk-go-v2/config v1.32.33
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.32
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.33 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.6.14
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.30 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.33 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.33 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.14 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.33 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssm v1.67.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.31.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.36.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.44.0
+	github.com/aws/aws-sdk-go-v2/service/sso v1.33.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.45.2
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
@@ -518,7 +518,7 @@ require (
 	github.com/DataDog/datadog-agent/pkg/trace/traceutil v0.77.0 // indirect
 	github.com/DataDog/go-libddwaf/v4 v4.9.0 // indirect
 	github.com/apparentlymart/go-textseg/v17 v17.0.1 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.31 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.34 // indirect
 	github.com/charmbracelet/colorprofile v0.4.1 // indirect
 	github.com/charmbracelet/x/cellbuf v0.0.15 // indirect
 	github.com/charmbracelet/x/exp/strings v0.1.0 // indirect
@@ -553,7 +553,7 @@ require (
 	github.com/mark3labs/mcp-go v0.38.0
 	github.com/nats-io/nats-server/v2 v2.14.2
 	github.com/nats-io/nats.go v1.52.0
-	github.com/openai/openai-go/v3 v3.28.0
+	github.com/openai/openai-go/v3 v3.50.0
 	github.com/scim2/filter-parser/v2 v2.3.1
 	github.com/shopspring/decimal v1.4.0
 	github.com/smallstep/pkcs7 v0.2.1
@@ -574,8 +574,8 @@ require (
 	cloud.google.com/go/monitoring v1.29.0 // indirect
 	cloud.google.com/go/storage v1.62.3 // indirect
 	git.sr.ht/~jackmordaunt/go-toast v1.1.2 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 // indirect
 	github.com/DataDog/datadog-agent/comp/core/tagger/origindetection v0.77.0 // indirect
 	github.com/DataDog/datadog-agent/pkg/version v0.77.0 // indirect
 	github.com/DataDog/dd-trace-go/v2 v2.8.1 // indirect
@@ -592,7 +592,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.22 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.29 // indirect
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.103.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/signin v1.2.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signin v1.5.2 // indirect
 	github.com/bahlo/generic-list-go v0.2.0 // indirect
 	github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
 	github.com/bits-and-blooms/bitset v1.24.5 // indirect
diff --git a/go.sum b/go.sum
index 9761644f7ba0c..5592a9d10439f 100644
--- a/go.sum
+++ b/go.sum
@@ -31,16 +31,16 @@ filippo.io/mkcert v1.4.4 h1:8eVbbwfVlaqUM7OwuftKc2nuYOoTDQWqsoXmzoXZdbc=
 filippo.io/mkcert v1.4.4/go.mod h1:VyvOchVuAye3BoUsPUOOofKygVwLV2KQMVFJNRq+1dA=
 git.sr.ht/~jackmordaunt/go-toast v1.1.2 h1:/yrfI55LRt1M7H1vkaw+NaH1+L1CDxrqDltwm5euVuE=
 git.sr.ht/~jackmordaunt/go-toast v1.1.2/go.mod h1:jA4OqHKTQ4AFBdwrSnwnskUIIS3HYzlJSgdzCKqfavo=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 h1:JXg2dwJUmPB9JmtVmdEB16APJ7jurfbY5jnfXpJoRMc=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0/go.mod h1:YD5h/ldMsG0XiIw7PdyNhLxaM317eFh5yNLccNfGdyw=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 h1:Hk5QBxZQC1jb2Fwj6mpzme37xbCDdNTxU7O9eb5+LB4=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1/go.mod h1:IYus9qsFobWIc2YVwe/WPjcnyCkPKtnHAqUYeebc8z0=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 h1:9iefClla7iYpfYWdzPCRDozdmndjTm8DXdpCzPajMgA=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2/go.mod h1:XtLgD3ZD34DAaVIIAyG3objl5DynM3CQ/vMcbBNJZGI=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 h1:aokoqcHvaGjiM3VpjKDfMMnF/8epJ+Q1HLJ7CudztqE=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0/go.mod h1:/WYEx9pcM9Y+Dd/APJaNlSvVSvzl54rrMdZT5+Oi2LM=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 h1:CU4+EJeJi3TKYWEcYuSdWsjzw0nVsK/H0MSQOiPcymU=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0/go.mod h1:q0+UTSRvShwUCrR/s5HtyInYphN7Wvxb7snFM3u+SLA=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 h1:fhqpLE3UEXi9lPaBRpQ6XuRW0nU7hgg4zlmZZa+a9q4=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0/go.mod h1:7dCRMLwisfRH3dBupKeNCioWYUZ4SS09Z14H+7i8ZoY=
 github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
 github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 h1:XRzhVemXdgvJqCH0sFfrBUTnUJSBrBf7++ypk+twtRs=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 h1:RHK7bS+HQMslb1sZpAokUt+zTVmue0hKSs2C791hhzU=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk=
 github.com/BurntSushi/locker v0.0.0-20171006230638-a6e239ea1c69 h1:+tu3HOoMXB7RXEINRVIpxJCT+KdYiI7LAEAUrOw3dIU=
 github.com/BurntSushi/locker v0.0.0-20171006230638-a6e239ea1c69/go.mod h1:L1AbZdiDllfyYH5l5OkAaZtk7VkWe89bPJFmnDBNHxg=
 github.com/DATA-DOG/go-sqlmock v1.5.2 h1:OcvFkGmslmlZibjAjaHm3L//6LiuBgolP7OputlJIzU=
@@ -170,46 +170,46 @@ github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z
 github.com/atotto/clipboard v0.1.4/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI=
 github.com/awalterschulze/gographviz v2.0.3+incompatible h1:9sVEXJBJLwGX7EQVhLm2elIKCm7P2YHFC8v6096G09E=
 github.com/awalterschulze/gographviz v2.0.3+incompatible/go.mod h1:GEV5wmg4YquNw7v1kkyoX9etIk8yVmXj+AkDHuuETHs=
-github.com/aws/aws-sdk-go-v2 v1.42.1 h1:9eOTgu1z/dVtYpNZ3/8/XbbaX0x/BqE3HUzAzs6K0ek=
-github.com/aws/aws-sdk-go-v2 v1.42.1/go.mod h1:5pKeft2eJj+gElQ38Jqg4ibCqh+/AK33/0X3hip7IjM=
+github.com/aws/aws-sdk-go-v2 v1.43.2 h1:cl+IXwWb3qazClUcm08tGSsB6OiuV83JVJO9B0jQcPc=
+github.com/aws/aws-sdk-go-v2 v1.43.2/go.mod h1:WEzLKBh/mEjXvx1FtQMWgSxMSTVqxQzjkRtk5fa3wkg=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.13 h1:p1BBrg/Hhp6uK7zpejeI8QFXHJeC/mynzi04Sl03k9g=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.13/go.mod h1:8cIfkE9MDhkRZGpQ22aV6/lkYeYSozpz16Smrs5x4Ls=
-github.com/aws/aws-sdk-go-v2/config v1.32.25 h1:ACCejvStYoilgwrfegSt5ZntCbPrk52qfwyNcnl3omM=
-github.com/aws/aws-sdk-go-v2/config v1.32.25/go.mod h1:LJyU8sDRbXUxFn8xMJIGP+v9QYYwveNLI8a/giAOiAs=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.24 h1:2hQqYCV9yqyePQ9o6dCrZc/zO8U3TwPr9mIKlZnPu/I=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.24/go.mod h1:IDwpACtwqHLISdzfwUUNq4P9DsB/h5BLg4FwJPNfqFY=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.29 h1:r6qZHbT+wxgWO/e9vYNUEtg7lv5+UN3pRqKhLXvnArg=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.29/go.mod h1:QRnaRcTVGKPGRy8w78HMQtKUGRYcnMZAANATkeVA6Mo=
+github.com/aws/aws-sdk-go-v2/config v1.32.33 h1:M1m/Q6f0OKDEDGwhiNOqx1OjTdrewe3v+GDbHmKczWk=
+github.com/aws/aws-sdk-go-v2/config v1.32.33/go.mod h1:fGj1iQj2QpIZzp7jE4aQQ+71TE8cd4z9K4+xCd6EqmE=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.32 h1:eNE0JnIblBo1NCvd3tqEYuZz9XDefn69R74CHd3nT7U=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.32/go.mod h1:yYJu+6tqKUYZuJSYcpSGjz/6sV/SUaAaKIufnWKx2OU=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.33 h1:MobhiR6KIerWxmO74Zit5I3379+mSc2DOdZ3DeRFB9w=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.33/go.mod h1:xu02847OdZfNr/jAfZpHtyRk0b3v4d0kaoxNHxZGG/w=
 github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.6.14 h1:gKXU53GYsPuYgkdTdMHh6vNdcbIgoxFQLQGjg+iRG+k=
 github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.6.14/go.mod h1:jyoemRAktfCyZR9bTb5gT3kn/Vj2KwYDm0Pev5TsmEQ=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30 h1:xM/Is9cKMHa8Jj8zkvWhvrFkZsXJV9E+BB4g0HW0duQ=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30/go.mod h1:WueJeNDZvK1fMYEWJIkcivBfEzUkTpBhzlrUKKY8EuA=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30 h1:jn46zC9LdsVR/ZpMIJqMqb8hHv31BlLx3ulVqNspUOk=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30/go.mod h1:1hTMsAgbdS/AtUi4bw8+gUuh1pceo+eXRLfpSuSQj3M=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.31 h1:3GUprIsfmGcC5SACIyB0e7E0BM1O1b3Erl5CePYIAeQ=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.31/go.mod h1:7PuV1yl5e2xnUbm+RqvVg5i2iBM8EyijZNoI9wsOoOc=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13 h1:mbRIur/BiHK6SKPjoBIXSE/hJ6g6JGRLuxQy1jGjlN4=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13/go.mod h1:ITg9em2KbJx1s0y4aqRX5OYWG6HBZ5TVR//OdpEZ2CQ=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.33 h1:HAp1wLFZzch054uh3FK7rcVYg4v7J2FxVf3h3IGNZas=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.33/go.mod h1:mJk5fmqnF+WUlMdPG37pR2Fh3oh6r8F6ZGUgPKvzu0c=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.33 h1:0YA0aCKgsJyno6xkFfaIgjE3/wK08+Qxo9nQfe1UrWM=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.33/go.mod h1:UZqj4WIdTH+ga8Y/DgpAuy/8cGjM3h7gDCliJYGg2SE=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.34 h1:HQYnjFnXpX8EbPW5M1QT8mXzesRPwly0HEPTcFlS02Y=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.34/go.mod h1:tGzj56niKYZBbDIRhwPGDqrULzmWv5b6uBQGqyNaFZw=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.14 h1:SA43nfaY7+1jjMNIc2ywu99JLJLButtIdLP6j+bT870=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.14/go.mod h1:Du3llKcwbQvHsTXSLzTOGQz0DTDBMEzdg7DAGu7inrY=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.22 h1:V51LGlOq/1VsDsHUdoklAQi7rMmx4qQubvFYAlP2254=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.22/go.mod h1:4Pzhyz8hJOm2bepgl+NjvRx8vlUFAIIvJnZ/MkcNPpU=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.30 h1:/Z5jmNrKsSD7EmDjzAPsm/3L9IuOkzaynklJZ1qX7S4=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.30/go.mod h1:lEzEZnOosE7zi8Z6royW1cFJTD9fpab4Ul1SBrllewk=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.33 h1:mqI7OrxN/DUH85F5OqVn3cIfuZ3+HVcebUm2N8mLlgQ=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.33/go.mod h1:eZ5jdEpvaaOU8nWWE4cTAJETSEA5FZoWxvNRao4piHY=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.29 h1:hiME6pBzC7OTl9LMtlyTWBuEl1f4QBcUmFDKC7MLXtc=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.29/go.mod h1:G7RP+uhagpKtKhd1BM9N6JQqjCcGEU47K5lBVZQyRQw=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.103.3 h1:JRseEu/vIDMaWis4bSw0QbXL+cvIGc1XnX076H5ZXLE=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.103.3/go.mod h1:77ZAgynvx1txMvDG8gGWoWkO1augYDxkp9JElWFgjQU=
-github.com/aws/aws-sdk-go-v2/service/signin v1.2.0 h1:3nXpRcFwRCW8n7HgO2QGy0Dc20eQNfBuUemGQhpF8m8=
-github.com/aws/aws-sdk-go-v2/service/signin v1.2.0/go.mod h1:LxYujSTLPRlp2vTtcUO/+1ilrew8ytt6SvQyOgejzFQ=
+github.com/aws/aws-sdk-go-v2/service/signin v1.5.2 h1:EjI1CZzDcBxPkTa3j1BdtIrUDbqnOGssFMeyUS+6W0I=
+github.com/aws/aws-sdk-go-v2/service/signin v1.5.2/go.mod h1:vN3eb5H8MEAZ4dx0F5Wc9LT8eb3eW7bZZ5BjGJdbw9k=
 github.com/aws/aws-sdk-go-v2/service/ssm v1.67.4 h1:pOwUUY5FzKUsxtxGR6qsczZP7MuZMVlMbAOPQOcmJlo=
 github.com/aws/aws-sdk-go-v2/service/ssm v1.67.4/go.mod h1:+nlWvcgDPQ56mChEBzTC0puAMck+4onOFaHg5cE+Lgg=
-github.com/aws/aws-sdk-go-v2/service/sso v1.31.3 h1:ey1XLTYXb9PcLt4535632o5kCGXNXEhNb620Dqwuylo=
-github.com/aws/aws-sdk-go-v2/service/sso v1.31.3/go.mod h1:Lk7PlmoTYryQmyBG0EXqj5BcUbj3whXdU2s3yGI3EAc=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.36.6 h1:yLr03zQE/5Eu5l3QU0Si+xMbLMbSDF2YXsigqXngs6g=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.36.6/go.mod h1:Q5N6icH+KJZDLh+ESNwzdv6cZ6vLFF/egy3IOxWhmz4=
-github.com/aws/aws-sdk-go-v2/service/sts v1.44.0 h1:bLZ0PolJ8J+HkJHztcXORUpHXBye2U8298lCEMi6ZCU=
-github.com/aws/aws-sdk-go-v2/service/sts v1.44.0/go.mod h1:9gdl4RrflIdpDb2TlXshWgR1F9TeCkvqDx77Vpr4Z/Q=
-github.com/aws/smithy-go v1.27.3 h1:F3Zb497UhhskkfpJmfkXswyo+t0sh9OTBnIHjogWbVY=
-github.com/aws/smithy-go v1.27.3/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/aws/aws-sdk-go-v2/service/sso v1.33.2 h1:zMP1FDFE08L7sM5f1QqkH/ZgKKg8Uc0Dz7KhSSYqWkw=
+github.com/aws/aws-sdk-go-v2/service/sso v1.33.2/go.mod h1:0LoIZSUKjdo2BleHfT1hv/jlD33LQS00IrBlzoUsoUQ=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.2 h1:9eTqUYl+SyVmaRPMyBXSO9wwqC6TRwZB82pKENK2hdQ=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.2/go.mod h1:DThweuz22kiLc7lGHop5vQ9c3bx5W6Azs/YqSHa2fu8=
+github.com/aws/aws-sdk-go-v2/service/sts v1.45.2 h1:EJd8vZO3E8SE6nmPqxuxlQ1NeSb8as50sf6eGdV4Saw=
+github.com/aws/aws-sdk-go-v2/service/sts v1.45.2/go.mod h1:OgpPvKzsO2Ranjpli/20djMkg6UrV5mw4W3pZpq1Mqo=
+github.com/aws/smithy-go v1.27.5 h1:d1ro7KpYOYwP6m73YFa+Kc/A130VsAdX68SpsJwARMM=
+github.com/aws/smithy-go v1.27.5/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
 github.com/aymanbagabas/go-udiff v0.4.1 h1:OEIrQ8maEeDBXQDoGCbbTTXYJMYRCRO1fnodZ12Gv5o=
@@ -345,8 +345,8 @@ github.com/coder/guts v1.7.0 h1:TaZ/PR9wgN8dlbcckaWV1MxkkuEFZRwSRwBBEm8dYXs=
 github.com/coder/guts v1.7.0/go.mod h1:30SShdvpmsauNlsNjECRB5AppScjYk08rf2ZVpH3MFg=
 github.com/coder/gvisor v0.0.0-20260313164934-7a658db7b714 h1:j7tyq3rv0ZXkbyy/BE5K3lYiIqEsV8sDTiTjpLLxjiw=
 github.com/coder/gvisor v0.0.0-20260313164934-7a658db7b714/go.mod h1:sxc3Uvk/vHcd3tj7/DHVBoR5wvWT/MmRq2pj7HRJnwU=
-github.com/coder/openai-go/v3 v3.0.0-20260708125056-3633b71968f7 h1:YEThquYyw8RkFRojQdrGIYUQ4juXvsUNFfx1ZN9II+U=
-github.com/coder/openai-go/v3 v3.0.0-20260708125056-3633b71968f7/go.mod h1:cdufnVK14cWcT9qA1rRtrXx4FTRsgbDPW7Ia7SS5cZo=
+github.com/coder/openai-go/v3 v3.0.0-20260810175933-92b5addb22d2 h1:84CQp2XsKlhthzgSmAJXJCYqOu3eHS/CWPSDTNFdY24=
+github.com/coder/openai-go/v3 v3.0.0-20260810175933-92b5addb22d2/go.mod h1:Ogjo0gDct+Jm7yCqaCjLGQGygeV8xNfNHV1/yKvCji0=
 github.com/coder/pq v1.10.5-0.20250807075151-6ad9b0a25151 h1:YAxwg3lraGNRwoQ18H7R7n+wsCqNve7Brdvj0F1rDnU=
 github.com/coder/pq v1.10.5-0.20250807075151-6ad9b0a25151/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/coder/pretty v0.0.0-20230908205945-e89ba86370e0 h1:3A0ES21Ke+FxEM8CXx9n47SZOKOpgSE1bbJzlE4qPVs=
@@ -1188,8 +1188,8 @@ github.com/testcontainers/testcontainers-go/modules/localstack v0.40.0/go.mod h1
 github.com/tetratelabs/wazero v1.12.0 h1:DuWcpNu/FzgEXgGBDp8J1Spc+CWOvvtvVyjKlaZopYU=
 github.com/tetratelabs/wazero v1.12.0/go.mod h1:LvKtzl2RqO4gyF27BiXU+nKAjcV8f38U+kP/q2vgxh0=
 github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
-github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=
-github.com/tidwall/gjson v1.18.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/gjson v1.19.0 h1:xwxm7n691Uf3u5OFjzngavjGTh55KX5q/9w9xHW88JU=
+github.com/tidwall/gjson v1.19.0/go.mod h1:V37/opeE/JbLUOfH0QTXiNez2l0RUjYUhpT4szFQAfc=
 github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
 github.com/tidwall/match v1.2.0 h1:0pt8FlkOwjN2fPt4bIl4BoNxb98gGHN2ObFEDkrfZnM=
 github.com/tidwall/match v1.2.0/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=