feat: add --aigateway-proxy-target flag by pawbana · Pull Request #27122 · coder/coder

pawbana · 2026-07-09T11:34:14Z

Adds --aigateway-proxy-target option to deploymentGroupAIGatewayProxy that defines URL to which intercepted requests should be forwarded to.
Forward URL used to be hardcoded to coderAPI.AccessURL pointing to embedded Gateway. With addition of standalone AI Gateway this needs to be configurable.

Renamed aibridgeproxyd.Server.coderAccessURL and coderAccessPort -> gatewayURL and gatewayPort + option to better reflect reality.

linear-code · 2026-07-09T11:34:18Z

AIGOV-319

pawbana · 2026-07-09T11:34:32Z

feat: add --aigateway-proxy-target flag #27122 👈 (View in Graphite)
feat: setup logging, tracing and metrics in standalone AI Gateway #27068
feat: add /healtz and /readyz endpoints to standalone Gateway #26988
feat: add ai-gateway start command #26605 : 2 other dependent PRs (#26746 , #26797 )
Revert "chore: hide AI Gateway key management UI/CLI/API (#26879)" #26913
main

This stack of pull requests is managed by Graphite. Learn more about stacking.

github-actions · 2026-07-09T11:34:52Z

Docs preview

📖 View docs preview for docs/ai-coder/ai-gateway/ai-gateway-proxy/setup.md

pawbana · 2026-07-09T14:05:02Z

/coder-agents-review

coder-agents-review · 2026-07-09T14:05:06Z

Chat: Review posted | View chat
Requested: 2026-07-09 16:30 UTC by @pawbana
Spend: $57.43 / $100.00

Review history

R1 (2026-07-09): 16 reviewers, 4 Nit, 2 P2, 5 P3, COMMENT. Review
R2 (2026-07-09): 5 reviewers, 6 Nit, 2 P2, 7 P3, COMMENT. Review

deep-review v0.9.0 | Round 2 | 3e85cfb..826ef6a

Last posted: Round 2, 15 findings (2 P2, 7 P3, 6 Nit), COMMENT. Review

Finding inventory

Findings

#	Sev	Status	Location	Summary	Round	Reviewer	Posted
CRF-1	P2	Author fixed (`826ef6a`)	enterprise/cli/aigatewaystart.go:158	Double-nested logger name produces ai-gateway.ai-gateway prefix	R1	Netero P3, Mafu-san P2, Meruem Nit	Yes
CRF-2	P2	Author fixed (`826ef6a`)	codersdk/deployment.go:2128	Flag --aigateway-proxy-target breaks ai-gateway-proxy-* naming convention	R1	Kite P3, Mafuuu P2, Ryosuke P2, Knov P2	Yes
CRF-3	P3	Author fixed (`826ef6a`)	enterprise/aibridgeproxyd/aibridgeproxyd.go:344	MITM used as predicate adjective is ungrammatical in 7 instances	R1	Gon P3, Leorio P2	Yes
CRF-4	P3	Author fixed (`826ef6a`)	enterprise/aibridgeproxyd/aibridgeproxyd_test.go:296	No proxy test exercises GatewayURL with a path prefix	R1	Hisoka P3, Meruem P3, Kite Note, Knov Note	Yes
CRF-5	P3	Author fixed (`826ef6a`)	cli/server.go:2806	ConfigureTraceProviderWithService doc comment restates signature	R1	Gon P2, Leorio P3	Yes
CRF-6	P3	Author fixed (`826ef6a`)	enterprise/aibridgeproxyd/aibridgeproxyd.go:974	url.JoinPath preserves gatewayURL query params then line 984 silently overwrites them	R1	Hisoka	Yes
CRF-7	P3	Author contested; panel closed R2 (5/5 accept)	enterprise/cli/aigatewaystart.go:292	--verbose / CODER_AI_GATEWAY_VERBOSE removed without mention in PR description	R1	Mafu-san	Yes
CRF-8	Nit	Author fixed (`826ef6a`)	enterprise/cli/aigatewaystart.go:306	gatewayMiddleware doc first sentence restates function name	R1	Gon	Yes
CRF-9	Nit	Author fixed (`826ef6a`)	enterprise/cli/aigatewaystart.go:316	newGatewayMux doc first sentence restates function name	R1	Gon	Yes
CRF-10	Nit	Author fixed (`826ef6a`)	enterprise/cli/aigatewaystart.go:145	5*time.Second tracing shutdown timeout is an inline magic number	R1	Gon	Yes
CRF-11	Nit	Author fixed (`826ef6a`)	enterprise/aibridgeproxyd/aibridgeproxyd.go:970	Log message uses Go field name gatewayURL instead of user-facing concept	R1	Leorio	Yes
CRF-12	P3	Open	enterprise/aibridgeproxyd/aibridgeproxyd.go:504	GatewayURL() doc claims normalized port but returned URL has no port normalization	R2	Gon P3, Razor Nit	Yes
CRF-13	P3	Open	enterprise/aibridgeproxyd/aibridgeproxyd.go:121	Server doc and internal names still say aibridged but destination is now configurable gateway	R2	Razor P3, Gon Nit	Yes
CRF-14	Nit	Open	cli/server.go:2812	ConfigureTraceProviderWithService doc fix was cosmetic, still restates signature	R2	Gon	Yes
CRF-15	Nit	Open	enterprise/aibridgeproxyd/aibridgeproxyd.go:807	isBlockedIP comment says its own deployment but exempted host may be external gateway	R2	Razor	Yes

Contested and acknowledged

CRF-7 (P3, enterprise/cli/aigatewaystart.go:292) - --verbose removal not documented

Finding: The --verbose flag and CODER_AI_GATEWAY_VERBOSE env var were removed and replaced by inherited clilog options without mention in the PR description. Operators using CODER_AI_GATEWAY_VERBOSE=true would silently lose debug logging.
Author defense: "this command was not release yet, it is ok to change flags." The command is unreleased, so no operators are affected and no migration path is needed.
Panel closure (R2, 5/5): All five panelists (Mafuuu, Bisky, Pariston, Gon, Razor) verified the command is unreleased and accepted the defense. Zero operators affected, zero backward-compatibility obligation.

Round log

Round 1

Panel (16 reviewers). 2 P2, 5 P3, 4 Nit. Reviewed against 344a977..45205a1.

Round 2

Panel (5 reviewers). 10 R1 findings fixed, CRF-7 contested and closed (5/5). 2 P3, 2 Nit new. Reviewed against 3e85cfb..826ef6a.

About deep-review

CRF = Coder Review Finding (P0-P4, Nit, Note)

Reviewer	Focus
Bisky	tests
Chopper	ops/errors
Churn-guard	change verification
Ging	language modernization
Gon	naming
Hisoka	edge cases
Killua	perf
Kite	change integrity
Knov	contracts
Knuckle	SQL
Komugi	flake/determinism
Kurapika	security
Law	decomposition
Leorio	docs
Luffy	product
Mafu-san	process
Mafuuu	contracts
Melody	dispatch/pairing
Meruem	structural
Nami	frontend
Netero	mechanical checks
Pariston	premise testing
Pen-botter	product gaps
Razor	verification
Robin	duplication
Ryosuke	Go arch
Takumi	concurrency
Zoro	shape

🤖 Managed by Coder Agents.

coder-agents-review

Clean architecture: the proxy target extraction and StartHTTPSpan refactor push deployment-topology knowledge to the configuration edge, keeping the proxy itself generic. The option inheritance guard (TestAIGatewayStart_InheritedOptions) is the best test in the PR: it prevents silent drift by forcing every new option in the source groups to be explicitly classified. The tracing middleware tests verify ordering invariants. Good work.

Severity count: 2 P2, 5 P3, 4 Nit.

The two P2s deserve attention before merge: the flag naming (--aigateway-proxy-target vs the group convention --ai-gateway-proxy-*) ships a permanent public API surface that requires a deprecation cycle to rename, and the double-nested logger (ai-gateway.ai-gateway) affects every log line from the standalone gateway.

"I tried to construct a scenario where the stated problem exists but the fix does not help. The only case I found: if the operator sets --aigateway-proxy-target to a standalone gateway URL that already serves at /api/v2/ai-gateway/, the URL construction would double the prefix. But this is standard URL configuration behavior, not a design flaw." (Pariston)

Process note: The PR title says "add --aigateway-proxy-target flag" but the diff also wires structured logging (replacing --verbose), OpenTelemetry tracing, Prometheus metrics, refactors option inheritance, and extracts StartHTTPSpan. The individual commit messages are clear, but a squash merge loses that context. The --verbose removal is a breaking change for operators using CODER_AI_GATEWAY_VERBOSE=true and should be documented in the PR body.

🤖 This review was automatically generated with Coder Agents.

pawbana · 2026-07-09T16:30:30Z

/coder-agents-review

coder-agents-review

All 11 R1 findings addressed. 10 fixed cleanly, CRF-7 (--verbose removal) contested and closed by panel vote (5/5 accept: unreleased command, zero operators affected). The CRF-6 fix (query param rejection at startup) is particularly well done: prevents bad state rather than handling it at runtime.

Two new P3s and two Nits from the R2 panel, all documentation/naming consistency.

"The system-level consequence of the defended behavior: zero. No migration path is needed for a flag that was never exposed to users." (Razor, on CRF-7)

Severity count this round: 2 P3, 2 Nit.

🤖 This review was automatically generated with Coder Agents.

coder-tasks · 2026-07-13T09:21:27Z

Documentation Check

Updates Needed

docs/ai-coder/ai-gateway/ai-gateway-proxy/setup.md - The new --ai-gateway-proxy-target / CODER_AI_GATEWAY_PROXY_TARGET option (YAML ai_gateway_proxy.target) makes the proxy's forward target configurable. Addressed in 04a3e54: a new Proxy target section documents the option, its default (<coderd-access-url>/api/v2/ai-gateway), and the standalone/non-embedded case; the Security Considerations and Troubleshooting sections were updated to reference the configurable target, and the documented routing MITM request to AI Gateway log line matches the renamed code.

Note: the auto-generated docs/reference/cli/server.md and docs/reference/api/* entries for this option are already regenerated in the PR; no action needed there.

Automated review via Coder Agents

ssncferreira · 2026-07-14T12:18:49Z

+--ai-gateway-proxy-target=https://ai-gateway.example.com/
+```
+
+The target is used as-is: the proxy appends only the provider and request path to it, and the URL must not include query parameters.


Nice ✍️

ssncferreira · 2026-07-14T12:28:32Z


 	// Configure upstream proxy for tunneled (non-provider-host) CONNECT requests.
-	// Provider-host domains are MITM'd and forwarded to aibridge directly,
+	// Provider-host domains are intercepted and forwarded to AI Gateway directly,


I would prefer to keep MITM here as well as in the other comments that were replaced. Even though intercepted is correct, it could be considered for both MITM and tunneled requests, since the proxy "intercepts" all requests. MITM is the right term and is used elsewhere, including documentation, configuration values and in other places in the code.

changed back to MITM in: fd37ec9

ssncferreira

LGTM 👍 just some MITM renames missing in reload_test.go

ssncferreira · 2026-07-14T16:05:40Z


 // requestResult is the outcome of sending a request through the proxy.
-// Either err is set (CONNECT failed for a non-MITM'd host whose dial
+// Either err is set (CONNECT failed for a non-intercepted host whose dial


MITM in this file as well 👀

sorry about that 😞
fixed in: 5cde37c

pawbana mentioned this pull request Jul 9, 2026

feat: add /healtz and /readyz endpoints to standalone Gateway #26988

Merged

github-actions Bot assigned pawbana Jul 9, 2026

pawbana mentioned this pull request Jul 9, 2026

feat: setup logging, tracing and metrics in standalone AI Gateway #27068

Merged

pawbana force-pushed the pawel/aigov-319-add-aigateway-proxy-target-flag-to-ai-gateway-proxy branch from b2b5847 to 45205a1 Compare July 9, 2026 13:47

Base automatically changed from pawel/aigov-317-add-observability-to-standalone-ai-gateway to main July 9, 2026 14:02

pawbana requested review from ssncferreira and removed request for ssncferreira July 9, 2026 14:04

coder-agents-review Bot reviewed Jul 9, 2026

View reviewed changes

pawbana force-pushed the pawel/aigov-319-add-aigateway-proxy-target-flag-to-ai-gateway-proxy branch 2 times, most recently from 0d8b072 to 826ef6a Compare July 9, 2026 16:28

coder-agents-review Bot reviewed Jul 9, 2026

View reviewed changes

Comment thread enterprise/aibridgeproxyd/aibridgeproxyd.go Outdated

Comment thread enterprise/aibridgeproxyd/aibridgeproxyd.go Outdated

Comment thread cli/server.go Outdated

Comment thread enterprise/aibridgeproxyd/aibridgeproxyd.go Outdated

pawbana force-pushed the pawel/aigov-319-add-aigateway-proxy-target-flag-to-ai-gateway-proxy branch from f5c52f9 to 18a735f Compare July 13, 2026 09:07

pawbana marked this pull request as ready for review July 13, 2026 09:07

pawbana requested a review from ssncferreira July 13, 2026 09:07

ssncferreira reviewed Jul 14, 2026

View reviewed changes

pawbana added 5 commits July 14, 2026 15:16

feat: add --aigateway-proxy-target flag

d9dc6e4

agentic review 1

03668c8

agentic review 2

af93dbe

documentation changes

228de08

review 1: flag description, MITM, fallback unit test

fd37ec9

pawbana force-pushed the pawel/aigov-319-add-aigateway-proxy-target-flag-to-ai-gateway-proxy branch from 2296a72 to fd37ec9 Compare July 14, 2026 15:16

pawbana requested a review from ssncferreira July 14, 2026 15:19

ssncferreira approved these changes Jul 14, 2026

View reviewed changes

review 2: more MITM reverts

5cde37c

pawbana enabled auto-merge (squash) July 14, 2026 16:35

pawbana merged commit 3126306 into main Jul 14, 2026
33 of 34 checks passed

pawbana deleted the pawel/aigov-319-add-aigateway-proxy-target-flag-to-ai-gateway-proxy branch July 14, 2026 16:40

github-actions Bot locked and limited conversation to collaborators Jul 14, 2026

Uh oh!

Conversation

pawbana commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

linear-code Bot commented Jul 9, 2026

Uh oh!

pawbana commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Docs preview

Uh oh!

pawbana commented Jul 9, 2026

Uh oh!

coder-agents-review Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Findings

Contested and acknowledged

CRF-7 (P3, enterprise/cli/aigatewaystart.go:292) - --verbose removal not documented

Round log

Round 1

Round 2

Uh oh!

coder-agents-review Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pawbana commented Jul 9, 2026

Uh oh!

coder-agents-review Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coder-tasks Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Documentation Check

Updates Needed

Uh oh!

Uh oh!

ssncferreira Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

ssncferreira Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

pawbana Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ssncferreira left a comment

Choose a reason for hiding this comment

Uh oh!

ssncferreira Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

pawbana Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

pawbana commented Jul 9, 2026 •

edited

Loading

pawbana commented Jul 9, 2026 •

edited

Loading

github-actions Bot commented Jul 9, 2026 •

edited

Loading

coder-agents-review Bot commented Jul 9, 2026 •

edited

Loading

coder-tasks Bot commented Jul 13, 2026 •

edited

Loading