GeezerVison

read_template reported template_version_parameters.default_value, which is
the default evaluated at template import. Templates whose defaults depend
on the workspace owner (for example a region chosen from the owner's
groups) therefore showed a default the owner never receives, and the
chat agent created workspaces in the wrong region while believing it had
the default.

Render the active version's parameters through dynamicparameters for the
chat owner with no inputs, which is the form state the owner sees on the
create page, and report those defaults. Fall back to the import-time rows
when no renderer is configured or evaluation fails, and say which source
was used in a parameters_note. Always report mutable so immutable
parameters are explicit.

…red defaults

UAT of the owner-evaluated read_template found four gaps:

- A parameter whose owner-evaluated default fails its own validation
  (for example a value outside the option set) carries the error only in
  the parameter's diagnostics, so it was reported as a usable default and
  create_workspace then rejected the build. Report an error for that
  parameter instead of a default and log a warn naming it.
- Versions imported by a provisioner that predates dynamic parameters
  render statically, so import-time defaults were labelled as evaluated
  for the owner. Detect the provisioner version up front and use the
  import-defaults note.
- A still-importing active version returned an empty list under the
  generic import note. Say the import has not finished and to retry.
- Defaults that only resolve on the provisioner at build time were
  dropped. Show the import-time value with a note saying why.

The template version, job, and terraform values loaded for these checks
are passed into dynamicparameters.Prepare so the hot path issues no extra
queries.

…oken defaults

preview tags every required parameter rendered without a value with an
error diagnostic coded "required". read_template treated that like any
other parameter error, so ordinary required parameters showed an error
key and every read of such a template logged a warn, hiding the genuinely
broken-default case. Skip the required diagnostic, and never synthesize
an import-time default for a required parameter.

…valuation

chatRenderTemplateParameters re-implemented the readiness and legacy
provisioner checks that Prepare already performs, and signalled both
through chattool-owned sentinel errors. It now authorizes as the owner
like the other chat hooks and just calls Prepare, which selects the
static renderer for legacy versions and returns
dynamicparameters.ErrTemplateVersionNotReady while importing.

read_template now skips owner evaluation for templates using the classic
parameter flow, because wsbuilder resolves those builds from the import
rows. The tool description points the model at parameters_note, the
per-call warning for invalid owner defaults is gone, and the required
diagnostic code comes from preview types.

A coderd-level test drives the hook with a plain context against an
owner-derived default and a still-importing version.

chatgpt-codex-connector Bot left a comment

… cannot evaluate

preview reports a module it cannot load as a module_not_loaded warning
and omits every parameter that module declares, so read_template
replaced the complete import rows with the incomplete render. The
missing parameters are now appended from the import rows with the
build-time default note, mirroring dynamicparameters.incompleteRender.

An option whose value preview cannot know rendered as an empty string.
It now takes the value recorded at import by option name, with an
options_note, and is omitted when no import value exists.

chatgpt-codex-connector Bot left a comment

…e from the import row

Option labels can depend on the owner, so recovering an unknown option
value by its evaluated label missed the import row and dropped the
option. A validation bound preview cannot evaluate comes back nil, the
same as an absent one, and was silently omitted although the
provisioner enforces it at build time.

renderedParameterEntry now omits whatever preview could not evaluate
and fills default, options, and validation bounds from the import row
in one place, each with a note naming the source. A partially unknown
option list is replaced as a whole.

chatgpt-codex-connector Bot left a comment

…be prebuild matching

renderedOptions treated an empty rendered list as unknown, so a
parameter whose option blocks evaluate to nothing for this owner was
filled with the importer's options. An empty list is now a known result
and is left alone.

The build-values note claimed a build matches a preset by the resolved
values. wsbuilder records the preset that way, but workspace creation
claims a prebuilt workspace from the raw request values only, so an
agent relying on defaults misses the prebuild. The note now tells the
model to pass preset_id or the preset's parameter values.

chatgpt-codex-connector Bot left a comment

…lds from the import row

read_template filled a default, option list, or validation bound that
preview could not evaluate for the owner from the import-time row. Preview's
output carries no signal that distinguishes those from fields that evaluate
to null for this owner: a default that depends on data.coder_provisioner and
a default that is null for the owner both render as Valid false with no
diagnostic, a null validation bound is a nil pointer like an absent one (an
unknown bound panics preview and fails the whole render, which already falls
back to import rows), and a wholly unknown dynamic option set renders as an
empty list with no diagnostic. Every fill therefore guessed on one side of
that line, and each review round found the counterexample on the other.

Show these fields exactly as preview evaluates them, as the create-workspace
form does. An option whose value is unknown is omitted rather than shown
empty, and preview's invalid-options error is already surfaced as error. A
non-required parameter whose default could not be evaluated gets a
default_note saying so instead of a borrowed value. The module_not_loaded
whole-parameter fill stays: its diagnostic code is the signal wsbuilder also
keys on.

chatgpt-codex-connector Bot left a comment

The build-defaults note promised the values a build uses when a parameter
is omitted, but a default that depends on another parameter is re-evaluated
against the values create_workspace passes. Say so, and scope the promise
to a request that omits every parameter.

Import rows carry no module provenance, so the module_not_loaded fill also
restores root-level rows the render omitted for this owner. Label every
restored row as an import-time estimate instead of noting only its default.

… preset note

Report a parameter error only for an evaluated default. With no default,
preview and the static renderer validate an empty value, so a required
parameter with a validation block, or an optional one whose default could
not be evaluated, was reported as broken.

Log only diagnostic codes when evaluation falls back, since diagnostic text
can quote owner attributes seeded into the render, and skip the warning when
the context was cancelled.

Qualify the build defaults note for presets matched without a preset_id and
for claimed prebuilt workspaces, which keep their own parameter values.

…ate-owner-params

# Conflicts:
#	coderd/export_test.go