GeezerVison

Make this change globally. I'm not sure if what you committed here works with beta-docs, but I know the format in Get Started works, so use that for now.

I avoid using the word "old" or any of its derivatives, as it can be considered ageist.

If this error is explicit enough we do not need to mention this as we already mention minimum required coder version at top.

Done in 14037c4. I removed the line, and the requirement at the top (now v2.39) stays.

Posted by Superblink on behalf of @nickvigilante.

I think the end user won't need to know that they are using Agent Relay. So we should repurpose this for Admins on how they can configure Slack to work with Agent Relay managed pools/environments.

Agreed. In 106dd12 the page is retitled "Configure Slack for Agent Relay" everywhere (frontmatter, manifest, and links), and the intro says it's for admins and that developers don't need to know Agent Relay is involved. I kept the lifecycle bullets because they describe how many workspaces get created, which admins need for sizing. Let me know if you'd cut more.

Generated by Coder Agents on behalf of @nickvigilante.

@dluman IIrC we have not tested or validated repo scoped pools yet.

@matifali @dluman Since repository-scoped pools haven't been validated, my proposal for beta is to remove the repository-scoped guidance from cursor.md (the pool-type table, the repository-scoped list, and the two related troubleshooting rows) and the repo_url table in slack.md. In configuration.md, repo_url would either get a "not yet validated" note or be removed. Does that work for you, or would you rather keep it with a caution callout? I'll hold this change until you weigh in.

Generated by Coder Agents on behalf of @nickvigilante.

@nickvigilante — given our lack of validation here and the messaging that gives, I'm in favor of removing it.

Removed in 14037c4, per this thread. Repository-scoped guidance is gone from cursor.md and slack.md, and repo_url is out of configuration.md. The reserved parameter name agent_relay_cursor_repo_url stays listed, since Agent Relay still reserves it.

Posted by Superblink on behalf of @nickvigilante.

Should we link to External auth docs and how to configure the GitHub External auth here?

Added in 106dd12 to the Cursor credentials list and the Claude Code source control section. One detail from the code: since #26314 (v2.35), coderd refuses to create a workspace when the owner hasn't linked a required external auth provider, and that includes API-created workspaces. So the docs say a non-optional provider blocks Agent Relay from serving that developer's session. Claude Tag channel sessions still need credentials from the template.

Generated by Coder Agents on behalf of @nickvigilante.

Does it matter for jq commands that this is true? Do we need to provide guidance that something like jq -Rsc 'sub("^[^{]*"; "") | fromjson | ...' to work around all startup failures?

Or, and I am open to this, does it not matter?

Good catch, and it was worse than this: the JSON sink nests fields under fields, so the old example never matched anything. In 106dd12 the example uses jq -R with fromjson?, which skips non-JSON startup lines without the slurp-and-strip workaround, and the page now explains the record shape.

Generated by Coder Agents on behalf of @nickvigilante.

Just session_id might miss failures. Should we trace by session_uuid?

Yes. The poller logs both session_id and session_uuid, but the reaper's failure path logs only session_uuid (serviceclaudecoderunners/reap.go:79). In 106dd12 the example matches either one, and the correlation section and symptom table call out session_uuid for Claude Code.

Generated by Coder Agents on behalf of @nickvigilante.

Add a restart step? The Relay needs to be restarted.

Agreed. Pool secrets reach the pod as environment variables and aren't reloaded. In 106dd12 the row now says to restart Agent Relay (kubectl rollout restart or restart the container), and both provider pages' Step 3 says that secrets are read only at startup.

Generated by Coder Agents on behalf of @nickvigilante.

job_error in the Agent Relay log (independent of the workspace's build log via coderd) also provides detail.

Agreed. Agent Relay deletes the workspace after a failed build, so job_error on the workspace build failed line is the easier place to start (workspacedispatcher/dispatcher.go:675). In 106dd12 this row in both provider pages and the monitoring.md checklist now point there first.

Generated by Coder Agents on behalf of @nickvigilante.

Because these sessions might happen at a higher velocity -- if we're retooling this for admins -- adding Terraform guidance about keeping this template away from build quota (daily_cost) would make this issue more visible.

Added in 106dd12 as a setup step: every channel session's workspace belongs to the one claude_tag_channel_user, so they all draw on a single quota budget. The step says to leave daily_cost off the Tag template, or to give that user a group allowance that covers the expected concurrency.

Generated by Coder Agents on behalf of @nickvigilante.

@matifali -- will this fail without passing the service account's session token?

Will defer to @Emyrk

It would fail at startup. The session token is a required option, and Agent Relay checks it against coderd before it serves anything (servicecoderd/coderd.go). The docker run in setup Step 5 passes it, but the snippet didn't say so. In 106dd12 both provider pages now say to pass the pool secret alongside CODER_AGENT_RELAY_CODERD_SESSION_TOKEN and link to the Docker install.

While checking this, I found that the code also accepts a coderSessionToken YAML key, though it discourages it. So 106dd12 drops our "no YAML key" claim and just says to use the environment variable.

Generated by Coder Agents on behalf of @nickvigilante.

make it 2.39

Done in 14037c4. The index and setup requirements now say v2.39 or later.

Posted by Superblink on behalf of @nickvigilante.

link to this page https://registry.coder.com/modules?search=tag%3Aagent-relay

Done in 14037c4. The module requirement now links to the registry's agent-relay tag search.

Posted by Superblink on behalf of @nickvigilante.

Help chart is just a method to install we should not say that Kubernetes cluster is needed because of helm chart. The comment is about choice of words here.

Reworded in 14037c4 to "Somewhere to run the Agent Relay container, such as a Kubernetes cluster or a Docker host" (same idea in setup's prerequisites), so Helm reads as an install method, not a requirement.

Posted by Superblink on behalf of @nickvigilante.

Should we separate Slack instructions for each provider?

The page already has one H2 per provider ("Claude Tag channel sessions" and "Cursor in Slack"), each with its own setup and lifecycle sections. Only the intro ownership table and the troubleshooting table are shared. Options: keep one page as is, split it into two Slack pages, or move each section into its provider page. I'd keep one page, since the intro table is the main thing admins compare, but holding this until we agree on a direction.

Posted by Superblink on behalf of @nickvigilante.

Are we proposing these as alternatives? pools is not a coder native term.
We should say one relay per deployment or one relay per organization.

Rewritten in 14037c4 as two layouts: one relay per deployment, or one relay per organization (each with its own service account and provider credentials). The hard rule, never give two relays the same provider credentials, is now a separate sentence and doesn't use "pools".

Posted by Superblink on behalf of @nickvigilante.

have we verified the GitHub Enterprise server part? @dluman?

@dluman can you confirm? I couldn't verify GitHub Enterprise Server support from the code. If it hasn't been tested with Agent Relay, we can keep Anthropic's requirement but say our testing covered github.com only.

Posted by Superblink on behalf of @nickvigilante.

We haven't; the Coder implementation testing this rests only on the Github app. We might remove enterprise reference here, as that doesn't necessarily have an effect on repository visibility if an admin has the ability to manage Github org. permissions from the app.

Thanks. In 699c041 I removed GitHub Enterprise Server from the requirements, the network list, and this line, so the page covers only the Claude GitHub app.

Generated by Coder Agents on behalf of @nickvigilante.

isn't it wrong to say Coder does not provide them? We should say Coder supplies them but a template admin needs to configure the template to inject those credentials.

Agreed. Reworded in 14037c4 in claude-code.md, cursor.md, and setup.md: Coder can supply each developer's credentials through external authentication, but a template admin must configure the template to provide them.

Posted by Superblink on behalf of @nickvigilante.

instead use additional-args input of the module and pass --configure-git --push-outcome-on-release
Please verify flag names.

Done in 14037c4. I checked the names against Anthropic's self-hosted environments reference: --configure-git (SELF_HOSTED_RUNNER_CONFIGURE_GIT) and --push-outcome-on-release (SELF_HOSTED_RUNNER_PUSH_OUTCOME_ON_RELEASE). The module input is additional_args, a list with one element per argument. The Slack Tag lifecycle table uses the same pattern, and I added Anthropic's advice to restrict pushes to claude/* before turning on push-on-release.

Posted by Superblink on behalf of @nickvigilante.

Where are we talking about the per user credentials that are injected via Coder external auth and GIT_ASKPASS

Added in 14037c4. Coder external authentication is now the first row of the Git access table, and the paragraph below it explains that declaring the provider with data "coder_external_auth" makes the agent set GIT_ASKPASS, so Git over HTTPS uses the session owner's linked token with no credential in the image. cursor.md uses the same wording.

Posted by Superblink on behalf of @nickvigilante.

should this be all separate subheading we can link to instead of a table? or an FAQ?

Converted in 14037c4. The troubleshooting tables in claude-code.md and cursor.md are now one H3 per symptom, so each is linkable. slack.md and monitoring.md still use tables. Happy to convert those too if this format works.

Posted by Superblink on behalf of @nickvigilante.

We should have a docs rule on when we should use Tables over headings.
cc: @nickvigilante

I don't know that the upgrade path will allow these modules to work without the --dangerous... build parameter set. I'm in favor of mandating a full cut-over to modules 1.0.0 here in the same window.

The take-away for me is that 2.39's secrets are a must run for us on this feature.

Agreed. In 699c041 this is now a single cut-over: upgrade Coder to 2.39, grant the new permissions, convert Cursor idle_release_timeout values, upgrade Agent Relay, and update every template to 1.0.0 in the same maintenance window. I removed the "keep working until you move them" and rollback sentences, didn't document --dangerous-allow-parameter-credential-transport (it has no effect on 2.39 anyway), and pointed early access customers to Coder for help.

Generated by Coder Agents on behalf of @nickvigilante.

Should we mention that 0 indicates "never release?"

Yes, added in 699c041: "0 still turns off idle release."

Generated by Coder Agents on behalf of @nickvigilante.